26:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js","/_next/static/chunks/1w1axrg6kzses.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/1kn_tf3p-ubex.js","/_next/static/chunks/1wq095nwqbaw1.js"],"SampleDetailWrapper"] 73:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js"],"IconMark"] 25:T487,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Trojan.Generic Sample a58ffa444d65… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample a58ffa444d65…. Malware family: Trojan.Generic. Threat score 100/100. 6/25 AV engines flagged this file. 15 malicious and 16 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/a58ffa444d6514a0b092f8fa84c0a15853f5141c86abcbcf0c5b4dcc312aaf3c","keywords":["Malicious","Trojan.Generic","malware analysis","sandbox report","threat intelligence","a58ffa444d6514a0b092f8fa84c0a15853f5141c86abcbcf0c5b4dcc312aaf3c"],"about":{"@type":"SoftwareApplication","name":"wextract.exe","applicationCategory":["peexe","executable"],"identifier":"a58ffa444d6514a0b092f8fa84c0a15853f5141c86abcbcf0c5b4dcc312aaf3c","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Trojan.Generic","antivirusDetections":{"malicious":6,"total":25},"behavioralIndicators":{"malicious":15,"suspicious":16},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}27:T499,"wextract.exe" called "FindResourceA" with parameter "2226536" - (UID: 00000000-00003568) "wextract.exe" called "FindResourceA" with parameter "20452040" - (UID: 00000000-00003568) "wextract.exe" called "FindResourceA" with parameter "20452048" - (UID: 00000000-00003568) "wextract.exe" called "FindResourceA" with parameter "20452076" - (UID: 00000000-00003568) "cZ5oz01.exe" called "FindResourceA" with parameter "654044" - (UID: 00000000-00003316) "cZ5oz01.exe" called "FindResourceA" with parameter "3412680" - (UID: 00000000-00003316) "cZ5oz01.exe" called "FindResourceA" with parameter "3412812" - (UID: 00000000-00003316) "cZ5oz01.exe" called "FindResourceA" with parameter "3412688" - (UID: 00000000-00003316) "cZ5oz01.exe" called "FindResourceA" with parameter "3412716" - (UID: 00000000-00003316) "ZP6rv89.exe" called "FindResourceA" with parameter "1899324" - (UID: 00000000-00003028) "ZP6rv89.exe" called "FindResourceA" with parameter "19731144" - (UID: 00000000-00003028) "ZP6rv89.exe" called "FindResourceA" with parameter "19731152" - (UID: 00000000-00003028) "ZP6rv89.exe" called "FindResourceA" with parameter "19731180" - (UID: 00000000-00003028)28:T9fb,"wextract.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '20498512'}" (UID: 00000000-00003568) "wextract.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '20498544'}" (UID: 00000000-00003568) "wextract.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '20498528'}" (UID: 00000000-00003568) "cZ5oz01.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '3459040'}" (UID: 00000000-00003316) "cZ5oz01.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '3459152'}" (UID: 00000000-00003316) "cZ5oz01.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '3459184'}" (UID: 00000000-00003316) "cZ5oz01.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '3459168'}" (UID: 00000000-00003316) "ZP6rv89.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '19777616'}" (UID: 00000000-00003028) "ZP6rv89.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '19777648'}" (UID: 00000000-00003028) "ZP6rv89.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '19777632'}" (UID: 00000000-00003028) "ZP6rv89.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '19777600'}" (UID: 00000000-00003028) "1Pe57AQ7.exe" called "LoadResource with parameter {'hModule': '19267584', 'hResInfo': '20137256'}" (UID: 00000000-00003660) "1Pe57AQ7.exe" called "LoadResource with parameter {'hModule': '19267584', 'hResInfo': '20137272'}" (UID: 00000000-00003660) "1Pe57AQ7.exe" called "LoadResource with parameter {'hModule': '19267584', 'hResInfo': '20137096'}" (UID: 00000000-00003660) "1Pe57AQ7.exe" called "LoadResource with parameter {'hModule': '19267584', 'hResInfo': '20137304'}" (UID: 00000000-00003660) "1Pe57AQ7.exe" called "LoadResource with parameter {'hModule': '19267584', 'hResInfo': '20136952'}" (UID: 00000000-00003660) "1Pe57AQ7.exe" called "LoadResource with parameter {'hModule': '19267584', 'hResInfo': '20137288'}" (UID: 00000000-00003660) "1Pe57AQ7.exe" called "LoadResource with parameter {'hModule': '19267584', 'hResInfo': '20136968'}" (UID: 00000000-00003660) "1Pe57AQ7.exe" called "LoadResource with parameter {'hModule': '19267584', 'hResInfo': '20137112'}" (UID: 00000000-00003660) "1Pe57AQ7.exe" called "LoadResource with parameter {'hModule': '19267584', 'hResInfo': '20137320'}" (UID: 00000000-00003660) "1Pe57AQ7.exe" called "LoadResource with parameter {'hModule': '19267584', 'hResInfo': '20136984'}" (UID: 00000000-00003660)29:T866,Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; File: "wextract.exe") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; File: "wextract.exe") Found reference to API "LoadLibraryExA" (Indicator: "LoadLibrary"; File: "wextract.exe") Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; File: "2cV9250.exe.1068760659") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; Source: "00000000-00001912.00000000.68222.00400000.00000040.mdmp, 00000000-00001912.00000001.70142.00400000.00000040.mdmp, 00000000-00001912.00000002.72061.00160000.00000040.mdmp") Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; Source: "00000000-00001912.00000000.68222.00400000.00000040.mdmp, 00000000-00001912.00000001.70142.00400000.00000040.mdmp, 00000000-00001912.00000002.72061.00160000.00000040.mdmp") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; Source: "00000000-00001912.00000000.68222.00400000.00000040.mdmp, 00000000-00001912.00000001.70142.00400000.00000040.mdmp, 00000000-00001912.00000002.72061.00160000.00000040.mdmp") Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; Source: "00000000-00001912.00000000.68222.00400000.00000040.mdmp, 00000000-00001912.00000001.70142.00400000.00000040.mdmp, 00000000-00001912.00000002.72061.00160000.00000040.mdmp") Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; Source: "00000000-00003028.00000001.68977.012DA000.00000002.mdmp") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; Source: "00000000-00003028.00000001.68977.012DA000.00000002.mdmp") Found reference to API "LoadLibraryExA" (Indicator: "LoadLibrary"; Source: "00000000-00003028.00000001.68977.012DA000.00000002.mdmp") Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; Source: "00000000-00003316.00000002.70823.0034A000.00000002.mdmp") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; Source: "00000000-00003316.00000002.70823.0034A000.00000002.mdmp") Found reference to API "LoadLibraryExA" (Indicator: "LoadLibrary"; Source: "00000000-00003316.00000002.70823.0034A000.00000002.mdmp")2a:Tcc4,"2cV9250.exe" called "CryptStringToBinaryA" with parameters {"pszString": "Mh+JCVywvTkSrKXwYMg70bKdVoOGzXoXDqwg4B8eWpRBcPx5Nd7JXGDJ1oQPrRW3x/M=" "cchString": "68" "dwFlags": "1" "pbBinary": "321f89095cb0bd3912aca5f060c83bd1b29d568386cd7a170eac20e01f1e5a944170fc7935dec95c60c9d6840fad15b7c7f3" "pcbBinary": "32000000" "$name": "C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\IXP002.TMP\\2cV9250.exe"} "2cV9250.exe" called "CryptStringToBinaryA" with parameters {"pszString": "KKQMiYuMe0ZGqeqdgnQHDMyIHX1p5VXU9eQ4/96xHF9TqQapq6xbZDCL0L22WAoG7Kg9XUuWMPbPxEyNq9QwUiKELKmrrhoiZJPK++MYdGnghRddScV19pCcGsX+6hFVCIQsqausAEtMicq9olQnLOyqeBNL33X2kI5anrLTfTRH1GDq4+AcLiPKjvzuGWJpqel3EwCIPbnXyDX1/pE8fwiELKmp6QFkfInI0OcAZkGt+3ZfZO919NXEGN+jnRFVCIQs" "cchString": "17104" "dwFlags": "1" "pcbBinary": "1c320000"} "2cV9250.exe" called "CryptStringToBinaryA" with parameters {"pszString": "KKQMiYuMe0ZGqeqdgnQHDMyIHX1p5VXU9eQ4/96xHF9TqQapq6xbZDCL0L22WAoG7Kg9XUuWMPbPxEyNq9QwUiKELKmrrhoiZJPK++MYdGnghRddScV19pCcGsX+6hFVCIQsqausAEtMicq9olQnLOyqeBNL33X2kI5anrLTfTRH1GDq4+AcLiPKjvzuGWJpqel3EwCIPbnXyDX1/pE8fwiELKmp6QFkfInI0OcAZkGt+3ZfZO919NXEGN+jnRFVCIQs" "cchString": "17104" "dwFlags": "1" "pbBinary": "28a40c898b8c7b4646a9ea9d8274070ccc881d7d69e555d4f5e438ffdeb11c5f53a906a9abac5b64308bd0bdb6580a06eca83d5d4b9630f6cfc44c8dabd4305222842ca9abae1a226493cafbe3187469e085175d49c575f6909c1ac5feea115508842ca9abac004b4c89cabda254272cecaa78134bdf75f6908e5a9eb2d37d3447d460eae3e01c2e23ca8efcee196269a9e9771300883db9d7c835f5fe913c7f08842ca9a9e901647c89c8d0e7006641adfb765f64ef75f4d5c418dfa39d115508842ca9abac004b4c89cabda254272cecaa78134bdf75f69b8f5a96b6d77e3a47c36deceae31e2e2acc8cf3e91b636ea9ee7a0d0e8e3bbad7c835f5fe913c7f08842ca9a9e901647c89c8d0e7006641adfb765f64ef75f4d5c418dfa39d115508842ca9abac004b4c89cabda254272cecaa78134bdf75f690835296badb7e2f4fc865eae3e8182928cd88fee010696ea9ed6d0d0e8125bcd7c835f5fe913c7f08842ca9a9e901647c89c8c9f0017478ecdf7c11058021f6f8ee18dffe913c7f55880183abac5b66668991908854272ceca83d5d49c730bad7de18ddb7d3723a42c06ae3e6e1103625c786ede7166c60a1e676120c8a3cbc9a825d9cfc9d115508842ca9abac5b6664cc90bfb8542558bee77331008b3ef6f8ee18dffe913c7f55880183abac5b66668991908854272ceca83d5d49c730bad7de18ddb8df763745cf64e1e6e7192c2dc28bffec106462a2e77a1c0e8a32b69b815d9cfc9d115508842ca9abac5b6664cc90bfb854255ea3e6741349b234b899814cddd3bb3c7f08842ca9f6a0764c6689cabda2547c01c6a83d5d49c575f4d5c65d91fc8b3c7d45c763e1e2e0152524cf8bf5e0196068a6e37f0d0c8836b79c8d5793b9d27b3a0a880183abac5b666689cabda0117d2ef6a83f3222bd77d9ffc418dffe913c2204a906a9abac5b6666d2e797a254272ceca83d5d4b803bf6cfc41a99b6d3733741c96dece7ee142e36c388ffee106462abeb731c198b31bb918e48ddf2bc167f08842ca9abac5b6423d3c8a7a2564565a2e9731e0cc516bc948d56df89d070334dd02e8481ac5b666689cae0ae790d2ceca83d5d499e58ded5c418dffe913c7f0ac162abb1ac592020c788f8ee126363a9e172150c8b3ebe9c865692bfd576364dcc66e1eae619646aa4e0bda254272ceca83d5f0c9f77eed5c66190acde757d25ae2ca9abac5b663b85e797a254272ceca8667063c575f4d5c418dffe9379310a9e2cabe1ee1f2729ca84f8eb1d6e62a1e27f17058234b89d875d93b9d3793545ca65eda9a0764c6689cabda254272ceeed675f53c5779a9c824c86fcbc167f08842ca9abf1574b4c89cabda2542777c1823d5d49c575f4d5c41a9ab093267f0ac56aebe8ee113624d98cfce6186c61a4e57e11018e30b19a80559eb3d27a33" "pcbBinary": "1c320000"}2b:T814d,Contains base64 string in header "POST" in header "POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: soupinterestoe.fun" Contains base64 string in header "/api" in header "POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: soupinterestoe.fun" Contains base64 string in header "Keep" in header "POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: soupinterestoe.fun" Contains base64 string in header "AliveContent" in header "POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: soupinterestoe.fun" Contains base64 string in header "Type" in header "POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: soupinterestoe.fun" Contains base64 string in header "form" in header "POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: soupinterestoe.fun" Contains base64 string in header "like" in header "POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: soupinterestoe.fun" Contains base64 string in header "POST" in header "POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedCookie: __cf_mw_byp=14QNW8Ja7sqHF79WoUD1smeKYX205dU1M2j6gN2sxUI-1702943900-0-/apiUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 47Host: soupinterestoe.fun" Contains base64 string in header "/api" in header "POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedCookie: __cf_mw_byp=14QNW8Ja7sqHF79WoUD1smeKYX205dU1M2j6gN2sxUI-1702943900-0-/apiUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 47Host: soupinterestoe.fun" Contains base64 string in header "Keep" in header "POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedCookie: __cf_mw_byp=14QNW8Ja7sqHF79WoUD1smeKYX205dU1M2j6gN2sxUI-1702943900-0-/apiUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 47Host: soupinterestoe.fun" Contains base64 string in header "AliveContent" in header "POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedCookie: __cf_mw_byp=14QNW8Ja7sqHF79WoUD1smeKYX205dU1M2j6gN2sxUI-1702943900-0-/apiUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 47Host: soupinterestoe.fun" Contains base64 string in header "Type" in header "POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedCookie: __cf_mw_byp=14QNW8Ja7sqHF79WoUD1smeKYX205dU1M2j6gN2sxUI-1702943900-0-/apiUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 47Host: soupinterestoe.fun" Contains base64 string in header "form" in header "POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedCookie: __cf_mw_byp=14QNW8Ja7sqHF79WoUD1smeKYX205dU1M2j6gN2sxUI-1702943900-0-/apiUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 47Host: soupinterestoe.fun" Contains base64 string in header "urlencodedCookie" in header "POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedCookie: __cf_mw_byp=14QNW8Ja7sqHF79WoUD1smeKYX205dU1M2j6gN2sxUI-1702943900-0-/apiUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 47Host: soupinterestoe.fun" Contains base64 string in header "/apiUser" in header "POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedCookie: __cf_mw_byp=14QNW8Ja7sqHF79WoUD1smeKYX205dU1M2j6gN2sxUI-1702943900-0-/apiUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 47Host: soupinterestoe.fun" Contains base64 string in header "like" in header "POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedCookie: __cf_mw_byp=14QNW8Ja7sqHF79WoUD1smeKYX205dU1M2j6gN2sxUI-1702943900-0-/apiUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 47Host: soupinterestoe.fun" Contains base64 string in header "POST" in header "POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=be85de5ipdocierre1Cookie: __cf_mw_byp=14QNW8Ja7sqHF79WoUD1smeKYX205dU1M2j6gN2sxUI-1702943900-0-/apiUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 500Host: soupinterestoe.fun" Contains base64 string in header "/api" in header "POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=be85de5ipdocierre1Cookie: __cf_mw_byp=14QNW8Ja7sqHF79WoUD1smeKYX205dU1M2j6gN2sxUI-1702943900-0-/apiUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 500Host: soupinterestoe.fun" Contains base64 string in header "Keep" in header "POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=be85de5ipdocierre1Cookie: __cf_mw_byp=14QNW8Ja7sqHF79WoUD1smeKYX205dU1M2j6gN2sxUI-1702943900-0-/apiUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 500Host: soupinterestoe.fun" Contains base64 string in header "AliveContent" in header "POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=be85de5ipdocierre1Cookie: __cf_mw_byp=14QNW8Ja7sqHF79WoUD1smeKYX205dU1M2j6gN2sxUI-1702943900-0-/apiUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 500Host: soupinterestoe.fun" Contains base64 string in header "Type" in header "POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=be85de5ipdocierre1Cookie: __cf_mw_byp=14QNW8Ja7sqHF79WoUD1smeKYX205dU1M2j6gN2sxUI-1702943900-0-/apiUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 500Host: soupinterestoe.fun" Contains base64 string in header "data" in header "POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=be85de5ipdocierre1Cookie: __cf_mw_byp=14QNW8Ja7sqHF79WoUD1smeKYX205dU1M2j6gN2sxUI-1702943900-0-/apiUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 500Host: soupinterestoe.fun" Contains base64 string in header "be85de5ipdocierre1Cookie" in header "POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=be85de5ipdocierre1Cookie: __cf_mw_byp=14QNW8Ja7sqHF79WoUD1smeKYX205dU1M2j6gN2sxUI-1702943900-0-/apiUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 500Host: soupinterestoe.fun" Contains base64 string in header "/apiUser" in header "POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=be85de5ipdocierre1Cookie: __cf_mw_byp=14QNW8Ja7sqHF79WoUD1smeKYX205dU1M2j6gN2sxUI-1702943900-0-/apiUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 500Host: soupinterestoe.fun" Contains base64 string in header "like" in header "POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=be85de5ipdocierre1Cookie: __cf_mw_byp=14QNW8Ja7sqHF79WoUD1smeKYX205dU1M2j6gN2sxUI-1702943900-0-/apiUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 500Host: soupinterestoe.fun" Contains base64 string in header "Keep" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "User" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "ocsp" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "digicert" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "Keep" in header "GET /DigiCertGlobalRootG3.crt HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: cacerts.digicert.com" Contains base64 string in header "User" in header "GET /DigiCertGlobalRootG3.crt HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: cacerts.digicert.com" Contains base64 string in header "digicert" in header "GET /DigiCertGlobalRootG3.crt HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: cacerts.digicert.com" Contains base64 string in header "2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP" in header "GET /gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "2FUsCEHe9DWzbNvka6iEPxPBY0w0" in header "GET /gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "Keep" in header "GET /gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "User" in header "GET /gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "ocsp" in header "GET /gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "goog" in header "GET /gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "Keep" in header "GET /gtsr1/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBQwkcLWD4LqGJ7bE7B1XZsEbmfwUAQU5K8rJnEaK0gnhS9SZizv8IkTcT4CDQIDvFNZazTHGPUBUGY%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "User" in header "GET /gtsr1/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBQwkcLWD4LqGJ7bE7B1XZsEbmfwUAQU5K8rJnEaK0gnhS9SZizv8IkTcT4CDQIDvFNZazTHGPUBUGY%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "ocsp" in header "GET /gtsr1/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBQwkcLWD4LqGJ7bE7B1XZsEbmfwUAQU5K8rJnEaK0gnhS9SZizv8IkTcT4CDQIDvFNZazTHGPUBUGY%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "goog" in header "GET /gtsr1/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBQwkcLWD4LqGJ7bE7B1XZsEbmfwUAQU5K8rJnEaK0gnhS9SZizv8IkTcT4CDQIDvFNZazTHGPUBUGY%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "2BrkS7QYXjzkCEAz1vQYrVgL0erhQLCPM8GY" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAz1vQYrVgL0erhQLCPM8GY%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "Keep" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAz1vQYrVgL0erhQLCPM8GY%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "User" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAz1vQYrVgL0erhQLCPM8GY%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "ocsp" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAz1vQYrVgL0erhQLCPM8GY%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "digicert" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAz1vQYrVgL0erhQLCPM8GY%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "/gtsr1/gtsr1" in header "GET /gtsr1/gtsr1.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: crl.pki.goog" Contains base64 string in header "Keep" in header "GET /gtsr1/gtsr1.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: crl.pki.goog" Contains base64 string in header "User" in header "GET /gtsr1/gtsr1.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: crl.pki.goog" Contains base64 string in header "goog" in header "GET /gtsr1/gtsr1.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: crl.pki.goog" Contains base64 string in header "Keep" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEAx5qUSwjBGVIJJhX%2BJrHYM%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "User" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEAx5qUSwjBGVIJJhX%2BJrHYM%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "ocsp" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEAx5qUSwjBGVIJJhX%2BJrHYM%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "digicert" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEAx5qUSwjBGVIJJhX%2BJrHYM%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "Keep" in header "GET /gts1c3/moVDfISia2k.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: crls.pki.goog" Contains base64 string in header "User" in header "GET /gts1c3/moVDfISia2k.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: crls.pki.goog" Contains base64 string in header "crls" in header "GET /gts1c3/moVDfISia2k.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: crls.pki.goog" Contains base64 string in header "goog" in header "GET /gts1c3/moVDfISia2k.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: crls.pki.goog" Contains base64 string in header "Keep" in header "GET /gts1c3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEBZwXm7t3kKEEFjsmHQeLcQ%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "User" in header "GET /gts1c3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEBZwXm7t3kKEEFjsmHQeLcQ%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "ocsp" in header "GET /gts1c3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEBZwXm7t3kKEEFjsmHQeLcQ%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "goog" in header "GET /gts1c3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEBZwXm7t3kKEEFjsmHQeLcQ%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "Keep" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSnxLiz3Fu1WB6n1%2FE6xWn1b0jXiQQUdIWAwGbH3zfez70pN6oDHb7tzRcCEAp6FnkBkACKqk%2BVbKsyAbY%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "User" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSnxLiz3Fu1WB6n1%2FE6xWn1b0jXiQQUdIWAwGbH3zfez70pN6oDHb7tzRcCEAp6FnkBkACKqk%2BVbKsyAbY%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "ocsp" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSnxLiz3Fu1WB6n1%2FE6xWn1b0jXiQQUdIWAwGbH3zfez70pN6oDHb7tzRcCEAp6FnkBkACKqk%2BVbKsyAbY%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "digicert" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSnxLiz3Fu1WB6n1%2FE6xWn1b0jXiQQUdIWAwGbH3zfez70pN6oDHb7tzRcCEAp6FnkBkACKqk%2BVbKsyAbY%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAzlnDD9eoNTLi0BRrMy%2BWU%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "2BWU" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAzlnDD9eoNTLi0BRrMy%2BWU%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "Keep" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAzlnDD9eoNTLi0BRrMy%2BWU%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "User" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAzlnDD9eoNTLi0BRrMy%2BWU%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "ocsp" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAzlnDD9eoNTLi0BRrMy%2BWU%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "digicert" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAzlnDD9eoNTLi0BRrMy%2BWU%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "Keep" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAbY2QTVWENG9oovp1QifsQ%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "User" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAbY2QTVWENG9oovp1QifsQ%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "ocsp" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAbY2QTVWENG9oovp1QifsQ%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "digicert" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAbY2QTVWENG9oovp1QifsQ%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "2Bsl" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTPJvUY%2Bsl%2Bj4yzQuAcL2oQno5fCgQUUWj%2FkK8CB3U8zNllZGKiErhZcjsCEAdcWuWOzU%2B3YfWP%2Bc9lf9g%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "2FkK8CB3U8zNllZGKiErhZcjsCEAdcWuWOzU" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTPJvUY%2Bsl%2Bj4yzQuAcL2oQno5fCgQUUWj%2FkK8CB3U8zNllZGKiErhZcjsCEAdcWuWOzU%2B3YfWP%2Bc9lf9g%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "2Bc9lf9g" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTPJvUY%2Bsl%2Bj4yzQuAcL2oQno5fCgQUUWj%2FkK8CB3U8zNllZGKiErhZcjsCEAdcWuWOzU%2B3YfWP%2Bc9lf9g%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "Keep" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTPJvUY%2Bsl%2Bj4yzQuAcL2oQno5fCgQUUWj%2FkK8CB3U8zNllZGKiErhZcjsCEAdcWuWOzU%2B3YfWP%2Bc9lf9g%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "User" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTPJvUY%2Bsl%2Bj4yzQuAcL2oQno5fCgQUUWj%2FkK8CB3U8zNllZGKiErhZcjsCEAdcWuWOzU%2B3YfWP%2Bc9lf9g%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "ocsp" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTPJvUY%2Bsl%2Bj4yzQuAcL2oQno5fCgQUUWj%2FkK8CB3U8zNllZGKiErhZcjsCEAdcWuWOzU%2B3YfWP%2Bc9lf9g%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "digicert" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTPJvUY%2Bsl%2Bj4yzQuAcL2oQno5fCgQUUWj%2FkK8CB3U8zNllZGKiErhZcjsCEAdcWuWOzU%2B3YfWP%2Bc9lf9g%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAzlnDD9eoNTLi0BRrMy%2BWU%3D HTTP/1.1Cache-Control: max-age = 7200Connection: Keep-AliveAccept: */*If-Modified-Since: Mon, 18 Dec 2023 22:50:33 GMTUser-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "2BWU" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAzlnDD9eoNTLi0BRrMy%2BWU%3D HTTP/1.1Cache-Control: max-age = 7200Connection: Keep-AliveAccept: */*If-Modified-Since: Mon, 18 Dec 2023 22:50:33 GMTUser-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "Keep" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAzlnDD9eoNTLi0BRrMy%2BWU%3D HTTP/1.1Cache-Control: max-age = 7200Connection: Keep-AliveAccept: */*If-Modified-Since: Mon, 18 Dec 2023 22:50:33 GMTUser-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "Modified" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAzlnDD9eoNTLi0BRrMy%2BWU%3D HTTP/1.1Cache-Control: max-age = 7200Connection: Keep-AliveAccept: */*If-Modified-Since: Mon, 18 Dec 2023 22:50:33 GMTUser-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "2023" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAzlnDD9eoNTLi0BRrMy%2BWU%3D HTTP/1.1Cache-Control: max-age = 7200Connection: Keep-AliveAccept: */*If-Modified-Since: Mon, 18 Dec 2023 22:50:33 GMTUser-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "ocsp" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAzlnDD9eoNTLi0BRrMy%2BWU%3D HTTP/1.1Cache-Control: max-age = 7200Connection: Keep-AliveAccept: */*If-Modified-Since: Mon, 18 Dec 2023 22:50:33 GMTUser-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "digicert" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAzlnDD9eoNTLi0BRrMy%2BWU%3D HTTP/1.1Cache-Control: max-age = 7200Connection: Keep-AliveAccept: */*If-Modified-Since: Mon, 18 Dec 2023 22:50:33 GMTUser-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTk45WiKdPUwcMf8JgMC07ACYqr2AQUt2ui6qiqhIx56rTaD5iyxZV2ufQCEAqiBEK" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTk45WiKdPUwcMf8JgMC07ACYqr2AQUt2ui6qiqhIx56rTaD5iyxZV2ufQCEAqiBEK%2F1RSvcy4lL46SQ4M%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "Keep" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTk45WiKdPUwcMf8JgMC07ACYqr2AQUt2ui6qiqhIx56rTaD5iyxZV2ufQCEAqiBEK%2F1RSvcy4lL46SQ4M%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "User" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTk45WiKdPUwcMf8JgMC07ACYqr2AQUt2ui6qiqhIx56rTaD5iyxZV2ufQCEAqiBEK%2F1RSvcy4lL46SQ4M%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "ocsp" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTk45WiKdPUwcMf8JgMC07ACYqr2AQUt2ui6qiqhIx56rTaD5iyxZV2ufQCEAqiBEK%2F1RSvcy4lL46SQ4M%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "digicert" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTk45WiKdPUwcMf8JgMC07ACYqr2AQUt2ui6qiqhIx56rTaD5iyxZV2ufQCEAqiBEK%2F1RSvcy4lL46SQ4M%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "2BrkS7QYXjzkCEAqvpsXKY8RRQeo74ffHUxc" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAqvpsXKY8RRQeo74ffHUxc%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "Keep" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAqvpsXKY8RRQeo74ffHUxc%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "User" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAqvpsXKY8RRQeo74ffHUxc%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "ocsp" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAqvpsXKY8RRQeo74ffHUxc%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "digicert" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAqvpsXKY8RRQeo74ffHUxc%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "Keep" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "User" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "ocsp" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "digicert" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "2BrkS7QYXjzkCEA177el9ggmWelJjG4vdGL0" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEA177el9ggmWelJjG4vdGL0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "Keep" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEA177el9ggmWelJjG4vdGL0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "User" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEA177el9ggmWelJjG4vdGL0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "ocsp" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEA177el9ggmWelJjG4vdGL0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "digicert" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEA177el9ggmWelJjG4vdGL0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com"2c:T44b,The analysis contains indicators for cyrpto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Contains ability to perform AES/RC4 encryption (API string) Matched sigs: Contains ability to use Microsoft's Enhanced Cryptographic Provider Matched sigs: Contains ability to perform decryption (API string) Matched sigs: Contains CRYPTO related strings Matched sigs: Contains ability to use Cryptographic classes Matched sigs: Contains ability to decrypt/decode data Matched sigs: Contains ability to perform Base64 encoding/decoding Matched sigs: Found Crypto currency wallets related strings Matched sigs: Decrypted SSL network traffic Matched sigs: Contains ability to encrypt/encode message (API string) Matched sigs: Tries to steal crypto wallet extension (string) Matched sigs: Dropped file has high entropy (likely encrypted/compressed content) Matched sigs: Tries to steal Crypto currency wallets information (file access) Matched sigs: HTTP requests contain Base64 strings Matched sigs: Sample file has high entropy (likely encrypted/compressed content)2d:T2c6a,"wextract.exe" called "RtlGetVersion" with parameter 000000000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00003568) "cZ5oz01.exe" called "RtlGetVersion" with parameter 000000000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00003316) "ZP6rv89.exe" called "RtlGetVersion" with parameter 000000000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00003028) "1Pe57AQ7.exe" called "RtlGetVersion" with parameter 140100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00003660) "1Pe57AQ7.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000099049966cc04cc66cc04ff6699040099cc043399cc046699cc049999cc04cc99cc04ff99cc0400cccc0433cccc0466cccc0499cccc04cccccc04ffcccc0400ffcc0433ffcc0466ff990499ffcc04ccffcc04ffffcc043300cc046600ff049900ff040033cc043333ff046633ff049933ff04cc33ff04ff33ff040066ff043366ff046666cc049966ff04cc66ff04ff66cc040099ff043399ff046699ff049999ff04cc99ff04ff99ff0400ccff0433ccff0466ccff0499ccff04ccccff0400006f6ca0e0c50266ffcc0499ffff04ccffff0490e0c50200006f6c0000000001000000 (UID: 00000000-00003660) "1Pe57AQ7.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000099049966cc04cc66cc04ff6699040099cc043399cc046699cc049999cc04cc99cc04ff99cc0400cccc0433cccc0466cccc0499cccc04cccccc04ffcccc0400ffcc0433ffcc0466ff990499ffcc04ccffcc04ffffcc043300cc046600ff049900ff040033cc043333ff046633ff049933ff04cc33ff04ff33ff040066ff043366ff046666cc049966ff04cc66ff04ff66cc040099ff043399ff046699ff049999ff04cc99ff04ff99ff0400ccff0433ccff0466ccff0499ccff04ccccff0400006f6c20df2c0466ffcc0499ffff04ccffff0410df2c0400006f6c0000000001000000 (UID: 00000000-00003660) "1Pe57AQ7.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000099049966cc04cc66cc04ff6699040099cc043399cc046699cc049999cc04cc99cc04ff99cc0400cccc0433cccc0466cccc0499cccc04cccccc04ffcccc0400ffcc0433ffcc0466ff990499ffcc04ccffcc04ffffcc043300cc046600ff049900ff040033cc043333ff046633ff049933ff04cc33ff04ff33ff040066ff043366ff046666cc049966ff04cc66ff04ff66cc040099ff043399ff046699ff049999ff04cc99ff04ff99ff0400ccff0433ccff0466ccff0499ccff04ccccff0400006f6ce0e3280466ffcc0499ffff04ccffff04d0e3280400006f6c0000000001000000 (UID: 00000000-00003660) "1Pe57AQ7.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000099049966cc04cc66cc04ff6699040099cc043399cc046699cc049999cc04cc99cc04ff99cc0400cccc0433cccc0466cccc0499cccc04cccccc04ffcccc0400ffcc0433ffcc0466ff990499ffcc04ccffcc04ffffcc043300cc046600ff049900ff040033cc043333ff046633ff049933ff04cc33ff04ff33ff040066ff043366ff046666cc049966ff04cc66ff04ff66cc040099ff043399ff046699ff049999ff04cc99ff04ff99ff0400ccff0433ccff0466ccff0499ccff04ccccff0400006f6c60e3280466ffcc0499ffff04ccffff0450e3280400006f6c0000000001000000 (UID: 00000000-00003660) "1Pe57AQ7.exe" called "RtlGetVersion" with parameter 000000000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00003660) "1Pe57AQ7.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000099049966cc04cc66cc04ff6699040099cc043399cc046699cc049999cc04cc99cc04ff99cc0400cccc0433cccc0466cccc0499cccc04cccccc04ffcccc0400ffcc0433ffcc0466ff990499ffcc04ccffcc04ffffcc043300cc046600ff049900ff040033cc043333ff046633ff049933ff04cc33ff04ff33ff040066ff043366ff046666cc049966ff04cc66ff04ff66cc040099ff043399ff046699ff049999ff04cc99ff04ff99ff0400ccff0433ccff0466ccff0499ccff04ccccff0400006f6c00e2370466ffcc0499ffff04ccffff04f0e1370400006f6c0000000001000000 (UID: 00000000-00003660) "1Pe57AQ7.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000099049966cc04cc66cc04ff6699040099cc043399cc046699cc049999cc04cc99cc04ff99cc0400cccc0433cccc0466cccc0499cccc04cccccc04ffcccc0400ffcc0433ffcc0466ff990499ffcc04ccffcc04ffffcc043300cc046600ff049900ff040033cc043333ff046633ff049933ff04cc33ff04ff33ff040066ff043366ff046666cc049966ff04cc66ff04ff66cc040099ff043399ff046699ff049999ff04cc99ff04ff99ff0400ccff0433ccff0466ccff0499ccff04ccccff0400006f6cf0e3c50266ffcc0499ffff04ccffff04e0e3c50200006f6c0000000001000000 (UID: 00000000-00003660) "1Pe57AQ7.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000099049966cc04cc66cc04ff6699040099cc043399cc046699cc049999cc04cc99cc04ff99cc0400cccc0433cccc0466cccc0499cccc04cccccc04ffcccc0400ffcc0433ffcc0466ff990499ffcc04ccffcc04ffffcc043300cc046600ff049900ff040033cc043333ff046633ff049933ff04cc33ff04ff33ff040066ff043366ff046666cc049966ff04cc66ff04ff66cc040099ff043399ff046699ff049999ff04cc99ff04ff99ff0400ccff0433ccff0466ccff0499ccff04ccccff0400006f6c50e3c50266ffcc0499ffff04ccffff0440e3c50200006f6c0000000001000000 (UID: 00000000-00003660) "1Pe57AQ7.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00003660) "1Pe57AQ7.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000099049966cc04cc66cc04ff6699040099cc043399cc046699cc049999cc04cc99cc04ff99cc0400cccc0433cccc0466cccc0499cccc04cccccc04ffcccc0400ffcc0433ffcc0466ff990499ffcc04ccffcc04ffffcc043300cc046600ff049900ff040033cc043333ff046633ff049933ff04cc33ff04ff33ff040066ff043366ff046666cc049966ff04cc66ff04ff66cc040099ff043399ff046699ff049999ff04cc99ff04ff99ff0400ccff0433ccff0466ccff0499ccff04ccccff0400006f6cc0e0ce0266ffcc0499ffff04ccffff04b0e0ce0200006f6c0000000001000000 (UID: 00000000-00003660) "1Pe57AQ7.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000010000000001011e19f40cca58e7ce022a9d8f75000000002483a475040000000000000000000000d4f8ce0200000000e79c8f75020007806ce1ce020000000076000000bce1ce02feffffff44e1ce02cf00f076d600f076518b3674760000003b000000bce1ce026f006e0018e1ce026e00740080e1ce02 (UID: 00000000-00003660) "1Pe57AQ7.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000099049966cc04cc66cc04ff6699040099cc043399cc046699cc049999cc04cc99cc04ff99cc0400cccc0433cccc0466cccc0499cccc04cccccc04ffcccc0400ffcc0433ffcc0466ff990499ffcc04ccffcc04ffffcc043300cc046600ff049900ff040033cc043333ff046633ff049933ff04cc33ff04ff33ff040066ff043366ff046666cc049966ff04cc66ff04ff66cc040099ff043399ff046699ff049999ff04cc99ff04ff99ff0400ccff0433ccff0466ccff0499ccff04ccccff0400006f6c80dd720466ffcc0499ffff04ccffff0470dd720400006f6c0000000001000000 (UID: 00000000-00003660) "2cV9250.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00001912) "2cV9250.exe" called "RtlGetVersion" with parameter 140100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00001912)2e:T411,"wextract.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "wextract.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "cZ5oz01.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "cZ5oz01.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "ZP6rv89.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "ZP6rv89.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "1Pe57AQ7.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "1Pe57AQ7.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "2cV9250.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED")2f:T4a6,Found reference to API "ExpandEnvironmentStringsA" (Indicator: "ExpandEnvironmentStrings"; File: "wextract.exe") Found reference to API "GetSystemInfo" (Indicator: "GetSystemInfo"; File: "wextract.exe") Found reference to API "GetUserObjectInformationA" (Indicator: "GetUserObjectInformation"; File: "2cV9250.exe.1068760659") Found reference to API "ExpandEnvironmentStringsW" (Indicator: "ExpandEnvironmentStrings"; Source: "00000000-00001912.00000000.68222.00400000.00000040.mdmp, 00000000-00001912.00000001.70142.00400000.00000040.mdmp, 00000000-00001912.00000002.72061.00160000.00000040.mdmp") Found reference to API "ExpandEnvironmentStringsA" (Indicator: "ExpandEnvironmentStrings"; Source: "00000000-00003028.00000001.68977.012DA000.00000002.mdmp") Found reference to API "GetSystemInfo" (Indicator: "GetSystemInfo"; Source: "00000000-00003028.00000001.68977.012DA000.00000002.mdmp") Found reference to API "ExpandEnvironmentStringsA" (Indicator: "ExpandEnvironmentStrings"; Source: "00000000-00003316.00000002.70823.0034A000.00000002.mdmp") Found reference to API "GetSystemInfo" (Indicator: "GetSystemInfo"; Source: "00000000-00003316.00000002.70823.0034A000.00000002.mdmp")30:T66b,Found reference to API "GetVersion" (Indicator: "GetVersion"; File: "wextract.exe") Found reference to API "GetVersionExA" (Indicator: "GetVersionExA"; File: "wextract.exe") Found reference to API "GetVersionExA" (Indicator: "GetVersion"; File: "wextract.exe") Found reference to API "GetVersionExW" (Indicator: "GetVersionExW"; File: "2cV9250.exe.1068760659") Found reference to API "GetVersionExW" (Indicator: "GetVersion"; File: "2cV9250.exe.1068760659") Found reference to API "11291922757,3604,3024,,RtlGetVersion,NTDLL.dll,"252:02:57.406",RX=0,PX=0" (Indicator: "GetVersion"; Source: "00000000-00003028.00000000.67057.00350000.00000004.mdmp") Found reference to API "29338901477,3604,3024,,RtlGetVersion,NTDLL.dll,"252:03:15.000",RX=0,PX=0" (Indicator: "GetVersion"; Source: "00000000-00003028.00000001.68977.00350000.00000004.mdmp") Found reference to API "GetVersion" (Indicator: "GetVersion"; Source: "00000000-00003028.00000001.68977.012DA000.00000002.mdmp") Found reference to API "GetVersionExA" (Indicator: "GetVersionExA"; Source: "00000000-00003028.00000001.68977.012DA000.00000002.mdmp") Found reference to API "GetVersionExA" (Indicator: "GetVersion"; Source: "00000000-00003028.00000001.68977.012DA000.00000002.mdmp") Found reference to API "GetVersion" (Indicator: "GetVersion"; Source: "00000000-00003316.00000002.70823.0034A000.00000002.mdmp") Found reference to API "GetVersionExA" (Indicator: "GetVersionExA"; Source: "00000000-00003316.00000002.70823.0034A000.00000002.mdmp") Found reference to API "GetVersionExA" (Indicator: "GetVersion"; Source: "00000000-00003316.00000002.70823.0034A000.00000002.mdmp")31:T8c3,"2cV9250.exe" queries volume information of "C:\" at 00000000-00001912-0000010C-4268212 "2cV9250.exe" queries volume information of "C:\" at 00000000-00001912-0000010C-5071411 "2cV9250.exe" queries volume information of "C:\" at 00000000-00001912-0000010C-5990133 "2cV9250.exe" queries volume information of "C:\" at 00000000-00001912-0000010C-7428840 "2cV9250.exe" queries volume information of "C:\" at 00000000-00001912-0000010C-9162288 "2cV9250.exe" queries volume information of "C:\" at 00000000-00001912-0000010C-13115287 "2cV9250.exe" queries volume information of "C:\" at 00000000-00001912-0000010C-15193726 "2cV9250.exe" queries volume information of "C:\" at 00000000-00001912-0000010C-17129963 "2cV9250.exe" queries volume information of "C:\" at 00000000-00001912-0000010C-18747391 "2cV9250.exe" queries volume information of "C:\" at 00000000-00001912-0000010C-21641619 "2cV9250.exe" queries volume information of "C:\" at 00000000-00001912-0000010C-24678479 "2cV9250.exe" queries volume information of "C:\" at 00000000-00001912-0000010C-28766325 "2cV9250.exe" queries volume information of "C:\" at 00000000-00001912-0000010C-35730999 "2cV9250.exe" queries volume information of "C:\" at 00000000-00001912-0000010C-40937108 "2cV9250.exe" queries volume information of "C:\" at 00000000-00001912-0000010C-62219923 "2cV9250.exe" queries volume information of "C:\" at 00000000-00001912-0000010C-64062518 "2cV9250.exe" queries volume information of "C:\" at 00000000-00001912-0000010C-65290894 "2cV9250.exe" queries volume information of "C:\" at 00000000-00001912-0000010C-69218441 "2cV9250.exe" queries volume information of "C:\" at 00000000-00001912-0000010C-70809745 "2cV9250.exe" queries volume information of "C:\" at 00000000-00001912-0000010C-72330643 "2cV9250.exe" queries volume information of "C:\" at 00000000-00001912-0000010C-73598036 "2cV9250.exe" queries volume information of "C:\" at 00000000-00001912-0000010C-74789968 "2cV9250.exe" queries volume information of "C:\" at 00000000-00001912-0000010C-75964571 "2cV9250.exe" queries volume information of "C:\" at 00000000-00001912-0000010C-76889947 "2cV9250.exe" queries volume information of "C:\" at 00000000-00001912-0000010C-7818058132:T8c3,"2cV9250.exe" queries volume information of "C:\" at 00000000-00001912-0000010C-4268212 "2cV9250.exe" queries volume information of "C:\" at 00000000-00001912-0000010C-5071411 "2cV9250.exe" queries volume information of "C:\" at 00000000-00001912-0000010C-5990133 "2cV9250.exe" queries volume information of "C:\" at 00000000-00001912-0000010C-7428840 "2cV9250.exe" queries volume information of "C:\" at 00000000-00001912-0000010C-9162288 "2cV9250.exe" queries volume information of "C:\" at 00000000-00001912-0000010C-13115287 "2cV9250.exe" queries volume information of "C:\" at 00000000-00001912-0000010C-15193726 "2cV9250.exe" queries volume information of "C:\" at 00000000-00001912-0000010C-17129963 "2cV9250.exe" queries volume information of "C:\" at 00000000-00001912-0000010C-18747391 "2cV9250.exe" queries volume information of "C:\" at 00000000-00001912-0000010C-21641619 "2cV9250.exe" queries volume information of "C:\" at 00000000-00001912-0000010C-24678479 "2cV9250.exe" queries volume information of "C:\" at 00000000-00001912-0000010C-28766325 "2cV9250.exe" queries volume information of "C:\" at 00000000-00001912-0000010C-35730999 "2cV9250.exe" queries volume information of "C:\" at 00000000-00001912-0000010C-40937108 "2cV9250.exe" queries volume information of "C:\" at 00000000-00001912-0000010C-62219923 "2cV9250.exe" queries volume information of "C:\" at 00000000-00001912-0000010C-64062518 "2cV9250.exe" queries volume information of "C:\" at 00000000-00001912-0000010C-65290894 "2cV9250.exe" queries volume information of "C:\" at 00000000-00001912-0000010C-69218441 "2cV9250.exe" queries volume information of "C:\" at 00000000-00001912-0000010C-70809745 "2cV9250.exe" queries volume information of "C:\" at 00000000-00001912-0000010C-72330643 "2cV9250.exe" queries volume information of "C:\" at 00000000-00001912-0000010C-73598036 "2cV9250.exe" queries volume information of "C:\" at 00000000-00001912-0000010C-74789968 "2cV9250.exe" queries volume information of "C:\" at 00000000-00001912-0000010C-75964571 "2cV9250.exe" queries volume information of "C:\" at 00000000-00001912-0000010C-76889947 "2cV9250.exe" queries volume information of "C:\" at 00000000-00001912-0000010C-7818058133:T16ed,"wextract.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\advpack.dll (UID: 00000000-00003568) "wextract.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00003568) "wextract.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00003568) "wextract.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00003568) "wextract.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00003568) "cZ5oz01.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00003316) "cZ5oz01.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00003316) "cZ5oz01.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00003316) "cZ5oz01.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00003316) "cZ5oz01.exe" called "LoadLibrary" with a parameter feclient.dll (UID: 00000000-00003316) "cZ5oz01.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\advpack.dll (UID: 00000000-00003316) "ZP6rv89.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\advpack.dll (UID: 00000000-00003028) "ZP6rv89.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00003028) "ZP6rv89.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00003028) "ZP6rv89.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00003028) "ZP6rv89.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00003028) "1Pe57AQ7.exe" called "LoadLibrary" with a parameter UxTheme.dll (UID: 00000000-00003660) "1Pe57AQ7.exe" called "LoadLibrary" with a parameter IMM32.dll (UID: 00000000-00003660) "1Pe57AQ7.exe" called "LoadLibrary" with a parameter comctl32 (UID: 00000000-00003660) "1Pe57AQ7.exe" called "LoadLibrary" with a parameter SHELL32.dll (UID: 00000000-00003660) "1Pe57AQ7.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00003660) "1Pe57AQ7.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00003660) "1Pe57AQ7.exe" called "LoadLibrary" with a parameter propsys.dll (UID: 00000000-00003660) "1Pe57AQ7.exe" called "LoadLibrary" with a parameter comctl32.dll (UID: 00000000-00003660) "1Pe57AQ7.exe" called "LoadLibrary" with a parameter %WINDIR%\System32\ieframe.dll (UID: 00000000-00003660) "1Pe57AQ7.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00003660) "1Pe57AQ7.exe" called "LoadLibrary" with a parameter api-ms-win-downlevel-ole32-l1-1-0.dll (UID: 00000000-00003660) "1Pe57AQ7.exe" called "LoadLibrary" with a parameter urlmon.dll (UID: 00000000-00003660) "1Pe57AQ7.exe" called "LoadLibrary" with a parameter api-ms-win-downlevel-shlwapi-l2-1-0.dll (UID: 00000000-00003660) "1Pe57AQ7.exe" called "LoadLibrary" with a parameter PROPSYS.dll (UID: 00000000-00003660) "1Pe57AQ7.exe" called "LoadLibrary" with a parameter %PROGRAMFILES%\Internet Explorer\ieproxy.dll (UID: 00000000-00003660) "1Pe57AQ7.exe" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00003660) "1Pe57AQ7.exe" called "LoadLibrary" with a parameter iertutil.dll (UID: 00000000-00003660) "1Pe57AQ7.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00003660) "1Pe57AQ7.exe" called "LoadLibrary" with a parameter %TEMP%\IXP002.TMP\1Pe57AQ7.exe (UID: 00000000-00003660) "1Pe57AQ7.exe" called "LoadLibrary" with a parameter dwmapi.dll (UID: 00000000-00003660) "1Pe57AQ7.exe" called "LoadLibrary" with a parameter ext-ms-win-kernel32-package-current-l1-1-0 (UID: 00000000-00003660) "1Pe57AQ7.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-1 (UID: 00000000-00003660) "2cV9250.exe" called "LoadLibrary" with a parameter msimg32.dll (UID: 00000000-00001912) "2cV9250.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00001912) "2cV9250.exe" called "LoadLibrary" with a parameter KERNEL32.dll (UID: 00000000-00001912) "2cV9250.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00001912) "2cV9250.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00001912) "2cV9250.exe" called "LoadLibrary" with a parameter GDI32.dll (UID: 00000000-00001912) "2cV9250.exe" called "LoadLibrary" with a parameter WINHTTP.dll (UID: 00000000-00001912) "2cV9250.exe" called "LoadLibrary" with a parameter CRYPT32.dll (UID: 00000000-00001912) "2cV9250.exe" called "LoadLibrary" with a parameter msvcr100.dll (UID: 00000000-00001912) "2cV9250.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00001912) "2cV9250.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00001912) "2cV9250.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00001912) "2cV9250.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00001912) "2cV9250.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00001912) "2cV9250.exe" called "LoadLibrary" with a parameter winhttp.dll (UID: 00000000-00001912) "2cV9250.exe" called "LoadLibrary" with a parameter WS2_32.dll (UID: 00000000-00001912) "2cV9250.exe" called "LoadLibrary" with a parameter SspiCli.dll (UID: 00000000-00001912) "2cV9250.exe" called "LoadLibrary" with a parameter wship6.dll (UID: 00000000-00001912) "2cV9250.exe" called "LoadLibrary" with a parameter DNSAPI.dll (UID: 00000000-00001912) "2cV9250.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00001912) "2cV9250.exe" called "LoadLibrary" with a parameter RPCRT4.dll (UID: 00000000-00001912) "2cV9250.exe" called "LoadLibrary" with a parameter wshtcpip (UID: 00000000-00001912)34:T7e66,"wextract.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00003568) "wextract.exe" called "GetProcAddress" with a parameter DelNodeRunDLL32 (UID: 00000000-00003568) "wextract.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00003568) "wextract.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00003568) "wextract.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00003568) "wextract.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00003568) "wextract.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00003568) "wextract.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00003568) "wextract.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00003568) "wextract.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00003568) "wextract.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00003568) "wextract.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00003568) "wextract.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00003568) "wextract.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00003568) "wextract.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00003568) "wextract.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00003568) "wextract.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00003568) "wextract.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00003568) "wextract.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00003568) "wextract.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00003568) "wextract.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00003568) "wextract.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00003568) "wextract.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00003568) "wextract.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00003568) "wextract.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00003568) "wextract.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00003568) "wextract.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00003568) "wextract.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00003568) "wextract.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00003568) "wextract.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00003568) "wextract.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00003568) "wextract.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00003568) "wextract.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00003568) "wextract.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00003568) "wextract.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00003568) "wextract.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00003568) "wextract.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00003568) "wextract.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00003568) "wextract.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00003568) "wextract.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00003568) "wextract.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00003568) "wextract.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00003568) "cZ5oz01.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00003316) "cZ5oz01.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00003316) "cZ5oz01.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00003316) "cZ5oz01.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00003316) "cZ5oz01.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00003316) "cZ5oz01.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00003316) "cZ5oz01.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00003316) "cZ5oz01.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00003316) "cZ5oz01.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00003316) "cZ5oz01.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00003316) "cZ5oz01.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00003316) "cZ5oz01.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00003316) "cZ5oz01.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00003316) "cZ5oz01.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00003316) "cZ5oz01.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00003316) "cZ5oz01.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00003316) "cZ5oz01.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00003316) "cZ5oz01.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00003316) "cZ5oz01.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00003316) "cZ5oz01.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00003316) "cZ5oz01.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00003316) "cZ5oz01.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00003316) "cZ5oz01.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00003316) "cZ5oz01.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00003316) "cZ5oz01.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00003316) "cZ5oz01.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00003316) "cZ5oz01.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00003316) "cZ5oz01.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00003316) "cZ5oz01.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00003316) "cZ5oz01.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00003316) "cZ5oz01.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00003316) "cZ5oz01.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00003316) "cZ5oz01.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00003316) "cZ5oz01.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00003316) "cZ5oz01.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00003316) "cZ5oz01.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00003316) "cZ5oz01.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00003316) "cZ5oz01.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00003316) "cZ5oz01.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00003316) "cZ5oz01.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00003316) "cZ5oz01.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00003316) "cZ5oz01.exe" called "GetProcAddress" with a parameter FeClientInitialize (UID: 00000000-00003316) "cZ5oz01.exe" called "GetProcAddress" with a parameter DecryptFileA (UID: 00000000-00003316) "cZ5oz01.exe" called "GetProcAddress" with a parameter DelNodeRunDLL32 (UID: 00000000-00003316) "ZP6rv89.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00003028) "ZP6rv89.exe" called "GetProcAddress" with a parameter DelNodeRunDLL32 (UID: 00000000-00003028) "ZP6rv89.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00003028) "ZP6rv89.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00003028) "ZP6rv89.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00003028) "ZP6rv89.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00003028) "ZP6rv89.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00003028) "ZP6rv89.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00003028) "ZP6rv89.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00003028) "ZP6rv89.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00003028) "ZP6rv89.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00003028) "ZP6rv89.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00003028) "ZP6rv89.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00003028) "ZP6rv89.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00003028) "ZP6rv89.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00003028) "ZP6rv89.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00003028) "ZP6rv89.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00003028) "ZP6rv89.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00003028) "ZP6rv89.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00003028) "ZP6rv89.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00003028) "ZP6rv89.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00003028) "ZP6rv89.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00003028) "ZP6rv89.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00003028) "ZP6rv89.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00003028) "ZP6rv89.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00003028) "ZP6rv89.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00003028) "ZP6rv89.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00003028) "ZP6rv89.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00003028) "ZP6rv89.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00003028) "ZP6rv89.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00003028) "ZP6rv89.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00003028) "ZP6rv89.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00003028) "ZP6rv89.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00003028) "ZP6rv89.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00003028) "ZP6rv89.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00003028) "ZP6rv89.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00003028) "ZP6rv89.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00003028) "ZP6rv89.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00003028) "ZP6rv89.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00003028) "ZP6rv89.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00003028) "ZP6rv89.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00003028) "ZP6rv89.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00003028) "1Pe57AQ7.exe" called "GetProcAddress" with a parameter RegisterClassNameW (UID: 00000000-00003660) "1Pe57AQ7.exe" called "GetProcAddress" with a parameter OpenThemeData (UID: 00000000-00003660) "1Pe57AQ7.exe" called "GetProcAddress" with a parameter GetThemeBool (UID: 00000000-00003660) "1Pe57AQ7.exe" called "GetProcAddress" with a parameter ImmGetContext (UID: 00000000-00003660) "1Pe57AQ7.exe" called "GetProcAddress" with a parameter ImmReleaseContext (UID: 00000000-00003660) "1Pe57AQ7.exe" called "GetProcAddress" with a parameter ImmAssociateContext (UID: 00000000-00003660) "1Pe57AQ7.exe" called "GetProcAddress" with a parameter ImmIsIME (UID: 00000000-00003660) "1Pe57AQ7.exe" called "GetProcAddress" with a parameter HIMAGELIST_QueryInterface (UID: 00000000-00003660) "1Pe57AQ7.exe" called "GetProcAddress" with a parameter DrawShadowText (UID: 00000000-00003660) "1Pe57AQ7.exe" called "GetProcAddress" with a parameter DrawSizeBox (UID: 00000000-00003660) "1Pe57AQ7.exe" called "GetProcAddress" with a parameter DrawScrollBar (UID: 00000000-00003660) "1Pe57AQ7.exe" called "GetProcAddress" with a parameter SizeBoxHwnd (UID: 00000000-00003660) "1Pe57AQ7.exe" called "GetProcAddress" with a parameter ScrollBar_MouseMove (UID: 00000000-00003660) "1Pe57AQ7.exe" called "GetProcAddress" with a parameter ScrollBar_Menu (UID: 00000000-00003660) "1Pe57AQ7.exe" called "GetProcAddress" with a parameter HandleScrollCmd (UID: 00000000-00003660) "1Pe57AQ7.exe" called "GetProcAddress" with a parameter DetachScrollBars (UID: 00000000-00003660) "1Pe57AQ7.exe" called "GetProcAddress" with a parameter AttachScrollBars (UID: 00000000-00003660) "1Pe57AQ7.exe" called "GetProcAddress" with a parameter CCSetScrollInfo (UID: 00000000-00003660) "1Pe57AQ7.exe" called "GetProcAddress" with a parameter CCGetScrollInfo (UID: 00000000-00003660) "1Pe57AQ7.exe" called "GetProcAddress" with a parameter CCEnableScrollBar (UID: 00000000-00003660) "1Pe57AQ7.exe" called "GetProcAddress" with a parameter QuerySystemGestureStatus (UID: 00000000-00003660) "1Pe57AQ7.exe" called "GetProcAddress" with a parameter StringFromGUID2 (UID: 00000000-00003660) "1Pe57AQ7.exe" called "GetProcAddress" with a parameter OleInitialize (UID: 00000000-00003660) "1Pe57AQ7.exe" called "GetProcAddress" with a parameter CreateBindCtx (UID: 00000000-00003660) "1Pe57AQ7.exe" called "GetProcAddress" with a parameter CoTaskMemAlloc (UID: 00000000-00003660) "1Pe57AQ7.exe" called "GetProcAddress" with a parameter RegisterTraceGuidsW (UID: 00000000-00003660) "1Pe57AQ7.exe" called "GetProcAddress" with a parameter EventRegister (UID: 00000000-00003660) "1Pe57AQ7.exe" called "GetProcAddress" with a parameter EventUnregister (UID: 00000000-00003660) "1Pe57AQ7.exe" called "GetProcAddress" with a parameter EventEnabled (UID: 00000000-00003660) "1Pe57AQ7.exe" called "GetProcAddress" with a parameter EventWrite (UID: 00000000-00003660) "1Pe57AQ7.exe" called "GetProcAddress" with a parameter PSCreateMemoryPropertyStore (UID: 00000000-00003660) "1Pe57AQ7.exe" called "GetProcAddress" with a parameter PSPropertyBag_WriteDWORD (UID: 00000000-00003660) "1Pe57AQ7.exe" called "GetProcAddress" with a parameter CoGetApartmentType (UID: 00000000-00003660) "1Pe57AQ7.exe" called "GetProcAddress" with a parameter CoRegisterInitializeSpy (UID: 00000000-00003660) "1Pe57AQ7.exe" called "GetProcAddress" with a parameter CoGetMalloc (UID: 00000000-00003660) "1Pe57AQ7.exe" called "GetProcAddress" with a parameter PSPropertyBag_ReadDWORD (UID: 00000000-00003660) "1Pe57AQ7.exe" called "GetProcAddress" with a parameter PSPropertyBag_ReadGUID (UID: 00000000-00003660) "1Pe57AQ7.exe" called "GetProcAddress" with a parameter RegEnumKeyW (UID: 00000000-00003660) "1Pe57AQ7.exe" called "GetProcAddress" with a parameter OpenThreadToken (UID: 00000000-00003660) "1Pe57AQ7.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00003660) "1Pe57AQ7.exe" called "GetProcAddress" with a parameter CLSIDFromOle1Class (UID: 00000000-00003660) "1Pe57AQ7.exe" called "GetProcAddress" with a parameter GetCatalogObject (UID: 00000000-00003660) "1Pe57AQ7.exe" called "GetProcAddress" with a parameter GetCatalogObject2 (UID: 00000000-00003660) "1Pe57AQ7.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00003660) "1Pe57AQ7.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00003660) "1Pe57AQ7.exe" called "GetProcAddress" with a parameter AcquireSRWLockShared (UID: 00000000-00003660) "1Pe57AQ7.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00003660) "1Pe57AQ7.exe" called "GetProcAddress" with a parameter ReleaseSRWLockShared (UID: 00000000-00003660) "1Pe57AQ7.exe" called "GetProcAddress" with a parameter EventSetInformation (UID: 00000000-00003660) "1Pe57AQ7.exe" called "GetProcAddress" with a parameter InitCommonControlsEx (UID: 00000000-00003660) "1Pe57AQ7.exe" called "GetProcAddress" with a parameter DllGetClassObject (UID: 00000000-00003660) "1Pe57AQ7.exe" called "GetProcAddress" with a parameter DllCanUnloadNow (UID: 00000000-00003660) "1Pe57AQ7.exe" called "GetProcAddress" with a parameter IsValidURL (UID: 00000000-00003660) "1Pe57AQ7.exe" called "GetProcAddress" with a parameter SHStrDupW (UID: 00000000-00003660) "1Pe57AQ7.exe" called "GetProcAddress" with a parameter CoTaskMemFree (UID: 00000000-00003660) "1Pe57AQ7.exe" called "GetProcAddress" with a parameter PSCreateAdapterFromPropertyStore (UID: 00000000-00003660) "1Pe57AQ7.exe" called "GetProcAddress" with a parameter PropVariantToBSTR (UID: 00000000-00003660) "1Pe57AQ7.exe" called "GetProcAddress" with a parameter PropVariantClear (UID: 00000000-00003660) "1Pe57AQ7.exe" called "GetProcAddress" with a parameter CoInitializeEx (UID: 00000000-00003660) "1Pe57AQ7.exe" called "GetProcAddress" with a parameter CoTaskMemRealloc (UID: 00000000-00003660) "1Pe57AQ7.exe" called "GetProcAddress" with a parameter ResolveDelayLoadedAPI (UID: 00000000-00003660) "1Pe57AQ7.exe" called "GetProcAddress" with a parameter PSPropertyBag_ReadStrAlloc (UID: 00000000-00003660) "1Pe57AQ7.exe" called "GetProcAddress" with a parameter CoAllowSetForegroundWindow (UID: 00000000-00003660) "1Pe57AQ7.exe" called "GetProcAddress" with a parameter RtlDllShutdownInProgress (UID: 00000000-00003660) "1Pe57AQ7.exe" called "GetProcAddress" with a parameter CoUninitialize (UID: 00000000-00003660) "1Pe57AQ7.exe" called "GetProcAddress" with a parameter OleUninitialize (UID: 00000000-00003660) "1Pe57AQ7.exe" called "GetProcAddress" with a parameter CoRevokeInitializeSpy (UID: 00000000-00003660) "1Pe57AQ7.exe" called "GetProcAddress" with a parameter NdrOleInitializeExtension (UID: 00000000-00003660) "1Pe57AQ7.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00003660) "1Pe57AQ7.exe" called "GetProcAddress" with a parameter CoGetMarshalSizeMax (UID: 00000000-00003660) "1Pe57AQ7.exe" called "GetProcAddress" with a parameter CoMarshalInterface (UID: 00000000-00003660) "1Pe57AQ7.exe" called "GetProcAddress" with a parameter CoUnmarshalInterface (UID: 00000000-00003660) "1Pe57AQ7.exe" called "GetProcAddress" with a parameter StringFromIID (UID: 00000000-00003660) "1Pe57AQ7.exe" called "GetProcAddress" with a parameter CoGetPSClsid (UID: 00000000-00003660) "1Pe57AQ7.exe" called "GetProcAddress" with a parameter CoReleaseMarshalData (UID: 00000000-00003660) "1Pe57AQ7.exe" called "GetProcAddress" with a parameter DcomChannelSetHResult (UID: 00000000-00003660) "1Pe57AQ7.exe" called "GetProcAddress" with a parameter FindWindowExW (UID: 00000000-00003660) "1Pe57AQ7.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00003660) "1Pe57AQ7.exe" called "GetProcAddress" with a parameter Wow64DisableWow64FsRedirection (UID: 00000000-00003660) "1Pe57AQ7.exe" called "GetProcAddress" with a parameter Wow64RevertWow64FsRedirection (UID: 00000000-00003660) "1Pe57AQ7.exe" called "GetProcAddress" with a parameter DwmIsCompositionEnabled (UID: 00000000-00003660) "1Pe57AQ7.exe" called "GetProcAddress" with a parameter SetSystemFileCacheSize (UID: 00000000-00003660) "1Pe57AQ7.exe" called "GetProcAddress" with a parameter NtSetSystemInformation (UID: 00000000-00003660) "1Pe57AQ7.exe" called "GetProcAddress" with a parameter PrivIsDllSynchronizationHeld (UID: 00000000-00003660) "1Pe57AQ7.exe" called "GetProcAddress" with a parameter SHGetInstanceExplorer (UID: 00000000-00003660) "1Pe57AQ7.exe" called "GetProcAddress" with a parameter SendMessageTimeoutW (UID: 00000000-00003660) "1Pe57AQ7.exe" called "GetProcAddress" with a parameter IUnknown_Set (UID: 00000000-00003660) "1Pe57AQ7.exe" called "GetProcAddress" with a parameter CM_Get_Device_Interface_List_Size_ExW (UID: 00000000-00003660) "1Pe57AQ7.exe" called "GetProcAddress" with a parameter CM_Get_Device_Interface_List_ExW (UID: 00000000-00003660) "1Pe57AQ7.exe" called "GetProcAddress" with a parameter GetWindowThreadProcessId (UID: 00000000-00003660) "1Pe57AQ7.exe" called "GetProcAddress" with a parameter AllowSetForegroundWindow (UID: 00000000-00003660) "1Pe57AQ7.exe" called "GetProcAddress" with a parameter PostMessageW (UID: 00000000-00003660) "1Pe57AQ7.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00003660) "1Pe57AQ7.exe" called "GetProcAddress" with a parameter CloseThemeData (UID: 00000000-00003660) "1Pe57AQ7.exe" called "GetProcAddress" with a parameter UnregisterTraceGuids (UID: 00000000-00003660) "2cV9250.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00001912) "2cV9250.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00001912) "2cV9250.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00001912) "2cV9250.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00001912) "2cV9250.exe" called "GetProcAddress" with a parameter StrRChrA (UID: 00000000-00001912) "2cV9250.exe" called "GetProcAddress" with a parameter OpenThreadToken (UID: 00000000-00001912) "2cV9250.exe" called "GetProcAddress" with a parameter SetSystemFileCacheSize (UID: 00000000-00001912) "2cV9250.exe" called "GetProcAddress" with a parameter NtSetSystemInformation (UID: 00000000-00001912) "2cV9250.exe" called "GetProcAddress" with a parameter PrivIsDllSynchronizationHeld (UID: 00000000-00001912) "2cV9250.exe" called "GetProcAddress" with a parameter GetProductInfo (UID: 00000000-00001912) "2cV9250.exe" called "GetProcAddress" with a parameter InitSecurityInterfaceW (UID: 00000000-00001912) "2cV9250.exe" called "GetProcAddress" with a parameter InitSecurityInterfaceA (UID: 00000000-00001912) "2cV9250.exe" called "GetProcAddress" with a parameter SystemFunction035 (UID: 00000000-00001912) "2cV9250.exe" called "GetProcAddress" with a parameter RpcStringBindingComposeW (UID: 00000000-00001912) "2cV9250.exe" called "GetProcAddress" with a parameter RpcBindingFromStringBindingW (UID: 00000000-00001912) "2cV9250.exe" called "GetProcAddress" with a parameter RpcBindingSetAuthInfoExW (UID: 00000000-00001912) "2cV9250.exe" called "GetProcAddress" with a parameter RpcBindingSetOption (UID: 00000000-00001912) "2cV9250.exe" called "GetProcAddress" with a parameter RpcStringFreeW (UID: 00000000-00001912) "2cV9250.exe" called "GetProcAddress" with a parameter WSAStringToAddressW (UID: 00000000-00001912) "2cV9250.exe" called "GetProcAddress" with a parameter WSPStartup (UID: 00000000-00001912) "2cV9250.exe" called "GetProcAddress" with a parameter WSHAddressToString (UID: 00000000-00001912) "2cV9250.exe" called "GetProcAddress" with a parameter WSHEnumProtocols (UID: 00000000-00001912) "2cV9250.exe" called "GetProcAddress" with a parameter WSHGetProviderGuid (UID: 00000000-00001912) "2cV9250.exe" called "GetProcAddress" with a parameter WSHGetSockaddrType (UID: 00000000-00001912) "2cV9250.exe" called "GetProcAddress" with a parameter WSHGetSocketInformation (UID: 00000000-00001912) "2cV9250.exe" called "GetProcAddress" with a parameter WSHGetWSAProtocolInfo (UID: 00000000-00001912) "2cV9250.exe" called "GetProcAddress" with a parameter WSHGetWildcardSockaddr (UID: 00000000-00001912) "2cV9250.exe" called "GetProcAddress" with a parameter WSHGetWinsockMapping (UID: 00000000-00001912) "2cV9250.exe" called "GetProcAddress" with a parameter WSHIoctl (UID: 00000000-00001912) "2cV9250.exe" called "GetProcAddress" with a parameter WSHJoinLeaf (UID: 00000000-00001912) "2cV9250.exe" called "GetProcAddress" with a parameter WSHNotify (UID: 00000000-00001912) "2cV9250.exe" called "GetProcAddress" with a parameter WSHOpenSocket (UID: 00000000-00001912) "2cV9250.exe" called "GetProcAddress" with a parameter WSHOpenSocket2 (UID: 00000000-00001912) "2cV9250.exe" called "GetProcAddress" with a parameter WSHSetSocketInformation (UID: 00000000-00001912) "2cV9250.exe" called "GetProcAddress" with a parameter WSHStringToAddress (UID: 00000000-00001912) "2cV9250.exe" called "GetProcAddress" with a parameter WSHGetBroadcastSockaddr (UID: 00000000-00001912) "2cV9250.exe" called "GetProcAddress" with a parameter UrlCanonicalizeW (UID: 00000000-00001912) "2cV9250.exe" called "GetProcAddress" with a parameter StrCmpNW (UID: 00000000-00001912) "2cV9250.exe" called "GetProcAddress" with a parameter DnsGetProxyInformation (UID: 00000000-00001912) "2cV9250.exe" called "GetProcAddress" with a parameter NdrClientCall2 (UID: 00000000-00001912) "2cV9250.exe" called "GetProcAddress" with a parameter RpcBindingFree (UID: 00000000-00001912) "2cV9250.exe" called "GetProcAddress" with a parameter GetAddrInfoW (UID: 00000000-00001912) "2cV9250.exe" called "GetProcAddress" with a parameter NSPStartup (UID: 00000000-00001912) "2cV9250.exe" called "GetProcAddress" with a parameter DnsQueryConfigAllocEx (UID: 00000000-00001912) "2cV9250.exe" called "GetProcAddress" with a parameter DnsNameCompare_W (UID: 00000000-00001912) "2cV9250.exe" called "GetProcAddress" with a parameter DnsApiAlloc (UID: 00000000-00001912) "2cV9250.exe" called "GetProcAddress" with a parameter DnsQueryExW (UID: 00000000-00001912) "2cV9250.exe" called "GetProcAddress" with a parameter GetCurrentThreadCompartmentId (UID: 00000000-00001912) "2cV9250.exe" called "GetProcAddress" with a parameter WSAttemptAutodialAddr (UID: 00000000-00001912) "2cV9250.exe" called "GetProcAddress" with a parameter WSAttemptAutodialName (UID: 00000000-00001912) "2cV9250.exe" called "GetProcAddress" with a parameter WSNoteSuccessfulHostentLookup (UID: 00000000-00001912) "2cV9250.exe" called "GetProcAddress" with a parameter DnsApiFree (UID: 00000000-00001912) "2cV9250.exe" called "GetProcAddress" with a parameter DnsFree (UID: 00000000-00001912) "2cV9250.exe" called "GetProcAddress" with a parameter NamespaceCallout (UID: 00000000-00001912) "2cV9250.exe" called "GetProcAddress" with a parameter WSASocketW (UID: 00000000-00001912) "2cV9250.exe" called "GetProcAddress" with a parameter WSAIoctl (UID: 00000000-00001912) "2cV9250.exe" called "GetProcAddress" with a parameter FreeAddrInfoW (UID: 00000000-00001912) "2cV9250.exe" called "GetProcAddress" with a parameter GetUserNameExW (UID: 00000000-00001912) "2cV9250.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00001912) "2cV9250.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00001912) "2cV9250.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00001912) "2cV9250.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00001912) "2cV9250.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00001912) "2cV9250.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00001912) "2cV9250.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00001912) "2cV9250.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00001912) "2cV9250.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00001912) "2cV9250.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00001912) "2cV9250.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00001912) "2cV9250.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00001912) "2cV9250.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00001912) "2cV9250.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00001912) "2cV9250.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00001912) "2cV9250.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00001912) "2cV9250.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00001912) "2cV9250.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00001912) "2cV9250.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00001912) "2cV9250.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00001912) "2cV9250.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00001912) "2cV9250.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00001912) "2cV9250.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00001912) "2cV9250.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00001912) "2cV9250.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00001912) "2cV9250.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00001912) "2cV9250.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00001912) "2cV9250.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00001912) "2cV9250.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00001912) "2cV9250.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00001912) "2cV9250.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00001912) "2cV9250.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00001912) "2cV9250.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00001912) "2cV9250.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00001912) "2cV9250.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00001912) "2cV9250.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00001912) "2cV9250.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00001912) "2cV9250.exe" called "GetProcAddress" with a parameter WSARecv (UID: 00000000-00001912) "2cV9250.exe" called "GetProcAddress" with a parameter WSASend (UID: 00000000-00001912)35:T1486,Found reference to API "CreateProcessA" (Indicator: "CreateProcess"; File: "wextract.exe") Found reference to API "ElevateCreateProcess WRPMitigationLayer" (Indicator: "CreateProcess"; File: "00003316.00000CF4.909317.00050000.wprm") Found reference to API "__COMPAT_LAYER=ElevateCreateProcess WRPMitigationLayer" (Indicator: "CreateProcess"; Source: "00000000-00001912.00000000.68222.002B0000.00000004.mdmp, 00000000-00001912.00000000.68222.0033E000.00000004.mdmp, 00000000-00001912.00000000.68222.00B40000.00000004.mdmp, 00000000-00001912.00000000.68222.00DE0000.00000004.mdmp, 00000000-00001912.00000000.68222.00E50000.00000004.mdmp, 00000000-00001912.00000000.68222.01030000.00000004.mdmp, 00000000-00001912.00000001.70142.002B0000.00000004.mdmp, 00000000-00001912.00000001.70142.0033E000.00000004.mdmp, 00000000-00001912.00000001.70142.00B40000.00000004.mdmp, 00000000-00001912.00000001.70142.00E50000.00000004.mdmp, 00000000-00001912.00000002.72061.002B0000.00000004.mdmp, 00000000-00001912.00000002.72061.0033E000.00000004.mdmp, 00000000-00001912.00000002.72061.01030000.00000004.mdmp") Found reference to API "ElevateCreateProcess" (Indicator: "CreateProcess"; Source: "00000000-00001912.00000000.68222.002B0000.00000004.mdmp, 00000000-00001912.00000001.70142.002B0000.00000004.mdmp, 00000000-00001912.00000002.72061.002B0000.00000004.mdmp") Found reference to API "__COMPAT_LAYER=ElevateCreateProcess WRPM" (Indicator: "CreateProcess"; Source: "00000000-00001912.00000000.68222.002B0000.00000004.mdmp, 00000000-00001912.00000001.70142.002B0000.00000004.mdmp, 00000000-00001912.00000002.72061.002B0000.00000004.mdmp") Found reference to API "_COMPAT_LAYER=ElevateCreateProcess WRPMitigationLayer" (Indicator: "CreateProcess"; Source: "00000000-00001912.00000000.68222.0033E000.00000004.mdmp, 00000000-00001912.00000001.70142.0033E000.00000004.mdmp, 00000000-00001912.00000002.72061.0033E000.00000004.mdmp") Found reference to API "CreateProcessW" (Indicator: "CreateProcess"; Source: "00000000-00001912.00000000.68222.00400000.00000040.mdmp, 00000000-00001912.00000001.70142.00400000.00000040.mdmp, 00000000-00001912.00000002.72061.00160000.00000040.mdmp") Found reference to API "__COMPAT_LAYER=ElevateCreateProcess WRPMitigationLayer" (Indicator: "CreateProcess"; Source: "00000000-00003028.00000000.67057.00170000.00000004.mdmp, 00000000-00003028.00000000.67057.00350000.00000004.mdmp, 00000000-00003028.00000000.67057.00870000.00000004.mdmp, 00000000-00003028.00000001.68977.00350000.00000004.mdmp, 00000000-00003028.00000002.70898.002C0000.00000004.mdmp") Found reference to API "ElevateCreateProcess" (Indicator: "CreateProcess"; Source: "00000000-00003028.00000000.67057.00350000.00000004.mdmp, 00000000-00003028.00000001.68977.00350000.00000004.mdmp") Found reference to API "MPAT_LAYER=ElevateCreateProcess WRPMitigationLayer" (Indicator: "CreateProcess"; Source: "00000000-00003028.00000000.67057.00350000.00000004.mdmp, 00000000-00003028.00000001.68977.00350000.00000004.mdmp") Found reference to API "ElevateCreateProcess WRPMitigationLayer" (Indicator: "CreateProcess"; Source: "00000000-00003028.00000000.67057.00350000.00000004.mdmp, 00000000-00003028.00000001.68977.00350000.00000004.mdmp") Found reference to API "11303716070,3604,3136,,CreateProcessA,kernel32.dll,"252:02:57.421",RX=0,PX=0" (Indicator: "CreateProcess"; Source: "00000000-00003028.00000000.67057.00350000.00000004.mdmp") Found reference to API "__COMPAT_LAYER=ElevateCreateProcess WRPMitigx" (Indicator: "CreateProcess"; Source: "00000000-00003028.00000000.67057.00870000.00000004.mdmp") Found reference to API "29357629640,3604,3136,,CreateProcessA,kernel32.dll,"252:03:15.015",RX=0,PX=0" (Indicator: "CreateProcess"; Source: "00000000-00003028.00000001.68977.00350000.00000004.mdmp") Found reference to API "CreateProcessA" (Indicator: "CreateProcess"; Source: "00000000-00003028.00000001.68977.012DA000.00000002.mdmp") Found reference to API "__COMPAT_LAYER=ElevateCreateProcess WRPMitig" (Indicator: "CreateProcess"; Source: "00000000-00003316.00000000.66984.00910000.00000004.mdmp") Found reference to API "__COMPAT_LAYER=ElevateCreateProcess WRPMitigationLayer" (Indicator: "CreateProcess"; Source: "00000000-00003316.00000000.66984.00910000.00000004.mdmp, 00000000-00003316.00000001.68903.00110000.00000004.mdmp, 00000000-00003316.00000001.68903.00C90000.00000004.mdmp, 00000000-00003316.00000001.68903.00DA0000.00000004.mdmp") Found reference to API "ElevateCreateProcess" (Indicator: "CreateProcess"; Source: "00000000-00003316.00000001.68903.00110000.00000004.mdmp") Found reference to API "MPAT_LAYER=ElevateCreateProcess WRPMitigationLayer" (Indicator: "CreateProcess"; Source: "00000000-00003316.00000001.68903.00110000.00000004.mdmp") Found reference to API "ElevateCreateProcess WRPMitigationLayer" (Indicator: "CreateProcess"; Source: "00000000-00003316.00000001.68903.00110000.00000004.mdmp") Found reference to API "1407026455,3592,3136,,CreateProcessA,kernel32.dll,"252:02:56.765",RX=0,PX=0" (Indicator: "CreateProcess"; Source: "00000000-00003316.00000001.68903.00110000.00000004.mdmp") Found reference to API "CreateProcessA" (Indicator: "CreateProcess"; Source: "00000000-00003316.00000002.70823.0034A000.00000002.mdmp")36:T472,Found reference to API "CreateFileA" (Indicator: "CreateFile"; File: "wextract.exe") Found reference to API "CreateFileW" (Indicator: "CreateFile"; File: "2cV9250.exe.1068760659") Found reference to API "CreateFileMappingA" (Indicator: "CreateFile"; File: "2cV9250.exe.1068760659") Found reference to API "CreateFileMappingW" (Indicator: "CreateFile"; File: "2cV9250.exe.1068760659") Found reference to API "CreateFileA" (Indicator: "CreateFile"; Source: "00000000-00001912.00000000.68222.00400000.00000040.mdmp, 00000000-00001912.00000001.70142.00400000.00000040.mdmp, 00000000-00001912.00000002.72061.00160000.00000040.mdmp") Found reference to API "CreateFileW" (Indicator: "CreateFile"; Source: "00000000-00001912.00000000.68222.00400000.00000040.mdmp, 00000000-00001912.00000001.70142.00400000.00000040.mdmp, 00000000-00001912.00000002.72061.00160000.00000040.mdmp") Found reference to API "CreateFileA" (Indicator: "CreateFile"; Source: "00000000-00003028.00000001.68977.012DA000.00000002.mdmp") Found reference to API "CreateFileA" (Indicator: "CreateFile"; Source: "00000000-00003316.00000002.70823.0034A000.00000002.mdmp")37:T12c9b,Found reference to API (Indicator: "CheckTokenMembership"; File: "wextract.exe") Found reference to API (Indicator: "HeapSetInformation"; File: "wextract.exe") Found reference to API (Indicator: "DecryptFileA"; File: "wextract.exe") Found reference to API (Indicator: "SHBrowseForFolder"; File: "wextract.exe") Found reference to API (Indicator: "SHGetPathFromIDList"; File: "wextract.exe") Found reference to API (Indicator: "GetTokenInformation"; File: "wextract.exe") Found reference to API (Indicator: "RegDeleteValueA"; File: "wextract.exe") Found reference to API (Indicator: "RegOpenKeyExA"; File: "wextract.exe") Found reference to API (Indicator: "RegQueryInfoKeyA"; File: "wextract.exe") Found reference to API (Indicator: "FreeSid"; File: "wextract.exe") Found reference to API (Indicator: "OpenProcessToken"; File: "wextract.exe") Found reference to API (Indicator: "RegSetValueExA"; File: "wextract.exe") Found reference to API (Indicator: "RegCreateKeyExA"; File: "wextract.exe") Found reference to API (Indicator: "LookupPrivilegeValueA"; File: "wextract.exe") Found reference to API (Indicator: "AllocateAndInitializeSid"; File: "wextract.exe") Found reference to API (Indicator: "RegQueryValueExA"; File: "wextract.exe") Found reference to API (Indicator: "EqualSid"; File: "wextract.exe") Found reference to API (Indicator: "RegCloseKey"; File: "wextract.exe") Found reference to API (Indicator: "AdjustTokenPrivileges"; File: "wextract.exe") Found reference to API (Indicator: "GetShortPathNameA"; File: "wextract.exe") Found reference to API (Indicator: "GetModuleFileNameA"; File: "wextract.exe") Found reference to API (Indicator: "FindFirstFileA"; File: "wextract.exe") Found reference to API (Indicator: "GetCurrentProcess"; File: "wextract.exe") Found reference to API (Indicator: "FindNextFileA"; File: "wextract.exe") Found reference to API (Indicator: "ExpandEnvironmentStringsA"; File: "wextract.exe") Found reference to API (Indicator: "FindClose"; File: "wextract.exe") Found reference to API (Indicator: "LocalAlloc"; File: "wextract.exe") Found reference to API (Indicator: "lstrcmpA"; File: "wextract.exe") Found reference to API (Indicator: "CompareStringA"; File: "wextract.exe") Found reference to API (Indicator: "GetLastError"; File: "wextract.exe") Found reference to API (Indicator: "GetFileAttributesA"; File: "wextract.exe") Found reference to API (Indicator: "GetSystemDirectoryA"; File: "wextract.exe") Found reference to API (Indicator: "LoadLibraryA"; File: "wextract.exe") Found reference to API (Indicator: "DeleteFileA"; File: "wextract.exe") Found reference to API (Indicator: "GlobalAlloc"; File: "wextract.exe") Found reference to API (Indicator: "GlobalFree"; File: "wextract.exe") Found reference to API (Indicator: "CloseHandle"; File: "wextract.exe") Found reference to API (Indicator: "WritePrivateProfileStringA"; File: "wextract.exe") Found reference to API (Indicator: "IsDBCSLeadByte"; File: "wextract.exe") Found reference to API (Indicator: "GetWindowsDirectoryA"; File: "wextract.exe") Found reference to API (Indicator: "SetFileAttributesA"; File: "wextract.exe") Found reference to API (Indicator: "GetProcAddress"; File: "wextract.exe") Found reference to API (Indicator: "GlobalLock"; File: "wextract.exe") Found reference to API (Indicator: "LocalFree"; File: "wextract.exe") Found reference to API (Indicator: "RemoveDirectoryA"; File: "wextract.exe") Found reference to API (Indicator: "FreeLibrary"; File: "wextract.exe") Found reference to API (Indicator: "CreateDirectoryA"; File: "wextract.exe") Found reference to API (Indicator: "GetPrivateProfileIntA"; File: "wextract.exe") Found reference to API (Indicator: "GetPrivateProfileStringA"; File: "wextract.exe") Found reference to API (Indicator: "GlobalUnlock"; File: "wextract.exe") Found reference to API (Indicator: "ReadFile"; File: "wextract.exe") Found reference to API (Indicator: "SizeofResource"; File: "wextract.exe") Found reference to API (Indicator: "WriteFile"; File: "wextract.exe") Found reference to API (Indicator: "GetDriveTypeA"; File: "wextract.exe") Found reference to API (Indicator: "LoadLibraryExA"; File: "wextract.exe") Found reference to API (Indicator: "SetFileTime"; File: "wextract.exe") Found reference to API (Indicator: "SetFilePointer"; File: "wextract.exe") Found reference to API (Indicator: "FindResourceA"; File: "wextract.exe") Found reference to API (Indicator: "CreateMutexA"; File: "wextract.exe") Found reference to API (Indicator: "GetVolumeInformationA"; File: "wextract.exe") Found reference to API (Indicator: "WaitForSingleObject"; File: "wextract.exe") Found reference to API (Indicator: "GetCurrentDirectoryA"; File: "wextract.exe") Found reference to API (Indicator: "FreeResource"; File: "wextract.exe") Found reference to API (Indicator: "GetVersion"; File: "wextract.exe") Found reference to API (Indicator: "SetCurrentDirectoryA"; File: "wextract.exe") Found reference to API (Indicator: "GetTempPathA"; File: "wextract.exe") Found reference to API (Indicator: "LocalFileTimeToFileTime"; File: "wextract.exe") Found reference to API (Indicator: "CreateFileA"; File: "wextract.exe") Found reference to API (Indicator: "SetEvent"; File: "wextract.exe") Found reference to API (Indicator: "TerminateThread"; File: "wextract.exe") Found reference to API (Indicator: "GetVersionExA"; File: "wextract.exe") Found reference to API (Indicator: "LockResource"; File: "wextract.exe") Found reference to API (Indicator: "GetSystemInfo"; File: "wextract.exe") Found reference to API (Indicator: "CreateThread"; File: "wextract.exe") Found reference to API (Indicator: "ResetEvent"; File: "wextract.exe") Found reference to API (Indicator: "LoadResource"; File: "wextract.exe") Found reference to API (Indicator: "ExitProcess"; File: "wextract.exe") Found reference to API (Indicator: "GetModuleHandleW"; File: "wextract.exe") Found reference to API (Indicator: "CreateProcessA"; File: "wextract.exe") Found reference to API (Indicator: "FormatMessageA"; File: "wextract.exe") Found reference to API (Indicator: "GetTempFileNameA"; File: "wextract.exe") Found reference to API (Indicator: "DosDateTimeToFileTime"; File: "wextract.exe") Found reference to API (Indicator: "CreateEventA"; File: "wextract.exe") Found reference to API (Indicator: "GetExitCodeProcess"; File: "wextract.exe") Found reference to API (Indicator: "GetDeviceCaps"; File: "wextract.exe") Found reference to API (Indicator: "GetDesktopWindow"; File: "wextract.exe") Found reference to API (Indicator: "CharUpperA"; File: "wextract.exe") Found reference to API (Indicator: "ExitWindowsEx"; File: "wextract.exe") Found reference to API (Indicator: "MessageBeep"; File: "wextract.exe") Found reference to API (Indicator: "CharPrevA"; File: "wextract.exe") Found reference to API (Indicator: "LoadStringA"; File: "wextract.exe") Found reference to API (Indicator: "CharNextA"; File: "wextract.exe") Found reference to API (Indicator: "EnableWindow"; File: "wextract.exe") Found reference to API (Indicator: "ReleaseDC"; File: "wextract.exe") Found reference to API (Indicator: "SetForegroundWindow"; File: "wextract.exe") Found reference to API (Indicator: "PeekMessageA"; File: "wextract.exe") Found reference to API (Indicator: "SendMessageA"; File: "wextract.exe") Found reference to API (Indicator: "MessageBoxA"; File: "wextract.exe") Found reference to API (Indicator: "SetWindowTextA"; File: "wextract.exe") Found reference to API (Indicator: "GetWindowLongA"; File: "wextract.exe") Found reference to API (Indicator: "CallWindowProcA"; File: "wextract.exe") Found reference to API (Indicator: "SetWindowLongA"; File: "wextract.exe") Found reference to API (Indicator: "ShowWindow"; File: "wextract.exe") Found reference to API (Indicator: "MsgWaitForMultipleObjects"; File: "wextract.exe") Found reference to API (Indicator: "SetWindowPos"; File: "wextract.exe") Found reference to API (Indicator: "GetDC"; File: "wextract.exe") Found reference to API (Indicator: "GetWindowRect"; File: "wextract.exe") Found reference to API (Indicator: "DispatchMessageA"; File: "wextract.exe") Found reference to API (Indicator: "GetFileVersionInfoSizeA"; File: "wextract.exe") Found reference to API (Indicator: "VerQueryValueA"; File: "wextract.exe") Found reference to API (Indicator: "GetFileVersionInfoA"; File: "wextract.exe") Found reference to API (Indicator: "Sleep"; File: "wextract.exe") Found reference to API (Indicator: "GetStartupInfoW"; File: "wextract.exe") Found reference to API (Indicator: "UnhandledExceptionFilter"; File: "wextract.exe") Found reference to API (Indicator: "SetUnhandledExceptionFilter"; File: "wextract.exe") Found reference to API (Indicator: "TerminateProcess"; File: "wextract.exe") Found reference to API (Indicator: "QueryPerformanceCounter"; File: "wextract.exe") Found reference to API (Indicator: "GetCurrentProcessId"; File: "wextract.exe") Found reference to API (Indicator: "GetCurrentThreadId"; File: "wextract.exe") Found reference to API (Indicator: "GetSystemTimeAsFileTime"; File: "wextract.exe") Found reference to API (Indicator: "GetTickCount"; File: "wextract.exe") Found reference to API (Indicator: "EnumResourceLanguagesA"; File: "wextract.exe") Found reference to API (Indicator: "GetDiskFreeSpaceA"; File: "wextract.exe") Found reference to API (Indicator: "MulDiv"; File: "wextract.exe") Found reference to API (Indicator: "GetSystemMetrics"; File: "wextract.exe") Found reference to API (Indicator: "FlsSetValue"; File: "00000000-00003660.00000000.67098.01261000.00000020.mdmp") Found reference to API (Indicator: "FlsGetValue"; File: "00000000-00003660.00000000.67098.01261000.00000020.mdmp") Found reference to API (Indicator: "FlsFree"; File: "00000000-00001912.00000000.68222.00400000.00000040.mdmp") Found reference to API (Indicator: "LCMapStringEx"; File: "00000000-00001912.00000000.68222.00400000.00000040.mdmp") Found reference to API (Indicator: "InitializeCriticalSectionEx"; File: "00000000-00001912.00000000.68222.00400000.00000040.mdmp") Found reference to API (Indicator: "FlsAlloc"; File: "00000000-00001912.00000000.68222.00400000.00000040.mdmp") Found reference to API (Indicator: "AreFileApisANSI"; File: "00000000-00001912.00000000.68222.00400000.00000040.mdmp") Found reference to API (Indicator: "LocaleNameToLCID"; File: "00000000-00001912.00000000.68222.00400000.00000040.mdmp") Found reference to API (Indicator: "CompareStringEx"; File: "00000000-00001912.00000000.68222.00400000.00000040.mdmp") Found reference to API (Indicator: "EncodePointer"; File: "2cV9250.exe.1068760659") Found reference to API (Indicator: "DecodePointer"; File: "2cV9250.exe.1068760659") Found reference to API (Indicator: "GetActiveWindow"; File: "2cV9250.exe.1068760659") Found reference to API (Indicator: "GetLastActivePopup"; File: "2cV9250.exe.1068760659") Found reference to API (Indicator: "GetUserObjectInformationA"; File: "2cV9250.exe.1068760659") Found reference to API (Indicator: "GetProcessWindowStation"; File: "2cV9250.exe.1068760659") Found reference to API (Indicator: "GetFullPathNameW"; File: "2cV9250.exe.1068760659") Found reference to API (Indicator: "GetComputerNameA"; File: "2cV9250.exe.1068760659") Found reference to API (Indicator: "GetDateFormatW"; File: "2cV9250.exe.1068760659") Found reference to API (Indicator: "GlobalDeleteAtom"; File: "2cV9250.exe.1068760659") Found reference to API (Indicator: "SystemTimeToTzSpecificLocalTime"; File: "2cV9250.exe.1068760659") Found reference to API (Indicator: "InterlockedIncrement"; File: "2cV9250.exe.1068760659") Found reference to API (Indicator: "GetSystemWindowsDirectoryW"; File: "2cV9250.exe.1068760659") Found reference to API (Indicator: "InterlockedCompareExchange"; File: "2cV9250.exe.1068760659") Found reference to API (Indicator: "BackupSeek"; File: "2cV9250.exe.1068760659") Found reference to API (Indicator: "FindNextVolumeMountPointA"; File: "2cV9250.exe.1068760659") Found reference to API (Indicator: "GetConsoleAliasesLengthA"; File: "2cV9250.exe.1068760659") Found reference to API (Indicator: "TlsSetValue"; File: "2cV9250.exe.1068760659") Found reference to API (Indicator: "GetCurrencyFormatW"; File: "2cV9250.exe.1068760659") Found reference to API (Indicator: "LoadLibraryW"; File: "2cV9250.exe.1068760659") Found reference to API (Indicator: "AssignProcessToJobObject"; File: "2cV9250.exe.1068760659") Found reference to API (Indicator: "GetVersionExW"; File: "2cV9250.exe.1068760659") Found reference to API (Indicator: "CreateFileW"; File: "2cV9250.exe.1068760659") Found reference to API (Indicator: "GetVolumePathNameA"; File: "2cV9250.exe.1068760659") Found reference to API (Indicator: "CreateJobObjectA"; File: "2cV9250.exe.1068760659") Found reference to API (Indicator: "LCMapStringA"; File: "2cV9250.exe.1068760659") Found reference to API (Indicator: "InterlockedExchange"; File: "2cV9250.exe.1068760659") Found reference to API (Indicator: "SetLastError"; File: "2cV9250.exe.1068760659") Found reference to API (Indicator: "GetProcessHeaps"; File: "2cV9250.exe.1068760659") Found reference to API (Indicator: "VirtualAlloc"; File: "2cV9250.exe.1068760659") Found reference to API (Indicator: "BackupWrite"; File: "2cV9250.exe.1068760659") Found reference to API (Indicator: "EnumDateFormatsExA"; File: "2cV9250.exe.1068760659") Found reference to API (Indicator: "SetComputerNameA"; File: "2cV9250.exe.1068760659") Found reference to API (Indicator: "OpenMutexA"; File: "2cV9250.exe.1068760659") Found reference to API (Indicator: "CreateFileMappingA"; File: "2cV9250.exe.1068760659") Found reference to API (Indicator: "CreateFileMappingW"; File: "2cV9250.exe.1068760659") Found reference to API (Indicator: "FindFirstVolumeMountPointW"; File: "2cV9250.exe.1068760659") Found reference to API (Indicator: "BeginUpdateResourceA"; File: "2cV9250.exe.1068760659") Found reference to API (Indicator: "GlobalFindAtomW"; File: "2cV9250.exe.1068760659") Found reference to API (Indicator: "CreateIoCompletionPort"; File: "2cV9250.exe.1068760659") Found reference to API (Indicator: "FindFirstChangeNotificationA"; File: "2cV9250.exe.1068760659") Found reference to API (Indicator: "VirtualProtect"; File: "2cV9250.exe.1068760659") Found reference to API (Indicator: "OpenSemaphoreW"; File: "2cV9250.exe.1068760659") Found reference to API (Indicator: "FindAtomW"; File: "2cV9250.exe.1068760659") Found reference to API (Indicator: "GlobalAddAtomW"; File: "2cV9250.exe.1068760659") Found reference to API (Indicator: "RegisterEventSourceW"; File: "2cV9250.exe.1068760659") Found reference to API (Indicator: "GetCommandLineA"; File: "2cV9250.exe.1068760659") Found reference to API (Indicator: "GetStartupInfoA"; File: "2cV9250.exe.1068760659") Found reference to API (Indicator: "GetStdHandle"; File: "2cV9250.exe.1068760659") Found reference to API (Indicator: "GetCPInfo"; File: "2cV9250.exe.1068760659") Found reference to API (Indicator: "InterlockedDecrement"; File: "2cV9250.exe.1068760659") Found reference to API (Indicator: "GetACP"; File: "2cV9250.exe.1068760659") Found reference to API (Indicator: "GetOEMCP"; File: "2cV9250.exe.1068760659") Found reference to API (Indicator: "IsValidCodePage"; File: "2cV9250.exe.1068760659") Found reference to API (Indicator: "TlsGetValue"; File: "2cV9250.exe.1068760659") Found reference to API (Indicator: "TlsAlloc"; File: "2cV9250.exe.1068760659") Found reference to API (Indicator: "TlsFree"; File: "2cV9250.exe.1068760659") Found reference to API (Indicator: "HeapSize"; File: "2cV9250.exe.1068760659") Found reference to API (Indicator: "HeapFree"; File: "2cV9250.exe.1068760659") Found reference to API (Indicator: "IsDebuggerPresent"; File: "2cV9250.exe.1068760659") Found reference to API (Indicator: "DeleteCriticalSection"; File: "2cV9250.exe.1068760659") Found reference to API (Indicator: "LeaveCriticalSection"; File: "2cV9250.exe.1068760659") Found reference to API (Indicator: "EnterCriticalSection"; File: "2cV9250.exe.1068760659") Found reference to API (Indicator: "InitializeCriticalSectionAndSpinCount"; File: "2cV9250.exe.1068760659") Found reference to API (Indicator: "FreeEnvironmentStringsA"; File: "2cV9250.exe.1068760659") Found reference to API (Indicator: "GetEnvironmentStrings"; File: "2cV9250.exe.1068760659") Found reference to API (Indicator: "FreeEnvironmentStringsW"; File: "2cV9250.exe.1068760659") Found reference to API (Indicator: "WideCharToMultiByte"; File: "2cV9250.exe.1068760659") Found reference to API (Indicator: "GetEnvironmentStringsW"; File: "2cV9250.exe.1068760659") Found reference to API (Indicator: "SetHandleCount"; File: "2cV9250.exe.1068760659") Found reference to API (Indicator: "GetFileType"; File: "2cV9250.exe.1068760659") Found reference to API (Indicator: "HeapCreate"; File: "2cV9250.exe.1068760659") Found reference to API (Indicator: "VirtualFree"; File: "2cV9250.exe.1068760659") Found reference to API (Indicator: "MultiByteToWideChar"; File: "2cV9250.exe.1068760659") Found reference to API (Indicator: "LCMapStringW"; File: "2cV9250.exe.1068760659") Found reference to API (Indicator: "GetStringTypeA"; File: "2cV9250.exe.1068760659") Found reference to API (Indicator: "GetStringTypeW"; File: "2cV9250.exe.1068760659") Found reference to API (Indicator: "GetLocaleInfoA"; File: "2cV9250.exe.1068760659") Found reference to API (Indicator: "HeapAlloc"; File: "2cV9250.exe.1068760659") Found reference to API (Indicator: "HeapReAlloc"; File: "2cV9250.exe.1068760659") Found reference to API (Indicator: "RtlUnwind"; File: "2cV9250.exe.1068760659") Found reference to API (Indicator: "AreFileApisANSI"; Source: "00000000-00001912.00000000.68222.002FC000.00000040.mdmp, 00000000-00001912.00000000.68222.00400000.00000040.mdmp, 00000000-00001912.00000001.70142.002FC000.00000040.mdmp, 00000000-00001912.00000001.70142.00400000.00000040.mdmp, 00000000-00001912.00000002.72061.00160000.00000040.mdmp") Found reference to API (Indicator: "CompareStringEx"; Source: "00000000-00001912.00000000.68222.00400000.00000040.mdmp, 00000000-00001912.00000001.70142.00400000.00000040.mdmp, 00000000-00001912.00000002.72061.00160000.00000040.mdmp") Found reference to API (Indicator: "FlsAlloc"; Source: "00000000-00001912.00000000.68222.00400000.00000040.mdmp, 00000000-00001912.00000001.70142.00400000.00000040.mdmp, 00000000-00001912.00000002.72061.00160000.00000040.mdmp") Found reference to API (Indicator: "FlsFree"; Source: "00000000-00001912.00000000.68222.00400000.00000040.mdmp, 00000000-00001912.00000001.70142.00400000.00000040.mdmp, 00000000-00001912.00000002.72061.00160000.00000040.mdmp") Found reference to API (Indicator: "FlsGetValue"; Source: "00000000-00001912.00000000.68222.00400000.00000040.mdmp, 00000000-00001912.00000001.70142.00400000.00000040.mdmp, 00000000-00001912.00000002.72061.00160000.00000040.mdmp") Found reference to API (Indicator: "FlsSetValue"; Source: "00000000-00001912.00000000.68222.00400000.00000040.mdmp, 00000000-00001912.00000001.70142.00400000.00000040.mdmp, 00000000-00001912.00000002.72061.00160000.00000040.mdmp") Found reference to API (Indicator: "InitializeCriticalSectionEx"; Source: "00000000-00001912.00000000.68222.00400000.00000040.mdmp, 00000000-00001912.00000001.70142.00400000.00000040.mdmp, 00000000-00001912.00000002.72061.00160000.00000040.mdmp") Found reference to API (Indicator: "LCMapStringEx"; Source: "00000000-00001912.00000000.68222.00400000.00000040.mdmp, 00000000-00001912.00000001.70142.00400000.00000040.mdmp, 00000000-00001912.00000002.72061.00160000.00000040.mdmp") Found reference to API (Indicator: "LocaleNameToLCID"; Source: "00000000-00001912.00000000.68222.00400000.00000040.mdmp, 00000000-00001912.00000001.70142.00400000.00000040.mdmp, 00000000-00001912.00000002.72061.00160000.00000040.mdmp") Found reference to API (Indicator: "CloseHandle"; Source: "00000000-00001912.00000000.68222.00400000.00000040.mdmp, 00000000-00001912.00000001.70142.00400000.00000040.mdmp, 00000000-00001912.00000002.72061.00160000.00000040.mdmp") Found reference to API (Indicator: "CompareStringW"; Source: "00000000-00001912.00000000.68222.00400000.00000040.mdmp, 00000000-00001912.00000001.70142.00400000.00000040.mdmp, 00000000-00001912.00000002.72061.00160000.00000040.mdmp") Found reference to API (Indicator: "CreateFileA"; Source: "00000000-00001912.00000000.68222.00400000.00000040.mdmp, 00000000-00001912.00000001.70142.00400000.00000040.mdmp, 00000000-00001912.00000002.72061.00160000.00000040.mdmp") Found reference to API (Indicator: "CreateFileW"; Source: "00000000-00001912.00000000.68222.00400000.00000040.mdmp, 00000000-00001912.00000001.70142.00400000.00000040.mdmp, 00000000-00001912.00000002.72061.00160000.00000040.mdmp") Found reference to API (Indicator: "CreateProcessW"; Source: "00000000-00001912.00000000.68222.00400000.00000040.mdmp, 00000000-00001912.00000001.70142.00400000.00000040.mdmp, 00000000-00001912.00000002.72061.00160000.00000040.mdmp") Found reference to API (Indicator: "DecodePointer"; Source: "00000000-00001912.00000000.68222.00400000.00000040.mdmp, 00000000-00001912.00000001.70142.00400000.00000040.mdmp, 00000000-00001912.00000002.72061.00160000.00000040.mdmp") Found reference to API (Indicator: "DeleteCriticalSection"; Source: "00000000-00001912.00000000.68222.00400000.00000040.mdmp, 00000000-00001912.00000001.70142.00400000.00000040.mdmp, 00000000-00001912.00000002.72061.00160000.00000040.mdmp") Found reference to API (Indicator: "EncodePointer"; Source: "00000000-00001912.00000000.68222.00400000.00000040.mdmp, 00000000-00001912.00000001.70142.00400000.00000040.mdmp, 00000000-00001912.00000002.72061.00160000.00000040.mdmp") Found reference to API (Indicator: "EnterCriticalSection"; Source: "00000000-00001912.00000000.68222.00400000.00000040.mdmp, 00000000-00001912.00000001.70142.00400000.00000040.mdmp, 00000000-00001912.00000002.72061.00160000.00000040.mdmp") Found reference to API (Indicator: "ExitProcess"; Source: "00000000-00001912.00000000.68222.00400000.00000040.mdmp, 00000000-00001912.00000001.70142.00400000.00000040.mdmp, 00000000-00001912.00000002.72061.00160000.00000040.mdmp") Found reference to API (Indicator: "ExpandEnvironmentStringsW"; Source: "00000000-00001912.00000000.68222.00400000.00000040.mdmp, 00000000-00001912.00000001.70142.00400000.00000040.mdmp, 00000000-00001912.00000002.72061.00160000.00000040.mdmp") Found reference to API (Indicator: "FindClose"; Source: "00000000-00001912.00000000.68222.00400000.00000040.mdmp, 00000000-00001912.00000001.70142.00400000.00000040.mdmp, 00000000-00001912.00000002.72061.00160000.00000040.mdmp") Found reference to API (Indicator: "FindFirstFileExW"; Source: "00000000-00001912.00000000.68222.00400000.00000040.mdmp, 00000000-00001912.00000001.70142.00400000.00000040.mdmp, 00000000-00001912.00000002.72061.00160000.00000040.mdmp") Found reference to API (Indicator: "FindNextFileW"; Source: "00000000-00001912.00000000.68222.00400000.00000040.mdmp, 00000000-00001912.00000001.70142.00400000.00000040.mdmp, 00000000-00001912.00000002.72061.00160000.00000040.mdmp") Found reference to API (Indicator: "FlushFileBuffers"; Source: "00000000-00001912.00000000.68222.00400000.00000040.mdmp, 00000000-00001912.00000001.70142.00400000.00000040.mdmp, 00000000-00001912.00000002.72061.00160000.00000040.mdmp") Found reference to API (Indicator: "FreeEnvironmentStringsW"; Source: "00000000-00001912.00000000.68222.00400000.00000040.mdmp, 00000000-00001912.00000001.70142.00400000.00000040.mdmp, 00000000-00001912.00000002.72061.00160000.00000040.mdmp") Found reference to API (Indicator: "FreeLibrary"; Source: "00000000-00001912.00000000.68222.00400000.00000040.mdmp, 00000000-00001912.00000001.70142.00400000.00000040.mdmp, 00000000-00001912.00000002.72061.00160000.00000040.mdmp") Found reference to API (Indicator: "GetACP"; Source: "00000000-00001912.00000000.68222.00400000.00000040.mdmp, 00000000-00001912.00000001.70142.00400000.00000040.mdmp, 00000000-00001912.00000002.72061.00160000.00000040.mdmp") Found reference to API (Indicator: "GetCPInfo"; Source: "00000000-00001912.00000000.68222.00400000.00000040.mdmp, 00000000-00001912.00000001.70142.00400000.00000040.mdmp, 00000000-00001912.00000002.72061.00160000.00000040.mdmp") Found reference to API (Indicator: "GetCommandLineA"; Source: "00000000-00001912.00000000.68222.00400000.00000040.mdmp, 00000000-00001912.00000001.70142.00400000.00000040.mdmp, 00000000-00001912.00000002.72061.00160000.00000040.mdmp") Found reference to API (Indicator: "GetCommandLineW"; Source: "00000000-00001912.00000000.68222.00400000.00000040.mdmp, 00000000-00001912.00000001.70142.00400000.00000040.mdmp, 00000000-00001912.00000002.72061.00160000.00000040.mdmp") Found reference to API (Indicator: "GetComputerNameExA"; Source: "00000000-00001912.00000000.68222.00400000.00000040.mdmp, 00000000-00001912.00000001.70142.00400000.00000040.mdmp, 00000000-00001912.00000002.72061.00160000.00000040.mdmp") Found reference to API (Indicator: "GetComputerNameW"; Source: "00000000-00001912.00000000.68222.00400000.00000040.mdmp, 00000000-00001912.00000001.70142.00400000.00000040.mdmp, 00000000-00001912.00000002.72061.00160000.00000040.mdmp") Found reference to API (Indicator: "GetConsoleMode"; Source: "00000000-00001912.00000000.68222.00400000.00000040.mdmp, 00000000-00001912.00000001.70142.00400000.00000040.mdmp, 00000000-00001912.00000002.72061.00160000.00000040.mdmp") Found reference to API (Indicator: "GetConsoleOutputCP"; Source: "00000000-00001912.00000000.68222.00400000.00000040.mdmp, 00000000-00001912.00000001.70142.00400000.00000040.mdmp, 00000000-00001912.00000002.72061.00160000.00000040.mdmp") Found reference to API (Indicator: "GetCurrentProcess"; Source: "00000000-00001912.00000000.68222.00400000.00000040.mdmp, 00000000-00001912.00000001.70142.00400000.00000040.mdmp, 00000000-00001912.00000002.72061.00160000.00000040.mdmp") Found reference to API (Indicator: "GetCurrentProcessId"; Source: "00000000-00001912.00000000.68222.00400000.00000040.mdmp, 00000000-00001912.00000001.70142.00400000.00000040.mdmp, 00000000-00001912.00000002.72061.00160000.00000040.mdmp") Found reference to API (Indicator: "GetCurrentThreadId"; Source: "00000000-00001912.00000000.68222.00400000.00000040.mdmp, 00000000-00001912.00000001.70142.00400000.00000040.mdmp, 00000000-00001912.00000002.72061.00160000.00000040.mdmp") Found reference to API (Indicator: "GetEnvironmentStringsW"; Source: "00000000-00001912.00000000.68222.00400000.00000040.mdmp, 00000000-00001912.00000001.70142.00400000.00000040.mdmp, 00000000-00001912.00000002.72061.00160000.00000040.mdmp") Found reference to API (Indicator: "GetFileSizeEx"; Source: "00000000-00001912.00000000.68222.00400000.00000040.mdmp, 00000000-00001912.00000001.70142.00400000.00000040.mdmp, 00000000-00001912.00000002.72061.00160000.00000040.mdmp") Found reference to API (Indicator: "GetFileType"; Source: "00000000-00001912.00000000.68222.00400000.00000040.mdmp, 00000000-00001912.00000001.70142.00400000.00000040.mdmp, 00000000-00001912.00000002.72061.00160000.00000040.mdmp") Found reference to API (Indicator: "GetLastError"; Source: "00000000-00001912.00000000.68222.00400000.00000040.mdmp, 00000000-00001912.00000001.70142.00400000.00000040.mdmp, 00000000-00001912.00000002.72061.00160000.00000040.mdmp") Found reference to API (Indicator: "GetModuleFileNameA"; Source: "00000000-00001912.00000000.68222.00400000.00000040.mdmp, 00000000-00001912.00000001.70142.00400000.00000040.mdmp, 00000000-00001912.00000002.72061.00160000.00000040.mdmp") Found reference to API (Indicator: "GetModuleFileNameW"; Source: "00000000-00001912.00000000.68222.00400000.00000040.mdmp, 00000000-00001912.00000001.70142.00400000.00000040.mdmp, 00000000-00001912.00000002.72061.00160000.00000040.mdmp") Found reference to API (Indicator: "GetModuleHandleExW"; Source: "00000000-00001912.00000000.68222.00400000.00000040.mdmp, 00000000-00001912.00000001.70142.00400000.00000040.mdmp, 00000000-00001912.00000002.72061.00160000.00000040.mdmp") Found reference to API (Indicator: "GetModuleHandleW"; Source: "00000000-00001912.00000000.68222.00400000.00000040.mdmp, 00000000-00001912.00000001.70142.00400000.00000040.mdmp, 00000000-00001912.00000002.72061.00160000.00000040.mdmp") Found reference to API (Indicator: "GetOEMCP"; Source: "00000000-00001912.00000000.68222.00400000.00000040.mdmp, 00000000-00001912.00000001.70142.00400000.00000040.mdmp, 00000000-00001912.00000002.72061.00160000.00000040.mdmp") Found reference to API (Indicator: "GetProcAddress"; Source: "00000000-00001912.00000000.68222.00400000.00000040.mdmp, 00000000-00001912.00000001.70142.00400000.00000040.mdmp, 00000000-00001912.00000002.72061.00160000.00000040.mdmp") Found reference to API (Indicator: "GetProcessHeap"; Source: "00000000-00001912.00000000.68222.00400000.00000040.mdmp, 00000000-00001912.00000001.70142.00400000.00000040.mdmp, 00000000-00001912.00000002.72061.00160000.00000040.mdmp") Found reference to API (Indicator: "GetStartupInfoW"; Source: "00000000-00001912.00000000.68222.00400000.00000040.mdmp, 00000000-00001912.00000001.70142.00400000.00000040.mdmp, 00000000-00001912.00000002.72061.00160000.00000040.mdmp") Found reference to API (Indicator: "GetStdHandle"; Source: "00000000-00001912.00000000.68222.00400000.00000040.mdmp, 00000000-00001912.00000001.70142.00400000.00000040.mdmp, 00000000-00001912.00000002.72061.00160000.00000040.mdmp") Found reference to API (Indicator: "GetStringTypeW"; Source: "00000000-00001912.00000000.68222.00400000.00000040.mdmp, 00000000-00001912.00000001.70142.00400000.00000040.mdmp, 00000000-00001912.00000002.72061.00160000.00000040.mdmp") Found reference to API (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00001912.00000000.68222.00400000.00000040.mdmp, 00000000-00001912.00000001.70142.00400000.00000040.mdmp, 00000000-00001912.00000002.72061.00160000.00000040.mdmp") Found reference to API (Indicator: "GetTimeZoneInformation"; Source: "00000000-00001912.00000000.68222.00400000.00000040.mdmp, 00000000-00001912.00000001.70142.00400000.00000040.mdmp, 00000000-00001912.00000002.72061.00160000.00000040.mdmp") Found reference to API (Indicator: "GetVolumeInformationW"; Source: "00000000-00001912.00000000.68222.00400000.00000040.mdmp, 00000000-00001912.00000001.70142.00400000.00000040.mdmp, 00000000-00001912.00000002.72061.00160000.00000040.mdmp") Found reference to API (Indicator: "GetWindowsDirectoryW"; Source: "00000000-00001912.00000000.68222.00400000.00000040.mdmp, 00000000-00001912.00000001.70142.00400000.00000040.mdmp, 00000000-00001912.00000002.72061.00160000.00000040.mdmp") Found reference to API (Indicator: "HeapAlloc"; Source: "00000000-00001912.00000000.68222.00400000.00000040.mdmp, 00000000-00001912.00000001.70142.00400000.00000040.mdmp, 00000000-00001912.00000002.72061.00160000.00000040.mdmp") Found reference to API (Indicator: "HeapFree"; Source: "00000000-00001912.00000000.68222.00400000.00000040.mdmp, 00000000-00001912.00000001.70142.00400000.00000040.mdmp, 00000000-00001912.00000002.72061.00160000.00000040.mdmp") Found reference to API (Indicator: "HeapReAlloc"; Source: "00000000-00001912.00000000.68222.00400000.00000040.mdmp, 00000000-00001912.00000001.70142.00400000.00000040.mdmp, 00000000-00001912.00000002.72061.00160000.00000040.mdmp") Found reference to API (Indicator: "HeapSize"; Source: "00000000-00001912.00000000.68222.00400000.00000040.mdmp, 00000000-00001912.00000001.70142.00400000.00000040.mdmp, 00000000-00001912.00000002.72061.00160000.00000040.mdmp") Found reference to API (Indicator: "InitializeCriticalSectionAndSpinCount"; Source: "00000000-00001912.00000000.68222.00400000.00000040.mdmp, 00000000-00001912.00000001.70142.00400000.00000040.mdmp, 00000000-00001912.00000002.72061.00160000.00000040.mdmp") Found reference to API (Indicator: "InitializeSListHead"; Source: "00000000-00001912.00000000.68222.00400000.00000040.mdmp, 00000000-00001912.00000001.70142.00400000.00000040.mdmp, 00000000-00001912.00000002.72061.00160000.00000040.mdmp") Found reference to API (Indicator: "IsDebuggerPresent"; Source: "00000000-00001912.00000000.68222.00400000.00000040.mdmp, 00000000-00001912.00000001.70142.00400000.00000040.mdmp, 00000000-00001912.00000002.72061.00160000.00000040.mdmp") Found reference to API (Indicator: "IsProcessorFeaturePresent"; Source: "00000000-00001912.00000000.68222.00400000.00000040.mdmp, 00000000-00001912.00000001.70142.00400000.00000040.mdmp, 00000000-00001912.00000002.72061.00160000.00000040.mdmp") Found reference to API (Indicator: "IsValidCodePage"; Source: "00000000-00001912.00000000.68222.00400000.00000040.mdmp, 00000000-00001912.00000001.70142.00400000.00000040.mdmp, 00000000-00001912.00000002.72061.00160000.00000040.mdmp") Found reference to API (Indicator: "LCMapStringW"; Source: "00000000-00001912.00000000.68222.00400000.00000040.mdmp, 00000000-00001912.00000001.70142.00400000.00000040.mdmp, 00000000-00001912.00000002.72061.00160000.00000040.mdmp") Found reference to API (Indicator: "LeaveCriticalSection"; Source: "00000000-00001912.00000000.68222.00400000.00000040.mdmp, 00000000-00001912.00000001.70142.00400000.00000040.mdmp, 00000000-00001912.00000002.72061.00160000.00000040.mdmp") Found reference to API (Indicator: "LoadLibraryA"; Source: "00000000-00001912.00000000.68222.00400000.00000040.mdmp, 00000000-00001912.00000001.70142.00400000.00000040.mdmp, 00000000-00001912.00000002.72061.00160000.00000040.mdmp") Found reference to API (Indicator: "LoadLibraryExW"; Source: "00000000-00001912.00000000.68222.00400000.00000040.mdmp, 00000000-00001912.00000001.70142.00400000.00000040.mdmp, 00000000-00001912.00000002.72061.00160000.00000040.mdmp") Found reference to API (Indicator: "LoadLibraryW"; Source: "00000000-00001912.00000000.68222.00400000.00000040.mdmp, 00000000-00001912.00000001.70142.00400000.00000040.mdmp, 00000000-00001912.00000002.72061.00160000.00000040.mdmp") Found reference to API (Indicator: "MultiByteToWideChar"; Source: "00000000-00001912.00000000.68222.00400000.00000040.mdmp, 00000000-00001912.00000001.70142.00400000.00000040.mdmp, 00000000-00001912.00000002.72061.00160000.00000040.mdmp") Found reference to API (Indicator: "QueryPerformanceCounter"; Source: "00000000-00001912.00000000.68222.00400000.00000040.mdmp, 00000000-00001912.00000001.70142.00400000.00000040.mdmp, 00000000-00001912.00000002.72061.00160000.00000040.mdmp") Found reference to API (Indicator: "RaiseException"; Source: "00000000-00001912.00000000.68222.00400000.00000040.mdmp, 00000000-00001912.00000001.70142.00400000.00000040.mdmp, 00000000-00001912.00000002.72061.00160000.00000040.mdmp") Found reference to API (Indicator: "ReadFile"; Source: "00000000-00001912.00000000.68222.00400000.00000040.mdmp, 00000000-00001912.00000001.70142.00400000.00000040.mdmp, 00000000-00001912.00000002.72061.00160000.00000040.mdmp") Found reference to API (Indicator: "RtlUnwind"; Source: "00000000-00001912.00000000.68222.00400000.00000040.mdmp, 00000000-00001912.00000001.70142.00400000.00000040.mdmp, 00000000-00001912.00000002.72061.00160000.00000040.mdmp") Found reference to API (Indicator: "SetEndOfFile"; Source: "00000000-00001912.00000000.68222.00400000.00000040.mdmp, 00000000-00001912.00000001.70142.00400000.00000040.mdmp, 00000000-00001912.00000002.72061.00160000.00000040.mdmp") Found reference to API (Indicator: "SetEnvironmentVariableW"; Source: "00000000-00001912.00000000.68222.00400000.00000040.mdmp, 00000000-00001912.00000001.70142.00400000.00000040.mdmp, 00000000-00001912.00000002.72061.00160000.00000040.mdmp") Found reference to API (Indicator: "SetFilePointerEx"; Source: "00000000-00001912.00000000.68222.00400000.00000040.mdmp, 00000000-00001912.00000001.70142.00400000.00000040.mdmp, 00000000-00001912.00000002.72061.00160000.00000040.mdmp") Found reference to API (Indicator: "SetLastError"; Source: "00000000-00001912.00000000.68222.00400000.00000040.mdmp, 00000000-00001912.00000001.70142.00400000.00000040.mdmp, 00000000-00001912.00000002.72061.00160000.00000040.mdmp") Found reference to API (Indicator: "SetStdHandle"; Source: "00000000-00001912.00000000.68222.00400000.00000040.mdmp, 00000000-00001912.00000001.70142.00400000.00000040.mdmp, 00000000-00001912.00000002.72061.00160000.00000040.mdmp") Found reference to API (Indicator: "SetUnhandledExceptionFilter"; Source: "00000000-00001912.00000000.68222.00400000.00000040.mdmp, 00000000-00001912.00000001.70142.00400000.00000040.mdmp, 00000000-00001912.00000002.72061.00160000.00000040.mdmp") Found reference to API (Indicator: "TerminateProcess"; Source: "00000000-00001912.00000000.68222.00400000.00000040.mdmp, 00000000-00001912.00000001.70142.00400000.00000040.mdmp, 00000000-00001912.00000002.72061.00160000.00000040.mdmp") Found reference to API (Indicator: "TlsAlloc"; Source: "00000000-00001912.00000000.68222.00400000.00000040.mdmp, 00000000-00001912.00000001.70142.00400000.00000040.mdmp, 00000000-00001912.00000002.72061.00160000.00000040.mdmp") Found reference to API (Indicator: "TlsFree"; Source: "00000000-00001912.00000000.68222.00400000.00000040.mdmp, 00000000-00001912.00000001.70142.00400000.00000040.mdmp, 00000000-00001912.00000002.72061.00160000.00000040.mdmp") Found reference to API (Indicator: "TlsGetValue"; Source: "00000000-00001912.00000000.68222.00400000.00000040.mdmp, 00000000-00001912.00000001.70142.00400000.00000040.mdmp, 00000000-00001912.00000002.72061.00160000.00000040.mdmp") Found reference to API (Indicator: "TlsSetValue"; Source: "00000000-00001912.00000000.68222.00400000.00000040.mdmp, 00000000-00001912.00000001.70142.00400000.00000040.mdmp, 00000000-00001912.00000002.72061.00160000.00000040.mdmp") Found reference to API (Indicator: "UnhandledExceptionFilter"; Source: "00000000-00001912.00000000.68222.00400000.00000040.mdmp, 00000000-00001912.00000001.70142.00400000.00000040.mdmp, 00000000-00001912.00000002.72061.00160000.00000040.mdmp") Found reference to API (Indicator: "WideCharToMultiByte"; Source: "00000000-00001912.00000000.68222.00400000.00000040.mdmp, 00000000-00001912.00000001.70142.00400000.00000040.mdmp, 00000000-00001912.00000002.72061.00160000.00000040.mdmp") Found reference to API (Indicator: "WinExec"; Source: "00000000-00001912.00000000.68222.00400000.00000040.mdmp, 00000000-00001912.00000001.70142.00400000.00000040.mdmp, 00000000-00001912.00000002.72061.00160000.00000040.mdmp") Found reference to API (Indicator: "WriteConsoleW"; Source: "00000000-00001912.00000000.68222.00400000.00000040.mdmp, 00000000-00001912.00000001.70142.00400000.00000040.mdmp, 00000000-00001912.00000002.72061.00160000.00000040.mdmp") Found reference to API (Indicator: "WriteFile"; Source: "00000000-00001912.00000000.68222.00400000.00000040.mdmp, 00000000-00001912.00000001.70142.00400000.00000040.mdmp, 00000000-00001912.00000002.72061.00160000.00000040.mdmp") Found reference to API (Indicator: "lstrcatW"; Source: "00000000-00001912.00000000.68222.00400000.00000040.mdmp, 00000000-00001912.00000001.70142.00400000.00000040.mdmp, 00000000-00001912.00000002.72061.00160000.00000040.mdmp") Found reference to API (Indicator: "lstrcmpW"; Source: "00000000-00001912.00000000.68222.00400000.00000040.mdmp, 00000000-00001912.00000001.70142.00400000.00000040.mdmp, 00000000-00001912.00000002.72061.00160000.00000040.mdmp") Found reference to API (Indicator: "lstrcmpiW"; Source: "00000000-00001912.00000000.68222.00400000.00000040.mdmp, 00000000-00001912.00000001.70142.00400000.00000040.mdmp, 00000000-00001912.00000002.72061.00160000.00000040.mdmp") Found reference to API (Indicator: "lstrlenW"; Source: "00000000-00001912.00000000.68222.00400000.00000040.mdmp, 00000000-00001912.00000001.70142.00400000.00000040.mdmp, 00000000-00001912.00000002.72061.00160000.00000040.mdmp") Found reference to API (Indicator: "GetUserNameW"; Source: "00000000-00001912.00000000.68222.00400000.00000040.mdmp, 00000000-00001912.00000001.70142.00400000.00000040.mdmp, 00000000-00001912.00000002.72061.00160000.00000040.mdmp") Found reference to API (Indicator: "RegCloseKey"; Source: "00000000-00001912.00000000.68222.00400000.00000040.mdmp, 00000000-00001912.00000001.70142.00400000.00000040.mdmp, 00000000-00001912.00000002.72061.00160000.00000040.mdmp") Found reference to API (Indicator: "RegEnumKeyExW"; Source: "00000000-00001912.00000000.68222.00400000.00000040.mdmp, 00000000-00001912.00000001.70142.00400000.00000040.mdmp, 00000000-00001912.00000002.72061.00160000.00000040.mdmp") Found reference to API (Indicator: "RegOpenKeyExW"; Source: "00000000-00001912.00000000.68222.00400000.00000040.mdmp, 00000000-00001912.00000001.70142.00400000.00000040.mdmp, 00000000-00001912.00000002.72061.00160000.00000040.mdmp") Found reference to API (Indicator: "RegQueryValueExW"; Source: "00000000-00001912.00000000.68222.00400000.00000040.mdmp, 00000000-00001912.00000001.70142.00400000.00000040.mdmp, 00000000-00001912.00000002.72061.00160000.00000040.mdmp") Found reference to API (Indicator: "GetDC"; Source: "00000000-00001912.00000000.68222.00400000.00000040.mdmp, 00000000-00001912.00000001.70142.00400000.00000040.mdmp, 00000000-00001912.00000002.72061.00160000.00000040.mdmp") Found reference to API (Indicator: "GetSystemMetrics"; Source: "00000000-00001912.00000000.68222.00400000.00000040.mdmp, 00000000-00001912.00000001.70142.00400000.00000040.mdmp, 00000000-00001912.00000002.72061.00160000.00000040.mdmp") Found reference to API (Indicator: "ReleaseDC"; Source: "00000000-00001912.00000000.68222.00400000.00000040.mdmp, 00000000-00001912.00000001.70142.00400000.00000040.mdmp, 00000000-00001912.00000002.72061.00160000.00000040.mdmp") Found reference to API (Indicator: "wsprintfW"; Source: "00000000-00001912.00000000.68222.00400000.00000040.mdmp, 00000000-00001912.00000001.70142.00400000.00000040.mdmp, 00000000-00001912.00000002.72061.00160000.00000040.mdmp") Found reference to API (Indicator: "BitBlt"; Source: "00000000-00001912.00000000.68222.00400000.00000040.mdmp, 00000000-00001912.00000001.70142.00400000.00000040.mdmp, 00000000-00001912.00000002.72061.00160000.00000040.mdmp") Found reference to API (Indicator: "CreateCompatibleBitmap"; Source: "00000000-00001912.00000000.68222.00400000.00000040.mdmp, 00000000-00001912.00000001.70142.00400000.00000040.mdmp, 00000000-00001912.00000002.72061.00160000.00000040.mdmp") Found reference to API (Indicator: "CreateCompatibleDC"; Source: "00000000-00001912.00000000.68222.00400000.00000040.mdmp, 00000000-00001912.00000001.70142.00400000.00000040.mdmp, 00000000-00001912.00000002.72061.00160000.00000040.mdmp") Found reference to API (Indicator: "DeleteDC"; Source: "00000000-00001912.00000000.68222.00400000.00000040.mdmp, 00000000-00001912.00000001.70142.00400000.00000040.mdmp, 00000000-00001912.00000002.72061.00160000.00000040.mdmp") Found reference to API (Indicator: "DeleteObject"; Source: "00000000-00001912.00000000.68222.00400000.00000040.mdmp, 00000000-00001912.00000001.70142.00400000.00000040.mdmp, 00000000-00001912.00000002.72061.00160000.00000040.mdmp") Found reference to API (Indicator: "GetDIBits"; Source: "00000000-00001912.00000000.68222.00400000.00000040.mdmp, 00000000-00001912.00000001.70142.00400000.00000040.mdmp, 00000000-00001912.00000002.72061.00160000.00000040.mdmp") Found reference to API (Indicator: "GetObjectW"; Source: "00000000-00001912.00000000.68222.00400000.00000040.mdmp, 00000000-00001912.00000001.70142.00400000.00000040.mdmp, 00000000-00001912.00000002.72061.00160000.00000040.mdmp") Found reference to API (Indicator: "SelectObject"; Source: "00000000-00001912.00000000.68222.00400000.00000040.mdmp, 00000000-00001912.00000001.70142.00400000.00000040.mdmp, 00000000-00001912.00000002.72061.00160000.00000040.mdmp") Found reference to API (Indicator: "WinHttpAddRequestHeaders"; Source: "00000000-00001912.00000000.68222.00400000.00000040.mdmp, 00000000-00001912.00000001.70142.00400000.00000040.mdmp, 00000000-00001912.00000002.72061.00160000.00000040.mdmp") Found reference to API (Indicator: "WinHttpCloseHandle"; Source: "00000000-00001912.00000000.68222.00400000.00000040.mdmp, 00000000-00001912.00000001.70142.00400000.00000040.mdmp, 00000000-00001912.00000002.72061.00160000.00000040.mdmp") Found reference to API (Indicator: "WinHttpConnect"; Source: "00000000-00001912.00000000.68222.00400000.00000040.mdmp, 00000000-00001912.00000001.70142.00400000.00000040.mdmp, 00000000-00001912.00000002.72061.00160000.00000040.mdmp") Found reference to API (Indicator: "WinHttpCrackUrl"; Source: "00000000-00001912.00000000.68222.00400000.00000040.mdmp, 00000000-00001912.00000001.70142.00400000.00000040.mdmp, 00000000-00001912.00000002.72061.00160000.00000040.mdmp") Found reference to API (Indicator: "WinHttpOpen"; Source: "00000000-00001912.00000000.68222.00400000.00000040.mdmp, 00000000-00001912.00000001.70142.00400000.00000040.mdmp, 00000000-00001912.00000002.72061.00160000.00000040.mdmp") Found reference to API (Indicator: "WinHttpOpenRequest"; Source: "00000000-00001912.00000000.68222.00400000.00000040.mdmp, 00000000-00001912.00000001.70142.00400000.00000040.mdmp, 00000000-00001912.00000002.72061.00160000.00000040.mdmp") Found reference to API (Indicator: "WinHttpQueryDataAvailable"; Source: "00000000-00001912.00000000.68222.00400000.00000040.mdmp, 00000000-00001912.00000001.70142.00400000.00000040.mdmp, 00000000-00001912.00000002.72061.00160000.00000040.mdmp") Found reference to API (Indicator: "WinHttpReadData"; Source: "00000000-00001912.00000000.68222.00400000.00000040.mdmp, 00000000-00001912.00000001.70142.00400000.00000040.mdmp, 00000000-00001912.00000002.72061.00160000.00000040.mdmp") Found reference to API (Indicator: "WinHttpReceiveResponse"; Source: "00000000-00001912.00000000.68222.00400000.00000040.mdmp, 00000000-00001912.00000001.70142.00400000.00000040.mdmp, 00000000-00001912.00000002.72061.00160000.00000040.mdmp") Found reference to API (Indicator: "WinHttpSendRequest"; Source: "00000000-00001912.00000000.68222.00400000.00000040.mdmp, 00000000-00001912.00000001.70142.00400000.00000040.mdmp, 00000000-00001912.00000002.72061.00160000.00000040.mdmp") Found reference to API (Indicator: "CryptStringToBinaryA"; Source: "00000000-00001912.00000000.68222.00400000.00000040.mdmp, 00000000-00001912.00000001.70142.00400000.00000040.mdmp, 00000000-00001912.00000002.72061.00160000.00000040.mdmp") Found reference to API (Indicator: "Process32NextW"; Source: "00000000-00001912.00000001.70142.00400000.00000040.mdmp") Found reference to API (Indicator: "CreateToolhelp32Snapshot"; Source: "00000000-00001912.00000001.70142.00400000.00000040.mdmp") Found reference to API (Indicator: "OpenProcess"; Source: "00000000-00001912.00000001.70142.00400000.00000040.mdmp") Found reference to API (Indicator: "GetTokenInformation"; Source: "00000000-00003028.00000001.68977.012DA000.00000002.mdmp") Found reference to API (Indicator: "RegDeleteValueA"; Source: "00000000-00003028.00000001.68977.012DA000.00000002.mdmp") Found reference to API (Indicator: "RegOpenKeyExA"; Source: "00000000-00003028.00000001.68977.012DA000.00000002.mdmp") Found reference to API (Indicator: "RegQueryInfoKeyA"; Source: "00000000-00003028.00000001.68977.012DA000.00000002.mdmp") Found reference to API (Indicator: "FreeSid"; Source: "00000000-00003028.00000001.68977.012DA000.00000002.mdmp") Found reference to API (Indicator: "OpenProcessToken"; Source: "00000000-00003028.00000001.68977.012DA000.00000002.mdmp") Found reference to API (Indicator: "RegSetValueExA"; Source: "00000000-00003028.00000001.68977.012DA000.00000002.mdmp") Found reference to API (Indicator: "RegCreateKeyExA"; Source: "00000000-00003028.00000001.68977.012DA000.00000002.mdmp") Found reference to API (Indicator: "LookupPrivilegeValueA"; Source: "00000000-00003028.00000001.68977.012DA000.00000002.mdmp") Found reference to API (Indicator: "AllocateAndInitializeSid"; Source: "00000000-00003028.00000001.68977.012DA000.00000002.mdmp") Found reference to API (Indicator: "RegQueryValueExA"; Source: "00000000-00003028.00000001.68977.012DA000.00000002.mdmp") Found reference to API (Indicator: "EqualSid"; Source: "00000000-00003028.00000001.68977.012DA000.00000002.mdmp") Found reference to API (Indicator: "RegCloseKey"; Source: "00000000-00003028.00000001.68977.012DA000.00000002.mdmp") Found reference to API (Indicator: "AdjustTokenPrivileges"; Source: "00000000-00003028.00000001.68977.012DA000.00000002.mdmp") Found reference to API (Indicator: "GetShortPathNameA"; Source: "00000000-00003028.00000001.68977.012DA000.00000002.mdmp") Found reference to API (Indicator: "GetModuleFileNameA"; Source: "00000000-00003028.00000001.68977.012DA000.00000002.mdmp") Found reference to API (Indicator: "FindFirstFileA"; Source: "00000000-00003028.00000001.68977.012DA000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcess"; Source: "00000000-00003028.00000001.68977.012DA000.00000002.mdmp") Found reference to API (Indicator: "FindNextFileA"; Source: "00000000-00003028.00000001.68977.012DA000.00000002.mdmp") Found reference to API (Indicator: "ExpandEnvironmentStringsA"; Source: "00000000-00003028.00000001.68977.012DA000.00000002.mdmp") Found reference to API (Indicator: "FindClose"; Source: "00000000-00003028.00000001.68977.012DA000.00000002.mdmp") Found reference to API (Indicator: "LocalAlloc"; Source: "00000000-00003028.00000001.68977.012DA000.00000002.mdmp") Found reference to API (Indicator: "lstrcmpA"; Source: "00000000-00003028.00000001.68977.012DA000.00000002.mdmp") Found reference to API (Indicator: "CompareStringA"; Source: "00000000-00003028.00000001.68977.012DA000.00000002.mdmp") Found reference to API (Indicator: "GetLastError"; Source: "00000000-00003028.00000001.68977.012DA000.00000002.mdmp") Found reference to API (Indicator: "GetFileAttributesA"; Source: "00000000-00003028.00000001.68977.012DA000.00000002.mdmp") Found reference to API (Indicator: "GetSystemDirectoryA"; Source: "00000000-00003028.00000001.68977.012DA000.00000002.mdmp") Found reference to API (Indicator: "LoadLibraryA"; Source: "00000000-00003028.00000001.68977.012DA000.00000002.mdmp") Found reference to API (Indicator: "DeleteFileA"; Source: "00000000-00003028.00000001.68977.012DA000.00000002.mdmp") Found reference to API (Indicator: "GlobalAlloc"; Source: "00000000-00003028.00000001.68977.012DA000.00000002.mdmp") Found reference to API (Indicator: "GlobalFree"; Source: "00000000-00003028.00000001.68977.012DA000.00000002.mdmp") Found reference to API (Indicator: "CloseHandle"; Source: "00000000-00003028.00000001.68977.012DA000.00000002.mdmp") Found reference to API (Indicator: "WritePrivateProfileStringA"; Source: "00000000-00003028.00000001.68977.012DA000.00000002.mdmp") Found reference to API (Indicator: "IsDBCSLeadByte"; Source: "00000000-00003028.00000001.68977.012DA000.00000002.mdmp") Found reference to API (Indicator: "GetWindowsDirectoryA"; Source: "00000000-00003028.00000001.68977.012DA000.00000002.mdmp") Found reference to API (Indicator: "SetFileAttributesA"; Source: "00000000-00003028.00000001.68977.012DA000.00000002.mdmp") Found reference to API (Indicator: "GetProcAddress"; Source: "00000000-00003028.00000001.68977.012DA000.00000002.mdmp") Found reference to API (Indicator: "GlobalLock"; Source: "00000000-00003028.00000001.68977.012DA000.00000002.mdmp") Found reference to API (Indicator: "LocalFree"; Source: "00000000-00003028.00000001.68977.012DA000.00000002.mdmp") Found reference to API (Indicator: "RemoveDirectoryA"; Source: "00000000-00003028.00000001.68977.012DA000.00000002.mdmp") Found reference to API (Indicator: "FreeLibrary"; Source: "00000000-00003028.00000001.68977.012DA000.00000002.mdmp") Found reference to API (Indicator: "CreateDirectoryA"; Source: "00000000-00003028.00000001.68977.012DA000.00000002.mdmp") Found reference to API (Indicator: "GetPrivateProfileIntA"; Source: "00000000-00003028.00000001.68977.012DA000.00000002.mdmp") Found reference to API (Indicator: "GetPrivateProfileStringA"; Source: "00000000-00003028.00000001.68977.012DA000.00000002.mdmp") Found reference to API (Indicator: "GlobalUnlock"; Source: "00000000-00003028.00000001.68977.012DA000.00000002.mdmp") Found reference to API (Indicator: "ReadFile"; Source: "00000000-00003028.00000001.68977.012DA000.00000002.mdmp") Found reference to API (Indicator: "SizeofResource"; Source: "00000000-00003028.00000001.68977.012DA000.00000002.mdmp") Found reference to API (Indicator: "WriteFile"; Source: "00000000-00003028.00000001.68977.012DA000.00000002.mdmp") Found reference to API (Indicator: "GetDriveTypeA"; Source: "00000000-00003028.00000001.68977.012DA000.00000002.mdmp") Found reference to API (Indicator: "LoadLibraryExA"; Source: "00000000-00003028.00000001.68977.012DA000.00000002.mdmp") Found reference to API (Indicator: "SetFileTime"; Source: "00000000-00003028.00000001.68977.012DA000.00000002.mdmp") Found reference to API (Indicator: "SetFilePointer"; Source: "00000000-00003028.00000001.68977.012DA000.00000002.mdmp") Found reference to API (Indicator: "FindResourceA"; Source: "00000000-00003028.00000001.68977.012DA000.00000002.mdmp") Found reference to API (Indicator: "CreateMutexA"; Source: "00000000-00003028.00000001.68977.012DA000.00000002.mdmp") Found reference to API (Indicator: "GetVolumeInformationA"; Source: "00000000-00003028.00000001.68977.012DA000.00000002.mdmp") Found reference to API (Indicator: "WaitForSingleObject"; Source: "00000000-00003028.00000001.68977.012DA000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentDirectoryA"; Source: "00000000-00003028.00000001.68977.012DA000.00000002.mdmp") Found reference to API (Indicator: "FreeResource"; Source: "00000000-00003028.00000001.68977.012DA000.00000002.mdmp") Found reference to API (Indicator: "GetVersion"; Source: "00000000-00003028.00000001.68977.012DA000.00000002.mdmp") Found reference to API (Indicator: "SetCurrentDirectoryA"; Source: "00000000-00003028.00000001.68977.012DA000.00000002.mdmp") Found reference to API (Indicator: "GetTempPathA"; Source: "00000000-00003028.00000001.68977.012DA000.00000002.mdmp") Found reference to API (Indicator: "LocalFileTimeToFileTime"; Source: "00000000-00003028.00000001.68977.012DA000.00000002.mdmp") Found reference to API (Indicator: "CreateFileA"; Source: "00000000-00003028.00000001.68977.012DA000.00000002.mdmp") Found reference to API (Indicator: "SetEvent"; Source: "00000000-00003028.00000001.68977.012DA000.00000002.mdmp") Found reference to API (Indicator: "TerminateThread"; Source: "00000000-00003028.00000001.68977.012DA000.00000002.mdmp") Found reference to API (Indicator: "GetVersionExA"; Source: "00000000-00003028.00000001.68977.012DA000.00000002.mdmp") Found reference to API (Indicator: "LockResource"; Source: "00000000-00003028.00000001.68977.012DA000.00000002.mdmp") Found reference to API (Indicator: "GetSystemInfo"; Source: "00000000-00003028.00000001.68977.012DA000.00000002.mdmp") Found reference to API (Indicator: "CreateThread"; Source: "00000000-00003028.00000001.68977.012DA000.00000002.mdmp") Found reference to API (Indicator: "ResetEvent"; Source: "00000000-00003028.00000001.68977.012DA000.00000002.mdmp") Found reference to API (Indicator: "LoadResource"; Source: "00000000-00003028.00000001.68977.012DA000.00000002.mdmp") Found reference to API (Indicator: "ExitProcess"; Source: "00000000-00003028.00000001.68977.012DA000.00000002.mdmp") Found reference to API (Indicator: "GetModuleHandleW"; Source: "00000000-00003028.00000001.68977.012DA000.00000002.mdmp") Found reference to API (Indicator: "CreateProcessA"; Source: "00000000-00003028.00000001.68977.012DA000.00000002.mdmp") Found reference to API (Indicator: "FormatMessageA"; Source: "00000000-00003028.00000001.68977.012DA000.00000002.mdmp") Found reference to API (Indicator: "GetTempFileNameA"; Source: "00000000-00003028.00000001.68977.012DA000.00000002.mdmp") Found reference to API (Indicator: "DosDateTimeToFileTime"; Source: "00000000-00003028.00000001.68977.012DA000.00000002.mdmp") Found reference to API (Indicator: "CreateEventA"; Source: "00000000-00003028.00000001.68977.012DA000.00000002.mdmp") Found reference to API (Indicator: "GetExitCodeProcess"; Source: "00000000-00003028.00000001.68977.012DA000.00000002.mdmp") Found reference to API (Indicator: "GetDeviceCaps"; Source: "00000000-00003028.00000001.68977.012DA000.00000002.mdmp") Found reference to API (Indicator: "GetDesktopWindow"; Source: "00000000-00003028.00000001.68977.012DA000.00000002.mdmp") Found reference to API (Indicator: "CharUpperA"; Source: "00000000-00003028.00000001.68977.012DA000.00000002.mdmp") Found reference to API (Indicator: "ExitWindowsEx"; Source: "00000000-00003028.00000001.68977.012DA000.00000002.mdmp") Found reference to API (Indicator: "MessageBeep"; Source: "00000000-00003028.00000001.68977.012DA000.00000002.mdmp") Found reference to API (Indicator: "CharPrevA"; Source: "00000000-00003028.00000001.68977.012DA000.00000002.mdmp") Found reference to API (Indicator: "LoadStringA"; Source: "00000000-00003028.00000001.68977.012DA000.00000002.mdmp") Found reference to API (Indicator: "CharNextA"; Source: "00000000-00003028.00000001.68977.012DA000.00000002.mdmp") Found reference to API (Indicator: "EnableWindow"; Source: "00000000-00003028.00000001.68977.012DA000.00000002.mdmp") Found reference to API (Indicator: "ReleaseDC"; Source: "00000000-00003028.00000001.68977.012DA000.00000002.mdmp") Found reference to API (Indicator: "SetForegroundWindow"; Source: "00000000-00003028.00000001.68977.012DA000.00000002.mdmp") Found reference to API (Indicator: "PeekMessageA"; Source: "00000000-00003028.00000001.68977.012DA000.00000002.mdmp") Found reference to API (Indicator: "SendMessageA"; Source: "00000000-00003028.00000001.68977.012DA000.00000002.mdmp") Found reference to API (Indicator: "MessageBoxA"; Source: "00000000-00003028.00000001.68977.012DA000.00000002.mdmp") Found reference to API (Indicator: "SetWindowTextA"; Source: "00000000-00003028.00000001.68977.012DA000.00000002.mdmp") Found reference to API (Indicator: "GetWindowLongA"; Source: "00000000-00003028.00000001.68977.012DA000.00000002.mdmp") Found reference to API (Indicator: "CallWindowProcA"; Source: "00000000-00003028.00000001.68977.012DA000.00000002.mdmp") Found reference to API (Indicator: "SetWindowLongA"; Source: "00000000-00003028.00000001.68977.012DA000.00000002.mdmp") Found reference to API (Indicator: "ShowWindow"; Source: "00000000-00003028.00000001.68977.012DA000.00000002.mdmp") Found reference to API (Indicator: "MsgWaitForMultipleObjects"; Source: "00000000-00003028.00000001.68977.012DA000.00000002.mdmp") Found reference to API (Indicator: "SetWindowPos"; Source: "00000000-00003028.00000001.68977.012DA000.00000002.mdmp") Found reference to API (Indicator: "GetDC"; Source: "00000000-00003028.00000001.68977.012DA000.00000002.mdmp") Found reference to API (Indicator: "GetWindowRect"; Source: "00000000-00003028.00000001.68977.012DA000.00000002.mdmp") Found reference to API (Indicator: "DispatchMessageA"; Source: "00000000-00003028.00000001.68977.012DA000.00000002.mdmp") Found reference to API (Indicator: "GetFileVersionInfoSizeA"; Source: "00000000-00003028.00000001.68977.012DA000.00000002.mdmp") Found reference to API (Indicator: "VerQueryValueA"; Source: "00000000-00003028.00000001.68977.012DA000.00000002.mdmp") Found reference to API (Indicator: "GetFileVersionInfoA"; Source: "00000000-00003028.00000001.68977.012DA000.00000002.mdmp") Found reference to API (Indicator: "Sleep"; Source: "00000000-00003028.00000001.68977.012DA000.00000002.mdmp") Found reference to API (Indicator: "GetStartupInfoW"; Source: "00000000-00003028.00000001.68977.012DA000.00000002.mdmp") Found reference to API (Indicator: "UnhandledExceptionFilter"; Source: "00000000-00003028.00000001.68977.012DA000.00000002.mdmp") Found reference to API (Indicator: "SetUnhandledExceptionFilter"; Source: "00000000-00003028.00000001.68977.012DA000.00000002.mdmp") Found reference to API (Indicator: "TerminateProcess"; Source: "00000000-00003028.00000001.68977.012DA000.00000002.mdmp") Found reference to API (Indicator: "QueryPerformanceCounter"; Source: "00000000-00003028.00000001.68977.012DA000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcessId"; Source: "00000000-00003028.00000001.68977.012DA000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentThreadId"; Source: "00000000-00003028.00000001.68977.012DA000.00000002.mdmp") Found reference to API (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00003028.00000001.68977.012DA000.00000002.mdmp") Found reference to API (Indicator: "GetTickCount"; Source: "00000000-00003028.00000001.68977.012DA000.00000002.mdmp") Found reference to API (Indicator: "EnumResourceLanguagesA"; Source: "00000000-00003028.00000001.68977.012DA000.00000002.mdmp") Found reference to API (Indicator: "GetDiskFreeSpaceA"; Source: "00000000-00003028.00000001.68977.012DA000.00000002.mdmp") Found reference to API (Indicator: "MulDiv"; Source: "00000000-00003028.00000001.68977.012DA000.00000002.mdmp") Found reference to API (Indicator: "GetSystemMetrics"; Source: "00000000-00003028.00000001.68977.012DA000.00000002.mdmp") Found reference to API (Indicator: "CheckTokenMembership"; Source: "00000000-00003028.00000002.70898.012D1000.00000020.mdmp") Found reference to API (Indicator: "HeapSetInformation"; Source: "00000000-00003028.00000002.70898.012D1000.00000020.mdmp") Found reference to API (Indicator: "DecryptFileA"; Source: "00000000-00003028.00000002.70898.012D1000.00000020.mdmp") Found reference to API (Indicator: "CheckTokenMembership"; Source: "00000000-00003316.00000000.66984.00341000.00000020.mdmp") Found reference to API (Indicator: "HeapSetInformation"; Source: "00000000-00003316.00000000.66984.00341000.00000020.mdmp") Found reference to API (Indicator: "DecryptFileA"; Source: "00000000-00003316.00000000.66984.00341000.00000020.mdmp") Found reference to API (Indicator: "GetTokenInformation"; Source: "00000000-00003316.00000002.70823.0034A000.00000002.mdmp") Found reference to API (Indicator: "RegDeleteValueA"; Source: "00000000-00003316.00000002.70823.0034A000.00000002.mdmp") Found reference to API (Indicator: "RegOpenKeyExA"; Source: "00000000-00003316.00000002.70823.0034A000.00000002.mdmp") Found reference to API (Indicator: "RegQueryInfoKeyA"; Source: "00000000-00003316.00000002.70823.0034A000.00000002.mdmp") Found reference to API (Indicator: "FreeSid"; Source: "00000000-00003316.00000002.70823.0034A000.00000002.mdmp") Found reference to API (Indicator: "OpenProcessToken"; Source: "00000000-00003316.00000002.70823.0034A000.00000002.mdmp") Found reference to API (Indicator: "RegSetValueExA"; Source: "00000000-00003316.00000002.70823.0034A000.00000002.mdmp") Found reference to API (Indicator: "RegCreateKeyExA"; Source: "00000000-00003316.00000002.70823.0034A000.00000002.mdmp") Found reference to API (Indicator: "LookupPrivilegeValueA"; Source: "00000000-00003316.00000002.70823.0034A000.00000002.mdmp") Found reference to API (Indicator: "AllocateAndInitializeSid"; Source: "00000000-00003316.00000002.70823.0034A000.00000002.mdmp") Found reference to API (Indicator: "RegQueryValueExA"; Source: "00000000-00003316.00000002.70823.0034A000.00000002.mdmp") Found reference to API (Indicator: "EqualSid"; Source: "00000000-00003316.00000002.70823.0034A000.00000002.mdmp") Found reference to API (Indicator: "RegCloseKey"; Source: "00000000-00003316.00000002.70823.0034A000.00000002.mdmp") Found reference to API (Indicator: "AdjustTokenPrivileges"; Source: "00000000-00003316.00000002.70823.0034A000.00000002.mdmp") Found reference to API (Indicator: "GetShortPathNameA"; Source: "00000000-00003316.00000002.70823.0034A000.00000002.mdmp") Found reference to API (Indicator: "GetModuleFileNameA"; Source: "00000000-00003316.00000002.70823.0034A000.00000002.mdmp") Found reference to API (Indicator: "FindFirstFileA"; Source: "00000000-00003316.00000002.70823.0034A000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcess"; Source: "00000000-00003316.00000002.70823.0034A000.00000002.mdmp") Found reference to API (Indicator: "FindNextFileA"; Source: "00000000-00003316.00000002.70823.0034A000.00000002.mdmp") Found reference to API (Indicator: "ExpandEnvironmentStringsA"; Source: "00000000-00003316.00000002.70823.0034A000.00000002.mdmp") Found reference to API (Indicator: "FindClose"; Source: "00000000-00003316.00000002.70823.0034A000.00000002.mdmp") Found reference to API (Indicator: "LocalAlloc"; Source: "00000000-00003316.00000002.70823.0034A000.00000002.mdmp") Found reference to API (Indicator: "lstrcmpA"; Source: "00000000-00003316.00000002.70823.0034A000.00000002.mdmp") Found reference to API (Indicator: "CompareStringA"; Source: "00000000-00003316.00000002.70823.0034A000.00000002.mdmp") Found reference to API (Indicator: "GetLastError"; Source: "00000000-00003316.00000002.70823.0034A000.00000002.mdmp") Found reference to API (Indicator: "GetFileAttributesA"; Source: "00000000-00003316.00000002.70823.0034A000.00000002.mdmp") Found reference to API (Indicator: "GetSystemDirectoryA"; Source: "00000000-00003316.00000002.70823.0034A000.00000002.mdmp") Found reference to API (Indicator: "LoadLibraryA"; Source: "00000000-00003316.00000002.70823.0034A000.00000002.mdmp") Found reference to API (Indicator: "DeleteFileA"; Source: "00000000-00003316.00000002.70823.0034A000.00000002.mdmp") Found reference to API (Indicator: "GlobalAlloc"; Source: "00000000-00003316.00000002.70823.0034A000.00000002.mdmp") Found reference to API (Indicator: "GlobalFree"; Source: "00000000-00003316.00000002.70823.0034A000.00000002.mdmp") Found reference to API (Indicator: "CloseHandle"; Source: "00000000-00003316.00000002.70823.0034A000.00000002.mdmp") Found reference to API (Indicator: "WritePrivateProfileStringA"; Source: "00000000-00003316.00000002.70823.0034A000.00000002.mdmp") Found reference to API (Indicator: "IsDBCSLeadByte"; Source: "00000000-00003316.00000002.70823.0034A000.00000002.mdmp") Found reference to API (Indicator: "GetWindowsDirectoryA"; Source: "00000000-00003316.00000002.70823.0034A000.00000002.mdmp") Found reference to API (Indicator: "SetFileAttributesA"; Source: "00000000-00003316.00000002.70823.0034A000.00000002.mdmp") Found reference to API (Indicator: "GetProcAddress"; Source: "00000000-00003316.00000002.70823.0034A000.00000002.mdmp") Found reference to API (Indicator: "GlobalLock"; Source: "00000000-00003316.00000002.70823.0034A000.00000002.mdmp") Found reference to API (Indicator: "LocalFree"; Source: "00000000-00003316.00000002.70823.0034A000.00000002.mdmp") Found reference to API (Indicator: "RemoveDirectoryA"; Source: "00000000-00003316.00000002.70823.0034A000.00000002.mdmp") Found reference to API (Indicator: "FreeLibrary"; Source: "00000000-00003316.00000002.70823.0034A000.00000002.mdmp") Found reference to API (Indicator: "CreateDirectoryA"; Source: "00000000-00003316.00000002.70823.0034A000.00000002.mdmp") Found reference to API (Indicator: "GetPrivateProfileIntA"; Source: "00000000-00003316.00000002.70823.0034A000.00000002.mdmp") Found reference to API (Indicator: "GetPrivateProfileStringA"; Source: "00000000-00003316.00000002.70823.0034A000.00000002.mdmp") Found reference to API (Indicator: "GlobalUnlock"; Source: "00000000-00003316.00000002.70823.0034A000.00000002.mdmp") Found reference to API (Indicator: "ReadFile"; Source: "00000000-00003316.00000002.70823.0034A000.00000002.mdmp") Found reference to API (Indicator: "SizeofResource"; Source: "00000000-00003316.00000002.70823.0034A000.00000002.mdmp") Found reference to API (Indicator: "WriteFile"; Source: "00000000-00003316.00000002.70823.0034A000.00000002.mdmp") Found reference to API (Indicator: "GetDriveTypeA"; Source: "00000000-00003316.00000002.70823.0034A000.00000002.mdmp") Found reference to API (Indicator: "LoadLibraryExA"; Source: "00000000-00003316.00000002.70823.0034A000.00000002.mdmp") Found reference to API (Indicator: "SetFileTime"; Source: "00000000-00003316.00000002.70823.0034A000.00000002.mdmp") Found reference to API (Indicator: "SetFilePointer"; Source: "00000000-00003316.00000002.70823.0034A000.00000002.mdmp") Found reference to API (Indicator: "FindResourceA"; Source: "00000000-00003316.00000002.70823.0034A000.00000002.mdmp") Found reference to API (Indicator: "CreateMutexA"; Source: "00000000-00003316.00000002.70823.0034A000.00000002.mdmp") Found reference to API (Indicator: "GetVolumeInformationA"; Source: "00000000-00003316.00000002.70823.0034A000.00000002.mdmp") Found reference to API (Indicator: "WaitForSingleObject"; Source: "00000000-00003316.00000002.70823.0034A000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentDirectoryA"; Source: "00000000-00003316.00000002.70823.0034A000.00000002.mdmp") Found reference to API (Indicator: "FreeResource"; Source: "00000000-00003316.00000002.70823.0034A000.00000002.mdmp") Found reference to API (Indicator: "GetVersion"; Source: "00000000-00003316.00000002.70823.0034A000.00000002.mdmp") Found reference to API (Indicator: "SetCurrentDirectoryA"; Source: "00000000-00003316.00000002.70823.0034A000.00000002.mdmp") Found reference to API (Indicator: "GetTempPathA"; Source: "00000000-00003316.00000002.70823.0034A000.00000002.mdmp") Found reference to API (Indicator: "LocalFileTimeToFileTime"; Source: "00000000-00003316.00000002.70823.0034A000.00000002.mdmp") Found reference to API (Indicator: "CreateFileA"; Source: "00000000-00003316.00000002.70823.0034A000.00000002.mdmp") Found reference to API (Indicator: "SetEvent"; Source: "00000000-00003316.00000002.70823.0034A000.00000002.mdmp") Found reference to API (Indicator: "TerminateThread"; Source: "00000000-00003316.00000002.70823.0034A000.00000002.mdmp") Found reference to API (Indicator: "GetVersionExA"; Source: "00000000-00003316.00000002.70823.0034A000.00000002.mdmp") Found reference to API (Indicator: "LockResource"; Source: "00000000-00003316.00000002.70823.0034A000.00000002.mdmp") Found reference to API (Indicator: "GetSystemInfo"; Source: "00000000-00003316.00000002.70823.0034A000.00000002.mdmp") Found reference to API (Indicator: "CreateThread"; Source: "00000000-00003316.00000002.70823.0034A000.00000002.mdmp") Found reference to API (Indicator: "ResetEvent"; Source: "00000000-00003316.00000002.70823.0034A000.00000002.mdmp") Found reference to API (Indicator: "LoadResource"; Source: "00000000-00003316.00000002.70823.0034A000.00000002.mdmp") Found reference to API (Indicator: "ExitProcess"; Source: "00000000-00003316.00000002.70823.0034A000.00000002.mdmp") Found reference to API (Indicator: "GetModuleHandleW"; Source: "00000000-00003316.00000002.70823.0034A000.00000002.mdmp") Found reference to API (Indicator: "CreateProcessA"; Source: "00000000-00003316.00000002.70823.0034A000.00000002.mdmp") Found reference to API (Indicator: "FormatMessageA"; Source: "00000000-00003316.00000002.70823.0034A000.00000002.mdmp") Found reference to API (Indicator: "GetTempFileNameA"; Source: "00000000-00003316.00000002.70823.0034A000.00000002.mdmp") Found reference to API (Indicator: "DosDateTimeToFileTime"; Source: "00000000-00003316.00000002.70823.0034A000.00000002.mdmp") Found reference to API (Indicator: "CreateEventA"; Source: "00000000-00003316.00000002.70823.0034A000.00000002.mdmp") Found reference to API (Indicator: "GetExitCodeProcess"; Source: "00000000-00003316.00000002.70823.0034A000.00000002.mdmp") Found reference to API (Indicator: "GetDeviceCaps"; Source: "00000000-00003316.00000002.70823.0034A000.00000002.mdmp") Found reference to API (Indicator: "GetDesktopWindow"; Source: "00000000-00003316.00000002.70823.0034A000.00000002.mdmp") Found reference to API (Indicator: "CharUpperA"; Source: "00000000-00003316.00000002.70823.0034A000.00000002.mdmp") Found reference to API (Indicator: "ExitWindowsEx"; Source: "00000000-00003316.00000002.70823.0034A000.00000002.mdmp") Found reference to API (Indicator: "MessageBeep"; Source: "00000000-00003316.00000002.70823.0034A000.00000002.mdmp") Found reference to API (Indicator: "CharPrevA"; Source: "00000000-00003316.00000002.70823.0034A000.00000002.mdmp") Found reference to API (Indicator: "LoadStringA"; Source: "00000000-00003316.00000002.70823.0034A000.00000002.mdmp") Found reference to API (Indicator: "CharNextA"; Source: "00000000-00003316.00000002.70823.0034A000.00000002.mdmp") Found reference to API (Indicator: "EnableWindow"; Source: "00000000-00003316.00000002.70823.0034A000.00000002.mdmp") Found reference to API (Indicator: "ReleaseDC"; Source: "00000000-00003316.00000002.70823.0034A000.00000002.mdmp") Found reference to API (Indicator: "SetForegroundWindow"; Source: "00000000-00003316.00000002.70823.0034A000.00000002.mdmp") Found reference to API (Indicator: "PeekMessageA"; Source: "00000000-00003316.00000002.70823.0034A000.00000002.mdmp") Found reference to API (Indicator: "SendMessageA"; Source: "00000000-00003316.00000002.70823.0034A000.00000002.mdmp") Found reference to API (Indicator: "MessageBoxA"; Source: "00000000-00003316.00000002.70823.0034A000.00000002.mdmp") Found reference to API (Indicator: "SetWindowTextA"; Source: "00000000-00003316.00000002.70823.0034A000.00000002.mdmp") Found reference to API (Indicator: "GetWindowLongA"; Source: "00000000-00003316.00000002.70823.0034A000.00000002.mdmp") Found reference to API (Indicator: "CallWindowProcA"; Source: "00000000-00003316.00000002.70823.0034A000.00000002.mdmp") Found reference to API (Indicator: "SetWindowLongA"; Source: "00000000-00003316.00000002.70823.0034A000.00000002.mdmp") Found reference to API (Indicator: "ShowWindow"; Source: "00000000-00003316.00000002.70823.0034A000.00000002.mdmp") Found reference to API (Indicator: "MsgWaitForMultipleObjects"; Source: "00000000-00003316.00000002.70823.0034A000.00000002.mdmp") Found reference to API (Indicator: "SetWindowPos"; Source: "00000000-00003316.00000002.70823.0034A000.00000002.mdmp") Found reference to API (Indicator: "GetDC"; Source: "00000000-00003316.00000002.70823.0034A000.00000002.mdmp") Found reference to API (Indicator: "GetWindowRect"; Source: "00000000-00003316.00000002.70823.0034A000.00000002.mdmp") Found reference to API (Indicator: "DispatchMessageA"; Source: "00000000-00003316.00000002.70823.0034A000.00000002.mdmp") Found reference to API (Indicator: "GetFileVersionInfoSizeA"; Source: "00000000-00003316.00000002.70823.0034A000.00000002.mdmp") Found reference to API (Indicator: "VerQueryValueA"; Source: "00000000-00003316.00000002.70823.0034A000.00000002.mdmp") Found reference to API (Indicator: "GetFileVersionInfoA"; Source: "00000000-00003316.00000002.70823.0034A000.00000002.mdmp") Found reference to API (Indicator: "Sleep"; Source: "00000000-00003316.00000002.70823.0034A000.00000002.mdmp") Found reference to API (Indicator: "GetStartupInfoW"; Source: "00000000-00003316.00000002.70823.0034A000.00000002.mdmp") Found reference to API (Indicator: "UnhandledExceptionFilter"; Source: "00000000-00003316.00000002.70823.0034A000.00000002.mdmp") Found reference to API (Indicator: "SetUnhandledExceptionFilter"; Source: "00000000-00003316.00000002.70823.0034A000.00000002.mdmp") Found reference to API (Indicator: "TerminateProcess"; Source: "00000000-00003316.00000002.70823.0034A000.00000002.mdmp") Found reference to API (Indicator: "QueryPerformanceCounter"; Source: "00000000-00003316.00000002.70823.0034A000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcessId"; Source: "00000000-00003316.00000002.70823.0034A000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentThreadId"; Source: "00000000-00003316.00000002.70823.0034A000.00000002.mdmp") Found reference to API (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00003316.00000002.70823.0034A000.00000002.mdmp") Found reference to API (Indicator: "GetTickCount"; Source: "00000000-00003316.00000002.70823.0034A000.00000002.mdmp") Found reference to API (Indicator: "EnumResourceLanguagesA"; Source: "00000000-00003316.00000002.70823.0034A000.00000002.mdmp") Found reference to API (Indicator: "GetDiskFreeSpaceA"; Source: "00000000-00003316.00000002.70823.0034A000.00000002.mdmp") Found reference to API (Indicator: "MulDiv"; Source: "00000000-00003316.00000002.70823.0034A000.00000002.mdmp") Found reference to API (Indicator: "GetSystemMetrics"; Source: "00000000-00003316.00000002.70823.0034A000.00000002.mdmp")38:T706,Found reference to API "SizeofResource" (Indicator: "SizeofResource"; File: "wextract.exe") Found reference to API "FindResourceA" (Indicator: "FindResource"; File: "wextract.exe") Found reference to API "FreeResource" (Indicator: "FreeResource"; File: "wextract.exe") Found reference to API "LockResource" (Indicator: "LockResource"; File: "wextract.exe") Found reference to API "LoadResource" (Indicator: "LoadResource"; File: "wextract.exe") Found reference to API "SizeofResource" (Indicator: "SizeofResource"; Source: "00000000-00003028.00000001.68977.012DA000.00000002.mdmp") Found reference to API "FindResourceA" (Indicator: "FindResource"; Source: "00000000-00003028.00000001.68977.012DA000.00000002.mdmp") Found reference to API "FreeResource" (Indicator: "FreeResource"; Source: "00000000-00003028.00000001.68977.012DA000.00000002.mdmp") Found reference to API "LockResource" (Indicator: "LockResource"; Source: "00000000-00003028.00000001.68977.012DA000.00000002.mdmp") Found reference to API "LoadResource" (Indicator: "LoadResource"; Source: "00000000-00003028.00000001.68977.012DA000.00000002.mdmp") Found reference to API "SizeofResource" (Indicator: "SizeofResource"; Source: "00000000-00003316.00000002.70823.0034A000.00000002.mdmp") Found reference to API "FindResourceA" (Indicator: "FindResource"; Source: "00000000-00003316.00000002.70823.0034A000.00000002.mdmp") Found reference to API "FreeResource" (Indicator: "FreeResource"; Source: "00000000-00003316.00000002.70823.0034A000.00000002.mdmp") Found reference to API "LockResource" (Indicator: "LockResource"; Source: "00000000-00003316.00000002.70823.0034A000.00000002.mdmp") Found reference to API "LoadResource" (Indicator: "LoadResource"; Source: "00000000-00003316.00000002.70823.0034A000.00000002.mdmp")39:T4b6,Found reference to API "OpenProcessToken" (Indicator: "OpenProcess"; File: "wextract.exe") file/memory contains long string with (Indicator: "OpenProcess"; File: "wextract.exe") Found reference to API "GetProcessHeaps" (Indicator: "GetProcessHeap"; File: "2cV9250.exe.1068760659") Found reference to API "GetProcessHeap" (Indicator: "GetProcessHeap"; Source: "00000000-00001912.00000000.68222.00400000.00000040.mdmp, 00000000-00001912.00000001.70142.00400000.00000040.mdmp, 00000000-00001912.00000002.72061.00160000.00000040.mdmp") Found reference to API "OpenProcess" (Indicator: "OpenProcess"; Source: "00000000-00001912.00000001.70142.00400000.00000040.mdmp") file/memory contains long string with (Indicator: "OpenProcess"; Source: "00000000-00003028.00000001.68977.012DA000.00000002.mdmp") Found reference to API "OpenProcessToken" (Indicator: "OpenProcess"; Source: "00000000-00003028.00000001.68977.012DA000.00000002.mdmp") file/memory contains long string with (Indicator: "OpenProcess"; Source: "00000000-00003316.00000002.70823.0034A000.00000002.mdmp") Found reference to API "OpenProcessToken" (Indicator: "OpenProcess"; Source: "00000000-00003316.00000002.70823.0034A000.00000002.mdmp")3a:Tc64,"Software\Microsoft\Windows\CurrentVersion\App Paths" in Source: wextract.exe "DSystem\CurrentControlSet\Control\Session Manager" in Source: wextract.exe "Software\Microsoft\Windows\CurrentVersion\RunOnce" in Source: wextract.exe "System\CurrentControlSet\Control\Session Manager\FileRenameOperations" in Source: wextract.exe "System\CurrentControlSet\Control\Session Manager" in Source: 16932-17-0040256D "%localappdata%\Opera Software\Opera Neon\User Data" in Source: 00000000-00001912.00000000.68222.0033E000.00000004.mdmp 00000000-00001912.00000001.70142.0033E000.00000004.mdmp 00000000-00001912.00000002.72061.0033E000.00000004.mdmp "%localappdata%\BraveSoftware\Brave-Browser\User Data" in Source: 00000000-00001912.00000000.68222.0033E000.00000004.mdmp 00000000-00001912.00000001.70142.0033E000.00000004.mdmp 00000000-00001912.00000002.72061.0033E000.00000004.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall" in Source: 00000000-00001912.00000000.68222.00400000.00000040.mdmp 00000000-00001912.00000001.70142.00400000.00000040.mdmp 00000000-00001912.00000002.72061.00160000.00000040.mdmp ""p": "%appdata%\\Opera Software\\Opera Stable"," in Source: 00000000-00001912.00000000.68222.01C40000.00000004.mdmp 00000000-00001912.00000001.70142.01C40000.00000004.mdmp 00000000-00001912.00000002.72061.01C40000.00000004.mdmp ""p": "%localappdata%\\Opera Software\\Opera Neon\\User Data"," in Source: 00000000-00001912.00000000.68222.01C40000.00000004.mdmp 00000000-00001912.00000001.70142.01C40000.00000004.mdmp 00000000-00001912.00000002.72061.01C40000.00000004.mdmp ""p": "%appdata%\\Opera Software\\Opera GX Stable"," in Source: 00000000-00001912.00000000.68222.01C40000.00000004.mdmp 00000000-00001912.00000001.70142.01C40000.00000004.mdmp 00000000-00001912.00000002.72061.01C40000.00000004.mdmp ""p": "%localappdata%\\BraveSoftware\\Brave-Browser\\User Data"," in Source: 00000000-00001912.00000000.68222.01C40000.00000004.mdmp 00000000-00001912.00000001.70142.01C40000.00000004.mdmp 00000000-00001912.00000002.72061.01C40000.00000004.mdmp "%appdata%\Opera Software\Opera Stable" in Source: 00000000-00001912.00000000.68222.01C40000.00000004.mdmp 00000000-00001912.00000001.70142.01C40000.00000004.mdmp 00000000-00001912.00000002.72061.01C40000.00000004.mdmp "era Software\Opera GX Stable" in Source: 00000000-00001912.00000000.68222.01C40000.00000004.mdmp 00000000-00001912.00000001.70142.01C40000.00000004.mdmp 00000000-00001912.00000002.72061.01C40000.00000004.mdmp "%appdata%\Opera Software\Opera GX Stable" in Source: 00000000-00001912.00000000.68222.01C40000.00000004.mdmp 00000000-00001912.00000001.70142.01C40000.00000004.mdmp 00000000-00001912.00000002.72061.01C40000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\App Paths" in Source: 00000000-00003028.00000002.70898.012D1000.00000020.mdmp "Software\Microsoft\Windows\CurrentVersion\App Paths" in Source: 00000000-00003316.00000000.66984.00341000.00000020.mdmp "REGISTRY\USER\S-1-5-21-2092356043-4041700817-663127204-1001\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags" in Source: 00000000-00003316.00000001.68903.00110000.00000004.mdmp3b:T4b1,"\Sessions\1\BaseNamedObjects\IsoScope_a70_IESQMMUTEX_0_519" "UpdatingNewTabPageData" "Local\URLBLOCK_DOWNLOAD_MUTEX" "IsoScope_a70_IESQMMUTEX_0_303" "{5312EE61-79E3-4A24-BFE1-132B85B23C3A}" "Local\URLBLOCK_FILEMAPSWITCH_MUTEX_2672" "Local\ZonesLockedCacheCounterMutex" "{66D0969A-1E86-44CF-B4EC-3806DDDA3B5D}" "IsoScope_a70_IE_EarlyTabStart_0xf08_Mutex" "IsoScope_a70_IESQMMUTEX_0_519" "IsoScope_a70_IESQMMUTEX_0_331" "Local\ZonesCacheCounterMutex" "Local\URLBLOCK_HASHFILESWITCH_MUTEX" "IsoScope_a70_ConnHashTable<2672>_HashTable_Mutex" "Local\!BrowserEmulation!SharedMemory!Mutex" "Local\VERMGMTBlockListFileMutex" "IsoScope_a70_IE_EarlyTabStart_0x920_Mutex" "\Sessions\1\BaseNamedObjects\UpdatingNewTabPageData" "\Sessions\1\BaseNamedObjects\Local\!BrowserEmulation!SharedMemory!Mutex" "\Sessions\1\BaseNamedObjects\Local\VERMGMTBlockListFileMutex" "\Sessions\1\BaseNamedObjects\Local\URLBLOCK_FILEMAPSWITCH_MUTEX_2672" "\Sessions\1\BaseNamedObjects\Local\URLBLOCK_HASHFILESWITCH_MUTEX" "\Sessions\1\BaseNamedObjects\Local\URLBLOCK_DOWNLOAD_MUTEX" "\Sessions\1\BaseNamedObjects\Local\ZonesCacheCounterMutex" "\Sessions\1\BaseNamedObjects\Local\ZonesLockedCacheCounterMutex"3c:T446,"wextract.exe" failed to load missing module "api-ms-win-core-fibers-l1-1-1" - [base:0; Status:c0000135] "wextract.exe" failed to load missing module "api-ms-win-core-localization-l1-2-1" - [base:0; Status:c0000135] "cZ5oz01.exe" failed to load missing module "api-ms-win-core-fibers-l1-1-1" - [base:0; Status:c0000135] "cZ5oz01.exe" failed to load missing module "api-ms-win-core-localization-l1-2-1" - [base:0; Status:c0000135] "ZP6rv89.exe" failed to load missing module "api-ms-win-core-fibers-l1-1-1" - [base:0; Status:c0000135] "ZP6rv89.exe" failed to load missing module "api-ms-win-core-localization-l1-2-1" - [base:0; Status:c0000135] "1Pe57AQ7.exe" failed to load missing module "ext-ms-win-kernel32-package-current-l1-1-0" - [base:0; Status:c0000135] "1Pe57AQ7.exe" failed to load missing module "api-ms-win-appmodel-runtime-l1-1-1" - [base:0; Status:c0000135] "2cV9250.exe" failed to load missing module "api-ms-win-core-fibers-l1-1-1" - [base:0; Status:c0000135] "2cV9250.exe" failed to load missing module "api-ms-win-core-localization-l1-2-1" - [base:0; Status:c0000135]3d:Tca7,Found string "https://www.facebook.com/login" (Indicator: "facebook.com"; File: "wextract.exe") Found string "https://twitter.com/i/flow/login" (Indicator: "twitter"; File: "wextract.exe") file/memory contains long string with (Indicator: "twitter"; File: "ZR9AE29K.txt") file/memory contains long string with (Indicator: "twitter"; File: "D22R24WJ.txt") file/memory contains long string with (Indicator: "twitter"; File: "LRY3UMZG.txt") file/memory contains long string with (Indicator: "twitter"; File: "ZLOJCF6K.txt") file/memory contains long string with (Indicator: "twitter"; File: "ZLPJH3RP.txt") file/memory contains long string with (Indicator: "linkedin.com"; File: "9D0C8XGA.txt") file/memory contains long string with (Indicator: "twitter"; File: "OVX5T6EU.txt") file/memory contains long string with (Indicator: "facebook.com"; File: "HM3F1BLY.txt") file/memory contains long string with (Indicator: "linkedin.com"; File: "W3Q3CSQY.txt") file/memory contains long string with (Indicator: "linkedin.com"; File: "2F1MM9GB.txt") Found string "0jvJ8aOtTxyh8XW1I..BlgNzR.Ha.AAA.0.0.BlgNzR.AWWxLcv48CAfacebook.com/921747532403231094983397551480310768700dyAZQwkypDDj7FPwQhVUu9zfacebook.com/921720197781763115734440427023031076870" (Indicator: "facebook.com"; File: "OC8M3S4P.txt") Found string "guest_id_marketingv1%3A170294393846618106twitter.com/10254658332163122372925192648031076870guest_id_adsv1%3A170294393846618106twitter.com/10254658332163122372925692648031076870" (Indicator: "twitter"; File: "I5IR7TGT.txt") Found string "li_rmAQFy-YvBndYtWAAAAYx_XfCqFShTEnzQmaUV41pELgNC-IvETdhBKFlrzMKzkif-TlPT8IH_xMguTok33SwE4WYjebAttKMbRb9d6lXQAxADiUnKhznXUkvswww.linkedin.com/9217247450931231150303308339377631076869" (Indicator: "linkedin.com"; File: "Q2SX58NF.txt") Found string "0jvJ8aOtTxyh8XW1I..BlgNzR.Ha.AAA.0.0.BlgNzR.AWWxLcv48CAfacebook.com/92174753240323109498339755148031076870" (Indicator: "facebook.com"; File: "D9Y30TW1.txt") Found string "bcookie"v=2&3b1d6816-b66c-47d4-8d7a-6df618b7c0e4"linkedin.com/1025247450931231150303308386252631076869" (Indicator: "linkedin.com"; File: "2DI0ZNR7.txt") Found string "guest_id_marketingv1%3A170294393846618106twitter.com/10254658332163122372925192648031076870" (Indicator: "twitter"; File: "ZQGPYIQ8.txt") Found string "facebook.com" (Indicator: "facebook.com"; File: "PCAP") Found string "platform.linkedin.com" (Indicator: "linkedin.com"; File: "PCAP") Found string "twitter.com" (Indicator: "twitter"; File: "PCAP") Found string "www.facebook.com" (Indicator: "facebook.com"; File: "PCAP") Found string "GET /i/flow/login HTTP/1.1Accept: text/html, application/xhtml+xml, */*User-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateDNT: 1Host: twitter.comConnection: Keep-AliveAccept-Language: en-US" (Indicator: "twitter"; File: "SSL") Found string "GET /i/flow/login HTTP/1.1Accept: text/html, application/xhtml+xml, */*Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: twitter.comDNT: 1Connection: Keep-Alive" (Indicator: "twitter"; File: "SSL") file/memory contains long string with (Indicator: "linkedin.com"; File: "SSL")3e:T3514,"GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.digicert.com" Response ==> HTTP/1.1 200 OK Accept-Ranges: bytes Age: 6330 Cache-Control: max-age=7200 Content-Type: application/ocsp-response Date: Mon 18 Dec 2023 23:58:31 GMT Last-Modified: Mon 18 Dec 2023 22:13:01 GMT Server: ECAcc (sac/2551) X-Cache: HIT Content-Length: 471 with response body ==>308201D30A0100A08201CC308201C806092B0601050507300101048201B9308201B530819EA216041403DE503556D14CBB66F0A3E21B1BC397B23DD155180F32....... "GET /DigiCertGlobalRootG3.crt HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: cacerts.digicert.com" Response ==> HTTP/1.1 200 OK Accept-Ranges: bytes Age: 126558 cache-control: max-age=172800 public Content-Type: application/pkix-cert Date: Mon 18 Dec 2023 23:58:34 GMT Etag: "614b5ba7-243" expires: Wed 20 Dec 2023 23:58:34 GMT last-modified: Wed 22 Sep 2021 16:36:55 GMT Server: ECAcc (sac/253C) X-Cache: HIT Content-Length: 579 with response body ==>3082023F308201C5A0030201020210055556BCF25EA43535C3A40FD5AB4572300A06082A8648CE3D0403033061310B3009060355040613025553311530130603....... "GET /gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.pki.goog" Response ==> HTTP/1.1 200 OK Server: ocsp_responder Content-Length: 1445 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Date: Mon 18 Dec 2023 23:41:50 GMT Cache-Control: public max-age=14400 Content-Type: application/ocsp-response Age: 1004 with response body ==>308205A10A0100A082059A3082059606092B0601050507300101048205873082058330819EA2160414D49BADF2AB3CB9FF1A3E0C506DCF192780868DAA180F32....... "GET /DigiCertGlobalRootG3.crt HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: cacerts.digicert.com" Response ==> HTTP/1.1 200 OK Accept-Ranges: bytes Age: 126560 cache-control: max-age=172800 public Content-Type: application/pkix-cert Date: Mon 18 Dec 2023 23:58:36 GMT Etag: "614b5ba7-243" expires: Wed 20 Dec 2023 23:58:36 GMT last-modified: Wed 22 Sep 2021 16:36:55 GMT Server: ECAcc (sac/253C) X-Cache: HIT Content-Length: 579 with response body ==>3082023F308201C5A0030201020210055556BCF25EA43535C3A40FD5AB4572300A06082A8648CE3D0403033061310B3009060355040613025553311530130603....... "GET /gtsr1/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBQwkcLWD4LqGJ7bE7B1XZsEbmfwUAQU5K8rJnEaK0gnhS9SZizv8IkTcT4CDQIDvFNZazTHGPUBUGY%3D HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.pki.goog" Response ==> HTTP/1.1 200 OK Server: ocsp_responder Content-Length: 724 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Date: Mon 18 Dec 2023 23:40:49 GMT Cache-Control: public max-age=14400 Content-Type: application/ocsp-response Age: 1075 with response body ==>308202D00A0100A08202C9308202C506092B0601050507300101048202B6308202B230819BA2160414E4AF2B26711A2B4827852F52662CEFF08913713E180F32....... "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAz1vQYrVgL0erhQLCPM8GY%3D HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.digicert.com" Response ==> HTTP/1.1 200 OK Accept-Ranges: bytes Age: 6138 Cache-Control: max-age=7200 Content-Type: application/ocsp-response Date: Mon 18 Dec 2023 23:58:48 GMT Last-Modified: Mon 18 Dec 2023 22:16:30 GMT Server: ECAcc (sac/253E) X-Cache: HIT Content-Length: 471 with response body ==>308201D30A0100A08201CC308201C806092B0601050507300101048201B9308201B530819EA21604144E2254201895E6E36EE60FFAFAB912ED06178F39180F32....... "GET /gtsr1/gtsr1.crl HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: crl.pki.goog" Response ==> HTTP/1.1 200 OK Accept-Ranges: bytes Content-Security-Policy-Report-Only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/cacerts Cross-Origin-Resource-Policy: cross-origin Cross-Origin-Opener-Policy: same-origin; report-to="cacerts" Report-To: {"group":"cacerts" "max_age":2592000 "endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/cacerts"}]} Content-Length: 854 X-Content-Type-Options: nosniff Server: sffe X-XSS-Protection: 0 Date: Mon 18 Dec 2023 23:49:30 GMT Expires: Tue 19 Dec 2023 00:39:30 GMT Cache-Control: public max-age=3000 Age: 562 Last-Modified: Mon 18 Sep 2023 16:18:00 GMT Content-Type: application/pkix-crl Vary: Accept-Encoding with response body ==>308203523082013A020101300D06092A864886F70D01010B05003047310B300906035504061302555331223020060355040A1319476F6F676C65205472757374....... "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEAx5qUSwjBGVIJJhX%2BJrHYM%3D HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.digicert.com" Response ==> HTTP/1.1 200 OK Accept-Ranges: bytes Age: 4474 Cache-Control: max-age=7200 Content-Type: application/ocsp-response Date: Mon 18 Dec 2023 23:58:53 GMT Last-Modified: Mon 18 Dec 2023 22:44:19 GMT Server: ECAcc (sac/2507) X-Cache: HIT Content-Length: 471 with response body ==>308201D30A0100A08201CC308201C806092B0601050507300101048201B9308201B530819EA2160414B13EC36903F8BF4701D498261A0802EF63642BC3180F32....... "GET /gts1c3/moVDfISia2k.crl HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: crls.pki.goog" Response ==> HTTP/1.1 200 OK Accept-Ranges: bytes Content-Security-Policy-Report-Only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/cacerts Cross-Origin-Resource-Policy: cross-origin Cross-Origin-Opener-Policy: same-origin; report-to="cacerts" Report-To: {"group":"cacerts" "max_age":2592000 "endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/cacerts"}]} Content-Length: 17698 X-Content-Type-Options: nosniff Server: sffe X-XSS-Protection: 0 Date: Mon 18 Dec 2023 23:19:58 GMT Expires: Tue 19 Dec 2023 00:09:58 GMT Cache-Control: public max-age=3000 Age: 2336 Last-Modified: Mon 18 Dec 2023 21:21:42 GMT Content-Type: application/pkix-crl Vary: Accept-Encoding with response body ==>3082451E30824406020101300D06092A864886F70D01010B05003046310B300906035504061302555331223020060355040A1319476F6F676C65205472757374....... "GET /gts1c3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEBZwXm7t3kKEEFjsmHQeLcQ%3D HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.pki.goog" Response ==> HTTP/1.1 200 OK Server: ocsp_responder Content-Length: 471 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Date: Mon 18 Dec 2023 23:15:10 GMT Cache-Control: public max-age=14400 Content-Type: application/ocsp-response Age: 2625 with response body ==>308201D30A0100A08201CC308201C806092B0601050507300101048201B9308201B530819EA21604148A747FAF85CDEE95CD3D9CD0E24614F371351D27180F32....... "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSnxLiz3Fu1WB6n1%2FE6xWn1b0jXiQQUdIWAwGbH3zfez70pN6oDHb7tzRcCEAp6FnkBkACKqk%2BVbKsyAbY%3D HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.digicert.com" Response ==> HTTP/1.1 200 OK Accept-Ranges: bytes Age: 4011 Cache-Control: max-age=7200 Content-Type: application/ocsp-response Date: Mon 18 Dec 2023 23:58:59 GMT Last-Modified: Mon 18 Dec 2023 22:52:08 GMT Server: ECAcc (sac/2505) X-Cache: HIT Content-Length: 471 with response body ==>308201D30A0100A08201CC308201C806092B0601050507300101048201B9308201B530819EA2160414748580C066C7DF37DECFBD2937AA031DBEEDCD17180F32....... "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAzlnDD9eoNTLi0BRrMy%2BWU%3D HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.digicert.com" Response ==> HTTP/1.1 200 OK Accept-Ranges: bytes Age: 4106 Cache-Control: max-age=7200 Content-Type: application/ocsp-response Date: Mon 18 Dec 2023 23:58:59 GMT Last-Modified: Mon 18 Dec 2023 22:50:33 GMT Server: ECAcc (sac/2568) X-Cache: HIT Content-Length: 313 with response body ==>308201350A0100A082012E3082012A06092B06010505073001010482011B3082011730819EA2160414B3DB48A4F9A1C5D8AE3641CC1163696229BC4BC6180F32....... "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAbY2QTVWENG9oovp1QifsQ%3D HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.digicert.com" Response ==> HTTP/1.1 200 OK Accept-Ranges: bytes Age: 3334 Cache-Control: max-age=7200 Content-Type: application/ocsp-response Date: Mon 18 Dec 2023 23:58:59 GMT Last-Modified: Mon 18 Dec 2023 23:03:25 GMT Server: ECAcc (sac/254F) X-Cache: HIT Content-Length: 471 with response body ==>308201D30A0100A08201CC308201C806092B0601050507300101048201B9308201B530819EA216041403DE503556D14CBB66F0A3E21B1BC397B23DD155180F32....... "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTPJvUY%2Bsl%2Bj4yzQuAcL2oQno5fCgQUUWj%2FkK8CB3U8zNllZGKiErhZcjsCEAdcWuWOzU%2B3YfWP%2Bc9lf9g%3D HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.digicert.com" Response ==> HTTP/1.1 200 OK Accept-Ranges: bytes Age: 282 Cache-Control: max-age=7200 Content-Type: application/ocsp-response Date: Mon 18 Dec 2023 23:59:04 GMT Last-Modified: Mon 18 Dec 2023 23:54:25 GMT Server: ECAcc (sac/251B) X-Cache: HIT Content-Length: 471 with response body ==>308201D30A0100A08201CC308201C806092B0601050507300101048201B9308201B530819EA21604145168FF90AF0207753CCCD9656462A212B859723B180F32....... "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAzlnDD9eoNTLi0BRrMy%2BWU%3D HTTP/1.1 Cache-Control: max-age = 7200 Connection: Keep-Alive Accept: */* If-Modified-Since: Mon, 18 Dec 2023 22:50:33 GMT User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.digicert.com" Response ==> HTTP/1.1 304 Not Modified Accept-Ranges: bytes Age: 4111 Cache-Control: max-age=7200 Date: Mon 18 Dec 2023 23:59:04 GMT Last-Modified: Mon 18 Dec 2023 22:50:33 GMT Server: ECAcc (sac/2568) X-Cache: HIT with response body ==>....... "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTk45WiKdPUwcMf8JgMC07ACYqr2AQUt2ui6qiqhIx56rTaD5iyxZV2ufQCEAqiBEK%2F1RSvcy4lL46SQ4M%3D HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.digicert.com" Response ==> HTTP/1.1 200 OK Accept-Ranges: bytes Age: 3993 Cache-Control: max-age=7200 Content-Type: application/ocsp-response Date: Mon 18 Dec 2023 23:59:05 GMT Last-Modified: Mon 18 Dec 2023 22:52:32 GMT Server: ECAcc (sac/253A) X-Cache: HIT Content-Length: 471 with response body ==>308201D30A0100A08201CC308201C806092B0601050507300101048201B9308201B530819EA2160414B76BA2EAA8AA848C79EAB4DA0F98B2C59576B9F4180F32....... "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSnxLiz3Fu1WB6n1%2FE6xWn1b0jXiQQUdIWAwGbH3zfez70pN6oDHb7tzRcCEAp6FnkBkACKqk%2BVbKsyAbY%3D HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.digicert.com" Response ==> HTTP/1.1 200 OK Accept-Ranges: bytes Age: 4018 Cache-Control: max-age=7200 Content-Type: application/ocsp-response Date: Mon 18 Dec 2023 23:59:06 GMT Last-Modified: Mon 18 Dec 2023 22:52:08 GMT Server: ECAcc (sac/2505) X-Cache: HIT Content-Length: 471 with response body ==>308201D30A0100A08201CC308201C806092B0601050507300101048201B9308201B530819EA2160414748580C066C7DF37DECFBD2937AA031DBEEDCD17180F32....... "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAqvpsXKY8RRQeo74ffHUxc%3D HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.digicert.com" Response ==> HTTP/1.1 200 OK Accept-Ranges: bytes Age: 1372 Cache-Control: max-age=7200 Content-Type: application/ocsp-response Date: Mon 18 Dec 2023 23:59:20 GMT Last-Modified: Mon 18 Dec 2023 23:36:28 GMT Server: ECAcc (sac/252C) X-Cache: HIT Content-Length: 471 with response body ==>308201D30A0100A08201CC308201C806092B0601050507300101048201B9308201B530819EA21604144E2254201895E6E36EE60FFAFAB912ED06178F39180F32....... "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.digicert.com" Response ==> HTTP/1.1 200 OK Accept-Ranges: bytes Age: 2303 Cache-Control: max-age=7200 Content-Type: application/ocsp-response Date: Mon 18 Dec 2023 23:59:24 GMT Last-Modified: Mon 18 Dec 2023 23:21:01 GMT Server: ECAcc (sac/2561) X-Cache: HIT Content-Length: 471 with response body ==>308201D30A0100A08201CC308201C806092B0601050507300101048201B9308201B530819EA21604144E2254201895E6E36EE60FFAFAB912ED06178F39180F32....... "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEA177el9ggmWelJjG4vdGL0%3D HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.digicert.com" Response ==> HTTP/1.1 200 OK Accept-Ranges: bytes Age: 3759 Cache-Control: max-age=7200 Content-Type: application/ocsp-response Date: Mon 18 Dec 2023 23:59:27 GMT Last-Modified: Mon 18 Dec 2023 22:56:48 GMT Server: ECAcc (sac/254A) X-Cache: HIT Content-Length: 471 with response body ==>308201D30A0100A08201CC308201C806092B0601050507300101048201B9308201B530819EA21604144E2254201895E6E36EE60FFAFAB912ED06178F39180F32.......3f:T14b8,"wextract.exe" loaded module "%WINDIR%\SYSTEM32\ADVPACK.DLL" at base 6d730000 "wextract.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 74c50000 "wextract.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 72650000 "wextract.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 0 "wextract.exe" loaded module "KERNEL32" at base 75220000 "wextract.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 0 "wextract.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 6c190000 "cZ5oz01.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 72650000 "cZ5oz01.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 0 "cZ5oz01.exe" loaded module "KERNEL32" at base 75220000 "cZ5oz01.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 0 "cZ5oz01.exe" loaded module "FECLIENT.DLL" at base 6d860000 "cZ5oz01.exe" loaded module "%WINDIR%\SYSTEM32\ADVPACK.DLL" at base 6d680000 "cZ5oz01.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 74c50000 "ZP6rv89.exe" loaded module "%WINDIR%\SYSTEM32\ADVPACK.DLL" at base 6c0f0000 "ZP6rv89.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 72650000 "ZP6rv89.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 0 "ZP6rv89.exe" loaded module "KERNEL32" at base 75220000 "ZP6rv89.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 0 "ZP6rv89.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 6c190000 "ZP6rv89.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 74c50000 "1Pe57AQ7.exe" loaded module "KERNEL32.DLL" at base 75220000 "1Pe57AQ7.exe" loaded module "UXTHEME.DLL" at base 73890000 "1Pe57AQ7.exe" loaded module "IMM32.DLL" at base 76ff0000 "1Pe57AQ7.exe" loaded module "COMCTL32" at base 73c20000 "1Pe57AQ7.exe" loaded module "SHELL32.DLL" at base 76250000 "1Pe57AQ7.exe" loaded module "OLE32.DLL" at base 756e0000 "1Pe57AQ7.exe" loaded module "ADVAPI32.DLL" at base 75c50000 "1Pe57AQ7.exe" loaded module "PROPSYS.DLL" at base 73ae0000 "1Pe57AQ7.exe" loaded module "COMCTL32.DLL" at base 73c20000 "1Pe57AQ7.exe" loaded module "OLEAUT32.DLL" at base 75410000 "1Pe57AQ7.exe" loaded module "CLBCATQ.DLL" at base 75650000 "1Pe57AQ7.exe" loaded module "%WINDIR%\SYSTEM32\IEFRAME.DLL" at base 6c6f0000 "1Pe57AQ7.exe" loaded module "API-MS-WIN-DOWNLEVEL-OLE32-L1-1-0.DLL" at base 74de0000 "1Pe57AQ7.exe" loaded module "URLMON.DLL" at base 75a80000 "1Pe57AQ7.exe" loaded module "API-MS-WIN-DOWNLEVEL-SHLWAPI-L2-1-0.DLL" at base 6d650000 "1Pe57AQ7.exe" loaded module "%WINDIR%\SYSTEM32\PROPSYS.DLL" at base 73ae0000 "1Pe57AQ7.exe" loaded module "%PROGRAMFILES%\INTERNET EXPLORER\IEPROXY.DLL" at base 6c360000 "1Pe57AQ7.exe" loaded module "IERTUTIL.DLL" at base 75840000 "1Pe57AQ7.exe" loaded module "%WINDIR%\SYSTEM32\SHELL32.DLL" at base 76250000 "1Pe57AQ7.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 74c50000 "1Pe57AQ7.exe" loaded module "USER32.DLL" at base 75e00000 "1Pe57AQ7.exe" loaded module "DWMAPI.DLL" at base 73650000 "1Pe57AQ7.exe" loaded module "SETUPAPI.DLL" at base 754b0000 "1Pe57AQ7.exe" loaded module "RPCRT4.DLL" at base 75d00000 "1Pe57AQ7.exe" loaded module "EXT-MS-WIN-KERNEL32-PACKAGE-CURRENT-L1-1-0" at base 0 "1Pe57AQ7.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-1" at base 0 "2cV9250.exe" loaded module "MSIMG32.DLL" at base 6e5c0000 "2cV9250.exe" loaded module "KERNEL32.DLL" at base 75220000 "2cV9250.exe" loaded module "ADVAPI32.DLL" at base 75c50000 "2cV9250.exe" loaded module "USER32.DLL" at base 75e00000 "2cV9250.exe" loaded module "GDI32.DLL" at base 77090000 "2cV9250.exe" loaded module "WINHTTP.DLL" at base 70400000 "2cV9250.exe" loaded module "CRYPT32.DLL" at base 74f10000 "2cV9250.exe" loaded module "MSVCR100.DLL" at base 66b70000 "2cV9250.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 72650000 "2cV9250.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 0 "2cV9250.exe" loaded module "KERNEL32" at base 75220000 "2cV9250.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 0 "2cV9250.exe" loaded module "SHLWAPI.DLL" at base 75300000 "2cV9250.exe" loaded module "WS2_32.DLL" at base 75180000 "2cV9250.exe" loaded module "SSPICLI.DLL" at base 74c30000 "2cV9250.exe" loaded module "CRYPTSP.DLL" at base 747b0000 "2cV9250.exe" loaded module "CREDSSP.DLL" at base 74470000 "2cV9250.exe" loaded module "RPCRT4.DLL" at base 75d00000 "2cV9250.exe" loaded module "%WINDIR%\SYSTEM32\MSWSOCK.DLL" at base 74770000 "2cV9250.exe" loaded module "WSHIP6.DLL" at base 74760000 "2cV9250.exe" loaded module "%WINDIR%\SYSTEM32\WSHQOS.DLL" at base 70f70000 "2cV9250.exe" loaded module "DNSAPI.DLL" at base 74630000 "2cV9250.exe" loaded module "%WINDIR%\SYSTEM32\WSHTCPIP.DLL" at base 74210000 "2cV9250.exe" loaded module "%WINDIR%\SYSTEM32\WSHIP6.DLL" at base 74760000 "2cV9250.exe" loaded module "IPHLPAPI.DLL" at base 74300000 "2cV9250.exe" loaded module "RASADHLP.DLL" at base 715c0000 "2cV9250.exe" loaded module "%WINDIR%\SYSTEM32\FWPUCLNT.DLL" at base 72ca0000 "2cV9250.exe" loaded module "NTDLL.DLL" at base 76ea0000 "2cV9250.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 6c190000 "2cV9250.exe" loaded module "WSHTCPIP" at base 74210000 "2cV9250.exe" loaded module "ADVAPI32" at base 75c5000040:Ta47,"wextract.exe" was detected as "Microsoft Cabinet" and name: "sfx" "wextract.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "wextract.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "wextract.exe" was detected as "Microsoft Cabinet File" and name: "Archive" "wextract.exe" was detected as "Microsoft Linker" and name: "Linker" "cZ5oz01.exe" was detected as "Microsoft Cabinet" and name: "sfx" "cZ5oz01.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "cZ5oz01.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "cZ5oz01.exe" was detected as "Microsoft Cabinet File" and name: "Archive" "cZ5oz01.exe" was detected as "Microsoft Linker" and name: "Linker" "4xt354js.exe" was detected as "Microsoft Cabinet" and name: "sfx" "4xt354js.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "4xt354js.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "4xt354js.exe" was detected as "Microsoft Cabinet File" and name: "Archive" "4xt354js.exe" was detected as "Microsoft Linker" and name: "Linker" "1Pe57AQ7.exe" was detected as "Microsoft Cabinet" and name: "sfx" "1Pe57AQ7.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "1Pe57AQ7.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "1Pe57AQ7.exe" was detected as "Microsoft Cabinet File" and name: "Archive" "1Pe57AQ7.exe" was detected as "Microsoft Linker" and name: "Linker" "ZP6rv89.exe" was detected as "Microsoft Cabinet" and name: "sfx" "ZP6rv89.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "ZP6rv89.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "ZP6rv89.exe" was detected as "Microsoft Cabinet File" and name: "Archive" "ZP6rv89.exe" was detected as "Microsoft Linker" and name: "Linker" "2cV9250.exe" was detected as "Microsoft Cabinet" and name: "sfx" "2cV9250.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "2cV9250.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "2cV9250.exe" was detected as "Microsoft Cabinet File" and name: "Archive" "2cV9250.exe" was detected as "Microsoft Linker" and name: "Linker" "6xa9BJ8.exe" was detected as "Microsoft Cabinet" and name: "sfx" "6xa9BJ8.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "6xa9BJ8.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "6xa9BJ8.exe" was detected as "Microsoft Cabinet File" and name: "Archive" "6xa9BJ8.exe" was detected as "Microsoft Linker" and name: "Linker"41:T1047,"wextract.exe" file has an entrypoint instructions - "call 0x407155,jmp 0x406a6a,push 0x58,push 0x4072b8,call 0x407208,xor ebx, ebx,mov dword ptr [ebp - 0x20], ebx,lea eax, [ebp - 0x68],push eax,call dword ptr [0x40a184],mov dword ptr [ebp - 4], ebx,mov eax, dword ptr fs:[0x18],mov esi, dword ptr [eax + 4],mov edi, ebx,mov edx, 0x4088ac,mov ecx, esi,xor eax, eax,lock cmpxchg dword ptr [edx], ecx,test eax, eax,je 0x406abc,cmp eax, esi,jne 0x406aaf,xor esi, esi,inc esi,mov edi, esi,jmp 0x406abf,push 0x3e8,call dword ptr [0x40a188],jmp 0x406a93,xor esi, esi,inc esi," "cZ5oz01.exe" file has an entrypoint instructions - "call 0x407155,jmp 0x406a6a,push 0x58,push 0x4072b8,call 0x407208,xor ebx, ebx,mov dword ptr [ebp - 0x20], ebx,lea eax, [ebp - 0x68],push eax,call dword ptr [0x40a184],mov dword ptr [ebp - 4], ebx,mov eax, dword ptr fs:[0x18],mov esi, dword ptr [eax + 4],mov edi, ebx,mov edx, 0x4088ac,mov ecx, esi,xor eax, eax,lock cmpxchg dword ptr [edx], ecx,test eax, eax,je 0x406abc,cmp eax, esi,jne 0x406aaf,xor esi, esi,inc esi,mov edi, esi,jmp 0x406abf,push 0x3e8,call dword ptr [0x40a188],jmp 0x406a93,xor esi, esi,inc esi," "4xt354js.exe" file has an entrypoint instructions - "call 0x40eda2,jmp 0x40e376,mov ecx, dword ptr [ebp - 0xc],mov dword ptr fs:[0], ecx,pop ecx,pop edi,pop edi,pop esi,pop ebx,mov esp, ebp,pop ebp,push ecx,ret ,mov ecx, dword ptr [ebp - 0x10],xor ecx, ebp,call 0x40de07,jmp 0x40e4fc,push eax,push dword ptr fs:[0],lea eax, [esp + 0xc],sub esp, dword ptr [esp + 0xc],push ebx,push esi,push edi,mov dword ptr [eax], ebp,mov ebp, eax,mov eax, dword ptr [0x43c0f0],xor eax, ebp,push eax,push dword ptr [ebp - 4],mov dword ptr [ebp - 4], 0xffffffff,lea eax, [ebp - 0xc],mov dword ptr fs:[0], eax,ret ,push eax," "1Pe57AQ7.exe" file has an entrypoint instructions - "call 0x420aea,jmp 0x4203fb,push ebp,mov ebp, esp,push esi,push dword ptr [ebp + 8],mov esi, ecx,call 0x4205e7,mov dword ptr [esi], 0x49fdf0,mov eax, esi,pop esi,pop ebp,ret 4,and dword ptr [ecx + 4], 0,mov eax, ecx,and dword ptr [ecx + 8], 0,mov dword ptr [ecx + 4], 0x49fdf8,mov dword ptr [ecx], 0x49fdf0,ret ,push ebp,mov ebp, esp,push esi,push dword ptr [ebp + 8],mov esi, ecx,call 0x4205e7,mov dword ptr [esi], 0x49fe0c,mov eax, esi,pop esi,pop ebp,ret 4,and dword ptr [ecx + 4], 0,mov eax, ecx,and dword ptr [ecx + 8], 0," "ZP6rv89.exe" file has an entrypoint instructions - "call 0x407155,jmp 0x406a6a,push 0x58,push 0x4072b8,call 0x407208,xor ebx, ebx,mov dword ptr [ebp - 0x20], ebx,lea eax, [ebp - 0x68],push eax,call dword ptr [0x40a184],mov dword ptr [ebp - 4], ebx,mov eax, dword ptr fs:[0x18],mov esi, dword ptr [eax + 4],mov edi, ebx,mov edx, 0x4088ac,mov ecx, esi,xor eax, eax,lock cmpxchg dword ptr [edx], ecx,test eax, eax,je 0x406abc,cmp eax, esi,jne 0x406aaf,xor esi, esi,inc esi,mov edi, esi,jmp 0x406abf,push 0x3e8,call dword ptr [0x40a188],jmp 0x406a93,xor esi, esi,inc esi," "2cV9250.exe" file has an entrypoint instructions - "call 0x405a69,jmp 0x401f8b,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,mov edx, dword ptr [esp + 0xc],mov ecx, dword ptr [esp + 4],test edx, edx,je 0x402195,xor eax, eax,mov al, byte ptr [esp + 8],test al, al,jne 0x40214c,cmp edx, 0x100,jb 0x40214c,cmp dword ptr [0x870088], 0,je 0x40214c,jmp 0x405b56,push edi,mov edi, ecx,cmp edx, 4,jb 0x402185,neg ecx,and ecx, 3,je 0x402167,sub edx, ecx,mov byte ptr [edi], al,add edi, 1,sub ecx, 1,jne 0x40215d,mov ecx, eax,shl eax, 8," "6xa9BJ8.exe" file has an entrypoint instructions - "call 0x4031a7,jne 0x4031af,je 0x4031af,jnp 0x403153,and dword ptr [ecx - 0x74fb3b7d], ecx,pop esp,and al, 0xfc,jmp 0x4031c2,add al, 0x81,jmp 0x403163,xor dword ptr [eax], eax,add bl, ch,add eax, 0x4f5eb20,and byte ptr [edi + eax + 0x75], dh,add eax, 0xb1d340c7,rol bh, 1,inc esp,and al, 0xfc,xor byte ptr [eax], al,add byte ptr [eax], al,sub esp, 4,jne 0x4031e2,je 0x4031e2,int3 ,dec esi,xchg eax, esi,add eax, dword ptr [ebx + 0x548b04c4],and al, 0xfc,jmp 0x4031f1,add al, 0x29,shr bl, 5,add ch, bl,stc ,add al, 2,jmp 0x4031fc,or byte ptr [edx], cl,loop 0x403246,mov byte ptr [ebx + eax + 2], ah,je 0x403206,jne 0x403206,mov cl, 0xb5,dec edi,"42:T573,file/memory contains long string with (Indicator: "text/javascript"; File: "SSL") Found string "" (Indicator: "text/javascript"; File: "ML59MCK3.htm") Found string "" (Indicator: "text/javascript"; File: "ML59MCK3.htm") Found string "" (Indicator: "text/javascript"; File: "ML59MCK3.htm") Found string "" (Indicator: "text/javascript"; File: "ML59MCK3.htm")43:T4cb,Spawned process "cZ5oz01.exe" (UID: 00000000-00003316) Spawned process "ZP6rv89.exe" (UID: 00000000-00003028) Spawned process "1Pe57AQ7.exe" (UID: 00000000-00003660) Spawned process "iexplore.exe" with commandline "https://accounts.google.com/" (UID: 00000000-00002672) Spawned process "iexplore.exe" with commandline "https://www.facebook.com/login" (UID: 00000000-00003748) Spawned process "iexplore.exe" with commandline "SCODEF:2672 CREDAT:275458 /prefetch:2" (UID: 00000000-00000540) Spawned process "iexplore.exe" with commandline "https://store.steampowered.com/login" (UID: 00000000-00002648) Spawned process "iexplore.exe" with commandline "SCODEF:3748 CREDAT:275457 /prefetch:2" (UID: 00000000-00001232) Spawned process "iexplore.exe" with commandline "https://twitter.com/i/flow/login" (UID: 00000000-00003860) Spawned process "iexplore.exe" with commandline "SCODEF:2648 CREDAT:275457 /prefetch:2" (UID: 00000000-00003116) Spawned process "iexplore.exe" with commandline "SCODEF:2672 CREDAT:275461 /prefetch:2" (UID: 00000000-00002332) Spawned process "2cV9250.exe" (UID: 00000000-00001912) Spawned process "iexplore.exe" with commandline "SCODEF:3860 CREDAT:275457 /prefetch:2" (UID: 00000000-00002404)44:T4cb,Spawned process "cZ5oz01.exe" (UID: 00000000-00003316) Spawned process "ZP6rv89.exe" (UID: 00000000-00003028) Spawned process "1Pe57AQ7.exe" (UID: 00000000-00003660) Spawned process "iexplore.exe" with commandline "https://accounts.google.com/" (UID: 00000000-00002672) Spawned process "iexplore.exe" with commandline "https://www.facebook.com/login" (UID: 00000000-00003748) Spawned process "iexplore.exe" with commandline "SCODEF:2672 CREDAT:275458 /prefetch:2" (UID: 00000000-00000540) Spawned process "iexplore.exe" with commandline "https://store.steampowered.com/login" (UID: 00000000-00002648) Spawned process "iexplore.exe" with commandline "SCODEF:3748 CREDAT:275457 /prefetch:2" (UID: 00000000-00001232) Spawned process "iexplore.exe" with commandline "https://twitter.com/i/flow/login" (UID: 00000000-00003860) Spawned process "iexplore.exe" with commandline "SCODEF:2648 CREDAT:275457 /prefetch:2" (UID: 00000000-00003116) Spawned process "iexplore.exe" with commandline "SCODEF:2672 CREDAT:275461 /prefetch:2" (UID: 00000000-00002332) Spawned process "2cV9250.exe" (UID: 00000000-00001912) Spawned process "iexplore.exe" with commandline "SCODEF:3860 CREDAT:275457 /prefetch:2" (UID: 00000000-00002404)45:T611,Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; File: "wextract.exe") Found reference to API "LoadLibraryExA" (Indicator: "LoadLibrary"; File: "wextract.exe") Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; File: "2cV9250.exe.1068760659") Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; Source: "00000000-00001912.00000000.68222.00400000.00000040.mdmp, 00000000-00001912.00000001.70142.00400000.00000040.mdmp, 00000000-00001912.00000002.72061.00160000.00000040.mdmp") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; Source: "00000000-00001912.00000000.68222.00400000.00000040.mdmp, 00000000-00001912.00000001.70142.00400000.00000040.mdmp, 00000000-00001912.00000002.72061.00160000.00000040.mdmp") Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; Source: "00000000-00001912.00000000.68222.00400000.00000040.mdmp, 00000000-00001912.00000001.70142.00400000.00000040.mdmp, 00000000-00001912.00000002.72061.00160000.00000040.mdmp") Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; Source: "00000000-00003028.00000001.68977.012DA000.00000002.mdmp") Found reference to API "LoadLibraryExA" (Indicator: "LoadLibrary"; Source: "00000000-00003028.00000001.68977.012DA000.00000002.mdmp") Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; Source: "00000000-00003316.00000002.70823.0034A000.00000002.mdmp") Found reference to API "LoadLibraryExA" (Indicator: "LoadLibrary"; Source: "00000000-00003316.00000002.70823.0034A000.00000002.mdmp")46:T7d13,"cZ5oz01.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP000.TMP\cZ5oz01.exe]- [targetUID: 00000000-00003316] "4xt354js.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP001.TMP\4xt354js.exe]- [targetUID: 00000000-00003316] "1Pe57AQ7.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP002.TMP\1Pe57AQ7.exe]- [targetUID: 00000000-00003028] "ZP6rv89.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP001.TMP\ZP6rv89.exe]- [targetUID: 00000000-00003316] "urlref_httpsaccounts.google.com" has type "HTML document UTF-8 Unicode text with very long lines"- [targetUID: N/A] "2cV9250.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP002.TMP\2cV9250.exe]- [targetUID: 00000000-00003028] "6xa9BJ8.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP000.TMP\6xa9BJ8.exe]- [targetUID: 00000000-00003568] "logo_steam_1_.svg" has type "SVG Scalable Vector Graphics image"- [targetUID: N/A] "4lCu2zih0ca_1_.svg" has type "SVG Scalable Vector Graphics image"- [targetUID: N/A] "urlblockindex_1_.bin" has type "data"- [targetUID: N/A] "libraries~b28b7af69_1_.js" has type "UTF-8 Unicode text with very long lines with CRLF LF line terminators"- [targetUID: N/A] "main_2_.js" has type "data"- [targetUID: N/A] "DskFNeBDZrG_1_.js" has type "ASCII text with very long lines"- [targetUID: N/A] "642e1qh28prue1yv3o1kqf3z9_1_.css" has type "ASCII text with very long lines"- [targetUID: N/A] "780clfwo95q05e51lsjnfgmg4_1_.js" has type "UTF-8 Unicode text with very long lines"- [targetUID: N/A] "9hjywk3zr0hyiyvhto6gc39eu_1_.js" has type "UTF-8 Unicode text with very long lines"- [targetUID: N/A] "urlref_httpstwitter.comiflowlogin" has type "HTML document UTF-8 Unicode text with very long lines"- [targetUID: N/A] "ML59MCK3.htm" has type "HTML document UTF-8 Unicode text with very long lines with CRLF NEL line terminators"- Location: [%LOCALAPPDATA%\Microsoft\Windows\Temporary Internet Files\Content.IE5\QQW0X29Y\ML59MCK3.htm]- [targetUID: 00000000-00002672] "TarBEFF.tmp" has type "data"- Location: [%TEMP%\TarBEFF.tmp]- [targetUID: 00000000-00002648] "shared_global_1_.js" has type "ASCII text with very long lines with CRLF line terminators"- [targetUID: N/A] "utag_2_.js" has type "UTF-8 Unicode text with very long lines"- [targetUID: N/A] "store_1_.css" has type "ASCII text with very long lines with CRLF LF line terminators"- [targetUID: N/A] "MotivaSans-RegularItalic_1_.ttf" has type "TrueType Font data digitally signed 18 tables 1st "DSIG" 23 names Macintosh Copyright \251 2012 2017 2020 by Plau. All rights reserved.Motiva SansRegular Italic4.015;Plau"- [targetUID: N/A] "main_1_.css" has type "UTF-8 Unicode text with very long lines with CRLF LF line terminators"- [targetUID: N/A] "MotivaSans-BoldItalic_1_.ttf" has type "TrueType Font data digitally signed 18 tables 1st "DSIG" 22 names Macintosh Copyright \251 2012 2017 2020 by Plau. All rights reserved.Motiva SansBold Italic4.015;Plau;Mo"- [targetUID: N/A] "MotivaSans-LightItalic_1_.ttf" has type "TrueType Font data digitally signed 18 tables 1st "DSIG" 24 names Macintosh Copyright \251 2012 2017 2020 by Plau. All rights reserved.Motiva SansLight Italic4.015;Plau;M"- [targetUID: N/A] "new_login_bg_strong_mask_1_.jpg" has type "JPEG image data Exif standard: [TIFF image data little-endian direntries=0] baseline precision 8 1920x1080 components 3"- [targetUID: N/A] "MotivaSans-Medium_1_.ttf" has type "TrueType Font data digitally signed 18 tables 1st "DSIG" 24 names Macintosh Copyright \251 2012 2017 2020 by Plau. All rights reserved.Motiva SansMedium4.015;Plau;MotivaS"- [targetUID: N/A] "MotivaSans-Bold_1_.ttf" has type "TrueType Font data digitally signed 18 tables 1st "DSIG" 22 names Macintosh Copyright \251 2012 2017 2020 by Plau. All rights reserved.Motiva SansBold4.015;Plau;MotivaSan"- [targetUID: N/A] "MotivaSans-Regular_1_.ttf" has type "TrueType Font data digitally signed 18 tables 1st "DSIG" 22 names Macintosh Copyright \251 2012 2017 2020 by Plau. All rights reserved.Motiva SansRegular4.015;Plau;Motiva"- [targetUID: N/A] "MotivaSans-Light_1_.ttf" has type "TrueType Font data digitally signed 18 tables 1st "DSIG" 24 names Macintosh Copyright \251 2012 2017 2020 by Plau. All rights reserved.Motiva SansLight4.015;Plau;MotivaSa"- [targetUID: N/A] "MotivaSans-Black_1_.ttf" has type "TrueType Font data digitally signed 18 tables 1st "DSIG" 24 names Macintosh Copyright \251 2012 2017 2020 by Plau. All rights reserved.Motiva SansBlack4.015;Plau;MotivaSa"- [targetUID: N/A] "MotivaSans-Thin_1_.ttf" has type "TrueType Font data digitally signed 18 tables 1st "DSIG" 24 names Macintosh Copyright \251 2012 2017 2020 by Plau. All rights reserved.Motiva SansThin4.015;Plau;MotivaSan"- [targetUID: N/A] "a0ux9o0kp9f6cs9ljq6oqxayk_1_.js" has type "UTF-8 Unicode text with very long lines"- [targetUID: N/A] "jquery-1.8.3.min_1_.js" has type "ASCII text with very long lines with CRLF line terminators"- [targetUID: N/A] "dynamicstore_1_.js" has type "ASCII text with very long lines with CRLF line terminators"- [targetUID: N/A] "main_1_.js" has type "ASCII text with very long lines with CRLF line terminators"- [targetUID: N/A] "shared_global_1_.css" has type "ASCII text with very long lines with CRLF LF line terminators"- [targetUID: N/A] "imagestore.dat" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\Internet Explorer\imagestore\3mt7jhv\imagestore.dat]- [targetUID: 00000000-00003116] "727ucpfhmn0jolb3t2h3o5dkj_1_.js" has type "C source UTF-8 Unicode text with very long lines"- [targetUID: N/A] "1jvrml64dlmt60uoawzo2af88_1_.js" has type "UTF-8 Unicode text with very long lines"- [targetUID: N/A] "CabBEDF.tmp" has type "Microsoft Cabinet archive data Windows 2000/XP setup 66791 bytes 1 file at 0x2c +A "authroot.stl" number 1 6 datablocks 0x1 compression"- Location: [%TEMP%\CabBEDF.tmp]- [targetUID: 00000000-00002648] "login_2_.htm" has type "HTML document UTF-8 Unicode text with very long lines"- [targetUID: N/A] "login_1_.js" has type "UTF-8 Unicode text with very long lines with CRLF line terminators"- [targetUID: N/A] "urlref_httpswww.facebook.comlogin" has type "HTML document UTF-8 Unicode text with very long lines"- [targetUID: N/A] "cart_1_.css" has type "ASCII text with very long lines with CRLF LF line terminators"- [targetUID: N/A] "a1OLcVhluEP_1_.js" has type "ASCII text with very long lines"- [targetUID: N/A] "sKtrEJAtiUM_1_.js" has type "ASCII text with very long lines"- [targetUID: N/A] "VOBFpi2zoQs_1_.js" has type "ASCII text with very long lines"- [targetUID: N/A] "login_1_.htm" has type "HTML document UTF-8 Unicode text with very long lines"- [targetUID: N/A] "rf7yAhNGY86_1_.js" has type "ASCII text with very long lines"- [targetUID: N/A] "login-submite4706ea2_1_.htm" has type "HTML document UTF-8 Unicode text with very long lines"- [targetUID: N/A] "login-submit374a3190_1_.htm" has type "HTML document UTF-8 Unicode text with very long lines"- [targetUID: N/A] "favicon_5_.ico" has type "MS Windows icon resource - 5 icons 16x16 32 bits/pixel 24x24 32 bits/pixel"- [targetUID: N/A] "D3XrCjdXtFY_1_.js" has type "ASCII text with very long lines"- [targetUID: N/A] "buttons_1_.css" has type "ASCII text with CRLF LF line terminators"- [targetUID: N/A] "8W3qU45QLlE_1_.css" has type "ASCII text with very long lines"- [targetUID: N/A] "3m4lyvbs6efg8pyhv7kupo6dh_1_.ico" has type "MS Windows icon resource - 4 icons 64x64 32 bits/pixel 32x32 32 bits/pixel"- [targetUID: N/A] "aBIoq18cchP_1_.js" has type "ASCII text with very long lines"- [targetUID: N/A] "WSUsUAbL_J5_1_.js" has type "ASCII text with very long lines"- [targetUID: N/A] "qvzskUrYlYC_1_.js" has type "ASCII text with very long lines"- [targetUID: N/A] "login_1_.htm" has type "HTML document UTF-8 Unicode text with very long lines with CRLF LF line terminators"- [targetUID: N/A] "urlref_httpsstore.steampowered.comlogin" has type "HTML document UTF-8 Unicode text with very long lines with CRLF LF line terminators"- [targetUID: N/A] "shared_responsive_adapter_1_.js" has type "UTF-8 Unicode text with CRLF line terminators"- [targetUID: N/A] "cjx8Hpg6co-_1_.js" has type "C source ASCII text with very long lines"- [targetUID: N/A] "EcHbCLLcfHK_1_.js" has type "ASCII text with very long lines"- [targetUID: N/A] "manifest_1_.js" has type "ASCII text with very long lines with CRLF LF line terminators"- [targetUID: N/A] "L3lExXePTzJ_1_.css" has type "ASCII text with very long lines"- [targetUID: N/A] "en-US.4" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\Internet Explorer\DomainSuggestions\en-US.4]- [targetUID: 00000000-00002648] "login_1_.css" has type "assembler source ASCII text with CRLF LF line terminators"- [targetUID: N/A] "70DAE932E3BCB3C00656A27B544BA9CA" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\70DAE932E3BCB3C00656A27B544BA9CA]- [targetUID: 00000000-00000540] "~DFDC7C1909BC1B63FD.TMP" has type "data"- Location: [%TEMP%\~DFDC7C1909BC1B63FD.TMP]- [targetUID: 00000000-00002672] "~DF1AD35DC0EBAD7284.TMP" has type "data"- Location: [%TEMP%\~DF1AD35DC0EBAD7284.TMP]- [targetUID: 00000000-00003860] "~DFB7E4CFA62980EB1B.TMP" has type "data"- Location: [%TEMP%\~DFB7E4CFA62980EB1B.TMP]- [targetUID: 00000000-00003748] "~DF433838858BD6F4C3.TMP" has type "data"- [targetUID: N/A] "~DFB2CE4EB89128E4B7.TMP" has type "data"- Location: [%TEMP%\~DFB2CE4EB89128E4B7.TMP]- [targetUID: 00000000-00002672] "~DFC24A82FF304C4278.TMP" has type "data"- Location: [%TEMP%\~DFC24A82FF304C4278.TMP]- [targetUID: 00000000-00003748] "~DFB6BA0071B95FC524.TMP" has type "data"- Location: [%TEMP%\~DFB6BA0071B95FC524.TMP]- [targetUID: 00000000-00002672] "~DF05EF25E6219DB4D5.TMP" has type "data"- Location: [%TEMP%\~DF05EF25E6219DB4D5.TMP]- [targetUID: 00000000-00003860] "~DF1E28E1C680E28C0D.TMP" has type "data"- [targetUID: N/A] "~DFCD3EF34FBC31EB7A.TMP" has type "data"- Location: [%TEMP%\~DFCD3EF34FBC31EB7A.TMP]- [targetUID: 00000000-00002648] "~DFFA97742A9B14C885.TMP" has type "data"- Location: [%TEMP%\~DFFA97742A9B14C885.TMP]- [targetUID: 00000000-00002672] "~DFF7BC9132B62AD9F8.TMP" has type "data"- Location: [%TEMP%\~DFF7BC9132B62AD9F8.TMP]- [targetUID: 00000000-00002648] "~DFB009EBE6E6EC7D2A.TMP" has type "data"- Location: [%TEMP%\~DFB009EBE6E6EC7D2A.TMP]- [targetUID: 00000000-00002648] "tooltip_1_.js" has type "HTML document ASCII text with CRLF line terminators"- [targetUID: N/A] "_E4AAB6EF-9DF8-11EE-8F4A-08002780A744_.dat" has type "Composite Document File V2 Document Cannot read section info"- [targetUID: N/A] "EEh1AYcUYds_1_.js" has type "ASCII text with very long lines"- [targetUID: N/A] "lFK_RCKM9IT_1_.js" has type "C source ASCII text with very long lines"- [targetUID: N/A] "browse_1_.css" has type "ASCII text with CRLF LF line terminators"- [targetUID: N/A] "header_logo_1_.png" has type "PNG image data 744 x 171 8-bit/color RGBA non-interlaced"- [targetUID: N/A] "cfM8cJotnFg_1_.js" has type "ASCII text with very long lines"- [targetUID: N/A] "ISUe9_7D94n_1_.js" has type "ASCII text with very long lines"- [targetUID: N/A] "sV8yd1HtEV3_1_.js" has type "C source ASCII text with very long lines"- [targetUID: N/A] "739F2FF4259CDC6CBE7B90F1A95601EF" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\739F2FF4259CDC6CBE7B90F1A95601EF]- [targetUID: 00000000-00001232] "Y0L6f5sxdIV_1_.png" has type "PNG image data 283 x 315 8-bit colormap non-interlaced"- [targetUID: N/A] "dqd6vCA9PNV_1_.js" has type "C source ASCII text with very long lines"- [targetUID: N/A] "_F5EC9C5E-9DF8-11EE-8F4A-08002780A744_.dat" has type "Composite Document File V2 Document Cannot read section info"- [targetUID: N/A] "RecoveryStore._E4AAB6ED-9DF8-11EE-8F4A-08002780A744_.dat" has type "Composite Document File V2 Document Cannot read section info"- [targetUID: N/A] "RecoveryStore._E5709A1B-9DF8-11EE-8F4A-08002780A744_.dat" has type "Composite Document File V2 Document Cannot read section info"- [targetUID: N/A] "RecoveryStore._E612BA03-9DF8-11EE-8F4A-08002780A744_.dat" has type "Composite Document File V2 Document Cannot read section info"- [targetUID: N/A] "RecoveryStore._E810F13F-9DF8-11EE-8F4A-08002780A744_.dat" has type "Composite Document File V2 Document Cannot read section info"- [targetUID: N/A] "_F5435568-9DF8-11EE-8F4A-08002780A744_.dat" has type "Composite Document File V2 Document Cannot read section info"- [targetUID: N/A] "57C8EDB95DF3F0AD4EE2DC2B8CFD4157" has type "Microsoft Cabinet archive data Windows 2000/XP setup 4770 bytes 1 file at 0x2c +A "disallowedcert.stl" number 1 1 datablock 0x1 compression"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\57C8EDB95DF3F0AD4EE2DC2B8CFD4157]- [targetUID: 00000000-00000540] "_BA2AB0CE-9DFC-11EE-8F4A-08002780A744_.dat" has type "Composite Document File V2 Document Cannot read section info"- [targetUID: N/A] "_F08A8D2A-9DF8-11EE-8F4A-08002780A744_.dat" has type "Composite Document File V2 Document Cannot read section info"- [targetUID: N/A] "_707F3CD6-9DF9-11EE-8F4A-08002780A744_.dat" has type "Composite Document File V2 Document Cannot read section info"- [targetUID: N/A] "_45F4DF7C-9DF9-11EE-8F4A-08002780A744_.dat" has type "Composite Document File V2 Document Cannot read section info"- [targetUID: N/A] "_F9579B64-9DF8-11EE-8F4A-08002780A744_.dat" has type "Composite Document File V2 Document Cannot read section info"- [targetUID: N/A] "_F5FFAF2E-9DF8-11EE-8F4A-08002780A744_.dat" has type "Composite Document File V2 Document Cannot read section info"- [targetUID: N/A] "cA_3fTtJxgp_1_.js" has type "ASCII text with very long lines"- [targetUID: N/A] "FzXL11-8Cqh_1_.css" has type "ASCII text with very long lines"- [targetUID: N/A] "hLRJ1GG_y0J_1_.ico" has type "MS Windows icon resource - 1 icon 32x32 32 bits/pixel"- [targetUID: N/A] "favicon_3_.ico" has type "MS Windows icon resource - 1 icon 32x32 32 bits/pixel"- [targetUID: N/A] "header_menu_hamburger_1_.png" has type "PNG image data 244 x 212 8-bit/color RGBA non-interlaced"- [targetUID: N/A] "zyRovCtoGSI_1_.js" has type "ASCII text with very long lines"- [targetUID: N/A] "logo_steam_footer_1_.png" has type "PNG image data 92 x 26 8-bit/color RGBA non-interlaced"- [targetUID: N/A] "wm4d5zAAo-a_1_.js" has type "ASCII text with very long lines"- [targetUID: N/A] "motiva_sans_1_.css" has type "ASCII text with CRLF line terminators"- [targetUID: N/A] "footerLogo_valve_new_1_.png" has type "PNG image data 176 x 50 8-bit/color RGBA non-interlaced"- [targetUID: N/A] "65xtw2y5evpkuq3vtf8wiydts_1_.js" has type "ASCII text with very long lines with no line terminators"- [targetUID: N/A] "skazhVdw245_1_.js" has type "ASCII text with very long lines"- [targetUID: N/A] "logo_valve_footer_1_.png" has type "PNG image data 92 x 26 8-bit/color RGBA non-interlaced"- [targetUID: N/A] "1FPNULrhhBJ_1_.css" has type "ASCII text with very long lines"- [targetUID: N/A] "EQ0cyse2DGv_1_.css" has type "ASCII text with very long lines"- [targetUID: N/A] "24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA]- [targetUID: 00000000-00000540] "ico_twitter_1_.png" has type "PNG image data 16 x 16 8-bit/color RGBA non-interlaced"- [targetUID: N/A] "QcYlxMWQTQ-_1_.js" has type "ASCII text with very long lines"- [targetUID: N/A] "ico_facebook_1_.png" has type "PNG image data 16 x 16 8-bit/color RGBA non-interlaced"- [targetUID: N/A] "3FPJ9YC_wUr_1_.js" has type "ASCII text with very long lines"- [targetUID: N/A] "GIlJjyzEguQ_1_.js" has type "C source ASCII text with very long lines"- [targetUID: N/A] "www.facebook_1_.xml" has type "ASCII text with very long lines with no line terminators"- [targetUID: N/A] "logo46x38_1_.png" has type "PNG image data 46 x 38 8-bit/color RGBA non-interlaced"- [targetUID: N/A] "AE583B12017CC3ACE1D659336529BFB3" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\AE583B12017CC3ACE1D659336529BFB3]- [targetUID: 00000000-00003748] "4748633DC5731827D4B432DBAC7A3ECE" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\4748633DC5731827D4B432DBAC7A3ECE]- [targetUID: 00000000-00000540] "BqEjD1dj1pL_1_.js" has type "ASCII text with very long lines"- [targetUID: N/A] "0270780F846F08BEFE0DD8112D932FEF" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\0270780F846F08BEFE0DD8112D932FEF]- [targetUID: 00000000-00003116] "CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA]- [targetUID: 00000000-00000540] "6B2043001D270792DFFD725518EAFE2C" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\6B2043001D270792DFFD725518EAFE2C]- [targetUID: 00000000-00002648] "4H697AIP.txt" has type "ASCII text"- Location: [%APPDATA%\Microsoft\Windows\Cookies\4H697AIP.txt]- [targetUID: 00000000-00000540] "M2ND1T0S.txt" has type "ASCII text"- Location: [%APPDATA%\Microsoft\Windows\Cookies\M2ND1T0S.txt]- [targetUID: 00000000-00003748] "EDC238BFF48A31D55A97E1E93892934B_C31B2498754E340573F1336DE607D619" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\EDC238BFF48A31D55A97E1E93892934B_C31B2498754E340573F1336DE607D619]- [targetUID: 00000000-00003116] "E2C6CBAF0AF08CF203BA74BF0D0AB6D5_49536AB5156BDD74EFF881D01C36A419" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_49536AB5156BDD74EFF881D01C36A419]- [targetUID: 00000000-00002404] "80237EE4964FC9C409AAF55BF996A292_D46D6FA25B74360E1349F9015B5CCE53" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\80237EE4964FC9C409AAF55BF996A292_D46D6FA25B74360E1349F9015B5CCE53]- [targetUID: 00000000-00002672] "E2C6CBAF0AF08CF203BA74BF0D0AB6D5_0FB9553B978E7F00C6B2309507DEB64A" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_0FB9553B978E7F00C6B2309507DEB64A]- [targetUID: 00000000-00002672] "80237EE4964FC9C409AAF55BF996A292_C5130A0BDC8C859A2757D77746C10868" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\80237EE4964FC9C409AAF55BF996A292_C5130A0BDC8C859A2757D77746C10868]- [targetUID: 00000000-00002672] "59D76868C250B3240414CE3EFBB12518_DB3354A21B46C492983D8DC6E09DCFAD" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\59D76868C250B3240414CE3EFBB12518_DB3354A21B46C492983D8DC6E09DCFAD]- [targetUID: 00000000-00002404] "F2DDCD2B5F37625B82E81F4976CEE400_BFB422D89E28A298A60024A8D8A2EA06" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\F2DDCD2B5F37625B82E81F4976CEE400_BFB422D89E28A298A60024A8D8A2EA06]- [targetUID: 00000000-00000540] "E573CDF4C6D731D56A665145182FD759_E391470CF0D37EE71D631C107209CEFF" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\E573CDF4C6D731D56A665145182FD759_E391470CF0D37EE71D631C107209CEFF]- [targetUID: 00000000-00003116] "7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776]- [targetUID: 00000000-00002404] "B398B80134F72209547439DB21AB308D_A4CF52CCA82D7458083F7280801A3A04" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\B398B80134F72209547439DB21AB308D_A4CF52CCA82D7458083F7280801A3A04]- [targetUID: 00000000-00003116] "35DDEDF268117918D1D277A171D8DF7B_EBDE77CB467169C3928F012A05185035" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\35DDEDF268117918D1D277A171D8DF7B_EBDE77CB467169C3928F012A05185035]- [targetUID: 00000000-00001232] "TJ764UUI.txt" has type "ASCII text"- Location: [%APPDATA%\Microsoft\Windows\Cookies\TJ764UUI.txt]- [targetUID: 00000000-00002672] "dXk5exdOVhk_1_.js" has type "ASCII text with very long lines"- [targetUID: N/A] "35DDEDF268117918D1D277A171D8DF7B_EBDE77CB467169C3928F012A05185035" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\MetaData\35DDEDF268117918D1D277A171D8DF7B_EBDE77CB467169C3928F012A05185035]- [targetUID: 00000000-00001232] "E2C6CBAF0AF08CF203BA74BF0D0AB6D5_0FB9553B978E7F00C6B2309507DEB64A" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_0FB9553B978E7F00C6B2309507DEB64A]- [targetUID: 00000000-00002672] "E2C6CBAF0AF08CF203BA74BF0D0AB6D5_49536AB5156BDD74EFF881D01C36A419" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_49536AB5156BDD74EFF881D01C36A419]- [targetUID: 00000000-00002404] "80237EE4964FC9C409AAF55BF996A292_D46D6FA25B74360E1349F9015B5CCE53" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\MetaData\80237EE4964FC9C409AAF55BF996A292_D46D6FA25B74360E1349F9015B5CCE53]- [targetUID: 00000000-00002672] "80237EE4964FC9C409AAF55BF996A292_C5130A0BDC8C859A2757D77746C10868" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\MetaData\80237EE4964FC9C409AAF55BF996A292_C5130A0BDC8C859A2757D77746C10868]- [targetUID: 00000000-00002672] "24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA]- [targetUID: 00000000-00000540] "F2DDCD2B5F37625B82E81F4976CEE400_BFB422D89E28A298A60024A8D8A2EA06" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\MetaData\F2DDCD2B5F37625B82E81F4976CEE400_BFB422D89E28A298A60024A8D8A2EA06]- [targetUID: 00000000-00000540] "59D76868C250B3240414CE3EFBB12518_DB3354A21B46C492983D8DC6E09DCFAD" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\MetaData\59D76868C250B3240414CE3EFBB12518_DB3354A21B46C492983D8DC6E09DCFAD]- [targetUID: 00000000-00002404] "7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776]- [targetUID: 00000000-00002404] "EAF8AA29A62AB29E614331747385D816_F9E4DC0B9D5C777357D7DB8DEF51118A" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\MetaData\EAF8AA29A62AB29E614331747385D816_F9E4DC0B9D5C777357D7DB8DEF51118A]- [targetUID: 00000000-00003748] "B398B80134F72209547439DB21AB308D_A4CF52CCA82D7458083F7280801A3A04" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\MetaData\B398B80134F72209547439DB21AB308D_A4CF52CCA82D7458083F7280801A3A04]- [targetUID: 00000000-00003116] "E573CDF4C6D731D56A665145182FD759_E391470CF0D37EE71D631C107209CEFF" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\MetaData\E573CDF4C6D731D56A665145182FD759_E391470CF0D37EE71D631C107209CEFF]- [targetUID: 00000000-00003116] "EDC238BFF48A31D55A97E1E93892934B_C31B2498754E340573F1336DE607D619" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\MetaData\EDC238BFF48A31D55A97E1E93892934B_C31B2498754E340573F1336DE607D619]- [targetUID: 00000000-00003116] "ZR9AE29K.txt" has type "ASCII text"- Location: [%APPDATA%\Microsoft\Windows\Cookies\ZR9AE29K.txt]- [targetUID: 00000000-00002404] "D22R24WJ.txt" has type "ASCII text"- Location: [%APPDATA%\Microsoft\Windows\Cookies\D22R24WJ.txt]- [targetUID: 00000000-00002404] "LRY3UMZG.txt" has type "ASCII text"- Location: [%APPDATA%\Microsoft\Windows\Cookies\LRY3UMZG.txt]- [targetUID: 00000000-00002404] "ZLOJCF6K.txt" has type "ASCII text"- Location: [%APPDATA%\Microsoft\Windows\Cookies\ZLOJCF6K.txt]- [targetUID: 00000000-00002404] "ZLPJH3RP.txt" has type "ASCII text"- Location: [%APPDATA%\Microsoft\Windows\Cookies\ZLPJH3RP.txt]- [targetUID: 00000000-00002404] "CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\MetaData\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA]- [targetUID: 00000000-00000540] "FN5VNH38.txt" has type "ASCII text"- Location: [%APPDATA%\Microsoft\Windows\Cookies\FN5VNH38.txt]- [targetUID: 00000000-00002404] "9D0C8XGA.txt" has type "ASCII text"- Location: [%APPDATA%\Microsoft\Windows\Cookies\9D0C8XGA.txt]- [targetUID: 00000000-00000540] "57C8EDB95DF3F0AD4EE2DC2B8CFD4157" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157]- [targetUID: 00000000-00000540] "77EC63BDA74BD0D0E0426DC8F8008506" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506]- [targetUID: 00000000-00002648] "EAF8AA29A62AB29E614331747385D816_F9E4DC0B9D5C777357D7DB8DEF51118A" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\EAF8AA29A62AB29E614331747385D816_F9E4DC0B9D5C777357D7DB8DEF51118A]- [targetUID: 00000000-00003748] "OVX5T6EU.txt" has type "ASCII text"- Location: [%APPDATA%\Microsoft\Windows\Cookies\OVX5T6EU.txt]- [targetUID: 00000000-00002332] "HM3F1BLY.txt" has type "ASCII text"- Location: [%APPDATA%\Microsoft\Windows\Cookies\HM3F1BLY.txt]- [targetUID: 00000000-00001232] "btn_header_installsteam_download_1_.png" has type "PNG image data 15 x 13 8-bit/color RGBA non-interlaced"- [targetUID: N/A] "W3Q3CSQY.txt" has type "ASCII text"- Location: [%APPDATA%\Microsoft\Windows\Cookies\W3Q3CSQY.txt]- [targetUID: 00000000-00000540] "2F1MM9GB.txt" has type "ASCII text"- [targetUID: N/A] "1E2DBD58769A756A24A9D033F9B07F3D" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\MetaData\1E2DBD58769A756A24A9D033F9B07F3D]- [targetUID: 00000000-00002404] "9DFE38F0CF4E54F251E86E53D05E8885" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\MetaData\9DFE38F0CF4E54F251E86E53D05E8885]- [targetUID: 00000000-00002404] "PtmfxLVwAb7_1_.js" has type "ASCII text"- [targetUID: N/A] "0270780F846F08BEFE0DD8112D932FEF" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\MetaData\0270780F846F08BEFE0DD8112D932FEF]- [targetUID: 00000000-00003116] "ZDM7TA9X.txt" has type "ASCII text"- Location: [%APPDATA%\Microsoft\Windows\Cookies\ZDM7TA9X.txt]- [targetUID: 00000000-00000540] "6B2043001D270792DFFD725518EAFE2C" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\MetaData\6B2043001D270792DFFD725518EAFE2C]- [targetUID: 00000000-00002648] "9D6B3FE9E6E4067193F477ABAD990106" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\MetaData\9D6B3FE9E6E4067193F477ABAD990106]- [targetUID: 00000000-00003748] "AE583B12017CC3ACE1D659336529BFB3" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\MetaData\AE583B12017CC3ACE1D659336529BFB3]- [targetUID: 00000000-00003748] "BEC6224B02D155A396218A2504F3EE0B" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\MetaData\BEC6224B02D155A396218A2504F3EE0B]- [targetUID: 00000000-00001232] "739F2FF4259CDC6CBE7B90F1A95601EF" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\MetaData\739F2FF4259CDC6CBE7B90F1A95601EF]- [targetUID: 00000000-00001232] "V7XEY7HC.txt" has type "ASCII text"- Location: [%APPDATA%\Microsoft\Windows\Cookies\V7XEY7HC.txt]- [targetUID: 00000000-00000540] "OC8M3S4P.txt" has type "ASCII text"- Location: [%APPDATA%\Microsoft\Windows\Cookies\OC8M3S4P.txt]- [targetUID: 00000000-00001232] "70DAE932E3BCB3C00656A27B544BA9CA" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\MetaData\70DAE932E3BCB3C00656A27B544BA9CA]- [targetUID: 00000000-00000540] "I5IR7TGT.txt" has type "ASCII text"- Location: [%APPDATA%\Microsoft\Windows\Cookies\I5IR7TGT.txt]- [targetUID: 00000000-00002332] "Q2SX58NF.txt" has type "ASCII text"- Location: [%APPDATA%\Microsoft\Windows\Cookies\Q2SX58NF.txt]- [targetUID: 00000000-00000540] "4748633DC5731827D4B432DBAC7A3ECE" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\MetaData\4748633DC5731827D4B432DBAC7A3ECE]- [targetUID: 00000000-00000540] "btn_arrow_down_padded_1_.png" has type "PNG image data 19 x 12 8-bit/color RGBA non-interlaced"- [targetUID: N/A] "ZMYU52FS.txt" has type "ASCII text"- Location: [%APPDATA%\Microsoft\Windows\Cookies\ZMYU52FS.txt]- [targetUID: 00000000-00002672] "D9Y30TW1.txt" has type "ASCII text"- Location: [%APPDATA%\Microsoft\Windows\Cookies\D9Y30TW1.txt]- [targetUID: 00000000-00001232] "2DI0ZNR7.txt" has type "ASCII text"- Location: [%APPDATA%\Microsoft\Windows\Cookies\2DI0ZNR7.txt]- [targetUID: 00000000-00000540] "3WF3KWKW.txt" has type "ASCII text"- Location: [%APPDATA%\Microsoft\Windows\Cookies\3WF3KWKW.txt]- [targetUID: 00000000-00002672] "ZQGPYIQ8.txt" has type "ASCII text"- Location: [%APPDATA%\Microsoft\Windows\Cookies\ZQGPYIQ8.txt]- [targetUID: 00000000-00002332] "L7940DB4.txt" has type "ASCII text"- Location: [%APPDATA%\Microsoft\Windows\Cookies\L7940DB4.txt]- [targetUID: 00000000-00003116] "18RSIP93.txt" has type "ASCII text"- Location: [%APPDATA%\Microsoft\Windows\Cookies\18RSIP93.txt]- [targetUID: 00000000-00002672] "O7nelmd9XSI_1_.png" has type "PNG image data 1 x 1 1-bit colormap non-interlaced"- [targetUID: N/A] "73C0EFZF.txt" has type "ASCII text"- Location: [%APPDATA%\Microsoft\Windows\Cookies\73C0EFZF.txt]- [targetUID: 00000000-00002672] "TarA328.tmp" has type "data"- Location: [%TEMP%\TarA328.tmp]- [targetUID: 00000000-00002672] "TarBC6D.tmp" has type "data"- Location: [%TEMP%\TarBC6D.tmp]- [targetUID: 00000000-00002648] "utag_1_.js" has type "UTF-8 Unicode text with very long lines"- [targetUID: N/A] "CabBC5C.tmp" has type "Microsoft Cabinet archive data Windows 2000/XP setup 66791 bytes 1 file at 0x2c +A "authroot.stl" number 1 6 datablocks 0x1 compression"- Location: [%TEMP%\CabBC5C.tmp]- [targetUID: 00000000-00002648] "77EC63BDA74BD0D0E0426DC8F8008506" has type "Microsoft Cabinet archive data Windows 2000/XP setup 66791 bytes 1 file at 0x2c +A "authroot.stl" number 1 6 datablocks 0x1 compression"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506]- [targetUID: 00000000-00002648] "CabA327.tmp" has type "Microsoft Cabinet archive data Windows 2000/XP setup 66791 bytes 1 file at 0x2c +A "authroot.stl" number 1 6 datablocks 0x1 compression"- Location: [%TEMP%\CabA327.tmp]- [targetUID: 00000000-00002672] "BEC6224B02D155A396218A2504F3EE0B" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\BEC6224B02D155A396218A2504F3EE0B]- [targetUID: 00000000-00001232] "favicon_6_.ico" has type "MS Windows icon resource - 1 icon 32x32 32 bits/pixel"- [targetUID: N/A] "search__0633EE93-D776-472f-A0FF-E1416B8B2E3A_.ico" has type "MS Windows icon resource - 1 icon 32x32 32 bits/pixel"- [targetUID: N/A] "favicon_2_.ico" has type "MS Windows icon resource - 1 icon 32x32 32 bits/pixel"- [targetUID: N/A] "favicon_4_.ico" has type "MS Windows icon resource - 1 icon 32x32 32 bits/pixel"- [targetUID: N/A] "9D6B3FE9E6E4067193F477ABAD990106" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\9D6B3FE9E6E4067193F477ABAD990106]- [targetUID: 00000000-00003748] "NFBHPCT2.txt" has type "ASCII text"- Location: [%APPDATA%\Microsoft\Windows\Cookies\NFBHPCT2.txt]- [targetUID: 00000000-00000540] "U18ECMZ3.txt" has type "ASCII text"- Location: [%APPDATA%\Microsoft\Windows\Cookies\U18ECMZ3.txt]- [targetUID: 00000000-00000540]47:T725,"TarBEFF.tmp" has type "data" - Location: [%TEMP%\TarBEFF.tmp] "CabBEDF.tmp" has type "Microsoft Cabinet archive data Windows 2000/XP setup 66791 bytes 1 file at 0x2c +A "authroot.stl" number 1 6 datablocks 0x1 compression" - Location: [%TEMP%\CabBEDF.tmp] "~DFDC7C1909BC1B63FD.TMP" has type "data" - Location: [%TEMP%\~DFDC7C1909BC1B63FD.TMP] "~DF1AD35DC0EBAD7284.TMP" has type "data" - Location: [%TEMP%\~DF1AD35DC0EBAD7284.TMP] "~DFB7E4CFA62980EB1B.TMP" has type "data" - Location: [%TEMP%\~DFB7E4CFA62980EB1B.TMP] "~DF433838858BD6F4C3.TMP" has type "data" "~DFB2CE4EB89128E4B7.TMP" has type "data" - Location: [%TEMP%\~DFB2CE4EB89128E4B7.TMP] "~DFC24A82FF304C4278.TMP" has type "data" - Location: [%TEMP%\~DFC24A82FF304C4278.TMP] "~DFB6BA0071B95FC524.TMP" has type "data" - Location: [%TEMP%\~DFB6BA0071B95FC524.TMP] "~DF05EF25E6219DB4D5.TMP" has type "data" - Location: [%TEMP%\~DF05EF25E6219DB4D5.TMP] "~DF1E28E1C680E28C0D.TMP" has type "data" "~DFCD3EF34FBC31EB7A.TMP" has type "data" - Location: [%TEMP%\~DFCD3EF34FBC31EB7A.TMP] "~DFFA97742A9B14C885.TMP" has type "data" - Location: [%TEMP%\~DFFA97742A9B14C885.TMP] "~DFF7BC9132B62AD9F8.TMP" has type "data" - Location: [%TEMP%\~DFF7BC9132B62AD9F8.TMP] "~DFB009EBE6E6EC7D2A.TMP" has type "data" - Location: [%TEMP%\~DFB009EBE6E6EC7D2A.TMP] "TarA328.tmp" has type "data" - Location: [%TEMP%\TarA328.tmp] "TarBC6D.tmp" has type "data" - Location: [%TEMP%\TarBC6D.tmp] "CabBC5C.tmp" has type "Microsoft Cabinet archive data Windows 2000/XP setup 66791 bytes 1 file at 0x2c +A "authroot.stl" number 1 6 datablocks 0x1 compression" - Location: [%TEMP%\CabBC5C.tmp] "CabA327.tmp" has type "Microsoft Cabinet archive data Windows 2000/XP setup 66791 bytes 1 file at 0x2c +A "authroot.stl" number 1 6 datablocks 0x1 compression" - Location: [%TEMP%\CabA327.tmp]48:T7dc,"wextract.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\SIDEBYSIDE"; Key: ""; Value: "") "wextract.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: ""; Value: "") "wextract.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SAFEBOOT\OPTION"; Key: ""; Value: "") "wextract.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SRP\GP\DLL"; Key: ""; Value: "") "wextract.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "wextract.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "wextract.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\SIDEBYSIDE\ASSEMBLYSTORAGEROOTS"; Key: ""; Value: "") "wextract.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS"; Key: ""; Value: "") "wextract.exe" (Access type: "OPEN"; Path: "HKCU\CONTROL PANEL\DESKTOP\MUICACHED\MACHINELANGUAGECONFIGURATION"; Key: ""; Value: "") "wextract.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\MUI\SETTINGS"; Key: ""; Value: "") "wextract.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\CONTROL PANEL\DESKTOP"; Key: ""; Value: "") "wextract.exe" (Access type: "OPEN"; Path: "HKCU\CONTROL PANEL\DESKTOP\LANGUAGECONFIGURATION"; Key: ""; Value: "") "wextract.exe" (Access type: "OPEN"; Path: "HKCU\CONTROL PANEL\DESKTOP"; Key: ""; Value: "") "wextract.exe" (Access type: "OPEN"; Path: "HKCU\CONTROL PANEL\DESKTOP\MUICACHED"; Key: ""; Value: "") "wextract.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: ""; Value: "") "wextract.exe" (Access type: "OPEN"; Path: "HKLM"; Key: ""; Value: "") "wextract.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\DIAGNOSTICS"; Key: ""; Value: "")49:Tb56,"wextract.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\SIDEBYSIDE"; Key: "PREFEREXTERNALMANIFEST"; Value: "") "wextract.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "CWDILLEGALINDLLSEARCH"; Value: "") "wextract.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED"; Value: "") "wextract.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS"; Key: "SHOWDEBUGINFO"; Value: "") "wextract.exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP"; Key: "PREFERREDUILANGUAGES"; Value: "") "wextract.exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP\MUICACHED"; Key: "MACHINEPREFERREDUILANGUAGES"; Value: "") "wextract.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: "COMPATDLL"; Value: "") "wextract.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: "00060101.00060101"; Value: "") "wextract.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: ""; Value: "") "wextract.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "SAFEDLLSEARCHMODE"; Value: "") "wextract.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\GRE_INITIALIZE"; Key: "DISABLEMETAFILES"; Value: "") "wextract.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\COMPATIBILITY32"; Key: "WEXTRACT"; Value: "") "wextract.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINDOWS"; Key: "LOADAPPINIT_DLLS"; Value: "") "wextract.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE"; Key: "PAGEALLOCATORUSESYSTEMHEAP"; Value: "") "wextract.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE"; Key: "PAGEALLOCATORSYSTEMHEAPISPRIVATE"; Value: "") "wextract.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\WINDOWS ERROR REPORTING\WMR"; Key: "DISABLE"; Value: "") "wextract.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\SETUP"; Key: "SOURCEPATH"; Value: "") "wextract.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION"; Key: "DEVICEPATH"; Value: "") "wextract.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US"; Value: "") "wextract.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US"; Value: "") "wextract.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\DATACOLLECTION"; Key: "COMMERCIALDATAOPTIN"; Value: "")4a:T698,"wextract.exe" trying to touch file "C:\Windows\SYSTEM32\sechost.dll" "wextract.exe" trying to touch file "C:\wextract.exe.Local\" "wextract.exe" trying to touch file "C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18837_none_41e855142bd5705d" "wextract.exe" trying to touch file "C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18837_none_41e855142bd5705d\COMCTL32.dll" "wextract.exe" trying to touch file "C:\Cabinet.dll" "wextract.exe" trying to touch file "C:\Windows\system32\Cabinet.dll" "wextract.exe" trying to touch file "C:\VERSION.dll" "wextract.exe" trying to touch file "C:\Windows\system32\VERSION.dll" "wextract.exe" trying to touch file "C:\Windows\system32\apphelp.dll" "wextract.exe" trying to touch file "C:\Windows\AppPatch\sysmain.sdb" "wextract.exe" trying to touch file "C:\Windows\AppPatch\AcLayers.DLL" "wextract.exe" trying to touch file "C:\SspiCli.dll" "wextract.exe" trying to touch file "C:\Windows\system32\SspiCli.dll" "wextract.exe" trying to touch file "C:\WINSPOOL.DRV" "wextract.exe" trying to touch file "C:\Windows\system32\WINSPOOL.DRV" "wextract.exe" trying to touch file "C:\MPR.dll" "wextract.exe" trying to touch file "C:\Windows\system32\MPR.dll" "wextract.exe" trying to touch file "C:\Windows\AppPatch\AcGenral.DLL" "wextract.exe" trying to touch file "C:\samcli.dll" "wextract.exe" trying to touch file "C:\Windows\system32\samcli.dll" "wextract.exe" trying to touch file "C:\wextract.exe.Config" "wextract.exe" trying to touch file "C:\Windows\system32\IMM32.DLL" "wextract.exe" trying to touch file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP"4b:T6ab,"wextract.exe" trying to access non-existent file "C:\Cabinet.dll" "wextract.exe" trying to access non-existent file "C:\VERSION.dll" "wextract.exe" trying to access non-existent file "C:\SspiCli.dll" "wextract.exe" trying to access non-existent file "C:\MPR.dll" "wextract.exe" trying to access non-existent file "C:\samcli.dll" "wextract.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP\cZ5oz01.exe" "wextract.exe" trying to access non-existent file "C:\FLTLIB.DLL" "wextract.exe" trying to access non-existent file "C:\Windows\system32\api-ms-win-core-fibers-l1-1-1.DLL" "wextract.exe" trying to access non-existent file "C:\Windows\system32\api-ms-win-core-localization-l1-2-1.DLL" "wextract.exe" trying to access non-existent file "C:\UxTheme.dll" "wextract.exe" trying to access non-existent file "C:\WINMM.dll" "wextract.exe" trying to access non-existent file "C:\MSACM32.dll" "wextract.exe" trying to access non-existent file "C:\sfc.dll" "wextract.exe" trying to access non-existent file "C:\sfc_os.DLL" "wextract.exe" trying to access non-existent file "C:\dwmapi.dll" "wextract.exe" trying to access non-existent file "\Device\HarddiskVolume2\CABINET.DLL" "wextract.exe" trying to access non-existent file "\Device\HarddiskVolume2\VERSION.DLL" "wextract.exe" trying to access non-existent file "\Device\HarddiskVolume2\SSPICLI.DLL" "wextract.exe" trying to access non-existent file "\Device\HarddiskVolume2\MPR.DLL" "wextract.exe" trying to access non-existent file "\Device\HarddiskVolume2\SAMCLI.DLL" "wextract.exe" trying to access non-existent file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP\CZ5OZ01.EXE"4c:T8c4,"wextract.exe" trying to access non-existent file "C:\wextract.exe.Local\" "wextract.exe" trying to access non-existent file "C:\WINSPOOL.DRV" "wextract.exe" trying to access non-existent file "C:\wextract.exe.Config" "wextract.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP" "wextract.exe" trying to access non-existent file "\Device\HarddiskVolume2\WEXTRACT.EXE.LOCAL" "wextract.exe" trying to access non-existent file "\Device\HarddiskVolume2\WINSPOOL.DRV" "wextract.exe" trying to access non-existent file "\Device\HarddiskVolume2\WEXTRACT.EXE.CONFIG" "wextract.exe" trying to access non-existent file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP" "cZ5oz01.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP\cZ5oz01.exe.Local\" "cZ5oz01.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP\cZ5oz01.exe.Config" "cZ5oz01.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP\WINSPOOL.DRV" "cZ5oz01.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP001.TMP" "cZ5oz01.exe" trying to access non-existent file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP\CZ5OZ01.EXE.LOCAL" "cZ5oz01.exe" trying to access non-existent file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP\CZ5OZ01.EXE.CONFIG" "cZ5oz01.exe" trying to access non-existent file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP\WINSPOOL.DRV" "cZ5oz01.exe" trying to access non-existent file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\IXP001.TMP" "ZP6rv89.exe" trying to access non-existent file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\IXP001.TMP\ZP6RV89.EXE.LOCAL" "ZP6rv89.exe" trying to access non-existent file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\IXP001.TMP\WINSPOOL.DRV" "ZP6rv89.exe" trying to access non-existent file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\IXP001.TMP\ZP6RV89.EXE.CONFIG" "ZP6rv89.exe" trying to access non-existent file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\IXP002.TMP"4d:T709,"2cV9250.exe" called "WinHttpSendRequest" with parameters {"hRequest": "35c710" "lpszHeaders": "Content-Type: application/x-www-form-urlencoded" "dwHeadersLength": "4294967295" "lpOptional": "act=life" "dwOptionalLength": "8" "dwTotalLength": "8" "dwContext": "0"} "2cV9250.exe" called "WinHttpSendRequest" with parameters {"hRequest": "1c44de0" "lpszHeaders": "Content-Type: application/x-www-form-urlencoded" "dwHeadersLength": "4294967295" "lpOptional": "act=recive_message&lid=LGNDRY&j=default&ver=4.0" "dwOptionalLength": "47" "dwTotalLength": "47" "dwContext": "0"} "2cV9250.exe" called "WinHttpSendRequest" with parameters {"hRequest": "1c4e5b8" "dwHeadersLength": "0" "dwOptionalLength": "0" "dwTotalLength": "500" "dwContext": "0"} "2cV9250.exe" called "WinHttpSendRequest" with parameters {"hRequest": "1c4f1d0" "dwHeadersLength": "0" "dwOptionalLength": "0" "dwTotalLength": "500" "dwContext": "0"} "2cV9250.exe" called "WinHttpSendRequest" with parameters {"hRequest": "1c49708" "dwHeadersLength": "0" "dwOptionalLength": "0" "dwTotalLength": "500" "dwContext": "0"} "2cV9250.exe" called "WinHttpSendRequest" with parameters {"hRequest": "1c67c18" "dwHeadersLength": "0" "dwOptionalLength": "0" "dwTotalLength": "500" "dwContext": "0"} "2cV9250.exe" called "WinHttpSendRequest" with parameters {"hRequest": "1c497c8" "dwHeadersLength": "0" "dwOptionalLength": "0" "dwTotalLength": "500" "dwContext": "0"} "2cV9250.exe" called "WinHttpSendRequest" with parameters {"hRequest": "1c44640" "dwHeadersLength": "0" "dwOptionalLength": "0" "dwTotalLength": "500" "dwContext": "0"} "2cV9250.exe" called "WinHttpSendRequest" with parameters {"hRequest": "368bd8" "dwHeadersLength": "0" "dwOptionalLength": "0" "dwTotalLength": "500" "dwContext": "0"}4e:T2324,Found requests in header "GET /i/flow/login HTTP/1.1Accept: text/html, application/xhtml+xml, */*User-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateDNT: 1Host: twitter.comConnection: Keep-AliveAccept-Language: en-US"; in File: "SSL") Found requests in header "GET /i/flow/login HTTP/1.1Accept: text/html, application/xhtml+xml, */*Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: twitter.comDNT: 1Connection: Keep-Alive"; in File: "SSL") Found requests in header "GET /sc/h/1jvrml64dlmt60uoawzo2af88 HTTP/1.1Accept: application/javascript, */*;q=0.8Referer: https://www.linkedin.com/loginAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: static.licdn.comDNT: 1Connection: Keep-Alive"; in File: "SSL") Found requests in header "GET /sc/h/9hjywk3zr0hyiyvhto6gc39eu HTTP/1.1Accept: application/javascript, */*;q=0.8Referer: https://www.linkedin.com/loginAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: static.licdn.comDNT: 1Connection: Keep-Alive"; in File: "SSL") Found requests in header "GET /sc/h/642e1qh28prue1yv3o1kqf3z9 HTTP/1.1Accept: text/css, */*Referer: https://www.linkedin.com/loginAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: static.licdn.comDNT: 1Connection: Keep-Alive"; in File: "SSL") Found requests in header "GET /sc/h/a0ux9o0kp9f6cs9ljq6oqxayk HTTP/1.1Accept: application/javascript, */*;q=0.8Referer: https://www.linkedin.com/loginAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: static.licdn.comDNT: 1Connection: Keep-Alive"; in File: "SSL") Found requests in header "GET /sc/h/780clfwo95q05e51lsjnfgmg4 HTTP/1.1Accept: application/javascript, */*;q=0.8Referer: https://www.linkedin.com/loginAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: static.licdn.comDNT: 1Connection: Keep-Alive"; in File: "SSL") Found requests in header "GET /sc/h/727ucpfhmn0jolb3t2h3o5dkj HTTP/1.1Accept: application/javascript, */*;q=0.8Referer: https://www.linkedin.com/loginAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: static.licdn.comDNT: 1Connection: Keep-Alive"; in File: "SSL") Found requests in header "GET /sc/h/65xtw2y5evpkuq3vtf8wiydts HTTP/1.1Accept: application/javascript, */*;q=0.8Referer: https://www.linkedin.com/loginAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: static.licdn.comDNT: 1Connection: Keep-Alive"; in File: "SSL") Found requests in header "GET /sc/h/3m4lyvbs6efg8pyhv7kupo6dh HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoHost: static.licdn.comDNT: 1Connection: Keep-Alive"; in File: "SSL") Found requests in header "GET /login HTTP/1.1Accept: text/html, application/xhtml+xml, */*Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: store.steampowered.comDNT: 1Connection: Keep-Alive"; in File: "SSL") Found requests in header "GET /login HTTP/1.1Accept: text/html, application/xhtml+xml, */*User-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateDNT: 1Host: www.facebook.comConnection: Keep-AliveAccept-Language: en-US"; in File: "SSL") Found requests in header "GET /security/hsts-pixel.gif?c=3.2.5 HTTP/1.1Accept: image/png, image/svg+xml, image/*;q=0.8, */*;q=0.5Referer: https://www.facebook.com/loginAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: facebook.comDNT: 1Connection: Keep-AliveCookie: fr=0jvJ8aOtTxyh8XW1I..BlgNzR.Ha.AAA.0.0.BlgNzR.AWWxLcv48CA; sb=0dyAZQwkypDDj7FPwQhVUu9z"; in File: "SSL") Found requests in header "GET /security/hsts-pixel.gif?c=2.5 HTTP/1.1Accept: image/png, image/svg+xml, image/*;q=0.8, */*;q=0.5Referer: https://www.facebook.com/loginAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateDNT: 1Connection: Keep-AliveHost: fbcdn.net"; in File: "SSL") Found requests in header "GET /errors/logo46x38.png HTTP/1.1Accept: image/png, image/svg+xml, image/*;q=0.8, */*;q=0.5Referer: https://twitter.com/i/flow/loginAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: abs.twimg.comDNT: 1Connection: Keep-Alive"; in File: "SSL") Found requests in header "GET /litms/utag/checkpoint-frontend/utag.js?cb=1702940400000 HTTP/1.1Accept: application/javascript, */*;q=0.8Referer: https://www.linkedin.com/loginAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: platform.linkedin.comDNT: 1Connection: Keep-AliveCookie: bcookie="v=2&3b1d6816-b66c-47d4-8d7a-6df618b7c0e4"; lidc="b=OGST08:s=O:r=O:a=O:p=O:g=2719:u=1:x=1:i=1702943912:t=1703030312:v=2:sig=AQGotSHFp4kMdVFUChf8hdFwa_WiIsUJ"; lang=v=2&lang=en-us"; in File: "SSL") Found requests in header "GET /litms/utag/checkpoint-frontend/utag.js?cb=1702941900000 HTTP/1.1Accept: application/javascript, */*;q=0.8Referer: https://www.linkedin.com/checkpoint/lg/login-submitAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: platform.linkedin.comDNT: 1Connection: Keep-AliveCookie: bcookie="v=2&3b1d6816-b66c-47d4-8d7a-6df618b7c0e4"; lidc="b=OGST08:s=O:r=O:a=O:p=O:g=2719:u=1:x=1:i=1702943912:t=1703030312:v=2:sig=AQGotSHFp4kMdVFUChf8hdFwa_WiIsUJ"; lang=v=2&lang=en-us"; in File: "SSL") Found requests in header "GET /rsrc.php/v3/yc/l/0,cross/1FPNULrhhBJ.css?_nc_x=Ij3Wp8lg5Kz HTTP/1.1Accept: text/css, */*Referer: https://www.facebook.com/loginAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: static.xx.fbcdn.netDNT: 1Connection: Keep-Alive"; in File: "SSL") Found requests in header "GET /rsrc.php/v3/yP/r/DskFNeBDZrG.js?_nc_x=Ij3Wp8lg5Kz HTTP/1.1Accept: application/javascript, */*;q=0.8Referer: https://www.facebook.com/loginAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: static.xx.fbcdn.netDNT: 1Connection: Keep-Alive"; in File: "SSL") Found requests in header "GET /rsrc.php/v3/yR/l/0,cross/8W3qU45QLlE.css?_nc_x=Ij3Wp8lg5Kz HTTP/1.1Accept: text/css, */*Referer: https://www.facebook.com/loginAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: static.xx.fbcdn.netDNT: 1Connection: Keep-Alive"; in File: "SSL") Found requests in header "GET /rsrc.php/y1/r/4lCu2zih0ca.svg HTTP/1.1Accept: image/png, image/svg+xml, image/*;q=0.8, */*;q=0.5Referer: https://www.facebook.com/loginAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: static.xx.fbcdn.netDNT: 1Connection: Keep-Alive"; in File: "SSL") Found requests in header "GET /rsrc.php/v3/yJ/l/0,cross/FzXL11-8Cqh.css?_nc_x=Ij3Wp8lg5Kz HTTP/1.1Accept: text/css, */*Referer: https://www.facebook.com/loginAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: static.xx.fbcdn.netDNT: 1Connection: Keep-Alive"; in File: "SSL") Found requests in header "GET /rsrc.php/v3/ya/l/0,cross/EQ0cyse2DGv.css?_nc_x=Ij3Wp8lg5Kz HTTP/1.1Accept: text/css, */*Referer: https://www.facebook.com/loginAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: static.xx.fbcdn.netDNT: 1Connection: Keep-Alive"; in File: "SSL") Found requests in header "GET /security/hsts-pixel.gif HTTP/1.1Accept: image/png, image/svg+xml, image/*;q=0.8, */*;q=0.5Referer: https://www.facebook.com/loginAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateDNT: 1Host: connect.facebook.netConnection: Keep-Alive"; in File: "SSL") Found requests in header "GET /rsrc.php/v3/yx/r/GIlJjyzEguQ.js?_nc_x=Ij3Wp8lg5Kz HTTP/1.1Accept: application/javascript, */*;q=0.8Referer: https://www.facebook.com/loginAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: static.xx.fbcdn.netDNT: 1Connection: Keep-Alive"; in File: "SSL")4f:T8c5,Found reference to API "WSARecv" (Indicator: "WSARecv"; Source: "00000000-00001912-00000C26-44543067") Found reference to API "WSASend" (Indicator: "WSASend"; Source: "00000000-00001912-00000C26-44544496") Found reference to API "WinHttpConnect" (Indicator: "WinHttpConnect"; Source: "00000000-00001912.00000000.68222.00400000.00000040.mdmp, 00000000-00001912.00000001.70142.00400000.00000040.mdmp, 00000000-00001912.00000002.72061.00160000.00000040.mdmp") Found reference to API "WinHttpOpen" (Indicator: "WinHttpOpen"; Source: "00000000-00001912.00000000.68222.00400000.00000040.mdmp, 00000000-00001912.00000001.70142.00400000.00000040.mdmp, 00000000-00001912.00000002.72061.00160000.00000040.mdmp") Found reference to API "WinHttpOpenRequest" (Indicator: "HttpOpenRequest"; Source: "00000000-00001912.00000000.68222.00400000.00000040.mdmp, 00000000-00001912.00000001.70142.00400000.00000040.mdmp, 00000000-00001912.00000002.72061.00160000.00000040.mdmp") Found reference to API "WinHttpOpenRequest" (Indicator: "WinHttpOpen"; Source: "00000000-00001912.00000000.68222.00400000.00000040.mdmp, 00000000-00001912.00000001.70142.00400000.00000040.mdmp, 00000000-00001912.00000002.72061.00160000.00000040.mdmp") Found reference to API "WinHttpOpenRequest" (Indicator: "WinHttpOpenRequest"; Source: "00000000-00001912.00000000.68222.00400000.00000040.mdmp, 00000000-00001912.00000001.70142.00400000.00000040.mdmp, 00000000-00001912.00000002.72061.00160000.00000040.mdmp") Found reference to API "WinHttpReadData" (Indicator: "WinHttpReadData"; Source: "00000000-00001912.00000000.68222.00400000.00000040.mdmp, 00000000-00001912.00000001.70142.00400000.00000040.mdmp, 00000000-00001912.00000002.72061.00160000.00000040.mdmp") Found reference to API "WinHttpSendRequest" (Indicator: "HttpSendRequest"; Source: "00000000-00001912.00000000.68222.00400000.00000040.mdmp, 00000000-00001912.00000001.70142.00400000.00000040.mdmp, 00000000-00001912.00000002.72061.00160000.00000040.mdmp") Found reference to API "WinHttpSendRequest" (Indicator: "WinHttpSendRequest"; Source: "00000000-00001912.00000000.68222.00400000.00000040.mdmp, 00000000-00001912.00000001.70142.00400000.00000040.mdmp, 00000000-00001912.00000002.72061.00160000.00000040.mdmp")50:T1378,Found string "POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=be85de5ipdocierre1Cookie: __cf_mw_byp=14QNW8Ja7sqHF79WoUD1smeKYX205dU1M2j6gN2sxUI-1702943900-0-/apiUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 500Host: soupinterestoe.fun--be85de5ipdocierre1Content-Disposition: form-data; name="hwid"l2445fea7200004b54eacd289166b7u--be85de5ipdocierre1Content-Disposition: form-data; name="pid"1--be85de5ipdocierre1Content-Disposition: form-data; name="lid"LGNDRY--be85de5ipdocierre1Content-Disposition: form-data; name="act"send_message--be85de5ipdocierre1Content-Disposition: form-data; name="file"; filename="file"Content-Type: attachment/x-objectPK"; File: "PCAP") Found string "POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=be85de5ipdocierre1Cookie: __cf_mw_byp=14QNW8Ja7sqHF79WoUD1smeKYX205dU1M2j6gN2sxUI-1702943900-0-/apiUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 500Host: soupinterestoe.fun--be85de5ipdocierre1Content-Disposition: form-data; name="hwid"l2445fea7200004b54eacd289166b7u--be85de5ipdocierre1Content-Disposition: form-data; name="pid"2--be85de5ipdocierre1Content-Disposition: form-data; name="lid"LGNDRY--be85de5ipdocierre1Content-Disposition: form-data; name="act"send_message--be85de5ipdocierre1Content-Disposition: form-data; name="file"; filename="file"Content-Type: attachment/x-objectPK"; File: "PCAP") Found string "POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=be85de5ipdocierre1Cookie: __cf_mw_byp=14QNW8Ja7sqHF79WoUD1smeKYX205dU1M2j6gN2sxUI-1702943900-0-/apiUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 500Host: soupinterestoe.fun--be85de5ipdocierre1Content-Disposition: form-data; name="hwid"l2445fea7200004b54eacd289166b7u--be85de5ipdocierre1Content-Disposition: form-data; name="pid"3--be85de5ipdocierre1Content-Disposition: form-data; name="lid"LGNDRY--be85de5ipdocierre1Content-Disposition: form-data; name="act"send_message--be85de5ipdocierre1Content-Disposition: form-data; name="file"; filename="file"Content-Type: attachment/x-objectPK"; File: "PCAP") Found string "Content-Disposition: form-data; name=""; File: "00000000-00001912.00000000.68222.00400000.00000040.mdmp"), Found string "Content-Type: multipart/form-data; boundary=%s"; Source: "00000000-00001912.00000000.68222.00400000.00000040.mdmp 00000000-00001912.00000001.70142.00400000.00000040.mdmp 00000000-00001912.00000002.72061.00160000.00000040.mdmp"), Found string "Content-Disposition: form-data; name=""; Source: "00000000-00001912.00000000.68222.00400000.00000040.mdmp, 00000000-00001912.00000001.70142.00400000.00000040.mdmp, 00000000-00001912.00000002.72061.00160000.00000040.mdmp") Found string "Content-Disposition: form-data; name="hwid""; Source: "00000000-00001912.00000000.68222.01C40000.00000004.mdmp, 00000000-00001912.00000001.70142.0033E000.00000004.mdmp, 00000000-00001912.00000001.70142.01C40000.00000004.mdmp, 00000000-00001912.00000002.72061.0033E000.00000004.mdmp, 00000000-00001912.00000002.72061.01C40000.00000004.mdmp") Found string "Content-Disposition: form-data; name="pid""; Source: "00000000-00001912.00000000.68222.01C40000.00000004.mdmp, 00000000-00001912.00000001.70142.0033E000.00000004.mdmp, 00000000-00001912.00000001.70142.01C40000.00000004.mdmp, 00000000-00001912.00000002.72061.0033E000.00000004.mdmp, 00000000-00001912.00000002.72061.01C40000.00000004.mdmp") Found string "Content-Disposition: form-data; name="lid""; Source: "00000000-00001912.00000000.68222.01C40000.00000004.mdmp, 00000000-00001912.00000001.70142.0033E000.00000004.mdmp, 00000000-00001912.00000001.70142.01C40000.00000004.mdmp, 00000000-00001912.00000002.72061.0033E000.00000004.mdmp, 00000000-00001912.00000002.72061.01C40000.00000004.mdmp") Found string "Content-Disposition: form-data; name="act""; Source: "00000000-00001912.00000000.68222.01C40000.00000004.mdmp, 00000000-00001912.00000001.70142.0033E000.00000004.mdmp, 00000000-00001912.00000001.70142.01C40000.00000004.mdmp, 00000000-00001912.00000002.72061.0033E000.00000004.mdmp, 00000000-00001912.00000002.72061.01C40000.00000004.mdmp") Found string "Content-Disposition: form-data; name="file"; filename="file""; Source: "00000000-00001912.00000000.68222.01C40000.00000004.mdmp, 00000000-00001912.00000001.70142.0033E000.00000004.mdmp, 00000000-00001912.00000001.70142.01C40000.00000004.mdmp, 00000000-00001912.00000002.72061.0033E000.00000004.mdmp, 00000000-00001912.00000002.72061.01C40000.00000004.mdmp") Found string "Content-Type: multipart/form-data; boundary=be85de5ipdocierre1"; Source: "00000000-00001912.00000001.70142.01C40000.00000004.mdmp, 00000000-00001912.00000002.72061.01C40000.00000004.mdmp")51:Tb23,Found reference to API "WinHttpAddRequestHeaders" (Indicator: "WinHttpAddRequestHeaders"; Source: "00000000-00001912.00000000.68222.00400000.00000040.mdmp, 00000000-00001912.00000001.70142.00400000.00000040.mdmp, 00000000-00001912.00000002.72061.00160000.00000040.mdmp") Found reference to API "WinHttpCloseHandle" (Indicator: "WinHttpCloseHandle"; Source: "00000000-00001912.00000000.68222.00400000.00000040.mdmp, 00000000-00001912.00000001.70142.00400000.00000040.mdmp, 00000000-00001912.00000002.72061.00160000.00000040.mdmp") Found reference to API "WinHttpConnect" (Indicator: "WinHttpConnect"; Source: "00000000-00001912.00000000.68222.00400000.00000040.mdmp, 00000000-00001912.00000001.70142.00400000.00000040.mdmp, 00000000-00001912.00000002.72061.00160000.00000040.mdmp") Found reference to API "WinHttpCrackUrl" (Indicator: "WinHttpCrackUrl"; Source: "00000000-00001912.00000000.68222.00400000.00000040.mdmp, 00000000-00001912.00000001.70142.00400000.00000040.mdmp, 00000000-00001912.00000002.72061.00160000.00000040.mdmp") Found reference to API "WinHttpOpen" (Indicator: "WinHttpOpen"; Source: "00000000-00001912.00000000.68222.00400000.00000040.mdmp, 00000000-00001912.00000001.70142.00400000.00000040.mdmp, 00000000-00001912.00000002.72061.00160000.00000040.mdmp") Found reference to API "WinHttpOpenRequest" (Indicator: "WinHttpOpen"; Source: "00000000-00001912.00000000.68222.00400000.00000040.mdmp, 00000000-00001912.00000001.70142.00400000.00000040.mdmp, 00000000-00001912.00000002.72061.00160000.00000040.mdmp") Found reference to API "WinHttpOpenRequest" (Indicator: "WinHttpOpenRequest"; Source: "00000000-00001912.00000000.68222.00400000.00000040.mdmp, 00000000-00001912.00000001.70142.00400000.00000040.mdmp, 00000000-00001912.00000002.72061.00160000.00000040.mdmp") Found reference to API "WinHttpQueryDataAvailable" (Indicator: "WinHttpQueryDataAvailable"; Source: "00000000-00001912.00000000.68222.00400000.00000040.mdmp, 00000000-00001912.00000001.70142.00400000.00000040.mdmp, 00000000-00001912.00000002.72061.00160000.00000040.mdmp") Found reference to API "WinHttpReadData" (Indicator: "WinHttpReadData"; Source: "00000000-00001912.00000000.68222.00400000.00000040.mdmp, 00000000-00001912.00000001.70142.00400000.00000040.mdmp, 00000000-00001912.00000002.72061.00160000.00000040.mdmp") Found reference to API "WinHttpReceiveResponse" (Indicator: "WinHttpReceiveResponse"; Source: "00000000-00001912.00000000.68222.00400000.00000040.mdmp, 00000000-00001912.00000001.70142.00400000.00000040.mdmp, 00000000-00001912.00000002.72061.00160000.00000040.mdmp") Found reference to API "WinHttpSendRequest" (Indicator: "WinHttpSendRequest"; Source: "00000000-00001912.00000000.68222.00400000.00000040.mdmp, 00000000-00001912.00000001.70142.00400000.00000040.mdmp, 00000000-00001912.00000002.72061.00160000.00000040.mdmp")52:T48e1,Pattern match: "https://store.steampowered.com/login" Pattern match: "https://www.facebook.com/login" Pattern match: "https://accounts.google.com/" Pattern match: "https://twitter.com/i/flow/login" Heuristic match: "Lr>qK.AG" Heuristic match: "9].Mh" Heuristic match: "?-.sE" Heuristic match: "Qh.nF" Heuristic match: "GfB.lT" Pattern match: "http://www.w3.org/Graphics/SVG/1.1/DTD/svg11.dtd" Pattern match: "http://www.w3.org/2000/svg" Pattern match: "crl.microsoft.com/pki/crl/products/MicCerLisCA2011_2011-03-29.crl0]Q0O0MAhttp://www.microsoft.com/pki/certs/MicCerLisCA2011_2011-03-29.crt0J!P-f+;z{]6mWXIY8Washington1Redmond1Microsoft" Pattern match: "U.HzsR/^pTjT0+" Pattern match: "I.HTQE/L+#&'73267#&&5466367&&#O" Pattern match: "https://www.facebook.com/legal/license/aJoeSHn7XcN/__d" Pattern match: "https://store.akamai.steamstatic.com/public/shared/css/motiva_sans.css?v=Rc2hpzg2Ex3T&l=english" Pattern match: "https://www.facebook.com/legal/license/WRsJ32R7YJG/__d" Pattern match: "http://store.steampowered.com/subscriber_agreement/" Pattern match: "rsrc.php/v3/yB/r/TwAHgQi2ZPB.png" Pattern match: "https://store.akamai.steamstatic.com/public/shared/images/login/emailauth_icons2.png" Pattern match: "http://crls.pki.goog/gts1c3/moVDfISia2k.crlx-" Pattern match: "www.bing.com" Pattern match: "http://crl3.digicert.com/sha2-ha-server-g6.crl.http://crl4.digicert.com/sha2-ha-server-g6.crl0XyJL2" Pattern match: "rsrc.php/v3/yL/r/unHwF9CkMyM.png" Pattern match: "http://www.w3.org/1999/02/22-rdf-syntax-ns#" Pattern match: "http://www.youworkforthem.com/product.php?sku=T2982" Pattern match: "NOFORMmicrosoft.com/102433237894403108561027971357230938743SRCHUIDV=2&GUID=426377958C8445E3B4EA69482BD0E747&dmnchg=1microsoft.com/102433237894403108561027971357230938743SRCHUSRDOB=20220131microsoft.com/102433237894403108561027971357230938743SRCHHPGUSRSRCHL" Pattern match: "IESS4Abing.com/1024294378944031085610419731758630938742SRCHUIDV=2&GUID=DD3EB05AD9C54D24A2443E918EB9AD6D&dmnchg=1bing.com/1024294378944031085610419731758630938742SRCHUSRDOB=20220131&T=1643622536000bing.com/1088404823347231085593429095039930938742bing.com/10" Pattern match: "3A170294394673087397twitter.com/10255458332163122372933489523031076870guest_id_adsv1%3A170294394673087397twitter.com/10255458332163122372934411398031076870personalization_idv1_HGdkp6+MYH+TVJgiOb6rCw==twitter.com/10254658332163122372926833273031076870gues" Pattern match: "3A170294394673087397twitter.com/10255458332163122372933489523031076870guest_id_adsv1%3A170294394673087397twitter.com/10255458332163122372934411398031076870personalization_idv1_0qQVeAhHADnQAbeV4W2zPw==twitter.com/10255458332163122372934411398031076870gues" Pattern match: "3A170294394673087397twitter.com/10255458332163122372933489523031076870guest_id_adsv1%3A170294393846618106twitter.com/10254658332163122372925692648031076870personalization_idv1_HGdkp6+MYH+TVJgiOb6rCw==twitter.com/10254658332163122372926833273031076870gues" Pattern match: "3A170294393846618106twitter.com/10254658332163122372925192648031076870guest_id_adsv1%3A170294393846618106twitter.com/10254658332163122372925692648031076870personalization_idv1_HGdkp6+MYH+TVJgiOb6rCw==twitter.com/10254658332163122372926833273031076870gues" Pattern match: "www.linkedin.com/9217247450931231150303308636252631076869li_rmAQFy-YvBndYtWAAAAYx_XfCqFShTEnzQmaUV41pELgNC-IvETdhBKFlrzMKzkif-TlPT8IH_xMguTok33SwE4WYjebAttKMbRb9d6lXQAxADiUnKhznXUkvswww.linkedin.com/9217247450931231150303308339377631076869" Pattern match: "3A170294393846618106twitter.com/10254658332163122372925192648031076870guest_id_adsv1%3A170294393846618106twitter.com/10254658332163122372925692648031076870personalization_idv1_HGdkp6+MYH+TVJgiOb6rCw==twitter.com/10254658332163122372926833273031076870" Pattern match: "0jvJ8aOtTxyh8XW1I..BlgNzR.Ha.AAA.0.0.BlgNzR.AWWxLcv48CAfacebook.com/921747532403231094983397551480310768700dyAZQwkypDDj7FPwQhVUu9zfacebook.com/921720197781763115734440427023031076870_js_datr0dyAZeHbW6fMOJkhcj-Jsqs3facebook.com/10891629516544311573364733327" Pattern match: "linkedin.com/1025247450931231150303308386252631076869lidcb=OGST08:s=O:r=O:a=O:p=O:g=2719:u=1:x=1:i=1702943912:t=1703030312:v=2:sig=AQGotSHFp4kMdVFUChf8hdFwa_WiIsUJlinkedin.com/1025115979161631077079308714377631076869" Pattern match: "linkedin.com/1025247450931231150303308386252631076869lidcb=TGST03:s=T:r=T:a=T:p=T:g=3120:u=1:x=1:i=1702944023:t=1703030423:v=2:sig=AQGms8dZLuDx8JcPf-Ehl45XYUf-AV1Plinkedin.com/1025226979161631077079196188396731076873" Pattern match: "MUIDB05F370B01AD06F9100E6635B1B546E31www.msn.com/921636339777283115533253630148031076870sptmarketen-us||us|en-us|en-us|en||RefA=DD8E4C1A2BCB4411B5B9ABF49110C2B2.RefC=2023-12-18T23:59:27Zwww.msn.com/102414674067203122393054020773031076870" Pattern match: "921636339777283115533253661398031076870MUID05F370B01AD06F9100E6635B1B546E31msn.com/102536339777283115533253630148031076870USRLOCmsn.com/921714674067203122393054161398031076870" Pattern match: "0jvJ8aOtTxyh8XW1I..BlgNzR.Ha.AAA.0.0.BlgNzR.AWWxLcv48CAfacebook.com/921747532403231094983397551480310768700dyAZQwkypDDj7FPwQhVUu9zfacebook.com/921720197781763115734440427023031076870" Pattern match: "3A170294393846618106twitter.com/10254658332163122372925192648031076870guest_id_adsv1%3A170294393846618106twitter.com/10254658332163122372925692648031076870" Pattern match: ".linkedin.com/9217247450931231150303308339377631076869" Pattern match: "921636339777283115533253661398031076870MUID05F370B01AD06F9100E6635B1B546E31msn.com/102536339777283115533253630148031076870" Pattern match: "0jvJ8aOtTxyh8XW1I..BlgNzR.Ha.AAA.0.0.BlgNzR.AWWxLcv48CAfacebook.com/92174753240323109498339755148031076870" Pattern match: "linkedin.com/1025247450931231150303308386252631076869" Pattern match: "MUIDB336DF1F6D1C361260E12E21DD08F608Cieonline.microsoft.com/921635639777283115533246661398031076870" Pattern match: "3A170294393846618106twitter.com/10254658332163122372925192648031076870" Pattern match: "browserid3166657605604843874store.steampowered.com/102526245093123115030316255148031076870" Pattern match: "MUIDB05F370B01AD06F9100E6635B1B546E31www.msn.com/921636339777283115533253630148031076870" Pattern match: "MUID05F370B01AD06F9100E6635B1B546E31msn.com/102536339777283115533253630148031076870" Heuristic match: "ocsp.digicert.com" Heuristic match: "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Heuristic match: "cacerts.digicert.com" Heuristic match: "GET /DigiCertGlobalRootG3.crt HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: cacerts.digicert.com" Heuristic match: "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAz1vQYrVgL0erhQLCPM8GY%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Heuristic match: "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEAx5qUSwjBGVIJJhX%2BJrHYM%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Heuristic match: "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSnxLiz3Fu1WB6n1%2FE6xWn1b0jXiQQUdIWAwGbH3zfez70pN6oDHb7tzRcCEAp6FnkBkACKqk%2BVbKsyAbY%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Heuristic match: "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAzlnDD9eoNTLi0BRrMy%2BWU%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Heuristic match: "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAbY2QTVWENG9oovp1QifsQ%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Heuristic match: "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTPJvUY%2Bsl%2Bj4yzQuAcL2oQno5fCgQUUWj%2FkK8CB3U8zNllZGKiErhZcjsCEAdcWuWOzU%2B3YfWP%2Bc9lf9g%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Heuristic match: "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAzlnDD9eoNTLi0BRrMy%2BWU%3D HTTP/1.1Cache-Control: max-age = 7200Connection: Keep-AliveAccept: */*If-Modified-Since: Mon, 18 Dec 2023 22:50:33 GMTUser-Agent: Mi" Heuristic match: "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTk45WiKdPUwcMf8JgMC07ACYqr2AQUt2ui6qiqhIx56rTaD5iyxZV2ufQCEAqiBEK%2F1RSvcy4lL46SQ4M%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Heuristic match: "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAqvpsXKY8RRQeo74ffHUxc%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Heuristic match: "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Heuristic match: "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEA177el9ggmWelJjG4vdGL0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Heuristic match: "abs.twimg.com" Heuristic match: "accounts.google.com" Heuristic match: "connect.facebook.net" Heuristic match: "facebook.com" Heuristic match: "fbcdn.net" Heuristic match: "fbsbx.com" Heuristic match: "platform.linkedin.com" Heuristic match: "static.licdn.com" Heuristic match: "static.xx.fbcdn.net" Heuristic match: "store.steampowered.com" Heuristic match: "twitter.com" Pattern match: "www.facebook.com" Pattern match: "https://api.x.ai" Pattern match: "https://www.linkedin.com/loginAccept-Language" Pattern match: "https://www.linkedin.com/li/rep}],include_subdomains:true}Server" Pattern match: "https://store.akamai.steamstatic.com/" Pattern match: "www.facebook.comConnection" Pattern match: "fb.me/p3pSet-Cookie" Pattern match: "https://*.fbsbx.com" Pattern match: "https://www.facebook.com/loginAccept-Language" Pattern match: "https://connect.facebook.net/security/hsts-pixel.gifreporting-endpoints" Pattern match: "https://fbsbx.com/security/hsts-pixel.gif?c=5reporting-endpoints" Pattern match: "https://twitter.com/i/flow/loginAccept-Language" Pattern match: "https://twitter.com" Pattern match: "https://www.linkedin.com/checkpoint/lg/login-submitAccept-Language" Pattern match: "rsrc.php/v3/yc/l/0,cross/1FPNULrhhBJ.css?_nc_x=Ij3Wp8lg5Kz" Pattern match: "rsrc.php/v3/yP/r/DskFNeBDZrG.js?_nc_x=Ij3Wp8lg5Kz" Pattern match: "rsrc.php/v3/yR/l/0,cross/8W3qU45QLlE.css?_nc_x=Ij3Wp8lg5Kz" Pattern match: "rsrc.php/y1/r/4lCu2zih0ca.svg" Pattern match: "rsrc.php/v3/yJ/l/0,cross/FzXL11-8Cqh.css?_nc_x=Ij3Wp8lg5Kz" Pattern match: "rsrc.php/v3/ya/l/0,cross/EQ0cyse2DGv.css?_nc_x=Ij3Wp8lg5Kz" Pattern match: "rsrc.php/v3/yx/r/GIlJjyzEguQ.js?_nc_x=Ij3Wp8lg5Kz" Pattern match: "rsrc.php/v3/y0/r/cjx8Hpg6co-.js?_nc_x=Ij3Wp8lg5Kz" Pattern match: "rsrc.php/v3i7M54/yo/l/en_US/VOBFpi2zoQs.js?_nc_x=Ij3Wp8lg5Kz" Pattern match: "rsrc.php/v3/yy/r/rf7yAhNGY86.js?_nc_x=Ij3Wp8lg5Kz" Pattern match: "rsrc.php/v3/yU/r/O7nelmd9XSI.png" Pattern match: "rsrc.php/v3/yJ/r/a1OLcVhluEP.js?_nc_x=Ij3Wp8lg5Kz" Pattern match: "rsrc.php/v3/yy/r/QcYlxMWQTQ-.js?_nc_x=Ij3Wp8lg5Kz" Pattern match: "rsrc.php/v3/yw/r/wm4d5zAAo-a.js?_nc_x=Ij3Wp8lg5Kz" Pattern match: "rsrc.php/v3/y2/r/3FPJ9YC_wUr.js?_nc_x=Ij3Wp8lg5Kz" Pattern match: "rsrc.php/v3/yZ/r/WSUsUAbL_J5.js?_nc_x=Ij3Wp8lg5Kz" Pattern match: "rsrc.php/v3/yB/r/Y0L6f5sxdIV.png" Pattern match: "rsrc.php/v3/y1/r/dXk5exdOVhk.js?_nc_x=Ij3Wp8lg5Kz" Pattern match: "rsrc.php/v3/yH/r/EEh1AYcUYds.js?_nc_x=Ij3Wp8lg5Kz" Pattern match: "rsrc.php/v3/yP/r/aBIoq18cchP.js?_nc_x=Ij3Wp8lg5Kz" Pattern match: "rsrc.php/v3/yQ/r/zyRovCtoGSI.js?_nc_x=Ij3Wp8lg5Kz" Pattern match: "rsrc.php/v3/yF/r/PtmfxLVwAb7.js?_nc_x=Ij3Wp8lg5Kz" Pattern match: "rsrc.php/v3/yp/r/sKtrEJAtiUM.js?_nc_x=Ij3Wp8lg5Kz" Pattern match: "rsrc.php/v3/yv/r/qvzskUrYlYC.js?_nc_x=Ij3Wp8lg5Kz" Pattern match: "rsrc.php/v3/yJ/r/EcHbCLLcfHK.js?_nc_x=Ij3Wp8lg5Kz" Pattern match: "rsrc.php/v3/yp/r/ISUe9_7D94n.js?_nc_x=Ij3Wp8lg5Kz" Pattern match: "rsrc.php/v3ihVQ4/yn/l/en_US/D3XrCjdXtFY.js?_nc_x=Ij3Wp8lg5Kz" Pattern match: "rsrc.php/v3/yz/r/dqd6vCA9PNV.js?_nc_x=Ij3Wp8lg5Kz" Pattern match: "rsrc.php/v3/yZ/r/skazhVdw245.js?_nc_x=Ij3Wp8lg5Kz" Pattern match: "rsrc.php/v3/yY/r/BqEjD1dj1pL.js?_nc_x=Ij3Wp8lg5Kz" Pattern match: "rsrc.php/v3/yT/r/cfM8cJotnFg.js?_nc_x=Ij3Wp8lg5Kz" Pattern match: "rsrc.php/v3/yZ/r/cA_3fTtJxgp.js?_nc_x=Ij3Wp8lg5Kz" Pattern match: "rsrc.php/yb/r/hLRJ1GG_y0J.ico" Pattern match: "https://reactjs.org/docs/error-decoder.html?invariant=+e,r=1;r" Pattern match: "https://steamcommunity.com/chat/friend/" Pattern match: "https://steamcommunity.com/chat/group/" Pattern match: "https://store.steampowered.com/about/" Pattern match: "https://steamcommunity.com/" Pattern match: "https://store.steampowered.com/" Pattern match: "https://community.akamai.steamstatic.com/" Pattern match: "www.youtube.com/embed/" Pattern match: "https://player.vimeo.com/video/" Pattern match: "https://sketchfab.com/models/" Pattern match: "https://help.steampowered.com/en/wizard/HelpWithLimitedAccount" Pattern match: "https://steamcommunity.com" Pattern match: "https://steamcommunity.com/chat/" Pattern match: "https://checkout.steampowered.com/parental/ajaxlock" Pattern match: "https://store.steampowered.com/search/results/" Pattern match: "https://github.com/uuidjs/uuid#getrandomvalues-not-supported" Pattern match: "https://raw.githubusercontent.com/stefanpenner/es6-promise/master/LICENSE" Pattern match: "C.JgU/0$" Pattern match: "crl.microsoft.com/pki/crl/products/MicCerLisCA2011_2011-03-29.crl0]+Q0O0M+0Ahttp://www.microsoft.com/pki/certs/MicCerLisCA2011_2011-03-29.crt0U00" Pattern match: "crl.microsoft.com/pki/crl/products/MicRooCerAut_2010-06-23.crl0Z+N0L0J+0" Pattern match: "www.microsoft.com0" Pattern match: "https://assets.msn.com/config/v1/"" Pattern match: "https://+l+/OneCollector/1.0+function(t){return?+Object.keys(t).map" Pattern match: "https://assets.msn.com/bundles/v1/homePage/latest/midlevel/vendors.ef7dde432bed42c1b7db.js" Pattern match: "https://assets.msn.com/bundles/v1/homePage/latest/midlevel/microsoft.f0dc8bbbc7b4d116660b.js" Pattern match: "https://assets.msn.com/bundles/v1/homePage/latest/midlevel/common.a878ea7bfce3fb435465.js" Pattern match: "https://assets.msn.com/bundles/v1/homePage/latest/midlevel/experience.0f30a2bb04a428617069.js" Pattern match: "https://abs.twimg.com/responsive-web/client-web/vendor.1b81224a.js" Pattern match: "https://static.ads-twitter.com/uwt.js" Pattern match: "https://abs.twimg.com/errors/logo46x38.png" Pattern match: "https://help.twitter.com/using-twitter/twitter-supported-browsers" Pattern match: "https://twitter.com/tos" Pattern match: "https://twitter.com/privacy" Pattern match: "https://support.twitter.com/articles/20170514" Pattern match: "https://legal.twitter.com/imprint.html" Pattern match: "https://business.twitter.com/en/help/troubleshooting/how-twitter-ads-work.html?ref=web-twc-ao-gbl-adsinfo&utm_source=twc&utm_medium=web&utm_campaign=ao&utm_content=adsinfo" Pattern match: "https://ton.local.twitter.com/responsive-web-internal/sourcemaps/client-web/runtime.151ccd0a.js.map" Pattern match: "http://feross.org" Pattern match: "https://feross.org/opensource" Pattern match: "https://www.internalfb.com/intern/invariant/+a+/;b.length" Pattern match: "https://fburl.com/debugjs" Pattern match: "https://www.facebook.com/legal/license/Ga6vBwdwgUx/" Pattern match: "https://www.facebook.com/legal/license/A4tfXiHOGrs/" Pattern match: "https://secure.facebook.com/:document.referrer,d=c.indexOf(/,8);c=c.substring(0,d);if(l(c)){d=new" Pattern match: "www.+" Pattern match: "www.novi" Pattern match: "https://accounts.google.com/v3/signin/" Pattern match: "https://www.gstatic.com/_/mss/boq-identity/_/ss/k=boq-identity.AccountsSignInUi.dEB8J-yETiQ.L.B1.O/am=P4GFZI4NgBgzyzl_zzg5DAAAAAAAAAAAsAawAw/d=1/ed=1/rs=AOaEmlHgabEHgkgpm8Idb4egzdS99jS9KA/m=identifierview,_b,_tp" Pattern match: "fonts.gstatic.com/s/productsans/v9/pxiDypQkot1TnFhsFMOfGShVGdeOYktMqlap.woff2" Pattern match: "https://www.gstatic.com/_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en_US.Esgs9sUIcrA.es5.O/am=P4GFZI4NgBgzyzl_zzg5DAAAAAAAAAAAsAawAw/d=1/excm=_b,_tp,identifierview/ed=1/dg=0/wt=2/ujg=1/rs=AOaEmlH7PzU0xJlt26l3lAuQiC9uvvi0-Q/m=_b,_tp" Pattern match: "fonts.gstatic.com/s/roboto/v18/KFOkCnqEu92Fr1MmgVxFIzIXKMnyrYk.woff2" Pattern match: "https://accounts.google.com/AccountChooser?continue\u003dhttps://accounts.google.com/\u0026followup\u003dhttps://accounts.google.com/],[null,[null,null,https://accounts.google.com/Logout?continue\u003dhttps://accounts.google.com/restart?continue%3Dhttps:" Heuristic match: "}U%.mU" Pattern match: "http://soupinterestoe.fun/api" Pattern match: "https://www.cloudflare.com/5xx-error-landing" Pattern match: "soupinterestoe.fun/api" Heuristic match: "*CACHE.PM" Heuristic match: "iloncdn.net" Heuristic match: "ccounts.google.com" Pattern match: "twitter.com/i/flow/login" Heuristic match: "witter.com" Pattern match: "store.steampowered.com/login" Heuristic match: "tore.steampowered.com" Heuristic match: "acebook.com" Pattern match: "www.facebook.com/login" Pattern match: "http://soupinteresY" Pattern match: "http://soupinterestoe.fun/" Heuristic match: ":-.ro" Heuristic match: "=F.Am" Heuristic match: "PATHEXT=.CO" Pattern match: "http://ocsp.thawte.com0" Pattern match: "http://crl.thawte.com/ThawteTimestampingCA.crl0" Pattern match: "http://ts-ocsp.ws.symantec.com07" Pattern match: "http://ts-aia.ws.symantec.com/tss-ca-g2.cer0" Pattern match: "http://ts-crl.ws.symantec.com/tss-ca-g2.crl0" Pattern match: "https://www.verisign.com/rpa" Pattern match: "http://csc3-2010-crl.verisign.com/CSC3-2010.crl0D" Pattern match: "https://www.verisign.com/rpa0" Pattern match: "http://ocsp.verisign.com0" Pattern match: "http://csc3-2010-aia.verisign.com/CSC3-2010.cer0" Pattern match: "https://www.verisign.com/cps0*" Pattern match: "http://logo.verisign.com/vslogo.gif04" Pattern match: "http://crl.verisign.com/pca3-g5.crl04" Pattern match: "http://www.rohitab.com/apimonitor"53:T257a,Found URL "http://soupinterestoe.fun/apisoupinterestoe.funoupinterestoe.fungistergisterseswrpc-85968997ad33ab5f71997ad33ab5f71997ad33ab5f71?\c:\windows\shsoupinterestoe.funsoupinterestoe.fun:\windows\system32\winnsi.dllsenumerateprocessesexwionwsoupinterestoe.funsoupintereen-us:\windows\system32\rasadhlp.dll:\windows\system32\fwpuclnt.dll2445fea7200004b54eacd289166b7usoupinterestoe.fun+8+8+" - Source: "00000000-00001912.00000000.68222.0033E000.00000004.mdmp") Found URL "http://soupinterestoe.fun/apis^4!sv." - Source: "00000000-00001912.00000000.68222.0033E000.00000004.mdmp") Found URL "https://www.cloudflare.com/5xx-error-landing" - Source: "00000000-00001912.00000000.68222.0033E000.00000004.mdmp") Found URL "https://www.cloudflare.com/5xx-error-landing" - Source: "00000000-00001912.00000000.68222.01C40000.00000004.mdmp") Found URL "http://soupinterestoe.fun/apisoupinterestoe.fun:\users\hapubws\appdata\roaming\ethereumontent-type:" - Source: "00000000-00001912.00000001.70142.0033E000.00000004.mdmp") Found URL "http://soupinterestoe.fun/apis^4!sv." - Source: "00000000-00001912.00000001.70142.0033E000.00000004.mdmp") Found URL "https://www.cloudflare.com/5xx-error-landing" - Source: "00000000-00001912.00000001.70142.0033E000.00000004.mdmp") Found URL "http://soupinterestoe.fun/api:\users\hapubws\appdata\roaming\binance:\users\hapubws\appdata\roaming\binance:\users\hapubws\appdata\roaming\binance:\users\hapubws\appdata\roaming\binance:\users\hapubws\appdata\roaming\binance:\users\hapubws\appdata\roaming\binance:\users\hapubws\appdata\roaming\binance:\users\hapubws\appdata\roaming\com.liberty.jaxx\indexeddb:\users\hapubws\appdata\roaming\com.liberty.jaxx\indexeddb:\users\hapubws\appdata\roaming\com.liberty.jaxx\indexeddb:\users\hapubws\appdata\roaming\electrum\wallets:\users\hapubws\appdata\roaming\electrum\wallets:\users\hapubws\appdata\roaming\electrum\wallets:\users\hapubws\appdata\local\google\chrome\user" - Source: "00000000-00001912.00000001.70142.01C40000.00000004.mdmp") Found URL "https://www.cloudflare.com/5xx-error-landing" - Source: "00000000-00001912.00000001.70142.01C40000.00000004.mdmp") Found URL "http://soupinterestoe.fun/apisoupinterestoe.fun:\users\hapubws\appdata\roaming\ethereumontent-type:" - Source: "00000000-00001912.00000002.72061.0033E000.00000004.mdmp") Found URL "http://soupinterestoe.fun/apis^4!sv." - Source: "00000000-00001912.00000002.72061.0033E000.00000004.mdmp") Found URL "https://www.cloudflare.com/5xx-error-landing" - Source: "00000000-00001912.00000002.72061.0033E000.00000004.mdmp") Found URL "http://soupinterestoe.fun/apie.funontent-type:" - Source: "00000000-00001912.00000002.72061.01C40000.00000004.mdmp") Found URL "http://soupinteresyhttp://soupinterestoe.fun/http://soupinterestoe.fun/??\c:\users\hapubws\appdata\roaming\atomic\local" - Source: "00000000-00001912.00000002.72061.01C40000.00000004.mdmp") Found URL "https://www.cloudflare.com/5xx-error-landing" - Source: "00000000-00001912.00000002.72061.01C40000.00000004.mdmp") Found URL "http://ocsp.thawte.com080604.http://crl.thawte.com/thawtetimestampingca.crl0timestamp-2048-10y@b%symantec" - Source: "00000000-00003316.00000001.68903.00110000.00000004.mdmp") Found URL "http://ts-ocsp.ws.symantec.com07+http://ts-aia.ws.symantec.com/tss-ca-g2.cer0<50301+http://ts-crl.ws.symantec.com/tss-ca-g2.crl0(timestamp-2048-20b07x,&c3\vno^efany3+." - Source: "00000000-00003316.00000001.68903.00110000.00000004.mdmp") Found URL "https://www.verisign.com/rpa" - Source: "00000000-00003316.00000001.68903.00110000.00000004.mdmp") Found URL "http://csc3-2010-crl.verisign.com/csc3-2010.crl0d=0;090*0(https://www.verisign.com/rpa0e0c0$http://ocsp.verisign.com0;/http://csc3-2010-aia.verisign.com/csc3-2010.cer0odj6je[=glbzmverisign," - Source: "00000000-00003316.00000001.68903.00110000.00000004.mdmp") Found URL "https://www.verisign.com/cps0*https://www.verisign.com/rpa0[0y0w0u" - Source: "00000000-00003316.00000001.68903.00110000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif04-0+0)" - Source: "00000000-00003316.00000001.68903.00110000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3-g5.crl04(0&0$http://ocsp.verisign.com0verisignmpki-2-803130g8j-lb=e6verisign," - Source: "00000000-00003316.00000001.68903.00110000.00000004.mdmp") Found URL "http://www.rohitab.com/apimonitor" - Source: "00000000-00003316.00000001.68903.00110000.00000004.mdmp") Found URL "https://www.facebook.com/login-ms-winclsid\" - Source: "00000000-00003660.00000000.67098.00570000.00000004.mdmp") Found URL "https://accounts.google.com/ac0-d863-11e7-b9ff-806e6f6e6963" - Source: "00000000-00003660.00000000.67098.00570000.00000004.mdmp") Found URL "https://accounts.google.com/c$cxlwc:\users\hapubws\appdata\local\temp\ixp002.tmp\1pe57aq7.exe@p.uvt" - Source: "00000000-00003660.00000000.67098.00570000.00000004.mdmp") Found URL "https://steamcommunity.com/openid/loginform:\windows\system32\userenv.dll:\windows\system32\profapi.dll:\windows\system32\psapi.dll:\windows\system32\comdlg32.dll:\windows\system32\oleaut32.dll:\windows\system32\iphlpapi.dll:\windows\system32\winnsi.dll:\windows\system32\uxtheme.dll:\windows\system32\shell32.dll:\windows\system32\ole32.dll:\windows\system32\apphelp.dll:\windows\system32\sspicli.dll:\windows\system32\samcli.dll:\windows\system32\msacm32.dll:\windows\system32\sfc_os.dll:\windows\system32\dwmapi.dll:\windows\system32\devobj.dll:\windows\system32\urlmon.dll:\windows\system32\imm32.dll:\windows\system32\msctf.dll\windows\system32\driverstorellusersprofile=c:\programdatarogramfiles=c:\program" - Source: "00000000-00003660.00000001.67886.00570000.00000004.mdmp") Found URL "https://www.paypal.com/signinttps://twitter.com/i/flow/login:\windows\system32\propsys.dlllocationnotificationsview.xmlttps://www.epicgames.com/id/loginnettrace.pla.diagnostics.xmlportabledeviceconnectapi.dllportabledevicewiacompat.dllecurity=impersonation" - Source: "00000000-00003660.00000001.67886.00570000.00000004.mdmp") Found URL "https://www.youtube.com/https://www.youtube.com/api-ms-win-core-rtlsupport-l1-1-0.dllapi-ms-win-core-sysinfo-l1-1-0.dllapi-ms-win-core-threadpool-l1-1-0.dllapi-ms-win-crt-filesystem-l1-1-0.dllhttps://www.youtube.com/ttps://steamcommunity.com/openid/loginformttps://steamcommunity.com/openid/loginformapi-ms-win-security-sddl-l1-1-0.dllhttps://www.youtube.com/https://www.youtube.com/auxiliarydisplayclassinstaller.dllommonprogramfiles=c:\program" - Source: "00000000-00003660.00000001.67886.00570000.00000004.mdmp") Found URL "https://www.linkedin.com/loginfime" - Source: "00000000-00003660.00000001.67886.00570000.00000004.mdmp") Found URL "https://www.linkedin.com/loginac0-d863-11e7-b9ff-806e6f6e6963" - Source: "00000000-00003660.00000001.67886.00570000.00000004.mdmp") Found URL "https://store.steampowered.com/loginofile=c:\programdataappdata=c:\users\hapubws\appdata\roamingcommonprogramfiles=c:\program" - Source: "00000000-00003660.00000001.67886.00570000.00000004.mdmp") Found URL "https://www.linkedin.com/loginhttps://www.linkedin.com/loginhttps://www.linkedin.com/loginhttps://www.linkedin.com/loginxt-ms-win-kernel32-package-current-l1-1-0.dllhttps://www.linkedin.com/loginhttps://www.facebook.com/login:\program" - Source: "00000000-00003660.00000001.67886.00570000.00000004.mdmp") Found URL "https://www.epicgames.com/id/loginrstrtmgr.dllrstrui.exertffilt.dllrtutils.dlldll32.exerunonce.exerwinsta.exesamcli.dllsampleres.dllsamsrv.dllsberes.dllscarddpscardsvr.dllscecli.dllscesrv.dllschannel.dischedcli.dllschedsvc.dllschtasks.exescripto.dllscrnsave.scrscrobj.dllscrptadm.dllscrrun.dll_sdbinst.exesdchange.exesdengin2.dllsdhcinst.dllageng.dllsdiagprv.dllsdiagschd.dllsdohlp.dllsdshext.dllsecedit.exesechost.dllseciniseclogon.dllsecpol.mscsecproc.dllsecur32.dlsecurity.dllsendmail.dllsensapi.dllsensrsvc.dllserialui.dllservices.exeservices.mscserwvdrv.dllsessenv.dllsetspn.exesetupapi.dllsetupcl.exepcln.dllsetupetw.dllsetupsnk.exesetupugc.exesfc_os.dllshacct.dllshadow.exeshdocvdshell32.dllshfolder.dllshgina.dllshiftjis.ushimeng.dllshimgvw.dllshlwapi.dllshpafact.dllshrpubw.exeshsetup.dllshsvcs.dllshunimpl.dllshutdown.exeshwebsvc.dllsigndrv.dllsigverif.exedata.tlbsisbkup.dllslcext.dllsmiengine.dllsndvolsso.dllsnmpapi.dllsnmptrap.exesntsea>softkbd.dllsoftpub.dllspcmsg.dllsperror.dlspfileq.dllspinstall.exespoolss.dllspoolsv.exesppcext.dllsppcomapi.dllsppinst.dllsppobjs.dllsppsvc.exesppwinob.dllsppwmi.dllspreview.exensat.dllspwizeng.dllspwizimg.dllspwizres.dllsqlceqp30.dllsqlcese30.dllsqlsrv32.dllsqlsrvsqlunirl.dllsqlwid.dllsqlwoa.dllsqmapi.dllsr-latn-cssrchadmin.dllsrclient.dllsrcore.dllsrdelayed.exesrhelper.dllsrrstr.dllsrvcli.dllsrvsvc.dllsscore.dllssdpapi.dllssdpsrv.dllcli.dllsspisrv.dllssshim.dllsstext3d.scrstclient.dllstdole2.tlbstdole32.tlbstikynsti_ci.dllstobject.dllstorage.dllstorprop.d" - Source: "00000000-00003660.00000001.67886.00570000.00000004.mdmp") Found URL "https://www.epicgames.com/id/loginhttps://www.linkedin.com/loginttps://store.steampowered.com/loginttps://store.steampowered.com/login:\0f78b956-909d-45b2-8b8d-2e5e1d522649:\0f78b956-909d-45b2-8b8d-2e5e1d522649fcoinstaller.dllxpsgdiconv.dllxpsrasterservice.dllopenrchvw.xmlxpsshhdr.dllxpssvcs.dllxwizarxwizard.exexwizards.dllxwtpdui.dllxwtpw32.dllzipfldr.dllieframe.dll.muiproductnameinternet" - Source: "00000000-00003660.00000001.67886.00570000.00000004.mdmp") Found URL "https://www.linkedin.com/loginw8w8ww8w8wc$cxlwc:\users\hapubws\appdata\local\temp\ixp002.tmp\1pe57aq7.exe@p.upvt" - Source: "00000000-00003660.00000001.67886.00570000.00000004.mdmp")54:T9bb,Found string "GET /i/flow/login HTTP/1.1Accept: text/html, application/xhtml+xml, */*User-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateDNT: 1Host: twitter.comConnection: Keep-AliveAccept-Language: en-US" (Indicator: "HTTP/1.1"; File: "SSL") Found string "GET /i/flow/login HTTP/1.1Accept: text/html, application/xhtml+xml, */*Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: twitter.comDNT: 1Connection: Keep-Alive" (Indicator: "HTTP/1.1"; File: "SSL") file/memory contains long string with (Indicator: "HTTP/1.1"; File: "SSL") Found string "GET /sc/h/3m4lyvbs6efg8pyhv7kupo6dh HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoHost: static.licdn.comDNT: 1Connection: Keep-Alive" (Indicator: "HTTP/1.1"; File: "SSL") Found string "GET /login HTTP/1.1Accept: text/html, application/xhtml+xml, */*Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: store.steampowered.comDNT: 1Connection: Keep-Alive" (Indicator: "HTTP/1.1"; File: "SSL") Found string "GET /login HTTP/1.1Accept: text/html, application/xhtml+xml, */*User-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateDNT: 1Host: www.facebook.comConnection: Keep-AliveAccept-Language: en-US" (Indicator: "HTTP/1.1"; File: "SSL") Found string "GET /rsrc.php/yb/r/hLRJ1GG_y0J.ico HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoHost: static.xx.fbcdn.netDNT: 1Connection: Keep-Alive" (Indicator: "HTTP/1.1"; File: "SSL") Found string "POST /api HTTP/1.1" (Indicator: "HTTP/1.1"; Source: "00000000-00001912.00000000.68222.0033E000.00000004.mdmp, 00000000-00001912.00000001.70142.0033E000.00000004.mdmp, 00000000-00001912.00000001.70142.01C40000.00000004.mdmp, 00000000-00001912.00000002.72061.0033E000.00000004.mdmp, 00000000-00001912.00000002.72061.01C40000.00000004.mdmp") Found string "HTTP/1.1 200 OK" (Indicator: "HTTP/1.1"; Source: "00000000-00001912.00000000.68222.01C40000.00000004.mdmp, 00000000-00001912.00000001.70142.01C40000.00000004.mdmp, 00000000-00001912.00000002.72061.01C40000.00000004.mdmp") Found string "i HTTP/1.1" (Indicator: "HTTP/1.1"; Source: "00000000-00001912.00000001.70142.01C40000.00000004.mdmp")55:T3090,Contains base62 string in header "14QNW8Ja7sqHF79WoUD1smeKYX205dU1M" in header "POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedCookie: __cf_mw_byp=14QNW8Ja7sqHF79WoUD1smeKYX205dU1M2j6gN2sxUI-1702943900-0-/apiUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 47Host: soupinterestoe.fun" Contains base62 string in header "14QNW8Ja7sqHF79WoUD1smeKYX205dU1M" in header "POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=be85de5ipdocierre1Cookie: __cf_mw_byp=14QNW8Ja7sqHF79WoUD1smeKYX205dU1M2j6gN2sxUI-1702943900-0-/apiUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 500Host: soupinterestoe.fun" Contains base62 string in header "MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAU" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base62 string in header "2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base62 string in header "MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V" in header "GET /gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base62 string in header "ME4wTDBKMEgwRjAJBgUrDgMCGgUABBQwk" in header "GET /gtsr1/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBQwkcLWD4LqGJ7bE7B1XZsEbmfwUAQU5K8rJnEaK0gnhS9SZizv8IkTcT4CDQIDvFNZazTHGPUBUGY%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base62 string in header "cLWD4LqGJ7bE7B1XZsEbmfwUAQU5K8rJn" in header "GET /gtsr1/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBQwkcLWD4LqGJ7bE7B1XZsEbmfwUAQU5K8rJnEaK0gnhS9SZizv8IkTcT4CDQIDvFNZazTHGPUBUGY%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base62 string in header "EaK0gnhS9SZizv8IkTcT4CDQIDvFNZazT" in header "GET /gtsr1/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBQwkcLWD4LqGJ7bE7B1XZsEbmfwUAQU5K8rJnEaK0gnhS9SZizv8IkTcT4CDQIDvFNZazTHGPUBUGY%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base62 string in header "MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAz1vQYrVgL0erhQLCPM8GY%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base62 string in header "2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAz1vQYrVgL0erhQLCPM8GY%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base62 string in header "2BrkS7QYXjzkCEAz1vQYrVgL0erhQLCPM" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAz1vQYrVgL0erhQLCPM8GY%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base62 string in header "MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfq" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEAx5qUSwjBGVIJJhX%2BJrHYM%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base62 string in header "hLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQ" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEAx5qUSwjBGVIJJhX%2BJrHYM%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base62 string in header "P4v0cB1JgmGggC72NkK8MCEAx5qUSwjBG" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEAx5qUSwjBGVIJJhX%2BJrHYM%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base62 string in header "MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHL" in header "GET /gts1c3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEBZwXm7t3kKEEFjsmHQeLcQ%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base62 string in header "2Fr4XN7pXNPZzQ4kYU83E1HScCEBZwXm7" in header "GET /gts1c3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEBZwXm7t3kKEEFjsmHQeLcQ%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base62 string in header "MFEwTzBNMEswSTAJBgUrDgMCGgUABBSnx" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSnxLiz3Fu1WB6n1%2FE6xWn1b0jXiQQUdIWAwGbH3zfez70pN6oDHb7tzRcCEAp6FnkBkACKqk%2BVbKsyAbY%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base62 string in header "2FE6xWn1b0jXiQQUdIWAwGbH3zfez70pN" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSnxLiz3Fu1WB6n1%2FE6xWn1b0jXiQQUdIWAwGbH3zfez70pN6oDHb7tzRcCEAp6FnkBkACKqk%2BVbKsyAbY%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base62 string in header "MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrj" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAzlnDD9eoNTLi0BRrMy%2BWU%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base62 string in header "2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdi" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAzlnDD9eoNTLi0BRrMy%2BWU%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base62 string in header "uNkHMEWNpYim8S8YCEAzlnDD9eoNTLi0B" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAzlnDD9eoNTLi0BRrMy%2BWU%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base62 string in header "MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAU" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAbY2QTVWENG9oovp1QifsQ%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base62 string in header "2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAbY2QTVWENG9oovp1QifsQ%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base62 string in header "MFEwTzBNMEswSTAJBgUrDgMCGgUABBTPJ" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTPJvUY%2Bsl%2Bj4yzQuAcL2oQno5fCgQUUWj%2FkK8CB3U8zNllZGKiErhZcjsCEAdcWuWOzU%2B3YfWP%2Bc9lf9g%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base62 string in header "2FkK8CB3U8zNllZGKiErhZcjsCEAdcWuW" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTPJvUY%2Bsl%2Bj4yzQuAcL2oQno5fCgQUUWj%2FkK8CB3U8zNllZGKiErhZcjsCEAdcWuWOzU%2B3YfWP%2Bc9lf9g%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base62 string in header "MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrj" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAzlnDD9eoNTLi0BRrMy%2BWU%3D HTTP/1.1Cache-Control: max-age = 7200Connection: Keep-AliveAccept: */*If-Modified-Since: Mon, 18 Dec 2023 22:50:33 GMTUser-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base62 string in header "2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdi" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAzlnDD9eoNTLi0BRrMy%2BWU%3D HTTP/1.1Cache-Control: max-age = 7200Connection: Keep-AliveAccept: */*If-Modified-Since: Mon, 18 Dec 2023 22:50:33 GMTUser-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base62 string in header "uNkHMEWNpYim8S8YCEAzlnDD9eoNTLi0B" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAzlnDD9eoNTLi0BRrMy%2BWU%3D HTTP/1.1Cache-Control: max-age = 7200Connection: Keep-AliveAccept: */*If-Modified-Since: Mon, 18 Dec 2023 22:50:33 GMTUser-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base62 string in header "MFEwTzBNMEswSTAJBgUrDgMCGgUABBTk4" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTk45WiKdPUwcMf8JgMC07ACYqr2AQUt2ui6qiqhIx56rTaD5iyxZV2ufQCEAqiBEK%2F1RSvcy4lL46SQ4M%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base62 string in header "5WiKdPUwcMf8JgMC07ACYqr2AQUt2ui6q" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTk45WiKdPUwcMf8JgMC07ACYqr2AQUt2ui6qiqhIx56rTaD5iyxZV2ufQCEAqiBEK%2F1RSvcy4lL46SQ4M%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base62 string in header "MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAqvpsXKY8RRQeo74ffHUxc%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base62 string in header "2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAqvpsXKY8RRQeo74ffHUxc%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base62 string in header "2BrkS7QYXjzkCEAqvpsXKY8RRQeo74ffH" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAqvpsXKY8RRQeo74ffHUxc%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base62 string in header "MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base62 string in header "2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base62 string in header "2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base62 string in header "MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEA177el9ggmWelJjG4vdGL0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base62 string in header "2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEA177el9ggmWelJjG4vdGL0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base62 string in header "2BrkS7QYXjzkCEA177el9ggmWelJjG4vd" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEA177el9ggmWelJjG4vdGL0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com"56:T74c,Observed string: "__d("URISchemes",["$InternalEnum"],(function(a,b,c,d,e,f){"use strict";var g=new Set(["about","accountscenter","aidemos","aistudio","apk","blob","cmms","fb","fba","fbatwork","fb-ama","fb-internal","fb-workchat","fb-workchat-secure","fb-messenger","fb-messenger-public","fb-messenger-group-thread","fb-page-messages","fb-pma","fbcf","fbconnect","fbinternal","fbmobilehome","fbrpc","file","flipper","ftp","gtalk","http","https","mailto","wss","ms-app","intent","itms","itms-apps","itms-services","lasso","market","svn+ssh","fbstaging","tel","sms","pebblejs","sftp","whatsapp","moments","flash","fblite","chrome-extension","webcal","instagram","iglite","fb124024574287414","fb124024574287414rc","fb124024574287414master","fb1576585912599779","fb929757330408142","designpack","fbpixelcloud","fbapi20130214","fb1196383223757595","tbauth","oculus","oculus.store","oculus.feed","oculusstore","socialplatform","odh","com.oculus.rd","aria","skype","ms-windows-store","callto","messenger","workchat","fb236786383180508","fb1775440806014337","data","fb-mk","munki","origami-file","fb-nimble-vrsrecorder","fb-nimble-monohandtrackingvis","together","togetherbl","horizonlauncher","venues","whatsapp-consumer","whatsapp-smb","fb-ide-opener","fb-vscode","fb-vscode-insiders","editor","spark-studio","spark-player","spark-simulator","arstudio","manifold","origami-internal","origami-public","stella","mwa","mattermost","logaggregator","pcoip","cinema","home","oculus360photos","systemux"]),h=b("$InternalEnum")({EXPLICITLY_ALLOWED_SCHEMES_ONLY:"explicitly_allowed_schemes_only",INCLUDE_DEFAULTS:"include_defaults"});function a(a,b,c){b===void 0&&(b=h.INCLUDE_DEFAULTS);return a==null||a===""?!0:(c==null?void 0:c.has(a.toLowerCase()))||b===h.INCLUDE_DEFAULTS&&g.has(a.toLowerCase())}f.Options=h;f.isAllowed=a}),66);" (Indicator: ""sftp") in Source: DskFNeBDZrG_1_.js57:T60a,"wextract.exe" called "FindFirstFileW" with parameter %TEMP%\IXP000.TMP\*.* (UID: 00000000-00003568) "wextract.exe" called "FindNextFileW" with parameter .. (UID: 00000000-00003568) "wextract.exe" called "FindNextFileW" with parameter 6xa9BJ8.exe (UID: 00000000-00003568) "wextract.exe" called "FindNextFileW" with parameter cZ5oz01.exe (UID: 00000000-00003568) "cZ5oz01.exe" called "FindFirstFileW" with parameter %TEMP%\IXP001.TMP\*.* (UID: 00000000-00003316) "cZ5oz01.exe" called "FindNextFileW" with parameter .. (UID: 00000000-00003316) "cZ5oz01.exe" called "FindNextFileW" with parameter 4xt354js.exe (UID: 00000000-00003316) "cZ5oz01.exe" called "FindNextFileW" with parameter ZP6rv89.exe (UID: 00000000-00003316) "ZP6rv89.exe" called "FindFirstFileW" with parameter %TEMP%\IXP002.TMP\*.* (UID: 00000000-00003028) "ZP6rv89.exe" called "FindNextFileW" with parameter .. (UID: 00000000-00003028) "ZP6rv89.exe" called "FindNextFileW" with parameter 1Pe57AQ7.exe (UID: 00000000-00003028) "ZP6rv89.exe" called "FindNextFileW" with parameter 2cV9250.exe (UID: 00000000-00003028) "1Pe57AQ7.exe" called "FindNextFileW" with parameter biocpl.dll (UID: 00000000-00003660) "1Pe57AQ7.exe" called "FindNextFileW" with parameter BioCredProv.dll (UID: 00000000-00003660) "1Pe57AQ7.exe" called "FindNextFileW" with parameter bios1.rom (UID: 00000000-00003660) "1Pe57AQ7.exe" called "FindNextFileW" with parameter bios4.rom (UID: 00000000-00003660) "1Pe57AQ7.exe" called "FindNextFileW" with parameter bitsadmin.exe (UID: 00000000-00003660)58:T461,file/memory contains long string with (Indicator: ".decrypt"; File: "qvzskUrYlYC_1_.js") file/memory contains long string with (Indicator: ".encrypt"; File: "qvzskUrYlYC_1_.js") file/memory contains long string with (Indicator: "base64"; File: "qvzskUrYlYC_1_.js") file/memory contains long string with (Indicator: "blowfish"; File: "qvzskUrYlYC_1_.js") file/memory contains long string with (Indicator: "base64"; File: "cjx8Hpg6co-_1_.js") file/memory contains long string with (Indicator: "base64"; File: "EcHbCLLcfHK_1_.js") file/memory contains long string with (Indicator: "base64"; File: "sV8yd1HtEV3_1_.js") file/memory contains long string with (Indicator: "chacha"; File: "9hjywk3zr0hyiyvhto6gc39eu_1_.js") file/memory contains long string with (Indicator: "base64"; File: "780clfwo95q05e51lsjnfgmg4_1_.js") file/memory contains long string with (Indicator: "chacha"; File: "780clfwo95q05e51lsjnfgmg4_1_.js") file/memory contains long string with (Indicator: "base64"; File: "DskFNeBDZrG_1_.js") Found string "MaEs" (Indicator: "aes"; Source: "00000000-00003028.00000001.68977.012DA000.00000002.mdmp")59:T87f,Found reference to API "GetDesktopWindow" (Indicator: "GetDesktopWindow"; File: "wextract.exe") Found reference to API "GetDC" (Indicator: "GetDC"; File: "wextract.exe") Found reference to API "GetDC" (Indicator: "GetDC"; Source: "00000000-00001912.00000000.68222.00400000.00000040.mdmp, 00000000-00001912.00000001.70142.00400000.00000040.mdmp, 00000000-00001912.00000002.72061.00160000.00000040.mdmp") Found reference to API "BitBlt" (Indicator: "BitBlt"; Source: "00000000-00001912.00000000.68222.00400000.00000040.mdmp, 00000000-00001912.00000001.70142.00400000.00000040.mdmp, 00000000-00001912.00000002.72061.00160000.00000040.mdmp") Found reference to API "CreateCompatibleBitmap" (Indicator: "CreateCompatibleBitmap"; Source: "00000000-00001912.00000000.68222.00400000.00000040.mdmp, 00000000-00001912.00000001.70142.00400000.00000040.mdmp, 00000000-00001912.00000002.72061.00160000.00000040.mdmp") Found reference to API "CreateCompatibleDC" (Indicator: "CreateCompatibleDC"; Source: "00000000-00001912.00000000.68222.00400000.00000040.mdmp, 00000000-00001912.00000001.70142.00400000.00000040.mdmp, 00000000-00001912.00000002.72061.00160000.00000040.mdmp") Found reference to API "CreateDCW" (Indicator: "CreateDC"; Source: "00000000-00001912.00000000.68222.00400000.00000040.mdmp, 00000000-00001912.00000001.70142.00400000.00000040.mdmp, 00000000-00001912.00000002.72061.00160000.00000040.mdmp") Found reference to API "GetDIBits" (Indicator: "GetDIBits"; Source: "00000000-00001912.00000000.68222.00400000.00000040.mdmp, 00000000-00001912.00000001.70142.00400000.00000040.mdmp, 00000000-00001912.00000002.72061.00160000.00000040.mdmp") Found reference to API "GetDesktopWindow" (Indicator: "GetDesktopWindow"; Source: "00000000-00003028.00000001.68977.012DA000.00000002.mdmp") Found reference to API "GetDC" (Indicator: "GetDC"; Source: "00000000-00003028.00000001.68977.012DA000.00000002.mdmp") Found reference to API "GetDesktopWindow" (Indicator: "GetDesktopWindow"; Source: "00000000-00003316.00000002.70823.0034A000.00000002.mdmp") Found reference to API "GetDC" (Indicator: "GetDC"; Source: "00000000-00003316.00000002.70823.0034A000.00000002.mdmp")5a:T4ca,Found reference to API "FindFirstFileA" (Indicator: "FindFirstFile"; File: "wextract.exe") Found reference to API "FindNextFileA" (Indicator: "FindNextFile"; File: "wextract.exe") Found reference to API "FindFirstFileExW" (Indicator: "FindFirstFile"; Source: "00000000-00001912.00000000.68222.00400000.00000040.mdmp, 00000000-00001912.00000001.70142.00400000.00000040.mdmp, 00000000-00001912.00000002.72061.00160000.00000040.mdmp") Found reference to API "FindNextFileW" (Indicator: "FindNextFile"; Source: "00000000-00001912.00000000.68222.00400000.00000040.mdmp, 00000000-00001912.00000001.70142.00400000.00000040.mdmp, 00000000-00001912.00000002.72061.00160000.00000040.mdmp") Found reference to API "FindFirstFileA" (Indicator: "FindFirstFile"; Source: "00000000-00003028.00000001.68977.012DA000.00000002.mdmp") Found reference to API "FindNextFileA" (Indicator: "FindNextFile"; Source: "00000000-00003028.00000001.68977.012DA000.00000002.mdmp") Found reference to API "FindFirstFileA" (Indicator: "FindFirstFile"; Source: "00000000-00003316.00000002.70823.0034A000.00000002.mdmp") Found reference to API "FindNextFileA" (Indicator: "FindNextFile"; Source: "00000000-00003316.00000002.70823.0034A000.00000002.mdmp")5b:Tc33,Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; File: "wextract.exe") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; File: "wextract.exe") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; File: "wextract.exe") Found reference to API "GetEnvironmentStrings" (Indicator: "GetEnvironmentStrings"; File: "2cV9250.exe.1068760659") Found reference to API "GetEnvironmentStringsW" (Indicator: "GetEnvironmentStrings"; File: "2cV9250.exe.1068760659") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; Source: "00000000-00001912.00000000.68222.00400000.00000040.mdmp, 00000000-00001912.00000001.70142.00400000.00000040.mdmp, 00000000-00001912.00000002.72061.00160000.00000040.mdmp") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; Source: "00000000-00001912.00000000.68222.00400000.00000040.mdmp, 00000000-00001912.00000001.70142.00400000.00000040.mdmp, 00000000-00001912.00000002.72061.00160000.00000040.mdmp") Found reference to API "GetEnvironmentStringsW" (Indicator: "GetEnvironmentStrings"; Source: "00000000-00001912.00000000.68222.00400000.00000040.mdmp, 00000000-00001912.00000001.70142.00400000.00000040.mdmp, 00000000-00001912.00000002.72061.00160000.00000040.mdmp") Found reference to API "GetModuleHandleExW" (Indicator: "GetModuleHandle"; Source: "00000000-00001912.00000000.68222.00400000.00000040.mdmp, 00000000-00001912.00000001.70142.00400000.00000040.mdmp, 00000000-00001912.00000002.72061.00160000.00000040.mdmp") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00001912.00000000.68222.00400000.00000040.mdmp, 00000000-00001912.00000001.70142.00400000.00000040.mdmp, 00000000-00001912.00000002.72061.00160000.00000040.mdmp") Found reference to API "3Process32FirstW" (Indicator: "Process32First"; Source: "00000000-00001912.00000001.70142.00400000.00000040.mdmp") Found reference to API "Process32NextW" (Indicator: "Process32Next"; Source: "00000000-00001912.00000001.70142.00400000.00000040.mdmp") Found reference to API "CreateToolhelp32Snapshot" (Indicator: "CreateToolhelp32Snapshot"; Source: "00000000-00001912.00000001.70142.00400000.00000040.mdmp") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; Source: "00000000-00003028.00000001.68977.012DA000.00000002.mdmp") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00003028.00000001.68977.012DA000.00000002.mdmp") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; Source: "00000000-00003028.00000001.68977.012DA000.00000002.mdmp") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; Source: "00000000-00003316.00000002.70823.0034A000.00000002.mdmp") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00003316.00000002.70823.0034A000.00000002.mdmp") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; Source: "00000000-00003316.00000002.70823.0034A000.00000002.mdmp")5c:T739,Found reference to API "RegOpenKeyExA" (Indicator: "RegOpenKey"; File: "wextract.exe") Found reference to API "RegQueryInfoKeyA" (Indicator: "RegQueryInfoKey"; File: "wextract.exe") Found reference to API "RegQueryValueExA" (Indicator: "RegQueryValue"; File: "wextract.exe") Found reference to API "RegEnumKeyExW" (Indicator: "RegEnumKey"; Source: "00000000-00001912.00000000.68222.00400000.00000040.mdmp, 00000000-00001912.00000001.70142.00400000.00000040.mdmp, 00000000-00001912.00000002.72061.00160000.00000040.mdmp") Found reference to API "RegOpenKeyExW" (Indicator: "RegOpenKey"; Source: "00000000-00001912.00000000.68222.00400000.00000040.mdmp, 00000000-00001912.00000001.70142.00400000.00000040.mdmp, 00000000-00001912.00000002.72061.00160000.00000040.mdmp") Found reference to API "RegQueryValueExW" (Indicator: "RegQueryValue"; Source: "00000000-00001912.00000000.68222.00400000.00000040.mdmp, 00000000-00001912.00000001.70142.00400000.00000040.mdmp, 00000000-00001912.00000002.72061.00160000.00000040.mdmp") Found reference to API "RegOpenKeyExA" (Indicator: "RegOpenKey"; Source: "00000000-00003028.00000001.68977.012DA000.00000002.mdmp") Found reference to API "RegQueryInfoKeyA" (Indicator: "RegQueryInfoKey"; Source: "00000000-00003028.00000001.68977.012DA000.00000002.mdmp") Found reference to API "RegQueryValueExA" (Indicator: "RegQueryValue"; Source: "00000000-00003028.00000001.68977.012DA000.00000002.mdmp") Found reference to API "RegOpenKeyExA" (Indicator: "RegOpenKey"; Source: "00000000-00003316.00000002.70823.0034A000.00000002.mdmp") Found reference to API "RegQueryInfoKeyA" (Indicator: "RegQueryInfoKey"; Source: "00000000-00003316.00000002.70823.0034A000.00000002.mdmp") Found reference to API "RegQueryValueExA" (Indicator: "RegQueryValue"; Source: "00000000-00003316.00000002.70823.0034A000.00000002.mdmp")5d:T5ad,Found reference to API "GetProcAddress" (Indicator: "GetProcAddress"; File: "wextract.exe") Found reference to API "Error loading %shGetProcAddress() failed on function '%s'. Possible reason: incorrect version of advpack.dll being used./Windows 95 or Windows NT is required to install" (Indicator: "GetProcAddress"; File: "wextract.exe") Found reference to API "GetProcAddress" (Indicator: "GetProcAddress"; Source: "00000000-00001912.00000000.68222.00400000.00000040.mdmp, 00000000-00001912.00000001.70142.00400000.00000040.mdmp, 00000000-00001912.00000002.72061.00160000.00000040.mdmp") Found reference to API "Error loading %shGetProcAddress() failed on function '%s'. Possible reason: incorrect version of advpack.dll being used./Windows 95 or Windows NT is required to install" (Indicator: "GetProcAddress"; Source: "00000000-00003028.00000001.68977.012DA000.00000002.mdmp") Found reference to API "GetProcAddress" (Indicator: "GetProcAddress"; Source: "00000000-00003028.00000001.68977.012DA000.00000002.mdmp") Found reference to API "Error loading %shGetProcAddress() failed on function '%s'. Possible reason: incorrect version of advpack.dll being used./Windows 95 or Windows NT is required to install" (Indicator: "GetProcAddress"; Source: "00000000-00003316.00000002.70823.0034A000.00000002.mdmp") Found reference to API "GetProcAddress" (Indicator: "GetProcAddress"; Source: "00000000-00003316.00000002.70823.0034A000.00000002.mdmp")5e:Td3e,Found reference to API "GetFileAttributesA" (Indicator: "GetFileAttributes"; File: "wextract.exe") Found reference to API "GetSystemDirectoryA" (Indicator: "GetSystemDirectory"; File: "wextract.exe") Found reference to API "GetCurrentDirectoryA" (Indicator: "GetCurrentDirectory"; File: "wextract.exe") Found reference to API "GetTempPathA" (Indicator: "GetTempPath"; File: "wextract.exe") Found reference to API "GetTempFileNameA" (Indicator: "GetTempFileName"; File: "wextract.exe") Found reference to API "GetFileVersionInfoSizeA" (Indicator: "GetFileVersionInfo"; File: "wextract.exe") Found reference to API "GetFileVersionInfoSizeA" (Indicator: "GetFileVersionInfoSize"; File: "wextract.exe") Found reference to API "GetFileVersionInfoA" (Indicator: "GetFileVersionInfo"; File: "wextract.exe") Found reference to API "GetFileSizeEx" (Indicator: "GetFileSize"; Source: "00000000-00001912.00000000.68222.00400000.00000040.mdmp, 00000000-00001912.00000001.70142.00400000.00000040.mdmp, 00000000-00001912.00000002.72061.00160000.00000040.mdmp") Found reference to API "GetFileAttributesA" (Indicator: "GetFileAttributes"; Source: "00000000-00003028.00000001.68977.012DA000.00000002.mdmp") Found reference to API "GetSystemDirectoryA" (Indicator: "GetSystemDirectory"; Source: "00000000-00003028.00000001.68977.012DA000.00000002.mdmp") Found reference to API "GetCurrentDirectoryA" (Indicator: "GetCurrentDirectory"; Source: "00000000-00003028.00000001.68977.012DA000.00000002.mdmp") Found reference to API "GetTempPathA" (Indicator: "GetTempPath"; Source: "00000000-00003028.00000001.68977.012DA000.00000002.mdmp") Found reference to API "GetTempFileNameA" (Indicator: "GetTempFileName"; Source: "00000000-00003028.00000001.68977.012DA000.00000002.mdmp") Found reference to API "GetFileVersionInfoSizeA" (Indicator: "GetFileVersionInfo"; Source: "00000000-00003028.00000001.68977.012DA000.00000002.mdmp") Found reference to API "GetFileVersionInfoSizeA" (Indicator: "GetFileVersionInfoSize"; Source: "00000000-00003028.00000001.68977.012DA000.00000002.mdmp") Found reference to API "GetFileVersionInfoA" (Indicator: "GetFileVersionInfo"; Source: "00000000-00003028.00000001.68977.012DA000.00000002.mdmp") Found reference to API "GetFileAttributesA" (Indicator: "GetFileAttributes"; Source: "00000000-00003316.00000002.70823.0034A000.00000002.mdmp") Found reference to API "GetSystemDirectoryA" (Indicator: "GetSystemDirectory"; Source: "00000000-00003316.00000002.70823.0034A000.00000002.mdmp") Found reference to API "GetCurrentDirectoryA" (Indicator: "GetCurrentDirectory"; Source: "00000000-00003316.00000002.70823.0034A000.00000002.mdmp") Found reference to API "GetTempPathA" (Indicator: "GetTempPath"; Source: "00000000-00003316.00000002.70823.0034A000.00000002.mdmp") Found reference to API "GetTempFileNameA" (Indicator: "GetTempFileName"; Source: "00000000-00003316.00000002.70823.0034A000.00000002.mdmp") Found reference to API "GetFileVersionInfoSizeA" (Indicator: "GetFileVersionInfo"; Source: "00000000-00003316.00000002.70823.0034A000.00000002.mdmp") Found reference to API "GetFileVersionInfoSizeA" (Indicator: "GetFileVersionInfoSize"; Source: "00000000-00003316.00000002.70823.0034A000.00000002.mdmp") Found reference to API "GetFileVersionInfoA" (Indicator: "GetFileVersionInfo"; Source: "00000000-00003316.00000002.70823.0034A000.00000002.mdmp")5f:T667,Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; File: "wextract.exe") Found reference to API "OpenProcessToken" (Indicator: "OpenProcessToken"; File: "wextract.exe") file/memory contains long string with (Indicator: "OpenProcessToken"; File: "wextract.exe") Found reference to API "GetUserObjectInformationA" (Indicator: "GetUserObjectInformation"; File: "2cV9250.exe.1068760659") Found reference to API "GetProcessWindowStation" (Indicator: "GetProcessWindowStation"; File: "2cV9250.exe.1068760659") Found reference to API "GetUserNameW" (Indicator: "GetUserName"; Source: "00000000-00001912.00000000.68222.00400000.00000040.mdmp, 00000000-00001912.00000001.70142.00400000.00000040.mdmp, 00000000-00001912.00000002.72061.00160000.00000040.mdmp") file/memory contains long string with (Indicator: "OpenProcessToken"; Source: "00000000-00003028.00000001.68977.012DA000.00000002.mdmp") Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; Source: "00000000-00003028.00000001.68977.012DA000.00000002.mdmp") Found reference to API "OpenProcessToken" (Indicator: "OpenProcessToken"; Source: "00000000-00003028.00000001.68977.012DA000.00000002.mdmp") file/memory contains long string with (Indicator: "OpenProcessToken"; Source: "00000000-00003316.00000002.70823.0034A000.00000002.mdmp") Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; Source: "00000000-00003316.00000002.70823.0034A000.00000002.mdmp") Found reference to API "OpenProcessToken" (Indicator: "OpenProcessToken"; Source: "00000000-00003316.00000002.70823.0034A000.00000002.mdmp")60:T11a7,Found string ":\Windows\System32\DriverStore" (Indicator: "system32\drivers"; Source: "00000000-00001912.00000000.68222.002B0000.00000004.mdmp, 00000000-00001912.00000001.70142.002B0000.00000004.mdmp, 00000000-00001912.00000002.72061.002B0000.00000004.mdmp") Found string ":\Windows\System32\DriverStore\infpub.dat" (Indicator: "system32\drivers"; Source: "00000000-00001912.00000000.68222.002B0000.00000004.mdmp, 00000000-00001912.00000001.70142.002B0000.00000004.mdmp, 00000000-00001912.00000002.72061.002B0000.00000004.mdmp") Found string ":\Windows\System32\DriverStore\infstor.dat" (Indicator: "system32\drivers"; Source: "00000000-00001912.00000000.68222.002B0000.00000004.mdmp, 00000000-00001912.00000001.70142.002B0000.00000004.mdmp, 00000000-00001912.00000002.72061.002B0000.00000004.mdmp") Found string ":\Windows\System32\DriverStore\infstrng.dat" (Indicator: "system32\drivers"; Source: "00000000-00001912.00000000.68222.002B0000.00000004.mdmp, 00000000-00001912.00000001.70142.002B0000.00000004.mdmp, 00000000-00001912.00000002.72061.002B0000.00000004.mdmp") Found string ":\Windows\System32\DriverStore\drvindex.dat" (Indicator: "system32\drivers"; Source: "00000000-00001912.00000000.68222.002B0000.00000004.mdmp, 00000000-00001912.00000001.70142.002B0000.00000004.mdmp, 00000000-00001912.00000002.72061.002B0000.00000004.mdmp") Found string ":\Windows\System32\DriverStore\FileRepository" (Indicator: "system32\drivers"; Source: "00000000-00001912.00000000.68222.002B0000.00000004.mdmp, 00000000-00001912.00000001.70142.002B0000.00000004.mdmp, 00000000-00001912.00000002.72061.002B0000.00000004.mdmp") Found string "\Device\HarddiskVolume2\Users\HAPUBWS\AppData\Local\Temp\IXP002.TMP\2cV9250.exe" (Indicator: "\Device\"; Source: "00000000-00001912.00000000.68222.002FC000.00000040.mdmp, 00000000-00001912.00000001.70142.002FC000.00000040.mdmp") Found string ":\Windows\System32\DriverStore" (Indicator: "system32\drivers"; Source: "00000000-00003028.00000000.67057.00350000.00000004.mdmp, 00000000-00003028.00000001.68977.00350000.00000004.mdmp") Found string ":\Windows\System32\DriverStore\infpub.dat" (Indicator: "system32\drivers"; Source: "00000000-00003028.00000000.67057.00350000.00000004.mdmp, 00000000-00003028.00000001.68977.00350000.00000004.mdmp") Found string ":\Windows\System32\DriverStore\infstor.dat" (Indicator: "system32\drivers"; Source: "00000000-00003028.00000000.67057.00350000.00000004.mdmp, 00000000-00003028.00000001.68977.00350000.00000004.mdmp") Found string ":\Windows\System32\DriverStore\infstrng.dat" (Indicator: "system32\drivers"; Source: "00000000-00003028.00000000.67057.00350000.00000004.mdmp, 00000000-00003028.00000001.68977.00350000.00000004.mdmp") Found string ":\Windows\System32\DriverStore\drvindex.dat" (Indicator: "system32\drivers"; Source: "00000000-00003028.00000000.67057.00350000.00000004.mdmp, 00000000-00003028.00000001.68977.00350000.00000004.mdmp") Found string ":\Windows\System32\DriverStore\FileRepository" (Indicator: "system32\drivers"; Source: "00000000-00003028.00000000.67057.00350000.00000004.mdmp, 00000000-00003028.00000001.68977.00350000.00000004.mdmp") Found string "\Device\HarddiskVolume2\Users\HAPUBWS\AppData\Local\Temp\IXP001.TMP\ZP6rv89.exe" (Indicator: "\Device\"; Source: "00000000-00003028.00000000.67057.00350000.00000004.mdmp, 00000000-00003028.00000001.68977.00350000.00000004.mdmp") Found string ":\Windows\System32\DriverStore" (Indicator: "system32\drivers"; Source: "00000000-00003316.00000001.68903.00110000.00000004.mdmp") Found string ":\Windows\System32\DriverStore\infpub.dat" (Indicator: "system32\drivers"; Source: "00000000-00003316.00000001.68903.00110000.00000004.mdmp") Found string ":\Windows\System32\DriverStore\infstor.dat" (Indicator: "system32\drivers"; Source: "00000000-00003316.00000001.68903.00110000.00000004.mdmp") Found string ":\Windows\System32\DriverStore\infstrng.dat" (Indicator: "system32\drivers"; Source: "00000000-00003316.00000001.68903.00110000.00000004.mdmp") Found string ":\Windows\System32\DriverStore\drvindex.dat" (Indicator: "system32\drivers"; Source: "00000000-00003316.00000001.68903.00110000.00000004.mdmp") Found string ":\Windows\System32\DriverStore\FileRepository" (Indicator: "system32\drivers"; Source: "00000000-00003316.00000001.68903.00110000.00000004.mdmp") Found string "\Device\HarddiskVolume2\Users\HAPUBWS\AppData\Local\Temp\IXP000.TMP\cZ5oz01.exe" (Indicator: "\Device\"; Source: "00000000-00003316.00000001.68903.00110000.00000004.mdmp")61:T7d5,Found reference to API "CheckTokenMembership" (Indicator: "CheckTokenMembership"; File: "wextract.exe") Found reference to API "SeShutdownPrivilege" (Indicator: "SeShutdownPrivilege"; File: "wextract.exe") Found reference to API "LookupPrivilegeValueA" (Indicator: "LookupPrivilegeValue"; File: "wextract.exe") Found reference to API "AdjustTokenPrivileges" (Indicator: "AdjustTokenPrivileges"; File: "wextract.exe") file/memory contains long string with (Indicator: "AdjustTokenPrivileges"; File: "wextract.exe") file/memory contains long string with (Indicator: "AdjustTokenPrivileges"; Source: "00000000-00003028.00000001.68977.012DA000.00000002.mdmp") Found reference to API "LookupPrivilegeValueA" (Indicator: "LookupPrivilegeValue"; Source: "00000000-00003028.00000001.68977.012DA000.00000002.mdmp") Found reference to API "AdjustTokenPrivileges" (Indicator: "AdjustTokenPrivileges"; Source: "00000000-00003028.00000001.68977.012DA000.00000002.mdmp") Found reference to API "CheckTokenMembership" (Indicator: "CheckTokenMembership"; Source: "00000000-00003028.00000002.70898.012D1000.00000020.mdmp") Found reference to API "SeShutdownPrivilege" (Indicator: "SeShutdownPrivilege"; Source: "00000000-00003028.00000002.70898.012D1000.00000020.mdmp") Found reference to API "CheckTokenMembership" (Indicator: "CheckTokenMembership"; Source: "00000000-00003316.00000000.66984.00341000.00000020.mdmp") Found reference to API "SeShutdownPrivilege" (Indicator: "SeShutdownPrivilege"; Source: "00000000-00003316.00000000.66984.00341000.00000020.mdmp") file/memory contains long string with (Indicator: "AdjustTokenPrivileges"; Source: "00000000-00003316.00000002.70823.0034A000.00000002.mdmp") Found reference to API "LookupPrivilegeValueA" (Indicator: "LookupPrivilegeValue"; Source: "00000000-00003316.00000002.70823.0034A000.00000002.mdmp") Found reference to API "AdjustTokenPrivileges" (Indicator: "AdjustTokenPrivileges"; Source: "00000000-00003316.00000002.70823.0034A000.00000002.mdmp")62:T75a,Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; File: "wextract.exe") Found reference to API "FreeSid" (Indicator: "FreeSid"; File: "wextract.exe") Found reference to API "AllocateAndInitializeSid" (Indicator: "AllocateAndInitializeSid"; File: "wextract.exe") Found reference to API "AllocateAndInitializeSid" (Indicator: "InitializeSid"; File: "wextract.exe") Found reference to API "EqualSid" (Indicator: "EqualSid"; File: "wextract.exe") Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; Source: "00000000-00003028.00000001.68977.012DA000.00000002.mdmp") Found reference to API "FreeSid" (Indicator: "FreeSid"; Source: "00000000-00003028.00000001.68977.012DA000.00000002.mdmp") Found reference to API "AllocateAndInitializeSid" (Indicator: "AllocateAndInitializeSid"; Source: "00000000-00003028.00000001.68977.012DA000.00000002.mdmp") Found reference to API "AllocateAndInitializeSid" (Indicator: "InitializeSid"; Source: "00000000-00003028.00000001.68977.012DA000.00000002.mdmp") Found reference to API "EqualSid" (Indicator: "EqualSid"; Source: "00000000-00003028.00000001.68977.012DA000.00000002.mdmp") Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; Source: "00000000-00003316.00000002.70823.0034A000.00000002.mdmp") Found reference to API "FreeSid" (Indicator: "FreeSid"; Source: "00000000-00003316.00000002.70823.0034A000.00000002.mdmp") Found reference to API "AllocateAndInitializeSid" (Indicator: "AllocateAndInitializeSid"; Source: "00000000-00003316.00000002.70823.0034A000.00000002.mdmp") Found reference to API "AllocateAndInitializeSid" (Indicator: "InitializeSid"; Source: "00000000-00003316.00000002.70823.0034A000.00000002.mdmp") Found reference to API "EqualSid" (Indicator: "EqualSid"; Source: "00000000-00003316.00000002.70823.0034A000.00000002.mdmp")63:T64e,Found reference to API "ExitProcess" (Indicator: "ExitProcess"; File: "wextract.exe") Found reference to API "TerminateProcess" (Indicator: "TerminateProcess"; File: "wextract.exe") Found reference to API "CorExitProcess" (Indicator: "ExitProcess"; File: "00000000-00001912.00000000.68222.00400000.00000040.mdmp") Found reference to API "CorExitProcess" (Indicator: "ExitProcess"; Source: "00000000-00001912.00000000.68222.00400000.00000040.mdmp, 00000000-00001912.00000001.70142.00400000.00000040.mdmp, 00000000-00001912.00000002.72061.00160000.00000040.mdmp") Found reference to API "ExitProcess" (Indicator: "ExitProcess"; Source: "00000000-00001912.00000000.68222.00400000.00000040.mdmp, 00000000-00001912.00000001.70142.00400000.00000040.mdmp, 00000000-00001912.00000002.72061.00160000.00000040.mdmp") Found reference to API "TerminateProcess" (Indicator: "TerminateProcess"; Source: "00000000-00001912.00000000.68222.00400000.00000040.mdmp, 00000000-00001912.00000001.70142.00400000.00000040.mdmp, 00000000-00001912.00000002.72061.00160000.00000040.mdmp") Found reference to API "ExitProcess" (Indicator: "ExitProcess"; Source: "00000000-00003028.00000001.68977.012DA000.00000002.mdmp") Found reference to API "TerminateProcess" (Indicator: "TerminateProcess"; Source: "00000000-00003028.00000001.68977.012DA000.00000002.mdmp") Found reference to API "ExitProcess" (Indicator: "ExitProcess"; Source: "00000000-00003316.00000002.70823.0034A000.00000002.mdmp") Found reference to API "TerminateProcess" (Indicator: "TerminateProcess"; Source: "00000000-00003316.00000002.70823.0034A000.00000002.mdmp")64:T113a,Observed import api "AllocateAndInitializeSid" which can "Allocates and initializes a security identifier (SID) with up to eight subauthorities" [Source: wextract.exe] Observed import api "EqualSid" which can "Tests two security identifier (SID) values for equality" [Source: wextract.exe] Observed import api "FreeSid" which can "Frees a security identifier (SID) previously allocated by using the AllocateAndInitializeSid function" [Source: wextract.exe] Observed import api "GetTokenInformation" which can "Retrieves a specified type of information about an access token" [Source: wextract.exe] Observed import api "InitializeSid" which can "Initializes a security identifier (SID)" [Source: wextract.exe] Observed import api "AllocateAndInitializeSid" which can "Allocates and initializes a security identifier (SID) with up to eight subauthorities" [Source: cZ5oz01.exe] Observed import api "EqualSid" which can "Tests two security identifier (SID) values for equality" [Source: cZ5oz01.exe] Observed import api "FreeSid" which can "Frees a security identifier (SID) previously allocated by using the AllocateAndInitializeSid function" [Source: cZ5oz01.exe] Observed import api "GetTokenInformation" which can "Retrieves a specified type of information about an access token" [Source: cZ5oz01.exe] Observed import api "InitializeSid" which can "Initializes a security identifier (SID)" [Source: cZ5oz01.exe] Observed import api "AddAce" which can "Adds one or more access control entries (ACEs) to a specified access control list (ACL)" [Source: 1Pe57AQ7.exe] Observed import api "AllocateAndInitializeSid" which can "Allocates and initializes a security identifier (SID) with up to eight subauthorities" [Source: 1Pe57AQ7.exe] Observed import api "CheckTokenMembership" which can "Determines whether a specified security identifier (SID) is enabled in an access token" [Source: 1Pe57AQ7.exe] Observed import api "CopySid" which can "Copies a security identifier (SID) to a buffer" [Source: 1Pe57AQ7.exe] Observed import api "DuplicateToken" which can "Creates a new access token that duplicates one already in existence" [Source: 1Pe57AQ7.exe] Observed import api "DuplicateTokenEx" which can "Creates a new access token that duplicates an existing token" [Source: 1Pe57AQ7.exe] Observed import api "FreeSid" which can "Frees a security identifier (SID) previously allocated by using the AllocateAndInitializeSid function" [Source: 1Pe57AQ7.exe] Observed import api "GetAce" which can "Obtains a pointer to an access control entry (ACE) in an access control list (ACL)" [Source: 1Pe57AQ7.exe] Observed import api "GetAclInformation" which can "Retrieves information about an access control list (ACL)" [Source: 1Pe57AQ7.exe] Observed import api "GetLengthSid" which can "Returns the length in bytes of a valid security identifier (SID)" [Source: 1Pe57AQ7.exe] Observed import api "GetSecurityDescriptorDacl" which can "Retrieves a pointer to the discretionary access control list (DACL) in a specified security descriptor" [Source: 1Pe57AQ7.exe] Observed import api "GetTokenInformation" which can "Retrieves a specified type of information about an access token" [Source: 1Pe57AQ7.exe] Observed import api "InitializeAcl" which can "Initializes a new ACL structure" [Source: 1Pe57AQ7.exe] Observed import api "InitializeSecurityDescriptor" which can "Initializes a new security descriptor" [Source: 1Pe57AQ7.exe] Observed import api "InitializeSid" which can "Initializes a security identifier (SID)" [Source: 1Pe57AQ7.exe] Observed import api "SetSecurityDescriptorDacl" which can "Sets information in a discretionary access control list (DACL)" [Source: 1Pe57AQ7.exe] Observed import api "AllocateAndInitializeSid" which can "Allocates and initializes a security identifier (SID) with up to eight subauthorities" [Source: ZP6rv89.exe] Observed import api "EqualSid" which can "Tests two security identifier (SID) values for equality" [Source: ZP6rv89.exe] Observed import api "FreeSid" which can "Frees a security identifier (SID) previously allocated by using the AllocateAndInitializeSid function" [Source: ZP6rv89.exe] Observed import api "GetTokenInformation" which can "Retrieves a specified type of information about an access token" [Source: ZP6rv89.exe] Observed import api "InitializeSid" which can "Initializes a security identifier (SID)" [Source: ZP6rv89.exe]65:T937,"2cV9250.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK\PARAMETERS"; Key: "TRANSPORTS"; Value: "") "2cV9250.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP6\PARAMETERS\WINSOCK"; Key: "MAPPING"; Value: "") "2cV9250.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\PSCHED\PARAMETERS\WINSOCK"; Key: "MAPPING"; Value: "") "2cV9250.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK\SETUP MIGRATION\PROVIDERS\PSCHED"; Key: "WINSOCK 2.0 PROVIDER ID"; Value: "") "2cV9250.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\WINSOCK"; Key: "MAPPING"; Value: "") "2cV9250.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK\SETUP MIGRATION\PROVIDERS\TCPIP"; Key: "WINSOCK 2.0 PROVIDER ID"; Value: "") "2cV9250.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\WINSOCK"; Key: "MINSOCKADDRLENGTH"; Value: "") "2cV9250.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\WINSOCK"; Key: "MAXSOCKADDRLENGTH"; Value: "") "2cV9250.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\WINSOCK"; Key: "USEDELAYEDACCEPTANCE"; Value: "") "2cV9250.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\WINSOCK"; Key: "HELPERDLLNAME"; Value: "") "2cV9250.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK\SETUP MIGRATION\PROVIDERS\TCPIP6"; Key: "WINSOCK 2.0 PROVIDER ID"; Value: "") "2cV9250.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP6\PARAMETERS\WINSOCK"; Key: "MINSOCKADDRLENGTH"; Value: "") "2cV9250.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP6\PARAMETERS\WINSOCK"; Key: "MAXSOCKADDRLENGTH"; Value: "") "2cV9250.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP6\PARAMETERS\WINSOCK"; Key: "USEDELAYEDACCEPTANCE"; Value: "") "2cV9250.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP6\PARAMETERS\WINSOCK"; Key: "HELPERDLLNAME"; Value: "") "2cV9250.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS"; Key: "HOSTNAME"; Value: "")66:T51c,"CabBEDF.tmp" has type "Microsoft Cabinet archive data Windows 2000/XP setup 66791 bytes 1 file at 0x2c +A "authroot.stl" number 1 6 datablocks 0x1 compression"- Location: [%TEMP%\CabBEDF.tmp]- [targetUID: 00000000-00002648] "57C8EDB95DF3F0AD4EE2DC2B8CFD4157" has type "Microsoft Cabinet archive data Windows 2000/XP setup 4770 bytes 1 file at 0x2c +A "disallowedcert.stl" number 1 1 datablock 0x1 compression"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\57C8EDB95DF3F0AD4EE2DC2B8CFD4157]- [targetUID: 00000000-00000540] "CabBC5C.tmp" has type "Microsoft Cabinet archive data Windows 2000/XP setup 66791 bytes 1 file at 0x2c +A "authroot.stl" number 1 6 datablocks 0x1 compression"- Location: [%TEMP%\CabBC5C.tmp]- [targetUID: 00000000-00002648] "77EC63BDA74BD0D0E0426DC8F8008506" has type "Microsoft Cabinet archive data Windows 2000/XP setup 66791 bytes 1 file at 0x2c +A "authroot.stl" number 1 6 datablocks 0x1 compression"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506]- [targetUID: 00000000-00002648] "CabA327.tmp" has type "Microsoft Cabinet archive data Windows 2000/XP setup 66791 bytes 1 file at 0x2c +A "authroot.stl" number 1 6 datablocks 0x1 compression"- Location: [%TEMP%\CabA327.tmp]- [targetUID: 00000000-00002672]67:T1472,Dropped file: "ML59MCK3.htm" - Location: [%LOCALAPPDATA%\Microsoft\Windows\Temporary Internet Files\Content.IE5\QQW0X29Y\ML59MCK3.htm]- [targetUID: 00000000-00002672] Dropped file: "imagestore.dat" - Location: [%LOCALAPPDATA%\Microsoft\Internet Explorer\imagestore\3mt7jhv\imagestore.dat]- [targetUID: 00000000-00003116] Dropped file: "en-US.4" - Location: [%LOCALAPPDATA%\Microsoft\Internet Explorer\DomainSuggestions\en-US.4]- [targetUID: 00000000-00002648] Dropped file: "70DAE932E3BCB3C00656A27B544BA9CA" - Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\70DAE932E3BCB3C00656A27B544BA9CA]- [targetUID: 00000000-00000540] Dropped file: "739F2FF4259CDC6CBE7B90F1A95601EF" - Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\739F2FF4259CDC6CBE7B90F1A95601EF]- [targetUID: 00000000-00001232] Dropped file: "57C8EDB95DF3F0AD4EE2DC2B8CFD4157" - Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\57C8EDB95DF3F0AD4EE2DC2B8CFD4157]- [targetUID: 00000000-00000540] Dropped file: "24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA" - Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA]- [targetUID: 00000000-00000540] Dropped file: "AE583B12017CC3ACE1D659336529BFB3" - Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\AE583B12017CC3ACE1D659336529BFB3]- [targetUID: 00000000-00003748] Dropped file: "4748633DC5731827D4B432DBAC7A3ECE" - Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\4748633DC5731827D4B432DBAC7A3ECE]- [targetUID: 00000000-00000540] Dropped file: "0270780F846F08BEFE0DD8112D932FEF" - Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\0270780F846F08BEFE0DD8112D932FEF]- [targetUID: 00000000-00003116] Dropped file: "CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA" - Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA]- [targetUID: 00000000-00000540] Dropped file: "6B2043001D270792DFFD725518EAFE2C" - Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\6B2043001D270792DFFD725518EAFE2C]- [targetUID: 00000000-00002648] Dropped file: "4H697AIP.txt" - Location: [%APPDATA%\Microsoft\Windows\Cookies\4H697AIP.txt]- [targetUID: 00000000-00000540] Dropped file: "M2ND1T0S.txt" - Location: [%APPDATA%\Microsoft\Windows\Cookies\M2ND1T0S.txt]- [targetUID: 00000000-00003748] Dropped file: "EDC238BFF48A31D55A97E1E93892934B_C31B2498754E340573F1336DE607D619" - Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\EDC238BFF48A31D55A97E1E93892934B_C31B2498754E340573F1336DE607D619]- [targetUID: 00000000-00003116] Dropped file: "E2C6CBAF0AF08CF203BA74BF0D0AB6D5_49536AB5156BDD74EFF881D01C36A419" - Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_49536AB5156BDD74EFF881D01C36A419]- [targetUID: 00000000-00002404] Dropped file: "80237EE4964FC9C409AAF55BF996A292_D46D6FA25B74360E1349F9015B5CCE53" - Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\80237EE4964FC9C409AAF55BF996A292_D46D6FA25B74360E1349F9015B5CCE53]- [targetUID: 00000000-00002672] Dropped file: "E2C6CBAF0AF08CF203BA74BF0D0AB6D5_0FB9553B978E7F00C6B2309507DEB64A" - Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_0FB9553B978E7F00C6B2309507DEB64A]- [targetUID: 00000000-00002672] Dropped file: "80237EE4964FC9C409AAF55BF996A292_C5130A0BDC8C859A2757D77746C10868" - Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\80237EE4964FC9C409AAF55BF996A292_C5130A0BDC8C859A2757D77746C10868]- [targetUID: 00000000-00002672] Dropped file: "59D76868C250B3240414CE3EFBB12518_DB3354A21B46C492983D8DC6E09DCFAD" - Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\59D76868C250B3240414CE3EFBB12518_DB3354A21B46C492983D8DC6E09DCFAD]- [targetUID: 00000000-00002404] Dropped file: "F2DDCD2B5F37625B82E81F4976CEE400_BFB422D89E28A298A60024A8D8A2EA06" - Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\F2DDCD2B5F37625B82E81F4976CEE400_BFB422D89E28A298A60024A8D8A2EA06]- [targetUID: 00000000-00000540] Dropped file: "E573CDF4C6D731D56A665145182FD759_E391470CF0D37EE71D631C107209CEFF" - Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\E573CDF4C6D731D56A665145182FD759_E391470CF0D37EE71D631C107209CEFF]- [targetUID: 00000000-00003116] Dropped file: "7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776" - Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776]- [targetUID: 00000000-00002404] Dropped file: "B398B80134F72209547439DB21AB308D_A4CF52CCA82D7458083F7280801A3A04" - Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\B398B80134F72209547439DB21AB308D_A4CF52CCA82D7458083F7280801A3A04]- [targetUID: 00000000-00003116] Dropped file: "35DDEDF268117918D1D277A171D8DF7B_EBDE77CB467169C3928F012A05185035" - Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\35DDEDF268117918D1D277A171D8DF7B_EBDE77CB467169C3928F012A05185035]- [targetUID: 00000000-00001232]68:T606,"new_login_bg_strong_mask_1_.jpg" has type "JPEG image data Exif standard: [TIFF image data little-endian direntries=0] baseline precision 8 1920x1080 components 3" and extension "jpg" "header_logo_1_.png" has type "PNG image data 744 x 171 8-bit/color RGBA non-interlaced" and extension "png" "Y0L6f5sxdIV_1_.png" has type "PNG image data 283 x 315 8-bit colormap non-interlaced" and extension "png" "header_menu_hamburger_1_.png" has type "PNG image data 244 x 212 8-bit/color RGBA non-interlaced" and extension "png" "logo_steam_footer_1_.png" has type "PNG image data 92 x 26 8-bit/color RGBA non-interlaced" and extension "png" "footerLogo_valve_new_1_.png" has type "PNG image data 176 x 50 8-bit/color RGBA non-interlaced" and extension "png" "logo_valve_footer_1_.png" has type "PNG image data 92 x 26 8-bit/color RGBA non-interlaced" and extension "png" "ico_twitter_1_.png" has type "PNG image data 16 x 16 8-bit/color RGBA non-interlaced" and extension "png" "ico_facebook_1_.png" has type "PNG image data 16 x 16 8-bit/color RGBA non-interlaced" and extension "png" "logo46x38_1_.png" has type "PNG image data 46 x 38 8-bit/color RGBA non-interlaced" and extension "png" "btn_header_installsteam_download_1_.png" has type "PNG image data 15 x 13 8-bit/color RGBA non-interlaced" and extension "png" "btn_arrow_down_padded_1_.png" has type "PNG image data 19 x 12 8-bit/color RGBA non-interlaced" and extension "png" "O7nelmd9XSI_1_.png" has type "PNG image data 1 x 1 1-bit colormap non-interlaced" and extension "png"69:T43f,"2cV9250.exe" queried SystemProcessInformation at 00000000-00001912-00000105-28145463 [PID: 1912] "2cV9250.exe" queried SystemProcessInformation at 00000000-00001912-00000105-68652881 [PID: 1912] "2cV9250.exe" queried SystemProcessInformation at 00000000-00001912-00000105-70575356 [PID: 1912] "2cV9250.exe" queried SystemProcessInformation at 00000000-00001912-00000105-72026503 [PID: 1912] "2cV9250.exe" queried SystemProcessInformation at 00000000-00001912-00000105-73370096 [PID: 1912] "2cV9250.exe" queried SystemProcessInformation at 00000000-00001912-00000105-74565592 [PID: 1912] "2cV9250.exe" queried SystemProcessInformation at 00000000-00001912-00000105-75744603 [PID: 1912] "2cV9250.exe" queried SystemProcessInformation at 00000000-00001912-00000105-76677079 [PID: 1912] "2cV9250.exe" queried SystemProcessInformation at 00000000-00001912-00000105-77967274 [PID: 1912] "2cV9250.exe" queried SystemProcessInformation at 00000000-00001912-00000105-78842922 [PID: 1912] "2cV9250.exe" queried SystemProcessInformation at 00000000-00001912-00000105-80277203 [PID: 1912]6a:T4001,"initAft()