26:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js","/_next/static/chunks/1w1axrg6kzses.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/1kn_tf3p-ubex.js","/_next/static/chunks/1wq095nwqbaw1.js"],"SampleDetailWrapper"] 7a:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js"],"IconMark"] 25:T49f,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Trojan.Generic Sample c4a844e31520… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample c4a844e31520…. Malware family: Trojan.Generic. Threat score 100/100. 5/25 AV engines flagged this file. 10 malicious and 15 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/c4a844e31520ffff519cc4aea8acce0eff61cf4f54566964febbde1be29a8712","keywords":["Malicious","Trojan.Generic","malware analysis","sandbox report","threat intelligence","c4a844e31520ffff519cc4aea8acce0eff61cf4f54566964febbde1be29a8712"],"about":{"@type":"SoftwareApplication","name":"afa6fbd86c448bceaf510ae6f8b831be.exe","applicationCategory":["peexe","executable"],"identifier":"c4a844e31520ffff519cc4aea8acce0eff61cf4f54566964febbde1be29a8712","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Trojan.Generic","antivirusDetections":{"malicious":5,"total":25},"behavioralIndicators":{"malicious":10,"suspicious":15},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}27:T475,"afa6fbd86c448bceaf510ae6f8b831be.exe" called "FindResourceA" with parameter "981384" - (UID: 00000000-00001616) "afa6fbd86c448bceaf510ae6f8b831be.exe" called "FindResourceA" with parameter "2560712" - (UID: 00000000-00001616) "afa6fbd86c448bceaf510ae6f8b831be.exe" called "FindResourceA" with parameter "2560720" - (UID: 00000000-00001616) "afa6fbd86c448bceaf510ae6f8b831be.exe" called "FindResourceA" with parameter "2560748" - (UID: 00000000-00001616) "afa6fbd86c448bceaf510ae6f8b831be.exe" called "FindResourceA" with parameter "2560760" - (UID: 00000000-00001616) "afa6fbd86c448bceaf510ae6f8b831be.exe" called "FindResourceA" with parameter "2560776" - (UID: 00000000-00001616) "tB0lu63.exe" called "FindResourceA" with parameter "2422648" - (UID: 00000000-00003500) "tB0lu63.exe" called "FindResourceA" with parameter "14029512" - (UID: 00000000-00003500) "tB0lu63.exe" called "FindResourceA" with parameter "14029520" - (UID: 00000000-00003500) "tB0lu63.exe" called "FindResourceA" with parameter "14029548" - (UID: 00000000-00003500) "tB0lu63.exe" called "FindResourceA" with parameter "14029560" - (UID: 00000000-00003500)28:Ta8e,"afa6fbd86c448bceaf510ae6f8b831be.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '2607184'}" (UID: 00000000-00001616) "afa6fbd86c448bceaf510ae6f8b831be.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '2607216'}" (UID: 00000000-00001616) "afa6fbd86c448bceaf510ae6f8b831be.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '2607200'}" (UID: 00000000-00001616) "afa6fbd86c448bceaf510ae6f8b831be.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '2607168'}" (UID: 00000000-00001616) "afa6fbd86c448bceaf510ae6f8b831be.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '2607120'}" (UID: 00000000-00001616) "tB0lu63.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '14075984'}" (UID: 00000000-00003500) "tB0lu63.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '14076016'}" (UID: 00000000-00003500) "tB0lu63.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '14076000'}" (UID: 00000000-00003500) "tB0lu63.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '14075968'}" (UID: 00000000-00003500) "tB0lu63.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '14075920'}" (UID: 00000000-00003500) "qP8xB26.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '9422928'}" (UID: 00000000-00002516) "qP8xB26.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '9422960'}" (UID: 00000000-00002516) "qP8xB26.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '9422944'}" (UID: 00000000-00002516) "qP8xB26.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '9422912'}" (UID: 00000000-00002516) "qP8xB26.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '9422864'}" (UID: 00000000-00002516) "kX8EH32.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '3590176'}" (UID: 00000000-00002644) "kX8EH32.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '3590144'}" (UID: 00000000-00002644) "kX8EH32.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '3590192'}" (UID: 00000000-00002644) "kX8EH32.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '3590240'}" (UID: 00000000-00002644) "kX8EH32.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '3590112'}" (UID: 00000000-00002644) "kX8EH32.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '3590224'}" (UID: 00000000-00002644) "kX8EH32.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '3590256'}" (UID: 00000000-00002644)29:T583,Found reference to API "CreateThread" (Indicator: "CreateThread"; File: "afa6fbd86c448bceaf510ae6f8b831be.exe") Found reference to API "VirtualAlloc" (Indicator: "VirtualAlloc"; File: "MaxLoonaFest131.exe.1646122814") Found reference to API "VirtualFree" (Indicator: "VirtualFree"; File: "MaxLoonaFest131.exe.1646122814") Found reference to API "CreateThread" (Indicator: "CreateThread"; Source: "00000000-00001512.00000000.67840.00E5C000.00000002.mdmp") Found reference to API "VirtualFreeEx" (Indicator: "VirtualFree"; Source: "00000000-00001512.00000000.67840.00E5C000.00000002.mdmp") Found reference to API "VirtualAllocEx" (Indicator: "VirtualAlloc"; Source: "00000000-00001512.00000000.67840.00E5C000.00000002.mdmp") Found reference to API "VirtualAllocEx" (Indicator: "VirtualAllocEx"; Source: "00000000-00001512.00000000.67840.00E5C000.00000002.mdmp") Found reference to API "WriteProcessMemory" (Indicator: "WriteProcessMemory"; Source: "00000000-00001512.00000000.67840.00E5C000.00000002.mdmp") Found reference to API "VirtualFree" (Indicator: "VirtualFree"; Source: "00000000-00001512.00000000.67840.00E5C000.00000002.mdmp") Found reference to API "VirtualAlloc" (Indicator: "VirtualAlloc"; Source: "00000000-00001512.00000000.67840.00E5C000.00000002.mdmp") Found reference to API "CreateThread" (Indicator: "CreateThread"; Source: "00000000-00002516.00000001.67151.008FA000.00000002.mdmp")2a:T67e,Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; File: "afa6fbd86c448bceaf510ae6f8b831be.exe") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; File: "afa6fbd86c448bceaf510ae6f8b831be.exe") Found reference to API "LoadLibraryExA" (Indicator: "LoadLibrary"; File: "afa6fbd86c448bceaf510ae6f8b831be.exe") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; Source: "00000000-00001512.00000000.67840.00E5C000.00000002.mdmp, 00000000-00001512.00000000.67840.6B260000.00000002.mdmp") Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; Source: "00000000-00001512.00000000.67840.00E5C000.00000002.mdmp") Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; Source: "00000000-00001512.00000000.67840.00E5C000.00000002.mdmp") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; Source: "00000000-00001512.00000000.67840.00E5C000.00000002.mdmp, 00000000-00001512.00000000.67840.6B260000.00000002.mdmp") Found reference to API "FreeLibraryAndExitThread" (Indicator: "FreeLibrary"; Source: "00000000-00001512.00000000.67840.00E5C000.00000002.mdmp") Found reference to API "LoadLibraryExA" (Indicator: "LoadLibrary"; Source: "00000000-00001512.00000000.67840.6B260000.00000002.mdmp") Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; Source: "00000000-00002516.00000001.67151.008FA000.00000002.mdmp") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; Source: "00000000-00002516.00000001.67151.008FA000.00000002.mdmp") Found reference to API "LoadLibraryExA" (Indicator: "LoadLibrary"; Source: "00000000-00002516.00000001.67151.008FA000.00000002.mdmp")2b:T5af,Found reference to API "IOpenServiceManager" (Indicator: "OpenService"; Source: "00000000-00001512.00000000.67840.6B221000.00000020.mdmp") Found reference to API "IOpenServiceActivity" (Indicator: "OpenService"; Source: "00000000-00001512.00000000.67840.6B221000.00000020.mdmp") Found reference to API "IOpenServiceActivityManager" (Indicator: "OpenService"; Source: "00000000-00001512.00000000.67840.6B221000.00000020.mdmp") Found reference to API "IOpenServiceActivityOutputContext" (Indicator: "OpenService"; Source: "00000000-00001512.00000000.67840.6B221000.00000020.mdmp") Found reference to API "IOpenServiceActivityInput" (Indicator: "OpenService"; Source: "00000000-00001512.00000000.67840.6B221000.00000020.mdmp") Found reference to API "IOpenService" (Indicator: "OpenService"; Source: "00000000-00001512.00000000.67840.6B221000.00000020.mdmp") Found reference to API "IEnumOpenServiceActivity" (Indicator: "OpenService"; Source: "00000000-00001512.00000000.67840.6B221000.00000020.mdmp") Found reference to API "IOpenServiceActivityCategory" (Indicator: "OpenService"; Source: "00000000-00001512.00000000.67840.6B221000.00000020.mdmp") Found reference to API "IEnumOpenServiceActivityCategory" (Indicator: "OpenService"; Source: "00000000-00001512.00000000.67840.6B221000.00000020.mdmp") Found reference to API "IOpenServiceManagerInternal" (Indicator: "OpenService"; Source: "00000000-00001512.00000000.67840.6B221000.00000020.mdmp")2c:T2f00,Contains base64 string in header "Keep" in header "GET /geoip/v2.1/city/me HTTP/1.1Connection: Keep-AliveReferer: https://www.maxmind.com/en/locate-my-ip-addressUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: www.maxmind.com" Contains base64 string in header "AliveReferer" in header "GET /geoip/v2.1/city/me HTTP/1.1Connection: Keep-AliveReferer: https://www.maxmind.com/en/locate-my-ip-addressUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: www.maxmind.com" Contains base64 string in header "like" in header "GET /geoip/v2.1/city/me HTTP/1.1Connection: Keep-AliveReferer: https://www.maxmind.com/en/locate-my-ip-addressUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: www.maxmind.com" Contains base64 string in header "2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP" in header "GET /gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "2FUsCEHe9DWzbNvka6iEPxPBY0w0" in header "GET /gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "Keep" in header "GET /gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "User" in header "GET /gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "ocsp" in header "GET /gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "goog" in header "GET /gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "Keep" in header "GET /gtsr1/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBQwkcLWD4LqGJ7bE7B1XZsEbmfwUAQU5K8rJnEaK0gnhS9SZizv8IkTcT4CDQIDvFNZazTHGPUBUGY%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "User" in header "GET /gtsr1/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBQwkcLWD4LqGJ7bE7B1XZsEbmfwUAQU5K8rJnEaK0gnhS9SZizv8IkTcT4CDQIDvFNZazTHGPUBUGY%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "ocsp" in header "GET /gtsr1/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBQwkcLWD4LqGJ7bE7B1XZsEbmfwUAQU5K8rJnEaK0gnhS9SZizv8IkTcT4CDQIDvFNZazTHGPUBUGY%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "goog" in header "GET /gtsr1/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBQwkcLWD4LqGJ7bE7B1XZsEbmfwUAQU5K8rJnEaK0gnhS9SZizv8IkTcT4CDQIDvFNZazTHGPUBUGY%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "Keep" in header "GET /gts1c3/moVDfISia2k.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: crls.pki.goog" Contains base64 string in header "User" in header "GET /gts1c3/moVDfISia2k.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: crls.pki.goog" Contains base64 string in header "crls" in header "GET /gts1c3/moVDfISia2k.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: crls.pki.goog" Contains base64 string in header "goog" in header "GET /gts1c3/moVDfISia2k.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: crls.pki.goog" Contains base64 string in header "Keep" in header "GET /gts1c3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEBZwXm7t3kKEEFjsmHQeLcQ%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "User" in header "GET /gts1c3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEBZwXm7t3kKEEFjsmHQeLcQ%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "ocsp" in header "GET /gts1c3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEBZwXm7t3kKEEFjsmHQeLcQ%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "goog" in header "GET /gts1c3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEBZwXm7t3kKEEFjsmHQeLcQ%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "2Fr4XN7pXNPZzQ4kYU83E1HScCEQClj3zJOwEs2AlR6v" in header "GET /gts1c3/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEQClj3zJOwEs2AlR6v%2BfUXog HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "Keep" in header "GET /gts1c3/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEQClj3zJOwEs2AlR6v%2BfUXog HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "User" in header "GET /gts1c3/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEQClj3zJOwEs2AlR6v%2BfUXog HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "ocsp" in header "GET /gts1c3/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEQClj3zJOwEs2AlR6v%2BfUXog HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "goog" in header "GET /gts1c3/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEQClj3zJOwEs2AlR6v%2BfUXog HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "2Fr4XN7pXNPZzQ4kYU83E1HScCEQClj3zJOwEs2AlR6v" in header "GET /gts1c3/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEQClj3zJOwEs2AlR6v%2BfUXog HTTP/1.1Cache-Control: max-age = 14400Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "Keep" in header "GET /gts1c3/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEQClj3zJOwEs2AlR6v%2BfUXog HTTP/1.1Cache-Control: max-age = 14400Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "User" in header "GET /gts1c3/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEQClj3zJOwEs2AlR6v%2BfUXog HTTP/1.1Cache-Control: max-age = 14400Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "ocsp" in header "GET /gts1c3/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEQClj3zJOwEs2AlR6v%2BfUXog HTTP/1.1Cache-Control: max-age = 14400Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "goog" in header "GET /gts1c3/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEQClj3zJOwEs2AlR6v%2BfUXog HTTP/1.1Cache-Control: max-age = 14400Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "Keep" in header "GET /gts1c3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEDEixfO34qnbCeE6N8VMp00%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "User" in header "GET /gts1c3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEDEixfO34qnbCeE6N8VMp00%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "ocsp" in header "GET /gts1c3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEDEixfO34qnbCeE6N8VMp00%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "goog" in header "GET /gts1c3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEDEixfO34qnbCeE6N8VMp00%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "Keep" in header "GET /gts1c3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEGpYRvzN3kAuEMlMWsqSFLc%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "User" in header "GET /gts1c3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEGpYRvzN3kAuEMlMWsqSFLc%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "ocsp" in header "GET /gts1c3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEGpYRvzN3kAuEMlMWsqSFLc%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "goog" in header "GET /gts1c3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEGpYRvzN3kAuEMlMWsqSFLc%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "Keep" in header "GET /gts1c3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEGpYRvzN3kAuEMlMWsqSFLc%3D HTTP/1.1Cache-Control: max-age = 14400Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "User" in header "GET /gts1c3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEGpYRvzN3kAuEMlMWsqSFLc%3D HTTP/1.1Cache-Control: max-age = 14400Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "ocsp" in header "GET /gts1c3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEGpYRvzN3kAuEMlMWsqSFLc%3D HTTP/1.1Cache-Control: max-age = 14400Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "goog" in header "GET /gts1c3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEGpYRvzN3kAuEMlMWsqSFLc%3D HTTP/1.1Cache-Control: max-age = 14400Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog"2d:T47c,The analysis contains indicators for cyrpto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Contains ability to perform AES/RC4 encryption (API string) Matched sigs: Contains ability to use Microsoft's Enhanced Cryptographic Provider Matched sigs: Contains ability to perform decryption (API string) Matched sigs: Contains CRYPTO related strings Matched sigs: Contains ability to use Cryptographic classes Matched sigs: Decrypted SSL network traffic Matched sigs: Contains ability to perform Base64 encoding/decoding Matched sigs: Contains ability to decrypt/decode data Matched sigs: Calls an API typically to import asymmetric cryptographic keys into a CSP Matched sigs: Calls an API typically used to decrypt a block of data Matched sigs: Dropped file has high entropy (likely encrypted/compressed content) Matched sigs: Calls an API typically used to encrypt a block of data Matched sigs: HTTP requests contain Base64 strings Matched sigs: Sample file has high entropy (likely encrypted/compressed content) Matched sigs: Reads the cryptographic machine GUID Matched sigs: Imports Crypto related APIs2e:T3173,"afa6fbd86c448bceaf510ae6f8b831be.exe" called "RtlGetVersion" with parameter 000000000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00001616) "tB0lu63.exe" called "RtlGetVersion" with parameter 000000000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00003500) "qP8xB26.exe" called "RtlGetVersion" with parameter 000000000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00002516) "kX8EH32.exe" called "RtlGetVersion" with parameter 000000000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00002644) "1yz61bk1.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00003736) "1yz61bk1.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000041007000700044006100740061005c004c006f00630061006c005c00540065006d0070005c004900580050003000300033002e0054004d0050005c00310079007a003600310062006b0031002e00650078006500000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ff2bdf7610f6fa76d8ebf576ac0125000000250000000000000000001b00750003000000000000000000000000000000000000001c007000030000000000000000000000106f250000000000200000000000000000000000 (UID: 00000000-00003736) "1yz61bk1.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b00200031000000780065000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ff2bdf7644f6fa76020000000c02c6000000c60000000000000000002f00df0002000000000000000000000000000000000000003000ce000200000000000000000000005803d80000000000 (UID: 00000000-00003736) "1yz61bk1.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000180000004e85675e432aa26be8fe1100c8cc120068d212005059a26baa59d135feffffff94cc12004b65a16b40cc12004ce9bc7331c5a06b6465a16b (UID: 00000000-00003736) "1yz61bk1.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001000008a82b0000002500e08f2d00000000000000000000000000436c665f08ca120000cf1200d29fbd6b000000009a9bbb6bb001be6beca3bb6be36d665f02000000b001be6b0000130000002500e02e25000000000000000000e02e250000000000f02f2500000000000000000000000000e02e25007f0700001005be6b00000000e0d1120055a0bd6b (UID: 00000000-00003736) "1yz61bk1.exe" called "RtlGetVersion" with parameter 140100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b00200031000000000089f4247516e7675e02000000c0d11200bcd112000200000018000000ee29df769801d8005876c60010d11200c83a2e7584d11200d58c2675c0d1120054d1120042a42475a8022e7594d11200d2f42475080000006ef5247544f52475cee7675e020000003c41bc6b000013005e43bc6b68d1120002000000000013003c41bc6b98d1120042a42475a8022e75dcd11200503ebc6b08000000273ebc6b3373665f020000003c41bc6b000013005e43bc6b9076c6005876c600a8d112000000000068d212004437bd6bc79cc834feffffff273ebc6ba53dbc6b5e43bc6bfcd11200 (UID: 00000000-00003736) "1yz61bk1.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b00200031000000120000000000aac512000500000081d0ff7560c5120064c512000000000078002c009c50de76e26bde74580100005801000030c51200b0ea6f755801000050c512000cca12005ecbfd755801000000000000005dfb7568cc12000e5dfb7500c81200dcaaff75010000000000000072000000ffffffffffffffff88c5120078020000000000002500000088c512007b00370035003800340037003100370037002d0046003000370037002d0034003100370031002d0042004400320043002d004100360042004200320031003600d6f0675ee0c512006d823b75fc4b2c0004010000 (UID: 00000000-00003736) "1yz61bk1.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000041007000700044006100740061005c004c006f00630061006c005c00540065006d0070005c004900580050003000300033002e0054004d0050005c00310079007a003600310062006b0031002e00650078006500000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ff2bdf769897fa76d8ebf576ac0125000000250000000000000000000400e800e4030000000000000000000000000000000000000500e300e40300000000000000000000106f250000000000200000000000000000000000 (UID: 00000000-00003736) "1yz61bk1.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b002000310000002c0001000000ffffffff0200000008000000506c2c00506c2c004b6c2c00000000000200000098d22b00000000000100000800000000d4ec120095e1db7638353700feffffffc8c412003f0870750200000098d22b00000000000100001888fb6f75b8c41200c81cff758ec6120095fb6f75ecc5120098d22b0000000000000000000000000074c51200000025007b00370035003800340037003100370037002d0046003000370037002d0034003100370031002d0042004400320043002d00410036004200420032003100360002f0675e34c512006d823b75fc4b2c0004010000 (UID: 00000000-00003736) "1yz61bk1.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b002000310000003b750100000000800000000000000000000094bd120023333b75c8bd12000080000000800000c8bd120037333b7500000000cebd12008288675eb0bd120067323b75a8c212006488675ed4bf1200135ffb75c8bd1200bac212000000000010c71200a0762700dcc41200205ffb7543003a005c0055007300650072007300000048004100500055004200570053007b00370035003800340037003100370037002d0046003000370037002d0034003100370031002d0042004400320043002d0041003600420042003200310036003a8b675e4cbe12006d823b75b4592c0004010000 (UID: 00000000-00003736) "1yz61bk1.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b00200031000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000007b00370035003800340037003100370037002d0046003000370037002d0034003100370031002d0042004400320043002d0041003600420042003200310036007e8d675e88b812006d823b75bc472c0004010000 (UID: 00000000-00003736) "1yz61bk1.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b00200031000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000007b00370035003800340037003100370037002d0046003000370037002d0034003100370031002d0042004400320043002d0041003600420042003200310036005287675e64b212006d823b759c6e2d0004010000 (UID: 00000000-00003736) "1yz61bk1.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b00200031000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000007b00370035003800340037003100370037002d0046003000370037002d0034003100370031002d0042004400320043002d0041003600420042003200310036005287675e64b212006d823b753c782d0004010000 (UID: 00000000-00003736) "1yz61bk1.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b00200031000000000000000000000000005cb11200e86c2b0068cd1200bd06e0743137ab2afeffffffda76de74f7a6ff75400000005400000058d13176d0d4fd7554d131760000000014b2120078d3fd750100010000000880d0d4fd75fdd3fd7534b212003c782d0058d13176000000005c00000014b212004cd4fd75000000003c782d004800000010b2120004000000b8fc2c007b00370035003800340037003100370037002d0046003000370037002d0034003100370031002d0042004400320043002d0041003600420042003200310036005287675e64b212006d823b75d4802d0004010000 (UID: 00000000-00003736) "1yz61bk1.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b00200031000000000000000000000000005cb11200e86c2b0068cd1200bd06e0743137ab2afeffffffda76de74f7a6ff75400000005800000058d13176d0d4fd7554d131760000000014b2120078d3fd750100010000000880d0d4fd75fdd3fd7534b21200d4802d0058d13176000000005e00000014b212004cd4fd7500000000d4802d004c00000010b212000400000018fd2c007b00370035003800340037003100370037002d0046003000370037002d0034003100370031002d0042004400320043002d0041003600420042003200310036005287675e64b212006d823b756c892d0004010000 (UID: 00000000-00003736) "1yz61bk1.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b00200031000000000000000000000000005cb11200e86c2b0068cd1200bd06e0743137ab2afeffffffda76de74f7a6ff75400000005800000058d13176d0d4fd7554d131760000000014b2120078d3fd750100010000000880d0d4fd75fdd3fd7534b212006c892d0058d13176000000002500000014b212004cd4fd75000000006c892d004c00000010b212000400000078fd2c007b00370035003800340037003100370037002d0046003000370037002d0034003100370031002d0042004400320043002d0041003600420042003200310036005287675e64b212006d823b751ccd2c0004010000 (UID: 00000000-00003736)2f:T755,"1yz61bk1.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b203100000000000000000000000000000000000000000000010000000000000000006b750000000010e812000000000000000000000000001c5cde764379de74ffffffff0c0000004c62de761f79de74ffffffff0c00000004e8120004000000000400000100000018e81200210e2b0200000000 (UID: 00000000-00003736) "1yz61bk1.exe" called "GetVersionExA" with parameter 9c0000000600000001000000b11d00000200000053657276696365205061636b2031000000000000000000000200000000000000d8ebf576203b2b000080fd7f9a5ce07600f0fd7fc0d112004480fd7f00000000400000003f000000240000000080fd7fb4d11200c15ce0766082e776240000000080fd7f9a5ce07600f0fd7fd8d112005789df768083e7761317df74d8ebf576 (UID: 00000000-00003736) "1yz61bk1.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b20310000000000000000000000000000000000000000000002000000000000008800000000000000e8d11200459d24750000c600000000008000000002000000000013009c1d2273fcd112006c22227380000000d3222273dcf0227318d21200741d2273dcf022730000000048d3120000000000 (UID: 00000000-00003736) "1yz61bk1.exe" called "GetVersionExA" with parameter 9c0000000600000001000000b11d00000200000053657276696365205061636b2031000000000000000000000200000000000000d8ebf576b83e2b000080fd7f9a5ce07600f0fd7f48b112004480fd7f00000000400000003f0000002a0000000080fd7f3cb11200c15ce0766082e7762a0000000080fd7f9a5ce07600f0fd7f60b112005789df768083e7761317df74d8ebf576 (UID: 00000000-00003736) "6FR1MW1.exe" called "GetVersionExA" with parameter 9c0000000600000001000000b11d00000200000053657276696365205061636b2031000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00001512)30:T853,"afa6fbd86c448bceaf510ae6f8b831be.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "afa6fbd86c448bceaf510ae6f8b831be.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "tB0lu63.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "tB0lu63.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "qP8xB26.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "qP8xB26.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "kX8EH32.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "kX8EH32.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "1yz61bk1.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "1yz61bk1.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "schtasks.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "3mk61Eb.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "4hV149il.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "5eh2lq1.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "5eh2lq1.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "AppLaunch.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "6FR1MW1.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "6FR1MW1.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED")31:T4c7,Found reference to API "ExpandEnvironmentStringsA" (Indicator: "ExpandEnvironmentStrings"; File: "afa6fbd86c448bceaf510ae6f8b831be.exe") Found reference to API "GetSystemInfo" (Indicator: "GetSystemInfo"; File: "afa6fbd86c448bceaf510ae6f8b831be.exe") Found reference to API "GetUserObjectInformationA" (Indicator: "GetUserObjectInformation"; File: "MaxLoonaFest131.exe.1646122814") Found reference to API "GetUserObjectInformationW" (Indicator: "GetUserObjectInformation"; File: "5eh2lq1.exe.27807583") Found reference to API "GetNativeSystemInfo" (Indicator: "GetNativeSystemInfo"; Source: "00000000-00001512.00000000.67840.00E5C000.00000002.mdmp") Found reference to API "GetSystemInfo" (Indicator: "GetSystemInfo"; Source: "00000000-00001512.00000000.67840.00E5C000.00000002.mdmp") Found reference to API "GetMonitorInfoW" (Indicator: "GetMonitorInfo"; Source: "00000000-00001512.00000000.67840.00E5C000.00000002.mdmp") Found reference to API "ExpandEnvironmentStringsA" (Indicator: "ExpandEnvironmentStrings"; Source: "00000000-00002516.00000001.67151.008FA000.00000002.mdmp") Found reference to API "GetSystemInfo" (Indicator: "GetSystemInfo"; Source: "00000000-00002516.00000001.67151.008FA000.00000002.mdmp")32:T4e0,Found reference to API "GetActiveWindow" (Indicator: "GetActiveWindow"; File: "MaxLoonaFest131.exe.1646122814") Found reference to API "GetWindowTextLengthW" (Indicator: "GetWindowText"; File: "MaxLoonaFest131.exe.1646122814") Found reference to API "GetForegroundWindow" (Indicator: "GetForegroundWindow"; Source: "00000000-00001512.00000000.67840.00E5C000.00000002.mdmp") Found reference to API "GetWindowTextW" (Indicator: "GetWindowText"; Source: "00000000-00001512.00000000.67840.00E5C000.00000002.mdmp") Found reference to API "EnumWindows" (Indicator: "EnumWindows"; Source: "00000000-00001512.00000000.67840.00E5C000.00000002.mdmp") Found reference to API "FindWindowW" (Indicator: "FindWindow"; Source: "00000000-00001512.00000000.67840.00E5C000.00000002.mdmp") Found reference to API "FindWindowExW" (Indicator: "FindWindow"; Source: "00000000-00001512.00000000.67840.00E5C000.00000002.mdmp, 00000000-00001512.00000000.67840.6B221000.00000020.mdmp") Found reference to API "GetActiveWindow" (Indicator: "GetActiveWindow"; Source: "00000000-00001512.00000000.67840.00E5C000.00000002.mdmp") Found reference to API "GetWindowTextLengthW" (Indicator: "GetWindowText"; Source: "00000000-00001512.00000000.67840.00E5C000.00000002.mdmp")33:T5b7,Found reference to API "GetVersion" (Indicator: "GetVersion"; File: "afa6fbd86c448bceaf510ae6f8b831be.exe") Found reference to API "GetVersionExA" (Indicator: "GetVersionExA"; File: "afa6fbd86c448bceaf510ae6f8b831be.exe") Found reference to API "GetVersionExA" (Indicator: "GetVersion"; File: "afa6fbd86c448bceaf510ae6f8b831be.exe") Found reference to API "GetVersionExW" (Indicator: "GetVersionExW"; Source: "00000000-00001512.00000000.67840.00E5C000.00000002.mdmp") Found reference to API "GetVersionExW" (Indicator: "GetVersion"; Source: "00000000-00001512.00000000.67840.00E5C000.00000002.mdmp") Found reference to API "GetVersionExA" (Indicator: "GetVersionExA"; Source: "00000000-00001512.00000000.67840.6B260000.00000002.mdmp") Found reference to API "GetVersionExA" (Indicator: "GetVersion"; Source: "00000000-00001512.00000000.67840.6B260000.00000002.mdmp") Found reference to API "42733362930,3128,3024,,RtlGetVersion,NTDLL.dll,"252:02:56.289",RX=0,PX=0" (Indicator: "GetVersion"; Source: "00000000-00002516.00000001.67151.00160000.00000004.mdmp") Found reference to API "GetVersion" (Indicator: "GetVersion"; Source: "00000000-00002516.00000001.67151.008FA000.00000002.mdmp") Found reference to API "GetVersionExA" (Indicator: "GetVersionExA"; Source: "00000000-00002516.00000001.67151.008FA000.00000002.mdmp") Found reference to API "GetVersionExA" (Indicator: "GetVersion"; Source: "00000000-00002516.00000001.67151.008FA000.00000002.mdmp")34:T9d1,"1yz61bk1.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "1yz61bk1.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "1yz61bk1.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS"; Key: "") "1yz61bk1.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS"; Key: "") "1yz61bk1.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "1yz61bk1.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "1yz61bk1.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS"; Key: "") "1yz61bk1.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS"; Key: "") "1yz61bk1.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED"; Key: "") "1yz61bk1.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES"; Key: "") "1yz61bk1.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS"; Key: "") "1yz61bk1.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS"; Key: "") "1yz61bk1.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED"; Key: "") "1yz61bk1.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES"; Key: "") "1yz61bk1.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS"; Key: "") "1yz61bk1.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS"; Key: "") "1yz61bk1.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT"; Key: "") "1yz61bk1.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES"; Key: "") "1yz61bk1.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CRLS"; Key: "") "1yz61bk1.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CTLS"; Key: "") "1yz61bk1.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE"; Key: "") "1yz61bk1.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE\CERTIFICATES"; Key: "") "1yz61bk1.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE\CRLS"; Key: "") "1yz61bk1.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE\CTLS"; Key: "") "1yz61bk1.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE"; Key: "")35:T58d,"1yz61bk1.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\AUTOUPDATE"; Key: "DISALLOWEDCERTSYNCDELTATIME") "1yz61bk1.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\MY"; Key: "") "1yz61bk1.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "1yz61bk1.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "1yz61bk1.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\2E4916B07F3DE90C8DDE2566FD9B9B400D89BBBA"; Key: "BLOB") "1yz61bk1.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\5AEAEE3F7F2A9449CEBAFEEC68FDD184F20124A7"; Key: "BLOB") "1yz61bk1.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\E6A3B45B062D509B3382282D196EFE97D5956CCB"; Key: "BLOB") "1yz61bk1.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\F5AD0BCC1AD56CD150725B1C866C30AD92EF21B0"; Key: "BLOB") "1yz61bk1.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS"; Key: "") "1yz61bk1.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS"; Key: "") "1yz61bk1.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "1yz61bk1.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "1yz61bk1.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\109F1CAED645BB78B3EA2B94C0697C740733031C"; Key: "BLOB")36:T4d6,"kX8EH32.exe" called "CreateDirectoryA" with parameter %TEMP%\IXP003.TMP (UID: 00000000-00002644) "1yz61bk1.exe" called "CreateDirectoryW" with parameter %WINDIR%\System32\GroupPolicy\Machine (UID: 00000000-00003736) "1yz61bk1.exe" called "CreateDirectoryW" with parameter %WINDIR%\System32\GroupPolicy\User (UID: 00000000-00003736) "1yz61bk1.exe" called "CreateDirectoryA" with parameter %LOCALAPPDATA%\MaxLoonaFest131 (UID: 00000000-00003736) "1yz61bk1.exe" called "CreateDirectoryA" with parameter %TEMP%\FANBooster131 (UID: 00000000-00003736) "1yz61bk1.exe" called "CreateDirectoryW" with parameter %LOCALAPPDATA%\Microsoft\Windows\Caches (UID: 00000000-00003736) "1yz61bk1.exe" called "CreateDirectoryA" with parameter %ALLUSERSPROFILE%\OfficeTrackerNMP131 (UID: 00000000-00003736) "1yz61bk1.exe" called "CreateDirectoryA" with parameter %TEMP%\grandUIAHWbMGyms9D53Z (UID: 00000000-00003736) "1yz61bk1.exe" called "CreateDirectoryA" with parameter %TEMP%\posterBoxHWbMGyms9D53Z (UID: 00000000-00003736) "4hV149il.exe" called "CreateDirectoryA" with parameter %TEMP%\grandUIADrNxWdvla9pcR (UID: 00000000-00003088) "4hV149il.exe" called "CreateDirectoryA" with parameter %TEMP%\posterBoxDrNxWdvla9pcR (UID: 00000000-00003088)37:T3379,"afa6fbd86c448bceaf510ae6f8b831be.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00001616) "afa6fbd86c448bceaf510ae6f8b831be.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00001616) "afa6fbd86c448bceaf510ae6f8b831be.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00001616) "afa6fbd86c448bceaf510ae6f8b831be.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00001616) "afa6fbd86c448bceaf510ae6f8b831be.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\advpack.dll (UID: 00000000-00001616) "tB0lu63.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00003500) "tB0lu63.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00003500) "tB0lu63.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00003500) "tB0lu63.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00003500) "tB0lu63.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\advpack.dll (UID: 00000000-00003500) "qP8xB26.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00002516) "qP8xB26.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00002516) "qP8xB26.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00002516) "qP8xB26.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00002516) "qP8xB26.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\advpack.dll (UID: 00000000-00002516) "kX8EH32.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00002644) "kX8EH32.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00002644) "kX8EH32.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00002644) "kX8EH32.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00002644) "kX8EH32.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\advapi32.dll (UID: 00000000-00002644) "kX8EH32.exe" called "LoadLibrary" with a parameter feclient.dll (UID: 00000000-00002644) "kX8EH32.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\advpack.dll (UID: 00000000-00002644) "1yz61bk1.exe" called "LoadLibrary" with a parameter msimg32.dll (UID: 00000000-00003736) "1yz61bk1.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00003736) "1yz61bk1.exe" called "LoadLibrary" with a parameter KERNEL32.dll (UID: 00000000-00003736) "1yz61bk1.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00003736) "1yz61bk1.exe" called "LoadLibrary" with a parameter GDI32.dll (UID: 00000000-00003736) "1yz61bk1.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00003736) "1yz61bk1.exe" called "LoadLibrary" with a parameter SHELL32.dll (UID: 00000000-00003736) "1yz61bk1.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00003736) "1yz61bk1.exe" called "LoadLibrary" with a parameter WS2_32.dll (UID: 00000000-00003736) "1yz61bk1.exe" called "LoadLibrary" with a parameter CRYPT32.dll (UID: 00000000-00003736) "1yz61bk1.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00003736) "1yz61bk1.exe" called "LoadLibrary" with a parameter gdiplus.dll (UID: 00000000-00003736) "1yz61bk1.exe" called "LoadLibrary" with a parameter SETUPAPI.dll (UID: 00000000-00003736) "1yz61bk1.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00003736) "1yz61bk1.exe" called "LoadLibrary" with a parameter msvcr100.dll (UID: 00000000-00003736) "1yz61bk1.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00003736) "1yz61bk1.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00003736) "1yz61bk1.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00003736) "1yz61bk1.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-0 (UID: 00000000-00003736) "1yz61bk1.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00003736) "1yz61bk1.exe" called "LoadLibrary" with a parameter api-ms-win-core-string-l1-1-0 (UID: 00000000-00003736) "1yz61bk1.exe" called "LoadLibrary" with a parameter api-ms-win-core-datetime-l1-1-1 (UID: 00000000-00003736) "1yz61bk1.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-obsolete-l1-2-0 (UID: 00000000-00003736) "1yz61bk1.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\uxtheme.dll (UID: 00000000-00003736) "1yz61bk1.exe" called "LoadLibrary" with a parameter propsys.dll (UID: 00000000-00003736) "1yz61bk1.exe" called "LoadLibrary" with a parameter comctl32.dll (UID: 00000000-00003736) "1yz61bk1.exe" called "LoadLibrary" with a parameter ntmarta.dll (UID: 00000000-00003736) "1yz61bk1.exe" called "LoadLibrary" with a parameter %WINDIR%\System32\shdocvw.dll (UID: 00000000-00003736) "1yz61bk1.exe" called "LoadLibrary" with a parameter PROPSYS.dll (UID: 00000000-00003736) "1yz61bk1.exe" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00003736) "1yz61bk1.exe" called "LoadLibrary" with a parameter ntshrui.dll (UID: 00000000-00003736) "1yz61bk1.exe" called "LoadLibrary" with a parameter srvcli.dll (UID: 00000000-00003736) "1yz61bk1.exe" called "LoadLibrary" with a parameter cscapi.dll (UID: 00000000-00003736) "1yz61bk1.exe" called "LoadLibrary" with a parameter slc.dll (UID: 00000000-00003736) "1yz61bk1.exe" called "LoadLibrary" with a parameter API-MS-Win-Security-SDDL-L1-1-0.dll (UID: 00000000-00003736) "1yz61bk1.exe" called "LoadLibrary" with a parameter SspiCli.dll (UID: 00000000-00003736) "1yz61bk1.exe" called "LoadLibrary" with a parameter winhttp.dll (UID: 00000000-00003736) "1yz61bk1.exe" called "LoadLibrary" with a parameter WININET.DLL (UID: 00000000-00003736) "1yz61bk1.exe" called "LoadLibrary" with a parameter RPCRT4.dll (UID: 00000000-00003736) "1yz61bk1.exe" called "LoadLibrary" with a parameter DNSAPI.dll (UID: 00000000-00003736) "1yz61bk1.exe" called "LoadLibrary" with a parameter secur32.dll (UID: 00000000-00003736) "1yz61bk1.exe" called "LoadLibrary" with a parameter ncrypt.dll (UID: 00000000-00003736) "1yz61bk1.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\bcryptprimitives.dll (UID: 00000000-00003736) "1yz61bk1.exe" called "LoadLibrary" with a parameter USERENV.dll (UID: 00000000-00003736) "1yz61bk1.exe" called "LoadLibrary" with a parameter CRYPTSP.dll (UID: 00000000-00003736) "1yz61bk1.exe" called "LoadLibrary" with a parameter CRYPTBASE.dll (UID: 00000000-00003736) "1yz61bk1.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2 (UID: 00000000-00003736) "1yz61bk1.exe" called "LoadLibrary" with a parameter netutils.dll (UID: 00000000-00003736) "schtasks.exe" called "LoadLibrary" with a parameter SspiCli.dll (UID: 00000000-00001284) "schtasks.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00003416) "schtasks.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00003416) "schtasks.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00003416) "schtasks.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00003416) "schtasks.exe" called "LoadLibrary" with a parameter SspiCli.dll (UID: 00000000-00003416) "4hV149il.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00003088) "4hV149il.exe" called "LoadLibrary" with a parameter winhttp.dll (UID: 00000000-00003088) "4hV149il.exe" called "LoadLibrary" with a parameter WININET.DLL (UID: 00000000-00003088) "4hV149il.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00003088) "4hV149il.exe" called "LoadLibrary" with a parameter WS2_32.dll (UID: 00000000-00003088) "4hV149il.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00003088) "4hV149il.exe" called "LoadLibrary" with a parameter SspiCli.dll (UID: 00000000-00003088) "4hV149il.exe" called "LoadLibrary" with a parameter RPCRT4.dll (UID: 00000000-00003088) "4hV149il.exe" called "LoadLibrary" with a parameter DNSAPI.dll (UID: 00000000-00003088) "4hV149il.exe" called "LoadLibrary" with a parameter CRYPT32.dll (UID: 00000000-00003088) "4hV149il.exe" called "LoadLibrary" with a parameter secur32.dll (UID: 00000000-00003088) "4hV149il.exe" called "LoadLibrary" with a parameter ncrypt.dll (UID: 00000000-00003088) "4hV149il.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\bcryptprimitives.dll (UID: 00000000-00003088) "4hV149il.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00003088) "4hV149il.exe" called "LoadLibrary" with a parameter USERENV.dll (UID: 00000000-00003088) "4hV149il.exe" called "LoadLibrary" with a parameter API-MS-Win-Security-SDDL-L1-1-0.dll (UID: 00000000-00003088) "4hV149il.exe" called "LoadLibrary" with a parameter CRYPTSP.dll (UID: 00000000-00003088) "4hV149il.exe" called "LoadLibrary" with a parameter CRYPTBASE.dll (UID: 00000000-00003088) "4hV149il.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2 (UID: 00000000-00003088) "5eh2lq1.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00003116) "5eh2lq1.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00003116) "5eh2lq1.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00003116) "5eh2lq1.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00003116) "5eh2lq1.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2 (UID: 00000000-00003116) "AppLaunch.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00004016) "AppLaunch.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00004016) "AppLaunch.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00004016) "AppLaunch.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00004016) "6FR1MW1.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00001512) "6FR1MW1.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00001512) "6FR1MW1.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00001512) "6FR1MW1.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00001512) "6FR1MW1.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\uxtheme.dll (UID: 00000000-00001512) "6FR1MW1.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00001512) "6FR1MW1.exe" called "LoadLibrary" with a parameter %TEMP%\IXP000.TMP\6FR1MW1.exe (UID: 00000000-00001512) "6FR1MW1.exe" called "LoadLibrary" with a parameter api-ms-win-core-sysinfo-l1-2-1 (UID: 00000000-00001512) "6FR1MW1.exe" called "LoadLibrary" with a parameter dwmapi.dll (UID: 00000000-00001512) "6FR1MW1.exe" called "LoadLibrary" with a parameter comctl32.dll (UID: 00000000-00001512) "6FR1MW1.exe" called "LoadLibrary" with a parameter UxTheme.dll (UID: 00000000-00001512) "6FR1MW1.exe" called "LoadLibrary" with a parameter IMM32.dll (UID: 00000000-00001512) "6FR1MW1.exe" called "LoadLibrary" with a parameter comctl32 (UID: 00000000-00001512) "6FR1MW1.exe" called "LoadLibrary" with a parameter SHELL32.dll (UID: 00000000-00001512) "6FR1MW1.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00001512) "6FR1MW1.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00001512) "6FR1MW1.exe" called "LoadLibrary" with a parameter propsys.dll (UID: 00000000-00001512) "6FR1MW1.exe" called "LoadLibrary" with a parameter %WINDIR%\System32\ieframe.dll (UID: 00000000-00001512) "6FR1MW1.exe" called "LoadLibrary" with a parameter api-ms-win-downlevel-ole32-l1-1-0.dll (UID: 00000000-00001512) "6FR1MW1.exe" called "LoadLibrary" with a parameter urlmon.dll (UID: 00000000-00001512) "6FR1MW1.exe" called "LoadLibrary" with a parameter api-ms-win-downlevel-shlwapi-l2-1-0.dll (UID: 00000000-00001512) "6FR1MW1.exe" called "LoadLibrary" with a parameter PROPSYS.dll (UID: 00000000-00001512) "6FR1MW1.exe" called "LoadLibrary" with a parameter %PROGRAMFILES%\Internet Explorer\ieproxy.dll (UID: 00000000-00001512) "6FR1MW1.exe" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00001512) "6FR1MW1.exe" called "LoadLibrary" with a parameter iertutil.dll (UID: 00000000-00001512) "6FR1MW1.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00001512) "6FR1MW1.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-1 (UID: 00000000-00001512) "6FR1MW1.exe" called "LoadLibrary" with a parameter ext-ms-win-kernel32-package-current-l1-1-0 (UID: 00000000-00001512)38:T13d0b,"afa6fbd86c448bceaf510ae6f8b831be.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00001616) "afa6fbd86c448bceaf510ae6f8b831be.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00001616) "afa6fbd86c448bceaf510ae6f8b831be.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00001616) "afa6fbd86c448bceaf510ae6f8b831be.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00001616) "afa6fbd86c448bceaf510ae6f8b831be.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00001616) "afa6fbd86c448bceaf510ae6f8b831be.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00001616) "afa6fbd86c448bceaf510ae6f8b831be.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00001616) "afa6fbd86c448bceaf510ae6f8b831be.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00001616) "afa6fbd86c448bceaf510ae6f8b831be.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00001616) "afa6fbd86c448bceaf510ae6f8b831be.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00001616) "afa6fbd86c448bceaf510ae6f8b831be.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00001616) "afa6fbd86c448bceaf510ae6f8b831be.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00001616) "afa6fbd86c448bceaf510ae6f8b831be.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00001616) "afa6fbd86c448bceaf510ae6f8b831be.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00001616) "afa6fbd86c448bceaf510ae6f8b831be.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00001616) "afa6fbd86c448bceaf510ae6f8b831be.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00001616) "afa6fbd86c448bceaf510ae6f8b831be.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00001616) "afa6fbd86c448bceaf510ae6f8b831be.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00001616) "afa6fbd86c448bceaf510ae6f8b831be.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00001616) "afa6fbd86c448bceaf510ae6f8b831be.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00001616) "afa6fbd86c448bceaf510ae6f8b831be.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00001616) "afa6fbd86c448bceaf510ae6f8b831be.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00001616) "afa6fbd86c448bceaf510ae6f8b831be.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00001616) "afa6fbd86c448bceaf510ae6f8b831be.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00001616) "afa6fbd86c448bceaf510ae6f8b831be.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00001616) "afa6fbd86c448bceaf510ae6f8b831be.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00001616) "afa6fbd86c448bceaf510ae6f8b831be.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00001616) "afa6fbd86c448bceaf510ae6f8b831be.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00001616) "afa6fbd86c448bceaf510ae6f8b831be.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00001616) "afa6fbd86c448bceaf510ae6f8b831be.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00001616) "afa6fbd86c448bceaf510ae6f8b831be.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00001616) "afa6fbd86c448bceaf510ae6f8b831be.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00001616) "afa6fbd86c448bceaf510ae6f8b831be.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00001616) "afa6fbd86c448bceaf510ae6f8b831be.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00001616) "afa6fbd86c448bceaf510ae6f8b831be.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00001616) "afa6fbd86c448bceaf510ae6f8b831be.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00001616) "afa6fbd86c448bceaf510ae6f8b831be.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00001616) "afa6fbd86c448bceaf510ae6f8b831be.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00001616) "afa6fbd86c448bceaf510ae6f8b831be.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00001616) "afa6fbd86c448bceaf510ae6f8b831be.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00001616) "afa6fbd86c448bceaf510ae6f8b831be.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00001616) "afa6fbd86c448bceaf510ae6f8b831be.exe" called "GetProcAddress" with a parameter DelNodeRunDLL32 (UID: 00000000-00001616) "afa6fbd86c448bceaf510ae6f8b831be.exe" called "GetProcAddress" with a parameter UnregisterTraceGuids (UID: 00000000-00001616) "tB0lu63.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00003500) "tB0lu63.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00003500) "tB0lu63.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00003500) "tB0lu63.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00003500) "tB0lu63.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00003500) "tB0lu63.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00003500) "tB0lu63.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00003500) "tB0lu63.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00003500) "tB0lu63.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00003500) "tB0lu63.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00003500) "tB0lu63.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00003500) "tB0lu63.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00003500) "tB0lu63.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00003500) "tB0lu63.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00003500) "tB0lu63.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00003500) "tB0lu63.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00003500) "tB0lu63.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00003500) "tB0lu63.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00003500) "tB0lu63.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00003500) "tB0lu63.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00003500) "tB0lu63.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00003500) "tB0lu63.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00003500) "tB0lu63.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00003500) "tB0lu63.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00003500) "tB0lu63.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00003500) "tB0lu63.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00003500) "tB0lu63.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00003500) "tB0lu63.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00003500) "tB0lu63.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00003500) "tB0lu63.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00003500) "tB0lu63.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00003500) "tB0lu63.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00003500) "tB0lu63.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00003500) "tB0lu63.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00003500) "tB0lu63.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00003500) "tB0lu63.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00003500) "tB0lu63.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00003500) "tB0lu63.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00003500) "tB0lu63.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00003500) "tB0lu63.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00003500) "tB0lu63.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00003500) "tB0lu63.exe" called "GetProcAddress" with a parameter DelNodeRunDLL32 (UID: 00000000-00003500) "tB0lu63.exe" called "GetProcAddress" with a parameter UnregisterTraceGuids (UID: 00000000-00003500) "qP8xB26.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00002516) "qP8xB26.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00002516) "qP8xB26.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00002516) "qP8xB26.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00002516) "qP8xB26.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00002516) "qP8xB26.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00002516) "qP8xB26.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00002516) "qP8xB26.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00002516) "qP8xB26.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00002516) "qP8xB26.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00002516) "qP8xB26.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00002516) "qP8xB26.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00002516) "qP8xB26.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00002516) "qP8xB26.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00002516) "qP8xB26.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00002516) "qP8xB26.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00002516) "qP8xB26.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00002516) "qP8xB26.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00002516) "qP8xB26.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00002516) "qP8xB26.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00002516) "qP8xB26.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00002516) "qP8xB26.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00002516) "qP8xB26.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00002516) "qP8xB26.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00002516) "qP8xB26.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00002516) "qP8xB26.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00002516) "qP8xB26.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00002516) "qP8xB26.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00002516) "qP8xB26.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00002516) "qP8xB26.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00002516) "qP8xB26.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00002516) "qP8xB26.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00002516) "qP8xB26.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00002516) "qP8xB26.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00002516) "qP8xB26.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00002516) "qP8xB26.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00002516) "qP8xB26.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00002516) "qP8xB26.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00002516) "qP8xB26.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00002516) "qP8xB26.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00002516) "qP8xB26.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00002516) "qP8xB26.exe" called "GetProcAddress" with a parameter DelNodeRunDLL32 (UID: 00000000-00002516) "qP8xB26.exe" called "GetProcAddress" with a parameter UnregisterTraceGuids (UID: 00000000-00002516) "kX8EH32.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00002644) "kX8EH32.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00002644) "kX8EH32.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00002644) "kX8EH32.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00002644) "kX8EH32.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00002644) "kX8EH32.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00002644) "kX8EH32.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00002644) "kX8EH32.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00002644) "kX8EH32.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00002644) "kX8EH32.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00002644) "kX8EH32.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00002644) "kX8EH32.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00002644) "kX8EH32.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00002644) "kX8EH32.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00002644) "kX8EH32.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00002644) "kX8EH32.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00002644) "kX8EH32.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00002644) "kX8EH32.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00002644) "kX8EH32.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00002644) "kX8EH32.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00002644) "kX8EH32.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00002644) "kX8EH32.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00002644) "kX8EH32.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00002644) "kX8EH32.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00002644) "kX8EH32.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00002644) "kX8EH32.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00002644) "kX8EH32.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00002644) "kX8EH32.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00002644) "kX8EH32.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00002644) "kX8EH32.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00002644) "kX8EH32.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00002644) "kX8EH32.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00002644) "kX8EH32.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00002644) "kX8EH32.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00002644) "kX8EH32.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00002644) "kX8EH32.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00002644) "kX8EH32.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00002644) "kX8EH32.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00002644) "kX8EH32.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00002644) "kX8EH32.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00002644) "kX8EH32.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00002644) "kX8EH32.exe" called "GetProcAddress" with a parameter DecryptFileA (UID: 00000000-00002644) "kX8EH32.exe" called "GetProcAddress" with a parameter FeClientInitialize (UID: 00000000-00002644) "kX8EH32.exe" called "GetProcAddress" with a parameter DelNodeRunDLL32 (UID: 00000000-00002644) "kX8EH32.exe" called "GetProcAddress" with a parameter UnregisterTraceGuids (UID: 00000000-00002644) "1yz61bk1.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00003736) "1yz61bk1.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00003736) "1yz61bk1.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00003736) "1yz61bk1.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00003736) "1yz61bk1.exe" called "GetProcAddress" with a parameter SystemFunction036 (UID: 00000000-00003736) "1yz61bk1.exe" called "GetProcAddress" with a parameter ThemeInitApiHook (UID: 00000000-00003736) "1yz61bk1.exe" called "GetProcAddress" with a parameter IsProcessDPIAware (UID: 00000000-00003736) "1yz61bk1.exe" called "GetProcAddress" with a parameter CLSIDFromOle1Class (UID: 00000000-00003736) "1yz61bk1.exe" called "GetProcAddress" with a parameter GetCatalogObject (UID: 00000000-00003736) "1yz61bk1.exe" called "GetProcAddress" with a parameter GetCatalogObject2 (UID: 00000000-00003736) "1yz61bk1.exe" called "GetProcAddress" with a parameter LpkEditControl (UID: 00000000-00003736) "1yz61bk1.exe" called "GetProcAddress" with a parameter DllGetClassObject (UID: 00000000-00003736) "1yz61bk1.exe" called "GetProcAddress" with a parameter DllCanUnloadNow (UID: 00000000-00003736) "1yz61bk1.exe" called "GetProcAddress" with a parameter NdrOleInitializeExtension (UID: 00000000-00003736) "1yz61bk1.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00003736) "1yz61bk1.exe" called "GetProcAddress" with a parameter CoGetMarshalSizeMax (UID: 00000000-00003736) "1yz61bk1.exe" called "GetProcAddress" with a parameter CoMarshalInterface (UID: 00000000-00003736) "1yz61bk1.exe" called "GetProcAddress" with a parameter CoUnmarshalInterface (UID: 00000000-00003736) "1yz61bk1.exe" called "GetProcAddress" with a parameter StringFromIID (UID: 00000000-00003736) "1yz61bk1.exe" called "GetProcAddress" with a parameter CoGetPSClsid (UID: 00000000-00003736) "1yz61bk1.exe" called "GetProcAddress" with a parameter CoTaskMemAlloc (UID: 00000000-00003736) "1yz61bk1.exe" called "GetProcAddress" with a parameter CoTaskMemFree (UID: 00000000-00003736) "1yz61bk1.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00003736) "1yz61bk1.exe" called "GetProcAddress" with a parameter CoReleaseMarshalData (UID: 00000000-00003736) "1yz61bk1.exe" called "GetProcAddress" with a parameter DcomChannelSetHResult (UID: 00000000-00003736) "1yz61bk1.exe" called "GetProcAddress" with a parameter GetSystemWow64DirectoryW (UID: 00000000-00003736) "1yz61bk1.exe" called "GetProcAddress" with a parameter StringFromGUID2 (UID: 00000000-00003736) "1yz61bk1.exe" called "GetProcAddress" with a parameter OpenThreadToken (UID: 00000000-00003736) "1yz61bk1.exe" called "GetProcAddress" with a parameter RegisterTraceGuidsW (UID: 00000000-00003736) "1yz61bk1.exe" called "GetProcAddress" with a parameter EventRegister (UID: 00000000-00003736) "1yz61bk1.exe" called "GetProcAddress" with a parameter EventUnregister (UID: 00000000-00003736) "1yz61bk1.exe" called "GetProcAddress" with a parameter EventEnabled (UID: 00000000-00003736) "1yz61bk1.exe" called "GetProcAddress" with a parameter EventWrite (UID: 00000000-00003736) "1yz61bk1.exe" called "GetProcAddress" with a parameter PSCreateMemoryPropertyStore (UID: 00000000-00003736) "1yz61bk1.exe" called "GetProcAddress" with a parameter CoGetApartmentType (UID: 00000000-00003736) "1yz61bk1.exe" called "GetProcAddress" with a parameter CoRegisterInitializeSpy (UID: 00000000-00003736) "1yz61bk1.exe" called "GetProcAddress" with a parameter CoGetMalloc (UID: 00000000-00003736) "1yz61bk1.exe" called "GetProcAddress" with a parameter CreateBindCtx (UID: 00000000-00003736) "1yz61bk1.exe" called "GetProcAddress" with a parameter RegEnumKeyW (UID: 00000000-00003736) "1yz61bk1.exe" called "GetProcAddress" with a parameter CM_Get_Device_Interface_List_Size_ExW (UID: 00000000-00003736) "1yz61bk1.exe" called "GetProcAddress" with a parameter InitializeSecurityDescriptor (UID: 00000000-00003736) "1yz61bk1.exe" called "GetProcAddress" with a parameter SetEntriesInAclW (UID: 00000000-00003736) "1yz61bk1.exe" called "GetProcAddress" with a parameter CM_Get_Device_Interface_List_ExW (UID: 00000000-00003736) "1yz61bk1.exe" called "GetProcAddress" with a parameter GetMartaExtensionInterface (UID: 00000000-00003736) "1yz61bk1.exe" called "GetProcAddress" with a parameter SetSecurityDescriptorDacl (UID: 00000000-00003736) "1yz61bk1.exe" called "GetProcAddress" with a parameter IsTextUnicode (UID: 00000000-00003736) "1yz61bk1.exe" called "GetProcAddress" with a parameter CoInitializeEx (UID: 00000000-00003736) "1yz61bk1.exe" called "GetProcAddress" with a parameter CoUninitialize (UID: 00000000-00003736) "1yz61bk1.exe" called "GetProcAddress" with a parameter ConvertSidToStringSidW (UID: 00000000-00003736) "1yz61bk1.exe" called "GetProcAddress" with a parameter PropVariantClear (UID: 00000000-00003736) "1yz61bk1.exe" called "GetProcAddress" with a parameter RegQueryValueW (UID: 00000000-00003736) "1yz61bk1.exe" called "GetProcAddress" with a parameter ApphelpCheckShellObject (UID: 00000000-00003736) "1yz61bk1.exe" called "GetProcAddress" with a parameter PSPropertyBag_ReadDWORD (UID: 00000000-00003736) "1yz61bk1.exe" called "GetProcAddress" with a parameter PSPropertyBag_ReadBSTR (UID: 00000000-00003736) "1yz61bk1.exe" called "GetProcAddress" with a parameter PSPropertyBag_ReadGUID (UID: 00000000-00003736) "1yz61bk1.exe" called "GetProcAddress" with a parameter CreateLinkInfoW (UID: 00000000-00003736) "1yz61bk1.exe" called "GetProcAddress" with a parameter IsCharAlphaW (UID: 00000000-00003736) "1yz61bk1.exe" called "GetProcAddress" with a parameter CharPrevW (UID: 00000000-00003736) "1yz61bk1.exe" called "GetProcAddress" with a parameter GetNetResourceFromLocalPathW (UID: 00000000-00003736) "1yz61bk1.exe" called "GetProcAddress" with a parameter NetShareEnum (UID: 00000000-00003736) "1yz61bk1.exe" called "GetProcAddress" with a parameter CscNetApiGetInterface (UID: 00000000-00003736) "1yz61bk1.exe" called "GetProcAddress" with a parameter SLGetWindowsInformationDWORD (UID: 00000000-00003736) "1yz61bk1.exe" called "GetProcAddress" with a parameter PathRemoveFileSpecW (UID: 00000000-00003736) "1yz61bk1.exe" called "GetProcAddress" with a parameter RegOpenKeyExW (UID: 00000000-00003736) "1yz61bk1.exe" called "GetProcAddress" with a parameter RegQueryValueExW (UID: 00000000-00003736) "1yz61bk1.exe" called "GetProcAddress" with a parameter RegCloseKey (UID: 00000000-00003736) "1yz61bk1.exe" called "GetProcAddress" with a parameter ConvertStringSecurityDescriptorToSecurityDescriptorW (UID: 00000000-00003736) "1yz61bk1.exe" called "GetProcAddress" with a parameter CharNextW (UID: 00000000-00003736) "1yz61bk1.exe" called "GetProcAddress" with a parameter DestroyLinkInfo (UID: 00000000-00003736) "1yz61bk1.exe" called "GetProcAddress" with a parameter CoRevokeInitializeSpy (UID: 00000000-00003736) "1yz61bk1.exe" called "GetProcAddress" with a parameter GetUserNameExA (UID: 00000000-00003736) "1yz61bk1.exe" called "GetProcAddress" with a parameter WSPStartup (UID: 00000000-00003736) "1yz61bk1.exe" called "GetProcAddress" with a parameter WSHOpenSocket (UID: 00000000-00003736) "1yz61bk1.exe" called "GetProcAddress" with a parameter WSHOpenSocket2 (UID: 00000000-00003736) "1yz61bk1.exe" called "GetProcAddress" with a parameter WSHJoinLeaf (UID: 00000000-00003736) "1yz61bk1.exe" called "GetProcAddress" with a parameter WSHNotify (UID: 00000000-00003736) "1yz61bk1.exe" called "GetProcAddress" with a parameter WSHGetSocketInformation (UID: 00000000-00003736) "1yz61bk1.exe" called "GetProcAddress" with a parameter WSHSetSocketInformation (UID: 00000000-00003736) "1yz61bk1.exe" called "GetProcAddress" with a parameter WSHGetSockaddrType (UID: 00000000-00003736) "1yz61bk1.exe" called "GetProcAddress" with a parameter WSHGetWildcardSockaddr (UID: 00000000-00003736) "1yz61bk1.exe" called "GetProcAddress" with a parameter WSHGetBroadcastSockaddr (UID: 00000000-00003736) "1yz61bk1.exe" called "GetProcAddress" with a parameter WSHAddressToString (UID: 00000000-00003736) "1yz61bk1.exe" called "GetProcAddress" with a parameter WSHStringToAddress (UID: 00000000-00003736) "1yz61bk1.exe" called "GetProcAddress" with a parameter WSHIoctl (UID: 00000000-00003736) "1yz61bk1.exe" called "GetProcAddress" with a parameter StrRChrA (UID: 00000000-00003736) "1yz61bk1.exe" called "GetProcAddress" with a parameter SetSystemFileCacheSize (UID: 00000000-00003736) "1yz61bk1.exe" called "GetProcAddress" with a parameter NtSetSystemInformation (UID: 00000000-00003736) "1yz61bk1.exe" called "GetProcAddress" with a parameter PrivIsDllSynchronizationHeld (UID: 00000000-00003736) "1yz61bk1.exe" called "GetProcAddress" with a parameter GetProductInfo (UID: 00000000-00003736) "1yz61bk1.exe" called "GetProcAddress" with a parameter InitSecurityInterfaceW (UID: 00000000-00003736) "1yz61bk1.exe" called "GetProcAddress" with a parameter InitSecurityInterfaceA (UID: 00000000-00003736) "1yz61bk1.exe" called "GetProcAddress" with a parameter SystemFunction035 (UID: 00000000-00003736) "1yz61bk1.exe" called "GetProcAddress" with a parameter RpcStringBindingComposeW (UID: 00000000-00003736) "1yz61bk1.exe" called "GetProcAddress" with a parameter RpcBindingFromStringBindingW (UID: 00000000-00003736) "1yz61bk1.exe" called "GetProcAddress" with a parameter RpcBindingSetAuthInfoExW (UID: 00000000-00003736) "1yz61bk1.exe" called "GetProcAddress" with a parameter RpcBindingSetOption (UID: 00000000-00003736) "1yz61bk1.exe" called "GetProcAddress" with a parameter RpcStringFreeW (UID: 00000000-00003736) "1yz61bk1.exe" called "GetProcAddress" with a parameter WSAStringToAddressW (UID: 00000000-00003736) "1yz61bk1.exe" called "GetProcAddress" with a parameter UrlCanonicalizeW (UID: 00000000-00003736) "1yz61bk1.exe" called "GetProcAddress" with a parameter StrCmpNW (UID: 00000000-00003736) "1yz61bk1.exe" called "GetProcAddress" with a parameter DnsGetProxyInformation (UID: 00000000-00003736) "1yz61bk1.exe" called "GetProcAddress" with a parameter NdrClientCall2 (UID: 00000000-00003736) "1yz61bk1.exe" called "GetProcAddress" with a parameter RpcBindingFree (UID: 00000000-00003736) "1yz61bk1.exe" called "GetProcAddress" with a parameter GetAddrInfoW (UID: 00000000-00003736) "1yz61bk1.exe" called "GetProcAddress" with a parameter NSPStartup (UID: 00000000-00003736) "1yz61bk1.exe" called "GetProcAddress" with a parameter DnsQueryConfigAllocEx (UID: 00000000-00003736) "1yz61bk1.exe" called "GetProcAddress" with a parameter DnsNameCompare_W (UID: 00000000-00003736) "1yz61bk1.exe" called "GetProcAddress" with a parameter DnsApiAlloc (UID: 00000000-00003736) "1yz61bk1.exe" called "GetProcAddress" with a parameter DnsQueryExW (UID: 00000000-00003736) "1yz61bk1.exe" called "GetProcAddress" with a parameter GetCurrentThreadCompartmentId (UID: 00000000-00003736) "1yz61bk1.exe" called "GetProcAddress" with a parameter WSAttemptAutodialAddr (UID: 00000000-00003736) "1yz61bk1.exe" called "GetProcAddress" with a parameter WSAttemptAutodialName (UID: 00000000-00003736) "1yz61bk1.exe" called "GetProcAddress" with a parameter WSNoteSuccessfulHostentLookup (UID: 00000000-00003736) "1yz61bk1.exe" called "GetProcAddress" with a parameter DnsApiFree (UID: 00000000-00003736) "1yz61bk1.exe" called "GetProcAddress" with a parameter DnsFree (UID: 00000000-00003736) "1yz61bk1.exe" called "GetProcAddress" with a parameter NamespaceCallout (UID: 00000000-00003736) "1yz61bk1.exe" called "GetProcAddress" with a parameter WSASocketW (UID: 00000000-00003736) "1yz61bk1.exe" called "GetProcAddress" with a parameter WSAIoctl (UID: 00000000-00003736) "1yz61bk1.exe" called "GetProcAddress" with a parameter FreeAddrInfoW (UID: 00000000-00003736) "1yz61bk1.exe" called "GetProcAddress" with a parameter SpUserModeInitialize (UID: 00000000-00003736) "1yz61bk1.exe" called "GetProcAddress" with a parameter RegCreateKeyExW (UID: 00000000-00003736) "1yz61bk1.exe" called "GetProcAddress" with a parameter WSASend (UID: 00000000-00003736) "1yz61bk1.exe" called "GetProcAddress" with a parameter WSARecv (UID: 00000000-00003736) "1yz61bk1.exe" called "GetProcAddress" with a parameter CertFreeCertificateContext (UID: 00000000-00003736) "1yz61bk1.exe" called "GetProcAddress" with a parameter FreeContextBuffer (UID: 00000000-00003736) "1yz61bk1.exe" called "GetProcAddress" with a parameter SslOpenProvider (UID: 00000000-00003736) "1yz61bk1.exe" called "GetProcAddress" with a parameter GetSChannelInterface (UID: 00000000-00003736) "1yz61bk1.exe" called "GetProcAddress" with a parameter GetHashInterface (UID: 00000000-00003736) "1yz61bk1.exe" called "GetProcAddress" with a parameter SslIncrementProviderReferenceCount (UID: 00000000-00003736) "1yz61bk1.exe" called "GetProcAddress" with a parameter SslImportKey (UID: 00000000-00003736) "1yz61bk1.exe" called "GetProcAddress" with a parameter GetCipherInterface (UID: 00000000-00003736) "1yz61bk1.exe" called "GetProcAddress" with a parameter SslLookupCipherSuiteInfo (UID: 00000000-00003736) "1yz61bk1.exe" called "GetProcAddress" with a parameter LoadStringW (UID: 00000000-00003736) "1yz61bk1.exe" called "GetProcAddress" with a parameter BCryptOpenAlgorithmProvider (UID: 00000000-00003736) "1yz61bk1.exe" called "GetProcAddress" with a parameter BCryptGetProperty (UID: 00000000-00003736) "1yz61bk1.exe" called "GetProcAddress" with a parameter BCryptCreateHash (UID: 00000000-00003736) "1yz61bk1.exe" called "GetProcAddress" with a parameter BCryptHashData (UID: 00000000-00003736) "1yz61bk1.exe" called "GetProcAddress" with a parameter BCryptFinishHash (UID: 00000000-00003736) "1yz61bk1.exe" called "GetProcAddress" with a parameter BCryptDestroyHash (UID: 00000000-00003736) "1yz61bk1.exe" called "GetProcAddress" with a parameter CertGetCertificateChain (UID: 00000000-00003736) "1yz61bk1.exe" called "GetProcAddress" with a parameter GetUserProfileDirectoryW (UID: 00000000-00003736) "1yz61bk1.exe" called "GetProcAddress" with a parameter ConvertStringSidToSidW (UID: 00000000-00003736) "1yz61bk1.exe" called "GetProcAddress" with a parameter RegisterGPNotification (UID: 00000000-00003736) "1yz61bk1.exe" called "GetProcAddress" with a parameter RegisterGPNotificationInternal (UID: 00000000-00003736) "1yz61bk1.exe" called "GetProcAddress" with a parameter OpenSCManagerW (UID: 00000000-00003736) "1yz61bk1.exe" called "GetProcAddress" with a parameter OpenServiceW (UID: 00000000-00003736) "1yz61bk1.exe" called "GetProcAddress" with a parameter CloseServiceHandle (UID: 00000000-00003736) "1yz61bk1.exe" called "GetProcAddress" with a parameter QueryServiceConfigW (UID: 00000000-00003736) "1yz61bk1.exe" called "GetProcAddress" with a parameter CryptAcquireContextA (UID: 00000000-00003736) "1yz61bk1.exe" called "GetProcAddress" with a parameter CPAcquireContext (UID: 00000000-00003736) "1yz61bk1.exe" called "GetProcAddress" with a parameter CPReleaseContext (UID: 00000000-00003736) "1yz61bk1.exe" called "GetProcAddress" with a parameter CPGenKey (UID: 00000000-00003736) "1yz61bk1.exe" called "GetProcAddress" with a parameter CPDeriveKey (UID: 00000000-00003736) "1yz61bk1.exe" called "GetProcAddress" with a parameter CPDestroyKey (UID: 00000000-00003736) "1yz61bk1.exe" called "GetProcAddress" with a parameter CPSetKeyParam (UID: 00000000-00003736) "1yz61bk1.exe" called "GetProcAddress" with a parameter CPGetKeyParam (UID: 00000000-00003736) "1yz61bk1.exe" called "GetProcAddress" with a parameter CPExportKey (UID: 00000000-00003736) "1yz61bk1.exe" called "GetProcAddress" with a parameter CPImportKey (UID: 00000000-00003736) "1yz61bk1.exe" called "GetProcAddress" with a parameter CPEncrypt (UID: 00000000-00003736) "1yz61bk1.exe" called "GetProcAddress" with a parameter CPDecrypt (UID: 00000000-00003736) "1yz61bk1.exe" called "GetProcAddress" with a parameter CPCreateHash (UID: 00000000-00003736) "1yz61bk1.exe" called "GetProcAddress" with a parameter CPHashData (UID: 00000000-00003736) "1yz61bk1.exe" called "GetProcAddress" with a parameter CPHashSessionKey (UID: 00000000-00003736) "1yz61bk1.exe" called "GetProcAddress" with a parameter CPDestroyHash (UID: 00000000-00003736) "1yz61bk1.exe" called "GetProcAddress" with a parameter CPSignHash (UID: 00000000-00003736) "1yz61bk1.exe" called "GetProcAddress" with a parameter CPVerifySignature (UID: 00000000-00003736) "1yz61bk1.exe" called "GetProcAddress" with a parameter CPGenRandom (UID: 00000000-00003736) "1yz61bk1.exe" called "GetProcAddress" with a parameter CPGetUserKey (UID: 00000000-00003736) "1yz61bk1.exe" called "GetProcAddress" with a parameter CPSetProvParam (UID: 00000000-00003736) "1yz61bk1.exe" called "GetProcAddress" with a parameter CPGetProvParam (UID: 00000000-00003736) "1yz61bk1.exe" called "GetProcAddress" with a parameter CPSetHashParam (UID: 00000000-00003736) "1yz61bk1.exe" called "GetProcAddress" with a parameter CPGetHashParam (UID: 00000000-00003736) "1yz61bk1.exe" called "GetProcAddress" with a parameter CPDuplicateKey (UID: 00000000-00003736) "1yz61bk1.exe" called "GetProcAddress" with a parameter CPDuplicateHash (UID: 00000000-00003736) "1yz61bk1.exe" called "GetProcAddress" with a parameter OpenProcessToken (UID: 00000000-00003736) "1yz61bk1.exe" called "GetProcAddress" with a parameter GetTokenInformation (UID: 00000000-00003736) "1yz61bk1.exe" called "GetProcAddress" with a parameter AllocateAndInitializeSid (UID: 00000000-00003736) "1yz61bk1.exe" called "GetProcAddress" with a parameter EqualSid (UID: 00000000-00003736) "1yz61bk1.exe" called "GetProcAddress" with a parameter FreeSid (UID: 00000000-00003736) "1yz61bk1.exe" called "GetProcAddress" with a parameter CryptImportKey (UID: 00000000-00003736) "1yz61bk1.exe" called "GetProcAddress" with a parameter CryptGetKeyParam (UID: 00000000-00003736) "1yz61bk1.exe" called "GetProcAddress" with a parameter CryptDestroyKey (UID: 00000000-00003736) "1yz61bk1.exe" called "GetProcAddress" with a parameter CryptCreateHash (UID: 00000000-00003736) "1yz61bk1.exe" called "GetProcAddress" with a parameter CryptHashData (UID: 00000000-00003736) "1yz61bk1.exe" called "GetProcAddress" with a parameter CryptVerifySignatureA (UID: 00000000-00003736) "1yz61bk1.exe" called "GetProcAddress" with a parameter CryptDestroyHash (UID: 00000000-00003736) "1yz61bk1.exe" called "GetProcAddress" with a parameter GetAsymmetricEncryptionInterface (UID: 00000000-00003736) "1yz61bk1.exe" called "GetProcAddress" with a parameter BCryptImportKeyPair (UID: 00000000-00003736) "1yz61bk1.exe" called "GetProcAddress" with a parameter BCryptVerifySignature (UID: 00000000-00003736) "1yz61bk1.exe" called "GetProcAddress" with a parameter BCryptDestroyKey (UID: 00000000-00003736) "1yz61bk1.exe" called "GetProcAddress" with a parameter CertVerifyCertificateChainPolicy (UID: 00000000-00003736) "1yz61bk1.exe" called "GetProcAddress" with a parameter CertFreeCertificateChain (UID: 00000000-00003736) "1yz61bk1.exe" called "GetProcAddress" with a parameter CertDuplicateCertificateContext (UID: 00000000-00003736) "1yz61bk1.exe" called "GetProcAddress" with a parameter SslEncryptPacket (UID: 00000000-00003736) "1yz61bk1.exe" called "GetProcAddress" with a parameter SslDecryptPacket (UID: 00000000-00003736) "1yz61bk1.exe" called "GetProcAddress" with a parameter SslFreeObject (UID: 00000000-00003736) "1yz61bk1.exe" called "GetProcAddress" with a parameter NetApiBufferFree (UID: 00000000-00003736) "1yz61bk1.exe" called "GetProcAddress" with a parameter UnregisterTraceGuids (UID: 00000000-00003736) "schtasks.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00001284) "schtasks.exe" called "GetProcAddress" with a parameter GetUserNameExW (UID: 00000000-00001284) "schtasks.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00001284) "schtasks.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00003416) "schtasks.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00003416) "schtasks.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00003416) "schtasks.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00003416) "schtasks.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00003416) "schtasks.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00003416) "schtasks.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00003416) "schtasks.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00003416) "schtasks.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00003416) "schtasks.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00003416) "schtasks.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00003416) "schtasks.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00003416) "schtasks.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00003416) "schtasks.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00003416) "schtasks.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00003416) "schtasks.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00003416) "schtasks.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00003416) "schtasks.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00003416) "schtasks.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00003416) "schtasks.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00003416) "schtasks.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00003416) "schtasks.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00003416) "schtasks.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00003416) "schtasks.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00003416) "schtasks.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00003416) "schtasks.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00003416) "schtasks.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00003416) "schtasks.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00003416) "schtasks.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00003416) "schtasks.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00003416) "schtasks.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00003416) "schtasks.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00003416) "schtasks.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00003416) "schtasks.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00003416) "schtasks.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00003416) "schtasks.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00003416) "schtasks.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00003416) "schtasks.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00003416) "schtasks.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00003416) "schtasks.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00003416) "schtasks.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00003416) "schtasks.exe" called "GetProcAddress" with a parameter GetUserNameExW (UID: 00000000-00003416) "3mk61Eb.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00000904) "3mk61Eb.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00000904) "3mk61Eb.exe" called "GetProcAddress" with a parameter UnregisterTraceGuids (UID: 00000000-00000904) "4hV149il.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00003088) "4hV149il.exe" called "GetProcAddress" with a parameter GetSystemWow64DirectoryW (UID: 00000000-00003088) "4hV149il.exe" called "GetProcAddress" with a parameter StringFromGUID2 (UID: 00000000-00003088) "4hV149il.exe" called "GetProcAddress" with a parameter OpenThreadToken (UID: 00000000-00003088) "4hV149il.exe" called "GetProcAddress" with a parameter InternetOpenA (UID: 00000000-00003088) "4hV149il.exe" called "GetProcAddress" with a parameter InternetSetOptionA (UID: 00000000-00003088) "4hV149il.exe" called "GetProcAddress" with a parameter HttpOpenRequestA (UID: 00000000-00003088) "4hV149il.exe" called "GetProcAddress" with a parameter InternetConnectA (UID: 00000000-00003088) "4hV149il.exe" called "GetProcAddress" with a parameter InternetOpenUrlA (UID: 00000000-00003088) "4hV149il.exe" called "GetProcAddress" with a parameter HttpQueryInfoA (UID: 00000000-00003088) "4hV149il.exe" called "GetProcAddress" with a parameter InternetQueryOptionA (UID: 00000000-00003088) "4hV149il.exe" called "GetProcAddress" with a parameter HttpSendRequestA (UID: 00000000-00003088) "4hV149il.exe" called "GetProcAddress" with a parameter InternetReadFile (UID: 00000000-00003088) "4hV149il.exe" called "GetProcAddress" with a parameter InternetCloseHandle (UID: 00000000-00003088) "4hV149il.exe" called "GetProcAddress" with a parameter WSPStartup (UID: 00000000-00003088) "4hV149il.exe" called "GetProcAddress" with a parameter WSHOpenSocket (UID: 00000000-00003088) "4hV149il.exe" called "GetProcAddress" with a parameter WSHOpenSocket2 (UID: 00000000-00003088) "4hV149il.exe" called "GetProcAddress" with a parameter WSHJoinLeaf (UID: 00000000-00003088) "4hV149il.exe" called "GetProcAddress" with a parameter WSHNotify (UID: 00000000-00003088) "4hV149il.exe" called "GetProcAddress" with a parameter WSHGetSocketInformation (UID: 00000000-00003088) "4hV149il.exe" called "GetProcAddress" with a parameter WSHSetSocketInformation (UID: 00000000-00003088) "4hV149il.exe" called "GetProcAddress" with a parameter WSHGetSockaddrType (UID: 00000000-00003088) "4hV149il.exe" called "GetProcAddress" with a parameter WSHGetWildcardSockaddr (UID: 00000000-00003088) "4hV149il.exe" called "GetProcAddress" with a parameter WSHGetBroadcastSockaddr (UID: 00000000-00003088) "4hV149il.exe" called "GetProcAddress" with a parameter WSHAddressToString (UID: 00000000-00003088) "4hV149il.exe" called "GetProcAddress" with a parameter WSHStringToAddress (UID: 00000000-00003088) "4hV149il.exe" called "GetProcAddress" with a parameter WSHIoctl (UID: 00000000-00003088) "4hV149il.exe" called "GetProcAddress" with a parameter RegOpenKeyExW (UID: 00000000-00003088) "4hV149il.exe" called "GetProcAddress" with a parameter RegCloseKey (UID: 00000000-00003088) "4hV149il.exe" called "GetProcAddress" with a parameter WinHttpConnect (UID: 00000000-00003088) "4hV149il.exe" called "GetProcAddress" with a parameter WinHttpQueryHeaders (UID: 00000000-00003088) "4hV149il.exe" called "GetProcAddress" with a parameter WinHttpOpen (UID: 00000000-00003088) "4hV149il.exe" called "GetProcAddress" with a parameter WinHttpOpenRequest (UID: 00000000-00003088) "4hV149il.exe" called "GetProcAddress" with a parameter WinHttpQueryDataAvailable (UID: 00000000-00003088) "4hV149il.exe" called "GetProcAddress" with a parameter WinHttpSendRequest (UID: 00000000-00003088) "4hV149il.exe" called "GetProcAddress" with a parameter WinHttpReceiveResponse (UID: 00000000-00003088) "4hV149il.exe" called "GetProcAddress" with a parameter WinHttpReadData (UID: 00000000-00003088) "4hV149il.exe" called "GetProcAddress" with a parameter WinHttpCloseHandle (UID: 00000000-00003088) "4hV149il.exe" called "GetProcAddress" with a parameter WinHttpSetTimeouts (UID: 00000000-00003088) "4hV149il.exe" called "GetProcAddress" with a parameter StrRChrA (UID: 00000000-00003088) "4hV149il.exe" called "GetProcAddress" with a parameter SetSystemFileCacheSize (UID: 00000000-00003088) "4hV149il.exe" called "GetProcAddress" with a parameter NtSetSystemInformation (UID: 00000000-00003088) "4hV149il.exe" called "GetProcAddress" with a parameter PrivIsDllSynchronizationHeld (UID: 00000000-00003088) "4hV149il.exe" called "GetProcAddress" with a parameter GetProductInfo (UID: 00000000-00003088) "4hV149il.exe" called "GetProcAddress" with a parameter InitSecurityInterfaceW (UID: 00000000-00003088) "4hV149il.exe" called "GetProcAddress" with a parameter InitSecurityInterfaceA (UID: 00000000-00003088) "4hV149il.exe" called "GetProcAddress" with a parameter SystemFunction035 (UID: 00000000-00003088) "4hV149il.exe" called "GetProcAddress" with a parameter RpcStringBindingComposeW (UID: 00000000-00003088) "4hV149il.exe" called "GetProcAddress" with a parameter RpcBindingFromStringBindingW (UID: 00000000-00003088) "4hV149il.exe" called "GetProcAddress" with a parameter RpcBindingSetAuthInfoExW (UID: 00000000-00003088) "4hV149il.exe" called "GetProcAddress" with a parameter RpcBindingSetOption (UID: 00000000-00003088) "4hV149il.exe" called "GetProcAddress" with a parameter RpcStringFreeW (UID: 00000000-00003088) "4hV149il.exe" called "GetProcAddress" with a parameter WSAStringToAddressW (UID: 00000000-00003088) "4hV149il.exe" called "GetProcAddress" with a parameter UrlCanonicalizeW (UID: 00000000-00003088) "4hV149il.exe" called "GetProcAddress" with a parameter StrCmpNW (UID: 00000000-00003088) "4hV149il.exe" called "GetProcAddress" with a parameter DnsGetProxyInformation (UID: 00000000-00003088) "4hV149il.exe" called "GetProcAddress" with a parameter NdrClientCall2 (UID: 00000000-00003088) "4hV149il.exe" called "GetProcAddress" with a parameter RpcBindingFree (UID: 00000000-00003088) "4hV149il.exe" called "GetProcAddress" with a parameter GetAddrInfoW (UID: 00000000-00003088) "4hV149il.exe" called "GetProcAddress" with a parameter NSPStartup (UID: 00000000-00003088) "4hV149il.exe" called "GetProcAddress" with a parameter DnsQueryConfigAllocEx (UID: 00000000-00003088) "4hV149il.exe" called "GetProcAddress" with a parameter DnsNameCompare_W (UID: 00000000-00003088) "4hV149il.exe" called "GetProcAddress" with a parameter DnsApiAlloc (UID: 00000000-00003088) "4hV149il.exe" called "GetProcAddress" with a parameter DnsQueryExW (UID: 00000000-00003088) "4hV149il.exe" called "GetProcAddress" with a parameter GetCurrentThreadCompartmentId (UID: 00000000-00003088) "4hV149il.exe" called "GetProcAddress" with a parameter WSAttemptAutodialAddr (UID: 00000000-00003088) "4hV149il.exe" called "GetProcAddress" with a parameter WSAttemptAutodialName (UID: 00000000-00003088) "4hV149il.exe" called "GetProcAddress" with a parameter WSNoteSuccessfulHostentLookup (UID: 00000000-00003088) "4hV149il.exe" called "GetProcAddress" with a parameter DnsApiFree (UID: 00000000-00003088) "4hV149il.exe" called "GetProcAddress" with a parameter DnsFree (UID: 00000000-00003088) "4hV149il.exe" called "GetProcAddress" with a parameter NamespaceCallout (UID: 00000000-00003088) "4hV149il.exe" called "GetProcAddress" with a parameter WSASocketW (UID: 00000000-00003088) "4hV149il.exe" called "GetProcAddress" with a parameter WSAIoctl (UID: 00000000-00003088) "4hV149il.exe" called "GetProcAddress" with a parameter FreeAddrInfoW (UID: 00000000-00003088) "4hV149il.exe" called "GetProcAddress" with a parameter SpUserModeInitialize (UID: 00000000-00003088) "4hV149il.exe" called "GetProcAddress" with a parameter RegCreateKeyExW (UID: 00000000-00003088) "4hV149il.exe" called "GetProcAddress" with a parameter RegQueryValueExW (UID: 00000000-00003088) "4hV149il.exe" called "GetProcAddress" with a parameter WSASend (UID: 00000000-00003088) "4hV149il.exe" called "GetProcAddress" with a parameter WSARecv (UID: 00000000-00003088) "4hV149il.exe" called "GetProcAddress" with a parameter CertFreeCertificateContext (UID: 00000000-00003088) "4hV149il.exe" called "GetProcAddress" with a parameter FreeContextBuffer (UID: 00000000-00003088) "4hV149il.exe" called "GetProcAddress" with a parameter SslOpenProvider (UID: 00000000-00003088) "4hV149il.exe" called "GetProcAddress" with a parameter GetSChannelInterface (UID: 00000000-00003088) "4hV149il.exe" called "GetProcAddress" with a parameter GetHashInterface (UID: 00000000-00003088) "4hV149il.exe" called "GetProcAddress" with a parameter SslIncrementProviderReferenceCount (UID: 00000000-00003088) "4hV149il.exe" called "GetProcAddress" with a parameter SslImportKey (UID: 00000000-00003088) "4hV149il.exe" called "GetProcAddress" with a parameter GetCipherInterface (UID: 00000000-00003088) "4hV149il.exe" called "GetProcAddress" with a parameter SslLookupCipherSuiteInfo (UID: 00000000-00003088) "4hV149il.exe" called "GetProcAddress" with a parameter LoadStringW (UID: 00000000-00003088) "4hV149il.exe" called "GetProcAddress" with a parameter BCryptOpenAlgorithmProvider (UID: 00000000-00003088) "4hV149il.exe" called "GetProcAddress" with a parameter BCryptGetProperty (UID: 00000000-00003088) "4hV149il.exe" called "GetProcAddress" with a parameter BCryptCreateHash (UID: 00000000-00003088) "4hV149il.exe" called "GetProcAddress" with a parameter BCryptHashData (UID: 00000000-00003088) "4hV149il.exe" called "GetProcAddress" with a parameter BCryptFinishHash (UID: 00000000-00003088) "4hV149il.exe" called "GetProcAddress" with a parameter BCryptDestroyHash (UID: 00000000-00003088) "4hV149il.exe" called "GetProcAddress" with a parameter CertGetCertificateChain (UID: 00000000-00003088) "4hV149il.exe" called "GetProcAddress" with a parameter GetUserProfileDirectoryW (UID: 00000000-00003088) "4hV149il.exe" called "GetProcAddress" with a parameter ConvertSidToStringSidW (UID: 00000000-00003088) "4hV149il.exe" called "GetProcAddress" with a parameter ConvertStringSidToSidW (UID: 00000000-00003088) "4hV149il.exe" called "GetProcAddress" with a parameter RegisterGPNotification (UID: 00000000-00003088) "4hV149il.exe" called "GetProcAddress" with a parameter RegisterGPNotificationInternal (UID: 00000000-00003088) "4hV149il.exe" called "GetProcAddress" with a parameter OpenSCManagerW (UID: 00000000-00003088) "4hV149il.exe" called "GetProcAddress" with a parameter OpenServiceW (UID: 00000000-00003088) "4hV149il.exe" called "GetProcAddress" with a parameter CloseServiceHandle (UID: 00000000-00003088) "4hV149il.exe" called "GetProcAddress" with a parameter QueryServiceConfigW (UID: 00000000-00003088) "4hV149il.exe" called "GetProcAddress" with a parameter CryptAcquireContextA (UID: 00000000-00003088) "4hV149il.exe" called "GetProcAddress" with a parameter CPAcquireContext (UID: 00000000-00003088) "4hV149il.exe" called "GetProcAddress" with a parameter CPReleaseContext (UID: 00000000-00003088) "4hV149il.exe" called "GetProcAddress" with a parameter CPGenKey (UID: 00000000-00003088) "4hV149il.exe" called "GetProcAddress" with a parameter CPDeriveKey (UID: 00000000-00003088) "4hV149il.exe" called "GetProcAddress" with a parameter CPDestroyKey (UID: 00000000-00003088) "4hV149il.exe" called "GetProcAddress" with a parameter CPSetKeyParam (UID: 00000000-00003088) "4hV149il.exe" called "GetProcAddress" with a parameter CPGetKeyParam (UID: 00000000-00003088) "4hV149il.exe" called "GetProcAddress" with a parameter CPExportKey (UID: 00000000-00003088) "4hV149il.exe" called "GetProcAddress" with a parameter CPImportKey (UID: 00000000-00003088) "4hV149il.exe" called "GetProcAddress" with a parameter CPEncrypt (UID: 00000000-00003088) "4hV149il.exe" called "GetProcAddress" with a parameter CPDecrypt (UID: 00000000-00003088) "4hV149il.exe" called "GetProcAddress" with a parameter CPCreateHash (UID: 00000000-00003088) "4hV149il.exe" called "GetProcAddress" with a parameter CPHashData (UID: 00000000-00003088) "4hV149il.exe" called "GetProcAddress" with a parameter CPHashSessionKey (UID: 00000000-00003088) "4hV149il.exe" called "GetProcAddress" with a parameter CPDestroyHash (UID: 00000000-00003088) "4hV149il.exe" called "GetProcAddress" with a parameter CPSignHash (UID: 00000000-00003088) "4hV149il.exe" called "GetProcAddress" with a parameter CPVerifySignature (UID: 00000000-00003088) "4hV149il.exe" called "GetProcAddress" with a parameter CPGenRandom (UID: 00000000-00003088) "4hV149il.exe" called "GetProcAddress" with a parameter CPGetUserKey (UID: 00000000-00003088) "4hV149il.exe" called "GetProcAddress" with a parameter CPSetProvParam (UID: 00000000-00003088) "4hV149il.exe" called "GetProcAddress" with a parameter CPGetProvParam (UID: 00000000-00003088) "4hV149il.exe" called "GetProcAddress" with a parameter CPSetHashParam (UID: 00000000-00003088) "4hV149il.exe" called "GetProcAddress" with a parameter CPGetHashParam (UID: 00000000-00003088) "4hV149il.exe" called "GetProcAddress" with a parameter CPDuplicateKey (UID: 00000000-00003088) "4hV149il.exe" called "GetProcAddress" with a parameter CPDuplicateHash (UID: 00000000-00003088) "4hV149il.exe" called "GetProcAddress" with a parameter OpenProcessToken (UID: 00000000-00003088) "4hV149il.exe" called "GetProcAddress" with a parameter GetTokenInformation (UID: 00000000-00003088) "4hV149il.exe" called "GetProcAddress" with a parameter AllocateAndInitializeSid (UID: 00000000-00003088) "4hV149il.exe" called "GetProcAddress" with a parameter EqualSid (UID: 00000000-00003088) "4hV149il.exe" called "GetProcAddress" with a parameter FreeSid (UID: 00000000-00003088) "4hV149il.exe" called "GetProcAddress" with a parameter SystemFunction036 (UID: 00000000-00003088) "4hV149il.exe" called "GetProcAddress" with a parameter CryptImportKey (UID: 00000000-00003088) "4hV149il.exe" called "GetProcAddress" with a parameter CryptGetKeyParam (UID: 00000000-00003088) "4hV149il.exe" called "GetProcAddress" with a parameter CryptDestroyKey (UID: 00000000-00003088) "4hV149il.exe" called "GetProcAddress" with a parameter CryptCreateHash (UID: 00000000-00003088) "4hV149il.exe" called "GetProcAddress" with a parameter CryptHashData (UID: 00000000-00003088) "4hV149il.exe" called "GetProcAddress" with a parameter CryptVerifySignatureA (UID: 00000000-00003088) "4hV149il.exe" called "GetProcAddress" with a parameter CryptDestroyHash (UID: 00000000-00003088) "4hV149il.exe" called "GetProcAddress" with a parameter GetAsymmetricEncryptionInterface (UID: 00000000-00003088) "4hV149il.exe" called "GetProcAddress" with a parameter BCryptImportKeyPair (UID: 00000000-00003088) "4hV149il.exe" called "GetProcAddress" with a parameter BCryptVerifySignature (UID: 00000000-00003088) "4hV149il.exe" called "GetProcAddress" with a parameter BCryptDestroyKey (UID: 00000000-00003088) "4hV149il.exe" called "GetProcAddress" with a parameter CertVerifyCertificateChainPolicy (UID: 00000000-00003088) "4hV149il.exe" called "GetProcAddress" with a parameter CertFreeCertificateChain (UID: 00000000-00003088) "4hV149il.exe" called "GetProcAddress" with a parameter CertDuplicateCertificateContext (UID: 00000000-00003088) "4hV149il.exe" called "GetProcAddress" with a parameter SslEncryptPacket (UID: 00000000-00003088) "4hV149il.exe" called "GetProcAddress" with a parameter SslDecryptPacket (UID: 00000000-00003088) "4hV149il.exe" called "GetProcAddress" with a parameter SslFreeObject (UID: 00000000-00003088) "4hV149il.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00003088) "4hV149il.exe" called "GetProcAddress" with a parameter UnregisterTraceGuids (UID: 00000000-00003088) "5eh2lq1.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00003116) "5eh2lq1.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00003116) "5eh2lq1.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00003116) "5eh2lq1.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00003116) "5eh2lq1.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00003116) "5eh2lq1.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00003116) "5eh2lq1.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00003116) "5eh2lq1.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00003116) "5eh2lq1.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00003116) "5eh2lq1.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00003116) "5eh2lq1.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00003116) "5eh2lq1.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00003116) "5eh2lq1.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00003116) "5eh2lq1.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00003116) "5eh2lq1.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00003116) "5eh2lq1.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00003116) "5eh2lq1.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00003116) "5eh2lq1.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00003116) "5eh2lq1.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00003116) "5eh2lq1.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00003116) "5eh2lq1.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00003116) "5eh2lq1.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00003116) "5eh2lq1.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00003116) "5eh2lq1.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00003116) "5eh2lq1.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00003116) "5eh2lq1.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00003116) "5eh2lq1.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00003116) "5eh2lq1.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00003116) "5eh2lq1.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00003116) "5eh2lq1.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00003116) "5eh2lq1.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00003116) "5eh2lq1.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00003116) "5eh2lq1.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00003116) "5eh2lq1.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00003116) "5eh2lq1.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00003116) "5eh2lq1.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00003116) "5eh2lq1.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00003116) "5eh2lq1.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00003116) "5eh2lq1.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00003116) "5eh2lq1.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00003116) "5eh2lq1.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00003116) "5eh2lq1.exe" called "GetProcAddress" with a parameter UnregisterTraceGuids (UID: 00000000-00003116) "AppLaunch.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00004016) "AppLaunch.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00004016) "AppLaunch.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00004016) "AppLaunch.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00004016) "AppLaunch.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00004016) "AppLaunch.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00004016) "AppLaunch.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00004016) "AppLaunch.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00004016) "AppLaunch.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00004016) "AppLaunch.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00004016) "AppLaunch.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00004016) "AppLaunch.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00004016) "AppLaunch.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00004016) "AppLaunch.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00004016) "AppLaunch.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00004016) "AppLaunch.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00004016) "AppLaunch.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00004016) "AppLaunch.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00004016) "AppLaunch.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00004016) "AppLaunch.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00004016) "AppLaunch.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00004016) "AppLaunch.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00004016) "AppLaunch.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00004016) "AppLaunch.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00004016) "AppLaunch.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00004016) "AppLaunch.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00004016) "AppLaunch.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00004016) "AppLaunch.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00004016) "AppLaunch.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00004016) "AppLaunch.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00004016) "AppLaunch.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00004016) "AppLaunch.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00004016) "AppLaunch.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00004016) "AppLaunch.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00004016) "AppLaunch.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00004016) "AppLaunch.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00004016) "AppLaunch.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00004016) "AppLaunch.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00004016) "AppLaunch.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00004016) "AppLaunch.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00004016) "AppLaunch.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00004016) "AppLaunch.exe" called "GetProcAddress" with a parameter UnregisterTraceGuids (UID: 00000000-00004016) "6FR1MW1.exe" called "GetProcAddress" with a parameter ThemeInitApiHook (UID: 00000000-00001512) "6FR1MW1.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00001512) "6FR1MW1.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00001512) "6FR1MW1.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00001512) "6FR1MW1.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00001512) "6FR1MW1.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00001512) "6FR1MW1.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00001512) "6FR1MW1.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00001512) "6FR1MW1.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00001512) "6FR1MW1.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00001512) "6FR1MW1.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00001512) "6FR1MW1.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00001512) "6FR1MW1.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00001512) "6FR1MW1.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00001512) "6FR1MW1.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00001512) "6FR1MW1.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00001512) "6FR1MW1.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00001512) "6FR1MW1.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00001512) "6FR1MW1.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00001512) "6FR1MW1.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00001512) "6FR1MW1.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00001512) "6FR1MW1.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00001512) "6FR1MW1.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00001512) "6FR1MW1.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00001512) "6FR1MW1.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00001512) "6FR1MW1.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00001512) "6FR1MW1.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00001512) "6FR1MW1.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00001512) "6FR1MW1.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00001512) "6FR1MW1.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00001512) "6FR1MW1.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00001512) "6FR1MW1.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00001512) "6FR1MW1.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00001512) "6FR1MW1.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00001512) "6FR1MW1.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00001512) "6FR1MW1.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00001512) "6FR1MW1.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00001512) "6FR1MW1.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00001512) "6FR1MW1.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00001512) "6FR1MW1.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00001512) "6FR1MW1.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00001512) "6FR1MW1.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00001512) "6FR1MW1.exe" called "GetProcAddress" with a parameter IsProcessDPIAware (UID: 00000000-00001512) "6FR1MW1.exe" called "GetProcAddress" with a parameter Wow64DisableWow64FsRedirection (UID: 00000000-00001512) "6FR1MW1.exe" called "GetProcAddress" with a parameter Wow64RevertWow64FsRedirection (UID: 00000000-00001512) "6FR1MW1.exe" called "GetProcAddress" with a parameter DwmIsCompositionEnabled (UID: 00000000-00001512) "6FR1MW1.exe" called "GetProcAddress" with a parameter RegisterClassNameW (UID: 00000000-00001512) "6FR1MW1.exe" called "GetProcAddress" with a parameter OpenThemeData (UID: 00000000-00001512) "6FR1MW1.exe" called "GetProcAddress" with a parameter GetThemeBool (UID: 00000000-00001512) "6FR1MW1.exe" called "GetProcAddress" with a parameter ImmGetContext (UID: 00000000-00001512) "6FR1MW1.exe" called "GetProcAddress" with a parameter ImmReleaseContext (UID: 00000000-00001512) "6FR1MW1.exe" called "GetProcAddress" with a parameter ImmAssociateContext (UID: 00000000-00001512) "6FR1MW1.exe" called "GetProcAddress" with a parameter ImmIsIME (UID: 00000000-00001512) "6FR1MW1.exe" called "GetProcAddress" with a parameter HIMAGELIST_QueryInterface (UID: 00000000-00001512) "6FR1MW1.exe" called "GetProcAddress" with a parameter DrawShadowText (UID: 00000000-00001512) "6FR1MW1.exe" called "GetProcAddress" with a parameter DrawSizeBox (UID: 00000000-00001512) "6FR1MW1.exe" called "GetProcAddress" with a parameter DrawScrollBar (UID: 00000000-00001512) "6FR1MW1.exe" called "GetProcAddress" with a parameter SizeBoxHwnd (UID: 00000000-00001512) "6FR1MW1.exe" called "GetProcAddress" with a parameter ScrollBar_MouseMove (UID: 00000000-00001512) "6FR1MW1.exe" called "GetProcAddress" with a parameter ScrollBar_Menu (UID: 00000000-00001512) "6FR1MW1.exe" called "GetProcAddress" with a parameter HandleScrollCmd (UID: 00000000-00001512) "6FR1MW1.exe" called "GetProcAddress" with a parameter DetachScrollBars (UID: 00000000-00001512) "6FR1MW1.exe" called "GetProcAddress" with a parameter AttachScrollBars (UID: 00000000-00001512) "6FR1MW1.exe" called "GetProcAddress" with a parameter CCSetScrollInfo (UID: 00000000-00001512) "6FR1MW1.exe" called "GetProcAddress" with a parameter CCGetScrollInfo (UID: 00000000-00001512) "6FR1MW1.exe" called "GetProcAddress" with a parameter CCEnableScrollBar (UID: 00000000-00001512) "6FR1MW1.exe" called "GetProcAddress" with a parameter QuerySystemGestureStatus (UID: 00000000-00001512) "6FR1MW1.exe" called "GetProcAddress" with a parameter StringFromGUID2 (UID: 00000000-00001512) "6FR1MW1.exe" called "GetProcAddress" with a parameter CoTaskMemAlloc (UID: 00000000-00001512) "6FR1MW1.exe" called "GetProcAddress" with a parameter CoTaskMemFree (UID: 00000000-00001512) "6FR1MW1.exe" called "GetProcAddress" with a parameter SetSystemFileCacheSize (UID: 00000000-00001512) "6FR1MW1.exe" called "GetProcAddress" with a parameter NtSetSystemInformation (UID: 00000000-00001512) "6FR1MW1.exe" called "GetProcAddress" with a parameter PrivIsDllSynchronizationHeld (UID: 00000000-00001512) "6FR1MW1.exe" called "GetProcAddress" with a parameter SHGetInstanceExplorer (UID: 00000000-00001512) "6FR1MW1.exe" called "GetProcAddress" with a parameter OleInitialize (UID: 00000000-00001512) "6FR1MW1.exe" called "GetProcAddress" with a parameter CreateBindCtx (UID: 00000000-00001512) "6FR1MW1.exe" called "GetProcAddress" with a parameter RegisterTraceGuidsW (UID: 00000000-00001512) "6FR1MW1.exe" called "GetProcAddress" with a parameter EventRegister (UID: 00000000-00001512) "6FR1MW1.exe" called "GetProcAddress" with a parameter EventUnregister (UID: 00000000-00001512) "6FR1MW1.exe" called "GetProcAddress" with a parameter EventEnabled (UID: 00000000-00001512) "6FR1MW1.exe" called "GetProcAddress" with a parameter EventWrite (UID: 00000000-00001512) "6FR1MW1.exe" called "GetProcAddress" with a parameter PSCreateMemoryPropertyStore (UID: 00000000-00001512) "6FR1MW1.exe" called "GetProcAddress" with a parameter PSPropertyBag_WriteDWORD (UID: 00000000-00001512) "6FR1MW1.exe" called "GetProcAddress" with a parameter CoGetApartmentType (UID: 00000000-00001512) "6FR1MW1.exe" called "GetProcAddress" with a parameter CoRegisterInitializeSpy (UID: 00000000-00001512) "6FR1MW1.exe" called "GetProcAddress" with a parameter CoGetMalloc (UID: 00000000-00001512) "6FR1MW1.exe" called "GetProcAddress" with a parameter PSPropertyBag_ReadDWORD (UID: 00000000-00001512) "6FR1MW1.exe" called "GetProcAddress" with a parameter PSPropertyBag_ReadGUID (UID: 00000000-00001512) "6FR1MW1.exe" called "GetProcAddress" with a parameter RegEnumKeyW (UID: 00000000-00001512) "6FR1MW1.exe" called "GetProcAddress" with a parameter OpenThreadToken (UID: 00000000-00001512) "6FR1MW1.exe" called "GetProcAddress" with a parameter ApphelpCheckShellObject (UID: 00000000-00001512) "6FR1MW1.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00001512) "6FR1MW1.exe" called "GetProcAddress" with a parameter CLSIDFromOle1Class (UID: 00000000-00001512) "6FR1MW1.exe" called "GetProcAddress" with a parameter GetCatalogObject (UID: 00000000-00001512) "6FR1MW1.exe" called "GetProcAddress" with a parameter GetCatalogObject2 (UID: 00000000-00001512) "6FR1MW1.exe" called "GetProcAddress" with a parameter AcquireSRWLockShared (UID: 00000000-00001512) "6FR1MW1.exe" called "GetProcAddress" with a parameter ReleaseSRWLockShared (UID: 00000000-00001512) "6FR1MW1.exe" called "GetProcAddress" with a parameter EventSetInformation (UID: 00000000-00001512) "6FR1MW1.exe" called "GetProcAddress" with a parameter InitCommonControlsEx (UID: 00000000-00001512) "6FR1MW1.exe" called "GetProcAddress" with a parameter DllGetClassObject (UID: 00000000-00001512) "6FR1MW1.exe" called "GetProcAddress" with a parameter DllCanUnloadNow (UID: 00000000-00001512) "6FR1MW1.exe" called "GetProcAddress" with a parameter IsValidURL (UID: 00000000-00001512) "6FR1MW1.exe" called "GetProcAddress" with a parameter SHStrDupW (UID: 00000000-00001512) "6FR1MW1.exe" called "GetProcAddress" with a parameter PSCreateAdapterFromPropertyStore (UID: 00000000-00001512) "6FR1MW1.exe" called "GetProcAddress" with a parameter PropVariantToBSTR (UID: 00000000-00001512) "6FR1MW1.exe" called "GetProcAddress" with a parameter PropVariantClear (UID: 00000000-00001512) "6FR1MW1.exe" called "GetProcAddress" with a parameter IUnknown_Set (UID: 00000000-00001512) "6FR1MW1.exe" called "GetProcAddress" with a parameter CoInitializeEx (UID: 00000000-00001512) "6FR1MW1.exe" called "GetProcAddress" with a parameter CoTaskMemRealloc (UID: 00000000-00001512) "6FR1MW1.exe" called "GetProcAddress" with a parameter ResolveDelayLoadedAPI (UID: 00000000-00001512) "6FR1MW1.exe" called "GetProcAddress" with a parameter PSPropertyBag_ReadStrAlloc (UID: 00000000-00001512) "6FR1MW1.exe" called "GetProcAddress" with a parameter CoAllowSetForegroundWindow (UID: 00000000-00001512) "6FR1MW1.exe" called "GetProcAddress" with a parameter FindWindowExW (UID: 00000000-00001512) "6FR1MW1.exe" called "GetProcAddress" with a parameter CM_Get_Device_Interface_List_Size_ExW (UID: 00000000-00001512) "6FR1MW1.exe" called "GetProcAddress" with a parameter CM_Get_Device_Interface_List_ExW (UID: 00000000-00001512) "6FR1MW1.exe" called "GetProcAddress" with a parameter RtlDllShutdownInProgress (UID: 00000000-00001512) "6FR1MW1.exe" called "GetProcAddress" with a parameter CoUninitialize (UID: 00000000-00001512) "6FR1MW1.exe" called "GetProcAddress" with a parameter OleUninitialize (UID: 00000000-00001512) "6FR1MW1.exe" called "GetProcAddress" with a parameter CoRevokeInitializeSpy (UID: 00000000-00001512) "6FR1MW1.exe" called "GetProcAddress" with a parameter NdrOleInitializeExtension (UID: 00000000-00001512) "6FR1MW1.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00001512) "6FR1MW1.exe" called "GetProcAddress" with a parameter CoGetMarshalSizeMax (UID: 00000000-00001512) "6FR1MW1.exe" called "GetProcAddress" with a parameter CoMarshalInterface (UID: 00000000-00001512) "6FR1MW1.exe" called "GetProcAddress" with a parameter CoUnmarshalInterface (UID: 00000000-00001512) "6FR1MW1.exe" called "GetProcAddress" with a parameter StringFromIID (UID: 00000000-00001512) "6FR1MW1.exe" called "GetProcAddress" with a parameter CoGetPSClsid (UID: 00000000-00001512) "6FR1MW1.exe" called "GetProcAddress" with a parameter CoReleaseMarshalData (UID: 00000000-00001512) "6FR1MW1.exe" called "GetProcAddress" with a parameter DcomChannelSetHResult (UID: 00000000-00001512) "6FR1MW1.exe" called "GetProcAddress" with a parameter SendMessageTimeoutW (UID: 00000000-00001512) "6FR1MW1.exe" called "GetProcAddress" with a parameter GetWindowThreadProcessId (UID: 00000000-00001512) "6FR1MW1.exe" called "GetProcAddress" with a parameter AllowSetForegroundWindow (UID: 00000000-00001512) "6FR1MW1.exe" called "GetProcAddress" with a parameter PostMessageW (UID: 00000000-00001512) "6FR1MW1.exe" called "GetProcAddress" with a parameter CloseThemeData (UID: 00000000-00001512) "6FR1MW1.exe" called "GetProcAddress" with a parameter UnregisterTraceGuids (UID: 00000000-00001512)39:T152e,Found reference to API "CreateProcessA" (Indicator: "CreateProcess"; File: "afa6fbd86c448bceaf510ae6f8b831be.exe") Found reference to API "ElevateCreateProcess WRPMitigationLayer" (Indicator: "CreateProcess"; File: "00002644.00000A54.429304.00090000.wprm") Found reference to API "__COMPAT_LAYER=ElevateCreateProcess WRPMitig" (Indicator: "CreateProcess"; Source: "00000000-00000904.00000000.66782.00240000.00000004.mdmp") Found reference to API "__COMPAT_LAYER=ElevateCreateProcess WRPMitigationLayer" (Indicator: "CreateProcess"; Source: "00000000-00000904.00000000.66782.00240000.00000004.mdmp, 00000000-00000904.00000000.66782.00800000.00000004.mdmp, 00000000-00000904.00000000.66782.009D0000.00000004.mdmp, 00000000-00000904.00000000.66782.00BB0000.00000004.mdmp") Found reference to API "__COMPAT_LAYER=ElevateCreateProcess WRPMitigationLayer" (Indicator: "CreateProcess"; Source: "00000000-00001512.00000000.67840.005A0000.00000004.mdmp, 00000000-00001512.00000000.67840.013B0000.00000004.mdmp, 00000000-00001512.00000001.68017.005A0000.00000004.mdmp, 00000000-00001512.00000001.68017.005F6000.00000004.mdmp, 00000000-00001512.00000001.68017.013B0000.00000004.mdmp") Found reference to API "ElevateCreateProcess" (Indicator: "CreateProcess"; Source: "00000000-00001512.00000000.67840.005A0000.00000004.mdmp, 00000000-00001512.00000001.68017.005A0000.00000004.mdmp") Found reference to API "_COMPAT_LAYER=ElevateCreateProcess WRPMitigationLayer" (Indicator: "CreateProcess"; Source: "00000000-00001512.00000000.67840.005A0000.00000004.mdmp, 00000000-00001512.00000001.68017.005A0000.00000004.mdmp") Found reference to API "ElevateCreateProcess WRPMitigationLayer" (Indicator: "CreateProcess"; Source: "00000000-00001512.00000000.67840.005A0000.00000004.mdmp, 00000000-00001512.00000001.68017.005F6000.00000004.mdmp") Found reference to API "MPAT_LAYER=ElevateCreateProcess WRPMitigationLayer" (Indicator: "CreateProcess"; Source: "00000000-00001512.00000000.67840.005A0000.00000004.mdmp, 00000000-00001512.00000001.68017.005F6000.00000004.mdmp") Found reference to API "CreateProcessW" (Indicator: "CreateProcess"; Source: "00000000-00001512.00000000.67840.00E5C000.00000002.mdmp") Found reference to API "CreateProcessAsUserW" (Indicator: "CreateProcess"; Source: "00000000-00001512.00000000.67840.00E5C000.00000002.mdmp") Found reference to API "CreateProcessWithLogonW" (Indicator: "CreateProcess"; Source: "00000000-00001512.00000000.67840.00E5C000.00000002.mdmp") Found reference to API "__COMPAT_LAYER=ElevateCreateProcess WRPMitigationLayer" (Indicator: "CreateProcess"; Source: "00000000-00001616.00000000.65913.00600000.00000004.mdmp, 00000000-00001616.00000001.67833.00190000.00000004.mdmp, 00000000-00001616.00000001.67833.00600000.00000004.mdmp, 00000000-00001616.00000001.67833.00B10000.00000004.mdmp, 00000000-00001616.00000002.68025.00190000.00000004.mdmp, 00000000-00001616.00000002.68025.00600000.00000004.mdmp, 00000000-00001616.00000002.68025.00B10000.00000004.mdmp") Found reference to API "ElevateCreateProcess" (Indicator: "CreateProcess"; Source: "00000000-00001616.00000000.65913.00600000.00000004.mdmp, 00000000-00001616.00000001.67833.00600000.00000004.mdmp, 00000000-00001616.00000002.68025.00600000.00000004.mdmp") Found reference to API "ElevateCreateProcess WRPMitigationLayer" (Indicator: "CreateProcess"; Source: "00000000-00001616.00000000.65913.00600000.00000004.mdmp, 00000000-00001616.00000001.67833.00600000.00000004.mdmp, 00000000-00001616.00000002.68025.00600000.00000004.mdmp") Found reference to API "__COMPAT_LAYER=ElevateCreateProcess WRPMitig" (Indicator: "CreateProcess"; Source: "00000000-00001616.00000001.67833.00B10000.00000004.mdmp, 00000000-00001616.00000002.68025.00B10000.00000004.mdmp") Found reference to API "__COMPAT_LAYER=ElevateCreateProcess WRPMitigationLayer" (Indicator: "CreateProcess"; Source: "00000000-00002516.00000000.65984.00160000.00000004.mdmp, 00000000-00002516.00000000.65984.003A0000.00000004.mdmp, 00000000-00002516.00000000.65984.00760000.00000004.mdmp, 00000000-00002516.00000001.67151.00160000.00000004.mdmp, 00000000-00002516.00000001.67151.001C2000.00000004.mdmp, 00000000-00002516.00000001.67151.003A0000.00000004.mdmp, 00000000-00002516.00000001.67151.00760000.00000004.mdmp") Found reference to API "ElevateCreateProcess" (Indicator: "CreateProcess"; Source: "00000000-00002516.00000000.65984.00160000.00000004.mdmp, 00000000-00002516.00000001.67151.00160000.00000004.mdmp") Found reference to API "ElevateCreateProcess WRPMitigationLayer" (Indicator: "CreateProcess"; Source: "00000000-00002516.00000000.65984.00160000.00000004.mdmp, 00000000-00002516.00000001.67151.00160000.00000004.mdmp") Found reference to API "674239560,3128,3136,,CreateProcessA,kernel32.dll,"252:02:38.770",RX=0,PX=0" (Indicator: "CreateProcess"; Source: "00000000-00002516.00000000.65984.00160000.00000004.mdmp") Found reference to API "ER=ElevateCreateProcess WRPMitigationLayer" (Indicator: "CreateProcess"; Source: "00000000-00002516.00000000.65984.00160000.00000004.mdmp") Found reference to API "__COMPAT_LAYER=ElevateCreateProcess WRPMitig" (Indicator: "CreateProcess"; Source: "00000000-00002516.00000000.65984.003A0000.00000004.mdmp, 00000000-00002516.00000001.67151.003A0000.00000004.mdmp") Found reference to API "CreateProcessA" (Indicator: "CreateProcess"; Source: "00000000-00002516.00000001.67151.008FA000.00000002.mdmp")3a:T16952,Found reference to API (Indicator: "CheckTokenMembership"; File: "afa6fbd86c448bceaf510ae6f8b831be.exe") Found reference to API (Indicator: "HeapSetInformation"; File: "afa6fbd86c448bceaf510ae6f8b831be.exe") Found reference to API (Indicator: "DecryptFileA"; File: "afa6fbd86c448bceaf510ae6f8b831be.exe") Found reference to API (Indicator: "SHBrowseForFolder"; File: "afa6fbd86c448bceaf510ae6f8b831be.exe") Found reference to API (Indicator: "SHGetPathFromIDList"; File: "afa6fbd86c448bceaf510ae6f8b831be.exe") Found reference to API (Indicator: "GetTokenInformation"; File: "afa6fbd86c448bceaf510ae6f8b831be.exe") Found reference to API (Indicator: "RegDeleteValueA"; File: "afa6fbd86c448bceaf510ae6f8b831be.exe") Found reference to API (Indicator: "RegOpenKeyExA"; File: "afa6fbd86c448bceaf510ae6f8b831be.exe") Found reference to API (Indicator: "RegQueryInfoKeyA"; File: "afa6fbd86c448bceaf510ae6f8b831be.exe") Found reference to API (Indicator: "FreeSid"; File: "afa6fbd86c448bceaf510ae6f8b831be.exe") Found reference to API (Indicator: "OpenProcessToken"; File: "afa6fbd86c448bceaf510ae6f8b831be.exe") Found reference to API (Indicator: "RegSetValueExA"; File: "afa6fbd86c448bceaf510ae6f8b831be.exe") Found reference to API (Indicator: "RegCreateKeyExA"; File: "afa6fbd86c448bceaf510ae6f8b831be.exe") Found reference to API (Indicator: "LookupPrivilegeValueA"; File: "afa6fbd86c448bceaf510ae6f8b831be.exe") Found reference to API (Indicator: "AllocateAndInitializeSid"; File: "afa6fbd86c448bceaf510ae6f8b831be.exe") Found reference to API (Indicator: "RegQueryValueExA"; File: "afa6fbd86c448bceaf510ae6f8b831be.exe") Found reference to API (Indicator: "EqualSid"; File: "afa6fbd86c448bceaf510ae6f8b831be.exe") Found reference to API (Indicator: "RegCloseKey"; File: "afa6fbd86c448bceaf510ae6f8b831be.exe") Found reference to API (Indicator: "AdjustTokenPrivileges"; File: "afa6fbd86c448bceaf510ae6f8b831be.exe") Found reference to API (Indicator: "GetShortPathNameA"; File: "afa6fbd86c448bceaf510ae6f8b831be.exe") Found reference to API (Indicator: "GetModuleFileNameA"; File: "afa6fbd86c448bceaf510ae6f8b831be.exe") Found reference to API (Indicator: "FindFirstFileA"; File: "afa6fbd86c448bceaf510ae6f8b831be.exe") Found reference to API (Indicator: "GetCurrentProcess"; File: "afa6fbd86c448bceaf510ae6f8b831be.exe") Found reference to API (Indicator: "FindNextFileA"; File: "afa6fbd86c448bceaf510ae6f8b831be.exe") Found reference to API (Indicator: "ExpandEnvironmentStringsA"; File: "afa6fbd86c448bceaf510ae6f8b831be.exe") Found reference to API (Indicator: "FindClose"; File: "afa6fbd86c448bceaf510ae6f8b831be.exe") Found reference to API (Indicator: "LocalAlloc"; File: "afa6fbd86c448bceaf510ae6f8b831be.exe") Found reference to API (Indicator: "lstrcmpA"; File: "afa6fbd86c448bceaf510ae6f8b831be.exe") Found reference to API (Indicator: "CompareStringA"; File: "afa6fbd86c448bceaf510ae6f8b831be.exe") Found reference to API (Indicator: "GetLastError"; File: "afa6fbd86c448bceaf510ae6f8b831be.exe") Found reference to API (Indicator: "GetFileAttributesA"; File: "afa6fbd86c448bceaf510ae6f8b831be.exe") Found reference to API (Indicator: "GetSystemDirectoryA"; File: "afa6fbd86c448bceaf510ae6f8b831be.exe") Found reference to API (Indicator: "LoadLibraryA"; File: "afa6fbd86c448bceaf510ae6f8b831be.exe") Found reference to API (Indicator: "DeleteFileA"; File: "afa6fbd86c448bceaf510ae6f8b831be.exe") Found reference to API (Indicator: "GlobalAlloc"; File: "afa6fbd86c448bceaf510ae6f8b831be.exe") Found reference to API (Indicator: "GlobalFree"; File: "afa6fbd86c448bceaf510ae6f8b831be.exe") Found reference to API (Indicator: "CloseHandle"; File: "afa6fbd86c448bceaf510ae6f8b831be.exe") Found reference to API (Indicator: "WritePrivateProfileStringA"; File: "afa6fbd86c448bceaf510ae6f8b831be.exe") Found reference to API (Indicator: "IsDBCSLeadByte"; File: "afa6fbd86c448bceaf510ae6f8b831be.exe") Found reference to API (Indicator: "GetWindowsDirectoryA"; File: "afa6fbd86c448bceaf510ae6f8b831be.exe") Found reference to API (Indicator: "SetFileAttributesA"; File: "afa6fbd86c448bceaf510ae6f8b831be.exe") Found reference to API (Indicator: "GetProcAddress"; File: "afa6fbd86c448bceaf510ae6f8b831be.exe") Found reference to API (Indicator: "GlobalLock"; File: "afa6fbd86c448bceaf510ae6f8b831be.exe") Found reference to API (Indicator: "LocalFree"; File: "afa6fbd86c448bceaf510ae6f8b831be.exe") Found reference to API (Indicator: "RemoveDirectoryA"; File: "afa6fbd86c448bceaf510ae6f8b831be.exe") Found reference to API (Indicator: "FreeLibrary"; File: "afa6fbd86c448bceaf510ae6f8b831be.exe") Found reference to API (Indicator: "CreateDirectoryA"; File: "afa6fbd86c448bceaf510ae6f8b831be.exe") Found reference to API (Indicator: "GetPrivateProfileIntA"; File: "afa6fbd86c448bceaf510ae6f8b831be.exe") Found reference to API (Indicator: "GetPrivateProfileStringA"; File: "afa6fbd86c448bceaf510ae6f8b831be.exe") Found reference to API (Indicator: "GlobalUnlock"; File: "afa6fbd86c448bceaf510ae6f8b831be.exe") Found reference to API (Indicator: "ReadFile"; File: "afa6fbd86c448bceaf510ae6f8b831be.exe") Found reference to API (Indicator: "SizeofResource"; File: "afa6fbd86c448bceaf510ae6f8b831be.exe") Found reference to API (Indicator: "WriteFile"; File: "afa6fbd86c448bceaf510ae6f8b831be.exe") Found reference to API (Indicator: "GetDriveTypeA"; File: "afa6fbd86c448bceaf510ae6f8b831be.exe") Found reference to API (Indicator: "LoadLibraryExA"; File: "afa6fbd86c448bceaf510ae6f8b831be.exe") Found reference to API (Indicator: "SetFileTime"; File: "afa6fbd86c448bceaf510ae6f8b831be.exe") Found reference to API (Indicator: "SetFilePointer"; File: "afa6fbd86c448bceaf510ae6f8b831be.exe") Found reference to API (Indicator: "FindResourceA"; File: "afa6fbd86c448bceaf510ae6f8b831be.exe") Found reference to API (Indicator: "CreateMutexA"; File: "afa6fbd86c448bceaf510ae6f8b831be.exe") Found reference to API (Indicator: "GetVolumeInformationA"; File: "afa6fbd86c448bceaf510ae6f8b831be.exe") Found reference to API (Indicator: "WaitForSingleObject"; File: "afa6fbd86c448bceaf510ae6f8b831be.exe") Found reference to API (Indicator: "GetCurrentDirectoryA"; File: "afa6fbd86c448bceaf510ae6f8b831be.exe") Found reference to API (Indicator: "FreeResource"; File: "afa6fbd86c448bceaf510ae6f8b831be.exe") Found reference to API (Indicator: "GetVersion"; File: "afa6fbd86c448bceaf510ae6f8b831be.exe") Found reference to API (Indicator: "SetCurrentDirectoryA"; File: "afa6fbd86c448bceaf510ae6f8b831be.exe") Found reference to API (Indicator: "GetTempPathA"; File: "afa6fbd86c448bceaf510ae6f8b831be.exe") Found reference to API (Indicator: "LocalFileTimeToFileTime"; File: "afa6fbd86c448bceaf510ae6f8b831be.exe") Found reference to API (Indicator: "CreateFileA"; File: "afa6fbd86c448bceaf510ae6f8b831be.exe") Found reference to API (Indicator: "SetEvent"; File: "afa6fbd86c448bceaf510ae6f8b831be.exe") Found reference to API (Indicator: "TerminateThread"; File: "afa6fbd86c448bceaf510ae6f8b831be.exe") Found reference to API (Indicator: "GetVersionExA"; File: "afa6fbd86c448bceaf510ae6f8b831be.exe") Found reference to API (Indicator: "LockResource"; File: "afa6fbd86c448bceaf510ae6f8b831be.exe") Found reference to API (Indicator: "GetSystemInfo"; File: "afa6fbd86c448bceaf510ae6f8b831be.exe") Found reference to API (Indicator: "CreateThread"; File: "afa6fbd86c448bceaf510ae6f8b831be.exe") Found reference to API (Indicator: "ResetEvent"; File: "afa6fbd86c448bceaf510ae6f8b831be.exe") Found reference to API (Indicator: "LoadResource"; File: "afa6fbd86c448bceaf510ae6f8b831be.exe") Found reference to API (Indicator: "ExitProcess"; File: "afa6fbd86c448bceaf510ae6f8b831be.exe") Found reference to API (Indicator: "GetModuleHandleW"; File: "afa6fbd86c448bceaf510ae6f8b831be.exe") Found reference to API (Indicator: "CreateProcessA"; File: "afa6fbd86c448bceaf510ae6f8b831be.exe") Found reference to API (Indicator: "FormatMessageA"; File: "afa6fbd86c448bceaf510ae6f8b831be.exe") Found reference to API (Indicator: "GetTempFileNameA"; File: "afa6fbd86c448bceaf510ae6f8b831be.exe") Found reference to API (Indicator: "DosDateTimeToFileTime"; File: "afa6fbd86c448bceaf510ae6f8b831be.exe") Found reference to API (Indicator: "CreateEventA"; File: "afa6fbd86c448bceaf510ae6f8b831be.exe") Found reference to API (Indicator: "GetExitCodeProcess"; File: "afa6fbd86c448bceaf510ae6f8b831be.exe") Found reference to API (Indicator: "GetDeviceCaps"; File: "afa6fbd86c448bceaf510ae6f8b831be.exe") Found reference to API (Indicator: "GetDesktopWindow"; File: "afa6fbd86c448bceaf510ae6f8b831be.exe") Found reference to API (Indicator: "CharUpperA"; File: "afa6fbd86c448bceaf510ae6f8b831be.exe") Found reference to API (Indicator: "ExitWindowsEx"; File: "afa6fbd86c448bceaf510ae6f8b831be.exe") Found reference to API (Indicator: "MessageBeep"; File: "afa6fbd86c448bceaf510ae6f8b831be.exe") Found reference to API (Indicator: "CharPrevA"; File: "afa6fbd86c448bceaf510ae6f8b831be.exe") Found reference to API (Indicator: "LoadStringA"; File: "afa6fbd86c448bceaf510ae6f8b831be.exe") Found reference to API (Indicator: "CharNextA"; File: "afa6fbd86c448bceaf510ae6f8b831be.exe") Found reference to API (Indicator: "EnableWindow"; File: "afa6fbd86c448bceaf510ae6f8b831be.exe") Found reference to API (Indicator: "ReleaseDC"; File: "afa6fbd86c448bceaf510ae6f8b831be.exe") Found reference to API (Indicator: "SetForegroundWindow"; File: "afa6fbd86c448bceaf510ae6f8b831be.exe") Found reference to API (Indicator: "PeekMessageA"; File: "afa6fbd86c448bceaf510ae6f8b831be.exe") Found reference to API (Indicator: "SendMessageA"; File: "afa6fbd86c448bceaf510ae6f8b831be.exe") Found reference to API (Indicator: "MessageBoxA"; File: "afa6fbd86c448bceaf510ae6f8b831be.exe") Found reference to API (Indicator: "SetWindowTextA"; File: "afa6fbd86c448bceaf510ae6f8b831be.exe") Found reference to API (Indicator: "GetWindowLongA"; File: "afa6fbd86c448bceaf510ae6f8b831be.exe") Found reference to API (Indicator: "CallWindowProcA"; File: "afa6fbd86c448bceaf510ae6f8b831be.exe") Found reference to API (Indicator: "SetWindowLongA"; File: "afa6fbd86c448bceaf510ae6f8b831be.exe") Found reference to API (Indicator: "ShowWindow"; File: "afa6fbd86c448bceaf510ae6f8b831be.exe") Found reference to API (Indicator: "MsgWaitForMultipleObjects"; File: "afa6fbd86c448bceaf510ae6f8b831be.exe") Found reference to API (Indicator: "SetWindowPos"; File: "afa6fbd86c448bceaf510ae6f8b831be.exe") Found reference to API (Indicator: "GetDC"; File: "afa6fbd86c448bceaf510ae6f8b831be.exe") Found reference to API (Indicator: "GetWindowRect"; File: "afa6fbd86c448bceaf510ae6f8b831be.exe") Found reference to API (Indicator: "DispatchMessageA"; File: "afa6fbd86c448bceaf510ae6f8b831be.exe") Found reference to API (Indicator: "GetFileVersionInfoSizeA"; File: "afa6fbd86c448bceaf510ae6f8b831be.exe") Found reference to API (Indicator: "VerQueryValueA"; File: "afa6fbd86c448bceaf510ae6f8b831be.exe") Found reference to API (Indicator: "GetFileVersionInfoA"; File: "afa6fbd86c448bceaf510ae6f8b831be.exe") Found reference to API (Indicator: "Sleep"; File: "afa6fbd86c448bceaf510ae6f8b831be.exe") Found reference to API (Indicator: "GetStartupInfoW"; File: "afa6fbd86c448bceaf510ae6f8b831be.exe") Found reference to API (Indicator: "UnhandledExceptionFilter"; File: "afa6fbd86c448bceaf510ae6f8b831be.exe") Found reference to API (Indicator: "SetUnhandledExceptionFilter"; File: "afa6fbd86c448bceaf510ae6f8b831be.exe") Found reference to API (Indicator: "TerminateProcess"; File: "afa6fbd86c448bceaf510ae6f8b831be.exe") Found reference to API (Indicator: "QueryPerformanceCounter"; File: "afa6fbd86c448bceaf510ae6f8b831be.exe") Found reference to API (Indicator: "GetCurrentProcessId"; File: "afa6fbd86c448bceaf510ae6f8b831be.exe") Found reference to API (Indicator: "GetCurrentThreadId"; File: "afa6fbd86c448bceaf510ae6f8b831be.exe") Found reference to API (Indicator: "GetSystemTimeAsFileTime"; File: "afa6fbd86c448bceaf510ae6f8b831be.exe") Found reference to API (Indicator: "GetTickCount"; File: "afa6fbd86c448bceaf510ae6f8b831be.exe") Found reference to API (Indicator: "EnumResourceLanguagesA"; File: "afa6fbd86c448bceaf510ae6f8b831be.exe") Found reference to API (Indicator: "GetDiskFreeSpaceA"; File: "afa6fbd86c448bceaf510ae6f8b831be.exe") Found reference to API (Indicator: "MulDiv"; File: "afa6fbd86c448bceaf510ae6f8b831be.exe") Found reference to API (Indicator: "GetSystemMetrics"; File: "afa6fbd86c448bceaf510ae6f8b831be.exe") Found reference to API (Indicator: "InitializeCriticalSectionEx"; File: "00000000-00003736.00000000.66071.00400000.00000040.mdmp") Found reference to API (Indicator: "FlsSetValue"; File: "00000000-00003736.00000000.66071.00400000.00000040.mdmp") Found reference to API (Indicator: "GetTimeFormatEx"; File: "00000000-00003736.00000000.66071.00400000.00000040.mdmp") Found reference to API (Indicator: "IsValidLocaleName"; File: "00000000-00003736.00000000.66071.00400000.00000040.mdmp") Found reference to API (Indicator: "LocaleNameToLCID"; File: "00000000-00003736.00000000.66071.00400000.00000040.mdmp") Found reference to API (Indicator: "EnumSystemLocalesEx"; File: "00000000-00003736.00000000.66071.00400000.00000040.mdmp") Found reference to API (Indicator: "LCIDToLocaleName"; File: "00000000-00003736.00000000.66071.00400000.00000040.mdmp") Found reference to API (Indicator: "AreFileApisANSI"; File: "00000000-00003736.00000000.66071.00400000.00000040.mdmp") Found reference to API (Indicator: "CompareStringEx"; File: "00000000-00003736.00000000.66071.00400000.00000040.mdmp") Found reference to API (Indicator: "FlsGetValue"; File: "00000000-00003736.00000000.66071.00400000.00000040.mdmp") Found reference to API (Indicator: "GetUserDefaultLocaleName"; File: "00000000-00003736.00000000.66071.00400000.00000040.mdmp") Found reference to API (Indicator: "GetLocaleInfoEx"; File: "00000000-00003736.00000000.66071.00400000.00000040.mdmp") Found reference to API (Indicator: "FlsFree"; File: "00000000-00003736.00000000.66071.00400000.00000040.mdmp") Found reference to API (Indicator: "GetDateFormatEx"; File: "00000000-00003736.00000000.66071.00400000.00000040.mdmp") Found reference to API (Indicator: "FlsAlloc"; File: "00000000-00003736.00000000.66071.00400000.00000040.mdmp") Found reference to API (Indicator: "LCMapStringEx"; File: "00000000-00003736.00000000.66071.00400000.00000040.mdmp") Found reference to API (Indicator: "DecodePointer"; File: "MaxLoonaFest131.exe.1646122814") Found reference to API (Indicator: "EncodePointer"; File: "MaxLoonaFest131.exe.1646122814") Found reference to API (Indicator: "GetActiveWindow"; File: "MaxLoonaFest131.exe.1646122814") Found reference to API (Indicator: "GetLastActivePopup"; File: "MaxLoonaFest131.exe.1646122814") Found reference to API (Indicator: "GetUserObjectInformationA"; File: "MaxLoonaFest131.exe.1646122814") Found reference to API (Indicator: "GetProcessWindowStation"; File: "MaxLoonaFest131.exe.1646122814") Found reference to API (Indicator: "GetComputerNameA"; File: "MaxLoonaFest131.exe.1646122814") Found reference to API (Indicator: "GetFullPathNameA"; File: "MaxLoonaFest131.exe.1646122814") Found reference to API (Indicator: "GetDateFormatW"; File: "MaxLoonaFest131.exe.1646122814") Found reference to API (Indicator: "FindFirstChangeNotificationW"; File: "MaxLoonaFest131.exe.1646122814") Found reference to API (Indicator: "TlsGetValue"; File: "MaxLoonaFest131.exe.1646122814") Found reference to API (Indicator: "SystemTimeToTzSpecificLocalTime"; File: "MaxLoonaFest131.exe.1646122814") Found reference to API (Indicator: "EndUpdateResourceW"; File: "MaxLoonaFest131.exe.1646122814") Found reference to API (Indicator: "InterlockedIncrement"; File: "MaxLoonaFest131.exe.1646122814") Found reference to API (Indicator: "CreateJobObjectW"; File: "MaxLoonaFest131.exe.1646122814") Found reference to API (Indicator: "GetConsoleAliasesLengthA"; File: "MaxLoonaFest131.exe.1646122814") Found reference to API (Indicator: "EnumTimeFormatsA"; File: "MaxLoonaFest131.exe.1646122814") Found reference to API (Indicator: "SetFileShortNameW"; File: "MaxLoonaFest131.exe.1646122814") Found reference to API (Indicator: "GlobalFindAtomA"; File: "MaxLoonaFest131.exe.1646122814") Found reference to API (Indicator: "AssignProcessToJobObject"; File: "MaxLoonaFest131.exe.1646122814") Found reference to API (Indicator: "GetSystemWindowsDirectoryA"; File: "MaxLoonaFest131.exe.1646122814") Found reference to API (Indicator: "CreateFileW"; File: "MaxLoonaFest131.exe.1646122814") Found reference to API (Indicator: "GetOverlappedResult"; File: "MaxLoonaFest131.exe.1646122814") Found reference to API (Indicator: "GetVolumePathNameA"; File: "MaxLoonaFest131.exe.1646122814") Found reference to API (Indicator: "InterlockedExchange"; File: "MaxLoonaFest131.exe.1646122814") Found reference to API (Indicator: "SetLastError"; File: "MaxLoonaFest131.exe.1646122814") Found reference to API (Indicator: "BackupRead"; File: "MaxLoonaFest131.exe.1646122814") Found reference to API (Indicator: "GetProcessHeaps"; File: "MaxLoonaFest131.exe.1646122814") Found reference to API (Indicator: "VirtualAlloc"; File: "MaxLoonaFest131.exe.1646122814") Found reference to API (Indicator: "BeginUpdateResourceW"; File: "MaxLoonaFest131.exe.1646122814") Found reference to API (Indicator: "EnumDateFormatsExA"; File: "MaxLoonaFest131.exe.1646122814") Found reference to API (Indicator: "SetComputerNameA"; File: "MaxLoonaFest131.exe.1646122814") Found reference to API (Indicator: "SetFileApisToOEM"; File: "MaxLoonaFest131.exe.1646122814") Found reference to API (Indicator: "InterlockedExchangeAdd"; File: "MaxLoonaFest131.exe.1646122814") Found reference to API (Indicator: "CreateFileMappingW"; File: "MaxLoonaFest131.exe.1646122814") Found reference to API (Indicator: "FindFirstVolumeMountPointW"; File: "MaxLoonaFest131.exe.1646122814") Found reference to API (Indicator: "SetConsoleWindowInfo"; File: "MaxLoonaFest131.exe.1646122814") Found reference to API (Indicator: "FoldStringA"; File: "MaxLoonaFest131.exe.1646122814") Found reference to API (Indicator: "FindFirstVolumeMountPointA"; File: "MaxLoonaFest131.exe.1646122814") Found reference to API (Indicator: "GetModuleHandleA"; File: "MaxLoonaFest131.exe.1646122814") Found reference to API (Indicator: "VirtualProtect"; File: "MaxLoonaFest131.exe.1646122814") Found reference to API (Indicator: "OpenSemaphoreW"; File: "MaxLoonaFest131.exe.1646122814") Found reference to API (Indicator: "GlobalAddAtomW"; File: "MaxLoonaFest131.exe.1646122814") Found reference to API (Indicator: "ReadConsoleOutputCharacterW"; File: "MaxLoonaFest131.exe.1646122814") Found reference to API (Indicator: "LCMapStringW"; File: "MaxLoonaFest131.exe.1646122814") Found reference to API (Indicator: "GetWindowTextLengthW"; File: "MaxLoonaFest131.exe.1646122814") Found reference to API (Indicator: "ReadEventLogA"; File: "MaxLoonaFest131.exe.1646122814") Found reference to API (Indicator: "WinHttpCheckPlatform"; File: "MaxLoonaFest131.exe.1646122814") Found reference to API (Indicator: "GetStdHandle"; File: "MaxLoonaFest131.exe.1646122814") Found reference to API (Indicator: "TlsAlloc"; File: "MaxLoonaFest131.exe.1646122814") Found reference to API (Indicator: "TlsSetValue"; File: "MaxLoonaFest131.exe.1646122814") Found reference to API (Indicator: "TlsFree"; File: "MaxLoonaFest131.exe.1646122814") Found reference to API (Indicator: "InterlockedDecrement"; File: "MaxLoonaFest131.exe.1646122814") Found reference to API (Indicator: "HeapSize"; File: "MaxLoonaFest131.exe.1646122814") Found reference to API (Indicator: "EnterCriticalSection"; File: "MaxLoonaFest131.exe.1646122814") Found reference to API (Indicator: "LeaveCriticalSection"; File: "MaxLoonaFest131.exe.1646122814") Found reference to API (Indicator: "IsDebuggerPresent"; File: "MaxLoonaFest131.exe.1646122814") Found reference to API (Indicator: "HeapFree"; File: "MaxLoonaFest131.exe.1646122814") Found reference to API (Indicator: "DeleteCriticalSection"; File: "MaxLoonaFest131.exe.1646122814") Found reference to API (Indicator: "InitializeCriticalSectionAndSpinCount"; File: "MaxLoonaFest131.exe.1646122814") Found reference to API (Indicator: "GetModuleFileNameW"; File: "MaxLoonaFest131.exe.1646122814") Found reference to API (Indicator: "FreeEnvironmentStringsW"; File: "MaxLoonaFest131.exe.1646122814") Found reference to API (Indicator: "GetEnvironmentStringsW"; File: "MaxLoonaFest131.exe.1646122814") Found reference to API (Indicator: "GetCommandLineW"; File: "MaxLoonaFest131.exe.1646122814") Found reference to API (Indicator: "SetHandleCount"; File: "MaxLoonaFest131.exe.1646122814") Found reference to API (Indicator: "GetFileType"; File: "MaxLoonaFest131.exe.1646122814") Found reference to API (Indicator: "GetStartupInfoA"; File: "MaxLoonaFest131.exe.1646122814") Found reference to API (Indicator: "HeapCreate"; File: "MaxLoonaFest131.exe.1646122814") Found reference to API (Indicator: "VirtualFree"; File: "MaxLoonaFest131.exe.1646122814") Found reference to API (Indicator: "GetCPInfo"; File: "MaxLoonaFest131.exe.1646122814") Found reference to API (Indicator: "GetACP"; File: "MaxLoonaFest131.exe.1646122814") Found reference to API (Indicator: "GetOEMCP"; File: "MaxLoonaFest131.exe.1646122814") Found reference to API (Indicator: "IsValidCodePage"; File: "MaxLoonaFest131.exe.1646122814") Found reference to API (Indicator: "HeapAlloc"; File: "MaxLoonaFest131.exe.1646122814") Found reference to API (Indicator: "HeapReAlloc"; File: "MaxLoonaFest131.exe.1646122814") Found reference to API (Indicator: "RtlUnwind"; File: "MaxLoonaFest131.exe.1646122814") Found reference to API (Indicator: "WideCharToMultiByte"; File: "MaxLoonaFest131.exe.1646122814") Found reference to API (Indicator: "GetLocaleInfoA"; File: "MaxLoonaFest131.exe.1646122814") Found reference to API (Indicator: "GetStringTypeA"; File: "MaxLoonaFest131.exe.1646122814") Found reference to API (Indicator: "MultiByteToWideChar"; File: "MaxLoonaFest131.exe.1646122814") Found reference to API (Indicator: "GetStringTypeW"; File: "MaxLoonaFest131.exe.1646122814") Found reference to API (Indicator: "LCMapStringA"; File: "MaxLoonaFest131.exe.1646122814") Found reference to API (Indicator: "GetConsoleCP"; File: "MaxLoonaFest131.exe.1646122814") Found reference to API (Indicator: "GetConsoleMode"; File: "MaxLoonaFest131.exe.1646122814") Found reference to API (Indicator: "FlushFileBuffers"; File: "MaxLoonaFest131.exe.1646122814") Found reference to API (Indicator: "WriteConsoleA"; File: "MaxLoonaFest131.exe.1646122814") Found reference to API (Indicator: "GetConsoleOutputCP"; File: "MaxLoonaFest131.exe.1646122814") Found reference to API (Indicator: "WriteConsoleW"; File: "MaxLoonaFest131.exe.1646122814") Found reference to API (Indicator: "SetStdHandle"; File: "MaxLoonaFest131.exe.1646122814") Found reference to API (Indicator: "SetThreadStackGuarantee"; File: "5eh2lq1.exe.27807583") Found reference to API (Indicator: "GetXStateFeaturesMask"; File: "5eh2lq1.exe.27807583") Found reference to API (Indicator: "MessageBoxW"; File: "5eh2lq1.exe.27807583") Found reference to API (Indicator: "GetUserObjectInformationW"; File: "5eh2lq1.exe.27807583") Found reference to API (Indicator: "LocateXStateFeature"; File: "5eh2lq1.exe.27807583") Found reference to API (Indicator: "GetEnabledXStateFeatures"; File: "5eh2lq1.exe.27807583") Found reference to API (Indicator: "GetNativeSystemInfo"; Source: "00000000-00001512.00000000.67840.00E5C000.00000002.mdmp") Found reference to API (Indicator: "InitializeConditionVariable"; Source: "00000000-00001512.00000000.67840.00E5C000.00000002.mdmp") Found reference to API (Indicator: "SleepConditionVariableCS"; Source: "00000000-00001512.00000000.67840.00E5C000.00000002.mdmp") Found reference to API (Indicator: "WakeAllConditionVariable"; Source: "00000000-00001512.00000000.67840.00E5C000.00000002.mdmp") Found reference to API (Indicator: "FlsAlloc"; Source: "00000000-00001512.00000000.67840.00E5C000.00000002.mdmp") Found reference to API (Indicator: "FlsFree"; Source: "00000000-00001512.00000000.67840.00E5C000.00000002.mdmp") Found reference to API (Indicator: "FlsGetValue"; Source: "00000000-00001512.00000000.67840.00E5C000.00000002.mdmp") Found reference to API (Indicator: "FlsSetValue"; Source: "00000000-00001512.00000000.67840.00E5C000.00000002.mdmp") Found reference to API (Indicator: "InitializeCriticalSectionEx"; Source: "00000000-00001512.00000000.67840.00E5C000.00000002.mdmp") Found reference to API (Indicator: "CompareStringEx"; Source: "00000000-00001512.00000000.67840.00E5C000.00000002.mdmp") Found reference to API (Indicator: "GetDateFormatEx"; Source: "00000000-00001512.00000000.67840.00E5C000.00000002.mdmp") Found reference to API (Indicator: "GetSystemTimePreciseAsFileTime"; Source: "00000000-00001512.00000000.67840.00E5C000.00000002.mdmp") Found reference to API (Indicator: "GetTimeFormatEx"; Source: "00000000-00001512.00000000.67840.00E5C000.00000002.mdmp") Found reference to API (Indicator: "LCMapStringEx"; Source: "00000000-00001512.00000000.67840.00E5C000.00000002.mdmp") Found reference to API (Indicator: "LocaleNameToLCID"; Source: "00000000-00001512.00000000.67840.00E5C000.00000002.mdmp") Found reference to API (Indicator: "Wow64RevertWow64FsRedirection"; Source: "00000000-00001512.00000000.67840.00E5C000.00000002.mdmp") Found reference to API (Indicator: "Wow64DisableWow64FsRedirection"; Source: "00000000-00001512.00000000.67840.00E5C000.00000002.mdmp") Found reference to API (Indicator: "GetModuleHandleExW"; Source: "00000000-00001512.00000000.67840.00E5C000.00000002.mdmp") Found reference to API (Indicator: "GetSystemWow64DirectoryW"; Source: "00000000-00001512.00000000.67840.00E5C000.00000002.mdmp") Found reference to API (Indicator: "RegDeleteKeyExW"; Source: "00000000-00001512.00000000.67840.00E5C000.00000002.mdmp") Found reference to API (Indicator: "GetFileVersionInfoSizeW"; Source: "00000000-00001512.00000000.67840.00E5C000.00000002.mdmp") Found reference to API (Indicator: "GetFileVersionInfoW"; Source: "00000000-00001512.00000000.67840.00E5C000.00000002.mdmp") Found reference to API (Indicator: "VerQueryValueW"; Source: "00000000-00001512.00000000.67840.00E5C000.00000002.mdmp") Found reference to API (Indicator: "WNetAddConnection2W"; Source: "00000000-00001512.00000000.67840.00E5C000.00000002.mdmp") Found reference to API (Indicator: "WNetUseConnectionW"; Source: "00000000-00001512.00000000.67840.00E5C000.00000002.mdmp") Found reference to API (Indicator: "WNetCancelConnection2W"; Source: "00000000-00001512.00000000.67840.00E5C000.00000002.mdmp") Found reference to API (Indicator: "WNetGetConnectionW"; Source: "00000000-00001512.00000000.67840.00E5C000.00000002.mdmp") Found reference to API (Indicator: "InternetCloseHandle"; Source: "00000000-00001512.00000000.67840.00E5C000.00000002.mdmp") Found reference to API (Indicator: "InternetOpenW"; Source: "00000000-00001512.00000000.67840.00E5C000.00000002.mdmp") Found reference to API (Indicator: "InternetSetOptionW"; Source: "00000000-00001512.00000000.67840.00E5C000.00000002.mdmp") Found reference to API (Indicator: "InternetCrackUrlW"; Source: "00000000-00001512.00000000.67840.00E5C000.00000002.mdmp") Found reference to API (Indicator: "HttpQueryInfoW"; Source: "00000000-00001512.00000000.67840.00E5C000.00000002.mdmp") Found reference to API (Indicator: "InternetQueryOptionW"; Source: "00000000-00001512.00000000.67840.00E5C000.00000002.mdmp") Found reference to API (Indicator: "InternetConnectW"; Source: "00000000-00001512.00000000.67840.00E5C000.00000002.mdmp") Found reference to API (Indicator: "HttpOpenRequestW"; Source: "00000000-00001512.00000000.67840.00E5C000.00000002.mdmp") Found reference to API (Indicator: "HttpSendRequestW"; Source: "00000000-00001512.00000000.67840.00E5C000.00000002.mdmp") Found reference to API (Indicator: "FtpOpenFileW"; Source: "00000000-00001512.00000000.67840.00E5C000.00000002.mdmp") Found reference to API (Indicator: "FtpGetFileSize"; Source: "00000000-00001512.00000000.67840.00E5C000.00000002.mdmp") Found reference to API (Indicator: "InternetOpenUrlW"; Source: "00000000-00001512.00000000.67840.00E5C000.00000002.mdmp") Found reference to API (Indicator: "InternetReadFile"; Source: "00000000-00001512.00000000.67840.00E5C000.00000002.mdmp") Found reference to API (Indicator: "InternetQueryDataAvailable"; Source: "00000000-00001512.00000000.67840.00E5C000.00000002.mdmp") Found reference to API (Indicator: "GetProcessMemoryInfo"; Source: "00000000-00001512.00000000.67840.00E5C000.00000002.mdmp") Found reference to API (Indicator: "IcmpSendEcho"; Source: "00000000-00001512.00000000.67840.00E5C000.00000002.mdmp") Found reference to API (Indicator: "CreateEnvironmentBlock"; Source: "00000000-00001512.00000000.67840.00E5C000.00000002.mdmp") Found reference to API (Indicator: "DestroyEnvironmentBlock"; Source: "00000000-00001512.00000000.67840.00E5C000.00000002.mdmp") Found reference to API (Indicator: "InterlockedIncrement"; Source: "00000000-00001512.00000000.67840.00E5C000.00000002.mdmp") Found reference to API (Indicator: "InterlockedDecrement"; Source: "00000000-00001512.00000000.67840.00E5C000.00000002.mdmp") Found reference to API (Indicator: "DeleteCriticalSection"; Source: "00000000-00001512.00000000.67840.00E5C000.00000002.mdmp") Found reference to API (Indicator: "InitializeCriticalSectionAndSpinCount"; Source: "00000000-00001512.00000000.67840.00E5C000.00000002.mdmp") Found reference to API (Indicator: "RaiseException"; Source: "00000000-00001512.00000000.67840.00E5C000.00000002.mdmp") Found reference to API (Indicator: "GetLastError"; Source: "00000000-00001512.00000000.67840.00E5C000.00000002.mdmp, 00000000-00001512.00000000.67840.6B260000.00000002.mdmp") Found reference to API (Indicator: "DecodePointer"; Source: "00000000-00001512.00000000.67840.00E5C000.00000002.mdmp") Found reference to API (Indicator: "lstrcmpiW"; Source: "00000000-00001512.00000000.67840.00E5C000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentDirectoryW"; Source: "00000000-00001512.00000000.67840.00E5C000.00000002.mdmp, 00000000-00001512.00000000.67840.6B260000.00000002.mdmp") Found reference to API (Indicator: "IsDebuggerPresent"; Source: "00000000-00001512.00000000.67840.00E5C000.00000002.mdmp") Found reference to API (Indicator: "SetCurrentDirectoryW"; Source: "00000000-00001512.00000000.67840.00E5C000.00000002.mdmp") Found reference to API (Indicator: "GetFullPathNameW"; Source: "00000000-00001512.00000000.67840.00E5C000.00000002.mdmp") Found reference to API (Indicator: "CloseHandle"; Source: "00000000-00001512.00000000.67840.00E5C000.00000002.mdmp, 00000000-00001512.00000000.67840.6B260000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentThread"; Source: "00000000-00001512.00000000.67840.00E5C000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcess"; Source: "00000000-00001512.00000000.67840.00E5C000.00000002.mdmp, 00000000-00001512.00000000.67840.6B260000.00000002.mdmp") Found reference to API (Indicator: "DuplicateHandle"; Source: "00000000-00001512.00000000.67840.00E5C000.00000002.mdmp") Found reference to API (Indicator: "CreateThread"; Source: "00000000-00001512.00000000.67840.00E5C000.00000002.mdmp") Found reference to API (Indicator: "WaitForSingleObject"; Source: "00000000-00001512.00000000.67840.00E5C000.00000002.mdmp") Found reference to API (Indicator: "HeapAlloc"; Source: "00000000-00001512.00000000.67840.00E5C000.00000002.mdmp") Found reference to API (Indicator: "GetProcessHeap"; Source: "00000000-00001512.00000000.67840.00E5C000.00000002.mdmp") Found reference to API (Indicator: "HeapFree"; Source: "00000000-00001512.00000000.67840.00E5C000.00000002.mdmp") Found reference to API (Indicator: "Sleep"; Source: "00000000-00001512.00000000.67840.00E5C000.00000002.mdmp, 00000000-00001512.00000000.67840.6B260000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentThreadId"; Source: "00000000-00001512.00000000.67840.00E5C000.00000002.mdmp, 00000000-00001512.00000000.67840.6B260000.00000002.mdmp") Found reference to API (Indicator: "MultiByteToWideChar"; Source: "00000000-00001512.00000000.67840.00E5C000.00000002.mdmp") Found reference to API (Indicator: "MulDiv"; Source: "00000000-00001512.00000000.67840.00E5C000.00000002.mdmp") Found reference to API (Indicator: "GetVersionExW"; Source: "00000000-00001512.00000000.67840.00E5C000.00000002.mdmp") Found reference to API (Indicator: "IsWow64Process"; Source: "00000000-00001512.00000000.67840.00E5C000.00000002.mdmp") Found reference to API (Indicator: "GetSystemInfo"; Source: "00000000-00001512.00000000.67840.00E5C000.00000002.mdmp") Found reference to API (Indicator: "FreeLibrary"; Source: "00000000-00001512.00000000.67840.00E5C000.00000002.mdmp, 00000000-00001512.00000000.67840.6B260000.00000002.mdmp") Found reference to API (Indicator: "LoadLibraryA"; Source: "00000000-00001512.00000000.67840.00E5C000.00000002.mdmp") Found reference to API (Indicator: "GetProcAddress"; Source: "00000000-00001512.00000000.67840.00E5C000.00000002.mdmp, 00000000-00001512.00000000.67840.6B260000.00000002.mdmp") Found reference to API (Indicator: "SetErrorMode"; Source: "00000000-00001512.00000000.67840.00E5C000.00000002.mdmp") Found reference to API (Indicator: "GetModuleFileNameW"; Source: "00000000-00001512.00000000.67840.00E5C000.00000002.mdmp") Found reference to API (Indicator: "WideCharToMultiByte"; Source: "00000000-00001512.00000000.67840.00E5C000.00000002.mdmp") Found reference to API (Indicator: "lstrcpyW"; Source: "00000000-00001512.00000000.67840.00E5C000.00000002.mdmp") Found reference to API (Indicator: "lstrlenW"; Source: "00000000-00001512.00000000.67840.00E5C000.00000002.mdmp") Found reference to API (Indicator: "GetModuleHandleW"; Source: "00000000-00001512.00000000.67840.00E5C000.00000002.mdmp, 00000000-00001512.00000000.67840.6B260000.00000002.mdmp") Found reference to API (Indicator: "QueryPerformanceCounter"; Source: "00000000-00001512.00000000.67840.00E5C000.00000002.mdmp, 00000000-00001512.00000000.67840.6B260000.00000002.mdmp") Found reference to API (Indicator: "VirtualFreeEx"; Source: "00000000-00001512.00000000.67840.00E5C000.00000002.mdmp") Found reference to API (Indicator: "OpenProcess"; Source: "00000000-00001512.00000000.67840.00E5C000.00000002.mdmp") Found reference to API (Indicator: "VirtualAllocEx"; Source: "00000000-00001512.00000000.67840.00E5C000.00000002.mdmp") Found reference to API (Indicator: "WriteProcessMemory"; Source: "00000000-00001512.00000000.67840.00E5C000.00000002.mdmp") Found reference to API (Indicator: "ReadProcessMemory"; Source: "00000000-00001512.00000000.67840.00E5C000.00000002.mdmp") Found reference to API (Indicator: "CreateFileW"; Source: "00000000-00001512.00000000.67840.00E5C000.00000002.mdmp, 00000000-00001512.00000000.67840.6B260000.00000002.mdmp") Found reference to API (Indicator: "SetFilePointerEx"; Source: "00000000-00001512.00000000.67840.00E5C000.00000002.mdmp") Found reference to API (Indicator: "SetEndOfFile"; Source: "00000000-00001512.00000000.67840.00E5C000.00000002.mdmp") Found reference to API (Indicator: "ReadFile"; Source: "00000000-00001512.00000000.67840.00E5C000.00000002.mdmp") Found reference to API (Indicator: "WriteFile"; Source: "00000000-00001512.00000000.67840.00E5C000.00000002.mdmp") Found reference to API (Indicator: "FlushFileBuffers"; Source: "00000000-00001512.00000000.67840.00E5C000.00000002.mdmp") Found reference to API (Indicator: "TerminateProcess"; Source: "00000000-00001512.00000000.67840.00E5C000.00000002.mdmp, 00000000-00001512.00000000.67840.6B260000.00000002.mdmp") Found reference to API (Indicator: "CreateToolhelp32Snapshot"; Source: "00000000-00001512.00000000.67840.00E5C000.00000002.mdmp") Found reference to API (Indicator: "Process32FirstW"; Source: "00000000-00001512.00000000.67840.00E5C000.00000002.mdmp") Found reference to API (Indicator: "Process32NextW"; Source: "00000000-00001512.00000000.67840.00E5C000.00000002.mdmp") Found reference to API (Indicator: "SetFileTime"; Source: "00000000-00001512.00000000.67840.00E5C000.00000002.mdmp") Found reference to API (Indicator: "GetFileAttributesW"; Source: "00000000-00001512.00000000.67840.00E5C000.00000002.mdmp") Found reference to API (Indicator: "FindFirstFileW"; Source: "00000000-00001512.00000000.67840.00E5C000.00000002.mdmp") Found reference to API (Indicator: "FindClose"; Source: "00000000-00001512.00000000.67840.00E5C000.00000002.mdmp") Found reference to API (Indicator: "GetLongPathNameW"; Source: "00000000-00001512.00000000.67840.00E5C000.00000002.mdmp") Found reference to API (Indicator: "GetShortPathNameW"; Source: "00000000-00001512.00000000.67840.00E5C000.00000002.mdmp") Found reference to API (Indicator: "DeleteFileW"; Source: "00000000-00001512.00000000.67840.00E5C000.00000002.mdmp") Found reference to API (Indicator: "FindNextFileW"; Source: "00000000-00001512.00000000.67840.00E5C000.00000002.mdmp") Found reference to API (Indicator: "CopyFileExW"; Source: "00000000-00001512.00000000.67840.00E5C000.00000002.mdmp") Found reference to API (Indicator: "MoveFileW"; Source: "00000000-00001512.00000000.67840.00E5C000.00000002.mdmp") Found reference to API (Indicator: "CreateDirectoryW"; Source: "00000000-00001512.00000000.67840.00E5C000.00000002.mdmp") Found reference to API (Indicator: "RemoveDirectoryW"; Source: "00000000-00001512.00000000.67840.00E5C000.00000002.mdmp") Found reference to API (Indicator: "SetSystemPowerState"; Source: "00000000-00001512.00000000.67840.00E5C000.00000002.mdmp") Found reference to API (Indicator: "QueryPerformanceFrequency"; Source: "00000000-00001512.00000000.67840.00E5C000.00000002.mdmp") Found reference to API (Indicator: "LoadResource"; Source: "00000000-00001512.00000000.67840.00E5C000.00000002.mdmp") Found reference to API (Indicator: "LockResource"; Source: "00000000-00001512.00000000.67840.00E5C000.00000002.mdmp") Found reference to API (Indicator: "SizeofResource"; Source: "00000000-00001512.00000000.67840.00E5C000.00000002.mdmp") Found reference to API (Indicator: "OutputDebugStringW"; Source: "00000000-00001512.00000000.67840.00E5C000.00000002.mdmp") Found reference to API (Indicator: "GetTempPathW"; Source: "00000000-00001512.00000000.67840.00E5C000.00000002.mdmp") Found reference to API (Indicator: "GetTempFileNameW"; Source: "00000000-00001512.00000000.67840.00E5C000.00000002.mdmp") Found reference to API (Indicator: "DeviceIoControl"; Source: "00000000-00001512.00000000.67840.00E5C000.00000002.mdmp") Found reference to API (Indicator: "LoadLibraryW"; Source: "00000000-00001512.00000000.67840.00E5C000.00000002.mdmp") Found reference to API (Indicator: "GetLocalTime"; Source: "00000000-00001512.00000000.67840.00E5C000.00000002.mdmp") Found reference to API (Indicator: "CompareStringW"; Source: "00000000-00001512.00000000.67840.00E5C000.00000002.mdmp, 00000000-00001512.00000000.67840.6B260000.00000002.mdmp") Found reference to API (Indicator: "EnterCriticalSection"; Source: "00000000-00001512.00000000.67840.00E5C000.00000002.mdmp") Found reference to API (Indicator: "LeaveCriticalSection"; Source: "00000000-00001512.00000000.67840.00E5C000.00000002.mdmp") Found reference to API (Indicator: "GetStdHandle"; Source: "00000000-00001512.00000000.67840.00E5C000.00000002.mdmp") Found reference to API (Indicator: "CreatePipe"; Source: "00000000-00001512.00000000.67840.00E5C000.00000002.mdmp") Found reference to API (Indicator: "InterlockedExchange"; Source: "00000000-00001512.00000000.67840.00E5C000.00000002.mdmp") Found reference to API (Indicator: "TerminateThread"; Source: "00000000-00001512.00000000.67840.00E5C000.00000002.mdmp") Found reference to API (Indicator: "LoadLibraryExW"; Source: "00000000-00001512.00000000.67840.00E5C000.00000002.mdmp, 00000000-00001512.00000000.67840.6B260000.00000002.mdmp") Found reference to API (Indicator: "FindResourceExW"; Source: "00000000-00001512.00000000.67840.00E5C000.00000002.mdmp") Found reference to API (Indicator: "CopyFileW"; Source: "00000000-00001512.00000000.67840.00E5C000.00000002.mdmp") Found reference to API (Indicator: "VirtualFree"; Source: "00000000-00001512.00000000.67840.00E5C000.00000002.mdmp") Found reference to API (Indicator: "FormatMessageW"; Source: "00000000-00001512.00000000.67840.00E5C000.00000002.mdmp") Found reference to API (Indicator: "GetExitCodeProcess"; Source: "00000000-00001512.00000000.67840.00E5C000.00000002.mdmp") Found reference to API (Indicator: "GetPrivateProfileStringW"; Source: "00000000-00001512.00000000.67840.00E5C000.00000002.mdmp") Found reference to API (Indicator: "WritePrivateProfileStringW"; Source: "00000000-00001512.00000000.67840.00E5C000.00000002.mdmp") Found reference to API (Indicator: "GetPrivateProfileSectionW"; Source: "00000000-00001512.00000000.67840.00E5C000.00000002.mdmp") Found reference to API (Indicator: "WritePrivateProfileSectionW"; Source: "00000000-00001512.00000000.67840.00E5C000.00000002.mdmp") Found reference to API (Indicator: "GetPrivateProfileSectionNamesW"; Source: "00000000-00001512.00000000.67840.00E5C000.00000002.mdmp") Found reference to API (Indicator: "FileTimeToLocalFileTime"; Source: "00000000-00001512.00000000.67840.00E5C000.00000002.mdmp") Found reference to API (Indicator: "FileTimeToSystemTime"; Source: "00000000-00001512.00000000.67840.00E5C000.00000002.mdmp") Found reference to API (Indicator: "SystemTimeToFileTime"; Source: "00000000-00001512.00000000.67840.00E5C000.00000002.mdmp") Found reference to API (Indicator: "LocalFileTimeToFileTime"; Source: "00000000-00001512.00000000.67840.00E5C000.00000002.mdmp") Found reference to API (Indicator: "GetDriveTypeW"; Source: "00000000-00001512.00000000.67840.00E5C000.00000002.mdmp") Found reference to API (Indicator: "GetDiskFreeSpaceExW"; Source: "00000000-00001512.00000000.67840.00E5C000.00000002.mdmp") Found reference to API (Indicator: "GetDiskFreeSpaceW"; Source: "00000000-00001512.00000000.67840.00E5C000.00000002.mdmp") Found reference to API (Indicator: "GetVolumeInformationW"; Source: "00000000-00001512.00000000.67840.00E5C000.00000002.mdmp") Found reference to API (Indicator: "SetVolumeLabelW"; Source: "00000000-00001512.00000000.67840.00E5C000.00000002.mdmp") Found reference to API (Indicator: "CreateHardLinkW"; Source: "00000000-00001512.00000000.67840.00E5C000.00000002.mdmp") Found reference to API (Indicator: "SetFileAttributesW"; Source: "00000000-00001512.00000000.67840.00E5C000.00000002.mdmp") Found reference to API (Indicator: "CreateEventW"; Source: "00000000-00001512.00000000.67840.00E5C000.00000002.mdmp") Found reference to API (Indicator: "SetEvent"; Source: "00000000-00001512.00000000.67840.00E5C000.00000002.mdmp") Found reference to API (Indicator: "GetEnvironmentVariableW"; Source: "00000000-00001512.00000000.67840.00E5C000.00000002.mdmp") Found reference to API (Indicator: "SetEnvironmentVariableW"; Source: "00000000-00001512.00000000.67840.00E5C000.00000002.mdmp") Found reference to API (Indicator: "GlobalLock"; Source: "00000000-00001512.00000000.67840.00E5C000.00000002.mdmp, 00000000-00001512.00000000.67840.6B260000.00000002.mdmp") Found reference to API (Indicator: "GlobalUnlock"; Source: "00000000-00001512.00000000.67840.00E5C000.00000002.mdmp, 00000000-00001512.00000000.67840.6B260000.00000002.mdmp") Found reference to API (Indicator: "GlobalAlloc"; Source: "00000000-00001512.00000000.67840.00E5C000.00000002.mdmp, 00000000-00001512.00000000.67840.6B260000.00000002.mdmp") Found reference to API (Indicator: "GetFileSize"; Source: "00000000-00001512.00000000.67840.00E5C000.00000002.mdmp") Found reference to API (Indicator: "GlobalFree"; Source: "00000000-00001512.00000000.67840.00E5C000.00000002.mdmp") Found reference to API (Indicator: "GlobalMemoryStatusEx"; Source: "00000000-00001512.00000000.67840.00E5C000.00000002.mdmp") Found reference to API (Indicator: "Beep"; Source: "00000000-00001512.00000000.67840.00E5C000.00000002.mdmp") Found reference to API (Indicator: "GetSystemDirectoryW"; Source: "00000000-00001512.00000000.67840.00E5C000.00000002.mdmp") Found reference to API (Indicator: "HeapReAlloc"; Source: "00000000-00001512.00000000.67840.00E5C000.00000002.mdmp") Found reference to API (Indicator: "HeapSize"; Source: "00000000-00001512.00000000.67840.00E5C000.00000002.mdmp") Found reference to API (Indicator: "GetComputerNameW"; Source: "00000000-00001512.00000000.67840.00E5C000.00000002.mdmp") Found reference to API (Indicator: "GetWindowsDirectoryW"; Source: "00000000-00001512.00000000.67840.00E5C000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcessId"; Source: "00000000-00001512.00000000.67840.00E5C000.00000002.mdmp, 00000000-00001512.00000000.67840.6B260000.00000002.mdmp") Found reference to API (Indicator: "GetProcessIoCounters"; Source: "00000000-00001512.00000000.67840.00E5C000.00000002.mdmp") Found reference to API (Indicator: "CreateProcessW"; Source: "00000000-00001512.00000000.67840.00E5C000.00000002.mdmp") Found reference to API (Indicator: "GetProcessId"; Source: "00000000-00001512.00000000.67840.00E5C000.00000002.mdmp") Found reference to API (Indicator: "SetPriorityClass"; Source: "00000000-00001512.00000000.67840.00E5C000.00000002.mdmp") Found reference to API (Indicator: "VirtualAlloc"; Source: "00000000-00001512.00000000.67840.00E5C000.00000002.mdmp") Found reference to API (Indicator: "DestroyIcon"; Source: "00000000-00001512.00000000.67840.00E5C000.00000002.mdmp") Found reference to API (Indicator: "MessageBoxA"; Source: "00000000-00001512.00000000.67840.00E5C000.00000002.mdmp") Found reference to API (Indicator: "GetForegroundWindow"; Source: "00000000-00001512.00000000.67840.00E5C000.00000002.mdmp") Found reference to API (Indicator: "GetSysColorBrush"; Source: "00000000-00001512.00000000.67840.00E5C000.00000002.mdmp") Found reference to API (Indicator: "LoadCursorW"; Source: "00000000-00001512.00000000.67840.00E5C000.00000002.mdmp") Found reference to API (Indicator: "LoadIconW"; Source: "00000000-00001512.00000000.67840.00E5C000.00000002.mdmp") Found reference to API (Indicator: "CreateWindowExW"; Source: "00000000-00001512.00000000.67840.00E5C000.00000002.mdmp") Found reference to API (Indicator: "ShowWindow"; Source: "00000000-00001512.00000000.67840.00E5C000.00000002.mdmp") Found reference to API (Indicator: "SetTimer"; Source: "00000000-00001512.00000000.67840.00E5C000.00000002.mdmp") Found reference to API (Indicator: "CreatePopupMenu"; Source: "00000000-00001512.00000000.67840.00E5C000.00000002.mdmp") Found reference to API (Indicator: "KillTimer"; Source: "00000000-00001512.00000000.67840.00E5C000.00000002.mdmp") Found reference to API (Indicator: "PostQuitMessage"; Source: "00000000-00001512.00000000.67840.00E5C000.00000002.mdmp") Found reference to API (Indicator: "SetFocus"; Source: "00000000-00001512.00000000.67840.00E5C000.00000002.mdmp") Found reference to API (Indicator: "MoveWindow"; Source: "00000000-00001512.00000000.67840.00E5C000.00000002.mdmp") Found reference to API (Indicator: "DefWindowProcW"; Source: "00000000-00001512.00000000.67840.00E5C000.00000002.mdmp") Found reference to API (Indicator: "MessageBoxW"; Source: "00000000-00001512.00000000.67840.00E5C000.00000002.mdmp") Found reference to API (Indicator: "OpenWindowStationW"; Source: "00000000-00001512.00000000.67840.00E5C000.00000002.mdmp") Found reference to API (Indicator: "GetProcessWindowStation"; Source: "00000000-00001512.00000000.67840.00E5C000.00000002.mdmp") Found reference to API (Indicator: "SetProcessWindowStation"; Source: "00000000-00001512.00000000.67840.00E5C000.00000002.mdmp") Found reference to API (Indicator: "OpenDesktopW"; Source: "00000000-00001512.00000000.67840.00E5C000.00000002.mdmp") Found reference to API (Indicator: "CloseWindowStation"; Source: "00000000-00001512.00000000.67840.00E5C000.00000002.mdmp") Found reference to API (Indicator: "CloseDesktop"; Source: "00000000-00001512.00000000.67840.00E5C000.00000002.mdmp") Found reference to API (Indicator: "GetWindowRect"; Source: "00000000-00001512.00000000.67840.00E5C000.00000002.mdmp") Found reference to API (Indicator: "GetParent"; Source: "00000000-00001512.00000000.67840.00E5C000.00000002.mdmp") Found reference to API (Indicator: "CharUpperBuffW"; Source: "00000000-00001512.00000000.67840.00E5C000.00000002.mdmp") Found reference to API (Indicator: "EnumChildWindows"; Source: "00000000-00001512.00000000.67840.00E5C000.00000002.mdmp") Found reference to API (Indicator: "ScreenToClient"; Source: "00000000-00001512.00000000.67840.00E5C000.00000002.mdmp") Found reference to API (Indicator: "GetWindowTextW"; Source: "00000000-00001512.00000000.67840.00E5C000.00000002.mdmp") Found reference to API (Indicator: "GetFocus"; Source: "00000000-00001512.00000000.67840.00E5C000.00000002.mdmp") Found reference to API (Indicator: "AttachThreadInput"; Source: "00000000-00001512.00000000.67840.00E5C000.00000002.mdmp") Found reference to API (Indicator: "GetWindowThreadProcessId"; Source: "00000000-00001512.00000000.67840.00E5C000.00000002.mdmp, 00000000-00001512.00000000.67840.6B221000.00000020.mdmp") Found reference to API (Indicator: "InvalidateRect"; Source: "00000000-00001512.00000000.67840.00E5C000.00000002.mdmp") Found reference to API (Indicator: "EnableWindow"; Source: "00000000-00001512.00000000.67840.00E5C000.00000002.mdmp") Found reference to API (Indicator: "IsWindowVisible"; Source: "00000000-00001512.00000000.67840.00E5C000.00000002.mdmp") Found reference to API (Indicator: "IsWindowEnabled"; Source: "00000000-00001512.00000000.67840.00E5C000.00000002.mdmp") Found reference to API (Indicator: "IsWindow"; Source: "00000000-00001512.00000000.67840.00E5C000.00000002.mdmp") Found reference to API (Indicator: "GetDesktopWindow"; Source: "00000000-00001512.00000000.67840.00E5C000.00000002.mdmp") Found reference to API (Indicator: "EnumWindows"; Source: "00000000-00001512.00000000.67840.00E5C000.00000002.mdmp") Found reference to API (Indicator: "DestroyWindow"; Source: "00000000-00001512.00000000.67840.00E5C000.00000002.mdmp") Found reference to API (Indicator: "GetMenu"; Source: "00000000-00001512.00000000.67840.00E5C000.00000002.mdmp") Found reference to API (Indicator: "GetClientRect"; Source: "00000000-00001512.00000000.67840.00E5C000.00000002.mdmp") Found reference to API (Indicator: "BeginPaint"; Source: "00000000-00001512.00000000.67840.00E5C000.00000002.mdmp") Found reference to API (Indicator: "GetDC"; Source: "00000000-00001512.00000000.67840.00E5C000.00000002.mdmp") Found reference to API (Indicator: "ReleaseDC"; Source: "00000000-00001512.00000000.67840.00E5C000.00000002.mdmp") Found reference to API (Indicator: "CopyRect"; Source: "00000000-00001512.00000000.67840.00E5C000.00000002.mdmp") Found reference to API (Indicator: "SetWindowTextW"; Source: "00000000-00001512.00000000.67840.00E5C000.00000002.mdmp") Found reference to API (Indicator: "MessageBeep"; Source: "00000000-00001512.00000000.67840.00E5C000.00000002.mdmp") Found reference to API (Indicator: "LoadStringW"; Source: "00000000-00001512.00000000.67840.00E5C000.00000002.mdmp") Found reference to API (Indicator: "GetKeyState"; Source: "00000000-00001512.00000000.67840.00E5C000.00000002.mdmp") Found reference to API (Indicator: "GetKeyboardState"; Source: "00000000-00001512.00000000.67840.00E5C000.00000002.mdmp") Found reference to API (Indicator: "GetAsyncKeyState"; Source: "00000000-00001512.00000000.67840.00E5C000.00000002.mdmp") Found reference to API (Indicator: "SendInput"; Source: "00000000-00001512.00000000.67840.00E5C000.00000002.mdmp") Found reference to API (Indicator: "SystemParametersInfoW"; Source: "00000000-00001512.00000000.67840.00E5C000.00000002.mdmp") Found reference to API (Indicator: "IsIconic"; Source: "00000000-00001512.00000000.67840.00E5C000.00000002.mdmp") Found reference to API (Indicator: "SetForegroundWindow"; Source: "00000000-00001512.00000000.67840.00E5C000.00000002.mdmp") Found reference to API (Indicator: "GetMenuItemInfoW"; Source: "00000000-00001512.00000000.67840.00E5C000.00000002.mdmp") Found reference to API (Indicator: "SetMenuItemInfoW"; Source: "00000000-00001512.00000000.67840.00E5C000.00000002.mdmp") Found reference to API (Indicator: "GetMenuItemCount"; Source: "00000000-00001512.00000000.67840.00E5C000.00000002.mdmp") Found reference to API (Indicator: "GetMenuItemID"; Source: "00000000-00001512.00000000.67840.00E5C000.00000002.mdmp") Found reference to API (Indicator: "CheckMenuRadioItem"; Source: "00000000-00001512.00000000.67840.00E5C000.00000002.mdmp") Found reference to API (Indicator: "DeleteMenu"; Source: "00000000-00001512.00000000.67840.00E5C000.00000002.mdmp") Found reference to API (Indicator: "GetCursorPos"; Source: "00000000-00001512.00000000.67840.00E5C000.00000002.mdmp") Found reference to API (Indicator: "TrackPopupMenuEx"; Source: "00000000-00001512.00000000.67840.00E5C000.00000002.mdmp") Found reference to API (Indicator: "InsertMenuItemW"; Source: "00000000-00001512.00000000.67840.00E5C000.00000002.mdmp") Found reference to API (Indicator: "SetMenuDefaultItem"; Source: "00000000-00001512.00000000.67840.00E5C000.00000002.mdmp") Found reference to API (Indicator: "EnumThreadWindows"; Source: "00000000-00001512.00000000.67840.00E5C000.00000002.mdmp") Found reference to API (Indicator: "SetActiveWindow"; Source: "00000000-00001512.00000000.67840.00E5C000.00000002.mdmp") Found reference to API (Indicator: "ExitWindowsEx"; Source: "00000000-00001512.00000000.67840.00E5C000.00000002.mdmp") Found reference to API (Indicator: "LoadImageW"; Source: "00000000-00001512.00000000.67840.00E5C000.00000002.mdmp") Found reference to API (Indicator: "CharLowerBuffW"; Source: "00000000-00001512.00000000.67840.00E5C000.00000002.mdmp") Found reference to API (Indicator: "UnregisterHotKey"; Source: "00000000-00001512.00000000.67840.00E5C000.00000002.mdmp") Found reference to API (Indicator: "PeekMessageW"; Source: "00000000-00001512.00000000.67840.00E5C000.00000002.mdmp") Found reference to API (Indicator: "TranslateMessage"; Source: "00000000-00001512.00000000.67840.00E5C000.00000002.mdmp") Found reference to API (Indicator: "DispatchMessageW"; Source: "00000000-00001512.00000000.67840.00E5C000.00000002.mdmp") Found reference to API (Indicator: "OpenClipboard"; Source: "00000000-00001512.00000000.67840.00E5C000.00000002.mdmp") Found reference to API (Indicator: "GetClipboardData"; Source: "00000000-00001512.00000000.67840.00E5C000.00000002.mdmp") Found reference to API (Indicator: "CloseClipboard"; Source: "00000000-00001512.00000000.67840.00E5C000.00000002.mdmp") Found reference to API (Indicator: "CountClipboardFormats"; Source: "00000000-00001512.00000000.67840.00E5C000.00000002.mdmp") Found reference to API (Indicator: "EmptyClipboard"; Source: "00000000-00001512.00000000.67840.00E5C000.00000002.mdmp") Found reference to API (Indicator: "SetClipboardData"; Source: "00000000-00001512.00000000.67840.00E5C000.00000002.mdmp") Found reference to API (Indicator: "SetRect"; Source: "00000000-00001512.00000000.67840.00E5C000.00000002.mdmp") Found reference to API (Indicator: "AdjustWindowRectEx"; Source: "00000000-00001512.00000000.67840.00E5C000.00000002.mdmp") Found reference to API (Indicator: "CopyImage"; Source: "00000000-00001512.00000000.67840.00E5C000.00000002.mdmp") Found reference to API (Indicator: "SetWindowPos"; Source: "00000000-00001512.00000000.67840.00E5C000.00000002.mdmp") Found reference to API (Indicator: "GetCursorInfo"; Source: "00000000-00001512.00000000.67840.00E5C000.00000002.mdmp") Found reference to API (Indicator: "RegisterHotKey"; Source: "00000000-00001512.00000000.67840.00E5C000.00000002.mdmp") Found reference to API (Indicator: "ClientToScreen"; Source: "00000000-00001512.00000000.67840.00E5C000.00000002.mdmp") Found reference to API (Indicator: "IsCharAlphaW"; Source: "00000000-00001512.00000000.67840.00E5C000.00000002.mdmp") Found reference to API (Indicator: "IsCharAlphaNumericW"; Source: "00000000-00001512.00000000.67840.00E5C000.00000002.mdmp") Found reference to API (Indicator: "IsCharUpperW"; Source: "00000000-00001512.00000000.67840.00E5C000.00000002.mdmp") Found reference to API (Indicator: "GetMenuStringW"; Source: "00000000-00001512.00000000.67840.00E5C000.00000002.mdmp") Found reference to API (Indicator: "GetSubMenu"; Source: "00000000-00001512.00000000.67840.00E5C000.00000002.mdmp") Found reference to API (Indicator: "GetCaretPos"; Source: "00000000-00001512.00000000.67840.00E5C000.00000002.mdmp") Found reference to API (Indicator: "IsZoomed"; Source: "00000000-00001512.00000000.67840.00E5C000.00000002.mdmp") Found reference to API (Indicator: "TranslateAcceleratorW"; Source: "00000000-00001512.00000000.67840.00E5C000.00000002.mdmp") Found reference to API (Indicator: "GetSysColor"; Source: "00000000-00001512.00000000.67840.00E5C000.00000002.mdmp") Found reference to API (Indicator: "InflateRect"; Source: "00000000-00001512.00000000.67840.00E5C000.00000002.mdmp") Found reference to API (Indicator: "DrawFocusRect"; Source: "00000000-00001512.00000000.67840.00E5C000.00000002.mdmp") Found reference to API (Indicator: "FrameRect"; Source: "00000000-00001512.00000000.67840.00E5C000.00000002.mdmp") Found reference to API (Indicator: "DrawFrameControl"; Source: "00000000-00001512.00000000.67840.00E5C000.00000002.mdmp") Found reference to API (Indicator: "FillRect"; Source: "00000000-00001512.00000000.67840.00E5C000.00000002.mdmp") Found reference to API (Indicator: "PtInRect"; Source: "00000000-00001512.00000000.67840.00E5C000.00000002.mdmp") Found reference to API (Indicator: "DestroyAcceleratorTable"; Source: "00000000-00001512.00000000.67840.00E5C000.00000002.mdmp") Found reference to API (Indicator: "CreateAcceleratorTableW"; Source: "00000000-00001512.00000000.67840.00E5C000.00000002.mdmp") Found reference to API (Indicator: "SetCursor"; Source: "00000000-00001512.00000000.67840.00E5C000.00000002.mdmp") Found reference to API (Indicator: "GetWindowDC"; Source: "00000000-00001512.00000000.67840.00E5C000.00000002.mdmp") Found reference to API (Indicator: "GetSystemMetrics"; Source: "00000000-00001512.00000000.67840.00E5C000.00000002.mdmp") Found reference to API (Indicator: "GetActiveWindow"; Source: "00000000-00001512.00000000.67840.00E5C000.00000002.mdmp") Found reference to API (Indicator: "CharNextW"; Source: "00000000-00001512.00000000.67840.00E5C000.00000002.mdmp") Found reference to API (Indicator: "wsprintfW"; Source: "00000000-00001512.00000000.67840.00E5C000.00000002.mdmp") Found reference to API (Indicator: "RedrawWindow"; Source: "00000000-00001512.00000000.67840.00E5C000.00000002.mdmp") Found reference to API (Indicator: "DrawMenuBar"; Source: "00000000-00001512.00000000.67840.00E5C000.00000002.mdmp") Found reference to API (Indicator: "DestroyMenu"; Source: "00000000-00001512.00000000.67840.00E5C000.00000002.mdmp") Found reference to API (Indicator: "SetMenu"; Source: "00000000-00001512.00000000.67840.00E5C000.00000002.mdmp") Found reference to API (Indicator: "GetWindowTextLengthW"; Source: "00000000-00001512.00000000.67840.00E5C000.00000002.mdmp") Found reference to API (Indicator: "CreateMenu"; Source: "00000000-00001512.00000000.67840.00E5C000.00000002.mdmp") Found reference to API (Indicator: "ReleaseCapture"; Source: "00000000-00001512.00000000.67840.00E5C000.00000002.mdmp") Found reference to API (Indicator: "SetCapture"; Source: "00000000-00001512.00000000.67840.00E5C000.00000002.mdmp") Found reference to API (Indicator: "GetDeviceCaps"; Source: "00000000-00001512.00000000.67840.00E5C000.00000002.mdmp") Found reference to API (Indicator: "DeleteObject"; Source: "00000000-00001512.00000000.67840.00E5C000.00000002.mdmp") Found reference to API (Indicator: "CreateCompatibleBitmap"; Source: "00000000-00001512.00000000.67840.00E5C000.00000002.mdmp") Found reference to API (Indicator: "CreateCompatibleDC"; Source: "00000000-00001512.00000000.67840.00E5C000.00000002.mdmp") Found reference to API (Indicator: "SelectObject"; Source: "00000000-00001512.00000000.67840.00E5C000.00000002.mdmp") Found reference to API (Indicator: "StretchBlt"; Source: "00000000-00001512.00000000.67840.00E5C000.00000002.mdmp") Found reference to API (Indicator: "GetDIBits"; Source: "00000000-00001512.00000000.67840.00E5C000.00000002.mdmp") Found reference to API (Indicator: "DeleteDC"; Source: "00000000-00001512.00000000.67840.00E5C000.00000002.mdmp") Found reference to API (Indicator: "GetStockObject"; Source: "00000000-00001512.00000000.67840.00E5C000.00000002.mdmp") Found reference to API (Indicator: "CreateSolidBrush"; Source: "00000000-00001512.00000000.67840.00E5C000.00000002.mdmp") Found reference to API (Indicator: "RoundRect"; Source: "00000000-00001512.00000000.67840.00E5C000.00000002.mdmp") Found reference to API (Indicator: "GetObjectW"; Source: "00000000-00001512.00000000.67840.00E5C000.00000002.mdmp") Found reference to API (Indicator: "GetOpenFileNameW"; Source: "00000000-00001512.00000000.67840.00E5C000.00000002.mdmp") Found reference to API (Indicator: "GetSaveFileNameW"; Source: "00000000-00001512.00000000.67840.00E5C000.00000002.mdmp") Found reference to API (Indicator: "RegOpenKeyExW"; Source: "00000000-00001512.00000000.67840.00E5C000.00000002.mdmp, 00000000-00001512.00000000.67840.6B260000.00000002.mdmp") Found reference to API (Indicator: "RegCloseKey"; Source: "00000000-00001512.00000000.67840.00E5C000.00000002.mdmp, 00000000-00001512.00000000.67840.6B260000.00000002.mdmp") Found reference to API (Indicator: "RegQueryValueExW"; Source: "00000000-00001512.00000000.67840.00E5C000.00000002.mdmp, 00000000-00001512.00000000.67840.6B260000.00000002.mdmp") Found reference to API (Indicator: "RegConnectRegistryW"; Source: "00000000-00001512.00000000.67840.00E5C000.00000002.mdmp") Found reference to API (Indicator: "InitializeSecurityDescriptor"; Source: "00000000-00001512.00000000.67840.00E5C000.00000002.mdmp") Found reference to API (Indicator: "InitializeAcl"; Source: "00000000-00001512.00000000.67840.00E5C000.00000002.mdmp") Found reference to API (Indicator: "AdjustTokenPrivileges"; Source: "00000000-00001512.00000000.67840.00E5C000.00000002.mdmp") Found reference to API (Indicator: "OpenThreadToken"; Source: "00000000-00001512.00000000.67840.00E5C000.00000002.mdmp") Found reference to API (Indicator: "OpenProcessToken"; Source: "00000000-00001512.00000000.67840.00E5C000.00000002.mdmp") Found reference to API (Indicator: "LookupPrivilegeValueW"; Source: "00000000-00001512.00000000.67840.00E5C000.00000002.mdmp") Found reference to API (Indicator: "DuplicateTokenEx"; Source: "00000000-00001512.00000000.67840.00E5C000.00000002.mdmp") Found reference to API (Indicator: "CreateProcessAsUserW"; Source: "00000000-00001512.00000000.67840.00E5C000.00000002.mdmp") Found reference to API (Indicator: "CreateProcessWithLogonW"; Source: "00000000-00001512.00000000.67840.00E5C000.00000002.mdmp") Found reference to API (Indicator: "GetLengthSid"; Source: "00000000-00001512.00000000.67840.00E5C000.00000002.mdmp") Found reference to API (Indicator: "CopySid"; Source: "00000000-00001512.00000000.67840.00E5C000.00000002.mdmp") Found reference to API (Indicator: "LogonUserW"; Source: "00000000-00001512.00000000.67840.00E5C000.00000002.mdmp") Found reference to API (Indicator: "AllocateAndInitializeSid"; Source: "00000000-00001512.00000000.67840.00E5C000.00000002.mdmp") Found reference to API (Indicator: "CheckTokenMembership"; Source: "00000000-00001512.00000000.67840.00E5C000.00000002.mdmp") Found reference to API (Indicator: "FreeSid"; Source: "00000000-00001512.00000000.67840.00E5C000.00000002.mdmp") Found reference to API (Indicator: "GetTokenInformation"; Source: "00000000-00001512.00000000.67840.00E5C000.00000002.mdmp") Found reference to API (Indicator: "GetSecurityDescriptorDacl"; Source: "00000000-00001512.00000000.67840.00E5C000.00000002.mdmp, 00000000-00001512.00000000.67840.6B260000.00000002.mdmp") Found reference to API (Indicator: "GetAclInformation"; Source: "00000000-00001512.00000000.67840.00E5C000.00000002.mdmp") Found reference to API (Indicator: "GetAce"; Source: "00000000-00001512.00000000.67840.00E5C000.00000002.mdmp, 00000000-00001512.00000000.67840.6B260000.00000002.mdmp") Found reference to API (Indicator: "AddAce"; Source: "00000000-00001512.00000000.67840.00E5C000.00000002.mdmp") Found reference to API (Indicator: "SetSecurityDescriptorDacl"; Source: "00000000-00001512.00000000.67840.00E5C000.00000002.mdmp") Found reference to API (Indicator: "GetUserNameW"; Source: "00000000-00001512.00000000.67840.00E5C000.00000002.mdmp") Found reference to API (Indicator: "RegCreateKeyExW"; Source: "00000000-00001512.00000000.67840.00E5C000.00000002.mdmp") Found reference to API (Indicator: "RegSetValueExW"; Source: "00000000-00001512.00000000.67840.00E5C000.00000002.mdmp") Found reference to API (Indicator: "RegEnumKeyExW"; Source: "00000000-00001512.00000000.67840.00E5C000.00000002.mdmp") Found reference to API (Indicator: "RegDeleteKeyW"; Source: "00000000-00001512.00000000.67840.00E5C000.00000002.mdmp") Found reference to API (Indicator: "RegDeleteValueW"; Source: "00000000-00001512.00000000.67840.00E5C000.00000002.mdmp") Found reference to API (Indicator: "RegEnumValueW"; Source: "00000000-00001512.00000000.67840.00E5C000.00000002.mdmp") Found reference to API (Indicator: "ShellExecuteW"; Source: "00000000-00001512.00000000.67840.00E5C000.00000002.mdmp") Found reference to API (Indicator: "Shell_NotifyIconW"; Source: "00000000-00001512.00000000.67840.00E5C000.00000002.mdmp") Found reference to API (Indicator: "SHFileOperationW"; Source: "00000000-00001512.00000000.67840.00E5C000.00000002.mdmp") Found reference to API (Indicator: "SHGetFolderPathW"; Source: "00000000-00001512.00000000.67840.00E5C000.00000002.mdmp") Found reference to API (Indicator: "SHGetSpecialFolderLocation"; Source: "00000000-00001512.00000000.67840.00E5C000.00000002.mdmp") Found reference to API (Indicator: "SHGetDesktopFolder"; Source: "00000000-00001512.00000000.67840.00E5C000.00000002.mdmp") Found reference to API (Indicator: "SHBrowseForFolderW"; Source: "00000000-00001512.00000000.67840.00E5C000.00000002.mdmp") Found reference to API (Indicator: "SHGetPathFromIDListW"; Source: "00000000-00001512.00000000.67840.00E5C000.00000002.mdmp") Found reference to API (Indicator: "ShellExecuteExW"; Source: "00000000-00001512.00000000.67840.00E5C000.00000002.mdmp") Found reference to API (Indicator: "CoTaskMemAlloc"; Source: "00000000-00001512.00000000.67840.00E5C000.00000002.mdmp") Found reference to API (Indicator: "CoTaskMemFree"; Source: "00000000-00001512.00000000.67840.00E5C000.00000002.mdmp, 00000000-00001512.00000000.67840.6B221000.00000020.mdmp") Found reference to API (Indicator: "CLSIDFromString"; Source: "00000000-00001512.00000000.67840.00E5C000.00000002.mdmp") Found reference to API (Indicator: "ProgIDFromCLSID"; Source: "00000000-00001512.00000000.67840.00E5C000.00000002.mdmp") Found reference to API (Indicator: "OleSetMenuDescriptor"; Source: "00000000-00001512.00000000.67840.00E5C000.00000002.mdmp") Found reference to API (Indicator: "CoCreateInstance"; Source: "00000000-00001512.00000000.67840.00E5C000.00000002.mdmp, 00000000-00001512.00000000.67840.6B221000.00000020.mdmp") Found reference to API (Indicator: "IIDFromString"; Source: "00000000-00001512.00000000.67840.00E5C000.00000002.mdmp") Found reference to API (Indicator: "StringFromGUID2"; Source: "00000000-00001512.00000000.67840.00E5C000.00000002.mdmp") Found reference to API (Indicator: "CreateStreamOnHGlobal"; Source: "00000000-00001512.00000000.67840.00E5C000.00000002.mdmp") Found reference to API (Indicator: "OleInitialize"; Source: "00000000-00001512.00000000.67840.00E5C000.00000002.mdmp") Found reference to API (Indicator: "OleUninitialize"; Source: "00000000-00001512.00000000.67840.00E5C000.00000002.mdmp") Found reference to API (Indicator: "CoInitialize"; Source: "00000000-00001512.00000000.67840.00E5C000.00000002.mdmp") Found reference to API (Indicator: "CoUninitialize"; Source: "00000000-00001512.00000000.67840.00E5C000.00000002.mdmp") Found reference to API (Indicator: "CoGetObject"; Source: "00000000-00001512.00000000.67840.00E5C000.00000002.mdmp") Found reference to API (Indicator: "CoInitializeSecurity"; Source: "00000000-00001512.00000000.67840.00E5C000.00000002.mdmp") Found reference to API (Indicator: "ResetEvent"; Source: "00000000-00001512.00000000.67840.00E5C000.00000002.mdmp") Found reference to API (Indicator: "WaitForSingleObjectEx"; Source: "00000000-00001512.00000000.67840.00E5C000.00000002.mdmp") Found reference to API (Indicator: "IsProcessorFeaturePresent"; Source: "00000000-00001512.00000000.67840.00E5C000.00000002.mdmp") Found reference to API (Indicator: "UnhandledExceptionFilter"; Source: "00000000-00001512.00000000.67840.00E5C000.00000002.mdmp, 00000000-00001512.00000000.67840.6B260000.00000002.mdmp") Found reference to API (Indicator: "SetUnhandledExceptionFilter"; Source: "00000000-00001512.00000000.67840.00E5C000.00000002.mdmp, 00000000-00001512.00000000.67840.6B260000.00000002.mdmp") Found reference to API (Indicator: "GetStartupInfoW"; Source: "00000000-00001512.00000000.67840.00E5C000.00000002.mdmp") Found reference to API (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00001512.00000000.67840.00E5C000.00000002.mdmp, 00000000-00001512.00000000.67840.6B260000.00000002.mdmp") Found reference to API (Indicator: "InitializeSListHead"; Source: "00000000-00001512.00000000.67840.00E5C000.00000002.mdmp") Found reference to API (Indicator: "RtlUnwind"; Source: "00000000-00001512.00000000.67840.00E5C000.00000002.mdmp") Found reference to API (Indicator: "SetLastError"; Source: "00000000-00001512.00000000.67840.00E5C000.00000002.mdmp") Found reference to API (Indicator: "TlsAlloc"; Source: "00000000-00001512.00000000.67840.00E5C000.00000002.mdmp") Found reference to API (Indicator: "TlsGetValue"; Source: "00000000-00001512.00000000.67840.00E5C000.00000002.mdmp") Found reference to API (Indicator: "TlsSetValue"; Source: "00000000-00001512.00000000.67840.00E5C000.00000002.mdmp") Found reference to API (Indicator: "TlsFree"; Source: "00000000-00001512.00000000.67840.00E5C000.00000002.mdmp") Found reference to API (Indicator: "EncodePointer"; Source: "00000000-00001512.00000000.67840.00E5C000.00000002.mdmp") Found reference to API (Indicator: "ExitProcess"; Source: "00000000-00001512.00000000.67840.00E5C000.00000002.mdmp") Found reference to API (Indicator: "ExitThread"; Source: "00000000-00001512.00000000.67840.00E5C000.00000002.mdmp") Found reference to API (Indicator: "ResumeThread"; Source: "00000000-00001512.00000000.67840.00E5C000.00000002.mdmp") Found reference to API (Indicator: "FreeLibraryAndExitThread"; Source: "00000000-00001512.00000000.67840.00E5C000.00000002.mdmp") Found reference to API (Indicator: "GetACP"; Source: "00000000-00001512.00000000.67840.00E5C000.00000002.mdmp") Found reference to API (Indicator: "GetDateFormatW"; Source: "00000000-00001512.00000000.67840.00E5C000.00000002.mdmp") Found reference to API (Indicator: "GetTimeFormatW"; Source: "00000000-00001512.00000000.67840.00E5C000.00000002.mdmp") Found reference to API (Indicator: "LCMapStringW"; Source: "00000000-00001512.00000000.67840.00E5C000.00000002.mdmp") Found reference to API (Indicator: "GetStringTypeW"; Source: "00000000-00001512.00000000.67840.00E5C000.00000002.mdmp") Found reference to API (Indicator: "GetFileType"; Source: "00000000-00001512.00000000.67840.00E5C000.00000002.mdmp") Found reference to API (Indicator: "SetStdHandle"; Source: "00000000-00001512.00000000.67840.00E5C000.00000002.mdmp") Found reference to API (Indicator: "GetConsoleCP"; Source: "00000000-00001512.00000000.67840.00E5C000.00000002.mdmp") Found reference to API (Indicator: "GetConsoleMode"; Source: "00000000-00001512.00000000.67840.00E5C000.00000002.mdmp") Found reference to API (Indicator: "ReadConsoleW"; Source: "00000000-00001512.00000000.67840.00E5C000.00000002.mdmp") Found reference to API (Indicator: "GetTimeZoneInformation"; Source: "00000000-00001512.00000000.67840.00E5C000.00000002.mdmp") Found reference to API (Indicator: "FindFirstFileExW"; Source: "00000000-00001512.00000000.67840.00E5C000.00000002.mdmp") Found reference to API (Indicator: "IsValidCodePage"; Source: "00000000-00001512.00000000.67840.00E5C000.00000002.mdmp") Found reference to API (Indicator: "GetOEMCP"; Source: "00000000-00001512.00000000.67840.00E5C000.00000002.mdmp") Found reference to API (Indicator: "GetCPInfo"; Source: "00000000-00001512.00000000.67840.00E5C000.00000002.mdmp") Found reference to API (Indicator: "GetCommandLineA"; Source: "00000000-00001512.00000000.67840.00E5C000.00000002.mdmp") Found reference to API (Indicator: "GetCommandLineW"; Source: "00000000-00001512.00000000.67840.00E5C000.00000002.mdmp") Found reference to API (Indicator: "GetEnvironmentStringsW"; Source: "00000000-00001512.00000000.67840.00E5C000.00000002.mdmp") Found reference to API (Indicator: "FreeEnvironmentStringsW"; Source: "00000000-00001512.00000000.67840.00E5C000.00000002.mdmp") Found reference to API (Indicator: "SetEnvironmentVariableA"; Source: "00000000-00001512.00000000.67840.00E5C000.00000002.mdmp") Found reference to API (Indicator: "WriteConsoleW"; Source: "00000000-00001512.00000000.67840.00E5C000.00000002.mdmp") Found reference to API (Indicator: "CoMarshalInterface"; Source: "00000000-00001512.00000000.67840.6B221000.00000020.mdmp") Found reference to API (Indicator: "CoTaskMemRealloc"; Source: "00000000-00001512.00000000.67840.6B221000.00000020.mdmp") Found reference to API (Indicator: "GetObjectA"; Source: "00000000-00001512.00000000.67840.6B221000.00000020.mdmp") Found reference to API (Indicator: "CompareStringOrdinal"; Source: "00000000-00001512.00000000.67840.6B260000.00000002.mdmp") Found reference to API (Indicator: "DelayLoadFailureHook"; Source: "00000000-00001512.00000000.67840.6B260000.00000002.mdmp") Found reference to API (Indicator: "LoadLibraryExA"; Source: "00000000-00001512.00000000.67840.6B260000.00000002.mdmp") Found reference to API (Indicator: "DisableThreadLibraryCalls"; Source: "00000000-00001512.00000000.67840.6B260000.00000002.mdmp") Found reference to API (Indicator: "GetLocaleInfoEx"; Source: "00000000-00001512.00000000.67840.6B260000.00000002.mdmp") Found reference to API (Indicator: "GetTickCount"; Source: "00000000-00001512.00000000.67840.6B260000.00000002.mdmp") Found reference to API (Indicator: "RegGetValueW"; Source: "00000000-00001512.00000000.67840.6B260000.00000002.mdmp") Found reference to API (Indicator: "GetFinalPathNameByHandleW"; Source: "00000000-00001512.00000000.67840.6B260000.00000002.mdmp") Found reference to API (Indicator: "LocalFree"; Source: "00000000-00001512.00000000.67840.6B260000.00000002.mdmp") Found reference to API (Indicator: "LocalAlloc"; Source: "00000000-00001512.00000000.67840.6B260000.00000002.mdmp") Found reference to API (Indicator: "GetVersionExA"; Source: "00000000-00001512.00000000.67840.6B260000.00000002.mdmp") Found reference to API (Indicator: "GlobalSize"; Source: "00000000-00001512.00000000.67840.6B260000.00000002.mdmp") Found reference to API (Indicator: "RpcRaiseException"; Source: "00000000-00001512.00000000.67840.6B260000.00000002.mdmp") Found reference to API (Indicator: "NdrStubCall2"; Source: "00000000-00001512.00000000.67840.6B260000.00000002.mdmp") Found reference to API (Indicator: "NdrClientCall2"; Source: "00000000-00001512.00000000.67840.6B260000.00000002.mdmp") Found reference to API (Indicator: "NdrOleFree"; Source: "00000000-00001512.00000000.67840.6B260000.00000002.mdmp") Found reference to API (Indicator: "NdrGetUserMarshalInfo"; Source: "00000000-00001512.00000000.67840.6B260000.00000002.mdmp") Found reference to API (Indicator: "NdrOleAllocate"; Source: "00000000-00001512.00000000.67840.6B260000.00000002.mdmp") Found reference to API (Indicator: "GetSidSubAuthorityCount"; Source: "00000000-00001512.00000000.67840.6B260000.00000002.mdmp") Found reference to API (Indicator: "GetSidIdentifierAuthority"; Source: "00000000-00001512.00000000.67840.6B260000.00000002.mdmp") Found reference to API (Indicator: "GetSidSubAuthority"; Source: "00000000-00001512.00000000.67840.6B260000.00000002.mdmp") Found reference to API (Indicator: "GetKernelObjectSecurity"; Source: "00000000-00001512.00000000.67840.6B260000.00000002.mdmp") Found reference to API (Indicator: "CheckTokenMembership"; Source: "00000000-00001616.00000002.68025.00271000.00000020.mdmp") Found reference to API (Indicator: "HeapSetInformation"; Source: "00000000-00001616.00000002.68025.00271000.00000020.mdmp") Found reference to API (Indicator: "DecryptFileA"; Source: "00000000-00001616.00000002.68025.00271000.00000020.mdmp") Found reference to API (Indicator: "CheckTokenMembership"; Source: "00000000-00002516.00000000.65984.008F1000.00000020.mdmp") Found reference to API (Indicator: "HeapSetInformation"; Source: "00000000-00002516.00000000.65984.008F1000.00000020.mdmp") Found reference to API (Indicator: "DecryptFileA"; Source: "00000000-00002516.00000000.65984.008F1000.00000020.mdmp") Found reference to API (Indicator: "GetTokenInformation"; Source: "00000000-00002516.00000001.67151.008FA000.00000002.mdmp") Found reference to API (Indicator: "RegDeleteValueA"; Source: "00000000-00002516.00000001.67151.008FA000.00000002.mdmp") Found reference to API (Indicator: "RegOpenKeyExA"; Source: "00000000-00002516.00000001.67151.008FA000.00000002.mdmp") Found reference to API (Indicator: "RegQueryInfoKeyA"; Source: "00000000-00002516.00000001.67151.008FA000.00000002.mdmp") Found reference to API (Indicator: "FreeSid"; Source: "00000000-00002516.00000001.67151.008FA000.00000002.mdmp") Found reference to API (Indicator: "OpenProcessToken"; Source: "00000000-00002516.00000001.67151.008FA000.00000002.mdmp") Found reference to API (Indicator: "RegSetValueExA"; Source: "00000000-00002516.00000001.67151.008FA000.00000002.mdmp") Found reference to API (Indicator: "RegCreateKeyExA"; Source: "00000000-00002516.00000001.67151.008FA000.00000002.mdmp") Found reference to API (Indicator: "LookupPrivilegeValueA"; Source: "00000000-00002516.00000001.67151.008FA000.00000002.mdmp") Found reference to API (Indicator: "AllocateAndInitializeSid"; Source: "00000000-00002516.00000001.67151.008FA000.00000002.mdmp") Found reference to API (Indicator: "RegQueryValueExA"; Source: "00000000-00002516.00000001.67151.008FA000.00000002.mdmp") Found reference to API (Indicator: "EqualSid"; Source: "00000000-00002516.00000001.67151.008FA000.00000002.mdmp") Found reference to API (Indicator: "RegCloseKey"; Source: "00000000-00002516.00000001.67151.008FA000.00000002.mdmp") Found reference to API (Indicator: "AdjustTokenPrivileges"; Source: "00000000-00002516.00000001.67151.008FA000.00000002.mdmp") Found reference to API (Indicator: "GetShortPathNameA"; Source: "00000000-00002516.00000001.67151.008FA000.00000002.mdmp") Found reference to API (Indicator: "GetModuleFileNameA"; Source: "00000000-00002516.00000001.67151.008FA000.00000002.mdmp") Found reference to API (Indicator: "FindFirstFileA"; Source: "00000000-00002516.00000001.67151.008FA000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcess"; Source: "00000000-00002516.00000001.67151.008FA000.00000002.mdmp") Found reference to API (Indicator: "FindNextFileA"; Source: "00000000-00002516.00000001.67151.008FA000.00000002.mdmp") Found reference to API (Indicator: "ExpandEnvironmentStringsA"; Source: "00000000-00002516.00000001.67151.008FA000.00000002.mdmp") Found reference to API (Indicator: "FindClose"; Source: "00000000-00002516.00000001.67151.008FA000.00000002.mdmp") Found reference to API (Indicator: "LocalAlloc"; Source: "00000000-00002516.00000001.67151.008FA000.00000002.mdmp") Found reference to API (Indicator: "lstrcmpA"; Source: "00000000-00002516.00000001.67151.008FA000.00000002.mdmp") Found reference to API (Indicator: "CompareStringA"; Source: "00000000-00002516.00000001.67151.008FA000.00000002.mdmp") Found reference to API (Indicator: "GetLastError"; Source: "00000000-00002516.00000001.67151.008FA000.00000002.mdmp") Found reference to API (Indicator: "GetFileAttributesA"; Source: "00000000-00002516.00000001.67151.008FA000.00000002.mdmp") Found reference to API (Indicator: "GetSystemDirectoryA"; Source: "00000000-00002516.00000001.67151.008FA000.00000002.mdmp") Found reference to API (Indicator: "LoadLibraryA"; Source: "00000000-00002516.00000001.67151.008FA000.00000002.mdmp") Found reference to API (Indicator: "DeleteFileA"; Source: "00000000-00002516.00000001.67151.008FA000.00000002.mdmp") Found reference to API (Indicator: "GlobalAlloc"; Source: "00000000-00002516.00000001.67151.008FA000.00000002.mdmp") Found reference to API (Indicator: "GlobalFree"; Source: "00000000-00002516.00000001.67151.008FA000.00000002.mdmp") Found reference to API (Indicator: "CloseHandle"; Source: "00000000-00002516.00000001.67151.008FA000.00000002.mdmp") Found reference to API (Indicator: "WritePrivateProfileStringA"; Source: "00000000-00002516.00000001.67151.008FA000.00000002.mdmp") Found reference to API (Indicator: "IsDBCSLeadByte"; Source: "00000000-00002516.00000001.67151.008FA000.00000002.mdmp") Found reference to API (Indicator: "GetWindowsDirectoryA"; Source: "00000000-00002516.00000001.67151.008FA000.00000002.mdmp") Found reference to API (Indicator: "SetFileAttributesA"; Source: "00000000-00002516.00000001.67151.008FA000.00000002.mdmp") Found reference to API (Indicator: "GetProcAddress"; Source: "00000000-00002516.00000001.67151.008FA000.00000002.mdmp") Found reference to API (Indicator: "GlobalLock"; Source: "00000000-00002516.00000001.67151.008FA000.00000002.mdmp") Found reference to API (Indicator: "LocalFree"; Source: "00000000-00002516.00000001.67151.008FA000.00000002.mdmp") Found reference to API (Indicator: "RemoveDirectoryA"; Source: "00000000-00002516.00000001.67151.008FA000.00000002.mdmp") Found reference to API (Indicator: "FreeLibrary"; Source: "00000000-00002516.00000001.67151.008FA000.00000002.mdmp") Found reference to API (Indicator: "CreateDirectoryA"; Source: "00000000-00002516.00000001.67151.008FA000.00000002.mdmp") Found reference to API (Indicator: "GetPrivateProfileIntA"; Source: "00000000-00002516.00000001.67151.008FA000.00000002.mdmp") Found reference to API (Indicator: "GetPrivateProfileStringA"; Source: "00000000-00002516.00000001.67151.008FA000.00000002.mdmp") Found reference to API (Indicator: "GlobalUnlock"; Source: "00000000-00002516.00000001.67151.008FA000.00000002.mdmp") Found reference to API (Indicator: "ReadFile"; Source: "00000000-00002516.00000001.67151.008FA000.00000002.mdmp") Found reference to API (Indicator: "SizeofResource"; Source: "00000000-00002516.00000001.67151.008FA000.00000002.mdmp") Found reference to API (Indicator: "WriteFile"; Source: "00000000-00002516.00000001.67151.008FA000.00000002.mdmp") Found reference to API (Indicator: "GetDriveTypeA"; Source: "00000000-00002516.00000001.67151.008FA000.00000002.mdmp") Found reference to API (Indicator: "LoadLibraryExA"; Source: "00000000-00002516.00000001.67151.008FA000.00000002.mdmp") Found reference to API (Indicator: "SetFileTime"; Source: "00000000-00002516.00000001.67151.008FA000.00000002.mdmp") Found reference to API (Indicator: "SetFilePointer"; Source: "00000000-00002516.00000001.67151.008FA000.00000002.mdmp") Found reference to API (Indicator: "FindResourceA"; Source: "00000000-00002516.00000001.67151.008FA000.00000002.mdmp") Found reference to API (Indicator: "CreateMutexA"; Source: "00000000-00002516.00000001.67151.008FA000.00000002.mdmp") Found reference to API (Indicator: "GetVolumeInformationA"; Source: "00000000-00002516.00000001.67151.008FA000.00000002.mdmp") Found reference to API (Indicator: "WaitForSingleObject"; Source: "00000000-00002516.00000001.67151.008FA000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentDirectoryA"; Source: "00000000-00002516.00000001.67151.008FA000.00000002.mdmp") Found reference to API (Indicator: "FreeResource"; Source: "00000000-00002516.00000001.67151.008FA000.00000002.mdmp") Found reference to API (Indicator: "GetVersion"; Source: "00000000-00002516.00000001.67151.008FA000.00000002.mdmp") Found reference to API (Indicator: "SetCurrentDirectoryA"; Source: "00000000-00002516.00000001.67151.008FA000.00000002.mdmp") Found reference to API (Indicator: "GetTempPathA"; Source: "00000000-00002516.00000001.67151.008FA000.00000002.mdmp") Found reference to API (Indicator: "LocalFileTimeToFileTime"; Source: "00000000-00002516.00000001.67151.008FA000.00000002.mdmp") Found reference to API (Indicator: "CreateFileA"; Source: "00000000-00002516.00000001.67151.008FA000.00000002.mdmp") Found reference to API (Indicator: "SetEvent"; Source: "00000000-00002516.00000001.67151.008FA000.00000002.mdmp") Found reference to API (Indicator: "TerminateThread"; Source: "00000000-00002516.00000001.67151.008FA000.00000002.mdmp") Found reference to API (Indicator: "GetVersionExA"; Source: "00000000-00002516.00000001.67151.008FA000.00000002.mdmp") Found reference to API (Indicator: "LockResource"; Source: "00000000-00002516.00000001.67151.008FA000.00000002.mdmp") Found reference to API (Indicator: "GetSystemInfo"; Source: "00000000-00002516.00000001.67151.008FA000.00000002.mdmp") Found reference to API (Indicator: "CreateThread"; Source: "00000000-00002516.00000001.67151.008FA000.00000002.mdmp") Found reference to API (Indicator: "ResetEvent"; Source: "00000000-00002516.00000001.67151.008FA000.00000002.mdmp") Found reference to API (Indicator: "LoadResource"; Source: "00000000-00002516.00000001.67151.008FA000.00000002.mdmp") Found reference to API (Indicator: "ExitProcess"; Source: "00000000-00002516.00000001.67151.008FA000.00000002.mdmp") Found reference to API (Indicator: "GetModuleHandleW"; Source: "00000000-00002516.00000001.67151.008FA000.00000002.mdmp") Found reference to API (Indicator: "CreateProcessA"; Source: "00000000-00002516.00000001.67151.008FA000.00000002.mdmp") Found reference to API (Indicator: "FormatMessageA"; Source: "00000000-00002516.00000001.67151.008FA000.00000002.mdmp") Found reference to API (Indicator: "GetTempFileNameA"; Source: "00000000-00002516.00000001.67151.008FA000.00000002.mdmp") Found reference to API (Indicator: "DosDateTimeToFileTime"; Source: "00000000-00002516.00000001.67151.008FA000.00000002.mdmp") Found reference to API (Indicator: "CreateEventA"; Source: "00000000-00002516.00000001.67151.008FA000.00000002.mdmp") Found reference to API (Indicator: "GetExitCodeProcess"; Source: "00000000-00002516.00000001.67151.008FA000.00000002.mdmp") Found reference to API (Indicator: "GetDeviceCaps"; Source: "00000000-00002516.00000001.67151.008FA000.00000002.mdmp") Found reference to API (Indicator: "GetDesktopWindow"; Source: "00000000-00002516.00000001.67151.008FA000.00000002.mdmp") Found reference to API (Indicator: "CharUpperA"; Source: "00000000-00002516.00000001.67151.008FA000.00000002.mdmp") Found reference to API (Indicator: "ExitWindowsEx"; Source: "00000000-00002516.00000001.67151.008FA000.00000002.mdmp") Found reference to API (Indicator: "MessageBeep"; Source: "00000000-00002516.00000001.67151.008FA000.00000002.mdmp") Found reference to API (Indicator: "CharPrevA"; Source: "00000000-00002516.00000001.67151.008FA000.00000002.mdmp") Found reference to API (Indicator: "LoadStringA"; Source: "00000000-00002516.00000001.67151.008FA000.00000002.mdmp") Found reference to API (Indicator: "CharNextA"; Source: "00000000-00002516.00000001.67151.008FA000.00000002.mdmp") Found reference to API (Indicator: "EnableWindow"; Source: "00000000-00002516.00000001.67151.008FA000.00000002.mdmp") Found reference to API (Indicator: "ReleaseDC"; Source: "00000000-00002516.00000001.67151.008FA000.00000002.mdmp") Found reference to API (Indicator: "SetForegroundWindow"; Source: "00000000-00002516.00000001.67151.008FA000.00000002.mdmp") Found reference to API (Indicator: "PeekMessageA"; Source: "00000000-00002516.00000001.67151.008FA000.00000002.mdmp") Found reference to API (Indicator: "SendMessageA"; Source: "00000000-00002516.00000001.67151.008FA000.00000002.mdmp") Found reference to API (Indicator: "MessageBoxA"; Source: "00000000-00002516.00000001.67151.008FA000.00000002.mdmp") Found reference to API (Indicator: "SetWindowTextA"; Source: "00000000-00002516.00000001.67151.008FA000.00000002.mdmp") Found reference to API (Indicator: "GetWindowLongA"; Source: "00000000-00002516.00000001.67151.008FA000.00000002.mdmp") Found reference to API (Indicator: "CallWindowProcA"; Source: "00000000-00002516.00000001.67151.008FA000.00000002.mdmp") Found reference to API (Indicator: "SetWindowLongA"; Source: "00000000-00002516.00000001.67151.008FA000.00000002.mdmp") Found reference to API (Indicator: "ShowWindow"; Source: "00000000-00002516.00000001.67151.008FA000.00000002.mdmp") Found reference to API (Indicator: "MsgWaitForMultipleObjects"; Source: "00000000-00002516.00000001.67151.008FA000.00000002.mdmp") Found reference to API (Indicator: "SetWindowPos"; Source: "00000000-00002516.00000001.67151.008FA000.00000002.mdmp") Found reference to API (Indicator: "GetDC"; Source: "00000000-00002516.00000001.67151.008FA000.00000002.mdmp") Found reference to API (Indicator: "GetWindowRect"; Source: "00000000-00002516.00000001.67151.008FA000.00000002.mdmp") Found reference to API (Indicator: "DispatchMessageA"; Source: "00000000-00002516.00000001.67151.008FA000.00000002.mdmp") Found reference to API (Indicator: "GetFileVersionInfoSizeA"; Source: "00000000-00002516.00000001.67151.008FA000.00000002.mdmp") Found reference to API (Indicator: "VerQueryValueA"; Source: "00000000-00002516.00000001.67151.008FA000.00000002.mdmp") Found reference to API (Indicator: "GetFileVersionInfoA"; Source: "00000000-00002516.00000001.67151.008FA000.00000002.mdmp") Found reference to API (Indicator: "Sleep"; Source: "00000000-00002516.00000001.67151.008FA000.00000002.mdmp") Found reference to API (Indicator: "GetStartupInfoW"; Source: "00000000-00002516.00000001.67151.008FA000.00000002.mdmp") Found reference to API (Indicator: "UnhandledExceptionFilter"; Source: "00000000-00002516.00000001.67151.008FA000.00000002.mdmp") Found reference to API (Indicator: "SetUnhandledExceptionFilter"; Source: "00000000-00002516.00000001.67151.008FA000.00000002.mdmp") Found reference to API (Indicator: "TerminateProcess"; Source: "00000000-00002516.00000001.67151.008FA000.00000002.mdmp") Found reference to API (Indicator: "QueryPerformanceCounter"; Source: "00000000-00002516.00000001.67151.008FA000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcessId"; Source: "00000000-00002516.00000001.67151.008FA000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentThreadId"; Source: "00000000-00002516.00000001.67151.008FA000.00000002.mdmp") Found reference to API (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00002516.00000001.67151.008FA000.00000002.mdmp") Found reference to API (Indicator: "GetTickCount"; Source: "00000000-00002516.00000001.67151.008FA000.00000002.mdmp") Found reference to API (Indicator: "EnumResourceLanguagesA"; Source: "00000000-00002516.00000001.67151.008FA000.00000002.mdmp") Found reference to API (Indicator: "GetDiskFreeSpaceA"; Source: "00000000-00002516.00000001.67151.008FA000.00000002.mdmp") Found reference to API (Indicator: "MulDiv"; Source: "00000000-00002516.00000001.67151.008FA000.00000002.mdmp") Found reference to API (Indicator: "GetSystemMetrics"; Source: "00000000-00002516.00000001.67151.008FA000.00000002.mdmp")3b:T7be,Found reference to API "SizeofResource" (Indicator: "SizeofResource"; File: "afa6fbd86c448bceaf510ae6f8b831be.exe") Found reference to API "FindResourceA" (Indicator: "FindResource"; File: "afa6fbd86c448bceaf510ae6f8b831be.exe") Found reference to API "FreeResource" (Indicator: "FreeResource"; File: "afa6fbd86c448bceaf510ae6f8b831be.exe") Found reference to API "LockResource" (Indicator: "LockResource"; File: "afa6fbd86c448bceaf510ae6f8b831be.exe") Found reference to API "LoadResource" (Indicator: "LoadResource"; File: "afa6fbd86c448bceaf510ae6f8b831be.exe") Found reference to API "LoadResource" (Indicator: "LoadResource"; Source: "00000000-00001512.00000000.67840.00E5C000.00000002.mdmp") Found reference to API "LockResource" (Indicator: "LockResource"; Source: "00000000-00001512.00000000.67840.00E5C000.00000002.mdmp") Found reference to API "SizeofResource" (Indicator: "SizeofResource"; Source: "00000000-00001512.00000000.67840.00E5C000.00000002.mdmp") Found reference to API "FindResourceExW" (Indicator: "FindResource"; Source: "00000000-00001512.00000000.67840.00E5C000.00000002.mdmp") Found reference to API "18015062777,3112,3135,,LoadResource,kernel32.dll,"252:03:14.978",RX=0,PX=0" (Indicator: "LoadResource"; Source: "00000000-00001512.00000001.68017.005F6000.00000004.mdmp") Found reference to API "SizeofResource" (Indicator: "SizeofResource"; Source: "00000000-00002516.00000001.67151.008FA000.00000002.mdmp") Found reference to API "FindResourceA" (Indicator: "FindResource"; Source: "00000000-00002516.00000001.67151.008FA000.00000002.mdmp") Found reference to API "FreeResource" (Indicator: "FreeResource"; Source: "00000000-00002516.00000001.67151.008FA000.00000002.mdmp") Found reference to API "LockResource" (Indicator: "LockResource"; Source: "00000000-00002516.00000001.67151.008FA000.00000002.mdmp") Found reference to API "LoadResource" (Indicator: "LoadResource"; Source: "00000000-00002516.00000001.67151.008FA000.00000002.mdmp")3c:T907,"Software\Microsoft\Windows\CurrentVersion\App Paths" in Source: afa6fbd86c448bceaf510ae6f8b831be.exe "DSystem\CurrentControlSet\Control\Session Manager" in Source: afa6fbd86c448bceaf510ae6f8b831be.exe "Software\Microsoft\Windows\CurrentVersion\RunOnce" in Source: afa6fbd86c448bceaf510ae6f8b831be.exe "System\CurrentControlSet\Control\Session Manager\FileRenameOperations" in Source: afa6fbd86c448bceaf510ae6f8b831be.exe "System\CurrentControlSet\Control\Session Manager" in Source: 32043-17-0040256D "Software\Policies\Microsoft\Internet Explorer\TabbedBrowsing" in Source: 00000000-00001512.00000000.67840.005A0000.00000004.mdmp 00000000-00001512.00000001.68017.005F6000.00000004.mdmp "Software\Policies\Microsoft\Internet Explorer\Main" in Source: 00000000-00001512.00000000.67840.005A0000.00000004.mdmp 00000000-00001512.00000001.68017.005F6000.00000004.mdmp "ISTRY\USER\S-1-5-21-2092356043-4041700817-663127204-1001\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Layers" in Source: 00000000-00001512.00000000.67840.005A0000.00000004.mdmp "Software\AutoIt v3\AutoIt" in Source: 00000000-00001512.00000000.67840.00E5C000.00000002.mdmp "SOFTWARE\Classes\" in Source: 00000000-00001512.00000000.67840.00E5C000.00000002.mdmp "SYSTEM\CurrentControlSet\Control\Nls\Language" in Source: 00000000-00001512.00000000.67840.00E5C000.00000002.mdmp "ISTRY\USER\S-1-5-21-2092356043-4041700817-663127204-1001\Software\Microsoft\Windows" in Source: 00000000-00001512.00000001.68017.005F6000.00000004.mdmp "ISTRY\USER\S-1-5-21-2092356043-4041700817-663127204-1001\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags" in Source: 00000000-00001616.00000000.65913.00600000.00000004.mdmp 00000000-00001616.00000001.67833.00600000.00000004.mdmp 00000000-00001616.00000002.68025.00600000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\App Paths" in Source: 00000000-00001616.00000002.68025.00271000.00000020.mdmp "REGISTRY\USER\S-1-5-21-2092356043-4041700817-663127204-1001\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags" in Source: 00000000-00002516.00000000.65984.00160000.00000004.mdmp 00000000-00002516.00000001.67151.00160000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\App Paths" in Source: 00000000-00002516.00000000.65984.008F1000.00000020.mdmp3d:Tb4f,"afa6fbd86c448bceaf510ae6f8b831be.exe" failed to load missing module "api-ms-win-core-fibers-l1-1-1" - [base:0; Status:c0000135] "afa6fbd86c448bceaf510ae6f8b831be.exe" failed to load missing module "api-ms-win-core-localization-l1-2-1" - [base:0; Status:c0000135] "tB0lu63.exe" failed to load missing module "api-ms-win-core-fibers-l1-1-1" - [base:0; Status:c0000135] "tB0lu63.exe" failed to load missing module "api-ms-win-core-localization-l1-2-1" - [base:0; Status:c0000135] "qP8xB26.exe" failed to load missing module "api-ms-win-core-fibers-l1-1-1" - [base:0; Status:c0000135] "qP8xB26.exe" failed to load missing module "api-ms-win-core-localization-l1-2-1" - [base:0; Status:c0000135] "kX8EH32.exe" failed to load missing module "api-ms-win-core-fibers-l1-1-1" - [base:0; Status:c0000135] "kX8EH32.exe" failed to load missing module "api-ms-win-core-localization-l1-2-1" - [base:0; Status:c0000135] "1yz61bk1.exe" failed to load missing module "api-ms-win-core-fibers-l1-1-1" - [base:0; Status:c0000135] "1yz61bk1.exe" failed to load missing module "api-ms-win-core-localization-l1-2-1" - [base:0; Status:c0000135] "1yz61bk1.exe" failed to load missing module "api-ms-win-core-datetime-l1-1-1" - [base:0; Status:c0000135] "1yz61bk1.exe" failed to load missing module "api-ms-win-core-localization-obsolete-l1-2-0" - [base:0; Status:c0000135] "1yz61bk1.exe" failed to load missing module "api-ms-win-appmodel-runtime-l1-1-2" - [base:0; Status:c0000135] "schtasks.exe" failed to load missing module "api-ms-win-core-fibers-l1-1-1" - [base:0; Status:c0000135] "schtasks.exe" failed to load missing module "api-ms-win-core-localization-l1-2-1" - [base:0; Status:c0000135] "4hV149il.exe" failed to load missing module "api-ms-win-appmodel-runtime-l1-1-2" - [base:0; Status:c0000135] "5eh2lq1.exe" failed to load missing module "api-ms-win-core-fibers-l1-1-1" - [base:0; Status:c0000135] "5eh2lq1.exe" failed to load missing module "api-ms-win-core-localization-l1-2-1" - [base:0; Status:c0000135] "5eh2lq1.exe" failed to load missing module "api-ms-win-appmodel-runtime-l1-1-2" - [base:0; Status:c0000135] "AppLaunch.exe" failed to load missing module "api-ms-win-core-fibers-l1-1-1" - [base:0; Status:c0000135] "AppLaunch.exe" failed to load missing module "api-ms-win-core-localization-l1-2-1" - [base:0; Status:c0000135] "6FR1MW1.exe" failed to load missing module "api-ms-win-core-fibers-l1-1-1" - [base:0; Status:c0000135] "6FR1MW1.exe" failed to load missing module "api-ms-win-core-localization-l1-2-1" - [base:0; Status:c0000135] "6FR1MW1.exe" failed to load missing module "api-ms-win-core-sysinfo-l1-2-1" - [base:0; Status:c0000135] "6FR1MW1.exe" failed to load missing module "api-ms-win-appmodel-runtime-l1-1-1" - [base:0; Status:c0000135] "6FR1MW1.exe" failed to load missing module "ext-ms-win-kernel32-package-current-l1-1-0" - [base:0; Status:c0000135]3e:T70b,Found string "https://www.facebook.com/login" (Indicator: "facebook.com"; File: "afa6fbd86c448bceaf510ae6f8b831be.exe") file/memory contains long string with (Indicator: "facebook.com"; File: "42KJUZJI.txt") file/memory contains long string with (Indicator: "facebook.com"; File: "1SZ3F8UB.txt") file/memory contains long string with (Indicator: "facebook.com"; File: "13S8284S.txt") file/memory contains long string with (Indicator: "facebook.com"; File: "ENSTKLU3.txt") file/memory contains long string with (Indicator: "facebook.com"; File: "YIM1LFAM.txt") file/memory contains long string with (Indicator: "facebook.com"; File: "B7JHZ6R8.txt") Found string "028OKYOjTTwf5RiBz..BldNIM.MC.AAA.0.0.BldNIM.AWVrUBXupFofacebook.com/921727352140803109314583324119231075033DNJ0ZRANmuoFymQq0xtK-7Uhfacebook.com/921742796682243115550683433319431075033" (Indicator: "facebook.com"; File: "905Q0HNZ.txt") Found string "028OKYOjTTwf5RiBz..BldNIM.MC.AAA.0.0.BldNIM.AWVrUBXupFofacebook.com/921727352140803109314583324119231075033" (Indicator: "facebook.com"; File: "151L61J2.txt") Found string "CONSENTWP.2676bayoutube.com/102431383388163210825482504061830633367" (Indicator: "youtube"; File: "0SDTTJFC.txt") Found string "accounts.youtube.com" (Indicator: "youtube"; File: "PCAP") Found string "facebook.com" (Indicator: "facebook.com"; File: "PCAP") Found string "www.facebook.com" (Indicator: "facebook.com"; File: "PCAP") Found string "GET /login HTTP/1.1Accept: text/html, application/xhtml+xml, */*User-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateDNT: 1Host: www.facebook.comConnection: Keep-AliveAccept-Language: en-US" (Indicator: "facebook.com"; File: "SSL") file/memory contains long string with (Indicator: "facebook.com"; File: "SSL")3f:T1db8,"GET /geoip/v2.1/city/me HTTP/1.1 Connection: Keep-Alive Referer: https://www.maxmind.com/en/locate-my-ip-address User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Host: www.maxmind.com" Response ==> HTTP/1.1 403 Forbidden Date: Sat 09 Dec 2023 20:45:24 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 4519 Connection: keep-alive X-Frame-Options: SAMEORIGIN Referrer-Policy: same-origin Cache-Control: max-age=15 Expires: Sat 09 Dec 2023 20:45:39 GMT Server: cloudflare CF-RAY: 83301774fb4f6464-SJC with response body ==>3C21444F43545950452068746D6C3E0A3C212D2D5B6966206C7420494520375D3E203C68746D6C20636C6173733D226E6F2D6A7320696536206F6C6469652220....... "GET /geoip/v2.1/city/me HTTP/1.1 Connection: Keep-Alive Referer: https://www.maxmind.com/en/locate-my-ip-address User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Host: www.maxmind.com" Response ==> HTTP/1.1 403 Forbidden Date: Sat 09 Dec 2023 20:45:34 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 4519 Connection: keep-alive X-Frame-Options: SAMEORIGIN Referrer-Policy: same-origin Cache-Control: max-age=15 Expires: Sat 09 Dec 2023 20:45:49 GMT Server: cloudflare CF-RAY: 833017b0a90a239d-SJC with response body ==>3C21444F43545950452068746D6C3E0A3C212D2D5B6966206C7420494520375D3E203C68746D6C20636C6173733D226E6F2D6A7320696536206F6C6469652220....... "GET /gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.pki.goog" Response ==> HTTP/1.1 200 OK Server: ocsp_responder Content-Length: 1445 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Date: Sat 09 Dec 2023 20:18:13 GMT Cache-Control: public max-age=14400 Content-Type: application/ocsp-response Age: 1669 with response body ==>308205A10A0100A082059A3082059606092B0601050507300101048205873082058330819EA2160414D49BADF2AB3CB9FF1A3E0C506DCF192780868DAA180F32....... "GET /gtsr1/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBQwkcLWD4LqGJ7bE7B1XZsEbmfwUAQU5K8rJnEaK0gnhS9SZizv8IkTcT4CDQIDvFNZazTHGPUBUGY%3D HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.pki.goog" Response ==> HTTP/1.1 200 OK Server: ocsp_responder Content-Length: 724 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Date: Sat 09 Dec 2023 20:17:19 GMT Cache-Control: public max-age=14400 Content-Type: application/ocsp-response Age: 1724 with response body ==>308202D00A0100A08202C9308202C506092B0601050507300101048202B6308202B230819BA2160414E4AF2B26711A2B4827852F52662CEFF08913713E180F32....... "GET /gts1c3/moVDfISia2k.crl HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: crls.pki.goog" Response ==> HTTP/1.1 200 OK Accept-Ranges: bytes Content-Security-Policy-Report-Only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/cacerts Cross-Origin-Resource-Policy: cross-origin Cross-Origin-Opener-Policy: same-origin; report-to="cacerts" Report-To: {"group":"cacerts" "max_age":2592000 "endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/cacerts"}]} Content-Length: 12768 X-Content-Type-Options: nosniff Server: sffe X-XSS-Protection: 0 Date: Sat 09 Dec 2023 20:03:00 GMT Expires: Sat 09 Dec 2023 20:53:00 GMT Cache-Control: public max-age=3000 Age: 2586 Last-Modified: Sat 09 Dec 2023 17:37:04 GMT Content-Type: application/pkix-crl Vary: Accept-Encoding with response body ==>308231DC308230C4020101300D06092A864886F70D01010B05003046310B300906035504061302555331223020060355040A1319476F6F676C65205472757374....... "GET /gts1c3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEBZwXm7t3kKEEFjsmHQeLcQ%3D HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.pki.goog" Response ==> HTTP/1.1 200 OK Server: ocsp_responder Content-Length: 471 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Date: Sat 09 Dec 2023 20:21:03 GMT Cache-Control: public max-age=14400 Content-Type: application/ocsp-response Age: 1503 with response body ==>308201D30A0100A08201CC308201C806092B0601050507300101048201B9308201B530819EA21604148A747FAF85CDEE95CD3D9CD0E24614F371351D27180F32....... "GET /gts1c3/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEQClj3zJOwEs2AlR6v%2BfUXog HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.pki.goog" Response ==> HTTP/1.1 200 OK Server: ocsp_responder Content-Length: 472 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Date: Sat 09 Dec 2023 20:17:37 GMT Cache-Control: public max-age=14400 Content-Type: application/ocsp-response Age: 1711 with response body ==>308201D40A0100A08201CD308201C906092B0601050507300101048201BA308201B630819FA21604148A747FAF85CDEE95CD3D9CD0E24614F371351D27180F32....... "GET /gts1c3/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEQClj3zJOwEs2AlR6v%2BfUXog HTTP/1.1 Cache-Control: max-age = 14400 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.pki.goog" Response ==> HTTP/1.1 200 OK Server: ocsp_responder Content-Length: 472 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Date: Sat 09 Dec 2023 20:17:37 GMT Cache-Control: public max-age=14400 Content-Type: application/ocsp-response Age: 1712 with response body ==>308201D40A0100A08201CD308201C906092B0601050507300101048201BA308201B630819FA21604148A747FAF85CDEE95CD3D9CD0E24614F371351D27180F32....... "GET /gts1c3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEDEixfO34qnbCeE6N8VMp00%3D HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.pki.goog" Response ==> HTTP/1.1 200 OK Server: ocsp_responder Content-Length: 471 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Date: Sat 09 Dec 2023 19:48:31 GMT Cache-Control: public max-age=14400 Content-Type: application/ocsp-response Age: 3463 with response body ==>308201D30A0100A08201CC308201C806092B0601050507300101048201B9308201B530819EA21604148A747FAF85CDEE95CD3D9CD0E24614F371351D27180F32....... "GET /gts1c3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEGpYRvzN3kAuEMlMWsqSFLc%3D HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.pki.goog" Response ==> HTTP/1.1 200 OK Server: ocsp_responder Content-Length: 471 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Date: Sat 09 Dec 2023 20:14:39 GMT Cache-Control: public max-age=14400 Content-Type: application/ocsp-response Age: 1895 with response body ==>308201D30A0100A08201CC308201C806092B0601050507300101048201B9308201B530819EA21604148A747FAF85CDEE95CD3D9CD0E24614F371351D27180F32....... "GET /gts1c3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEGpYRvzN3kAuEMlMWsqSFLc%3D HTTP/1.1 Cache-Control: max-age = 14400 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.pki.goog" Response ==> HTTP/1.1 200 OK Server: ocsp_responder Content-Length: 471 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Date: Sat 09 Dec 2023 20:14:39 GMT Cache-Control: public max-age=14400 Content-Type: application/ocsp-response Age: 1895 with response body ==>308201D30A0100A08201CC308201C806092B0601050507300101048201B9308201B530819EA21604148A747FAF85CDEE95CD3D9CD0E24614F371351D27180F32.......40:T309c,"afa6fbd86c448bceaf510ae6f8b831be.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 70450000 "afa6fbd86c448bceaf510ae6f8b831be.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 0 "afa6fbd86c448bceaf510ae6f8b831be.exe" loaded module "KERNEL32" at base 756b0000 "afa6fbd86c448bceaf510ae6f8b831be.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 0 "afa6fbd86c448bceaf510ae6f8b831be.exe" loaded module "%WINDIR%\SYSTEM32\ADVPACK.DLL" at base 6b990000 "afa6fbd86c448bceaf510ae6f8b831be.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 74b50000 "tB0lu63.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 70450000 "tB0lu63.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 0 "tB0lu63.exe" loaded module "KERNEL32" at base 756b0000 "tB0lu63.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 0 "tB0lu63.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 6b140000 "tB0lu63.exe" loaded module "%WINDIR%\SYSTEM32\ADVPACK.DLL" at base 6b290000 "tB0lu63.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 74b50000 "qP8xB26.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 70450000 "qP8xB26.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 0 "qP8xB26.exe" loaded module "KERNEL32" at base 756b0000 "qP8xB26.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 0 "qP8xB26.exe" loaded module "%WINDIR%\SYSTEM32\ADVPACK.DLL" at base 6b990000 "qP8xB26.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 74b50000 "kX8EH32.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 70450000 "kX8EH32.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 0 "kX8EH32.exe" loaded module "KERNEL32" at base 756b0000 "kX8EH32.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 0 "kX8EH32.exe" loaded module "%WINDIR%\SYSTEM32\ADVAPI32.DLL" at base 75790000 "kX8EH32.exe" loaded module "FECLIENT.DLL" at base 71420000 "kX8EH32.exe" loaded module "%WINDIR%\SYSTEM32\ADVPACK.DLL" at base 6b290000 "kX8EH32.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 74b50000 "1yz61bk1.exe" loaded module "MSIMG32.DLL" at base 6d110000 "1yz61bk1.exe" loaded module "KERNEL32.DLL" at base 756b0000 "1yz61bk1.exe" loaded module "USER32.DLL" at base 75990000 "1yz61bk1.exe" loaded module "GDI32.DLL" at base 754f0000 "1yz61bk1.exe" loaded module "ADVAPI32.DLL" at base 75790000 "1yz61bk1.exe" loaded module "SHELL32.DLL" at base 75f50000 "1yz61bk1.exe" loaded module "OLE32.DLL" at base 76c40000 "1yz61bk1.exe" loaded module "WS2_32.DLL" at base 754b0000 "1yz61bk1.exe" loaded module "CRYPT32.DLL" at base 74e30000 "1yz61bk1.exe" loaded module "SHLWAPI.DLL" at base 753a0000 "1yz61bk1.exe" loaded module "GDIPLUS.DLL" at base 735c0000 "1yz61bk1.exe" loaded module "SETUPAPI.DLL" at base 750a0000 "1yz61bk1.exe" loaded module "NTDLL.DLL" at base 76da0000 "1yz61bk1.exe" loaded module "MSVCR100.DLL" at base 6ae70000 "1yz61bk1.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 70450000 "1yz61bk1.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 0 "1yz61bk1.exe" loaded module "KERNEL32" at base 756b0000 "1yz61bk1.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-0" at base 74de0000 "1yz61bk1.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 0 "1yz61bk1.exe" loaded module "API-MS-WIN-CORE-STRING-L1-1-0" at base 74de0000 "1yz61bk1.exe" loaded module "API-MS-WIN-CORE-DATETIME-L1-1-1" at base 0 "1yz61bk1.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-OBSOLETE-L1-2-0" at base 0 "1yz61bk1.exe" loaded module "CRYPTBASE.DLL" at base 74ba0000 "1yz61bk1.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 73810000 "1yz61bk1.exe" loaded module "CLBCATQ.DLL" at base 74fe0000 "1yz61bk1.exe" loaded module "%WINDIR%\SYSTEM32\GPEDIT.DLL" at base 69860000 "1yz61bk1.exe" loaded module "RPCRT4.DLL" at base 752f0000 "1yz61bk1.exe" loaded module "OLEAUT32.DLL" at base 75410000 "1yz61bk1.exe" loaded module "%WINDIR%\SYSTEM32\SHELL32.DLL" at base 75f50000 "1yz61bk1.exe" loaded module "PROPSYS.DLL" at base 73870000 "1yz61bk1.exe" loaded module "COMCTL32.DLL" at base 73ba0000 "1yz61bk1.exe" loaded module "%WINDIR%\SYSTEM32\PROPSYS.DLL" at base 73870000 "1yz61bk1.exe" loaded module "NTMARTA.DLL" at base 74000000 "1yz61bk1.exe" loaded module "API-MS-WIN-SECURITY-SDDL-L1-1-0.DLL" at base 76f00000 "1yz61bk1.exe" loaded module "PROFAPI.DLL" at base 74cb0000 "1yz61bk1.exe" loaded module "APPHELP.DLL" at base 74b50000 "1yz61bk1.exe" loaded module "%WINDIR%\SYSTEM32\SHDOCVW.DLL" at base 6de00000 "1yz61bk1.exe" loaded module "LINKINFO.DLL" at base 6dd30000 "1yz61bk1.exe" loaded module "NTSHRUI.DLL" at base 723d0000 "1yz61bk1.exe" loaded module "SRVCLI.DLL" at base 748a0000 "1yz61bk1.exe" loaded module "CSCAPI.DLL" at base 700e0000 "1yz61bk1.exe" loaded module "SLC.DLL" at base 73050000 "1yz61bk1.exe" loaded module "SSPICLI.DLL" at base 74b30000 "1yz61bk1.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 74b50000 "1yz61bk1.exe" loaded module "WINHTTP.DLL" at base 70570000 "1yz61bk1.exe" loaded module "WININET.DLL" at base 75ca0000 "1yz61bk1.exe" loaded module "%WINDIR%\SYSTEM32\MSWSOCK.DLL" at base 74670000 "1yz61bk1.exe" loaded module "%WINDIR%\SYSTEM32\WSHTCPIP.DLL" at base 741d0000 "1yz61bk1.exe" loaded module "CRYPTSP.DLL" at base 746b0000 "1yz61bk1.exe" loaded module "CREDSSP.DLL" at base 74340000 "1yz61bk1.exe" loaded module "%WINDIR%\SYSTEM32\WSHIP6.DLL" at base 74660000 "1yz61bk1.exe" loaded module "DNSAPI.DLL" at base 74530000 "1yz61bk1.exe" loaded module "IPHLPAPI.DLL" at base 72ff0000 "1yz61bk1.exe" loaded module "RASADHLP.DLL" at base 71360000 "1yz61bk1.exe" loaded module "%WINDIR%\SYSTEM32\FWPUCLNT.DLL" at base 72f20000 "1yz61bk1.exe" loaded module "%WINDIR%\SYSTEM32\SCHANNEL.DLL" at base 744b0000 "1yz61bk1.exe" loaded module "SECUR32.DLL" at base 749e0000 "1yz61bk1.exe" loaded module "NCRYPT.DLL" at base 747e0000 "1yz61bk1.exe" loaded module "%WINDIR%\SYSTEM32\BCRYPTPRIMITIVES.DLL" at base 74380000 "1yz61bk1.exe" loaded module "USERENV.DLL" at base 74ce0000 "1yz61bk1.exe" loaded module "GPAPI.DLL" at base 74280000 "1yz61bk1.exe" loaded module "API-MS-WIN-SERVICE-MANAGEMENT-L1-1-0.DLL" at base 76f00000 "1yz61bk1.exe" loaded module "API-MS-WIN-SERVICE-MANAGEMENT-L2-1-0.DLL" at base 76f00000 "1yz61bk1.exe" loaded module "%WINDIR%\SYSTEM32\RSAENH.DLL" at base 74440000 "1yz61bk1.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-2" at base 0 "1yz61bk1.exe" loaded module "NETUTILS.DLL" at base 73760000 "schtasks.exe" loaded module "SSPICLI.DLL" at base 74b30000 "schtasks.exe" loaded module "ADVAPI32.DLL" at base 75790000 "schtasks.exe" loaded module "API-MS-WIN-SECURITY-LSALOOKUP-L1-1-0.DLL" at base 76f00000 "schtasks.exe" loaded module "XMLLITE.DLL" at base 734d0000 "schtasks.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 70450000 "schtasks.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 0 "schtasks.exe" loaded module "KERNEL32" at base 756b0000 "schtasks.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 0 "4hV149il.exe" loaded module "KERNEL32.DLL" at base 756b0000 "4hV149il.exe" loaded module "OLEAUT32.DLL" at base 75410000 "4hV149il.exe" loaded module "OLE32.DLL" at base 76c40000 "4hV149il.exe" loaded module "ADVAPI32.DLL" at base 75790000 "4hV149il.exe" loaded module "WINHTTP.DLL" at base 70570000 "4hV149il.exe" loaded module "WININET.DLL" at base 75ca0000 "4hV149il.exe" loaded module "CRYPTBASE.DLL" at base 74ba0000 "4hV149il.exe" loaded module "%WINDIR%\SYSTEM32\MSWSOCK.DLL" at base 74670000 "4hV149il.exe" loaded module "%WINDIR%\SYSTEM32\WSHTCPIP.DLL" at base 741d0000 "4hV149il.exe" loaded module "SHLWAPI.DLL" at base 753a0000 "4hV149il.exe" loaded module "WS2_32.DLL" at base 754b0000 "4hV149il.exe" loaded module "SSPICLI.DLL" at base 74b30000 "4hV149il.exe" loaded module "CRYPTSP.DLL" at base 746b0000 "4hV149il.exe" loaded module "CREDSSP.DLL" at base 74340000 "4hV149il.exe" loaded module "RPCRT4.DLL" at base 752f0000 "4hV149il.exe" loaded module "%WINDIR%\SYSTEM32\WSHIP6.DLL" at base 74660000 "4hV149il.exe" loaded module "DNSAPI.DLL" at base 74530000 "4hV149il.exe" loaded module "IPHLPAPI.DLL" at base 72ff0000 "4hV149il.exe" loaded module "RASADHLP.DLL" at base 71360000 "4hV149il.exe" loaded module "%WINDIR%\SYSTEM32\FWPUCLNT.DLL" at base 72f20000 "4hV149il.exe" loaded module "%WINDIR%\SYSTEM32\SCHANNEL.DLL" at base 744b0000 "4hV149il.exe" loaded module "CRYPT32.DLL" at base 74e30000 "4hV149il.exe" loaded module "SECUR32.DLL" at base 749e0000 "4hV149il.exe" loaded module "NCRYPT.DLL" at base 747e0000 "4hV149il.exe" loaded module "%WINDIR%\SYSTEM32\BCRYPTPRIMITIVES.DLL" at base 74380000 "4hV149il.exe" loaded module "USER32.DLL" at base 75990000 "4hV149il.exe" loaded module "USERENV.DLL" at base 74ce0000 "4hV149il.exe" loaded module "API-MS-WIN-SECURITY-SDDL-L1-1-0.DLL" at base 76f00000 "4hV149il.exe" loaded module "GPAPI.DLL" at base 74280000 "4hV149il.exe" loaded module "API-MS-WIN-SERVICE-MANAGEMENT-L1-1-0.DLL" at base 76f00000 "4hV149il.exe" loaded module "API-MS-WIN-SERVICE-MANAGEMENT-L2-1-0.DLL" at base 76f00000 "4hV149il.exe" loaded module "%WINDIR%\SYSTEM32\RSAENH.DLL" at base 74440000 "4hV149il.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-2" at base 0 "5eh2lq1.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 70450000 "5eh2lq1.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 0 "5eh2lq1.exe" loaded module "KERNEL32" at base 756b0000 "5eh2lq1.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 0 "5eh2lq1.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 74b50000 "5eh2lq1.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-2" at base 0 "AppLaunch.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 70450000 "AppLaunch.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 0 "AppLaunch.exe" loaded module "KERNEL32" at base 756b0000 "AppLaunch.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 0 "AppLaunch.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 6b140000 "6FR1MW1.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 70450000 "6FR1MW1.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 0 "6FR1MW1.exe" loaded module "KERNEL32" at base 756b0000 "6FR1MW1.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 0 "6FR1MW1.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 73810000 "6FR1MW1.exe" loaded module "KERNEL32.DLL" at base 756b0000 "6FR1MW1.exe" loaded module "API-MS-WIN-CORE-SYSINFO-L1-2-1" at base 0 "6FR1MW1.exe" loaded module "DWMAPI.DLL" at base 73770000 "6FR1MW1.exe" loaded module "COMCTL32.DLL" at base 73ba0000 "6FR1MW1.exe" loaded module "UXTHEME.DLL" at base 73810000 "6FR1MW1.exe" loaded module "IMM32.DLL" at base 76fd0000 "6FR1MW1.exe" loaded module "COMCTL32" at base 73ba0000 "6FR1MW1.exe" loaded module "SHELL32.DLL" at base 75f50000 "6FR1MW1.exe" loaded module "OLE32.DLL" at base 76c40000 "6FR1MW1.exe" loaded module "ADVAPI32.DLL" at base 75790000 "6FR1MW1.exe" loaded module "PROPSYS.DLL" at base 73870000 "6FR1MW1.exe" loaded module "OLEAUT32.DLL" at base 75410000 "6FR1MW1.exe" loaded module "APPHELP.DLL" at base 74b50000 "6FR1MW1.exe" loaded module "CLBCATQ.DLL" at base 74fe0000 "6FR1MW1.exe" loaded module "%WINDIR%\SYSTEM32\IEFRAME.DLL" at base 69b80000 "6FR1MW1.exe" loaded module "API-MS-WIN-DOWNLEVEL-OLE32-L1-1-0.DLL" at base 74dd0000 "6FR1MW1.exe" loaded module "URLMON.DLL" at base 75840000 "6FR1MW1.exe" loaded module "API-MS-WIN-DOWNLEVEL-SHLWAPI-L2-1-0.DLL" at base 683b0000 "6FR1MW1.exe" loaded module "%WINDIR%\SYSTEM32\PROPSYS.DLL" at base 73870000 "6FR1MW1.exe" loaded module "%PROGRAMFILES%\INTERNET EXPLORER\IEPROXY.DLL" at base 6b220000 "6FR1MW1.exe" loaded module "IERTUTIL.DLL" at base 75a60000 "6FR1MW1.exe" loaded module "%WINDIR%\SYSTEM32\SHELL32.DLL" at base 75f50000 "6FR1MW1.exe" loaded module "USER32.DLL" at base 75990000 "6FR1MW1.exe" loaded module "SETUPAPI.DLL" at base 750a0000 "6FR1MW1.exe" loaded module "RPCRT4.DLL" at base 752f0000 "6FR1MW1.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 74b50000 "6FR1MW1.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-1" at base 0 "6FR1MW1.exe" loaded module "EXT-MS-WIN-KERNEL32-PACKAGE-CURRENT-L1-1-0" at base 041:Tdc4,"afa6fbd86c448bceaf510ae6f8b831be.exe" was detected as "Microsoft Cabinet" and name: "sfx" "afa6fbd86c448bceaf510ae6f8b831be.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "afa6fbd86c448bceaf510ae6f8b831be.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "afa6fbd86c448bceaf510ae6f8b831be.exe" was detected as "Microsoft Cabinet File" and name: "Archive" "afa6fbd86c448bceaf510ae6f8b831be.exe" was detected as "Microsoft Linker" and name: "Linker" "tB0lu63.exe" was detected as "Microsoft Cabinet" and name: "sfx" "tB0lu63.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "tB0lu63.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "tB0lu63.exe" was detected as "Microsoft Cabinet File" and name: "Archive" "tB0lu63.exe" was detected as "Microsoft Linker" and name: "Linker" "qP8xB26.exe" was detected as "Microsoft Cabinet" and name: "sfx" "qP8xB26.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "qP8xB26.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "qP8xB26.exe" was detected as "Microsoft Cabinet File" and name: "Archive" "qP8xB26.exe" was detected as "Microsoft Linker" and name: "Linker" "5eh2lq1.exe" was detected as "Microsoft Cabinet" and name: "sfx" "5eh2lq1.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "5eh2lq1.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "5eh2lq1.exe" was detected as "Microsoft Cabinet File" and name: "Archive" "5eh2lq1.exe" was detected as "Microsoft Linker" and name: "Linker" "4hV149il.exe" was detected as "Microsoft Cabinet" and name: "sfx" "4hV149il.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "4hV149il.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "4hV149il.exe" was detected as "Microsoft Cabinet File" and name: "Archive" "4hV149il.exe" was detected as "Microsoft Linker" and name: "Linker" "kX8EH32.exe" was detected as "Microsoft Cabinet" and name: "sfx" "kX8EH32.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "kX8EH32.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "kX8EH32.exe" was detected as "Microsoft Cabinet File" and name: "Archive" "kX8EH32.exe" was detected as "Microsoft Linker" and name: "Linker" "FANBooster131.exe" was detected as "Microsoft Cabinet" and name: "sfx" "FANBooster131.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "FANBooster131.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "FANBooster131.exe" was detected as "Microsoft Cabinet File" and name: "Archive" "FANBooster131.exe" was detected as "Microsoft Linker" and name: "Linker" "6FR1MW1.exe" was detected as "Microsoft Cabinet" and name: "sfx" "6FR1MW1.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "6FR1MW1.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "6FR1MW1.exe" was detected as "Microsoft Cabinet File" and name: "Archive" "6FR1MW1.exe" was detected as "Microsoft Linker" and name: "Linker" "3mk61Eb.exe" was detected as "Microsoft Cabinet" and name: "sfx" "3mk61Eb.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "3mk61Eb.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "3mk61Eb.exe" was detected as "Microsoft Cabinet File" and name: "Archive" "3mk61Eb.exe" was detected as "Microsoft Linker" and name: "Linker"42:T4f2,"1yz61bk1.exe" touched "Group Policy Object" (Path: "HKCU\CLSID\{EA502722-A23D-11D1-A7D3-0000F87571E3}") "1yz61bk1.exe" touched "Shortcut" (Path: "HKCU\CLSID\{00021401-0000-0000-C000-000000000046}") "1yz61bk1.exe" touched "Computer" (Path: "HKCU\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\SHELLFOLDER") "1yz61bk1.exe" touched "Memory Mapped Cache Mgr" (Path: "HKLM\SOFTWARE\CLASSES\CLSID\{1F486A52-3CB1-48FD-8F50-B8DC300D9F9D}") "1yz61bk1.exe" touched "UsersFiles" (Path: "HKCU\CLSID\{59031A47-3F72-44A7-89C5-5595FE6B30EE}\SHELLFOLDER") "1yz61bk1.exe" touched "delegate folder that appears in Users Files Folder" (Path: "HKCU\CLSID\{DFFACDC5-679F-4156-8947-C5C76BC0B67F}\SHELLFOLDER") "1yz61bk1.exe" touched "Shell File System Folder" (Path: "HKCU\CLSID\{0E5AAE11-A475-4C5B-AB00-C66DE400274E}\INPROCSERVER32") "schtasks.exe" touched "TaskScheduler class" (Path: "HKCU\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}") "6FR1MW1.exe" touched "Network" (Path: "HKCU\CLSID\{208D2C60-3AEA-1069-A2D7-08002B30309D}\SHELLFOLDER") "6FR1MW1.exe" touched "Property System Both Class Factory" (Path: "HKCU\CLSID\{76765B11-3F95-4AF2-AC9D-EA55D8994F1A}") "6FR1MW1.exe" touched "Application Registration" (Path: "HKCU\CLSID\{591209C7-767B-42B2-9FBA-44EE4615F2C7}\TREATAS")43:T13f1,"afa6fbd86c448bceaf510ae6f8b831be.exe" file has an entrypoint instructions - "call 0x407155,jmp 0x406a6a,push 0x58,push 0x4072b8,call 0x407208,xor ebx, ebx,mov dword ptr [ebp - 0x20], ebx,lea eax, [ebp - 0x68],push eax,call dword ptr [0x40a184],mov dword ptr [ebp - 4], ebx,mov eax, dword ptr fs:[0x18],mov esi, dword ptr [eax + 4],mov edi, ebx,mov edx, 0x4088ac,mov ecx, esi,xor eax, eax,lock cmpxchg dword ptr [edx], ecx,test eax, eax,je 0x406abc,cmp eax, esi,jne 0x406aaf,xor esi, esi,inc esi,mov edi, esi,jmp 0x406abf,push 0x3e8,call dword ptr [0x40a188],jmp 0x406a93,xor esi, esi,inc esi," "tB0lu63.exe" file has an entrypoint instructions - "call 0x407155,jmp 0x406a6a,push 0x58,push 0x4072b8,call 0x407208,xor ebx, ebx,mov dword ptr [ebp - 0x20], ebx,lea eax, [ebp - 0x68],push eax,call dword ptr [0x40a184],mov dword ptr [ebp - 4], ebx,mov eax, dword ptr fs:[0x18],mov esi, dword ptr [eax + 4],mov edi, ebx,mov edx, 0x4088ac,mov ecx, esi,xor eax, eax,lock cmpxchg dword ptr [edx], ecx,test eax, eax,je 0x406abc,cmp eax, esi,jne 0x406aaf,xor esi, esi,inc esi,mov edi, esi,jmp 0x406abf,push 0x3e8,call dword ptr [0x40a188],jmp 0x406a93,xor esi, esi,inc esi," "qP8xB26.exe" file has an entrypoint instructions - "call 0x407155,jmp 0x406a6a,push 0x58,push 0x4072b8,call 0x407208,xor ebx, ebx,mov dword ptr [ebp - 0x20], ebx,lea eax, [ebp - 0x68],push eax,call dword ptr [0x40a184],mov dword ptr [ebp - 4], ebx,mov eax, dword ptr fs:[0x18],mov esi, dword ptr [eax + 4],mov edi, ebx,mov edx, 0x4088ac,mov ecx, esi,xor eax, eax,lock cmpxchg dword ptr [edx], ecx,test eax, eax,je 0x406abc,cmp eax, esi,jne 0x406aaf,xor esi, esi,inc esi,mov edi, esi,jmp 0x406abf,push 0x3e8,call dword ptr [0x40a188],jmp 0x406a93,xor esi, esi,inc esi," "5eh2lq1.exe" file has an entrypoint instructions - "jmp 0x422711,jmp 0x4ad7f7,jmp 0x47dc83,jmp 0x488f15,jmp 0x428b18,jmp 0x49f6d7,jmp 0x426bdc,jmp 0x4b45fa,jmp 0x424ba4,jmp 0x466788,jmp 0x47dcfb,jmp 0x4732b9,jmp 0x44d1df,jmp 0x435f20,jmp 0x40e710,jmp 0x471dc4,jmp 0x4515b0,jmp 0x45851a,jmp 0x46f8b4,jmp 0x44f196," "4hV149il.exe" file has an entrypoint instructions - "call 0x508e02,jmp 0x5085cf,cmp ecx, dword ptr [0x58a048],jne 0x50875e,ret ,jmp 0x508f35,push ebp,mov ebp, esp,and dword ptr [0x58c3d0], 0,sub esp, 0x24,or dword ptr [0x58a050], 1,push 0xa,call dword ptr [0x5560e0],test eax, eax,je 0x508933,and dword ptr [ebp - 0x10], 0,xor eax, eax,push ebx,push esi,push edi,xor ecx, ecx,lea edi, [ebp - 0x24],push ebx,cpuid ,mov esi, ebx,pop ebx,nop ,mov dword ptr [edi], eax,mov dword ptr [edi + 4], esi,mov dword ptr [edi + 8], ecx,xor ecx, ecx,mov dword ptr [edi + 0xc], edx,mov eax, dword ptr [ebp - 0x24],mov edi, dword ptr [ebp - 0x20]," "kX8EH32.exe" file has an entrypoint instructions - "call 0x407155,jmp 0x406a6a,push 0x58,push 0x4072b8,call 0x407208,xor ebx, ebx,mov dword ptr [ebp - 0x20], ebx,lea eax, [ebp - 0x68],push eax,call dword ptr [0x40a184],mov dword ptr [ebp - 4], ebx,mov eax, dword ptr fs:[0x18],mov esi, dword ptr [eax + 4],mov edi, ebx,mov edx, 0x4088ac,mov ecx, esi,xor eax, eax,lock cmpxchg dword ptr [edx], ecx,test eax, eax,je 0x406abc,cmp eax, esi,jne 0x406aaf,xor esi, esi,inc esi,mov edi, esi,jmp 0x406abf,push 0x3e8,call dword ptr [0x40a188],jmp 0x406a93,xor esi, esi,inc esi," "FANBooster131.exe" file has an entrypoint instructions - "call 0x4043f0,jmp 0x401e35,int3 ,int3 ,int3 ,int3 ,mov edx, dword ptr [esp + 0xc],mov ecx, dword ptr [esp + 4],test edx, edx,je 0x402035,xor eax, eax,mov al, byte ptr [esp + 8],test al, al,jne 0x401fec,cmp edx, 0x100,jb 0x401fec,cmp dword ptr [0x8fa148], 0,je 0x401fec,jmp 0x4044dd,push edi,mov edi, ecx,cmp edx, 4,jb 0x402025,neg ecx,and ecx, 3,je 0x402007,sub edx, ecx,mov byte ptr [edi], al,add edi, 1,sub ecx, 1,jne 0x401ffd,mov ecx, eax,shl eax, 8,add eax, ecx,mov ecx, eax,shl eax, 0x10,add eax, ecx," "6FR1MW1.exe" file has an entrypoint instructions - "call 0x420aea,jmp 0x4203fb,push ebp,mov ebp, esp,push esi,push dword ptr [ebp + 8],mov esi, ecx,call 0x4205e7,mov dword ptr [esi], 0x49fdf0,mov eax, esi,pop esi,pop ebp,ret 4,and dword ptr [ecx + 4], 0,mov eax, ecx,and dword ptr [ecx + 8], 0,mov dword ptr [ecx + 4], 0x49fdf8,mov dword ptr [ecx], 0x49fdf0,ret ,push ebp,mov ebp, esp,push esi,push dword ptr [ebp + 8],mov esi, ecx,call 0x4205e7,mov dword ptr [esi], 0x49fe0c,mov eax, esi,pop esi,pop ebp,ret 4,and dword ptr [ecx + 4], 0,mov eax, ecx,and dword ptr [ecx + 8], 0," "3mk61Eb.exe" file has an entrypoint instructions - "call 0x403250,jne 0x403256,je 0x403256,mov edi, 0x4c4835f,mov ebx, dword ptr [esp - 4],jmp 0x403269,add al, 0x81,jmp 0x4032b3,xor al, byte ptr [eax],add bl, ch,add eax, 0x4f5eb20,and byte ptr [edi + eax + 0x75], dh,add eax, 0xbb8ce2e5,dec eax,push 0x30,jne 0x403280,je 0x403280,cmp al, 0x68,js 0x403209,mov edx, dword ptr [esp],add esp, 4,jmp 0x40328e,shr byte ptr [ecx], 0xc0,jmp 0x403292,sub bl, 0xf9,rol byte ptr [edx - 0x3a3bfa15], 0xa5,mov dword ptr [edx + 0x64], edi,add eax, dword ptr [edx],je 0x4032a5,jne 0x4032a5,adc al, 0xf6,cmpsd dword ptr [esi], dword ptr es:[edi],daa ,daa ,push dword ptr [eax + 0xa4],jne 0x4032b1,je 0x4032b1,"44:T863,"afa6fbd86c448bceaf510ae6f8b831be.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "afa6fbd86c448bceaf510ae6f8b831be.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "tB0lu63.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "tB0lu63.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "qP8xB26.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "qP8xB26.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "kX8EH32.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "kX8EH32.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "1yz61bk1.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "1yz61bk1.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "schtasks.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "schtasks.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "3mk61Eb.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "3mk61Eb.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "4hV149il.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "4hV149il.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "5eh2lq1.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "5eh2lq1.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "AppLaunch.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "AppLaunch.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "6FR1MW1.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "6FR1MW1.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "6FR1MW1.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LOCALE"; Key: "00000409")45:T520,Found string "" (Indicator: "text/javascript"; File: "222WX212.htm") Found string "" (Indicator: "text/javascript"; File: "222WX212.htm") Found string "" (Indicator: "text/javascript"; File: "222WX212.htm") Found string "" (Indicator: "text/javascript"; File: "222WX212.htm")46:T5b0,Observed system executable string:"C:\Windows\system32\apphelp.dll" [Source: 00002644.00000A54.429304.00090000.wprm] Observed system executable string:"%WINDIR%\system32\advpack.dll" [Source: 00000000-00001616-00000C25-43283618] Observed system executable string:"rundll32.exe %WINDIR%\system32\advpack.dll,DelNodeRunDLL32 "%TEMP%\IXP000.TMP\"" [Source: 00000000-00001616-00000BC1-43295204] Observed system executable string:"rundll32.exe %WINDIR%\system32\advpack.dll,DelNodeRunDLL32 "%TEMP%\IXP001.TMP\"" [Source: 00000000-00003500-00000BC1-43855973] Observed system executable string:"rundll32.exe %WINDIR%\system32\advpack.dll,DelNodeRunDLL32 "%TEMP%\IXP002.TMP\"" [Source: 00000000-00002516-00000BC1-44353020] Observed system executable string:"%WINDIR%\system32\advapi32.dll" [Source: 00000000-00002644-00000C25-45014181] Observed system executable string:"rundll32.exe %WINDIR%\system32\advpack.dll,DelNodeRunDLL32 "%TEMP%\IXP003.TMP\"" [Source: 00000000-00002644-00000BC1-45093489] Observed system executable string:"%WINDIR%\system32\uxtheme.dll" [Source: 00000000-00003736-00000C25-46693673] Observed system executable string:"%WINDIR%\System32\shdocvw.dll" [Source: 00000000-00003736-00000C25-48170550] Observed system executable string:"%WINDIR%\system32\bcryptprimitives.dll" [Source: 00000000-00003736-00000C25-54394014] Observed system executable string:"%WINDIR%\System32\ieframe.dll" [Source: 00000000-00001512-00000C25-74112492]47:T5af,Spawned process "tB0lu63.exe" (UID: 00000000-00003500) Spawned process "qP8xB26.exe" (UID: 00000000-00002516) Spawned process "kX8EH32.exe" (UID: 00000000-00002644) Spawned process "1yz61bk1.exe" (UID: 00000000-00003736) Spawned process "schtasks.exe" with commandline "schtasks /create /f /RU "%OSUSER%" /tr "%ALLUSERSPROFILE%\\Offic ..." (UID: 00000000-00001284), Spawned process "schtasks.exe" with commandline "schtasks /create /f /RU "%OSUSER%" /tr "%ALLUSERSPROFILE%\\Offic ..." (UID: 00000000-00003416) Spawned process "3mk61Eb.exe" (UID: 00000000-00000904) Spawned process "4hV149il.exe" (UID: 00000000-00003088) Spawned process "5eh2lq1.exe" (UID: 00000000-00003116) Spawned process "AppLaunch.exe" (UID: 00000000-00004016) Spawned process "6FR1MW1.exe" (UID: 00000000-00001512) Spawned process "iexplore.exe" with commandline "https://accounts.google.com/" (UID: 00000000-00003276) Spawned process "iexplore.exe" with commandline "https://www.facebook.com/login" (UID: 00000000-00002704) Spawned process "iexplore.exe" with commandline "https://accounts.google.com/" (UID: 00000000-00002856) Spawned process "iexplore.exe" with commandline "SCODEF:3276 CREDAT:275458 /prefetch:2" (UID: 00000000-00003096) Spawned process "iexplore.exe" with commandline "SCODEF:2704 CREDAT:275457 /prefetch:2" (UID: 00000000-00003592) Spawned process "iexplore.exe" with commandline "SCODEF:2856 CREDAT:275457 /prefetch:2" (UID: 00000000-00003804)48:T5af,Spawned process "tB0lu63.exe" (UID: 00000000-00003500) Spawned process "qP8xB26.exe" (UID: 00000000-00002516) Spawned process "kX8EH32.exe" (UID: 00000000-00002644) Spawned process "1yz61bk1.exe" (UID: 00000000-00003736) Spawned process "schtasks.exe" with commandline "schtasks /create /f /RU "%OSUSER%" /tr "%ALLUSERSPROFILE%\\Offic ..." (UID: 00000000-00001284), Spawned process "schtasks.exe" with commandline "schtasks /create /f /RU "%OSUSER%" /tr "%ALLUSERSPROFILE%\\Offic ..." (UID: 00000000-00003416) Spawned process "3mk61Eb.exe" (UID: 00000000-00000904) Spawned process "4hV149il.exe" (UID: 00000000-00003088) Spawned process "5eh2lq1.exe" (UID: 00000000-00003116) Spawned process "AppLaunch.exe" (UID: 00000000-00004016) Spawned process "6FR1MW1.exe" (UID: 00000000-00001512) Spawned process "iexplore.exe" with commandline "https://accounts.google.com/" (UID: 00000000-00003276) Spawned process "iexplore.exe" with commandline "https://www.facebook.com/login" (UID: 00000000-00002704) Spawned process "iexplore.exe" with commandline "https://accounts.google.com/" (UID: 00000000-00002856) Spawned process "iexplore.exe" with commandline "SCODEF:3276 CREDAT:275458 /prefetch:2" (UID: 00000000-00003096) Spawned process "iexplore.exe" with commandline "SCODEF:2704 CREDAT:275457 /prefetch:2" (UID: 00000000-00003592) Spawned process "iexplore.exe" with commandline "SCODEF:2856 CREDAT:275457 /prefetch:2" (UID: 00000000-00003804)49:T43d,Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; File: "afa6fbd86c448bceaf510ae6f8b831be.exe") Found reference to API "LoadLibraryExA" (Indicator: "LoadLibrary"; File: "afa6fbd86c448bceaf510ae6f8b831be.exe") Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; Source: "00000000-00001512.00000000.67840.00E5C000.00000002.mdmp") Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; Source: "00000000-00001512.00000000.67840.00E5C000.00000002.mdmp") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; Source: "00000000-00001512.00000000.67840.00E5C000.00000002.mdmp, 00000000-00001512.00000000.67840.6B260000.00000002.mdmp") Found reference to API "LoadLibraryExA" (Indicator: "LoadLibrary"; Source: "00000000-00001512.00000000.67840.6B260000.00000002.mdmp") Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; Source: "00000000-00002516.00000001.67151.008FA000.00000002.mdmp") Found reference to API "LoadLibraryExA" (Indicator: "LoadLibrary"; Source: "00000000-00002516.00000001.67151.008FA000.00000002.mdmp")4a:T5a4a,"tB0lu63.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP000.TMP\tB0lu63.exe]- [targetUID: 00000000-00001616] "qP8xB26.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP001.TMP\qP8xB26.exe]- [targetUID: 00000000-00002516] "5eh2lq1.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP001.TMP\5eh2lq1.exe]- [targetUID: 00000000-00003116] "4hV149il.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP002.TMP\4hV149il.exe]- [targetUID: 00000000-00002516] "kX8EH32.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP002.TMP\kX8EH32.exe]- [targetUID: 00000000-00002644] "FANBooster131.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\FANBooster131\FANBooster131.exe]- [targetUID: 00000000-00003736] "6FR1MW1.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP000.TMP\6FR1MW1.exe]- [targetUID: 00000000-00001512] "urlref_httpsaccounts.google.com" has type "HTML document UTF-8 Unicode text with very long lines"- [targetUID: N/A] "3mk61Eb.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP003.TMP\3mk61Eb.exe]- [targetUID: 00000000-00002644] "4lCu2zih0ca_1_.svg" has type "SVG Scalable Vector Graphics image"- [targetUID: N/A] "FANBooster131.lnk" has type "MS Windows shortcut Item id list present Points to a file or directory Has Description string Has Relative path Archive ctime=Sat Dec 9 19:45:16 2023 mtime=Sat Dec 9 19:45:16 2023 atime=Sat Dec 9 18:14:58 2023 length=986624 window=hide"- Location: [%APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\FANBooster131.lnk]- [targetUID: 00000000-00003736] "urlblockindex_1_.bin" has type "data"- [targetUID: N/A] "identifier_1_.htm" has type "HTML document UTF-8 Unicode text with very long lines"- [targetUID: N/A] "Ijg_IKf_KOp_1_.js" has type "ASCII text with very long lines"- [targetUID: N/A] "222WX212.htm" has type "HTML document UTF-8 Unicode text with very long lines with CRLF NEL line terminators"- Location: [%LOCALAPPDATA%\Microsoft\Windows\Temporary Internet Files\Content.IE5\37NU00GP\222WX212.htm]- [targetUID: 00000000-00003276] "login_2_.htm" has type "HTML document UTF-8 Unicode text with very long lines"- [targetUID: N/A] "login_1_.htm" has type "HTML document UTF-8 Unicode text with very long lines"- [targetUID: N/A] "urlref_httpswww.facebook.comlogin" has type "HTML document UTF-8 Unicode text with very long lines"- [targetUID: N/A] "a1OLcVhluEP_1_.js" has type "ASCII text with very long lines"- [targetUID: N/A] "sKtrEJAtiUM_1_.js" has type "ASCII text with very long lines"- [targetUID: N/A] "YoTddyRzZmh_1_.js" has type "ASCII text with very long lines"- [targetUID: N/A] "a_TNkY9RAW1_1_.js" has type "ASCII text with very long lines"- [targetUID: N/A] "euLeui0FtEX_1_.js" has type "ASCII text with very long lines"- [targetUID: N/A] "CheckConnection_2_.htm" has type "HTML document ASCII text with very long lines"- [targetUID: N/A] "CheckConnection_1_.htm" has type "HTML document ASCII text with very long lines"- [targetUID: N/A] "GFdzeQQcoxa_1_.css" has type "ASCII text with very long lines"- [targetUID: N/A] "aBIoq18cchP_1_.js" has type "ASCII text with very long lines"- [targetUID: N/A] "GxGC52INhg0_1_.js" has type "C source ASCII text with very long lines"- [targetUID: N/A] "qvzskUrYlYC_1_.js" has type "ASCII text with very long lines"- [targetUID: N/A] "4UabrENHsxJlGDuGo1OIlLU94YtzCwA_1_.woff" has type "Web Open Font Format TrueType length 26412 version 1.1"- [targetUID: N/A] "4UaGrENHsxJlGDuGo1OIlL3Owpg_1_.woff" has type "Web Open Font Format TrueType length 26180 version 1.1"- [targetUID: N/A] "5YJJZ1WjDXH_1_.js" has type "ASCII text with very long lines"- [targetUID: N/A] "hNaGl-uOTME_1_.js" has type "C source ASCII text with very long lines"- [targetUID: N/A] "~DF135390806DEF457B.TMP" has type "data"- Location: [%TEMP%\~DF135390806DEF457B.TMP]- [targetUID: 00000000-00002856] "~DF1EE20F9867A1B1CC.TMP" has type "data"- Location: [%TEMP%\~DF1EE20F9867A1B1CC.TMP]- [targetUID: 00000000-00003276] "KFOlCnqEu92Fr1MmEU9fBBc-_1_.woff" has type "Web Open Font Format TrueType length 20012 version 1.1"- [targetUID: N/A] "KFOkCnqEu92Fr1MmgVxIIzQ_1_.woff" has type "Web Open Font Format TrueType length 19936 version 1.1"- [targetUID: N/A] "KFOlCnqEu92Fr1MmSU5fBBc-_1_.woff" has type "Web Open Font Format TrueType length 19916 version 1.1"- [targetUID: N/A] "KFOlCnqEu92Fr1MmWUlfBBc-_1_.woff" has type "Web Open Font Format TrueType length 19888 version 1.1"- [targetUID: N/A] "en-US.4" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\Internet Explorer\DomainSuggestions\en-US.4]- [targetUID: 00000000-00002704] "2pRVSwAv5Rj_1_.css" has type "ASCII text with very long lines"- [targetUID: N/A] "_DE541CC0-96CB-11EE-AA3E-00505691BB01_.dat" has type "Composite Document File V2 Document Cannot read section info"- [targetUID: N/A] "~DF778328D12577013F.TMP" has type "data"- Location: [%TEMP%\~DF778328D12577013F.TMP]- [targetUID: 00000000-00002704] "~DF4D880BE0F3A7C55D.TMP" has type "data"- Location: [%TEMP%\~DF4D880BE0F3A7C55D.TMP]- [targetUID: 00000000-00002856] "~DF9A8AD6D15ED7CFA7.TMP" has type "data"- Location: [%TEMP%\~DF9A8AD6D15ED7CFA7.TMP]- [targetUID: 00000000-00003276] "~DF2AB32E27C784156C.TMP" has type "data"- Location: [%TEMP%\~DF2AB32E27C784156C.TMP]- [targetUID: 00000000-00003276] "~DF7C12A64958AB8E11.TMP" has type "data"- Location: [%TEMP%\~DF7C12A64958AB8E11.TMP]- [targetUID: 00000000-00003276] "~DF49A5ECE52593B9FE.TMP" has type "data"- Location: [%TEMP%\~DF49A5ECE52593B9FE.TMP]- [targetUID: 00000000-00002704] "~DF5BAC219EF8B467C3.TMP" has type "data"- Location: [%TEMP%\~DF5BAC219EF8B467C3.TMP]- [targetUID: 00000000-00002704] "imagestore.dat" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\Internet Explorer\imagestore\3mt7jhv\imagestore.dat]- [targetUID: 00000000-00003096] "lFK_RCKM9IT_1_.js" has type "C source ASCII text with very long lines"- [targetUID: N/A] "70DAE932E3BCB3C00656A27B544BA9CA" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\70DAE932E3BCB3C00656A27B544BA9CA]- [targetUID: 00000000-00003096] "s_Izg7nAY9-_1_.js" has type "ASCII text with very long lines"- [targetUID: N/A] "_DE4A973F-96CB-11EE-AA3E-00505691BB01_.dat" has type "Composite Document File V2 Document Cannot read section info"- [targetUID: N/A] "_8E39F18E-96CB-11EE-AA3E-00505691BB01_.dat" has type "Composite Document File V2 Document Cannot read section info"- [targetUID: N/A] "ISUe9_7D94n_1_.js" has type "ASCII text with very long lines"- [targetUID: N/A] "0c71UB7QWmT_1_.js" has type "ASCII text with very long lines"- [targetUID: N/A] "739F2FF4259CDC6CBE7B90F1A95601EF" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\739F2FF4259CDC6CBE7B90F1A95601EF]- [targetUID: 00000000-00003592] "Y0L6f5sxdIV_1_.png" has type "PNG image data 283 x 315 8-bit colormap non-interlaced"- [targetUID: N/A] "o95MhjcKs5m_1_.js" has type "C source ASCII text with very long lines"- [targetUID: N/A] "dqd6vCA9PNV_1_.js" has type "C source ASCII text with very long lines"- [targetUID: N/A] "EVmD_liOmwc_1_.css" has type "ASCII text with very long lines"- [targetUID: N/A] "RecoveryStore._8E8D5167-96CB-11EE-AA3E-00505691BB01_.dat" has type "Composite Document File V2 Document Cannot read section info"- [targetUID: N/A] "RecoveryStore._8E39F18C-96CB-11EE-AA3E-00505691BB01_.dat" has type "Composite Document File V2 Document Cannot read section info"- [targetUID: N/A] "RecoveryStore._8E3A189C-96CB-11EE-AA3E-00505691BB01_.dat" has type "Composite Document File V2 Document Cannot read section info"- [targetUID: N/A] "favicon_4_.ico" has type "MS Windows icon resource - 2 icons 16x16 32 bits/pixel 32x32 32 bits/pixel"- [targetUID: N/A] "57C8EDB95DF3F0AD4EE2DC2B8CFD4157" has type "Microsoft Cabinet archive data Windows 2000/XP setup 4770 bytes 1 file at 0x2c +A "disallowedcert.stl" number 1 1 datablock 0x1 compression"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\57C8EDB95DF3F0AD4EE2DC2B8CFD4157]- [targetUID: 00000000-00003276] "_7C58432E-96CF-11EE-AA3E-00505691BB01_.dat" has type "Composite Document File V2 Document Cannot read section info"- [targetUID: N/A] "_DF90B3C5-96CB-11EE-AA3E-00505691BB01_.dat" has type "Composite Document File V2 Document Cannot read section info"- [targetUID: N/A] "_74B22887-96CC-11EE-AA3E-00505691BB01_.dat" has type "Composite Document File V2 Document Cannot read section info"- [targetUID: N/A] "cA_3fTtJxgp_1_.js" has type "ASCII text with very long lines"- [targetUID: N/A] "hLRJ1GG_y0J_1_.ico" has type "MS Windows icon resource - 1 icon 32x32 32 bits/pixel"- [targetUID: N/A] "fi9_yN9n_WX_1_.js" has type "ASCII text with very long lines"- [targetUID: N/A] "zyRovCtoGSI_1_.js" has type "ASCII text with very long lines"- [targetUID: N/A] "wm4d5zAAo-a_1_.js" has type "ASCII text with very long lines"- [targetUID: N/A] "skazhVdw245_1_.js" has type "ASCII text with very long lines"- [targetUID: N/A] "Registry.pol" has type "data"- Location: [%WINDIR%\System32\GroupPolicy\Machine\Registry.pol]- [targetUID: 00000000-00003736] "EQ0cyse2DGv_1_.css" has type "ASCII text with very long lines"- [targetUID: N/A] "24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA]- [targetUID: 00000000-00003096] "QcYlxMWQTQ-_1_.js" has type "ASCII text with very long lines"- [targetUID: N/A] "www.facebook_1_.xml" has type "ASCII text with very long lines with no line terminators"- [targetUID: N/A] "FEYuBywZ5D6_1_.js" has type "ASCII text with very long lines"- [targetUID: N/A] "3FPJ9YC_wUr_1_.js" has type "ASCII text with very long lines"- [targetUID: N/A] "zXvhQagBa-d_1_.css" has type "ASCII text with very long lines"- [targetUID: N/A] "BqEjD1dj1pL_1_.js" has type "ASCII text with very long lines"- [targetUID: N/A] "0270780F846F08BEFE0DD8112D932FEF" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\0270780F846F08BEFE0DD8112D932FEF]- [targetUID: 00000000-00003592] "CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA]- [targetUID: 00000000-00003096] "v75M7CPu9-P_1_.js" has type "C source ASCII text"- [targetUID: N/A] "4H14ONGE.txt" has type "ASCII text"- Location: [%APPDATA%\Microsoft\Windows\Cookies\4H14ONGE.txt]- [targetUID: 00000000-00003096] "E87CE99F124623F95572A696C80EFCAF_9E9C5BD522DEAFF0AF9BF0B0877DDF33" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\E87CE99F124623F95572A696C80EFCAF_9E9C5BD522DEAFF0AF9BF0B0877DDF33]- [targetUID: 00000000-00003096] "E87CE99F124623F95572A696C80EFCAF_9FBD3BA6168F3C4317F2AAB1E548FE96" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\E87CE99F124623F95572A696C80EFCAF_9FBD3BA6168F3C4317F2AAB1E548FE96]- [targetUID: 00000000-00003096] "80237EE4964FC9C409AAF55BF996A292_D46D6FA25B74360E1349F9015B5CCE53" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\80237EE4964FC9C409AAF55BF996A292_D46D6FA25B74360E1349F9015B5CCE53]- [targetUID: 00000000-00003276] "E2C6CBAF0AF08CF203BA74BF0D0AB6D5_0FB9553B978E7F00C6B2309507DEB64A" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_0FB9553B978E7F00C6B2309507DEB64A]- [targetUID: 00000000-00003276] "80237EE4964FC9C409AAF55BF996A292_C5130A0BDC8C859A2757D77746C10868" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\80237EE4964FC9C409AAF55BF996A292_C5130A0BDC8C859A2757D77746C10868]- [targetUID: 00000000-00003276] "F07644E38ED7C9F37D11EEC6D4335E02_EC50BC49A28D68A36F5274F1BD1417C1" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\F07644E38ED7C9F37D11EEC6D4335E02_EC50BC49A28D68A36F5274F1BD1417C1]- [targetUID: 00000000-00003096] "F2DDCD2B5F37625B82E81F4976CEE400_BFB422D89E28A298A60024A8D8A2EA06" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\F2DDCD2B5F37625B82E81F4976CEE400_BFB422D89E28A298A60024A8D8A2EA06]- [targetUID: 00000000-00003096] "7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776]- [targetUID: 00000000-00003096] "EDC238BFF48A31D55A97E1E93892934B_C20E0DA2D0F89FE526E1490F4A2EE5AB" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\EDC238BFF48A31D55A97E1E93892934B_C20E0DA2D0F89FE526E1490F4A2EE5AB]- [targetUID: 00000000-00003592] "35DDEDF268117918D1D277A171D8DF7B_B2D5A2AFC0A7FA2364E778B425CC1FD0" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\35DDEDF268117918D1D277A171D8DF7B_B2D5A2AFC0A7FA2364E778B425CC1FD0]- [targetUID: 00000000-00003592] "O287_AcFyg4_1_.png" has type "PNG image data 20 x 20 8-bit colormap non-interlaced"- [targetUID: N/A] "HNPXNTQW.txt" has type "ASCII text"- Location: [%APPDATA%\Microsoft\Windows\Cookies\HNPXNTQW.txt]- [targetUID: 00000000-00003276] "dXk5exdOVhk_1_.js" has type "ASCII text with very long lines"- [targetUID: N/A] "E2C6CBAF0AF08CF203BA74BF0D0AB6D5_0FB9553B978E7F00C6B2309507DEB64A" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_0FB9553B978E7F00C6B2309507DEB64A]- [targetUID: 00000000-00003276] "80237EE4964FC9C409AAF55BF996A292_D46D6FA25B74360E1349F9015B5CCE53" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\MetaData\80237EE4964FC9C409AAF55BF996A292_D46D6FA25B74360E1349F9015B5CCE53]- [targetUID: 00000000-00003276] "80237EE4964FC9C409AAF55BF996A292_C5130A0BDC8C859A2757D77746C10868" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\MetaData\80237EE4964FC9C409AAF55BF996A292_C5130A0BDC8C859A2757D77746C10868]- [targetUID: 00000000-00003276] "24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA]- [targetUID: 00000000-00003096] "35DDEDF268117918D1D277A171D8DF7B_B2D5A2AFC0A7FA2364E778B425CC1FD0" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\MetaData\35DDEDF268117918D1D277A171D8DF7B_B2D5A2AFC0A7FA2364E778B425CC1FD0]- [targetUID: 00000000-00003592] "E87CE99F124623F95572A696C80EFCAF_9FBD3BA6168F3C4317F2AAB1E548FE96" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\MetaData\E87CE99F124623F95572A696C80EFCAF_9FBD3BA6168F3C4317F2AAB1E548FE96]- [targetUID: 00000000-00003096] "F2DDCD2B5F37625B82E81F4976CEE400_BFB422D89E28A298A60024A8D8A2EA06" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\MetaData\F2DDCD2B5F37625B82E81F4976CEE400_BFB422D89E28A298A60024A8D8A2EA06]- [targetUID: 00000000-00003096] "E87CE99F124623F95572A696C80EFCAF_9E9C5BD522DEAFF0AF9BF0B0877DDF33" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\MetaData\E87CE99F124623F95572A696C80EFCAF_9E9C5BD522DEAFF0AF9BF0B0877DDF33]- [targetUID: 00000000-00003096] "F07644E38ED7C9F37D11EEC6D4335E02_EC50BC49A28D68A36F5274F1BD1417C1" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\MetaData\F07644E38ED7C9F37D11EEC6D4335E02_EC50BC49A28D68A36F5274F1BD1417C1]- [targetUID: 00000000-00003096] "7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776]- [targetUID: 00000000-00003096] "EDC238BFF48A31D55A97E1E93892934B_C20E0DA2D0F89FE526E1490F4A2EE5AB" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\MetaData\EDC238BFF48A31D55A97E1E93892934B_C20E0DA2D0F89FE526E1490F4A2EE5AB]- [targetUID: 00000000-00003592] "CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\MetaData\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA]- [targetUID: 00000000-00003096] "42KJUZJI.txt" has type "ASCII text"- Location: [%APPDATA%\Microsoft\Windows\Cookies\42KJUZJI.txt]- [targetUID: 00000000-00003592] "ZR770OD0.txt" has type "ASCII text"- Location: [%APPDATA%\Microsoft\Windows\Cookies\ZR770OD0.txt]- [targetUID: 00000000-00003096] "57C8EDB95DF3F0AD4EE2DC2B8CFD4157" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157]- [targetUID: 00000000-00003276] "1SZ3F8UB.txt" has type "ASCII text"- Location: [%APPDATA%\Microsoft\Windows\Cookies\1SZ3F8UB.txt]- [targetUID: 00000000-00003592] "13S8284S.txt" has type "ASCII text"- Location: [%APPDATA%\Microsoft\Windows\Cookies\13S8284S.txt]- [targetUID: 00000000-00003592] "ENSTKLU3.txt" has type "ASCII text"- Location: [%APPDATA%\Microsoft\Windows\Cookies\ENSTKLU3.txt]- [targetUID: 00000000-00003592] "YIM1LFAM.txt" has type "ASCII text"- Location: [%APPDATA%\Microsoft\Windows\Cookies\YIM1LFAM.txt]- [targetUID: 00000000-00003592] "B7JHZ6R8.txt" has type "ASCII text"- Location: [%APPDATA%\Microsoft\Windows\Cookies\B7JHZ6R8.txt]- [targetUID: 00000000-00003592] "PtmfxLVwAb7_1_.js" has type "ASCII text"- [targetUID: N/A] "0270780F846F08BEFE0DD8112D932FEF" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\MetaData\0270780F846F08BEFE0DD8112D932FEF]- [targetUID: 00000000-00003592] "YFLO1I30.txt" has type "ASCII text"- Location: [%APPDATA%\Microsoft\Windows\Cookies\YFLO1I30.txt]- [targetUID: 00000000-00003096] "BEC6224B02D155A396218A2504F3EE0B" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\MetaData\BEC6224B02D155A396218A2504F3EE0B]- [targetUID: 00000000-00003592] "739F2FF4259CDC6CBE7B90F1A95601EF" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\MetaData\739F2FF4259CDC6CBE7B90F1A95601EF]- [targetUID: 00000000-00003592] "98FRGJ5F.htm" has type "gzip compressed data original size modulo 2^32 338"- Location: [%LOCALAPPDATA%\Microsoft\Windows\Temporary Internet Files\Content.IE5\CKDNCXYS\98FRGJ5F.htm]- [targetUID: 00000000-00003096] "V62BJRVO.txt" has type "ASCII text"- Location: [%APPDATA%\Microsoft\Windows\Cookies\V62BJRVO.txt]- [targetUID: 00000000-00003096] "LVZ2068E.txt" has type "ASCII text"- Location: [%APPDATA%\Microsoft\Windows\Cookies\LVZ2068E.txt]- [targetUID: 00000000-00003096] "XAOQSOXO.txt" has type "ASCII text"- Location: [%APPDATA%\Microsoft\Windows\Cookies\XAOQSOXO.txt]- [targetUID: 00000000-00003096] "L2XVSIEZ.txt" has type "ASCII text"- Location: [%APPDATA%\Microsoft\Windows\Cookies\L2XVSIEZ.txt]- [targetUID: 00000000-00003096] "WSHALHYV.txt" has type "ASCII text"- Location: [%APPDATA%\Microsoft\Windows\Cookies\WSHALHYV.txt]- [targetUID: 00000000-00003096] "QP8TVXBW.txt" has type "ASCII text"- Location: [%APPDATA%\Microsoft\Windows\Cookies\QP8TVXBW.txt]- [targetUID: 00000000-00003096] "3122Z1HI.txt" has type "ASCII text"- Location: [%APPDATA%\Microsoft\Windows\Cookies\3122Z1HI.txt]- [targetUID: 00000000-00003096] "905Q0HNZ.txt" has type "ASCII text"- Location: [%APPDATA%\Microsoft\Windows\Cookies\905Q0HNZ.txt]- [targetUID: 00000000-00003592] "70DAE932E3BCB3C00656A27B544BA9CA" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\MetaData\70DAE932E3BCB3C00656A27B544BA9CA]- [targetUID: 00000000-00003096] "L7QU50U7.txt" has type "ASCII text"- Location: [%APPDATA%\Microsoft\Windows\Cookies\L7QU50U7.txt]- [targetUID: 00000000-00003276] "gpt.ini" has type "data"- Location: [%WINDIR%\System32\GroupPolicy\gpt.ini]- [targetUID: 00000000-00003736] "J1C52NCV.txt" has type "ASCII text"- Location: [%APPDATA%\Microsoft\Windows\Cookies\J1C52NCV.txt]- [targetUID: 00000000-00003096] "YOYHN4CD.txt" has type "ASCII text"- Location: [%APPDATA%\Microsoft\Windows\Cookies\YOYHN4CD.txt]- [targetUID: 00000000-00003096] "VZ6OS66V.txt" has type "ASCII text"- Location: [%APPDATA%\Microsoft\Windows\Cookies\VZ6OS66V.txt]- [targetUID: 00000000-00003096] "151L61J2.txt" has type "ASCII text"- Location: [%APPDATA%\Microsoft\Windows\Cookies\151L61J2.txt]- [targetUID: 00000000-00003592] "5Y53ZVBE.txt" has type "ASCII text"- Location: [%APPDATA%\Microsoft\Windows\Cookies\5Y53ZVBE.txt]- [targetUID: 00000000-00003276] "BPHHPW4H.txt" has type "ASCII text"- Location: [%APPDATA%\Microsoft\Windows\Cookies\BPHHPW4H.txt]- [targetUID: 00000000-00003276] "N803W9KN.txt" has type "ASCII text"- Location: [%APPDATA%\Microsoft\Windows\Cookies\N803W9KN.txt]- [targetUID: 00000000-00003096] "O7nelmd9XSI_1_.png" has type "PNG image data 1 x 1 1-bit colormap non-interlaced"- [targetUID: N/A] "VG4RDITL.txt" has type "ASCII text"- Location: [%APPDATA%\Microsoft\Windows\Cookies\VG4RDITL.txt]- [targetUID: 00000000-00003276] "0SDTTJFC.txt" has type "ASCII text"- Location: [%APPDATA%\Microsoft\Windows\Cookies\0SDTTJFC.txt]- [targetUID: 00000000-00003096] "IHPXNAXT.txt" has type "ASCII text"- Location: [%APPDATA%\Microsoft\Windows\Cookies\IHPXNAXT.txt]- [targetUID: 00000000-00003096] "hsts-pixel_1_.gif" has type "GIF image data version 89a 1 x 1"- [targetUID: N/A] "bscframe_1_.htm" has type "HTML document ASCII text with no line terminators"- [targetUID: N/A] "rise131M9Asphalt.tmp" has type "ASCII text with no line terminators"- Location: [%TEMP%\rise131M9Asphalt.tmp]- [targetUID: 00000000-00003736] "OfficeTrackerNMP131.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%ALLUSERSPROFILE%\OfficeTrackerNMP131\OfficeTrackerNMP131.exe]- [targetUID: 00000000-00003736] "1yz61bk1.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP003.TMP\1yz61bk1.exe]- [targetUID: 00000000-00002644] "MaxLoonaFest131.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%LOCALAPPDATA%\MaxLoonaFest131\MaxLoonaFest131.exe]- [targetUID: 00000000-00003736] "BEC6224B02D155A396218A2504F3EE0B" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\BEC6224B02D155A396218A2504F3EE0B]- [targetUID: 00000000-00003592] "favicon_1_.ico" has type "MS Windows icon resource - 2 icons 16x16 32 bits/pixel 32x32 32 bits/pixel"- [targetUID: N/A] "MZKTY89O.htm" has type "gzip compressed data original size modulo 2^32 338"- Location: [%LOCALAPPDATA%\Microsoft\Windows\Temporary Internet Files\Content.IE5\2UXTWTJR\MZKTY89O.htm]- [targetUID: 00000000-00003804] "U9EHLN1L.txt" has type "ASCII text"- Location: [%APPDATA%\Microsoft\Windows\Cookies\U9EHLN1L.txt]- [targetUID: 00000000-00003096]4b:T974,"afa6fbd86c448bceaf510ae6f8b831be.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: ""; Value: "") "afa6fbd86c448bceaf510ae6f8b831be.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SAFEBOOT\OPTION"; Key: ""; Value: "") "afa6fbd86c448bceaf510ae6f8b831be.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SRP\GP\DLL"; Key: ""; Value: "") "afa6fbd86c448bceaf510ae6f8b831be.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "afa6fbd86c448bceaf510ae6f8b831be.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "afa6fbd86c448bceaf510ae6f8b831be.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\SIDEBYSIDE\ASSEMBLYSTORAGEROOTS"; Key: ""; Value: "") "afa6fbd86c448bceaf510ae6f8b831be.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS"; Key: ""; Value: "") "afa6fbd86c448bceaf510ae6f8b831be.exe" (Access type: "OPEN"; Path: "HKCU\CONTROL PANEL\DESKTOP\MUICACHED\MACHINELANGUAGECONFIGURATION"; Key: ""; Value: "") "afa6fbd86c448bceaf510ae6f8b831be.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\MUI\SETTINGS"; Key: ""; Value: "") "afa6fbd86c448bceaf510ae6f8b831be.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\CONTROL PANEL\DESKTOP"; Key: ""; Value: "") "afa6fbd86c448bceaf510ae6f8b831be.exe" (Access type: "OPEN"; Path: "HKCU\CONTROL PANEL\DESKTOP\LANGUAGECONFIGURATION"; Key: ""; Value: "") "afa6fbd86c448bceaf510ae6f8b831be.exe" (Access type: "OPEN"; Path: "HKCU\CONTROL PANEL\DESKTOP"; Key: ""; Value: "") "afa6fbd86c448bceaf510ae6f8b831be.exe" (Access type: "OPEN"; Path: "HKCU\CONTROL PANEL\DESKTOP\MUICACHED"; Key: ""; Value: "") "afa6fbd86c448bceaf510ae6f8b831be.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: ""; Value: "") "afa6fbd86c448bceaf510ae6f8b831be.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\SIDEBYSIDE"; Key: ""; Value: "") "afa6fbd86c448bceaf510ae6f8b831be.exe" (Access type: "OPEN"; Path: "HKLM"; Key: ""; Value: "") "afa6fbd86c448bceaf510ae6f8b831be.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\DIAGNOSTICS"; Key: ""; Value: "")4c:T681,"schtasks.exe" (Access type: "OPEN"; Path: "HKCU\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}"; Key: ""; Value: "") "schtasks.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}"; Key: ""; Value: "") "schtasks.exe" (Access type: "OPEN"; Path: "HKCU\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\TREATAS"; Key: ""; Value: "") "schtasks.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\TREATAS"; Key: ""; Value: "") "schtasks.exe" (Access type: "OPEN"; Path: "HKCU\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\PROGID"; Key: ""; Value: "") "schtasks.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\PROGID"; Key: ""; Value: "") "schtasks.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\PROGID"; Key: ""; Value: "") "schtasks.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}"; Key: ""; Value: "") "schtasks.exe" (Access type: "OPEN"; Path: "HKCU\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\INPROCSERVER32"; Key: ""; Value: "") "schtasks.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\INPROCSERVER32"; Key: ""; Value: "") "schtasks.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\INPROCSERVER32"; Key: "INPROCSERVER32"; Value: "") "schtasks.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\INPROCSERVER32"; Key: ""; Value: "")4d:Te12,"afa6fbd86c448bceaf510ae6f8b831be.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "CWDILLEGALINDLLSEARCH"; Value: "") "afa6fbd86c448bceaf510ae6f8b831be.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED"; Value: "") "afa6fbd86c448bceaf510ae6f8b831be.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS"; Key: "SHOWDEBUGINFO"; Value: "") "afa6fbd86c448bceaf510ae6f8b831be.exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP"; Key: "PREFERREDUILANGUAGES"; Value: "") "afa6fbd86c448bceaf510ae6f8b831be.exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP\MUICACHED"; Key: "MACHINEPREFERREDUILANGUAGES"; Value: "") "afa6fbd86c448bceaf510ae6f8b831be.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: "COMPATDLL"; Value: "") "afa6fbd86c448bceaf510ae6f8b831be.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: "00060101.00060101"; Value: "") "afa6fbd86c448bceaf510ae6f8b831be.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: ""; Value: "") "afa6fbd86c448bceaf510ae6f8b831be.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\SIDEBYSIDE"; Key: "PREFEREXTERNALMANIFEST"; Value: "") "afa6fbd86c448bceaf510ae6f8b831be.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "SAFEDLLSEARCHMODE"; Value: "") "afa6fbd86c448bceaf510ae6f8b831be.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\GRE_INITIALIZE"; Key: "DISABLEMETAFILES"; Value: "") "afa6fbd86c448bceaf510ae6f8b831be.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\COMPATIBILITY32"; Key: "AFA6FBD86C448BCEAF510AE6F8B831BE"; Value: "") "afa6fbd86c448bceaf510ae6f8b831be.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINDOWS"; Key: "LOADAPPINIT_DLLS"; Value: "") "afa6fbd86c448bceaf510ae6f8b831be.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE"; Key: "PAGEALLOCATORUSESYSTEMHEAP"; Value: "") "afa6fbd86c448bceaf510ae6f8b831be.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE"; Key: "PAGEALLOCATORSYSTEMHEAPISPRIVATE"; Value: "") "afa6fbd86c448bceaf510ae6f8b831be.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\WINDOWS ERROR REPORTING\WMR"; Key: "DISABLE"; Value: "") "afa6fbd86c448bceaf510ae6f8b831be.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\SETUP"; Key: "SOURCEPATH"; Value: "") "afa6fbd86c448bceaf510ae6f8b831be.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION"; Key: "DEVICEPATH"; Value: "") "afa6fbd86c448bceaf510ae6f8b831be.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US"; Value: "") "afa6fbd86c448bceaf510ae6f8b831be.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US"; Value: "") "afa6fbd86c448bceaf510ae6f8b831be.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\DATACOLLECTION"; Key: "COMMERCIALDATAOPTIN"; Value: "") "afa6fbd86c448bceaf510ae6f8b831be.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "PENDINGFILERENAMEOPERATIONS"; Value: "")4e:T95a,"afa6fbd86c448bceaf510ae6f8b831be.exe" trying to touch file "C:\Windows\SYSTEM32\sechost.dll" "afa6fbd86c448bceaf510ae6f8b831be.exe" trying to touch file "C:\afa6fbd86c448bceaf510ae6f8b831be.exe.Local\" "afa6fbd86c448bceaf510ae6f8b831be.exe" trying to touch file "C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18837_none_41e855142bd5705d" "afa6fbd86c448bceaf510ae6f8b831be.exe" trying to touch file "C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18837_none_41e855142bd5705d\COMCTL32.dll" "afa6fbd86c448bceaf510ae6f8b831be.exe" trying to touch file "C:\Cabinet.dll" "afa6fbd86c448bceaf510ae6f8b831be.exe" trying to touch file "C:\Windows\system32\Cabinet.dll" "afa6fbd86c448bceaf510ae6f8b831be.exe" trying to touch file "C:\VERSION.dll" "afa6fbd86c448bceaf510ae6f8b831be.exe" trying to touch file "C:\Windows\system32\VERSION.dll" "afa6fbd86c448bceaf510ae6f8b831be.exe" trying to touch file "C:\Windows\system32\apphelp.dll" "afa6fbd86c448bceaf510ae6f8b831be.exe" trying to touch file "C:\Windows\AppPatch\sysmain.sdb" "afa6fbd86c448bceaf510ae6f8b831be.exe" trying to touch file "C:\Windows\AppPatch\AcLayers.DLL" "afa6fbd86c448bceaf510ae6f8b831be.exe" trying to touch file "C:\SspiCli.dll" "afa6fbd86c448bceaf510ae6f8b831be.exe" trying to touch file "C:\Windows\system32\SspiCli.dll" "afa6fbd86c448bceaf510ae6f8b831be.exe" trying to touch file "C:\WINSPOOL.DRV" "afa6fbd86c448bceaf510ae6f8b831be.exe" trying to touch file "C:\Windows\system32\WINSPOOL.DRV" "afa6fbd86c448bceaf510ae6f8b831be.exe" trying to touch file "C:\MPR.dll" "afa6fbd86c448bceaf510ae6f8b831be.exe" trying to touch file "C:\Windows\system32\MPR.dll" "afa6fbd86c448bceaf510ae6f8b831be.exe" trying to touch file "C:\Windows\AppPatch\AcGenral.DLL" "afa6fbd86c448bceaf510ae6f8b831be.exe" trying to touch file "C:\UxTheme.dll" "afa6fbd86c448bceaf510ae6f8b831be.exe" trying to touch file "C:\Windows\system32\UxTheme.dll" "afa6fbd86c448bceaf510ae6f8b831be.exe" trying to touch file "C:\WINMM.dll" "afa6fbd86c448bceaf510ae6f8b831be.exe" trying to touch file "C:\Windows\system32\WINMM.dll" "afa6fbd86c448bceaf510ae6f8b831be.exe" trying to touch file "C:\samcli.dll" "afa6fbd86c448bceaf510ae6f8b831be.exe" trying to touch file "C:\Windows\system32\samcli.dll" "afa6fbd86c448bceaf510ae6f8b831be.exe" trying to touch file "C:\MSACM32.dll"4f:T875,"afa6fbd86c448bceaf510ae6f8b831be.exe" trying to access non-existent file "C:\Cabinet.dll" "afa6fbd86c448bceaf510ae6f8b831be.exe" trying to access non-existent file "C:\VERSION.dll" "afa6fbd86c448bceaf510ae6f8b831be.exe" trying to access non-existent file "C:\SspiCli.dll" "afa6fbd86c448bceaf510ae6f8b831be.exe" trying to access non-existent file "C:\MPR.dll" "afa6fbd86c448bceaf510ae6f8b831be.exe" trying to access non-existent file "C:\UxTheme.dll" "afa6fbd86c448bceaf510ae6f8b831be.exe" trying to access non-existent file "C:\WINMM.dll" "afa6fbd86c448bceaf510ae6f8b831be.exe" trying to access non-existent file "C:\samcli.dll" "afa6fbd86c448bceaf510ae6f8b831be.exe" trying to access non-existent file "C:\MSACM32.dll" "afa6fbd86c448bceaf510ae6f8b831be.exe" trying to access non-existent file "C:\sfc.dll" "afa6fbd86c448bceaf510ae6f8b831be.exe" trying to access non-existent file "C:\sfc_os.DLL" "afa6fbd86c448bceaf510ae6f8b831be.exe" trying to access non-existent file "C:\dwmapi.dll" "afa6fbd86c448bceaf510ae6f8b831be.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP\tB0lu63.exe" "afa6fbd86c448bceaf510ae6f8b831be.exe" trying to access non-existent file "C:\FLTLIB.DLL" "afa6fbd86c448bceaf510ae6f8b831be.exe" trying to access non-existent file "C:\Windows\system32\api-ms-win-core-fibers-l1-1-1.DLL" "afa6fbd86c448bceaf510ae6f8b831be.exe" trying to access non-existent file "C:\Windows\system32\api-ms-win-core-localization-l1-2-1.DLL" "afa6fbd86c448bceaf510ae6f8b831be.exe" trying to access non-existent file "\Device\HarddiskVolume2\CABINET.DLL" "afa6fbd86c448bceaf510ae6f8b831be.exe" trying to access non-existent file "\Device\HarddiskVolume2\VERSION.DLL" "afa6fbd86c448bceaf510ae6f8b831be.exe" trying to access non-existent file "\Device\HarddiskVolume2\SSPICLI.DLL" "afa6fbd86c448bceaf510ae6f8b831be.exe" trying to access non-existent file "\Device\HarddiskVolume2\MPR.DLL" "afa6fbd86c448bceaf510ae6f8b831be.exe" trying to access non-existent file "\Device\HarddiskVolume2\UXTHEME.DLL" "afa6fbd86c448bceaf510ae6f8b831be.exe" trying to access non-existent file "\Device\HarddiskVolume2\WINMM.DLL"50:T991,"afa6fbd86c448bceaf510ae6f8b831be.exe" trying to access non-existent file "C:\afa6fbd86c448bceaf510ae6f8b831be.exe.Local\" "afa6fbd86c448bceaf510ae6f8b831be.exe" trying to access non-existent file "C:\WINSPOOL.DRV" "afa6fbd86c448bceaf510ae6f8b831be.exe" trying to access non-existent file "C:\afa6fbd86c448bceaf510ae6f8b831be.exe.Config" "afa6fbd86c448bceaf510ae6f8b831be.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP" "afa6fbd86c448bceaf510ae6f8b831be.exe" trying to access non-existent file "\Device\HarddiskVolume2\AFA6FBD86C448BCEAF510AE6F8B831BE.EXE.LOCAL" "afa6fbd86c448bceaf510ae6f8b831be.exe" trying to access non-existent file "\Device\HarddiskVolume2\WINSPOOL.DRV" "afa6fbd86c448bceaf510ae6f8b831be.exe" trying to access non-existent file "\Device\HarddiskVolume2\AFA6FBD86C448BCEAF510AE6F8B831BE.EXE.CONFIG" "afa6fbd86c448bceaf510ae6f8b831be.exe" trying to access non-existent file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP" "tB0lu63.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP\tB0lu63.exe.Local\" "tB0lu63.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP\WINSPOOL.DRV" "tB0lu63.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP\tB0lu63.exe.Config" "tB0lu63.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP001.TMP" "tB0lu63.exe" trying to access non-existent file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP\TB0LU63.EXE.LOCAL" "tB0lu63.exe" trying to access non-existent file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP\WINSPOOL.DRV" "tB0lu63.exe" trying to access non-existent file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP\TB0LU63.EXE.CONFIG" "tB0lu63.exe" trying to access non-existent file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\IXP001.TMP" "qP8xB26.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP001.TMP\qP8xB26.exe.Local\" "qP8xB26.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP001.TMP\WINSPOOL.DRV" "qP8xB26.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP001.TMP\qP8xB26.exe.Config" "qP8xB26.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP002.TMP"51:T42a,"1yz61bk1.exe" called "WinHttpSendRequest" with parameters {"hRequest": "2e72e8" "dwHeadersLength": "0" "dwOptionalLength": "0" "dwTotalLength": "0" "dwContext": "0" "$error": "2f8f"} "1yz61bk1.exe" called "WinHttpSendRequest" with parameters {"hRequest": "2f0248" "dwHeadersLength": "0" "dwOptionalLength": "0" "dwTotalLength": "0" "dwContext": "0"} "1yz61bk1.exe" called "WinHttpSendRequest" with parameters {"hRequest": "3256f8" "dwHeadersLength": "0" "dwOptionalLength": "0" "dwTotalLength": "0" "dwContext": "0"} "4hV149il.exe" called "WinHttpSendRequest" with parameters {"hRequest": "5cb080" "dwHeadersLength": "0" "dwOptionalLength": "0" "dwTotalLength": "0" "dwContext": "0" "$error": "2f8f"} "4hV149il.exe" called "WinHttpSendRequest" with parameters {"hRequest": "5d56e0" "dwHeadersLength": "0" "dwOptionalLength": "0" "dwTotalLength": "0" "dwContext": "0"} "4hV149il.exe" called "WinHttpSendRequest" with parameters {"hRequest": "63a950" "dwHeadersLength": "0" "dwOptionalLength": "0" "dwTotalLength": "0" "dwContext": "0"}52:T43b,Found http requests in header "GET /geoip/v2.1/city/me" Found http requests in header "GET /gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D" Found http requests in header "GET /gtsr1/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBQwkcLWD4LqGJ7bE7B1XZsEbmfwUAQU5K8rJnEaK0gnhS9SZizv8IkTcT4CDQIDvFNZazTHGPUBUGY%3D" Found http requests in header "GET /gts1c3/moVDfISia2k.crl" Found http requests in header "GET /gts1c3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEBZwXm7t3kKEEFjsmHQeLcQ%3D" Found http requests in header "GET /gts1c3/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEQClj3zJOwEs2AlR6v%2BfUXog" Found http requests in header "GET /gts1c3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEDEixfO34qnbCeE6N8VMp00%3D" Found http requests in header "GET /gts1c3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEGpYRvzN3kAuEMlMWsqSFLc%3D"53:T3e32,Found requests in header "GET /demo/home.php?s=67.218.111.202 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: db-ip.com"; in File: "SSL") Found requests in header "GET /ServiceLogin?passive=1209600&continue=https%3A%2F%2Faccounts.google.com%2F&followup=https%3A%2F%2Faccounts.google.com%2F HTTP/1.1Accept: text/html, application/xhtml+xml, */*User-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateDNT: 1Host: accounts.google.comCookie: __Host-GAPS=1:12uSrMFGA1zKQbyOCw7hbD8ONRmbdQ:V7N_W1A21Nbo1EheConnection: Keep-AliveAccept-Language: en-US"; in File: "SSL") Found requests in header "GET /InteractiveLogin?continue=https://accounts.google.com/&followup=https://accounts.google.com/&passive=1209600&ifkv=ASKXGp2Jodese1-YquoZm5lH5OiBTaTX6t5thgkCEND3mmQBfcuUaji0l5VdQu5KxN4DiNiiTW8h HTTP/1.1Accept: text/html, application/xhtml+xml, */*User-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateDNT: 1Host: accounts.google.comCookie: __Host-GAPS=1:jzWowutDdFhfLYGMesropLRclRvwuA:GcFpuUFW_GiqixvaConnection: Keep-AliveAccept-Language: en-US"; in File: "SSL") Found requests in header "GET /v3/signin/identifier?continue=https%3A%2F%2Faccounts.google.com%2F&followup=https%3A%2F%2Faccounts.google.com%2F&ifkv=ASKXGp1-X14OzAYZRRk85M7088CJDaO9nGq-vtpyYayj-Lm-y5iWoIgH_B0iyXK4Zh4dfZapzYTV&passive=1209600&flowName=GlifWebSignIn&flowEntry=ServiceLogin&dsh=S-234202157%3A1702154766168130&theme=glif HTTP/1.1Accept: text/html, application/xhtml+xml, */*User-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateDNT: 1Host: accounts.google.comCookie: __Host-GAPS=1:jzWowutDdFhfLYGMesropLRclRvwuA:GcFpuUFW_GiqixvaConnection: Keep-AliveAccept-Language: en-US"; in File: "SSL") Found requests in header "GET /ServiceLogin?passive=1209600&continue=https%3A%2F%2Faccounts.google.com%2F&followup=https%3A%2F%2Faccounts.google.com%2F HTTP/1.1Accept: text/html, application/xhtml+xml, */*Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: accounts.google.comCookie: __Host-GAPS=1:6YYvMTE2WtELVQT7BzvmvKDj_rHZ0w:pTHcDlA9hvPCZVMWConnection: Keep-AliveDNT: 1"; in File: "SSL") Found requests in header "GET /InteractiveLogin?continue=https://accounts.google.com/&followup=https://accounts.google.com/&passive=1209600&ifkv=ASKXGp2yWBYNsON9vu8-lVeqkPsECZC_HMHENvR5LL_fpo03JMEsYmuMxGNUZgQPJIjekj3YBOK87w HTTP/1.1Accept: text/html, application/xhtml+xml, */*Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: accounts.google.comConnection: Keep-AliveDNT: 1Cookie: __Host-GAPS=1:6YYvMTE2WtELVQT7BzvmvKDj_rHZ0w:pTHcDlA9hvPCZVMW"; in File: "SSL") Found requests in header "GET / HTTP/1.1Accept: text/html, application/xhtml+xml, */*Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: accounts.google.comDNT: 1Connection: Keep-Alive"; in File: "SSL") Found requests in header "GET /v3/signin/identifier?continue=https%3A%2F%2Faccounts.google.com%2F&followup=https%3A%2F%2Faccounts.google.com%2F&ifkv=ASKXGp1MyKRCX_FQv7nQeXChAg172YLAwKiFIMn9dq9BqeENDl7zCl9YWjKv0vHlUBt-fMww7m0jZA&passive=1209600&flowName=GlifWebSignIn&flowEntry=ServiceLogin&dsh=S789491184%3A1702154767530904&theme=glif HTTP/1.1Accept: text/html, application/xhtml+xml, */*Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: accounts.google.comDNT: 1Connection: Keep-AliveCookie: __Host-GAPS=1:6YYvMTE2WtELVQT7BzvmvKDj_rHZ0w:pTHcDlA9hvPCZVMW"; in File: "SSL") Found requests in header "GET /favicon.ico HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoHost: accounts.google.comDNT: 1Connection: Keep-AliveCookie: __Host-GAPS=1:6YYvMTE2WtELVQT7BzvmvKDj_rHZ0w:pTHcDlA9hvPCZVMW"; in File: "SSL") Found requests in header "POST /v3/signin/_/AccountsSignInUi/data/batchexecute?rpcids=UEkKwb&source-path=%2Fv3%2Fsignin%2Fidentifier&f.sid=-4982841501737134946&bl=boq_identityfrontendauthuiserver_20231203.08_p0&hl=en-US&_reqid=75137&rt=c HTTP/1.1Accept: */*X-Same-Domain: 1x-goog-ext-278367001-jspb: ["GlifWebSignIn"]x-goog-ext-391502476-jspb: ["S-234202157:1702154766168130",null,null,"ASKXGp1-X14OzAYZRRk85M7088CJDaO9nGq-vtpyYayj-Lm-y5iWoIgH_B0iyXK4Zh4dfZapzYTV"]Content-Type: application/x-www-form-urlencoded;charset=utf-8Referer: https://accounts.google.com/Accept-Language: en-USAccept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoHost: accounts.google.comContent-Length: 165DNT: 1Connection: Keep-AliveCache-Control: no-cacheCookie: __Host-GAPS=1:6YYvMTE2WtELVQT7BzvmvKDj_rHZ0w:pTHcDlA9hvPCZVMW; OTZ=7330792_52_52_123900_48_436380"; in File: "SSL") Found requests in header "GET /_/bscframe HTTP/1.1Accept: text/html, application/xhtml+xml, */*Referer: https://accounts.google.com/Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: accounts.google.comDNT: 1Connection: Keep-AliveCookie: __Host-GAPS=1:6YYvMTE2WtELVQT7BzvmvKDj_rHZ0w:pTHcDlA9hvPCZVMW; OTZ=7330792_52_52_123900_48_436380"; in File: "SSL") Found requests in header "POST /v3/signin/_/AccountsSignInUi/reporthttp4xxerror?url=https%3A%2F%2Faccounts.google.com%2Fv3%2Fsignin%2F_%2FAccountsSignInUi%2Fdata%2Fbatchexecute%3Frpcids%3DUEkKwb%26source-path%3D%252Fv3%252Fsignin%252Fidentifier%26f.sid%3D-4982841501737134946%26bl%3Dboq_identityfrontendauthuiserver_20231203.08_p0%26hl%3Den-US%26_reqid%3D75137%26rt%3Dc&status=400&traceid HTTP/1.1Accept: */*Content-Type: application/x-www-form-urlencoded;charset=utf-8Referer: https://accounts.google.com/Accept-Language: en-USAccept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoHost: accounts.google.comContent-Length: 0DNT: 1Connection: Keep-AliveCache-Control: no-cacheCookie: __Host-GAPS=1:6YYvMTE2WtELVQT7BzvmvKDj_rHZ0w:pTHcDlA9hvPCZVMW; OTZ=7330792_52_52_123900_48_436380"; in File: "SSL") Found requests in header "POST /v3/signin/_/AccountsSignInUi/jserror?script=https%3A%2F%2Faccounts.google.com%2Fv3%2Fsignin%2Fidentifier%3Fcontinue%3Dhttps%253A%252F%252Faccounts.google.com%252F%26followup%3Dhttps%253A%252F%252Faccounts.google.com%252F%26ifkv%3DASKXGp1-X14OzAYZRRk85M7088CJDaO9nGq-vtpyYayj-Lm-y5iWoIgH_B0iyXK4Zh4dfZapzYTV%26passive%3D1209600%26flowName%3DGlifWebSignIn%26flowEntry%3DServiceLogin%26dsh%3DS-234202157%253A1702154766168130%26theme%3Dglif&error=qb%60https%3A%2F%2Faccounts.google.com%2Fv3%2Fsignin%2F_%2FAccountsSignInUi%2Fdata%2Fbatchexecute%3Frpcids%3DUEkKwb%26source-path%3D%252Fv3%252Fsignin%252Fidentifier%26f.sid%3D-4982841501737134946%26bl%3Dboq_identityfrontendauthuiserver_20231203.08_p0%26hl%3Den-US%26_reqid%3D75137%26rt%3Dc%60400&line=Not%20available HTTP/1.1Accept: */*Content-Type: application/x-www-form-urlencoded;charset=utf-8Referer: https://accounts.google.com/Accept-Language: en-USAccept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoHost: accounts.google.comContent-Length: 8291DNT: 1Connection: Keep-AliveCache-Control: no-cacheCookie: __Host-GAPS=1:6YYvMTE2WtELVQT7BzvmvKDj_rHZ0w:pTHcDlA9hvPCZVMW; OTZ=7330792_52_52_123900_48_436380"; in File: "SSL") Found requests in header "POST /v3/signin/_/AccountsSignInUi/jserror?script=https%3A%2F%2Faccounts.google.com%2Fv3%2Fsignin%2Fidentifier%3Fcontinue%3Dhttps%253A%252F%252Faccounts.google.com%252F%26followup%3Dhttps%253A%252F%252Faccounts.google.com%252F%26ifkv%3DASKXGp1-X14OzAYZRRk85M7088CJDaO9nGq-vtpyYayj-Lm-y5iWoIgH_B0iyXK4Zh4dfZapzYTV%26passive%3D1209600%26flowName%3DGlifWebSignIn%26flowEntry%3DServiceLogin%26dsh%3DS-234202157%253A1702154766168130%26theme%3Dglif&error=qb%60https%3A%2F%2Faccounts.google.com%2Fv3%2Fsignin%2F_%2FAccountsSignInUi%2Fdata%2Fbatchexecute%3Frpcids%3DUEkKwb%26source-path%3D%252Fv3%252Fsignin%252Fidentifier%26f.sid%3D-4982841501737134946%26bl%3Dboq_identityfrontendauthuiserver_20231203.08_p0%26hl%3Den-US%26_reqid%3D75137%26rt%3Dc%60400&line=Not%20available HTTP/1.1Accept: */*Content-Type: application/x-www-form-urlencoded;charset=utf-8Referer: https://accounts.google.com/Accept-Language: en-USAccept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoHost: accounts.google.comContent-Length: 8296DNT: 1Connection: Keep-AliveCache-Control: no-cacheCookie: __Host-GAPS=1:6YYvMTE2WtELVQT7BzvmvKDj_rHZ0w:pTHcDlA9hvPCZVMW; OTZ=7330792_52_52_123900_48_436380"; in File: "SSL") Found requests in header "GET /generate_204?FRPWhQ HTTP/1.1Accept: image/png, image/svg+xml, image/*;q=0.8, */*;q=0.5Referer: https://accounts.google.com/Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: accounts.google.comDNT: 1Connection: Keep-AliveCookie: __Host-GAPS=1:75Lxtv7dSZGugD4rDd54OwOCDCuViQ:WlVf-olYNC1MTcQ3; OTZ=7330792_52_52_123900_48_436380; NID=511=tNjvruqZGBLtFftB9v76erC2UfK0GEMbQ_BfymUC91LPiGFNszQEBnT8ZKd5GxRNLAJSNx2ufFm-QK0iyhrU5TTi3KGLl2Mz9O0scTyIk-8muKlpPt8M0Kx9qeEVeg60pfODDOGWyi-X2iYzCzg4PewrrHoZN9-LveyGKrGcjoY"; in File: "SSL") Found requests in header "POST /v3/signin/_/AccountsSignInUi/data/batchexecute?rpcids=UEkKwb&source-path=%2Fv3%2Fsignin%2Fidentifier&f.sid=-2508367394189711371&bl=boq_identityfrontendauthuiserver_20231203.08_p0&hl=en-US&_reqid=75139&rt=c HTTP/1.1Accept: */*X-Same-Domain: 1x-goog-ext-278367001-jspb: ["GlifWebSignIn"]x-goog-ext-391502476-jspb: ["S789491184:1702154767530904",null,null,"ASKXGp1MyKRCX_FQv7nQeXChAg172YLAwKiFIMn9dq9BqeENDl7zCl9YWjKv0vHlUBt-fMww7m0jZA"]Content-Type: application/x-www-form-urlencoded;charset=utf-8Referer: https://accounts.google.com/Accept-Language: en-USAccept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoHost: accounts.google.comContent-Length: 164DNT: 1Connection: Keep-AliveCache-Control: no-cacheCookie: __Host-GAPS=1:6YYvMTE2WtELVQT7BzvmvKDj_rHZ0w:pTHcDlA9hvPCZVMW; OTZ=7330792_52_52_123900_48_436380; NID=511=tNjvruqZGBLtFftB9v76erC2UfK0GEMbQ_BfymUC91LPiGFNszQEBnT8ZKd5GxRNLAJSNx2ufFm-QK0iyhrU5TTi3KGLl2Mz9O0scTyIk-8muKlpPt8M0Kx9qeEVeg60pfODDOGWyi-X2iYzCzg4PewrrHoZN9-LveyGKrGcjoY"; in File: "SSL") Found requests in header "GET /_/bscframe HTTP/1.1Accept: text/html, application/xhtml+xml, */*Referer: https://accounts.google.com/Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: accounts.google.comDNT: 1Connection: Keep-AliveCookie: __Host-GAPS=1:6YYvMTE2WtELVQT7BzvmvKDj_rHZ0w:pTHcDlA9hvPCZVMW; OTZ=7330792_52_52_123900_48_436380; NID=511=tNjvruqZGBLtFftB9v76erC2UfK0GEMbQ_BfymUC91LPiGFNszQEBnT8ZKd5GxRNLAJSNx2ufFm-QK0iyhrU5TTi3KGLl2Mz9O0scTyIk-8muKlpPt8M0Kx9qeEVeg60pfODDOGWyi-X2iYzCzg4PewrrHoZN9-LveyGKrGcjoY"; in File: "SSL") Found requests in header "GET /generate_204?WuzAOQ HTTP/1.1Accept: image/png, image/svg+xml, image/*;q=0.8, */*;q=0.5Referer: https://accounts.google.com/Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: accounts.google.comDNT: 1Connection: Keep-AliveCookie: __Host-GAPS=1:75Lxtv7dSZGugD4rDd54OwOCDCuViQ:WlVf-olYNC1MTcQ3; OTZ=7330792_52_52_123900_48_436380; NID=511=tNjvruqZGBLtFftB9v76erC2UfK0GEMbQ_BfymUC91LPiGFNszQEBnT8ZKd5GxRNLAJSNx2ufFm-QK0iyhrU5TTi3KGLl2Mz9O0scTyIk-8muKlpPt8M0Kx9qeEVeg60pfODDOGWyi-X2iYzCzg4PewrrHoZN9-LveyGKrGcjoY"; in File: "SSL") Found requests in header "GET /v3/signin/_/AccountsSignInUi/gen204/?tmambps=0.001062015503875969&rtembps=-1&rttms=1 HTTP/1.1Accept: image/png, image/svg+xml, image/*;q=0.8, */*;q=0.5Referer: https://accounts.google.com/Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: accounts.google.comDNT: 1Connection: Keep-AliveCookie: __Host-GAPS=1:75Lxtv7dSZGugD4rDd54OwOCDCuViQ:WlVf-olYNC1MTcQ3; OTZ=7330792_52_52_123900_48_436380; NID=511=tNjvruqZGBLtFftB9v76erC2UfK0GEMbQ_BfymUC91LPiGFNszQEBnT8ZKd5GxRNLAJSNx2ufFm-QK0iyhrU5TTi3KGLl2Mz9O0scTyIk-8muKlpPt8M0Kx9qeEVeg60pfODDOGWyi-X2iYzCzg4PewrrHoZN9-LveyGKrGcjoY"; in File: "SSL") Found requests in header "GET /login HTTP/1.1Accept: text/html, application/xhtml+xml, */*User-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateDNT: 1Host: www.facebook.comConnection: Keep-AliveAccept-Language: en-US"; in File: "SSL") Found requests in header "POST /login/device-based/regular/login/?login_attempt=1&lwv=100 HTTP/1.1Accept: text/html, application/xhtml+xml, */*Referer: https://www.facebook.com/loginAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoContent-Type: application/x-www-form-urlencodedAccept-Encoding: gzip, deflateHost: www.facebook.comContent-Length: 392DNT: 1Connection: Keep-AliveCache-Control: no-cacheCookie: fr=028OKYOjTTwf5RiBz..BldNIM.MC.AAA.0.0.BldNIM.AWVrUBXupFo; sb=DNJ0ZRANmuoFymQq0xtK-7Uh; _js_datr=DNJ0ZcZqom8JZ-uYU3MGThSkjazoest=21005&lsd=AVpzDHQvlXU&display=&isprivate=&return_session=&skip_api_login=&signed_next=&trynum=1&timezone=&lgndim=eyJ3IjoxMjgwLCJoIjo4MDAsImF3IjoxMjgwLCJhaCI6NzYwLCJjIjoyNH0%3D&lgnrnd=124604_CI3G&lgnjs=n&email=&pass=&login=1&prefill_contact_point=&prefill_source=&prefill_type=&first_prefill_source=&first_prefill_type=&had_cp_prefilled=false&had_password_prefilled=false&ab_test_data="; in File: "SSL") Found requests in header "POST /login/device-based/regular/login/?login_attempt=1&lwv=120&lwc=1348028 HTTP/1.1Accept: text/html, application/xhtml+xml, */*Referer: https://www.facebook.com/login/device-based/regular/login/?login_attempt=1&lwv=100Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoContent-Type: application/x-www-form-urlencodedAccept-Encoding: gzip, deflateHost: www.facebook.comContent-Length: 392DNT: 1Connection: Keep-AliveCache-Control: no-cacheCookie: fr=028OKYOjTTwf5RiBz..BldNIM.MC.AAA.0.0.BldNIp.AWVdNa0R69Y; sb=DNJ0ZRANmuoFymQq0xtK-7Uh; datr=DNJ0ZcZqom8JZ-uYU3MGThSk"; in File: "SSL") Found requests in header "POST /login/device-based/regular/login/?login_attempt=1&lwv=120&lwc=1348028 HTTP/1.1Accept: text/html, application/xhtml+xml, */*Referer: https://www.facebook.com/login/device-based/regular/login/?login_attempt=1&lwv=120&lwc=1348028Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoContent-Type: application/x-www-form-urlencodedAccept-Encoding: gzip, deflateHost: www.facebook.comContent-Length: 392DNT: 1Connection: Keep-AliveCache-Control: no-cacheCookie: fr=028OKYOjTTwf5RiBz..BldNIM.MC.AAA.0.0.BldNJH.AWX6fKaXAHU; sb=DNJ0ZRANmuoFymQq0xtK-7Uh; datr=DNJ0ZcZqom8JZ-uYU3MGThSk"; in File: "SSL") Found requests in header "GET /rsrc.php/v3/y0/l/0,cross/2pRVSwAv5Rj.css?_nc_x=Ij3Wp8lg5Kz HTTP/1.1Accept: text/css, */*Referer: https://www.facebook.com/loginAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: static.xx.fbcdn.netDNT: 1Connection: Keep-Alive"; in File: "SSL") Found requests in header "GET /rsrc.php/v3/y1/l/0,cross/GFdzeQQcoxa.css?_nc_x=Ij3Wp8lg5Kz HTTP/1.1Accept: text/css, */*Referer: https://www.facebook.com/loginAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: static.xx.fbcdn.netDNT: 1Connection: Keep-Alive"; in File: "SSL")54:Tc27,Found reference to API "WSASend" (Indicator: "WSASend"; Source: "00000000-00003736-00000C26-54277585") Found reference to API "WSARecv" (Indicator: "WSARecv"; Source: "00000000-00003736-00000C26-54278390") Found reference to API "InternetOpenA" (Indicator: "InternetOpen"; Source: "00000000-00003088-00000C26-62490776") Found reference to API "HttpOpenRequestA" (Indicator: "HttpOpenRequest"; Source: "00000000-00003088-00000C26-62491812") Found reference to API "InternetConnectA" (Indicator: "InternetConnect"; Source: "00000000-00003088-00000C26-62492300") Found reference to API "InternetOpenUrlA" (Indicator: "InternetOpen"; Source: "00000000-00003088-00000C26-62492788") Found reference to API "HttpQueryInfoA" (Indicator: "HttpQueryInfo"; Source: "00000000-00003088-00000C26-62493271") Found reference to API "HttpSendRequestA" (Indicator: "HttpSendRequest"; Source: "00000000-00003088-00000C26-62494243") Found reference to API "InternetReadFile" (Indicator: "InternetReadFile"; Source: "00000000-00003088-00000C26-62494721") Found reference to API "WinHttpConnect" (Indicator: "WinHttpConnect"; Source: "00000000-00003088-00000C26-63509535") Found reference to API "WinHttpQueryHeaders" (Indicator: "WinHttpQueryHeaders"; Source: "00000000-00003088-00000C26-63510276") Found reference to API "WinHttpOpen" (Indicator: "WinHttpOpen"; Source: "00000000-00003088-00000C26-63510812") Found reference to API "WinHttpOpenRequest" (Indicator: "HttpOpenRequest"; Source: "00000000-00003088-00000C26-63511323") Found reference to API "WinHttpOpenRequest" (Indicator: "WinHttpOpen"; Source: "00000000-00003088-00000C26-63511323") Found reference to API "WinHttpOpenRequest" (Indicator: "WinHttpOpenRequest"; Source: "00000000-00003088-00000C26-63511323") Found reference to API "WinHttpSendRequest" (Indicator: "HttpSendRequest"; Source: "00000000-00003088-00000C26-63512371") Found reference to API "WinHttpSendRequest" (Indicator: "WinHttpSendRequest"; Source: "00000000-00003088-00000C26-63512371") Found reference to API "WinHttpReadData" (Indicator: "WinHttpReadData"; Source: "00000000-00003088-00000C26-63513451") Found reference to API "InternetOpenW" (Indicator: "InternetOpen"; Source: "00000000-00001512.00000000.67840.00E5C000.00000002.mdmp") Found reference to API "HttpQueryInfoW" (Indicator: "HttpQueryInfo"; Source: "00000000-00001512.00000000.67840.00E5C000.00000002.mdmp") Found reference to API "InternetConnectW" (Indicator: "InternetConnect"; Source: "00000000-00001512.00000000.67840.00E5C000.00000002.mdmp") Found reference to API "HttpOpenRequestW" (Indicator: "HttpOpenRequest"; Source: "00000000-00001512.00000000.67840.00E5C000.00000002.mdmp") Found reference to API "HttpSendRequestW" (Indicator: "HttpSendRequest"; Source: "00000000-00001512.00000000.67840.00E5C000.00000002.mdmp") Found reference to API "InternetOpenUrlW" (Indicator: "InternetOpen"; Source: "00000000-00001512.00000000.67840.00E5C000.00000002.mdmp") Found reference to API "InternetReadFile" (Indicator: "InternetReadFile"; Source: "00000000-00001512.00000000.67840.00E5C000.00000002.mdmp")55:T8e2f,"GET /demo/home.php?s=67.218.111.202 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: db-ip.com" "HTTP/1.1 200 OKDate: Sat, 09 Dec 2023 20:45:24 GMTContent-Type: application/jsonTransfer-Encoding: chunkedConnection: keep-alivex-iplb-request-id: AC479F38:E06A_93878F2E:0050_6574D1E4_3626D3B:03FFx-iplb-instance: 30783CF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=D%2B600UWi1AAwjzaIyEJDvIHX3zlV9aRm%2FPjnK3cAWffOiJkFZXJyifyjj4R0xUpClYNIKVCtnmdegZm3%2BoRSnQJjSVMfdkol0p8LN9%2B6k5VgaNiQJuLFS66JCA%3D%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 833017744faffad2-SJCalt-svc: h3=":443"; ma=864004f{"status":"ok","demoInfo":{"error":"over query limit please try again later"}}" "HTTP/1.1 200 OKDate: Sat, 09 Dec 2023 20:45:34 GMTContent-Type: application/jsonTransfer-Encoding: chunkedConnection: keep-alivex-iplb-request-id: AC458630:29C8_93878F2E:0050_6574D1EE_35A1D1E:BDC9x-iplb-instance: 30782CF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Pn%2FJARVRNXcy8DleS%2B3S3o7IUOIoxWJb%2B%2BK8yx7StpoQMtbS5CrRq%2BWxCQle6cfThu4tGyRPVithRM357455ma2%2FPsorEtFs0empiLR8JDOhuWd0p2so8LfB7g%3D%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 833017af9ba196a8-SJCalt-svc: h3=":443"; ma=864004f{"status":"ok","demoInfo":{"error":"over query limit please try again later"}}" "0000000100000001�0000000100000001000000010000000100000001000000011e4��PAj�0��B!=ZN��u��X�K_E�1��ax%�u��~�7Q�8z�IN��#��_�o�d��)��2�Q|&��Ht@ΨfƑNZ��:eJ;�F�ĘTg�l�"��5{�i��f7Jk��6y|H�;��g��f�4��s%˳��À��x��fL�Y�ž�K��P�/��@�R", "GET /ServiceLogin?passive=1209600&continue=https%3A%2F%2Faccounts.google.com%2F&followup=https%3A%2F%2Faccounts.google.com%2F HTTP/1.1Accept: text/html application/xhtml+xml */*User-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip deflateDNT: 1Host: accounts.google.comCookie: __Host-GAPS=1:12uSrMFGA1zKQbyOCw7hbD8ONRmbdQ:V7N_W1A21Nbo1EheConnection: Keep-AliveAccept-Language: en-US", "GET /InteractiveLogin?continue=https://accounts.google.com/&followup=https://accounts.google.com/&passive=1209600&ifkv=ASKXGp2Jodese1-YquoZm5lH5OiBTaTX6t5thgkCEND3mmQBfcuUaji0l5VdQu5KxN4DiNiiTW8h HTTP/1.1Accept: text/html application/xhtml+xml */*User-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip deflateDNT: 1Host: accounts.google.comCookie: __Host-GAPS=1:jzWowutDdFhfLYGMesropLRclRvwuA:GcFpuUFW_GiqixvaConnection: Keep-AliveAccept-Language: en-US", "GET /v3/signin/identifier?continue=https%3A%2F%2Faccounts.google.com%2F&followup=https%3A%2F%2Faccounts.google.com%2F&ifkv=ASKXGp1-X14OzAYZRRk85M7088CJDaO9nGq-vtpyYayj-Lm-y5iWoIgH_B0iyXK4Zh4dfZapzYTV&passive=1209600&flowName=GlifWebSignIn&flowEntry=ServiceLogin&dsh=S-234202157%3A1702154766168130&theme=glif HTTP/1.1Accept: text/html application/xhtml+xml */*User-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip deflateDNT: 1Host: accounts.google.comCookie: __Host-GAPS=1:jzWowutDdFhfLYGMesropLRclRvwuA:GcFpuUFW_GiqixvaConnection: Keep-AliveAccept-Language: en-US", "0000000100000001�0000000100000001000000010000000100000001000000010000bab��X[wں~ﯠ^�)��C�P(�\��d[�|��4��,N/��ѧѧ��hħ��ѵ�Su�ϟ�o�F�)�͍�BJ'�,�4`#��'��!�~xv|�4͛�4̛�g�8�y��x�%�1�t0E)9X`")�s)v�,x1��P�OS:�(GtYPL]H��q��UY�??��.�J��yI\�[�o;�i{*�6=%�^��w�U�L�B�'N��d�8+��T��c��?·�p��i�P-IeQ:)�H��i�.��3�)h߆��s3e��S�X@H�\9�ǖ��,N@栲7:1Na��־��el]�0�p�ќZ��&��+�͛͊�4hs�b� ��ət¾��JE�T��Xi�i��>�j�R9�� j�D��z��&Xju��Ʈ�ǝ��T�k-��Pe�t�>��|t綝}|,�Ke�R��Q?�h��<`�V?�"�xR(�!n��w7��|�zUh��!��d\�ڋU�� P_:��n��?��U#�?l��BOn�0~�F�7��'��ǟ��`o��>Ճ��q��I>�C�Zޢ��~��~�/'��T:�f�.��f�r��(�]�&�D/��~"��iV�c}�[T�o�i�{��(t��z��b��ї�BM$�)�C��$ܜ�~H%0g�@K�qz��s1�(�bE�e�)gKY��hM4�5�l�zg��F�0�Rg]��2վ��8��:Za��&�+��&ڨ:/o�p�D�x��>C0�p׃x$��I��6�F�!EGt��^w�gsR�'f�6�M�y��?62�qo��*u|��*�XҸ��&nb�6�;�.�*x��ͭ��Ᾱ܋CEM��=:N`�Pհ��k?neXoz"n�9��-�y�(!��x�ĝ�_��,=�A�苹ɰD_!��e�Z.ֻ�W�ax6t�~�4��ޏ��/m]k"�7��cq�3�fA|m��苑7�|�Ę.�AxZH�7��]y�o{�1�m:s�;�'��+��c��ؾ>��ζicJ��<�Ea��C�[��6�`GY��8Z��B�h܈��'�:��=��=$!��q7:�q{O+�?a8�]��7�s��8��<.8]��]��z��5PIƅX��q�lX��y��-�fF�Be�0�]y��҃��鿡�?�|(6�?*p$t�t��D2h"��C�x�H�&�-V�", "�ao�&��ë��/��RS��r�D�V�M�?u۳܂��{�~�u�ܺLn��E9��`�t��FQjM�E�>��yp�� 7�#��;��.��x'��d'q��&��ެ�-��%.O�Z��{.��S}��%1�טATE�'�51ռ�QE��%}B��G��?(��Ő�'�N�f��4z��X@o��Y��Y��M7�_~U�>��J�ZO-Ƣ~q�U�s��+..;�^��>�WEZnm��pX=W��z��.��e�Y�+\Y��ʪ|Ѩ�z�sW3��N1�rD��}�ܬ��B��4_~��݉8S��.h��=g��A/�h�.'-�_��ۯZ�ޚ*��Zҭ1��j`�SҬV6��s��x�ڊ=�➫ul�Qx�u��(�{�� r�|�P�A��cvf��ӿ��_��Z��OF�j��f�].�k��[rӰ.��6�骳��ڌ��>�?fv��_2ic�F�.�y�8q*��)$�l��>�5�@]֖��L�aM��Z��B��e��Hϻ��o� j��澕wт��:��ږ^|0��nj�?�Mg��.^��@$��vҙ��L7�3/�Ho��9��ۣ)��j23�"f>�S��:�̮��5˩GGi��ObГ�=?��l5ὦ�X�yEy�E�p�P�S!��UH�E�uǁ�c��;#༅�:��9�i!�#.4!��/ǈ�1x�lւ,˘QO�l��;��߬��V��4�嵦=��~��?��p��;$�-djj>|�:�CY-S��Fz�eK�(�2�7��h@��7��oQD��l֘�/�.l8i}3-<�6��6�_@��τ��H{��Y��p�0�Y��:�I��:��Rt�Y��@P]O^�@3��晆��`}�fC��b�rV�,c�-LL��[��Ԃ>��-��1��3��p[�hD�\�[�X{��Z�op�l�mlп S@��<\3@L=?��RXR�l�e�H��5�Ō��rrD��Uf6O��mˎ��ۘ1>�i(%�/�5~��~��H�cn��[H��e5T�w�e�Nm�ڏ�摮��"��c~�F�?"�k5��k�#��r#�Ktvb��P��E��&�#�3��8�0R�7��W}�ٜ�^��#A~x��"��?�&��O(>ptZ4H�q�c� �^diӛ��$8�p�Ge)P��^3y�v�Z$��鏍�5�ԏ�{ݱ%��[^�uJN}T�Yn��V�ǚ)2�:R��n��|G��}~925��_��G-��rz�ue�/wq>�B%t.��VS�s�o�4�ǩ6�B��[�p�u��", "00000001�00000001]0000000100000001s00000001�0000000160000000100000001�00000001+00000001�00000001v00000001:00000001c00000001M0000000100000001�00000001�00000001�00000001(01017�f�N�v��q��P"%3:KJ�4�$ x��n��82I�=<��{��/�AH�%��#�o4�G��%xe��"9�.��~��b��A��#��C?��)Y��FM�ߟ[7�M��ŏ3��ҽ>x4�`s��߇��*��o.f��̾�_��7��T�-�W��2��$�-u�}�yɝ��a<��q6�{��p Xd�ߦ��8�f6��-X�<0��M��e� �9�T�]@��f��л��3�ۆi��a5`�u� B�H��'��:��&�8�f��x{p�:&�]/��.3��Y|��f��r匠��n�گ��}I%�ED�ރj�:U�zA�5��v��j�i�6�悯W��Y�d�oR�Q��_�$ݷ2�S�%��|�ҟ��YL�~�]�`�},��oE��Mv��e�I*#^z�?�ञ!��lcJ�0\�`�a��j��K��/�5�fh+��j>�x��au�a�l�1tF�I�R)��Q��E}��@�Yq4��?�)��8��~�r�u��H1��c�EX"K&��=3˃ɹg@N:�GҀ�k��]�U��G_=��ɧ�S�g�/!��DW��[D��Eo�q��(b vU}I�k�6RS(�K'pCC�u��ʳ��Ժ��8\hF�< jNd��yF{З5@�2�_��d�⺪o��Ro��% �L$\@�FI��'��?��yO��Ķq� e{B��E�ë�L��`��#��N��t��+R��2"R��,1T`��IX�3�ޯ��H�w��!�g�6Ms��a_6��2��ȥ��^�E8w�Gqe��f[^`�IM�-�^yݷ#�u�8|�'��r�'��/G0cΦ��$J�$ ^̾e+*4�0˖I]�Pd��ی��:#T�d�/��U��Z��J�q'3��V�f��'��w�=�HL��n,��0<��cX��n��j��Gj��q>ܷ�Օx"��H=��8��9�ܣoΟ�^", "��oi�e�y�0+��l;�u�\��s�J@�$��n�]�l:�#Οz��ܹiv�@�1�>�t��GL�Ξ�@%c��kx��O��w��HUu��ঘd#��;�|Be� ��g��TP��WH��Ђ^��9XD 㾱Q��l�m��st��_�{�� |�/)�7A��?�6!d#�f�hM��\Hjkiv�w��|�f(%�w�[VQt��:Q�3�Ѽ�m��g�6��3*��z��V��1D��bM�,jK��m��ͥ�6�#��O8��͏�>��^m�L௽yH��g�w5��D��& ��@�ۀz��*�8Wwu��N��Վ�+�r#%Ĳ��]��?A��(DjT�$��٥��>��kzԨ8�/�#�8?��a�t��\��bd&�?u�7��5��G�E��Qk��-��}LE-��H��CE��7��k�vV��' ��M5�� I�)W��/��=�H�\� ?cБI�f@y��=��%��3U��'��uS�0Ӥ)P�i�U�ou�;��w��R꜃�V�X1%m��4��]�T��.�R֠D�4'��QSj]��Z��\�:ޚBu��1�l��-��j��4�4�#�r��)��6�2�{y�ڱu��۵�)$�55r��NmMG@��B@�-�R�ҖW(Њj{Q��_��bh��Eh�T�P}�/hӡ�^)0vL�.;��`�pV+��!��se��ԟ��;c�}�焕lӋ��6gí8��17Q��j��mԿ2#�d��ز��p�n+�ϔ�u�iND2c[]f�Ƃ�9�nϠdo�D_<�g5�ʻ�$)>{|ώߊx�3��z`sx�b�6*M�M��|˚��7�qq��f�s�� {��Ĩ+��J)�"֪��<�_GR��V"��JZ]BN"Ż��:#��G��i��\֥�1�w�.5��oË�^��/�Kr�d˜��f�]t��QC��ex��/��s�&�s��8��pk'�\a?�RE��?%+��>�ް�4��@�v/l��zVӰ�Nߢ��p�a°��T��:]^��YFm�'�_{�]��P�Y��w��$�=�M�>��]�|��'n�j)O-O��1-C>��S;l*��G�k�q��1�Z�tE�ږ+ޏ��W�w��=��l��' q�cwҗe�+�ZF4n�<��,�ެd4�,�&rq��?��" "\§�F7�^��I-��{��-�kH= G�f��<��-x?~I��1M��%��Y��`�H4�n�bE��㸂��&=K�sn��n�'nsP�d�־e��RP*�5��!#ۮ2/�5��\�Ai9z�.]O$�U<(�w�D*�ߗ��7Ǌw�t�AhǦ:�@g� h��qX��^\a�^B��Y��ò��"%�.��K��@M��#��Ѭ��n��J~<��˩�u;i��;g�ھ;OP��E��{:0E]�=�U�q�6�t��Y1�Y6& $��`��X3DH�s[{��c��|}��Z]5 � ȍu�v�0�"��R��Q��=iP ��$U��\��S/��]�(n�AJ2S�(E�U"L��]�)!��]w�r)��??X��>�`��ko��R0BT�X�Iʅ }��TBA��%Cmq��Ðe�C��=3�@щ�SJ�DL�"�<˄/��4��,��,3��˄�ດ.�=Ą�i!@E��p��S,Mr#Ke\��lC��,b�LV��DV"� #ww*)Ԗs0jvGP�6�:s��e��jl�F�A�j�y^�l��.�r�&)�r��c��C��F��S��ΩXq8(?i��2y1��δ��k��Ϥ�G/]��d��E^�_<߹N��^�0�q��'��wfûe�؎"|~xǧ6��1t@1Y9�F��o{<=ۯ��h�\�*��5,�c�-�){�o2�`uC��#K1�I�2�I�?�O�/��{��d��kݶ�}�mUo�w ��M(`CH��%�d��M�V$�\r[��i�F�e��!�%��xx"u�D�!-��jZݘ��%F�w�h��\�J�K��h�Vi�7��{�v֦ү%ߝ�?�zu$��l^�/�{�x�,3V��zqCƁg�i�܆�`9�.J��1H�пp�74��2R/^�#X�6�#p��B�C�4��D�l�]�'%>�ɓM�̇��wULْ9�uB8j�;]�٭xXru��}4G>"\�͠d/DK�z�w��x�YM�B�*�F�N_e��Z�*��._P��*�$s��l�Ϫ�ȚwQQ��5_Fq��Hw3%N�rS၉=��m�?�f��Q�%��9d��}O��(�kk�{��Y ��x33�sI%L<��}�M�q~pg�P��ֺ<�,�U�:�L�ݘ_m��olO?�}%�L��U�q��>'QUM��q�DqQ`��\f=�ҽ�(U.�W��In+�=t�S�(u�-4�r��b��U�fsV��X�o��e�", "d:��b߭��ߦŅ-��rQM��F?�rQ��j��E��R.��_v�ǫ?�#i�@��a��#?�6�F�w�.�9��5��3~a|��v��Ĵ�j��djj"�uy^t+,)՜��W8�f��BW�n��FZ�p��m�s�+J�8EUN[Ƕ��%�Ĕh�Zׄ�b��*�3�nWŝ��"�b��" "00000001�00000001]00000001m00000001o00000001�0000000160000000100000001�00000001+00000001�00000001R00000001�000000010008f3�T�c׉1`ɲ"뚶i�vE��M'Nb;��"��EJ")�E�V��/w��(ňӹ��D��Y��6�g�x�W��V��"'u��F�A�+F�*:�fFWX��c`��ō9��C5B��j��;̑��j�T�͘��j ��|v��6��O� -�R�;�V{�o��ۛ��L�n+�;�vP��UD�\I��%�N;y��3�Z9��iW�sa��u��4B=A��l��A��QW�GZ�tZ��DOB9x�Ǣ�>��ZXk�`��f�M2�0��.}?`*�~�P��E�_�_��7�/�S�f��@��/�X��ٌ�Df�<`'-;w��h�0��7��X�Չ}@��!�9��wZ+GܲM�R�R��.��V.�W}T�κ}P�d.V�k�p�H�>��5�h�c�A>��5C��{w�膁T8Un��0�^��v،<Ì��e��m�촂di��2/��K�p�;�BNڣ��,��L��8�.t��[��Ѕz��Z�зtfK��q2N8�j BN��ӯ��9��i;4q��"�]1��#��q�{w��!N8Un��0�^�y�u̞}��Nw7�鑁{��[�ˈ?$gؑ��6��A�Kg�Q��'�>��.X�kɓbO��|�R�]��j{R��Ndn��p �'&��,��+a��!z��4�.6�5�>��p��37�f�iv��qqw�p�/�`�m��E>��>\}�E�՞�l��Ĝ��a-zY�n��5ּ��-��D}��s1c�9߀�A�[��3�:7�d�@A�7�t�WX�3�a}��qk�>�\�m�3�?��*��0Cd�g@�_m�X��$WQ��S�<��7�OGw��KK$��~�1�*�Gaz�|~M�<4K��ߢE�~�h�%PA@$��:��y~X��Ǹ�)�(Ơ�U�^07�]��M�xz��ƶ��̆�$��9��|Ჟ}Q6��%�P$4�~�b��&t�~�v8흔��W�R]��>8g��j-Q>5�N��W��S��.�ҥ��f�", "�Z�K]�#��:Ɛ��2�9��}>��P�)�_�{�Y��8{��B�0w-�Ҧ�U滬��m�vB+φڐ�4�a_��NOa��Z��ٺ��o��4ʘ"@��"�K]� UVkEE�4>��f��{聄�Zq+I#H3��O}��1�Wl�8f�o��@Z?s��;�6H�� i��٪�8��t2K|P�.��l�'(��Ɲ��@S��xF)aåE}ɾ0�Bl�7�H _��Q�%�X�.��ͭ�A��L6� f�!��n��h��4G(��oސھ��X�v��1��<�,G��iE��p�TB��۳dv�O�B��-n'Ho��]��`TE��&��z�D�v]탍l�P(�O&"�*��ec9-A+��,T�cuء�7��>q��mVw��0��V�>�hE�H�,��0VM�/Q��z��t:�n��[M��rꍓ��0w��oBV�r��rSқNn�S��/��#ycA��Yj.��HA��Hǋ�JGz L�σ�@�@&�h�$�x�h祛oEw>�̾�b�3�_�#tʰ�I/��r�4J!!��m:�e�K��x1cy��u��q[��KD��0^\#�B�Đ8V��<��IѐM��y`H촷�/Zr;�sT;β��"�a�.C��/q�Ύ�3Kh.H�x��ӆ�ps6I��L��n�� Ѧe��5ZD��t/��p��@�w�|6��V��]�h�A�V�X*��QO�ĭ�n��V�WPɐT%�~<�,��RyԙM4}I�9��Ӗj��߳||��\?|��jpGhƗ�@b�y_A\&�r Ѵ�`{�}�.w�(5��2��L��cƦQ�k��|H��s�,aB�qyM�@��Mo+�X��an��/9m�GNe,Z2��G��4�l��d�?��", "00000001�00000001]00000001Y00cbf��6�+�ڗU��")i$��>��8>��xk�[y��M��sW��"W��hykS�dD��F��@7HB�o~��]�>��!JU�5li��/��h��/-��ǹ��A?��oZF�/g�=�hn�RP��0�:��X��tuN��V)*X��X�y�!5��XHM��U��*�4]،�:]4p��Ny�^v,}&�V�4kA*K59R�*(��[��0�qO�s��ؐRʷ��'��yf��#��P��X�w�C��ֲQ!�G�6 ��Rj�%S8�z@C��ں��T75�q�L�U�Ue3��8�_�r�3ꓛ��>�4 ��%�8<��:_m��5��v@�l�Vz�V8?�ed�p6-ڎ�is8ϰ��cl�l��5��MLg��zq$nb<��D+��*�lK�y��"�R�ݎ�Fאw�j^��}C��M<(��`uGA�3��(��kV�B��<0Z�K:�N��c��Q��TcI�Wg��Y*��ٓ��W�/Id��ѥXa�+®�?*��Ǻ�g�l�ޯ��Q��J73�/��FŢC6E��K:3�^��E�;I)NP�6~w9��.5��b�^C (�H1��j�!�;l�I��,�A��k||��O�'��X�s�K��q��$-��[]�K�k*�k;q�EAr?�/=e.7��`��n��f��6#�E��,��]#�"��$[��$�ǷhJ��8ǐ��l��J5�Gc�ϟ�O��9vpZ�R�nS�J��Evga��v"�,δ��{*IF"��iX#�Ul�oL]`��Ga�'I��Z��JW9嫬|�S��61�ǧ�ZJ}:[��ݫ�S9�![�U�Nq�W��j�^k"Z=�/�Yk��,J��N��՞�ȱO�W:��S&�3}��P��Mب}�SC��C�a��^+��g@��j��M�5�T�J��ƃ�>%x��*�3�P`&�.q��h��r:��^N�P;�[�SnCr��)��"��#��\è��[��&��-�C�$��sm�Q�?!��S�", "�[=5d��⧇=c��?A;�rSd5K�a��W��ʳ�yڕ$xrnyFVu��9�Ђ��<8d�q�2��"S��U��ʫ�M��2�(Nf׆AV��j|�'Cí��.��5�uy��a8��c��ǳ�׊��F��U��Ok��J��F+��ʖ�%�4�7@��;p[�k�!צ��`u�?l��al�L�ܓQ��ﳃ��mN��k} �kR�G��R��74R�uq;�®��}^��Lh�<��t�FZՅ^\N�wۑ-�뇺[b�vz�_��V��>B��GT�=�h>V]0��yH��9��,��괒��9�@�Hh�mw��E�c��N��^s�?��z�D��h�@��?��q�v&�a�o(�*o�!~��DC��:�٦�ޥ�4/~O�R�L��m��%1k�P0�O��/>�:��Wg��U��>/��YeB��oW�մ��?�Y�GGI��|ZTz�w�S/ᒖ�z�~[>�I�i�K�f2��??�9��5��o��9�'S3h7��@L|w�:��*_��d��=��VIT|w-�B��MO��-B�'�T�a��MHk�і:�x��$�$�F?��;�n�k�Bi��9�E��h�/j��+yC�e�R��$�t�n`[�v��J��R&\��7?��s��>��Z5�d�a��f�XkB&�Ef�J��M��d�V)��z�I��n��l�; ^д�O��[��5��~D`ͳ$KWQ��)��HQ&qN�h��p?!��T�+�я��&�?��Xu��}~Qe(��G��!IŐ�~��wF?_�#̤��ƧP�W�A32��5[��f��*�{��_N'��1�zi��#�'�%�Q�CF��VyڞT�:ԟ��NX��D��R��*��h��Ir�^��b��#�&��cqK|S��j]�AYSf��&�'=��Xb�?_OӏK��^�굘�o~8��;��Y/J��`�f�1��ǧ��JXsjyu�4A�P��ݿ?�Q�{��J^RV�p�R.��%c��O#��Z}��F��[)�o��?*g��$��f�н��)L˫��oı(*^wP�׀�pM�P��5�b4�&zg��t@q�3�LÕ7+�;��v��B��p'm��]�k��ص��|��.a1�$r��^�cj��1;�E��[��=��~�ᠢj��Q0fe��S��oG�aۧ:��Ař�O�޼��.�p��W΂@8�", "�JfWwk��c8�p��pvy7�\��z��yA�!9b�5��΀3{�+�K��b0��>��`�_��N�T�k;��Zd�:Ae��0�~�9��!��q��[�in�xE2u;��!7��R>r��S8��#�a6o��O�� '!ӹ��W!S��h�]B8'͍/��R�{j��<�C"�n��g��ӿƛ`}�2,�'��YV�[�l�Ҳ*4L�B�Kq;-�m��ĭи�V��q#t��-��n�r�n��Mc3T�-o�=�6-CJ�3�0)B00000001�00000001�00000001�00000001`00000001�00000001�00001�2544AB��n(�A��k't�]�ڕWR�k��zW�MOL8$/Vk�!ʊ��Ϛ��DH�+Ҡ��i��-W��ԋT3��G��8[\7ʔٟ(ˬ_��J�]z�0F!�S:k�*��5rU��*�m8j�٣vyo��u��wf�o��Vԭ�@��l;��95��L�\~nt�|�Z��}6.��/_~�wy�mՒ�#�W#�}��D��EZ�y��dT�Ț�տv��)��j?�>o�m�rU2xV=�kuZ��ջ�&�@�>e��&*9��klM l�@�� [G�N��f%Mmg��W�B�3�0�wM�mn^�Q��G��O�b`bN��x��4CL��8�0�#��^�8�]��D'��E,�z�{!��.z ��r=Db=�9�!��D$�Y�h�Oxa~��9??H/K�Gz�yN(̋��a�"?#�@gec��"�H.�4��4�v�z�j��O��iO�р�k�\��0P|��JB��ar��iJ弝~Y|_��؏�s8F��=Ǣ��"�H绘H�ؗ�{�Q��t��O9��@ٿ��O^��X��US?X��<�%�z̖��p��fĶ��/<�|^|�,� ��l�<��Xq��Gp�Դ��/��W4��O.��n��<��8`��G/��>k�/�w�?G�KB�Og�o�Vۗ�0^fak/��p�Iw�v�8��ȉ�Q��n�\��%?I֟Bo=�i[��yS�I;��L�\_��K�|�/��JZ2�7��R�u:�e�M��JҾz�0�~�z}�e�Q|�5q�o�ck�-��o�[�$��_��y?u��M/��ǳ$�˸��p��vu:��.xu�?�?M��>�H��}R&��Y�(&%f�g9��N\�!:ڽ=)C��J'A*��yy/�7s$��E��R��z�/�KJ��DQs�N�Y��u`{�d", "��L(`9ډ�!�Fo{\Y2lŜ/��$w��B.Ir_D��*��,[��#��i��0��Ddp�,rHK��R�K�S��d��O��í�$~BF�[HL�Z��X[+q(�5̲zj��$��4�G>��S��C��V�K��/��)�xy$�g�3ZLp��>8$��T�]��oa"��1_$T�0��V>�;��E��1�ԯ�)��s�*ǘ��\�Bl&E�F�N��ʻ�/G��yCJz��"&Ci��<�^�W�C��8��x��q��t.��<��n�^��5�y��S�XSK'sy�U1�3;=�?gC�@@2*uo�#CH��6�"C`��!Ql�W�5�c"`��ҹ�rZ5�yO2l��Ȑ�>0�߀!e ��75�v��A��evg��n�7��1[��XM��oX�o(�t.�\�oV��@�ӂ�Z:�-~#�;��7`H@�A�o�UX,�*�.��n�7��1[��XM��oX�o(�t.�\�oV��@�c�&(��H��&z��^��vX�Rf1H��~�/��$$GN�pU��$��r*�-��}a��", "00000001�00000001]00527Mo�@�+>&��Fm%��KU�JI�67l��k��#��Bf��0&=��of�7<�㝡jIĴ$�/��[��%E�@�CkId`�ZRm�իZ3@��0�Z3�%�l�{�t��L��Z�5�f�\��uS��ӓ��U_��D��I��$�/��[��'E�@�#Y[F�-Վ��jK��n�}jK��L�҄I�72��4ܠЖD��iK�r,�/r�"w�%�bڒŗ�ͭSז�n �hKd��R��߫�4@ڨ%�0L��\��n�j�~��C]�''/K�,��I"w��%�b�ŗ�ͭS��n ��Kd��e�a@]j��^�D��e�'�V�a��ƴ��~raY'�s>�v�K�Q�G:Mcb��&��[+h��0�c�ƴw�W�Lc�V��R9��|�Vʆ�H�N�/��K��>��ܧ��Sy�8cO��ؗ��î��;SV})cww�40\�J&#\�X;G��f��%z|��U�i��ЗJ��l�p��5d3޵��s�o�+�3�M�D�yf<|O`ƃ��f��_�(<3��饌�:V��Ydn�z�V4c\�2��>[`�:��C��Y�`j3�Aҍ>{ɜ�0�z�\��M��??�'��N%�_�E�^}��W-��b��&��2;n�e$�Ψ�k��+#?��V�5]Q�~V�:-�v�Z�Vl��>��O1��G(-�V�vCtfs9��%(KU��(0,}Q`X"��F�!ɭ��ü��EA!��BR��d*IT��(,$MQXH��Ki��4Ϩ��p�b��"��E�3��%�F,��u�Tp�-^��%�v�Br�Y�c!��,ݱp�Ƌ��(��GQf��#(��u��ѓY�:C��;�[�3٣��=��w"̱�H��Rv��4��L��p�X��Ӈ��\jn6Q�=�T��d�8\��1��Ժ:/�^��eW��^/5��K��_�e��Fy�E%��v5��&��wE��яW�t_ޕ�Uj�_�`�r��]T-t��T߱�$��(��$zN�Y�U�FN�$��"��%��]fk�V�z��kqÔ��O�Q�H�o��%��O��ya��dӭ�߾��Z��y��R�4�nBk]un��_zOw�֗K��(*)"��,�(�T�f�r�[e�C��v�K�D��E�`�~��P]}u��Q+��qQ��O�G��?��" "00000001�00000001]00000001[00000001�00000001�0000000160000000100000001�00000001+00000001�00000001t00000001:0000001�7f2�1��,,˾4��$M7Is�$y3Xt��Kl �L�{%߰��%��>-�ҹ��|G>��S��fh�ͮ��ݑ7��1�f��_ޙ�E�AG��̦��pLW��7�\�7��Z�~��,֫NO�1��@0u�qJG��S�M�-�^;��M�*l;#P;+4{@0��I�76?��}�wE�*�m�TmF��˖:f�<�F��98��S�&fG�I4��~QU~��끙��k��bC��jS%��$�f�߅�0��yO��y�H�Ц&O^��I��r��-N��t1Y��պ�:8v��=M?n}��*��2��!�J�*IG�demr�#)p��X:�-q0��M��UN�3��'��.r��uPM�N��6]~��jb�8!�z�F�fy��3d�C�]�"`�זܓskf8?��1�`M�^��Bà6(Ӻ^j$ܠ��$S'(�7l">P�EI�@%��܁�|�Zu�չ�Ts��|��r��o��wb[��m��L8�T�uK^J�a�j��y��_�ed|I,-)�KU��Z�k�^ߺ%^�0A�x� [I�o!^�T�Pͅ��ŤƂ��P[�ո�^�U��)� �=��B-��r؂7��\��u>U�<�E��C8X�u�k��H�K;ZS�x��4q�̲��3X�v`��ZzD�=R�D��~\i��ņ��z��i�Z�6�:�ĵ�Ÿ-p��@|��=FeJy��T�s�u)Ix~�g�'��P�$Ʊ��ӭ>7�{~�pw�.��UY -SHP h`�D]��:�:�N�/f��Y��e��+Qb�kA�f��z��/��h0�?F��i��J��ի7��̚w�ޚ��댾�-3#�u7��5�H:Rz}yk1��ӫ��'��r`oxu��51�լ;�޾��<�y��s)�� 8��u=f��~}z;~�7�o��V�}vG�5��B"E��)D4i��-{��Tb�/�&7��#m��PZ��p�DKTu��=q�U��δy�ی��q'!�17;��^n�/v%X&��g�|c��v��.�R��_�[a�v�.��'�~L� C��" "ʻ��q�^��*F�#<��+]�$-[�R��Ip+j��ҩe�#��gl��{d�{�z_�Xq�|��wR�3�~��_��\kl�,@g".��T&??b�� EKg�$�0"��]��R&a�i�c�.{�_��r�W*�%��/-�[��hS�~��4+�}��Ni�z��[�^��nK�o�_ҿ?��Lg��}�_�ݔF��ԘY��ѻ�x�Z(O˰��ǚr�8k=v��6Y��2<�s��6��T՛X/��W�tݵ35&$��z�B��9�|��4�͕�ȷeN#��9��Q�l�OZ]��kEcջl��Ћ��tG�ϡ��!��.�;��;�*�{��E��E��=sr�y��σ��gƜ��??�g��??�g"D�Q�x�QT�ǀo�*�KepU��1G�s��GD��R��g�R�_Ó??D��\$��\$�/��x��O�\$��\$<5�"�%�"�!�.>�z��"M{�R`b�Г�58zB�I�7=!��g*��|�sGOH>�耣'$�t\��Έ�W�a�$A5�dQ�6A5�dQ�$A��AU��8/'`�L�R�s'qr��S�+��}��QKo'��aa�$t��@�$4� �$4D��$4p��$4�Ò��G@f�hZ_�Xs!�E8�N/��2[��>0��X�e(��X�e(HI�$c�5�h&c(c�5��'c(c�5��(c(c�5�/ O}�+8mH9�?��" "00000001�00000001]00000001�00000001j00000001�0000000100000000100000001�00000001�000000010000000100000001�0001c3!�/��B�G'��!��{�]Q�i�;;qA��H��w$��o5�U�<ˬ�0��Y��[�O0�yk3aX�!̳��êa�%�LV��4)��a�0��˿&��a�2$׎#4� �tQg+0Ѥ�M-*0��M�(0�d�S��m��}��8�2r��`h8��i0c��U��;�8Ӌ�{��c/>?t��燋��б;��R,~#��x-�~��*ۢE0�H�۰P�X�A��i�P�,n��5��౳ٮ�說Ӥ��f�sg�H��.�y�Pb6��ϸ��i��>3�9(3Z��3��5�rH��{G�75�#�Iw�(��ʳm6ml�ͩE�X8Y��&m=��p�\"��wb��_�b��;��"56:T5095,Pattern match: "https://www.facebook.com/login" Pattern match: "https://accounts.google.com/" Heuristic match: "^s7a.bN" Heuristic match: "-sM%.sK" Pattern match: "http://www.w3.org/2000/svg" Pattern match: "https://www.facebook.com/legal/license/aJoeSHn7XcN/__d" Pattern match: "https://www.facebook.com/legal/license/WRsJ32R7YJG/__d" Pattern match: "rsrc.php/v3/yB/r/TwAHgQi2ZPB.png" Pattern match: "http://crls.pki.goog/gts1c3/moVDfISia2k.crl.f" Pattern match: "http://crl3.digicert.com/sha2-ha-server-g6.crl.http://crl4.digicert.com/sha2-ha-server-g6.crl0" Pattern match: "rsrc.php/v3/yL/r/unHwF9CkMyM.png" Pattern match: "NOFORMmicrosoft.com/102433237894403108561027971357230938743SRCHUIDV=2&GUID=426377958C8445E3B4EA69482BD0E747&dmnchg=1microsoft.com/102433237894403108561027971357230938743SRCHUSRDOB=20220131microsoft.com/102433237894403108561027971357230938743SRCHHPGUSRSRCHL" Pattern match: "028OKYOjTTwf5RiBz..BldNIM.MC.AAA.0.0.BldNIM.AWVrUBXupFofacebook.com/921727352140803109314583324119231075033DNJ0ZRANmuoFymQq0xtK-7Uhfacebook.com/921742796682243115550683433319431075033_js_datrDNJ0ZcZqom8JZ-uYU3MGThSkfacebook.com/1089202443929631155499863193" Pattern match: "028OKYOjTTwf5RiBz..BldNIM.MC.AAA.0.0.BldNJH.AWX6fKaXAHUfacebook.com/9217332521408031093145251556276731075034DNJ0ZRANmuoFymQq0xtK-7Uhfacebook.com/921742796682243115550683433319431075033datrDNJ0ZcZqom8JZ-uYU3MGThSkfacebook.com/9217274700928311555071724301480" Pattern match: "028OKYOjTTwf5RiBz..BldNIM.MC.AAA.0.0.BldNIp.AWVdNa0R69Yfacebook.com/9217302521408031093145172445748031075033DNJ0ZRANmuoFymQq0xtK-7Uhfacebook.com/921742796682243115550683433319431075033datrDNJ0ZcZqom8JZ-uYU3MGThSkfacebook.com/9217274700928311555071724301480" Pattern match: "9217362521408031093145212160805031075035DNJ0ZRANmuoFymQq0xtK-7Uhfacebook.com/921742796682243115550683433319431075033datrDNJ0ZcZqom8JZ-uYU3MGThSkfacebook.com/921727470092831155507172430148031075033" Pattern match: "028OKYOjTTwf5RiBz..BldNIM.MC.AAA.0.0.BldNIM.AWVrUBXupFofacebook.com/921727352140803109314583324119231075033DNJ0ZRANmuoFymQq0xtK-7Uhfacebook.com/921742796682243115550683433319431075033datrDNJ0ZcZqom8JZ-uYU3MGThSkfacebook.com/92172747009283115550717243014803" Pattern match: "MUIDB3C59CC61797364030C9DDF8378F76587www.msn.com/9216194890048031153495252344788331075033sptmarketen-us||us|en-us|en-us|en||RefA=11A3F3ED46BB48078B73ACCF10AB25DB.RefC=2023-12-09T20:46:54Zwww.msn.com/1024408729676831222092252391588431075033" Pattern match: "-qEmsus56BVOttVldeW2lTEgoogle.com/92172720732163111185491074572631075033" Pattern match: "-g19neils04p5otrFdcgoogle.com/92172720732163111185491017071831075033" Pattern match: "-QK0iyhrU5TTi3KGLl2Mz9O0scTyIk-8muKlpPt8M0Kx9qeEVeg60pfODDOGWyi-X2iYzCzg4PewrrHoZN9-LveyGKrGcjoYgoogle.com/92172720732163111185491214574831075033" Pattern match: "WlVf-olYNC1MTcQ3accounts.google.com/9217296572326431221891925395951310750337330792_52_52_123900_48_436380accounts.google.com/10897752478723108106890512064031075033" Pattern match: "pTHcDlA9hvPCZVMWaccounts.google.com/9217290572326431221891858513236310750337330792_52_52_123900_48_436380accounts.google.com/10897752478723108106890512064031075033" Pattern match: "9216194890048031153495252344788331075033MUID3C59CC61797364030C9DDF8378F76587msn.com/1025194890048031153495252344788331075033USRLOCmsn.com/9217408729676831222092252391588431075033" Pattern match: "028OKYOjTTwf5RiBz..BldNIM.MC.AAA.0.0.BldNIM.AWVrUBXupFofacebook.com/921727352140803109314583324119231075033DNJ0ZRANmuoFymQq0xtK-7Uhfacebook.com/921742796682243115550683433319431075033" Pattern match: "9216194890048031153495252344788331075033MUID3C59CC61797364030C9DDF8378F76587msn.com/1025194890048031153495252344788331075033" Pattern match: ".google.com/921728757232643122189183355319231075033" Pattern match: "pTHcDlA9hvPCZVMWaccounts.google.com/921729057232643122189185851323631075033" Pattern match: ".google.com/921728957232643122189184821721831075033" Pattern match: "028OKYOjTTwf5RiBz..BldNIM.MC.AAA.0.0.BldNIM.AWVrUBXupFofacebook.com/921727352140803109314583324119231075033" Pattern match: "MUIDB3B562DACBB92680B2D2D3E4EBADE69F5ieonline.microsoft.com/9216193890048031153495251127986231075033" Pattern match: "MUIDB3C59CC61797364030C9DDF8378F76587www.msn.com/9216194890048031153495252344788331075033" Pattern match: "TESTCOOKIESENABLEDaccounts.google.com/v3/signin/108815028792323107503390422062631075033" Pattern match: "MUID3C59CC61797364030C9DDF8378F76587msn.com/1025194890048031153495252344788331075033" Pattern match: "CONSENTWP.2676bayoutube.com/102431383388163210825482504061830633367" Pattern match: "nactkwww.msn.com/spartan/108834324326431367516156339216030633261" Pattern match: "www.maxmind.com" Pattern match: "https://www.maxmind.com/en/locate-my-ip-addressUser-Agent" Heuristic match: "accounts.google.com" Heuristic match: "accounts.youtube.com" Heuristic match: "connect.facebook.net" Heuristic match: "db-ip.com" Heuristic match: "facebook.com" Heuristic match: "fbcdn.net" Heuristic match: "fbsbx.com" Heuristic match: "fonts.gstatic.com" Heuristic match: "ipinfo.io" Heuristic match: "play.google.com" Heuristic match: "static.xx.fbcdn.net" Pattern match: "www.facebook.com" Pattern match: "www.google.com" Pattern match: "www.gstatic.com" Heuristic match: "GET /demo/home.php?s=67.218.111.202 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: db-ip.com" Pattern match: "https://accounts.google.com/&followup=https://accounts.google.com/&passive=1209600&ifkv=ASKXGp2Jodese1-YquoZm5lH5OiBTaTX6t5thgkCEND3mmQBfcuUaji0l5VdQu5KxN4DiNiiTW8h" Pattern match: "https://accounts.google.com/InteractiveLogin?continue=https://accounts.google.com/&followup=https://accounts.google.com/&passive=1209600&ifkv=ASKXGp2Jodese1-YquoZm5lH5OiBTaTX6t5thgkCEND3mmQBfcuUaji0l5VdQu5KxN4DiNiiTW8hStrict-Transport-Security" Pattern match: "https://accounts.google.com/v3/signin/identifier?continue=https%3A%2F%2Faccounts.google.com%2F&followup=https%3A%2F%2Faccounts.google.com%2F&ifkv=ASKXGp1-X14OzAYZRRk85M7088CJDaO9nGq-vtpyYayj-Lm-y5iWoIgH_B0iyXK4Zh4dfZapzYTV&passive=1209600&flowName=GlifWebS" Pattern match: "accounts.google.com/x-ua-compatible" Pattern match: "https://accounts.google.com/&followup=https://accounts.google.com/&passive=1209600&ifkv=ASKXGp2yWBYNsON9vu8-lVeqkPsECZC_HMHENvR5LL_fpo03JMEsYmuMxGNUZgQPJIjekj3YBOK87w" Pattern match: "https://accounts.google.com/ServiceLogin?passive=1209600&continue=https%3A%2F%2Faccounts.google.com%2F&followup=https%3A%2F%2Faccounts.google.com%2FContent-Encoding" Pattern match: "https://accounts.google.com/InteractiveLogin?continue=https://accounts.google.com/&followup=https://accounts.google.com/&passive=1209600&ifkv=ASKXGp2yWBYNsON9vu8-lVeqkPsECZC_HMHENvR5LL_fpo03JMEsYmuMxGNUZgQPJIjekj3YBOK87wStrict-Transport-Security" Pattern match: "https://accounts.google.com/v3/signin/identifier?continue=https%3A%2F%2Faccounts.google.com%2F&followup=https%3A%2F%2Faccounts.google.com%2F&ifkv=ASKXGp1MyKRCX_FQv7nQeXChAg172YLAwKiFIMn9dq9BqeENDl7zCl9YWjKv0vHlUBt-fMww7m0jZA&passive=1209600&flowName=GlifWe" Pattern match: "https://www.google.com/favicon.icoStrict-Transport-Security" Pattern match: "https://accounts.google.com/Accept-Language" Pattern match: "g.co/p3phelp" Pattern match: "https://csp.withgoogle.com/csp/report-to/AccountsSignInSignUpUi}]}Content-Encoding" Pattern match: "https://csp.withgoogle.com/csp/report-to/AccountsSignInUi}]}Content-Encoding" Pattern match: "https://csp.withgoogle.com/csp/report-to/AccountsSignInSignUpUi}]}Cross-Origin-Resource-Policy" Pattern match: "https://csp.withgoogle.com/csp/report-to/AccountsSignInUi}]}Accept-CH" Pattern match: "www.facebook.comConnection" Pattern match: "fb.me/p3pSet-Cookie" Pattern match: "https://*.fbsbx.com" Pattern match: "https://www.facebook.com/loginAccept-Language" Pattern match: "https://www.facebook.com/login/device-based/regular/login/?login_attempt=1&lwv=100Accept-Language" Pattern match: "www.googleadservices.com" Pattern match: "https://www.facebook.com/login/device-based/regular/login/?login_attempt=1&lwv=120&lwc=1348028Accept-Language" Pattern match: "rsrc.php/v3/y0/l/0,cross/2pRVSwAv5Rj.css?_nc_x=Ij3Wp8lg5Kz" Pattern match: "rsrc.php/v3/y1/l/0,cross/GFdzeQQcoxa.css?_nc_x=Ij3Wp8lg5Kz" Pattern match: "rsrc.php/v3/yy/r/Ijg_IKf_KOp.js?_nc_x=Ij3Wp8lg5Kz" Pattern match: "rsrc.php/v3/yO/l/0,cross/EVmD_liOmwc.css?_nc_x=Ij3Wp8lg5Kz" Pattern match: "rsrc.php/v3/yl/l/0,cross/zXvhQagBa-d.css?_nc_x=Ij3Wp8lg5Kz" Pattern match: "rsrc.php/v3/ya/l/0,cross/EQ0cyse2DGv.css?_nc_x=Ij3Wp8lg5Kz" Pattern match: "rsrc.php/y1/r/4lCu2zih0ca.svg" Pattern match: "rsrc.php/v3/ye/r/a_TNkY9RAW1.js?_nc_x=Ij3Wp8lg5Kz" Pattern match: "rsrc.php/v3i7M54/y2/l/en_US/YoTddyRzZmh.js?_nc_x=Ij3Wp8lg5Kz" Pattern match: "rsrc.php/v3/yt/r/v75M7CPu9-P.js?_nc_x=Ij3Wp8lg5Kz" Pattern match: "rsrc.php/v3/yB/r/Y0L6f5sxdIV.png" Pattern match: "rsrc.php/v3/yU/r/O7nelmd9XSI.png" Pattern match: "rsrc.php/v3/ya/r/GxGC52INhg0.js?_nc_x=Ij3Wp8lg5Kz" Pattern match: "rsrc.php/v3/y2/r/3FPJ9YC_wUr.js?_nc_x=Ij3Wp8lg5Kz" Pattern match: "rsrc.php/v3ihVQ4/yS/l/en_US/euLeui0FtEX.js?_nc_x=Ij3Wp8lg5Kz" Pattern match: "rsrc.php/yb/r/hLRJ1GG_y0J.ico" Pattern match: "rsrc.php/v3/yy/r/QcYlxMWQTQ-.js?_nc_x=Ij3Wp8lg5Kz" Pattern match: "rsrc.php/v3/yz/r/lFK_RCKM9IT.js?_nc_x=Ij3Wp8lg5Kz" Pattern match: "rsrc.php/v3/yv/r/qvzskUrYlYC.js?_nc_x=Ij3Wp8lg5Kz" Pattern match: "rsrc.php/v3/yE/r/hNaGl-uOTME.js?_nc_x=Ij3Wp8lg5Kz" Pattern match: "rsrc.php/v3/yp/r/ISUe9_7D94n.js?_nc_x=Ij3Wp8lg5Kz" Pattern match: "rsrc.php/v3/yY/r/BqEjD1dj1pL.js?_nc_x=Ij3Wp8lg5Kz" Pattern match: "rsrc.php/v3/yN/r/FEYuBywZ5D6.js?_nc_x=Ij3Wp8lg5Kz" Pattern match: "rsrc.php/v3/yP/r/aBIoq18cchP.js?_nc_x=Ij3Wp8lg5Kz" Pattern match: "rsrc.php/v3/yF/r/PtmfxLVwAb7.js?_nc_x=Ij3Wp8lg5Kz" Pattern match: "rsrc.php/v3/y-/r/0c71UB7QWmT.js?_nc_x=Ij3Wp8lg5Kz" Pattern match: "rsrc.php/v3/yJ/r/a1OLcVhluEP.js?_nc_x=Ij3Wp8lg5Kz" Pattern match: "rsrc.php/v3/yZ/r/skazhVdw245.js?_nc_x=Ij3Wp8lg5Kz" Pattern match: "rsrc.php/v3/yz/r/dqd6vCA9PNV.js?_nc_x=Ij3Wp8lg5Kz" Pattern match: "rsrc.php/v3/yQ/r/zyRovCtoGSI.js?_nc_x=Ij3Wp8lg5Kz" Pattern match: "rsrc.php/v3/yZ/r/cA_3fTtJxgp.js?_nc_x=Ij3Wp8lg5Kz" Pattern match: "rsrc.php/v3/yh/r/5YJJZ1WjDXH.js?_nc_x=Ij3Wp8lg5Kz" Pattern match: "rsrc.php/v3/yw/r/wm4d5zAAo-a.js?_nc_x=Ij3Wp8lg5Kz" Pattern match: "rsrc.php/v3/yp/r/sKtrEJAtiUM.js?_nc_x=Ij3Wp8lg5Kz" Pattern match: "rsrc.php/v3/ym/r/fi9_yN9n_WX.js?_nc_x=Ij3Wp8lg5Kz" Pattern match: "rsrc.php/v3/y1/r/dXk5exdOVhk.js?_nc_x=Ij3Wp8lg5Kz" Pattern match: "rsrc.php/v3/yU/r/s_Izg7nAY9-.js?_nc_x=Ij3Wp8lg5Kz" Pattern match: "rsrc.php/v3/y6/r/o95MhjcKs5m.js?_nc_x=Ij3Wp8lg5Kz" Pattern match: "rsrc.php/v3/y2/r/O287_AcFyg4.png" Pattern match: "https://fbsbx.com/security/hsts-pixel.gif?c=5reporting-endpoints" Pattern match: "https://fbcdn.net/security/hsts-pixel.gif?c=2.5reporting-endpoints" Pattern match: "https://connect.facebook.net/security/hsts-pixel.gifreporting-endpoints" Pattern match: "https://csp.withgoogle.com/csp/boq-infra/identity-boq-js-css-signersCross-Origin-Resource-Policy" Pattern match: "https://csp.withgoogle.com/csp/apps-themesCross-Origin-Resource-Policy" Pattern match: "https://csp.withgoogle.com/csp/report-to/static-on-bigtable}]}Content-Length" Pattern match: "https://accounts.google.comContent-Security-Policy" Pattern match: "accounts.google.com/v3/signin/identifier\,null,[\\],0]],\-4982841501737134946\,3,[null,\S-234202157:1702154766168130\]],null,null,null,null,null,null,-3600,null,null,null,null,null,1],[1702151536000,null,null,null,null,null,null,[[[307,64002,nul" Pattern match: "https://accounts.google.comAccess-Control-Request-Method" Pattern match: "accounts.google.com/v3/signin/identifier\,null,[\\],0]],\-2508367394189711371\,3,[null,\S789491184:1702154767530904\]],null,null,null,null,null,null,-3600,null,null,null,null,null,1],[1702151538000,null,null,null,null,null,null,[[[307,64002,null" Pattern match: "https://accounts.google.comAccess-Control-Allow-Methods" Pattern match: "https://accounts.google.comCross-Origin-Resource-Policy" Pattern match: "https://ipinfo.io/" Pattern match: "https://accounts.google.com/v3/signin/" Pattern match: "https://www.gstatic.com/_/mss/boq-identity/_/ss/k=boq-identity.AccountsSignInUi.7SqRI1GGGCM.L.I11.O/am=HwEWSRwbADFmlnP-nnFyGAAAAAAAAAAAYA3EDg/d=1/ed=1/rs=AOaEmlEn2P1ykj_C1zfxu6LUFjU0vDwdyA/m=identifierview,_b,_tp" Pattern match: "fonts.gstatic.com/s/productsans/v9/pxiDypQkot1TnFhsFMOfGShVF9eI.woff" Pattern match: "https://www.gstatic.com/_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en_US.1_ex_vpT7l8.es5.O/am=HwEWSRwbADFmlnP-nnFyGAAAAAAAAAAAYA3EDg/d=1/excm=_b,_tp,identifierview/ed=1/dg=0/wt=2/ujg=1/rs=AOaEmlFMmSVi-s7WpReqz8Tw1urTAT-5xQ/m=_b,_tp" Pattern match: "fonts.gstatic.com/s/roboto/v18/KFOkCnqEu92Fr1MmgVxIIzQ.woff" Pattern match: "https://accounts.google.com/AccountChooser?continue\u003dhttps://accounts.google.com/\u0026followup\u003dhttps://accounts.google.com/],[null,[null,null,https://accounts.google.com/Logout?continue\u003dhttps://accounts.google.com/restart?continue%3Dhttps:" Pattern match: "https://www.gstatic.com/_/mss/boq-identity/_/ss/k=boq-identity.AccountsSignInUi.1i05gx70WEQ.L.B1.O/am=HwEWyRwbADFmlnP-nnFyGAAAAAAAAAAAYA3EDg/d=1/ed=1/rs=AOaEmlEGHGg7uPyVJKGUoP3SPuCtpU22HA/m=identifierview,_b,_tp" Pattern match: "fonts.gstatic.com/s/productsans/v9/pxiDypQkot1TnFhsFMOfGShVGdeOYktMqlap.woff2" Pattern match: "https://www.gstatic.com/_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en_US.1_ex_vpT7l8.es5.O/am=HwEWyRwbADFmlnP-nnFyGAAAAAAAAAAAYA3EDg/d=1/excm=_b,_tp,identifierview/ed=1/dg=0/wt=2/ujg=1/rs=AOaEmlEee_xS5zD7paaaIdQTg0aRQVoAZA/m=_b,_tp" Pattern match: "fonts.gstatic.com/s/roboto/v18/KFOkCnqEu92Fr1MmgVxFIzIXKMnyrYk.woff2" Pattern match: "https://static.xx.fbcdn.net/rsrc.php/v3/ym/r/5NogN3rgY0F.png" Pattern match: "https://static.xx.fbcdn.net/rsrc.php/v3/ya/l/0,cross/EQ0cyse2DGv.css?_nc_x=Ij3Wp8lg5Kz" Pattern match: "https://static.xx.fbcdn.net/rsrc.php/v3/y0/l/0,cross/2pRVSwAv5Rj.css?_nc_x=Ij3Wp8lg5Kz" Pattern match: "https://static.xx.fbcdn.net/rsrc.php/v3/y1/l/0,cross/GFdzeQQcoxa.css?_nc_x=Ij3Wp8lg5Kz" Pattern match: "https://static.xx.fbcdn.net/rsrc.php/v3/yl/l/0,cross/zXvhQagBa-d.css?_nc_x=Ij3Wp8lg5Kz" Pattern match: "https://static.xx.fbcdn.net/rsrc.php/v3/yy/r/Ijg_IKf_KOp.js?_nc_x=Ij3Wp8lg5Kz" Pattern match: "www.kfc.co.th,learn.pantheon.io,www.landmarkshops.in,www.ncl.com,s0.wp.com,www.tatacliq.com,bs.serving-sys.com,kohls.com,lazada.co.th,xg4ken.com,technopark.ru,officedepot.com.mx,bestbuy.com.mx,booking.com,nibio.no,myworkdayjob" Pattern match: "www.facebook.com\/login}]],[UITinyViewportAction,init,[],[]],[ResetScrollOnUnload,init,[__elem_a588f507_0_0_7L],[{__m:__elem_a588f507_0_0_7L}]],[KeyboardActivityLogger,init,[],[]],[FocusRing,init,[],[]],[ErrorMessageConsole,listen" Pattern match: "https://static.xx.fbcdn.net/rsrc.php/v3/yO/l/0,cross/EVmD_liOmwc.css?_nc_x=Ij3Wp8lg5Kz" Pattern match: "https://static.xx.fbcdn.net/rsrc.php/v3/ya/r/GxGC52INhg0.js?_nc_x=Ij3Wp8lg5Kz" Pattern match: "https://static.xx.fbcdn.net/rsrc.php/v3/ye/r/a_TNkY9RAW1.js?_nc_x=Ij3Wp8lg5Kz" Pattern match: "https://static.xx.fbcdn.net/rsrc.php/v3i7M54/y2/l/en_US/YoTddyRzZmh.js?_nc_x=Ij3Wp8lg5Kz" Pattern match: "https://static.xx.fbcdn.net/rsrc.php/v3/yt/r/v75M7CPu9-P.js?_nc_x=Ij3Wp8lg5Kz" Pattern match: "https://www.facebook.com/login,serverLID:7310699045915481065}]],[FalcoLoggerTransports,attach,[],[]],[Chromedome,start,[],[{}]],[DimensionTracking],[ClickRefLogger],[NavigationClickPointHandler],[WebDevicePerfInfoLogging,doLog,[],[]],[" Pattern match: "https://www.maxmind.com/en/locate-my-ip-address" Pattern match: "https://www.internalfb.com/intern/invariant/+a+/;b.length" Pattern match: "https://fburl.com/debugjs" Pattern match: "https://www.facebook.com/legal/license/Ga6vBwdwgUx/" Pattern match: "https://www.facebook.com/legal/license/A4tfXiHOGrs/" Pattern match: "https://secure.facebook.com/:document.referrer,d=c.indexOf(/,8);c=c.substring(0,d);if(l(c)){d=new" Pattern match: "www.+" Pattern match: "www.novi" Pattern match: "www.facebook.com\/login\/device-based\/regular\/login\/?login_attempt=1&lwv=120&lwc=1348028}]],[UITinyViewportAction,init,[],[]],[ResetScrollOnUnload,init,[__elem_a588f507_0_0_JL],[{__m:__elem_a588f507_0_0_JL}]],[KeyboardActivityLogger,in" Pattern match: "https://www.facebook.com/login/device-based/regular/login/?login_attempt=1&lwv=120&lwc=1348028,serverLID:7310699302549469738}]],[FalcoLoggerTransports,attach,[],[]],[Chromedome,start,[],[{}]],[DimensionTracking],[NavigationClickPointHandler]" Pattern match: "www.facebook.com\/login\/device-based\/regular\/login\/?login_attempt=1&lwv=120&lwc=1348028}]],[UITinyViewportAction,init,[],[]],[ResetScrollOnUnload,init,[__elem_a588f507_0_0_2c],[{__m:__elem_a588f507_0_0_2c}]],[KeyboardActivityLogger,in" Pattern match: "https://www.facebook.com/login/device-based/regular/login/?login_attempt=1&lwv=120&lwc=1348028,serverLID:7310699427248261296}]],[FalcoLoggerTransports,attach,[],[]],[Chromedome,start,[],[{}]],[DimensionTracking],[NavigationClickPointHandler]" Pattern match: "https://www.facebook.com/login/" Pattern match: "https://static.xx.fbcdn.net/rsrc.php/v3/y_/l/0,cross/piXcg3ZJdR_.css?_nc_x=Ij3Wp8lg5Kz" Pattern match: "https://static.xx.fbcdn.net/rsrc.php/v3/yQ/l/0,cross/LOrjNwftsyP.css?_nc_x=Ij3Wp8lg5Kz" Pattern match: "https://static.xx.fbcdn.net/rsrc.php/v3/yb/l/0,cross/pqoj1sLptdE.css?_nc_x=Ij3Wp8lg5Kz" Pattern match: "https://static.xx.fbcdn.net/rsrc.php/v3/ya/r/JS2LsxE-gw3.js?_nc_x=Ij3Wp8lg5Kz" Pattern match: "www.facebook.com\/login}]],[UITinyViewportAction,init,[],[]],[ResetScrollOnUnload,init,[__elem_a588f507_0_0_+G],[{__m:__elem_a588f507_0_0_+G}]],[KeyboardActivityLogger,init,[],[]],[FocusRing,init,[],[]],[ErrorMessageConsole,listen" Pattern match: "https://static.xx.fbcdn.net/rsrc.php/v3/y-/l/0,cross/UiF6KvaaDMc.css?_nc_x=Ij3Wp8lg5Kz" Pattern match: "https://www.facebook.com/login,serverLID:7310699955754314844}]],[FalcoLoggerTransports,attach,[],[]],[Chromedome,start,[],[{}]],[DimensionTracking],[ClickRefLogger],[NavigationClickPointHandler],[ServiceWorkerURLCleaner,removeRedirectID" Pattern match: "https://assets.msn.com/config/v1/"" Pattern match: "https://+l+/OneCollector/1.0+function(t){return?+Object.keys(t).map" Pattern match: "www.bing.com" Pattern match: "https://assets.msn.com/bundles/v1/homePage/latest/midlevel/vendors.ef7dde432bed42c1b7db.js" Pattern match: "https://assets.msn.com/bundles/v1/homePage/latest/midlevel/microsoft.f0dc8bbbc7b4d116660b.js" Pattern match: "https://assets.msn.com/bundles/v1/homePage/latest/midlevel/common.a4f17d7709f5f87af285.js" Pattern match: "https://assets.msn.com/bundles/v1/homePage/latest/midlevel/experience.0f30a2bb04a428617069.js" Heuristic match: "PATHEXT=.CO" Heuristic match: "ttps://accounts.google.com" Pattern match: "www.facebook.com/login" Pattern match: "www.paypal.com/signin" Pattern match: "twitter.com/i/flow/login" Pattern match: "https://store.steampowered.com/login" Pattern match: "store.steampowered.com/login" Pattern match: "steamcommunity.com/openid/loginform" Pattern match: "www.epicgames.com/id/login" Heuristic match: "witter.com" Pattern match: "www.youtube.com" Heuristic match: "tore.steampowered.com" Heuristic match: "ww.facebook.com" Heuristic match: "ccounts.google.com" Pattern match: "https://twitter.com/i/flow/login" Heuristic match: "c_950.nl" Heuristic match: "djctq.rs" Heuristic match: "diskcomp.com" Heuristic match: "iskcopy.com" Heuristic match: "edit.com" Heuristic match: "esrb.rs" Heuristic match: "fpb.rs" Heuristic match: "grb.rs" Heuristic match: "mode.com" Heuristic match: "more.com" Heuristic match: "normidna.ne" Heuristic match: "oflc-nz.rs" Pattern match: "https://steamcommunity.com/openid/loginform" Heuristic match: "tps://accounts.google.com" Pattern match: "https://www.youtube.com/" Pattern match: "steamcommunity.com/openid/loginf" Pattern match: "www.youtube.com/" Heuristic match: "teamcommunity.com" Heuristic match: "ww.epicgames.com" Pattern match: "https://www.epicgames.com/id/login" Heuristic match: "ww.paypal.com" Heuristic match: "ww.youtube.com" Heuristic match: "CMD;.VBS;.Vg" Heuristic match: "b2{-.sn" Heuristic match: "Fax.pF" Heuristic match: "cz'.CO" Heuristic match: "\X.in" Heuristic match: "IN.MZ"57:T9f1c,Found URL "https://store.steampowered.com/loginapi-ms-win-crt-filesystem-l1-1-0.dllapi-ms-win-crt-multibyte-l1-1-0.dllapi-ms-win-downlevel-ole32-l1-1-0.dllapi-ms-win-security-base-l1-1-0.dllapi-ms-win-security-sddl-l1-1-0.dllapi-ms-win-service-core-l1-1-0.dllapi-ms-win-service-winsvc-l1-1-0.dllauxiliarydisplayclassinstaller.dllommonprogramfiles=c:\program" - Source: "00000000-00001512.00000000.67840.005A0000.00000004.mdmp") Found URL "https://twitter.com/i/flow/loginc:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18837_none_41e855142bd5705d\855142bd5705d\-ms-winclsid\" - Source: "00000000-00001512.00000000.67840.005A0000.00000004.mdmp") Found URL "https://twitter.com/i/flow/loginc:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18837_none_41e855142bd5705d\:\users\hapubws\appdata\local\temp\ixp000.tmp\6fr1mw1.exe\winhttps://twitter.com/i/flow/login09d-45b2-8b8d-2e5e1d522649istry\user\s-1-5-21-2092356043-4041700817-663127204-1001_classesieproxy.dllieframe.dllapi-ms-win-downlevel-shell32-l1-ieproxy.dllieframe.dllapi-ms-win-downlevel-shell32-l1-ieproxy.dllieframe.dllapi-ms-win-downlevel-shell32-l1-ieproxy.dllieframe.dllapi-ms-win-downlevel-shell32-l1-indows\system32\apphelp.dllelevatecreateprocess" - Source: "00000000-00001512.00000000.67840.005A0000.00000004.mdmp") Found URL "https://accounts.google.com/:\program" - Source: "00000000-00001512.00000000.67840.005A0000.00000004.mdmp") Found URL "https://accounts.google.com/:\users\hapubws\appdata\local\temp\ixp000.tmp:\users\hapubws\appdata\local\temp\ixp000.tmp:\program" - Source: "00000000-00001512.00000000.67840.005A0000.00000004.mdmp") Found URL "https://accounts.google.com/:\users\hapubws\appdata\local\temp\ixp000.tmp:\program" - Source: "00000000-00001512.00000000.67840.005A0000.00000004.mdmp") Found URL "https://twitter.com/i/flow/login-209235clsid\" - Source: "00000000-00001512.00000000.67840.005A0000.00000004.mdmp") Found URL "https://twitter.com/i/flow/loginie.protocoletdrivetypeetdrivetypeummy://url/v2.dlle.protocolummy://urlfr1mw1.exele32.dllbout:blankru-ruslmgrsppuibout:blankwitter.comrs\hapubws\appdata\local\programrograms\python\?\volume" - Source: "00000000-00001512.00000000.67840.005A0000.00000004.mdmp") Found URL "https://twitter.com/i/flow/loginc:\users\hapubws\appdata\local\temp\ixp000.tmphttps://twitter.com/i/flow/loginhttps://twitter.com/i/flow/loginttps://store.steampowered.com/loginttps://store.steampowered.com/login:\0f78b956-909d-45b2-8b8d-2e5e1d522649https://twitter.com/i/flow/login2649normaliz.dllnormidna.nenormnfc.nlsnormnfpnormnfkc.nlsd.nlsnotepad.exeproxy.dllnrpsrv.dllnshhttp.dllnshipsec.dllnshwfp.dllnsisvc.dll'nslookup.exentdos4ntdos411.sys2.sysntdos804.syssapi.dllntio404.sysntio411.sysntio412.sysntio804.sysntkrnlpa.entlanman.dllntlanuntmarta.dlll.exentprint.dllrint.exentshrui.dllntvdmd.dllobjsel.dlloccache.dllocsetapi.docsetup.exeodbc16odbc32.dll.dllodbcad32.exebcp.dllodbcconf.dllodbcconf.exeodbcconf.rspodbccp32.dllodbccr32.d]odbccu32.dllodbcinhodbcji32.dll.dllodbctrac.dllse32.dllodexl32.dllodfox32.dllodpdx32.dllodtext32.dllofffilt.dloflc-nz.rsogldrvole2disp.dlloleacc.dllccrc.dlloleaut32.dllolecli.dllolecli32.dlloledlg.dlloleprn.dllolepro32.dlloleresolesvr.dll.dllolethk32.dllhttps://accounts.google.com/program" - Source: "00000000-00001512.00000000.67840.005A0000.00000004.mdmp") Found URL "https://accounts.google.com/dfp.dlrpcns4cnsh.dll.dllscrnsave.scrscrobj.dllscrptadm.dllscrrun.dllsdbinst.exesdchange.exesdengin2.dllsdhcinsdiageng.dllsdiagprv.dllsdiagschd.dllsdohlp.dllsdrsvc.dllsdshext.dllsecedit.exesechost.dl]secinit.exeseclogon.dllsecpol.mscsecproc.dllsecur32.dllsecurity.dllsendmail.dllsensapi.dllsensrsvc.dllserialui.dllservices.exeservices.mscserwvdrv.dllsessenv.dllsetspn.exesetupapi.dllsetupcl.exesetupcln.dllsetupetw.dllsetupsnk.exesetupugc.exesetver.exesfc_os.dllshacct.dllow.exeshdocvw.dllshell32.dllshfolder.dllshgina.dllshiftjis.uceshimeng.dllshimgvw.dllshpafact.dllshrpubw.exeshsetup.dllshsvcs.dllshunimpl.dllshutdown.exeshwebsvc.dllsigndr" - Source: "00000000-00001512.00000000.67840.005A0000.00000004.mdmp") Found URL "https://steamcommunity.com/openid/loginform:\windows\system32\userenv.dll:\windows\system32\profapi.dll:\windows\system32\psapi.dll:\windows\system32\comdlg32.dll:\windows\system32\oleaut32.dll:\windows\system32\iphlpapi.dll:\windows\system32\winnsi.dll:\windows\system32\uxtheme.dll:\windows\system32\shell32.dll:\windows\system32\ole32.dll:\windows\system32\apphelp.dll:\windows\system32\sspicli.dll:\windows\system32\samcli.dll:\windows\system32\msacm32.dll:\windows\system32\sfc_os.dll:\windows\system32\dwmapi.dll:\windows\system32\devobj.dll:\windows\system32\urlmon.dll:\windows\system32\imm32.dll:\windows\system32\msctf.dll\windows\system32\driverstorellusersprofile=c:\programdatarogramfiles=c:\program" - Source: "00000000-00001512.00000001.68017.005A0000.00000004.mdmp") Found URL "https://accounts.google.com/ttps://accounts.google.com/ttps://accounts.google.com/elevatecreateprocesswrpmitigationapphelp.dllen-usen-usar-sapt-brzh-twzh-cnzh-hkcs-czda-dkel-gres-esfi-fifr-frde-dehe-ilhu-huit-itja-jpko-krnl-nlnb-nopl-plpt-ptru-rusv-setr-trbg-bghr-hret-eelv-lvlt-ltro-rosr-latn-cssk-sksl-sith-thuk-uafy-nlqps-plocqps-plocm:\windows\apppatch\aclayers.dll52c64b7eviewtooltipclass32\imm32.dllh;c:\windows\system32;c:\windows;c:\windows\system32\wbem;c:\windows\system32\windowspowershell\v1.0\;c:\users\hapubws\appdata\local\programs\python\python38-32\scripts\;c:\users\hapubws\appdata\local\programs\python\python38-:\windows\system32\winspool.drvocasrvevpdata\lo:\windows\system32\setupapi.dll:\windows\system32\cfgmgr32.dll:\windows\system32\sfc.dllms-win-core-processthreads-l1-1-0:\windows\apppatch\acgenral.dllc:\users\hapubws\appdata\local\temp\ixp000.tmp;c:\windows\system32;c:\windows\system;c:\windows;.;c:\programdata\oracle\java\javapath;c:\windows\system32;c:\windows;c:\windows\system32\wbem;c:\windows\system32\windowspowershell\v1.0\;c:\users\hapubws\appdata\local\programs\python\python38-32\scripts\;c:\users\hapubws\appdata\local\programs\python\python38-32\;c:\users\hapubws\appdata\local\programs\python\python36-32\scripts\;c:\users\hapubws\appdata\local\programs\python\python36-32\msiscanbuffer:\windows\system32\cryptbase.dllomspec=c:\windows\system32\cmd.exeroperty" - Source: "00000000-00001512.00000001.68017.005A0000.00000004.mdmp") Found URL "https://accounts.google.com/ttps://www.epicgames.com/id/login:\windows\system32\shell32.dlllocationnotificationsview.xmlttps://twitter.com/i/flow/loginttps://www.epicgames.com/id/loginhttps://accounts.google.com/portabledevicewiacompat.dll:\windows\system32\propsys.dllprintfilterpipelineprxy.dllprintfilterpipelinesvc.exepushprinterconnections.exettps://www.epicgames.com/id/loginarse" - Source: "00000000-00001512.00000001.68017.005A0000.00000004.mdmp") Found URL "https://www.youtube.com/api-ms-win-core-rtlsupport-l1-1-0.dllapi-ms-win-core-sysinfo-l1-1-0.dllapi-ms-win-core-threadpool-l1-1-0.dllapi-ms-win-crt-filesystem-l1-1-0.dllhttps://www.youtube.com/ttps://steamcommunity.com/openid/loginformttps://steamcommunity.com/openid/loginformapi-ms-win-security-sddl-l1-1-0.dllhttps://www.youtube.com/https://www.youtube.com/auxiliarydisplayclassinstaller.dllommonprogramfiles=c:\program" - Source: "00000000-00001512.00000001.68017.005A0000.00000004.mdmp") Found URL "https://accounts.google.com/https://accounts.google.com/https://accounts.google.com/https://accounts.google.com/:\program" - Source: "00000000-00001512.00000001.68017.005F6000.00000004.mdmp") Found URL "https://accounts.google.com/https://accounts.google.com/:\program" - Source: "00000000-00001512.00000001.68017.005F6000.00000004.mdmp") Found URL "https://www.epicgames.com/id/login-209235clsid\" - Source: "00000000-00001512.00000001.68017.005F6000.00000004.mdmp") Found URL "https://ipinfo.io/https://www.maxmind.com/en/locate-my-ip-addressauthorization:" - Source: "00000000-00003088.00000000.67133.00436000.00000002.mdmp") Found URL "http://www.winimage.com/zlibdllherfqq2lyf8x5[x]tiulm:.p)q+e4" - Source: "00000000-00003088.00000000.67133.00436000.00000002.mdmp") Found URL "http://www.maxmind.com/geoip/v2.1/city/memsiscanbuffer%systemroot%\system32\shell32.dll,-21787system" - Source: "00000000-00003088.00000000.67141.00550000.00000004.mdmp") Found URL "https://db-ip.com/demo/home.php?s=67.218.111.202db-ip.comdb-ip.comdomain" - Source: "00000000-00003088.00000000.67141.00550000.00000004.mdmp") Found URL "https://t.me/riseprosupport" - Source: "00000000-00003088.00000000.67141.00550000.00000004.mdmp") Found URL "https://ipinfo.io/d1bf2bdddbdddldap?r<0" - Source: "00000000-00003088.00000000.67141.00550000.00000004.mdmp") Found URL "https://ipinfo.io/widget/demo/67.218.111.202hbjt1.2.840.113549.1.9.16.2.11.2.840.113549.1.9.16.1.1essreceiptrequestdecodeexacmgcomspec=c:\windows\system32\cmd.exetmp=c:\users\hapubws\appdata\local\tempcomspec=c:\windows\system32\cmd.exetmp=c:\users\hapubws\appdata\local\temp(gwpgest" - Source: "00000000-00003088.00000000.67141.00550000.00000004.mdmp") Found URL "https://db-ip.com/demo/home.php?s=67.218.111.202;1ji1.3.6.1.4.1.11129.2.4.231ji+1ji" - Source: "00000000-00003088.00000000.67141.00550000.00000004.mdmp") Found URL "http://crl3.digicert.com/cloudflareincrsaca-2.crl071http://crl4.digicert.com/cloudflareincrsaca-2.crl0>705030)0'http://www.digicert.com/cps0vj0h0$http://ocsp.digicert.com0@4http://cacerts.digicert.com/cloudflareincrsaca-2.crt0qhyfqc4i?9z6>.y8l(t$" - Source: "00000000-00003088.00000000.67141.00550000.00000004.mdmp") Found URL "http://ocsp.digicert.com0:3010/)http://crl3.digicert.com/omniroot2025.crl0mf0d070*0(https://www.digicert.com/cps0r.\ozj5u$^" - Source: "00000000-00003088.00000000.67141.00550000.00000004.mdmp") Found URL "http://crl.usertrust.com/addtrustexternalcaroot.crl05)0'0%http://ocsp.usertrust.com0ql" - Source: "00000000-00003088.00000000.67141.00550000.00000004.mdmp") Found URL "http://g.symcd.com0e0c0a60301%http://www.geotrust.com/resources/cps06/0-0+%http://g.symcb.com/geotrustpca-g3.crl0symantecpki-1-697033ti^l" - Source: "00000000-00003088.00000000.67141.00550000.00000004.mdmp") Found URL "http://g1.symcb.com/crls/gtglobal.crl0/" - Source: "00000000-00003088.00000000.67141.00550000.00000004.mdmp") Found URL "http://g2.symcb.com0le0c0a60301%http://www.geotrust.com/resources/cps0)symantecpki-1-53902ol!o!yj>9iqmgvw,czcni" - Source: "00000000-00003088.00000000.67141.00550000.00000004.mdmp") Found URL "http://isrg.trustid.ocsp.identrust.com0;/http://apps.identrust.com/roots/dstrootcax3.p7c0m0k0000." - Source: "00000000-00003088.00000000.67141.00550000.00000004.mdmp") Found URL "http://cps.root-x1.letsencrypt.org0<50301+http://crl.identrust.com/dstrootcax3crl.crl0ig'" - Source: "00000000-00003088.00000000.67141.00550000.00000004.mdmp") Found URL "https://www.verisign.com/cps04*0(0&" - Source: "00000000-00003088.00000000.67141.00550000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl0izttpsalt" - Source: "00000000-00003088.00000000.67141.00550000.00000004.mdmp") Found URL "http://www.usertrust.com1utn-userfirst-hardware0110315000000z140314235959z0384771florida1english1sea" - Source: "00000000-00003088.00000000.67141.00550000.00000004.mdmp") Found URL "https://secure.comodo.com/cps0" - Source: "00000000-00003088.00000000.67141.00550000.00000004.mdmp") Found URL "http://crl.comodoca.com/utn-userfirst-hardware.crl060http://crl.comodo.net/utn-userfirst-hardware.crl0qe0c0;/http://crt.comodoca.com/utnaddtrustserverca.crt0$http://ocsp.comodoca.com05addons.mozilla.orgwww.addons.mozilla.org0zsb)j9e/9ckxsalt" - Source: "00000000-00003088.00000000.67141.00550000.00000004.mdmp") Found URL "http://crl.comodoca.com/utn-userfirst-hardware.crl060http://crl.comodo.net/utn-userfirst-hardware.crl0qe0c0;/http://crt.comodoca.com/utnaddtrustserverca.crt0$http://ocsp.comodoca.com0%www.google.comgoogle.com0io]l,e9n" - Source: "00000000-00003088.00000000.67141.00550000.00000004.mdmp") Found URL "http://www.public-trust.com/cps/omniroot.html0w0u1gte" - Source: "00000000-00003088.00000000.67141.00550000.00000004.mdmp") Found URL "http://www.public-trust.com/cgi-bin/crl/2018/cdp.crl0dmxt*j]+xijom5o^4," - Source: "00000000-00003088.00000000.67141.00550000.00000004.mdmp") Found URL "http://ocsp.entrust.net03,0*0(" - Source: "00000000-00003088.00000000.67141.00550000.00000004.mdmp") Found URL "http://crl.entrust.net/server1.crl0;8kbv7.11c)d[b" - Source: "00000000-00003088.00000000.67141.00550000.00000004.mdmp") Found URL "http://www.diginotar.nl/cps/pkioverheid0w0u1staat" - Source: "00000000-00003088.00000000.67141.00550000.00000004.mdmp") Found URL "http://crl.pkioverheid.nl/domovlatestcrl.crl0]ko)tsz'rl" - Source: "00000000-00003088.00000000.67141.00550000.00000004.mdmp") Found URL "http://crl.comodoca.com/utn-userfirst-hardware.crl060http://crl.comodo.net/utn-userfirst-hardware.crl0qe0c0;/http://crt.comodoca.com/utnaddtrustserverca.crt0$http://ocsp.comodoca.com0/login.skype.comwww.login.skype.com0>qq1ni07nej-+\lu>gvpob\hzagxr" - Source: "00000000-00003088.00000000.67141.00550000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif0\:oj?;liir0m0-xgj.lii2.16.840.1.113730.1.13'liixx4bx'ect" - Source: "00000000-00003088.00000000.67141.00550000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif03130$j0_b>mnk't" - Source: "00000000-00003088.00000000.67141.00550000.00000004.mdmp") Found URL "http://crlcq81isign^" - Source: "00000000-00003088.00000000.67141.00550000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00003088.00000000.67141.00550000.00000004.mdmp") Found URL "http://www.microsoft.com/windows0^ziq$(c\a6\4[=oft" - Source: "00000000-00003088.00000000.67141.00550000.00000004.mdmp") Found URL "http://www.microsoft.com/windows0^ziq$(c\a6\4[=_$viq$vik$vim$vig$viy$vis$viu$vio$via$vi" - Source: "00000000-00003088.00000000.67141.00550000.00000004.mdmp") Found URL "https://www.maxmind.com/en/locate-my-ip-addressc+vid+vihttp://www.maxmind.com/geoip/v2.1/city/me" - Source: "00000000-00003088.00000000.67141.00550000.00000004.mdmp") Found URL "https://www.cloudflare.com/5xx-error-landing" - Source: "00000000-00003088.00000000.67141.00550000.00000004.mdmp") Found URL "https://www.maxmind.com/en/locate-my-ip-addressmozilla/5.0" - Source: "00000000-00003088.00000000.67141.00550000.00000004.mdmp") Found URL "https://www.maxmind.com/en/locate-my-ip-addressuser-agent:" - Source: "00000000-00003088.00000000.67141.00550000.00000004.mdmp") Found URL "https://t.me/riseprosupportt" - Source: "00000000-00003736.00000000.66071.00250000.00000004.mdmp") Found URL "https://t.me/riseprosupport" - Source: "00000000-00003736.00000000.66071.00250000.00000004.mdmp") Found URL "https://ipinfo.io/https://www.maxmind.com/en/locate-my-ip-addressauthorization:" - Source: "00000000-00003736.00000000.66071.00400000.00000040.mdmp") Found URL "http://www.winimage.com/zlibdllherfqq2lyf8x5[x]tiulm:.p)q+e4" - Source: "00000000-00003736.00000000.66071.00400000.00000040.mdmp") Found URL "http://www.windows.com/pctv.update" - Source: "00000000-00003736.00000000.66071.02E10000.00000002.mdmp") Found URL "http://www.windows.com/pctv.select" - Source: "00000000-00003736.00000000.66071.02E10000.00000002.mdmp") Found URL "http://go.microsoft.com/fwlink/?linkid=53081" - Source: "00000000-00003736.00000000.66071.02E10000.00000002.mdmp") Found URL "http://go.microsoft.com/fwlink/?linkid=30564-http://go.microsoft.com/fwlink/?linkid=145764-http://go.microsoft.com/fwlink/?linkid=145764-http://go.microsoft.com/fwlink/?linkid=145764-http://go.microsoft.com/fwlink/?linkid=145764-http://go.microsoft.com/fwlink/?linkid=131536-http://go.microsoft.com/fwlink/?linkid=131535+http://go.microsoft.com/fwlink/?linkid=8430software" - Source: "00000000-00003736.00000000.66071.02E10000.00000002.mdmp") Found URL "http://go.microsoft.com/fwlink/?linkid=70599help" - Source: "00000000-00003736.00000000.66071.02E10000.00000002.mdmp") Found URL "http://go.microsoft.com/fwlink/?linkid=145837.presscheckcheckuncheckselectpresspresspresspressexecutepnow" - Source: "00000000-00003736.00000000.66071.02E10000.00000002.mdmp") Found URL "http://go.microsoft.com/fwlink/?linkid=57190microsoft" - Source: "00000000-00003736.00000000.66071.02E10000.00000002.mdmp") Found URL "http://go.microsoft.com/fwlink/?linkid=145765ehtray_notify_nullehtray_s_ignore_eventlow" - Source: "00000000-00003736.00000000.66071.02E10000.00000002.mdmp") Found URL "http://vista.gallery.microsoft.com/vista/sideshow.aspxgadgetsno" - Source: "00000000-00003736.00000000.66071.02E10000.00000002.mdmp") Found URL "http://www.icra.org/vocabulary/.nonelimitedsomeunrestrictednudity4no" - Source: "00000000-00003736.00000000.66071.02E10000.00000002.mdmp") Found URL "http://go.microsoft.com/fwlink/?linkid=32146" - Source: "00000000-00003736.00000000.66071.02E10000.00000002.mdmp") Found URL "http://go.microsoft.com/fwlink/?linkid=70183'res://wmploc.dll/offline_radioguide.htm&visualizationsshow" - Source: "00000000-00003736.00000000.66071.02E10000.00000002.mdmp") Found URL "http://images.metaservices.microsoft.com/cover/6http://redir.metaservices.microsoft.com/redir/buynow/?1http://redir.metaservices.microsoft.com/dvdcover/phttp://redir.metaservices.microsoft.com/redir/buynow/?,http://windowsmedia.com/redir/findmedia.asp?9http://redir.metaservices.microsoft.com/redir/getmdrdvd/?8http://redir.metaservices.microsoft.com/redir/getmdrcd/?bhttp://redir.metaservices.microsoft.com/redir/getmdrcdbackground/??http://redir.metaservices.microsoft.com/redir/getmdrcdposturl/?ihttp://redir.metaservices.microsoft.com/redir/getmdrcdposturlbackground/?=http://redir.metaservices.microsoft.com/redir/getdaiposturl/?:http://redir.metaservices.microsoft.com/redir/daifailure/?microsoft" - Source: "00000000-00003736.00000000.66071.02E10000.00000002.mdmp") Found URL "http://redir.metaservices.microsoft.com/redir/submittoc/?-http://windowsmedia.com/redir/querytocext.asp1res://wmploc.dll/offline_mediainfo_nowplaying.htm7http://redir.metaservices.microsoft.com/redir/buynowmg/,http://windowsmedia.com/redir/buyticket9.asp)http://windowsmedia.com/redir/idppage.asp)http://windowsmedia.com/redir/idplogo.aspsegoe" - Source: "00000000-00003736.00000000.66071.02E10000.00000002.mdmp") Found URL "http://go.microsoft.com/fwlink/?linkid=321507optimized" - Source: "00000000-00003736.00000000.66071.02E10000.00000002.mdmp") Found URL "http://go.microsoft.com/fwlink/?linkid=8792hdcd" - Source: "00000000-00003736.00000000.66071.02E10000.00000002.mdmp") Found URL "http://redir.metaservices.microsoft.com/redir/mediaguide/?9http://redir.metaservices.microsoft.com/redir/radiotuner/,http://windowsmedia.com/redir/querytocnp.asp" - Source: "00000000-00003736.00000000.66071.02E10000.00000002.mdmp") Found URL "http://redir.metaservices.microsoft.com/redir/dvddetails/9http://redir.metaservices.microsoft.com/redir/dvdwizard/?pshow" - Source: "00000000-00003736.00000000.66071.02E10000.00000002.mdmp") Found URL "http://windowsmedia.com/redir/services.asp?wmpfriendly=trueonlinestoresplearn" - Source: "00000000-00003736.00000000.66071.02E10000.00000002.mdmp") Found URL "http://www.microsoft.com/windows/windowsmedia/musicservices.aspx?http://redir.metaservices.microsoft.com/redir/allservices/?sv=2?http://redir.metaservices.microsoft.com/redir/allservices/?sv=3?http://redir.metaservices.microsoft.com/redir/allservices/?sv=5musicpicturesvideos/enter" - Source: "00000000-00003736.00000000.66071.02E10000.00000002.mdmp") Found URL "http://timevalue705030)0'http://www.digicert.com/cps0vj0h0$http://ocsp.digicert.com0@4http://cacerts.digicert.com/cloudflareincrsaca-2.crt0qhyfqc4i?9z6>.y8l(t$" - Source: "00000000-00003736.00000001.66453.00250000.00000004.mdmp") Found URL "http://ocsp.digicert.com0:3010/)http://crl3.digicert.com/omniroot2025.crl0mf0d070*0(https://www.digicert.com/cps0r.\ozj5u$^" - Source: "00000000-00003736.00000001.66453.00250000.00000004.mdmp") Found URL "https://ipinfo.io/widget/demo/67.218.111.202gu29iqmgvw,czcinternet1verisign," - Source: "00000000-00003736.00000001.66453.00250000.00000004.mdmp") Found URL "https://ipinfo.io/bdddsystemfunction035ldappku2u" - Source: "00000000-00003736.00000001.66453.00250000.00000004.mdmp") Found URL "http://isrg.trustid.ocsp.identrust.com0;/http://apps.identrust.com/roots/dstrootcax3.p7c0m0k0000." - Source: "00000000-00003736.00000001.66453.00250000.00000004.mdmp") Found URL "http://cps.root-x1.letsencrypt.org0<50301+http://crl.identrust.com/dstrootcax3crl.crl0ig'" - Source: "00000000-00003736.00000001.66453.00250000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0>^" - Source: "00000000-00003736.00000001.66453.00250000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00003736.00000001.66453.00250000.00000004.mdmp") Found URL "http://www.microsoft.com/windows0^ziq$(c\a6\4[=1.3.6.1.4.1.311.10.1210316072924z0/^g(o-cejy" - Source: "00000000-00003736.00000001.66453.00250000.00000004.mdmp") Found URL "https://www.maxmind.com/en/locate-my-ip-addressty/medresslb-instachttp://www.maxmind.com/geoip/v2.1/city/me" - Source: "00000000-00003736.00000001.66453.00250000.00000004.mdmp") Found URL "https://www.cloudflare.com/5xx-error-landing" - Source: "00000000-00003736.00000001.66453.00250000.00000004.mdmp") Found URL "https://www.maxmind.com/en/locate-my-ip-addressmozilla/5.0" - Source: "00000000-00003736.00000001.66453.00250000.00000004.mdmp") Found URL "https://www.maxmind.com/en/locate-my-ip-addressuser-agent:" - Source: "00000000-00003736.00000001.66453.00250000.00000004.mdmp") Found URL "https://ipinfo.io/https://www.maxmind.com/en/locate-my-ip-addressauthorization:" - Source: "00000000-00003736.00000001.66453.00400000.00000040.mdmp") Found URL "http://www.winimage.com/zlibdllherfqq2lyf8x5[x]tiulm:.p)q+e4" - Source: "00000000-00003736.00000001.66453.00400000.00000040.mdmp") Found URL "https://ipinfo.io/https://www.maxmind.com/en/locate-my-ip-addressauthorization:" - Source: "00000000-00003736.00000001.66453.022B0000.00000040.mdmp") Found URL "http://www.winimage.com/zlibdllherfqq2lyf8x5[x]tiulm:.p)q+e4" - Source: "00000000-00003736.00000001.66453.022B0000.00000040.mdmp") Found URL "http://crl.usertrust.com/addtrustexternalcaroot.crl05)0'0%http://ocsp.usertrust.com0ql" - Source: "00000000-00003736.00000001.66453.02B20000.00000004.mdmp") Found URL "https://www.verisign.com/cps04*0(0&" - Source: "00000000-00003736.00000001.66453.02B20000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl0izttpsalt" - Source: "00000000-00003736.00000001.66453.02B20000.00000004.mdmp") Found URL "http://www.usertrust.com1utn-userfirst-hardware0110315000000z140314235959z0384771florida1english1sea" - Source: "00000000-00003736.00000001.66453.02B20000.00000004.mdmp") Found URL "https://secure.comodo.com/cps0" - Source: "00000000-00003736.00000001.66453.02B20000.00000004.mdmp") Found URL "http://crl.comodoca.com/utn-userfirst-hardware.crl060http://crl.comodo.net/utn-userfirst-hardware.crl0qe0c0;/http://crt.comodoca.com/utnaddtrustserverca.crt0$http://ocsp.comodoca.com05addons.mozilla.orgwww.addons.mozilla.org0zsb)j9e/salt" - Source: "00000000-00003736.00000001.66453.02B20000.00000004.mdmp") Found URL "http://crl.comodoca.com/utn-userfirst-hardware.crl060http://crl.comodo.net/utn-userfirst-hardware.crl0qe0c0;/http://crt.comodoca.com/utnaddtrustserverca.crt0$http://ocsp.comodoca.com0%www.google.comgoogle.com0io]l,e9n0p1+0)" - Source: "00000000-00003736.00000001.66453.02B20000.00000004.mdmp") Found URL "http://www.public-trust.com/cps/omniroot.html0w0u1gte" - Source: "00000000-00003736.00000001.66453.02B20000.00000004.mdmp") Found URL "http://www.public-trust.com/cgi-bin/crl/2018/cdp.crl0dmxt*j]+xijom5o" - Source: "00000000-00003736.00000001.66453.02B20000.00000004.mdmp") Found URL "http://ocsp.entrust.net03,0*0(" - Source: "00000000-00003736.00000001.66453.02B20000.00000004.mdmp") Found URL "http://crl.entrust.net/server1.crl0;8kbv7.11c)d[b" - Source: "00000000-00003736.00000001.66453.02B20000.00000004.mdmp") Found URL "http://www.diginotar.nl/cps/pkioverheid0w0u1staat" - Source: "00000000-00003736.00000001.66453.02B20000.00000004.mdmp") Found URL "http://crl.pkioverheid.nl/domovlatestcrl.crl0]ko)tsz'.x^y2htth.$jsalt" - Source: "00000000-00003736.00000001.66453.02B20000.00000004.mdmp") Found URL "http://crl.comodoca.com/utn-userfirst-hardware.crl060http://crl.comodo.net/utn-userfirst-hardware.crl0qe0c0;/http://crt.comodoca.com/utnaddtrustserverca.crt0$http://ocsp.comodoca.com0/login.skype.comwww.login.skype.com0gte" - Source: "00000000-00003736.00000001.66453.02B20000.00000004.mdmp") Found URL "http://cybertrust.omniroot.com/repository.cfm0w0u1gte" - Source: "00000000-00003736.00000001.66453.02B20000.00000004.mdmp") Found URL "http://www.public-trust.com/cgi-bin/crl/2018/cdp.crl0j)z" - Source: "00000000-00003736.00000001.66453.02B20000.00000004.mdmp") Found URL "http://www.usertrust.com1utn-userfirst-hardware0110315000000z140314235959z0384771florida1tampa1sea" - Source: "00000000-00003736.00000001.66453.02B20000.00000004.mdmp") Found URL "http://crl.comodoca.com/utn-userfirst-hardware.crl060http://crl.comodo.net/utn-userfirst-hardware.crl0qe0c0;/http://crt.comodoca.com/utnaddtrustserverca.crt0$http://ocsp.comodoca.com0global" - Source: "00000000-00003736.00000001.66453.02B20000.00000004.mdmp") Found URL "http://www.diginotar.nl/cps/pkioverheid0\0z1staat" - Source: "00000000-00003736.00000001.66453.02B20000.00000004.mdmp") Found URL "http://crl.pkioverheid.nl/domorganisatielatestcrl-g2.crl0^tl*" - Source: "00000000-00003736.00000001.66453.02B20000.00000004.mdmp") Found URL "http://www.public-trust.com/cgi-bin/crl/2018/cdp.crl0or" - Source: "00000000-00003736.00000001.66453.02B20000.00000004.mdmp") Found URL "https://www.verisign.com/repository/cpsthis" - Source: "00000000-00003736.00000001.66453.02B20000.00000004.mdmp") Found URL "https://www.verisign.com;" - Source: "00000000-00003736.00000001.66453.02B20000.00000004.mdmp") Found URL "https://www.verisign.com/repository/verisignlogo.gif0d=0;090*0(https://www.verisign.com/rpa0d1r06x7y1%2+jopijlf0(+pw)salt" - Source: "00000000-00003736.00000001.66453.02B20000.00000004.mdmp") Found URL "http://crl.comodoca.com/utn-userfirst-hardware.crl060http://crl.comodo.net/utn-userfirst-hardware.crl0qe0c0;/http://crt.comodoca.com/utnaddtrustserverca.crt0$http://ocsp.comodoca.com0/login.yahoo.comwww.login.yahoo.com0yvr,salt" - Source: "00000000-00003736.00000001.66453.02B20000.00000004.mdmp") Found URL "http://crl.comodoca.com/utn-userfirst-hardware.crl060http://crl.comodo.net/utn-userfirst-hardware.crl0qe0c0;/http://crt.comodoca.com/utnaddtrustserverca.crt0$http://ocsp.comodoca.com0/mail.google.comwww.mail.google.com0?=*k!\yro2;nki0!!salt" - Source: "00000000-00003736.00000001.66453.02B20000.00000004.mdmp") Found URL "http://crl.comodoca.com/utn-userfirst-hardware.crl060http://crl.comodo.net/utn-userfirst-hardware.crl0qe0c0;/http://crt.comodoca.com/utnaddtrustserverca.crt0$http://ocsp.comodoca.com0login.yahoo.com0kw(=n" - Source: "00000000-00003736.00000001.66453.02B20000.00000004.mdmp") Found URL "https://www.verisign.com/repository/verisignlogo.gif0d=0;090*0(https://www.verisign.com/rpa0f$\_)$bf!entrust.net1;092www.entrust.net/cps" - Source: "00000000-00003736.00000001.66453.02B20000.00000004.mdmp") Found URL "http://crl.entrust.net/server1.crl0;8kbv7.1q7z?," - Source: "00000000-00003736.00000001.66453.02B20000.00000004.mdmp") Found URL "http://ocsp.entrust.net0d=0;09000." - Source: "00000000-00003736.00000001.66453.02B20000.00000004.mdmp") Found URL "http://www.digicert.com.my/cps.htm02+0)0'!http://crl.entrust.net/2048ca.crl09yk3y!gte" - Source: "00000000-00003736.00000001.66453.02B20000.00000004.mdmp") Found URL "http://www.public-trust.com/cgi-bin/crl/2018/cdp.crl0\0" - Source: "00000000-00003736.00000001.66453.02B20000.00000004.mdmp") Found URL "http://crl.pkioverheid.nl/domovlatestcrl.crl00ev" - Source: "00000000-00003736.00000001.66453.02B20000.00000004.mdmp") Found URL "http://crl.comodoca.com/utn-userfirst-hardware.crl060http://crl.comodo.net/utn-userfirst-hardware.crl0qe0c0;/http://crt.comodoca.com/utnaddtrustserverca.crt0$http://ocsp.comodoca.com0-login.live.comwww.login.live.com0nwk1uy1un:9*cosalt" - Source: "00000000-00003736.00000001.66453.02B20000.00000004.mdmp") Found URL "http://crl.comodoca.com/utn-userfirst-hardware.crl060http://crl.comodo.net/utn-userfirst-hardware.crl0qe0c0;/http://crt.comodoca.com/utnaddtrustserverca.crt0$http://ocsp.comodoca.com0login.yahoo.com0oc*9entrust.net1;092www.entrust.net/cps" - Source: "00000000-00003736.00000001.66453.02B20000.00000004.mdmp") Found URL "http://crl.entrust.net/server1.crl0v7.1ctj7+>.entrusikt,com1" - Source: "00000000-00003736.00000001.66453.02B20000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl0th0f0d8http://www.microsoft.com/pki/certs/microsoftrootcert.crt0>ej-+\lu>gvpob\hzagxr" - Source: "00000000-00003736.00000001.66453.02B20000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif0\:oj?us1!0the" - Source: "00000000-00003736.00000001.66453.02B20000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif03130$j0_b>mnk't" - Source: "00000000-00003736.00000001.66453.02B20000.00000004.mdmp") Found URL "http://www.microsoft.com/windows0^ziq$(c\a6\4[=suuu@s-hhsmqdy32" - Source: "00000000-00003736.00000001.66453.02B20000.00000004.mdmp")58:T8f8,Found string "GET /demo/home.php?s=67.218.111.202 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: db-ip.com" (Indicator: "HTTP/1.1"; File: "SSL") file/memory contains long string with (Indicator: "HTTP/1.1"; File: "SSL") Found string "GET / HTTP/1.1Accept: text/html, application/xhtml+xml, */*Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: accounts.google.comDNT: 1Connection: Keep-Alive" (Indicator: "HTTP/1.1"; File: "SSL") Found string "HTTP/1.1 204 No ContentContent-Length: 0Cross-Origin-Resource-Policy: cross-originDate: Sat, 09 Dec 2023 20:46:15 GMTAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000" (Indicator: "HTTP/1.1"; File: "SSL") Found string "GET /login HTTP/1.1Accept: text/html, application/xhtml+xml, */*User-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateDNT: 1Host: www.facebook.comConnection: Keep-AliveAccept-Language: en-US" (Indicator: "HTTP/1.1"; File: "SSL") Found string "GET /rsrc.php/yb/r/hLRJ1GG_y0J.ico HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoHost: static.xx.fbcdn.netDNT: 1Connection: Keep-Alive" (Indicator: "HTTP/1.1"; File: "SSL") Found string "HTTP/1.1 304 Not ModifiedDate: Wed, 06 Dec 2023 15:07:35 GMTExpires: Thu, 05 Dec 2024 15:07:35 GMTLast-Modified: Mon, 16 Oct 2017 17:32:56 GMTCache-Control: public, max-age=31536000Age: 279513Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000" (Indicator: "HTTP/1.1"; File: "SSL") Found string "HTTP/1.1 304 Not ModifiedDate: Wed, 06 Dec 2023 15:07:35 GMTExpires: Thu, 05 Dec 2024 15:07:35 GMTLast-Modified: Mon, 16 Oct 2017 17:32:56 GMTCache-Control: public, max-age=31536000Age: 279514Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000" (Indicator: "HTTP/1.1"; File: "SSL") Found string "GET /favicon.ico HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoDNT: 1Connection: Keep-AliveHost: www.google.com" (Indicator: "HTTP/1.1"; File: "SSL")59:T1393,Contains base62 string in header "MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V" in header "GET /gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base62 string in header "ME4wTDBKMEgwRjAJBgUrDgMCGgUABBQwk" in header "GET /gtsr1/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBQwkcLWD4LqGJ7bE7B1XZsEbmfwUAQU5K8rJnEaK0gnhS9SZizv8IkTcT4CDQIDvFNZazTHGPUBUGY%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base62 string in header "cLWD4LqGJ7bE7B1XZsEbmfwUAQU5K8rJn" in header "GET /gtsr1/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBQwkcLWD4LqGJ7bE7B1XZsEbmfwUAQU5K8rJnEaK0gnhS9SZizv8IkTcT4CDQIDvFNZazTHGPUBUGY%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base62 string in header "EaK0gnhS9SZizv8IkTcT4CDQIDvFNZazT" in header "GET /gtsr1/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBQwkcLWD4LqGJ7bE7B1XZsEbmfwUAQU5K8rJnEaK0gnhS9SZizv8IkTcT4CDQIDvFNZazTHGPUBUGY%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base62 string in header "MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHL" in header "GET /gts1c3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEBZwXm7t3kKEEFjsmHQeLcQ%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base62 string in header "2Fr4XN7pXNPZzQ4kYU83E1HScCEBZwXm7" in header "GET /gts1c3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEBZwXm7t3kKEEFjsmHQeLcQ%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base62 string in header "MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTHL" in header "GET /gts1c3/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEQClj3zJOwEs2AlR6v%2BfUXog HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base62 string in header "2Fr4XN7pXNPZzQ4kYU83E1HScCEQClj3z" in header "GET /gts1c3/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEQClj3zJOwEs2AlR6v%2BfUXog HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base62 string in header "MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTHL" in header "GET /gts1c3/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEQClj3zJOwEs2AlR6v%2BfUXog HTTP/1.1Cache-Control: max-age = 14400Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base62 string in header "2Fr4XN7pXNPZzQ4kYU83E1HScCEQClj3z" in header "GET /gts1c3/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEQClj3zJOwEs2AlR6v%2BfUXog HTTP/1.1Cache-Control: max-age = 14400Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base62 string in header "MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHL" in header "GET /gts1c3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEDEixfO34qnbCeE6N8VMp00%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base62 string in header "2Fr4XN7pXNPZzQ4kYU83E1HScCEDEixfO" in header "GET /gts1c3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEDEixfO34qnbCeE6N8VMp00%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base62 string in header "MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHL" in header "GET /gts1c3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEGpYRvzN3kAuEMlMWsqSFLc%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base62 string in header "2Fr4XN7pXNPZzQ4kYU83E1HScCEGpYRvz" in header "GET /gts1c3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEGpYRvzN3kAuEMlMWsqSFLc%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base62 string in header "MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHL" in header "GET /gts1c3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEGpYRvzN3kAuEMlMWsqSFLc%3D HTTP/1.1Cache-Control: max-age = 14400Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base62 string in header "2Fr4XN7pXNPZzQ4kYU83E1HScCEGpYRvz" in header "GET /gts1c3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEGpYRvzN3kAuEMlMWsqSFLc%3D HTTP/1.1Cache-Control: max-age = 14400Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog"5a:T74c,Observed string: "__d("URISchemes",["$InternalEnum"],(function(a,b,c,d,e,f){"use strict";var g=new Set(["about","accountscenter","aidemos","aistudio","apk","blob","cmms","fb","fba","fbatwork","fb-ama","fb-internal","fb-workchat","fb-workchat-secure","fb-messenger","fb-messenger-public","fb-messenger-group-thread","fb-page-messages","fb-pma","fbcf","fbconnect","fbinternal","fbmobilehome","fbrpc","file","flipper","ftp","gtalk","http","https","mailto","wss","ms-app","intent","itms","itms-apps","itms-services","lasso","market","svn+ssh","fbstaging","tel","sms","pebblejs","sftp","whatsapp","moments","flash","fblite","chrome-extension","webcal","instagram","iglite","fb124024574287414","fb124024574287414rc","fb124024574287414master","fb1576585912599779","fb929757330408142","designpack","fbpixelcloud","fbapi20130214","fb1196383223757595","tbauth","oculus","oculus.store","oculus.feed","oculusstore","socialplatform","odh","com.oculus.rd","aria","skype","ms-windows-store","callto","messenger","workchat","fb236786383180508","fb1775440806014337","data","fb-mk","munki","origami-file","fb-nimble-vrsrecorder","fb-nimble-monohandtrackingvis","together","togetherbl","horizonlauncher","venues","whatsapp-consumer","whatsapp-smb","fb-ide-opener","fb-vscode","fb-vscode-insiders","editor","spark-studio","spark-player","spark-simulator","arstudio","manifold","origami-internal","origami-public","stella","mwa","mattermost","logaggregator","pcoip","cinema","home","oculus360photos","systemux"]),h=b("$InternalEnum")({EXPLICITLY_ALLOWED_SCHEMES_ONLY:"explicitly_allowed_schemes_only",INCLUDE_DEFAULTS:"include_defaults"});function a(a,b,c){b===void 0&&(b=h.INCLUDE_DEFAULTS);return a==null||a===""?!0:(c==null?void 0:c.has(a.toLowerCase()))||b===h.INCLUDE_DEFAULTS&&g.has(a.toLowerCase())}f.Options=h;f.isAllowed=a}),66);" (Indicator: ""sftp") in Source: Ijg_IKf_KOp_1_.js5b:T4d0,"afa6fbd86c448bceaf510ae6f8b831be.exe" called "FindFirstFileW" with parameter %TEMP%\IXP000.TMP\*.* (UID: 00000000-00001616) "afa6fbd86c448bceaf510ae6f8b831be.exe" called "FindNextFileW" with parameter .. (UID: 00000000-00001616) "afa6fbd86c448bceaf510ae6f8b831be.exe" called "FindNextFileW" with parameter 6FR1MW1.exe (UID: 00000000-00001616) "afa6fbd86c448bceaf510ae6f8b831be.exe" called "FindNextFileW" with parameter tB0lu63.exe (UID: 00000000-00001616) "afa6fbd86c448bceaf510ae6f8b831be.exe" called "FindFirstFileA" with parameter %TEMP%\IXP000.TMP\* (UID: 00000000-00001616) "afa6fbd86c448bceaf510ae6f8b831be.exe" called "FindNextFileA" with parameter .. (UID: 00000000-00001616) "tB0lu63.exe" called "FindFirstFileW" with parameter %TEMP%\IXP001.TMP\*.* (UID: 00000000-00003500) "tB0lu63.exe" called "FindNextFileW" with parameter .. (UID: 00000000-00003500) "tB0lu63.exe" called "FindNextFileW" with parameter 5eh2lq1.exe (UID: 00000000-00003500) "tB0lu63.exe" called "FindNextFileW" with parameter qP8xB26.exe (UID: 00000000-00003500) "tB0lu63.exe" called "FindFirstFileA" with parameter %TEMP%\IXP001.TMP\* (UID: 00000000-00003500) "tB0lu63.exe" called "FindNextFileA" with parameter .. (UID: 00000000-00003500)5c:T421,file/memory contains long string with (Indicator: "base64"; File: "GxGC52INhg0_1_.js") file/memory contains long string with (Indicator: ".decrypt"; File: "qvzskUrYlYC_1_.js") file/memory contains long string with (Indicator: ".encrypt"; File: "qvzskUrYlYC_1_.js") file/memory contains long string with (Indicator: "base64"; File: "qvzskUrYlYC_1_.js") file/memory contains long string with (Indicator: "blowfish"; File: "qvzskUrYlYC_1_.js") file/memory contains long string with (Indicator: "base64"; File: "hNaGl-uOTME_1_.js") file/memory contains long string with (Indicator: "aes"; File: "SSL") file/memory contains long string with (Indicator: "base64"; File: "identifier_1_.htm") file/memory contains long string with (Indicator: "base64"; File: "login_1_.htm") file/memory contains long string with (Indicator: "base64"; File: "Ijg_IKf_KOp_1_.js") file/memory contains long string with (Indicator: "base64"; File: "login_2_.htm") Found string "IAESCheck" (Indicator: "aes"; Source: "00000000-00001512.00000000.67840.6B221000.00000020.mdmp")5d:T595,Found reference to API "GetDesktopWindow" (Indicator: "GetDesktopWindow"; File: "afa6fbd86c448bceaf510ae6f8b831be.exe") Found reference to API "GetDC" (Indicator: "GetDC"; File: "afa6fbd86c448bceaf510ae6f8b831be.exe") Found reference to API "GetDesktopWindow" (Indicator: "GetDesktopWindow"; Source: "00000000-00001512.00000000.67840.00E5C000.00000002.mdmp") Found reference to API "GetDC" (Indicator: "GetDC"; Source: "00000000-00001512.00000000.67840.00E5C000.00000002.mdmp") Found reference to API "GetWindowDC" (Indicator: "GetWindowDC"; Source: "00000000-00001512.00000000.67840.00E5C000.00000002.mdmp") Found reference to API "CreateCompatibleBitmap" (Indicator: "CreateCompatibleBitmap"; Source: "00000000-00001512.00000000.67840.00E5C000.00000002.mdmp") Found reference to API "CreateCompatibleDC" (Indicator: "CreateCompatibleDC"; Source: "00000000-00001512.00000000.67840.00E5C000.00000002.mdmp") Found reference to API "GetDIBits" (Indicator: "GetDIBits"; Source: "00000000-00001512.00000000.67840.00E5C000.00000002.mdmp") Found reference to API "CreateDCW" (Indicator: "CreateDC"; Source: "00000000-00001512.00000000.67840.00E5C000.00000002.mdmp") Found reference to API "GetDesktopWindow" (Indicator: "GetDesktopWindow"; Source: "00000000-00002516.00000001.67151.008FA000.00000002.mdmp") Found reference to API "GetDC" (Indicator: "GetDC"; Source: "00000000-00002516.00000001.67151.008FA000.00000002.mdmp")5e:T6bf,Found reference to API "FindFirstFileA" (Indicator: "FindFirstFile"; File: "afa6fbd86c448bceaf510ae6f8b831be.exe") Found reference to API "FindNextFileA" (Indicator: "FindNextFile"; File: "afa6fbd86c448bceaf510ae6f8b831be.exe") Found reference to API "7584931143,1492,3114,,FindNextFileW,kernel32.dll,"252:03:10.641",RX=0,PX=0" (Indicator: "FindNextFile"; Source: "00000000-00001512.00000000.67840.005A0000.00000004.mdmp, 00000000-00001512.00000001.68017.005F6000.00000004.mdmp") Found reference to API "FindFirstFileW" (Indicator: "FindFirstFile"; Source: "00000000-00001512.00000000.67840.00E5C000.00000002.mdmp") Found reference to API "FindNextFileW" (Indicator: "FindNextFile"; Source: "00000000-00001512.00000000.67840.00E5C000.00000002.mdmp") Found reference to API "FindFirstFileExW" (Indicator: "FindFirstFile"; Source: "00000000-00001512.00000000.67840.00E5C000.00000002.mdmp") Found reference to API "975675294,3572,3114,,FindNextFileW,kernel32.dll,"252:02:37.834",RX=0,PX=0" (Indicator: "FindNextFile"; Source: "00000000-00001616.00000000.65913.00600000.00000004.mdmp, 00000000-00001616.00000001.67833.00600000.00000004.mdmp, 00000000-00001616.00000002.68025.00600000.00000004.mdmp") Found reference to API "71620182356,3572,3114,,FindNextFileW,kernel32.dll,"252:03:07.271",RX=0,PX=0" (Indicator: "FindNextFile"; Source: "00000000-00001616.00000001.67833.00600000.00000004.mdmp, 00000000-00001616.00000002.68025.00600000.00000004.mdmp") Found reference to API "FindFirstFileA" (Indicator: "FindFirstFile"; Source: "00000000-00002516.00000001.67151.008FA000.00000002.mdmp") Found reference to API "FindNextFileA" (Indicator: "FindNextFile"; Source: "00000000-00002516.00000001.67151.008FA000.00000002.mdmp")5f:T941,Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; File: "afa6fbd86c448bceaf510ae6f8b831be.exe") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; File: "afa6fbd86c448bceaf510ae6f8b831be.exe") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; File: "afa6fbd86c448bceaf510ae6f8b831be.exe") Found reference to API "GetModuleHandleA" (Indicator: "GetModuleHandle"; File: "MaxLoonaFest131.exe.1646122814") Found reference to API "GetEnvironmentStringsW" (Indicator: "GetEnvironmentStrings"; File: "MaxLoonaFest131.exe.1646122814") Found reference to API "GetModuleHandleExW" (Indicator: "GetModuleHandle"; Source: "00000000-00001512.00000000.67840.00E5C000.00000002.mdmp") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; Source: "00000000-00001512.00000000.67840.00E5C000.00000002.mdmp, 00000000-00001512.00000000.67840.6B260000.00000002.mdmp") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00001512.00000000.67840.00E5C000.00000002.mdmp, 00000000-00001512.00000000.67840.6B260000.00000002.mdmp") Found reference to API "CreateToolhelp32Snapshot" (Indicator: "CreateToolhelp32Snapshot"; Source: "00000000-00001512.00000000.67840.00E5C000.00000002.mdmp") Found reference to API "Process32FirstW" (Indicator: "Process32First"; Source: "00000000-00001512.00000000.67840.00E5C000.00000002.mdmp") Found reference to API "Process32NextW" (Indicator: "Process32Next"; Source: "00000000-00001512.00000000.67840.00E5C000.00000002.mdmp") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; Source: "00000000-00001512.00000000.67840.00E5C000.00000002.mdmp, 00000000-00001512.00000000.67840.6B260000.00000002.mdmp") Found reference to API "GetEnvironmentStringsW" (Indicator: "GetEnvironmentStrings"; Source: "00000000-00001512.00000000.67840.00E5C000.00000002.mdmp") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; Source: "00000000-00002516.00000001.67151.008FA000.00000002.mdmp") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00002516.00000001.67151.008FA000.00000002.mdmp") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; Source: "00000000-00002516.00000001.67151.008FA000.00000002.mdmp")60:T60c,Found reference to API "RegOpenKeyExA" (Indicator: "RegOpenKey"; File: "afa6fbd86c448bceaf510ae6f8b831be.exe") Found reference to API "RegQueryInfoKeyA" (Indicator: "RegQueryInfoKey"; File: "afa6fbd86c448bceaf510ae6f8b831be.exe") Found reference to API "RegQueryValueExA" (Indicator: "RegQueryValue"; File: "afa6fbd86c448bceaf510ae6f8b831be.exe") Found reference to API "RegOpenKeyExW" (Indicator: "RegOpenKey"; Source: "00000000-00001512.00000000.67840.00E5C000.00000002.mdmp, 00000000-00001512.00000000.67840.6B260000.00000002.mdmp") Found reference to API "RegQueryValueExW" (Indicator: "RegQueryValue"; Source: "00000000-00001512.00000000.67840.00E5C000.00000002.mdmp, 00000000-00001512.00000000.67840.6B260000.00000002.mdmp") Found reference to API "RegEnumKeyExW" (Indicator: "RegEnumKey"; Source: "00000000-00001512.00000000.67840.00E5C000.00000002.mdmp") Found reference to API "RegEnumValueW" (Indicator: "RegEnumValue"; Source: "00000000-00001512.00000000.67840.00E5C000.00000002.mdmp") Found reference to API "RegGetValueW" (Indicator: "RegGetValue"; Source: "00000000-00001512.00000000.67840.6B260000.00000002.mdmp") Found reference to API "RegOpenKeyExA" (Indicator: "RegOpenKey"; Source: "00000000-00002516.00000001.67151.008FA000.00000002.mdmp") Found reference to API "RegQueryInfoKeyA" (Indicator: "RegQueryInfoKey"; Source: "00000000-00002516.00000001.67151.008FA000.00000002.mdmp") Found reference to API "RegQueryValueExA" (Indicator: "RegQueryValue"; Source: "00000000-00002516.00000001.67151.008FA000.00000002.mdmp")61:Teec,Found reference to API "GetFileAttributesA" (Indicator: "GetFileAttributes"; File: "afa6fbd86c448bceaf510ae6f8b831be.exe") Found reference to API "GetSystemDirectoryA" (Indicator: "GetSystemDirectory"; File: "afa6fbd86c448bceaf510ae6f8b831be.exe") Found reference to API "GetCurrentDirectoryA" (Indicator: "GetCurrentDirectory"; File: "afa6fbd86c448bceaf510ae6f8b831be.exe") Found reference to API "GetTempPathA" (Indicator: "GetTempPath"; File: "afa6fbd86c448bceaf510ae6f8b831be.exe") Found reference to API "GetTempFileNameA" (Indicator: "GetTempFileName"; File: "afa6fbd86c448bceaf510ae6f8b831be.exe") Found reference to API "GetFileVersionInfoSizeA" (Indicator: "GetFileVersionInfo"; File: "afa6fbd86c448bceaf510ae6f8b831be.exe") Found reference to API "GetFileVersionInfoSizeA" (Indicator: "GetFileVersionInfoSize"; File: "afa6fbd86c448bceaf510ae6f8b831be.exe") Found reference to API "GetFileVersionInfoA" (Indicator: "GetFileVersionInfo"; File: "afa6fbd86c448bceaf510ae6f8b831be.exe") Found reference to API "GetFileVersionInfoSizeW" (Indicator: "GetFileVersionInfo"; Source: "00000000-00001512.00000000.67840.00E5C000.00000002.mdmp") Found reference to API "GetFileVersionInfoSizeW" (Indicator: "GetFileVersionInfoSize"; Source: "00000000-00001512.00000000.67840.00E5C000.00000002.mdmp") Found reference to API "GetFileVersionInfoW" (Indicator: "GetFileVersionInfo"; Source: "00000000-00001512.00000000.67840.00E5C000.00000002.mdmp") Found reference to API "FtpGetFileSize" (Indicator: "GetFileSize"; Source: "00000000-00001512.00000000.67840.00E5C000.00000002.mdmp") Found reference to API "GetCurrentDirectoryW" (Indicator: "GetCurrentDirectory"; Source: "00000000-00001512.00000000.67840.00E5C000.00000002.mdmp, 00000000-00001512.00000000.67840.6B260000.00000002.mdmp") Found reference to API "GetFileAttributesW" (Indicator: "GetFileAttributes"; Source: "00000000-00001512.00000000.67840.00E5C000.00000002.mdmp") Found reference to API "GetTempPathW" (Indicator: "GetTempPath"; Source: "00000000-00001512.00000000.67840.00E5C000.00000002.mdmp") Found reference to API "GetTempFileNameW" (Indicator: "GetTempFileName"; Source: "00000000-00001512.00000000.67840.00E5C000.00000002.mdmp") Found reference to API "GetFileSize" (Indicator: "GetFileSize"; Source: "00000000-00001512.00000000.67840.00E5C000.00000002.mdmp") Found reference to API "GetSystemDirectoryW" (Indicator: "GetSystemDirectory"; Source: "00000000-00001512.00000000.67840.00E5C000.00000002.mdmp") Found reference to API "SHGetSpecialFolderLocation" (Indicator: "SHGetSpecialFolderLocation"; Source: "00000000-00001512.00000000.67840.00E5C000.00000002.mdmp") Found reference to API "GetFileAttributesA" (Indicator: "GetFileAttributes"; Source: "00000000-00002516.00000001.67151.008FA000.00000002.mdmp") Found reference to API "GetSystemDirectoryA" (Indicator: "GetSystemDirectory"; Source: "00000000-00002516.00000001.67151.008FA000.00000002.mdmp") Found reference to API "GetCurrentDirectoryA" (Indicator: "GetCurrentDirectory"; Source: "00000000-00002516.00000001.67151.008FA000.00000002.mdmp") Found reference to API "GetTempPathA" (Indicator: "GetTempPath"; Source: "00000000-00002516.00000001.67151.008FA000.00000002.mdmp") Found reference to API "GetTempFileNameA" (Indicator: "GetTempFileName"; Source: "00000000-00002516.00000001.67151.008FA000.00000002.mdmp") Found reference to API "GetFileVersionInfoSizeA" (Indicator: "GetFileVersionInfo"; Source: "00000000-00002516.00000001.67151.008FA000.00000002.mdmp") Found reference to API "GetFileVersionInfoSizeA" (Indicator: "GetFileVersionInfoSize"; Source: "00000000-00002516.00000001.67151.008FA000.00000002.mdmp") Found reference to API "GetFileVersionInfoA" (Indicator: "GetFileVersionInfo"; Source: "00000000-00002516.00000001.67151.008FA000.00000002.mdmp")62:T771,Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; File: "afa6fbd86c448bceaf510ae6f8b831be.exe") Found reference to API "OpenProcessToken" (Indicator: "OpenProcessToken"; File: "afa6fbd86c448bceaf510ae6f8b831be.exe") file/memory contains long string with (Indicator: "OpenProcessToken"; File: "afa6fbd86c448bceaf510ae6f8b831be.exe") Found reference to API "GetUserObjectInformationA" (Indicator: "GetUserObjectInformation"; File: "MaxLoonaFest131.exe.1646122814") Found reference to API "GetProcessWindowStation" (Indicator: "GetProcessWindowStation"; File: "MaxLoonaFest131.exe.1646122814") Found reference to API "GetUserObjectInformationW" (Indicator: "GetUserObjectInformation"; File: "5eh2lq1.exe.27807583") Found reference to API "GetUserObjectSecurity" (Indicator: "GetUserObjectSecurity"; Source: "00000000-00001512.00000000.67840.00E5C000.00000002.mdmp") Found reference to API "GetProcessWindowStation" (Indicator: "GetProcessWindowStation"; Source: "00000000-00001512.00000000.67840.00E5C000.00000002.mdmp") Found reference to API "OpenProcessToken" (Indicator: "OpenProcessToken"; Source: "00000000-00001512.00000000.67840.00E5C000.00000002.mdmp") Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; Source: "00000000-00001512.00000000.67840.00E5C000.00000002.mdmp") Found reference to API "GetUserNameW" (Indicator: "GetUserName"; Source: "00000000-00001512.00000000.67840.00E5C000.00000002.mdmp") file/memory contains long string with (Indicator: "OpenProcessToken"; Source: "00000000-00002516.00000001.67151.008FA000.00000002.mdmp") Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; Source: "00000000-00002516.00000001.67151.008FA000.00000002.mdmp") Found reference to API "OpenProcessToken" (Indicator: "OpenProcessToken"; Source: "00000000-00002516.00000001.67151.008FA000.00000002.mdmp")63:T12f2,Found string ":\Windows\System32\DriverStore" (Indicator: "system32\drivers"; Source: "00000000-00000904.00000000.66782.00800000.00000004.mdmp") Found string "indows\System32\DriverStore\infpub.dat" (Indicator: "system32\drivers"; Source: "00000000-00000904.00000000.66782.00800000.00000004.mdmp") Found string ":\Windows\System32\DriverStore\infstor.dat" (Indicator: "system32\drivers"; Source: "00000000-00000904.00000000.66782.00800000.00000004.mdmp") Found string ":\Windows\System32\DriverStore\infstrng.dat" (Indicator: "system32\drivers"; Source: "00000000-00000904.00000000.66782.00800000.00000004.mdmp") Found string ":\Windows\System32\DriverStore\drvindex.dat" (Indicator: "system32\drivers"; Source: "00000000-00000904.00000000.66782.00800000.00000004.mdmp") Found string "indows\System32\DriverStore\FileRepository" (Indicator: "system32\drivers"; Source: "00000000-00000904.00000000.66782.00800000.00000004.mdmp") Found string ":\Windows\System32\DriverStore" (Indicator: "system32\drivers"; Source: "00000000-00001512.00000000.67840.005A0000.00000004.mdmp") Found string ":\Windows\System32\DriverStore\infpub.dat" (Indicator: "system32\drivers"; Source: "00000000-00001512.00000000.67840.005A0000.00000004.mdmp, 00000000-00001512.00000001.68017.005A0000.00000004.mdmp") Found string ":\Windows\System32\DriverStore\infstor.dat" (Indicator: "system32\drivers"; Source: "00000000-00001512.00000000.67840.005A0000.00000004.mdmp") Found string ":\Windows\System32\DriverStore\infstrng.dat" (Indicator: "system32\drivers"; Source: "00000000-00001512.00000000.67840.005A0000.00000004.mdmp, 00000000-00001512.00000001.68017.005A0000.00000004.mdmp") Found string ":\Windows\System32\DriverStore\drvindex.dat" (Indicator: "system32\drivers"; Source: "00000000-00001512.00000000.67840.005A0000.00000004.mdmp, 00000000-00001512.00000001.68017.005A0000.00000004.mdmp") Found string ":\Windows\System32\DriverStore\FileRepository" (Indicator: "system32\drivers"; Source: "00000000-00001512.00000000.67840.005A0000.00000004.mdmp") Found string "\Device\HarddiskVolume2\Users\HAPUBWS\AppData\Local\Temp\IXP000.TMP\6FR1MW1.exe" (Indicator: "\Device\"; Source: "00000000-00001512.00000000.67840.005A0000.00000004.mdmp, 00000000-00001512.00000001.68017.005A0000.00000004.mdmp") Found string "\Windows\System32\DriverStore" (Indicator: "system32\drivers"; Source: "00000000-00001512.00000001.68017.005A0000.00000004.mdmp") Found string "indows\System32\DriverStore\infstor.dat" (Indicator: "system32\drivers"; Source: "00000000-00001512.00000001.68017.005A0000.00000004.mdmp") Found string "indows\System32\DriverStore\FileRepository" (Indicator: "system32\drivers"; Source: "00000000-00001512.00000001.68017.005A0000.00000004.mdmp") Found string ":\Windows\System32\DriverStore" (Indicator: "system32\drivers"; Source: "00000000-00001616.00000000.65913.00600000.00000004.mdmp, 00000000-00001616.00000001.67833.00600000.00000004.mdmp, 00000000-00001616.00000002.68025.00600000.00000004.mdmp") Found string ":\Windows\System32\DriverStore\infpub.dat" (Indicator: "system32\drivers"; Source: "00000000-00001616.00000000.65913.00600000.00000004.mdmp, 00000000-00001616.00000001.67833.00600000.00000004.mdmp, 00000000-00001616.00000002.68025.00600000.00000004.mdmp") Found string ":\Windows\System32\DriverStore\infstor.dat" (Indicator: "system32\drivers"; Source: "00000000-00001616.00000000.65913.00600000.00000004.mdmp, 00000000-00001616.00000001.67833.00600000.00000004.mdmp") Found string ":\Windows\System32\DriverStore\infstrng.dat" (Indicator: "system32\drivers"; Source: "00000000-00001616.00000000.65913.00600000.00000004.mdmp, 00000000-00001616.00000001.67833.00600000.00000004.mdmp, 00000000-00001616.00000002.68025.00600000.00000004.mdmp") Found string ":\Windows\System32\DriverStore\drvindex.dat" (Indicator: "system32\drivers"; Source: "00000000-00001616.00000000.65913.00600000.00000004.mdmp, 00000000-00001616.00000001.67833.00600000.00000004.mdmp, 00000000-00001616.00000002.68025.00600000.00000004.mdmp") Found string ":\Windows\System32\DriverStore\FileRepository" (Indicator: "system32\drivers"; Source: "00000000-00001616.00000000.65913.00600000.00000004.mdmp, 00000000-00001616.00000001.67833.00600000.00000004.mdmp") Found string "\Device\HarddiskVolume2\afa6fbd86c448bceaf510ae6f8b831be.exe" (Indicator: "\Device\"; Source: "00000000-00001616.00000000.65913.00600000.00000004.mdmp, 00000000-00001616.00000001.67833.00600000.00000004.mdmp, 00000000-00001616.00000002.68025.00600000.00000004.mdmp") Found string "indows\System32\DriverStore\infstor.dat" (Indicator: "system32\drivers"; Source: "00000000-00001616.00000002.68025.00600000.00000004.mdmp") Found string "indows\System32\DriverStore\FileRepository" (Indicator: "system32\drivers"; Source: "00000000-00001616.00000002.68025.00600000.00000004.mdmp")64:T49a,Found reference to API "DeleteFileA" (Indicator: "DeleteFile"; File: "afa6fbd86c448bceaf510ae6f8b831be.exe") Found reference to API "RemoveDirectoryA" (Indicator: "RemoveDirectory"; File: "afa6fbd86c448bceaf510ae6f8b831be.exe") Found reference to API "DeleteFileW" (Indicator: "DeleteFile"; Source: "00000000-00001512.00000000.67840.00E5C000.00000002.mdmp") Found reference to API "RemoveDirectoryW" (Indicator: "RemoveDirectory"; Source: "00000000-00001512.00000000.67840.00E5C000.00000002.mdmp") Found reference to API "90523823988,3572,3130,,RemoveDirectoryA,kernel32.dll,"252:03:15.150",RX=0,PX=0" (Indicator: "RemoveDirectory"; Source: "00000000-00001616.00000002.68025.00600000.00000004.mdmp") Found reference to API "55184766476,3128,3130,,RemoveDirectoryA,kernel32.dll,"252:03:01.484",RX=0,PX=0" (Indicator: "RemoveDirectory"; Source: "00000000-00002516.00000001.67151.001C2000.00000004.mdmp") Found reference to API "DeleteFileA" (Indicator: "DeleteFile"; Source: "00000000-00002516.00000001.67151.008FA000.00000002.mdmp") Found reference to API "RemoveDirectoryA" (Indicator: "RemoveDirectory"; Source: "00000000-00002516.00000001.67151.008FA000.00000002.mdmp")65:Ta06,Found reference to API "CheckTokenMembership" (Indicator: "CheckTokenMembership"; File: "afa6fbd86c448bceaf510ae6f8b831be.exe") Found reference to API "SeShutdownPrivilege" (Indicator: "SeShutdownPrivilege"; File: "afa6fbd86c448bceaf510ae6f8b831be.exe") Found reference to API "LookupPrivilegeValueA" (Indicator: "LookupPrivilegeValue"; File: "afa6fbd86c448bceaf510ae6f8b831be.exe") Found reference to API "AdjustTokenPrivileges" (Indicator: "AdjustTokenPrivileges"; File: "afa6fbd86c448bceaf510ae6f8b831be.exe") file/memory contains long string with (Indicator: "AdjustTokenPrivileges"; File: "afa6fbd86c448bceaf510ae6f8b831be.exe") Found reference to API "SeBackupPrivilege" (Indicator: "SeBackupPrivilege"; Source: "00000000-00001512.00000000.67840.00E5C000.00000002.mdmp") Found reference to API "SeShutdownPrivilege" (Indicator: "SeShutdownPrivilege"; Source: "00000000-00001512.00000000.67840.00E5C000.00000002.mdmp") Found reference to API "SeDebugPrivilege" (Indicator: "SeDebugPrivilege"; Source: "00000000-00001512.00000000.67840.00E5C000.00000002.mdmp") Found reference to API "AdjustTokenPrivileges" (Indicator: "AdjustTokenPrivileges"; Source: "00000000-00001512.00000000.67840.00E5C000.00000002.mdmp") Found reference to API "LookupPrivilegeValueW" (Indicator: "LookupPrivilegeValue"; Source: "00000000-00001512.00000000.67840.00E5C000.00000002.mdmp") Found reference to API "CheckTokenMembership" (Indicator: "CheckTokenMembership"; Source: "00000000-00001512.00000000.67840.00E5C000.00000002.mdmp") Found reference to API "CheckTokenMembership" (Indicator: "CheckTokenMembership"; Source: "00000000-00001616.00000002.68025.00271000.00000020.mdmp") Found reference to API "SeShutdownPrivilege" (Indicator: "SeShutdownPrivilege"; Source: "00000000-00001616.00000002.68025.00271000.00000020.mdmp") Found reference to API "CheckTokenMembership" (Indicator: "CheckTokenMembership"; Source: "00000000-00002516.00000000.65984.008F1000.00000020.mdmp") Found reference to API "SeShutdownPrivilege" (Indicator: "SeShutdownPrivilege"; Source: "00000000-00002516.00000000.65984.008F1000.00000020.mdmp") file/memory contains long string with (Indicator: "AdjustTokenPrivileges"; Source: "00000000-00002516.00000001.67151.008FA000.00000002.mdmp") Found reference to API "LookupPrivilegeValueA" (Indicator: "LookupPrivilegeValue"; Source: "00000000-00002516.00000001.67151.008FA000.00000002.mdmp") Found reference to API "AdjustTokenPrivileges" (Indicator: "AdjustTokenPrivileges"; Source: "00000000-00002516.00000001.67151.008FA000.00000002.mdmp")66:T111e,Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; File: "afa6fbd86c448bceaf510ae6f8b831be.exe") Found reference to API "FreeSid" (Indicator: "FreeSid"; File: "afa6fbd86c448bceaf510ae6f8b831be.exe") Found reference to API "AllocateAndInitializeSid" (Indicator: "AllocateAndInitializeSid"; File: "afa6fbd86c448bceaf510ae6f8b831be.exe") Found reference to API "AllocateAndInitializeSid" (Indicator: "InitializeSid"; File: "afa6fbd86c448bceaf510ae6f8b831be.exe") Found reference to API "EqualSid" (Indicator: "EqualSid"; File: "afa6fbd86c448bceaf510ae6f8b831be.exe") Found reference to API "gPCMachineExtensionNames=[{35378EAC-683F-11D2-A89A-00C04FBBCFA2}{8FC0B734-A0E1-11D1-A7D3-0000F87571E3}]Version=2AccessCheck=test" (Indicator: "AccessCheck"; File: "gpt.ini") Found reference to API "InitializeSecurityDescriptor" (Indicator: "InitializeSecurityDescriptor"; Source: "00000000-00001512.00000000.67840.00E5C000.00000002.mdmp") Found reference to API "InitializeAcl" (Indicator: "InitializeAcl"; Source: "00000000-00001512.00000000.67840.00E5C000.00000002.mdmp") Found reference to API "DuplicateTokenEx" (Indicator: "DuplicateToken"; Source: "00000000-00001512.00000000.67840.00E5C000.00000002.mdmp") Found reference to API "DuplicateTokenEx" (Indicator: "DuplicateTokenEx"; Source: "00000000-00001512.00000000.67840.00E5C000.00000002.mdmp") Found reference to API "GetLengthSid" (Indicator: "GetLengthSid"; Source: "00000000-00001512.00000000.67840.00E5C000.00000002.mdmp") Found reference to API "CopySid" (Indicator: "CopySid"; Source: "00000000-00001512.00000000.67840.00E5C000.00000002.mdmp") Found reference to API "AllocateAndInitializeSid" (Indicator: "AllocateAndInitializeSid"; Source: "00000000-00001512.00000000.67840.00E5C000.00000002.mdmp") Found reference to API "AllocateAndInitializeSid" (Indicator: "InitializeSid"; Source: "00000000-00001512.00000000.67840.00E5C000.00000002.mdmp") Found reference to API "FreeSid" (Indicator: "FreeSid"; Source: "00000000-00001512.00000000.67840.00E5C000.00000002.mdmp") Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; Source: "00000000-00001512.00000000.67840.00E5C000.00000002.mdmp") Found reference to API "GetSecurityDescriptorDacl" (Indicator: "GetSecurityDescriptorDacl"; Source: "00000000-00001512.00000000.67840.00E5C000.00000002.mdmp, 00000000-00001512.00000000.67840.6B260000.00000002.mdmp") Found reference to API "GetAclInformation" (Indicator: "GetAclInformation"; Source: "00000000-00001512.00000000.67840.00E5C000.00000002.mdmp") Found reference to API "GetAce" (Indicator: "GetAce"; Source: "00000000-00001512.00000000.67840.00E5C000.00000002.mdmp, 00000000-00001512.00000000.67840.6B260000.00000002.mdmp") Found reference to API "AddAce" (Indicator: "AddAce"; Source: "00000000-00001512.00000000.67840.00E5C000.00000002.mdmp") Found reference to API "SetSecurityDescriptorDacl" (Indicator: "SetSecurityDescriptorDacl"; Source: "00000000-00001512.00000000.67840.00E5C000.00000002.mdmp") Found reference to API "GetSidSubAuthorityCount" (Indicator: "GetSidSubAuthority"; Source: "00000000-00001512.00000000.67840.6B260000.00000002.mdmp") Found reference to API "GetSidSubAuthorityCount" (Indicator: "GetSidSubAuthorityCount"; Source: "00000000-00001512.00000000.67840.6B260000.00000002.mdmp") Found reference to API "GetSidIdentifierAuthority" (Indicator: "GetSidIdentifierAuthority"; Source: "00000000-00001512.00000000.67840.6B260000.00000002.mdmp") Found reference to API "GetSidSubAuthority" (Indicator: "GetSidSubAuthority"; Source: "00000000-00001512.00000000.67840.6B260000.00000002.mdmp") Found reference to API "GetKernelObjectSecurity" (Indicator: "GetKernelObjectSecurity"; Source: "00000000-00001512.00000000.67840.6B260000.00000002.mdmp") Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; Source: "00000000-00002516.00000001.67151.008FA000.00000002.mdmp") Found reference to API "FreeSid" (Indicator: "FreeSid"; Source: "00000000-00002516.00000001.67151.008FA000.00000002.mdmp") Found reference to API "AllocateAndInitializeSid" (Indicator: "AllocateAndInitializeSid"; Source: "00000000-00002516.00000001.67151.008FA000.00000002.mdmp") Found reference to API "AllocateAndInitializeSid" (Indicator: "InitializeSid"; Source: "00000000-00002516.00000001.67151.008FA000.00000002.mdmp")67:T44f,Found reference to API "ExitProcess" (Indicator: "ExitProcess"; File: "afa6fbd86c448bceaf510ae6f8b831be.exe") Found reference to API "TerminateProcess" (Indicator: "TerminateProcess"; File: "afa6fbd86c448bceaf510ae6f8b831be.exe") Found reference to API "CorExitProcess" (Indicator: "ExitProcess"; File: "00000000-00003736.00000000.66071.00400000.00000040.mdmp") Found reference to API "CorExitProcess" (Indicator: "ExitProcess"; Source: "00000000-00001512.00000000.67840.00E5C000.00000002.mdmp") Found reference to API "TerminateProcess" (Indicator: "TerminateProcess"; Source: "00000000-00001512.00000000.67840.00E5C000.00000002.mdmp, 00000000-00001512.00000000.67840.6B260000.00000002.mdmp") Found reference to API "ExitProcess" (Indicator: "ExitProcess"; Source: "00000000-00001512.00000000.67840.00E5C000.00000002.mdmp") Found reference to API "ExitProcess" (Indicator: "ExitProcess"; Source: "00000000-00002516.00000001.67151.008FA000.00000002.mdmp") Found reference to API "TerminateProcess" (Indicator: "TerminateProcess"; Source: "00000000-00002516.00000001.67151.008FA000.00000002.mdmp")68:T1500,Observed import api "AllocateAndInitializeSid" which can "Allocates and initializes a security identifier (SID) with up to eight subauthorities" [Source: afa6fbd86c448bceaf510ae6f8b831be.exe] Observed import api "EqualSid" which can "Tests two security identifier (SID) values for equality" [Source: afa6fbd86c448bceaf510ae6f8b831be.exe] Observed import api "FreeSid" which can "Frees a security identifier (SID) previously allocated by using the AllocateAndInitializeSid function" [Source: afa6fbd86c448bceaf510ae6f8b831be.exe] Observed import api "GetTokenInformation" which can "Retrieves a specified type of information about an access token" [Source: afa6fbd86c448bceaf510ae6f8b831be.exe] Observed import api "InitializeSid" which can "Initializes a security identifier (SID)" [Source: afa6fbd86c448bceaf510ae6f8b831be.exe] Observed import api "AllocateAndInitializeSid" which can "Allocates and initializes a security identifier (SID) with up to eight subauthorities" [Source: tB0lu63.exe] Observed import api "EqualSid" which can "Tests two security identifier (SID) values for equality" [Source: tB0lu63.exe] Observed import api "FreeSid" which can "Frees a security identifier (SID) previously allocated by using the AllocateAndInitializeSid function" [Source: tB0lu63.exe] Observed import api "GetTokenInformation" which can "Retrieves a specified type of information about an access token" [Source: tB0lu63.exe] Observed import api "InitializeSid" which can "Initializes a security identifier (SID)" [Source: tB0lu63.exe] Observed import api "AllocateAndInitializeSid" which can "Allocates and initializes a security identifier (SID) with up to eight subauthorities" [Source: qP8xB26.exe] Observed import api "EqualSid" which can "Tests two security identifier (SID) values for equality" [Source: qP8xB26.exe] Observed import api "FreeSid" which can "Frees a security identifier (SID) previously allocated by using the AllocateAndInitializeSid function" [Source: qP8xB26.exe] Observed import api "GetTokenInformation" which can "Retrieves a specified type of information about an access token" [Source: qP8xB26.exe] Observed import api "InitializeSid" which can "Initializes a security identifier (SID)" [Source: qP8xB26.exe] Observed import api "GetSidSubAuthority" which can "Returns a pointer to a specified subauthority in a security identifier (SID)" [Source: 5eh2lq1.exe] Observed import api "AllocateAndInitializeSid" which can "Allocates and initializes a security identifier (SID) with up to eight subauthorities" [Source: kX8EH32.exe] Observed import api "EqualSid" which can "Tests two security identifier (SID) values for equality" [Source: kX8EH32.exe] Observed import api "FreeSid" which can "Frees a security identifier (SID) previously allocated by using the AllocateAndInitializeSid function" [Source: kX8EH32.exe] Observed import api "GetTokenInformation" which can "Retrieves a specified type of information about an access token" [Source: kX8EH32.exe] Observed import api "InitializeSid" which can "Initializes a security identifier (SID)" [Source: kX8EH32.exe] Observed import api "AddAce" which can "Adds one or more access control entries (ACEs) to a specified access control list (ACL)" [Source: 6FR1MW1.exe] Observed import api "AllocateAndInitializeSid" which can "Allocates and initializes a security identifier (SID) with up to eight subauthorities" [Source: 6FR1MW1.exe] Observed import api "CheckTokenMembership" which can "Determines whether a specified security identifier (SID) is enabled in an access token" [Source: 6FR1MW1.exe] Observed import api "CopySid" which can "Copies a security identifier (SID) to a buffer" [Source: 6FR1MW1.exe] Observed import api "DuplicateToken" which can "Creates a new access token that duplicates one already in existence" [Source: 6FR1MW1.exe] Observed import api "DuplicateTokenEx" which can "Creates a new access token that duplicates an existing token" [Source: 6FR1MW1.exe] Observed import api "FreeSid" which can "Frees a security identifier (SID) previously allocated by using the AllocateAndInitializeSid function" [Source: 6FR1MW1.exe] Observed import api "GetAce" which can "Obtains a pointer to an access control entry (ACE) in an access control list (ACL)" [Source: 6FR1MW1.exe] Observed import api "GetAclInformation" which can "Retrieves information about an access control list (ACL)" [Source: 6FR1MW1.exe] Observed import api "GetLengthSid" which can "Returns the length in bytes of a valid security identifier (SID)" [Source: 6FR1MW1.exe] Observed import api "GetSecurityDescriptorDacl" which can "Retrieves a pointer to the discretionary access control list (DACL) in a specified security descriptor" [Source: 6FR1MW1.exe] Observed import api "GetTokenInformation" which can "Retrieves a specified type of information about an access token" [Source: 6FR1MW1.exe] Observed import api "InitializeAcl" which can "Initializes a new ACL structure" [Source: 6FR1MW1.exe] Observed import api "InitializeSecurityDescriptor" which can "Initializes a new security descriptor" [Source: 6FR1MW1.exe] Observed import api "InitializeSid" which can "Initializes a security identifier (SID)" [Source: 6FR1MW1.exe] Observed import api "SetSecurityDescriptorDacl" which can "Sets information in a discretionary access control list (DACL)" [Source: 6FR1MW1.exe]69:T8f6,"1yz61bk1.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\CRYPT32"; Key: "DEBUGHEAPFLAGS"; Value: "") "1yz61bk1.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\LDAP"; Key: "LDAPCLIENTINTEGRITY"; Value: "") "1yz61bk1.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\LDAP"; Key: "USEOLDHOSTRESOLUTIONORDER"; Value: "") "1yz61bk1.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\LDAP"; Key: "USEHOSTNAMEASALIAS"; Value: "") "1yz61bk1.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\LDAP"; Key: "IPV4LOOPBACKALTERNATIVE"; Value: "") "1yz61bk1.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\LANMANWORKSTATION\PARAMETERS"; Key: "RPCCACHETIMEOUT"; Value: "") "1yz61bk1.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\LANMANSERVER\DEFAULTSECURITY"; Key: "SRVSVCDEFAULTSHAREINFO"; Value: "") "1yz61bk1.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK\PARAMETERS"; Key: "TRANSPORTS"; Value: "") "1yz61bk1.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP6\PARAMETERS\WINSOCK"; Key: "MAPPING"; Value: "") "1yz61bk1.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK\SETUP MIGRATION\PROVIDERS\TCPIP6"; Key: "WINSOCK 2.0 PROVIDER ID"; Value: "") "1yz61bk1.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP6\PARAMETERS\WINSOCK"; Key: "MINSOCKADDRLENGTH"; Value: "") "1yz61bk1.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP6\PARAMETERS\WINSOCK"; Key: "MAXSOCKADDRLENGTH"; Value: "") "1yz61bk1.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP6\PARAMETERS\WINSOCK"; Key: "USEDELAYEDACCEPTANCE"; Value: "") "1yz61bk1.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP6\PARAMETERS\WINSOCK"; Key: "HELPERDLLNAME"; Value: "") "1yz61bk1.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS"; Key: "WINSOCK_REGISTRY_VERSION"; Value: "") "1yz61bk1.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS"; Key: "NAMESPACE_CALLOUT"; Value: "")6a:T557,"tB0lu63.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP000.TMP\tB0lu63.exe]- [targetUID: 00000000-00001616] "qP8xB26.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP001.TMP\qP8xB26.exe]- [targetUID: 00000000-00002516] "5eh2lq1.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP001.TMP\5eh2lq1.exe]- [targetUID: 00000000-00003116] "4hV149il.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP002.TMP\4hV149il.exe]- [targetUID: 00000000-00002516] "kX8EH32.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP002.TMP\kX8EH32.exe]- [targetUID: 00000000-00002644] "FANBooster131.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\FANBooster131\FANBooster131.exe]- [targetUID: 00000000-00003736] "6FR1MW1.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP000.TMP\6FR1MW1.exe]- [targetUID: 00000000-00001512] "3mk61Eb.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP003.TMP\3mk61Eb.exe]- [targetUID: 00000000-00002644] "1yz61bk1.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP003.TMP\1yz61bk1.exe]- [targetUID: 00000000-00002644]6b:T14de,Dropped file: "FANBooster131.lnk" - Location: [%APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\FANBooster131.lnk]- [targetUID: 00000000-00003736] Dropped file: "222WX212.htm" - Location: [%LOCALAPPDATA%\Microsoft\Windows\Temporary Internet Files\Content.IE5\37NU00GP\222WX212.htm]- [targetUID: 00000000-00003276] Dropped file: "en-US.4" - Location: [%LOCALAPPDATA%\Microsoft\Internet Explorer\DomainSuggestions\en-US.4]- [targetUID: 00000000-00002704] Dropped file: "imagestore.dat" - Location: [%LOCALAPPDATA%\Microsoft\Internet Explorer\imagestore\3mt7jhv\imagestore.dat]- [targetUID: 00000000-00003096] Dropped file: "70DAE932E3BCB3C00656A27B544BA9CA" - Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\70DAE932E3BCB3C00656A27B544BA9CA]- [targetUID: 00000000-00003096] Dropped file: "739F2FF4259CDC6CBE7B90F1A95601EF" - Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\739F2FF4259CDC6CBE7B90F1A95601EF]- [targetUID: 00000000-00003592] Dropped file: "57C8EDB95DF3F0AD4EE2DC2B8CFD4157" - Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\57C8EDB95DF3F0AD4EE2DC2B8CFD4157]- [targetUID: 00000000-00003276] Dropped file: "24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA" - Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA]- [targetUID: 00000000-00003096] Dropped file: "0270780F846F08BEFE0DD8112D932FEF" - Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\0270780F846F08BEFE0DD8112D932FEF]- [targetUID: 00000000-00003592] Dropped file: "CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA" - Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA]- [targetUID: 00000000-00003096] Dropped file: "4H14ONGE.txt" - Location: [%APPDATA%\Microsoft\Windows\Cookies\4H14ONGE.txt]- [targetUID: 00000000-00003096] Dropped file: "E87CE99F124623F95572A696C80EFCAF_9E9C5BD522DEAFF0AF9BF0B0877DDF33" - Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\E87CE99F124623F95572A696C80EFCAF_9E9C5BD522DEAFF0AF9BF0B0877DDF33]- [targetUID: 00000000-00003096] Dropped file: "E87CE99F124623F95572A696C80EFCAF_9FBD3BA6168F3C4317F2AAB1E548FE96" - Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\E87CE99F124623F95572A696C80EFCAF_9FBD3BA6168F3C4317F2AAB1E548FE96]- [targetUID: 00000000-00003096] Dropped file: "80237EE4964FC9C409AAF55BF996A292_D46D6FA25B74360E1349F9015B5CCE53" - Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\80237EE4964FC9C409AAF55BF996A292_D46D6FA25B74360E1349F9015B5CCE53]- [targetUID: 00000000-00003276] Dropped file: "E2C6CBAF0AF08CF203BA74BF0D0AB6D5_0FB9553B978E7F00C6B2309507DEB64A" - Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_0FB9553B978E7F00C6B2309507DEB64A]- [targetUID: 00000000-00003276] Dropped file: "80237EE4964FC9C409AAF55BF996A292_C5130A0BDC8C859A2757D77746C10868" - Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\80237EE4964FC9C409AAF55BF996A292_C5130A0BDC8C859A2757D77746C10868]- [targetUID: 00000000-00003276] Dropped file: "F07644E38ED7C9F37D11EEC6D4335E02_EC50BC49A28D68A36F5274F1BD1417C1" - Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\F07644E38ED7C9F37D11EEC6D4335E02_EC50BC49A28D68A36F5274F1BD1417C1]- [targetUID: 00000000-00003096] Dropped file: "F2DDCD2B5F37625B82E81F4976CEE400_BFB422D89E28A298A60024A8D8A2EA06" - Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\F2DDCD2B5F37625B82E81F4976CEE400_BFB422D89E28A298A60024A8D8A2EA06]- [targetUID: 00000000-00003096] Dropped file: "7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776" - Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776]- [targetUID: 00000000-00003096] Dropped file: "EDC238BFF48A31D55A97E1E93892934B_C20E0DA2D0F89FE526E1490F4A2EE5AB" - Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\EDC238BFF48A31D55A97E1E93892934B_C20E0DA2D0F89FE526E1490F4A2EE5AB]- [targetUID: 00000000-00003592] Dropped file: "35DDEDF268117918D1D277A171D8DF7B_B2D5A2AFC0A7FA2364E778B425CC1FD0" - Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\35DDEDF268117918D1D277A171D8DF7B_B2D5A2AFC0A7FA2364E778B425CC1FD0]- [targetUID: 00000000-00003592] Dropped file: "HNPXNTQW.txt" - Location: [%APPDATA%\Microsoft\Windows\Cookies\HNPXNTQW.txt]- [targetUID: 00000000-00003276] Dropped file: "E2C6CBAF0AF08CF203BA74BF0D0AB6D5_0FB9553B978E7F00C6B2309507DEB64A" - Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_0FB9553B978E7F00C6B2309507DEB64A]- [targetUID: 00000000-00003276] Dropped file: "80237EE4964FC9C409AAF55BF996A292_D46D6FA25B74360E1349F9015B5CCE53" - Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\MetaData\80237EE4964FC9C409AAF55BF996A292_D46D6FA25B74360E1349F9015B5CCE53]- [targetUID: 00000000-00003276] Dropped file: "80237EE4964FC9C409AAF55BF996A292_C5130A0BDC8C859A2757D77746C10868" - Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\MetaData\80237EE4964FC9C409AAF55BF996A292_C5130A0BDC8C859A2757D77746C10868]- [targetUID: 00000000-00003276]6c:Tc007,"initAft()