26:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js","/_next/static/chunks/1w1axrg6kzses.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/1kn_tf3p-ubex.js","/_next/static/chunks/1wq095nwqbaw1.js"],"SampleDetailWrapper"] 78:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js"],"IconMark"] 25:T483,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Malware Sample e96789d69730… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample e96789d69730…. Malware family: Malware. Threat score 100/100. 6/25 AV engines flagged this file. 14 malicious and 18 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/e96789d697301017c3c5f2332f7f74fd5aabbee70373e2d7af8c7ebd24ab22e0","keywords":["Malicious","Malware","malware analysis","sandbox report","threat intelligence","e96789d697301017c3c5f2332f7f74fd5aabbee70373e2d7af8c7ebd24ab22e0"],"about":{"@type":"SoftwareApplication","name":"ac18ad4de0d70e7cbbfb829afea0dd45.exe","applicationCategory":["peexe","executable"],"identifier":"e96789d697301017c3c5f2332f7f74fd5aabbee70373e2d7af8c7ebd24ab22e0","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Malware","antivirusDetections":{"malicious":6,"total":25},"behavioralIndicators":{"malicious":14,"suspicious":18},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}27:T47b,"ac18ad4de0d70e7cbbfb829afea0dd45.exe" called "FindResourceA" with parameter "2489416" - (UID: 00000000-00002632) "ac18ad4de0d70e7cbbfb829afea0dd45.exe" called "FindResourceA" with parameter "15864520" - (UID: 00000000-00002632) "ac18ad4de0d70e7cbbfb829afea0dd45.exe" called "FindResourceA" with parameter "15864528" - (UID: 00000000-00002632) "ac18ad4de0d70e7cbbfb829afea0dd45.exe" called "FindResourceA" with parameter "15864556" - (UID: 00000000-00002632) "ac18ad4de0d70e7cbbfb829afea0dd45.exe" called "FindResourceA" with parameter "15864568" - (UID: 00000000-00002632) "ac18ad4de0d70e7cbbfb829afea0dd45.exe" called "FindResourceA" with parameter "15864584" - (UID: 00000000-00002632) "lP8PV47.exe" called "FindResourceA" with parameter "2422584" - (UID: 00000000-00003784) "lP8PV47.exe" called "FindResourceA" with parameter "15930056" - (UID: 00000000-00003784) "lP8PV47.exe" called "FindResourceA" with parameter "15930064" - (UID: 00000000-00003784) "lP8PV47.exe" called "FindResourceA" with parameter "15930092" - (UID: 00000000-00003784) "lP8PV47.exe" called "FindResourceA" with parameter "15930104" - (UID: 00000000-00003784)28:Ta03,"ac18ad4de0d70e7cbbfb829afea0dd45.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '15910992'}" (UID: 00000000-00002632) "ac18ad4de0d70e7cbbfb829afea0dd45.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '15911024'}" (UID: 00000000-00002632) "ac18ad4de0d70e7cbbfb829afea0dd45.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '15911008'}" (UID: 00000000-00002632) "ac18ad4de0d70e7cbbfb829afea0dd45.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '15910976'}" (UID: 00000000-00002632) "ac18ad4de0d70e7cbbfb829afea0dd45.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '15910928'}" (UID: 00000000-00002632) "lP8PV47.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '15976528'}" (UID: 00000000-00003784) "lP8PV47.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '15976560'}" (UID: 00000000-00003784) "lP8PV47.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '15976544'}" (UID: 00000000-00003784) "lP8PV47.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '15976512'}" (UID: 00000000-00003784) "lP8PV47.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '15976464'}" (UID: 00000000-00003784) "1pH71tZ8.exe" called "LoadResource with parameter {'hModule': '15466496', 'hResInfo': '16336168'}" (UID: 00000000-00003416) "1pH71tZ8.exe" called "LoadResource with parameter {'hModule': '15466496', 'hResInfo': '16336184'}" (UID: 00000000-00003416) "1pH71tZ8.exe" called "LoadResource with parameter {'hModule': '15466496', 'hResInfo': '16336008'}" (UID: 00000000-00003416) "1pH71tZ8.exe" called "LoadResource with parameter {'hModule': '15466496', 'hResInfo': '16336216'}" (UID: 00000000-00003416) "1pH71tZ8.exe" called "LoadResource with parameter {'hModule': '15466496', 'hResInfo': '16335864'}" (UID: 00000000-00003416) "1pH71tZ8.exe" called "LoadResource with parameter {'hModule': '15466496', 'hResInfo': '16336200'}" (UID: 00000000-00003416) "1pH71tZ8.exe" called "LoadResource with parameter {'hModule': '15466496', 'hResInfo': '16335880'}" (UID: 00000000-00003416) "1pH71tZ8.exe" called "LoadResource with parameter {'hModule': '15466496', 'hResInfo': '16336024'}" (UID: 00000000-00003416) "1pH71tZ8.exe" called "LoadResource with parameter {'hModule': '15466496', 'hResInfo': '16336232'}" (UID: 00000000-00003416) "1pH71tZ8.exe" called "LoadResource with parameter {'hModule': '15466496', 'hResInfo': '16335896'}" (UID: 00000000-00003416)29:T4af,Found reference to API "CreateThread" (Indicator: "CreateThread"; File: "ac18ad4de0d70e7cbbfb829afea0dd45.exe") Found reference to API "CreateThread" (Indicator: "CreateThread"; Source: "00000000-00002632.00000002.67682.00F2A000.00000002.mdmp") Found reference to API "CreateThread" (Indicator: "CreateThread"; Source: "00000000-00003416.00000000.65622.00F5C000.00000002.mdmp") Found reference to API "VirtualFreeEx" (Indicator: "VirtualFree"; Source: "00000000-00003416.00000000.65622.00F5C000.00000002.mdmp") Found reference to API "VirtualAllocEx" (Indicator: "VirtualAlloc"; Source: "00000000-00003416.00000000.65622.00F5C000.00000002.mdmp") Found reference to API "VirtualAllocEx" (Indicator: "VirtualAllocEx"; Source: "00000000-00003416.00000000.65622.00F5C000.00000002.mdmp") Found reference to API "WriteProcessMemory" (Indicator: "WriteProcessMemory"; Source: "00000000-00003416.00000000.65622.00F5C000.00000002.mdmp") Found reference to API "VirtualFree" (Indicator: "VirtualFree"; Source: "00000000-00003416.00000000.65622.00F5C000.00000002.mdmp") Found reference to API "VirtualAlloc" (Indicator: "VirtualAlloc"; Source: "00000000-00003416.00000000.65622.00F5C000.00000002.mdmp")2a:T67e,Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; File: "ac18ad4de0d70e7cbbfb829afea0dd45.exe") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; File: "ac18ad4de0d70e7cbbfb829afea0dd45.exe") Found reference to API "LoadLibraryExA" (Indicator: "LoadLibrary"; File: "ac18ad4de0d70e7cbbfb829afea0dd45.exe") Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; Source: "00000000-00002632.00000002.67682.00F2A000.00000002.mdmp") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; Source: "00000000-00002632.00000002.67682.00F2A000.00000002.mdmp") Found reference to API "LoadLibraryExA" (Indicator: "LoadLibrary"; Source: "00000000-00002632.00000002.67682.00F2A000.00000002.mdmp") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; Source: "00000000-00003416.00000000.65622.00F5C000.00000002.mdmp, 00000000-00003416.00000000.65622.6D110000.00000002.mdmp") Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; Source: "00000000-00003416.00000000.65622.00F5C000.00000002.mdmp") Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; Source: "00000000-00003416.00000000.65622.00F5C000.00000002.mdmp") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; Source: "00000000-00003416.00000000.65622.00F5C000.00000002.mdmp, 00000000-00003416.00000000.65622.6D110000.00000002.mdmp") Found reference to API "FreeLibraryAndExitThread" (Indicator: "FreeLibrary"; Source: "00000000-00003416.00000000.65622.00F5C000.00000002.mdmp") Found reference to API "LoadLibraryExA" (Indicator: "LoadLibrary"; Source: "00000000-00003416.00000000.65622.6D110000.00000002.mdmp")2b:T5af,Found reference to API "IOpenServiceManager" (Indicator: "OpenService"; Source: "00000000-00003416.00000000.65622.6D0D1000.00000020.mdmp") Found reference to API "IOpenServiceActivity" (Indicator: "OpenService"; Source: "00000000-00003416.00000000.65622.6D0D1000.00000020.mdmp") Found reference to API "IOpenServiceActivityManager" (Indicator: "OpenService"; Source: "00000000-00003416.00000000.65622.6D0D1000.00000020.mdmp") Found reference to API "IOpenServiceActivityOutputContext" (Indicator: "OpenService"; Source: "00000000-00003416.00000000.65622.6D0D1000.00000020.mdmp") Found reference to API "IOpenServiceActivityInput" (Indicator: "OpenService"; Source: "00000000-00003416.00000000.65622.6D0D1000.00000020.mdmp") Found reference to API "IOpenService" (Indicator: "OpenService"; Source: "00000000-00003416.00000000.65622.6D0D1000.00000020.mdmp") Found reference to API "IEnumOpenServiceActivity" (Indicator: "OpenService"; Source: "00000000-00003416.00000000.65622.6D0D1000.00000020.mdmp") Found reference to API "IOpenServiceActivityCategory" (Indicator: "OpenService"; Source: "00000000-00003416.00000000.65622.6D0D1000.00000020.mdmp") Found reference to API "IEnumOpenServiceActivityCategory" (Indicator: "OpenService"; Source: "00000000-00003416.00000000.65622.6D0D1000.00000020.mdmp") Found reference to API "IOpenServiceManagerInternal" (Indicator: "OpenService"; Source: "00000000-00003416.00000000.65622.6D0D1000.00000020.mdmp")2c:T41d,Found string - return /^\S+@\S+\.\S+$/;; Source: "signin-split_1_.js") Found string - var EMAIL_PTN = /^\S+@\S+\.\S+$/;; Source: "signin-split_1_.js") Found string - !\uff01]/[!\uff01];["\uff02]/["\uff02];[\#\uff03]/[\#\uff03];[\$\uff04]/[\$\uff04];[%\uff05]/[%\uff05];[&\uff06]/[&\uff06];[\u0027\uff07]/[\u0027\uff07];[$\uff08]/[\(\uff08];[$\uff09]/[\)\uff09];[\*\uff0a]/[\*\uff0a];[\+\uff0b]/[\+\uff0b];[ \uff0c]/[ \uff0c];[-\uff0d]/[-\uff0d];[\.\uff0e]/[\.\uff0e];[\u002f\uff0f]/[\u002f\uff0f];[:\uff1a]/[:\uff1a];[\u003b\uff1b]/[\u003b\uff1b];[<\uff1c]/[<\uff1c];[=\uff1d]/[=\uff1d];[>\uff1e]/[>\uff1e];[\?\uff1f]/[\?\uff1f];[@\uff20]/[@\uff20];[\[\uff3b]/[\[\uff3b];[\\\\uff3c]/[\\\\uff3c];[]\uff3d]/[]\uff3d];[\^\uff3e]/[\^\uff3e];[_\uff3f]/[_\uff3f];[`\uff40]/[`\uff40];[\{\uff5b]/[\{\uff5b];[\|\uff5c]/[\|\uff5c];[}\uff5d]/[}\uff5d];[~\uff5e]/[~\uff5e];[\u3002\uff61]/[\u3002\uff61];[\u300C\uff62]/[\u300C\uff62];[\u300D\uff63]/[\u300D\uff63];[\u3001\uff64]/[\u3001\uff64]M; Source: "00000000-00003416.00000001.66534.028C0000.00000002.mdmp")2d:T5680,Contains base64 string in header "Keep" in header "GET /DigiCertGlobalRootG3.crt HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: cacerts.digicert.com" Contains base64 string in header "User" in header "GET /DigiCertGlobalRootG3.crt HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: cacerts.digicert.com" Contains base64 string in header "digicert" in header "GET /DigiCertGlobalRootG3.crt HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: cacerts.digicert.com" Contains base64 string in header "Keep" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "User" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "ocsp" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "digicert" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "Keep" in header "GET /gtsr1/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBQwkcLWD4LqGJ7bE7B1XZsEbmfwUAQU5K8rJnEaK0gnhS9SZizv8IkTcT4CDQIDvFNZazTHGPUBUGY%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "User" in header "GET /gtsr1/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBQwkcLWD4LqGJ7bE7B1XZsEbmfwUAQU5K8rJnEaK0gnhS9SZizv8IkTcT4CDQIDvFNZazTHGPUBUGY%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "ocsp" in header "GET /gtsr1/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBQwkcLWD4LqGJ7bE7B1XZsEbmfwUAQU5K8rJnEaK0gnhS9SZizv8IkTcT4CDQIDvFNZazTHGPUBUGY%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "goog" in header "GET /gtsr1/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBQwkcLWD4LqGJ7bE7B1XZsEbmfwUAQU5K8rJnEaK0gnhS9SZizv8IkTcT4CDQIDvFNZazTHGPUBUGY%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP" in header "GET /gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "2FUsCEHe9DWzbNvka6iEPxPBY0w0" in header "GET /gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "Keep" in header "GET /gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "User" in header "GET /gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "ocsp" in header "GET /gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "goog" in header "GET /gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "Keep" in header "GET /gts1c3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEBZwXm7t3kKEEFjsmHQeLcQ%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "User" in header "GET /gts1c3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEBZwXm7t3kKEEFjsmHQeLcQ%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "ocsp" in header "GET /gts1c3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEBZwXm7t3kKEEFjsmHQeLcQ%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "goog" in header "GET /gts1c3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEBZwXm7t3kKEEFjsmHQeLcQ%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "Keep" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEAx5qUSwjBGVIJJhX%2BJrHYM%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "User" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEAx5qUSwjBGVIJJhX%2BJrHYM%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "ocsp" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEAx5qUSwjBGVIJJhX%2BJrHYM%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "digicert" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEAx5qUSwjBGVIJJhX%2BJrHYM%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEATh56TcXPLzbcArQrhdFZ8" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEATh56TcXPLzbcArQrhdFZ8%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "Keep" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEATh56TcXPLzbcArQrhdFZ8%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "User" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEATh56TcXPLzbcArQrhdFZ8%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "ocsp" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEATh56TcXPLzbcArQrhdFZ8%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "digicert" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEATh56TcXPLzbcArQrhdFZ8%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "2Bsl" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTPJvUY%2Bsl%2Bj4yzQuAcL2oQno5fCgQUUWj%2FkK8CB3U8zNllZGKiErhZcjsCEAdcWuWOzU%2B3YfWP%2Bc9lf9g%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "2FkK8CB3U8zNllZGKiErhZcjsCEAdcWuWOzU" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTPJvUY%2Bsl%2Bj4yzQuAcL2oQno5fCgQUUWj%2FkK8CB3U8zNllZGKiErhZcjsCEAdcWuWOzU%2B3YfWP%2Bc9lf9g%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "2Bc9lf9g" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTPJvUY%2Bsl%2Bj4yzQuAcL2oQno5fCgQUUWj%2FkK8CB3U8zNllZGKiErhZcjsCEAdcWuWOzU%2B3YfWP%2Bc9lf9g%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "Keep" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTPJvUY%2Bsl%2Bj4yzQuAcL2oQno5fCgQUUWj%2FkK8CB3U8zNllZGKiErhZcjsCEAdcWuWOzU%2B3YfWP%2Bc9lf9g%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "User" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTPJvUY%2Bsl%2Bj4yzQuAcL2oQno5fCgQUUWj%2FkK8CB3U8zNllZGKiErhZcjsCEAdcWuWOzU%2B3YfWP%2Bc9lf9g%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "ocsp" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTPJvUY%2Bsl%2Bj4yzQuAcL2oQno5fCgQUUWj%2FkK8CB3U8zNllZGKiErhZcjsCEAdcWuWOzU%2B3YfWP%2Bc9lf9g%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "digicert" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTPJvUY%2Bsl%2Bj4yzQuAcL2oQno5fCgQUUWj%2FkK8CB3U8zNllZGKiErhZcjsCEAdcWuWOzU%2B3YfWP%2Bc9lf9g%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "Keep" in header "GET /gsr1/gsr1.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: crl.pki.goog" Contains base64 string in header "User" in header "GET /gsr1/gsr1.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: crl.pki.goog" Contains base64 string in header "goog" in header "GET /gsr1/gsr1.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: crl.pki.goog" Contains base64 string in header "/gtsr1/gtsr1" in header "GET /gtsr1/gtsr1.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: crl.pki.goog" Contains base64 string in header "Keep" in header "GET /gtsr1/gtsr1.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: crl.pki.goog" Contains base64 string in header "User" in header "GET /gtsr1/gtsr1.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: crl.pki.goog" Contains base64 string in header "goog" in header "GET /gtsr1/gtsr1.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: crl.pki.goog" Contains base64 string in header "Keep" in header "GET /gts1c3/moVDfISia2k.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: crls.pki.goog" Contains base64 string in header "User" in header "GET /gts1c3/moVDfISia2k.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: crls.pki.goog" Contains base64 string in header "crls" in header "GET /gts1c3/moVDfISia2k.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: crls.pki.goog" Contains base64 string in header "goog" in header "GET /gts1c3/moVDfISia2k.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: crls.pki.goog" Contains base64 string in header "/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAzlnDD9eoNTLi0BRrMy%2BWU%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "2BWU" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAzlnDD9eoNTLi0BRrMy%2BWU%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "Keep" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAzlnDD9eoNTLi0BRrMy%2BWU%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "User" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAzlnDD9eoNTLi0BRrMy%2BWU%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "ocsp" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAzlnDD9eoNTLi0BRrMy%2BWU%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "digicert" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAzlnDD9eoNTLi0BRrMy%2BWU%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "2BrkS7QYXjzkCEAz1vQYrVgL0erhQLCPM8GY" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAz1vQYrVgL0erhQLCPM8GY%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "Keep" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAz1vQYrVgL0erhQLCPM8GY%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "User" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAz1vQYrVgL0erhQLCPM8GY%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "ocsp" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAz1vQYrVgL0erhQLCPM8GY%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "digicert" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAz1vQYrVgL0erhQLCPM8GY%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTk45WiKdPUwcMf8JgMC07ACYqr2AQUt2ui6qiqhIx56rTaD5iyxZV2ufQCEAqiBEK" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTk45WiKdPUwcMf8JgMC07ACYqr2AQUt2ui6qiqhIx56rTaD5iyxZV2ufQCEAqiBEK%2F1RSvcy4lL46SQ4M%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "Keep" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTk45WiKdPUwcMf8JgMC07ACYqr2AQUt2ui6qiqhIx56rTaD5iyxZV2ufQCEAqiBEK%2F1RSvcy4lL46SQ4M%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "User" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTk45WiKdPUwcMf8JgMC07ACYqr2AQUt2ui6qiqhIx56rTaD5iyxZV2ufQCEAqiBEK%2F1RSvcy4lL46SQ4M%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "ocsp" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTk45WiKdPUwcMf8JgMC07ACYqr2AQUt2ui6qiqhIx56rTaD5iyxZV2ufQCEAqiBEK%2F1RSvcy4lL46SQ4M%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "digicert" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTk45WiKdPUwcMf8JgMC07ACYqr2AQUt2ui6qiqhIx56rTaD5iyxZV2ufQCEAqiBEK%2F1RSvcy4lL46SQ4M%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "Keep" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSnxLiz3Fu1WB6n1%2FE6xWn1b0jXiQQUdIWAwGbH3zfez70pN6oDHb7tzRcCEAp6FnkBkACKqk%2BVbKsyAbY%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "User" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSnxLiz3Fu1WB6n1%2FE6xWn1b0jXiQQUdIWAwGbH3zfez70pN6oDHb7tzRcCEAp6FnkBkACKqk%2BVbKsyAbY%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "ocsp" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSnxLiz3Fu1WB6n1%2FE6xWn1b0jXiQQUdIWAwGbH3zfez70pN6oDHb7tzRcCEAp6FnkBkACKqk%2BVbKsyAbY%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "digicert" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSnxLiz3Fu1WB6n1%2FE6xWn1b0jXiQQUdIWAwGbH3zfez70pN6oDHb7tzRcCEAp6FnkBkACKqk%2BVbKsyAbY%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "2BrkS7QYXjzkCEAqvpsXKY8RRQeo74ffHUxc" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAqvpsXKY8RRQeo74ffHUxc%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "Keep" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAqvpsXKY8RRQeo74ffHUxc%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "User" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAqvpsXKY8RRQeo74ffHUxc%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "ocsp" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAqvpsXKY8RRQeo74ffHUxc%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "digicert" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAqvpsXKY8RRQeo74ffHUxc%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "Keep" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "User" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "ocsp" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "digicert" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "2BrkS7QYXjzkCEA177el9ggmWelJjG4vdGL0" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEA177el9ggmWelJjG4vdGL0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "Keep" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEA177el9ggmWelJjG4vdGL0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "User" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEA177el9ggmWelJjG4vdGL0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "ocsp" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEA177el9ggmWelJjG4vdGL0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "digicert" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEA177el9ggmWelJjG4vdGL0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com"2e:T4ce,The analysis contains indicators for cyrpto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Contains ability to perform AES/RC4 encryption (API string) Matched sigs: Contains ability to perform decryption (API string) Matched sigs: Contains ability to use Microsoft's Enhanced Cryptographic Provider Matched sigs: Contains CRYPTO related strings Matched sigs: Contains ability to use Cryptographic classes Matched sigs: Decrypted SSL network traffic Matched sigs: Contains ability to decrypt/decode data Matched sigs: Contains reference to cryptographic keys Matched sigs: Found XOR operators (encryption/decryption) Matched sigs: Calls an API typically to import asymmetric cryptographic keys into a CSP Matched sigs: Calls an API typically used to decrypt a block of data Matched sigs: Dropped file has high entropy (likely encrypted/compressed content) Matched sigs: Reads the cryptographic machine GUID Matched sigs: Calls an API typically used to encrypt a block of data Matched sigs: Calls an API typically to import cryptographic keys into a CSP Matched sigs: HTTP requests contain Base64 strings Matched sigs: Sample file has high entropy (likely encrypted/compressed content)2f:T2a0e,"ac18ad4de0d70e7cbbfb829afea0dd45.exe" called "RtlGetVersion" with parameter 000000000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00002632) "lP8PV47.exe" called "RtlGetVersion" with parameter 000000000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00003784) "1pH71tZ8.exe" called "RtlGetVersion" with parameter 140100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00003416) "1pH71tZ8.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00003416) "1pH71tZ8.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000010000000001011e420db0a0e0e5e8022a9d507600000000248365760400000000000000000000005cf7e80200000000e79c507602000780f4dfe802000000007600000044e0e802feffffffccdfe802cf000577d600057721cceb75760000003b00000044e0e8026f006e00a0dfe8026e00740008e0e802 (UID: 00000000-00003416) "1pH71tZ8.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000099049966cc04cc66cc04ff6699040099cc043399cc046699cc049999cc04cc99cc04ff99cc0400cccc0433cccc0466cccc0499cccc04cccccc04ffcccc0400ffcc0433ffcc0466ff990499ffcc04ccffcc04ffffcc043300cc046600ff049900ff040033cc043333ff046633ff049933ff04cc33ff04ff33ff040066ff043366ff046666cc049966ff04cc66ff04ff66cc040099ff043399ff046699ff049999ff04cc99ff04ff99ff0400ccff0433ccff0466ccff0499ccff04ccccff040000dd6b40dfe80266ffcc0499ffff04ccffff0430dfe8020000dd6b0000000001000000 (UID: 00000000-00003416) "1pH71tZ8.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000099049966cc04cc66cc04ff6699040099cc043399cc046699cc049999cc04cc99cc04ff99cc0400cccc0433cccc0466cccc0499cccc04cccccc04ffcccc0400ffcc0433ffcc0466ff990499ffcc04ccffcc04ffffcc043300cc046600ff049900ff040033cc043333ff046633ff049933ff04cc33ff04ff33ff040066ff043366ff046666cc049966ff04cc66ff04ff66cc040099ff043399ff046699ff049999ff04cc99ff04ff99ff0400ccff0433ccff0466ccff0499ccff04ccccff040000dd6b80e1a40466ffcc0499ffff04ccffff0470e1a4040000dd6b0000000001000000 (UID: 00000000-00003416) "1pH71tZ8.exe" called "RtlGetVersion" with parameter 000000000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00003416) "1pH71tZ8.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000099049966cc04cc66cc04ff6699040099cc043399cc046699cc049999cc04cc99cc04ff99cc0400cccc0433cccc0466cccc0499cccc04cccccc04ffcccc0400ffcc0433ffcc0466ff990499ffcc04ccffcc04ffffcc043300cc046600ff049900ff040033cc043333ff046633ff049933ff04cc33ff04ff33ff040066ff043366ff046666cc049966ff04cc66ff04ff66cc040099ff043399ff046699ff049999ff04cc99ff04ff99ff0400ccff0433ccff0466ccff0499ccff04ccccff040000dd6bc0dd000366ffcc0499ffff04ccffff04b0dd00030000dd6b0000000001000000 (UID: 00000000-00003416) "1pH71tZ8.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000099049966cc04cc66cc04ff6699040099cc043399cc046699cc049999cc04cc99cc04ff99cc0400cccc0433cccc0466cccc0499cccc04cccccc04ffcccc0400ffcc0433ffcc0466ff990499ffcc04ccffcc04ffffcc043300cc046600ff049900ff040033cc043333ff046633ff049933ff04cc33ff04ff33ff040066ff043366ff046666cc049966ff04cc66ff04ff66cc040099ff043399ff046699ff049999ff04cc99ff04ff99ff0400ccff0433ccff0466ccff0499ccff04ccccff040000dd6b00e1eb0266ffcc0499ffff04ccffff04f0e0eb020000dd6b0000000001000000 (UID: 00000000-00003416) "1pH71tZ8.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000099049966cc04cc66cc04ff6699040099cc043399cc046699cc049999cc04cc99cc04ff99cc0400cccc0433cccc0466cccc0499cccc04cccccc04ffcccc0400ffcc0433ffcc0466ff990499ffcc04ccffcc04ffffcc043300cc046600ff049900ff040033cc043333ff046633ff049933ff04cc33ff04ff33ff040066ff043366ff046666cc049966ff04cc66ff04ff66cc040099ff043399ff046699ff049999ff04cc99ff04ff99ff0400ccff0433ccff0466ccff0499ccff04ccccff040000dd6be0dd060366ffcc0499ffff04ccffff04d0dd06030000dd6b0000000001000000 (UID: 00000000-00003416) "1pH71tZ8.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000099049966cc04cc66cc04ff6699040099cc043399cc046699cc049999cc04cc99cc04ff99cc0400cccc0433cccc0466cccc0499cccc04cccccc04ffcccc0400ffcc0433ffcc0466ff990499ffcc04ccffcc04ffffcc043300cc046600ff049900ff040033cc043333ff046633ff049933ff04cc33ff04ff33ff040066ff043366ff046666cc049966ff04cc66ff04ff66cc040099ff043399ff046699ff049999ff04cc99ff04ff99ff0400ccff0433ccff0466ccff0499ccff04ccccff040000dd6ba0dd900466ffcc0499ffff04ccffff0490dd90040000dd6b0000000001000000 (UID: 00000000-00003416) "1pH71tZ8.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000099049966cc04cc66cc04ff6699040099cc043399cc046699cc049999cc04cc99cc04ff99cc0400cccc0433cccc0466cccc0499cccc04cccccc04ffcccc0400ffcc0433ffcc0466ff990499ffcc04ccffcc04ffffcc043300cc046600ff049900ff040033cc043333ff046633ff049933ff04cc33ff04ff33ff040066ff043366ff046666cc049966ff04cc66ff04ff66cc040099ff043399ff046699ff049999ff04cc99ff04ff99ff0400ccff0433ccff0466ccff0499ccff04ccccff040000dd6b60ddf70266ffcc0499ffff04ccffff0450ddf7020000dd6b0000000001000000 (UID: 00000000-00003416) "1pH71tZ8.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000099049966cc04cc66cc04ff6699040099cc043399cc046699cc049999cc04cc99cc04ff99cc0400cccc0433cccc0466cccc0499cccc04cccccc04ffcccc0400ffcc0433ffcc0466ff990499ffcc04ccffcc04ffffcc043300cc046600ff049900ff040033cc043333ff046633ff049933ff04cc33ff04ff33ff040066ff043366ff046666cc049966ff04cc66ff04ff66cc040099ff043399ff046699ff049999ff04cc99ff04ff99ff0400ccff0433ccff0466ccff0499ccff04ccccff040000dd6b90dd040366ffcc0499ffff04ccffff0480dd04030000dd6b0000000001000000 (UID: 00000000-00003416) "1pH71tZ8.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000099049966cc04cc66cc04ff6699040099cc043399cc046699cc049999cc04cc99cc04ff99cc0400cccc0433cccc0466cccc0499cccc04cccccc04ffcccc0400ffcc0433ffcc0466ff990499ffcc04ccffcc04ffffcc043300cc046600ff049900ff040033cc043333ff046633ff049933ff04cc33ff04ff33ff040066ff043366ff046666cc049966ff04cc66ff04ff66cc040099ff043399ff046699ff049999ff04cc99ff04ff99ff0400ccff0433ccff0466ccff0499ccff04ccccff040000dd6b00e2ee0266ffcc0499ffff04ccffff04f0e1ee020000dd6b0000000001000000 (UID: 00000000-00003416) "4Uh436mr.exe" called "RtlGetVersion" with parameter 000000000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00003628) "AppLaunch.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00002108)30:T1034,"1pH71tZ8.exe" called "GetVersionExA" with parameter 9c0000000600000001000000b11d00000200000053657276696365205061636b2031000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00003416) "AppLaunch.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b20310034342c2c4973576f77363450726f636573732c6b65726e656c33322e646c6c2c223235323a30333a30372e323635222c52583d302c50583d300030000039005c0063006f006e006600690067005c006d0061006300680069006e0065002e0063006f006e0066006900670000009d00009d (UID: 00000000-00002108) "AppLaunch.exe" called "GetVersionExA" with parameter 9c0000000600000001000000b11d00000200000053657276696365205061636b2031000000000000000000000200000000000000d8eb547598ee66000060fd7f9a5c057700f0fd7f28be34004460fd7f00000000400000003f0000002c0000000060fd7f1cbe3400c15c057760820c772c0000000060fd7f9a5c057700f0fd7f40be34005789047780830c771317f574d8eb5475 (UID: 00000000-00002108) "AppLaunch.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b20310000a86c5b004800000010000000000000007817de0698695b00cc6a5b00805bde0668705b0000005b00a4ea3008a8ea300820f2300895e1007788650700feffffffff2b04779a2a0477f8d20208030000000000000030080000a86c5b005ceb3008bb5c667200005b000000000022080000 (UID: 00000000-00002108) "AppLaunch.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b20310000338ace6cd8ea060800000000e8e234002827ce6cd8ea060830e334000723cd6cd8ea060820000000000000005c37cd6c28123102303288022812310202000000000000001800000000ea060834e334002823856600005b00000000000c0000003032880240e334002f99d96d0c000000 (UID: 00000000-00002108) "AppLaunch.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b20310076808c6900888e5f0000000000808c690020000000000000006ce3340050dc2b75808c690010000000ec666600b435f8071000000098e33400a6ecd46f0200000000000000180000000832d96d9ce334002823856600005b00000000000c0000000832d96da8e334002f99d96d0c000000 (UID: 00000000-00002108) "AppLaunch.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b2031000001000000c0e434006a6f996600000000bc6f9966c1d57bb73ce034000000000010f2340015de32752df47bc2feffffff7f673a75e2d8e7762824876e02000000000000001800000030a5d96d80e434002823856600005b00000000000c00000030a5d96d8ce434002f99d96d0c000000 (UID: 00000000-00002108) "powershell.exe" called "GetVersionExA" with parameter 9c0000000600000001000000b11d00000200000053657276696365205061636b2031000000000000000000000200000000000000d8eb5475e8f4290000c0fd7f9a5c057700f0fd7f48bc160044c0fd7f00000000400000003f0000001d00000000c0fd7f3cbc1600c15c057760820c771d00000000c0fd7f9a5c057700f0fd7f60bc16005789047780830c771317f574d8eb5475 (UID: 00000000-00001788) "powershell.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b2031000072006f0073006f00660074002e004e00450054005c004600720061006d00650077006f0072006b005c00760032002e0030002e00350030003700320037005c006d00730063006f00720077006b0073002e0064006c006c002e0032002e004d0061006e00690066006500730074000000 (UID: 00000000-00001788) "powershell.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b20310000636dc8710000f801000000006c6dc8718228da92d8d7d362eceb1600e8eb160000000000000000000000000000000000d8d7d36240eb160000000000b0eb1600eceb160080eb1600ff23c871c83bd171c0eb16003117c871080000001c5c037714a10477ffffffff24000000a8eb1600 (UID: 00000000-00001788) "powershell.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b2031000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00001788)31:T6f7,"ac18ad4de0d70e7cbbfb829afea0dd45.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "ac18ad4de0d70e7cbbfb829afea0dd45.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "lP8PV47.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "lP8PV47.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "1pH71tZ8.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "1pH71tZ8.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "4Uh436mr.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "4Uh436mr.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "AppLaunch.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "AppLaunch.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "6qY7ld8.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "cmd.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "cmd.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "schtasks.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED")32:T6ae,Found reference to API "GetVersion" (Indicator: "GetVersion"; File: "ac18ad4de0d70e7cbbfb829afea0dd45.exe") Found reference to API "GetVersionExA" (Indicator: "GetVersionExA"; File: "ac18ad4de0d70e7cbbfb829afea0dd45.exe") Found reference to API "GetVersionExA" (Indicator: "GetVersion"; File: "ac18ad4de0d70e7cbbfb829afea0dd45.exe") Found reference to API "515200242,2908,3024,,RtlGetVersion,NTDLL.dll,"252:02:33.796",RX=0,PX=0" (Indicator: "GetVersion"; Source: "00000000-00002632.00000000.65533.00320000.00000004.mdmp") Found reference to API "49776644715,2908,3024,,RtlGetVersion,NTDLL.dll,"252:03:02.281",RX=0,PX=0" (Indicator: "GetVersion"; Source: "00000000-00002632.00000001.67454.00320000.00000004.mdmp, 00000000-00002632.00000002.67682.00320000.00000004.mdmp") Found reference to API "GetVersion" (Indicator: "GetVersion"; Source: "00000000-00002632.00000002.67682.00F2A000.00000002.mdmp") Found reference to API "GetVersionExA" (Indicator: "GetVersionExA"; Source: "00000000-00002632.00000002.67682.00F2A000.00000002.mdmp") Found reference to API "GetVersionExA" (Indicator: "GetVersion"; Source: "00000000-00002632.00000002.67682.00F2A000.00000002.mdmp") Found reference to API "GetVersionExW" (Indicator: "GetVersionExW"; Source: "00000000-00003416.00000000.65622.00F5C000.00000002.mdmp") Found reference to API "GetVersionExW" (Indicator: "GetVersion"; Source: "00000000-00003416.00000000.65622.00F5C000.00000002.mdmp") Found reference to API "GetVersionExA" (Indicator: "GetVersionExA"; Source: "00000000-00003416.00000000.65622.6D110000.00000002.mdmp") Found reference to API "GetVersionExA" (Indicator: "GetVersion"; Source: "00000000-00003416.00000000.65622.6D110000.00000002.mdmp")33:T74a,"AppLaunch.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{90A066FE-591C-47F3-850D-9644B684FBA5}"; Key: "ENABLEDHCP"; Value: "") "AppLaunch.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{90A066FE-591C-47F3-850D-9644B684FBA5}"; Key: "REGISTRATIONENABLED"; Value: "") "AppLaunch.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{90A066FE-591C-47F3-850D-9644B684FBA5}"; Key: "REGISTERADAPTERNAME"; Value: "") "AppLaunch.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{90A066FE-591C-47F3-850D-9644B684FBA5}"; Key: "DOMAIN"; Value: "") "AppLaunch.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{90A066FE-591C-47F3-850D-9644B684FBA5}"; Key: "DHCPDOMAIN"; Value: "") "AppLaunch.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E29AC6C2-7037-11DE-816D-806E6F6E6963}"; Key: "ENABLEDHCP"; Value: "") "AppLaunch.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E29AC6C2-7037-11DE-816D-806E6F6E6963}"; Key: "REGISTRATIONENABLED"; Value: "") "AppLaunch.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E29AC6C2-7037-11DE-816D-806E6F6E6963}"; Key: "REGISTERADAPTERNAME"; Value: "") "AppLaunch.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E29AC6C2-7037-11DE-816D-806E6F6E6963}"; Key: "DOMAIN"; Value: "") "AppLaunch.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E29AC6C2-7037-11DE-816D-806E6F6E6963}"; Key: "DHCPDOMAIN"; Value: "")34:T9ea,"AppLaunch.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "AppLaunch.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "AppLaunch.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS"; Key: "") "AppLaunch.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS"; Key: "") "AppLaunch.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "AppLaunch.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "AppLaunch.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS"; Key: "") "AppLaunch.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS"; Key: "") "AppLaunch.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED"; Key: "") "AppLaunch.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES"; Key: "") "AppLaunch.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS"; Key: "") "AppLaunch.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS"; Key: "") "AppLaunch.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED"; Key: "") "AppLaunch.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES"; Key: "") "AppLaunch.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS"; Key: "") "AppLaunch.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS"; Key: "") "AppLaunch.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT"; Key: "") "AppLaunch.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES"; Key: "") "AppLaunch.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CRLS"; Key: "") "AppLaunch.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CTLS"; Key: "") "AppLaunch.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE"; Key: "") "AppLaunch.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE\CERTIFICATES"; Key: "") "AppLaunch.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE\CRLS"; Key: "") "AppLaunch.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE\CTLS"; Key: "") "AppLaunch.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE"; Key: "")35:T59a,"AppLaunch.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\AUTOUPDATE"; Key: "DISALLOWEDCERTSYNCDELTATIME") "AppLaunch.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\MY"; Key: "") "AppLaunch.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "AppLaunch.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "AppLaunch.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\2E4916B07F3DE90C8DDE2566FD9B9B400D89BBBA"; Key: "BLOB") "AppLaunch.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\5AEAEE3F7F2A9449CEBAFEEC68FDD184F20124A7"; Key: "BLOB") "AppLaunch.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\E6A3B45B062D509B3382282D196EFE97D5956CCB"; Key: "BLOB") "AppLaunch.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\F5AD0BCC1AD56CD150725B1C866C30AD92EF21B0"; Key: "BLOB") "AppLaunch.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS"; Key: "") "AppLaunch.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS"; Key: "") "AppLaunch.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "AppLaunch.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "AppLaunch.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\109F1CAED645BB78B3EA2B94C0697C740733031C"; Key: "BLOB")36:T4a9,"AppLaunch.exe" called "CopyFileW" to copy %WINDIR%\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe to new location %LOCALAPPDATA%\MaxLoonaFest131\MaxLoonaFest131.exe (UID: 00000000-00002108) "AppLaunch.exe" called "CopyFileW" to copy %WINDIR%\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe to new location %TEMP%\FANBooster131\FANBooster131.exe (UID: 00000000-00002108) "AppLaunch.exe" called "CopyFileW" to copy %WINDIR%\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe to new location %ALLUSERSPROFILE%\OfficeTrackerNMP131\OfficeTrackerNMP131.exe (UID: 00000000-00002108) "AppLaunch.exe" called "CopyFileW" to copy %APPDATA%\Mozilla\Firefox\Profiles\g4h7miqt.default\places.sqlite to new location %TEMP%\tempAVSfLAzW1Bz9gE0\WnLWxEJdg8rnplaces.sqlite (UID: 00000000-00002108) "AppLaunch.exe" called "CopyFileW" to copy %APPDATA%\Mozilla\Firefox\Profiles\g4h7miqt.default\cookies.sqlite to new location %TEMP%\tempAVSfLAzW1Bz9gE0\TuMisuVwKTrzcookies.sqlite (UID: 00000000-00002108) "AppLaunch.exe" called "CopyFileW" to copy %APPDATA%\Mozilla\Firefox\Profiles\g4h7miqt.default\places.sqlite to new location %TEMP%\tempAVSfLAzW1Bz9gE0\rhDkFzZ5zd3gplaces.sqlite (UID: 00000000-00002108)37:T55c,"AppLaunch.exe" called "CreateDirectoryW" with parameter C:\Users\%OSUSER% (UID: 00000000-00002108) "AppLaunch.exe" called "CreateDirectoryW" with parameter %USERPROFILE%\AppData\Roaming (UID: 00000000-00002108) "AppLaunch.exe" called "CreateDirectoryW" with parameter %LOCALAPPDATA%\MaxLoonaFest131 (UID: 00000000-00002108) "AppLaunch.exe" called "CreateDirectoryW" with parameter %TEMP%\FANBooster131 (UID: 00000000-00002108) "AppLaunch.exe" called "CreateDirectoryW" with parameter %LOCALAPPDATA%\Microsoft\Windows\Caches (UID: 00000000-00002108) "AppLaunch.exe" called "CreateDirectoryW" with parameter %ALLUSERSPROFILE%\OfficeTrackerNMP131 (UID: 00000000-00002108) "AppLaunch.exe" called "CreateDirectoryW" with parameter %TEMP%\tempCMSfLAzW1Bz9gE0 (UID: 00000000-00002108) "AppLaunch.exe" called "CreateDirectoryW" with parameter %TEMP%\tempAVSfLAzW1Bz9gE0 (UID: 00000000-00002108) "powershell.exe" called "CreateDirectoryW" with parameter %LOCALAPPDATA%\Microsoft\Windows\Caches (UID: 00000000-00001788) "powershell.exe" called "CreateDirectoryW" with parameter %APPDATA%\Microsoft\Windows\Recent\CustomDestinations (UID: 00000000-00001788) "powershell.exe" called "CreateDirectoryW" with parameter C:\Users\%OSUSER% (UID: 00000000-00001788) "powershell.exe" called "CreateDirectoryW" with parameter %USERPROFILE%\AppData\Roaming (UID: 00000000-00001788)38:T7019,"ac18ad4de0d70e7cbbfb829afea0dd45.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\advpack.dll (UID: 00000000-00002632) "lP8PV47.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00003784) "lP8PV47.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00003784) "lP8PV47.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00003784) "lP8PV47.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00003784) "lP8PV47.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\advpack.dll (UID: 00000000-00003784) "1pH71tZ8.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\uxtheme.dll (UID: 00000000-00003416) "1pH71tZ8.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00003416) "1pH71tZ8.exe" called "LoadLibrary" with a parameter %TEMP%\IXP001.TMP\1pH71tZ8.exe (UID: 00000000-00003416) "1pH71tZ8.exe" called "LoadLibrary" with a parameter api-ms-win-core-sysinfo-l1-2-1 (UID: 00000000-00003416) "1pH71tZ8.exe" called "LoadLibrary" with a parameter dwmapi.dll (UID: 00000000-00003416) "1pH71tZ8.exe" called "LoadLibrary" with a parameter comctl32.dll (UID: 00000000-00003416) "1pH71tZ8.exe" called "LoadLibrary" with a parameter UxTheme.dll (UID: 00000000-00003416) "1pH71tZ8.exe" called "LoadLibrary" with a parameter IMM32.dll (UID: 00000000-00003416) "1pH71tZ8.exe" called "LoadLibrary" with a parameter comctl32 (UID: 00000000-00003416) "1pH71tZ8.exe" called "LoadLibrary" with a parameter SHELL32.dll (UID: 00000000-00003416) "1pH71tZ8.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00003416) "1pH71tZ8.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00003416) "1pH71tZ8.exe" called "LoadLibrary" with a parameter %WINDIR%\System32\ieframe.dll (UID: 00000000-00003416) "1pH71tZ8.exe" called "LoadLibrary" with a parameter urlmon.dll (UID: 00000000-00003416) "1pH71tZ8.exe" called "LoadLibrary" with a parameter %PROGRAMFILES%\Internet Explorer\ieproxy.dll (UID: 00000000-00003416) "1pH71tZ8.exe" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00003416) "1pH71tZ8.exe" called "LoadLibrary" with a parameter api-ms-win-downlevel-ole32-l1-1-0.dll (UID: 00000000-00003416) "1pH71tZ8.exe" called "LoadLibrary" with a parameter iertutil.dll (UID: 00000000-00003416) "1pH71tZ8.exe" called "LoadLibrary" with a parameter api-ms-win-downlevel-shlwapi-l2-1-0.dll (UID: 00000000-00003416) "1pH71tZ8.exe" called "LoadLibrary" with a parameter PROPSYS.dll (UID: 00000000-00003416) "1pH71tZ8.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00003416) "1pH71tZ8.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-1 (UID: 00000000-00003416) "1pH71tZ8.exe" called "LoadLibrary" with a parameter ext-ms-win-kernel32-package-current-l1-1-0 (UID: 00000000-00003416) "4Uh436mr.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-obsolete-l1-2-0 (UID: 00000000-00003628) "4Uh436mr.exe" called "LoadLibrary" with a parameter api-ms-win-core-string-l1-1-0 (UID: 00000000-00003628) "4Uh436mr.exe" called "LoadLibrary" with a parameter api-ms-win-core-datetime-l1-1-1 (UID: 00000000-00003628) "4Uh436mr.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2 (UID: 00000000-00003628) "AppLaunch.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00002108) "AppLaunch.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2.dll (UID: 00000000-00002108) "AppLaunch.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-0.dll (UID: 00000000-00002108) "AppLaunch.exe" called "LoadLibrary" with a parameter VERSION.dll (UID: 00000000-00002108) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0\clr.dll (UID: 00000000-00002108) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\clr.dll (UID: 00000000-00002108) "AppLaunch.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00002108) "AppLaunch.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00002108) "AppLaunch.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00002108) "AppLaunch.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00002108) "AppLaunch.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00002108) "AppLaunch.exe" called "LoadLibrary" with a parameter api-ms-win-core-quirks-l1-1-0.dll (UID: 00000000-00002108) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoree.dll (UID: 00000000-00002108) "AppLaunch.exe" called "LoadLibrary" with a parameter mscoree.dll (UID: 00000000-00002108) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\combase.dll (UID: 00000000-00002108) "AppLaunch.exe" called "LoadLibrary" with a parameter psapi.dll (UID: 00000000-00002108) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\mscorlib\36eaccfde177c2e7b93b8dbdde4e012a\mscorlib.ni.dll (UID: 00000000-00002108) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\ole32.dll (UID: 00000000-00002108) "AppLaunch.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00002108) "AppLaunch.exe" called "LoadLibrary" with a parameter api-ms-win-core-xstate-l2-1-0.dll (UID: 00000000-00002108) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\clrjit.dll (UID: 00000000-00002108) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System\2c3c912ea8f058f9d04c4650128feb3f\System.ni.dll (UID: 00000000-00002108) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Core\31fae3290fad30c31c98651462d22724\System.Core.ni.dll (UID: 00000000-00002108) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\Microsoft.CSharp\f73f48afb5512225dedaee9c88ac5050\Microsoft.CSharp.ni.dll (UID: 00000000-00002108) "AppLaunch.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00002108) "AppLaunch.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00002108) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\nlssorting.dll (UID: 00000000-00002108) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Configuration\96f7edb07b12303f0ec2595c7f3778c7\System.Configuration.ni.dll (UID: 00000000-00002108) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Xml\15af16d373cf0528cb74fc73d365fdbf\System.Xml.ni.dll (UID: 00000000-00002108) "AppLaunch.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00002108) "AppLaunch.exe" called "LoadLibrary" with a parameter shell32.dll (UID: 00000000-00002108) "AppLaunch.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00002108) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll (UID: 00000000-00002108) "AppLaunch.exe" called "LoadLibrary" with a parameter bcrypt.dll (UID: 00000000-00002108) "AppLaunch.exe" called "LoadLibrary" with a parameter CRYPTSP.dll (UID: 00000000-00002108) "AppLaunch.exe" called "LoadLibrary" with a parameter CRYPTBASE.dll (UID: 00000000-00002108) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll (UID: 00000000-00002108) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll (UID: 00000000-00002108) "AppLaunch.exe" called "LoadLibrary" with a parameter API-MS-Win-Security-LSALookup-L1-1-0.dll (UID: 00000000-00002108) "AppLaunch.exe" called "LoadLibrary" with a parameter propsys.dll (UID: 00000000-00002108) "AppLaunch.exe" called "LoadLibrary" with a parameter comctl32.dll (UID: 00000000-00002108) "AppLaunch.exe" called "LoadLibrary" with a parameter ntmarta.dll (UID: 00000000-00002108) "AppLaunch.exe" called "LoadLibrary" with a parameter SHELL32.dll (UID: 00000000-00002108) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\System32\shdocvw.dll (UID: 00000000-00002108) "AppLaunch.exe" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00002108) "AppLaunch.exe" called "LoadLibrary" with a parameter PROPSYS.dll (UID: 00000000-00002108) "AppLaunch.exe" called "LoadLibrary" with a parameter ntshrui.dll (UID: 00000000-00002108) "AppLaunch.exe" called "LoadLibrary" with a parameter srvcli.dll (UID: 00000000-00002108) "AppLaunch.exe" called "LoadLibrary" with a parameter cscapi.dll (UID: 00000000-00002108) "AppLaunch.exe" called "LoadLibrary" with a parameter slc.dll (UID: 00000000-00002108) "AppLaunch.exe" called "LoadLibrary" with a parameter API-MS-Win-Security-SDDL-L1-1-0.dll (UID: 00000000-00002108) "AppLaunch.exe" called "LoadLibrary" with a parameter SspiCli.dll (UID: 00000000-00002108) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ws2_32.dll (UID: 00000000-00002108) "AppLaunch.exe" called "LoadLibrary" with a parameter ws2_32.dll (UID: 00000000-00002108) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\sqlite3 (UID: 00000000-00002108) "AppLaunch.exe" called "LoadLibrary" with a parameter sqlite3 (UID: 00000000-00002108) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\rasapi32.dll (UID: 00000000-00002108) "AppLaunch.exe" called "LoadLibrary" with a parameter rasapi32.dll (UID: 00000000-00002108) "AppLaunch.exe" called "LoadLibrary" with a parameter RASMAN.DLL (UID: 00000000-00002108) "AppLaunch.exe" called "LoadLibrary" with a parameter rtutils.dll (UID: 00000000-00002108) "AppLaunch.exe" called "LoadLibrary" with a parameter API-MS-WIN-Service-winsvc-L1-1-0.dll (UID: 00000000-00002108) "AppLaunch.exe" called "LoadLibrary" with a parameter API-MS-WIN-Service-Management-L1-1-0.dll (UID: 00000000-00002108) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\winhttp.dll (UID: 00000000-00002108) "AppLaunch.exe" called "LoadLibrary" with a parameter winhttp.dll (UID: 00000000-00002108) "AppLaunch.exe" called "LoadLibrary" with a parameter WS2_32.dll (UID: 00000000-00002108) "AppLaunch.exe" called "LoadLibrary" with a parameter RPCRT4.dll (UID: 00000000-00002108) "AppLaunch.exe" called "LoadLibrary" with a parameter IPHLPAPI.DLL (UID: 00000000-00002108) "AppLaunch.exe" called "LoadLibrary" with a parameter NSI.dll (UID: 00000000-00002108) "AppLaunch.exe" called "LoadLibrary" with a parameter CFGMGR32.dll (UID: 00000000-00002108) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\en-US\tzres.dll.mui (UID: 00000000-00002108) "AppLaunch.exe" called "LoadLibrary" with a parameter user32.dll (UID: 00000000-00002108) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\iphlpapi.dll (UID: 00000000-00002108) "AppLaunch.exe" called "LoadLibrary" with a parameter iphlpapi.dll (UID: 00000000-00002108) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\secur32.dll (UID: 00000000-00002108) "AppLaunch.exe" called "LoadLibrary" with a parameter secur32.dll (UID: 00000000-00002108) "AppLaunch.exe" called "LoadLibrary" with a parameter ncrypt.dll (UID: 00000000-00002108) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\bcryptprimitives.dll (UID: 00000000-00002108) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\crypt32.dll (UID: 00000000-00002108) "AppLaunch.exe" called "LoadLibrary" with a parameter crypt32.dll (UID: 00000000-00002108) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\CRYPT32.dll (UID: 00000000-00002108) "AppLaunch.exe" called "LoadLibrary" with a parameter CRYPT32.dll (UID: 00000000-00002108) "AppLaunch.exe" called "LoadLibrary" with a parameter USERENV.dll (UID: 00000000-00002108) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Dynamic\b7ad5353ae4f44df28ce7ebc9a8a752a\System.Dynamic.ni.dll (UID: 00000000-00002108) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Data\df2dd09ed7c341842a104e1e668f184e\System.Data.ni.dll (UID: 00000000-00002108) "AppLaunch.exe" called "LoadLibrary" with a parameter vaultcli.dll (UID: 00000000-00002108) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll (UID: 00000000-00002108) "AppLaunch.exe" called "LoadLibrary" with a parameter KERNEL32.dll (UID: 00000000-00002108) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Management\e114780fd3ea5727401c06ea4f22ef35\System.Management.ni.dll (UID: 00000000-00002108) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\WindowsBase\1a4cc316fb6d09525321fc0be44692d8\WindowsBase.ni.dll (UID: 00000000-00002108) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\PresentationCore\468f4e17be144ca12a73a4297eacc9cc\PresentationCore.ni.dll (UID: 00000000-00002108) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\Presentatio5ae0f00f#\252cc7b0fae8cfe083bdc149957c0c54\PresentationFramework.ni.dll (UID: 00000000-00002108) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\PresentationCore\v4.0_4.0.0.0__31bf3856ad364e35\ucrtbase_clr0400.dll (UID: 00000000-00002108) "AppLaunch.exe" called "LoadLibrary" with a parameter ucrtbase_clr0400.dll (UID: 00000000-00002108) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\PresentationCore\v4.0_4.0.0.0__31bf3856ad364e35\SHLWAPI.dll (UID: 00000000-00002108) "AppLaunch.exe" called "LoadLibrary" with a parameter dwrite.dll (UID: 00000000-00002108) "AppLaunch.exe" called "LoadLibrary" with a parameter api-ms-win-core-string-l1-1-0 (UID: 00000000-00002108) "AppLaunch.exe" called "LoadLibrary" with a parameter api-ms-win-core-datetime-l1-1-1 (UID: 00000000-00002108) "AppLaunch.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-obsolete-l1-2-0 (UID: 00000000-00002108) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\WPF\wpfgfx_v0400.dll (UID: 00000000-00002108) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\WPF\PresentationNative_v0400.dll (UID: 00000000-00002108) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\\wminet_utils.dll (UID: 00000000-00002108) "AppLaunch.exe" called "LoadLibrary" with a parameter API-MS-Win-Core-LocalRegistry-L1-1-0.dll (UID: 00000000-00002108) "AppLaunch.exe" called "LoadLibrary" with a parameter oleaut32.dll (UID: 00000000-00002108) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll (UID: 00000000-00002108) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\OLEAUT32.dll (UID: 00000000-00002108) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\setupapi.dll (UID: 00000000-00002108) "AppLaunch.exe" called "LoadLibrary" with a parameter setupapi.dll (UID: 00000000-00002108) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\winbrand.dll (UID: 00000000-00002108) "AppLaunch.exe" called "LoadLibrary" with a parameter winbrand.dll (UID: 00000000-00002108) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\Branding\Basebrd\Basebrd.dll (UID: 00000000-00002108) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\uxtheme.dll (UID: 00000000-00001788) "powershell.exe" called "LoadLibrary" with a parameter comctl32.dll (UID: 00000000-00001788) "powershell.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00001788) "powershell.exe" called "LoadLibrary" with a parameter SHELL32.dll (UID: 00000000-00001788) "powershell.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00001788) "powershell.exe" called "LoadLibrary" with a parameter propsys.dll (UID: 00000000-00001788) "powershell.exe" called "LoadLibrary" with a parameter ntmarta.dll (UID: 00000000-00001788) "powershell.exe" called "LoadLibrary" with a parameter API-MS-Win-Core-LocalRegistry-L1-1-0.dll (UID: 00000000-00001788) "powershell.exe" called "LoadLibrary" with a parameter PROPSYS.dll (UID: 00000000-00001788) "powershell.exe" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00001788) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\shell32.dll (UID: 00000000-00001788) "powershell.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00001788) "powershell.exe" called "LoadLibrary" with a parameter ntshrui.dll (UID: 00000000-00001788) "powershell.exe" called "LoadLibrary" with a parameter srvcli.dll (UID: 00000000-00001788) "powershell.exe" called "LoadLibrary" with a parameter cscapi.dll (UID: 00000000-00001788) "powershell.exe" called "LoadLibrary" with a parameter slc.dll (UID: 00000000-00001788) "powershell.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00001788) "powershell.exe" called "LoadLibrary" with a parameter CRYPTBASE.dll (UID: 00000000-00001788) "powershell.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00001788) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00001788) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00001788) "powershell.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00001788) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00001788) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll (UID: 00000000-00001788) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2.dll (UID: 00000000-00001788) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-0.dll (UID: 00000000-00001788) "powershell.exe" called "LoadLibrary" with a parameter VERSION.dll (UID: 00000000-00001788) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v2.0.50727\mscorwks.dll (UID: 00000000-00001788) "powershell.exe" called "LoadLibrary" with a parameter mscoree.dll (UID: 00000000-00001788) "powershell.exe" called "LoadLibrary" with a parameter ntdll (UID: 00000000-00001788) "powershell.exe" called "LoadLibrary" with a parameter shell32.dll (UID: 00000000-00001788) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v2.0.50727_32\mscorlib\9f895c66454577eff9c77442d0c84f71\mscorlib.ni.dll (UID: 00000000-00001788) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v2.0.50727\ole32.dll (UID: 00000000-00001788) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v2.0.50727\OLEAUT32.dll (UID: 00000000-00001788) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v2.0.50727_32\System\ad92dab7f418877d6a1e0358ce35658a\System.ni.dll (UID: 00000000-00001788) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v2.0.50727_32\Microsoft.PowerShel#\8229f0505633d4bcef019b9d4fab9f18\Microsoft.PowerShell.ConsoleH (UID: 00000000-00001788) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v2.0.50727_32\System.Management.A#\84c47b5a5813a5f040aee9715a0ff7c0\System.Management.Automation. (UID: 00000000-00001788) "powershell.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00001788) "powershell.exe" called "LoadLibrary" with a parameter version.dll (UID: 00000000-00001788) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\GAC_MSIL\System.Management.Automation\1.0.0.0__31bf3856ad364e35\System.Management.Automation.dll (UID: 00000000-00001788) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\GAC_MSIL\System\2.0.0.0__b77a5c561934e089\psapi.dll (UID: 00000000-00001788) "powershell.exe" called "LoadLibrary" with a parameter psapi.dll (UID: 00000000-00001788) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\GAC_MSIL\System\2.0.0.0__b77a5c561934e089\ntdll.dll (UID: 00000000-00001788) "powershell.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00001788) "powershell.exe" called "LoadLibrary" with a parameter user32.dll (UID: 00000000-00001788) "powershell.exe" called "LoadLibrary" with a parameter AdvApi32.dll (UID: 00000000-00001788) "powershell.exe" called "LoadLibrary" with a parameter CRYPTSP.dll (UID: 00000000-00001788) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v2.0.50727_32\System.Core\bd9ff1a4363781a57e8f7392f230a203\System.Core.ni.dll (UID: 00000000-00001788) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v2.0.50727_32\Microsoft.PowerShel#\49cae79ac18bad142e1ab5a46a8ac306\Microsoft.PowerShell.Commands (UID: 00000000-00001788) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v2.0.50727_32\System.Configuratio#\d6acc39f6c1ea42d8b3150db6184a969\System.Configuration.Install. (UID: 00000000-00001788) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v2.0.50727_32\Microsoft.WSMan.Man#\7bf5729401cff7ea7898124e9818ed20\Microsoft.WSMan.Management.ni (UID: 00000000-00001788) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v2.0.50727_32\System.Transactions\fec007ea17ac8956cc5d6d4074dada6a\System.Transactions.ni.dll (UID: 00000000-00001788) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\GAC_32\System.Transactions\2.0.0.0__b77a5c561934e089\System.Transactions.dll (UID: 00000000-00001788) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v2.0.50727_32\Microsoft.PowerShel#\f1831ce4588265a3f72e0a581ba58f2a\Microsoft.PowerShell.Commands (UID: 00000000-00001788) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v2.0.50727_32\Microsoft.PowerShel#\344e681515d07b93a4f1383f0d625e1e\Microsoft.PowerShell.Commands (UID: 00000000-00001788) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v2.0.50727_32\Microsoft.PowerShel#\573750f17b5b8316f04a10956fdd1d97\Microsoft.PowerShell.Security (UID: 00000000-00001788) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v2.0.50727\culture.dll (UID: 00000000-00001788) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v2.0.50727\en-US\mscorrc.dll (UID: 00000000-00001788) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v2.0.50727\en\mscorrc.dll (UID: 00000000-00001788) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v2.0.50727\mscorrc.dll (UID: 00000000-00001788) "powershell.exe" called "LoadLibrary" with a parameter KERNEL32.dll (UID: 00000000-00001788) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v2.0.50727_32\System.Xml\77c1dc46ea139bf5e1eaa9b87ef03c7a\System.Xml.ni.dll (UID: 00000000-00001788) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v2.0.50727_32\System.Management\00c2b464e52d4e82c04d61592a12a89d\System.Management.ni.dll (UID: 00000000-00001788) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v2.0.50727_32\System.DirectorySer#\237ed1739105c1bebe48d41905fdb3ee\System.DirectoryServices.ni.d (UID: 00000000-00001788) "powershell.exe" called "LoadLibrary" with a parameter shfolder.dll (UID: 00000000-00001788) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\secur32.dll (UID: 00000000-00001788) "powershell.exe" called "LoadLibrary" with a parameter secur32.dll (UID: 00000000-00001788) "powershell.exe" called "LoadLibrary" with a parameter SspiCli.dll (UID: 00000000-00001788) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v2.0.50727_32\System.Data\511c39d1efa06d262a6b2f47e2726c73\System.Data.ni.dll (UID: 00000000-00001788) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\GAC_32\System.Data\2.0.0.0__b77a5c561934e089\System.Data.dll (UID: 00000000-00001788) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v2.0.50727\mscorjit.dll (UID: 00000000-00001788) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v2.0.50727\diasymreader.dll (UID: 00000000-00001788) "powershell.exe" called "LoadLibrary" with a parameter GDI32.dll (UID: 00000000-00001788) "powershell.exe" called "LoadLibrary" with a parameter netutils.dll (UID: 00000000-00001788) "schtasks.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00003892) "schtasks.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00003892) "schtasks.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00003892) "schtasks.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00003892) "schtasks.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\schtasks.exe (UID: 00000000-00003892) "schtasks.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\uxtheme.dll (UID: 00000000-00003892) "schtasks.exe" called "LoadLibrary" with a parameter API-MS-Win-Security-LSALookup-L1-1-0.dll (UID: 00000000-00003892) "schtasks.exe" called "LoadLibrary" with a parameter SspiCli.dll (UID: 00000000-00003892) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00001928) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00001928) "cmd.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00001928) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00001928) "schtasks.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00003776) "schtasks.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\schtasks.exe (UID: 00000000-00003776) "schtasks.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00003776) "schtasks.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00003776) "schtasks.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\uxtheme.dll (UID: 00000000-00003776) "schtasks.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00003776) "schtasks.exe" called "LoadLibrary" with a parameter API-MS-Win-Security-LSALookup-L1-1-0.dll (UID: 00000000-00003776) "schtasks.exe" called "LoadLibrary" with a parameter SspiCli.dll (UID: 00000000-00003776)39:Tbfa,"Select Your Wireless NetworkySelect the network name (SSID) of your wireless network from the list. Network names may take up to 60 seconds to appear." (Source: 00000000-00003416.00000001.66534.028C0000.00000002.mdmp, Indicator: "select your wireless networkyselect the network name (ssid) of your wireless network from the list. network names may take up to 60 seconds to appear."), "Select Your Connection}Select your connection from the list. The connection must have a saved user name and password and be available to all users." (Source: 00000000-00003416.00000001.66534.028C0000.00000002.mdmp, Indicator: "select your connection}select your connection from the list. the connection must have a saved user name and password and be available to all users."), "Select Your Set-top Box Brand}Select the brand of your set-top box from the list. If your brand is not listed select Not Listed at the bottom of the list." (Source: 00000000-00003416.00000001.66534.028C0000.00000002.mdmp, Indicator: "select your set-top box brand}select the brand of your set-top box from the list. if your brand is not listed select not listed at the bottom of the list."), "Select the appropriate display resolution from the list below. For best results use the resolution recommended by the manufacturer in the display hardware documentation." (Source: 00000000-00003416.00000001.66534.028C0000.00000002.mdmp, Indicator: "select the appropriate display resolution from the list below. for best results use the resolution recommended by the manufacturer in the display hardware documentation."), "insert it into the digital tuner and select Scan Again." (Source: 00000000-00003416.00000001.66534.028C0000.00000002.mdmp, Indicator: "insert it into the digital tuner and select scan again."), "Select Add Channel to enter the name and channel number for a standard TV channel that is missing from the Guide. To add a digital TV channel select Add DTV Channel." (Source: 00000000-00003416.00000001.66534.028C0000.00000002.mdmp, Indicator: "select add channel to enter the name and channel number for a standard tv channel that is missing from the guide. to add a digital tv channel select add dtv channel."), "Select OK for more information.ZYour Guide listings include one or more channels that share programming from two networks." (Source: 00000000-00003416.00000001.66534.028C0000.00000002.mdmp, Indicator: "select ok for more information.zyour guide listings include one or more channels that share programming from two networks."), "Select a folder for backing up or restoring your media usage rights.ORequesting approval to restore media usage rights. This may take a few minutes.&Transferring media usage rights to %s.(Transferring media usage rights from %s." (Source: 00000000-00003416.00000001.66534.028C0000.00000002.mdmp, Indicator: "select a folder for backing up or restoring your media usage rights.orequesting approval to restore media usage rights. this may take a few minutes.&transferring media usage rights to %s.(transferring media usage rights from %s.")3a:T121d,Found reference to API "CreateProcessA" (Indicator: "CreateProcess"; File: "ac18ad4de0d70e7cbbfb829afea0dd45.exe") Found reference to API "ElevateCreateProcess WRPMitigationLayer" (Indicator: "CreateProcess"; File: "00003784.00000EC8.816003.00050000.wprm") Found reference to API "__COMPAT_LAYER=ElevateCreateProcess WRPMitigationLayer" (Indicator: "CreateProcess"; Source: "00000000-00000284.00000000.67408.00AF0000.00000004.mdmp, 00000000-00000284.00000001.67626.003D0000.00000004.mdmp, 00000000-00000284.00000001.67626.00800000.00000004.mdmp, 00000000-00000284.00000001.67626.00AF0000.00000004.mdmp") Found reference to API "__COMPAT_LAYER=ElevateCreateProcess WRPMitig" (Indicator: "CreateProcess"; Source: "00000000-00000284.00000001.67626.003D0000.00000004.mdmp") Found reference to API "__COMPAT_LAYER=ElevateCreateProcess WRPMitigationLayer" (Indicator: "CreateProcess"; Source: "00000000-00002632.00000000.65533.00320000.00000004.mdmp, 00000000-00002632.00000001.67454.000B0000.00000004.mdmp, 00000000-00002632.00000001.67454.00320000.00000004.mdmp, 00000000-00002632.00000001.67454.00740000.00000004.mdmp, 00000000-00002632.00000002.67682.000B0000.00000004.mdmp, 00000000-00002632.00000002.67682.00320000.00000004.mdmp, 00000000-00002632.00000002.67682.00740000.00000004.mdmp") Found reference to API "ElevateCreateProcess" (Indicator: "CreateProcess"; Source: "00000000-00002632.00000000.65533.00320000.00000004.mdmp, 00000000-00002632.00000001.67454.00320000.00000004.mdmp, 00000000-00002632.00000002.67682.00320000.00000004.mdmp") Found reference to API "MPAT_LAYER=ElevateCreateProcess WRPMitigationLayer" (Indicator: "CreateProcess"; Source: "00000000-00002632.00000000.65533.00320000.00000004.mdmp, 00000000-00002632.00000001.67454.00320000.00000004.mdmp") Found reference to API "ElevateCreateProcess WRPMitigationLayer" (Indicator: "CreateProcess"; Source: "00000000-00002632.00000000.65533.00320000.00000004.mdmp, 00000000-00002632.00000001.67454.00320000.00000004.mdmp, 00000000-00002632.00000002.67682.00320000.00000004.mdmp") Found reference to API "523472861,2908,3136,,CreateProcessA,kernel32.dll,"252:02:33.796",RX=0,PX=0" (Indicator: "CreateProcess"; Source: "00000000-00002632.00000000.65533.00320000.00000004.mdmp") Found reference to API "49802719591,2908,3136,,CreateProcessA,kernel32.dll,"252:03:02.296",RX=0,PX=0" (Indicator: "CreateProcess"; Source: "00000000-00002632.00000001.67454.00320000.00000004.mdmp") Found reference to API "__COMPAT_LAYER=ElevateCreateProcess WRPMitigs+X" (Indicator: "CreateProcess"; Source: "00000000-00002632.00000001.67454.00740000.00000004.mdmp") Found reference to API "__COMPAT_LAYER=ElevateCreateProcess WRPMitig" (Indicator: "CreateProcess"; Source: "00000000-00002632.00000002.67682.00740000.00000004.mdmp") Found reference to API "CreateProcessA" (Indicator: "CreateProcess"; Source: "00000000-00002632.00000002.67682.00F2A000.00000002.mdmp") Found reference to API "__COMPAT_LAYER=ElevateCreateProcess WRPMitigationLayer" (Indicator: "CreateProcess"; Source: "00000000-00003416.00000000.65622.00180000.00000004.mdmp, 00000000-00003416.00000000.65622.00660000.00000004.mdmp, 00000000-00003416.00000000.65622.01550000.00000004.mdmp, 00000000-00003416.00000001.66534.00180000.00000004.mdmp, 00000000-00003416.00000001.66534.00660000.00000004.mdmp, 00000000-00003416.00000001.66534.006B6000.00000004.mdmp, 00000000-00003416.00000001.66534.01550000.00000004.mdmp") Found reference to API "ElevateCreateProcess" (Indicator: "CreateProcess"; Source: "00000000-00003416.00000000.65622.00660000.00000004.mdmp, 00000000-00003416.00000001.66534.00660000.00000004.mdmp") Found reference to API "_COMPAT_LAYER=ElevateCreateProcess WRPMitigationLayer" (Indicator: "CreateProcess"; Source: "00000000-00003416.00000000.65622.00660000.00000004.mdmp, 00000000-00003416.00000001.66534.00660000.00000004.mdmp") Found reference to API "CreateProcessW" (Indicator: "CreateProcess"; Source: "00000000-00003416.00000000.65622.00F5C000.00000002.mdmp") Found reference to API "CreateProcessAsUserW" (Indicator: "CreateProcess"; Source: "00000000-00003416.00000000.65622.00F5C000.00000002.mdmp") Found reference to API "CreateProcessWithLogonW" (Indicator: "CreateProcess"; Source: "00000000-00003416.00000000.65622.00F5C000.00000002.mdmp") Found reference to API "ElevateCreateProcess WRPMitigationLayer" (Indicator: "CreateProcess"; Source: "00000000-00003416.00000001.66534.006B6000.00000004.mdmp") Found reference to API "MPAT_LAYER=ElevateCreateProcess WRPMitigationLayer" (Indicator: "CreateProcess"; Source: "00000000-00003416.00000001.66534.006B6000.00000004.mdmp")3b:T13dbe,Found reference to API (Indicator: "CheckTokenMembership"; File: "ac18ad4de0d70e7cbbfb829afea0dd45.exe") Found reference to API (Indicator: "HeapSetInformation"; File: "ac18ad4de0d70e7cbbfb829afea0dd45.exe") Found reference to API (Indicator: "DecryptFileA"; File: "ac18ad4de0d70e7cbbfb829afea0dd45.exe") Found reference to API (Indicator: "SHBrowseForFolder"; File: "ac18ad4de0d70e7cbbfb829afea0dd45.exe") Found reference to API (Indicator: "SHGetPathFromIDList"; File: "ac18ad4de0d70e7cbbfb829afea0dd45.exe") Found reference to API (Indicator: "GetTokenInformation"; File: "ac18ad4de0d70e7cbbfb829afea0dd45.exe") Found reference to API (Indicator: "RegDeleteValueA"; File: "ac18ad4de0d70e7cbbfb829afea0dd45.exe") Found reference to API (Indicator: "RegOpenKeyExA"; File: "ac18ad4de0d70e7cbbfb829afea0dd45.exe") Found reference to API (Indicator: "RegQueryInfoKeyA"; File: "ac18ad4de0d70e7cbbfb829afea0dd45.exe") Found reference to API (Indicator: "FreeSid"; File: "ac18ad4de0d70e7cbbfb829afea0dd45.exe") Found reference to API (Indicator: "OpenProcessToken"; File: "ac18ad4de0d70e7cbbfb829afea0dd45.exe") Found reference to API (Indicator: "RegSetValueExA"; File: "ac18ad4de0d70e7cbbfb829afea0dd45.exe") Found reference to API (Indicator: "RegCreateKeyExA"; File: "ac18ad4de0d70e7cbbfb829afea0dd45.exe") Found reference to API (Indicator: "LookupPrivilegeValueA"; File: "ac18ad4de0d70e7cbbfb829afea0dd45.exe") Found reference to API (Indicator: "AllocateAndInitializeSid"; File: "ac18ad4de0d70e7cbbfb829afea0dd45.exe") Found reference to API (Indicator: "RegQueryValueExA"; File: "ac18ad4de0d70e7cbbfb829afea0dd45.exe") Found reference to API (Indicator: "EqualSid"; File: "ac18ad4de0d70e7cbbfb829afea0dd45.exe") Found reference to API (Indicator: "RegCloseKey"; File: "ac18ad4de0d70e7cbbfb829afea0dd45.exe") Found reference to API (Indicator: "AdjustTokenPrivileges"; File: "ac18ad4de0d70e7cbbfb829afea0dd45.exe") Found reference to API (Indicator: "GetShortPathNameA"; File: "ac18ad4de0d70e7cbbfb829afea0dd45.exe") Found reference to API (Indicator: "GetModuleFileNameA"; File: "ac18ad4de0d70e7cbbfb829afea0dd45.exe") Found reference to API (Indicator: "FindFirstFileA"; File: "ac18ad4de0d70e7cbbfb829afea0dd45.exe") Found reference to API (Indicator: "GetCurrentProcess"; File: "ac18ad4de0d70e7cbbfb829afea0dd45.exe") Found reference to API (Indicator: "FindNextFileA"; File: "ac18ad4de0d70e7cbbfb829afea0dd45.exe") Found reference to API (Indicator: "ExpandEnvironmentStringsA"; File: "ac18ad4de0d70e7cbbfb829afea0dd45.exe") Found reference to API (Indicator: "FindClose"; File: "ac18ad4de0d70e7cbbfb829afea0dd45.exe") Found reference to API (Indicator: "LocalAlloc"; File: "ac18ad4de0d70e7cbbfb829afea0dd45.exe") Found reference to API (Indicator: "lstrcmpA"; File: "ac18ad4de0d70e7cbbfb829afea0dd45.exe") Found reference to API (Indicator: "CompareStringA"; File: "ac18ad4de0d70e7cbbfb829afea0dd45.exe") Found reference to API (Indicator: "GetLastError"; File: "ac18ad4de0d70e7cbbfb829afea0dd45.exe") Found reference to API (Indicator: "GetFileAttributesA"; File: "ac18ad4de0d70e7cbbfb829afea0dd45.exe") Found reference to API (Indicator: "GetSystemDirectoryA"; File: "ac18ad4de0d70e7cbbfb829afea0dd45.exe") Found reference to API (Indicator: "LoadLibraryA"; File: "ac18ad4de0d70e7cbbfb829afea0dd45.exe") Found reference to API (Indicator: "DeleteFileA"; File: "ac18ad4de0d70e7cbbfb829afea0dd45.exe") Found reference to API (Indicator: "GlobalAlloc"; File: "ac18ad4de0d70e7cbbfb829afea0dd45.exe") Found reference to API (Indicator: "GlobalFree"; File: "ac18ad4de0d70e7cbbfb829afea0dd45.exe") Found reference to API (Indicator: "CloseHandle"; File: "ac18ad4de0d70e7cbbfb829afea0dd45.exe") Found reference to API (Indicator: "WritePrivateProfileStringA"; File: "ac18ad4de0d70e7cbbfb829afea0dd45.exe") Found reference to API (Indicator: "IsDBCSLeadByte"; File: "ac18ad4de0d70e7cbbfb829afea0dd45.exe") Found reference to API (Indicator: "GetWindowsDirectoryA"; File: "ac18ad4de0d70e7cbbfb829afea0dd45.exe") Found reference to API (Indicator: "SetFileAttributesA"; File: "ac18ad4de0d70e7cbbfb829afea0dd45.exe") Found reference to API (Indicator: "GetProcAddress"; File: "ac18ad4de0d70e7cbbfb829afea0dd45.exe") Found reference to API (Indicator: "GlobalLock"; File: "ac18ad4de0d70e7cbbfb829afea0dd45.exe") Found reference to API (Indicator: "LocalFree"; File: "ac18ad4de0d70e7cbbfb829afea0dd45.exe") Found reference to API (Indicator: "RemoveDirectoryA"; File: "ac18ad4de0d70e7cbbfb829afea0dd45.exe") Found reference to API (Indicator: "FreeLibrary"; File: "ac18ad4de0d70e7cbbfb829afea0dd45.exe") Found reference to API (Indicator: "CreateDirectoryA"; File: "ac18ad4de0d70e7cbbfb829afea0dd45.exe") Found reference to API (Indicator: "GetPrivateProfileIntA"; File: "ac18ad4de0d70e7cbbfb829afea0dd45.exe") Found reference to API (Indicator: "GetPrivateProfileStringA"; File: "ac18ad4de0d70e7cbbfb829afea0dd45.exe") Found reference to API (Indicator: "GlobalUnlock"; File: "ac18ad4de0d70e7cbbfb829afea0dd45.exe") Found reference to API (Indicator: "ReadFile"; File: "ac18ad4de0d70e7cbbfb829afea0dd45.exe") Found reference to API (Indicator: "SizeofResource"; File: "ac18ad4de0d70e7cbbfb829afea0dd45.exe") Found reference to API (Indicator: "WriteFile"; File: "ac18ad4de0d70e7cbbfb829afea0dd45.exe") Found reference to API (Indicator: "GetDriveTypeA"; File: "ac18ad4de0d70e7cbbfb829afea0dd45.exe") Found reference to API (Indicator: "LoadLibraryExA"; File: "ac18ad4de0d70e7cbbfb829afea0dd45.exe") Found reference to API (Indicator: "SetFileTime"; File: "ac18ad4de0d70e7cbbfb829afea0dd45.exe") Found reference to API (Indicator: "SetFilePointer"; File: "ac18ad4de0d70e7cbbfb829afea0dd45.exe") Found reference to API (Indicator: "FindResourceA"; File: "ac18ad4de0d70e7cbbfb829afea0dd45.exe") Found reference to API (Indicator: "CreateMutexA"; File: "ac18ad4de0d70e7cbbfb829afea0dd45.exe") Found reference to API (Indicator: "GetVolumeInformationA"; File: "ac18ad4de0d70e7cbbfb829afea0dd45.exe") Found reference to API (Indicator: "WaitForSingleObject"; File: "ac18ad4de0d70e7cbbfb829afea0dd45.exe") Found reference to API (Indicator: "GetCurrentDirectoryA"; File: "ac18ad4de0d70e7cbbfb829afea0dd45.exe") Found reference to API (Indicator: "FreeResource"; File: "ac18ad4de0d70e7cbbfb829afea0dd45.exe") Found reference to API (Indicator: "GetVersion"; File: "ac18ad4de0d70e7cbbfb829afea0dd45.exe") Found reference to API (Indicator: "SetCurrentDirectoryA"; File: "ac18ad4de0d70e7cbbfb829afea0dd45.exe") Found reference to API (Indicator: "GetTempPathA"; File: "ac18ad4de0d70e7cbbfb829afea0dd45.exe") Found reference to API (Indicator: "LocalFileTimeToFileTime"; File: "ac18ad4de0d70e7cbbfb829afea0dd45.exe") Found reference to API (Indicator: "CreateFileA"; File: "ac18ad4de0d70e7cbbfb829afea0dd45.exe") Found reference to API (Indicator: "SetEvent"; File: "ac18ad4de0d70e7cbbfb829afea0dd45.exe") Found reference to API (Indicator: "TerminateThread"; File: "ac18ad4de0d70e7cbbfb829afea0dd45.exe") Found reference to API (Indicator: "GetVersionExA"; File: "ac18ad4de0d70e7cbbfb829afea0dd45.exe") Found reference to API (Indicator: "LockResource"; File: "ac18ad4de0d70e7cbbfb829afea0dd45.exe") Found reference to API (Indicator: "GetSystemInfo"; File: "ac18ad4de0d70e7cbbfb829afea0dd45.exe") Found reference to API (Indicator: "CreateThread"; File: "ac18ad4de0d70e7cbbfb829afea0dd45.exe") Found reference to API (Indicator: "ResetEvent"; File: "ac18ad4de0d70e7cbbfb829afea0dd45.exe") Found reference to API (Indicator: "LoadResource"; File: "ac18ad4de0d70e7cbbfb829afea0dd45.exe") Found reference to API (Indicator: "ExitProcess"; File: "ac18ad4de0d70e7cbbfb829afea0dd45.exe") Found reference to API (Indicator: "GetModuleHandleW"; File: "ac18ad4de0d70e7cbbfb829afea0dd45.exe") Found reference to API (Indicator: "CreateProcessA"; File: "ac18ad4de0d70e7cbbfb829afea0dd45.exe") Found reference to API (Indicator: "FormatMessageA"; File: "ac18ad4de0d70e7cbbfb829afea0dd45.exe") Found reference to API (Indicator: "GetTempFileNameA"; File: "ac18ad4de0d70e7cbbfb829afea0dd45.exe") Found reference to API (Indicator: "DosDateTimeToFileTime"; File: "ac18ad4de0d70e7cbbfb829afea0dd45.exe") Found reference to API (Indicator: "CreateEventA"; File: "ac18ad4de0d70e7cbbfb829afea0dd45.exe") Found reference to API (Indicator: "GetExitCodeProcess"; File: "ac18ad4de0d70e7cbbfb829afea0dd45.exe") Found reference to API (Indicator: "GetDeviceCaps"; File: "ac18ad4de0d70e7cbbfb829afea0dd45.exe") Found reference to API (Indicator: "GetDesktopWindow"; File: "ac18ad4de0d70e7cbbfb829afea0dd45.exe") Found reference to API (Indicator: "CharUpperA"; File: "ac18ad4de0d70e7cbbfb829afea0dd45.exe") Found reference to API (Indicator: "ExitWindowsEx"; File: "ac18ad4de0d70e7cbbfb829afea0dd45.exe") Found reference to API (Indicator: "MessageBeep"; File: "ac18ad4de0d70e7cbbfb829afea0dd45.exe") Found reference to API (Indicator: "CharPrevA"; File: "ac18ad4de0d70e7cbbfb829afea0dd45.exe") Found reference to API (Indicator: "LoadStringA"; File: "ac18ad4de0d70e7cbbfb829afea0dd45.exe") Found reference to API (Indicator: "CharNextA"; File: "ac18ad4de0d70e7cbbfb829afea0dd45.exe") Found reference to API (Indicator: "EnableWindow"; File: "ac18ad4de0d70e7cbbfb829afea0dd45.exe") Found reference to API (Indicator: "ReleaseDC"; File: "ac18ad4de0d70e7cbbfb829afea0dd45.exe") Found reference to API (Indicator: "SetForegroundWindow"; File: "ac18ad4de0d70e7cbbfb829afea0dd45.exe") Found reference to API (Indicator: "PeekMessageA"; File: "ac18ad4de0d70e7cbbfb829afea0dd45.exe") Found reference to API (Indicator: "SendMessageA"; File: "ac18ad4de0d70e7cbbfb829afea0dd45.exe") Found reference to API (Indicator: "MessageBoxA"; File: "ac18ad4de0d70e7cbbfb829afea0dd45.exe") Found reference to API (Indicator: "SetWindowTextA"; File: "ac18ad4de0d70e7cbbfb829afea0dd45.exe") Found reference to API (Indicator: "GetWindowLongA"; File: "ac18ad4de0d70e7cbbfb829afea0dd45.exe") Found reference to API (Indicator: "CallWindowProcA"; File: "ac18ad4de0d70e7cbbfb829afea0dd45.exe") Found reference to API (Indicator: "SetWindowLongA"; File: "ac18ad4de0d70e7cbbfb829afea0dd45.exe") Found reference to API (Indicator: "ShowWindow"; File: "ac18ad4de0d70e7cbbfb829afea0dd45.exe") Found reference to API (Indicator: "MsgWaitForMultipleObjects"; File: "ac18ad4de0d70e7cbbfb829afea0dd45.exe") Found reference to API (Indicator: "SetWindowPos"; File: "ac18ad4de0d70e7cbbfb829afea0dd45.exe") Found reference to API (Indicator: "GetDC"; File: "ac18ad4de0d70e7cbbfb829afea0dd45.exe") Found reference to API (Indicator: "GetWindowRect"; File: "ac18ad4de0d70e7cbbfb829afea0dd45.exe") Found reference to API (Indicator: "DispatchMessageA"; File: "ac18ad4de0d70e7cbbfb829afea0dd45.exe") Found reference to API (Indicator: "GetFileVersionInfoSizeA"; File: "ac18ad4de0d70e7cbbfb829afea0dd45.exe") Found reference to API (Indicator: "VerQueryValueA"; File: "ac18ad4de0d70e7cbbfb829afea0dd45.exe") Found reference to API (Indicator: "GetFileVersionInfoA"; File: "ac18ad4de0d70e7cbbfb829afea0dd45.exe") Found reference to API (Indicator: "Sleep"; File: "ac18ad4de0d70e7cbbfb829afea0dd45.exe") Found reference to API (Indicator: "GetStartupInfoW"; File: "ac18ad4de0d70e7cbbfb829afea0dd45.exe") Found reference to API (Indicator: "UnhandledExceptionFilter"; File: "ac18ad4de0d70e7cbbfb829afea0dd45.exe") Found reference to API (Indicator: "SetUnhandledExceptionFilter"; File: "ac18ad4de0d70e7cbbfb829afea0dd45.exe") Found reference to API (Indicator: "TerminateProcess"; File: "ac18ad4de0d70e7cbbfb829afea0dd45.exe") Found reference to API (Indicator: "QueryPerformanceCounter"; File: "ac18ad4de0d70e7cbbfb829afea0dd45.exe") Found reference to API (Indicator: "GetCurrentProcessId"; File: "ac18ad4de0d70e7cbbfb829afea0dd45.exe") Found reference to API (Indicator: "GetCurrentThreadId"; File: "ac18ad4de0d70e7cbbfb829afea0dd45.exe") Found reference to API (Indicator: "GetSystemTimeAsFileTime"; File: "ac18ad4de0d70e7cbbfb829afea0dd45.exe") Found reference to API (Indicator: "GetTickCount"; File: "ac18ad4de0d70e7cbbfb829afea0dd45.exe") Found reference to API (Indicator: "EnumResourceLanguagesA"; File: "ac18ad4de0d70e7cbbfb829afea0dd45.exe") Found reference to API (Indicator: "GetDiskFreeSpaceA"; File: "ac18ad4de0d70e7cbbfb829afea0dd45.exe") Found reference to API (Indicator: "MulDiv"; File: "ac18ad4de0d70e7cbbfb829afea0dd45.exe") Found reference to API (Indicator: "GetSystemMetrics"; File: "ac18ad4de0d70e7cbbfb829afea0dd45.exe") Found reference to API (Indicator: "MessageBoxW"; File: "MaxLoonaFest131.exe.1646122814") Found reference to API (Indicator: "IsDebuggerPresent"; File: "MaxLoonaFest131.exe.1646122814") Found reference to API (Indicator: "CheckTokenMembership"; Source: "00000000-00002632.00000000.65533.00F21000.00000020.mdmp") Found reference to API (Indicator: "HeapSetInformation"; Source: "00000000-00002632.00000000.65533.00F21000.00000020.mdmp") Found reference to API (Indicator: "DecryptFileA"; Source: "00000000-00002632.00000000.65533.00F21000.00000020.mdmp") Found reference to API (Indicator: "GetTokenInformation"; Source: "00000000-00002632.00000002.67682.00F2A000.00000002.mdmp") Found reference to API (Indicator: "RegDeleteValueA"; Source: "00000000-00002632.00000002.67682.00F2A000.00000002.mdmp") Found reference to API (Indicator: "RegOpenKeyExA"; Source: "00000000-00002632.00000002.67682.00F2A000.00000002.mdmp") Found reference to API (Indicator: "RegQueryInfoKeyA"; Source: "00000000-00002632.00000002.67682.00F2A000.00000002.mdmp") Found reference to API (Indicator: "FreeSid"; Source: "00000000-00002632.00000002.67682.00F2A000.00000002.mdmp") Found reference to API (Indicator: "OpenProcessToken"; Source: "00000000-00002632.00000002.67682.00F2A000.00000002.mdmp") Found reference to API (Indicator: "RegSetValueExA"; Source: "00000000-00002632.00000002.67682.00F2A000.00000002.mdmp") Found reference to API (Indicator: "RegCreateKeyExA"; Source: "00000000-00002632.00000002.67682.00F2A000.00000002.mdmp") Found reference to API (Indicator: "LookupPrivilegeValueA"; Source: "00000000-00002632.00000002.67682.00F2A000.00000002.mdmp") Found reference to API (Indicator: "AllocateAndInitializeSid"; Source: "00000000-00002632.00000002.67682.00F2A000.00000002.mdmp") Found reference to API (Indicator: "RegQueryValueExA"; Source: "00000000-00002632.00000002.67682.00F2A000.00000002.mdmp") Found reference to API (Indicator: "EqualSid"; Source: "00000000-00002632.00000002.67682.00F2A000.00000002.mdmp") Found reference to API (Indicator: "RegCloseKey"; Source: "00000000-00002632.00000002.67682.00F2A000.00000002.mdmp") Found reference to API (Indicator: "AdjustTokenPrivileges"; Source: "00000000-00002632.00000002.67682.00F2A000.00000002.mdmp") Found reference to API (Indicator: "GetShortPathNameA"; Source: "00000000-00002632.00000002.67682.00F2A000.00000002.mdmp") Found reference to API (Indicator: "GetModuleFileNameA"; Source: "00000000-00002632.00000002.67682.00F2A000.00000002.mdmp") Found reference to API (Indicator: "FindFirstFileA"; Source: "00000000-00002632.00000002.67682.00F2A000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcess"; Source: "00000000-00002632.00000002.67682.00F2A000.00000002.mdmp") Found reference to API (Indicator: "FindNextFileA"; Source: "00000000-00002632.00000002.67682.00F2A000.00000002.mdmp") Found reference to API (Indicator: "ExpandEnvironmentStringsA"; Source: "00000000-00002632.00000002.67682.00F2A000.00000002.mdmp") Found reference to API (Indicator: "FindClose"; Source: "00000000-00002632.00000002.67682.00F2A000.00000002.mdmp") Found reference to API (Indicator: "LocalAlloc"; Source: "00000000-00002632.00000002.67682.00F2A000.00000002.mdmp") Found reference to API (Indicator: "lstrcmpA"; Source: "00000000-00002632.00000002.67682.00F2A000.00000002.mdmp") Found reference to API (Indicator: "CompareStringA"; Source: "00000000-00002632.00000002.67682.00F2A000.00000002.mdmp") Found reference to API (Indicator: "GetLastError"; Source: "00000000-00002632.00000002.67682.00F2A000.00000002.mdmp") Found reference to API (Indicator: "GetFileAttributesA"; Source: "00000000-00002632.00000002.67682.00F2A000.00000002.mdmp") Found reference to API (Indicator: "GetSystemDirectoryA"; Source: "00000000-00002632.00000002.67682.00F2A000.00000002.mdmp") Found reference to API (Indicator: "LoadLibraryA"; Source: "00000000-00002632.00000002.67682.00F2A000.00000002.mdmp") Found reference to API (Indicator: "DeleteFileA"; Source: "00000000-00002632.00000002.67682.00F2A000.00000002.mdmp") Found reference to API (Indicator: "GlobalAlloc"; Source: "00000000-00002632.00000002.67682.00F2A000.00000002.mdmp") Found reference to API (Indicator: "GlobalFree"; Source: "00000000-00002632.00000002.67682.00F2A000.00000002.mdmp") Found reference to API (Indicator: "CloseHandle"; Source: "00000000-00002632.00000002.67682.00F2A000.00000002.mdmp") Found reference to API (Indicator: "WritePrivateProfileStringA"; Source: "00000000-00002632.00000002.67682.00F2A000.00000002.mdmp") Found reference to API (Indicator: "IsDBCSLeadByte"; Source: "00000000-00002632.00000002.67682.00F2A000.00000002.mdmp") Found reference to API (Indicator: "GetWindowsDirectoryA"; Source: "00000000-00002632.00000002.67682.00F2A000.00000002.mdmp") Found reference to API (Indicator: "SetFileAttributesA"; Source: "00000000-00002632.00000002.67682.00F2A000.00000002.mdmp") Found reference to API (Indicator: "GetProcAddress"; Source: "00000000-00002632.00000002.67682.00F2A000.00000002.mdmp") Found reference to API (Indicator: "GlobalLock"; Source: "00000000-00002632.00000002.67682.00F2A000.00000002.mdmp") Found reference to API (Indicator: "LocalFree"; Source: "00000000-00002632.00000002.67682.00F2A000.00000002.mdmp") Found reference to API (Indicator: "RemoveDirectoryA"; Source: "00000000-00002632.00000002.67682.00F2A000.00000002.mdmp") Found reference to API (Indicator: "FreeLibrary"; Source: "00000000-00002632.00000002.67682.00F2A000.00000002.mdmp") Found reference to API (Indicator: "CreateDirectoryA"; Source: "00000000-00002632.00000002.67682.00F2A000.00000002.mdmp") Found reference to API (Indicator: "GetPrivateProfileIntA"; Source: "00000000-00002632.00000002.67682.00F2A000.00000002.mdmp") Found reference to API (Indicator: "GetPrivateProfileStringA"; Source: "00000000-00002632.00000002.67682.00F2A000.00000002.mdmp") Found reference to API (Indicator: "GlobalUnlock"; Source: "00000000-00002632.00000002.67682.00F2A000.00000002.mdmp") Found reference to API (Indicator: "ReadFile"; Source: "00000000-00002632.00000002.67682.00F2A000.00000002.mdmp") Found reference to API (Indicator: "SizeofResource"; Source: "00000000-00002632.00000002.67682.00F2A000.00000002.mdmp") Found reference to API (Indicator: "WriteFile"; Source: "00000000-00002632.00000002.67682.00F2A000.00000002.mdmp") Found reference to API (Indicator: "GetDriveTypeA"; Source: "00000000-00002632.00000002.67682.00F2A000.00000002.mdmp") Found reference to API (Indicator: "LoadLibraryExA"; Source: "00000000-00002632.00000002.67682.00F2A000.00000002.mdmp") Found reference to API (Indicator: "SetFileTime"; Source: "00000000-00002632.00000002.67682.00F2A000.00000002.mdmp") Found reference to API (Indicator: "SetFilePointer"; Source: "00000000-00002632.00000002.67682.00F2A000.00000002.mdmp") Found reference to API (Indicator: "FindResourceA"; Source: "00000000-00002632.00000002.67682.00F2A000.00000002.mdmp") Found reference to API (Indicator: "CreateMutexA"; Source: "00000000-00002632.00000002.67682.00F2A000.00000002.mdmp") Found reference to API (Indicator: "GetVolumeInformationA"; Source: "00000000-00002632.00000002.67682.00F2A000.00000002.mdmp") Found reference to API (Indicator: "WaitForSingleObject"; Source: "00000000-00002632.00000002.67682.00F2A000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentDirectoryA"; Source: "00000000-00002632.00000002.67682.00F2A000.00000002.mdmp") Found reference to API (Indicator: "FreeResource"; Source: "00000000-00002632.00000002.67682.00F2A000.00000002.mdmp") Found reference to API (Indicator: "GetVersion"; Source: "00000000-00002632.00000002.67682.00F2A000.00000002.mdmp") Found reference to API (Indicator: "SetCurrentDirectoryA"; Source: "00000000-00002632.00000002.67682.00F2A000.00000002.mdmp") Found reference to API (Indicator: "GetTempPathA"; Source: "00000000-00002632.00000002.67682.00F2A000.00000002.mdmp") Found reference to API (Indicator: "LocalFileTimeToFileTime"; Source: "00000000-00002632.00000002.67682.00F2A000.00000002.mdmp") Found reference to API (Indicator: "CreateFileA"; Source: "00000000-00002632.00000002.67682.00F2A000.00000002.mdmp") Found reference to API (Indicator: "SetEvent"; Source: "00000000-00002632.00000002.67682.00F2A000.00000002.mdmp") Found reference to API (Indicator: "TerminateThread"; Source: "00000000-00002632.00000002.67682.00F2A000.00000002.mdmp") Found reference to API (Indicator: "GetVersionExA"; Source: "00000000-00002632.00000002.67682.00F2A000.00000002.mdmp") Found reference to API (Indicator: "LockResource"; Source: "00000000-00002632.00000002.67682.00F2A000.00000002.mdmp") Found reference to API (Indicator: "GetSystemInfo"; Source: "00000000-00002632.00000002.67682.00F2A000.00000002.mdmp") Found reference to API (Indicator: "CreateThread"; Source: "00000000-00002632.00000002.67682.00F2A000.00000002.mdmp") Found reference to API (Indicator: "ResetEvent"; Source: "00000000-00002632.00000002.67682.00F2A000.00000002.mdmp") Found reference to API (Indicator: "LoadResource"; Source: "00000000-00002632.00000002.67682.00F2A000.00000002.mdmp") Found reference to API (Indicator: "ExitProcess"; Source: "00000000-00002632.00000002.67682.00F2A000.00000002.mdmp") Found reference to API (Indicator: "GetModuleHandleW"; Source: "00000000-00002632.00000002.67682.00F2A000.00000002.mdmp") Found reference to API (Indicator: "CreateProcessA"; Source: "00000000-00002632.00000002.67682.00F2A000.00000002.mdmp") Found reference to API (Indicator: "FormatMessageA"; Source: "00000000-00002632.00000002.67682.00F2A000.00000002.mdmp") Found reference to API (Indicator: "GetTempFileNameA"; Source: "00000000-00002632.00000002.67682.00F2A000.00000002.mdmp") Found reference to API (Indicator: "DosDateTimeToFileTime"; Source: "00000000-00002632.00000002.67682.00F2A000.00000002.mdmp") Found reference to API (Indicator: "CreateEventA"; Source: "00000000-00002632.00000002.67682.00F2A000.00000002.mdmp") Found reference to API (Indicator: "GetExitCodeProcess"; Source: "00000000-00002632.00000002.67682.00F2A000.00000002.mdmp") Found reference to API (Indicator: "GetDeviceCaps"; Source: "00000000-00002632.00000002.67682.00F2A000.00000002.mdmp") Found reference to API (Indicator: "GetDesktopWindow"; Source: "00000000-00002632.00000002.67682.00F2A000.00000002.mdmp") Found reference to API (Indicator: "CharUpperA"; Source: "00000000-00002632.00000002.67682.00F2A000.00000002.mdmp") Found reference to API (Indicator: "ExitWindowsEx"; Source: "00000000-00002632.00000002.67682.00F2A000.00000002.mdmp") Found reference to API (Indicator: "MessageBeep"; Source: "00000000-00002632.00000002.67682.00F2A000.00000002.mdmp") Found reference to API (Indicator: "CharPrevA"; Source: "00000000-00002632.00000002.67682.00F2A000.00000002.mdmp") Found reference to API (Indicator: "LoadStringA"; Source: "00000000-00002632.00000002.67682.00F2A000.00000002.mdmp") Found reference to API (Indicator: "CharNextA"; Source: "00000000-00002632.00000002.67682.00F2A000.00000002.mdmp") Found reference to API (Indicator: "EnableWindow"; Source: "00000000-00002632.00000002.67682.00F2A000.00000002.mdmp") Found reference to API (Indicator: "ReleaseDC"; Source: "00000000-00002632.00000002.67682.00F2A000.00000002.mdmp") Found reference to API (Indicator: "SetForegroundWindow"; Source: "00000000-00002632.00000002.67682.00F2A000.00000002.mdmp") Found reference to API (Indicator: "PeekMessageA"; Source: "00000000-00002632.00000002.67682.00F2A000.00000002.mdmp") Found reference to API (Indicator: "SendMessageA"; Source: "00000000-00002632.00000002.67682.00F2A000.00000002.mdmp") Found reference to API (Indicator: "MessageBoxA"; Source: "00000000-00002632.00000002.67682.00F2A000.00000002.mdmp") Found reference to API (Indicator: "SetWindowTextA"; Source: "00000000-00002632.00000002.67682.00F2A000.00000002.mdmp") Found reference to API (Indicator: "GetWindowLongA"; Source: "00000000-00002632.00000002.67682.00F2A000.00000002.mdmp") Found reference to API (Indicator: "CallWindowProcA"; Source: "00000000-00002632.00000002.67682.00F2A000.00000002.mdmp") Found reference to API (Indicator: "SetWindowLongA"; Source: "00000000-00002632.00000002.67682.00F2A000.00000002.mdmp") Found reference to API (Indicator: "ShowWindow"; Source: "00000000-00002632.00000002.67682.00F2A000.00000002.mdmp") Found reference to API (Indicator: "MsgWaitForMultipleObjects"; Source: "00000000-00002632.00000002.67682.00F2A000.00000002.mdmp") Found reference to API (Indicator: "SetWindowPos"; Source: "00000000-00002632.00000002.67682.00F2A000.00000002.mdmp") Found reference to API (Indicator: "GetDC"; Source: "00000000-00002632.00000002.67682.00F2A000.00000002.mdmp") Found reference to API (Indicator: "GetWindowRect"; Source: "00000000-00002632.00000002.67682.00F2A000.00000002.mdmp") Found reference to API (Indicator: "DispatchMessageA"; Source: "00000000-00002632.00000002.67682.00F2A000.00000002.mdmp") Found reference to API (Indicator: "GetFileVersionInfoSizeA"; Source: "00000000-00002632.00000002.67682.00F2A000.00000002.mdmp") Found reference to API (Indicator: "VerQueryValueA"; Source: "00000000-00002632.00000002.67682.00F2A000.00000002.mdmp") Found reference to API (Indicator: "GetFileVersionInfoA"; Source: "00000000-00002632.00000002.67682.00F2A000.00000002.mdmp") Found reference to API (Indicator: "Sleep"; Source: "00000000-00002632.00000002.67682.00F2A000.00000002.mdmp") Found reference to API (Indicator: "GetStartupInfoW"; Source: "00000000-00002632.00000002.67682.00F2A000.00000002.mdmp") Found reference to API (Indicator: "UnhandledExceptionFilter"; Source: "00000000-00002632.00000002.67682.00F2A000.00000002.mdmp") Found reference to API (Indicator: "SetUnhandledExceptionFilter"; Source: "00000000-00002632.00000002.67682.00F2A000.00000002.mdmp") Found reference to API (Indicator: "TerminateProcess"; Source: "00000000-00002632.00000002.67682.00F2A000.00000002.mdmp") Found reference to API (Indicator: "QueryPerformanceCounter"; Source: "00000000-00002632.00000002.67682.00F2A000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcessId"; Source: "00000000-00002632.00000002.67682.00F2A000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentThreadId"; Source: "00000000-00002632.00000002.67682.00F2A000.00000002.mdmp") Found reference to API (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00002632.00000002.67682.00F2A000.00000002.mdmp") Found reference to API (Indicator: "GetTickCount"; Source: "00000000-00002632.00000002.67682.00F2A000.00000002.mdmp") Found reference to API (Indicator: "EnumResourceLanguagesA"; Source: "00000000-00002632.00000002.67682.00F2A000.00000002.mdmp") Found reference to API (Indicator: "GetDiskFreeSpaceA"; Source: "00000000-00002632.00000002.67682.00F2A000.00000002.mdmp") Found reference to API (Indicator: "MulDiv"; Source: "00000000-00002632.00000002.67682.00F2A000.00000002.mdmp") Found reference to API (Indicator: "GetSystemMetrics"; Source: "00000000-00002632.00000002.67682.00F2A000.00000002.mdmp") Found reference to API (Indicator: "GetNativeSystemInfo"; Source: "00000000-00003416.00000000.65622.00F5C000.00000002.mdmp") Found reference to API (Indicator: "InitializeConditionVariable"; Source: "00000000-00003416.00000000.65622.00F5C000.00000002.mdmp") Found reference to API (Indicator: "SleepConditionVariableCS"; Source: "00000000-00003416.00000000.65622.00F5C000.00000002.mdmp") Found reference to API (Indicator: "WakeAllConditionVariable"; Source: "00000000-00003416.00000000.65622.00F5C000.00000002.mdmp") Found reference to API (Indicator: "FlsAlloc"; Source: "00000000-00003416.00000000.65622.00F5C000.00000002.mdmp") Found reference to API (Indicator: "FlsFree"; Source: "00000000-00003416.00000000.65622.00F5C000.00000002.mdmp") Found reference to API (Indicator: "FlsGetValue"; Source: "00000000-00003416.00000000.65622.00F5C000.00000002.mdmp") Found reference to API (Indicator: "FlsSetValue"; Source: "00000000-00003416.00000000.65622.00F5C000.00000002.mdmp") Found reference to API (Indicator: "InitializeCriticalSectionEx"; Source: "00000000-00003416.00000000.65622.00F5C000.00000002.mdmp") Found reference to API (Indicator: "CompareStringEx"; Source: "00000000-00003416.00000000.65622.00F5C000.00000002.mdmp") Found reference to API (Indicator: "GetDateFormatEx"; Source: "00000000-00003416.00000000.65622.00F5C000.00000002.mdmp") Found reference to API (Indicator: "GetSystemTimePreciseAsFileTime"; Source: "00000000-00003416.00000000.65622.00F5C000.00000002.mdmp") Found reference to API (Indicator: "GetTimeFormatEx"; Source: "00000000-00003416.00000000.65622.00F5C000.00000002.mdmp") Found reference to API (Indicator: "LCMapStringEx"; Source: "00000000-00003416.00000000.65622.00F5C000.00000002.mdmp") Found reference to API (Indicator: "LocaleNameToLCID"; Source: "00000000-00003416.00000000.65622.00F5C000.00000002.mdmp") Found reference to API (Indicator: "Wow64RevertWow64FsRedirection"; Source: "00000000-00003416.00000000.65622.00F5C000.00000002.mdmp") Found reference to API (Indicator: "Wow64DisableWow64FsRedirection"; Source: "00000000-00003416.00000000.65622.00F5C000.00000002.mdmp") Found reference to API (Indicator: "GetModuleHandleExW"; Source: "00000000-00003416.00000000.65622.00F5C000.00000002.mdmp") Found reference to API (Indicator: "GetSystemWow64DirectoryW"; Source: "00000000-00003416.00000000.65622.00F5C000.00000002.mdmp") Found reference to API (Indicator: "RegDeleteKeyExW"; Source: "00000000-00003416.00000000.65622.00F5C000.00000002.mdmp") Found reference to API (Indicator: "GetFileVersionInfoSizeW"; Source: "00000000-00003416.00000000.65622.00F5C000.00000002.mdmp") Found reference to API (Indicator: "GetFileVersionInfoW"; Source: "00000000-00003416.00000000.65622.00F5C000.00000002.mdmp") Found reference to API (Indicator: "VerQueryValueW"; Source: "00000000-00003416.00000000.65622.00F5C000.00000002.mdmp") Found reference to API (Indicator: "WNetAddConnection2W"; Source: "00000000-00003416.00000000.65622.00F5C000.00000002.mdmp") Found reference to API (Indicator: "WNetUseConnectionW"; Source: "00000000-00003416.00000000.65622.00F5C000.00000002.mdmp") Found reference to API (Indicator: "WNetCancelConnection2W"; Source: "00000000-00003416.00000000.65622.00F5C000.00000002.mdmp") Found reference to API (Indicator: "WNetGetConnectionW"; Source: "00000000-00003416.00000000.65622.00F5C000.00000002.mdmp") Found reference to API (Indicator: "InternetCloseHandle"; Source: "00000000-00003416.00000000.65622.00F5C000.00000002.mdmp") Found reference to API (Indicator: "InternetOpenW"; Source: "00000000-00003416.00000000.65622.00F5C000.00000002.mdmp") Found reference to API (Indicator: "InternetSetOptionW"; Source: "00000000-00003416.00000000.65622.00F5C000.00000002.mdmp") Found reference to API (Indicator: "InternetCrackUrlW"; Source: "00000000-00003416.00000000.65622.00F5C000.00000002.mdmp") Found reference to API (Indicator: "HttpQueryInfoW"; Source: "00000000-00003416.00000000.65622.00F5C000.00000002.mdmp") Found reference to API (Indicator: "InternetQueryOptionW"; Source: "00000000-00003416.00000000.65622.00F5C000.00000002.mdmp") Found reference to API (Indicator: "InternetConnectW"; Source: "00000000-00003416.00000000.65622.00F5C000.00000002.mdmp") Found reference to API (Indicator: "HttpOpenRequestW"; Source: "00000000-00003416.00000000.65622.00F5C000.00000002.mdmp") Found reference to API (Indicator: "HttpSendRequestW"; Source: "00000000-00003416.00000000.65622.00F5C000.00000002.mdmp") Found reference to API (Indicator: "FtpOpenFileW"; Source: "00000000-00003416.00000000.65622.00F5C000.00000002.mdmp") Found reference to API (Indicator: "FtpGetFileSize"; Source: "00000000-00003416.00000000.65622.00F5C000.00000002.mdmp") Found reference to API (Indicator: "InternetOpenUrlW"; Source: "00000000-00003416.00000000.65622.00F5C000.00000002.mdmp") Found reference to API (Indicator: "InternetReadFile"; Source: "00000000-00003416.00000000.65622.00F5C000.00000002.mdmp") Found reference to API (Indicator: "InternetQueryDataAvailable"; Source: "00000000-00003416.00000000.65622.00F5C000.00000002.mdmp") Found reference to API (Indicator: "GetProcessMemoryInfo"; Source: "00000000-00003416.00000000.65622.00F5C000.00000002.mdmp") Found reference to API (Indicator: "IcmpSendEcho"; Source: "00000000-00003416.00000000.65622.00F5C000.00000002.mdmp") Found reference to API (Indicator: "CreateEnvironmentBlock"; Source: "00000000-00003416.00000000.65622.00F5C000.00000002.mdmp") Found reference to API (Indicator: "DestroyEnvironmentBlock"; Source: "00000000-00003416.00000000.65622.00F5C000.00000002.mdmp") Found reference to API (Indicator: "InterlockedIncrement"; Source: "00000000-00003416.00000000.65622.00F5C000.00000002.mdmp") Found reference to API (Indicator: "InterlockedDecrement"; Source: "00000000-00003416.00000000.65622.00F5C000.00000002.mdmp") Found reference to API (Indicator: "DeleteCriticalSection"; Source: "00000000-00003416.00000000.65622.00F5C000.00000002.mdmp") Found reference to API (Indicator: "InitializeCriticalSectionAndSpinCount"; Source: "00000000-00003416.00000000.65622.00F5C000.00000002.mdmp") Found reference to API (Indicator: "RaiseException"; Source: "00000000-00003416.00000000.65622.00F5C000.00000002.mdmp") Found reference to API (Indicator: "GetLastError"; Source: "00000000-00003416.00000000.65622.00F5C000.00000002.mdmp, 00000000-00003416.00000000.65622.6D110000.00000002.mdmp") Found reference to API (Indicator: "DecodePointer"; Source: "00000000-00003416.00000000.65622.00F5C000.00000002.mdmp") Found reference to API (Indicator: "lstrcmpiW"; Source: "00000000-00003416.00000000.65622.00F5C000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentDirectoryW"; Source: "00000000-00003416.00000000.65622.00F5C000.00000002.mdmp, 00000000-00003416.00000000.65622.6D110000.00000002.mdmp") Found reference to API (Indicator: "IsDebuggerPresent"; Source: "00000000-00003416.00000000.65622.00F5C000.00000002.mdmp") Found reference to API (Indicator: "SetCurrentDirectoryW"; Source: "00000000-00003416.00000000.65622.00F5C000.00000002.mdmp") Found reference to API (Indicator: "GetFullPathNameW"; Source: "00000000-00003416.00000000.65622.00F5C000.00000002.mdmp") Found reference to API (Indicator: "CloseHandle"; Source: "00000000-00003416.00000000.65622.00F5C000.00000002.mdmp, 00000000-00003416.00000000.65622.6D110000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentThread"; Source: "00000000-00003416.00000000.65622.00F5C000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcess"; Source: "00000000-00003416.00000000.65622.00F5C000.00000002.mdmp, 00000000-00003416.00000000.65622.6D110000.00000002.mdmp") Found reference to API (Indicator: "DuplicateHandle"; Source: "00000000-00003416.00000000.65622.00F5C000.00000002.mdmp") Found reference to API (Indicator: "CreateThread"; Source: "00000000-00003416.00000000.65622.00F5C000.00000002.mdmp") Found reference to API (Indicator: "WaitForSingleObject"; Source: "00000000-00003416.00000000.65622.00F5C000.00000002.mdmp") Found reference to API (Indicator: "HeapAlloc"; Source: "00000000-00003416.00000000.65622.00F5C000.00000002.mdmp") Found reference to API (Indicator: "GetProcessHeap"; Source: "00000000-00003416.00000000.65622.00F5C000.00000002.mdmp") Found reference to API (Indicator: "HeapFree"; Source: "00000000-00003416.00000000.65622.00F5C000.00000002.mdmp") Found reference to API (Indicator: "Sleep"; Source: "00000000-00003416.00000000.65622.00F5C000.00000002.mdmp, 00000000-00003416.00000000.65622.6D110000.00000002.mdmp, 00000000-00003416.00000001.66534.028C0000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentThreadId"; Source: "00000000-00003416.00000000.65622.00F5C000.00000002.mdmp, 00000000-00003416.00000000.65622.6D110000.00000002.mdmp") Found reference to API (Indicator: "MultiByteToWideChar"; Source: "00000000-00003416.00000000.65622.00F5C000.00000002.mdmp") Found reference to API (Indicator: "MulDiv"; Source: "00000000-00003416.00000000.65622.00F5C000.00000002.mdmp") Found reference to API (Indicator: "GetVersionExW"; Source: "00000000-00003416.00000000.65622.00F5C000.00000002.mdmp") Found reference to API (Indicator: "IsWow64Process"; Source: "00000000-00003416.00000000.65622.00F5C000.00000002.mdmp") Found reference to API (Indicator: "GetSystemInfo"; Source: "00000000-00003416.00000000.65622.00F5C000.00000002.mdmp") Found reference to API (Indicator: "FreeLibrary"; Source: "00000000-00003416.00000000.65622.00F5C000.00000002.mdmp, 00000000-00003416.00000000.65622.6D110000.00000002.mdmp") Found reference to API (Indicator: "LoadLibraryA"; Source: "00000000-00003416.00000000.65622.00F5C000.00000002.mdmp") Found reference to API (Indicator: "GetProcAddress"; Source: "00000000-00003416.00000000.65622.00F5C000.00000002.mdmp, 00000000-00003416.00000000.65622.6D110000.00000002.mdmp") Found reference to API (Indicator: "SetErrorMode"; Source: "00000000-00003416.00000000.65622.00F5C000.00000002.mdmp") Found reference to API (Indicator: "GetModuleFileNameW"; Source: "00000000-00003416.00000000.65622.00F5C000.00000002.mdmp") Found reference to API (Indicator: "WideCharToMultiByte"; Source: "00000000-00003416.00000000.65622.00F5C000.00000002.mdmp") Found reference to API (Indicator: "lstrcpyW"; Source: "00000000-00003416.00000000.65622.00F5C000.00000002.mdmp") Found reference to API (Indicator: "lstrlenW"; Source: "00000000-00003416.00000000.65622.00F5C000.00000002.mdmp") Found reference to API (Indicator: "GetModuleHandleW"; Source: "00000000-00003416.00000000.65622.00F5C000.00000002.mdmp, 00000000-00003416.00000000.65622.6D110000.00000002.mdmp") Found reference to API (Indicator: "QueryPerformanceCounter"; Source: "00000000-00003416.00000000.65622.00F5C000.00000002.mdmp, 00000000-00003416.00000000.65622.6D110000.00000002.mdmp") Found reference to API (Indicator: "VirtualFreeEx"; Source: "00000000-00003416.00000000.65622.00F5C000.00000002.mdmp") Found reference to API (Indicator: "OpenProcess"; Source: "00000000-00003416.00000000.65622.00F5C000.00000002.mdmp") Found reference to API (Indicator: "VirtualAllocEx"; Source: "00000000-00003416.00000000.65622.00F5C000.00000002.mdmp") Found reference to API (Indicator: "WriteProcessMemory"; Source: "00000000-00003416.00000000.65622.00F5C000.00000002.mdmp") Found reference to API (Indicator: "ReadProcessMemory"; Source: "00000000-00003416.00000000.65622.00F5C000.00000002.mdmp") Found reference to API (Indicator: "CreateFileW"; Source: "00000000-00003416.00000000.65622.00F5C000.00000002.mdmp, 00000000-00003416.00000000.65622.6D110000.00000002.mdmp") Found reference to API (Indicator: "SetFilePointerEx"; Source: "00000000-00003416.00000000.65622.00F5C000.00000002.mdmp") Found reference to API (Indicator: "SetEndOfFile"; Source: "00000000-00003416.00000000.65622.00F5C000.00000002.mdmp") Found reference to API (Indicator: "ReadFile"; Source: "00000000-00003416.00000000.65622.00F5C000.00000002.mdmp") Found reference to API (Indicator: "WriteFile"; Source: "00000000-00003416.00000000.65622.00F5C000.00000002.mdmp") Found reference to API (Indicator: "FlushFileBuffers"; Source: "00000000-00003416.00000000.65622.00F5C000.00000002.mdmp") Found reference to API (Indicator: "TerminateProcess"; Source: "00000000-00003416.00000000.65622.00F5C000.00000002.mdmp, 00000000-00003416.00000000.65622.6D110000.00000002.mdmp") Found reference to API (Indicator: "CreateToolhelp32Snapshot"; Source: "00000000-00003416.00000000.65622.00F5C000.00000002.mdmp") Found reference to API (Indicator: "Process32FirstW"; Source: "00000000-00003416.00000000.65622.00F5C000.00000002.mdmp") Found reference to API (Indicator: "Process32NextW"; Source: "00000000-00003416.00000000.65622.00F5C000.00000002.mdmp") Found reference to API (Indicator: "SetFileTime"; Source: "00000000-00003416.00000000.65622.00F5C000.00000002.mdmp") Found reference to API (Indicator: "GetFileAttributesW"; Source: "00000000-00003416.00000000.65622.00F5C000.00000002.mdmp") Found reference to API (Indicator: "FindFirstFileW"; Source: "00000000-00003416.00000000.65622.00F5C000.00000002.mdmp") Found reference to API (Indicator: "FindClose"; Source: "00000000-00003416.00000000.65622.00F5C000.00000002.mdmp") Found reference to API (Indicator: "GetLongPathNameW"; Source: "00000000-00003416.00000000.65622.00F5C000.00000002.mdmp") Found reference to API (Indicator: "GetShortPathNameW"; Source: "00000000-00003416.00000000.65622.00F5C000.00000002.mdmp") Found reference to API (Indicator: "DeleteFileW"; Source: "00000000-00003416.00000000.65622.00F5C000.00000002.mdmp") Found reference to API (Indicator: "FindNextFileW"; Source: "00000000-00003416.00000000.65622.00F5C000.00000002.mdmp") Found reference to API (Indicator: "CopyFileExW"; Source: "00000000-00003416.00000000.65622.00F5C000.00000002.mdmp") Found reference to API (Indicator: "MoveFileW"; Source: "00000000-00003416.00000000.65622.00F5C000.00000002.mdmp") Found reference to API (Indicator: "CreateDirectoryW"; Source: "00000000-00003416.00000000.65622.00F5C000.00000002.mdmp") Found reference to API (Indicator: "RemoveDirectoryW"; Source: "00000000-00003416.00000000.65622.00F5C000.00000002.mdmp") Found reference to API (Indicator: "SetSystemPowerState"; Source: "00000000-00003416.00000000.65622.00F5C000.00000002.mdmp") Found reference to API (Indicator: "QueryPerformanceFrequency"; Source: "00000000-00003416.00000000.65622.00F5C000.00000002.mdmp") Found reference to API (Indicator: "LoadResource"; Source: "00000000-00003416.00000000.65622.00F5C000.00000002.mdmp") Found reference to API (Indicator: "LockResource"; Source: "00000000-00003416.00000000.65622.00F5C000.00000002.mdmp") Found reference to API (Indicator: "SizeofResource"; Source: "00000000-00003416.00000000.65622.00F5C000.00000002.mdmp") Found reference to API (Indicator: "OutputDebugStringW"; Source: "00000000-00003416.00000000.65622.00F5C000.00000002.mdmp") Found reference to API (Indicator: "GetTempPathW"; Source: "00000000-00003416.00000000.65622.00F5C000.00000002.mdmp") Found reference to API (Indicator: "GetTempFileNameW"; Source: "00000000-00003416.00000000.65622.00F5C000.00000002.mdmp") Found reference to API (Indicator: "DeviceIoControl"; Source: "00000000-00003416.00000000.65622.00F5C000.00000002.mdmp") Found reference to API (Indicator: "LoadLibraryW"; Source: "00000000-00003416.00000000.65622.00F5C000.00000002.mdmp") Found reference to API (Indicator: "GetLocalTime"; Source: "00000000-00003416.00000000.65622.00F5C000.00000002.mdmp") Found reference to API (Indicator: "CompareStringW"; Source: "00000000-00003416.00000000.65622.00F5C000.00000002.mdmp, 00000000-00003416.00000000.65622.6D110000.00000002.mdmp") Found reference to API (Indicator: "EnterCriticalSection"; Source: "00000000-00003416.00000000.65622.00F5C000.00000002.mdmp") Found reference to API (Indicator: "LeaveCriticalSection"; Source: "00000000-00003416.00000000.65622.00F5C000.00000002.mdmp") Found reference to API (Indicator: "GetStdHandle"; Source: "00000000-00003416.00000000.65622.00F5C000.00000002.mdmp") Found reference to API (Indicator: "CreatePipe"; Source: "00000000-00003416.00000000.65622.00F5C000.00000002.mdmp") Found reference to API (Indicator: "InterlockedExchange"; Source: "00000000-00003416.00000000.65622.00F5C000.00000002.mdmp") Found reference to API (Indicator: "TerminateThread"; Source: "00000000-00003416.00000000.65622.00F5C000.00000002.mdmp") Found reference to API (Indicator: "LoadLibraryExW"; Source: "00000000-00003416.00000000.65622.00F5C000.00000002.mdmp, 00000000-00003416.00000000.65622.6D110000.00000002.mdmp") Found reference to API (Indicator: "FindResourceExW"; Source: "00000000-00003416.00000000.65622.00F5C000.00000002.mdmp") Found reference to API (Indicator: "CopyFileW"; Source: "00000000-00003416.00000000.65622.00F5C000.00000002.mdmp") Found reference to API (Indicator: "VirtualFree"; Source: "00000000-00003416.00000000.65622.00F5C000.00000002.mdmp") Found reference to API (Indicator: "FormatMessageW"; Source: "00000000-00003416.00000000.65622.00F5C000.00000002.mdmp") Found reference to API (Indicator: "GetExitCodeProcess"; Source: "00000000-00003416.00000000.65622.00F5C000.00000002.mdmp") Found reference to API (Indicator: "GetPrivateProfileStringW"; Source: "00000000-00003416.00000000.65622.00F5C000.00000002.mdmp") Found reference to API (Indicator: "WritePrivateProfileStringW"; Source: "00000000-00003416.00000000.65622.00F5C000.00000002.mdmp") Found reference to API (Indicator: "GetPrivateProfileSectionW"; Source: "00000000-00003416.00000000.65622.00F5C000.00000002.mdmp") Found reference to API (Indicator: "WritePrivateProfileSectionW"; Source: "00000000-00003416.00000000.65622.00F5C000.00000002.mdmp") Found reference to API (Indicator: "GetPrivateProfileSectionNamesW"; Source: "00000000-00003416.00000000.65622.00F5C000.00000002.mdmp") Found reference to API (Indicator: "FileTimeToLocalFileTime"; Source: "00000000-00003416.00000000.65622.00F5C000.00000002.mdmp") Found reference to API (Indicator: "FileTimeToSystemTime"; Source: "00000000-00003416.00000000.65622.00F5C000.00000002.mdmp") Found reference to API (Indicator: "SystemTimeToFileTime"; Source: "00000000-00003416.00000000.65622.00F5C000.00000002.mdmp") Found reference to API (Indicator: "LocalFileTimeToFileTime"; Source: "00000000-00003416.00000000.65622.00F5C000.00000002.mdmp") Found reference to API (Indicator: "GetDriveTypeW"; Source: "00000000-00003416.00000000.65622.00F5C000.00000002.mdmp") Found reference to API (Indicator: "GetDiskFreeSpaceExW"; Source: "00000000-00003416.00000000.65622.00F5C000.00000002.mdmp") Found reference to API (Indicator: "GetDiskFreeSpaceW"; Source: "00000000-00003416.00000000.65622.00F5C000.00000002.mdmp") Found reference to API (Indicator: "GetVolumeInformationW"; Source: "00000000-00003416.00000000.65622.00F5C000.00000002.mdmp") Found reference to API (Indicator: "SetVolumeLabelW"; Source: "00000000-00003416.00000000.65622.00F5C000.00000002.mdmp") Found reference to API (Indicator: "CreateHardLinkW"; Source: "00000000-00003416.00000000.65622.00F5C000.00000002.mdmp") Found reference to API (Indicator: "SetFileAttributesW"; Source: "00000000-00003416.00000000.65622.00F5C000.00000002.mdmp") Found reference to API (Indicator: "CreateEventW"; Source: "00000000-00003416.00000000.65622.00F5C000.00000002.mdmp") Found reference to API (Indicator: "SetEvent"; Source: "00000000-00003416.00000000.65622.00F5C000.00000002.mdmp") Found reference to API (Indicator: "GetEnvironmentVariableW"; Source: "00000000-00003416.00000000.65622.00F5C000.00000002.mdmp") Found reference to API (Indicator: "SetEnvironmentVariableW"; Source: "00000000-00003416.00000000.65622.00F5C000.00000002.mdmp") Found reference to API (Indicator: "GlobalLock"; Source: "00000000-00003416.00000000.65622.00F5C000.00000002.mdmp, 00000000-00003416.00000000.65622.6D110000.00000002.mdmp") Found reference to API (Indicator: "GlobalUnlock"; Source: "00000000-00003416.00000000.65622.00F5C000.00000002.mdmp, 00000000-00003416.00000000.65622.6D110000.00000002.mdmp") Found reference to API (Indicator: "GlobalAlloc"; Source: "00000000-00003416.00000000.65622.00F5C000.00000002.mdmp, 00000000-00003416.00000000.65622.6D110000.00000002.mdmp") Found reference to API (Indicator: "GetFileSize"; Source: "00000000-00003416.00000000.65622.00F5C000.00000002.mdmp") Found reference to API (Indicator: "GlobalFree"; Source: "00000000-00003416.00000000.65622.00F5C000.00000002.mdmp") Found reference to API (Indicator: "GlobalMemoryStatusEx"; Source: "00000000-00003416.00000000.65622.00F5C000.00000002.mdmp") Found reference to API (Indicator: "Beep"; Source: "00000000-00003416.00000000.65622.00F5C000.00000002.mdmp") Found reference to API (Indicator: "GetSystemDirectoryW"; Source: "00000000-00003416.00000000.65622.00F5C000.00000002.mdmp") Found reference to API (Indicator: "HeapReAlloc"; Source: "00000000-00003416.00000000.65622.00F5C000.00000002.mdmp") Found reference to API (Indicator: "HeapSize"; Source: "00000000-00003416.00000000.65622.00F5C000.00000002.mdmp") Found reference to API (Indicator: "GetComputerNameW"; Source: "00000000-00003416.00000000.65622.00F5C000.00000002.mdmp") Found reference to API (Indicator: "GetWindowsDirectoryW"; Source: "00000000-00003416.00000000.65622.00F5C000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcessId"; Source: "00000000-00003416.00000000.65622.00F5C000.00000002.mdmp, 00000000-00003416.00000000.65622.6D110000.00000002.mdmp") Found reference to API (Indicator: "GetProcessIoCounters"; Source: "00000000-00003416.00000000.65622.00F5C000.00000002.mdmp") Found reference to API (Indicator: "CreateProcessW"; Source: "00000000-00003416.00000000.65622.00F5C000.00000002.mdmp") Found reference to API (Indicator: "GetProcessId"; Source: "00000000-00003416.00000000.65622.00F5C000.00000002.mdmp") Found reference to API (Indicator: "SetPriorityClass"; Source: "00000000-00003416.00000000.65622.00F5C000.00000002.mdmp") Found reference to API (Indicator: "VirtualAlloc"; Source: "00000000-00003416.00000000.65622.00F5C000.00000002.mdmp") Found reference to API (Indicator: "DestroyIcon"; Source: "00000000-00003416.00000000.65622.00F5C000.00000002.mdmp") Found reference to API (Indicator: "MessageBoxA"; Source: "00000000-00003416.00000000.65622.00F5C000.00000002.mdmp") Found reference to API (Indicator: "GetForegroundWindow"; Source: "00000000-00003416.00000000.65622.00F5C000.00000002.mdmp") Found reference to API (Indicator: "GetSysColorBrush"; Source: "00000000-00003416.00000000.65622.00F5C000.00000002.mdmp") Found reference to API (Indicator: "LoadCursorW"; Source: "00000000-00003416.00000000.65622.00F5C000.00000002.mdmp") Found reference to API (Indicator: "LoadIconW"; Source: "00000000-00003416.00000000.65622.00F5C000.00000002.mdmp") Found reference to API (Indicator: "CreateWindowExW"; Source: "00000000-00003416.00000000.65622.00F5C000.00000002.mdmp") Found reference to API (Indicator: "ShowWindow"; Source: "00000000-00003416.00000000.65622.00F5C000.00000002.mdmp") Found reference to API (Indicator: "SetTimer"; Source: "00000000-00003416.00000000.65622.00F5C000.00000002.mdmp") Found reference to API (Indicator: "CreatePopupMenu"; Source: "00000000-00003416.00000000.65622.00F5C000.00000002.mdmp") Found reference to API (Indicator: "KillTimer"; Source: "00000000-00003416.00000000.65622.00F5C000.00000002.mdmp") Found reference to API (Indicator: "PostQuitMessage"; Source: "00000000-00003416.00000000.65622.00F5C000.00000002.mdmp") Found reference to API (Indicator: "SetFocus"; Source: "00000000-00003416.00000000.65622.00F5C000.00000002.mdmp") Found reference to API (Indicator: "MoveWindow"; Source: "00000000-00003416.00000000.65622.00F5C000.00000002.mdmp") Found reference to API (Indicator: "DefWindowProcW"; Source: "00000000-00003416.00000000.65622.00F5C000.00000002.mdmp") Found reference to API (Indicator: "MessageBoxW"; Source: "00000000-00003416.00000000.65622.00F5C000.00000002.mdmp") Found reference to API (Indicator: "OpenWindowStationW"; Source: "00000000-00003416.00000000.65622.00F5C000.00000002.mdmp") Found reference to API (Indicator: "GetProcessWindowStation"; Source: "00000000-00003416.00000000.65622.00F5C000.00000002.mdmp") Found reference to API (Indicator: "SetProcessWindowStation"; Source: "00000000-00003416.00000000.65622.00F5C000.00000002.mdmp") Found reference to API (Indicator: "OpenDesktopW"; Source: "00000000-00003416.00000000.65622.00F5C000.00000002.mdmp") Found reference to API (Indicator: "CloseWindowStation"; Source: "00000000-00003416.00000000.65622.00F5C000.00000002.mdmp") Found reference to API (Indicator: "CloseDesktop"; Source: "00000000-00003416.00000000.65622.00F5C000.00000002.mdmp") Found reference to API (Indicator: "GetWindowRect"; Source: "00000000-00003416.00000000.65622.00F5C000.00000002.mdmp") Found reference to API (Indicator: "GetParent"; Source: "00000000-00003416.00000000.65622.00F5C000.00000002.mdmp") Found reference to API (Indicator: "CharUpperBuffW"; Source: "00000000-00003416.00000000.65622.00F5C000.00000002.mdmp") Found reference to API (Indicator: "EnumChildWindows"; Source: "00000000-00003416.00000000.65622.00F5C000.00000002.mdmp") Found reference to API (Indicator: "ScreenToClient"; Source: "00000000-00003416.00000000.65622.00F5C000.00000002.mdmp") Found reference to API (Indicator: "GetWindowTextW"; Source: "00000000-00003416.00000000.65622.00F5C000.00000002.mdmp") Found reference to API (Indicator: "GetFocus"; Source: "00000000-00003416.00000000.65622.00F5C000.00000002.mdmp") Found reference to API (Indicator: "AttachThreadInput"; Source: "00000000-00003416.00000000.65622.00F5C000.00000002.mdmp") Found reference to API (Indicator: "GetWindowThreadProcessId"; Source: "00000000-00003416.00000000.65622.00F5C000.00000002.mdmp, 00000000-00003416.00000000.65622.6D0D1000.00000020.mdmp") Found reference to API (Indicator: "InvalidateRect"; Source: "00000000-00003416.00000000.65622.00F5C000.00000002.mdmp") Found reference to API (Indicator: "EnableWindow"; Source: "00000000-00003416.00000000.65622.00F5C000.00000002.mdmp") Found reference to API (Indicator: "IsWindowVisible"; Source: "00000000-00003416.00000000.65622.00F5C000.00000002.mdmp") Found reference to API (Indicator: "IsWindowEnabled"; Source: "00000000-00003416.00000000.65622.00F5C000.00000002.mdmp") Found reference to API (Indicator: "IsWindow"; Source: "00000000-00003416.00000000.65622.00F5C000.00000002.mdmp") Found reference to API (Indicator: "GetDesktopWindow"; Source: "00000000-00003416.00000000.65622.00F5C000.00000002.mdmp") Found reference to API (Indicator: "EnumWindows"; Source: "00000000-00003416.00000000.65622.00F5C000.00000002.mdmp") Found reference to API (Indicator: "DestroyWindow"; Source: "00000000-00003416.00000000.65622.00F5C000.00000002.mdmp") Found reference to API (Indicator: "GetMenu"; Source: "00000000-00003416.00000000.65622.00F5C000.00000002.mdmp") Found reference to API (Indicator: "GetClientRect"; Source: "00000000-00003416.00000000.65622.00F5C000.00000002.mdmp") Found reference to API (Indicator: "BeginPaint"; Source: "00000000-00003416.00000000.65622.00F5C000.00000002.mdmp") Found reference to API (Indicator: "GetDC"; Source: "00000000-00003416.00000000.65622.00F5C000.00000002.mdmp") Found reference to API (Indicator: "ReleaseDC"; Source: "00000000-00003416.00000000.65622.00F5C000.00000002.mdmp") Found reference to API (Indicator: "CopyRect"; Source: "00000000-00003416.00000000.65622.00F5C000.00000002.mdmp") Found reference to API (Indicator: "SetWindowTextW"; Source: "00000000-00003416.00000000.65622.00F5C000.00000002.mdmp") Found reference to API (Indicator: "MessageBeep"; Source: "00000000-00003416.00000000.65622.00F5C000.00000002.mdmp") Found reference to API (Indicator: "LoadStringW"; Source: "00000000-00003416.00000000.65622.00F5C000.00000002.mdmp") Found reference to API (Indicator: "GetKeyState"; Source: "00000000-00003416.00000000.65622.00F5C000.00000002.mdmp") Found reference to API (Indicator: "GetKeyboardState"; Source: "00000000-00003416.00000000.65622.00F5C000.00000002.mdmp") Found reference to API (Indicator: "GetAsyncKeyState"; Source: "00000000-00003416.00000000.65622.00F5C000.00000002.mdmp") Found reference to API (Indicator: "SendInput"; Source: "00000000-00003416.00000000.65622.00F5C000.00000002.mdmp") Found reference to API (Indicator: "SystemParametersInfoW"; Source: "00000000-00003416.00000000.65622.00F5C000.00000002.mdmp") Found reference to API (Indicator: "IsIconic"; Source: "00000000-00003416.00000000.65622.00F5C000.00000002.mdmp") Found reference to API (Indicator: "SetForegroundWindow"; Source: "00000000-00003416.00000000.65622.00F5C000.00000002.mdmp") Found reference to API (Indicator: "GetMenuItemInfoW"; Source: "00000000-00003416.00000000.65622.00F5C000.00000002.mdmp") Found reference to API (Indicator: "SetMenuItemInfoW"; Source: "00000000-00003416.00000000.65622.00F5C000.00000002.mdmp") Found reference to API (Indicator: "GetMenuItemCount"; Source: "00000000-00003416.00000000.65622.00F5C000.00000002.mdmp") Found reference to API (Indicator: "GetMenuItemID"; Source: "00000000-00003416.00000000.65622.00F5C000.00000002.mdmp") Found reference to API (Indicator: "CheckMenuRadioItem"; Source: "00000000-00003416.00000000.65622.00F5C000.00000002.mdmp") Found reference to API (Indicator: "DeleteMenu"; Source: "00000000-00003416.00000000.65622.00F5C000.00000002.mdmp") Found reference to API (Indicator: "GetCursorPos"; Source: "00000000-00003416.00000000.65622.00F5C000.00000002.mdmp") Found reference to API (Indicator: "TrackPopupMenuEx"; Source: "00000000-00003416.00000000.65622.00F5C000.00000002.mdmp") Found reference to API (Indicator: "InsertMenuItemW"; Source: "00000000-00003416.00000000.65622.00F5C000.00000002.mdmp") Found reference to API (Indicator: "SetMenuDefaultItem"; Source: "00000000-00003416.00000000.65622.00F5C000.00000002.mdmp") Found reference to API (Indicator: "EnumThreadWindows"; Source: "00000000-00003416.00000000.65622.00F5C000.00000002.mdmp") Found reference to API (Indicator: "SetActiveWindow"; Source: "00000000-00003416.00000000.65622.00F5C000.00000002.mdmp") Found reference to API (Indicator: "ExitWindowsEx"; Source: "00000000-00003416.00000000.65622.00F5C000.00000002.mdmp") Found reference to API (Indicator: "LoadImageW"; Source: "00000000-00003416.00000000.65622.00F5C000.00000002.mdmp") Found reference to API (Indicator: "CharLowerBuffW"; Source: "00000000-00003416.00000000.65622.00F5C000.00000002.mdmp") Found reference to API (Indicator: "UnregisterHotKey"; Source: "00000000-00003416.00000000.65622.00F5C000.00000002.mdmp") Found reference to API (Indicator: "PeekMessageW"; Source: "00000000-00003416.00000000.65622.00F5C000.00000002.mdmp") Found reference to API (Indicator: "TranslateMessage"; Source: "00000000-00003416.00000000.65622.00F5C000.00000002.mdmp") Found reference to API (Indicator: "DispatchMessageW"; Source: "00000000-00003416.00000000.65622.00F5C000.00000002.mdmp") Found reference to API (Indicator: "OpenClipboard"; Source: "00000000-00003416.00000000.65622.00F5C000.00000002.mdmp") Found reference to API (Indicator: "GetClipboardData"; Source: "00000000-00003416.00000000.65622.00F5C000.00000002.mdmp") Found reference to API (Indicator: "CloseClipboard"; Source: "00000000-00003416.00000000.65622.00F5C000.00000002.mdmp") Found reference to API (Indicator: "CountClipboardFormats"; Source: "00000000-00003416.00000000.65622.00F5C000.00000002.mdmp") Found reference to API (Indicator: "EmptyClipboard"; Source: "00000000-00003416.00000000.65622.00F5C000.00000002.mdmp") Found reference to API (Indicator: "SetClipboardData"; Source: "00000000-00003416.00000000.65622.00F5C000.00000002.mdmp") Found reference to API (Indicator: "SetRect"; Source: "00000000-00003416.00000000.65622.00F5C000.00000002.mdmp") Found reference to API (Indicator: "AdjustWindowRectEx"; Source: "00000000-00003416.00000000.65622.00F5C000.00000002.mdmp") Found reference to API (Indicator: "CopyImage"; Source: "00000000-00003416.00000000.65622.00F5C000.00000002.mdmp") Found reference to API (Indicator: "SetWindowPos"; Source: "00000000-00003416.00000000.65622.00F5C000.00000002.mdmp") Found reference to API (Indicator: "GetCursorInfo"; Source: "00000000-00003416.00000000.65622.00F5C000.00000002.mdmp") Found reference to API (Indicator: "RegisterHotKey"; Source: "00000000-00003416.00000000.65622.00F5C000.00000002.mdmp") Found reference to API (Indicator: "ClientToScreen"; Source: "00000000-00003416.00000000.65622.00F5C000.00000002.mdmp") Found reference to API (Indicator: "IsCharAlphaW"; Source: "00000000-00003416.00000000.65622.00F5C000.00000002.mdmp") Found reference to API (Indicator: "IsCharAlphaNumericW"; Source: "00000000-00003416.00000000.65622.00F5C000.00000002.mdmp") Found reference to API (Indicator: "IsCharUpperW"; Source: "00000000-00003416.00000000.65622.00F5C000.00000002.mdmp") Found reference to API (Indicator: "GetMenuStringW"; Source: "00000000-00003416.00000000.65622.00F5C000.00000002.mdmp") Found reference to API (Indicator: "GetSubMenu"; Source: "00000000-00003416.00000000.65622.00F5C000.00000002.mdmp") Found reference to API (Indicator: "GetCaretPos"; Source: "00000000-00003416.00000000.65622.00F5C000.00000002.mdmp") Found reference to API (Indicator: "IsZoomed"; Source: "00000000-00003416.00000000.65622.00F5C000.00000002.mdmp") Found reference to API (Indicator: "TranslateAcceleratorW"; Source: "00000000-00003416.00000000.65622.00F5C000.00000002.mdmp") Found reference to API (Indicator: "GetSysColor"; Source: "00000000-00003416.00000000.65622.00F5C000.00000002.mdmp") Found reference to API (Indicator: "InflateRect"; Source: "00000000-00003416.00000000.65622.00F5C000.00000002.mdmp") Found reference to API (Indicator: "DrawFocusRect"; Source: "00000000-00003416.00000000.65622.00F5C000.00000002.mdmp") Found reference to API (Indicator: "FrameRect"; Source: "00000000-00003416.00000000.65622.00F5C000.00000002.mdmp") Found reference to API (Indicator: "DrawFrameControl"; Source: "00000000-00003416.00000000.65622.00F5C000.00000002.mdmp") Found reference to API (Indicator: "FillRect"; Source: "00000000-00003416.00000000.65622.00F5C000.00000002.mdmp") Found reference to API (Indicator: "PtInRect"; Source: "00000000-00003416.00000000.65622.00F5C000.00000002.mdmp") Found reference to API (Indicator: "DestroyAcceleratorTable"; Source: "00000000-00003416.00000000.65622.00F5C000.00000002.mdmp") Found reference to API (Indicator: "CreateAcceleratorTableW"; Source: "00000000-00003416.00000000.65622.00F5C000.00000002.mdmp") Found reference to API (Indicator: "SetCursor"; Source: "00000000-00003416.00000000.65622.00F5C000.00000002.mdmp") Found reference to API (Indicator: "GetWindowDC"; Source: "00000000-00003416.00000000.65622.00F5C000.00000002.mdmp") Found reference to API (Indicator: "GetSystemMetrics"; Source: "00000000-00003416.00000000.65622.00F5C000.00000002.mdmp") Found reference to API (Indicator: "GetActiveWindow"; Source: "00000000-00003416.00000000.65622.00F5C000.00000002.mdmp") Found reference to API (Indicator: "CharNextW"; Source: "00000000-00003416.00000000.65622.00F5C000.00000002.mdmp") Found reference to API (Indicator: "wsprintfW"; Source: "00000000-00003416.00000000.65622.00F5C000.00000002.mdmp") Found reference to API (Indicator: "RedrawWindow"; Source: "00000000-00003416.00000000.65622.00F5C000.00000002.mdmp") Found reference to API (Indicator: "DrawMenuBar"; Source: "00000000-00003416.00000000.65622.00F5C000.00000002.mdmp") Found reference to API (Indicator: "DestroyMenu"; Source: "00000000-00003416.00000000.65622.00F5C000.00000002.mdmp") Found reference to API (Indicator: "SetMenu"; Source: "00000000-00003416.00000000.65622.00F5C000.00000002.mdmp") Found reference to API (Indicator: "GetWindowTextLengthW"; Source: "00000000-00003416.00000000.65622.00F5C000.00000002.mdmp") Found reference to API (Indicator: "CreateMenu"; Source: "00000000-00003416.00000000.65622.00F5C000.00000002.mdmp") Found reference to API (Indicator: "ReleaseCapture"; Source: "00000000-00003416.00000000.65622.00F5C000.00000002.mdmp") Found reference to API (Indicator: "SetCapture"; Source: "00000000-00003416.00000000.65622.00F5C000.00000002.mdmp") Found reference to API (Indicator: "GetDeviceCaps"; Source: "00000000-00003416.00000000.65622.00F5C000.00000002.mdmp") Found reference to API (Indicator: "DeleteObject"; Source: "00000000-00003416.00000000.65622.00F5C000.00000002.mdmp") Found reference to API (Indicator: "CreateCompatibleBitmap"; Source: "00000000-00003416.00000000.65622.00F5C000.00000002.mdmp") Found reference to API (Indicator: "CreateCompatibleDC"; Source: "00000000-00003416.00000000.65622.00F5C000.00000002.mdmp") Found reference to API (Indicator: "SelectObject"; Source: "00000000-00003416.00000000.65622.00F5C000.00000002.mdmp") Found reference to API (Indicator: "StretchBlt"; Source: "00000000-00003416.00000000.65622.00F5C000.00000002.mdmp") Found reference to API (Indicator: "GetDIBits"; Source: "00000000-00003416.00000000.65622.00F5C000.00000002.mdmp") Found reference to API (Indicator: "DeleteDC"; Source: "00000000-00003416.00000000.65622.00F5C000.00000002.mdmp") Found reference to API (Indicator: "GetStockObject"; Source: "00000000-00003416.00000000.65622.00F5C000.00000002.mdmp") Found reference to API (Indicator: "CreateSolidBrush"; Source: "00000000-00003416.00000000.65622.00F5C000.00000002.mdmp") Found reference to API (Indicator: "RoundRect"; Source: "00000000-00003416.00000000.65622.00F5C000.00000002.mdmp") Found reference to API (Indicator: "GetObjectW"; Source: "00000000-00003416.00000000.65622.00F5C000.00000002.mdmp") Found reference to API (Indicator: "GetOpenFileNameW"; Source: "00000000-00003416.00000000.65622.00F5C000.00000002.mdmp") Found reference to API (Indicator: "GetSaveFileNameW"; Source: "00000000-00003416.00000000.65622.00F5C000.00000002.mdmp") Found reference to API (Indicator: "RegOpenKeyExW"; Source: "00000000-00003416.00000000.65622.00F5C000.00000002.mdmp, 00000000-00003416.00000000.65622.6D110000.00000002.mdmp") Found reference to API (Indicator: "RegCloseKey"; Source: "00000000-00003416.00000000.65622.00F5C000.00000002.mdmp, 00000000-00003416.00000000.65622.6D110000.00000002.mdmp") Found reference to API (Indicator: "RegQueryValueExW"; Source: "00000000-00003416.00000000.65622.00F5C000.00000002.mdmp, 00000000-00003416.00000000.65622.6D110000.00000002.mdmp") Found reference to API (Indicator: "RegConnectRegistryW"; Source: "00000000-00003416.00000000.65622.00F5C000.00000002.mdmp") Found reference to API (Indicator: "InitializeSecurityDescriptor"; Source: "00000000-00003416.00000000.65622.00F5C000.00000002.mdmp") Found reference to API (Indicator: "InitializeAcl"; Source: "00000000-00003416.00000000.65622.00F5C000.00000002.mdmp") Found reference to API (Indicator: "AdjustTokenPrivileges"; Source: "00000000-00003416.00000000.65622.00F5C000.00000002.mdmp") Found reference to API (Indicator: "OpenThreadToken"; Source: "00000000-00003416.00000000.65622.00F5C000.00000002.mdmp") Found reference to API (Indicator: "OpenProcessToken"; Source: "00000000-00003416.00000000.65622.00F5C000.00000002.mdmp") Found reference to API (Indicator: "LookupPrivilegeValueW"; Source: "00000000-00003416.00000000.65622.00F5C000.00000002.mdmp") Found reference to API (Indicator: "DuplicateTokenEx"; Source: "00000000-00003416.00000000.65622.00F5C000.00000002.mdmp") Found reference to API (Indicator: "CreateProcessAsUserW"; Source: "00000000-00003416.00000000.65622.00F5C000.00000002.mdmp") Found reference to API (Indicator: "CreateProcessWithLogonW"; Source: "00000000-00003416.00000000.65622.00F5C000.00000002.mdmp") Found reference to API (Indicator: "GetLengthSid"; Source: "00000000-00003416.00000000.65622.00F5C000.00000002.mdmp") Found reference to API (Indicator: "CopySid"; Source: "00000000-00003416.00000000.65622.00F5C000.00000002.mdmp") Found reference to API (Indicator: "LogonUserW"; Source: "00000000-00003416.00000000.65622.00F5C000.00000002.mdmp") Found reference to API (Indicator: "AllocateAndInitializeSid"; Source: "00000000-00003416.00000000.65622.00F5C000.00000002.mdmp") Found reference to API (Indicator: "CheckTokenMembership"; Source: "00000000-00003416.00000000.65622.00F5C000.00000002.mdmp") Found reference to API (Indicator: "FreeSid"; Source: "00000000-00003416.00000000.65622.00F5C000.00000002.mdmp") Found reference to API (Indicator: "GetTokenInformation"; Source: "00000000-00003416.00000000.65622.00F5C000.00000002.mdmp") Found reference to API (Indicator: "GetSecurityDescriptorDacl"; Source: "00000000-00003416.00000000.65622.00F5C000.00000002.mdmp, 00000000-00003416.00000000.65622.6D110000.00000002.mdmp") Found reference to API (Indicator: "GetAclInformation"; Source: "00000000-00003416.00000000.65622.00F5C000.00000002.mdmp") Found reference to API (Indicator: "GetAce"; Source: "00000000-00003416.00000000.65622.00F5C000.00000002.mdmp, 00000000-00003416.00000000.65622.6D110000.00000002.mdmp") Found reference to API (Indicator: "AddAce"; Source: "00000000-00003416.00000000.65622.00F5C000.00000002.mdmp") Found reference to API (Indicator: "SetSecurityDescriptorDacl"; Source: "00000000-00003416.00000000.65622.00F5C000.00000002.mdmp") Found reference to API (Indicator: "GetUserNameW"; Source: "00000000-00003416.00000000.65622.00F5C000.00000002.mdmp") Found reference to API (Indicator: "RegCreateKeyExW"; Source: "00000000-00003416.00000000.65622.00F5C000.00000002.mdmp") Found reference to API (Indicator: "RegSetValueExW"; Source: "00000000-00003416.00000000.65622.00F5C000.00000002.mdmp") Found reference to API (Indicator: "RegEnumKeyExW"; Source: "00000000-00003416.00000000.65622.00F5C000.00000002.mdmp") Found reference to API (Indicator: "RegDeleteKeyW"; Source: "00000000-00003416.00000000.65622.00F5C000.00000002.mdmp") Found reference to API (Indicator: "RegDeleteValueW"; Source: "00000000-00003416.00000000.65622.00F5C000.00000002.mdmp") Found reference to API (Indicator: "RegEnumValueW"; Source: "00000000-00003416.00000000.65622.00F5C000.00000002.mdmp") Found reference to API (Indicator: "ShellExecuteW"; Source: "00000000-00003416.00000000.65622.00F5C000.00000002.mdmp") Found reference to API (Indicator: "Shell_NotifyIconW"; Source: "00000000-00003416.00000000.65622.00F5C000.00000002.mdmp") Found reference to API (Indicator: "SHFileOperationW"; Source: "00000000-00003416.00000000.65622.00F5C000.00000002.mdmp") Found reference to API (Indicator: "SHGetFolderPathW"; Source: "00000000-00003416.00000000.65622.00F5C000.00000002.mdmp") Found reference to API (Indicator: "SHGetSpecialFolderLocation"; Source: "00000000-00003416.00000000.65622.00F5C000.00000002.mdmp") Found reference to API (Indicator: "SHGetDesktopFolder"; Source: "00000000-00003416.00000000.65622.00F5C000.00000002.mdmp") Found reference to API (Indicator: "SHBrowseForFolderW"; Source: "00000000-00003416.00000000.65622.00F5C000.00000002.mdmp") Found reference to API (Indicator: "SHGetPathFromIDListW"; Source: "00000000-00003416.00000000.65622.00F5C000.00000002.mdmp") Found reference to API (Indicator: "ShellExecuteExW"; Source: "00000000-00003416.00000000.65622.00F5C000.00000002.mdmp") Found reference to API (Indicator: "CoTaskMemAlloc"; Source: "00000000-00003416.00000000.65622.00F5C000.00000002.mdmp") Found reference to API (Indicator: "CoTaskMemFree"; Source: "00000000-00003416.00000000.65622.00F5C000.00000002.mdmp, 00000000-00003416.00000000.65622.6D0D1000.00000020.mdmp") Found reference to API (Indicator: "CLSIDFromString"; Source: "00000000-00003416.00000000.65622.00F5C000.00000002.mdmp") Found reference to API (Indicator: "ProgIDFromCLSID"; Source: "00000000-00003416.00000000.65622.00F5C000.00000002.mdmp") Found reference to API (Indicator: "OleSetMenuDescriptor"; Source: "00000000-00003416.00000000.65622.00F5C000.00000002.mdmp") Found reference to API (Indicator: "CoCreateInstance"; Source: "00000000-00003416.00000000.65622.00F5C000.00000002.mdmp, 00000000-00003416.00000000.65622.6D0D1000.00000020.mdmp") Found reference to API (Indicator: "IIDFromString"; Source: "00000000-00003416.00000000.65622.00F5C000.00000002.mdmp") Found reference to API (Indicator: "StringFromGUID2"; Source: "00000000-00003416.00000000.65622.00F5C000.00000002.mdmp") Found reference to API (Indicator: "CreateStreamOnHGlobal"; Source: "00000000-00003416.00000000.65622.00F5C000.00000002.mdmp") Found reference to API (Indicator: "OleInitialize"; Source: "00000000-00003416.00000000.65622.00F5C000.00000002.mdmp") Found reference to API (Indicator: "OleUninitialize"; Source: "00000000-00003416.00000000.65622.00F5C000.00000002.mdmp") Found reference to API (Indicator: "CoInitialize"; Source: "00000000-00003416.00000000.65622.00F5C000.00000002.mdmp") Found reference to API (Indicator: "CoUninitialize"; Source: "00000000-00003416.00000000.65622.00F5C000.00000002.mdmp") Found reference to API (Indicator: "CoGetObject"; Source: "00000000-00003416.00000000.65622.00F5C000.00000002.mdmp") Found reference to API (Indicator: "CoInitializeSecurity"; Source: "00000000-00003416.00000000.65622.00F5C000.00000002.mdmp") Found reference to API (Indicator: "ResetEvent"; Source: "00000000-00003416.00000000.65622.00F5C000.00000002.mdmp") Found reference to API (Indicator: "WaitForSingleObjectEx"; Source: "00000000-00003416.00000000.65622.00F5C000.00000002.mdmp") Found reference to API (Indicator: "IsProcessorFeaturePresent"; Source: "00000000-00003416.00000000.65622.00F5C000.00000002.mdmp") Found reference to API (Indicator: "UnhandledExceptionFilter"; Source: "00000000-00003416.00000000.65622.00F5C000.00000002.mdmp, 00000000-00003416.00000000.65622.6D110000.00000002.mdmp") Found reference to API (Indicator: "SetUnhandledExceptionFilter"; Source: "00000000-00003416.00000000.65622.00F5C000.00000002.mdmp, 00000000-00003416.00000000.65622.6D110000.00000002.mdmp") Found reference to API (Indicator: "GetStartupInfoW"; Source: "00000000-00003416.00000000.65622.00F5C000.00000002.mdmp") Found reference to API (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00003416.00000000.65622.00F5C000.00000002.mdmp, 00000000-00003416.00000000.65622.6D110000.00000002.mdmp") Found reference to API (Indicator: "InitializeSListHead"; Source: "00000000-00003416.00000000.65622.00F5C000.00000002.mdmp") Found reference to API (Indicator: "RtlUnwind"; Source: "00000000-00003416.00000000.65622.00F5C000.00000002.mdmp") Found reference to API (Indicator: "SetLastError"; Source: "00000000-00003416.00000000.65622.00F5C000.00000002.mdmp") Found reference to API (Indicator: "TlsAlloc"; Source: "00000000-00003416.00000000.65622.00F5C000.00000002.mdmp") Found reference to API (Indicator: "TlsGetValue"; Source: "00000000-00003416.00000000.65622.00F5C000.00000002.mdmp") Found reference to API (Indicator: "TlsSetValue"; Source: "00000000-00003416.00000000.65622.00F5C000.00000002.mdmp") Found reference to API (Indicator: "TlsFree"; Source: "00000000-00003416.00000000.65622.00F5C000.00000002.mdmp") Found reference to API (Indicator: "EncodePointer"; Source: "00000000-00003416.00000000.65622.00F5C000.00000002.mdmp") Found reference to API (Indicator: "ExitProcess"; Source: "00000000-00003416.00000000.65622.00F5C000.00000002.mdmp") Found reference to API (Indicator: "ExitThread"; Source: "00000000-00003416.00000000.65622.00F5C000.00000002.mdmp") Found reference to API (Indicator: "ResumeThread"; Source: "00000000-00003416.00000000.65622.00F5C000.00000002.mdmp") Found reference to API (Indicator: "FreeLibraryAndExitThread"; Source: "00000000-00003416.00000000.65622.00F5C000.00000002.mdmp") Found reference to API (Indicator: "GetACP"; Source: "00000000-00003416.00000000.65622.00F5C000.00000002.mdmp") Found reference to API (Indicator: "GetDateFormatW"; Source: "00000000-00003416.00000000.65622.00F5C000.00000002.mdmp") Found reference to API (Indicator: "GetTimeFormatW"; Source: "00000000-00003416.00000000.65622.00F5C000.00000002.mdmp") Found reference to API (Indicator: "LCMapStringW"; Source: "00000000-00003416.00000000.65622.00F5C000.00000002.mdmp") Found reference to API (Indicator: "GetStringTypeW"; Source: "00000000-00003416.00000000.65622.00F5C000.00000002.mdmp") Found reference to API (Indicator: "GetFileType"; Source: "00000000-00003416.00000000.65622.00F5C000.00000002.mdmp") Found reference to API (Indicator: "SetStdHandle"; Source: "00000000-00003416.00000000.65622.00F5C000.00000002.mdmp") Found reference to API (Indicator: "GetConsoleCP"; Source: "00000000-00003416.00000000.65622.00F5C000.00000002.mdmp") Found reference to API (Indicator: "GetConsoleMode"; Source: "00000000-00003416.00000000.65622.00F5C000.00000002.mdmp") Found reference to API (Indicator: "ReadConsoleW"; Source: "00000000-00003416.00000000.65622.00F5C000.00000002.mdmp") Found reference to API (Indicator: "GetTimeZoneInformation"; Source: "00000000-00003416.00000000.65622.00F5C000.00000002.mdmp") Found reference to API (Indicator: "FindFirstFileExW"; Source: "00000000-00003416.00000000.65622.00F5C000.00000002.mdmp") Found reference to API (Indicator: "IsValidCodePage"; Source: "00000000-00003416.00000000.65622.00F5C000.00000002.mdmp") Found reference to API (Indicator: "GetOEMCP"; Source: "00000000-00003416.00000000.65622.00F5C000.00000002.mdmp") Found reference to API (Indicator: "GetCPInfo"; Source: "00000000-00003416.00000000.65622.00F5C000.00000002.mdmp") Found reference to API (Indicator: "GetCommandLineA"; Source: "00000000-00003416.00000000.65622.00F5C000.00000002.mdmp") Found reference to API (Indicator: "GetCommandLineW"; Source: "00000000-00003416.00000000.65622.00F5C000.00000002.mdmp") Found reference to API (Indicator: "GetEnvironmentStringsW"; Source: "00000000-00003416.00000000.65622.00F5C000.00000002.mdmp") Found reference to API (Indicator: "FreeEnvironmentStringsW"; Source: "00000000-00003416.00000000.65622.00F5C000.00000002.mdmp") Found reference to API (Indicator: "SetEnvironmentVariableA"; Source: "00000000-00003416.00000000.65622.00F5C000.00000002.mdmp") Found reference to API (Indicator: "WriteConsoleW"; Source: "00000000-00003416.00000000.65622.00F5C000.00000002.mdmp") Found reference to API (Indicator: "CoMarshalInterface"; Source: "00000000-00003416.00000000.65622.6D0D1000.00000020.mdmp") Found reference to API (Indicator: "CoTaskMemRealloc"; Source: "00000000-00003416.00000000.65622.6D0D1000.00000020.mdmp") Found reference to API (Indicator: "GetObjectA"; Source: "00000000-00003416.00000000.65622.6D0D1000.00000020.mdmp") Found reference to API (Indicator: "CompareStringOrdinal"; Source: "00000000-00003416.00000000.65622.6D110000.00000002.mdmp") Found reference to API (Indicator: "DelayLoadFailureHook"; Source: "00000000-00003416.00000000.65622.6D110000.00000002.mdmp") Found reference to API (Indicator: "LoadLibraryExA"; Source: "00000000-00003416.00000000.65622.6D110000.00000002.mdmp") Found reference to API (Indicator: "DisableThreadLibraryCalls"; Source: "00000000-00003416.00000000.65622.6D110000.00000002.mdmp") Found reference to API (Indicator: "GetLocaleInfoEx"; Source: "00000000-00003416.00000000.65622.6D110000.00000002.mdmp") Found reference to API (Indicator: "GetTickCount"; Source: "00000000-00003416.00000000.65622.6D110000.00000002.mdmp") Found reference to API (Indicator: "RegGetValueW"; Source: "00000000-00003416.00000000.65622.6D110000.00000002.mdmp") Found reference to API (Indicator: "GetFinalPathNameByHandleW"; Source: "00000000-00003416.00000000.65622.6D110000.00000002.mdmp") Found reference to API (Indicator: "LocalFree"; Source: "00000000-00003416.00000000.65622.6D110000.00000002.mdmp") Found reference to API (Indicator: "LocalAlloc"; Source: "00000000-00003416.00000000.65622.6D110000.00000002.mdmp") Found reference to API (Indicator: "GetVersionExA"; Source: "00000000-00003416.00000000.65622.6D110000.00000002.mdmp") Found reference to API (Indicator: "GlobalSize"; Source: "00000000-00003416.00000000.65622.6D110000.00000002.mdmp") Found reference to API (Indicator: "RpcRaiseException"; Source: "00000000-00003416.00000000.65622.6D110000.00000002.mdmp") Found reference to API (Indicator: "NdrStubCall2"; Source: "00000000-00003416.00000000.65622.6D110000.00000002.mdmp") Found reference to API (Indicator: "NdrClientCall2"; Source: "00000000-00003416.00000000.65622.6D110000.00000002.mdmp") Found reference to API (Indicator: "NdrOleFree"; Source: "00000000-00003416.00000000.65622.6D110000.00000002.mdmp") Found reference to API (Indicator: "NdrGetUserMarshalInfo"; Source: "00000000-00003416.00000000.65622.6D110000.00000002.mdmp") Found reference to API (Indicator: "NdrOleAllocate"; Source: "00000000-00003416.00000000.65622.6D110000.00000002.mdmp") Found reference to API (Indicator: "GetSidSubAuthorityCount"; Source: "00000000-00003416.00000000.65622.6D110000.00000002.mdmp") Found reference to API (Indicator: "GetSidIdentifierAuthority"; Source: "00000000-00003416.00000000.65622.6D110000.00000002.mdmp") Found reference to API (Indicator: "GetSidSubAuthority"; Source: "00000000-00003416.00000000.65622.6D110000.00000002.mdmp") Found reference to API (Indicator: "GetKernelObjectSecurity"; Source: "00000000-00003416.00000000.65622.6D110000.00000002.mdmp")3c:T7be,Found reference to API "SizeofResource" (Indicator: "SizeofResource"; File: "ac18ad4de0d70e7cbbfb829afea0dd45.exe") Found reference to API "FindResourceA" (Indicator: "FindResource"; File: "ac18ad4de0d70e7cbbfb829afea0dd45.exe") Found reference to API "FreeResource" (Indicator: "FreeResource"; File: "ac18ad4de0d70e7cbbfb829afea0dd45.exe") Found reference to API "LockResource" (Indicator: "LockResource"; File: "ac18ad4de0d70e7cbbfb829afea0dd45.exe") Found reference to API "LoadResource" (Indicator: "LoadResource"; File: "ac18ad4de0d70e7cbbfb829afea0dd45.exe") Found reference to API "SizeofResource" (Indicator: "SizeofResource"; Source: "00000000-00002632.00000002.67682.00F2A000.00000002.mdmp") Found reference to API "FindResourceA" (Indicator: "FindResource"; Source: "00000000-00002632.00000002.67682.00F2A000.00000002.mdmp") Found reference to API "FreeResource" (Indicator: "FreeResource"; Source: "00000000-00002632.00000002.67682.00F2A000.00000002.mdmp") Found reference to API "LockResource" (Indicator: "LockResource"; Source: "00000000-00002632.00000002.67682.00F2A000.00000002.mdmp") Found reference to API "LoadResource" (Indicator: "LoadResource"; Source: "00000000-00002632.00000002.67682.00F2A000.00000002.mdmp") Found reference to API "LoadResource" (Indicator: "LoadResource"; Source: "00000000-00003416.00000000.65622.00F5C000.00000002.mdmp") Found reference to API "LockResource" (Indicator: "LockResource"; Source: "00000000-00003416.00000000.65622.00F5C000.00000002.mdmp") Found reference to API "SizeofResource" (Indicator: "SizeofResource"; Source: "00000000-00003416.00000000.65622.00F5C000.00000002.mdmp") Found reference to API "FindResourceExW" (Indicator: "FindResource"; Source: "00000000-00003416.00000000.65622.00F5C000.00000002.mdmp") Found reference to API "30161025121,3788,3135,,LoadResource,kernel32.dll,"252:02:53.218",RX=0,PX=0" (Indicator: "LoadResource"; Source: "00000000-00003416.00000001.66534.006B6000.00000004.mdmp")3d:T83e,"sqlite3.dll" contains export function called "sqlite3_activate_cerod" at ordinal 1 "sqlite3.dll" contains export function called "sqlite3_activate_see" at ordinal 2 "sqlite3.dll" contains export function called "sqlite3_aggregate_context" at ordinal 3 "sqlite3.dll" contains export function called "sqlite3_auto_extension" at ordinal 4 "sqlite3.dll" contains export function called "sqlite3_backup_finish" at ordinal 5 "sqlite3.dll" contains export function called "sqlite3_backup_init" at ordinal 6 "sqlite3.dll" contains export function called "sqlite3_backup_pagecount" at ordinal 7 "sqlite3.dll" contains export function called "sqlite3_backup_remaining" at ordinal 8 "sqlite3.dll" contains export function called "sqlite3_backup_step" at ordinal 9 "sqlite3.dll" contains export function called "sqlite3_bind_blob" at ordinal 10 "sqlite3.dll" contains export function called "sqlite3_bind_blob64" at ordinal 11 "sqlite3.dll" contains export function called "sqlite3_bind_double" at ordinal 12 "sqlite3.dll" contains export function called "sqlite3_bind_int" at ordinal 13 "sqlite3.dll" contains export function called "sqlite3_bind_int64" at ordinal 14 "sqlite3.dll" contains export function called "sqlite3_bind_null" at ordinal 15 "sqlite3.dll" contains export function called "sqlite3_bind_parameter_count" at ordinal 16 "sqlite3.dll" contains export function called "sqlite3_bind_parameter_index" at ordinal 17 "sqlite3.dll" contains export function called "sqlite3_bind_parameter_name" at ordinal 18 "sqlite3.dll" contains export function called "sqlite3_bind_pointer" at ordinal 19 "sqlite3.dll" contains export function called "sqlite3_bind_text" at ordinal 20 "sqlite3.dll" contains export function called "sqlite3_bind_text64" at ordinal 21 "sqlite3.dll" contains export function called "sqlite3_bind_value" at ordinal 22 "sqlite3.dll" contains export function called "sqlite3_bind_zeroblob" at ordinal 23 "sqlite3.dll" contains export function called "sqlite3_bind_zeroblob64" at ordinal 24 "sqlite3.dll" contains export function called "sqlite3_blob_bytes" at ordinal 253e:T690,"Software\Microsoft\Windows\CurrentVersion\App Paths" in Source: ac18ad4de0d70e7cbbfb829afea0dd45.exe "DSystem\CurrentControlSet\Control\Session Manager" in Source: ac18ad4de0d70e7cbbfb829afea0dd45.exe "Software\Microsoft\Windows\CurrentVersion\RunOnce" in Source: ac18ad4de0d70e7cbbfb829afea0dd45.exe "System\CurrentControlSet\Control\Session Manager\FileRenameOperations" in Source: ac18ad4de0d70e7cbbfb829afea0dd45.exe "System\CurrentControlSet\Control\Session Manager" in Source: 2498-17-0040256D "ISTRY\USER\S-1-5-21-2092356043-4041700817-663127204-1001\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags" in Source: 00000000-00002632.00000000.65533.00320000.00000004.mdmp 00000000-00002632.00000001.67454.00320000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\App Paths" in Source: 00000000-00002632.00000000.65533.00F21000.00000020.mdmp "ISTRY\USER\S-1-5-21-2092356043-4041700817-663127204-1001\Software\Micros$" in Source: 00000000-00002632.00000002.67682.00320000.00000004.mdmp "Software\Policies\Microsoft\Internet Explorer\TabbedBrowsing" in Source: 00000000-00003416.00000000.65622.00660000.00000004.mdmp 00000000-00003416.00000001.66534.006B6000.00000004.mdmp "Software\Policies\Microsoft\Internet Explorer\Main" in Source: 00000000-00003416.00000000.65622.00660000.00000004.mdmp 00000000-00003416.00000001.66534.006B6000.00000004.mdmp "Software\AutoIt v3\AutoIt" in Source: 00000000-00003416.00000000.65622.00F5C000.00000002.mdmp "SOFTWARE\Classes\" in Source: 00000000-00003416.00000000.65622.00F5C000.00000002.mdmp "SYSTEM\CurrentControlSet\Control\Nls\Language" in Source: 00000000-00003416.00000000.65622.00F5C000.00000002.mdmp3f:T4b1,"\Sessions\1\BaseNamedObjects\UpdatingNewTabPageData" "Local\URLBLOCK_FILEMAPSWITCH_MUTEX_2968" "IsoScope_b98_IESQMMUTEX_0_303" "{5312EE61-79E3-4A24-BFE1-132B85B23C3A}" "IsoScope_b98_IESQMMUTEX_0_331" "Local\!BrowserEmulation!SharedMemory!Mutex" "Local\ZonesLockedCacheCounterMutex" "Local\URLBLOCK_DOWNLOAD_MUTEX" "UpdatingNewTabPageData" "IsoScope_b98_IE_EarlyTabStart_0xd44_Mutex" "IsoScope_b98_IE_EarlyTabStart_0x8c8_Mutex" "Local\URLBLOCK_HASHFILESWITCH_MUTEX" "{66D0969A-1E86-44CF-B4EC-3806DDDA3B5D}" "Local\VERMGMTBlockListFileMutex" "IsoScope_b98_IESQMMUTEX_0_519" "Local\ZonesCacheCounterMutex" "IsoScope_b98_ConnHashTable<2968>_HashTable_Mutex" "\Sessions\1\BaseNamedObjects\IsoScope_b98_IESQMMUTEX_0_519" "\Sessions\1\BaseNamedObjects\Local\!BrowserEmulation!SharedMemory!Mutex" "\Sessions\1\BaseNamedObjects\Local\VERMGMTBlockListFileMutex" "\Sessions\1\BaseNamedObjects\Local\URLBLOCK_FILEMAPSWITCH_MUTEX_2968" "\Sessions\1\BaseNamedObjects\Local\URLBLOCK_HASHFILESWITCH_MUTEX" "\Sessions\1\BaseNamedObjects\Local\URLBLOCK_DOWNLOAD_MUTEX" "\Sessions\1\BaseNamedObjects\Local\ZonesCacheCounterMutex" "\Sessions\1\BaseNamedObjects\Local\ZonesLockedCacheCounterMutex"40:T196a,"lP8PV47.exe" failed to load missing module "api-ms-win-core-fibers-l1-1-1" - [base:0; Status:c0000135] "lP8PV47.exe" failed to load missing module "api-ms-win-core-localization-l1-2-1" - [base:0; Status:c0000135] "1pH71tZ8.exe" failed to load missing module "api-ms-win-core-sysinfo-l1-2-1" - [base:0; Status:c0000135] "1pH71tZ8.exe" failed to load missing module "PROPSYS.dll" - [base:73be0000; Status:c0000034] "1pH71tZ8.exe" failed to load missing module "api-ms-win-appmodel-runtime-l1-1-1" - [base:0; Status:c0000135] "1pH71tZ8.exe" failed to load missing module "ext-ms-win-kernel32-package-current-l1-1-0" - [base:0; Status:c0000135] "4Uh436mr.exe" failed to load missing module "api-ms-win-core-localization-obsolete-l1-2-0" - [base:0; Status:c0000135] "4Uh436mr.exe" failed to load missing module "api-ms-win-core-datetime-l1-1-1" - [base:0; Status:c0000135] "4Uh436mr.exe" failed to load missing module "api-ms-win-appmodel-runtime-l1-1-2" - [base:0; Status:c0000135] "AppLaunch.exe" failed to load missing module "api-ms-win-appmodel-runtime-l1-1-2.dll" - [base:0; Status:c0000135] "AppLaunch.exe" failed to load missing module "api-ms-win-appmodel-runtime-l1-1-0.dll" - [base:0; Status:c0000135] "AppLaunch.exe" failed to load missing module "api-ms-win-core-fibers-l1-1-1" - [base:0; Status:c0000135] "AppLaunch.exe" failed to load missing module "api-ms-win-core-localization-l1-2-1" - [base:0; Status:c0000135] "AppLaunch.exe" failed to load missing module "api-ms-win-core-quirks-l1-1-0.dll" - [base:0; Status:c0000135] "AppLaunch.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoree.dll" - [base:0; Status:c0000135] "AppLaunch.exe" failed to load missing module "%WINDIR%\system32\combase.dll" - [base:0; Status:c0000135] "AppLaunch.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\ole32.dll" - [base:0; Status:c0000135] "AppLaunch.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll" - [base:0; Status:c0000135] "AppLaunch.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll" - [base:0; Status:c0000135] "AppLaunch.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll" - [base:0; Status:c0000135] "AppLaunch.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ws2_32.dll" - [base:0; Status:c0000135] "AppLaunch.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\sqlite3" - [base:0; Status:c0000135] "AppLaunch.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\rasapi32.dll" - [base:0; Status:c0000135] "AppLaunch.exe" failed to load missing module "kernel32" - [base:76960000; Status:c0000135] "AppLaunch.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\winhttp.dll" - [base:0; Status:c0000135] "AppLaunch.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\iphlpapi.dll" - [base:0; Status:c0000135] "AppLaunch.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\secur32.dll" - [base:0; Status:c0000135] "AppLaunch.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\crypt32.dll" - [base:0; Status:c0000135] "AppLaunch.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\CRYPT32.dll" - [base:0; Status:c0000135] "AppLaunch.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\PresentationCore\v4.0_4.0.0.0__31bf3856ad364e35\ucrtbase_clr0400.dll" - [base:0; Status:c0000135] "AppLaunch.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\PresentationCore\v4.0_4.0.0.0__31bf3856ad364e35\SHLWAPI.dll" - [base:0; Status:c0000135] "AppLaunch.exe" failed to load missing module "api-ms-win-core-datetime-l1-1-1" - [base:0; Status:c0000135] "AppLaunch.exe" failed to load missing module "api-ms-win-core-localization-obsolete-l1-2-0" - [base:0; Status:c0000135] "AppLaunch.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll" - [base:0; Status:c0000135] "AppLaunch.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\OLEAUT32.dll" - [base:0; Status:c0000135] "AppLaunch.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\setupapi.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "shell32.dll" - [base:755c0000; Status:c0000034] "powershell.exe" failed to load missing module "api-ms-win-core-fibers-l1-1-1" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "api-ms-win-core-localization-l1-2-1" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "api-ms-win-appmodel-runtime-l1-1-2.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "api-ms-win-appmodel-runtime-l1-1-0.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v2.0.50727\ole32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v2.0.50727\OLEAUT32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\assembly\GAC_MSIL\System\2.0.0.0__b77a5c561934e089\psapi.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\assembly\GAC_MSIL\System\2.0.0.0__b77a5c561934e089\ntdll.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\secur32.dll" - [base:0; Status:c0000135] "schtasks.exe" failed to load missing module "api-ms-win-core-fibers-l1-1-1" - [base:0; Status:c0000135] "schtasks.exe" failed to load missing module "api-ms-win-core-localization-l1-2-1" - [base:0; Status:c0000135] "cmd.exe" failed to load missing module "api-ms-win-core-fibers-l1-1-1" - [base:0; Status:c0000135] "cmd.exe" failed to load missing module "api-ms-win-core-localization-l1-2-1" - [base:0; Status:c0000135]41:Tb96,Found string "https://www.facebook.com/login" (Indicator: "facebook.com"; File: "ac18ad4de0d70e7cbbfb829afea0dd45.exe") Found string "https://twitter.com/i/flow/login" (Indicator: "twitter"; File: "ac18ad4de0d70e7cbbfb829afea0dd45.exe") file/memory contains long string with (Indicator: "paypal"; File: "332HFF5K.txt") file/memory contains long string with (Indicator: "paypal"; File: "615ETHM7.txt") file/memory contains long string with (Indicator: "paypal"; File: "U7VTJWMG.txt") file/memory contains long string with (Indicator: "paypal"; File: "VOMYGU3D.txt") file/memory contains long string with (Indicator: "paypal"; File: "SNAUKTZR.txt") file/memory contains long string with (Indicator: "paypal"; File: "SDY4YMU0.txt") file/memory contains long string with (Indicator: "paypal"; File: "UGK0QAVD.txt") file/memory contains long string with (Indicator: "paypal"; File: "9KJ3Z76X.txt") file/memory contains long string with (Indicator: "twitter"; File: "7XZE67A6.txt") file/memory contains long string with (Indicator: "linkedin.com"; File: "LVROXB4K.txt") file/memory contains long string with (Indicator: "paypal"; File: "6WV7X1AF.txt") file/memory contains long string with (Indicator: "twitter"; File: "BP4TEVY2.txt") file/memory contains long string with (Indicator: "linkedin.com"; File: "NXIRHQZW.txt") Found string "enforce_policyccpapaypal.com/1025337405145631150289123752275631076864cookie_checkpaypal.com/9217226055628831811722425096025631076864d_idc72bd7ec083b43d9ab236fc0583ef6dc1702937989417paypal.com/9217226055628831811722116808671031076865" (Indicator: "paypal"; File: "7989AFQS.txt") Found string "guest_id_marketingv1%3A170293801670803410twitter.com/1025137537536031223715378243046031076865guest_id_adsv1%3A170293801670803410twitter.com/1025137537536031223715378368046031076865" (Indicator: "twitter"; File: "F7PZTVCR.txt") Found string "li_rmAQHqATLTlKIV7wAAAYx_A_9BLgXRE_mq_Z7eYOdclcG0SDyM94a1CCbCOQr-tA0RUP2UW6VoYaailsU4XBUQ0zuDGbxeUbAlNfZp6TmbxxBCkdkLtk-iYgmAwww.linkedin.com/9217365405145631150289378930546031076865" (Indicator: "linkedin.com"; File: "IE61JY3G.txt") Found string "enforce_policyccpapaypal.com/1025337405145631150289123752275631076864cookie_checkpaypal.com/9217226055628831811722425096025631076864" (Indicator: "paypal"; File: "4LHOBBKR.txt") Found string "bcookie"v=2&149ada1b-9209-4645-8430-6ef74c12bc49"linkedin.com/1025365405145631150289380352421031076865" (Indicator: "linkedin.com"; File: "9ELCP68Z.txt") Found string "guest_id_marketingv1%3A170293801670803410twitter.com/1025137537536031223715378243046031076865" (Indicator: "twitter"; File: "T2PCFNWM.txt") Found string "enforce_policyccpapaypal.com/1025337405145631150289123752275631076864" (Indicator: "paypal"; File: "RBVUWGU9.txt") Found string "t.paypal.com" (Indicator: "paypal"; File: "PCAP") Found string "twitter.com" (Indicator: "twitter"; File: "PCAP") Found string "www.facebook.com" (Indicator: "facebook.com"; File: "PCAP")42:T30bd,"enforce_policyccpapaypal.com/1025337405145631150289123752275631076864cookie_checkpaypal.com/9217226055628831811722425096025631076864d_idc72bd7ec083b43d9ab236fc0583ef6dc1702937989417paypal.com/9217226055628831811722116808671031076865LANGen_US%3BUSpaypal.com/9217337514764831076937237002421031076865tsrceunifiedloginnodewebpaypal.com/9217347248076831077467357789921031076865l7_azdcg15.slcpaypal.com/9217216789107231076868362258671031076865vreXpYrS%3D1797546027%26vteXpYrS%3D1702939827%26vr%3D7f0390fa18c0aa38288b288dff0133c2%26vt%3D7f0390fa18c0aa38288b288dff0133c1%26vtyp%3Dnewpaypal.com/9217351166656031297140388821171031076865ts_cvr%3D7f0390fa18c0aa38288b288dff0133c2%26vt%3D7f0390fa18c0aa38288b288dff0133c1paypal.com/1025313166656031297140363633671031076865" (Indicator: "paypal.com") "enforce_policyccpapaypal.com/1025337405145631150289123752275631076864cookie_checkpaypal.com/9217226055628831811722425096025631076864d_idc72bd7ec083b43d9ab236fc0583ef6dc1702937989417paypal.com/9217226055628831811722116808671031076865LANGen_US%3BUSpaypal.com/9217337514764831076937237002421031076865tsrceunifiedloginnodewebpaypal.com/9217347248076831077467357789921031076865l7_azdcg15.slcpaypal.com/9217216789107231076868362258671031076865vreXpYrS%3D1797546028%26vteXpYrS%3D1702939828%26vr%3D7f0390fa18c0aa38288b288dff0133c2%26vt%3D7f0390fa18c0aa38288b288dff0133c1%26vtyp%3Dnewpaypal.com/9217352166656031297140389477421031076865ts_cvr%3D7f0390fa18c0aa38288b288dff0133c2%26vt%3D7f0390fa18c0aa38288b288dff0133c1paypal.com/1025351166656031297140388852421031076865" (Indicator: "paypal.com") "enforce_policyccpapaypal.com/1025337405145631150289123752275631076864cookie_checkpaypal.com/9217226055628831811722425096025631076864d_idc72bd7ec083b43d9ab236fc0583ef6dc1702937989417paypal.com/9217226055628831811722116808671031076865LANGen_US%3BUSpaypal.com/9217337514764831076937237002421031076865tsrceunifiedloginnodewebpaypal.com/9217347248076831077467357789921031076865l7_azdcg15.slcpaypal.com/9217216789107231076868362258671031076865vreXpYrS%3D1797632389%26vteXpYrS%3D1702939789%26vr%3D7f0390fa18c0aa38288b288dff0133c2%26vt%3D7f0390fa18c0aa38288b288dff0133c1%26vtyp%3Dnewpaypal.com/9217313166656031297140362555546031076865ts_cvr%3D7f0390fa18c0aa38288b288dff0133c2%26vt%3D7f0390fa18c0aa38288b288dff0133c1paypal.com/1025313166656031297140363633671031076865" (Indicator: "paypal.com") "enforce_policyccpapaypal.com/1025337405145631150289123752275631076864cookie_checkpaypal.com/9217226055628831811722425096025631076864d_idc72bd7ec083b43d9ab236fc0583ef6dc1702937989417paypal.com/9217226055628831811722116808671031076865LANGen_US%3BUSpaypal.com/9217337514764831076937237002421031076865tsrceunifiedloginnodewebpaypal.com/9217347248076831077467357789921031076865l7_azdcg15.slcpaypal.com/9217216789107231076868362258671031076865vreXpYrS%3D1797546027%26vteXpYrS%3D1702939827%26vr%3D7f0390fa18c0aa38288b288dff0133c2%26vt%3D7f0390fa18c0aa38288b288dff0133c1%26vtyp%3Dnewpaypal.com/9217351166656031297140388821171031076865ts_cvr%3D7f0390fa18c0aa38288b288dff0133c2%26vt%3D7f0390fa18c0aa38288b288dff0133c1paypal.com/1025351166656031297140388852421031076865" (Indicator: "paypal.com") "enforce_policyccpapaypal.com/1025337405145631150289123752275631076864cookie_checkpaypal.com/9217226055628831811722425096025631076864d_idc72bd7ec083b43d9ab236fc0583ef6dc1702937989417paypal.com/9217226055628831811722116808671031076865LANGen_US%3BUSpaypal.com/9217337514764831076937237002421031076865tsrceunifiedloginnodewebpaypal.com/9217347248076831077467357789921031076865l7_azdcg15.slcpaypal.com/9217216789107231076868362258671031076865vreXpYrS%3D1797546028%26vteXpYrS%3D1702939828%26vr%3D7f0390fa18c0aa38288b288dff0133c2%26vt%3D7f0390fa18c0aa38288b288dff0133c1%26vtyp%3Dnewpaypal.com/9217352166656031297140389477421031076865ts_cvr%3D7f0390fa18c0aa38288b288dff0133c2%26vt%3D7f0390fa18c0aa38288b288dff0133c1paypal.com/1025352166656031297140389586796031076865" (Indicator: "paypal.com") "enforce_policyccpapaypal.com/1025337405145631150289123752275631076864cookie_checkpaypal.com/9217226055628831811722425096025631076864d_idc72bd7ec083b43d9ab236fc0583ef6dc1702937989417paypal.com/9217226055628831811722116808671031076865LANGen_US%3BUSpaypal.com/9217337514764831076937237002421031076865tsrceunifiedloginnodewebpaypal.com/9217347248076831077467357789921031076865l7_azdcg15.slcpaypal.com/9217216789107231076868362258671031076865vreXpYrS%3D1797632389%26vteXpYrS%3D1702939789%26vr%3D7f0390fa18c0aa38288b288dff0133c2%26vt%3D7f0390fa18c0aa38288b288dff0133c1%26vtyp%3Dnewpaypal.com/9217313166656031297140362555546031076865" (Indicator: "paypal.com") "enforce_policyccpapaypal.com/1025337405145631150289123752275631076864cookie_checkpaypal.com/9217226055628831811722425096025631076864d_idc72bd7ec083b43d9ab236fc0583ef6dc1702937989417paypal.com/9217226055628831811722116808671031076865LANGen_US%3BUSpaypal.com/9217337514764831076937237002421031076865tsrceunifiedloginnodewebpaypal.com/9217347248076831077467357789921031076865l7_azdcg15.slcpaypal.com/9217216789107231076868362258671031076865" (Indicator: "paypal.com") "enforce_policyccpapaypal.com/1025337405145631150289123752275631076864cookie_checkpaypal.com/9217226055628831811722425096025631076864d_idc72bd7ec083b43d9ab236fc0583ef6dc1702937989417paypal.com/9217226055628831811722116808671031076865LANGen_US%3BUSpaypal.com/9217337514764831076937237002421031076865tsrceunifiedloginnodewebpaypal.com/9217347248076831077467357789921031076865" (Indicator: "paypal.com") "enforce_policyccpapaypal.com/1025337405145631150289123752275631076864cookie_checkpaypal.com/9217226055628831811722425096025631076864d_idc72bd7ec083b43d9ab236fc0583ef6dc1702937989417paypal.com/9217226055628831811722116808671031076865LANGen_US%3BUSpaypal.com/9217337514764831076937237002421031076865" (Indicator: "paypal.com") "enforce_policyccpapaypal.com/1025337405145631150289123752275631076864cookie_checkpaypal.com/9217226055628831811722425096025631076864d_idc72bd7ec083b43d9ab236fc0583ef6dc1702937989417paypal.com/9217226055628831811722116808671031076865" (Indicator: "paypal.com") "enforce_policyccpapaypal.com/1025337405145631150289123752275631076864cookie_checkpaypal.com/9217226055628831811722425096025631076864" (Indicator: "paypal.com") "enforce_policyccpapaypal.com/1025337405145631150289123752275631076864" (Indicator: "paypal.com") "GET /webcaptcha/ngrlCaptcha.min.js HTTP/1.1Accept: application/javascript, */*;q=0.8Referer: https://www.paypal.com/signinAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: www.paypalobjects.comDNT: 1Connection: Keep-Alive" (Indicator: "paypal.com") "GET /pa/js/min/pa.js HTTP/1.1Accept: application/javascript, */*;q=0.8Referer: https://www.paypal.com/signinAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: www.paypalobjects.comDNT: 1Connection: Keep-Alive" (Indicator: "paypal.com") "GET /images/shared/glyph_alert_critical_big-2x.png HTTP/1.1Accept: image/png, image/svg+xml, image/*;q=0.8, */*;q=0.5Referer: https://www.paypal.com/signinAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: www.paypalobjects.comDNT: 1Connection: Keep-Alive" (Indicator: "paypal.com") "GET /web/res/ec5/d423d5ca948be117596b4b08bd315/css/contextualLoginElementalUIv2.css HTTP/1.1Accept: text/css, */*Referer: https://www.paypal.com/signinAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: www.paypalobjects.comDNT: 1Connection: Keep-Alive" (Indicator: "paypal.com") "GET /web/res/ec5/d423d5ca948be117596b4b08bd315/js/lib/modernizr-2.6.1.js HTTP/1.1Accept: application/javascript, */*;q=0.8Referer: https://www.paypal.com/signinAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: www.paypalobjects.comDNT: 1Connection: Keep-Alive" (Indicator: "paypal.com") "GET /images/shared/icon-PN-check.png HTTP/1.1Accept: image/png, image/svg+xml, image/*;q=0.8, */*;q=0.5Referer: https://www.paypal.com/signinAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: www.paypalobjects.comDNT: 1Connection: Keep-Alive" (Indicator: "paypal.com") "HTTP/1.1 200 OKContent-Encoding: gzipAccept-Ranges: bytesAccess-Control-Allow-Headers: x-csrf-tokenAccess-Control-Allow-Methods: GETAccess-Control-Allow-Origin: *Cache-Control: max-age=31536000, s-maxage=31536000Content-Type: application/javascriptDate: Mon, 18 Dec 2023 22:20:09 GMTDC: ccg11-origin-www-1.paypal.comEtag: W/"657bddfe-edf"Expires: Tue, 17 Dec 2024 22:20:09 GMTLast-Modified: Fri, 15 Dec 2023 05:02:54 GMTPaypal-Debug-Id: de2f7a15f3dc9Server: ECAcc (sac/2571)Strict-Transport-Security: max-age=63072000; includeSubDomains; preloadTiming-Allow-Origin: https://www.paypal.com,https://www.sandbox.paypal.comTraceparent: 00-0000000000000000000de2f7a15f3dc9-105b3e89fb9ac202-01Vary: Accept-EncodingX-Cache: HITX-Content-Type-Options: nosniffContent-Length: 1788" (Indicator: "paypal.com") "HTTP/1.1 200 OKContent-Encoding: gzipAccept-Ranges: bytesCache-Control: s-maxage=31536000, public,max-age=3600Content-Type: application/javascriptDate: Mon, 18 Dec 2023 22:20:08 GMTDC: ccg11-origin-www-1.paypal.comEtag: "64ecc60d-5a30+gzip"Expires: Mon, 18 Dec 2023 23:20:08 GMTLast-Modified: Mon, 28 Aug 2023 16:06:37 GMTPaypal-Debug-Id: 801f8414451b5Server: ECAcc (sac/257C)Strict-Transport-Security: max-age=63072000; includeSubDomains; preloadTiming-Allow-Origin: https://www.paypal.com,https://www.sandbox.paypal.comTraceparent: 00-0000000000000000000801f8414451b5-cdb914aef784ee15-01Vary: Accept-EncodingX-Cache: HITX-Content-Type-Options: nosniffContent-Length: 6752" (Indicator: "paypal.com") "HTTP/1.1 200 OKContent-Encoding: gzipAccept-Ranges: bytesAccess-Control-Allow-Headers: x-csrf-tokenAccess-Control-Allow-Methods: GETAccess-Control-Allow-Origin: *Cache-Control: max-age=31536000, s-maxage=31536000Content-Type: text/cssDate: Mon, 18 Dec 2023 22:20:08 GMTDC: ccg11-origin-www-1.paypal.comEtag: W/"657bddfd-25c40"Expires: Tue, 17 Dec 2024 22:20:08 GMTLast-Modified: Fri, 15 Dec 2023 05:02:53 GMTPaypal-Debug-Id: dbb30d00ff4deServer: ECAcc (sac/256C)Strict-Transport-Security: max-age=63072000; includeSubDomains; preloadTiming-Allow-Origin: https://www.paypal.com,https://www.sandbox.paypal.comTraceparent: 00-0000000000000000000dbb30d00ff4de-ab82af08f7454088-01Vary: Accept-EncodingX-Cache: HITX-Content-Type-Options: nosniffContent-Length: 23917" (Indicator: "paypal.com") "HTTP/1.1 200 OKAccept-CH: DPR, Viewport-Width, Width, ECT, DownlinkAccept-Ranges: bytesCache-Control: s-maxage=31536000, public,max-age=3600Content-Type: image/pngDate: Mon, 18 Dec 2023 22:20:09 GMTDC: ccg11-origin-www-1.paypal.comEtag: "54130c54-16c4"Expires: Mon, 18 Dec 2023 23:20:09 GMTLast-Modified: Fri, 12 Sep 2014 15:08:04 GMTPaypal-Debug-Id: cd52faa5009f3Server: ECAcc (sac/250D)Strict-Transport-Security: max-age=63072000; includeSubDomains; preloadTiming-Allow-Origin: https://www.paypal.com,https://www.sandbox.paypal.comTraceparent: 00-0000000000000000000cd52faa5009f3-0754bfa7100a48fc-01X-Cache: HITX-Content-Type-Options: nosniffContent-Length: 5828" (Indicator: "paypal.com") "GET /web/res/ec5/d423d5ca948be117596b4b08bd315/js/signin-split.js HTTP/1.1Accept: application/javascript, */*;q=0.8Referer: https://www.paypal.com/signinAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: www.paypalobjects.comDNT: 1Connection: Keep-Alive" (Indicator: "paypal.com") "GET /webcaptcha/grcenterprise_v3_static.js HTTP/1.1Accept: application/javascript, */*;q=0.8Referer: https://www.paypal.com/signinAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: www.paypalobjects.comDNT: 1Connection: Keep-Alive" (Indicator: "paypal.com") "GET /web/res/ec5/d423d5ca948be117596b4b08bd315/js/lib/fn-sync-telemetry-min.js HTTP/1.1Accept: application/javascript, */*;q=0.8Referer: https://www.paypal.com/signinAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: www.paypalobjects.comDNT: 1Connection: Keep-Alive" (Indicator: "paypal.com")43:T3b6e,"GET /DigiCertGlobalRootG3.crt HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: cacerts.digicert.com" Response ==> HTTP/1.1 200 OK Accept-Ranges: bytes Age: 120623 cache-control: max-age=172800 public Content-Type: application/pkix-cert Date: Mon 18 Dec 2023 22:19:39 GMT Etag: "614b5ba7-243" expires: Wed 20 Dec 2023 22:19:39 GMT last-modified: Wed 22 Sep 2021 16:36:55 GMT Server: ECAcc (sac/253C) X-Cache: HIT Content-Length: 579 with response body ==>3082023F308201C5A0030201020210055556BCF25EA43535C3A40FD5AB4572300A06082A8648CE3D0403033061310B3009060355040613025553311530130603....... "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.digicert.com" Response ==> HTTP/1.1 200 OK Accept-Ranges: bytes Age: 403 Cache-Control: max-age=7200 Content-Type: application/ocsp-response Date: Mon 18 Dec 2023 22:19:44 GMT Last-Modified: Mon 18 Dec 2023 22:13:01 GMT Server: ECAcc (sac/2551) X-Cache: HIT Content-Length: 471 with response body ==>308201D30A0100A08201CC308201C806092B0601050507300101048201B9308201B530819EA216041403DE503556D14CBB66F0A3E21B1BC397B23DD155180F32....... "GET /DigiCertGlobalRootG3.crt HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: cacerts.digicert.com" Response ==> HTTP/1.1 200 OK Accept-Ranges: bytes Age: 120628 cache-control: max-age=172800 public Content-Type: application/pkix-cert Date: Mon 18 Dec 2023 22:19:44 GMT Etag: "614b5ba7-243" expires: Wed 20 Dec 2023 22:19:44 GMT last-modified: Wed 22 Sep 2021 16:36:55 GMT Server: ECAcc (sac/253C) X-Cache: HIT Content-Length: 579 with response body ==>3082023F308201C5A0030201020210055556BCF25EA43535C3A40FD5AB4572300A06082A8648CE3D0403033061310B3009060355040613025553311530130603....... "GET /gtsr1/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBQwkcLWD4LqGJ7bE7B1XZsEbmfwUAQU5K8rJnEaK0gnhS9SZizv8IkTcT4CDQIDvFNZazTHGPUBUGY%3D HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.pki.goog" Response ==> HTTP/1.1 200 OK Server: ocsp_responder Content-Length: 724 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Date: Mon 18 Dec 2023 21:40:49 GMT Cache-Control: public max-age=14400 Content-Type: application/ocsp-response Age: 2339 with response body ==>308202D00A0100A08202C9308202C506092B0601050507300101048202B6308202B230819BA2160414E4AF2B26711A2B4827852F52662CEFF08913713E180F32....... "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.digicert.com" Response ==> HTTP/1.1 200 OK Accept-Ranges: bytes Age: 408 Cache-Control: max-age=7200 Content-Type: application/ocsp-response Date: Mon 18 Dec 2023 22:19:49 GMT Last-Modified: Mon 18 Dec 2023 22:13:01 GMT Server: ECAcc (sac/2551) X-Cache: HIT Content-Length: 471 with response body ==>308201D30A0100A08201CC308201C806092B0601050507300101048201B9308201B530819EA216041403DE503556D14CBB66F0A3E21B1BC397B23DD155180F32....... "GET /DigiCertGlobalRootG3.crt HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: cacerts.digicert.com" Response ==> HTTP/1.1 200 OK Accept-Ranges: bytes Age: 120635 cache-control: max-age=172800 public Content-Type: application/pkix-cert Date: Mon 18 Dec 2023 22:19:51 GMT Etag: "614b5ba7-243" expires: Wed 20 Dec 2023 22:19:51 GMT last-modified: Wed 22 Sep 2021 16:36:55 GMT Server: ECAcc (sac/253C) X-Cache: HIT Content-Length: 579 with response body ==>3082023F308201C5A0030201020210055556BCF25EA43535C3A40FD5AB4572300A06082A8648CE3D0403033061310B3009060355040613025553311530130603....... "GET /gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.pki.goog" Response ==> HTTP/1.1 200 OK Server: ocsp_responder Content-Length: 1445 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Date: Mon 18 Dec 2023 21:41:50 GMT Cache-Control: public max-age=14400 Content-Type: application/ocsp-response Age: 2281 with response body ==>308205A10A0100A082059A3082059606092B0601050507300101048205873082058330819EA2160414D49BADF2AB3CB9FF1A3E0C506DCF192780868DAA180F32....... "GET /DigiCertGlobalRootG3.crt HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: cacerts.digicert.com" Response ==> HTTP/1.1 200 OK Accept-Ranges: bytes Age: 120637 cache-control: max-age=172800 public Content-Type: application/pkix-cert Date: Mon 18 Dec 2023 22:19:53 GMT Etag: "614b5ba7-243" expires: Wed 20 Dec 2023 22:19:53 GMT last-modified: Wed 22 Sep 2021 16:36:55 GMT Server: ECAcc (sac/253C) X-Cache: HIT Content-Length: 579 with response body ==>3082023F308201C5A0030201020210055556BCF25EA43535C3A40FD5AB4572300A06082A8648CE3D0403033061310B3009060355040613025553311530130603....... "GET /gts1c3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEBZwXm7t3kKEEFjsmHQeLcQ%3D HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.pki.goog" Response ==> HTTP/1.1 200 OK Server: ocsp_responder Content-Length: 471 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Date: Mon 18 Dec 2023 22:15:10 GMT Cache-Control: public max-age=14400 Content-Type: application/ocsp-response Age: 285 with response body ==>308201D30A0100A08201CC308201C806092B0601050507300101048201B9308201B530819EA21604148A747FAF85CDEE95CD3D9CD0E24614F371351D27180F32....... "GET /DigiCertGlobalRootG3.crt HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: cacerts.digicert.com" Response ==> HTTP/1.1 200 OK Accept-Ranges: bytes Age: 120639 cache-control: max-age=172800 public Content-Type: application/pkix-cert Date: Mon 18 Dec 2023 22:19:55 GMT Etag: "614b5ba7-243" expires: Wed 20 Dec 2023 22:19:55 GMT last-modified: Wed 22 Sep 2021 16:36:55 GMT Server: ECAcc (sac/253C) X-Cache: HIT Content-Length: 579 with response body ==>3082023F308201C5A0030201020210055556BCF25EA43535C3A40FD5AB4572300A06082A8648CE3D0403033061310B3009060355040613025553311530130603....... "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.digicert.com" Response ==> HTTP/1.1 200 OK Accept-Ranges: bytes Age: 414 Cache-Control: max-age=7200 Content-Type: application/ocsp-response Date: Mon 18 Dec 2023 22:19:55 GMT Last-Modified: Mon 18 Dec 2023 22:13:01 GMT Server: ECAcc (sac/2551) X-Cache: HIT Content-Length: 471 with response body ==>308201D30A0100A08201CC308201C806092B0601050507300101048201B9308201B530819EA216041403DE503556D14CBB66F0A3E21B1BC397B23DD155180F32....... "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEAx5qUSwjBGVIJJhX%2BJrHYM%3D HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.digicert.com" Response ==> HTTP/1.1 200 OK Accept-Ranges: bytes Age: 5136 Cache-Control: max-age=7200 Content-Type: application/ocsp-response Date: Mon 18 Dec 2023 22:19:55 GMT Last-Modified: Mon 18 Dec 2023 20:54:19 GMT Server: ECAcc (sac/2507) X-Cache: HIT Content-Length: 471 with response body ==>308201D30A0100A08201CC308201C806092B0601050507300101048201B9308201B530819EA2160414B13EC36903F8BF4701D498261A0802EF63642BC3180F32....... "GET /DigiCertGlobalRootG3.crt HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: cacerts.digicert.com" Response ==> HTTP/1.1 200 OK Accept-Ranges: bytes Age: 120641 cache-control: max-age=172800 public Content-Type: application/pkix-cert Date: Mon 18 Dec 2023 22:19:57 GMT Etag: "614b5ba7-243" expires: Wed 20 Dec 2023 22:19:57 GMT last-modified: Wed 22 Sep 2021 16:36:55 GMT Server: ECAcc (sac/253C) X-Cache: HIT Content-Length: 579 with response body ==>3082023F308201C5A0030201020210055556BCF25EA43535C3A40FD5AB4572300A06082A8648CE3D0403033061310B3009060355040613025553311530130603....... "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEATh56TcXPLzbcArQrhdFZ8%3D HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.digicert.com" Response ==> HTTP/1.1 200 OK Accept-Ranges: bytes Age: 4390 Cache-Control: max-age=7200 Content-Type: application/ocsp-response Date: Mon 18 Dec 2023 22:19:58 GMT Last-Modified: Mon 18 Dec 2023 21:06:48 GMT Server: ECAcc (sac/254A) X-Cache: HIT Content-Length: 471 with response body ==>308201D30A0100A08201CC308201C806092B0601050507300101048201B9308201B530819EA2160414B13EC36903F8BF4701D498261A0802EF63642BC3180F32....... "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.digicert.com" Response ==> HTTP/1.1 200 OK Accept-Ranges: bytes Age: 417 Cache-Control: max-age=7200 Content-Type: application/ocsp-response Date: Mon 18 Dec 2023 22:19:58 GMT Last-Modified: Mon 18 Dec 2023 22:13:01 GMT Server: ECAcc (sac/2551) X-Cache: HIT Content-Length: 471 with response body ==>308201D30A0100A08201CC308201C806092B0601050507300101048201B9308201B530819EA216041403DE503556D14CBB66F0A3E21B1BC397B23DD155180F32....... "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTPJvUY%2Bsl%2Bj4yzQuAcL2oQno5fCgQUUWj%2FkK8CB3U8zNllZGKiErhZcjsCEAdcWuWOzU%2B3YfWP%2Bc9lf9g%3D HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.digicert.com" Response ==> HTTP/1.1 200 OK Accept-Ranges: bytes Age: 937 Cache-Control: max-age=7200 Content-Type: application/ocsp-response Date: Mon 18 Dec 2023 22:19:59 GMT Last-Modified: Mon 18 Dec 2023 22:04:22 GMT Server: ECAcc (sac/251B) X-Cache: HIT Content-Length: 471 with response body ==>308201D30A0100A08201CC308201C806092B0601050507300101048201B9308201B530819EA21604145168FF90AF0207753CCCD9656462A212B859723B180F32....... "GET /gsr1/gsr1.crl HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: crl.pki.goog" Response ==> HTTP/1.1 200 OK Accept-Ranges: bytes Content-Security-Policy-Report-Only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/cacerts Cross-Origin-Resource-Policy: cross-origin Cross-Origin-Opener-Policy: same-origin; report-to="cacerts" Report-To: {"group":"cacerts" "max_age":2592000 "endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/cacerts"}]} Content-Length: 1739 X-Content-Type-Options: nosniff Server: sffe X-XSS-Protection: 0 Date: Mon 18 Dec 2023 21:43:20 GMT Expires: Mon 18 Dec 2023 22:33:20 GMT Cache-Control: public max-age=3000 Age: 2199 Last-Modified: Mon 09 Oct 2023 07:18:00 GMT Content-Type: application/pkix-crl Vary: Accept-Encoding with response body ==>308206C7308205AF020101300D06092A864886F70D01010B05003057310B300906035504061302424531193017060355040A1310476C6F62616C5369676E206E....... "GET /gtsr1/gtsr1.crl HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: crl.pki.goog" Response ==> HTTP/1.1 200 OK Accept-Ranges: bytes Content-Security-Policy-Report-Only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/cacerts Cross-Origin-Resource-Policy: cross-origin Cross-Origin-Opener-Policy: same-origin; report-to="cacerts" Report-To: {"group":"cacerts" "max_age":2592000 "endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/cacerts"}]} Content-Length: 854 X-Content-Type-Options: nosniff Server: sffe X-XSS-Protection: 0 Date: Mon 18 Dec 2023 22:09:30 GMT Expires: Mon 18 Dec 2023 22:59:30 GMT Cache-Control: public max-age=3000 Age: 629 Last-Modified: Mon 18 Sep 2023 16:18:00 GMT Content-Type: application/pkix-crl Vary: Accept-Encoding with response body ==>308203523082013A020101300D06092A864886F70D01010B05003047310B300906035504061302555331223020060355040A1319476F6F676C65205472757374....... "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.digicert.com" Response ==> HTTP/1.1 200 OK Accept-Ranges: bytes Age: 418 Cache-Control: max-age=7200 Content-Type: application/ocsp-response Date: Mon 18 Dec 2023 22:19:59 GMT Last-Modified: Mon 18 Dec 2023 22:13:01 GMT Server: ECAcc (sac/2551) X-Cache: HIT Content-Length: 471 with response body ==>308201D30A0100A08201CC308201C806092B0601050507300101048201B9308201B530819EA216041403DE503556D14CBB66F0A3E21B1BC397B23DD155180F32....... "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.digicert.com" Response ==> HTTP/1.1 200 OK Accept-Ranges: bytes Age: 419 Cache-Control: max-age=7200 Content-Type: application/ocsp-response Date: Mon 18 Dec 2023 22:20:00 GMT Last-Modified: Mon 18 Dec 2023 22:13:01 GMT Server: ECAcc (sac/2551) X-Cache: HIT Content-Length: 471 with response body ==>308201D30A0100A08201CC308201C806092B0601050507300101048201B9308201B530819EA216041403DE503556D14CBB66F0A3E21B1BC397B23DD155180F32....... "GET /gts1c3/moVDfISia2k.crl HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: crls.pki.goog" Response ==> HTTP/1.1 200 OK Accept-Ranges: bytes Content-Security-Policy-Report-Only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/cacerts Cross-Origin-Resource-Policy: cross-origin Cross-Origin-Opener-Policy: same-origin; report-to="cacerts" Report-To: {"group":"cacerts" "max_age":2592000 "endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/cacerts"}]} Content-Length: 17698 X-Content-Type-Options: nosniff Server: sffe X-XSS-Protection: 0 Date: Mon 18 Dec 2023 21:39:56 GMT Expires: Mon 18 Dec 2023 22:29:56 GMT Cache-Control: public max-age=3000 Last-Modified: Mon 18 Dec 2023 21:21:42 GMT Content-Type: application/pkix-crl Vary: Accept-Encoding Age: 2405 with response body ==>3082451E30824406020101300D06092A864886F70D01010B05003046310B300906035504061302555331223020060355040A1319476F6F676C65205472757374....... "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.digicert.com" Response ==> HTTP/1.1 200 OK Accept-Ranges: bytes Age: 421 Cache-Control: max-age=7200 Content-Type: application/ocsp-response Date: Mon 18 Dec 2023 22:20:02 GMT Last-Modified: Mon 18 Dec 2023 22:13:01 GMT Server: ECAcc (sac/2551) X-Cache: HIT Content-Length: 471 with response body ==>308201D30A0100A08201CC308201C806092B0601050507300101048201B9308201B530819EA216041403DE503556D14CBB66F0A3E21B1BC397B23DD155180F32.......44:T599a,"ac18ad4de0d70e7cbbfb829afea0dd45.exe" loaded module "%WINDIR%\SYSTEM32\ADVPACK.DLL" at base 69030000 "ac18ad4de0d70e7cbbfb829afea0dd45.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 74da0000 "lP8PV47.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 73460000 "lP8PV47.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 0 "lP8PV47.exe" loaded module "KERNEL32" at base 76960000 "lP8PV47.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 0 "lP8PV47.exe" loaded module "%WINDIR%\SYSTEM32\ADVPACK.DLL" at base 68f90000 "lP8PV47.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 74da0000 "1pH71tZ8.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 73ba0000 "1pH71tZ8.exe" loaded module "KERNEL32.DLL" at base 76960000 "1pH71tZ8.exe" loaded module "API-MS-WIN-CORE-SYSINFO-L1-2-1" at base 0 "1pH71tZ8.exe" loaded module "DWMAPI.DLL" at base 73770000 "1pH71tZ8.exe" loaded module "COMCTL32.DLL" at base 73d50000 "1pH71tZ8.exe" loaded module "UXTHEME.DLL" at base 73ba0000 "1pH71tZ8.exe" loaded module "IMM32.DLL" at base 76690000 "1pH71tZ8.exe" loaded module "COMCTL32" at base 73d50000 "1pH71tZ8.exe" loaded module "SHELL32.DLL" at base 755c0000 "1pH71tZ8.exe" loaded module "OLE32.DLL" at base 76d40000 "1pH71tZ8.exe" loaded module "ADVAPI32.DLL" at base 76a40000 "1pH71tZ8.exe" loaded module "PROPSYS.DLL" at base 73be0000 "1pH71tZ8.exe" loaded module "APPHELP.DLL" at base 74da0000 "1pH71tZ8.exe" loaded module "CLBCATQ.DLL" at base 771b0000 "1pH71tZ8.exe" loaded module "URLMON.DLL" at base 76ea0000 "1pH71tZ8.exe" loaded module "OLEAUT32.DLL" at base 75270000 "1pH71tZ8.exe" loaded module "%WINDIR%\SYSTEM32\IEFRAME.DLL" at base 6bdd0000 "1pH71tZ8.exe" loaded module "API-MS-WIN-DOWNLEVEL-OLE32-L1-1-0.DLL" at base 74f30000 "1pH71tZ8.exe" loaded module "IERTUTIL.DLL" at base 76450000 "1pH71tZ8.exe" loaded module "API-MS-WIN-DOWNLEVEL-SHLWAPI-L2-1-0.DLL" at base 69010000 "1pH71tZ8.exe" loaded module "%WINDIR%\SYSTEM32\PROPSYS.DLL" at base 73be0000 "1pH71tZ8.exe" loaded module "SETUPAPI.DLL" at base 76ba0000 "1pH71tZ8.exe" loaded module "RPCRT4.DLL" at base 75310000 "1pH71tZ8.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 74da0000 "1pH71tZ8.exe" loaded module "%PROGRAMFILES%\INTERNET EXPLORER\IEPROXY.DLL" at base 6d0d0000 "1pH71tZ8.exe" loaded module "%WINDIR%\SYSTEM32\SHELL32.DLL" at base 755c0000 "1pH71tZ8.exe" loaded module "USER32.DLL" at base 762e0000 "1pH71tZ8.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-1" at base 0 "1pH71tZ8.exe" loaded module "EXT-MS-WIN-KERNEL32-PACKAGE-CURRENT-L1-1-0" at base 0 "4Uh436mr.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-OBSOLETE-L1-2-0" at base 0 "4Uh436mr.exe" loaded module "API-MS-WIN-CORE-STRING-L1-1-0" at base 74f40000 "4Uh436mr.exe" loaded module "API-MS-WIN-CORE-DATETIME-L1-1-1" at base 0 "4Uh436mr.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 74da0000 "4Uh436mr.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-2" at base 0 "AppLaunch.exe" loaded module "SHLWAPI.DLL" at base 754a0000 "AppLaunch.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-2.DLL" at base 0 "AppLaunch.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-0.DLL" at base 0 "AppLaunch.exe" loaded module "VERSION.DLL" at base 74470000 "AppLaunch.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 73460000 "AppLaunch.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 0 "AppLaunch.exe" loaded module "KERNEL32" at base 76960000 "AppLaunch.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 0 "AppLaunch.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 6ccd0000 "AppLaunch.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\CLR.DLL" at base 668a0000 "AppLaunch.exe" loaded module "USER32.DLL" at base 762e0000 "AppLaunch.exe" loaded module "API-MS-WIN-CORE-QUIRKS-L1-1-0.DLL" at base 0 "AppLaunch.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\MSCOREE.DLL" at base 0 "AppLaunch.exe" loaded module "MSCOREE.DLL" at base 68f70000 "AppLaunch.exe" loaded module "%WINDIR%\SYSTEM32\COMBASE.DLL" at base 0 "AppLaunch.exe" loaded module "PSAPI.DLL" at base 771a0000 "AppLaunch.exe" loaded module "KERNEL32.DLL" at base 76960000 "AppLaunch.exe" loaded module "RPCRT4.DLL" at base 75310000 "AppLaunch.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\MSCORLIB\36EACCFDE177C2E7B93B8DBDDE4E012A\MSCORLIB.NI.DLL" at base 653b0000 "AppLaunch.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\OLE32.DLL" at base 0 "AppLaunch.exe" loaded module "OLE32.DLL" at base 76d40000 "AppLaunch.exe" loaded module "CRYPTBASE.DLL" at base 74df0000 "AppLaunch.exe" loaded module "API-MS-WIN-CORE-XSTATE-L2-1-0.DLL" at base 6cd20000 "AppLaunch.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\CLRJIT.DLL" at base 652f0000 "AppLaunch.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM\2C3C912EA8F058F9D04C4650128FEB3F\SYSTEM.NI.DLL" at base 64890000 "AppLaunch.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.CORE\31FAE3290FAD30C31C98651462D22724\SYSTEM.CORE.NI.DLL" at base 64070000 "AppLaunch.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\MICROSOFT.CSHARP\F73F48AFB5512225DEDAEE9C88AC5050\MICROSOFT.CSHARP.NI.DLL" at base 63ed0000 "AppLaunch.exe" loaded module "ADVAPI32.DLL" at base 76a40000 "AppLaunch.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\NLSSORTING.DLL" at base 63c60000 "AppLaunch.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.CONFIGURATION\96F7EDB07B12303F0EC2595C7F3778C7\SYSTEM.CONFIGURATION.NI.DLL" at base 63b50000 "AppLaunch.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.XML\15AF16D373CF0528CB74FC73D365FDBF\SYSTEM.XML.NI.DLL" at base 62f70000 "AppLaunch.exe" loaded module "NTDLL.DLL" at base 76ff0000 "AppLaunch.exe" loaded module "SHELL32.DLL" at base 755c0000 "AppLaunch.exe" loaded module "API-MS-WIN-SECURITY-SDDL-L1-1-0.DLL" at base 77180000 "AppLaunch.exe" loaded module "PROFAPI.DLL" at base 74f00000 "AppLaunch.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_32\MSCORLIB\V4.0_4.0.0.0__B77A5C561934E089\BCRYPT.DLL" at base 0 "AppLaunch.exe" loaded module "BCRYPT.DLL" at base 74a10000 "AppLaunch.exe" loaded module "%WINDIR%\SYSTEM32\RSAENH.DLL" at base 74690000 "AppLaunch.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM\V4.0_4.0.0.0__B77A5C561934E089\PSAPI.DLL" at base 0 "AppLaunch.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 74da0000 "AppLaunch.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_32\MSCORLIB\V4.0_4.0.0.0__B77A5C561934E089\SHELL32.DLL" at base 0 "AppLaunch.exe" loaded module "CLBCATQ.DLL" at base 771b0000 "AppLaunch.exe" loaded module "%WINDIR%\SYSTEM32\SHELL32.DLL" at base 755c0000 "AppLaunch.exe" loaded module "API-MS-WIN-SECURITY-LSALOOKUP-L1-1-0.DLL" at base 77180000 "AppLaunch.exe" loaded module "CRYPTSP.DLL" at base 74900000 "AppLaunch.exe" loaded module "PROPSYS.DLL" at base 73be0000 "AppLaunch.exe" loaded module "COMCTL32.DLL" at base 73d50000 "AppLaunch.exe" loaded module "RPCRTREMOTE.DLL" at base 74e90000 "AppLaunch.exe" loaded module "OLEAUT32.DLL" at base 75270000 "AppLaunch.exe" loaded module "SETUPAPI.DLL" at base 76ba0000 "AppLaunch.exe" loaded module "%WINDIR%\SYSTEM32\PROPSYS.DLL" at base 73be0000 "AppLaunch.exe" loaded module "NTMARTA.DLL" at base 74410000 "AppLaunch.exe" loaded module "APPHELP.DLL" at base 74da0000 "AppLaunch.exe" loaded module "%WINDIR%\SYSTEM32\SHDOCVW.DLL" at base 6e780000 "AppLaunch.exe" loaded module "LINKINFO.DLL" at base 6e770000 "AppLaunch.exe" loaded module "NTSHRUI.DLL" at base 72860000 "AppLaunch.exe" loaded module "SRVCLI.DLL" at base 74af0000 "AppLaunch.exe" loaded module "CSCAPI.DLL" at base 6fcf0000 "AppLaunch.exe" loaded module "SLC.DLL" at base 72f20000 "AppLaunch.exe" loaded module "SSPICLI.DLL" at base 74d80000 "AppLaunch.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM\V4.0_4.0.0.0__B77A5C561934E089\WS2_32.DLL" at base 0 "AppLaunch.exe" loaded module "WS2_32.DLL" at base 75230000 "AppLaunch.exe" loaded module "%WINDIR%\SYSTEM32\MSWSOCK.DLL" at base 748c0000 "AppLaunch.exe" loaded module "%WINDIR%\SYSTEM32\WSHTCPIP.DLL" at base 74340000 "AppLaunch.exe" loaded module "%WINDIR%\SYSTEM32\WSHIP6.DLL" at base 748b0000 "AppLaunch.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\SQLITE3" at base 0 "AppLaunch.exe" loaded module "SQLITE3" at base 62cb0000 "AppLaunch.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM\V4.0_4.0.0.0__B77A5C561934E089\RASAPI32.DLL" at base 0 "AppLaunch.exe" loaded module "RASAPI32.DLL" at base 72210000 "AppLaunch.exe" loaded module "RTUTILS.DLL" at base 73300000 "AppLaunch.exe" loaded module "API-MS-WIN-SERVICE-MANAGEMENT-L1-1-0.DLL" at base 77180000 "AppLaunch.exe" loaded module "API-MS-WIN-SERVICE-WINSVC-L1-1-0.DLL" at base 77180000 "AppLaunch.exe" loaded module "RASMAN.DLL" at base 721f0000 "AppLaunch.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM\V4.0_4.0.0.0__B77A5C561934E089\WINHTTP.DLL" at base 0 "AppLaunch.exe" loaded module "WINHTTP.DLL" at base 706d0000 "AppLaunch.exe" loaded module "CREDSSP.DLL" at base 745c0000 "AppLaunch.exe" loaded module "IPHLPAPI.DLL" at base 74450000 "AppLaunch.exe" loaded module "DHCPCSVC6.DLL" at base 72de0000 "AppLaunch.exe" loaded module "DHCPCSVC.DLL" at base 74350000 "AppLaunch.exe" loaded module "NSI.DLL" at base 75560000 "AppLaunch.exe" loaded module "CFGMGR32.DLL" at base 75030000 "AppLaunch.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM\V4.0_4.0.0.0__B77A5C561934E089\IPHLPAPI.DLL" at base 0 "AppLaunch.exe" loaded module "DNSAPI.DLL" at base 74780000 "AppLaunch.exe" loaded module "RASADHLP.DLL" at base 71680000 "AppLaunch.exe" loaded module "%WINDIR%\SYSTEM32\FWPUCLNT.DLL" at base 72e00000 "AppLaunch.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM\V4.0_4.0.0.0__B77A5C561934E089\SECUR32.DLL" at base 0 "AppLaunch.exe" loaded module "SECUR32.DLL" at base 74c30000 "AppLaunch.exe" loaded module "%WINDIR%\SYSTEM32\SCHANNEL.DLL" at base 74700000 "AppLaunch.exe" loaded module "NCRYPT.DLL" at base 74a30000 "AppLaunch.exe" loaded module "%WINDIR%\SYSTEM32\BCRYPTPRIMITIVES.DLL" at base 745d0000 "AppLaunch.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM\V4.0_4.0.0.0__B77A5C561934E089\CRYPT32.DLL" at base 0 "AppLaunch.exe" loaded module "CRYPT32.DLL" at base 75100000 "AppLaunch.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\CRYPT32.DLL" at base 0 "AppLaunch.exe" loaded module "GPAPI.DLL" at base 744d0000 "AppLaunch.exe" loaded module "API-MS-WIN-SERVICE-MANAGEMENT-L2-1-0.DLL" at base 77180000 "AppLaunch.exe" loaded module "USERENV.DLL" at base 74fd0000 "AppLaunch.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.DYNAMIC\B7AD5353AE4F44DF28CE7EBC9A8A752A\SYSTEM.DYNAMIC.NI.DLL" at base 71cb0000 "AppLaunch.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.DATA\DF2DD09ED7C341842A104E1E668F184E\SYSTEM.DATA.NI.DLL" at base 62490000 "AppLaunch.exe" loaded module "VAULTCLI.DLL" at base 71ca0000 "AppLaunch.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_32\SYSTEM.DATA\V4.0_4.0.0.0__B77A5C561934E089\SYSTEM.DATA.DLL" at base 62130000 "AppLaunch.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.MANAGEMENT\E114780FD3EA5727401C06EA4F22EF35\SYSTEM.MANAGEMENT.NI.DLL" at base 62000000 "AppLaunch.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\WINDOWSBASE\1A4CC316FB6D09525321FC0BE44692D8\WINDOWSBASE.NI.DLL" at base 61be0000 "AppLaunch.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\PRESENTATIONCORE\468F4E17BE144CA12A73A4297EACC9CC\PRESENTATIONCORE.NI.DLL" at base 60fa0000 "AppLaunch.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\PRESENTATIO5AE0F00F#\252CC7B0FAE8CFE083BDC149957C0C54\PRESENTATIONFRAMEWORK.NI.DLL" at base 5fbb0000 "AppLaunch.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_32\PRESENTATIONCORE\V4.0_4.0.0.0__31BF3856AD364E35\UCRTBASE_CLR0400.DLL" at base 0 "AppLaunch.exe" loaded module "UCRTBASE_CLR0400.DLL" at base 667f0000 "AppLaunch.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_32\PRESENTATIONCORE\V4.0_4.0.0.0__31BF3856AD364E35\SHLWAPI.DLL" at base 0 "AppLaunch.exe" loaded module "DWRITE.DLL" at base 67360000 "AppLaunch.exe" loaded module "API-MS-WIN-CORE-STRING-L1-1-0" at base 74f40000 "AppLaunch.exe" loaded module "API-MS-WIN-CORE-DATETIME-L1-1-1" at base 0 "AppLaunch.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-OBSOLETE-L1-2-0" at base 0 "AppLaunch.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\WPF\WPFGFX_V0400.DLL" at base 5fa20000 "AppLaunch.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\WPF\PRESENTATIONNATIVE_V0400.DLL" at base 5f8c0000 "AppLaunch.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\\WMINET_UTILS.DLL" at base 6dd90000 "AppLaunch.exe" loaded module "API-MS-WIN-CORE-LOCALREGISTRY-L1-1-0.DLL" at base 76960000 "AppLaunch.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\WMIUTILS.DLL" at base 6e800000 "AppLaunch.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\WBEMPROX.DLL" at base 6fd00000 "AppLaunch.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\WBEMSVC.DLL" at base 6e870000 "AppLaunch.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\FASTPROX.DLL" at base 6fd30000 "AppLaunch.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_32\MSCORLIB\V4.0_4.0.0.0__B77A5C561934E089\OLEAUT32.DLL" at base 0 "AppLaunch.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\OLEAUT32.DLL" at base 0 "AppLaunch.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\SETUPAPI.DLL" at base 0 "AppLaunch.exe" loaded module "WINBRAND.DLL" at base 6dea0000 "powershell.exe" loaded module "CRYPTBASE.DLL" at base 74df0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 73ba0000 "powershell.exe" loaded module "CLBCATQ.DLL" at base 771b0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\SHELL32.DLL" at base 755c0000 "powershell.exe" loaded module "SHELL32.DLL" at base 755c0000 "powershell.exe" loaded module "USERENV.DLL" at base 74fd0000 "powershell.exe" loaded module "API-MS-WIN-SECURITY-SDDL-L1-1-0.DLL" at base 77180000 "powershell.exe" loaded module "COMCTL32.DLL" at base 73d50000 "powershell.exe" loaded module "ADVAPI32.DLL" at base 76a40000 "powershell.exe" loaded module "KERNEL32.DLL" at base 76960000 "powershell.exe" loaded module "OLEAUT32.DLL" at base 75270000 "powershell.exe" loaded module "OLE32.DLL" at base 76d40000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\PROPSYS.DLL" at base 73be0000 "powershell.exe" loaded module "NTMARTA.DLL" at base 74410000 "powershell.exe" loaded module "API-MS-WIN-CORE-LOCALREGISTRY-L1-1-0.DLL" at base 76960000 "powershell.exe" loaded module "SETUPAPI.DLL" at base 76ba0000 "powershell.exe" loaded module "RPCRT4.DLL" at base 75310000 "powershell.exe" loaded module "APPHELP.DLL" at base 74da0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\SHDOCVW.DLL" at base 6e780000 "powershell.exe" loaded module "PROPSYS.DLL" at base 73be0000 "powershell.exe" loaded module "LINKINFO.DLL" at base 6e770000 "powershell.exe" loaded module "PROFAPI.DLL" at base 74f00000 "powershell.exe" loaded module "USER32.DLL" at base 762e0000 "powershell.exe" loaded module "NTSHRUI.DLL" at base 72860000 "powershell.exe" loaded module "SRVCLI.DLL" at base 74af0000 "powershell.exe" loaded module "CSCAPI.DLL" at base 6fcf0000 "powershell.exe" loaded module "SLC.DLL" at base 72f20000 "powershell.exe" loaded module "SHLWAPI.DLL" at base 754a0000 "powershell.exe" loaded module "CRYPTSP.DLL" at base 74900000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\RSAENH.DLL" at base 74690000 "powershell.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 73460000 "powershell.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 0 "powershell.exe" loaded module "KERNEL32" at base 76960000 "powershell.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 0 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\MSCOREEI.DLL" at base 671c0000 "powershell.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-2.DLL" at base 0 "powershell.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-0.DLL" at base 0 "powershell.exe" loaded module "VERSION.DLL" at base 74470000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V2.0.50727\MSCORWKS.DLL" at base 627d0000 "powershell.exe" loaded module "MSCOREE.DLL" at base 68f70000 "powershell.exe" loaded module "NTDLL" at base 76ff0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\MSCOREE.DLL" at base 68f70000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\MSCORLIB\9F895C66454577EFF9C77442D0C84F71\MSCORLIB.NI.DLL" at base 61cd0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V2.0.50727\OLE32.DLL" at base 0 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V2.0.50727\OLEAUT32.DLL" at base 0 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\SYSTEM\AD92DAB7F418877D6A1E0358CE35658A\SYSTEM.NI.DLL" at base 61520000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\MICROSOFT.POWERSHEL#\8229F0505633D4BCEF019B9D4FAB9F18\MICROSOFT.POWERSHELL.CONSOLEHOST.NI.DLL" at base 61490000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\SYSTEM.MANAGEMENT.A#\84C47B5A5813A5F040AEE9715A0FF7C0\SYSTEM.MANAGEMENT.AUTOMATION.NI.DLL" at base 60920000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\GAC_MSIL\SYSTEM\2.0.0.0__B77A5C561934E089\PSAPI.DLL" at base 0 "powershell.exe" loaded module "PSAPI.DLL" at base 771a0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\GAC_MSIL\SYSTEM\2.0.0.0__B77A5C561934E089\NTDLL.DLL" at base 0 "powershell.exe" loaded module "NTDLL.DLL" at base 76ff0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\SYSTEM.CORE\BD9FF1A4363781A57E8F7392F230A203\SYSTEM.CORE.NI.DLL" at base 606e0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\MICROSOFT.POWERSHEL#\49CAE79AC18BAD142E1AB5A46A8AC306\MICROSOFT.POWERSHELL.COMMANDS.DIAGNOSTICS.NI.DLL" at base 60690000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\SYSTEM.CONFIGURATIO#\D6ACC39F6C1EA42D8B3150DB6184A969\SYSTEM.CONFIGURATION.INSTALL.NI.DLL" at base 6dd90000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\MICROSOFT.WSMAN.MAN#\7BF5729401CFF7EA7898124E9818ED20\MICROSOFT.WSMAN.MANAGEMENT.NI.DLL" at base 60600000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\SYSTEM.TRANSACTIONS\FEC007EA17AC8956CC5D6D4074DADA6A\SYSTEM.TRANSACTIONS.NI.DLL" at base 60560000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\GAC_32\SYSTEM.TRANSACTIONS\2.0.0.0__B77A5C561934E089\SYSTEM.TRANSACTIONS.DLL" at base 60510000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\MICROSOFT.POWERSHEL#\F1831CE4588265A3F72E0A581BA58F2A\MICROSOFT.POWERSHELL.COMMANDS.UTILITY.NI.DLL" at base 60370000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\MICROSOFT.POWERSHEL#\344E681515D07B93A4F1383F0D625E1E\MICROSOFT.POWERSHELL.COMMANDS.MANAGEMENT.NI.DLL" at base 602a0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\MICROSOFT.POWERSHEL#\573750F17B5B8316F04A10956FDD1D97\MICROSOFT.POWERSHELL.SECURITY.NI.DLL" at base 60270000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V2.0.50727\CULTURE.DLL" at base 71c60000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\SYSTEM.XML\77C1DC46EA139BF5E1EAA9B87EF03C7A\SYSTEM.XML.NI.DLL" at base 5fd30000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\SYSTEM.MANAGEMENT\00C2B464E52D4E82C04D61592A12A89D\SYSTEM.MANAGEMENT.NI.DLL" at base 5fc20000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\SYSTEM.DIRECTORYSER#\237ED1739105C1BEBE48D41905FDB3EE\SYSTEM.DIRECTORYSERVICES.NI.DLL" at base 5fb00000 "powershell.exe" loaded module "SHFOLDER.DLL" at base 71c60000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\GAC_32\MSCORLIB\2.0.0.0__B77A5C561934E089\SECUR32.DLL" at base 0 "powershell.exe" loaded module "SECUR32.DLL" at base 74c30000 "powershell.exe" loaded module "SSPICLI.DLL" at base 74d80000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\SYSTEM.DATA\511C39D1EFA06D262A6B2F47E2726C73\SYSTEM.DATA.NI.DLL" at base 5f4a0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\GAC_32\SYSTEM.DATA\2.0.0.0__B77A5C561934E089\SYSTEM.DATA.DLL" at base 5f1c0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V2.0.50727\MSCORJIT.DLL" at base 5f160000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V2.0.50727\DIASYMREADER.DLL" at base 5f0d0000 "powershell.exe" loaded module "GDI32.DLL" at base 75570000 "powershell.exe" loaded module "NETUTILS.DLL" at base 743a0000 "cmd.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 74da0000 "schtasks.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 73460000 "schtasks.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 0 "schtasks.exe" loaded module "KERNEL32" at base 76960000 "schtasks.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 0 "schtasks.exe" loaded module "VERSION.DLL" at base 74470000 "schtasks.exe" loaded module "KERNEL32.DLL" at base 76960000 "schtasks.exe" loaded module "CRYPTBASE.DLL" at base 74df0000 "schtasks.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 73ba0000 "schtasks.exe" loaded module "RPCRT4.DLL" at base 75310000 "schtasks.exe" loaded module "API-MS-WIN-SECURITY-LSALOOKUP-L1-1-0.DLL" at base 77180000 "schtasks.exe" loaded module "ADVAPI32.DLL" at base 76a40000 "schtasks.exe" loaded module "CLBCATQ.DLL" at base 771b0000 "schtasks.exe" loaded module "%WINDIR%\SYSTEM32\TASKSCHD.DLL" at base 72fd0000 "schtasks.exe" loaded module "SSPICLI.DLL" at base 74d80000 "schtasks.exe" loaded module "XMLLITE.DLL" at base 73680000 "cmd.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 73460000 "cmd.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 0 "cmd.exe" loaded module "KERNEL32" at base 76960000 "cmd.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 0 "cmd.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 6ccd0000 "schtasks.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 6ccd000045:Tadd,"ac18ad4de0d70e7cbbfb829afea0dd45.exe" was detected as "Microsoft Cabinet" and name: "sfx" "ac18ad4de0d70e7cbbfb829afea0dd45.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "ac18ad4de0d70e7cbbfb829afea0dd45.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "ac18ad4de0d70e7cbbfb829afea0dd45.exe" was detected as "Microsoft Cabinet File" and name: "Archive" "ac18ad4de0d70e7cbbfb829afea0dd45.exe" was detected as "Microsoft Linker" and name: "Linker" "4Uh436mr.exe" was detected as "Microsoft Cabinet" and name: "sfx" "4Uh436mr.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "4Uh436mr.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "4Uh436mr.exe" was detected as "Microsoft Cabinet File" and name: "Archive" "4Uh436mr.exe" was detected as "Microsoft Linker" and name: "Linker" "1pH71tZ8.exe" was detected as "Microsoft Cabinet" and name: "sfx" "1pH71tZ8.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "1pH71tZ8.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "1pH71tZ8.exe" was detected as "Microsoft Cabinet File" and name: "Archive" "1pH71tZ8.exe" was detected as "Microsoft Linker" and name: "Linker" "lP8PV47.exe" was detected as "Microsoft Cabinet" and name: "sfx" "lP8PV47.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "lP8PV47.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "lP8PV47.exe" was detected as "Microsoft Cabinet File" and name: "Archive" "lP8PV47.exe" was detected as "Microsoft Linker" and name: "Linker" "sqlite3.dll" was detected as "Microsoft Cabinet" and name: "sfx" "sqlite3.dll" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "sqlite3.dll" was detected as "Microsoft Visual C/C++" and name: "Compiler" "sqlite3.dll" was detected as "Microsoft Cabinet File" and name: "Archive" "sqlite3.dll" was detected as "Microsoft Linker" and name: "Linker" "FANBooster131.exe" was detected as "Microsoft Cabinet" and name: "sfx" "FANBooster131.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "FANBooster131.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "FANBooster131.exe" was detected as "Microsoft Cabinet File" and name: "Archive" "FANBooster131.exe" was detected as "Microsoft Linker" and name: "Linker" "6qY7ld8.exe" was detected as "Microsoft Cabinet" and name: "sfx" "6qY7ld8.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "6qY7ld8.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "6qY7ld8.exe" was detected as "Microsoft Cabinet File" and name: "Archive" "6qY7ld8.exe" was detected as "Microsoft Linker" and name: "Linker"46:Tc77,"1pH71tZ8.exe" touched "Computer" (Path: "HKCU\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\SHELLFOLDER") "1pH71tZ8.exe" touched "Network" (Path: "HKCU\CLSID\{208D2C60-3AEA-1069-A2D7-08002B30309D}\SHELLFOLDER") "1pH71tZ8.exe" touched "Property System Both Class Factory" (Path: "HKCU\CLSID\{76765B11-3F95-4AF2-AC9D-EA55D8994F1A}") "1pH71tZ8.exe" touched "Application Registration" (Path: "HKCU\CLSID\{591209C7-767B-42B2-9FBA-44EE4615F2C7}\TREATAS") "AppLaunch.exe" touched "Shortcut" (Path: "HKCU\CLSID\{00021401-0000-0000-C000-000000000046}\INPROCSERVER32") "AppLaunch.exe" touched "Memory Mapped Cache Mgr" (Path: "HKCU\CLSID\{1F486A52-3CB1-48FD-8F50-B8DC300D9F9D}") "AppLaunch.exe" touched "UsersFiles" (Path: "HKCU\CLSID\{59031A47-3F72-44A7-89C5-5595FE6B30EE}\SHELLFOLDER") "AppLaunch.exe" touched "delegate folder that appears in Users Files Folder" (Path: "HKCU\CLSID\{DFFACDC5-679F-4156-8947-C5C76BC0B67F}\SHELLFOLDER") "AppLaunch.exe" touched "Shell File System Folder" (Path: "HKCU\CLSID\{0E5AAE11-A475-4C5B-AB00-C66DE400274E}\INPROCSERVER32") "AppLaunch.exe" touched "WbemDefaultPathParser" (Path: "HKCU\CLSID\{CF4CC405-E2C5-4DDD-B3CE-5E7582D8C9FA}\INPROCSERVER32") "AppLaunch.exe" touched "WBEM Locator" (Path: "HKCU\CLSID\{4590F811-1D3A-11D0-891F-00AA004B2E24}\INPROCSERVER32") "AppLaunch.exe" touched "Windows Management and Instrumentation" (Path: "HKCU\CLSID\{8BC3F05E-D86B-11D0-A075-00C04FB68820}\TREATAS") "AppLaunch.exe" touched "PSFactoryBuffer" (Path: "HKCU\CLSID\{7C857801-7381-11CF-884D-00AA004B2E24}\TREATAS") "AppLaunch.exe" touched "Microsoft WBEM (non)Standard Marshaling for IWbemServices" (Path: "HKCU\CLSID\{D68AF00A-29CB-43FA-8504-CE99A996D9EA}\TREATAS") "AppLaunch.exe" touched "Microsoft WBEM (non)Standard Marshaling for IEnumWbemClassObject" (Path: "HKCU\CLSID\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\TREATAS") "AppLaunch.exe" touched "NDP SymBinder" (Path: "HKCU\CLSID\{0A29FF9E-7F9C-4437-8B11-F424491E3931}\INPROCSERVER32") "powershell.exe" touched "Custom Destination List" (Path: "HKCU\CLSID\{77F10CF0-3DB5-4966-B520-B7C54FD35ED6}") "powershell.exe" touched "Start Menu Cache" (Path: "HKLM\SOFTWARE\CLASSES\CLSID\{660B90C8-73A9-4B58-8CAE-355B7F55341B}") "powershell.exe" touched "Start Menu Pin" (Path: "HKCU\CLSID\{A2A9545D-A0C2-42B4-9708-A0B2BADD77C8}\TREATAS") "powershell.exe" touched "Taskband Pin" (Path: "HKCU\CLSID\{90AA3A4E-1CBA-4233-B8BB-535773D48449}\TREATAS") "powershell.exe" touched "Internet Shortcut" (Path: "HKCU\CLSID\{FBF23B40-E3F0-101B-8488-00AA003E56F8}\IMPLEMENTED CATEGORIES\{00021490-0000-0000-C000-000000000046}") "powershell.exe" touched "User Pinned" (Path: "HKCU\CLSID\{1F3427C8-5C10-4210-AA03-2EE45287D668}\SHELLFOLDER") "powershell.exe" touched "User Assist" (Path: "HKCU\CLSID\{DD313E04-FEFF-11D1-8ECD-0000F87A470C}\TREATAS") "powershell.exe" touched "Shared Task Scheduler" (Path: "HKCU\CLSID\{603D3801-BD81-11D0-A3A5-00C04FD706EC}\TREATAS") "powershell.exe" touched "A collection of IUnknown objects that can be enumerated" (Path: "HKCU\CLSID\{2D3468C1-36A7-43B6-AC24-D3F02FD9607A}\TREATAS") "schtasks.exe" touched "TaskScheduler class" (Path: "HKCU\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}")47:Tfa8,"ac18ad4de0d70e7cbbfb829afea0dd45.exe" file has an entrypoint instructions - "call 0x407155,jmp 0x406a6a,push 0x58,push 0x4072b8,call 0x407208,xor ebx, ebx,mov dword ptr [ebp - 0x20], ebx,lea eax, [ebp - 0x68],push eax,call dword ptr [0x40a184],mov dword ptr [ebp - 4], ebx,mov eax, dword ptr fs:[0x18],mov esi, dword ptr [eax + 4],mov edi, ebx,mov edx, 0x4088ac,mov ecx, esi,xor eax, eax,lock cmpxchg dword ptr [edx], ecx,test eax, eax,je 0x406abc,cmp eax, esi,jne 0x406aaf,xor esi, esi,inc esi,mov edi, esi,jmp 0x406abf,push 0x3e8,call dword ptr [0x40a188],jmp 0x406a93,xor esi, esi,inc esi," "4Uh436mr.exe" file has an entrypoint instructions - "call 0x405fd9,jmp 0x4056b6,push ebp,mov ebp, esp,mov eax, dword ptr [ebp + 8],push esi,mov ecx, dword ptr [eax + 0x3c],add ecx, eax,movzx eax, word ptr [ecx + 0x14],lea edx, [ecx + 0x18],add edx, eax,movzx eax, word ptr [ecx + 6],imul esi, eax, 0x28,add esi, edx,cmp edx, esi,je 0x405877,mov ecx, dword ptr [ebp + 0xc],cmp ecx, dword ptr [edx + 0xc],jb 0x405870,mov eax, dword ptr [edx + 8],add eax, dword ptr [edx + 0xc],cmp ecx, eax,jb 0x40587c,add edx, 0x28,cmp edx, esi,jne 0x405861,xor eax, eax,pop esi,pop ebp,ret ,mov eax, edx,jmp 0x405879,push esi,call 0x406335,test eax, eax,je 0x4058aa,mov eax, dword ptr fs:[0x18],mov esi, 0x42b3bc," "1pH71tZ8.exe" file has an entrypoint instructions - "call 0x420aea,jmp 0x4203fb,push ebp,mov ebp, esp,push esi,push dword ptr [ebp + 8],mov esi, ecx,call 0x4205e7,mov dword ptr [esi], 0x49fdf0,mov eax, esi,pop esi,pop ebp,ret 4,and dword ptr [ecx + 4], 0,mov eax, ecx,and dword ptr [ecx + 8], 0,mov dword ptr [ecx + 4], 0x49fdf8,mov dword ptr [ecx], 0x49fdf0,ret ,push ebp,mov ebp, esp,push esi,push dword ptr [ebp + 8],mov esi, ecx,call 0x4205e7,mov dword ptr [esi], 0x49fe0c,mov eax, esi,pop esi,pop ebp,ret 4,and dword ptr [ecx + 4], 0,mov eax, ecx,and dword ptr [ecx + 8], 0," "lP8PV47.exe" file has an entrypoint instructions - "call 0x407155,jmp 0x406a6a,push 0x58,push 0x4072b8,call 0x407208,xor ebx, ebx,mov dword ptr [ebp - 0x20], ebx,lea eax, [ebp - 0x68],push eax,call dword ptr [0x40a184],mov dword ptr [ebp - 4], ebx,mov eax, dword ptr fs:[0x18],mov esi, dword ptr [eax + 4],mov edi, ebx,mov edx, 0x4088ac,mov ecx, esi,xor eax, eax,lock cmpxchg dword ptr [edx], ecx,test eax, eax,je 0x406abc,cmp eax, esi,jne 0x406aaf,xor esi, esi,inc esi,mov edi, esi,jmp 0x406abf,push 0x3e8,call dword ptr [0x40a188],jmp 0x406a93,xor esi, esi,inc esi," "sqlite3.dll" file has an entrypoint instructions - "jmp 0x100a9752,jmp 0x10084dd0,jmp 0x10083310,jmp 0x100a7460,jmp 0x100a8840,jmp 0x10084c70,jmp 0x10082e10,jmp 0x10086cc0,jmp 0x10089a90,jmp 0x100824e0,jmp 0x100867c0,jmp 0x10086020,jmp 0x10084340,jmp 0x100a9f11,jmp 0x100aa3db,jmp 0x100a86ef,jmp 0x10088a80,jmp 0x10089260,jmp 0x10089c60,jmp 0x100a9d91," "FANBooster131.exe" file has an entrypoint instructions - "call 0x40ff23,jmp 0x40f992,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,cmp ecx, dword ptr [0x413014],bnd jne 0x40fb1b,bnd ret ,bnd jmp 0x40fb49,push ebp,mov ebp, esp,push 0,call dword ptr [0x415068],push dword ptr [ebp + 8],call dword ptr [0x415064],push 0xc0000409,call dword ptr [0x415014],push eax,call dword ptr [0x415008],pop ebp,ret ,push ebp,mov ebp, esp,sub esp, 0x324,push 0x17,call 0x410540,test eax, eax,je 0x40fb62,push 2,pop ecx,int 0x29," "6qY7ld8.exe" file has an entrypoint instructions - "call 0x4031a7,jne 0x4031af,je 0x4031af,jnp 0x403153,and dword ptr [ecx - 0x74fb3b7d], ecx,pop esp,and al, 0xfc,jmp 0x4031c2,add al, 0x81,jmp 0x403163,xor dword ptr [eax], eax,add bl, ch,add eax, 0x4f5eb20,and byte ptr [edi + eax + 0x75], dh,add eax, 0xb1d340c7,rol bh, 1,inc esp,and al, 0xfc,xor byte ptr [eax], al,add byte ptr [eax], al,sub esp, 4,jne 0x4031e2,je 0x4031e2,int3 ,dec esi,xchg eax, esi,add eax, dword ptr [ebx + 0x548b04c4],and al, 0xfc,jmp 0x4031f1,add al, 0x29,shr bl, 5,add ch, bl,stc ,add al, 2,jmp 0x4031fc,or byte ptr [edx], cl,loop 0x403246,mov byte ptr [ebx + eax + 2], ah,je 0x403206,jne 0x403206,mov cl, 0xb5,dec edi,"48:T542,Observed system executable string:"/C:\ PROGRA~2 MICROS~1 WindowsSTARTM~1ProgramsACCESS~1WINDOW~1WINDOW~1.LNKC:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk1SPS1SPShapubws-pc/C:\ PROGRA~2 MICROS~1 WindowsSTARTM~1ProgramsACCESS~1WINDOW~1WINDOW~1.LNKC:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk1SPS1SPShapubws-pc/C:\WindowsSystem32WINDOW~1v1.0powershell_ise.exeC:\Windows\System32\WindowsPowerShell\v1.0\powershell_ise.exe%systemroot%\system32\windowspowershell\v1.0\powershell_ise.exe1SPS1SPShapubws-pc/C:\Windowshh.exeC:\Windows\hh.exe%systemroot%\hh.exe1SPS1SPShapubws-pc" [Source: 9WT54HPEBC1KUL8P5SVY.temp] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe" [Source: 00000000-00002108-00000C37-155124344637] Observed system executable string:"%WINDIR%\system32\windowspowershell\v1.0\powershell_ise.exe" [Source: 00000000-00001788-00000C28-17952419436] Observed system executable string:"%WINDIR%\system32\schtasks.exe" [Source: 00000000-00003892-00000C25-145432915]49:T457,Process "lP8PV47.exe" (UID: 00000000-00003784) was launched with new environment variables: "__COMPAT_LAYER="ElevateCreateProcess WRPMitigationLayer"" Process "iexplore.exe" (UID: 00000000-00002968) was launched with modified environment variables: "Path" Process "4Uh436mr.exe" (UID: 00000000-00003628) was launched with modified environment variables: "Path" Process "iexplore.exe" (UID: 00000000-00002472) was launched with modified environment variables: "Path" Process "AppLaunch.exe" (UID: 00000000-00002108) was launched with modified environment variables: "Path" Process "iexplore.exe" (UID: 00000000-00002744) was launched with modified environment variables: "Path" Process "powershell.exe" (UID: 00000000-00001788) was launched with modified environment variables: "Path" Process "schtasks.exe" (UID: 00000000-00003892) was launched with new environment variables: "PROMPT="$P$G"" Process "cmd.exe" (UID: 00000000-00001928) was launched with missing environment variables: "PROMPT" Process "schtasks.exe" (UID: 00000000-00003776) was launched with new environment variables: "PROMPT="$P$G""4a:T8c1,"ac18ad4de0d70e7cbbfb829afea0dd45.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "ac18ad4de0d70e7cbbfb829afea0dd45.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "lP8PV47.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "lP8PV47.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "1pH71tZ8.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "1pH71tZ8.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "1pH71tZ8.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LOCALE"; Key: "00000409") "4Uh436mr.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "4Uh436mr.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "AppLaunch.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "AppLaunch.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "AppLaunch.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LOCALE"; Key: "00000409") "AppLaunch.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "AR") "AppLaunch.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "AR") "AppLaunch.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "AR-SA") "AppLaunch.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "AR-SA") "AppLaunch.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "BG") "AppLaunch.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "BG") "AppLaunch.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "BG-BG") "AppLaunch.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "BG-BG") "AppLaunch.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "CA") "AppLaunch.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "CA") "AppLaunch.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "CA-ES") "AppLaunch.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "CA-ES")4b:T592,Found string "" (Indicator: "text/javascript"; File: "G4VW0JM3.htm") Found string "" (Indicator: "text/javascript"; File: "G4VW0JM3.htm") Found string "" (Indicator: "text/javascript"; File: "G4VW0JM3.htm") Found string "" (Indicator: "text/javascript"; File: "G4VW0JM3.htm") Found string "adsScriptTag.type = 'text/javascript';" (Indicator: "text/javascript"; File: "signin-split_1_.js")4c:Tf15,Observed system executable string:"C:\Windows\system32\apphelp.dll" [Source: 00003784.00000EC8.816003.00050000.wprm] Observed system executable string:"%WINDIR%\system32\advpack.dll" [Source: 00000000-00002632-00000C25-24777608] Observed system executable string:"rundll32.exe %WINDIR%\system32\advpack.dll,DelNodeRunDLL32 "%TEMP%\IXP000.TMP\"" [Source: 00000000-00002632-00000BC1-24799997] Observed system executable string:"rundll32.exe %WINDIR%\system32\advpack.dll,DelNodeRunDLL32 "%TEMP%\IXP001.TMP\"" [Source: 00000000-00003784-00000BC1-25471105] Observed system executable string:"%WINDIR%\system32\uxtheme.dll" [Source: 00000000-00003416-00000C25-25811569] Observed system executable string:"%WINDIR%\System32\ieframe.dll" [Source: 00000000-00003416-00000C25-27481908] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0\clr.dll" [Source: 00000000-00002108-00000C25-51380902] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\clr.dll" [Source: 00000000-00002108-00000C25-51458168] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoree.dll" [Source: 00000000-00002108-00000C25-55047467] Observed system executable string:"%WINDIR%\system32\combase.dll" [Source: 00000000-00002108-00000C25-56193090] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\mscorlib\36eaccfde177c2e7b93b8dbdde4e012a\mscorlib.ni.dll" [Source: 00000000-00002108-00000C25-58900608] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\ole32.dll" [Source: 00000000-00002108-00000C25-63573901] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\clrjit.dll" [Source: 00000000-00002108-00000C25-66653236] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System\2c3c912ea8f058f9d04c4650128feb3f\System.ni.dll" [Source: 00000000-00002108-00000C25-73297217] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Core\31fae3290fad30c31c98651462d22724\System.Core.ni.dll" [Source: 00000000-00002108-00000C25-73745316] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\Microsoft.CSharp\f73f48afb5512225dedaee9c88ac5050\Microsoft.CSharp.ni.dll" [Source: 00000000-00002108-00000C25-75029225] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\nlssorting.dll" [Source: 00000000-00002108-00000C25-86513651] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Configuration\96f7edb07b12303f0ec2595c7f3778c7\System.Configuration.ni.dll" [Source: 00000000-00002108-00000C25-94969439] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Xml\15af16d373cf0528cb74fc73d365fdbf\System.Xml.ni.dll" [Source: 00000000-00002108-00000C25-96835155] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll" [Source: 00000000-00002108-00000C25-99766586] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll" [Source: 00000000-00002108-00000C25-102816076] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll" [Source: 00000000-00002108-00000C25-135058864] Observed system executable string:"%WINDIR%\System32\shdocvw.dll" [Source: 00000000-00002108-00000C25-140856621] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ws2_32.dll" [Source: 00000000-00002108-00000C25-153025865] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\rasapi32.dll" [Source: 00000000-00002108-00000C25-157965134]4d:T912,Spawned process "lP8PV47.exe" (UID: 00000000-00003784) Spawned process "1pH71tZ8.exe" (UID: 00000000-00003416) Spawned process "iexplore.exe" with commandline "https://accounts.google.com/" (UID: 00000000-00002968) Spawned process "iexplore.exe" with commandline "https://www.facebook.com/login" (UID: 00000000-00002972) Spawned process "iexplore.exe" with commandline "https://store.steampowered.com/login" (UID: 00000000-00003480) Spawned process "iexplore.exe" with commandline "SCODEF:2968 CREDAT:340993 /prefetch:2" (UID: 00000000-00002932) Spawned process "iexplore.exe" with commandline "https://twitter.com/i/flow/login" (UID: 00000000-00003324) Spawned process "iexplore.exe" with commandline "SCODEF:2972 CREDAT:275457 /prefetch:2" (UID: 00000000-00001904) Spawned process "iexplore.exe" with commandline "https://steamcommunity.com/openid/loginform" (UID: 00000000-00003060) Spawned process "iexplore.exe" with commandline "SCODEF:3480 CREDAT:275457 /prefetch:2" (UID: 00000000-00003308) Spawned process "iexplore.exe" with commandline "SCODEF:2968 CREDAT:472070 /prefetch:2" (UID: 00000000-00003968) Spawned process "iexplore.exe" with commandline "SCODEF:3324 CREDAT:275457 /prefetch:2" (UID: 00000000-00003188) Spawned process "4Uh436mr.exe" (UID: 00000000-00003628) Spawned process "iexplore.exe" with commandline "SCODEF:3060 CREDAT:275457 /prefetch:2" (UID: 00000000-00002472) Spawned process "AppLaunch.exe" (UID: 00000000-00002108) Spawned process "6qY7ld8.exe" (UID: 00000000-00000284) Spawned process "iexplore.exe" with commandline "SCODEF:2972 CREDAT:5321730 /prefetch:2" (UID: 00000000-00002744) Spawned process "powershell.exe" with commandline ""powershell" Get-MpPreference -verbose" (UID: 00000000-00001788) Spawned process "cmd.exe" with commandline "/c schtasks /create /f /RU "%OSUSER%" /tr "%ALLUSERSPROFILE%\\Of ..." (UID: 00000000-00003100), Spawned process "schtasks.exe" with commandline "schtasks /create /f /RU "%OSUSER%" /tr "%ALLUSERSPROFILE%\\Offi ..." (UID: 00000000-00003892) Spawned process "cmd.exe" with commandline "/c schtasks /create /f /RU "%OSUSER%" /tr "%ALLUSERSPROFILE%\\Of ..." (UID: 00000000-00001928), Spawned process "schtasks.exe" with commandline "schtasks /create /f /RU "%OSUSER%" /tr "%ALLUSERSPROFILE%\\Offi ..." (UID: 00000000-00003776)4e:T912,Spawned process "lP8PV47.exe" (UID: 00000000-00003784) Spawned process "1pH71tZ8.exe" (UID: 00000000-00003416) Spawned process "iexplore.exe" with commandline "https://accounts.google.com/" (UID: 00000000-00002968) Spawned process "iexplore.exe" with commandline "https://www.facebook.com/login" (UID: 00000000-00002972) Spawned process "iexplore.exe" with commandline "https://store.steampowered.com/login" (UID: 00000000-00003480) Spawned process "iexplore.exe" with commandline "SCODEF:2968 CREDAT:340993 /prefetch:2" (UID: 00000000-00002932) Spawned process "iexplore.exe" with commandline "https://twitter.com/i/flow/login" (UID: 00000000-00003324) Spawned process "iexplore.exe" with commandline "SCODEF:2972 CREDAT:275457 /prefetch:2" (UID: 00000000-00001904) Spawned process "iexplore.exe" with commandline "https://steamcommunity.com/openid/loginform" (UID: 00000000-00003060) Spawned process "iexplore.exe" with commandline "SCODEF:3480 CREDAT:275457 /prefetch:2" (UID: 00000000-00003308) Spawned process "iexplore.exe" with commandline "SCODEF:2968 CREDAT:472070 /prefetch:2" (UID: 00000000-00003968) Spawned process "iexplore.exe" with commandline "SCODEF:3324 CREDAT:275457 /prefetch:2" (UID: 00000000-00003188) Spawned process "4Uh436mr.exe" (UID: 00000000-00003628) Spawned process "iexplore.exe" with commandline "SCODEF:3060 CREDAT:275457 /prefetch:2" (UID: 00000000-00002472) Spawned process "AppLaunch.exe" (UID: 00000000-00002108) Spawned process "6qY7ld8.exe" (UID: 00000000-00000284) Spawned process "iexplore.exe" with commandline "SCODEF:2972 CREDAT:5321730 /prefetch:2" (UID: 00000000-00002744) Spawned process "powershell.exe" with commandline ""powershell" Get-MpPreference -verbose" (UID: 00000000-00001788) Spawned process "cmd.exe" with commandline "/c schtasks /create /f /RU "%OSUSER%" /tr "%ALLUSERSPROFILE%\\Of ..." (UID: 00000000-00003100), Spawned process "schtasks.exe" with commandline "schtasks /create /f /RU "%OSUSER%" /tr "%ALLUSERSPROFILE%\\Offi ..." (UID: 00000000-00003892) Spawned process "cmd.exe" with commandline "/c schtasks /create /f /RU "%OSUSER%" /tr "%ALLUSERSPROFILE%\\Of ..." (UID: 00000000-00001928), Spawned process "schtasks.exe" with commandline "schtasks /create /f /RU "%OSUSER%" /tr "%ALLUSERSPROFILE%\\Offi ..." (UID: 00000000-00003776)4f:T43d,Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; File: "ac18ad4de0d70e7cbbfb829afea0dd45.exe") Found reference to API "LoadLibraryExA" (Indicator: "LoadLibrary"; File: "ac18ad4de0d70e7cbbfb829afea0dd45.exe") Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; Source: "00000000-00002632.00000002.67682.00F2A000.00000002.mdmp") Found reference to API "LoadLibraryExA" (Indicator: "LoadLibrary"; Source: "00000000-00002632.00000002.67682.00F2A000.00000002.mdmp") Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; Source: "00000000-00003416.00000000.65622.00F5C000.00000002.mdmp") Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; Source: "00000000-00003416.00000000.65622.00F5C000.00000002.mdmp") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; Source: "00000000-00003416.00000000.65622.00F5C000.00000002.mdmp, 00000000-00003416.00000000.65622.6D110000.00000002.mdmp") Found reference to API "LoadLibraryExA" (Indicator: "LoadLibrary"; Source: "00000000-00003416.00000000.65622.6D110000.00000002.mdmp")50:T8b9f,"4Uh436mr.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP001.TMP\4Uh436mr.exe]- [targetUID: 00000000-00003628] "1pH71tZ8.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP001.TMP\1pH71tZ8.exe]- [targetUID: 00000000-00003416] "lP8PV47.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP000.TMP\lP8PV47.exe]- [targetUID: 00000000-00002632] "sqlite3.dll" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\tempAVSfLAzW1Bz9gE0\sqlite3.dll]- [targetUID: 00000000-00002108] "urlref_httpsaccounts.google.com" has type "HTML document UTF-8 Unicode text with very long lines"- [targetUID: N/A] "FANBooster131.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\FANBooster131\FANBooster131.exe]- [targetUID: 00000000-00002108] "6qY7ld8.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP000.TMP\6qY7ld8.exe]- [targetUID: 00000000-00002632] "logo_steam_1_.svg" has type "SVG Scalable Vector Graphics image"- [targetUID: N/A] "FANBooster131.lnk" has type "MS Windows shortcut Item id list present Points to a file or directory Has Description string Has Relative path Archive ctime=Mon Dec 18 22:31:22 2023 mtime=Mon Dec 18 22:31:22 2023 atime=Thu Mar 28 01:11:14 2019 length=102568 window=hide"- Location: [%APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\FANBooster131.lnk]- [targetUID: 00000000-00002108] "paypal-mark-color_1_.svg" has type "SVG Scalable Vector Graphics image"- [targetUID: N/A] "chevron-right_1_.svg" has type "SVG Scalable Vector Graphics image"- [targetUID: N/A] "urlblockindex_1_.bin" has type "data"- [targetUID: N/A] "libraries~b28b7af69_1_.js" has type "UTF-8 Unicode text with very long lines with CRLF LF line terminators"- [targetUID: N/A] "main_1_.js" has type "data"- [targetUID: N/A] "TuMisuVwKTrzcookies.sqlite" has type "SQLite 3.x database user version 8 last written using SQLite version 3020001"- Location: [%TEMP%\tempAVSfLAzW1Bz9gE0\TuMisuVwKTrzcookies.sqlite]- [targetUID: 00000000-00002108] "identifier_1_.htm" has type "HTML document UTF-8 Unicode text with very long lines"- [targetUID: N/A] "signin-split_1_.js" has type "UTF-8 Unicode text"- [targetUID: N/A] "latmconf_1_.js" has type "UTF-8 Unicode text with very long lines"- [targetUID: N/A] "urlref_httpstwitter.comiflowlogin" has type "HTML document UTF-8 Unicode text with very long lines"- [targetUID: N/A] "G4VW0JM3.htm" has type "HTML document UTF-8 Unicode text with very long lines with CRLF NEL line terminators"- Location: [%LOCALAPPDATA%\Microsoft\Windows\Temporary Internet Files\Content.IE5\CKDNCXYS\G4VW0JM3.htm]- [targetUID: 00000000-00002968] "TarBC8C.tmp" has type "data"- Location: [%TEMP%\TarBC8C.tmp]- [targetUID: 00000000-00002972] "prototype-1.7_1_.js" has type "ASCII text with very long lines with CRLF line terminators"- [targetUID: N/A] "contextualLoginElementalUIv2_1_.css" has type "ASCII text with very long lines with no line terminators"- [targetUID: N/A] "shared_global_1_.js" has type "ASCII text with very long lines with CRLF line terminators"- [targetUID: N/A] "MotivaSans-RegularItalic_1_.ttf" has type "TrueType Font data digitally signed 18 tables 1st "DSIG" 23 names Macintosh Copyright \251 2012 2017 2020 by Plau. All rights reserved.Motiva SansRegular Italic4.015;Plau"- [targetUID: N/A] "MotivaSans-BoldItalic_1_.ttf" has type "TrueType Font data digitally signed 18 tables 1st "DSIG" 22 names Macintosh Copyright \251 2012 2017 2020 by Plau. All rights reserved.Motiva SansBold Italic4.015;Plau;Mo"- [targetUID: N/A] "MotivaSans-LightItalic_1_.ttf" has type "TrueType Font data digitally signed 18 tables 1st "DSIG" 24 names Macintosh Copyright \251 2012 2017 2020 by Plau. All rights reserved.Motiva SansLight Italic4.015;Plau;M"- [targetUID: N/A] "main_1_.css" has type "UTF-8 Unicode text with very long lines with CRLF LF line terminators"- [targetUID: N/A] "new_login_bg_strong_mask_1_.jpg" has type "JPEG image data Exif standard: [TIFF image data little-endian direntries=0] baseline precision 8 1920x1080 components 3"- [targetUID: N/A] "MotivaSans-Medium_1_.ttf" has type "TrueType Font data digitally signed 18 tables 1st "DSIG" 24 names Macintosh Copyright \251 2012 2017 2020 by Plau. All rights reserved.Motiva SansMedium4.015;Plau;MotivaS"- [targetUID: N/A] "MotivaSans-Bold_1_.ttf" has type "TrueType Font data digitally signed 18 tables 1st "DSIG" 22 names Macintosh Copyright \251 2012 2017 2020 by Plau. All rights reserved.Motiva SansBold4.015;Plau;MotivaSan"- [targetUID: N/A] "MotivaSans-Regular_1_.ttf" has type "TrueType Font data digitally signed 18 tables 1st "DSIG" 22 names Macintosh Copyright \251 2012 2017 2020 by Plau. All rights reserved.Motiva SansRegular4.015;Plau;Motiva"- [targetUID: N/A] "MotivaSans-Light_1_.ttf" has type "TrueType Font data digitally signed 18 tables 1st "DSIG" 24 names Macintosh Copyright \251 2012 2017 2020 by Plau. All rights reserved.Motiva SansLight4.015;Plau;MotivaSa"- [targetUID: N/A] "_combined_1_.js" has type "HTML document ASCII text with CRLF line terminators"- [targetUID: N/A] "MotivaSans-Black_1_.ttf" has type "TrueType Font data digitally signed 18 tables 1st "DSIG" 24 names Macintosh Copyright \251 2012 2017 2020 by Plau. All rights reserved.Motiva SansBlack4.015;Plau;MotivaSa"- [targetUID: N/A] "MotivaSans-Thin_1_.ttf" has type "TrueType Font data digitally signed 18 tables 1st "DSIG" 24 names Macintosh Copyright \251 2012 2017 2020 by Plau. All rights reserved.Motiva SansThin4.015;Plau;MotivaSan"- [targetUID: N/A] "global_1_.js" has type "ASCII text with very long lines with CRLF line terminators"- [targetUID: N/A] "jquery-1.11.1.min_1_.js" has type "ASCII text with very long lines with CRLF line terminators"- [targetUID: N/A] "imagestore.dat" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\Internet Explorer\imagestore\3mt7jhv\imagestore.dat]- [targetUID: 00000000-00003968] "shared_global_1_.css" has type "ASCII text with very long lines with CRLF LF line terminators"- [targetUID: N/A] "pa_1_.js" has type "ASCII text with very long lines"- [targetUID: N/A] "CabC872.tmp" has type "Microsoft Cabinet archive data Windows 2000/XP setup 66791 bytes 1 file at 0x2c +A "authroot.stl" number 1 6 datablocks 0x1 compression"- Location: [%TEMP%\CabC872.tmp]- [targetUID: 00000000-00003324] "urlref_httpswww.facebook.comlogin" has type "HTML document UTF-8 Unicode text with very long lines"- [targetUID: N/A] "login_1_.js" has type "UTF-8 Unicode text with very long lines with CRLF line terminators"- [targetUID: N/A] "loginform_1_.htm" has type "HTML document UTF-8 Unicode text with very long lines with CRLF LF line terminators"- [targetUID: N/A] "loginform_2_.htm" has type "HTML document UTF-8 Unicode text with very long lines with CRLF LF line terminators"- [targetUID: N/A] "urlref_httpssteamcommunity.comopenidloginform" has type "HTML document UTF-8 Unicode text with very long lines with CRLF LF line terminators"- [targetUID: N/A] "PayPalSansBig-Medium_1_.eot" has type "Embedded OpenType (EOT) PayPal Sans Big Medium family"- [targetUID: N/A] "PayPalSansBig-Regular_1_.eot" has type "Embedded OpenType (EOT) PayPal Sans Big family"- [targetUID: N/A] "globalv2_1_.css" has type "ASCII text with very long lines with CRLF LF line terminators"- [targetUID: N/A] "favicon_1_.ico" has type "MS Windows icon resource - 5 icons 16x16 32 bits/pixel 24x24 32 bits/pixel"- [targetUID: N/A] "signin_1_.htm" has type "HTML document UTF-8 Unicode text with very long lines with no line terminators"- [targetUID: N/A] "urlref_httpsstore.steampowered.comlogin" has type "HTML document UTF-8 Unicode text with very long lines with CRLF LF line terminators"- [targetUID: N/A] "shared_responsive_adapter_1_.js" has type "UTF-8 Unicode text with CRLF line terminators"- [targetUID: N/A] "ngrlCaptcha.min_1_.js" has type "ASCII text with very long lines with no line terminators"- [targetUID: N/A] "shared_responsive_1_.css" has type "ASCII text with very long lines with CRLF LF line terminators"- [targetUID: N/A] "en-US.4" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\Internet Explorer\DomainSuggestions\en-US.4]- [targetUID: 00000000-00002968] "login_1_.css" has type "assembler source ASCII text with CRLF LF line terminators"- [targetUID: N/A] "70DAE932E3BCB3C00656A27B544BA9CA" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\70DAE932E3BCB3C00656A27B544BA9CA]- [targetUID: 00000000-00002932] "~DF00A1488D6BC37951.TMP" has type "data"- Location: [%TEMP%\~DF00A1488D6BC37951.TMP]- [targetUID: 00000000-00002972] "~DF09530E38B1AD56BD.TMP" has type "data"- Location: [%TEMP%\~DF09530E38B1AD56BD.TMP]- [targetUID: 00000000-00002972] "~DF60D8AE175BD2AFD4.TMP" has type "data"- Location: [%TEMP%\~DF60D8AE175BD2AFD4.TMP]- [targetUID: 00000000-00002968] "~DFB0EF1856BB383E1F.TMP" has type "data"- Location: [%TEMP%\~DFB0EF1856BB383E1F.TMP]- [targetUID: 00000000-00002968] "~DF3B52D9B6F3BFDE88.TMP" has type "data"- Location: [%TEMP%\~DF3B52D9B6F3BFDE88.TMP]- [targetUID: 00000000-00003324] "~DFFE2802123B7DE98C.TMP" has type "data"- Location: [%TEMP%\~DFFE2802123B7DE98C.TMP]- [targetUID: 00000000-00003060] "~DF0481C33983F321D8.TMP" has type "data"- Location: [%TEMP%\~DF0481C33983F321D8.TMP]- [targetUID: 00000000-00002972] "~DF0FEA89A9B9B4EC7B.TMP" has type "data"- Location: [%TEMP%\~DF0FEA89A9B9B4EC7B.TMP]- [targetUID: 00000000-00002968] "~DFBC9CFD7941EDAC16.TMP" has type "data"- Location: [%TEMP%\~DFBC9CFD7941EDAC16.TMP]- [targetUID: 00000000-00003480] "~DFCA4D5A02C2BB5296.TMP" has type "data"- Location: [%TEMP%\~DFCA4D5A02C2BB5296.TMP]- [targetUID: 00000000-00003480] "~DF5F98C312DD3ACDD2.TMP" has type "data"- Location: [%TEMP%\~DF5F98C312DD3ACDD2.TMP]- [targetUID: 00000000-00003480] "~DF059957E7D311A7B6.TMP" has type "data"- Location: [%TEMP%\~DF059957E7D311A7B6.TMP]- [targetUID: 00000000-00003060] "~DF3F90DC5132A8E11D.TMP" has type "data"- [targetUID: N/A] "~DF33663F6BA05FDC52.TMP" has type "data"- Location: [%TEMP%\~DF33663F6BA05FDC52.TMP]- [targetUID: 00000000-00003324] "~DF7B5436AD52A5DA4E.TMP" has type "data"- Location: [%TEMP%\~DF7B5436AD52A5DA4E.TMP]- [targetUID: 00000000-00003324] "~DF8BB5557CAA27ECCB.TMP" has type "data"- Location: [%TEMP%\~DF8BB5557CAA27ECCB.TMP]- [targetUID: 00000000-00002968] "tooltip_1_.js" has type "HTML document ASCII text with CRLF line terminators"- [targetUID: N/A] "manifest_1_.js" has type "ASCII text with very long lines with CRLF LF line terminators"- [targetUID: N/A] "home_1_.css" has type "ASCII text with CRLF LF line terminators"- [targetUID: N/A] "header_1_.css" has type "ASCII text with very long lines with CRLF line terminators"- [targetUID: N/A] "grcenterprise_v3_static_1_.js" has type "ASCII text with very long lines with no line terminators"- [targetUID: N/A] "header_logo_1_.png" has type "PNG image data 744 x 171 8-bit/color RGBA non-interlaced"- [targetUID: N/A] "httpErrorPagesScripts_1_" has type "UTF-8 Unicode (with BOM) text with CRLF line terminators"- [targetUID: N/A] "739F2FF4259CDC6CBE7B90F1A95601EF" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\739F2FF4259CDC6CBE7B90F1A95601EF]- [targetUID: 00000000-00001904] "RecoveryStore._0B1B8A77-9DEB-11EE-982E-080027044E34_.dat" has type "Composite Document File V2 Document Cannot read section info"- [targetUID: N/A] "_18A160EE-9DEB-11EE-982E-080027044E34_.dat" has type "Composite Document File V2 Document Cannot read section info"- [targetUID: N/A] "glyph_alert_critical_big-2x_1_.png" has type "PNG image data 224 x 200 8-bit/color RGBA non-interlaced"- [targetUID: N/A] "RecoveryStore._0DA66C71-9DEB-11EE-982E-080027044E34_.dat" has type "Composite Document File V2 Document Cannot read section info"- [targetUID: N/A] "_5F6963EC-9DF4-11EE-982E-080027044E34_.dat" has type "Composite Document File V2 Document Cannot read section info"- [targetUID: N/A] "RecoveryStore._0C111CAD-9DEB-11EE-982E-080027044E34_.dat" has type "Composite Document File V2 Document Cannot read section info"- [targetUID: N/A] "_18A160EF-9DEB-11EE-982E-080027044E34_.dat" has type "Composite Document File V2 Document Cannot read section info"- [targetUID: N/A] "RecoveryStore._0B905DB1-9DEB-11EE-982E-080027044E34_.dat" has type "Composite Document File V2 Document Cannot read section info"- [targetUID: N/A] "RecoveryStore._0FB08F6F-9DEB-11EE-982E-080027044E34_.dat" has type "Composite Document File V2 Document Cannot read section info"- [targetUID: N/A] "fn-sync-telemetry-min_1_.js" has type "ASCII text with very long lines with no line terminators"- [targetUID: N/A] "sprite_form_2x_1_.png" has type "PNG image data 48 x 1350 8-bit colormap non-interlaced"- [targetUID: N/A] "pp_favicon_x_1_.ico" has type "MS Windows icon resource - 2 icons 32x32 32 bits/pixel 16x16 32 bits/pixel"- [targetUID: N/A] "passwords.txt" has type "UTF-8 Unicode text with CRLF LF line terminators"- Location: [%TEMP%\tempCMSfLAzW1Bz9gE0\passwords.txt]- [targetUID: 00000000-00002108] "information.txt" has type "ASCII text with CRLF LF line terminators"- Location: [%TEMP%\tempCMSfLAzW1Bz9gE0\information.txt]- [targetUID: 00000000-00002108] "57C8EDB95DF3F0AD4EE2DC2B8CFD4157" has type "Microsoft Cabinet archive data Windows 2000/XP setup 4770 bytes 1 file at 0x2c +A "disallowedcert.stl" number 1 1 datablock 0x1 compression"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\57C8EDB95DF3F0AD4EE2DC2B8CFD4157]- [targetUID: 00000000-00002932] "_2068DF5A-9DF5-11EE-982E-080027044E34_.dat" has type "Composite Document File V2 Document Cannot read section info"- [targetUID: N/A] "_1BDA4E92-9DEB-11EE-982E-080027044E34_.dat" has type "Composite Document File V2 Document Cannot read section info"- [targetUID: N/A] "_1249BF84-9DEB-11EE-982E-080027044E34_.dat" has type "Composite Document File V2 Document Cannot read section info"- [targetUID: N/A] "_531B8984-9DFA-11EE-982E-080027044E34_.dat" has type "Composite Document File V2 Document Cannot read section info"- [targetUID: N/A] "_5B031F86-9DF5-11EE-982E-080027044E34_.dat" has type "Composite Document File V2 Document Cannot read section info"- [targetUID: N/A] "_4CDCF508-9DF0-11EE-982E-080027044E34_.dat" has type "Composite Document File V2 Document Cannot read section info"- [targetUID: N/A] "_1520ECBE-9DEB-11EE-982E-080027044E34_.dat" has type "Composite Document File V2 Document Cannot read section info"- [targetUID: N/A] "_0B1B8A79-9DEB-11EE-982E-080027044E34_.dat" has type "Composite Document File V2 Document Cannot read section info"- [targetUID: N/A] "favicon_2_.ico" has type "MS Windows icon resource - 1 icon 32x32 32 bits/pixel"- [targetUID: N/A] "modernizr-2.6.1_1_.js" has type "HTML document ASCII text with very long lines with no line terminators"- [targetUID: N/A] "header_menu_hamburger_1_.png" has type "PNG image data 244 x 212 8-bit/color RGBA non-interlaced"- [targetUID: N/A] "footerLogo_valve_1_.png" has type "PNG image data 96 x 26 8-bit/color RGBA non-interlaced"- [targetUID: N/A] "errorPageStrings_1_" has type "UTF-8 Unicode (with BOM) text with CRLF line terminators"- [targetUID: N/A] "code_box_1_.png" has type "PNG image data 222 x 28 8-bit/color RGBA non-interlaced"- [targetUID: N/A] "friendlyname_box_1_.png" has type "PNG image data 222 x 28 8-bit/color RGBA non-interlaced"- [targetUID: N/A] "dberr.txt" has type "ASCII text with CRLF line terminators"- Location: [%WINDIR%\System32\catroot2\dberr.txt]- [targetUID: 00000000-00002968] "motiva_sans_1_.css" has type "ASCII text with CRLF line terminators"- [targetUID: N/A] "icon-PN-check_1_.png" has type "PNG image data 121 x 133 8-bit/color RGBA non-interlaced"- [targetUID: N/A] "pnfSOBL91xbWYBjnW3Mw7ICXAUREyKjq.zip" has type "Zip archive data at least v2.0 to extract"- Location: [%TEMP%\pnfSOBL91xbWYBjnW3Mw7ICXAUREyKjq.zip]- [targetUID: 00000000-00002108] "dnserror_1_" has type "HTML document UTF-8 Unicode (with BOM) text with CRLF line terminators"- [targetUID: N/A] "logo_valve_footer_1_.png" has type "PNG image data 92 x 26 8-bit/color RGBA non-interlaced"- [targetUID: N/A] "646C991C2A28825F3CC56E0A1D1E3FA9" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\646C991C2A28825F3CC56E0A1D1E3FA9]- [targetUID: 00000000-00002932] "EA618097E393409AFA316F0F87E2C202_1E65FD33F74047223AF4D58CBFD34BCE" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\EA618097E393409AFA316F0F87E2C202_1E65FD33F74047223AF4D58CBFD34BCE]- [targetUID: 00000000-00003480] "24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA]- [targetUID: 00000000-00002932] "NewErrorPageTemplate_1_" has type "UTF-8 Unicode (with BOM) text with CRLF line terminators"- [targetUID: N/A] "logo46x38_1_.png" has type "PNG image data 46 x 38 8-bit/color RGBA non-interlaced"- [targetUID: N/A] "AE583B12017CC3ACE1D659336529BFB3" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\AE583B12017CC3ACE1D659336529BFB3]- [targetUID: 00000000-00002968] "9D6B3FE9E6E4067193F477ABAD990106" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\9D6B3FE9E6E4067193F477ABAD990106]- [targetUID: 00000000-00002968] "4748633DC5731827D4B432DBAC7A3ECE" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\4748633DC5731827D4B432DBAC7A3ECE]- [targetUID: 00000000-00002932] "332HFF5K.txt" has type "ASCII text"- Location: [%APPDATA%\Microsoft\Windows\Cookies\332HFF5K.txt]- [targetUID: 00000000-00003968] "615ETHM7.txt" has type "ASCII text"- Location: [%APPDATA%\Microsoft\Windows\Cookies\615ETHM7.txt]- [targetUID: 00000000-00003968] "U7VTJWMG.txt" has type "ASCII text"- Location: [%APPDATA%\Microsoft\Windows\Cookies\U7VTJWMG.txt]- [targetUID: 00000000-00002932] "VOMYGU3D.txt" has type "ASCII text"- Location: [%APPDATA%\Microsoft\Windows\Cookies\VOMYGU3D.txt]- [targetUID: 00000000-00003968] "SNAUKTZR.txt" has type "ASCII text"- Location: [%APPDATA%\Microsoft\Windows\Cookies\SNAUKTZR.txt]- [targetUID: 00000000-00003968] "40C68D5626484A90937F0752C8B950AB" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\40C68D5626484A90937F0752C8B950AB]- [targetUID: 00000000-00003480] "69C6F6EC64E114822DF688DC12CDD86C" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\69C6F6EC64E114822DF688DC12CDD86C]- [targetUID: 00000000-00002932] "6DB145CFEEC544B1582FED1ADA3370DD" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\6DB145CFEEC544B1582FED1ADA3370DD]- [targetUID: 00000000-00002932] "0270780F846F08BEFE0DD8112D932FEF" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\0270780F846F08BEFE0DD8112D932FEF]- [targetUID: 00000000-00003968] "CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA]- [targetUID: 00000000-00002932] "SDY4YMU0.txt" has type "ASCII text"- Location: [%APPDATA%\Microsoft\Windows\Cookies\SDY4YMU0.txt]- [targetUID: 00000000-00003968] "6B2043001D270792DFFD725518EAFE2C" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\6B2043001D270792DFFD725518EAFE2C]- [targetUID: 00000000-00002968] "52AVYTKG.txt" has type "ASCII text"- Location: [%APPDATA%\Microsoft\Windows\Cookies\52AVYTKG.txt]- [targetUID: 00000000-00003968] "8EX7E8PN.txt" has type "ASCII text"- Location: [%APPDATA%\Microsoft\Windows\Cookies\8EX7E8PN.txt]- [targetUID: 00000000-00003060] "UGK0QAVD.txt" has type "ASCII text"- Location: [%APPDATA%\Microsoft\Windows\Cookies\UGK0QAVD.txt]- [targetUID: 00000000-00003968] "EDC238BFF48A31D55A97E1E93892934B_C31B2498754E340573F1336DE607D619" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\EDC238BFF48A31D55A97E1E93892934B_C31B2498754E340573F1336DE607D619]- [targetUID: 00000000-00003968] "E2C6CBAF0AF08CF203BA74BF0D0AB6D5_49536AB5156BDD74EFF881D01C36A419" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_49536AB5156BDD74EFF881D01C36A419]- [targetUID: 00000000-00003188] "80237EE4964FC9C409AAF55BF996A292_D46D6FA25B74360E1349F9015B5CCE53" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\80237EE4964FC9C409AAF55BF996A292_D46D6FA25B74360E1349F9015B5CCE53]- [targetUID: 00000000-00002968] "E2C6CBAF0AF08CF203BA74BF0D0AB6D5_0FB9553B978E7F00C6B2309507DEB64A" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_0FB9553B978E7F00C6B2309507DEB64A]- [targetUID: 00000000-00002968] "80237EE4964FC9C409AAF55BF996A292_C5130A0BDC8C859A2757D77746C10868" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\80237EE4964FC9C409AAF55BF996A292_C5130A0BDC8C859A2757D77746C10868]- [targetUID: 00000000-00002968] "59D76868C250B3240414CE3EFBB12518_DB3354A21B46C492983D8DC6E09DCFAD" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\59D76868C250B3240414CE3EFBB12518_DB3354A21B46C492983D8DC6E09DCFAD]- [targetUID: 00000000-00003188] "F2DDCD2B5F37625B82E81F4976CEE400_BFB422D89E28A298A60024A8D8A2EA06" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\F2DDCD2B5F37625B82E81F4976CEE400_BFB422D89E28A298A60024A8D8A2EA06]- [targetUID: 00000000-00002932] "E573CDF4C6D731D56A665145182FD759_E391470CF0D37EE71D631C107209CEFF" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\E573CDF4C6D731D56A665145182FD759_E391470CF0D37EE71D631C107209CEFF]- [targetUID: 00000000-00003968] "7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776]- [targetUID: 00000000-00002932] "35DDEDF268117918D1D277A171D8DF7B_EBDE77CB467169C3928F012A05185035" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\35DDEDF268117918D1D277A171D8DF7B_EBDE77CB467169C3928F012A05185035]- [targetUID: 00000000-00001904] "EDC238BFF48A31D55A97E1E93892934B_C20E0DA2D0F89FE526E1490F4A2EE5AB" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\EDC238BFF48A31D55A97E1E93892934B_C20E0DA2D0F89FE526E1490F4A2EE5AB]- [targetUID: 00000000-00001904] "KOEGS69J.txt" has type "ASCII text"- Location: [%APPDATA%\Microsoft\Windows\Cookies\KOEGS69J.txt]- [targetUID: 00000000-00002968] "9KJ3Z76X.txt" has type "ASCII text"- Location: [%APPDATA%\Microsoft\Windows\Cookies\9KJ3Z76X.txt]- [targetUID: 00000000-00003968] "35DDEDF268117918D1D277A171D8DF7B_EBDE77CB467169C3928F012A05185035" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\MetaData\35DDEDF268117918D1D277A171D8DF7B_EBDE77CB467169C3928F012A05185035]- [targetUID: 00000000-00001904] "E2C6CBAF0AF08CF203BA74BF0D0AB6D5_0FB9553B978E7F00C6B2309507DEB64A" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_0FB9553B978E7F00C6B2309507DEB64A]- [targetUID: 00000000-00002968] "E2C6CBAF0AF08CF203BA74BF0D0AB6D5_49536AB5156BDD74EFF881D01C36A419" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_49536AB5156BDD74EFF881D01C36A419]- [targetUID: 00000000-00003188] "80237EE4964FC9C409AAF55BF996A292_D46D6FA25B74360E1349F9015B5CCE53" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\MetaData\80237EE4964FC9C409AAF55BF996A292_D46D6FA25B74360E1349F9015B5CCE53]- [targetUID: 00000000-00002968] "80237EE4964FC9C409AAF55BF996A292_C5130A0BDC8C859A2757D77746C10868" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\MetaData\80237EE4964FC9C409AAF55BF996A292_C5130A0BDC8C859A2757D77746C10868]- [targetUID: 00000000-00002968] "24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA]- [targetUID: 00000000-00002932] "F2DDCD2B5F37625B82E81F4976CEE400_BFB422D89E28A298A60024A8D8A2EA06" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\MetaData\F2DDCD2B5F37625B82E81F4976CEE400_BFB422D89E28A298A60024A8D8A2EA06]- [targetUID: 00000000-00002932] "59D76868C250B3240414CE3EFBB12518_DB3354A21B46C492983D8DC6E09DCFAD" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\MetaData\59D76868C250B3240414CE3EFBB12518_DB3354A21B46C492983D8DC6E09DCFAD]- [targetUID: 00000000-00003188] "7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776]- [targetUID: 00000000-00002932] "EAF8AA29A62AB29E614331747385D816_F9E4DC0B9D5C777357D7DB8DEF51118A" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\MetaData\EAF8AA29A62AB29E614331747385D816_F9E4DC0B9D5C777357D7DB8DEF51118A]- [targetUID: 00000000-00002968] "7XZE67A6.txt" has type "ASCII text"- Location: [%APPDATA%\Microsoft\Windows\Cookies\7XZE67A6.txt]- [targetUID: 00000000-00003188] "EA618097E393409AFA316F0F87E2C202_1E65FD33F74047223AF4D58CBFD34BCE" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\MetaData\EA618097E393409AFA316F0F87E2C202_1E65FD33F74047223AF4D58CBFD34BCE]- [targetUID: 00000000-00003480] "E573CDF4C6D731D56A665145182FD759_E391470CF0D37EE71D631C107209CEFF" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\MetaData\E573CDF4C6D731D56A665145182FD759_E391470CF0D37EE71D631C107209CEFF]- [targetUID: 00000000-00003968] "EDC238BFF48A31D55A97E1E93892934B_C31B2498754E340573F1336DE607D619" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\MetaData\EDC238BFF48A31D55A97E1E93892934B_C31B2498754E340573F1336DE607D619]- [targetUID: 00000000-00003968] "C46E7B0F942663A1EDC8D9D6D7869173_6043FC604A395E1485AF7AC16D16B7CE" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\MetaData\C46E7B0F942663A1EDC8D9D6D7869173_6043FC604A395E1485AF7AC16D16B7CE]- [targetUID: 00000000-00003480] "EDC238BFF48A31D55A97E1E93892934B_C20E0DA2D0F89FE526E1490F4A2EE5AB" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\MetaData\EDC238BFF48A31D55A97E1E93892934B_C20E0DA2D0F89FE526E1490F4A2EE5AB]- [targetUID: 00000000-00001904] "CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\MetaData\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA]- [targetUID: 00000000-00002932] "Y126OFY3.txt" has type "ASCII text"- Location: [%APPDATA%\Microsoft\Windows\Cookies\Y126OFY3.txt]- [targetUID: 00000000-00002932] "LVROXB4K.txt" has type "ASCII text"- Location: [%APPDATA%\Microsoft\Windows\Cookies\LVROXB4K.txt]- [targetUID: 00000000-00002744] "57C8EDB95DF3F0AD4EE2DC2B8CFD4157" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157]- [targetUID: 00000000-00002932] "6WV7X1AF.txt" has type "ASCII text"- Location: [%APPDATA%\Microsoft\Windows\Cookies\6WV7X1AF.txt]- [targetUID: 00000000-00003968] "EAF8AA29A62AB29E614331747385D816_F9E4DC0B9D5C777357D7DB8DEF51118A" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\EAF8AA29A62AB29E614331747385D816_F9E4DC0B9D5C777357D7DB8DEF51118A]- [targetUID: 00000000-00002968] "BP4TEVY2.txt" has type "ASCII text"- Location: [%APPDATA%\Microsoft\Windows\Cookies\BP4TEVY2.txt]- [targetUID: 00000000-00003188] "btn_header_installsteam_download_1_.png" has type "PNG image data 15 x 13 8-bit/color RGBA non-interlaced"- [targetUID: N/A] "77EC63BDA74BD0D0E0426DC8F8008506" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506]- [targetUID: 00000000-00002968] "NXIRHQZW.txt" has type "ASCII text"- Location: [%APPDATA%\Microsoft\Windows\Cookies\NXIRHQZW.txt]- [targetUID: 00000000-00002744] "7989AFQS.txt" has type "ASCII text"- Location: [%APPDATA%\Microsoft\Windows\Cookies\7989AFQS.txt]- [targetUID: 00000000-00003968] "0270780F846F08BEFE0DD8112D932FEF" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\MetaData\0270780F846F08BEFE0DD8112D932FEF]- [targetUID: 00000000-00003968] "RYWEW1Y8.txt" has type "ASCII text"- Location: [%APPDATA%\Microsoft\Windows\Cookies\RYWEW1Y8.txt]- [targetUID: 00000000-00003968] "6B2043001D270792DFFD725518EAFE2C" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\MetaData\6B2043001D270792DFFD725518EAFE2C]- [targetUID: 00000000-00002968] "9D6B3FE9E6E4067193F477ABAD990106" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\MetaData\9D6B3FE9E6E4067193F477ABAD990106]- [targetUID: 00000000-00002968] "6DB145CFEEC544B1582FED1ADA3370DD" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\MetaData\6DB145CFEEC544B1582FED1ADA3370DD]- [targetUID: 00000000-00002932] "AE583B12017CC3ACE1D659336529BFB3" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\MetaData\AE583B12017CC3ACE1D659336529BFB3]- [targetUID: 00000000-00002968] "69C6F6EC64E114822DF688DC12CDD86C" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\MetaData\69C6F6EC64E114822DF688DC12CDD86C]- [targetUID: 00000000-00002932] "BEC6224B02D155A396218A2504F3EE0B" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\MetaData\BEC6224B02D155A396218A2504F3EE0B]- [targetUID: 00000000-00001904] "739F2FF4259CDC6CBE7B90F1A95601EF" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\MetaData\739F2FF4259CDC6CBE7B90F1A95601EF]- [targetUID: 00000000-00001904] "YVXT3NQ5.htm" has type "gzip compressed data original size modulo 2^32 338"- Location: [%LOCALAPPDATA%\Microsoft\Windows\Temporary Internet Files\Content.IE5\37NU00GP\YVXT3NQ5.htm]- [targetUID: 00000000-00002932] "DTNTD107.txt" has type "ASCII text"- Location: [%APPDATA%\Microsoft\Windows\Cookies\DTNTD107.txt]- [targetUID: 00000000-00003968] "70DAE932E3BCB3C00656A27B544BA9CA" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\MetaData\70DAE932E3BCB3C00656A27B544BA9CA]- [targetUID: 00000000-00002932] "F7PZTVCR.txt" has type "ASCII text"- Location: [%APPDATA%\Microsoft\Windows\Cookies\F7PZTVCR.txt]- [targetUID: 00000000-00003188] "IE61JY3G.txt" has type "ASCII text"- Location: [%APPDATA%\Microsoft\Windows\Cookies\IE61JY3G.txt]- [targetUID: 00000000-00002744] "4748633DC5731827D4B432DBAC7A3ECE" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\MetaData\4748633DC5731827D4B432DBAC7A3ECE]- [targetUID: 00000000-00002932] "646C991C2A28825F3CC56E0A1D1E3FA9" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\MetaData\646C991C2A28825F3CC56E0A1D1E3FA9]- [targetUID: 00000000-00002932] "40C68D5626484A90937F0752C8B950AB" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\MetaData\40C68D5626484A90937F0752C8B950AB]- [targetUID: 00000000-00003480] "4EWTWWTJ.txt" has type "ASCII text"- Location: [%APPDATA%\Microsoft\Windows\Cookies\4EWTWWTJ.txt]- [targetUID: 00000000-00002968] "4LHOBBKR.txt" has type "ASCII text"- Location: [%APPDATA%\Microsoft\Windows\Cookies\4LHOBBKR.txt]- [targetUID: 00000000-00003968] "DL986OPF.txt" has type "ASCII text"- Location: [%APPDATA%\Microsoft\Windows\Cookies\DL986OPF.txt]- [targetUID: 00000000-00002932] "TVY5XPCB.txt" has type "ASCII text"- Location: [%APPDATA%\Microsoft\Windows\Cookies\TVY5XPCB.txt]- [targetUID: 00000000-00002932] "FXA0X6IV.txt" has type "ASCII text"- Location: [%APPDATA%\Microsoft\Windows\Cookies\FXA0X6IV.txt]- [targetUID: 00000000-00002932] "9YI0IUTV.txt" has type "ASCII text"- Location: [%APPDATA%\Microsoft\Windows\Cookies\9YI0IUTV.txt]- [targetUID: 00000000-00002932] "9ELCP68Z.txt" has type "ASCII text"- Location: [%APPDATA%\Microsoft\Windows\Cookies\9ELCP68Z.txt]- [targetUID: 00000000-00002744] "04IX7IG0.txt" has type "ASCII text"- Location: [%APPDATA%\Microsoft\Windows\Cookies\04IX7IG0.txt]- [targetUID: 00000000-00002968] "T2PCFNWM.txt" has type "ASCII text"- Location: [%APPDATA%\Microsoft\Windows\Cookies\T2PCFNWM.txt]- [targetUID: 00000000-00003188] "BB33SVIB.txt" has type "ASCII text"- Location: [%APPDATA%\Microsoft\Windows\Cookies\BB33SVIB.txt]- [targetUID: 00000000-00002968] "WAZK1680.txt" has type "ASCII text"- Location: [%APPDATA%\Microsoft\Windows\Cookies\WAZK1680.txt]- [targetUID: 00000000-00002968] "RBVUWGU9.txt" has type "ASCII text"- Location: [%APPDATA%\Microsoft\Windows\Cookies\RBVUWGU9.txt]- [targetUID: 00000000-00003968] "rise131M9Asphalt.tmp" has type "ASCII text with no line terminators"- Location: [%TEMP%\rise131M9Asphalt.tmp]- [targetUID: 00000000-00002108] "C46E7B0F942663A1EDC8D9D6D7869173_6043FC604A395E1485AF7AC16D16B7CE" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\C46E7B0F942663A1EDC8D9D6D7869173_6043FC604A395E1485AF7AC16D16B7CE]- [targetUID: 00000000-00003480] "OfficeTrackerNMP131.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%ALLUSERSPROFILE%\OfficeTrackerNMP131\OfficeTrackerNMP131.exe]- [targetUID: 00000000-00002108] "MaxLoonaFest131.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%LOCALAPPDATA%\MaxLoonaFest131\MaxLoonaFest131.exe]- [targetUID: 00000000-00002108] "TarC873.tmp" has type "data"- Location: [%TEMP%\TarC873.tmp]- [targetUID: 00000000-00003324] "TarB866.tmp" has type "data"- Location: [%TEMP%\TarB866.tmp]- [targetUID: 00000000-00003480] "77EC63BDA74BD0D0E0426DC8F8008506" has type "Microsoft Cabinet archive data Windows 2000/XP setup 66791 bytes 1 file at 0x2c +A "authroot.stl" number 1 6 datablocks 0x1 compression"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506]- [targetUID: 00000000-00002968] "CabB855.tmp" has type "Microsoft Cabinet archive data Windows 2000/XP setup 66791 bytes 1 file at 0x2c +A "authroot.stl" number 1 6 datablocks 0x1 compression"- Location: [%TEMP%\CabB855.tmp]- [targetUID: 00000000-00003480] "CabBC8B.tmp" has type "Microsoft Cabinet archive data Windows 2000/XP setup 66791 bytes 1 file at 0x2c +A "authroot.stl" number 1 6 datablocks 0x1 compression"- Location: [%TEMP%\CabBC8B.tmp]- [targetUID: 00000000-00002972] "BEC6224B02D155A396218A2504F3EE0B" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\BEC6224B02D155A396218A2504F3EE0B]- [targetUID: 00000000-00001904] "search__0633EE93-D776-472f-A0FF-E1416B8B2E3A_.ico" has type "MS Windows icon resource - 1 icon 32x32 32 bits/pixel"- [targetUID: N/A] "4KIB1S71.txt" has type "ASCII text"- Location: [%APPDATA%\Microsoft\Windows\Cookies\4KIB1S71.txt]- [targetUID: 00000000-00003188] "66ELRVME.txt" has type "ASCII text"- Location: [%APPDATA%\Microsoft\Windows\Cookies\66ELRVME.txt]- [targetUID: 00000000-00002744] "NUNAYEX1.txt" has type "ASCII text"- Location: [%APPDATA%\Microsoft\Windows\Cookies\NUNAYEX1.txt]- [targetUID: 00000000-00002932]51:T8cb,"TarBC8C.tmp" has type "data" - Location: [%TEMP%\TarBC8C.tmp] "CabC872.tmp" has type "Microsoft Cabinet archive data Windows 2000/XP setup 66791 bytes 1 file at 0x2c +A "authroot.stl" number 1 6 datablocks 0x1 compression" - Location: [%TEMP%\CabC872.tmp] "~DF00A1488D6BC37951.TMP" has type "data" - Location: [%TEMP%\~DF00A1488D6BC37951.TMP] "~DF09530E38B1AD56BD.TMP" has type "data" - Location: [%TEMP%\~DF09530E38B1AD56BD.TMP] "~DF60D8AE175BD2AFD4.TMP" has type "data" - Location: [%TEMP%\~DF60D8AE175BD2AFD4.TMP] "~DFB0EF1856BB383E1F.TMP" has type "data" - Location: [%TEMP%\~DFB0EF1856BB383E1F.TMP] "~DF3B52D9B6F3BFDE88.TMP" has type "data" - Location: [%TEMP%\~DF3B52D9B6F3BFDE88.TMP] "~DFFE2802123B7DE98C.TMP" has type "data" - Location: [%TEMP%\~DFFE2802123B7DE98C.TMP] "~DF0481C33983F321D8.TMP" has type "data" - Location: [%TEMP%\~DF0481C33983F321D8.TMP] "~DF0FEA89A9B9B4EC7B.TMP" has type "data" - Location: [%TEMP%\~DF0FEA89A9B9B4EC7B.TMP] "~DFBC9CFD7941EDAC16.TMP" has type "data" - Location: [%TEMP%\~DFBC9CFD7941EDAC16.TMP] "~DFCA4D5A02C2BB5296.TMP" has type "data" - Location: [%TEMP%\~DFCA4D5A02C2BB5296.TMP] "~DF5F98C312DD3ACDD2.TMP" has type "data" - Location: [%TEMP%\~DF5F98C312DD3ACDD2.TMP] "~DF059957E7D311A7B6.TMP" has type "data" - Location: [%TEMP%\~DF059957E7D311A7B6.TMP] "~DF3F90DC5132A8E11D.TMP" has type "data" "~DF33663F6BA05FDC52.TMP" has type "data" - Location: [%TEMP%\~DF33663F6BA05FDC52.TMP] "~DF7B5436AD52A5DA4E.TMP" has type "data" - Location: [%TEMP%\~DF7B5436AD52A5DA4E.TMP] "~DF8BB5557CAA27ECCB.TMP" has type "data" - Location: [%TEMP%\~DF8BB5557CAA27ECCB.TMP] "rise131M9Asphalt.tmp" has type "ASCII text with no line terminators" - Location: [%TEMP%\rise131M9Asphalt.tmp] "TarC873.tmp" has type "data" - Location: [%TEMP%\TarC873.tmp] "TarB866.tmp" has type "data" - Location: [%TEMP%\TarB866.tmp] "CabB855.tmp" has type "Microsoft Cabinet archive data Windows 2000/XP setup 66791 bytes 1 file at 0x2c +A "authroot.stl" number 1 6 datablocks 0x1 compression" - Location: [%TEMP%\CabB855.tmp] "CabBC8B.tmp" has type "Microsoft Cabinet archive data Windows 2000/XP setup 66791 bytes 1 file at 0x2c +A "authroot.stl" number 1 6 datablocks 0x1 compression" - Location: [%TEMP%\CabBC8B.tmp]52:T974,"ac18ad4de0d70e7cbbfb829afea0dd45.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: ""; Value: "") "ac18ad4de0d70e7cbbfb829afea0dd45.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SAFEBOOT\OPTION"; Key: ""; Value: "") "ac18ad4de0d70e7cbbfb829afea0dd45.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SRP\GP\DLL"; Key: ""; Value: "") "ac18ad4de0d70e7cbbfb829afea0dd45.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "ac18ad4de0d70e7cbbfb829afea0dd45.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "ac18ad4de0d70e7cbbfb829afea0dd45.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\SIDEBYSIDE\ASSEMBLYSTORAGEROOTS"; Key: ""; Value: "") "ac18ad4de0d70e7cbbfb829afea0dd45.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS"; Key: ""; Value: "") "ac18ad4de0d70e7cbbfb829afea0dd45.exe" (Access type: "OPEN"; Path: "HKCU\CONTROL PANEL\DESKTOP\MUICACHED\MACHINELANGUAGECONFIGURATION"; Key: ""; Value: "") "ac18ad4de0d70e7cbbfb829afea0dd45.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\MUI\SETTINGS"; Key: ""; Value: "") "ac18ad4de0d70e7cbbfb829afea0dd45.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\CONTROL PANEL\DESKTOP"; Key: ""; Value: "") "ac18ad4de0d70e7cbbfb829afea0dd45.exe" (Access type: "OPEN"; Path: "HKCU\CONTROL PANEL\DESKTOP\LANGUAGECONFIGURATION"; Key: ""; Value: "") "ac18ad4de0d70e7cbbfb829afea0dd45.exe" (Access type: "OPEN"; Path: "HKCU\CONTROL PANEL\DESKTOP"; Key: ""; Value: "") "ac18ad4de0d70e7cbbfb829afea0dd45.exe" (Access type: "OPEN"; Path: "HKCU\CONTROL PANEL\DESKTOP\MUICACHED"; Key: ""; Value: "") "ac18ad4de0d70e7cbbfb829afea0dd45.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: ""; Value: "") "ac18ad4de0d70e7cbbfb829afea0dd45.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\SIDEBYSIDE"; Key: ""; Value: "") "ac18ad4de0d70e7cbbfb829afea0dd45.exe" (Access type: "OPEN"; Path: "HKLM"; Key: ""; Value: "") "ac18ad4de0d70e7cbbfb829afea0dd45.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\DIAGNOSTICS"; Key: ""; Value: "")53:T681,"schtasks.exe" (Access type: "OPEN"; Path: "HKCU\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}"; Key: ""; Value: "") "schtasks.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}"; Key: ""; Value: "") "schtasks.exe" (Access type: "OPEN"; Path: "HKCU\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\TREATAS"; Key: ""; Value: "") "schtasks.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\TREATAS"; Key: ""; Value: "") "schtasks.exe" (Access type: "OPEN"; Path: "HKCU\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\PROGID"; Key: ""; Value: "") "schtasks.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\PROGID"; Key: ""; Value: "") "schtasks.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\PROGID"; Key: ""; Value: "") "schtasks.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}"; Key: ""; Value: "") "schtasks.exe" (Access type: "OPEN"; Path: "HKCU\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\INPROCSERVER32"; Key: ""; Value: "") "schtasks.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\INPROCSERVER32"; Key: ""; Value: "") "schtasks.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\INPROCSERVER32"; Key: "INPROCSERVER32"; Value: "") "schtasks.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\INPROCSERVER32"; Key: ""; Value: "")54:Te12,"ac18ad4de0d70e7cbbfb829afea0dd45.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "CWDILLEGALINDLLSEARCH"; Value: "") "ac18ad4de0d70e7cbbfb829afea0dd45.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED"; Value: "") "ac18ad4de0d70e7cbbfb829afea0dd45.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS"; Key: "SHOWDEBUGINFO"; Value: "") "ac18ad4de0d70e7cbbfb829afea0dd45.exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP"; Key: "PREFERREDUILANGUAGES"; Value: "") "ac18ad4de0d70e7cbbfb829afea0dd45.exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP\MUICACHED"; Key: "MACHINEPREFERREDUILANGUAGES"; Value: "") "ac18ad4de0d70e7cbbfb829afea0dd45.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: "COMPATDLL"; Value: "") "ac18ad4de0d70e7cbbfb829afea0dd45.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: "00060101.00060101"; Value: "") "ac18ad4de0d70e7cbbfb829afea0dd45.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: ""; Value: "") "ac18ad4de0d70e7cbbfb829afea0dd45.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\SIDEBYSIDE"; Key: "PREFEREXTERNALMANIFEST"; Value: "") "ac18ad4de0d70e7cbbfb829afea0dd45.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "SAFEDLLSEARCHMODE"; Value: "") "ac18ad4de0d70e7cbbfb829afea0dd45.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\GRE_INITIALIZE"; Key: "DISABLEMETAFILES"; Value: "") "ac18ad4de0d70e7cbbfb829afea0dd45.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\COMPATIBILITY32"; Key: "AC18AD4DE0D70E7CBBFB829AFEA0DD45"; Value: "") "ac18ad4de0d70e7cbbfb829afea0dd45.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINDOWS"; Key: "LOADAPPINIT_DLLS"; Value: "") "ac18ad4de0d70e7cbbfb829afea0dd45.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE"; Key: "PAGEALLOCATORUSESYSTEMHEAP"; Value: "") "ac18ad4de0d70e7cbbfb829afea0dd45.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE"; Key: "PAGEALLOCATORSYSTEMHEAPISPRIVATE"; Value: "") "ac18ad4de0d70e7cbbfb829afea0dd45.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\WINDOWS ERROR REPORTING\WMR"; Key: "DISABLE"; Value: "") "ac18ad4de0d70e7cbbfb829afea0dd45.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\SETUP"; Key: "SOURCEPATH"; Value: "") "ac18ad4de0d70e7cbbfb829afea0dd45.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION"; Key: "DEVICEPATH"; Value: "") "ac18ad4de0d70e7cbbfb829afea0dd45.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US"; Value: "") "ac18ad4de0d70e7cbbfb829afea0dd45.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US"; Value: "") "ac18ad4de0d70e7cbbfb829afea0dd45.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\DATACOLLECTION"; Key: "COMMERCIALDATAOPTIN"; Value: "") "ac18ad4de0d70e7cbbfb829afea0dd45.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "PENDINGFILERENAMEOPERATIONS"; Value: "")55:T95a,"ac18ad4de0d70e7cbbfb829afea0dd45.exe" trying to touch file "C:\Windows\SYSTEM32\sechost.dll" "ac18ad4de0d70e7cbbfb829afea0dd45.exe" trying to touch file "C:\ac18ad4de0d70e7cbbfb829afea0dd45.exe.Local\" "ac18ad4de0d70e7cbbfb829afea0dd45.exe" trying to touch file "C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18837_none_41e855142bd5705d" "ac18ad4de0d70e7cbbfb829afea0dd45.exe" trying to touch file "C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18837_none_41e855142bd5705d\COMCTL32.dll" "ac18ad4de0d70e7cbbfb829afea0dd45.exe" trying to touch file "C:\Cabinet.dll" "ac18ad4de0d70e7cbbfb829afea0dd45.exe" trying to touch file "C:\Windows\system32\Cabinet.dll" "ac18ad4de0d70e7cbbfb829afea0dd45.exe" trying to touch file "C:\VERSION.dll" "ac18ad4de0d70e7cbbfb829afea0dd45.exe" trying to touch file "C:\Windows\system32\VERSION.dll" "ac18ad4de0d70e7cbbfb829afea0dd45.exe" trying to touch file "C:\Windows\system32\apphelp.dll" "ac18ad4de0d70e7cbbfb829afea0dd45.exe" trying to touch file "C:\Windows\AppPatch\sysmain.sdb" "ac18ad4de0d70e7cbbfb829afea0dd45.exe" trying to touch file "C:\Windows\AppPatch\AcLayers.DLL" "ac18ad4de0d70e7cbbfb829afea0dd45.exe" trying to touch file "C:\SspiCli.dll" "ac18ad4de0d70e7cbbfb829afea0dd45.exe" trying to touch file "C:\Windows\system32\SspiCli.dll" "ac18ad4de0d70e7cbbfb829afea0dd45.exe" trying to touch file "C:\WINSPOOL.DRV" "ac18ad4de0d70e7cbbfb829afea0dd45.exe" trying to touch file "C:\Windows\system32\WINSPOOL.DRV" "ac18ad4de0d70e7cbbfb829afea0dd45.exe" trying to touch file "C:\MPR.dll" "ac18ad4de0d70e7cbbfb829afea0dd45.exe" trying to touch file "C:\Windows\system32\MPR.dll" "ac18ad4de0d70e7cbbfb829afea0dd45.exe" trying to touch file "C:\Windows\AppPatch\AcGenral.DLL" "ac18ad4de0d70e7cbbfb829afea0dd45.exe" trying to touch file "C:\UxTheme.dll" "ac18ad4de0d70e7cbbfb829afea0dd45.exe" trying to touch file "C:\Windows\system32\UxTheme.dll" "ac18ad4de0d70e7cbbfb829afea0dd45.exe" trying to touch file "C:\WINMM.dll" "ac18ad4de0d70e7cbbfb829afea0dd45.exe" trying to touch file "C:\Windows\system32\WINMM.dll" "ac18ad4de0d70e7cbbfb829afea0dd45.exe" trying to touch file "C:\samcli.dll" "ac18ad4de0d70e7cbbfb829afea0dd45.exe" trying to touch file "C:\Windows\system32\samcli.dll" "ac18ad4de0d70e7cbbfb829afea0dd45.exe" trying to touch file "C:\MSACM32.dll"56:T88f,"ac18ad4de0d70e7cbbfb829afea0dd45.exe" trying to access non-existent file "C:\Cabinet.dll" "ac18ad4de0d70e7cbbfb829afea0dd45.exe" trying to access non-existent file "C:\VERSION.dll" "ac18ad4de0d70e7cbbfb829afea0dd45.exe" trying to access non-existent file "C:\SspiCli.dll" "ac18ad4de0d70e7cbbfb829afea0dd45.exe" trying to access non-existent file "C:\MPR.dll" "ac18ad4de0d70e7cbbfb829afea0dd45.exe" trying to access non-existent file "C:\UxTheme.dll" "ac18ad4de0d70e7cbbfb829afea0dd45.exe" trying to access non-existent file "C:\WINMM.dll" "ac18ad4de0d70e7cbbfb829afea0dd45.exe" trying to access non-existent file "C:\samcli.dll" "ac18ad4de0d70e7cbbfb829afea0dd45.exe" trying to access non-existent file "C:\MSACM32.dll" "ac18ad4de0d70e7cbbfb829afea0dd45.exe" trying to access non-existent file "C:\sfc.dll" "ac18ad4de0d70e7cbbfb829afea0dd45.exe" trying to access non-existent file "C:\sfc_os.DLL" "ac18ad4de0d70e7cbbfb829afea0dd45.exe" trying to access non-existent file "C:\dwmapi.dll" "ac18ad4de0d70e7cbbfb829afea0dd45.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP\lP8PV47.exe" "ac18ad4de0d70e7cbbfb829afea0dd45.exe" trying to access non-existent file "C:\Windows\system32\api-ms-win-core-fibers-l1-1-1.DLL" "ac18ad4de0d70e7cbbfb829afea0dd45.exe" trying to access non-existent file "C:\Windows\system32\api-ms-win-core-localization-l1-2-1.DLL" "ac18ad4de0d70e7cbbfb829afea0dd45.exe" trying to access non-existent file "C:\FLTLIB.DLL" "ac18ad4de0d70e7cbbfb829afea0dd45.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP\6qY7ld8.exe" "ac18ad4de0d70e7cbbfb829afea0dd45.exe" trying to access non-existent file "\Device\HarddiskVolume2\CABINET.DLL" "ac18ad4de0d70e7cbbfb829afea0dd45.exe" trying to access non-existent file "\Device\HarddiskVolume2\VERSION.DLL" "ac18ad4de0d70e7cbbfb829afea0dd45.exe" trying to access non-existent file "\Device\HarddiskVolume2\SSPICLI.DLL" "ac18ad4de0d70e7cbbfb829afea0dd45.exe" trying to access non-existent file "\Device\HarddiskVolume2\MPR.DLL" "ac18ad4de0d70e7cbbfb829afea0dd45.exe" trying to access non-existent file "\Device\HarddiskVolume2\UXTHEME.DLL"57:T98e,"ac18ad4de0d70e7cbbfb829afea0dd45.exe" trying to access non-existent file "C:\ac18ad4de0d70e7cbbfb829afea0dd45.exe.Local\" "ac18ad4de0d70e7cbbfb829afea0dd45.exe" trying to access non-existent file "C:\WINSPOOL.DRV" "ac18ad4de0d70e7cbbfb829afea0dd45.exe" trying to access non-existent file "C:\ac18ad4de0d70e7cbbfb829afea0dd45.exe.Config" "ac18ad4de0d70e7cbbfb829afea0dd45.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP" "ac18ad4de0d70e7cbbfb829afea0dd45.exe" trying to access non-existent file "\Device\HarddiskVolume2\AC18AD4DE0D70E7CBBFB829AFEA0DD45.EXE.LOCAL" "ac18ad4de0d70e7cbbfb829afea0dd45.exe" trying to access non-existent file "\Device\HarddiskVolume2\WINSPOOL.DRV" "ac18ad4de0d70e7cbbfb829afea0dd45.exe" trying to access non-existent file "\Device\HarddiskVolume2\AC18AD4DE0D70E7CBBFB829AFEA0DD45.EXE.CONFIG" "ac18ad4de0d70e7cbbfb829afea0dd45.exe" trying to access non-existent file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP" "lP8PV47.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP\lP8PV47.exe.Local\" "lP8PV47.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP\WINSPOOL.DRV" "lP8PV47.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP\lP8PV47.exe.Config" "lP8PV47.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP001.TMP" "lP8PV47.exe" trying to access non-existent file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP\LP8PV47.EXE.LOCAL" "lP8PV47.exe" trying to access non-existent file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP\WINSPOOL.DRV" "lP8PV47.exe" trying to access non-existent file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP\LP8PV47.EXE.CONFIG" "lP8PV47.exe" trying to access non-existent file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\IXP001.TMP" "1pH71tZ8.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP001.TMP\1pH71tZ8.exe.Local\" "1pH71tZ8.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP001.TMP\WINSPOOL.DRV" "1pH71tZ8.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP001.TMP\1pH71tZ8.exe.Config" "1pH71tZ8.exe" trying to access non-existent file "C:\Windows\system32\UxTheme.dll.Config"58:T539,Found http requests in header "GET /DigiCertGlobalRootG3.crt" Found http requests in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D" Found http requests in header "GET /gtsr1/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBQwkcLWD4LqGJ7bE7B1XZsEbmfwUAQU5K8rJnEaK0gnhS9SZizv8IkTcT4CDQIDvFNZazTHGPUBUGY%3D" Found http requests in header "GET /gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D" Found http requests in header "GET /gts1c3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEBZwXm7t3kKEEFjsmHQeLcQ%3D" Found http requests in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEAx5qUSwjBGVIJJhX%2BJrHYM%3D" Found http requests in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEATh56TcXPLzbcArQrhdFZ8%3D" Found http requests in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTPJvUY%2Bsl%2Bj4yzQuAcL2oQno5fCgQUUWj%2FkK8CB3U8zNllZGKiErhZcjsCEAdcWuWOzU%2B3YfWP%2Bc9lf9g%3D" Found http requests in header "GET /gsr1/gsr1.crl" Found http requests in header "GET /gtsr1/gtsr1.crl" Found http requests in header "GET /gts1c3/moVDfISia2k.crl"59:T2ba6,Found requests in header "GET / HTTP/1.1Accept: text/html, application/xhtml+xml, */*User-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateDNT: 1Host: accounts.google.comConnection: Keep-AliveAccept-Language: en-US"; in File: "SSL") Found requests in header "GET /ServiceLogin?passive=1209600&continue=https%3A%2F%2Faccounts.google.com%2F&followup=https%3A%2F%2Faccounts.google.com%2F HTTP/1.1Accept: text/html, application/xhtml+xml, */*User-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateDNT: 1Host: accounts.google.comCookie: __Host-GAPS=1:XINCjX7eYQ7qsF-A-SI5PDdDkJDh3w:aD1Fr0zsMOE9rjXjConnection: Keep-AliveAccept-Language: en-US"; in File: "SSL") Found requests in header "GET /InteractiveLogin?continue=https://accounts.google.com/&followup=https://accounts.google.com/&passive=1209600&ifkv=ASKXGp3RoAPMFi1D5ORBXVz_3-qgvvaoO_Xbq0DpOYN_2Y6b5HKHN4-kycfkj4C6lMsFDSw4q-z9aQ HTTP/1.1Accept: text/html, application/xhtml+xml, */*User-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateDNT: 1Host: accounts.google.comCookie: __Host-GAPS=1:XlbOBA3UikTIwYMqu_TYNLap9SLKkw:3sB_QlGYJ4S-igQyConnection: Keep-AliveAccept-Language: en-US"; in File: "SSL") Found requests in header "GET /v3/signin/identifier?continue=https%3A%2F%2Faccounts.google.com%2F&followup=https%3A%2F%2Faccounts.google.com%2F&ifkv=ASKXGp1JD8bmwMlPogrTbm0hK5wZ_8XjO-tmiJhCncpxbLll1LitcD6HSS3ohkPrAOqqKf2sDxwfSQ&passive=1209600&flowName=GlifWebSignIn&flowEntry=ServiceLogin&dsh=S-1676788469%3A1702938004613431&theme=glif HTTP/1.1Accept: text/html, application/xhtml+xml, */*User-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateDNT: 1Host: accounts.google.comCookie: __Host-GAPS=1:8af_SuhMYeUBMilWcQZMaelPEL3xRQ:qR7a4e59ikgqQRvnConnection: Keep-AliveAccept-Language: en-US"; in File: "SSL") Found requests in header "GET /favicon.ico HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoHost: steamcommunity.comDNT: 1Connection: Keep-AliveCookie: sessionid=c546ed69b0fcd334f7e8b8d2; steamCountry=US%7Cd5203a3b374fc04fbcd23a13412805b3"; in File: "SSL") Found requests in header "GET /webcaptcha/ngrlCaptcha.min.js HTTP/1.1Accept: application/javascript, */*;q=0.8Referer: https://www.paypal.com/signinAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: www.paypalobjects.comDNT: 1Connection: Keep-Alive"; in File: "SSL") Found requests in header "GET /pa/js/min/pa.js HTTP/1.1Accept: application/javascript, */*;q=0.8Referer: https://www.paypal.com/signinAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: www.paypalobjects.comDNT: 1Connection: Keep-Alive"; in File: "SSL") Found requests in header "GET /images/shared/glyph_alert_critical_big-2x.png HTTP/1.1Accept: image/png, image/svg+xml, image/*;q=0.8, */*;q=0.5Referer: https://www.paypal.com/signinAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: www.paypalobjects.comDNT: 1Connection: Keep-Alive"; in File: "SSL") Found requests in header "GET /web/res/ec5/d423d5ca948be117596b4b08bd315/css/contextualLoginElementalUIv2.css HTTP/1.1Accept: text/css, */*Referer: https://www.paypal.com/signinAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: www.paypalobjects.comDNT: 1Connection: Keep-Alive"; in File: "SSL") Found requests in header "GET /web/res/ec5/d423d5ca948be117596b4b08bd315/js/lib/modernizr-2.6.1.js HTTP/1.1Accept: application/javascript, */*;q=0.8Referer: https://www.paypal.com/signinAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: www.paypalobjects.comDNT: 1Connection: Keep-Alive"; in File: "SSL") Found requests in header "GET /images/shared/icon-PN-check.png HTTP/1.1Accept: image/png, image/svg+xml, image/*;q=0.8, */*;q=0.5Referer: https://www.paypal.com/signinAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: www.paypalobjects.comDNT: 1Connection: Keep-Alive"; in File: "SSL") Found requests in header "GET /web/res/ec5/d423d5ca948be117596b4b08bd315/js/signin-split.js HTTP/1.1Accept: application/javascript, */*;q=0.8Referer: https://www.paypal.com/signinAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: www.paypalobjects.comDNT: 1Connection: Keep-Alive"; in File: "SSL") Found requests in header "GET /webcaptcha/grcenterprise_v3_static.js HTTP/1.1Accept: application/javascript, */*;q=0.8Referer: https://www.paypal.com/signinAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: www.paypalobjects.comDNT: 1Connection: Keep-Alive"; in File: "SSL") Found requests in header "GET /web/res/ec5/d423d5ca948be117596b4b08bd315/js/lib/fn-sync-telemetry-min.js HTTP/1.1Accept: application/javascript, */*;q=0.8Referer: https://www.paypal.com/signinAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: www.paypalobjects.comDNT: 1Connection: Keep-Alive"; in File: "SSL") Found requests in header "GET /webstatic/mktg/2014design/font/PP-Sans/PayPalSansBig-Medium.eot? HTTP/1.1Accept: */*Referer: https://www.paypal.com/signinAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoOrigin: https://www.paypal.comAccept-Encoding: gzip, deflateHost: www.paypalobjects.comDNT: 1Connection: Keep-Alive"; in File: "SSL") Found requests in header "GET /webstatic/i/consumer/onboarding/sprite_form_2x.png HTTP/1.1Accept: image/png, image/svg+xml, image/*;q=0.8, */*;q=0.5Referer: https://www.paypal.com/signinAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: www.paypalobjects.comDNT: 1Connection: Keep-Alive"; in File: "SSL") Found requests in header "GET /paypal-ui/logos/svg/paypal-mark-color.svg HTTP/1.1Accept: image/png, image/svg+xml, image/*;q=0.8, */*;q=0.5Referer: https://www.paypal.com/signinAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: www.paypalobjects.comDNT: 1Connection: Keep-Alive"; in File: "SSL") Found requests in header "GET /paypal-ui/icons/svg/chevron-right.svg HTTP/1.1Accept: image/png, image/svg+xml, image/*;q=0.8, */*;q=0.5Referer: https://www.paypal.com/signinAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: www.paypalobjects.comDNT: 1Connection: Keep-Alive"; in File: "SSL") Found requests in header "GET /pa/mi/paypal/latmconf.js HTTP/1.1Accept: application/javascript, */*;q=0.8Referer: https://www.paypal.com/signinAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: www.paypalobjects.comDNT: 1Connection: Keep-Alive"; in File: "SSL") Found requests in header "GET /en_US/i/icon/pp_favicon_x.ico HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoHost: www.paypalobjects.comDNT: 1Connection: Keep-Alive"; in File: "SSL") Found requests in header "GET /i/flow/login HTTP/1.1Accept: text/html, application/xhtml+xml, */*Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: twitter.comDNT: 1Connection: Keep-Alive"; in File: "SSL") Found requests in header "GET /errors/logo46x38.png HTTP/1.1Accept: image/png, image/svg+xml, image/*;q=0.8, */*;q=0.5Referer: https://twitter.com/i/flow/loginAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: abs.twimg.comDNT: 1Connection: Keep-Alive"; in File: "SSL") Found requests in header "GET /ts?v=1.8.11&t=1702938671923&g=-60&e=err&erpg=Script%20error&error_type=WINDOW_ONERROR&error_source=https%3A%2F%2Fwww.paypalobjects.com%2Fpa%2Fjs%2Fmin%2Fpa.js%200%3A0 HTTP/1.1Accept: image/png, image/svg+xml, image/*;q=0.8, */*;q=0.5Referer: https://www.paypal.com/signinAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: t.paypal.comDNT: 1Connection: Keep-AliveCookie: enforce_policy=ccpa; cookie_check=yes; d_id=c72bd7ec083b43d9ab236fc0583ef6dc1702937989417; LANG=en_US%3BUS; tsrce=unifiedloginnodeweb; x-pp-s=eyJ0IjoiMTcwMjkzNzk4OTQ1MCIsImwiOiIwIiwibSI6IjAifQ; l7_az=dcg15.slc; ts=vreXpYrS%3D1797632389%26vteXpYrS%3D1702939789%26vr%3D7f0390fa18c0aa38288b288dff0133c2%26vt%3D7f0390fa18c0aa38288b288dff0133c1%26vtyp%3Dnew; ts_c=vr%3D7f0390fa18c0aa38288b288dff0133c2%26vt%3D7f0390fa18c0aa38288b288dff0133c1"; in File: "SSL") Found requests in header "GET /ts?v=1.8.11&t=1702938672564&g=-60&e=err&erpg=Script%20error&error_type=WINDOW_ONERROR&error_source=https%3A%2F%2Fwww.paypal.com%2Fsignin%201%3A29115 HTTP/1.1Accept: image/png, image/svg+xml, image/*;q=0.8, */*;q=0.5Referer: https://www.paypal.com/signinAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: t.paypal.comDNT: 1Connection: Keep-AliveCookie: enforce_policy=ccpa; cookie_check=yes; d_id=c72bd7ec083b43d9ab236fc0583ef6dc1702937989417; LANG=en_US%3BUS; tsrce=unifiedloginnodeweb; x-pp-s=eyJ0IjoiMTcwMjkzNzk4OTQ1MCIsImwiOiIwIiwibSI6IjAifQ; l7_az=dcg15.slc; ts=vreXpYrS%3D1797546027%26vteXpYrS%3D1702939827%26vr%3D7f0390fa18c0aa38288b288dff0133c2%26vt%3D7f0390fa18c0aa38288b288dff0133c1%26vtyp%3Dnew; ts_c=vr%3D7f0390fa18c0aa38288b288dff0133c2%26vt%3D7f0390fa18c0aa38288b288dff0133c1"; in File: "SSL") Found requests in header "GET /ts?v=1.8.11&t=1702938672942&g=-60&e=err&erpg=Script%20error&error_type=WINDOW_ONERROR&error_source=https%3A%2F%2Fwww.paypalobjects.com%2Fwebcaptcha%2Fgrcenterprise_v3_static.js%200%3A0 HTTP/1.1Accept: image/png, image/svg+xml, image/*;q=0.8, */*;q=0.5Referer: https://www.paypal.com/signinAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: t.paypal.comDNT: 1Connection: Keep-AliveCookie: enforce_policy=ccpa; cookie_check=yes; d_id=c72bd7ec083b43d9ab236fc0583ef6dc1702937989417; LANG=en_US%3BUS; tsrce=unifiedloginnodeweb; x-pp-s=eyJ0IjoiMTcwMjkzNzk4OTQ1MCIsImwiOiIwIiwibSI6IjAifQ; l7_az=dcg15.slc; ts=vreXpYrS%3D1797546027%26vteXpYrS%3D1702939827%26vr%3D7f0390fa18c0aa38288b288dff0133c2%26vt%3D7f0390fa18c0aa38288b288dff0133c1%26vtyp%3Dnew; ts_c=vr%3D7f0390fa18c0aa38288b288dff0133c2%26vt%3D7f0390fa18c0aa38288b288dff0133c1"; in File: "SSL")5a:T4a5,Found reference to API "WSAStartup" (Indicator: "WSAStartup"; Source: "00000000-00002108-00000C26-153105863") Found reference to API "WSARecv" (Indicator: "WSARecv"; Source: "00000000-00002108-00000C26-153464972") Found reference to API "InternetOpenW" (Indicator: "InternetOpen"; Source: "00000000-00003416.00000000.65622.00F5C000.00000002.mdmp") Found reference to API "HttpQueryInfoW" (Indicator: "HttpQueryInfo"; Source: "00000000-00003416.00000000.65622.00F5C000.00000002.mdmp") Found reference to API "InternetConnectW" (Indicator: "InternetConnect"; Source: "00000000-00003416.00000000.65622.00F5C000.00000002.mdmp") Found reference to API "HttpOpenRequestW" (Indicator: "HttpOpenRequest"; Source: "00000000-00003416.00000000.65622.00F5C000.00000002.mdmp") Found reference to API "HttpSendRequestW" (Indicator: "HttpSendRequest"; Source: "00000000-00003416.00000000.65622.00F5C000.00000002.mdmp") Found reference to API "InternetOpenUrlW" (Indicator: "InternetOpen"; Source: "00000000-00003416.00000000.65622.00F5C000.00000002.mdmp") Found reference to API "InternetReadFile" (Indicator: "InternetReadFile"; Source: "00000000-00003416.00000000.65622.00F5C000.00000002.mdmp")5b:T8fca,"GET / HTTP/1.1Accept: text/html, application/xhtml+xml, */*User-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateDNT: 1Host: accounts.google.comConnection: Keep-AliveAccept-Language: en-US" "HTTP/1.1 302 Moved TemporarilyContent-Type: text/html; charset=UTF-8Strict-Transport-Security: max-age=31536000; includeSubDomainsSet-Cookie: __Host-GAPS=1:XINCjX7eYQ7qsF-A-SI5PDdDkJDh3w:aD1Fr0zsMOE9rjXj;Path=/;Expires=Wed, 17-Dec-2025 22:19:50 GMT;Secure;HttpOnly;Priority=HIGHX-Frame-Options: DENYContent-Security-Policy: script-src 'nonce-qNlevjfKRLQThiv6Kt9duA' 'unsafe-inline' 'unsafe-eval';object-src 'none';base-uri 'self';report-uri /cspreportLocation: https://accounts.google.com/ServiceLogin?passive=1209600&continue=https%3A%2F%2Faccounts.google.com%2F&followup=https%3A%2F%2Faccounts.google.com%2FContent-Encoding: gzipDate: Mon, 18 Dec 2023 22:19:50 GMTExpires: Mon, 18 Dec 2023 22:19:50 GMTCache-Control: private, max-age=0X-Content-Type-Options: nosniffX-XSS-Protection: 1; mode=blockServer: GSEAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Transfer-Encoding: chunked" "0000000100000001�000000010000000100000001000000010000000100000001000000010e4��PAj�0��B!=ZN��u��X�K_E�1��ax%�u��~�7Q�8z�IN��#��_�o�d��)��2�Q|&��Ht@ΨfƑNZ��:eJ;�F�ĘTg�l�"��5{�i��f7Jk��6y|H�;��g��f�4��s%˳��À��x��fL�Y�ž�K��P�/��@�R", "GET /ServiceLogin?passive=1209600&continue=https%3A%2F%2Faccounts.google.com%2F&followup=https%3A%2F%2Faccounts.google.com%2F HTTP/1.1Accept: text/html application/xhtml+xml */*User-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip deflateDNT: 1Host: accounts.google.comCookie: __Host-GAPS=1:XINCjX7eYQ7qsF-A-SI5PDdDkJDh3w:aD1Fr0zsMOE9rjXjConnection: Keep-AliveAccept-Language: en-US", "HTTP/1.1 302 FoundContent-Type: application/binarySet-Cookie: __Host-GAPS=1:XlbOBA3UikTIwYMqu_TYNLap9SLKkw:3sB_QlGYJ4S-igQy; Expires=Wed 17-Dec-2025 22:20:03 GMT; Path=/; Secure; HttpOnly; Priority=HIGHCache-Control: no-cache no-store max-age=0 must-revalidatePragma: no-cacheExpires: Mon 01 Jan 1990 00:00:00 GMTDate: Mon 18 Dec 2023 22:20:03 GMTLocation: https://accounts.google.com/InteractiveLogin?continue=https://accounts.google.com/&followup=https://accounts.google.com/&passive=1209600&ifkv=ASKXGp3RoAPMFi1D5ORBXVz_3-qgvvaoO_Xbq0DpOYN_2Y6b5HKHN4-kycfkj4C6lMsFDSw4q-z9aQStrict-Transport-Security: max-age=31536000; includeSubDomainsContent-Security-Policy: script-src 'nonce-lyTZEBWRgN_9k-U7DgZDAg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/AccountsSigninPassiveLoginHttp/cspreport;worker-src 'self'Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/AccountsSigninPassiveLoginHttp/cspreportCross-Origin-Resource-Policy: cross-originAccept-CH: Sec-CH-UA-Arch Sec-CH-UA-Bitness Sec-CH-UA-Full-Version Sec-CH-UA-Full-Version-List Sec-CH-UA-Model Sec-CH-UA-WoW64 Sec-CH-UA-Form-Factor Sec-CH-UA-Platform Sec-CH-UA-Platform-VersionCross-Origin-Opener-Policy: unsafe-nonePermissions-Policy: ch-ua-arch=* ch-ua-bitness=* ch-ua-full-version=* ch-ua-full-version-list=* ch-ua-model=* ch-ua-wow64=* ch-ua-form-factor=* ch-ua-platform=* ch-ua-platform-version=*Server: ESFContent-Length: 0X-XSS-Protection: 0X-Content-Type-Options: nosniffAlt-Svc: h3=":443"; ma=2592000 h3-29=":443"; ma=2592000", "GET /InteractiveLogin?continue=https://accounts.google.com/&followup=https://accounts.google.com/&passive=1209600&ifkv=ASKXGp3RoAPMFi1D5ORBXVz_3-qgvvaoO_Xbq0DpOYN_2Y6b5HKHN4-kycfkj4C6lMsFDSw4q-z9aQ HTTP/1.1Accept: text/html application/xhtml+xml */*User-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip deflateDNT: 1Host: accounts.google.comCookie: __Host-GAPS=1:XlbOBA3UikTIwYMqu_TYNLap9SLKkw:3sB_QlGYJ4S-igQyConnection: Keep-AliveAccept-Language: en-US", "HTTP/1.1 302 Moved TemporarilyContent-Type: text/html; charset=UTF-8Set-Cookie: __Host-GAPS=1:8af_SuhMYeUBMilWcQZMaelPEL3xRQ:qR7a4e59ikgqQRvn;Path=/;Expires=Wed 17-Dec-2025 22:20:04 GMT;Secure;HttpOnly;Priority=HIGHX-Frame-Options: DENYCache-Control: no-cache no-store max-age=0 must-revalidatePragma: no-cacheExpires: Mon 01 Jan 1990 00:00:00 GMTDate: Mon 18 Dec 2023 22:20:04 GMTLocation: https://accounts.google.com/v3/signin/identifier?continue=https%3A%2F%2Faccounts.google.com%2F&followup=https%3A%2F%2Faccounts.google.com%2F&ifkv=ASKXGp1JD8bmwMlPogrTbm0hK5wZ_8XjO-tmiJhCncpxbLll1LitcD6HSS3ohkPrAOqqKf2sDxwfSQ&passive=1209600&flowName=GlifWebSignIn&flowEntry=ServiceLogin&dsh=S-1676788469%3A1702938004613431&theme=glifStrict-Transport-Security: max-age=31536000; includeSubDomainsCross-Origin-Opener-Policy-Report-Only: same-origin; report-to="coop_gse_qebhlk"Content-Security-Policy: require-trusted-types-for 'script';report-uri /cspreportContent-Security-Policy: script-src 'nonce-gY4VwqHnL1-n2qxJ7hN-fg' 'unsafe-inline' 'unsafe-eval';object-src 'none';base-uri 'self';report-uri /cspreportReport-To: {"group":"coop_gse_qebhlk" "max_age":2592000 "endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gse_qebhlk"}]}Content-Encoding: gzipX-Content-Type-Options: nosniffX-XSS-Protection: 1; mode=blockServer: GSEAlt-Svc: h3=":443"; ma=2592000 h3-29=":443"; ma=2592000Transfer-Encoding: chunked", "GET /v3/signin/identifier?continue=https%3A%2F%2Faccounts.google.com%2F&followup=https%3A%2F%2Faccounts.google.com%2F&ifkv=ASKXGp1JD8bmwMlPogrTbm0hK5wZ_8XjO-tmiJhCncpxbLll1LitcD6HSS3ohkPrAOqqKf2sDxwfSQ&passive=1209600&flowName=GlifWebSignIn&flowEntry=ServiceLogin&dsh=S-1676788469%3A1702938004613431&theme=glif HTTP/1.1Accept: text/html application/xhtml+xml */*User-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip deflateDNT: 1Host: accounts.google.comCookie: __Host-GAPS=1:8af_SuhMYeUBMilWcQZMaelPEL3xRQ:qR7a4e59ikgqQRvnConnection: Keep-AliveAccept-Language: en-US", "HTTP/1.1 200 OKContent-Type: text/html; charset=utf-8X-Frame-Options: DENYVary: Sec-Fetch-Dest Sec-Fetch-Mode Sec-Fetch-SiteSet-Cookie: __Host-GAPS=1:rYTHzWFwkz-QHMPxqJXJjquc0bLk_w:jWw0QKqNaw-SrYDu; Expires=Wed 17-Dec-2025 22:20:05 GMT; Path=/; Secure; HttpOnly; Priority=HIGHx-auto-login: realm=com.google&args=continue%3Dhttps://accounts.google.com/x-ua-compatible: IE=edgeCache-Control: no-cache no-store max-age=0 must-revalidatePragma: no-cacheExpires: Mon 01 Jan 1990 00:00:00 GMTDate: Mon 18 Dec 2023 22:20:05 GMTStrict-Transport-Security: max-age=31536000; includeSubDomainsCross-Origin-Resource-Policy: same-siteAccept-CH: Sec-CH-UA-Arch Sec-CH-UA-Bitness Sec-CH-UA-Full-Version Sec-CH-UA-Full-Version-List Sec-CH-UA-Model Sec-CH-UA-WoW64 Sec-CH-UA-Form-Factor Sec-CH-UA-Platform Sec-CH-UA-Platform-VersionContent-Security-Policy: script-src 'nonce-jm-dC0XooXDKHjXBLoJy4Q' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /v3/signin/_/AccountsSignInUi/cspreport;worker-src 'self'Content-Security-Policy: require-trusted-types-for 'script';report-uri /v3/signin/_/AccountsSignInUi/cspreportCross-Origin-Opener-Policy-Report-Only: same-origin; report-to="AccountsSignInUi"Permissions-Policy: ch-ua-arch=* ch-ua-bitness=* ch-ua-full-version=* ch-ua-full-version-list=* ch-ua-model=* ch-ua-wow64=* ch-ua-form-factor=* ch-ua-platform=* ch-ua-platform-version=*Report-To: {"group":"AccountsSignInUi" "max_age":2592000 "endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/AccountsSignInUi"}]}Content-Encoding: gzipServer: ESFX-XSS-Protection: 0X-Content-Type-Options: nosniffAlt-Svc: h3=":443"; ma=2592000 h3-29=":443"; ma=2592000Transfer-Encoding: chunked", "0000000100000001�000000010117c�RMo�@��+��U� b4((*+$��4��e�O��]��C'��{/3y��{�m&��X��4`��U��/p��d>uw��w�.XƷv>}�]�]��|�=�j��A��f�*/�8.�"RgU9HIR0��+Q��C{JG1�KDh��@�}��3zn�i�>��sLҔ�u��fx��<��v�nHR�!��Rv��C��N�(?�N��"S�=O"�)�x\�bi��{�t� Q4A��2�_��h�� Ƌ�eeUq�w��t��", "0000000100000001�000000010000000100000001000000011bb0��X[wں~ﯠ^�)�M��-$��r�bɶl+ؖ��-i��Y�^��K�O�O3�ш/-j�E�3.��_�o�C��+8ؾ�)�D��H�A��_�a[W\�C��L�N��&�w��F��;0��e�c]��8�p�dLpp]�qH0fF$�q�M ]:��h`¼g�j�w��5�N��;�tQ�V��H`�Y��0t��9N�)or��vr_IC��|Q|g�ru�>��oDO[��T�k{��# ��~�d�ߠӨ��j�hO��yz��jI��M��xj��ǈX�Gr�w;D?��3�"[d�$��{3�'��Ԁb��E�T��<�~��b�&�7{b�z��4��jc��"upuџcܿ�0Ŵ��3:��V�Dj��)��E�XҊ�ZPk�P��"�l��p�c��|&r>�,�\�!�:-�CW��t,z||J+�,m��'E��<)��Q�69�A�a�g~�n�Fg��O��ڤ�d#�s�M��D��W(�HE��mt��=�8��.O0�O��,��H��![~<��L�4��"{Ɠ��dx8�8>K�!�u��K��lݜ��lh��K��k�a{4aa�ڏK��G$H4�>��=��h��'��0&�$�F(gY)s�/�&�~m��WZV�;x�X�.P��M=�N¤��2��i�_��A��J�.3�fArmW��X�>a�wb��IC� h�{.�Í,"��۷��EI�8�2��ǉ��K��-��7��^6=�9�&g��0cK��`8EAI��3��x�H��P$�i&_J��C� eM1��K��L�kZlD�Dw*�&{t-��3��2.$]�"'�U�M��zX�5PJ&�X�6U�I�l��W��w˦�1�X]��W�� 7�"8��ՔO��&��b�$�6�΀ZI�M��dH�Oiyľņ��>��,ĉT�wv��f��g��u��Ye�0��=_ns��F��f�z�땨;��]dp�ٽk�(v�Y(l��I�>^��JC�ﶚ��=|��ω��JN�c��N�nMqu��1�^ԏ��פB��9o��O�B��dݗ/��Yf" "�q!�� x\��Eyj\V�)��A (��H��GCJ _5+�[^��ף�Q��v��X�c�n�'h��e/��UY��\+qw1r��m�h�/ƸыL+8�hQ�m\w��}W��ys|�V͓��֯��i�b�z'%�9-ߩ��9�P��x4Dc�}�]��1��x�)FE2lt��]2{�Zg�Y=�߾e��=>��{�g��s�|��|>��5��ۇ#��X�٭=ձq��֐�N��x�,|�<��]�ea��'��i}A^@�po��;��n�~�tye�&�m7*^�H��'��5�o�u`/��#*��4��G��t��|Wu&s��hV��3Y{�'/�{��CN|�[[[V!��B8�V!@S� �j/��2��k��2+��o6��,�"�ܸ}��ͽ�fY�{%vv9M|��^�]�t '�,��eBn��F!�.Db��V��BH�l.�Ԅך�l�h�l��d��J�L;$��^mj�5��.bu+��J��L%��/ǈ��Y^��XPO�<�,��X�*x��\��l��v`>�~��B8an�L9�_O��SrF��[]R��;H�h��z�tK��2�7�'h@=��w��oq�Ȏ�ӟ�l8m}'�<3OZ��+��V�Fੴ�@^D�G��M��D�0�xIP|��f�F��6�*{@�L��e�4��e��f�?��yE簌]p1q\/3bq��7q,��ăG|nM$&,t!B��p#/A��A��0u��a��B��Ҷ��6�9�}"�%կ�_�Մ^�X��G�d`��f��Dx[��", "00000001�00000001]0000000100000001s00000001�0000000160000000100000001�00000001+00000001�00000001v00000001:00000001c00000001M0000000100000001�00000001�00000001e00000001U00000001�00001019�Աǩ�&q7�N�)��YR�ek��I@��n;qd��{xx��@�_؃��K��[ ��8��l��K��y�E>�g�ߵN^}=m��M��ݍ�Ǉ��}sx��yn=s�?xNW��ߚ��o�OV��ã��^��60��Q��{��r��e��ͱu��!�J�EE��{X&��d��.��GY�1��9�ڧ�J�8�Dp��e5P�L�'�=��5��>��G&. �P�$�O��_f��|��Cdb�(�\��!�d�Ţ��UF&�u0��mz;�s��sK��)�B�TLG��1A�s�$�tթg�rv$�qz�ϳz?��O]M1�/�a�+�R�L/F"�9��Qf��fK^`�qM�-�_��߆�r9?>ʒ�|��NV�C�1��]�}�Q-f�j(*4�0�!��PE��%��絇�&IO_d�K��*�%U��㌧��#�\��#��"�ě#1EϾ��Ԕ��rC�W�?R;Ɵ��Xn�/��", "��>��q��ez2��e2��ìW��b�Z��+>_�.��v�O�q��ng�$�݀x%b�=�1�D��%��=�J�~�[��!+w��HUu��ຘd-��;�lLe� ��DP��WHkhA��ڜ� "�r��(��Z#o:��>��ݥ2��W��D6�'�K��ghŏ�u�ܩ;\�gR��Z�]&��]�p6��@��8C�V�U]d�NT��~��gÂ�w�y͞;�=|�J-��Uj}vQj�X�2�ڒB��t�i9dsi�M�g��N%�e�7��{��Ǘ�->��;(R��a4u7��`�nA-qh�P"h��5�G�Sc�"�su��(eltrm�4P�vl]��!Uͤ袈}��k;��;��Qa ��<�Cf�о��$��5�Q�‿\��XS��s��~l;o�kH>��l�TM��֊gή;[V�)��ZbE1�ѧ��w0�V`e/�\;N2@*O1�j�_/X��/U�h��!��Gh�N�FAvƠ#��̀�d-U{@��K/�f��O�W��@n�IS��l�`�j��س%�9�-k�b��`!u�hZv1�f�z��M�]��@�piF0)�&0Ԫ�_��/�e�Dy�5��r�a��T�[��)iti�Gf�"�!0+�/��S4Ee�ej�&�V�c늄�k3SH�kjd��ښ��*1:��8[(�2�-/W��1�ď�+`E�2?��B�(%��̛ӦC��T`�"]v��!,`/�P��C�9>��+��7�gʂ�,��+ަW��]0xe�?��ܷ��D��-��a��Cc�ʋ��m��?S��A�9QȌmu��Njftj�=��}��US2`(�F�$��=;~+�Y>9/ێ��/_��F�)�I5��oYS��2.��ߍ�Nڒe��ׁ��uI�_)�L�Z5��HC*҂�$w�a�ZI�K�I$��Sg$��?�H�5�~V8c��K�T�4��إ�]�}p=��K��9�{I��l�s�Թ�s8 lh��6��b��B.k�۷<�r�{��`��S)U�kp�5�S��I��JcO��{=��VOL��`Vz�"�[4��4X�3l�34e�<�.��m�цt��`�� T*��Ƥr�68G��)��Ѣ��r�؍��C@-��?�e�G716 yj�mA%_�4�hqm=�q5�]I�.�J�r��qU7�w��V��m�� A|�N��L~e�Aˈ��G��ܛ�́Ƅ" "%�D.J{�`��=??��Q?��mߝ��r�ovit�V�o��oȲۦIҼXq�˥�a��ىP��c�RaW�R�gi��-tSЍ��m��ڷx��)��f�H��KtMs4�jPZN��K��I�F�9��5��e��p��ͱ�]1�m�ڱ��Y��:(�nV�Wخ�Pq�Y��t>��H�&�ŧ��>P�'$�|cj4�&�۫䄒�Fz�u�rbh�NZ�`��+w�*��3B��X�I�� }�(��DBA��%C-q��e�C��#3�@ባSmJ4ELuC�<˄/�[4��,��,3��˄�ດ.�=ń�i!@��p��S�Mr#e\��lC��bfL��DV � #ww*)T�s0j�@P�6�*s��eV�jl�F�A�j�Y^�h��.�r�&ɛr��c��C��F��S��ΩXQ8(>i��2Y1��δ��k��Ϥ�G/�]��x��:��??z׾M��N�S��A��Ӝ��2alG>;��S��H#k淄=��Y��f8s&n�|��1,�m4��u��-��&�˨��_>�7��2��itZF�۪�2��@��P��6��K��#��$�A��lͦ��h��xo��Թy��h��iu"�*Ȗ��&�2*�/e/�,��ZeC��ߣl�m*�jP��s�WGb��g`}ں>r��9\��R5�Թ��#��4O��_L\��s�{�*t�'�/��#��ċ��H�V�M�x�i��d&�;��I�ϭ��D�س�g^A�d2C݄�Z<�N��hv+�\��_͐�Wb3(��^��*^zVS/��Ѽ�W��*��u��+��{�|:�gUTdͻ��⚆/��|��']9��^��?dD)��f�Q��#��W/@��į�it��)�2@��zj$�J�x(�䛴��!w��ѭuyri��u�1��t]O �؞~�'�J(� ��%��׋�}N��.'[?u�J��"�@iq��jʥG]Q�\Ư8��V`?z��.<$�Q�T[h:�Zc", "��+��f�`�ͱ|��P�t:{��c��[K��%�M�7Z:�X墚z�~b�>W��:�[�\�ru��)�v�.F�KC��L�@��]�d��#ר�'�(��M6��Ӫ�y��S��I�yѭ��T3J,JO\ᐛ%*fsU8t\�G��i��=�_��%Σ�(Q��U9m��?H6�-k]J�v�d��]%wF�#(��?��", "00000001�00000001]00000001m00000001S00000001�0000000180000000100000001�00000001+00000001|00000001�00000001L00000001�00000001�00000001�00000001�000000018caj��q�״��k��( �ؼ��ϲ�X��LbZ�$�z�]�])�|O*F��ۧ% b�5 F��(��C�##�k�ϭ:�"�1�kH��0bZ�X�T3��3��Ċb-+��/�q��J�8U��FZ��Seg1-K�@��&U��yx�b��_��a[�{�Nw��t�ۛ��L�~�s{��W��QF�ZI�/K��v��"hg85�i=x�.��I^��W1�+i�z�|5ĭj��A--A5'=��P��h��$EO\9x�Ǡ�:��8�FXk娔�b}Gs[�%>I3��$X��\�A.|]q��w�޲�N��{oY\^��bqp�g;~��#��u@�ٿ�E��!��x��V�>�T\��Z9*M�t �!yiR1iR�z��A��Zs1�H^[��yZ��pv�4��!F3�-�Ѵ՜��8�B�t87o�tx] Uݻ�F��©��T��ڀ�w燷�v�3̉y�JZ�Oл��n�K�~�Q��y)E�Eͥ4�g�(�=�ayi��"ZO��-�B�p{��>p�jPQ�]h}��Zf1eH^+'cpr�YUr��O=[mb��5�qj�9#�]1�T�%��&��q�{��!N8Uv��2�^�y��:fϾ�ng��;�㷥�d/#��aG��4��կ��G)�x�js �"��;/��'Ś{�}a|�R��9Ɲ��N�?|)�D��XR��Dʯ��WG�]9��w��)vـ�t-=s��a2k��5��t�M��Û��xx��=�W{&�ũ;9F�_�a~-z�Y��k��Wj�d"�]Qr�9�c�9߀�F�[��3$;7�4�� ׌�C:�+��9��>3�~ܚ��U��'s]�3f��ٍ�Htr�Y88��Q��=�>]T��?f��|q��e<�rP�M��Q�~,�B��HHM1@�:H��Ǥ�+�(Ơ˫2�`n��"��M�xv��ƶ��̆�᥊��9��p�ͿH��̉�R(��>_1�l:�~�v4�9�g/)%��u]�", "�Q\�'��D��v�'�T�C�j%?�c��t�.�^�г��Բ^�J��2�$��+��@-HM��_�;`�en�=C��e�t�]��i�g{��_��O(��RR��&�K]q��)��^_��`��6_��8�2f��[�*�"�s�}y3qN��>z 鬂V�Jڈ��(&�S�~Z5E3o�5"��~5��σ��2��?�B|�d~��N��<��iJ��Х�.��q(�q�/>д�QRJ�tiQ_�.\�Bl�7�#_��(ɣNKR��](��.��e�1U1Y��@w�(��F��I0F�t�W��޼!�]��b�*��i�H=H�$6��ӊ��֩� lw}�t�Ժ�''�t��)R�;��{׻�8U��t��]'Luo��?�Ȇ��d�!B�Ӌ^6�f�A��=_o3̑}��eV{��0n�V�>�(E�H�*��R3F��|Y��dq"�z�DN��6{<��g-br��K��]03!�9��*��0��lPu��l>�,P��z��z=��W��TN�I�t�F)p��盐Y�ڬ+GB�%�tf�[4�cbw��w�1��]�Yi�S��HN��H'�|�#;�� o Z=�;җ�,�{A�"�}��4��1��vW�T��C��(��)�Np9=��]��ɯ�~�wX/�.��b�n4��6��S�p�hO��-��$�t��![��v)�}��#��D�/�axI3�ۖ�Y��}��B��r��`g��I�\��z,��4��e�I��l�7B�3?O�tr��M3>�J]1�T�!��X�AtqyE�@��W�d��", "00000001�00000001]00000001Y00000001�00000001�0000000180000000100000001�00000001+0000000100000001�00000001e0000000100000001X00000001�00000001$00000001�00001mccd��0G<�L��b;�y�V"�=��%��D+�b$��b�c�X,��L*�<��hVƒ��t�ly�;F�o��8�0��⏗F�r|�C�$:��k�� _��~^Z>Xa+�s��~��ߴ��_��{$�ܢ�2�8�Ea\u��?8d��꜈��?�RT�!��s�Cj��j��C-�U`i��u�h��Ae��(�X�Lf�iւT�jr��UP67��*@1MeaH�8?�;f��!��o?OH�?�̎�G�;�vaG��D��e�B,ڏ�m@T��FK�p��R�u�A�nj`�@�Z��f_q��Z�lf�'7׫}�i@ C!�Kqx ?��u��@+@k|��V��&��p~�Ȑ�lZ0��4�p"�a#��؎�$ Z�yk��I�I��H��x$N]��VP��U-7J�U�ٖ��ǉE6�(��э�!�ռ�3��J[˛xP�=�a��ꎂ�f\a;JQ��׬̅�y`�v�t�$/��̩!<��6��<��`u�T�+�#��'�ݯ�_�,�f;�K�V�]�THA�u��9�$�_#�ۣru�nf_*��E�l�q/�DmQ�tf��v�R��1l��r4�]j&�5�z��XP�b&��FCnw2�"��Yăڡ��k||��O�'��X�s�K��q��$-��[]�K�k*�k;q�EAr?�/=e.7��`��n��f��6#�E��,��]#�"��$[��$�ǷhJ��8ǐ��l��J5�Gc�ϟ�O��9vpZ�R�nS�J��Evga��v"�,δ��{*IF"��iX#�Ul�oL]`��Ga�'I��Z��JW9嫬|�S��61�ǧ�ZJ}:[��ݫ�S9�![�U�Nq�W��j�^k"Z=�/�Yk��,J��N��՞�ȱO�W:��S&�3}��P��Mب}�SC��C�a��^+��g@��j��M�5�T�J��ƃ�>%x��*�3�P`&�.q��h��r:��^N�P;��܆��ɧ��S�1qE��i" "G�!&��Q��=�ɷ1l�MB��[��QI��5��8��x�2hZ-~@P��yD2��5��̞��*��T��b��H+:��-��@~��2�5��V��.�:��W�G�6T/��WW�z�-�z��D�7m�U��,�א:h��F��,�~�E-}�AӒ��+Xp�mD�h��O�o�Ԑ��v��`�5j��M��,�߆�Cr�V\1N+�: �iW��H��Y�~�dCn�c��-ʤ�M��W��*��7��ܢ8�u\Y�FO��FOк�wԼ��y,��p��;��Yb��j�j^+F��)`��WU�vp�?��K&��+�'��N([��#�� WC`�t�m�M�\��o{��Յ��ʆ�q3�rOF��÷9)�6��|�I��_K�:*ޚ��H)��y�3�m��w�QiUzp9��mG��n9��m�+�Or{[�w��*�Ox1Pe��Xu�<��!��̊�h*P��J*��T�#E�u��up�"Q�U�:�ޓ�{�a��;��?��q�v&�a�o(�*o�!~��DC�O\}�l�T��k��'?�q�f��6�֒��A(�ϧ��~��wӫ3MR�*��H݅�2!��˷��j��,��$�S>-*=�;�t��pI�w\=d�-��݅��%�J3�?��ySRY�e��Ӝ˓��C &��A�s�/Km�Y��ŋ�\�V�$*��J!�U��'��!�e�԰��&��I�hK�~<�f��MN��ٝU��5R�4j��"muq4�5�ڕ�!�2Q){R@:l��z��LL�Q�q\�)�f��q��9�l��o��n�k��?!��"3K��&Kfi2C��j=�$��?��m��/hZ�'k�-��n��]?"��Y��(��E�RKH�(�8�M�_m�_!��T�+�я��&�?��Xu��}~Qe(�a��C��!�!�8�?�~��G�I�O�t� �f:dz�k(�lE�2�I�-T��F��N��c��(��G:O2K��-��=��u�?w5c��'��#��.�Ut�#�4��7��n�֛��g�G|M��=��?��3Ӎ$��R��Y�{��Q��(", "F�UC��˧0-�2 &�Ǣ�x�Aa_�;�5iB��W�p��g�W�ey��42Wެ<��K�1�r�j�ŎtI��#$�b�FD�kT??�Ő��j��za��;��X�Yno��Dz�,Z�e��QJ�D��OQ/�C#K��m��̂g:>�z�r:��Y0��~8�W_@8f�t|�*�]ݭ�8��Y0��sCO��7��G/��䈱�8��a�%v�g(vv̘��X�_BX>F��.��B�u��X��"�*��;Gx�!< l�τi��m��&��HsS�+��i<��H~��N ��4��y#L}�'�t00000001�00025f��`��4AB��n(�A��k't�]�ڕWR�k��zWp��@q��ΘpH^�֮B&��m�5JA��W�A)%�x� �1��"��%0�3 E1\�?�dM#�'��(ܾb�b¾R�}��5Z�,ũ�f"0y��Y�q��n�)�?Q�Y� _�/��:�a�B�t��U�k��5r5T�5"�p��G��T!�(��q��̴�[��[��R�v9��sj��-��f�.V#y��l\6�5��_��۪%�7G��F��*w)�|e틴��ɨl�5+��-C�S�,~<|}��V��d�z��:e^��wMP�l}ʊ��KMTr\��ؚX�*��lCA��LK��J��`�gah�>��"�v�Z'�D?�x9��(�f��i��A�q�a�G��X�=p|��ÉN0d��X*r�T�B��]�@kiW��I�z��zTs�Cx�Z�Po�İFaq�3YN:�9�r7�8�*'D��|�ѹt�*�8�;w�h�^�!M!£��)�(4�hyh4ų9N��#��ˎf��", "0001�715]�o�6�W�R�f�q�&K^�y]�d��6@۽)�<{�!O��n��'��,Jԅy$թOma�ǻOy�I-�(]�)��o=��)"9,�E��Ô�Z(�E�]�)��A�*K0ŀ�F`�);�ǀCE��0�q??0E䄫(LIK��&U�r��RU��h�L��Ksa��V�v:�SL�a=�]�)��o=��)"w�ϑ��z!�3��UMW�*��"�l�X(X3U�ʈe�;s/P1Li!4�[��L�5�u�v�A�K�b��cõ�ǂ��!��h��`Z��M��S�i�3�i��蘆��.lU#e��q��4�ң��׫��}�V�ɒl��7�@��]QI��R��y��O��Z=I]��d��m��$F�İ&1"'[hQ��??[�r3��ft��q��`+tx�Rkǆ(m��4�b@��a��w��zvU��N��o��^��k�_��_�]��7iߛT�7)��B��Q�i&v�F*��P��a>��D$�Y�h�Oxa~��9??H/K�Gz�yN(̋��a�"?#�@gec��"�H.�4��4�v�z�j��O��iO�р�k�\��0P|��JB��ar��iJ弝~Y|_��؏�s8F��=Ǣ��"�H绘H�ؗ�{�Q��t��O9��@ٿ��O^��X��US?X��<�%�z̖��p��fĶ��/<�|^|�,� ��l�<��Xq��Gp�Դ��/��W4��O.��n��<��8`��G/��>k�/�w�?G�KB�Og�o�Vۗ�0^fak/��p�Iw�v�8��ȉ�Q��n�\��%?I֟Bo=�i[��yS�I;��L�\_��K�|�/��JZ2�7��R�u:�e�M��JҾz�0�~�z}�e�Q|�5q�o�ck�-��o�[�$��_��y?u��M/��ǳ$�˸��p��vu:��.xu�?�?M��>�H��}R&��Y�(&%f�g9��N\�!:ڽ=)C��J'A*��yy/�7s$��E��R��z�/�KJ��DQs�N�Y��u`{�d��L(`9ډ�!�Fo{\Y2lŜ/��$w��B.Ir_D��*��,[��#��i��0��Ddp�,rHK��R�K�S��d��O��í�$~BF�[HL�Z��X[+q(�5̲zj��$��4�G>��S��C��V�K��/��)�xy$�g�3ZLp��>8$��T�]��", "�oa"��1_$T�0��V>�;��E��1�ԯ�)��s�*ǘ��\�Bl&E�F�N��ʻ�/G��yCJz��"&Ci��<�^�W�C��8��x��q��t.��<��n�^��5�y��S�XSK'sy�U1�3;=�?gC�@@2*uo�#CH��6�"C`��!Ql�W�5�c"`��ҹ�rZ5�yO2l��Ȑ�>0�߀!e ��75�v��A��evg��n�7��1[��XM��oX�o(�t.�\�oV��@�ӂ�Z:�-~#�;��7`H@�A�o�UX,�*�.��n�7��1[��XM��oX�o(�t.�\�oV��@�c�&(��H��&z��^��vX�Rf1H��~�/��$$GN�pU��$��r*�-��}a��", "00000001�00000001]00000001M00000001o00000001�00000001@0000000100000001�00000001+00000001>00000001&00000001�00000001�00000001�00000001F00000001m00000001%00000001�000001�4fcKU?��J��L�N��?_`!�vggH�L�ofv��̎wƪ%Ӓ,��nm]K��5��֒��b��:��W�@��I�Ag�5[��*��D5�`��5h�^+�f�l�K��1��:9=��X^e�E�O䎜�dp@LO��2��5t=)��22�Xm�Nt�U[��-�??%�Iu62��&hڒ�:9m��X�e�E��O䎜�dp@L[��2��5tm)��D�-�y��jK�F-�0iK��W�"j�~��)�P�B��K��,�/r��9y��d�etkk��Rԭ�=y��7�2P�Zif��:-zhٟI��Ƕ�gG.-�1�c��\X։�ϭ]5�%�(b�G:Mcb�HR��Ƴ��i�u�ܘ��<��T��"j+eC}&rC�K��ӼsI��g8�)��T�0�Iy]��|��+em �ΔG_��])f��*��QxdԬ�`�)g�W�R��vǸ��lŻ��t�³��<+�$�ͳ��7�V��يw��gŃ�Ι�@�ֱ��E�v�'hE3&�M>!#��e�S�;!#{t3�Lm&6�t��g2�9�S�~Yoo�i�氋?ޗ��N%��?'��/��9��Z�Z ��v�K��uv-L�e$�Ψ��j_��Z&?Z9zG1��}Z��ڣ�h!�}h!��bh!��PZ�2��p9��%(KU��(0,}Q`X"��F�!ɭ��ü��EA!��BR��d*IT��(,$MQXH��5��&��<��`�Z,�9W��"��`�F,�9�f�#P��xE�;��Uf쎅�/��u��q/~��j_g$E��3��̺�GOf��#��i��d��x8��`v߉d0�f�6ߥ�p]om h'��f��>�П��r�]��Q��oT��l�x��kj��p~�z�(��C��Z��b+3��C�(��J�d7�m��lZ��\��[=��&�˻��J��4X��/��i��;Vi��:�O��C�h�J^��)��"5c:T456d,Pattern match: "https://steamcommunity.com/openid/loginform" Pattern match: "https://store.steampowered.com/login" Pattern match: "https://www.facebook.com/login" Pattern match: "https://accounts.google.com/" Pattern match: "https://twitter.com/i/flow/login" Heuristic match: ",b.CD" Heuristic match: "9].Mh" Heuristic match: "?-.sE" Heuristic match: "G\4.hT" Pattern match: "crl.microsoft.com/pki/crl/products/MicrosoftTimeStampPCA.crl0XL0J0H" Pattern match: "http://www.w3.org/Graphics/SVG/1.1/DTD/svg11.dtd" Pattern match: "http://www.w3.org/2000/svg" Pattern match: "crl.microsoft.com/pki/crl/products/MicCerLisCA2011_2011-03-29.crl0]Q0O0MAhttp://www.microsoft.com/pki/certs/MicCerLisCA2011_2011-03-29.crt0J!P-f+;z{]6mWXIY8Washington1Redmond1Microsoft" Pattern match: "U.HzsR/^pTjT0+" Pattern match: "I.HTQE/L+#&'73267#&&5466367&&#O" Pattern match: "https://store.akamai.steamstatic.com/public/shared/css/motiva_sans.css?v=Rc2hpzg2Ex3T&l=english" Pattern match: "https://community.akamai.steamstatic.com/public/shared/images/responsive/local_menu_hamburger.png" Pattern match: "https://community.akamai.steamstatic.com/public/shared/images/login/emailauth_icons2.png" Pattern match: "http://crls.pki.goog/gts1c3/moVDfISia2k.crlx-" Pattern match: "http://store.steampowered.com/subscriber_agreement/" Pattern match: "https://community.akamai.steamstatic.com/public/images/skin_1/homeBoxBG.gif" Pattern match: "https://community.akamai.steamstatic.com/public/images/header/lowerBarBG.gif" Pattern match: "http://crl3.digicert.com/sha2-ha-server-g6.crl.http://crl4.digicert.com/sha2-ha-server-g6.crl0XyJL2" Pattern match: "http://www.w3.org/1999/02/22-rdf-syntax-ns#" Pattern match: "https://t.me/RiseProSUPPORT" Pattern match: "http://www.youworkforthem.com/product.php?sku=T2982" Pattern match: "3BUSpaypal.com/9217337514764831076937237002421031076865tsrceunifiedloginnodewebpaypal.com/9217347248076831077467357789921031076865l7_azdcg15.slcpaypal.com/9217216789107231076868362258671031076865vreXpYrS%3D1797546027%26vteXpYrS%3D1702939827%26vr%3D7f0390fa" Pattern match: "3BUSpaypal.com/9217337514764831076937237002421031076865tsrceunifiedloginnodewebpaypal.com/9217347248076831077467357789921031076865l7_azdcg15.slcpaypal.com/9217216789107231076868362258671031076865vreXpYrS%3D1797546028%26vteXpYrS%3D1702939828%26vr%3D7f0390fa" Pattern match: "3BUSpaypal.com/9217337514764831076937237002421031076865tsrceunifiedloginnodewebpaypal.com/9217347248076831077467357789921031076865l7_azdcg15.slcpaypal.com/9217216789107231076868362258671031076865vreXpYrS%3D1797632389%26vteXpYrS%3D1702939789%26vr%3D7f0390fa" Pattern match: "NOFORMmicrosoft.com/102433237894403108561027971357230938743SRCHUIDV=2&GUID=426377958C8445E3B4EA69482BD0E747&dmnchg=1microsoft.com/102433237894403108561027971357230938743SRCHUSRDOB=20220131microsoft.com/102433237894403108561027971357230938743SRCHHPGUSRSRCHL" Pattern match: "IESS4Abing.com/1024294378944031085610419731758630938742SRCHUIDV=2&GUID=DD3EB05AD9C54D24A2443E918EB9AD6D&dmnchg=1bing.com/1024294378944031085610419731758630938742SRCHUSRDOB=20220131&T=1643622536000bing.com/1088404823347231085593429095039930938742bing.com/10" Pattern match: "3BUSpaypal.com/9217337514764831076937237002421031076865tsrceunifiedloginnodewebpaypal.com/9217347248076831077467357789921031076865l7_azdcg15.slcpaypal.com/9217216789107231076868362258671031076865" Pattern match: "3BUSpaypal.com/9217337514764831076937237002421031076865tsrceunifiedloginnodewebpaypal.com/9217347248076831077467357789921031076865" Pattern match: "twitter.com/1025137537536031223715378446171031076865guest_idv1%3A170293801670803410twitter.com/1025137537536031223715378508671031076865guest_id_marketingv1%3A170293801670803410twitter.com/1025137537536031223715378243046031076865guest_id_adsv1%3A17029380167" Pattern match: "-tA0RUP2UW6VoYaailsU4XBUQ0zuDGbxeUbAlNfZp6TmbxxBCkdkLtk-iYgmAwww.linkedin.com/9217365405145631150289378930546031076865bscookiev=1&2023121822201780528046-5688-424a-8749-1cacd29e9e09AQFwomCC5tEmayDQOtvnI4RPaKanNCWlwww.linkedin.com/9217365405145631150289380" Pattern match: "3BUSpaypal.com/9217337514764831076937237002421031076865" Pattern match: "twitter.com/1025137537536031223715378446171031076865guest_id_marketingv1%3A170293801670803410twitter.com/1025137537536031223715378243046031076865guest_id_adsv1%3A170293801670803410twitter.com/1025137537536031223715378368046031076865" Pattern match: "linkedin.com/1025365405145631150289380352421031076865lidcb=TGST08:s=T:r=T:a=T:p=T:g=2664:u=1:x=1:i=1702938017:t=1703024417:v=2:sig=AQGBXg_IWhm_XrpjdjUofqkOilrExeOjlinkedin.com/1025233933376031077065380399296031076865" Pattern match: "MUIDB01E31D16CE68652038B10EFDCF246489www.msn.com/921613855257631155319395805546031076865sptmarketen-us||us|en-us|en-us|en||RefA=BB95D0A4B0CA48908A10C70807B5513B.RefC=2023-12-18T22:20:34Zwww.msn.com/1024226694886431223916396008671031076865" Pattern match: "921613855257631155319395836796031076865MUID01E31D16CE68652038B10EFDCF246489msn.com/102513855257631155319395789921031076865USRLOCmsn.com/9217226694886431223916396008671031076865" Pattern match: "3A170293801670803410twitter.com/1025137537536031223715378243046031076865guest_id_adsv1%3A170293801670803410twitter.com/1025137537536031223715378368046031076865" Pattern match: "-tA0RUP2UW6VoYaailsU4XBUQ0zuDGbxeUbAlNfZp6TmbxxBCkdkLtk-iYgmAwww.linkedin.com/9217365405145631150289378930546031076865" Pattern match: "921613855257631155319395836796031076865MUID01E31D16CE68652038B10EFDCF246489msn.com/102513855257631155319395789921031076865" Pattern match: "qR7a4e59ikgqQRvnaccounts.google.com/9217125537536031223715365664921031076865" Pattern match: "aD1Fr0zsMOE9rjXjaccounts.google.com/9217111537536031223715183802275631076864" Pattern match: "jWw0QKqNaw-SrYDuaccounts.google.com/9217126537536031223715366993046031076865" Pattern match: "-igQyaccounts.google.com/9217124537536031223715364555546031076865" Pattern match: "linkedin.com/1025365405145631150289380352421031076865" Pattern match: "MUIDB1E830229B94C6AF53AA211C2B8C86B0Cieonline.microsoft.com/9216427351987231155318380383671031076865" Pattern match: "3A170293801670803410twitter.com/1025137537536031223715378243046031076865" Pattern match: "MUIDB01E31D16CE68652038B10EFDCF246489www.msn.com/921613855257631155319395805546031076865" Pattern match: "MUID01E31D16CE68652038B10EFDCF246489msn.com/102513855257631155319395789921031076865" Heuristic match: "cacerts.digicert.com" Heuristic match: "GET /DigiCertGlobalRootG3.crt HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: cacerts.digicert.com" Heuristic match: "ocsp.digicert.com" Heuristic match: "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Heuristic match: "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEAx5qUSwjBGVIJJhX%2BJrHYM%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Heuristic match: "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEATh56TcXPLzbcArQrhdFZ8%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Heuristic match: "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTPJvUY%2Bsl%2Bj4yzQuAcL2oQno5fCgQUUWj%2FkK8CB3U8zNllZGKiErhZcjsCEAdcWuWOzU%2B3YfWP%2Bc9lf9g%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Heuristic match: "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAzlnDD9eoNTLi0BRrMy%2BWU%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Heuristic match: "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAz1vQYrVgL0erhQLCPM8GY%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Heuristic match: "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTk45WiKdPUwcMf8JgMC07ACYqr2AQUt2ui6qiqhIx56rTaD5iyxZV2ufQCEAqiBEK%2F1RSvcy4lL46SQ4M%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Heuristic match: "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSnxLiz3Fu1WB6n1%2FE6xWn1b0jXiQQUdIWAwGbH3zfez70pN6oDHb7tzRcCEAp6FnkBkACKqk%2BVbKsyAbY%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Heuristic match: "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAqvpsXKY8RRQeo74ffHUxc%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Heuristic match: "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Heuristic match: "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEA177el9ggmWelJjG4vdGL0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Heuristic match: "abs.twimg.com" Heuristic match: "accounts.google.com" Heuristic match: "ipinfo.io" Heuristic match: "steamcommunity.com" Heuristic match: "store.steampowered.com" Heuristic match: "t.paypal.com" Heuristic match: "twitter.com" Pattern match: "www.facebook.com" Pattern match: "www.paypal.com" Pattern match: "www.paypalobjects.com" Pattern match: "https://accounts.google.com/ServiceLogin?passive=1209600&continue=https%3A%2F%2Faccounts.google.com%2F&followup=https%3A%2F%2Faccounts.google.com%2FContent-Encoding" Pattern match: "https://accounts.google.com/InteractiveLogin?continue=https://accounts.google.com/&followup=https://accounts.google.com/&passive=1209600&ifkv=ASKXGp3RoAPMFi1D5ORBXVz_3-qgvvaoO_Xbq0DpOYN_2Y6b5HKHN4-kycfkj4C6lMsFDSw4q-z9aQStrict-Transport-Security" Pattern match: "https://accounts.google.com/&followup=https://accounts.google.com/&passive=1209600&ifkv=ASKXGp3RoAPMFi1D5ORBXVz_3-qgvvaoO_Xbq0DpOYN_2Y6b5HKHN4-kycfkj4C6lMsFDSw4q-z9aQ" Pattern match: "https://accounts.google.com/v3/signin/identifier?continue=https%3A%2F%2Faccounts.google.com%2F&followup=https%3A%2F%2Faccounts.google.com%2F&ifkv=ASKXGp1JD8bmwMlPogrTbm0hK5wZ_8XjO-tmiJhCncpxbLll1LitcD6HSS3ohkPrAOqqKf2sDxwfSQ&passive=1209600&flowName=GlifWe" Pattern match: "accounts.google.com/x-ua-compatible" Pattern match: "https://community.akamai.steamstatic.com/" Pattern match: "https://www.paypal.com/signinAccept-Language" Pattern match: "https://www.paypal.com,https://www.sandbox.paypal.comTraceparent" Pattern match: "www.paypalobjects.comDNT" Pattern match: "https://twitter.com/i/flow/loginAccept-Language" Pattern match: "https://twitter.com" Pattern match: "https://ipinfo.io/Host" Pattern match: "https://accounts.google.com/v3/signin/" Pattern match: "https://www.gstatic.com/_/mss/boq-identity/_/ss/k=boq-identity.AccountsSignInUi.dEB8J-yETiQ.L.B1.O/am=P4GFZI4NgBgzyzl_zzg5DAAAAAAAAAAAsAawAw/d=1/ed=1/rs=AOaEmlHgabEHgkgpm8Idb4egzdS99jS9KA/m=identifierview,_b,_tp" Pattern match: "fonts.gstatic.com/s/productsans/v9/pxiDypQkot1TnFhsFMOfGShVGdeOYktMqlap.woff2" Pattern match: "https://www.gstatic.com/_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en_US.Esgs9sUIcrA.es5.O/am=P4GFZI4NgBgzyzl_zzg5DAAAAAAAAAAAsAawAw/d=1/excm=_b,_tp,identifierview/ed=1/dg=0/wt=2/ujg=1/rs=AOaEmlH7PzU0xJlt26l3lAuQiC9uvvi0-Q/m=_b,_tp" Pattern match: "fonts.gstatic.com/s/roboto/v18/KFOkCnqEu92Fr1MmgVxFIzIXKMnyrYk.woff2" Pattern match: "https://accounts.google.com/AccountChooser?continue\u003dhttps://accounts.google.com/\u0026followup\u003dhttps://accounts.google.com/],[null,[null,null,https://accounts.google.com/Logout?continue\u003dhttps://accounts.google.com/restart?continue%3Dhttps:" Pattern match: "https://assets.msn.com/config/v1/"" Pattern match: "https://+l+/OneCollector/1.0+function(t){return?+Object.keys(t).map" Pattern match: "www.bing.com" Pattern match: "https://assets.msn.com/bundles/v1/homePage/latest/midlevel/vendors.ef7dde432bed42c1b7db.js" Pattern match: "https://assets.msn.com/bundles/v1/homePage/latest/midlevel/microsoft.f0dc8bbbc7b4d116660b.js" Pattern match: "https://assets.msn.com/bundles/v1/homePage/latest/midlevel/common.a878ea7bfce3fb435465.js" Pattern match: "https://assets.msn.com/bundles/v1/homePage/latest/midlevel/experience.0f30a2bb04a428617069.js" Pattern match: "https://www.gstatic.com/_/mss/boq-identity/_/ss/k=boq-identity.AccountsSignInUi.EUkLMShNfWA.L.I11.O/am=P4GFZI4NgBgzyzl_zzg5DAAAAAAAAAAAsAawAw/d=1/ed=1/rs=AOaEmlGCZAzGFYX_3pQOxMGtUlcC7xuWhA/m=identifierview,_b,_tp" Pattern match: "fonts.gstatic.com/s/productsans/v9/pxiDypQkot1TnFhsFMOfGShVF9eI.woff" Pattern match: "fonts.gstatic.com/s/roboto/v18/KFOkCnqEu92Fr1MmgVxIIzQ.woff" Pattern match: "https://reactjs.org/docs/error-decoder.html?invariant=+e,r=1;r" Pattern match: "https://engineering.paypalcorp.com/i18napp/#phone" Pattern match: "https://caniuse.com/#feat=input-event" Pattern match: "https://developer.mozilla.org/en-US/docs/Web/API/NodeList" Pattern match: "https://www.w3.org/TR/webauthn/#isUserVerifyingPlatformAuthenticatorAvailable" Heuristic match: "name: response.rp.name" Pattern match: "paypal.com/merchantaccountsignupfinish}}]},c={name:pwd_recovery_start,trigger:{type:pa.beacon,condition:{e:im,pgrp:main" Pattern match: "https://abs.twimg.com/responsive-web/client-web/vendor.1b81224a.js" Pattern match: "https://static.ads-twitter.com/uwt.js" Pattern match: "https://abs.twimg.com/errors/logo46x38.png" Pattern match: "https://help.twitter.com/using-twitter/twitter-supported-browsers" Pattern match: "https://twitter.com/tos" Pattern match: "https://twitter.com/privacy" Pattern match: "https://support.twitter.com/articles/20170514" Pattern match: "https://legal.twitter.com/imprint.html" Pattern match: "https://business.twitter.com/en/help/troubleshooting/how-twitter-ads-work.html?ref=web-twc-ao-gbl-adsinfo&utm_source=twc&utm_medium=web&utm_campaign=ao&utm_content=adsinfo" Pattern match: "https://ton.local.twitter.com/responsive-web-internal/sourcemaps/client-web/runtime.151ccd0a.js.map" Heuristic match: "%WINDIR%\assembly\NativeImages_v2.0.50727_32\Microsoft.WSMan.Man#\7bf5729401cff7ea7898124e9818ed20\Microsoft.WSMan.Management.ni" Heuristic match: "%ALLUSERSPROFILE%\Oracle\Java\javapath\Get-MpPreference.COM" Heuristic match: "%WINDIR%\system32\Get-MpPreference.COM" Heuristic match: "%WINDIR%\Get-MpPreference.COM" Heuristic match: "%WINDIR%\System32\Wbem\Get-MpPreference.COM" Heuristic match: "%LOCALAPPDATA%\Programs\Python\Python36-32\Scripts\Get-MpPreference.COM" Heuristic match: "%LOCALAPPDATA%\Programs\Python\Python36-32\Get-MpPreference.COM" Heuristic match: "%WINDIR%\System32\WindowsPowerShell\v1.0\Get-MpPreference.COM" Heuristic match: "%LOCALAPPDATA%\Programs\Python\Python38-32\Scripts\Get-MpPreference.COM" Heuristic match: "%LOCALAPPDATA%\Programs\Python\Python38-32\Get-MpPreference.COM" Heuristic match: "h_p;:/J=tore.=;eampov_ered.com" Heuristic match: "ccounts.google.com" Heuristic match: "acebook.com" Pattern match: "www.facebook.com/login" Pattern match: "store.steampowered.com/login" Heuristic match: "tore.steampowered.com" Heuristic match: "ttps://accounts.google.com" Pattern match: "www.paypal.com/signin" Pattern match: "www.linkedin.com/login" Pattern match: "twitter.com/i/flow/login" Pattern match: "www.epicgames.com/id/login" Pattern match: "www.youtube.com" Pattern match: "steamcommunity.com/openid/loginform" Pattern match: "https://accounts.google.com" Heuristic match: "diskcomp.com" Heuristic match: "iskcopy.com" Heuristic match: "edit.com" Heuristic match: "esrb.rs" Heuristic match: "fpb.rs" Heuristic match: "grb.rs" Heuristic match: "graftabl.com" Heuristic match: "graphics.com" Heuristic match: "graphics.pro" Heuristic match: "ieapfltr.dO" Heuristic match: "iertutil.dm" Heuristic match: "ivfsrc.ax" Heuristic match: "kb16.com" Heuristic match: "oflc-nz.rs" Heuristic match: "H;.MG" Pattern match: "https://www.paypal.com/signin" Pattern match: "https://www.youtube.com/" Pattern match: "www.youtube.com/" Pattern match: "www.linkedin.url" Heuristic match: "ww.facebook.com" Heuristic match: "teamcommunity.com" Heuristic match: "ww.epicgames.com" Heuristic match: "ww.linkedin.com" Heuristic match: "witter.com" Pattern match: "https://www.epicgames.com/id/login" Heuristic match: "ww.youtube.com" Heuristic match: "ww.paypal.com" Pattern match: "https://st" Pattern match: "teampowered.com/login" Pattern match: "https://www.linkedin.com/login" Pattern match: "http://www.windows.com/pctv" Pattern match: "http://go.microsoft.com/fwlink/?linkid=53081" Pattern match: "www.microsoft.com/extender/help" Pattern match: "http://go.microsoft.com/fwlink/?LinkId=30564-http://go.microsoft.com/fwlink/?LinkId=145764-http://go.microsoft.com/fwlink/?LinkId=145764-http://go.microsoft.com/fwlink/?LinkId=145764-http://go.microsoft.com/fwlink/?LinkId=145764-http://go.microsoft.com/fwl" Pattern match: "http://go.microsoft.com/fwlink/?LinkId=70599" Pattern match: "http://go.microsoft.com/fwlink/?LinkId=145837" Pattern match: "http://go.microsoft.com/fwlink/?LinkID=57190" Pattern match: "http://go.microsoft.com/fwlink/?LinkId=145765" Heuristic match: "Example: computer.fabrikam.com" Pattern match: "vista.gallery.microsoft.com/vista/SideShow.aspx" Pattern match: "http://www.icra.org/vocabulary/"5d:T15d3,Found URL "https://accounts.google.com/locationnotifications.exettps://accounts.google.com/mediametadatahandler.dll\la6elevatecreateprocesswrpmitigationapphelp.dllen-usen-usar-sapt-brzh-twzh-cnzh-hkcs-czda-dkel-gres-esfi-fifr-frde-dehe-ilhu-huit-itja-jpko-krnl-nlnb-nopl-plpt-ptru-rusv-setr-trbg-bghr-hret-eelv-lvlt-ltro-rosr-latn-cssk-sksl-sith-thuk-uafy-nlqps-plocqps-plocm:\windows\apppatch\aclayers.dll127252c64b7ec:\windows\system32\imm32.dllh;c:\windows\system32;c:\windows;c:\windows\system32\wbem;c:\windows\system32\windowspowershell\v1.0\;c:\users\hapubws\appdata\local\programs\python\python38-32\scripts\;c:\users\hapubws\appdata\local\programs\python\python38-;:\windows\system32\winspool.drvocazrve_pdata\lo=:\windows\system32\setupapi.dllmp\=:\windows\system32\cfgmgr32.dll:\windows\system32\sfc.dllms-win-core-processthreads-l1-1-0:\windows\apppatch\acgenral.dlldata=c:\users\hapubws\appdata\roamingcommonprogramfiles=c:\program" - Source: "00000000-00003416.00000000.65622.00660000.00000004.mdmp") Found URL "https://accounts.google.com/javascriptcollectionagent.dll:\windows\system32\propsys.dlllocationnotificationsview.xmlmsspellcheckingfacility.exenettrace.pla.diagnostics.xmlportabledeviceconnectapi.dllportabledevicewiacompat.dllecurity=impersonation" - Source: "00000000-00003416.00000000.65622.00660000.00000004.mdmp") Found URL "https://accounts.google.com-ms-winclsid\" - Source: "00000000-00003416.00000000.65622.00660000.00000004.mdmp") Found URL "https://accounts.google.com/llusersprofile=c:\programdataappdata=c:\users\hapubws\appdata\roamingcommonprogramfiles=c:\program" - Source: "00000000-00003416.00000000.65622.00660000.00000004.mdmp") Found URL "https://accounts.google.com/c:\program" - Source: "00000000-00003416.00000000.65622.00660000.00000004.mdmp") Found URL "https://accounts.google.com/:\users\hapubws\appdata\local\temp\ixp001.tmp\??\c:\program" - Source: "00000000-00003416.00000000.65622.00660000.00000004.mdmp") Found URL "https://accounts.google.com/:\users\hapubws\appdata\local\temp\ixp001.tmphttps://accounts.google.com/https://accounts.google.com/https://accounts.google.com/:\program" - Source: "00000000-00003416.00000000.65622.00660000.00000004.mdmp") Found URL "https://accounts.google.com/:\users\hapubws\appdata\local\temp\ixp001.tmpnntdos804.sysntdsapi.dllo404.sysntio411.sys.sysntio804.sysntkrnldntlanman.dllntlanui2.dntmarta.dllntoskrnl.exentprint.dllntprint.exentshrui.dllntvdmd.dllel.dlloccache.dll.dllocsetup.exeodbc16odbc32.dllodbc32gt.dodbcad32.exeodbcbcp.dllodbcconf.dllodbcconf.exeodbcconf.rspodbccp32.dllcr32.dllodbccu32.dllodbcji32.dllodbcjtodbctrac.dlloddbse32.dodexl32.dllodfox32.dllodpdx32.dllodtext32.dllofffilt.dlloflc-nz.rsrv.dllole2disp.dlloleacc.dlloleaccnoleaut32.dllolecli.dll" - Source: "00000000-00003416.00000000.65622.00660000.00000004.mdmp") Found URL "https://accounts.google.com/c:\users\hapubws\appdata\local\temp\ixp001.tmp\c:\program" - Source: "00000000-00003416.00000000.65622.00660000.00000004.mdmp") Found URL "https://steamcommunity.com/openid/loginform:\windows\system32\userenv.dll:\windows\system32\profapi.dll:\windows\system32\psapi.dll:\windows\system32\comdlg32.dll-1-=:\windows\system32\oleaut32.dll-1-;:\windows\system32\iphlpapi.dll:\windows\system32\winnsi.dll:\windows\system32\uxtheme.dll:\windows\system32\shell32.dll:\windows\system32\ole32.dll:\windows\system32\apphelp.dll:\windows\system32\sspicli.dll:\windows\system32\samcli.dll:\windows\system32\msacm32.dll:\windows\system32\sfc_os.dll:\windows\system32\dwmapi.dll:\windows\system32\devobj.dll:\windows\system32\urlmon.dll:\windows\system32\imm32.dll:\windows\system32\msctf.dll\windows\system32\driverstorellusersprofile=c:\programdatarogramfiles=c:\program" - Source: "00000000-00003416.00000001.66534.00660000.00000004.mdmp") Found URL "https://www.paypal.com/signinttps://twitter.com/i/flow/login:\windows\system32\propsys.dlllocationnotificationsview.xmlttps://www.epicgames.com/id/loginnettrace.pla.diagnostics.xmlportabledeviceconnectapi.dllportabledevicewiacompat.dllecurity=impersonation" - Source: "00000000-00003416.00000001.66534.00660000.00000004.mdmp") Found URL "https://www.youtube.com/https://www.youtube.com/api-ms-win-core-rtlsupport-l1-1-0.dllapi-ms-win-core-sysinfo-l1-1-0.dllapi-ms-win-core-threadpool-l1-1-0.dllapi-ms-win-crt-filesystem-l1-1-0.dllhttps://www.youtube.com/ttps://steamcommunity.com/openid/loginformttps://steamcommunity.com/openid/loginformapi-ms-win-security-sddl-l1-1-0.dllhttps://www.youtube.com/https://www.youtube.com/auxiliarydisplayclassinstaller.dllommonprogramfiles=c:\program" - Source: "00000000-00003416.00000001.66534.00660000.00000004.mdmp") Found URL "https://accounts.google.com/??\c:\program" - Source: "00000000-00003416.00000001.66534.006B6000.00000004.mdmp") Found URL "https://twitter.com/i/flow/loginstorage" - Source: "00000000-00003416.00000001.66534.006B6000.00000004.mdmp") Found URL "https://www.epicgames.com/id/loginhttps://www.epicgames.com/id/loginhttps://www.epicgames.com/id/loginhttps://www.epicgames.com/id/logindpapiper.dlling.exeverquery.exedrttransport.dlldxptasksync.dlehstorauthehstorr.dllhell.dllntcreate.exenexplorerframe.dllfdbthproxy.dllfirewallapframedase.dllrecover.dllofwremotesvr.dllfxscompose.dlljfxscompose" - Source: "00000000-00003416.00000001.66534.006B6000.00000004.mdmp") Found URL "https://stteampowered.com/loginjavxapaz\wi" - Source: "00000000-00003416.00000001.66534.006B6000.00000004.mdmp") Found URL "https://www.linkedin.com/login" - Source: "00000000-00003416.00000001.66534.006B6000.00000004.mdmp")5e:T29ed,Contains base62 string in header "MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAU" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base62 string in header "2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base62 string in header "ME4wTDBKMEgwRjAJBgUrDgMCGgUABBQwk" in header "GET /gtsr1/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBQwkcLWD4LqGJ7bE7B1XZsEbmfwUAQU5K8rJnEaK0gnhS9SZizv8IkTcT4CDQIDvFNZazTHGPUBUGY%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base62 string in header "cLWD4LqGJ7bE7B1XZsEbmfwUAQU5K8rJn" in header "GET /gtsr1/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBQwkcLWD4LqGJ7bE7B1XZsEbmfwUAQU5K8rJnEaK0gnhS9SZizv8IkTcT4CDQIDvFNZazTHGPUBUGY%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base62 string in header "EaK0gnhS9SZizv8IkTcT4CDQIDvFNZazT" in header "GET /gtsr1/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBQwkcLWD4LqGJ7bE7B1XZsEbmfwUAQU5K8rJnEaK0gnhS9SZizv8IkTcT4CDQIDvFNZazTHGPUBUGY%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base62 string in header "MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V" in header "GET /gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base62 string in header "MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHL" in header "GET /gts1c3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEBZwXm7t3kKEEFjsmHQeLcQ%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base62 string in header "2Fr4XN7pXNPZzQ4kYU83E1HScCEBZwXm7" in header "GET /gts1c3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEBZwXm7t3kKEEFjsmHQeLcQ%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base62 string in header "MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfq" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEAx5qUSwjBGVIJJhX%2BJrHYM%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base62 string in header "hLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQ" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEAx5qUSwjBGVIJJhX%2BJrHYM%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base62 string in header "P4v0cB1JgmGggC72NkK8MCEAx5qUSwjBG" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEAx5qUSwjBGVIJJhX%2BJrHYM%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base62 string in header "MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfq" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEATh56TcXPLzbcArQrhdFZ8%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base62 string in header "hLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQ" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEATh56TcXPLzbcArQrhdFZ8%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base62 string in header "P4v0cB1JgmGggC72NkK8MCEATh56TcXPL" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEATh56TcXPLzbcArQrhdFZ8%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base62 string in header "MFEwTzBNMEswSTAJBgUrDgMCGgUABBTPJ" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTPJvUY%2Bsl%2Bj4yzQuAcL2oQno5fCgQUUWj%2FkK8CB3U8zNllZGKiErhZcjsCEAdcWuWOzU%2B3YfWP%2Bc9lf9g%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base62 string in header "2FkK8CB3U8zNllZGKiErhZcjsCEAdcWuW" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTPJvUY%2Bsl%2Bj4yzQuAcL2oQno5fCgQUUWj%2FkK8CB3U8zNllZGKiErhZcjsCEAdcWuWOzU%2B3YfWP%2Bc9lf9g%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base62 string in header "MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrj" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAzlnDD9eoNTLi0BRrMy%2BWU%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base62 string in header "2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdi" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAzlnDD9eoNTLi0BRrMy%2BWU%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base62 string in header "uNkHMEWNpYim8S8YCEAzlnDD9eoNTLi0B" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAzlnDD9eoNTLi0BRrMy%2BWU%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base62 string in header "MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAz1vQYrVgL0erhQLCPM8GY%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base62 string in header "2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAz1vQYrVgL0erhQLCPM8GY%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base62 string in header "2BrkS7QYXjzkCEAz1vQYrVgL0erhQLCPM" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAz1vQYrVgL0erhQLCPM8GY%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base62 string in header "MFEwTzBNMEswSTAJBgUrDgMCGgUABBTk4" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTk45WiKdPUwcMf8JgMC07ACYqr2AQUt2ui6qiqhIx56rTaD5iyxZV2ufQCEAqiBEK%2F1RSvcy4lL46SQ4M%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base62 string in header "5WiKdPUwcMf8JgMC07ACYqr2AQUt2ui6q" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTk45WiKdPUwcMf8JgMC07ACYqr2AQUt2ui6qiqhIx56rTaD5iyxZV2ufQCEAqiBEK%2F1RSvcy4lL46SQ4M%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base62 string in header "MFEwTzBNMEswSTAJBgUrDgMCGgUABBSnx" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSnxLiz3Fu1WB6n1%2FE6xWn1b0jXiQQUdIWAwGbH3zfez70pN6oDHb7tzRcCEAp6FnkBkACKqk%2BVbKsyAbY%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base62 string in header "2FE6xWn1b0jXiQQUdIWAwGbH3zfez70pN" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSnxLiz3Fu1WB6n1%2FE6xWn1b0jXiQQUdIWAwGbH3zfez70pN6oDHb7tzRcCEAp6FnkBkACKqk%2BVbKsyAbY%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base62 string in header "MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAqvpsXKY8RRQeo74ffHUxc%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base62 string in header "2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAqvpsXKY8RRQeo74ffHUxc%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base62 string in header "2BrkS7QYXjzkCEAqvpsXKY8RRQeo74ffH" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAqvpsXKY8RRQeo74ffHUxc%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base62 string in header "MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base62 string in header "2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base62 string in header "2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base62 string in header "MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEA177el9ggmWelJjG4vdGL0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base62 string in header "2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEA177el9ggmWelJjG4vdGL0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base62 string in header "2BrkS7QYXjzkCEA177el9ggmWelJjG4vd" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEA177el9ggmWelJjG4vdGL0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com"5f:T4d2,"ac18ad4de0d70e7cbbfb829afea0dd45.exe" called "FindFirstFileW" with parameter %TEMP%\IXP000.TMP\*.* (UID: 00000000-00002632) "ac18ad4de0d70e7cbbfb829afea0dd45.exe" called "FindNextFileW" with parameter .. (UID: 00000000-00002632) "ac18ad4de0d70e7cbbfb829afea0dd45.exe" called "FindNextFileW" with parameter 6qY7ld8.exe (UID: 00000000-00002632) "ac18ad4de0d70e7cbbfb829afea0dd45.exe" called "FindNextFileW" with parameter lP8PV47.exe (UID: 00000000-00002632) "ac18ad4de0d70e7cbbfb829afea0dd45.exe" called "FindFirstFileA" with parameter %TEMP%\IXP000.TMP\* (UID: 00000000-00002632) "ac18ad4de0d70e7cbbfb829afea0dd45.exe" called "FindNextFileA" with parameter .. (UID: 00000000-00002632) "lP8PV47.exe" called "FindFirstFileW" with parameter %TEMP%\IXP001.TMP\*.* (UID: 00000000-00003784) "lP8PV47.exe" called "FindNextFileW" with parameter .. (UID: 00000000-00003784) "lP8PV47.exe" called "FindNextFileW" with parameter 1pH71tZ8.exe (UID: 00000000-00003784) "lP8PV47.exe" called "FindNextFileW" with parameter 4Uh436mr.exe (UID: 00000000-00003784) "lP8PV47.exe" called "FindFirstFileA" with parameter %TEMP%\IXP001.TMP\* (UID: 00000000-00003784) "lP8PV47.exe" called "FindNextFileA" with parameter .. (UID: 00000000-00003784)60:T595,Found reference to API "GetDesktopWindow" (Indicator: "GetDesktopWindow"; File: "ac18ad4de0d70e7cbbfb829afea0dd45.exe") Found reference to API "GetDC" (Indicator: "GetDC"; File: "ac18ad4de0d70e7cbbfb829afea0dd45.exe") Found reference to API "GetDesktopWindow" (Indicator: "GetDesktopWindow"; Source: "00000000-00002632.00000002.67682.00F2A000.00000002.mdmp") Found reference to API "GetDC" (Indicator: "GetDC"; Source: "00000000-00002632.00000002.67682.00F2A000.00000002.mdmp") Found reference to API "GetDesktopWindow" (Indicator: "GetDesktopWindow"; Source: "00000000-00003416.00000000.65622.00F5C000.00000002.mdmp") Found reference to API "GetDC" (Indicator: "GetDC"; Source: "00000000-00003416.00000000.65622.00F5C000.00000002.mdmp") Found reference to API "GetWindowDC" (Indicator: "GetWindowDC"; Source: "00000000-00003416.00000000.65622.00F5C000.00000002.mdmp") Found reference to API "CreateCompatibleBitmap" (Indicator: "CreateCompatibleBitmap"; Source: "00000000-00003416.00000000.65622.00F5C000.00000002.mdmp") Found reference to API "CreateCompatibleDC" (Indicator: "CreateCompatibleDC"; Source: "00000000-00003416.00000000.65622.00F5C000.00000002.mdmp") Found reference to API "GetDIBits" (Indicator: "GetDIBits"; Source: "00000000-00003416.00000000.65622.00F5C000.00000002.mdmp") Found reference to API "CreateDCW" (Indicator: "CreateDC"; Source: "00000000-00003416.00000000.65622.00F5C000.00000002.mdmp")61:T851,Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; File: "ac18ad4de0d70e7cbbfb829afea0dd45.exe") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; File: "ac18ad4de0d70e7cbbfb829afea0dd45.exe") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; File: "ac18ad4de0d70e7cbbfb829afea0dd45.exe") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; Source: "00000000-00002632.00000002.67682.00F2A000.00000002.mdmp") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00002632.00000002.67682.00F2A000.00000002.mdmp") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; Source: "00000000-00002632.00000002.67682.00F2A000.00000002.mdmp") Found reference to API "GetModuleHandleExW" (Indicator: "GetModuleHandle"; Source: "00000000-00003416.00000000.65622.00F5C000.00000002.mdmp") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; Source: "00000000-00003416.00000000.65622.00F5C000.00000002.mdmp, 00000000-00003416.00000000.65622.6D110000.00000002.mdmp") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00003416.00000000.65622.00F5C000.00000002.mdmp, 00000000-00003416.00000000.65622.6D110000.00000002.mdmp") Found reference to API "CreateToolhelp32Snapshot" (Indicator: "CreateToolhelp32Snapshot"; Source: "00000000-00003416.00000000.65622.00F5C000.00000002.mdmp") Found reference to API "Process32FirstW" (Indicator: "Process32First"; Source: "00000000-00003416.00000000.65622.00F5C000.00000002.mdmp") Found reference to API "Process32NextW" (Indicator: "Process32Next"; Source: "00000000-00003416.00000000.65622.00F5C000.00000002.mdmp") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; Source: "00000000-00003416.00000000.65622.00F5C000.00000002.mdmp, 00000000-00003416.00000000.65622.6D110000.00000002.mdmp") Found reference to API "GetEnvironmentStringsW" (Indicator: "GetEnvironmentStrings"; Source: "00000000-00003416.00000000.65622.00F5C000.00000002.mdmp")62:T60c,Found reference to API "RegOpenKeyExA" (Indicator: "RegOpenKey"; File: "ac18ad4de0d70e7cbbfb829afea0dd45.exe") Found reference to API "RegQueryInfoKeyA" (Indicator: "RegQueryInfoKey"; File: "ac18ad4de0d70e7cbbfb829afea0dd45.exe") Found reference to API "RegQueryValueExA" (Indicator: "RegQueryValue"; File: "ac18ad4de0d70e7cbbfb829afea0dd45.exe") Found reference to API "RegOpenKeyExA" (Indicator: "RegOpenKey"; Source: "00000000-00002632.00000002.67682.00F2A000.00000002.mdmp") Found reference to API "RegQueryInfoKeyA" (Indicator: "RegQueryInfoKey"; Source: "00000000-00002632.00000002.67682.00F2A000.00000002.mdmp") Found reference to API "RegQueryValueExA" (Indicator: "RegQueryValue"; Source: "00000000-00002632.00000002.67682.00F2A000.00000002.mdmp") Found reference to API "RegOpenKeyExW" (Indicator: "RegOpenKey"; Source: "00000000-00003416.00000000.65622.00F5C000.00000002.mdmp, 00000000-00003416.00000000.65622.6D110000.00000002.mdmp") Found reference to API "RegQueryValueExW" (Indicator: "RegQueryValue"; Source: "00000000-00003416.00000000.65622.00F5C000.00000002.mdmp, 00000000-00003416.00000000.65622.6D110000.00000002.mdmp") Found reference to API "RegEnumKeyExW" (Indicator: "RegEnumKey"; Source: "00000000-00003416.00000000.65622.00F5C000.00000002.mdmp") Found reference to API "RegEnumValueW" (Indicator: "RegEnumValue"; Source: "00000000-00003416.00000000.65622.00F5C000.00000002.mdmp") Found reference to API "RegGetValueW" (Indicator: "RegGetValue"; Source: "00000000-00003416.00000000.65622.6D110000.00000002.mdmp")63:Teec,Found reference to API "GetFileAttributesA" (Indicator: "GetFileAttributes"; File: "ac18ad4de0d70e7cbbfb829afea0dd45.exe") Found reference to API "GetSystemDirectoryA" (Indicator: "GetSystemDirectory"; File: "ac18ad4de0d70e7cbbfb829afea0dd45.exe") Found reference to API "GetCurrentDirectoryA" (Indicator: "GetCurrentDirectory"; File: "ac18ad4de0d70e7cbbfb829afea0dd45.exe") Found reference to API "GetTempPathA" (Indicator: "GetTempPath"; File: "ac18ad4de0d70e7cbbfb829afea0dd45.exe") Found reference to API "GetTempFileNameA" (Indicator: "GetTempFileName"; File: "ac18ad4de0d70e7cbbfb829afea0dd45.exe") Found reference to API "GetFileVersionInfoSizeA" (Indicator: "GetFileVersionInfo"; File: "ac18ad4de0d70e7cbbfb829afea0dd45.exe") Found reference to API "GetFileVersionInfoSizeA" (Indicator: "GetFileVersionInfoSize"; File: "ac18ad4de0d70e7cbbfb829afea0dd45.exe") Found reference to API "GetFileVersionInfoA" (Indicator: "GetFileVersionInfo"; File: "ac18ad4de0d70e7cbbfb829afea0dd45.exe") Found reference to API "GetFileAttributesA" (Indicator: "GetFileAttributes"; Source: "00000000-00002632.00000002.67682.00F2A000.00000002.mdmp") Found reference to API "GetSystemDirectoryA" (Indicator: "GetSystemDirectory"; Source: "00000000-00002632.00000002.67682.00F2A000.00000002.mdmp") Found reference to API "GetCurrentDirectoryA" (Indicator: "GetCurrentDirectory"; Source: "00000000-00002632.00000002.67682.00F2A000.00000002.mdmp") Found reference to API "GetTempPathA" (Indicator: "GetTempPath"; Source: "00000000-00002632.00000002.67682.00F2A000.00000002.mdmp") Found reference to API "GetTempFileNameA" (Indicator: "GetTempFileName"; Source: "00000000-00002632.00000002.67682.00F2A000.00000002.mdmp") Found reference to API "GetFileVersionInfoSizeA" (Indicator: "GetFileVersionInfo"; Source: "00000000-00002632.00000002.67682.00F2A000.00000002.mdmp") Found reference to API "GetFileVersionInfoSizeA" (Indicator: "GetFileVersionInfoSize"; Source: "00000000-00002632.00000002.67682.00F2A000.00000002.mdmp") Found reference to API "GetFileVersionInfoA" (Indicator: "GetFileVersionInfo"; Source: "00000000-00002632.00000002.67682.00F2A000.00000002.mdmp") Found reference to API "GetFileVersionInfoSizeW" (Indicator: "GetFileVersionInfo"; Source: "00000000-00003416.00000000.65622.00F5C000.00000002.mdmp") Found reference to API "GetFileVersionInfoSizeW" (Indicator: "GetFileVersionInfoSize"; Source: "00000000-00003416.00000000.65622.00F5C000.00000002.mdmp") Found reference to API "GetFileVersionInfoW" (Indicator: "GetFileVersionInfo"; Source: "00000000-00003416.00000000.65622.00F5C000.00000002.mdmp") Found reference to API "FtpGetFileSize" (Indicator: "GetFileSize"; Source: "00000000-00003416.00000000.65622.00F5C000.00000002.mdmp") Found reference to API "GetCurrentDirectoryW" (Indicator: "GetCurrentDirectory"; Source: "00000000-00003416.00000000.65622.00F5C000.00000002.mdmp, 00000000-00003416.00000000.65622.6D110000.00000002.mdmp") Found reference to API "GetFileAttributesW" (Indicator: "GetFileAttributes"; Source: "00000000-00003416.00000000.65622.00F5C000.00000002.mdmp") Found reference to API "GetTempPathW" (Indicator: "GetTempPath"; Source: "00000000-00003416.00000000.65622.00F5C000.00000002.mdmp") Found reference to API "GetTempFileNameW" (Indicator: "GetTempFileName"; Source: "00000000-00003416.00000000.65622.00F5C000.00000002.mdmp") Found reference to API "GetFileSize" (Indicator: "GetFileSize"; Source: "00000000-00003416.00000000.65622.00F5C000.00000002.mdmp") Found reference to API "GetSystemDirectoryW" (Indicator: "GetSystemDirectory"; Source: "00000000-00003416.00000000.65622.00F5C000.00000002.mdmp") Found reference to API "SHGetSpecialFolderLocation" (Indicator: "SHGetSpecialFolderLocation"; Source: "00000000-00003416.00000000.65622.00F5C000.00000002.mdmp")64:T5f2,Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; File: "ac18ad4de0d70e7cbbfb829afea0dd45.exe") Found reference to API "OpenProcessToken" (Indicator: "OpenProcessToken"; File: "ac18ad4de0d70e7cbbfb829afea0dd45.exe") file/memory contains long string with (Indicator: "OpenProcessToken"; File: "ac18ad4de0d70e7cbbfb829afea0dd45.exe") file/memory contains long string with (Indicator: "OpenProcessToken"; Source: "00000000-00002632.00000002.67682.00F2A000.00000002.mdmp") Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; Source: "00000000-00002632.00000002.67682.00F2A000.00000002.mdmp") Found reference to API "OpenProcessToken" (Indicator: "OpenProcessToken"; Source: "00000000-00002632.00000002.67682.00F2A000.00000002.mdmp") Found reference to API "GetUserObjectSecurity" (Indicator: "GetUserObjectSecurity"; Source: "00000000-00003416.00000000.65622.00F5C000.00000002.mdmp") Found reference to API "GetProcessWindowStation" (Indicator: "GetProcessWindowStation"; Source: "00000000-00003416.00000000.65622.00F5C000.00000002.mdmp") Found reference to API "OpenProcessToken" (Indicator: "OpenProcessToken"; Source: "00000000-00003416.00000000.65622.00F5C000.00000002.mdmp") Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; Source: "00000000-00003416.00000000.65622.00F5C000.00000002.mdmp") Found reference to API "GetUserNameW" (Indicator: "GetUserName"; Source: "00000000-00003416.00000000.65622.00F5C000.00000002.mdmp")65:Tcef,Found string "information.txtz2Am#j5,,tC\s@`tp[\3,jWe+a=O+~N&"(BJ",]gP@uTT421^_.:*'8LT=passwords.txtH2s0(&,"F1TIJP!S?(I*PE1ACh3UR%(I8z;R!$5'5D/7U?((?84 ?(Daxz~x#^.information.txtPKpasswords.txtPKRiseProTelegram: https://t.me/RiseProSUPPORT" (Indicator: "password"; File: "pnfSOBL91xbWYBjnW3Mw7ICXAUREyKjq.zip") Found string "password: 'begin_hybrid_pwd'," (Indicator: "password"; File: "signin-split_1_.js") Found string "var options = ['email', 'sms', 'biometrics', 'signup', 'password', 'passwordRecovery'];" (Indicator: "password"; File: "signin-split_1_.js") Found string "loginWithPassword: 'password'," (Indicator: "password"; File: "signin-split_1_.js") Found string "setPasswordLink: 'set_password'," (Indicator: "password"; File: "signin-split_1_.js") Found string "passwordRecoveryModal: 'password_recovery'," (Indicator: "password"; File: "signin-split_1_.js") Found string "if (!pageName || !optionList || pageName !== 'password') {" (Indicator: "password"; File: "signin-split_1_.js") Found string "// setting emailField here because this value is used in subsequent xhr calls when on the password page." (Indicator: "password"; File: "signin-split_1_.js") Found string "delete formData.login_password;" (Indicator: "password"; File: "signin-split_1_.js") Found string "login.utils.logTryAnotherWayInstrumentData({page: 'password', action: 'menuPressed', option: 'biometrics'});" (Indicator: "password"; File: "signin-split_1_.js") Found string "login.utils.logTryAnotherWayInstrumentData({page: 'password', action: 'linkShown'});" (Indicator: "password"; File: "signin-split_1_.js") Found string "// change "forgot password?" to "setup a password" link if" (Indicator: "password"; File: "signin-split_1_.js") Found string "// poma users land on password page" (Indicator: "password"; File: "signin-split_1_.js") Found string "* Chrome will not allow reading the password field on page load" (Indicator: "password"; File: "signin-split_1_.js") Found string "var passwordDom = document.querySelector('#password');" (Indicator: "password"; File: "signin-split_1_.js") Found string "if(passwordDom && passwordDom.hasAttribute('disabled')) {" (Indicator: "password"; File: "signin-split_1_.js") Found string "passwordDom.removeAttribute('disabled');" (Indicator: "password"; File: "signin-split_1_.js") Found string "login: 'password'," (Indicator: "password"; File: "signin-split_1_.js") Found string "var setPwr = tawParentNode.querySelector("#passwordRecoveryModal");" (Indicator: "password"; File: "signin-split_1_.js") Found string "data: 'prepare_login_with_your_password'," (Indicator: "password"; File: "signin-split_1_.js") Found string "data: 'login_with_your_password'," (Indicator: "password"; File: "signin-split_1_.js") Found string "data: 'login_with_your_password_clicked'," (Indicator: "password"; File: "signin-split_1_.js") Found string "login.utils.logTryAnotherWayInstrumentData({page: pageName, action: 'menuPressed', option: 'password'});" (Indicator: "password"; File: "signin-split_1_.js") Found string "var passwordRedirect = function() {" (Indicator: "password"; File: "signin-split_1_.js") Found string "return login.logger.pushLogs({complete: passwordRedirect, data: {logStartTime: Date.now()}});" (Indicator: "password"; File: "signin-split_1_.js")66:T12f1,Found string ":\Windows\System32\DriverStore" (Indicator: "system32\drivers"; Source: "00000000-00000284.00000001.67626.00800000.00000004.mdmp") Found string "indows\System32\DriverStore\infpub.dat" (Indicator: "system32\drivers"; Source: "00000000-00000284.00000001.67626.00800000.00000004.mdmp") Found string ":\Windows\System32\DriverStore\infstor.dat" (Indicator: "system32\drivers"; Source: "00000000-00000284.00000001.67626.00800000.00000004.mdmp") Found string ":\Windows\System32\DriverStore\infstrng.dat" (Indicator: "system32\drivers"; Source: "00000000-00000284.00000001.67626.00800000.00000004.mdmp") Found string ":\Windows\System32\DriverStore\drvindex.dat" (Indicator: "system32\drivers"; Source: "00000000-00000284.00000001.67626.00800000.00000004.mdmp") Found string "indows\System32\DriverStore\FileRepository" (Indicator: "system32\drivers"; Source: "00000000-00000284.00000001.67626.00800000.00000004.mdmp") Found string ":\Windows\System32\DriverStore" (Indicator: "system32\drivers"; Source: "00000000-00002632.00000000.65533.00320000.00000004.mdmp, 00000000-00002632.00000001.67454.00320000.00000004.mdmp, 00000000-00002632.00000002.67682.00320000.00000004.mdmp") Found string ":\Windows\System32\DriverStore\infpub.dat" (Indicator: "system32\drivers"; Source: "00000000-00002632.00000000.65533.00320000.00000004.mdmp, 00000000-00002632.00000001.67454.00320000.00000004.mdmp, 00000000-00002632.00000002.67682.00320000.00000004.mdmp") Found string ":\Windows\System32\DriverStore\infstor.dat" (Indicator: "system32\drivers"; Source: "00000000-00002632.00000000.65533.00320000.00000004.mdmp, 00000000-00002632.00000001.67454.00320000.00000004.mdmp") Found string ":\Windows\System32\DriverStore\infstrng.dat" (Indicator: "system32\drivers"; Source: "00000000-00002632.00000000.65533.00320000.00000004.mdmp, 00000000-00002632.00000001.67454.00320000.00000004.mdmp, 00000000-00002632.00000002.67682.00320000.00000004.mdmp") Found string ":\Windows\System32\DriverStore\drvindex.dat" (Indicator: "system32\drivers"; Source: "00000000-00002632.00000000.65533.00320000.00000004.mdmp, 00000000-00002632.00000001.67454.00320000.00000004.mdmp, 00000000-00002632.00000002.67682.00320000.00000004.mdmp") Found string ":\Windows\System32\DriverStore\FileRepository" (Indicator: "system32\drivers"; Source: "00000000-00002632.00000000.65533.00320000.00000004.mdmp, 00000000-00002632.00000001.67454.00320000.00000004.mdmp") Found string "\Device\HarddiskVolume2\ac18ad4de0d70e7cbbfb829afea0dd45.exe" (Indicator: "\Device\"; Source: "00000000-00002632.00000000.65533.00320000.00000004.mdmp, 00000000-00002632.00000001.67454.00320000.00000004.mdmp, 00000000-00002632.00000002.67682.00320000.00000004.mdmp") Found string "indows\System32\DriverStore\infstor.dat" (Indicator: "system32\drivers"; Source: "00000000-00002632.00000002.67682.00320000.00000004.mdmp") Found string "indows\System32\DriverStore\FileRepository" (Indicator: "system32\drivers"; Source: "00000000-00002632.00000002.67682.00320000.00000004.mdmp") Found string ":\Windows\System32\DriverStore" (Indicator: "system32\drivers"; Source: "00000000-00003416.00000000.65622.00660000.00000004.mdmp") Found string "\Device\HarddiskVolume2" (Indicator: "\Device\"; Source: "00000000-00003416.00000000.65622.00660000.00000004.mdmp") Found string ":\Windows\System32\DriverStore\infpub.dat" (Indicator: "system32\drivers"; Source: "00000000-00003416.00000000.65622.00660000.00000004.mdmp, 00000000-00003416.00000001.66534.00660000.00000004.mdmp") Found string ":\Windows\System32\DriverStore\infstor.dat" (Indicator: "system32\drivers"; Source: "00000000-00003416.00000000.65622.00660000.00000004.mdmp") Found string ":\Windows\System32\DriverStore\infstrng.dat" (Indicator: "system32\drivers"; Source: "00000000-00003416.00000000.65622.00660000.00000004.mdmp, 00000000-00003416.00000001.66534.00660000.00000004.mdmp") Found string ":\Windows\System32\DriverStore\drvindex.dat" (Indicator: "system32\drivers"; Source: "00000000-00003416.00000000.65622.00660000.00000004.mdmp, 00000000-00003416.00000001.66534.00660000.00000004.mdmp") Found string ":\Windows\System32\DriverStore\FileRepository" (Indicator: "system32\drivers"; Source: "00000000-00003416.00000000.65622.00660000.00000004.mdmp") Found string "\Device\HarddiskVolume2\Users\HAPUBWS\AppData\Local\Temp\IXP001.TMP\1pH71tZ8.exe" (Indicator: "\Device\"; Source: "00000000-00003416.00000000.65622.00660000.00000004.mdmp, 00000000-00003416.00000001.66534.00660000.00000004.mdmp") Found string "\Device\HarddiskVolume1\??\Volume{dcbfaac3-d863-11e7-b9ff-806e6f6e6963}'" (Indicator: "\Device\"; Source: "00000000-00003416.00000000.65622.00660000.00000004.mdmp") Found string "\Windows\System32\DriverStore" (Indicator: "system32\drivers"; Source: "00000000-00003416.00000001.66534.00660000.00000004.mdmp")67:T8dc,Found reference to API "CheckTokenMembership" (Indicator: "CheckTokenMembership"; File: "ac18ad4de0d70e7cbbfb829afea0dd45.exe") Found reference to API "SeShutdownPrivilege" (Indicator: "SeShutdownPrivilege"; File: "ac18ad4de0d70e7cbbfb829afea0dd45.exe") Found reference to API "LookupPrivilegeValueA" (Indicator: "LookupPrivilegeValue"; File: "ac18ad4de0d70e7cbbfb829afea0dd45.exe") Found reference to API "AdjustTokenPrivileges" (Indicator: "AdjustTokenPrivileges"; File: "ac18ad4de0d70e7cbbfb829afea0dd45.exe") file/memory contains long string with (Indicator: "AdjustTokenPrivileges"; File: "ac18ad4de0d70e7cbbfb829afea0dd45.exe") Found reference to API "CheckTokenMembership" (Indicator: "CheckTokenMembership"; Source: "00000000-00002632.00000000.65533.00F21000.00000020.mdmp") Found reference to API "SeShutdownPrivilege" (Indicator: "SeShutdownPrivilege"; Source: "00000000-00002632.00000000.65533.00F21000.00000020.mdmp") file/memory contains long string with (Indicator: "AdjustTokenPrivileges"; Source: "00000000-00002632.00000002.67682.00F2A000.00000002.mdmp") Found reference to API "LookupPrivilegeValueA" (Indicator: "LookupPrivilegeValue"; Source: "00000000-00002632.00000002.67682.00F2A000.00000002.mdmp") Found reference to API "AdjustTokenPrivileges" (Indicator: "AdjustTokenPrivileges"; Source: "00000000-00002632.00000002.67682.00F2A000.00000002.mdmp") Found reference to API "SeBackupPrivilege" (Indicator: "SeBackupPrivilege"; Source: "00000000-00003416.00000000.65622.00F5C000.00000002.mdmp") Found reference to API "SeShutdownPrivilege" (Indicator: "SeShutdownPrivilege"; Source: "00000000-00003416.00000000.65622.00F5C000.00000002.mdmp") Found reference to API "SeDebugPrivilege" (Indicator: "SeDebugPrivilege"; Source: "00000000-00003416.00000000.65622.00F5C000.00000002.mdmp") Found reference to API "AdjustTokenPrivileges" (Indicator: "AdjustTokenPrivileges"; Source: "00000000-00003416.00000000.65622.00F5C000.00000002.mdmp") Found reference to API "LookupPrivilegeValueW" (Indicator: "LookupPrivilegeValue"; Source: "00000000-00003416.00000000.65622.00F5C000.00000002.mdmp") Found reference to API "CheckTokenMembership" (Indicator: "CheckTokenMembership"; Source: "00000000-00003416.00000000.65622.00F5C000.00000002.mdmp")68:T10d5,Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; File: "ac18ad4de0d70e7cbbfb829afea0dd45.exe") Found reference to API "FreeSid" (Indicator: "FreeSid"; File: "ac18ad4de0d70e7cbbfb829afea0dd45.exe") Found reference to API "AllocateAndInitializeSid" (Indicator: "AllocateAndInitializeSid"; File: "ac18ad4de0d70e7cbbfb829afea0dd45.exe") Found reference to API "AllocateAndInitializeSid" (Indicator: "InitializeSid"; File: "ac18ad4de0d70e7cbbfb829afea0dd45.exe") Found reference to API "EqualSid" (Indicator: "EqualSid"; File: "ac18ad4de0d70e7cbbfb829afea0dd45.exe") Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; Source: "00000000-00002632.00000002.67682.00F2A000.00000002.mdmp") Found reference to API "FreeSid" (Indicator: "FreeSid"; Source: "00000000-00002632.00000002.67682.00F2A000.00000002.mdmp") Found reference to API "AllocateAndInitializeSid" (Indicator: "AllocateAndInitializeSid"; Source: "00000000-00002632.00000002.67682.00F2A000.00000002.mdmp") Found reference to API "AllocateAndInitializeSid" (Indicator: "InitializeSid"; Source: "00000000-00002632.00000002.67682.00F2A000.00000002.mdmp") Found reference to API "EqualSid" (Indicator: "EqualSid"; Source: "00000000-00002632.00000002.67682.00F2A000.00000002.mdmp") Found reference to API "InitializeSecurityDescriptor" (Indicator: "InitializeSecurityDescriptor"; Source: "00000000-00003416.00000000.65622.00F5C000.00000002.mdmp") Found reference to API "InitializeAcl" (Indicator: "InitializeAcl"; Source: "00000000-00003416.00000000.65622.00F5C000.00000002.mdmp") Found reference to API "DuplicateTokenEx" (Indicator: "DuplicateToken"; Source: "00000000-00003416.00000000.65622.00F5C000.00000002.mdmp") Found reference to API "DuplicateTokenEx" (Indicator: "DuplicateTokenEx"; Source: "00000000-00003416.00000000.65622.00F5C000.00000002.mdmp") Found reference to API "GetLengthSid" (Indicator: "GetLengthSid"; Source: "00000000-00003416.00000000.65622.00F5C000.00000002.mdmp") Found reference to API "CopySid" (Indicator: "CopySid"; Source: "00000000-00003416.00000000.65622.00F5C000.00000002.mdmp") Found reference to API "AllocateAndInitializeSid" (Indicator: "AllocateAndInitializeSid"; Source: "00000000-00003416.00000000.65622.00F5C000.00000002.mdmp") Found reference to API "AllocateAndInitializeSid" (Indicator: "InitializeSid"; Source: "00000000-00003416.00000000.65622.00F5C000.00000002.mdmp") Found reference to API "FreeSid" (Indicator: "FreeSid"; Source: "00000000-00003416.00000000.65622.00F5C000.00000002.mdmp") Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; Source: "00000000-00003416.00000000.65622.00F5C000.00000002.mdmp") Found reference to API "GetSecurityDescriptorDacl" (Indicator: "GetSecurityDescriptorDacl"; Source: "00000000-00003416.00000000.65622.00F5C000.00000002.mdmp, 00000000-00003416.00000000.65622.6D110000.00000002.mdmp") Found reference to API "GetAclInformation" (Indicator: "GetAclInformation"; Source: "00000000-00003416.00000000.65622.00F5C000.00000002.mdmp") Found reference to API "GetAce" (Indicator: "GetAce"; Source: "00000000-00003416.00000000.65622.00F5C000.00000002.mdmp, 00000000-00003416.00000000.65622.6D110000.00000002.mdmp") Found reference to API "AddAce" (Indicator: "AddAce"; Source: "00000000-00003416.00000000.65622.00F5C000.00000002.mdmp") Found reference to API "SetSecurityDescriptorDacl" (Indicator: "SetSecurityDescriptorDacl"; Source: "00000000-00003416.00000000.65622.00F5C000.00000002.mdmp") Found reference to API "GetSidSubAuthorityCount" (Indicator: "GetSidSubAuthority"; Source: "00000000-00003416.00000000.65622.6D110000.00000002.mdmp") Found reference to API "GetSidSubAuthorityCount" (Indicator: "GetSidSubAuthorityCount"; Source: "00000000-00003416.00000000.65622.6D110000.00000002.mdmp") Found reference to API "GetSidIdentifierAuthority" (Indicator: "GetSidIdentifierAuthority"; Source: "00000000-00003416.00000000.65622.6D110000.00000002.mdmp") Found reference to API "GetSidSubAuthority" (Indicator: "GetSidSubAuthority"; Source: "00000000-00003416.00000000.65622.6D110000.00000002.mdmp") Found reference to API "GetKernelObjectSecurity" (Indicator: "GetKernelObjectSecurity"; Source: "00000000-00003416.00000000.65622.6D110000.00000002.mdmp")69:Tf86,Observed import api "AllocateAndInitializeSid" which can "Allocates and initializes a security identifier (SID) with up to eight subauthorities" [Source: ac18ad4de0d70e7cbbfb829afea0dd45.exe] Observed import api "EqualSid" which can "Tests two security identifier (SID) values for equality" [Source: ac18ad4de0d70e7cbbfb829afea0dd45.exe] Observed import api "FreeSid" which can "Frees a security identifier (SID) previously allocated by using the AllocateAndInitializeSid function" [Source: ac18ad4de0d70e7cbbfb829afea0dd45.exe] Observed import api "GetTokenInformation" which can "Retrieves a specified type of information about an access token" [Source: ac18ad4de0d70e7cbbfb829afea0dd45.exe] Observed import api "InitializeSid" which can "Initializes a security identifier (SID)" [Source: ac18ad4de0d70e7cbbfb829afea0dd45.exe] Observed import api "AddAce" which can "Adds one or more access control entries (ACEs) to a specified access control list (ACL)" [Source: 4Uh436mr.exe] Observed import api "AddAce" which can "Adds one or more access control entries (ACEs) to a specified access control list (ACL)" [Source: 1pH71tZ8.exe] Observed import api "AllocateAndInitializeSid" which can "Allocates and initializes a security identifier (SID) with up to eight subauthorities" [Source: 1pH71tZ8.exe] Observed import api "CheckTokenMembership" which can "Determines whether a specified security identifier (SID) is enabled in an access token" [Source: 1pH71tZ8.exe] Observed import api "CopySid" which can "Copies a security identifier (SID) to a buffer" [Source: 1pH71tZ8.exe] Observed import api "DuplicateToken" which can "Creates a new access token that duplicates one already in existence" [Source: 1pH71tZ8.exe] Observed import api "DuplicateTokenEx" which can "Creates a new access token that duplicates an existing token" [Source: 1pH71tZ8.exe] Observed import api "FreeSid" which can "Frees a security identifier (SID) previously allocated by using the AllocateAndInitializeSid function" [Source: 1pH71tZ8.exe] Observed import api "GetAce" which can "Obtains a pointer to an access control entry (ACE) in an access control list (ACL)" [Source: 1pH71tZ8.exe] Observed import api "GetAclInformation" which can "Retrieves information about an access control list (ACL)" [Source: 1pH71tZ8.exe] Observed import api "GetLengthSid" which can "Returns the length in bytes of a valid security identifier (SID)" [Source: 1pH71tZ8.exe] Observed import api "GetSecurityDescriptorDacl" which can "Retrieves a pointer to the discretionary access control list (DACL) in a specified security descriptor" [Source: 1pH71tZ8.exe] Observed import api "GetTokenInformation" which can "Retrieves a specified type of information about an access token" [Source: 1pH71tZ8.exe] Observed import api "InitializeAcl" which can "Initializes a new ACL structure" [Source: 1pH71tZ8.exe] Observed import api "InitializeSecurityDescriptor" which can "Initializes a new security descriptor" [Source: 1pH71tZ8.exe] Observed import api "InitializeSid" which can "Initializes a security identifier (SID)" [Source: 1pH71tZ8.exe] Observed import api "SetSecurityDescriptorDacl" which can "Sets information in a discretionary access control list (DACL)" [Source: 1pH71tZ8.exe] Observed import api "AllocateAndInitializeSid" which can "Allocates and initializes a security identifier (SID) with up to eight subauthorities" [Source: lP8PV47.exe] Observed import api "EqualSid" which can "Tests two security identifier (SID) values for equality" [Source: lP8PV47.exe] Observed import api "FreeSid" which can "Frees a security identifier (SID) previously allocated by using the AllocateAndInitializeSid function" [Source: lP8PV47.exe] Observed import api "GetTokenInformation" which can "Retrieves a specified type of information about an access token" [Source: lP8PV47.exe] Observed import api "InitializeSid" which can "Initializes a security identifier (SID)" [Source: lP8PV47.exe]6a:Taca,"AppLaunch.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\LDAP"; Key: "LDAPCLIENTINTEGRITY"; Value: "") "AppLaunch.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\LDAP"; Key: "USEOLDHOSTRESOLUTIONORDER"; Value: "") "AppLaunch.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\LDAP"; Key: "USEHOSTNAMEASALIAS"; Value: "") "AppLaunch.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\LDAP"; Key: "IPV4LOOPBACKALTERNATIVE"; Value: "") "AppLaunch.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\LANMANWORKSTATION\PARAMETERS"; Key: "RPCCACHETIMEOUT"; Value: "") "AppLaunch.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\LANMANSERVER\DEFAULTSECURITY"; Key: "SRVSVCDEFAULTSHAREINFO"; Value: "") "AppLaunch.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS"; Key: "HOSTNAME"; Value: "") "AppLaunch.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS"; Key: "DOMAIN"; Value: "") "AppLaunch.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9"; Key: "SERIAL_ACCESS_NUM"; Value: "") "AppLaunch.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{90A066FE-591C-47F3-850D-9644B684FBA5}"; Key: "ENABLEDHCP"; Value: "") "AppLaunch.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{90A066FE-591C-47F3-850D-9644B684FBA5}"; Key: "REGISTRATIONENABLED"; Value: "") "AppLaunch.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{90A066FE-591C-47F3-850D-9644B684FBA5}"; Key: "REGISTERADAPTERNAME"; Value: "") "AppLaunch.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{90A066FE-591C-47F3-850D-9644B684FBA5}"; Key: "DOMAIN"; Value: "") "AppLaunch.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{90A066FE-591C-47F3-850D-9644B684FBA5}"; Key: "DHCPDOMAIN"; Value: "") "AppLaunch.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP6\PARAMETERS\INTERFACES\{90A066FE-591C-47F3-850D-9644B684FBA5}"; Key: "DHCPV6DOMAIN"; Value: "") "AppLaunch.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E29AC6C2-7037-11DE-816D-806E6F6E6963}"; Key: "ENABLEDHCP"; Value: "") "AppLaunch.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E29AC6C2-7037-11DE-816D-806E6F6E6963}"; Key: "REGISTRATIONENABLED"; Value: "")6b:T51c,"CabC872.tmp" has type "Microsoft Cabinet archive data Windows 2000/XP setup 66791 bytes 1 file at 0x2c +A "authroot.stl" number 1 6 datablocks 0x1 compression"- Location: [%TEMP%\CabC872.tmp]- [targetUID: 00000000-00003324] "57C8EDB95DF3F0AD4EE2DC2B8CFD4157" has type "Microsoft Cabinet archive data Windows 2000/XP setup 4770 bytes 1 file at 0x2c +A "disallowedcert.stl" number 1 1 datablock 0x1 compression"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\57C8EDB95DF3F0AD4EE2DC2B8CFD4157]- [targetUID: 00000000-00002932] "77EC63BDA74BD0D0E0426DC8F8008506" has type "Microsoft Cabinet archive data Windows 2000/XP setup 66791 bytes 1 file at 0x2c +A "authroot.stl" number 1 6 datablocks 0x1 compression"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506]- [targetUID: 00000000-00002968] "CabB855.tmp" has type "Microsoft Cabinet archive data Windows 2000/XP setup 66791 bytes 1 file at 0x2c +A "authroot.stl" number 1 6 datablocks 0x1 compression"- Location: [%TEMP%\CabB855.tmp]- [targetUID: 00000000-00003480] "CabBC8B.tmp" has type "Microsoft Cabinet archive data Windows 2000/XP setup 66791 bytes 1 file at 0x2c +A "authroot.stl" number 1 6 datablocks 0x1 compression"- Location: [%TEMP%\CabBC8B.tmp]- [targetUID: 00000000-00002972]6c:T10d2,Dropped file: "FANBooster131.lnk" - Location: [%APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\FANBooster131.lnk]- [targetUID: 00000000-00002108] Dropped file: "G4VW0JM3.htm" - Location: [%LOCALAPPDATA%\Microsoft\Windows\Temporary Internet Files\Content.IE5\CKDNCXYS\G4VW0JM3.htm]- [targetUID: 00000000-00002968] Dropped file: "imagestore.dat" - Location: [%LOCALAPPDATA%\Microsoft\Internet Explorer\imagestore\3mt7jhv\imagestore.dat]- [targetUID: 00000000-00003968] Dropped file: "en-US.4" - Location: [%LOCALAPPDATA%\Microsoft\Internet Explorer\DomainSuggestions\en-US.4]- [targetUID: 00000000-00002968] Dropped file: "70DAE932E3BCB3C00656A27B544BA9CA" - Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\70DAE932E3BCB3C00656A27B544BA9CA]- [targetUID: 00000000-00002932] Dropped file: "9WT54HPEBC1KUL8P5SVY.temp" - Location: [%APPDATA%\Microsoft\Windows\Recent\CustomDestinations\9WT54HPEBC1KUL8P5SVY.temp]- [targetUID: 00000000-00001788] Dropped file: "739F2FF4259CDC6CBE7B90F1A95601EF" - Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\739F2FF4259CDC6CBE7B90F1A95601EF]- [targetUID: 00000000-00001904] Dropped file: "57C8EDB95DF3F0AD4EE2DC2B8CFD4157" - Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\57C8EDB95DF3F0AD4EE2DC2B8CFD4157]- [targetUID: 00000000-00002932] Dropped file: "646C991C2A28825F3CC56E0A1D1E3FA9" - Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\646C991C2A28825F3CC56E0A1D1E3FA9]- [targetUID: 00000000-00002932] Dropped file: "EA618097E393409AFA316F0F87E2C202_1E65FD33F74047223AF4D58CBFD34BCE" - Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\EA618097E393409AFA316F0F87E2C202_1E65FD33F74047223AF4D58CBFD34BCE]- [targetUID: 00000000-00003480] Dropped file: "24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA" - Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA]- [targetUID: 00000000-00002932] Dropped file: "AE583B12017CC3ACE1D659336529BFB3" - Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\AE583B12017CC3ACE1D659336529BFB3]- [targetUID: 00000000-00002968] Dropped file: "9D6B3FE9E6E4067193F477ABAD990106" - Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\9D6B3FE9E6E4067193F477ABAD990106]- [targetUID: 00000000-00002968] Dropped file: "4748633DC5731827D4B432DBAC7A3ECE" - Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\4748633DC5731827D4B432DBAC7A3ECE]- [targetUID: 00000000-00002932] Dropped file: "332HFF5K.txt" - Location: [%APPDATA%\Microsoft\Windows\Cookies\332HFF5K.txt]- [targetUID: 00000000-00003968] Dropped file: "615ETHM7.txt" - Location: [%APPDATA%\Microsoft\Windows\Cookies\615ETHM7.txt]- [targetUID: 00000000-00003968] Dropped file: "U7VTJWMG.txt" - Location: [%APPDATA%\Microsoft\Windows\Cookies\U7VTJWMG.txt]- [targetUID: 00000000-00002932] Dropped file: "VOMYGU3D.txt" - Location: [%APPDATA%\Microsoft\Windows\Cookies\VOMYGU3D.txt]- [targetUID: 00000000-00003968] Dropped file: "SNAUKTZR.txt" - Location: [%APPDATA%\Microsoft\Windows\Cookies\SNAUKTZR.txt]- [targetUID: 00000000-00003968] Dropped file: "40C68D5626484A90937F0752C8B950AB" - Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\40C68D5626484A90937F0752C8B950AB]- [targetUID: 00000000-00003480] Dropped file: "69C6F6EC64E114822DF688DC12CDD86C" - Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\69C6F6EC64E114822DF688DC12CDD86C]- [targetUID: 00000000-00002932] Dropped file: "6DB145CFEEC544B1582FED1ADA3370DD" - Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\6DB145CFEEC544B1582FED1ADA3370DD]- [targetUID: 00000000-00002932] Dropped file: "0270780F846F08BEFE0DD8112D932FEF" - Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\0270780F846F08BEFE0DD8112D932FEF]- [targetUID: 00000000-00003968] Dropped file: "CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA" - Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA]- [targetUID: 00000000-00002932] Dropped file: "SDY4YMU0.txt" - Location: [%APPDATA%\Microsoft\Windows\Cookies\SDY4YMU0.txt]- [targetUID: 00000000-00003968]6d:T5a5,"new_login_bg_strong_mask_1_.jpg" has type "JPEG image data Exif standard: [TIFF image data little-endian direntries=0] baseline precision 8 1920x1080 components 3" and extension "jpg" "header_logo_1_.png" has type "PNG image data 744 x 171 8-bit/color RGBA non-interlaced" and extension "png" "glyph_alert_critical_big-2x_1_.png" has type "PNG image data 224 x 200 8-bit/color RGBA non-interlaced" and extension "png" "sprite_form_2x_1_.png" has type "PNG image data 48 x 1350 8-bit colormap non-interlaced" and extension "png" "header_menu_hamburger_1_.png" has type "PNG image data 244 x 212 8-bit/color RGBA non-interlaced" and extension "png" "footerLogo_valve_1_.png" has type "PNG image data 96 x 26 8-bit/color RGBA non-interlaced" and extension "png" "code_box_1_.png" has type "PNG image data 222 x 28 8-bit/color RGBA non-interlaced" and extension "png" "friendlyname_box_1_.png" has type "PNG image data 222 x 28 8-bit/color RGBA non-interlaced" and extension "png" "icon-PN-check_1_.png" has type "PNG image data 121 x 133 8-bit/color RGBA non-interlaced" and extension "png" "logo_valve_footer_1_.png" has type "PNG image data 92 x 26 8-bit/color RGBA non-interlaced" and extension "png" "logo46x38_1_.png" has type "PNG image data 46 x 38 8-bit/color RGBA non-interlaced" and extension "png" "btn_header_installsteam_download_1_.png" has type "PNG image data 15 x 13 8-bit/color RGBA non-interlaced" and extension "png"6e:T8004,"initAft()