26:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js","/_next/static/chunks/1w1axrg6kzses.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/1kn_tf3p-ubex.js","/_next/static/chunks/1wq095nwqbaw1.js"],"SampleDetailWrapper"] 7c:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js"],"IconMark"] 25:T48f,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious TR/Dldr.Agent_AGen Sample bc5d2f1649b9… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample bc5d2f1649b9…. Malware family: TR/Dldr.Agent_AGen. Threat score 100/100. 3/28 AV engines flagged this file. 16 malicious and 19 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/bc5d2f1649b96a8d50cf4f7184f421a073c0e653d25a068222ecb40b253b53ca","keywords":["Malicious","TR/Dldr.Agent_AGen","malware analysis","sandbox report","threat intelligence","bc5d2f1649b96a8d50cf4f7184f421a073c0e653d25a068222ecb40b253b53ca"],"about":{"@type":"SoftwareApplication","name":"file","applicationCategory":["peexe","executable"],"identifier":"bc5d2f1649b96a8d50cf4f7184f421a073c0e653d25a068222ecb40b253b53ca","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"TR/Dldr.Agent_AGen","antivirusDetections":{"malicious":3,"total":28},"behavioralIndicators":{"malicious":16,"suspicious":19},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}27:T98a,"file.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '13223968'}" (UID: 00000000-00000928) "file.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '13223936'}" (UID: 00000000-00000928) "file.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '13223984'}" (UID: 00000000-00000928) "file.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '13224032'}" (UID: 00000000-00000928) "file.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '13223904'}" (UID: 00000000-00000928) "file.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '13224016'}" (UID: 00000000-00000928) "file.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '13224048'}" (UID: 00000000-00000928) "file.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '13224000'}" (UID: 00000000-00000928) "xX1Zl63.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '3131472'}" (UID: 00000000-00002736) "xX1Zl63.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '3131504'}" (UID: 00000000-00002736) "xX1Zl63.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '3131488'}" (UID: 00000000-00002736) "xX1Zl63.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '3131456'}" (UID: 00000000-00002736) "xX1Zl63.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '3131408'}" (UID: 00000000-00002736) "VW6ig05.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '9750608'}" (UID: 00000000-00003088) "VW6ig05.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '9750640'}" (UID: 00000000-00003088) "VW6ig05.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '9750624'}" (UID: 00000000-00003088) "VW6ig05.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '9750544'}" (UID: 00000000-00003088) "VW6ig05.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '9750592'}" (UID: 00000000-00003088) "Dk2ox03.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '11126864'}" (UID: 00000000-00003452) "Dk2ox03.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '11126896'}" (UID: 00000000-00003452) "Dk2ox03.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '11126880'}" (UID: 00000000-00003452)28:T505,Found reference to API "CreateThread" (Indicator: "CreateThread"; File: "file") Found reference to API "VirtualFree" (Indicator: "VirtualFree"; File: "2St5480.exe.1666954272") Found reference to API "VirtualAlloc" (Indicator: "VirtualAlloc"; File: "2St5480.exe.1666954272") Found reference to API "WriteProcessMemory" (Indicator: "WriteProcessMemory"; File: "explothe.exe.322908262") Found reference to API "VirtualAllocEx" (Indicator: "VirtualAlloc"; File: "explothe.exe.322908262") Found reference to API "VirtualAllocEx" (Indicator: "VirtualAllocEx"; File: "explothe.exe.322908262") Found reference to API "CreateThreadpoolWork" (Indicator: "CreateThread"; Source: "00000000-00000876.00000000.67434.00D99000.00000002.mdmp") Found reference to API "CreateThreadpoolTimer" (Indicator: "CreateThread"; Source: "00000000-00000876.00000000.67434.00D99000.00000002.mdmp") Found reference to API "CreateThreadpoolWait" (Indicator: "CreateThread"; Source: "00000000-00000876.00000000.67434.00D99000.00000002.mdmp") Found reference to API "CreateThread" (Indicator: "CreateThread"; Source: "00000000-00000876.00000000.67434.00D99000.00000002.mdmp") Found reference to API "CreateThread" (Indicator: "CreateThread"; Source: "00000000-00000928.00000000.66890.00C9A000.00000002.mdmp")29:T55d,Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; File: "file") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; File: "file") Found reference to API "LoadLibraryExA" (Indicator: "LoadLibrary"; File: "file") Found reference to API "FreeLibraryWhenCallbackReturns" (Indicator: "FreeLibrary"; Source: "00000000-00000876.00000000.67434.00D99000.00000002.mdmp") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; Source: "00000000-00000876.00000000.67434.00D99000.00000002.mdmp") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; Source: "00000000-00000876.00000000.67434.00D99000.00000002.mdmp") Found reference to API "FreeLibraryAndExitThread" (Indicator: "FreeLibrary"; Source: "00000000-00000876.00000000.67434.00D99000.00000002.mdmp") Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; Source: "00000000-00000928.00000000.66890.00070000.00000004.mdmp, 00000000-00000928.00000000.66890.00C9A000.00000002.mdmp, 00000000-00000928.00000001.68810.00070000.00000004.mdmp, 00000000-00000928.00000002.70098.00070000.00000004.mdmp") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; Source: "00000000-00000928.00000000.66890.00C9A000.00000002.mdmp") Found reference to API "LoadLibraryExA" (Indicator: "LoadLibrary"; Source: "00000000-00000928.00000000.66890.00C9A000.00000002.mdmp")2a:T4ca,file/memory contains long string with (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+"; File: "2St5480.exe") file/memory contains long string with (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"; File: "2St5480.exe") file/memory contains long string with (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+"; File: "clip.dll") file/memory contains long string with (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"; File: "clip.dll") file/memory contains long string with (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+"; File: "_tJ17sGyxOX_1_.js") file/memory contains long string with (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"; File: "_tJ17sGyxOX_1_.js") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+"; File: "2St5480.exe.1666954272") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"; File: "2St5480.exe.1666954272")2b:T147e,Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00000928-50449-29-00C952B6 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00000928-50449-29-00C952B6 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00000928-50449-74-00C936EE Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00000928-50449-74-00C936EE Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00000928-50449-26-00C924E0 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00000928-50449-26-00C924E0 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00000928-50449-41-00C96495 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00000928-50449-41-00C96495 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00000928-50449-72-00C918A3 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00000928-50449-72-00C918A3 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00000928-50449-65-00C953A1 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00000928-50449-65-00C953A1 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00000928-50449-16-00C944B9 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00000928-50449-16-00C944B9 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00000928-50449-15-00C91F90 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00000928-50449-15-00C91F90 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00000928-50449-66-00C92630 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00000928-50449-66-00C92630 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00000928-50449-33-00C92F1D Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00000928-50449-33-00C92F1D Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00000928-50449-42-00C9202A Assembly shows XOR instruction xor eax 01h in Stream UID: 00000000-00000928-50449-42-00C9202A Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00000928-50449-42-00C9202A Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00000928-50449-63-00C95467 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00000928-50449-63-00C95467 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00000928-50449-71-00C92CAA Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00000928-50449-71-00C92CAA Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00000928-50449-52-00C94EFD Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00000928-50449-52-00C94EFD Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00000928-50449-62-00C955A0 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00000928-50449-62-00C955A0 Assembly shows XOR instruction xor eax esp in Stream UID: 00000000-00000928-50449-36-00C93BA2 Assembly shows XOR instruction xor ecx esp in Stream UID: 00000000-00000928-50449-36-00C93BA2 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00000928-50449-37-00C93FEF Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00000928-50449-37-00C93FEF Assembly shows XOR instruction xor eax dword ptr [ebp-0Ch] in Stream UID: 00000000-00000928-50449-83-00C97155 Assembly shows XOR instruction xor dword ptr [ebp-04h] eax in Stream UID: 00000000-00000928-50449-83-00C97155 Assembly shows XOR instruction xor eax dword ptr [ebp-04h] in Stream UID: 00000000-00000928-50449-83-00C97155 Assembly shows XOR instruction xor eax ecx in Stream UID: 00000000-00000928-50449-83-00C97155 Assembly shows XOR instruction xor eax dword ptr [ebp-14h] in Stream UID: 00000000-00000928-50449-83-00C97155 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00000928-50449-59-00C9621E Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00000928-50449-59-00C9621E Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00000928-50449-43-00C91AE8 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00000928-50449-43-00C91AE8 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00000928-50449-40-00C92267 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00000928-50449-40-00C92267 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00000928-50449-78-00C95C9E Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00000928-50449-78-00C95C9E Assembly shows XOR instruction xor eax esp in Stream UID: 00000000-00000928-50449-31-00C92390 Assembly shows XOR instruction xor ecx esp in Stream UID: 00000000-00000928-50449-31-00C92390 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00000928-50449-77-00C92773 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00000928-50449-77-00C92773 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00000928-50449-22-00C9681F Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00000928-50449-22-00C9681F2c:T18a8,"file.exe" called "RtlGetVersion" with parameter 000000000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00000928) "xX1Zl63.exe" called "RtlGetVersion" with parameter 000000000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00002736) "VW6ig05.exe" called "RtlGetVersion" with parameter 000000000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00003088) "Dk2ox03.exe" called "RtlGetVersion" with parameter 000000000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00003452) "qj9aa78.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000001e00000048201f0000001f0048211f000000ef000000000000000000000000000200000000f117001e0000001e0000001768d87750201f0000000000435cd8771b9af8770000000074021f0000001f0050011f000000ef000000000050011f0054f0170078011f0080f01700020000000000ef0050011f0020000000a8ea2300a0f0170020000000d8f017001e000000d8f01700531ad9770000ef00471bd9770000000002000002a8cf23003a00003aa0010500b2f4d877000000008000000000004e0036270011 (UID: 00000000-00003976) "3Fs87VT.exe" called "RtlGetVersion" with parameter 000000000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00000876) "4AR077QH.exe" called "RtlGetVersion" with parameter 000000000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00003276) "AppLaunch.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00003268) "AppLaunch.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b00200031000000000000000000000000000000000000320000000000000000000100000000000000001800010174ef2900d327176e00f1290095e1d4771400001418046200000000001664d877f0006200f0da6200140000008000000000000000e8da620088f02900f4c5ed77b80c62000100000014000000020000000c00000000005d001804620013046200000000005c7b170000005d0000000001f4ef2900b444176e14f6290095e1d4775ba12800feffffff435cd8775059d87794000000a000000012046200100462009400000098f12900fdfeed773cf1290040f129001000000001000000 (UID: 00000000-00003268) "AppLaunch.exe" called "RtlGetVersion" with parameter 140100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00003268)2d:T2062,"qj9aa78.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b20310000e10000000000000050201f00ca201f006600000050201f00420000000300000000000000f0000000ff010000a0f11700c0d10d7750201f00e1000000f4f1170000000000d8f11700c4f117005617ef0050201f00e1000000f4f11700d8f1170050201f0010aa2500e2000000d3d80c76 (UID: 00000000-00003976) "AppLaunch.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b2031000000000000000001000000740014000000f0ba6200000000000100000001000000000000002c000000d8c7620000000000140000000a00000000000000000000000000750050cb62001400000000000000000000000000000000000000000000000032000000000000c4005d0075006200 (UID: 00000000-00003268) "AppLaunch.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b20310000fce729008a87af75f8716100ace82900980a4202980a4202000000002c30af75b2f4d8774f5bd97794e8290000000e6500000e65fce7290024e82900f0000000f0000e650000000000e829000000000094e92900000000000100000064e8290040f5d877000000000000000050e82900 (UID: 00000000-00003268) "AppLaunch.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b203100776079e706b0bde706000000006079e706100000000000000070e8290050dc03776079e706100000006cc7e606540aae00100000009ce82900a6ec956f02000000000000001800000028c7956fa0e8290028231a6900005d00000000000c00000028c7956face829002f99fd6d0c000000 (UID: 00000000-00003268) "AppLaunch.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b203100000100000044e829006a6f2e6900000000bc6f2e6994342b03c0e329000000000080ee290015de7877e4167874feffffff7f678077e2d850772824db6e02000000000000001800000030a5fd6d04e8290028231a6900005d00000000000c00000030a5fd6d10e829002f99fd6d0c000000 (UID: 00000000-00003268) "AppLaunch.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b2031006de098e4060000000008f11c089823746de098e40654f11c08e722736de098e40620000000000000003c37736d2812630220227c022812630220227c020200000000000000180000001be3a73458f11c0828231a6900005d00000000000c00000020227c0264f11c082f99fd6d0c000000 (UID: 00000000-00003268) "AppLaunch.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b203100776079e706b0bde706000000006079e70610000000000000001ce7290050dc03776079e70610000000eca6e5068c39b0001000000048e72900a6ec956f02000000000000001800000028c7956f4ce7290028231a6900005d00000000000c00000028c7956f58e729002f99fd6d0c000000 (UID: 00000000-00003268) "AppLaunch.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b2031006da097e40600000000b8f20e089823746da097e40604f30e08e722736da097e40620000000000000003c37736d2812630220e27b022812630220e27b020200000000000000180000001be3a73408f30e0828231a6900005d00000000000c00000020e27b0214f30e082f99fd6d0c000000 (UID: 00000000-00003268) "AppLaunch.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b203100776079e706b0bde706000000006079e70610000000000000001ce7290050dc03776079e70610000000f4a3e9065c3cb0001000000048e72900a6ec956f02000000000000001800000028c7956f4ce7290028231a6900005d00000000000c00000028c7956f58e729002f99fd6d0c000000 (UID: 00000000-00003268) "AppLaunch.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b203100776079e706b0bde706000000006079e7061000000000000000f0e3290050dc03776079e7061000000094a7e5060c40b000100000001ce42900a6ec956f02000000000000001800000028c7956f20e4290028231a6900005d00000000000c00000028c7956f2ce429002f99fd6d0c000000 (UID: 00000000-00003268) "AppLaunch.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b2031006d209ae40600000000c8f218089823746d209ae40614f31808e722736d209ae40620000000000000003c37736d2812630220627c022812630220627c020200000000000000180000001be3a73418f3180828231a6900005d00000000000c00000020627c0224f318082f99fd6d0c000000 (UID: 00000000-00003268) "AppLaunch.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b2031006d609be40600000000b8ef11089823746d609be40604f01108e722736d609be40620000000000000003c37736d2812630220827c022812630220827c020200000000000000180000001be3a73408f0110828231a6900005d00000000000c00000020827c0214f011082f99fd6d0c000000 (UID: 00000000-00003268) "AppLaunch.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b203100776079e706b0bde706000000006079e706100000000000000008e7290050dc03776079e7061000000094a7e506fc5eb0001000000034e72900a6ec956f02000000000000001800000028c7956f38e7290028231a6900005d00000000000c00000028c7956f44e729002f99fd6d0c000000 (UID: 00000000-00003268) "AppLaunch.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b203100000100000054e829006a6f2e6900000000bc6f2e69a4342b03d0e329000000000080ee290015de7877e4167874feffffff7f678077e2d850772824db6e02000000000000001800000030a5fd6d14e8290028231a6900005d00000000000c00000030a5fd6d20e829002f99fd6d0c000000 (UID: 00000000-00003268) "AppLaunch.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b20310008a386746d0823e30600000000b0f019089823746d0823e306f8f01908e722736d0823e30620000000000000003c37736d2812630220a27d02281263020200000000000000180000000023e306fcf0190828231a6900005d00000000000c00000020a27d0208f119082f99fd6d0c000000 (UID: 00000000-00003268) "AppLaunch.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b203100776079e706b0bde706000000006079e70610000000000000005ce7290050dc03776079e70610000000f4a3e90614a4b1001000000088e72900a6ec956f02000000000000001800000028c7956f8ce7290028231a6900005d00000000000c00000028c7956f98e729002f99fd6d0c000000 (UID: 00000000-00003268) "AppLaunch.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b203100000100000084e829006a6f2e6900000000bc6f2e69543b2b0300e429000000000080ee290015de7877e4167874feffffff7f678077e2d850772824db6e02000000000000001800000030a5fd6d44e8290028231a6900005d00000000000c00000030a5fd6d50e829002f99fd6d0c000000 (UID: 00000000-00003268) "AppLaunch.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b20310008a386746d0832e3060000000030f13f089823746d0832e30678f13f08e722736d0832e30620000000000000003c37736d2812630220229702281263020200000000000000180000000032e3067cf13f0828231a6900005d00000000000c0000002022970288f13f082f99fd6d0c000000 (UID: 00000000-00003268) "AppLaunch.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b203100000100000050e829006a6f2e6900000000bc6f2e6998342b03cce329000000000080ee290015de7877e4167874feffffff7f678077e2d850772824db6e02000000000000001800000030a5fd6d10e8290028231a6900005d00000000000c00000030a5fd6d1ce829002f99fd6d0c000000 (UID: 00000000-00003268) "AppLaunch.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b203100777897e406b0bde706000000007897e406200000000000000018e7290050dc03777897e4061000000094a7e50614a4b1001000000044e72900a6ec956f02000000000000001800000028c7956f48e7290028231a6900005d00000000000c00000028c7956f54e729002f99fd6d0c000000 (UID: 00000000-00003268) "AppLaunch.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b20310000010000004ce829006a6f2e6900000000bc6f2e699c342b03c8e329000000000080ee290015de7877e4167874feffffff7f678077e2d850772824db6e02000000000000001800000030a5fd6d0ce8290028231a6900005d00000000000c00000030a5fd6d18e829002f99fd6d0c000000 (UID: 00000000-00003268) "AppLaunch.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b20310008a386746dd825e3060000000010ed18089823746dd825e30658ed1808e722736dd825e30620000000000000003c37736d2812630220c29202281263020200000000000000180000000025e3065ced180828231a6900005d00000000000c00000020c2920268ed18082f99fd6d0c000000 (UID: 00000000-00003268)2e:T733,"file.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "file.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "xX1Zl63.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "xX1Zl63.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "VW6ig05.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "VW6ig05.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "Dk2ox03.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "Dk2ox03.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "qj9aa78.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "3Fs87VT.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "3Fs87VT.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "AppLaunch.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "4AR077QH.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "4AR077QH.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "5ol2yF2.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "5ol2yF2.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED")2f:T40d,Found reference to API "GetVersion" (Indicator: "GetVersion"; File: "file") Found reference to API "GetVersionExA" (Indicator: "GetVersionExA"; File: "file") Found reference to API "GetVersionExA" (Indicator: "GetVersion"; File: "file") Found reference to API "GetVersionExW" (Indicator: "GetVersionExW"; File: "explothe.exe.322908262") Found reference to API "GetVersionExW" (Indicator: "GetVersion"; File: "explothe.exe.322908262") Found reference to API "18446744054724345541,2652,3024,,RtlGetVersion,NTDLL.dll,"252:03:04.687",RX=0,PX=0" (Indicator: "GetVersion"; Source: "00000000-00000876.00000000.67434.003C0000.00000004.mdmp") Found reference to API "GetVersion" (Indicator: "GetVersion"; Source: "00000000-00000928.00000000.66890.00C9A000.00000002.mdmp") Found reference to API "GetVersionExA" (Indicator: "GetVersionExA"; Source: "00000000-00000928.00000000.66890.00C9A000.00000002.mdmp") Found reference to API "GetVersionExA" (Indicator: "GetVersion"; Source: "00000000-00000928.00000000.66890.00C9A000.00000002.mdmp")30:T740,"explothe.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{90A066FE-591C-47F3-850D-9644B684FBA5}"; Key: "ENABLEDHCP"; Value: "") "explothe.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{90A066FE-591C-47F3-850D-9644B684FBA5}"; Key: "REGISTRATIONENABLED"; Value: "") "explothe.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{90A066FE-591C-47F3-850D-9644B684FBA5}"; Key: "REGISTERADAPTERNAME"; Value: "") "explothe.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{90A066FE-591C-47F3-850D-9644B684FBA5}"; Key: "DOMAIN"; Value: "") "explothe.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{90A066FE-591C-47F3-850D-9644B684FBA5}"; Key: "DHCPDOMAIN"; Value: "") "explothe.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E29AC6C2-7037-11DE-816D-806E6F6E6963}"; Key: "ENABLEDHCP"; Value: "") "explothe.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E29AC6C2-7037-11DE-816D-806E6F6E6963}"; Key: "REGISTRATIONENABLED"; Value: "") "explothe.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E29AC6C2-7037-11DE-816D-806E6F6E6963}"; Key: "REGISTERADAPTERNAME"; Value: "") "explothe.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E29AC6C2-7037-11DE-816D-806E6F6E6963}"; Key: "DOMAIN"; Value: "") "explothe.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E29AC6C2-7037-11DE-816D-806E6F6E6963}"; Key: "DHCPDOMAIN"; Value: "")31:T7ae,"AppLaunch.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel.Internals\v4.0_4.0.0.0__31bf3856ad364e35\System.ServiceModel.Internals.dll" at 00000000-00003268-0000010C-1520377 "AppLaunch.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel.Internals\v4.0_4.0.0.0__31bf3856ad364e35\System.ServiceModel.Internals.dll" at 00000000-00003268-0000010C-1678415 "AppLaunch.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll" at 00000000-00003268-0000010C-6012459 "AppLaunch.exe" queries volume information of "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe" at 00000000-00003268-0000010C-10058202864810761 "AppLaunch.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel\v4.0_4.0.0.0__b77a5c561934e089\System.ServiceModel.dll" at 00000000-00003268-0000010C-10058202871364255 "AppLaunch.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel\v4.0_4.0.0.0__b77a5c561934e089\System.ServiceModel.dll" at 00000000-00003268-0000010C-10058202871383818 "explothe.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Temp\fefffe8cea\explothe.exe" at 00000000-00001460-0000010C-12428079 "explothe.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Roaming\006700e5a2ab05\cred.dll" at 00000000-00001460-0000010C-42370303 "explothe.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Roaming\006700e5a2ab05\cred.dll" at 00000000-00001460-0000010C-42376911 "explothe.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Roaming\006700e5a2ab05\clip.dll" at 00000000-00001460-0000010C-44519493 "explothe.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Roaming\006700e5a2ab05\clip.dll" at 00000000-00001460-0000010C-4452653432:T6ff,"AppLaunch.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL") "AppLaunch.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\7-ZIP") "AppLaunch.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\7-ZIP"; Key: "DISPLAYNAME") "AppLaunch.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\7-ZIP"; Key: "DISPLAYVERSION") "AppLaunch.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\ADDRESSBOOK") "AppLaunch.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\ADDRESSBOOK"; Key: "DISPLAYNAME") "AppLaunch.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\ADDRESSBOOK"; Key: "DISPLAYVERSION") "AppLaunch.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\ADOBE AIR") "AppLaunch.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\ADOBE AIR"; Key: "DISPLAYNAME") "AppLaunch.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\ADOBE AIR"; Key: "DISPLAYVERSION") "AppLaunch.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\ADOBE FLASH PLAYER ACTIVEX") "AppLaunch.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\ADOBE FLASH PLAYER ACTIVEX"; Key: "DISPLAYNAME") "AppLaunch.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\ADOBE FLASH PLAYER ACTIVEX"; Key: "DISPLAYVERSION") "AppLaunch.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\ADOBE SHOCKWAVE PLAYER") "AppLaunch.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\ADOBE SHOCKWAVE PLAYER"; Key: "DISPLAYNAME") "AppLaunch.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\ADOBE SHOCKWAVE PLAYER"; Key: "DISPLAYVERSION")33:T616,"file.exe" called "CreateProcessA" with parameter "%TEMP%\IXP000.TMP\xX1Zl63.exe" - (UID: 00000000-00000928) "file.exe" called "CreateProcessA" with parameter "%TEMP%\IXP000.TMP\6Um8bf3.exe" - (UID: 00000000-00000928) "xX1Zl63.exe" called "CreateProcessA" with parameter "%TEMP%\IXP001.TMP\VW6ig05.exe" - (UID: 00000000-00002736) "xX1Zl63.exe" called "CreateProcessA" with parameter "%TEMP%\IXP001.TMP\5ol2yF2.exe" - (UID: 00000000-00002736) "VW6ig05.exe" called "CreateProcessA" with parameter "%TEMP%\IXP002.TMP\Dk2ox03.exe" - (UID: 00000000-00003088) "VW6ig05.exe" called "CreateProcessA" with parameter "%TEMP%\IXP002.TMP\4AR077QH.exe" - (UID: 00000000-00003088) "Dk2ox03.exe" called "CreateProcessA" with parameter "%TEMP%\IXP003.TMP\qj9aa78.exe" - (UID: 00000000-00003452) "Dk2ox03.exe" called "CreateProcessA" with parameter "%TEMP%\IXP003.TMP\3Fs87VT.exe" - (UID: 00000000-00003452) "qj9aa78.exe" called "CreateProcessA" with parameter "%TEMP%\IXP004.TMP\1Wp25tZ5.exe" - (UID: 00000000-00003976) "cmd.exe" called "CreateProcessW" with parameter ""%PROGRAMFILES%\Internet Explorer\iexplore.exe" https://www.youtube.com/" - (UID: 00000000-00002248) "cmd.exe" called "CreateProcessW" with parameter ""%PROGRAMFILES%\Internet Explorer\iexplore.exe" https://www.facebook.com/login" - (UID: 00000000-00002248) "cmd.exe" called "CreateProcessW" with parameter "CACLS "explothe.exe" /P "%OSUSER%:N"" - (UID: 00000000-00002860) "cmd.exe" called "CreateProcessW" with parameter "CACLS "explothe.exe" /P "%OSUSER%:R" /E" - (UID: 00000000-00002860)34:T50fe,"file.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\advapi32.dll (UID: 00000000-00000928) "file.exe" called "LoadLibrary" with a parameter feclient.dll (UID: 00000000-00000928) "file.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\advpack.dll (UID: 00000000-00000928) "file.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00000928) "file.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00000928) "file.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00000928) "file.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00000928) "xX1Zl63.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\advpack.dll (UID: 00000000-00002736) "VW6ig05.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\advpack.dll (UID: 00000000-00003088) "Dk2ox03.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00003452) "Dk2ox03.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00003452) "Dk2ox03.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00003452) "Dk2ox03.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00003452) "Dk2ox03.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\advpack.dll (UID: 00000000-00003452) "qj9aa78.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\advpack.dll (UID: 00000000-00003976) "qj9aa78.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00003976) "qj9aa78.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\uxtheme.dll (UID: 00000000-00003976) "qj9aa78.exe" called "LoadLibrary" with a parameter dwmapi.dll (UID: 00000000-00003976) "qj9aa78.exe" called "LoadLibrary" with a parameter comctl32.dll (UID: 00000000-00003976) "qj9aa78.exe" called "LoadLibrary" with a parameter UxTheme.dll (UID: 00000000-00003976) "qj9aa78.exe" called "LoadLibrary" with a parameter imageres.dll (UID: 00000000-00003976) "qj9aa78.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\ole32.dll (UID: 00000000-00003976) "qj9aa78.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\MSCTF.dll (UID: 00000000-00003976) "3Fs87VT.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2 (UID: 00000000-00000876) "AppLaunch.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00003836) "AppLaunch.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00003836) "AppLaunch.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00003836) "AppLaunch.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00003836) "4AR077QH.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2 (UID: 00000000-00003276) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\clr.dll (UID: 00000000-00003268) "AppLaunch.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00003268) "AppLaunch.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00003268) "AppLaunch.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00003268) "AppLaunch.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00003268) "AppLaunch.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00003268) "AppLaunch.exe" called "LoadLibrary" with a parameter api-ms-win-core-quirks-l1-1-0.dll (UID: 00000000-00003268) "AppLaunch.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2.dll (UID: 00000000-00003268) "AppLaunch.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-0.dll (UID: 00000000-00003268) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoree.dll (UID: 00000000-00003268) "AppLaunch.exe" called "LoadLibrary" with a parameter mscoree.dll (UID: 00000000-00003268) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\combase.dll (UID: 00000000-00003268) "AppLaunch.exe" called "LoadLibrary" with a parameter psapi.dll (UID: 00000000-00003268) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\mscorlib\36eaccfde177c2e7b93b8dbdde4e012a\mscorlib.ni.dll (UID: 00000000-00003268) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\ole32.dll (UID: 00000000-00003268) "AppLaunch.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00003268) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\uxtheme.dll (UID: 00000000-00003268) "AppLaunch.exe" called "LoadLibrary" with a parameter api-ms-win-core-xstate-l2-1-0.dll (UID: 00000000-00003268) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\clrjit.dll (UID: 00000000-00003268) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System\2c3c912ea8f058f9d04c4650128feb3f\System.ni.dll (UID: 00000000-00003268) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Drawing\f7568d7f1b9d356f64779b4c0927cfb3\System.Drawing.ni.dll (UID: 00000000-00003268) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Windows.Forms\c9a4cbc00f690a9e3cddfc400f6e85bb\System.Windows.Forms.ni.dll (UID: 00000000-00003268) "AppLaunch.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00003268) "AppLaunch.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00003268) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\uxtheme.dll (UID: 00000000-00003268) "AppLaunch.exe" called "LoadLibrary" with a parameter uxtheme.dll (UID: 00000000-00003268) "AppLaunch.exe" called "LoadLibrary" with a parameter user32.dll (UID: 00000000-00003268) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Core\31fae3290fad30c31c98651462d22724\System.Core.ni.dll (UID: 00000000-00003268) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Configuration\96f7edb07b12303f0ec2595c7f3778c7\System.Configuration.ni.dll (UID: 00000000-00003268) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Xml\15af16d373cf0528cb74fc73d365fdbf\System.Xml.ni.dll (UID: 00000000-00003268) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\nlssorting.dll (UID: 00000000-00003268) "AppLaunch.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00003268) "AppLaunch.exe" called "LoadLibrary" with a parameter shell32.dll (UID: 00000000-00003268) "AppLaunch.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00003268) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll (UID: 00000000-00003268) "AppLaunch.exe" called "LoadLibrary" with a parameter bcrypt.dll (UID: 00000000-00003268) "AppLaunch.exe" called "LoadLibrary" with a parameter CRYPTSP.dll (UID: 00000000-00003268) "AppLaunch.exe" called "LoadLibrary" with a parameter CRYPTBASE.dll (UID: 00000000-00003268) "AppLaunch.exe" called "LoadLibrary" with a parameter imm32.dll (UID: 00000000-00003268) "AppLaunch.exe" called "LoadLibrary" with a parameter comctl32.dll (UID: 00000000-00003268) "AppLaunch.exe" called "LoadLibrary" with a parameter gdi32.dll (UID: 00000000-00003268) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\WindowsBase\1a4cc316fb6d09525321fc0be44692d8\WindowsBase.ni.dll (UID: 00000000-00003268) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\PresentationCore\468f4e17be144ca12a73a4297eacc9cc\PresentationCore.ni.dll (UID: 00000000-00003268) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\Presentatio5ae0f00f#\252cc7b0fae8cfe083bdc149957c0c54\PresentationFramework.ni.dll (UID: 00000000-00003268) "AppLaunch.exe" called "LoadLibrary" with a parameter KERNEL32.dll (UID: 00000000-00003268) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\PresentationCore\v4.0_4.0.0.0__31bf3856ad364e35\ucrtbase_clr0400.dll (UID: 00000000-00003268) "AppLaunch.exe" called "LoadLibrary" with a parameter ucrtbase_clr0400.dll (UID: 00000000-00003268) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\PresentationCore\v4.0_4.0.0.0__31bf3856ad364e35\SHLWAPI.dll (UID: 00000000-00003268) "AppLaunch.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00003268) "AppLaunch.exe" called "LoadLibrary" with a parameter dwrite.dll (UID: 00000000-00003268) "AppLaunch.exe" called "LoadLibrary" with a parameter api-ms-win-core-string-l1-1-0 (UID: 00000000-00003268) "AppLaunch.exe" called "LoadLibrary" with a parameter api-ms-win-core-datetime-l1-1-1 (UID: 00000000-00003268) "AppLaunch.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-obsolete-l1-2-0 (UID: 00000000-00003268) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\WPF\wpfgfx_v0400.dll (UID: 00000000-00003268) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\WPF\PresentationNative_v0400.dll (UID: 00000000-00003268) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll (UID: 00000000-00003268) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\en-US\tzres.dll.mui (UID: 00000000-00003268) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\VERSION.dll (UID: 00000000-00003268) "AppLaunch.exe" called "LoadLibrary" with a parameter VERSION.dll (UID: 00000000-00003268) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.ServiceModel\v4.0_4.0.0.0__b77a5c561934e089\System.ServiceModel.dll (UID: 00000000-00003268) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Runteb92aa12#\274e43040c8a7a02ef1065db3283005a\System.Runtime.Serialization. (UID: 00000000-00003268) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.IdentityModel\c2ef5bc545b98a289f02d0b3eddbe280\System.IdentityModel.ni.dll (UID: 00000000-00003268) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\SMDiagnostics\dc67dcb4b2fb4a3853d458cab08561f0\SMDiagnostics.ni.dll (UID: 00000000-00003268) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.ServiceModel.Internals\v4.0_4.0.0.0__31bf3856ad364e35\System.ServiceModel.Intern (UID: 00000000-00003268) "AppLaunch.exe" called "LoadLibrary" with a parameter SspiCli.dll (UID: 00000000-00003268) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\secur32.dll (UID: 00000000-00003268) "AppLaunch.exe" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00003268) "AppLaunch.exe" called "LoadLibrary" with a parameter API-MS-Win-Core-LocalRegistry-L1-1-0.dll (UID: 00000000-00003268) "AppLaunch.exe" called "LoadLibrary" with a parameter oleaut32.dll (UID: 00000000-00003268) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll (UID: 00000000-00003268) "AppLaunch.exe" called "LoadLibrary" with a parameter version.dll (UID: 00000000-00003268) "AppLaunch.exe" called "LoadLibrary" with a parameter %PROGRAMFILES%\Mozilla Firefox\firefox.exe (UID: 00000000-00003268) "AppLaunch.exe" called "LoadLibrary" with a parameter %PROGRAMFILES%\Internet Explorer\iexplore.exe (UID: 00000000-00003268) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Security\93d03eb9812405fa70e89d4efd5f7e14\System.Security.ni.dll (UID: 00000000-00003268) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll (UID: 00000000-00003268) "AppLaunch.exe" called "LoadLibrary" with a parameter VCRUNTIME140_CLR0400.dll (UID: 00000000-00003268) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\PresentationCore\v4.0_4.0.0.0__31bf3856ad364e35\VCRUNTIME140_CLR0400.dll (UID: 00000000-00003268) "5ol2yF2.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\uxtheme.dll (UID: 00000000-00003396) "5ol2yF2.exe" called "LoadLibrary" with a parameter comctl32.dll (UID: 00000000-00003396) "5ol2yF2.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00003396) "5ol2yF2.exe" called "LoadLibrary" with a parameter propsys.dll (UID: 00000000-00003396) "5ol2yF2.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00003396) "5ol2yF2.exe" called "LoadLibrary" with a parameter SHELL32.dll (UID: 00000000-00003396) "5ol2yF2.exe" called "LoadLibrary" with a parameter ntmarta.dll (UID: 00000000-00003396) "5ol2yF2.exe" called "LoadLibrary" with a parameter %WINDIR%\System32\shdocvw.dll (UID: 00000000-00003396) "5ol2yF2.exe" called "LoadLibrary" with a parameter PROPSYS.dll (UID: 00000000-00003396) "5ol2yF2.exe" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00003396) "5ol2yF2.exe" called "LoadLibrary" with a parameter Secur32.dll (UID: 00000000-00003396) "5ol2yF2.exe" called "LoadLibrary" with a parameter API-MS-WIN-DOWNLEVEL-SHLWAPI-L1-1-0.DLL (UID: 00000000-00003396) "5ol2yF2.exe" called "LoadLibrary" with a parameter api-ms-win-downlevel-advapi32-l2-1-0.dll (UID: 00000000-00003396) "5ol2yF2.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2 (UID: 00000000-00003396) "explothe.exe" called "LoadLibrary" with a parameter SHELL32.dll (UID: 00000000-00001460) "explothe.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00001460) "explothe.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\uxtheme.dll (UID: 00000000-00001460) "explothe.exe" called "LoadLibrary" with a parameter comctl32.dll (UID: 00000000-00001460) "explothe.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00001460) "explothe.exe" called "LoadLibrary" with a parameter API-MS-Win-Security-LSALookup-L1-1-0.dll (UID: 00000000-00001460) "explothe.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00001460) "explothe.exe" called "LoadLibrary" with a parameter propsys.dll (UID: 00000000-00001460) "explothe.exe" called "LoadLibrary" with a parameter DNSAPI.dll (UID: 00000000-00001460) "explothe.exe" called "LoadLibrary" with a parameter %WINDIR%\System32\ieframe.dll (UID: 00000000-00001460) "explothe.exe" called "LoadLibrary" with a parameter ntmarta.dll (UID: 00000000-00001460) "explothe.exe" called "LoadLibrary" with a parameter Secur32.dll (UID: 00000000-00001460) "explothe.exe" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00001460) "explothe.exe" called "LoadLibrary" with a parameter IPHLPAPI.DLL (UID: 00000000-00001460) "explothe.exe" called "LoadLibrary" with a parameter CRYPTBASE.dll (UID: 00000000-00001460) "6Um8bf3.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\uxtheme.dll (UID: 00000000-00001884) "6Um8bf3.exe" called "LoadLibrary" with a parameter SHELL32.dll (UID: 00000000-00001884) "6Um8bf3.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00001884) "6Um8bf3.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00001884) "6Um8bf3.exe" called "LoadLibrary" with a parameter propsys.dll (UID: 00000000-00001884) "6Um8bf3.exe" called "LoadLibrary" with a parameter comctl32.dll (UID: 00000000-00001884) "6Um8bf3.exe" called "LoadLibrary" with a parameter ntmarta.dll (UID: 00000000-00001884) "6Um8bf3.exe" called "LoadLibrary" with a parameter Secur32.dll (UID: 00000000-00001884) "6Um8bf3.exe" called "LoadLibrary" with a parameter API-MS-WIN-DOWNLEVEL-SHLWAPI-L1-1-0.DLL (UID: 00000000-00001884) "6Um8bf3.exe" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00001884) "6Um8bf3.exe" called "LoadLibrary" with a parameter Kernel32.dll (UID: 00000000-00001884) "6Um8bf3.exe" called "LoadLibrary" with a parameter %TEMP%\IXP000.TMP\6Um8bf3.exe (UID: 00000000-00001884) "6Um8bf3.exe" called "LoadLibrary" with a parameter Kernel32.DLL (UID: 00000000-00001884) "cmd.exe" called "LoadLibrary" with a parameter comctl32.dll (UID: 00000000-00002248) "cmd.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\uxtheme.dll (UID: 00000000-00002248) "cmd.exe" called "LoadLibrary" with a parameter API-MS-Win-Core-LocalRegistry-L1-1-0.dll (UID: 00000000-00002248) "cmd.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00002248) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-downlevel-shlwapi-l2-1-0.dll (UID: 00000000-00002248) "cmd.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00002248) "cmd.exe" called "LoadLibrary" with a parameter iertutil.dll (UID: 00000000-00002248) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-downlevel-ole32-l1-1-0.dll (UID: 00000000-00002248) "cmd.exe" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00002248) "cmd.exe" called "LoadLibrary" with a parameter PROPSYS.dll (UID: 00000000-00002248) "cmd.exe" called "LoadLibrary" with a parameter %PROGRAMFILES%\Internet Explorer\ieproxy.dll (UID: 00000000-00002248) "cmd.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00002248) "cmd.exe" called "LoadLibrary" with a parameter urlmon.dll (UID: 00000000-00002248) "schtasks.exe" called "LoadLibrary" with a parameter %WINDIR%\System32\schtasks.exe (UID: 00000000-00002784) "schtasks.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\uxtheme.dll (UID: 00000000-00002784) "schtasks.exe" called "LoadLibrary" with a parameter SspiCli.dll (UID: 00000000-00002784) "schtasks.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00002784) "explothe.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00002512) "explothe.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00002512) "cacls.exe" called "LoadLibrary" with a parameter API-MS-Win-Security-LSALookup-L1-1-0.dll (UID: 00000000-00003744) "cacls.exe" called "LoadLibrary" with a parameter gdi32.dll (UID: 00000000-00003744) "cacls.exe" called "LoadLibrary" with a parameter gdi32.dll (UID: 00000000-00002920) "cacls.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00002920) "cacls.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00002920) "cacls.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00002920) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00001384) "rundll32.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00001384) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00001384) "rundll32.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\uxtheme.dll (UID: 00000000-00001384) "explothe.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00002152) "explothe.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00002152) "explothe.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00002152) "explothe.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00002152) "explothe.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2 (UID: 00000000-00003280)35:T12cda,"file.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00000928) "file.exe" called "GetProcAddress" with a parameter DecryptFileA (UID: 00000000-00000928) "file.exe" called "GetProcAddress" with a parameter FeClientInitialize (UID: 00000000-00000928) "file.exe" called "GetProcAddress" with a parameter DelNodeRunDLL32 (UID: 00000000-00000928) "file.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00000928) "file.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00000928) "file.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00000928) "file.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00000928) "file.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00000928) "file.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00000928) "file.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00000928) "file.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00000928) "file.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00000928) "file.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00000928) "file.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00000928) "file.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00000928) "file.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00000928) "file.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00000928) "file.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00000928) "file.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00000928) "file.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00000928) "file.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00000928) "file.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00000928) "file.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00000928) "file.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00000928) "file.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00000928) "file.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00000928) "file.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00000928) "file.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00000928) "file.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00000928) "file.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00000928) "file.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00000928) "file.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00000928) "file.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00000928) "file.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00000928) "file.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00000928) "file.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00000928) "file.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00000928) "file.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00000928) "file.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00000928) "file.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00000928) "file.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00000928) "file.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00000928) "file.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00000928) "xX1Zl63.exe" called "GetProcAddress" with a parameter DelNodeRunDLL32 (UID: 00000000-00002736) "xX1Zl63.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00002736) "xX1Zl63.exe" called "GetProcAddress" with a parameter UnregisterTraceGuids (UID: 00000000-00002736) "xX1Zl63.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00002736) "VW6ig05.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00003088) "VW6ig05.exe" called "GetProcAddress" with a parameter DelNodeRunDLL32 (UID: 00000000-00003088) "VW6ig05.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00003088) "VW6ig05.exe" called "GetProcAddress" with a parameter UnregisterTraceGuids (UID: 00000000-00003088) "Dk2ox03.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00003452) "Dk2ox03.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00003452) "Dk2ox03.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00003452) "Dk2ox03.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00003452) "Dk2ox03.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00003452) "Dk2ox03.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00003452) "Dk2ox03.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00003452) "Dk2ox03.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00003452) "Dk2ox03.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00003452) "Dk2ox03.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00003452) "Dk2ox03.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00003452) "Dk2ox03.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00003452) "Dk2ox03.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00003452) "Dk2ox03.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00003452) "Dk2ox03.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00003452) "Dk2ox03.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00003452) "Dk2ox03.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00003452) "Dk2ox03.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00003452) "Dk2ox03.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00003452) "Dk2ox03.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00003452) "Dk2ox03.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00003452) "Dk2ox03.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00003452) "Dk2ox03.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00003452) "Dk2ox03.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00003452) "Dk2ox03.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00003452) "Dk2ox03.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00003452) "Dk2ox03.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00003452) "Dk2ox03.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00003452) "Dk2ox03.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00003452) "Dk2ox03.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00003452) "Dk2ox03.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00003452) "Dk2ox03.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00003452) "Dk2ox03.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00003452) "Dk2ox03.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00003452) "Dk2ox03.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00003452) "Dk2ox03.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00003452) "Dk2ox03.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00003452) "Dk2ox03.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00003452) "Dk2ox03.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00003452) "Dk2ox03.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00003452) "Dk2ox03.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00003452) "Dk2ox03.exe" called "GetProcAddress" with a parameter DelNodeRunDLL32 (UID: 00000000-00003452) "Dk2ox03.exe" called "GetProcAddress" with a parameter UnregisterTraceGuids (UID: 00000000-00003452) "qj9aa78.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00003976) "qj9aa78.exe" called "GetProcAddress" with a parameter DelNodeRunDLL32 (UID: 00000000-00003976) "qj9aa78.exe" called "GetProcAddress" with a parameter GetLayout (UID: 00000000-00003976) "qj9aa78.exe" called "GetProcAddress" with a parameter GdiRealizationInfo (UID: 00000000-00003976) "qj9aa78.exe" called "GetProcAddress" with a parameter FontIsLinked (UID: 00000000-00003976) "qj9aa78.exe" called "GetProcAddress" with a parameter RegOpenKeyExW (UID: 00000000-00003976) "qj9aa78.exe" called "GetProcAddress" with a parameter RegQueryInfoKeyW (UID: 00000000-00003976) "qj9aa78.exe" called "GetProcAddress" with a parameter GetTextFaceAliasW (UID: 00000000-00003976) "qj9aa78.exe" called "GetProcAddress" with a parameter RegEnumValueW (UID: 00000000-00003976) "qj9aa78.exe" called "GetProcAddress" with a parameter RegCloseKey (UID: 00000000-00003976) "qj9aa78.exe" called "GetProcAddress" with a parameter RegQueryValueExW (UID: 00000000-00003976) "qj9aa78.exe" called "GetProcAddress" with a parameter GetFontAssocStatus (UID: 00000000-00003976) "qj9aa78.exe" called "GetProcAddress" with a parameter RegQueryValueExA (UID: 00000000-00003976) "qj9aa78.exe" called "GetProcAddress" with a parameter RegEnumKeyExW (UID: 00000000-00003976) "qj9aa78.exe" called "GetProcAddress" with a parameter ThemeInitApiHook (UID: 00000000-00003976) "qj9aa78.exe" called "GetProcAddress" with a parameter IsProcessDPIAware (UID: 00000000-00003976) "qj9aa78.exe" called "GetProcAddress" with a parameter DwmIsCompositionEnabled (UID: 00000000-00003976) "qj9aa78.exe" called "GetProcAddress" with a parameter RegisterClassNameW (UID: 00000000-00003976) "qj9aa78.exe" called "GetProcAddress" with a parameter EnableThemeDialogTexture (UID: 00000000-00003976) "qj9aa78.exe" called "GetProcAddress" with a parameter OpenThemeData (UID: 00000000-00003976) "qj9aa78.exe" called "GetProcAddress" with a parameter GetThemeBool (UID: 00000000-00003976) "qj9aa78.exe" called "GetProcAddress" with a parameter GdiIsMetaPrintDC (UID: 00000000-00003976) "qj9aa78.exe" called "GetProcAddress" with a parameter CoInitializeEx (UID: 00000000-00003976) "qj9aa78.exe" called "GetProcAddress" with a parameter CoUninitialize (UID: 00000000-00003976) "qj9aa78.exe" called "GetProcAddress" with a parameter SystemFunction036 (UID: 00000000-00003976) "qj9aa78.exe" called "GetProcAddress" with a parameter CoRegisterInitializeSpy (UID: 00000000-00003976) "qj9aa78.exe" called "GetProcAddress" with a parameter CoRevokeInitializeSpy (UID: 00000000-00003976) "qj9aa78.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00003976) "qj9aa78.exe" called "GetProcAddress" with a parameter CLSIDFromOle1Class (UID: 00000000-00003976) "qj9aa78.exe" called "GetProcAddress" with a parameter GetCatalogObject (UID: 00000000-00003976) "qj9aa78.exe" called "GetProcAddress" with a parameter GetCatalogObject2 (UID: 00000000-00003976) "qj9aa78.exe" called "GetProcAddress" with a parameter BufferedPaintInit (UID: 00000000-00003976) "qj9aa78.exe" called "GetProcAddress" with a parameter BufferedPaintRenderAnimation (UID: 00000000-00003976) "qj9aa78.exe" called "GetProcAddress" with a parameter GetThemeTransitionDuration (UID: 00000000-00003976) "qj9aa78.exe" called "GetProcAddress" with a parameter BeginBufferedAnimation (UID: 00000000-00003976) "qj9aa78.exe" called "GetProcAddress" with a parameter IsThemeBackgroundPartiallyTransparent (UID: 00000000-00003976) "qj9aa78.exe" called "GetProcAddress" with a parameter DrawThemeParentBackground (UID: 00000000-00003976) "qj9aa78.exe" called "GetProcAddress" with a parameter DrawThemeBackground (UID: 00000000-00003976) "qj9aa78.exe" called "GetProcAddress" with a parameter GetThemeBackgroundContentRect (UID: 00000000-00003976) "qj9aa78.exe" called "GetProcAddress" with a parameter DrawThemeText (UID: 00000000-00003976) "qj9aa78.exe" called "GetProcAddress" with a parameter EndBufferedAnimation (UID: 00000000-00003976) "qj9aa78.exe" called "GetProcAddress" with a parameter CloseThemeData (UID: 00000000-00003976) "qj9aa78.exe" called "GetProcAddress" with a parameter BufferedPaintStopAllAnimations (UID: 00000000-00003976) "qj9aa78.exe" called "GetProcAddress" with a parameter BufferedPaintUnInit (UID: 00000000-00003976) "qj9aa78.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00003976) "qj9aa78.exe" called "GetProcAddress" with a parameter UnregisterTraceGuids (UID: 00000000-00003976) "3Fs87VT.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00000876) "3Fs87VT.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00000876) "3Fs87VT.exe" called "GetProcAddress" with a parameter UnregisterTraceGuids (UID: 00000000-00000876) "AppLaunch.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00003836) "AppLaunch.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00003836) "AppLaunch.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00003836) "AppLaunch.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00003836) "AppLaunch.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00003836) "AppLaunch.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00003836) "AppLaunch.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00003836) "AppLaunch.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00003836) "AppLaunch.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00003836) "AppLaunch.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00003836) "AppLaunch.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00003836) "AppLaunch.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00003836) "AppLaunch.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00003836) "AppLaunch.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00003836) "AppLaunch.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00003836) "AppLaunch.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00003836) "AppLaunch.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00003836) "AppLaunch.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00003836) "AppLaunch.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00003836) "AppLaunch.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00003836) "AppLaunch.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00003836) "AppLaunch.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00003836) "AppLaunch.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00003836) "AppLaunch.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00003836) "AppLaunch.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00003836) "AppLaunch.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00003836) "AppLaunch.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00003836) "AppLaunch.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00003836) "AppLaunch.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00003836) "AppLaunch.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00003836) "AppLaunch.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00003836) "AppLaunch.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00003836) "AppLaunch.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00003836) "AppLaunch.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00003836) "AppLaunch.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00003836) "AppLaunch.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00003836) "AppLaunch.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00003836) "AppLaunch.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00003836) "AppLaunch.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00003836) "AppLaunch.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00003836) "AppLaunch.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00003836) "AppLaunch.exe" called "GetProcAddress" with a parameter UnregisterTraceGuids (UID: 00000000-00003836) "4AR077QH.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00003276) "4AR077QH.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00003276) "4AR077QH.exe" called "GetProcAddress" with a parameter UnregisterTraceGuids (UID: 00000000-00003276) "AppLaunch.exe" called "GetProcAddress" with a parameter GetFileVersionInfoW (UID: 00000000-00003268) "AppLaunch.exe" called "GetProcAddress" with a parameter VerQueryValueW (UID: 00000000-00003268) "AppLaunch.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00003268) "AppLaunch.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00003268) "AppLaunch.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00003268) "AppLaunch.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00003268) "AppLaunch.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00003268) "AppLaunch.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00003268) "AppLaunch.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00003268) "AppLaunch.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00003268) "AppLaunch.exe" called "GetProcAddress" with a parameter EventSetInformation (UID: 00000000-00003268) "AppLaunch.exe" called "GetProcAddress" with a parameter SetRuntimeInfo (UID: 00000000-00003268) "AppLaunch.exe" called "GetProcAddress" with a parameter GetProcessWindowStation (UID: 00000000-00003268) "AppLaunch.exe" called "GetProcAddress" with a parameter GetUserObjectInformationW (UID: 00000000-00003268) "AppLaunch.exe" called "GetProcAddress" with a parameter _CorExeMain (UID: 00000000-00003268) "AppLaunch.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00003268) "AppLaunch.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00003268) "AppLaunch.exe" called "GetProcAddress" with a parameter AddDllDirectory (UID: 00000000-00003268) "AppLaunch.exe" called "GetProcAddress" with a parameter CreateConfigStream (UID: 00000000-00003268) "AppLaunch.exe" called "GetProcAddress" with a parameter CreateConfigStream_RetAddr (UID: 00000000-00003268) "AppLaunch.exe" called "GetProcAddress" with a parameter GetNumaHighestNodeNumber (UID: 00000000-00003268) "AppLaunch.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00003268) "AppLaunch.exe" called "GetProcAddress" with a parameter GetSystemWindowsDirectoryW (UID: 00000000-00003268) "AppLaunch.exe" called "GetProcAddress" with a parameter AllocateAndInitializeSid (UID: 00000000-00003268) "AppLaunch.exe" called "GetProcAddress" with a parameter OpenProcessToken (UID: 00000000-00003268) "AppLaunch.exe" called "GetProcAddress" with a parameter GetTokenInformation (UID: 00000000-00003268) "AppLaunch.exe" called "GetProcAddress" with a parameter InitializeAcl (UID: 00000000-00003268) "AppLaunch.exe" called "GetProcAddress" with a parameter AddAccessAllowedAce (UID: 00000000-00003268) "AppLaunch.exe" called "GetProcAddress" with a parameter FreeSid (UID: 00000000-00003268) "AppLaunch.exe" called "GetProcAddress" with a parameter AddSIDToBoundaryDescriptor (UID: 00000000-00003268) "AppLaunch.exe" called "GetProcAddress" with a parameter CreateBoundaryDescriptorW (UID: 00000000-00003268) "AppLaunch.exe" called "GetProcAddress" with a parameter CreatePrivateNamespaceW (UID: 00000000-00003268) "AppLaunch.exe" called "GetProcAddress" with a parameter OpenPrivateNamespaceW (UID: 00000000-00003268) "AppLaunch.exe" called "GetProcAddress" with a parameter DeleteBoundaryDescriptor (UID: 00000000-00003268) "AppLaunch.exe" called "GetProcAddress" with a parameter WerRegisterRuntimeExceptionModule (UID: 00000000-00003268) "AppLaunch.exe" called "GetProcAddress" with a parameter RaiseException (UID: 00000000-00003268) "AppLaunch.exe" called "GetProcAddress" with a parameter SetSystemFileCacheSize (UID: 00000000-00003268) "AppLaunch.exe" called "GetProcAddress" with a parameter NtSetSystemInformation (UID: 00000000-00003268) "AppLaunch.exe" called "GetProcAddress" with a parameter PrivIsDllSynchronizationHeld (UID: 00000000-00003268) "AppLaunch.exe" called "GetProcAddress" with a parameter GetProcessMemoryInfo (UID: 00000000-00003268) "AppLaunch.exe" called "GetProcAddress" with a parameter CoInitializeEx (UID: 00000000-00003268) "AppLaunch.exe" called "GetProcAddress" with a parameter SystemFunction036 (UID: 00000000-00003268) "AppLaunch.exe" called "GetProcAddress" with a parameter ThemeInitApiHook (UID: 00000000-00003268) "AppLaunch.exe" called "GetProcAddress" with a parameter IsProcessDPIAware (UID: 00000000-00003268) "AppLaunch.exe" called "GetProcAddress" with a parameter GetEnabledXStateFeatures (UID: 00000000-00003268) "AppLaunch.exe" called "GetProcAddress" with a parameter sxsJitStartup (UID: 00000000-00003268) "AppLaunch.exe" called "GetProcAddress" with a parameter jitStartup (UID: 00000000-00003268) "AppLaunch.exe" called "GetProcAddress" with a parameter getJit (UID: 00000000-00003268) "AppLaunch.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00003268) "AppLaunch.exe" called "GetProcAddress" with a parameter LocaleNameToLCID (UID: 00000000-00003268) "AppLaunch.exe" called "GetProcAddress" with a parameter GetUserDefaultLocaleName (UID: 00000000-00003268) "AppLaunch.exe" called "GetProcAddress" with a parameter LCIDToLocaleName (UID: 00000000-00003268) "AppLaunch.exe" called "GetProcAddress" with a parameter GetUserPreferredUILanguages (UID: 00000000-00003268) "AppLaunch.exe" called "GetProcAddress" with a parameter RegCloseKey (UID: 00000000-00003268) "AppLaunch.exe" called "GetProcAddress" with a parameter RegOpenKeyEx (UID: 00000000-00003268) "AppLaunch.exe" called "GetProcAddress" with a parameter RegOpenKeyExW (UID: 00000000-00003268) "AppLaunch.exe" called "GetProcAddress" with a parameter GetFullPathName (UID: 00000000-00003268) "AppLaunch.exe" called "GetProcAddress" with a parameter GetFullPathNameW (UID: 00000000-00003268) "AppLaunch.exe" called "GetProcAddress" with a parameter IsAppThemed (UID: 00000000-00003268) "AppLaunch.exe" called "GetProcAddress" with a parameter IsAppThemedW (UID: 00000000-00003268) "AppLaunch.exe" called "GetProcAddress" with a parameter CreateActCtx (UID: 00000000-00003268) "AppLaunch.exe" called "GetProcAddress" with a parameter CreateActCtxA (UID: 00000000-00003268) "AppLaunch.exe" called "GetProcAddress" with a parameter CoTaskMemAlloc (UID: 00000000-00003268) "AppLaunch.exe" called "GetProcAddress" with a parameter CoTaskMemFree (UID: 00000000-00003268) "AppLaunch.exe" called "GetProcAddress" with a parameter RegisterWindowMessage (UID: 00000000-00003268) "AppLaunch.exe" called "GetProcAddress" with a parameter RegisterWindowMessageW (UID: 00000000-00003268) "AppLaunch.exe" called "GetProcAddress" with a parameter CompareStringOrdinal (UID: 00000000-00003268) "AppLaunch.exe" called "GetProcAddress" with a parameter CloseHandle (UID: 00000000-00003268) "AppLaunch.exe" called "GetProcAddress" with a parameter GetCurrentProcess (UID: 00000000-00003268) "AppLaunch.exe" called "GetProcAddress" with a parameter GetCurrentProcessW (UID: 00000000-00003268) "AppLaunch.exe" called "GetProcAddress" with a parameter OpenProcessTokenW (UID: 00000000-00003268) "AppLaunch.exe" called "GetProcAddress" with a parameter SortGetHandle (UID: 00000000-00003268) "AppLaunch.exe" called "GetProcAddress" with a parameter SortCloseHandle (UID: 00000000-00003268) "AppLaunch.exe" called "GetProcAddress" with a parameter NtQuerySystemInformation (UID: 00000000-00003268) "AppLaunch.exe" called "GetProcAddress" with a parameter GetFileAttributesEx (UID: 00000000-00003268) "AppLaunch.exe" called "GetProcAddress" with a parameter GetFileAttributesExW (UID: 00000000-00003268) "AppLaunch.exe" called "GetProcAddress" with a parameter SetThreadErrorMode (UID: 00000000-00003268) "AppLaunch.exe" called "GetProcAddress" with a parameter CreateFile (UID: 00000000-00003268) "AppLaunch.exe" called "GetProcAddress" with a parameter CreateFileW (UID: 00000000-00003268) "AppLaunch.exe" called "GetProcAddress" with a parameter GetFileType (UID: 00000000-00003268) "AppLaunch.exe" called "GetProcAddress" with a parameter ConvertSidToStringSidW (UID: 00000000-00003268) "AppLaunch.exe" called "GetProcAddress" with a parameter SHGetFolderPathW (UID: 00000000-00003268) "AppLaunch.exe" called "GetProcAddress" with a parameter StringFromGUID2 (UID: 00000000-00003268) "AppLaunch.exe" called "GetProcAddress" with a parameter OpenThreadToken (UID: 00000000-00003268) "AppLaunch.exe" called "GetProcAddress" with a parameter GetProcessExecutableHeap (UID: 00000000-00003268) "AppLaunch.exe" called "GetProcAddress" with a parameter GetProcessExecutableHeap_RetAddr (UID: 00000000-00003268) "AppLaunch.exe" called "GetProcAddress" with a parameter BCryptGetFipsAlgorithmMode (UID: 00000000-00003268) "AppLaunch.exe" called "GetProcAddress" with a parameter CryptGetDefaultProviderW (UID: 00000000-00003268) "AppLaunch.exe" called "GetProcAddress" with a parameter CryptAcquireContextW (UID: 00000000-00003268) "AppLaunch.exe" called "GetProcAddress" with a parameter CPAcquireContext (UID: 00000000-00003268) "AppLaunch.exe" called "GetProcAddress" with a parameter CPReleaseContext (UID: 00000000-00003268) "AppLaunch.exe" called "GetProcAddress" with a parameter CPGenKey (UID: 00000000-00003268) "AppLaunch.exe" called "GetProcAddress" with a parameter CPDeriveKey (UID: 00000000-00003268) "AppLaunch.exe" called "GetProcAddress" with a parameter CPDestroyKey (UID: 00000000-00003268) "AppLaunch.exe" called "GetProcAddress" with a parameter CPSetKeyParam (UID: 00000000-00003268) "AppLaunch.exe" called "GetProcAddress" with a parameter CPGetKeyParam (UID: 00000000-00003268) "AppLaunch.exe" called "GetProcAddress" with a parameter CPExportKey (UID: 00000000-00003268) "AppLaunch.exe" called "GetProcAddress" with a parameter CPImportKey (UID: 00000000-00003268) "AppLaunch.exe" called "GetProcAddress" with a parameter CPEncrypt (UID: 00000000-00003268) "AppLaunch.exe" called "GetProcAddress" with a parameter CPDecrypt (UID: 00000000-00003268) "AppLaunch.exe" called "GetProcAddress" with a parameter CPCreateHash (UID: 00000000-00003268) "AppLaunch.exe" called "GetProcAddress" with a parameter CPHashData (UID: 00000000-00003268) "AppLaunch.exe" called "GetProcAddress" with a parameter CPHashSessionKey (UID: 00000000-00003268) "AppLaunch.exe" called "GetProcAddress" with a parameter CPDestroyHash (UID: 00000000-00003268) "AppLaunch.exe" called "GetProcAddress" with a parameter CPSignHash (UID: 00000000-00003268) "AppLaunch.exe" called "GetProcAddress" with a parameter CPVerifySignature (UID: 00000000-00003268) "AppLaunch.exe" called "GetProcAddress" with a parameter CPGenRandom (UID: 00000000-00003268) "AppLaunch.exe" called "GetProcAddress" with a parameter CPGetUserKey (UID: 00000000-00003268) "AppLaunch.exe" called "GetProcAddress" with a parameter CPSetProvParam (UID: 00000000-00003268) "AppLaunch.exe" called "GetProcAddress" with a parameter CPGetProvParam (UID: 00000000-00003268) "AppLaunch.exe" called "GetProcAddress" with a parameter CPSetHashParam (UID: 00000000-00003268) "AppLaunch.exe" called "GetProcAddress" with a parameter CPGetHashParam (UID: 00000000-00003268) "AppLaunch.exe" called "GetProcAddress" with a parameter CPDuplicateKey (UID: 00000000-00003268) "AppLaunch.exe" called "GetProcAddress" with a parameter CPDuplicateHash (UID: 00000000-00003268) "AppLaunch.exe" called "GetProcAddress" with a parameter EqualSid (UID: 00000000-00003268) "AppLaunch.exe" called "GetProcAddress" with a parameter CryptGenRandom (UID: 00000000-00003268) "AppLaunch.exe" called "GetProcAddress" with a parameter GetFileSize (UID: 00000000-00003268) "AppLaunch.exe" called "GetProcAddress" with a parameter ReadFile (UID: 00000000-00003268) "AppLaunch.exe" called "GetProcAddress" with a parameter GetSystemMetrics (UID: 00000000-00003268) "AppLaunch.exe" called "GetProcAddress" with a parameter GetModuleHandle (UID: 00000000-00003268) "AppLaunch.exe" called "GetProcAddress" with a parameter GetModuleHandleW (UID: 00000000-00003268) "AppLaunch.exe" called "GetProcAddress" with a parameter GetProcAddress (UID: 00000000-00003268) "AppLaunch.exe" called "GetProcAddress" with a parameter WideCharToMultiByte (UID: 00000000-00003268) "AppLaunch.exe" called "GetProcAddress" with a parameter LoadLibraryEx (UID: 00000000-00003268) "AppLaunch.exe" called "GetProcAddress" with a parameter LoadLibraryExW (UID: 00000000-00003268) "AppLaunch.exe" called "GetProcAddress" with a parameter EncodePointer (UID: 00000000-00003268) "AppLaunch.exe" called "GetProcAddress" with a parameter DecodePointer (UID: 00000000-00003268) "AppLaunch.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionAndSpinCount (UID: 00000000-00003268) "AppLaunch.exe" called "GetProcAddress" with a parameter ProcessIdToSessionId (UID: 00000000-00003268) "AppLaunch.exe" called "GetProcAddress" with a parameter ImmCreateContext (UID: 00000000-00003268) "AppLaunch.exe" called "GetProcAddress" with a parameter ImmDestroyContext (UID: 00000000-00003268) "AppLaunch.exe" called "GetProcAddress" with a parameter ImmNotifyIME (UID: 00000000-00003268) "AppLaunch.exe" called "GetProcAddress" with a parameter ImmAssociateContext (UID: 00000000-00003268) "AppLaunch.exe" called "GetProcAddress" with a parameter ImmReleaseContext (UID: 00000000-00003268) "AppLaunch.exe" called "GetProcAddress" with a parameter ImmGetContext (UID: 00000000-00003268) "AppLaunch.exe" called "GetProcAddress" with a parameter ImmGetCompositionStringA (UID: 00000000-00003268) "AppLaunch.exe" called "GetProcAddress" with a parameter ImmSetCompositionStringA (UID: 00000000-00003268) "AppLaunch.exe" called "GetProcAddress" with a parameter ImmGetCompositionStringW (UID: 00000000-00003268) "AppLaunch.exe" called "GetProcAddress" with a parameter ImmSetCompositionStringW (UID: 00000000-00003268) "AppLaunch.exe" called "GetProcAddress" with a parameter ImmSetCandidateWindow (UID: 00000000-00003268) "AppLaunch.exe" called "GetProcAddress" with a parameter AdjustWindowRectEx (UID: 00000000-00003268) "AppLaunch.exe" called "GetProcAddress" with a parameter GetCurrentThread (UID: 00000000-00003268) "AppLaunch.exe" called "GetProcAddress" with a parameter DuplicateHandle (UID: 00000000-00003268) "AppLaunch.exe" called "GetProcAddress" with a parameter GetCurrentThreadId (UID: 00000000-00003268) "AppLaunch.exe" called "GetProcAddress" with a parameter GetCurrentActCtx (UID: 00000000-00003268) "AppLaunch.exe" called "GetProcAddress" with a parameter ActivateActCtx (UID: 00000000-00003268) "AppLaunch.exe" called "GetProcAddress" with a parameter DefWindowProcW (UID: 00000000-00003268) "AppLaunch.exe" called "GetProcAddress" with a parameter GetStockObject (UID: 00000000-00003268) "AppLaunch.exe" called "GetProcAddress" with a parameter RegisterClass (UID: 00000000-00003268) "AppLaunch.exe" called "GetProcAddress" with a parameter RegisterClassW (UID: 00000000-00003268) "AppLaunch.exe" called "GetProcAddress" with a parameter CreateWindowEx (UID: 00000000-00003268) "AppLaunch.exe" called "GetProcAddress" with a parameter CreateWindowExW (UID: 00000000-00003268) "AppLaunch.exe" called "GetProcAddress" with a parameter SetWindowLong (UID: 00000000-00003268) "AppLaunch.exe" called "GetProcAddress" with a parameter SetWindowLongW (UID: 00000000-00003268) "AppLaunch.exe" called "GetProcAddress" with a parameter GetWindowLong (UID: 00000000-00003268) "AppLaunch.exe" called "GetProcAddress" with a parameter GetWindowLongW (UID: 00000000-00003268) "AppLaunch.exe" called "GetProcAddress" with a parameter RegQueryValueEx (UID: 00000000-00003268) "AppLaunch.exe" called "GetProcAddress" with a parameter RegQueryValueExW (UID: 00000000-00003268) "AppLaunch.exe" called "GetProcAddress" with a parameter CallWindowProc (UID: 00000000-00003268) "AppLaunch.exe" called "GetProcAddress" with a parameter CallWindowProcW (UID: 00000000-00003268) "AppLaunch.exe" called "GetProcAddress" with a parameter GetClientRect (UID: 00000000-00003268) "AppLaunch.exe" called "GetProcAddress" with a parameter GetWindowRect (UID: 00000000-00003268) "AppLaunch.exe" called "GetProcAddress" with a parameter GetParent (UID: 00000000-00003268) "AppLaunch.exe" called "GetProcAddress" with a parameter DeactivateActCtx (UID: 00000000-00003268) "AppLaunch.exe" called "GetProcAddress" with a parameter CryptImportKey (UID: 00000000-00003268) "AppLaunch.exe" called "GetProcAddress" with a parameter CryptExportKey (UID: 00000000-00003268) "AppLaunch.exe" called "GetProcAddress" with a parameter CryptCreateHash (UID: 00000000-00003268) "AppLaunch.exe" called "GetProcAddress" with a parameter CryptHashData (UID: 00000000-00003268) "AppLaunch.exe" called "GetProcAddress" with a parameter CryptGetHashParam (UID: 00000000-00003268) "AppLaunch.exe" called "GetProcAddress" with a parameter CryptDestroyHash (UID: 00000000-00003268) "AppLaunch.exe" called "GetProcAddress" with a parameter CryptDestroyKey (UID: 00000000-00003268) "AppLaunch.exe" called "GetProcAddress" with a parameter LocalAlloc (UID: 00000000-00003268) "AppLaunch.exe" called "GetProcAddress" with a parameter _calloc_base (UID: 00000000-00003268) "AppLaunch.exe" called "GetProcAddress" with a parameter InitializeSListHead (UID: 00000000-00003268) "AppLaunch.exe" called "GetProcAddress" with a parameter malloc (UID: 00000000-00003268) "AppLaunch.exe" called "GetProcAddress" with a parameter SetProcessDPIAware (UID: 00000000-00003268) "AppLaunch.exe" called "GetProcAddress" with a parameter GetEnvironmentVariableW (UID: 00000000-00003268) "AppLaunch.exe" called "GetProcAddress" with a parameter PathAppendW (UID: 00000000-00003268) "AppLaunch.exe" called "GetProcAddress" with a parameter DWriteCreateFactory (UID: 00000000-00003268) "AppLaunch.exe" called "GetProcAddress" with a parameter PathCombineW (UID: 00000000-00003268) "AppLaunch.exe" called "GetProcAddress" with a parameter LoadLibraryW (UID: 00000000-00003268) "AppLaunch.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00003268) "AppLaunch.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00003268) "AppLaunch.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00003268) "AppLaunch.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00003268) "AppLaunch.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00003268) "AppLaunch.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00003268) "AppLaunch.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00003268) "AppLaunch.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00003268) "AppLaunch.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00003268) "AppLaunch.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00003268) "AppLaunch.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00003268) "AppLaunch.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00003268) "AppLaunch.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00003268) "AppLaunch.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00003268) "AppLaunch.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00003268) "AppLaunch.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00003268) "AppLaunch.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00003268) "AppLaunch.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00003268) "AppLaunch.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00003268) "AppLaunch.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00003268) "AppLaunch.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00003268) "AppLaunch.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00003268) "AppLaunch.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00003268) "AppLaunch.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00003268) "AppLaunch.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00003268) "AppLaunch.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00003268) "AppLaunch.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00003268) "AppLaunch.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00003268) "AppLaunch.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00003268) "AppLaunch.exe" called "GetProcAddress" with a parameter EnumSystemLocalesEx (UID: 00000000-00003268) "AppLaunch.exe" called "GetProcAddress" with a parameter GetDateFormatEx (UID: 00000000-00003268) "AppLaunch.exe" called "GetProcAddress" with a parameter GetTimeFormatEx (UID: 00000000-00003268) "AppLaunch.exe" called "GetProcAddress" with a parameter IsValidLocaleName (UID: 00000000-00003268) "AppLaunch.exe" called "GetProcAddress" with a parameter GdiEntry13 (UID: 00000000-00003268) "AppLaunch.exe" called "GetProcAddress" with a parameter EventWrite (UID: 00000000-00003268) "AppLaunch.exe" called "GetProcAddress" with a parameter EventRegister (UID: 00000000-00003268) "AppLaunch.exe" called "GetProcAddress" with a parameter EventUnregister (UID: 00000000-00003268) "AppLaunch.exe" called "GetProcAddress" with a parameter GetDynamicTimeZoneInformation (UID: 00000000-00003268) "AppLaunch.exe" called "GetProcAddress" with a parameter SHGetFolderPath (UID: 00000000-00003268) "AppLaunch.exe" called "GetProcAddress" with a parameter GetFileMUIPath (UID: 00000000-00003268) "AppLaunch.exe" called "GetProcAddress" with a parameter FreeLibrary (UID: 00000000-00003268) "AppLaunch.exe" called "GetProcAddress" with a parameter FreeLibraryW (UID: 00000000-00003268) "AppLaunch.exe" called "GetProcAddress" with a parameter LoadStringW (UID: 00000000-00003268) "AppLaunch.exe" called "GetProcAddress" with a parameter GetFileVersionInfoSizeW (UID: 00000000-00003268) "AppLaunch.exe" called "GetProcAddress" with a parameter CryptAcquireContextA (UID: 00000000-00003268) "AppLaunch.exe" called "GetProcAddress" with a parameter CryptReleaseContext (UID: 00000000-00003268) "5ol2yF2.exe" called "GetProcAddress" with a parameter CoInitializeEx (UID: 00000000-00003396) "5ol2yF2.exe" called "GetProcAddress" with a parameter ThemeInitApiHook (UID: 00000000-00003396) "5ol2yF2.exe" called "GetProcAddress" with a parameter CreateBindCtx (UID: 00000000-00003396) "5ol2yF2.exe" called "GetProcAddress" with a parameter CoGetMalloc (UID: 00000000-00003396) "5ol2yF2.exe" called "GetProcAddress" with a parameter PSPropertyBag_ReadDWORD (UID: 00000000-00003396) "5ol2yF2.exe" called "GetProcAddress" with a parameter OpenThreadToken (UID: 00000000-00003396) "5ol2yF2.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00003396) "5ol2yF2.exe" called "GetProcAddress" with a parameter CLSIDFromOle1Class (UID: 00000000-00003396) "5ol2yF2.exe" called "GetProcAddress" with a parameter DllGetClassObject (UID: 00000000-00003396) "5ol2yF2.exe" called "GetProcAddress" with a parameter DllCanUnloadNow (UID: 00000000-00003396) "5ol2yF2.exe" called "GetProcAddress" with a parameter InitializeSecurityDescriptor (UID: 00000000-00003396) "5ol2yF2.exe" called "GetProcAddress" with a parameter SetEntriesInAclW (UID: 00000000-00003396) "5ol2yF2.exe" called "GetProcAddress" with a parameter PropVariantClear (UID: 00000000-00003396) "5ol2yF2.exe" called "GetProcAddress" with a parameter CoTaskMemFree (UID: 00000000-00003396) "5ol2yF2.exe" called "GetProcAddress" with a parameter ApphelpCheckShellObject (UID: 00000000-00003396) "5ol2yF2.exe" called "GetProcAddress" with a parameter CM_Get_Device_Interface_List_Size_ExW (UID: 00000000-00003396) "5ol2yF2.exe" called "GetProcAddress" with a parameter CM_Get_Device_Interface_List_ExW (UID: 00000000-00003396) "5ol2yF2.exe" called "GetProcAddress" with a parameter SHGetFolderPathW (UID: 00000000-00003396) "5ol2yF2.exe" called "GetProcAddress" with a parameter ConvertStringSidToSidW (UID: 00000000-00003396) "5ol2yF2.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00003396) "5ol2yF2.exe" called "GetProcAddress" with a parameter SystemFunction036 (UID: 00000000-00003396) "5ol2yF2.exe" called "GetProcAddress" with a parameter IsProcessDPIAware (UID: 00000000-00003396) "5ol2yF2.exe" called "GetProcAddress" with a parameter RegisterTraceGuidsW (UID: 00000000-00003396) "5ol2yF2.exe" called "GetProcAddress" with a parameter EventRegister (UID: 00000000-00003396) "5ol2yF2.exe" called "GetProcAddress" with a parameter EventUnregister (UID: 00000000-00003396) "5ol2yF2.exe" called "GetProcAddress" with a parameter EventEnabled (UID: 00000000-00003396) "5ol2yF2.exe" called "GetProcAddress" with a parameter EventWrite (UID: 00000000-00003396) "5ol2yF2.exe" called "GetProcAddress" with a parameter PSCreateMemoryPropertyStore (UID: 00000000-00003396) "5ol2yF2.exe" called "GetProcAddress" with a parameter PSPropertyBag_WriteDWORD (UID: 00000000-00003396) "5ol2yF2.exe" called "GetProcAddress" with a parameter CoTaskMemAlloc (UID: 00000000-00003396) "5ol2yF2.exe" called "GetProcAddress" with a parameter CoGetApartmentType (UID: 00000000-00003396) "5ol2yF2.exe" called "GetProcAddress" with a parameter CoRegisterInitializeSpy (UID: 00000000-00003396) "5ol2yF2.exe" called "GetProcAddress" with a parameter LpkEditControl (UID: 00000000-00003396) "5ol2yF2.exe" called "GetProcAddress" with a parameter StringFromGUID2 (UID: 00000000-00003396) "5ol2yF2.exe" called "GetProcAddress" with a parameter RegEnumKeyW (UID: 00000000-00003396) "5ol2yF2.exe" called "GetProcAddress" with a parameter PSPropertyBag_ReadBSTR (UID: 00000000-00003396) "5ol2yF2.exe" called "GetProcAddress" with a parameter PSPropertyBag_ReadStrAlloc (UID: 00000000-00003396) "5ol2yF2.exe" called "GetProcAddress" with a parameter GetCatalogObject (UID: 00000000-00003396) "5ol2yF2.exe" called "GetProcAddress" with a parameter GetCatalogObject2 (UID: 00000000-00003396) "5ol2yF2.exe" called "GetProcAddress" with a parameter GetMartaExtensionInterface (UID: 00000000-00003396) "5ol2yF2.exe" called "GetProcAddress" with a parameter SetSecurityDescriptorDacl (UID: 00000000-00003396) "5ol2yF2.exe" called "GetProcAddress" with a parameter IsTextUnicode (UID: 00000000-00003396) "5ol2yF2.exe" called "GetProcAddress" with a parameter CoUninitialize (UID: 00000000-00003396) "5ol2yF2.exe" called "GetProcAddress" with a parameter ConvertSidToStringSidW (UID: 00000000-00003396) "5ol2yF2.exe" called "GetProcAddress" with a parameter RegQueryValueW (UID: 00000000-00003396) "5ol2yF2.exe" called "GetProcAddress" with a parameter PSPropertyBag_ReadGUID (UID: 00000000-00003396) "5ol2yF2.exe" called "GetProcAddress" with a parameter RegOpenKeyExW (UID: 00000000-00003396) "5ol2yF2.exe" called "GetProcAddress" with a parameter RegGetValueW (UID: 00000000-00003396) "5ol2yF2.exe" called "GetProcAddress" with a parameter RegCloseKey (UID: 00000000-00003396) "5ol2yF2.exe" called "GetProcAddress" with a parameter CoTaskMemRealloc (UID: 00000000-00003396) "5ol2yF2.exe" called "GetProcAddress" with a parameter InitPropVariantFromStringAsVector (UID: 00000000-00003396) "5ol2yF2.exe" called "GetProcAddress" with a parameter PSCoerceToCanonicalValue (UID: 00000000-00003396) "5ol2yF2.exe" called "GetProcAddress" with a parameter PropVariantToStringAlloc (UID: 00000000-00003396) "5ol2yF2.exe" called "GetProcAddress" with a parameter CoAllowSetForegroundWindow (UID: 00000000-00003396) "5ol2yF2.exe" called "GetProcAddress" with a parameter GetUserNameExW (UID: 00000000-00003396) "5ol2yF2.exe" called "GetProcAddress" with a parameter PathCreateFromUrlW (UID: 00000000-00003396) "5ol2yF2.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00003396) "5ol2yF2.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00003396) "5ol2yF2.exe" called "GetProcAddress" with a parameter SaferGetPolicyInformation (UID: 00000000-00003396) "5ol2yF2.exe" called "GetProcAddress" with a parameter RtlDllShutdownInProgress (UID: 00000000-00003396) "5ol2yF2.exe" called "GetProcAddress" with a parameter CoRevokeInitializeSpy (UID: 00000000-00003396) "5ol2yF2.exe" called "GetProcAddress" with a parameter UnregisterTraceGuids (UID: 00000000-00003396) "5ol2yF2.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00003396) "explothe.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00001460) "explothe.exe" called "GetProcAddress" with a parameter SetSystemFileCacheSize (UID: 00000000-00001460) "explothe.exe" called "GetProcAddress" with a parameter NtSetSystemInformation (UID: 00000000-00001460) "explothe.exe" called "GetProcAddress" with a parameter PrivIsDllSynchronizationHeld (UID: 00000000-00001460) "explothe.exe" called "GetProcAddress" with a parameter SHGetInstanceExplorer (UID: 00000000-00001460) "explothe.exe" called "GetProcAddress" with a parameter ThemeInitApiHook (UID: 00000000-00001460) "explothe.exe" called "GetProcAddress" with a parameter IsProcessDPIAware (UID: 00000000-00001460) "explothe.exe" called "GetProcAddress" with a parameter EventRegister (UID: 00000000-00001460) "explothe.exe" called "GetProcAddress" with a parameter EventUnregister (UID: 00000000-00001460) "explothe.exe" called "GetProcAddress" with a parameter EventEnabled (UID: 00000000-00001460) "explothe.exe" called "GetProcAddress" with a parameter EventWrite (UID: 00000000-00001460) "explothe.exe" called "GetProcAddress" with a parameter PSCreateMemoryPropertyStore (UID: 00000000-00001460) "explothe.exe" called "GetProcAddress" with a parameter PSPropertyBag_WriteDWORD (UID: 00000000-00001460) "explothe.exe" called "GetProcAddress" with a parameter CoGetApartmentType (UID: 00000000-00001460) "explothe.exe" called "GetProcAddress" with a parameter CoRegisterInitializeSpy (UID: 00000000-00001460) "explothe.exe" called "GetProcAddress" with a parameter CoTaskMemFree (UID: 00000000-00001460) "explothe.exe" called "GetProcAddress" with a parameter CoTaskMemAlloc (UID: 00000000-00001460) "explothe.exe" called "GetProcAddress" with a parameter CoGetMalloc (UID: 00000000-00001460) "explothe.exe" called "GetProcAddress" with a parameter PSPropertyBag_ReadDWORD (UID: 00000000-00001460) "explothe.exe" called "GetProcAddress" with a parameter PSPropertyBag_ReadGUID (UID: 00000000-00001460) "explothe.exe" called "GetProcAddress" with a parameter RegEnumKeyW (UID: 00000000-00001460) "explothe.exe" called "GetProcAddress" with a parameter StringFromGUID2 (UID: 00000000-00001460) "explothe.exe" called "GetProcAddress" with a parameter CM_Get_Device_Interface_List_Size_ExW (UID: 00000000-00001460) "explothe.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00001460) "explothe.exe" called "GetProcAddress" with a parameter AcquireSRWLockShared (UID: 00000000-00001460) "explothe.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00001460) "explothe.exe" called "GetProcAddress" with a parameter ReleaseSRWLockShared (UID: 00000000-00001460) "explothe.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00001460) "explothe.exe" called "GetProcAddress" with a parameter GetNativeSystemInfo (UID: 00000000-00001460) "explothe.exe" called "GetProcAddress" with a parameter GetSidSubAuthorityCount (UID: 00000000-00001460) "explothe.exe" called "GetProcAddress" with a parameter GetSidSubAuthority (UID: 00000000-00001460) "explothe.exe" called "GetProcAddress" with a parameter RegCreateKeyExA (UID: 00000000-00001460) "explothe.exe" called "GetProcAddress" with a parameter RegQueryValueExA (UID: 00000000-00001460) "explothe.exe" called "GetProcAddress" with a parameter RegOpenKeyExW (UID: 00000000-00001460) "explothe.exe" called "GetProcAddress" with a parameter RegGetValueW (UID: 00000000-00001460) "explothe.exe" called "GetProcAddress" with a parameter RegCloseKey (UID: 00000000-00001460) "explothe.exe" called "GetProcAddress" with a parameter RegGetValueA (UID: 00000000-00001460) "explothe.exe" called "GetProcAddress" with a parameter RegOpenKeyExA (UID: 00000000-00001460) "explothe.exe" called "GetProcAddress" with a parameter OleInitialize (UID: 00000000-00001460) "explothe.exe" called "GetProcAddress" with a parameter SystemFunction036 (UID: 00000000-00001460) "explothe.exe" called "GetProcAddress" with a parameter CreateBindCtx (UID: 00000000-00001460) "explothe.exe" called "GetProcAddress" with a parameter RegisterTraceGuidsW (UID: 00000000-00001460) "explothe.exe" called "GetProcAddress" with a parameter RegQueryValueExW (UID: 00000000-00001460) "explothe.exe" called "GetProcAddress" with a parameter EventActivityIdControl (UID: 00000000-00001460) "explothe.exe" called "GetProcAddress" with a parameter RegCreateKeyExW (UID: 00000000-00001460) "explothe.exe" called "GetProcAddress" with a parameter RegSetValueExW (UID: 00000000-00001460) "explothe.exe" called "GetProcAddress" with a parameter LpkEditControl (UID: 00000000-00001460) "explothe.exe" called "GetProcAddress" with a parameter OpenThreadToken (UID: 00000000-00001460) "explothe.exe" called "GetProcAddress" with a parameter ApphelpCheckShellObject (UID: 00000000-00001460) "explothe.exe" called "GetProcAddress" with a parameter DnsGetProxyInformation (UID: 00000000-00001460) "explothe.exe" called "GetProcAddress" with a parameter CoInitializeEx (UID: 00000000-00001460) "explothe.exe" called "GetProcAddress" with a parameter Dhcpv6QueryLeaseInfo (UID: 00000000-00001460) "explothe.exe" called "GetProcAddress" with a parameter Dhcpv6FreeLeaseInfo (UID: 00000000-00001460) "explothe.exe" called "GetProcAddress" with a parameter DhcpIsEnabled (UID: 00000000-00001460) "explothe.exe" called "GetProcAddress" with a parameter ConvertInterfaceNameToLuidW (UID: 00000000-00001460) "explothe.exe" called "GetProcAddress" with a parameter DhcpQueryLeaseInfo (UID: 00000000-00001460) "explothe.exe" called "GetProcAddress" with a parameter DhcpFreeLeaseInfo (UID: 00000000-00001460) "explothe.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00001460) "explothe.exe" called "GetProcAddress" with a parameter CLSIDFromOle1Class (UID: 00000000-00001460) "explothe.exe" called "GetProcAddress" with a parameter GetCatalogObject (UID: 00000000-00001460) "explothe.exe" called "GetProcAddress" with a parameter GetCatalogObject2 (UID: 00000000-00001460) "explothe.exe" called "GetProcAddress" with a parameter EventSetInformation (UID: 00000000-00001460) "explothe.exe" called "GetProcAddress" with a parameter InitCommonControlsEx (UID: 00000000-00001460) "explothe.exe" called "GetProcAddress" with a parameter DllGetClassObject (UID: 00000000-00001460) "explothe.exe" called "GetProcAddress" with a parameter DllCanUnloadNow (UID: 00000000-00001460) "explothe.exe" called "GetProcAddress" with a parameter PSPropertyBag_ReadStrAlloc (UID: 00000000-00001460) "explothe.exe" called "GetProcAddress" with a parameter CM_Get_Device_Interface_List_ExW (UID: 00000000-00001460) "explothe.exe" called "GetProcAddress" with a parameter PropVariantToStringAlloc (UID: 00000000-00001460) "explothe.exe" called "GetProcAddress" with a parameter PropVariantClear (UID: 00000000-00001460) "explothe.exe" called "GetProcAddress" with a parameter GetUserNameExW (UID: 00000000-00001460) "explothe.exe" called "GetProcAddress" with a parameter CoInternetCreateSecurityManager (UID: 00000000-00001460) "explothe.exe" called "GetProcAddress" with a parameter CoInternetCreateZoneManager (UID: 00000000-00001460) "explothe.exe" called "GetProcAddress" with a parameter WinHttpCreateProxyResolver (UID: 00000000-00001460) "explothe.exe" called "GetProcAddress" with a parameter WSPStartup (UID: 00000000-00001460) "explothe.exe" called "GetProcAddress" with a parameter WSHOpenSocket (UID: 00000000-00001460) "explothe.exe" called "GetProcAddress" with a parameter WSHOpenSocket2 (UID: 00000000-00001460) "explothe.exe" called "GetProcAddress" with a parameter WSHJoinLeaf (UID: 00000000-00001460) "explothe.exe" called "GetProcAddress" with a parameter WSHNotify (UID: 00000000-00001460) "explothe.exe" called "GetProcAddress" with a parameter WSHGetSocketInformation (UID: 00000000-00001460) "explothe.exe" called "GetProcAddress" with a parameter WSHSetSocketInformation (UID: 00000000-00001460) "explothe.exe" called "GetProcAddress" with a parameter WSHGetSockaddrType (UID: 00000000-00001460) "explothe.exe" called "GetProcAddress" with a parameter WSHGetWildcardSockaddr (UID: 00000000-00001460) "explothe.exe" called "GetProcAddress" with a parameter WSHGetBroadcastSockaddr (UID: 00000000-00001460) "explothe.exe" called "GetProcAddress" with a parameter WSHAddressToString (UID: 00000000-00001460) "explothe.exe" called "GetProcAddress" with a parameter WSHStringToAddress (UID: 00000000-00001460) "explothe.exe" called "GetProcAddress" with a parameter WSHIoctl (UID: 00000000-00001460) "explothe.exe" called "GetProcAddress" with a parameter WSAIoctl (UID: 00000000-00001460) "explothe.exe" called "GetProcAddress" with a parameter SHGetValueA (UID: 00000000-00001460) "explothe.exe" called "GetProcAddress" with a parameter NdrClientCall2 (UID: 00000000-00001460) "explothe.exe" called "GetProcAddress" with a parameter RpcStringBindingComposeW (UID: 00000000-00001460) "explothe.exe" called "GetProcAddress" with a parameter RpcBindingFromStringBindingW (UID: 00000000-00001460) "explothe.exe" called "GetProcAddress" with a parameter RpcStringFreeW (UID: 00000000-00001460) "explothe.exe" called "GetProcAddress" with a parameter RpcBindingFree (UID: 00000000-00001460) "explothe.exe" called "GetProcAddress" with a parameter getaddrinfo (UID: 00000000-00001460) "explothe.exe" called "GetProcAddress" with a parameter getnameinfo (UID: 00000000-00001460) "explothe.exe" called "GetProcAddress" with a parameter freeaddrinfo (UID: 00000000-00001460) "explothe.exe" called "GetProcAddress" with a parameter WSASocketA (UID: 00000000-00001460) "explothe.exe" called "GetProcAddress" with a parameter DhcpRequestParams (UID: 00000000-00001460) "explothe.exe" called "GetProcAddress" with a parameter ConvertInterfaceGuidToLuid (UID: 00000000-00001460) "explothe.exe" called "GetProcAddress" with a parameter WSAttemptAutodialAddr (UID: 00000000-00001460) "explothe.exe" called "GetProcAddress" with a parameter WSAttemptAutodialName (UID: 00000000-00001460) "explothe.exe" called "GetProcAddress" with a parameter WSNoteSuccessfulHostentLookup (UID: 00000000-00001460) "explothe.exe" called "GetProcAddress" with a parameter CoSetProxyBlanket (UID: 00000000-00001460) "explothe.exe" called "GetProcAddress" with a parameter ObjectStublessClient10 (UID: 00000000-00001460) "explothe.exe" called "GetProcAddress" with a parameter OpenProcessToken (UID: 00000000-00001460) "explothe.exe" called "GetProcAddress" with a parameter GetTokenInformation (UID: 00000000-00001460) "explothe.exe" called "GetProcAddress" with a parameter AllocateAndInitializeSid (UID: 00000000-00001460) "explothe.exe" called "GetProcAddress" with a parameter EqualSid (UID: 00000000-00001460) "explothe.exe" called "GetProcAddress" with a parameter FreeSid (UID: 00000000-00001460) "explothe.exe" called "GetProcAddress" with a parameter CryptGenRandom (UID: 00000000-00001460) "explothe.exe" called "GetProcAddress" with a parameter CoGetMarshalSizeMax (UID: 00000000-00001460) "explothe.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00001460) "explothe.exe" called "GetProcAddress" with a parameter CoMarshalInterface (UID: 00000000-00001460) "explothe.exe" called "GetProcAddress" with a parameter CoUnmarshalInterface (UID: 00000000-00001460) "explothe.exe" called "GetProcAddress" with a parameter StringFromIID (UID: 00000000-00001460) "explothe.exe" called "GetProcAddress" with a parameter CoGetPSClsid (UID: 00000000-00001460) "explothe.exe" called "GetProcAddress" with a parameter CoReleaseMarshalData (UID: 00000000-00001460) "explothe.exe" called "GetProcAddress" with a parameter DcomChannelSetHResult (UID: 00000000-00001460) "explothe.exe" called "GetProcAddress" with a parameter RegEnumKeyExW (UID: 00000000-00001460) "explothe.exe" called "GetProcAddress" with a parameter RegOpenKeyW (UID: 00000000-00001460) "explothe.exe" called "GetProcAddress" with a parameter GetIpForwardTable2 (UID: 00000000-00001460) "explothe.exe" called "GetProcAddress" with a parameter GetIpNetEntry2 (UID: 00000000-00001460) "explothe.exe" called "GetProcAddress" with a parameter FreeMibTable (UID: 00000000-00001460) "explothe.exe" called "GetProcAddress" with a parameter CoUninitialize (UID: 00000000-00001460) "6Um8bf3.exe" called "GetProcAddress" with a parameter ThemeInitApiHook (UID: 00000000-00001884) "6Um8bf3.exe" called "GetProcAddress" with a parameter IsProcessDPIAware (UID: 00000000-00001884) "6Um8bf3.exe" called "GetProcAddress" with a parameter SetSystemFileCacheSize (UID: 00000000-00001884) "6Um8bf3.exe" called "GetProcAddress" with a parameter NtSetSystemInformation (UID: 00000000-00001884) "6Um8bf3.exe" called "GetProcAddress" with a parameter PrivIsDllSynchronizationHeld (UID: 00000000-00001884) "6Um8bf3.exe" called "GetProcAddress" with a parameter SHGetInstanceExplorer (UID: 00000000-00001884) "6Um8bf3.exe" called "GetProcAddress" with a parameter OleInitialize (UID: 00000000-00001884) "6Um8bf3.exe" called "GetProcAddress" with a parameter CreateBindCtx (UID: 00000000-00001884) "6Um8bf3.exe" called "GetProcAddress" with a parameter CoTaskMemAlloc (UID: 00000000-00001884) "6Um8bf3.exe" called "GetProcAddress" with a parameter RegisterTraceGuidsW (UID: 00000000-00001884) "6Um8bf3.exe" called "GetProcAddress" with a parameter EventRegister (UID: 00000000-00001884) "6Um8bf3.exe" called "GetProcAddress" with a parameter EventUnregister (UID: 00000000-00001884) "6Um8bf3.exe" called "GetProcAddress" with a parameter EventEnabled (UID: 00000000-00001884) "6Um8bf3.exe" called "GetProcAddress" with a parameter EventWrite (UID: 00000000-00001884) "6Um8bf3.exe" called "GetProcAddress" with a parameter PSCreateMemoryPropertyStore (UID: 00000000-00001884) "6Um8bf3.exe" called "GetProcAddress" with a parameter PSPropertyBag_WriteDWORD (UID: 00000000-00001884) "6Um8bf3.exe" called "GetProcAddress" with a parameter CoGetApartmentType (UID: 00000000-00001884) "6Um8bf3.exe" called "GetProcAddress" with a parameter CoRegisterInitializeSpy (UID: 00000000-00001884) "6Um8bf3.exe" called "GetProcAddress" with a parameter CoTaskMemFree (UID: 00000000-00001884) "6Um8bf3.exe" called "GetProcAddress" with a parameter CoGetMalloc (UID: 00000000-00001884) "6Um8bf3.exe" called "GetProcAddress" with a parameter PSPropertyBag_ReadDWORD (UID: 00000000-00001884) "6Um8bf3.exe" called "GetProcAddress" with a parameter StringFromGUID2 (UID: 00000000-00001884) "6Um8bf3.exe" called "GetProcAddress" with a parameter RegEnumKeyW (UID: 00000000-00001884) "6Um8bf3.exe" called "GetProcAddress" with a parameter PSPropertyBag_ReadBSTR (UID: 00000000-00001884) "6Um8bf3.exe" called "GetProcAddress" with a parameter PSPropertyBag_ReadStrAlloc (UID: 00000000-00001884) "6Um8bf3.exe" called "GetProcAddress" with a parameter OpenThreadToken (UID: 00000000-00001884) "6Um8bf3.exe" called "GetProcAddress" with a parameter CoInitializeEx (UID: 00000000-00001884) "6Um8bf3.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00001884) "6Um8bf3.exe" called "GetProcAddress" with a parameter CLSIDFromOle1Class (UID: 00000000-00001884) "6Um8bf3.exe" called "GetProcAddress" with a parameter GetCatalogObject (UID: 00000000-00001884) "6Um8bf3.exe" called "GetProcAddress" with a parameter GetCatalogObject2 (UID: 00000000-00001884) "6Um8bf3.exe" called "GetProcAddress" with a parameter DllGetClassObject (UID: 00000000-00001884) "6Um8bf3.exe" called "GetProcAddress" with a parameter DllCanUnloadNow (UID: 00000000-00001884) "6Um8bf3.exe" called "GetProcAddress" with a parameter InitializeSecurityDescriptor (UID: 00000000-00001884) "6Um8bf3.exe" called "GetProcAddress" with a parameter SetEntriesInAclW (UID: 00000000-00001884) "6Um8bf3.exe" called "GetProcAddress" with a parameter GetMartaExtensionInterface (UID: 00000000-00001884) "6Um8bf3.exe" called "GetProcAddress" with a parameter SetSecurityDescriptorDacl (UID: 00000000-00001884) "6Um8bf3.exe" called "GetProcAddress" with a parameter IsTextUnicode (UID: 00000000-00001884) "6Um8bf3.exe" called "GetProcAddress" with a parameter CoUninitialize (UID: 00000000-00001884) "6Um8bf3.exe" called "GetProcAddress" with a parameter ConvertSidToStringSidW (UID: 00000000-00001884) "6Um8bf3.exe" called "GetProcAddress" with a parameter RegOpenKeyExW (UID: 00000000-00001884) "6Um8bf3.exe" called "GetProcAddress" with a parameter RegGetValueW (UID: 00000000-00001884) "6Um8bf3.exe" called "GetProcAddress" with a parameter RegCloseKey (UID: 00000000-00001884) "6Um8bf3.exe" called "GetProcAddress" with a parameter CoTaskMemRealloc (UID: 00000000-00001884) "6Um8bf3.exe" called "GetProcAddress" with a parameter InitPropVariantFromStringAsVector (UID: 00000000-00001884) "6Um8bf3.exe" called "GetProcAddress" with a parameter PSCoerceToCanonicalValue (UID: 00000000-00001884) "6Um8bf3.exe" called "GetProcAddress" with a parameter GetUserNameExW (UID: 00000000-00001884) "6Um8bf3.exe" called "GetProcAddress" with a parameter PathCreateFromUrlW (UID: 00000000-00001884) "6Um8bf3.exe" called "GetProcAddress" with a parameter RtlDllShutdownInProgress (UID: 00000000-00001884) "6Um8bf3.exe" called "GetProcAddress" with a parameter OleUninitialize (UID: 00000000-00001884) "6Um8bf3.exe" called "GetProcAddress" with a parameter CoRevokeInitializeSpy (UID: 00000000-00001884) "6Um8bf3.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00001884) "6Um8bf3.exe" called "GetProcAddress" with a parameter SystemFunction036 (UID: 00000000-00001884) "6Um8bf3.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00001884) "6Um8bf3.exe" called "GetProcAddress" with a parameter GetLongPathNameW (UID: 00000000-00001884) "6Um8bf3.exe" called "GetProcAddress" with a parameter PropVariantToStringAlloc (UID: 00000000-00001884) "6Um8bf3.exe" called "GetProcAddress" with a parameter PropVariantClear (UID: 00000000-00001884) "6Um8bf3.exe" called "GetProcAddress" with a parameter CoAllowSetForegroundWindow (UID: 00000000-00001884) "6Um8bf3.exe" called "GetProcAddress" with a parameter CM_Get_Device_Interface_List_Size_ExW (UID: 00000000-00001884) "6Um8bf3.exe" called "GetProcAddress" with a parameter CM_Get_Device_Interface_List_ExW (UID: 00000000-00001884) "6Um8bf3.exe" called "GetProcAddress" with a parameter UnregisterTraceGuids (UID: 00000000-00001884) "6Um8bf3.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00001884) "cmd.exe" called "GetProcAddress" with a parameter ShellExecuteExW (UID: 00000000-00002248) "cmd.exe" called "GetProcAddress" with a parameter ThemeInitApiHook (UID: 00000000-00002248) "cmd.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00002248) "cmd.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00002248) "cmd.exe" called "GetProcAddress" with a parameter AcquireSRWLockShared (UID: 00000000-00002248) "cmd.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00002248) "cmd.exe" called "GetProcAddress" with a parameter ReleaseSRWLockShared (UID: 00000000-00002248) "cmd.exe" called "GetProcAddress" with a parameter EventSetInformation (UID: 00000000-00002248) "cmd.exe" called "GetProcAddress" with a parameter InitCommonControlsEx (UID: 00000000-00002248) "cmd.exe" called "GetProcAddress" with a parameter IsValidURL (UID: 00000000-00002248) "cmd.exe" called "GetProcAddress" with a parameter PropVariantToBSTR (UID: 00000000-00002248) "cmd.exe" called "GetProcAddress" with a parameter PropVariantClear (UID: 00000000-00002248) "cmd.exe" called "GetProcAddress" with a parameter CoTaskMemFree (UID: 00000000-00002248) "cmd.exe" called "GetProcAddress" with a parameter IUnknown_Set (UID: 00000000-00002248) "cmd.exe" called "GetProcAddress" with a parameter PSPropertyBag_ReadStrAlloc (UID: 00000000-00002248) "cmd.exe" called "GetProcAddress" with a parameter PSPropertyBag_ReadDWORD (UID: 00000000-00002248) "cmd.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00002248) "cmd.exe" called "GetProcAddress" with a parameter FindWindowExW (UID: 00000000-00002248) "cmd.exe" called "GetProcAddress" with a parameter IsProcessDPIAware (UID: 00000000-00002248) "cmd.exe" called "GetProcAddress" with a parameter CoTaskMemAlloc (UID: 00000000-00002248) "cmd.exe" called "GetProcAddress" with a parameter RegisterTraceGuidsW (UID: 00000000-00002248) "cmd.exe" called "GetProcAddress" with a parameter OpenThreadToken (UID: 00000000-00002248) "cmd.exe" called "GetProcAddress" with a parameter OpenProcessToken (UID: 00000000-00002248) "cmd.exe" called "GetProcAddress" with a parameter SHStrDupW (UID: 00000000-00002248) "cmd.exe" called "GetProcAddress" with a parameter OleUninitialize (UID: 00000000-00002248) "cmd.exe" called "GetProcAddress" with a parameter PSCreateAdapterFromPropertyStore (UID: 00000000-00002248) "schtasks.exe" called "GetProcAddress" with a parameter IsProcessDPIAware (UID: 00000000-00002784) "schtasks.exe" called "GetProcAddress" with a parameter ThemeInitApiHook (UID: 00000000-00002784) "schtasks.exe" called "GetProcAddress" with a parameter LookupAccountSidLocalW (UID: 00000000-00002784) "schtasks.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00002784) "schtasks.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00002784) "cmd.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00002860) "cmd.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00002860) "explothe.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00002512) "explothe.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00002512) "explothe.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00002512) "explothe.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00002512) "explothe.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00002512) "explothe.exe" called "GetProcAddress" with a parameter UnregisterTraceGuids (UID: 00000000-00002512) "cacls.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00003744) "cmd.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00003092) "cacls.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00002920) "cacls.exe" called "GetProcAddress" with a parameter LpkTabbedTextOut (UID: 00000000-00002920) "cacls.exe" called "GetProcAddress" with a parameter LpkPSMTextOut (UID: 00000000-00002920) "cacls.exe" called "GetProcAddress" with a parameter LpkDrawTextEx (UID: 00000000-00002920) "cacls.exe" called "GetProcAddress" with a parameter LpkEditControl (UID: 00000000-00002920) "cacls.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00002920) "cacls.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00002920) "cacls.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00002920) "rundll32.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00001384) "rundll32.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00001384) "rundll32.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00001384) "explothe.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00002152) "explothe.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00002152) "explothe.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00002152) "explothe.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00002152) "explothe.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00002152) "explothe.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00002152) "explothe.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00002152) "explothe.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00002152) "explothe.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00002152) "explothe.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00002152) "explothe.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00002152) "explothe.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00002152) "explothe.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00002152) "explothe.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00002152) "explothe.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00002152) "explothe.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00002152) "explothe.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00002152) "explothe.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00002152) "explothe.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00002152) "explothe.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00002152) "explothe.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00002152) "explothe.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00002152) "explothe.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00002152) "explothe.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00002152) "explothe.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00002152) "explothe.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00002152) "explothe.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00002152) "explothe.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00002152) "explothe.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00002152) "explothe.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00002152) "explothe.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00002152) "explothe.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00002152) "explothe.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00002152) "explothe.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00002152) "explothe.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00002152) "explothe.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00002152) "explothe.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00002152) "explothe.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00002152) "explothe.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00002152) "explothe.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00002152) "explothe.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00002152) "explothe.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00003280) "explothe.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00003280) "explothe.exe" called "GetProcAddress" with a parameter GetNativeSystemInfo (UID: 00000000-00003280) "explothe.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00003280) "explothe.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00003280) "explothe.exe" called "GetProcAddress" with a parameter UnregisterTraceGuids (UID: 00000000-00003280) "explothe.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00003232) "explothe.exe" called "GetProcAddress" with a parameter UnregisterTraceGuids (UID: 00000000-00003232) "explothe.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00003232)36:T92a,Found reference to API "CreateProcessA" (Indicator: "CreateProcess"; File: "file") Found reference to API "ElevateCreateProcess WRPMitigationLayer" (Indicator: "CreateProcess"; File: "00002736.00000AB0.1113237.00050000.wprm") Found reference to API "__COMPAT_LAYER=ElevateCreateProcess WRPMitigationLayer" (Indicator: "CreateProcess"; Source: "00000000-00000876.00000000.67426.00520000.00000004.mdmp, 00000000-00000876.00000000.67426.007E0000.00000004.mdmp, 00000000-00000876.00000000.67434.003C0000.00000004.mdmp") Found reference to API "__COMPAT_LAYER=ElevateCreateProcess WRPMitig" (Indicator: "CreateProcess"; Source: "00000000-00000876.00000000.67426.007E0000.00000004.mdmp") Found reference to API "ElevateCreateProcess" (Indicator: "CreateProcess"; Source: "00000000-00000876.00000000.67434.003C0000.00000004.mdmp") Found reference to API "ElevateCreateProcess WRPMitigationLayer" (Indicator: "CreateProcess"; Source: "00000000-00000876.00000000.67434.003C0000.00000004.mdmp") Found reference to API "__COMPAT_LAYER=ElevateCreateProcess WRPMitigationLayer" (Indicator: "CreateProcess"; Source: "00000000-00000928.00000000.66890.00070000.00000004.mdmp, 00000000-00000928.00000000.66890.00640000.00000004.mdmp, 00000000-00000928.00000001.68810.00070000.00000004.mdmp, 00000000-00000928.00000001.68810.00AF0000.00000004.mdmp, 00000000-00000928.00000002.70098.00070000.00000004.mdmp, 00000000-00000928.00000002.70098.00640000.00000004.mdmp, 00000000-00000928.00000002.70098.00AF0000.00000004.mdmp") Found reference to API "ElevateCreateProcess" (Indicator: "CreateProcess"; Source: "00000000-00000928.00000000.66890.00070000.00000004.mdmp, 00000000-00000928.00000001.68810.00070000.00000004.mdmp, 00000000-00000928.00000002.70098.00070000.00000004.mdmp") Found reference to API "ElevateCreateProcess WRPMitigationLayer" (Indicator: "CreateProcess"; Source: "00000000-00000928.00000000.66890.00070000.00000004.mdmp, 00000000-00000928.00000001.68810.00070000.00000004.mdmp, 00000000-00000928.00000002.70098.00070000.00000004.mdmp") Found reference to API "__COMPAT_LAYER=ElevateCreateProcess WRPMitigj" (Indicator: "CreateProcess"; Source: "00000000-00000928.00000000.66890.00640000.00000004.mdmp") Found reference to API "CreateProcessA" (Indicator: "CreateProcess"; Source: "00000000-00000928.00000000.66890.00C9A000.00000002.mdmp")37:Tc937,Found reference to API (Indicator: "CheckTokenMembership"; File: "file") Found reference to API (Indicator: "HeapSetInformation"; File: "file") Found reference to API (Indicator: "DecryptFileA"; File: "file") Found reference to API (Indicator: "SHBrowseForFolder"; File: "file") Found reference to API (Indicator: "SHGetPathFromIDList"; File: "file") Found reference to API (Indicator: "GetTokenInformation"; File: "file") Found reference to API (Indicator: "RegDeleteValueA"; File: "file") Found reference to API (Indicator: "RegOpenKeyExA"; File: "file") Found reference to API (Indicator: "RegQueryInfoKeyA"; File: "file") Found reference to API (Indicator: "FreeSid"; File: "file") Found reference to API (Indicator: "OpenProcessToken"; File: "file") Found reference to API (Indicator: "RegSetValueExA"; File: "file") Found reference to API (Indicator: "RegCreateKeyExA"; File: "file") Found reference to API (Indicator: "LookupPrivilegeValueA"; File: "file") Found reference to API (Indicator: "AllocateAndInitializeSid"; File: "file") Found reference to API (Indicator: "RegQueryValueExA"; File: "file") Found reference to API (Indicator: "EqualSid"; File: "file") Found reference to API (Indicator: "RegCloseKey"; File: "file") Found reference to API (Indicator: "AdjustTokenPrivileges"; File: "file") Found reference to API (Indicator: "GetShortPathNameA"; File: "file") Found reference to API (Indicator: "GetModuleFileNameA"; File: "file") Found reference to API (Indicator: "FindFirstFileA"; File: "file") Found reference to API (Indicator: "GetCurrentProcess"; File: "file") Found reference to API (Indicator: "FindNextFileA"; File: "file") Found reference to API (Indicator: "ExpandEnvironmentStringsA"; File: "file") Found reference to API (Indicator: "FindClose"; File: "file") Found reference to API (Indicator: "LocalAlloc"; File: "file") Found reference to API (Indicator: "lstrcmpA"; File: "file") Found reference to API (Indicator: "CompareStringA"; File: "file") Found reference to API (Indicator: "GetLastError"; File: "file") Found reference to API (Indicator: "GetFileAttributesA"; File: "file") Found reference to API (Indicator: "GetSystemDirectoryA"; File: "file") Found reference to API (Indicator: "LoadLibraryA"; File: "file") Found reference to API (Indicator: "DeleteFileA"; File: "file") Found reference to API (Indicator: "GlobalAlloc"; File: "file") Found reference to API (Indicator: "GlobalFree"; File: "file") Found reference to API (Indicator: "CloseHandle"; File: "file") Found reference to API (Indicator: "WritePrivateProfileStringA"; File: "file") Found reference to API (Indicator: "IsDBCSLeadByte"; File: "file") Found reference to API (Indicator: "GetWindowsDirectoryA"; File: "file") Found reference to API (Indicator: "SetFileAttributesA"; File: "file") Found reference to API (Indicator: "GetProcAddress"; File: "file") Found reference to API (Indicator: "GlobalLock"; File: "file") Found reference to API (Indicator: "LocalFree"; File: "file") Found reference to API (Indicator: "RemoveDirectoryA"; File: "file") Found reference to API (Indicator: "FreeLibrary"; File: "file") Found reference to API (Indicator: "CreateDirectoryA"; File: "file") Found reference to API (Indicator: "GetPrivateProfileIntA"; File: "file") Found reference to API (Indicator: "GetPrivateProfileStringA"; File: "file") Found reference to API (Indicator: "GlobalUnlock"; File: "file") Found reference to API (Indicator: "ReadFile"; File: "file") Found reference to API (Indicator: "SizeofResource"; File: "file") Found reference to API (Indicator: "WriteFile"; File: "file") Found reference to API (Indicator: "GetDriveTypeA"; File: "file") Found reference to API (Indicator: "LoadLibraryExA"; File: "file") Found reference to API (Indicator: "SetFileTime"; File: "file") Found reference to API (Indicator: "SetFilePointer"; File: "file") Found reference to API (Indicator: "FindResourceA"; File: "file") Found reference to API (Indicator: "CreateMutexA"; File: "file") Found reference to API (Indicator: "GetVolumeInformationA"; File: "file") Found reference to API (Indicator: "WaitForSingleObject"; File: "file") Found reference to API (Indicator: "GetCurrentDirectoryA"; File: "file") Found reference to API (Indicator: "FreeResource"; File: "file") Found reference to API (Indicator: "GetVersion"; File: "file") Found reference to API (Indicator: "SetCurrentDirectoryA"; File: "file") Found reference to API (Indicator: "GetTempPathA"; File: "file") Found reference to API (Indicator: "LocalFileTimeToFileTime"; File: "file") Found reference to API (Indicator: "CreateFileA"; File: "file") Found reference to API (Indicator: "SetEvent"; File: "file") Found reference to API (Indicator: "TerminateThread"; File: "file") Found reference to API (Indicator: "GetVersionExA"; File: "file") Found reference to API (Indicator: "LockResource"; File: "file") Found reference to API (Indicator: "GetSystemInfo"; File: "file") Found reference to API (Indicator: "CreateThread"; File: "file") Found reference to API (Indicator: "ResetEvent"; File: "file") Found reference to API (Indicator: "LoadResource"; File: "file") Found reference to API (Indicator: "ExitProcess"; File: "file") Found reference to API (Indicator: "GetModuleHandleW"; File: "file") Found reference to API (Indicator: "CreateProcessA"; File: "file") Found reference to API (Indicator: "FormatMessageA"; File: "file") Found reference to API (Indicator: "GetTempFileNameA"; File: "file") Found reference to API (Indicator: "DosDateTimeToFileTime"; File: "file") Found reference to API (Indicator: "CreateEventA"; File: "file") Found reference to API (Indicator: "GetExitCodeProcess"; File: "file") Found reference to API (Indicator: "GetDeviceCaps"; File: "file") Found reference to API (Indicator: "GetDesktopWindow"; File: "file") Found reference to API (Indicator: "CharUpperA"; File: "file") Found reference to API (Indicator: "ExitWindowsEx"; File: "file") Found reference to API (Indicator: "MessageBeep"; File: "file") Found reference to API (Indicator: "CharPrevA"; File: "file") Found reference to API (Indicator: "LoadStringA"; File: "file") Found reference to API (Indicator: "CharNextA"; File: "file") Found reference to API (Indicator: "EnableWindow"; File: "file") Found reference to API (Indicator: "ReleaseDC"; File: "file") Found reference to API (Indicator: "SetForegroundWindow"; File: "file") Found reference to API (Indicator: "PeekMessageA"; File: "file") Found reference to API (Indicator: "SendMessageA"; File: "file") Found reference to API (Indicator: "MessageBoxA"; File: "file") Found reference to API (Indicator: "SetWindowTextA"; File: "file") Found reference to API (Indicator: "GetWindowLongA"; File: "file") Found reference to API (Indicator: "CallWindowProcA"; File: "file") Found reference to API (Indicator: "SetWindowLongA"; File: "file") Found reference to API (Indicator: "ShowWindow"; File: "file") Found reference to API (Indicator: "MsgWaitForMultipleObjects"; File: "file") Found reference to API (Indicator: "SetWindowPos"; File: "file") Found reference to API (Indicator: "GetDC"; File: "file") Found reference to API (Indicator: "GetWindowRect"; File: "file") Found reference to API (Indicator: "DispatchMessageA"; File: "file") Found reference to API (Indicator: "GetFileVersionInfoSizeA"; File: "file") Found reference to API (Indicator: "VerQueryValueA"; File: "file") Found reference to API (Indicator: "GetFileVersionInfoA"; File: "file") Found reference to API (Indicator: "Sleep"; File: "file") Found reference to API (Indicator: "GetStartupInfoW"; File: "file") Found reference to API (Indicator: "UnhandledExceptionFilter"; File: "file") Found reference to API (Indicator: "SetUnhandledExceptionFilter"; File: "file") Found reference to API (Indicator: "TerminateProcess"; File: "file") Found reference to API (Indicator: "QueryPerformanceCounter"; File: "file") Found reference to API (Indicator: "GetCurrentProcessId"; File: "file") Found reference to API (Indicator: "GetCurrentThreadId"; File: "file") Found reference to API (Indicator: "GetSystemTimeAsFileTime"; File: "file") Found reference to API (Indicator: "GetTickCount"; File: "file") Found reference to API (Indicator: "EnumResourceLanguagesA"; File: "file") Found reference to API (Indicator: "GetDiskFreeSpaceA"; File: "file") Found reference to API (Indicator: "MulDiv"; File: "file") Found reference to API (Indicator: "GetSystemMetrics"; File: "file") Found reference to API (Indicator: "FlsSetValue"; File: "00000000-00000876.00000000.67434.00CC1000.00000020.mdmp") Found reference to API (Indicator: "FlsGetValue"; File: "00000000-00000876.00000000.67434.00CC1000.00000020.mdmp") Found reference to API (Indicator: "VirtualFree"; File: "2St5480.exe.1666954272") Found reference to API (Indicator: "VirtualAlloc"; File: "2St5480.exe.1666954272") Found reference to API (Indicator: "IsDebuggerPresent"; File: "2St5480.exe.1666954272") Found reference to API (Indicator: "IsProcessorFeaturePresent"; File: "2St5480.exe.1666954272") Found reference to API (Indicator: "RtlUnwind"; File: "2St5480.exe.1666954272") Found reference to API (Indicator: "SetLastError"; File: "2St5480.exe.1666954272") Found reference to API (Indicator: "EnterCriticalSection"; File: "2St5480.exe.1666954272") Found reference to API (Indicator: "LeaveCriticalSection"; File: "2St5480.exe.1666954272") Found reference to API (Indicator: "DeleteCriticalSection"; File: "2St5480.exe.1666954272") Found reference to API (Indicator: "TlsAlloc"; File: "2St5480.exe.1666954272") Found reference to API (Indicator: "TlsGetValue"; File: "2St5480.exe.1666954272") Found reference to API (Indicator: "TlsSetValue"; File: "2St5480.exe.1666954272") Found reference to API (Indicator: "TlsFree"; File: "2St5480.exe.1666954272") Found reference to API (Indicator: "GetStdHandle"; File: "2St5480.exe.1666954272") Found reference to API (Indicator: "GetModuleFileNameW"; File: "2St5480.exe.1666954272") Found reference to API (Indicator: "GetModuleHandleExW"; File: "2St5480.exe.1666954272") Found reference to API (Indicator: "HeapFree"; File: "2St5480.exe.1666954272") Found reference to API (Indicator: "HeapAlloc"; File: "2St5480.exe.1666954272") Found reference to API (Indicator: "HeapReAlloc"; File: "2St5480.exe.1666954272") Found reference to API (Indicator: "LCMapStringW"; File: "2St5480.exe.1666954272") Found reference to API (Indicator: "FindFirstFileExW"; File: "2St5480.exe.1666954272") Found reference to API (Indicator: "FindNextFileW"; File: "2St5480.exe.1666954272") Found reference to API (Indicator: "IsValidCodePage"; File: "2St5480.exe.1666954272") Found reference to API (Indicator: "GetACP"; File: "2St5480.exe.1666954272") Found reference to API (Indicator: "GetOEMCP"; File: "2St5480.exe.1666954272") Found reference to API (Indicator: "GetCPInfo"; File: "2St5480.exe.1666954272") Found reference to API (Indicator: "GetCommandLineA"; File: "2St5480.exe.1666954272") Found reference to API (Indicator: "GetCommandLineW"; File: "2St5480.exe.1666954272") Found reference to API (Indicator: "MultiByteToWideChar"; File: "2St5480.exe.1666954272") Found reference to API (Indicator: "GetEnvironmentStringsW"; File: "2St5480.exe.1666954272") Found reference to API (Indicator: "FreeEnvironmentStringsW"; File: "2St5480.exe.1666954272") Found reference to API (Indicator: "SetStdHandle"; File: "2St5480.exe.1666954272") Found reference to API (Indicator: "GetStringTypeW"; File: "2St5480.exe.1666954272") Found reference to API (Indicator: "GetProcessHeap"; File: "2St5480.exe.1666954272") Found reference to API (Indicator: "HeapSize"; File: "2St5480.exe.1666954272") Found reference to API (Indicator: "FlushFileBuffers"; File: "2St5480.exe.1666954272") Found reference to API (Indicator: "GetConsoleOutputCP"; File: "2St5480.exe.1666954272") Found reference to API (Indicator: "GetConsoleMode"; File: "2St5480.exe.1666954272") Found reference to API (Indicator: "SetFilePointerEx"; File: "2St5480.exe.1666954272") Found reference to API (Indicator: "WriteConsoleW"; File: "2St5480.exe.1666954272") Found reference to API (Indicator: "NtUnmapViewOfSection"; File: "explothe.exe.322908262") Found reference to API (Indicator: "WriteProcessMemory"; File: "explothe.exe.322908262") Found reference to API (Indicator: "GetVersionExW"; File: "explothe.exe.322908262") Found reference to API (Indicator: "GetComputerNameExW"; File: "explothe.exe.322908262") Found reference to API (Indicator: "ResumeThread"; File: "explothe.exe.322908262") Found reference to API (Indicator: "GetModuleHandleA"; File: "explothe.exe.322908262") Found reference to API (Indicator: "CopyFileA"; File: "explothe.exe.322908262") Found reference to API (Indicator: "GetThreadContext"; File: "explothe.exe.322908262") Found reference to API (Indicator: "VirtualAllocEx"; File: "explothe.exe.322908262") Found reference to API (Indicator: "ReadProcessMemory"; File: "explothe.exe.322908262") Found reference to API (Indicator: "SetThreadContext"; File: "explothe.exe.322908262") Found reference to API (Indicator: "GetSidIdentifierAuthority"; File: "explothe.exe.322908262") Found reference to API (Indicator: "LookupAccountNameA"; File: "explothe.exe.322908262") Found reference to API (Indicator: "GetUserNameA"; File: "explothe.exe.322908262") Found reference to API (Indicator: "ShellExecuteA"; File: "explothe.exe.322908262") Found reference to API (Indicator: "SHGetFolderPathA"; File: "explothe.exe.322908262") Found reference to API (Indicator: "HttpOpenRequestA"; File: "explothe.exe.322908262") Found reference to API (Indicator: "InternetOpenUrlA"; File: "explothe.exe.322908262") Found reference to API (Indicator: "InternetOpenW"; File: "explothe.exe.322908262") Found reference to API (Indicator: "InternetOpenA"; File: "explothe.exe.322908262") Found reference to API (Indicator: "InternetCloseHandle"; File: "explothe.exe.322908262") Found reference to API (Indicator: "HttpSendRequestA"; File: "explothe.exe.322908262") Found reference to API (Indicator: "InternetConnectA"; File: "explothe.exe.322908262") Found reference to API (Indicator: "InternetReadFile"; File: "explothe.exe.322908262") Found reference to API (Indicator: "WaitForSingleObjectEx"; File: "explothe.exe.322908262") Found reference to API (Indicator: "CreateEventW"; File: "explothe.exe.322908262") Found reference to API (Indicator: "GetDriveTypeW"; File: "explothe.exe.322908262") Found reference to API (Indicator: "GetFileInformationByHandle"; File: "explothe.exe.322908262") Found reference to API (Indicator: "PeekNamedPipe"; File: "explothe.exe.322908262") Found reference to API (Indicator: "SystemTimeToTzSpecificLocalTime"; File: "explothe.exe.322908262") Found reference to API (Indicator: "FileTimeToSystemTime"; File: "explothe.exe.322908262") Found reference to API (Indicator: "CompareStringW"; File: "explothe.exe.322908262") Found reference to API (Indicator: "DeleteFileW"; File: "explothe.exe.322908262") Found reference to API (Indicator: "GetCurrentDirectoryW"; File: "explothe.exe.322908262") Found reference to API (Indicator: "SetEnvironmentVariableW"; File: "explothe.exe.322908262") Found reference to API (Indicator: "GetConsoleCP"; File: "explothe.exe.322908262") Found reference to API (Indicator: "GetTimeZoneInformation"; File: "explothe.exe.322908262") Found reference to API (Indicator: "SetEndOfFile"; File: "explothe.exe.322908262") Found reference to API (Indicator: "ReadConsoleW"; File: "explothe.exe.322908262") Found reference to API (Indicator: "GetSystemTimePreciseAsFileTime"; Source: "00000000-00000876.00000000.67426.00D7A000.00000002.mdmp") Found reference to API (Indicator: "FlsAlloc"; Source: "00000000-00000876.00000000.67426.00D7A000.00000002.mdmp, 00000000-00000876.00000000.67434.00D99000.00000002.mdmp") Found reference to API (Indicator: "FlsFree"; Source: "00000000-00000876.00000000.67426.00D7A000.00000002.mdmp, 00000000-00000876.00000000.67434.00D99000.00000002.mdmp") Found reference to API (Indicator: "FlsGetValue"; Source: "00000000-00000876.00000000.67426.00D7A000.00000002.mdmp, 00000000-00000876.00000000.67434.00D99000.00000002.mdmp") Found reference to API (Indicator: "FlsSetValue"; Source: "00000000-00000876.00000000.67426.00D7A000.00000002.mdmp, 00000000-00000876.00000000.67434.00D99000.00000002.mdmp") Found reference to API (Indicator: "InitializeCriticalSectionEx"; Source: "00000000-00000876.00000000.67426.00D7A000.00000002.mdmp, 00000000-00000876.00000000.67434.00D99000.00000002.mdmp") Found reference to API (Indicator: "AreFileApisANSI"; Source: "00000000-00000876.00000000.67426.00D7A000.00000002.mdmp") Found reference to API (Indicator: "CompareStringEx"; Source: "00000000-00000876.00000000.67426.00D7A000.00000002.mdmp, 00000000-00000876.00000000.67434.00D99000.00000002.mdmp") Found reference to API (Indicator: "EnumSystemLocalesEx"; Source: "00000000-00000876.00000000.67426.00D7A000.00000002.mdmp") Found reference to API (Indicator: "GetActiveWindow"; Source: "00000000-00000876.00000000.67426.00D7A000.00000002.mdmp") Found reference to API (Indicator: "GetDateFormatEx"; Source: "00000000-00000876.00000000.67426.00D7A000.00000002.mdmp") Found reference to API (Indicator: "GetEnabledXStateFeatures"; Source: "00000000-00000876.00000000.67426.00D7A000.00000002.mdmp") Found reference to API (Indicator: "GetLastActivePopup"; Source: "00000000-00000876.00000000.67426.00D7A000.00000002.mdmp") Found reference to API (Indicator: "GetLocaleInfoEx"; Source: "00000000-00000876.00000000.67426.00D7A000.00000002.mdmp, 00000000-00000876.00000000.67434.00D99000.00000002.mdmp") Found reference to API (Indicator: "GetProcessWindowStation"; Source: "00000000-00000876.00000000.67426.00D7A000.00000002.mdmp") Found reference to API (Indicator: "GetTimeFormatEx"; Source: "00000000-00000876.00000000.67426.00D7A000.00000002.mdmp") Found reference to API (Indicator: "GetUserDefaultLocaleName"; Source: "00000000-00000876.00000000.67426.00D7A000.00000002.mdmp") Found reference to API (Indicator: "GetUserObjectInformationW"; Source: "00000000-00000876.00000000.67426.00D7A000.00000002.mdmp") Found reference to API (Indicator: "GetXStateFeaturesMask"; Source: "00000000-00000876.00000000.67426.00D7A000.00000002.mdmp") Found reference to API (Indicator: "IsValidLocaleName"; Source: "00000000-00000876.00000000.67426.00D7A000.00000002.mdmp") Found reference to API (Indicator: "LCMapStringEx"; Source: "00000000-00000876.00000000.67426.00D7A000.00000002.mdmp, 00000000-00000876.00000000.67434.00D99000.00000002.mdmp") Found reference to API (Indicator: "LCIDToLocaleName"; Source: "00000000-00000876.00000000.67426.00D7A000.00000002.mdmp") Found reference to API (Indicator: "LocaleNameToLCID"; Source: "00000000-00000876.00000000.67426.00D7A000.00000002.mdmp") Found reference to API (Indicator: "LocateXStateFeature"; Source: "00000000-00000876.00000000.67426.00D7A000.00000002.mdmp") Found reference to API (Indicator: "MessageBoxA"; Source: "00000000-00000876.00000000.67426.00D7A000.00000002.mdmp") Found reference to API (Indicator: "MessageBoxW"; Source: "00000000-00000876.00000000.67426.00D7A000.00000002.mdmp") Found reference to API (Indicator: "SetThreadStackGuarantee"; Source: "00000000-00000876.00000000.67426.00D7A000.00000002.mdmp") Found reference to API (Indicator: "CloseEventLog"; Source: "00000000-00000876.00000000.67434.00D99000.00000002.mdmp") Found reference to API (Indicator: "CloseHandle"; Source: "00000000-00000876.00000000.67434.00D99000.00000002.mdmp") Found reference to API (Indicator: "WaitForSingleObjectEx"; Source: "00000000-00000876.00000000.67434.00D99000.00000002.mdmp") Found reference to API (Indicator: "Sleep"; Source: "00000000-00000876.00000000.67434.00D99000.00000002.mdmp") Found reference to API (Indicator: "SwitchToThread"; Source: "00000000-00000876.00000000.67434.00D99000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentThreadId"; Source: "00000000-00000876.00000000.67434.00D99000.00000002.mdmp") Found reference to API (Indicator: "GetExitCodeThread"; Source: "00000000-00000876.00000000.67434.00D99000.00000002.mdmp") Found reference to API (Indicator: "GetNativeSystemInfo"; Source: "00000000-00000876.00000000.67434.00D99000.00000002.mdmp") Found reference to API (Indicator: "FormatMessageA"; Source: "00000000-00000876.00000000.67434.00D99000.00000002.mdmp") Found reference to API (Indicator: "WideCharToMultiByte"; Source: "00000000-00000876.00000000.67434.00D99000.00000002.mdmp") Found reference to API (Indicator: "MultiByteToWideChar"; Source: "00000000-00000876.00000000.67434.00D99000.00000002.mdmp") Found reference to API (Indicator: "GetStringTypeW"; Source: "00000000-00000876.00000000.67434.00D99000.00000002.mdmp") Found reference to API (Indicator: "EnterCriticalSection"; Source: "00000000-00000876.00000000.67434.00D99000.00000002.mdmp") Found reference to API (Indicator: "LeaveCriticalSection"; Source: "00000000-00000876.00000000.67434.00D99000.00000002.mdmp") Found reference to API (Indicator: "DeleteCriticalSection"; Source: "00000000-00000876.00000000.67434.00D99000.00000002.mdmp") Found reference to API (Indicator: "QueryPerformanceCounter"; Source: "00000000-00000876.00000000.67434.00D99000.00000002.mdmp") Found reference to API (Indicator: "QueryPerformanceFrequency"; Source: "00000000-00000876.00000000.67434.00D99000.00000002.mdmp") Found reference to API (Indicator: "InitializeSRWLock"; Source: "00000000-00000876.00000000.67434.00D99000.00000002.mdmp") Found reference to API (Indicator: "ReleaseSRWLockExclusive"; Source: "00000000-00000876.00000000.67434.00D99000.00000002.mdmp") Found reference to API (Indicator: "AcquireSRWLockExclusive"; Source: "00000000-00000876.00000000.67434.00D99000.00000002.mdmp") Found reference to API (Indicator: "TryAcquireSRWLockExclusive"; Source: "00000000-00000876.00000000.67434.00D99000.00000002.mdmp") Found reference to API (Indicator: "InitializeConditionVariable"; Source: "00000000-00000876.00000000.67434.00D99000.00000002.mdmp") Found reference to API (Indicator: "WakeConditionVariable"; Source: "00000000-00000876.00000000.67434.00D99000.00000002.mdmp") Found reference to API (Indicator: "WakeAllConditionVariable"; Source: "00000000-00000876.00000000.67434.00D99000.00000002.mdmp") Found reference to API (Indicator: "SleepConditionVariableSRW"; Source: "00000000-00000876.00000000.67434.00D99000.00000002.mdmp") Found reference to API (Indicator: "LocalFree"; Source: "00000000-00000876.00000000.67434.00D99000.00000002.mdmp") Found reference to API (Indicator: "EncodePointer"; Source: "00000000-00000876.00000000.67434.00D99000.00000002.mdmp") Found reference to API (Indicator: "DecodePointer"; Source: "00000000-00000876.00000000.67434.00D99000.00000002.mdmp") Found reference to API (Indicator: "SetFileInformationByHandle"; Source: "00000000-00000876.00000000.67434.00D99000.00000002.mdmp") Found reference to API (Indicator: "GetTempPathW"; Source: "00000000-00000876.00000000.67434.00D99000.00000002.mdmp") Found reference to API (Indicator: "InitOnceExecuteOnce"; Source: "00000000-00000876.00000000.67434.00D99000.00000002.mdmp") Found reference to API (Indicator: "SleepConditionVariableCS"; Source: "00000000-00000876.00000000.67434.00D99000.00000002.mdmp") Found reference to API (Indicator: "CreateEventExW"; Source: "00000000-00000876.00000000.67434.00D99000.00000002.mdmp") Found reference to API (Indicator: "CreateSemaphoreExW"; Source: "00000000-00000876.00000000.67434.00D99000.00000002.mdmp") Found reference to API (Indicator: "FlushProcessWriteBuffers"; Source: "00000000-00000876.00000000.67434.00D99000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcessorNumber"; Source: "00000000-00000876.00000000.67434.00D99000.00000002.mdmp") Found reference to API (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00000876.00000000.67434.00D99000.00000002.mdmp") Found reference to API (Indicator: "GetTickCount64"; Source: "00000000-00000876.00000000.67434.00D99000.00000002.mdmp") Found reference to API (Indicator: "FreeLibraryWhenCallbackReturns"; Source: "00000000-00000876.00000000.67434.00D99000.00000002.mdmp") Found reference to API (Indicator: "CreateThreadpoolWork"; Source: "00000000-00000876.00000000.67434.00D99000.00000002.mdmp") Found reference to API (Indicator: "SubmitThreadpoolWork"; Source: "00000000-00000876.00000000.67434.00D99000.00000002.mdmp") Found reference to API (Indicator: "CloseThreadpoolWork"; Source: "00000000-00000876.00000000.67434.00D99000.00000002.mdmp") Found reference to API (Indicator: "CreateThreadpoolTimer"; Source: "00000000-00000876.00000000.67434.00D99000.00000002.mdmp") Found reference to API (Indicator: "SetThreadpoolTimer"; Source: "00000000-00000876.00000000.67434.00D99000.00000002.mdmp") Found reference to API (Indicator: "WaitForThreadpoolTimerCallbacks"; Source: "00000000-00000876.00000000.67434.00D99000.00000002.mdmp") Found reference to API (Indicator: "CloseThreadpoolTimer"; Source: "00000000-00000876.00000000.67434.00D99000.00000002.mdmp") Found reference to API (Indicator: "CreateThreadpoolWait"; Source: "00000000-00000876.00000000.67434.00D99000.00000002.mdmp") Found reference to API (Indicator: "SetThreadpoolWait"; Source: "00000000-00000876.00000000.67434.00D99000.00000002.mdmp") Found reference to API (Indicator: "CloseThreadpoolWait"; Source: "00000000-00000876.00000000.67434.00D99000.00000002.mdmp") Found reference to API (Indicator: "GetModuleHandleW"; Source: "00000000-00000876.00000000.67434.00D99000.00000002.mdmp") Found reference to API (Indicator: "GetProcAddress"; Source: "00000000-00000876.00000000.67434.00D99000.00000002.mdmp") Found reference to API (Indicator: "GetFileInformationByHandleEx"; Source: "00000000-00000876.00000000.67434.00D99000.00000002.mdmp") Found reference to API (Indicator: "CreateSymbolicLinkW"; Source: "00000000-00000876.00000000.67434.00D99000.00000002.mdmp") Found reference to API (Indicator: "GetCPInfo"; Source: "00000000-00000876.00000000.67434.00D99000.00000002.mdmp") Found reference to API (Indicator: "IsProcessorFeaturePresent"; Source: "00000000-00000876.00000000.67434.00D99000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcessId"; Source: "00000000-00000876.00000000.67434.00D99000.00000002.mdmp") Found reference to API (Indicator: "InitializeSListHead"; Source: "00000000-00000876.00000000.67434.00D99000.00000002.mdmp") Found reference to API (Indicator: "IsDebuggerPresent"; Source: "00000000-00000876.00000000.67434.00D99000.00000002.mdmp") Found reference to API (Indicator: "UnhandledExceptionFilter"; Source: "00000000-00000876.00000000.67434.00D99000.00000002.mdmp") Found reference to API (Indicator: "SetUnhandledExceptionFilter"; Source: "00000000-00000876.00000000.67434.00D99000.00000002.mdmp") Found reference to API (Indicator: "GetStartupInfoW"; Source: "00000000-00000876.00000000.67434.00D99000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcess"; Source: "00000000-00000876.00000000.67434.00D99000.00000002.mdmp") Found reference to API (Indicator: "TerminateProcess"; Source: "00000000-00000876.00000000.67434.00D99000.00000002.mdmp") Found reference to API (Indicator: "RaiseException"; Source: "00000000-00000876.00000000.67434.00D99000.00000002.mdmp") Found reference to API (Indicator: "RtlUnwind"; Source: "00000000-00000876.00000000.67434.00D99000.00000002.mdmp") Found reference to API (Indicator: "InterlockedPushEntrySList"; Source: "00000000-00000876.00000000.67434.00D99000.00000002.mdmp") Found reference to API (Indicator: "InterlockedFlushSList"; Source: "00000000-00000876.00000000.67434.00D99000.00000002.mdmp") Found reference to API (Indicator: "GetLastError"; Source: "00000000-00000876.00000000.67434.00D99000.00000002.mdmp") Found reference to API (Indicator: "SetLastError"; Source: "00000000-00000876.00000000.67434.00D99000.00000002.mdmp") Found reference to API (Indicator: "InitializeCriticalSectionAndSpinCount"; Source: "00000000-00000876.00000000.67434.00D99000.00000002.mdmp") Found reference to API (Indicator: "TlsAlloc"; Source: "00000000-00000876.00000000.67434.00D99000.00000002.mdmp") Found reference to API (Indicator: "TlsGetValue"; Source: "00000000-00000876.00000000.67434.00D99000.00000002.mdmp") Found reference to API (Indicator: "TlsSetValue"; Source: "00000000-00000876.00000000.67434.00D99000.00000002.mdmp") Found reference to API (Indicator: "TlsFree"; Source: "00000000-00000876.00000000.67434.00D99000.00000002.mdmp") Found reference to API (Indicator: "FreeLibrary"; Source: "00000000-00000876.00000000.67434.00D99000.00000002.mdmp") Found reference to API (Indicator: "LoadLibraryExW"; Source: "00000000-00000876.00000000.67434.00D99000.00000002.mdmp") Found reference to API (Indicator: "CreateThread"; Source: "00000000-00000876.00000000.67434.00D99000.00000002.mdmp") Found reference to API (Indicator: "ExitThread"; Source: "00000000-00000876.00000000.67434.00D99000.00000002.mdmp") Found reference to API (Indicator: "ResumeThread"; Source: "00000000-00000876.00000000.67434.00D99000.00000002.mdmp") Found reference to API (Indicator: "FreeLibraryAndExitThread"; Source: "00000000-00000876.00000000.67434.00D99000.00000002.mdmp") Found reference to API (Indicator: "GetModuleHandleExW"; Source: "00000000-00000876.00000000.67434.00D99000.00000002.mdmp") Found reference to API (Indicator: "GetStdHandle"; Source: "00000000-00000876.00000000.67434.00D99000.00000002.mdmp") Found reference to API (Indicator: "WriteFile"; Source: "00000000-00000876.00000000.67434.00D99000.00000002.mdmp") Found reference to API (Indicator: "GetModuleFileNameW"; Source: "00000000-00000876.00000000.67434.00D99000.00000002.mdmp") Found reference to API (Indicator: "ExitProcess"; Source: "00000000-00000876.00000000.67434.00D99000.00000002.mdmp") Found reference to API (Indicator: "GetCommandLineA"; Source: "00000000-00000876.00000000.67434.00D99000.00000002.mdmp") Found reference to API (Indicator: "GetCommandLineW"; Source: "00000000-00000876.00000000.67434.00D99000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentThread"; Source: "00000000-00000876.00000000.67434.00D99000.00000002.mdmp") Found reference to API (Indicator: "HeapAlloc"; Source: "00000000-00000876.00000000.67434.00D99000.00000002.mdmp") Found reference to API (Indicator: "HeapFree"; Source: "00000000-00000876.00000000.67434.00D99000.00000002.mdmp") Found reference to API (Indicator: "GetDateFormatW"; Source: "00000000-00000876.00000000.67434.00D99000.00000002.mdmp") Found reference to API (Indicator: "GetTimeFormatW"; Source: "00000000-00000876.00000000.67434.00D99000.00000002.mdmp") Found reference to API (Indicator: "CompareStringW"; Source: "00000000-00000876.00000000.67434.00D99000.00000002.mdmp") Found reference to API (Indicator: "LCMapStringW"; Source: "00000000-00000876.00000000.67434.00D99000.00000002.mdmp") Found reference to API (Indicator: "GetLocaleInfoW"; Source: "00000000-00000876.00000000.67434.00D99000.00000002.mdmp") Found reference to API (Indicator: "IsValidLocale"; Source: "00000000-00000876.00000000.67434.00D99000.00000002.mdmp") Found reference to API (Indicator: "GetUserDefaultLCID"; Source: "00000000-00000876.00000000.67434.00D99000.00000002.mdmp") Found reference to API (Indicator: "EnumSystemLocalesW"; Source: "00000000-00000876.00000000.67434.00D99000.00000002.mdmp") Found reference to API (Indicator: "GetFileType"; Source: "00000000-00000876.00000000.67434.00D99000.00000002.mdmp") Found reference to API (Indicator: "SetConsoleCtrlHandler"; Source: "00000000-00000876.00000000.67434.00D99000.00000002.mdmp") Found reference to API (Indicator: "FlushFileBuffers"; Source: "00000000-00000876.00000000.67434.00D99000.00000002.mdmp") Found reference to API (Indicator: "GetConsoleOutputCP"; Source: "00000000-00000876.00000000.67434.00D99000.00000002.mdmp") Found reference to API (Indicator: "GetConsoleMode"; Source: "00000000-00000876.00000000.67434.00D99000.00000002.mdmp") Found reference to API (Indicator: "ReadFile"; Source: "00000000-00000876.00000000.67434.00D99000.00000002.mdmp") Found reference to API (Indicator: "GetFileSizeEx"; Source: "00000000-00000876.00000000.67434.00D99000.00000002.mdmp") Found reference to API (Indicator: "SetFilePointerEx"; Source: "00000000-00000876.00000000.67434.00D99000.00000002.mdmp") Found reference to API (Indicator: "ReadConsoleW"; Source: "00000000-00000876.00000000.67434.00D99000.00000002.mdmp") Found reference to API (Indicator: "HeapReAlloc"; Source: "00000000-00000876.00000000.67434.00D99000.00000002.mdmp") Found reference to API (Indicator: "GetTimeZoneInformation"; Source: "00000000-00000876.00000000.67434.00D99000.00000002.mdmp") Found reference to API (Indicator: "OutputDebugStringW"; Source: "00000000-00000876.00000000.67434.00D99000.00000002.mdmp") Found reference to API (Indicator: "FindClose"; Source: "00000000-00000876.00000000.67434.00D99000.00000002.mdmp") Found reference to API (Indicator: "FindFirstFileExW"; Source: "00000000-00000876.00000000.67434.00D99000.00000002.mdmp") Found reference to API (Indicator: "FindNextFileW"; Source: "00000000-00000876.00000000.67434.00D99000.00000002.mdmp") Found reference to API (Indicator: "IsValidCodePage"; Source: "00000000-00000876.00000000.67434.00D99000.00000002.mdmp") Found reference to API (Indicator: "GetACP"; Source: "00000000-00000876.00000000.67434.00D99000.00000002.mdmp") Found reference to API (Indicator: "GetOEMCP"; Source: "00000000-00000876.00000000.67434.00D99000.00000002.mdmp") Found reference to API (Indicator: "GetEnvironmentStringsW"; Source: "00000000-00000876.00000000.67434.00D99000.00000002.mdmp") Found reference to API (Indicator: "FreeEnvironmentStringsW"; Source: "00000000-00000876.00000000.67434.00D99000.00000002.mdmp") Found reference to API (Indicator: "SetEnvironmentVariableW"; Source: "00000000-00000876.00000000.67434.00D99000.00000002.mdmp") Found reference to API (Indicator: "SetStdHandle"; Source: "00000000-00000876.00000000.67434.00D99000.00000002.mdmp") Found reference to API (Indicator: "GetProcessHeap"; Source: "00000000-00000876.00000000.67434.00D99000.00000002.mdmp") Found reference to API (Indicator: "HeapSize"; Source: "00000000-00000876.00000000.67434.00D99000.00000002.mdmp") Found reference to API (Indicator: "CreateFileW"; Source: "00000000-00000876.00000000.67434.00D99000.00000002.mdmp") Found reference to API (Indicator: "WriteConsoleW"; Source: "00000000-00000876.00000000.67434.00D99000.00000002.mdmp") Found reference to API (Indicator: "GetStockObject"; Source: "00000000-00000928.00000000.66890.00070000.00000004.mdmp, 00000000-00000928.00000001.68810.00070000.00000004.mdmp, 00000000-00000928.00000002.70098.00070000.00000004.mdmp") Found reference to API (Indicator: "ExitProcess"; Source: "00000000-00000928.00000000.66890.00070000.00000004.mdmp, 00000000-00000928.00000000.66890.00C9A000.00000002.mdmp, 00000000-00000928.00000001.68810.00070000.00000004.mdmp, 00000000-00000928.00000002.70098.00070000.00000004.mdmp") Found reference to API (Indicator: "GetProcAddress"; Source: "00000000-00000928.00000000.66890.00070000.00000004.mdmp, 00000000-00000928.00000000.66890.00C9A000.00000002.mdmp, 00000000-00000928.00000001.68810.00070000.00000004.mdmp, 00000000-00000928.00000002.70098.00070000.00000004.mdmp") Found reference to API (Indicator: "LoadLibraryA"; Source: "00000000-00000928.00000000.66890.00070000.00000004.mdmp, 00000000-00000928.00000000.66890.00C9A000.00000002.mdmp, 00000000-00000928.00000001.68810.00070000.00000004.mdmp, 00000000-00000928.00000002.70098.00070000.00000004.mdmp") Found reference to API (Indicator: "VirtualProtect"; Source: "00000000-00000928.00000000.66890.00070000.00000004.mdmp, 00000000-00000928.00000001.68810.00070000.00000004.mdmp, 00000000-00000928.00000002.70098.00070000.00000004.mdmp") Found reference to API (Indicator: "CoInitialize"; Source: "00000000-00000928.00000000.66890.00070000.00000004.mdmp, 00000000-00000928.00000001.68810.00070000.00000004.mdmp, 00000000-00000928.00000002.70098.00070000.00000004.mdmp") Found reference to API (Indicator: "ShellExecuteExW"; Source: "00000000-00000928.00000000.66890.00070000.00000004.mdmp, 00000000-00000928.00000001.68810.00070000.00000004.mdmp, 00000000-00000928.00000002.70098.00070000.00000004.mdmp") Found reference to API (Indicator: "SetFocus"; Source: "00000000-00000928.00000000.66890.00070000.00000004.mdmp, 00000000-00000928.00000001.68810.00070000.00000004.mdmp, 00000000-00000928.00000002.70098.00070000.00000004.mdmp") Found reference to API (Indicator: "CheckTokenMembership"; Source: "00000000-00000928.00000000.66890.00C91000.00000020.mdmp") Found reference to API (Indicator: "HeapSetInformation"; Source: "00000000-00000928.00000000.66890.00C91000.00000020.mdmp") Found reference to API (Indicator: "DecryptFileA"; Source: "00000000-00000928.00000000.66890.00C91000.00000020.mdmp") Found reference to API (Indicator: "GetTokenInformation"; Source: "00000000-00000928.00000000.66890.00C9A000.00000002.mdmp") Found reference to API (Indicator: "RegDeleteValueA"; Source: "00000000-00000928.00000000.66890.00C9A000.00000002.mdmp") Found reference to API (Indicator: "RegOpenKeyExA"; Source: "00000000-00000928.00000000.66890.00C9A000.00000002.mdmp") Found reference to API (Indicator: "RegQueryInfoKeyA"; Source: "00000000-00000928.00000000.66890.00C9A000.00000002.mdmp") Found reference to API (Indicator: "FreeSid"; Source: "00000000-00000928.00000000.66890.00C9A000.00000002.mdmp") Found reference to API (Indicator: "OpenProcessToken"; Source: "00000000-00000928.00000000.66890.00C9A000.00000002.mdmp") Found reference to API (Indicator: "RegSetValueExA"; Source: "00000000-00000928.00000000.66890.00C9A000.00000002.mdmp") Found reference to API (Indicator: "RegCreateKeyExA"; Source: "00000000-00000928.00000000.66890.00C9A000.00000002.mdmp") Found reference to API (Indicator: "LookupPrivilegeValueA"; Source: "00000000-00000928.00000000.66890.00C9A000.00000002.mdmp") Found reference to API (Indicator: "AllocateAndInitializeSid"; Source: "00000000-00000928.00000000.66890.00C9A000.00000002.mdmp") Found reference to API (Indicator: "RegQueryValueExA"; Source: "00000000-00000928.00000000.66890.00C9A000.00000002.mdmp") Found reference to API (Indicator: "EqualSid"; Source: "00000000-00000928.00000000.66890.00C9A000.00000002.mdmp") Found reference to API (Indicator: "RegCloseKey"; Source: "00000000-00000928.00000000.66890.00C9A000.00000002.mdmp") Found reference to API (Indicator: "AdjustTokenPrivileges"; Source: "00000000-00000928.00000000.66890.00C9A000.00000002.mdmp") Found reference to API (Indicator: "GetShortPathNameA"; Source: "00000000-00000928.00000000.66890.00C9A000.00000002.mdmp") Found reference to API (Indicator: "GetModuleFileNameA"; Source: "00000000-00000928.00000000.66890.00C9A000.00000002.mdmp") Found reference to API (Indicator: "FindFirstFileA"; Source: "00000000-00000928.00000000.66890.00C9A000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcess"; Source: "00000000-00000928.00000000.66890.00C9A000.00000002.mdmp") Found reference to API (Indicator: "FindNextFileA"; Source: "00000000-00000928.00000000.66890.00C9A000.00000002.mdmp") Found reference to API (Indicator: "ExpandEnvironmentStringsA"; Source: "00000000-00000928.00000000.66890.00C9A000.00000002.mdmp") Found reference to API (Indicator: "FindClose"; Source: "00000000-00000928.00000000.66890.00C9A000.00000002.mdmp") Found reference to API (Indicator: "LocalAlloc"; Source: "00000000-00000928.00000000.66890.00C9A000.00000002.mdmp") Found reference to API (Indicator: "lstrcmpA"; Source: "00000000-00000928.00000000.66890.00C9A000.00000002.mdmp") Found reference to API (Indicator: "CompareStringA"; Source: "00000000-00000928.00000000.66890.00C9A000.00000002.mdmp") Found reference to API (Indicator: "GetLastError"; Source: "00000000-00000928.00000000.66890.00C9A000.00000002.mdmp") Found reference to API (Indicator: "GetFileAttributesA"; Source: "00000000-00000928.00000000.66890.00C9A000.00000002.mdmp") Found reference to API (Indicator: "GetSystemDirectoryA"; Source: "00000000-00000928.00000000.66890.00C9A000.00000002.mdmp") Found reference to API (Indicator: "DeleteFileA"; Source: "00000000-00000928.00000000.66890.00C9A000.00000002.mdmp") Found reference to API (Indicator: "GlobalAlloc"; Source: "00000000-00000928.00000000.66890.00C9A000.00000002.mdmp") Found reference to API (Indicator: "GlobalFree"; Source: "00000000-00000928.00000000.66890.00C9A000.00000002.mdmp") Found reference to API (Indicator: "CloseHandle"; Source: "00000000-00000928.00000000.66890.00C9A000.00000002.mdmp") Found reference to API (Indicator: "WritePrivateProfileStringA"; Source: "00000000-00000928.00000000.66890.00C9A000.00000002.mdmp") Found reference to API (Indicator: "IsDBCSLeadByte"; Source: "00000000-00000928.00000000.66890.00C9A000.00000002.mdmp") Found reference to API (Indicator: "GetWindowsDirectoryA"; Source: "00000000-00000928.00000000.66890.00C9A000.00000002.mdmp") Found reference to API (Indicator: "SetFileAttributesA"; Source: "00000000-00000928.00000000.66890.00C9A000.00000002.mdmp") Found reference to API (Indicator: "GlobalLock"; Source: "00000000-00000928.00000000.66890.00C9A000.00000002.mdmp") Found reference to API (Indicator: "LocalFree"; Source: "00000000-00000928.00000000.66890.00C9A000.00000002.mdmp") Found reference to API (Indicator: "RemoveDirectoryA"; Source: "00000000-00000928.00000000.66890.00C9A000.00000002.mdmp") Found reference to API (Indicator: "FreeLibrary"; Source: "00000000-00000928.00000000.66890.00C9A000.00000002.mdmp") Found reference to API (Indicator: "CreateDirectoryA"; Source: "00000000-00000928.00000000.66890.00C9A000.00000002.mdmp") Found reference to API (Indicator: "GetPrivateProfileIntA"; Source: "00000000-00000928.00000000.66890.00C9A000.00000002.mdmp") Found reference to API (Indicator: "GetPrivateProfileStringA"; Source: "00000000-00000928.00000000.66890.00C9A000.00000002.mdmp") Found reference to API (Indicator: "GlobalUnlock"; Source: "00000000-00000928.00000000.66890.00C9A000.00000002.mdmp") Found reference to API (Indicator: "ReadFile"; Source: "00000000-00000928.00000000.66890.00C9A000.00000002.mdmp") Found reference to API (Indicator: "SizeofResource"; Source: "00000000-00000928.00000000.66890.00C9A000.00000002.mdmp") Found reference to API (Indicator: "WriteFile"; Source: "00000000-00000928.00000000.66890.00C9A000.00000002.mdmp") Found reference to API (Indicator: "GetDriveTypeA"; Source: "00000000-00000928.00000000.66890.00C9A000.00000002.mdmp") Found reference to API (Indicator: "LoadLibraryExA"; Source: "00000000-00000928.00000000.66890.00C9A000.00000002.mdmp") Found reference to API (Indicator: "SetFileTime"; Source: "00000000-00000928.00000000.66890.00C9A000.00000002.mdmp") Found reference to API (Indicator: "SetFilePointer"; Source: "00000000-00000928.00000000.66890.00C9A000.00000002.mdmp") Found reference to API (Indicator: "FindResourceA"; Source: "00000000-00000928.00000000.66890.00C9A000.00000002.mdmp") Found reference to API (Indicator: "CreateMutexA"; Source: "00000000-00000928.00000000.66890.00C9A000.00000002.mdmp") Found reference to API (Indicator: "GetVolumeInformationA"; Source: "00000000-00000928.00000000.66890.00C9A000.00000002.mdmp") Found reference to API (Indicator: "WaitForSingleObject"; Source: "00000000-00000928.00000000.66890.00C9A000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentDirectoryA"; Source: "00000000-00000928.00000000.66890.00C9A000.00000002.mdmp") Found reference to API (Indicator: "FreeResource"; Source: "00000000-00000928.00000000.66890.00C9A000.00000002.mdmp") Found reference to API (Indicator: "GetVersion"; Source: "00000000-00000928.00000000.66890.00C9A000.00000002.mdmp") Found reference to API (Indicator: "SetCurrentDirectoryA"; Source: "00000000-00000928.00000000.66890.00C9A000.00000002.mdmp") Found reference to API (Indicator: "GetTempPathA"; Source: "00000000-00000928.00000000.66890.00C9A000.00000002.mdmp") Found reference to API (Indicator: "LocalFileTimeToFileTime"; Source: "00000000-00000928.00000000.66890.00C9A000.00000002.mdmp") Found reference to API (Indicator: "CreateFileA"; Source: "00000000-00000928.00000000.66890.00C9A000.00000002.mdmp") Found reference to API (Indicator: "SetEvent"; Source: "00000000-00000928.00000000.66890.00C9A000.00000002.mdmp") Found reference to API (Indicator: "TerminateThread"; Source: "00000000-00000928.00000000.66890.00C9A000.00000002.mdmp") Found reference to API (Indicator: "GetVersionExA"; Source: "00000000-00000928.00000000.66890.00C9A000.00000002.mdmp") Found reference to API (Indicator: "LockResource"; Source: "00000000-00000928.00000000.66890.00C9A000.00000002.mdmp") Found reference to API (Indicator: "GetSystemInfo"; Source: "00000000-00000928.00000000.66890.00C9A000.00000002.mdmp") Found reference to API (Indicator: "CreateThread"; Source: "00000000-00000928.00000000.66890.00C9A000.00000002.mdmp") Found reference to API (Indicator: "ResetEvent"; Source: "00000000-00000928.00000000.66890.00C9A000.00000002.mdmp") Found reference to API (Indicator: "LoadResource"; Source: "00000000-00000928.00000000.66890.00C9A000.00000002.mdmp") Found reference to API (Indicator: "GetModuleHandleW"; Source: "00000000-00000928.00000000.66890.00C9A000.00000002.mdmp") Found reference to API (Indicator: "CreateProcessA"; Source: "00000000-00000928.00000000.66890.00C9A000.00000002.mdmp") Found reference to API (Indicator: "FormatMessageA"; Source: "00000000-00000928.00000000.66890.00C9A000.00000002.mdmp") Found reference to API (Indicator: "GetTempFileNameA"; Source: "00000000-00000928.00000000.66890.00C9A000.00000002.mdmp") Found reference to API (Indicator: "DosDateTimeToFileTime"; Source: "00000000-00000928.00000000.66890.00C9A000.00000002.mdmp") Found reference to API (Indicator: "CreateEventA"; Source: "00000000-00000928.00000000.66890.00C9A000.00000002.mdmp") Found reference to API (Indicator: "GetExitCodeProcess"; Source: "00000000-00000928.00000000.66890.00C9A000.00000002.mdmp") Found reference to API (Indicator: "GetDeviceCaps"; Source: "00000000-00000928.00000000.66890.00C9A000.00000002.mdmp") Found reference to API (Indicator: "GetDesktopWindow"; Source: "00000000-00000928.00000000.66890.00C9A000.00000002.mdmp") Found reference to API (Indicator: "CharUpperA"; Source: "00000000-00000928.00000000.66890.00C9A000.00000002.mdmp") Found reference to API (Indicator: "ExitWindowsEx"; Source: "00000000-00000928.00000000.66890.00C9A000.00000002.mdmp") Found reference to API (Indicator: "MessageBeep"; Source: "00000000-00000928.00000000.66890.00C9A000.00000002.mdmp") Found reference to API (Indicator: "CharPrevA"; Source: "00000000-00000928.00000000.66890.00C9A000.00000002.mdmp") Found reference to API (Indicator: "LoadStringA"; Source: "00000000-00000928.00000000.66890.00C9A000.00000002.mdmp") Found reference to API (Indicator: "CharNextA"; Source: "00000000-00000928.00000000.66890.00C9A000.00000002.mdmp") Found reference to API (Indicator: "EnableWindow"; Source: "00000000-00000928.00000000.66890.00C9A000.00000002.mdmp") Found reference to API (Indicator: "ReleaseDC"; Source: "00000000-00000928.00000000.66890.00C9A000.00000002.mdmp") Found reference to API (Indicator: "SetForegroundWindow"; Source: "00000000-00000928.00000000.66890.00C9A000.00000002.mdmp") Found reference to API (Indicator: "PeekMessageA"; Source: "00000000-00000928.00000000.66890.00C9A000.00000002.mdmp") Found reference to API (Indicator: "SendMessageA"; Source: "00000000-00000928.00000000.66890.00C9A000.00000002.mdmp") Found reference to API (Indicator: "MessageBoxA"; Source: "00000000-00000928.00000000.66890.00C9A000.00000002.mdmp") Found reference to API (Indicator: "SetWindowTextA"; Source: "00000000-00000928.00000000.66890.00C9A000.00000002.mdmp") Found reference to API (Indicator: "GetWindowLongA"; Source: "00000000-00000928.00000000.66890.00C9A000.00000002.mdmp") Found reference to API (Indicator: "CallWindowProcA"; Source: "00000000-00000928.00000000.66890.00C9A000.00000002.mdmp") Found reference to API (Indicator: "SetWindowLongA"; Source: "00000000-00000928.00000000.66890.00C9A000.00000002.mdmp") Found reference to API (Indicator: "ShowWindow"; Source: "00000000-00000928.00000000.66890.00C9A000.00000002.mdmp") Found reference to API (Indicator: "MsgWaitForMultipleObjects"; Source: "00000000-00000928.00000000.66890.00C9A000.00000002.mdmp") Found reference to API (Indicator: "SetWindowPos"; Source: "00000000-00000928.00000000.66890.00C9A000.00000002.mdmp") Found reference to API (Indicator: "GetDC"; Source: "00000000-00000928.00000000.66890.00C9A000.00000002.mdmp") Found reference to API (Indicator: "GetWindowRect"; Source: "00000000-00000928.00000000.66890.00C9A000.00000002.mdmp") Found reference to API (Indicator: "DispatchMessageA"; Source: "00000000-00000928.00000000.66890.00C9A000.00000002.mdmp") Found reference to API (Indicator: "GetFileVersionInfoSizeA"; Source: "00000000-00000928.00000000.66890.00C9A000.00000002.mdmp") Found reference to API (Indicator: "VerQueryValueA"; Source: "00000000-00000928.00000000.66890.00C9A000.00000002.mdmp") Found reference to API (Indicator: "GetFileVersionInfoA"; Source: "00000000-00000928.00000000.66890.00C9A000.00000002.mdmp") Found reference to API (Indicator: "Sleep"; Source: "00000000-00000928.00000000.66890.00C9A000.00000002.mdmp") Found reference to API (Indicator: "GetStartupInfoW"; Source: "00000000-00000928.00000000.66890.00C9A000.00000002.mdmp") Found reference to API (Indicator: "UnhandledExceptionFilter"; Source: "00000000-00000928.00000000.66890.00C9A000.00000002.mdmp") Found reference to API (Indicator: "SetUnhandledExceptionFilter"; Source: "00000000-00000928.00000000.66890.00C9A000.00000002.mdmp") Found reference to API (Indicator: "TerminateProcess"; Source: "00000000-00000928.00000000.66890.00C9A000.00000002.mdmp") Found reference to API (Indicator: "QueryPerformanceCounter"; Source: "00000000-00000928.00000000.66890.00C9A000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcessId"; Source: "00000000-00000928.00000000.66890.00C9A000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentThreadId"; Source: "00000000-00000928.00000000.66890.00C9A000.00000002.mdmp") Found reference to API (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00000928.00000000.66890.00C9A000.00000002.mdmp") Found reference to API (Indicator: "GetTickCount"; Source: "00000000-00000928.00000000.66890.00C9A000.00000002.mdmp") Found reference to API (Indicator: "EnumResourceLanguagesA"; Source: "00000000-00000928.00000000.66890.00C9A000.00000002.mdmp") Found reference to API (Indicator: "GetDiskFreeSpaceA"; Source: "00000000-00000928.00000000.66890.00C9A000.00000002.mdmp") Found reference to API (Indicator: "MulDiv"; Source: "00000000-00000928.00000000.66890.00C9A000.00000002.mdmp") Found reference to API (Indicator: "GetSystemMetrics"; Source: "00000000-00000928.00000000.66890.00C9A000.00000002.mdmp")38:T43b,Found reference to API "SizeofResource" (Indicator: "SizeofResource"; File: "file") Found reference to API "FindResourceA" (Indicator: "FindResource"; File: "file") Found reference to API "FreeResource" (Indicator: "FreeResource"; File: "file") Found reference to API "LockResource" (Indicator: "LockResource"; File: "file") Found reference to API "LoadResource" (Indicator: "LoadResource"; File: "file") Found reference to API "SizeofResource" (Indicator: "SizeofResource"; Source: "00000000-00000928.00000000.66890.00C9A000.00000002.mdmp") Found reference to API "FindResourceA" (Indicator: "FindResource"; Source: "00000000-00000928.00000000.66890.00C9A000.00000002.mdmp") Found reference to API "FreeResource" (Indicator: "FreeResource"; Source: "00000000-00000928.00000000.66890.00C9A000.00000002.mdmp") Found reference to API "LockResource" (Indicator: "LockResource"; Source: "00000000-00000928.00000000.66890.00C9A000.00000002.mdmp") Found reference to API "LoadResource" (Indicator: "LoadResource"; Source: "00000000-00000928.00000000.66890.00C9A000.00000002.mdmp")39:T4c5,Found reference to API "CreateThread" (Indicator: "CreateThread"; File: "file") Found reference to API "ResumeThread" (Indicator: "ResumeThread"; File: "explothe.exe.322908262") Found reference to API "GetThreadContext" (Indicator: "GetThreadContext"; File: "explothe.exe.322908262") Found reference to API "SetThreadContext" (Indicator: "SetThreadContext"; File: "explothe.exe.322908262") Found reference to API "CreateThreadpoolWork" (Indicator: "CreateThread"; Source: "00000000-00000876.00000000.67434.00D99000.00000002.mdmp") Found reference to API "CreateThreadpoolTimer" (Indicator: "CreateThread"; Source: "00000000-00000876.00000000.67434.00D99000.00000002.mdmp") Found reference to API "CreateThreadpoolWait" (Indicator: "CreateThread"; Source: "00000000-00000876.00000000.67434.00D99000.00000002.mdmp") Found reference to API "CreateThread" (Indicator: "CreateThread"; Source: "00000000-00000876.00000000.67434.00D99000.00000002.mdmp") Found reference to API "ResumeThread" (Indicator: "ResumeThread"; Source: "00000000-00000876.00000000.67434.00D99000.00000002.mdmp") Found reference to API "CreateThread" (Indicator: "CreateThread"; Source: "00000000-00000928.00000000.66890.00C9A000.00000002.mdmp")3a:T49c,"Software\Microsoft\Windows\CurrentVersion\App Paths" in Source: file "DSystem\CurrentControlSet\Control\Session Manager" in Source: file "Software\Microsoft\Windows\CurrentVersion\RunOnce" in Source: file "System\CurrentControlSet\Control\Session Manager\FileRenameOperations" in Source: file "System\CurrentControlSet\Control\Session Manager" in Source: 46954-17-0040256D "%LOCALAPPDATA%\BraveSoftware\Brave-Browser\User Data\*" in Source: 00000000-00003268-00000C28-159359817333 "%APPDATA%\Opera Software\*" in Source: 00000000-00003268-00000C28-181098370315 "REGISTRY\USER\S-1-5-21-2092356043-4041700817-663127204-1001\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags" in Source: 00000000-00000876.00000000.67434.003C0000.00000004.mdmp "ISTRY\USER\S-1-5-21-2092356043-4041700817-663127204-1001\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags" in Source: 00000000-00000928.00000000.66890.00070000.00000004.mdmp 00000000-00000928.00000001.68810.00070000.00000004.mdmp 00000000-00000928.00000002.70098.00070000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\App Paths" in Source: 00000000-00000928.00000000.66890.00C91000.00000020.mdmp3b:T1042,"file.exe" failed to load missing module "api-ms-win-core-fibers-l1-1-1" - [base:0; Status:c0000135] "Dk2ox03.exe" failed to load missing module "api-ms-win-core-fibers-l1-1-1" - [base:0; Status:c0000135] "Dk2ox03.exe" failed to load missing module "api-ms-win-core-localization-l1-2-1" - [base:0; Status:c0000135] "3Fs87VT.exe" failed to load missing module "api-ms-win-appmodel-runtime-l1-1-2" - [base:0; Status:c0000135] "AppLaunch.exe" failed to load missing module "api-ms-win-core-fibers-l1-1-1" - [base:0; Status:c0000135] "AppLaunch.exe" failed to load missing module "api-ms-win-core-localization-l1-2-1" - [base:0; Status:c0000135] "4AR077QH.exe" failed to load missing module "api-ms-win-appmodel-runtime-l1-1-2" - [base:0; Status:c0000135] "AppLaunch.exe" failed to load missing module "api-ms-win-core-quirks-l1-1-0.dll" - [base:0; Status:c0000135] "AppLaunch.exe" failed to load missing module "api-ms-win-appmodel-runtime-l1-1-2.dll" - [base:0; Status:c0000135] "AppLaunch.exe" failed to load missing module "api-ms-win-appmodel-runtime-l1-1-0.dll" - [base:0; Status:c0000135] "AppLaunch.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoree.dll" - [base:0; Status:c0000135] "AppLaunch.exe" failed to load missing module "%WINDIR%\system32\combase.dll" - [base:0; Status:c0000135] "AppLaunch.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\ole32.dll" - [base:0; Status:c0000135] "AppLaunch.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\uxtheme.dll" - [base:0; Status:c0000135] "AppLaunch.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll" - [base:0; Status:c0000135] "AppLaunch.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\PresentationCore\v4.0_4.0.0.0__31bf3856ad364e35\ucrtbase_clr0400.dll" - [base:0; Status:c0000135] "AppLaunch.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\PresentationCore\v4.0_4.0.0.0__31bf3856ad364e35\SHLWAPI.dll" - [base:0; Status:c0000135] "AppLaunch.exe" failed to load missing module "api-ms-win-core-datetime-l1-1-1" - [base:0; Status:c0000135] "AppLaunch.exe" failed to load missing module "api-ms-win-core-localization-obsolete-l1-2-0" - [base:0; Status:c0000135] "AppLaunch.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll" - [base:0; Status:c0000135] "AppLaunch.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\VERSION.dll" - [base:0; Status:c0000135] "AppLaunch.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\secur32.dll" - [base:0; Status:c0000135] "AppLaunch.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll" - [base:0; Status:c0000135] "AppLaunch.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll" - [base:0; Status:c0000135] "AppLaunch.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\PresentationCore\v4.0_4.0.0.0__31bf3856ad364e35\VCRUNTIME140_CLR0400.dll" - [base:0; Status:c0000135] "5ol2yF2.exe" failed to load missing module "api-ms-win-appmodel-runtime-l1-1-2" - [base:0; Status:c0000135] "schtasks.exe" failed to load missing module "api-ms-win-core-fibers-l1-1-1" - [base:0; Status:c0000135] "cacls.exe" failed to load missing module "api-ms-win-core-fibers-l1-1-1" - [base:0; Status:c0000135] "rundll32.exe" failed to load missing module "api-ms-win-core-localization-l1-2-1" - [base:0; Status:c0000135] "explothe.exe" failed to load missing module "api-ms-win-core-fibers-l1-1-1" - [base:0; Status:c0000135] "explothe.exe" failed to load missing module "api-ms-win-core-localization-l1-2-1" - [base:0; Status:c0000135] "explothe.exe" failed to load missing module "api-ms-win-appmodel-runtime-l1-1-2" - [base:0; Status:c0000135]3c:T732,"file" has flags like IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "xX1Zl63.exe" has flags like IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "4AR077QH.exe" has flags like IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "VW6ig05.exe" has flags like IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "3Fs87VT.exe" has flags like IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "Dk2ox03.exe" has flags like IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "qj9aa78.exe" has flags like IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "1Wp25tZ5.exe" has flags like IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA "5ol2yF2.exe" has flags like IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "2St5480.exe" has flags like IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "clip.dll" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT3d:T96e,Found string "https://www.youtube.com/" (Indicator: "youtube"; File: "file") Found string "https://www.facebook.com/login" (Indicator: "facebook.com"; File: "file") Found string "@shift /0start "" https://www.facebook.com/loginstart "" https://www.youtube.comstart "" https://accounts.google.com" (Indicator: "facebook.com"; File: "53C1.bat") file/memory contains long string with (Indicator: "facebook.com"; File: "97ZM78Q3.txt") file/memory contains long string with (Indicator: "youtube"; File: "BLAFN6G1.txt") file/memory contains long string with (Indicator: "youtube"; File: "css_2_.css") file/memory contains long string with (Indicator: "facebook.com"; File: "J0YIYL4Z.txt") file/memory contains long string with (Indicator: "facebook.com"; File: "LYWPJ62F.txt") file/memory contains long string with (Indicator: "facebook.com"; File: "F8537174.txt") Found string "CONSENTWP.2676bayoutube.com/102431383388163210825482504061830633367hideBrowserUpgradeBoxtrueyoutube.com/921728791801603106804040767855831065243VISITOR_INFO1_LIVEqhnsPw9jWJQyoutube.com/921774129753631101434161480355831065243" (Indicator: "youtube"; File: "2MCKUOL7.txt") Found string "5Xw0ZQUZybSbtOwzRQL1a3X0facebook.com/9217264864576031145690492177104310652420nPcsGnTFkHxB842s..BlNHzl.UN.AAA.0.0.BlNHzl.AWVJOK33wwEfacebook.com/9217110419161631083329109817710431065242" (Indicator: "facebook.com"; File: "PWQN49HS.txt") Found string "CONSENTWP.2676bayoutube.com/102431383388163210825482504061830633367hideBrowserUpgradeBoxtrueyoutube.com/921728791801603106804040767855831065243" (Indicator: "youtube"; File: "B8P167D3.txt") Found string "CheckConnectionTempCookie70652397accounts.youtube.com/accounts/2147484752139087936031065340129634303131065340" (Indicator: "youtube"; File: "4ZSVHRCU.txt") Found string "5Xw0ZQUZybSbtOwzRQL1a3X0facebook.com/921726486457603114569049217710431065242" (Indicator: "facebook.com"; File: "EEOESYDF.txt") Found string "CONSENTWP.2676bayoutube.com/102431383388163210825482504061830633367" (Indicator: "youtube"; File: "57I46P9H.txt") Found string "accounts.youtube.com" (Indicator: "youtube"; File: "PCAP") Found string "facebook.com" (Indicator: "facebook.com"; File: "PCAP") Found string "www.facebook.com" (Indicator: "facebook.com"; File: "PCAP") Found string "www.youtube.com" (Indicator: "youtube"; File: "PCAP") file/memory contains long string with (Indicator: "youtube"; File: "SSL")3e:T4485,"file.exe" loaded module "%WINDIR%\SYSTEM32\ADVAPI32.DLL" at base 76000000 "file.exe" loaded module "FECLIENT.DLL" at base 6dc60000 "file.exe" loaded module "%WINDIR%\SYSTEM32\ADVPACK.DLL" at base 6d820000 "file.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 75ae0000 "file.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 734a0000 "file.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 0 "file.exe" loaded module "KERNEL32" at base 77e90000 "file.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 6d730000 "xX1Zl63.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 75ae0000 "xX1Zl63.exe" loaded module "%WINDIR%\SYSTEM32\ADVPACK.DLL" at base 6d810000 "VW6ig05.exe" loaded module "%WINDIR%\SYSTEM32\ADVPACK.DLL" at base 6d700000 "VW6ig05.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 75ae0000 "Dk2ox03.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 734a0000 "Dk2ox03.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 0 "Dk2ox03.exe" loaded module "KERNEL32" at base 77e90000 "Dk2ox03.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 0 "Dk2ox03.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 6d730000 "Dk2ox03.exe" loaded module "%WINDIR%\SYSTEM32\ADVPACK.DLL" at base 6d810000 "Dk2ox03.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 75ae0000 "qj9aa78.exe" loaded module "%WINDIR%\SYSTEM32\ADVPACK.DLL" at base 6d700000 "qj9aa78.exe" loaded module "ADVAPI32.DLL" at base 76000000 "qj9aa78.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 74720000 "qj9aa78.exe" loaded module "DWMAPI.DLL" at base 744a0000 "qj9aa78.exe" loaded module "COMCTL32.DLL" at base 74a80000 "qj9aa78.exe" loaded module "UXTHEME.DLL" at base 74720000 "qj9aa78.exe" loaded module "%WINDIR%\SYSTEM32\OLE32.DLL" at base 773d0000 "qj9aa78.exe" loaded module "CRYPTBASE.DLL" at base 75bc0000 "qj9aa78.exe" loaded module "CLBCATQ.DLL" at base 75f70000 "qj9aa78.exe" loaded module "%WINDIR%\SYSTEM32\MSCTF.DLL" at base 77300000 "qj9aa78.exe" loaded module "OLEAUT32.DLL" at base 76ff0000 "3Fs87VT.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-2" at base 0 "3Fs87VT.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 75ae0000 "AppLaunch.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 734a0000 "AppLaunch.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 0 "AppLaunch.exe" loaded module "KERNEL32" at base 77e90000 "AppLaunch.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 0 "4AR077QH.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 75ae0000 "4AR077QH.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-2" at base 0 "AppLaunch.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\CLR.DLL" at base 691f0000 "AppLaunch.exe" loaded module "USER32.DLL" at base 760b0000 "AppLaunch.exe" loaded module "API-MS-WIN-CORE-QUIRKS-L1-1-0.DLL" at base 0 "AppLaunch.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-2.DLL" at base 0 "AppLaunch.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-0.DLL" at base 0 "AppLaunch.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\MSCOREE.DLL" at base 0 "AppLaunch.exe" loaded module "MSCOREE.DLL" at base 6dba0000 "AppLaunch.exe" loaded module "%WINDIR%\SYSTEM32\COMBASE.DLL" at base 0 "AppLaunch.exe" loaded module "PSAPI.DLL" at base 77e80000 "AppLaunch.exe" loaded module "KERNEL32.DLL" at base 77e90000 "AppLaunch.exe" loaded module "RPCRT4.DLL" at base 77770000 "AppLaunch.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\MSCORLIB\36EACCFDE177C2E7B93B8DBDDE4E012A\MSCORLIB.NI.DLL" at base 67d30000 "AppLaunch.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\OLE32.DLL" at base 0 "AppLaunch.exe" loaded module "OLE32.DLL" at base 773d0000 "AppLaunch.exe" loaded module "CRYPTBASE.DLL" at base 75bc0000 "AppLaunch.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 74720000 "AppLaunch.exe" loaded module "API-MS-WIN-CORE-XSTATE-L2-1-0.DLL" at base 6f520000 "AppLaunch.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\CLRJIT.DLL" at base 67ca0000 "AppLaunch.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM\2C3C912EA8F058F9D04C4650128FEB3F\SYSTEM.NI.DLL" at base 67240000 "AppLaunch.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.DRAWING\F7568D7F1B9D356F64779B4C0927CFB3\SYSTEM.DRAWING.NI.DLL" at base 67090000 "AppLaunch.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.WINDOWS.FORMS\C9A4CBC00F690A9E3CDDFC400F6E85BB\SYSTEM.WINDOWS.FORMS.NI.DLL" at base 66220000 "AppLaunch.exe" loaded module "ADVAPI32.DLL" at base 76000000 "AppLaunch.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM.WINDOWS.FORMS\V4.0_4.0.0.0__B77A5C561934E089\UXTHEME.DLL" at base 0 "AppLaunch.exe" loaded module "UXTHEME.DLL" at base 74720000 "AppLaunch.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.CORE\31FAE3290FAD30C31C98651462D22724\SYSTEM.CORE.NI.DLL" at base 65a00000 "AppLaunch.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.CONFIGURATION\96F7EDB07B12303F0EC2595C7F3778C7\SYSTEM.CONFIGURATION.NI.DLL" at base 658f0000 "AppLaunch.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.XML\15AF16D373CF0528CB74FC73D365FDBF\SYSTEM.XML.NI.DLL" at base 65170000 "AppLaunch.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\NLSSORTING.DLL" at base 6d800000 "AppLaunch.exe" loaded module "NTDLL.DLL" at base 77d30000 "AppLaunch.exe" loaded module "SHELL32.DLL" at base 76330000 "AppLaunch.exe" loaded module "API-MS-WIN-SECURITY-SDDL-L1-1-0.DLL" at base 77250000 "AppLaunch.exe" loaded module "PROFAPI.DLL" at base 75c40000 "AppLaunch.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_32\MSCORLIB\V4.0_4.0.0.0__B77A5C561934E089\BCRYPT.DLL" at base 0 "AppLaunch.exe" loaded module "BCRYPT.DLL" at base 75750000 "AppLaunch.exe" loaded module "CRYPTSP.DLL" at base 75640000 "AppLaunch.exe" loaded module "%WINDIR%\SYSTEM32\RSAENH.DLL" at base 753d0000 "AppLaunch.exe" loaded module "IMM32.DLL" at base 77820000 "AppLaunch.exe" loaded module "COMCTL32.DLL" at base 650e0000 "AppLaunch.exe" loaded module "GDI32.DLL" at base 77270000 "AppLaunch.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\WINDOWSBASE\1A4CC316FB6D09525321FC0BE44692D8\WINDOWSBASE.NI.DLL" at base 64cc0000 "AppLaunch.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\PRESENTATIONCORE\468F4E17BE144CA12A73A4297EACC9CC\PRESENTATIONCORE.NI.DLL" at base 64080000 "AppLaunch.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\PRESENTATIO5AE0F00F#\252CC7B0FAE8CFE083BDC149957C0C54\PRESENTATIONFRAMEWORK.NI.DLL" at base 62c90000 "AppLaunch.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_32\PRESENTATIONCORE\V4.0_4.0.0.0__31BF3856AD364E35\UCRTBASE_CLR0400.DLL" at base 0 "AppLaunch.exe" loaded module "UCRTBASE_CLR0400.DLL" at base 69140000 "AppLaunch.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_32\PRESENTATIONCORE\V4.0_4.0.0.0__31BF3856AD364E35\SHLWAPI.DLL" at base 0 "AppLaunch.exe" loaded module "SHLWAPI.DLL" at base 76180000 "AppLaunch.exe" loaded module "DWRITE.DLL" at base 62b50000 "AppLaunch.exe" loaded module "API-MS-WIN-CORE-STRING-L1-1-0" at base 75c60000 "AppLaunch.exe" loaded module "API-MS-WIN-CORE-DATETIME-L1-1-1" at base 0 "AppLaunch.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-OBSOLETE-L1-2-0" at base 0 "AppLaunch.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\WPF\WPFGFX_V0400.DLL" at base 629c0000 "AppLaunch.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\WPF\PRESENTATIONNATIVE_V0400.DLL" at base 628d0000 "AppLaunch.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_32\MSCORLIB\V4.0_4.0.0.0__B77A5C561934E089\SHELL32.DLL" at base 0 "AppLaunch.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\VERSION.DLL" at base 0 "AppLaunch.exe" loaded module "VERSION.DLL" at base 751b0000 "AppLaunch.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.RUNTEB92AA12#\274E43040C8A7A02EF1065DB3283005A\SYSTEM.RUNTIME.SERIALIZATION.NI.DLL" at base 625f0000 "AppLaunch.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.IDENTITYMODEL\C2EF5BC545B98A289F02D0B3EDDBE280\SYSTEM.IDENTITYMODEL.NI.DLL" at base 622e0000 "AppLaunch.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SMDIAGNOSTICS\DC67DCB4B2FB4A3853D458CAB08561F0\SMDIAGNOSTICS.NI.DLL" at base 6d710000 "AppLaunch.exe" loaded module "%WINDIR%\SYSTEM32\MSWSOCK.DLL" at base 75600000 "AppLaunch.exe" loaded module "%WINDIR%\SYSTEM32\WSHTCPIP.DLL" at base 750b0000 "AppLaunch.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_32\MSCORLIB\V4.0_4.0.0.0__B77A5C561934E089\SECUR32.DLL" at base 0 "AppLaunch.exe" loaded module "RPCRTREMOTE.DLL" at base 75bd0000 "AppLaunch.exe" loaded module "%WINDIR%\SYSTEM32\WSHIP6.DLL" at base 755f0000 "AppLaunch.exe" loaded module "OLEAUT32.DLL" at base 76ff0000 "AppLaunch.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM\V4.0_4.0.0.0__B77A5C561934E089\NTDLL.DLL" at base 0 "AppLaunch.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.SECURITY\93D03EB9812405FA70E89D4EFD5F7E14\SYSTEM.SECURITY.NI.DLL" at base 5f210000 "AppLaunch.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM\V4.0_4.0.0.0__B77A5C561934E089\PSAPI.DLL" at base 0 "AppLaunch.exe" loaded module "VCRUNTIME140_CLR0400.DLL" at base 6f540000 "AppLaunch.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_32\PRESENTATIONCORE\V4.0_4.0.0.0__31BF3856AD364E35\VCRUNTIME140_CLR0400.DLL" at base 0 "5ol2yF2.exe" loaded module "OLE32.DLL" at base 773d0000 "5ol2yF2.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 74720000 "5ol2yF2.exe" loaded module "COMCTL32.DLL" at base 74a80000 "5ol2yF2.exe" loaded module "%WINDIR%\SYSTEM32\PROPSYS.DLL" at base 74960000 "5ol2yF2.exe" loaded module "PROFAPI.DLL" at base 75c40000 "5ol2yF2.exe" loaded module "APPHELP.DLL" at base 75ae0000 "5ol2yF2.exe" loaded module "SETUPAPI.DLL" at base 775d0000 "5ol2yF2.exe" loaded module "RPCRT4.DLL" at base 77770000 "5ol2yF2.exe" loaded module "KERNEL32.DLL" at base 77e90000 "5ol2yF2.exe" loaded module "CRYPTBASE.DLL" at base 75bc0000 "5ol2yF2.exe" loaded module "ADVAPI32.DLL" at base 76000000 "5ol2yF2.exe" loaded module "PROPSYS.DLL" at base 74960000 "5ol2yF2.exe" loaded module "OLEAUT32.DLL" at base 76ff0000 "5ol2yF2.exe" loaded module "SHELL32.DLL" at base 76330000 "5ol2yF2.exe" loaded module "CLBCATQ.DLL" at base 75f70000 "5ol2yF2.exe" loaded module "NTMARTA.DLL" at base 75150000 "5ol2yF2.exe" loaded module "API-MS-WIN-SECURITY-SDDL-L1-1-0.DLL" at base 77250000 "5ol2yF2.exe" loaded module "%WINDIR%\SYSTEM32\SHDOCVW.DLL" at base 6f7f0000 "5ol2yF2.exe" loaded module "%WINDIR%\SYSTEM32\SHELL32.DLL" at base 76330000 "5ol2yF2.exe" loaded module "%WINDIR%\SYSTEM32\URLMON.DLL" at base 761e0000 "5ol2yF2.exe" loaded module "SECUR32.DLL" at base 75970000 "5ol2yF2.exe" loaded module "API-MS-WIN-DOWNLEVEL-SHLWAPI-L1-1-0.DLL" at base 75e60000 "5ol2yF2.exe" loaded module "API-MS-WIN-DOWNLEVEL-ADVAPI32-L2-1-0.DLL" at base 71cc0000 "5ol2yF2.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 75ae0000 "5ol2yF2.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-2" at base 0 "explothe.exe" loaded module "KERNEL32.DLL" at base 77e90000 "explothe.exe" loaded module "SHELL32.DLL" at base 76330000 "explothe.exe" loaded module "OLE32.DLL" at base 773d0000 "explothe.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 74720000 "explothe.exe" loaded module "PROPSYS.DLL" at base 74960000 "explothe.exe" loaded module "COMCTL32.DLL" at base 74a80000 "explothe.exe" loaded module "OLEAUT32.DLL" at base 76ff0000 "explothe.exe" loaded module "ADVAPI32.DLL" at base 76000000 "explothe.exe" loaded module "SETUPAPI.DLL" at base 775d0000 "explothe.exe" loaded module "RPCRT4.DLL" at base 77770000 "explothe.exe" loaded module "API-MS-WIN-SECURITY-LSALOOKUP-L1-1-0.DLL" at base 77250000 "explothe.exe" loaded module "CRYPTBASE.DLL" at base 75bc0000 "explothe.exe" loaded module "APPHELP.DLL" at base 75ae0000 "explothe.exe" loaded module "DNSAPI.DLL" at base 754c0000 "explothe.exe" loaded module "DHCPCSVC6.DLL" at base 73b10000 "explothe.exe" loaded module "DHCPCSVC.DLL" at base 750c0000 "explothe.exe" loaded module "IPHLPAPI.DLL" at base 75190000 "explothe.exe" loaded module "CLBCATQ.DLL" at base 75f70000 "explothe.exe" loaded module "%WINDIR%\SYSTEM32\IEFRAME.DLL" at base 6c940000 "explothe.exe" loaded module "NTMARTA.DLL" at base 75150000 "explothe.exe" loaded module "%WINDIR%\SYSTEM32\URLMON.DLL" at base 761e0000 "explothe.exe" loaded module "SECUR32.DLL" at base 75970000 "explothe.exe" loaded module "%WINDIR%\SYSTEM32\MSWSOCK.DLL" at base 75600000 "explothe.exe" loaded module "%WINDIR%\SYSTEM32\WSHIP6.DLL" at base 755f0000 "explothe.exe" loaded module "%WINDIR%\SYSTEM32\NETPROFM.DLL" at base 6f660000 "explothe.exe" loaded module "%WINDIR%\SYSTEM32\WSHTCPIP.DLL" at base 750b0000 "explothe.exe" loaded module "RASADHLP.DLL" at base 72060000 "explothe.exe" loaded module "%WINDIR%\SYSTEM32\WININET.DLL" at base 77a80000 "explothe.exe" loaded module "%WINDIR%\SYSTEM32\OLEAUT32.DLL" at base 76ff0000 "explothe.exe" loaded module "%WINDIR%\SYSTEM32\NPMPROXY.DLL" at base 6ed90000 "6Um8bf3.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 74720000 "6Um8bf3.exe" loaded module "KERNEL32.DLL" at base 77e90000 "6Um8bf3.exe" loaded module "SHELL32.DLL" at base 76330000 "6Um8bf3.exe" loaded module "OLE32.DLL" at base 773d0000 "6Um8bf3.exe" loaded module "ADVAPI32.DLL" at base 76000000 "6Um8bf3.exe" loaded module "PROPSYS.DLL" at base 74960000 "6Um8bf3.exe" loaded module "COMCTL32.DLL" at base 74a80000 "6Um8bf3.exe" loaded module "OLEAUT32.DLL" at base 76ff0000 "6Um8bf3.exe" loaded module "CLBCATQ.DLL" at base 75f70000 "6Um8bf3.exe" loaded module "%WINDIR%\SYSTEM32\PROPSYS.DLL" at base 74960000 "6Um8bf3.exe" loaded module "NTMARTA.DLL" at base 75150000 "6Um8bf3.exe" loaded module "API-MS-WIN-SECURITY-SDDL-L1-1-0.DLL" at base 77250000 "6Um8bf3.exe" loaded module "PROFAPI.DLL" at base 75c40000 "6Um8bf3.exe" loaded module "%WINDIR%\SYSTEM32\URLMON.DLL" at base 761e0000 "6Um8bf3.exe" loaded module "SECUR32.DLL" at base 75970000 "6Um8bf3.exe" loaded module "RPCRT4.DLL" at base 77770000 "6Um8bf3.exe" loaded module "API-MS-WIN-DOWNLEVEL-SHLWAPI-L1-1-0.DLL" at base 75e60000 "6Um8bf3.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 75ae0000 "6Um8bf3.exe" loaded module "SETUPAPI.DLL" at base 775d0000 "cmd.exe" loaded module "COMCTL32.DLL" at base 74a80000 "cmd.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 74720000 "cmd.exe" loaded module "%WINDIR%\SYSTEM32\PROPSYS.DLL" at base 74960000 "cmd.exe" loaded module "%WINDIR%\SYSTEM32\SHELL32.DLL" at base 76330000 "cmd.exe" loaded module "API-MS-WIN-CORE-LOCALREGISTRY-L1-1-0.DLL" at base 77e90000 "cmd.exe" loaded module "KERNEL32.DLL" at base 77e90000 "cmd.exe" loaded module "%WINDIR%\SYSTEM32\IEFRAME.DLL" at base 6c940000 "cmd.exe" loaded module "API-MS-WIN-DOWNLEVEL-OLE32-L1-1-0.DLL" at base 75e50000 "cmd.exe" loaded module "API-MS-WIN-DOWNLEVEL-SHLWAPI-L2-1-0.DLL" at base 6d7f0000 "cmd.exe" loaded module "OLE32.DLL" at base 773d0000 "cmd.exe" loaded module "IERTUTIL.DLL" at base 77840000 "cmd.exe" loaded module "OLEAUT32.DLL" at base 76ff0000 "cmd.exe" loaded module "PROPSYS.DLL" at base 74960000 "cmd.exe" loaded module "USER32.DLL" at base 760b0000 "cmd.exe" loaded module "URLMON.DLL" at base 761e0000 "schtasks.exe" loaded module "CRYPTBASE.DLL" at base 75bc0000 "schtasks.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 74720000 "schtasks.exe" loaded module "RPCRT4.DLL" at base 77770000 "schtasks.exe" loaded module "CLBCATQ.DLL" at base 75f70000 "schtasks.exe" loaded module "ADVAPI32.DLL" at base 76000000 "schtasks.exe" loaded module "SSPICLI.DLL" at base 75ac0000 "schtasks.exe" loaded module "XMLLITE.DLL" at base 74470000 "schtasks.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 0 "cmd.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 75ae0000 "explothe.exe" loaded module "KERNEL32" at base 77e90000 "explothe.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 734a0000 "explothe.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 6d730000 "cacls.exe" loaded module "API-MS-WIN-SECURITY-LSALOOKUP-L1-1-0.DLL" at base 77250000 "cacls.exe" loaded module "GDI32.DLL" at base 77270000 "cacls.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 6d730000 "cacls.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 734a0000 "cacls.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 0 "cacls.exe" loaded module "KERNEL32" at base 77e90000 "rundll32.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 734a0000 "rundll32.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 0 "rundll32.exe" loaded module "KERNEL32" at base 77e90000 "rundll32.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 74720000 "explothe.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 0 "explothe.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 0 "explothe.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-2" at base 03f:T433,"file.exe" loaded module "%WINDIR%\System32\rpcrt4.dll" at 77770000 "xX1Zl63.exe" loaded module "%WINDIR%\System32\rpcrt4.dll" at 77770000 "VW6ig05.exe" loaded module "%WINDIR%\System32\rpcrt4.dll" at 77770000 "Dk2ox03.exe" loaded module "%WINDIR%\System32\rpcrt4.dll" at 77770000 "qj9aa78.exe" loaded module "%WINDIR%\System32\rpcrt4.dll" at 77770000 "3Fs87VT.exe" loaded module "%WINDIR%\System32\rpcrt4.dll" at 77770000 "AppLaunch.exe" loaded module "%WINDIR%\System32\rpcrt4.dll" at 77770000 "4AR077QH.exe" loaded module "%WINDIR%\System32\rpcrt4.dll" at 77770000 "5ol2yF2.exe" loaded module "%WINDIR%\System32\rpcrt4.dll" at 77770000 "explothe.exe" loaded module "%WINDIR%\System32\rpcrt4.dll" at 77770000 "6Um8bf3.exe" loaded module "%WINDIR%\System32\rpcrt4.dll" at 77770000 "cmd.exe" loaded module "%WINDIR%\System32\rpcrt4.dll" at 77770000 "schtasks.exe" loaded module "%WINDIR%\System32\rpcrt4.dll" at 77770000 "cacls.exe" loaded module "%WINDIR%\System32\rpcrt4.dll" at 77770000 "rundll32.exe" loaded module "%WINDIR%\System32\rpcrt4.dll" at 7777000040:T115e,"file" was detected as "Microsoft Cabinet" and name: "sfx" "file" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "file" was detected as "Microsoft Visual C/C++" and name: "Compiler" "file" was detected as "Microsoft Cabinet File" and name: "Archive" "file" was detected as "Microsoft Linker" and name: "Linker" "xX1Zl63.exe" was detected as "Microsoft Cabinet" and name: "sfx" "xX1Zl63.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "xX1Zl63.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "xX1Zl63.exe" was detected as "Microsoft Cabinet File" and name: "Archive" "xX1Zl63.exe" was detected as "Microsoft Linker" and name: "Linker" "4AR077QH.exe" was detected as "Microsoft Cabinet" and name: "sfx" "4AR077QH.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "4AR077QH.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "4AR077QH.exe" was detected as "Microsoft Cabinet File" and name: "Archive" "4AR077QH.exe" was detected as "Microsoft Linker" and name: "Linker" "VW6ig05.exe" was detected as "Microsoft Cabinet" and name: "sfx" "VW6ig05.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "VW6ig05.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "VW6ig05.exe" was detected as "Microsoft Cabinet File" and name: "Archive" "VW6ig05.exe" was detected as "Microsoft Linker" and name: "Linker" "3Fs87VT.exe" was detected as "Microsoft Cabinet" and name: "sfx" "3Fs87VT.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "3Fs87VT.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "3Fs87VT.exe" was detected as "Microsoft Cabinet File" and name: "Archive" "3Fs87VT.exe" was detected as "Microsoft Linker" and name: "Linker" "Dk2ox03.exe" was detected as "Microsoft Cabinet" and name: "sfx" "Dk2ox03.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "Dk2ox03.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "Dk2ox03.exe" was detected as "Microsoft Cabinet File" and name: "Archive" "Dk2ox03.exe" was detected as "Microsoft Linker" and name: "Linker" "qj9aa78.exe" was detected as "Microsoft Cabinet" and name: "sfx" "qj9aa78.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "qj9aa78.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "qj9aa78.exe" was detected as "Microsoft Cabinet File" and name: "Archive" "qj9aa78.exe" was detected as "Microsoft Linker" and name: "Linker" "1Wp25tZ5.exe" was detected as "Microsoft Cabinet" and name: "sfx" "1Wp25tZ5.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "1Wp25tZ5.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "1Wp25tZ5.exe" was detected as "Microsoft Cabinet File" and name: "Archive" "1Wp25tZ5.exe" was detected as "Microsoft Linker" and name: "Linker" "5ol2yF2.exe" was detected as "Microsoft Cabinet" and name: "sfx" "5ol2yF2.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "5ol2yF2.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "5ol2yF2.exe" was detected as "Microsoft Cabinet File" and name: "Archive" "5ol2yF2.exe" was detected as "Microsoft Linker" and name: "Linker" "2St5480.exe" was detected as "Microsoft Cabinet" and name: "sfx" "2St5480.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "2St5480.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "2St5480.exe" was detected as "Microsoft Cabinet File" and name: "Archive" "2St5480.exe" was detected as "Microsoft Linker" and name: "Linker" "clip.dll" was detected as "Microsoft Cabinet" and name: "sfx" "clip.dll" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "clip.dll" was detected as "Microsoft Visual C/C++" and name: "Compiler" "clip.dll" was detected as "Microsoft Cabinet File" and name: "Archive" "clip.dll" was detected as "Microsoft Linker" and name: "Linker" "6Um8bf3.exe" was detected as "Microsoft Cabinet" and name: "sfx" "6Um8bf3.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "6Um8bf3.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "6Um8bf3.exe" was detected as "Microsoft Cabinet File" and name: "Archive" "6Um8bf3.exe" was detected as "Microsoft Linker" and name: "Linker"41:Tf9f,"AppLaunch.exe" touched "WBEM Locator" (Path: "HKCU\CLSID\{4590F811-1D3A-11D0-891F-00AA004B2E24}\INPROCSERVER32") "AppLaunch.exe" touched "Windows Management and Instrumentation" (Path: "HKCU\CLSID\{8BC3F05E-D86B-11D0-A075-00C04FB68820}") "AppLaunch.exe" touched "WbemDefaultPathParser" (Path: "HKCU\CLSID\{CF4CC405-E2C5-4DDD-B3CE-5E7582D8C9FA}\INPROCSERVER32") "AppLaunch.exe" touched "PSFactoryBuffer" (Path: "HKCU\CLSID\{7C857801-7381-11CF-884D-00AA004B2E24}\INPROCSERVER32") "AppLaunch.exe" touched "Microsoft WBEM (non)Standard Marshaling for IWbemServices" (Path: "HKCU\CLSID\{D68AF00A-29CB-43FA-8504-CE99A996D9EA}\INPROCHANDLER") "AppLaunch.exe" touched "Microsoft WBEM (non)Standard Marshaling for IEnumWbemClassObject" (Path: "HKCU\CLSID\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\TREATAS") "5ol2yF2.exe" touched "Computer" (Path: "HKCU\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\SHELLFOLDER") "5ol2yF2.exe" touched "Memory Mapped Cache Mgr" (Path: "HKCU\CLSID\{1F486A52-3CB1-48FD-8F50-B8DC300D9F9D}") "5ol2yF2.exe" touched "UsersFiles" (Path: "HKCU\CLSID\{59031A47-3F72-44A7-89C5-5595FE6B30EE}\SHELLFOLDER") "5ol2yF2.exe" touched "Property System Both Class Factory" (Path: "HKCU\CLSID\{76765B11-3F95-4AF2-AC9D-EA55D8994F1A}") "5ol2yF2.exe" touched "delegate folder that appears in Users Files Folder" (Path: "HKCU\CLSID\{DFFACDC5-679F-4156-8947-C5C76BC0B67F}\SHELLFOLDER") "5ol2yF2.exe" touched "Shell File System Folder" (Path: "HKCU\CLSID\{0E5AAE11-A475-4C5B-AB00-C66DE400274E}\INPROCSERVER32") "5ol2yF2.exe" touched "Security Manager" (Path: "HKCU\CLSID\{7B8A2D94-0AC9-11D1-896C-00C04FB6BFC4}\TREATAS") "explothe.exe" touched "WinInetBroker Class" (Path: "HKCU\CLSID\{C39EE728-D419-4BD4-A3EF-EDA059DBD935}") "explothe.exe" touched "NetworkListManager" (Path: "HKLM\SOFTWARE\CLASSES\CLSID\{DCB00C01-570F-4A9B-8D69-199FDBA5723B}") "explothe.exe" touched "Network List Manager" (Path: "HKCU\CLSID\{A47979D2-C419-11D9-A5B4-001185AD2B89}\TREATAS") "explothe.exe" touched "Network" (Path: "HKCU\CLSID\{208D2C60-3AEA-1069-A2D7-08002B30309D}\SHELLFOLDER") "explothe.exe" touched "Recycle Bin" (Path: "HKCU\CLSID\{645FF040-5081-101B-9F08-00AA002F954E}\SHELLFOLDER") "explothe.exe" touched "Control Panel" (Path: "HKCU\CLSID\{26EE0668-A00A-44D7-9371-BEB064C98683}\SHELLFOLDER") "explothe.exe" touched "UsersLibraries" (Path: "HKCU\CLSID\{031E4825-7B94-4DC3-B131-E946B44C8DD5}\SHELLFOLDER") "explothe.exe" touched "CLSID_SearchFolder" (Path: "HKCU\CLSID\{04731B67-D933-450A-90E6-4ACD2E9408FE}\SHELLFOLDER") "explothe.exe" touched "Microsoft OneNote Namespace Extension for Windows Desktop Search" (Path: "HKCU\CLSID\{0875DCB6-C686-4243-9432-ADCCF0B9F2D7}\SHELLFOLDER") "explothe.exe" touched "IE History and Feeds Shell Data Source for Windows Search" (Path: "HKCU\CLSID\{11016101-E366-4D22-BC06-4ADA335C892B}\SHELLFOLDER") "explothe.exe" touched "Public Folder" (Path: "HKCU\CLSID\{4336A54D-038B-4685-AB02-99BB52D3FB8B}\SHELLFOLDER") "explothe.exe" touched "Control Panel command object for Start menu and desktop" (Path: "HKCU\CLSID\{5399E694-6CE5-4D6C-8FCE-1D8870FDCBA0}\SHELLFOLDER") "explothe.exe" touched "@%systemroot%\system32\mssvp.dll,-110" (Path: "HKCU\CLSID\{89D83576-6BD1-4C86-9454-BEB04E94C819}\SHELLFOLDER") "explothe.exe" touched "Windows Search Service Media Center Namespace Extension Handler" (Path: "HKCU\CLSID\{98D99750-0B8A-4C59-9151-589053683D73}\SHELLFOLDER") "explothe.exe" touched "@%systemroot%\system32\mssvp.dll,-112" (Path: "HKCU\CLSID\{BD7A2E7B-21CB-41B2-A086-B309680C6B7E}\SHELLFOLDER") "explothe.exe" touched "CLSID_StartMenuProviderFolder" (Path: "HKCU\CLSID\{DAF95313-E44D-46AF-BE1B-CBACEA2C3065}\SHELLFOLDER") "explothe.exe" touched "Games Explorer" (Path: "HKCU\CLSID\{ED228FDF-9EA8-4870-83B1-96B02CFE0D52}\SHELLFOLDER") "cmd.exe" touched "Application Registration" (Path: "HKCU\CLSID\{591209C7-767B-42B2-9FBA-44EE4615F2C7}") "schtasks.exe" touched "TaskScheduler class" (Path: "HKCU\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}")42:T1899,"file" file has an entrypoint instructions - "call 0x407155,jmp 0x406a6a,push 0x58,push 0x4072b8,call 0x407208,xor ebx, ebx,mov dword ptr [ebp - 0x20], ebx,lea eax, [ebp - 0x68],push eax,call dword ptr [0x40a184],mov dword ptr [ebp - 4], ebx,mov eax, dword ptr fs:[0x18],mov esi, dword ptr [eax + 4],mov edi, ebx,mov edx, 0x4088ac,mov ecx, esi,xor eax, eax,lock cmpxchg dword ptr [edx], ecx,test eax, eax,je 0x406abc,cmp eax, esi,jne 0x406aaf,xor esi, esi,inc esi,mov edi, esi,jmp 0x406abf,push 0x3e8,call dword ptr [0x40a188],jmp 0x406a93,xor esi, esi,inc esi," "xX1Zl63.exe" file has an entrypoint instructions - "call 0x407155,jmp 0x406a6a,push 0x58,push 0x4072b8,call 0x407208,xor ebx, ebx,mov dword ptr [ebp - 0x20], ebx,lea eax, [ebp - 0x68],push eax,call dword ptr [0x40a184],mov dword ptr [ebp - 4], ebx,mov eax, dword ptr fs:[0x18],mov esi, dword ptr [eax + 4],mov edi, ebx,mov edx, 0x4088ac,mov ecx, esi,xor eax, eax,lock cmpxchg dword ptr [edx], ecx,test eax, eax,je 0x406abc,cmp eax, esi,jne 0x406aaf,xor esi, esi,inc esi,mov edi, esi,jmp 0x406abf,push 0x3e8,call dword ptr [0x40a188],jmp 0x406a93,xor esi, esi,inc esi," "4AR077QH.exe" file has an entrypoint instructions - "jmp 0x4449ea,jmp 0x45bba4,jmp 0x44d070,jmp 0x438c0c,jmp 0x424a28,jmp 0x4a7a20,jmp 0x4390ca,jmp 0x45c987,jmp 0x4af349,jmp 0x41f4e1,jmp 0x445b48,jmp 0x41e133,jmp 0x455a10,jmp 0x42fa0b,jmp 0x456e46,jmp 0x420d95,jmp 0x41d19c,jmp 0x49573f,jmp 0x413ce0,jmp 0x4570d7," "VW6ig05.exe" file has an entrypoint instructions - "call 0x407155,jmp 0x406a6a,push 0x58,push 0x4072b8,call 0x407208,xor ebx, ebx,mov dword ptr [ebp - 0x20], ebx,lea eax, [ebp - 0x68],push eax,call dword ptr [0x40a184],mov dword ptr [ebp - 4], ebx,mov eax, dword ptr fs:[0x18],mov esi, dword ptr [eax + 4],mov edi, ebx,mov edx, 0x4088ac,mov ecx, esi,xor eax, eax,lock cmpxchg dword ptr [edx], ecx,test eax, eax,je 0x406abc,cmp eax, esi,jne 0x406aaf,xor esi, esi,inc esi,mov edi, esi,jmp 0x406abf,push 0x3e8,call dword ptr [0x40a188],jmp 0x406a93,xor esi, esi,inc esi," "3Fs87VT.exe" file has an entrypoint instructions - "jmp 0x4449fa,jmp 0x45bbb4,jmp 0x44d080,jmp 0x438c1c,jmp 0x424a38,jmp 0x4a7a30,jmp 0x4390da,jmp 0x45c997,jmp 0x4af359,jmp 0x41f4f1,jmp 0x445b58,jmp 0x41e143,jmp 0x455a20,jmp 0x42fa1b,jmp 0x456e56,jmp 0x420da5,jmp 0x41d1ac,jmp 0x49574f,jmp 0x413ce0,jmp 0x4570e7," "Dk2ox03.exe" file has an entrypoint instructions - "call 0x407155,jmp 0x406a6a,push 0x58,push 0x4072b8,call 0x407208,xor ebx, ebx,mov dword ptr [ebp - 0x20], ebx,lea eax, [ebp - 0x68],push eax,call dword ptr [0x40a184],mov dword ptr [ebp - 4], ebx,mov eax, dword ptr fs:[0x18],mov esi, dword ptr [eax + 4],mov edi, ebx,mov edx, 0x4088ac,mov ecx, esi,xor eax, eax,lock cmpxchg dword ptr [edx], ecx,test eax, eax,je 0x406abc,cmp eax, esi,jne 0x406aaf,xor esi, esi,inc esi,mov edi, esi,jmp 0x406abf,push 0x3e8,call dword ptr [0x40a188],jmp 0x406a93,xor esi, esi,inc esi," "qj9aa78.exe" file has an entrypoint instructions - "call 0x407155,jmp 0x406a6a,push 0x58,push 0x4072b8,call 0x407208,xor ebx, ebx,mov dword ptr [ebp - 0x20], ebx,lea eax, [ebp - 0x68],push eax,call dword ptr [0x40a184],mov dword ptr [ebp - 4], ebx,mov eax, dword ptr fs:[0x18],mov esi, dword ptr [eax + 4],mov edi, ebx,mov edx, 0x4088ac,mov ecx, esi,xor eax, eax,lock cmpxchg dword ptr [edx], ecx,test eax, eax,je 0x406abc,cmp eax, esi,jne 0x406aaf,xor esi, esi,inc esi,mov edi, esi,jmp 0x406abf,push 0x3e8,call dword ptr [0x40a188],jmp 0x406a93,xor esi, esi,inc esi," "1Wp25tZ5.exe" file has an entrypoint instructions - "sub rsp, 0x28,call 0x14000b078,add rsp, 0x28,jmp 0x14000a63c,int3 ,int3 ,sub rsp, 0x28,call 0x14000b41c,test eax, eax,je 0x14000a7fa,mov rax, qword ptr gs:[0x30],mov rcx, qword ptr [rax + 8],jmp 0x14000a7ed,cmp rcx, rax,je 0x14000a801,xor eax, eax,lock cmpxchg qword ptr [rip + 0x35e70], rcx,jne 0x14000a7e8,xor al, al,add rsp, 0x28,ret ,mov al, 1,jmp 0x14000a7fc,int3 ,int3 ,int3 ,push rbx,sub rsp, 0x20,movzx eax, byte ptr [rip + 0x35e5b],test ecx, ecx,mov ebx, 1," "5ol2yF2.exe" file has an entrypoint instructions - "call 0x414888,jmp 0x41427f,jmp 0x4186fa,push ebp,mov ebp, esp,sub esp, 0x324,push ebx,push 0x17,call 0x4273e3,test eax, eax,je 0x41442a,mov ecx, dword ptr [ebp + 8],int 0x29,push 3,call 0x4145d7,mov dword ptr [esp], 0x2cc,lea eax, [ebp - 0x324],push 0,push eax,call 0x414ec0,add esp, 0xc,mov dword ptr [ebp - 0x274], eax,mov dword ptr [ebp - 0x278], ecx,mov dword ptr [ebp - 0x27c], edx,mov dword ptr [ebp - 0x280], ebx," "2St5480.exe" file has an entrypoint instructions - "call 0x4014e9,jmp 0x4010c5,push ebp,mov ebp, esp,mov eax, dword ptr [ebp + 8],push esi,mov ecx, dword ptr [eax + 0x3c],add ecx, eax,movzx eax, word ptr [ecx + 0x14],lea edx, [ecx + 0x18],add edx, eax,movzx eax, word ptr [ecx + 6],imul esi, eax, 0x28,add esi, edx,cmp edx, esi,je 0x401286,mov ecx, dword ptr [ebp + 0xc],cmp ecx, dword ptr [edx + 0xc],jb 0x40127f,mov eax, dword ptr [edx + 8],add eax, dword ptr [edx + 0xc],cmp ecx, eax,jb 0x40128b,add edx, 0x28,cmp edx, esi,jne 0x401270,xor eax, eax,pop esi,pop ebp,ret ,mov eax, edx,jmp 0x401288,push esi,call 0x401a29,test eax, eax,je 0x4012b9,mov eax, dword ptr fs:[0x18],mov esi, 0x42bd74," "clip.dll" file has an entrypoint instructions - "push ebp,mov ebp, esp,cmp dword ptr [ebp + 0xc], 1,jne 0x10003e0e,call 0x100041f9,push dword ptr [ebp + 0x10],push dword ptr [ebp + 0xc],push dword ptr [ebp + 8],call 0x10003ccf,add esp, 0xc,pop ebp,ret 0xc,jmp 0x10006e36,push ebp,mov ebp, esp,sub esp, 0xc,lea ecx, [ebp - 0xc],call 0x100035f8,push 0x10014590,lea eax, [ebp - 0xc],push eax,call 0x10004497,int3 ,push ebp,mov ebp, esp,and dword ptr [0x10016a48], 0,sub esp, 0x24,or dword ptr [0x10016004], 1,push 0xa,call 0x1000e0c7,test eax, eax," "6Um8bf3.exe" file has an entrypoint instructions - "pushal ,mov esi, 0x412015,lea edi, [esi - 0x11015],push edi,mov ebp, esp,lea ebx, [esp - 0x3e80],xor eax, eax,push eax,cmp esp, ebx,jne 0x41bca8,inc esi,inc esi,push ebx,push 0x19a62,push edi,add ebx, 4,push ebx,push 0x9c78,push esi,add ebx, 4,push ebx,push eax,mov dword ptr [ebx], 0x20003,push ebp,push edi,push esi,push ebx,sub esp, 0x7c,mov edx, dword ptr [esp + 0x90],mov dword ptr [esp + 0x74], 0,mov byte ptr [esp + 0x73], 0,mov ebp, dword ptr [esp + 0x9c],lea eax, [edx + 4],mov dword ptr [esp + 0x78], eax,"43:Tbc3,Process "xX1Zl63.exe" (UID: 00000000-00002736) was launched with new environment variables: "__COMPAT_LAYER="ElevateCreateProcess WRPMitigationLayer"" Process "cmd.exe" (UID: 00000000-00002248) was launched with new environment variables: "b2eincfilepath="%TEMP%\IXP000.TMP"" Process "schtasks.exe" (UID: 00000000-00002784) was launched with missing environment variables: "b2eincfilepath" Process "cmd.exe" (UID: 00000000-00003428) was launched with new environment variables: "PROMPT="$P$G"" Process "iexplore.exe" (UID: 00000000-00002656) was launched with new environment variables: "b2eincfilepath="%TEMP%\IXP000.TMP"" Process "iexplore.exe" (UID: 00000000-00002656) was launched with modified environment variables: "Path" Process "cacls.exe" (UID: 00000000-00002488) was launched with modified environment variables: "Path" Process "cacls.exe" (UID: 00000000-00002488) was launched with missing environment variables: "b2eincfilepath" Process "explothe.exe" (UID: 00000000-00002512) was launched with missing environment variables: "PROMPT, __COMPAT_LAYER" Process "iexplore.exe" (UID: 00000000-00002392) was launched with new environment variables: "PROMPT="$P$G", __COMPAT_LAYER="ElevateCreateProcess WRPMitigationLayer", b2eincfilepath="%TEMP%\IXP000.TMP"" Process "iexplore.exe" (UID: 00000000-00002392) was launched with modified environment variables: "Path" Process "cacls.exe" (UID: 00000000-00003744) was launched with modified environment variables: "Path" Process "cacls.exe" (UID: 00000000-00003744) was launched with missing environment variables: "b2eincfilepath" Process "iexplore.exe" (UID: 00000000-00003236) was launched with new environment variables: "b2eincfilepath="%TEMP%\IXP000.TMP"" Process "iexplore.exe" (UID: 00000000-00003236) was launched with modified environment variables: "Path" Process "cacls.exe" (UID: 00000000-00000556) was launched with modified environment variables: "Path" Process "cacls.exe" (UID: 00000000-00000556) was launched with missing environment variables: "b2eincfilepath" Process "iexplore.exe" (UID: 00000000-00003392) was launched with new environment variables: "b2eincfilepath="%TEMP%\IXP000.TMP"" Process "iexplore.exe" (UID: 00000000-00003392) was launched with modified environment variables: "Path" Process "rundll32.exe" (UID: 00000000-00001384) was launched with modified environment variables: "Path" Process "rundll32.exe" (UID: 00000000-00001384) was launched with missing environment variables: "PROMPT, b2eincfilepath" Process "iexplore.exe" (UID: 00000000-00002976) was launched with new environment variables: "PROMPT="$P$G", b2eincfilepath="%TEMP%\IXP000.TMP"" Process "iexplore.exe" (UID: 00000000-00002976) was launched with modified environment variables: "Path" Process "explothe.exe" (UID: 00000000-00002152) was launched with modified environment variables: "Path" Process "explothe.exe" (UID: 00000000-00002152) was launched with missing environment variables: "PROMPT, __COMPAT_LAYER, b2eincfilepath"44:T826,"file.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "file.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "xX1Zl63.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "xX1Zl63.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "VW6ig05.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "VW6ig05.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "Dk2ox03.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "Dk2ox03.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "qj9aa78.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "qj9aa78.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "qj9aa78.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LOCALE"; Key: "00000409") "3Fs87VT.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "3Fs87VT.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "AppLaunch.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "AppLaunch.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "4AR077QH.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "4AR077QH.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "AppLaunch.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LOCALE"; Key: "00000409") "5ol2yF2.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "5ol2yF2.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "explothe.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "explothe.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "6Um8bf3.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US")45:Tf0e,Observed system executable string:"C:\Windows\system32\apphelp.dll" [Source: 00002736.00000AB0.1113237.00050000.wprm] Observed system executable string:"%WINDIR%\system32\advapi32.dll" [Source: 00000000-00000928-00000C25-15381272] Observed system executable string:"%WINDIR%\system32\advpack.dll" [Source: 00000000-00000928-00000C25-15538974] Observed system executable string:"rundll32.exe %WINDIR%\system32\advpack.dll,DelNodeRunDLL32 "%TEMP%\IXP000.TMP\"" [Source: 00000000-00000928-00000BC1-15565073] Observed system executable string:"rundll32.exe %WINDIR%\system32\advpack.dll,DelNodeRunDLL32 "%TEMP%\IXP001.TMP\"" [Source: 00000000-00002736-00000BC1-16067270] Observed system executable string:"rundll32.exe %WINDIR%\system32\advpack.dll,DelNodeRunDLL32 "%TEMP%\IXP002.TMP\"" [Source: 00000000-00003088-00000BC1-16648446] Observed system executable string:"rundll32.exe %WINDIR%\system32\advpack.dll,DelNodeRunDLL32 "%TEMP%\IXP003.TMP\"" [Source: 00000000-00003452-00000BC1-28173784] Observed system executable string:"rundll32.exe %WINDIR%\system32\advpack.dll,DelNodeRunDLL32 "%TEMP%\IXP004.TMP\"" [Source: 00000000-00003976-00000BC1-17547794] Observed system executable string:"%WINDIR%\system32\uxtheme.dll" [Source: 00000000-00003976-00000C25-17619161] Observed system executable string:"%WINDIR%\system32\ole32.dll" [Source: 00000000-00003976-00000C25-17835198] Observed system executable string:"%WINDIR%\system32\MSCTF.dll" [Source: 00000000-00003976-00000C25-17911978] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\clr.dll" [Source: 00000000-00003268-00000C25-27731777] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoree.dll" [Source: 00000000-00003268-00000C25-28481535] Observed system executable string:"%WINDIR%\system32\combase.dll" [Source: 00000000-00003268-00000C25-28601865] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\mscorlib\36eaccfde177c2e7b93b8dbdde4e012a\mscorlib.ni.dll" [Source: 00000000-00003268-00000C25-28915195] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\ole32.dll" [Source: 00000000-00003268-00000C25-28997545] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\clrjit.dll" [Source: 00000000-00003268-00000C25-29454701] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System\2c3c912ea8f058f9d04c4650128feb3f\System.ni.dll" [Source: 00000000-00003268-00000C25-29657450] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Drawing\f7568d7f1b9d356f64779b4c0927cfb3\System.Drawing.ni.dll" [Source: 00000000-00003268-00000C25-29701879] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Windows.Forms\c9a4cbc00f690a9e3cddfc400f6e85bb\System.Windows.Forms.ni.dll" [Source: 00000000-00003268-00000C25-29766325] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\uxtheme.dll" [Source: 00000000-00003268-00000C25-30141273] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Core\31fae3290fad30c31c98651462d22724\System.Core.ni.dll" [Source: 00000000-00003268-00000C25-30334038] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Configuration\96f7edb07b12303f0ec2595c7f3778c7\System.Configuration.ni.dll" [Source: 00000000-00003268-00000C25-30380054] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Xml\15af16d373cf0528cb74fc73d365fdbf\System.Xml.ni.dll" [Source: 00000000-00003268-00000C25-30707657] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\nlssorting.dll" [Source: 00000000-00003268-00000C25-31064315]46:T871,Spawned process "xX1Zl63.exe" (UID: 00000000-00002736) Spawned process "VW6ig05.exe" (UID: 00000000-00003088) Spawned process "Dk2ox03.exe" (UID: 00000000-00003452) Spawned process "qj9aa78.exe" (UID: 00000000-00003976) Spawned process "3Fs87VT.exe" (UID: 00000000-00000876) Spawned process "AppLaunch.exe" (UID: 00000000-00003836) Spawned process "4AR077QH.exe" (UID: 00000000-00003276) Spawned process "AppLaunch.exe" (UID: 00000000-00003268) Spawned process "5ol2yF2.exe" (UID: 00000000-00003396) Spawned process "explothe.exe" (UID: 00000000-00001460) Spawned process "6Um8bf3.exe" (UID: 00000000-00001884) Spawned process "cmd.exe" with commandline "/c "%TEMP%\\53BF.tmp\\53C0.tmp\\53C1.bat %TEMP%\\IXP000.TMP\\6Um ..." (UID: 00000000-00002248), Spawned process "schtasks.exe" with commandline "/Create /SC MINUTE /MO 1 /TN explothe.exe /TR "%TEMP%\\fefffe8ce ..." (UID: 00000000-00002784) Spawned process "cmd.exe" with commandline "/k echo Y|CACLS "explothe.exe" /P "%OSUSER%:N"&&CACLS "explothe. ..." (UID: 00000000-00002860), Spawned process "cmd.exe" with commandline "/S /D /c" echo Y"" (UID: 00000000-00003428), Spawned process "iexplore.exe" with commandline "https://www.facebook.com/login" (UID: 00000000-00002656), Spawned process "cacls.exe" with commandline "CACLS "explothe.exe" /P "%OSUSER%:N"" (UID: 00000000-00002488), Spawned process "explothe.exe" (UID: 00000000-00002512), Spawned process "iexplore.exe" with commandline "https://www.youtube.com/" (UID: 00000000-00002392), Spawned process "cacls.exe" with commandline "CACLS "explothe.exe" /P "%OSUSER%:R" /E" (UID: 00000000-00003744), Spawned process "cmd.exe" with commandline "/S /D /c" echo Y"" (UID: 00000000-00003092), Spawned process "iexplore.exe" with commandline "SCODEF:2656 CREDAT:275458 /prefetch:2" (UID: 00000000-00004048), Spawned process "iexplore.exe" with commandline "https://accounts.google.com/" (UID: 00000000-00003236), Spawned process "cacls.exe" with commandline "CACLS "..\\fefffe8cea" /P "%OSUSER%:N"" (UID: 00000000-00000556), Spawned process "cacls.exe" with commandline "CACLS "..\\fefffe8cea" /P "%OSUSER%:R" /E" (UID: 00000000-00002920)47:T871,Spawned process "xX1Zl63.exe" (UID: 00000000-00002736) Spawned process "VW6ig05.exe" (UID: 00000000-00003088) Spawned process "Dk2ox03.exe" (UID: 00000000-00003452) Spawned process "qj9aa78.exe" (UID: 00000000-00003976) Spawned process "3Fs87VT.exe" (UID: 00000000-00000876) Spawned process "AppLaunch.exe" (UID: 00000000-00003836) Spawned process "4AR077QH.exe" (UID: 00000000-00003276) Spawned process "AppLaunch.exe" (UID: 00000000-00003268) Spawned process "5ol2yF2.exe" (UID: 00000000-00003396) Spawned process "explothe.exe" (UID: 00000000-00001460) Spawned process "6Um8bf3.exe" (UID: 00000000-00001884) Spawned process "cmd.exe" with commandline "/c "%TEMP%\\53BF.tmp\\53C0.tmp\\53C1.bat %TEMP%\\IXP000.TMP\\6Um ..." (UID: 00000000-00002248), Spawned process "schtasks.exe" with commandline "/Create /SC MINUTE /MO 1 /TN explothe.exe /TR "%TEMP%\\fefffe8ce ..." (UID: 00000000-00002784) Spawned process "cmd.exe" with commandline "/k echo Y|CACLS "explothe.exe" /P "%OSUSER%:N"&&CACLS "explothe. ..." (UID: 00000000-00002860), Spawned process "cmd.exe" with commandline "/S /D /c" echo Y"" (UID: 00000000-00003428), Spawned process "iexplore.exe" with commandline "https://www.facebook.com/login" (UID: 00000000-00002656), Spawned process "cacls.exe" with commandline "CACLS "explothe.exe" /P "%OSUSER%:N"" (UID: 00000000-00002488), Spawned process "explothe.exe" (UID: 00000000-00002512), Spawned process "iexplore.exe" with commandline "https://www.youtube.com/" (UID: 00000000-00002392), Spawned process "cacls.exe" with commandline "CACLS "explothe.exe" /P "%OSUSER%:R" /E" (UID: 00000000-00003744), Spawned process "cmd.exe" with commandline "/S /D /c" echo Y"" (UID: 00000000-00003092), Spawned process "iexplore.exe" with commandline "SCODEF:2656 CREDAT:275458 /prefetch:2" (UID: 00000000-00004048), Spawned process "iexplore.exe" with commandline "https://accounts.google.com/" (UID: 00000000-00003236), Spawned process "cacls.exe" with commandline "CACLS "..\\fefffe8cea" /P "%OSUSER%:N"" (UID: 00000000-00000556), Spawned process "cacls.exe" with commandline "CACLS "..\\fefffe8cea" /P "%OSUSER%:R" /E" (UID: 00000000-00002920)48:T6047,"xX1Zl63.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP000.TMP\xX1Zl63.exe]- [targetUID: 00000000-00002736] "4AR077QH.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP002.TMP\4AR077QH.exe]- [targetUID: 00000000-00003276] "VW6ig05.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP001.TMP\VW6ig05.exe]- [targetUID: 00000000-00002736] "3Fs87VT.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP003.TMP\3Fs87VT.exe]- [targetUID: 00000000-00000876] "urlref_httpswww.youtube.com" has type "HTML document UTF-8 Unicode text with very long lines"- [targetUID: N/A] "Dk2ox03.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP002.TMP\Dk2ox03.exe]- [targetUID: 00000000-00003452] "urlref_httpsaccounts.google.com" has type "HTML document UTF-8 Unicode text with very long lines"- [targetUID: N/A] "qj9aa78.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP003.TMP\qj9aa78.exe]- [targetUID: 00000000-00003976] "1Wp25tZ5.exe" has type "PE32+ executable (console) x86-64 for MS Windows"- Location: [%TEMP%\IXP004.TMP\1Wp25tZ5.exe]- [targetUID: 00000000-00003976] "5ol2yF2.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP001.TMP\5ol2yF2.exe]- [targetUID: 00000000-00002736] "2St5480.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP004.TMP\2St5480.exe]- [targetUID: 00000000-00003976] "clip.dll" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"- Location: [%APPDATA%\006700e5a2ab05\clip.dll]- [targetUID: 00000000-00001460] "6Um8bf3.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows UPX compressed"- Location: [%TEMP%\IXP000.TMP\6Um8bf3.exe]- [targetUID: 00000000-00001884] "4aAhOWlwaXf_1_.svg" has type "SVG Scalable Vector Graphics image"- [targetUID: N/A] "cred.dll" has type "HTML document ASCII text"- [targetUID: N/A] "53C1.bat" has type "ASCII text with CRLF line terminators"- Location: [%TEMP%\53BF.tmp\53C0.tmp\53C1.bat]- [targetUID: 00000000-00002248] "urlblockindex_1_.bin" has type "data"- [targetUID: N/A] "IVHZVIUP.js" has type "ASCII text with very long lines"- Location: [%LOCALAPPDATA%\Microsoft\Windows\Temporary Internet Files\Content.IE5\37NU00GP\IVHZVIUP.js]- [targetUID: 00000000-00002976] "identifier_1_.htm" has type "HTML document UTF-8 Unicode text with very long lines"- [targetUID: N/A] "RNFuSb7tdaZ_1_.js" has type "ASCII text with very long lines"- [targetUID: N/A] "m__b__tp_1_.js" has type "ASCII text with very long lines"- [targetUID: N/A] "K3Z7HZTX.htm" has type "HTML document UTF-8 Unicode text with very long lines with CRLF NEL line terminators"- Location: [%LOCALAPPDATA%\Microsoft\Windows\Temporary Internet Files\Content.IE5\QQW0X29Y\K3Z7HZTX.htm]- [targetUID: 00000000-00002656] "Tar43FC.tmp" has type "data"- [targetUID: N/A] "m_ltDFwf_Rusgnf_Ctsu_UPKV3d_bPkrc_W2YXuc_pxq3x_IZ1fbc_soHxf_kSPLL_qPfo0c_yRXbo_bTi8wc_ywOR5c_PHUIyb_1_.js" has type "ASCII text with very long lines"- [targetUID: N/A] "login_2_.htm" has type "HTML document UTF-8 Unicode text with very long lines"- [targetUID: N/A] "Cab440B.tmp" has type "Microsoft Cabinet archive data Windows 2000/XP setup 63165 bytes 1 file at 0x2c +A "authroot.stl" number 1 6 datablocks 0x1 compression"- [targetUID: N/A] "login_1_.htm" has type "HTML document UTF-8 Unicode text with very long lines"- [targetUID: N/A] "dinosaur_1_.png" has type "PNG image data 1200 x 800 8-bit/color RGBA non-interlaced"- [targetUID: N/A] "urlref_httpswww.facebook.comlogin" has type "HTML document UTF-8 Unicode text with very long lines"- [targetUID: N/A] "kzikDtJjAjw_1_.js" has type "ASCII text with very long lines"- [targetUID: N/A] "bisOS4dl-mS_1_.js" has type "ASCII text with very long lines"- [targetUID: N/A] "M_qt8gV3koE_1_.js" has type "C source ASCII text with very long lines"- [targetUID: N/A] "LgvwffuKmeX_1_.js" has type "ASCII text with very long lines"- [targetUID: N/A] "TOgyZUwZTqd_1_.js" has type "ASCII text with very long lines"- [targetUID: N/A] "xEUODc7mbZF_1_.js" has type "ASCII text with very long lines"- [targetUID: N/A] "m_byfTOb_lsjVmc_LEikZe_1_.js" has type "ASCII text with very long lines"- [targetUID: N/A] "CheckConnection_1_.htm" has type "HTML document ASCII text with very long lines"- [targetUID: N/A] "GLMTwJKTA1g_1_.css" has type "ASCII text with very long lines"- [targetUID: N/A] "imagestore.dat" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\Internet Explorer\imagestore\3mt7jhv\imagestore.dat]- [targetUID: 00000000-00002976] "zI56j6esQGz_1_.js" has type "ASCII text with very long lines"- [targetUID: N/A] "4UabrENHsxJlGDuGo1OIlLU94YtzCwA_1_.woff" has type "Web Open Font Format TrueType length 26412 version 1.1"- [targetUID: N/A] "4UaGrENHsxJlGDuGo1OIlL3Owpg_1_.woff" has type "Web Open Font Format TrueType length 26180 version 1.1"- [targetUID: N/A] "SeW64FDUgJN_1_.js" has type "ASCII text with very long lines"- [targetUID: N/A] "BQn1Lzzcmjv_1_.js" has type "ASCII text with very long lines"- [targetUID: N/A] "fpMCwgcFvo4_1_.css" has type "ASCII text with very long lines"- [targetUID: N/A] "KFOlCnqEu92Fr1MmEU9fBBc-_1_.woff" has type "Web Open Font Format TrueType length 20544 version 1.1"- [targetUID: N/A] "~DFF6BA66DC4FC93D92.TMP" has type "data"- [targetUID: N/A] "KFOmCnqEu92Fr1Mu4mxM_1_.woff" has type "Web Open Font Format TrueType length 20344 version 1.1"- [targetUID: N/A] "KFOlCnqEu92Fr1MmEU9fBBc-_1_.woff" has type "Web Open Font Format TrueType length 20012 version 1.1"- [targetUID: N/A] "KFOkCnqEu92Fr1MmgVxIIzQ_1_.woff" has type "Web Open Font Format TrueType length 19936 version 1.1"- [targetUID: N/A] "KFOlCnqEu92Fr1MmSU5fBBc-_1_.woff" has type "Web Open Font Format TrueType length 19916 version 1.1"- [targetUID: N/A] "KFOlCnqEu92Fr1MmWUlfBBc-_1_.woff" has type "Web Open Font Format TrueType length 19888 version 1.1"- [targetUID: N/A] "m_RqjULd_1_.js" has type "ASCII text with very long lines"- [targetUID: N/A] "en-US.4" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\Internet Explorer\DomainSuggestions\en-US.4]- [targetUID: 00000000-00002656] "_tJ17sGyxOX_1_.js" has type "ASCII text with very long lines"- [targetUID: N/A] "~DF70CA51B2ECFE00FD.TMP" has type "data"- Location: [%TEMP%\~DF70CA51B2ECFE00FD.TMP]- [targetUID: 00000000-00002656] "~DFB3EE0CC3A4AE8201.TMP" has type "data"- [targetUID: N/A] "~DFE0C398AC950F5E63.TMP" has type "data"- Location: [%TEMP%\~DFE0C398AC950F5E63.TMP]- [targetUID: 00000000-00003236] "~DFE5C4A93991016F0D.TMP" has type "data"- [targetUID: N/A] "~DF22A32C332D75F8E7.TMP" has type "data"- Location: [%TEMP%\~DF22A32C332D75F8E7.TMP]- [targetUID: 00000000-00003236] "~DFF39B2BA4FE3A9E71.TMP" has type "data"- [targetUID: N/A] "~DFEC1B5641FE1840EA.TMP" has type "data"- [targetUID: N/A] "Qw3hZQNGEDjaO2m6tqIqX5E-AVS5_rSejo46_PCTRspJ0OosolrBEJL3HMXfxQASluL2m_dANVawBpSF_1_.woff" has type "Web Open Font Format TrueType length 16064 version 1.1"- [targetUID: N/A] "lFK_RCKM9IT_1_.js" has type "C source ASCII text with very long lines"- [targetUID: N/A] "_D7A54701-707C-11EE-8B2F-0800270018AF_.dat" has type "Composite Document File V2 Document Cannot read section info"- [targetUID: N/A] "C9n9XTZa3H8_1_.js" has type "ASCII text with very long lines"- [targetUID: N/A] "xqvNY4MTESs_1_.js" has type "ASCII text with very long lines"- [targetUID: N/A] "70DAE932E3BCB3C00656A27B544BA9CA" has type "data"- [targetUID: 00000000-00002976] "30BCF8D79B1225AC4F40686E58D30D95" has type "data"- [targetUID: 00000000-00003392] "rAl2Hl1fQTa_1_.js" has type "ASCII text with very long lines"- [targetUID: N/A] "m_wg1P6b_1_.js" has type "ASCII text with very long lines"- [targetUID: N/A] "739F2FF4259CDC6CBE7B90F1A95601EF" has type "data"- [targetUID: N/A] "firefox_1_.png" has type "PNG image data 128 x 128 8-bit/color RGBA non-interlaced"- [targetUID: N/A] "yt_logo_rgb_light_1_.png" has type "PNG image data 1588 x 356 8-bit colormap non-interlaced"- [targetUID: N/A] "_FB6BE37E-707C-11EE-8B2F-0800270018AF_.dat" has type "Composite Document File V2 Document Cannot read short stream"- [targetUID: N/A] "edgium_1_.png" has type "PNG image data 128 x 128 8-bit/color RGBA non-interlaced"- [targetUID: N/A] "P8DLAFRlDfy_1_.js" has type "C source ASCII text with very long lines"- [targetUID: N/A] "Y0L6f5sxdIV_1_.png" has type "PNG image data 283 x 315 8-bit colormap non-interlaced"- [targetUID: N/A] "MAz3ivwtIyN_1_.js" has type "C source ASCII text with very long lines"- [targetUID: N/A] "jIUN0Hn2kpD_1_.js" has type "ASCII text with very long lines"- [targetUID: N/A] "chrome_1_.png" has type "PNG image data 128 x 128 8-bit/color RGBA non-interlaced"- [targetUID: N/A] "supported_browsers_1_.htm" has type "HTML document UTF-8 Unicode text with very long lines with no line terminators"- [targetUID: N/A] "RecoveryStore._27D741D4-7072-11EE-8B2F-0800270018AF_.dat" has type "Composite Document File V2 Document Cannot read section info"- [targetUID: N/A] "RecoveryStore._AE2BE906-7077-11EE-8B2F-0800270018AF_.dat" has type "Composite Document File V2 Document Cannot read section info"- [targetUID: N/A] "RecoveryStore._27C42F05-7072-11EE-8B2F-0800270018AF_.dat" has type "Composite Document File V2 Document Cannot read section info"- [targetUID: N/A] "favicon_3_.ico" has type "MS Windows icon resource - 2 icons 16x16 32 bits/pixel 32x32 32 bits/pixel"- [targetUID: N/A] "57C8EDB95DF3F0AD4EE2DC2B8CFD4157" has type "Microsoft Cabinet archive data Windows 2000/XP setup 4770 bytes 1 file at 0x2c +A "disallowedcert.stl" number 1 1 datablock 0x1 compression"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\57C8EDB95DF3F0AD4EE2DC2B8CFD4157]- [targetUID: 00000000-00002656] "d4QqVJOdC1V_1_.js" has type "ASCII text with very long lines"- [targetUID: N/A] "_95894046-708C-11EE-8B2F-0800270018AF_.dat" has type "Composite Document File V2 Document Cannot read section info"- [targetUID: N/A] "_AE2BE908-7077-11EE-8B2F-0800270018AF_.dat" has type "Composite Document File V2 Document Cannot read section info"- [targetUID: N/A] "_D3A61728-70A1-11EE-8B2F-0800270018AF_.dat" has type "Composite Document File V2 Document Cannot read section info"- [targetUID: N/A] "hLRJ1GG_y0J_1_.ico" has type "MS Windows icon resource - 1 icon 32x32 32 bits/pixel"- [targetUID: N/A] "favicon_1_.ico" has type "MS Windows icon resource - 1 icon 32x32 32 bits/pixel"- [targetUID: N/A] "m_NTMZac_sOXFj_q0xTif_ZZ4WUe_1_.js" has type "HTML document ASCII text with very long lines"- [targetUID: N/A] "wYnUPpbC_DL_1_.css" has type "ASCII text with very long lines"- [targetUID: N/A] "2W2z89vRC58_1_.css" has type "ASCII text with very long lines"- [targetUID: N/A] "m_Wt6vjf_hhhU8_FCpbqb_WhJNk_1_.js" has type "ASCII text with very long lines"- [targetUID: N/A] "QJ_ErdZuyUE_1_.js" has type "ASCII text with very long lines"- [targetUID: N/A] "m_ZwDk9d_RMhBfe_1_.js" has type "ASCII text with very long lines"- [targetUID: N/A] "wm4d5zAAo-a_1_.js" has type "ASCII text with very long lines"- [targetUID: N/A] "opera_1_.png" has type "PNG image data 128 x 128 8-bit/color RGBA non-interlaced"- [targetUID: N/A] "yUtEQ4ajXZI_1_.js" has type "ASCII text with very long lines"- [targetUID: N/A] "EQ0cyse2DGv_1_.css" has type "ASCII text with very long lines"- [targetUID: N/A] "m_w9hDv_VwDzFe_A7fCU_1_.js" has type "ASCII text with very long lines"- [targetUID: N/A] "24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA]- [targetUID: 00000000-00002976] "bpW4eEg-2_W_1_.js" has type "C source ASCII text with very long lines"- [targetUID: N/A] "m_bm51tf_1_.js" has type "ASCII text with very long lines"- [targetUID: N/A] "www.facebook_1_.xml" has type "ASCII text with very long lines with no line terminators"- [targetUID: N/A] "favicon_1_.ico" has type "MS Windows icon resource - 1 icon 16x16 32 bits/pixel"- [targetUID: N/A] "4748633DC5731827D4B432DBAC7A3ECE" has type "data"- [targetUID: 00000000-00003392] "69C6F6EC64E114822DF688DC12CDD86C" has type "data"- [targetUID: 00000000-00002656] "CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA]- [targetUID: 00000000-00002976] "7O04Eyj-1fg_1_.css" has type "ASCII text with very long lines"- [targetUID: N/A] "6B2043001D270792DFFD725518EAFE2C" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\6B2043001D270792DFFD725518EAFE2C]- [targetUID: 00000000-00002656] "WGUDQ09L.txt" has type "ASCII text"- Location: [%APPDATA%\Microsoft\Windows\Cookies\WGUDQ09L.txt]- [targetUID: 00000000-00002976] "OZDB452G.txt" has type "ASCII text"- Location: [%APPDATA%\Microsoft\Windows\Cookies\OZDB452G.txt]- [targetUID: 00000000-00003236] "F2DDCD2B5F37625B82E81F4976CEE400_249A1AAD948A044308274CC39E5A79B2" has type "data"- [targetUID: N/A] "F07644E38ED7C9F37D11EEC6D4335E02_2D1FA229671185E6CE5261A2A9B06982" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\F07644E38ED7C9F37D11EEC6D4335E02_2D1FA229671185E6CE5261A2A9B06982]- [targetUID: 00000000-00002976] "265C0DEB29181DD1891051371C5F863A_3177CE6CD1B3852A6EC841765B1A16FB" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\265C0DEB29181DD1891051371C5F863A_3177CE6CD1B3852A6EC841765B1A16FB]- [targetUID: 00000000-00002976] "E87CE99F124623F95572A696C80EFCAF_802691FEFBCBFDBC6638E7243774E081" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\E87CE99F124623F95572A696C80EFCAF_802691FEFBCBFDBC6638E7243774E081]- [targetUID: 00000000-00002976] "80237EE4964FC9C409AAF55BF996A292_D46D6FA25B74360E1349F9015B5CCE53" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\80237EE4964FC9C409AAF55BF996A292_D46D6FA25B74360E1349F9015B5CCE53]- [targetUID: 00000000-00002656] "E2C6CBAF0AF08CF203BA74BF0D0AB6D5_0FB9553B978E7F00C6B2309507DEB64A" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_0FB9553B978E7F00C6B2309507DEB64A]- [targetUID: 00000000-00002656] "7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776]- [targetUID: 00000000-00002976] "EDC238BFF48A31D55A97E1E93892934B_C20E0DA2D0F89FE526E1490F4A2EE5AB" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\EDC238BFF48A31D55A97E1E93892934B_C20E0DA2D0F89FE526E1490F4A2EE5AB]- [targetUID: 00000000-00004048] "35DDEDF268117918D1D277A171D8DF7B_56087230985656D9A5EBEBE1867517A7" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\35DDEDF268117918D1D277A171D8DF7B_56087230985656D9A5EBEBE1867517A7]- [targetUID: 00000000-00004048] "O287_AcFyg4_1_.png" has type "PNG image data 20 x 20 8-bit colormap non-interlaced"- [targetUID: N/A] "LC8PJ10M.txt" has type "ASCII text"- Location: [%APPDATA%\Microsoft\Windows\Cookies\LC8PJ10M.txt]- [targetUID: 00000000-00002656] "dXk5exdOVhk_1_.js" has type "ASCII text with very long lines"- [targetUID: N/A] "E2C6CBAF0AF08CF203BA74BF0D0AB6D5_0FB9553B978E7F00C6B2309507DEB64A" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_0FB9553B978E7F00C6B2309507DEB64A]- [targetUID: 00000000-00002656] "35DDEDF268117918D1D277A171D8DF7B_56087230985656D9A5EBEBE1867517A7" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\MetaData\35DDEDF268117918D1D277A171D8DF7B_56087230985656D9A5EBEBE1867517A7]- [targetUID: 00000000-00004048] "80237EE4964FC9C409AAF55BF996A292_D46D6FA25B74360E1349F9015B5CCE53" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\MetaData\80237EE4964FC9C409AAF55BF996A292_D46D6FA25B74360E1349F9015B5CCE53]- [targetUID: 00000000-00002656] "24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA]- [targetUID: 00000000-00002976] "E87CE99F124623F95572A696C80EFCAF_802691FEFBCBFDBC6638E7243774E081" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\MetaData\E87CE99F124623F95572A696C80EFCAF_802691FEFBCBFDBC6638E7243774E081]- [targetUID: 00000000-00002976] "7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776]- [targetUID: 00000000-00002976] "EAF8AA29A62AB29E614331747385D816_F9E4DC0B9D5C777357D7DB8DEF51118A" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\MetaData\EAF8AA29A62AB29E614331747385D816_F9E4DC0B9D5C777357D7DB8DEF51118A]- [targetUID: 00000000-00002656] "F07644E38ED7C9F37D11EEC6D4335E02_2D1FA229671185E6CE5261A2A9B06982" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\MetaData\F07644E38ED7C9F37D11EEC6D4335E02_2D1FA229671185E6CE5261A2A9B06982]- [targetUID: 00000000-00002976] "265C0DEB29181DD1891051371C5F863A_3177CE6CD1B3852A6EC841765B1A16FB" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\MetaData\265C0DEB29181DD1891051371C5F863A_3177CE6CD1B3852A6EC841765B1A16FB]- [targetUID: 00000000-00002976] "EDC238BFF48A31D55A97E1E93892934B_C20E0DA2D0F89FE526E1490F4A2EE5AB" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\MetaData\EDC238BFF48A31D55A97E1E93892934B_C20E0DA2D0F89FE526E1490F4A2EE5AB]- [targetUID: 00000000-00004048] "97ZM78Q3.txt" has type "ASCII text"- Location: [%APPDATA%\Microsoft\Windows\Cookies\97ZM78Q3.txt]- [targetUID: 00000000-00004048] "CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\MetaData\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA]- [targetUID: 00000000-00002976] "U572UXIM.txt" has type "ASCII text"- Location: [%APPDATA%\Microsoft\Windows\Cookies\U572UXIM.txt]- [targetUID: 00000000-00002976] "css_3_.css" has type "ASCII text"- [targetUID: N/A] "BLAFN6G1.txt" has type "ASCII text"- Location: [%APPDATA%\Microsoft\Windows\Cookies\BLAFN6G1.txt]- [targetUID: 00000000-00002976] "57C8EDB95DF3F0AD4EE2DC2B8CFD4157" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157]- [targetUID: 00000000-00002656] "77EC63BDA74BD0D0E0426DC8F8008506" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506]- [targetUID: 00000000-00002656] "EAF8AA29A62AB29E614331747385D816_F9E4DC0B9D5C777357D7DB8DEF51118A" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\EAF8AA29A62AB29E614331747385D816_F9E4DC0B9D5C777357D7DB8DEF51118A]- [targetUID: 00000000-00002656] "css_2_.css" has type "ASCII text"- [targetUID: N/A] "J0YIYL4Z.txt" has type "ASCII text"- Location: [%APPDATA%\Microsoft\Windows\Cookies\J0YIYL4Z.txt]- [targetUID: 00000000-00004048] "LYWPJ62F.txt" has type "ASCII text"- Location: [%APPDATA%\Microsoft\Windows\Cookies\LYWPJ62F.txt]- [targetUID: 00000000-00004048] "F8537174.txt" has type "ASCII text"- Location: [%APPDATA%\Microsoft\Windows\Cookies\F8537174.txt]- [targetUID: 00000000-00004048] "D5VALYSO.txt" has type "ASCII text"- Location: [%APPDATA%\Microsoft\Windows\Cookies\D5VALYSO.txt]- [targetUID: 00000000-00002656] "2MCKUOL7.txt" has type "ASCII text"- [targetUID: N/A] "6B2043001D270792DFFD725518EAFE2C" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\MetaData\6B2043001D270792DFFD725518EAFE2C]- [targetUID: 00000000-00002656] "6DB145CFEEC544B1582FED1ADA3370DD" has type "data"- [targetUID: 00000000-00002656] "69C6F6EC64E114822DF688DC12CDD86C" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\MetaData\69C6F6EC64E114822DF688DC12CDD86C]- [targetUID: 00000000-00002656] "BEC6224B02D155A396218A2504F3EE0B" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\MetaData\BEC6224B02D155A396218A2504F3EE0B]- [targetUID: 00000000-00004048] "IRXVZ2YF.txt" has type "ASCII text"- [targetUID: N/A] "0Z9ENDTG.htm" has type "gzip compressed data original size modulo 2^32 338"- [targetUID: N/A] "1R4JFPMC.txt" has type "ASCII text"- Location: [%APPDATA%\Microsoft\Windows\Cookies\1R4JFPMC.txt]- [targetUID: 00000000-00002656] "PWQN49HS.txt" has type "ASCII text"- [targetUID: N/A] "B8P167D3.txt" has type "ASCII text"- [targetUID: N/A] "4M8GR8RM.txt" has type "ASCII text"- Location: [%APPDATA%\Microsoft\Windows\Cookies\4M8GR8RM.txt]- [targetUID: 00000000-00002656] "9TBLAYAL.txt" has type "ASCII text"- Location: [%APPDATA%\Microsoft\Windows\Cookies\9TBLAYAL.txt]- [targetUID: 00000000-00002976] "R2GJ2USK.txt" has type "ASCII text"- [targetUID: N/A] "3NYRYLL1.txt" has type "ASCII text"- Location: [%APPDATA%\Microsoft\Windows\Cookies\3NYRYLL1.txt]- [targetUID: 00000000-00002976] "451E4DL2.txt" has type "ASCII text"- [targetUID: N/A] "56ZT81QM.txt" has type "ASCII text"- Location: [%APPDATA%\Microsoft\Windows\Cookies\56ZT81QM.txt]- [targetUID: 00000000-00002976] "INSBYIO1.txt" has type "ASCII text"- Location: [%APPDATA%\Microsoft\Windows\Cookies\INSBYIO1.txt]- [targetUID: 00000000-00002976] "4ZSVHRCU.txt" has type "ASCII text"- Location: [%APPDATA%\Microsoft\Windows\Cookies\4ZSVHRCU.txt]- [targetUID: 00000000-00002976] "93D2AOC7.txt" has type "ASCII text"- Location: [%APPDATA%\Microsoft\Windows\Cookies\93D2AOC7.txt]- [targetUID: 00000000-00002656] "EKWK305F.txt" has type "ASCII text"- Location: [%APPDATA%\Microsoft\Windows\Cookies\EKWK305F.txt]- [targetUID: 00000000-00002976] "OGJYG73M.txt" has type "ASCII text"- Location: [%APPDATA%\Microsoft\Windows\Cookies\OGJYG73M.txt]- [targetUID: 00000000-00002976] "ZNKOIKRB.txt" has type "ASCII text"- Location: [%APPDATA%\Microsoft\Windows\Cookies\ZNKOIKRB.txt]- [targetUID: 00000000-00002656] "O7nelmd9XSI_1_.png" has type "PNG image data 1 x 1 1-bit colormap non-interlaced"- [targetUID: N/A] "43XU7PHC.txt" has type "ASCII text"- Location: [%APPDATA%\Microsoft\Windows\Cookies\43XU7PHC.txt]- [targetUID: 00000000-00002656] "EEOESYDF.txt" has type "ASCII text"- [targetUID: N/A] "57I46P9H.txt" has type "ASCII text"- Location: [%APPDATA%\Microsoft\Windows\Cookies\57I46P9H.txt]- [targetUID: 00000000-00003392] "J1J29W1B.txt" has type "ASCII text"- Location: [%APPDATA%\Microsoft\Windows\Cookies\J1J29W1B.txt]- [targetUID: 00000000-00002656] "hsts-pixel_1_.gif" has type "GIF image data version 89a 1 x 1"- [targetUID: N/A] "bscframe_1_.htm" has type "HTML document ASCII text with no line terminators"- [targetUID: N/A] "explothe.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\fefffe8cea\explothe.exe]- [targetUID: 00000000-00003744] "clip_1_.dll" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"- [targetUID: N/A] "Tar440C.tmp" has type "data"- [targetUID: N/A] "Cab43FB.tmp" has type "Microsoft Cabinet archive data Windows 2000/XP setup 63165 bytes 1 file at 0x2c +A "authroot.stl" number 1 6 datablocks 0x1 compression"- [targetUID: N/A] "BEC6224B02D155A396218A2504F3EE0B" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\BEC6224B02D155A396218A2504F3EE0B]- [targetUID: 00000000-00004048] "favicon_3_.ico" has type "MS Windows icon resource - 1 icon 32x32 32 bits/pixel"- [targetUID: N/A] "favicon_2_.ico" has type "MS Windows icon resource - 1 icon 32x32 32 bits/pixel"- [targetUID: N/A] "search__0633EE93-D776-472f-A0FF-E1416B8B2E3A_.ico" has type "MS Windows icon resource - 1 icon 32x32 32 bits/pixel"- [targetUID: N/A] "favicon_4_.ico" has type "MS Windows icon resource - 1 icon 32x32 32 bits/pixel"- [targetUID: N/A] "YGU1U3YN.txt" has type "ASCII text"- Location: [%APPDATA%\Microsoft\Windows\Cookies\YGU1U3YN.txt]- [targetUID: 00000000-00004048] "DFYSZGIZ.txt" has type "ASCII text"- Location: [%APPDATA%\Microsoft\Windows\Cookies\DFYSZGIZ.txt]- [targetUID: 00000000-00002656] "S0DYSIIG.txt" has type "ASCII text"- [targetUID: N/A]49:T798,"file.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: ""; Value: "") "file.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SAFEBOOT\OPTION"; Key: ""; Value: "") "file.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SRP\GP\DLL"; Key: ""; Value: "") "file.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "file.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "file.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\SIDEBYSIDE\ASSEMBLYSTORAGEROOTS"; Key: ""; Value: "") "file.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS"; Key: ""; Value: "") "file.exe" (Access type: "OPEN"; Path: "HKCU\CONTROL PANEL\DESKTOP\MUICACHED\MACHINELANGUAGECONFIGURATION"; Key: ""; Value: "") "file.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\MUI\SETTINGS"; Key: ""; Value: "") "file.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\CONTROL PANEL\DESKTOP"; Key: ""; Value: "") "file.exe" (Access type: "OPEN"; Path: "HKCU\CONTROL PANEL\DESKTOP\LANGUAGECONFIGURATION"; Key: ""; Value: "") "file.exe" (Access type: "OPEN"; Path: "HKCU\CONTROL PANEL\DESKTOP"; Key: ""; Value: "") "file.exe" (Access type: "OPEN"; Path: "HKCU\CONTROL PANEL\DESKTOP\MUICACHED"; Key: ""; Value: "") "file.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: ""; Value: "") "file.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\SIDEBYSIDE"; Key: ""; Value: "") "file.exe" (Access type: "OPEN"; Path: "HKLM"; Key: ""; Value: "") "file.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\DIAGNOSTICS"; Key: ""; Value: "")4a:T407,"file.exe" queries basic process information of the "C:\Windows\System32\advpack.dll" (UID: 928) "file.exe" queries basic process information of the "C:\Users\HAPUBWS\AppData\Local\Temp" (UID: 928) "xX1Zl63.exe" queries basic process information of the "C:\Windows\System32\advpack.dll" (UID: 2736) "xX1Zl63.exe" queries basic process information of the "C:\Users\HAPUBWS\AppData\Local\Temp" (UID: 2736) "VW6ig05.exe" queries basic process information of the "C:\Users\HAPUBWS\AppData\Local\Temp" (UID: 3088) "VW6ig05.exe" queries basic process information of the "C:\Windows\System32\advpack.dll" (UID: 3088) "Dk2ox03.exe" queries basic process information of the "C:\Windows\System32\advpack.dll" (UID: 3452) "Dk2ox03.exe" queries basic process information of the "C:\Users\HAPUBWS\AppData\Local\Temp" (UID: 3452) "explothe.exe" queries basic process information of the "\FileSystem\Filters\FltMgrMsg" (UID: 1460) "6Um8bf3.exe" queries basic process information of the "C:\Windows\System32\cmd.exe" (UID: 1884)4b:Tb8e,"file.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "CWDILLEGALINDLLSEARCH"; Value: "") "file.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED"; Value: "") "file.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS"; Key: "SHOWDEBUGINFO"; Value: "") "file.exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP"; Key: "PREFERREDUILANGUAGES"; Value: "") "file.exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP\MUICACHED"; Key: "MACHINEPREFERREDUILANGUAGES"; Value: "") "file.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: "COMPATDLL"; Value: "") "file.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: "00060101.00060101"; Value: "") "file.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: ""; Value: "") "file.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\SIDEBYSIDE"; Key: "PREFEREXTERNALMANIFEST"; Value: "") "file.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "SAFEDLLSEARCHMODE"; Value: "") "file.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\GRE_INITIALIZE"; Key: "DISABLEMETAFILES"; Value: "") "file.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\COMPATIBILITY32"; Key: "FILE"; Value: "") "file.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINDOWS"; Key: "LOADAPPINIT_DLLS"; Value: "") "file.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE"; Key: "PAGEALLOCATORUSESYSTEMHEAP"; Value: "") "file.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE"; Key: "PAGEALLOCATORSYSTEMHEAPISPRIVATE"; Value: "") "file.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\WINDOWS ERROR REPORTING\WMR"; Key: "DISABLE"; Value: "") "file.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\SETUP"; Key: "SOURCEPATH"; Value: "") "file.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION"; Key: "DEVICEPATH"; Value: "") "file.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US"; Value: "") "file.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US"; Value: "") "file.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\DATACOLLECTION"; Key: "COMMERCIALDATAOPTIN"; Value: "") "file.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "PENDINGFILERENAMEOPERATIONS"; Value: "")4c:T4f5,"file.exe" reads file "c:\users\%osuser%\appdata\local\temp\ixp000.tmp\xx1zl63.exe" "file.exe" reads file "c:\users\%osuser%\appdata\local\temp\ixp000.tmp\6um8bf3.exe" "xX1Zl63.exe" reads file "c:\users\%osuser%\appdata\local\temp\ixp001.tmp\vw6ig05.exe" "xX1Zl63.exe" reads file "c:\users\%osuser%\appdata\local\temp\ixp001.tmp\5ol2yf2.exe" "VW6ig05.exe" reads file "c:\users\%osuser%\appdata\local\temp\ixp002.tmp\dk2ox03.exe" "VW6ig05.exe" reads file "c:\users\%osuser%\appdata\local\temp\ixp002.tmp\4ar077qh.exe" "Dk2ox03.exe" reads file "c:\users\%osuser%\appdata\local\temp\ixp003.tmp\qj9aa78.exe" "Dk2ox03.exe" reads file "c:\users\%osuser%\appdata\local\temp\ixp003.tmp\3fs87vt.exe" "qj9aa78.exe" reads file "c:\windows\fonts\staticcache.dat" "3Fs87VT.exe" reads file "c:\windows\microsoft.net\framework\v4.0.30319\applaunch.exe" "4AR077QH.exe" reads file "c:\windows\microsoft.net\framework\v4.0.30319\applaunch.exe" "AppLaunch.exe" reads file "c:\windows\microsoft.net\framework\v4.0.30319\applaunch.exe.config" "AppLaunch.exe" reads file "c:\windows\microsoft.net\framework\v4.0.30319\config\machine.config" "AppLaunch.exe" reads file "c:\windows\assembly\nativeimages_v4.0.30319_32\mscorlib\36eaccfde177c2e7b93b8dbdde4e012a\mscorlib.ni.dll.aux"4d:T67d,"file.exe" trying to touch file "C:\file.exe.Local\" "file.exe" trying to touch file "C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18837_none_41e855142bd5705d" "file.exe" trying to touch file "C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18837_none_41e855142bd5705d\COMCTL32.dll" "file.exe" trying to touch file "C:\Cabinet.dll" "file.exe" trying to touch file "C:\Windows\system32\Cabinet.dll" "file.exe" trying to touch file "C:\VERSION.dll" "file.exe" trying to touch file "C:\Windows\system32\VERSION.dll" "file.exe" trying to touch file "C:\Windows\system32\apphelp.dll" "file.exe" trying to touch file "C:\Windows\AppPatch\sysmain.sdb" "file.exe" trying to touch file "C:\Windows\AppPatch\AcLayers.DLL" "file.exe" trying to touch file "C:\SspiCli.dll" "file.exe" trying to touch file "C:\Windows\system32\SspiCli.dll" "file.exe" trying to touch file "C:\Windows\system32\WINSPOOL.DRV" "file.exe" trying to touch file "C:\MPR.dll" "file.exe" trying to touch file "C:\Windows\system32\MPR.dll" "file.exe" trying to touch file "C:\Windows\AppPatch\AcGenral.DLL" "file.exe" trying to touch file "C:\UxTheme.dll" "file.exe" trying to touch file "C:\Windows\system32\UxTheme.dll" "file.exe" trying to touch file "C:\WINMM.dll" "file.exe" trying to touch file "C:\Windows\system32\WINMM.dll" "file.exe" trying to touch file "C:\samcli.dll" "file.exe" trying to touch file "C:\Windows\system32\samcli.dll" "file.exe" trying to touch file "C:\MSACM32.dll" "file.exe" trying to touch file "C:\Windows\system32\MSACM32.dll" "file.exe" trying to touch file "C:\sfc.dll"4e:T643,"file.exe" trying to access non-existent file "C:\Cabinet.dll" "file.exe" trying to access non-existent file "C:\VERSION.dll" "file.exe" trying to access non-existent file "C:\SspiCli.dll" "file.exe" trying to access non-existent file "C:\MPR.dll" "file.exe" trying to access non-existent file "C:\UxTheme.dll" "file.exe" trying to access non-existent file "C:\WINMM.dll" "file.exe" trying to access non-existent file "C:\samcli.dll" "file.exe" trying to access non-existent file "C:\MSACM32.dll" "file.exe" trying to access non-existent file "C:\sfc.dll" "file.exe" trying to access non-existent file "C:\sfc_os.DLL" "file.exe" trying to access non-existent file "C:\dwmapi.dll" "file.exe" trying to access non-existent file "C:\FLTLIB.DLL" "file.exe" trying to access non-existent file "C:\Windows\system32\api-ms-win-core-fibers-l1-1-1.DLL" "file.exe" trying to access non-existent file "C:\Windows\system32\api-ms-win-core-localization-l1-2-1.DLL" "file.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP\xX1Zl63.exe" "file.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP\6Um8bf3.exe" "file.exe" trying to access non-existent file "\Device\HarddiskVolume2\CABINET.DLL" "file.exe" trying to access non-existent file "\Device\HarddiskVolume2\VERSION.DLL" "file.exe" trying to access non-existent file "\Device\HarddiskVolume2\SSPICLI.DLL" "file.exe" trying to access non-existent file "\Device\HarddiskVolume2\MPR.DLL" "file.exe" trying to access non-existent file "\Device\HarddiskVolume2\UXTHEME.DLL"4f:T84e,"file.exe" trying to access non-existent file "C:\file.exe.Local\" "file.exe" trying to access non-existent file "C:\Windows\system32\WINSPOOL.DRV" "file.exe" trying to access non-existent file "C:\file.exe.Config" "file.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP" "file.exe" trying to access non-existent file "\Device\HarddiskVolume2\FILE.EXE.LOCAL" "file.exe" trying to access non-existent file "C:\Windows\System32\winspool.drv" "file.exe" trying to access non-existent file "\Device\HarddiskVolume2\FILE.EXE.CONFIG" "file.exe" trying to access non-existent file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP" "xX1Zl63.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP001.TMP" "xX1Zl63.exe" trying to access non-existent file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP\XX1ZL63.EXE.LOCAL" "xX1Zl63.exe" trying to access non-existent file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP\WINSPOOL.DRV" "xX1Zl63.exe" trying to access non-existent file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP\XX1ZL63.EXE.CONFIG" "xX1Zl63.exe" trying to access non-existent file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\IXP001.TMP" "xX1Zl63.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP\xX1Zl63.exe.Local\" "xX1Zl63.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP\WINSPOOL.DRV" "xX1Zl63.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP\xX1Zl63.exe.Config" "VW6ig05.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP001.TMP\VW6ig05.exe.Local\" "VW6ig05.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP001.TMP\WINSPOOL.DRV" "VW6ig05.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP001.TMP\VW6ig05.exe.Config" "VW6ig05.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP002.TMP"50:T4e8d,Found requests in header "GET / HTTP/1.1Accept: text/html, application/xhtml+xml, */*Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: www.youtube.comDNT: 1Connection: Keep-AliveCookie: CONSENT=WP.2676ba"; in File: "SSL") Found requests in header "GET /supported_browsers?next_url=https%3A%2F%2Fwww.youtube.com%2F HTTP/1.1Accept: text/html, application/xhtml+xml, */*Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: www.youtube.comCookie: CONSENT=WP.2676baConnection: Keep-AliveDNT: 1"; in File: "SSL") Found requests in header "GET /img/desktop/supported_browsers/dinosaur.png HTTP/1.1Accept: image/png, image/svg+xml, image/*;q=0.8, */*;q=0.5Referer: https://www.youtube.com/supported_browsers?next_url=https%3A%2F%2Fwww.youtube.com%2FAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: www.youtube.comDNT: 1Connection: Keep-AliveCookie: CONSENT=WP.2676ba; hideBrowserUpgradeBox=true; YSC=INgtjk5iJ8M; VISITOR_INFO1_LIVE=qhnsPw9jWJQ; VISITOR_PRIVACY_METADATA=CgJVUxICGgA%3D"; in File: "SSL") Found requests in header "GET /img/desktop/supported_browsers/edgium.png HTTP/1.1Accept: image/png, image/svg+xml, image/*;q=0.8, */*;q=0.5Referer: https://www.youtube.com/supported_browsers?next_url=https%3A%2F%2Fwww.youtube.com%2FAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: www.youtube.comDNT: 1Connection: Keep-AliveCookie: CONSENT=WP.2676ba; hideBrowserUpgradeBox=true; YSC=INgtjk5iJ8M; VISITOR_INFO1_LIVE=qhnsPw9jWJQ; VISITOR_PRIVACY_METADATA=CgJVUxICGgA%3D"; in File: "SSL") Found requests in header "GET /favicon.ico HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoHost: www.youtube.comDNT: 1Connection: Keep-AliveCookie: CONSENT=WP.2676ba; hideBrowserUpgradeBox=true; YSC=INgtjk5iJ8M; VISITOR_INFO1_LIVE=qhnsPw9jWJQ; VISITOR_PRIVACY_METADATA=CgJVUxICGgA%3D"; in File: "SSL") Found requests in header "GET /login HTTP/1.1Accept: text/html, application/xhtml+xml, */*User-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateDNT: 1Host: www.facebook.comConnection: Keep-AliveAccept-Language: en-US"; in File: "SSL") Found requests in header "GET / HTTP/1.1Accept: text/html, application/xhtml+xml, */*User-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateDNT: 1Host: accounts.google.comConnection: Keep-AliveAccept-Language: en-US"; in File: "SSL") Found requests in header "GET /ServiceLogin?passive=1209600&continue=https%3A%2F%2Faccounts.google.com%2F&followup=https%3A%2F%2Faccounts.google.com%2F HTTP/1.1Accept: text/html, application/xhtml+xml, */*User-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateDNT: 1Host: accounts.google.comCookie: __Host-GAPS=1:WgnYHc4t1-kBzxdedi2_3RqNb8Yfvg:pqJMcqs_aOH9a68IConnection: Keep-AliveAccept-Language: en-US"; in File: "SSL") Found requests in header "GET /v3/signin/identifier?continue=https%3A%2F%2Faccounts.google.com%2F&followup=https%3A%2F%2Faccounts.google.com%2F&ifkv=AVQVeyxIlPfH-a1urYLCbJJ1OCyOYTIFSSjOrcte9PX-CVueRGRCbIRA2TFNdBycqvuWa_qfcRvQ&passive=1209600&flowName=GlifWebSignIn&flowEntry=ServiceLogin&dsh=S2114035212%3A1697938657160250&theme=glif HTTP/1.1Accept: text/html, application/xhtml+xml, */*User-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateDNT: 1Host: accounts.google.comCookie: __Host-GAPS=1:9bwmK8B02c_jaG5oYa_wjwqvVqmUOg:51M6UrEj4uizfWNjConnection: Keep-AliveAccept-Language: en-US"; in File: "SSL") Found requests in header "GET /favicon.ico HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoHost: accounts.google.comDNT: 1Connection: Keep-AliveCookie: __Host-GAPS=1:9bwmK8B02c_jaG5oYa_wjwqvVqmUOg:51M6UrEj4uizfWNj"; in File: "SSL") Found requests in header "GET /_/bscframe HTTP/1.1Accept: text/html, application/xhtml+xml, */*Referer: https://accounts.google.com/Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: accounts.google.comDNT: 1Connection: Keep-AliveCookie: __Host-GAPS=1:9bwmK8B02c_jaG5oYa_wjwqvVqmUOg:51M6UrEj4uizfWNj"; in File: "SSL") Found requests in header "GET /restart?continue=https%3A%2F%2Faccounts.google.com%2F&dsh=S2114035212%3A1697938657160250&flowEntry=ServiceLogin&flowName=GlifWebSignIn&followup=https%3A%2F%2Faccounts.google.com%2F&ifkv=AVQVeyxIlPfH-a1urYLCbJJ1OCyOYTIFSSjOrcte9PX-CVueRGRCbIRA2TFNdBycqvuWa_qfcRvQ&theme=glif HTTP/1.1Accept: text/html, application/xhtml+xml, */*Referer: https://accounts.google.com/Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: accounts.google.comDNT: 1Connection: Keep-AliveCookie: __Host-GAPS=1:BD7x_KiZ27WIk13h9iVJ5Os5iiX7Cw:hwHI3ks23tAnKPI7; NID=511=e071U9Yqudf5fiBYhUnAzpcbouIgqMhNIdIM2iNCKht6LCnwUckNFeadIFpdEYBn5SoXKHK62gIxgmSMi8DoEQj4GRK_GFaNzNsx-1QaxENO0ASlc7JuhRyzGqR-vG8-ecyemNDer-ByCMNG3g5BPOHGqA68LkWvUe73HXUjZOU"; in File: "SSL") Found requests in header "GET /ServiceLogin?continue=https%3A%2F%2Faccounts.google.com%2F&flowEntry=ServiceLogin&flowName=GlifWebSignIn&followup=https%3A%2F%2Faccounts.google.com%2F&ifkv=AVQVeyxIlPfH-a1urYLCbJJ1OCyOYTIFSSjOrcte9PX-CVueRGRCbIRA2TFNdBycqvuWa_qfcRvQ&theme=glif HTTP/1.1Accept: text/html, application/xhtml+xml, */*Referer: https://accounts.google.com/Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: accounts.google.comCookie: __Host-GAPS=1:XT7PcOiByXBKncPJC4HdbAGKhbW1Rw:A_QKv67y8V7GsOi0; NID=511=e071U9Yqudf5fiBYhUnAzpcbouIgqMhNIdIM2iNCKht6LCnwUckNFeadIFpdEYBn5SoXKHK62gIxgmSMi8DoEQj4GRK_GFaNzNsx-1QaxENO0ASlc7JuhRyzGqR-vG8-ecyemNDer-ByCMNG3g5BPOHGqA68LkWvUe73HXUjZOUConnection: Keep-AliveDNT: 1"; in File: "SSL") Found requests in header "GET /InteractiveLogin?continue=https://accounts.google.com/&flowEntry=ServiceLogin&flowName=GlifWebSignIn&followup=https://accounts.google.com/&ifkv=AVQVeyxIlPfH-a1urYLCbJJ1OCyOYTIFSSjOrcte9PX-CVueRGRCbIRA2TFNdBycqvuWa_qfcRvQ&theme=glif HTTP/1.1Accept: text/html, application/xhtml+xml, */*Referer: https://accounts.google.com/Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: accounts.google.comConnection: Keep-AliveDNT: 1Cookie: __Host-GAPS=1:XT7PcOiByXBKncPJC4HdbAGKhbW1Rw:A_QKv67y8V7GsOi0; NID=511=e071U9Yqudf5fiBYhUnAzpcbouIgqMhNIdIM2iNCKht6LCnwUckNFeadIFpdEYBn5SoXKHK62gIxgmSMi8DoEQj4GRK_GFaNzNsx-1QaxENO0ASlc7JuhRyzGqR-vG8-ecyemNDer-ByCMNG3g5BPOHGqA68LkWvUe73HXUjZOU"; in File: "SSL") Found requests in header "GET /v3/signin/identifier?continue=https%3A%2F%2Faccounts.google.com%2F&flowEntry=ServiceLogin&flowName=GlifWebSignIn&followup=https%3A%2F%2Faccounts.google.com%2F&ifkv=AVQVeyx8hHtv4AYLh0wYoEC13ATSq-CGPTmRXTlMtixKFhSjmob6f2BjwNAefj0BRzQSqwQeFQdcww&theme=glif&dsh=S2097582914%3A1697938736438973 HTTP/1.1Accept: text/html, application/xhtml+xml, */*Referer: https://accounts.google.com/Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: accounts.google.comDNT: 1Connection: Keep-AliveCookie: __Host-GAPS=1:XT7PcOiByXBKncPJC4HdbAGKhbW1Rw:A_QKv67y8V7GsOi0; NID=511=e071U9Yqudf5fiBYhUnAzpcbouIgqMhNIdIM2iNCKht6LCnwUckNFeadIFpdEYBn5SoXKHK62gIxgmSMi8DoEQj4GRK_GFaNzNsx-1QaxENO0ASlc7JuhRyzGqR-vG8-ecyemNDer-ByCMNG3g5BPOHGqA68LkWvUe73HXUjZOU"; in File: "SSL") Found requests in header "GET /favicon.ico HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoHost: accounts.google.comDNT: 1Connection: Keep-AliveCookie: __Host-GAPS=1:XT7PcOiByXBKncPJC4HdbAGKhbW1Rw:A_QKv67y8V7GsOi0; NID=511=e071U9Yqudf5fiBYhUnAzpcbouIgqMhNIdIM2iNCKht6LCnwUckNFeadIFpdEYBn5SoXKHK62gIxgmSMi8DoEQj4GRK_GFaNzNsx-1QaxENO0ASlc7JuhRyzGqR-vG8-ecyemNDer-ByCMNG3g5BPOHGqA68LkWvUe73HXUjZOU"; in File: "SSL") Found requests in header "POST /v3/signin/_/AccountsSignInUi/data/batchexecute?rpcids=UEkKwb&source-path=%2Fv3%2Fsignin%2Fidentifier&f.sid=9210110154298667206&bl=boq_identityfrontendauthuiserver_20231015.08_p1&hl=en-US&_reqid=62442&rt=c HTTP/1.1Accept: */*X-Same-Domain: 1x-goog-ext-278367001-jspb: ["GlifWebSignIn"]x-goog-ext-391502476-jspb: ["S2097582914:1697938736438973",null,null,"AVQVeyx8hHtv4AYLh0wYoEC13ATSq-CGPTmRXTlMtixKFhSjmob6f2BjwNAefj0BRzQSqwQeFQdcww"]Content-Type: application/x-www-form-urlencoded;charset=utf-8Referer: https://accounts.google.com/Accept-Language: en-USAccept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoHost: accounts.google.comContent-Length: 165DNT: 1Connection: Keep-AliveCache-Control: no-cacheCookie: __Host-GAPS=1:XT7PcOiByXBKncPJC4HdbAGKhbW1Rw:A_QKv67y8V7GsOi0; NID=511=e071U9Yqudf5fiBYhUnAzpcbouIgqMhNIdIM2iNCKht6LCnwUckNFeadIFpdEYBn5SoXKHK62gIxgmSMi8DoEQj4GRK_GFaNzNsx-1QaxENO0ASlc7JuhRyzGqR-vG8-ecyemNDer-ByCMNG3g5BPOHGqA68LkWvUe73HXUjZOU"; in File: "SSL") Found requests in header "GET /_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en_US.C6tNd3FBrA8.es5.O/am=DmBFJI4NgOD_oonn7xknhwEAAAAAAAAAANZAdg/d=1/excm=_b,_tp,identifierview/ed=1/dg=0/wt=2/ujg=1/rs=AOaEmlHlvGH0uOdIItMZ5p_iAU8jYD9fsA/m=_b,_tp HTTP/1.1Accept: application/javascript, */*;q=0.8Referer: https://accounts.google.com/Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: www.gstatic.comDNT: 1Connection: Keep-Alive"; in File: "SSL") Found requests in header "GET /_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en_US.C6tNd3FBrA8.es5.O/ck=boq-identity.AccountsSignInUi.QUjh89dKB-E.L.I11.O/am=DmBFJI4NgOD_oonn7xknhwEAAAAAAAAAANZAdg/d=1/exm=_b,_tp/excm=_b,_tp,identifierview/ed=1/wt=2/ujg=1/rs=AOaEmlGnxNV2pEseDP5Hh_iXCnMiha4f2g/ee=ASJRFf:LANRae;Al0B8:kibjWe;DaIJ8c:iAskyc;EVNhjf:pw70Gc;EkYFhd:BDnJmb;EmZ2Bf:zr1jrb;Erl4fe:FloWmf;JsbNhc:Xd8iUd;LBgRLc:XVMNvd;Me32dd:MEeYgc;NPKaK:PVlQOd;NSEoX:lazG7b;Oj465e:KG2eXe;Pjplud:EEDORb;QGR0gd:Mlhmy;SMDL4c:K0PMbc;SNUn3:ZwDk9d;UpnZUd:nnwwYc;XdiAjb:NLiXbe;a56pNe:JEfCwb;cEt90b:ws9Tlc;dIoSBb:SpsfSb;eBAeSb:zbML3c;iFQyKf:vfuNJf;io8t5d:yDVVkb;kMFpHd:OTA3Ae;nAFL3:NTMZac;nTuGK:JKNPM;oGtAuc:sOXFj;oSUNyd:K0PMbc;oXZmbc:tUnxGc;pXdRYb:fqEYIb;qddgKe:xQtZb;sP4Vbe:VwDzFe;uY49fb:COQbmf;ul9GGd:VDovNc;vNjB7d:YTxL4;wR5FRb:siKnQd;yxTchf:KUM7Z/m=byfTOb,lsjVmc,LEikZe HTTP/1.1Accept: application/javascript, */*;q=0.8Referer: https://accounts.google.com/Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: www.gstatic.comDNT: 1Connection: Keep-Alive"; in File: "SSL") Found requests in header "GET /_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en_US.C6tNd3FBrA8.es5.O/ck=boq-identity.AccountsSignInUi.QUjh89dKB-E.L.I11.O/am=DmBFJI4NgOD_oonn7xknhwEAAAAAAAAAANZAdg/d=1/exm=LEikZe,_b,_tp,byfTOb,lsjVmc/excm=_b,_tp,identifierview/ed=1/wt=2/ujg=1/rs=AOaEmlGnxNV2pEseDP5Hh_iXCnMiha4f2g/ee=ASJRFf:LANRae;Al0B8:kibjWe;DaIJ8c:iAskyc;EVNhjf:pw70Gc;EkYFhd:BDnJmb;EmZ2Bf:zr1jrb;Erl4fe:FloWmf;JsbNhc:Xd8iUd;LBgRLc:XVMNvd;Me32dd:MEeYgc;NPKaK:PVlQOd;NSEoX:lazG7b;Oj465e:KG2eXe;Pjplud:EEDORb;QGR0gd:Mlhmy;SMDL4c:K0PMbc;SNUn3:ZwDk9d;UpnZUd:nnwwYc;XdiAjb:NLiXbe;a56pNe:JEfCwb;cEt90b:ws9Tlc;dIoSBb:SpsfSb;eBAeSb:zbML3c;iFQyKf:vfuNJf;io8t5d:yDVVkb;kMFpHd:OTA3Ae;nAFL3:NTMZac;nTuGK:JKNPM;oGtAuc:sOXFj;oSUNyd:K0PMbc;oXZmbc:tUnxGc;pXdRYb:fqEYIb;qddgKe:xQtZb;sP4Vbe:VwDzFe;uY49fb:COQbmf;ul9GGd:VDovNc;vNjB7d:YTxL4;wR5FRb:siKnQd;yxTchf:KUM7Z/m=n73qwf,SCuOPb,IZT63,vfuNJf,UUJqVe,ws9Tlc,siKnQd,STuCOe,njlZCf,fJpY1b,b3kMqb,EGw7Od,ZUKRxc,my67ye,t2srLd,EN3i8d,hmHrle,mWLH9d,NOeYWe,O6y8ed,fqEYIb,PrPYRd,MpJwZc,hc6Ubd,KUM7Z,oLggrd,inNHtf,L1AAkb,lwddkf,SpsfSb,tUnxGc,aW3pY,EFQ78c,xQtZb,I6YDgd,zbML3c,zr1jrb,vHEMJe,YHI3We,YTxL4,bSspM,Uas9Hd,zy0vNb,K0PMbc,AvtSve,qmdT9,xBaz7b,eVCnO,LDQI HTTP/1.1Accept: application/javascript, */*;q=0.8Referer: https://accounts.google.com/Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: www.gstatic.comDNT: 1Connection: Keep-Alive"; in File: "SSL") Found requests in header "GET /_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en_US.C6tNd3FBrA8.es5.O/ck=boq-identity.AccountsSignInUi.QUjh89dKB-E.L.I11.O/am=DmBFJI4NgOD_oonn7xknhwEAAAAAAAAAANZAdg/d=1/exm=AvtSve,EFQ78c,EGw7Od,EN3i8d,I6YDgd,IZT63,K0PMbc,KUM7Z,L1AAkb,LDQI,LEikZe,MpJwZc,NOeYWe,O6y8ed,PrPYRd,SCuOPb,STuCOe,SpsfSb,UUJqVe,Uas9Hd,YHI3We,YTxL4,ZUKRxc,_b,_tp,aW3pY,b3kMqb,bSspM,byfTOb,eVCnO,fJpY1b,fqEYIb,hc6Ubd,hmHrle,inNHtf,lsjVmc,lwddkf,mWLH9d,my67ye,n73qwf,njlZCf,oLggrd,qmdT9,siKnQd,t2srLd,tUnxGc,vHEMJe,vfuNJf,ws9Tlc,xBaz7b,xQtZb,zbML3c,zr1jrb,zy0vNb/excm=_b,_tp,identifierview/ed=1/wt=2/ujg=1/rs=AOaEmlGnxNV2pEseDP5Hh_iXCnMiha4f2g/ee=ASJRFf:LANRae;Al0B8:kibjWe;DaIJ8c:iAskyc;EVNhjf:pw70Gc;EkYFhd:BDnJmb;EmZ2Bf:zr1jrb;Erl4fe:FloWmf;JsbNhc:Xd8iUd;LBgRLc:XVMNvd;Me32dd:MEeYgc;NPKaK:PVlQOd;NSEoX:lazG7b;Oj465e:KG2eXe;Pjplud:EEDORb;QGR0gd:Mlhmy;SMDL4c:K0PMbc;SNUn3:ZwDk9d;UpnZUd:nnwwYc;XdiAjb:NLiXbe;a56pNe:JEfCwb;cEt90b:ws9Tlc;dIoSBb:SpsfSb;eBAeSb:zbML3c;iFQyKf:vfuNJf;io8t5d:yDVVkb;kMFpHd:OTA3Ae;nAFL3:NTMZac;nTuGK:JKNPM;oGtAuc:sOXFj;oSUNyd:K0PMbc;oXZmbc:tUnxGc;pXdRYb:fqEYIb;qddgKe:xQtZb;sP4Vbe:VwDzFe;uY49fb:COQbmf;ul9GGd:VDovNc;vNjB7d:YTxL4;wR5FRb:siKnQd;yxTchf:KUM7Z/m=RqjULd HTTP/1.1Accept: application/javascript, */*;q=0.8Referer: https://accounts.google.com/Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: www.gstatic.comDNT: 1Connection: Keep-Alive"; in File: "SSL") Found requests in header "GET /_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en_US.C6tNd3FBrA8.es5.O/ck=boq-identity.AccountsSignInUi.QUjh89dKB-E.L.I11.O/am=DmBFJI4NgOD_oonn7xknhwEAAAAAAAAAANZAdg/d=1/exm=AvtSve,EFQ78c,EGw7Od,EN3i8d,I6YDgd,IZT63,K0PMbc,KUM7Z,L1AAkb,LDQI,LEikZe,MpJwZc,NOeYWe,O6y8ed,PrPYRd,RqjULd,SCuOPb,STuCOe,SpsfSb,UUJqVe,Uas9Hd,YHI3We,YTxL4,ZUKRxc,_b,_tp,aW3pY,b3kMqb,bSspM,byfTOb,eVCnO,fJpY1b,fqEYIb,hc6Ubd,hmHrle,inNHtf,lsjVmc,lwddkf,mWLH9d,my67ye,n73qwf,njlZCf,oLggrd,qmdT9,siKnQd,t2srLd,tUnxGc,vHEMJe,vfuNJf,ws9Tlc,xBaz7b,xQtZb,zbML3c,zr1jrb,zy0vNb/excm=_b,_tp,identifierview/ed=1/wt=2/ujg=1/rs=AOaEmlGnxNV2pEseDP5Hh_iXCnMiha4f2g/ee=ASJRFf:LANRae;Al0B8:kibjWe;DaIJ8c:iAskyc;EVNhjf:pw70Gc;EkYFhd:BDnJmb;EmZ2Bf:zr1jrb;Erl4fe:FloWmf;JsbNhc:Xd8iUd;LBgRLc:XVMNvd;Me32dd:MEeYgc;NPKaK:PVlQOd;NSEoX:lazG7b;Oj465e:KG2eXe;Pjplud:EEDORb;QGR0gd:Mlhmy;SMDL4c:K0PMbc;SNUn3:ZwDk9d;UpnZUd:nnwwYc;XdiAjb:NLiXbe;a56pNe:JEfCwb;cEt90b:ws9Tlc;dIoSBb:SpsfSb;eBAeSb:zbML3c;iFQyKf:vfuNJf;io8t5d:yDVVkb;kMFpHd:OTA3Ae;nAFL3:NTMZac;nTuGK:JKNPM;oGtAuc:sOXFj;oSUNyd:K0PMbc;oXZmbc:tUnxGc;pXdRYb:fqEYIb;qddgKe:xQtZb;sP4Vbe:VwDzFe;uY49fb:COQbmf;ul9GGd:VDovNc;vNjB7d:YTxL4;wR5FRb:siKnQd;yxTchf:KUM7Z/m=ltDFwf HTTP/1.1Accept: application/javascript, */*;q=0.8Referer: https://accounts.google.com/Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: www.gstatic.comDNT: 1Connection: Keep-Alive"; in File: "SSL") Found requests in header "GET /_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en_US.C6tNd3FBrA8.es5.O/ck=boq-identity.AccountsSignInUi.QUjh89dKB-E.L.I11.O/am=DmBFJI4NgOD_oonn7xknhwEAAAAAAAAAANZAdg/d=1/exm=AvtSve,EFQ78c,EGw7Od,EN3i8d,I6YDgd,IZT63,K0PMbc,KUM7Z,L1AAkb,LDQI,LEikZe,MpJwZc,NOeYWe,O6y8ed,PrPYRd,RMhBfe,RqjULd,SCuOPb,STuCOe,SpsfSb,UUJqVe,Uas9Hd,YHI3We,YTxL4,ZUKRxc,ZwDk9d,_b,_tp,aW3pY,b3kMqb,bSspM,bm51tf,byfTOb,eVCnO,fJpY1b,fqEYIb,hc6Ubd,hmHrle,inNHtf,lsjVmc,ltDFwf,lwddkf,mWLH9d,my67ye,n73qwf,njlZCf,oLggrd,qmdT9,siKnQd,t2srLd,tUnxGc,vHEMJe,vfuNJf,ws9Tlc,xBaz7b,xQtZb,zbML3c,zr1jrb,zy0vNb/excm=_b,_tp,identifierview/ed=1/wt=2/ujg=1/rs=AOaEmlGnxNV2pEseDP5Hh_iXCnMiha4f2g/ee=ASJRFf:LANRae;Al0B8:kibjWe;DaIJ8c:iAskyc;EVNhjf:pw70Gc;EkYFhd:BDnJmb;EmZ2Bf:zr1jrb;Erl4fe:FloWmf;JsbNhc:Xd8iUd;LBgRLc:XVMNvd;Me32dd:MEeYgc;NPKaK:PVlQOd;NSEoX:lazG7b;Oj465e:KG2eXe;Pjplud:EEDORb;QGR0gd:Mlhmy;SMDL4c:K0PMbc;SNUn3:ZwDk9d;UpnZUd:nnwwYc;XdiAjb:NLiXbe;a56pNe:JEfCwb;cEt90b:ws9Tlc;dIoSBb:SpsfSb;eBAeSb:zbML3c;iFQyKf:vfuNJf;io8t5d:yDVVkb;kMFpHd:OTA3Ae;nAFL3:NTMZac;nTuGK:JKNPM;oGtAuc:sOXFj;oSUNyd:K0PMbc;oXZmbc:tUnxGc;pXdRYb:fqEYIb;qddgKe:xQtZb;sP4Vbe:VwDzFe;uY49fb:COQbmf;ul9GGd:VDovNc;vNjB7d:YTxL4;wR5FRb:siKnQd;yxTchf:KUM7Z/m=qPfo0c HTTP/1.1Accept: application/javascript, */*;q=0.8Referer: https://accounts.google.com/Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: www.gstatic.comDNT: 1Connection: Keep-Alive"; in File: "SSL") Found requests in header "GET /_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en_US.C6tNd3FBrA8.es5.O/ck=boq-identity.AccountsSignInUi.QUjh89dKB-E.L.I11.O/am=DmBFJI4NgOD_oonn7xknhwEAAAAAAAAAANZAdg/d=1/exm=AvtSve,EFQ78c,EGw7Od,EN3i8d,I6YDgd,IZT63,K0PMbc,KUM7Z,L1AAkb,LDQI,LEikZe,MpJwZc,NOeYWe,O6y8ed,PrPYRd,RMhBfe,RqjULd,SCuOPb,STuCOe,SpsfSb,UUJqVe,Uas9Hd,YHI3We,YTxL4,ZUKRxc,ZwDk9d,_b,_tp,aW3pY,b3kMqb,bSspM,byfTOb,eVCnO,fJpY1b,fqEYIb,hc6Ubd,hmHrle,inNHtf,lsjVmc,ltDFwf,lwddkf,mWLH9d,my67ye,n73qwf,njlZCf,oLggrd,qmdT9,siKnQd,t2srLd,tUnxGc,vHEMJe,vfuNJf,ws9Tlc,xBaz7b,xQtZb,zbML3c,zr1jrb,zy0vNb/excm=_b,_tp,identifierview/ed=1/wt=2/ujg=1/rs=AOaEmlGnxNV2pEseDP5Hh_iXCnMiha4f2g/ee=ASJRFf:LANRae;Al0B8:kibjWe;DaIJ8c:iAskyc;EVNhjf:pw70Gc;EkYFhd:BDnJmb;EmZ2Bf:zr1jrb;Erl4fe:FloWmf;JsbNhc:Xd8iUd;LBgRLc:XVMNvd;Me32dd:MEeYgc;NPKaK:PVlQOd;NSEoX:lazG7b;Oj465e:KG2eXe;Pjplud:EEDORb;QGR0gd:Mlhmy;SMDL4c:K0PMbc;SNUn3:ZwDk9d;UpnZUd:nnwwYc;XdiAjb:NLiXbe;a56pNe:JEfCwb;cEt90b:ws9Tlc;dIoSBb:SpsfSb;eBAeSb:zbML3c;iFQyKf:vfuNJf;io8t5d:yDVVkb;kMFpHd:OTA3Ae;nAFL3:NTMZac;nTuGK:JKNPM;oGtAuc:sOXFj;oSUNyd:K0PMbc;oXZmbc:tUnxGc;pXdRYb:fqEYIb;qddgKe:xQtZb;sP4Vbe:VwDzFe;uY49fb:COQbmf;ul9GGd:VDovNc;vNjB7d:YTxL4;wR5FRb:siKnQd;yxTchf:KUM7Z/m=bm51tf HTTP/1.1Accept: application/javascript, */*;q=0.8Referer: https://accounts.google.com/Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: www.gstatic.comDNT: 1Connection: Keep-Alive"; in File: "SSL") Found requests in header "GET /_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en_US.C6tNd3FBrA8.es5.O/ck=boq-identity.AccountsSignInUi.QUjh89dKB-E.L.I11.O/am=DmBFJI4NgOD_oonn7xknhwEAAAAAAAAAANZAdg/d=1/exm=AvtSve,EFQ78c,EGw7Od,EN3i8d,I6YDgd,IZT63,K0PMbc,KUM7Z,L1AAkb,LDQI,LEikZe,MpJwZc,NOeYWe,O6y8ed,PrPYRd,RMhBfe,RqjULd,SCuOPb,STuCOe,SpsfSb,UUJqVe,Uas9Hd,YHI3We,YTxL4,ZUKRxc,ZwDk9d,_b,_tp,aW3pY,b3kMqb,bSspM,bm51tf,byfTOb,eVCnO,fJpY1b,fqEYIb,hc6Ubd,hmHrle,inNHtf,lsjVmc,ltDFwf,lwddkf,mWLH9d,my67ye,n73qwf,njlZCf,oLggrd,qPfo0c,qmdT9,siKnQd,t2srLd,tUnxGc,vHEMJe,vfuNJf,ws9Tlc,xBaz7b,xQtZb,zbML3c,zr1jrb,zy0vNb/excm=_b,_tp,identifierview/ed=1/wt=2/ujg=1/rs=AOaEmlGnxNV2pEseDP5Hh_iXCnMiha4f2g/ee=ASJRFf:LANRae;Al0B8:kibjWe;DaIJ8c:iAskyc;EVNhjf:pw70Gc;EkYFhd:BDnJmb;EmZ2Bf:zr1jrb;Erl4fe:FloWmf;JsbNhc:Xd8iUd;LBgRLc:XVMNvd;Me32dd:MEeYgc;NPKaK:PVlQOd;NSEoX:lazG7b;Oj465e:KG2eXe;Pjplud:EEDORb;QGR0gd:Mlhmy;SMDL4c:K0PMbc;SNUn3:ZwDk9d;UpnZUd:nnwwYc;XdiAjb:NLiXbe;a56pNe:JEfCwb;cEt90b:ws9Tlc;dIoSBb:SpsfSb;eBAeSb:zbML3c;iFQyKf:vfuNJf;io8t5d:yDVVkb;kMFpHd:OTA3Ae;nAFL3:NTMZac;nTuGK:JKNPM;oGtAuc:sOXFj;oSUNyd:K0PMbc;oXZmbc:tUnxGc;pXdRYb:fqEYIb;qddgKe:xQtZb;sP4Vbe:VwDzFe;uY49fb:COQbmf;ul9GGd:VDovNc;vNjB7d:YTxL4;wR5FRb:siKnQd;yxTchf:KUM7Z/m=Ctsu HTTP/1.1Accept: application/javascript, */*;q=0.8Referer: https://accounts.google.com/Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: www.gstatic.comDNT: 1Connection: Keep-Alive"; in File: "SSL")51:Tb2e6,"GET / HTTP/1.1Accept: text/html, application/xhtml+xml, */*Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: www.youtube.comDNT: 1Connection: Keep-AliveCookie: CONSENT=WP.2676ba" "HTTP/1.1 302 FoundContent-Type: application/binaryX-Content-Type-Options: nosniffCache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Sun, 22 Oct 2023 01:37:42 GMTLocation: https://www.youtube.com/supported_browsers?next_url=https%3A%2F%2Fwww.youtube.com%2FStrict-Transport-Security: max-age=31536000X-Frame-Options: SAMEORIGINOrigin-Trial: AvC9UlR6RDk2crliDsFl66RWLnTbHrDbp+DiY6AYz/PNQ4G4tdUTjrHYr2sghbkhGQAVxb7jaPTHpEVBz0uzQwkAAAB4eyJvcmlnaW4iOiJodHRwczovL3lvdXR1YmUuY29tOjQ0MyIsImZlYXR1cmUiOiJXZWJWaWV3WFJlcXVlc3RlZFdpdGhEZXByZWNhdGlvbiIsImV4cGlyeSI6MTcxOTUzMjc5OSwiaXNTdWJkb21haW4iOnRydWV9Report-To: {"group":"youtube_main","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/youtube_main"}]}Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="youtube_main"Permissions-Policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factor=*, ch-ua-platform=*, ch-ua-platform-version=*Server: ESFContent-Length: 0X-XSS-Protection: 0Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000" "GET /supported_browsers?next_url=https%3A%2F%2Fwww.youtube.com%2F HTTP/1.1Accept: text/html, application/xhtml+xml, */*Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: www.youtube.comCookie: CONSENT=WP.2676baConnection: Keep-AliveDNT: 1" "HTTP/1.1 200 OKContent-Type: text/html; charset=utf-8X-Content-Type-Options: nosniffCache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Sun, 22 Oct 2023 01:37:43 GMTX-Frame-Options: SAMEORIGINStrict-Transport-Security: max-age=31536000Origin-Trial: AvC9UlR6RDk2crliDsFl66RWLnTbHrDbp+DiY6AYz/PNQ4G4tdUTjrHYr2sghbkhGQAVxb7jaPTHpEVBz0uzQwkAAAB4eyJvcmlnaW4iOiJodHRwczovL3lvdXR1YmUuY29tOjQ0MyIsImZlYXR1cmUiOiJXZWJWaWV3WFJlcXVlc3RlZFdpdGhEZXByZWNhdGlvbiIsImV4cGlyeSI6MTcxOTUzMjc5OSwiaXNTdWJkb21haW4iOnRydWV9Cross-Origin-Opener-Policy-Report-Only: same-origin; report-to="youtube_main"Permissions-Policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factor=*, ch-ua-platform=*, ch-ua-platform-version=*Report-To: {"group":"youtube_main","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/youtube_main"}]}P3P: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657?hl=en for more info."Content-Encoding: gzipServer: ESFX-XSS-Protection: 0Set-Cookie: hideBrowserUpgradeBox=true; Domain=.youtube.com; Expires=Sun, 05-Nov-2023 01:37:43 GMT; Path=/; Secure; HttpOnlySet-Cookie: YSC=INgtjk5iJ8M; Domain=.youtube.com; Path=/; Secure; HttpOnly; SameSite=noneSet-Cookie: VISITOR_INFO1_LIVE=qhnsPw9jWJQ; Domain=.youtube.com; Expires=Fri, 19-Apr-2024 01:37:43 GMT; Path=/; Secure; HttpOnly; SameSite=noneSet-Cookie: VISITOR_PRIVACY_METADATA=CgJVUxICGgA%3D; Domain=.youtube.com; Expires=Fri, 19-Apr-2024 01:37:43 GMT; Path=/; Secure; HttpOnly; SameSite=laxAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Transfer-Encoding: chunked" "0000000107fc��X��6~,UI�)�u8��Ԗwc��DB$<$��+��'�x��8�e�X�H�>��ح��~��ۗ�Q$�x9W�(�i�0Hj��Kn��r��Q��06�l3ƥ�|�J�ʅ��P�X��D4��>��b�wL��M�9��3^�P�{9�i��"N�#�2�m��$�c�3*�>Kl_�gk��x�x��7��|��;��8��P6e��.�7��h��u��x�؊I��C��X��`m��Jk�v��iz+��:G��\�`otcF3r�hhF#3��T�6i�15Ylf��pj��!�<��2J�3+dr�:�x��j��C�Y��s@�Q��G�2�W��R��CfO��gᇈ�0�Z�QM'l#*��g1�^��U�S��3�X�M,@]��B(�h�eX��O<�F�F�؆�u̶��$;i]�V(\�0&#��*�S,Hp�L9Y1�d�ډx@�FN&Y�1<\�'�xbV�� c҇�@K�!G|К�g�)@x$��d��G��Y�{�E��`qޓ ��DL��S��\ƨ�I��\��V�E�Qҋ�Z��U��d�7+\��KV�@ܮ�1�mnh)>�Z;uS��e��'{Z��M��_�Ubڪ�C�҉�-@J��a)},w�}��<@n��2��>�UJ��ޤ��ht�X1.��4-j��t��J��:�C�cH��r��[�U��q@s��O��4$�:�c,��d��c�Ylt��Z�׆�,T�ՑiE Z��m(��mGݞ��*�d4#��D��OZ�D�\%��g��u�� g2^�Ҷ��O��wϚ��?�@Ɨ��L|�3X��'$�=i��vO��Щ(�N�0݉��tEy��I��u�3�^|A��'+xu��`�Z�d�tƫ�F��[��5��u�_PY�6β�J��d��Μ5�GwҌn1�&��yr4��7� ��Wn��C`vo��GX��!N�!��x �ć��ִE��i&��߷��w�=��W��Tʈ��+cI��7�dۃo�b��>#l�^��џ��1�Rb�):$&��8��~ơPTK��D̔jZ��.�U� �[T}�ш�Y5��~T�Qv��p]R��XB$��=��#��uEB�;��4��?�n��Dtk�퀈�4[B�F��[�^�+��Pr��Jh?Kör�'�1|��qM�4�Ī,z?cT�W+{��SX��s��݈C�@��Kh�Ay`�3��\,��mcQ��?��>�t�0N��B�H2��Z!Q*��S��]Rr!�Ԋ5��D��J�'�ͤ6�t��-��f�N]c��`�"�L�l9��ɚ$ձV-g4��*o7��#@�)�ͮ�:�g+x}��_��k�d�\&�>�``�I�1fB��"�zqՓ�[�dA*p|N�Ȭ!v�6��p��a��~��s&�ZjI�/`��\e�?*=�s��aP��F®��W��TG�2~ �=�c�g<�", "��4N��8�S-��n^�q��ǩ.Uu�&DC4xO��Cd��;ʹ':�!�(䫞?"��8Ѻu��^��k�3nEC4��K²F��x�gx��h��>^#�}�y�M�]!�͈��[�8N��(DC4��?5:I�Tok�>��ÑS<�D�z��,}b,J4�yN��$�E��}�@4D#��|��D_DC4|h�Sc[k�ia�V4D��?4??u��>��Ʀ�L��DC4|h�ScWi��'N��?ɼ}b[gk�1��$��!d�F�h�f��m�l��Q9|�y��}U��C�!�^�R��9�+��!�*d��j�6��>��N��u��ϯh��_�h��}��1�0;Ev�A��n�nEC4��p�H�7�P~3�2Ѩ�6�?"�]�n/nEC4�;�]�=�rDC4j{J�^��}��m �aI�[�$r)�d��hT��^Z\߷-��!viPD��օw�|�!��o��'�l?��@4D��Sq��*�d��hX��їe?�nEC4l�?Z\߷+��a��8�i�j!��:8�ñ��U�;?�뿸up��ڲ�*��o��h��51]J~l\�'�ѽ�=�S��|�bUU4D�~p��u��`�V4D�{i��o�t�si�h��s��G�P�s�h�V4D�U��@4D��T�OŮ�A��h�/M��e��ح�[��}$�OMt(t��ڥ}�!ݻM8}��}��!N��\�[��!&n��k4��oWfk�.��h��)��ƪ�A�;��!�AW�[��F��f��:p+�a��W�O.��z��lr?c��!�{M��W��e�CW�h�F�7jT��\��v�U8I��k��h�ۇh��h��h`�F��>ds��O4D�6Dc1N1�^"A4DC4(�.rY�|��\�'�q^v��8I�X~��<��_�;�-IN �"�$e��ʛ��Y��w�i�tE�b�(J�Ҹ��2��n��BiPg��O��H��kmqΥ��9��ɀ�4(�jw��$�6��-��Kl��_��_(Ņ�v\yq�m��[gy;a��`�4(��9��;�4�+�6��K��r1�", "�i�Ҡ4|IA�JH�tg�s��ҿ�WҸ��F%�)ac��n�e1oF�Ai��=�\��:܁��S~��R��t;��cDi!�Fuj��)N��4��+�uZ�9�(�\�j�C��w?�4�'�6�G�!��:�~��Nt�1�Ⱥ�w+i��il��c�a� ]%��4�#�6Β�G�f�>,5Q��ޔ�aW�v��D9H,㤈\^��/�!p�Q�$^�ѣ��Ai�E�$W@�I�?sip$]d@3�U1ʂ�/�(Jc�'N��:�w��}��#��Ҙ0��p��7�(J�/�D�X��d��(ED!��ti��$�8L��,X��4^��5�5�`��1��d��!��nw�-��u4��(�G��ЇO�(�r��^�'��Ni<��v�5�Ƃ�k��>K��}GEiTQP+#�jꀲ(J#�1f��ƅ��B3��EAo��Yؠ4(��"�)�G��gCI��]�a��T^ڗ�B�4(�$8�Q⃜�]�\��O�|��w9�yxiPE�ȭx��t@b!n��=��.J��Cn;<�r8i04/��8\9��<��Ai$�b��S�/��EҀ��X��J`Z��F�$�<��M�4ܱ�Pn��>�4(�(h<~�Gi04�k�e:��*��Ҡ4�Ms��s:��La6�r��:�Tq��2�4(� pf��>�T�ۑ�q��=��a�Aiܬ=A��#J�Ni�#]w틜N�4( ;��a(�84�ҨG"*�#��TJ��1�'fJc�d�fn?�0��i��)JH�O40L�84��X��G��S��GGQ��tJc��Y�}�cK3GiP8R�31��Z��-�Li��n��ܱJq��Kl{�Ai�}�^ˋ]g�A�l�ƫ�[ڠ4RsE��*�ͼ��/֠4(��l�*�-9t4�e�>"��Li��A��V��꼈�Q8�Ai�d�bMv��a��;J�Ni��Ԉ�s�2�'J#+�uT��nE��M�4vmk^K�^��(��I��7�p�(��)d��1iW��FQ��enN��"�M�{��z��ShG�н�*2�Ai��f�sKi`C�)��r�v�*� �$��Q�҈�¢�V)th:�Qt�}�м��{�MiPF��Ұ�:Y��R��C��1Ϥ4(�YԠ/h�FR��tJ�̪<��Mt�4(T��G�^?��R[��(��[ΪP��G�s�xA��T�3j��t��h�9��+��V٩}��'�X�}��h�G�A��T/��Frm��C�;�K��4��/�q�� J��t�R�suk�g�^F��h�y��*)~�ײod�__@4z�#�3��!�P/��X��kQ|/%4��5h�F�hd�Џ��Ƌ�z�8�{傆�,��:4��F�ͭ��OI6�K�l��4@C��wz4T��/�hHG�A��*<�g`��F�う셎�-��]�P/�� 9!-��Р��!��[��$��9n�E�BWڏ4�b4��*�^�Eq��"4��2=4��Qu�l��(h�q<Ш4�!��;Ш��6I�@�Q��A4|��N�h�+b�m��#�h� I��ͱ}V��/4�\�4<��A㐕f�F��L/'��I�S�@�EV�bߝ��h�翚gˬki��<��Uֵ�{��c��>�Z��V�F�8V�q�Apа�K�[�h4�Fm�N��]V��0hd��", "9�4Ƭjи84֠qE:F4YՋ٠��p=�4�E:�4l�5mUC��hd��fh쳦��O$h�h��o��7C�{`��5h�h��~�6[��4@4~��66C�hX)�1s4��HY��1w44��z 4Y�4@4B��4��!�!;�ok��{��4K"�Y��4@4@�~4t��f�F��Q?��-��h�h�b��O~|_��<��4@4@�+У�a��m4@4@cVh��m��Q��h�F4��:h��nA4@��N��~�@�k4�C�@4@ChH�Z��4B߷��n�8��H��!4B�g��~1��D#��4@4�q4蠡?�o��h��t��o��y��U�2i��V��1�^��t��L0��@4@#"�@�׾�@#ԒH1�Ј��m��4@4@�5�k�2i��!��@��S�_�h�h��k��ACp��A4@#&O�G�4��A4@#&�<��!��?�o��0��@4@4|c]pp_��h�h��s�t��$��h<��͐�h��h�h8'@� ��A4@4��@�{�K�$r��.�:g0��2{��KB�յ6C@4@4@�n�H��N{��W�@'��(I��k�A4@4��6z�:�h�h�ƹ�!�4@4@4�@�X�h\�5��3�b��h�h��f{��6b4@4�14�F+��h�F@4z�Z�:��Ɠ�x�fh�h4�F��F+�S��h�Fh��qUl��}l4�tm��e�aa�(�sB��t��tVD@4@4�vm�fh�h�AC?�|�~4순?�N�[Bc��+�=hL�m��"4@cУ��h�F�h�vDH��И�0h<��>��c��/�hx$�@#EA��]64@#4%:�:�o�1FA�h�Ʊ��Z��q��aSh�Q�0��c��h��O)��/M�H8�@8h�h�>��y��粜V�#�//|��ʖ��I��+.�#��{W�l�l�04��W��q~�e>�G�.��;�8h��zr4F��1��(�6�_", "5�hkԽ�~r4j�h��A4D+";��D�+44/4@�g��4�YT��7=��P�(��=~/&� Xg��D|�r�H��6j(*B�jHcRi�48�Ih�_JRi(�&��4T��N�^�Q�T��/U*�p�R,e}W��|3�4��e��h��PiP>�!��*�{��g�t��@��6JGWi�4Vi�9/C��~�I+n;�?z�iSi�48͔�vf�a']�-��6�4��?z�p�QT�Hc��y9G��@z'Й4��#V�Ȏ+ssi�a��L��V��ѿ4��T*��Ւ��q��FR��X��Q㑻�4�}��R/]2�5��i�c�Jo�%��ojE�H�B<�n��j��8g��؛KÏ"��<`h\�wt�_5�j�m�Ұ��IY�ͥ1"�"�1�[Y��Zs{C�Ic��v�K��$qsi� ��rG\�2d�Z>u?~�x�(r�B��NǻK��!/�G��N~�?��T��:�/(g��~~��B?Ұ5��b�(r��yE��-��ߍ(��<3H��A3��Ұ��4\�?.��u�h��zDil�F :=?hN2�4v�D�/��7>��'n_�^~��i0�⩎�1�Dve�Kτ��'i�"d�#Isi�Z#.�zͅ��dp�ӧ�(�汝��cG��a��,�F(�ِD�a��Sz�� ؙ1�p,!�e��K��U�\A2;�(� ��9 ��%�y��3Bi��a�2�yb��CD�F!Ƥ��d�MAγ�A��k� �P�<Ûh,�f�5>�40�"��'DAq�t'Ϝjd��HC�a�*�D�:f^�e4~?0�469�ʺR 8��v��?i$��rsI�$��1gC�p�Bs��{�u?� �(r�0��6�>lA:��5M��IC�u��晤��ci`�X#�z߳&D�Ez��w��Ƌ\N"a��cr��D�5�ە��!d*�+�M�6F��sx��E�>�Q�5f��ȵ�qvkL��;��t�߮,�]�x�/jX��q��e�`ߌ`V;�H��@��)�#W�F{�Zk�K�_�;FG?k@խ}=K��D��@Y�(��ӕ4��Q�޻>/�1��ZOz}4��)��Jv<�O��4��:_h��WMit-D�Ck��4�J�6��ο{�S�V`di�+��ͥ�T�P�e42��c��2�4\�F]�aR#�>��Y갌$��zā��F�^�LjX׉4l�0�F��]�҂�Ѥ��", "V�Y�iLR�?�4��@ק�X��~�ן�GBe|�@� �G��کa��(|X-�+9+u"�$|��8�(x�O4��|��ϒO�&�i�J�_3�4ΐ�1:�c䐩�>�4��'�S*-g�N��Xiq��4|��Ɓo\�5~*\��qi� dk�ɣ;dԁ4,��H# 5�hS��S��%��v߲i�m�E��}ix��4(1'|��qC��-��j�S�N��DHu��4��e��WH�<��B=��i��*1mgA��N�a�8{k"C��4S�O0;hVC3�K�QO�v�a(G��D�U�m�H��U��7M��X��qˎ{�v#��]ixr��K$�N�p�{5n��H[�)��t�n��T��-�a�(Lx�4��f�A��tQg�T��#j�ϒ��W��8 ��L�ޥ�tMg{g`�F�j��@ܺ��5g�]C�f�{��5��΀�G��4fj��U��5��T��vIg��؎��*�X�yi, Z#Lx�s�t��>�4�Õ�2��sG��wv��4VLsg��W'��v��40E�Bn�×�7��4��p��o��O�8�P��(?��[Jn>�wItgu%d�3��Ҙy�4� 0�B��C�n��KX��Y��_��2{��Z�M(�E��gy��V��.~W�(�ܪ��}I�<ϳli�_Q*��?�b��F��$x�� w��"�J�ҙ40�q_맥QH�49�Q(��Y��A��,e�f��o�Mp;s�}��4"�gY��6��Pkh�Ը��$��3�XbbҴ�F�|S4�o��x�躤Fӌ�<�;D[��Y^',��0��pJΞ��eiG�4U�e�̠S�"i��-��Y��J!|�O��I2PY��,�)�/�o\�O�#>��w�0@��B��{Z��L>g��Z[�0��BKQ�&N��v8Yܕ��4`��.��Ｕ�]͈��[r��t�O�x�-y��u�c�1x�$�4`GVOsd]`�.^�q��i��M��jՀN`�\j��FC�p�-��V��T�W�j��8ĪJxՀ};9��'0p�أ1�?N�/[c��=�0`� �(Jd��_��uڿ%^ �o^��5�q�}�(��o��8�9F��|_18��vҐ��Ƒ�X��˳� (��IA�w!YP�y�<�b�h3�W�j�:�d��!Z�K!�W3�Dk��0v", "��E�T�j/u��G?�G�O�Y�Z��H��7A��ʿ�d��lY�^D�pp�ZeDm��gs��^��^Z[|$lE�Y��d-׭��T��,~�\օS�5Ż��u�IEND�B`�", "HTTP/1.1 200 OKAccept-Ranges: bytesCross-Origin-Resource-Policy: cross-originCross-Origin-Opener-Policy-Report-Only: same-origin; report-to="youtube-marketing"Report-To: {"group":"youtube-marketing","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/youtube-marketing"}]}Content-Length: 9171X-Content-Type-Options: nosniffServer: sffeX-XSS-Protection: 0Date: Thu, 19 Oct 2023 15:14:15 GMTExpires: Fri, 18 Oct 2024 15:14:15 GMTCache-Control: public, max-age=31536000Age: 210212Last-Modified: Wed, 16 Oct 2019 17:15:00 GMTContent-Type: image/pngAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000�PNGIHDR4d��"��PLTE��((((((((((((((((((((((((((((((((((((((((((((((((��PP�� pp��@@��``��00+.s�!tRNS@`�P��0�� p�@��0А�Pp�ఠ` q��"�IDATx��vC1Qe}n��d's71�I�̜�'�_��#��ײn)vs�n�k��p7��Wg�?��qr&��8,�"61�d��M��-�:�V�#�1bO�0��K�+~Kq�P�w��g��Co��E̺�D5��Ǳ�G@��4�yX��0�mC1Tb�I�V��R�$P�4jT�$PC��˹��Hp0�P�%�y��H�G2�x��h k��z�f ;��h �Q�� ;;��lhO��Gn4��p�h`��_��r�6@�V��'g��XB�8.��@�h��o7T��q�^�Vc1L�l�wd��B4f�.��3N��Ʃ��DC3��،S-*?��6��n�jh^)�:D��G��r��3�d?N�DC4�M�/��a��X9R�hB4D�͘�", "GET /img/desktop/supported_browsers/dinosaur.png HTTP/1.1Accept: image/png image/svg+xml image/*;q=0.8 */*;q=0.5Referer: https://www.youtube.com/supported_browsers?next_url=https%3A%2F%2Fwww.youtube.com%2FAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip deflateHost: www.youtube.comDNT: 1Connection: Keep-AliveCookie: CONSENT=WP.2676ba; hideBrowserUpgradeBox=true; YSC=INgtjk5iJ8M; VISITOR_INFO1_LIVE=qhnsPw9jWJQ; VISITOR_PRIVACY_METADATA=CgJVUxICGgA%3D", "GET /img/desktop/supported_browsers/edgium.png HTTP/1.1Accept: image/png image/svg+xml image/*;q=0.8 */*;q=0.5Referer: https://www.youtube.com/supported_browsers?next_url=https%3A%2F%2Fwww.youtube.com%2FAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip deflateHost: www.youtube.comDNT: 1Connection: Keep-AliveCookie: CONSENT=WP.2676ba; hideBrowserUpgradeBox=true; YSC=INgtjk5iJ8M; VISITOR_INFO1_LIVE=qhnsPw9jWJQ; VISITOR_PRIVACY_METADATA=CgJVUxICGgA%3D", "Q�^�8��S�0� �J_$c�bqm.�W�l�F�p�%�3Ϥqa�Ӽ��^�u��&N��)��@h�yK�?#`!`m��K�Bz ��Bt�ʧ�c��+!��-��0��˰��V��;S�5��q��/��6\S��"�P(�O��H��A>��mrּ��,݂mD,7��=4-��A�"?�$HBUջ�P�6��@�uO�8.�<�t�[�?��c�؂kR��)�!��d�w�Iˇ�Pݳ�X\?�E�{ `u��X�LO�*�Ip��M��X�O��&A��~�Ŋ��P��$�7�h�%��o5ql��v��8U4��]��՟S$�u�TO~Z>�Gkn�d��h��ŏ�t��R渖S��I0��b�b]��W�;��[d��p�7�n��K>�SU#�U�!`��)2�_-G2�Ǧ�C|��T cX�x��Ƨ'`��)�L�$c%X�X��]J��ކo��M�j�n�@��u7^<�)�Zđ��i��(;�V:-�1=�d�4��r��9��&AD9��+��w�.��q!D�K?�QMS��Ü"#�X��p��U�@�2��>gSI�ϑx=_��&A~�o,T�I��%��C��P��p�q��.Á�+]�W��>�)2�,�Y��F�2��%�ҝS�9N�'��$H�1v*��.�[�06�+�b�Kn�.Jun�+0c�-��*�@F��$��%��"H��N�a$��Z�'q��:��탐�'F�iu+�0�g�BX!��_C��E�!H��)�v`��|�#k�h��:ȩ�cCw��}0yp��|z׏؁�_�X�#�V=��%,�� z��)��X�9��(#+�4>��i�׎(X#9E6D��{*K�R��X��X�XK��b��W�E��#�$��!*�I��)�QU��D�JL��X��,T��c��Ƈ6��q�`��7�� p�Lc��y�«�@�J8S8E4�, ��k�V_m��'��e�Ƈ�%�}�sp�7Q*�Uq�@�0��|+��XIB�B��4N�a,NӴ#�H�ջ��2\{�J�Wq�`��w�?/H�6\'�^��)2a�-�{��1, `�+eN�N�TU��=o��1o1�J�K>�!��$�_´�g]Af0�ޓ��m��cr�; `=��,,��B��)" "�0��"�*VS��0��W*b�_��Dian�8��~��s�X��XX��8��9��|̕@��6��s��7̞�X؁��XX�9�̋V_��c��<̓`�� d��S�f�@��$��S��6e�5�>��'��@�-��S[�)a��h�s%��q��o%�1a*Y�[-��cW�c��), `P�;��e!`!`-�"%�Bu/t~x�s?j�5`�ZR�"�d��}��Pc��~0��@`_N�2��{�9 `=��;��˅EJ��ˏ�� N��}:5Heux��+Wmv�k��*,�A�B�B�,�)��z��5O�J��"��бo$�?E�^��ʈ��X�_��\X��X@�#(��0Oipڻ�?yjT��J5�?'@��oZ�Ny'�&F~25H3�5r{��@Uջ8�j��`O��90 `��L�8��ۭ"��WH�Rw/Vw�V��ݽ]�A�C Bt޹��9w��P�ɝ;��r��z��9��cdXX ��*Ani@�yBLVޜ�0�®�`എ}.T��]��k��3�U/��i�ɐ�vȞ|�2_��;d��r��)y�˄�� Ĭ�u"�C� �־��d�@�E�E�,Xk��a�JO�n��,�dVG�^q|�{��+ϊ�s&=�iR��^i��i�3n�#�n�Щ]��֑�~?�C�|됃nL�!7��֎L(��O��j�3i��?��?JfB�KbR�ĕ��H��n؛G�&�,```�x�5�Uwx�;�C��n��y�%��Z��.�䚈��5U(��XXX �"�:;��<�ʯ��\�\+�ҫ��@��[�g=�X �"�"��չ��6UHz��o\��}��Jg�i�r�۽� �z)�o%t]��~ ��nc�xͳ�'��q}��kB0 }�T�\?w(�7�u��{��XXX �"�z�J�T\�y"l-�Chlv|�N~�-��yO�v�5`��B��{�;�=|A�,,,`�q�w��x��5��P*j�/!Ѹ'Ze�m��]��:Xiu�2��N�c��OX �"�"��JrMK%=g3��m\�C-�]��r��_%^0%-3��YOO��d��[�1��Q�K�~N��~��|��T��T", "��T��TM��Y��I��"K�$e�M�RUO\"�/��%M��v_*�O��C��j��Z�4�r��y� Y��Ш}��߫��Q�n�Ͳi�Sj�_��6=��vj��&m��ʮ��>쬢��E}.) �{a��'�Y��f��#��-��2].��b6J�_��gx�1�jAIY��W��/�.�z��x��@��LW��Xk��N��b��|��T<�Y8a��?Lf��#3� ?��0?�R��i�uwaA޹��~��7Tf�!��Z;/7��i%Ͽ�S-��4��^�\��5:��^��V*��Z��:D�N�^=��;[иt�T��,�4^JN�'�Cl��E�n+�w��c~��2+��q�(��Tʗe/�:��u��@�Wg>�&Mͬ=_[k/M&�[(�2"��ou�A�@Su�T<{�̽p��(蛃A�Wg��%��8�8Xk�s��A�rI��3�r��T��ꨃoJgnOԯ��.KkYw ��U�Mu��ש�[�k��*銫��y�R:�R)�E��8@ြ��}�-��|\�iP�/��v�&{o{��D{NH�3c��[��:dA��Jh� ��[/��<��Y�� 8�S�/$��~��|�׿ܵWH=�Y⿟]��Dxu�Mi)Z�f�T��߶{p�of��F�km��T\�`�*'�\>�뢠(-��g�s^�3)-�ωu}�hj��i�w��w�2Q�� "��f��E#<��sP��s��=1-/}��{�5��1=��?�Z��9R�(ha�us��Az�N�po��I�*��U��>��5�Ͽz�DV��?��0U2h�}��l�\��F�9G���b_{�9W?�yu��yYu��ɬ��ߧ|�1y(E-��x�k�V��a9��}�Yo�ߓy�US�OV�b7t��fJ�_�px��L�0$�_��A��f��ԉ�&G��gB�~�M~w�¬t��?�*��ƕ�3��Xp��}��2Q�J��Ã�%�=�d��*��@x��kmZ�W�}�s�x��Q=�^WE��~]��ېn��)5-��&�m��b�oӧ��}��='��$�;�", "Zի{]�=F��Y�D�G��ҿ\��2Q��vg濎y{xX��>�ȴ�R��W�NJ�[�qz�0W�\�-"�)��b�!��;we��x#a��{-e�$��Z��0�5/�~��q�S��-��vȗb�a��Z;\��L&��^��9�vsG��2Q� �-؈�˭��3�꘿?}��C܏��]UYz�аֶ�q��W]#�Xk��T��CDķ�o�L��0��Mو�+^��g��Vz4}��n�«˟o��z�P�W�]��Q��Z��I*��=r3CD��L��0�H6b�JV��`��_D�B��S;�4��JZ��g��"l�Ջ"��2�`��u4{�`�-�0�@D��K�(ha��؈��J�+Y9�>��׻�A��.%e.}E��R�\�z��쟮��c� "��j7e�$��ADVg#��%�{X��S��X�r�S��S��gIij��Uxա�R&@zim�J~��kNf��>�W�(%.��V6c�i_t�g�[�}��W=��C��Ϸ��JK��4e�FDzj�ӕ��PQ1��q��c�ޞ��XB�B�ɿ'~��X{MH˥ϵ��vAp�`,;I��?�,:eG:��[l�L��8Xk��K��l�`9͵�)��UX��V9��Y{OLˉ��ß'�|��_s�u�2�y[�+�W;��c�e��(��sDd5e�$��q�%�۸�3�J�ۉ>EHc�#_.��3c�^q\�]�JC}A$«G��.4��G��L��ʡu��L��88��PI��g�վ��@�ë�Edme��u�g��o�`Py�W&j\��%l��}�3�j+=�>sxU��)�9�s� ��^�3�C�0?Obg�9E��pqp�%هDͣ�Vk�8� ��e�+Y��PZ$Ea�KFl(�c��DM��6c�HVN��R��'a�P&V�)��Y��$ăp��{��6�P&j\�yWI�!Uq�g��>�RY_�0��"ꖏ�"��`��K�#2�l�L��8Xkg#�ֲ��bH��aʄ��o��f]e�[��!=C6��!��W��ѦC�h�V&j\��d��->�3��׾A��MeB��Ql�ԝ�N��6@ɠ^��f��J�6��DQ��26b�h-�`�3��0�W)��2a#"�;�3CE�w�e�EGl��0s`o��)��J��6W&�\�9EI�!Q}�O�W��G�`MQ&�\��:#" "�ܢw3N��e��^�xh��s��*��2Q��K��/��*��ߤ?�ĊHOe7�"�j��;��א�A�1� 8lcI��UF�3Y�(pq�kw6b>j^.��c��)��O��P��NR&g�U�K��/�:m�nt%��WS�Zƚc��t!�Z�K��X#�S�Wv2�.8|� l��l�[�Fm M��y��H�Xp�C%tF,�L�BDR��?w �ܶRy��2��M�0��5@�%��7�eǭ�q��*m��8O)��D��83�Q��c��}eV��kgnkY�C�^-�=�2��;�G&��>�Ҡ��Y��w)k�(U/��il��D��b%@��^��US&Բ��)�'�-5z��ң֗��7��6��z��=3aW��^�AN_��\��̹k��R2�W��z^�7�G�M��Gl��O�X͜�O\G�ikfΑz��C�2Q�a��Mt�N�DU*��:jkؒ�3��;4 �Af�.��'�Mo�km�W�g`!�b��ߍ��9�X̉��M��C_w��a?�p��ס?@T�1�(e/�x|O6a��ػ��(ή��'8��ݭ��u�I��{��]q%)$!��2��}R`��0��[/r-r��3s��S��g��=��/��դ��o�� c�8��8��J.��#U��I֩�۳��U�e�K!_]qO��#�^.�9I��&P��d��?��XR,��$� �0<�5X/u�<��Y�+�b��T'H�(��v8y�lV,�o��!�@J��r��A�X|�/@-T�*'�A{�~,��a��B�|��e��8U-p�q�Eיv=@@��/�`�g�u��&�A,�s��! ��P��8��hÕֿl7��Ŋ�~ma�CFREU�9�p��eP��;)��Lo" "��k��j�?�\ZmQ��-�^GV��N6��e��XR$$ge'C@i�ᷜ��Ϸ�rQ�}��r2Tu?~| �z6Z��d(��G)��q�.~y��J�� T��ds(o��*:��XR��E��#��U��r1U�h�Ud �V;��s��z��J'��`H� ��@�w2!%�l"7�W�q}��+/z'?��8��lg~� ��hf8��p��r��@)��7p??�)R#��$��d��Y�+�R�xD,ϗ�-��N�!��W}�:o-Q#ַ�� T��N��q�,��wX�XhtX�v�9B��r�C8t�G��*��r]w�%�DRտ:�*<ʏd��[��]XX��֡��h`}��@)��ơ��[mp��*��Ϡ�P��\`��r��N��2a�:9��b�˫��%��0�!SI�['[~/:ڬ��'1,&��U,��?<��7_>�d�@)��o߁K�^��,긚L��`��8�.��g�rVۇv"'�Ł��[G)��'�ad�W֭�*�[?G��@U��d��mtd^w��qh=x��Cq��f��RFU�:��U�Z`,y�&U=�6gfM�:�)+��6+-Hҭvh��Ԋ֊��`�@nw��j(f6YU�P��H��۫��L�m��8��l��D�}3A��֢=g��hZd_'��RHUo��p�º?Խ�*+��&�{�`s�b�9O�@O��r��P��s��kr�ā��<�Րr��k?��{F��[q0�&U}�6��pt��V:>��a^S��Xbu9��)�t�F-�>Zۡц�F��*|��v��sbP�A3��d8DQtؖs]�tX��ֺƸ�@ W;Au!��3k;��w�Q�V`��=��p��r_�zn�>*C��K��//w��BJ��C�D��~֨X�O�u��pP�U��N+��];x�C�a��H��'�!��zW��l`��:Q�r��6gh_m�/�R��ܿ�$1�&U}��꿜��8��c?��T^�^�l��SbIr��(��dKܑ�۔��R<��i��y�=3U�ى*<�7;�U��s��6˫K��g[�U<�U�l��V�I, ��U)n�W8��B��r��4��R`=�s�raEx��f9�:��΀��/��8��ie KM�x�U�XK��a�cƓ�<';�4��#�Ͽ!֒7ձ�Aߊ��G�d��_Sv�\.7��Y s�z�3�=jBya{U%�}�c�~dJ"��c�� I��BH=kR��zW�Ա�A~�yU��z��,��e��@U�dk̤)n�/��H��j��i>6�|��ݚ�s�k��T[��4��5��]�!�[(Oq��@@U��o�t�jлj^M�`�M�_#T՟T�U-FQ�'��"�)�Π:6��KM%V��Ͷ��l��X�E�z�x/Ȧ��v)U[|B��f�e�f9�I}�@.�;$��#��_c��Zk�x�pA�o��5e�WN�e'˓K�\Ͱ:�l��Ј��.�e�k�tj�'��dz??Y��W8��i�˯-v{��y��E�^�-�x�Y��T�ur;bv�Y~�~@��v�0בּ_%dq{�ኚ3U�5ï~�� tR;]�ǁ|��F{(D��>`�r9�ѱ,��$\c�LtR? ��῝%_�ūO��B�_G�;��7:�U��Ƛ��@N��Z`*��#'�yeYn��YN�� (�-M��PJՠ��3��GQ��3��%N�W�|yw��;(��g'��8t2�Uf �'^(/uR �af�Tum��h��.z�6��n��@U܋�d�5�g@U/pR/�u��n�F�{��%��][|N��}Ͳ��Bh ��m`��RޠoŇ<�κd��'�Κ3��=N��", "Z�I�@~ϗ��(��2��3�OV�d'��@T�%��6.��{=��A��Z��V��@U��(z��Fff��0��Y��d4Y O�/?�ɏ��ļZ��K��(�P�0os�:=�wšW�X�JӮ��3��U�y��\DQt��`'��8��u��у��5�b��i��{�?��/w�^3+�wK��q �_�v2�@��{x��A�˫��cQ�գ�3��N��R��f6�ɘ�/n��a�L�5Y�/}o��ԡ'�V�?͖�=��c��n��n��Op_K��>�U�am�Ϫ��I�;f��+X^r�#c��E�u��X�զ�{��CT�ū��t��74�v��̦;i4a��|�ɎTZ /��N)�5�bٽU��9��>�Oq ��CT��-?0��.}{��?9��4�#��a7^�Px��$0��yO)�?��(�k��놥�MN��ȵ�NN0v��~�?L��E/��W�~=�9�Ʊ�8i�R��a��Pճ��J�4�.��q ��;��r�]�M�Pvq��E��l��O��+��}`�u��`��:�cy��-�g��q �d|�<��/�''4Jyu��(Ӝ`�B��r?K��7f��*��c�s�e�:;��xU=��.v�V��E��rd�Y~r��e��1||��Fp�}Vvu��TE�J��{]�,��5�9��^gf�R��INEy�r_��@N�?�b�+�V��j��N�v�6�d��F��c�.��ʶ0o��H)��ݛy�2�y:��e��ݧ8�kqpC�~�i;��{s��T(�=7r��9�P\��aWT�{<�Ƚ��x�71ĺ�m!��A��WZ�v#M`ߒTے%(@��A��/4��?o$ǉ\��AH`��5��=��d�ul�W�!��:�ᒰT��+C��x�Yv؞#ߵ}��j��T�X�L�A��)�9Nn�YW~��s@�98(�]Y@Օig�<`u��G��5�DD�L/E'��T?@z��ȕi�O��-ie��IA,0_ñ"��"�!g� $8U��n�o� ��:v��X4��VX�X2��73;��&�P�"><�S��8��ޡߖ1 �<��w�tQ対�T�Cm�� "", "Yw��$Tu,��-�O��q�(\m��1?n_�m%ǏNSB�;��-��Z��9kt�}�8NN�%��|ı��:�\��B��T�o�ëӗ��C�6̀�E��p��N��Tf��f�q� ��n��A�ӳ��sd�m�Vh^Ӂ#�X��89��ɗ@�8^��9��5�M!��r�RB"bxr��#I�U��Ӈ��{1|�-ffn��l��Q��%�mK.d��U.4��-��q��}��|�A��P:��2S�]��т��J��6+/3yI^Vʪh*^��ﺪ��]W�S�_��O��Z~��Z��-Z�؝Z��Z��z��e�ݻS�+]XrF\sM�)�&��߅P�18��o��&�Ē5p_WB �ǔ��@z��Ly�m�so.��am��'p��9��\�K�f�%�g�L͟�j�MN�M��k�e&?�-3�n�u��L��3�dYJ��)�Z��SZv�,�y�O��k��s-B�W��E!��$�@�QՁf�C�$��l��N�f� H_3�1�/�ө%�B��Zx�?�}zALI��5!��}�:6r'G̺�at�!JJ�|xP^V�g�3��L��V�ўo�igIO!5�6ɳ�b�Uje�޿��r�� 6��#��9No��і�W�s�<�@)a4��p�{�|̶$��0��3��L�X6��OTn[2�\� �K��J>��D`��B3|e�R�x~F�!��^�7D�u��/�� J)Q<��ToqY�H?a��K�� ;G~k��C��5�}�(.�;�-��Z2�܋��=��U�X=�2@*��J��~.C??��g�]�\��)�gqJn�'�ĩ��0��APr/��)�ؠ�\�2�j�uk��Lֶ�I}��)�!�� ;��&��V��L�E�C��,,"��\�۷��*�)��A�NU�̎�pܕ�M��i��I��S=��Y5(揃ȶ��I~v�W\=��0��M۩��͛�YXD��:x�?Y��l3�A��b�@ے+� T/|s��dm��/��K�s�J�'k�.� ��8oa[f��j`}�S4��~GB"*ɝ�u��VHë�T", "��a�ɇ�7w'6o'�'�z1H0�T^f��FH�m�a��FӃ�<��@�W�]AE��Lg�2Bo"*�2]�j�RD]��*�L��@��y�23B��C!��!��q��$��YrԶ�7z�d�xqN�5�=��|��}u�06�Ng��YI�~��;}�Z�$E�֥h��&��4�>��W��Kҵ��t��6]�fhgQ��;��:��$�VU��$��\��_�H��ŗ�#�mK�{)`@��?�kV�{g[��>��ݒY�U��p��W��z��:��&j��wߏ��V�u�Z��)oJ�nߐj7��^�,�pT��Y��«ă�+8F?��Z��%�m�tz'pHҢ)�~6��!δ��Zj��-B�&j��^��_��6�:Iw��2C��K�f�bg�&�{l�l��Lգ�I7�\��?�>��b!K��IdX*��cmw��S��q��9^��yg��C<�̿1H{�e[rU�'gr�l�No�(�NY��o�^��2A��lMj��Z]��b��2Vf�ց��k��~6C۟��&�� ,��Y�R_�W;Tu,��x7;��g!ےz)�)Ț�}�xO�HX�v��N��`�k2�ے��#�Ԓ � ��%�#�e�԰��n)߱W��k��z>�wz̗:w��h��dQK}��= ^��2G�?ëNx�#1��p�Т�=~>�_0"�Ǡq݀nwel0!�{@B@��L��S8/��r ��x��f�ŋRb��~.Cf9y��p�'X�R_�vss��@�FU�`��_�p� ��Ǫ��k�՛�9�69�w�dɇ�MN9¢�o��~j��X��]�vm��2��[c3k�9\�G��U nc��R:��L�wa�A)>&.q.R�$�'7{!�8B/,�԰i}��;��%��=��W��C"�x~V�ds�Q��d��'��m�i�V�e��:+M��0�;6��ܢ�4��m�1��fCg\��.�8��#Cm��3�_�H��Z:��!.H��{��2S/`1�=y�R� ��X�7r��[T=��Xbp�]UG��7q9t>��-�(��AY�A!}N��1��TϫS��z��G��b1�M��Go!v��Ữbq+��ZZZ>@�:�ߧ��v�}*�G`�|ڶğ�a��y�B[��Z6�7�2K!��^av�v��ë&�*C@BD��Ns޴�"52:T6b95,Pattern match: "https://www.youtube.com/" Pattern match: "https://www.facebook.com/login" Pattern match: "https://accounts.google.com/" Heuristic match: "Lr>qK.AG" Heuristic match: "oL.CL" Heuristic match: "Ec}[O.gU" Heuristic match: "7).DK" Heuristic match: "1J.nA" Heuristic match: "9u.zW" Heuristic match: "X5.bM" Heuristic match: "9o.nc" Heuristic match: "ak.Do" Heuristic match: "YD.me" Pattern match: "http://www.w3.org/2000/svg" Pattern match: "https://www.facebook.com/loginstart" Pattern match: "crl.microsoft.com/pki/crl/products/MicCerLisCA2011_2011-03-29.crl0]Q0O0MAhttp://www.microsoft.com/pki/certs/MicCerLisCA2011_2011-03-29.crt0J!P-f+;z{]6mWXIY8Washington1Redmond1Microsoft" Pattern match: "https://www.facebook.com/legal/license/WRsJ32R7YJG/__d" Pattern match: "rsrc.php/v3/yB/r/TwAHgQi2ZPB.png" Pattern match: "http://example.com" Pattern match: "https://www.facebook.com/legal/license/t3hOLs8wlXy/__d" Pattern match: "crl3.digicert.com/DigicertSHA2SecureServerCA-1.crl0?9http://crl4.digicert.com/DigicertSHA2SecureServerCA-1.crl0" Pattern match: "http://crls.pki.goog/gts1c3/moVDfISia2k.crlc2d_z\|" Pattern match: "http://crls.pki.goog/gts1c3/QOvJ0N1sT2A.crlcB" Pattern match: "http://crl3.digicert.com/sha2-ha-server-g6.crl.http://crl4.digicert.com/sha2-ha-server-g6.crl0d0pGi/%d" Pattern match: "https://fonts.googleapis.com/css?family=YouTube+Sans:500" Pattern match: "rsrc.php/v3/yD/r/MKQzjVd1bVq.png" Pattern match: "rsrc.php/v3/yL/r/unHwF9CkMyM.png" Pattern match: "NOFORMmicrosoft.com/102433237894403108561027971357230938743SRCHUIDV=2&GUID=426377958C8445E3B4EA69482BD0E747&dmnchg=1microsoft.com/102433237894403108561027971357230938743SRCHUSRDOB=20220131microsoft.com/102433237894403108561027971357230938743SRCHHPGUSRSRCHL" Pattern match: "IESS4Abing.com/1024294378944031085610419731758630938742SRCHUIDV=2&GUID=DD3EB05AD9C54D24A2443E918EB9AD6D&dmnchg=1bing.com/1024294378944031085610419731758630938742SRCHUSRDOB=20220131&T=1643622536000bing.com/1088404823347231085593429095039930938742bing.com/10" Pattern match: "5Xw0ZQUZybSbtOwzRQL1a3X0facebook.com/9217264864576031145690492177104310652420nPcsGnTFkHxB842s..BlNHzl.UN.AAA.0.0.BlNHzl.AWVJOK33wwEfacebook.com/9217110419161631083329109817710431065242_js_datr5Xw0ZbfoVhv1Z9q7dCU5fv0Ifacebook.com/108917472499231145723360948" Pattern match: "https://fonts.gstatic.com/s/roboto/v30/KFOmCnqEu92Fr1Mu4mxM.woff" Pattern match: "CONSENTWP.2676bayoutube.com/102431383388163210825482504061830633367hideBrowserUpgradeBoxtrueyoutube.com/921728791801603106804040767855831065243VISITOR_INFO1_LIVEqhnsPw9jWJQyoutube.com/921774129753631101434161480355831065243VISITOR_PRIVACY_METADATACgJVUxICG" Pattern match: "https://fonts.google.com/license/googlerestricted@font-face" Pattern match: "5Xw0ZQUZybSbtOwzRQL1a3X0facebook.com/9217264864576031145690492177104310652420nPcsGnTFkHxB842s..BlNHzl.UN.AAA.0.0.BlNH07.AWX9LZ0SyJofacebook.com/9217196419161631083329261390262631065338datr5Xw0ZbfoVhv1Z9q7dCU5fv0Ifacebook.com/9217350864576031145690261366825" Pattern match: "5Xw0ZQUZybSbtOwzRQL1a3X0facebook.com/9217264864576031145690492177104310652420nPcsGnTFkHxB842s..BlNHzl.UN.AAA.0.0.BlNHzl.AWVJOK33wwEfacebook.com/9217110419161631083329109817710431065242datr5Xw0ZbfoVhv1Z9q7dCU5fv0Ifacebook.com/9217350864576031145690261366825" Pattern match: "MUIDB1AD6AA1D5ACA62A3209CB9AF5B4E630Cwww.msn.com/921629787801631143679359494856831065289sptmarketen-us||us|en-us|en-us|en||RefA=CCB505AE21D24F6FB18A255C796C237B.RefC=2023-10-22T01:38:28Zwww.msn.com/1024242627430431212276360372981831065289" Pattern match: "CONSENTWP.2676bayoutube.com/102431383388163210825482504061830633367hideBrowserUpgradeBoxtrueyoutube.com/921728791801603106804040767855831065243VISITOR_INFO1_LIVEqhnsPw9jWJQyoutube.com/921774129753631101434161480355831065243" Pattern match: "-1QaxENO0ASlc7JuhRyzGqR-vG8-ecyemNDer-ByCMNG3g5BPOHGqA68LkWvUe73HXUjZOUgoogle.com/9217311601804831102037312715931031065262" Pattern match: "921629787801631143679359494856831065289MUID1AD6AA1D5ACA62A3209CB9AF5B4E630Cmsn.com/102529787801631143679329647981831065289USRLOCmsn.com/9217242627430431212276360388606831065289" Pattern match: "5Xw0ZQUZybSbtOwzRQL1a3X0facebook.com/9217264864576031145690492177104310652420nPcsGnTFkHxB842s..BlNHzl.UN.AAA.0.0.BlNHzl.AWVJOK33wwEfacebook.com/9217110419161631083329109817710431065242" Pattern match: "CONSENTWP.2676bayoutube.com/102431383388163210825482504061830633367hideBrowserUpgradeBoxtrueyoutube.com/921728791801603106804040767855831065243" Pattern match: "921629787801631143679359494856831065289MUID1AD6AA1D5ACA62A3209CB9AF5B4E630Cmsn.com/102529787801631143679329647981831065289" Pattern match: "qGZ1SjozwUdAYpQ8accounts.google.com/9217213470080031212075228721657731065339" Pattern match: "51M6UrEj4uizfWNjaccounts.google.com/9217120470080031212075146655065031065241" Pattern match: ".google.com/9217199470080031212075225166007031065327" Pattern match: "f3SshWCCatvOvBDKaccounts.google.com/9217119470080031212075116386315031065241" Pattern match: ".google.com/9217118470080031212075365708044631065240" Pattern match: "hwHI3ks23tAnKPI7accounts.google.com/921714447008003121207543419255531065258" Pattern match: "CheckConnectionTempCookie70652397accounts.youtube.com/accounts/2147484752139087936031065340129634303131065340" Pattern match: "MUIDB35AD4D4342E16210093B5EF143AD63FCieonline.microsoft.com/9216277878016311436793313461431065288" Pattern match: "TESTCOOKIESENABLEDaccounts.google.com/v3/signin/1088298813222431065256239538496031065256" Pattern match: "TESTCOOKIESENABLEDaccounts.google.com/v3/signin/108841571584031065335411515462231065334" Pattern match: "MUIDB1AD6AA1D5ACA62A3209CB9AF5B4E630Cwww.msn.com/921629787801631143679359494856831065289" Pattern match: "MUID1AD6AA1D5ACA62A3209CB9AF5B4E630Cmsn.com/102529787801631143679329647981831065289" Pattern match: "5Xw0ZQUZybSbtOwzRQL1a3X0facebook.com/921726486457603114569049217710431065242" Pattern match: "CONSENTWP.2676bayoutube.com/102431383388163210825482504061830633367" Pattern match: "nactkwww.msn.com/spartan/108834324326431367516156339216030633261" Heuristic match: "accounts.google.com" Heuristic match: "accounts.youtube.com" Heuristic match: "connect.facebook.net" Heuristic match: "facebook.com" Heuristic match: "fbcdn.net" Heuristic match: "fbsbx.com" Heuristic match: "fonts.googleapis.com" Heuristic match: "fonts.gstatic.com" Heuristic match: "play.google.com" Heuristic match: "static.xx.fbcdn.net" Pattern match: "www.facebook.com" Pattern match: "www.google.com" Pattern match: "www.gstatic.com" Pattern match: "www.youtube.com" Pattern match: "www.youtube.comDNT" Pattern match: "https://www.youtube.com/supported_browsers?next_url=https%3A%2F%2Fwww.youtube.com%2FStrict-Transport-Security" Pattern match: "www.youtube.comCookie" Pattern match: "https://csp.withgoogle.com/csp/report-to/youtube_main}]}P3P" Pattern match: "https://csp.withgoogle.com/csp/report-to/youtube-marketing}]}Content-Length" Pattern match: "https://www.youtube.com/supported_browsers?next_url=https%3A%2F%2Fwww.youtube.com%2FAccept-Language" Pattern match: "www.facebook.comConnection" Pattern match: "fb.me/p3pSet-Cookie" Pattern match: "https://*.fbsbx.com" Pattern match: "https://accounts.google.com/ServiceLogin?passive=1209600&continue=https%3A%2F%2Faccounts.google.com%2F&followup=https%3A%2F%2Faccounts.google.com%2FContent-Encoding" Pattern match: "https://accounts.google.com/InteractiveLogin?continue=https://accounts.google.com/&followup=https://accounts.google.com/&passive=1209600&ifkv=AVQVeyw6T5RNWRQ4EzCs8feXRx7chPuQws1P0-wtKhr1EQrRjvvfDBWWs9whSdkTxN3pB67n74EL0QStrict-Transport-Security" Pattern match: "accounts.google.com/x-ua-compatible" Pattern match: "https://www.google.com/favicon.icoStrict-Transport-Security" Pattern match: "https://accounts.google.com/Accept-Language" Pattern match: "https://csp.withgoogle.com/csp/report-to/AccountsSignInSignUpUi}]}Cross-Origin-Opener-Policy-Report-Only" Pattern match: "https://csp.withgoogle.com/csp/report-to/AccountsSignInUi}]}Permissions-Policy" Pattern match: "https://accounts.google.com/ServiceLogin?continue=https%3A%2F%2Faccounts.google.com%2F&flowEntry=ServiceLogin&flowName=GlifWebSignIn&followup=https%3A%2F%2Faccounts.google.com%2F&ifkv=AVQVeyxIlPfH-a1urYLCbJJ1OCyOYTIFSSjOrcte9PX-CVueRGRCbIRA2TFNdBycqvuWa_qf" Pattern match: "https://accounts.google.com/&flowEntry=ServiceLogin&flowName=GlifWebSignIn&followup=https://accounts.google.com/&ifkv=AVQVeyxIlPfH-a1urYLCbJJ1OCyOYTIFSSjOrcte9PX-CVueRGRCbIRA2TFNdBycqvuWa_qfcRvQ&theme=glif" Pattern match: "https://accounts.google.com/InteractiveLogin?continue=https://accounts.google.com/&flowEntry=ServiceLogin&flowName=GlifWebSignIn&followup=https://accounts.google.com/&ifkv=AVQVeyxIlPfH-a1urYLCbJJ1OCyOYTIFSSjOrcte9PX-CVueRGRCbIRA2TFNdBycqvuWa_qfcRvQ&theme=g" Pattern match: "https://accounts.google.com/v3/signin/identifier?continue=https%3A%2F%2Faccounts.google.com%2F&flowEntry=ServiceLogin&flowName=GlifWebSignIn&followup=https%3A%2F%2Faccounts.google.com%2F&ifkv=AVQVeyx8hHtv4AYLh0wYoEC13ATSq-CGPTmRXTlMtixKFhSjmob6f2BjwNAefj0B" Pattern match: "https://csp.withgoogle.com/csp/report-to/AccountsSignInUi}]}Content-Security-Policy" Pattern match: "https://csp.withgoogle.com/csp/boq-infra/identity-boq-js-css-signersCross-Origin-Resource-Policy" Pattern match: "https://csp.withgoogle.com/csp/apps-themesCross-Origin-Resource-Policy" Pattern match: "rsrc.php/v3/y9/l/0,cross/2W2z89vRC58.css?_nc_x=Ij3Wp8lg5Kz" Pattern match: "rsrc.php/v3/yX/l/0,cross/fpMCwgcFvo4.css?_nc_x=Ij3Wp8lg5Kz" Pattern match: "rsrc.php/v3/ya/l/0,cross/EQ0cyse2DGv.css?_nc_x=Ij3Wp8lg5Kz" Pattern match: "rsrc.php/v3/yy/l/0,cross/wYnUPpbC_DL.css?_nc_x=Ij3Wp8lg5Kz" Pattern match: "rsrc.php/v3/y8/r/RNFuSb7tdaZ.js?_nc_x=Ij3Wp8lg5Kz" Pattern match: "Y-.YU/Ҍc]�'�Ī�*" Pattern match: "https://www.facebook.com/loginAccept-Language" Pattern match: "rsrc.php/v3/yh/r/bpW4eEg-2_W.js?_nc_x=Ij3Wp8lg5Kz" Pattern match: "rsrc.php/v3i7M54/ya/l/en_US/kzikDtJjAjw.js?_nc_x=Ij3Wp8lg5Kz" Pattern match: "rsrc.php/v3/yl/r/BQn1Lzzcmjv.js?_nc_x=Ij3Wp8lg5Kz" Pattern match: "rsrc.php/v3/yM/r/SeW64FDUgJN.js?_nc_x=Ij3Wp8lg5Kz" Pattern match: "rsrc.php/v3/yG/r/rAl2Hl1fQTa.js?_nc_x=Ij3Wp8lg5Kz" Pattern match: "rsrc.php/v3/yU/r/O7nelmd9XSI.png" Pattern match: "rsrc.php/yb/r/hLRJ1GG_y0J.ico" Pattern match: "rsrc.php/v3/yB/r/Y0L6f5sxdIV.png" Pattern match: "rsrc.php/v3/yw/r/wm4d5zAAo-a.js?_nc_x=Ij3Wp8lg5Kz" Pattern match: "rsrc.php/v3/y1/r/dXk5exdOVhk.js?_nc_x=Ij3Wp8lg5Kz" Pattern match: "rsrc.php/v3/yt/r/d4QqVJOdC1V.js?_nc_x=Ij3Wp8lg5Kz" Pattern match: "rsrc.php/v3/yw/r/TOgyZUwZTqd.js?_nc_x=Ij3Wp8lg5Kz" Pattern match: "rsrc.php/v3/yq/r/C9n9XTZa3H8.js?_nc_x=Ij3Wp8lg5Kz" Pattern match: "rsrc.php/v3/yj/r/MAz3ivwtIyN.js?_nc_x=Ij3Wp8lg5Kz" Pattern match: "rsrc.php/v3/y1/r/P8DLAFRlDfy.js?_nc_x=Ij3Wp8lg5Kz" Pattern match: "rsrc.php/v3/ys/r/xEUODc7mbZF.js?_nc_x=Ij3Wp8lg5Kz" Pattern match: "rsrc.php/v3/yt/r/zI56j6esQGz.js?_nc_x=Ij3Wp8lg5Kz" Pattern match: "rsrc.php/v3/yf/r/LgvwffuKmeX.js?_nc_x=Ij3Wp8lg5Kz" Pattern match: "rsrc.php/v3/yO/r/_tJ17sGyxOX.js?_nc_x=Ij3Wp8lg5Kz" Pattern match: "rsrc.php/v3/yP/r/bisOS4dl-mS.js?_nc_x=Ij3Wp8lg5Kz" Pattern match: "rsrc.php/v3ihVQ4/yp/l/en_US/M_qt8gV3koE.js?_nc_x=Ij3Wp8lg5Kz" Pattern match: "rsrc.php/v3/yo/r/xqvNY4MTESs.js?_nc_x=Ij3Wp8lg5Kz" Pattern match: "rsrc.php/v3/yt/r/jIUN0Hn2kpD.js?_nc_x=Ij3Wp8lg5Kz" Pattern match: "rsrc.php/v3/y7/r/QJ_ErdZuyUE.js?_nc_x=Ij3Wp8lg5Kz" Pattern match: "rsrc.php/v3/y2/r/O287_AcFyg4.png" Pattern match: "https://www.facebook.com/login/device-based/regular/login/?login_attempt=1&lwv=100Accept-Language" Pattern match: "https://fbcdn.net/security/hsts-pixel.gif?c=2.5reporting-endpoints" Pattern match: "https://connect.facebook.net/security/hsts-pixel.gifreporting-endpoints" Pattern match: "https://fbsbx.com/security/hsts-pixel.gif?c=5reporting-endpoints" Pattern match: "https://csp.withgoogle.com/csp/report-to/static-on-bigtable}]}Content-Length" Pattern match: "https://accounts.google.comContent-Security-Policy" Pattern match: "https://csp.withgoogle.com/csp/report-to/AccountsSignInSignUpUi}]}Permissions-Policy" Pattern match: "https://accounts.google.comAccess-Control-Request-Method" Pattern match: "https://accounts.google.comAccess-Control-Allow-Methods" Pattern match: "accounts.google.com/v3/signin/identifier\,null,[\\],0]],\-1673957322464046599\,3,[null,\S2114035212:1697938657160250\]],null,null,null,null,null,null,-7200,null,null,null,null,[],1,null,null,null,null,null,[]],[1697952618000,null,[],null,null,nul" Pattern match: "g.co/p3phelp" Pattern match: "https://accounts.google.comCross-Origin-Resource-Policy" Pattern match: "accounts.google.com/v3/signin/identifier\,null,[\\],0]],\9210110154298667206\,3,[null,\S2097582914:1697938736438973\]],null,null,null,null,null,null,-7200,null,null,null,null,[],1,null,null,null,null,null,[]],[1697988041000,null,[],null,null,null" Pattern match: "https://accounts.google.com/v3/signin/" Pattern match: "https://www.gstatic.com/_/mss/boq-identity/_/ss/k=boq-identity.AccountsSignInUi.8dPAf41KP2A.L.B1.O/am=DmBFZI4NgOD_oonn7xknhwEAAAAAAAAAANZAdg/d=1/ed=1/rs=AOaEmlFu7so_cG35thTT-KKqKIyGIgUn8w/m=identifierview,_b,_tp" Pattern match: "fonts.gstatic.com/s/productsans/v9/pxiDypQkot1TnFhsFMOfGShVGdeOYktMqlap.woff2" Pattern match: "https://www.gstatic.com/_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en_US.C6tNd3FBrA8.es5.O/am=DmBFZI4NgOD_oonn7xknhwEAAAAAAAAAANZAdg/d=1/excm=_b,_tp,identifierview/ed=1/dg=0/wt=2/ujg=1/rs=AOaEmlHK_6NZi0yeSin1ommAktmAN0EneA/m=_b,_tp" Pattern match: "fonts.gstatic.com/s/roboto/v18/KFOkCnqEu92Fr1MmgVxFIzIXKMnyrYk.woff2" Pattern match: "https://accounts.google.com/AccountChooser?continue\u003dhttps://accounts.google.com/\u0026followup\u003dhttps://accounts.google.com/],[null,[null,null,https://accounts.google.com/Logout?continue\u003dhttps://accounts.google.com/restart?continue%3Dhttps:" Pattern match: "https://www.gstatic.com/_/mss/boq-identity/_/ss/k=boq-identity.AccountsSignInUi.QUjh89dKB-E.L.I11.O/am=DmBFJI4NgOD_oonn7xknhwEAAAAAAAAAANZAdg/d=1/ed=1/rs=AOaEmlEs3ytxL6hfwA-YD0CWz74eke7d0g/m=identifierview,_b,_tp" Pattern match: "fonts.gstatic.com/s/productsans/v9/pxiDypQkot1TnFhsFMOfGShVF9eI.woff" Pattern match: "https://www.gstatic.com/_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en_US.C6tNd3FBrA8.es5.O/am=DmBFJI4NgOD_oonn7xknhwEAAAAAAAAAANZAdg/d=1/excm=_b,_tp,identifierview/ed=1/dg=0/wt=2/ujg=1/rs=AOaEmlHlvGH0uOdIItMZ5p_iAU8jYD9fsA/m=_b,_tp" Pattern match: "fonts.gstatic.com/s/roboto/v18/KFOkCnqEu92Fr1MmgVxIIzQ.woff" Pattern match: "https://www.youtube.com" Pattern match: "https://accounts.google.com" Pattern match: "www.youtube.com\//g" Pattern match: "https://www.youtube.com/error_204?t=jserror&level=ERROR" Pattern match: "https://www.youtube.com/s/desktop/b926992e/img/favicon.ico" Pattern match: "https://i.ytimg.com/generate_204" Pattern match: "https://www.youtube.com/s/desktop/b926992e/jsbin/scheduler.vflset/scheduler.js" Pattern match: "https://www.youtube.com/s/desktop/b926992e/jsbin/network.vflset/network.js" Pattern match: "https://www.youtube.com/s/desktop/b926992e/cssbin/www-main-desktop-watch-page-skeleton.css" Pattern match: "com.google.android.gms/com.google.android.gms.kids.account.receiver.ProfileOwnerReceiver,com.google.android.gms.supervision/com.google.android.gms.kids.account.receiver.ProfileOwnerReceiver" Pattern match: "https://www.google.com/log?format=json&hasfast=true:https://play.google.com/log?format=json&hasfast=true" Pattern match: "https://play.google.com/log?format=json&hasfast=true;this.Ma=!0;this.Ja=!1;this.Qg=;this.oa=this.aa=this.da=!1;this.network=new" Pattern match: "https://policies.google.com/terms+(f?/embedded:)+?hl=+_.rz(d)+&gl=+_.rz(c)+" Pattern match: "https://policies.google.com/privacy+(f?/embedded:)+?hl=+_.rz(d)+&gl=+_.rz(c)+(g?&color_scheme=+_.rz(g):)+((null==e?0:e.X9)?#infocollect:);break;case" Pattern match: "https://play.google.com/intl/+_.rz(l)+/about/play-terms/embedded/+(g??color_scheme=+_.rz(g):);break;case" Pattern match: "https://www.youtube.com/t/terms?chromeless=1&hl=+_.rz(l);break;case" Pattern match: "https://policies.google.com/privacy+(f?/embedded:)+?hl=+_.rz(d)+&gl=+_.rz(c)+(g?&color_scheme=+_.rz(g):)+#inforetaining;break;case" Pattern match: "https://policies.google.com/privacy/additional+(f?/embedded:)+?hl=+_.rz(d)+&gl=jp+(g?&color_scheme=+_.rz(g):);break;case" Pattern match: "http://+this.ea.substring(this.Ca.length)" Pattern match: "http://www.w3.org/XML/1998/namespace:0===b.lastIndexOf(xlink:,0)?http://www.w3.org/1999/xlink:null" Pattern match: "http://www.w3.org/2000/svg:math===a?http://www.w3.org/1998/Math/MathML:null==d||foreignObject===IB(d).da?null:d.namespaceURI" Pattern match: "https://www.w3.org/2000/svg'+" Pattern match: "https://www.gstatic.com/images/branding/product/2x/chrome_48dp.png" Pattern match: "https://fonts.gstatic.com/s/i/productlogos/drive_2020q4/v10/192px.svg" Pattern match: "https://www.gstatic.com/images/branding/product/2x/gsa_48dp.png" Pattern match: "https://fonts.gstatic.com/s/i/productlogos/gmail_2020q4/v10/web-48dp/logo_gmail_2020q4_color_2x_web_48dp.png" Pattern match: "https://www.gstatic.com/images/branding/product/2x/play_prism_48dp.png" Pattern match: "https://ssl.gstatic.com/accounts/animation/+_.sz" Pattern match: "https://ssl.gstatic.com/accounts/embedded/security_key_laptop.gif" Pattern match: "https://ssl.gstatic.com/accounts/embedded/security_key.gif" Pattern match: "https://ssl.gstatic.com/accounts/embedded/security_key_nfc_discovered.gif" Pattern match: "https://ssl.gstatic.com/accounts/embedded/security_key_phone.gif" Pattern match: "https://ssl.gstatic.com/accounts/embedded/security_key_ios_center.png" Pattern match: "https://ssl.gstatic.com/accounts/embedded/ble_device.png" Pattern match: "https://ssl.gstatic.com/accounts/embedded/ble_pin.png" Pattern match: "https://ssl.gstatic.com/accounts/embedded/usb_key.svg" Pattern match: "https://ssl.gstatic.com/accounts/marc/security_key_phone.svg" Pattern match: "https://ssl.gstatic.com/accounts/marc/paaskey.svg" Pattern match: "https://ssl.gstatic.com/accounts/marc/passkey_challenge.svg" Pattern match: "https://ssl.gstatic.com/accounts/marc/passkey_enrollment.svg" Pattern match: "https://ssl.gstatic.com/accounts/marc/passkey_enrollment_cross_device.svg" Pattern match: "https://ssl.gstatic.com/accounts/marc/passkey_enrollment_reauth.svg" Pattern match: "https://ssl.gstatic.com/accounts/marc/passkey_enrollment_error.svg" Pattern match: "https://ssl.gstatic.com/accounts/marc/passkeyerror.svg" Pattern match: "https://ssl.gstatic.com/accounts/marc/passkey_success.svg" Pattern match: "https://ssl.gstatic.com/accounts/marc/security_keys.svg" Pattern match: "https://ssl.gstatic.com/accounts/marc/security_key_ipad.gif" Pattern match: "https://ssl.gstatic.com/accounts/marc/security_key_iphone.gif" Pattern match: "https://ssl.gstatic.com/accounts/marc/security_key_iphone_nfc.gif" Pattern match: "https://ssl.gstatic.com/accounts/marc/security_key_iphone_usb.gif" Pattern match: "https://ssl.gstatic.com/accounts/marc/success_checkmark_2.svg" Pattern match: "https://ssl.gstatic.com/accounts/embedded/smart_lock_2x.png" Pattern match: "https://ssl.gstatic.com/accounts/account-recovery-password.svg" Pattern match: "https://ssl.gstatic.com/accounts/account-recovery-email-pin.gif" Pattern match: "https://www.gstatic.com/accounts/speedbump/authzen_optin_illustration.gif" Pattern match: "https://ssl.gstatic.com/images/hpp/shield_security_checkup_green_2x_web_96dp.png" Pattern match: "https://ssl.gstatic.com/accounts/embedded/kidfork_who_will_use.svg" Pattern match: "https://ssl.gstatic.com/accounts/embedded/kidfork_who_will_use_updated.svg" Pattern match: "https://ssl.gstatic.com/kids/images/ulpupgrade/kidprofileupgrade_all_set.svg" Pattern match: "https://ssl.gstatic.com/accounts/embedded/kidsignin_not_ready.png" Pattern match: "https://ssl.gstatic.com/accounts/embedded/kidsignin_stick_around.svg" Pattern match: "https://ssl.gstatic.com/accounts/embedded/kidsignup_single_device.svg" Pattern match: "https://ssl.gstatic.com/accounts/embedded/kidsignup_double_device.svg" Pattern match: "https://ssl.gstatic.com/accounts/embedded/kidsignup_full_house.png" Pattern match: "https://ssl.gstatic.com/accounts/embedded/kidsignup_stop.png" Pattern match: "https://ssl.gstatic.com/accounts/embedded/kidsignup_child_account.svg" Pattern match: "https://ssl.gstatic.com/accounts/embedded/kidsignup_child_privacy.svg" Pattern match: "https://ssl.gstatic.com/accounts/embedded/kidsignup_created.png" Pattern match: "https://ssl.gstatic.com/accounts/embedded/kidsignup_link_accounts.svg" Pattern match: "https://ssl.gstatic.com/accounts/embedded/kidsignup_parent_app_decision.svg" Pattern match: "https://ssl.gstatic.com/accounts/embedded/kidsignup_parent_supervision.svg" Pattern match: "https://ssl.gstatic.com/accounts/embedded/kidsignup_respect_others_updated.svg" Pattern match: "https://ssl.gstatic.com/kids/onboarding/illustrations/supervision_ready_v2.svg" Pattern match: "https://ssl.gstatic.com/kids/onboarding/illustrations/hand_over_device.svg" Pattern match: "https://ssl.gstatic.com/kids/onboarding/illustrations/devices_connected_v2.svg" Pattern match: "https://ssl.gstatic.com/kids/onboarding/illustrations/devices_connected_tablet_v2.svg" Pattern match: "https://ssl.gstatic.com/kids/onboarding/illustrations/set_up_kids_space.png" Pattern match: "https://ssl.gstatic.com/kids/onboarding/illustrations/almost_done_kids_space_v2.svg" Pattern match: "https://ssl.gstatic.com/kids/onboarding/illustrations/all_set.svg" Pattern match: "https://ssl.gstatic.com/kids/onboarding/illustrations/linking_accounts_v2.svg" Pattern match: "https://ssl.gstatic.com/kids/onboarding/illustrations/parents_help.svg" Pattern match: "https://ssl.gstatic.com/kids/onboarding/illustrations/manage_parental_controls_v2.svg" Pattern match: "https://ssl.gstatic.com/kids/onboarding/illustrations/manage_parental_controls_email_v2.svg" Pattern match: "https://ssl.gstatic.com/kids/onboarding/illustrations/open_family_link_v2.svg" Pattern match: "https://ssl.gstatic.com/kids/images/onboarding/installing_family_link_0.svg" Pattern match: "https://ssl.gstatic.com/kids/images/onboarding/location_sharing_enabled_0.svg" Pattern match: "https://ssl.gstatic.com/kids/images/onboarding/parent_sign_in_prologue_0.svg" Pattern match: "https://ssl.gstatic.com/kids/images/onboarding/set_up_contacts_0.svg" Pattern match: "https://ssl.gstatic.com/kids/images/onboarding/set_up_family_link_0.svg" Pattern match: "https://ssl.gstatic.com/kids/images/onboarding/set_up_location_sharing_0.svg" Pattern match: "https://ssl.gstatic.com/kids/images/onboarding/set_up_parental_controls_0.svg" Pattern match: "https://ssl.gstatic.com/kids/images/onboarding/set_up_school_time_0.svg" Pattern match: "https://ssl.gstatic.com/accounts/embedded/device_prompt_tap_yes.gif" Pattern match: "https://ssl.gstatic.com/accounts/embedded/signin_tapyes.gif" Pattern match: "https://ssl.gstatic.com/accounts/marc/gmail_ios_authzen.gif" Pattern match: "https://ssl.gstatic.com/accounts/embedded/signin_googleapp_ios.gif" Pattern match: "https://ssl.gstatic.com/accounts/embedded/signin_googleapp_pulldown.gif" Pattern match: "https://ssl.gstatic.com/accounts/marc/screenlock.png" Pattern match: "https://ssl.gstatic.com/accounts/account-recovery-sms-pin.gif" Pattern match: "https://ssl.gstatic.com/accounts/account-recovery-sms-or-voice-pin.gif" Pattern match: "https://ssl.gstatic.com/accounts/account-recovery-stop-go-landing-page_1x.png" Pattern match: "https://ssl.gstatic.com/accounts/ui/progress_spinner_color_20dp_4x.gif" Pattern match: "https://ssl.gstatic.com/accounts/ui/success-gm-default_2x.png" Pattern match: "https://ssl.gstatic.com/accounts/embedded/continue_on_your_phone.png" Pattern match: "https://ssl.gstatic.com/accounts/embedded/device_phone_number_verification.png" Pattern match: "https://ssl.gstatic.com/accounts/embedded/phone_number_sign_in_2x.png" Pattern match: "https://ssl.gstatic.com/accounts/ui/loading_spinner_gm.gif" Pattern match: "https://ssl.gstatic.com/accounts/embedded/contacts_backup_sync.png" Pattern match: "https://ssl.gstatic.com/accounts/embedded/contacts_backup_sync_1x.png" Pattern match: "https://ssl.gstatic.com/accounts/embedded/contacts_backup_sync_2x.png" Pattern match: "https://ssl.gstatic.com/accounts/embedded/web_and_app_activity.svg" Pattern match: "https://ssl.gstatic.com/accounts/embedded/you_tube_history.svg" Pattern match: "https://ssl.gstatic.com/accounts/embedded/personalization_reminders.svg" Pattern match: "https://ssl.gstatic.com/accounts/embedded/who_will_be_using_this_device.svg" Pattern match: "https://ssl.gstatic.com/kids/images/ulp_appblock/kid_setup_parent_escalation.svg" Pattern match: "https://ssl.gstatic.com/kids/images/ulp_appblock/success_sent_email.svg" Pattern match: "https://ssl.gstatic.com/kids/images/ulp_appblock/send_email_confirmation.svg" Pattern match: "https://ssl.gstatic.com/accounts/embedded/kid_success.svg" Pattern match: "https://ssl.gstatic.com/kids/images/minormodeexit/intro.svg" Pattern match: "https://ssl.gstatic.com/kids/images/minormodeexit/fork.svg" Pattern match: "https://ssl.gstatic.com/kids/images/minormodeexit/ads_personalization.svg" Pattern match: "https://ssl.gstatic.com/kids/images/minormodeexit/personal_results.svg" Pattern match: "https://ssl.gstatic.com/kids/images/minormodeexit/safe_search.svg" Pattern match: "https://ssl.gstatic.com/kids/images/minormodeexit/confirmation.svg" Pattern match: "https://ssl.gstatic.com/kids/images/minormodeexit/eligibility_error.svg" Pattern match: "https://ssl.gstatic.com/kids/images/graduation/graduation_apps_devices.svg" Pattern match: "https://ssl.gstatic.com/kids/images/graduation/graduation_choose_apps.svg" Pattern match: "https://ssl.gstatic.com/kids/images/graduation/graduation_confirmation.svg" Pattern match: "https://ssl.gstatic.com/kids/images/graduation/graduation_intro.svg" Pattern match: "https://ssl.gstatic.com/kids/images/graduation/graduation_review_settings.svg" Pattern match: "https://ssl.gstatic.com/kids/images/graduation/graduation_safe_search.svg" Pattern match: "https://ssl.gstatic.com/kids/images/graduation/graduation_supervision_choice.svg" Pattern match: "https://ssl.gstatic.com/kids/images/chaptering/account_setup_chapter.svg" Pattern match: "https://ssl.gstatic.com/kids/images/chaptering/device_setup_chapter.svg" Pattern match: "https://ssl.gstatic.com/kids/images/chaptering/parental_control_chapter.svg" Pattern match: "https://www.w3.org/2000/svg" Pattern match: "https://accounts.google.com/TOS?loc=+_.rz(a.zW)+&hl=+_.rz(b)+&privacy=true" Pattern match: "https://support.google.com/websearch/answer/4358949?hl=ko&ref_topic=3285072" Pattern match: "https://www.gstatic.com/images/branding/product/2x/youtube_48dp.png" Pattern match: "https://fonts.gstatic.com/s/i/productlogos/maps/v7/192px.svg" Pattern match: "https://ssl.gstatic.com/kids/onboarding/illustrations/manage_parental_controls_email.svg" Pattern match: "https://g.co/recover" Pattern match: "https://play.google.com/work/enroll?identifier=+_.gi(a)" Pattern match: "a.rb/1E3/c,this.da=-1==this.da?a:.3*a+.7*this.da" Heuristic match: "accoune_.goog__.com" Heuristic match: "7 ).DK"53:T5b8,file/memory contains long string with (Indicator: "HTTP/1.1"; File: "SSL") Found string "GET /login HTTP/1.1Accept: text/html, application/xhtml+xml, */*User-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateDNT: 1Host: www.facebook.comConnection: Keep-AliveAccept-Language: en-US" (Indicator: "HTTP/1.1"; File: "SSL") Found string "GET / HTTP/1.1Accept: text/html, application/xhtml+xml, */*User-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateDNT: 1Host: accounts.google.comConnection: Keep-AliveAccept-Language: en-US" (Indicator: "HTTP/1.1"; File: "SSL") Found string "HTTP/1.1 304 Not ModifiedDate: Fri, 20 Oct 2023 11:41:29 GMTExpires: Sat, 19 Oct 2024 11:41:29 GMTAge: 136578Last-Modified: Mon, 16 Oct 2017 17:32:56 GMTCache-Control: public, max-age=31536000Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000" (Indicator: "HTTP/1.1"; File: "SSL") Found string "GET /rsrc.php/yb/r/hLRJ1GG_y0J.ico HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoHost: static.xx.fbcdn.netDNT: 1Connection: Keep-Alive" (Indicator: "HTTP/1.1"; File: "SSL") Found string "GET /favicon.ico HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoDNT: 1Connection: Keep-AliveHost: www.google.com" (Indicator: "HTTP/1.1"; File: "SSL")54:T428,"file.exe" called "FindFirstFileW" with parameter %TEMP%\IXP000.TMP\*.* (UID: 00000000-00000928) "file.exe" called "FindNextFileW" with parameter .. (UID: 00000000-00000928) "file.exe" called "FindNextFileW" with parameter 6Um8bf3.exe (UID: 00000000-00000928) "file.exe" called "FindNextFileW" with parameter xX1Zl63.exe (UID: 00000000-00000928) "file.exe" called "FindFirstFileA" with parameter %TEMP%\IXP000.TMP\* (UID: 00000000-00000928) "file.exe" called "FindNextFileA" with parameter .. (UID: 00000000-00000928) "xX1Zl63.exe" called "FindFirstFileW" with parameter %TEMP%\IXP001.TMP\*.* (UID: 00000000-00002736) "xX1Zl63.exe" called "FindNextFileW" with parameter .. (UID: 00000000-00002736) "xX1Zl63.exe" called "FindNextFileW" with parameter 5ol2yF2.exe (UID: 00000000-00002736) "xX1Zl63.exe" called "FindNextFileW" with parameter VW6ig05.exe (UID: 00000000-00002736) "xX1Zl63.exe" called "FindFirstFileA" with parameter %TEMP%\IXP001.TMP\* (UID: 00000000-00002736) "xX1Zl63.exe" called "FindNextFileA" with parameter .. (UID: 00000000-00002736)55:T4cf,Found string "{QAES" (Indicator: "aes"; File: "file") file/memory contains long string with (Indicator: "base64"; File: "zI56j6esQGz_1_.js") file/memory contains long string with (Indicator: ".decrypt"; File: "_tJ17sGyxOX_1_.js") file/memory contains long string with (Indicator: ".encrypt"; File: "_tJ17sGyxOX_1_.js") file/memory contains long string with (Indicator: "base64"; File: "_tJ17sGyxOX_1_.js") file/memory contains long string with (Indicator: "blowfish"; File: "_tJ17sGyxOX_1_.js") file/memory contains long string with (Indicator: "aes"; File: "SSL") file/memory contains long string with (Indicator: "base64"; File: "identifier_1_.htm") file/memory contains long string with (Indicator: "base64"; File: "IVHZVIUP.js") file/memory contains long string with (Indicator: "aes"; File: "IVHZVIUP.js") Found string "system.security.cryptography.csp.dll" (Indicator: "System.Security.Cryptography"; Source: "00000000-00000876.00000000.67434.003C0000.00000004.mdmp") Found string "system.io.compression.zipfile.dll" (Indicator: "zipfile"; Source: "00000000-00000876.00000000.67434.003C0000.00000004.mdmp") Found string "{QAES" (Indicator: "aes"; Source: "00000000-00000928.00000000.66890.00C9A000.00000002.mdmp")56:T778,Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; File: "file") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; File: "file") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; File: "file") Found reference to API "GetModuleHandleExW" (Indicator: "GetModuleHandle"; File: "2St5480.exe.1666954272") Found reference to API "GetEnvironmentStringsW" (Indicator: "GetEnvironmentStrings"; File: "2St5480.exe.1666954272") Found reference to API "GetModuleHandleA" (Indicator: "GetModuleHandle"; File: "explothe.exe.322908262") Found reference to API "GetCurrentProcessorNumber" (Indicator: "GetCurrentProcess"; Source: "00000000-00000876.00000000.67434.00D99000.00000002.mdmp") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00000876.00000000.67434.00D99000.00000002.mdmp") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; Source: "00000000-00000876.00000000.67434.00D99000.00000002.mdmp") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; Source: "00000000-00000876.00000000.67434.00D99000.00000002.mdmp") Found reference to API "GetModuleHandleExW" (Indicator: "GetModuleHandle"; Source: "00000000-00000876.00000000.67434.00D99000.00000002.mdmp") Found reference to API "GetEnvironmentStringsW" (Indicator: "GetEnvironmentStrings"; Source: "00000000-00000876.00000000.67434.00D99000.00000002.mdmp") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; Source: "00000000-00000928.00000000.66890.00C9A000.00000002.mdmp") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00000928.00000000.66890.00C9A000.00000002.mdmp") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; Source: "00000000-00000928.00000000.66890.00C9A000.00000002.mdmp")57:T427,Found reference to API "GetProcAddress" (Indicator: "GetProcAddress"; File: "file") Found reference to API "Error loading %shGetProcAddress() failed on function '%s'. Possible reason: incorrect version of advpack.dll being used./Windows 95 or Windows NT is required to install" (Indicator: "GetProcAddress"; File: "file") Found reference to API "GetProcAddress" (Indicator: "GetProcAddress"; Source: "00000000-00000876.00000000.67434.00D99000.00000002.mdmp") Found reference to API "GetProcAddress" (Indicator: "GetProcAddress"; Source: "00000000-00000928.00000000.66890.00070000.00000004.mdmp, 00000000-00000928.00000000.66890.00C9A000.00000002.mdmp, 00000000-00000928.00000001.68810.00070000.00000004.mdmp, 00000000-00000928.00000002.70098.00070000.00000004.mdmp") Found reference to API "Error loading %shGetProcAddress() failed on function '%s'. Possible reason: incorrect version of advpack.dll being used./Windows 95 or Windows NT is required to install" (Indicator: "GetProcAddress"; Source: "00000000-00000928.00000000.66890.00C9A000.00000002.mdmp")58:Ta9c,Found reference to API "GetFileAttributesA" (Indicator: "GetFileAttributes"; File: "file") Found reference to API "GetSystemDirectoryA" (Indicator: "GetSystemDirectory"; File: "file") Found reference to API "GetCurrentDirectoryA" (Indicator: "GetCurrentDirectory"; File: "file") Found reference to API "GetTempPathA" (Indicator: "GetTempPath"; File: "file") Found reference to API "GetTempFileNameA" (Indicator: "GetTempFileName"; File: "file") Found reference to API "GetFileVersionInfoSizeA" (Indicator: "GetFileVersionInfo"; File: "file") Found reference to API "GetFileVersionInfoSizeA" (Indicator: "GetFileVersionInfoSize"; File: "file") Found reference to API "GetFileVersionInfoA" (Indicator: "GetFileVersionInfo"; File: "file") Found reference to API "GetFileInformationByHandle" (Indicator: "GetFileInformationByHandle"; File: "explothe.exe.322908262") Found reference to API "GetCurrentDirectoryW" (Indicator: "GetCurrentDirectory"; File: "explothe.exe.322908262") Found reference to API "GetTempPath2W" (Indicator: "GetTempPath"; Source: "00000000-00000876.00000000.67426.00D7A000.00000002.mdmp") Found reference to API "GetTempPathW" (Indicator: "GetTempPath"; Source: "00000000-00000876.00000000.67434.00D99000.00000002.mdmp") Found reference to API "GetFileInformationByHandleEx" (Indicator: "GetFileInformationByHandle"; Source: "00000000-00000876.00000000.67434.00D99000.00000002.mdmp") Found reference to API "GetFileSizeEx" (Indicator: "GetFileSize"; Source: "00000000-00000876.00000000.67434.00D99000.00000002.mdmp") Found reference to API "GetFileAttributesA" (Indicator: "GetFileAttributes"; Source: "00000000-00000928.00000000.66890.00C9A000.00000002.mdmp") Found reference to API "GetSystemDirectoryA" (Indicator: "GetSystemDirectory"; Source: "00000000-00000928.00000000.66890.00C9A000.00000002.mdmp") Found reference to API "GetCurrentDirectoryA" (Indicator: "GetCurrentDirectory"; Source: "00000000-00000928.00000000.66890.00C9A000.00000002.mdmp") Found reference to API "GetTempPathA" (Indicator: "GetTempPath"; Source: "00000000-00000928.00000000.66890.00C9A000.00000002.mdmp") Found reference to API "GetTempFileNameA" (Indicator: "GetTempFileName"; Source: "00000000-00000928.00000000.66890.00C9A000.00000002.mdmp") Found reference to API "GetFileVersionInfoSizeA" (Indicator: "GetFileVersionInfo"; Source: "00000000-00000928.00000000.66890.00C9A000.00000002.mdmp") Found reference to API "GetFileVersionInfoSizeA" (Indicator: "GetFileVersionInfoSize"; Source: "00000000-00000928.00000000.66890.00C9A000.00000002.mdmp") Found reference to API "GetFileVersionInfoA" (Indicator: "GetFileVersionInfo"; Source: "00000000-00000928.00000000.66890.00C9A000.00000002.mdmp")59:T4c2,Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; File: "file") Found reference to API "OpenProcessToken" (Indicator: "OpenProcessToken"; File: "file") file/memory contains long string with (Indicator: "OpenProcessToken"; File: "file") Found reference to API "LookupAccountNameA" (Indicator: "LookupAccountName"; File: "explothe.exe.322908262") Found reference to API "GetUserNameA" (Indicator: "GetUserName"; File: "explothe.exe.322908262") Found reference to API "GetProcessWindowStation" (Indicator: "GetProcessWindowStation"; Source: "00000000-00000876.00000000.67426.00D7A000.00000002.mdmp") Found reference to API "GetUserObjectInformationW" (Indicator: "GetUserObjectInformation"; Source: "00000000-00000876.00000000.67426.00D7A000.00000002.mdmp") file/memory contains long string with (Indicator: "OpenProcessToken"; Source: "00000000-00000928.00000000.66890.00C9A000.00000002.mdmp") Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; Source: "00000000-00000928.00000000.66890.00C9A000.00000002.mdmp") Found reference to API "OpenProcessToken" (Indicator: "OpenProcessToken"; Source: "00000000-00000928.00000000.66890.00C9A000.00000002.mdmp")5a:Tb42,Found string "\Windows\System32\DriverStore" (Indicator: "system32\drivers"; Source: "00000000-00000876.00000000.67434.003C0000.00000004.mdmp") Found string ":\Windows\System32\DriverStore\infpub.dat" (Indicator: "system32\drivers"; Source: "00000000-00000876.00000000.67434.003C0000.00000004.mdmp") Found string "indows\System32\DriverStore\infstor.dat" (Indicator: "system32\drivers"; Source: "00000000-00000876.00000000.67434.003C0000.00000004.mdmp") Found string ":\Windows\System32\DriverStore\infstrng.dat" (Indicator: "system32\drivers"; Source: "00000000-00000876.00000000.67434.003C0000.00000004.mdmp") Found string ":\Windows\System32\DriverStore\drvindex.dat" (Indicator: "system32\drivers"; Source: "00000000-00000876.00000000.67434.003C0000.00000004.mdmp") Found string "indows\System32\DriverStore\FileRepository" (Indicator: "system32\drivers"; Source: "00000000-00000876.00000000.67434.003C0000.00000004.mdmp") Found string "\Device\HarddiskVolume2\Users\HAPUBWS\AppData\Local\Temp\IXP003.TMP\3Fs87VT.exe" (Indicator: "\Device\"; Source: "00000000-00000876.00000000.67434.003C0000.00000004.mdmp") Found string ":\Windows\System32\DriverStore" (Indicator: "system32\drivers"; Source: "00000000-00000928.00000000.66890.00070000.00000004.mdmp, 00000000-00000928.00000001.68810.00070000.00000004.mdmp, 00000000-00000928.00000002.70098.00070000.00000004.mdmp") Found string ":\Windows\System32\DriverStore\infpub.dat" (Indicator: "system32\drivers"; Source: "00000000-00000928.00000000.66890.00070000.00000004.mdmp, 00000000-00000928.00000001.68810.00070000.00000004.mdmp, 00000000-00000928.00000002.70098.00070000.00000004.mdmp") Found string ":\Windows\System32\DriverStore\infstor.dat" (Indicator: "system32\drivers"; Source: "00000000-00000928.00000000.66890.00070000.00000004.mdmp, 00000000-00000928.00000001.68810.00070000.00000004.mdmp") Found string ":\Windows\System32\DriverStore\infstrng.dat" (Indicator: "system32\drivers"; Source: "00000000-00000928.00000000.66890.00070000.00000004.mdmp, 00000000-00000928.00000001.68810.00070000.00000004.mdmp, 00000000-00000928.00000002.70098.00070000.00000004.mdmp") Found string ":\Windows\System32\DriverStore\drvindex.dat" (Indicator: "system32\drivers"; Source: "00000000-00000928.00000000.66890.00070000.00000004.mdmp, 00000000-00000928.00000001.68810.00070000.00000004.mdmp, 00000000-00000928.00000002.70098.00070000.00000004.mdmp") Found string ":\Windows\System32\DriverStore\FileRepository" (Indicator: "system32\drivers"; Source: "00000000-00000928.00000000.66890.00070000.00000004.mdmp, 00000000-00000928.00000001.68810.00070000.00000004.mdmp") Found string "\Device\HarddiskVolume2\file.exe" (Indicator: "\Device\"; Source: "00000000-00000928.00000000.66890.00070000.00000004.mdmp, 00000000-00000928.00000001.68810.00070000.00000004.mdmp, 00000000-00000928.00000002.70098.00070000.00000004.mdmp")5b:T4c5,Found reference to API "CheckTokenMembership" (Indicator: "CheckTokenMembership"; File: "file") Found reference to API "SeShutdownPrivilege" (Indicator: "SeShutdownPrivilege"; File: "file") Found reference to API "LookupPrivilegeValueA" (Indicator: "LookupPrivilegeValue"; File: "file") Found reference to API "AdjustTokenPrivileges" (Indicator: "AdjustTokenPrivileges"; File: "file") file/memory contains long string with (Indicator: "AdjustTokenPrivileges"; File: "file") Found reference to API "CheckTokenMembership" (Indicator: "CheckTokenMembership"; Source: "00000000-00000928.00000000.66890.00C91000.00000020.mdmp") Found reference to API "SeShutdownPrivilege" (Indicator: "SeShutdownPrivilege"; Source: "00000000-00000928.00000000.66890.00C91000.00000020.mdmp") file/memory contains long string with (Indicator: "AdjustTokenPrivileges"; Source: "00000000-00000928.00000000.66890.00C9A000.00000002.mdmp") Found reference to API "LookupPrivilegeValueA" (Indicator: "LookupPrivilegeValue"; Source: "00000000-00000928.00000000.66890.00C9A000.00000002.mdmp") Found reference to API "AdjustTokenPrivileges" (Indicator: "AdjustTokenPrivileges"; Source: "00000000-00000928.00000000.66890.00C9A000.00000002.mdmp")5c:T4f0,Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; File: "file") Found reference to API "FreeSid" (Indicator: "FreeSid"; File: "file") Found reference to API "AllocateAndInitializeSid" (Indicator: "AllocateAndInitializeSid"; File: "file") Found reference to API "AllocateAndInitializeSid" (Indicator: "InitializeSid"; File: "file") Found reference to API "EqualSid" (Indicator: "EqualSid"; File: "file") Found reference to API "GetSidIdentifierAuthority" (Indicator: "GetSidIdentifierAuthority"; File: "explothe.exe.322908262") Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; Source: "00000000-00000928.00000000.66890.00C9A000.00000002.mdmp") Found reference to API "FreeSid" (Indicator: "FreeSid"; Source: "00000000-00000928.00000000.66890.00C9A000.00000002.mdmp") Found reference to API "AllocateAndInitializeSid" (Indicator: "AllocateAndInitializeSid"; Source: "00000000-00000928.00000000.66890.00C9A000.00000002.mdmp") Found reference to API "AllocateAndInitializeSid" (Indicator: "InitializeSid"; Source: "00000000-00000928.00000000.66890.00C9A000.00000002.mdmp") Found reference to API "EqualSid" (Indicator: "EqualSid"; Source: "00000000-00000928.00000000.66890.00C9A000.00000002.mdmp")5d:T481,Found reference to API "ExitProcess" (Indicator: "ExitProcess"; File: "file") Found reference to API "TerminateProcess" (Indicator: "TerminateProcess"; File: "file") Found reference to API "CorExitProcess" (Indicator: "ExitProcess"; File: "00000000-00000876.00000000.67434.00CC1000.00000020.mdmp") Found reference to API "CorExitProcess" (Indicator: "ExitProcess"; Source: "00000000-00000876.00000000.67426.00D7A000.00000002.mdmp") Found reference to API "TerminateProcess" (Indicator: "TerminateProcess"; Source: "00000000-00000876.00000000.67434.00D99000.00000002.mdmp") Found reference to API "ExitProcess" (Indicator: "ExitProcess"; Source: "00000000-00000876.00000000.67434.00D99000.00000002.mdmp") Found reference to API "ExitProcess" (Indicator: "ExitProcess"; Source: "00000000-00000928.00000000.66890.00070000.00000004.mdmp, 00000000-00000928.00000000.66890.00C9A000.00000002.mdmp, 00000000-00000928.00000001.68810.00070000.00000004.mdmp, 00000000-00000928.00000002.70098.00070000.00000004.mdmp") Found reference to API "TerminateProcess" (Indicator: "TerminateProcess"; Source: "00000000-00000928.00000000.66890.00C9A000.00000002.mdmp")5e:T1392,Observed import api "AllocateAndInitializeSid" which can "Allocates and initializes a security identifier (SID) with up to eight subauthorities" [Source: file] Observed import api "EqualSid" which can "Tests two security identifier (SID) values for equality" [Source: file] Observed import api "FreeSid" which can "Frees a security identifier (SID) previously allocated by using the AllocateAndInitializeSid function" [Source: file] Observed import api "GetTokenInformation" which can "Retrieves a specified type of information about an access token" [Source: file] Observed import api "InitializeSid" which can "Initializes a security identifier (SID)" [Source: file] Observed import api "AllocateAndInitializeSid" which can "Allocates and initializes a security identifier (SID) with up to eight subauthorities" [Source: xX1Zl63.exe] Observed import api "EqualSid" which can "Tests two security identifier (SID) values for equality" [Source: xX1Zl63.exe] Observed import api "FreeSid" which can "Frees a security identifier (SID) previously allocated by using the AllocateAndInitializeSid function" [Source: xX1Zl63.exe] Observed import api "GetTokenInformation" which can "Retrieves a specified type of information about an access token" [Source: xX1Zl63.exe] Observed import api "InitializeSid" which can "Initializes a security identifier (SID)" [Source: xX1Zl63.exe] Observed import api "AllocateAndInitializeSid" which can "Allocates and initializes a security identifier (SID) with up to eight subauthorities" [Source: VW6ig05.exe] Observed import api "EqualSid" which can "Tests two security identifier (SID) values for equality" [Source: VW6ig05.exe] Observed import api "FreeSid" which can "Frees a security identifier (SID) previously allocated by using the AllocateAndInitializeSid function" [Source: VW6ig05.exe] Observed import api "GetTokenInformation" which can "Retrieves a specified type of information about an access token" [Source: VW6ig05.exe] Observed import api "InitializeSid" which can "Initializes a security identifier (SID)" [Source: VW6ig05.exe] Observed import api "AllocateAndInitializeSid" which can "Allocates and initializes a security identifier (SID) with up to eight subauthorities" [Source: Dk2ox03.exe] Observed import api "EqualSid" which can "Tests two security identifier (SID) values for equality" [Source: Dk2ox03.exe] Observed import api "FreeSid" which can "Frees a security identifier (SID) previously allocated by using the AllocateAndInitializeSid function" [Source: Dk2ox03.exe] Observed import api "GetTokenInformation" which can "Retrieves a specified type of information about an access token" [Source: Dk2ox03.exe] Observed import api "InitializeSid" which can "Initializes a security identifier (SID)" [Source: Dk2ox03.exe] Observed import api "AllocateAndInitializeSid" which can "Allocates and initializes a security identifier (SID) with up to eight subauthorities" [Source: qj9aa78.exe] Observed import api "EqualSid" which can "Tests two security identifier (SID) values for equality" [Source: qj9aa78.exe] Observed import api "FreeSid" which can "Frees a security identifier (SID) previously allocated by using the AllocateAndInitializeSid function" [Source: qj9aa78.exe] Observed import api "GetTokenInformation" which can "Retrieves a specified type of information about an access token" [Source: qj9aa78.exe] Observed import api "InitializeSid" which can "Initializes a security identifier (SID)" [Source: qj9aa78.exe] Observed import api "DuplicateToken" which can "Creates a new access token that duplicates one already in existence" [Source: 1Wp25tZ5.exe] Observed import api "DuplicateTokenEx" which can "Creates a new access token that duplicates an existing token" [Source: 1Wp25tZ5.exe] Observed import api "GetTokenInformation" which can "Retrieves a specified type of information about an access token" [Source: 1Wp25tZ5.exe] Observed import api "ImpersonateLoggedOnUser" which can "Lets the calling thread impersonate the security context of a logged-on user" [Source: 1Wp25tZ5.exe] Observed import api "InitializeSecurityDescriptor" which can "Initializes a new security descriptor" [Source: 1Wp25tZ5.exe] Observed import api "RevertToSelf" which can "Terminates the impersonation of a client application" [Source: 1Wp25tZ5.exe] Observed import api "SetSecurityDescriptorDacl" which can "Sets information in a discretionary access control list (DACL)" [Source: 1Wp25tZ5.exe] Observed import api "GetSidIdentifierAuthority" which can "Returns a pointer to the SID_IDENTIFIER_AUTHORITY structure in a specified security identifier (SID)" [Source: 5ol2yF2.exe] Observed import api "GetSidSubAuthority" which can "Returns a pointer to a specified subauthority in a security identifier (SID)" [Source: 5ol2yF2.exe] Observed import api "GetSidSubAuthorityCount" which can "Returns a pointer to the member in a security identifier (SID) structure that contains the subauthority count" [Source: 5ol2yF2.exe]5f:T857,"AppLaunch.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS"; Key: "HOSTNAME"; Value: "") "AppLaunch.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS"; Key: "DOMAIN"; Value: "") "AppLaunch.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\NAMESPACE_CATALOG5\CATALOG_ENTRIES\000000000001"; Key: "PROVIDERINFO"; Value: "") "AppLaunch.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\NAMESPACE_CATALOG5\CATALOG_ENTRIES\000000000002"; Key: "LIBRARYPATH"; Value: "") "AppLaunch.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\NAMESPACE_CATALOG5\CATALOG_ENTRIES\000000000002"; Key: "DISPLAYSTRING"; Value: "") "AppLaunch.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\NAMESPACE_CATALOG5\CATALOG_ENTRIES\000000000002"; Key: "PROVIDERID"; Value: "") "AppLaunch.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\NAMESPACE_CATALOG5\CATALOG_ENTRIES\000000000002"; Key: "ADDRESSFAMILY"; Value: "") "AppLaunch.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\NAMESPACE_CATALOG5\CATALOG_ENTRIES\000000000002"; Key: "SUPPORTEDNAMESPACE"; Value: "") "AppLaunch.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\NAMESPACE_CATALOG5\CATALOG_ENTRIES\000000000002"; Key: "ENABLED"; Value: "") "AppLaunch.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\NAMESPACE_CATALOG5\CATALOG_ENTRIES\000000000002"; Key: "VERSION"; Value: "") "AppLaunch.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\NAMESPACE_CATALOG5\CATALOG_ENTRIES\000000000002"; Key: "STORESSERVICECLASSINFO"; Value: "") "AppLaunch.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\NAMESPACE_CATALOG5\CATALOG_ENTRIES\000000000002"; Key: "PROVIDERINFO"; Value: "")60:T685,"xX1Zl63.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP000.TMP\xX1Zl63.exe]- [targetUID: 00000000-00002736] "4AR077QH.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP002.TMP\4AR077QH.exe]- [targetUID: 00000000-00003276] "VW6ig05.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP001.TMP\VW6ig05.exe]- [targetUID: 00000000-00002736] "3Fs87VT.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP003.TMP\3Fs87VT.exe]- [targetUID: 00000000-00000876] "Dk2ox03.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP002.TMP\Dk2ox03.exe]- [targetUID: 00000000-00003452] "qj9aa78.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP003.TMP\qj9aa78.exe]- [targetUID: 00000000-00003976] "1Wp25tZ5.exe" has type "PE32+ executable (console) x86-64 for MS Windows"- Location: [%TEMP%\IXP004.TMP\1Wp25tZ5.exe]- [targetUID: 00000000-00003976] "5ol2yF2.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP001.TMP\5ol2yF2.exe]- [targetUID: 00000000-00002736] "2St5480.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP004.TMP\2St5480.exe]- [targetUID: 00000000-00003976] "6Um8bf3.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows UPX compressed"- Location: [%TEMP%\IXP000.TMP\6Um8bf3.exe]- [targetUID: 00000000-00001884] "explothe.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\fefffe8cea\explothe.exe]- [targetUID: 00000000-00003744]61:T1466,Dropped file: "clip.dll" - Location: [%APPDATA%\006700e5a2ab05\clip.dll]- [targetUID: 00000000-00001460] Dropped file: "IVHZVIUP.js" - Location: [%LOCALAPPDATA%\Microsoft\Windows\Temporary Internet Files\Content.IE5\37NU00GP\IVHZVIUP.js]- [targetUID: 00000000-00002976] Dropped file: "K3Z7HZTX.htm" - Location: [%LOCALAPPDATA%\Microsoft\Windows\Temporary Internet Files\Content.IE5\QQW0X29Y\K3Z7HZTX.htm]- [targetUID: 00000000-00002656] Dropped file: "imagestore.dat" - Location: [%LOCALAPPDATA%\Microsoft\Internet Explorer\imagestore\3mt7jhv\imagestore.dat]- [targetUID: 00000000-00002976] Dropped file: "en-US.4" - Location: [%LOCALAPPDATA%\Microsoft\Internet Explorer\DomainSuggestions\en-US.4]- [targetUID: 00000000-00002656] Dropped file: "57C8EDB95DF3F0AD4EE2DC2B8CFD4157" - Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\57C8EDB95DF3F0AD4EE2DC2B8CFD4157]- [targetUID: 00000000-00002656] Dropped file: "24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA" - Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA]- [targetUID: 00000000-00002976] Dropped file: "CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA" - Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA]- [targetUID: 00000000-00002976] Dropped file: "6B2043001D270792DFFD725518EAFE2C" - Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\6B2043001D270792DFFD725518EAFE2C]- [targetUID: 00000000-00002656] Dropped file: "WGUDQ09L.txt" - Location: [%APPDATA%\Microsoft\Windows\Cookies\WGUDQ09L.txt]- [targetUID: 00000000-00002976] Dropped file: "OZDB452G.txt" - Location: [%APPDATA%\Microsoft\Windows\Cookies\OZDB452G.txt]- [targetUID: 00000000-00003236] Dropped file: "F07644E38ED7C9F37D11EEC6D4335E02_2D1FA229671185E6CE5261A2A9B06982" - Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\F07644E38ED7C9F37D11EEC6D4335E02_2D1FA229671185E6CE5261A2A9B06982]- [targetUID: 00000000-00002976] Dropped file: "265C0DEB29181DD1891051371C5F863A_3177CE6CD1B3852A6EC841765B1A16FB" - Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\265C0DEB29181DD1891051371C5F863A_3177CE6CD1B3852A6EC841765B1A16FB]- [targetUID: 00000000-00002976] Dropped file: "E87CE99F124623F95572A696C80EFCAF_802691FEFBCBFDBC6638E7243774E081" - Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\E87CE99F124623F95572A696C80EFCAF_802691FEFBCBFDBC6638E7243774E081]- [targetUID: 00000000-00002976] Dropped file: "80237EE4964FC9C409AAF55BF996A292_D46D6FA25B74360E1349F9015B5CCE53" - Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\80237EE4964FC9C409AAF55BF996A292_D46D6FA25B74360E1349F9015B5CCE53]- [targetUID: 00000000-00002656] Dropped file: "E2C6CBAF0AF08CF203BA74BF0D0AB6D5_0FB9553B978E7F00C6B2309507DEB64A" - Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_0FB9553B978E7F00C6B2309507DEB64A]- [targetUID: 00000000-00002656] Dropped file: "7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776" - Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776]- [targetUID: 00000000-00002976] Dropped file: "EDC238BFF48A31D55A97E1E93892934B_C20E0DA2D0F89FE526E1490F4A2EE5AB" - Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\EDC238BFF48A31D55A97E1E93892934B_C20E0DA2D0F89FE526E1490F4A2EE5AB]- [targetUID: 00000000-00004048] Dropped file: "35DDEDF268117918D1D277A171D8DF7B_56087230985656D9A5EBEBE1867517A7" - Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\35DDEDF268117918D1D277A171D8DF7B_56087230985656D9A5EBEBE1867517A7]- [targetUID: 00000000-00004048] Dropped file: "LC8PJ10M.txt" - Location: [%APPDATA%\Microsoft\Windows\Cookies\LC8PJ10M.txt]- [targetUID: 00000000-00002656] Dropped file: "E2C6CBAF0AF08CF203BA74BF0D0AB6D5_0FB9553B978E7F00C6B2309507DEB64A" - Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_0FB9553B978E7F00C6B2309507DEB64A]- [targetUID: 00000000-00002656] Dropped file: "35DDEDF268117918D1D277A171D8DF7B_56087230985656D9A5EBEBE1867517A7" - Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\MetaData\35DDEDF268117918D1D277A171D8DF7B_56087230985656D9A5EBEBE1867517A7]- [targetUID: 00000000-00004048] Dropped file: "80237EE4964FC9C409AAF55BF996A292_D46D6FA25B74360E1349F9015B5CCE53" - Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\MetaData\80237EE4964FC9C409AAF55BF996A292_D46D6FA25B74360E1349F9015B5CCE53]- [targetUID: 00000000-00002656] Dropped file: "24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA" - Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA]- [targetUID: 00000000-00002976] Dropped file: "E87CE99F124623F95572A696C80EFCAF_802691FEFBCBFDBC6638E7243774E081" - Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\MetaData\E87CE99F124623F95572A696C80EFCAF_802691FEFBCBFDBC6638E7243774E081]- [targetUID: 00000000-00002976]62:T414,"dinosaur_1_.png" has type "PNG image data 1200 x 800 8-bit/color RGBA non-interlaced" and extension "png" "firefox_1_.png" has type "PNG image data 128 x 128 8-bit/color RGBA non-interlaced" and extension "png" "yt_logo_rgb_light_1_.png" has type "PNG image data 1588 x 356 8-bit colormap non-interlaced" and extension "png" "edgium_1_.png" has type "PNG image data 128 x 128 8-bit/color RGBA non-interlaced" and extension "png" "Y0L6f5sxdIV_1_.png" has type "PNG image data 283 x 315 8-bit colormap non-interlaced" and extension "png" "chrome_1_.png" has type "PNG image data 128 x 128 8-bit/color RGBA non-interlaced" and extension "png" "opera_1_.png" has type "PNG image data 128 x 128 8-bit/color RGBA non-interlaced" and extension "png" "O287_AcFyg4_1_.png" has type "PNG image data 20 x 20 8-bit colormap non-interlaced" and extension "png" "O7nelmd9XSI_1_.png" has type "PNG image data 1 x 1 1-bit colormap non-interlaced" and extension "png" "hsts-pixel_1_.gif" has type "GIF image data version 89a 1 x 1" and extension "gif"63:Tc007,"initAft()