26:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js","/_next/static/chunks/1w1axrg6kzses.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/1kn_tf3p-ubex.js","/_next/static/chunks/1wq095nwqbaw1.js"],"SampleDetailWrapper"] 86:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js"],"IconMark"] 25:T477,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Trojan.DOMG Sample 3e40d42332c8… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 3e40d42332c8…. Malware family: Trojan.DOMG. Threat score 100/100. 1/27 AV engines flagged this file. 11 malicious and 20 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/3e40d42332c8d1600b75d65e22f4af7b05cb1ee53633fd9b0c112737de22cb2d","keywords":["Malicious","Trojan.DOMG","malware analysis","sandbox report","threat intelligence","3e40d42332c8d1600b75d65e22f4af7b05cb1ee53633fd9b0c112737de22cb2d"],"about":{"@type":"SoftwareApplication","name":"file.exe","applicationCategory":["peexe","executable"],"identifier":"3e40d42332c8d1600b75d65e22f4af7b05cb1ee53633fd9b0c112737de22cb2d","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Trojan.DOMG","antivirusDetections":{"malicious":1,"total":27},"behavioralIndicators":{"malicious":11,"suspicious":20},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}27:T13d9,Found reference to API "VirtualFree" (Indicator: "VirtualFree"; File: "3e40d42332c8d1600b75d65e22f4af7b05cb1ee53633fd9b0c112737de22cb2d.bin") Found reference to API "VirtualAlloc" (Indicator: "VirtualAlloc"; File: "3e40d42332c8d1600b75d65e22f4af7b05cb1ee53633fd9b0c112737de22cb2d.bin") Found reference to API "CreateThread" (Indicator: "CreateThread"; File: "3e40d42332c8d1600b75d65e22f4af7b05cb1ee53633fd9b0c112737de22cb2d.bin") Found reference to API "CreateThreadpoolWait" (Indicator: "CreateThread"; File: "3e40d42332c8d1600b75d65e22f4af7b05cb1ee53633fd9b0c112737de22cb2d.bin") Found reference to API "CreateThreadpoolWork" (Indicator: "CreateThread"; File: "3e40d42332c8d1600b75d65e22f4af7b05cb1ee53633fd9b0c112737de22cb2d.bin") Found reference to API "CreateThreadpoolTimer" (Indicator: "CreateThread"; File: "3e40d42332c8d1600b75d65e22f4af7b05cb1ee53633fd9b0c112737de22cb2d.bin") Found reference to API "VirtualFree" (Indicator: "VirtualFree"; Source: "00000000-00001892.00000000.139628.00706000.00000004.mdmp, 00000000-00001892.00000001.141547.00660000.00000004.mdmp, 00000000-00001892.00000001.141547.01164000.00000004.mdmp, 00000000-00001892.00000001.141547.048B0000.00000004.mdmp, 00000000-00001892.00000001.141547.04E10000.00000020.mdmp, 00000000-00001892.00000002.143468.00660000.00000004.mdmp, 00000000-00001892.00000002.143468.012FD000.00000002.mdmp, 00000000-00001892.00000002.143468.048E0000.00000002.mdmp, 00000000-00001892.00000002.143468.057C1000.00000004.mdmp, 00000000-00001892.00000002.143468.05E27000.00000004.mdmp, 00000000-00001892.00000002.143468.0A9D6000.00000002.mdmp") Found reference to API "WriteProcessMemory" (Indicator: "WriteProcessMemory"; Source: "00000000-00001892.00000000.139628.00706000.00000004.mdmp, 00000000-00001892.00000001.141547.00660000.00000004.mdmp, 00000000-00001892.00000001.141547.01164000.00000004.mdmp, 00000000-00001892.00000001.141547.048B0000.00000004.mdmp, 00000000-00001892.00000001.141547.04E10000.00000020.mdmp, 00000000-00001892.00000002.143468.00660000.00000004.mdmp, 00000000-00001892.00000002.143468.048E0000.00000002.mdmp, 00000000-00001892.00000002.143468.057C1000.00000004.mdmp, 00000000-00001892.00000002.143468.0A9D6000.00000002.mdmp") Found reference to API "VirtualAllocEx" (Indicator: "VirtualAlloc"; Source: "00000000-00001892.00000000.139628.00706000.00000004.mdmp, 00000000-00001892.00000001.141547.00660000.00000004.mdmp, 00000000-00001892.00000001.141547.01164000.00000004.mdmp, 00000000-00001892.00000001.141547.048B0000.00000004.mdmp, 00000000-00001892.00000001.141547.04E10000.00000020.mdmp, 00000000-00001892.00000002.143468.00660000.00000004.mdmp, 00000000-00001892.00000002.143468.048E0000.00000002.mdmp, 00000000-00001892.00000002.143468.057C1000.00000004.mdmp, 00000000-00001892.00000002.143468.0A9D6000.00000002.mdmp") Found reference to API "VirtualAllocEx" (Indicator: "VirtualAllocEx"; Source: "00000000-00001892.00000000.139628.00706000.00000004.mdmp, 00000000-00001892.00000001.141547.00660000.00000004.mdmp, 00000000-00001892.00000001.141547.01164000.00000004.mdmp, 00000000-00001892.00000001.141547.048B0000.00000004.mdmp, 00000000-00001892.00000001.141547.04E10000.00000020.mdmp, 00000000-00001892.00000002.143468.00660000.00000004.mdmp, 00000000-00001892.00000002.143468.048E0000.00000002.mdmp, 00000000-00001892.00000002.143468.057C1000.00000004.mdmp, 00000000-00001892.00000002.143468.0A9D6000.00000002.mdmp") Found reference to API "VirtualAlloc" (Indicator: "VirtualAlloc"; Source: "00000000-00001892.00000000.139628.00706000.00000004.mdmp, 00000000-00001892.00000001.141547.00660000.00000004.mdmp, 00000000-00001892.00000001.141547.01164000.00000004.mdmp, 00000000-00001892.00000001.141547.048B0000.00000004.mdmp, 00000000-00001892.00000001.141547.04E10000.00000020.mdmp, 00000000-00001892.00000002.143468.00660000.00000004.mdmp, 00000000-00001892.00000002.143468.012FD000.00000002.mdmp, 00000000-00001892.00000002.143468.048E0000.00000002.mdmp, 00000000-00001892.00000002.143468.057C1000.00000004.mdmp, 00000000-00001892.00000002.143468.05E27000.00000004.mdmp, 00000000-00001892.00000002.143468.0A9D6000.00000002.mdmp") Found reference to API "CreateThread" (Indicator: "CreateThread"; Source: "00000000-00001892.00000000.139628.00706000.00000004.mdmp, 00000000-00001892.00000000.139628.72611000.00000040.mdmp, 00000000-00001892.00000001.141547.00660000.00000004.mdmp, 00000000-00001892.00000001.141547.01164000.00000004.mdmp, 00000000-00001892.00000001.141547.048B0000.00000004.mdmp, 00000000-00001892.00000001.141547.04E10000.00000020.mdmp, 00000000-00001892.00000001.141547.72611000.00000040.mdmp, 00000000-00001892.00000002.143468.00660000.00000004.mdmp, 00000000-00001892.00000002.143468.012FD000.00000002.mdmp, 00000000-00001892.00000002.143468.048E0000.00000002.mdmp, 00000000-00001892.00000002.143468.04A5D000.00000002.mdmp, 00000000-00001892.00000002.143468.057C1000.00000004.mdmp, 00000000-00001892.00000002.143468.05E27000.00000004.mdmp, 00000000-00001892.00000002.143468.05F27000.00000002.mdmp, 00000000-00001892.00000002.143468.0A9D6000.00000002.mdmp")28:Ta5f,Found reference to API "OpenThreadToken" (Indicator: "OpenThread"; File: "3e40d42332c8d1600b75d65e22f4af7b05cb1ee53633fd9b0c112737de22cb2d.bin") Found reference to API "ResumeThread" (Indicator: "ResumeThread"; File: "3e40d42332c8d1600b75d65e22f4af7b05cb1ee53633fd9b0c112737de22cb2d.bin") Found reference to API "SuspendThread" (Indicator: "SuspendThread"; File: "3e40d42332c8d1600b75d65e22f4af7b05cb1ee53633fd9b0c112737de22cb2d.bin") Found reference to API "ResumeThread" (Indicator: "ResumeThread"; Source: "00000000-00001892.00000000.139628.00706000.00000004.mdmp, 00000000-00001892.00000000.139628.72611000.00000040.mdmp, 00000000-00001892.00000001.141547.00660000.00000004.mdmp, 00000000-00001892.00000001.141547.01164000.00000004.mdmp, 00000000-00001892.00000001.141547.048B0000.00000004.mdmp, 00000000-00001892.00000001.141547.04E10000.00000020.mdmp, 00000000-00001892.00000001.141547.72611000.00000040.mdmp, 00000000-00001892.00000002.143468.00660000.00000004.mdmp, 00000000-00001892.00000002.143468.048E0000.00000002.mdmp, 00000000-00001892.00000002.143468.057C1000.00000004.mdmp, 00000000-00001892.00000002.143468.05E27000.00000004.mdmp, 00000000-00001892.00000002.143468.0A9D6000.00000002.mdmp") Found reference to API "SetThreadContext" (Indicator: "SetThreadContext"; Source: "00000000-00001892.00000000.139628.00706000.00000004.mdmp, 00000000-00001892.00000000.139628.72611000.00000040.mdmp, 00000000-00001892.00000001.141547.00660000.00000004.mdmp, 00000000-00001892.00000001.141547.01164000.00000004.mdmp, 00000000-00001892.00000001.141547.048B0000.00000004.mdmp, 00000000-00001892.00000001.141547.04E10000.00000020.mdmp, 00000000-00001892.00000001.141547.72611000.00000040.mdmp, 00000000-00001892.00000002.143468.00660000.00000004.mdmp, 00000000-00001892.00000002.143468.048E0000.00000002.mdmp, 00000000-00001892.00000002.143468.057C1000.00000004.mdmp, 00000000-00001892.00000002.143468.0A9D6000.00000002.mdmp") Found reference to API "GetThreadContext" (Indicator: "GetThreadContext"; Source: "00000000-00001892.00000000.139628.00706000.00000004.mdmp, 00000000-00001892.00000000.139628.72611000.00000040.mdmp, 00000000-00001892.00000001.141547.00660000.00000004.mdmp, 00000000-00001892.00000001.141547.01164000.00000004.mdmp, 00000000-00001892.00000001.141547.048B0000.00000004.mdmp, 00000000-00001892.00000001.141547.04E10000.00000020.mdmp, 00000000-00001892.00000001.141547.72611000.00000040.mdmp, 00000000-00001892.00000002.143468.00660000.00000004.mdmp, 00000000-00001892.00000002.143468.048E0000.00000002.mdmp, 00000000-00001892.00000002.143468.057C1000.00000004.mdmp, 00000000-00001892.00000002.143468.0A9D6000.00000002.mdmp")29:T1321,Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; File: "3e40d42332c8d1600b75d65e22f4af7b05cb1ee53633fd9b0c112737de22cb2d.bin") Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; File: "3e40d42332c8d1600b75d65e22f4af7b05cb1ee53633fd9b0c112737de22cb2d.bin") Found reference to API "QueryPerformanceFrequency" (Indicator: "QueryPerformanceFrequency"; File: "3e40d42332c8d1600b75d65e22f4af7b05cb1ee53633fd9b0c112737de22cb2d.bin") Found reference to API "MsgWaitForMultipleObjects" (Indicator: "WaitForMultipleObjects"; File: "3e40d42332c8d1600b75d65e22f4af7b05cb1ee53633fd9b0c112737de22cb2d.bin") Found reference to API "GetTickCount64" (Indicator: "GetTickCount64"; File: "3e40d42332c8d1600b75d65e22f4af7b05cb1ee53633fd9b0c112737de22cb2d.bin") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; File: "3e40d42332c8d1600b75d65e22f4af7b05cb1ee53633fd9b0c112737de22cb2d.bin") Found reference to API "WaitForMultipleObjectsEx" (Indicator: "WaitForMultipleObjects"; File: "3e40d42332c8d1600b75d65e22f4af7b05cb1ee53633fd9b0c112737de22cb2d.bin") Found reference to API "WaitForMultipleObjectsEx" (Indicator: "WaitForMultipleObjectsEx"; File: "3e40d42332c8d1600b75d65e22f4af7b05cb1ee53633fd9b0c112737de22cb2d.bin") Found reference to API "MsgWaitForMultipleObjectsEx" (Indicator: "WaitForMultipleObjects"; File: "3e40d42332c8d1600b75d65e22f4af7b05cb1ee53633fd9b0c112737de22cb2d.bin") Found reference to API "MsgWaitForMultipleObjectsEx" (Indicator: "WaitForMultipleObjectsEx"; File: "3e40d42332c8d1600b75d65e22f4af7b05cb1ee53633fd9b0c112737de22cb2d.bin") Found reference to API "SetTimer" (Indicator: "SetTimer"; File: "3e40d42332c8d1600b75d65e22f4af7b05cb1ee53633fd9b0c112737de22cb2d.bin") Found reference to API "WaitForMultipleObjects" (Indicator: "WaitForMultipleObjects"; File: "3e40d42332c8d1600b75d65e22f4af7b05cb1ee53633fd9b0c112737de22cb2d.bin") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObject"; File: "3e40d42332c8d1600b75d65e22f4af7b05cb1ee53633fd9b0c112737de22cb2d.bin") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObjectEx"; File: "3e40d42332c8d1600b75d65e22f4af7b05cb1ee53633fd9b0c112737de22cb2d.bin") Found reference to API "SetTimer" (Indicator: "SetTimer"; Source: "00000000-00000672.00000000.139168.012A4000.00000004.mdmp") Found reference to API "SetTimer" (Indicator: "SetTimer"; Source: "00000000-00001560.00000000.139404.00C04000.00000004.mdmp") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; Source: "00000000-00001560.00000000.139404.010EB000.00000004.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00001560.00000000.139404.010EB000.00000004.mdmp") Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; Source: "00000000-00001892.00000000.139628.00706000.00000004.mdmp, 00000000-00001892.00000000.139628.72611000.00000040.mdmp, 00000000-00001892.00000001.141547.00660000.00000004.mdmp, 00000000-00001892.00000001.141547.01164000.00000004.mdmp, 00000000-00001892.00000001.141547.048B0000.00000004.mdmp, 00000000-00001892.00000001.141547.04E10000.00000020.mdmp, 00000000-00001892.00000001.141547.72611000.00000040.mdmp, 00000000-00001892.00000002.143468.00660000.00000004.mdmp, 00000000-00001892.00000002.143468.012FD000.00000002.mdmp, 00000000-00001892.00000002.143468.048E0000.00000002.mdmp, 00000000-00001892.00000002.143468.057C1000.00000004.mdmp, 00000000-00001892.00000002.143468.05E27000.00000004.mdmp, 00000000-00001892.00000002.143468.05F27000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00001892.00000000.139628.00706000.00000004.mdmp, 00000000-00001892.00000000.139628.72611000.00000040.mdmp, 00000000-00001892.00000001.141547.00660000.00000004.mdmp, 00000000-00001892.00000001.141547.01164000.00000004.mdmp, 00000000-00001892.00000001.141547.048B0000.00000004.mdmp, 00000000-00001892.00000001.141547.04E10000.00000020.mdmp, 00000000-00001892.00000001.141547.0A654000.00000002.mdmp, 00000000-00001892.00000001.141547.72611000.00000040.mdmp, 00000000-00001892.00000002.143468.00660000.00000004.mdmp, 00000000-00001892.00000002.143468.012FD000.00000002.mdmp, 00000000-00001892.00000002.143468.048E0000.00000002.mdmp, 00000000-00001892.00000002.143468.04A5D000.00000002.mdmp, 00000000-00001892.00000002.143468.057C1000.00000004.mdmp, 00000000-00001892.00000002.143468.05E27000.00000004.mdmp, 00000000-00001892.00000002.143468.05F27000.00000002.mdmp, 00000000-00001892.00000002.143468.0A9D6000.00000002.mdmp, 00000000-00001892.00000002.143468.728E2000.00000002.mdmp, 00000000-00001892.00000002.143468.72956000.00000002.mdmp, 00000000-00001892.00000002.143468.729A1000.00000002.mdmp")2a:Tbff,Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; File: "3e40d42332c8d1600b75d65e22f4af7b05cb1ee53633fd9b0c112737de22cb2d.bin") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; File: "3e40d42332c8d1600b75d65e22f4af7b05cb1ee53633fd9b0c112737de22cb2d.bin") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; File: "3e40d42332c8d1600b75d65e22f4af7b05cb1ee53633fd9b0c112737de22cb2d.bin") Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; File: "3e40d42332c8d1600b75d65e22f4af7b05cb1ee53633fd9b0c112737de22cb2d.bin") Found reference to API "FreeLibraryWhenCallbackReturns" (Indicator: "FreeLibrary"; File: "3e40d42332c8d1600b75d65e22f4af7b05cb1ee53633fd9b0c112737de22cb2d.bin") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; Source: "00000000-00001560.00000000.139404.010EB000.00000004.mdmp") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; Source: "00000000-00001560.00000000.139404.010EB000.00000004.mdmp") Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; Source: "00000000-00001892.00000000.139628.00660000.00000004.mdmp, 00000000-00001892.00000000.139628.00706000.00000004.mdmp, 00000000-00001892.00000000.139628.72611000.00000040.mdmp, 00000000-00001892.00000000.139628.72805000.00000004.mdmp, 00000000-00001892.00000001.141547.00660000.00000004.mdmp, 00000000-00001892.00000001.141547.01164000.00000004.mdmp, 00000000-00001892.00000001.141547.048B0000.00000004.mdmp, 00000000-00001892.00000001.141547.04E10000.00000020.mdmp, 00000000-00001892.00000001.141547.0A654000.00000002.mdmp, 00000000-00001892.00000001.141547.72611000.00000040.mdmp, 00000000-00001892.00000002.143468.00660000.00000004.mdmp, 00000000-00001892.00000002.143468.048E0000.00000002.mdmp, 00000000-00001892.00000002.143468.04A5D000.00000002.mdmp, 00000000-00001892.00000002.143468.057C1000.00000004.mdmp, 00000000-00001892.00000002.143468.05E27000.00000004.mdmp, 00000000-00001892.00000002.143468.05F27000.00000002.mdmp, 00000000-00001892.00000002.143468.0A9D6000.00000002.mdmp") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; Source: "00000000-00001892.00000000.139628.00706000.00000004.mdmp, 00000000-00001892.00000000.139628.72611000.00000040.mdmp, 00000000-00001892.00000001.141547.00660000.00000004.mdmp, 00000000-00001892.00000001.141547.01164000.00000004.mdmp, 00000000-00001892.00000001.141547.048B0000.00000004.mdmp, 00000000-00001892.00000001.141547.04E10000.00000020.mdmp, 00000000-00001892.00000001.141547.0A654000.00000002.mdmp, 00000000-00001892.00000001.141547.72611000.00000040.mdmp, 00000000-00001892.00000002.143468.00660000.00000004.mdmp, 00000000-00001892.00000002.143468.012FD000.00000002.mdmp, 00000000-00001892.00000002.143468.048E0000.00000002.mdmp, 00000000-00001892.00000002.143468.04A5D000.00000002.mdmp, 00000000-00001892.00000002.143468.057C1000.00000004.mdmp, 00000000-00001892.00000002.143468.05E27000.00000004.mdmp, 00000000-00001892.00000002.143468.0A9D6000.00000002.mdmp, 00000000-00001892.00000002.143468.728E2000.00000002.mdmp")2b:T4f0,Found reference to API "RegSetValueExW" (Indicator: "RegSetValue"; File: "3e40d42332c8d1600b75d65e22f4af7b05cb1ee53633fd9b0c112737de22cb2d.bin") Found reference to API "RegFlushKey" (Indicator: "RegFlushKey"; File: "3e40d42332c8d1600b75d65e22f4af7b05cb1ee53633fd9b0c112737de22cb2d.bin") Found reference to API "RegSetValueExA" (Indicator: "RegSetValue"; Source: "00000000-00001892.00000000.139628.00706000.00000004.mdmp, 00000000-00001892.00000001.141547.00660000.00000004.mdmp, 00000000-00001892.00000001.141547.01164000.00000004.mdmp, 00000000-00001892.00000001.141547.048B0000.00000004.mdmp, 00000000-00001892.00000001.141547.04E10000.00000020.mdmp, 00000000-00001892.00000002.143468.00660000.00000004.mdmp, 00000000-00001892.00000002.143468.048E0000.00000002.mdmp") Found reference to API "RegSetKeySecurity" (Indicator: "RegSetKeySecurity"; Source: "00000000-00001892.00000000.139628.00706000.00000004.mdmp, 00000000-00001892.00000001.141547.00660000.00000004.mdmp, 00000000-00001892.00000001.141547.01164000.00000004.mdmp, 00000000-00001892.00000001.141547.048B0000.00000004.mdmp, 00000000-00001892.00000001.141547.04E10000.00000020.mdmp, 00000000-00001892.00000002.143468.00660000.00000004.mdmp, 00000000-00001892.00000002.143468.048E0000.00000002.mdmp")2c:T971,Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/>" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+"; Source: "00000000-00000672.00000000.139168.01297000.00000004.mdmp") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/>" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"; Source: "00000000-00000672.00000000.139168.01297000.00000004.mdmp") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/>" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+"; Source: "00000000-00001560.00000000.139404.00BF7000.00000004.mdmp") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/>" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"; Source: "00000000-00001560.00000000.139404.00BF7000.00000004.mdmp") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+"; Source: "00000000-00001892.00000000.139628.00706000.00000004.mdmp, 00000000-00001892.00000001.141547.00660000.00000004.mdmp, 00000000-00001892.00000001.141547.01164000.00000004.mdmp, 00000000-00001892.00000001.141547.048B0000.00000004.mdmp, 00000000-00001892.00000001.141547.04E10000.00000020.mdmp, 00000000-00001892.00000002.143468.00660000.00000004.mdmp, 00000000-00001892.00000002.143468.048E0000.00000002.mdmp, 00000000-00001892.00000002.143468.04A5D000.00000002.mdmp, 00000000-00001892.00000002.143468.057C1000.00000004.mdmp, 00000000-00001892.00000002.143468.729A1000.00000002.mdmp") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"; Source: "00000000-00001892.00000000.139628.00706000.00000004.mdmp, 00000000-00001892.00000001.141547.00660000.00000004.mdmp, 00000000-00001892.00000001.141547.01164000.00000004.mdmp, 00000000-00001892.00000001.141547.048B0000.00000004.mdmp, 00000000-00001892.00000001.141547.04E10000.00000020.mdmp, 00000000-00001892.00000002.143468.00660000.00000004.mdmp, 00000000-00001892.00000002.143468.048E0000.00000002.mdmp, 00000000-00001892.00000002.143468.04A5D000.00000002.mdmp, 00000000-00001892.00000002.143468.057C1000.00000004.mdmp, 00000000-00001892.00000002.143468.729A1000.00000002.mdmp")2d:T698," HTTP/1.1 200 OK Date: Mon 19 Jan 2026 15:46:47 GMT Expires: -1 Cache-Control: private max-age=0 Content-Type: text/html; charset=UTF-8 Content-Security-Policy-Report-Only: object-src 'none';base-uri 'self';script-src 'nonce-wr9bvQElGJ_1hCooi8-c7g' 'strict-dynamic' 'report-sample' 'unsafe-eval' 'unsafe-inline' https: http:;report-uri https://csp.withgoogle.com/csp/gws/other-hp P3P: CP="This is not a P3P policy! See g.co/p3phelp for more info." Content-Encoding: gzip Server: gws X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Set-Cookie: __Secure-STRP=AD6DogtqxMOBK0bO1YFDduqyp5kc-khh1t4g6xUgwaCdoZAzlSTFB6tW0ZD9jqkpYcpqzZRpAxEU4Kw22xSq7Q-6bHAGSduJRPV-; expires=Mon 19-Jan-2026 15:51:47 GMT; path=/; domain=.google.com; Secure; SameSite=strict Set-Cookie: AEC=AaJma5vjDFMMdNwTrJp0gtFqZP9mPSh8NUY5GyTpz1PYnzQqWP7IIwB01A; expires=Sat 18-Jul-2026 15:46:47 GMT; path=/; domain=.google.com; Secure; HttpOnly; SameSite=lax Set-Cookie: NID=528=SiR9YsbbGEX3qJsZnwm4stq_bVoKejxgu5ObH0flG1E6E0VqPbRcRoLDhM5LwAL1IJcWz25psPh4oAM6A_W9LewZrKaMkQpgLc8RZZd7WD7CASkwTTBQT-PYHwlXRk68gvLNa83VtEhttaEISnzFy21CG4dKQowTWix4xUoxvoxIoE1n1_9dhzCymit-TweIqH7jkBGAVchNDLtHFHJaqkzhFPfYNsDOIOgQFg; expires=Tue 21-Jul-2026 15:46:47 GMT; path=/; domain=.google.com; HttpOnly Transfer-Encoding: chunked with response body ==>3C21646F63747970652068746D6C3E3C68746D6C206974656D73636F70653D2222206974656D747970653D22687474703A2F2F736368656D612E6F72672F5765....... "GET / HTTP/1.1 Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/x-shockwave-flash, */* Accept-Language: en Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; EmbeddedWB 14,52 from: http://www.bsalsa.com/ EmbeddedWB 14,52; .NET CLR 2.0.50727) Host: www.google.com Connection: Keep-Alive" Response ==> HTTP/1.1 200 OK Date: Mon 19 Jan 2026 15:46:49 GMT Expires: -1 Cache-Control: private max-age=0 Content-Type: text/html; charset=UTF-8 Content-Security-Policy-Report-Only: object-src 'none';base-uri 'self';script-src 'nonce-w8oVGrdQqOSXpJBTKWY7fw' 'strict-dynamic' 'report-sample' 'unsafe-eval' 'unsafe-inline' https: http:;report-uri https://csp.withgoogle.com/csp/gws/other-hp P3P: CP="This is not a P3P policy! See g.co/p3phelp for more info." Content-Encoding: gzip Server: gws X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Set-Cookie: __Secure-STRP=AD6Dogu1PVMRBRmJLSa4UEgZJf0-C0Q39ukub4et0exbF2d0wBQrKOsER2hb6Dl0EWSqcQRCXwHLyRGOW0ELvZZLiVKDJo6lwn96; expires=Mon 19-Jan-2026 15:51:49 GMT; path=/; domain=.google.com; Secure; SameSite=strict Set-Cookie: AEC=AaJma5s7bDA_NcUTU9cIsddMEn6g3q1BbbTRZzrarzFPmT97CSQ4eXH2VQ; expires=Sat 18-Jul-2026 15:46:49 GMT; path=/; domain=.google.com; Secure; HttpOnly; SameSite=lax Set-Cookie: NID=528=XIBmmX4UdqGzOhEBozGtddNQ2UzgNX7pd5I6k10dVG4EWTEVwRo1xnObloHYgkbtjLyDJPDOJhQDQgWLLuQ1ELqMqrOqqsmdW0UpRg0x-N-bUT09DqkCzDBOdSTrtG72j28HR5rUVrL1-2Mx9D7SNOxOUhtQbJMPy3y3ijoND9au6yQu2tcy23L2yGiobqhMzq1ihoAQy3ZCHiMocXWgFo_YL56V_fvQF5rLqw; expires=Tue 21-Jul-2026 15:46:49 GMT; path=/; domain=.google.com; HttpOnly Transfer-Encoding: chunked with response body ==>3C21646F63747970652068746D6C3E3C68746D6C206974656D73636F70653D2222206974656D747970653D22687474703A2F2F736368656D612E6F72672F5765....... "GET / HTTP/1.1 Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/x-shockwave-flash, */* Accept-Language: en Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; EmbeddedWB 14,52 from: http://www.bsalsa.com/ EmbeddedWB 14,52; .NET CLR 2.0.50727) Host: www.google.com Connection: Keep-Alive" Response ==> HTTP/1.1 200 OK Date: Mon 19 Jan 2026 15:46:54 GMT Expires: -1 Cache-Control: private max-age=0 Content-Type: text/html; charset=UTF-8 Content-Security-Policy-Report-Only: object-src 'none';base-uri 'self';script-src 'nonce-zd2yNtP0eQQseG4OESkjxg' 'strict-dynamic' 'report-sample' 'unsafe-eval' 'unsafe-inline' https: http:;report-uri https://csp.withgoogle.com/csp/gws/other-hp P3P: CP="This is not a P3P policy! See g.co/p3phelp for more info." Content-Encoding: gzip Server: gws X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Set-Cookie: __Secure-STRP=AD6DogthiRxenkKWIuNoRhfvgxz69UChj8ZVhWfmKi1jDbMqavqNmZftbzGweW3-3-N1ZDB3gWy_7bzADYa2q1s43co8gmLTFhYw; expires=Mon 19-Jan-2026 15:51:54 GMT; path=/; domain=.google.com; Secure; SameSite=strict Set-Cookie: AEC=AaJma5vd0-1gn-y7ZTShc96Ws2Lci62-VZdgfJDu6cwCx4n3aq9rJv8NKA; expires=Sat 18-Jul-2026 15:46:54 GMT; path=/; domain=.google.com; Secure; HttpOnly; SameSite=lax Set-Cookie: NID=528=SNf8qIB3v_p1BAf7bNbIyZTytFOv-bnBZMIjyUmteZES_eOIr3KzP4SG1jUR6fPQ5lT4NANI3B8xVIaEJQFawKWH1JFHtuNWdfDocSncJjOKuaNxUeNoQELF6aFDWm8WPhwmeb8cKtx54B9ZOUGfQve3RJtOGPRqh2WuK3-kHLYYJ9BtraVpS3mC6GjXDRRn-gidMk-WjRXsF4dKloAQyWuzL3m1DnsTRUEkwg; expires=Tue 21-Jul-2026 15:46:54 GMT; path=/; domain=.google.com; HttpOnly Transfer-Encoding: chunked with response body ==>3C21646F63747970652068746D6C3E3C68746D6C206974656D73636F70653D2222206974656D747970653D22687474703A2F2F736368656D612E6F72672F5765....... "GET / HTTP/1.1 Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/x-shockwave-flash, */* Accept-Language: en Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; EmbeddedWB 14,52 from: http://www.bsalsa.com/ EmbeddedWB 14,52; .NET CLR 2.0.50727) Host: www.google.com Connection: Keep-Alive" Response ==> HTTP/1.1 200 OK Date: Mon 19 Jan 2026 15:47:09 GMT Expires: -1 Cache-Control: private max-age=0 Content-Type: text/html; charset=UTF-8 Content-Security-Policy-Report-Only: object-src 'none';base-uri 'self';script-src 'nonce-RpGwjEpABi8mAovTT2ovPA' 'strict-dynamic' 'report-sample' 'unsafe-eval' 'unsafe-inline' https: http:;report-uri https://csp.withgoogle.com/csp/gws/other-hp P3P: CP="This is not a P3P policy! See g.co/p3phelp for more info." Content-Encoding: gzip Server: gws X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Set-Cookie: __Secure-STRP=AD6DogsBmgeQNGUeg7XhodKjVpu-jpDxuko4jRg1QqkTWbgb4k8guk-l7Yn9OWzxMKVMWF7POUl30NhjAZ-aZX_tlDKhbDiH2A; expires=Mon 19-Jan-2026 15:52:09 GMT; path=/; domain=.google.com; Secure; SameSite=strict Set-Cookie: AEC=AaJma5svMdZsCZuJ_7HsrnEQ56Iplp6eRvSP6WGO4FQV8XUYBC4rbYdtkw; expires=Sat 18-Jul-2026 15:47:09 GMT; path=/; domain=.google.com; Secure; HttpOnly; SameSite=lax Set-Cookie: NID=528=jTZLT3RjiqxUJTHKP3cDkUF6SUv3g9Sxl57ATkKjlkGAC7iwiGOzkqdYGj_kIOp7vN7SLVXNm8gfsDhZ19doxXqTUP55CaFY86sd2pDTXG0JwSGGscjl53D88NY0IegvbRzFzYCjvK94t_hpF3Nxaycvk5aBhQvTyF3zBxytHTVdpa4psYI2HSDfkyHDAstbBsPOUh2IAjr_K9nuR0N2sEBfjrJkqzu2HhYDkQ; expires=Tue 21-Jul-2026 15:47:09 GMT; path=/; domain=.google.com; HttpOnly Transfer-Encoding: chunked with response body ==>3C21646F63747970652068746D6C3E3C68746D6C206974656D73636F70653D2222206974656D747970653D22687474703A2F2F736368656D612E6F72672F5765....... "GET / HTTP/1.1 Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/x-shockwave-flash, */* Accept-Language: en Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; EmbeddedWB 14,52 from: http://www.bsalsa.com/ EmbeddedWB 14,52; .NET CLR 2.0.50727) Host: www.google.com Connection: Keep-Alive" Response ==> HTTP/1.1 200 OK Date: Mon 19 Jan 2026 15:47:11 GMT Expires: -1 Cache-Control: private max-age=0 Content-Type: text/html; charset=UTF-8 Content-Security-Policy-Report-Only: object-src 'none';base-uri 'self';script-src 'nonce-Fc8dJ4XSwyyccKH_OyqEKA' 'strict-dynamic' 'report-sample' 'unsafe-eval' 'unsafe-inline' https: http:;report-uri https://csp.withgoogle.com/csp/gws/other-hp P3P: CP="This is not a P3P policy! See g.co/p3phelp for more info." Content-Encoding: gzip Server: gws X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Set-Cookie: __Secure-STRP=AD6DogsQtKfSaqxZLWKghuBMZ7oJ95b4YpKyPhHjdlk1GmYTjqq7lZrYZECk6rBSoQPZYVewyfa1KIqUTMs2qDtkDz0Qmvkiiedy; expires=Mon 19-Jan-2026 15:52:11 GMT; path=/; domain=.google.com; Secure; SameSite=strict Set-Cookie: AEC=AaJma5s2uvNFlH6ZUbwnHYhkZTr23vnsTWbKVb1FoJrf_cs784kZ1v-maR4; expires=Sat 18-Jul-2026 15:47:11 GMT; path=/; domain=.google.com; Secure; HttpOnly; SameSite=lax Set-Cookie: NID=528=F5olSQipGKoxMm4HOd22aCHHsKQ5pXG2JKPeEARIkkc1cwS_HSz8zwshBF5Q5fiXgXPO6Z80Mp89qpPBxnPCHW856LYnyHP_ePCURUw2gKKqQCB5XC5LaZNbewc_Y-M5QphtM0xhFYxVuLEIF9tkxAnQqQbW4Ma5QmxIUSetIxGqj1zuW_5XLYTeJHMWNYWtRL6qFAyON1-eJ_qSoaFu_qjhyxWC4qCl3yt3YQ; expires=Tue 21-Jul-2026 15:47:11 GMT; path=/; domain=.google.com; HttpOnly Transfer-Encoding: chunked with response body ==>3C21646F63747970652068746D6C3E3C68746D6C206974656D73636F70653D2222206974656D747970653D22687474703A2F2F736368656D612E6F72672F5765....... "GET / HTTP/1.1 Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/x-shockwave-flash, */* Accept-Language: en Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; EmbeddedWB 14,52 from: http://www.bsalsa.com/ EmbeddedWB 14,52; .NET CLR 2.0.50727) Host: www.google.com Connection: Keep-Alive" Response ==> HTTP/1.1 200 OK Date: Mon 19 Jan 2026 15:47:21 GMT Expires: -1 Cache-Control: private max-age=0 Content-Type: text/html; charset=UTF-8 Content-Security-Policy-Report-Only: object-src 'none';base-uri 'self';script-src 'nonce-cDTUonyyeXKOGQlneJvM0w' 'strict-dynamic' 'report-sample' 'unsafe-eval' 'unsafe-inline' https: http:;report-uri https://csp.withgoogle.com/csp/gws/other-hp P3P: CP="This is not a P3P policy! See g.co/p3phelp for more info." Content-Encoding: gzip Server: gws X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Set-Cookie: __Secure-STRP=AD6DogudE1MwvlUJgSjJhYAGVugm14OHFB2OzEEMkR9YRP8S8iSQd6kPz3TdeGNwbezJRJx7XcGlYLGtteGeQ5bjTtUciSfSh2Ph; expires=Mon 19-Jan-2026 15:52:21 GMT; path=/; domain=.google.com; Secure; SameSite=strict Set-Cookie: AEC=AaJma5sBMviJLVcS4sza6ij8MksPgg7PBIHg4zMsmf9Z3MdtUO2zQB9iDw; expires=Sat 18-Jul-2026 15:47:21 GMT; path=/; domain=.google.com; Secure; HttpOnly; SameSite=lax Set-Cookie: NID=528=ans3ino56P1rEvc4WxkxW3a5WEqaaONQqCCHfxDMYgqMxRI_elHJEp3zNult4YvHsDFeMI_TN2nLcNLGOKYsEwy_EzpUBZRG4TQ75XJkYOUYz4opDDoag-Ne9RhmISuWb-cWD8BUT5HpQcRuXt9NFeGviGEEsP0SE0PZW0u2Lj51w8w16hyzDgVic8tWhfe5wlw7LKZYmoQIELfkyXVTHwNGJDoeE8tz4j9Ing; expires=Tue 21-Jul-2026 15:47:21 GMT; path=/; domain=.google.com; HttpOnly Transfer-Encoding: chunked with response body ==>3C21646F63747970652068746D6C3E3C68746D6C206974656D73636F70653D2222206974656D747970653D22687474703A2F2F736368656D612E6F72672F5765....... "GET / HTTP/1.1 Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/x-shockwave-flash, */* Accept-Language: en Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; EmbeddedWB 14,52 from: http://www.bsalsa.com/ EmbeddedWB 14,52; .NET CLR 2.0.50727) Host: www.google.com Connection: Keep-Alive" Response ==> HTTP/1.1 200 OK Date: Mon 19 Jan 2026 15:47:45 GMT Expires: -1 Cache-Control: private max-age=0 Content-Type: text/html; charset=UTF-8 Content-Security-Policy-Report-Only: object-src 'none';base-uri 'self';script-src 'nonce-hvubvi7rjf9XJGVKi_gALA' 'strict-dynamic' 'report-sample' 'unsafe-eval' 'unsafe-inline' https: http:;report-uri https://csp.withgoogle.com/csp/gws/other-hp P3P: CP="This is not a P3P policy! See g.co/p3phelp for more info." Content-Encoding: gzip Server: gws X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Set-Cookie: __Secure-STRP=AD6DogvL-U0EDcAZ7YqGM5lKg8v5dWN_i6h8GyPFSx0VzrMVhXt0_yGR9wJDHosgLJcAc-gbNqqymsTCytoO9h_1zLy3XrsT_DxA; expires=Mon 19-Jan-2026 15:52:45 GMT; path=/; domain=.google.com; Secure; SameSite=strict Set-Cookie: AEC=AaJma5tsKqo2psBhA5z5hjg6nTf33rBz2aojahVM021gvTd4Hcm-x1b_2Q; expires=Sat 18-Jul-2026 15:47:45 GMT; path=/; domain=.google.com; Secure; HttpOnly; SameSite=lax Set-Cookie: NID=528=NVgmhTrM23_YbmvI42NYOxYiD9T9OSfZEtpLot2lKIl7ag6rH8a9wA8q1oQqYHD8Y7KinJn7z3prppOASjwXgn0_1z-ECXjCz2g--HtulB1SYLMDjtGeASwXN9ZVPiC_7LY5bjyHNsKW17ej6U0hsCAOD7-Tks9ezWvwTSIMqiEIHHgD6vqRMhPFzbQS9_TBZyVpNPKIfMj9HJatmcBbXztVGDC_vLEkng7F02k; expires=Tue 21-Jul-2026 15:47:45 GMT; path=/; domain=.google.com; HttpOnly Transfer-Encoding: chunked with response body ==>3C21646F63747970652068746D6C3E3C68746D6C206974656D73636F70653D2222206974656D747970653D22687474703A2F2F736368656D612E6F72672F5765....... "GET / HTTP/1.1 Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/x-shockwave-flash, */* Accept-Language: en Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; EmbeddedWB 14,52 from: http://www.bsalsa.com/ EmbeddedWB 14,52; .NET CLR 2.0.50727) Host: www.google.com Connection: Keep-Alive" Response ==> HTTP/1.1 200 OK Date: Mon 19 Jan 2026 15:47:45 GMT Expires: -1 Cache-Control: private max-age=0 Content-Type: text/html; charset=UTF-8 Content-Security-Policy-Report-Only: object-src 'none';base-uri 'self';script-src 'nonce-nX02E8VR8M0YiNohJeCkRA' 'strict-dynamic' 'report-sample' 'unsafe-eval' 'unsafe-inline' https: http:;report-uri https://csp.withgoogle.com/csp/gws/other-hp P3P: CP="This is not a P3P policy! See g.co/p3phelp for more info." Content-Encoding: gzip Server: gws X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Set-Cookie: __Secure-STRP=AD6DogtjL8ofNARy6sWzaTAGxs-DaTiXBtbaofCFvBeL9V0MjpjkxTnIZrhhhwi1PDq2MVxhm8Y12_fAPGoDyhzLqnUluUdxhgqz; expires=Mon 19-Jan-2026 15:52:45 GMT; path=/; domain=.google.com; Secure; SameSite=strict Set-Cookie: AEC=AaJma5vGLSGl4NJ9mPjhjQ-EEL-oUwAk8oM-OclnLVGm1-A27nXaJlNHsA; expires=Sat 18-Jul-2026 15:47:45 GMT; path=/; domain=.google.com; Secure; HttpOnly; SameSite=lax Set-Cookie: NID=528=YA-728VRrY5mR1AsiFolV_Kmaen6OQfonWE98CA0IKeAR0cA0ck5fZToRNgm4J5Xc3pvPKhvr0SHRlhad6D_dFOgTLN4TQHpYKLY8Bh7nPuf6brPSM6a6jITWa8HZW_PGFIJ-TWTSF8NQ8JL8SSyJs6KINy0ufjH45GQYyOrOyP3bkVEpfoDIln2gfL96HJ3a1CakHvQuIV2ykR0Q2xMcLo4MNcBkKr0W5kKPzM; expires=Tue 21-Jul-2026 15:47:45 GMT; path=/; domain=.google.com; HttpOnly Transfer-Encoding: chunked with response body ==>3C21646F63747970652068746D6C3E3C68746D6C206974656D73636F70653D2222206974656D747970653D22687474703A2F2F736368656D612E6F72672F5765....... "GET / HTTP/1.1 Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/x-shockwave-flash, */* Accept-Language: en Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; EmbeddedWB 14,52 from: http://www.bsalsa.com/ EmbeddedWB 14,52; .NET CLR 2.0.50727) Host: www.google.com Connection: Keep-Alive" Response ==> HTTP/1.1 200 OK Date: Mon 19 Jan 2026 15:47:46 GMT Expires: -1 Cache-Control: private max-age=0 Content-Type: text/html; charset=UTF-8 Content-Security-Policy-Report-Only: object-src 'none';base-uri 'self';script-src 'nonce-2mzKGwoI4PBT3FYJbXpJHA' 'strict-dynamic' 'report-sample' 'unsafe-eval' 'unsafe-inline' https: http:;report-uri https://csp.withgoogle.com/csp/gws/other-hp P3P: CP="This is not a P3P policy! See g.co/p3phelp for more info." Content-Encoding: gzip Server: gws X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Set-Cookie: __Secure-STRP=AD6DogtFen3tojB03Buqs0RY1oR23Vf1oWOSL-3n1DOTtV50AgPnUAslWxYZMN3vBhWQagjKOIncHUIyf9YdXXif4nluwX95Ng; expires=Mon 19-Jan-2026 15:52:46 GMT; path=/; domain=.google.com; Secure; SameSite=strict Set-Cookie: AEC=AaJma5t5nO1Iq9QFz3rSMD8wZXsP_cOre5CTiXyCTgr_liDiC2z4AXAm0A; expires=Sat 18-Jul-2026 15:47:46 GMT; path=/; domain=.google.com; Secure; HttpOnly; SameSite=lax Set-Cookie: NID=528=M08MMHo5iPwLsOO8IF-41OU--n8bkilBTSIpR8xQ-JfrOt-FbYE-hFM7SH84LlAW9PW1iXaigRW9FUa-RBJgUQERrqxTXPDeD4SBBqTdgq4EJhKlDrhRdiO0IqXbuF3WdPb8IUyXgoyZNuJd1DNu-9fd7qvoslafDb5Uffvd8EteMKkainKtI6gTTZItxVhKmFfL2_oWGgac_R5mbbTmXqfoVPQ0_YXPYOUsRQ; expires=Tue 21-Jul-2026 15:47:46 GMT; path=/; domain=.google.com; HttpOnly Transfer-Encoding: chunked with response body ==>3C21646F63747970652068746D6C3E3C68746D6C206974656D73636F70653D2222206974656D747970653D22687474703A2F2F736368656D612E6F72672F5765....... "GET / HTTP/1.1 Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/x-shockwave-flash, */* Accept-Language: en Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; EmbeddedWB 14,52 from: http://www.bsalsa.com/ EmbeddedWB 14,52; .NET CLR 2.0.50727) Host: www.google.com Connection: Keep-Alive" Response ==> HTTP/1.1 200 OK Date: Mon 19 Jan 2026 15:49:04 GMT Expires: -1 Cache-Control: private max-age=0 Content-Type: text/html; charset=UTF-8 Content-Security-Policy-Report-Only: object-src 'none';base-uri 'self';script-src 'nonce-yhxB7ebBhEuv7CjOe8norw' 'strict-dynamic' 'report-sample' 'unsafe-eval' 'unsafe-inline' https: http:;report-uri https://csp.withgoogle.com/csp/gws/other-hp P3P: CP="This is not a P3P policy! See g.co/p3phelp for more info." Content-Encoding: gzip Server: gws X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Set-Cookie: __Secure-STRP=AD6DogvvF0g_8v93NQLX-2DVX6_qXfAUXb6vUDtbHqDH42czZMjyh1PGmRH_LTI-yKbBuq5jRHu4oms4R9zHPWBZ_E955s6xdQ; expires=Mon 19-Jan-2026 15:54:04 GMT; path=/; domain=.google.com; Secure; SameSite=strict Set-Cookie: AEC=AaJma5vQwGlJwot-K-xR58EdJAfTIotCHPbSDcTYJBN_XI62Bj62wMUskQ; expires=Sat 18-Jul-2026 15:49:04 GMT; path=/; domain=.google.com; Secure; HttpOnly; SameSite=lax Set-Cookie: NID=528=PLmlSrEII1Jy-Ud7tpqzvbEryhn8toDX6AycUzLnGX2craCvefPmrLi2-26r-pQEbvvNYh8QS9Wj48cKtqR7XgFY1EmppoywUgFqpw7fVtymx8m5P2WmDPQzwrH_Mi66AJtiAEljMmu1-QjyobmO8WgZakSrtmM_HAnuHrST7KTPrLr96Uip1pe7P4JZI2wPEj1jie8FZCwMvBf10kMkzy7yjyVhQE7oKOLkufw; expires=Tue 21-Jul-2026 15:49:04 GMT; path=/; domain=.google.com; HttpOnly Transfer-Encoding: chunked with response body ==>3C21646F63747970652068746D6C3E3C68746D6C206974656D73636F70653D2222206974656D747970653D22687474703A2F2F736368656D612E6F72672F5765....... "GET / HTTP/1.1 Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/x-shockwave-flash, */* Accept-Language: en Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; EmbeddedWB 14,52 from: http://www.bsalsa.com/ EmbeddedWB 14,52; .NET CLR 2.0.50727) Host: www.google.com Connection: Keep-Alive" Response ==> HTTP/1.1 200 OK Date: Mon 19 Jan 2026 15:49:04 GMT Expires: -1 Cache-Control: private max-age=0 Content-Type: text/html; charset=UTF-8 Content-Security-Policy-Report-Only: object-src 'none';base-uri 'self';script-src 'nonce-yakm49Py4_8sCh1cNZLd1g' 'strict-dynamic' 'report-sample' 'unsafe-eval' 'unsafe-inline' https: http:;report-uri https://csp.withgoogle.com/csp/gws/other-hp P3P: CP="This is not a P3P policy! See g.co/p3phelp for more info." Content-Encoding: gzip Server: gws X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Set-Cookie: __Secure-STRP=AD6DogsF4zs-lXXoY27FxllXZVBPBwJqn3rRkodY5FyGSwO-UNYDLjaop-CdIev5vPJcKjc91I5bJjcZuzN-VdtOuiz9NtnqUjj1; expires=Mon 19-Jan-2026 15:54:04 GMT; path=/; domain=.google.com; Secure; SameSite=strict Set-Cookie: AEC=AaJma5s2FOcDV0vCydVMssaPygagcYjYrK-FwfSMphg8ptvXe97JNrQ3cDI; expires=Sat 18-Jul-2026 15:49:04 GMT; path=/; domain=.google.com; Secure; HttpOnly; SameSite=lax Set-Cookie: NID=528=bmRh_Uk4API4QOsVZGa5T1XaeMFDDnpNEscxFHP79p5r435_kwWYtO7jzVgGspiN5kGijPnSG-Ytb83F1jacVirWFgSWyCnD8XD_FB8QQFGGQGvEGfDZncVuM1RftIFeNhxQqFFlrRylVPIHCj5qXxuSma1OmpwHGYWE1C95BgVePM6z7MfUFnOkNhe1s-cQEsFEKQ7DgF_gifo-in8YmRjq_9tlW7oM1IikQd0; expires=Tue 21-Jul-2026 15:49:04 GMT; path=/; domain=.google.com; HttpOnly Transfer-Encoding: chunked with response body ==>3C21646F63747970652068746D6C3E3C68746D6C206974656D73636F70653D2222206974656D747970653D22687474703A2F2F736368656D612E6F72672F5765....... "GET / HTTP/1.1 Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/x-shockwave-flash, */* Accept-Language: en Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; EmbeddedWB 14,52 from: http://www.bsalsa.com/ EmbeddedWB 14,52; .NET CLR 2.0.50727) Host: www.google.com Connection: Keep-Alive" Response ==> HTTP/1.1 200 OK Date: Mon 19 Jan 2026 15:49:04 GMT Expires: -1 Cache-Control: private max-age=0 Content-Type: text/html; charset=UTF-8 Content-Security-Policy-Report-Only: object-src 'none';base-uri 'self';script-src 'nonce-DD9kRQU_jg1nIFDectQnEw' 'strict-dynamic' 'report-sample' 'unsafe-eval' 'unsafe-inline' https: http:;report-uri https://csp.withgoogle.com/csp/gws/other-hp P3P: CP="This is not a P3P policy! See g.co/p3phelp for more info." Content-Encoding: gzip Server: gws X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Set-Cookie: __Secure-STRP=AD6Dogt9LhriqLmJBgV2Fr-q_uofMsQJZqBBMXkX9nOLqub-bi5lztgwhLAGEN47pSWxbdWn7PG-mXCfwsdgN76LR1BBU7a3wSBS; expires=Mon 19-Jan-2026 15:54:04 GMT; path=/; domain=.google.com; Secure; SameSite=strict Set-Cookie: AEC=AaJma5sLC2hgSpzlx0xdjvqjj4aj5um-W9VQTrcwF1TjEZs_k7183f0evZU; expires=Sat 18-Jul-2026 15:49:04 GMT; path=/; domain=.google.com; Secure; HttpOnly; SameSite=lax Set-Cookie: NID=528=kcS_IXYTp5ePrHPCyX0f7alJ-8wmE7fCl9bOj0D-GjLV0zNFWQxClHKY71MgHUsxgbkEdjxdD5QPxVAa-k4iOG5iEgjFyPuo5zlQfxFbNt7nFIlATAYCgmrLv2Htc4bbTJuzIhLaHt4m9DgWH0sSLXD-GX6hliyZZ-sNjHFBgTWFFKo2K8cO1-TQAsclswSlbjuaP3kDh_6OO1XtshgKdCkNc9lsOIeLIwBsCg; expires=Tue 21-Jul-2026 15:49:04 GMT; path=/; domain=.google.com; HttpOnly Transfer-Encoding: chunked with response body ==>3C21646F63747970652068746D6C3E3C68746D6C206974656D73636F70653D2222206974656D747970653D22687474703A2F2F736368656D612E6F72672F5765....... "GET / HTTP/1.1 Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/x-shockwave-flash, */* Accept-Language: en Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; EmbeddedWB 14,52 from: http://www.bsalsa.com/ EmbeddedWB 14,52; .NET CLR 2.0.50727) Host: www.google.com Connection: Keep-Alive" Response ==> HTTP/1.1 200 OK Date: Mon 19 Jan 2026 15:49:04 GMT Expires: -1 Cache-Control: private max-age=0 Content-Type: text/html; charset=UTF-8 Content-Security-Policy-Report-Only: object-src 'none';base-uri 'self';script-src 'nonce-lkhHn5KCOh7GQiyBVoqPtg' 'strict-dynamic' 'report-sample' 'unsafe-eval' 'unsafe-inline' https: http:;report-uri https://csp.withgoogle.com/csp/gws/other-hp P3P: CP="This is not a P3P policy! See g.co/p3phelp for more info." Content-Encoding: gzip Server: gws X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Set-Cookie: __Secure-STRP=AD6DogvvktP874mT8CecUCO8P4ZEfC6uR-TxCHxJFrTuLYHqtZLqFfiBMpvH4TwiSbwsmH2jKMQc-KDCZTdB0tin4Ss0vhVWJtCD; expires=Mon 19-Jan-2026 15:54:04 GMT; path=/; domain=.google.com; Secure; SameSite=strict Set-Cookie: AEC=AaJma5veJXs8gOnVcrQtogyXLaOnv7Hv3e2c1un0hVPdcBLA_OOWZVkZH7A; expires=Sat 18-Jul-2026 15:49:04 GMT; path=/; domain=.google.com; Secure; HttpOnly; SameSite=lax Set-Cookie: NID=528=aIv6UY-7j2XR4jiWUSPbJmNou3S4ivFZh1pWHqNNmXmRo3NF8tlpFmvtMQYuzjyRVecXRpoeccX8cZHZwZ0vfb09WGHTOe8SBrOHBwafOp8Kz7KlZB5jWJHlEU4pifDt90kchLMVTB7r7yvOQOaukK6i46gqHeQiD1qZaHWC3ybk8eyXnIq5vczgs4dDyqDyqeVAz_yHHCixVQpQemRCWBRyt1xdiACRS3GXww; expires=Tue 21-Jul-2026 15:49:04 GMT; path=/; domain=.google.com; HttpOnly Transfer-Encoding: chunked with response body ==>3C21646F63747970652068746D6C3E3C68746D6C206974656D73636F70653D2222206974656D747970653D22687474703A2F2F736368656D612E6F72672F5765.......53:T18e4,"http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt0>ngdxfg:smxsu$was.,k" - Source: "00000000-00001560.00000000.139404.010EB000.00000004.mdmp") Found URL "http://pki.eset.com/crt/csca2020.crt05.0,0*$http://pki.eset.com/crl/csca2020.crl0ib0@00%0" - Source: "00000000-00001560.00000000.139404.010EB000.00000004.mdmp") Found URL "http://pki.eset.com/csp0jte;u" - Source: "00000000-00001560.00000000.139404.010EB000.00000004.mdmp") Found URL "http://pki.eset.com/crt/rootca2020.crt0700.0,&http://pki.eset.com/crl/rootca2020.crl0?806040%0" - Source: "00000000-00001560.00000000.139404.010EB000.00000004.mdmp") Found URL "http://pki.eset.com/csp0elxqj^x8;,*+-*" - Source: "00000000-00001560.00000000.139404.010EB000.00000004.mdmp") Found URL "http://pki.eset.com/crt/tsca2020.crt05.0,0*$http://pki.eset.com/crl/tsca2020.crl0?806040%0" - Source: "00000000-00001560.00000000.139404.010EB000.00000004.mdmp") Found URL "http://pki.eset.com/csp0rleog9[jrg" - Source: "00000000-00001560.00000000.139404.010EB000.00000004.mdmp") Found URL "http://pki.eset.com/csp0'dbgc" - Source: "00000000-00001560.00000000.139404.010EB000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/miccodsigpca2011_2011-07-08.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/miccodsigpca2011_2011-07-08.crt0zeaf$x" - Source: "00000000-00001560.00000000.139404.010EB000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^r0p0nbhttp://www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt03http://www.microsoft.com/pkiops/docs/primarycps.htm0@e_.,>d=xz" - Source: "00000000-00001560.00000000.139404.010EB000.00000004.mdmp") Found URL "http://www.microsoft.com0m" - Source: "00000000-00001560.00000000.139404.010EB000.00000004.mdmp") Found URL "http://103.15.106.221/rnm226.php;http://188.190.114.21/rnm226.php;http://111.121.193.238/rnm238.phplitecoin.path%userprofile%\%rnd_char[4-6].exelitecoin.size_min200000litecoin.size_max350000litecoin.runlitecoin.flagsnormal_priority_class" - Source: "00000000-00001892.00000001.141547.00660000.00000004.mdmp") Found URL "http://130.185.108.137/pchfv.phpone_core.path%userprofile%\do.exeone_core.size223744one_core.run" - Source: "00000000-00001892.00000001.141547.00660000.00000004.mdmp") Found URL "http://103.15.106.221/rnm226.php;http://188.190.114.21/rnm226.php;http://111.121.193.238/rnm238.php" - Source: "00000000-00001892.00000001.141547.00660000.00000004.mdmp") Found URL "http://peterhalpin.com/026.jpg;http://sharkey.ie/002.jpg;http://masterscastle.com/021.jpg;http://lesamis-asso.com/009.jpg;http://ourladysgrove.ie/011.jpg;http://cflacu.com/000.jpg;http://arsenalbruneifc.com/009.jpg;http://adultsunderwear.co.uk/000.jpg;http://1callsolutions.com/029.jpglitecoin.path=%userprofile%\%rnd_char[4-6].exelitecoin.size_min=200000litecoin.size_max=350000litecoin.run=litecoin.flags=normal_priority_class" - Source: "00000000-00001892.00000001.141547.00660000.00000004.mdmp") Found URL "http://130.185.108.137/pchfv.phpcores_gt_1.path=svchost.execores_gt_1.size_min=200000cores_gt_1.size_max=4000000cores_gt_1.run=$xmrcpu" - Source: "00000000-00001892.00000001.141547.00660000.00000004.mdmp") Found URL "http://130.185.108.137/pchfv.phpone_core.path=%userprofile%\do.exeone_core.size=223744one_core.run=" - Source: "00000000-00001892.00000001.141547.00660000.00000004.mdmp") Found URL "http://www.w3.org/1999/02/22-rdf-syntax-ns" - Source: "00000000-00001892.00000001.141547.0133A000.00000002.mdmp") Found URL "http://www.bsalsa.com/" - Source: "00000000-00001892.00000001.141547.06270000.00000004.mdmp") Found URL "http://103.15.106.221/rnm226.php;http://188.190.114.21/rnm226.php;http://111.121.193.238/rnm238.phplitecoin.path%userprofile%\%rnd_char[4-6].exelitecoin.size_min200000litecoin.size_max350000litecoin.runlitecoin.flagsnormal_priority_class" - Source: "00000000-00001892.00000002.143468.00660000.00000004.mdmp") Found URL "http://130.185.108.137/pchfv.phpone_core.path%userprofile%\do.exeone_core.size223744one_core.run" - Source: "00000000-00001892.00000002.143468.00660000.00000004.mdmp") Found URL "http://103.15.106.221/rnm226.php;http://188.190.114.21/rnm226.php;http://111.121.193.238/rnm238.php" - Source: "00000000-00001892.00000002.143468.00660000.00000004.mdmp") Found URL "http://peterhalpin.com/026.jpg;http://sharkey.ie/002.jpg;http://masterscastle.com/021.jpg;http://lesamis-asso.com/009.jpg;http://ourladysgrove.ie/011.jpg;http://cflacu.com/000.jpg;http://arsenalbruneifc.com/009.jpg;http://adultsunderwear.co.uk/000.jpg;http://1callsolutions.com/029.jpglitecoin.path=%userprofile%\%rnd_char[4-6].exelitecoin.size_min=200000litecoin.size_max=350000litecoin.run=litecoin.flags=normal_priority_class" - Source: "00000000-00001892.00000002.143468.00660000.00000004.mdmp") Found URL "http://130.185.108.137/pchfv.phpcores_gt_1.path=svchost.execores_gt_1.size_min=200000cores_gt_1.size_max=4000000cores_gt_1.run=$xmrcpu" - Source: "00000000-00001892.00000002.143468.00660000.00000004.mdmp") Found URL "http://130.185.108.137/pchfv.phpone_core.path=%userprofile%\do.exeone_core.size=223744one_core.run=" - Source: "00000000-00001892.00000002.143468.00660000.00000004.mdmp") Found URL "http://www.bsalsa.com/" - Source: "00000000-00001892.00000002.143468.00660000.00000004.mdmp") Found URL "https://go.eset.com" - Source: "00000000-00001892.00000002.143468.012FD000.00000002.mdmp") Found URL "http://redirector.eset.systems" - Source: "00000000-00001892.00000002.143468.012FD000.00000002.mdmp") Found URL "https://help.eset.com" - Source: "00000000-00001892.00000002.143468.012FD000.00000002.mdmp") Found URL "http://windowsupdate.microsoft.comexplorer.exelinkreferenceguireferrer&guireferrer=%sgui.web.showgui.faq.showgui.websupport.showgui.feedback.showhttps://go.eset.com/supportform?version=$" - Source: "00000000-00001892.00000002.143468.012FD000.00000002.mdmp") Found URL "https://go.eset.com/product/knowledgebase?lng=$" - Source: "00000000-00001892.00000002.143468.012FD000.00000002.mdmp") Found URL "https://go.eset.com/product/license-troubleshooting?lng=$" - Source: "00000000-00001892.00000002.143468.012FD000.00000002.mdmp") Found URL "https://go.eset.com/product/product-troubleshooting?lng=$" - Source: "00000000-00001892.00000002.143468.012FD000.00000002.mdmp") Found URL "https://help.eset.com/gethelp?product=$" - Source: "00000000-00001892.00000002.143468.012FD000.00000002.mdmp") Found URL "https://go.eset.com/ehome_security_features?feature=vpn&lng=$" - Source: "00000000-00001892.00000002.143468.012FD000.00000002.mdmp") Found URL "https://go.eset.com/vpn_apps?lng=$" - Source: "00000000-00001892.00000002.143468.012FD000.00000002.mdmp") Found URL "https://go.eset.com/ehome_security_features?feature=ip&lng=$" - Source: "00000000-00001892.00000002.143468.012FD000.00000002.mdmp") Found URL "https://go.eset.com/password_manager_extension?lng=$" - Source: "00000000-00001892.00000002.143468.012FD000.00000002.mdmp") Found URL "https://msp.eset.comgui.upconvert.show$" - Source: "00000000-00001892.00000002.143468.012FD000.00000002.mdmp") Found URL "http://phishing.eset.com/report/$" - Source: "00000000-00001892.00000002.143468.012FD000.00000002.mdmp") Found URL "http://logo.verisign.com/vslogo.gif0\:oj?f%w0digicert" - Source: "00000000-00001892.00000002.143468.012FD000.00000002.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microsoftcodeverifroot.crl0m0k0i/0\0zm0k0i=http://www.microsoft.com/pki/certs/microsoftcodeverifroot.crt08&v:" - Source: "00000000-00001892.00000002.143468.012FD000.00000002.mdmp") Found URL "http://logo.verisign.com/vslogo.gif03130$j0_b>mnmnmn Risco Software Inc.\"\n \"is-6RA4E.tmp\" was detected as \"VC8 -> Microsoft Corporation\"\n \"is-T08I6.tmp\" was detected as \"Borland Delphi 3.0 (???)\"\n \"is-LQO5M.tmp\" was detected as \"Borland Delphi 3.0 (???)\"\n \"is-LJ50M.tmp\" was detected as \"Borland Delphi 3.0 (???)\"\n \"_setup64.tmp\" was detected as \"Morphine v1.2 (DLL)\"","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":10,"id":"static-18","sources":[{"report_type":"sandbox","report_id":"696e51a64bdd2e685b0a360e"}]},{"level":"informative","category":"Unusual Characteristics","name":"Reads the windows installation language","description":"\"