24:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/1f7k-b47qno-6.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/3fc9w1ah_nm2g.js"],"SampleDetailWrapper"] 79:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/1f7k-b47qno-6.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 23:T4a9,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious BrResMon.Generic Sample fc38866bc8b8… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample fc38866bc8b8…. Malware family: BrResMon.Generic. Threat score 100/100. 19/27 AV engines flagged this file. 13 malicious and 13 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336","keywords":["Malicious","BrResMon.Generic","malware analysis","sandbox report","threat intelligence","fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336"],"about":{"@type":"SoftwareApplication","name":"d938eea3995975254eb0d6fd7a86eab2.exe","applicationCategory":["peexe","executable"],"identifier":"fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"BrResMon.Generic","antivirusDetections":{"malicious":19,"total":27},"behavioralIndicators":{"malicious":13,"suspicious":13},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}25:Tb08,Found reference to API (Indicator: "CreateThreadpoolWait"; Source: "sample.bin"), Found reference to API (Indicator: "SetThreadpoolWait"; Source: "sample.bin"), Found reference to API (Indicator: "CloseThreadpoolWait"; Source: "sample.bin"), Found reference to API (Indicator: "LCMapStringEx"; Source: "sample.bin"), Found reference to API (Indicator: "FlsFree"; Source: "sample.bin"), Found reference to API (Indicator: "FlsAlloc"; Source: "sample.bin"), Found reference to API (Indicator: "FlushProcessWriteBuffers"; Source: "sample.bin"), Found reference to API (Indicator: "CreateSemaphoreExW"; Source: "sample.bin"), Found reference to API (Indicator: "FlsGetValue"; Source: "sample.bin"), Found reference to API (Indicator: "GetLogicalProcessorInformation"; Source: "sample.bin"), Found reference to API (Indicator: "CreateSymbolicLinkW"; Source: "sample.bin"), Found reference to API (Indicator: "GetTickCount64"; Source: "sample.bin"), Found reference to API (Indicator: "GetLastActivePopup"; Source: "sample.bin"), Found reference to API (Indicator: "EnumSystemLocalesEx"; Source: "sample.bin"), Found reference to API (Indicator: "GetUserObjectInformationW"; Source: "sample.bin"), Found reference to API (Indicator: "SetDefaultDllDirectories"; Source: "sample.bin"), Found reference to API (Indicator: "CompareStringEx"; Source: "sample.bin"), Found reference to API (Indicator: "FreeLibraryWhenCallbackReturns"; Source: "sample.bin"), Found reference to API (Indicator: "WaitForThreadpoolTimerCallbacks"; Source: "sample.bin"), Found reference to API (Indicator: "GetDateFormatEx"; Source: "sample.bin"), Found reference to API (Indicator: "CloseThreadpoolTimer"; Source: "sample.bin"), Found reference to API (Indicator: "GetCurrentProcessorNumber"; Source: "sample.bin"), Found reference to API (Indicator: "MessageBoxW"; Source: "sample.bin"), Found reference to API (Indicator: "GetActiveWindow"; Source: "sample.bin"), Found reference to API (Indicator: "InitializeCriticalSectionEx"; Source: "sample.bin"), Found reference to API (Indicator: "GetTimeFormatEx"; Source: "sample.bin"), Found reference to API (Indicator: "GetProcessWindowStation"; Source: "sample.bin"), Found reference to API (Indicator: "FlsSetValue"; Source: "sample.bin"), Found reference to API (Indicator: "CreateThreadpoolTimer"; Source: "sample.bin"), Found reference to API (Indicator: "SetThreadpoolTimer"; Source: "sample.bin"), Found reference to API (Indicator: "IsValidLocaleName"; Source: "sample.bin"), Found reference to API (Indicator: "GetUserDefaultLocaleName"; Source: "sample.bin"), Found reference to API (Indicator: "CreateEventExW"; Source: "sample.bin"), Found reference to API (Indicator: "GetLocaleInfoEx"; Source: "sample.bin"), Found reference to API (Indicator: "SetThreadStackGuarantee"; Source: "sample.bin")26:Tc00,Found reference to "DlSHA512 block transform for x86, CRYPTOGAMS by " (Indicator: "SHA512"; File: "00000000-00003936.00000001.81096.00400000.00000040.mdmp") Found reference to "HMAC routines" (Indicator: "HMAC"; File: "00000000-00003936.00000001.81096.00400000.00000040.mdmp") Found reference to "HMAC_Init_ex" (Indicator: "HMAC"; File: "00000000-00003936.00000001.81096.00400000.00000040.mdmp") Found reference to "RC2_MAGIC_TO_METH" (Indicator: "RC2"; File: "00000000-00003936.00000001.81096.00400000.00000040.mdmp") Found reference to "RSA-SHA384" (Indicator: "SHA384"; File: "00000000-00003936.00000001.81096.00400000.00000040.mdmp") Found reference to "RSA-SHA512" (Indicator: "SHA512"; File: "00000000-00003936.00000001.81096.00400000.00000040.mdmp") Found reference to "SHA384" (Indicator: "SHA384"; File: "00000000-00003936.00000001.81096.00400000.00000040.mdmp") Found reference to "SHA512" (Indicator: "SHA512"; File: "00000000-00003936.00000001.81096.00400000.00000040.mdmp") Found reference to "HMAC-MD5" (Indicator: "HMAC"; File: "00000000-00003936.00000001.81096.00400000.00000040.mdmp") Found reference to "HMAC-SHA1" (Indicator: "HMAC"; File: "00000000-00003936.00000001.81096.00400000.00000040.mdmp") Found reference to "ecdsa-with-SHA384" (Indicator: "SHA384"; File: "00000000-00003936.00000001.81096.00400000.00000040.mdmp") Found reference to "ecdsa-with-SHA512" (Indicator: "SHA512"; File: "00000000-00003936.00000001.81096.00400000.00000040.mdmp") Found reference to "hmacWithSHA384" (Indicator: "SHA384"; File: "00000000-00003936.00000001.81096.00400000.00000040.mdmp") Found reference to "hmacWithSHA512" (Indicator: "SHA512"; File: "00000000-00003936.00000001.81096.00400000.00000040.mdmp") Found reference to "id-HMACGostR3411-94" (Indicator: "HMAC"; File: "00000000-00003936.00000001.81096.00400000.00000040.mdmp") Found reference to "HMAC GOST 34.11-94" (Indicator: "HMAC"; File: "00000000-00003936.00000001.81096.00400000.00000040.mdmp") Found reference to "RC2-CBC" (Indicator: "RC2"; File: "00000000-00003936.00000001.81096.00400000.00000040.mdmp") Found reference to "RC2-ECB" (Indicator: "RC2"; File: "00000000-00003936.00000001.81096.00400000.00000040.mdmp") Found reference to "RC2-CFB" (Indicator: "RC2"; File: "00000000-00003936.00000001.81096.00400000.00000040.mdmp") Found reference to "RC2-OFB" (Indicator: "RC2"; File: "00000000-00003936.00000001.81096.00400000.00000040.mdmp") Found reference to "PBE-SHA1-RC2-64" (Indicator: "RC2"; File: "00000000-00003936.00000001.81096.00400000.00000040.mdmp") Found reference to "pbeWithSHA1AndRC2-CBC" (Indicator: "RC2"; File: "00000000-00003936.00000001.81096.00400000.00000040.mdmp") Found reference to "RC2-40-CBC" (Indicator: "RC2"; File: "00000000-00003936.00000001.81096.00400000.00000040.mdmp") Found reference to "RC4-HMAC-MD5" (Indicator: "HMAC"; File: "00000000-00003936.00000001.81096.00400000.00000040.mdmp") Found reference to "AES-128-CBC-HMAC-SHA1" (Indicator: "HMAC"; File: "00000000-00003936.00000001.81096.00400000.00000040.mdmp")27:T8e1,Found PE header "MZ" - Source: "00000000-00001112.00000000.92282.03D00000.00000040.mdmp") Found PE header "MZ" - Source: "00000000-00001260.00000000.90318.00400000.00000040.mdmp") Found PE header "MZ" - Source: "00000000-00001260.00000001.91374.00400000.00000040.mdmp") Found PE header "MZ" - Source: "00000000-00001316.00000000.81962.00400000.00000040.mdmp") Found PE header "MZ" - Source: "00000000-00001316.00000001.83107.00400000.00000040.mdmp") Found PE header "MZ" - Source: "00000000-00001460.00000000.84618.00400000.00000040.mdmp") Found PE header "MZ" - Source: "00000000-00001460.00000001.85504.00400000.00000040.mdmp") Found PE header "MZ" - Source: "00000000-00001936.00000000.82481.00400000.00000040.mdmp") Found PE header "MZ" - Source: "00000000-00001936.00000001.83411.00400000.00000040.mdmp") Found PE header "MZ" - Source: "00000000-00002112.00000000.91290.00400000.00000040.mdmp") Found PE header "MZ" - Source: "00000000-00002112.00000001.92399.00400000.00000040.mdmp") Found PE header "MZ" - Source: "00000000-00002340.00000000.92422.00400000.00000040.mdmp") Found PE header "MZ" - Source: "00000000-00002408.00000000.83276.00400000.00000040.mdmp") Found PE header "MZ" - Source: "00000000-00002408.00000001.84654.00400000.00000040.mdmp") Found PE header "MZ" - Source: "00000000-00002436.00000000.81409.03D10000.00000040.mdmp") Found PE header "MZ" - Source: "00000000-00002784.00000000.81480.00400000.00000040.mdmp") Found PE header "MZ" - Source: "00000000-00002784.00000001.82152.00400000.00000040.mdmp") Found PE header "MZ" - Source: "00000000-00002880.00000001.84512.03DA0000.00000040.mdmp") Found PE header "MZ" - Source: "00000000-00002992.00000000.83813.03DC0000.00000040.mdmp") Found PE header "MZ" - Source: "00000000-00002992.00000000.83813.04090000.00000040.mdmp") Found PE header "MZ" - Source: "00000000-00003176.00000000.91995.00400000.00000040.mdmp") Found PE header "MZ" - Source: "00000000-00003216.00000001.86344.03D70000.00000040.mdmp") Found PE header "MZ" - Source: "00000000-00003232.00000000.82323.02FA0000.00000040.mdmp") Found PE header "MZ" - Source: "00000000-00003320.00000000.91892.03CD0000.00000040.mdmp") Found PE header "MZ" - Source: "00000000-00003336.00000000.89478.00400000.00000040.mdmp")28:Tab7,"fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\CERTIFICATES\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25") "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\CERTIFICATES\6252DC40F71143A22FDE9EF7348E064251B18118") "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\CERTIFICATES\6252DC40F71143A22FDE9EF7348E064251B18118") "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\CERTIFICATES\627F8D7827656399D27D7F9044C9FEB3F33EFA9A") "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\CERTIFICATES\627F8D7827656399D27D7F9044C9FEB3F33EFA9A") "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\CERTIFICATES\67650DF17E8E7E5B8240A4F4564BCFE23D69C6F0") "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\CERTIFICATES\67650DF17E8E7E5B8240A4F4564BCFE23D69C6F0") "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\CERTIFICATES\74207441729CDD92EC7931D823108DC28192E2BB") "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\CERTIFICATES\74207441729CDD92EC7931D823108DC28192E2BB") "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\CERTIFICATES\742C3192E607E424EB4549542BE1BBC53E6174E2") "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\CERTIFICATES\742C3192E607E424EB4549542BE1BBC53E6174E2") "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\CERTIFICATES\75E0ABB6138512271C04F85FDDDE38E4B7242EFE") "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\CERTIFICATES\75E0ABB6138512271C04F85FDDDE38E4B7242EFE")29:T616,"fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" queried SystemProcessInformation at 00000000-00003936-00000105-17589982 [PID: 3936] "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" queried SystemProcessInformation at 00000000-00003936-00000105-17590557 [PID: 3936] "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" queried SystemProcessInformation at 00000000-00002784-00000105-15063897 [PID: 2784] "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" queried SystemProcessInformation at 00000000-00002784-00000105-15064322 [PID: 2784] "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" queried SystemProcessInformation at 00000000-00001316-00000105-22703373 [PID: 1316] "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" queried SystemProcessInformation at 00000000-00001316-00000105-22703926 [PID: 1316] "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" queried SystemProcessInformation at 00000000-00001936-00000105-18661501 [PID: 1936] "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" queried SystemProcessInformation at 00000000-00001936-00000105-18662050 [PID: 1936] "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" queried SystemProcessInformation at 00000000-00002408-00000105-26306052 [PID: 2408] "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" queried SystemProcessInformation at 00000000-00002408-00000105-26306625 [PID: 2408]2a:Td00,Found api reference "CryptAcquireContextW" (Indicator: "CryptAcquireContextW"; File: "00000000-00003936.00000001.81096.00400000.00000040.mdmp") Found api reference "CryptGenRandom" (Indicator: "CryptGenRandom"; File: "00000000-00003936.00000001.81096.00400000.00000040.mdmp") Found api reference "CryptReleaseContext" (Indicator: "CryptReleaseContext"; File: "00000000-00003936.00000001.81096.00400000.00000040.mdmp") Found api reference "CryptGetHashParam" (Indicator: "CryptGetHashParam"; File: "00000000-00003936.00000001.81096.00400000.00000040.mdmp") Found api reference "CryptImportKey" (Indicator: "CryptImportKey"; File: "00000000-00003936.00000001.81096.00400000.00000040.mdmp") Found api reference "CryptEncrypt" (Indicator: "CryptEncrypt"; File: "00000000-00003936.00000001.81096.00400000.00000040.mdmp") Found api reference "CryptCreateHash" (Indicator: "CryptCreateHash"; File: "00000000-00003936.00000001.81096.00400000.00000040.mdmp") Found api reference "CryptDestroyHash" (Indicator: "CryptDestroyHash"; File: "00000000-00003936.00000001.81096.00400000.00000040.mdmp") Found api reference "CryptHashData" (Indicator: "CryptHashData"; File: "00000000-00003936.00000001.81096.00400000.00000040.mdmp") Found api reference "CryptStringToBinaryA" (Indicator: "CryptStringToBinaryA"; File: "00000000-00003936.00000001.81096.00400000.00000040.mdmp") Found api reference "CryptAcquireContextW" (Indicator: "CryptAcquireContextW"; Source: "00000000-00001260.00000000.90318.00400000.00000040.mdmp, 00000000-00001260.00000001.91374.00400000.00000040.mdmp") Found api reference "CryptGenRandom" (Indicator: "CryptGenRandom"; Source: "00000000-00001260.00000000.90318.00400000.00000040.mdmp, 00000000-00001260.00000001.91374.00400000.00000040.mdmp") Found api reference "CryptReleaseContext" (Indicator: "CryptReleaseContext"; Source: "00000000-00001260.00000000.90318.00400000.00000040.mdmp, 00000000-00001260.00000001.91374.00400000.00000040.mdmp") Found api reference "CryptGetHashParam" (Indicator: "CryptGetHashParam"; Source: "00000000-00001260.00000000.90318.00400000.00000040.mdmp, 00000000-00001260.00000001.91374.00400000.00000040.mdmp") Found api reference "CryptImportKey" (Indicator: "CryptImportKey"; Source: "00000000-00001260.00000000.90318.00400000.00000040.mdmp, 00000000-00001260.00000001.91374.00400000.00000040.mdmp") Found api reference "CryptEncrypt" (Indicator: "CryptEncrypt"; Source: "00000000-00001260.00000000.90318.00400000.00000040.mdmp, 00000000-00001260.00000001.91374.00400000.00000040.mdmp") Found api reference "CryptCreateHash" (Indicator: "CryptCreateHash"; Source: "00000000-00001260.00000000.90318.00400000.00000040.mdmp, 00000000-00001260.00000001.91374.00400000.00000040.mdmp") Found api reference "CryptDestroyHash" (Indicator: "CryptDestroyHash"; Source: "00000000-00001260.00000000.90318.00400000.00000040.mdmp, 00000000-00001260.00000001.91374.00400000.00000040.mdmp") Found api reference "CryptHashData" (Indicator: "CryptHashData"; Source: "00000000-00001260.00000000.90318.00400000.00000040.mdmp, 00000000-00001260.00000001.91374.00400000.00000040.mdmp") Found api reference "CryptStringToBinaryA" (Indicator: "CryptStringToBinaryA"; Source: "00000000-00001260.00000000.90318.00400000.00000040.mdmp, 00000000-00001260.00000001.91374.00400000.00000040.mdmp")2b:T11a9,Assembly shows XOR instruction xor eax ebp in Stream UID: 38229-100-0040C276 Assembly shows XOR instruction xor ecx ebp in Stream UID: 38229-100-0040C276 Assembly shows XOR instruction xor eax ebp in Stream UID: 38229-162-00411A03 Assembly shows XOR instruction xor ecx ebp in Stream UID: 38229-162-00411A03 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00003936-40981-17-00427FAE Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00003936-40981-17-00427FAE Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00003936-40981-23-00424168 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00003936-40981-23-00424168 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00003936-40981-29-0042A57A Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00003936-40981-29-0042A57A Assembly shows XOR instruction xor eax dword ptr [0050AD20h] in Stream UID: 00000000-00003936-40981-40-0043263E Assembly shows XOR instruction xor eax dword ptr [0050AD20h] in Stream UID: 00000000-00003936-40981-47-00432553 Assembly shows XOR instruction xor eax dword ptr [0050AD20h] in Stream UID: 00000000-00003936-40981-50-00432534 Assembly shows XOR instruction xor eax dword ptr [0050AD20h] in Stream UID: 00000000-00003936-40981-94-00438908 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00003936-40981-170-004211DD Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00003936-40981-170-004211DD Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00003936-40981-185-0042E003 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00003936-40981-185-0042E003 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00003936-40981-205-0043CA35 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00003936-40981-205-0043CA35 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00003936-40981-243-00426AB6 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00003936-40981-243-00426AB6 Assembly shows XOR instruction xor eax esp in Stream UID: 00000000-00003936-40981-259-00454AE0 Assembly shows XOR instruction xor ecx esp in Stream UID: 00000000-00003936-40981-259-00454AE0 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00003936-40981-260-004549A0 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00003936-40981-260-004549A0 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00003936-40981-300-00433E00 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00003936-40981-300-00433E00 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00003936-40981-453-0042A89E Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00003936-40981-453-0042A89E Assembly shows XOR instruction xor al byte ptr [ebp-02h] in Stream UID: 00000000-00003936-40981-504-0043BAC1 Assembly shows XOR instruction xor byte ptr [ecx+edx+24h] al in Stream UID: 00000000-00003936-40981-504-0043BAC1 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00003936-40981-600-0044D4BA Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00003936-40981-600-0044D4BA Assembly shows XOR instruction xor eax dword ptr [0050AD20h] in Stream UID: 00000000-00003936-40981-601-004386C2 Assembly shows XOR instruction xor eax dword ptr [0050AD20h] in Stream UID: 00000000-00003936-40981-618-00438805 Assembly shows XOR instruction xor eax dword ptr [0050AD20h] in Stream UID: 00000000-00003936-40981-619-0043887D Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00003936-40981-626-004230C5 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00003936-40981-626-004230C5 Assembly shows XOR instruction xor eax dword ptr [ebp-0Ch] in Stream UID: 00000000-00003936-40981-657-004321A1 Assembly shows XOR instruction xor dword ptr [ebp-04h] eax in Stream UID: 00000000-00003936-40981-657-004321A1 Assembly shows XOR instruction xor ecx dword ptr [ebp-14h] in Stream UID: 00000000-00003936-40981-657-004321A1 Assembly shows XOR instruction xor ecx dword ptr [ebp-04h] in Stream UID: 00000000-00003936-40981-657-004321A1 Assembly shows XOR instruction xor ecx eax in Stream UID: 00000000-00003936-40981-657-004321A1 Assembly shows XOR instruction xor eax dword ptr [0050AD20h] in Stream UID: 00000000-00003936-40981-667-004325152c:T459,Found reference to API "CryptAcquireContextW" (Indicator: "CryptAcquireContext"; File: "00000000-00003936.00000001.81096.00400000.00000040.mdmp") Found reference to API "CryptReleaseContext" (Indicator: "CryptReleaseContext"; File: "00000000-00003936.00000001.81096.00400000.00000040.mdmp") Found reference to API "CryptGetHashParam" (Indicator: "CryptGetHashParam"; File: "00000000-00003936.00000001.81096.00400000.00000040.mdmp") Found reference to API "CryptImportKey" (Indicator: "CryptImportKey"; File: "00000000-00003936.00000001.81096.00400000.00000040.mdmp") Found reference to API "CryptEncrypt" (Indicator: "CryptEncrypt"; File: "00000000-00003936.00000001.81096.00400000.00000040.mdmp") Found reference to API "CryptCreateHash" (Indicator: "CryptCreateHash"; File: "00000000-00003936.00000001.81096.00400000.00000040.mdmp") Found reference to API "CryptDestroyHash" (Indicator: "CryptDestroyHash"; File: "00000000-00003936.00000001.81096.00400000.00000040.mdmp") Found reference to API "CryptHashData" (Indicator: "CryptHashData"; File: "00000000-00003936.00000001.81096.00400000.00000040.mdmp")2d:T4e2,Found reference to API "CryptAcquireContextW" (Indicator: "CryptAcquireContextW"; File: "00000000-00003936.00000001.81096.00400000.00000040.mdmp") Found reference to API "CryptGenRandom" (Indicator: "CryptGenRandom"; File: "00000000-00003936.00000001.81096.00400000.00000040.mdmp") Found reference to API "CryptReleaseContext" (Indicator: "CryptReleaseContext"; File: "00000000-00003936.00000001.81096.00400000.00000040.mdmp") Found reference to API "CryptGetHashParam" (Indicator: "CryptGetHashParam"; File: "00000000-00003936.00000001.81096.00400000.00000040.mdmp") Found reference to API "CryptImportKey" (Indicator: "CryptImportKey"; File: "00000000-00003936.00000001.81096.00400000.00000040.mdmp") Found reference to API "CryptEncrypt" (Indicator: "CryptEncrypt"; File: "00000000-00003936.00000001.81096.00400000.00000040.mdmp") Found reference to API "CryptCreateHash" (Indicator: "CryptCreateHash"; File: "00000000-00003936.00000001.81096.00400000.00000040.mdmp") Found reference to API "CryptDestroyHash" (Indicator: "CryptDestroyHash"; File: "00000000-00003936.00000001.81096.00400000.00000040.mdmp") Found reference to API "CryptHashData" (Indicator: "CryptHashData"; File: "00000000-00003936.00000001.81096.00400000.00000040.mdmp")2e:Tca0,Found string "ANY PRIVATE KEY" (Indicator: "private key"; File: "00000000-00003936.00000001.81096.00400000.00000040.mdmp") Found string "ENCRYPTED PRIVATE KEY" (Indicator: "private key"; File: "00000000-00003936.00000001.81096.00400000.00000040.mdmp") Found string "Private Key" (Indicator: "private key"; File: "00000000-00003936.00000001.81096.00400000.00000040.mdmp") Found string "Subject Public Key Info:" (Indicator: "public key"; File: "00000000-00003936.00000001.81096.00400000.00000040.mdmp") Found string "%12sPublic Key Algorithm:" (Indicator: "public key"; File: "00000000-00003936.00000001.81096.00400000.00000040.mdmp") Found string "%12sUnable to load Public Key" (Indicator: "public key"; File: "00000000-00003936.00000001.81096.00400000.00000040.mdmp") Found string "Public Key" (Indicator: "public key"; File: "00000000-00003936.00000001.81096.00400000.00000040.mdmp") Found string "%s PRIVATE KEY" (Indicator: "private key"; File: "00000000-00003936.00000001.81096.00400000.00000040.mdmp") Found string "RSA PRIVATE KEY" (Indicator: "private key"; File: "00000000-00003936.00000001.81096.00400000.00000040.mdmp") Found string "EC PRIVATE KEY" (Indicator: "private key"; File: "00000000-00003936.00000001.81096.00400000.00000040.mdmp") Found string "DSA PRIVATE KEY" (Indicator: "private key"; File: "00000000-00003936.00000001.81096.00400000.00000040.mdmp") Found string "RSA PUBLIC KEY" (Indicator: "public key"; File: "00000000-00003936.00000001.81096.00400000.00000040.mdmp") Found string "private key header missing" (Indicator: "private key"; File: "00000000-00003936.00000001.81096.00400000.00000040.mdmp") Found string "unable to decode rsa private key" (Indicator: "private key"; File: "00000000-00003936.00000001.81096.00400000.00000040.mdmp") Found string "unknown public key type" (Indicator: "public key"; File: "00000000-00003936.00000001.81096.00400000.00000040.mdmp") Found string "unsupported public key type" (Indicator: "public key"; File: "00000000-00003936.00000001.81096.00400000.00000040.mdmp") Found string "wrong public key type" (Indicator: "public key"; File: "00000000-00003936.00000001.81096.00400000.00000040.mdmp") Found string "invalid private key" (Indicator: "private key"; File: "00000000-00003936.00000001.81096.00400000.00000040.mdmp") Found string "missing private key" (Indicator: "private key"; File: "00000000-00003936.00000001.81096.00400000.00000040.mdmp") Found string "invalid public key" (Indicator: "public key"; File: "00000000-00003936.00000001.81096.00400000.00000040.mdmp") Found string "private key decode error" (Indicator: "private key"; File: "00000000-00003936.00000001.81096.00400000.00000040.mdmp") Found string "private key encode error" (Indicator: "private key"; File: "00000000-00003936.00000001.81096.00400000.00000040.mdmp") Found string "public key not rsa" (Indicator: "public key"; File: "00000000-00003936.00000001.81096.00400000.00000040.mdmp") Found string "unsupported private key algorithm" (Indicator: "private key"; File: "00000000-00003936.00000001.81096.00400000.00000040.mdmp") Found string "error converting private key" (Indicator: "private key"; File: "00000000-00003936.00000001.81096.00400000.00000040.mdmp")2f:T1121,Contains base64 string in header "Keep" in header "GET /r/gsr1.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: c.pki.goog" Contains base64 string in header "User" in header "GET /r/gsr1.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: c.pki.goog" Contains base64 string in header "goog" in header "GET /r/gsr1.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: c.pki.goog" Contains base64 string in header "Keep" in header "GET /we1/8GJyPhuLa-4.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: c.pki.goog" Contains base64 string in header "User" in header "GET /we1/8GJyPhuLa-4.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: c.pki.goog" Contains base64 string in header "goog" in header "GET /we1/8GJyPhuLa-4.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: c.pki.goog" Contains base64 string in header "Keep" in header "GET /r/r4.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: c.pki.goog" Contains base64 string in header "User" in header "GET /r/r4.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: c.pki.goog" Contains base64 string in header "goog" in header "GET /r/r4.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: c.pki.goog" Contains base64 string in header "Keep" in header "GET /we1/8GJyPhuLa-4.crl HTTP/1.1Cache-Control: max-age = 3000Connection: Keep-AliveAccept: */*If-Modified-Since: Wed, 16 Sep 2026 07:49:31 GMTUser-Agent: Microsoft-CryptoAPI/6.1Host: c.pki.goog" Contains base64 string in header "Modified" in header "GET /we1/8GJyPhuLa-4.crl HTTP/1.1Cache-Control: max-age = 3000Connection: Keep-AliveAccept: */*If-Modified-Since: Wed, 16 Sep 2026 07:49:31 GMTUser-Agent: Microsoft-CryptoAPI/6.1Host: c.pki.goog" Contains base64 string in header "2026" in header "GET /we1/8GJyPhuLa-4.crl HTTP/1.1Cache-Control: max-age = 3000Connection: Keep-AliveAccept: */*If-Modified-Since: Wed, 16 Sep 2026 07:49:31 GMTUser-Agent: Microsoft-CryptoAPI/6.1Host: c.pki.goog" Contains base64 string in header "goog" in header "GET /we1/8GJyPhuLa-4.crl HTTP/1.1Cache-Control: max-age = 3000Connection: Keep-AliveAccept: */*If-Modified-Since: Wed, 16 Sep 2026 07:49:31 GMTUser-Agent: Microsoft-CryptoAPI/6.1Host: c.pki.goog" Contains base64 string in header "Keep" in header "GET /r/gsr1.crl HTTP/1.1Cache-Control: max-age = 3000Connection: Keep-AliveAccept: */*If-Modified-Since: Mon, 31 Aug 2026 08:08:00 GMTUser-Agent: Microsoft-CryptoAPI/6.1Host: c.pki.goog" Contains base64 string in header "Modified" in header "GET /r/gsr1.crl HTTP/1.1Cache-Control: max-age = 3000Connection: Keep-AliveAccept: */*If-Modified-Since: Mon, 31 Aug 2026 08:08:00 GMTUser-Agent: Microsoft-CryptoAPI/6.1Host: c.pki.goog" Contains base64 string in header "2026" in header "GET /r/gsr1.crl HTTP/1.1Cache-Control: max-age = 3000Connection: Keep-AliveAccept: */*If-Modified-Since: Mon, 31 Aug 2026 08:08:00 GMTUser-Agent: Microsoft-CryptoAPI/6.1Host: c.pki.goog" Contains base64 string in header "goog" in header "GET /r/gsr1.crl HTTP/1.1Cache-Control: max-age = 3000Connection: Keep-AliveAccept: */*If-Modified-Since: Mon, 31 Aug 2026 08:08:00 GMTUser-Agent: Microsoft-CryptoAPI/6.1Host: c.pki.goog" Contains base64 string in header "Keep" in header "GET /r/r4.crl HTTP/1.1Cache-Control: max-age = 3000Connection: Keep-AliveAccept: */*If-Modified-Since: Wed, 11 Feb 2026 14:38:00 GMTUser-Agent: Microsoft-CryptoAPI/6.1Host: c.pki.goog" Contains base64 string in header "Modified" in header "GET /r/r4.crl HTTP/1.1Cache-Control: max-age = 3000Connection: Keep-AliveAccept: */*If-Modified-Since: Wed, 11 Feb 2026 14:38:00 GMTUser-Agent: Microsoft-CryptoAPI/6.1Host: c.pki.goog" Contains base64 string in header "2026" in header "GET /r/r4.crl HTTP/1.1Cache-Control: max-age = 3000Connection: Keep-AliveAccept: */*If-Modified-Since: Wed, 11 Feb 2026 14:38:00 GMTUser-Agent: Microsoft-CryptoAPI/6.1Host: c.pki.goog" Contains base64 string in header "goog" in header "GET /r/r4.crl HTTP/1.1Cache-Control: max-age = 3000Connection: Keep-AliveAccept: */*If-Modified-Since: Wed, 11 Feb 2026 14:38:00 GMTUser-Agent: Microsoft-CryptoAPI/6.1Host: c.pki.goog"30:T6da,The analysis contains indicators for crypto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Decrypted SSL network traffic Matched sigs: Contains reference to cryptographic keys Matched sigs: Contains CRYPTO related strings Matched sigs: Contains ability to attach base64 encoded attachment to an email Matched sigs: Contains key cryptographic functions (API string) Matched sigs: Able to use Microsoft's Enhanced Cryptographic Provider Matched sigs: Contains ability to perform AES/RC4 encryption (API string) Matched sigs: Contains ability to use Cryptographic classes Matched sigs: Contains ability to use AES encryption instructions Matched sigs: Able to import cryptographic keys (seen in ransomware) Matched sigs: Contains ability to encrypt/encode message (API string) Matched sigs: Able to utilize the Windows bcrypt cryptographic API Matched sigs: Contains reference to crypto DLLs Matched sigs: Contains ability to perform Base64 encoding/decoding Matched sigs: Calls an API typically used to import asymmetric cryptographic keys into a CSP Matched sigs: Reads the cryptographic machine GUID Matched sigs: Calls an API typically used to encrypt a block of data Matched sigs: Calls an API typically used to decrypt a block of data Matched sigs: HTTP requests contain Base64 strings Matched sigs: Dropped file has high entropy (likely encrypted/compressed content) Matched sigs: Sample file has high entropy (likely encrypted/compressed content) Matched sigs: Contains XOR operation loops [Stream disassembly] Matched sigs: Contains key cryptographic functions of the CryptoAPI Matched sigs: YARA signature match - AES encryption Matched sigs: YARA signature match – cryptographic algorithms31:T13e6,Found XOR loop in file "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" at offset 103304; code bytes = 30d0 Found XOR loop in file "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" at offset 148938; code bytes = 30d0 Found XOR loop in file "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" at offset 387892; code bytes = 30d0 Found XOR loop in file "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" at offset 393291; code bytes = 30d0 Found XOR loop in file "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" at offset 396062; code bytes = 30d0 Found XOR loop in file "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" at offset 486267; code bytes = 30d0 Found XOR loop in file "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" at offset 494293; code bytes = 30d0 Found XOR loop in file "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" at offset 551776; code bytes = 30d0 Found XOR loop in file "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" at offset 642265; code bytes = 30d0 Found XOR loop in file "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" at offset 41197; code bytes = 33c1 Found XOR loop in file "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" at offset 41349; code bytes = 33c1 Found XOR loop in file "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" at offset 375115; code bytes = 33c1 Found XOR loop in file "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" at offset 434660; code bytes = 33c1 Found XOR loop in file "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" at offset 548539; code bytes = 33c1 Found XOR loop in file "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" at offset 558556; code bytes = 33c1 Found XOR loop in file "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" at offset 633673; code bytes = 33c1 Found XOR loop in file "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" at offset 656461; code bytes = 33c1 Found XOR loop in file "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" at offset 667793; code bytes = 33c1 Found XOR loop in file "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" at offset 157247; code bytes = 8030 Found XOR loop in file "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" at offset 214305; code bytes = 8030 Found XOR loop in file "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" at offset 243214; code bytes = 8030 Found XOR loop in file "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" at offset 482005; code bytes = 8030 Found XOR loop in file "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" at offset 522566; code bytes = 8030 Found XOR loop in file "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" at offset 628013; code bytes = 8030 Found XOR loop in file "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" at offset 688035; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 103304; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 148938; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 387892; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 393291; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 396062; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 486267; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 494293; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 551776; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 642265; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 41197; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 41349; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 375115; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 434660; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 548539; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 558556; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 633673; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 656461; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 667793; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 157247; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 214305; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 243214; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 482005; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 522566; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 628013; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 688035; code bytes = 803032:T2dae,"fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000180000000000000070bb120058af066a94c3120092e0056a2d93cfc9feffffff28c212004c9c056a680c000044c212005f9c056a00000000000000000000000000000000000000000000000060c312000100000054c212000100000074c21200935cb0774083b777d4a0af771fadb77760c3120001000000 (UID: 00000000-00005948) "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" called "RtlGetVersion" with parameter 140100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00005948) "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" called "RtlGetVersion" with parameter 000000000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00005948) "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b00200031000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000a4bd1200000000008e000000f4bd1200feffffff7cbd1200cf00b077d600b077c2c9b7778e00000047000000f4bd12000000000050bd120000000000b8bd120095e1ab77a6720a00feffffffd600b0772f7bac75010000003100a009167bac753306dba3 (UID: 00000000-00003936) "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00003936) "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b00200031000000af775059af7734020000400200008a055a0088055a001000000080000000ff2baf776a91db7620a34c6dac0121000000210001000000209025000b00c5000600000000d1f273ac0121000000210088055a000c00c0000600000006000000bceeaf77c86f210000005a00200000000d00bb000000000070eb2600b86c2100d86d2100089728008071210000005a0050e57e0170eb2600d0e67e0195e1ab77ae680a00feffffffff2baf779a2aaf7720a34c6d10a34c6d00000000380046000300000000000000bce67e01f06d36004ce67e0180f46d76000036000000000089f46d76 (UID: 00000000-00003936) "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b00200031000000000000002100a8242b006dd1fe754203dba36caec3760000000000000000c402000068410029c40021000100000000002100500121000c000000a8242b0000000000020000001800000010000000c0b8120000000000000000000300000084b812003c6eaf77000000000000000000000000a8232500c0750676a823250000000000c0750676a0b8120079dafe750000000002000000f8b81200dbd2fe7500000000e2d2fe752a03dba368410000ff2baf77fecdb77700000000040221000000210004b81200a0b812002d0022010e000000b6660a00feffffffe063af771664af77 (UID: 00000000-00003936) "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b00200031000000380037003600340036003000620033006600330063006400610037006600650034003400350032003700360063003000660034006400660065003300330036002e00650078006500000000000000000000000000000000000000000000000000000000000000ff2baf7776d3b777d8eba877ac0121000000210000000000000000003400f700e5010000000000000000000000000000000000003500f200e50100000000000000000000c86f21000000000020000000000000000000000058166102b86c2100d86d210080472f00807121000000000044a7120000000000c4a81200 (UID: 00000000-00003936) "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" called "RtlGetVersion" with parameter 140100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00003936) "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" called "RtlGetVersion" with parameter 140100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b00200031000000210014000000aa000000000000000000000090ed2600b86c2100206e210010542b00d078210063006100bc9b120073002e00c4a8120010542b00e9e9af7710542b0000000000aa000000e89c120020a1120000000000000000000000000000000000000000000000000000000000000000001c5cae7760d8ac75ffffffff17000000989c1200240000000300000088a11200b4a6120020a1120086000000c49c120096edaf7732542b00a06a857586000000e89c120020a112000000000086008800a06a8575e89c1200916c857532542b00a06a8575a06a857558a1120002020000 (UID: 00000000-00003936) "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" called "RtlGetVersion" with parameter 000000000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00003936) "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b00200031000000af77010000000000f87300000000000000001ccd120054cf1200c702b1770100000048cd120000000000586f29000203b17700020000000000000000000098cf1200a401b17750cd1200626faf7764f8af7756b9b7777411f87348ce1200000000000000aa773ff000007411f8730000000000000000ff2baf77babab777020000000c023600000036006c44656c657465432600780106000000000000006cce120098703600fccd120080f46d76000036000000000089f46d760ab2d5a30200000070ce12006cce12000000000088673600480052019801520198703600c0cd1200 (UID: 00000000-00003936) "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b00200031000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000007b00370035003800340037003100370037002d0046003000370037002d0034003100370031002d0042004400320043002d004100360042004200320031003600c49c0ea168e0c9026d821e76e4d6280004010000 (UID: 00000000-00003936) "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000180000000000000070bb120058af066a94c3120092e0056a6a0ad5fafeffffff28c212004c9c056a680c000044c212005f9c056a00000000000000000000000000000000000000000000000060c312000100000054c212000100000074c21200935cb0774083b777d4a0af775e0eb67760c3120001000000 (UID: 00000000-00002436) "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" called "RtlGetVersion" with parameter 140100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00002436) "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" called "RtlGetVersion" with parameter 000000000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00002436) "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00002784)33:T200e,"fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b2031000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00005948) "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" called "GetVersionExA" with parameter 9c0000000600000001000000b11d00000200000053657276696365205061636b2031000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00003936) "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b2031000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00003936) "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" called "GetVersionExA" with parameter 9c0000000600000001000000b11d00000200000053657276696365205061636b2031000000000000000000000200000000000000d8eba87780472f000050fd7f9a5cb07700f0fd7f88a812004450fd7f00000000400000003f000000200000000050fd7f7ca81200c15cb0776082b777200000000050fd7f9a5cb07700f0fd7fa0a812005789af778083b7771317ad75d8eba877 (UID: 00000000-00003936) "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b2031000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00002436) "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b2031000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00002784) "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" called "GetVersionExA" with parameter 9c0000000600000001000000b11d00000200000053657276696365205061636b2031000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00002784) "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" called "GetVersionExA" with parameter 9c0000000600000001000000b11d00000200000053657276696365205061636b2031000000000000000000000200000000000000d8eba877f0625f0200d0fd7f9a5cb07700f0fd7f88a8120044d0fd7f00000000400000003f0000002000000000d0fd7f7ca81200c15cb0776082b7772000000000d0fd7f9a5cb07700f0fd7fa0a812005789af778083b7771317ad75d8eba877 (UID: 00000000-00002784) "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b2031000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00003996) "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" called "GetVersionExA" with parameter 9c0000000600000001000000b11d00000200000053657276696365205061636b2031000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00001316) "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b2031000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00001316) "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" called "GetVersionExA" with parameter 9c0000000600000001000000b11d00000200000053657276696365205061636b2031000000000000000000000200000000000000d8eba8772047260000e0fd7f9a5cb07700f0fd7f88a8120044e0fd7f00000000400000003f0000002000000000e0fd7f7ca81200c15cb0776082b7772000000000e0fd7f9a5cb07700f0fd7fa0a812005789af778083b7771317ad75d8eba877 (UID: 00000000-00001316) "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" called "GetVersionExA" with parameter 9c0000000600000001000000b11d00000200000053657276696365205061636b2031000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00001936) "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b2031000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00001936) "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" called "GetVersionExA" with parameter 9c0000000600000001000000b11d00000200000053657276696365205061636b2031000000000000000000000200000000000000d8eba87718db280000c0fd7f9a5cb07700f0fd7f88a8120044c0fd7f00000000400000003f0000002000000000c0fd7f7ca81200c15cb0776082b7772000000000c0fd7f9a5cb07700f0fd7fa0a812005789af778083b7771317ad75d8eba877 (UID: 00000000-00001936) "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b2031000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00004436) "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" called "GetVersionExA" with parameter 9c0000000600000001000000b11d00000200000053657276696365205061636b2031000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00002408) "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b2031000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00002408) "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" called "GetVersionExA" with parameter 9c0000000600000001000000b11d00000200000053657276696365205061636b2031000000000000000000000200000000000000d8eba877b07237000090fd7f9a5cb07700f0fd7f88a812004490fd7f00000000400000003f000000200000000090fd7f7ca81200c15cb0776082b777200000000090fd7f9a5cb07700f0fd7fa0a812005789af778083b7771317ad75d8eba877 (UID: 00000000-00002408)34:T70c,GetUserDefaultLCID@KERNEL32.DLL at 00000000-00003936-40981-6490-004388B2 EnumSystemLocalesW@KERNEL32.DLL at 00000000-00003936-40981-6495-004387C8 GetLocaleInfoW@KERNEL32.DLL at 00000000-00003936-40981-6496-0043884E GetUserDefaultLCID@KERNEL32.DLL at 00000000-00003936-40981-6504-00438423 EnumSystemLocalesW@KERNEL32.DLL at 00000000-00003936-40981-6505-00437E27 EnumSystemLocalesW@KERNEL32.DLL at 00000000-00003936-40981-6506-00437F00 EnumSystemLocalesW@KERNEL32.DLL at 00000000-00003936-40981-6508-00437E83 GetLocaleInfoW@KERNEL32.DLL at 00000000-00003936-40981-6510-004382A2 GetLocaleInfoW@KERNEL32.DLL at 00000000-00003936-40981-6695-00437D77 GetUserDefaultLCID@KERNEL32.DLL at 00000000-00003936-40981-6698-00437E67 GetLocaleInfoW@KERNEL32.DLL at 00000000-00003936-40981-6699-00437F83 GetLocaleInfoW@KERNEL32.DLL at 00000000-00003936-40981-6700-0043834F GetLocaleInfoW@KERNEL32.DLL at 00000000-00003936-40981-6701-00438178 GetUserDefaultLCID@KERNEL32.DLL at 00000000-00002784-48098-6487-004388B2 EnumSystemLocalesW@KERNEL32.DLL at 00000000-00002784-48098-6492-004387C8 GetLocaleInfoW@KERNEL32.DLL at 00000000-00002784-48098-6493-0043884E GetUserDefaultLCID@KERNEL32.DLL at 00000000-00002784-48098-6501-00438423 EnumSystemLocalesW@KERNEL32.DLL at 00000000-00002784-48098-6502-00437E27 EnumSystemLocalesW@KERNEL32.DLL at 00000000-00002784-48098-6503-00437F00 EnumSystemLocalesW@KERNEL32.DLL at 00000000-00002784-48098-6505-00437E83 GetLocaleInfoW@KERNEL32.DLL at 00000000-00002784-48098-6507-004382A2 GetLocaleInfoW@KERNEL32.DLL at 00000000-00002784-48098-6692-00437D77 GetUserDefaultLCID@KERNEL32.DLL at 00000000-00002784-48098-6695-00437E67 GetLocaleInfoW@KERNEL32.DLL at 00000000-00002784-48098-6696-00437F83 GetLocaleInfoW@KERNEL32.DLL at 00000000-00002784-48098-6697-0043834F35:T688,GetProcessHeap@KERNEL32.DLL at 00000000-00003936-40981-1-00424141 OpenProcess@KERNEL32.DLL at 00000000-00003936-40981-54-00419F90 OpenProcess@KERNEL32.DLL at 00000000-00003936-40981-111-00412220 GetProcessHeap@KERNEL32.DLL at 00000000-00003936-40981-505-00447CAC OpenProcess@KERNEL32.DLL at 00000000-00003936-40981-639-00412440 GetProcessHeap@KERNEL32.DLL at 00000000-00003936-40981-677-004278D5 GetProcessHeap@KERNEL32.DLL at 00000000-00002784-48098-1-00424141 OpenProcess@KERNEL32.DLL at 00000000-00002784-48098-54-00419F90 OpenProcess@KERNEL32.DLL at 00000000-00002784-48098-111-00412220 GetProcessHeap@KERNEL32.DLL at 00000000-00002784-48098-505-00447CAC OpenProcess@KERNEL32.DLL at 00000000-00002784-48098-639-00412440 GetProcessHeap@KERNEL32.DLL at 00000000-00002784-48098-677-004278D5 GetProcessHeap@KERNEL32.DLL at 00000000-00001316-58894-1-00424141 OpenProcess@KERNEL32.DLL at 00000000-00001316-58894-54-00419F90 OpenProcess@KERNEL32.DLL at 00000000-00001316-58894-111-00412220 GetProcessHeap@KERNEL32.DLL at 00000000-00001316-58894-505-00447CAC OpenProcess@KERNEL32.DLL at 00000000-00001316-58894-639-00412440 GetProcessHeap@KERNEL32.DLL at 00000000-00001316-58894-677-004278D5 GetProcessHeap@KERNEL32.DLL at 00000000-00001936-65104-1-00424141 OpenProcess@KERNEL32.DLL at 00000000-00001936-65104-54-00419F90 OpenProcess@KERNEL32.DLL at 00000000-00001936-65104-111-00412220 GetProcessHeap@KERNEL32.DLL at 00000000-00001936-65104-505-00447CAC OpenProcess@KERNEL32.DLL at 00000000-00001936-65104-639-00412440 GetProcessHeap@KERNEL32.DLL at 00000000-00001936-65104-677-004278D5 GetProcessHeap@KERNEL32.DLL at 00000000-00002408-5683-1-0042414136:T6bb,PathFileExistsW@SHLWAPI.DLL at 00000000-00003936-40981-65-00411CD0 PathFileExistsA@SHLWAPI.DLL at 00000000-00003936-40981-156-00410A50 PathFileExistsA@SHLWAPI.DLL at 00000000-00003936-40981-638-004124E0 PathFileExistsW@SHLWAPI.DLL at 00000000-00003936-40981-5602-00410160 PathFileExistsW@SHLWAPI.DLL at 00000000-00003936-40981-5611-0040F730 PathFileExistsW@SHLWAPI.DLL at 00000000-00002784-48098-65-00411CD0 PathFileExistsA@SHLWAPI.DLL at 00000000-00002784-48098-156-00410A50 PathFileExistsA@SHLWAPI.DLL at 00000000-00002784-48098-638-004124E0 PathFileExistsW@SHLWAPI.DLL at 00000000-00002784-48098-5599-00410160 PathFileExistsW@SHLWAPI.DLL at 00000000-00002784-48098-5608-0040F730 PathFileExistsW@SHLWAPI.DLL at 00000000-00001316-58894-65-00411CD0 PathFileExistsA@SHLWAPI.DLL at 00000000-00001316-58894-156-00410A50 PathFileExistsA@SHLWAPI.DLL at 00000000-00001316-58894-638-004124E0 PathFileExistsW@SHLWAPI.DLL at 00000000-00001316-58894-5598-00410160 PathFileExistsW@SHLWAPI.DLL at 00000000-00001316-58894-5607-0040F730 PathFileExistsW@SHLWAPI.DLL at 00000000-00001936-65104-65-00411CD0 PathFileExistsA@SHLWAPI.DLL at 00000000-00001936-65104-156-00410A50 PathFileExistsA@SHLWAPI.DLL at 00000000-00001936-65104-638-004124E0 PathFileExistsW@SHLWAPI.DLL at 00000000-00001936-65104-5598-00410160 PathFileExistsW@SHLWAPI.DLL at 00000000-00001936-65104-5607-0040F730 PathFileExistsW@SHLWAPI.DLL at 00000000-00002408-5683-65-00411CD0 PathFileExistsA@SHLWAPI.DLL at 00000000-00002408-5683-156-00410A50 PathFileExistsA@SHLWAPI.DLL at 00000000-00002408-5683-638-004124E0 PathFileExistsW@SHLWAPI.DLL at 00000000-00002408-5683-5598-00410160 PathFileExistsW@SHLWAPI.DLL at 00000000-00002408-5683-5607-0040F73037:T630,Found API call GetVersion@KERNEL32.DLL directly followed by "cmp al, 05h" and "jbe 0041A6F9h" at 00000000-00003936-40981-54-00419F90 Found API call GetTimeZoneInformation@KERNEL32.DLL directly followed by "cmp eax, FFFFFFFFh" and "je 0043004Bh" at 00000000-00003936-40981-587-0042FE47 Found API call GetTimeZoneInformation@KERNEL32.DLL directly followed by "cmp eax, FFFFFFFFh" and "je 0043004Bh" at 00000000-00003936-44666-587-0042FE47 Found API call GetVersion@KERNEL32.DLL directly followed by "cmp al, 05h" and "jbe 0041A6F9h" at 00000000-00002784-48098-54-00419F90 Found API call GetTimeZoneInformation@KERNEL32.DLL directly followed by "cmp eax, FFFFFFFFh" and "je 0043004Bh" at 00000000-00002784-48098-587-0042FE47 Found API call GetVersion@KERNEL32.DLL directly followed by "cmp al, 05h" and "jbe 0041A6F9h" at 00000000-00001316-58894-54-00419F90 Found API call GetTimeZoneInformation@KERNEL32.DLL directly followed by "cmp eax, FFFFFFFFh" and "je 0043004Bh" at 00000000-00001316-58894-587-0042FE47 Found API call GetVersion@KERNEL32.DLL directly followed by "cmp al, 05h" and "jbe 0041A6F9h" at 00000000-00001936-65104-54-00419F90 Found API call GetTimeZoneInformation@KERNEL32.DLL directly followed by "cmp eax, FFFFFFFFh" and "je 0043004Bh" at 00000000-00001936-65104-587-0042FE47 Found API call GetVersion@KERNEL32.DLL directly followed by "cmp al, 05h" and "jbe 0041A6F9h" at 00000000-00002408-5683-54-00419F90 Found API call GetTimeZoneInformation@KERNEL32.DLL directly followed by "cmp eax, FFFFFFFFh" and "je 0043004Bh" at 00000000-00002408-5683-587-0042FE4738:T970,"fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{07B41F79-1AEC-4782-A6E8-8C28FFBA35ED}"; Key: "ENABLEDHCP"; Value: "") "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{07B41F79-1AEC-4782-A6E8-8C28FFBA35ED}"; Key: "REGISTRATIONENABLED"; Value: "") "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{07B41F79-1AEC-4782-A6E8-8C28FFBA35ED}"; Key: "REGISTERADAPTERNAME"; Value: "") "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{07B41F79-1AEC-4782-A6E8-8C28FFBA35ED}"; Key: "DOMAIN"; Value: "") "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{07B41F79-1AEC-4782-A6E8-8C28FFBA35ED}"; Key: "DHCPDOMAIN"; Value: "") "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E29AC6C2-7037-11DE-816D-806E6F6E6963}"; Key: "ENABLEDHCP"; Value: "") "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E29AC6C2-7037-11DE-816D-806E6F6E6963}"; Key: "REGISTRATIONENABLED"; Value: "") "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E29AC6C2-7037-11DE-816D-806E6F6E6963}"; Key: "REGISTERADAPTERNAME"; Value: "") "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E29AC6C2-7037-11DE-816D-806E6F6E6963}"; Key: "DOMAIN"; Value: "") "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E29AC6C2-7037-11DE-816D-806E6F6E6963}"; Key: "DHCPDOMAIN"; Value: "")39:T865,"fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\AUTOUPDATE"; Key: "DISALLOWEDCERTSYNCDELTATIME") "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\MY"; Key: "") "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\2E4916B07F3DE90C8DDE2566FD9B9B400D89BBBA"; Key: "BLOB") "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\5AEAEE3F7F2A9449CEBAFEEC68FDD184F20124A7"; Key: "BLOB") "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\E6A3B45B062D509B3382282D196EFE97D5956CCB"; Key: "BLOB") "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\F5AD0BCC1AD56CD150725B1C866C30AD92EF21B0"; Key: "BLOB") "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS"; Key: "") "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS"; Key: "") "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\109F1CAED645BB78B3EA2B94C0697C740733031C"; Key: "BLOB")3a:Tc3a,"fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" called "CreateDirectoryW" with parameter C:\Users\%OSUSER% (UID: 00000000-00003936) "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" called "CreateDirectoryW" with parameter %USERPROFILE%\AppData\Local (UID: 00000000-00003936) "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" called "CreateDirectoryW" with parameter %LOCALAPPDATA%\Microsoft\Windows\Temporary Internet Files (UID: 00000000-00003936) "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" called "CreateDirectoryW" with parameter %USERPROFILE%\AppData\Roaming (UID: 00000000-00003936) "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" called "CreateDirectoryW" with parameter %APPDATA%\Microsoft\Windows\Cookies (UID: 00000000-00003936) "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" called "CreateDirectoryW" with parameter %LOCALAPPDATA%\Microsoft\Windows\History (UID: 00000000-00003936) "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" called "CreateDirectoryW" with parameter %LOCALAPPDATA%\181e15e2-efce-4e8a-ade3-f867c1bd02fc (UID: 00000000-00003936) "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" called "CreateDirectoryW" with parameter %LOCALAPPDATA%\Microsoft\Windows\Caches (UID: 00000000-00003936) "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" called "CreateDirectoryW" with parameter C:\Users\%OSUSER% (UID: 00000000-00002784) "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" called "CreateDirectoryW" with parameter %USERPROFILE%\AppData\Local (UID: 00000000-00002784) "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" called "CreateDirectoryW" with parameter %LOCALAPPDATA%\Microsoft\Windows\Temporary Internet Files (UID: 00000000-00002784) "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" called "CreateDirectoryW" with parameter %USERPROFILE%\AppData\Roaming (UID: 00000000-00002784) "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" called "CreateDirectoryW" with parameter %APPDATA%\Microsoft\Windows\Cookies (UID: 00000000-00002784) "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" called "CreateDirectoryW" with parameter %LOCALAPPDATA%\Microsoft\Windows\History (UID: 00000000-00002784) "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" called "CreateDirectoryW" with parameter C:\Users\%OSUSER% (UID: 00000000-00001316) "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" called "CreateDirectoryW" with parameter %USERPROFILE%\AppData\Local (UID: 00000000-00001316) "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" called "CreateDirectoryW" with parameter %LOCALAPPDATA%\Microsoft\Windows\Temporary Internet Files (UID: 00000000-00001316) "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" called "CreateDirectoryW" with parameter %USERPROFILE%\AppData\Roaming (UID: 00000000-00001316)3b:T6ce,"fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" called "CreateProcessA" with parameter ""C:\fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe"" - (UID: 00000000-00005948) "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" called "CreateProcessW" with parameter "icacls "%LOCALAPPDATA%\181e15e2-efce-4e8a-ade3-f867c1bd02fc" /deny *S-1-1-0:(OI)(CI)(DE,DC)" - (UID: 00000000-00003936) "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" called "CreateProcessW" with parameter ""C:\fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" --Admin IsNotAutoStart IsNotTask" - (UID: 00000000-00003936) "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" called "CreateProcessA" with parameter ""C:\fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" --Admin IsNotAutoStart IsNotTask" - (UID: 00000000-00002436) "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" called "CreateProcessA" with parameter "%LOCALAPPDATA%\181e15e2-efce-4e8a-ade3-f867c1bd02fc\fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe --Task" - (UID: 00000000-00003996) "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" called "CreateProcessA" with parameter "%LOCALAPPDATA%\181e15e2-efce-4e8a-ade3-f867c1bd02fc\fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe --Task" - (UID: 00000000-00003232) "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" called "CreateProcessA" with parameter "%LOCALAPPDATA%\181e15e2-efce-4e8a-ade3-f867c1bd02fc\fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe --Task" - (UID: 00000000-00004436)3c:T8858,"fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00005948) "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" called "LoadLibrary" with a parameter user32 (UID: 00000000-00005948) "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00005948) "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00005948) "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\uxtheme.dll (UID: 00000000-00005948) "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" called "LoadLibrary" with a parameter dwmapi.dll (UID: 00000000-00005948) "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" called "LoadLibrary" with a parameter SHELL32.dll (UID: 00000000-00003936) "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00003936) "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" called "LoadLibrary" with a parameter api-ms-win-downlevel-advapi32-l2-1-0.dll (UID: 00000000-00003936) "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" called "LoadLibrary" with a parameter api-ms-win-downlevel-ole32-l1-1-0.dll (UID: 00000000-00003936) "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" called "LoadLibrary" with a parameter WS2_32.dll (UID: 00000000-00003936) "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" called "LoadLibrary" with a parameter winhttp.dll (UID: 00000000-00003936) "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" called "LoadLibrary" with a parameter IPHLPAPI.DLL (UID: 00000000-00003936) "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" called "LoadLibrary" with a parameter api-ms-win-downlevel-shlwapi-l2-1-0.dll (UID: 00000000-00003936) "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" called "LoadLibrary" with a parameter DNSAPI.dll (UID: 00000000-00003936) "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00003936) "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" called "LoadLibrary" with a parameter dhcpcsvc.DLL (UID: 00000000-00003936) "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" called "LoadLibrary" with a parameter API-MS-Win-Security-LSALookup-L1-1-0.dll (UID: 00000000-00003936) "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" called "LoadLibrary" with a parameter CRYPTBASE.dll (UID: 00000000-00003936) "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00003936) "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" called "LoadLibrary" with a parameter CRYPT32.dll (UID: 00000000-00003936) "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" called "LoadLibrary" with a parameter USERENV.dll (UID: 00000000-00003936) "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" called "LoadLibrary" with a parameter urlmon.dll (UID: 00000000-00003936) "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" called "LoadLibrary" with a parameter Secur32.dll (UID: 00000000-00003936) "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" called "LoadLibrary" with a parameter Comctl32.dll (UID: 00000000-00003936) "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\ws2_32 (UID: 00000000-00003936) "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" called "LoadLibrary" with a parameter secur32.dll (UID: 00000000-00003936) "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" called "LoadLibrary" with a parameter ncrypt.dll (UID: 00000000-00003936) "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\bcryptprimitives.dll (UID: 00000000-00003936) "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" called "LoadLibrary" with a parameter WINTRUST.dll (UID: 00000000-00003936) "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" called "LoadLibrary" with a parameter CRYPTSP.dll (UID: 00000000-00003936) "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" called "LoadLibrary" with a parameter API-MS-Win-Security-SDDL-L1-1-0.dll (UID: 00000000-00003936) "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00003936) "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\cryptnet.dll (UID: 00000000-00003936) "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" called "LoadLibrary" with a parameter cryptnet.dll (UID: 00000000-00003936) "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00003936) "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" called "LoadLibrary" with a parameter profapi.dll (UID: 00000000-00003936) "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" called "LoadLibrary" with a parameter SensApi.dll (UID: 00000000-00003936) "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" called "LoadLibrary" with a parameter WINHTTP.dll (UID: 00000000-00003936) "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\CRYPT32.dll (UID: 00000000-00003936) "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00003936) "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" called "LoadLibrary" with a parameter SspiCli.dll (UID: 00000000-00003936) "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" called "LoadLibrary" with a parameter RPCRT4.dll (UID: 00000000-00003936) "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" called "LoadLibrary" with a parameter API-MS-WIN-Service-Management-L1-1-0.dll (UID: 00000000-00003936) "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" called "LoadLibrary" with a parameter API-MS-WIN-Service-winsvc-L1-1-0.dll (UID: 00000000-00003936) "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00003936) "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" called "LoadLibrary" with a parameter NSI.dll (UID: 00000000-00003936) "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" called "LoadLibrary" with a parameter CFGMGR32.dll (UID: 00000000-00003936) "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" called "LoadLibrary" with a parameter Psapi.dll (UID: 00000000-00003936) "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" called "LoadLibrary" with a parameter Shell32.dll (UID: 00000000-00003936) "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\uxtheme.dll (UID: 00000000-00003936) "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" called "LoadLibrary" with a parameter propsys.dll (UID: 00000000-00003936) "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" called "LoadLibrary" with a parameter comctl32.dll (UID: 00000000-00003936) "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" called "LoadLibrary" with a parameter ntmarta.dll (UID: 00000000-00003936) "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" called "LoadLibrary" with a parameter API-MS-WIN-DOWNLEVEL-SHLWAPI-L1-1-0.DLL (UID: 00000000-00003936) "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" called "LoadLibrary" with a parameter API-MS-Win-Core-LocalRegistry-L1-1-0.dll (UID: 00000000-00003936) "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00002436) "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" called "LoadLibrary" with a parameter user32 (UID: 00000000-00002436) "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00002436) "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00002436) "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\uxtheme.dll (UID: 00000000-00002436) "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" called "LoadLibrary" with a parameter dwmapi.dll (UID: 00000000-00002436) "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" called "LoadLibrary" with a parameter WS2_32.dll (UID: 00000000-00002784) "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" called "LoadLibrary" with a parameter winhttp.dll (UID: 00000000-00002784) "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" called "LoadLibrary" with a parameter IPHLPAPI.DLL (UID: 00000000-00002784) "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" called "LoadLibrary" with a parameter api-ms-win-downlevel-shlwapi-l2-1-0.dll (UID: 00000000-00002784) "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" called "LoadLibrary" with a parameter DNSAPI.dll (UID: 00000000-00002784) "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00002784) "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" called "LoadLibrary" with a parameter CRYPT32.dll (UID: 00000000-00002784) "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" called "LoadLibrary" with a parameter dhcpcsvc.DLL (UID: 00000000-00002784) "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" called "LoadLibrary" with a parameter API-MS-Win-Security-LSALookup-L1-1-0.dll (UID: 00000000-00002784) "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00002784) "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" called "LoadLibrary" with a parameter CRYPTBASE.dll (UID: 00000000-00002784) "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" called "LoadLibrary" with a parameter USERENV.dll (UID: 00000000-00002784) "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" called "LoadLibrary" with a parameter urlmon.dll (UID: 00000000-00002784) "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00002784) "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" called "LoadLibrary" with a parameter Secur32.dll (UID: 00000000-00002784) "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" called "LoadLibrary" with a parameter Comctl32.dll (UID: 00000000-00002784) "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\ws2_32 (UID: 00000000-00002784) "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" called "LoadLibrary" with a parameter secur32.dll (UID: 00000000-00002784) "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" called "LoadLibrary" with a parameter ncrypt.dll (UID: 00000000-00002784) "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\bcryptprimitives.dll (UID: 00000000-00002784) "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" called "LoadLibrary" with a parameter WINTRUST.dll (UID: 00000000-00002784) "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" called "LoadLibrary" with a parameter CRYPTSP.dll (UID: 00000000-00002784) "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" called "LoadLibrary" with a parameter API-MS-Win-Security-SDDL-L1-1-0.dll (UID: 00000000-00002784) "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00002784) "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\cryptnet.dll (UID: 00000000-00002784) "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" called "LoadLibrary" with a parameter cryptnet.dll (UID: 00000000-00002784) "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00002784) "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" called "LoadLibrary" with a parameter profapi.dll (UID: 00000000-00002784) "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\CRYPT32.dll (UID: 00000000-00002784) "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" called "LoadLibrary" with a parameter SensApi.dll (UID: 00000000-00002784) "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" called "LoadLibrary" with a parameter API-MS-WIN-Service-Management-L1-1-0.dll (UID: 00000000-00002784) "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" called "LoadLibrary" with a parameter API-MS-WIN-Service-winsvc-L1-1-0.dll (UID: 00000000-00002784) "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" called "LoadLibrary" with a parameter RPCRT4.dll (UID: 00000000-00002784) "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00002784) "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" called "LoadLibrary" with a parameter Psapi.dll (UID: 00000000-00002784) "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00003996) "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" called "LoadLibrary" with a parameter user32 (UID: 00000000-00003996) "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00003996) "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00003996) "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\uxtheme.dll (UID: 00000000-00003996) "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" called "LoadLibrary" with a parameter dwmapi.dll (UID: 00000000-00003996) "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" called "LoadLibrary" with a parameter SHELL32.dll (UID: 00000000-00001316) "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00001316) "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" called "LoadLibrary" with a parameter api-ms-win-downlevel-advapi32-l2-1-0.dll (UID: 00000000-00001316) "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" called "LoadLibrary" with a parameter api-ms-win-downlevel-ole32-l1-1-0.dll (UID: 00000000-00001316) "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" called "LoadLibrary" with a parameter WS2_32.dll (UID: 00000000-00001316) "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" called "LoadLibrary" with a parameter winhttp.dll (UID: 00000000-00001316) "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" called "LoadLibrary" with a parameter IPHLPAPI.DLL (UID: 00000000-00001316) "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" called "LoadLibrary" with a parameter api-ms-win-downlevel-shlwapi-l2-1-0.dll (UID: 00000000-00001316) "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" called "LoadLibrary" with a parameter DNSAPI.dll (UID: 00000000-00001316) "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00001316) "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" called "LoadLibrary" with a parameter CRYPT32.dll (UID: 00000000-00001316) "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" called "LoadLibrary" with a parameter dhcpcsvc.DLL (UID: 00000000-00001316) "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" called "LoadLibrary" with a parameter API-MS-Win-Security-LSALookup-L1-1-0.dll (UID: 00000000-00001316) "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" called "LoadLibrary" with a parameter USERENV.dll (UID: 00000000-00001316) "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" called "LoadLibrary" with a parameter urlmon.dll (UID: 00000000-00001316) "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" called "LoadLibrary" with a parameter Secur32.dll (UID: 00000000-00001316) "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00001316) "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" called "LoadLibrary" with a parameter CRYPTBASE.dll (UID: 00000000-00001316) "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" called "LoadLibrary" with a parameter Comctl32.dll (UID: 00000000-00001316) "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\ws2_32 (UID: 00000000-00001316) "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" called "LoadLibrary" with a parameter secur32.dll (UID: 00000000-00001316) "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" called "LoadLibrary" with a parameter ncrypt.dll (UID: 00000000-00001316) "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\bcryptprimitives.dll (UID: 00000000-00001316) "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" called "LoadLibrary" with a parameter WINTRUST.dll (UID: 00000000-00001316) "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" called "LoadLibrary" with a parameter CRYPTSP.dll (UID: 00000000-00001316) "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" called "LoadLibrary" with a parameter API-MS-Win-Security-SDDL-L1-1-0.dll (UID: 00000000-00001316) "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00001316) "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\cryptnet.dll (UID: 00000000-00001316) "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" called "LoadLibrary" with a parameter cryptnet.dll (UID: 00000000-00001316) "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00001316) "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" called "LoadLibrary" with a parameter profapi.dll (UID: 00000000-00001316) "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\CRYPT32.dll (UID: 00000000-00001316) "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" called "LoadLibrary" with a parameter SensApi.dll (UID: 00000000-00001316) "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" called "LoadLibrary" with a parameter API-MS-WIN-Service-Management-L1-1-0.dll (UID: 00000000-00001316) "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" called "LoadLibrary" with a parameter API-MS-WIN-Service-winsvc-L1-1-0.dll (UID: 00000000-00001316) "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" called "LoadLibrary" with a parameter RPCRT4.dll (UID: 00000000-00001316) "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00001316) "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" called "LoadLibrary" with a parameter Psapi.dll (UID: 00000000-00001316) "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" called "LoadLibrary" with a parameter user32 (UID: 00000000-00003232) "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00003232) "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00003232) "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\uxtheme.dll (UID: 00000000-00003232) "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" called "LoadLibrary" with a parameter dwmapi.dll (UID: 00000000-00003232) "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" called "LoadLibrary" with a parameter Secur32.dll (UID: 00000000-00001936) "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" called "LoadLibrary" with a parameter SHELL32.dll (UID: 00000000-00001936) "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00001936) "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" called "LoadLibrary" with a parameter api-ms-win-downlevel-advapi32-l2-1-0.dll (UID: 00000000-00001936) "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" called "LoadLibrary" with a parameter api-ms-win-downlevel-ole32-l1-1-0.dll (UID: 00000000-00001936) "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" called "LoadLibrary" with a parameter WS2_32.dll (UID: 00000000-00001936) "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" called "LoadLibrary" with a parameter winhttp.dll (UID: 00000000-00001936) "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" called "LoadLibrary" with a parameter IPHLPAPI.DLL (UID: 00000000-00001936) "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" called "LoadLibrary" with a parameter api-ms-win-downlevel-shlwapi-l2-1-0.dll (UID: 00000000-00001936) "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" called "LoadLibrary" with a parameter DNSAPI.dll (UID: 00000000-00001936) "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00001936) "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" called "LoadLibrary" with a parameter CRYPT32.dll (UID: 00000000-00001936) "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" called "LoadLibrary" with a parameter dhcpcsvc.DLL (UID: 00000000-00001936) "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" called "LoadLibrary" with a parameter USERENV.dll (UID: 00000000-00001936) "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" called "LoadLibrary" with a parameter API-MS-Win-Security-LSALookup-L1-1-0.dll (UID: 00000000-00001936) "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" called "LoadLibrary" with a parameter CRYPTBASE.dll (UID: 00000000-00001936) "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" called "LoadLibrary" with a parameter urlmon.dll (UID: 00000000-00001936) "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00001936) "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" called "LoadLibrary" with a parameter Comctl32.dll (UID: 00000000-00001936) "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\ws2_32 (UID: 00000000-00001936) "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" called "LoadLibrary" with a parameter secur32.dll (UID: 00000000-00001936) "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" called "LoadLibrary" with a parameter ncrypt.dll (UID: 00000000-00001936) "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\bcryptprimitives.dll (UID: 00000000-00001936) "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" called "LoadLibrary" with a parameter WINTRUST.dll (UID: 00000000-00001936) "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" called "LoadLibrary" with a parameter CRYPTSP.dll (UID: 00000000-00001936) "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" called "LoadLibrary" with a parameter API-MS-Win-Security-SDDL-L1-1-0.dll (UID: 00000000-00001936) "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00001936) "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\cryptnet.dll (UID: 00000000-00001936) "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" called "LoadLibrary" with a parameter cryptnet.dll (UID: 00000000-00001936) "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00001936) "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" called "LoadLibrary" with a parameter profapi.dll (UID: 00000000-00001936) "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\CRYPT32.dll (UID: 00000000-00001936) "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" called "LoadLibrary" with a parameter SensApi.dll (UID: 00000000-00001936) "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" called "LoadLibrary" with a parameter API-MS-WIN-Service-Management-L1-1-0.dll (UID: 00000000-00001936) "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" called "LoadLibrary" with a parameter API-MS-WIN-Service-winsvc-L1-1-0.dll (UID: 00000000-00001936) "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" called "LoadLibrary" with a parameter RPCRT4.dll (UID: 00000000-00001936) "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00001936) "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" called "LoadLibrary" with a parameter Psapi.dll (UID: 00000000-00001936) "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00004436) "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" called "LoadLibrary" with a parameter user32 (UID: 00000000-00004436) "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00004436) "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00004436) "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\uxtheme.dll (UID: 00000000-00004436) "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" called "LoadLibrary" with a parameter dwmapi.dll (UID: 00000000-00004436) "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" called "LoadLibrary" with a parameter SHELL32.dll (UID: 00000000-00002408) "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00002408) "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" called "LoadLibrary" with a parameter api-ms-win-downlevel-advapi32-l2-1-0.dll (UID: 00000000-00002408) "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" called "LoadLibrary" with a parameter api-ms-win-downlevel-ole32-l1-1-0.dll (UID: 00000000-00002408) "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" called "LoadLibrary" with a parameter WS2_32.dll (UID: 00000000-00002408) "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" called "LoadLibrary" with a parameter winhttp.dll (UID: 00000000-00002408) "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" called "LoadLibrary" with a parameter IPHLPAPI.DLL (UID: 00000000-00002408) "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" called "LoadLibrary" with a parameter api-ms-win-downlevel-shlwapi-l2-1-0.dll (UID: 00000000-00002408) "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" called "LoadLibrary" with a parameter DNSAPI.dll (UID: 00000000-00002408) "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00002408) "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" called "LoadLibrary" with a parameter dhcpcsvc.DLL (UID: 00000000-00002408) "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" called "LoadLibrary" with a parameter CRYPT32.dll (UID: 00000000-00002408) "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" called "LoadLibrary" with a parameter API-MS-Win-Security-LSALookup-L1-1-0.dll (UID: 00000000-00002408) "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" called "LoadLibrary" with a parameter USERENV.dll (UID: 00000000-00002408) "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" called "LoadLibrary" with a parameter CRYPTBASE.dll (UID: 00000000-00002408) "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00002408) "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" called "LoadLibrary" with a parameter urlmon.dll (UID: 00000000-00002408) "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" called "LoadLibrary" with a parameter Secur32.dll (UID: 00000000-00002408) "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" called "LoadLibrary" with a parameter Comctl32.dll (UID: 00000000-00002408) "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\ws2_32 (UID: 00000000-00002408) "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" called "LoadLibrary" with a parameter secur32.dll (UID: 00000000-00002408) "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" called "LoadLibrary" with a parameter ncrypt.dll (UID: 00000000-00002408) "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\bcryptprimitives.dll (UID: 00000000-00002408) "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" called "LoadLibrary" with a parameter WINTRUST.dll (UID: 00000000-00002408) "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" called "LoadLibrary" with a parameter CRYPTSP.dll (UID: 00000000-00002408) "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" called "LoadLibrary" with a parameter API-MS-Win-Security-SDDL-L1-1-0.dll (UID: 00000000-00002408) "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00002408) "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\cryptnet.dll (UID: 00000000-00002408) "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" called "LoadLibrary" with a parameter cryptnet.dll (UID: 00000000-00002408) "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00002408) "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" called "LoadLibrary" with a parameter profapi.dll (UID: 00000000-00002408) "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\CRYPT32.dll (UID: 00000000-00002408) "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" called "LoadLibrary" with a parameter SensApi.dll (UID: 00000000-00002408) "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" called "LoadLibrary" with a parameter API-MS-WIN-Service-Management-L1-1-0.dll (UID: 00000000-00002408) "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" called "LoadLibrary" with a parameter API-MS-WIN-Service-winsvc-L1-1-0.dll (UID: 00000000-00002408) "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" called "LoadLibrary" with a parameter RPCRT4.dll (UID: 00000000-00002408) "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00002408) "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" called "LoadLibrary" with a parameter Psapi.dll (UID: 00000000-00002408)3d:T6c4,Sleep@KERNEL32.DLL at 00000000-00003936-40981-42-004329C9 WaitForSingleObject@KERNEL32.DLL at 00000000-00003936-40981-54-00419F90 Sleep@KERNEL32.DLL at 00000000-00003936-40981-112-00411A10 WaitForSingleObject@KERNEL32.DLL at 00000000-00003936-40981-5617-0041F100 WaitForSingleObject@KERNEL32.DLL at 00000000-00003936-40981-5621-0041E590 Sleep@KERNEL32.DLL at 00000000-00003936-40981-6078-00411B10 WaitForSingleObject@KERNEL32.DLL at 00000000-00003936-40981-6208-00410A10 WaitForSingleObject@KERNEL32.DLL at 00000000-00003936-40981-6267-0041FA40 WaitForSingleObject@KERNEL32.DLL at 00000000-00003936-40981-6270-0041FDF0 Sleep@KERNEL32.DLL at 00000000-00002784-48098-42-004329C9 WaitForSingleObject@KERNEL32.DLL at 00000000-00002784-48098-54-00419F90 Sleep@KERNEL32.DLL at 00000000-00002784-48098-112-00411A10 WaitForSingleObject@KERNEL32.DLL at 00000000-00002784-48098-5614-0041F100 WaitForSingleObject@KERNEL32.DLL at 00000000-00002784-48098-5618-0041E590 Sleep@KERNEL32.DLL at 00000000-00002784-48098-6075-00411B10 WaitForSingleObject@KERNEL32.DLL at 00000000-00002784-48098-6205-00410A10 WaitForSingleObject@KERNEL32.DLL at 00000000-00002784-48098-6264-0041FA40 WaitForSingleObject@KERNEL32.DLL at 00000000-00002784-48098-6267-0041FDF0 Sleep@KERNEL32.DLL at 00000000-00001316-58894-42-004329C9 WaitForSingleObject@KERNEL32.DLL at 00000000-00001316-58894-54-00419F90 Sleep@KERNEL32.DLL at 00000000-00001316-58894-112-00411A10 WaitForSingleObject@KERNEL32.DLL at 00000000-00001316-58894-5613-0041F100 WaitForSingleObject@KERNEL32.DLL at 00000000-00001316-58894-5617-0041E590 Sleep@KERNEL32.DLL at 00000000-00001316-58894-6074-00411B10 WaitForSingleObject@KERNEL32.DLL at 00000000-00001316-58894-6204-00410A103e:T699,LoadLibraryExW@KERNEL32.DLL at 00000000-00003936-40981-29-0042A57A LoadLibraryW@KERNEL32.DLL at 00000000-00003936-40981-65-00411CD0 LoadLibraryW@KERNEL32.DLL at 00000000-00003936-40981-111-00412220 LoadLibraryA@KERNEL32.DLL at 00000000-00003936-40981-2818-004C28F0 LoadLibraryA@KERNEL32.DLL at 00000000-00003936-40981-2819-004C2700 LoadLibraryW@KERNEL32.DLL at 00000000-00003936-40981-5605-0040F310 LoadLibraryW@KERNEL32.DLL at 00000000-00003936-40981-5632-0041DC3C LoadLibraryA@KERNEL32.DLL at 00000000-00003936-40981-8728-004C20F0 LoadLibraryExW@KERNEL32.DLL at 00000000-00002784-48098-29-0042A57A LoadLibraryW@KERNEL32.DLL at 00000000-00002784-48098-65-00411CD0 LoadLibraryW@KERNEL32.DLL at 00000000-00002784-48098-111-00412220 LoadLibraryA@KERNEL32.DLL at 00000000-00002784-48098-2815-004C28F0 LoadLibraryA@KERNEL32.DLL at 00000000-00002784-48098-2816-004C2700 LoadLibraryW@KERNEL32.DLL at 00000000-00002784-48098-5602-0040F310 LoadLibraryW@KERNEL32.DLL at 00000000-00002784-48098-5629-0041DC3C LoadLibraryA@KERNEL32.DLL at 00000000-00002784-48098-8725-004C20F0 LoadLibraryExW@KERNEL32.DLL at 00000000-00001316-58894-29-0042A57A LoadLibraryW@KERNEL32.DLL at 00000000-00001316-58894-65-00411CD0 LoadLibraryW@KERNEL32.DLL at 00000000-00001316-58894-111-00412220 LoadLibraryA@KERNEL32.DLL at 00000000-00001316-58894-2814-004C28F0 LoadLibraryA@KERNEL32.DLL at 00000000-00001316-58894-2815-004C2700 LoadLibraryW@KERNEL32.DLL at 00000000-00001316-58894-5601-0040F310 LoadLibraryW@KERNEL32.DLL at 00000000-00001316-58894-5628-0041DC3C LoadLibraryA@KERNEL32.DLL at 00000000-00001316-58894-8723-004C20F0 LoadLibraryExW@KERNEL32.DLL at 00000000-00001936-65104-29-0042A57A3f:T448,"Software\Microsoft\Windows\CurrentVersion\Run" in Source: 40981-65-00411CD0 "Software\Microsoft\Windows\CurrentVersion" in Source: 40981-6207-0040C6A0 "Software\Microsoft\Windows\CurrentVersion" in Source: 00000000-00001260.00000000.90318.00400000.00000040.mdmp 00000000-00001260.00000001.91374.00400000.00000040.mdmp "Software\Microsoft\Windows\CurrentVersion\Run" in Source: 00000000-00001260.00000000.90318.00400000.00000040.mdmp 00000000-00001260.00000001.91374.00400000.00000040.mdmp "Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\" in Source: 00000000-00001260.00000001.91374.00250000.00000004.mdmp "Software\Policies\Microsoft\Internet Explorer\Main" in Source: 00000000-00001316.00000000.81962.00180000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion" in Source: 00000000-00001316.00000000.81962.00400000.00000040.mdmp 00000000-00001316.00000001.83107.00400000.00000040.mdmp "Software\Microsoft\Windows\CurrentVersion\Run" in Source: 00000000-00001316.00000000.81962.00400000.00000040.mdmp 00000000-00001316.00000001.83107.00400000.00000040.mdmp40:T3372,"Software\Microsoft\Windows\CurrentVersion" in Source: 00000000-00001260.00000000.90318.00400000.00000040.mdmp "Software\Microsoft\Windows\CurrentVersion\Run" in Source: 00000000-00001260.00000000.90318.00400000.00000040.mdmp "Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\" in Source: 00000000-00001260.00000001.91374.00250000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion" in Source: 00000000-00001260.00000001.91374.00400000.00000040.mdmp "Software\Microsoft\Windows\CurrentVersion\Run" in Source: 00000000-00001260.00000001.91374.00400000.00000040.mdmp "Software\Policies\Microsoft\Internet Explorer\Main" in Source: 00000000-00001316.00000000.81962.00180000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion" in Source: 00000000-00001316.00000000.81962.00400000.00000040.mdmp "Software\Microsoft\Windows\CurrentVersion\Run" in Source: 00000000-00001316.00000000.81962.00400000.00000040.mdmp "Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\" in Source: 00000000-00001316.00000001.83107.001F7000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion" in Source: 00000000-00001316.00000001.83107.00400000.00000040.mdmp "Software\Microsoft\Windows\CurrentVersion\Run" in Source: 00000000-00001316.00000001.83107.00400000.00000040.mdmp "Software\Microsoft\Windows\CurrentVersion" in Source: 00000000-00001460.00000000.84618.00400000.00000040.mdmp "Software\Microsoft\Windows\CurrentVersion\Run" in Source: 00000000-00001460.00000000.84618.00400000.00000040.mdmp "Software\Microsoft\Windows\CurrentVersion" in Source: 00000000-00001460.00000001.85504.00400000.00000040.mdmp "Software\Microsoft\Windows\CurrentVersion\Run" in Source: 00000000-00001460.00000001.85504.00400000.00000040.mdmp "Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\" in Source: 00000000-00001460.00000001.85504.00730000.00000004.mdmp "Software\Policies\Microsoft\Internet Explorer\Main" in Source: 00000000-00001936.00000000.82481.001A0000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion" in Source: 00000000-00001936.00000000.82481.00400000.00000040.mdmp "Software\Microsoft\Windows\CurrentVersion\Run" in Source: 00000000-00001936.00000000.82481.00400000.00000040.mdmp "Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\" in Source: 00000000-00001936.00000001.83411.0021D000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion" in Source: 00000000-00001936.00000001.83411.00400000.00000040.mdmp "Software\Microsoft\Windows\CurrentVersion\Run" in Source: 00000000-00001936.00000001.83411.00400000.00000040.mdmp "Software\Policies\Microsoft\Internet Explorer\Main" in Source: 00000000-00002112.00000000.91290.001C0000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion" in Source: 00000000-00002112.00000000.91290.00400000.00000040.mdmp "Software\Microsoft\Windows\CurrentVersion\Run" in Source: 00000000-00002112.00000000.91290.00400000.00000040.mdmp "Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\" in Source: 00000000-00002112.00000001.92399.00242000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion" in Source: 00000000-00002112.00000001.92399.00400000.00000040.mdmp "Software\Microsoft\Windows\CurrentVersion\Run" in Source: 00000000-00002112.00000001.92399.00400000.00000040.mdmp "Software\Policies\Microsoft\Internet Explorer\Main" in Source: 00000000-00002340.00000000.92422.001F0000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion" in Source: 00000000-00002340.00000000.92422.00400000.00000040.mdmp "Software\Microsoft\Windows\CurrentVersion\Run" in Source: 00000000-00002340.00000000.92422.00400000.00000040.mdmp "Software\Policies\Microsoft\Internet Explorer\Main" in Source: 00000000-00002408.00000000.83276.00290000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion" in Source: 00000000-00002408.00000000.83276.00400000.00000040.mdmp "Software\Microsoft\Windows\CurrentVersion\Run" in Source: 00000000-00002408.00000000.83276.00400000.00000040.mdmp "Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\" in Source: 00000000-00002408.00000001.84654.0030F000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion" in Source: 00000000-00002408.00000001.84654.00400000.00000040.mdmp "Software\Microsoft\Windows\CurrentVersion\Run" in Source: 00000000-00002408.00000001.84654.00400000.00000040.mdmp "Software\Policies\Microsoft\Internet Explorer\Main" in Source: 00000000-00002784.00000000.81480.00190000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion" in Source: 00000000-00002784.00000000.81480.00400000.00000040.mdmp "Software\Microsoft\Windows\CurrentVersion\Run" in Source: 00000000-00002784.00000000.81480.00400000.00000040.mdmp "Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\" in Source: 00000000-00002784.00000001.82152.00190000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion" in Source: 00000000-00002784.00000001.82152.00400000.00000040.mdmp "Software\Microsoft\Windows\CurrentVersion\Run" in Source: 00000000-00002784.00000001.82152.00400000.00000040.mdmp "Software\Microsoft\Windows\CurrentVersion" in Source: 00000000-00002992.00000000.83813.04090000.00000040.mdmp "Software\Microsoft\Windows\CurrentVersion\Run" in Source: 00000000-00002992.00000000.83813.04090000.00000040.mdmp "Software\Policies\Microsoft\Internet Explorer\Main" in Source: 00000000-00003176.00000000.91995.00170000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion" in Source: 00000000-00003176.00000000.91995.00400000.00000040.mdmp "Software\Microsoft\Windows\CurrentVersion\Run" in Source: 00000000-00003176.00000000.91995.00400000.00000040.mdmp "Software\Policies\Microsoft\Internet Explorer\Main" in Source: 00000000-00003336.00000000.89478.002E0000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion" in Source: 00000000-00003336.00000000.89478.00400000.00000040.mdmp "Software\Microsoft\Windows\CurrentVersion\Run" in Source: 00000000-00003336.00000000.89478.00400000.00000040.mdmp "Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\" in Source: 00000000-00003336.00000001.90378.0035C000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion" in Source: 00000000-00003336.00000001.90378.00400000.00000040.mdmp "Software\Microsoft\Windows\CurrentVersion\Run" in Source: 00000000-00003336.00000001.90378.00400000.00000040.mdmp "Software\Policies\Microsoft\Internet Explorer\Main" in Source: 00000000-00003936.00000000.79964.00210000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\" in Source: 00000000-00003936.00000000.79964.00210000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion" in Source: 00000000-00003936.00000000.79964.00400000.00000040.mdmp "Software\Microsoft\Windows\CurrentVersion\Run" in Source: 00000000-00003936.00000000.79964.00400000.00000040.mdmp "Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\" in Source: 00000000-00003936.00000001.81096.00210000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion" in Source: 00000000-00003936.00000001.81096.00400000.00000040.mdmp "Software\Microsoft\Windows\CurrentVersion\Run" in Source: 00000000-00003936.00000001.81096.00400000.00000040.mdmp "Software\Microsoft\Windows\CurrentVersion" in Source: 00000000-00004144.00000000.88995.00400000.00000040.mdmp "Software\Microsoft\Windows\CurrentVersion\Run" in Source: 00000000-00004144.00000000.88995.00400000.00000040.mdmp "Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\" in Source: 00000000-00004144.00000001.90881.00190000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion" in Source: 00000000-00004144.00000001.90881.00400000.00000040.mdmp "Software\Microsoft\Windows\CurrentVersion\Run" in Source: 00000000-00004144.00000001.90881.00400000.00000040.mdmp "Software\Policies\Microsoft\Internet Explorer\Main" in Source: 00000000-00004280.00000000.88298.00280000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion" in Source: 00000000-00004280.00000000.88298.00400000.00000040.mdmp "Software\Microsoft\Windows\CurrentVersion\Run" in Source: 00000000-00004280.00000000.88298.00400000.00000040.mdmp "Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\" in Source: 00000000-00004280.00000001.89167.0031E000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion" in Source: 00000000-00004280.00000001.89167.00400000.00000040.mdmp "Software\Microsoft\Windows\CurrentVersion\Run" in Source: 00000000-00004280.00000001.89167.00400000.00000040.mdmp "\Registry\Machine\System\CurrentControlSet\Control\Nls\ExtendedLocale" in Source: 00000000-00004344.00000000.89187.0012A000.00000004.mdmp "Software\Policies\Microsoft\Internet Explorer\Main" in Source: 00000000-00004704.00000000.83916.002F0000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion" in Source: 00000000-00004704.00000000.83916.00400000.00000040.mdmp "Software\Microsoft\Windows\CurrentVersion\Run" in Source: 00000000-00004704.00000000.83916.00400000.00000040.mdmp "Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\" in Source: 00000000-00004704.00000001.84992.00368000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion" in Source: 00000000-00004704.00000001.84992.00400000.00000040.mdmp "Software\Microsoft\Windows\CurrentVersion\Run" in Source: 00000000-00004704.00000001.84992.00400000.00000040.mdmp "Software\Policies\Microsoft\Internet Explorer\Main" in Source: 00000000-00004804.00000000.85330.00260000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion" in Source: 00000000-00004804.00000000.85330.00400000.00000040.mdmp "Software\Microsoft\Windows\CurrentVersion\Run" in Source: 00000000-00004804.00000000.85330.00400000.00000040.mdmp "Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\" in Source: 00000000-00004804.00000001.86646.00260000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion" in Source: 00000000-00004804.00000001.86646.00400000.00000040.mdmp "Software\Microsoft\Windows\CurrentVersion\Run" in Source: 00000000-00004804.00000001.86646.00400000.00000040.mdmp "Software\Policies\Microsoft\Internet Explorer\Main" in Source: 00000000-00005256.00000000.85841.001F0000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion" in Source: 00000000-00005256.00000000.85841.00400000.00000040.mdmp "Software\Microsoft\Windows\CurrentVersion\Run" in Source: 00000000-00005256.00000000.85841.00400000.00000040.mdmp "Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\" in Source: 00000000-00005256.00000001.86646.0026F000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion" in Source: 00000000-00005256.00000001.86646.00400000.00000040.mdmp "Software\Microsoft\Windows\CurrentVersion\Run" in Source: 00000000-00005256.00000001.86646.00400000.00000040.mdmp "Software\Microsoft\Windows\CurrentVersion" in Source: 00000000-00005336.00000000.86578.00400000.00000040.mdmp "Software\Microsoft\Windows\CurrentVersion\Run" in Source: 00000000-00005336.00000000.86578.00400000.00000040.mdmp "Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\" in Source: 00000000-00005336.00000001.87785.0032F000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion" in Source: 00000000-00005336.00000001.87785.00400000.00000040.mdmp "Software\Microsoft\Windows\CurrentVersion\Run" in Source: 00000000-00005336.00000001.87785.00400000.00000040.mdmp "Software\Policies\Microsoft\Internet Explorer\Main" in Source: 00000000-00005832.00000000.87213.00170000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion" in Source: 00000000-00005832.00000000.87213.00400000.00000040.mdmp "Software\Microsoft\Windows\CurrentVersion\Run" in Source: 00000000-00005832.00000000.87213.00400000.00000040.mdmp "Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\" in Source: 00000000-00005832.00000001.88413.001F3000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion" in Source: 00000000-00005832.00000001.88413.00400000.00000040.mdmp "Software\Microsoft\Windows\CurrentVersion\Run" in Source: 00000000-00005832.00000001.88413.00400000.00000040.mdmp "Software\Microsoft\Windows\CurrentVersion" in Source: 00000000-00006008.00000000.87767.00400000.00000040.mdmp "Software\Microsoft\Windows\CurrentVersion\Run" in Source: 00000000-00006008.00000000.87767.00400000.00000040.mdmp "Software\Policies\Microsoft\Internet Explorer\Main" in Source: 00000000-00006008.00000001.89688.00200000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\" in Source: 00000000-00006008.00000001.89688.00200000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\" in Source: 00000000-00006008.00000002.90055.00200000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion" in Source: 00000000-00006008.00000002.90055.00400000.00000040.mdmp "Software\Microsoft\Windows\CurrentVersion\Run" in Source: 00000000-00006008.00000002.90055.00400000.00000040.mdmp "\Registry\Machine\System\CurrentControlSet\Control\Nls\ExtendedLocale" in Source: 00000000-00006104.00000000.88033.0012A000.00000004.mdmp41:T2528,"GET /r/gsr1.crl HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: c.pki.goog" Response ==> HTTP/1.1 200 OK Accept-Ranges: bytes Content-Security-Policy-Report-Only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/cacerts Cross-Origin-Resource-Policy: cross-origin Cross-Origin-Opener-Policy: same-origin; report-to="cacerts" Report-To: {"group":"cacerts" "max_age":2592000 "endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/cacerts"}]} Content-Length: 1871 X-Content-Type-Options: nosniff Server: sffe X-XSS-Protection: 0 Date: Wed 16 Sep 2026 09:26:55 GMT Expires: Wed 16 Sep 2026 10:16:55 GMT Cache-Control: public max-age=3000 Age: 1634 Last-Modified: Mon 31 Aug 2026 08:08:00 GMT Content-Type: application/pkix-crl Vary: Accept-Encoding with response body ==>30C282074B30C2820633020101300D06092AC28648C286C3B70D01010B05003057310B300906035504061302424531193017060355040A1310476C6F62616C53....... "GET /we1/8GJyPhuLa-4.crl HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: c.pki.goog" Response ==> HTTP/1.1 200 OK Accept-Ranges: bytes Content-Security-Policy-Report-Only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/cacerts Cross-Origin-Resource-Policy: cross-origin Cross-Origin-Opener-Policy: same-origin; report-to="cacerts" Report-To: {"group":"cacerts" "max_age":2592000 "endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/cacerts"}]} Content-Length: 309 X-Content-Type-Options: nosniff Server: sffe X-XSS-Protection: 0 Date: Wed 16 Sep 2026 09:36:54 GMT Expires: Wed 16 Sep 2026 10:26:54 GMT Cache-Control: public max-age=3000 Age: 1035 Last-Modified: Wed 16 Sep 2026 07:49:31 GMT Content-Type: application/pkix-crl with response body ==>30C282013130C281C398020101300A06082AC28648C38E3D040302303B310B3009060355040613025553311E301C060355040A1315476F6F676C652054727573....... "GET /r/r4.crl HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: c.pki.goog" Response ==> HTTP/1.1 200 OK Accept-Ranges: bytes Content-Security-Policy-Report-Only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/cacerts Cross-Origin-Resource-Policy: cross-origin Cross-Origin-Opener-Policy: same-origin; report-to="cacerts" Report-To: {"group":"cacerts" "max_age":2592000 "endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/cacerts"}]} Content-Length: 528 X-Content-Type-Options: nosniff Server: sffe X-XSS-Protection: 0 Date: Wed 16 Sep 2026 09:13:27 GMT Expires: Wed 16 Sep 2026 10:03:27 GMT Cache-Control: public max-age=3000 Age: 2442 Last-Modified: Wed 11 Feb 2026 14:38:00 GMT Content-Type: application/pkix-crl Vary: Accept-Encoding with response body ==>30C282020C30C28201C293020101300A06082AC28648C38E3D0403033047310B300906035504061302555331223020060355040A1319476F6F676C6520547275....... "GET /we1/8GJyPhuLa-4.crl HTTP/1.1 Cache-Control: max-age = 3000 Connection: Keep-Alive Accept: */* If-Modified-Since: Wed, 16 Sep 2026 07:49:31 GMT User-Agent: Microsoft-CryptoAPI/6.1 Host: c.pki.goog" Response ==> HTTP/1.1 304 Not Modified Date: Wed 16 Sep 2026 09:36:54 GMT Expires: Wed 16 Sep 2026 10:26:54 GMT Age: 1054 Last-Modified: Wed 16 Sep 2026 07:49:31 GMT Cache-Control: public max-age=3000 with no response body "GET /r/gsr1.crl HTTP/1.1 Cache-Control: max-age = 3000 Connection: Keep-Alive Accept: */* If-Modified-Since: Mon, 31 Aug 2026 08:08:00 GMT User-Agent: Microsoft-CryptoAPI/6.1 Host: c.pki.goog" Response ==> HTTP/1.1 304 Not Modified Date: Wed 16 Sep 2026 09:26:55 GMT Expires: Wed 16 Sep 2026 10:16:55 GMT Age: 1653 Last-Modified: Mon 31 Aug 2026 08:08:00 GMT Cache-Control: public max-age=3000 Vary: Accept-Encoding with no response body "GET /r/r4.crl HTTP/1.1 Cache-Control: max-age = 3000 Connection: Keep-Alive Accept: */* If-Modified-Since: Wed, 11 Feb 2026 14:38:00 GMT User-Agent: Microsoft-CryptoAPI/6.1 Host: c.pki.goog" Response ==> HTTP/1.1 304 Not Modified Date: Wed 16 Sep 2026 09:13:27 GMT Expires: Wed 16 Sep 2026 10:03:27 GMT Age: 2461 Last-Modified: Wed 11 Feb 2026 14:38:00 GMT Cache-Control: public max-age=3000 Vary: Accept-Encoding with no response body "GET /we1/8GJyPhuLa-4.crl HTTP/1.1 Cache-Control: max-age = 3000 Connection: Keep-Alive Accept: */* If-Modified-Since: Wed, 16 Sep 2026 07:49:31 GMT User-Agent: Microsoft-CryptoAPI/6.1 Host: c.pki.goog" Response ==> HTTP/1.1 304 Not Modified Date: Wed 16 Sep 2026 09:36:54 GMT Expires: Wed 16 Sep 2026 10:26:54 GMT Age: 1073 Last-Modified: Wed 16 Sep 2026 07:49:31 GMT Cache-Control: public max-age=3000 with no response body "GET /r/gsr1.crl HTTP/1.1 Cache-Control: max-age = 3000 Connection: Keep-Alive Accept: */* If-Modified-Since: Mon, 31 Aug 2026 08:08:00 GMT User-Agent: Microsoft-CryptoAPI/6.1 Host: c.pki.goog" Response ==> HTTP/1.1 304 Not Modified Date: Wed 16 Sep 2026 09:26:55 GMT Expires: Wed 16 Sep 2026 10:16:55 GMT Age: 1672 Last-Modified: Mon 31 Aug 2026 08:08:00 GMT Cache-Control: public max-age=3000 Vary: Accept-Encoding with no response body "GET /r/r4.crl HTTP/1.1 Cache-Control: max-age = 3000 Connection: Keep-Alive Accept: */* If-Modified-Since: Wed, 11 Feb 2026 14:38:00 GMT User-Agent: Microsoft-CryptoAPI/6.1 Host: c.pki.goog" Response ==> HTTP/1.1 304 Not Modified Date: Wed 16 Sep 2026 09:13:27 GMT Expires: Wed 16 Sep 2026 10:03:27 GMT Age: 2480 Last-Modified: Wed 11 Feb 2026 14:38:00 GMT Cache-Control: public max-age=3000 Vary: Accept-Encoding with no response body "GET /we1/8GJyPhuLa-4.crl HTTP/1.1 Cache-Control: max-age = 3000 Connection: Keep-Alive Accept: */* If-Modified-Since: Wed, 16 Sep 2026 07:49:31 GMT User-Agent: Microsoft-CryptoAPI/6.1 Host: c.pki.goog" Response ==> HTTP/1.1 304 Not Modified Date: Wed 16 Sep 2026 09:36:54 GMT Expires: Wed 16 Sep 2026 10:26:54 GMT Age: 1099 Last-Modified: Wed 16 Sep 2026 07:49:31 GMT Cache-Control: public max-age=3000 with no response body "GET /r/gsr1.crl HTTP/1.1 Cache-Control: max-age = 3000 Connection: Keep-Alive Accept: */* If-Modified-Since: Mon, 31 Aug 2026 08:08:00 GMT User-Agent: Microsoft-CryptoAPI/6.1 Host: c.pki.goog" Response ==> HTTP/1.1 304 Not Modified Date: Wed 16 Sep 2026 09:26:55 GMT Expires: Wed 16 Sep 2026 10:16:55 GMT Age: 1698 Last-Modified: Mon 31 Aug 2026 08:08:00 GMT Cache-Control: public max-age=3000 Vary: Accept-Encoding with no response body "GET /r/r4.crl HTTP/1.1 Cache-Control: max-age = 3000 Connection: Keep-Alive Accept: */* If-Modified-Since: Wed, 11 Feb 2026 14:38:00 GMT User-Agent: Microsoft-CryptoAPI/6.1 Host: c.pki.goog" Response ==> HTTP/1.1 304 Not Modified Date: Wed 16 Sep 2026 09:13:27 GMT Expires: Wed 16 Sep 2026 10:03:27 GMT Age: 2506 Last-Modified: Wed 11 Feb 2026 14:38:00 GMT Cache-Control: public max-age=3000 Vary: Accept-Encoding with no response body "GET /we1/8GJyPhuLa-4.crl HTTP/1.1 Cache-Control: max-age = 3000 Connection: Keep-Alive Accept: */* If-Modified-Since: Wed, 16 Sep 2026 07:49:31 GMT User-Agent: Microsoft-CryptoAPI/6.1 Host: c.pki.goog" Response ==> HTTP/1.1 304 Not Modified Date: Wed 16 Sep 2026 09:36:54 GMT Expires: Wed 16 Sep 2026 10:26:54 GMT Age: 1124 Last-Modified: Wed 16 Sep 2026 07:49:31 GMT Cache-Control: public max-age=3000 with no response body "GET /r/gsr1.crl HTTP/1.1 Cache-Control: max-age = 3000 Connection: Keep-Alive Accept: */* If-Modified-Since: Mon, 31 Aug 2026 08:08:00 GMT User-Agent: Microsoft-CryptoAPI/6.1 Host: c.pki.goog" Response ==> HTTP/1.1 304 Not Modified Date: Wed 16 Sep 2026 09:26:55 GMT Expires: Wed 16 Sep 2026 10:16:55 GMT Age: 1723 Last-Modified: Mon 31 Aug 2026 08:08:00 GMT Cache-Control: public max-age=3000 Vary: Accept-Encoding with no response body "GET /r/r4.crl HTTP/1.1 Cache-Control: max-age = 3000 Connection: Keep-Alive Accept: */* If-Modified-Since: Wed, 11 Feb 2026 14:38:00 GMT User-Agent: Microsoft-CryptoAPI/6.1 Host: c.pki.goog" Response ==> HTTP/1.1 304 Not Modified Date: Wed 16 Sep 2026 09:13:27 GMT Expires: Wed 16 Sep 2026 10:03:27 GMT Age: 2531 Last-Modified: Wed 11 Feb 2026 14:38:00 GMT Cache-Control: public max-age=3000 Vary: Accept-Encoding with no response body "GET /we1/8GJyPhuLa-4.crl HTTP/1.1 Cache-Control: max-age = 3000 Connection: Keep-Alive Accept: */* If-Modified-Since: Wed, 16 Sep 2026 07:49:31 GMT User-Agent: Microsoft-CryptoAPI/6.1 Host: c.pki.goog" Response ==> HTTP/1.1 304 Not Modified Date: Wed 16 Sep 2026 09:36:54 GMT Expires: Wed 16 Sep 2026 10:26:54 GMT Age: 1164 Last-Modified: Wed 16 Sep 2026 07:49:31 GMT Cache-Control: public max-age=3000 with no response body "GET /r/gsr1.crl HTTP/1.1 Cache-Control: max-age = 3000 Connection: Keep-Alive Accept: */* If-Modified-Since: Mon, 31 Aug 2026 08:08:00 GMT User-Agent: Microsoft-CryptoAPI/6.1 Host: c.pki.goog" Response ==> HTTP/1.1 304 Not Modified Date: Wed 16 Sep 2026 09:26:55 GMT Expires: Wed 16 Sep 2026 10:16:55 GMT Age: 1763 Last-Modified: Mon 31 Aug 2026 08:08:00 GMT Cache-Control: public max-age=3000 Vary: Accept-Encoding with no response body "GET /r/r4.crl HTTP/1.1 Cache-Control: max-age = 3000 Connection: Keep-Alive Accept: */* If-Modified-Since: Wed, 11 Feb 2026 14:38:00 GMT User-Agent: Microsoft-CryptoAPI/6.1 Host: c.pki.goog" Response ==> HTTP/1.1 304 Not Modified Date: Wed 16 Sep 2026 09:13:27 GMT Expires: Wed 16 Sep 2026 10:03:27 GMT Age: 2571 Last-Modified: Wed 11 Feb 2026 14:38:00 GMT Cache-Control: public max-age=3000 Vary: Accept-Encoding with no response body42:T24cc,"fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" loaded module "KERNEL32.DLL" at base 75fa0000 "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 68bf0000 "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" loaded module "USER32" at base 769c0000 "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" loaded module "KERNEL32" at base 75fa0000 "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" loaded module "NTDLL.DLL" at base 77aa0000 "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 74530000 "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" loaded module "DWMAPI.DLL" at base 74140000 "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 75850000 "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" loaded module "SHELL32.DLL" at base 76d80000 "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" loaded module "OLE32.DLL" at base 75ce0000 "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" loaded module "ADVAPI32.DLL" at base 75e40000 "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" loaded module "PROFAPI.DLL" at base 759b0000 "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" loaded module "API-MS-WIN-DOWNLEVEL-ADVAPI32-L2-1-0.DLL" at base 6ffb0000 "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" loaded module "API-MS-WIN-DOWNLEVEL-OLE32-L1-1-0.DLL" at base 75ca0000 "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" loaded module "WS2_32.DLL" at base 76230000 "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" loaded module "WINHTTP.DLL" at base 71bd0000 "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" loaded module "%WINDIR%\SYSTEM32\MSWSOCK.DLL" at base 75370000 "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" loaded module "IPHLPAPI.DLL" at base 72690000 "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" loaded module "%WINDIR%\SYSTEM32\WSHIP6.DLL" at base 75360000 "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" loaded module "API-MS-WIN-DOWNLEVEL-SHLWAPI-L2-1-0.DLL" at base 70640000 "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" loaded module "DNSAPI.DLL" at base 75230000 "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" loaded module "RPCRT4.DLL" at base 75ef0000 "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" loaded module "CRYPTBASE.DLL" at base 758a0000 "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" loaded module "CLBCATQ.DLL" at base 76370000 "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" loaded module "%WINDIR%\SYSTEM32\NETPROFM.DLL" at base 6d490000 "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" loaded module "DHCPCSVC6.DLL" at base 719b0000 "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" loaded module "%WINDIR%\SYSTEM32\WSHTCPIP.DLL" at base 74ed0000 "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" loaded module "DHCPCSVC.DLL" at base 71930000 "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" loaded module "RASADHLP.DLL" at base 6d250000 "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" loaded module "API-MS-WIN-SECURITY-LSALOOKUP-L1-1-0.DLL" at base 76400000 "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" loaded module "CRYPTSP.DLL" at base 753b0000 "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" loaded module "%WINDIR%\SYSTEM32\RSAENH.DLL" at base 75140000 "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" loaded module "RPCRTREMOTE.DLL" at base 75940000 "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" loaded module "%WINDIR%\SYSTEM32\NPMPROXY.DLL" at base 6ccf0000 "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" loaded module "OLEAUT32.DLL" at base 77c50000 "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" loaded module "CRYPT32.DLL" at base 75b10000 "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" loaded module "USERENV.DLL" at base 75aa0000 "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" loaded module "API-MS-WIN-SECURITY-SDDL-L1-1-0.DLL" at base 76400000 "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" loaded module "URLMON.DLL" at base 76c30000 "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" loaded module "%WINDIR%\SYSTEM32\OLEAUT32.DLL" at base 77c50000 "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" loaded module "SECUR32.DLL" at base 756d0000 "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" loaded module "%WINDIR%\SYSTEM32\WININET.DLL" at base 76420000 "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" loaded module "%WINDIR%\SYSTEM32\FWPUCLNT.DLL" at base 719d0000 "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" loaded module "COMCTL32.DLL" at base 748a0000 "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" loaded module "%WINDIR%\SYSTEM32\WS2_32" at base 76230000 "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" loaded module "CREDSSP.DLL" at base 75070000 "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" loaded module "%WINDIR%\SYSTEM32\SCHANNEL.DLL" at base 751b0000 "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" loaded module "NCRYPT.DLL" at base 754e0000 "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" loaded module "%WINDIR%\SYSTEM32\BCRYPTPRIMITIVES.DLL" at base 75080000 "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" loaded module "WINTRUST.DLL" at base 75c40000 "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" loaded module "GPAPI.DLL" at base 74f80000 "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" loaded module "API-MS-WIN-SERVICE-MANAGEMENT-L1-1-0.DLL" at base 76400000 "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" loaded module "API-MS-WIN-SERVICE-MANAGEMENT-L2-1-0.DLL" at base 76400000 "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" loaded module "USER32.DLL" at base 769c0000 "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" loaded module "%WINDIR%\SYSTEM32\CRYPTNET.DLL" at base 6eed0000 "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" loaded module "CRYPTNET.DLL" at base 6eed0000 "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" loaded module "SHLWAPI.DLL" at base 761d0000 "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" loaded module "SENSAPI.DLL" at base 72f80000 "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" loaded module "%WINDIR%\SYSTEM32\CRYPT32.DLL" at base 75b10000 "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" loaded module "SSPICLI.DLL" at base 75830000 "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" loaded module "API-MS-WIN-SERVICE-WINSVC-L1-1-0.DLL" at base 76400000 "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" loaded module "NSI.DLL" at base 77bf0000 "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" loaded module "CFGMGR32.DLL" at base 759e0000 "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" loaded module "PSAPI.DLL" at base 77c10000 "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" loaded module "%WINDIR%\SYSTEM32\TASKSCHD.DLL" at base 73f80000 "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" loaded module "XMLLITE.DLL" at base 740c0000 "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" loaded module "PROPSYS.DLL" at base 746a0000 "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" loaded module "%WINDIR%\SYSTEM32\PROPSYS.DLL" at base 746a0000 "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" loaded module "NTMARTA.DLL" at base 74e10000 "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" loaded module "%WINDIR%\SYSTEM32\URLMON.DLL" at base 76c30000 "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" loaded module "API-MS-WIN-DOWNLEVEL-SHLWAPI-L1-1-0.DLL" at base 75c70000 "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" loaded module "API-MS-WIN-CORE-LOCALREGISTRY-L1-1-0.DLL" at base 75fa0000 "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" loaded module "SETUPAPI.DLL" at base 76a90000 "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" loaded module "SENSAPI.DLL" at base 72f50000 "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 68c4000043:T543,"fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" touched "TaskScheduler class" (Path: "HKCU\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}") "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" touched "NetworkListManager" (Path: "HKCU\CLSID\{DCB00C01-570F-4A9B-8D69-199FDBA5723B}") "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" touched "Network List Manager" (Path: "HKLM\SOFTWARE\CLASSES\CLSID\{A47979D2-C419-11D9-A5B4-001185AD2B89}") "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" touched "PSFactoryBuffer" (Path: "HKCU\CLSID\{1299CF18-C4F5-4B6A-BB0F-2299F0398E27}\TREATAS") "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" touched "WinInetBroker Class" (Path: "HKCU\CLSID\{C39EE728-D419-4BD4-A3EF-EDA059DBD935}\LOCALSERVER32") "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" touched "Computer" (Path: "HKCU\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\SHELLFOLDER") "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" touched "Memory Mapped Cache Mgr" (Path: "HKCU\CLSID\{1F486A52-3CB1-48FD-8F50-B8DC300D9F9D}\TREATAS") "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" touched "Security Manager" (Path: "HKCU\CLSID\{7B8A2D94-0AC9-11D1-896C-00C04FB6BFC4}\TREATAS")44:T410,"fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336" file has an entrypoint instructions - "call 0x410ce0,jmp 0x40b10a,push 0x14,push 0x416e38,call 0x40b8e0,call 0x410ec7,movzx esi, ax,push 2,call 0x410c93,pop ecx,mov eax, 0x5a4d,cmp word ptr [0x400000], ax,je 0x40b138,xor ebx, ebx,jmp 0x40b16b,mov eax, dword ptr [0x40003c],cmp dword ptr [eax + 0x400000], 0x4550,jne 0x40b134,mov ecx, 0x10b,cmp word ptr [eax + 0x400018], cx,jne 0x40b134,xor ebx, ebx,cmp dword ptr [eax + 0x400074], 0xe,jbe 0x40b16b," "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" file has an entrypoint instructions - "call 0x410ce0,jmp 0x40b10a,push 0x14,push 0x416e38,call 0x40b8e0,call 0x410ec7,movzx esi, ax,push 2,call 0x410c93,pop ecx,mov eax, 0x5a4d,cmp word ptr [0x400000], ax,je 0x40b138,xor ebx, ebx,jmp 0x40b16b,mov eax, dword ptr [0x40003c],cmp dword ptr [eax + 0x400000], 0x4550,jne 0x40b134,mov ecx, 0x10b,cmp word ptr [eax + 0x400018], cx,jne 0x40b134,xor ebx, ebx,cmp dword ptr [eax + 0x400074], 0xe,jbe 0x40b16b,"45:T227c,Process "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" (UID: 00000000-00003936) was launched with new environment variables: "USERDNSDOMAIN="%OSUSER%-PC"" Process "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" (UID: 00000000-00003936) was launched with modified environment variables: "NUMBER_OF_PROCESSORS" Process "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" (UID: 00000000-00003996) was launched with modified environment variables: "NUMBER_OF_PROCESSORS" Process "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" (UID: 00000000-00003996) was launched with missing environment variables: "USERDNSDOMAIN" Process "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" (UID: 00000000-00001316) was launched with new environment variables: "USERDNSDOMAIN="%OSUSER%-PC"" Process "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" (UID: 00000000-00001316) was launched with modified environment variables: "NUMBER_OF_PROCESSORS" Process "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" (UID: 00000000-00003232) was launched with modified environment variables: "NUMBER_OF_PROCESSORS" Process "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" (UID: 00000000-00003232) was launched with missing environment variables: "USERDNSDOMAIN" Process "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" (UID: 00000000-00001936) was launched with new environment variables: "USERDNSDOMAIN="%OSUSER%-PC"" Process "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" (UID: 00000000-00001936) was launched with modified environment variables: "NUMBER_OF_PROCESSORS" Process "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" (UID: 00000000-00004436) was launched with modified environment variables: "NUMBER_OF_PROCESSORS" Process "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" (UID: 00000000-00004436) was launched with missing environment variables: "USERDNSDOMAIN" Process "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" (UID: 00000000-00002408) was launched with new environment variables: "USERDNSDOMAIN="%OSUSER%-PC"" Process "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" (UID: 00000000-00002408) was launched with modified environment variables: "NUMBER_OF_PROCESSORS" Process "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" (UID: 00000000-00002992) was launched with modified environment variables: "NUMBER_OF_PROCESSORS" Process "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" (UID: 00000000-00002992) was launched with missing environment variables: "USERDNSDOMAIN" Process "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" (UID: 00000000-00004704) was launched with new environment variables: "USERDNSDOMAIN="%OSUSER%-PC"" Process "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" (UID: 00000000-00004704) was launched with modified environment variables: "NUMBER_OF_PROCESSORS" Process "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" (UID: 00000000-00002880) was launched with modified environment variables: "NUMBER_OF_PROCESSORS" Process "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" (UID: 00000000-00002880) was launched with missing environment variables: "USERDNSDOMAIN" Process "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" (UID: 00000000-00001460) was launched with new environment variables: "USERDNSDOMAIN="%OSUSER%-PC"" Process "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" (UID: 00000000-00001460) was launched with modified environment variables: "NUMBER_OF_PROCESSORS" Process "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" (UID: 00000000-00005196) was launched with modified environment variables: "NUMBER_OF_PROCESSORS" Process "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" (UID: 00000000-00005196) was launched with missing environment variables: "USERDNSDOMAIN" Process "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" (UID: 00000000-00004804) was launched with new environment variables: "USERDNSDOMAIN="%OSUSER%-PC"" Process "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" (UID: 00000000-00004804) was launched with modified environment variables: "NUMBER_OF_PROCESSORS" Process "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" (UID: 00000000-00005216) was launched with modified environment variables: "NUMBER_OF_PROCESSORS" Process "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" (UID: 00000000-00005216) was launched with missing environment variables: "USERDNSDOMAIN" Process "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" (UID: 00000000-00005256) was launched with new environment variables: "USERDNSDOMAIN="%OSUSER%-PC"" Process "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" (UID: 00000000-00005256) was launched with modified environment variables: "NUMBER_OF_PROCESSORS" Process "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" (UID: 00000000-00003216) was launched with modified environment variables: "NUMBER_OF_PROCESSORS" Process "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" (UID: 00000000-00003216) was launched with missing environment variables: "USERDNSDOMAIN" Process "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" (UID: 00000000-00005336) was launched with new environment variables: "USERDNSDOMAIN="%OSUSER%-PC"" Process "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" (UID: 00000000-00005336) was launched with modified environment variables: "NUMBER_OF_PROCESSORS" Process "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" (UID: 00000000-00005672) was launched with modified environment variables: "NUMBER_OF_PROCESSORS" Process "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" (UID: 00000000-00005672) was launched with missing environment variables: "USERDNSDOMAIN" Process "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" (UID: 00000000-00005832) was launched with new environment variables: "USERDNSDOMAIN="%OSUSER%-PC"" Process "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" (UID: 00000000-00005832) was launched with modified environment variables: "NUMBER_OF_PROCESSORS" Process "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" (UID: 00000000-00005956) was launched with modified environment variables: "NUMBER_OF_PROCESSORS" Process "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" (UID: 00000000-00005956) was launched with missing environment variables: "USERDNSDOMAIN" Process "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" (UID: 00000000-00006008) was launched with new environment variables: "USERDNSDOMAIN="%OSUSER%-PC"" Process "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" (UID: 00000000-00006008) was launched with modified environment variables: "NUMBER_OF_PROCESSORS" Process "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" (UID: 00000000-00006104) was launched with modified environment variables: "NUMBER_OF_PROCESSORS" Process "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" (UID: 00000000-00006104) was launched with missing environment variables: "USERDNSDOMAIN" Process "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" (UID: 00000000-00004280) was launched with new environment variables: "USERDNSDOMAIN="%OSUSER%-PC"" Process "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" (UID: 00000000-00004280) was launched with modified environment variables: "NUMBER_OF_PROCESSORS" Process "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" (UID: 00000000-00004244) was launched with modified environment variables: "NUMBER_OF_PROCESSORS" Process "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" (UID: 00000000-00004244) was launched with missing environment variables: "USERDNSDOMAIN" Process "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" (UID: 00000000-00004144) was launched with new environment variables: "USERDNSDOMAIN="%OSUSER%-PC"" Process "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" (UID: 00000000-00004144) was launched with modified environment variables: "NUMBER_OF_PROCESSORS"46:Tdaf,Spawned process "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" (UID: 00000000-00003936) Spawned process "icacls.exe" with commandline "icacls "%LOCALAPPDATA%\\181e15e2-efce-4e8a-ade3-f867c1bd02fc" /d ..." (UID: 00000000-00002876) Spawned process "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" with commandline "--Admin IsNotAutoStart IsNotTask" (UID: 00000000-00002436) Spawned process "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" with commandline "--Admin IsNotAutoStart IsNotTask" (UID: 00000000-00002784) Spawned process "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" with commandline "--Task" (UID: 00000000-00003996) Spawned process "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" with commandline "--Task" (UID: 00000000-00001316) Spawned process "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" with commandline "--Task" (UID: 00000000-00003232) Spawned process "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" with commandline "--Task" (UID: 00000000-00001936) Spawned process "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" with commandline "--Task" (UID: 00000000-00004436) Spawned process "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" with commandline "--Task" (UID: 00000000-00002408) Spawned process "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" with commandline "--Task" (UID: 00000000-00002992) Spawned process "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" with commandline "--Task" (UID: 00000000-00004704) Spawned process "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" with commandline "--Task" (UID: 00000000-00002880) Spawned process "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" with commandline "--Task" (UID: 00000000-00001460) Spawned process "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" with commandline "--Task" (UID: 00000000-00005196) Spawned process "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" with commandline "--Task" (UID: 00000000-00004804) Spawned process "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" with commandline "--Task" (UID: 00000000-00005216) Spawned process "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" with commandline "--Task" (UID: 00000000-00005256) Spawned process "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" with commandline "--Task" (UID: 00000000-00003216) Spawned process "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" with commandline "--Task" (UID: 00000000-00005336) Spawned process "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" with commandline "--Task" (UID: 00000000-00005672) Spawned process "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" with commandline "--Task" (UID: 00000000-00005832) Spawned process "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" with commandline "--Task" (UID: 00000000-00005956) Spawned process "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" with commandline "--Task" (UID: 00000000-00006008) Spawned process "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" with commandline "--Task" (UID: 00000000-00006104)47:Tdaf,Spawned process "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" (UID: 00000000-00003936) Spawned process "icacls.exe" with commandline "icacls "%LOCALAPPDATA%\\181e15e2-efce-4e8a-ade3-f867c1bd02fc" /d ..." (UID: 00000000-00002876) Spawned process "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" with commandline "--Admin IsNotAutoStart IsNotTask" (UID: 00000000-00002436) Spawned process "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" with commandline "--Admin IsNotAutoStart IsNotTask" (UID: 00000000-00002784) Spawned process "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" with commandline "--Task" (UID: 00000000-00003996) Spawned process "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" with commandline "--Task" (UID: 00000000-00001316) Spawned process "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" with commandline "--Task" (UID: 00000000-00003232) Spawned process "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" with commandline "--Task" (UID: 00000000-00001936) Spawned process "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" with commandline "--Task" (UID: 00000000-00004436) Spawned process "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" with commandline "--Task" (UID: 00000000-00002408) Spawned process "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" with commandline "--Task" (UID: 00000000-00002992) Spawned process "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" with commandline "--Task" (UID: 00000000-00004704) Spawned process "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" with commandline "--Task" (UID: 00000000-00002880) Spawned process "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" with commandline "--Task" (UID: 00000000-00001460) Spawned process "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" with commandline "--Task" (UID: 00000000-00005196) Spawned process "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" with commandline "--Task" (UID: 00000000-00004804) Spawned process "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" with commandline "--Task" (UID: 00000000-00005216) Spawned process "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" with commandline "--Task" (UID: 00000000-00005256) Spawned process "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" with commandline "--Task" (UID: 00000000-00003216) Spawned process "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" with commandline "--Task" (UID: 00000000-00005336) Spawned process "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" with commandline "--Task" (UID: 00000000-00005672) Spawned process "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" with commandline "--Task" (UID: 00000000-00005832) Spawned process "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" with commandline "--Task" (UID: 00000000-00005956) Spawned process "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" with commandline "--Task" (UID: 00000000-00006008) Spawned process "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" with commandline "--Task" (UID: 00000000-00006104)48:T5b8,"fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" has type "PE32 executable for MS Windows 5.01 (GUI) Intel i386 7 sections"- Location: [%LOCALAPPDATA%\181e15e2-efce-4e8a-ade3-f867c1bd02fc\fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe]- [targetUID: 00000000-00003320] "8B2B9A00839EED1DFDCCC3BFC2F5DF12" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\8B2B9A00839EED1DFDCCC3BFC2F5DF12]- [targetUID: 00000000-00004280] "B46811C17859FFB409CF0E904A4AA8F8" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\B46811C17859FFB409CF0E904A4AA8F8]- [targetUID: 00000000-00004280] "geo_1_.json" has type "Unknown"- [targetUID: N/A] "70825F0EABF2526E540CA0F7C268D189" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\70825F0EABF2526E540CA0F7C268D189]- [targetUID: 00000000-00004280] "70825F0EABF2526E540CA0F7C268D189" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\MetaData\70825F0EABF2526E540CA0F7C268D189]- [targetUID: 00000000-00004280] "8B2B9A00839EED1DFDCCC3BFC2F5DF12" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\MetaData\8B2B9A00839EED1DFDCCC3BFC2F5DF12]- [targetUID: 00000000-00004280] "B46811C17859FFB409CF0E904A4AA8F8" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\MetaData\B46811C17859FFB409CF0E904A4AA8F8]- [targetUID: 00000000-00004280]49:Tad2,"fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\SIDEBYSIDE"; Key: ""; Value: "") "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\DIAGNOSTICS"; Key: ""; Value: "") "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE"; Key: ""; Value: "") "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE\TRACING"; Key: ""; Value: "") "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\OLEAUT"; Key: ""; Value: "") "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: ""; Value: "") "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SAFEBOOT\OPTION"; Key: ""; Value: "") "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SRP\GP\DLL"; Key: ""; Value: "") "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: ""; Value: "") "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\ERROR MESSAGE INSTRUMENT"; Key: ""; Value: "") "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\GRE_INITIALIZE"; Key: ""; Value: "") "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\COMPATIBILITY32"; Key: ""; Value: "") "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IME COMPATIBILITY"; Key: ""; Value: "") "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" (Access type: "OPEN"; Path: "HKLM"; Key: ""; Value: "")4a:Tf95,"fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\SIDEBYSIDE"; Key: "PREFEREXTERNALMANIFEST"; Value: "") "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE"; Key: "PAGEALLOCATORUSESYSTEMHEAP"; Value: "") "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE"; Key: "PAGEALLOCATORSYSTEMHEAPISPRIVATE"; Value: "") "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "CWDILLEGALINDLLSEARCH"; Value: "") "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED"; Value: "") "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: "COMPATDLL"; Value: "") "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: "00060101.00060101"; Value: "") "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: ""; Value: "") "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "SAFEDLLSEARCHMODE"; Value: "") "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\GRE_INITIALIZE"; Key: "DISABLEMETAFILES"; Value: "") "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\COMPATIBILITY32"; Key: "FC38866BC8B8CAB27E524E8592C185D3876460B3F3CDA7FE445276C0F4DFE336"; Value: "") "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINDOWS"; Key: "LOADAPPINIT_DLLS"; Value: "") "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US"; Value: "") "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US"; Value: "") "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED"; Value: "") "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\APPCOMPAT"; Key: "DISABLEENGINE"; Value: "") "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS"; Key: "DISABLELOCALOVERRIDE"; Value: "") "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP"; Key: "PREFERREDUILANGUAGES"; Value: "") "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP\MUICACHED"; Key: "MACHINEPREFERREDUILANGUAGES"; Value: "") "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\CONNECTIONS"; Key: "WINHTTPSETTINGS"; Value: "")4b:T57a,"fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" reads file "c:\fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" reads file "c:\windows\system32\icacls.exe" "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" reads file "c:\users\%osuser%\appdata\locallow\microsoft\cryptneturlcache\metadata\8b2b9a00839eed1dfdccc3bfc2f5df12" "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" reads file "c:\users\%osuser%\appdata\locallow\microsoft\cryptneturlcache\content\8b2b9a00839eed1dfdccc3bfc2f5df12" "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" reads file "c:\users\%osuser%\appdata\locallow\microsoft\cryptneturlcache\metadata\b46811c17859ffb409cf0e904a4aa8f8" "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" reads file "c:\users\%osuser%\appdata\locallow\microsoft\cryptneturlcache\content\b46811c17859ffb409cf0e904a4aa8f8" "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" reads file "c:\users\%osuser%\appdata\locallow\microsoft\cryptneturlcache\metadata\70825f0eabf2526e540ca0f7c268d189" "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" reads file "c:\users\%osuser%\appdata\locallow\microsoft\cryptneturlcache\content\70825f0eabf2526e540ca0f7c268d189"4c:Tb7f,"fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" trying to touch file "C:\WINHTTP.dll" "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" trying to touch file "C:\Windows\system32\WINHTTP.dll" "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" trying to touch file "C:\webio.dll" "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" trying to touch file "C:\Windows\system32\webio.dll" "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" trying to touch file "C:\Windows\system32\IMM32.DLL" "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" trying to touch file "C:\Windows\Temp\VxSSL32.dll" "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" trying to touch file "C:\FLTLIB.DLL" "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" trying to touch file "C:\Windows\system32\FLTLIB.DLL" "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" trying to touch file "C:\MSVCP140.dll" "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" trying to touch file "C:\Windows\system32\MSVCP140.dll" "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" trying to touch file "C:\VCRUNTIME140.dll" "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" trying to touch file "C:\Windows\system32\VCRUNTIME140.dll" "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" trying to touch file "C:\api-ms-win-crt-runtime-l1-1-0.dll" "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" trying to touch file "C:\Windows\system32\api-ms-win-crt-runtime-l1-1-0.dll" "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" trying to touch file "C:\ucrtbase.DLL" "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" trying to touch file "C:\Windows\system32\ucrtbase.DLL" "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" trying to touch file "C:\api-ms-win-core-timezone-l1-1-0.dll" "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" trying to touch file "C:\Windows\system32\api-ms-win-core-timezone-l1-1-0.dll" "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" trying to touch file "C:\api-ms-win-core-file-l2-1-0.dll" "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" trying to touch file "C:\Windows\system32\api-ms-win-core-file-l2-1-0.dll" "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" trying to touch file "C:\api-ms-win-core-localization-l1-2-0.dll" "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" trying to touch file "C:\Windows\system32\api-ms-win-core-localization-l1-2-0.dll" "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" trying to touch file "C:\api-ms-win-core-synch-l1-2-0.dll"4d:T721,"fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat" "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\Temporary Internet Files" "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" touched file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Cookies" "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\History" "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\Caches" "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" touched file "%LOCALAPPDATA%\Microsoft\Windows\Temporary Internet Files\counters.dat" "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" touched file "%LOCALAPPDATA%\Microsoft\Windows\Temporary Internet Files" "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" touched file "%APPDATA%\Microsoft\Windows\Cookies" "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" touched file "%LOCALAPPDATA%\Microsoft\Windows\History" "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" touched file "%LOCALAPPDATA%\Microsoft\Windows\Caches" "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\2UXTWTJR\geo[1].json" "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" touched file "%LOCALAPPDATA%\Microsoft\Windows\Temporary Internet Files\Content.IE5\2UXTWTJR\geo[1].json"4e:Td44,"fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" trying to access non-existent file "C:\WINHTTP.dll" "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" trying to access non-existent file "C:\webio.dll" "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" trying to access non-existent file "C:\FLTLIB.DLL" "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" trying to access non-existent file "C:\MSVCP140.dll" "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" trying to access non-existent file "C:\VCRUNTIME140.dll" "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" trying to access non-existent file "C:\api-ms-win-crt-runtime-l1-1-0.dll" "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" trying to access non-existent file "C:\ucrtbase.DLL" "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" trying to access non-existent file "C:\api-ms-win-core-timezone-l1-1-0.dll" "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" trying to access non-existent file "C:\api-ms-win-core-file-l2-1-0.dll" "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" trying to access non-existent file "C:\api-ms-win-core-localization-l1-2-0.dll" "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" trying to access non-existent file "C:\api-ms-win-core-synch-l1-2-0.dll" "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" trying to access non-existent file "C:\api-ms-win-core-processthreads-l1-1-1.dll" "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" trying to access non-existent file "C:\api-ms-win-core-file-l1-2-0.dll" "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" trying to access non-existent file "C:\api-ms-win-crt-heap-l1-1-0.dll" "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" trying to access non-existent file "C:\api-ms-win-crt-string-l1-1-0.dll" "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" trying to access non-existent file "C:\api-ms-win-crt-stdio-l1-1-0.dll" "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" trying to access non-existent file "C:\api-ms-win-crt-convert-l1-1-0.dll" "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" trying to access non-existent file "C:\api-ms-win-crt-locale-l1-1-0.dll" "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" trying to access non-existent file "C:\api-ms-win-crt-filesystem-l1-1-0.dll" "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" trying to access non-existent file "C:\api-ms-win-crt-time-l1-1-0.dll" "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" trying to access non-existent file "C:\api-ms-win-crt-environment-l1-1-0.dll" "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" trying to access non-existent file "C:\api-ms-win-crt-math-l1-1-0.dll" "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" trying to access non-existent file "C:\api-ms-win-crt-utility-l1-1-0.dll" "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" trying to access non-existent file "C:\Windows\system32\api-ms-win-core-fibers-l1-1-1.DLL"4f:T66a,"fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" trying to access non-existent file "C:\apfHQ" "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" trying to access non-existent file "C:\APFHQ" "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" trying to access non-existent file "C:\fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe.Local\" "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" trying to access non-existent file "C:\fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe:Zone.Identifier" "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" trying to access non-existent file "C:\FC38866BC8B8CAB27E524E8592C185D3876460B3F3CDA7FE445276C0F4DFE336.EXE.LOCAL" "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8B2B9A00839EED1DFDCCC3BFC2F5DF12" "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B46811C17859FFB409CF0E904A4AA8F8" "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\70825F0EABF2526E540CA0F7C268D189" "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" trying to access non-existent file "C:\fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe:ZONE.IDENTIFIER"50:T492,"fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" writes file "c:\users\%osuser%\appdata\local\181e15e2-efce-4e8a-ade3-f867c1bd02fc\fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" writes file "c:\users\%osuser%\appdata\locallow\microsoft\cryptneturlcache\metadata\8b2b9a00839eed1dfdccc3bfc2f5df12" "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" writes file "c:\users\%osuser%\appdata\locallow\microsoft\cryptneturlcache\metadata\70825f0eabf2526e540ca0f7c268d189" "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" writes file "c:\users\%osuser%\appdata\locallow\microsoft\cryptneturlcache\content\8b2b9a00839eed1dfdccc3bfc2f5df12" "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" writes file "c:\users\%osuser%\appdata\locallow\microsoft\cryptneturlcache\content\70825f0eabf2526e540ca0f7c268d189" "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336.exe" writes file "c:\users\%osuser%\appdata\locallow\microsoft\cryptneturlcache\metadata\b46811c17859ffb409cf0e904a4aa8f8"51:Tef8,Found reference to API "WinHttpOpen" (Indicator: "WinHttpOpen"; File: "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336") Found reference to API "WSAStartup" (Indicator: "WSAStartup"; File: "00000000-00003936.00000001.81096.00400000.00000040.mdmp") Found reference to API "InternetOpenW" (Indicator: "InternetOpen"; File: "00000000-00003936.00000001.81096.00400000.00000040.mdmp") Found reference to API "InternetOpenUrlW" (Indicator: "InternetOpen"; File: "00000000-00003936.00000001.81096.00400000.00000040.mdmp") Found reference to API "InternetReadFile" (Indicator: "InternetReadFile"; File: "00000000-00003936.00000001.81096.00400000.00000040.mdmp") Found reference to API "InternetOpenUrlA" (Indicator: "InternetOpen"; File: "00000000-00003936.00000001.81096.00400000.00000040.mdmp") Found reference to API "HttpQueryInfoW" (Indicator: "HttpQueryInfo"; File: "00000000-00003936.00000001.81096.00400000.00000040.mdmp") Found reference to API "InternetOpenA" (Indicator: "InternetOpen"; File: "00000000-00003936.00000001.81096.00400000.00000040.mdmp") Found reference to API "WSASend" (Indicator: "WSASend"; Source: "00000000-00003936-00000C2C-262596173") Found reference to API "WSARecv" (Indicator: "WSARecv"; Source: "00000000-00003936-00000C2C-262596556") Found reference to API "WinHttpConnect" (Indicator: "WinHttpConnect"; Source: "00000000-00003936-00000C2C-270052148") Found reference to API "WinHttpOpenRequest" (Indicator: "HttpOpenRequest"; Source: "00000000-00003936-00000C2C-270052374") Found reference to API "WinHttpOpenRequest" (Indicator: "WinHttpOpen"; Source: "00000000-00003936-00000C2C-270052374") Found reference to API "WinHttpOpenRequest" (Indicator: "WinHttpOpenRequest"; Source: "00000000-00003936-00000C2C-270052374") Found reference to API "WinHttpSendRequest" (Indicator: "HttpSendRequest"; Source: "00000000-00003936-00000C2C-273632027") Found reference to API "WinHttpSendRequest" (Indicator: "WinHttpSendRequest"; Source: "00000000-00003936-00000C2C-273632027") Found reference to API "WinHttpQueryHeaders" (Indicator: "WinHttpQueryHeaders"; Source: "00000000-00003936-00000C2C-274260613") Found reference to API "WinHttpReadData" (Indicator: "WinHttpReadData"; Source: "00000000-00003936-00000C2C-274261012") Found reference to API "WSAStartup" (Indicator: "WSAStartup"; Source: "00000000-00001260.00000000.90318.00400000.00000040.mdmp, 00000000-00001260.00000001.91374.00400000.00000040.mdmp") Found reference to API "InternetOpenW" (Indicator: "InternetOpen"; Source: "00000000-00001260.00000000.90318.00400000.00000040.mdmp, 00000000-00001260.00000001.91374.00400000.00000040.mdmp") Found reference to API "InternetOpenUrlW" (Indicator: "InternetOpen"; Source: "00000000-00001260.00000000.90318.00400000.00000040.mdmp, 00000000-00001260.00000001.91374.00400000.00000040.mdmp") Found reference to API "InternetReadFile" (Indicator: "InternetReadFile"; Source: "00000000-00001260.00000000.90318.00400000.00000040.mdmp, 00000000-00001260.00000001.91374.00400000.00000040.mdmp") Found reference to API "InternetOpenUrlA" (Indicator: "InternetOpen"; Source: "00000000-00001260.00000000.90318.00400000.00000040.mdmp, 00000000-00001260.00000001.91374.00400000.00000040.mdmp") Found reference to API "HttpQueryInfoW" (Indicator: "HttpQueryInfo"; Source: "00000000-00001260.00000000.90318.00400000.00000040.mdmp, 00000000-00001260.00000001.91374.00400000.00000040.mdmp") Found reference to API "InternetOpenA" (Indicator: "InternetOpen"; Source: "00000000-00001260.00000000.90318.00400000.00000040.mdmp, 00000000-00001260.00000001.91374.00400000.00000040.mdmp") Found reference to API "4581520,3372,3237,,InternetReadFile,Wininet.dll,"252:34:13.913",RX=0,PX=0" (Indicator: "InternetReadFile"; Source: "00000000-00001260.00000001.91374.0022C000.00000004.mdmp")52:T68b,Found string "C:\Build-OpenSSL-VC-32/lib/engines" (Indicator: "openssl-"; File: "00000000-00003936.00000001.81096.00400000.00000040.mdmp") Found string "C:\Build-OpenSSL-VC-32/ssl/private" (Indicator: "openssl-"; File: "00000000-00003936.00000001.81096.00400000.00000040.mdmp") Found string "C:\Build-OpenSSL-VC-32/ssl" (Indicator: "openssl-"; File: "00000000-00003936.00000001.81096.00400000.00000040.mdmp") Found string "C:\Build-OpenSSL-VC-32/ssl/certs" (Indicator: "openssl-"; File: "00000000-00003936.00000001.81096.00400000.00000040.mdmp") Found string "C:\Build-OpenSSL-VC-32/ssl/cert.pem" (Indicator: "openssl-"; File: "00000000-00003936.00000001.81096.00400000.00000040.mdmp") Found string "C:\Build-OpenSSL-VC-32/lib/engines" (Indicator: "openssl-"; Source: "00000000-00001260.00000000.90318.00400000.00000040.mdmp, 00000000-00001260.00000001.91374.00400000.00000040.mdmp") Found string "C:\Build-OpenSSL-VC-32/ssl/private" (Indicator: "openssl-"; Source: "00000000-00001260.00000000.90318.00400000.00000040.mdmp, 00000000-00001260.00000001.91374.00400000.00000040.mdmp") Found string "C:\Build-OpenSSL-VC-32/ssl" (Indicator: "openssl-"; Source: "00000000-00001260.00000000.90318.00400000.00000040.mdmp, 00000000-00001260.00000001.91374.00400000.00000040.mdmp") Found string "C:\Build-OpenSSL-VC-32/ssl/certs" (Indicator: "openssl-"; Source: "00000000-00001260.00000000.90318.00400000.00000040.mdmp, 00000000-00001260.00000001.91374.00400000.00000040.mdmp") Found string "C:\Build-OpenSSL-VC-32/ssl/cert.pem" (Indicator: "openssl-"; Source: "00000000-00001260.00000000.90318.00400000.00000040.mdmp, 00000000-00001260.00000001.91374.00400000.00000040.mdmp")53:T51e,Found reference to API "InternetOpenW" (Indicator: "InternetOpen"; File: "00000000-00003936.00000001.81096.00400000.00000040.mdmp") Found reference to API "InternetOpenUrlW" (Indicator: "InternetOpen"; File: "00000000-00003936.00000001.81096.00400000.00000040.mdmp") Found reference to API "InternetOpenUrlA" (Indicator: "InternetOpen"; File: "00000000-00003936.00000001.81096.00400000.00000040.mdmp") Found reference to API "InternetOpenA" (Indicator: "InternetOpen"; File: "00000000-00003936.00000001.81096.00400000.00000040.mdmp") Found reference to API "InternetOpenW" (Indicator: "InternetOpen"; Source: "00000000-00001260.00000000.90318.00400000.00000040.mdmp, 00000000-00001260.00000001.91374.00400000.00000040.mdmp") Found reference to API "InternetOpenUrlW" (Indicator: "InternetOpen"; Source: "00000000-00001260.00000000.90318.00400000.00000040.mdmp, 00000000-00001260.00000001.91374.00400000.00000040.mdmp") Found reference to API "InternetOpenUrlA" (Indicator: "InternetOpen"; Source: "00000000-00001260.00000000.90318.00400000.00000040.mdmp, 00000000-00001260.00000001.91374.00400000.00000040.mdmp") Found reference to API "InternetOpenA" (Indicator: "InternetOpen"; Source: "00000000-00001260.00000000.90318.00400000.00000040.mdmp, 00000000-00001260.00000001.91374.00400000.00000040.mdmp")54:T106b,Found reference to API "WSAstartup" (Indicator: "wsastartup"; File: "00000000-00003936.00000001.81096.00400000.00000040.mdmp") Found reference to API "gethostbyname" (Indicator: "gethostbyname"; File: "00000000-00003936.00000001.81096.00400000.00000040.mdmp") Found reference to API "BIO_gethostbyname" (Indicator: "gethostbyname"; File: "00000000-00003936.00000001.81096.00400000.00000040.mdmp") Found reference to API "WSASTARTUP" (Indicator: "wsastartup"; File: "00000000-00003936.00000001.81096.00400000.00000040.mdmp") Found reference to API "error setting nbio on accept socket" (Indicator: " accept "; File: "00000000-00003936.00000001.81096.00400000.00000040.mdmp") Found reference to API "gethostbyname addr is not af inet" (Indicator: "gethostbyname"; File: "00000000-00003936.00000001.81096.00400000.00000040.mdmp") Found reference to API "nbio connect error" (Indicator: " connect "; File: "00000000-00003936.00000001.81096.00400000.00000040.mdmp") Found reference to API "no accept port specified" (Indicator: " accept "; File: "00000000-00003936.00000001.81096.00400000.00000040.mdmp") Found reference to API "unable to bind socket" (Indicator: " bind "; File: "00000000-00003936.00000001.81096.00400000.00000040.mdmp") Found reference to API "unable to listen socket" (Indicator: " listen "; File: "00000000-00003936.00000001.81096.00400000.00000040.mdmp") Found reference to API "WSAStartup" (Indicator: "wsastartup"; File: "00000000-00003936.00000001.81096.00400000.00000040.mdmp") Found reference to API "could not bind to the requested symbol name" (Indicator: " bind "; File: "00000000-00003936.00000001.81096.00400000.00000040.mdmp") Found reference to API "WSAstartup" (Indicator: "wsastartup"; Source: "00000000-00001260.00000000.90318.00400000.00000040.mdmp, 00000000-00001260.00000001.91374.00400000.00000040.mdmp") Found reference to API "gethostbyname" (Indicator: "gethostbyname"; Source: "00000000-00001260.00000000.90318.00400000.00000040.mdmp, 00000000-00001260.00000001.91374.00400000.00000040.mdmp") Found reference to API "BIO_gethostbyname" (Indicator: "gethostbyname"; Source: "00000000-00001260.00000000.90318.00400000.00000040.mdmp, 00000000-00001260.00000001.91374.00400000.00000040.mdmp") Found reference to API "WSASTARTUP" (Indicator: "wsastartup"; Source: "00000000-00001260.00000000.90318.00400000.00000040.mdmp, 00000000-00001260.00000001.91374.00400000.00000040.mdmp") Found reference to API "error setting nbio on accept socket" (Indicator: " accept "; Source: "00000000-00001260.00000000.90318.00400000.00000040.mdmp, 00000000-00001260.00000001.91374.00400000.00000040.mdmp") Found reference to API "gethostbyname addr is not af inet" (Indicator: "gethostbyname"; Source: "00000000-00001260.00000000.90318.00400000.00000040.mdmp, 00000000-00001260.00000001.91374.00400000.00000040.mdmp") Found reference to API "nbio connect error" (Indicator: " connect "; Source: "00000000-00001260.00000000.90318.00400000.00000040.mdmp, 00000000-00001260.00000001.91374.00400000.00000040.mdmp") Found reference to API "no accept port specified" (Indicator: " accept "; Source: "00000000-00001260.00000000.90318.00400000.00000040.mdmp, 00000000-00001260.00000001.91374.00400000.00000040.mdmp") Found reference to API "unable to bind socket" (Indicator: " bind "; Source: "00000000-00001260.00000000.90318.00400000.00000040.mdmp, 00000000-00001260.00000001.91374.00400000.00000040.mdmp") Found reference to API "unable to listen socket" (Indicator: " listen "; Source: "00000000-00001260.00000000.90318.00400000.00000040.mdmp, 00000000-00001260.00000001.91374.00400000.00000040.mdmp") Found reference to API "WSAStartup" (Indicator: "wsastartup"; Source: "00000000-00001260.00000000.90318.00400000.00000040.mdmp, 00000000-00001260.00000001.91374.00400000.00000040.mdmp") Found reference to API "could not bind to the requested symbol name" (Indicator: " bind "; Source: "00000000-00001260.00000000.90318.00400000.00000040.mdmp, 00000000-00001260.00000001.91374.00400000.00000040.mdmp") Found reference to API "AUTHUI.DLL: Shutdown Choices Message Window" (Indicator: " shutdown "; Source: "00000000-00001260.00000000.90318.008D0000.00000002.mdmp")55:T29b4,"GET /geo.json HTTP/1.1User-Agent: Microsoft Internet ExplorerHost: api.2ip.ua" "HTTP/1.1 200 OKDate: Wed, 16 Sep 2026 09:54:28 GMTContent-Type: application/jsonTransfer-Encoding: chunkedConnection: keep-alivestrict-transport-security: max-age=63072000; preloadx-frame-options: SAMEORIGINx-content-type-options: nosniffx-xss-protection: 1; mode=block; report=...access-control-allow-origin: *access-control-allow-methods: POST, GET, PUT, OPTIONS, PATCH, DELETEaccess-control-allow-headers: X-Accept-Charset,X-Accept,Content-TypeServer: cloudflarecf-cache-status: DYNAMICServer-Timing: cfCacheStatus;desc="DYNAMIC"Server-Timing: cfEdge;dur=7,cfOrigin;dur=435Report-To: {"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=eVbzj18FpVxKT9HemJHEL3pMLABmi3yDISPpz%2FPSwUpSNrd%2BVUlP9J9snc39j1w4zZFqKA5kcOHb7Zbi8qNpdh4t70%2FYaCroQOkOwzwFNLXFoXglHgldxYN%2F8xGs"}]}Nel: {"report_to":"cf-nel","success_fraction":0.0,"max_age":604800}CF-RAY: a3befd702d2a8acf-SJCalt-svc: h3=":443"; ma=8640021a{"ip":"64.124.12.162","country_code":"US","country":"United states of america","country_rus":"\u0421\u0428\u0410","country_ua":"\u0421\u0428\u0410","region":"California","region_rus":"\u041a\u0430\u043b\u0438\u0444\u043e\u0440\u043d\u0438\u044f","region_ua":"\u041a\u0430\u043b\u0456\u0444\u043e\u0440\u043d\u0456\u044f","city":"Santa clara","city_rus":"\u0421\u0430\u043d\u0442\", "HTTP/1.1 429 Too Many RequestsDate: Wed 16 Sep 2026 09:54:44 GMTContent-Type: text/html; charset=UTF-8Transfer-Encoding: chunkedConnection: keep-alivestrict-transport-security: max-age=63072000; preloadx-frame-options: SAMEORIGINx-content-type-options: nosniffx-xss-protection: 1; mode=block; report=...access-control-allow-origin: *access-control-allow-methods: POST GET PUT OPTIONS PATCH DELETEaccess-control-allow-headers: X-Accept-Charset X-Accept Content-TypeServer: cloudflarecf-cache-status: DYNAMICServer-Timing: cfCacheStatus;desc="DYNAMIC"Server-Timing: cfEdge;dur=7 cfOrigin;dur=463Report-To: {"group":"cf-nel" "max_age":604800 "endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=WLyl5%2FxAjjh%2BYrfSh6DoAuMReAUIV9kh2EjNnN%2FM1B1Hhqtxuiz50W9hezN0OpTAsBwY%2BeqGBuxe%2F2%2FNezkurr%2BhVIucEM16kuiu%2BsI40oUOfX3RwMLGByMRY212"}]}Nel: {"report_to":"cf-nel" "success_fraction":0.0 "max_age":604800}CF-RAY: a3befdcefcf4eb2a-SJCalt-svc: h3=":443"; ma=86400508

The limit of returned objects has been reached. For more information please contact by email [ema", "HTTP/1.1 429 Too Many RequestsDate: Wed 16 Sep 2026 09:55:08 GMTContent-Type: text/html; charset=UTF-8Transfer-Encoding: chunkedConnection: keep-alivestrict-transport-security: max-age=63072000; preloadx-frame-options: SAMEORIGINx-content-type-options: nosniffx-xss-protection: 1; mode=block; report=...access-control-allow-origin: *access-control-allow-methods: POST GET PUT OPTIONS PATCH DELETEaccess-control-allow-headers: X-Accept-Charset X-Accept Content-TypeServer: cloudflarecf-cache-status: DYNAMICServer-Timing: cfCacheStatus;desc="DYNAMIC"Server-Timing: cfEdge;dur=9 cfOrigin;dur=450Report-To: {"group":"cf-nel" "max_age":604800 "endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=voMFBd4oUHWxM3svPGhFwJhlEIVTRJWg9GwRTJ09iNOgkaj%2FEpuxYg5CVHXNVy1oWx0VL%2B7mkYDV%2FbXD%2B2SG8pzIfh30mp%2F73hApkaNxLtDr1gvqOB3zCqitLqN9"}]}Nel: {"report_to":"cf-nel" "success_fraction":0.0 "max_age":604800}CF-RAY: a3befe659b24c8bd-SJCalt-svc: h3=":443"; ma=86400508

The limit of returned objects has been reached. For more information please contact by email [email", "HTTP/1.1 429 Too Many RequestsDate: Wed 16 Sep 2026 09:55:21 GMTContent-Type: text/html; charset=UTF-8Transfer-Encoding: chunkedConnection: keep-alivestrict-transport-security: max-age=63072000; preloadx-frame-options: SAMEORIGINx-content-type-options: nosniffx-xss-protection: 1; mode=block; report=...access-control-allow-origin: *access-control-allow-methods: POST GET PUT OPTIONS PATCH DELETEaccess-control-allow-headers: X-Accept-Charset X-Accept Content-TypeServer: cloudflarecf-cache-status: DYNAMICServer-Timing: cfCacheStatus;desc="DYNAMIC"Server-Timing: cfEdge;dur=9 cfOrigin;dur=404Report-To: {"group":"cf-nel" "max_age":604800 "endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=enyBtu0fCP1I8gO2ycYJK%2B9u9DMkL05TwMuLdcbH6f9MopKV%2Fcnl2f%2FHDVaDUQzpMjATdMLm0iUcAOgCJNni0bVQYsedzEL8EoxiHbZQPyh%2FftgSMTc0x5gniuzt"}]}Nel: {"report_to":"cf-nel" "success_fraction":0.0 "max_age":604800}CF-RAY: a3befeb6ea9eced7-SJCalt-svc: h3=":443"; ma=86400508

The limit of returned objects has been reached. For more information please contact by email [email ", "HTTP/1.1 429 Too Many RequestsDate: Wed 16 Sep 2026 09:55:39 GMTContent-Type: text/html; charset=UTF-8Transfer-Encoding: chunkedConnection: keep-alivestrict-transport-security: max-age=63072000; preloadx-frame-options: SAMEORIGINx-content-type-options: nosniffx-xss-protection: 1; mode=block; report=...access-control-allow-origin: *access-control-allow-methods: POST GET PUT OPTIONS PATCH DELETEaccess-control-allow-headers: X-Accept-Charset X-Accept Content-TypeServer: cloudflarecf-cache-status: DYNAMICServer-Timing: cfCacheStatus;desc="DYNAMIC"Server-Timing: cfEdge;dur=6 cfOrigin;dur=424Report-To: {"group":"cf-nel" "max_age":604800 "endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=R%2Blm7Vy33XTsxaUiWX3KKg6oruoZIzSQ8BaTUXoS9EFhBmTP8kTTJmBbpQJzbLxzQF5Z3o9eRcA9Bbz7xvcY9mVc5GLu6Z6tAnXE%2FNJYF0yjYoa2xgfkCoxVqiV2"}]}Nel: {"report_to":"cf-nel" "success_fraction":0.0 "max_age":604800}CF-RAY: a3beff284f11f005-SJCalt-svc: h3=":443"; ma=86400508

The limit of returned objects has been reached. For more information please contact by email [email prot", "HTTP/1.1 429 Too Many RequestsDate: Wed 16 Sep 2026 09:55:39 GMTContent-Type: text/html; charset=UTF-8Transfer-Encoding: chunkedConnection: keep-alivestrict-transport-security: max-age=63072000; preloadx-frame-options: SAMEORIGINx-content-type-options: nosniffx-xss-protection: 1; mode=block; report=...access-control-allow-origin: *access-control-allow-methods: POST GET PUT OPTIONS PATCH DELETEaccess-control-allow-headers: X-Accept-Charset X-Accept Content-TypeServer: cloudflarecf-cache-status: DYNAMICServer-Timing: cfCacheStatus;desc="DYNAMIC"Server-Timing: cfEdge;dur=8 cfOrigin;dur=456Report-To: {"group":"cf-nel" "max_age":604800 "endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=KstJzZzZM3uGrKMZBvf5sK8RE6ktr6If%2BIQwMmkn6t8npoi71DW0yDyMM6dDj9S6xTsfbaHQQuAuX95fwqcjvwHdYZJnmea%2FJVWyeAFOTAaYcRTyzNoa%2B1DUWOl8"}]}Nel: {"report_to":"cf-nel" "success_fraction":0.0 "max_age":604800}CF-RAY: a3beff27dbad60d0-SJCalt-svc: h3=":443"; ma=86400508

The limit of returned objects has been reached. For more information please contact by email [email pr", "HTTP/1.1 429 Too Many RequestsDate: Wed 16 Sep 2026 09:55:56 GMTContent-Type: text/html; charset=UTF-8Transfer-Encoding: chunkedConnection: keep-alivestrict-transport-security: max-age=63072000; preloadx-frame-options: SAMEORIGINx-content-type-options: nosniffx-xss-protection: 1; mode=block; report=...access-control-allow-origin: *access-control-allow-methods: POST GET PUT OPTIONS PATCH DELETEaccess-control-allow-headers: X-Accept-Charset X-Accept Content-TypeServer: cloudflarecf-cache-status: DYNAMICServer-Timing: cfCacheStatus;desc="DYNAMIC"Server-Timing: cfEdge;dur=10 cfOrigin;dur=425Report-To: {"group":"cf-nel" "max_age":604800 "endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=FTD9GhjpVVR86udAjyTZ9LcwZ2IZURwUqoRKKkBaig8RmrVF2vkMRpPuJc2HBBcSHLkK798ZQ9ASOBxYc1sqdGjP9xc32D%2FpPvgSI27vmm0mCIQWEzpnRn3PvpB7"}]}Nel: {"report_to":"cf-nel" "success_fraction":0.0 "max_age":604800}CF-RAY: a3beff948f5ecf31-SJCalt-svc: h3=":443"; ma=86400508

The limit of returned objects has been reached. For more information please contact by email [email prote", "HTTP/1.1 429 Too Many RequestsDate: Wed 16 Sep 2026 09:56:37 GMTContent-Type: text/html; charset=UTF-8Transfer-Encoding: chunkedConnection: keep-alivestrict-transport-security: max-age=63072000; preloadx-frame-options: SAMEORIGINx-content-type-options: nosniffx-xss-protection: 1; mode=block; report=...access-control-allow-origin: *access-control-allow-methods: POST GET PUT OPTIONS PATCH DELETEaccess-control-allow-headers: X-Accept-Charset X-Accept Content-TypeServer: cloudflarecf-cache-status: DYNAMICServer-Timing: cfCacheStatus;desc="DYNAMIC"Server-Timing: cfEdge;dur=4 cfOrigin;dur=414Report-To: {"group":"cf-nel" "max_age":604800 "endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=NAqxxnvSDlZPzEXbRq7od92oMy36WRF%2FNq484dFOqfdXSnE87ZORusKRot5t97D71ORZJAsLwKru2RXXQYr%2BVfad7eEsMKW%2B6ORISeXs8kdpQ7%2BANnyMaZv9ztvO"}]}Nel: {"report_to":"cf-nel" "success_fraction":0.0 "max_age":604800}CF-RAY: a3bf00943d775f13-SJCalt-svc: h3=":443"; ma=86400508