26:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js","/_next/static/chunks/1w1axrg6kzses.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/1kn_tf3p-ubex.js","/_next/static/chunks/1wq095nwqbaw1.js"],"SampleDetailWrapper"] 89:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js"],"IconMark"] 25:T4d7,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Win/malicious_confidence_90% Sample c92353fc9390… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample c92353fc9390…. Malware family: Win/malicious_confidence_90%. Threat score 100/100. 5/27 AV engines flagged this file. 23 malicious and 28 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/c92353fc93904cff5198ccddebdd3381d94a9a4f05e8256cd96fd4c3b00bddcf","keywords":["Malicious","Win/malicious_confidence_90%","malware analysis","sandbox report","threat intelligence","c92353fc93904cff5198ccddebdd3381d94a9a4f05e8256cd96fd4c3b00bddcf"],"about":{"@type":"SoftwareApplication","name":"9ce01fdabd737268e2c5fe3da55fc969.exe","applicationCategory":["peexe","executable"],"identifier":"c92353fc93904cff5198ccddebdd3381d94a9a4f05e8256cd96fd4c3b00bddcf","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Win/malicious_confidence_90%","antivirusDetections":{"malicious":5,"total":27},"behavioralIndicators":{"malicious":23,"suspicious":28},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}27:T5e2,"9ce01fdabd737268e2c5fe3da55fc969.exe" called "FindResourceA" with parameter "10293880" - (UID: 00000000-00007120) "9ce01fdabd737268e2c5fe3da55fc969.exe" called "FindResourceA" with parameter "10293888" - (UID: 00000000-00007120) "9ce01fdabd737268e2c5fe3da55fc969.exe" called "FindResourceA" with parameter "10293916" - (UID: 00000000-00007120) "9ce01fdabd737268e2c5fe3da55fc969.exe" called "FindResourceA" with parameter "10294128" - (UID: 00000000-00007120) "9ce01fdabd737268e2c5fe3da55fc969.exe" called "FindResourceA" with parameter "10293944" - (UID: 00000000-00007120) "9ce01fdabd737268e2c5fe3da55fc969.exe" called "FindResourceA" with parameter "10294100" - (UID: 00000000-00007120) "9ce01fdabd737268e2c5fe3da55fc969.exe" called "FindResourceA" with parameter "10294112" - (UID: 00000000-00007120) "9ce01fdabd737268e2c5fe3da55fc969.exe" called "FindResourceA" with parameter "16382668" - (UID: 00000000-00007120) "9ce01fdabd737268e2c5fe3da55fc969.exe" called "FindResourceA" with parameter "10293996" - (UID: 00000000-00007120) "9ce01fdabd737268e2c5fe3da55fc969.exe" called "FindResourceA" with parameter "10294092" - (UID: 00000000-00007120) "9ce01fdabd737268e2c5fe3da55fc969.exe" called "FindResourceA" with parameter "16382664" - (UID: 00000000-00007120) "9ce01fdabd737268e2c5fe3da55fc969.exe" called "FindResourceA" with parameter "10293960" - (UID: 00000000-00007120) "9ce01fdabd737268e2c5fe3da55fc969.exe" called "FindResourceA" with parameter "10293968" - (UID: 00000000-00007120)28:Tb88,"9ce01fdabd737268e2c5fe3da55fc969.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '10340480'}" (UID: 00000000-00007120) "9ce01fdabd737268e2c5fe3da55fc969.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '10340336'}" (UID: 00000000-00007120) "9ce01fdabd737268e2c5fe3da55fc969.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '10340496'}" (UID: 00000000-00007120) "9ce01fdabd737268e2c5fe3da55fc969.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '10340384'}" (UID: 00000000-00007120) "9ce01fdabd737268e2c5fe3da55fc969.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '10340352'}" (UID: 00000000-00007120) "9ce01fdabd737268e2c5fe3da55fc969.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '10340400'}" (UID: 00000000-00007120) "9ce01fdabd737268e2c5fe3da55fc969.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '10340448'}" (UID: 00000000-00007120) "9ce01fdabd737268e2c5fe3da55fc969.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '10340320'}" (UID: 00000000-00007120) "9ce01fdabd737268e2c5fe3da55fc969.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '10340432'}" (UID: 00000000-00007120) "9ce01fdabd737268e2c5fe3da55fc969.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '10340464'}" (UID: 00000000-00007120) "Hl0Uw04.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '3983488'}" (UID: 00000000-00006816) "Hl0Uw04.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '3983344'}" (UID: 00000000-00006816) "Hl0Uw04.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '3983504'}" (UID: 00000000-00006816) "Hl0Uw04.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '3983392'}" (UID: 00000000-00006816) "Hl0Uw04.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '3983360'}" (UID: 00000000-00006816) "Hl0Uw04.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '3983408'}" (UID: 00000000-00006816) "Hl0Uw04.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '3983456'}" (UID: 00000000-00006816) "Hl0Uw04.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '3983328'}" (UID: 00000000-00006816) "Hl0Uw04.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '3983440'}" (UID: 00000000-00006816) "Hl0Uw04.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '3983472'}" (UID: 00000000-00006816) "JK4zG29.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '17549440'}" (UID: 00000000-00004708) "JK4zG29.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '17549296'}" (UID: 00000000-00004708) "JK4zG29.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '17549456'}" (UID: 00000000-00004708)29:Tbde,"9ce01fdabd737268e2c5fe3da55fc969.exe" called "RemoveDirectoryA" with parameter %TEMP%\IXP000.TMP (UID: 00000000-00007120) "Hl0Uw04.exe" called "RemoveDirectoryA" with parameter %TEMP%\IXP000.TMP (UID: 00000000-00006816) "Hl0Uw04.exe" called "RemoveDirectoryA" with parameter %TEMP%\IXP001.TMP (UID: 00000000-00006816) "JK4zG29.exe" called "RemoveDirectoryA" with parameter %TEMP%\IXP000.TMP (UID: 00000000-00004708) "JK4zG29.exe" called "RemoveDirectoryA" with parameter %TEMP%\IXP001.TMP (UID: 00000000-00004708) "JK4zG29.exe" called "RemoveDirectoryA" with parameter %TEMP%\IXP002.TMP (UID: 00000000-00004708) "wH5KL25.exe" called "RemoveDirectoryA" with parameter %TEMP%\IXP000.TMP (UID: 00000000-00006492) "wH5KL25.exe" called "RemoveDirectoryA" with parameter %TEMP%\IXP001.TMP (UID: 00000000-00006492) "wH5KL25.exe" called "RemoveDirectoryA" with parameter %TEMP%\IXP002.TMP (UID: 00000000-00006492) "wH5KL25.exe" called "RemoveDirectoryA" with parameter %TEMP%\IXP003.TMP (UID: 00000000-00006492) "wH5KL25.exe" called "RemoveDirectoryA" with parameter %TEMP%\IXP003.TMP\ (UID: 00000000-00006492) "1KF13LI4.exe" called "RemoveDirectoryA" with parameter %TEMP%\grandUIAG8qeDmG3xj4Kw\Files\My Music (UID: 00000000-00007820) "1KF13LI4.exe" called "RemoveDirectoryA" with parameter %TEMP%\grandUIAG8qeDmG3xj4Kw\Files\My Pictures (UID: 00000000-00007820) "1KF13LI4.exe" called "RemoveDirectoryA" with parameter %TEMP%\grandUIAG8qeDmG3xj4Kw\Files\My Videos (UID: 00000000-00007820) "1KF13LI4.exe" called "RemoveDirectoryA" with parameter %TEMP%\grandUIAG8qeDmG3xj4Kw\Files\OneNote Notebooks\My Notebook (UID: 00000000-00007820) "1KF13LI4.exe" called "RemoveDirectoryA" with parameter %TEMP%\grandUIAG8qeDmG3xj4Kw\Files\OneNote Notebooks\OneNote 2010 Guide (UID: 00000000-00007820) "1KF13LI4.exe" called "RemoveDirectoryA" with parameter %TEMP%\grandUIAG8qeDmG3xj4Kw\Files\OneNote Notebooks (UID: 00000000-00007820) "1KF13LI4.exe" called "RemoveDirectoryA" with parameter %TEMP%\grandUIAG8qeDmG3xj4Kw\Files\Outlook Files (UID: 00000000-00007820) "1KF13LI4.exe" called "RemoveDirectoryA" with parameter %TEMP%\grandUIAG8qeDmG3xj4Kw\Files (UID: 00000000-00007820) "1KF13LI4.exe" called "RemoveDirectoryA" with parameter %TEMP%\grandUIAG8qeDmG3xj4Kw\Files\.mitmproxy (UID: 00000000-00007820) "1KF13LI4.exe" called "RemoveDirectoryA" with parameter %TEMP%\grandUIAG8qeDmG3xj4Kw\Files\3D Objects (UID: 00000000-00007820) "1KF13LI4.exe" called "RemoveDirectoryA" with parameter %TEMP%\grandUIAG8qeDmG3xj4Kw\Files\AppData\Local\Adobe\Acrobat\11.0\Cache (UID: 00000000-00007820) "1KF13LI4.exe" called "RemoveDirectoryA" with parameter %TEMP%\grandUIAG8qeDmG3xj4Kw\Files\AppData\Local\Adobe\Acrobat\11.0 (UID: 00000000-00007820) "1KF13LI4.exe" called "RemoveDirectoryA" with parameter %TEMP%\grandUIAG8qeDmG3xj4Kw\Files\AppData\Local\Adobe\Acrobat (UID: 00000000-00007820) "1KF13LI4.exe" called "RemoveDirectoryA" with parameter %TEMP%\grandUIAG8qeDmG3xj4Kw\Files\AppData\Local\Adobe\Color\Profiles (UID: 00000000-00007820)2a:T434,Found reference to API "OpenProcessToken" (Indicator: "OpenProcessToken"; File: "9ce01fdabd737268e2c5fe3da55fc969.exe") file/memory contains long string with (Indicator: "OpenProcessToken"; File: "9ce01fdabd737268e2c5fe3da55fc969.exe") file/memory contains long string with (Indicator: "OpenProcessToken"; Source: "00000000-00004708.00000000.67069.010BA000.00000002.mdmp") Found reference to API "OpenProcessToken" (Indicator: "OpenProcessToken"; Source: "00000000-00004708.00000000.67069.010BA000.00000002.mdmp") file/memory contains long string with (Indicator: "OpenProcessToken"; Source: "00000000-00006492.00000000.67113.0098A000.00000002.mdmp") Found reference to API "OpenProcessToken" (Indicator: "OpenProcessToken"; Source: "00000000-00006492.00000000.67113.0098A000.00000002.mdmp") file/memory contains long string with (Indicator: "OpenProcessToken"; Source: "00000000-00006816.00000002.70867.003CA000.00000002.mdmp") Found reference to API "OpenProcessToken" (Indicator: "OpenProcessToken"; Source: "00000000-00006816.00000002.70867.003CA000.00000002.mdmp")2b:T4f4,Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; File: "9ce01fdabd737268e2c5fe3da55fc969.exe") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; File: "9ce01fdabd737268e2c5fe3da55fc969.exe") Found reference to API "LoadLibraryExA" (Indicator: "LoadLibrary"; File: "9ce01fdabd737268e2c5fe3da55fc969.exe") Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; Source: "00000000-00004708.00000000.67069.010BA000.00000002.mdmp") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; Source: "00000000-00004708.00000000.67069.010BA000.00000002.mdmp") Found reference to API "LoadLibraryExA" (Indicator: "LoadLibrary"; Source: "00000000-00004708.00000000.67069.010BA000.00000002.mdmp") Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; Source: "00000000-00006492.00000000.67113.0098A000.00000002.mdmp") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; Source: "00000000-00006492.00000000.67113.0098A000.00000002.mdmp") Found reference to API "LoadLibraryExA" (Indicator: "LoadLibrary"; Source: "00000000-00006492.00000000.67113.0098A000.00000002.mdmp") Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; Source: "00000000-00006816.00000002.70867.003CA000.00000002.mdmp")2c:T1152,Found reference to API "RegSetValueExA" (Indicator: "RegSetValue"; File: "9ce01fdabd737268e2c5fe3da55fc969.exe") Found reference to API "" (Indicator: "RegSetValue"; Source: "00000000-00000632.00000001.70834.02810000.00000004.mdmp, 00000000-00000632.00000002.72753.02810000.00000004.mdmp") Found reference to API "" (Indicator: "RegSetValue"; Source: "00000000-00000632.00000001.70834.02810000.00000004.mdmp, 00000000-00000632.00000002.72753.02810000.00000004.mdmp") Found reference to API "" (Indicator: "RegSetValue"; Source: "00000000-00000632.00000001.70834.02810000.00000004.mdmp, 00000000-00000632.00000002.72753.02810000.00000004.mdmp") Found reference to API "" (Indicator: "RegSetValue"; Source: "00000000-00000632.00000001.70834.02810000.00000004.mdmp, 00000000-00000632.00000002.72753.02810000.00000004.mdmp") Found reference to API "" (Indicator: "RegSetValue"; Source: "00000000-00004708.00000000.67069.00CE0000.00000004.mdmp, 00000000-00004708.00000001.68991.00CE0000.00000004.mdmp, 00000000-00004708.00000002.70911.00CE0000.00000004.mdmp") Found reference to API "" (Indicator: "RegSetValue"; Source: "00000000-00004708.00000000.67069.00CE0000.00000004.mdmp, 00000000-00004708.00000001.68991.00CE0000.00000004.mdmp, 00000000-00004708.00000002.70911.00CE0000.00000004.mdmp") Found reference to API "" (Indicator: "RegSetValue"; Source: "00000000-00004708.00000000.67069.00CE0000.00000004.mdmp, 00000000-00004708.00000001.68991.00CE0000.00000004.mdmp, 00000000-00004708.00000002.70911.00CE0000.00000004.mdmp") Found reference to API "" (Indicator: "RegSetValue"; Source: "00000000-00004708.00000000.67069.00CE0000.00000004.mdmp, 00000000-00004708.00000001.68991.00CE0000.00000004.mdmp, 00000000-00004708.00000002.70911.00CE0000.00000004.mdmp") Found reference to API "RegSetValueExA" (Indicator: "RegSetValue"; Source: "00000000-00004708.00000000.67069.010BA000.00000002.mdmp") Found reference to API "RegSetValueExA" (Indicator: "RegSetValue"; Source: "00000000-00006492.00000000.67113.0098A000.00000002.mdmp") Found reference to API "" (Indicator: "RegSetValue"; Source: "00000000-00006492.00000000.67113.03400000.00000004.mdmp") Found reference to API "" (Indicator: "RegSetValue"; Source: "00000000-00006492.00000000.67113.03400000.00000004.mdmp") Found reference to API "" (Indicator: "RegSetValue"; Source: "00000000-00006492.00000000.67113.03400000.00000004.mdmp") Found reference to API "" (Indicator: "RegSetValue"; Source: "00000000-00006492.00000000.67113.03400000.00000004.mdmp") Found reference to API "FUNCTION="RegSetValueExW"/>" (Indicator: "RegSetValue"; Source: "00000000-00006816.00000000.67028.032E0000.00000004.mdmp, 00000000-00006816.00000002.70867.032E0000.00000004.mdmp") Found reference to API "" (Indicator: "RegSetValue"; Source: "00000000-00006816.00000000.67028.032E0000.00000004.mdmp, 00000000-00006816.00000002.70867.032E0000.00000004.mdmp") Found reference to API "" (Indicator: "RegSetValue"; Source: "00000000-00006816.00000000.67028.032E0000.00000004.mdmp, 00000000-00006816.00000002.70867.032E0000.00000004.mdmp") Found reference to API "" (Indicator: "RegSetValue"; Source: "00000000-00006816.00000000.67028.032E0000.00000004.mdmp, 00000000-00006816.00000002.70867.032E0000.00000004.mdmp") Found reference to API "" (Indicator: "RegSetValue"; Source: "00000000-00006816.00000000.67028.032E0000.00000004.mdmp, 00000000-00006816.00000002.70867.032E0000.00000004.mdmp") Found reference to API "RegSetValueExA" (Indicator: "RegSetValue"; Source: "00000000-00006816.00000002.70867.003CA000.00000002.mdmp")2d:T4c3,The analysis contains indicators for cyrpto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Contains ability to perform AES/RC4 encryption (API string) Matched sigs: Contains ability to use Cryptographic classes Matched sigs: Contains ability to use Microsoft's Enhanced Cryptographic Provider Matched sigs: Contains CRYPTO related strings Matched sigs: Contains ability to perform decryption (API string) Matched sigs: Contains ability to import cryptographic keys (seen in ransomware) Matched sigs: Calls an API typically to import asymmetric cryptographic keys into a CSP Matched sigs: Calls an API typically used to decrypt a block of data Matched sigs: Tries to steal crypto wallet extension (file access) Matched sigs: Dropped file has high entropy (likely encrypted/compressed content) Matched sigs: Calls an API typically used to decrypt the data Matched sigs: Calls an API typically used to encrypt a block of data Matched sigs: Reads the cryptographic machine GUID Matched sigs: Calls an API typically to import cryptographic keys into a CSP Matched sigs: Imports Crypto related APIs Matched sigs: Sample file has high entropy (likely encrypted/compressed content)2e:T2a20,"9ce01fdabd737268e2c5fe3da55fc969.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00007120) "9ce01fdabd737268e2c5fe3da55fc969.exe" called "RtlGetVersion" with parameter 000000000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00007120) "Hl0Uw04.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00006816) "Hl0Uw04.exe" called "RtlGetVersion" with parameter 000000000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00006816) "JK4zG29.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00004708) "JK4zG29.exe" called "RtlGetVersion" with parameter 000000000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00004708) "wH5KL25.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00006492) "wH5KL25.exe" called "RtlGetVersion" with parameter 000000000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00006492) "1KF13LI4.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00007820) "1KF13LI4.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f0000020000000000ffff0000000040d23e0038cf1e77f4349702acd23e0001000000a8349702f4349702a8349702040000000400000000e01f7600100000acd23e0001000000a8349702cd971e779c971e776b36b266b50f1676a834970200001e77000000004c10e1750000000080ee1c760100000000000000f8e21f76000000000400000080a9b37348401e76f8e21f76b0d23e0080e80774d8e6970280e80774acd23e000000000080e80774e4aea4fdfeffffff0000000000000000000000000500000050249a0202000000020000000a00000040249a0250249a020000000025a9550530d53e00ddf3137624d33e000000000040249a020a000000f8f3137640249a02 (UID: 00000000-00007820) "1KF13LI4.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000003e00206ce77201000000dcca3e003f31e67271b1550530cc3e000000000030003200c8b1990201000000a4cb3e00321ee5720000d55d00000000003c13767a1fe5720000000000000000000000006400000001000000000000008000108000cc3e00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000050f51d77000000000000000003000000000000000000000000000000ffffffff000000000000000000000000901f9b02a41f9b02 (UID: 00000000-00007820) "1KF13LI4.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f000002000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000050f51d77000000000000000003000000000000000000990260039a022a0000008851990203002d006808700264000000e99c1f778100100030d23e0000d23e0000000000000000001733b2668fe6137678d23e00b1e613760000000000000002e0dd9b76dae613762040000000000000000000000100000081001000300300000000000000000000010000000000000018001a00200a9a020000000000000000200a9a020000000090588002a0907574000000001800000000000000 (UID: 00000000-00007820) "1KF13LI4.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff000000000000000000000000562b9b026c2b9b02 (UID: 00000000-00007820) "1KF13LI4.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff00000000000000000000000066379b027e379b02 (UID: 00000000-00007820) "1KF13LI4.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff00000000000000000000000066379b027a379b02 (UID: 00000000-00007820) "1KF13LI4.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000007e509b0296509b02 (UID: 00000000-00007820) "1KF13LI4.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff000000000000000000000000f62a9b020c2b9b02 (UID: 00000000-00007820)2f:T8e4,"9ce01fdabd737268e2c5fe3da55fc969.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f00000200000000f9f900cc7de67270aa48030000000080f9f9002447e67270aa4803d8f9f900d527e67270aa480301000000e32884ce00000000a7c5783800000000030000008cfaf9000a000000601b0000d0faf90008faf9005b0000000300000090f9f90098f9f900a0fcf9005059e672bbc195bcfeffffffe0faf90047f2e472a7c57838 (UID: 00000000-00007120) "Hl0Uw04.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f000002000000007de672c0ac30030000000010f727012447e672c0ac300368f72701d527e672c0ac300301000000dd5b59f200000000b4cdea2d00000000030000001cf827010a000000781a000060f8270198f727015b0000000300000020f7270128f7270134fa27015059e67235bc9681feffffff74f8270147f2e472b4cdea2d00000000 (UID: 00000000-00006816) "JK4zG29.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f000002000000007de672e8aed00000000000a0fa92002447e672e8aed000f8fa9200d527e672e8aed0000100000051bdcdee00000000feeaa5330000000003000000acfb92000a000000c4180000f0fb920028fb92005d00000003000000b0fa9200b8fa9200c4fd92005059e6722957b79cfeffffff04fc920047f2e472feeaa53300000000 (UID: 00000000-00004708) "wH5KL25.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f00000200000000f80901cc7de67288ae42030000000068f809012447e67288ae4203c0f80901d527e67288ae420301000000ade0387e00000000a834c834000000000300000074f909010a00000054170000b8f90901f0f809015b0000000300000078f8090180f8090188fb09015059e672ed08d90dfeffffffc8f9090147f2e472a834c834 (UID: 00000000-00006492) "1KF13LI4.exe" called "GetVersionExA" with parameter 940000000600000002000000f023000002000000006a2177c8df760559161e771802000000000000100200000000970200000000200200000000000000000000440000000200000000009702180200000000000059161e77ecdf7605ee131e7748e07605ee131e77000000000000000018020000180200000900000004e07605763e1f0000009702000000001802000010020000 (UID: 00000000-00007820) "AppLaunch.exe" called "GetVersionExA" with parameter 9400000006000000030000008025000002000000000000001600001677790000d0d6b300e8cfb10010000000605ab3000100000003000000010000000c00000000000000000000000000000001000000010000000000000000000000720061006d00650000000000000000000000000000000000010000002f000000000000000000000063006f006e006600690067005c006d00 (UID: 00000000-00000712)30:T6f8,"9ce01fdabd737268e2c5fe3da55fc969.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "9ce01fdabd737268e2c5fe3da55fc969.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "Hl0Uw04.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "Hl0Uw04.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "JK4zG29.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "JK4zG29.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "wH5KL25.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "wH5KL25.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "1KF13LI4.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "1KF13LI4.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "schtasks.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "2OY8588.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "2OY8588.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "AppLaunch.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "3KZ60ye.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED")31:T719,Found reference to API "GetVersion" (Indicator: "GetVersion"; File: "9ce01fdabd737268e2c5fe3da55fc969.exe") Found reference to API "GetVersionExA" (Indicator: "GetVersionExA"; File: "9ce01fdabd737268e2c5fe3da55fc969.exe") Found reference to API "GetVersionExA" (Indicator: "GetVersion"; File: "9ce01fdabd737268e2c5fe3da55fc969.exe") Found reference to API "1522948085,6340,3024,,RtlGetVersion,NTDLL.dll,"00:17:23.656",RX=0,PX=0" (Indicator: "GetVersion"; Source: "00000000-00004708.00000000.67069.00CE0000.00000004.mdmp") Found reference to API "GetVersion" (Indicator: "GetVersion"; Source: "00000000-00004708.00000000.67069.010BA000.00000002.mdmp") Found reference to API "GetVersionExA" (Indicator: "GetVersionExA"; Source: "00000000-00004708.00000000.67069.010BA000.00000002.mdmp") Found reference to API "GetVersionExA" (Indicator: "GetVersion"; Source: "00000000-00004708.00000000.67069.010BA000.00000002.mdmp") Found reference to API "69016609606,6340,3024,,RtlGetVersion,NTDLL.dll,"00:17:51.781",RX=0,PX=0" (Indicator: "GetVersion"; Source: "00000000-00004708.00000001.68991.00CE0000.00000004.mdmp, 00000000-00004708.00000002.70911.00CE0000.00000004.mdmp") Found reference to API "GetVersion" (Indicator: "GetVersion"; Source: "00000000-00006492.00000000.67113.0098A000.00000002.mdmp") Found reference to API "GetVersionExA" (Indicator: "GetVersionExA"; Source: "00000000-00006492.00000000.67113.0098A000.00000002.mdmp") Found reference to API "GetVersionExA" (Indicator: "GetVersion"; Source: "00000000-00006492.00000000.67113.0098A000.00000002.mdmp") Found reference to API "1439172599,6776,3024,,RtlGetVersion,NTDLL.dll,"00:17:22.968",RX=0,PX=0" (Indicator: "GetVersion"; Source: "00000000-00006816.00000000.67028.032E0000.00000004.mdmp, 00000000-00006816.00000002.70867.032E0000.00000004.mdmp")32:T8cf,"1KF13LI4.exe" queries volume information of "C:\" at 00000000-00007820-00000C15-55047069 "1KF13LI4.exe" queries volume information of "C:\" at 00000000-00007820-00000C15-57541762 "1KF13LI4.exe" queries volume information of "C:\" at 00000000-00007820-00000C15-62745756 "AppLaunch.exe" queries volume information of "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe" at 00000000-00000712-00000C15-81550966 "AppLaunch.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll" at 00000000-00000712-00000C15-82148858 "AppLaunch.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll" at 00000000-00000712-00000C15-83372265 "AppLaunch.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel\v4.0_4.0.0.0__b77a5c561934e089\System.ServiceModel.dll" at 00000000-00000712-00000C15-84470538 "AppLaunch.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.IdentityModel\v4.0_4.0.0.0__b77a5c561934e089\System.IdentityModel.dll" at 00000000-00000712-00000C15-84633628 "AppLaunch.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\SMDiagnostics\v4.0_4.0.0.0__b77a5c561934e089\SMDiagnostics.dll" at 00000000-00000712-00000C15-84777512 "AppLaunch.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel.Internals\v4.0_4.0.0.0__31bf3856ad364e35\System.ServiceModel.Internals.dll" at 00000000-00000712-00000C15-85169933 "AppLaunch.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll" at 00000000-00000712-00000C15-85893168 "AppLaunch.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll" at 00000000-00000712-00000C15-85906631 "AppLaunch.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll" at 00000000-00000712-00000C15-8590681233:T92b,"1KF13LI4.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APP PATHS\1KF13LI4.EXE") "1KF13LI4.exe" (Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL") "1KF13LI4.exe" (Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\ADDRESSBOOK") "1KF13LI4.exe" (Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\ADDRESSBOOK"; Key: "DISPLAYNAME") "1KF13LI4.exe" (Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\ADOBE FLASH PLAYER NPAPI") "1KF13LI4.exe" (Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\ADOBE FLASH PLAYER NPAPI"; Key: "DISPLAYNAME") "1KF13LI4.exe" (Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\ADOBE FLASH PLAYER NPAPI"; Key: "DISPLAYVERSION") "1KF13LI4.exe" (Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\AUTOITV3") "1KF13LI4.exe" (Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\AUTOITV3"; Key: "DISPLAYNAME") "1KF13LI4.exe" (Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\AUTOITV3"; Key: "DISPLAYVERSION") "1KF13LI4.exe" (Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\CONNECTION MANAGER") "1KF13LI4.exe" (Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\CONNECTION MANAGER"; Key: "DISPLAYNAME") "1KF13LI4.exe" (Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\DIRECTDRAWEX") "1KF13LI4.exe" (Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\DIRECTDRAWEX"; Key: "DISPLAYNAME") "1KF13LI4.exe" (Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\DXM_RUNTIME") "1KF13LI4.exe" (Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\DXM_RUNTIME"; Key: "DISPLAYNAME") "1KF13LI4.exe" (Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\FONTCORE") "1KF13LI4.exe" (Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\FONTCORE"; Key: "DISPLAYNAME") "1KF13LI4.exe" (Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\IE40") "1KF13LI4.exe" (Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\IE40"; Key: "DISPLAYNAME")34:T898,"1KF13LI4.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "1KF13LI4.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "1KF13LI4.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS"; Key: "") "1KF13LI4.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS"; Key: "") "1KF13LI4.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "1KF13LI4.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "1KF13LI4.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS"; Key: "") "1KF13LI4.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS"; Key: "") "1KF13LI4.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED"; Key: "") "1KF13LI4.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES"; Key: "") "1KF13LI4.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS"; Key: "") "1KF13LI4.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS"; Key: "") "1KF13LI4.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED"; Key: "") "1KF13LI4.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES"; Key: "") "1KF13LI4.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS"; Key: "") "1KF13LI4.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS"; Key: "") "1KF13LI4.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT"; Key: "") "1KF13LI4.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES"; Key: "") "1KF13LI4.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CRLS"; Key: "") "1KF13LI4.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CTLS"; Key: "") "1KF13LI4.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE"; Key: "") "1KF13LI4.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE\CERTIFICATES"; Key: "")35:T4f7,"1KF13LI4.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\AUTOUPDATE"; Key: "DISALLOWEDCERTSYNCDELTATIME") "1KF13LI4.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "1KF13LI4.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "1KF13LI4.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\104C63D2546B8021DD105E9FBA5A8D78169F6B32"; Key: "BLOB") "1KF13LI4.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\247106A405B288A46E70A0262717162D0903E734"; Key: "BLOB") "1KF13LI4.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\27AC9369FAF25207BB2627CEFACCBE4EF9C319B8"; Key: "BLOB") "1KF13LI4.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\339CDD57CFD5B141169B615FF31428782D1DA639"; Key: "BLOB") "1KF13LI4.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\4C27431717565A3A07F3E6D0032C4258949CF9EC"; Key: "BLOB") "1KF13LI4.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\525C47FB3A5E0655FBD4BE963CA1E94D5FECB43D"; Key: "BLOB") "1KF13LI4.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\5AEAEE3F7F2A9449CEBAFEEC68FDD184F20124A7"; Key: "BLOB")36:Tc15,"1KF13LI4.exe" called "CopyFileA" to copy %TEMP%\IXP003.TMP\1KF13LI4.exe to new location %LOCALAPPDATA%\MaxLoonaFest131\MaxLoonaFest131.exe (UID: 00000000-00007820) "1KF13LI4.exe" called "CopyFileA" to copy %TEMP%\IXP003.TMP\1KF13LI4.exe to new location %TEMP%\FANBooster131\FANBooster131.exe (UID: 00000000-00007820) "1KF13LI4.exe" called "CopyFileA" to copy %TEMP%\IXP003.TMP\1KF13LI4.exe to new location %ALLUSERSPROFILE%\OfficeTrackerNMP131\OfficeTrackerNMP131.exe (UID: 00000000-00007820) "1KF13LI4.exe" called "CopyFileA" to copy %APPDATA%\Mozilla\Firefox\Profiles/ywzu7870.default\signons.sqlite to new location %TEMP%\posterBoxG8qeDmG3xj4Kw\Ei8DrAmaYu9Ksignons.sqlite (UID: 00000000-00007820) "1KF13LI4.exe" called "CopyFileA" to copy %APPDATA%\Mozilla\Firefox\Profiles/ywzu7870.default\formhistory.sqlite to new location %TEMP%\posterBoxG8qeDmG3xj4Kw\8ghN89CsjOW1formhistory.sqlite (UID: 00000000-00007820) "1KF13LI4.exe" called "CopyFileA" to copy %LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Login Data to new location %TEMP%\posterBoxG8qeDmG3xj4Kw\Ei8DrAmaYu9KLogin Data (UID: 00000000-00007820) "1KF13LI4.exe" called "CopyFileA" to copy %APPDATA%\Mozilla\Firefox\Profiles/ywzu7870.default\places.sqlite to new location %TEMP%\posterBoxG8qeDmG3xj4Kw\D87fZN3R3jFeplaces.sqlite (UID: 00000000-00007820) "1KF13LI4.exe" called "CopyFileA" to copy %APPDATA%\Mozilla\Firefox\Profiles/ywzu7870.default\cookies.sqlite to new location %TEMP%\posterBoxG8qeDmG3xj4Kw\02zdBXl47cvzcookies.sqlite (UID: 00000000-00007820) "1KF13LI4.exe" called "CopyFileA" to copy %LOCALAPPDATA%\Microsoft\Edge\User Data\\Login Data For Account to new location %TEMP%\posterBoxG8qeDmG3xj4Kw\8ghN89CsjOW1Login Data For Account (UID: 00000000-00007820) "1KF13LI4.exe" called "CopyFileA" to copy %APPDATA%\Mozilla\Firefox\Profiles/ywzu7870.default\places.sqlite to new location %TEMP%\posterBoxG8qeDmG3xj4Kw\3b6N2Xdh3CYwplaces.sqlite (UID: 00000000-00007820) "1KF13LI4.exe" called "CopyFileA" to copy %LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Web Data to new location %TEMP%\posterBoxG8qeDmG3xj4Kw\D87fZN3R3jFeWeb Data (UID: 00000000-00007820) "1KF13LI4.exe" called "CopyFileA" to copy %LOCALAPPDATA%\Microsoft\Edge\User Data\Default\History to new location %TEMP%\posterBoxG8qeDmG3xj4Kw\02zdBXl47cvzHistory (UID: 00000000-00007820) "1KF13LI4.exe" called "CopyFileA" to copy %LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Web Data to new location %TEMP%\posterBoxG8qeDmG3xj4Kw\3b6N2Xdh3CYwWeb Data (UID: 00000000-00007820) "1KF13LI4.exe" called "CopyFileA" to copy %LOCALAPPDATA%\Microsoft\Edge\User Data\\Cookies to new location %TEMP%\posterBoxG8qeDmG3xj4Kw\5lop_S5WM5ERCookies (UID: 00000000-00007820) "1KF13LI4.exe" called "CopyFileA" to copy %LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Network\Cookies to new location %TEMP%\posterBoxG8qeDmG3xj4Kw\oOPEmFmu_xsJCookies (UID: 00000000-00007820) "1KF13LI4.exe" called "CopyFileA" to copy %LOCALAPPDATA%\Microsoft\Edge\User Data\Default\History to new location %TEMP%\posterBoxG8qeDmG3xj4Kw\IWPfiAXUTJTSHistory (UID: 00000000-00007820)37:Tc5d,"9ce01fdabd737268e2c5fe3da55fc969.exe" called "CreateDirectoryA" with parameter %TEMP%\IXP000.TMP (UID: 00000000-00007120) "Hl0Uw04.exe" called "CreateDirectoryA" with parameter %TEMP%\IXP001.TMP (UID: 00000000-00006816) "JK4zG29.exe" called "CreateDirectoryA" with parameter %TEMP%\IXP002.TMP (UID: 00000000-00004708) "wH5KL25.exe" called "CreateDirectoryA" with parameter %TEMP%\IXP003.TMP (UID: 00000000-00006492) "1KF13LI4.exe" called "CreateDirectoryA" with parameter %TEMP%\grandUIAG8qeDmG3xj4Kw\Files (UID: 00000000-00007820) "1KF13LI4.exe" called "CreateDirectoryA" with parameter %TEMP%\grandUIAG8qeDmG3xj4Kw\Files\My Music (UID: 00000000-00007820) "1KF13LI4.exe" called "CreateDirectoryA" with parameter %TEMP%\grandUIAG8qeDmG3xj4Kw\Files\My Pictures (UID: 00000000-00007820) "1KF13LI4.exe" called "CreateDirectoryA" with parameter %TEMP%\grandUIAG8qeDmG3xj4Kw\Files\My Videos (UID: 00000000-00007820) "1KF13LI4.exe" called "CreateDirectoryA" with parameter %TEMP%\grandUIAG8qeDmG3xj4Kw\Files\OneNote Notebooks (UID: 00000000-00007820) "1KF13LI4.exe" called "CreateDirectoryA" with parameter %TEMP%\grandUIAG8qeDmG3xj4Kw\Files\OneNote Notebooks\My Notebook (UID: 00000000-00007820) "1KF13LI4.exe" called "CreateDirectoryA" with parameter %TEMP%\grandUIAG8qeDmG3xj4Kw\Files\OneNote Notebooks\OneNote 2010 Guide (UID: 00000000-00007820) "1KF13LI4.exe" called "CreateDirectoryA" with parameter %TEMP%\grandUIAG8qeDmG3xj4Kw\Files\Outlook Files (UID: 00000000-00007820) "1KF13LI4.exe" called "CreateDirectoryA" with parameter %TEMP%\grandUIAG8qeDmG3xj4Kw\Files\.mitmproxy (UID: 00000000-00007820) "1KF13LI4.exe" called "CreateDirectoryA" with parameter %TEMP%\grandUIAG8qeDmG3xj4Kw\Files\3D Objects (UID: 00000000-00007820) "1KF13LI4.exe" called "CreateDirectoryA" with parameter %TEMP%\grandUIAG8qeDmG3xj4Kw\Files\AppData (UID: 00000000-00007820) "1KF13LI4.exe" called "CreateDirectoryA" with parameter %TEMP%\grandUIAG8qeDmG3xj4Kw\Files\AppData\Local (UID: 00000000-00007820) "1KF13LI4.exe" called "CreateDirectoryA" with parameter %TEMP%\grandUIAG8qeDmG3xj4Kw\Files\AppData\Local\Adobe (UID: 00000000-00007820) "1KF13LI4.exe" called "CreateDirectoryA" with parameter %TEMP%\grandUIAG8qeDmG3xj4Kw\Files\AppData\Local\Adobe\Acrobat (UID: 00000000-00007820) "1KF13LI4.exe" called "CreateDirectoryA" with parameter %TEMP%\grandUIAG8qeDmG3xj4Kw\Files\AppData\Local\Adobe\Acrobat\11.0 (UID: 00000000-00007820) "1KF13LI4.exe" called "CreateDirectoryA" with parameter %TEMP%\grandUIAG8qeDmG3xj4Kw\Files\AppData\Local\Adobe\Acrobat\11.0\Cache (UID: 00000000-00007820) "1KF13LI4.exe" called "CreateDirectoryA" with parameter %TEMP%\grandUIAG8qeDmG3xj4Kw\Files\AppData\Local\Adobe\Color (UID: 00000000-00007820) "1KF13LI4.exe" called "CreateDirectoryA" with parameter %TEMP%\grandUIAG8qeDmG3xj4Kw\Files\AppData\Local\Adobe\Color\Profiles (UID: 00000000-00007820) "1KF13LI4.exe" called "CreateDirectoryA" with parameter %TEMP%\grandUIAG8qeDmG3xj4Kw\Files\AppData\Local\Application Data (UID: 00000000-00007820) "1KF13LI4.exe" called "CreateDirectoryA" with parameter %TEMP%\grandUIAG8qeDmG3xj4Kw\Files\AppData\Local\Comms (UID: 00000000-00007820)38:T49d,"9ce01fdabd737268e2c5fe3da55fc969.exe" called "CreateProcessA" with parameter "%TEMP%\IXP000.TMP\Hl0Uw04.exe" - (UID: 00000000-00007120) "Hl0Uw04.exe" called "CreateProcessA" with parameter "%TEMP%\IXP001.TMP\JK4zG29.exe" - (UID: 00000000-00006816) "JK4zG29.exe" called "CreateProcessA" with parameter "%TEMP%\IXP002.TMP\wH5KL25.exe" - (UID: 00000000-00004708) "JK4zG29.exe" called "CreateProcessA" with parameter "%TEMP%\IXP002.TMP\3KZ60ye.exe" - (UID: 00000000-00004708) "wH5KL25.exe" called "CreateProcessA" with parameter "%TEMP%\IXP003.TMP\1KF13LI4.exe" - (UID: 00000000-00006492) "wH5KL25.exe" called "CreateProcessA" with parameter "%TEMP%\IXP003.TMP\2OY8588.exe" - (UID: 00000000-00006492) "1KF13LI4.exe" called "CreateProcessA" with parameter "schtasks /create /f /RU "%OSUSER%" /tr "%ALLUSERSPROFILE%\OfficeTrackerNMP131\OfficeTrackerNMP131.exe" /tn "OfficeTrackerNMP131 HR" /sc HOURLY /rl HIGHEST" - (UID: 00000000-00007820) "1KF13LI4.exe" called "CreateProcessA" with parameter "schtasks /create /f /RU "%OSUSER%" /tr "%ALLUSERSPROFILE%\OfficeTrackerNMP131\OfficeTrackerNMP131.exe" /tn "OfficeTrackerNMP131 LG" /sc ONLOGON /rl HIGHEST" - (UID: 00000000-00007820)39:T3679,"9ce01fdabd737268e2c5fe3da55fc969.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00007120) "9ce01fdabd737268e2c5fe3da55fc969.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00007120) "9ce01fdabd737268e2c5fe3da55fc969.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00007120) "9ce01fdabd737268e2c5fe3da55fc969.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00007120) "9ce01fdabd737268e2c5fe3da55fc969.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\advapi32.dll (UID: 00000000-00007120) "9ce01fdabd737268e2c5fe3da55fc969.exe" called "LoadLibrary" with a parameter feclient.dll (UID: 00000000-00007120) "9ce01fdabd737268e2c5fe3da55fc969.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\advpack.dll (UID: 00000000-00007120) "Hl0Uw04.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00006816) "Hl0Uw04.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00006816) "Hl0Uw04.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00006816) "Hl0Uw04.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00006816) "Hl0Uw04.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\advapi32.dll (UID: 00000000-00006816) "Hl0Uw04.exe" called "LoadLibrary" with a parameter feclient.dll (UID: 00000000-00006816) "Hl0Uw04.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\advpack.dll (UID: 00000000-00006816) "JK4zG29.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00004708) "JK4zG29.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00004708) "JK4zG29.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00004708) "JK4zG29.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00004708) "JK4zG29.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\advapi32.dll (UID: 00000000-00004708) "JK4zG29.exe" called "LoadLibrary" with a parameter feclient.dll (UID: 00000000-00004708) "JK4zG29.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\advpack.dll (UID: 00000000-00004708) "wH5KL25.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00006492) "wH5KL25.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00006492) "wH5KL25.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00006492) "wH5KL25.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00006492) "wH5KL25.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\advapi32.dll (UID: 00000000-00006492) "wH5KL25.exe" called "LoadLibrary" with a parameter feclient.dll (UID: 00000000-00006492) "wH5KL25.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\advpack.dll (UID: 00000000-00006492) "1KF13LI4.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00007820) "1KF13LI4.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00007820) "1KF13LI4.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00007820) "1KF13LI4.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00007820) "1KF13LI4.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-0 (UID: 00000000-00007820) "1KF13LI4.exe" called "LoadLibrary" with a parameter api-ms-win-core-string-l1-1-0 (UID: 00000000-00007820) "1KF13LI4.exe" called "LoadLibrary" with a parameter api-ms-win-core-datetime-l1-1-1 (UID: 00000000-00007820) "1KF13LI4.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-obsolete-l1-2-0 (UID: 00000000-00007820) "1KF13LI4.exe" called "LoadLibrary" with a parameter winhttp.dll (UID: 00000000-00007820) "1KF13LI4.exe" called "LoadLibrary" with a parameter WININET.DLL (UID: 00000000-00007820) "1KF13LI4.exe" called "LoadLibrary" with a parameter WS2_32.dll (UID: 00000000-00007820) "1KF13LI4.exe" called "LoadLibrary" with a parameter vaultcli.dll (UID: 00000000-00007820) "schtasks.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00005204) "schtasks.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00005204) "schtasks.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00005204) "schtasks.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00005204) "schtasks.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00007232) "schtasks.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00007232) "schtasks.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00007232) "schtasks.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00007232) "2OY8588.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00000652) "2OY8588.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00000652) "2OY8588.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00000652) "2OY8588.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00000652) "2OY8588.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-0 (UID: 00000000-00000652) "2OY8588.exe" called "LoadLibrary" with a parameter api-ms-win-core-string-l1-1-0 (UID: 00000000-00000652) "2OY8588.exe" called "LoadLibrary" with a parameter api-ms-win-core-datetime-l1-1-1 (UID: 00000000-00000652) "2OY8588.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-obsolete-l1-2-0 (UID: 00000000-00000652) "2OY8588.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2 (UID: 00000000-00000652) "AppLaunch.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00000712) "AppLaunch.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00000712) "AppLaunch.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00000712) "AppLaunch.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00000712) "AppLaunch.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00000712) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll (UID: 00000000-00000712) "AppLaunch.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00000712) "AppLaunch.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2.dll (UID: 00000000-00000712) "AppLaunch.exe" called "LoadLibrary" with a parameter VERSION.dll (UID: 00000000-00000712) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\clr.dll (UID: 00000000-00000712) "AppLaunch.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00000712) "AppLaunch.exe" called "LoadLibrary" with a parameter api-ms-win-core-quirks-l1-1-0.dll (UID: 00000000-00000712) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoree.dll (UID: 00000000-00000712) "AppLaunch.exe" called "LoadLibrary" with a parameter mscoree.dll (UID: 00000000-00000712) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\combase.dll (UID: 00000000-00000712) "AppLaunch.exe" called "LoadLibrary" with a parameter psapi.dll (UID: 00000000-00000712) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\mscorlib\36eaccfde177c2e7b93b8dbdde4e012a\mscorlib.ni.dll (UID: 00000000-00000712) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\ole32.dll (UID: 00000000-00000712) "AppLaunch.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00000712) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00000712) "AppLaunch.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00000712) "AppLaunch.exe" called "LoadLibrary" with a parameter api-ms-win-core-xstate-l2-1-0.dll (UID: 00000000-00000712) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\clrjit.dll (UID: 00000000-00000712) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\VERSION.dll (UID: 00000000-00000712) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System\2c3c912ea8f058f9d04c4650128feb3f\System.ni.dll (UID: 00000000-00000712) "AppLaunch.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00000712) "AppLaunch.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00000712) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\uxtheme.dll (UID: 00000000-00000712) "AppLaunch.exe" called "LoadLibrary" with a parameter uxtheme.dll (UID: 00000000-00000712) "AppLaunch.exe" called "LoadLibrary" with a parameter user32.dll (UID: 00000000-00000712) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Core\31fae3290fad30c31c98651462d22724\System.Core.ni.dll (UID: 00000000-00000712) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Configuration\96f7edb07b12303f0ec2595c7f3778c7\System.Configuration.ni.dll (UID: 00000000-00000712) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Xml\15af16d373cf0528cb74fc73d365fdbf\System.Xml.ni.dll (UID: 00000000-00000712) "AppLaunch.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00000712) "AppLaunch.exe" called "LoadLibrary" with a parameter shell32.dll (UID: 00000000-00000712) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll (UID: 00000000-00000712) "AppLaunch.exe" called "LoadLibrary" with a parameter bcrypt.dll (UID: 00000000-00000712) "AppLaunch.exe" called "LoadLibrary" with a parameter imm32.dll (UID: 00000000-00000712) "AppLaunch.exe" called "LoadLibrary" with a parameter comctl32.dll (UID: 00000000-00000712) "AppLaunch.exe" called "LoadLibrary" with a parameter gdi32.dll (UID: 00000000-00000712) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\WindowsBase\1a4cc316fb6d09525321fc0be44692d8\WindowsBase.ni.dll (UID: 00000000-00000712) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\PresentationCore\468f4e17be144ca12a73a4297eacc9cc\PresentationCore.ni.dll (UID: 00000000-00000712) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\Presentatio5ae0f00f#\252cc7b0fae8cfe083bdc149957c0c54\PresentationFramework.ni.dll (UID: 00000000-00000712) "AppLaunch.exe" called "LoadLibrary" with a parameter KERNEL32.dll (UID: 00000000-00000712) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\PresentationCore\v4.0_4.0.0.0__31bf3856ad364e35\ucrtbase_clr0400.dll (UID: 00000000-00000712) "AppLaunch.exe" called "LoadLibrary" with a parameter ucrtbase_clr0400.dll (UID: 00000000-00000712) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\PresentationCore\v4.0_4.0.0.0__31bf3856ad364e35\SHLWAPI.dll (UID: 00000000-00000712) "AppLaunch.exe" called "LoadLibrary" with a parameter dwrite.dll (UID: 00000000-00000712) "AppLaunch.exe" called "LoadLibrary" with a parameter api-ms-win-core-string-l1-1-0 (UID: 00000000-00000712) "AppLaunch.exe" called "LoadLibrary" with a parameter api-ms-win-core-datetime-l1-1-1 (UID: 00000000-00000712) "AppLaunch.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-obsolete-l1-2-0 (UID: 00000000-00000712) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\WPF\wpfgfx_v0400.dll (UID: 00000000-00000712) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\WPF\PresentationNative_v0400.dll (UID: 00000000-00000712) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll (UID: 00000000-00000712) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\en-US\tzres.dll.mui (UID: 00000000-00000712) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Runteb92aa12#\274e43040c8a7a02ef1065db3283005a\System.Runtime.Serialization. (UID: 00000000-00000712) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll (UID: 00000000-00000712) "3KZ60ye.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00000632) "3KZ60ye.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00000632) "3KZ60ye.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00000632) "3KZ60ye.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00000632)3a:Tfea7,"9ce01fdabd737268e2c5fe3da55fc969.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00007120) "9ce01fdabd737268e2c5fe3da55fc969.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00007120) "9ce01fdabd737268e2c5fe3da55fc969.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00007120) "9ce01fdabd737268e2c5fe3da55fc969.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00007120) "9ce01fdabd737268e2c5fe3da55fc969.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00007120) "9ce01fdabd737268e2c5fe3da55fc969.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00007120) "9ce01fdabd737268e2c5fe3da55fc969.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00007120) "9ce01fdabd737268e2c5fe3da55fc969.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00007120) "9ce01fdabd737268e2c5fe3da55fc969.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00007120) "9ce01fdabd737268e2c5fe3da55fc969.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00007120) "9ce01fdabd737268e2c5fe3da55fc969.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00007120) "9ce01fdabd737268e2c5fe3da55fc969.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00007120) "9ce01fdabd737268e2c5fe3da55fc969.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00007120) "9ce01fdabd737268e2c5fe3da55fc969.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00007120) "9ce01fdabd737268e2c5fe3da55fc969.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00007120) "9ce01fdabd737268e2c5fe3da55fc969.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00007120) "9ce01fdabd737268e2c5fe3da55fc969.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00007120) "9ce01fdabd737268e2c5fe3da55fc969.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00007120) "9ce01fdabd737268e2c5fe3da55fc969.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00007120) "9ce01fdabd737268e2c5fe3da55fc969.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00007120) "9ce01fdabd737268e2c5fe3da55fc969.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00007120) "9ce01fdabd737268e2c5fe3da55fc969.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00007120) "9ce01fdabd737268e2c5fe3da55fc969.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00007120) "9ce01fdabd737268e2c5fe3da55fc969.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00007120) "9ce01fdabd737268e2c5fe3da55fc969.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00007120) "9ce01fdabd737268e2c5fe3da55fc969.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00007120) "9ce01fdabd737268e2c5fe3da55fc969.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00007120) "9ce01fdabd737268e2c5fe3da55fc969.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00007120) "9ce01fdabd737268e2c5fe3da55fc969.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00007120) "9ce01fdabd737268e2c5fe3da55fc969.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00007120) "9ce01fdabd737268e2c5fe3da55fc969.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00007120) "9ce01fdabd737268e2c5fe3da55fc969.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00007120) "9ce01fdabd737268e2c5fe3da55fc969.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00007120) "9ce01fdabd737268e2c5fe3da55fc969.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00007120) "9ce01fdabd737268e2c5fe3da55fc969.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00007120) "9ce01fdabd737268e2c5fe3da55fc969.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00007120) "9ce01fdabd737268e2c5fe3da55fc969.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00007120) "9ce01fdabd737268e2c5fe3da55fc969.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00007120) "9ce01fdabd737268e2c5fe3da55fc969.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00007120) "9ce01fdabd737268e2c5fe3da55fc969.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00007120) "9ce01fdabd737268e2c5fe3da55fc969.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00007120) "9ce01fdabd737268e2c5fe3da55fc969.exe" called "GetProcAddress" with a parameter HeapSetInformation (UID: 00000000-00007120) "9ce01fdabd737268e2c5fe3da55fc969.exe" called "GetProcAddress" with a parameter DecryptFileA (UID: 00000000-00007120) "9ce01fdabd737268e2c5fe3da55fc969.exe" called "GetProcAddress" with a parameter FeClientInitialize (UID: 00000000-00007120) "9ce01fdabd737268e2c5fe3da55fc969.exe" called "GetProcAddress" with a parameter DelNodeRunDLL32 (UID: 00000000-00007120) "Hl0Uw04.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00006816) "Hl0Uw04.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00006816) "Hl0Uw04.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00006816) "Hl0Uw04.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00006816) "Hl0Uw04.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00006816) "Hl0Uw04.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00006816) "Hl0Uw04.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00006816) "Hl0Uw04.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00006816) "Hl0Uw04.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00006816) "Hl0Uw04.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00006816) "Hl0Uw04.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00006816) "Hl0Uw04.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00006816) "Hl0Uw04.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00006816) "Hl0Uw04.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00006816) "Hl0Uw04.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00006816) "Hl0Uw04.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00006816) "Hl0Uw04.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00006816) "Hl0Uw04.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00006816) "Hl0Uw04.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00006816) "Hl0Uw04.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00006816) "Hl0Uw04.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00006816) "Hl0Uw04.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00006816) "Hl0Uw04.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00006816) "Hl0Uw04.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00006816) "Hl0Uw04.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00006816) "Hl0Uw04.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00006816) "Hl0Uw04.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00006816) "Hl0Uw04.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00006816) "Hl0Uw04.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00006816) "Hl0Uw04.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00006816) "Hl0Uw04.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00006816) "Hl0Uw04.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00006816) "Hl0Uw04.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00006816) "Hl0Uw04.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00006816) "Hl0Uw04.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00006816) "Hl0Uw04.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00006816) "Hl0Uw04.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00006816) "Hl0Uw04.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00006816) "Hl0Uw04.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00006816) "Hl0Uw04.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00006816) "Hl0Uw04.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00006816) "Hl0Uw04.exe" called "GetProcAddress" with a parameter HeapSetInformation (UID: 00000000-00006816) "Hl0Uw04.exe" called "GetProcAddress" with a parameter DecryptFileA (UID: 00000000-00006816) "Hl0Uw04.exe" called "GetProcAddress" with a parameter FeClientInitialize (UID: 00000000-00006816) "Hl0Uw04.exe" called "GetProcAddress" with a parameter DelNodeRunDLL32 (UID: 00000000-00006816) "JK4zG29.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00004708) "JK4zG29.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00004708) "JK4zG29.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00004708) "JK4zG29.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00004708) "JK4zG29.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00004708) "JK4zG29.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00004708) "JK4zG29.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00004708) "JK4zG29.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00004708) "JK4zG29.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00004708) "JK4zG29.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00004708) "JK4zG29.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00004708) "JK4zG29.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00004708) "JK4zG29.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00004708) "JK4zG29.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00004708) "JK4zG29.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00004708) "JK4zG29.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00004708) "JK4zG29.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00004708) "JK4zG29.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00004708) "JK4zG29.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00004708) "JK4zG29.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00004708) "JK4zG29.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00004708) "JK4zG29.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00004708) "JK4zG29.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00004708) "JK4zG29.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00004708) "JK4zG29.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00004708) "JK4zG29.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00004708) "JK4zG29.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00004708) "JK4zG29.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00004708) "JK4zG29.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00004708) "JK4zG29.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00004708) "JK4zG29.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00004708) "JK4zG29.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00004708) "JK4zG29.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00004708) "JK4zG29.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00004708) "JK4zG29.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00004708) "JK4zG29.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00004708) "JK4zG29.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00004708) "JK4zG29.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00004708) "JK4zG29.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00004708) "JK4zG29.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00004708) "JK4zG29.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00004708) "JK4zG29.exe" called "GetProcAddress" with a parameter HeapSetInformation (UID: 00000000-00004708) "JK4zG29.exe" called "GetProcAddress" with a parameter DecryptFileA (UID: 00000000-00004708) "JK4zG29.exe" called "GetProcAddress" with a parameter FeClientInitialize (UID: 00000000-00004708) "JK4zG29.exe" called "GetProcAddress" with a parameter DelNodeRunDLL32 (UID: 00000000-00004708) "wH5KL25.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00006492) "wH5KL25.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00006492) "wH5KL25.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00006492) "wH5KL25.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00006492) "wH5KL25.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00006492) "wH5KL25.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00006492) "wH5KL25.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00006492) "wH5KL25.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00006492) "wH5KL25.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00006492) "wH5KL25.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00006492) "wH5KL25.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00006492) "wH5KL25.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00006492) "wH5KL25.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00006492) "wH5KL25.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00006492) "wH5KL25.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00006492) "wH5KL25.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00006492) "wH5KL25.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00006492) "wH5KL25.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00006492) "wH5KL25.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00006492) "wH5KL25.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00006492) "wH5KL25.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00006492) "wH5KL25.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00006492) "wH5KL25.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00006492) "wH5KL25.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00006492) "wH5KL25.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00006492) "wH5KL25.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00006492) "wH5KL25.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00006492) "wH5KL25.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00006492) "wH5KL25.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00006492) "wH5KL25.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00006492) "wH5KL25.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00006492) "wH5KL25.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00006492) "wH5KL25.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00006492) "wH5KL25.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00006492) "wH5KL25.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00006492) "wH5KL25.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00006492) "wH5KL25.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00006492) "wH5KL25.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00006492) "wH5KL25.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00006492) "wH5KL25.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00006492) "wH5KL25.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00006492) "wH5KL25.exe" called "GetProcAddress" with a parameter HeapSetInformation (UID: 00000000-00006492) "wH5KL25.exe" called "GetProcAddress" with a parameter DecryptFileA (UID: 00000000-00006492) "wH5KL25.exe" called "GetProcAddress" with a parameter FeClientInitialize (UID: 00000000-00006492) "wH5KL25.exe" called "GetProcAddress" with a parameter DelNodeRunDLL32 (UID: 00000000-00006492) "1KF13LI4.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00007820) "1KF13LI4.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00007820) "1KF13LI4.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00007820) "1KF13LI4.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00007820) "1KF13LI4.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00007820) "1KF13LI4.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00007820) "1KF13LI4.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00007820) "1KF13LI4.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00007820) "1KF13LI4.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00007820) "1KF13LI4.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00007820) "1KF13LI4.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00007820) "1KF13LI4.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00007820) "1KF13LI4.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00007820) "1KF13LI4.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00007820) "1KF13LI4.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00007820) "1KF13LI4.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00007820) "1KF13LI4.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00007820) "1KF13LI4.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00007820) "1KF13LI4.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00007820) "1KF13LI4.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00007820) "1KF13LI4.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00007820) "1KF13LI4.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00007820) "1KF13LI4.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00007820) "1KF13LI4.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00007820) "1KF13LI4.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00007820) "1KF13LI4.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00007820) "1KF13LI4.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00007820) "1KF13LI4.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00007820) "1KF13LI4.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00007820) "1KF13LI4.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00007820) "1KF13LI4.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00007820) "1KF13LI4.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00007820) "1KF13LI4.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00007820) "1KF13LI4.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00007820) "1KF13LI4.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00007820) "1KF13LI4.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00007820) "1KF13LI4.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00007820) "1KF13LI4.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00007820) "1KF13LI4.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00007820) "1KF13LI4.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00007820) "1KF13LI4.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00007820) "1KF13LI4.exe" called "GetProcAddress" with a parameter GetTempPath2W (UID: 00000000-00007820) "1KF13LI4.exe" called "GetProcAddress" with a parameter EnumSystemLocalesEx (UID: 00000000-00007820) "1KF13LI4.exe" called "GetProcAddress" with a parameter GetDateFormatEx (UID: 00000000-00007820) "1KF13LI4.exe" called "GetProcAddress" with a parameter GetTimeFormatEx (UID: 00000000-00007820) "1KF13LI4.exe" called "GetProcAddress" with a parameter GetUserDefaultLocaleName (UID: 00000000-00007820) "1KF13LI4.exe" called "GetProcAddress" with a parameter IsValidLocaleName (UID: 00000000-00007820) "1KF13LI4.exe" called "GetProcAddress" with a parameter LCIDToLocaleName (UID: 00000000-00007820) "1KF13LI4.exe" called "GetProcAddress" with a parameter LocaleNameToLCID (UID: 00000000-00007820) "1KF13LI4.exe" called "GetProcAddress" with a parameter O/ (UID: 00000000-00007820) "1KF13LI4.exe" called "GetProcAddress" with a parameter O (UID: 00000000-00007820) "1KF13LI4.exe" called "GetProcAddress" with a parameter ?/ (UID: 00000000-00007820) "1KF13LI4.exe" called "GetProcAddress" with a parameter ? (UID: 00000000-00007820) "1KF13LI4.exe" called "GetProcAddress" with a parameter WinHttpConnect (UID: 00000000-00007820) "1KF13LI4.exe" called "GetProcAddress" with a parameter WinHttpQueryHeaders (UID: 00000000-00007820) "1KF13LI4.exe" called "GetProcAddress" with a parameter WinHttpOpen (UID: 00000000-00007820) "1KF13LI4.exe" called "GetProcAddress" with a parameter WinHttpOpenRequest (UID: 00000000-00007820) "1KF13LI4.exe" called "GetProcAddress" with a parameter WinHttpQueryDataAvailable (UID: 00000000-00007820) "1KF13LI4.exe" called "GetProcAddress" with a parameter WinHttpSendRequest (UID: 00000000-00007820) "1KF13LI4.exe" called "GetProcAddress" with a parameter WinHttpReceiveResponse (UID: 00000000-00007820) "1KF13LI4.exe" called "GetProcAddress" with a parameter WinHttpReadData (UID: 00000000-00007820) "1KF13LI4.exe" called "GetProcAddress" with a parameter WinHttpCloseHandle (UID: 00000000-00007820) "1KF13LI4.exe" called "GetProcAddress" with a parameter WinHttpSetTimeouts (UID: 00000000-00007820) "1KF13LI4.exe" called "GetProcAddress" with a parameter WSASend (UID: 00000000-00007820) "1KF13LI4.exe" called "GetProcAddress" with a parameter VaultEnumerateItems (UID: 00000000-00007820) "1KF13LI4.exe" called "GetProcAddress" with a parameter VaultEnumerateVaults (UID: 00000000-00007820) "1KF13LI4.exe" called "GetProcAddress" with a parameter VaultFree (UID: 00000000-00007820) "1KF13LI4.exe" called "GetProcAddress" with a parameter VaultOpenVault (UID: 00000000-00007820) "1KF13LI4.exe" called "GetProcAddress" with a parameter VaultCloseVault (UID: 00000000-00007820) "1KF13LI4.exe" called "GetProcAddress" with a parameter VaultGetItem (UID: 00000000-00007820) "1KF13LI4.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00007820) "schtasks.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00005204) "schtasks.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00005204) "schtasks.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00005204) "schtasks.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00005204) "schtasks.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00005204) "schtasks.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00005204) "schtasks.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00005204) "schtasks.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00005204) "schtasks.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00005204) "schtasks.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00005204) "schtasks.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00005204) "schtasks.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00005204) "schtasks.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00005204) "schtasks.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00005204) "schtasks.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00005204) "schtasks.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00005204) "schtasks.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00005204) "schtasks.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00005204) "schtasks.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00005204) "schtasks.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00005204) "schtasks.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00005204) "schtasks.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00005204) "schtasks.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00005204) "schtasks.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00005204) "schtasks.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00005204) "schtasks.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00005204) "schtasks.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00005204) "schtasks.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00005204) "schtasks.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00005204) "schtasks.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00005204) "schtasks.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00005204) "schtasks.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00005204) "schtasks.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00005204) "schtasks.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00005204) "schtasks.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00005204) "schtasks.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00005204) "schtasks.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00005204) "schtasks.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00005204) "schtasks.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00005204) "schtasks.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00005204) "schtasks.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00005204) "schtasks.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00007232) "schtasks.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00007232) "schtasks.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00007232) "schtasks.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00007232) "schtasks.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00007232) "schtasks.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00007232) "schtasks.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00007232) "schtasks.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00007232) "schtasks.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00007232) "schtasks.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00007232) "schtasks.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00007232) "schtasks.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00007232) "schtasks.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00007232) "schtasks.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00007232) "schtasks.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00007232) "schtasks.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00007232) "schtasks.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00007232) "schtasks.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00007232) "schtasks.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00007232) "schtasks.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00007232) "schtasks.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00007232) "schtasks.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00007232) "schtasks.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00007232) "schtasks.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00007232) "schtasks.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00007232) "schtasks.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00007232) "schtasks.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00007232) "schtasks.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00007232) "schtasks.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00007232) "schtasks.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00007232) "schtasks.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00007232) "schtasks.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00007232) "schtasks.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00007232) "schtasks.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00007232) "schtasks.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00007232) "schtasks.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00007232) "schtasks.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00007232) "schtasks.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00007232) "schtasks.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00007232) "schtasks.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00007232) "schtasks.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00007232) "2OY8588.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00000652) "2OY8588.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00000652) "2OY8588.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00000652) "2OY8588.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00000652) "2OY8588.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00000652) "2OY8588.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00000652) "2OY8588.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00000652) "2OY8588.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00000652) "2OY8588.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00000652) "2OY8588.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00000652) "2OY8588.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00000652) "2OY8588.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00000652) "2OY8588.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00000652) "2OY8588.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00000652) "2OY8588.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00000652) "2OY8588.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00000652) "2OY8588.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00000652) "2OY8588.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00000652) "2OY8588.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00000652) "2OY8588.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00000652) "2OY8588.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00000652) "2OY8588.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00000652) "2OY8588.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00000652) "2OY8588.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00000652) "2OY8588.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00000652) "2OY8588.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00000652) "2OY8588.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00000652) "2OY8588.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00000652) "2OY8588.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00000652) "2OY8588.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00000652) "2OY8588.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00000652) "2OY8588.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00000652) "2OY8588.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00000652) "2OY8588.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00000652) "2OY8588.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00000652) "2OY8588.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00000652) "2OY8588.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00000652) "2OY8588.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00000652) "2OY8588.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00000652) "2OY8588.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00000652) "2OY8588.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00000652) "2OY8588.exe" called "GetProcAddress" with a parameter GetTempPath2W (UID: 00000000-00000652) "2OY8588.exe" called "GetProcAddress" with a parameter EnumSystemLocalesEx (UID: 00000000-00000652) "2OY8588.exe" called "GetProcAddress" with a parameter GetDateFormatEx (UID: 00000000-00000652) "2OY8588.exe" called "GetProcAddress" with a parameter GetTimeFormatEx (UID: 00000000-00000652) "2OY8588.exe" called "GetProcAddress" with a parameter GetUserDefaultLocaleName (UID: 00000000-00000652) "2OY8588.exe" called "GetProcAddress" with a parameter IsValidLocaleName (UID: 00000000-00000652) "2OY8588.exe" called "GetProcAddress" with a parameter LCIDToLocaleName (UID: 00000000-00000652) "2OY8588.exe" called "GetProcAddress" with a parameter LocaleNameToLCID (UID: 00000000-00000652) "2OY8588.exe" called "GetProcAddress" with a parameter AppPolicyGetThreadInitializationType (UID: 00000000-00000652) "2OY8588.exe" called "GetProcAddress" with a parameter AppPolicyGetProcessTerminationMethod (UID: 00000000-00000652) "AppLaunch.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00000712) "AppLaunch.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00000712) "AppLaunch.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00000712) "AppLaunch.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00000712) "AppLaunch.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00000712) "AppLaunch.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00000712) "AppLaunch.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00000712) "AppLaunch.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00000712) "AppLaunch.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00000712) "AppLaunch.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00000712) "AppLaunch.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00000712) "AppLaunch.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00000712) "AppLaunch.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00000712) "AppLaunch.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00000712) "AppLaunch.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00000712) "AppLaunch.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00000712) "AppLaunch.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00000712) "AppLaunch.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00000712) "AppLaunch.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00000712) "AppLaunch.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00000712) "AppLaunch.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00000712) "AppLaunch.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00000712) "AppLaunch.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00000712) "AppLaunch.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00000712) "AppLaunch.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00000712) "AppLaunch.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00000712) "AppLaunch.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00000712) "AppLaunch.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00000712) "AppLaunch.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00000712) "AppLaunch.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00000712) "AppLaunch.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00000712) "AppLaunch.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00000712) "AppLaunch.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00000712) "AppLaunch.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00000712) "AppLaunch.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00000712) "AppLaunch.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00000712) "AppLaunch.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00000712) "AppLaunch.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00000712) "AppLaunch.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00000712) "AppLaunch.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00000712) "AppLaunch.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00000712) "AppLaunch.exe" called "GetProcAddress" with a parameter DecodePointer (UID: 00000000-00000712) "AppLaunch.exe" called "GetProcAddress" with a parameter EncodePointer (UID: 00000000-00000712) "AppLaunch.exe" called "GetProcAddress" with a parameter RegOpenKeyExW (UID: 00000000-00000712) "AppLaunch.exe" called "GetProcAddress" with a parameter RegQueryInfoKeyW (UID: 00000000-00000712) "AppLaunch.exe" called "GetProcAddress" with a parameter RegEnumKeyExW (UID: 00000000-00000712) "AppLaunch.exe" called "GetProcAddress" with a parameter RegEnumValueW (UID: 00000000-00000712) "AppLaunch.exe" called "GetProcAddress" with a parameter RegCloseKey (UID: 00000000-00000712) "AppLaunch.exe" called "GetProcAddress" with a parameter RegQueryValueExW (UID: 00000000-00000712) "AppLaunch.exe" called "GetProcAddress" with a parameter AddDllDirectory (UID: 00000000-00000712) "AppLaunch.exe" called "GetProcAddress" with a parameter EventRegister (UID: 00000000-00000712) "AppLaunch.exe" called "GetProcAddress" with a parameter EventSetInformation (UID: 00000000-00000712) "AppLaunch.exe" called "GetProcAddress" with a parameter RegisterShimImplCallback (UID: 00000000-00000712) "AppLaunch.exe" called "GetProcAddress" with a parameter RegisterShimImplCleanupCallback (UID: 00000000-00000712) "AppLaunch.exe" called "GetProcAddress" with a parameter SetShellShimInstance (UID: 00000000-00000712) "AppLaunch.exe" called "GetProcAddress" with a parameter OnShimDllMainCalled (UID: 00000000-00000712) "AppLaunch.exe" called "GetProcAddress" with a parameter _CorExeMain_RetAddr (UID: 00000000-00000712) "AppLaunch.exe" called "GetProcAddress" with a parameter _CorExeMain (UID: 00000000-00000712) "AppLaunch.exe" called "GetProcAddress" with a parameter UrlIsW (UID: 00000000-00000712) "AppLaunch.exe" called "GetProcAddress" with a parameter AppPolicyGetClrCompat (UID: 00000000-00000712) "AppLaunch.exe" called "GetProcAddress" with a parameter GetCurrentPackageInfo (UID: 00000000-00000712) "AppLaunch.exe" called "GetProcAddress" with a parameter GetCurrentPackagePath (UID: 00000000-00000712) "AppLaunch.exe" called "GetProcAddress" with a parameter OpenProcessToken (UID: 00000000-00000712) "AppLaunch.exe" called "GetProcAddress" with a parameter GetTokenInformation (UID: 00000000-00000712) "AppLaunch.exe" called "GetProcAddress" with a parameter GetFileVersionInfoSizeW (UID: 00000000-00000712) "AppLaunch.exe" called "GetProcAddress" with a parameter GetFileVersionInfoW (UID: 00000000-00000712) "AppLaunch.exe" called "GetProcAddress" with a parameter VerQueryValueW (UID: 00000000-00000712) "AppLaunch.exe" called "GetProcAddress" with a parameter SetRuntimeInfo (UID: 00000000-00000712) "AppLaunch.exe" called "GetProcAddress" with a parameter GetProcessWindowStation (UID: 00000000-00000712) "AppLaunch.exe" called "GetProcAddress" with a parameter GetUserObjectInformationW (UID: 00000000-00000712) "AppLaunch.exe" called "GetProcAddress" with a parameter QuirkIsEnabled3 (UID: 00000000-00000712) "AppLaunch.exe" called "GetProcAddress" with a parameter QuirkGetData2 (UID: 00000000-00000712) "AppLaunch.exe" called "GetProcAddress" with a parameter CreateConfigStream (UID: 00000000-00000712) "AppLaunch.exe" called "GetProcAddress" with a parameter CreateConfigStream_RetAddr (UID: 00000000-00000712) "AppLaunch.exe" called "GetProcAddress" with a parameter GetNumaHighestNodeNumber (UID: 00000000-00000712) "AppLaunch.exe" called "GetProcAddress" with a parameter GetSystemWindowsDirectoryW (UID: 00000000-00000712) "AppLaunch.exe" called "GetProcAddress" with a parameter AllocateAndInitializeSid (UID: 00000000-00000712) "AppLaunch.exe" called "GetProcAddress" with a parameter InitializeAcl (UID: 00000000-00000712) "AppLaunch.exe" called "GetProcAddress" with a parameter AddAccessAllowedAce (UID: 00000000-00000712) "AppLaunch.exe" called "GetProcAddress" with a parameter FreeSid (UID: 00000000-00000712) "AppLaunch.exe" called "GetProcAddress" with a parameter RoInitialize (UID: 00000000-00000712) "AppLaunch.exe" called "GetProcAddress" with a parameter AddSIDToBoundaryDescriptor (UID: 00000000-00000712) "AppLaunch.exe" called "GetProcAddress" with a parameter CreateBoundaryDescriptorW (UID: 00000000-00000712) "AppLaunch.exe" called "GetProcAddress" with a parameter CreatePrivateNamespaceW (UID: 00000000-00000712) "AppLaunch.exe" called "GetProcAddress" with a parameter OpenPrivateNamespaceW (UID: 00000000-00000712) "AppLaunch.exe" called "GetProcAddress" with a parameter DeleteBoundaryDescriptor (UID: 00000000-00000712) "AppLaunch.exe" called "GetProcAddress" with a parameter WerRegisterRuntimeExceptionModule (UID: 00000000-00000712) "AppLaunch.exe" called "GetProcAddress" with a parameter RaiseException (UID: 00000000-00000712) "AppLaunch.exe" called "GetProcAddress" with a parameter SetSystemFileCacheSize (UID: 00000000-00000712) "AppLaunch.exe" called "GetProcAddress" with a parameter NtSetSystemInformation (UID: 00000000-00000712) "AppLaunch.exe" called "GetProcAddress" with a parameter PrivIsDllSynchronizationHeld (UID: 00000000-00000712) "AppLaunch.exe" called "GetProcAddress" with a parameter GetProcessMemoryInfo (UID: 00000000-00000712) "AppLaunch.exe" called "GetProcAddress" with a parameter GetNativeSystemInfo (UID: 00000000-00000712) "AppLaunch.exe" called "GetProcAddress" with a parameter CoInitializeEx (UID: 00000000-00000712) "AppLaunch.exe" called "GetProcAddress" with a parameter RoUninitialize (UID: 00000000-00000712) "AppLaunch.exe" called "GetProcAddress" with a parameter CoGetContextToken (UID: 00000000-00000712) "AppLaunch.exe" called "GetProcAddress" with a parameter GetEnabledXStateFeatures (UID: 00000000-00000712) "AppLaunch.exe" called "GetProcAddress" with a parameter sxsJitStartup (UID: 00000000-00000712) "AppLaunch.exe" called "GetProcAddress" with a parameter jitStartup (UID: 00000000-00000712) "AppLaunch.exe" called "GetProcAddress" with a parameter getJit (UID: 00000000-00000712) "AppLaunch.exe" called "GetProcAddress" with a parameter LocaleNameToLCID (UID: 00000000-00000712) "AppLaunch.exe" called "GetProcAddress" with a parameter GetUserDefaultLocaleName (UID: 00000000-00000712) "AppLaunch.exe" called "GetProcAddress" with a parameter LCIDToLocaleName (UID: 00000000-00000712) "AppLaunch.exe" called "GetProcAddress" with a parameter GetUserPreferredUILanguages (UID: 00000000-00000712) "AppLaunch.exe" called "GetProcAddress" with a parameter RegOpenKeyEx (UID: 00000000-00000712) "AppLaunch.exe" called "GetProcAddress" with a parameter GetFullPathName (UID: 00000000-00000712) "AppLaunch.exe" called "GetProcAddress" with a parameter GetFullPathNameW (UID: 00000000-00000712) "AppLaunch.exe" called "GetProcAddress" with a parameter IsAppThemed (UID: 00000000-00000712) "AppLaunch.exe" called "GetProcAddress" with a parameter IsAppThemedW (UID: 00000000-00000712) "AppLaunch.exe" called "GetProcAddress" with a parameter CreateActCtx (UID: 00000000-00000712) "AppLaunch.exe" called "GetProcAddress" with a parameter CreateActCtxA (UID: 00000000-00000712) "AppLaunch.exe" called "GetProcAddress" with a parameter CoTaskMemAlloc (UID: 00000000-00000712) "AppLaunch.exe" called "GetProcAddress" with a parameter CoTaskMemFree (UID: 00000000-00000712) "AppLaunch.exe" called "GetProcAddress" with a parameter GetProcessExecutableHeap (UID: 00000000-00000712) "AppLaunch.exe" called "GetProcAddress" with a parameter GetProcessExecutableHeap_RetAddr (UID: 00000000-00000712) "AppLaunch.exe" called "GetProcAddress" with a parameter RegisterWindowMessage (UID: 00000000-00000712) "AppLaunch.exe" called "GetProcAddress" with a parameter RegisterWindowMessageW (UID: 00000000-00000712) "AppLaunch.exe" called "GetProcAddress" with a parameter CompareStringOrdinal (UID: 00000000-00000712) "AppLaunch.exe" called "GetProcAddress" with a parameter CloseHandle (UID: 00000000-00000712) "AppLaunch.exe" called "GetProcAddress" with a parameter GetCurrentProcess (UID: 00000000-00000712) "AppLaunch.exe" called "GetProcAddress" with a parameter GetCurrentProcessW (UID: 00000000-00000712) "AppLaunch.exe" called "GetProcAddress" with a parameter OpenProcessTokenW (UID: 00000000-00000712) "AppLaunch.exe" called "GetProcAddress" with a parameter NtQuerySystemInformation (UID: 00000000-00000712) "AppLaunch.exe" called "GetProcAddress" with a parameter GetFileAttributesEx (UID: 00000000-00000712) "AppLaunch.exe" called "GetProcAddress" with a parameter GetFileAttributesExW (UID: 00000000-00000712) "AppLaunch.exe" called "GetProcAddress" with a parameter SetThreadErrorMode (UID: 00000000-00000712) "AppLaunch.exe" called "GetProcAddress" with a parameter CreateFile (UID: 00000000-00000712) "AppLaunch.exe" called "GetProcAddress" with a parameter CreateFileW (UID: 00000000-00000712) "AppLaunch.exe" called "GetProcAddress" with a parameter GetFileType (UID: 00000000-00000712) "AppLaunch.exe" called "GetProcAddress" with a parameter ConvertSidToStringSidW (UID: 00000000-00000712) "AppLaunch.exe" called "GetProcAddress" with a parameter SHGetFolderPathW (UID: 00000000-00000712) "AppLaunch.exe" called "GetProcAddress" with a parameter BCryptGetFipsAlgorithmMode (UID: 00000000-00000712) "AppLaunch.exe" called "GetProcAddress" with a parameter GetFileSize (UID: 00000000-00000712) "AppLaunch.exe" called "GetProcAddress" with a parameter ReadFile (UID: 00000000-00000712) "AppLaunch.exe" called "GetProcAddress" with a parameter GetSystemMetrics (UID: 00000000-00000712) "AppLaunch.exe" called "GetProcAddress" with a parameter GetModuleHandle (UID: 00000000-00000712) "AppLaunch.exe" called "GetProcAddress" with a parameter GetModuleHandleW (UID: 00000000-00000712) "AppLaunch.exe" called "GetProcAddress" with a parameter GetProcAddress (UID: 00000000-00000712) "AppLaunch.exe" called "GetProcAddress" with a parameter WideCharToMultiByte (UID: 00000000-00000712) "AppLaunch.exe" called "GetProcAddress" with a parameter LoadLibraryEx (UID: 00000000-00000712) "AppLaunch.exe" called "GetProcAddress" with a parameter LoadLibraryExW (UID: 00000000-00000712) "AppLaunch.exe" called "GetProcAddress" with a parameter ProcessIdToSessionId (UID: 00000000-00000712) "AppLaunch.exe" called "GetProcAddress" with a parameter ImmCreateContext (UID: 00000000-00000712) "AppLaunch.exe" called "GetProcAddress" with a parameter ImmDestroyContext (UID: 00000000-00000712) "AppLaunch.exe" called "GetProcAddress" with a parameter ImmNotifyIME (UID: 00000000-00000712) "AppLaunch.exe" called "GetProcAddress" with a parameter ImmAssociateContext (UID: 00000000-00000712) "AppLaunch.exe" called "GetProcAddress" with a parameter ImmReleaseContext (UID: 00000000-00000712) "AppLaunch.exe" called "GetProcAddress" with a parameter ImmGetContext (UID: 00000000-00000712) "AppLaunch.exe" called "GetProcAddress" with a parameter ImmGetCompositionStringA (UID: 00000000-00000712) "AppLaunch.exe" called "GetProcAddress" with a parameter ImmSetCompositionStringA (UID: 00000000-00000712) "AppLaunch.exe" called "GetProcAddress" with a parameter ImmGetCompositionStringW (UID: 00000000-00000712) "AppLaunch.exe" called "GetProcAddress" with a parameter ImmSetCompositionStringW (UID: 00000000-00000712) "AppLaunch.exe" called "GetProcAddress" with a parameter ImmSetCandidateWindow (UID: 00000000-00000712) "AppLaunch.exe" called "GetProcAddress" with a parameter AdjustWindowRectEx (UID: 00000000-00000712) "AppLaunch.exe" called "GetProcAddress" with a parameter GetCurrentThread (UID: 00000000-00000712) "AppLaunch.exe" called "GetProcAddress" with a parameter DuplicateHandle (UID: 00000000-00000712) "AppLaunch.exe" called "GetProcAddress" with a parameter GetCurrentThreadId (UID: 00000000-00000712) "AppLaunch.exe" called "GetProcAddress" with a parameter GetCurrentActCtx (UID: 00000000-00000712) "AppLaunch.exe" called "GetProcAddress" with a parameter ActivateActCtx (UID: 00000000-00000712) "AppLaunch.exe" called "GetProcAddress" with a parameter DefWindowProcW (UID: 00000000-00000712) "AppLaunch.exe" called "GetProcAddress" with a parameter GetStockObject (UID: 00000000-00000712) "AppLaunch.exe" called "GetProcAddress" with a parameter RegisterClass (UID: 00000000-00000712) "AppLaunch.exe" called "GetProcAddress" with a parameter RegisterClassW (UID: 00000000-00000712) "AppLaunch.exe" called "GetProcAddress" with a parameter CreateWindowEx (UID: 00000000-00000712) "AppLaunch.exe" called "GetProcAddress" with a parameter CreateWindowExW (UID: 00000000-00000712) "AppLaunch.exe" called "GetProcAddress" with a parameter SetWindowLong (UID: 00000000-00000712) "AppLaunch.exe" called "GetProcAddress" with a parameter SetWindowLongW (UID: 00000000-00000712) "AppLaunch.exe" called "GetProcAddress" with a parameter GetWindowLong (UID: 00000000-00000712) "AppLaunch.exe" called "GetProcAddress" with a parameter GetWindowLongW (UID: 00000000-00000712) "AppLaunch.exe" called "GetProcAddress" with a parameter FindNLSStringEx (UID: 00000000-00000712) "AppLaunch.exe" called "GetProcAddress" with a parameter RegQueryValueEx (UID: 00000000-00000712) "AppLaunch.exe" called "GetProcAddress" with a parameter CallWindowProc (UID: 00000000-00000712) "AppLaunch.exe" called "GetProcAddress" with a parameter CallWindowProcW (UID: 00000000-00000712) "AppLaunch.exe" called "GetProcAddress" with a parameter GetClientRect (UID: 00000000-00000712) "AppLaunch.exe" called "GetProcAddress" with a parameter GetWindowRect (UID: 00000000-00000712) "AppLaunch.exe" called "GetProcAddress" with a parameter GetParent (UID: 00000000-00000712) "AppLaunch.exe" called "GetProcAddress" with a parameter DeactivateActCtx (UID: 00000000-00000712) "AppLaunch.exe" called "GetProcAddress" with a parameter LocalAlloc (UID: 00000000-00000712) "AppLaunch.exe" called "GetProcAddress" with a parameter _calloc_base (UID: 00000000-00000712) "AppLaunch.exe" called "GetProcAddress" with a parameter InitializeSListHead (UID: 00000000-00000712) "AppLaunch.exe" called "GetProcAddress" with a parameter malloc (UID: 00000000-00000712) "AppLaunch.exe" called "GetProcAddress" with a parameter SetProcessDPIAware (UID: 00000000-00000712) "AppLaunch.exe" called "GetProcAddress" with a parameter GetEnvironmentVariableW (UID: 00000000-00000712) "AppLaunch.exe" called "GetProcAddress" with a parameter PathAppendW (UID: 00000000-00000712) "AppLaunch.exe" called "GetProcAddress" with a parameter DWriteCreateFactory (UID: 00000000-00000712) "AppLaunch.exe" called "GetProcAddress" with a parameter PathCombineW (UID: 00000000-00000712) "AppLaunch.exe" called "GetProcAddress" with a parameter LoadLibraryW (UID: 00000000-00000712) "AppLaunch.exe" called "GetProcAddress" with a parameter EnumSystemLocalesEx (UID: 00000000-00000712) "AppLaunch.exe" called "GetProcAddress" with a parameter GetDateFormatEx (UID: 00000000-00000712) "AppLaunch.exe" called "GetProcAddress" with a parameter GetTimeFormatEx (UID: 00000000-00000712) "AppLaunch.exe" called "GetProcAddress" with a parameter IsValidLocaleName (UID: 00000000-00000712) "AppLaunch.exe" called "GetProcAddress" with a parameter GdiEntry13 (UID: 00000000-00000712) "AppLaunch.exe" called "GetProcAddress" with a parameter EventWrite (UID: 00000000-00000712) "AppLaunch.exe" called "GetProcAddress" with a parameter EventUnregister (UID: 00000000-00000712) "AppLaunch.exe" called "GetProcAddress" with a parameter GetDynamicTimeZoneInformation (UID: 00000000-00000712) "AppLaunch.exe" called "GetProcAddress" with a parameter SHGetFolderPath (UID: 00000000-00000712) "AppLaunch.exe" called "GetProcAddress" with a parameter GetFileMUIPath (UID: 00000000-00000712) "AppLaunch.exe" called "GetProcAddress" with a parameter FreeLibrary (UID: 00000000-00000712) "AppLaunch.exe" called "GetProcAddress" with a parameter FreeLibraryW (UID: 00000000-00000712) "AppLaunch.exe" called "GetProcAddress" with a parameter LoadStringW (UID: 00000000-00000712) "AppLaunch.exe" called "GetProcAddress" with a parameter _CorDllMain_RetAddr (UID: 00000000-00000712) "AppLaunch.exe" called "GetProcAddress" with a parameter _CorDllMain (UID: 00000000-00000712) "AppLaunch.exe" called "GetProcAddress" with a parameter GetTokenForVTableEntry (UID: 00000000-00000712) "AppLaunch.exe" called "GetProcAddress" with a parameter SetTargetForVTableEntry (UID: 00000000-00000712) "AppLaunch.exe" called "GetProcAddress" with a parameter GetTargetForVTableEntry (UID: 00000000-00000712) "3KZ60ye.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00000632) "3KZ60ye.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00000632) "3KZ60ye.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00000632) "3KZ60ye.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00000632) "3KZ60ye.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00000632) "3KZ60ye.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00000632) "3KZ60ye.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00000632) "3KZ60ye.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00000632) "3KZ60ye.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00000632) "3KZ60ye.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00000632) "3KZ60ye.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00000632) "3KZ60ye.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00000632) "3KZ60ye.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00000632) "3KZ60ye.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00000632) "3KZ60ye.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00000632) "3KZ60ye.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00000632) "3KZ60ye.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00000632) "3KZ60ye.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00000632) "3KZ60ye.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00000632) "3KZ60ye.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00000632) "3KZ60ye.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00000632) "3KZ60ye.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00000632) "3KZ60ye.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00000632) "3KZ60ye.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00000632) "3KZ60ye.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00000632) "3KZ60ye.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00000632) "3KZ60ye.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00000632) "3KZ60ye.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00000632) "3KZ60ye.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00000632) "3KZ60ye.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00000632) "3KZ60ye.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00000632) "3KZ60ye.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00000632) "3KZ60ye.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00000632) "3KZ60ye.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00000632) "3KZ60ye.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00000632) "3KZ60ye.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00000632) "3KZ60ye.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00000632) "3KZ60ye.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00000632) "3KZ60ye.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00000632) "3KZ60ye.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00000632) "3KZ60ye.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00000632)3b:T9dd,"UPDATE %Q.%s SET type='table', name=%Q, tbl_name=%Q, rootpage=0, sql=%Q WHERE rowid=#%d" (Source: 50120-2739-004DC570, Indicator: "update %q.%s set type='table', name=%q, tbl_name=%q, rootpage=0, sql=%q where rowid=#%d") "DELETE FROM %Q.%s WHERE tbl_name=%Q and type!='trigger'" (Source: 50120-2662-004CF800, Indicator: "delete from %q.%s where tbl_name=%q and type!='trigger'") "DELETE FROM %Q.sqlite_stat1 WHERE tbl=%Q" (Source: 50120-2662-004CF800, Indicator: "delete from %q.sqlite_stat1 where tbl=%q") "UPDATE %Q.%s SET sql = sqlite_rename_table(sql, %Q), tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqlite_autoindex%%' AND type='index' THEN 'sqlite_autoindex_' || %Q || substr(name,%d+18) ELSE name END WHERE tbl_name=%Q AND (type='" (Source: 50120-2734-004CD2C0, Indicator: "update %q.%s set sql = sqlite_rename_table(sql, %q) tbl_name = %q name = case when type='table' then %q when name like 'sqlite_autoindex%%' and type='index' then 'sqlite_autoindex_' || %q || substr(name,%d+18) else name end where tbl_name=%q and (type='") "UPDATE %Q.%s SET type='%s', name=%Q, tbl_name=%Q, rootpage=#%d, sql=%Q WHERE rowid=#%d" (Source: 50120-2460-004CF4F0, Indicator: "update %q.%s set type='%s', name=%q, tbl_name=%q, rootpage=#%d, sql=%q where rowid=#%d") "DELETE FROM %Q.%s WHERE name=%Q" (Source: 50120-2708-004D0320, Indicator: "delete from %q.%s where name=%q") "DELETE FROM %Q.sqlite_stat1 WHERE idx=%Q" (Source: 50120-2708-004D0320, Indicator: "delete from %q.sqlite_stat1 where idx=%q") "SELECT name, rootpage, sql FROM '%q'.%s WHERE %s" (Source: 50120-2310-004C2E90, Indicator: "select name, rootpage, sql from '%q'.%s where %s") "UPDATE "%w".%s SET sql = substr(sql,1,%d) || ', ' || %Q || substr(sql,%d) WHERE type = 'table' AND name = %Q" (Source: 50120-2736-004CD570, Indicator: "update "%w".%s set sql = substr(sql,1,%d) || ', ' || %q || substr(sql,%d) where type = 'table' and name = %q"), "CREATE TABLE sqlite_master( type text, name text, tbl_name text, rootpage integer, sql text)" (Source: 50120-2265-004D6790, Indicator: "create table sqlite_master( type text, name text, tbl_name text, rootpage integer, sql text)"), "SELECT name rootpage sql FROM '%q'.%s" (Source: 50120-2265-004D6790, Indicator: "select name rootpage sql from '%q'.%s"), "INSERT INTO %Q.%s VALUES('index',%Q,%Q,#%d,%Q);" (Source: 50120-2649-004CFB70, Indicator: "insert into %q.%s values('index',%q,%q,#%d,%q);"), "CREATE TABLE" (Source: 50120-2466-004CF340, Indicator: "create table")3c:T1695,Found reference to API "CreateProcessA" (Indicator: "CreateProcess"; File: "9ce01fdabd737268e2c5fe3da55fc969.exe") Found reference to API "__COMPAT_LAYER=ElevateCreateProcess WRPMitigation" (Indicator: "CreateProcess"; Source: "00000000-00000632.00000000.68914.02A00000.00000004.mdmp, 00000000-00000632.00000000.68914.02B50000.00000004.mdmp, 00000000-00000632.00000001.70834.02810000.00000004.mdmp, 00000000-00000632.00000002.72753.02810000.00000004.mdmp, 00000000-00000632.00000002.72753.02A00000.00000004.mdmp") Found reference to API "levateCreateProcess" (Indicator: "CreateProcess"; Source: "00000000-00000632.00000000.68914.02A00000.00000004.mdmp, 00000000-00000632.00000002.72753.02A00000.00000004.mdmp") Found reference to API "" (Indicator: "CreateProcess"; Source: "00000000-00000632.00000001.70834.02810000.00000004.mdmp, 00000000-00000632.00000002.72753.02810000.00000004.mdmp") Found reference to API "" (Indicator: "CreateProcess"; Source: "00000000-00000632.00000001.70834.02810000.00000004.mdmp, 00000000-00000632.00000002.72753.02810000.00000004.mdmp") Found reference to API "" (Indicator: "CreateProcess"; Source: "00000000-00000632.00000001.70834.02810000.00000004.mdmp, 00000000-00000632.00000002.72753.02810000.00000004.mdmp") Found reference to API "" (Indicator: "CreateProcess"; Source: "00000000-00000632.00000001.70834.02810000.00000004.mdmp, 00000000-00000632.00000002.72753.02810000.00000004.mdmp") Found reference to API "__COMPAT_LAYER=ElevateCreateProcess WRPMitigation" (Indicator: "CreateProcess"; Source: "00000000-00004708.00000000.67069.00CE0000.00000004.mdmp, 00000000-00004708.00000001.68991.00CE0000.00000004.mdmp, 00000000-00004708.00000001.68991.00E30000.00000004.mdmp, 00000000-00004708.00000002.70911.00CE0000.00000004.mdmp") Found reference to API "levateCreateProcess" (Indicator: "CreateProcess"; Source: "00000000-00004708.00000000.67069.00CE0000.00000004.mdmp, 00000000-00004708.00000001.68991.00CE0000.00000004.mdmp, 00000000-00004708.00000002.70911.00CE0000.00000004.mdmp") Found reference to API "ElevateCreateProcess WRPMitigation" (Indicator: "CreateProcess"; Source: "00000000-00004708.00000000.67069.00CE0000.00000004.mdmp, 00000000-00004708.00000001.68991.00CE0000.00000004.mdmp, 00000000-00004708.00000002.70911.00CE0000.00000004.mdmp") Found reference to API "" (Indicator: "CreateProcess"; Source: "00000000-00004708.00000000.67069.00CE0000.00000004.mdmp, 00000000-00004708.00000001.68991.00CE0000.00000004.mdmp, 00000000-00004708.00000002.70911.00CE0000.00000004.mdmp") Found reference to API "" (Indicator: "CreateProcess"; Source: "00000000-00004708.00000000.67069.00CE0000.00000004.mdmp, 00000000-00004708.00000001.68991.00CE0000.00000004.mdmp, 00000000-00004708.00000002.70911.00CE0000.00000004.mdmp") Found reference to API "" (Indicator: "CreateProcess"; Source: "00000000-00004708.00000000.67069.00CE0000.00000004.mdmp, 00000000-00004708.00000001.68991.00CE0000.00000004.mdmp, 00000000-00004708.00000002.70911.00CE0000.00000004.mdmp") Found reference to API "" (Indicator: "CreateProcess"; Source: "00000000-00004708.00000000.67069.00CE0000.00000004.mdmp, 00000000-00004708.00000001.68991.00CE0000.00000004.mdmp, 00000000-00004708.00000002.70911.00CE0000.00000004.mdmp") Found reference to API "PRINT,NS_ElevateCreateProcess::APIHook_CreateProcessA,318,[ApiName] Hook Entered" (Indicator: "CreateProcess"; Source: "00000000-00004708.00000000.67069.00CE0000.00000004.mdmp, 00000000-00004708.00000001.68991.00CE0000.00000004.mdmp, 00000000-00004708.00000002.70911.00CE0000.00000004.mdmp") Found reference to API "1528836360,6340,3136,,CreateProcessA,kernel32.dll,"00:17:23.671",RX=0,PX=0" (Indicator: "CreateProcess"; Source: "00000000-00004708.00000000.67069.00CE0000.00000004.mdmp") Found reference to API "CreateProcessA" (Indicator: "CreateProcess"; Source: "00000000-00004708.00000000.67069.010BA000.00000002.mdmp") Found reference to API "69037625600,6340,3136,,CreateProcessA,kernel32.dll,"00:17:51.796",RX=0,PX=0" (Indicator: "CreateProcess"; Source: "00000000-00004708.00000001.68991.00CE0000.00000004.mdmp, 00000000-00004708.00000002.70911.00CE0000.00000004.mdmp") Found reference to API "CreateProcessA" (Indicator: "CreateProcess"; Source: "00000000-00006492.00000000.67113.0098A000.00000002.mdmp") Found reference to API "__COMPAT_LAYER=ElevateCreateProcess WRPMitigation" (Indicator: "CreateProcess"; Source: "00000000-00006492.00000000.67113.03400000.00000004.mdmp, 00000000-00006492.00000000.67113.036F0000.00000004.mdmp") Found reference to API "levateCreateProcess" (Indicator: "CreateProcess"; Source: "00000000-00006492.00000000.67113.03400000.00000004.mdmp") Found reference to API "ElevateCreateProcess WRPMitigation" (Indicator: "CreateProcess"; Source: "00000000-00006492.00000000.67113.03400000.00000004.mdmp") Found reference to API "" (Indicator: "CreateProcess"; Source: "00000000-00006492.00000000.67113.03400000.00000004.mdmp") Found reference to API "" (Indicator: "CreateProcess"; Source: "00000000-00006492.00000000.67113.03400000.00000004.mdmp") Found reference to API "" (Indicator: "CreateProcess"; Source: "00000000-00006492.00000000.67113.03400000.00000004.mdmp")3d:T10ad,Found reference to API "RegCreateKeyExA" (Indicator: "RegCreateKey"; File: "9ce01fdabd737268e2c5fe3da55fc969.exe") Found reference to API "" (Indicator: "RegCreateKey"; Source: "00000000-00000632.00000001.70834.02810000.00000004.mdmp, 00000000-00000632.00000002.72753.02810000.00000004.mdmp") Found reference to API "" (Indicator: "RegCreateKey"; Source: "00000000-00000632.00000001.70834.02810000.00000004.mdmp, 00000000-00000632.00000002.72753.02810000.00000004.mdmp") Found reference to API "" (Indicator: "RegCreateKey"; Source: "00000000-00000632.00000001.70834.02810000.00000004.mdmp, 00000000-00000632.00000002.72753.02810000.00000004.mdmp") Found reference to API "" (Indicator: "RegCreateKey"; Source: "00000000-00000632.00000001.70834.02810000.00000004.mdmp, 00000000-00000632.00000002.72753.02810000.00000004.mdmp") Found reference to API "" (Indicator: "RegCreateKey"; Source: "00000000-00004708.00000000.67069.00CE0000.00000004.mdmp, 00000000-00004708.00000001.68991.00CE0000.00000004.mdmp, 00000000-00004708.00000002.70911.00CE0000.00000004.mdmp") Found reference to API "" (Indicator: "RegCreateKey"; Source: "00000000-00004708.00000000.67069.00CE0000.00000004.mdmp, 00000000-00004708.00000001.68991.00CE0000.00000004.mdmp, 00000000-00004708.00000002.70911.00CE0000.00000004.mdmp") Found reference to API "" (Indicator: "RegCreateKey"; Source: "00000000-00004708.00000000.67069.00CE0000.00000004.mdmp, 00000000-00004708.00000001.68991.00CE0000.00000004.mdmp, 00000000-00004708.00000002.70911.00CE0000.00000004.mdmp") Found reference to API "" (Indicator: "RegCreateKey"; Source: "00000000-00004708.00000000.67069.00CE0000.00000004.mdmp, 00000000-00004708.00000001.68991.00CE0000.00000004.mdmp, 00000000-00004708.00000002.70911.00CE0000.00000004.mdmp") Found reference to API "RegCreateKeyExA" (Indicator: "RegCreateKey"; Source: "00000000-00004708.00000000.67069.010BA000.00000002.mdmp") Found reference to API "RegCreateKeyExA" (Indicator: "RegCreateKey"; Source: "00000000-00006492.00000000.67113.0098A000.00000002.mdmp") Found reference to API "" (Indicator: "RegCreateKey"; Source: "00000000-00006492.00000000.67113.03400000.00000004.mdmp") Found reference to API "" (Indicator: "RegCreateKey"; Source: "00000000-00006492.00000000.67113.03400000.00000004.mdmp") Found reference to API "" (Indicator: "RegCreateKey"; Source: "00000000-00006492.00000000.67113.03400000.00000004.mdmp") Found reference to API "" (Indicator: "RegCreateKey"; Source: "00000000-00006492.00000000.67113.03400000.00000004.mdmp") Found reference to API "" (Indicator: "RegCreateKey"; Source: "00000000-00006816.00000000.67028.032E0000.00000004.mdmp, 00000000-00006816.00000002.70867.032E0000.00000004.mdmp") Found reference to API "" (Indicator: "RegCreateKey"; Source: "00000000-00006816.00000000.67028.032E0000.00000004.mdmp, 00000000-00006816.00000002.70867.032E0000.00000004.mdmp") Found reference to API "" (Indicator: "RegCreateKey"; Source: "00000000-00006816.00000000.67028.032E0000.00000004.mdmp, 00000000-00006816.00000002.70867.032E0000.00000004.mdmp") Found reference to API "" (Indicator: "RegCreateKey"; Source: "00000000-00006816.00000000.67028.032E0000.00000004.mdmp, 00000000-00006816.00000002.70867.032E0000.00000004.mdmp") Found reference to API "RegCreateKeyExA" (Indicator: "RegCreateKey"; Source: "00000000-00006816.00000002.70867.003CA000.00000002.mdmp")3e:T89a,Found reference to API "CreateFileA" (Indicator: "CreateFile"; File: "9ce01fdabd737268e2c5fe3da55fc969.exe") Found reference to API "" (Indicator: "CreateFile"; Source: "00000000-00000632.00000001.70834.02810000.00000004.mdmp, 00000000-00000632.00000002.72753.02810000.00000004.mdmp") Found reference to API "" (Indicator: "CreateFile"; Source: "00000000-00000632.00000001.70834.02810000.00000004.mdmp, 00000000-00000632.00000002.72753.02810000.00000004.mdmp") Found reference to API "" (Indicator: "CreateFile"; Source: "00000000-00004708.00000000.67069.00CE0000.00000004.mdmp, 00000000-00004708.00000001.68991.00CE0000.00000004.mdmp, 00000000-00004708.00000002.70911.00CE0000.00000004.mdmp") Found reference to API "" (Indicator: "CreateFile"; Source: "00000000-00004708.00000000.67069.00CE0000.00000004.mdmp, 00000000-00004708.00000001.68991.00CE0000.00000004.mdmp, 00000000-00004708.00000002.70911.00CE0000.00000004.mdmp") Found reference to API "CreateFileA" (Indicator: "CreateFile"; Source: "00000000-00004708.00000000.67069.010BA000.00000002.mdmp") Found reference to API "CreateFileA" (Indicator: "CreateFile"; Source: "00000000-00006492.00000000.67113.0098A000.00000002.mdmp") Found reference to API "" (Indicator: "CreateFile"; Source: "00000000-00006492.00000000.67113.03400000.00000004.mdmp") Found reference to API "" (Indicator: "CreateFile"; Source: "00000000-00006492.00000000.67113.03400000.00000004.mdmp") Found reference to API "" (Indicator: "CreateFile"; Source: "00000000-00006816.00000000.67028.032E0000.00000004.mdmp, 00000000-00006816.00000002.70867.032E0000.00000004.mdmp") Found reference to API "" (Indicator: "CreateFile"; Source: "00000000-00006816.00000000.67028.032E0000.00000004.mdmp, 00000000-00006816.00000002.70867.032E0000.00000004.mdmp")3f:Tb767,Found reference to API (Indicator: "CheckTokenMembership"; File: "9ce01fdabd737268e2c5fe3da55fc969.exe") Found reference to API (Indicator: "HeapSetInformation"; File: "9ce01fdabd737268e2c5fe3da55fc969.exe") Found reference to API (Indicator: "DecryptFileA"; File: "9ce01fdabd737268e2c5fe3da55fc969.exe") Found reference to API (Indicator: "SHBrowseForFolder"; File: "9ce01fdabd737268e2c5fe3da55fc969.exe") Found reference to API (Indicator: "SHGetPathFromIDList"; File: "9ce01fdabd737268e2c5fe3da55fc969.exe") Found reference to API (Indicator: "GetTokenInformation"; File: "9ce01fdabd737268e2c5fe3da55fc969.exe") Found reference to API (Indicator: "RegDeleteValueA"; File: "9ce01fdabd737268e2c5fe3da55fc969.exe") Found reference to API (Indicator: "RegOpenKeyExA"; File: "9ce01fdabd737268e2c5fe3da55fc969.exe") Found reference to API (Indicator: "RegQueryInfoKeyA"; File: "9ce01fdabd737268e2c5fe3da55fc969.exe") Found reference to API (Indicator: "FreeSid"; File: "9ce01fdabd737268e2c5fe3da55fc969.exe") Found reference to API (Indicator: "OpenProcessToken"; File: "9ce01fdabd737268e2c5fe3da55fc969.exe") Found reference to API (Indicator: "RegSetValueExA"; File: "9ce01fdabd737268e2c5fe3da55fc969.exe") Found reference to API (Indicator: "RegCreateKeyExA"; File: "9ce01fdabd737268e2c5fe3da55fc969.exe") Found reference to API (Indicator: "LookupPrivilegeValueA"; File: "9ce01fdabd737268e2c5fe3da55fc969.exe") Found reference to API (Indicator: "AllocateAndInitializeSid"; File: "9ce01fdabd737268e2c5fe3da55fc969.exe") Found reference to API (Indicator: "RegQueryValueExA"; File: "9ce01fdabd737268e2c5fe3da55fc969.exe") Found reference to API (Indicator: "EqualSid"; File: "9ce01fdabd737268e2c5fe3da55fc969.exe") Found reference to API (Indicator: "RegCloseKey"; File: "9ce01fdabd737268e2c5fe3da55fc969.exe") Found reference to API (Indicator: "AdjustTokenPrivileges"; File: "9ce01fdabd737268e2c5fe3da55fc969.exe") Found reference to API (Indicator: "GetShortPathNameA"; File: "9ce01fdabd737268e2c5fe3da55fc969.exe") Found reference to API (Indicator: "GetModuleFileNameA"; File: "9ce01fdabd737268e2c5fe3da55fc969.exe") Found reference to API (Indicator: "FindFirstFileA"; File: "9ce01fdabd737268e2c5fe3da55fc969.exe") Found reference to API (Indicator: "GetCurrentProcess"; File: "9ce01fdabd737268e2c5fe3da55fc969.exe") Found reference to API (Indicator: "FindNextFileA"; File: "9ce01fdabd737268e2c5fe3da55fc969.exe") Found reference to API (Indicator: "ExpandEnvironmentStringsA"; File: "9ce01fdabd737268e2c5fe3da55fc969.exe") Found reference to API (Indicator: "FindClose"; File: "9ce01fdabd737268e2c5fe3da55fc969.exe") Found reference to API (Indicator: "LocalAlloc"; File: "9ce01fdabd737268e2c5fe3da55fc969.exe") Found reference to API (Indicator: "lstrcmpA"; File: "9ce01fdabd737268e2c5fe3da55fc969.exe") Found reference to API (Indicator: "CompareStringA"; File: "9ce01fdabd737268e2c5fe3da55fc969.exe") Found reference to API (Indicator: "GetLastError"; File: "9ce01fdabd737268e2c5fe3da55fc969.exe") Found reference to API (Indicator: "GetFileAttributesA"; File: "9ce01fdabd737268e2c5fe3da55fc969.exe") Found reference to API (Indicator: "GetSystemDirectoryA"; File: "9ce01fdabd737268e2c5fe3da55fc969.exe") Found reference to API (Indicator: "LoadLibraryA"; File: "9ce01fdabd737268e2c5fe3da55fc969.exe") Found reference to API (Indicator: "DeleteFileA"; File: "9ce01fdabd737268e2c5fe3da55fc969.exe") Found reference to API (Indicator: "GlobalAlloc"; File: "9ce01fdabd737268e2c5fe3da55fc969.exe") Found reference to API (Indicator: "GlobalFree"; File: "9ce01fdabd737268e2c5fe3da55fc969.exe") Found reference to API (Indicator: "CloseHandle"; File: "9ce01fdabd737268e2c5fe3da55fc969.exe") Found reference to API (Indicator: "WritePrivateProfileStringA"; File: "9ce01fdabd737268e2c5fe3da55fc969.exe") Found reference to API (Indicator: "IsDBCSLeadByte"; File: "9ce01fdabd737268e2c5fe3da55fc969.exe") Found reference to API (Indicator: "GetWindowsDirectoryA"; File: "9ce01fdabd737268e2c5fe3da55fc969.exe") Found reference to API (Indicator: "SetFileAttributesA"; File: "9ce01fdabd737268e2c5fe3da55fc969.exe") Found reference to API (Indicator: "GetProcAddress"; File: "9ce01fdabd737268e2c5fe3da55fc969.exe") Found reference to API (Indicator: "GlobalLock"; File: "9ce01fdabd737268e2c5fe3da55fc969.exe") Found reference to API (Indicator: "LocalFree"; File: "9ce01fdabd737268e2c5fe3da55fc969.exe") Found reference to API (Indicator: "RemoveDirectoryA"; File: "9ce01fdabd737268e2c5fe3da55fc969.exe") Found reference to API (Indicator: "FreeLibrary"; File: "9ce01fdabd737268e2c5fe3da55fc969.exe") Found reference to API (Indicator: "CreateDirectoryA"; File: "9ce01fdabd737268e2c5fe3da55fc969.exe") Found reference to API (Indicator: "GetPrivateProfileIntA"; File: "9ce01fdabd737268e2c5fe3da55fc969.exe") Found reference to API (Indicator: "GetPrivateProfileStringA"; File: "9ce01fdabd737268e2c5fe3da55fc969.exe") Found reference to API (Indicator: "GlobalUnlock"; File: "9ce01fdabd737268e2c5fe3da55fc969.exe") Found reference to API (Indicator: "ReadFile"; File: "9ce01fdabd737268e2c5fe3da55fc969.exe") Found reference to API (Indicator: "SizeofResource"; File: "9ce01fdabd737268e2c5fe3da55fc969.exe") Found reference to API (Indicator: "WriteFile"; File: "9ce01fdabd737268e2c5fe3da55fc969.exe") Found reference to API (Indicator: "GetDriveTypeA"; File: "9ce01fdabd737268e2c5fe3da55fc969.exe") Found reference to API (Indicator: "LoadLibraryExA"; File: "9ce01fdabd737268e2c5fe3da55fc969.exe") Found reference to API (Indicator: "SetFileTime"; File: "9ce01fdabd737268e2c5fe3da55fc969.exe") Found reference to API (Indicator: "SetFilePointer"; File: "9ce01fdabd737268e2c5fe3da55fc969.exe") Found reference to API (Indicator: "FindResourceA"; File: "9ce01fdabd737268e2c5fe3da55fc969.exe") Found reference to API (Indicator: "CreateMutexA"; File: "9ce01fdabd737268e2c5fe3da55fc969.exe") Found reference to API (Indicator: "GetVolumeInformationA"; File: "9ce01fdabd737268e2c5fe3da55fc969.exe") Found reference to API (Indicator: "WaitForSingleObject"; File: "9ce01fdabd737268e2c5fe3da55fc969.exe") Found reference to API (Indicator: "GetCurrentDirectoryA"; File: "9ce01fdabd737268e2c5fe3da55fc969.exe") Found reference to API (Indicator: "FreeResource"; File: "9ce01fdabd737268e2c5fe3da55fc969.exe") Found reference to API (Indicator: "GetVersion"; File: "9ce01fdabd737268e2c5fe3da55fc969.exe") Found reference to API (Indicator: "SetCurrentDirectoryA"; File: "9ce01fdabd737268e2c5fe3da55fc969.exe") Found reference to API (Indicator: "GetTempPathA"; File: "9ce01fdabd737268e2c5fe3da55fc969.exe") Found reference to API (Indicator: "LocalFileTimeToFileTime"; File: "9ce01fdabd737268e2c5fe3da55fc969.exe") Found reference to API (Indicator: "CreateFileA"; File: "9ce01fdabd737268e2c5fe3da55fc969.exe") Found reference to API (Indicator: "SetEvent"; File: "9ce01fdabd737268e2c5fe3da55fc969.exe") Found reference to API (Indicator: "TerminateThread"; File: "9ce01fdabd737268e2c5fe3da55fc969.exe") Found reference to API (Indicator: "GetVersionExA"; File: "9ce01fdabd737268e2c5fe3da55fc969.exe") Found reference to API (Indicator: "LockResource"; File: "9ce01fdabd737268e2c5fe3da55fc969.exe") Found reference to API (Indicator: "GetSystemInfo"; File: "9ce01fdabd737268e2c5fe3da55fc969.exe") Found reference to API (Indicator: "CreateThread"; File: "9ce01fdabd737268e2c5fe3da55fc969.exe") Found reference to API (Indicator: "ResetEvent"; File: "9ce01fdabd737268e2c5fe3da55fc969.exe") Found reference to API (Indicator: "LoadResource"; File: "9ce01fdabd737268e2c5fe3da55fc969.exe") Found reference to API (Indicator: "ExitProcess"; File: "9ce01fdabd737268e2c5fe3da55fc969.exe") Found reference to API (Indicator: "GetModuleHandleW"; File: "9ce01fdabd737268e2c5fe3da55fc969.exe") Found reference to API (Indicator: "CreateProcessA"; File: "9ce01fdabd737268e2c5fe3da55fc969.exe") Found reference to API (Indicator: "FormatMessageA"; File: "9ce01fdabd737268e2c5fe3da55fc969.exe") Found reference to API (Indicator: "GetTempFileNameA"; File: "9ce01fdabd737268e2c5fe3da55fc969.exe") Found reference to API (Indicator: "DosDateTimeToFileTime"; File: "9ce01fdabd737268e2c5fe3da55fc969.exe") Found reference to API (Indicator: "CreateEventA"; File: "9ce01fdabd737268e2c5fe3da55fc969.exe") Found reference to API (Indicator: "GetExitCodeProcess"; File: "9ce01fdabd737268e2c5fe3da55fc969.exe") Found reference to API (Indicator: "GetDeviceCaps"; File: "9ce01fdabd737268e2c5fe3da55fc969.exe") Found reference to API (Indicator: "GetDesktopWindow"; File: "9ce01fdabd737268e2c5fe3da55fc969.exe") Found reference to API (Indicator: "CharUpperA"; File: "9ce01fdabd737268e2c5fe3da55fc969.exe") Found reference to API (Indicator: "ExitWindowsEx"; File: "9ce01fdabd737268e2c5fe3da55fc969.exe") Found reference to API (Indicator: "MessageBeep"; File: "9ce01fdabd737268e2c5fe3da55fc969.exe") Found reference to API (Indicator: "CharPrevA"; File: "9ce01fdabd737268e2c5fe3da55fc969.exe") Found reference to API (Indicator: "LoadStringA"; File: "9ce01fdabd737268e2c5fe3da55fc969.exe") Found reference to API (Indicator: "CharNextA"; File: "9ce01fdabd737268e2c5fe3da55fc969.exe") Found reference to API (Indicator: "EnableWindow"; File: "9ce01fdabd737268e2c5fe3da55fc969.exe") Found reference to API (Indicator: "ReleaseDC"; File: "9ce01fdabd737268e2c5fe3da55fc969.exe") Found reference to API (Indicator: "SetForegroundWindow"; File: "9ce01fdabd737268e2c5fe3da55fc969.exe") Found reference to API (Indicator: "PeekMessageA"; File: "9ce01fdabd737268e2c5fe3da55fc969.exe") Found reference to API (Indicator: "SendMessageA"; File: "9ce01fdabd737268e2c5fe3da55fc969.exe") Found reference to API (Indicator: "MessageBoxA"; File: "9ce01fdabd737268e2c5fe3da55fc969.exe") Found reference to API (Indicator: "SetWindowTextA"; File: "9ce01fdabd737268e2c5fe3da55fc969.exe") Found reference to API (Indicator: "GetWindowLongA"; File: "9ce01fdabd737268e2c5fe3da55fc969.exe") Found reference to API (Indicator: "CallWindowProcA"; File: "9ce01fdabd737268e2c5fe3da55fc969.exe") Found reference to API (Indicator: "SetWindowLongA"; File: "9ce01fdabd737268e2c5fe3da55fc969.exe") Found reference to API (Indicator: "ShowWindow"; File: "9ce01fdabd737268e2c5fe3da55fc969.exe") Found reference to API (Indicator: "MsgWaitForMultipleObjects"; File: "9ce01fdabd737268e2c5fe3da55fc969.exe") Found reference to API (Indicator: "SetWindowPos"; File: "9ce01fdabd737268e2c5fe3da55fc969.exe") Found reference to API (Indicator: "GetDC"; File: "9ce01fdabd737268e2c5fe3da55fc969.exe") Found reference to API (Indicator: "GetWindowRect"; File: "9ce01fdabd737268e2c5fe3da55fc969.exe") Found reference to API (Indicator: "DispatchMessageA"; File: "9ce01fdabd737268e2c5fe3da55fc969.exe") Found reference to API (Indicator: "GetFileVersionInfoSizeA"; File: "9ce01fdabd737268e2c5fe3da55fc969.exe") Found reference to API (Indicator: "VerQueryValueA"; File: "9ce01fdabd737268e2c5fe3da55fc969.exe") Found reference to API (Indicator: "GetFileVersionInfoA"; File: "9ce01fdabd737268e2c5fe3da55fc969.exe") Found reference to API (Indicator: "Sleep"; File: "9ce01fdabd737268e2c5fe3da55fc969.exe") Found reference to API (Indicator: "GetStartupInfoW"; File: "9ce01fdabd737268e2c5fe3da55fc969.exe") Found reference to API (Indicator: "UnhandledExceptionFilter"; File: "9ce01fdabd737268e2c5fe3da55fc969.exe") Found reference to API (Indicator: "SetUnhandledExceptionFilter"; File: "9ce01fdabd737268e2c5fe3da55fc969.exe") Found reference to API (Indicator: "TerminateProcess"; File: "9ce01fdabd737268e2c5fe3da55fc969.exe") Found reference to API (Indicator: "QueryPerformanceCounter"; File: "9ce01fdabd737268e2c5fe3da55fc969.exe") Found reference to API (Indicator: "GetCurrentProcessId"; File: "9ce01fdabd737268e2c5fe3da55fc969.exe") Found reference to API (Indicator: "GetCurrentThreadId"; File: "9ce01fdabd737268e2c5fe3da55fc969.exe") Found reference to API (Indicator: "GetSystemTimeAsFileTime"; File: "9ce01fdabd737268e2c5fe3da55fc969.exe") Found reference to API (Indicator: "GetTickCount"; File: "9ce01fdabd737268e2c5fe3da55fc969.exe") Found reference to API (Indicator: "EnumResourceLanguagesA"; File: "9ce01fdabd737268e2c5fe3da55fc969.exe") Found reference to API (Indicator: "GetDiskFreeSpaceA"; File: "9ce01fdabd737268e2c5fe3da55fc969.exe") Found reference to API (Indicator: "MulDiv"; File: "9ce01fdabd737268e2c5fe3da55fc969.exe") Found reference to API (Indicator: "GetSystemMetrics"; File: "9ce01fdabd737268e2c5fe3da55fc969.exe") Found reference to API (Indicator: "CryptImportKey"; Source: "00000000-00004708.00000000.67069.00CE0000.00000004.mdmp, 00000000-00004708.00000001.68991.00CE0000.00000004.mdmp, 00000000-00004708.00000002.70911.00CE0000.00000004.mdmp") Found reference to API (Indicator: "GetTokenInformation"; Source: "00000000-00004708.00000000.67069.010BA000.00000002.mdmp") Found reference to API (Indicator: "RegDeleteValueA"; Source: "00000000-00004708.00000000.67069.010BA000.00000002.mdmp") Found reference to API (Indicator: "RegOpenKeyExA"; Source: "00000000-00004708.00000000.67069.010BA000.00000002.mdmp") Found reference to API (Indicator: "RegQueryInfoKeyA"; Source: "00000000-00004708.00000000.67069.010BA000.00000002.mdmp") Found reference to API (Indicator: "FreeSid"; Source: "00000000-00004708.00000000.67069.010BA000.00000002.mdmp") Found reference to API (Indicator: "OpenProcessToken"; Source: "00000000-00004708.00000000.67069.010BA000.00000002.mdmp") Found reference to API (Indicator: "RegSetValueExA"; Source: "00000000-00004708.00000000.67069.010BA000.00000002.mdmp") Found reference to API (Indicator: "RegCreateKeyExA"; Source: "00000000-00004708.00000000.67069.010BA000.00000002.mdmp") Found reference to API (Indicator: "LookupPrivilegeValueA"; Source: "00000000-00004708.00000000.67069.010BA000.00000002.mdmp") Found reference to API (Indicator: "AllocateAndInitializeSid"; Source: "00000000-00004708.00000000.67069.010BA000.00000002.mdmp") Found reference to API (Indicator: "RegQueryValueExA"; Source: "00000000-00004708.00000000.67069.010BA000.00000002.mdmp") Found reference to API (Indicator: "EqualSid"; Source: "00000000-00004708.00000000.67069.010BA000.00000002.mdmp") Found reference to API (Indicator: "RegCloseKey"; Source: "00000000-00004708.00000000.67069.010BA000.00000002.mdmp") Found reference to API (Indicator: "AdjustTokenPrivileges"; Source: "00000000-00004708.00000000.67069.010BA000.00000002.mdmp") Found reference to API (Indicator: "GetShortPathNameA"; Source: "00000000-00004708.00000000.67069.010BA000.00000002.mdmp") Found reference to API (Indicator: "GetModuleFileNameA"; Source: "00000000-00004708.00000000.67069.010BA000.00000002.mdmp") Found reference to API (Indicator: "FindFirstFileA"; Source: "00000000-00004708.00000000.67069.010BA000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcess"; Source: "00000000-00004708.00000000.67069.010BA000.00000002.mdmp") Found reference to API (Indicator: "FindNextFileA"; Source: "00000000-00004708.00000000.67069.010BA000.00000002.mdmp") Found reference to API (Indicator: "ExpandEnvironmentStringsA"; Source: "00000000-00004708.00000000.67069.010BA000.00000002.mdmp") Found reference to API (Indicator: "FindClose"; Source: "00000000-00004708.00000000.67069.010BA000.00000002.mdmp") Found reference to API (Indicator: "LocalAlloc"; Source: "00000000-00004708.00000000.67069.010BA000.00000002.mdmp") Found reference to API (Indicator: "lstrcmpA"; Source: "00000000-00004708.00000000.67069.010BA000.00000002.mdmp") Found reference to API (Indicator: "CompareStringA"; Source: "00000000-00004708.00000000.67069.010BA000.00000002.mdmp") Found reference to API (Indicator: "GetLastError"; Source: "00000000-00004708.00000000.67069.010BA000.00000002.mdmp") Found reference to API (Indicator: "GetFileAttributesA"; Source: "00000000-00004708.00000000.67069.010BA000.00000002.mdmp") Found reference to API (Indicator: "GetSystemDirectoryA"; Source: "00000000-00004708.00000000.67069.010BA000.00000002.mdmp") Found reference to API (Indicator: "LoadLibraryA"; Source: "00000000-00004708.00000000.67069.010BA000.00000002.mdmp") Found reference to API (Indicator: "DeleteFileA"; Source: "00000000-00004708.00000000.67069.010BA000.00000002.mdmp") Found reference to API (Indicator: "GlobalAlloc"; Source: "00000000-00004708.00000000.67069.010BA000.00000002.mdmp") Found reference to API (Indicator: "GlobalFree"; Source: "00000000-00004708.00000000.67069.010BA000.00000002.mdmp") Found reference to API (Indicator: "CloseHandle"; Source: "00000000-00004708.00000000.67069.010BA000.00000002.mdmp") Found reference to API (Indicator: "WritePrivateProfileStringA"; Source: "00000000-00004708.00000000.67069.010BA000.00000002.mdmp") Found reference to API (Indicator: "IsDBCSLeadByte"; Source: "00000000-00004708.00000000.67069.010BA000.00000002.mdmp") Found reference to API (Indicator: "GetWindowsDirectoryA"; Source: "00000000-00004708.00000000.67069.010BA000.00000002.mdmp") Found reference to API (Indicator: "SetFileAttributesA"; Source: "00000000-00004708.00000000.67069.010BA000.00000002.mdmp") Found reference to API (Indicator: "GetProcAddress"; Source: "00000000-00004708.00000000.67069.010BA000.00000002.mdmp") Found reference to API (Indicator: "GlobalLock"; Source: "00000000-00004708.00000000.67069.010BA000.00000002.mdmp") Found reference to API (Indicator: "LocalFree"; Source: "00000000-00004708.00000000.67069.010BA000.00000002.mdmp") Found reference to API (Indicator: "RemoveDirectoryA"; Source: "00000000-00004708.00000000.67069.010BA000.00000002.mdmp") Found reference to API (Indicator: "FreeLibrary"; Source: "00000000-00004708.00000000.67069.010BA000.00000002.mdmp") Found reference to API (Indicator: "CreateDirectoryA"; Source: "00000000-00004708.00000000.67069.010BA000.00000002.mdmp") Found reference to API (Indicator: "GetPrivateProfileIntA"; Source: "00000000-00004708.00000000.67069.010BA000.00000002.mdmp") Found reference to API (Indicator: "GetPrivateProfileStringA"; Source: "00000000-00004708.00000000.67069.010BA000.00000002.mdmp") Found reference to API (Indicator: "GlobalUnlock"; Source: "00000000-00004708.00000000.67069.010BA000.00000002.mdmp") Found reference to API (Indicator: "ReadFile"; Source: "00000000-00004708.00000000.67069.010BA000.00000002.mdmp") Found reference to API (Indicator: "SizeofResource"; Source: "00000000-00004708.00000000.67069.010BA000.00000002.mdmp") Found reference to API (Indicator: "WriteFile"; Source: "00000000-00004708.00000000.67069.010BA000.00000002.mdmp") Found reference to API (Indicator: "GetDriveTypeA"; Source: "00000000-00004708.00000000.67069.010BA000.00000002.mdmp") Found reference to API (Indicator: "LoadLibraryExA"; Source: "00000000-00004708.00000000.67069.010BA000.00000002.mdmp") Found reference to API (Indicator: "SetFileTime"; Source: "00000000-00004708.00000000.67069.010BA000.00000002.mdmp") Found reference to API (Indicator: "SetFilePointer"; Source: "00000000-00004708.00000000.67069.010BA000.00000002.mdmp") Found reference to API (Indicator: "FindResourceA"; Source: "00000000-00004708.00000000.67069.010BA000.00000002.mdmp") Found reference to API (Indicator: "CreateMutexA"; Source: "00000000-00004708.00000000.67069.010BA000.00000002.mdmp") Found reference to API (Indicator: "GetVolumeInformationA"; Source: "00000000-00004708.00000000.67069.010BA000.00000002.mdmp") Found reference to API (Indicator: "WaitForSingleObject"; Source: "00000000-00004708.00000000.67069.010BA000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentDirectoryA"; Source: "00000000-00004708.00000000.67069.010BA000.00000002.mdmp") Found reference to API (Indicator: "FreeResource"; Source: "00000000-00004708.00000000.67069.010BA000.00000002.mdmp") Found reference to API (Indicator: "GetVersion"; Source: "00000000-00004708.00000000.67069.010BA000.00000002.mdmp") Found reference to API (Indicator: "SetCurrentDirectoryA"; Source: "00000000-00004708.00000000.67069.010BA000.00000002.mdmp") Found reference to API (Indicator: "GetTempPathA"; Source: "00000000-00004708.00000000.67069.010BA000.00000002.mdmp") Found reference to API (Indicator: "LocalFileTimeToFileTime"; Source: "00000000-00004708.00000000.67069.010BA000.00000002.mdmp") Found reference to API (Indicator: "CreateFileA"; Source: "00000000-00004708.00000000.67069.010BA000.00000002.mdmp") Found reference to API (Indicator: "SetEvent"; Source: "00000000-00004708.00000000.67069.010BA000.00000002.mdmp") Found reference to API (Indicator: "TerminateThread"; Source: "00000000-00004708.00000000.67069.010BA000.00000002.mdmp") Found reference to API (Indicator: "GetVersionExA"; Source: "00000000-00004708.00000000.67069.010BA000.00000002.mdmp") Found reference to API (Indicator: "LockResource"; Source: "00000000-00004708.00000000.67069.010BA000.00000002.mdmp") Found reference to API (Indicator: "GetSystemInfo"; Source: "00000000-00004708.00000000.67069.010BA000.00000002.mdmp") Found reference to API (Indicator: "CreateThread"; Source: "00000000-00004708.00000000.67069.010BA000.00000002.mdmp") Found reference to API (Indicator: "ResetEvent"; Source: "00000000-00004708.00000000.67069.010BA000.00000002.mdmp") Found reference to API (Indicator: "LoadResource"; Source: "00000000-00004708.00000000.67069.010BA000.00000002.mdmp") Found reference to API (Indicator: "ExitProcess"; Source: "00000000-00004708.00000000.67069.010BA000.00000002.mdmp") Found reference to API (Indicator: "GetModuleHandleW"; Source: "00000000-00004708.00000000.67069.010BA000.00000002.mdmp") Found reference to API (Indicator: "CreateProcessA"; Source: "00000000-00004708.00000000.67069.010BA000.00000002.mdmp") Found reference to API (Indicator: "FormatMessageA"; Source: "00000000-00004708.00000000.67069.010BA000.00000002.mdmp") Found reference to API (Indicator: "GetTempFileNameA"; Source: "00000000-00004708.00000000.67069.010BA000.00000002.mdmp") Found reference to API (Indicator: "DosDateTimeToFileTime"; Source: "00000000-00004708.00000000.67069.010BA000.00000002.mdmp") Found reference to API (Indicator: "CreateEventA"; Source: "00000000-00004708.00000000.67069.010BA000.00000002.mdmp") Found reference to API (Indicator: "GetExitCodeProcess"; Source: "00000000-00004708.00000000.67069.010BA000.00000002.mdmp") Found reference to API (Indicator: "GetDeviceCaps"; Source: "00000000-00004708.00000000.67069.010BA000.00000002.mdmp") Found reference to API (Indicator: "GetDesktopWindow"; Source: "00000000-00004708.00000000.67069.010BA000.00000002.mdmp") Found reference to API (Indicator: "CharUpperA"; Source: "00000000-00004708.00000000.67069.010BA000.00000002.mdmp") Found reference to API (Indicator: "ExitWindowsEx"; Source: "00000000-00004708.00000000.67069.010BA000.00000002.mdmp") Found reference to API (Indicator: "MessageBeep"; Source: "00000000-00004708.00000000.67069.010BA000.00000002.mdmp") Found reference to API (Indicator: "CharPrevA"; Source: "00000000-00004708.00000000.67069.010BA000.00000002.mdmp") Found reference to API (Indicator: "LoadStringA"; Source: "00000000-00004708.00000000.67069.010BA000.00000002.mdmp") Found reference to API (Indicator: "CharNextA"; Source: "00000000-00004708.00000000.67069.010BA000.00000002.mdmp") Found reference to API (Indicator: "EnableWindow"; Source: "00000000-00004708.00000000.67069.010BA000.00000002.mdmp") Found reference to API (Indicator: "ReleaseDC"; Source: "00000000-00004708.00000000.67069.010BA000.00000002.mdmp") Found reference to API (Indicator: "SetForegroundWindow"; Source: "00000000-00004708.00000000.67069.010BA000.00000002.mdmp") Found reference to API (Indicator: "PeekMessageA"; Source: "00000000-00004708.00000000.67069.010BA000.00000002.mdmp") Found reference to API (Indicator: "SendMessageA"; Source: "00000000-00004708.00000000.67069.010BA000.00000002.mdmp") Found reference to API (Indicator: "MessageBoxA"; Source: "00000000-00004708.00000000.67069.010BA000.00000002.mdmp") Found reference to API (Indicator: "SetWindowTextA"; Source: "00000000-00004708.00000000.67069.010BA000.00000002.mdmp") Found reference to API (Indicator: "GetWindowLongA"; Source: "00000000-00004708.00000000.67069.010BA000.00000002.mdmp") Found reference to API (Indicator: "CallWindowProcA"; Source: "00000000-00004708.00000000.67069.010BA000.00000002.mdmp") Found reference to API (Indicator: "SetWindowLongA"; Source: "00000000-00004708.00000000.67069.010BA000.00000002.mdmp") Found reference to API (Indicator: "ShowWindow"; Source: "00000000-00004708.00000000.67069.010BA000.00000002.mdmp") Found reference to API (Indicator: "MsgWaitForMultipleObjects"; Source: "00000000-00004708.00000000.67069.010BA000.00000002.mdmp") Found reference to API (Indicator: "SetWindowPos"; Source: "00000000-00004708.00000000.67069.010BA000.00000002.mdmp") Found reference to API (Indicator: "GetDC"; Source: "00000000-00004708.00000000.67069.010BA000.00000002.mdmp") Found reference to API (Indicator: "GetWindowRect"; Source: "00000000-00004708.00000000.67069.010BA000.00000002.mdmp") Found reference to API (Indicator: "DispatchMessageA"; Source: "00000000-00004708.00000000.67069.010BA000.00000002.mdmp") Found reference to API (Indicator: "GetFileVersionInfoSizeA"; Source: "00000000-00004708.00000000.67069.010BA000.00000002.mdmp") Found reference to API (Indicator: "VerQueryValueA"; Source: "00000000-00004708.00000000.67069.010BA000.00000002.mdmp") Found reference to API (Indicator: "GetFileVersionInfoA"; Source: "00000000-00004708.00000000.67069.010BA000.00000002.mdmp") Found reference to API (Indicator: "Sleep"; Source: "00000000-00004708.00000000.67069.010BA000.00000002.mdmp") Found reference to API (Indicator: "GetStartupInfoW"; Source: "00000000-00004708.00000000.67069.010BA000.00000002.mdmp") Found reference to API (Indicator: "UnhandledExceptionFilter"; Source: "00000000-00004708.00000000.67069.010BA000.00000002.mdmp") Found reference to API (Indicator: "SetUnhandledExceptionFilter"; Source: "00000000-00004708.00000000.67069.010BA000.00000002.mdmp") Found reference to API (Indicator: "TerminateProcess"; Source: "00000000-00004708.00000000.67069.010BA000.00000002.mdmp") Found reference to API (Indicator: "QueryPerformanceCounter"; Source: "00000000-00004708.00000000.67069.010BA000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcessId"; Source: "00000000-00004708.00000000.67069.010BA000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentThreadId"; Source: "00000000-00004708.00000000.67069.010BA000.00000002.mdmp") Found reference to API (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00004708.00000000.67069.010BA000.00000002.mdmp") Found reference to API (Indicator: "GetTickCount"; Source: "00000000-00004708.00000000.67069.010BA000.00000002.mdmp") Found reference to API (Indicator: "EnumResourceLanguagesA"; Source: "00000000-00004708.00000000.67069.010BA000.00000002.mdmp") Found reference to API (Indicator: "GetDiskFreeSpaceA"; Source: "00000000-00004708.00000000.67069.010BA000.00000002.mdmp") Found reference to API (Indicator: "MulDiv"; Source: "00000000-00004708.00000000.67069.010BA000.00000002.mdmp") Found reference to API (Indicator: "GetSystemMetrics"; Source: "00000000-00004708.00000000.67069.010BA000.00000002.mdmp") Found reference to API (Indicator: "CheckTokenMembership"; Source: "00000000-00004708.00000002.70911.010B1000.00000020.mdmp") Found reference to API (Indicator: "HeapSetInformation"; Source: "00000000-00004708.00000002.70911.010B1000.00000020.mdmp") Found reference to API (Indicator: "DecryptFileA"; Source: "00000000-00004708.00000002.70911.010B1000.00000020.mdmp") Found reference to API (Indicator: "CheckTokenMembership"; Source: "00000000-00006492.00000000.67113.00981000.00000020.mdmp") Found reference to API (Indicator: "HeapSetInformation"; Source: "00000000-00006492.00000000.67113.00981000.00000020.mdmp") Found reference to API (Indicator: "DecryptFileA"; Source: "00000000-00006492.00000000.67113.00981000.00000020.mdmp") Found reference to API (Indicator: "GetTokenInformation"; Source: "00000000-00006492.00000000.67113.0098A000.00000002.mdmp") Found reference to API (Indicator: "RegDeleteValueA"; Source: "00000000-00006492.00000000.67113.0098A000.00000002.mdmp") Found reference to API (Indicator: "RegOpenKeyExA"; Source: "00000000-00006492.00000000.67113.0098A000.00000002.mdmp") Found reference to API (Indicator: "RegQueryInfoKeyA"; Source: "00000000-00006492.00000000.67113.0098A000.00000002.mdmp") Found reference to API (Indicator: "FreeSid"; Source: "00000000-00006492.00000000.67113.0098A000.00000002.mdmp") Found reference to API (Indicator: "OpenProcessToken"; Source: "00000000-00006492.00000000.67113.0098A000.00000002.mdmp") Found reference to API (Indicator: "RegSetValueExA"; Source: "00000000-00006492.00000000.67113.0098A000.00000002.mdmp") Found reference to API (Indicator: "RegCreateKeyExA"; Source: "00000000-00006492.00000000.67113.0098A000.00000002.mdmp") Found reference to API (Indicator: "LookupPrivilegeValueA"; Source: "00000000-00006492.00000000.67113.0098A000.00000002.mdmp") Found reference to API (Indicator: "AllocateAndInitializeSid"; Source: "00000000-00006492.00000000.67113.0098A000.00000002.mdmp") Found reference to API (Indicator: "RegQueryValueExA"; Source: "00000000-00006492.00000000.67113.0098A000.00000002.mdmp") Found reference to API (Indicator: "EqualSid"; Source: "00000000-00006492.00000000.67113.0098A000.00000002.mdmp") Found reference to API (Indicator: "RegCloseKey"; Source: "00000000-00006492.00000000.67113.0098A000.00000002.mdmp") Found reference to API (Indicator: "AdjustTokenPrivileges"; Source: "00000000-00006492.00000000.67113.0098A000.00000002.mdmp") Found reference to API (Indicator: "GetShortPathNameA"; Source: "00000000-00006492.00000000.67113.0098A000.00000002.mdmp") Found reference to API (Indicator: "GetModuleFileNameA"; Source: "00000000-00006492.00000000.67113.0098A000.00000002.mdmp") Found reference to API (Indicator: "FindFirstFileA"; Source: "00000000-00006492.00000000.67113.0098A000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcess"; Source: "00000000-00006492.00000000.67113.0098A000.00000002.mdmp") Found reference to API (Indicator: "FindNextFileA"; Source: "00000000-00006492.00000000.67113.0098A000.00000002.mdmp") Found reference to API (Indicator: "ExpandEnvironmentStringsA"; Source: "00000000-00006492.00000000.67113.0098A000.00000002.mdmp") Found reference to API (Indicator: "FindClose"; Source: "00000000-00006492.00000000.67113.0098A000.00000002.mdmp") Found reference to API (Indicator: "LocalAlloc"; Source: "00000000-00006492.00000000.67113.0098A000.00000002.mdmp") Found reference to API (Indicator: "lstrcmpA"; Source: "00000000-00006492.00000000.67113.0098A000.00000002.mdmp") Found reference to API (Indicator: "CompareStringA"; Source: "00000000-00006492.00000000.67113.0098A000.00000002.mdmp") Found reference to API (Indicator: "GetLastError"; Source: "00000000-00006492.00000000.67113.0098A000.00000002.mdmp") Found reference to API (Indicator: "GetFileAttributesA"; Source: "00000000-00006492.00000000.67113.0098A000.00000002.mdmp") Found reference to API (Indicator: "GetSystemDirectoryA"; Source: "00000000-00006492.00000000.67113.0098A000.00000002.mdmp") Found reference to API (Indicator: "LoadLibraryA"; Source: "00000000-00006492.00000000.67113.0098A000.00000002.mdmp") Found reference to API (Indicator: "DeleteFileA"; Source: "00000000-00006492.00000000.67113.0098A000.00000002.mdmp") Found reference to API (Indicator: "GlobalAlloc"; Source: "00000000-00006492.00000000.67113.0098A000.00000002.mdmp") Found reference to API (Indicator: "GlobalFree"; Source: "00000000-00006492.00000000.67113.0098A000.00000002.mdmp") Found reference to API (Indicator: "CloseHandle"; Source: "00000000-00006492.00000000.67113.0098A000.00000002.mdmp") Found reference to API (Indicator: "WritePrivateProfileStringA"; Source: "00000000-00006492.00000000.67113.0098A000.00000002.mdmp") Found reference to API (Indicator: "IsDBCSLeadByte"; Source: "00000000-00006492.00000000.67113.0098A000.00000002.mdmp") Found reference to API (Indicator: "GetWindowsDirectoryA"; Source: "00000000-00006492.00000000.67113.0098A000.00000002.mdmp") Found reference to API (Indicator: "SetFileAttributesA"; Source: "00000000-00006492.00000000.67113.0098A000.00000002.mdmp") Found reference to API (Indicator: "GetProcAddress"; Source: "00000000-00006492.00000000.67113.0098A000.00000002.mdmp") Found reference to API (Indicator: "GlobalLock"; Source: "00000000-00006492.00000000.67113.0098A000.00000002.mdmp") Found reference to API (Indicator: "LocalFree"; Source: "00000000-00006492.00000000.67113.0098A000.00000002.mdmp") Found reference to API (Indicator: "RemoveDirectoryA"; Source: "00000000-00006492.00000000.67113.0098A000.00000002.mdmp") Found reference to API (Indicator: "FreeLibrary"; Source: "00000000-00006492.00000000.67113.0098A000.00000002.mdmp") Found reference to API (Indicator: "CreateDirectoryA"; Source: "00000000-00006492.00000000.67113.0098A000.00000002.mdmp") Found reference to API (Indicator: "GetPrivateProfileIntA"; Source: "00000000-00006492.00000000.67113.0098A000.00000002.mdmp") Found reference to API (Indicator: "GetPrivateProfileStringA"; Source: "00000000-00006492.00000000.67113.0098A000.00000002.mdmp") Found reference to API (Indicator: "GlobalUnlock"; Source: "00000000-00006492.00000000.67113.0098A000.00000002.mdmp") Found reference to API (Indicator: "ReadFile"; Source: "00000000-00006492.00000000.67113.0098A000.00000002.mdmp") Found reference to API (Indicator: "SizeofResource"; Source: "00000000-00006492.00000000.67113.0098A000.00000002.mdmp") Found reference to API (Indicator: "WriteFile"; Source: "00000000-00006492.00000000.67113.0098A000.00000002.mdmp") Found reference to API (Indicator: "GetDriveTypeA"; Source: "00000000-00006492.00000000.67113.0098A000.00000002.mdmp") Found reference to API (Indicator: "LoadLibraryExA"; Source: "00000000-00006492.00000000.67113.0098A000.00000002.mdmp") Found reference to API (Indicator: "SetFileTime"; Source: "00000000-00006492.00000000.67113.0098A000.00000002.mdmp") Found reference to API (Indicator: "SetFilePointer"; Source: "00000000-00006492.00000000.67113.0098A000.00000002.mdmp") Found reference to API (Indicator: "FindResourceA"; Source: "00000000-00006492.00000000.67113.0098A000.00000002.mdmp") Found reference to API (Indicator: "CreateMutexA"; Source: "00000000-00006492.00000000.67113.0098A000.00000002.mdmp") Found reference to API (Indicator: "GetVolumeInformationA"; Source: "00000000-00006492.00000000.67113.0098A000.00000002.mdmp") Found reference to API (Indicator: "WaitForSingleObject"; Source: "00000000-00006492.00000000.67113.0098A000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentDirectoryA"; Source: "00000000-00006492.00000000.67113.0098A000.00000002.mdmp") Found reference to API (Indicator: "FreeResource"; Source: "00000000-00006492.00000000.67113.0098A000.00000002.mdmp") Found reference to API (Indicator: "GetVersion"; Source: "00000000-00006492.00000000.67113.0098A000.00000002.mdmp") Found reference to API (Indicator: "SetCurrentDirectoryA"; Source: "00000000-00006492.00000000.67113.0098A000.00000002.mdmp") Found reference to API (Indicator: "GetTempPathA"; Source: "00000000-00006492.00000000.67113.0098A000.00000002.mdmp") Found reference to API (Indicator: "LocalFileTimeToFileTime"; Source: "00000000-00006492.00000000.67113.0098A000.00000002.mdmp") Found reference to API (Indicator: "CreateFileA"; Source: "00000000-00006492.00000000.67113.0098A000.00000002.mdmp") Found reference to API (Indicator: "SetEvent"; Source: "00000000-00006492.00000000.67113.0098A000.00000002.mdmp") Found reference to API (Indicator: "TerminateThread"; Source: "00000000-00006492.00000000.67113.0098A000.00000002.mdmp") Found reference to API (Indicator: "GetVersionExA"; Source: "00000000-00006492.00000000.67113.0098A000.00000002.mdmp") Found reference to API (Indicator: "LockResource"; Source: "00000000-00006492.00000000.67113.0098A000.00000002.mdmp") Found reference to API (Indicator: "GetSystemInfo"; Source: "00000000-00006492.00000000.67113.0098A000.00000002.mdmp") Found reference to API (Indicator: "CreateThread"; Source: "00000000-00006492.00000000.67113.0098A000.00000002.mdmp") Found reference to API (Indicator: "ResetEvent"; Source: "00000000-00006492.00000000.67113.0098A000.00000002.mdmp") Found reference to API (Indicator: "LoadResource"; Source: "00000000-00006492.00000000.67113.0098A000.00000002.mdmp") Found reference to API (Indicator: "ExitProcess"; Source: "00000000-00006492.00000000.67113.0098A000.00000002.mdmp") Found reference to API (Indicator: "GetModuleHandleW"; Source: "00000000-00006492.00000000.67113.0098A000.00000002.mdmp") Found reference to API (Indicator: "CreateProcessA"; Source: "00000000-00006492.00000000.67113.0098A000.00000002.mdmp") Found reference to API (Indicator: "FormatMessageA"; Source: "00000000-00006492.00000000.67113.0098A000.00000002.mdmp") Found reference to API (Indicator: "GetTempFileNameA"; Source: "00000000-00006492.00000000.67113.0098A000.00000002.mdmp") Found reference to API (Indicator: "DosDateTimeToFileTime"; Source: "00000000-00006492.00000000.67113.0098A000.00000002.mdmp") Found reference to API (Indicator: "CreateEventA"; Source: "00000000-00006492.00000000.67113.0098A000.00000002.mdmp") Found reference to API (Indicator: "GetExitCodeProcess"; Source: "00000000-00006492.00000000.67113.0098A000.00000002.mdmp") Found reference to API (Indicator: "GetDeviceCaps"; Source: "00000000-00006492.00000000.67113.0098A000.00000002.mdmp") Found reference to API (Indicator: "GetDesktopWindow"; Source: "00000000-00006492.00000000.67113.0098A000.00000002.mdmp") Found reference to API (Indicator: "CharUpperA"; Source: "00000000-00006492.00000000.67113.0098A000.00000002.mdmp") Found reference to API (Indicator: "ExitWindowsEx"; Source: "00000000-00006492.00000000.67113.0098A000.00000002.mdmp") Found reference to API (Indicator: "MessageBeep"; Source: "00000000-00006492.00000000.67113.0098A000.00000002.mdmp") Found reference to API (Indicator: "CharPrevA"; Source: "00000000-00006492.00000000.67113.0098A000.00000002.mdmp") Found reference to API (Indicator: "LoadStringA"; Source: "00000000-00006492.00000000.67113.0098A000.00000002.mdmp") Found reference to API (Indicator: "CharNextA"; Source: "00000000-00006492.00000000.67113.0098A000.00000002.mdmp") Found reference to API (Indicator: "EnableWindow"; Source: "00000000-00006492.00000000.67113.0098A000.00000002.mdmp") Found reference to API (Indicator: "ReleaseDC"; Source: "00000000-00006492.00000000.67113.0098A000.00000002.mdmp") Found reference to API (Indicator: "SetForegroundWindow"; Source: "00000000-00006492.00000000.67113.0098A000.00000002.mdmp") Found reference to API (Indicator: "PeekMessageA"; Source: "00000000-00006492.00000000.67113.0098A000.00000002.mdmp") Found reference to API (Indicator: "SendMessageA"; Source: "00000000-00006492.00000000.67113.0098A000.00000002.mdmp") Found reference to API (Indicator: "MessageBoxA"; Source: "00000000-00006492.00000000.67113.0098A000.00000002.mdmp") Found reference to API (Indicator: "SetWindowTextA"; Source: "00000000-00006492.00000000.67113.0098A000.00000002.mdmp") Found reference to API (Indicator: "GetWindowLongA"; Source: "00000000-00006492.00000000.67113.0098A000.00000002.mdmp") Found reference to API (Indicator: "CallWindowProcA"; Source: "00000000-00006492.00000000.67113.0098A000.00000002.mdmp") Found reference to API (Indicator: "SetWindowLongA"; Source: "00000000-00006492.00000000.67113.0098A000.00000002.mdmp") Found reference to API (Indicator: "ShowWindow"; Source: "00000000-00006492.00000000.67113.0098A000.00000002.mdmp") Found reference to API (Indicator: "MsgWaitForMultipleObjects"; Source: "00000000-00006492.00000000.67113.0098A000.00000002.mdmp") Found reference to API (Indicator: "SetWindowPos"; Source: "00000000-00006492.00000000.67113.0098A000.00000002.mdmp") Found reference to API (Indicator: "GetDC"; Source: "00000000-00006492.00000000.67113.0098A000.00000002.mdmp") Found reference to API (Indicator: "GetWindowRect"; Source: "00000000-00006492.00000000.67113.0098A000.00000002.mdmp") Found reference to API (Indicator: "DispatchMessageA"; Source: "00000000-00006492.00000000.67113.0098A000.00000002.mdmp") Found reference to API (Indicator: "GetFileVersionInfoSizeA"; Source: "00000000-00006492.00000000.67113.0098A000.00000002.mdmp") Found reference to API (Indicator: "VerQueryValueA"; Source: "00000000-00006492.00000000.67113.0098A000.00000002.mdmp") Found reference to API (Indicator: "GetFileVersionInfoA"; Source: "00000000-00006492.00000000.67113.0098A000.00000002.mdmp") Found reference to API (Indicator: "Sleep"; Source: "00000000-00006492.00000000.67113.0098A000.00000002.mdmp") Found reference to API (Indicator: "GetStartupInfoW"; Source: "00000000-00006492.00000000.67113.0098A000.00000002.mdmp") Found reference to API (Indicator: "UnhandledExceptionFilter"; Source: "00000000-00006492.00000000.67113.0098A000.00000002.mdmp") Found reference to API (Indicator: "SetUnhandledExceptionFilter"; Source: "00000000-00006492.00000000.67113.0098A000.00000002.mdmp") Found reference to API (Indicator: "TerminateProcess"; Source: "00000000-00006492.00000000.67113.0098A000.00000002.mdmp") Found reference to API (Indicator: "QueryPerformanceCounter"; Source: "00000000-00006492.00000000.67113.0098A000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcessId"; Source: "00000000-00006492.00000000.67113.0098A000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentThreadId"; Source: "00000000-00006492.00000000.67113.0098A000.00000002.mdmp") Found reference to API (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00006492.00000000.67113.0098A000.00000002.mdmp") Found reference to API (Indicator: "GetTickCount"; Source: "00000000-00006492.00000000.67113.0098A000.00000002.mdmp") Found reference to API (Indicator: "EnumResourceLanguagesA"; Source: "00000000-00006492.00000000.67113.0098A000.00000002.mdmp") Found reference to API (Indicator: "GetDiskFreeSpaceA"; Source: "00000000-00006492.00000000.67113.0098A000.00000002.mdmp") Found reference to API (Indicator: "MulDiv"; Source: "00000000-00006492.00000000.67113.0098A000.00000002.mdmp") Found reference to API (Indicator: "GetSystemMetrics"; Source: "00000000-00006492.00000000.67113.0098A000.00000002.mdmp") Found reference to API (Indicator: "CryptDecrypt"; Source: "00000000-00006816.00000000.67028.032E0000.00000004.mdmp, 00000000-00006816.00000002.70867.032E0000.00000004.mdmp") Found reference to API (Indicator: "CheckTokenMembership"; Source: "00000000-00006816.00000001.68947.003C1000.00000020.mdmp") Found reference to API (Indicator: "HeapSetInformation"; Source: "00000000-00006816.00000001.68947.003C1000.00000020.mdmp") Found reference to API (Indicator: "DecryptFileA"; Source: "00000000-00006816.00000001.68947.003C1000.00000020.mdmp") Found reference to API (Indicator: "GetTokenInformation"; Source: "00000000-00006816.00000002.70867.003CA000.00000002.mdmp") Found reference to API (Indicator: "RegDeleteValueA"; Source: "00000000-00006816.00000002.70867.003CA000.00000002.mdmp") Found reference to API (Indicator: "RegOpenKeyExA"; Source: "00000000-00006816.00000002.70867.003CA000.00000002.mdmp") Found reference to API (Indicator: "RegQueryInfoKeyA"; Source: "00000000-00006816.00000002.70867.003CA000.00000002.mdmp") Found reference to API (Indicator: "FreeSid"; Source: "00000000-00006816.00000002.70867.003CA000.00000002.mdmp") Found reference to API (Indicator: "OpenProcessToken"; Source: "00000000-00006816.00000002.70867.003CA000.00000002.mdmp") Found reference to API (Indicator: "RegSetValueExA"; Source: "00000000-00006816.00000002.70867.003CA000.00000002.mdmp") Found reference to API (Indicator: "RegCreateKeyExA"; Source: "00000000-00006816.00000002.70867.003CA000.00000002.mdmp") Found reference to API (Indicator: "LookupPrivilegeValueA"; Source: "00000000-00006816.00000002.70867.003CA000.00000002.mdmp") Found reference to API (Indicator: "AllocateAndInitializeSid"; Source: "00000000-00006816.00000002.70867.003CA000.00000002.mdmp") Found reference to API (Indicator: "RegQueryValueExA"; Source: "00000000-00006816.00000002.70867.003CA000.00000002.mdmp") Found reference to API (Indicator: "EqualSid"; Source: "00000000-00006816.00000002.70867.003CA000.00000002.mdmp") Found reference to API (Indicator: "RegCloseKey"; Source: "00000000-00006816.00000002.70867.003CA000.00000002.mdmp") Found reference to API (Indicator: "AdjustTokenPrivileges"; Source: "00000000-00006816.00000002.70867.003CA000.00000002.mdmp") Found reference to API (Indicator: "GetShortPathNameA"; Source: "00000000-00006816.00000002.70867.003CA000.00000002.mdmp") Found reference to API (Indicator: "GetModuleFileNameA"; Source: "00000000-00006816.00000002.70867.003CA000.00000002.mdmp") Found reference to API (Indicator: "FindFirstFileA"; Source: "00000000-00006816.00000002.70867.003CA000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcess"; Source: "00000000-00006816.00000002.70867.003CA000.00000002.mdmp") Found reference to API (Indicator: "FindNextFileA"; Source: "00000000-00006816.00000002.70867.003CA000.00000002.mdmp") Found reference to API (Indicator: "ExpandEnvironmentStringsA"; Source: "00000000-00006816.00000002.70867.003CA000.00000002.mdmp") Found reference to API (Indicator: "FindClose"; Source: "00000000-00006816.00000002.70867.003CA000.00000002.mdmp") Found reference to API (Indicator: "LocalAlloc"; Source: "00000000-00006816.00000002.70867.003CA000.00000002.mdmp") Found reference to API (Indicator: "lstrcmpA"; Source: "00000000-00006816.00000002.70867.003CA000.00000002.mdmp") Found reference to API (Indicator: "CompareStringA"; Source: "00000000-00006816.00000002.70867.003CA000.00000002.mdmp") Found reference to API (Indicator: "GetLastError"; Source: "00000000-00006816.00000002.70867.003CA000.00000002.mdmp") Found reference to API (Indicator: "GetFileAttributesA"; Source: "00000000-00006816.00000002.70867.003CA000.00000002.mdmp") Found reference to API (Indicator: "GetSystemDirectoryA"; Source: "00000000-00006816.00000002.70867.003CA000.00000002.mdmp") Found reference to API (Indicator: "LoadLibraryA"; Source: "00000000-00006816.00000002.70867.003CA000.00000002.mdmp") Found reference to API (Indicator: "DeleteFileA"; Source: "00000000-00006816.00000002.70867.003CA000.00000002.mdmp") Found reference to API (Indicator: "GlobalAlloc"; Source: "00000000-00006816.00000002.70867.003CA000.00000002.mdmp")40:T77e,Found reference to API "SizeofResource" (Indicator: "SizeofResource"; File: "9ce01fdabd737268e2c5fe3da55fc969.exe") Found reference to API "FindResourceA" (Indicator: "FindResource"; File: "9ce01fdabd737268e2c5fe3da55fc969.exe") Found reference to API "FreeResource" (Indicator: "FreeResource"; File: "9ce01fdabd737268e2c5fe3da55fc969.exe") Found reference to API "LockResource" (Indicator: "LockResource"; File: "9ce01fdabd737268e2c5fe3da55fc969.exe") Found reference to API "LoadResource" (Indicator: "LoadResource"; File: "9ce01fdabd737268e2c5fe3da55fc969.exe") Found reference to API "SizeofResource" (Indicator: "SizeofResource"; Source: "00000000-00004708.00000000.67069.010BA000.00000002.mdmp") Found reference to API "FindResourceA" (Indicator: "FindResource"; Source: "00000000-00004708.00000000.67069.010BA000.00000002.mdmp") Found reference to API "FreeResource" (Indicator: "FreeResource"; Source: "00000000-00004708.00000000.67069.010BA000.00000002.mdmp") Found reference to API "LockResource" (Indicator: "LockResource"; Source: "00000000-00004708.00000000.67069.010BA000.00000002.mdmp") Found reference to API "LoadResource" (Indicator: "LoadResource"; Source: "00000000-00004708.00000000.67069.010BA000.00000002.mdmp") Found reference to API "SizeofResource" (Indicator: "SizeofResource"; Source: "00000000-00006492.00000000.67113.0098A000.00000002.mdmp") Found reference to API "FindResourceA" (Indicator: "FindResource"; Source: "00000000-00006492.00000000.67113.0098A000.00000002.mdmp") Found reference to API "FreeResource" (Indicator: "FreeResource"; Source: "00000000-00006492.00000000.67113.0098A000.00000002.mdmp") Found reference to API "LockResource" (Indicator: "LockResource"; Source: "00000000-00006492.00000000.67113.0098A000.00000002.mdmp") Found reference to API "LoadResource" (Indicator: "LoadResource"; Source: "00000000-00006492.00000000.67113.0098A000.00000002.mdmp")41:Te1e,Found reference to API "" (Indicator: "MoveFile"; Source: "00000000-00000632.00000001.70834.02810000.00000004.mdmp, 00000000-00000632.00000002.72753.02810000.00000004.mdmp") Found reference to API "" (Indicator: "MoveFile"; Source: "00000000-00000632.00000001.70834.02810000.00000004.mdmp, 00000000-00000632.00000002.72753.02810000.00000004.mdmp") Found reference to API "" (Indicator: "MoveFile"; Source: "00000000-00000632.00000001.70834.02810000.00000004.mdmp, 00000000-00000632.00000002.72753.02810000.00000004.mdmp") Found reference to API "" (Indicator: "MoveFile"; Source: "00000000-00000632.00000001.70834.02810000.00000004.mdmp, 00000000-00000632.00000002.72753.02810000.00000004.mdmp") Found reference to API "" (Indicator: "MoveFile"; Source: "00000000-00004708.00000000.67069.00CE0000.00000004.mdmp, 00000000-00004708.00000001.68991.00CE0000.00000004.mdmp, 00000000-00004708.00000002.70911.00CE0000.00000004.mdmp") Found reference to API "" (Indicator: "MoveFile"; Source: "00000000-00004708.00000000.67069.00CE0000.00000004.mdmp, 00000000-00004708.00000001.68991.00CE0000.00000004.mdmp, 00000000-00004708.00000002.70911.00CE0000.00000004.mdmp") Found reference to API "" (Indicator: "MoveFile"; Source: "00000000-00004708.00000000.67069.00CE0000.00000004.mdmp, 00000000-00004708.00000001.68991.00CE0000.00000004.mdmp, 00000000-00004708.00000002.70911.00CE0000.00000004.mdmp") Found reference to API "" (Indicator: "MoveFile"; Source: "00000000-00004708.00000000.67069.00CE0000.00000004.mdmp, 00000000-00004708.00000001.68991.00CE0000.00000004.mdmp, 00000000-00004708.00000002.70911.00CE0000.00000004.mdmp") Found reference to API "" (Indicator: "MoveFile"; Source: "00000000-00006492.00000000.67113.03400000.00000004.mdmp") Found reference to API "" (Indicator: "MoveFile"; Source: "00000000-00006492.00000000.67113.03400000.00000004.mdmp") Found reference to API "" (Indicator: "MoveFile"; Source: "00000000-00006492.00000000.67113.03400000.00000004.mdmp") Found reference to API "" (Indicator: "MoveFile"; Source: "00000000-00006492.00000000.67113.03400000.00000004.mdmp") Found reference to API "" (Indicator: "MoveFile"; Source: "00000000-00006816.00000000.67028.032E0000.00000004.mdmp, 00000000-00006816.00000002.70867.032E0000.00000004.mdmp") Found reference to API "" (Indicator: "MoveFile"; Source: "00000000-00006816.00000000.67028.032E0000.00000004.mdmp, 00000000-00006816.00000002.70867.032E0000.00000004.mdmp") Found reference to API "" (Indicator: "MoveFile"; Source: "00000000-00006816.00000000.67028.032E0000.00000004.mdmp, 00000000-00006816.00000002.70867.032E0000.00000004.mdmp") Found reference to API "" (Indicator: "MoveFile"; Source: "00000000-00006816.00000000.67028.032E0000.00000004.mdmp, 00000000-00006816.00000002.70867.032E0000.00000004.mdmp")42:T40c,Found reference to API "OpenProcessToken" (Indicator: "OpenProcess"; File: "9ce01fdabd737268e2c5fe3da55fc969.exe") file/memory contains long string with (Indicator: "OpenProcess"; File: "9ce01fdabd737268e2c5fe3da55fc969.exe") file/memory contains long string with (Indicator: "OpenProcess"; Source: "00000000-00004708.00000000.67069.010BA000.00000002.mdmp") Found reference to API "OpenProcessToken" (Indicator: "OpenProcess"; Source: "00000000-00004708.00000000.67069.010BA000.00000002.mdmp") file/memory contains long string with (Indicator: "OpenProcess"; Source: "00000000-00006492.00000000.67113.0098A000.00000002.mdmp") Found reference to API "OpenProcessToken" (Indicator: "OpenProcess"; Source: "00000000-00006492.00000000.67113.0098A000.00000002.mdmp") file/memory contains long string with (Indicator: "OpenProcess"; Source: "00000000-00006816.00000002.70867.003CA000.00000002.mdmp") Found reference to API "OpenProcessToken" (Indicator: "OpenProcess"; Source: "00000000-00006816.00000002.70867.003CA000.00000002.mdmp")43:T423,"Software\Microsoft\Windows\CurrentVersion\App Paths" in Source: 9ce01fdabd737268e2c5fe3da55fc969.exe "DSystem\CurrentControlSet\Control\Session Manager" in Source: 9ce01fdabd737268e2c5fe3da55fc969.exe "Software\Microsoft\Windows\CurrentVersion\RunOnce" in Source: 9ce01fdabd737268e2c5fe3da55fc969.exe "System\CurrentControlSet\Control\Session Manager\FileRenameOperations" in Source: 9ce01fdabd737268e2c5fe3da55fc969.exe "System\CurrentControlSet\Control\Session Manager" in Source: 28449-17-0040256D "%APPDATA%\Opera Software\*" in Source: 00000000-00007820-00000C27-18657727292 "%LOCALAPPDATA%\BraveSoftware\Brave-Browser\User Data\*" in Source: 00000000-00007820-00000C27-21737939238 "Software\Microsoft\Windows\CurrentVersion\App Paths" in Source: 00000000-00004708.00000002.70911.010B1000.00000020.mdmp "Software\Microsoft\Windows\CurrentVersion\App Paths" in Source: 00000000-00006492.00000000.67113.00981000.00000020.mdmp "Software\Microsoft\Windows\CurrentVersion\App Paths" in Source: 00000000-00006816.00000001.68947.003C1000.00000020.mdmp44:T593,"AppLaunch.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoree.dll" - [base:0; Status:c0000135] "AppLaunch.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\ole32.dll" - [base:0; Status:c0000135] "AppLaunch.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll" - [base:0; Status:c0000135] "AppLaunch.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\VERSION.dll" - [base:0; Status:c0000135] "AppLaunch.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\uxtheme.dll" - [base:0; Status:c0000135] "AppLaunch.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll" - [base:0; Status:c0000135] "AppLaunch.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\PresentationCore\v4.0_4.0.0.0__31bf3856ad364e35\ucrtbase_clr0400.dll" - [base:0; Status:c0000135] "AppLaunch.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\PresentationCore\v4.0_4.0.0.0__31bf3856ad364e35\SHLWAPI.dll" - [base:0; Status:c0000135] "AppLaunch.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll" - [base:0; Status:c0000135]45:T439,"9ce01fdabd737268e2c5fe3da55fc969.exe" has flags like IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "Hl0Uw04.exe" has flags like IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "2OY8588.exe" has flags like IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "JK4zG29.exe" has flags like IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "wH5KL25.exe" has flags like IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "5dr5Sx9.exe" has flags like IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT46:T359d,"9ce01fdabd737268e2c5fe3da55fc969.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 76050000 "9ce01fdabd737268e2c5fe3da55fc969.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 76050000 "9ce01fdabd737268e2c5fe3da55fc969.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 76050000 "9ce01fdabd737268e2c5fe3da55fc969.exe" loaded module "KERNEL32" at base 76950000 "9ce01fdabd737268e2c5fe3da55fc969.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 72df0000 "9ce01fdabd737268e2c5fe3da55fc969.exe" loaded module "KERNEL32.DLL" at base 76950000 "9ce01fdabd737268e2c5fe3da55fc969.exe" loaded module "%WINDIR%\SYSTEM32\ADVAPI32.DLL" at base 75ec0000 "9ce01fdabd737268e2c5fe3da55fc969.exe" loaded module "FECLIENT.DLL" at base 72b20000 "9ce01fdabd737268e2c5fe3da55fc969.exe" loaded module "%WINDIR%\SYSTEM32\ADVPACK.DLL" at base 72af0000 "9ce01fdabd737268e2c5fe3da55fc969.exe" loaded module "NTDLL.DLL" at base 771a0000 "9ce01fdabd737268e2c5fe3da55fc969.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 73b10000 "Hl0Uw04.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 76050000 "Hl0Uw04.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 76050000 "Hl0Uw04.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 76050000 "Hl0Uw04.exe" loaded module "KERNEL32" at base 76950000 "Hl0Uw04.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 72df0000 "Hl0Uw04.exe" loaded module "KERNEL32.DLL" at base 76950000 "Hl0Uw04.exe" loaded module "%WINDIR%\SYSTEM32\ADVAPI32.DLL" at base 75ec0000 "Hl0Uw04.exe" loaded module "FECLIENT.DLL" at base 72b20000 "Hl0Uw04.exe" loaded module "%WINDIR%\SYSTEM32\ADVPACK.DLL" at base 72af0000 "Hl0Uw04.exe" loaded module "NTDLL.DLL" at base 771a0000 "Hl0Uw04.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 73b10000 "JK4zG29.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 76050000 "JK4zG29.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 76050000 "JK4zG29.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 76050000 "JK4zG29.exe" loaded module "KERNEL32" at base 76950000 "JK4zG29.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 72df0000 "JK4zG29.exe" loaded module "KERNEL32.DLL" at base 76950000 "JK4zG29.exe" loaded module "%WINDIR%\SYSTEM32\ADVAPI32.DLL" at base 75ec0000 "JK4zG29.exe" loaded module "FECLIENT.DLL" at base 72b20000 "JK4zG29.exe" loaded module "%WINDIR%\SYSTEM32\ADVPACK.DLL" at base 72af0000 "JK4zG29.exe" loaded module "NTDLL.DLL" at base 771a0000 "JK4zG29.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 73b10000 "wH5KL25.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 76050000 "wH5KL25.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 76050000 "wH5KL25.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 76050000 "wH5KL25.exe" loaded module "KERNEL32" at base 76950000 "wH5KL25.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 72df0000 "wH5KL25.exe" loaded module "KERNEL32.DLL" at base 76950000 "wH5KL25.exe" loaded module "%WINDIR%\SYSTEM32\ADVAPI32.DLL" at base 75ec0000 "wH5KL25.exe" loaded module "FECLIENT.DLL" at base 72b20000 "wH5KL25.exe" loaded module "%WINDIR%\SYSTEM32\ADVPACK.DLL" at base 72af0000 "wH5KL25.exe" loaded module "NTDLL.DLL" at base 771a0000 "wH5KL25.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 73b10000 "1KF13LI4.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 76050000 "1KF13LI4.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 76050000 "1KF13LI4.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 76050000 "1KF13LI4.exe" loaded module "KERNEL32" at base 76950000 "1KF13LI4.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 72df0000 "1KF13LI4.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-0" at base 76050000 "1KF13LI4.exe" loaded module "API-MS-WIN-CORE-STRING-L1-1-0" at base 76050000 "1KF13LI4.exe" loaded module "API-MS-WIN-CORE-DATETIME-L1-1-1" at base 76050000 "1KF13LI4.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-OBSOLETE-L1-2-0" at base 76050000 "1KF13LI4.exe" loaded module "KERNEL32.DLL" at base 76950000 "1KF13LI4.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 73640000 "1KF13LI4.exe" loaded module "%WINDIR%\SYSWOW64\WINDOWS.STORAGE.DLL" at base 73f60000 "1KF13LI4.exe" loaded module "NTDLL.DLL" at base 771a0000 "1KF13LI4.exe" loaded module "%WINDIR%\SYSTEM32\PROPSYS.DLL" at base 73110000 "1KF13LI4.exe" loaded module "%WINDIR%\SYSTEM32\WINDOWS.STORAGE.DLL" at base 73f60000 "1KF13LI4.exe" loaded module "RPCRT4.DLL" at base 75f90000 "1KF13LI4.exe" loaded module "CSCAPI.DLL" at base 72ed0000 "1KF13LI4.exe" loaded module "SSPICLI.DLL" at base 73bc0000 "1KF13LI4.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 73b10000 "1KF13LI4.exe" loaded module "WINHTTP.DLL" at base 728f0000 "1KF13LI4.exe" loaded module "WININET.DLL" at base 72620000 "1KF13LI4.exe" loaded module "%WINDIR%\SYSTEM32\MSWSOCK.DLL" at base 735a0000 "1KF13LI4.exe" loaded module "%WINDIR%\SYSTEM32\ONDEMANDCONNROUTEHELPER.DLL" at base 72600000 "1KF13LI4.exe" loaded module "%WINDIR%\SYSTEM32\RASADHLP.DLL" at base 72580000 "1KF13LI4.exe" loaded module "%WINDIR%\SYSTEM32\FWPUCLNT.DLL" at base 72530000 "1KF13LI4.exe" loaded module "%WINDIR%\SYSWOW64\SCHANNEL.DLL" at base 724c0000 "1KF13LI4.exe" loaded module "MSKEYPROTECT.DLL" at base 724b0000 "1KF13LI4.exe" loaded module "%WINDIR%\SYSTEM32\NCRYPTSSLP.DLL" at base 72440000 "1KF13LI4.exe" loaded module "%WINDIR%\SYSTEM32\BCRYPTPRIMITIVES.DLL" at base 76840000 "1KF13LI4.exe" loaded module "%WINDIR%\SYSTEM32\RSAENH.DLL" at base 72410000 "1KF13LI4.exe" loaded module "WS2_32.DLL" at base 75d50000 "1KF13LI4.exe" loaded module "VAULTCLI.DLL" at base 723b0000 "schtasks.exe" loaded module "%WINDIR%\SYSTEM32\IMM32.DLL" at base 74770000 "schtasks.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 76050000 "schtasks.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 76050000 "schtasks.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 76050000 "schtasks.exe" loaded module "KERNEL32" at base 76950000 "schtasks.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 72df0000 "schtasks.exe" loaded module "KERNEL32.DLL" at base 76950000 "schtasks.exe" loaded module "RPCRT4.DLL" at base 75f90000 "schtasks.exe" loaded module "%WINDIR%\SYSWOW64\TASKSCHD.DLL" at base 73020000 "schtasks.exe" loaded module "SSPICLI.DLL" at base 73bc0000 "2OY8588.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 76050000 "2OY8588.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 76050000 "2OY8588.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 76050000 "2OY8588.exe" loaded module "KERNEL32" at base 76950000 "2OY8588.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 72df0000 "2OY8588.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-0" at base 76050000 "2OY8588.exe" loaded module "API-MS-WIN-CORE-STRING-L1-1-0" at base 76050000 "2OY8588.exe" loaded module "API-MS-WIN-CORE-DATETIME-L1-1-1" at base 76050000 "2OY8588.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-OBSOLETE-L1-2-0" at base 76050000 "2OY8588.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-2" at base 766c0000 "2OY8588.exe" loaded module "NTDLL.DLL" at base 771a0000 "2OY8588.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 73b10000 "AppLaunch.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 76050000 "AppLaunch.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 76050000 "AppLaunch.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 76050000 "AppLaunch.exe" loaded module "KERNEL32" at base 76950000 "AppLaunch.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 72df0000 "AppLaunch.exe" loaded module "ADVAPI32.DLL" at base 75ec0000 "AppLaunch.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\MSCOREEI.DLL" at base 72a30000 "AppLaunch.exe" loaded module "SHLWAPI.DLL" at base 75f40000 "AppLaunch.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-2.DLL" at base 766c0000 "AppLaunch.exe" loaded module "VERSION.DLL" at base 73900000 "AppLaunch.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\CLR.DLL" at base 72280000 "AppLaunch.exe" loaded module "USER32.DLL" at base 76ef0000 "AppLaunch.exe" loaded module "API-MS-WIN-CORE-QUIRKS-L1-1-0.DLL" at base 76050000 "AppLaunch.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\MSCOREE.DLL" at base 0 "AppLaunch.exe" loaded module "MSCOREE.DLL" at base 72ac0000 "AppLaunch.exe" loaded module "%WINDIR%\SYSTEM32\COMBASE.DLL" at base 73d10000 "AppLaunch.exe" loaded module "PSAPI.DLL" at base 76940000 "AppLaunch.exe" loaded module "KERNEL32.DLL" at base 76950000 "AppLaunch.exe" loaded module "RPCRT4.DLL" at base 75f90000 "AppLaunch.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\MSCORLIB\36EACCFDE177C2E7B93B8DBDDE4E012A\MSCORLIB.NI.DLL" at base 702e0000 "AppLaunch.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\OLE32.DLL" at base 0 "AppLaunch.exe" loaded module "OLE32.DLL" at base 75dc0000 "AppLaunch.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 73640000 "AppLaunch.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\API-MS-WIN-CORE-WINRT-L1-1-0.DLL" at base 0 "AppLaunch.exe" loaded module "API-MS-WIN-CORE-WINRT-L1-1-0.DLL" at base 73d10000 "AppLaunch.exe" loaded module "API-MS-WIN-CORE-XSTATE-L2-1-0.DLL" at base 76050000 "AppLaunch.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\CLRJIT.DLL" at base 72120000 "AppLaunch.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\VERSION.DLL" at base 0 "AppLaunch.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM\2C3C912EA8F058F9D04C4650128FEB3F\SYSTEM.NI.DLL" at base 6f880000 "AppLaunch.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM.WINDOWS.FORMS\V4.0_4.0.0.0__B77A5C561934E089\UXTHEME.DLL" at base 0 "AppLaunch.exe" loaded module "UXTHEME.DLL" at base 73640000 "AppLaunch.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.CORE\31FAE3290FAD30C31C98651462D22724\SYSTEM.CORE.NI.DLL" at base 71900000 "AppLaunch.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.CONFIGURATION\96F7EDB07B12303F0EC2595C7F3778C7\SYSTEM.CONFIGURATION.NI.DLL" at base 6f770000 "AppLaunch.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.XML\15AF16D373CF0528CB74FC73D365FDBF\SYSTEM.XML.NI.DLL" at base 6eff0000 "AppLaunch.exe" loaded module "NTDLL.DLL" at base 771a0000 "AppLaunch.exe" loaded module "SHELL32.DLL" at base 74a10000 "AppLaunch.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_32\MSCORLIB\V4.0_4.0.0.0__B77A5C561934E089\BCRYPT.DLL" at base 0 "AppLaunch.exe" loaded module "BCRYPT.DLL" at base 72ee0000 "AppLaunch.exe" loaded module "%WINDIR%\SYSTEM32\RSAENH.DLL" at base 718b0000 "AppLaunch.exe" loaded module "IMM32.DLL" at base 74770000 "AppLaunch.exe" loaded module "COMCTL32.DLL" at base 6ef60000 "AppLaunch.exe" loaded module "GDI32.DLL" at base 77150000 "AppLaunch.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\WINDOWSBASE\1A4CC316FB6D09525321FC0BE44692D8\WINDOWSBASE.NI.DLL" at base 6eb40000 "AppLaunch.exe" loaded module "%WINDIR%\SYSTEM32\BCRYPTPRIMITIVES.DLL" at base 76840000 "AppLaunch.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\PRESENTATIONCORE\468F4E17BE144CA12A73A4297EACC9CC\PRESENTATIONCORE.NI.DLL" at base 6df00000 "AppLaunch.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\PRESENTATIO5AE0F00F#\252CC7B0FAE8CFE083BDC149957C0C54\PRESENTATIONFRAMEWORK.NI.DLL" at base 6cb10000 "AppLaunch.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_32\PRESENTATIONCORE\V4.0_4.0.0.0__31BF3856AD364E35\UCRTBASE_CLR0400.DLL" at base 0 "AppLaunch.exe" loaded module "UCRTBASE_CLR0400.DLL" at base 721b0000 "AppLaunch.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_32\PRESENTATIONCORE\V4.0_4.0.0.0__31BF3856AD364E35\SHLWAPI.DLL" at base 0 "AppLaunch.exe" loaded module "DWRITE.DLL" at base 6c890000 "AppLaunch.exe" loaded module "API-MS-WIN-CORE-STRING-L1-1-0" at base 76050000 "AppLaunch.exe" loaded module "API-MS-WIN-CORE-DATETIME-L1-1-1" at base 76050000 "AppLaunch.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-OBSOLETE-L1-2-0" at base 76050000 "AppLaunch.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\WPF\WPFGFX_V0400.DLL" at base 6c700000 "AppLaunch.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\WPF\PRESENTATIONNATIVE_V0400.DLL" at base 6c5a0000 "AppLaunch.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_32\MSCORLIB\V4.0_4.0.0.0__B77A5C561934E089\SHELL32.DLL" at base 0 "AppLaunch.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.RUNTEB92AA12#\274E43040C8A7A02EF1065DB3283005A\SYSTEM.RUNTIME.SERIALIZATION.NI.DLL" at base 6c2c0000 "AppLaunch.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_32\SYSTEM.TRANSACTIONS\V4.0_4.0.0.0__B77A5C561934E089\SYSTEM.TRANSACTIONS.DLL" at base 71860000 "3KZ60ye.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 76050000 "3KZ60ye.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 76050000 "3KZ60ye.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 76050000 "3KZ60ye.exe" loaded module "KERNEL32" at base 76950000 "3KZ60ye.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 72df0000 "3KZ60ye.exe" loaded module "USER32" at base 76ef0000 "3KZ60ye.exe" loaded module "ADVAPI32" at base 75ec0000 "3KZ60ye.exe" loaded module "SHELL32" at base 74a1000047:T559,"9ce01fdabd737268e2c5fe3da55fc969.exe" loaded module "%WINDIR%\SysWOW64\bcryptprimitives.dll" at 76840000 "9ce01fdabd737268e2c5fe3da55fc969.exe" loaded module "%WINDIR%\SysWOW64\bcrypt.dll" at 72EE0000 "Hl0Uw04.exe" loaded module "%WINDIR%\SysWOW64\bcryptprimitives.dll" at 76840000 "Hl0Uw04.exe" loaded module "%WINDIR%\SysWOW64\bcrypt.dll" at 72EE0000 "JK4zG29.exe" loaded module "%WINDIR%\SysWOW64\bcryptprimitives.dll" at 76840000 "JK4zG29.exe" loaded module "%WINDIR%\SysWOW64\bcrypt.dll" at 72EE0000 "wH5KL25.exe" loaded module "%WINDIR%\SysWOW64\bcryptprimitives.dll" at 76840000 "wH5KL25.exe" loaded module "%WINDIR%\SysWOW64\bcrypt.dll" at 72EE0000 "1KF13LI4.exe" loaded module "%WINDIR%\SysWOW64\bcryptprimitives.dll" at 76840000 "1KF13LI4.exe" loaded module "%WINDIR%\SysWOW64\bcrypt.dll" at 72EE0000 "schtasks.exe" loaded module "%WINDIR%\SysWOW64\bcryptprimitives.dll" at 76840000 "2OY8588.exe" loaded module "%WINDIR%\SysWOW64\bcryptprimitives.dll" at 76840000 "2OY8588.exe" loaded module "%WINDIR%\SysWOW64\bcrypt.dll" at 72EE0000 "AppLaunch.exe" loaded module "%WINDIR%\SysWOW64\bcryptprimitives.dll" at 76840000 "AppLaunch.exe" loaded module "%WINDIR%\SysWOW64\bcrypt.dll" at 72EE0000 "3KZ60ye.exe" loaded module "%WINDIR%\SysWOW64\bcryptprimitives.dll" at 76840000 "3KZ60ye.exe" loaded module "%WINDIR%\SysWOW64\bcrypt.dll" at 72EE000048:Tdc4,"9ce01fdabd737268e2c5fe3da55fc969.exe" was detected as "Microsoft Cabinet" and name: "sfx" "9ce01fdabd737268e2c5fe3da55fc969.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "9ce01fdabd737268e2c5fe3da55fc969.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "9ce01fdabd737268e2c5fe3da55fc969.exe" was detected as "Microsoft Cabinet File" and name: "Archive" "9ce01fdabd737268e2c5fe3da55fc969.exe" was detected as "Microsoft Linker" and name: "Linker" "Hl0Uw04.exe" was detected as "Microsoft Cabinet" and name: "sfx" "Hl0Uw04.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "Hl0Uw04.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "Hl0Uw04.exe" was detected as "Microsoft Cabinet File" and name: "Archive" "Hl0Uw04.exe" was detected as "Microsoft Linker" and name: "Linker" "FANBooster131.exe" was detected as "Microsoft Cabinet" and name: "sfx" "FANBooster131.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "FANBooster131.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "FANBooster131.exe" was detected as "Microsoft Cabinet File" and name: "Archive" "FANBooster131.exe" was detected as "Microsoft Linker" and name: "Linker" "2OY8588.exe" was detected as "Microsoft Cabinet" and name: "sfx" "2OY8588.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "2OY8588.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "2OY8588.exe" was detected as "Microsoft Cabinet File" and name: "Archive" "2OY8588.exe" was detected as "Microsoft Linker" and name: "Linker" "JK4zG29.exe" was detected as "Microsoft Cabinet" and name: "sfx" "JK4zG29.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "JK4zG29.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "JK4zG29.exe" was detected as "Microsoft Cabinet File" and name: "Archive" "JK4zG29.exe" was detected as "Microsoft Linker" and name: "Linker" "wH5KL25.exe" was detected as "Microsoft Cabinet" and name: "sfx" "wH5KL25.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "wH5KL25.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "wH5KL25.exe" was detected as "Microsoft Cabinet File" and name: "Archive" "wH5KL25.exe" was detected as "Microsoft Linker" and name: "Linker" "5dr5Sx9.exe" was detected as "Microsoft Cabinet" and name: "sfx" "5dr5Sx9.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "5dr5Sx9.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "5dr5Sx9.exe" was detected as "Microsoft Cabinet File" and name: "Archive" "5dr5Sx9.exe" was detected as "Microsoft Linker" and name: "Linker" "4lh730XA.exe" was detected as "Microsoft Cabinet" and name: "sfx" "4lh730XA.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "4lh730XA.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "4lh730XA.exe" was detected as "Microsoft Cabinet File" and name: "Archive" "4lh730XA.exe" was detected as "Microsoft Linker" and name: "Linker" "3KZ60ye.exe" was detected as "Microsoft Cabinet" and name: "sfx" "3KZ60ye.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "3KZ60ye.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "3KZ60ye.exe" was detected as "Microsoft Cabinet File" and name: "Archive" "3KZ60ye.exe" was detected as "Microsoft Linker" and name: "Linker"49:T9dd,"UPDATE %Q.%s SET type='table', name=%Q, tbl_name=%Q, rootpage=0, sql=%Q WHERE rowid=#%d" (Source: 50120-2739-004DC570, Indicator: "update %q.%s set type='table', name=%q, tbl_name=%q, rootpage=0, sql=%q where rowid=#%d") "DELETE FROM %Q.%s WHERE tbl_name=%Q and type!='trigger'" (Source: 50120-2662-004CF800, Indicator: "delete from %q.%s where tbl_name=%q and type!='trigger'") "DELETE FROM %Q.sqlite_stat1 WHERE tbl=%Q" (Source: 50120-2662-004CF800, Indicator: "delete from %q.sqlite_stat1 where tbl=%q") "UPDATE %Q.%s SET sql = sqlite_rename_table(sql, %Q), tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqlite_autoindex%%' AND type='index' THEN 'sqlite_autoindex_' || %Q || substr(name,%d+18) ELSE name END WHERE tbl_name=%Q AND (type='" (Source: 50120-2734-004CD2C0, Indicator: "update %q.%s set sql = sqlite_rename_table(sql, %q) tbl_name = %q name = case when type='table' then %q when name like 'sqlite_autoindex%%' and type='index' then 'sqlite_autoindex_' || %q || substr(name,%d+18) else name end where tbl_name=%q and (type='") "UPDATE %Q.%s SET type='%s', name=%Q, tbl_name=%Q, rootpage=#%d, sql=%Q WHERE rowid=#%d" (Source: 50120-2460-004CF4F0, Indicator: "update %q.%s set type='%s', name=%q, tbl_name=%q, rootpage=#%d, sql=%q where rowid=#%d") "DELETE FROM %Q.%s WHERE name=%Q" (Source: 50120-2708-004D0320, Indicator: "delete from %q.%s where name=%q") "DELETE FROM %Q.sqlite_stat1 WHERE idx=%Q" (Source: 50120-2708-004D0320, Indicator: "delete from %q.sqlite_stat1 where idx=%q") "SELECT name, rootpage, sql FROM '%q'.%s WHERE %s" (Source: 50120-2310-004C2E90, Indicator: "select name, rootpage, sql from '%q'.%s where %s") "UPDATE "%w".%s SET sql = substr(sql,1,%d) || ', ' || %Q || substr(sql,%d) WHERE type = 'table' AND name = %Q" (Source: 50120-2736-004CD570, Indicator: "update "%w".%s set sql = substr(sql,1,%d) || ', ' || %q || substr(sql,%d) where type = 'table' and name = %q"), "CREATE TABLE sqlite_master( type text, name text, tbl_name text, rootpage integer, sql text)" (Source: 50120-2265-004D6790, Indicator: "create table sqlite_master( type text, name text, tbl_name text, rootpage integer, sql text)"), "SELECT name rootpage sql FROM '%q'.%s" (Source: 50120-2265-004D6790, Indicator: "select name rootpage sql from '%q'.%s"), "INSERT INTO %Q.%s VALUES('index',%Q,%Q,#%d,%Q);" (Source: 50120-2649-004CFB70, Indicator: "insert into %q.%s values('index',%q,%q,#%d,%q);"), "CREATE TABLE" (Source: 50120-2466-004CF340, Indicator: "create table")4a:T4ba,"1KF13LI4.exe" touched "Shortcut" (Path: "HKCU\WOW6432NODE\CLSID\{00021401-0000-0000-C000-000000000046}") "1KF13LI4.exe" touched "Computer" (Path: "HKCU\WOW6432NODE\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\SHELLFOLDER") "1KF13LI4.exe" touched "Private Profile Object" (Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{75847177-F077-4171-BD2C-A6BB2164FBD0}\INPROCSERVER32") "1KF13LI4.exe" touched "Memory Mapped Cache Mgr" (Path: "HKCU\WOW6432NODE\CLSID\{1F486A52-3CB1-48FD-8F50-B8DC300D9F9D}\TREATAS") "1KF13LI4.exe" touched "UsersFiles" (Path: "HKCU\WOW6432NODE\CLSID\{59031A47-3F72-44A7-89C5-5595FE6B30EE}\SHELLFOLDER") "1KF13LI4.exe" touched "delegate folder that appears in Users Files Folder" (Path: "HKCU\WOW6432NODE\CLSID\{DFFACDC5-679F-4156-8947-C5C76BC0B67F}\INSTANCE") "1KF13LI4.exe" touched "Shell File System Folder" (Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{0E5AAE11-A475-4C5B-AB00-C66DE400274E}\INPROCSERVER32") "1KF13LI4.exe" touched "Known Folder Manager" (Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{4DF0C730-DF9D-4AE3-9153-AA6B82E9795A}\INPROCSERVER32") "schtasks.exe" touched "TaskScheduler class" (Path: "HKCU\WOW6432NODE\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}")4b:T1308,"9ce01fdabd737268e2c5fe3da55fc969.exe" file has an entrypoint instructions - "call 0x407155,jmp 0x406a6a,push 0x58,push 0x4072b8,call 0x407208,xor ebx, ebx,mov dword ptr [ebp - 0x20], ebx,lea eax, [ebp - 0x68],push eax,call dword ptr [0x40a184],mov dword ptr [ebp - 4], ebx,mov eax, dword ptr fs:[0x18],mov esi, dword ptr [eax + 4],mov edi, ebx,mov edx, 0x4088ac,mov ecx, esi,xor eax, eax,lock cmpxchg dword ptr [edx], ecx,test eax, eax,je 0x406abc,cmp eax, esi,jne 0x406aaf,xor esi, esi,inc esi,mov edi, esi,jmp 0x406abf,push 0x3e8,call dword ptr [0x40a188],jmp 0x406a93,xor esi, esi,inc esi," "Hl0Uw04.exe" file has an entrypoint instructions - "call 0x407155,jmp 0x406a6a,push 0x58,push 0x4072b8,call 0x407208,xor ebx, ebx,mov dword ptr [ebp - 0x20], ebx,lea eax, [ebp - 0x68],push eax,call dword ptr [0x40a184],mov dword ptr [ebp - 4], ebx,mov eax, dword ptr fs:[0x18],mov esi, dword ptr [eax + 4],mov edi, ebx,mov edx, 0x4088ac,mov ecx, esi,xor eax, eax,lock cmpxchg dword ptr [edx], ecx,test eax, eax,je 0x406abc,cmp eax, esi,jne 0x406aaf,xor esi, esi,inc esi,mov edi, esi,jmp 0x406abf,push 0x3e8,call dword ptr [0x40a188],jmp 0x406a93,xor esi, esi,inc esi," "FANBooster131.exe" file has an entrypoint instructions - "call 0x4e6d12,jmp 0x4e64df,cmp ecx, dword ptr [0x56d048],jne 0x4e666e,ret ,jmp 0x4e6e45,push ebp,mov ebp, esp,and dword ptr [0x56f3d0], 0,sub esp, 0x24,or dword ptr [0x56d050], 1,push 0xa,call dword ptr [0x5370d8],test eax, eax,je 0x4e6843,and dword ptr [ebp - 0x10], 0,xor eax, eax,push ebx,push esi,push edi,xor ecx, ecx,lea edi, [ebp - 0x24],push ebx,cpuid ,mov esi, ebx,pop ebx,nop ,mov dword ptr [edi], eax,mov dword ptr [edi + 4], esi,mov dword ptr [edi + 8], ecx,xor ecx, ecx,mov dword ptr [edi + 0xc], edx,mov eax, dword ptr [ebp - 0x24],mov edi, dword ptr [ebp - 0x20]," "2OY8588.exe" file has an entrypoint instructions - "jmp 0x415f30,jmp 0x46b9b9,jmp 0x44a550,jmp 0x4364c9,jmp 0x4209c7,jmp 0x4a87f0,jmp 0x436a6a,jmp 0x46c75a,jmp 0x4a377a,jmp 0x41c05f,jmp 0x416984,jmp 0x452ee7,jmp 0x42c224,jmp 0x459d4b,jmp 0x41cc67,jmp 0x419015,jmp 0x492f8b,jmp 0x40de90,jmp 0x466efc,jmp 0x4838f0," "JK4zG29.exe" file has an entrypoint instructions - "call 0x407155,jmp 0x406a6a,push 0x58,push 0x4072b8,call 0x407208,xor ebx, ebx,mov dword ptr [ebp - 0x20], ebx,lea eax, [ebp - 0x68],push eax,call dword ptr [0x40a184],mov dword ptr [ebp - 4], ebx,mov eax, dword ptr fs:[0x18],mov esi, dword ptr [eax + 4],mov edi, ebx,mov edx, 0x4088ac,mov ecx, esi,xor eax, eax,lock cmpxchg dword ptr [edx], ecx,test eax, eax,je 0x406abc,cmp eax, esi,jne 0x406aaf,xor esi, esi,inc esi,mov edi, esi,jmp 0x406abf,push 0x3e8,call dword ptr [0x40a188],jmp 0x406a93,xor esi, esi,inc esi," "wH5KL25.exe" file has an entrypoint instructions - "call 0x407155,jmp 0x406a6a,push 0x58,push 0x4072b8,call 0x407208,xor ebx, ebx,mov dword ptr [ebp - 0x20], ebx,lea eax, [ebp - 0x68],push eax,call dword ptr [0x40a184],mov dword ptr [ebp - 4], ebx,mov eax, dword ptr fs:[0x18],mov esi, dword ptr [eax + 4],mov edi, ebx,mov edx, 0x4088ac,mov ecx, esi,xor eax, eax,lock cmpxchg dword ptr [edx], ecx,test eax, eax,je 0x406abc,cmp eax, esi,jne 0x406aaf,xor esi, esi,inc esi,mov edi, esi,jmp 0x406abf,push 0x3e8,call dword ptr [0x40a188],jmp 0x406a93,xor esi, esi,inc esi," "5dr5Sx9.exe" file has an entrypoint instructions - "jmp 0x415f30,jmp 0x46b9b9,jmp 0x44a550,jmp 0x4364c9,jmp 0x4209c7,jmp 0x4a87f0,jmp 0x436a6a,jmp 0x46c75a,jmp 0x4a377a,jmp 0x41c05f,jmp 0x416984,jmp 0x452ee7,jmp 0x42c224,jmp 0x459d4b,jmp 0x41cc67,jmp 0x419015,jmp 0x492f8b,jmp 0x40de90,jmp 0x466efc,jmp 0x4838f0," "4lh730XA.exe" file has an entrypoint instructions - "call 0x420aea,jmp 0x4203fb,push ebp,mov ebp, esp,push esi,push dword ptr [ebp + 8],mov esi, ecx,call 0x4205e7,mov dword ptr [esi], 0x49fdf0,mov eax, esi,pop esi,pop ebp,ret 4,and dword ptr [ecx + 4], 0,mov eax, ecx,and dword ptr [ecx + 8], 0,mov dword ptr [ecx + 4], 0x49fdf8,mov dword ptr [ecx], 0x49fdf0,ret ,push ebp,mov ebp, esp,push esi,push dword ptr [ebp + 8],mov esi, ecx,call 0x4205e7,mov dword ptr [esi], 0x49fe0c,mov eax, esi,pop esi,pop ebp,ret 4,and dword ptr [ecx + 4], 0,mov eax, ecx,and dword ptr [ecx + 8], 0," "3KZ60ye.exe" file has an entrypoint instructions - "call 0x4032e6,jne 0x4032ed,je 0x4032ed,test eax, 0xeb5b9ba5,or al, byte ptr [ecx + eax*4 - 0x15],out 0x32, al,add byte ptr [eax], al,jmp 0x4032fe,and ch, bl,cmc ,inc esp,and dh, byte ptr [esi + eax + 0x75],add al, 0x94,push ss,xor dword ptr [ecx - 0x3dbbb39], ebx,xor byte ptr [eax], al,add byte ptr [eax], al,sub esp, 4,jne 0x403317,je 0x403317,dec ebp,lahf ,mov edx, dword ptr [esp],add esp, 4,jmp 0x403325,mov byte ptr [ecx], ch,shr bl, 5,test al, 0xeb,stc ,mov byte ptr [eax - 0x4373fa15], ch,shr bl, 1,pop es,add eax, dword ptr fs:[edx],je 0x40333c,jne 0x40333c,jb 0x40337c,and dh, byte ptr [esi],in eax, dx,push dword ptr [eax + 0xa4],jne 0x403349,"4c:T6af,"9ce01fdabd737268e2c5fe3da55fc969.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EMPTY") "9ce01fdabd737268e2c5fe3da55fc969.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "9ce01fdabd737268e2c5fe3da55fc969.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "Hl0Uw04.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EMPTY") "Hl0Uw04.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "Hl0Uw04.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "JK4zG29.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EMPTY") "JK4zG29.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "JK4zG29.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "wH5KL25.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EMPTY") "wH5KL25.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "wH5KL25.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "1KF13LI4.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EMPTY") "1KF13LI4.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "1KF13LI4.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "schtasks.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EMPTY") "schtasks.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "schtasks.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US")4d:Tfff,Observed system executable string:"%WINDIR%\system32\advapi32.dll" [Source: 00000000-00007120-00000C25-50551552] Observed system executable string:"%WINDIR%\system32\advpack.dll" [Source: 00000000-00007120-00000C25-50701268] Observed system executable string:"rundll32.exe %WINDIR%\system32\advpack.dll,DelNodeRunDLL32 "%TEMP%\IXP000.TMP\"" [Source: 00000000-00007120-00000BC1-50730176] Observed system executable string:"rundll32.exe %WINDIR%\system32\advpack.dll,DelNodeRunDLL32 "%TEMP%\IXP001.TMP\"" [Source: 00000000-00006816-00000BC1-51450586] Observed system executable string:"rundll32.exe %WINDIR%\system32\advpack.dll,DelNodeRunDLL32 "%TEMP%\IXP002.TMP\"" [Source: 00000000-00004708-00000BC1-52152566] Observed system executable string:"rundll32.exe %WINDIR%\system32\advpack.dll,DelNodeRunDLL32 "%TEMP%\IXP003.TMP\"" [Source: 00000000-00006492-00000BC1-52882587] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll" [Source: 00000000-00000712-00000C25-80567441] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\clr.dll" [Source: 00000000-00000712-00000C25-80960198] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoree.dll" [Source: 00000000-00000712-00000C25-81107946] Observed system executable string:"%WINDIR%\system32\combase.dll" [Source: 00000000-00000712-00000C25-81207064] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\mscorlib\36eaccfde177c2e7b93b8dbdde4e012a\mscorlib.ni.dll" [Source: 00000000-00000712-00000C25-81418931] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\ole32.dll" [Source: 00000000-00000712-00000C25-81552066] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll" [Source: 00000000-00000712-00000C25-81651717] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\clrjit.dll" [Source: 00000000-00000712-00000C25-81800376] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\VERSION.dll" [Source: 00000000-00000712-00000C25-81978243] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System\2c3c912ea8f058f9d04c4650128feb3f\System.ni.dll" [Source: 00000000-00000712-00000C25-82077878] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\uxtheme.dll" [Source: 00000000-00000712-00000C25-82284179] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Core\31fae3290fad30c31c98651462d22724\System.Core.ni.dll" [Source: 00000000-00000712-00000C25-82470454] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Configuration\96f7edb07b12303f0ec2595c7f3778c7\System.Configuration.ni.dll" [Source: 00000000-00000712-00000C25-82520791] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Xml\15af16d373cf0528cb74fc73d365fdbf\System.Xml.ni.dll" [Source: 00000000-00000712-00000C25-82603485] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll" [Source: 00000000-00000712-00000C25-82850282] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\WindowsBase\1a4cc316fb6d09525321fc0be44692d8\WindowsBase.ni.dll" [Source: 00000000-00000712-00000C25-83418183] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\PresentationCore\468f4e17be144ca12a73a4297eacc9cc\PresentationCore.ni.dll" [Source: 00000000-00000712-00000C25-83499483] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\Presentatio5ae0f00f#\252cc7b0fae8cfe083bdc149957c0c54\PresentationFramework.ni.dll" [Source: 00000000-00000712-00000C25-83586320] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_32\PresentationCore\v4.0_4.0.0.0__31bf3856ad364e35\ucrtbase_clr0400.dll" [Source: 00000000-00000712-00000C25-83712893]4e:T1492,"Hl0Uw04.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP000.TMP\Hl0Uw04.exe]- [targetUID: 00000000-00007120] "FANBooster131.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\FANBooster131\FANBooster131.exe]- [targetUID: 00000000-00007820] "2OY8588.exe" has type "PE32 executable (console) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP003.TMP\2OY8588.exe]- [targetUID: 00000000-00006492] "JK4zG29.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP001.TMP\JK4zG29.exe]- [targetUID: 00000000-00006816] "wH5KL25.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP002.TMP\wH5KL25.exe]- [targetUID: 00000000-00006492] "5dr5Sx9.exe" has type "PE32 executable (console) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP000.TMP\5dr5Sx9.exe]- [targetUID: 00000000-00007120] "4lh730XA.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP001.TMP\4lh730XA.exe]- [targetUID: 00000000-00006816] "3KZ60ye.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP002.TMP\3KZ60ye.exe]- [targetUID: 00000000-00000632] "FANBooster131.lnk" has type "MS Windows shortcut Item id list present Points to a file or directory Has Description string Has Relative path Archive ctime=Wed Nov 29 02:02:02 2023 mtime=Wed Nov 29 02:02:02 2023 atime=Tue Nov 28 23:12:00 2023 length=1539629 window=hide"- Location: [%APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\FANBooster131.lnk]- [targetUID: 00000000-00007820] "D87fZN3R3jFeplaces.sqlite" has type "SQLite 3.x database user version 52 last written using SQLite version 3025001"- Location: [%TEMP%\posterBoxG8qeDmG3xj4Kw\D87fZN3R3jFeplaces.sqlite]- [targetUID: 00000000-00007820] "02zdBXl47cvzcookies.sqlite" has type "SQLite 3.x database user version 9 last written using SQLite version 3020001"- Location: [%TEMP%\posterBoxG8qeDmG3xj4Kw\02zdBXl47cvzcookies.sqlite]- [targetUID: 00000000-00007820] "8ghN89CsjOW1formhistory.sqlite" has type "SQLite 3.x database user version 4 last written using SQLite version 3020001"- Location: [%TEMP%\posterBoxG8qeDmG3xj4Kw\8ghN89CsjOW1formhistory.sqlite]- [targetUID: 00000000-00007820] "IWPfiAXUTJTSHistory" has type "SQLite 3.x database last written using SQLite version 3039003"- Location: [%TEMP%\posterBoxG8qeDmG3xj4Kw\IWPfiAXUTJTSHistory]- [targetUID: 00000000-00007820] "3b6N2Xdh3CYwWeb Data" has type "SQLite 3.x database last written using SQLite version 3039003"- Location: [%TEMP%\posterBoxG8qeDmG3xj4Kw\3b6N2Xdh3CYwWeb Data]- [targetUID: 00000000-00007820] "Ei8DrAmaYu9KLogin Data" has type "SQLite 3.x database last written using SQLite version 3038005"- Location: [%TEMP%\posterBoxG8qeDmG3xj4Kw\Ei8DrAmaYu9KLogin Data]- [targetUID: 00000000-00007820] "oOPEmFmu_xsJCookies" has type "SQLite 3.x database last written using SQLite version 3039003"- Location: [%TEMP%\posterBoxG8qeDmG3xj4Kw\oOPEmFmu_xsJCookies]- [targetUID: 00000000-00007820] "GG8pej_C6o1DJq2duPu9dgvBJlqLpGIZ.zip" has type "Zip archive data at least v2.0 to extract"- Location: [%TEMP%\GG8pej_C6o1DJq2duPu9dgvBJlqLpGIZ.zip]- [targetUID: 00000000-00007820] "Firefox_ywzu7870.default.txt" has type "ASCII text with very long lines with CRLF line terminators"- [targetUID: 00000000-00007820] "Edge_Default.txt" has type "ASCII text with very long lines with CRLF line terminators"- Location: [%TEMP%\grandUIAG8qeDmG3xj4Kw\Cookies\Edge_Default.txt]- [targetUID: 00000000-00007820] "passwords.txt" has type "UTF-8 Unicode text with CRLF line terminators"- Location: [%TEMP%\grandUIAG8qeDmG3xj4Kw\passwords.txt]- [targetUID: 00000000-00007820] "information.txt" has type "ASCII text"- Location: [%TEMP%\grandUIAG8qeDmG3xj4Kw\information.txt]- [targetUID: 00000000-00007820] "Edge_Default.txt" has type "ASCII text"- Location: [%TEMP%\grandUIAG8qeDmG3xj4Kw\Downloads\Edge_Default.txt]- [targetUID: 00000000-00007820] "rise131M9Asphalt.tmp" has type "ASCII text with no line terminators"- Location: [%TEMP%\rise131M9Asphalt.tmp]- [targetUID: 00000000-00007820] "OfficeTrackerNMP131.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%ALLUSERSPROFILE%\OfficeTrackerNMP131\OfficeTrackerNMP131.exe]- [targetUID: 00000000-00007820] "MaxLoonaFest131.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%LOCALAPPDATA%\MaxLoonaFest131\MaxLoonaFest131.exe]- [targetUID: 00000000-00007820] "1KF13LI4.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP003.TMP\1KF13LI4.exe]- [targetUID: 00000000-00006492] "3b6N2Xdh3CYwplaces.sqlite" has type "SQLite 3.x database user version 52 last written using SQLite version 3025001"- Location: [%TEMP%\posterBoxG8qeDmG3xj4Kw\3b6N2Xdh3CYwplaces.sqlite]- [targetUID: 00000000-00007820] "02zdBXl47cvzHistory" has type "SQLite 3.x database last written using SQLite version 3039003"- Location: [%TEMP%\posterBoxG8qeDmG3xj4Kw\02zdBXl47cvzHistory]- [targetUID: 00000000-00007820] "D87fZN3R3jFeWeb Data" has type "SQLite 3.x database last written using SQLite version 3039003"- Location: [%TEMP%\posterBoxG8qeDmG3xj4Kw\D87fZN3R3jFeWeb Data]- [targetUID: 00000000-00007820]4f:T64a,"9ce01fdabd737268e2c5fe3da55fc969.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER\SEGMENT HEAP"; Key: ""; Value: "") "9ce01fdabd737268e2c5fe3da55fc969.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: ""; Value: "") "9ce01fdabd737268e2c5fe3da55fc969.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WOW64\X86"; Key: ""; Value: "") "9ce01fdabd737268e2c5fe3da55fc969.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SAFEBOOT\OPTION"; Key: ""; Value: "") "9ce01fdabd737268e2c5fe3da55fc969.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SRP\GP\DLL"; Key: ""; Value: "") "9ce01fdabd737268e2c5fe3da55fc969.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "9ce01fdabd737268e2c5fe3da55fc969.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "9ce01fdabd737268e2c5fe3da55fc969.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\FILESYSTEM"; Key: ""; Value: "") "9ce01fdabd737268e2c5fe3da55fc969.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS"; Key: ""; Value: "") "9ce01fdabd737268e2c5fe3da55fc969.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\SHELL FOLDERS"; Key: ""; Value: "") "9ce01fdabd737268e2c5fe3da55fc969.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: ""; Value: "")50:T51e,"9ce01fdabd737268e2c5fe3da55fc969.exe" queries basic process information of the "C:\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP\Hl0Uw04.exe" (UID: 7120) "Hl0Uw04.exe" queries basic process information of the "C:\Users\%OSUSER%\AppData\Local\Temp\IXP001.TMP\JK4zG29.exe" (UID: 6816) "JK4zG29.exe" queries basic process information of the "C:\Users\%OSUSER%\AppData\Local\Temp\IXP002.TMP\wH5KL25.exe" (UID: 4708) "JK4zG29.exe" queries basic process information of the "C:\Users\%OSUSER%\AppData\Local\Temp\IXP002.TMP\3KZ60ye.exe" (UID: 4708) "wH5KL25.exe" queries basic process information of the "C:\Users\%OSUSER%\AppData\Local\Temp\IXP003.TMP\1KF13LI4.exe" (UID: 6492) "wH5KL25.exe" queries basic process information of the "C:\Users\%OSUSER%\AppData\Local\Temp\IXP003.TMP\2OY8588.exe" (UID: 6492) "1KF13LI4.exe" queries basic process information of the "C:\Windows\SysWOW64\schtasks.exe" (UID: 7820) "1KF13LI4.exe" queries basic process information of the "C:\Users\%OSUSER%\AppData\Local\Temp\IXP003.TMP\1KF13LI4.exe" (UID: 7820) "2OY8588.exe" queries basic process information of the "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe" (UID: 652) "AppLaunch.exe" queries basic process information of the "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe" (UID: 712)51:Tc75,"9ce01fdabd737268e2c5fe3da55fc969.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "RESOURCEPOLICIES"; Value: "") "9ce01fdabd737268e2c5fe3da55fc969.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WOW64\X86"; Key: "9CE01FDABD737268E2C5FE3DA55FC969.EXE"; Value: "") "9ce01fdabd737268e2c5fe3da55fc969.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WOW64\X86"; Key: ""; Value: "") "9ce01fdabd737268e2c5fe3da55fc969.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED"; Value: "") "9ce01fdabd737268e2c5fe3da55fc969.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\FILESYSTEM"; Key: "LONGPATHSENABLED"; Value: "") "9ce01fdabd737268e2c5fe3da55fc969.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS"; Key: "LOGFLAGS"; Value: "") "9ce01fdabd737268e2c5fe3da55fc969.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS"; Key: "SHOWDEBUGINFO"; Value: "") "9ce01fdabd737268e2c5fe3da55fc969.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\SHELL FOLDERS"; Key: "CACHE"; Value: "") "9ce01fdabd737268e2c5fe3da55fc969.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EMPTY"; Value: "") "9ce01fdabd737268e2c5fe3da55fc969.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LANGUAGE"; Key: "INSTALLLANGUAGEFALLBACK"; Value: "") "9ce01fdabd737268e2c5fe3da55fc969.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\MUI\UILANGUAGES\EN-US"; Key: "TYPE"; Value: "") "9ce01fdabd737268e2c5fe3da55fc969.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\MUI\UILANGUAGES\EN-US"; Key: "ALTERNATECODEPAGE"; Value: "") "9ce01fdabd737268e2c5fe3da55fc969.exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP"; Key: "PREFERREDUILANGUAGES"; Value: "") "9ce01fdabd737268e2c5fe3da55fc969.exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP\MUICACHED"; Key: "MACHINEPREFERREDUILANGUAGES"; Value: "") "9ce01fdabd737268e2c5fe3da55fc969.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: ""; Value: "") "9ce01fdabd737268e2c5fe3da55fc969.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA\FIPSALGORITHMPOLICY"; Key: "ENABLED"; Value: "") "9ce01fdabd737268e2c5fe3da55fc969.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA"; Key: "FIPSALGORITHMPOLICY"; Value: "") "9ce01fdabd737268e2c5fe3da55fc969.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA\FIPSALGORITHMPOLICY"; Key: "MDMENABLED"; Value: "") "9ce01fdabd737268e2c5fe3da55fc969.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE"; Key: "PAGEALLOCATORUSESYSTEMHEAP"; Value: "") "9ce01fdabd737268e2c5fe3da55fc969.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE"; Key: "PAGEALLOCATORSYSTEMHEAPISPRIVATE"; Value: "")52:Tc52,"9ce01fdabd737268e2c5fe3da55fc969.exe" trying to access non-existent file "\Device\HarddiskVolume2\CABINET.DLL" "9ce01fdabd737268e2c5fe3da55fc969.exe" trying to access non-existent file "\Device\HarddiskVolume2\VERSION.DLL" "9ce01fdabd737268e2c5fe3da55fc969.exe" trying to access non-existent file "\Device\HarddiskVolume2\FLTLIB.DLL" "9ce01fdabd737268e2c5fe3da55fc969.exe" trying to access non-existent file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP\HL0UW04.EXE" "9ce01fdabd737268e2c5fe3da55fc969.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP\Hl0Uw04.exe" "9ce01fdabd737268e2c5fe3da55fc969.exe" trying to access non-existent file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP\5DR5SX9.EXE" "9ce01fdabd737268e2c5fe3da55fc969.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP\5dr5Sx9.exe" "Hl0Uw04.exe" trying to access non-existent file "\Device\HarddiskVolume2\Windows\System32\WOW64LOG.DLL" "Hl0Uw04.exe" trying to access non-existent file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP\CABINET.DLL" "Hl0Uw04.exe" trying to access non-existent file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP\VERSION.DLL" "Hl0Uw04.exe" trying to access non-existent file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP\FLTLIB.DLL" "Hl0Uw04.exe" trying to access non-existent file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\IXP001.TMP\JK4ZG29.EXE" "Hl0Uw04.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP001.TMP\JK4zG29.exe" "Hl0Uw04.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP001.TMP\4lh730XA.exe" "JK4zG29.exe" trying to access non-existent file "\Device\HarddiskVolume2\Windows\System32\WOW64LOG.DLL" "JK4zG29.exe" trying to access non-existent file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\IXP001.TMP\CABINET.DLL" "JK4zG29.exe" trying to access non-existent file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\IXP001.TMP\VERSION.DLL" "JK4zG29.exe" trying to access non-existent file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\IXP001.TMP\FLTLIB.DLL" "JK4zG29.exe" trying to access non-existent file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\IXP002.TMP\WH5KL25.EXE" "JK4zG29.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP002.TMP\wH5KL25.exe" "JK4zG29.exe" trying to access non-existent file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\IXP002.TMP\3KZ60YE.EXE" "JK4zG29.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP002.TMP\3KZ60ye.exe" "wH5KL25.exe" trying to access non-existent file "\Device\HarddiskVolume2\Windows\System32\WOW64LOG.DLL" "wH5KL25.exe" trying to access non-existent file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\IXP002.TMP\CABINET.DLL" "wH5KL25.exe" trying to access non-existent file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\IXP002.TMP\VERSION.DLL"53:T649,"9ce01fdabd737268e2c5fe3da55fc969.exe" trying to access non-existent file "\Device\HarddiskVolume2\9CE01FDABD737268E2C5FE3DA55FC969.EXE.LOCAL" "9ce01fdabd737268e2c5fe3da55fc969.exe" trying to access non-existent file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP" "9ce01fdabd737268e2c5fe3da55fc969.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP" "Hl0Uw04.exe" trying to access non-existent file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP\HL0UW04.EXE.LOCAL" "Hl0Uw04.exe" trying to access non-existent file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\IXP001.TMP" "Hl0Uw04.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP001.TMP" "JK4zG29.exe" trying to access non-existent file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\IXP001.TMP\JK4ZG29.EXE.LOCAL" "JK4zG29.exe" trying to access non-existent file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\IXP002.TMP" "JK4zG29.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP002.TMP" "wH5KL25.exe" trying to access non-existent file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\IXP002.TMP\WH5KL25.EXE.LOCAL" "wH5KL25.exe" trying to access non-existent file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\IXP003.TMP" "wH5KL25.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP003.TMP" "1KF13LI4.exe" trying to access non-existent file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Roaming\DISCORD"54:T4ad,Found reference to API "WinHttpConnect" (Indicator: "WinHttpConnect"; Source: "00000000-00007820-00000C26-57873147") Found reference to API "WinHttpQueryHeaders" (Indicator: "WinHttpQueryHeaders"; Source: "00000000-00007820-00000C26-57873250") Found reference to API "WinHttpOpen" (Indicator: "WinHttpOpen"; Source: "00000000-00007820-00000C26-57873344") Found reference to API "WinHttpOpenRequest" (Indicator: "HttpOpenRequest"; Source: "00000000-00007820-00000C26-57873435") Found reference to API "WinHttpOpenRequest" (Indicator: "WinHttpOpen"; Source: "00000000-00007820-00000C26-57873435") Found reference to API "WinHttpOpenRequest" (Indicator: "WinHttpOpenRequest"; Source: "00000000-00007820-00000C26-57873435") Found reference to API "WinHttpSendRequest" (Indicator: "HttpSendRequest"; Source: "00000000-00007820-00000C26-57873679") Found reference to API "WinHttpSendRequest" (Indicator: "WinHttpSendRequest"; Source: "00000000-00007820-00000C26-57873679") Found reference to API "WinHttpReadData" (Indicator: "WinHttpReadData"; Source: "00000000-00007820-00000C26-57873937") Found reference to API "WSASend" (Indicator: "WSASend"; Source: "00000000-00007820-00000C26-59165610")55:Tc25,Heuristic match: "\|PB.NO" Heuristic match: "O?.NI" Heuristic match: "" (Indicator: "GetDC"; Source: "00000000-00000632.00000001.70834.02810000.00000004.mdmp, 00000000-00000632.00000002.72753.02810000.00000004.mdmp") Found reference to API "" (Indicator: "GetDC"; Source: "00000000-00000632.00000001.70834.02810000.00000004.mdmp, 00000000-00000632.00000002.72753.02810000.00000004.mdmp") Found reference to API "" (Indicator: "GetWindowDC"; Source: "00000000-00000632.00000001.70834.02810000.00000004.mdmp, 00000000-00000632.00000002.72753.02810000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00000632.00000001.70834.02810000.00000004.mdmp, 00000000-00000632.00000002.72753.02810000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00000632.00000001.70834.02810000.00000004.mdmp, 00000000-00000632.00000002.72753.02810000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleBitmap"; Source: "00000000-00000632.00000001.70834.02810000.00000004.mdmp, 00000000-00000632.00000002.72753.02810000.00000004.mdmp") Found reference to API "" (Indicator: "BitBlt"; Source: "00000000-00000632.00000001.70834.02810000.00000004.mdmp, 00000000-00000632.00000002.72753.02810000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleDC"; Source: "00000000-00000632.00000001.70834.02810000.00000004.mdmp, 00000000-00000632.00000002.72753.02810000.00000004.mdmp") Found reference to API "GetDesktopWindow" (Indicator: "GetDesktopWindow"; Source: "00000000-00004708.00000000.67069.010BA000.00000002.mdmp") Found reference to API "GetDC" (Indicator: "GetDC"; Source: "00000000-00004708.00000000.67069.010BA000.00000002.mdmp") Found reference to API "GetDesktopWindow" (Indicator: "GetDesktopWindow"; Source: "00000000-00006492.00000000.67113.0098A000.00000002.mdmp") Found reference to API "GetDC" (Indicator: "GetDC"; Source: "00000000-00006492.00000000.67113.0098A000.00000002.mdmp")58:T414,Found reference to API "FindFirstFileA" (Indicator: "FindFirstFile"; File: "9ce01fdabd737268e2c5fe3da55fc969.exe") Found reference to API "FindNextFileA" (Indicator: "FindNextFile"; File: "9ce01fdabd737268e2c5fe3da55fc969.exe") Found reference to API "FindFirstFileA" (Indicator: "FindFirstFile"; Source: "00000000-00004708.00000000.67069.010BA000.00000002.mdmp") Found reference to API "FindNextFileA" (Indicator: "FindNextFile"; Source: "00000000-00004708.00000000.67069.010BA000.00000002.mdmp") Found reference to API "FindFirstFileA" (Indicator: "FindFirstFile"; Source: "00000000-00006492.00000000.67113.0098A000.00000002.mdmp") Found reference to API "FindNextFileA" (Indicator: "FindNextFile"; Source: "00000000-00006492.00000000.67113.0098A000.00000002.mdmp") Found reference to API "FindFirstFileA" (Indicator: "FindFirstFile"; Source: "00000000-00006816.00000002.70867.003CA000.00000002.mdmp") Found reference to API "FindNextFileA" (Indicator: "FindNextFile"; Source: "00000000-00006816.00000002.70867.003CA000.00000002.mdmp")59:T55c,Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; File: "9ce01fdabd737268e2c5fe3da55fc969.exe") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; File: "9ce01fdabd737268e2c5fe3da55fc969.exe") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; File: "9ce01fdabd737268e2c5fe3da55fc969.exe") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; Source: "00000000-00004708.00000000.67069.010BA000.00000002.mdmp") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00004708.00000000.67069.010BA000.00000002.mdmp") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; Source: "00000000-00004708.00000000.67069.010BA000.00000002.mdmp") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; Source: "00000000-00006492.00000000.67113.0098A000.00000002.mdmp") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00006492.00000000.67113.0098A000.00000002.mdmp") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; Source: "00000000-00006492.00000000.67113.0098A000.00000002.mdmp") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; Source: "00000000-00006816.00000002.70867.003CA000.00000002.mdmp")5a:Td6b,Found reference to API "RegOpenKeyExA" (Indicator: "RegOpenKey"; File: "9ce01fdabd737268e2c5fe3da55fc969.exe") Found reference to API "RegQueryInfoKeyA" (Indicator: "RegQueryInfoKey"; File: "9ce01fdabd737268e2c5fe3da55fc969.exe") Found reference to API "RegQueryValueExA" (Indicator: "RegQueryValue"; File: "9ce01fdabd737268e2c5fe3da55fc969.exe") Found reference to API "" (Indicator: "RegOpenKey"; Source: "00000000-00000632.00000001.70834.02810000.00000004.mdmp, 00000000-00000632.00000002.72753.02810000.00000004.mdmp") Found reference to API "" (Indicator: "RegOpenKey"; Source: "00000000-00000632.00000001.70834.02810000.00000004.mdmp, 00000000-00000632.00000002.72753.02810000.00000004.mdmp") Found reference to API "" (Indicator: "RegOpenKey"; Source: "00000000-00004708.00000000.67069.00CE0000.00000004.mdmp, 00000000-00004708.00000001.68991.00CE0000.00000004.mdmp, 00000000-00004708.00000002.70911.00CE0000.00000004.mdmp") Found reference to API "" (Indicator: "RegOpenKey"; Source: "00000000-00004708.00000000.67069.00CE0000.00000004.mdmp, 00000000-00004708.00000001.68991.00CE0000.00000004.mdmp, 00000000-00004708.00000002.70911.00CE0000.00000004.mdmp") Found reference to API "RegOpenKeyExA" (Indicator: "RegOpenKey"; Source: "00000000-00004708.00000000.67069.010BA000.00000002.mdmp") Found reference to API "RegQueryInfoKeyA" (Indicator: "RegQueryInfoKey"; Source: "00000000-00004708.00000000.67069.010BA000.00000002.mdmp") Found reference to API "RegQueryValueExA" (Indicator: "RegQueryValue"; Source: "00000000-00004708.00000000.67069.010BA000.00000002.mdmp") Found reference to API "RegOpenKeyExA" (Indicator: "RegOpenKey"; Source: "00000000-00006492.00000000.67113.0098A000.00000002.mdmp") Found reference to API "RegQueryInfoKeyA" (Indicator: "RegQueryInfoKey"; Source: "00000000-00006492.00000000.67113.0098A000.00000002.mdmp") Found reference to API "RegQueryValueExA" (Indicator: "RegQueryValue"; Source: "00000000-00006492.00000000.67113.0098A000.00000002.mdmp") Found reference to API "" (Indicator: "RegOpenKey"; Source: "00000000-00006492.00000000.67113.03400000.00000004.mdmp") Found reference to API "" (Indicator: "RegOpenKey"; Source: "00000000-00006492.00000000.67113.03400000.00000004.mdmp") Found reference to API "" (Indicator: "RegOpenKey"; Source: "00000000-00006816.00000000.67028.032E0000.00000004.mdmp, 00000000-00006816.00000002.70867.032E0000.00000004.mdmp") Found reference to API "" (Indicator: "RegOpenKey"; Source: "00000000-00006816.00000000.67028.032E0000.00000004.mdmp, 00000000-00006816.00000002.70867.032E0000.00000004.mdmp") Found reference to API "RegOpenKeyExA" (Indicator: "RegOpenKey"; Source: "00000000-00006816.00000002.70867.003CA000.00000002.mdmp") Found reference to API "RegQueryInfoKeyA" (Indicator: "RegQueryInfoKey"; Source: "00000000-00006816.00000002.70867.003CA000.00000002.mdmp") Found reference to API "RegQueryValueExA" (Indicator: "RegQueryValue"; Source: "00000000-00006816.00000002.70867.003CA000.00000002.mdmp")5b:T606,Found reference to API "GetProcAddress" (Indicator: "GetProcAddress"; File: "9ce01fdabd737268e2c5fe3da55fc969.exe") Found reference to API "Error loading %shGetProcAddress() failed on function '%s'. Possible reason: incorrect version of advpack.dll being used./Windows 95 or Windows NT is required to install" (Indicator: "GetProcAddress"; File: "9ce01fdabd737268e2c5fe3da55fc969.exe") Found reference to API "Error loading %shGetProcAddress() failed on function '%s'. Possible reason: incorrect version of advpack.dll being used./Windows 95 or Windows NT is required to install" (Indicator: "GetProcAddress"; Source: "00000000-00004708.00000000.67069.010BA000.00000002.mdmp") Found reference to API "GetProcAddress" (Indicator: "GetProcAddress"; Source: "00000000-00004708.00000000.67069.010BA000.00000002.mdmp") Found reference to API "Error loading %shGetProcAddress() failed on function '%s'. Possible reason: incorrect version of advpack.dll being used./Windows 95 or Windows NT is required to install" (Indicator: "GetProcAddress"; Source: "00000000-00006492.00000000.67113.0098A000.00000002.mdmp") Found reference to API "GetProcAddress" (Indicator: "GetProcAddress"; Source: "00000000-00006492.00000000.67113.0098A000.00000002.mdmp") Found reference to API "Error loading %shGetProcAddress() failed on function '%s'. Possible reason: incorrect version of advpack.dll being used./Windows 95 or Windows NT is required to install" (Indicator: "GetProcAddress"; Source: "00000000-00006816.00000002.70867.003CA000.00000002.mdmp")5c:Te2a,Found reference to API "GetFileAttributesA" (Indicator: "GetFileAttributes"; File: "9ce01fdabd737268e2c5fe3da55fc969.exe") Found reference to API "GetSystemDirectoryA" (Indicator: "GetSystemDirectory"; File: "9ce01fdabd737268e2c5fe3da55fc969.exe") Found reference to API "GetCurrentDirectoryA" (Indicator: "GetCurrentDirectory"; File: "9ce01fdabd737268e2c5fe3da55fc969.exe") Found reference to API "GetTempPathA" (Indicator: "GetTempPath"; File: "9ce01fdabd737268e2c5fe3da55fc969.exe") Found reference to API "GetTempFileNameA" (Indicator: "GetTempFileName"; File: "9ce01fdabd737268e2c5fe3da55fc969.exe") Found reference to API "GetFileVersionInfoSizeA" (Indicator: "GetFileVersionInfo"; File: "9ce01fdabd737268e2c5fe3da55fc969.exe") Found reference to API "GetFileVersionInfoSizeA" (Indicator: "GetFileVersionInfoSize"; File: "9ce01fdabd737268e2c5fe3da55fc969.exe") Found reference to API "GetFileVersionInfoA" (Indicator: "GetFileVersionInfo"; File: "9ce01fdabd737268e2c5fe3da55fc969.exe") Found reference to API "GetFileAttributesA" (Indicator: "GetFileAttributes"; Source: "00000000-00004708.00000000.67069.010BA000.00000002.mdmp") Found reference to API "GetSystemDirectoryA" (Indicator: "GetSystemDirectory"; Source: "00000000-00004708.00000000.67069.010BA000.00000002.mdmp") Found reference to API "GetCurrentDirectoryA" (Indicator: "GetCurrentDirectory"; Source: "00000000-00004708.00000000.67069.010BA000.00000002.mdmp") Found reference to API "GetTempPathA" (Indicator: "GetTempPath"; Source: "00000000-00004708.00000000.67069.010BA000.00000002.mdmp") Found reference to API "GetTempFileNameA" (Indicator: "GetTempFileName"; Source: "00000000-00004708.00000000.67069.010BA000.00000002.mdmp") Found reference to API "GetFileVersionInfoSizeA" (Indicator: "GetFileVersionInfo"; Source: "00000000-00004708.00000000.67069.010BA000.00000002.mdmp") Found reference to API "GetFileVersionInfoSizeA" (Indicator: "GetFileVersionInfoSize"; Source: "00000000-00004708.00000000.67069.010BA000.00000002.mdmp") Found reference to API "GetFileVersionInfoA" (Indicator: "GetFileVersionInfo"; Source: "00000000-00004708.00000000.67069.010BA000.00000002.mdmp") Found reference to API "GetFileAttributesA" (Indicator: "GetFileAttributes"; Source: "00000000-00006492.00000000.67113.0098A000.00000002.mdmp") Found reference to API "GetSystemDirectoryA" (Indicator: "GetSystemDirectory"; Source: "00000000-00006492.00000000.67113.0098A000.00000002.mdmp") Found reference to API "GetCurrentDirectoryA" (Indicator: "GetCurrentDirectory"; Source: "00000000-00006492.00000000.67113.0098A000.00000002.mdmp") Found reference to API "GetTempPathA" (Indicator: "GetTempPath"; Source: "00000000-00006492.00000000.67113.0098A000.00000002.mdmp") Found reference to API "GetTempFileNameA" (Indicator: "GetTempFileName"; Source: "00000000-00006492.00000000.67113.0098A000.00000002.mdmp") Found reference to API "GetFileVersionInfoSizeA" (Indicator: "GetFileVersionInfo"; Source: "00000000-00006492.00000000.67113.0098A000.00000002.mdmp") Found reference to API "GetFileVersionInfoSizeA" (Indicator: "GetFileVersionInfoSize"; Source: "00000000-00006492.00000000.67113.0098A000.00000002.mdmp") Found reference to API "GetFileVersionInfoA" (Indicator: "GetFileVersionInfo"; Source: "00000000-00006492.00000000.67113.0098A000.00000002.mdmp") Found reference to API "GetFileAttributesA" (Indicator: "GetFileAttributes"; Source: "00000000-00006816.00000002.70867.003CA000.00000002.mdmp") Found reference to API "GetSystemDirectoryA" (Indicator: "GetSystemDirectory"; Source: "00000000-00006816.00000002.70867.003CA000.00000002.mdmp")5d:T66f,Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; File: "9ce01fdabd737268e2c5fe3da55fc969.exe") Found reference to API "OpenProcessToken" (Indicator: "OpenProcessToken"; File: "9ce01fdabd737268e2c5fe3da55fc969.exe") file/memory contains long string with (Indicator: "OpenProcessToken"; File: "9ce01fdabd737268e2c5fe3da55fc969.exe") file/memory contains long string with (Indicator: "OpenProcessToken"; Source: "00000000-00004708.00000000.67069.010BA000.00000002.mdmp") Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; Source: "00000000-00004708.00000000.67069.010BA000.00000002.mdmp") Found reference to API "OpenProcessToken" (Indicator: "OpenProcessToken"; Source: "00000000-00004708.00000000.67069.010BA000.00000002.mdmp") file/memory contains long string with (Indicator: "OpenProcessToken"; Source: "00000000-00006492.00000000.67113.0098A000.00000002.mdmp") Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; Source: "00000000-00006492.00000000.67113.0098A000.00000002.mdmp") Found reference to API "OpenProcessToken" (Indicator: "OpenProcessToken"; Source: "00000000-00006492.00000000.67113.0098A000.00000002.mdmp") file/memory contains long string with (Indicator: "OpenProcessToken"; Source: "00000000-00006816.00000002.70867.003CA000.00000002.mdmp") Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; Source: "00000000-00006816.00000002.70867.003CA000.00000002.mdmp") Found reference to API "OpenProcessToken" (Indicator: "OpenProcessToken"; Source: "00000000-00006816.00000002.70867.003CA000.00000002.mdmp")5e:T7af,Found string ":\WINDOWS\system32\DRIVERS" (Indicator: "system32\drivers"; Source: "00000000-00000632.00000001.70834.02810000.00000004.mdmp, 00000000-00000632.00000002.72753.02810000.00000004.mdmp") Found string ":\WINDOWS\system32\DriverStore\FileRepository" (Indicator: "system32\drivers"; Source: "00000000-00000632.00000001.70834.02810000.00000004.mdmp, 00000000-00000632.00000002.72753.02810000.00000004.mdmp") Found string ":\WINDOWS\system32\DriverStore\FileRepository" (Indicator: "system32\drivers"; Source: "00000000-00004708.00000000.67069.00CE0000.00000004.mdmp, 00000000-00004708.00000001.68991.00CE0000.00000004.mdmp, 00000000-00004708.00000002.70911.00CE0000.00000004.mdmp") Found string ":\WINDOWS\system32\DRIVERS" (Indicator: "system32\drivers"; Source: "00000000-00004708.00000000.67069.00CE0000.00000004.mdmp, 00000000-00004708.00000001.68991.00CE0000.00000004.mdmp, 00000000-00004708.00000002.70911.00CE0000.00000004.mdmp") Found string "\Device\HarddiskVolume2\Users\HAPUBWS\AppData\Local\Temp\IXP001.TMP\JK4zG29.exe" (Indicator: "\Device\"; Source: "00000000-00004708.00000000.67069.00CE0000.00000004.mdmp, 00000000-00004708.00000001.68991.00CE0000.00000004.mdmp, 00000000-00004708.00000002.70911.00CE0000.00000004.mdmp") Found string ":\WINDOWS\system32\DriverStore\FileRepository" (Indicator: "system32\drivers"; Source: "00000000-00006492.00000000.67113.03400000.00000004.mdmp") Found string ":\WINDOWS\system32\DRIVERS" (Indicator: "system32\drivers"; Source: "00000000-00006492.00000000.67113.03400000.00000004.mdmp") Found string ":\WINDOWS\system32\DriverStore\FileRepository" (Indicator: "system32\drivers"; Source: "00000000-00006816.00000000.67028.032E0000.00000004.mdmp, 00000000-00006816.00000002.70867.032E0000.00000004.mdmp") Found string ":\WINDOWS\system32\DRIVERS" (Indicator: "system32\drivers"; Source: "00000000-00006816.00000000.67028.032E0000.00000004.mdmp, 00000000-00006816.00000002.70867.032E0000.00000004.mdmp")5f:Taaf,Found reference to API "DeleteFileA" (Indicator: "DeleteFile"; File: "9ce01fdabd737268e2c5fe3da55fc969.exe") Found reference to API "RemoveDirectoryA" (Indicator: "RemoveDirectory"; File: "9ce01fdabd737268e2c5fe3da55fc969.exe") Found reference to API "" (Indicator: "DeleteFile"; Source: "00000000-00000632.00000001.70834.02810000.00000004.mdmp, 00000000-00000632.00000002.72753.02810000.00000004.mdmp") Found reference to API "" (Indicator: "DeleteFile"; Source: "00000000-00000632.00000001.70834.02810000.00000004.mdmp, 00000000-00000632.00000002.72753.02810000.00000004.mdmp") Found reference to API "" (Indicator: "DeleteFile"; Source: "00000000-00004708.00000000.67069.00CE0000.00000004.mdmp, 00000000-00004708.00000001.68991.00CE0000.00000004.mdmp, 00000000-00004708.00000002.70911.00CE0000.00000004.mdmp") Found reference to API "" (Indicator: "DeleteFile"; Source: "00000000-00004708.00000000.67069.00CE0000.00000004.mdmp, 00000000-00004708.00000001.68991.00CE0000.00000004.mdmp, 00000000-00004708.00000002.70911.00CE0000.00000004.mdmp") Found reference to API "DeleteFileA" (Indicator: "DeleteFile"; Source: "00000000-00004708.00000000.67069.010BA000.00000002.mdmp") Found reference to API "RemoveDirectoryA" (Indicator: "RemoveDirectory"; Source: "00000000-00004708.00000000.67069.010BA000.00000002.mdmp") Found reference to API "DeleteFileA" (Indicator: "DeleteFile"; Source: "00000000-00006492.00000000.67113.0098A000.00000002.mdmp") Found reference to API "RemoveDirectoryA" (Indicator: "RemoveDirectory"; Source: "00000000-00006492.00000000.67113.0098A000.00000002.mdmp") Found reference to API "" (Indicator: "DeleteFile"; Source: "00000000-00006492.00000000.67113.03400000.00000004.mdmp") Found reference to API "" (Indicator: "DeleteFile"; Source: "00000000-00006492.00000000.67113.03400000.00000004.mdmp") Found reference to API "" (Indicator: "DeleteFile"; Source: "00000000-00006816.00000000.67028.032E0000.00000004.mdmp, 00000000-00006816.00000002.70867.032E0000.00000004.mdmp") Found reference to API "" (Indicator: "DeleteFile"; Source: "00000000-00006816.00000000.67028.032E0000.00000004.mdmp, 00000000-00006816.00000002.70867.032E0000.00000004.mdmp") Found reference to API "DeleteFileA" (Indicator: "DeleteFile"; Source: "00000000-00006816.00000002.70867.003CA000.00000002.mdmp")60:T97d,Found reference to API "RegDeleteValueA" (Indicator: "RegDeleteValue"; File: "9ce01fdabd737268e2c5fe3da55fc969.exe") Found reference to API "" (Indicator: "RegDeleteValue"; Source: "00000000-00000632.00000001.70834.02810000.00000004.mdmp, 00000000-00000632.00000002.72753.02810000.00000004.mdmp") Found reference to API "" (Indicator: "RegDeleteValue"; Source: "00000000-00000632.00000001.70834.02810000.00000004.mdmp, 00000000-00000632.00000002.72753.02810000.00000004.mdmp") Found reference to API "" (Indicator: "RegDeleteValue"; Source: "00000000-00004708.00000000.67069.00CE0000.00000004.mdmp, 00000000-00004708.00000001.68991.00CE0000.00000004.mdmp, 00000000-00004708.00000002.70911.00CE0000.00000004.mdmp") Found reference to API "" (Indicator: "RegDeleteValue"; Source: "00000000-00004708.00000000.67069.00CE0000.00000004.mdmp, 00000000-00004708.00000001.68991.00CE0000.00000004.mdmp, 00000000-00004708.00000002.70911.00CE0000.00000004.mdmp") Found reference to API "RegDeleteValueA" (Indicator: "RegDeleteValue"; Source: "00000000-00004708.00000000.67069.010BA000.00000002.mdmp") Found reference to API "RegDeleteValueA" (Indicator: "RegDeleteValue"; Source: "00000000-00006492.00000000.67113.0098A000.00000002.mdmp") Found reference to API "" (Indicator: "RegDeleteValue"; Source: "00000000-00006492.00000000.67113.03400000.00000004.mdmp") Found reference to API "" (Indicator: "RegDeleteValue"; Source: "00000000-00006492.00000000.67113.03400000.00000004.mdmp") Found reference to API "" (Indicator: "RegDeleteValue"; Source: "00000000-00006816.00000000.67028.032E0000.00000004.mdmp, 00000000-00006816.00000002.70867.032E0000.00000004.mdmp") Found reference to API "" (Indicator: "RegDeleteValue"; Source: "00000000-00006816.00000000.67028.032E0000.00000004.mdmp, 00000000-00006816.00000002.70867.032E0000.00000004.mdmp") Found reference to API "RegDeleteValueA" (Indicator: "RegDeleteValue"; Source: "00000000-00006816.00000002.70867.003CA000.00000002.mdmp")61:Tb35,Found reference to API "CheckTokenMembership" (Indicator: "CheckTokenMembership"; File: "9ce01fdabd737268e2c5fe3da55fc969.exe") Found reference to API "SeShutdownPrivilege" (Indicator: "SeShutdownPrivilege"; File: "9ce01fdabd737268e2c5fe3da55fc969.exe") Found reference to API "LookupPrivilegeValueA" (Indicator: "LookupPrivilegeValue"; File: "9ce01fdabd737268e2c5fe3da55fc969.exe") Found reference to API "AdjustTokenPrivileges" (Indicator: "AdjustTokenPrivileges"; File: "9ce01fdabd737268e2c5fe3da55fc969.exe") file/memory contains long string with (Indicator: "AdjustTokenPrivileges"; File: "9ce01fdabd737268e2c5fe3da55fc969.exe") file/memory contains long string with (Indicator: "AdjustTokenPrivileges"; Source: "00000000-00004708.00000000.67069.010BA000.00000002.mdmp") Found reference to API "LookupPrivilegeValueA" (Indicator: "LookupPrivilegeValue"; Source: "00000000-00004708.00000000.67069.010BA000.00000002.mdmp") Found reference to API "AdjustTokenPrivileges" (Indicator: "AdjustTokenPrivileges"; Source: "00000000-00004708.00000000.67069.010BA000.00000002.mdmp") Found reference to API "CheckTokenMembership" (Indicator: "CheckTokenMembership"; Source: "00000000-00004708.00000002.70911.010B1000.00000020.mdmp") Found reference to API "SeShutdownPrivilege" (Indicator: "SeShutdownPrivilege"; Source: "00000000-00004708.00000002.70911.010B1000.00000020.mdmp") Found reference to API "CheckTokenMembership" (Indicator: "CheckTokenMembership"; Source: "00000000-00006492.00000000.67113.00981000.00000020.mdmp") Found reference to API "SeShutdownPrivilege" (Indicator: "SeShutdownPrivilege"; Source: "00000000-00006492.00000000.67113.00981000.00000020.mdmp") file/memory contains long string with (Indicator: "AdjustTokenPrivileges"; Source: "00000000-00006492.00000000.67113.0098A000.00000002.mdmp") Found reference to API "LookupPrivilegeValueA" (Indicator: "LookupPrivilegeValue"; Source: "00000000-00006492.00000000.67113.0098A000.00000002.mdmp") Found reference to API "AdjustTokenPrivileges" (Indicator: "AdjustTokenPrivileges"; Source: "00000000-00006492.00000000.67113.0098A000.00000002.mdmp") Found reference to API "CheckTokenMembership" (Indicator: "CheckTokenMembership"; Source: "00000000-00006816.00000001.68947.003C1000.00000020.mdmp") Found reference to API "SeShutdownPrivilege" (Indicator: "SeShutdownPrivilege"; Source: "00000000-00006816.00000001.68947.003C1000.00000020.mdmp") file/memory contains long string with (Indicator: "AdjustTokenPrivileges"; Source: "00000000-00006816.00000002.70867.003CA000.00000002.mdmp") Found reference to API "LookupPrivilegeValueA" (Indicator: "LookupPrivilegeValue"; Source: "00000000-00006816.00000002.70867.003CA000.00000002.mdmp") Found reference to API "AdjustTokenPrivileges" (Indicator: "AdjustTokenPrivileges"; Source: "00000000-00006816.00000002.70867.003CA000.00000002.mdmp")62:T934,Found reference to API "SetFileAttributesA" (Indicator: "SetFileAttributes"; File: "9ce01fdabd737268e2c5fe3da55fc969.exe") Found reference to API "" (Indicator: "SetFileAttributes"; Source: "00000000-00000632.00000001.70834.02810000.00000004.mdmp, 00000000-00000632.00000002.72753.02810000.00000004.mdmp") Found reference to API "" (Indicator: "SetFileAttributes"; Source: "00000000-00000632.00000001.70834.02810000.00000004.mdmp, 00000000-00000632.00000002.72753.02810000.00000004.mdmp") Found reference to API "" (Indicator: "SetFileAttributes"; Source: "00000000-00004708.00000000.67069.00CE0000.00000004.mdmp, 00000000-00004708.00000001.68991.00CE0000.00000004.mdmp, 00000000-00004708.00000002.70911.00CE0000.00000004.mdmp") Found reference to API "" (Indicator: "SetFileAttributes"; Source: "00000000-00004708.00000000.67069.00CE0000.00000004.mdmp, 00000000-00004708.00000001.68991.00CE0000.00000004.mdmp, 00000000-00004708.00000002.70911.00CE0000.00000004.mdmp") Found reference to API "SetFileAttributesA" (Indicator: "SetFileAttributes"; Source: "00000000-00004708.00000000.67069.010BA000.00000002.mdmp") Found reference to API "SetFileAttributesA" (Indicator: "SetFileAttributes"; Source: "00000000-00006492.00000000.67113.0098A000.00000002.mdmp") Found reference to API "" (Indicator: "SetFileAttributes"; Source: "00000000-00006492.00000000.67113.03400000.00000004.mdmp") Found reference to API "" (Indicator: "SetFileAttributes"; Source: "00000000-00006492.00000000.67113.03400000.00000004.mdmp") Found reference to API "" (Indicator: "SetFileAttributes"; Source: "00000000-00006816.00000000.67028.032E0000.00000004.mdmp, 00000000-00006816.00000002.70867.032E0000.00000004.mdmp") Found reference to API "" (Indicator: "SetFileAttributes"; Source: "00000000-00006816.00000000.67028.032E0000.00000004.mdmp, 00000000-00006816.00000002.70867.032E0000.00000004.mdmp")63:T11e9,Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; File: "9ce01fdabd737268e2c5fe3da55fc969.exe") Found reference to API "FreeSid" (Indicator: "FreeSid"; File: "9ce01fdabd737268e2c5fe3da55fc969.exe") Found reference to API "AllocateAndInitializeSid" (Indicator: "AllocateAndInitializeSid"; File: "9ce01fdabd737268e2c5fe3da55fc969.exe") Found reference to API "AllocateAndInitializeSid" (Indicator: "InitializeSid"; File: "9ce01fdabd737268e2c5fe3da55fc969.exe") Found reference to API "EqualSid" (Indicator: "EqualSid"; File: "9ce01fdabd737268e2c5fe3da55fc969.exe") Found reference to API "" (Indicator: "AccessCheck"; Source: "00000000-00000632.00000001.70834.02810000.00000004.mdmp, 00000000-00000632.00000002.72753.02810000.00000004.mdmp") Found reference to API "" (Indicator: "SetFileSecurityW"; Source: "00000000-00000632.00000001.70834.02810000.00000004.mdmp, 00000000-00000632.00000002.72753.02810000.00000004.mdmp") Found reference to API "" (Indicator: "AccessCheck"; Source: "00000000-00004708.00000000.67069.00CE0000.00000004.mdmp, 00000000-00004708.00000001.68991.00CE0000.00000004.mdmp, 00000000-00004708.00000002.70911.00CE0000.00000004.mdmp") Found reference to API "" (Indicator: "SetFileSecurityW"; Source: "00000000-00004708.00000000.67069.00CE0000.00000004.mdmp, 00000000-00004708.00000001.68991.00CE0000.00000004.mdmp, 00000000-00004708.00000002.70911.00CE0000.00000004.mdmp") Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; Source: "00000000-00004708.00000000.67069.010BA000.00000002.mdmp") Found reference to API "FreeSid" (Indicator: "FreeSid"; Source: "00000000-00004708.00000000.67069.010BA000.00000002.mdmp") Found reference to API "AllocateAndInitializeSid" (Indicator: "AllocateAndInitializeSid"; Source: "00000000-00004708.00000000.67069.010BA000.00000002.mdmp") Found reference to API "AllocateAndInitializeSid" (Indicator: "InitializeSid"; Source: "00000000-00004708.00000000.67069.010BA000.00000002.mdmp") Found reference to API "EqualSid" (Indicator: "EqualSid"; Source: "00000000-00004708.00000000.67069.010BA000.00000002.mdmp") Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; Source: "00000000-00006492.00000000.67113.0098A000.00000002.mdmp") Found reference to API "FreeSid" (Indicator: "FreeSid"; Source: "00000000-00006492.00000000.67113.0098A000.00000002.mdmp") Found reference to API "AllocateAndInitializeSid" (Indicator: "AllocateAndInitializeSid"; Source: "00000000-00006492.00000000.67113.0098A000.00000002.mdmp") Found reference to API "AllocateAndInitializeSid" (Indicator: "InitializeSid"; Source: "00000000-00006492.00000000.67113.0098A000.00000002.mdmp") Found reference to API "EqualSid" (Indicator: "EqualSid"; Source: "00000000-00006492.00000000.67113.0098A000.00000002.mdmp") Found reference to API "" (Indicator: "AccessCheck"; Source: "00000000-00006492.00000000.67113.03400000.00000004.mdmp") Found reference to API "" (Indicator: "SetFileSecurityW"; Source: "00000000-00006492.00000000.67113.03400000.00000004.mdmp") Found reference to API "" (Indicator: "AccessCheck"; Source: "00000000-00006816.00000000.67028.032E0000.00000004.mdmp, 00000000-00006816.00000002.70867.032E0000.00000004.mdmp") Found reference to API "" (Indicator: "SetFileSecurityW"; Source: "00000000-00006816.00000000.67028.032E0000.00000004.mdmp, 00000000-00006816.00000002.70867.032E0000.00000004.mdmp") Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; Source: "00000000-00006816.00000002.70867.003CA000.00000002.mdmp") Found reference to API "FreeSid" (Indicator: "FreeSid"; Source: "00000000-00006816.00000002.70867.003CA000.00000002.mdmp") Found reference to API "AllocateAndInitializeSid" (Indicator: "AllocateAndInitializeSid"; Source: "00000000-00006816.00000002.70867.003CA000.00000002.mdmp") Found reference to API "AllocateAndInitializeSid" (Indicator: "InitializeSid"; Source: "00000000-00006816.00000002.70867.003CA000.00000002.mdmp") Found reference to API "EqualSid" (Indicator: "EqualSid"; Source: "00000000-00006816.00000002.70867.003CA000.00000002.mdmp")64:T1477,Observed import api "AllocateAndInitializeSid" which can "Allocates and initializes a security identifier (SID) with up to eight subauthorities" [Source: 9ce01fdabd737268e2c5fe3da55fc969.exe] Observed import api "EqualSid" which can "Tests two security identifier (SID) values for equality" [Source: 9ce01fdabd737268e2c5fe3da55fc969.exe] Observed import api "FreeSid" which can "Frees a security identifier (SID) previously allocated by using the AllocateAndInitializeSid function" [Source: 9ce01fdabd737268e2c5fe3da55fc969.exe] Observed import api "GetTokenInformation" which can "Retrieves a specified type of information about an access token" [Source: 9ce01fdabd737268e2c5fe3da55fc969.exe] Observed import api "InitializeSid" which can "Initializes a security identifier (SID)" [Source: 9ce01fdabd737268e2c5fe3da55fc969.exe] Observed import api "AllocateAndInitializeSid" which can "Allocates and initializes a security identifier (SID) with up to eight subauthorities" [Source: Hl0Uw04.exe] Observed import api "EqualSid" which can "Tests two security identifier (SID) values for equality" [Source: Hl0Uw04.exe] Observed import api "FreeSid" which can "Frees a security identifier (SID) previously allocated by using the AllocateAndInitializeSid function" [Source: Hl0Uw04.exe] Observed import api "GetTokenInformation" which can "Retrieves a specified type of information about an access token" [Source: Hl0Uw04.exe] Observed import api "InitializeSid" which can "Initializes a security identifier (SID)" [Source: Hl0Uw04.exe] Observed import api "AllocateAndInitializeSid" which can "Allocates and initializes a security identifier (SID) with up to eight subauthorities" [Source: JK4zG29.exe] Observed import api "EqualSid" which can "Tests two security identifier (SID) values for equality" [Source: JK4zG29.exe] Observed import api "FreeSid" which can "Frees a security identifier (SID) previously allocated by using the AllocateAndInitializeSid function" [Source: JK4zG29.exe] Observed import api "GetTokenInformation" which can "Retrieves a specified type of information about an access token" [Source: JK4zG29.exe] Observed import api "InitializeSid" which can "Initializes a security identifier (SID)" [Source: JK4zG29.exe] Observed import api "AllocateAndInitializeSid" which can "Allocates and initializes a security identifier (SID) with up to eight subauthorities" [Source: wH5KL25.exe] Observed import api "EqualSid" which can "Tests two security identifier (SID) values for equality" [Source: wH5KL25.exe] Observed import api "FreeSid" which can "Frees a security identifier (SID) previously allocated by using the AllocateAndInitializeSid function" [Source: wH5KL25.exe] Observed import api "GetTokenInformation" which can "Retrieves a specified type of information about an access token" [Source: wH5KL25.exe] Observed import api "InitializeSid" which can "Initializes a security identifier (SID)" [Source: wH5KL25.exe] Observed import api "AddAce" which can "Adds one or more access control entries (ACEs) to a specified access control list (ACL)" [Source: 4lh730XA.exe] Observed import api "AllocateAndInitializeSid" which can "Allocates and initializes a security identifier (SID) with up to eight subauthorities" [Source: 4lh730XA.exe] Observed import api "CheckTokenMembership" which can "Determines whether a specified security identifier (SID) is enabled in an access token" [Source: 4lh730XA.exe] Observed import api "CopySid" which can "Copies a security identifier (SID) to a buffer" [Source: 4lh730XA.exe] Observed import api "DuplicateToken" which can "Creates a new access token that duplicates one already in existence" [Source: 4lh730XA.exe] Observed import api "DuplicateTokenEx" which can "Creates a new access token that duplicates an existing token" [Source: 4lh730XA.exe] Observed import api "FreeSid" which can "Frees a security identifier (SID) previously allocated by using the AllocateAndInitializeSid function" [Source: 4lh730XA.exe] Observed import api "GetAce" which can "Obtains a pointer to an access control entry (ACE) in an access control list (ACL)" [Source: 4lh730XA.exe] Observed import api "GetAclInformation" which can "Retrieves information about an access control list (ACL)" [Source: 4lh730XA.exe] Observed import api "GetLengthSid" which can "Returns the length in bytes of a valid security identifier (SID)" [Source: 4lh730XA.exe] Observed import api "GetSecurityDescriptorDacl" which can "Retrieves a pointer to the discretionary access control list (DACL) in a specified security descriptor" [Source: 4lh730XA.exe] Observed import api "GetTokenInformation" which can "Retrieves a specified type of information about an access token" [Source: 4lh730XA.exe] Observed import api "InitializeAcl" which can "Initializes a new ACL structure" [Source: 4lh730XA.exe] Observed import api "InitializeSecurityDescriptor" which can "Initializes a new security descriptor" [Source: 4lh730XA.exe] Observed import api "InitializeSid" which can "Initializes a security identifier (SID)" [Source: 4lh730XA.exe] Observed import api "SetSecurityDescriptorDacl" which can "Sets information in a discretionary access control list (DACL)" [Source: 4lh730XA.exe]65:Td1d,"9ce01fdabd737268e2c5fe3da55fc969.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\USERS\HAPUBWS\APPDATA\LOCAL\TEMP\IXP000.TMP\HL0UW04.EXE"; Value: "") "Hl0Uw04.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\USERS\HAPUBWS\APPDATA\LOCAL\TEMP\IXP001.TMP\JK4ZG29.EXE"; Value: "") "JK4zG29.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\USERS\HAPUBWS\APPDATA\LOCAL\TEMP\IXP002.TMP\WH5KL25.EXE"; Value: "") "JK4zG29.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\USERS\HAPUBWS\APPDATA\LOCAL\TEMP\IXP002.TMP\3KZ60YE.EXE"; Value: "") "wH5KL25.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\USERS\HAPUBWS\APPDATA\LOCAL\TEMP\IXP003.TMP\1KF13LI4.EXE"; Value: "") "wH5KL25.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\USERS\HAPUBWS\APPDATA\LOCAL\TEMP\IXP003.TMP\2OY8588.EXE"; Value: "") "1KF13LI4.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\LANMANWORKSTATION\PARAMETERS"; Key: "RPCCACHETIMEOUT"; Value: "") "1KF13LI4.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\SYSWOW64\SCHTASKS.EXE"; Value: "") "1KF13LI4.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK\PARAMETERS"; Key: "TRANSPORTS"; Value: "") "1KF13LI4.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\VMBUS\PARAMETERS\WINSOCK"; Key: "MAPPING"; Value: "") "1KF13LI4.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\PSCHED\PARAMETERS\WINSOCK"; Key: "MAPPING"; Value: "") "1KF13LI4.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK\SETUP MIGRATION\PROVIDERS\PSCHED"; Key: "WINSOCK 2.0 PROVIDER ID"; Value: "") "1KF13LI4.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\WINSOCK"; Key: "MAPPING"; Value: "") "1KF13LI4.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP6\PARAMETERS\WINSOCK"; Key: "MAPPING"; Value: "") "1KF13LI4.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK\SETUP MIGRATION\PROVIDERS\TCPIP6"; Key: "WINSOCK 2.0 PROVIDER ID"; Value: "") "1KF13LI4.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP6\PARAMETERS\WINSOCK"; Key: "MINSOCKADDRLENGTH"; Value: "") "1KF13LI4.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP6\PARAMETERS\WINSOCK"; Key: "MAXSOCKADDRLENGTH"; Value: "") "1KF13LI4.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP6\PARAMETERS\WINSOCK"; Key: "USEDELAYEDACCEPTANCE"; Value: "")66:T55f,"Hl0Uw04.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP000.TMP\Hl0Uw04.exe]- [targetUID: 00000000-00007120] "FANBooster131.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\FANBooster131\FANBooster131.exe]- [targetUID: 00000000-00007820] "2OY8588.exe" has type "PE32 executable (console) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP003.TMP\2OY8588.exe]- [targetUID: 00000000-00006492] "JK4zG29.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP001.TMP\JK4zG29.exe]- [targetUID: 00000000-00006816] "wH5KL25.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP002.TMP\wH5KL25.exe]- [targetUID: 00000000-00006492] "5dr5Sx9.exe" has type "PE32 executable (console) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP000.TMP\5dr5Sx9.exe]- [targetUID: 00000000-00007120] "4lh730XA.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP001.TMP\4lh730XA.exe]- [targetUID: 00000000-00006816] "3KZ60ye.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP002.TMP\3KZ60ye.exe]- [targetUID: 00000000-00000632] "1KF13LI4.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP003.TMP\1KF13LI4.exe]- [targetUID: 00000000-00006492]67:T41e,"9ce01fdabd737268e2c5fe3da55fc969.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LANGUAGE"; Key: "INSTALLLANGUAGEFALLBACK") "Hl0Uw04.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LANGUAGE"; Key: "INSTALLLANGUAGEFALLBACK") "JK4zG29.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LANGUAGE"; Key: "INSTALLLANGUAGEFALLBACK") "wH5KL25.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LANGUAGE"; Key: "INSTALLLANGUAGEFALLBACK") "1KF13LI4.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LANGUAGE"; Key: "INSTALLLANGUAGEFALLBACK") "schtasks.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LANGUAGE"; Key: "INSTALLLANGUAGEFALLBACK") "2OY8588.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LANGUAGE"; Key: "INSTALLLANGUAGEFALLBACK") "AppLaunch.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LANGUAGE"; Key: "INSTALLLANGUAGEFALLBACK") "AppLaunch.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LANGUAGE GROUPS"; Key: "1") "3KZ60ye.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LANGUAGE"; Key: "INSTALLLANGUAGEFALLBACK")68:T6d4,"Hl0Uw04.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP000.TMP\Hl0Uw04.exe]- [targetUID: 00000000-00007120] "FANBooster131.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\FANBooster131\FANBooster131.exe]- [targetUID: 00000000-00007820] "2OY8588.exe" has type "PE32 executable (console) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP003.TMP\2OY8588.exe]- [targetUID: 00000000-00006492] "JK4zG29.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP001.TMP\JK4zG29.exe]- [targetUID: 00000000-00006816] "wH5KL25.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP002.TMP\wH5KL25.exe]- [targetUID: 00000000-00006492] "5dr5Sx9.exe" has type "PE32 executable (console) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP000.TMP\5dr5Sx9.exe]- [targetUID: 00000000-00007120] "4lh730XA.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP001.TMP\4lh730XA.exe]- [targetUID: 00000000-00006816] "3KZ60ye.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP002.TMP\3KZ60ye.exe]- [targetUID: 00000000-00000632] "OfficeTrackerNMP131.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%ALLUSERSPROFILE%\OfficeTrackerNMP131\OfficeTrackerNMP131.exe]- [targetUID: 00000000-00007820] "MaxLoonaFest131.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%LOCALAPPDATA%\MaxLoonaFest131\MaxLoonaFest131.exe]- [targetUID: 00000000-00007820] "1KF13LI4.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP003.TMP\1KF13LI4.exe]- [targetUID: 00000000-00006492]69:T651,"9ce01fdabd737268e2c5fe3da55fc969.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\RUNONCE") "9ce01fdabd737268e2c5fe3da55fc969.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\RUNONCE"; Key: "WEXTRACT_CLEANUP0"; Value: "rundll32.exe %WINDIR%\system32\advpack.dll,DelNodeRunDLL32 "%TEMP%\IXP000.TMP\"") "Hl0Uw04.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\RUNONCE") "Hl0Uw04.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\RUNONCE"; Key: "WEXTRACT_CLEANUP1"; Value: "rundll32.exe %WINDIR%\system32\advpack.dll,DelNodeRunDLL32 "%TEMP%\IXP001.TMP\"") "JK4zG29.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\RUNONCE") "JK4zG29.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\RUNONCE"; Key: "WEXTRACT_CLEANUP2"; Value: "rundll32.exe %WINDIR%\system32\advpack.dll,DelNodeRunDLL32 "%TEMP%\IXP002.TMP\"") "wH5KL25.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\RUNONCE") "wH5KL25.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\RUNONCE"; Key: "WEXTRACT_CLEANUP3"; Value: "rundll32.exe %WINDIR%\system32\advpack.dll,DelNodeRunDLL32 "%TEMP%\IXP003.TMP\"") "1KF13LI4.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN"; Key: "MAXLOONAFEST131"; Value: "%LOCALAPPDATA%\MaxLoonaFest131\MaxLoonaFest131.exe")6a:Tca8,"9ce01fdabd737268e2c5fe3da55fc969.exe" wrote 32768 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP\Hl0Uw04.exe": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "9ce01fdabd737268e2c5fe3da55fc969.exe" wrote 25088 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP\5dr5Sx9.exe": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "Hl0Uw04.exe" wrote 32768 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP001.TMP\JK4zG29.exe": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "Hl0Uw04.exe" wrote 23552 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP001.TMP\4lh730XA.exe": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000200100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "JK4zG29.exe" wrote 32768 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP002.TMP\wH5KL25.exe": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "JK4zG29.exe" wrote 18944 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP002.TMP\3KZ60ye.exe": 4d5aff000100000004001000ffff00004001000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0a240000000000000000 ... "wH5KL25.exe" wrote 32768 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP003.TMP\1KF13LI4.exe": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000300100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "wH5KL25.exe" wrote 467 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP003.TMP\2OY8588.exe": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ...6b:Te13,"1KF13LI4.exe" called "CryptUnprotectData" with parameters {"pDataIn": "8000000090d47805" "pDataOut": "0000000000000000" "$error": "d"} "1KF13LI4.exe" called "CryptUnprotectData" with parameters {"pDataIn": "9000000090d47805" "pDataOut": "0000000000000000" "$error": "d"} "1KF13LI4.exe" called "CryptUnprotectData" with parameters {"pDataIn": "a000000090d47805" "pDataOut": "0000000000000000" "$error": "d"} "1KF13LI4.exe" called "CryptUnprotectData" with parameters {"pDataIn": "b000000090d47805" "pDataOut": "0000000000000000" "$error": "d"} "1KF13LI4.exe" called "CryptUnprotectData" with parameters {"pDataIn": "c000000090d47805" "pDataOut": "0000000000000000" "$error": "d"} "1KF13LI4.exe" called "CryptUnprotectData" with parameters {"pDataIn": "d000000090d47805" "pDataOut": "0000000000000000" "$error": "d"} "1KF13LI4.exe" called "CryptUnprotectData" with parameters {"pDataIn": "e000000090d47805" "pDataOut": "0000000000000000" "$error": "d"} "1KF13LI4.exe" called "CryptUnprotectData" with parameters {"pDataIn": "f000000090d47805" "pDataOut": "0000000000000000" "$error": "d"} "1KF13LI4.exe" called "CryptUnprotectData" with parameters {"pDataIn": "0001000090d47805" "pDataOut": "0000000000000000" "$error": "d"} "1KF13LI4.exe" called "CryptUnprotectData" with parameters {"pDataIn": "1001000090d47805" "pDataOut": "20000000b89c7e05" "$dataout": "b41f53fd7c91eeb41677c8b431507aa71d8a8df3f42de5625b7d75a16322b842"} "1KF13LI4.exe" called "CryptUnprotectData" with parameters {"pDataIn": "8000000070c77805" "pDataOut": "0000000000000000" "$error": "d"} "1KF13LI4.exe" called "CryptUnprotectData" with parameters {"pDataIn": "9000000070c77805" "pDataOut": "0000000000000000" "$error": "d"} "1KF13LI4.exe" called "CryptUnprotectData" with parameters {"pDataIn": "a000000070c77805" "pDataOut": "0000000000000000" "$error": "d"} "1KF13LI4.exe" called "CryptUnprotectData" with parameters {"pDataIn": "b000000070c77805" "pDataOut": "0000000000000000" "$error": "d"} "1KF13LI4.exe" called "CryptUnprotectData" with parameters {"pDataIn": "c000000070c77805" "pDataOut": "0000000000000000" "$error": "d"} "1KF13LI4.exe" called "CryptUnprotectData" with parameters {"pDataIn": "d000000070c77805" "pDataOut": "0000000000000000" "$error": "d"} "1KF13LI4.exe" called "CryptUnprotectData" with parameters {"pDataIn": "e000000070c77805" "pDataOut": "0000000000000000" "$error": "d"} "1KF13LI4.exe" called "CryptUnprotectData" with parameters {"pDataIn": "f000000070c77805" "pDataOut": "0000000000000000" "$error": "d"} "1KF13LI4.exe" called "CryptUnprotectData" with parameters {"pDataIn": "0001000070c77805" "pDataOut": "0000000000000000" "$error": "d"} "1KF13LI4.exe" called "CryptUnprotectData" with parameters {"pDataIn": "1001000070c77805" "pDataOut": "2000000038987e05" "$dataout": "b41f53fd7c91eeb41677c8b431507aa71d8a8df3f42de5625b7d75a16322b842"} "1KF13LI4.exe" called "CryptUnprotectData" with parameters {"pDataIn": "80000000a0c97805" "pDataOut": "0000000000000000" "$error": "d"} "1KF13LI4.exe" called "CryptUnprotectData" with parameters {"pDataIn": "90000000a0c97805" "pDataOut": "0000000000000000" "$error": "d"} "1KF13LI4.exe" called "CryptUnprotectData" with parameters {"pDataIn": "a0000000a0c97805" "pDataOut": "0000000000000000" "$error": "d"} "1KF13LI4.exe" called "CryptUnprotectData" with parameters {"pDataIn": "b0000000a0c97805" "pDataOut": "0000000000000000" "$error": "d"} "1KF13LI4.exe" called "CryptUnprotectData" with parameters {"pDataIn": "c0000000a0c97805" "pDataOut": "0000000000000000" "$error": "d"}6c:T7d0,"wH5KL25.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\IXP003.TMP\2OY8588.exe" for deletion "wH5KL25.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\IXP003.TMP\1KF13LI4.exe" for deletion "1KF13LI4.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\posterBoxG8qeDmG3xj4Kw\8ghN89CsjOW1formhistory.sqlite" for deletion "1KF13LI4.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\posterBoxG8qeDmG3xj4Kw\Ei8DrAmaYu9KLogin Data" for deletion "1KF13LI4.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\posterBoxG8qeDmG3xj4Kw\D87fZN3R3jFeplaces.sqlite" for deletion "1KF13LI4.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\posterBoxG8qeDmG3xj4Kw\02zdBXl47cvzcookies.sqlite" for deletion "1KF13LI4.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\posterBoxG8qeDmG3xj4Kw\D87fZN3R3jFeWeb Data" for deletion "1KF13LI4.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\posterBoxG8qeDmG3xj4Kw\02zdBXl47cvzHistory" for deletion "1KF13LI4.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\posterBoxG8qeDmG3xj4Kw\3b6N2Xdh3CYwWeb Data" for deletion "1KF13LI4.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\posterBoxG8qeDmG3xj4Kw\oOPEmFmu_xsJCookies" for deletion "1KF13LI4.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\posterBoxG8qeDmG3xj4Kw\IWPfiAXUTJTSHistory" for deletion "1KF13LI4.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\GG8pej_C6o1DJq2duPu9dgvBJlqLpGIZ.zip" for deletion "1KF13LI4.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\grandUIAG8qeDmG3xj4Kw\Cookies\Edge_Default.txt" for deletion "1KF13LI4.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\grandUIAG8qeDmG3xj4Kw\Cookies\Firefox_ywzu7870.default.txt" for deletion "1KF13LI4.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\grandUIAG8qeDmG3xj4Kw\Downloads\Edge_Default.txt" for deletion "1KF13LI4.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\grandUIAG8qeDmG3xj4Kw\information.txt" for deletion "1KF13LI4.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\grandUIAG8qeDmG3xj4Kw\passwords.txt" for deletion6d:T546,"9ce01fdabd737268e2c5fe3da55fc969.exe" opened "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP" with delete access "Hl0Uw04.exe" opened "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP" with delete access "Hl0Uw04.exe" opened "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\IXP001.TMP" with delete access "JK4zG29.exe" opened "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP" with delete access "JK4zG29.exe" opened "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\IXP001.TMP" with delete access "JK4zG29.exe" opened "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\IXP002.TMP" with delete access "wH5KL25.exe" opened "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP" with delete access "wH5KL25.exe" opened "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\IXP001.TMP" with delete access "wH5KL25.exe" opened "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\IXP002.TMP" with delete access "wH5KL25.exe" opened "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\IXP003.TMP" with delete access "wH5KL25.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\IXP003.TMP\2OY8588.exe" with delete access "wH5KL25.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\IXP003.TMP\1KF13LI4.exe" with delete access6e:T84b,RegCloseKey OpenProcessToken RegCreateKeyExA RegOpenKeyExA RegDeleteValueA GetTempFileNameA GetSystemInfo GetFileAttributesA LoadLibraryA GetVersionExA GetModuleFileNameA LoadLibraryExA CreateDirectoryA DeleteFileA UnhandledExceptionFilter GetProcAddress GetStartupInfoW GetTempPathA CreateThread LockResource FindFirstFileA WriteFile FindNextFileA GetSystemDirectoryA GetModuleHandleW GetDriveTypeA TerminateProcess CreateProcessA Sleep CreateFileA GetTickCount FindResourceA GetUserNameA RegEnumKeyA RegEnumKeyExA CredEnumerateA FindFirstFileW GetFileAttributesW GetTempPathW WriteProcessMemory GetModuleFileNameW CopyFileA LoadLibraryExW GetModuleHandleExW GetModuleHandleExA CreateToolhelp32Snapshot Process32First Process32Next CreateRemoteThread GetFileSize OpenProcess DeleteFileW GetFileSizeEx FindNextFileW GetComputerNameA FindFirstFileExW CreateFileW IsDebuggerPresent VirtualAllocEx GetCommandLineW GetCommandLineA GetTickCount64 GetModuleHandleA GetFileAttributesExW ShellExecuteA socket recv send WSAStartup connect closesocket OutputDebugStringW CreateThreadpoolWait ExitThread CreateThreadpoolWork SleepConditionVariableCS GetNativeSystemInfo SleepConditionVariableSRW CreateThreadpoolTimer RegCreateKeyExW CreateProcessWithLogonW RegDeleteKeyW SetSecurityDescriptorDacl RegOpenKeyExW GetUserNameW RegEnumKeyExW CreateProcessAsUserW RegDeleteValueW IcmpSendEcho GetDriveTypeW FindResourceExW DeviceIoControl CopyFileW GetSystemDirectoryW LoadLibraryW GetVersionExW ReadProcessMemory CreateDirectoryW GetTempFileNameW GetComputerNameW Process32NextW CopyFileExW Process32FirstW CreateProcessW VirtualAlloc ShellExecuteW ShellExecuteExW GetCursorPos GetClipboardData SetKeyboardState FindWindowExW FindWindowW GetWindowThreadProcessId FtpGetFileSize InternetOpenW InternetQueryDataAvailable InternetQueryOptionW InternetConnectW HttpQueryInfoW InternetCrackUrlW InternetCloseHandle HttpSendRequestW InternetOpenUrlW InternetReadFile FtpOpenFileW accept listen bind recvfrom sendto6f:T5dd,44/72 Antivirus vendors marked dropped file "Hl0Uw04.exe" as malicious (classified as "Generic.Dacic.7CB2327F.A" with 61% detection rate) 48/72 Antivirus vendors marked dropped file "FANBooster131.exe" as malicious (classified as "Generic.Dacic.7CB2327F.A" with 66% detection rate) 23/72 Antivirus vendors marked dropped file "2OY8588.exe" as malicious (classified as "Artemis" with 31% detection rate) 43/72 Antivirus vendors marked dropped file "JK4zG29.exe" as malicious (classified as "Agent.azfwy" with 59% detection rate) 36/71 Antivirus vendors marked dropped file "wH5KL25.exe" as malicious (classified as "Generic.Dacic.7CB2327F.A" with 50% detection rate) 22/72 Antivirus vendors marked dropped file "5dr5Sx9.exe" as malicious (classified as "UDS:Backdoor.Mokes" with 30% detection rate) 14/72 Antivirus vendors marked dropped file "4lh730XA.exe" as malicious (classified as "Malware.Generic" with 19% detection rate) 52/72 Antivirus vendors marked dropped file "3KZ60ye.exe" as malicious (classified as "Gen:Trojan.Heur" with 72% detection rate) 48/72 Antivirus vendors marked dropped file "OfficeTrackerNMP131.exe" as malicious (classified as "Generic.Dacic.7CB2327F.A" with 66% detection rate) 48/72 Antivirus vendors marked dropped file "MaxLoonaFest131.exe" as malicious (classified as "Generic.Dacic.7CB2327F.A" with 66% detection rate) 48/72 Antivirus vendors marked dropped file "1KF13LI4.exe" as malicious (classified as "Generic.Dacic.7CB2327F.A" with 66% detection rate)70:T71d,"9ce01fdabd737268e2c5fe3da55fc969.exe" wrote 00000004 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP\Hl0Uw04.exe" (Handle: 648) "Hl0Uw04.exe" wrote 00000004 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\Temp\IXP001.TMP\JK4zG29.exe" (Handle: 656) "JK4zG29.exe" wrote 00000004 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\Temp\IXP002.TMP\wH5KL25.exe" (Handle: 656) "JK4zG29.exe" wrote 00000004 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\Temp\IXP002.TMP\3KZ60ye.exe" (Handle: 124) "wH5KL25.exe" wrote 00000004 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\Temp\IXP003.TMP\1KF13LI4.exe" (Handle: 656) "wH5KL25.exe" wrote 00000004 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\Temp\IXP003.TMP\2OY8588.exe" (Handle: 652) "1KF13LI4.exe" wrote 00000004 bytes to a remote process "C:\Windows\SysWOW64\schtasks.exe" (Handle: 648) "1KF13LI4.exe" wrote 00000004 bytes to a remote process "C:\Windows\SysWOW64\schtasks.exe" (Handle: 1072) "2OY8588.exe" wrote 00000004 bytes to a remote process "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe" (Handle: 140) "2OY8588.exe" wrote 00000004 bytes to a remote process "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe" (Handle: 132) "2OY8588.exe" wrote 00000004 bytes to a remote process "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe" (Handle: 680) "2OY8588.exe" wrote 00000200 bytes to a remote process "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe" (Handle: 680) "2OY8588.exe" wrote 0002C000 bytes to a remote process "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe" (Handle: 680) "2OY8588.exe" wrote 0000AA00 bytes to a remote process "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe" (Handle: 680)71:T420,"1KF13LI4.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\15.0\OUTLOOK\PROFILES\OUTLOOK\9375CFF0413111D3B88A00104B2A6676") "1KF13LI4.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINDOWS MESSAGING SUBSYSTEM\PROFILES\OUTLOOK\9375CFF0413111D3B88A00104B2A6676") "1KF13LI4.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS MESSAGING SUBSYSTEM\PROFILES\9375CFF0413111D3B88A00104B2A6676") "1KF13LI4.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\16.0\OUTLOOK\PROFILES\OUTLOOK\9375CFF0413111D3B88A00104B2A6676") "1KF13LI4.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\16.0\OUTLOOK\PROFILES\OUTLOOK\9375CFF0413111D3B88A00104B2A6676\00000001") "1KF13LI4.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\16.0\OUTLOOK\PROFILES\OUTLOOK\9375CFF0413111D3B88A00104B2A6676\00000001"; Key: "EMAIL") "1KF13LI4.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\16.0\OUTLOOK\PROFILES\OUTLOOK\9375CFF0413111D3B88A00104B2A6676\00000002") "1KF13LI4.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\16.0\OUTLOOK\PROFILES\OUTLOOK\9375CFF0413111D3B88A00104B2A6676\00000002"; Key: "EMAIL")72:T26c5,"1KF13LI4.exe" trying to open a file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\SYNC EXTENSION SETTINGS\BHGHOAMAPCDPBOHPHIGOOOADDINPKBAI\CURRENT" "1KF13LI4.exe" trying to open a file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\LOCAL EXTENSION SETTINGS\BHGHOAMAPCDPBOHPHIGOOOADDINPKBAI\CURRENT" "1KF13LI4.exe" trying to open a file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Autofill\SYNC EXTENSION SETTINGS\BHGHOAMAPCDPBOHPHIGOOOADDINPKBAI\CURRENT" "1KF13LI4.exe" trying to open a file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Autofill\LOCAL EXTENSION SETTINGS\BHGHOAMAPCDPBOHPHIGOOOADDINPKBAI\CURRENT" "1KF13LI4.exe" trying to open a file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\AutoLaunchProtocolsComponent\SYNC EXTENSION SETTINGS\BHGHOAMAPCDPBOHPHIGOOOADDINPKBAI\CURRENT" "1KF13LI4.exe" trying to open a file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\AutoLaunchProtocolsComponent\LOCAL EXTENSION SETTINGS\BHGHOAMAPCDPBOHPHIGOOOADDINPKBAI\CURRENT" "1KF13LI4.exe" trying to open a file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics\SYNC EXTENSION SETTINGS\BHGHOAMAPCDPBOHPHIGOOOADDINPKBAI\CURRENT" "1KF13LI4.exe" trying to open a file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics\LOCAL EXTENSION SETTINGS\BHGHOAMAPCDPBOHPHIGOOOADDINPKBAI\CURRENT" "1KF13LI4.exe" trying to open a file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\CertificateRevocation\SYNC EXTENSION SETTINGS\BHGHOAMAPCDPBOHPHIGOOOADDINPKBAI\CURRENT" "1KF13LI4.exe" trying to open a file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\CertificateRevocation\LOCAL EXTENSION SETTINGS\BHGHOAMAPCDPBOHPHIGOOOADDINPKBAI\CURRENT" "1KF13LI4.exe" trying to open a file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Crashpad\SYNC EXTENSION SETTINGS\BHGHOAMAPCDPBOHPHIGOOOADDINPKBAI\CURRENT" "1KF13LI4.exe" trying to open a file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Crashpad\LOCAL EXTENSION SETTINGS\BHGHOAMAPCDPBOHPHIGOOOADDINPKBAI\CURRENT" "1KF13LI4.exe" trying to open a file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Default\SYNC EXTENSION SETTINGS\BHGHOAMAPCDPBOHPHIGOOOADDINPKBAI\CURRENT" "1KF13LI4.exe" trying to open a file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\BHGHOAMAPCDPBOHPHIGOOOADDINPKBAI\CURRENT" "1KF13LI4.exe" trying to open a file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\EADPData Component\SYNC EXTENSION SETTINGS\BHGHOAMAPCDPBOHPHIGOOOADDINPKBAI\CURRENT" "1KF13LI4.exe" trying to open a file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\EADPData Component\LOCAL EXTENSION SETTINGS\BHGHOAMAPCDPBOHPHIGOOOADDINPKBAI\CURRENT" "1KF13LI4.exe" trying to open a file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Edge Kids Mode\SYNC EXTENSION SETTINGS\BHGHOAMAPCDPBOHPHIGOOOADDINPKBAI\CURRENT" "1KF13LI4.exe" trying to open a file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Edge Kids Mode\LOCAL EXTENSION SETTINGS\BHGHOAMAPCDPBOHPHIGOOOADDINPKBAI\CURRENT" "1KF13LI4.exe" trying to open a file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Edge Shopping\SYNC EXTENSION SETTINGS\BHGHOAMAPCDPBOHPHIGOOOADDINPKBAI\CURRENT" "1KF13LI4.exe" trying to open a file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Edge Shopping\LOCAL EXTENSION SETTINGS\BHGHOAMAPCDPBOHPHIGOOOADDINPKBAI\CURRENT" "1KF13LI4.exe" trying to open a file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Edge Travel\SYNC EXTENSION SETTINGS\BHGHOAMAPCDPBOHPHIGOOOADDINPKBAI\CURRENT" "1KF13LI4.exe" trying to open a file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Edge Travel\LOCAL EXTENSION SETTINGS\BHGHOAMAPCDPBOHPHIGOOOADDINPKBAI\CURRENT" "1KF13LI4.exe" trying to open a file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\SYNC EXTENSION SETTINGS\BHGHOAMAPCDPBOHPHIGOOOADDINPKBAI\CURRENT" "1KF13LI4.exe" trying to open a file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\LOCAL EXTENSION SETTINGS\BHGHOAMAPCDPBOHPHIGOOOADDINPKBAI\CURRENT" "1KF13LI4.exe" trying to open a file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\SYNC EXTENSION SETTINGS\BHGHOAMAPCDPBOHPHIGOOOADDINPKBAI\CURRENT" "1KF13LI4.exe" trying to open a file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\LOCAL EXTENSION SETTINGS\BHGHOAMAPCDPBOHPHIGOOOADDINPKBAI\CURRENT" "1KF13LI4.exe" trying to open a file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\hyphen-data\SYNC EXTENSION SETTINGS\BHGHOAMAPCDPBOHPHIGOOOADDINPKBAI\CURRENT" "1KF13LI4.exe" trying to open a file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\hyphen-data\LOCAL EXTENSION SETTINGS\BHGHOAMAPCDPBOHPHIGOOOADDINPKBAI\CURRENT" "1KF13LI4.exe" trying to open a file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Nurturing\SYNC EXTENSION SETTINGS\BHGHOAMAPCDPBOHPHIGOOOADDINPKBAI\CURRENT" "1KF13LI4.exe" trying to open a file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Nurturing\LOCAL EXTENSION SETTINGS\BHGHOAMAPCDPBOHPHIGOOOADDINPKBAI\CURRENT" "1KF13LI4.exe" trying to open a file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\OriginTrials\SYNC EXTENSION SETTINGS\BHGHOAMAPCDPBOHPHIGOOOADDINPKBAI\CURRENT" "1KF13LI4.exe" trying to open a file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\OriginTrials\LOCAL EXTENSION SETTINGS\BHGHOAMAPCDPBOHPHIGOOOADDINPKBAI\CURRENT" "1KF13LI4.exe" trying to open a file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\RecoveryImproved\SYNC EXTENSION SETTINGS\BHGHOAMAPCDPBOHPHIGOOOADDINPKBAI\CURRENT" "1KF13LI4.exe" trying to open a file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\RecoveryImproved\LOCAL EXTENSION SETTINGS\BHGHOAMAPCDPBOHPHIGOOOADDINPKBAI\CURRENT" "1KF13LI4.exe" trying to open a file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Safe Browsing\SYNC EXTENSION SETTINGS\BHGHOAMAPCDPBOHPHIGOOOADDINPKBAI\CURRENT" "1KF13LI4.exe" trying to open a file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Safe Browsing\LOCAL EXTENSION SETTINGS\BHGHOAMAPCDPBOHPHIGOOOADDINPKBAI\CURRENT" "1KF13LI4.exe" trying to open a file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\SafetyTips\SYNC EXTENSION SETTINGS\BHGHOAMAPCDPBOHPHIGOOOADDINPKBAI\CURRENT" "1KF13LI4.exe" trying to open a file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\SafetyTips\LOCAL EXTENSION SETTINGS\BHGHOAMAPCDPBOHPHIGOOOADDINPKBAI\CURRENT" "1KF13LI4.exe" trying to open a file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\ShaderCache\SYNC EXTENSION SETTINGS\BHGHOAMAPCDPBOHPHIGOOOADDINPKBAI\CURRENT" "1KF13LI4.exe" trying to open a file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\ShaderCache\LOCAL EXTENSION SETTINGS\BHGHOAMAPCDPBOHPHIGOOOADDINPKBAI\CURRENT" "1KF13LI4.exe" trying to open a file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\SmartScreen\SYNC EXTENSION SETTINGS\BHGHOAMAPCDPBOHPHIGOOOADDINPKBAI\CURRENT" "1KF13LI4.exe" trying to open a file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\SmartScreen\LOCAL EXTENSION SETTINGS\BHGHOAMAPCDPBOHPHIGOOOADDINPKBAI\CURRENT" "1KF13LI4.exe" trying to open a file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Speech Recognition\SYNC EXTENSION SETTINGS\BHGHOAMAPCDPBOHPHIGOOOADDINPKBAI\CURRENT" "1KF13LI4.exe" trying to open a file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Speech Recognition\LOCAL EXTENSION SETTINGS\BHGHOAMAPCDPBOHPHIGOOOADDINPKBAI\CURRENT" "1KF13LI4.exe" trying to open a file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Subresource Filter\SYNC EXTENSION SETTINGS\BHGHOAMAPCDPBOHPHIGOOOADDINPKBAI\CURRENT" "1KF13LI4.exe" trying to open a file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Subresource Filter\LOCAL EXTENSION SETTINGS\BHGHOAMAPCDPBOHPHIGOOOADDINPKBAI\CURRENT" "1KF13LI4.exe" trying to open a file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Trust Protection Lists\SYNC EXTENSION SETTINGS\BHGHOAMAPCDPBOHPHIGOOOADDINPKBAI\CURRENT" "1KF13LI4.exe" trying to open a file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Trust Protection Lists\LOCAL EXTENSION SETTINGS\BHGHOAMAPCDPBOHPHIGOOOADDINPKBAI\CURRENT" "1KF13LI4.exe" trying to open a file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\UrlParamClassifications\SYNC EXTENSION SETTINGS\BHGHOAMAPCDPBOHPHIGOOOADDINPKBAI\CURRENT" "1KF13LI4.exe" trying to open a file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\UrlParamClassifications\LOCAL EXTENSION SETTINGS\BHGHOAMAPCDPBOHPHIGOOOADDINPKBAI\CURRENT"73:T29e5,1KF13LI4.exe trying to open a file \Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\SYNC EXTENSION SETTINGS\NKBIHFBEOGAEAOEHLEFNKODBEFGPGKNN\CURRENT related to MetaMask 1KF13LI4.exe trying to open a file \Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\LOCAL EXTENSION SETTINGS\NKBIHFBEOGAEAOEHLEFNKODBEFGPGKNN\CURRENT related to MetaMask 1KF13LI4.exe trying to open a file \Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Autofill\SYNC EXTENSION SETTINGS\NKBIHFBEOGAEAOEHLEFNKODBEFGPGKNN\CURRENT related to MetaMask 1KF13LI4.exe trying to open a file \Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Autofill\LOCAL EXTENSION SETTINGS\NKBIHFBEOGAEAOEHLEFNKODBEFGPGKNN\CURRENT related to MetaMask 1KF13LI4.exe trying to open a file \Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\AutoLaunchProtocolsComponent\SYNC EXTENSION SETTINGS\NKBIHFBEOGAEAOEHLEFNKODBEFGPGKNN\CURRENT related to MetaMask 1KF13LI4.exe trying to open a file \Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\AutoLaunchProtocolsComponent\LOCAL EXTENSION SETTINGS\NKBIHFBEOGAEAOEHLEFNKODBEFGPGKNN\CURRENT related to MetaMask 1KF13LI4.exe trying to open a file \Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics\SYNC EXTENSION SETTINGS\NKBIHFBEOGAEAOEHLEFNKODBEFGPGKNN\CURRENT related to MetaMask 1KF13LI4.exe trying to open a file \Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics\LOCAL EXTENSION SETTINGS\NKBIHFBEOGAEAOEHLEFNKODBEFGPGKNN\CURRENT related to MetaMask 1KF13LI4.exe trying to open a file \Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\CertificateRevocation\SYNC EXTENSION SETTINGS\NKBIHFBEOGAEAOEHLEFNKODBEFGPGKNN\CURRENT related to MetaMask 1KF13LI4.exe trying to open a file \Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\CertificateRevocation\LOCAL EXTENSION SETTINGS\NKBIHFBEOGAEAOEHLEFNKODBEFGPGKNN\CURRENT related to MetaMask 1KF13LI4.exe trying to open a file \Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Crashpad\SYNC EXTENSION SETTINGS\NKBIHFBEOGAEAOEHLEFNKODBEFGPGKNN\CURRENT related to MetaMask 1KF13LI4.exe trying to open a file \Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Crashpad\LOCAL EXTENSION SETTINGS\NKBIHFBEOGAEAOEHLEFNKODBEFGPGKNN\CURRENT related to MetaMask 1KF13LI4.exe trying to open a file \Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Default\SYNC EXTENSION SETTINGS\NKBIHFBEOGAEAOEHLEFNKODBEFGPGKNN\CURRENT related to MetaMask 1KF13LI4.exe trying to open a file \Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\NKBIHFBEOGAEAOEHLEFNKODBEFGPGKNN\CURRENT related to MetaMask 1KF13LI4.exe trying to open a file \Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\EADPData Component\SYNC EXTENSION SETTINGS\NKBIHFBEOGAEAOEHLEFNKODBEFGPGKNN\CURRENT related to MetaMask 1KF13LI4.exe trying to open a file \Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\EADPData Component\LOCAL EXTENSION SETTINGS\NKBIHFBEOGAEAOEHLEFNKODBEFGPGKNN\CURRENT related to MetaMask 1KF13LI4.exe trying to open a file \Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Edge Kids Mode\SYNC EXTENSION SETTINGS\NKBIHFBEOGAEAOEHLEFNKODBEFGPGKNN\CURRENT related to MetaMask 1KF13LI4.exe trying to open a file \Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Edge Kids Mode\LOCAL EXTENSION SETTINGS\NKBIHFBEOGAEAOEHLEFNKODBEFGPGKNN\CURRENT related to MetaMask 1KF13LI4.exe trying to open a file \Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Edge Shopping\SYNC EXTENSION SETTINGS\NKBIHFBEOGAEAOEHLEFNKODBEFGPGKNN\CURRENT related to MetaMask 1KF13LI4.exe trying to open a file \Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Edge Shopping\LOCAL EXTENSION SETTINGS\NKBIHFBEOGAEAOEHLEFNKODBEFGPGKNN\CURRENT related to MetaMask 1KF13LI4.exe trying to open a file \Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Edge Travel\SYNC EXTENSION SETTINGS\NKBIHFBEOGAEAOEHLEFNKODBEFGPGKNN\CURRENT related to MetaMask 1KF13LI4.exe trying to open a file \Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Edge Travel\LOCAL EXTENSION SETTINGS\NKBIHFBEOGAEAOEHLEFNKODBEFGPGKNN\CURRENT related to MetaMask 1KF13LI4.exe trying to open a file \Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\SYNC EXTENSION SETTINGS\NKBIHFBEOGAEAOEHLEFNKODBEFGPGKNN\CURRENT related to MetaMask 1KF13LI4.exe trying to open a file \Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\LOCAL EXTENSION SETTINGS\NKBIHFBEOGAEAOEHLEFNKODBEFGPGKNN\CURRENT related to MetaMask 1KF13LI4.exe trying to open a file \Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\SYNC EXTENSION SETTINGS\NKBIHFBEOGAEAOEHLEFNKODBEFGPGKNN\CURRENT related to MetaMask 1KF13LI4.exe trying to open a file \Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\LOCAL EXTENSION SETTINGS\NKBIHFBEOGAEAOEHLEFNKODBEFGPGKNN\CURRENT related to MetaMask 1KF13LI4.exe trying to open a file \Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\hyphen-data\SYNC EXTENSION SETTINGS\NKBIHFBEOGAEAOEHLEFNKODBEFGPGKNN\CURRENT related to MetaMask 1KF13LI4.exe trying to open a file \Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\hyphen-data\LOCAL EXTENSION SETTINGS\NKBIHFBEOGAEAOEHLEFNKODBEFGPGKNN\CURRENT related to MetaMask 1KF13LI4.exe trying to open a file \Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Nurturing\SYNC EXTENSION SETTINGS\NKBIHFBEOGAEAOEHLEFNKODBEFGPGKNN\CURRENT related to MetaMask 1KF13LI4.exe trying to open a file \Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Nurturing\LOCAL EXTENSION SETTINGS\NKBIHFBEOGAEAOEHLEFNKODBEFGPGKNN\CURRENT related to MetaMask 1KF13LI4.exe trying to open a file \Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\OriginTrials\SYNC EXTENSION SETTINGS\NKBIHFBEOGAEAOEHLEFNKODBEFGPGKNN\CURRENT related to MetaMask 1KF13LI4.exe trying to open a file \Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\OriginTrials\LOCAL EXTENSION SETTINGS\NKBIHFBEOGAEAOEHLEFNKODBEFGPGKNN\CURRENT related to MetaMask 1KF13LI4.exe trying to open a file \Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\RecoveryImproved\SYNC EXTENSION SETTINGS\NKBIHFBEOGAEAOEHLEFNKODBEFGPGKNN\CURRENT related to MetaMask 1KF13LI4.exe trying to open a file \Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\RecoveryImproved\LOCAL EXTENSION SETTINGS\NKBIHFBEOGAEAOEHLEFNKODBEFGPGKNN\CURRENT related to MetaMask 1KF13LI4.exe trying to open a file \Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Safe Browsing\SYNC EXTENSION SETTINGS\NKBIHFBEOGAEAOEHLEFNKODBEFGPGKNN\CURRENT related to MetaMask 1KF13LI4.exe trying to open a file \Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Safe Browsing\LOCAL EXTENSION SETTINGS\NKBIHFBEOGAEAOEHLEFNKODBEFGPGKNN\CURRENT related to MetaMask 1KF13LI4.exe trying to open a file \Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\SafetyTips\SYNC EXTENSION SETTINGS\NKBIHFBEOGAEAOEHLEFNKODBEFGPGKNN\CURRENT related to MetaMask 1KF13LI4.exe trying to open a file \Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\SafetyTips\LOCAL EXTENSION SETTINGS\NKBIHFBEOGAEAOEHLEFNKODBEFGPGKNN\CURRENT related to MetaMask 1KF13LI4.exe trying to open a file \Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\ShaderCache\SYNC EXTENSION SETTINGS\NKBIHFBEOGAEAOEHLEFNKODBEFGPGKNN\CURRENT related to MetaMask 1KF13LI4.exe trying to open a file \Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\ShaderCache\LOCAL EXTENSION SETTINGS\NKBIHFBEOGAEAOEHLEFNKODBEFGPGKNN\CURRENT related to MetaMask 1KF13LI4.exe trying to open a file \Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\SmartScreen\SYNC EXTENSION SETTINGS\NKBIHFBEOGAEAOEHLEFNKODBEFGPGKNN\CURRENT related to MetaMask 1KF13LI4.exe trying to open a file \Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\SmartScreen\LOCAL EXTENSION SETTINGS\NKBIHFBEOGAEAOEHLEFNKODBEFGPGKNN\CURRENT related to MetaMask 1KF13LI4.exe trying to open a file \Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Speech Recognition\SYNC EXTENSION SETTINGS\NKBIHFBEOGAEAOEHLEFNKODBEFGPGKNN\CURRENT related to MetaMask 1KF13LI4.exe trying to open a file \Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Speech Recognition\LOCAL EXTENSION SETTINGS\NKBIHFBEOGAEAOEHLEFNKODBEFGPGKNN\CURRENT related to MetaMask 1KF13LI4.exe trying to open a file \Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Subresource Filter\SYNC EXTENSION SETTINGS\NKBIHFBEOGAEAOEHLEFNKODBEFGPGKNN\CURRENT related to MetaMask 1KF13LI4.exe trying to open a file \Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Subresource Filter\LOCAL EXTENSION SETTINGS\NKBIHFBEOGAEAOEHLEFNKODBEFGPGKNN\CURRENT related to MetaMask 1KF13LI4.exe trying to open a file \Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Trust Protection Lists\SYNC EXTENSION SETTINGS\NKBIHFBEOGAEAOEHLEFNKODBEFGPGKNN\CURRENT related to MetaMask 1KF13LI4.exe trying to open a file \Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Trust Protection Lists\LOCAL EXTENSION SETTINGS\NKBIHFBEOGAEAOEHLEFNKODBEFGPGKNN\CURRENT related to MetaMask 1KF13LI4.exe trying to open a file \Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\UrlParamClassifications\SYNC EXTENSION SETTINGS\NKBIHFBEOGAEAOEHLEFNKODBEFGPGKNN\CURRENT related to MetaMask 1KF13LI4.exe trying to open a file \Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\UrlParamClassifications\LOCAL EXTENSION SETTINGS\NKBIHFBEOGAEAOEHLEFNKODBEFGPGKNN\CURRENT related to MetaMask74:T4e9,Spawned process "9ce01fdabd737268e2c5fe3da55fc969.exe" (UID: 00000000-00007120) Spawned process "Hl0Uw04.exe" (UID: 00000000-00006816) Spawned process "JK4zG29.exe" (UID: 00000000-00004708) Spawned process "wH5KL25.exe" (UID: 00000000-00006492) Spawned process "1KF13LI4.exe" (UID: 00000000-00007820) Spawned process "schtasks.exe" with commandline "schtasks /create /f /RU "%OSUSER%" /tr "%ALLUSERSPROFILE%\\OfficeTrackerNMP131\\OfficeTrackerNMP131.exe" /tn "OfficeTrackerNMP131 HR" /sc HOURLY /rl HIGHEST" (UID: 00000000-00005204) Spawned process "schtasks.exe" with commandline "schtasks /create /f /RU "%OSUSER%" /tr "%ALLUSERSPROFILE%\\OfficeTrackerNMP131\\OfficeTrackerNMP131.exe" /tn "OfficeTrackerNMP131 LG" /sc ONLOGON /rl HIGHEST" (UID: 00000000-00007232) Spawned process "WerFault.exe" with commandline "-pss -s 460 -p 7820 -ip 7820" (UID: 00000000-00000496) Spawned process "WerFault.exe" with commandline "-u -p 7820 -s 1284" (UID: 00000000-00000596) Spawned process "2OY8588.exe" (UID: 00000000-00000652) Spawned process "AppLaunch.exe" (UID: 00000000-00008140) Spawned process "AppLaunch.exe" (UID: 00000000-00000344) Spawned process "AppLaunch.exe" (UID: 00000000-00000712) Spawned process "3KZ60ye.exe" (UID: 00000000-00000632)75:T41d,Found string - return /^\S+@\S+\.\S+$/;; Source: "signin-split_1_.js") Found string - var EMAIL_PTN = /^\S+@\S+\.\S+$/;; Source: "signin-split_1_.js") Found string - !\uff01]/[!\uff01];["\uff02]/["\uff02];[\#\uff03]/[\#\uff03];[\$\uff04]/[\$\uff04];[%\uff05]/[%\uff05];[&\uff06]/[&\uff06];[\u0027\uff07]/[\u0027\uff07];[$\uff08]/[\(\uff08];[$\uff09]/[\)\uff09];[\*\uff0a]/[\*\uff0a];[\+\uff0b]/[\+\uff0b];[ \uff0c]/[ \uff0c];[-\uff0d]/[-\uff0d];[\.\uff0e]/[\.\uff0e];[\u002f\uff0f]/[\u002f\uff0f];[:\uff1a]/[:\uff1a];[\u003b\uff1b]/[\u003b\uff1b];[<\uff1c]/[<\uff1c];[=\uff1d]/[=\uff1d];[>\uff1e]/[>\uff1e];[\?\uff1f]/[\?\uff1f];[@\uff20]/[@\uff20];[\[\uff3b]/[\[\uff3b];[\\\\uff3c]/[\\\\uff3c];[]\uff3d]/[]\uff3d];[\^\uff3e]/[\^\uff3e];[_\uff3f]/[_\uff3f];[`\uff40]/[`\uff40];[\{\uff5b]/[\{\uff5b];[\|\uff5c]/[\|\uff5c];[}\uff5d]/[}\uff5d];[~\uff5e]/[~\uff5e];[\u3002\uff61]/[\u3002\uff61];[\u300C\uff62]/[\u300C\uff62];[\u300D\uff63]/[\u300D\uff63];[\u3001\uff64]/[\u3001\uff64]M; Source: "00000000-00002444.00000000.68740.02EB0000.00000002.mdmp")76:T5290,Contains base64 string in header "2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP" in header "GET /gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "2FUsCEHe9DWzbNvka6iEPxPBY0w0" in header "GET /gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "Keep" in header "GET /gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "User" in header "GET /gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "ocsp" in header "GET /gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "goog" in header "GET /gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "Keep" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "User" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "ocsp" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "digicert" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "Keep" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEAx5qUSwjBGVIJJhX%2BJrHYM%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "User" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEAx5qUSwjBGVIJJhX%2BJrHYM%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "ocsp" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEAx5qUSwjBGVIJJhX%2BJrHYM%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "digicert" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEAx5qUSwjBGVIJJhX%2BJrHYM%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "Keep" in header "GET /gtsr1/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBQwkcLWD4LqGJ7bE7B1XZsEbmfwUAQU5K8rJnEaK0gnhS9SZizv8IkTcT4CDQIDvFNZazTHGPUBUGY%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "User" in header "GET /gtsr1/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBQwkcLWD4LqGJ7bE7B1XZsEbmfwUAQU5K8rJnEaK0gnhS9SZizv8IkTcT4CDQIDvFNZazTHGPUBUGY%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "ocsp" in header "GET /gtsr1/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBQwkcLWD4LqGJ7bE7B1XZsEbmfwUAQU5K8rJnEaK0gnhS9SZizv8IkTcT4CDQIDvFNZazTHGPUBUGY%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "goog" in header "GET /gtsr1/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBQwkcLWD4LqGJ7bE7B1XZsEbmfwUAQU5K8rJnEaK0gnhS9SZizv8IkTcT4CDQIDvFNZazTHGPUBUGY%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "Keep" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D HTTP/1.1Cache-Control: max-age = 7200Connection: Keep-AliveAccept: */*If-Modified-Since: Wed, 29 Nov 2023 01:23:01 GMTUser-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "Modified" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D HTTP/1.1Cache-Control: max-age = 7200Connection: Keep-AliveAccept: */*If-Modified-Since: Wed, 29 Nov 2023 01:23:01 GMTUser-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "2023" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D HTTP/1.1Cache-Control: max-age = 7200Connection: Keep-AliveAccept: */*If-Modified-Since: Wed, 29 Nov 2023 01:23:01 GMTUser-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "ocsp" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D HTTP/1.1Cache-Control: max-age = 7200Connection: Keep-AliveAccept: */*If-Modified-Since: Wed, 29 Nov 2023 01:23:01 GMTUser-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "digicert" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D HTTP/1.1Cache-Control: max-age = 7200Connection: Keep-AliveAccept: */*If-Modified-Since: Wed, 29 Nov 2023 01:23:01 GMTUser-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "Keep" in header "GET /gts1c3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEFYyRZRleaQREjdgJW3R1jM%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "User" in header "GET /gts1c3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEFYyRZRleaQREjdgJW3R1jM%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "ocsp" in header "GET /gts1c3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEFYyRZRleaQREjdgJW3R1jM%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "goog" in header "GET /gts1c3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEFYyRZRleaQREjdgJW3R1jM%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEATh56TcXPLzbcArQrhdFZ8" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEATh56TcXPLzbcArQrhdFZ8%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "Keep" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEATh56TcXPLzbcArQrhdFZ8%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "User" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEATh56TcXPLzbcArQrhdFZ8%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "ocsp" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEATh56TcXPLzbcArQrhdFZ8%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "digicert" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEATh56TcXPLzbcArQrhdFZ8%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "Keep" in header "GET /gts1c3/moVDfISia2k.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: crls.pki.goog" Contains base64 string in header "User" in header "GET /gts1c3/moVDfISia2k.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: crls.pki.goog" Contains base64 string in header "crls" in header "GET /gts1c3/moVDfISia2k.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: crls.pki.goog" Contains base64 string in header "goog" in header "GET /gts1c3/moVDfISia2k.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: crls.pki.goog" Contains base64 string in header "Keep" in header "GET /gts1c3/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEQCLPpgizFvtXApe3cL6kC3u HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "User" in header "GET /gts1c3/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEQCLPpgizFvtXApe3cL6kC3u HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "ocsp" in header "GET /gts1c3/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEQCLPpgizFvtXApe3cL6kC3u HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "goog" in header "GET /gts1c3/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEQCLPpgizFvtXApe3cL6kC3u HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "2Bsl" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTPJvUY%2Bsl%2Bj4yzQuAcL2oQno5fCgQUUWj%2FkK8CB3U8zNllZGKiErhZcjsCEAq9F6UNEL2nYhx7xCvy3%2FI%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "Keep" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTPJvUY%2Bsl%2Bj4yzQuAcL2oQno5fCgQUUWj%2FkK8CB3U8zNllZGKiErhZcjsCEAq9F6UNEL2nYhx7xCvy3%2FI%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "User" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTPJvUY%2Bsl%2Bj4yzQuAcL2oQno5fCgQUUWj%2FkK8CB3U8zNllZGKiErhZcjsCEAq9F6UNEL2nYhx7xCvy3%2FI%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "ocsp" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTPJvUY%2Bsl%2Bj4yzQuAcL2oQno5fCgQUUWj%2FkK8CB3U8zNllZGKiErhZcjsCEAq9F6UNEL2nYhx7xCvy3%2FI%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "digicert" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTPJvUY%2Bsl%2Bj4yzQuAcL2oQno5fCgQUUWj%2FkK8CB3U8zNllZGKiErhZcjsCEAq9F6UNEL2nYhx7xCvy3%2FI%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "Keep" in header "GET /gts1c3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEF2rtEA6xK7GEl4nbt8ZZfk%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "User" in header "GET /gts1c3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEF2rtEA6xK7GEl4nbt8ZZfk%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "ocsp" in header "GET /gts1c3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEF2rtEA6xK7GEl4nbt8ZZfk%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "goog" in header "GET /gts1c3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEF2rtEA6xK7GEl4nbt8ZZfk%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "2BF8Rhvv" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSRXerF0eFeSWRripTgTkcJWMm7iQQUaDfg67Y7%2BF8Rhvv%2BYXsIiGX0TkICEATi7HzdaAMTTamxkE%2Fh8DM%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "2BYXsIiGX0TkICEATi7HzdaAMTTamxkE" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSRXerF0eFeSWRripTgTkcJWMm7iQQUaDfg67Y7%2BF8Rhvv%2BYXsIiGX0TkICEATi7HzdaAMTTamxkE%2Fh8DM%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "Keep" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSRXerF0eFeSWRripTgTkcJWMm7iQQUaDfg67Y7%2BF8Rhvv%2BYXsIiGX0TkICEATi7HzdaAMTTamxkE%2Fh8DM%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "User" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSRXerF0eFeSWRripTgTkcJWMm7iQQUaDfg67Y7%2BF8Rhvv%2BYXsIiGX0TkICEATi7HzdaAMTTamxkE%2Fh8DM%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "ocsp" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSRXerF0eFeSWRripTgTkcJWMm7iQQUaDfg67Y7%2BF8Rhvv%2BYXsIiGX0TkICEATi7HzdaAMTTamxkE%2Fh8DM%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "digicert" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSRXerF0eFeSWRripTgTkcJWMm7iQQUaDfg67Y7%2BF8Rhvv%2BYXsIiGX0TkICEATi7HzdaAMTTamxkE%2Fh8DM%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "2BtX" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfIs%2BLjDtGwQ09XEB1Yeq%2BtX%2BBgQQU7NfjgtJxXWRM3y5nP%2Be6mK4cD08CEAitQLJg0pxMn17Nqb2Trtk%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "2BBgQQU7NfjgtJxXWRM3y5nP" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfIs%2BLjDtGwQ09XEB1Yeq%2BtX%2BBgQQU7NfjgtJxXWRM3y5nP%2Be6mK4cD08CEAitQLJg0pxMn17Nqb2Trtk%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "Keep" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfIs%2BLjDtGwQ09XEB1Yeq%2BtX%2BBgQQU7NfjgtJxXWRM3y5nP%2Be6mK4cD08CEAitQLJg0pxMn17Nqb2Trtk%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "User" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfIs%2BLjDtGwQ09XEB1Yeq%2BtX%2BBgQQU7NfjgtJxXWRM3y5nP%2Be6mK4cD08CEAitQLJg0pxMn17Nqb2Trtk%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "ocsp" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfIs%2BLjDtGwQ09XEB1Yeq%2BtX%2BBgQQU7NfjgtJxXWRM3y5nP%2Be6mK4cD08CEAitQLJg0pxMn17Nqb2Trtk%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "digicert" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfIs%2BLjDtGwQ09XEB1Yeq%2BtX%2BBgQQU7NfjgtJxXWRM3y5nP%2Be6mK4cD08CEAitQLJg0pxMn17Nqb2Trtk%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "Keep" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBT3xL4LQLXDRDM9P665TW442vrsUQQUReuir%2FSSy4IxLVGLp6chnfNtyA8CEA6bGI750C3n79tQ4ghAGFo%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "User" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBT3xL4LQLXDRDM9P665TW442vrsUQQUReuir%2FSSy4IxLVGLp6chnfNtyA8CEA6bGI750C3n79tQ4ghAGFo%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "ocsp" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBT3xL4LQLXDRDM9P665TW442vrsUQQUReuir%2FSSy4IxLVGLp6chnfNtyA8CEA6bGI750C3n79tQ4ghAGFo%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "digicert" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBT3xL4LQLXDRDM9P665TW442vrsUQQUReuir%2FSSy4IxLVGLp6chnfNtyA8CEA6bGI750C3n79tQ4ghAGFo%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "2BrkS7QYXjzkCEAqvpsXKY8RRQeo74ffHUxc" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAqvpsXKY8RRQeo74ffHUxc%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "Keep" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAqvpsXKY8RRQeo74ffHUxc%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "User" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAqvpsXKY8RRQeo74ffHUxc%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "ocsp" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAqvpsXKY8RRQeo74ffHUxc%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "digicert" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAqvpsXKY8RRQeo74ffHUxc%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "Keep" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "User" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "ocsp" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "digicert" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com"77:T61b,Found reference to API "GetActiveWindow" (Indicator: "GetActiveWindow"; File: "00000000-00004052.00000000.69679.003B1000.00000020.mdmp") Found reference to API "GetWindowText" (Indicator: "GetWindowText"; Source: "00000000-00002364.00000000.68038.011E9000.00000004.mdmp") Found reference to API "FindWindow" (Indicator: "FindWindow"; Source: "00000000-00002364.00000000.68038.011E9000.00000004.mdmp") Found reference to API "GetActiveWindow" (Indicator: "GetActiveWindow"; Source: "00000000-00002364.00000000.68045.011C7000.00000002.mdmp") Found reference to API "GetForegroundWindow" (Indicator: "GetForegroundWindow"; Source: "00000000-00002444.00000000.68740.0135C000.00000002.mdmp") Found reference to API "GetWindowTextW" (Indicator: "GetWindowText"; Source: "00000000-00002444.00000000.68740.0135C000.00000002.mdmp") Found reference to API "EnumWindows" (Indicator: "EnumWindows"; Source: "00000000-00002444.00000000.68740.0135C000.00000002.mdmp") Found reference to API "FindWindowW" (Indicator: "FindWindow"; Source: "00000000-00002444.00000000.68740.0135C000.00000002.mdmp") Found reference to API "FindWindowExW" (Indicator: "FindWindow"; Source: "00000000-00002444.00000000.68740.0135C000.00000002.mdmp, 00000000-00002444.00000000.68740.6AFD1000.00000020.mdmp") Found reference to API "GetActiveWindow" (Indicator: "GetActiveWindow"; Source: "00000000-00002444.00000000.68740.0135C000.00000002.mdmp") Found reference to API "GetWindowTextLengthW" (Indicator: "GetWindowText"; Source: "00000000-00002444.00000000.68740.0135C000.00000002.mdmp")78:T536,"AppLaunch.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\WOW6432NODE\CLIENTS\STARTMENUINTERNET"; Key: ""; Value: "") "AppLaunch.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLIENTS\STARTMENUINTERNET"; Key: ""; Value: "") "AppLaunch.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLIENTS\STARTMENUINTERNET\FIREFOX-308046B0AF4A39CB"; Key: ""; Value: "") "AppLaunch.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLIENTS\STARTMENUINTERNET\FIREFOX-308046B0AF4A39CB"; Key: ""; Value: "") "AppLaunch.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLIENTS\STARTMENUINTERNET\FIREFOX-308046B0AF4A39CB\SHELL\OPEN\COMMAND"; Key: ""; Value: "") "AppLaunch.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLIENTS\STARTMENUINTERNET\FIREFOX-308046B0AF4A39CB\SHELL\OPEN\COMMAND"; Key: ""; Value: "") "AppLaunch.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLIENTS\STARTMENUINTERNET\IEXPLORE.EXE"; Key: ""; Value: "") "AppLaunch.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLIENTS\STARTMENUINTERNET\IEXPLORE.EXE"; Key: ""; Value: "") "AppLaunch.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLIENTS\STARTMENUINTERNET\IEXPLORE.EXE\SHELL\OPEN\COMMAND"; Key: ""; Value: "") "AppLaunch.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLIENTS\STARTMENUINTERNET\IEXPLORE.EXE\SHELL\OPEN\COMMAND"; Key: ""; Value: "")79:T2e46,"enforce_policyccpapaypal.com/1025407846438431146296364407627331072867cookie_checkpaypal.com/9217295496921631807729364626027731072867d_id501324bf91a64bce98ac76561763c3e71701223078969paypal.com/9217295496921631807729364688427831072867LANGen_US%3BUSpaypal.com/9217407956057631072944364704027831072867tsrceunifiedloginnodewebpaypal.com/9217417689369631073474364704027831072867l7_azdcg02.phxpaypal.com/9217287230400031072875364719627931072867vreXpYrS%3D1795917478%26vteXpYrS%3D1701224878%26vr%3D18cc1c0718c0a55358a7dc8ffad7366e%26vt%3D18cc1c0718c0a55358a7dc8ffad7366d%26vtyp%3Dnewpaypal.com/9217383607948831293147364719627931072867ts_cvr%3D18cc1c0718c0a55358a7dc8ffad7366e%26vt%3D18cc1c0718c0a55358a7dc8ffad7366dpaypal.com/1025383607948831293147364750827931072867" (Indicator: "paypal.com") "enforce_policyccpapaypal.com/1025407846438431146296364407627331072867cookie_checkpaypal.com/9217295496921631807729364626027731072867d_id501324bf91a64bce98ac76561763c3e71701223078969paypal.com/9217295496921631807729364688427831072867LANGen_US%3BUSpaypal.com/9217407956057631072944364704027831072867tsrceunifiedloginnodewebpaypal.com/9217417689369631073474364704027831072867l7_azdcg02.phxpaypal.com/9217287230400031072875364719627931072867vreXpYrS%3D1795831085%26vteXpYrS%3D1701224885%26vr%3D18cc1c0718c0a55358a7dc8ffad7366e%26vt%3D18cc1c0718c0a55358a7dc8ffad7366d%26vtyp%3Dnewpaypal.com/9217389607948831293147240291308931072868ts_cvr%3D18cc1c0718c0a55358a7dc8ffad7366e%26vt%3D18cc1c0718c0a55358a7dc8ffad7366dpaypal.com/1025383607948831293147364750827931072867" (Indicator: "paypal.com") "enforce_policyccpapaypal.com/1025407846438431146296364407627331072867cookie_checkpaypal.com/9217295496921631807729364626027731072867d_id501324bf91a64bce98ac76561763c3e71701223078969paypal.com/9217295496921631807729364688427831072867LANGen_US%3BUSpaypal.com/9217407956057631072944364704027831072867tsrceunifiedloginnodewebpaypal.com/9217417689369631073474364704027831072867l7_azdcg02.phxpaypal.com/9217287230400031072875364719627931072867vreXpYrS%3D1795831085%26vteXpYrS%3D1701224885%26vr%3D18cc1c0718c0a55358a7dc8ffad7366e%26vt%3D18cc1c0718c0a55358a7dc8ffad7366d%26vtyp%3Dnewpaypal.com/9217389607948831293147240291308931072868ts_cvr%3D18cc1c0718c0a55358a7dc8ffad7366e%26vt%3D18cc1c0718c0a55358a7dc8ffad7366dpaypal.com/1025389607948831293147240384909131072868" (Indicator: "paypal.com") "enforce_policyccpapaypal.com/1025407846438431146296364407627331072867cookie_checkpaypal.com/9217295496921631807729364626027731072867d_id501324bf91a64bce98ac76561763c3e71701223078969paypal.com/9217295496921631807729364688427831072867LANGen_US%3BUSpaypal.com/9217407956057631072944364704027831072867tsrceunifiedloginnodewebpaypal.com/9217417689369631073474364704027831072867l7_azdcg02.phxpaypal.com/9217287230400031072875364719627931072867vreXpYrS%3D1795917478%26vteXpYrS%3D1701224878%26vr%3D18cc1c0718c0a55358a7dc8ffad7366e%26vt%3D18cc1c0718c0a55358a7dc8ffad7366d%26vtyp%3Dnewpaypal.com/9217383607948831293147364719627931072867" (Indicator: "paypal.com") "enforce_policyccpapaypal.com/1025407846438431146296364407627331072867cookie_checkpaypal.com/9217295496921631807729364626027731072867d_id501324bf91a64bce98ac76561763c3e71701223078969paypal.com/9217295496921631807729364688427831072867LANGen_US%3BUSpaypal.com/9217407956057631072944364704027831072867tsrceunifiedloginnodewebpaypal.com/9217417689369631073474364704027831072867l7_azdcg02.phxpaypal.com/9217287230400031072875364719627931072867" (Indicator: "paypal.com") "enforce_policyccpapaypal.com/1025407846438431146296364407627331072867cookie_checkpaypal.com/9217295496921631807729364626027731072867d_id501324bf91a64bce98ac76561763c3e71701223078969paypal.com/9217295496921631807729364688427831072867LANGen_US%3BUSpaypal.com/9217407956057631072944364704027831072867tsrceunifiedloginnodewebpaypal.com/9217417689369631073474364704027831072867" (Indicator: "paypal.com") "enforce_policyccpapaypal.com/1025407846438431146296364407627331072867cookie_checkpaypal.com/9217295496921631807729364626027731072867d_id501324bf91a64bce98ac76561763c3e71701223078969paypal.com/9217295496921631807729364688427831072867LANGen_US%3BUSpaypal.com/9217407956057631072944364704027831072867" (Indicator: "paypal.com") "enforce_policyccpapaypal.com/1025407846438431146296364407627331072867cookie_checkpaypal.com/9217295496921631807729364626027731072867d_id501324bf91a64bce98ac76561763c3e71701223078969paypal.com/9217295496921631807729364688427831072867" (Indicator: "paypal.com") "enforce_policyccpapaypal.com/1025407846438431146296364407627331072867cookie_checkpaypal.com/9217295496921631807729364626027731072867" (Indicator: "paypal.com") "enforce_policyccpapaypal.com/1025407846438431146296364407627331072867" (Indicator: "paypal.com") "GET /signin HTTP/1.1Accept: text/html, application/xhtml+xml, */*Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: www.paypal.comDNT: 1Connection: Keep-Alive" (Indicator: "paypal.com") "8ffad7366d; Path=/; Domain=paypal.com; Expires=Sat, 28 Nov 2026 01:57:59 GMT; SecureTraceparent: 00-0000000000000000000f19262261e5c7-3f7097f0775093cd-01X-Content-Type-Options: nosniffX-Frame-Options: SAMEORIGINX-Xss-Protection: 1; mode=blockDC: ccg11-origin-www-1.paypal.comAccept-Ranges: bytesVia: 1.1 varnish, 1.1 varnish, 1.1 varnishDate: Wed, 29 Nov 2023 01:57:59 GMTStrict-Transport-Security: max-age=63072000; includeSubDomains; preloadX-Served-By: cache-bur-kbur8200088-BUR, cache-sjc10045-SJC, cache-sjc10045-SJCX-Cache: MISS, MISS, MISSX-Cache-Hits: 0, 0, 0X-Timer: S1701223079.894772,VS0,VE138Vary: Accept-EncodingServer-Timing: "traceparent;desc="00-0000000000000000000f19262261e5c7-4cd9eb5a88691b87-01"";content-encoding;desc="gzip",x-cdn;desc="fastly"transfer-encoding: chunked" (Indicator: "paypal.com") "GET /webcaptcha/ngrlCaptcha.min.js HTTP/1.1Accept: application/javascript, */*;q=0.8Referer: https://www.paypal.com/signinAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: www.paypalobjects.comDNT: 1Connection: Keep-Alive" (Indicator: "paypal.com") "HTTP/1.1 200 OKConnection: keep-aliveContent-Length: 6774Cache-Control: s-maxage=31536000, public,max-age=3600Content-Encoding: gzipContent-Type: application/javascriptEtag: W/"64ecc60d-5a30"Last-Modified: Mon, 28 Aug 2023 16:06:37 GMTPaypal-Debug-Id: 84dc4eec522baTiming-Allow-Origin: https://www.paypal.com,https://www.sandbox.paypal.comTraceparent: 00-000000000000000000084dc4eec522ba-0679dbc4b7bc2609-01DC: ccg11-origin-www-1.paypal.comAccept-Ranges: bytesDate: Wed, 29 Nov 2023 01:58:02 GMTVia: 1.1 varnishX-Served-By: cache-sjc1000145-SJCX-Cache: HITX-Cache-Hits: 14X-Timer: S1701223082.066162,VS0,VE0Vary: Accept-Encoding, Accept-EncodingX-Content-Type-Options: nosniffStrict-Transport-Security: max-age=31557600" (Indicator: "paypal.com") "GET /webstatic/mktg/2014design/font/PP-Sans/PayPalSansBig-Regular.eot? HTTP/1.1Accept: */*Referer: https://www.paypal.com/signinAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoOrigin: https://www.paypal.comAccept-Encoding: gzip, deflateHost: www.paypalobjects.comDNT: 1Connection: Keep-Alive" (Indicator: "paypal.com") "GET /pa/js/min/pa.js HTTP/1.1Accept: application/javascript, */*;q=0.8Referer: https://www.paypal.com/signinAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: www.paypalobjects.comDNT: 1Connection: Keep-Alive" (Indicator: "paypal.com") "GET /web/res/985/b7c27d784aef81253abdd166abc36/js/lib/modernizr-2.6.1.js HTTP/1.1Accept: application/javascript, */*;q=0.8Referer: https://www.paypal.com/signinAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: www.paypalobjects.comDNT: 1Connection: Keep-Alive" (Indicator: "paypal.com") "GET /webcaptcha/grcenterprise_v3_static.js HTTP/1.1Accept: application/javascript, */*;q=0.8Referer: https://www.paypal.com/signinAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: www.paypalobjects.comDNT: 1Connection: Keep-Alive" (Indicator: "paypal.com") "GET /web/res/985/b7c27d784aef81253abdd166abc36/js/lib/fn-sync-telemetry-min.js HTTP/1.1Accept: application/javascript, */*;q=0.8Referer: https://www.paypal.com/signinAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: www.paypalobjects.comDNT: 1Connection: Keep-Alive" (Indicator: "paypal.com") "GET /web/res/985/b7c27d784aef81253abdd166abc36/css/contextualLoginElementalUIv2.css HTTP/1.1Accept: text/css, */*Referer: https://www.paypal.com/signinAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: www.paypalobjects.comDNT: 1Connection: Keep-Alive" (Indicator: "paypal.com") "GET /images/shared/icon-PN-check.png HTTP/1.1Accept: image/png, image/svg+xml, image/*;q=0.8, */*;q=0.5Referer: https://www.paypal.com/signinAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: www.paypalobjects.comDNT: 1Connection: Keep-Alive" (Indicator: "paypal.com") "GET /web/res/985/b7c27d784aef81253abdd166abc36/js/signin-split.js HTTP/1.1Accept: application/javascript, */*;q=0.8Referer: https://www.paypal.com/signinAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: www.paypalobjects.comDNT: 1Connection: Keep-Alive" (Indicator: "paypal.com") "GET /images/shared/glyph_alert_critical_big-2x.png HTTP/1.1Accept: image/png, image/svg+xml, image/*;q=0.8, */*;q=0.5Referer: https://www.paypal.com/signinAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: www.paypalobjects.comDNT: 1Connection: Keep-Alive" (Indicator: "paypal.com") "HTTP/1.1 200 OKConnection: keep-aliveContent-Length: 24607Access-Control-Allow-Headers: x-csrf-tokenContent-Encoding: gzipContent-Type: text/cssEtag: W/"65575377-25c40"Expires: Sat, 16 Nov 2024 12:22:00 GMTLast-Modified: Fri, 17 Nov 2023 11:50:15 GMTPaypal-Debug-Id: 4dce0d5bd3943Timing-Allow-Origin: https://www.paypal.com,https://www.sandbox.paypal.comTraceparent: 00-00000000000000000004dce0d5bd3943-8769f66a321fff28-01DC: ccg11-origin-www-1.paypal.comAccept-Ranges: bytesDate: Wed, 29 Nov 2023 01:58:02 GMTVia: 1.1 varnishX-Served-By: cache-sjc1000145-SJCX-Cache: HITX-Cache-Hits: 2X-Timer: S1701223083.542118,VS0,VE0Vary: Accept-Encoding, Accept-EncodingX-Content-Type-Options: nosniffCache-Control: max-age=31536000ACCESS-CONTROL-ALLOW-ORIGIN: *ACCESS-CONTROL-ALLOW-METHODS: GETStrict-Transport-Security: max-age=31557600" (Indicator: "paypal.com") "HTTP/1.1 200 OKConnection: keep-aliveContent-Length: 99899Content-Encoding: gzipContent-Type: application/javascriptEtag: W/"65575377-723d2"Expires: Sat, 16 Nov 2024 12:32:19 GMTLast-Modified: Fri, 17 Nov 2023 11:50:15 GMTPaypal-Debug-Id: 1e61edf5c7200Timing-Allow-Origin: https://www.paypal.com,https://www.sandbox.paypal.comTraceparent: 00-00000000000000000001e61edf5c7200-18a6d71e8e9a289e-01DC: ccg11-origin-www-1.paypal.comAccept-Ranges: bytesDate: Wed, 29 Nov 2023 01:58:02 GMTVia: 1.1 varnishX-Served-By: cache-sjc1000138-SJCX-Cache: HITX-Cache-Hits: 1X-Timer: S1701223083.529012,VS0,VE1Vary: Accept-Encoding, Accept-EncodingX-Content-Type-Options: nosniffCache-Control: max-age=31536000ACCESS-CONTROL-ALLOW-ORIGIN: *ACCESS-CONTROL-ALLOW-METHODS: GETACCESS-CONTROL-ALLOW-HEADERS: x-csrf-tokenStrict-Transport-Security: max-age=31557600" (Indicator: "paypal.com")7a:T2bf0,"GET /gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.pki.goog" Response ==> HTTP/1.1 200 OK Server: ocsp_responder Content-Length: 1445 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Date: Wed 29 Nov 2023 01:24:12 GMT Cache-Control: public max-age=14400 Content-Type: application/ocsp-response Age: 2026 with response body ==>308205A10A0100A082059A3082059606092B0601050507300101048205873082058330819EA2160414D49BADF2AB3CB9FF1A3E0C506DCF192780868DAA180F32....... "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.digicert.com" Response ==> HTTP/1.1 200 OK Accept-Ranges: bytes Age: 2097 Cache-Control: max-age=7200 Content-Type: application/ocsp-response Date: Wed 29 Nov 2023 01:57:58 GMT Last-Modified: Wed 29 Nov 2023 01:23:01 GMT Server: ECAcc (sac/2551) X-Cache: HIT Content-Length: 471 with response body ==>308201D30A0100A08201CC308201C806092B0601050507300101048201B9308201B530819EA216041403DE503556D14CBB66F0A3E21B1BC397B23DD155180F32....... "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEAx5qUSwjBGVIJJhX%2BJrHYM%3D HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.digicert.com" Response ==> HTTP/1.1 200 OK Accept-Ranges: bytes Age: 219 Cache-Control: max-age=7200 Content-Type: application/ocsp-response Date: Wed 29 Nov 2023 01:57:58 GMT Last-Modified: Wed 29 Nov 2023 01:54:19 GMT Server: ECAcc (sac/2507) X-Cache: HIT Content-Length: 471 with response body ==>308201D30A0100A08201CC308201C806092B0601050507300101048201B9308201B530819EA2160414B13EC36903F8BF4701D498261A0802EF63642BC3180F32....... "GET /gtsr1/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBQwkcLWD4LqGJ7bE7B1XZsEbmfwUAQU5K8rJnEaK0gnhS9SZizv8IkTcT4CDQIDvFNZazTHGPUBUGY%3D HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.pki.goog" Response ==> HTTP/1.1 200 OK Server: ocsp_responder Content-Length: 724 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Date: Wed 29 Nov 2023 01:16:58 GMT Cache-Control: public max-age=14400 Content-Type: application/ocsp-response Age: 2462 with response body ==>308202D00A0100A08202C9308202C506092B0601050507300101048202B6308202B230819BA2160414E4AF2B26711A2B4827852F52662CEFF08913713E180F32....... "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D HTTP/1.1 Cache-Control: max-age = 7200 Connection: Keep-Alive Accept: */* If-Modified-Since: Wed, 29 Nov 2023 01:23:01 GMT User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.digicert.com" Response ==> HTTP/1.1 304 Not Modified Accept-Ranges: bytes Age: 2100 Cache-Control: max-age=7200 Date: Wed 29 Nov 2023 01:58:01 GMT Last-Modified: Wed 29 Nov 2023 01:23:01 GMT Server: ECAcc (sac/2551) X-Cache: HIT with response body ==>....... "GET /gtsr1/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBQwkcLWD4LqGJ7bE7B1XZsEbmfwUAQU5K8rJnEaK0gnhS9SZizv8IkTcT4CDQIDvFNZazTHGPUBUGY%3D HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.pki.goog" Response ==> HTTP/1.1 200 OK Server: ocsp_responder Content-Length: 724 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Date: Wed 29 Nov 2023 01:16:58 GMT Cache-Control: public max-age=14400 Content-Type: application/ocsp-response Age: 2464 with response body ==>308202D00A0100A08202C9308202C506092B0601050507300101048202B6308202B230819BA2160414E4AF2B26711A2B4827852F52662CEFF08913713E180F32....... "GET /gts1c3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEFYyRZRleaQREjdgJW3R1jM%3D HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.pki.goog" Response ==> HTTP/1.1 200 OK Server: ocsp_responder Content-Length: 471 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Date: Wed 29 Nov 2023 01:01:07 GMT Cache-Control: public max-age=14400 Content-Type: application/ocsp-response Age: 3416 with response body ==>308201D30A0100A08201CC308201C806092B0601050507300101048201B9308201B530819EA21604148A747FAF85CDEE95CD3D9CD0E24614F371351D27180F32....... "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEATh56TcXPLzbcArQrhdFZ8%3D HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.digicert.com" Response ==> HTTP/1.1 200 OK Accept-Ranges: bytes Age: 75 Cache-Control: max-age=7200 Content-Type: application/ocsp-response Date: Wed 29 Nov 2023 01:58:03 GMT Last-Modified: Wed 29 Nov 2023 01:56:48 GMT Server: ECAcc (sac/254A) X-Cache: HIT Content-Length: 471 with response body ==>308201D30A0100A08201CC308201C806092B0601050507300101048201B9308201B530819EA2160414B13EC36903F8BF4701D498261A0802EF63642BC3180F32....... "GET /gts1c3/moVDfISia2k.crl HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: crls.pki.goog" Response ==> HTTP/1.1 200 OK Accept-Ranges: bytes Content-Security-Policy-Report-Only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/cacerts Cross-Origin-Resource-Policy: cross-origin Cross-Origin-Opener-Policy: same-origin; report-to="cacerts" Report-To: {"group":"cacerts" "max_age":2592000 "endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/cacerts"}]} Content-Length: 12274 X-Content-Type-Options: nosniff Server: sffe X-XSS-Protection: 0 Date: Wed 29 Nov 2023 01:25:12 GMT Expires: Wed 29 Nov 2023 02:15:12 GMT Cache-Control: public max-age=3000 Last-Modified: Wed 29 Nov 2023 00:44:04 GMT Content-Type: application/pkix-crl Vary: Accept-Encoding Age: 1973 with response body ==>30822FEE30822ED6020101300D06092A864886F70D01010B05003046310B300906035504061302555331223020060355040A1319476F6F676C65205472757374....... "GET /gts1c3/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEQCLPpgizFvtXApe3cL6kC3u HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.pki.goog" Response ==> HTTP/1.1 200 OK Server: ocsp_responder Content-Length: 472 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Date: Wed 29 Nov 2023 01:25:37 GMT Cache-Control: public max-age=14400 Content-Type: application/ocsp-response Age: 1948 with response body ==>308201D40A0100A08201CD308201C906092B0601050507300101048201BA308201B630819FA21604148A747FAF85CDEE95CD3D9CD0E24614F371351D27180F32....... "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTPJvUY%2Bsl%2Bj4yzQuAcL2oQno5fCgQUUWj%2FkK8CB3U8zNllZGKiErhZcjsCEAq9F6UNEL2nYhx7xCvy3%2FI%3D HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.digicert.com" Response ==> HTTP/1.1 200 OK Accept-Ranges: bytes Age: 4710 Cache-Control: max-age=7200 Content-Type: application/ocsp-response Date: Wed 29 Nov 2023 01:58:06 GMT Last-Modified: Wed 29 Nov 2023 00:39:36 GMT Server: ECAcc (sac/254D) X-Cache: HIT Content-Length: 471 with response body ==>308201D30A0100A08201CC308201C806092B0601050507300101048201B9308201B530819EA21604145168FF90AF0207753CCCD9656462A212B859723B180F32....... "GET /gts1c3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEF2rtEA6xK7GEl4nbt8ZZfk%3D HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.pki.goog" Response ==> HTTP/1.1 200 OK Server: ocsp_responder Content-Length: 471 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Date: Wed 29 Nov 2023 01:45:38 GMT Cache-Control: public max-age=14400 Content-Type: application/ocsp-response Age: 752 with response body ==>308201D30A0100A08201CC308201C806092B0601050507300101048201B9308201B530819EA21604148A747FAF85CDEE95CD3D9CD0E24614F371351D27180F32....... "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSRXerF0eFeSWRripTgTkcJWMm7iQQUaDfg67Y7%2BF8Rhvv%2BYXsIiGX0TkICEATi7HzdaAMTTamxkE%2Fh8DM%3D HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.digicert.com" Response ==> HTTP/1.1 200 OK Accept-Ranges: bytes Age: 4690 Cache-Control: max-age=7200 Content-Type: application/ocsp-response Date: Wed 29 Nov 2023 01:58:48 GMT Last-Modified: Wed 29 Nov 2023 00:40:38 GMT Server: ECAcc (sac/2530) X-Cache: HIT Content-Length: 727 with response body ==>308202D30A0100A08202CC308202C806092B0601050507300101048202B9308202B530819EA21604146837E0EBB63BF85F1186FBFE617B088865F44E42180F32....... "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfIs%2BLjDtGwQ09XEB1Yeq%2BtX%2BBgQQU7NfjgtJxXWRM3y5nP%2Be6mK4cD08CEAitQLJg0pxMn17Nqb2Trtk%3D HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.digicert.com" Response ==> HTTP/1.1 200 OK Accept-Ranges: bytes Age: 5449 Cache-Control: max-age=7200 Content-Type: application/ocsp-response Date: Wed 29 Nov 2023 01:58:48 GMT Last-Modified: Wed 29 Nov 2023 00:27:59 GMT Server: ECAcc (sac/255F) X-Cache: HIT Content-Length: 727 with response body ==>308202D30A0100A08202CC308202C806092B0601050507300101048202B9308202B530819EA2160414ECD7E382D2715D644CDF2E673FE7BA98AE1C0F4F180F32....... "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBT3xL4LQLXDRDM9P665TW442vrsUQQUReuir%2FSSy4IxLVGLp6chnfNtyA8CEA6bGI750C3n79tQ4ghAGFo%3D HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.digicert.com" Response ==> HTTP/1.1 200 OK Accept-Ranges: bytes Age: 4357 Cache-Control: max-age=7200 Content-Type: application/ocsp-response Date: Wed 29 Nov 2023 01:58:48 GMT Last-Modified: Wed 29 Nov 2023 00:46:11 GMT Server: ECAcc (sac/254D) X-Cache: HIT Content-Length: 471 with response body ==>308201D30A0100A08201CC308201C806092B0601050507300101048201B9308201B530819EA216041445EBA2AFF492CB82312D518BA7A7219DF36DC80F180F32....... "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAqvpsXKY8RRQeo74ffHUxc%3D HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.digicert.com" Response ==> HTTP/1.1 200 OK Accept-Ranges: bytes Age: 3746 Cache-Control: max-age=7200 Content-Type: application/ocsp-response Date: Wed 29 Nov 2023 01:58:54 GMT Last-Modified: Wed 29 Nov 2023 00:56:28 GMT Server: ECAcc (sac/252C) X-Cache: HIT Content-Length: 471 with response body ==>308201D30A0100A08201CC308201C806092B0601050507300101048201B9308201B530819EA21604144E2254201895E6E36EE60FFAFAB912ED06178F39180F32....... "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.digicert.com" Response ==> HTTP/1.1 200 OK Accept-Ranges: bytes Age: 4674 Cache-Control: max-age=7200 Content-Type: application/ocsp-response Date: Wed 29 Nov 2023 01:58:55 GMT Last-Modified: Wed 29 Nov 2023 00:41:01 GMT Server: ECAcc (sac/2561) X-Cache: HIT Content-Length: 471 with response body ==>308201D30A0100A08201CC308201C806092B0601050507300101048201B9308201B530819EA21604144E2254201895E6E36EE60FFAFAB912ED06178F39180F32.......7b:T681,"schtasks.exe" (Access type: "OPEN"; Path: "HKCU\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}"; Key: ""; Value: "") "schtasks.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}"; Key: ""; Value: "") "schtasks.exe" (Access type: "OPEN"; Path: "HKCU\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\TREATAS"; Key: ""; Value: "") "schtasks.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\TREATAS"; Key: ""; Value: "") "schtasks.exe" (Access type: "OPEN"; Path: "HKCU\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\PROGID"; Key: ""; Value: "") "schtasks.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\PROGID"; Key: ""; Value: "") "schtasks.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\PROGID"; Key: ""; Value: "") "schtasks.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}"; Key: ""; Value: "") "schtasks.exe" (Access type: "OPEN"; Path: "HKCU\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\INPROCSERVER32"; Key: ""; Value: "") "schtasks.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\INPROCSERVER32"; Key: ""; Value: "") "schtasks.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\INPROCSERVER32"; Key: "INPROCSERVER32"; Value: "") "schtasks.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\INPROCSERVER32"; Key: ""; Value: "")7c:T8ed,Found http requests in header "GET /gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D" Found http requests in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D" Found http requests in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEAx5qUSwjBGVIJJhX%2BJrHYM%3D" Found http requests in header "GET /gtsr1/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBQwkcLWD4LqGJ7bE7B1XZsEbmfwUAQU5K8rJnEaK0gnhS9SZizv8IkTcT4CDQIDvFNZazTHGPUBUGY%3D" Found http requests in header "GET /gts1c3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEFYyRZRleaQREjdgJW3R1jM%3D" Found http requests in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEATh56TcXPLzbcArQrhdFZ8%3D" Found http requests in header "GET /gts1c3/moVDfISia2k.crl" Found http requests in header "GET /gts1c3/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEQCLPpgizFvtXApe3cL6kC3u" Found http requests in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTPJvUY%2Bsl%2Bj4yzQuAcL2oQno5fCgQUUWj%2FkK8CB3U8zNllZGKiErhZcjsCEAq9F6UNEL2nYhx7xCvy3%2FI%3D" Found http requests in header "GET /gts1c3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEF2rtEA6xK7GEl4nbt8ZZfk%3D" Found http requests in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSRXerF0eFeSWRripTgTkcJWMm7iQQUaDfg67Y7%2BF8Rhvv%2BYXsIiGX0TkICEATi7HzdaAMTTamxkE%2Fh8DM%3D" Found http requests in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfIs%2BLjDtGwQ09XEB1Yeq%2BtX%2BBgQQU7NfjgtJxXWRM3y5nP%2Be6mK4cD08CEAitQLJg0pxMn17Nqb2Trtk%3D" Found http requests in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBT3xL4LQLXDRDM9P665TW442vrsUQQUReuir%2FSSy4IxLVGLp6chnfNtyA8CEA6bGI750C3n79tQ4ghAGFo%3D" Found http requests in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAqvpsXKY8RRQeo74ffHUxc%3D" Found http requests in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D"7d:T3325,Found requests in header "GET /InteractiveLogin?continue=https://accounts.google.com/&followup=https://accounts.google.com/&passive=1209600&ifkv=ASKXGp3M2GWHo-OhRBdl90NpVwXWhxqvG7Muwe6D0IVzpLp_0bnmCj14xwyygy2oORoE5tzwtrBA8Q HTTP/1.1Accept: text/html, application/xhtml+xml, */*Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: accounts.google.comConnection: Keep-AliveDNT: 1Cookie: __Host-GAPS=1:Tdj3EqxENNPPY8xKdKzlNg14d-nvEg:BgKzyZxryuExJj1I"; in File: "SSL") Found requests in header "GET / HTTP/1.1Accept: text/html, application/xhtml+xml, */*Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: accounts.google.comDNT: 1Connection: Keep-Alive"; in File: "SSL") Found requests in header "GET /ServiceLogin?passive=1209600&continue=https%3A%2F%2Faccounts.google.com%2F&followup=https%3A%2F%2Faccounts.google.com%2F HTTP/1.1Accept: text/html, application/xhtml+xml, */*Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: accounts.google.comCookie: __Host-GAPS=1:Tdj3EqxENNPPY8xKdKzlNg14d-nvEg:BgKzyZxryuExJj1IConnection: Keep-AliveDNT: 1"; in File: "SSL") Found requests in header "GET /v3/signin/identifier?continue=https%3A%2F%2Faccounts.google.com%2F&followup=https%3A%2F%2Faccounts.google.com%2F&ifkv=ASKXGp01BwS9P8lG4Am8APvy764i-OBxAVJRJ0oBK_nUenD6nqlr6EAmGQf6bZXjX76G57Q0PlWK&passive=1209600&flowName=GlifWebSignIn&flowEntry=ServiceLogin&dsh=S1275186505%3A1701223084055846&theme=glif HTTP/1.1Accept: text/html, application/xhtml+xml, */*Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: accounts.google.comDNT: 1Connection: Keep-AliveCookie: __Host-GAPS=1:hRObo2DZbd0QvMumQvHbsVgivM1SOA:P1KCGszDmx01KpFJ"; in File: "SSL") Found requests in header "GET /favicon.ico HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoHost: accounts.google.comDNT: 1Connection: Keep-AliveCookie: __Host-GAPS=1:hRObo2DZbd0QvMumQvHbsVgivM1SOA:P1KCGszDmx01KpFJ"; in File: "SSL") Found requests in header "GET /ServiceLogin?passive=1209600&continue=https%3A%2F%2Faccounts.google.com%2F&followup=https%3A%2F%2Faccounts.google.com%2F HTTP/1.1Accept: text/html, application/xhtml+xml, */*Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: accounts.google.comDNT: 1Connection: Keep-AliveCookie: __Host-GAPS=1:m6_PlxG6DcomKljHQIhSWQ7q7UFHbA:g7ma3QQjqST3CU27"; in File: "SSL") Found requests in header "GET /InteractiveLogin?continue=https://accounts.google.com/&followup=https://accounts.google.com/&passive=1209600&ifkv=ASKXGp1shVrvnXqGtS_jJ0sT7M4MWSf5B4N3xf2exn4Ny4Sm3MjaqUPYKdNvSFu9OS5ASYiGOvXhuQ HTTP/1.1Accept: text/html, application/xhtml+xml, */*Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: accounts.google.comCookie: __Host-GAPS=1:m6_PlxG6DcomKljHQIhSWQ7q7UFHbA:g7ma3QQjqST3CU27Connection: Keep-AliveDNT: 1"; in File: "SSL") Found requests in header "GET /v3/signin/identifier?continue=https%3A%2F%2Faccounts.google.com%2F&followup=https%3A%2F%2Faccounts.google.com%2F&ifkv=ASKXGp2ib_XDgq6xbmfcojVOVObx3ZRi0busv8n8DvqRbhINOJb00q1aRfY6235lq_XtAQ1Qp5ZiGQ&passive=1209600&flowName=GlifWebSignIn&flowEntry=ServiceLogin&dsh=S2014026541%3A1701223089629630&theme=glif HTTP/1.1Accept: text/html, application/xhtml+xml, */*Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: accounts.google.comConnection: Keep-AliveDNT: 1Cookie: __Host-GAPS=1:m6_PlxG6DcomKljHQIhSWQ7q7UFHbA:g7ma3QQjqST3CU27"; in File: "SSL") Found requests in header "GET / HTTP/1.1Accept: text/html, application/xhtml+xml, */*Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: accounts.google.comDNT: 1Connection: Keep-AliveCookie: __Host-GAPS=1:hRObo2DZbd0QvMumQvHbsVgivM1SOA:P1KCGszDmx01KpFJ"; in File: "SSL") Found requests in header "GET /ServiceLogin?passive=1209600&continue=https%3A%2F%2Faccounts.google.com%2F&followup=https%3A%2F%2Faccounts.google.com%2F HTTP/1.1Accept: text/html, application/xhtml+xml, */*Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: accounts.google.comDNT: 1Connection: Keep-AliveCookie: __Host-GAPS=1:FBXfAEOf2hGBpvsgWmXQIQ1pVzWBZg:cw5K9U7BP8M5YHPQ"; in File: "SSL") Found requests in header "GET /InteractiveLogin?continue=https://accounts.google.com/&followup=https://accounts.google.com/&passive=1209600&ifkv=ASKXGp350grQwwzca1jFvq4j53lKtf-FXrXhsEv4lT3hwDLZzP7MLBqGbdqR1bKVaGX9fgc1hMIxDg HTTP/1.1Accept: text/html, application/xhtml+xml, */*Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: accounts.google.comCookie: __Host-GAPS=1:m6_PlxG6DcomKljHQIhSWQ7q7UFHbA:g7ma3QQjqST3CU27Connection: Keep-AliveDNT: 1"; in File: "SSL") Found requests in header "GET /v3/signin/identifier?continue=https%3A%2F%2Faccounts.google.com%2F&followup=https%3A%2F%2Faccounts.google.com%2F&ifkv=ASKXGp09z5eFqE6mPINu5nqpxWW3WgDwqWL9XyDDcKSaaoguOZZtvVlGQBKEqQ2r1avXj2zG7zLOXg&passive=1209600&flowName=GlifWebSignIn&flowEntry=ServiceLogin&dsh=S-988849344%3A1701223089699083&theme=glif HTTP/1.1Accept: text/html, application/xhtml+xml, */*Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: accounts.google.comConnection: Keep-AliveDNT: 1Cookie: __Host-GAPS=1:m6_PlxG6DcomKljHQIhSWQ7q7UFHbA:g7ma3QQjqST3CU27"; in File: "SSL") Found requests in header "GET /favicon.ico HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoHost: accounts.google.comDNT: 1Connection: Keep-AliveCookie: __Host-GAPS=1:m6_PlxG6DcomKljHQIhSWQ7q7UFHbA:g7ma3QQjqST3CU27; OTZ=7315297_52_52_123900_48_436380"; in File: "SSL") Found requests in header "GET /generate_204?VFI_Tw HTTP/1.1Accept: image/png, image/svg+xml, image/*;q=0.8, */*;q=0.5Referer: https://accounts.google.com/Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: accounts.google.comDNT: 1Connection: Keep-AliveCookie: __Host-GAPS=1:c-yeovt7F6PUE8JOa21ntLYT7bV-xQ:OX8K0T4qtYhcx8Pm; OTZ=7315297_52_52_123900_48_436380"; in File: "SSL") Found requests in header "POST /v3/signin/_/AccountsSignInUi/data/batchexecute?rpcids=UEkKwb&source-path=%2Fv3%2Fsignin%2Fidentifier&f.sid=1317271321563379849&bl=boq_identityfrontendauthuiserver_20231112.08_p0&hl=en-US&_reqid=9440&rt=c HTTP/1.1Accept: */*X-Same-Domain: 1x-goog-ext-278367001-jspb: ["GlifWebSignIn"]x-goog-ext-391502476-jspb: ["S2014026541:1701223089629630",null,null,"ASKXGp2ib_XDgq6xbmfcojVOVObx3ZRi0busv8n8DvqRbhINOJb00q1aRfY6235lq_XtAQ1Qp5ZiGQ"]Content-Type: application/x-www-form-urlencoded;charset=utf-8Referer: https://accounts.google.com/Accept-Language: en-USAccept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoHost: accounts.google.comContent-Length: 165DNT: 1Connection: Keep-AliveCache-Control: no-cacheCookie: __Host-GAPS=1:c-yeovt7F6PUE8JOa21ntLYT7bV-xQ:OX8K0T4qtYhcx8Pm; OTZ=7315297_52_52_123900_48_436380"; in File: "SSL") Found requests in header "GET /_/bscframe HTTP/1.1Accept: text/html, application/xhtml+xml, */*Referer: https://accounts.google.com/Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: accounts.google.comDNT: 1Connection: Keep-AliveCookie: __Host-GAPS=1:c-yeovt7F6PUE8JOa21ntLYT7bV-xQ:OX8K0T4qtYhcx8Pm; OTZ=7315297_52_52_123900_48_436380"; in File: "SSL") Found requests in header "POST /v3/signin/_/AccountsSignInUi/data/batchexecute?rpcids=UEkKwb&source-path=%2Fv3%2Fsignin%2Fidentifier&f.sid=3543217775908096395&bl=boq_identityfrontendauthuiserver_20231112.08_p0&hl=en-US&_reqid=9441&rt=c HTTP/1.1Accept: */*X-Same-Domain: 1x-goog-ext-278367001-jspb: ["GlifWebSignIn"]x-goog-ext-391502476-jspb: ["S-988849344:1701223089699083",null,null,"ASKXGp09z5eFqE6mPINu5nqpxWW3WgDwqWL9XyDDcKSaaoguOZZtvVlGQBKEqQ2r1avXj2zG7zLOXg"]Content-Type: application/x-www-form-urlencoded;charset=utf-8Referer: https://accounts.google.com/Accept-Language: en-USAccept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoHost: accounts.google.comContent-Length: 165DNT: 1Connection: Keep-AliveCache-Control: no-cacheCookie: __Host-GAPS=1:jwQUE1hUVXvmjLBy7gBZpYgAauLjGw:KdBXB5FtXLL2TxEF; OTZ=7315297_52_52_123900_48_436380"; in File: "SSL") Found requests in header "GET /_/bscframe HTTP/1.1Accept: text/html, application/xhtml+xml, */*Referer: https://accounts.google.com/Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: accounts.google.comDNT: 1Connection: Keep-AliveCookie: __Host-GAPS=1:jwQUE1hUVXvmjLBy7gBZpYgAauLjGw:KdBXB5FtXLL2TxEF; OTZ=7315297_52_52_123900_48_436380"; in File: "SSL") Found requests in header "GET /generate_204?9BectA HTTP/1.1Accept: image/png, image/svg+xml, image/*;q=0.8, */*;q=0.5Referer: https://accounts.google.com/Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: accounts.google.comDNT: 1Connection: Keep-AliveCookie: __Host-GAPS=1:VdMogGa4vj69w3BKJYE6i1ecrZfcAg:YM7sJhOMe3Gn-XHo; OTZ=7315297_52_52_123900_48_436380"; in File: "SSL") Found requests in header "GET /v3/signin/_/AccountsSignInUi/gen204/?tmambps=0.00014059405940594058&rtembps=-1&rttms=1 HTTP/1.1Accept: image/png, image/svg+xml, image/*;q=0.8, */*;q=0.5Referer: https://accounts.google.com/Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: accounts.google.comDNT: 1Connection: Keep-AliveCookie: __Host-GAPS=1:VdMogGa4vj69w3BKJYE6i1ecrZfcAg:YM7sJhOMe3Gn-XHo; OTZ=7315297_52_52_123900_48_436380; NID=511=lLfFCIh6JeVXgJ7P8lE3VATcLXdvr7ja643eWqi-I9ki29c-12ex8OdQTxVjagyxDOHZyu4YSHNexL5RkKQpAkBRF1iaF9TKGHwBCa5SFi18KSS4LDCwXbZPDe98F5dJSaTKFNHctPtM4A9MWFC4U0MG1TT4hWQIJu5NKwMvbOA"; in File: "SSL") Found requests in header "GET /signin HTTP/1.1Accept: text/html, application/xhtml+xml, */*Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: www.paypal.comDNT: 1Connection: Keep-Alive"; in File: "SSL") Found requests in header "GET /login HTTP/1.1Accept: text/html, application/xhtml+xml, */*User-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateDNT: 1Host: www.facebook.comConnection: Keep-AliveAccept-Language: en-US"; in File: "SSL") Found requests in header "POST /login/device-based/regular/login/?login_attempt=1&lwv=100 HTTP/1.1Accept: text/html, application/xhtml+xml, */*Referer: https://www.facebook.com/loginAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoContent-Type: application/x-www-form-urlencodedAccept-Encoding: gzip, deflateHost: www.facebook.comContent-Length: 391DNT: 1Connection: Keep-AliveCache-Control: no-cacheCookie: fr=0X1qMEAjxO0zHSRE3..BlZpqt.xx.AAA.0.0.BlZpqt.AWWy155JiKA; sb=rZpmZcss2R-AQijsIDCzegU-; _js_datr=rZpmZS4QhO8v83YCDrWz1MT9jazoest=2837&lsd=AVo8-5euL6I&display=&isprivate=&return_session=&skip_api_login=&signed_next=&trynum=1&timezone=&lgndim=eyJ3IjoxMjgwLCJoIjo4MDAsImF3IjoxMjgwLCJhaCI6NzYwLCJjIjoyNH0%3D&lgnrnd=175805_z2zn&lgnjs=n&email=&pass=&login=1&prefill_contact_point=&prefill_source=&prefill_type=&first_prefill_source=&first_prefill_type=&had_cp_prefilled=false&had_password_prefilled=false&ab_test_data="; in File: "SSL") Found requests in header "GET /supported_browsers?next_url=https%3A%2F%2Fwww.youtube.com%2F HTTP/1.1Accept: text/html, application/xhtml+xml, */*Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: www.youtube.comCookie: CONSENT=WP.2676baConnection: Keep-AliveDNT: 1"; in File: "SSL") Found requests in header "GET /img/desktop/supported_browsers/dinosaur.png HTTP/1.1Accept: image/png, image/svg+xml, image/*;q=0.8, */*;q=0.5Referer: https://www.youtube.com/supported_browsers?next_url=https%3A%2F%2Fwww.youtube.com%2FAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: www.youtube.comDNT: 1Connection: Keep-AliveCookie: CONSENT=WP.2676ba; hideBrowserUpgradeBox=true; YSC=8VcguTx_nTI; VISITOR_INFO1_LIVE=7E5kOhz7ULQ; VISITOR_PRIVACY_METADATA=CgJVUxICGgA%3D"; in File: "SSL")7e:T84dc,"GET /InteractiveLogin?continue=https://accounts.google.com/&followup=https://accounts.google.com/&passive=1209600&ifkv=ASKXGp3M2GWHo-OhRBdl90NpVwXWhxqvG7Muwe6D0IVzpLp_0bnmCj14xwyygy2oORoE5tzwtrBA8Q HTTP/1.1Accept: text/html, application/xhtml+xml, */*Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: accounts.google.comConnection: Keep-AliveDNT: 1Cookie: __Host-GAPS=1:Tdj3EqxENNPPY8xKdKzlNg14d-nvEg:BgKzyZxryuExJj1I" "GET / HTTP/1.1Accept: text/html, application/xhtml+xml, */*Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: accounts.google.comDNT: 1Connection: Keep-Alive" "GET /ServiceLogin?passive=1209600&continue=https%3A%2F%2Faccounts.google.com%2F&followup=https%3A%2F%2Faccounts.google.com%2F HTTP/1.1Accept: text/html, application/xhtml+xml, */*Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: accounts.google.comCookie: __Host-GAPS=1:Tdj3EqxENNPPY8xKdKzlNg14d-nvEg:BgKzyZxryuExJj1IConnection: Keep-AliveDNT: 1" "HTTP/1.1 302 FoundContent-Type: application/binaryCache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Wed, 29 Nov 2023 01:58:03 GMTLocation: https://accounts.google.com/InteractiveLogin?continue=https://accounts.google.com/&followup=https://accounts.google.com/&passive=1209600&ifkv=ASKXGp3M2GWHo-OhRBdl90NpVwXWhxqvG7Muwe6D0IVzpLp_0bnmCj14xwyygy2oORoE5tzwtrBA8QStrict-Transport-Security: max-age=31536000; includeSubDomainsAccept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factor, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionCross-Origin-Resource-Policy: cross-originPermissions-Policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factor=*, ch-ua-platform=*, ch-ua-platform-version=*Cross-Origin-Opener-Policy: unsafe-noneContent-Security-Policy: script-src 'nonce-R9kCGu8XsONEs4eaG3a9ww' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/AccountsSigninPassiveLoginHttp/cspreport;worker-src 'self'Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/AccountsSigninPassiveLoginHttp/cspreportServer: ESFContent-Length: 0X-XSS-Protection: 0X-Content-Type-Options: nosniffAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000" "HTTP/1.1 302 Moved TemporarilyContent-Type: text/html; charset=UTF-8Strict-Transport-Security: max-age=31536000; includeSubDomainsSet-Cookie: __Host-GAPS=1:Tdj3EqxENNPPY8xKdKzlNg14d-nvEg:BgKzyZxryuExJj1I;Path=/;Expires=Fri, 28-Nov-2025 01:58:03 GMT;Secure;HttpOnly;Priority=HIGHX-Frame-Options: DENYContent-Security-Policy: script-src 'nonce-xvALT5hBe7X96TMyx9J63g' 'unsafe-inline' 'unsafe-eval';object-src 'none';base-uri 'self';report-uri /cspreportLocation: https://accounts.google.com/ServiceLogin?passive=1209600&continue=https%3A%2F%2Faccounts.google.com%2F&followup=https%3A%2F%2Faccounts.google.com%2FContent-Encoding: gzipDate: Wed, 29 Nov 2023 01:58:03 GMTExpires: Wed, 29 Nov 2023 01:58:03 GMTCache-Control: private, max-age=0X-Content-Type-Options: nosniffX-XSS-Protection: 1; mode=blockServer: GSEAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Transfer-Encoding: chunked" "0000000100000001�0000000100000001000000010000000100000001000000010000000100000001�00000001�e2PAj�0��B!=ZN��u��X�K_E�1��ax%�u��~�7Q�8z�IN��#��_�o�d��)��2�Q|&��Ht@ΨfƑNZ��:eJ;�F�ĘTg�l�"��5{�i��f7Jk��6y|H�;��g��f�4��s%˳��À��x��fL�Y�ž�K��P�/��@�R", "HTTP/1.1 302 Moved TemporarilyContent-Type: text/html; charset=UTF-8Set-Cookie: __Host-GAPS=1:hRObo2DZbd0QvMumQvHbsVgivM1SOA:P1KCGszDmx01KpFJ;Path=/;Expires=Fri 28-Nov-2025 01:58:04 GMT;Secure;HttpOnly;Priority=HIGHX-Frame-Options: DENYCache-Control: no-cache no-store max-age=0 must-revalidatePragma: no-cacheExpires: Mon 01 Jan 1990 00:00:00 GMTDate: Wed 29 Nov 2023 01:58:04 GMTLocation: https://accounts.google.com/v3/signin/identifier?continue=https%3A%2F%2Faccounts.google.com%2F&followup=https%3A%2F%2Faccounts.google.com%2F&ifkv=ASKXGp01BwS9P8lG4Am8APvy764i-OBxAVJRJ0oBK_nUenD6nqlr6EAmGQf6bZXjX76G57Q0PlWK&passive=1209600&flowName=GlifWebSignIn&flowEntry=ServiceLogin&dsh=S1275186505%3A1701223084055846&theme=glifStrict-Transport-Security: max-age=31536000; includeSubDomainsCross-Origin-Opener-Policy-Report-Only: same-origin; report-to="coop_gse_qebhlk"Report-To: {"group":"coop_gse_qebhlk" "max_age":2592000 "endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gse_qebhlk"}]}Content-Security-Policy: require-trusted-types-for 'script';report-uri /cspreportContent-Security-Policy: script-src 'nonce-BzkxfkAhaQ-F85zozMrKfg' 'unsafe-inline' 'unsafe-eval';object-src 'none';base-uri 'self';report-uri /cspreportContent-Encoding: gzipX-Content-Type-Options: nosniffX-XSS-Protection: 1; mode=blockServer: GSEAlt-Svc: h3=":443"; ma=2592000 h3-29=":443"; ma=2592000Transfer-Encoding: chunked", "GET /v3/signin/identifier?continue=https%3A%2F%2Faccounts.google.com%2F&followup=https%3A%2F%2Faccounts.google.com%2F&ifkv=ASKXGp01BwS9P8lG4Am8APvy764i-OBxAVJRJ0oBK_nUenD6nqlr6EAmGQf6bZXjX76G57Q0PlWK&passive=1209600&flowName=GlifWebSignIn&flowEntry=ServiceLogin&dsh=S1275186505%3A1701223084055846&theme=glif HTTP/1.1Accept: text/html application/xhtml+xml */*Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip deflateHost: accounts.google.comDNT: 1Connection: Keep-AliveCookie: __Host-GAPS=1:hRObo2DZbd0QvMumQvHbsVgivM1SOA:P1KCGszDmx01KpFJ", "HTTP/1.1 200 OKContent-Type: text/html; charset=utf-8X-Frame-Options: DENYVary: Sec-Fetch-Dest Sec-Fetch-Mode Sec-Fetch-Sitex-auto-login: realm=com.google&args=continue%3Dhttps://accounts.google.com/x-ua-compatible: IE=edgeCache-Control: no-cache no-store max-age=0 must-revalidatePragma: no-cacheExpires: Mon 01 Jan 1990 00:00:00 GMTDate: Wed 29 Nov 2023 01:58:04 GMTStrict-Transport-Security: max-age=31536000; includeSubDomainsAccept-CH: Sec-CH-UA-Arch Sec-CH-UA-Bitness Sec-CH-UA-Full-Version Sec-CH-UA-Full-Version-List Sec-CH-UA-Model Sec-CH-UA-WoW64 Sec-CH-UA-Form-Factor Sec-CH-UA-Platform Sec-CH-UA-Platform-VersionCross-Origin-Opener-Policy-Report-Only: same-origin; report-to="AccountsSignInUi"Permissions-Policy: ch-ua-arch=* ch-ua-bitness=* ch-ua-full-version=* ch-ua-full-version-list=* ch-ua-model=* ch-ua-wow64=* ch-ua-form-factor=* ch-ua-platform=* ch-ua-platform-version=*Report-To: {"group":"AccountsSignInUi" "max_age":2592000 "endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/AccountsSignInUi"}]}Content-Security-Policy: require-trusted-types-for 'script';report-uri /v3/signin/_/AccountsSignInUi/cspreportContent-Security-Policy: script-src 'nonce-TNda0UD4s2cuOxhU21_mLA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /v3/signin/_/AccountsSignInUi/cspreport;worker-src 'self'Cross-Origin-Resource-Policy: same-siteContent-Encoding: gzipServer: ESFX-XSS-Protection: 0X-Content-Type-Options: nosniffAlt-Svc: h3=":443"; ma=2592000 h3-29=":443"; ma=2592000Transfer-Encoding: chunked", "0000000100000001�000000010000000100000001000000010000000100000001001176�R�R�0}�W08��h�T�N��^��m�š4@�V��w2��9gv�D��Kg�ѧ�˟��5Z�8e9-��']�4:��4��g��n�j��gO��RcՎ� �@�:C�⒠��Cn��&�TU^�B��&Uً)�S�i&4}��1�D�F�F�}HYFjd��nv�;�Y�:�??)=��8�h�-vvD��WZj`��UsR��q�/�<��5o��B>�B�`f�#e��{ߩ�-�k�J��V5�7�%0T��&{2d�)��h�}g�e��8*"��:��ቒ*��"��$�@��>�@��ª1�)�H��=�ښ�~�o�1�", "0000000100000001�0000000100000001000000010000000100000001000000010000000100000001�00000001�00000001X00000001[00000001w00000001�00000001�0000000100000001~00000001�00000001�001�b94^�)�M�͝Pw��IK��K�-��@��~F��i��K�O��h.|��y*]�8eR��l��ۡ�Ҭ@l��˂I�O��zs��y��s��-G�2\�=��(�"�l�A�!�z.�.�/��Q˧)Qthi�054!�z��FWo[E�W��y��N�!|-W��ܤ�mj؞��)۞�S/B��z��p,Y��[NG�ud��j��?��p��J�R�J��$Vb� %`p�M�Oxˠ�U��N��"�@躷�덻ww �C�fQ4��QE��~��j4�X�ȷH��95��M@��V7륵Ta<��T-��ұT�|� V�b�T-�7˝ �İl�A�|�T.פP��K�]�ѣ�1�W�c�?7O�Y鞔+b�f�mY��ѰEǰ�S�wn�ه�b�X��%)ͣ�F��ϣ�lw�#(=��|�/qվ��ڕ7��>��4P5uiJ��b��^��Ҵ$ŕ��~|��F��G��Dѓ��i\��,��u��h4x��׾��;|��Q�o�]{�o�S݋��/qR��>s�4t��Ko��R��,W�7�,��I3"��}/zѩ��/ժ��3,��N��0��äٸ�,�f^_��x|��b�I��;{��煒3K#r��>�)��,��o8~̅�"ʢ�=��I)[�B��7��Gg��ek��lt�h�j�t�%uWy3�>#C�{��X�-��Mءx�SK�,�҃(h,��-��y1_��|9'V��;�;u��O#A��#�׭e�"|by�P�C�5:j��`s�7��1ɘK�[8x�]`}ԃɣ��X�5=��*�<7�S��#��m��6ڨ:/m��f�d�C��(AE��{$L�#�ŏ�vή1�6Z)�8wظ��Ѱ��Etp`|=��L�xr�B��j�S��4*Y�C�"��Ę�0�d�wC�nx��0ܑ�TI�7�:N`wPE��X��v�а��d�1��f�|��^0%�s�{�[�<��wi1�/�*�N}u��k��vi��ήP|��0��$Pq�XZ?��N�`�1��8��E6��Ag`hP�g�܆��y3��n�E<� p/�Ci��f�ſ�6}so{��et�6��q/��{�|Db��Z��)��H�$&j�1�o#q�X(�V��K�]<@��_�|�#�Q��\~��#!�", "lk��Q��Xdf�ű�]�ϼy��C��~�ť(0p<�:�܎��.�@%bqD�W��1�iz��֒<��A��?��*D8oN��X<��v˧Bk�S�O@�Jgm_$�&�o�Ğ'�tlK�`�'�O;��1��tk�U�Sl8��bU)��ɲ1>��Խ�n��>�A��p:7zY�v�tW)wJ��ڞ\��K��rE^�Ǌ�s_�U��m�xs��7��c#�a>Nc�I"��!��ݛU�-��)��h��sQ=� �v��Va��ސ��Ixљ De�n/b�Q�[�ue dO�y͟ ��Gb��y��׬�6nfQ��}^9c̫��4YZ��Y�Ⱥ8�*z��*)j�f&��q:�)-q��Q�4�au�v�f�l�0��i��+zc*Me�?��F�?��(.��b:QM��kEt}8��f�ٺo��t}/ݕ�Wsc��m��ݫ�eT�^��תw^;�!-S:��˹v��b�� l�C�?��n�I��Bo��P,��z�t�(��`>u[�z��M�[��J��¸1h��Jd:iz��{^��N�Q��S˱sq��U�Լ�}~�i0]7��Ƈ��{��\}S|�{_�_��2ۿg��>w�7�μ|��"4�T��9�d�MV�Q��emy��ԡ8V��̱��K�R��vp��\/�[<��@�\c7ʹha��:��F��`�|�Ԗ��]�Z H&�w2�3�۝ng^ =��>P��2/쎆�g��ć��F��k�3� &'+b�p�wd��=?��l8��ט�yE9�E:�p�P�S!��Z��֫�%��J�9��9�i!��k�M��.� �2f�'@��4�;��o��H+\m��ZW��;̄��DSn^VRZױ۶��7��|liZ{��E��p��[�ȼ0qyO]��ˎ�1�,f0~�b-��ط��zQ��#��E��8��>��e_x�P�(�J�� >�Ł�B-�Aʀ�]��Y��/`�X0�~Y��J0�5�Yx��Ŕ��(a�V^_믙��l;MM�d��5U�ϙ��)<�^�UJN}V��_\��+��HW�X�_�\/ו�\�'G��s˅Ǹ�S��k�Q۱;�NqT^�%��o��v[<", "�/��y�զ��㷗*��P�z�f��)\��", "00000001�01]102as�6�+�v:cM��f�N��v�Ď�4�N'C�� )��}q�A��G&��w~T��=i��[9��p��o�fa��]��L�^�3g��r��f�v��<;�yg��俛�?s�[�<�#��?��4��`��[|?6{�@u��߆Ʒ�2��9��i4�~w�>ܟ^|��{7Pi6�|q�y��_�w�l6��%wv��1̍OC��5�G��A��}��<�eؘ�#�`9��0@�C��7�/g��p�H��=��C��s�m��kVsf!X��7�T�_D��=ȡq�S��dX3��w?�ϖL·�W|�=��dd��9H]Fa��c4)�t��\O�`�w��:�+g~��c�0�r�E�c��_{(:$l��m d�OR��'��]��`Sr��b��`üP��w�_e�|�(��0C�bV��$��3dӍ�3�\(�.eo~��Oݠ7�� +�&0�2%Sqg�MZn�δ)�t��Kd�D�#5�gfy09��9��C� Է��;��w��0�E�3d9��j�}�(��M;.��"bW՗��m#5�"�q74d^��>V��z��p��d�}:��CJ��@_��4�ړ��몾?H��?��82�pI0�%�~JL�O��2c��C�==�/^"��A䚔�e�7 o,��22y��ߎh�;ɞ[̞[�=W�HʈH�b:�(�P�r�3'a��<��%�?�S�s�|��4�A�j�|�@��_!��fBx1�̝�iT�u�myA�I&5|�L��?��oG��r��e��Վp�f��9��w�(��x1��t�\��,[&uC��o3N��PM��B��j-T�K��+Eǽ�ڇc�\N�1O;��1z�ϑ��g_��,{N.�ᅷ��Ԕv{yK�W�?R;Ɵ��e/o�/F��uNN>��kp�_�6}3��m2��W��b�Z��+�\�.��v�O�1q��7�̜[�f�$+��ÍA��qT��1�d�z��a��nW ��NU��l�ח��?��e�R�qj��h"��[�WHkhA��ڜ�,"�q��(�N�Zc:��%�Ke�ϯ��_�l�O�� Њ��zSo�"�d.$", "��4�L��d6?@��$C�V�U]d�NT��~4��y��#�yÙ��|�J-��Qj}~Qj�X�r�ڒ"��t�k9dsi�M�g��N��e�7x�y��֫/�|"�+oR�`��x��Õ?��ġB��)j.��6��n��4��]޲6G)c��kc��j�c��H��j��@E��3�vк3��+"9dv)�O`�8@�j�ڀ5*��.Ώ5E8y�*\�B.~Tx12��3��ȷH�4��V�\��$d��%��2�֘-��x~��@�k�g:2)�(OV�"P��@�~�D�|��5[�nf�4�1Ͷv�N�@8��=[J�sު+毤�R�m��U�m��י:��t݅Q��H�� jC��Xk�X�KT�[S�.�9ƝMu��1Xm��F�fudV.�-�b��=�S�fX�vo"oU[��Xx�63�D��F�>?��S��R*S��ZQm/*�K��V�-??-��bQ��9m:t�KƎ)�eGй,��r��1ĝ� ��a��3�u�,��mz=|��p#�}l~�M��U�R�&�_��p2c�alXy�`w�I��g��:�4'"��.3�cA͜N�gP��VӿJ��x��=�g�oE<�'��z`��%ۨ4E6��c3�-ks��T��q��Z��:P_��+��X�F��iHEZ�Z��N�3,Z+iu9��D{��|M��_�X��.U8��+v�Y�^_r�ez��$GI6̹�n��E�954P�]��b��B.�2p�0x��|��ㄞ+��gR�(�7�:��d%��M��'�_�ص{a#�^~��Փ��]p��M7?��M�9O��h�eԖNz�y��n[�J��И��@�ޅ��q��o��q��d��*壜>qc��PKyjyz��i��M�H��b[P�W=��i��x�� S\ٷ�2�qC�фe!�f%s�1e�4��^>��$m��]��>�0B�� ?�D��r��it�Fw۪�2��@��P��6��K��H"��$�A�Ӳ�V�hu5C�K��D�\��ɓM�̆�_{ULْ9�uB8j�;]�ٮxXru��}4G>"\�͠d/DK�z�w��x�YM�B�*�F�V_e��Z�*��6_P��*�$s��χ��t�Ϫ�Ț�QQ��5_Fq��Hw3%N�rS၉��m�?�f��Q�%��9d��H��(�kk{=��vˬ��i��鹤&J�>�&�8?x�m(\�rttk]�\��*{�E&�n̯6[�S�7��퉾J&��t�8��r��OݸR��(0PZ\p.��r�QW�*��+I�$�؏�ǩ�c�:��N��X��*j�9+�js�طp�2T2��_h��X��Rla�o��?V��^A��X��U5�~b��V)��]�}v�ǫ?�#i�@�-��a��#?�6�F�w�.�9��5��3~a|��v��Ĵ�j��djj"�uy^t+,)՜��W8�f��BW�n��FZ�p��>l��+J�8EUN[�6��%�Ĕh�Zׄ�b��*�3�nWŝ��", ""�b��", "00000001�00000001]00000001m00000001o00000001�0000000160000000100000001�00000001+00000001�00000001R00000001�18f3�T�cW�1`ɲ"뚶i�vE��M'Nb;��"��EJ")�E�V��/w��(ňӹCZ"�Nbd��M�R�Xt�3R�v��+RM��Je#�A�#AO3�+�h��1�R��ƜPl��C5��H�B5p��fL�B5��u��}>��~��z��S�/H˰��N��[��"S��N�cfQ(WR��yI��N^:8��VN;�w��\�9�k�*F|%�PO��5@-�6p� �e$��af�j��~�Vy:)ѓP�`1Ʋ��Z9�X��/�Ya�#�1�K�E��J�_ �nd��{w0��T��u�.��6�'�1O�I�F��i.��7L��,�i7�{ubн:A��E΢�j��lӱ��T䥃K�(��KE�U�U��nT:��UF��9.Ҫ��f u>��8h��f$��"nft��p�:�Åu��4�a N��~7�B��;?�6#�0#�)@*iY�@�t[;;� Y�z��J�Y�̥i8˝@!'�Q��KXĈ��z&XT�l��-��U��Z�]�B=�{�q�[:3�%C�Z�8��e5!�l��Wk�Xⴝ��8�U\�͌�qj��qH�ׅ8��;ht�'�*7�n��.��쵀�I�'��{_L>})��A|�=)o�q'��O�_8��K�Re�H��}z��b�uh�k陛�f3f�4�BX��;X��ߗ^�ɶz|psp�"�Z[��ޢ�j��l��Ĝ��a-zY�n�� _�5�ft�+�u2Q_��\̘z�7�Da��1��P�k��.��`X��~ܚ�&�e��Oj�+f1��P�W�7"1�UTf��>�*�M��ݧ��?�>��#&]��h�x>��'W��K�oq�D?r�� RSP�Y=X��棏�n��W�z�ܤ;LDt�'7��鵲�~�2�F�(��f:��~�E�L<_ϼ8)�b��s�6�3g�÷�i�t��9��H��Uk��v��t�C�j-?p�Z`��p�.�^�0�-�Ԫ^��", "1�$��)��E��n�ZPN� |��q�M��`4��Z��M>��wY;M�ڜ�V��!i�þTWlX��.��>Vs_k�u9%ߎ�o�Gi�1E��KE��$A��֊��˛�wr4��*hŭ$�X ͔b<��SS4��p^�!��WPi��K+�� R��lħMfg�� h�� A�3�p/��w��M9��3J.-�K��b�iG�*7D�'�*-)Śu��nn]R�e�1e1Y��@w�h0E��`��xL�ស�{��}��:U�+v�ӌ�~��r�Z�O+*�[��Ͳ=Kf��/��]t;Azs�7p�^�v�:��*Z��l2M�7Kto��>�Ȇ��d�!B�ҋY6��~�B�?V�:�y�0G��So��C�q��t��D+bFe��1�Bh�y��ŉ��9��s5t��l��Xzp�A?+�t]�0�_�4T�Y�� Ft�Uo4X��w�;[��N�vSTV��x�L�So�4��Q�N��|��H��tr�F�bLl/�j�(gL��~Nf��@�2"�"G�)��@��Lh�I,,��2�K7'ފ�|��}�h�3�_�#tʰ�I/��r�4J!!��m:�e�K��e4cy��u��q[��KD��p]#�B�Đ8V��<��IѐM��}�y`H촷�-��9*�g�N~��h�Ǘ8OgG��{�0}��o�&��p��M4��'ڴHV�?޿FQX��4$%w4��%��8�ռV�>o7R��PZۗL��W�O&7X9՝P�\-aG��@r��"\��6u��8��a�c�f�垌U=|�d�osR�m^��\�=�5?D��uT�5��R��1v]u��7fB��&��6Ҫ.��r�ێl�_?��r��W|��T��U��>b��)F��y��C��ϙ'd�T$�T��T�ͩZG�@�l��E.��u��'��)/׳%*vF��o0@��T��3A#|CYTy�k\'��ױ�6M�P�.��yi�{�gj>oo3l-�Y��|��|��y0}7�:�$��Bޟ�y��]�*��x~�|�z��_��?:J�=�Ӣҳ��H'�z��|��C��YN�]H�]rHР4��s��7%�5�Yf��~�=͹<��A��=b��N��8'P��&��mP��ɵh�J��k��R]P�ozr�n��s;�f��??}��rP=��#k�%Y��hOY�/ ��D�2�s�D�Ն�i��z]!�~��01��W�Ǫ3��*C�7�=Z�7I*��3�a�b0a&�6>�ҽ��酯�ز5�t'=�4P)�cd�r:ȗ�!�Kc� .��<�,�f@�J2�.��b֡�d�Ռu��n� ��x��W!�U�@��/�L��2Xo�ߟe�5y�{�\��4��o?��W�,ʚ2�8D��0Y?�y��[��z�~\��ZV��d~��\L��Q��xQz?_4{��w?>�WTSSȫäB�z�@��!��޳8W�"��s��raE |��˧��L7�do�J��t��Q9��'Q�4��OaZ^e@L|#�EQ�¾\w�k҄r�5N��7�;�ϸ��˝id��Yy��m�&�c �RՄ;i��^�GH�5Į��ר�s=w�!%��'��S;v�ٱ�-��ޢ��lX��U�4��1+�(^��F�@��};��>ՙ*�", "t|x��t�u��`N�'��?�p��*�p��U2��[{p��`N�'��˻��Ѓ�oFN�^��c�8��a�%v�o(vv̘��X�_BX>F��.��B�u��X��"�*��;Gx�!< l�τi��m��&��HsS�+��i<��H��N ��4��y#L}�'�t��905�y�Z�B~,Q�ُ�]��گ0��Nڂ��ݵE�.'��w��w8��{��ww��kQ�@�0��", "00000001�00000001]00000001Q01O261�0�5>��`��4AB��n(�A��k't�]�ڕWR�k��zW8��pH^�֮B&��m�5JA��W�A)%�x� �1��"��%0�3 E1\�?�dM#�'��(ܾb�b¾R�}��5Z�,ũ�f"0y��Y�q��n�)�?Q�Y� _�/��:�a�B�t��U�k��5r5T�5"�p��G��T!�(��q��̴�[��[��R�v9��sj��-��f�.V#y��l\6�5��_��۪%�7G��F��*w)�|e틴��ɨl�5+��-C�S�,~<|}��V��d�z��:e^��wMP�l}ʊ��KMTr\��ؚX�*��lCA��LK��J��`�gah�>��"�v�Z'�D?�x9��(�f��i��A�q�a�G��X�=p|��ÉN0d��X*r�T�B��]�@kiW��I�z��zTs�Cx�Z�Po�İFaq�3YN:�9�r7�8�*'D��|�ѹt�*�8�;w�h�^�!M!£��)�(4�hyh4ų9N��#��ˎf��", "00000001�00000001]00000001�00000001o00000001�000000016000000010001�70eW�R�f�q�&K^�y]�d��6@۽)�<{�!O��n��'��,Jԅy$թOma�ǻOy�I-�(]�)��o=��)"9,�E��Ô�Z(�E�]�)��A�*K0ŀ�F`�);�ǀCE��0�q??0E䄫(LIK��&U�r��RU��h�L��Ksa��V�v:�SL�a=�]�)��o=��)"w�ϑ��z!�3��UMW�*��"�l�X(X3U�ʈe�;s/P1Li!4�[��L�5�u�v�A�K�b��cõ�ǂ��!��h��`Z��M��S�i�3�i��蘆��.lU#e��q��4�ң��׫��}�V�ɒl��7�@��]QI��R��y��O��Z=I]��d��m��$F�İ&1"'[hQ��??[�r3��ft��q��`+tx�Rkǆ(m��4�b@��a��w��zvU��N��o��^��k�_��_�]��7iߛT�7)��B��Q�i&v�F*��P��a>��D$�Y�h�Oxa~��9??H/K�Gz�yN(̋��a�"?#�@gec��"�H.�4��4�v�z�j��O��iO�р�k�\��0P|��JB��ar��iJ弝~Y|_��؏�s8F��=Ǣ��"�H绘H�ؗ�{�Q��t��O9��@ٿ��O^��X��US?X��<�%�z̖��p��fĶ��/<�|^|�,� ��l�<��Xq��Gp�Դ��/��W4��O.��n��<��8`��G/��>k�/�w�?G�KB�Og�o�Vۗ�0^fak/��p�Iw�v�8��ȉ�Q��n�\��%?I֟Bo=�i[��yS�I;��L�\_��K�|�/��JZ2�7��R�u:�e�M��JҾz�0�~�z}�e�Q|�5q�o�ck�-��o�[�$��_��y?u��M/��ǳ$�˸��p��vu:��.xu�?�?M��>�H��}R&��Y�(&%f�g9��N\�!:ڽ=)C��J'A*��yy/�7s$��E��R��z�/�KJ��DQs�N�Y��u`{�d��L(`9ډ�!�Fo{\Y2lŜ/��$w��B.Ir_D��*��,[��#��i��0��Ddp�,rHK��R�K�S��d��O��í�$~BF�[HL", "�Z��X[+q(�5̲zj��$��4�G>��S��C��V�K��/��)�xy$�g�3ZLp��>8$��T�]��oa"��1_$T�0��V>�;��E��1�ԯ�)��s�*ǘ��\�Bl&E�F�N��ʻ�/G��yCJz��"&Ci��<�^�W�C��8��x��q��t.��<��n�^��5�y��S�XSK'sy�U1�3;=�?gC�@@2*uo�#CH��6�"C`��!Ql�W�5�c"`��ҹ�rZ5�yO2l��Ȑ�>0�߀!e ��75�v��A��evg��n�7��1[��XM��oX�o(�t.�\�oV��@�ӂ�Z:�-~#�;��7`H@�A�o�UX,�*�.��n�7��1[��XM��oX�o(�t.�\�oV��@�c�&(��H��&z��^��vX�Rf1H��~�/��$$GN�pU��$��r*�-��}a��", "00000001�00000001]00000001M00000001o00000001�00000001@0000000100000001�00000001+00000001>00000001&01�51d��Fm%��KU�JI�67l��k��#��Bf��0&=��of�7<�㝡jIĴ$�/��[��%E�@�CkId`�ZRm�իZ3@��0�Z3�%�l�{�t��L��Z�5�f�\��uS��ӓ��U_��D��I��$�/��[��'E�@�#Y[F�-Վ��jK��n�}jK��L�҄I�72��4ܠЖD��iK�r,�/r�"w�%�bڒŗ�ͭSז�n �hKd��R��߫�4@ڨ%�0L��\��n�j�~��C]�''/K�,��I"w��%�b�ŗ�ͭS��n ��Kd��e�a@]j��^�D��e�'�V�a��ƴ��~raY'�s>�v�K�Q�G:Mcb��&��[+h��0�c�ƴw�W�Lc�V��R9��|�Vʆ�H�N�/��K��>��ܧ��Sy�8cO��ؗ��î��;SV})cww�40\�J&#\�X;G��f��%z|��U�i��ЗJ��l�p��5d3޵��s�o�+�3�M�D�yf<|O`ƃ��f��_�(<3��饌�:V��Ydn�z�V4c\�2��>[`�:��C��Y�`j3�Aҍ>{ɜ�0�z�\��M��??�'��N%�_�E�^}��W-��b��&��2;n�e$�Ψ�k��+#?��V�5]Q�~V�:-�v�Z�Vl��>��O1��G(-�V�vCtfs9��%(KU��(0 }Q`X"��F�!ɭ��ü��EA!��BR��d*IT��(,$MQXH��Ki��4Ϩ��p�b��"��E�3��%�F ��u�Tp�-^��%�v�Br�Y�c!�� ݱp�Ƌ��(��GQf��#(��u��ѓY�:C��;�[�3٣��=��w"̱�H��Rv��4��L��p�X��Ӈ��\jn6Q�=�T��d�8\��1��Ժ:/�^��eW��^/5��K��_�e��Fy�E%��v5��&��wE��яW�t_ޕ�Uj�_�`�r��]T-t��T߱�$��(��$zN�Y�U�FN�$��"��%��]fk�V�z��kqÔ��O�Q�H�o��%��O��ya��dӭ�߾��Z��y��R�4�nBk]un��_zOw"7f:T798,file/memory contains long string with (Indicator: "HTTP/1.1"; File: "SSL") Found string "GET / HTTP/1.1Accept: text/html, application/xhtml+xml, */*Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: accounts.google.comDNT: 1Connection: Keep-Alive" (Indicator: "HTTP/1.1"; File: "SSL") Found string "HTTP/1.1 204 No ContentContent-Length: 0Cross-Origin-Resource-Policy: cross-originDate: Wed, 29 Nov 2023 01:58:18 GMTAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000" (Indicator: "HTTP/1.1"; File: "SSL") Found string "HTTP/1.1 204 No ContentContent-Length: 0Cross-Origin-Resource-Policy: cross-originDate: Wed, 29 Nov 2023 01:58:22 GMTAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000" (Indicator: "HTTP/1.1"; File: "SSL") Found string "GET /signin HTTP/1.1Accept: text/html, application/xhtml+xml, */*Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: www.paypal.comDNT: 1Connection: Keep-Alive" (Indicator: "HTTP/1.1"; File: "SSL") Found string "GET /login HTTP/1.1Accept: text/html, application/xhtml+xml, */*User-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateDNT: 1Host: www.facebook.comConnection: Keep-AliveAccept-Language: en-US" (Indicator: "HTTP/1.1"; File: "SSL") Found string "HTTP/1.1 304 Not ModifiedDate: Thu, 23 Nov 2023 22:42:38 GMTExpires: Fri, 22 Nov 2024 22:42:38 GMTLast-Modified: Mon, 16 Oct 2017 17:32:56 GMTCache-Control: public, max-age=31536000Age: 443728Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000" (Indicator: "HTTP/1.1"; File: "SSL") Found string "GET /favicon.ico HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoDNT: 1Connection: Keep-AliveHost: www.google.com" (Indicator: "HTTP/1.1"; File: "SSL")80:T2945,Contains base62 string in header "MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V" in header "GET /gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base62 string in header "MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAU" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base62 string in header "2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base62 string in header "MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfq" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEAx5qUSwjBGVIJJhX%2BJrHYM%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base62 string in header "hLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQ" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEAx5qUSwjBGVIJJhX%2BJrHYM%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base62 string in header "P4v0cB1JgmGggC72NkK8MCEAx5qUSwjBG" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEAx5qUSwjBGVIJJhX%2BJrHYM%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base62 string in header "ME4wTDBKMEgwRjAJBgUrDgMCGgUABBQwk" in header "GET /gtsr1/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBQwkcLWD4LqGJ7bE7B1XZsEbmfwUAQU5K8rJnEaK0gnhS9SZizv8IkTcT4CDQIDvFNZazTHGPUBUGY%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base62 string in header "cLWD4LqGJ7bE7B1XZsEbmfwUAQU5K8rJn" in header "GET /gtsr1/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBQwkcLWD4LqGJ7bE7B1XZsEbmfwUAQU5K8rJnEaK0gnhS9SZizv8IkTcT4CDQIDvFNZazTHGPUBUGY%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base62 string in header "EaK0gnhS9SZizv8IkTcT4CDQIDvFNZazT" in header "GET /gtsr1/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBQwkcLWD4LqGJ7bE7B1XZsEbmfwUAQU5K8rJnEaK0gnhS9SZizv8IkTcT4CDQIDvFNZazTHGPUBUGY%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base62 string in header "MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAU" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D HTTP/1.1Cache-Control: max-age = 7200Connection: Keep-AliveAccept: */*If-Modified-Since: Wed, 29 Nov 2023 01:23:01 GMTUser-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base62 string in header "2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D HTTP/1.1Cache-Control: max-age = 7200Connection: Keep-AliveAccept: */*If-Modified-Since: Wed, 29 Nov 2023 01:23:01 GMTUser-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base62 string in header "MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHL" in header "GET /gts1c3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEFYyRZRleaQREjdgJW3R1jM%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base62 string in header "2Fr4XN7pXNPZzQ4kYU83E1HScCEFYyRZR" in header "GET /gts1c3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEFYyRZRleaQREjdgJW3R1jM%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base62 string in header "MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfq" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEATh56TcXPLzbcArQrhdFZ8%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base62 string in header "hLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQ" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEATh56TcXPLzbcArQrhdFZ8%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base62 string in header "P4v0cB1JgmGggC72NkK8MCEATh56TcXPL" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEATh56TcXPLzbcArQrhdFZ8%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base62 string in header "MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTHL" in header "GET /gts1c3/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEQCLPpgizFvtXApe3cL6kC3u HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base62 string in header "2Fr4XN7pXNPZzQ4kYU83E1HScCEQCLPpg" in header "GET /gts1c3/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEQCLPpgizFvtXApe3cL6kC3u HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base62 string in header "MFEwTzBNMEswSTAJBgUrDgMCGgUABBTPJ" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTPJvUY%2Bsl%2Bj4yzQuAcL2oQno5fCgQUUWj%2FkK8CB3U8zNllZGKiErhZcjsCEAq9F6UNEL2nYhx7xCvy3%2FI%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base62 string in header "2FkK8CB3U8zNllZGKiErhZcjsCEAq9F6U" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTPJvUY%2Bsl%2Bj4yzQuAcL2oQno5fCgQUUWj%2FkK8CB3U8zNllZGKiErhZcjsCEAq9F6UNEL2nYhx7xCvy3%2FI%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base62 string in header "MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHL" in header "GET /gts1c3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEF2rtEA6xK7GEl4nbt8ZZfk%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base62 string in header "2Fr4XN7pXNPZzQ4kYU83E1HScCEF2rtEA" in header "GET /gts1c3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEF2rtEA6xK7GEl4nbt8ZZfk%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base62 string in header "MFEwTzBNMEswSTAJBgUrDgMCGgUABBSRX" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSRXerF0eFeSWRripTgTkcJWMm7iQQUaDfg67Y7%2BF8Rhvv%2BYXsIiGX0TkICEATi7HzdaAMTTamxkE%2Fh8DM%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base62 string in header "erF0eFeSWRripTgTkcJWMm7iQQUaDfg67" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSRXerF0eFeSWRripTgTkcJWMm7iQQUaDfg67Y7%2BF8Rhvv%2BYXsIiGX0TkICEATi7HzdaAMTTamxkE%2Fh8DM%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base62 string in header "MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfI" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfIs%2BLjDtGwQ09XEB1Yeq%2BtX%2BBgQQU7NfjgtJxXWRM3y5nP%2Be6mK4cD08CEAitQLJg0pxMn17Nqb2Trtk%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base62 string in header "2Be6mK4cD08CEAitQLJg0pxMn17Nqb2Tr" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfIs%2BLjDtGwQ09XEB1Yeq%2BtX%2BBgQQU7NfjgtJxXWRM3y5nP%2Be6mK4cD08CEAitQLJg0pxMn17Nqb2Trtk%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base62 string in header "MFEwTzBNMEswSTAJBgUrDgMCGgUABBT3x" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBT3xL4LQLXDRDM9P665TW442vrsUQQUReuir%2FSSy4IxLVGLp6chnfNtyA8CEA6bGI750C3n79tQ4ghAGFo%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base62 string in header "2FSSy4IxLVGLp6chnfNtyA8CEA6bGI750" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBT3xL4LQLXDRDM9P665TW442vrsUQQUReuir%2FSSy4IxLVGLp6chnfNtyA8CEA6bGI750C3n79tQ4ghAGFo%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base62 string in header "MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAqvpsXKY8RRQeo74ffHUxc%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base62 string in header "2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAqvpsXKY8RRQeo74ffHUxc%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base62 string in header "2BrkS7QYXjzkCEAqvpsXKY8RRQeo74ffH" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAqvpsXKY8RRQeo74ffHUxc%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base62 string in header "MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base62 string in header "2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base62 string in header "2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com"81:T74c,Observed string: "__d("URISchemes",["$InternalEnum"],(function(a,b,c,d,e,f){"use strict";var g=new Set(["about","accountscenter","aidemos","aistudio","apk","blob","cmms","fb","fba","fbatwork","fb-ama","fb-internal","fb-workchat","fb-workchat-secure","fb-messenger","fb-messenger-public","fb-messenger-group-thread","fb-page-messages","fb-pma","fbcf","fbconnect","fbinternal","fbmobilehome","fbrpc","file","flipper","ftp","gtalk","http","https","mailto","wss","ms-app","intent","itms","itms-apps","itms-services","lasso","market","svn+ssh","fbstaging","tel","sms","pebblejs","sftp","whatsapp","moments","flash","fblite","chrome-extension","webcal","instagram","iglite","fb124024574287414","fb124024574287414rc","fb124024574287414master","fb1576585912599779","fb929757330408142","designpack","fbpixelcloud","fbapi20130214","fb1196383223757595","tbauth","oculus","oculus.store","oculus.feed","oculusstore","socialplatform","odh","com.oculus.rd","aria","skype","ms-windows-store","callto","messenger","workchat","fb236786383180508","fb1775440806014337","data","fb-mk","munki","origami-file","fb-nimble-vrsrecorder","fb-nimble-monohandtrackingvis","together","togetherbl","horizonlauncher","venues","whatsapp-consumer","whatsapp-smb","fb-ide-opener","fb-vscode","fb-vscode-insiders","editor","spark-studio","spark-player","spark-simulator","arstudio","manifold","origami-internal","origami-public","stella","mwa","mattermost","logaggregator","pcoip","cinema","home","oculus360photos","systemux"]),h=b("$InternalEnum")({EXPLICITLY_ALLOWED_SCHEMES_ONLY:"explicitly_allowed_schemes_only",INCLUDE_DEFAULTS:"include_defaults"});function a(a,b,c){b===void 0&&(b=h.INCLUDE_DEFAULTS);return a==null||a===""?!0:(c==null?void 0:c.has(a.toLowerCase()))||b===h.INCLUDE_DEFAULTS&&g.has(a.toLowerCase())}f.Options=h;f.isAllowed=a}),66);" (Indicator: ""sftp") in Source: 5UEJ1PHJzvo_1_.js82:Tbef,file/memory contains long string with (Indicator: "password"; File: "~DFD44B17337C595BAA.TMP") file/memory contains long string with (Indicator: "password"; File: "_64299F06-8E55-11EE-9BCC-005056912C63_.dat") file/memory contains long string with (Indicator: "password"; File: "SSL") Found string "password: 'begin_hybrid_pwd'," (Indicator: "password"; File: "signin-split_1_.js") Found string "var options = ['email', 'sms', 'biometrics', 'signup', 'password', 'passwordRecovery'];" (Indicator: "password"; File: "signin-split_1_.js") Found string "loginWithPassword: 'password'," (Indicator: "password"; File: "signin-split_1_.js") Found string "setPasswordLink: 'set_password'," (Indicator: "password"; File: "signin-split_1_.js") Found string "passwordRecoveryModal: 'password_recovery'," (Indicator: "password"; File: "signin-split_1_.js") Found string "if (!pageName || !optionList || pageName !== 'password') {" (Indicator: "password"; File: "signin-split_1_.js") Found string "// setting emailField here because this value is used in subsequent xhr calls when on the password page." (Indicator: "password"; File: "signin-split_1_.js") Found string "delete formData.login_password;" (Indicator: "password"; File: "signin-split_1_.js") Found string "login.utils.logTryAnotherWayInstrumentData({page: 'password', action: 'menuPressed', option: 'biometrics'});" (Indicator: "password"; File: "signin-split_1_.js") Found string "login.utils.logTryAnotherWayInstrumentData({page: 'password', action: 'linkShown'});" (Indicator: "password"; File: "signin-split_1_.js") Found string "* Chrome will not allow reading the password field on page load" (Indicator: "password"; File: "signin-split_1_.js") Found string "var passwordDom = document.querySelector('#password');" (Indicator: "password"; File: "signin-split_1_.js") Found string "if(passwordDom && passwordDom.hasAttribute('disabled')) {" (Indicator: "password"; File: "signin-split_1_.js") Found string "passwordDom.removeAttribute('disabled');" (Indicator: "password"; File: "signin-split_1_.js") Found string "login: 'password'," (Indicator: "password"; File: "signin-split_1_.js") Found string "var setPwr = tawParentNode.querySelector("#passwordRecoveryModal");" (Indicator: "password"; File: "signin-split_1_.js") Found string "data: 'prepare_login_with_your_password'," (Indicator: "password"; File: "signin-split_1_.js") Found string "data: 'login_with_your_password'," (Indicator: "password"; File: "signin-split_1_.js") Found string "data: 'login_with_your_password_clicked'," (Indicator: "password"; File: "signin-split_1_.js") Found string "login.utils.logTryAnotherWayInstrumentData({page: pageName, action: 'menuPressed', option: 'password'});" (Indicator: "password"; File: "signin-split_1_.js") Found string "var passwordRedirect = function() {" (Indicator: "password"; File: "signin-split_1_.js") Found string "return login.logger.pushLogs({complete: passwordRedirect, data: {logStartTime: Date.now()}});" (Indicator: "password"; File: "signin-split_1_.js")83:T56d,"dinosaur_1_.png" has type "PNG image data 1200 x 800 8-bit/color RGBA non-interlaced" and extension "png" "firefox_1_.png" has type "PNG image data 128 x 128 8-bit/color RGBA non-interlaced" and extension "png" "yt_logo_rgb_light_1_.png" has type "PNG image data 1588 x 356 8-bit colormap non-interlaced" and extension "png" "edgium_1_.png" has type "PNG image data 128 x 128 8-bit/color RGBA non-interlaced" and extension "png" "Y0L6f5sxdIV_1_.png" has type "PNG image data 283 x 315 8-bit colormap non-interlaced" and extension "png" "chrome_1_.png" has type "PNG image data 128 x 128 8-bit/color RGBA non-interlaced" and extension "png" "sprite_form_2x_1_.png" has type "PNG image data 48 x 1350 8-bit colormap non-interlaced" and extension "png" "opera_1_.png" has type "PNG image data 128 x 128 8-bit/color RGBA non-interlaced" and extension "png" "glyph_alert_critical_big-2x_1_.png" has type "PNG image data 224 x 200 8-bit colormap non-interlaced" and extension "png" "icon-PN-check_1_.png" has type "PNG image data 121 x 133 8-bit colormap non-interlaced" and extension "png" "O287_AcFyg4_1_.png" has type "PNG image data 20 x 20 8-bit colormap non-interlaced" and extension "png" "O7nelmd9XSI_1_.png" has type "PNG image data 1 x 1 1-bit colormap non-interlaced" and extension "png" "hsts-pixel_1_.gif" has type "GIF image data version 89a 1 x 1" and extension "gif"84:T1000a,"initAft()