24:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/1f7k-b47qno-6.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/3fc9w1ah_nm2g.js"],"SampleDetailWrapper"] 8e:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/1f7k-b47qno-6.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 23:T49d,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Crifi.Generic Sample eabd0bd2d942… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample eabd0bd2d942…. Malware family: Crifi.Generic. Threat score 100/100. 12/23 AV engines flagged this file. 24 malicious and 29 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/eabd0bd2d942ed6013525df7ffc82dac2e1c7289308952de7dbabe6a03d71e00","keywords":["Malicious","Crifi.Generic","malware analysis","sandbox report","threat intelligence","eabd0bd2d942ed6013525df7ffc82dac2e1c7289308952de7dbabe6a03d71e00"],"about":{"@type":"SoftwareApplication","name":"23b876abb59c00ac24e3e0d934c0b920.exe","applicationCategory":["peexe","executable"],"identifier":"eabd0bd2d942ed6013525df7ffc82dac2e1c7289308952de7dbabe6a03d71e00","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Crifi.Generic","antivirusDetections":{"malicious":12,"total":23},"behavioralIndicators":{"malicious":24,"suspicious":29},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}25:T782,"eabd0bd2d942ed6013525df7ffc82dac2e1c7289308952de7dbabe6a03d71e00.exe" called "FindResourceA" with parameter "19796600" - (UID: 00000000-00004424) "eabd0bd2d942ed6013525df7ffc82dac2e1c7289308952de7dbabe6a03d71e00.exe" called "FindResourceA" with parameter "19796608" - (UID: 00000000-00004424) "eabd0bd2d942ed6013525df7ffc82dac2e1c7289308952de7dbabe6a03d71e00.exe" called "FindResourceA" with parameter "19796636" - (UID: 00000000-00004424) "eabd0bd2d942ed6013525df7ffc82dac2e1c7289308952de7dbabe6a03d71e00.exe" called "FindResourceA" with parameter "19796848" - (UID: 00000000-00004424) "eabd0bd2d942ed6013525df7ffc82dac2e1c7289308952de7dbabe6a03d71e00.exe" called "FindResourceA" with parameter "19796664" - (UID: 00000000-00004424) "eabd0bd2d942ed6013525df7ffc82dac2e1c7289308952de7dbabe6a03d71e00.exe" called "FindResourceA" with parameter "19796820" - (UID: 00000000-00004424) "eabd0bd2d942ed6013525df7ffc82dac2e1c7289308952de7dbabe6a03d71e00.exe" called "FindResourceA" with parameter "19796832" - (UID: 00000000-00004424) "eabd0bd2d942ed6013525df7ffc82dac2e1c7289308952de7dbabe6a03d71e00.exe" called "FindResourceA" with parameter "11532812" - (UID: 00000000-00004424) "eabd0bd2d942ed6013525df7ffc82dac2e1c7289308952de7dbabe6a03d71e00.exe" called "FindResourceA" with parameter "19796716" - (UID: 00000000-00004424) "eabd0bd2d942ed6013525df7ffc82dac2e1c7289308952de7dbabe6a03d71e00.exe" called "FindResourceA" with parameter "19796812" - (UID: 00000000-00004424) "eabd0bd2d942ed6013525df7ffc82dac2e1c7289308952de7dbabe6a03d71e00.exe" called "FindResourceA" with parameter "11532808" - (UID: 00000000-00004424) "eabd0bd2d942ed6013525df7ffc82dac2e1c7289308952de7dbabe6a03d71e00.exe" called "FindResourceA" with parameter "19796680" - (UID: 00000000-00004424) "eabd0bd2d942ed6013525df7ffc82dac2e1c7289308952de7dbabe6a03d71e00.exe" called "FindResourceA" with parameter "19796688" - (UID: 00000000-00004424)26:Tcc8,"eabd0bd2d942ed6013525df7ffc82dac2e1c7289308952de7dbabe6a03d71e00.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '19843200'}" (UID: 00000000-00004424) "eabd0bd2d942ed6013525df7ffc82dac2e1c7289308952de7dbabe6a03d71e00.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '19843056'}" (UID: 00000000-00004424) "eabd0bd2d942ed6013525df7ffc82dac2e1c7289308952de7dbabe6a03d71e00.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '19843216'}" (UID: 00000000-00004424) "eabd0bd2d942ed6013525df7ffc82dac2e1c7289308952de7dbabe6a03d71e00.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '19843104'}" (UID: 00000000-00004424) "eabd0bd2d942ed6013525df7ffc82dac2e1c7289308952de7dbabe6a03d71e00.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '19843072'}" (UID: 00000000-00004424) "eabd0bd2d942ed6013525df7ffc82dac2e1c7289308952de7dbabe6a03d71e00.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '19843120'}" (UID: 00000000-00004424) "eabd0bd2d942ed6013525df7ffc82dac2e1c7289308952de7dbabe6a03d71e00.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '19843168'}" (UID: 00000000-00004424) "eabd0bd2d942ed6013525df7ffc82dac2e1c7289308952de7dbabe6a03d71e00.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '19843040'}" (UID: 00000000-00004424) "eabd0bd2d942ed6013525df7ffc82dac2e1c7289308952de7dbabe6a03d71e00.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '19843152'}" (UID: 00000000-00004424) "eabd0bd2d942ed6013525df7ffc82dac2e1c7289308952de7dbabe6a03d71e00.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '19843184'}" (UID: 00000000-00004424) "se3jY19.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '2082944'}" (UID: 00000000-00008204) "se3jY19.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '2082800'}" (UID: 00000000-00008204) "se3jY19.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '2082960'}" (UID: 00000000-00008204) "se3jY19.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '2082848'}" (UID: 00000000-00008204) "se3jY19.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '2082816'}" (UID: 00000000-00008204) "se3jY19.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '2082864'}" (UID: 00000000-00008204) "se3jY19.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '2082912'}" (UID: 00000000-00008204) "se3jY19.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '2082784'}" (UID: 00000000-00008204) "se3jY19.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '2082896'}" (UID: 00000000-00008204) "se3jY19.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '2082928'}" (UID: 00000000-00008204) "ho0Ot26.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '12175488'}" (UID: 00000000-00005996) "ho0Ot26.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '12175344'}" (UID: 00000000-00005996) "ho0Ot26.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '12175504'}" (UID: 00000000-00005996)27:T668,"eabd0bd2d942ed6013525df7ffc82dac2e1c7289308952de7dbabe6a03d71e00.exe" called "RemoveDirectoryA" with parameter %TEMP%\IXP000.TMP (UID: 00000000-00004424) "se3jY19.exe" called "RemoveDirectoryA" with parameter %TEMP%\IXP000.TMP (UID: 00000000-00008204) "se3jY19.exe" called "RemoveDirectoryA" with parameter %TEMP%\IXP001.TMP (UID: 00000000-00008204) "ho0Ot26.exe" called "RemoveDirectoryA" with parameter %TEMP%\IXP000.TMP (UID: 00000000-00005996) "ho0Ot26.exe" called "RemoveDirectoryA" with parameter %TEMP%\IXP001.TMP (UID: 00000000-00005996) "ho0Ot26.exe" called "RemoveDirectoryA" with parameter %TEMP%\IXP002.TMP (UID: 00000000-00005996) "vm6LM89.exe" called "RemoveDirectoryA" with parameter %TEMP%\IXP000.TMP (UID: 00000000-00008540) "vm6LM89.exe" called "RemoveDirectoryA" with parameter %TEMP%\IXP001.TMP (UID: 00000000-00008540) "vm6LM89.exe" called "RemoveDirectoryA" with parameter %TEMP%\IXP002.TMP (UID: 00000000-00008540) "vm6LM89.exe" called "RemoveDirectoryA" with parameter %TEMP%\IXP003.TMP (UID: 00000000-00008540) "kX2gk33.exe" called "RemoveDirectoryA" with parameter %TEMP%\IXP000.TMP (UID: 00000000-00007476) "kX2gk33.exe" called "RemoveDirectoryA" with parameter %TEMP%\IXP001.TMP (UID: 00000000-00007476) "kX2gk33.exe" called "RemoveDirectoryA" with parameter %TEMP%\IXP002.TMP (UID: 00000000-00007476) "kX2gk33.exe" called "RemoveDirectoryA" with parameter %TEMP%\IXP003.TMP (UID: 00000000-00007476) "kX2gk33.exe" called "RemoveDirectoryA" with parameter %TEMP%\IXP004.TMP (UID: 00000000-00007476) "kX2gk33.exe" called "RemoveDirectoryA" with parameter %TEMP%\IXP004.TMP\ (UID: 00000000-00007476)28:Te22,Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; File: "eabd0bd2d942ed6013525df7ffc82dac2e1c7289308952de7dbabe6a03d71e00.exe") Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; File: "eabd0bd2d942ed6013525df7ffc82dac2e1c7289308952de7dbabe6a03d71e00.exe") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; File: "eabd0bd2d942ed6013525df7ffc82dac2e1c7289308952de7dbabe6a03d71e00.exe") Found reference to API "MsgWaitForMultipleObjects" (Indicator: "WaitForMultipleObjects"; File: "eabd0bd2d942ed6013525df7ffc82dac2e1c7289308952de7dbabe6a03d71e00.exe") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObject"; File: "eabd0bd2d942ed6013525df7ffc82dac2e1c7289308952de7dbabe6a03d71e00.exe") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObjectEx"; File: "eabd0bd2d942ed6013525df7ffc82dac2e1c7289308952de7dbabe6a03d71e00.exe") Found reference to API "RegisterWaitForSingleObject" (Indicator: "WaitForSingleObject"; File: "eabd0bd2d942ed6013525df7ffc82dac2e1c7289308952de7dbabe6a03d71e00.exe") Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; Source: "00000000-00004424.00000000.91567.012EA000.00000002.mdmp") Found reference to API "MsgWaitForMultipleObjects" (Indicator: "WaitForMultipleObjects"; Source: "00000000-00004424.00000000.91567.012EA000.00000002.mdmp") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; Source: "00000000-00004424.00000000.91567.012EA000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00004424.00000000.91567.012EA000.00000002.mdmp") Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; Source: "00000000-00005996.00000001.93593.00B9A000.00000002.mdmp") Found reference to API "MsgWaitForMultipleObjects" (Indicator: "WaitForMultipleObjects"; Source: "00000000-00005996.00000001.93593.00B9A000.00000002.mdmp") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; Source: "00000000-00005996.00000001.93593.00B9A000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00005996.00000001.93593.00B9A000.00000002.mdmp") Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; Source: "00000000-00007476.00000000.91759.0024A000.00000002.mdmp") Found reference to API "MsgWaitForMultipleObjects" (Indicator: "WaitForMultipleObjects"; Source: "00000000-00007476.00000000.91759.0024A000.00000002.mdmp") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; Source: "00000000-00007476.00000000.91759.0024A000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00007476.00000000.91759.0024A000.00000002.mdmp") Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; Source: "00000000-00008204.00000000.91623.001FA000.00000002.mdmp") Found reference to API "MsgWaitForMultipleObjects" (Indicator: "WaitForMultipleObjects"; Source: "00000000-00008204.00000000.91623.001FA000.00000002.mdmp") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; Source: "00000000-00008204.00000000.91623.001FA000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00008204.00000000.91623.001FA000.00000002.mdmp")29:T58c,Found reference to API "OpenProcessToken" (Indicator: "OpenProcessToken"; File: "eabd0bd2d942ed6013525df7ffc82dac2e1c7289308952de7dbabe6a03d71e00.exe") file/memory contains long string with (Indicator: "OpenProcessToken"; File: "eabd0bd2d942ed6013525df7ffc82dac2e1c7289308952de7dbabe6a03d71e00.exe") file/memory contains long string with (Indicator: "OpenProcessToken"; Source: "00000000-00004424.00000000.91567.012EA000.00000002.mdmp") Found reference to API "OpenProcessToken" (Indicator: "OpenProcessToken"; Source: "00000000-00004424.00000000.91567.012EA000.00000002.mdmp") file/memory contains long string with (Indicator: "OpenProcessToken"; Source: "00000000-00005996.00000001.93593.00B9A000.00000002.mdmp") Found reference to API "OpenProcessToken" (Indicator: "OpenProcessToken"; Source: "00000000-00005996.00000001.93593.00B9A000.00000002.mdmp") file/memory contains long string with (Indicator: "OpenProcessToken"; Source: "00000000-00007476.00000000.91759.0024A000.00000002.mdmp") Found reference to API "OpenProcessToken" (Indicator: "OpenProcessToken"; Source: "00000000-00007476.00000000.91759.0024A000.00000002.mdmp") file/memory contains long string with (Indicator: "OpenProcessToken"; Source: "00000000-00008204.00000000.91623.001FA000.00000002.mdmp") Found reference to API "OpenProcessToken" (Indicator: "OpenProcessToken"; Source: "00000000-00008204.00000000.91623.001FA000.00000002.mdmp")2a:T58c,Found reference to API "CreateThread" (Indicator: "CreateThread"; File: "eabd0bd2d942ed6013525df7ffc82dac2e1c7289308952de7dbabe6a03d71e00.exe") Found reference to API "WriteProcessMemory" (Indicator: "WriteProcessMemory"; File: "eabd0bd2d942ed6013525df7ffc82dac2e1c7289308952de7dbabe6a03d71e00.exe") Found reference to API "VirtualFree" (Indicator: "VirtualFree"; File: "eabd0bd2d942ed6013525df7ffc82dac2e1c7289308952de7dbabe6a03d71e00.exe") Found reference to API "VirtualAllocEx" (Indicator: "VirtualAlloc"; File: "eabd0bd2d942ed6013525df7ffc82dac2e1c7289308952de7dbabe6a03d71e00.exe") Found reference to API "VirtualAllocEx" (Indicator: "VirtualAllocEx"; File: "eabd0bd2d942ed6013525df7ffc82dac2e1c7289308952de7dbabe6a03d71e00.exe") Found reference to API "VirtualAlloc" (Indicator: "VirtualAlloc"; File: "eabd0bd2d942ed6013525df7ffc82dac2e1c7289308952de7dbabe6a03d71e00.exe") Found reference to API "CreateThread" (Indicator: "CreateThread"; Source: "00000000-00004424.00000000.91567.012EA000.00000002.mdmp") Found reference to API "CreateThread" (Indicator: "CreateThread"; Source: "00000000-00005996.00000001.93593.00B9A000.00000002.mdmp") Found reference to API "CreateThread" (Indicator: "CreateThread"; Source: "00000000-00007476.00000000.91759.0024A000.00000002.mdmp") Found reference to API "CreateThread" (Indicator: "CreateThread"; Source: "00000000-00008204.00000000.91623.001FA000.00000002.mdmp")2b:T911,Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; File: "eabd0bd2d942ed6013525df7ffc82dac2e1c7289308952de7dbabe6a03d71e00.exe") Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; File: "eabd0bd2d942ed6013525df7ffc82dac2e1c7289308952de7dbabe6a03d71e00.exe") Found reference to API "LoadLibraryExA" (Indicator: "LoadLibrary"; File: "eabd0bd2d942ed6013525df7ffc82dac2e1c7289308952de7dbabe6a03d71e00.exe") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; File: "eabd0bd2d942ed6013525df7ffc82dac2e1c7289308952de7dbabe6a03d71e00.exe") Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; File: "eabd0bd2d942ed6013525df7ffc82dac2e1c7289308952de7dbabe6a03d71e00.exe") Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; Source: "00000000-00004424.00000000.91567.012EA000.00000002.mdmp") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; Source: "00000000-00004424.00000000.91567.012EA000.00000002.mdmp") Found reference to API "LoadLibraryExA" (Indicator: "LoadLibrary"; Source: "00000000-00004424.00000000.91567.012EA000.00000002.mdmp") Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; Source: "00000000-00005996.00000001.93593.00B9A000.00000002.mdmp") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; Source: "00000000-00005996.00000001.93593.00B9A000.00000002.mdmp") Found reference to API "LoadLibraryExA" (Indicator: "LoadLibrary"; Source: "00000000-00005996.00000001.93593.00B9A000.00000002.mdmp") Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; Source: "00000000-00007476.00000000.91759.0024A000.00000002.mdmp") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; Source: "00000000-00007476.00000000.91759.0024A000.00000002.mdmp") Found reference to API "LoadLibraryExA" (Indicator: "LoadLibrary"; Source: "00000000-00007476.00000000.91759.0024A000.00000002.mdmp") Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; Source: "00000000-00008204.00000000.91623.001FA000.00000002.mdmp") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; Source: "00000000-00008204.00000000.91623.001FA000.00000002.mdmp") Found reference to API "LoadLibraryExA" (Indicator: "LoadLibrary"; Source: "00000000-00008204.00000000.91623.001FA000.00000002.mdmp")2c:T1048,Found reference to API "RegSetValueExA" (Indicator: "RegSetValue"; File: "eabd0bd2d942ed6013525df7ffc82dac2e1c7289308952de7dbabe6a03d71e00.exe") Found reference to API "" (Indicator: "RegSetValue"; Source: "00000000-00000496.00000000.92449.02F50000.00000004.mdmp, 00000000-00000496.00000002.96288.02F50000.00000004.mdmp") Found reference to API "" (Indicator: "RegSetValue"; Source: "00000000-00000496.00000000.92449.02F50000.00000004.mdmp, 00000000-00000496.00000002.96288.02F50000.00000004.mdmp") Found reference to API "" (Indicator: "RegSetValue"; Source: "00000000-00000496.00000000.92449.02F50000.00000004.mdmp, 00000000-00000496.00000002.96288.02F50000.00000004.mdmp") Found reference to API "" (Indicator: "RegSetValue"; Source: "00000000-00000496.00000000.92449.02F50000.00000004.mdmp, 00000000-00000496.00000002.96288.02F50000.00000004.mdmp") Found reference to API "" (Indicator: "RegSetValue"; Source: "00000000-00004424.00000000.91567.00E60000.00000004.mdmp, 00000000-00004424.00000002.95407.00E60000.00000004.mdmp") Found reference to API "" (Indicator: "RegSetValue"; Source: "00000000-00004424.00000000.91567.00E60000.00000004.mdmp, 00000000-00004424.00000002.95407.00E60000.00000004.mdmp") Found reference to API "" (Indicator: "RegSetValue"; Source: "00000000-00004424.00000000.91567.00E60000.00000004.mdmp, 00000000-00004424.00000002.95407.00E60000.00000004.mdmp") Found reference to API "" (Indicator: "RegSetValue"; Source: "00000000-00004424.00000000.91567.00E60000.00000004.mdmp, 00000000-00004424.00000002.95407.00E60000.00000004.mdmp") Found reference to API "RegSetValueExA" (Indicator: "RegSetValue"; Source: "00000000-00004424.00000000.91567.012EA000.00000002.mdmp") Found reference to API "RegSetValueExA" (Indicator: "RegSetValue"; Source: "00000000-00005996.00000001.93593.00B9A000.00000002.mdmp") Found reference to API "" (Indicator: "RegSetValue"; Source: "00000000-00005996.00000001.93593.03350000.00000004.mdmp, 00000000-00005996.00000002.95514.03350000.00000004.mdmp") Found reference to API "" (Indicator: "RegSetValue"; Source: "00000000-00005996.00000001.93593.03350000.00000004.mdmp, 00000000-00005996.00000002.95514.03350000.00000004.mdmp") Found reference to API "" (Indicator: "RegSetValue"; Source: "00000000-00005996.00000001.93593.03350000.00000004.mdmp, 00000000-00005996.00000002.95514.03350000.00000004.mdmp") Found reference to API "" (Indicator: "RegSetValue"; Source: "00000000-00005996.00000001.93593.03350000.00000004.mdmp, 00000000-00005996.00000002.95514.03350000.00000004.mdmp") Found reference to API "RegSetValueExA" (Indicator: "RegSetValue"; Source: "00000000-00007476.00000000.91759.0024A000.00000002.mdmp") Found reference to API "" (Indicator: "RegSetValue"; Source: "00000000-00007476.00000000.91759.02CC0000.00000004.mdmp") Found reference to API "" (Indicator: "RegSetValue"; Source: "00000000-00007476.00000000.91759.02CC0000.00000004.mdmp") Found reference to API "" (Indicator: "RegSetValue"; Source: "00000000-00007476.00000000.91759.02CC0000.00000004.mdmp") Found reference to API "" (Indicator: "RegSetValue"; Source: "00000000-00007476.00000000.91759.02CC0000.00000004.mdmp") Found reference to API "RegSetValueExA" (Indicator: "RegSetValue"; Source: "00000000-00008204.00000000.91623.001FA000.00000002.mdmp")2d:T131e,Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00007476-19798-15-00241F90 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00007476-19798-15-00241F90 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00007476-19798-16-002444B9 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00007476-19798-16-002444B9 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00007476-19798-22-0024681F Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00007476-19798-22-0024681F Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00007476-19798-26-002424E0 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00007476-19798-26-002424E0 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00007476-19798-29-002452B6 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00007476-19798-29-002452B6 Assembly shows XOR instruction xor eax esp in Stream UID: 00000000-00007476-19798-31-00242390 Assembly shows XOR instruction xor ecx esp in Stream UID: 00000000-00007476-19798-31-00242390 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00007476-19798-33-00242F1D Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00007476-19798-33-00242F1D Assembly shows XOR instruction xor eax esp in Stream UID: 00000000-00007476-19798-36-00243BA2 Assembly shows XOR instruction xor ecx esp in Stream UID: 00000000-00007476-19798-36-00243BA2 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00007476-19798-37-00243FEF Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00007476-19798-37-00243FEF Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00007476-19798-40-00242267 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00007476-19798-40-00242267 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00007476-19798-41-00246495 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00007476-19798-41-00246495 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00007476-19798-42-0024202A Assembly shows XOR instruction xor eax 01h in Stream UID: 00000000-00007476-19798-42-0024202A Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00007476-19798-42-0024202A Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00007476-19798-43-00241AE8 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00007476-19798-43-00241AE8 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00007476-19798-44-00242AAC Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00007476-19798-44-00242AAC Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00007476-19798-52-00244EFD Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00007476-19798-52-00244EFD Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00007476-19798-57-00246298 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00007476-19798-57-00246298 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00007476-19798-59-0024621E Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00007476-19798-59-0024621E Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00007476-19798-60-0024597D Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00007476-19798-60-0024597D Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00007476-19798-62-002455A0 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00007476-19798-62-002455A0 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00007476-19798-63-00245467 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00007476-19798-63-00245467 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00007476-19798-65-002453A1 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00007476-19798-65-002453A1 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00007476-19798-66-00242630 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00007476-19798-66-00242630 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00007476-19798-71-00242CAA Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00007476-19798-71-00242CAA Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00007476-19798-72-002418A3 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00007476-19798-72-002418A3 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00007476-19798-73-002417EE Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00007476-19798-73-002417EE2e:T644,Found reference to API "SendMessageA" (Indicator: "sendmessage"; File: "eabd0bd2d942ed6013525df7ffc82dac2e1c7289308952de7dbabe6a03d71e00.exe") file/memory contains long string with (Indicator: "sendmessage"; File: "vm6LM89.exe") file/memory contains long string with (Indicator: "sendmessage"; File: "kX2gk33.exe") file/memory contains long string with (Indicator: "sendmessage"; File: "6bT2Su1.exe") Found reference to API "SendMessageW" (Indicator: "sendmessage"; File: "eabd0bd2d942ed6013525df7ffc82dac2e1c7289308952de7dbabe6a03d71e00.exe") Found reference to API "PostMessageW" (Indicator: "postmessage"; File: "eabd0bd2d942ed6013525df7ffc82dac2e1c7289308952de7dbabe6a03d71e00.exe") Found reference to API "EnumWindows" (Indicator: "enumwindows"; File: "eabd0bd2d942ed6013525df7ffc82dac2e1c7289308952de7dbabe6a03d71e00.exe") Found reference to API "" (Indicator: "enumchildwindows"; Source: "00000000-00000496.00000000.92449.02F50000.00000004.mdmp, 00000000-00000496.00000002.96288.02F50000.00000004.mdmp") Found reference to API "SendMessageA" (Indicator: "sendmessage"; Source: "00000000-00004424.00000000.91567.012EA000.00000002.mdmp") Found reference to API "SendMessageA" (Indicator: "sendmessage"; Source: "00000000-00005996.00000001.93593.00B9A000.00000002.mdmp") Found reference to API "SendMessageA" (Indicator: "sendmessage"; Source: "00000000-00007476.00000000.91759.0024A000.00000002.mdmp") Found reference to API "SendMessageA" (Indicator: "sendmessage"; Source: "00000000-00008204.00000000.91623.001FA000.00000002.mdmp")2f:T281a,"eabd0bd2d942ed6013525df7ffc82dac2e1c7289308952de7dbabe6a03d71e00.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00004424) "eabd0bd2d942ed6013525df7ffc82dac2e1c7289308952de7dbabe6a03d71e00.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00004424) "eabd0bd2d942ed6013525df7ffc82dac2e1c7289308952de7dbabe6a03d71e00.exe" called "RtlGetVersion" with parameter 000000000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00004424) "se3jY19.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00008204) "se3jY19.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00008204) "se3jY19.exe" called "RtlGetVersion" with parameter 000000000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00008204) "ho0Ot26.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00005996) "ho0Ot26.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00005996) "ho0Ot26.exe" called "RtlGetVersion" with parameter 000000000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00005996) "vm6LM89.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00008540) "vm6LM89.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00008540) "vm6LM89.exe" called "RtlGetVersion" with parameter 000000000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00008540) "kX2gk33.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00007476) "kX2gk33.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00007476) "kX2gk33.exe" called "RtlGetVersion" with parameter 000000000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00007476) "1Ae44GC4.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00007224)30:T902,"eabd0bd2d942ed6013525df7ffc82dac2e1c7289308952de7dbabe6a03d71e00.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f00000200000000f8af00fcdf7d7370aae80000000000c0f8af00baa87d7370aae80018f9af00c58b7d7370aae800010000004849af5b00000000d43fd4420000000003000000ccf9af000a000000a40d000010faaf0048f9af005f00000003000000d0f8af00d8f8af00e0fbaf00d0bb7d73d0207f28feffffff20faaf0055117c73d43fd442 (UID: 00000000-00004424) "se3jY19.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f00000200000000fc2701fcdf7d73689837030000000028fc2701baa87d736898370380fc2701c58b7d736898370301000000fff930d300000000a522a13e000000000300000034fd27010a000000b422000078fd2701b0fc27015d0000000300000038fc270140fc270148ff2701d0bb7d73ff9568a1feffffff88fd270155117c73a522a13e (UID: 00000000-00008204) "ho0Ot26.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f00000200000000f7ff00fcdf7d73208b37030000000070f7ff00baa87d73208b3703c8f7ff00c58b7d73208b370301000000132dd4a700000000ebd6dd3c00000000030000007cf8ff000a0000009c150000c0f8ff00f8f7ff005d0000000300000080f7ff0088f7ff0090faff00d0bb7d735b4a54d4feffffffd0f8ff0055117c73ebd6dd3c (UID: 00000000-00005996) "vm6LM89.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f00000200000000f59200fcdf7d73688df70200000000f8f59200baa87d73688df70250f69200c58b7d73688df70201000000f131f8cc00000000f8e5723d000000000300000004f792000a0000005c1e000048f7920080f692005b0000000300000008f6920010f6920018f99200d0bb7d73215715bffeffffff58f7920055117c73f8e5723d (UID: 00000000-00008540) "kX2gk33.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f00000200000000df7d73c098ce020000000048f99100baa87d73c098ce02a0f99100c58b7d73c098ce0201000000f18cce0e00000000bd41a646000000000300000054fa91000a0000001c11000098fa9100d0f991005d0000000300000058f9910060f991006cfc9100d0bb7d73d1e5207dfeffffffacfa910055117c73bd41a64600000000 (UID: 00000000-00007476) "1Ae44GC4.exe" called "GetVersionExA" with parameter 940000000600000002000000f02300000200000000000000010000000c00000000000000000000000000000001000000010000000000000000000000720061006d00650000000000000000000000000000000000010000002f000000000000000000000063006f006e006600690067005c006d006100630000000000000065000000000000000000000000000000000000000000 (UID: 00000000-00007224)31:T64d,"eabd0bd2d942ed6013525df7ffc82dac2e1c7289308952de7dbabe6a03d71e00.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "eabd0bd2d942ed6013525df7ffc82dac2e1c7289308952de7dbabe6a03d71e00.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "se3jY19.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "se3jY19.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "ho0Ot26.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "ho0Ot26.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "vm6LM89.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "vm6LM89.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "kX2gk33.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "kX2gk33.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "1Ae44GC4.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "2Xd7490.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "3PX14vb.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED")32:T676,Found reference to API "ExpandEnvironmentStringsA" (Indicator: "ExpandEnvironmentStrings"; File: "eabd0bd2d942ed6013525df7ffc82dac2e1c7289308952de7dbabe6a03d71e00.exe") Found reference to API "GetSystemInfo" (Indicator: "GetSystemInfo"; File: "eabd0bd2d942ed6013525df7ffc82dac2e1c7289308952de7dbabe6a03d71e00.exe") Found reference to API "GetNativeSystemInfo" (Indicator: "GetNativeSystemInfo"; File: "eabd0bd2d942ed6013525df7ffc82dac2e1c7289308952de7dbabe6a03d71e00.exe") Found reference to API "ExpandEnvironmentStringsA" (Indicator: "ExpandEnvironmentStrings"; Source: "00000000-00004424.00000000.91567.012EA000.00000002.mdmp") Found reference to API "GetSystemInfo" (Indicator: "GetSystemInfo"; Source: "00000000-00004424.00000000.91567.012EA000.00000002.mdmp") Found reference to API "ExpandEnvironmentStringsA" (Indicator: "ExpandEnvironmentStrings"; Source: "00000000-00005996.00000001.93593.00B9A000.00000002.mdmp") Found reference to API "GetSystemInfo" (Indicator: "GetSystemInfo"; Source: "00000000-00005996.00000001.93593.00B9A000.00000002.mdmp") Found reference to API "ExpandEnvironmentStringsA" (Indicator: "ExpandEnvironmentStrings"; Source: "00000000-00007476.00000000.91759.0024A000.00000002.mdmp") Found reference to API "GetSystemInfo" (Indicator: "GetSystemInfo"; Source: "00000000-00007476.00000000.91759.0024A000.00000002.mdmp") Found reference to API "ExpandEnvironmentStringsA" (Indicator: "ExpandEnvironmentStrings"; Source: "00000000-00008204.00000000.91623.001FA000.00000002.mdmp") Found reference to API "GetSystemInfo" (Indicator: "GetSystemInfo"; Source: "00000000-00008204.00000000.91623.001FA000.00000002.mdmp")33:Tb7f,Found reference to API "GetVersionExA" (Indicator: "GetVersionExA"; File: "eabd0bd2d942ed6013525df7ffc82dac2e1c7289308952de7dbabe6a03d71e00.exe") Found reference to API "GetVersionExA" (Indicator: "GetVersion"; File: "eabd0bd2d942ed6013525df7ffc82dac2e1c7289308952de7dbabe6a03d71e00.exe") Found reference to API "GetVersion" (Indicator: "GetVersion"; File: "eabd0bd2d942ed6013525df7ffc82dac2e1c7289308952de7dbabe6a03d71e00.exe") Found reference to API "GetVersionExW" (Indicator: "GetVersionExW"; File: "eabd0bd2d942ed6013525df7ffc82dac2e1c7289308952de7dbabe6a03d71e00.exe") Found reference to API "GetVersionExW" (Indicator: "GetVersion"; File: "eabd0bd2d942ed6013525df7ffc82dac2e1c7289308952de7dbabe6a03d71e00.exe") Found reference to API "tlGetVersion" (Indicator: "GetVersion"; Source: "00000000-00004424.00000000.91567.00E60000.00000004.mdmp, 00000000-00004424.00000002.95407.00E60000.00000004.mdmp") Found reference to API "1671957189,3492,3024,,RtlGetVersion,NTDLL.dll,"00:23:46.593",RX=0,PX=0" (Indicator: "GetVersion"; Source: "00000000-00004424.00000000.91567.00E60000.00000004.mdmp, 00000000-00004424.00000002.95407.00E60000.00000004.mdmp") Found reference to API "GetVersion" (Indicator: "GetVersion"; Source: "00000000-00004424.00000000.91567.012EA000.00000002.mdmp") Found reference to API "GetVersionExA" (Indicator: "GetVersionExA"; Source: "00000000-00004424.00000000.91567.012EA000.00000002.mdmp") Found reference to API "GetVersionExA" (Indicator: "GetVersion"; Source: "00000000-00004424.00000000.91567.012EA000.00000002.mdmp") Found reference to API "GetVersion" (Indicator: "GetVersion"; Source: "00000000-00005996.00000001.93593.00B9A000.00000002.mdmp") Found reference to API "GetVersionExA" (Indicator: "GetVersionExA"; Source: "00000000-00005996.00000001.93593.00B9A000.00000002.mdmp") Found reference to API "GetVersionExA" (Indicator: "GetVersion"; Source: "00000000-00005996.00000001.93593.00B9A000.00000002.mdmp") Found reference to API "GetVersion" (Indicator: "GetVersion"; Source: "00000000-00007476.00000000.91759.0024A000.00000002.mdmp") Found reference to API "GetVersionExA" (Indicator: "GetVersionExA"; Source: "00000000-00007476.00000000.91759.0024A000.00000002.mdmp") Found reference to API "GetVersionExA" (Indicator: "GetVersion"; Source: "00000000-00007476.00000000.91759.0024A000.00000002.mdmp") Found reference to API "1547561394,4380,3024,,RtlGetVersion,NTDLL.dll,"00:23:49.421",RX=0,PX=0" (Indicator: "GetVersion"; Source: "00000000-00007476.00000000.91759.02CC0000.00000004.mdmp") Found reference to API "GetVersion" (Indicator: "GetVersion"; Source: "00000000-00008204.00000000.91623.001FA000.00000002.mdmp") Found reference to API "GetVersionExA" (Indicator: "GetVersionExA"; Source: "00000000-00008204.00000000.91623.001FA000.00000002.mdmp") Found reference to API "GetVersionExA" (Indicator: "GetVersion"; Source: "00000000-00008204.00000000.91623.001FA000.00000002.mdmp")34:T20d2,"eabd0bd2d942ed6013525df7ffc82dac2e1c7289308952de7dbabe6a03d71e00.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00004424) "eabd0bd2d942ed6013525df7ffc82dac2e1c7289308952de7dbabe6a03d71e00.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00004424) "eabd0bd2d942ed6013525df7ffc82dac2e1c7289308952de7dbabe6a03d71e00.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00004424) "eabd0bd2d942ed6013525df7ffc82dac2e1c7289308952de7dbabe6a03d71e00.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00004424) "eabd0bd2d942ed6013525df7ffc82dac2e1c7289308952de7dbabe6a03d71e00.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\advapi32.dll (UID: 00000000-00004424) "eabd0bd2d942ed6013525df7ffc82dac2e1c7289308952de7dbabe6a03d71e00.exe" called "LoadLibrary" with a parameter feclient.dll (UID: 00000000-00004424) "eabd0bd2d942ed6013525df7ffc82dac2e1c7289308952de7dbabe6a03d71e00.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\advpack.dll (UID: 00000000-00004424) "se3jY19.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00008204) "se3jY19.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00008204) "se3jY19.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00008204) "se3jY19.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00008204) "se3jY19.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\advapi32.dll (UID: 00000000-00008204) "se3jY19.exe" called "LoadLibrary" with a parameter feclient.dll (UID: 00000000-00008204) "se3jY19.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\advpack.dll (UID: 00000000-00008204) "ho0Ot26.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00005996) "ho0Ot26.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00005996) "ho0Ot26.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00005996) "ho0Ot26.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00005996) "ho0Ot26.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\advapi32.dll (UID: 00000000-00005996) "ho0Ot26.exe" called "LoadLibrary" with a parameter feclient.dll (UID: 00000000-00005996) "ho0Ot26.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\advpack.dll (UID: 00000000-00005996) "vm6LM89.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00008540) "vm6LM89.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00008540) "vm6LM89.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00008540) "vm6LM89.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00008540) "vm6LM89.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\advapi32.dll (UID: 00000000-00008540) "vm6LM89.exe" called "LoadLibrary" with a parameter feclient.dll (UID: 00000000-00008540) "vm6LM89.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\advpack.dll (UID: 00000000-00008540) "kX2gk33.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00007476) "kX2gk33.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00007476) "kX2gk33.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00007476) "kX2gk33.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00007476) "kX2gk33.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\advapi32.dll (UID: 00000000-00007476) "kX2gk33.exe" called "LoadLibrary" with a parameter feclient.dll (UID: 00000000-00007476) "kX2gk33.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\advpack.dll (UID: 00000000-00007476) "1Ae44GC4.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00007224) "1Ae44GC4.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00007224) "1Ae44GC4.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00007224) "1Ae44GC4.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00007224) "1Ae44GC4.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00007224) "1Ae44GC4.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll (UID: 00000000-00007224) "1Ae44GC4.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00007224) "1Ae44GC4.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2.dll (UID: 00000000-00007224) "1Ae44GC4.exe" called "LoadLibrary" with a parameter VERSION.dll (UID: 00000000-00007224) "1Ae44GC4.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\clr.dll (UID: 00000000-00007224) "1Ae44GC4.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00007224) "1Ae44GC4.exe" called "LoadLibrary" with a parameter api-ms-win-core-quirks-l1-1-0.dll (UID: 00000000-00007224) "1Ae44GC4.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoree.dll (UID: 00000000-00007224) "1Ae44GC4.exe" called "LoadLibrary" with a parameter mscoree.dll (UID: 00000000-00007224) "1Ae44GC4.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\combase.dll (UID: 00000000-00007224) "1Ae44GC4.exe" called "LoadLibrary" with a parameter psapi.dll (UID: 00000000-00007224) "1Ae44GC4.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\mscorlib\36eaccfde177c2e7b93b8dbdde4e012a\mscorlib.ni.dll (UID: 00000000-00007224) "1Ae44GC4.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\ole32.dll (UID: 00000000-00007224) "1Ae44GC4.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00007224) "1Ae44GC4.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00007224) "1Ae44GC4.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00007224) "1Ae44GC4.exe" called "LoadLibrary" with a parameter api-ms-win-core-xstate-l2-1-0.dll (UID: 00000000-00007224) "1Ae44GC4.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\clrjit.dll (UID: 00000000-00007224) "1Ae44GC4.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System\2c3c912ea8f058f9d04c4650128feb3f\System.ni.dll (UID: 00000000-00007224) "1Ae44GC4.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00007224) "1Ae44GC4.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00007224) "1Ae44GC4.exe" called "LoadLibrary" with a parameter advapi32 (UID: 00000000-00007224) "1Ae44GC4.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll (UID: 00000000-00007224) "1Ae44GC4.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00007224) "2Xd7490.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00007892) "2Xd7490.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00007892) "2Xd7490.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00007892) "2Xd7490.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00007892) "2Xd7490.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-0 (UID: 00000000-00007892) "2Xd7490.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2 (UID: 00000000-00007892) "3PX14vb.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00000496) "3PX14vb.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00000496) "3PX14vb.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00000496) "3PX14vb.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00000496)35:Tcc09,"eabd0bd2d942ed6013525df7ffc82dac2e1c7289308952de7dbabe6a03d71e00.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00004424) "eabd0bd2d942ed6013525df7ffc82dac2e1c7289308952de7dbabe6a03d71e00.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00004424) "eabd0bd2d942ed6013525df7ffc82dac2e1c7289308952de7dbabe6a03d71e00.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00004424) "eabd0bd2d942ed6013525df7ffc82dac2e1c7289308952de7dbabe6a03d71e00.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00004424) "eabd0bd2d942ed6013525df7ffc82dac2e1c7289308952de7dbabe6a03d71e00.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00004424) "eabd0bd2d942ed6013525df7ffc82dac2e1c7289308952de7dbabe6a03d71e00.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00004424) "eabd0bd2d942ed6013525df7ffc82dac2e1c7289308952de7dbabe6a03d71e00.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00004424) "eabd0bd2d942ed6013525df7ffc82dac2e1c7289308952de7dbabe6a03d71e00.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00004424) "eabd0bd2d942ed6013525df7ffc82dac2e1c7289308952de7dbabe6a03d71e00.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00004424) "eabd0bd2d942ed6013525df7ffc82dac2e1c7289308952de7dbabe6a03d71e00.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00004424) "eabd0bd2d942ed6013525df7ffc82dac2e1c7289308952de7dbabe6a03d71e00.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00004424) "eabd0bd2d942ed6013525df7ffc82dac2e1c7289308952de7dbabe6a03d71e00.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00004424) "eabd0bd2d942ed6013525df7ffc82dac2e1c7289308952de7dbabe6a03d71e00.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00004424) "eabd0bd2d942ed6013525df7ffc82dac2e1c7289308952de7dbabe6a03d71e00.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00004424) "eabd0bd2d942ed6013525df7ffc82dac2e1c7289308952de7dbabe6a03d71e00.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00004424) "eabd0bd2d942ed6013525df7ffc82dac2e1c7289308952de7dbabe6a03d71e00.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00004424) "eabd0bd2d942ed6013525df7ffc82dac2e1c7289308952de7dbabe6a03d71e00.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00004424) "eabd0bd2d942ed6013525df7ffc82dac2e1c7289308952de7dbabe6a03d71e00.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00004424) "eabd0bd2d942ed6013525df7ffc82dac2e1c7289308952de7dbabe6a03d71e00.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00004424) "eabd0bd2d942ed6013525df7ffc82dac2e1c7289308952de7dbabe6a03d71e00.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00004424) "eabd0bd2d942ed6013525df7ffc82dac2e1c7289308952de7dbabe6a03d71e00.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00004424) "eabd0bd2d942ed6013525df7ffc82dac2e1c7289308952de7dbabe6a03d71e00.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00004424) "eabd0bd2d942ed6013525df7ffc82dac2e1c7289308952de7dbabe6a03d71e00.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00004424) "eabd0bd2d942ed6013525df7ffc82dac2e1c7289308952de7dbabe6a03d71e00.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00004424) "eabd0bd2d942ed6013525df7ffc82dac2e1c7289308952de7dbabe6a03d71e00.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00004424) "eabd0bd2d942ed6013525df7ffc82dac2e1c7289308952de7dbabe6a03d71e00.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00004424) "eabd0bd2d942ed6013525df7ffc82dac2e1c7289308952de7dbabe6a03d71e00.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00004424) "eabd0bd2d942ed6013525df7ffc82dac2e1c7289308952de7dbabe6a03d71e00.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00004424) "eabd0bd2d942ed6013525df7ffc82dac2e1c7289308952de7dbabe6a03d71e00.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00004424) "eabd0bd2d942ed6013525df7ffc82dac2e1c7289308952de7dbabe6a03d71e00.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00004424) "eabd0bd2d942ed6013525df7ffc82dac2e1c7289308952de7dbabe6a03d71e00.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00004424) "eabd0bd2d942ed6013525df7ffc82dac2e1c7289308952de7dbabe6a03d71e00.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00004424) "eabd0bd2d942ed6013525df7ffc82dac2e1c7289308952de7dbabe6a03d71e00.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00004424) "eabd0bd2d942ed6013525df7ffc82dac2e1c7289308952de7dbabe6a03d71e00.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00004424) "eabd0bd2d942ed6013525df7ffc82dac2e1c7289308952de7dbabe6a03d71e00.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00004424) "eabd0bd2d942ed6013525df7ffc82dac2e1c7289308952de7dbabe6a03d71e00.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00004424) "eabd0bd2d942ed6013525df7ffc82dac2e1c7289308952de7dbabe6a03d71e00.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00004424) "eabd0bd2d942ed6013525df7ffc82dac2e1c7289308952de7dbabe6a03d71e00.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00004424) "eabd0bd2d942ed6013525df7ffc82dac2e1c7289308952de7dbabe6a03d71e00.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00004424) "eabd0bd2d942ed6013525df7ffc82dac2e1c7289308952de7dbabe6a03d71e00.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00004424) "eabd0bd2d942ed6013525df7ffc82dac2e1c7289308952de7dbabe6a03d71e00.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00004424) "eabd0bd2d942ed6013525df7ffc82dac2e1c7289308952de7dbabe6a03d71e00.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00004424) "eabd0bd2d942ed6013525df7ffc82dac2e1c7289308952de7dbabe6a03d71e00.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00004424) "eabd0bd2d942ed6013525df7ffc82dac2e1c7289308952de7dbabe6a03d71e00.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00004424) "eabd0bd2d942ed6013525df7ffc82dac2e1c7289308952de7dbabe6a03d71e00.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00004424) "eabd0bd2d942ed6013525df7ffc82dac2e1c7289308952de7dbabe6a03d71e00.exe" called "GetProcAddress" with a parameter HeapSetInformation (UID: 00000000-00004424) "eabd0bd2d942ed6013525df7ffc82dac2e1c7289308952de7dbabe6a03d71e00.exe" called "GetProcAddress" with a parameter DecryptFileA (UID: 00000000-00004424) "eabd0bd2d942ed6013525df7ffc82dac2e1c7289308952de7dbabe6a03d71e00.exe" called "GetProcAddress" with a parameter FeClientInitialize (UID: 00000000-00004424) "eabd0bd2d942ed6013525df7ffc82dac2e1c7289308952de7dbabe6a03d71e00.exe" called "GetProcAddress" with a parameter DelNodeRunDLL32 (UID: 00000000-00004424) "se3jY19.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00008204) "se3jY19.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00008204) "se3jY19.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00008204) "se3jY19.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00008204) "se3jY19.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00008204) "se3jY19.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00008204) "se3jY19.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00008204) "se3jY19.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00008204) "se3jY19.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00008204) "se3jY19.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00008204) "se3jY19.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00008204) "se3jY19.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00008204) "se3jY19.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00008204) "se3jY19.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00008204) "se3jY19.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00008204) "se3jY19.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00008204) "se3jY19.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00008204) "se3jY19.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00008204) "se3jY19.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00008204) "se3jY19.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00008204) "se3jY19.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00008204) "se3jY19.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00008204) "se3jY19.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00008204) "se3jY19.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00008204) "se3jY19.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00008204) "se3jY19.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00008204) "se3jY19.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00008204) "se3jY19.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00008204) "se3jY19.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00008204) "se3jY19.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00008204) "se3jY19.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00008204) "se3jY19.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00008204) "se3jY19.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00008204) "se3jY19.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00008204) "se3jY19.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00008204) "se3jY19.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00008204) "se3jY19.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00008204) "se3jY19.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00008204) "se3jY19.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00008204) "se3jY19.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00008204) "se3jY19.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00008204) "se3jY19.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00008204) "se3jY19.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00008204) "se3jY19.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00008204) "se3jY19.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00008204) "se3jY19.exe" called "GetProcAddress" with a parameter HeapSetInformation (UID: 00000000-00008204) "se3jY19.exe" called "GetProcAddress" with a parameter DecryptFileA (UID: 00000000-00008204) "se3jY19.exe" called "GetProcAddress" with a parameter FeClientInitialize (UID: 00000000-00008204) "se3jY19.exe" called "GetProcAddress" with a parameter DelNodeRunDLL32 (UID: 00000000-00008204) "ho0Ot26.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00005996) "ho0Ot26.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00005996) "ho0Ot26.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00005996) "ho0Ot26.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00005996) "ho0Ot26.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00005996) "ho0Ot26.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00005996) "ho0Ot26.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00005996) "ho0Ot26.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00005996) "ho0Ot26.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00005996) "ho0Ot26.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00005996) "ho0Ot26.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00005996) "ho0Ot26.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00005996) "ho0Ot26.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00005996) "ho0Ot26.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00005996) "ho0Ot26.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00005996) "ho0Ot26.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00005996) "ho0Ot26.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00005996) "ho0Ot26.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00005996) "ho0Ot26.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00005996) "ho0Ot26.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00005996) "ho0Ot26.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00005996) "ho0Ot26.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00005996) "ho0Ot26.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00005996) "ho0Ot26.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00005996) "ho0Ot26.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00005996) "ho0Ot26.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00005996) "ho0Ot26.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00005996) "ho0Ot26.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00005996) "ho0Ot26.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00005996) "ho0Ot26.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00005996) "ho0Ot26.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00005996) "ho0Ot26.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00005996) "ho0Ot26.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00005996) "ho0Ot26.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00005996) "ho0Ot26.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00005996) "ho0Ot26.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00005996) "ho0Ot26.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00005996) "ho0Ot26.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00005996) "ho0Ot26.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00005996) "ho0Ot26.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00005996) "ho0Ot26.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00005996) "ho0Ot26.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00005996) "ho0Ot26.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00005996) "ho0Ot26.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00005996) "ho0Ot26.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00005996) "ho0Ot26.exe" called "GetProcAddress" with a parameter HeapSetInformation (UID: 00000000-00005996) "ho0Ot26.exe" called "GetProcAddress" with a parameter DecryptFileA (UID: 00000000-00005996) "ho0Ot26.exe" called "GetProcAddress" with a parameter FeClientInitialize (UID: 00000000-00005996) "ho0Ot26.exe" called "GetProcAddress" with a parameter DelNodeRunDLL32 (UID: 00000000-00005996) "vm6LM89.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00008540) "vm6LM89.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00008540) "vm6LM89.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00008540) "vm6LM89.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00008540) "vm6LM89.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00008540) "vm6LM89.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00008540) "vm6LM89.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00008540) "vm6LM89.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00008540) "vm6LM89.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00008540) "vm6LM89.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00008540) "vm6LM89.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00008540) "vm6LM89.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00008540) "vm6LM89.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00008540) "vm6LM89.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00008540) "vm6LM89.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00008540) "vm6LM89.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00008540) "vm6LM89.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00008540) "vm6LM89.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00008540) "vm6LM89.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00008540) "vm6LM89.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00008540) "vm6LM89.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00008540) "vm6LM89.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00008540) "vm6LM89.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00008540) "vm6LM89.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00008540) "vm6LM89.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00008540) "vm6LM89.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00008540) "vm6LM89.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00008540) "vm6LM89.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00008540) "vm6LM89.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00008540) "vm6LM89.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00008540) "vm6LM89.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00008540) "vm6LM89.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00008540) "vm6LM89.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00008540) "vm6LM89.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00008540) "vm6LM89.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00008540) "vm6LM89.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00008540) "vm6LM89.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00008540) "vm6LM89.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00008540) "vm6LM89.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00008540) "vm6LM89.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00008540) "vm6LM89.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00008540) "vm6LM89.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00008540) "vm6LM89.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00008540) "vm6LM89.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00008540) "vm6LM89.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00008540) "vm6LM89.exe" called "GetProcAddress" with a parameter HeapSetInformation (UID: 00000000-00008540) "vm6LM89.exe" called "GetProcAddress" with a parameter DecryptFileA (UID: 00000000-00008540) "vm6LM89.exe" called "GetProcAddress" with a parameter FeClientInitialize (UID: 00000000-00008540) "vm6LM89.exe" called "GetProcAddress" with a parameter DelNodeRunDLL32 (UID: 00000000-00008540) "kX2gk33.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00007476) "kX2gk33.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00007476) "kX2gk33.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00007476) "kX2gk33.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00007476) "kX2gk33.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00007476) "kX2gk33.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00007476) "kX2gk33.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00007476) "kX2gk33.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00007476) "kX2gk33.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00007476) "kX2gk33.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00007476) "kX2gk33.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00007476) "kX2gk33.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00007476) "kX2gk33.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00007476) "kX2gk33.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00007476) "kX2gk33.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00007476) "kX2gk33.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00007476) "kX2gk33.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00007476) "kX2gk33.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00007476) "kX2gk33.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00007476) "kX2gk33.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00007476) "kX2gk33.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00007476) "kX2gk33.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00007476) "kX2gk33.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00007476) "kX2gk33.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00007476) "kX2gk33.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00007476) "kX2gk33.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00007476) "kX2gk33.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00007476) "kX2gk33.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00007476) "kX2gk33.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00007476) "kX2gk33.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00007476) "kX2gk33.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00007476) "kX2gk33.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00007476) "kX2gk33.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00007476) "kX2gk33.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00007476) "kX2gk33.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00007476) "kX2gk33.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00007476) "kX2gk33.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00007476) "kX2gk33.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00007476) "kX2gk33.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00007476) "kX2gk33.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00007476) "kX2gk33.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00007476) "kX2gk33.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00007476) "kX2gk33.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00007476) "kX2gk33.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00007476) "kX2gk33.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00007476) "kX2gk33.exe" called "GetProcAddress" with a parameter HeapSetInformation (UID: 00000000-00007476) "kX2gk33.exe" called "GetProcAddress" with a parameter DecryptFileA (UID: 00000000-00007476) "kX2gk33.exe" called "GetProcAddress" with a parameter FeClientInitialize (UID: 00000000-00007476) "kX2gk33.exe" called "GetProcAddress" with a parameter DelNodeRunDLL32 (UID: 00000000-00007476) "1Ae44GC4.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00007224) "1Ae44GC4.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00007224) "1Ae44GC4.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00007224) "1Ae44GC4.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00007224) "1Ae44GC4.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00007224) "1Ae44GC4.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00007224) "1Ae44GC4.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00007224) "1Ae44GC4.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00007224) "1Ae44GC4.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00007224) "1Ae44GC4.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00007224) "1Ae44GC4.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00007224) "1Ae44GC4.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00007224) "1Ae44GC4.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00007224) "1Ae44GC4.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00007224) "1Ae44GC4.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00007224) "1Ae44GC4.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00007224) "1Ae44GC4.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00007224) "1Ae44GC4.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00007224) "1Ae44GC4.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00007224) "1Ae44GC4.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00007224) "1Ae44GC4.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00007224) "1Ae44GC4.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00007224) "1Ae44GC4.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00007224) "1Ae44GC4.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00007224) "1Ae44GC4.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00007224) "1Ae44GC4.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00007224) "1Ae44GC4.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00007224) "1Ae44GC4.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00007224) "1Ae44GC4.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00007224) "1Ae44GC4.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00007224) "1Ae44GC4.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00007224) "1Ae44GC4.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00007224) "1Ae44GC4.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00007224) "1Ae44GC4.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00007224) "1Ae44GC4.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00007224) "1Ae44GC4.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00007224) "1Ae44GC4.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00007224) "1Ae44GC4.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00007224) "1Ae44GC4.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00007224) "1Ae44GC4.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00007224) "1Ae44GC4.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00007224) "1Ae44GC4.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00007224) "1Ae44GC4.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00007224) "1Ae44GC4.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00007224) "1Ae44GC4.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00007224) "1Ae44GC4.exe" called "GetProcAddress" with a parameter DecodePointer (UID: 00000000-00007224) "1Ae44GC4.exe" called "GetProcAddress" with a parameter EncodePointer (UID: 00000000-00007224) "1Ae44GC4.exe" called "GetProcAddress" with a parameter RegOpenKeyExW (UID: 00000000-00007224) "1Ae44GC4.exe" called "GetProcAddress" with a parameter RegQueryInfoKeyW (UID: 00000000-00007224) "1Ae44GC4.exe" called "GetProcAddress" with a parameter RegEnumKeyExW (UID: 00000000-00007224) "1Ae44GC4.exe" called "GetProcAddress" with a parameter RegEnumValueW (UID: 00000000-00007224) "1Ae44GC4.exe" called "GetProcAddress" with a parameter RegCloseKey (UID: 00000000-00007224) "1Ae44GC4.exe" called "GetProcAddress" with a parameter RegQueryValueExW (UID: 00000000-00007224) "1Ae44GC4.exe" called "GetProcAddress" with a parameter AddDllDirectory (UID: 00000000-00007224) "1Ae44GC4.exe" called "GetProcAddress" with a parameter EventRegister (UID: 00000000-00007224) "1Ae44GC4.exe" called "GetProcAddress" with a parameter EventSetInformation (UID: 00000000-00007224) "1Ae44GC4.exe" called "GetProcAddress" with a parameter RegisterShimImplCallback (UID: 00000000-00007224) "1Ae44GC4.exe" called "GetProcAddress" with a parameter RegisterShimImplCleanupCallback (UID: 00000000-00007224) "1Ae44GC4.exe" called "GetProcAddress" with a parameter SetShellShimInstance (UID: 00000000-00007224) "1Ae44GC4.exe" called "GetProcAddress" with a parameter OnShimDllMainCalled (UID: 00000000-00007224) "1Ae44GC4.exe" called "GetProcAddress" with a parameter _CorExeMain_RetAddr (UID: 00000000-00007224) "1Ae44GC4.exe" called "GetProcAddress" with a parameter _CorExeMain (UID: 00000000-00007224) "1Ae44GC4.exe" called "GetProcAddress" with a parameter UrlIsW (UID: 00000000-00007224) "1Ae44GC4.exe" called "GetProcAddress" with a parameter AppPolicyGetClrCompat (UID: 00000000-00007224) "1Ae44GC4.exe" called "GetProcAddress" with a parameter GetCurrentPackageInfo (UID: 00000000-00007224) "1Ae44GC4.exe" called "GetProcAddress" with a parameter GetCurrentPackagePath (UID: 00000000-00007224) "1Ae44GC4.exe" called "GetProcAddress" with a parameter OpenProcessToken (UID: 00000000-00007224) "1Ae44GC4.exe" called "GetProcAddress" with a parameter GetTokenInformation (UID: 00000000-00007224) "1Ae44GC4.exe" called "GetProcAddress" with a parameter GetFileVersionInfoSizeW (UID: 00000000-00007224) "1Ae44GC4.exe" called "GetProcAddress" with a parameter GetFileVersionInfoW (UID: 00000000-00007224) "1Ae44GC4.exe" called "GetProcAddress" with a parameter VerQueryValueW (UID: 00000000-00007224) "1Ae44GC4.exe" called "GetProcAddress" with a parameter SetRuntimeInfo (UID: 00000000-00007224) "1Ae44GC4.exe" called "GetProcAddress" with a parameter GetProcessWindowStation (UID: 00000000-00007224) "1Ae44GC4.exe" called "GetProcAddress" with a parameter GetUserObjectInformationW (UID: 00000000-00007224) "1Ae44GC4.exe" called "GetProcAddress" with a parameter QuirkIsEnabled3 (UID: 00000000-00007224) "1Ae44GC4.exe" called "GetProcAddress" with a parameter QuirkGetData2 (UID: 00000000-00007224) "1Ae44GC4.exe" called "GetProcAddress" with a parameter CreateConfigStream (UID: 00000000-00007224) "1Ae44GC4.exe" called "GetProcAddress" with a parameter CreateConfigStream_RetAddr (UID: 00000000-00007224) "1Ae44GC4.exe" called "GetProcAddress" with a parameter GetNumaHighestNodeNumber (UID: 00000000-00007224) "1Ae44GC4.exe" called "GetProcAddress" with a parameter GetSystemWindowsDirectoryW (UID: 00000000-00007224) "1Ae44GC4.exe" called "GetProcAddress" with a parameter AllocateAndInitializeSid (UID: 00000000-00007224) "1Ae44GC4.exe" called "GetProcAddress" with a parameter InitializeAcl (UID: 00000000-00007224) "1Ae44GC4.exe" called "GetProcAddress" with a parameter AddAccessAllowedAce (UID: 00000000-00007224) "1Ae44GC4.exe" called "GetProcAddress" with a parameter FreeSid (UID: 00000000-00007224) "1Ae44GC4.exe" called "GetProcAddress" with a parameter RoInitialize (UID: 00000000-00007224) "1Ae44GC4.exe" called "GetProcAddress" with a parameter AddSIDToBoundaryDescriptor (UID: 00000000-00007224) "1Ae44GC4.exe" called "GetProcAddress" with a parameter CreateBoundaryDescriptorW (UID: 00000000-00007224) "1Ae44GC4.exe" called "GetProcAddress" with a parameter CreatePrivateNamespaceW (UID: 00000000-00007224) "1Ae44GC4.exe" called "GetProcAddress" with a parameter OpenPrivateNamespaceW (UID: 00000000-00007224) "1Ae44GC4.exe" called "GetProcAddress" with a parameter DeleteBoundaryDescriptor (UID: 00000000-00007224) "1Ae44GC4.exe" called "GetProcAddress" with a parameter WerRegisterRuntimeExceptionModule (UID: 00000000-00007224) "1Ae44GC4.exe" called "GetProcAddress" with a parameter RaiseException (UID: 00000000-00007224) "1Ae44GC4.exe" called "GetProcAddress" with a parameter SetSystemFileCacheSize (UID: 00000000-00007224) "1Ae44GC4.exe" called "GetProcAddress" with a parameter NtSetSystemInformation (UID: 00000000-00007224) "1Ae44GC4.exe" called "GetProcAddress" with a parameter PrivIsDllSynchronizationHeld (UID: 00000000-00007224) "1Ae44GC4.exe" called "GetProcAddress" with a parameter GetProcessMemoryInfo (UID: 00000000-00007224) "1Ae44GC4.exe" called "GetProcAddress" with a parameter GetNativeSystemInfo (UID: 00000000-00007224) "1Ae44GC4.exe" called "GetProcAddress" with a parameter CoInitializeEx (UID: 00000000-00007224) "1Ae44GC4.exe" called "GetProcAddress" with a parameter RoUninitialize (UID: 00000000-00007224) "1Ae44GC4.exe" called "GetProcAddress" with a parameter CoGetContextToken (UID: 00000000-00007224) "1Ae44GC4.exe" called "GetProcAddress" with a parameter GetEnabledXStateFeatures (UID: 00000000-00007224) "1Ae44GC4.exe" called "GetProcAddress" with a parameter sxsJitStartup (UID: 00000000-00007224) "1Ae44GC4.exe" called "GetProcAddress" with a parameter jitStartup (UID: 00000000-00007224) "1Ae44GC4.exe" called "GetProcAddress" with a parameter getJit (UID: 00000000-00007224) "1Ae44GC4.exe" called "GetProcAddress" with a parameter GetUserName (UID: 00000000-00007224) "1Ae44GC4.exe" called "GetProcAddress" with a parameter GetUserNameA (UID: 00000000-00007224) "1Ae44GC4.exe" called "GetProcAddress" with a parameter WideCharToMultiByte (UID: 00000000-00007224) "1Ae44GC4.exe" called "GetProcAddress" with a parameter OpenSCManagerW (UID: 00000000-00007224) "1Ae44GC4.exe" called "GetProcAddress" with a parameter OpenServiceA (UID: 00000000-00007224) "1Ae44GC4.exe" called "GetProcAddress" with a parameter StartService (UID: 00000000-00007224) "1Ae44GC4.exe" called "GetProcAddress" with a parameter StartServiceA (UID: 00000000-00007224) "1Ae44GC4.exe" called "GetProcAddress" with a parameter CloseHandle (UID: 00000000-00007224) "1Ae44GC4.exe" called "GetProcAddress" with a parameter CloseHandleW (UID: 00000000-00007224) "1Ae44GC4.exe" called "GetProcAddress" with a parameter LookupPrivilegeValue (UID: 00000000-00007224) "1Ae44GC4.exe" called "GetProcAddress" with a parameter LookupPrivilegeValueW (UID: 00000000-00007224) "1Ae44GC4.exe" called "GetProcAddress" with a parameter GetCurrentProcess (UID: 00000000-00007224) "1Ae44GC4.exe" called "GetProcAddress" with a parameter OpenProcessTokenW (UID: 00000000-00007224) "1Ae44GC4.exe" called "GetProcAddress" with a parameter AdjustTokenPrivileges (UID: 00000000-00007224) "1Ae44GC4.exe" called "GetProcAddress" with a parameter AdjustTokenPrivilegesW (UID: 00000000-00007224) "1Ae44GC4.exe" called "GetProcAddress" with a parameter NtQuerySystemInformation (UID: 00000000-00007224) "1Ae44GC4.exe" called "GetProcAddress" with a parameter NtQuerySystemInformationW (UID: 00000000-00007224) "1Ae44GC4.exe" called "GetProcAddress" with a parameter OpenProcess (UID: 00000000-00007224) "1Ae44GC4.exe" called "GetProcAddress" with a parameter OpenProcessW (UID: 00000000-00007224) "1Ae44GC4.exe" called "GetProcAddress" with a parameter GetExitCodeProcess (UID: 00000000-00007224) "1Ae44GC4.exe" called "GetProcAddress" with a parameter GetExitCodeProcessW (UID: 00000000-00007224) "1Ae44GC4.exe" called "GetProcAddress" with a parameter ImpersonateLoggedOnUser (UID: 00000000-00007224) "1Ae44GC4.exe" called "GetProcAddress" with a parameter ControlService (UID: 00000000-00007224) "1Ae44GC4.exe" called "GetProcAddress" with a parameter ChangeServiceConfig (UID: 00000000-00007224) "1Ae44GC4.exe" called "GetProcAddress" with a parameter ChangeServiceConfigA (UID: 00000000-00007224) "1Ae44GC4.exe" called "GetProcAddress" with a parameter CoTaskMemFree (UID: 00000000-00007224) "1Ae44GC4.exe" called "GetProcAddress" with a parameter LocaleNameToLCID (UID: 00000000-00007224) "1Ae44GC4.exe" called "GetProcAddress" with a parameter GetUserDefaultLocaleName (UID: 00000000-00007224) "1Ae44GC4.exe" called "GetProcAddress" with a parameter LCIDToLocaleName (UID: 00000000-00007224) "1Ae44GC4.exe" called "GetProcAddress" with a parameter GetUserPreferredUILanguages (UID: 00000000-00007224) "1Ae44GC4.exe" called "GetProcAddress" with a parameter FindNLSStringEx (UID: 00000000-00007224) "1Ae44GC4.exe" called "GetProcAddress" with a parameter RegOpenKeyEx (UID: 00000000-00007224) "1Ae44GC4.exe" called "GetProcAddress" with a parameter RegCreateKeyEx (UID: 00000000-00007224) "1Ae44GC4.exe" called "GetProcAddress" with a parameter RegCreateKeyExW (UID: 00000000-00007224) "1Ae44GC4.exe" called "GetProcAddress" with a parameter RegQueryValueEx (UID: 00000000-00007224) "1Ae44GC4.exe" called "GetProcAddress" with a parameter RegSetValueEx (UID: 00000000-00007224) "1Ae44GC4.exe" called "GetProcAddress" with a parameter RegSetValueExW (UID: 00000000-00007224) "1Ae44GC4.exe" called "GetProcAddress" with a parameter GetProcessExecutableHeap (UID: 00000000-00007224) "1Ae44GC4.exe" called "GetProcAddress" with a parameter GetProcessExecutableHeap_RetAddr (UID: 00000000-00007224) "1Ae44GC4.exe" called "GetProcAddress" with a parameter EventUnregister (UID: 00000000-00007224) "1Ae44GC4.exe" called "GetProcAddress" with a parameter CoUninitialize (UID: 00000000-00007224) "1Ae44GC4.exe" called "GetProcAddress" with a parameter CreateActCtxW (UID: 00000000-00007224) "1Ae44GC4.exe" called "GetProcAddress" with a parameter AddRefActCtx (UID: 00000000-00007224) "1Ae44GC4.exe" called "GetProcAddress" with a parameter ReleaseActCtx (UID: 00000000-00007224) "1Ae44GC4.exe" called "GetProcAddress" with a parameter ActivateActCtx (UID: 00000000-00007224) "1Ae44GC4.exe" called "GetProcAddress" with a parameter DeactivateActCtx (UID: 00000000-00007224) "1Ae44GC4.exe" called "GetProcAddress" with a parameter GetCurrentActCtx (UID: 00000000-00007224) "1Ae44GC4.exe" called "GetProcAddress" with a parameter QueryActCtxW (UID: 00000000-00007224) "2Xd7490.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00007892) "2Xd7490.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00007892) "2Xd7490.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00007892) "2Xd7490.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00007892) "2Xd7490.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00007892) "2Xd7490.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00007892) "2Xd7490.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00007892) "2Xd7490.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00007892) "2Xd7490.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00007892) "2Xd7490.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00007892) "2Xd7490.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00007892) "2Xd7490.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00007892) "2Xd7490.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00007892) "2Xd7490.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00007892) "2Xd7490.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00007892) "2Xd7490.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00007892) "2Xd7490.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00007892) "2Xd7490.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00007892) "2Xd7490.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00007892) "2Xd7490.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00007892) "2Xd7490.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00007892) "2Xd7490.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00007892) "2Xd7490.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00007892) "2Xd7490.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00007892) "2Xd7490.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00007892) "2Xd7490.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00007892) "2Xd7490.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00007892) "2Xd7490.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00007892) "2Xd7490.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00007892) "2Xd7490.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00007892) "2Xd7490.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00007892) "2Xd7490.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00007892) "2Xd7490.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00007892) "2Xd7490.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00007892) "2Xd7490.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00007892) "2Xd7490.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00007892) "2Xd7490.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00007892) "2Xd7490.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00007892) "2Xd7490.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00007892) "2Xd7490.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00007892) "2Xd7490.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00007892) "2Xd7490.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00007892) "2Xd7490.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00007892) "2Xd7490.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00007892) "2Xd7490.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00007892) "2Xd7490.exe" called "GetProcAddress" with a parameter AppPolicyGetProcessTerminationMethod (UID: 00000000-00007892) "3PX14vb.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00000496) "3PX14vb.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00000496) "3PX14vb.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00000496) "3PX14vb.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00000496) "3PX14vb.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00000496) "3PX14vb.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00000496) "3PX14vb.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00000496) "3PX14vb.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00000496) "3PX14vb.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00000496) "3PX14vb.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00000496) "3PX14vb.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00000496) "3PX14vb.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00000496) "3PX14vb.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00000496) "3PX14vb.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00000496) "3PX14vb.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00000496) "3PX14vb.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00000496) "3PX14vb.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00000496) "3PX14vb.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00000496) "3PX14vb.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00000496) "3PX14vb.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00000496) "3PX14vb.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00000496) "3PX14vb.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00000496) "3PX14vb.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00000496) "3PX14vb.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00000496) "3PX14vb.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00000496) "3PX14vb.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00000496) "3PX14vb.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00000496) "3PX14vb.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00000496) "3PX14vb.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00000496) "3PX14vb.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00000496) "3PX14vb.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00000496) "3PX14vb.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00000496) "3PX14vb.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00000496) "3PX14vb.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00000496) "3PX14vb.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00000496) "3PX14vb.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00000496) "3PX14vb.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00000496) "3PX14vb.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00000496) "3PX14vb.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00000496) "3PX14vb.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00000496) "3PX14vb.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00000496) "3PX14vb.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00000496) "3PX14vb.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00000496) "3PX14vb.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00000496) "3PX14vb.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00000496)36:T1655,Found reference to API "CreateProcessA" (Indicator: "CreateProcess"; File: "eabd0bd2d942ed6013525df7ffc82dac2e1c7289308952de7dbabe6a03d71e00.exe") Found reference to API "__COMPAT_LAYER=ElevateCreateProcess WRPMitigation" (Indicator: "CreateProcess"; Source: "00000000-00000496.00000000.92449.02F50000.00000004.mdmp, 00000000-00000496.00000000.92449.030B0000.00000004.mdmp, 00000000-00000496.00000001.94371.02F40000.00000004.mdmp, 00000000-00000496.00000002.96288.02F40000.00000004.mdmp, 00000000-00000496.00000002.96288.02F50000.00000004.mdmp") Found reference to API "" (Indicator: "CreateProcess"; Source: "00000000-00000496.00000000.92449.02F50000.00000004.mdmp, 00000000-00000496.00000002.96288.02F50000.00000004.mdmp") Found reference to API "" (Indicator: "CreateProcess"; Source: "00000000-00000496.00000000.92449.02F50000.00000004.mdmp, 00000000-00000496.00000002.96288.02F50000.00000004.mdmp") Found reference to API "" (Indicator: "CreateProcess"; Source: "00000000-00000496.00000000.92449.02F50000.00000004.mdmp, 00000000-00000496.00000002.96288.02F50000.00000004.mdmp") Found reference to API "" (Indicator: "CreateProcess"; Source: "00000000-00000496.00000000.92449.02F50000.00000004.mdmp, 00000000-00000496.00000002.96288.02F50000.00000004.mdmp") Found reference to API "levateCreateProcess" (Indicator: "CreateProcess"; Source: "00000000-00000496.00000001.94371.02F40000.00000004.mdmp, 00000000-00000496.00000002.96288.02F40000.00000004.mdmp") Found reference to API "levateCreateProcess" (Indicator: "CreateProcess"; Source: "00000000-00004424.00000000.91567.00E60000.00000004.mdmp, 00000000-00004424.00000002.95407.00E60000.00000004.mdmp") Found reference to API "__COMPAT_LAYER=ElevateCreateProcess WRPMitigation" (Indicator: "CreateProcess"; Source: "00000000-00004424.00000000.91567.00E60000.00000004.mdmp, 00000000-00004424.00000002.95407.00E60000.00000004.mdmp, 00000000-00004424.00000002.95407.010C0000.00000004.mdmp") Found reference to API "ElevateCreateProcess WRPMitigation" (Indicator: "CreateProcess"; Source: "00000000-00004424.00000000.91567.00E60000.00000004.mdmp, 00000000-00004424.00000002.95407.00E60000.00000004.mdmp") Found reference to API "L32.DLL" FUNCTION="CreateProcessW"/>" (Indicator: "CreateProcess"; Source: "00000000-00004424.00000000.91567.00E60000.00000004.mdmp 00000000-00004424.00000002.95407.00E60000.00000004.mdmp"), Found reference to API "" (Indicator: "CreateProcess"; Source: "00000000-00004424.00000000.91567.00E60000.00000004.mdmp 00000000-00004424.00000002.95407.00E60000.00000004.mdmp"), Found reference to API "" (Indicator: "CreateProcess"; Source: "00000000-00004424.00000000.91567.00E60000.00000004.mdmp 00000000-00004424.00000002.95407.00E60000.00000004.mdmp"), Found reference to API "" (Indicator: "CreateProcess"; Source: "00000000-00004424.00000000.91567.00E60000.00000004.mdmp 00000000-00004424.00000002.95407.00E60000.00000004.mdmp"), Found reference to API "" (Indicator: "CreateProcess"; Source: "00000000-00004424.00000000.91567.00E60000.00000004.mdmp 00000000-00004424.00000002.95407.00E60000.00000004.mdmp"), Found reference to API "1673324273 3492 3140 CreateProcessA kernel32.dll "00:23:46.593" RX=0 PX=0" (Indicator: "CreateProcess"; Source: "00000000-00004424.00000000.91567.00E60000.00000004.mdmp 00000000-00004424.00000002.95407.00E60000.00000004.mdmp"), Found reference to API "PRINT NS_ElevateCreateProcess::APIHook_CreateProcessA 318 [ApiName] Hook Entered" (Indicator: "CreateProcess"; Source: "00000000-00004424.00000000.91567.00E60000.00000004.mdmp 00000000-00004424.00000002.95407.00E60000.00000004.mdmp"), Found reference to API "CreateProcessA" (Indicator: "CreateProcess"; Source: "00000000-00004424.00000000.91567.012EA000.00000002.mdmp"), Found reference to API "__COMPAT_LAYER=ElevateCreateProcess WRPMitigation" (Indicator: "CreateProcess"; Source: "00000000-00005996.00000000.91672.035C0000.00000004.mdmp 00000000-00005996.00000001.93593.03350000.00000004.mdmp 00000000-00005996.00000002.95514.03350000.00000004.mdmp"), Found reference to API "CreateProcessA" (Indicator: "CreateProcess"; Source: "00000000-00005996.00000001.93593.00B9A000.00000002.mdmp"), Found reference to API "levateCreateProcess" (Indicator: "CreateProcess"; Source: "00000000-00005996.00000001.93593.03350000.00000004.mdmp 00000000-00005996.00000002.95514.03350000.00000004.mdmp"), Found reference to API "ElevateCreateProcess WRPMitigation" (Indicator: "CreateProcess"; Source: "00000000-00005996.00000001.93593.03350000.00000004.mdmp 00000000-00005996.00000002.95514.03350000.00000004.mdmp"), Found reference to API "" (Indicator: "CreateProcess"; Source: "00000000-00005996.00000001.93593.03350000.00000004.mdmp 00000000-00005996.00000002.95514.03350000.00000004.mdmp"), Found reference to API "" (Indicator: "CreateProcess"; Source: "00000000-00005996.00000001.93593.03350000.00000004.mdmp 00000000-00005996.00000002.95514.03350000.00000004.mdmp"), Found reference to API "" (Indicator: "CreateProcess"; Source: "00000000-00005996.00000001.93593.03350000.00000004.mdmp 00000000-00005996.00000002.95514.03350000.00000004.mdmp")37:T1072,Found reference to API "RegCreateKeyExA" (Indicator: "RegCreateKey"; File: "eabd0bd2d942ed6013525df7ffc82dac2e1c7289308952de7dbabe6a03d71e00.exe") Found reference to API "" (Indicator: "RegCreateKey"; Source: "00000000-00000496.00000000.92449.02F50000.00000004.mdmp, 00000000-00000496.00000002.96288.02F50000.00000004.mdmp") Found reference to API "" (Indicator: "RegCreateKey"; Source: "00000000-00000496.00000000.92449.02F50000.00000004.mdmp, 00000000-00000496.00000002.96288.02F50000.00000004.mdmp") Found reference to API "" (Indicator: "RegCreateKey"; Source: "00000000-00000496.00000000.92449.02F50000.00000004.mdmp, 00000000-00000496.00000002.96288.02F50000.00000004.mdmp") Found reference to API "" (Indicator: "RegCreateKey"; Source: "00000000-00000496.00000000.92449.02F50000.00000004.mdmp, 00000000-00000496.00000002.96288.02F50000.00000004.mdmp") Found reference to API "" (Indicator: "RegCreateKey"; Source: "00000000-00004424.00000000.91567.00E60000.00000004.mdmp, 00000000-00004424.00000002.95407.00E60000.00000004.mdmp") Found reference to API "" (Indicator: "RegCreateKey"; Source: "00000000-00004424.00000000.91567.00E60000.00000004.mdmp, 00000000-00004424.00000002.95407.00E60000.00000004.mdmp") Found reference to API "" (Indicator: "RegCreateKey"; Source: "00000000-00004424.00000000.91567.00E60000.00000004.mdmp, 00000000-00004424.00000002.95407.00E60000.00000004.mdmp") Found reference to API "" (Indicator: "RegCreateKey"; Source: "00000000-00004424.00000000.91567.00E60000.00000004.mdmp, 00000000-00004424.00000002.95407.00E60000.00000004.mdmp") Found reference to API "RegCreateKeyExA" (Indicator: "RegCreateKey"; Source: "00000000-00004424.00000000.91567.012EA000.00000002.mdmp") Found reference to API "RegCreateKeyExA" (Indicator: "RegCreateKey"; Source: "00000000-00005996.00000001.93593.00B9A000.00000002.mdmp") Found reference to API "" (Indicator: "RegCreateKey"; Source: "00000000-00005996.00000001.93593.03350000.00000004.mdmp, 00000000-00005996.00000002.95514.03350000.00000004.mdmp") Found reference to API "" (Indicator: "RegCreateKey"; Source: "00000000-00005996.00000001.93593.03350000.00000004.mdmp, 00000000-00005996.00000002.95514.03350000.00000004.mdmp") Found reference to API "" (Indicator: "RegCreateKey"; Source: "00000000-00005996.00000001.93593.03350000.00000004.mdmp, 00000000-00005996.00000002.95514.03350000.00000004.mdmp") Found reference to API "" (Indicator: "RegCreateKey"; Source: "00000000-00005996.00000001.93593.03350000.00000004.mdmp, 00000000-00005996.00000002.95514.03350000.00000004.mdmp") Found reference to API "RegCreateKeyExA" (Indicator: "RegCreateKey"; Source: "00000000-00007476.00000000.91759.0024A000.00000002.mdmp") Found reference to API "" (Indicator: "RegCreateKey"; Source: "00000000-00007476.00000000.91759.02CC0000.00000004.mdmp") Found reference to API "" (Indicator: "RegCreateKey"; Source: "00000000-00007476.00000000.91759.02CC0000.00000004.mdmp") Found reference to API "" (Indicator: "RegCreateKey"; Source: "00000000-00007476.00000000.91759.02CC0000.00000004.mdmp") Found reference to API "" (Indicator: "RegCreateKey"; Source: "00000000-00007476.00000000.91759.02CC0000.00000004.mdmp") Found reference to API "RegCreateKeyExA" (Indicator: "RegCreateKey"; Source: "00000000-00008204.00000000.91623.001FA000.00000002.mdmp")38:T9dc,Found reference to API "CreateFileA" (Indicator: "CreateFile"; File: "eabd0bd2d942ed6013525df7ffc82dac2e1c7289308952de7dbabe6a03d71e00.exe") Found reference to API "CreateFileW" (Indicator: "CreateFile"; File: "eabd0bd2d942ed6013525df7ffc82dac2e1c7289308952de7dbabe6a03d71e00.exe") Found reference to API "" (Indicator: "CreateFile"; Source: "00000000-00000496.00000000.92449.02F50000.00000004.mdmp, 00000000-00000496.00000002.96288.02F50000.00000004.mdmp") Found reference to API "" (Indicator: "CreateFile"; Source: "00000000-00000496.00000000.92449.02F50000.00000004.mdmp, 00000000-00000496.00000002.96288.02F50000.00000004.mdmp") Found reference to API "" (Indicator: "CreateFile"; Source: "00000000-00004424.00000000.91567.00E60000.00000004.mdmp, 00000000-00004424.00000002.95407.00E60000.00000004.mdmp") Found reference to API "" (Indicator: "CreateFile"; Source: "00000000-00004424.00000000.91567.00E60000.00000004.mdmp, 00000000-00004424.00000002.95407.00E60000.00000004.mdmp") Found reference to API "CreateFileA" (Indicator: "CreateFile"; Source: "00000000-00004424.00000000.91567.012EA000.00000002.mdmp") Found reference to API "CreateFileA" (Indicator: "CreateFile"; Source: "00000000-00005996.00000001.93593.00B9A000.00000002.mdmp") Found reference to API "" (Indicator: "CreateFile"; Source: "00000000-00005996.00000001.93593.03350000.00000004.mdmp, 00000000-00005996.00000002.95514.03350000.00000004.mdmp") Found reference to API "" (Indicator: "CreateFile"; Source: "00000000-00005996.00000001.93593.03350000.00000004.mdmp, 00000000-00005996.00000002.95514.03350000.00000004.mdmp") Found reference to API "CreateFileA" (Indicator: "CreateFile"; Source: "00000000-00007476.00000000.91759.0024A000.00000002.mdmp") Found reference to API "" (Indicator: "CreateFile"; Source: "00000000-00007476.00000000.91759.02CC0000.00000004.mdmp") Found reference to API "" (Indicator: "CreateFile"; Source: "00000000-00007476.00000000.91759.02CC0000.00000004.mdmp") Found reference to API "CreateFileA" (Indicator: "CreateFile"; Source: "00000000-00008204.00000000.91623.001FA000.00000002.mdmp")39:T176f0,Found reference to API (Indicator: "AllocateAndInitializeSid"; File: "eabd0bd2d942ed6013525df7ffc82dac2e1c7289308952de7dbabe6a03d71e00.exe") Found reference to API (Indicator: "LookupPrivilegeValueA"; File: "eabd0bd2d942ed6013525df7ffc82dac2e1c7289308952de7dbabe6a03d71e00.exe") Found reference to API (Indicator: "OpenProcessToken"; File: "eabd0bd2d942ed6013525df7ffc82dac2e1c7289308952de7dbabe6a03d71e00.exe") Found reference to API (Indicator: "GetTokenInformation"; File: "eabd0bd2d942ed6013525df7ffc82dac2e1c7289308952de7dbabe6a03d71e00.exe") Found reference to API (Indicator: "RegCloseKey"; File: "eabd0bd2d942ed6013525df7ffc82dac2e1c7289308952de7dbabe6a03d71e00.exe") Found reference to API (Indicator: "RegCreateKeyExA"; File: "eabd0bd2d942ed6013525df7ffc82dac2e1c7289308952de7dbabe6a03d71e00.exe") Found reference to API (Indicator: "RegDeleteValueA"; File: "eabd0bd2d942ed6013525df7ffc82dac2e1c7289308952de7dbabe6a03d71e00.exe") Found reference to API (Indicator: "RegSetValueExA"; File: "eabd0bd2d942ed6013525df7ffc82dac2e1c7289308952de7dbabe6a03d71e00.exe") Found reference to API (Indicator: "FreeSid"; File: "eabd0bd2d942ed6013525df7ffc82dac2e1c7289308952de7dbabe6a03d71e00.exe") Found reference to API (Indicator: "RegQueryInfoKeyA"; File: "eabd0bd2d942ed6013525df7ffc82dac2e1c7289308952de7dbabe6a03d71e00.exe") Found reference to API (Indicator: "AdjustTokenPrivileges"; File: "eabd0bd2d942ed6013525df7ffc82dac2e1c7289308952de7dbabe6a03d71e00.exe") Found reference to API (Indicator: "RegOpenKeyExA"; File: "eabd0bd2d942ed6013525df7ffc82dac2e1c7289308952de7dbabe6a03d71e00.exe") Found reference to API (Indicator: "RegQueryValueExA"; File: "eabd0bd2d942ed6013525df7ffc82dac2e1c7289308952de7dbabe6a03d71e00.exe") Found reference to API (Indicator: "EqualSid"; File: "eabd0bd2d942ed6013525df7ffc82dac2e1c7289308952de7dbabe6a03d71e00.exe") Found reference to API (Indicator: "GetDeviceCaps"; File: "eabd0bd2d942ed6013525df7ffc82dac2e1c7289308952de7dbabe6a03d71e00.exe") Found reference to API (Indicator: "MulDiv"; File: "eabd0bd2d942ed6013525df7ffc82dac2e1c7289308952de7dbabe6a03d71e00.exe") Found reference to API (Indicator: "FormatMessageA"; File: "eabd0bd2d942ed6013525df7ffc82dac2e1c7289308952de7dbabe6a03d71e00.exe") Found reference to API (Indicator: "GetStartupInfoW"; File: "eabd0bd2d942ed6013525df7ffc82dac2e1c7289308952de7dbabe6a03d71e00.exe") Found reference to API (Indicator: "GetVersionExA"; File: "eabd0bd2d942ed6013525df7ffc82dac2e1c7289308952de7dbabe6a03d71e00.exe") Found reference to API (Indicator: "CreateMutexA"; File: "eabd0bd2d942ed6013525df7ffc82dac2e1c7289308952de7dbabe6a03d71e00.exe") Found reference to API (Indicator: "LocalAlloc"; File: "eabd0bd2d942ed6013525df7ffc82dac2e1c7289308952de7dbabe6a03d71e00.exe") Found reference to API (Indicator: "GetVolumeInformationA"; File: "eabd0bd2d942ed6013525df7ffc82dac2e1c7289308952de7dbabe6a03d71e00.exe") Found reference to API (Indicator: "SetFileAttributesA"; File: "eabd0bd2d942ed6013525df7ffc82dac2e1c7289308952de7dbabe6a03d71e00.exe") Found reference to API (Indicator: "GetPrivateProfileStringA"; File: "eabd0bd2d942ed6013525df7ffc82dac2e1c7289308952de7dbabe6a03d71e00.exe") Found reference to API (Indicator: "GlobalUnlock"; File: "eabd0bd2d942ed6013525df7ffc82dac2e1c7289308952de7dbabe6a03d71e00.exe") Found reference to API (Indicator: "SetUnhandledExceptionFilter"; File: "eabd0bd2d942ed6013525df7ffc82dac2e1c7289308952de7dbabe6a03d71e00.exe") Found reference to API (Indicator: "CreateEventA"; File: "eabd0bd2d942ed6013525df7ffc82dac2e1c7289308952de7dbabe6a03d71e00.exe") Found reference to API (Indicator: "GetDriveTypeA"; File: "eabd0bd2d942ed6013525df7ffc82dac2e1c7289308952de7dbabe6a03d71e00.exe") Found reference to API (Indicator: "SetFilePointer"; File: "eabd0bd2d942ed6013525df7ffc82dac2e1c7289308952de7dbabe6a03d71e00.exe") Found reference to API (Indicator: "FreeLibrary"; File: "eabd0bd2d942ed6013525df7ffc82dac2e1c7289308952de7dbabe6a03d71e00.exe") Found reference to API (Indicator: "LocalFree"; File: "eabd0bd2d942ed6013525df7ffc82dac2e1c7289308952de7dbabe6a03d71e00.exe") Found reference to API (Indicator: "FindNextFileA"; File: "eabd0bd2d942ed6013525df7ffc82dac2e1c7289308952de7dbabe6a03d71e00.exe") Found reference to API (Indicator: "TerminateThread"; File: "eabd0bd2d942ed6013525df7ffc82dac2e1c7289308952de7dbabe6a03d71e00.exe") Found reference to API (Indicator: "FindClose"; File: "eabd0bd2d942ed6013525df7ffc82dac2e1c7289308952de7dbabe6a03d71e00.exe") Found reference to API (Indicator: "IsDBCSLeadByte"; File: "eabd0bd2d942ed6013525df7ffc82dac2e1c7289308952de7dbabe6a03d71e00.exe") Found reference to API (Indicator: "GetModuleFileNameA"; File: "eabd0bd2d942ed6013525df7ffc82dac2e1c7289308952de7dbabe6a03d71e00.exe") Found reference to API (Indicator: "DosDateTimeToFileTime"; File: "eabd0bd2d942ed6013525df7ffc82dac2e1c7289308952de7dbabe6a03d71e00.exe") Found reference to API (Indicator: "QueryPerformanceCounter"; File: "eabd0bd2d942ed6013525df7ffc82dac2e1c7289308952de7dbabe6a03d71e00.exe") Found reference to API (Indicator: "ReadFile"; File: "eabd0bd2d942ed6013525df7ffc82dac2e1c7289308952de7dbabe6a03d71e00.exe") Found reference to API (Indicator: "GetTickCount"; File: "eabd0bd2d942ed6013525df7ffc82dac2e1c7289308952de7dbabe6a03d71e00.exe") Found reference to API (Indicator: "LocalFileTimeToFileTime"; File: "eabd0bd2d942ed6013525df7ffc82dac2e1c7289308952de7dbabe6a03d71e00.exe") Found reference to API (Indicator: "UnhandledExceptionFilter"; File: "eabd0bd2d942ed6013525df7ffc82dac2e1c7289308952de7dbabe6a03d71e00.exe") Found reference to API (Indicator: "CreateProcessA"; File: "eabd0bd2d942ed6013525df7ffc82dac2e1c7289308952de7dbabe6a03d71e00.exe") Found reference to API (Indicator: "RemoveDirectoryA"; File: "eabd0bd2d942ed6013525df7ffc82dac2e1c7289308952de7dbabe6a03d71e00.exe") Found reference to API (Indicator: "GetModuleHandleW"; File: "eabd0bd2d942ed6013525df7ffc82dac2e1c7289308952de7dbabe6a03d71e00.exe") Found reference to API (Indicator: "GetLastError"; File: "eabd0bd2d942ed6013525df7ffc82dac2e1c7289308952de7dbabe6a03d71e00.exe") Found reference to API (Indicator: "ExpandEnvironmentStringsA"; File: "eabd0bd2d942ed6013525df7ffc82dac2e1c7289308952de7dbabe6a03d71e00.exe") Found reference to API (Indicator: "GetWindowsDirectoryA"; File: "eabd0bd2d942ed6013525df7ffc82dac2e1c7289308952de7dbabe6a03d71e00.exe") Found reference to API (Indicator: "CreateThread"; File: "eabd0bd2d942ed6013525df7ffc82dac2e1c7289308952de7dbabe6a03d71e00.exe") Found reference to API (Indicator: "FreeResource"; File: "eabd0bd2d942ed6013525df7ffc82dac2e1c7289308952de7dbabe6a03d71e00.exe") Found reference to API (Indicator: "DeleteFileA"; File: "eabd0bd2d942ed6013525df7ffc82dac2e1c7289308952de7dbabe6a03d71e00.exe") Found reference to API (Indicator: "WaitForSingleObject"; File: "eabd0bd2d942ed6013525df7ffc82dac2e1c7289308952de7dbabe6a03d71e00.exe") Found reference to API (Indicator: "GetCurrentProcessId"; File: "eabd0bd2d942ed6013525df7ffc82dac2e1c7289308952de7dbabe6a03d71e00.exe") Found reference to API (Indicator: "GetShortPathNameA"; File: "eabd0bd2d942ed6013525df7ffc82dac2e1c7289308952de7dbabe6a03d71e00.exe") Found reference to API (Indicator: "GetTempPathA"; File: "eabd0bd2d942ed6013525df7ffc82dac2e1c7289308952de7dbabe6a03d71e00.exe") Found reference to API (Indicator: "SetEvent"; File: "eabd0bd2d942ed6013525df7ffc82dac2e1c7289308952de7dbabe6a03d71e00.exe") Found reference to API (Indicator: "GetDiskFreeSpaceA"; File: "eabd0bd2d942ed6013525df7ffc82dac2e1c7289308952de7dbabe6a03d71e00.exe") Found reference to API (Indicator: "GetTempFileNameA"; File: "eabd0bd2d942ed6013525df7ffc82dac2e1c7289308952de7dbabe6a03d71e00.exe") Found reference to API (Indicator: "GlobalFree"; File: "eabd0bd2d942ed6013525df7ffc82dac2e1c7289308952de7dbabe6a03d71e00.exe") Found reference to API (Indicator: "LoadResource"; File: "eabd0bd2d942ed6013525df7ffc82dac2e1c7289308952de7dbabe6a03d71e00.exe") Found reference to API (Indicator: "GetCurrentDirectoryA"; File: "eabd0bd2d942ed6013525df7ffc82dac2e1c7289308952de7dbabe6a03d71e00.exe") Found reference to API (Indicator: "GetFileAttributesA"; File: "eabd0bd2d942ed6013525df7ffc82dac2e1c7289308952de7dbabe6a03d71e00.exe") Found reference to API (Indicator: "TerminateProcess"; File: "eabd0bd2d942ed6013525df7ffc82dac2e1c7289308952de7dbabe6a03d71e00.exe") Found reference to API (Indicator: "GetSystemDirectoryA"; File: "eabd0bd2d942ed6013525df7ffc82dac2e1c7289308952de7dbabe6a03d71e00.exe") Found reference to API (Indicator: "SetFileTime"; File: "eabd0bd2d942ed6013525df7ffc82dac2e1c7289308952de7dbabe6a03d71e00.exe") Found reference to API (Indicator: "SetCurrentDirectoryA"; File: "eabd0bd2d942ed6013525df7ffc82dac2e1c7289308952de7dbabe6a03d71e00.exe") Found reference to API (Indicator: "GetSystemInfo"; File: "eabd0bd2d942ed6013525df7ffc82dac2e1c7289308952de7dbabe6a03d71e00.exe") Found reference to API (Indicator: "GetVersion"; File: "eabd0bd2d942ed6013525df7ffc82dac2e1c7289308952de7dbabe6a03d71e00.exe") Found reference to API (Indicator: "GetCurrentProcess"; File: "eabd0bd2d942ed6013525df7ffc82dac2e1c7289308952de7dbabe6a03d71e00.exe") Found reference to API (Indicator: "EnumResourceLanguagesA"; File: "eabd0bd2d942ed6013525df7ffc82dac2e1c7289308952de7dbabe6a03d71e00.exe") Found reference to API (Indicator: "GetCurrentThreadId"; File: "eabd0bd2d942ed6013525df7ffc82dac2e1c7289308952de7dbabe6a03d71e00.exe") Found reference to API (Indicator: "ResetEvent"; File: "eabd0bd2d942ed6013525df7ffc82dac2e1c7289308952de7dbabe6a03d71e00.exe") Found reference to API (Indicator: "LockResource"; File: "eabd0bd2d942ed6013525df7ffc82dac2e1c7289308952de7dbabe6a03d71e00.exe") Found reference to API (Indicator: "Sleep"; File: "eabd0bd2d942ed6013525df7ffc82dac2e1c7289308952de7dbabe6a03d71e00.exe") Found reference to API (Indicator: "CreateFileA"; File: "eabd0bd2d942ed6013525df7ffc82dac2e1c7289308952de7dbabe6a03d71e00.exe") Found reference to API (Indicator: "FindFirstFileA"; File: "eabd0bd2d942ed6013525df7ffc82dac2e1c7289308952de7dbabe6a03d71e00.exe") Found reference to API (Indicator: "GetExitCodeProcess"; File: "eabd0bd2d942ed6013525df7ffc82dac2e1c7289308952de7dbabe6a03d71e00.exe") Found reference to API (Indicator: "GlobalAlloc"; File: "eabd0bd2d942ed6013525df7ffc82dac2e1c7289308952de7dbabe6a03d71e00.exe") Found reference to API (Indicator: "CompareStringA"; File: "eabd0bd2d942ed6013525df7ffc82dac2e1c7289308952de7dbabe6a03d71e00.exe") Found reference to API (Indicator: "CloseHandle"; File: "eabd0bd2d942ed6013525df7ffc82dac2e1c7289308952de7dbabe6a03d71e00.exe") Found reference to API (Indicator: "LoadLibraryA"; File: "eabd0bd2d942ed6013525df7ffc82dac2e1c7289308952de7dbabe6a03d71e00.exe") Found reference to API (Indicator: "SizeofResource"; File: "eabd0bd2d942ed6013525df7ffc82dac2e1c7289308952de7dbabe6a03d71e00.exe") Found reference to API (Indicator: "CreateDirectoryA"; File: "eabd0bd2d942ed6013525df7ffc82dac2e1c7289308952de7dbabe6a03d71e00.exe") Found reference to API (Indicator: "FindResourceA"; File: "eabd0bd2d942ed6013525df7ffc82dac2e1c7289308952de7dbabe6a03d71e00.exe") Found reference to API (Indicator: "WriteFile"; File: "eabd0bd2d942ed6013525df7ffc82dac2e1c7289308952de7dbabe6a03d71e00.exe") Found reference to API (Indicator: "ExitProcess"; File: "eabd0bd2d942ed6013525df7ffc82dac2e1c7289308952de7dbabe6a03d71e00.exe") Found reference to API (Indicator: "GetPrivateProfileIntA"; File: "eabd0bd2d942ed6013525df7ffc82dac2e1c7289308952de7dbabe6a03d71e00.exe") Found reference to API (Indicator: "GetProcAddress"; File: "eabd0bd2d942ed6013525df7ffc82dac2e1c7289308952de7dbabe6a03d71e00.exe") Found reference to API (Indicator: "WritePrivateProfileStringA"; File: "eabd0bd2d942ed6013525df7ffc82dac2e1c7289308952de7dbabe6a03d71e00.exe") Found reference to API (Indicator: "GlobalLock"; File: "eabd0bd2d942ed6013525df7ffc82dac2e1c7289308952de7dbabe6a03d71e00.exe") Found reference to API (Indicator: "LoadLibraryExA"; File: "eabd0bd2d942ed6013525df7ffc82dac2e1c7289308952de7dbabe6a03d71e00.exe") Found reference to API (Indicator: "GetSystemTimeAsFileTime"; File: "eabd0bd2d942ed6013525df7ffc82dac2e1c7289308952de7dbabe6a03d71e00.exe") Found reference to API (Indicator: "lstrcmpA"; File: "eabd0bd2d942ed6013525df7ffc82dac2e1c7289308952de7dbabe6a03d71e00.exe") Found reference to API (Indicator: "GetDesktopWindow"; File: "eabd0bd2d942ed6013525df7ffc82dac2e1c7289308952de7dbabe6a03d71e00.exe") Found reference to API (Indicator: "CallWindowProcA"; File: "eabd0bd2d942ed6013525df7ffc82dac2e1c7289308952de7dbabe6a03d71e00.exe") Found reference to API (Indicator: "EnableWindow"; File: "eabd0bd2d942ed6013525df7ffc82dac2e1c7289308952de7dbabe6a03d71e00.exe") Found reference to API (Indicator: "GetDC"; File: "eabd0bd2d942ed6013525df7ffc82dac2e1c7289308952de7dbabe6a03d71e00.exe") Found reference to API (Indicator: "CharPrevA"; File: "eabd0bd2d942ed6013525df7ffc82dac2e1c7289308952de7dbabe6a03d71e00.exe") Found reference to API (Indicator: "CharUpperA"; File: "eabd0bd2d942ed6013525df7ffc82dac2e1c7289308952de7dbabe6a03d71e00.exe") Found reference to API (Indicator: "ReleaseDC"; File: "eabd0bd2d942ed6013525df7ffc82dac2e1c7289308952de7dbabe6a03d71e00.exe") Found reference to API (Indicator: "GetSystemMetrics"; File: "eabd0bd2d942ed6013525df7ffc82dac2e1c7289308952de7dbabe6a03d71e00.exe") Found reference to API (Indicator: "MessageBoxA"; File: "eabd0bd2d942ed6013525df7ffc82dac2e1c7289308952de7dbabe6a03d71e00.exe") Found reference to API (Indicator: "PeekMessageA"; File: "eabd0bd2d942ed6013525df7ffc82dac2e1c7289308952de7dbabe6a03d71e00.exe") Found reference to API (Indicator: "MessageBeep"; File: "eabd0bd2d942ed6013525df7ffc82dac2e1c7289308952de7dbabe6a03d71e00.exe") Found reference to API (Indicator: "DispatchMessageA"; File: "eabd0bd2d942ed6013525df7ffc82dac2e1c7289308952de7dbabe6a03d71e00.exe") Found reference to API (Indicator: "MsgWaitForMultipleObjects"; File: "eabd0bd2d942ed6013525df7ffc82dac2e1c7289308952de7dbabe6a03d71e00.exe") Found reference to API (Indicator: "SetWindowLongA"; File: "eabd0bd2d942ed6013525df7ffc82dac2e1c7289308952de7dbabe6a03d71e00.exe") Found reference to API (Indicator: "CharNextA"; File: "eabd0bd2d942ed6013525df7ffc82dac2e1c7289308952de7dbabe6a03d71e00.exe") Found reference to API (Indicator: "SendMessageA"; File: "eabd0bd2d942ed6013525df7ffc82dac2e1c7289308952de7dbabe6a03d71e00.exe") Found reference to API (Indicator: "GetWindowLongA"; File: "eabd0bd2d942ed6013525df7ffc82dac2e1c7289308952de7dbabe6a03d71e00.exe") Found reference to API (Indicator: "SetWindowPos"; File: "eabd0bd2d942ed6013525df7ffc82dac2e1c7289308952de7dbabe6a03d71e00.exe") Found reference to API (Indicator: "SetForegroundWindow"; File: "eabd0bd2d942ed6013525df7ffc82dac2e1c7289308952de7dbabe6a03d71e00.exe") Found reference to API (Indicator: "GetWindowRect"; File: "eabd0bd2d942ed6013525df7ffc82dac2e1c7289308952de7dbabe6a03d71e00.exe") Found reference to API (Indicator: "ShowWindow"; File: "eabd0bd2d942ed6013525df7ffc82dac2e1c7289308952de7dbabe6a03d71e00.exe") Found reference to API (Indicator: "SetWindowTextA"; File: "eabd0bd2d942ed6013525df7ffc82dac2e1c7289308952de7dbabe6a03d71e00.exe") Found reference to API (Indicator: "LoadStringA"; File: "eabd0bd2d942ed6013525df7ffc82dac2e1c7289308952de7dbabe6a03d71e00.exe") Found reference to API (Indicator: "ExitWindowsEx"; File: "eabd0bd2d942ed6013525df7ffc82dac2e1c7289308952de7dbabe6a03d71e00.exe") Found reference to API (Indicator: "VerQueryValueA"; File: "eabd0bd2d942ed6013525df7ffc82dac2e1c7289308952de7dbabe6a03d71e00.exe") Found reference to API (Indicator: "GetFileVersionInfoSizeA"; File: "eabd0bd2d942ed6013525df7ffc82dac2e1c7289308952de7dbabe6a03d71e00.exe") Found reference to API (Indicator: "GetFileVersionInfoA"; File: "eabd0bd2d942ed6013525df7ffc82dac2e1c7289308952de7dbabe6a03d71e00.exe") Found reference to API (Indicator: "CheckTokenMembership"; File: "eabd0bd2d942ed6013525df7ffc82dac2e1c7289308952de7dbabe6a03d71e00.exe") Found reference to API (Indicator: "SeShutdownPrivilege"; File: "eabd0bd2d942ed6013525df7ffc82dac2e1c7289308952de7dbabe6a03d71e00.exe") Found reference to API (Indicator: "HeapSetInformation"; File: "eabd0bd2d942ed6013525df7ffc82dac2e1c7289308952de7dbabe6a03d71e00.exe") Found reference to API (Indicator: "DecryptFileA"; File: "eabd0bd2d942ed6013525df7ffc82dac2e1c7289308952de7dbabe6a03d71e00.exe") Found reference to API (Indicator: "SHBrowseForFolder"; File: "eabd0bd2d942ed6013525df7ffc82dac2e1c7289308952de7dbabe6a03d71e00.exe") Found reference to API (Indicator: "SHGetPathFromIDList"; File: "eabd0bd2d942ed6013525df7ffc82dac2e1c7289308952de7dbabe6a03d71e00.exe") Found reference to API (Indicator: "LookupAccountNameA"; File: "eabd0bd2d942ed6013525df7ffc82dac2e1c7289308952de7dbabe6a03d71e00.exe") Found reference to API (Indicator: "GetSidSubAuthorityCount"; File: "eabd0bd2d942ed6013525df7ffc82dac2e1c7289308952de7dbabe6a03d71e00.exe") Found reference to API (Indicator: "GetUserNameA"; File: "eabd0bd2d942ed6013525df7ffc82dac2e1c7289308952de7dbabe6a03d71e00.exe") Found reference to API (Indicator: "GetSidSubAuthority"; File: "eabd0bd2d942ed6013525df7ffc82dac2e1c7289308952de7dbabe6a03d71e00.exe") Found reference to API (Indicator: "GetSidIdentifierAuthority"; File: "eabd0bd2d942ed6013525df7ffc82dac2e1c7289308952de7dbabe6a03d71e00.exe") Found reference to API (Indicator: "DeleteCriticalSection"; File: "eabd0bd2d942ed6013525df7ffc82dac2e1c7289308952de7dbabe6a03d71e00.exe") Found reference to API (Indicator: "RaiseException"; File: "eabd0bd2d942ed6013525df7ffc82dac2e1c7289308952de7dbabe6a03d71e00.exe") Found reference to API (Indicator: "DecodePointer"; File: "eabd0bd2d942ed6013525df7ffc82dac2e1c7289308952de7dbabe6a03d71e00.exe") Found reference to API (Indicator: "GetStdHandle"; File: "eabd0bd2d942ed6013525df7ffc82dac2e1c7289308952de7dbabe6a03d71e00.exe") Found reference to API (Indicator: "SetEnvironmentVariableW"; File: "eabd0bd2d942ed6013525df7ffc82dac2e1c7289308952de7dbabe6a03d71e00.exe") Found reference to API (Indicator: "FindFirstFileExW"; File: "eabd0bd2d942ed6013525df7ffc82dac2e1c7289308952de7dbabe6a03d71e00.exe") Found reference to API (Indicator: "FreeEnvironmentStringsW"; File: "eabd0bd2d942ed6013525df7ffc82dac2e1c7289308952de7dbabe6a03d71e00.exe") Found reference to API (Indicator: "GetTimeZoneInformation"; File: "eabd0bd2d942ed6013525df7ffc82dac2e1c7289308952de7dbabe6a03d71e00.exe") Found reference to API (Indicator: "GetFullPathNameW"; File: "eabd0bd2d942ed6013525df7ffc82dac2e1c7289308952de7dbabe6a03d71e00.exe") Found reference to API (Indicator: "CreateEventW"; File: "eabd0bd2d942ed6013525df7ffc82dac2e1c7289308952de7dbabe6a03d71e00.exe") Found reference to API (Indicator: "GetFileType"; File: "eabd0bd2d942ed6013525df7ffc82dac2e1c7289308952de7dbabe6a03d71e00.exe") Found reference to API (Indicator: "CopyFileA"; File: "eabd0bd2d942ed6013525df7ffc82dac2e1c7289308952de7dbabe6a03d71e00.exe") Found reference to API (Indicator: "HeapSize"; File: "eabd0bd2d942ed6013525df7ffc82dac2e1c7289308952de7dbabe6a03d71e00.exe") Found reference to API (Indicator: "MultiByteToWideChar"; File: "eabd0bd2d942ed6013525df7ffc82dac2e1c7289308952de7dbabe6a03d71e00.exe") Found reference to API (Indicator: "WriteProcessMemory"; File: "eabd0bd2d942ed6013525df7ffc82dac2e1c7289308952de7dbabe6a03d71e00.exe") Found reference to API (Indicator: "SystemTimeToTzSpecificLocalTime"; File: "eabd0bd2d942ed6013525df7ffc82dac2e1c7289308952de7dbabe6a03d71e00.exe") Found reference to API (Indicator: "VirtualFree"; File: "eabd0bd2d942ed6013525df7ffc82dac2e1c7289308952de7dbabe6a03d71e00.exe") Found reference to API (Indicator: "GetConsoleMode"; File: "eabd0bd2d942ed6013525df7ffc82dac2e1c7289308952de7dbabe6a03d71e00.exe") Found reference to API (Indicator: "TlsSetValue"; File: "eabd0bd2d942ed6013525df7ffc82dac2e1c7289308952de7dbabe6a03d71e00.exe") Found reference to API (Indicator: "GetEnvironmentStringsW"; File: "eabd0bd2d942ed6013525df7ffc82dac2e1c7289308952de7dbabe6a03d71e00.exe") Found reference to API (Indicator: "IsValidCodePage"; File: "eabd0bd2d942ed6013525df7ffc82dac2e1c7289308952de7dbabe6a03d71e00.exe") Found reference to API (Indicator: "GetConsoleCP"; File: "eabd0bd2d942ed6013525df7ffc82dac2e1c7289308952de7dbabe6a03d71e00.exe") Found reference to API (Indicator: "GetModuleFileNameW"; File: "eabd0bd2d942ed6013525df7ffc82dac2e1c7289308952de7dbabe6a03d71e00.exe") Found reference to API (Indicator: "InitializeCriticalSectionAndSpinCount"; File: "eabd0bd2d942ed6013525df7ffc82dac2e1c7289308952de7dbabe6a03d71e00.exe") Found reference to API (Indicator: "IsDebuggerPresent"; File: "eabd0bd2d942ed6013525df7ffc82dac2e1c7289308952de7dbabe6a03d71e00.exe") Found reference to API (Indicator: "LoadLibraryExW"; File: "eabd0bd2d942ed6013525df7ffc82dac2e1c7289308952de7dbabe6a03d71e00.exe") Found reference to API (Indicator: "LCMapStringW"; File: "eabd0bd2d942ed6013525df7ffc82dac2e1c7289308952de7dbabe6a03d71e00.exe") Found reference to API (Indicator: "GetVersionExW"; File: "eabd0bd2d942ed6013525df7ffc82dac2e1c7289308952de7dbabe6a03d71e00.exe") Found reference to API (Indicator: "GetComputerNameExW"; File: "eabd0bd2d942ed6013525df7ffc82dac2e1c7289308952de7dbabe6a03d71e00.exe") Found reference to API (Indicator: "SetLastError"; File: "eabd0bd2d942ed6013525df7ffc82dac2e1c7289308952de7dbabe6a03d71e00.exe") Found reference to API (Indicator: "ReadProcessMemory"; File: "eabd0bd2d942ed6013525df7ffc82dac2e1c7289308952de7dbabe6a03d71e00.exe") Found reference to API (Indicator: "GetStringTypeW"; File: "eabd0bd2d942ed6013525df7ffc82dac2e1c7289308952de7dbabe6a03d71e00.exe") Found reference to API (Indicator: "GetACP"; File: "eabd0bd2d942ed6013525df7ffc82dac2e1c7289308952de7dbabe6a03d71e00.exe") Found reference to API (Indicator: "GetThreadContext"; File: "eabd0bd2d942ed6013525df7ffc82dac2e1c7289308952de7dbabe6a03d71e00.exe") Found reference to API (Indicator: "WideCharToMultiByte"; File: "eabd0bd2d942ed6013525df7ffc82dac2e1c7289308952de7dbabe6a03d71e00.exe") Found reference to API (Indicator: "GetCommandLineW"; File: "eabd0bd2d942ed6013525df7ffc82dac2e1c7289308952de7dbabe6a03d71e00.exe") Found reference to API (Indicator: "VirtualAllocEx"; File: "eabd0bd2d942ed6013525df7ffc82dac2e1c7289308952de7dbabe6a03d71e00.exe") Found reference to API (Indicator: "ReadConsoleW"; File: "eabd0bd2d942ed6013525df7ffc82dac2e1c7289308952de7dbabe6a03d71e00.exe") Found reference to API (Indicator: "EnterCriticalSection"; File: "eabd0bd2d942ed6013525df7ffc82dac2e1c7289308952de7dbabe6a03d71e00.exe") Found reference to API (Indicator: "GetCommandLineA"; File: "eabd0bd2d942ed6013525df7ffc82dac2e1c7289308952de7dbabe6a03d71e00.exe") Found reference to API (Indicator: "FindNextFileW"; File: "eabd0bd2d942ed6013525df7ffc82dac2e1c7289308952de7dbabe6a03d71e00.exe") Found reference to API (Indicator: "SetEndOfFile"; File: "eabd0bd2d942ed6013525df7ffc82dac2e1c7289308952de7dbabe6a03d71e00.exe") Found reference to API (Indicator: "CreateFileW"; File: "eabd0bd2d942ed6013525df7ffc82dac2e1c7289308952de7dbabe6a03d71e00.exe") Found reference to API (Indicator: "HeapAlloc"; File: "eabd0bd2d942ed6013525df7ffc82dac2e1c7289308952de7dbabe6a03d71e00.exe") Found reference to API (Indicator: "RtlUnwind"; File: "eabd0bd2d942ed6013525df7ffc82dac2e1c7289308952de7dbabe6a03d71e00.exe") Found reference to API (Indicator: "GetOEMCP"; File: "eabd0bd2d942ed6013525df7ffc82dac2e1c7289308952de7dbabe6a03d71e00.exe") Found reference to API (Indicator: "IsProcessorFeaturePresent"; File: "eabd0bd2d942ed6013525df7ffc82dac2e1c7289308952de7dbabe6a03d71e00.exe") Found reference to API (Indicator: "CompareStringW"; File: "eabd0bd2d942ed6013525df7ffc82dac2e1c7289308952de7dbabe6a03d71e00.exe") Found reference to API (Indicator: "GetProcessHeap"; File: "eabd0bd2d942ed6013525df7ffc82dac2e1c7289308952de7dbabe6a03d71e00.exe") Found reference to API (Indicator: "TlsFree"; File: "eabd0bd2d942ed6013525df7ffc82dac2e1c7289308952de7dbabe6a03d71e00.exe") Found reference to API (Indicator: "TlsGetValue"; File: "eabd0bd2d942ed6013525df7ffc82dac2e1c7289308952de7dbabe6a03d71e00.exe") Found reference to API (Indicator: "TlsAlloc"; File: "eabd0bd2d942ed6013525df7ffc82dac2e1c7289308952de7dbabe6a03d71e00.exe") Found reference to API (Indicator: "WaitForSingleObjectEx"; File: "eabd0bd2d942ed6013525df7ffc82dac2e1c7289308952de7dbabe6a03d71e00.exe") Found reference to API (Indicator: "DeleteFileW"; File: "eabd0bd2d942ed6013525df7ffc82dac2e1c7289308952de7dbabe6a03d71e00.exe") Found reference to API (Indicator: "VirtualAlloc"; File: "eabd0bd2d942ed6013525df7ffc82dac2e1c7289308952de7dbabe6a03d71e00.exe") Found reference to API (Indicator: "HeapReAlloc"; File: "eabd0bd2d942ed6013525df7ffc82dac2e1c7289308952de7dbabe6a03d71e00.exe") Found reference to API (Indicator: "GetFileInformationByHandle"; File: "eabd0bd2d942ed6013525df7ffc82dac2e1c7289308952de7dbabe6a03d71e00.exe") Found reference to API (Indicator: "FileTimeToSystemTime"; File: "eabd0bd2d942ed6013525df7ffc82dac2e1c7289308952de7dbabe6a03d71e00.exe") Found reference to API (Indicator: "SetThreadContext"; File: "eabd0bd2d942ed6013525df7ffc82dac2e1c7289308952de7dbabe6a03d71e00.exe") Found reference to API (Indicator: "GetModuleHandleExW"; File: "eabd0bd2d942ed6013525df7ffc82dac2e1c7289308952de7dbabe6a03d71e00.exe") Found reference to API (Indicator: "WriteConsoleW"; File: "eabd0bd2d942ed6013525df7ffc82dac2e1c7289308952de7dbabe6a03d71e00.exe") Found reference to API (Indicator: "FlushFileBuffers"; File: "eabd0bd2d942ed6013525df7ffc82dac2e1c7289308952de7dbabe6a03d71e00.exe") Found reference to API (Indicator: "HeapFree"; File: "eabd0bd2d942ed6013525df7ffc82dac2e1c7289308952de7dbabe6a03d71e00.exe") Found reference to API (Indicator: "SetStdHandle"; File: "eabd0bd2d942ed6013525df7ffc82dac2e1c7289308952de7dbabe6a03d71e00.exe") Found reference to API (Indicator: "GetCPInfo"; File: "eabd0bd2d942ed6013525df7ffc82dac2e1c7289308952de7dbabe6a03d71e00.exe") Found reference to API (Indicator: "GetModuleHandleA"; File: "eabd0bd2d942ed6013525df7ffc82dac2e1c7289308952de7dbabe6a03d71e00.exe") Found reference to API (Indicator: "LeaveCriticalSection"; File: "eabd0bd2d942ed6013525df7ffc82dac2e1c7289308952de7dbabe6a03d71e00.exe") Found reference to API (Indicator: "GetCurrentDirectoryW"; File: "eabd0bd2d942ed6013525df7ffc82dac2e1c7289308952de7dbabe6a03d71e00.exe") Found reference to API (Indicator: "ResumeThread"; File: "eabd0bd2d942ed6013525df7ffc82dac2e1c7289308952de7dbabe6a03d71e00.exe") Found reference to API (Indicator: "SetFilePointerEx"; File: "eabd0bd2d942ed6013525df7ffc82dac2e1c7289308952de7dbabe6a03d71e00.exe") Found reference to API (Indicator: "InitializeSListHead"; File: "eabd0bd2d942ed6013525df7ffc82dac2e1c7289308952de7dbabe6a03d71e00.exe") Found reference to API (Indicator: "GetDriveTypeW"; File: "eabd0bd2d942ed6013525df7ffc82dac2e1c7289308952de7dbabe6a03d71e00.exe") Found reference to API (Indicator: "PeekNamedPipe"; File: "eabd0bd2d942ed6013525df7ffc82dac2e1c7289308952de7dbabe6a03d71e00.exe") Found reference to API (Indicator: "SHGetFolderPathA"; File: "eabd0bd2d942ed6013525df7ffc82dac2e1c7289308952de7dbabe6a03d71e00.exe") Found reference to API (Indicator: "ShellExecuteA"; File: "eabd0bd2d942ed6013525df7ffc82dac2e1c7289308952de7dbabe6a03d71e00.exe") Found reference to API (Indicator: "InternetCloseHandle"; File: "eabd0bd2d942ed6013525df7ffc82dac2e1c7289308952de7dbabe6a03d71e00.exe") Found reference to API (Indicator: "HttpSendRequestA"; File: "eabd0bd2d942ed6013525df7ffc82dac2e1c7289308952de7dbabe6a03d71e00.exe") Found reference to API (Indicator: "InternetOpenUrlA"; File: "eabd0bd2d942ed6013525df7ffc82dac2e1c7289308952de7dbabe6a03d71e00.exe") Found reference to API (Indicator: "InternetReadFile"; File: "eabd0bd2d942ed6013525df7ffc82dac2e1c7289308952de7dbabe6a03d71e00.exe") Found reference to API (Indicator: "InternetOpenA"; File: "eabd0bd2d942ed6013525df7ffc82dac2e1c7289308952de7dbabe6a03d71e00.exe") Found reference to API (Indicator: "InternetConnectA"; File: "eabd0bd2d942ed6013525df7ffc82dac2e1c7289308952de7dbabe6a03d71e00.exe") Found reference to API (Indicator: "HttpOpenRequestA"; File: "eabd0bd2d942ed6013525df7ffc82dac2e1c7289308952de7dbabe6a03d71e00.exe") Found reference to API (Indicator: "InternetOpenW"; File: "eabd0bd2d942ed6013525df7ffc82dac2e1c7289308952de7dbabe6a03d71e00.exe") Found reference to API (Indicator: "EncodePointer"; File: "eabd0bd2d942ed6013525df7ffc82dac2e1c7289308952de7dbabe6a03d71e00.exe") Found reference to API (Indicator: "GetConsoleOutputCP"; File: "eabd0bd2d942ed6013525df7ffc82dac2e1c7289308952de7dbabe6a03d71e00.exe") Found reference to API (Indicator: "GetStockObject"; File: "eabd0bd2d942ed6013525df7ffc82dac2e1c7289308952de7dbabe6a03d71e00.exe") Found reference to API (Indicator: "RemoveDirectoryW"; File: "eabd0bd2d942ed6013525df7ffc82dac2e1c7289308952de7dbabe6a03d71e00.exe") Found reference to API (Indicator: "DuplicateHandle"; File: "eabd0bd2d942ed6013525df7ffc82dac2e1c7289308952de7dbabe6a03d71e00.exe") Found reference to API (Indicator: "SetFileAttributesW"; File: "eabd0bd2d942ed6013525df7ffc82dac2e1c7289308952de7dbabe6a03d71e00.exe") Found reference to API (Indicator: "EnumResourceTypesW"; File: "eabd0bd2d942ed6013525df7ffc82dac2e1c7289308952de7dbabe6a03d71e00.exe") Found reference to API (Indicator: "GetCurrentThread"; File: "eabd0bd2d942ed6013525df7ffc82dac2e1c7289308952de7dbabe6a03d71e00.exe") Found reference to API (Indicator: "GetTempFileNameW"; File: "eabd0bd2d942ed6013525df7ffc82dac2e1c7289308952de7dbabe6a03d71e00.exe") Found reference to API (Indicator: "HeapDestroy"; File: "eabd0bd2d942ed6013525df7ffc82dac2e1c7289308952de7dbabe6a03d71e00.exe") Found reference to API (Indicator: "UnregisterWait"; File: "eabd0bd2d942ed6013525df7ffc82dac2e1c7289308952de7dbabe6a03d71e00.exe") Found reference to API (Indicator: "InterlockedExchange"; File: "eabd0bd2d942ed6013525df7ffc82dac2e1c7289308952de7dbabe6a03d71e00.exe") Found reference to API (Indicator: "GetNativeSystemInfo"; File: "eabd0bd2d942ed6013525df7ffc82dac2e1c7289308952de7dbabe6a03d71e00.exe") Found reference to API (Indicator: "InterlockedCompareExchange"; File: "eabd0bd2d942ed6013525df7ffc82dac2e1c7289308952de7dbabe6a03d71e00.exe") Found reference to API (Indicator: "GetShortPathNameW"; File: "eabd0bd2d942ed6013525df7ffc82dac2e1c7289308952de7dbabe6a03d71e00.exe") Found reference to API (Indicator: "HeapCreate"; File: "eabd0bd2d942ed6013525df7ffc82dac2e1c7289308952de7dbabe6a03d71e00.exe") Found reference to API (Indicator: "GetSystemDirectoryW"; File: "eabd0bd2d942ed6013525df7ffc82dac2e1c7289308952de7dbabe6a03d71e00.exe") Found reference to API (Indicator: "SetCurrentDirectoryW"; File: "eabd0bd2d942ed6013525df7ffc82dac2e1c7289308952de7dbabe6a03d71e00.exe") Found reference to API (Indicator: "FindResourceW"; File: "eabd0bd2d942ed6013525df7ffc82dac2e1c7289308952de7dbabe6a03d71e00.exe") Found reference to API (Indicator: "RegisterWaitForSingleObject"; File: "eabd0bd2d942ed6013525df7ffc82dac2e1c7289308952de7dbabe6a03d71e00.exe") Found reference to API (Indicator: "GetEnvironmentVariableW"; File: "eabd0bd2d942ed6013525df7ffc82dac2e1c7289308952de7dbabe6a03d71e00.exe") Found reference to API (Indicator: "InitializeCriticalSection"; File: "eabd0bd2d942ed6013525df7ffc82dac2e1c7289308952de7dbabe6a03d71e00.exe") Found reference to API (Indicator: "GetTempPathW"; File: "eabd0bd2d942ed6013525df7ffc82dac2e1c7289308952de7dbabe6a03d71e00.exe") Found reference to API (Indicator: "GetWindowsDirectoryW"; File: "eabd0bd2d942ed6013525df7ffc82dac2e1c7289308952de7dbabe6a03d71e00.exe") Found reference to API (Indicator: "CreateDirectoryW"; File: "eabd0bd2d942ed6013525df7ffc82dac2e1c7289308952de7dbabe6a03d71e00.exe") Found reference to API (Indicator: "EnumResourceNamesW"; File: "eabd0bd2d942ed6013525df7ffc82dac2e1c7289308952de7dbabe6a03d71e00.exe") Found reference to API (Indicator: "LoadLibraryW"; File: "eabd0bd2d942ed6013525df7ffc82dac2e1c7289308952de7dbabe6a03d71e00.exe") Found reference to API (Indicator: "CoInitialize"; File: "eabd0bd2d942ed6013525df7ffc82dac2e1c7289308952de7dbabe6a03d71e00.exe") Found reference to API (Indicator: "CoTaskMemFree"; File: "eabd0bd2d942ed6013525df7ffc82dac2e1c7289308952de7dbabe6a03d71e00.exe") Found reference to API (Indicator: "SHGetPathFromIDListW"; File: "eabd0bd2d942ed6013525df7ffc82dac2e1c7289308952de7dbabe6a03d71e00.exe") Found reference to API (Indicator: "ShellExecuteExW"; File: "eabd0bd2d942ed6013525df7ffc82dac2e1c7289308952de7dbabe6a03d71e00.exe") Found reference to API (Indicator: "PathRenameExtensionW"; File: "eabd0bd2d942ed6013525df7ffc82dac2e1c7289308952de7dbabe6a03d71e00.exe") Found reference to API (Indicator: "PathAddBackslashW"; File: "eabd0bd2d942ed6013525df7ffc82dac2e1c7289308952de7dbabe6a03d71e00.exe") Found reference to API (Indicator: "PathRemoveBackslashW"; File: "eabd0bd2d942ed6013525df7ffc82dac2e1c7289308952de7dbabe6a03d71e00.exe") Found reference to API (Indicator: "DispatchMessageW"; File: "eabd0bd2d942ed6013525df7ffc82dac2e1c7289308952de7dbabe6a03d71e00.exe") Found reference to API (Indicator: "GetForegroundWindow"; File: "eabd0bd2d942ed6013525df7ffc82dac2e1c7289308952de7dbabe6a03d71e00.exe") Found reference to API (Indicator: "DestroyWindow"; File: "eabd0bd2d942ed6013525df7ffc82dac2e1c7289308952de7dbabe6a03d71e00.exe") Found reference to API (Indicator: "CharUpperW"; File: "eabd0bd2d942ed6013525df7ffc82dac2e1c7289308952de7dbabe6a03d71e00.exe") Found reference to API (Indicator: "TranslateMessage"; File: "eabd0bd2d942ed6013525df7ffc82dac2e1c7289308952de7dbabe6a03d71e00.exe") Found reference to API (Indicator: "IsWindowVisible"; File: "eabd0bd2d942ed6013525df7ffc82dac2e1c7289308952de7dbabe6a03d71e00.exe") Found reference to API (Indicator: "BringWindowToTop"; File: "eabd0bd2d942ed6013525df7ffc82dac2e1c7289308952de7dbabe6a03d71e00.exe") Found reference to API (Indicator: "LoadIconW"; File: "eabd0bd2d942ed6013525df7ffc82dac2e1c7289308952de7dbabe6a03d71e00.exe") Found reference to API (Indicator: "GetWindowTextLengthW"; File: "eabd0bd2d942ed6013525df7ffc82dac2e1c7289308952de7dbabe6a03d71e00.exe") Found reference to API (Indicator: "DefWindowProcW"; File: "eabd0bd2d942ed6013525df7ffc82dac2e1c7289308952de7dbabe6a03d71e00.exe") Found reference to API (Indicator: "MessageBoxW"; File: "eabd0bd2d942ed6013525df7ffc82dac2e1c7289308952de7dbabe6a03d71e00.exe") Found reference to API (Indicator: "CreateAcceleratorTableW"; File: "eabd0bd2d942ed6013525df7ffc82dac2e1c7289308952de7dbabe6a03d71e00.exe") Found reference to API (Indicator: "DestroyAcceleratorTable"; File: "eabd0bd2d942ed6013525df7ffc82dac2e1c7289308952de7dbabe6a03d71e00.exe") Found reference to API (Indicator: "SetFocus"; File: "eabd0bd2d942ed6013525df7ffc82dac2e1c7289308952de7dbabe6a03d71e00.exe") Found reference to API (Indicator: "LoadCursorW"; File: "eabd0bd2d942ed6013525df7ffc82dac2e1c7289308952de7dbabe6a03d71e00.exe") Found reference to API (Indicator: "TranslateAcceleratorW"; File: "eabd0bd2d942ed6013525df7ffc82dac2e1c7289308952de7dbabe6a03d71e00.exe") Found reference to API (Indicator: "UnregisterClassW"; File: "eabd0bd2d942ed6013525df7ffc82dac2e1c7289308952de7dbabe6a03d71e00.exe") Found reference to API (Indicator: "CreateWindowExW"; File: "eabd0bd2d942ed6013525df7ffc82dac2e1c7289308952de7dbabe6a03d71e00.exe") Found reference to API (Indicator: "CharLowerW"; File: "eabd0bd2d942ed6013525df7ffc82dac2e1c7289308952de7dbabe6a03d71e00.exe") Found reference to API (Indicator: "IsWindowEnabled"; File: "eabd0bd2d942ed6013525df7ffc82dac2e1c7289308952de7dbabe6a03d71e00.exe") Found reference to API (Indicator: "GetWindowTextW"; File: "eabd0bd2d942ed6013525df7ffc82dac2e1c7289308952de7dbabe6a03d71e00.exe") Found reference to API (Indicator: "EnumWindows"; File: "eabd0bd2d942ed6013525df7ffc82dac2e1c7289308952de7dbabe6a03d71e00.exe") Found reference to API (Indicator: "GetWindowThreadProcessId"; File: "eabd0bd2d942ed6013525df7ffc82dac2e1c7289308952de7dbabe6a03d71e00.exe") Found reference to API (Indicator: "GetTokenInformation"; Source: "00000000-00004424.00000000.91567.012EA000.00000002.mdmp") Found reference to API (Indicator: "RegDeleteValueA"; Source: "00000000-00004424.00000000.91567.012EA000.00000002.mdmp") Found reference to API (Indicator: "RegOpenKeyExA"; Source: "00000000-00004424.00000000.91567.012EA000.00000002.mdmp") Found reference to API (Indicator: "RegQueryInfoKeyA"; Source: "00000000-00004424.00000000.91567.012EA000.00000002.mdmp") Found reference to API (Indicator: "FreeSid"; Source: "00000000-00004424.00000000.91567.012EA000.00000002.mdmp") Found reference to API (Indicator: "OpenProcessToken"; Source: "00000000-00004424.00000000.91567.012EA000.00000002.mdmp") Found reference to API (Indicator: "RegSetValueExA"; Source: "00000000-00004424.00000000.91567.012EA000.00000002.mdmp") Found reference to API (Indicator: "RegCreateKeyExA"; Source: "00000000-00004424.00000000.91567.012EA000.00000002.mdmp") Found reference to API (Indicator: "LookupPrivilegeValueA"; Source: "00000000-00004424.00000000.91567.012EA000.00000002.mdmp") Found reference to API (Indicator: "AllocateAndInitializeSid"; Source: "00000000-00004424.00000000.91567.012EA000.00000002.mdmp") Found reference to API (Indicator: "RegQueryValueExA"; Source: "00000000-00004424.00000000.91567.012EA000.00000002.mdmp") Found reference to API (Indicator: "EqualSid"; Source: "00000000-00004424.00000000.91567.012EA000.00000002.mdmp") Found reference to API (Indicator: "RegCloseKey"; Source: "00000000-00004424.00000000.91567.012EA000.00000002.mdmp") Found reference to API (Indicator: "AdjustTokenPrivileges"; Source: "00000000-00004424.00000000.91567.012EA000.00000002.mdmp") Found reference to API (Indicator: "GetShortPathNameA"; Source: "00000000-00004424.00000000.91567.012EA000.00000002.mdmp") Found reference to API (Indicator: "GetModuleFileNameA"; Source: "00000000-00004424.00000000.91567.012EA000.00000002.mdmp") Found reference to API (Indicator: "FindFirstFileA"; Source: "00000000-00004424.00000000.91567.012EA000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcess"; Source: "00000000-00004424.00000000.91567.012EA000.00000002.mdmp") Found reference to API (Indicator: "FindNextFileA"; Source: "00000000-00004424.00000000.91567.012EA000.00000002.mdmp") Found reference to API (Indicator: "ExpandEnvironmentStringsA"; Source: "00000000-00004424.00000000.91567.012EA000.00000002.mdmp") Found reference to API (Indicator: "FindClose"; Source: "00000000-00004424.00000000.91567.012EA000.00000002.mdmp") Found reference to API (Indicator: "LocalAlloc"; Source: "00000000-00004424.00000000.91567.012EA000.00000002.mdmp") Found reference to API (Indicator: "lstrcmpA"; Source: "00000000-00004424.00000000.91567.012EA000.00000002.mdmp") Found reference to API (Indicator: "CompareStringA"; Source: "00000000-00004424.00000000.91567.012EA000.00000002.mdmp") Found reference to API (Indicator: "GetLastError"; Source: "00000000-00004424.00000000.91567.012EA000.00000002.mdmp") Found reference to API (Indicator: "GetFileAttributesA"; Source: "00000000-00004424.00000000.91567.012EA000.00000002.mdmp") Found reference to API (Indicator: "GetSystemDirectoryA"; Source: "00000000-00004424.00000000.91567.012EA000.00000002.mdmp") Found reference to API (Indicator: "LoadLibraryA"; Source: "00000000-00004424.00000000.91567.012EA000.00000002.mdmp") Found reference to API (Indicator: "DeleteFileA"; Source: "00000000-00004424.00000000.91567.012EA000.00000002.mdmp") Found reference to API (Indicator: "GlobalAlloc"; Source: "00000000-00004424.00000000.91567.012EA000.00000002.mdmp") Found reference to API (Indicator: "GlobalFree"; Source: "00000000-00004424.00000000.91567.012EA000.00000002.mdmp") Found reference to API (Indicator: "CloseHandle"; Source: "00000000-00004424.00000000.91567.012EA000.00000002.mdmp") Found reference to API (Indicator: "WritePrivateProfileStringA"; Source: "00000000-00004424.00000000.91567.012EA000.00000002.mdmp") Found reference to API (Indicator: "IsDBCSLeadByte"; Source: "00000000-00004424.00000000.91567.012EA000.00000002.mdmp") Found reference to API (Indicator: "GetWindowsDirectoryA"; Source: "00000000-00004424.00000000.91567.012EA000.00000002.mdmp") Found reference to API (Indicator: "SetFileAttributesA"; Source: "00000000-00004424.00000000.91567.012EA000.00000002.mdmp") Found reference to API (Indicator: "GetProcAddress"; Source: "00000000-00004424.00000000.91567.012EA000.00000002.mdmp") Found reference to API (Indicator: "GlobalLock"; Source: "00000000-00004424.00000000.91567.012EA000.00000002.mdmp") Found reference to API (Indicator: "LocalFree"; Source: "00000000-00004424.00000000.91567.012EA000.00000002.mdmp") Found reference to API (Indicator: "RemoveDirectoryA"; Source: "00000000-00004424.00000000.91567.012EA000.00000002.mdmp") Found reference to API (Indicator: "FreeLibrary"; Source: "00000000-00004424.00000000.91567.012EA000.00000002.mdmp") Found reference to API (Indicator: "CreateDirectoryA"; Source: "00000000-00004424.00000000.91567.012EA000.00000002.mdmp") Found reference to API (Indicator: "GetPrivateProfileIntA"; Source: "00000000-00004424.00000000.91567.012EA000.00000002.mdmp") Found reference to API (Indicator: "GetPrivateProfileStringA"; Source: "00000000-00004424.00000000.91567.012EA000.00000002.mdmp") Found reference to API (Indicator: "GlobalUnlock"; Source: "00000000-00004424.00000000.91567.012EA000.00000002.mdmp") Found reference to API (Indicator: "ReadFile"; Source: "00000000-00004424.00000000.91567.012EA000.00000002.mdmp") Found reference to API (Indicator: "SizeofResource"; Source: "00000000-00004424.00000000.91567.012EA000.00000002.mdmp") Found reference to API (Indicator: "WriteFile"; Source: "00000000-00004424.00000000.91567.012EA000.00000002.mdmp") Found reference to API (Indicator: "GetDriveTypeA"; Source: "00000000-00004424.00000000.91567.012EA000.00000002.mdmp") Found reference to API (Indicator: "LoadLibraryExA"; Source: "00000000-00004424.00000000.91567.012EA000.00000002.mdmp") Found reference to API (Indicator: "SetFileTime"; Source: "00000000-00004424.00000000.91567.012EA000.00000002.mdmp") Found reference to API (Indicator: "SetFilePointer"; Source: "00000000-00004424.00000000.91567.012EA000.00000002.mdmp") Found reference to API (Indicator: "FindResourceA"; Source: "00000000-00004424.00000000.91567.012EA000.00000002.mdmp") Found reference to API (Indicator: "CreateMutexA"; Source: "00000000-00004424.00000000.91567.012EA000.00000002.mdmp") Found reference to API (Indicator: "GetVolumeInformationA"; Source: "00000000-00004424.00000000.91567.012EA000.00000002.mdmp") Found reference to API (Indicator: "WaitForSingleObject"; Source: "00000000-00004424.00000000.91567.012EA000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentDirectoryA"; Source: "00000000-00004424.00000000.91567.012EA000.00000002.mdmp") Found reference to API (Indicator: "FreeResource"; Source: "00000000-00004424.00000000.91567.012EA000.00000002.mdmp") Found reference to API (Indicator: "GetVersion"; Source: "00000000-00004424.00000000.91567.012EA000.00000002.mdmp") Found reference to API (Indicator: "SetCurrentDirectoryA"; Source: "00000000-00004424.00000000.91567.012EA000.00000002.mdmp") Found reference to API (Indicator: "GetTempPathA"; Source: "00000000-00004424.00000000.91567.012EA000.00000002.mdmp") Found reference to API (Indicator: "LocalFileTimeToFileTime"; Source: "00000000-00004424.00000000.91567.012EA000.00000002.mdmp") Found reference to API (Indicator: "CreateFileA"; Source: "00000000-00004424.00000000.91567.012EA000.00000002.mdmp") Found reference to API (Indicator: "SetEvent"; Source: "00000000-00004424.00000000.91567.012EA000.00000002.mdmp") Found reference to API (Indicator: "TerminateThread"; Source: "00000000-00004424.00000000.91567.012EA000.00000002.mdmp") Found reference to API (Indicator: "GetVersionExA"; Source: "00000000-00004424.00000000.91567.012EA000.00000002.mdmp") Found reference to API (Indicator: "LockResource"; Source: "00000000-00004424.00000000.91567.012EA000.00000002.mdmp") Found reference to API (Indicator: "GetSystemInfo"; Source: "00000000-00004424.00000000.91567.012EA000.00000002.mdmp") Found reference to API (Indicator: "CreateThread"; Source: "00000000-00004424.00000000.91567.012EA000.00000002.mdmp") Found reference to API (Indicator: "ResetEvent"; Source: "00000000-00004424.00000000.91567.012EA000.00000002.mdmp") Found reference to API (Indicator: "LoadResource"; Source: "00000000-00004424.00000000.91567.012EA000.00000002.mdmp") Found reference to API (Indicator: "ExitProcess"; Source: "00000000-00004424.00000000.91567.012EA000.00000002.mdmp") Found reference to API (Indicator: "GetModuleHandleW"; Source: "00000000-00004424.00000000.91567.012EA000.00000002.mdmp") Found reference to API (Indicator: "CreateProcessA"; Source: "00000000-00004424.00000000.91567.012EA000.00000002.mdmp") Found reference to API (Indicator: "FormatMessageA"; Source: "00000000-00004424.00000000.91567.012EA000.00000002.mdmp") Found reference to API (Indicator: "GetTempFileNameA"; Source: "00000000-00004424.00000000.91567.012EA000.00000002.mdmp") Found reference to API (Indicator: "DosDateTimeToFileTime"; Source: "00000000-00004424.00000000.91567.012EA000.00000002.mdmp") Found reference to API (Indicator: "CreateEventA"; Source: "00000000-00004424.00000000.91567.012EA000.00000002.mdmp") Found reference to API (Indicator: "GetExitCodeProcess"; Source: "00000000-00004424.00000000.91567.012EA000.00000002.mdmp") Found reference to API (Indicator: "GetDeviceCaps"; Source: "00000000-00004424.00000000.91567.012EA000.00000002.mdmp") Found reference to API (Indicator: "GetDesktopWindow"; Source: "00000000-00004424.00000000.91567.012EA000.00000002.mdmp") Found reference to API (Indicator: "CharUpperA"; Source: "00000000-00004424.00000000.91567.012EA000.00000002.mdmp") Found reference to API (Indicator: "ExitWindowsEx"; Source: "00000000-00004424.00000000.91567.012EA000.00000002.mdmp") Found reference to API (Indicator: "MessageBeep"; Source: "00000000-00004424.00000000.91567.012EA000.00000002.mdmp") Found reference to API (Indicator: "CharPrevA"; Source: "00000000-00004424.00000000.91567.012EA000.00000002.mdmp") Found reference to API (Indicator: "LoadStringA"; Source: "00000000-00004424.00000000.91567.012EA000.00000002.mdmp") Found reference to API (Indicator: "CharNextA"; Source: "00000000-00004424.00000000.91567.012EA000.00000002.mdmp") Found reference to API (Indicator: "EnableWindow"; Source: "00000000-00004424.00000000.91567.012EA000.00000002.mdmp") Found reference to API (Indicator: "ReleaseDC"; Source: "00000000-00004424.00000000.91567.012EA000.00000002.mdmp") Found reference to API (Indicator: "SetForegroundWindow"; Source: "00000000-00004424.00000000.91567.012EA000.00000002.mdmp") Found reference to API (Indicator: "PeekMessageA"; Source: "00000000-00004424.00000000.91567.012EA000.00000002.mdmp") Found reference to API (Indicator: "SendMessageA"; Source: "00000000-00004424.00000000.91567.012EA000.00000002.mdmp") Found reference to API (Indicator: "MessageBoxA"; Source: "00000000-00004424.00000000.91567.012EA000.00000002.mdmp") Found reference to API (Indicator: "SetWindowTextA"; Source: "00000000-00004424.00000000.91567.012EA000.00000002.mdmp") Found reference to API (Indicator: "GetWindowLongA"; Source: "00000000-00004424.00000000.91567.012EA000.00000002.mdmp") Found reference to API (Indicator: "CallWindowProcA"; Source: "00000000-00004424.00000000.91567.012EA000.00000002.mdmp") Found reference to API (Indicator: "SetWindowLongA"; Source: "00000000-00004424.00000000.91567.012EA000.00000002.mdmp") Found reference to API (Indicator: "ShowWindow"; Source: "00000000-00004424.00000000.91567.012EA000.00000002.mdmp") Found reference to API (Indicator: "MsgWaitForMultipleObjects"; Source: "00000000-00004424.00000000.91567.012EA000.00000002.mdmp") Found reference to API (Indicator: "SetWindowPos"; Source: "00000000-00004424.00000000.91567.012EA000.00000002.mdmp") Found reference to API (Indicator: "GetDC"; Source: "00000000-00004424.00000000.91567.012EA000.00000002.mdmp") Found reference to API (Indicator: "GetWindowRect"; Source: "00000000-00004424.00000000.91567.012EA000.00000002.mdmp") Found reference to API (Indicator: "DispatchMessageA"; Source: "00000000-00004424.00000000.91567.012EA000.00000002.mdmp") Found reference to API (Indicator: "GetFileVersionInfoSizeA"; Source: "00000000-00004424.00000000.91567.012EA000.00000002.mdmp") Found reference to API (Indicator: "VerQueryValueA"; Source: "00000000-00004424.00000000.91567.012EA000.00000002.mdmp") Found reference to API (Indicator: "GetFileVersionInfoA"; Source: "00000000-00004424.00000000.91567.012EA000.00000002.mdmp") Found reference to API (Indicator: "Sleep"; Source: "00000000-00004424.00000000.91567.012EA000.00000002.mdmp") Found reference to API (Indicator: "GetStartupInfoW"; Source: "00000000-00004424.00000000.91567.012EA000.00000002.mdmp") Found reference to API (Indicator: "UnhandledExceptionFilter"; Source: "00000000-00004424.00000000.91567.012EA000.00000002.mdmp") Found reference to API (Indicator: "SetUnhandledExceptionFilter"; Source: "00000000-00004424.00000000.91567.012EA000.00000002.mdmp") Found reference to API (Indicator: "TerminateProcess"; Source: "00000000-00004424.00000000.91567.012EA000.00000002.mdmp") Found reference to API (Indicator: "QueryPerformanceCounter"; Source: "00000000-00004424.00000000.91567.012EA000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcessId"; Source: "00000000-00004424.00000000.91567.012EA000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentThreadId"; Source: "00000000-00004424.00000000.91567.012EA000.00000002.mdmp") Found reference to API (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00004424.00000000.91567.012EA000.00000002.mdmp") Found reference to API (Indicator: "GetTickCount"; Source: "00000000-00004424.00000000.91567.012EA000.00000002.mdmp") Found reference to API (Indicator: "EnumResourceLanguagesA"; Source: "00000000-00004424.00000000.91567.012EA000.00000002.mdmp") Found reference to API (Indicator: "GetDiskFreeSpaceA"; Source: "00000000-00004424.00000000.91567.012EA000.00000002.mdmp") Found reference to API (Indicator: "MulDiv"; Source: "00000000-00004424.00000000.91567.012EA000.00000002.mdmp") Found reference to API (Indicator: "GetSystemMetrics"; Source: "00000000-00004424.00000000.91567.012EA000.00000002.mdmp") Found reference to API (Indicator: "CheckTokenMembership"; Source: "00000000-00004424.00000002.95407.012E1000.00000020.mdmp") Found reference to API (Indicator: "SeShutdownPrivilege"; Source: "00000000-00004424.00000002.95407.012E1000.00000020.mdmp") Found reference to API (Indicator: "HeapSetInformation"; Source: "00000000-00004424.00000002.95407.012E1000.00000020.mdmp") Found reference to API (Indicator: "DecryptFileA"; Source: "00000000-00004424.00000002.95407.012E1000.00000020.mdmp") Found reference to API (Indicator: "CheckTokenMembership"; Source: "00000000-00005996.00000000.91672.00B91000.00000020.mdmp") Found reference to API (Indicator: "SeShutdownPrivilege"; Source: "00000000-00005996.00000000.91672.00B91000.00000020.mdmp") Found reference to API (Indicator: "HeapSetInformation"; Source: "00000000-00005996.00000000.91672.00B91000.00000020.mdmp") Found reference to API (Indicator: "DecryptFileA"; Source: "00000000-00005996.00000000.91672.00B91000.00000020.mdmp") Found reference to API (Indicator: "GetTokenInformation"; Source: "00000000-00005996.00000001.93593.00B9A000.00000002.mdmp") Found reference to API (Indicator: "RegDeleteValueA"; Source: "00000000-00005996.00000001.93593.00B9A000.00000002.mdmp") Found reference to API (Indicator: "RegOpenKeyExA"; Source: "00000000-00005996.00000001.93593.00B9A000.00000002.mdmp") Found reference to API (Indicator: "RegQueryInfoKeyA"; Source: "00000000-00005996.00000001.93593.00B9A000.00000002.mdmp") Found reference to API (Indicator: "FreeSid"; Source: "00000000-00005996.00000001.93593.00B9A000.00000002.mdmp") Found reference to API (Indicator: "OpenProcessToken"; Source: "00000000-00005996.00000001.93593.00B9A000.00000002.mdmp") Found reference to API (Indicator: "RegSetValueExA"; Source: "00000000-00005996.00000001.93593.00B9A000.00000002.mdmp") Found reference to API (Indicator: "RegCreateKeyExA"; Source: "00000000-00005996.00000001.93593.00B9A000.00000002.mdmp") Found reference to API (Indicator: "LookupPrivilegeValueA"; Source: "00000000-00005996.00000001.93593.00B9A000.00000002.mdmp") Found reference to API (Indicator: "AllocateAndInitializeSid"; Source: "00000000-00005996.00000001.93593.00B9A000.00000002.mdmp") Found reference to API (Indicator: "RegQueryValueExA"; Source: "00000000-00005996.00000001.93593.00B9A000.00000002.mdmp") Found reference to API (Indicator: "EqualSid"; Source: "00000000-00005996.00000001.93593.00B9A000.00000002.mdmp") Found reference to API (Indicator: "RegCloseKey"; Source: "00000000-00005996.00000001.93593.00B9A000.00000002.mdmp") Found reference to API (Indicator: "AdjustTokenPrivileges"; Source: "00000000-00005996.00000001.93593.00B9A000.00000002.mdmp") Found reference to API (Indicator: "GetShortPathNameA"; Source: "00000000-00005996.00000001.93593.00B9A000.00000002.mdmp") Found reference to API (Indicator: "GetModuleFileNameA"; Source: "00000000-00005996.00000001.93593.00B9A000.00000002.mdmp") Found reference to API (Indicator: "FindFirstFileA"; Source: "00000000-00005996.00000001.93593.00B9A000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcess"; Source: "00000000-00005996.00000001.93593.00B9A000.00000002.mdmp") Found reference to API (Indicator: "FindNextFileA"; Source: "00000000-00005996.00000001.93593.00B9A000.00000002.mdmp") Found reference to API (Indicator: "ExpandEnvironmentStringsA"; Source: "00000000-00005996.00000001.93593.00B9A000.00000002.mdmp") Found reference to API (Indicator: "FindClose"; Source: "00000000-00005996.00000001.93593.00B9A000.00000002.mdmp") Found reference to API (Indicator: "LocalAlloc"; Source: "00000000-00005996.00000001.93593.00B9A000.00000002.mdmp") Found reference to API (Indicator: "lstrcmpA"; Source: "00000000-00005996.00000001.93593.00B9A000.00000002.mdmp") Found reference to API (Indicator: "CompareStringA"; Source: "00000000-00005996.00000001.93593.00B9A000.00000002.mdmp") Found reference to API (Indicator: "GetLastError"; Source: "00000000-00005996.00000001.93593.00B9A000.00000002.mdmp") Found reference to API (Indicator: "GetFileAttributesA"; Source: "00000000-00005996.00000001.93593.00B9A000.00000002.mdmp") Found reference to API (Indicator: "GetSystemDirectoryA"; Source: "00000000-00005996.00000001.93593.00B9A000.00000002.mdmp") Found reference to API (Indicator: "LoadLibraryA"; Source: "00000000-00005996.00000001.93593.00B9A000.00000002.mdmp") Found reference to API (Indicator: "DeleteFileA"; Source: "00000000-00005996.00000001.93593.00B9A000.00000002.mdmp") Found reference to API (Indicator: "GlobalAlloc"; Source: "00000000-00005996.00000001.93593.00B9A000.00000002.mdmp") Found reference to API (Indicator: "GlobalFree"; Source: "00000000-00005996.00000001.93593.00B9A000.00000002.mdmp") Found reference to API (Indicator: "CloseHandle"; Source: "00000000-00005996.00000001.93593.00B9A000.00000002.mdmp") Found reference to API (Indicator: "WritePrivateProfileStringA"; Source: "00000000-00005996.00000001.93593.00B9A000.00000002.mdmp") Found reference to API (Indicator: "IsDBCSLeadByte"; Source: "00000000-00005996.00000001.93593.00B9A000.00000002.mdmp") Found reference to API (Indicator: "GetWindowsDirectoryA"; Source: "00000000-00005996.00000001.93593.00B9A000.00000002.mdmp") Found reference to API (Indicator: "SetFileAttributesA"; Source: "00000000-00005996.00000001.93593.00B9A000.00000002.mdmp") Found reference to API (Indicator: "GetProcAddress"; Source: "00000000-00005996.00000001.93593.00B9A000.00000002.mdmp") Found reference to API (Indicator: "GlobalLock"; Source: "00000000-00005996.00000001.93593.00B9A000.00000002.mdmp") Found reference to API (Indicator: "LocalFree"; Source: "00000000-00005996.00000001.93593.00B9A000.00000002.mdmp") Found reference to API (Indicator: "RemoveDirectoryA"; Source: "00000000-00005996.00000001.93593.00B9A000.00000002.mdmp") Found reference to API (Indicator: "FreeLibrary"; Source: "00000000-00005996.00000001.93593.00B9A000.00000002.mdmp") Found reference to API (Indicator: "CreateDirectoryA"; Source: "00000000-00005996.00000001.93593.00B9A000.00000002.mdmp") Found reference to API (Indicator: "GetPrivateProfileIntA"; Source: "00000000-00005996.00000001.93593.00B9A000.00000002.mdmp") Found reference to API (Indicator: "GetPrivateProfileStringA"; Source: "00000000-00005996.00000001.93593.00B9A000.00000002.mdmp") Found reference to API (Indicator: "GlobalUnlock"; Source: "00000000-00005996.00000001.93593.00B9A000.00000002.mdmp") Found reference to API (Indicator: "ReadFile"; Source: "00000000-00005996.00000001.93593.00B9A000.00000002.mdmp") Found reference to API (Indicator: "SizeofResource"; Source: "00000000-00005996.00000001.93593.00B9A000.00000002.mdmp") Found reference to API (Indicator: "WriteFile"; Source: "00000000-00005996.00000001.93593.00B9A000.00000002.mdmp") Found reference to API (Indicator: "GetDriveTypeA"; Source: "00000000-00005996.00000001.93593.00B9A000.00000002.mdmp") Found reference to API (Indicator: "LoadLibraryExA"; Source: "00000000-00005996.00000001.93593.00B9A000.00000002.mdmp") Found reference to API (Indicator: "SetFileTime"; Source: "00000000-00005996.00000001.93593.00B9A000.00000002.mdmp") Found reference to API (Indicator: "SetFilePointer"; Source: "00000000-00005996.00000001.93593.00B9A000.00000002.mdmp") Found reference to API (Indicator: "FindResourceA"; Source: "00000000-00005996.00000001.93593.00B9A000.00000002.mdmp") Found reference to API (Indicator: "CreateMutexA"; Source: "00000000-00005996.00000001.93593.00B9A000.00000002.mdmp") Found reference to API (Indicator: "GetVolumeInformationA"; Source: "00000000-00005996.00000001.93593.00B9A000.00000002.mdmp") Found reference to API (Indicator: "WaitForSingleObject"; Source: "00000000-00005996.00000001.93593.00B9A000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentDirectoryA"; Source: "00000000-00005996.00000001.93593.00B9A000.00000002.mdmp") Found reference to API (Indicator: "FreeResource"; Source: "00000000-00005996.00000001.93593.00B9A000.00000002.mdmp") Found reference to API (Indicator: "GetVersion"; Source: "00000000-00005996.00000001.93593.00B9A000.00000002.mdmp") Found reference to API (Indicator: "SetCurrentDirectoryA"; Source: "00000000-00005996.00000001.93593.00B9A000.00000002.mdmp") Found reference to API (Indicator: "GetTempPathA"; Source: "00000000-00005996.00000001.93593.00B9A000.00000002.mdmp") Found reference to API (Indicator: "LocalFileTimeToFileTime"; Source: "00000000-00005996.00000001.93593.00B9A000.00000002.mdmp") Found reference to API (Indicator: "CreateFileA"; Source: "00000000-00005996.00000001.93593.00B9A000.00000002.mdmp") Found reference to API (Indicator: "SetEvent"; Source: "00000000-00005996.00000001.93593.00B9A000.00000002.mdmp") Found reference to API (Indicator: "TerminateThread"; Source: "00000000-00005996.00000001.93593.00B9A000.00000002.mdmp") Found reference to API (Indicator: "GetVersionExA"; Source: "00000000-00005996.00000001.93593.00B9A000.00000002.mdmp") Found reference to API (Indicator: "LockResource"; Source: "00000000-00005996.00000001.93593.00B9A000.00000002.mdmp") Found reference to API (Indicator: "GetSystemInfo"; Source: "00000000-00005996.00000001.93593.00B9A000.00000002.mdmp") Found reference to API (Indicator: "CreateThread"; Source: "00000000-00005996.00000001.93593.00B9A000.00000002.mdmp") Found reference to API (Indicator: "ResetEvent"; Source: "00000000-00005996.00000001.93593.00B9A000.00000002.mdmp") Found reference to API (Indicator: "LoadResource"; Source: "00000000-00005996.00000001.93593.00B9A000.00000002.mdmp") Found reference to API (Indicator: "ExitProcess"; Source: "00000000-00005996.00000001.93593.00B9A000.00000002.mdmp") Found reference to API (Indicator: "GetModuleHandleW"; Source: "00000000-00005996.00000001.93593.00B9A000.00000002.mdmp") Found reference to API (Indicator: "CreateProcessA"; Source: "00000000-00005996.00000001.93593.00B9A000.00000002.mdmp") Found reference to API (Indicator: "FormatMessageA"; Source: "00000000-00005996.00000001.93593.00B9A000.00000002.mdmp") Found reference to API (Indicator: "GetTempFileNameA"; Source: "00000000-00005996.00000001.93593.00B9A000.00000002.mdmp") Found reference to API (Indicator: "DosDateTimeToFileTime"; Source: "00000000-00005996.00000001.93593.00B9A000.00000002.mdmp") Found reference to API (Indicator: "CreateEventA"; Source: "00000000-00005996.00000001.93593.00B9A000.00000002.mdmp") Found reference to API (Indicator: "GetExitCodeProcess"; Source: "00000000-00005996.00000001.93593.00B9A000.00000002.mdmp") Found reference to API (Indicator: "GetDeviceCaps"; Source: "00000000-00005996.00000001.93593.00B9A000.00000002.mdmp") Found reference to API (Indicator: "GetDesktopWindow"; Source: "00000000-00005996.00000001.93593.00B9A000.00000002.mdmp") Found reference to API (Indicator: "CharUpperA"; Source: "00000000-00005996.00000001.93593.00B9A000.00000002.mdmp") Found reference to API (Indicator: "ExitWindowsEx"; Source: "00000000-00005996.00000001.93593.00B9A000.00000002.mdmp") Found reference to API (Indicator: "MessageBeep"; Source: "00000000-00005996.00000001.93593.00B9A000.00000002.mdmp") Found reference to API (Indicator: "CharPrevA"; Source: "00000000-00005996.00000001.93593.00B9A000.00000002.mdmp") Found reference to API (Indicator: "LoadStringA"; Source: "00000000-00005996.00000001.93593.00B9A000.00000002.mdmp") Found reference to API (Indicator: "CharNextA"; Source: "00000000-00005996.00000001.93593.00B9A000.00000002.mdmp") Found reference to API (Indicator: "EnableWindow"; Source: "00000000-00005996.00000001.93593.00B9A000.00000002.mdmp") Found reference to API (Indicator: "ReleaseDC"; Source: "00000000-00005996.00000001.93593.00B9A000.00000002.mdmp") Found reference to API (Indicator: "SetForegroundWindow"; Source: "00000000-00005996.00000001.93593.00B9A000.00000002.mdmp") Found reference to API (Indicator: "PeekMessageA"; Source: "00000000-00005996.00000001.93593.00B9A000.00000002.mdmp") Found reference to API (Indicator: "SendMessageA"; Source: "00000000-00005996.00000001.93593.00B9A000.00000002.mdmp") Found reference to API (Indicator: "MessageBoxA"; Source: "00000000-00005996.00000001.93593.00B9A000.00000002.mdmp") Found reference to API (Indicator: "SetWindowTextA"; Source: "00000000-00005996.00000001.93593.00B9A000.00000002.mdmp") Found reference to API (Indicator: "GetWindowLongA"; Source: "00000000-00005996.00000001.93593.00B9A000.00000002.mdmp") Found reference to API (Indicator: "CallWindowProcA"; Source: "00000000-00005996.00000001.93593.00B9A000.00000002.mdmp") Found reference to API (Indicator: "SetWindowLongA"; Source: "00000000-00005996.00000001.93593.00B9A000.00000002.mdmp") Found reference to API (Indicator: "ShowWindow"; Source: "00000000-00005996.00000001.93593.00B9A000.00000002.mdmp") Found reference to API (Indicator: "MsgWaitForMultipleObjects"; Source: "00000000-00005996.00000001.93593.00B9A000.00000002.mdmp") Found reference to API (Indicator: "SetWindowPos"; Source: "00000000-00005996.00000001.93593.00B9A000.00000002.mdmp") Found reference to API (Indicator: "GetDC"; Source: "00000000-00005996.00000001.93593.00B9A000.00000002.mdmp") Found reference to API (Indicator: "GetWindowRect"; Source: "00000000-00005996.00000001.93593.00B9A000.00000002.mdmp") Found reference to API (Indicator: "DispatchMessageA"; Source: "00000000-00005996.00000001.93593.00B9A000.00000002.mdmp") Found reference to API (Indicator: "GetFileVersionInfoSizeA"; Source: "00000000-00005996.00000001.93593.00B9A000.00000002.mdmp") Found reference to API (Indicator: "VerQueryValueA"; Source: "00000000-00005996.00000001.93593.00B9A000.00000002.mdmp") Found reference to API (Indicator: "GetFileVersionInfoA"; Source: "00000000-00005996.00000001.93593.00B9A000.00000002.mdmp") Found reference to API (Indicator: "Sleep"; Source: "00000000-00005996.00000001.93593.00B9A000.00000002.mdmp") Found reference to API (Indicator: "GetStartupInfoW"; Source: "00000000-00005996.00000001.93593.00B9A000.00000002.mdmp") Found reference to API (Indicator: "UnhandledExceptionFilter"; Source: "00000000-00005996.00000001.93593.00B9A000.00000002.mdmp") Found reference to API (Indicator: "SetUnhandledExceptionFilter"; Source: "00000000-00005996.00000001.93593.00B9A000.00000002.mdmp") Found reference to API (Indicator: "TerminateProcess"; Source: "00000000-00005996.00000001.93593.00B9A000.00000002.mdmp") Found reference to API (Indicator: "QueryPerformanceCounter"; Source: "00000000-00005996.00000001.93593.00B9A000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcessId"; Source: "00000000-00005996.00000001.93593.00B9A000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentThreadId"; Source: "00000000-00005996.00000001.93593.00B9A000.00000002.mdmp") Found reference to API (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00005996.00000001.93593.00B9A000.00000002.mdmp") Found reference to API (Indicator: "GetTickCount"; Source: "00000000-00005996.00000001.93593.00B9A000.00000002.mdmp") Found reference to API (Indicator: "EnumResourceLanguagesA"; Source: "00000000-00005996.00000001.93593.00B9A000.00000002.mdmp") Found reference to API (Indicator: "GetDiskFreeSpaceA"; Source: "00000000-00005996.00000001.93593.00B9A000.00000002.mdmp") Found reference to API (Indicator: "MulDiv"; Source: "00000000-00005996.00000001.93593.00B9A000.00000002.mdmp") Found reference to API (Indicator: "GetSystemMetrics"; Source: "00000000-00005996.00000001.93593.00B9A000.00000002.mdmp") Found reference to API (Indicator: "CheckTokenMembership"; Source: "00000000-00007476.00000000.91759.00241000.00000020.mdmp") Found reference to API (Indicator: "SeShutdownPrivilege"; Source: "00000000-00007476.00000000.91759.00241000.00000020.mdmp") Found reference to API (Indicator: "HeapSetInformation"; Source: "00000000-00007476.00000000.91759.00241000.00000020.mdmp") Found reference to API (Indicator: "DecryptFileA"; Source: "00000000-00007476.00000000.91759.00241000.00000020.mdmp") Found reference to API (Indicator: "GetTokenInformation"; Source: "00000000-00007476.00000000.91759.0024A000.00000002.mdmp") Found reference to API (Indicator: "RegDeleteValueA"; Source: "00000000-00007476.00000000.91759.0024A000.00000002.mdmp") Found reference to API (Indicator: "RegOpenKeyExA"; Source: "00000000-00007476.00000000.91759.0024A000.00000002.mdmp") Found reference to API (Indicator: "RegQueryInfoKeyA"; Source: "00000000-00007476.00000000.91759.0024A000.00000002.mdmp") Found reference to API (Indicator: "FreeSid"; Source: "00000000-00007476.00000000.91759.0024A000.00000002.mdmp") Found reference to API (Indicator: "OpenProcessToken"; Source: "00000000-00007476.00000000.91759.0024A000.00000002.mdmp") Found reference to API (Indicator: "RegSetValueExA"; Source: "00000000-00007476.00000000.91759.0024A000.00000002.mdmp") Found reference to API (Indicator: "RegCreateKeyExA"; Source: "00000000-00007476.00000000.91759.0024A000.00000002.mdmp") Found reference to API (Indicator: "LookupPrivilegeValueA"; Source: "00000000-00007476.00000000.91759.0024A000.00000002.mdmp") Found reference to API (Indicator: "AllocateAndInitializeSid"; Source: "00000000-00007476.00000000.91759.0024A000.00000002.mdmp") Found reference to API (Indicator: "RegQueryValueExA"; Source: "00000000-00007476.00000000.91759.0024A000.00000002.mdmp") Found reference to API (Indicator: "EqualSid"; Source: "00000000-00007476.00000000.91759.0024A000.00000002.mdmp") Found reference to API (Indicator: "RegCloseKey"; Source: "00000000-00007476.00000000.91759.0024A000.00000002.mdmp") Found reference to API (Indicator: "AdjustTokenPrivileges"; Source: "00000000-00007476.00000000.91759.0024A000.00000002.mdmp") Found reference to API (Indicator: "GetShortPathNameA"; Source: "00000000-00007476.00000000.91759.0024A000.00000002.mdmp") Found reference to API (Indicator: "GetModuleFileNameA"; Source: "00000000-00007476.00000000.91759.0024A000.00000002.mdmp") Found reference to API (Indicator: "FindFirstFileA"; Source: "00000000-00007476.00000000.91759.0024A000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcess"; Source: "00000000-00007476.00000000.91759.0024A000.00000002.mdmp") Found reference to API (Indicator: "FindNextFileA"; Source: "00000000-00007476.00000000.91759.0024A000.00000002.mdmp") Found reference to API (Indicator: "ExpandEnvironmentStringsA"; Source: "00000000-00007476.00000000.91759.0024A000.00000002.mdmp") Found reference to API (Indicator: "FindClose"; Source: "00000000-00007476.00000000.91759.0024A000.00000002.mdmp") Found reference to API (Indicator: "LocalAlloc"; Source: "00000000-00007476.00000000.91759.0024A000.00000002.mdmp") Found reference to API (Indicator: "lstrcmpA"; Source: "00000000-00007476.00000000.91759.0024A000.00000002.mdmp") Found reference to API (Indicator: "CompareStringA"; Source: "00000000-00007476.00000000.91759.0024A000.00000002.mdmp") Found reference to API (Indicator: "GetLastError"; Source: "00000000-00007476.00000000.91759.0024A000.00000002.mdmp") Found reference to API (Indicator: "GetFileAttributesA"; Source: "00000000-00007476.00000000.91759.0024A000.00000002.mdmp") Found reference to API (Indicator: "GetSystemDirectoryA"; Source: "00000000-00007476.00000000.91759.0024A000.00000002.mdmp") Found reference to API (Indicator: "LoadLibraryA"; Source: "00000000-00007476.00000000.91759.0024A000.00000002.mdmp") Found reference to API (Indicator: "DeleteFileA"; Source: "00000000-00007476.00000000.91759.0024A000.00000002.mdmp") Found reference to API (Indicator: "GlobalAlloc"; Source: "00000000-00007476.00000000.91759.0024A000.00000002.mdmp") Found reference to API (Indicator: "GlobalFree"; Source: "00000000-00007476.00000000.91759.0024A000.00000002.mdmp") Found reference to API (Indicator: "CloseHandle"; Source: "00000000-00007476.00000000.91759.0024A000.00000002.mdmp") Found reference to API (Indicator: "WritePrivateProfileStringA"; Source: "00000000-00007476.00000000.91759.0024A000.00000002.mdmp") Found reference to API (Indicator: "IsDBCSLeadByte"; Source: "00000000-00007476.00000000.91759.0024A000.00000002.mdmp") Found reference to API (Indicator: "GetWindowsDirectoryA"; Source: "00000000-00007476.00000000.91759.0024A000.00000002.mdmp") Found reference to API (Indicator: "SetFileAttributesA"; Source: "00000000-00007476.00000000.91759.0024A000.00000002.mdmp") Found reference to API (Indicator: "GetProcAddress"; Source: "00000000-00007476.00000000.91759.0024A000.00000002.mdmp") Found reference to API (Indicator: "GlobalLock"; Source: "00000000-00007476.00000000.91759.0024A000.00000002.mdmp") Found reference to API (Indicator: "LocalFree"; Source: "00000000-00007476.00000000.91759.0024A000.00000002.mdmp") Found reference to API (Indicator: "RemoveDirectoryA"; Source: "00000000-00007476.00000000.91759.0024A000.00000002.mdmp") Found reference to API (Indicator: "FreeLibrary"; Source: "00000000-00007476.00000000.91759.0024A000.00000002.mdmp") Found reference to API (Indicator: "CreateDirectoryA"; Source: "00000000-00007476.00000000.91759.0024A000.00000002.mdmp") Found reference to API (Indicator: "GetPrivateProfileIntA"; Source: "00000000-00007476.00000000.91759.0024A000.00000002.mdmp") Found reference to API (Indicator: "GetPrivateProfileStringA"; Source: "00000000-00007476.00000000.91759.0024A000.00000002.mdmp") Found reference to API (Indicator: "GlobalUnlock"; Source: "00000000-00007476.00000000.91759.0024A000.00000002.mdmp") Found reference to API (Indicator: "ReadFile"; Source: "00000000-00007476.00000000.91759.0024A000.00000002.mdmp") Found reference to API (Indicator: "SizeofResource"; Source: "00000000-00007476.00000000.91759.0024A000.00000002.mdmp") Found reference to API (Indicator: "WriteFile"; Source: "00000000-00007476.00000000.91759.0024A000.00000002.mdmp") Found reference to API (Indicator: "GetDriveTypeA"; Source: "00000000-00007476.00000000.91759.0024A000.00000002.mdmp") Found reference to API (Indicator: "LoadLibraryExA"; Source: "00000000-00007476.00000000.91759.0024A000.00000002.mdmp") Found reference to API (Indicator: "SetFileTime"; Source: "00000000-00007476.00000000.91759.0024A000.00000002.mdmp") Found reference to API (Indicator: "SetFilePointer"; Source: "00000000-00007476.00000000.91759.0024A000.00000002.mdmp") Found reference to API (Indicator: "FindResourceA"; Source: "00000000-00007476.00000000.91759.0024A000.00000002.mdmp") Found reference to API (Indicator: "CreateMutexA"; Source: "00000000-00007476.00000000.91759.0024A000.00000002.mdmp") Found reference to API (Indicator: "GetVolumeInformationA"; Source: "00000000-00007476.00000000.91759.0024A000.00000002.mdmp") Found reference to API (Indicator: "WaitForSingleObject"; Source: "00000000-00007476.00000000.91759.0024A000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentDirectoryA"; Source: "00000000-00007476.00000000.91759.0024A000.00000002.mdmp") Found reference to API (Indicator: "FreeResource"; Source: "00000000-00007476.00000000.91759.0024A000.00000002.mdmp") Found reference to API (Indicator: "GetVersion"; Source: "00000000-00007476.00000000.91759.0024A000.00000002.mdmp") Found reference to API (Indicator: "SetCurrentDirectoryA"; Source: "00000000-00007476.00000000.91759.0024A000.00000002.mdmp") Found reference to API (Indicator: "GetTempPathA"; Source: "00000000-00007476.00000000.91759.0024A000.00000002.mdmp") Found reference to API (Indicator: "LocalFileTimeToFileTime"; Source: "00000000-00007476.00000000.91759.0024A000.00000002.mdmp") Found reference to API (Indicator: "CreateFileA"; Source: "00000000-00007476.00000000.91759.0024A000.00000002.mdmp") Found reference to API (Indicator: "SetEvent"; Source: "00000000-00007476.00000000.91759.0024A000.00000002.mdmp") Found reference to API (Indicator: "TerminateThread"; Source: "00000000-00007476.00000000.91759.0024A000.00000002.mdmp") Found reference to API (Indicator: "GetVersionExA"; Source: "00000000-00007476.00000000.91759.0024A000.00000002.mdmp") Found reference to API (Indicator: "LockResource"; Source: "00000000-00007476.00000000.91759.0024A000.00000002.mdmp") Found reference to API (Indicator: "GetSystemInfo"; Source: "00000000-00007476.00000000.91759.0024A000.00000002.mdmp") Found reference to API (Indicator: "CreateThread"; Source: "00000000-00007476.00000000.91759.0024A000.00000002.mdmp") Found reference to API (Indicator: "ResetEvent"; Source: "00000000-00007476.00000000.91759.0024A000.00000002.mdmp") Found reference to API (Indicator: "LoadResource"; Source: "00000000-00007476.00000000.91759.0024A000.00000002.mdmp") Found reference to API (Indicator: "ExitProcess"; Source: "00000000-00007476.00000000.91759.0024A000.00000002.mdmp") Found reference to API (Indicator: "GetModuleHandleW"; Source: "00000000-00007476.00000000.91759.0024A000.00000002.mdmp") Found reference to API (Indicator: "CreateProcessA"; Source: "00000000-00007476.00000000.91759.0024A000.00000002.mdmp") Found reference to API (Indicator: "FormatMessageA"; Source: "00000000-00007476.00000000.91759.0024A000.00000002.mdmp") Found reference to API (Indicator: "GetTempFileNameA"; Source: "00000000-00007476.00000000.91759.0024A000.00000002.mdmp") Found reference to API (Indicator: "DosDateTimeToFileTime"; Source: "00000000-00007476.00000000.91759.0024A000.00000002.mdmp") Found reference to API (Indicator: "CreateEventA"; Source: "00000000-00007476.00000000.91759.0024A000.00000002.mdmp") Found reference to API (Indicator: "GetExitCodeProcess"; Source: "00000000-00007476.00000000.91759.0024A000.00000002.mdmp") Found reference to API (Indicator: "GetDeviceCaps"; Source: "00000000-00007476.00000000.91759.0024A000.00000002.mdmp") Found reference to API (Indicator: "GetDesktopWindow"; Source: "00000000-00007476.00000000.91759.0024A000.00000002.mdmp") Found reference to API (Indicator: "CharUpperA"; Source: "00000000-00007476.00000000.91759.0024A000.00000002.mdmp") Found reference to API (Indicator: "ExitWindowsEx"; Source: "00000000-00007476.00000000.91759.0024A000.00000002.mdmp") Found reference to API (Indicator: "MessageBeep"; Source: "00000000-00007476.00000000.91759.0024A000.00000002.mdmp") Found reference to API (Indicator: "CharPrevA"; Source: "00000000-00007476.00000000.91759.0024A000.00000002.mdmp") Found reference to API (Indicator: "LoadStringA"; Source: "00000000-00007476.00000000.91759.0024A000.00000002.mdmp") Found reference to API (Indicator: "CharNextA"; Source: "00000000-00007476.00000000.91759.0024A000.00000002.mdmp") Found reference to API (Indicator: "EnableWindow"; Source: "00000000-00007476.00000000.91759.0024A000.00000002.mdmp") Found reference to API (Indicator: "ReleaseDC"; Source: "00000000-00007476.00000000.91759.0024A000.00000002.mdmp") Found reference to API (Indicator: "SetForegroundWindow"; Source: "00000000-00007476.00000000.91759.0024A000.00000002.mdmp") Found reference to API (Indicator: "PeekMessageA"; Source: "00000000-00007476.00000000.91759.0024A000.00000002.mdmp") Found reference to API (Indicator: "SendMessageA"; Source: "00000000-00007476.00000000.91759.0024A000.00000002.mdmp") Found reference to API (Indicator: "MessageBoxA"; Source: "00000000-00007476.00000000.91759.0024A000.00000002.mdmp") Found reference to API (Indicator: "SetWindowTextA"; Source: "00000000-00007476.00000000.91759.0024A000.00000002.mdmp") Found reference to API (Indicator: "GetWindowLongA"; Source: "00000000-00007476.00000000.91759.0024A000.00000002.mdmp") Found reference to API (Indicator: "CallWindowProcA"; Source: "00000000-00007476.00000000.91759.0024A000.00000002.mdmp") Found reference to API (Indicator: "SetWindowLongA"; Source: "00000000-00007476.00000000.91759.0024A000.00000002.mdmp") Found reference to API (Indicator: "ShowWindow"; Source: "00000000-00007476.00000000.91759.0024A000.00000002.mdmp") Found reference to API (Indicator: "MsgWaitForMultipleObjects"; Source: "00000000-00007476.00000000.91759.0024A000.00000002.mdmp") Found reference to API (Indicator: "SetWindowPos"; Source: "00000000-00007476.00000000.91759.0024A000.00000002.mdmp") Found reference to API (Indicator: "GetDC"; Source: "00000000-00007476.00000000.91759.0024A000.00000002.mdmp") Found reference to API (Indicator: "GetWindowRect"; Source: "00000000-00007476.00000000.91759.0024A000.00000002.mdmp") Found reference to API (Indicator: "DispatchMessageA"; Source: "00000000-00007476.00000000.91759.0024A000.00000002.mdmp") Found reference to API (Indicator: "GetFileVersionInfoSizeA"; Source: "00000000-00007476.00000000.91759.0024A000.00000002.mdmp") Found reference to API (Indicator: "VerQueryValueA"; Source: "00000000-00007476.00000000.91759.0024A000.00000002.mdmp") Found reference to API (Indicator: "GetFileVersionInfoA"; Source: "00000000-00007476.00000000.91759.0024A000.00000002.mdmp") Found reference to API (Indicator: "Sleep"; Source: "00000000-00007476.00000000.91759.0024A000.00000002.mdmp") Found reference to API (Indicator: "GetStartupInfoW"; Source: "00000000-00007476.00000000.91759.0024A000.00000002.mdmp") Found reference to API (Indicator: "UnhandledExceptionFilter"; Source: "00000000-00007476.00000000.91759.0024A000.00000002.mdmp") Found reference to API (Indicator: "SetUnhandledExceptionFilter"; Source: "00000000-00007476.00000000.91759.0024A000.00000002.mdmp") Found reference to API (Indicator: "TerminateProcess"; Source: "00000000-00007476.00000000.91759.0024A000.00000002.mdmp") Found reference to API (Indicator: "QueryPerformanceCounter"; Source: "00000000-00007476.00000000.91759.0024A000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcessId"; Source: "00000000-00007476.00000000.91759.0024A000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentThreadId"; Source: "00000000-00007476.00000000.91759.0024A000.00000002.mdmp") Found reference to API (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00007476.00000000.91759.0024A000.00000002.mdmp") Found reference to API (Indicator: "GetTickCount"; Source: "00000000-00007476.00000000.91759.0024A000.00000002.mdmp") Found reference to API (Indicator: "EnumResourceLanguagesA"; Source: "00000000-00007476.00000000.91759.0024A000.00000002.mdmp") Found reference to API (Indicator: "GetDiskFreeSpaceA"; Source: "00000000-00007476.00000000.91759.0024A000.00000002.mdmp") Found reference to API (Indicator: "MulDiv"; Source: "00000000-00007476.00000000.91759.0024A000.00000002.mdmp") Found reference to API (Indicator: "GetSystemMetrics"; Source: "00000000-00007476.00000000.91759.0024A000.00000002.mdmp") Found reference to API (Indicator: "GetTokenInformation"; Source: "00000000-00008204.00000000.91623.001FA000.00000002.mdmp") Found reference to API (Indicator: "RegDeleteValueA"; Source: "00000000-00008204.00000000.91623.001FA000.00000002.mdmp") Found reference to API (Indicator: "RegOpenKeyExA"; Source: "00000000-00008204.00000000.91623.001FA000.00000002.mdmp") Found reference to API (Indicator: "RegQueryInfoKeyA"; Source: "00000000-00008204.00000000.91623.001FA000.00000002.mdmp") Found reference to API (Indicator: "FreeSid"; Source: "00000000-00008204.00000000.91623.001FA000.00000002.mdmp") Found reference to API (Indicator: "OpenProcessToken"; Source: "00000000-00008204.00000000.91623.001FA000.00000002.mdmp") Found reference to API (Indicator: "RegSetValueExA"; Source: "00000000-00008204.00000000.91623.001FA000.00000002.mdmp") Found reference to API (Indicator: "RegCreateKeyExA"; Source: "00000000-00008204.00000000.91623.001FA000.00000002.mdmp") Found reference to API (Indicator: "LookupPrivilegeValueA"; Source: "00000000-00008204.00000000.91623.001FA000.00000002.mdmp") Found reference to API (Indicator: "AllocateAndInitializeSid"; Source: "00000000-00008204.00000000.91623.001FA000.00000002.mdmp") Found reference to API (Indicator: "RegQueryValueExA"; Source: "00000000-00008204.00000000.91623.001FA000.00000002.mdmp") Found reference to API (Indicator: "EqualSid"; Source: "00000000-00008204.00000000.91623.001FA000.00000002.mdmp") Found reference to API (Indicator: "RegCloseKey"; Source: "00000000-00008204.00000000.91623.001FA000.00000002.mdmp") Found reference to API (Indicator: "AdjustTokenPrivileges"; Source: "00000000-00008204.00000000.91623.001FA000.00000002.mdmp") Found reference to API (Indicator: "GetShortPathNameA"; Source: "00000000-00008204.00000000.91623.001FA000.00000002.mdmp") Found reference to API (Indicator: "GetModuleFileNameA"; Source: "00000000-00008204.00000000.91623.001FA000.00000002.mdmp") Found reference to API (Indicator: "FindFirstFileA"; Source: "00000000-00008204.00000000.91623.001FA000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcess"; Source: "00000000-00008204.00000000.91623.001FA000.00000002.mdmp") Found reference to API (Indicator: "FindNextFileA"; Source: "00000000-00008204.00000000.91623.001FA000.00000002.mdmp") Found reference to API (Indicator: "ExpandEnvironmentStringsA"; Source: "00000000-00008204.00000000.91623.001FA000.00000002.mdmp") Found reference to API (Indicator: "FindClose"; Source: "00000000-00008204.00000000.91623.001FA000.00000002.mdmp") Found reference to API (Indicator: "LocalAlloc"; Source: "00000000-00008204.00000000.91623.001FA000.00000002.mdmp") Found reference to API (Indicator: "lstrcmpA"; Source: "00000000-00008204.00000000.91623.001FA000.00000002.mdmp") Found reference to API (Indicator: "CompareStringA"; Source: "00000000-00008204.00000000.91623.001FA000.00000002.mdmp") Found reference to API (Indicator: "GetLastError"; Source: "00000000-00008204.00000000.91623.001FA000.00000002.mdmp") Found reference to API (Indicator: "GetFileAttributesA"; Source: "00000000-00008204.00000000.91623.001FA000.00000002.mdmp") Found reference to API (Indicator: "GetSystemDirectoryA"; Source: "00000000-00008204.00000000.91623.001FA000.00000002.mdmp") Found reference to API (Indicator: "LoadLibraryA"; Source: "00000000-00008204.00000000.91623.001FA000.00000002.mdmp") Found reference to API (Indicator: "DeleteFileA"; Source: "00000000-00008204.00000000.91623.001FA000.00000002.mdmp") Found reference to API (Indicator: "GlobalAlloc"; Source: "00000000-00008204.00000000.91623.001FA000.00000002.mdmp") Found reference to API (Indicator: "GlobalFree"; Source: "00000000-00008204.00000000.91623.001FA000.00000002.mdmp") Found reference to API (Indicator: "CloseHandle"; Source: "00000000-00008204.00000000.91623.001FA000.00000002.mdmp") Found reference to API (Indicator: "WritePrivateProfileStringA"; Source: "00000000-00008204.00000000.91623.001FA000.00000002.mdmp") Found reference to API (Indicator: "IsDBCSLeadByte"; Source: "00000000-00008204.00000000.91623.001FA000.00000002.mdmp") Found reference to API (Indicator: "GetWindowsDirectoryA"; Source: "00000000-00008204.00000000.91623.001FA000.00000002.mdmp") Found reference to API (Indicator: "SetFileAttributesA"; Source: "00000000-00008204.00000000.91623.001FA000.00000002.mdmp") Found reference to API (Indicator: "GetProcAddress"; Source: "00000000-00008204.00000000.91623.001FA000.00000002.mdmp") Found reference to API (Indicator: "GlobalLock"; Source: "00000000-00008204.00000000.91623.001FA000.00000002.mdmp") Found reference to API (Indicator: "LocalFree"; Source: "00000000-00008204.00000000.91623.001FA000.00000002.mdmp") Found reference to API (Indicator: "RemoveDirectoryA"; Source: "00000000-00008204.00000000.91623.001FA000.00000002.mdmp") Found reference to API (Indicator: "FreeLibrary"; Source: "00000000-00008204.00000000.91623.001FA000.00000002.mdmp") Found reference to API (Indicator: "CreateDirectoryA"; Source: "00000000-00008204.00000000.91623.001FA000.00000002.mdmp") Found reference to API (Indicator: "GetPrivateProfileIntA"; Source: "00000000-00008204.00000000.91623.001FA000.00000002.mdmp") Found reference to API (Indicator: "GetPrivateProfileStringA"; Source: "00000000-00008204.00000000.91623.001FA000.00000002.mdmp") Found reference to API (Indicator: "GlobalUnlock"; Source: "00000000-00008204.00000000.91623.001FA000.00000002.mdmp") Found reference to API (Indicator: "ReadFile"; Source: "00000000-00008204.00000000.91623.001FA000.00000002.mdmp") Found reference to API (Indicator: "SizeofResource"; Source: "00000000-00008204.00000000.91623.001FA000.00000002.mdmp") Found reference to API (Indicator: "WriteFile"; Source: "00000000-00008204.00000000.91623.001FA000.00000002.mdmp") Found reference to API (Indicator: "GetDriveTypeA"; Source: "00000000-00008204.00000000.91623.001FA000.00000002.mdmp") Found reference to API (Indicator: "LoadLibraryExA"; Source: "00000000-00008204.00000000.91623.001FA000.00000002.mdmp") Found reference to API (Indicator: "SetFileTime"; Source: "00000000-00008204.00000000.91623.001FA000.00000002.mdmp") Found reference to API (Indicator: "SetFilePointer"; Source: "00000000-00008204.00000000.91623.001FA000.00000002.mdmp") Found reference to API (Indicator: "FindResourceA"; Source: "00000000-00008204.00000000.91623.001FA000.00000002.mdmp") Found reference to API (Indicator: "CreateMutexA"; Source: "00000000-00008204.00000000.91623.001FA000.00000002.mdmp") Found reference to API (Indicator: "GetVolumeInformationA"; Source: "00000000-00008204.00000000.91623.001FA000.00000002.mdmp") Found reference to API (Indicator: "WaitForSingleObject"; Source: "00000000-00008204.00000000.91623.001FA000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentDirectoryA"; Source: "00000000-00008204.00000000.91623.001FA000.00000002.mdmp") Found reference to API (Indicator: "FreeResource"; Source: "00000000-00008204.00000000.91623.001FA000.00000002.mdmp") Found reference to API (Indicator: "GetVersion"; Source: "00000000-00008204.00000000.91623.001FA000.00000002.mdmp") Found reference to API (Indicator: "SetCurrentDirectoryA"; Source: "00000000-00008204.00000000.91623.001FA000.00000002.mdmp") Found reference to API (Indicator: "GetTempPathA"; Source: "00000000-00008204.00000000.91623.001FA000.00000002.mdmp") Found reference to API (Indicator: "LocalFileTimeToFileTime"; Source: "00000000-00008204.00000000.91623.001FA000.00000002.mdmp") Found reference to API (Indicator: "CreateFileA"; Source: "00000000-00008204.00000000.91623.001FA000.00000002.mdmp") Found reference to API (Indicator: "SetEvent"; Source: "00000000-00008204.00000000.91623.001FA000.00000002.mdmp") Found reference to API (Indicator: "TerminateThread"; Source: "00000000-00008204.00000000.91623.001FA000.00000002.mdmp") Found reference to API (Indicator: "GetVersionExA"; Source: "00000000-00008204.00000000.91623.001FA000.00000002.mdmp") Found reference to API (Indicator: "LockResource"; Source: "00000000-00008204.00000000.91623.001FA000.00000002.mdmp") Found reference to API (Indicator: "GetSystemInfo"; Source: "00000000-00008204.00000000.91623.001FA000.00000002.mdmp") Found reference to API (Indicator: "CreateThread"; Source: "00000000-00008204.00000000.91623.001FA000.00000002.mdmp") Found reference to API (Indicator: "ResetEvent"; Source: "00000000-00008204.00000000.91623.001FA000.00000002.mdmp") Found reference to API (Indicator: "LoadResource"; Source: "00000000-00008204.00000000.91623.001FA000.00000002.mdmp") Found reference to API (Indicator: "ExitProcess"; Source: "00000000-00008204.00000000.91623.001FA000.00000002.mdmp") Found reference to API (Indicator: "GetModuleHandleW"; Source: "00000000-00008204.00000000.91623.001FA000.00000002.mdmp") Found reference to API (Indicator: "CreateProcessA"; Source: "00000000-00008204.00000000.91623.001FA000.00000002.mdmp") Found reference to API (Indicator: "FormatMessageA"; Source: "00000000-00008204.00000000.91623.001FA000.00000002.mdmp") Found reference to API (Indicator: "GetTempFileNameA"; Source: "00000000-00008204.00000000.91623.001FA000.00000002.mdmp") Found reference to API (Indicator: "DosDateTimeToFileTime"; Source: "00000000-00008204.00000000.91623.001FA000.00000002.mdmp") Found reference to API (Indicator: "CreateEventA"; Source: "00000000-00008204.00000000.91623.001FA000.00000002.mdmp") Found reference to API (Indicator: "GetExitCodeProcess"; Source: "00000000-00008204.00000000.91623.001FA000.00000002.mdmp") Found reference to API (Indicator: "GetDeviceCaps"; Source: "00000000-00008204.00000000.91623.001FA000.00000002.mdmp") Found reference to API (Indicator: "GetDesktopWindow"; Source: "00000000-00008204.00000000.91623.001FA000.00000002.mdmp") Found reference to API (Indicator: "CharUpperA"; Source: "00000000-00008204.00000000.91623.001FA000.00000002.mdmp") Found reference to API (Indicator: "ExitWindowsEx"; Source: "00000000-00008204.00000000.91623.001FA000.00000002.mdmp") Found reference to API (Indicator: "MessageBeep"; Source: "00000000-00008204.00000000.91623.001FA000.00000002.mdmp") Found reference to API (Indicator: "CharPrevA"; Source: "00000000-00008204.00000000.91623.001FA000.00000002.mdmp") Found reference to API (Indicator: "LoadStringA"; Source: "00000000-00008204.00000000.91623.001FA000.00000002.mdmp") Found reference to API (Indicator: "CharNextA"; Source: "00000000-00008204.00000000.91623.001FA000.00000002.mdmp") Found reference to API (Indicator: "EnableWindow"; Source: "00000000-00008204.00000000.91623.001FA000.00000002.mdmp") Found reference to API (Indicator: "ReleaseDC"; Source: "00000000-00008204.00000000.91623.001FA000.00000002.mdmp") Found reference to API (Indicator: "SetForegroundWindow"; Source: "00000000-00008204.00000000.91623.001FA000.00000002.mdmp") Found reference to API (Indicator: "PeekMessageA"; Source: "00000000-00008204.00000000.91623.001FA000.00000002.mdmp") Found reference to API (Indicator: "SendMessageA"; Source: "00000000-00008204.00000000.91623.001FA000.00000002.mdmp") Found reference to API (Indicator: "MessageBoxA"; Source: "00000000-00008204.00000000.91623.001FA000.00000002.mdmp") Found reference to API (Indicator: "SetWindowTextA"; Source: "00000000-00008204.00000000.91623.001FA000.00000002.mdmp") Found reference to API (Indicator: "GetWindowLongA"; Source: "00000000-00008204.00000000.91623.001FA000.00000002.mdmp") Found reference to API (Indicator: "CallWindowProcA"; Source: "00000000-00008204.00000000.91623.001FA000.00000002.mdmp") Found reference to API (Indicator: "SetWindowLongA"; Source: "00000000-00008204.00000000.91623.001FA000.00000002.mdmp") Found reference to API (Indicator: "ShowWindow"; Source: "00000000-00008204.00000000.91623.001FA000.00000002.mdmp") Found reference to API (Indicator: "MsgWaitForMultipleObjects"; Source: "00000000-00008204.00000000.91623.001FA000.00000002.mdmp") Found reference to API (Indicator: "SetWindowPos"; Source: "00000000-00008204.00000000.91623.001FA000.00000002.mdmp") Found reference to API (Indicator: "GetDC"; Source: "00000000-00008204.00000000.91623.001FA000.00000002.mdmp") Found reference to API (Indicator: "GetWindowRect"; Source: "00000000-00008204.00000000.91623.001FA000.00000002.mdmp") Found reference to API (Indicator: "DispatchMessageA"; Source: "00000000-00008204.00000000.91623.001FA000.00000002.mdmp") Found reference to API (Indicator: "GetFileVersionInfoSizeA"; Source: "00000000-00008204.00000000.91623.001FA000.00000002.mdmp") Found reference to API (Indicator: "VerQueryValueA"; Source: "00000000-00008204.00000000.91623.001FA000.00000002.mdmp") Found reference to API (Indicator: "GetFileVersionInfoA"; Source: "00000000-00008204.00000000.91623.001FA000.00000002.mdmp") Found reference to API (Indicator: "Sleep"; Source: "00000000-00008204.00000000.91623.001FA000.00000002.mdmp") Found reference to API (Indicator: "GetStartupInfoW"; Source: "00000000-00008204.00000000.91623.001FA000.00000002.mdmp") Found reference to API (Indicator: "UnhandledExceptionFilter"; Source: "00000000-00008204.00000000.91623.001FA000.00000002.mdmp") Found reference to API (Indicator: "SetUnhandledExceptionFilter"; Source: "00000000-00008204.00000000.91623.001FA000.00000002.mdmp") Found reference to API (Indicator: "TerminateProcess"; Source: "00000000-00008204.00000000.91623.001FA000.00000002.mdmp") Found reference to API (Indicator: "QueryPerformanceCounter"; Source: "00000000-00008204.00000000.91623.001FA000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcessId"; Source: "00000000-00008204.00000000.91623.001FA000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentThreadId"; Source: "00000000-00008204.00000000.91623.001FA000.00000002.mdmp") Found reference to API (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00008204.00000000.91623.001FA000.00000002.mdmp") Found reference to API (Indicator: "GetTickCount"; Source: "00000000-00008204.00000000.91623.001FA000.00000002.mdmp") Found reference to API (Indicator: "EnumResourceLanguagesA"; Source: "00000000-00008204.00000000.91623.001FA000.00000002.mdmp") Found reference to API (Indicator: "GetDiskFreeSpaceA"; Source: "00000000-00008204.00000000.91623.001FA000.00000002.mdmp") Found reference to API (Indicator: "MulDiv"; Source: "00000000-00008204.00000000.91623.001FA000.00000002.mdmp") Found reference to API (Indicator: "GetSystemMetrics"; Source: "00000000-00008204.00000000.91623.001FA000.00000002.mdmp")3a:T463,Found reference to API "ShellExecuteA" (Indicator: "ShellExecute"; File: "eabd0bd2d942ed6013525df7ffc82dac2e1c7289308952de7dbabe6a03d71e00.exe") Found reference to API "ShellExecuteExW" (Indicator: "ShellExecute"; File: "eabd0bd2d942ed6013525df7ffc82dac2e1c7289308952de7dbabe6a03d71e00.exe") Found reference to API "" (Indicator: "WinExec"; Source: "00000000-00000496.00000000.92449.02F50000.00000004.mdmp, 00000000-00000496.00000002.96288.02F50000.00000004.mdmp") Found reference to API "" (Indicator: "WinExec"; Source: "00000000-00004424.00000000.91567.00E60000.00000004.mdmp, 00000000-00004424.00000002.95407.00E60000.00000004.mdmp") Found reference to API "" (Indicator: "WinExec"; Source: "00000000-00005996.00000001.93593.03350000.00000004.mdmp, 00000000-00005996.00000002.95514.03350000.00000004.mdmp") Found reference to API "" (Indicator: "WinExec"; Source: "00000000-00007476.00000000.91759.02CC0000.00000004.mdmp")3b:Td70,Found reference to API "FreeResource" (Indicator: "FreeResource"; File: "eabd0bd2d942ed6013525df7ffc82dac2e1c7289308952de7dbabe6a03d71e00.exe") Found reference to API "LoadResource" (Indicator: "LoadResource"; File: "eabd0bd2d942ed6013525df7ffc82dac2e1c7289308952de7dbabe6a03d71e00.exe") Found reference to API "LockResource" (Indicator: "LockResource"; File: "eabd0bd2d942ed6013525df7ffc82dac2e1c7289308952de7dbabe6a03d71e00.exe") Found reference to API "SizeofResource" (Indicator: "SizeofResource"; File: "eabd0bd2d942ed6013525df7ffc82dac2e1c7289308952de7dbabe6a03d71e00.exe") Found reference to API "FindResourceA" (Indicator: "FindResource"; File: "eabd0bd2d942ed6013525df7ffc82dac2e1c7289308952de7dbabe6a03d71e00.exe") Found reference to API "FindResourceW" (Indicator: "FindResource"; File: "eabd0bd2d942ed6013525df7ffc82dac2e1c7289308952de7dbabe6a03d71e00.exe") Found reference to API "SizeofResource" (Indicator: "SizeofResource"; Source: "00000000-00004424.00000000.91567.012EA000.00000002.mdmp") Found reference to API "FindResourceA" (Indicator: "FindResource"; Source: "00000000-00004424.00000000.91567.012EA000.00000002.mdmp") Found reference to API "FreeResource" (Indicator: "FreeResource"; Source: "00000000-00004424.00000000.91567.012EA000.00000002.mdmp") Found reference to API "LockResource" (Indicator: "LockResource"; Source: "00000000-00004424.00000000.91567.012EA000.00000002.mdmp") Found reference to API "LoadResource" (Indicator: "LoadResource"; Source: "00000000-00004424.00000000.91567.012EA000.00000002.mdmp") Found reference to API "SizeofResource" (Indicator: "SizeofResource"; Source: "00000000-00005996.00000001.93593.00B9A000.00000002.mdmp") Found reference to API "FindResourceA" (Indicator: "FindResource"; Source: "00000000-00005996.00000001.93593.00B9A000.00000002.mdmp") Found reference to API "FreeResource" (Indicator: "FreeResource"; Source: "00000000-00005996.00000001.93593.00B9A000.00000002.mdmp") Found reference to API "LockResource" (Indicator: "LockResource"; Source: "00000000-00005996.00000001.93593.00B9A000.00000002.mdmp") Found reference to API "LoadResource" (Indicator: "LoadResource"; Source: "00000000-00005996.00000001.93593.00B9A000.00000002.mdmp") Found reference to API "SizeofResource" (Indicator: "SizeofResource"; Source: "00000000-00007476.00000000.91759.0024A000.00000002.mdmp") Found reference to API "FindResourceA" (Indicator: "FindResource"; Source: "00000000-00007476.00000000.91759.0024A000.00000002.mdmp") Found reference to API "FreeResource" (Indicator: "FreeResource"; Source: "00000000-00007476.00000000.91759.0024A000.00000002.mdmp") Found reference to API "LockResource" (Indicator: "LockResource"; Source: "00000000-00007476.00000000.91759.0024A000.00000002.mdmp") Found reference to API "LoadResource" (Indicator: "LoadResource"; Source: "00000000-00007476.00000000.91759.0024A000.00000002.mdmp") Found reference to API "SizeofResource" (Indicator: "SizeofResource"; Source: "00000000-00008204.00000000.91623.001FA000.00000002.mdmp") Found reference to API "FindResourceA" (Indicator: "FindResource"; Source: "00000000-00008204.00000000.91623.001FA000.00000002.mdmp") Found reference to API "FreeResource" (Indicator: "FreeResource"; Source: "00000000-00008204.00000000.91623.001FA000.00000002.mdmp") Found reference to API "LockResource" (Indicator: "LockResource"; Source: "00000000-00008204.00000000.91623.001FA000.00000002.mdmp")3c:Td3a,Found reference to API "" (Indicator: "MoveFile"; Source: "00000000-00000496.00000000.92449.02F50000.00000004.mdmp, 00000000-00000496.00000002.96288.02F50000.00000004.mdmp") Found reference to API "" (Indicator: "MoveFile"; Source: "00000000-00000496.00000000.92449.02F50000.00000004.mdmp, 00000000-00000496.00000002.96288.02F50000.00000004.mdmp") Found reference to API "" (Indicator: "MoveFile"; Source: "00000000-00000496.00000000.92449.02F50000.00000004.mdmp, 00000000-00000496.00000002.96288.02F50000.00000004.mdmp") Found reference to API "" (Indicator: "MoveFile"; Source: "00000000-00000496.00000000.92449.02F50000.00000004.mdmp, 00000000-00000496.00000002.96288.02F50000.00000004.mdmp") Found reference to API "" (Indicator: "MoveFile"; Source: "00000000-00004424.00000000.91567.00E60000.00000004.mdmp, 00000000-00004424.00000002.95407.00E60000.00000004.mdmp") Found reference to API "" (Indicator: "MoveFile"; Source: "00000000-00004424.00000000.91567.00E60000.00000004.mdmp, 00000000-00004424.00000002.95407.00E60000.00000004.mdmp") Found reference to API "" (Indicator: "MoveFile"; Source: "00000000-00004424.00000000.91567.00E60000.00000004.mdmp, 00000000-00004424.00000002.95407.00E60000.00000004.mdmp") Found reference to API "" (Indicator: "MoveFile"; Source: "00000000-00004424.00000000.91567.00E60000.00000004.mdmp, 00000000-00004424.00000002.95407.00E60000.00000004.mdmp") Found reference to API "" (Indicator: "MoveFile"; Source: "00000000-00005996.00000001.93593.03350000.00000004.mdmp, 00000000-00005996.00000002.95514.03350000.00000004.mdmp") Found reference to API "" (Indicator: "MoveFile"; Source: "00000000-00005996.00000001.93593.03350000.00000004.mdmp, 00000000-00005996.00000002.95514.03350000.00000004.mdmp") Found reference to API "" (Indicator: "MoveFile"; Source: "00000000-00005996.00000001.93593.03350000.00000004.mdmp, 00000000-00005996.00000002.95514.03350000.00000004.mdmp") Found reference to API "" (Indicator: "MoveFile"; Source: "00000000-00005996.00000001.93593.03350000.00000004.mdmp, 00000000-00005996.00000002.95514.03350000.00000004.mdmp") Found reference to API "" (Indicator: "MoveFile"; Source: "00000000-00007476.00000000.91759.02CC0000.00000004.mdmp") Found reference to API "" (Indicator: "MoveFile"; Source: "00000000-00007476.00000000.91759.02CC0000.00000004.mdmp") Found reference to API "" (Indicator: "MoveFile"; Source: "00000000-00007476.00000000.91759.02CC0000.00000004.mdmp") Found reference to API "" (Indicator: "MoveFile"; Source: "00000000-00007476.00000000.91759.02CC0000.00000004.mdmp")3d:T46a,Found reference to API "CreateThread" (Indicator: "CreateThread"; File: "eabd0bd2d942ed6013525df7ffc82dac2e1c7289308952de7dbabe6a03d71e00.exe") Found reference to API "GetThreadContext" (Indicator: "GetThreadContext"; File: "eabd0bd2d942ed6013525df7ffc82dac2e1c7289308952de7dbabe6a03d71e00.exe") Found reference to API "SetThreadContext" (Indicator: "SetThreadContext"; File: "eabd0bd2d942ed6013525df7ffc82dac2e1c7289308952de7dbabe6a03d71e00.exe") Found reference to API "ResumeThread" (Indicator: "ResumeThread"; File: "eabd0bd2d942ed6013525df7ffc82dac2e1c7289308952de7dbabe6a03d71e00.exe") Found reference to API "CreateThread" (Indicator: "CreateThread"; Source: "00000000-00004424.00000000.91567.012EA000.00000002.mdmp") Found reference to API "CreateThread" (Indicator: "CreateThread"; Source: "00000000-00005996.00000001.93593.00B9A000.00000002.mdmp") Found reference to API "CreateThread" (Indicator: "CreateThread"; Source: "00000000-00007476.00000000.91759.0024A000.00000002.mdmp") Found reference to API "CreateThread" (Indicator: "CreateThread"; Source: "00000000-00008204.00000000.91623.001FA000.00000002.mdmp")3e:T5ef,Found reference to API "OpenProcessToken" (Indicator: "OpenProcess"; File: "eabd0bd2d942ed6013525df7ffc82dac2e1c7289308952de7dbabe6a03d71e00.exe") file/memory contains long string with (Indicator: "OpenProcess"; File: "eabd0bd2d942ed6013525df7ffc82dac2e1c7289308952de7dbabe6a03d71e00.exe") Found reference to API "GetProcessHeap" (Indicator: "GetProcessHeap"; File: "eabd0bd2d942ed6013525df7ffc82dac2e1c7289308952de7dbabe6a03d71e00.exe") file/memory contains long string with (Indicator: "OpenProcess"; Source: "00000000-00004424.00000000.91567.012EA000.00000002.mdmp") Found reference to API "OpenProcessToken" (Indicator: "OpenProcess"; Source: "00000000-00004424.00000000.91567.012EA000.00000002.mdmp") file/memory contains long string with (Indicator: "OpenProcess"; Source: "00000000-00005996.00000001.93593.00B9A000.00000002.mdmp") Found reference to API "OpenProcessToken" (Indicator: "OpenProcess"; Source: "00000000-00005996.00000001.93593.00B9A000.00000002.mdmp") file/memory contains long string with (Indicator: "OpenProcess"; Source: "00000000-00007476.00000000.91759.0024A000.00000002.mdmp") Found reference to API "OpenProcessToken" (Indicator: "OpenProcess"; Source: "00000000-00007476.00000000.91759.0024A000.00000002.mdmp") file/memory contains long string with (Indicator: "OpenProcess"; Source: "00000000-00008204.00000000.91623.001FA000.00000002.mdmp") Found reference to API "OpenProcessToken" (Indicator: "OpenProcess"; Source: "00000000-00008204.00000000.91623.001FA000.00000002.mdmp")3f:T6b5,"eabd0bd2d942ed6013525df7ffc82dac2e1c7289308952de7dbabe6a03d71e00.exe" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE "se3jY19.exe" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE "ho0Ot26.exe" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE "vm6LM89.exe" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE "kX2gk33.exe" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE "4IL656Nj.exe" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE "5Dy6eL3.exe" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE "2Xd7490.exe" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE "1Ae44GC4.exe" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE40:T627,Observed unmanaged function "DwmIsCompositionEnabled" in "4IL656Nj.exe" Observed unmanaged function "BitBlt" in "4IL656Nj.exe" Observed unmanaged function "CreateRoundRectRgn" in "4IL656Nj.exe" Observed unmanaged function "PathCompactPath" in "4IL656Nj.exe" Observed unmanaged function "ClientToScreen" in "4IL656Nj.exe" Observed unmanaged function "CreateWindowEx" in "4IL656Nj.exe" Observed unmanaged function "DestroyWindow" in "4IL656Nj.exe" Observed unmanaged function "DrawMenuBar" in "4IL656Nj.exe" Observed unmanaged function "FindWindow" in "4IL656Nj.exe" Observed unmanaged function "GetClassName" in "4IL656Nj.exe" Observed unmanaged function "GetClientRect" in "4IL656Nj.exe" Observed unmanaged function "GetCursorPos" in "4IL656Nj.exe" Observed unmanaged function "GetDCEx" in "4IL656Nj.exe" Observed unmanaged function "GetMonitorInfo" in "4IL656Nj.exe" Observed unmanaged function "GetScrollInfo" in "4IL656Nj.exe" Observed unmanaged function "GetSystemMenu" in "4IL656Nj.exe" Observed unmanaged function "GetWindowDC" in "4IL656Nj.exe" Observed unmanaged function "GetWindowLong" in "4IL656Nj.exe" Observed unmanaged function "GetWindowRect" in "4IL656Nj.exe" Observed unmanaged function "GetWindowText" in "4IL656Nj.exe" Observed unmanaged function "InsertMenu" in "4IL656Nj.exe" Observed unmanaged function "InsertMenuItem" in "4IL656Nj.exe" Observed unmanaged function "MonitorFromWindow" in "4IL656Nj.exe" Observed unmanaged function "RegisterHotKey" in "4IL656Nj.exe" Observed unmanaged function "ReleaseCapture" in "4IL656Nj.exe"41:T1ffb,"eabd0bd2d942ed6013525df7ffc82dac2e1c7289308952de7dbabe6a03d71e00.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 770b0000 "eabd0bd2d942ed6013525df7ffc82dac2e1c7289308952de7dbabe6a03d71e00.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 770b0000 "eabd0bd2d942ed6013525df7ffc82dac2e1c7289308952de7dbabe6a03d71e00.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 770b0000 "eabd0bd2d942ed6013525df7ffc82dac2e1c7289308952de7dbabe6a03d71e00.exe" loaded module "KERNEL32" at base 74cc0000 "eabd0bd2d942ed6013525df7ffc82dac2e1c7289308952de7dbabe6a03d71e00.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 736e0000 "eabd0bd2d942ed6013525df7ffc82dac2e1c7289308952de7dbabe6a03d71e00.exe" loaded module "KERNEL32.DLL" at base 74cc0000 "eabd0bd2d942ed6013525df7ffc82dac2e1c7289308952de7dbabe6a03d71e00.exe" loaded module "%WINDIR%\SYSTEM32\ADVAPI32.DLL" at base 77ca0000 "eabd0bd2d942ed6013525df7ffc82dac2e1c7289308952de7dbabe6a03d71e00.exe" loaded module "FECLIENT.DLL" at base 736a0000 "eabd0bd2d942ed6013525df7ffc82dac2e1c7289308952de7dbabe6a03d71e00.exe" loaded module "%WINDIR%\SYSTEM32\ADVPACK.DLL" at base 73670000 "eabd0bd2d942ed6013525df7ffc82dac2e1c7289308952de7dbabe6a03d71e00.exe" loaded module "NTDLL.DLL" at base 77db0000 "eabd0bd2d942ed6013525df7ffc82dac2e1c7289308952de7dbabe6a03d71e00.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 74720000 "se3jY19.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 770b0000 "se3jY19.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 770b0000 "se3jY19.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 770b0000 "se3jY19.exe" loaded module "KERNEL32" at base 74cc0000 "se3jY19.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 736e0000 "se3jY19.exe" loaded module "KERNEL32.DLL" at base 74cc0000 "se3jY19.exe" loaded module "%WINDIR%\SYSTEM32\ADVAPI32.DLL" at base 77ca0000 "se3jY19.exe" loaded module "FECLIENT.DLL" at base 736a0000 "se3jY19.exe" loaded module "%WINDIR%\SYSTEM32\ADVPACK.DLL" at base 73670000 "se3jY19.exe" loaded module "NTDLL.DLL" at base 77db0000 "se3jY19.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 74720000 "ho0Ot26.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 770b0000 "ho0Ot26.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 770b0000 "ho0Ot26.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 770b0000 "ho0Ot26.exe" loaded module "KERNEL32" at base 74cc0000 "ho0Ot26.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 736e0000 "ho0Ot26.exe" loaded module "KERNEL32.DLL" at base 74cc0000 "ho0Ot26.exe" loaded module "%WINDIR%\SYSTEM32\ADVAPI32.DLL" at base 77ca0000 "ho0Ot26.exe" loaded module "FECLIENT.DLL" at base 736a0000 "ho0Ot26.exe" loaded module "%WINDIR%\SYSTEM32\ADVPACK.DLL" at base 73670000 "ho0Ot26.exe" loaded module "NTDLL.DLL" at base 77db0000 "ho0Ot26.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 74720000 "vm6LM89.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 770b0000 "vm6LM89.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 770b0000 "vm6LM89.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 770b0000 "vm6LM89.exe" loaded module "KERNEL32" at base 74cc0000 "vm6LM89.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 736e0000 "vm6LM89.exe" loaded module "KERNEL32.DLL" at base 74cc0000 "vm6LM89.exe" loaded module "%WINDIR%\SYSTEM32\ADVAPI32.DLL" at base 77ca0000 "vm6LM89.exe" loaded module "FECLIENT.DLL" at base 736a0000 "vm6LM89.exe" loaded module "%WINDIR%\SYSTEM32\ADVPACK.DLL" at base 73670000 "vm6LM89.exe" loaded module "NTDLL.DLL" at base 77db0000 "vm6LM89.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 74720000 "kX2gk33.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 770b0000 "kX2gk33.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 770b0000 "kX2gk33.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 770b0000 "kX2gk33.exe" loaded module "KERNEL32" at base 74cc0000 "kX2gk33.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 736e0000 "kX2gk33.exe" loaded module "KERNEL32.DLL" at base 74cc0000 "kX2gk33.exe" loaded module "%WINDIR%\SYSTEM32\ADVAPI32.DLL" at base 77ca0000 "kX2gk33.exe" loaded module "FECLIENT.DLL" at base 736a0000 "kX2gk33.exe" loaded module "%WINDIR%\SYSTEM32\ADVPACK.DLL" at base 73670000 "kX2gk33.exe" loaded module "NTDLL.DLL" at base 77db0000 "kX2gk33.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 74720000 "1Ae44GC4.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 770b0000 "1Ae44GC4.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 770b0000 "1Ae44GC4.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 770b0000 "1Ae44GC4.exe" loaded module "KERNEL32" at base 74cc0000 "1Ae44GC4.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 736e0000 "1Ae44GC4.exe" loaded module "ADVAPI32.DLL" at base 77ca0000 "1Ae44GC4.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\MSCOREEI.DLL" at base 735b0000 "1Ae44GC4.exe" loaded module "SHLWAPI.DLL" at base 75ae0000 "1Ae44GC4.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-2.DLL" at base 759e0000 "1Ae44GC4.exe" loaded module "VERSION.DLL" at base 74670000 "1Ae44GC4.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\CLR.DLL" at base 72e00000 "1Ae44GC4.exe" loaded module "USER32.DLL" at base 77290000 "1Ae44GC4.exe" loaded module "API-MS-WIN-CORE-QUIRKS-L1-1-0.DLL" at base 770b0000 "1Ae44GC4.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\MSCOREE.DLL" at base 0 "1Ae44GC4.exe" loaded module "MSCOREE.DLL" at base 73640000 "1Ae44GC4.exe" loaded module "%WINDIR%\SYSTEM32\COMBASE.DLL" at base 75790000 "1Ae44GC4.exe" loaded module "PSAPI.DLL" at base 74bc0000 "1Ae44GC4.exe" loaded module "RPCRT4.DLL" at base 74ab0000 "1Ae44GC4.exe" loaded module "KERNEL32.DLL" at base 74cc0000 "1Ae44GC4.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\MSCORLIB\36EACCFDE177C2E7B93B8DBDDE4E012A\MSCORLIB.NI.DLL" at base 70b60000 "1Ae44GC4.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\OLE32.DLL" at base 0 "1Ae44GC4.exe" loaded module "OLE32.DLL" at base 74840000 "1Ae44GC4.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\API-MS-WIN-CORE-WINRT-L1-1-0.DLL" at base 0 "1Ae44GC4.exe" loaded module "API-MS-WIN-CORE-WINRT-L1-1-0.DLL" at base 75790000 "1Ae44GC4.exe" loaded module "API-MS-WIN-CORE-XSTATE-L2-1-0.DLL" at base 770b0000 "1Ae44GC4.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\CLRJIT.DLL" at base 72ca0000 "1Ae44GC4.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM\2C3C912EA8F058F9D04C4650128FEB3F\SYSTEM.NI.DLL" at base 70100000 "1Ae44GC4.exe" loaded module "SSPICLI.DLL" at base 747d0000 "1Ae44GC4.exe" loaded module "ADVAPI32" at base 77ca0000 "1Ae44GC4.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM\V4.0_4.0.0.0__B77A5C561934E089\NTDLL.DLL" at base 0 "1Ae44GC4.exe" loaded module "NTDLL.DLL" at base 77db0000 "2Xd7490.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 770b0000 "2Xd7490.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 770b0000 "2Xd7490.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 770b0000 "2Xd7490.exe" loaded module "KERNEL32" at base 74cc0000 "2Xd7490.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 736e0000 "2Xd7490.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-0" at base 770b0000 "2Xd7490.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-2" at base 759e0000 "3PX14vb.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 770b0000 "3PX14vb.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 770b0000 "3PX14vb.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 770b0000 "3PX14vb.exe" loaded module "KERNEL32" at base 74cc0000 "3PX14vb.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 736e0000 "3PX14vb.exe" loaded module "USER32" at base 77290000 "3PX14vb.exe" loaded module "ADVAPI32" at base 77ca0000 "3PX14vb.exe" loaded module "SHELL32" at base 75d7000042:T542,"eabd0bd2d942ed6013525df7ffc82dac2e1c7289308952de7dbabe6a03d71e00.exe" loaded module "%WINDIR%\SysWOW64\bcryptprimitives.dll" at 77C10000 "eabd0bd2d942ed6013525df7ffc82dac2e1c7289308952de7dbabe6a03d71e00.exe" loaded module "%WINDIR%\SysWOW64\bcrypt.dll" at 73B50000 "se3jY19.exe" loaded module "%WINDIR%\SysWOW64\bcryptprimitives.dll" at 77C10000 "se3jY19.exe" loaded module "%WINDIR%\SysWOW64\bcrypt.dll" at 73B50000 "ho0Ot26.exe" loaded module "%WINDIR%\SysWOW64\bcryptprimitives.dll" at 77C10000 "ho0Ot26.exe" loaded module "%WINDIR%\SysWOW64\bcrypt.dll" at 73B50000 "vm6LM89.exe" loaded module "%WINDIR%\SysWOW64\bcryptprimitives.dll" at 77C10000 "vm6LM89.exe" loaded module "%WINDIR%\SysWOW64\bcrypt.dll" at 73B50000 "kX2gk33.exe" loaded module "%WINDIR%\SysWOW64\bcryptprimitives.dll" at 77C10000 "kX2gk33.exe" loaded module "%WINDIR%\SysWOW64\bcrypt.dll" at 73B50000 "1Ae44GC4.exe" loaded module "%WINDIR%\SysWOW64\bcryptprimitives.dll" at 77C10000 "1Ae44GC4.exe" loaded module "%WINDIR%\SysWOW64\bcrypt.dll" at 73B50000 "2Xd7490.exe" loaded module "%WINDIR%\SysWOW64\bcryptprimitives.dll" at 77C10000 "2Xd7490.exe" loaded module "%WINDIR%\SysWOW64\bcrypt.dll" at 73B50000 "3PX14vb.exe" loaded module "%WINDIR%\SysWOW64\bcryptprimitives.dll" at 77C10000 "3PX14vb.exe" loaded module "%WINDIR%\SysWOW64\bcrypt.dll" at 73B5000043:T1137,"eabd0bd2d942ed6013525df7ffc82dac2e1c7289308952de7dbabe6a03d71e00.exe" was detected as "Microsoft Cabinet" and name: "sfx" "eabd0bd2d942ed6013525df7ffc82dac2e1c7289308952de7dbabe6a03d71e00.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "eabd0bd2d942ed6013525df7ffc82dac2e1c7289308952de7dbabe6a03d71e00.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "eabd0bd2d942ed6013525df7ffc82dac2e1c7289308952de7dbabe6a03d71e00.exe" was detected as "Microsoft Cabinet File" and name: "Archive" "eabd0bd2d942ed6013525df7ffc82dac2e1c7289308952de7dbabe6a03d71e00.exe" was detected as "Microsoft Linker" and name: "Linker" "se3jY19.exe" was detected as "Microsoft Cabinet" and name: "sfx" "se3jY19.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "se3jY19.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "se3jY19.exe" was detected as "Microsoft Cabinet File" and name: "Archive" "se3jY19.exe" was detected as "Microsoft Linker" and name: "Linker" "ho0Ot26.exe" was detected as "Microsoft Cabinet" and name: "sfx" "ho0Ot26.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "ho0Ot26.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "ho0Ot26.exe" was detected as "Microsoft Cabinet File" and name: "Archive" "ho0Ot26.exe" was detected as "Microsoft Linker" and name: "Linker" "vm6LM89.exe" was detected as "Microsoft Cabinet" and name: "sfx" "vm6LM89.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "vm6LM89.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "vm6LM89.exe" was detected as "Microsoft Cabinet File" and name: "Archive" "vm6LM89.exe" was detected as "Microsoft Linker" and name: "Linker" "kX2gk33.exe" was detected as "Microsoft Cabinet" and name: "sfx" "kX2gk33.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "kX2gk33.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "kX2gk33.exe" was detected as "Microsoft Cabinet File" and name: "Archive" "kX2gk33.exe" was detected as "Microsoft Linker" and name: "Linker" "4IL656Nj.exe" was detected as "Microsoft Cabinet" and name: "sfx" "4IL656Nj.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "4IL656Nj.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "4IL656Nj.exe" was detected as "Microsoft Cabinet File" and name: "Archive" "4IL656Nj.exe" was detected as "Microsoft Linker" and name: "Linker" "5Dy6eL3.exe" was detected as "Microsoft Cabinet" and name: "sfx" "5Dy6eL3.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "5Dy6eL3.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "5Dy6eL3.exe" was detected as "Microsoft Cabinet File" and name: "Archive" "5Dy6eL3.exe" was detected as "Microsoft Linker" and name: "Linker" "2Xd7490.exe" was detected as "Microsoft Cabinet" and name: "sfx" "2Xd7490.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "2Xd7490.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "2Xd7490.exe" was detected as "Microsoft Cabinet File" and name: "Archive" "2Xd7490.exe" was detected as "Microsoft Linker" and name: "Linker" "6bT2Su1.exe" was detected as "Microsoft Cabinet" and name: "sfx" "6bT2Su1.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "6bT2Su1.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "6bT2Su1.exe" was detected as "Microsoft Cabinet File" and name: "Archive" "6bT2Su1.exe" was detected as "Microsoft Linker" and name: "Linker" "3PX14vb.exe" was detected as "Microsoft Cabinet" and name: "sfx" "3PX14vb.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "3PX14vb.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "3PX14vb.exe" was detected as "Microsoft Cabinet File" and name: "Archive" "3PX14vb.exe" was detected as "Microsoft Linker" and name: "Linker" "1Ae44GC4.exe" was detected as "Microsoft Cabinet" and name: "sfx" "1Ae44GC4.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "1Ae44GC4.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "1Ae44GC4.exe" was detected as "Microsoft Cabinet File" and name: "Archive" "1Ae44GC4.exe" was detected as "Microsoft Linker" and name: "Linker"44:T1cff,"eabd0bd2d942ed6013525df7ffc82dac2e1c7289308952de7dbabe6a03d71e00.exe" file has an entrypoint instructions - "call 0x407155,jmp 0x406a6a,push 0x58,push 0x4072b8,call 0x407208,xor ebx, ebx,mov dword ptr [ebp - 0x20], ebx,lea eax, [ebp - 0x68],push eax,call dword ptr [0x40a184],mov dword ptr [ebp - 4], ebx,mov eax, dword ptr fs:[0x18],mov esi, dword ptr [eax + 4],mov edi, ebx,mov edx, 0x4088ac,mov ecx, esi,xor eax, eax,lock cmpxchg dword ptr [edx], ecx,test eax, eax,je 0x406abc,cmp eax, esi,jne 0x406aaf,xor esi, esi,inc esi,mov edi, esi,jmp 0x406abf,push 0x3e8,call dword ptr [0x40a188],jmp 0x406a93,xor esi, esi,inc esi," "se3jY19.exe" file has an entrypoint instructions - "call 0x407155,jmp 0x406a6a,push 0x58,push 0x4072b8,call 0x407208,xor ebx, ebx,mov dword ptr [ebp - 0x20], ebx,lea eax, [ebp - 0x68],push eax,call dword ptr [0x40a184],mov dword ptr [ebp - 4], ebx,mov eax, dword ptr fs:[0x18],mov esi, dword ptr [eax + 4],mov edi, ebx,mov edx, 0x4088ac,mov ecx, esi,xor eax, eax,lock cmpxchg dword ptr [edx], ecx,test eax, eax,je 0x406abc,cmp eax, esi,jne 0x406aaf,xor esi, esi,inc esi,mov edi, esi,jmp 0x406abf,push 0x3e8,call dword ptr [0x40a188],jmp 0x406a93,xor esi, esi,inc esi," "ho0Ot26.exe" file has an entrypoint instructions - "call 0x407155,jmp 0x406a6a,push 0x58,push 0x4072b8,call 0x407208,xor ebx, ebx,mov dword ptr [ebp - 0x20], ebx,lea eax, [ebp - 0x68],push eax,call dword ptr [0x40a184],mov dword ptr [ebp - 4], ebx,mov eax, dword ptr fs:[0x18],mov esi, dword ptr [eax + 4],mov edi, ebx,mov edx, 0x4088ac,mov ecx, esi,xor eax, eax,lock cmpxchg dword ptr [edx], ecx,test eax, eax,je 0x406abc,cmp eax, esi,jne 0x406aaf,xor esi, esi,inc esi,mov edi, esi,jmp 0x406abf,push 0x3e8,call dword ptr [0x40a188],jmp 0x406a93,xor esi, esi,inc esi," "vm6LM89.exe" file has an entrypoint instructions - "call 0x407155,jmp 0x406a6a,push 0x58,push 0x4072b8,call 0x407208,xor ebx, ebx,mov dword ptr [ebp - 0x20], ebx,lea eax, [ebp - 0x68],push eax,call dword ptr [0x40a184],mov dword ptr [ebp - 4], ebx,mov eax, dword ptr fs:[0x18],mov esi, dword ptr [eax + 4],mov edi, ebx,mov edx, 0x4088ac,mov ecx, esi,xor eax, eax,lock cmpxchg dword ptr [edx], ecx,test eax, eax,je 0x406abc,cmp eax, esi,jne 0x406aaf,xor esi, esi,inc esi,mov edi, esi,jmp 0x406abf,push 0x3e8,call dword ptr [0x40a188],jmp 0x406a93,xor esi, esi,inc esi," "kX2gk33.exe" file has an entrypoint instructions - "call 0x407155,jmp 0x406a6a,push 0x58,push 0x4072b8,call 0x407208,xor ebx, ebx,mov dword ptr [ebp - 0x20], ebx,lea eax, [ebp - 0x68],push eax,call dword ptr [0x40a184],mov dword ptr [ebp - 4], ebx,mov eax, dword ptr fs:[0x18],mov esi, dword ptr [eax + 4],mov edi, ebx,mov edx, 0x4088ac,mov ecx, esi,xor eax, eax,lock cmpxchg dword ptr [edx], ecx,test eax, eax,je 0x406abc,cmp eax, esi,jne 0x406aaf,xor esi, esi,inc esi,mov edi, esi,jmp 0x406abf,push 0x3e8,call dword ptr [0x40a188],jmp 0x406a93,xor esi, esi,inc esi," "4IL656Nj.exe" file has an entrypoint instructions - "jmp dword ptr [0x402000],add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al," "5Dy6eL3.exe" file has an entrypoint instructions - "call 0x414888,jmp 0x41427f,jmp 0x4186fa,push ebp,mov ebp, esp,sub esp, 0x324,push ebx,push 0x17,call 0x4273e3,test eax, eax,je 0x41442a,mov ecx, dword ptr [ebp + 8],int 0x29,push 3,call 0x4145d7,mov dword ptr [esp], 0x2cc,lea eax, [ebp - 0x324],push 0,push eax,call 0x414ec0,add esp, 0xc,mov dword ptr [ebp - 0x274], eax,mov dword ptr [ebp - 0x278], ecx,mov dword ptr [ebp - 0x27c], edx,mov dword ptr [ebp - 0x280], ebx," "2Xd7490.exe" file has an entrypoint instructions - "call 0x4014e9,jmp 0x4010c5,push ebp,mov ebp, esp,mov eax, dword ptr [ebp + 8],push esi,mov ecx, dword ptr [eax + 0x3c],add ecx, eax,movzx eax, word ptr [ecx + 0x14],lea edx, [ecx + 0x18],add edx, eax,movzx eax, word ptr [ecx + 6],imul esi, eax, 0x28,add esi, edx,cmp edx, esi,je 0x401286,mov ecx, dword ptr [ebp + 0xc],cmp ecx, dword ptr [edx + 0xc],jb 0x40127f,mov eax, dword ptr [edx + 8],add eax, dword ptr [edx + 0xc],cmp ecx, eax,jb 0x40128b,add edx, 0x28,cmp edx, esi,jne 0x401270,xor eax, eax,pop esi,pop ebp,ret ,mov eax, edx,jmp 0x401288,push esi,call 0x401a29,test eax, eax,je 0x4012b9,mov eax, dword ptr fs:[0x18],mov esi, 0x42bd74," "6bT2Su1.exe" file has an entrypoint instructions - "push 0xac,push 0,push 0x418010,call 0x405070,add esp, 0xc,push 0,call 0x405076,mov dword ptr [0x418014], eax,push 0,push 0x1000,push 0,call 0x40507c,mov dword ptr [0x418010], eax,call 0x405000,mov eax, 0x417088,mov dword ptr [0x418034], eax,call 0x40de30,call 0x40dba1,call 0x40aaa0,call 0x40a329," "3PX14vb.exe" file has an entrypoint instructions - "call 0x403249,jne 0x40324f,je 0x40324f,mov esp, 0x241c8b55,add esp, 4,jmp 0x403261,inc eax,sub ebx, 0x3249,jmp 0x403265,and ch, bl,cmc ,inc eax,and dh, byte ptr [ebp + eax + 0x75],add ecx, dword ptr [esi - 0x49],jecxz 0x4032d7,xor byte ptr [ebp + 5], dh,je 0x403275,sbb ebp, dword ptr [esi + 0x6eb5abe],dec esp,sub eax, eax,jmp 0x403282,sub bl, ch,stc ,dec esp,sub bl, ch,add eax, 0xf1928a88,mov byte ptr [ebx + eax + 2], ah,je 0x403295,jne 0x403295,cmp bl, dh,fcomp qword ptr [ebp + edx*8 + 0xa4b0ff],add byte ptr [eax], al,jne 0x4032a1,je 0x4032a1,jne 0x403255,add esp, 4,mov ecx, dword ptr [esp - 4]," "1Ae44GC4.exe" file has an entrypoint instructions - "jmp dword ptr [0x402000],add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,"45:T75a,"eabd0bd2d942ed6013525df7ffc82dac2e1c7289308952de7dbabe6a03d71e00.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EMPTY") "eabd0bd2d942ed6013525df7ffc82dac2e1c7289308952de7dbabe6a03d71e00.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "eabd0bd2d942ed6013525df7ffc82dac2e1c7289308952de7dbabe6a03d71e00.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "se3jY19.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EMPTY") "se3jY19.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "se3jY19.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "ho0Ot26.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EMPTY") "ho0Ot26.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "ho0Ot26.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "vm6LM89.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EMPTY") "vm6LM89.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "vm6LM89.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "kX2gk33.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EMPTY") "kX2gk33.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "kX2gk33.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "1Ae44GC4.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EMPTY") "1Ae44GC4.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "1Ae44GC4.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "1Ae44GC4.exe" (Path: "HKCU\CONTROL PANEL\INTERNATIONAL"; Key: "LOCALENAME")46:Tb1c,Observed system executable string:"1,"fusion","GAC",01,"WinRT","NotApp",13,"System Version=4.0.0.0 Culture=neutral PublicKeyToken=b77a5c561934e089","C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\System\2c3c912ea8f058f9d04c4650128feb3f\System.ni.dll",0" [Source: 1Ae44GC4.exe.log] Observed system executable string:"%WINDIR%\system32\advapi32.dll" [Source: 00000000-00004424-00000C29-434366148] Observed system executable string:"%WINDIR%\system32\advpack.dll" [Source: 00000000-00004424-00000C29-434465970] Observed system executable string:"rundll32.exe %WINDIR%\system32\advpack.dll,DelNodeRunDLL32 "%TEMP%\IXP000.TMP\"" [Source: 00000000-00004424-00000BC1-434505762] Observed system executable string:"rundll32.exe %WINDIR%\system32\advpack.dll,DelNodeRunDLL32 "%TEMP%\IXP001.TMP\"" [Source: 00000000-00008204-00000BC1-435276194] Observed system executable string:"rundll32.exe %WINDIR%\system32\advpack.dll,DelNodeRunDLL32 "%TEMP%\IXP002.TMP\"" [Source: 00000000-00005996-00000BC1-435973594] Observed system executable string:"rundll32.exe %WINDIR%\system32\advpack.dll,DelNodeRunDLL32 "%TEMP%\IXP003.TMP\"" [Source: 00000000-00008540-00000BC1-436664958] Observed system executable string:"rundll32.exe %WINDIR%\system32\advpack.dll,DelNodeRunDLL32 "%TEMP%\IXP004.TMP\"" [Source: 00000000-00007476-00000BC1-437383406] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll" [Source: 00000000-00007224-00000C29-438177488] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\clr.dll" [Source: 00000000-00007224-00000C29-438628329] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoree.dll" [Source: 00000000-00007224-00000C29-438786525] Observed system executable string:"%WINDIR%\system32\combase.dll" [Source: 00000000-00007224-00000C29-438897181] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\mscorlib\36eaccfde177c2e7b93b8dbdde4e012a\mscorlib.ni.dll" [Source: 00000000-00007224-00000C29-439253125] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\ole32.dll" [Source: 00000000-00007224-00000C29-439309965] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll" [Source: 00000000-00007224-00000C29-439400469] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\clrjit.dll" [Source: 00000000-00007224-00000C29-439514443] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System\2c3c912ea8f058f9d04c4650128feb3f\System.ni.dll" [Source: 00000000-00007224-00000C29-439593678] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll" [Source: 00000000-00007224-00000C29-440311243]47:T672,Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; File: "eabd0bd2d942ed6013525df7ffc82dac2e1c7289308952de7dbabe6a03d71e00.exe") Found reference to API "LoadLibraryExA" (Indicator: "LoadLibrary"; File: "eabd0bd2d942ed6013525df7ffc82dac2e1c7289308952de7dbabe6a03d71e00.exe") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; File: "eabd0bd2d942ed6013525df7ffc82dac2e1c7289308952de7dbabe6a03d71e00.exe") Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; File: "eabd0bd2d942ed6013525df7ffc82dac2e1c7289308952de7dbabe6a03d71e00.exe") Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; Source: "00000000-00004424.00000000.91567.012EA000.00000002.mdmp") Found reference to API "LoadLibraryExA" (Indicator: "LoadLibrary"; Source: "00000000-00004424.00000000.91567.012EA000.00000002.mdmp") Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; Source: "00000000-00005996.00000001.93593.00B9A000.00000002.mdmp") Found reference to API "LoadLibraryExA" (Indicator: "LoadLibrary"; Source: "00000000-00005996.00000001.93593.00B9A000.00000002.mdmp") Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; Source: "00000000-00007476.00000000.91759.0024A000.00000002.mdmp") Found reference to API "LoadLibraryExA" (Indicator: "LoadLibrary"; Source: "00000000-00007476.00000000.91759.0024A000.00000002.mdmp") Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; Source: "00000000-00008204.00000000.91623.001FA000.00000002.mdmp") Found reference to API "LoadLibraryExA" (Indicator: "LoadLibrary"; Source: "00000000-00008204.00000000.91623.001FA000.00000002.mdmp")48:T699,"se3jY19.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP000.TMP\se3jY19.exe]- [targetUID: 00000000-00004424] "ho0Ot26.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP001.TMP\ho0Ot26.exe]- [targetUID: 00000000-00005996] "vm6LM89.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP002.TMP\vm6LM89.exe]- [targetUID: 00000000-00008540] "kX2gk33.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP003.TMP\kX2gk33.exe]- [targetUID: 00000000-00008540] "4IL656Nj.exe" has type "PE32 executable (GUI) Intel 80386 Mono/.Net assembly for MS Windows"- Location: [%TEMP%\IXP002.TMP\4IL656Nj.exe]- [targetUID: 00000000-00005996] "5Dy6eL3.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP001.TMP\5Dy6eL3.exe]- [targetUID: 00000000-00008204] "2Xd7490.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP004.TMP\2Xd7490.exe]- [targetUID: 00000000-00007892] "6bT2Su1.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP000.TMP\6bT2Su1.exe]- [targetUID: 00000000-00004424] "3PX14vb.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP003.TMP\3PX14vb.exe]- [targetUID: 00000000-00008540] "1Ae44GC4.exe" has type "PE32 executable (GUI) Intel 80386 Mono/.Net assembly for MS Windows"- Location: [%TEMP%\IXP004.TMP\1Ae44GC4.exe]- [targetUID: 00000000-00007476] "1Ae44GC4.exe.log" has type "CSV text"- Location: [%LOCALAPPDATA%\Microsoft\CLR_v4.0_32\UsageLogs\1Ae44GC4.exe.log]- [targetUID: 00000000-00007224]49:T7aa,"eabd0bd2d942ed6013525df7ffc82dac2e1c7289308952de7dbabe6a03d71e00.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER\SEGMENT HEAP"; Key: ""; Value: "") "eabd0bd2d942ed6013525df7ffc82dac2e1c7289308952de7dbabe6a03d71e00.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: ""; Value: "") "eabd0bd2d942ed6013525df7ffc82dac2e1c7289308952de7dbabe6a03d71e00.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WOW64\X86"; Key: ""; Value: "") "eabd0bd2d942ed6013525df7ffc82dac2e1c7289308952de7dbabe6a03d71e00.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SAFEBOOT\OPTION"; Key: ""; Value: "") "eabd0bd2d942ed6013525df7ffc82dac2e1c7289308952de7dbabe6a03d71e00.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SRP\GP\DLL"; Key: ""; Value: "") "eabd0bd2d942ed6013525df7ffc82dac2e1c7289308952de7dbabe6a03d71e00.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "eabd0bd2d942ed6013525df7ffc82dac2e1c7289308952de7dbabe6a03d71e00.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "eabd0bd2d942ed6013525df7ffc82dac2e1c7289308952de7dbabe6a03d71e00.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\FILESYSTEM"; Key: ""; Value: "") "eabd0bd2d942ed6013525df7ffc82dac2e1c7289308952de7dbabe6a03d71e00.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS"; Key: ""; Value: "") "eabd0bd2d942ed6013525df7ffc82dac2e1c7289308952de7dbabe6a03d71e00.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\SHELL FOLDERS"; Key: ""; Value: "") "eabd0bd2d942ed6013525df7ffc82dac2e1c7289308952de7dbabe6a03d71e00.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: ""; Value: "")4a:Tf15,"eabd0bd2d942ed6013525df7ffc82dac2e1c7289308952de7dbabe6a03d71e00.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "RESOURCEPOLICIES"; Value: "") "eabd0bd2d942ed6013525df7ffc82dac2e1c7289308952de7dbabe6a03d71e00.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WOW64\X86"; Key: "EABD0BD2D942ED6013525DF7FFC82DAC2E1C7289308952DE7DBABE6A03D71E00.EXE"; Value: "") "eabd0bd2d942ed6013525df7ffc82dac2e1c7289308952de7dbabe6a03d71e00.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WOW64\X86"; Key: ""; Value: "") "eabd0bd2d942ed6013525df7ffc82dac2e1c7289308952de7dbabe6a03d71e00.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED"; Value: "") "eabd0bd2d942ed6013525df7ffc82dac2e1c7289308952de7dbabe6a03d71e00.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\FILESYSTEM"; Key: "LONGPATHSENABLED"; Value: "") "eabd0bd2d942ed6013525df7ffc82dac2e1c7289308952de7dbabe6a03d71e00.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS"; Key: "LOGFLAGS"; Value: "") "eabd0bd2d942ed6013525df7ffc82dac2e1c7289308952de7dbabe6a03d71e00.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS"; Key: "SHOWDEBUGINFO"; Value: "") "eabd0bd2d942ed6013525df7ffc82dac2e1c7289308952de7dbabe6a03d71e00.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\SHELL FOLDERS"; Key: "CACHE"; Value: "") "eabd0bd2d942ed6013525df7ffc82dac2e1c7289308952de7dbabe6a03d71e00.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EMPTY"; Value: "") "eabd0bd2d942ed6013525df7ffc82dac2e1c7289308952de7dbabe6a03d71e00.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LANGUAGE"; Key: "INSTALLLANGUAGEFALLBACK"; Value: "") "eabd0bd2d942ed6013525df7ffc82dac2e1c7289308952de7dbabe6a03d71e00.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\MUI\UILANGUAGES\EN-US"; Key: "TYPE"; Value: "") "eabd0bd2d942ed6013525df7ffc82dac2e1c7289308952de7dbabe6a03d71e00.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\MUI\UILANGUAGES\EN-US"; Key: "ALTERNATECODEPAGE"; Value: "") "eabd0bd2d942ed6013525df7ffc82dac2e1c7289308952de7dbabe6a03d71e00.exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP"; Key: "PREFERREDUILANGUAGES"; Value: "") "eabd0bd2d942ed6013525df7ffc82dac2e1c7289308952de7dbabe6a03d71e00.exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP\MUICACHED"; Key: "MACHINEPREFERREDUILANGUAGES"; Value: "") "eabd0bd2d942ed6013525df7ffc82dac2e1c7289308952de7dbabe6a03d71e00.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: ""; Value: "") "eabd0bd2d942ed6013525df7ffc82dac2e1c7289308952de7dbabe6a03d71e00.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA\FIPSALGORITHMPOLICY"; Key: "ENABLED"; Value: "") "eabd0bd2d942ed6013525df7ffc82dac2e1c7289308952de7dbabe6a03d71e00.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA"; Key: "FIPSALGORITHMPOLICY"; Value: "") "eabd0bd2d942ed6013525df7ffc82dac2e1c7289308952de7dbabe6a03d71e00.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA\FIPSALGORITHMPOLICY"; Key: "MDMENABLED"; Value: "") "eabd0bd2d942ed6013525df7ffc82dac2e1c7289308952de7dbabe6a03d71e00.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE"; Key: "PAGEALLOCATORUSESYSTEMHEAP"; Value: "") "eabd0bd2d942ed6013525df7ffc82dac2e1c7289308952de7dbabe6a03d71e00.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE"; Key: "PAGEALLOCATORSYSTEMHEAPISPRIVATE"; Value: "")4b:T518,"eabd0bd2d942ed6013525df7ffc82dac2e1c7289308952de7dbabe6a03d71e00.exe" trying to touch file "C:\Windows\System32\WOW64LOG.DLL" "eabd0bd2d942ed6013525df7ffc82dac2e1c7289308952de7dbabe6a03d71e00.exe" trying to touch file "C:\Windows\SysWOW64\apphelp.dll" "eabd0bd2d942ed6013525df7ffc82dac2e1c7289308952de7dbabe6a03d71e00.exe" trying to touch file "C:\eabd0bd2d942ed6013525df7ffc82dac2e1c7289308952de7dbabe6a03d71e00.exe" "eabd0bd2d942ed6013525df7ffc82dac2e1c7289308952de7dbabe6a03d71e00.exe" trying to touch file "C:\Windows\SysWOW64\ntdll.dll" "eabd0bd2d942ed6013525df7ffc82dac2e1c7289308952de7dbabe6a03d71e00.exe" trying to touch file "C:\Windows\SysWOW64\kernel32.dll" "eabd0bd2d942ed6013525df7ffc82dac2e1c7289308952de7dbabe6a03d71e00.exe" trying to touch file "C:\Windows\SysWOW64\KernelBase.dll" "eabd0bd2d942ed6013525df7ffc82dac2e1c7289308952de7dbabe6a03d71e00.exe" trying to touch file "C:\Windows\apppatch\sysmain.sdb" "eabd0bd2d942ed6013525df7ffc82dac2e1c7289308952de7dbabe6a03d71e00.exe" trying to touch file "C:\Windows\SysWOW64\AcLayers.dll" "eabd0bd2d942ed6013525df7ffc82dac2e1c7289308952de7dbabe6a03d71e00.exe" trying to touch file "C:\Windows\SysWOW64\mpr.dll" "eabd0bd2d942ed6013525df7ffc82dac2e1c7289308952de7dbabe6a03d71e00.exe" trying to touch file "C:\Windows\SysWOW64\sfc.dll"4c:Tbc2,"eabd0bd2d942ed6013525df7ffc82dac2e1c7289308952de7dbabe6a03d71e00.exe" trying to access non-existent file "C:\Windows\System32\WOW64LOG.DLL" "eabd0bd2d942ed6013525df7ffc82dac2e1c7289308952de7dbabe6a03d71e00.exe" trying to access non-existent file "C:\CABINET.DLL" "eabd0bd2d942ed6013525df7ffc82dac2e1c7289308952de7dbabe6a03d71e00.exe" trying to access non-existent file "C:\VERSION.DLL" "eabd0bd2d942ed6013525df7ffc82dac2e1c7289308952de7dbabe6a03d71e00.exe" trying to access non-existent file "C:\FLTLIB.DLL" "eabd0bd2d942ed6013525df7ffc82dac2e1c7289308952de7dbabe6a03d71e00.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP\SE3JY19.EXE" "eabd0bd2d942ed6013525df7ffc82dac2e1c7289308952de7dbabe6a03d71e00.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP\se3jY19.exe" "eabd0bd2d942ed6013525df7ffc82dac2e1c7289308952de7dbabe6a03d71e00.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP\6BT2SU1.EXE" "eabd0bd2d942ed6013525df7ffc82dac2e1c7289308952de7dbabe6a03d71e00.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP\6bT2Su1.exe" "se3jY19.exe" trying to access non-existent file "C:\Windows\System32\WOW64LOG.DLL" "se3jY19.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP\CABINET.DLL" "se3jY19.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP\VERSION.DLL" "se3jY19.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP\FLTLIB.DLL" "se3jY19.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP001.TMP\HO0OT26.EXE" "se3jY19.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP001.TMP\ho0Ot26.exe" "se3jY19.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP001.TMP\5DY6EL3.EXE" "se3jY19.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP001.TMP\5Dy6eL3.exe" "ho0Ot26.exe" trying to access non-existent file "C:\Windows\System32\WOW64LOG.DLL" "ho0Ot26.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP001.TMP\CABINET.DLL" "ho0Ot26.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP001.TMP\VERSION.DLL" "ho0Ot26.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP001.TMP\FLTLIB.DLL" "ho0Ot26.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP002.TMP\VM6LM89.EXE" "ho0Ot26.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP002.TMP\vm6LM89.exe" "ho0Ot26.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP002.TMP\4IL656NJ.EXE" "ho0Ot26.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP002.TMP\4IL656Nj.exe" "vm6LM89.exe" trying to access non-existent file "C:\Windows\System32\WOW64LOG.DLL"4d:T5ed,"eabd0bd2d942ed6013525df7ffc82dac2e1c7289308952de7dbabe6a03d71e00.exe" trying to access non-existent file "C:\EABD0BD2D942ED6013525DF7FFC82DAC2E1C7289308952DE7DBABE6A03D71E00.EXE.LOCAL" "eabd0bd2d942ed6013525df7ffc82dac2e1c7289308952de7dbabe6a03d71e00.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP" "se3jY19.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP\SE3JY19.EXE.LOCAL" "se3jY19.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP001.TMP" "ho0Ot26.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP001.TMP\HO0OT26.EXE.LOCAL" "ho0Ot26.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP002.TMP" "vm6LM89.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP002.TMP\VM6LM89.EXE.LOCAL" "vm6LM89.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP003.TMP" "kX2gk33.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP003.TMP\KX2GK33.EXE.LOCAL" "kX2gk33.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP004.TMP" "1Ae44GC4.exe" trying to access non-existent file "C:\Windows\SysWOW64\MSCOREE.DLL.LOCAL" "1Ae44GC4.exe" trying to access non-existent file "C:\WINDOWS\SYSTEM32\MSCOREE.DLL.local" "1Ae44GC4.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP004.TMP\1AE44GC4.EXE.CONFIG"4e:T418,Found reference to API "HttpSendRequestA" (Indicator: "HttpSendRequest"; File: "eabd0bd2d942ed6013525df7ffc82dac2e1c7289308952de7dbabe6a03d71e00.exe") Found reference to API "InternetOpenUrlA" (Indicator: "InternetOpen"; File: "eabd0bd2d942ed6013525df7ffc82dac2e1c7289308952de7dbabe6a03d71e00.exe") Found reference to API "InternetReadFile" (Indicator: "InternetReadFile"; File: "eabd0bd2d942ed6013525df7ffc82dac2e1c7289308952de7dbabe6a03d71e00.exe") Found reference to API "InternetOpenA" (Indicator: "InternetOpen"; File: "eabd0bd2d942ed6013525df7ffc82dac2e1c7289308952de7dbabe6a03d71e00.exe") Found reference to API "InternetConnectA" (Indicator: "InternetConnect"; File: "eabd0bd2d942ed6013525df7ffc82dac2e1c7289308952de7dbabe6a03d71e00.exe") Found reference to API "HttpOpenRequestA" (Indicator: "HttpOpenRequest"; File: "eabd0bd2d942ed6013525df7ffc82dac2e1c7289308952de7dbabe6a03d71e00.exe") Found reference to API "InternetOpenW" (Indicator: "InternetOpen"; File: "eabd0bd2d942ed6013525df7ffc82dac2e1c7289308952de7dbabe6a03d71e00.exe")4f:T914,"kX2gk33.exe" called "FindFirstFileA" with parameter %TEMP%\IXP004.TMP\* (UID: 00000000-00007476) "kX2gk33.exe" called "FindNextFileA" with parameter .. (UID: 00000000-00007476) "1Ae44GC4.exe" called "FindFirstFileW" with parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll (UID: 00000000-00007224) "1Ae44GC4.exe" called "FindFirstFileW" with parameter %WINDIR%\Microsoft.NET\Framework\\* (UID: 00000000-00007224) "1Ae44GC4.exe" called "FindNextFileW" with parameter .. (UID: 00000000-00007224) "1Ae44GC4.exe" called "FindNextFileW" with parameter NETFXSBS10.exe (UID: 00000000-00007224) "1Ae44GC4.exe" called "FindNextFileW" with parameter netfxsbs12.hkf (UID: 00000000-00007224) "1Ae44GC4.exe" called "FindNextFileW" with parameter sbscmp10.dll (UID: 00000000-00007224) "1Ae44GC4.exe" called "FindNextFileW" with parameter sbscmp20_mscorwks.dll (UID: 00000000-00007224) "1Ae44GC4.exe" called "FindNextFileW" with parameter sbscmp20_perfcounter.dll (UID: 00000000-00007224) "1Ae44GC4.exe" called "FindNextFileW" with parameter sbs_diasymreader.dll (UID: 00000000-00007224) "1Ae44GC4.exe" called "FindNextFileW" with parameter sbs_iehost.dll (UID: 00000000-00007224) "1Ae44GC4.exe" called "FindNextFileW" with parameter sbs_microsoft.jscript.dll (UID: 00000000-00007224) "1Ae44GC4.exe" called "FindNextFileW" with parameter sbs_microsoft.vsa.vb.codedomprocessor.dll (UID: 00000000-00007224) "1Ae44GC4.exe" called "FindNextFileW" with parameter sbs_mscordbi.dll (UID: 00000000-00007224) "1Ae44GC4.exe" called "FindNextFileW" with parameter sbs_mscorrc.dll (UID: 00000000-00007224) "1Ae44GC4.exe" called "FindNextFileW" with parameter sbs_mscorsec.dll (UID: 00000000-00007224) "1Ae44GC4.exe" called "FindNextFileW" with parameter sbs_system.configuration.install.dll (UID: 00000000-00007224) "1Ae44GC4.exe" called "FindNextFileW" with parameter sbs_system.data.dll (UID: 00000000-00007224) "1Ae44GC4.exe" called "FindNextFileW" with parameter sbs_system.enterpriseservices.dll (UID: 00000000-00007224) "1Ae44GC4.exe" called "FindNextFileW" with parameter sbs_VsaVb7rt.dll (UID: 00000000-00007224) "1Ae44GC4.exe" called "FindNextFileW" with parameter sbs_wminet_utils.dll (UID: 00000000-00007224) "1Ae44GC4.exe" called "FindNextFileW" with parameter SharedReg12.dll (UID: 00000000-00007224)50:Tc47,Found reference to API "GetDesktopWindow" (Indicator: "GetDesktopWindow"; File: "eabd0bd2d942ed6013525df7ffc82dac2e1c7289308952de7dbabe6a03d71e00.exe") Found reference to API "GetDC" (Indicator: "GetDC"; File: "eabd0bd2d942ed6013525df7ffc82dac2e1c7289308952de7dbabe6a03d71e00.exe") Found reference to API "" (Indicator: "GetDC"; Source: "00000000-00000496.00000000.92449.02F50000.00000004.mdmp, 00000000-00000496.00000002.96288.02F50000.00000004.mdmp") Found reference to API "" (Indicator: "GetDC"; Source: "00000000-00000496.00000000.92449.02F50000.00000004.mdmp, 00000000-00000496.00000002.96288.02F50000.00000004.mdmp") Found reference to API "" (Indicator: "GetWindowDC"; Source: "00000000-00000496.00000000.92449.02F50000.00000004.mdmp, 00000000-00000496.00000002.96288.02F50000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00000496.00000000.92449.02F50000.00000004.mdmp, 00000000-00000496.00000002.96288.02F50000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00000496.00000000.92449.02F50000.00000004.mdmp, 00000000-00000496.00000002.96288.02F50000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleBitmap"; Source: "00000000-00000496.00000000.92449.02F50000.00000004.mdmp, 00000000-00000496.00000002.96288.02F50000.00000004.mdmp") Found reference to API "" (Indicator: "BitBlt"; Source: "00000000-00000496.00000000.92449.02F50000.00000004.mdmp, 00000000-00000496.00000002.96288.02F50000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleDC"; Source: "00000000-00000496.00000000.92449.02F50000.00000004.mdmp, 00000000-00000496.00000002.96288.02F50000.00000004.mdmp") Found reference to API "GetDesktopWindow" (Indicator: "GetDesktopWindow"; Source: "00000000-00004424.00000000.91567.012EA000.00000002.mdmp") Found reference to API "GetDC" (Indicator: "GetDC"; Source: "00000000-00004424.00000000.91567.012EA000.00000002.mdmp") Found reference to API "GetDesktopWindow" (Indicator: "GetDesktopWindow"; Source: "00000000-00005996.00000001.93593.00B9A000.00000002.mdmp") Found reference to API "GetDC" (Indicator: "GetDC"; Source: "00000000-00005996.00000001.93593.00B9A000.00000002.mdmp") Found reference to API "GetDesktopWindow" (Indicator: "GetDesktopWindow"; Source: "00000000-00007476.00000000.91759.0024A000.00000002.mdmp") Found reference to API "GetDC" (Indicator: "GetDC"; Source: "00000000-00007476.00000000.91759.0024A000.00000002.mdmp") Found reference to API "GetDesktopWindow" (Indicator: "GetDesktopWindow"; Source: "00000000-00008204.00000000.91623.001FA000.00000002.mdmp") Found reference to API "GetDC" (Indicator: "GetDC"; Source: "00000000-00008204.00000000.91623.001FA000.00000002.mdmp")51:T68c,Found reference to API "FindNextFileA" (Indicator: "FindNextFile"; File: "eabd0bd2d942ed6013525df7ffc82dac2e1c7289308952de7dbabe6a03d71e00.exe") Found reference to API "FindFirstFileA" (Indicator: "FindFirstFile"; File: "eabd0bd2d942ed6013525df7ffc82dac2e1c7289308952de7dbabe6a03d71e00.exe") Found reference to API "FindFirstFileExW" (Indicator: "FindFirstFile"; File: "eabd0bd2d942ed6013525df7ffc82dac2e1c7289308952de7dbabe6a03d71e00.exe") Found reference to API "FindNextFileW" (Indicator: "FindNextFile"; File: "eabd0bd2d942ed6013525df7ffc82dac2e1c7289308952de7dbabe6a03d71e00.exe") Found reference to API "FindFirstFileA" (Indicator: "FindFirstFile"; Source: "00000000-00004424.00000000.91567.012EA000.00000002.mdmp") Found reference to API "FindNextFileA" (Indicator: "FindNextFile"; Source: "00000000-00004424.00000000.91567.012EA000.00000002.mdmp") Found reference to API "FindFirstFileA" (Indicator: "FindFirstFile"; Source: "00000000-00005996.00000001.93593.00B9A000.00000002.mdmp") Found reference to API "FindNextFileA" (Indicator: "FindNextFile"; Source: "00000000-00005996.00000001.93593.00B9A000.00000002.mdmp") Found reference to API "FindFirstFileA" (Indicator: "FindFirstFile"; Source: "00000000-00007476.00000000.91759.0024A000.00000002.mdmp") Found reference to API "FindNextFileA" (Indicator: "FindNextFile"; Source: "00000000-00007476.00000000.91759.0024A000.00000002.mdmp") Found reference to API "FindFirstFileA" (Indicator: "FindFirstFile"; Source: "00000000-00008204.00000000.91623.001FA000.00000002.mdmp") Found reference to API "FindNextFileA" (Indicator: "FindNextFile"; Source: "00000000-00008204.00000000.91623.001FA000.00000002.mdmp")52:Tb72,Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; File: "eabd0bd2d942ed6013525df7ffc82dac2e1c7289308952de7dbabe6a03d71e00.exe") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; File: "eabd0bd2d942ed6013525df7ffc82dac2e1c7289308952de7dbabe6a03d71e00.exe") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; File: "eabd0bd2d942ed6013525df7ffc82dac2e1c7289308952de7dbabe6a03d71e00.exe") Found reference to API "GetEnvironmentStringsW" (Indicator: "GetEnvironmentStrings"; File: "eabd0bd2d942ed6013525df7ffc82dac2e1c7289308952de7dbabe6a03d71e00.exe") Found reference to API "GetModuleHandleExW" (Indicator: "GetModuleHandle"; File: "eabd0bd2d942ed6013525df7ffc82dac2e1c7289308952de7dbabe6a03d71e00.exe") Found reference to API "GetModuleHandleA" (Indicator: "GetModuleHandle"; File: "eabd0bd2d942ed6013525df7ffc82dac2e1c7289308952de7dbabe6a03d71e00.exe") Found reference to API "775141492,6064,3119,,CreateToolhelp32Snapshot,kernel32.dll,"00:23:59.875",RX=0,PX=0" (Indicator: "CreateToolhelp32Snapshot"; Source: "00000000-00000496.00000000.92449.02F50000.00000004.mdmp, 00000000-00000496.00000002.96288.02F50000.00000004.mdmp") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; Source: "00000000-00004424.00000000.91567.012EA000.00000002.mdmp") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00004424.00000000.91567.012EA000.00000002.mdmp") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; Source: "00000000-00004424.00000000.91567.012EA000.00000002.mdmp") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; Source: "00000000-00005996.00000001.93593.00B9A000.00000002.mdmp") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00005996.00000001.93593.00B9A000.00000002.mdmp") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; Source: "00000000-00005996.00000001.93593.00B9A000.00000002.mdmp") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; Source: "00000000-00007476.00000000.91759.0024A000.00000002.mdmp") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00007476.00000000.91759.0024A000.00000002.mdmp") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; Source: "00000000-00007476.00000000.91759.0024A000.00000002.mdmp") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; Source: "00000000-00008204.00000000.91623.001FA000.00000002.mdmp") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00008204.00000000.91623.001FA000.00000002.mdmp") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; Source: "00000000-00008204.00000000.91623.001FA000.00000002.mdmp")53:Tef6,Found reference to API "RegQueryInfoKeyA" (Indicator: "RegQueryInfoKey"; File: "eabd0bd2d942ed6013525df7ffc82dac2e1c7289308952de7dbabe6a03d71e00.exe") Found reference to API "RegOpenKeyExA" (Indicator: "RegOpenKey"; File: "eabd0bd2d942ed6013525df7ffc82dac2e1c7289308952de7dbabe6a03d71e00.exe") Found reference to API "RegQueryValueExA" (Indicator: "RegQueryValue"; File: "eabd0bd2d942ed6013525df7ffc82dac2e1c7289308952de7dbabe6a03d71e00.exe") Found reference to API "" (Indicator: "RegOpenKey"; Source: "00000000-00000496.00000000.92449.02F50000.00000004.mdmp, 00000000-00000496.00000002.96288.02F50000.00000004.mdmp") Found reference to API "" (Indicator: "RegOpenKey"; Source: "00000000-00000496.00000000.92449.02F50000.00000004.mdmp, 00000000-00000496.00000002.96288.02F50000.00000004.mdmp") Found reference to API "" (Indicator: "RegOpenKey"; Source: "00000000-00004424.00000000.91567.00E60000.00000004.mdmp, 00000000-00004424.00000002.95407.00E60000.00000004.mdmp") Found reference to API "" (Indicator: "RegOpenKey"; Source: "00000000-00004424.00000000.91567.00E60000.00000004.mdmp, 00000000-00004424.00000002.95407.00E60000.00000004.mdmp") Found reference to API "RegOpenKeyExA" (Indicator: "RegOpenKey"; Source: "00000000-00004424.00000000.91567.012EA000.00000002.mdmp") Found reference to API "RegQueryInfoKeyA" (Indicator: "RegQueryInfoKey"; Source: "00000000-00004424.00000000.91567.012EA000.00000002.mdmp") Found reference to API "RegQueryValueExA" (Indicator: "RegQueryValue"; Source: "00000000-00004424.00000000.91567.012EA000.00000002.mdmp") Found reference to API "RegOpenKeyExA" (Indicator: "RegOpenKey"; Source: "00000000-00005996.00000001.93593.00B9A000.00000002.mdmp") Found reference to API "RegQueryInfoKeyA" (Indicator: "RegQueryInfoKey"; Source: "00000000-00005996.00000001.93593.00B9A000.00000002.mdmp") Found reference to API "RegQueryValueExA" (Indicator: "RegQueryValue"; Source: "00000000-00005996.00000001.93593.00B9A000.00000002.mdmp") Found reference to API "" (Indicator: "RegOpenKey"; Source: "00000000-00005996.00000001.93593.03350000.00000004.mdmp, 00000000-00005996.00000002.95514.03350000.00000004.mdmp") Found reference to API "" (Indicator: "RegOpenKey"; Source: "00000000-00005996.00000001.93593.03350000.00000004.mdmp, 00000000-00005996.00000002.95514.03350000.00000004.mdmp") Found reference to API "RegOpenKeyExA" (Indicator: "RegOpenKey"; Source: "00000000-00007476.00000000.91759.0024A000.00000002.mdmp") Found reference to API "RegQueryInfoKeyA" (Indicator: "RegQueryInfoKey"; Source: "00000000-00007476.00000000.91759.0024A000.00000002.mdmp") Found reference to API "RegQueryValueExA" (Indicator: "RegQueryValue"; Source: "00000000-00007476.00000000.91759.0024A000.00000002.mdmp") Found reference to API "" (Indicator: "RegOpenKey"; Source: "00000000-00007476.00000000.91759.02CC0000.00000004.mdmp") Found reference to API "" (Indicator: "RegOpenKey"; Source: "00000000-00007476.00000000.91759.02CC0000.00000004.mdmp") Found reference to API "RegOpenKeyExA" (Indicator: "RegOpenKey"; Source: "00000000-00008204.00000000.91623.001FA000.00000002.mdmp") Found reference to API "RegQueryInfoKeyA" (Indicator: "RegQueryInfoKey"; Source: "00000000-00008204.00000000.91623.001FA000.00000002.mdmp") Found reference to API "RegQueryValueExA" (Indicator: "RegQueryValue"; Source: "00000000-00008204.00000000.91623.001FA000.00000002.mdmp")54:T87f,Found reference to API "GetProcAddress" (Indicator: "GetProcAddress"; File: "eabd0bd2d942ed6013525df7ffc82dac2e1c7289308952de7dbabe6a03d71e00.exe") Found reference to API "Error loading %shGetProcAddress() failed on function '%s'. Possible reason: incorrect version of advpack.dll being used./Windows 95 or Windows NT is required to install" (Indicator: "GetProcAddress"; File: "eabd0bd2d942ed6013525df7ffc82dac2e1c7289308952de7dbabe6a03d71e00.exe") Found reference to API "Error loading %shGetProcAddress() failed on function '%s'. Possible reason: incorrect version of advpack.dll being used./Windows 95 or Windows NT is required to install" (Indicator: "GetProcAddress"; Source: "00000000-00004424.00000000.91567.012EA000.00000002.mdmp") Found reference to API "GetProcAddress" (Indicator: "GetProcAddress"; Source: "00000000-00004424.00000000.91567.012EA000.00000002.mdmp") Found reference to API "Error loading %shGetProcAddress() failed on function '%s'. Possible reason: incorrect version of advpack.dll being used./Windows 95 or Windows NT is required to install" (Indicator: "GetProcAddress"; Source: "00000000-00005996.00000001.93593.00B9A000.00000002.mdmp") Found reference to API "GetProcAddress" (Indicator: "GetProcAddress"; Source: "00000000-00005996.00000001.93593.00B9A000.00000002.mdmp") Found reference to API "Error loading %shGetProcAddress() failed on function '%s'. Possible reason: incorrect version of advpack.dll being used./Windows 95 or Windows NT is required to install" (Indicator: "GetProcAddress"; Source: "00000000-00007476.00000000.91759.0024A000.00000002.mdmp") Found reference to API "GetProcAddress" (Indicator: "GetProcAddress"; Source: "00000000-00007476.00000000.91759.0024A000.00000002.mdmp") Found reference to API "Error loading %shGetProcAddress() failed on function '%s'. Possible reason: incorrect version of advpack.dll being used./Windows 95 or Windows NT is required to install" (Indicator: "GetProcAddress"; Source: "00000000-00008204.00000000.91623.001FA000.00000002.mdmp") Found reference to API "GetProcAddress" (Indicator: "GetProcAddress"; Source: "00000000-00008204.00000000.91623.001FA000.00000002.mdmp")55:T1086,Found reference to API "GetTempPathA" (Indicator: "GetTempPath"; File: "eabd0bd2d942ed6013525df7ffc82dac2e1c7289308952de7dbabe6a03d71e00.exe") Found reference to API "GetTempFileNameA" (Indicator: "GetTempFileName"; File: "eabd0bd2d942ed6013525df7ffc82dac2e1c7289308952de7dbabe6a03d71e00.exe") Found reference to API "GetCurrentDirectoryA" (Indicator: "GetCurrentDirectory"; File: "eabd0bd2d942ed6013525df7ffc82dac2e1c7289308952de7dbabe6a03d71e00.exe") Found reference to API "GetFileAttributesA" (Indicator: "GetFileAttributes"; File: "eabd0bd2d942ed6013525df7ffc82dac2e1c7289308952de7dbabe6a03d71e00.exe") Found reference to API "GetSystemDirectoryA" (Indicator: "GetSystemDirectory"; File: "eabd0bd2d942ed6013525df7ffc82dac2e1c7289308952de7dbabe6a03d71e00.exe") Found reference to API "GetFileVersionInfoSizeA" (Indicator: "GetFileVersionInfo"; File: "eabd0bd2d942ed6013525df7ffc82dac2e1c7289308952de7dbabe6a03d71e00.exe") Found reference to API "GetFileVersionInfoSizeA" (Indicator: "GetFileVersionInfoSize"; File: "eabd0bd2d942ed6013525df7ffc82dac2e1c7289308952de7dbabe6a03d71e00.exe") Found reference to API "GetFileVersionInfoA" (Indicator: "GetFileVersionInfo"; File: "eabd0bd2d942ed6013525df7ffc82dac2e1c7289308952de7dbabe6a03d71e00.exe") Found reference to API "GetFileInformationByHandle" (Indicator: "GetFileInformationByHandle"; File: "eabd0bd2d942ed6013525df7ffc82dac2e1c7289308952de7dbabe6a03d71e00.exe") Found reference to API "GetCurrentDirectoryW" (Indicator: "GetCurrentDirectory"; File: "eabd0bd2d942ed6013525df7ffc82dac2e1c7289308952de7dbabe6a03d71e00.exe") Found reference to API "GetTempFileNameW" (Indicator: "GetTempFileName"; File: "eabd0bd2d942ed6013525df7ffc82dac2e1c7289308952de7dbabe6a03d71e00.exe") Found reference to API "GetSystemDirectoryW" (Indicator: "GetSystemDirectory"; File: "eabd0bd2d942ed6013525df7ffc82dac2e1c7289308952de7dbabe6a03d71e00.exe") Found reference to API "GetTempPathW" (Indicator: "GetTempPath"; File: "eabd0bd2d942ed6013525df7ffc82dac2e1c7289308952de7dbabe6a03d71e00.exe") Found reference to API "GetFileAttributesA" (Indicator: "GetFileAttributes"; Source: "00000000-00004424.00000000.91567.012EA000.00000002.mdmp") Found reference to API "GetSystemDirectoryA" (Indicator: "GetSystemDirectory"; Source: "00000000-00004424.00000000.91567.012EA000.00000002.mdmp") Found reference to API "GetCurrentDirectoryA" (Indicator: "GetCurrentDirectory"; Source: "00000000-00004424.00000000.91567.012EA000.00000002.mdmp") Found reference to API "GetTempPathA" (Indicator: "GetTempPath"; Source: "00000000-00004424.00000000.91567.012EA000.00000002.mdmp") Found reference to API "GetTempFileNameA" (Indicator: "GetTempFileName"; Source: "00000000-00004424.00000000.91567.012EA000.00000002.mdmp") Found reference to API "GetFileVersionInfoSizeA" (Indicator: "GetFileVersionInfo"; Source: "00000000-00004424.00000000.91567.012EA000.00000002.mdmp") Found reference to API "GetFileVersionInfoSizeA" (Indicator: "GetFileVersionInfoSize"; Source: "00000000-00004424.00000000.91567.012EA000.00000002.mdmp") Found reference to API "GetFileVersionInfoA" (Indicator: "GetFileVersionInfo"; Source: "00000000-00004424.00000000.91567.012EA000.00000002.mdmp") Found reference to API "GetFileAttributesA" (Indicator: "GetFileAttributes"; Source: "00000000-00005996.00000001.93593.00B9A000.00000002.mdmp") Found reference to API "GetSystemDirectoryA" (Indicator: "GetSystemDirectory"; Source: "00000000-00005996.00000001.93593.00B9A000.00000002.mdmp") Found reference to API "GetCurrentDirectoryA" (Indicator: "GetCurrentDirectory"; Source: "00000000-00005996.00000001.93593.00B9A000.00000002.mdmp") Found reference to API "GetTempPathA" (Indicator: "GetTempPath"; Source: "00000000-00005996.00000001.93593.00B9A000.00000002.mdmp") Found reference to API "GetTempFileNameA" (Indicator: "GetTempFileName"; Source: "00000000-00005996.00000001.93593.00B9A000.00000002.mdmp") Found reference to API "GetFileVersionInfoSizeA" (Indicator: "GetFileVersionInfo"; Source: "00000000-00005996.00000001.93593.00B9A000.00000002.mdmp") Found reference to API "GetFileVersionInfoSizeA" (Indicator: "GetFileVersionInfoSize"; Source: "00000000-00005996.00000001.93593.00B9A000.00000002.mdmp")56:T9a7,Found reference to API "OpenProcessToken" (Indicator: "OpenProcessToken"; File: "eabd0bd2d942ed6013525df7ffc82dac2e1c7289308952de7dbabe6a03d71e00.exe") Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; File: "eabd0bd2d942ed6013525df7ffc82dac2e1c7289308952de7dbabe6a03d71e00.exe") file/memory contains long string with (Indicator: "OpenProcessToken"; File: "eabd0bd2d942ed6013525df7ffc82dac2e1c7289308952de7dbabe6a03d71e00.exe") Found reference to API "LookupAccountNameA" (Indicator: "LookupAccountName"; File: "eabd0bd2d942ed6013525df7ffc82dac2e1c7289308952de7dbabe6a03d71e00.exe") Found reference to API "GetUserNameA" (Indicator: "GetUserName"; File: "eabd0bd2d942ed6013525df7ffc82dac2e1c7289308952de7dbabe6a03d71e00.exe") file/memory contains long string with (Indicator: "OpenProcessToken"; Source: "00000000-00004424.00000000.91567.012EA000.00000002.mdmp") Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; Source: "00000000-00004424.00000000.91567.012EA000.00000002.mdmp") Found reference to API "OpenProcessToken" (Indicator: "OpenProcessToken"; Source: "00000000-00004424.00000000.91567.012EA000.00000002.mdmp") file/memory contains long string with (Indicator: "OpenProcessToken"; Source: "00000000-00005996.00000001.93593.00B9A000.00000002.mdmp") Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; Source: "00000000-00005996.00000001.93593.00B9A000.00000002.mdmp") Found reference to API "OpenProcessToken" (Indicator: "OpenProcessToken"; Source: "00000000-00005996.00000001.93593.00B9A000.00000002.mdmp") file/memory contains long string with (Indicator: "OpenProcessToken"; Source: "00000000-00007476.00000000.91759.0024A000.00000002.mdmp") Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; Source: "00000000-00007476.00000000.91759.0024A000.00000002.mdmp") Found reference to API "OpenProcessToken" (Indicator: "OpenProcessToken"; Source: "00000000-00007476.00000000.91759.0024A000.00000002.mdmp") file/memory contains long string with (Indicator: "OpenProcessToken"; Source: "00000000-00008204.00000000.91623.001FA000.00000002.mdmp") Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; Source: "00000000-00008204.00000000.91623.001FA000.00000002.mdmp") Found reference to API "OpenProcessToken" (Indicator: "OpenProcessToken"; Source: "00000000-00008204.00000000.91623.001FA000.00000002.mdmp")57:T76a,Found string "OpenProcessToken" (Indicator: "OpenProcess"; File: "eabd0bd2d942ed6013525df7ffc82dac2e1c7289308952de7dbabe6a03d71e00.exe") file/memory contains long string with (Indicator: "OpenProcess"; File: "eabd0bd2d942ed6013525df7ffc82dac2e1c7289308952de7dbabe6a03d71e00.exe") file/memory contains long string with (Indicator: "OpenProcess"; File: "vm6LM89.exe") file/memory contains long string with (Indicator: "OpenProcess"; File: "kX2gk33.exe") file/memory contains long string with (Indicator: "OpenProcess"; File: "1Ae44GC4.exe") Found string "OpenProcessTokenW" (Indicator: "OpenProcess"; Source: "00000000-00007224-00000C2A-440306589") Found string "OpenProcess" (Indicator: "OpenProcess"; Source: "00000000-00007224-00000C2A-440439316") Found string "OpenProcessW" (Indicator: "OpenProcess"; Source: "00000000-00007224-00000C2A-440439366") file/memory contains long string with (Indicator: "OpenProcess"; Source: "00000000-00004424.00000000.91567.012EA000.00000002.mdmp") Found string "OpenProcessToken" (Indicator: "OpenProcess"; Source: "00000000-00004424.00000000.91567.012EA000.00000002.mdmp") file/memory contains long string with (Indicator: "OpenProcess"; Source: "00000000-00005996.00000001.93593.00B9A000.00000002.mdmp") Found string "OpenProcessToken" (Indicator: "OpenProcess"; Source: "00000000-00005996.00000001.93593.00B9A000.00000002.mdmp") file/memory contains long string with (Indicator: "OpenProcess"; Source: "00000000-00007476.00000000.91759.0024A000.00000002.mdmp") Found string "OpenProcessToken" (Indicator: "OpenProcess"; Source: "00000000-00007476.00000000.91759.0024A000.00000002.mdmp") file/memory contains long string with (Indicator: "OpenProcess"; Source: "00000000-00008204.00000000.91623.001FA000.00000002.mdmp") Found string "OpenProcessToken" (Indicator: "OpenProcess"; Source: "00000000-00008204.00000000.91623.001FA000.00000002.mdmp")58:T711,Found string ":\WINDOWS\system32\DRIVERS" (Indicator: "system32\drivers"; Source: "00000000-00000496.00000000.92449.02F50000.00000004.mdmp, 00000000-00000496.00000002.96288.02F50000.00000004.mdmp") Found string ":\WINDOWS\system32\DriverStore\FileRepository" (Indicator: "system32\drivers"; Source: "00000000-00000496.00000000.92449.02F50000.00000004.mdmp, 00000000-00000496.00000002.96288.02F50000.00000004.mdmp") Found string ":\WINDOWS\system32\DriverStore\FileRepository" (Indicator: "system32\drivers"; Source: "00000000-00004424.00000000.91567.00E60000.00000004.mdmp, 00000000-00004424.00000002.95407.00E60000.00000004.mdmp") Found string ":\WINDOWS\system32\DRIVERS" (Indicator: "system32\drivers"; Source: "00000000-00004424.00000000.91567.00E60000.00000004.mdmp, 00000000-00004424.00000002.95407.00E60000.00000004.mdmp") Found string "\Device\HarddiskVolume2\eabd0bd2d942ed6013525df7ffc82dac2e1c7289308952de7dbabe6a03d71e00.exe" (Indicator: "\Device\"; Source: "00000000-00004424.00000000.91567.00E60000.00000004.mdmp, 00000000-00004424.00000002.95407.00E60000.00000004.mdmp") Found string ":\WINDOWS\system32\DriverStore\FileRepository" (Indicator: "system32\drivers"; Source: "00000000-00005996.00000001.93593.03350000.00000004.mdmp, 00000000-00005996.00000002.95514.03350000.00000004.mdmp") Found string ":\WINDOWS\system32\DRIVERS" (Indicator: "system32\drivers"; Source: "00000000-00005996.00000001.93593.03350000.00000004.mdmp, 00000000-00005996.00000002.95514.03350000.00000004.mdmp") Found string ":\WINDOWS\system32\DriverStore\FileRepository" (Indicator: "system32\drivers"; Source: "00000000-00007476.00000000.91759.02CC0000.00000004.mdmp") Found string ":\WINDOWS\system32\DRIVERS" (Indicator: "system32\drivers"; Source: "00000000-00007476.00000000.91759.02CC0000.00000004.mdmp")59:Td40,Found reference to API "RemoveDirectoryA" (Indicator: "RemoveDirectory"; File: "eabd0bd2d942ed6013525df7ffc82dac2e1c7289308952de7dbabe6a03d71e00.exe") Found reference to API "DeleteFileA" (Indicator: "DeleteFile"; File: "eabd0bd2d942ed6013525df7ffc82dac2e1c7289308952de7dbabe6a03d71e00.exe") Found reference to API "DeleteFileW" (Indicator: "DeleteFile"; File: "eabd0bd2d942ed6013525df7ffc82dac2e1c7289308952de7dbabe6a03d71e00.exe") Found reference to API "RemoveDirectoryW" (Indicator: "RemoveDirectory"; File: "eabd0bd2d942ed6013525df7ffc82dac2e1c7289308952de7dbabe6a03d71e00.exe") Found reference to API "" (Indicator: "DeleteFile"; Source: "00000000-00000496.00000000.92449.02F50000.00000004.mdmp, 00000000-00000496.00000002.96288.02F50000.00000004.mdmp") Found reference to API "" (Indicator: "DeleteFile"; Source: "00000000-00000496.00000000.92449.02F50000.00000004.mdmp, 00000000-00000496.00000002.96288.02F50000.00000004.mdmp") Found reference to API "" (Indicator: "DeleteFile"; Source: "00000000-00004424.00000000.91567.00E60000.00000004.mdmp, 00000000-00004424.00000002.95407.00E60000.00000004.mdmp") Found reference to API "" (Indicator: "DeleteFile"; Source: "00000000-00004424.00000000.91567.00E60000.00000004.mdmp, 00000000-00004424.00000002.95407.00E60000.00000004.mdmp") Found reference to API "DeleteFileA" (Indicator: "DeleteFile"; Source: "00000000-00004424.00000000.91567.012EA000.00000002.mdmp") Found reference to API "RemoveDirectoryA" (Indicator: "RemoveDirectory"; Source: "00000000-00004424.00000000.91567.012EA000.00000002.mdmp") Found reference to API "DeleteFileA" (Indicator: "DeleteFile"; Source: "00000000-00005996.00000001.93593.00B9A000.00000002.mdmp") Found reference to API "RemoveDirectoryA" (Indicator: "RemoveDirectory"; Source: "00000000-00005996.00000001.93593.00B9A000.00000002.mdmp") Found reference to API "" (Indicator: "DeleteFile"; Source: "00000000-00005996.00000001.93593.03350000.00000004.mdmp, 00000000-00005996.00000002.95514.03350000.00000004.mdmp") Found reference to API "" (Indicator: "DeleteFile"; Source: "00000000-00005996.00000001.93593.03350000.00000004.mdmp, 00000000-00005996.00000002.95514.03350000.00000004.mdmp") Found reference to API "DeleteFileA" (Indicator: "DeleteFile"; Source: "00000000-00007476.00000000.91759.0024A000.00000002.mdmp") Found reference to API "RemoveDirectoryA" (Indicator: "RemoveDirectory"; Source: "00000000-00007476.00000000.91759.0024A000.00000002.mdmp") Found reference to API "" (Indicator: "DeleteFile"; Source: "00000000-00007476.00000000.91759.02CC0000.00000004.mdmp") Found reference to API "" (Indicator: "DeleteFile"; Source: "00000000-00007476.00000000.91759.02CC0000.00000004.mdmp") Found reference to API "DeleteFileA" (Indicator: "DeleteFile"; Source: "00000000-00008204.00000000.91623.001FA000.00000002.mdmp") Found reference to API "RemoveDirectoryA" (Indicator: "RemoveDirectory"; Source: "00000000-00008204.00000000.91623.001FA000.00000002.mdmp")5a:T9b6,Found reference to API "RegDeleteValueA" (Indicator: "RegDeleteValue"; File: "eabd0bd2d942ed6013525df7ffc82dac2e1c7289308952de7dbabe6a03d71e00.exe") Found reference to API "" (Indicator: "RegDeleteValue"; Source: "00000000-00000496.00000000.92449.02F50000.00000004.mdmp, 00000000-00000496.00000002.96288.02F50000.00000004.mdmp") Found reference to API "" (Indicator: "RegDeleteValue"; Source: "00000000-00000496.00000000.92449.02F50000.00000004.mdmp, 00000000-00000496.00000002.96288.02F50000.00000004.mdmp") Found reference to API "" (Indicator: "RegDeleteValue"; Source: "00000000-00004424.00000000.91567.00E60000.00000004.mdmp, 00000000-00004424.00000002.95407.00E60000.00000004.mdmp") Found reference to API "" (Indicator: "RegDeleteValue"; Source: "00000000-00004424.00000000.91567.00E60000.00000004.mdmp, 00000000-00004424.00000002.95407.00E60000.00000004.mdmp") Found reference to API "RegDeleteValueA" (Indicator: "RegDeleteValue"; Source: "00000000-00004424.00000000.91567.012EA000.00000002.mdmp") Found reference to API "RegDeleteValueA" (Indicator: "RegDeleteValue"; Source: "00000000-00005996.00000001.93593.00B9A000.00000002.mdmp") Found reference to API "" (Indicator: "RegDeleteValue"; Source: "00000000-00005996.00000001.93593.03350000.00000004.mdmp, 00000000-00005996.00000002.95514.03350000.00000004.mdmp") Found reference to API "" (Indicator: "RegDeleteValue"; Source: "00000000-00005996.00000001.93593.03350000.00000004.mdmp, 00000000-00005996.00000002.95514.03350000.00000004.mdmp") Found reference to API "RegDeleteValueA" (Indicator: "RegDeleteValue"; Source: "00000000-00007476.00000000.91759.0024A000.00000002.mdmp") Found reference to API "" (Indicator: "RegDeleteValue"; Source: "00000000-00007476.00000000.91759.02CC0000.00000004.mdmp") Found reference to API "" (Indicator: "RegDeleteValue"; Source: "00000000-00007476.00000000.91759.02CC0000.00000004.mdmp") Found reference to API "RegDeleteValueA" (Indicator: "RegDeleteValue"; Source: "00000000-00008204.00000000.91623.001FA000.00000002.mdmp")5b:Td93,Found reference to API "LookupPrivilegeValueA" (Indicator: "LookupPrivilegeValue"; File: "eabd0bd2d942ed6013525df7ffc82dac2e1c7289308952de7dbabe6a03d71e00.exe") Found reference to API "AdjustTokenPrivileges" (Indicator: "AdjustTokenPrivileges"; File: "eabd0bd2d942ed6013525df7ffc82dac2e1c7289308952de7dbabe6a03d71e00.exe") Found reference to API "CheckTokenMembership" (Indicator: "CheckTokenMembership"; File: "eabd0bd2d942ed6013525df7ffc82dac2e1c7289308952de7dbabe6a03d71e00.exe") Found reference to API "SeShutdownPrivilege" (Indicator: "SeShutdownPrivilege"; File: "eabd0bd2d942ed6013525df7ffc82dac2e1c7289308952de7dbabe6a03d71e00.exe") file/memory contains long string with (Indicator: "AdjustTokenPrivileges"; File: "eabd0bd2d942ed6013525df7ffc82dac2e1c7289308952de7dbabe6a03d71e00.exe") file/memory contains long string with (Indicator: "AdjustTokenPrivileges"; Source: "00000000-00004424.00000000.91567.012EA000.00000002.mdmp") Found reference to API "LookupPrivilegeValueA" (Indicator: "LookupPrivilegeValue"; Source: "00000000-00004424.00000000.91567.012EA000.00000002.mdmp") Found reference to API "AdjustTokenPrivileges" (Indicator: "AdjustTokenPrivileges"; Source: "00000000-00004424.00000000.91567.012EA000.00000002.mdmp") Found reference to API "CheckTokenMembership" (Indicator: "CheckTokenMembership"; Source: "00000000-00004424.00000002.95407.012E1000.00000020.mdmp") Found reference to API "SeShutdownPrivilege" (Indicator: "SeShutdownPrivilege"; Source: "00000000-00004424.00000002.95407.012E1000.00000020.mdmp") Found reference to API "CheckTokenMembership" (Indicator: "CheckTokenMembership"; Source: "00000000-00005996.00000000.91672.00B91000.00000020.mdmp") Found reference to API "SeShutdownPrivilege" (Indicator: "SeShutdownPrivilege"; Source: "00000000-00005996.00000000.91672.00B91000.00000020.mdmp") file/memory contains long string with (Indicator: "AdjustTokenPrivileges"; Source: "00000000-00005996.00000001.93593.00B9A000.00000002.mdmp") Found reference to API "LookupPrivilegeValueA" (Indicator: "LookupPrivilegeValue"; Source: "00000000-00005996.00000001.93593.00B9A000.00000002.mdmp") Found reference to API "AdjustTokenPrivileges" (Indicator: "AdjustTokenPrivileges"; Source: "00000000-00005996.00000001.93593.00B9A000.00000002.mdmp") Found reference to API "CheckTokenMembership" (Indicator: "CheckTokenMembership"; Source: "00000000-00007476.00000000.91759.00241000.00000020.mdmp") Found reference to API "SeShutdownPrivilege" (Indicator: "SeShutdownPrivilege"; Source: "00000000-00007476.00000000.91759.00241000.00000020.mdmp") file/memory contains long string with (Indicator: "AdjustTokenPrivileges"; Source: "00000000-00007476.00000000.91759.0024A000.00000002.mdmp") Found reference to API "LookupPrivilegeValueA" (Indicator: "LookupPrivilegeValue"; Source: "00000000-00007476.00000000.91759.0024A000.00000002.mdmp") Found reference to API "AdjustTokenPrivileges" (Indicator: "AdjustTokenPrivileges"; Source: "00000000-00007476.00000000.91759.0024A000.00000002.mdmp") file/memory contains long string with (Indicator: "AdjustTokenPrivileges"; Source: "00000000-00008204.00000000.91623.001FA000.00000002.mdmp") Found reference to API "LookupPrivilegeValueA" (Indicator: "LookupPrivilegeValue"; Source: "00000000-00008204.00000000.91623.001FA000.00000002.mdmp") Found reference to API "AdjustTokenPrivileges" (Indicator: "AdjustTokenPrivileges"; Source: "00000000-00008204.00000000.91623.001FA000.00000002.mdmp")5c:Taa0,Found reference to API "SetFileAttributesA" (Indicator: "SetFileAttributes"; File: "eabd0bd2d942ed6013525df7ffc82dac2e1c7289308952de7dbabe6a03d71e00.exe") Found reference to API "SetFileAttributesW" (Indicator: "SetFileAttributes"; File: "eabd0bd2d942ed6013525df7ffc82dac2e1c7289308952de7dbabe6a03d71e00.exe") Found reference to API "" (Indicator: "SetFileAttributes"; Source: "00000000-00000496.00000000.92449.02F50000.00000004.mdmp, 00000000-00000496.00000002.96288.02F50000.00000004.mdmp") Found reference to API "" (Indicator: "SetFileAttributes"; Source: "00000000-00000496.00000000.92449.02F50000.00000004.mdmp, 00000000-00000496.00000002.96288.02F50000.00000004.mdmp") Found reference to API "" (Indicator: "SetFileAttributes"; Source: "00000000-00004424.00000000.91567.00E60000.00000004.mdmp, 00000000-00004424.00000002.95407.00E60000.00000004.mdmp") Found reference to API "" (Indicator: "SetFileAttributes"; Source: "00000000-00004424.00000000.91567.00E60000.00000004.mdmp, 00000000-00004424.00000002.95407.00E60000.00000004.mdmp") Found reference to API "SetFileAttributesA" (Indicator: "SetFileAttributes"; Source: "00000000-00004424.00000000.91567.012EA000.00000002.mdmp") Found reference to API "SetFileAttributesA" (Indicator: "SetFileAttributes"; Source: "00000000-00005996.00000001.93593.00B9A000.00000002.mdmp") Found reference to API "" (Indicator: "SetFileAttributes"; Source: "00000000-00005996.00000001.93593.03350000.00000004.mdmp, 00000000-00005996.00000002.95514.03350000.00000004.mdmp") Found reference to API "" (Indicator: "SetFileAttributes"; Source: "00000000-00005996.00000001.93593.03350000.00000004.mdmp, 00000000-00005996.00000002.95514.03350000.00000004.mdmp") Found reference to API "SetFileAttributesA" (Indicator: "SetFileAttributes"; Source: "00000000-00007476.00000000.91759.0024A000.00000002.mdmp") Found reference to API "" (Indicator: "SetFileAttributes"; Source: "00000000-00007476.00000000.91759.02CC0000.00000004.mdmp") Found reference to API "" (Indicator: "SetFileAttributes"; Source: "00000000-00007476.00000000.91759.02CC0000.00000004.mdmp") Found reference to API "SetFileAttributesA" (Indicator: "SetFileAttributes"; Source: "00000000-00008204.00000000.91623.001FA000.00000002.mdmp")5d:T1344,Found reference to API "AllocateAndInitializeSid" (Indicator: "AllocateAndInitializeSid"; File: "eabd0bd2d942ed6013525df7ffc82dac2e1c7289308952de7dbabe6a03d71e00.exe") Found reference to API "AllocateAndInitializeSid" (Indicator: "InitializeSid"; File: "eabd0bd2d942ed6013525df7ffc82dac2e1c7289308952de7dbabe6a03d71e00.exe") Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; File: "eabd0bd2d942ed6013525df7ffc82dac2e1c7289308952de7dbabe6a03d71e00.exe") Found reference to API "FreeSid" (Indicator: "FreeSid"; File: "eabd0bd2d942ed6013525df7ffc82dac2e1c7289308952de7dbabe6a03d71e00.exe") Found reference to API "EqualSid" (Indicator: "EqualSid"; File: "eabd0bd2d942ed6013525df7ffc82dac2e1c7289308952de7dbabe6a03d71e00.exe") Found reference to API "GetSidSubAuthorityCount" (Indicator: "GetSidSubAuthority"; File: "eabd0bd2d942ed6013525df7ffc82dac2e1c7289308952de7dbabe6a03d71e00.exe") Found reference to API "GetSidSubAuthorityCount" (Indicator: "GetSidSubAuthorityCount"; File: "eabd0bd2d942ed6013525df7ffc82dac2e1c7289308952de7dbabe6a03d71e00.exe") Found reference to API "GetSidSubAuthority" (Indicator: "GetSidSubAuthority"; File: "eabd0bd2d942ed6013525df7ffc82dac2e1c7289308952de7dbabe6a03d71e00.exe") Found reference to API "GetSidIdentifierAuthority" (Indicator: "GetSidIdentifierAuthority"; File: "eabd0bd2d942ed6013525df7ffc82dac2e1c7289308952de7dbabe6a03d71e00.exe") Found reference to API "" (Indicator: "AccessCheck"; Source: "00000000-00000496.00000000.92449.02F50000.00000004.mdmp, 00000000-00000496.00000002.96288.02F50000.00000004.mdmp") Found reference to API "" (Indicator: "SetFileSecurityW"; Source: "00000000-00000496.00000000.92449.02F50000.00000004.mdmp, 00000000-00000496.00000002.96288.02F50000.00000004.mdmp") Found reference to API "" (Indicator: "AccessCheck"; Source: "00000000-00004424.00000000.91567.00E60000.00000004.mdmp, 00000000-00004424.00000002.95407.00E60000.00000004.mdmp") Found reference to API "" (Indicator: "SetFileSecurityW"; Source: "00000000-00004424.00000000.91567.00E60000.00000004.mdmp, 00000000-00004424.00000002.95407.00E60000.00000004.mdmp") Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; Source: "00000000-00004424.00000000.91567.012EA000.00000002.mdmp") Found reference to API "FreeSid" (Indicator: "FreeSid"; Source: "00000000-00004424.00000000.91567.012EA000.00000002.mdmp") Found reference to API "AllocateAndInitializeSid" (Indicator: "AllocateAndInitializeSid"; Source: "00000000-00004424.00000000.91567.012EA000.00000002.mdmp") Found reference to API "AllocateAndInitializeSid" (Indicator: "InitializeSid"; Source: "00000000-00004424.00000000.91567.012EA000.00000002.mdmp") Found reference to API "EqualSid" (Indicator: "EqualSid"; Source: "00000000-00004424.00000000.91567.012EA000.00000002.mdmp") Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; Source: "00000000-00005996.00000001.93593.00B9A000.00000002.mdmp") Found reference to API "FreeSid" (Indicator: "FreeSid"; Source: "00000000-00005996.00000001.93593.00B9A000.00000002.mdmp") Found reference to API "AllocateAndInitializeSid" (Indicator: "AllocateAndInitializeSid"; Source: "00000000-00005996.00000001.93593.00B9A000.00000002.mdmp") Found reference to API "AllocateAndInitializeSid" (Indicator: "InitializeSid"; Source: "00000000-00005996.00000001.93593.00B9A000.00000002.mdmp") Found reference to API "EqualSid" (Indicator: "EqualSid"; Source: "00000000-00005996.00000001.93593.00B9A000.00000002.mdmp") Found reference to API "" (Indicator: "AccessCheck"; Source: "00000000-00005996.00000001.93593.03350000.00000004.mdmp, 00000000-00005996.00000002.95514.03350000.00000004.mdmp") Found reference to API "" (Indicator: "SetFileSecurityW"; Source: "00000000-00005996.00000001.93593.03350000.00000004.mdmp, 00000000-00005996.00000002.95514.03350000.00000004.mdmp") Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; Source: "00000000-00007476.00000000.91759.0024A000.00000002.mdmp") Found reference to API "FreeSid" (Indicator: "FreeSid"; Source: "00000000-00007476.00000000.91759.0024A000.00000002.mdmp") Found reference to API "AllocateAndInitializeSid" (Indicator: "AllocateAndInitializeSid"; Source: "00000000-00007476.00000000.91759.0024A000.00000002.mdmp") Found reference to API "AllocateAndInitializeSid" (Indicator: "InitializeSid"; Source: "00000000-00007476.00000000.91759.0024A000.00000002.mdmp") Found reference to API "EqualSid" (Indicator: "EqualSid"; Source: "00000000-00007476.00000000.91759.0024A000.00000002.mdmp")5e:T56e,Found reference to API "TerminateProcess" (Indicator: "TerminateProcess"; File: "eabd0bd2d942ed6013525df7ffc82dac2e1c7289308952de7dbabe6a03d71e00.exe") Found reference to API "ExitProcess" (Indicator: "ExitProcess"; File: "eabd0bd2d942ed6013525df7ffc82dac2e1c7289308952de7dbabe6a03d71e00.exe") Found reference to API "ExitProcess" (Indicator: "ExitProcess"; Source: "00000000-00004424.00000000.91567.012EA000.00000002.mdmp") Found reference to API "TerminateProcess" (Indicator: "TerminateProcess"; Source: "00000000-00004424.00000000.91567.012EA000.00000002.mdmp") Found reference to API "ExitProcess" (Indicator: "ExitProcess"; Source: "00000000-00005996.00000001.93593.00B9A000.00000002.mdmp") Found reference to API "TerminateProcess" (Indicator: "TerminateProcess"; Source: "00000000-00005996.00000001.93593.00B9A000.00000002.mdmp") Found reference to API "ExitProcess" (Indicator: "ExitProcess"; Source: "00000000-00007476.00000000.91759.0024A000.00000002.mdmp") Found reference to API "TerminateProcess" (Indicator: "TerminateProcess"; Source: "00000000-00007476.00000000.91759.0024A000.00000002.mdmp") Found reference to API "ExitProcess" (Indicator: "ExitProcess"; Source: "00000000-00008204.00000000.91623.001FA000.00000002.mdmp") Found reference to API "TerminateProcess" (Indicator: "TerminateProcess"; Source: "00000000-00008204.00000000.91623.001FA000.00000002.mdmp")5f:T1104,Observed import api "AllocateAndInitializeSid" which can "Allocates and initializes a security identifier (SID) with up to eight subauthorities" [Source: eabd0bd2d942ed6013525df7ffc82dac2e1c7289308952de7dbabe6a03d71e00.exe] Observed import api "EqualSid" which can "Tests two security identifier (SID) values for equality" [Source: eabd0bd2d942ed6013525df7ffc82dac2e1c7289308952de7dbabe6a03d71e00.exe] Observed import api "FreeSid" which can "Frees a security identifier (SID) previously allocated by using the AllocateAndInitializeSid function" [Source: eabd0bd2d942ed6013525df7ffc82dac2e1c7289308952de7dbabe6a03d71e00.exe] Observed import api "GetTokenInformation" which can "Retrieves a specified type of information about an access token" [Source: eabd0bd2d942ed6013525df7ffc82dac2e1c7289308952de7dbabe6a03d71e00.exe] Observed import api "InitializeSid" which can "Initializes a security identifier (SID)" [Source: eabd0bd2d942ed6013525df7ffc82dac2e1c7289308952de7dbabe6a03d71e00.exe] Observed import api "AllocateAndInitializeSid" which can "Allocates and initializes a security identifier (SID) with up to eight subauthorities" [Source: se3jY19.exe] Observed import api "EqualSid" which can "Tests two security identifier (SID) values for equality" [Source: se3jY19.exe] Observed import api "FreeSid" which can "Frees a security identifier (SID) previously allocated by using the AllocateAndInitializeSid function" [Source: se3jY19.exe] Observed import api "GetTokenInformation" which can "Retrieves a specified type of information about an access token" [Source: se3jY19.exe] Observed import api "InitializeSid" which can "Initializes a security identifier (SID)" [Source: se3jY19.exe] Observed import api "AllocateAndInitializeSid" which can "Allocates and initializes a security identifier (SID) with up to eight subauthorities" [Source: ho0Ot26.exe] Observed import api "EqualSid" which can "Tests two security identifier (SID) values for equality" [Source: ho0Ot26.exe] Observed import api "FreeSid" which can "Frees a security identifier (SID) previously allocated by using the AllocateAndInitializeSid function" [Source: ho0Ot26.exe] Observed import api "GetTokenInformation" which can "Retrieves a specified type of information about an access token" [Source: ho0Ot26.exe] Observed import api "InitializeSid" which can "Initializes a security identifier (SID)" [Source: ho0Ot26.exe] Observed import api "AllocateAndInitializeSid" which can "Allocates and initializes a security identifier (SID) with up to eight subauthorities" [Source: vm6LM89.exe] Observed import api "EqualSid" which can "Tests two security identifier (SID) values for equality" [Source: vm6LM89.exe] Observed import api "FreeSid" which can "Frees a security identifier (SID) previously allocated by using the AllocateAndInitializeSid function" [Source: vm6LM89.exe] Observed import api "GetTokenInformation" which can "Retrieves a specified type of information about an access token" [Source: vm6LM89.exe] Observed import api "InitializeSid" which can "Initializes a security identifier (SID)" [Source: vm6LM89.exe] Observed import api "AllocateAndInitializeSid" which can "Allocates and initializes a security identifier (SID) with up to eight subauthorities" [Source: kX2gk33.exe] Observed import api "EqualSid" which can "Tests two security identifier (SID) values for equality" [Source: kX2gk33.exe] Observed import api "FreeSid" which can "Frees a security identifier (SID) previously allocated by using the AllocateAndInitializeSid function" [Source: kX2gk33.exe] Observed import api "GetTokenInformation" which can "Retrieves a specified type of information about an access token" [Source: kX2gk33.exe] Observed import api "InitializeSid" which can "Initializes a security identifier (SID)" [Source: kX2gk33.exe] Observed import api "GetSidIdentifierAuthority" which can "Returns a pointer to the SID_IDENTIFIER_AUTHORITY structure in a specified security identifier (SID)" [Source: 5Dy6eL3.exe] Observed import api "GetSidSubAuthority" which can "Returns a pointer to a specified subauthority in a security identifier (SID)" [Source: 5Dy6eL3.exe] Observed import api "GetSidSubAuthorityCount" which can "Returns a pointer to the member in a security identifier (SID) structure that contains the subauthority count" [Source: 5Dy6eL3.exe]60:T6f9,"eabd0bd2d942ed6013525df7ffc82dac2e1c7289308952de7dbabe6a03d71e00.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\USERS\HAPUBWS\APPDATA\LOCAL\TEMP\IXP000.TMP\SE3JY19.EXE"; Value: "") "se3jY19.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\USERS\HAPUBWS\APPDATA\LOCAL\TEMP\IXP001.TMP\HO0OT26.EXE"; Value: "") "ho0Ot26.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\USERS\HAPUBWS\APPDATA\LOCAL\TEMP\IXP002.TMP\VM6LM89.EXE"; Value: "") "vm6LM89.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\USERS\HAPUBWS\APPDATA\LOCAL\TEMP\IXP003.TMP\KX2GK33.EXE"; Value: "") "vm6LM89.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\USERS\HAPUBWS\APPDATA\LOCAL\TEMP\IXP003.TMP\3PX14VB.EXE"; Value: "") "kX2gk33.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\USERS\HAPUBWS\APPDATA\LOCAL\TEMP\IXP004.TMP\1AE44GC4.EXE"; Value: "") "kX2gk33.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\USERS\HAPUBWS\APPDATA\LOCAL\TEMP\IXP004.TMP\2XD7490.EXE"; Value: "")61:T54b,Found reference to API "ExitWindowsEx" (Indicator: "ExitWindows"; File: "eabd0bd2d942ed6013525df7ffc82dac2e1c7289308952de7dbabe6a03d71e00.exe") file/memory contains long string with (Indicator: "ExitWindows"; File: "eabd0bd2d942ed6013525df7ffc82dac2e1c7289308952de7dbabe6a03d71e00.exe") file/memory contains long string with (Indicator: "ExitWindows"; Source: "00000000-00004424.00000000.91567.012EA000.00000002.mdmp") Found reference to API "ExitWindowsEx" (Indicator: "ExitWindows"; Source: "00000000-00004424.00000000.91567.012EA000.00000002.mdmp") file/memory contains long string with (Indicator: "ExitWindows"; Source: "00000000-00005996.00000001.93593.00B9A000.00000002.mdmp") Found reference to API "ExitWindowsEx" (Indicator: "ExitWindows"; Source: "00000000-00005996.00000001.93593.00B9A000.00000002.mdmp") file/memory contains long string with (Indicator: "ExitWindows"; Source: "00000000-00007476.00000000.91759.0024A000.00000002.mdmp") Found reference to API "ExitWindowsEx" (Indicator: "ExitWindows"; Source: "00000000-00007476.00000000.91759.0024A000.00000002.mdmp") file/memory contains long string with (Indicator: "ExitWindows"; Source: "00000000-00008204.00000000.91623.001FA000.00000002.mdmp") Found reference to API "ExitWindowsEx" (Indicator: "ExitWindows"; Source: "00000000-00008204.00000000.91623.001FA000.00000002.mdmp")62:T604,"se3jY19.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP000.TMP\se3jY19.exe]- [targetUID: 00000000-00004424] "ho0Ot26.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP001.TMP\ho0Ot26.exe]- [targetUID: 00000000-00005996] "vm6LM89.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP002.TMP\vm6LM89.exe]- [targetUID: 00000000-00008540] "kX2gk33.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP003.TMP\kX2gk33.exe]- [targetUID: 00000000-00008540] "4IL656Nj.exe" has type "PE32 executable (GUI) Intel 80386 Mono/.Net assembly for MS Windows"- Location: [%TEMP%\IXP002.TMP\4IL656Nj.exe]- [targetUID: 00000000-00005996] "5Dy6eL3.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP001.TMP\5Dy6eL3.exe]- [targetUID: 00000000-00008204] "2Xd7490.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP004.TMP\2Xd7490.exe]- [targetUID: 00000000-00007892] "6bT2Su1.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP000.TMP\6bT2Su1.exe]- [targetUID: 00000000-00004424] "3PX14vb.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP003.TMP\3PX14vb.exe]- [targetUID: 00000000-00008540] "1Ae44GC4.exe" has type "PE32 executable (GUI) Intel 80386 Mono/.Net assembly for MS Windows"- Location: [%TEMP%\IXP004.TMP\1Ae44GC4.exe]- [targetUID: 00000000-00007476]63:T714,"eabd0bd2d942ed6013525df7ffc82dac2e1c7289308952de7dbabe6a03d71e00.exe" has section name .text with entropy "6.314163792045976" "eabd0bd2d942ed6013525df7ffc82dac2e1c7289308952de7dbabe6a03d71e00.exe" has section name .rsrc with entropy "7.944208489805836" "eabd0bd2d942ed6013525df7ffc82dac2e1c7289308952de7dbabe6a03d71e00.exe" has section name .reloc with entropy "6.222637930812128" "se3jY19.exe" has section name .text with entropy "6.314163792045976" "se3jY19.exe" has section name .rsrc with entropy "7.927108643484695" "se3jY19.exe" has section name .reloc with entropy "6.222637930812128" "ho0Ot26.exe" has section name .text with entropy "6.314163792045976" "ho0Ot26.exe" has section name .rsrc with entropy "7.885933608867585" "ho0Ot26.exe" has section name .reloc with entropy "6.222637930812128" "vm6LM89.exe" has section name .text with entropy "6.314163792045976" "vm6LM89.exe" has section name .rsrc with entropy "7.790720088744247" "vm6LM89.exe" has section name .reloc with entropy "6.222637930812128" "kX2gk33.exe" has section name .text with entropy "6.314163792045976" "kX2gk33.exe" has section name .rsrc with entropy "7.599695315089128" "kX2gk33.exe" has section name .reloc with entropy "6.222637930812128" "4IL656Nj.exe" has section name .text with entropy "6.347609018152964" "5Dy6eL3.exe" has section name .text with entropy "6.481477924163614" "5Dy6eL3.exe" has section name .reloc with entropy "6.604286353686168" "2Xd7490.exe" has section name .text with entropy "6.792540501452876" "2Xd7490.exe" has section name .reloc with entropy "6.7904444831249995" "6bT2Su1.exe" has section name .text with entropy "6.558083729279072" "6bT2Su1.exe" has section name .rdata with entropy "7.110640338733979" "3PX14vb.exe" has section name .text with entropy "7.876606251361052"64:T604,"se3jY19.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP000.TMP\se3jY19.exe]- [targetUID: 00000000-00004424] "ho0Ot26.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP001.TMP\ho0Ot26.exe]- [targetUID: 00000000-00005996] "vm6LM89.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP002.TMP\vm6LM89.exe]- [targetUID: 00000000-00008540] "kX2gk33.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP003.TMP\kX2gk33.exe]- [targetUID: 00000000-00008540] "4IL656Nj.exe" has type "PE32 executable (GUI) Intel 80386 Mono/.Net assembly for MS Windows"- Location: [%TEMP%\IXP002.TMP\4IL656Nj.exe]- [targetUID: 00000000-00005996] "5Dy6eL3.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP001.TMP\5Dy6eL3.exe]- [targetUID: 00000000-00008204] "2Xd7490.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP004.TMP\2Xd7490.exe]- [targetUID: 00000000-00007892] "6bT2Su1.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP000.TMP\6bT2Su1.exe]- [targetUID: 00000000-00004424] "3PX14vb.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP003.TMP\3PX14vb.exe]- [targetUID: 00000000-00008540] "1Ae44GC4.exe" has type "PE32 executable (GUI) Intel 80386 Mono/.Net assembly for MS Windows"- Location: [%TEMP%\IXP004.TMP\1Ae44GC4.exe]- [targetUID: 00000000-00007476]65:T732,"eabd0bd2d942ed6013525df7ffc82dac2e1c7289308952de7dbabe6a03d71e00.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\RUNONCE") "eabd0bd2d942ed6013525df7ffc82dac2e1c7289308952de7dbabe6a03d71e00.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\RUNONCE"; Key: "WEXTRACT_CLEANUP0"; Value: "rundll32.exe %WINDIR%\system32\advpack.dll,DelNodeRunDLL32 "%TEMP%\IXP000.TMP\"") "se3jY19.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\RUNONCE") "se3jY19.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\RUNONCE"; Key: "WEXTRACT_CLEANUP1"; Value: "rundll32.exe %WINDIR%\system32\advpack.dll,DelNodeRunDLL32 "%TEMP%\IXP001.TMP\"") "ho0Ot26.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\RUNONCE") "ho0Ot26.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\RUNONCE"; Key: "WEXTRACT_CLEANUP2"; Value: "rundll32.exe %WINDIR%\system32\advpack.dll,DelNodeRunDLL32 "%TEMP%\IXP002.TMP\"") "vm6LM89.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\RUNONCE") "vm6LM89.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\RUNONCE"; Key: "WEXTRACT_CLEANUP3"; Value: "rundll32.exe %WINDIR%\system32\advpack.dll,DelNodeRunDLL32 "%TEMP%\IXP003.TMP\"") "kX2gk33.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\RUNONCE") "kX2gk33.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\RUNONCE"; Key: "WEXTRACT_CLEANUP4"; Value: "rundll32.exe %WINDIR%\system32\advpack.dll,DelNodeRunDLL32 "%TEMP%\IXP004.TMP\"")66:T1006,"eabd0bd2d942ed6013525df7ffc82dac2e1c7289308952de7dbabe6a03d71e00.exe" wrote 32768 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP\se3jY19.exe": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "eabd0bd2d942ed6013525df7ffc82dac2e1c7289308952de7dbabe6a03d71e00.exe" wrote 8704 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP\6bT2Su1.exe": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "se3jY19.exe" wrote 32768 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP001.TMP\ho0Ot26.exe": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "se3jY19.exe" wrote 32256 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP001.TMP\5Dy6eL3.exe": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000000100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "ho0Ot26.exe" wrote 32768 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP002.TMP\vm6LM89.exe": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "ho0Ot26.exe" wrote 13312 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP002.TMP\4IL656Nj.exe": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "vm6LM89.exe" wrote 32768 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP003.TMP\kX2gk33.exe": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "vm6LM89.exe" wrote 9728 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP003.TMP\3PX14vb.exe": 4d5aff000100000004001000ffff00004001000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0a240000000000000000 ... "kX2gk33.exe" wrote 11776 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP004.TMP\1Ae44GC4.exe": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "kX2gk33.exe" wrote 20992 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP004.TMP\2Xd7490.exe": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000100100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ...67:T65b,"eabd0bd2d942ed6013525df7ffc82dac2e1c7289308952de7dbabe6a03d71e00.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP" with delete access "se3jY19.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP" with delete access "se3jY19.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\IXP001.TMP" with delete access "ho0Ot26.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP" with delete access "ho0Ot26.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\IXP001.TMP" with delete access "ho0Ot26.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\IXP002.TMP" with delete access "vm6LM89.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP" with delete access "vm6LM89.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\IXP001.TMP" with delete access "vm6LM89.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\IXP002.TMP" with delete access "vm6LM89.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\IXP003.TMP" with delete access "kX2gk33.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP" with delete access "kX2gk33.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\IXP001.TMP" with delete access "kX2gk33.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\IXP002.TMP" with delete access "kX2gk33.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\IXP003.TMP" with delete access "kX2gk33.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\IXP004.TMP" with delete access "kX2gk33.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\IXP004.TMP\2Xd7490.exe" with delete access "kX2gk33.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\IXP004.TMP\1Ae44GC4.exe" with delete access68:T499,OpenProcessToken RegCloseKey RegCreateKeyExA RegDeleteValueA RegOpenKeyExA GetStartupInfoW GetVersionExA GetDriveTypeA FindNextFileA GetModuleFileNameA GetTickCount UnhandledExceptionFilter CreateProcessA GetModuleHandleW CreateThread DeleteFileA GetTempPathA GetTempFileNameA GetFileAttributesA TerminateProcess GetSystemDirectoryA GetSystemInfo LockResource Sleep CreateFileA FindFirstFileA LoadLibraryA CreateDirectoryA FindResourceA WriteFile GetProcAddress LoadLibraryExA LookupAccountNameA GetUserNameA FindFirstFileExW CopyFileA WriteProcessMemory GetModuleFileNameW IsDebuggerPresent LoadLibraryExW GetVersionExW GetComputerNameExW ReadProcessMemory GetThreadContext GetCommandLineW VirtualAllocEx GetCommandLineA FindNextFileW CreateFileW DeleteFileW VirtualAlloc GetModuleHandleExW GetModuleHandleA GetDriveTypeW ShellExecuteA InternetCloseHandle HttpSendRequestA InternetOpenUrlA InternetReadFile InternetOpenA InternetConnectA InternetOpenW GetTempFileNameW GetNativeSystemInfo GetSystemDirectoryW FindResourceW GetTempPathW CreateDirectoryW LoadLibraryW ShellExecuteExW GetWindowThreadProcessId69:T5ff9,Contains base64 string in header "POST" in header "POST /loghub/master HTTP/1.1Content-Type: multipart/form-data; boundary=pmxH1vNzjnvmIjGoC2ZiContent-Length: 213User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; InfoPath.1)Host: 5.42.92.88Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "1Content" in header "POST /loghub/master HTTP/1.1Content-Type: multipart/form-data; boundary=pmxH1vNzjnvmIjGoC2ZiContent-Length: 213User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; InfoPath.1)Host: 5.42.92.88Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "Type" in header "POST /loghub/master HTTP/1.1Content-Type: multipart/form-data; boundary=pmxH1vNzjnvmIjGoC2ZiContent-Length: 213User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; InfoPath.1)Host: 5.42.92.88Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "data" in header "POST /loghub/master HTTP/1.1Content-Type: multipart/form-data; boundary=pmxH1vNzjnvmIjGoC2ZiContent-Length: 213User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; InfoPath.1)Host: 5.42.92.88Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "MSIE" in header "POST /loghub/master HTTP/1.1Content-Type: multipart/form-data; boundary=pmxH1vNzjnvmIjGoC2ZiContent-Length: 213User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; InfoPath.1)Host: 5.42.92.88Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "InfoPath" in header "POST /loghub/master HTTP/1.1Content-Type: multipart/form-data; boundary=pmxH1vNzjnvmIjGoC2ZiContent-Length: 213User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; InfoPath.1)Host: 5.42.92.88Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "Host" in header "POST /loghub/master HTTP/1.1Content-Type: multipart/form-data; boundary=pmxH1vNzjnvmIjGoC2ZiContent-Length: 213User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; InfoPath.1)Host: 5.42.92.88Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "88Connection" in header "POST /loghub/master HTTP/1.1Content-Type: multipart/form-data; boundary=pmxH1vNzjnvmIjGoC2ZiContent-Length: 213User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; InfoPath.1)Host: 5.42.92.88Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "Keep" in header "POST /loghub/master HTTP/1.1Content-Type: multipart/form-data; boundary=pmxH1vNzjnvmIjGoC2ZiContent-Length: 213User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; InfoPath.1)Host: 5.42.92.88Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "POST" in header "POST /theme/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.124.1Content-Length: 92Cache-Control: no-cache" Contains base64 string in header "/theme/index" in header "POST /theme/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.124.1Content-Length: 92Cache-Control: no-cache" Contains base64 string in header "1Content" in header "POST /theme/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.124.1Content-Length: 92Cache-Control: no-cache" Contains base64 string in header "Type" in header "POST /theme/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.124.1Content-Length: 92Cache-Control: no-cache" Contains base64 string in header "form" in header "POST /theme/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.124.1Content-Length: 92Cache-Control: no-cache" Contains base64 string in header "Keep" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "User" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "ocsp" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "digicert" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "Keep" in header "GET /gtsr1/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBQwkcLWD4LqGJ7bE7B1XZsEbmfwUAQU5K8rJnEaK0gnhS9SZizv8IkTcT4CDQIDvFNZazTHGPUBUGY%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "User" in header "GET /gtsr1/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBQwkcLWD4LqGJ7bE7B1XZsEbmfwUAQU5K8rJnEaK0gnhS9SZizv8IkTcT4CDQIDvFNZazTHGPUBUGY%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "ocsp" in header "GET /gtsr1/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBQwkcLWD4LqGJ7bE7B1XZsEbmfwUAQU5K8rJnEaK0gnhS9SZizv8IkTcT4CDQIDvFNZazTHGPUBUGY%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "goog" in header "GET /gtsr1/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBQwkcLWD4LqGJ7bE7B1XZsEbmfwUAQU5K8rJnEaK0gnhS9SZizv8IkTcT4CDQIDvFNZazTHGPUBUGY%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP" in header "GET /gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "2FUsCEHe9DWzbNvka6iEPxPBY0w0" in header "GET /gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "Keep" in header "GET /gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "User" in header "GET /gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "ocsp" in header "GET /gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "goog" in header "GET /gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEATh56TcXPLzbcArQrhdFZ8" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEATh56TcXPLzbcArQrhdFZ8%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "Keep" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEATh56TcXPLzbcArQrhdFZ8%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "User" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEATh56TcXPLzbcArQrhdFZ8%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "ocsp" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEATh56TcXPLzbcArQrhdFZ8%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "digicert" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEATh56TcXPLzbcArQrhdFZ8%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "Keep" in header "GET /gts1c3/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEQDD4iAmv7K7FRC9GgFEgKKE HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "User" in header "GET /gts1c3/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEQDD4iAmv7K7FRC9GgFEgKKE HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "ocsp" in header "GET /gts1c3/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEQDD4iAmv7K7FRC9GgFEgKKE HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "goog" in header "GET /gts1c3/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEQDD4iAmv7K7FRC9GgFEgKKE HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "2Bsl" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTPJvUY%2Bsl%2Bj4yzQuAcL2oQno5fCgQUUWj%2FkK8CB3U8zNllZGKiErhZcjsCEAEjvRUG64sR2nXnhnVUNII%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "Keep" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTPJvUY%2Bsl%2Bj4yzQuAcL2oQno5fCgQUUWj%2FkK8CB3U8zNllZGKiErhZcjsCEAEjvRUG64sR2nXnhnVUNII%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "User" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTPJvUY%2Bsl%2Bj4yzQuAcL2oQno5fCgQUUWj%2FkK8CB3U8zNllZGKiErhZcjsCEAEjvRUG64sR2nXnhnVUNII%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "ocsp" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTPJvUY%2Bsl%2Bj4yzQuAcL2oQno5fCgQUUWj%2FkK8CB3U8zNllZGKiErhZcjsCEAEjvRUG64sR2nXnhnVUNII%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "digicert" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTPJvUY%2Bsl%2Bj4yzQuAcL2oQno5fCgQUUWj%2FkK8CB3U8zNllZGKiErhZcjsCEAEjvRUG64sR2nXnhnVUNII%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "Keep" in header "GET /gts1c3/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEQDHFurBkDkysBLRERRg7lfk HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "User" in header "GET /gts1c3/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEQDHFurBkDkysBLRERRg7lfk HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "ocsp" in header "GET /gts1c3/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEQDHFurBkDkysBLRERRg7lfk HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "goog" in header "GET /gts1c3/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEQDHFurBkDkysBLRERRg7lfk HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "Keep" in header "GET /DigiCertGlobalRootG3.crt HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: cacerts.digicert.com" Contains base64 string in header "User" in header "GET /DigiCertGlobalRootG3.crt HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: cacerts.digicert.com" Contains base64 string in header "digicert" in header "GET /DigiCertGlobalRootG3.crt HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: cacerts.digicert.com" Contains base64 string in header "Keep" in header "GET /gts1c3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEBM9NSid4pOvCr35n90pfXk%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "User" in header "GET /gts1c3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEBM9NSid4pOvCr35n90pfXk%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "ocsp" in header "GET /gts1c3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEBM9NSid4pOvCr35n90pfXk%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "goog" in header "GET /gts1c3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEBM9NSid4pOvCr35n90pfXk%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "Keep" in header "GET /gts1c3/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEQDLYsQ7yv2LMwmxOu34tlfG HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "User" in header "GET /gts1c3/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEQDLYsQ7yv2LMwmxOu34tlfG HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "ocsp" in header "GET /gts1c3/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEQDLYsQ7yv2LMwmxOu34tlfG HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "goog" in header "GET /gts1c3/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEQDLYsQ7yv2LMwmxOu34tlfG HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAzlnDD9eoNTLi0BRrMy%2BWU%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "2BWU" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAzlnDD9eoNTLi0BRrMy%2BWU%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "Keep" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAzlnDD9eoNTLi0BRrMy%2BWU%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "User" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAzlnDD9eoNTLi0BRrMy%2BWU%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "ocsp" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAzlnDD9eoNTLi0BRrMy%2BWU%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "digicert" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAzlnDD9eoNTLi0BRrMy%2BWU%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "2BrkS7QYXjzkCEA177el9ggmWelJjG4vdGL0" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEA177el9ggmWelJjG4vdGL0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "Keep" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEA177el9ggmWelJjG4vdGL0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "User" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEA177el9ggmWelJjG4vdGL0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "ocsp" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEA177el9ggmWelJjG4vdGL0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "digicert" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEA177el9ggmWelJjG4vdGL0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "Keep" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "User" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "ocsp" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "digicert" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "Keep" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBT3xL4LQLXDRDM9P665TW442vrsUQQUReuir%2FSSy4IxLVGLp6chnfNtyA8CEA6bGI750C3n79tQ4ghAGFo%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "User" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBT3xL4LQLXDRDM9P665TW442vrsUQQUReuir%2FSSy4IxLVGLp6chnfNtyA8CEA6bGI750C3n79tQ4ghAGFo%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "ocsp" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBT3xL4LQLXDRDM9P665TW442vrsUQQUReuir%2FSSy4IxLVGLp6chnfNtyA8CEA6bGI750C3n79tQ4ghAGFo%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "digicert" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBT3xL4LQLXDRDM9P665TW442vrsUQQUReuir%2FSSy4IxLVGLp6chnfNtyA8CEA6bGI750C3n79tQ4ghAGFo%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "2BF8Rhvv" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSRXerF0eFeSWRripTgTkcJWMm7iQQUaDfg67Y7%2BF8Rhvv%2BYXsIiGX0TkICEATi7HzdaAMTTamxkE%2Fh8DM%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "2BYXsIiGX0TkICEATi7HzdaAMTTamxkE" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSRXerF0eFeSWRripTgTkcJWMm7iQQUaDfg67Y7%2BF8Rhvv%2BYXsIiGX0TkICEATi7HzdaAMTTamxkE%2Fh8DM%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "Keep" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSRXerF0eFeSWRripTgTkcJWMm7iQQUaDfg67Y7%2BF8Rhvv%2BYXsIiGX0TkICEATi7HzdaAMTTamxkE%2Fh8DM%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "User" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSRXerF0eFeSWRripTgTkcJWMm7iQQUaDfg67Y7%2BF8Rhvv%2BYXsIiGX0TkICEATi7HzdaAMTTamxkE%2Fh8DM%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "ocsp" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSRXerF0eFeSWRripTgTkcJWMm7iQQUaDfg67Y7%2BF8Rhvv%2BYXsIiGX0TkICEATi7HzdaAMTTamxkE%2Fh8DM%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "digicert" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSRXerF0eFeSWRripTgTkcJWMm7iQQUaDfg67Y7%2BF8Rhvv%2BYXsIiGX0TkICEATi7HzdaAMTTamxkE%2Fh8DM%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "2BtX" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfIs%2BLjDtGwQ09XEB1Yeq%2BtX%2BBgQQU7NfjgtJxXWRM3y5nP%2Be6mK4cD08CEAitQLJg0pxMn17Nqb2Trtk%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "2BBgQQU7NfjgtJxXWRM3y5nP" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfIs%2BLjDtGwQ09XEB1Yeq%2BtX%2BBgQQU7NfjgtJxXWRM3y5nP%2Be6mK4cD08CEAitQLJg0pxMn17Nqb2Trtk%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "Keep" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfIs%2BLjDtGwQ09XEB1Yeq%2BtX%2BBgQQU7NfjgtJxXWRM3y5nP%2Be6mK4cD08CEAitQLJg0pxMn17Nqb2Trtk%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "User" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfIs%2BLjDtGwQ09XEB1Yeq%2BtX%2BBgQQU7NfjgtJxXWRM3y5nP%2Be6mK4cD08CEAitQLJg0pxMn17Nqb2Trtk%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "ocsp" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfIs%2BLjDtGwQ09XEB1Yeq%2BtX%2BBgQQU7NfjgtJxXWRM3y5nP%2Be6mK4cD08CEAitQLJg0pxMn17Nqb2Trtk%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "digicert" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfIs%2BLjDtGwQ09XEB1Yeq%2BtX%2BBgQQU7NfjgtJxXWRM3y5nP%2Be6mK4cD08CEAitQLJg0pxMn17Nqb2Trtk%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com"6a:Te78,"2Xd7490.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{90A066FE-591C-47F3-850D-9644B684FBA5}"; Key: "ENABLEDHCP"; Value: "") "2Xd7490.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{90A066FE-591C-47F3-850D-9644B684FBA5}"; Key: "REGISTRATIONENABLED"; Value: "") "2Xd7490.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{90A066FE-591C-47F3-850D-9644B684FBA5}"; Key: "REGISTERADAPTERNAME"; Value: "") "2Xd7490.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{90A066FE-591C-47F3-850D-9644B684FBA5}"; Key: "DOMAIN"; Value: "") "2Xd7490.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{90A066FE-591C-47F3-850D-9644B684FBA5}"; Key: "DHCPDOMAIN"; Value: "") "2Xd7490.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E29AC6C2-7037-11DE-816D-806E6F6E6963}"; Key: "ENABLEDHCP"; Value: "") "2Xd7490.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E29AC6C2-7037-11DE-816D-806E6F6E6963}"; Key: "REGISTRATIONENABLED"; Value: "") "2Xd7490.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E29AC6C2-7037-11DE-816D-806E6F6E6963}"; Key: "REGISTERADAPTERNAME"; Value: "") "2Xd7490.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E29AC6C2-7037-11DE-816D-806E6F6E6963}"; Key: "DOMAIN"; Value: "") "2Xd7490.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E29AC6C2-7037-11DE-816D-806E6F6E6963}"; Key: "DHCPDOMAIN"; Value: "") "explothe.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{90A066FE-591C-47F3-850D-9644B684FBA5}"; Key: "ENABLEDHCP"; Value: "") "explothe.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{90A066FE-591C-47F3-850D-9644B684FBA5}"; Key: "REGISTRATIONENABLED"; Value: "") "explothe.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{90A066FE-591C-47F3-850D-9644B684FBA5}"; Key: "REGISTERADAPTERNAME"; Value: "") "explothe.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{90A066FE-591C-47F3-850D-9644B684FBA5}"; Key: "DOMAIN"; Value: "") "explothe.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{90A066FE-591C-47F3-850D-9644B684FBA5}"; Key: "DHCPDOMAIN"; Value: "") "explothe.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E29AC6C2-7037-11DE-816D-806E6F6E6963}"; Key: "ENABLEDHCP"; Value: "") "explothe.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E29AC6C2-7037-11DE-816D-806E6F6E6963}"; Key: "REGISTRATIONENABLED"; Value: "") "explothe.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E29AC6C2-7037-11DE-816D-806E6F6E6963}"; Key: "REGISTERADAPTERNAME"; Value: "") "explothe.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E29AC6C2-7037-11DE-816D-806E6F6E6963}"; Key: "DOMAIN"; Value: "") "explothe.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E29AC6C2-7037-11DE-816D-806E6F6E6963}"; Key: "DHCPDOMAIN"; Value: "")6b:T52c,"4IL656Nj.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\WOW6432NODE\CLIENTS\STARTMENUINTERNET"; Key: ""; Value: "") "4IL656Nj.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLIENTS\STARTMENUINTERNET"; Key: ""; Value: "") "4IL656Nj.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLIENTS\STARTMENUINTERNET\FIREFOX-308046B0AF4A39CB"; Key: ""; Value: "") "4IL656Nj.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLIENTS\STARTMENUINTERNET\FIREFOX-308046B0AF4A39CB"; Key: ""; Value: "") "4IL656Nj.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLIENTS\STARTMENUINTERNET\FIREFOX-308046B0AF4A39CB\SHELL\OPEN\COMMAND"; Key: ""; Value: "") "4IL656Nj.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLIENTS\STARTMENUINTERNET\FIREFOX-308046B0AF4A39CB\SHELL\OPEN\COMMAND"; Key: ""; Value: "") "4IL656Nj.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLIENTS\STARTMENUINTERNET\IEXPLORE.EXE"; Key: ""; Value: "") "4IL656Nj.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLIENTS\STARTMENUINTERNET\IEXPLORE.EXE"; Key: ""; Value: "") "4IL656Nj.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLIENTS\STARTMENUINTERNET\IEXPLORE.EXE\SHELL\OPEN\COMMAND"; Key: ""; Value: "") "4IL656Nj.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLIENTS\STARTMENUINTERNET\IEXPLORE.EXE\SHELL\OPEN\COMMAND"; Key: ""; Value: "")6c:T6ef,"4IL656Nj.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL") "4IL656Nj.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\7-ZIP") "4IL656Nj.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\7-ZIP"; Key: "DISPLAYNAME") "4IL656Nj.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\7-ZIP"; Key: "DISPLAYVERSION") "4IL656Nj.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\ADDRESSBOOK") "4IL656Nj.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\ADDRESSBOOK"; Key: "DISPLAYNAME") "4IL656Nj.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\ADDRESSBOOK"; Key: "DISPLAYVERSION") "4IL656Nj.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\ADOBE AIR") "4IL656Nj.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\ADOBE AIR"; Key: "DISPLAYNAME") "4IL656Nj.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\ADOBE AIR"; Key: "DISPLAYVERSION") "4IL656Nj.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\ADOBE FLASH PLAYER ACTIVEX") "4IL656Nj.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\ADOBE FLASH PLAYER ACTIVEX"; Key: "DISPLAYNAME") "4IL656Nj.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\ADOBE FLASH PLAYER ACTIVEX"; Key: "DISPLAYVERSION") "4IL656Nj.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\ADOBE SHOCKWAVE PLAYER") "4IL656Nj.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\ADOBE SHOCKWAVE PLAYER"; Key: "DISPLAYNAME") "4IL656Nj.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\ADOBE SHOCKWAVE PLAYER"; Key: "DISPLAYVERSION")6d:Td47,"Select Your Wireless NetworkySelect the network name (SSID) of your wireless network from the list. Network names may take up to 60 seconds to appear." (Source: 00000000-00000540.00000000.68211.023B0000.00000002.mdmp, Indicator: "select your wireless networkyselect the network name (ssid) of your wireless network from the list. network names may take up to 60 seconds to appear."), "Select Your Connection}Select your connection from the list. The connection must have a saved user name and password and be available to all users." (Source: 00000000-00000540.00000000.68211.023B0000.00000002.mdmp, Indicator: "select your connection}select your connection from the list. the connection must have a saved user name and password and be available to all users."), "Select Your Set-top Box Brand}Select the brand of your set-top box from the list. If your brand is not listed select Not Listed at the bottom of the list." (Source: 00000000-00000540.00000000.68211.023B0000.00000002.mdmp, Indicator: "select your set-top box brand}select the brand of your set-top box from the list. if your brand is not listed select not listed at the bottom of the list."), "Select the appropriate display resolution from the list below. For best results use the resolution recommended by the manufacturer in the display hardware documentation." (Source: 00000000-00000540.00000000.68211.023B0000.00000002.mdmp, Indicator: "select the appropriate display resolution from the list below. for best results use the resolution recommended by the manufacturer in the display hardware documentation."), "insert it into the digital tuner and select Scan Again." (Source: 00000000-00000540.00000000.68211.023B0000.00000002.mdmp, Indicator: "insert it into the digital tuner and select scan again."), "Select Add Channel to enter the name and channel number for a standard TV channel that is missing from the Guide. To add a digital TV channel select Add DTV Channel." (Source: 00000000-00000540.00000000.68211.023B0000.00000002.mdmp, Indicator: "select add channel to enter the name and channel number for a standard tv channel that is missing from the guide. to add a digital tv channel select add dtv channel."), "Select OK for more information.ZYour Guide listings include one or more channels that share programming from two networks." (Source: 00000000-00000540.00000000.68211.023B0000.00000002.mdmp, Indicator: "select ok for more information.zyour guide listings include one or more channels that share programming from two networks."), "Select a folder for backing up or restoring your media usage rights.ORequesting approval to restore media usage rights. This may take a few minutes.&Transferring media usage rights to %s.(Transferring media usage rights from %s." (Source: 00000000-00000540.00000000.68211.023B0000.00000002.mdmp, Indicator: "select a folder for backing up or restoring your media usage rights.orequesting approval to restore media usage rights. this may take a few minutes.&transferring media usage rights to %s.(transferring media usage rights from %s.") "Delete from &library only$Delete from library and my &computer=Are you sure you want to delete these items from your device?" (Source: 00000000-00000540.00000000.68211.023B0000.00000002.mdmp, Indicator: "delete from &library only$delete from library and my &computer=are you sure you want to delete these items from your device?")6e:Ta1d,Found string "https://www.youtube.com/" (Indicator: "youtube"; File: "23b876abb59c00ac24e3e0d934c0b920.exe") Found string "https://www.facebook.com/login" (Indicator: "facebook.com"; File: "23b876abb59c00ac24e3e0d934c0b920.exe") Found string "@shift /0start "" https://www.facebook.com/loginstart "" https://www.youtube.comstart "" https://accounts.google.com" (Indicator: "facebook.com"; File: "4B36.bat") file/memory contains long string with (Indicator: "youtube"; File: "21EQ900B.txt") file/memory contains long string with (Indicator: "youtube"; File: "css_1_.css") file/memory contains long string with (Indicator: "facebook.com"; File: "5WYPCWPN.txt") Found string "CONSENTWP.2676bayoutube.com/102431383388163210825482504061830633367hideBrowserUpgradeBoxtrueyoutube.com/921726449866243106760616150943031064813VISITOR_INFO1_LIVEyccoFA1-rhoyoutube.com/92175071040003110100016244693031064813" (Indicator: "youtube"; File: "7RUXDIHS.txt") Found string "rKQxZYR_JMNoSBPiBcS6ei3Jfacebook.com/92172414452224311452562919976726310648120kW7fOMa4WxsuYXwY..BlMaSs.Lk.AAA.0.0.BlMaSs.AWUjrG-aL50facebook.com/921786999808031082895323035172631064812" (Indicator: "facebook.com"; File: "QD1CT3AO.txt") Found string "CONSENTWP.2676bayoutube.com/102431383388163210825482504061830633367hideBrowserUpgradeBoxtrueyoutube.com/921726449866243106760616150943031064813" (Indicator: "youtube"; File: "9XZRGEPU.txt") Found string "CheckConnectionTempCookie697295812accounts.youtube.com/accounts/2147484752265942924831064837256528651231064837" (Indicator: "youtube"; File: "H2FAMHPX.txt") Found string "rKQxZYR_JMNoSBPiBcS6ei3Jfacebook.com/9217241445222431145256291997672631064812" (Indicator: "facebook.com"; File: "NUGK62SW.txt") Found string "CONSENTWP.2676bayoutube.com/102431383388163210825482504061830633367" (Indicator: "youtube"; File: "003NQ6HH.txt") Found string "accounts.youtube.com" (Indicator: "youtube"; File: "PCAP") Found string "facebook.com" (Indicator: "facebook.com"; File: "PCAP") Found string "www.facebook.com" (Indicator: "facebook.com"; File: "PCAP") Found string "www.youtube.com" (Indicator: "youtube"; File: "PCAP") Found string "GET /login HTTP/1.1Accept: text/html, application/xhtml+xml, */*User-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateDNT: 1Host: www.facebook.comConnection: Keep-AliveAccept-Language: en-US" (Indicator: "facebook.com"; File: "SSL") file/memory contains long string with (Indicator: "youtube"; File: "SSL") file/memory contains long string with (Indicator: "facebook.com"; File: "SSL")6f:T3591,"GET /theme/Plugins/cred.dll HTTP/1.1 Host: 77.91.124.1" Response ==> HTTP/1.1 404 Not Found Date: Thu 19 Oct 2023 21:50:01 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 273 Content-Type: text/html; charset=iso-8859-1 with response body ==>3C21444F43545950452048544D4C205055424C494320222D2F2F494554462F2F4454442048544D4C20322E302F2F454E223E0A3C68746D6C3E3C686561643E0A....... "GET /theme/Plugins/clip.dll HTTP/1.1 Host: 77.91.124.1" Response ==> HTTP/1.1 200 OK Date: Thu 19 Oct 2023 21:50:02 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Sat 30 Sep 2023 10:50:50 GMT ETag: "16400-60691507c4d20" Accept-Ranges: bytes Content-Length: 91136 Content-Type: application/x-msdos-program with response body ==>4D5A90000300000004000000FFFF0000B80000000000000040000000000000000000000000000000000000000000000000000000000000000000000000010000....... "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.digicert.com" Response ==> HTTP/1.1 200 OK Accept-Ranges: bytes Age: 1434 Cache-Control: max-age=7200 Content-Type: application/ocsp-response Date: Thu 19 Oct 2023 21:50:25 GMT Last-Modified: Thu 19 Oct 2023 21:26:31 GMT Server: ECAcc (sac/2522) X-Cache: HIT Content-Length: 471 with response body ==>308201D30A0100A08201CC308201C806092B0601050507300101048201B9308201B530819EA216041403DE503556D14CBB66F0A3E21B1BC397B23DD155180F32....... "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.digicert.com" Response ==> HTTP/1.1 200 OK Accept-Ranges: bytes Age: 1436 Cache-Control: max-age=7200 Content-Type: application/ocsp-response Date: Thu 19 Oct 2023 21:50:27 GMT Last-Modified: Thu 19 Oct 2023 21:26:31 GMT Server: ECAcc (sac/2522) X-Cache: HIT Content-Length: 471 with response body ==>308201D30A0100A08201CC308201C806092B0601050507300101048201B9308201B530819EA216041403DE503556D14CBB66F0A3E21B1BC397B23DD155180F32....... "GET /gtsr1/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBQwkcLWD4LqGJ7bE7B1XZsEbmfwUAQU5K8rJnEaK0gnhS9SZizv8IkTcT4CDQIDvFNZazTHGPUBUGY%3D HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.pki.goog" Response ==> HTTP/1.1 200 OK Server: ocsp_responder Content-Length: 724 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Date: Thu 19 Oct 2023 21:39:48 GMT Cache-Control: public max-age=14400 Content-Type: application/ocsp-response Age: 645 with response body ==>308202D00A0100A08202C9308202C506092B0601050507300101048202B6308202B230819BA2160414E4AF2B26711A2B4827852F52662CEFF08913713E180F32....... "GET /gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.pki.goog" Response ==> HTTP/1.1 200 OK Server: ocsp_responder Content-Length: 1445 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Date: Thu 19 Oct 2023 21:05:05 GMT Cache-Control: public max-age=14400 Content-Type: application/ocsp-response Age: 2728 with response body ==>308205A10A0100A082059A3082059606092B0601050507300101048205873082058330819EA2160414D49BADF2AB3CB9FF1A3E0C506DCF192780868DAA180F32....... "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEATh56TcXPLzbcArQrhdFZ8%3D HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.digicert.com" Response ==> HTTP/1.1 200 OK Accept-Ranges: bytes Age: 2243 Cache-Control: max-age=7200 Content-Type: application/ocsp-response Date: Thu 19 Oct 2023 21:50:34 GMT Last-Modified: Thu 19 Oct 2023 21:13:11 GMT Server: ECAcc (sac/254A) X-Cache: HIT Content-Length: 471 with response body ==>308201D30A0100A08201CC308201C806092B0601050507300101048201B9308201B530819EA2160414B13EC36903F8BF4701D498261A0802EF63642BC3180F32....... "GET /gts1c3/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEQDD4iAmv7K7FRC9GgFEgKKE HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.pki.goog" Response ==> HTTP/1.1 200 OK Server: ocsp_responder Content-Length: 472 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Date: Thu 19 Oct 2023 21:28:20 GMT Cache-Control: public max-age=14400 Content-Type: application/ocsp-response Age: 1334 with response body ==>308201D40A0100A08201CD308201C906092B0601050507300101048201BA308201B630819FA21604148A747FAF85CDEE95CD3D9CD0E24614F371351D27180F32....... "GET /gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.pki.goog" Response ==> HTTP/1.1 200 OK Server: ocsp_responder Content-Length: 1445 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Date: Thu 19 Oct 2023 21:05:05 GMT Cache-Control: public max-age=14400 Content-Type: application/ocsp-response Age: 2730 with response body ==>308205A10A0100A082059A3082059606092B0601050507300101048205873082058330819EA2160414D49BADF2AB3CB9FF1A3E0C506DCF192780868DAA180F32....... "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTPJvUY%2Bsl%2Bj4yzQuAcL2oQno5fCgQUUWj%2FkK8CB3U8zNllZGKiErhZcjsCEAEjvRUG64sR2nXnhnVUNII%3D HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.digicert.com" Response ==> HTTP/1.1 200 OK Accept-Ranges: bytes Age: 2201 Cache-Control: max-age=7200 Content-Type: application/ocsp-response Date: Thu 19 Oct 2023 21:50:36 GMT Last-Modified: Thu 19 Oct 2023 21:13:55 GMT Server: ECAcc (sac/2536) X-Cache: HIT Content-Length: 471 with response body ==>308201D30A0100A08201CC308201C806092B0601050507300101048201B9308201B530819EA21604145168FF90AF0207753CCCD9656462A212B859723B180F32....... "GET /gts1c3/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEQDHFurBkDkysBLRERRg7lfk HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.pki.goog" Response ==> HTTP/1.1 200 OK Server: ocsp_responder Content-Length: 472 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Date: Thu 19 Oct 2023 20:57:38 GMT Cache-Control: public max-age=14400 Content-Type: application/ocsp-response Age: 3179 with response body ==>308201D40A0100A08201CD308201C906092B0601050507300101048201BA308201B630819FA21604148A747FAF85CDEE95CD3D9CD0E24614F371351D27180F32....... "GET /DigiCertGlobalRootG3.crt HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: cacerts.digicert.com" Response ==> HTTP/1.1 200 OK Accept-Ranges: bytes Age: 118887 cache-control: max-age=172800 public Content-Type: application/pkix-cert Date: Thu 19 Oct 2023 21:50:40 GMT Etag: "614b5ba7-243" expires: Sat 21 Oct 2023 21:50:40 GMT last-modified: Wed 22 Sep 2021 16:36:55 GMT Server: ECAcc (sac/253C) X-Cache: HIT Content-Length: 579 with response body ==>3082023F308201C5A0030201020210055556BCF25EA43535C3A40FD5AB4572300A06082A8648CE3D0403033061310B3009060355040613025553311530130603....... "GET /DigiCertGlobalRootG3.crt HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: cacerts.digicert.com" Response ==> HTTP/1.1 200 OK Accept-Ranges: bytes Age: 118889 cache-control: max-age=172800 public Content-Type: application/pkix-cert Date: Thu 19 Oct 2023 21:50:42 GMT Etag: "614b5ba7-243" expires: Sat 21 Oct 2023 21:50:42 GMT last-modified: Wed 22 Sep 2021 16:36:55 GMT Server: ECAcc (sac/253C) X-Cache: HIT Content-Length: 579 with response body ==>3082023F308201C5A0030201020210055556BCF25EA43535C3A40FD5AB4572300A06082A8648CE3D0403033061310B3009060355040613025553311530130603....... "GET /DigiCertGlobalRootG3.crt HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: cacerts.digicert.com" Response ==> HTTP/1.1 200 OK Accept-Ranges: bytes Age: 118890 cache-control: max-age=172800 public Content-Type: application/pkix-cert Date: Thu 19 Oct 2023 21:50:43 GMT Etag: "614b5ba7-243" expires: Sat 21 Oct 2023 21:50:43 GMT last-modified: Wed 22 Sep 2021 16:36:55 GMT Server: ECAcc (sac/253C) X-Cache: HIT Content-Length: 579 with response body ==>3082023F308201C5A0030201020210055556BCF25EA43535C3A40FD5AB4572300A06082A8648CE3D0403033061310B3009060355040613025553311530130603....... "GET /DigiCertGlobalRootG3.crt HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: cacerts.digicert.com" Response ==> HTTP/1.1 200 OK Accept-Ranges: bytes Age: 118891 cache-control: max-age=172800 public Content-Type: application/pkix-cert Date: Thu 19 Oct 2023 21:50:44 GMT Etag: "614b5ba7-243" expires: Sat 21 Oct 2023 21:50:44 GMT last-modified: Wed 22 Sep 2021 16:36:55 GMT Server: ECAcc (sac/253C) X-Cache: HIT Content-Length: 579 with response body ==>3082023F308201C5A0030201020210055556BCF25EA43535C3A40FD5AB4572300A06082A8648CE3D0403033061310B3009060355040613025553311530130603....... "GET /gts1c3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEBM9NSid4pOvCr35n90pfXk%3D HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.pki.goog" Response ==> HTTP/1.1 200 OK Server: ocsp_responder Content-Length: 471 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Date: Thu 19 Oct 2023 21:26:35 GMT Cache-Control: public max-age=14400 Content-Type: application/ocsp-response Age: 1450 with response body ==>308201D30A0100A08201CC308201C806092B0601050507300101048201B9308201B530819EA21604148A747FAF85CDEE95CD3D9CD0E24614F371351D27180F32....... "GET /gts1c3/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEQDLYsQ7yv2LMwmxOu34tlfG HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.pki.goog" Response ==> HTTP/1.1 200 OK Server: ocsp_responder Content-Length: 472 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Date: Thu 19 Oct 2023 21:18:42 GMT Cache-Control: public max-age=14400 Content-Type: application/ocsp-response Age: 1927 with response body ==>308201D40A0100A08201CD308201C906092B0601050507300101048201BA308201B630819FA21604148A747FAF85CDEE95CD3D9CD0E24614F371351D27180F32....... "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAzlnDD9eoNTLi0BRrMy%2BWU%3D HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.digicert.com" Response ==> HTTP/1.1 200 OK Accept-Ranges: bytes Age: 1777 Cache-Control: max-age=7200 Content-Type: application/ocsp-response Date: Thu 19 Oct 2023 21:50:52 GMT Last-Modified: Thu 19 Oct 2023 21:21:15 GMT Server: ECAcc (sac/2568) X-Cache: HIT Content-Length: 313 with response body ==>308201350A0100A082012E3082012A06092B06010505073001010482011B3082011730819EA2160414B3DB48A4F9A1C5D8AE3641CC1163696229BC4BC6180F32....... "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAzlnDD9eoNTLi0BRrMy%2BWU%3D HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.digicert.com" Response ==> HTTP/1.1 200 OK Accept-Ranges: bytes Age: 1778 Cache-Control: max-age=7200 Content-Type: application/ocsp-response Date: Thu 19 Oct 2023 21:50:53 GMT Last-Modified: Thu 19 Oct 2023 21:21:15 GMT Server: ECAcc (sac/2568) X-Cache: HIT Content-Length: 313 with response body ==>308201350A0100A082012E3082012A06092B06010505073001010482011B3082011730819EA2160414B3DB48A4F9A1C5D8AE3641CC1163696229BC4BC6180F32....... "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEA177el9ggmWelJjG4vdGL0%3D HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.digicert.com" Response ==> HTTP/1.1 200 OK Accept-Ranges: bytes Age: 2087 Cache-Control: max-age=7200 Content-Type: application/ocsp-response Date: Thu 19 Oct 2023 21:51:34 GMT Last-Modified: Thu 19 Oct 2023 21:16:47 GMT Server: ECAcc (sac/254A) X-Cache: HIT Content-Length: 471 with response body ==>308201D30A0100A08201CC308201C806092B0601050507300101048201B9308201B530819EA21604144E2254201895E6E36EE60FFAFAB912ED06178F39180F32....... "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.digicert.com" Response ==> HTTP/1.1 200 OK Accept-Ranges: bytes Age: 3134 Cache-Control: max-age=7200 Content-Type: application/ocsp-response Date: Thu 19 Oct 2023 21:51:38 GMT Last-Modified: Thu 19 Oct 2023 20:59:24 GMT Server: ECAcc (sac/251B) X-Cache: HIT Content-Length: 471 with response body ==>308201D30A0100A08201CC308201C806092B0601050507300101048201B9308201B530819EA21604144E2254201895E6E36EE60FFAFAB912ED06178F39180F32....... "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBT3xL4LQLXDRDM9P665TW442vrsUQQUReuir%2FSSy4IxLVGLp6chnfNtyA8CEA6bGI750C3n79tQ4ghAGFo%3D HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.digicert.com" Response ==> HTTP/1.1 200 OK Accept-Ranges: bytes Age: 348 Cache-Control: max-age=7200 Content-Type: application/ocsp-response Date: Thu 19 Oct 2023 21:51:59 GMT Last-Modified: Thu 19 Oct 2023 21:46:11 GMT Server: ECAcc (sac/254D) X-Cache: HIT Content-Length: 471 with response body ==>308201D30A0100A08201CC308201C806092B0601050507300101048201B9308201B530819EA216041445EBA2AFF492CB82312D518BA7A7219DF36DC80F180F32.......70:T1334,"2Xd7490.exe" touched "NetworkListManager" (Path: "HKCU\CLSID\{DCB00C01-570F-4A9B-8D69-199FDBA5723B}") "2Xd7490.exe" touched "Network List Manager" (Path: "HKCU\CLSID\{A47979D2-C419-11D9-A5B4-001185AD2B89}") "2Xd7490.exe" touched "PSFactoryBuffer" (Path: "HKLM\SOFTWARE\CLASSES\CLSID\{1299CF18-C4F5-4B6A-BB0F-2299F0398E27}") "2Xd7490.exe" touched "WinInetBroker Class" (Path: "HKCU\CLSID\{C39EE728-D419-4BD4-A3EF-EDA059DBD935}\TREATAS") "4IL656Nj.exe" touched "WBEM Locator" (Path: "HKCU\CLSID\{4590F811-1D3A-11D0-891F-00AA004B2E24}\INPROCSERVER32") "4IL656Nj.exe" touched "Windows Management and Instrumentation" (Path: "HKCU\CLSID\{8BC3F05E-D86B-11D0-A075-00C04FB68820}\LOCALSERVER32") "4IL656Nj.exe" touched "WbemDefaultPathParser" (Path: "HKCU\CLSID\{CF4CC405-E2C5-4DDD-B3CE-5E7582D8C9FA}\INPROCSERVER32") "4IL656Nj.exe" touched "Microsoft WBEM (non)Standard Marshaling for IWbemServices" (Path: "HKCU\CLSID\{D68AF00A-29CB-43FA-8504-CE99A996D9EA}\TREATAS") "4IL656Nj.exe" touched "Microsoft WBEM (non)Standard Marshaling for IEnumWbemClassObject" (Path: "HKCU\CLSID\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\TREATAS") "5Dy6eL3.exe" touched "Computer" (Path: "HKCU\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\SHELLFOLDER") "5Dy6eL3.exe" touched "Memory Mapped Cache Mgr" (Path: "HKCU\CLSID\{1F486A52-3CB1-48FD-8F50-B8DC300D9F9D}") "5Dy6eL3.exe" touched "UsersFiles" (Path: "HKCU\CLSID\{59031A47-3F72-44A7-89C5-5595FE6B30EE}\SHELLFOLDER") "5Dy6eL3.exe" touched "Property System Both Class Factory" (Path: "HKCU\CLSID\{76765B11-3F95-4AF2-AC9D-EA55D8994F1A}") "5Dy6eL3.exe" touched "delegate folder that appears in Users Files Folder" (Path: "HKCU\CLSID\{DFFACDC5-679F-4156-8947-C5C76BC0B67F}\SHELLFOLDER") "5Dy6eL3.exe" touched "Shell File System Folder" (Path: "HKCU\CLSID\{0E5AAE11-A475-4C5B-AB00-C66DE400274E}\INPROCSERVER32") "5Dy6eL3.exe" touched "Security Manager" (Path: "HKCU\CLSID\{7B8A2D94-0AC9-11D1-896C-00C04FB6BFC4}\TREATAS") "explothe.exe" touched "Network" (Path: "HKCU\CLSID\{208D2C60-3AEA-1069-A2D7-08002B30309D}\SHELLFOLDER") "explothe.exe" touched "Recycle Bin" (Path: "HKCU\CLSID\{645FF040-5081-101B-9F08-00AA002F954E}\SHELLFOLDER") "explothe.exe" touched "Control Panel" (Path: "HKCU\CLSID\{26EE0668-A00A-44D7-9371-BEB064C98683}\SHELLFOLDER") "explothe.exe" touched "UsersLibraries" (Path: "HKCU\CLSID\{031E4825-7B94-4DC3-B131-E946B44C8DD5}\SHELLFOLDER") "explothe.exe" touched "CLSID_SearchFolder" (Path: "HKCU\CLSID\{04731B67-D933-450A-90E6-4ACD2E9408FE}\SHELLFOLDER") "explothe.exe" touched "Microsoft OneNote Namespace Extension for Windows Desktop Search" (Path: "HKCU\CLSID\{0875DCB6-C686-4243-9432-ADCCF0B9F2D7}\SHELLFOLDER") "explothe.exe" touched "IE History and Feeds Shell Data Source for Windows Search" (Path: "HKCU\CLSID\{11016101-E366-4D22-BC06-4ADA335C892B}\SHELLFOLDER") "explothe.exe" touched "@C:\Program Files (x86)\Microsoft Office\Office15\MAPISHELL.DLL,-110" (Path: "HKCU\CLSID\{138508BC-1E03-49EA-9C8F-EA9E1D05D65D}\SHELLFOLDER") "explothe.exe" touched "Public Folder" (Path: "HKCU\CLSID\{4336A54D-038B-4685-AB02-99BB52D3FB8B}\SHELLFOLDER") "explothe.exe" touched "Control Panel command object for Start menu and desktop" (Path: "HKCU\CLSID\{5399E694-6CE5-4D6C-8FCE-1D8870FDCBA0}\SHELLFOLDER") "explothe.exe" touched "@%systemroot%\system32\mssvp.dll,-110" (Path: "HKCU\CLSID\{89D83576-6BD1-4C86-9454-BEB04E94C819}\SHELLFOLDER") "explothe.exe" touched "DXP" (Path: "HKCU\CLSID\{8FD8B88D-30E1-4F25-AC2B-553D3D65F0EA}\SHELLFOLDER") "explothe.exe" touched "CLSID_SearchHome" (Path: "HKCU\CLSID\{9343812E-1C37-4A49-A12E-4B2D810D956B}\SHELLFOLDER") "explothe.exe" touched "Windows Search Service Media Center Namespace Extension Handler" (Path: "HKCU\CLSID\{98D99750-0B8A-4C59-9151-589053683D73}\SHELLFOLDER") "explothe.exe" touched "Other Users Folder" (Path: "HKCU\CLSID\{B4FB3F98-C1EA-428D-A78A-D1F5659CBA93}\SHELLFOLDER") "explothe.exe" touched "@%systemroot%\system32\mssvp.dll,-112" (Path: "HKCU\CLSID\{BD7A2E7B-21CB-41B2-A086-B309680C6B7E}\SHELLFOLDER") "explothe.exe" touched "CLSID_StartMenuProviderFolder" (Path: "HKCU\CLSID\{DAF95313-E44D-46AF-BE1B-CBACEA2C3065}\SHELLFOLDER") "explothe.exe" touched "CLSID_StartMenuPathCompleteProviderFolder" (Path: "HKCU\CLSID\{E345F35F-9397-435C-8F95-4E922C26259E}\SHELLFOLDER") "explothe.exe" touched "Games Explorer" (Path: "HKCU\CLSID\{ED228FDF-9EA8-4870-83B1-96B02CFE0D52}\SHELLFOLDER") "explothe.exe" touched "Computers and Devices" (Path: "HKCU\CLSID\{F02C1A0D-BE21-4350-88B0-7367FC96EF3C}\SHELLFOLDER") "explothe.exe" touched "Sticky Notes Namespace Extension for Windows Desktop Search" (Path: "HKCU\CLSID\{F3F5824C-AD58-4728-AF59-A1EBE3392799}\SHELLFOLDER") "cmd.exe" touched "Application Registration" (Path: "HKCU\CLSID\{591209C7-767B-42B2-9FBA-44EE4615F2C7}\INPROCSERVER32") "schtasks.exe" touched "TaskScheduler class" (Path: "HKCU\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}")71:T567,"Tar22E7.tmp" has type "data" - Location: [%TEMP%\Tar22E7.tmp] "Cab1B67.tmp" has type "Microsoft Cabinet archive data Windows 2000/XP setup 63165 bytes 1 file at 0x2c +A "authroot.stl" number 1 6 datablocks 0x1 compression" "~DF4F7256941D51C325.TMP" has type "data" "~DF2A2B8F547BF32EC1.TMP" has type "data" - Location: [%TEMP%\~DF2A2B8F547BF32EC1.TMP] "~DF6559E3A63B633307.TMP" has type "data" - Location: [%TEMP%\~DF6559E3A63B633307.TMP] "~DFD011C8FEE25FC2F8.TMP" has type "data" - Location: [%TEMP%\~DFD011C8FEE25FC2F8.TMP] "~DFD6CA04FD7E4CAB29.TMP" has type "data" "~DFD3329763F53D663F.TMP" has type "data" - Location: [%TEMP%\~DFD3329763F53D663F.TMP] "~DFB4935B05D03CBF4E.TMP" has type "data" "Tar270E.tmp" has type "data" - Location: [%TEMP%\Tar270E.tmp] "Tar1B68.tmp" has type "data" "Tar1829.tmp" has type "data" "Cab22D7.tmp" has type "Microsoft Cabinet archive data Windows 2000/XP setup 63165 bytes 1 file at 0x2c +A "authroot.stl" number 1 6 datablocks 0x1 compression" - Location: [%TEMP%\Cab22D7.tmp] "Cab270D.tmp" has type "Microsoft Cabinet archive data Windows 2000/XP setup 63165 bytes 1 file at 0x2c +A "authroot.stl" number 1 6 datablocks 0x1 compression" - Location: [%TEMP%\Cab270D.tmp] "Cab1828.tmp" has type "Microsoft Cabinet archive data Windows 2000/XP setup 63165 bytes 1 file at 0x2c +A "authroot.stl" number 1 6 datablocks 0x1 compression"72:T5118,Found requests in header "GET /login HTTP/1.1Accept: text/html, application/xhtml+xml, */*User-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateDNT: 1Host: www.facebook.comConnection: Keep-AliveAccept-Language: en-US"; in File: "SSL") Found requests in header "GET / HTTP/1.1Accept: text/html, application/xhtml+xml, */*Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: www.youtube.comDNT: 1Connection: Keep-AliveCookie: CONSENT=WP.2676ba"; in File: "SSL") Found requests in header "GET /supported_browsers?next_url=https%3A%2F%2Fwww.youtube.com%2F HTTP/1.1Accept: text/html, application/xhtml+xml, */*Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: www.youtube.comCookie: CONSENT=WP.2676baConnection: Keep-AliveDNT: 1"; in File: "SSL") Found requests in header "GET /img/desktop/supported_browsers/opera.png HTTP/1.1Accept: image/png, image/svg+xml, image/*;q=0.8, */*;q=0.5Referer: https://www.youtube.com/supported_browsers?next_url=https%3A%2F%2Fwww.youtube.com%2FAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: www.youtube.comDNT: 1Connection: Keep-AliveCookie: CONSENT=WP.2676ba; hideBrowserUpgradeBox=true; YSC=saOgiktOres; VISITOR_INFO1_LIVE=yccoFA1-rho; VISITOR_PRIVACY_METADATA=CgJVUxICGgA%3D"; in File: "SSL") Found requests in header "GET /favicon.ico HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoHost: www.youtube.comDNT: 1Connection: Keep-AliveCookie: CONSENT=WP.2676ba; hideBrowserUpgradeBox=true; YSC=saOgiktOres; VISITOR_INFO1_LIVE=yccoFA1-rho; VISITOR_PRIVACY_METADATA=CgJVUxICGgA%3D"; in File: "SSL") Found requests in header "GET /ServiceLogin?passive=1209600&continue=https%3A%2F%2Faccounts.google.com%2F&followup=https%3A%2F%2Faccounts.google.com%2F HTTP/1.1Accept: text/html, application/xhtml+xml, */*User-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateDNT: 1Host: accounts.google.comCookie: __Host-GAPS=1:_nflcPvmGo75KlAHti5N2R4xdxLlfA:T-v2HUSVK2qm3UlHConnection: Keep-AliveAccept-Language: en-US"; in File: "SSL") Found requests in header "GET /InteractiveLogin?continue=https://accounts.google.com/&followup=https://accounts.google.com/&passive=1209600&ifkv=AVQVeyzsopxW0YWb8J66SDwJFuoa6xmwicgbRiWPcxZ0Cp-ZYxxxrGT3uKoYD8GgK3QTQEco6tj4Ww HTTP/1.1Accept: text/html, application/xhtml+xml, */*User-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateDNT: 1Host: accounts.google.comCookie: __Host-GAPS=1:88SAWDLvdawd5YFijEA6MeVUsPdAhQ:UtgHKIMtR0vi1f29Connection: Keep-AliveAccept-Language: en-US"; in File: "SSL") Found requests in header "GET /v3/signin/identifier?continue=https%3A%2F%2Faccounts.google.com%2F&followup=https%3A%2F%2Faccounts.google.com%2F&ifkv=AVQVeyx5kPECWo_ZMaJTFRVVJ0PiYjBX5QcJn3-qFmoMUBUNLsKhj_eShdLNGxHeGwH5EA5tZXeI4A&passive=1209600&flowName=GlifWebSignIn&flowEntry=ServiceLogin&dsh=S553743099%3A1697752233867861&theme=glif HTTP/1.1Accept: text/html, application/xhtml+xml, */*User-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateDNT: 1Host: accounts.google.comCookie: __Host-GAPS=1:88SAWDLvdawd5YFijEA6MeVUsPdAhQ:UtgHKIMtR0vi1f29Connection: Keep-AliveAccept-Language: en-US"; in File: "SSL") Found requests in header "GET /favicon.ico HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoHost: accounts.google.comDNT: 1Connection: Keep-AliveCookie: __Host-GAPS=1:M8_dMEMdOIqCDFqtCrPo-BB9U2eSag:PABni8TxHBw6u21B"; in File: "SSL") Found requests in header "POST /v3/signin/_/AccountsSignInUi/data/batchexecute?rpcids=UEkKwb&source-path=%2Fv3%2Fsignin%2Fidentifier&f.sid=-7727457537996696095&bl=boq_identityfrontendauthuiserver_20231015.08_p1&hl=en-US&_reqid=19243&rt=c HTTP/1.1Accept: */*X-Same-Domain: 1x-goog-ext-278367001-jspb: ["GlifWebSignIn"]x-goog-ext-391502476-jspb: ["S553743099:1697752233867861",null,null,"AVQVeyx5kPECWo_ZMaJTFRVVJ0PiYjBX5QcJn3-qFmoMUBUNLsKhj_eShdLNGxHeGwH5EA5tZXeI4A"]Content-Type: application/x-www-form-urlencoded;charset=utf-8Referer: https://accounts.google.com/Accept-Language: en-USAccept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoHost: accounts.google.comContent-Length: 164DNT: 1Connection: Keep-AliveCache-Control: no-cacheCookie: __Host-GAPS=1:M8_dMEMdOIqCDFqtCrPo-BB9U2eSag:PABni8TxHBw6u21B; OTZ=7257769_48_52_123900_48_436380"; in File: "SSL") Found requests in header "GET /_/bscframe HTTP/1.1Accept: text/html, application/xhtml+xml, */*Referer: https://accounts.google.com/Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: accounts.google.comDNT: 1Connection: Keep-AliveCookie: __Host-GAPS=1:M8_dMEMdOIqCDFqtCrPo-BB9U2eSag:PABni8TxHBw6u21B; OTZ=7257769_48_52_123900_48_436380"; in File: "SSL") Found requests in header "GET /generate_204?GExVSg HTTP/1.1Accept: image/png, image/svg+xml, image/*;q=0.8, */*;q=0.5Referer: https://accounts.google.com/Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: accounts.google.comDNT: 1Connection: Keep-AliveCookie: __Host-GAPS=1:6LlMESmd82MN9-nw32y4s2UWMc9-MA:YhgvKXOosmySOFE-; OTZ=7257769_48_52_123900_48_436380; NID=511=fpCSj8v6xfXnxydLI1CLa8WzN_u5ms28rdPx5LCI0fXSCzoZObAW4h-9FIrZwmDFzTb3jzbYqxdZzKUG5bEgL7eMCWGNWPuj27Ju79eD8NGAHaXLMbXKs-x6BI5tgWErBBPo66flIP5yGyoCpO1x4Z7MeuBc2NJWQYJduvnJtKU"; in File: "SSL") Found requests in header "GET /v3/signin/_/AccountsSignInUi/gen204/?tmambps=7.736842736139882e-8&rtembps=-1&rttms=3 HTTP/1.1Accept: image/png, image/svg+xml, image/*;q=0.8, */*;q=0.5Referer: https://accounts.google.com/Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: accounts.google.comDNT: 1Connection: Keep-AliveCookie: __Host-GAPS=1:6LlMESmd82MN9-nw32y4s2UWMc9-MA:YhgvKXOosmySOFE-; OTZ=7257769_48_52_123900_48_436380; NID=511=fpCSj8v6xfXnxydLI1CLa8WzN_u5ms28rdPx5LCI0fXSCzoZObAW4h-9FIrZwmDFzTb3jzbYqxdZzKUG5bEgL7eMCWGNWPuj27Ju79eD8NGAHaXLMbXKs-x6BI5tgWErBBPo66flIP5yGyoCpO1x4Z7MeuBc2NJWQYJduvnJtKU"; in File: "SSL") Found requests in header "GET /restart?continue=https%3A%2F%2Faccounts.google.com%2F&dsh=S553743099%3A1697752233867861&flowEntry=ServiceLogin&flowName=GlifWebSignIn&followup=https%3A%2F%2Faccounts.google.com%2F&ifkv=AVQVeyx5kPECWo_ZMaJTFRVVJ0PiYjBX5QcJn3-qFmoMUBUNLsKhj_eShdLNGxHeGwH5EA5tZXeI4A&theme=glif HTTP/1.1Accept: text/html, application/xhtml+xml, */*Referer: https://accounts.google.com/Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: accounts.google.comDNT: 1Connection: Keep-AliveCookie: __Host-GAPS=1:6LlMESmd82MN9-nw32y4s2UWMc9-MA:YhgvKXOosmySOFE-; OTZ=7257769_48_52_123900_48_436380; NID=511=fpCSj8v6xfXnxydLI1CLa8WzN_u5ms28rdPx5LCI0fXSCzoZObAW4h-9FIrZwmDFzTb3jzbYqxdZzKUG5bEgL7eMCWGNWPuj27Ju79eD8NGAHaXLMbXKs-x6BI5tgWErBBPo66flIP5yGyoCpO1x4Z7MeuBc2NJWQYJduvnJtKU"; in File: "SSL") Found requests in header "GET /ServiceLogin?continue=https%3A%2F%2Faccounts.google.com%2F&flowEntry=ServiceLogin&flowName=GlifWebSignIn&followup=https%3A%2F%2Faccounts.google.com%2F&ifkv=AVQVeyx5kPECWo_ZMaJTFRVVJ0PiYjBX5QcJn3-qFmoMUBUNLsKhj_eShdLNGxHeGwH5EA5tZXeI4A&theme=glif HTTP/1.1Accept: text/html, application/xhtml+xml, */*Referer: https://accounts.google.com/Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: accounts.google.comCookie: __Host-GAPS=1:5yIXSLcdJpJUwWidFsqOsYZ4tsa1hg:ScMgotaFGDZvIsoq; OTZ=7257769_48_52_123900_48_436380; NID=511=fpCSj8v6xfXnxydLI1CLa8WzN_u5ms28rdPx5LCI0fXSCzoZObAW4h-9FIrZwmDFzTb3jzbYqxdZzKUG5bEgL7eMCWGNWPuj27Ju79eD8NGAHaXLMbXKs-x6BI5tgWErBBPo66flIP5yGyoCpO1x4Z7MeuBc2NJWQYJduvnJtKUConnection: Keep-AliveDNT: 1"; in File: "SSL") Found requests in header "GET /InteractiveLogin?continue=https://accounts.google.com/&flowEntry=ServiceLogin&flowName=GlifWebSignIn&followup=https://accounts.google.com/&ifkv=AVQVeyx5kPECWo_ZMaJTFRVVJ0PiYjBX5QcJn3-qFmoMUBUNLsKhj_eShdLNGxHeGwH5EA5tZXeI4A&theme=glif HTTP/1.1Accept: text/html, application/xhtml+xml, */*Referer: https://accounts.google.com/Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: accounts.google.comConnection: Keep-AliveDNT: 1Cookie: __Host-GAPS=1:5yIXSLcdJpJUwWidFsqOsYZ4tsa1hg:ScMgotaFGDZvIsoq; OTZ=7257769_48_52_123900_48_436380; NID=511=fpCSj8v6xfXnxydLI1CLa8WzN_u5ms28rdPx5LCI0fXSCzoZObAW4h-9FIrZwmDFzTb3jzbYqxdZzKUG5bEgL7eMCWGNWPuj27Ju79eD8NGAHaXLMbXKs-x6BI5tgWErBBPo66flIP5yGyoCpO1x4Z7MeuBc2NJWQYJduvnJtKU"; in File: "SSL") Found requests in header "GET /v3/signin/identifier?continue=https%3A%2F%2Faccounts.google.com%2F&flowEntry=ServiceLogin&flowName=GlifWebSignIn&followup=https%3A%2F%2Faccounts.google.com%2F&ifkv=AVQVeywMZk6zU-HVpHQQR107y99cfbvYQQkOFdExWXbg5TT3GMucBlv9yhq2RzlTAma1go8bl9i7mw&theme=glif&dsh=S369162045%3A1697752321675759 HTTP/1.1Accept: text/html, application/xhtml+xml, */*Referer: https://accounts.google.com/Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: accounts.google.comDNT: 1Connection: Keep-AliveCookie: __Host-GAPS=1:5yIXSLcdJpJUwWidFsqOsYZ4tsa1hg:ScMgotaFGDZvIsoq; OTZ=7257769_48_52_123900_48_436380; NID=511=fpCSj8v6xfXnxydLI1CLa8WzN_u5ms28rdPx5LCI0fXSCzoZObAW4h-9FIrZwmDFzTb3jzbYqxdZzKUG5bEgL7eMCWGNWPuj27Ju79eD8NGAHaXLMbXKs-x6BI5tgWErBBPo66flIP5yGyoCpO1x4Z7MeuBc2NJWQYJduvnJtKU"; in File: "SSL") Found requests in header "GET /_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en_US.C6tNd3FBrA8.es5.O/am=DmBFZI4NgOD_oonn7xknhwEAAAAAAAAAANZAdg/d=1/excm=_b,_tp,identifierview/ed=1/dg=0/wt=2/ujg=1/rs=AOaEmlHK_6NZi0yeSin1ommAktmAN0EneA/m=_b,_tp HTTP/1.1Accept: application/javascript, */*;q=0.8Referer: https://accounts.google.com/Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: www.gstatic.comDNT: 1Connection: Keep-Alive"; in File: "SSL") Found requests in header "GET /_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en_US.C6tNd3FBrA8.es5.O/ck=boq-identity.AccountsSignInUi.QUjh89dKB-E.L.I11.O/am=DmBFZI4NgOD_oonn7xknhwEAAAAAAAAAANZAdg/d=1/exm=_b,_tp/excm=_b,_tp,identifierview/ed=1/wt=2/ujg=1/rs=AOaEmlHDcUi9ID1jIalJtFQkB5xrA2xb_g/ee=ASJRFf:LANRae;Al0B8:kibjWe;DaIJ8c:iAskyc;EVNhjf:pw70Gc;EkYFhd:BDnJmb;EmZ2Bf:zr1jrb;Erl4fe:FloWmf;JsbNhc:Xd8iUd;LBgRLc:XVMNvd;Me32dd:MEeYgc;NPKaK:PVlQOd;NSEoX:lazG7b;Oj465e:KG2eXe;Pjplud:EEDORb;QGR0gd:Mlhmy;SMDL4c:K0PMbc;SNUn3:ZwDk9d;UpnZUd:nnwwYc;XdiAjb:NLiXbe;a56pNe:JEfCwb;cEt90b:ws9Tlc;dIoSBb:SpsfSb;eBAeSb:zbML3c;iFQyKf:vfuNJf;io8t5d:yDVVkb;kMFpHd:OTA3Ae;nAFL3:NTMZac;nTuGK:JKNPM;oGtAuc:sOXFj;oSUNyd:K0PMbc;oXZmbc:tUnxGc;pXdRYb:fqEYIb;qddgKe:xQtZb;sP4Vbe:VwDzFe;uY49fb:COQbmf;ul9GGd:VDovNc;vNjB7d:YTxL4;wR5FRb:siKnQd;yxTchf:KUM7Z/m=byfTOb,lsjVmc,LEikZe HTTP/1.1Accept: application/javascript, */*;q=0.8Referer: https://accounts.google.com/Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: www.gstatic.comDNT: 1Connection: Keep-Alive"; in File: "SSL") Found requests in header "GET /_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en_US.C6tNd3FBrA8.es5.O/ck=boq-identity.AccountsSignInUi.QUjh89dKB-E.L.I11.O/am=DmBFZI4NgOD_oonn7xknhwEAAAAAAAAAANZAdg/d=1/exm=LEikZe,_b,_tp,byfTOb,lsjVmc/excm=_b,_tp,identifierview/ed=1/wt=2/ujg=1/rs=AOaEmlHDcUi9ID1jIalJtFQkB5xrA2xb_g/ee=ASJRFf:LANRae;Al0B8:kibjWe;DaIJ8c:iAskyc;EVNhjf:pw70Gc;EkYFhd:BDnJmb;EmZ2Bf:zr1jrb;Erl4fe:FloWmf;JsbNhc:Xd8iUd;LBgRLc:XVMNvd;Me32dd:MEeYgc;NPKaK:PVlQOd;NSEoX:lazG7b;Oj465e:KG2eXe;Pjplud:EEDORb;QGR0gd:Mlhmy;SMDL4c:K0PMbc;SNUn3:ZwDk9d;UpnZUd:nnwwYc;XdiAjb:NLiXbe;a56pNe:JEfCwb;cEt90b:ws9Tlc;dIoSBb:SpsfSb;eBAeSb:zbML3c;iFQyKf:vfuNJf;io8t5d:yDVVkb;kMFpHd:OTA3Ae;nAFL3:NTMZac;nTuGK:JKNPM;oGtAuc:sOXFj;oSUNyd:K0PMbc;oXZmbc:tUnxGc;pXdRYb:fqEYIb;qddgKe:xQtZb;sP4Vbe:VwDzFe;uY49fb:COQbmf;ul9GGd:VDovNc;vNjB7d:YTxL4;wR5FRb:siKnQd;yxTchf:KUM7Z/m=n73qwf,SCuOPb,IZT63,vfuNJf,UUJqVe,ws9Tlc,siKnQd,STuCOe,njlZCf,fJpY1b,b3kMqb,EGw7Od,ZUKRxc,my67ye,t2srLd,EN3i8d,hmHrle,mWLH9d,NOeYWe,O6y8ed,fqEYIb,PrPYRd,MpJwZc,hc6Ubd,KUM7Z,oLggrd,inNHtf,L1AAkb,lwddkf,SpsfSb,tUnxGc,aW3pY,EFQ78c,xQtZb,I6YDgd,zbML3c,zr1jrb,vHEMJe,YHI3We,YTxL4,bSspM,Uas9Hd,zy0vNb,K0PMbc,AvtSve,qmdT9,xBaz7b,eVCnO,LDQI HTTP/1.1Accept: application/javascript, */*;q=0.8Referer: https://accounts.google.com/Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: www.gstatic.comDNT: 1Connection: Keep-Alive"; in File: "SSL") Found requests in header "GET /_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en_US.C6tNd3FBrA8.es5.O/ck=boq-identity.AccountsSignInUi.QUjh89dKB-E.L.I11.O/am=DmBFZI4NgOD_oonn7xknhwEAAAAAAAAAANZAdg/d=1/exm=AvtSve,EFQ78c,EGw7Od,EN3i8d,I6YDgd,IZT63,K0PMbc,KUM7Z,L1AAkb,LDQI,LEikZe,MpJwZc,NOeYWe,O6y8ed,PrPYRd,SCuOPb,STuCOe,SpsfSb,UUJqVe,Uas9Hd,YHI3We,YTxL4,ZUKRxc,_b,_tp,aW3pY,b3kMqb,bSspM,byfTOb,eVCnO,fJpY1b,fqEYIb,hc6Ubd,hmHrle,inNHtf,lsjVmc,lwddkf,mWLH9d,my67ye,n73qwf,njlZCf,oLggrd,qmdT9,siKnQd,t2srLd,tUnxGc,vHEMJe,vfuNJf,ws9Tlc,xBaz7b,xQtZb,zbML3c,zr1jrb,zy0vNb/excm=_b,_tp,identifierview/ed=1/wt=2/ujg=1/rs=AOaEmlHDcUi9ID1jIalJtFQkB5xrA2xb_g/ee=ASJRFf:LANRae;Al0B8:kibjWe;DaIJ8c:iAskyc;EVNhjf:pw70Gc;EkYFhd:BDnJmb;EmZ2Bf:zr1jrb;Erl4fe:FloWmf;JsbNhc:Xd8iUd;LBgRLc:XVMNvd;Me32dd:MEeYgc;NPKaK:PVlQOd;NSEoX:lazG7b;Oj465e:KG2eXe;Pjplud:EEDORb;QGR0gd:Mlhmy;SMDL4c:K0PMbc;SNUn3:ZwDk9d;UpnZUd:nnwwYc;XdiAjb:NLiXbe;a56pNe:JEfCwb;cEt90b:ws9Tlc;dIoSBb:SpsfSb;eBAeSb:zbML3c;iFQyKf:vfuNJf;io8t5d:yDVVkb;kMFpHd:OTA3Ae;nAFL3:NTMZac;nTuGK:JKNPM;oGtAuc:sOXFj;oSUNyd:K0PMbc;oXZmbc:tUnxGc;pXdRYb:fqEYIb;qddgKe:xQtZb;sP4Vbe:VwDzFe;uY49fb:COQbmf;ul9GGd:VDovNc;vNjB7d:YTxL4;wR5FRb:siKnQd;yxTchf:KUM7Z/m=Wt6vjf,hhhU8,FCpbqb,WhJNk HTTP/1.1Accept: application/javascript, */*;q=0.8Referer: https://accounts.google.com/Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: www.gstatic.comDNT: 1Connection: Keep-Alive"; in File: "SSL") Found requests in header "GET /_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en_US.C6tNd3FBrA8.es5.O/ck=boq-identity.AccountsSignInUi.QUjh89dKB-E.L.I11.O/am=DmBFZI4NgOD_oonn7xknhwEAAAAAAAAAANZAdg/d=1/exm=AvtSve,EFQ78c,EGw7Od,EN3i8d,FCpbqb,I6YDgd,IZT63,K0PMbc,KUM7Z,L1AAkb,LDQI,LEikZe,MpJwZc,NOeYWe,O6y8ed,PrPYRd,RqjULd,SCuOPb,STuCOe,SpsfSb,UUJqVe,Uas9Hd,WhJNk,Wt6vjf,YHI3We,YTxL4,ZUKRxc,_b,_tp,aW3pY,b3kMqb,bSspM,byfTOb,eVCnO,fJpY1b,fqEYIb,hc6Ubd,hhhU8,hmHrle,inNHtf,lsjVmc,lwddkf,mWLH9d,my67ye,n73qwf,njlZCf,oLggrd,qmdT9,siKnQd,t2srLd,tUnxGc,vHEMJe,vfuNJf,ws9Tlc,xBaz7b,xQtZb,zbML3c,zr1jrb,zy0vNb/excm=_b,_tp,identifierview/ed=1/wt=2/ujg=1/rs=AOaEmlHDcUi9ID1jIalJtFQkB5xrA2xb_g/ee=ASJRFf:LANRae;Al0B8:kibjWe;DaIJ8c:iAskyc;EVNhjf:pw70Gc;EkYFhd:BDnJmb;EmZ2Bf:zr1jrb;Erl4fe:FloWmf;JsbNhc:Xd8iUd;LBgRLc:XVMNvd;Me32dd:MEeYgc;NPKaK:PVlQOd;NSEoX:lazG7b;Oj465e:KG2eXe;Pjplud:EEDORb;QGR0gd:Mlhmy;SMDL4c:K0PMbc;SNUn3:ZwDk9d;UpnZUd:nnwwYc;XdiAjb:NLiXbe;a56pNe:JEfCwb;cEt90b:ws9Tlc;dIoSBb:SpsfSb;eBAeSb:zbML3c;iFQyKf:vfuNJf;io8t5d:yDVVkb;kMFpHd:OTA3Ae;nAFL3:NTMZac;nTuGK:JKNPM;oGtAuc:sOXFj;oSUNyd:K0PMbc;oXZmbc:tUnxGc;pXdRYb:fqEYIb;qddgKe:xQtZb;sP4Vbe:VwDzFe;uY49fb:COQbmf;ul9GGd:VDovNc;vNjB7d:YTxL4;wR5FRb:siKnQd;yxTchf:KUM7Z/m=ltDFwf HTTP/1.1Accept: application/javascript, */*;q=0.8Referer: https://accounts.google.com/Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: www.gstatic.comDNT: 1Connection: Keep-Alive"; in File: "SSL") Found requests in header "GET /_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en_US.C6tNd3FBrA8.es5.O/ck=boq-identity.AccountsSignInUi.QUjh89dKB-E.L.I11.O/am=DmBFZI4NgOD_oonn7xknhwEAAAAAAAAAANZAdg/d=1/exm=AvtSve,EFQ78c,EGw7Od,EN3i8d,FCpbqb,I6YDgd,IZT63,K0PMbc,KUM7Z,L1AAkb,LDQI,LEikZe,MpJwZc,NOeYWe,O6y8ed,PrPYRd,RqjULd,SCuOPb,STuCOe,SpsfSb,UUJqVe,Uas9Hd,WhJNk,Wt6vjf,YHI3We,YTxL4,ZUKRxc,_b,_tp,aW3pY,b3kMqb,bSspM,byfTOb,eVCnO,fJpY1b,fqEYIb,hc6Ubd,hhhU8,hmHrle,inNHtf,lsjVmc,ltDFwf,lwddkf,mWLH9d,my67ye,n73qwf,njlZCf,oLggrd,qmdT9,siKnQd,t2srLd,tUnxGc,vHEMJe,vfuNJf,ws9Tlc,xBaz7b,xQtZb,zbML3c,zr1jrb,zy0vNb/excm=_b,_tp,identifierview/ed=1/wt=2/ujg=1/rs=AOaEmlHDcUi9ID1jIalJtFQkB5xrA2xb_g/ee=ASJRFf:LANRae;Al0B8:kibjWe;DaIJ8c:iAskyc;EVNhjf:pw70Gc;EkYFhd:BDnJmb;EmZ2Bf:zr1jrb;Erl4fe:FloWmf;JsbNhc:Xd8iUd;LBgRLc:XVMNvd;Me32dd:MEeYgc;NPKaK:PVlQOd;NSEoX:lazG7b;Oj465e:KG2eXe;Pjplud:EEDORb;QGR0gd:Mlhmy;SMDL4c:K0PMbc;SNUn3:ZwDk9d;UpnZUd:nnwwYc;XdiAjb:NLiXbe;a56pNe:JEfCwb;cEt90b:ws9Tlc;dIoSBb:SpsfSb;eBAeSb:zbML3c;iFQyKf:vfuNJf;io8t5d:yDVVkb;kMFpHd:OTA3Ae;nAFL3:NTMZac;nTuGK:JKNPM;oGtAuc:sOXFj;oSUNyd:K0PMbc;oXZmbc:tUnxGc;pXdRYb:fqEYIb;qddgKe:xQtZb;sP4Vbe:VwDzFe;uY49fb:COQbmf;ul9GGd:VDovNc;vNjB7d:YTxL4;wR5FRb:siKnQd;yxTchf:KUM7Z/m=ZwDk9d,RMhBfe HTTP/1.1Accept: application/javascript, */*;q=0.8Referer: https://accounts.google.com/Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: www.gstatic.comDNT: 1Connection: Keep-Alive"; in File: "SSL") Found requests in header "GET /_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en_US.C6tNd3FBrA8.es5.O/ck=boq-identity.AccountsSignInUi.QUjh89dKB-E.L.I11.O/am=DmBFZI4NgOD_oonn7xknhwEAAAAAAAAAANZAdg/d=1/exm=AvtSve,EFQ78c,EGw7Od,EN3i8d,FCpbqb,I6YDgd,IZT63,K0PMbc,KUM7Z,L1AAkb,LDQI,LEikZe,MpJwZc,NOeYWe,O6y8ed,PrPYRd,SCuOPb,STuCOe,SpsfSb,UUJqVe,Uas9Hd,WhJNk,Wt6vjf,YHI3We,YTxL4,ZUKRxc,_b,_tp,aW3pY,b3kMqb,bSspM,byfTOb,eVCnO,fJpY1b,fqEYIb,hc6Ubd,hhhU8,hmHrle,inNHtf,lsjVmc,lwddkf,mWLH9d,my67ye,n73qwf,njlZCf,oLggrd,qmdT9,siKnQd,t2srLd,tUnxGc,vHEMJe,vfuNJf,ws9Tlc,xBaz7b,xQtZb,zbML3c,zr1jrb,zy0vNb/excm=_b,_tp,identifierview/ed=1/wt=2/ujg=1/rs=AOaEmlHDcUi9ID1jIalJtFQkB5xrA2xb_g/ee=ASJRFf:LANRae;Al0B8:kibjWe;DaIJ8c:iAskyc;EVNhjf:pw70Gc;EkYFhd:BDnJmb;EmZ2Bf:zr1jrb;Erl4fe:FloWmf;JsbNhc:Xd8iUd;LBgRLc:XVMNvd;Me32dd:MEeYgc;NPKaK:PVlQOd;NSEoX:lazG7b;Oj465e:KG2eXe;Pjplud:EEDORb;QGR0gd:Mlhmy;SMDL4c:K0PMbc;SNUn3:ZwDk9d;UpnZUd:nnwwYc;XdiAjb:NLiXbe;a56pNe:JEfCwb;cEt90b:ws9Tlc;dIoSBb:SpsfSb;eBAeSb:zbML3c;iFQyKf:vfuNJf;io8t5d:yDVVkb;kMFpHd:OTA3Ae;nAFL3:NTMZac;nTuGK:JKNPM;oGtAuc:sOXFj;oSUNyd:K0PMbc;oXZmbc:tUnxGc;pXdRYb:fqEYIb;qddgKe:xQtZb;sP4Vbe:VwDzFe;uY49fb:COQbmf;ul9GGd:VDovNc;vNjB7d:YTxL4;wR5FRb:siKnQd;yxTchf:KUM7Z/m=RqjULd HTTP/1.1Accept: application/javascript, */*;q=0.8Referer: https://accounts.google.com/Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: www.gstatic.comDNT: 1Connection: Keep-Alive"; in File: "SSL") Found requests in header "GET /_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en_US.C6tNd3FBrA8.es5.O/ck=boq-identity.AccountsSignInUi.QUjh89dKB-E.L.I11.O/am=DmBFZI4NgOD_oonn7xknhwEAAAAAAAAAANZAdg/d=1/exm=AvtSve,EFQ78c,EGw7Od,EN3i8d,FCpbqb,I6YDgd,IZT63,K0PMbc,KUM7Z,L1AAkb,LDQI,LEikZe,MpJwZc,NOeYWe,O6y8ed,PrPYRd,RMhBfe,RqjULd,SCuOPb,STuCOe,SpsfSb,UUJqVe,Uas9Hd,WhJNk,Wt6vjf,YHI3We,YTxL4,ZUKRxc,ZwDk9d,_b,_tp,aW3pY,b3kMqb,bSspM,byfTOb,eVCnO,fJpY1b,fqEYIb,hc6Ubd,hhhU8,hmHrle,inNHtf,lsjVmc,ltDFwf,lwddkf,mWLH9d,my67ye,n73qwf,njlZCf,oLggrd,qmdT9,siKnQd,t2srLd,tUnxGc,vHEMJe,vfuNJf,ws9Tlc,xBaz7b,xQtZb,zbML3c,zr1jrb,zy0vNb/excm=_b,_tp,identifierview/ed=1/wt=2/ujg=1/rs=AOaEmlHDcUi9ID1jIalJtFQkB5xrA2xb_g/ee=ASJRFf:LANRae;Al0B8:kibjWe;DaIJ8c:iAskyc;EVNhjf:pw70Gc;EkYFhd:BDnJmb;EmZ2Bf:zr1jrb;Erl4fe:FloWmf;JsbNhc:Xd8iUd;LBgRLc:XVMNvd;Me32dd:MEeYgc;NPKaK:PVlQOd;NSEoX:lazG7b;Oj465e:KG2eXe;Pjplud:EEDORb;QGR0gd:Mlhmy;SMDL4c:K0PMbc;SNUn3:ZwDk9d;UpnZUd:nnwwYc;XdiAjb:NLiXbe;a56pNe:JEfCwb;cEt90b:ws9Tlc;dIoSBb:SpsfSb;eBAeSb:zbML3c;iFQyKf:vfuNJf;io8t5d:yDVVkb;kMFpHd:OTA3Ae;nAFL3:NTMZac;nTuGK:JKNPM;oGtAuc:sOXFj;oSUNyd:K0PMbc;oXZmbc:tUnxGc;pXdRYb:fqEYIb;qddgKe:xQtZb;sP4Vbe:VwDzFe;uY49fb:COQbmf;ul9GGd:VDovNc;vNjB7d:YTxL4;wR5FRb:siKnQd;yxTchf:KUM7Z/m=bm51tf HTTP/1.1Accept: application/javascript, */*;q=0.8Referer: https://accounts.google.com/Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: www.gstatic.comDNT: 1Connection: Keep-Alive"; in File: "SSL")73:T9b30,"GET /login HTTP/1.1Accept: text/html, application/xhtml+xml, */*User-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateDNT: 1Host: www.facebook.comConnection: Keep-AliveAccept-Language: en-US" "HTTP/1.1 200 OKVary: Accept-EncodingContent-Encoding: gzipp3p: CP="Facebook has no P3P policy fb.me/p3p"Set-Cookie: sb=rKQxZYR_JMNoSBPiBcS6ei3J; expires=Fri, 22-Nov-2024 21:50:36 GMT; Max-Age=34560000; path=/; domain=.facebook.com; secure; httponlySet-Cookie: fr=0kW7fOMa4WxsuYXwY..BlMaSs.Lk.AAA.0.0.BlMaSs.AWUjrG-aL50; expires=Wed, 17-Jan-2024 21:50:36 GMT; Max-Age=7776000; path=/; domain=.facebook.com; secure; httponlyreport-to: {"max_age":259200,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/?device_level=unknown"}]}content-security-policy: default-src data: blob: 'self' https://*.fbsbx.com 'unsafe-inline' *.facebook.com *.fbcdn.net 'unsafe-eval';script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.google.com 127.0.0.1:* 'unsafe-inline' blob: data: 'self' connect.facebook.net 'unsafe-eval';style-src fonts.googleapis.com *.fbcdn.net data: *.facebook.com 'unsafe-inline';connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* wss://*.whatsapp.com:* wss://*.fbcdn.net attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' http://localhost:3103 wss://gateway.facebook.com wss://edge-chat.facebook.com wss://snaptu-d.facebook.com wss://kaios-d.facebook.com/ v.whatsapp.net *.fbsbx.com *.fb.com;font-src data: *.gstatic.com *.facebook.com *.fbcdn.net *.fbsbx.com;img-src *.fbcdn.net *.facebook.com data: https://*.fbsbx.com *.tenor.co media.tenor.com facebook.com *.cdnins" "tagram.com fbsbx.com fbcdn.net *.giphy.com connect.facebook.net *.carriersignal.info blob: android-webview-video-poster: googleads.g.doubleclick.net www.googleadservices.com *.whatsapp.net *.fb.com *.oculuscdn.com;media-src *.cdninstagram.com blob: *.fbcdn.net *.fbsbx.com www.facebook.com *.facebook.com https://*.giphy.com data:;frame-src *.doubleclick.net *.google.com *.facebook.com www.googleadservices.com *.fbsbx.com fbsbx.com data: www.instagram.com *.fbcdn.net https://paywithmybank.com https://sandbox.paywithmybank.com;worker-src blob: *.facebook.com data:;block-all-mixed-content;upgrade-insecure-requests;document-policy: force-load-at-toppermissions-policy: accelerometer=(), ambient-light-sensor=(), bluetooth=(), camera=(self), geolocation=(self), gyroscope=(), hid=(), idle-detection=(), magnetometer=(), microphone=(self), midi=(), payment=(), screen-wake-lock=(), serial=(), usb=()cross-origin-resource-policy: same-origincross-origin-opener-policy: unsafe-nonePragma: no-cacheCache-Control: private, no-cache, no-store, must-revalidateExpires: Sat, 01 Jan 2000 00:00:00 GMTX-Content-Type-Options: nosniffX-XSS-Protection: 0X-Frame-Options: DENYStrict-Transport-Security: max-age=15552000; preloadContent-Type: text/html; charset="utf-8"X-FB-Debug: 4nYtFE5dUOVEd0pYcNb9cR0+2FChJxj+zzGY6CSPHgPoeG9pMv96+4ONpdNZxhIV8hlmByZlgCaUpwNTOO1ykA==Date: Thu, 19 Oct 2023 21:50:36 GMTAlt-Svc: h3=":443"; ma=86400Transfer-Encoding: chunkedConnection: keep-aliv" "e2332��[o#͒ �>��Ss��~��O��wQ�H��Z=��,2�bU)��0�'�뗅�f�x,`�À�O̾��0��`Df�xQ��R/+/��u�[��걉3�?�կ�/�#c|*`C��TА�eӜ1EG�}*�4�(��9vPL� jc�Tp-QbI/�@s|*P�aJ1b�i8�pNk��Ja��_m�ˉ��S��IC��ӈac��]{�}��Wͤ�Ɣ1b�H��|9E��/�Kb��G�P�FO��v�>|��B��N>x�ucq��>��H��s@�W��??��¶p�!��q��>�L�t}@S��%ǜaC8ʷd�Ih��*1��(��K��#c��m)3ɡH��N��N2��9�u��i��Nr�T*.�s)c�(A�#�X1UL��9��#��y��\��bPz�V톸He-ZW�r�2�*?}�5��n��_{6-lԐ�dd�#��T��Z�j��i�R�S�ZR�^n��N�^�n��U�4D��J\=��A��@�<ܓ�:��L��x�Sj�G��t�|��{��ZǻM�5�2^�$��גt��2L�ZǱ �6�(�'��ۧI��7I�%��FXr�Ȳt� hgR"��s;Z�1M�!V��5��k�36�؊�VlI�IL��m��R=6��#�Du&�b:��8�dJ�V�B�M(�N��&��BM�6)�&��B�� $�8:f-4�C�>��q��_��F3T̵1��;Ua�A�'�cC��8��t�?��1͉��6-C��0��!7-jZ�:�S��A=�QeSK�=�\.�}C�X1�\/�B7�GQbC��MA�i�~/}Ur�e��B �۵�)�k9I��v�\l6�u�<�z�Y[�Tp��I*�-pl��';��B_J��T��Z2}�~*��j�x��o��H��4sc�q��I��&d�tt��&&Ȟ�=W�W��@�_�2Q��UJY�8]k.^Gf�>��ɼ��N�� +��LB��ɤ2��ĽV��:2��l��O$�D�\�N]UF�Rs�:2kJ��c��'��f�"�ZI3�f^G�y3u�_g~"��|��:2�w�6ө?�L%B��uFm:�T�_Gf�2�%��+��2�I��w�@.8*�?��{Ai��/�", "GET / HTTP/1.1Accept: text/html application/xhtml+xml */*Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip deflateHost: www.youtube.comDNT: 1Connection: Keep-AliveCookie: CONSENT=WP.2676ba", "HTTP/1.1 302 FoundContent-Type: application/binaryX-Content-Type-Options: nosniffCache-Control: no-cache no-store max-age=0 must-revalidatePragma: no-cacheExpires: Mon 01 Jan 1990 00:00:00 GMTDate: Thu 19 Oct 2023 21:50:38 GMTLocation: https://www.youtube.com/supported_browsers?next_url=https%3A%2F%2Fwww.youtube.com%2FX-Frame-Options: SAMEORIGINStrict-Transport-Security: max-age=31536000Origin-Trial: AvC9UlR6RDk2crliDsFl66RWLnTbHrDbp+DiY6AYz/PNQ4G4tdUTjrHYr2sghbkhGQAVxb7jaPTHpEVBz0uzQwkAAAB4eyJvcmlnaW4iOiJodHRwczovL3lvdXR1YmUuY29tOjQ0MyIsImZlYXR1cmUiOiJXZWJWaWV3WFJlcXVlc3RlZFdpdGhEZXByZWNhdGlvbiIsImV4cGlyeSI6MTcxOTUzMjc5OSwiaXNTdWJkb21haW4iOnRydWV9Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="youtube_main"Permissions-Policy: ch-ua-arch=* ch-ua-bitness=* ch-ua-full-version=* ch-ua-full-version-list=* ch-ua-model=* ch-ua-wow64=* ch-ua-form-factor=* ch-ua-platform=* ch-ua-platform-version=*Report-To: {"group":"youtube_main" "max_age":2592000 "endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/youtube_main"}]}Content-Security-Policy-Report-Only: require-trusted-types-for 'script';report-uri /cspreportServer: ESFContent-Length: 0X-XSS-Protection: 0Alt-Svc: h3=":443"; ma=2592000 h3-29=":443"; ma=2592000", "GET /supported_browsers?next_url=https%3A%2F%2Fwww.youtube.com%2F HTTP/1.1Accept: text/html application/xhtml+xml */*Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip deflateHost: www.youtube.comCookie: CONSENT=WP.2676baConnection: Keep-AliveDNT: 1", "HTTP/1.1 200 OKContent-Type: text/html; charset=utf-8X-Content-Type-Options: nosniffCache-Control: no-cache no-store max-age=0 must-revalidatePragma: no-cacheExpires: Mon 01 Jan 1990 00:00:00 GMTDate: Thu 19 Oct 2023 21:50:38 GMTX-Frame-Options: SAMEORIGINStrict-Transport-Security: max-age=31536000Cross-Origin-Opener-Policy-Report-Only: same-origin; report-to="youtube_main"Report-To: {"group":"youtube_main" "max_age":2592000 "endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/youtube_main"}]}Origin-Trial: AvC9UlR6RDk2crliDsFl66RWLnTbHrDbp+DiY6AYz/PNQ4G4tdUTjrHYr2sghbkhGQAVxb7jaPTHpEVBz0uzQwkAAAB4eyJvcmlnaW4iOiJodHRwczovL3lvdXR1YmUuY29tOjQ0MyIsImZlYXR1cmUiOiJXZWJWaWV3WFJlcXVlc3RlZFdpdGhEZXByZWNhdGlvbiIsImV4cGlyeSI6MTcxOTUzMjc5OSwiaXNTdWJkb21haW4iOnRydWV9Permissions-Policy: ch-ua-arch=* ch-ua-bitness=* ch-ua-full-version=* ch-ua-full-version-list=* ch-ua-model=* ch-ua-wow64=* ch-ua-form-factor=* ch-ua-platform=* ch-ua-platform-version=*P3P: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657?hl=en for more info."Content-Encoding: gzipServer: ESFX-XSS-Protection: 0Set-Cookie: hideBrowserUpgradeBox=true; Domain=.youtube.com; Expires=Thu 02-Nov-2023 21:50:38 GMT; Path=/; Secure; HttpOnlySet-Cookie: YSC=saOgiktOres; Domain=.youtube.com; Path=/; Secure; HttpOnly; SameSite=noneSet-Cookie: VISITOR_INFO1_LIVE=yccoFA1-rho; Domain=.youtube.com; Expires=Tue 16-Apr-2024 21:50:38 GMT; Path=/; Secure; HttpOnly; SameSite=noneSet-Cookie: VISITOR_PRIVACY_METADATA=CgJVUxICGgA%3D; Domain=.youtube.com; Expires=Tue 16-Apr-2024 21:50:38 GMT; Path=/; Secure; HttpOnly; SameSite=laxAlt-Svc: h3=":443"; ma=2592000 h3-29=":443"; ma=2592000Transfer-Encoding: chunked", "0000000100000001�0000000100000001000000010000000100000001000000010000000100000001�00000001�00000001X00000001�1�7f3۸~��^��f��Q�z;�̯)�E�G�jU��I��k�.�$G��?vk��?��p��2M�s��R�0��!8\�S"1�pJ�%��qi��e�dralh(�EH�h@,�`"�QIqb�'d1�]�xK�"m�p��W0�1�Y��=��ha�R��w�N��uBpN��x�&��=+>+��8��u�I�0��%DĄ��;��~��n��?��ſ�l��ڐ�#�֊m-A��_1��`d�;z�抅;3�Of<4cόGf<6�OMo��k3�&K��9��"٧��i滳��J�p�ܡ"��u?[��q�Y��s@�A��Gr�&栂��~1�o�́Zgm8�s��1��Xj�5�o��$��%��7TW�O�(ca�4�U4*�7�P��L˰@π�4�a��'£�m�I��:�P� eL��98S�X��0P�r�b2ͷ��1�M�Jc�z�_x��Y�뗳�H��) �9�� $�XOj�# %g<��E��F^��=�rxJ$$��R�`s��&=��f\[��FI/Jif��V��t�|pf� Xqے3@��k��M�Rkx��5��?5�|�W��f�U�H'�6)Qe��rR�'xh!�*a��N��R+�A��ۻ�:K�?V~9:jr�5��װ��JÕ�C<�wҦbN��r�EU�U�n��S�R�Wh�g��&��U�P��J��p��iQ�`W��N��3R��@�5�!�z��m3� ��"7��o Ԝ��iIjt�,��d��g�Ilt��F�7�v,T�Փie :��?QH%�� x컎�>5ţ}��u�[�hGT��hq��)i�Yp�8֎��v��$Ǖm%����/?@��5L|�3%Xߧ$��h��лʷ/��ȭ)�ݸG`zS={��\O�С�`wzs~��j��䒵�ӱ��o%��t�w�SBԙ~Fem�8ɖ��׫�qo4�8q�x|�i;��l��:JX��z7|d[_��(&@Z��7Ï�ٻn�.�a�S��m��A�Xؒ�sG�:�� oV��~�߽�r��|��;cI#��[`��[�X ��]�b��W��y*%�_�}H"��s��s��Zj�j�1S�i��s��wTŃ oQ�APG#.�v-�.�?��QUTF�M8�tI��6f)1��:��r��\��@��d��v;!��i�6�.��5��|Pr��|H�P;��]�TO�`��]G��i)�UX�~ƸT�Q�Z?j�_�4�6��ZW��j�jQ��;h�AEb�3��Z.��5��JԜ�p�K'6�g)�J$Z��Z!Q*��S��]!Rr!�Ԋ�`�v"l0趒�IU3��kC�3��x7��|C0ϐR��D��I�dM��Xk�V3~�s��Sp&X$", "��$\�H��Z�-5P��H�O�x��{�z:@`F��0p>�~#Ja��V��L�S�Ml3�v"�l�dd�*d� G@�-��i>SS��tXҌp��e�Q�/uM��e.D?�{�MH��'ÁT��տ�VP�ۿ�t��5c�KIfY[�N%�+��"W�Yۇn��G9ER3p��+�K��-?�2�H�"W]+��S��V��C��ݲ�6t�]�^�qT=�3�(]�7 l�N��@!�i��č��#��S��o�2:9�_�d8:�C��3҆'^��/�.֘bo��O��ā|(�گ�Q!.nJa��s��'��]y�u��C�P)�3��iA�qDd��7�~�<��*�߼��R�S]U��U��", "000000010000000100000001�07��", "HTTP/1.1 200 OKAccept-Ranges: bytesCross-Origin-Resource-Policy: cross-originCross-Origin-Opener-Policy-Report-Only: same-origin; report-to="youtube-marketing"Report-To: {"group":"youtube-marketing" "max_age":2592000 "endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/youtube-marketing"}]}Content-Length: 59088X-Content-Type-Options: nosniffServer: sffeX-XSS-Protection: 0Date: Tue 17 Oct 2023 15:04:40 GMTExpires: Wed 16 Oct 2024 15:04:40 GMTCache-Control: public max-age=31536000Age: 197163Last-Modified: Wed 16 Oct 2019 17:15:00 GMTContent-Type: image/pngAlt-Svc: h3=":443"; ma=2592000 h3-29=":443"; ma=2592000�PNGIHDR� 3��IDATx�� M7Dx�ػH)�(�Wr��R%P@��"BH��$A)�T"��}�{RH@�۽�vwg��.��%Q{��"?%_�ƯlY��_ݚ8��8B��hsF��`�|��M�hg��6G��7y⃽��h�'j7�+R��ps��@oa��&�>�5Y�&jO{j�s K�<��f��>�K��wh��#W�^�;��8�W?��gr��>{��\�f��C�5�-��q��#�@7q��'D�}�1�go��Ӊ��2y��"j�zx8q��R��.}�[9�̟��~i�%q��I�>��,��ƥ�㍉@7p� �(_��JY5��z��h\�" "GET /img/desktop/supported_browsers/opera.png HTTP/1.1Accept: image/png, image/svg+xml, image/*;q=0.8, */*;q=0.5Referer: https://www.youtube.com/supported_browsers?next_url=https%3A%2F%2Fwww.youtube.com%2FAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: www.youtube.comDNT: 1Connection: Keep-AliveCookie: CONSENT=WP.2676ba; hideBrowserUpgradeBox=true; YSC=saOgiktOres; VISITOR_INFO1_LIVE=yccoFA1-rho; VISITOR_PRIVACY_METADATA=CgJVUxICGgA%3D" "HTTP/1.1 200 OKAccept-Ranges: bytesCross-Origin-Resource-Policy: cross-originCross-Origin-Opener-Policy-Report-Only: same-origin; report-to="youtube-marketing"Report-To: {"group":"youtube-marketing","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/youtube-marketing"}]}Content-Length: 7121X-Content-Type-Options: nosniffServer: sffeX-XSS-Protection: 0Date: Wed, 18 Oct 2023 23:38:07 GMTExpires: Thu, 17 Oct 2024 23:38:07 GMTCache-Control: public, max-age=31536000Age: 79957Last-Modified: Wed, 12 Feb 2020 21:45:00 GMTContent-Type: image/pngAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000�PNGIHDR��>a��IDATx��]{gWrn��-�)̱�;��9�e��q�1:y��e��c<��x��c{$[`��~��_�V�Z-��n�F�k��>��kW��m�x�7�9��o|�s��͠�x9q#P^�E��{ �MB��ZfG8'�gN�&M��!��K��@�l�a@�}g��u�)�Wq��^�ͫ9k_�h�-�1��գSY&B��(��j�W9�<�i�&X|�8��2B!j&H�df0�?|�,�"g�~�F`��`�0/C��a�x��R��r*"�,�%*M��A3>��6��9�a��8��Yx�O��E�/6�-��JZٟH��.��:My4�)?��c��q�X��G��"[n�Ģ�&�%��Д��zڈ\��V8��c�� LH��Ǐ��|��$@��)⽟H�@Ff�� ՝0��:3.��B��1��~�g��qq�EIhd$X��ADy^�F�|�彐��4r�&�`��|��/Q\�j��u�1��O��t��o^\�t�я�#�i �/b��r��m�^��"MnA��O�V��4%��3��ዶ��`K�jA)�� t��U�L�t݄2�T>�I|/��ݪ��n��ax�S� ��R�|��3Q.�R�F��IP�#m+�z#��,9��)�y2�dDz��x��z9��:�׷��7ȥY�'c�t~��^�t��)��i^^��$��Iu��i�$X�*>�L��uJ0:��T��\��`�z��:�D~�L�� H��:3g� ��g.t�o�?W��w�$�sv�W�-ڢ8��[=��D�� $��^Y^x��6�;�1S�;8,�� E��)��I��kG��U�%X.��;�m��GJ!��mk�(�H�Hc��z�X�_-!�[�M��P��IlPy�L��Lѓ��%G��׎�;�/_�E`��r��M�.f�$�@�!4�YN*o�i�X��zRd&��b2Қ��Mͬ�+��:�\P��?�!bg�xX��T��ū�fF?\�a��1l��w�F`0F��k��c��ªf��f$��o�Q]�e�`��'=�5O}|��Չ阕��v�:T�!��N��x_�{�)�ʼ!��u��Z��>�5��X�L��mw1�g1V��!,�t�%^��ha-� ��=0��އ8��Y��ǲ�O��v5%}�\|�H#��,�/�dja��ZAժv��w��&��q��=JhD7�bC0 `�K��yۊU��|U��K��Zm�Pw��o��]��4x4�_��=��^[ZTE;�V��HuK&(�FyG֯�ǐ��B[A��6�}?Q�z=X@!�0��|�O�)��yy��"�F��(s�g8�k��8ֿhc!~--��h/CX/�Xq<��)t:��::��b�-w��Q��)�}�f�;�!��u��6O0��@s", "��!F��E��:�h��4"!,��ʟ6_�9��i��:�G/��L�m�l]D��#ZkVu�9�/��S;�r��]D�FP0��P��S!3�H�{=>�,��(d�$ �$��@{�ƈ��x�k�2��i�iai�H�m��%�� ͣ�Q��f��U�z��#�?|v`�k3<��E��Ђp�+\p/�&??��e�,g�@�6P��ѓ7��Zm�ܸ��S��꙽�/��݂R��=YG +Y*@��i��V��b��B;�x�V�}��?U�$v��؞�O�X�f8�/��)�Hfr��хPU�t`��M`��c�2��rc!~=�*��#JC��R�TM��Q`Y>�_:��a��̧��w3u�fm\��Ů��PA�de&�`(��{x�!��31��n3O��F�2��S?��+��'�e�P[$��E&N��!O�tJ'�s��CGۯ�7�&gZq�|#�$X�Gyh%7��e@n�b0dFH�RX1�.��G��zŀa�e>E [��ܺ�u�t�/�pBLS��a>��2rqS�[�@�D�r5P>��[;�_u��'@c ��?x�|'�ުB�B(�7��9��?��ϋ^7��&/P��W��)�j��!�q��~�=�̮yZcG}Қ��C@.��1��?�|Q��*�]ȼM��`�2��bp��ة��Ƃ��*\��[Д$��A��X^�'F>U@��U�A1`t��憨�]��#7O��m��Ä��JB'�L��<��F��U�-)��8� 7{�c��n��,�b��JwXZ��YE3@BfK�H1k�u�bZ��X�Z��u��,��a��f�<ռ�(v1�p��m^�B0%��dȷ�S�灞��k��-�ld:/�6@��=8[O�W�(��wC�n��. �Y@��2 [��u�)��v5%�@��́g)�`]�E8vV�g�ѡ�W�("b��|]��bMʌ��H�@�D��F�LkO��{��9tˡ��o�Zx=�~_X ��x)��3��o��=��4��.௎>�9bǶ)��1@��ӀZMZ(��,��e��Pϯ��!,3J)�I�V��;�ݣ3;�}�g�6��>��J۹�b�ɠ4�؅4}��}e_s.j��A�t!Qw��&��2�逴�P��b&d}�?��<_�4��`#k�j�[�Y��;ӡ1@Ly�g�?=E}J��ʶ�!�E�K��X�tf|4l�P|$��ߴ��N�3��r{:�Օ�ӣ��b#�jq�09��XԘ3��I}i5�b�;cv~~��q�!��`tfm4%@�v��-�*6��-�,=��~��s>��X&��Q?�\��Ai(/�- &"��B�u��9��B5h�d?B�}(V�`�3�!��?F�vc#k ��G,��^��Ⓞ-��H��j�٢0��8�/�O��*�r1��| ��\B��xn�t<�!��M��o��jmZt��eB��OC�\(�L< �D��*^��E��D�x��s-��]?R�`��3�۱�j��*O�L8��w��GU��5��[�J�D�Q)%b:{��u�]�W6@�2Bh�Rk)`�1��0;��=��e5��&��Hi�/G|�6J�Xf�Y2��@��n]nH��_��M�@}��^�`a�f�g��L��Y6�\oY=��V.��Rj�"Q`��ߏQ�o~�:�W�u�>��V�}��!��4��⧾��Yt'ʹ��c��'��fr�$�U��ǈ1~>7��l@�-b��V&��t��j��.��Ϲ��F�{�^�A�}eɀ�'��F�e�+�fc�^ΐ�j.� �6��7ʹ��0 �XV�v��r��[A$��S$��4��'��i_�:�+�[�f1 ��iǴ��Yt�X�݆�6.��F��C[�]�g3��=� ��"��O"�k��3��1A;H$�Td�d�T,�u��;[&��#=��)"Q1b�#��_�8�`9�s!7��>L��ҠOH��ۯx��W�z¬s�YwO9�)��xD�4�<Ҕ�#icS~�!��<��n�80K�T��p+��D�{Wz�$��M��l��g��w�W��W��J`0ɩ�?4$\��x@�A�%�o��Y��6`b�C�}�-W��}~s�_�O��Ҹ��Ck��jpqR4ٗ��:N4R��1��ݤ��e�}��;\ȳ��y��MI��n}L��[{��f��`�)�a��D2�W��8ѭ�ް��6��؆�zA�*`�/p�&0��d&X�!b��ߙD��o��u��1|��Ùa��+��I��&h�(P^�d�/A�AW��!q�ߞ��:8W��N��p�؊4��É-$��Ɛ!�{��֟��&j�c��Ô9�A��\l�qQ�ݨ��ab��2��!��K�[�V��]�j��T��,v+��0)��=�lwn��~ƟcP�<�uT��X&��|�J�� .��ǟ��a�IW5��xC�Ͱ0��w��E�b��l��%U�|J��}��5Xg�p��d��?]��;�'�Vw&@��-n�2��ׅ��,#Z�X.��z�/~Hƿ\��mǱ�S܃1<�K3�Xflr��u(=7��m��?��G��o��+~~�&#��@�[Ƕ0K��b�g�Z��a��-�R��kR��"Ĉbo^�2�E�8؂�!c̊[�� YC|�S�ߏ�^y��y�"�� `�rs�'W�v�;�Dw�'=�o��K��j(�.~|jp�И`;p!f��^C��'g�{��e��`��)bc�k�" "��i�o��S^U��SqvA�F�Ϙ�)f�*�8��q�%��J��qզ�g�?�8��O��9�^9��\��@=L��&��N�X{��_��L�N�ı��>��;'�6Ag�&�]|*�Ί��&��ӈ��u\�Xx�+�U#(�R��g�$@��l��b��:h�z��b��S��&P�j��??>�o��v`3p��@�,��1�e�%AL5Ȋs��#�>��?��Y�l��}�3�/z�f`�ɼ`s�w��jn��mb��N�S�^�t�b�R�k�a�V=��(6I��i�g�R3F�6A�M��Aw�jv2˒��2&�4�ꏀ~��v7�㙘E�[͸�D�IӇi�wa~̰"L�Q!��o�Lr��?�[��|�[6�qp0֯��G{��c��/�3@��)�jTovq��q�&y�;��\��a�n^&C R;��0��$��Cg�g��V��``l6$�Y��Ӱ0G5��jꀛ�N �@##�U��髬��~��e��sG_��y�8L�S��6߰s�t^q��^Uv�X��3�9��i�E�?��16�3��+��pfر�T�� ط��p�F��y��n��l0l�a�Vl��<�X��V�b��`+X��V�b��`+X��V�b��`+X��Vpn��5_��ʿ�IEND�B`�", "HTTP/1.1 200 OKAccept-Ranges: bytesCross-Origin-Resource-Policy: cross-originCross-Origin-Opener-Policy-Report-Only: same-origin; report-to="youtube-marketing"Report-To: {"group":"youtube-marketing" "max_age":2592000 "endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/youtube-marketing"}]}Content-Length: 9291X-Content-Type-Options: nosniffServer: sffeX-XSS-Protection: 0Date: Fri 13 Oct 2023 04:31:49 GMTExpires: Sat 12 Oct 2024 04:31:49 GMTCache-Control: public max-age=31536000Age: 580735Last-Modified: Sun 25 Jun 2023 02:58:00 GMTContent-Type: image/pngAlt-Svc: h3=":443"; ma=2592000 h3-29=":443"; ma=2592000�PNGIHDR��>a�$IDATx��\ŕ��uOT�DN6a/�^#�l��s�?��k��r�7ʛ�Q�s$rFde�4��Μ:��=u�c�H�;��z��G�w�{_j蠃:蠃:蠃:蠃:蠃:蠃:蠃:蠃w5:�[y'0��1�"n�Q�,��/=��`6]=�[�Z`YGO 趮��%]+�8��+d��Y��Az�8`��'�:��K��p��-�N�N��+��^@W+��-T�XTJ�D�0��Ǹ�C߹PDV��e�<[��f�ߋ��ٌ�̲��G�"ȡ̄��@�G'��Y�_��p��'$�Փ!�D;@A�چK�N�)�T''�H�W�`OO��2+��qͱ��{Ŋ�R��6QP(��>ۻ�Z��/��-��}��ґ�%��=D@-��BR��70g�6_��o�L:�� 8��_��R�u��j��pP@z��N\��`��o�$��V ��Wr�� "��^z�7(�̧5�&*P�r�rj�]��S��De"�8��˟�]�bu�͜+��O?i��5 KKr�lCĈ _c7b�[ĉsn,��x�^��_", "�GV�;��j��/w⠀��#��V+g��Cw��yK!G�2f�Yq_pp|��VE]�(�q)a��9�@�wu��2��2��n�k��`��CJ*��U��>#�uR�*��o��"vgG�\I��s_D��6??fC��b�L/+��xu@Q@�`�� D�* �j(5m��?��~FT%өW��"��z��4�t�67��u_y,�x�PP'�U0�T��'`�*��@M�R�z��c��c�C��L&�Z@��mT�o��1��KJ/ 4N�]*`��؈ bc�:�i��ˈ�k��3I��H��w�gfWm��vny��C��Gjifu��O��9��BW��\��"ȁ��&/��?��R��;I��Z�so�`� 4�3�=~��ލ(��e�!�'�n��+��ѫ�Ȋw]F.�#I�0d��`�}�0FiZ�N�FjPD��S�|?��@�E��[H��|>ipv�̫jQ��rT�As >?��'��wAିa��x��b��ft_��|��ٽ��#ۧxz��)�[��s��c�� Ќ��`��#��\ĝJ��k�'"N", "Ը̨{��!��/��d~�;R@*7��48��o��x��̕7l�w]N��Ĭ^�CA `ԭz1PY��/�&}�+h�'&��/��n.�W-��S9��)�L0u�>{8g<��K0��#�ƃ��j�QЊ4��n6�R��]$�ڝ�#�މ�D�V�h�w\��w� N��N�(�<�p��*��i|��ݰ�-n�/\�8J�~�ukX֛�9�;��+S��{��OA�ZG��f��>�]��r-�k�[��'{�|�N�G�{=��?ALi�)��w�4~j�8⟥E��>��w��ޑ|�߷��ՙ�`~��C�\x�^����K `�q)c�~_#�;��v�X�_��pn %��|��V��@cb�Uf�T�@q�� p1�ϐ4"r��9�+j�GN��㌔B,*T0��@, ;�s�~\��M�%�B��vR�NY��Cn��L?H�>�J��q��,jrϜM�$��/x��F�[/t)ם��q;��t`PF��n��A��U�;X�j��V_L��O�f$f��o�#�DJm�hy=�5�`�$�{+�(�Up,4�ke��x��(��,�J�,��?��3�&N��k��j��)W�� x�_��Xp�N��8�<�h�~��Tm��2�p��&O�x"�Ejl�B�وo��u�{��?� ��_��F��}W�' ��G��q�=q��&~3Ѿ��=�0��ǖ"J�؛��eN>��x�Ĉ9y�!��_�H��e��elzjEQ��*�e�<�b��/Z|hG�7<��P8��R}��Ș�o/��D�m��"h��I#$I%�m�.��<��Q�}b?yc��(V!{��_��3/��`v��2��=ފ�r�R�tm.�Hq$�"a|��$)x�+�!��]=��\��+o��1��?�8��.��M�p�҄R�u�pt��ij�i��a+$�J�G�$I��-PhM�l_��d-�b�!J�5ĩ��[�Hޟ��v��6FokM�1�J�4ٹ*�v�Fck=��Hm��?��Z�~cWW�n�Hw��4ٲ�Hӱ�Hm��4Rb��#��!²ee��r��)P�`�Ӿ��om��Z�)��7��_��=��'��V[C�p�=�R�3Wr��", "�J(��h��0J!��?4��k�%��rݩ��}��Z��p�o��ۋ�V�փ�Gm|VX��4~�Z�!��d(��4�[�-m�v�_[�ن��|��4R@D(�T��|��V��ڎ�]��Bіv�>J��s��l��Z7�1��]5��o�,\��x&Z~m�~TI��2��9��|�1޽��rо��_�"u��PI�ͣ�z^�ۿV�s}��%4�p~��[+��Xq��c�Y�٬�Y��/\��_��<8�0į=F��'Iة� �$��C��8��=�ic'��>��L]�8o?o�8v�!��/��/"�p$$��TA�T�ؐ�x�G��_��Zk�o�7!��ŷF4�0�$��l`�Y��Fip�ē<��N��v}z�R�PHG�|��pq��'��CI�jU�<6�0R��"�f�ëw�|f)�i�D>|�O硭�|��;h�o��U�XG|�GQD��} �7�c��!a�j��؎;�r�y8�Ӻ��n��7�n�ZK�[��"r+�Ү"r�^�1$KC�H��2�/cc�8�s��>�[�F��f��?ƾ�[Y]�F�m��5�#z) �;�O��\��>�!�^C�^��ߢ��T�>�[�l�AK�?��e=��w�0O��~1��S��IFt�&�`��+��3o��9s�z>t�O5��A}z�>�Y�\��}��N��&P �&��̇8{p&O��[��6R@�n��48��c~2��J��B�~�5�t�D}��>�W�r�<(Jsk�~�;|�&O<�?��K��ߖ#ow�F��J�I9��g��ߍHB��fy��_8��\��|�nD�a��6�?��|��ݜ�_�pz��y�39m��^RB�|iq��g��O#,"��F_�Olxm�@��r��o��\Ǎ;��{7�w�.�U�-�{�kRJ�H�O��#�Fyя��Ϧ��|��l:��{�M��3O�ʭ;�U��;�M�-�/~��~�9ƀ�8�m��ڇV},��W i��}㱡g�s�o䴁�l�ec�(8� Ǔ��:��ƽ�oᙉ��~��:��=�/ܗ��Vaf6J��r��-�&�nY=�l�>q�}��z@x��J�GةQAd�*D�B9`�e�t�4LU��V��;�c̓+�Gs��j�4P�6�S�1 A�)E:�E#��Sgwp�Jܶ/]�", "�H)��O��6�33��o��8QB� �_pQ�x�9+�0Ѯt�wL�D�}޵�O��6#��U��z݆��tG��b�!(D��!D�!��ܶ/m��+�_C��Œe1�z⮿��w��9!Z�tm!��a�ւ�ï�{�gÀA��[�b�ޙ��rUY,��>�X{0��/z+Y�V?A��](r�^4��p��˴��U?n"�P��S��VPk!�H-Bj��"��y��+;0A��$ğ��r�?�XT�=i��=��t�E?m��C��wE�*b�{Q��T,?y�rL�\�⻼�{�5]T��@��}T9�X�]х��ߖ��3��!��G��\��~� P�3�j��N��".>$�|�}d� h��7��ϣ9�� me��[��i�;�>@��!�6�/W��%��:;�o��) V=�j ��E��Q�t۬��F�BA��<�>��^��a�ԅ/��L.��gGA�:m�@��ˇ\"5{�X}S�1،�z��7��R��X�+��E��k��|�� i�ꏦ��k$�e��Ԣ�J�jX��v~J��gD�3��0Tj��+�؝��m�7� ��H��{Ǽ��A��a�g"�Q��ZC�W6-��GUg��1Le|�`��͞��h8�w�a��K��'��B@@@@@�" $�D�&��IEND�B`�", "HTTP/1.1 200 OKAccept-Ranges: bytesCross-Origin-Resource-Policy: cross-originCross-Origin-Opener-Policy-Report-Only: same-origin; report-to="youtube-marketing"Report-To: {"group":"youtube-marketing","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/youtube-marketing"}]}Content-Length: 2375X-Content-Type-Options: nosniffServer: sffeX-XSS-Protection: 0Date: Tue, 17 Oct 2023 11:16:40 GMTExpires: Wed, 16 Oct 2024 11:16:40 GMTCache-Control: public, max-age=31536000Age: 210844Last-Modified: Wed, 16 Oct 2019 17:15:00 GMTContent-Type: image/pngAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000�PNGIHDR��>a�IDATx�� ?��lv�"ʍ+��57w5��<�0�D�a�~��n`��yFaN*̉h�lٝ��;�>G�W�T��]}�+��#�*�"�6UQB9H�j��PD4f!�ȟ��ȡ�:4aU��dy(�M��4�¬]"N5�F�S��C�G'7�G�ku��7v/{f�[��y�o�W3��o�ѕ��8��!h�0�GM��U�x��]��f��f��4�k��7>M�_��e�y�B��}�k��9s�0k��m&��ш:�\��"��#˵:�s�g�֤��7E�� `��L�Wh��{Ϗ��V��q�lwjP�Z:2�^��k�d��ȡ�*4!H+$]0��7�Zo��i��SQA�y(�5!�$-�b�5�7��U��A�P��D�Y��[��$fB��>$)�2~�K�W�M}�O��׃*B��A��HT�Z�&�h80r$��+ ��B�`^��,��]�$U��DP#E�5��7}/�,z�7y^j(�X2�A%��J��FjKf��S��"74:T1819,Found URL "http://www.windows.com/pctv.update" - Source: "00000000-00000540.00000000.68211.023B0000.00000002.mdmp") Found URL "http://www.windows.com/pctv.select" - Source: "00000000-00000540.00000000.68211.023B0000.00000002.mdmp") Found URL "http://go.microsoft.com/fwlink/?linkid=53081" - Source: "00000000-00000540.00000000.68211.023B0000.00000002.mdmp") Found URL "http://go.microsoft.com/fwlink/?linkid=30564-http://go.microsoft.com/fwlink/?linkid=145764-http://go.microsoft.com/fwlink/?linkid=145764-http://go.microsoft.com/fwlink/?linkid=145764-http://go.microsoft.com/fwlink/?linkid=145764-http://go.microsoft.com/fwlink/?linkid=131536-http://go.microsoft.com/fwlink/?linkid=131535+http://go.microsoft.com/fwlink/?linkid=8430software" - Source: "00000000-00000540.00000000.68211.023B0000.00000002.mdmp") Found URL "http://go.microsoft.com/fwlink/?linkid=70599help" - Source: "00000000-00000540.00000000.68211.023B0000.00000002.mdmp") Found URL "http://go.microsoft.com/fwlink/?linkid=145837.presscheckcheckuncheckselectpresspresspresspressexecutepnow" - Source: "00000000-00000540.00000000.68211.023B0000.00000002.mdmp") Found URL "http://go.microsoft.com/fwlink/?linkid=57190microsoft" - Source: "00000000-00000540.00000000.68211.023B0000.00000002.mdmp") Found URL "http://go.microsoft.com/fwlink/?linkid=145765ehtray_notify_nullehtray_s_ignore_eventlow" - Source: "00000000-00000540.00000000.68211.023B0000.00000002.mdmp") Found URL "http://vista.gallery.microsoft.com/vista/sideshow.aspxgadgetsno" - Source: "00000000-00000540.00000000.68211.023B0000.00000002.mdmp") Found URL "http://www.icra.org/vocabulary/.nonelimitedsomeunrestrictednudity4no" - Source: "00000000-00000540.00000000.68211.023B0000.00000002.mdmp") Found URL "http://go.microsoft.com/fwlink/?linkid=32146" - Source: "00000000-00000540.00000000.68211.023B0000.00000002.mdmp") Found URL "http://go.microsoft.com/fwlink/?linkid=70183'res://wmploc.dll/offline_radioguide.htm&visualizationsshow" - Source: "00000000-00000540.00000000.68211.023B0000.00000002.mdmp") Found URL "http://images.metaservices.microsoft.com/cover/6http://redir.metaservices.microsoft.com/redir/buynow/?1http://redir.metaservices.microsoft.com/dvdcover/phttp://redir.metaservices.microsoft.com/redir/buynow/?,http://windowsmedia.com/redir/findmedia.asp?9http://redir.metaservices.microsoft.com/redir/getmdrdvd/?8http://redir.metaservices.microsoft.com/redir/getmdrcd/?bhttp://redir.metaservices.microsoft.com/redir/getmdrcdbackground/??http://redir.metaservices.microsoft.com/redir/getmdrcdposturl/?ihttp://redir.metaservices.microsoft.com/redir/getmdrcdposturlbackground/?=http://redir.metaservices.microsoft.com/redir/getdaiposturl/?:http://redir.metaservices.microsoft.com/redir/daifailure/?microsoft" - Source: "00000000-00000540.00000000.68211.023B0000.00000002.mdmp") Found URL "http://redir.metaservices.microsoft.com/redir/submittoc/?-http://windowsmedia.com/redir/querytocext.asp1res://wmploc.dll/offline_mediainfo_nowplaying.htm7http://redir.metaservices.microsoft.com/redir/buynowmg/,http://windowsmedia.com/redir/buyticket9.asp)http://windowsmedia.com/redir/idppage.asp)http://windowsmedia.com/redir/idplogo.aspsegoe" - Source: "00000000-00000540.00000000.68211.023B0000.00000002.mdmp") Found URL "http://go.microsoft.com/fwlink/?linkid=321507optimized" - Source: "00000000-00000540.00000000.68211.023B0000.00000002.mdmp") Found URL "http://go.microsoft.com/fwlink/?linkid=8792hdcd" - Source: "00000000-00000540.00000000.68211.023B0000.00000002.mdmp") Found URL "http://redir.metaservices.microsoft.com/redir/mediaguide/?9http://redir.metaservices.microsoft.com/redir/radiotuner/,http://windowsmedia.com/redir/querytocnp.asp" - Source: "00000000-00000540.00000000.68211.023B0000.00000002.mdmp") Found URL "http://redir.metaservices.microsoft.com/redir/dvddetails/9http://redir.metaservices.microsoft.com/redir/dvdwizard/?pshow" - Source: "00000000-00000540.00000000.68211.023B0000.00000002.mdmp") Found URL "http://windowsmedia.com/redir/services.asp?wmpfriendly=trueonlinestoresplearn" - Source: "00000000-00000540.00000000.68211.023B0000.00000002.mdmp") Found URL "http://www.microsoft.com/windows/windowsmedia/musicservices.aspx?http://redir.metaservices.microsoft.com/redir/allservices/?sv=2?http://redir.metaservices.microsoft.com/redir/allservices/?sv=3?http://redir.metaservices.microsoft.com/redir/allservices/?sv=5musicpicturesvideos/enter" - Source: "00000000-00000540.00000000.68211.023B0000.00000002.mdmp") Found URL "http://timevaluelmemlmemp744070866300202,3680,6,lpsecurityattributes,1lmempl&ubm&uh" - Source: "00000000-00001488.00000000.66085.003A0000.00000004.mdmp") Found URL "http://go.microsoft.c?linkid=42127" - Source: "00000000-00002728.00000000.65713.004A0000.00000004.mdmp") Found URL "http://go.microsoft.c?linkid=42127" - Source: "00000000-00002728.00000001.65755.004A0000.00000004.mdmp")75:T577,Found string "GET /login HTTP/1.1Accept: text/html, application/xhtml+xml, */*User-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateDNT: 1Host: www.facebook.comConnection: Keep-AliveAccept-Language: en-US" (Indicator: "HTTP/1.1"; File: "SSL") file/memory contains long string with (Indicator: "HTTP/1.1"; File: "SSL") Found string "HTTP/1.1 204 No ContentContent-Length: 0Cross-Origin-Resource-Policy: cross-originDate: Thu, 19 Oct 2023 21:51:07 GMTAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000" (Indicator: "HTTP/1.1"; File: "SSL") Found string "GET /rsrc.php/yb/r/hLRJ1GG_y0J.ico HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoHost: static.xx.fbcdn.netDNT: 1Connection: Keep-Alive" (Indicator: "HTTP/1.1"; File: "SSL") Found string "HTTP/1.1 304 Not ModifiedDate: Fri, 13 Oct 2023 11:41:28 GMTExpires: Sat, 12 Oct 2024 11:41:28 GMTAge: 554959Last-Modified: Mon, 16 Oct 2017 17:32:56 GMTCache-Control: public, max-age=31536000Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000" (Indicator: "HTTP/1.1"; File: "SSL") Found string "GET /favicon.ico HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoDNT: 1Connection: Keep-AliveHost: www.google.com" (Indicator: "HTTP/1.1"; File: "SSL")76:T28a7,Contains base62 string in header "MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAU" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base62 string in header "2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base62 string in header "ME4wTDBKMEgwRjAJBgUrDgMCGgUABBQwk" in header "GET /gtsr1/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBQwkcLWD4LqGJ7bE7B1XZsEbmfwUAQU5K8rJnEaK0gnhS9SZizv8IkTcT4CDQIDvFNZazTHGPUBUGY%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base62 string in header "cLWD4LqGJ7bE7B1XZsEbmfwUAQU5K8rJn" in header "GET /gtsr1/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBQwkcLWD4LqGJ7bE7B1XZsEbmfwUAQU5K8rJnEaK0gnhS9SZizv8IkTcT4CDQIDvFNZazTHGPUBUGY%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base62 string in header "EaK0gnhS9SZizv8IkTcT4CDQIDvFNZazT" in header "GET /gtsr1/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBQwkcLWD4LqGJ7bE7B1XZsEbmfwUAQU5K8rJnEaK0gnhS9SZizv8IkTcT4CDQIDvFNZazTHGPUBUGY%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base62 string in header "MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V" in header "GET /gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base62 string in header "MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfq" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEATh56TcXPLzbcArQrhdFZ8%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base62 string in header "hLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQ" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEATh56TcXPLzbcArQrhdFZ8%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base62 string in header "P4v0cB1JgmGggC72NkK8MCEATh56TcXPL" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEATh56TcXPLzbcArQrhdFZ8%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base62 string in header "MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTHL" in header "GET /gts1c3/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEQDD4iAmv7K7FRC9GgFEgKKE HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base62 string in header "2Fr4XN7pXNPZzQ4kYU83E1HScCEQDD4iA" in header "GET /gts1c3/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEQDD4iAmv7K7FRC9GgFEgKKE HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base62 string in header "MFEwTzBNMEswSTAJBgUrDgMCGgUABBTPJ" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTPJvUY%2Bsl%2Bj4yzQuAcL2oQno5fCgQUUWj%2FkK8CB3U8zNllZGKiErhZcjsCEAEjvRUG64sR2nXnhnVUNII%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base62 string in header "2FkK8CB3U8zNllZGKiErhZcjsCEAEjvRU" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTPJvUY%2Bsl%2Bj4yzQuAcL2oQno5fCgQUUWj%2FkK8CB3U8zNllZGKiErhZcjsCEAEjvRUG64sR2nXnhnVUNII%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base62 string in header "MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTHL" in header "GET /gts1c3/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEQDHFurBkDkysBLRERRg7lfk HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base62 string in header "2Fr4XN7pXNPZzQ4kYU83E1HScCEQDHFur" in header "GET /gts1c3/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEQDHFurBkDkysBLRERRg7lfk HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base62 string in header "MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHL" in header "GET /gts1c3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEBM9NSid4pOvCr35n90pfXk%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base62 string in header "2Fr4XN7pXNPZzQ4kYU83E1HScCEBM9NSi" in header "GET /gts1c3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEBM9NSid4pOvCr35n90pfXk%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base62 string in header "MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTHL" in header "GET /gts1c3/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEQDLYsQ7yv2LMwmxOu34tlfG HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base62 string in header "2Fr4XN7pXNPZzQ4kYU83E1HScCEQDLYsQ" in header "GET /gts1c3/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEQDLYsQ7yv2LMwmxOu34tlfG HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base62 string in header "MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrj" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAzlnDD9eoNTLi0BRrMy%2BWU%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base62 string in header "2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdi" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAzlnDD9eoNTLi0BRrMy%2BWU%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base62 string in header "uNkHMEWNpYim8S8YCEAzlnDD9eoNTLi0B" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAzlnDD9eoNTLi0BRrMy%2BWU%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base62 string in header "MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEA177el9ggmWelJjG4vdGL0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base62 string in header "2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEA177el9ggmWelJjG4vdGL0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base62 string in header "2BrkS7QYXjzkCEA177el9ggmWelJjG4vd" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEA177el9ggmWelJjG4vdGL0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base62 string in header "MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base62 string in header "2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base62 string in header "2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base62 string in header "MFEwTzBNMEswSTAJBgUrDgMCGgUABBT3x" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBT3xL4LQLXDRDM9P665TW442vrsUQQUReuir%2FSSy4IxLVGLp6chnfNtyA8CEA6bGI750C3n79tQ4ghAGFo%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base62 string in header "2FSSy4IxLVGLp6chnfNtyA8CEA6bGI750" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBT3xL4LQLXDRDM9P665TW442vrsUQQUReuir%2FSSy4IxLVGLp6chnfNtyA8CEA6bGI750C3n79tQ4ghAGFo%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base62 string in header "MFEwTzBNMEswSTAJBgUrDgMCGgUABBSRX" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSRXerF0eFeSWRripTgTkcJWMm7iQQUaDfg67Y7%2BF8Rhvv%2BYXsIiGX0TkICEATi7HzdaAMTTamxkE%2Fh8DM%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base62 string in header "erF0eFeSWRripTgTkcJWMm7iQQUaDfg67" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSRXerF0eFeSWRripTgTkcJWMm7iQQUaDfg67Y7%2BF8Rhvv%2BYXsIiGX0TkICEATi7HzdaAMTTamxkE%2Fh8DM%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base62 string in header "MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfI" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfIs%2BLjDtGwQ09XEB1Yeq%2BtX%2BBgQQU7NfjgtJxXWRM3y5nP%2Be6mK4cD08CEAitQLJg0pxMn17Nqb2Trtk%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base62 string in header "2Be6mK4cD08CEAitQLJg0pxMn17Nqb2Tr" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfIs%2BLjDtGwQ09XEB1Yeq%2BtX%2BBgQQU7NfjgtJxXWRM3y5nP%2Be6mK4cD08CEAitQLJg0pxMn17Nqb2Trtk%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com"77:T4a0,"23b876abb59c00ac24e3e0d934c0b920.exe" called "FindFirstFileW" with parameter %TEMP%\IXP000.TMP\*.* (UID: 00000000-00002516) "23b876abb59c00ac24e3e0d934c0b920.exe" called "FindNextFileW" with parameter .. (UID: 00000000-00002516) "23b876abb59c00ac24e3e0d934c0b920.exe" called "FindNextFileW" with parameter 6bT2Su1.exe (UID: 00000000-00002516) "23b876abb59c00ac24e3e0d934c0b920.exe" called "FindNextFileW" with parameter se3jY19.exe (UID: 00000000-00002516) "se3jY19.exe" called "FindFirstFileW" with parameter %TEMP%\IXP001.TMP\*.* (UID: 00000000-00002648) "se3jY19.exe" called "FindNextFileW" with parameter .. (UID: 00000000-00002648) "se3jY19.exe" called "FindNextFileW" with parameter 5Dy6eL3.exe (UID: 00000000-00002648) "se3jY19.exe" called "FindNextFileW" with parameter ho0Ot26.exe (UID: 00000000-00002648) "se3jY19.exe" called "FindFirstFileA" with parameter %TEMP%\IXP001.TMP\* (UID: 00000000-00002648) "se3jY19.exe" called "FindNextFileA" with parameter .. (UID: 00000000-00002648) "ho0Ot26.exe" called "FindFirstFileW" with parameter %TEMP%\IXP002.TMP\*.* (UID: 00000000-00004016) "ho0Ot26.exe" called "FindNextFileW" with parameter .. (UID: 00000000-00004016)78:T7cd,file/memory contains long string with (Indicator: "base64"; File: "zI56j6esQGz_1_.js") file/memory contains long string with (Indicator: ".decrypt"; File: "_tJ17sGyxOX_1_.js") file/memory contains long string with (Indicator: ".encrypt"; File: "_tJ17sGyxOX_1_.js") file/memory contains long string with (Indicator: "base64"; File: "_tJ17sGyxOX_1_.js") file/memory contains long string with (Indicator: "blowfish"; File: "_tJ17sGyxOX_1_.js") file/memory contains long string with (Indicator: "aes"; File: "SSL") file/memory contains long string with (Indicator: "base64"; File: "SSL") Found string "FromBase64" (Indicator: "base64"; File: "00000000-00003868.00000001.67838.00A02000.00000020.mdmp") Found string "FromBase64String" (Indicator: "base64"; File: "00000000-00003868.00000001.67838.00A02000.00000020.mdmp") Found string "FromBase64String" (Indicator: "FromBase64String"; File: "00000000-00003868.00000001.67838.00A02000.00000020.mdmp") Found string "MD5CryptoServiceProvider" (Indicator: "md5cryptoserviceprovider"; File: "00000000-00003868.00000001.67838.00A02000.00000020.mdmp") Found string "base64str" (Indicator: "base64"; File: "00000000-00003868.00000001.67838.00A02000.00000020.mdmp") Found string "System.Security.Cryptography.X509Certificates" (Indicator: "System.Security.Cryptography"; File: "00000000-00003868.00000001.67838.00A02000.00000020.mdmp") Found string "FromBase64CharArray" (Indicator: "base64"; File: "00000000-00003868.00000001.67838.00A02000.00000020.mdmp") Found string "System.Security.Cryptography" (Indicator: "System.Security.Cryptography"; File: "00000000-00003868.00000001.67838.00A02000.00000020.mdmp") file/memory contains long string with (Indicator: "base64"; File: "identifier_1_.htm") file/memory contains long string with (Indicator: "base64"; File: "identifier_2_.htm") file/memory contains long string with (Indicator: "base64"; File: "F6MGKB37.js") file/memory contains long string with (Indicator: "aes"; File: "F6MGKB37.js")79:T12d8,Found string "ZIndicates if the text in the edit control should appear as the default password character." (Indicator: "password"; File: "00000000-00003868.00000001.67838.00A02000.00000020.mdmp") file/memory contains long string with (Indicator: "password"; File: "F6MGKB37.js") Found string "No Caps LockHCaps Lock is on, which may cause you to enter your password incorrectly." (Indicator: "password"; Source: "00000000-00000540.00000000.68211.023B0000.00000002.mdmp") file/memory contains long string with (Indicator: "password"; Source: "00000000-00000540.00000000.68211.023B0000.00000002.mdmp") Found string "Use Internet connection: {0}/Dial-up or broadband with username and password" (Indicator: "password"; Source: "00000000-00000540.00000000.68211.023B0000.00000002.mdmp") Found string "Select Your Connection}Select your connection from the list. The connection must have a saved user name and password, and be available to all users." (Indicator: "password"; Source: "00000000-00000540.00000000.68211.023B0000.00000002.mdmp") Found string "Enter Your Dial-Up PassworddEnter the password for the connection you selected. You must use the keyboard to enter the password.P" (Indicator: "password"; Source: "00000000-00000540.00000000.68211.023B0000.00000002.mdmp") Found string "Confirm Password5These passwords do not match. Re-enter the passwords./Manually Download the TV Program Guide listings" (Indicator: "password"; Source: "00000000-00000540.00000000.68211.023B0000.00000002.mdmp") Found string "Windows Media Center requires an Internet connection with a saved password for all users to automatically download TV Program Guide listings." (Indicator: "password"; Source: "00000000-00000540.00000000.68211.023B0000.00000002.mdmp") Found string "This feature is not compatible with password-protected screen savers. To use this feature, disable the password protection on your Windows screen saver." (Indicator: "password"; Source: "00000000-00000540.00000000.68211.023B0000.00000002.mdmp") Found string "password" (Indicator: "password"; Source: "00000000-00000540.00000000.68211.023B0000.00000002.mdmp") Found string "Username or password error" (Indicator: "password"; Source: "00000000-00000540.00000000.68211.023B0000.00000002.mdmp") Found string "The username or password entered does not appear to be correct. Verify that the username and password are valid for the shared folder on the other computer.P" (Indicator: "password"; Source: "00000000-00000540.00000000.68211.023B0000.00000002.mdmp") Found string "No username entered0A password cannot be entered without a username." (Indicator: "password"; Source: "00000000-00000540.00000000.68211.023B0000.00000002.mdmp") Found string "Remember my password" (Indicator: "password"; Source: "00000000-00000540.00000000.68211.023B0000.00000002.mdmp") file/memory contains long string with (Indicator: "secret"; Source: "00000000-00000540.00000000.68211.023B0000.00000002.mdmp") Found string "Windows Media Center is unable to connect to the internet. Please check your username and password for your default Internet connection.%0" (Indicator: "password"; Source: "00000000-00000540.00000000.68211.023B0000.00000002.mdmp") Found string "Windows Update was unable to connect to proxy server %1 because valid credentials (user name and password) were required, but were either not available or were incorrect. Please check your proxy credentials, and then try searching again for updates." (Indicator: "password"; Source: "00000000-00000540.00000000.68211.023B0000.00000002.mdmp") Found string "Ask for password (NTLM)P" (Indicator: "password"; Source: "00000000-00000540.00000000.68211.023B0000.00000002.mdmp") Found string "You have chosen to make this site available offline and add it to your Active Desktop interface. If this site needs a password, please choose Customize and enter it." (Indicator: "password"; Source: "00000000-00000540.00000000.68211.023B0000.00000002.mdmp") Found string "Type your user name and password for this site." (Indicator: "password"; Source: "00000000-00000540.00000000.68211.023B0000.00000002.mdmp") Found string "If the site requires a user name and password:" (Indicator: "password"; Source: "00000000-00000540.00000000.68211.023B0000.00000002.mdmp") Found string "This channel requires a user name and password before you can download its content. You should have received this information from the content provider." (Indicator: "password"; Source: "00000000-00000540.00000000.68211.023B0000.00000002.mdmp") Found string "&Yes, my user name and password are:" (Indicator: "password"; Source: "00000000-00000540.00000000.68211.023B0000.00000002.mdmp") Found string "Does this site require a password?" (Indicator: "password"; Source: "00000000-00000540.00000000.68211.023B0000.00000002.mdmp")7a:T53f,"Cab1B67.tmp" has type "Microsoft Cabinet archive data Windows 2000/XP setup 63165 bytes 1 file at 0x2c +A "authroot.stl" number 1 6 datablocks 0x1 compression"- [targetUID: N/A] "57C8EDB95DF3F0AD4EE2DC2B8CFD4157" has type "Microsoft Cabinet archive data Windows 2000/XP setup 4770 bytes 1 file at 0x2c +A "disallowedcert.stl" number 1 1 datablock 0x1 compression"- [targetUID: 00000000-00000576] "77EC63BDA74BD0D0E0426DC8F8008506" has type "Microsoft Cabinet archive data Windows 2000/XP setup 63165 bytes 1 file at 0x2c +A "authroot.stl" number 1 6 datablocks 0x1 compression"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506]- [targetUID: 00000000-00000764] "Cab22D7.tmp" has type "Microsoft Cabinet archive data Windows 2000/XP setup 63165 bytes 1 file at 0x2c +A "authroot.stl" number 1 6 datablocks 0x1 compression"- Location: [%TEMP%\Cab22D7.tmp]- [targetUID: 00000000-00000576] "Cab270D.tmp" has type "Microsoft Cabinet archive data Windows 2000/XP setup 63165 bytes 1 file at 0x2c +A "authroot.stl" number 1 6 datablocks 0x1 compression"- Location: [%TEMP%\Cab270D.tmp]- [targetUID: 00000000-00000764] "Cab1828.tmp" has type "Microsoft Cabinet archive data Windows 2000/XP setup 63165 bytes 1 file at 0x2c +A "authroot.stl" number 1 6 datablocks 0x1 compression"- [targetUID: N/A]7b:Tc007,"initAft()