26:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js","/_next/static/chunks/1w1axrg6kzses.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/1kn_tf3p-ubex.js","/_next/static/chunks/1wq095nwqbaw1.js"],"SampleDetailWrapper"] 67:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js"],"IconMark"] 25:T481,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Crifi.Generic Sample 3fa03f784ec2… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 3fa03f784ec2…. Malware family: Crifi.Generic. Threat score 100/100. 13/28 AV engines flagged this file. 11 malicious and 26 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/3fa03f784ec205ddfffcf521bd6cdb53b46ad6ed6fd84ec4ecd85c545c8e2edf","keywords":["Malicious","Crifi.Generic","malware analysis","sandbox report","threat intelligence","3fa03f784ec205ddfffcf521bd6cdb53b46ad6ed6fd84ec4ecd85c545c8e2edf"],"about":{"@type":"SoftwareApplication","name":"file.exe","applicationCategory":["peexe","executable"],"identifier":"3fa03f784ec205ddfffcf521bd6cdb53b46ad6ed6fd84ec4ecd85c545c8e2edf","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Crifi.Generic","antivirusDetections":{"malicious":13,"total":28},"behavioralIndicators":{"malicious":11,"suspicious":26},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}27:T25c4,Found reference to API (Indicator: "DosDateTimeToFileTime"; Source: "sample.bin"), Found reference to API (Indicator: "DeleteFileA"; Source: "sample.bin"), Found reference to API (Indicator: "AdjustTokenPrivileges"; Source: "sample.bin"), Found reference to API (Indicator: "MulDiv"; Source: "sample.bin"), Found reference to API (Indicator: "GetFileAttributesA"; Source: "sample.bin"), Found reference to API (Indicator: "SetForegroundWindow"; Source: "sample.bin"), Found reference to API (Indicator: "SeShutdownPrivilege"; Source: "sample.bin"), Found reference to API (Indicator: "GetPrivateProfileIntA"; Source: "sample.bin"), Found reference to API (Indicator: "GetExitCodeProcess"; Source: "sample.bin"), Found reference to API (Indicator: "FreeSid"; Source: "sample.bin"), Found reference to API (Indicator: "SetEvent"; Source: "sample.bin"), Found reference to API (Indicator: "GetSystemDirectoryA"; Source: "sample.bin"), Found reference to API (Indicator: "CreateDirectoryA"; Source: "sample.bin"), Found reference to API (Indicator: "GetDriveTypeA"; Source: "sample.bin"), Found reference to API (Indicator: "GlobalFree"; Source: "sample.bin"), Found reference to API (Indicator: "LoadLibraryA"; Source: "sample.bin"), Found reference to API (Indicator: "EqualSid"; Source: "sample.bin"), Found reference to API (Indicator: "CreateThread"; Source: "sample.bin"), Found reference to API (Indicator: "GetFileVersionInfoSizeA"; Source: "sample.bin"), Found reference to API (Indicator: "GetModuleHandleW"; Source: "sample.bin"), Found reference to API (Indicator: "DecryptFileA"; Source: "sample.bin"), Found reference to API (Indicator: "RegQueryValueExA"; Source: "sample.bin"), Found reference to API (Indicator: "GetCurrentProcessId"; Source: "sample.bin"), Found reference to API (Indicator: "RegSetValueExA"; Source: "sample.bin"), Found reference to API (Indicator: "FormatMessageA"; Source: "sample.bin"), Found reference to API (Indicator: "GetStartupInfoW"; Source: "sample.bin"), Found reference to API (Indicator: "GetCurrentDirectoryA"; Source: "sample.bin"), Found reference to API (Indicator: "SetFileAttributesA"; Source: "sample.bin"), Found reference to API (Indicator: "RegOpenKeyExA"; Source: "sample.bin"), Found reference to API (Indicator: "GetDesktopWindow"; Source: "sample.bin"), Found reference to API (Indicator: "CharNextA"; Source: "sample.bin"), Found reference to API (Indicator: "SetWindowPos"; Source: "sample.bin"), Found reference to API (Indicator: "ShowWindow"; Source: "sample.bin"), Found reference to API (Indicator: "GetSystemInfo"; Source: "sample.bin"), Found reference to API (Indicator: "SendMessageA"; Source: "sample.bin"), Found reference to API (Indicator: "UnhandledExceptionFilter"; Source: "sample.bin"), Found reference to API (Indicator: "VerQueryValueA"; Source: "sample.bin"), Found reference to API (Indicator: "DispatchMessageA"; Source: "sample.bin"), Found reference to API (Indicator: "GetWindowLongA"; Source: "sample.bin"), Found reference to API (Indicator: "LookupPrivilegeValueA"; Source: "sample.bin"), Found reference to API (Indicator: "FindFirstFileA"; Source: "sample.bin"), Found reference to API (Indicator: "GetProcAddress"; Source: "sample.bin"), Found reference to API (Indicator: "CreateMutexA"; Source: "sample.bin"), Found reference to API (Indicator: "CreateFileA"; Source: "sample.bin"), Found reference to API (Indicator: "GlobalAlloc"; Source: "sample.bin"), Found reference to API (Indicator: "CheckTokenMembership"; Source: "sample.bin"), Found reference to API (Indicator: "SetFileTime"; Source: "sample.bin"), Found reference to API (Indicator: "RegCloseKey"; Source: "sample.bin"), Found reference to API (Indicator: "GetTempPathA"; Source: "sample.bin"), Found reference to API (Indicator: "GetTokenInformation"; Source: "sample.bin"), Found reference to API (Indicator: "SizeofResource"; Source: "sample.bin"), Found reference to API (Indicator: "ResetEvent"; Source: "sample.bin"), Found reference to API (Indicator: "RemoveDirectoryA"; Source: "sample.bin"), Found reference to API (Indicator: "SetUnhandledExceptionFilter"; Source: "sample.bin"), Found reference to API (Indicator: "GlobalLock"; Source: "sample.bin"), Found reference to API (Indicator: "FindClose"; Source: "sample.bin"), Found reference to API (Indicator: "LocalFileTimeToFileTime"; Source: "sample.bin"), Found reference to API (Indicator: "IsDBCSLeadByte"; Source: "sample.bin"), Found reference to API (Indicator: "GetTickCount"; Source: "sample.bin"), Found reference to API (Indicator: "SetCurrentDirectoryA"; Source: "sample.bin"), Found reference to API (Indicator: "GetDC"; Source: "sample.bin"), Found reference to API (Indicator: "MsgWaitForMultipleObjects"; Source: "sample.bin"), Found reference to API (Indicator: "SetFilePointer"; Source: "sample.bin"), Found reference to API (Indicator: "GetShortPathNameA"; Source: "sample.bin"), Found reference to API (Indicator: "GetPrivateProfileStringA"; Source: "sample.bin"), Found reference to API (Indicator: "TerminateThread"; Source: "sample.bin"), Found reference to API (Indicator: "FreeResource"; Source: "sample.bin"), Found reference to API (Indicator: "lstrcmpA"; Source: "sample.bin"), Found reference to API (Indicator: "ExitProcess"; Source: "sample.bin"), Found reference to API (Indicator: "EnumResourceLanguagesA"; Source: "sample.bin"), Found reference to API (Indicator: "WritePrivateProfileStringA"; Source: "sample.bin"), Found reference to API (Indicator: "GetVolumeInformationA"; Source: "sample.bin"), Found reference to API (Indicator: "GetCurrentThreadId"; Source: "sample.bin"), Found reference to API (Indicator: "MessageBoxA"; Source: "sample.bin"), Found reference to API (Indicator: "SHBrowseForFolder"; Source: "sample.bin"), Found reference to API (Indicator: "GetModuleFileNameA"; Source: "sample.bin"), Found reference to API (Indicator: "GetCurrentProcess"; Source: "sample.bin"), Found reference to API (Indicator: "CharUpperA"; Source: "sample.bin"), Found reference to API (Indicator: "LocalFree"; Source: "sample.bin"), Found reference to API (Indicator: "LoadLibraryExA"; Source: "sample.bin"), Found reference to API (Indicator: "QueryPerformanceCounter"; Source: "sample.bin"), Found reference to API (Indicator: "RegDeleteValueA"; Source: "sample.bin"), Found reference to API (Indicator: "GetWindowRect"; Source: "sample.bin"), Found reference to API (Indicator: "CharPrevA"; Source: "sample.bin"), Found reference to API (Indicator: "GetDeviceCaps"; Source: "sample.bin"), Found reference to API (Indicator: "ReleaseDC"; Source: "sample.bin"), Found reference to API (Indicator: "HeapSetInformation"; Source: "sample.bin"), Found reference to API (Indicator: "GetSystemTimeAsFileTime"; Source: "sample.bin"), Found reference to API (Indicator: "SetWindowTextA"; Source: "sample.bin"), Found reference to API (Indicator: "ExpandEnvironmentStringsA"; Source: "sample.bin"), Found reference to API (Indicator: "AllocateAndInitializeSid"; Source: "sample.bin"), Found reference to API (Indicator: "EnableWindow"; Source: "sample.bin"), Found reference to API (Indicator: "PeekMessageA"; Source: "sample.bin"), Found reference to API (Indicator: "GetVersionExA"; Source: "sample.bin"), Found reference to API (Indicator: "LocalAlloc"; Source: "sample.bin"), Found reference to API (Indicator: "CreateEventA"; Source: "sample.bin"), Found reference to API (Indicator: "GetFileVersionInfoA"; Source: "sample.bin"), Found reference to API (Indicator: "GlobalUnlock"; Source: "sample.bin"), Found reference to API (Indicator: "RegQueryInfoKeyA"; Source: "sample.bin"), Found reference to API (Indicator: "CompareStringA"; Source: "sample.bin"), Found reference to API (Indicator: "WriteFile"; Source: "sample.bin"), Found reference to API (Indicator: "Sleep"; Source: "sample.bin"), Found reference to API (Indicator: "LoadStringA"; Source: "sample.bin"), Found reference to API (Indicator: "LoadResource"; Source: "sample.bin"), Found reference to API (Indicator: "TerminateProcess"; Source: "sample.bin"), Found reference to API (Indicator: "CreateProcessA"; Source: "sample.bin"), Found reference to API (Indicator: "FreeLibrary"; Source: "sample.bin"), Found reference to API (Indicator: "SHGetPathFromIDList"; Source: "sample.bin"), Found reference to API (Indicator: "RegCreateKeyExA"; Source: "sample.bin"), Found reference to API (Indicator: "MessageBeep"; Source: "sample.bin"), Found reference to API (Indicator: "FindNextFileA"; Source: "sample.bin"), Found reference to API (Indicator: "SetWindowLongA"; Source: "sample.bin"), Found reference to API (Indicator: "ReadFile"; Source: "sample.bin"), Found reference to API (Indicator: "CallWindowProcA"; Source: "sample.bin"), Found reference to API (Indicator: "OpenProcessToken"; Source: "sample.bin"), Found reference to API (Indicator: "ExitWindowsEx"; Source: "sample.bin"), Found reference to API (Indicator: "GetTempFileNameA"; Source: "sample.bin"), Found reference to API (Indicator: "GetVersion"; Source: "sample.bin"), Found reference to API (Indicator: "GetLastError"; Source: "sample.bin"), Found reference to API (Indicator: "LockResource"; Source: "sample.bin"), Found reference to API (Indicator: "GetDiskFreeSpaceA"; Source: "sample.bin"), Found reference to API (Indicator: "GetWindowsDirectoryA"; Source: "sample.bin"), Found reference to API (Indicator: "GetSystemMetrics"; Source: "sample.bin"), Found reference to API (Indicator: "WaitForSingleObject"; Source: "sample.bin"), Found reference to API (Indicator: "CloseHandle"; Source: "sample.bin"), Found reference to API (Indicator: "FindResourceA"; Source: "sample.bin")28:T698,file/memory contains long string(File: "5Ln7gt9.exe") Found string "system.io.compression.dll" (Source: "00000000-00000176.00000001.82037.00480000.00000004.mdmp") Found string "clrcompression.dll" (Source: "00000000-00000176.00000001.82037.00480000.00000004.mdmp") Found string "system.io.compression.filesystem.dll" (Source: "00000000-00000176.00000001.82037.00480000.00000004.mdmp") Found string "system.io.compression.zipfile.dll" (Source: "00000000-00000176.00000001.82037.00480000.00000004.mdmp") Found string "system.io.compression.dll" (Source: "00000000-00001596.00000001.80705.00250000.00000004.mdmp") Found string "clrcompression.dll" (Source: "00000000-00001596.00000001.80705.00250000.00000004.mdmp") Found string "system.io.compression.filesystem.dll" (Source: "00000000-00001596.00000001.80705.00250000.00000004.mdmp") Found string "system.io.compression.zipfile.dll" (Source: "00000000-00001596.00000001.80705.00250000.00000004.mdmp") Found string "unknown compression method" (Source: "00000000-00002056.00000001.82574.00413000.00000002.mdmp") Found string "unknown compression method" (Source: "00000000-00002360.00000000.79712.001B0000.00000004.mdmp, 00000000-00002360.00000002.82587.001B0000.00000004.mdmp") Found string "system.io.compression.dll" (Source: "00000000-00003804.00000000.81033.003A0000.00000004.mdmp") Found string "clrcompression.dll" (Source: "00000000-00003804.00000000.81033.003A0000.00000004.mdmp") Found string "system.io.compression.filesystem.dll" (Source: "00000000-00003804.00000000.81033.003A0000.00000004.mdmp") Found string "system.io.compression.zipfile.dll" (Source: "00000000-00003804.00000000.81033.003A0000.00000004.mdmp")29:T5ce,"3fa03f784ec205ddfffcf521bd6cdb53b46ad6ed6fd84ec4ecd85c545c8e2edf.exe" called "FindResourceA" with parameter "19206988" - (UID: 00000000-00002360) "3fa03f784ec205ddfffcf521bd6cdb53b46ad6ed6fd84ec4ecd85c545c8e2edf.exe" called "FindResourceA" with parameter "981080" - (UID: 00000000-00002360) "3fa03f784ec205ddfffcf521bd6cdb53b46ad6ed6fd84ec4ecd85c545c8e2edf.exe" called "FindResourceA" with parameter "19206856" - (UID: 00000000-00002360) "3fa03f784ec205ddfffcf521bd6cdb53b46ad6ed6fd84ec4ecd85c545c8e2edf.exe" called "FindResourceA" with parameter "19206864" - (UID: 00000000-00002360) "3fa03f784ec205ddfffcf521bd6cdb53b46ad6ed6fd84ec4ecd85c545c8e2edf.exe" called "FindResourceA" with parameter "19206892" - (UID: 00000000-00002360) "3fa03f784ec205ddfffcf521bd6cdb53b46ad6ed6fd84ec4ecd85c545c8e2edf.exe" called "FindResourceA" with parameter "19206904" - (UID: 00000000-00002360) "3fa03f784ec205ddfffcf521bd6cdb53b46ad6ed6fd84ec4ecd85c545c8e2edf.exe" called "FindResourceA" with parameter "19206920" - (UID: 00000000-00002360) "FI3gq62.exe" called "FindResourceA" with parameter "11473740" - (UID: 00000000-00003856) "FI3gq62.exe" called "FindResourceA" with parameter "1177968" - (UID: 00000000-00003856) "FI3gq62.exe" called "FindResourceA" with parameter "11473608" - (UID: 00000000-00003856) "FI3gq62.exe" called "FindResourceA" with parameter "11473616" - (UID: 00000000-00003856) "FI3gq62.exe" called "FindResourceA" with parameter "11473644" - (UID: 00000000-00003856)2a:Tb79,"3fa03f784ec205ddfffcf521bd6cdb53b46ad6ed6fd84ec4ecd85c545c8e2edf.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '19253216'}" (UID: 00000000-00002360) "3fa03f784ec205ddfffcf521bd6cdb53b46ad6ed6fd84ec4ecd85c545c8e2edf.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '19253328'}" (UID: 00000000-00002360) "3fa03f784ec205ddfffcf521bd6cdb53b46ad6ed6fd84ec4ecd85c545c8e2edf.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '19253360'}" (UID: 00000000-00002360) "3fa03f784ec205ddfffcf521bd6cdb53b46ad6ed6fd84ec4ecd85c545c8e2edf.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '19253344'}" (UID: 00000000-00002360) "3fa03f784ec205ddfffcf521bd6cdb53b46ad6ed6fd84ec4ecd85c545c8e2edf.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '19253312'}" (UID: 00000000-00002360) "3fa03f784ec205ddfffcf521bd6cdb53b46ad6ed6fd84ec4ecd85c545c8e2edf.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '19253264'}" (UID: 00000000-00002360) "FI3gq62.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '11519968'}" (UID: 00000000-00003856) "FI3gq62.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '11520080'}" (UID: 00000000-00003856) "FI3gq62.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '11520112'}" (UID: 00000000-00003856) "FI3gq62.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '11520096'}" (UID: 00000000-00003856) "FI3gq62.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '11520064'}" (UID: 00000000-00003856) "FI3gq62.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '11520016'}" (UID: 00000000-00003856) "db2FL06.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '1755104'}" (UID: 00000000-00004180) "db2FL06.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '1755216'}" (UID: 00000000-00004180) "db2FL06.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '1755248'}" (UID: 00000000-00004180) "db2FL06.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '1755232'}" (UID: 00000000-00004180) "db2FL06.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '1755200'}" (UID: 00000000-00004180) "db2FL06.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '1755152'}" (UID: 00000000-00004180) "Ta8tZ82.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '706672'}" (UID: 00000000-00000772) "Ta8tZ82.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '706624'}" (UID: 00000000-00000772) "Ta8tZ82.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '706576'}" (UID: 00000000-00000772) "AppLaunch.exe" called "LoadResource with parameter {'hModule': '1661075456', 'hResInfo': '1662116216'}" (UID: 00000000-00004020)2b:T517,Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+"; File: "00001428.00000594.12355032.00401000.wprm") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"; File: "00001428.00000594.12355032.00401000.wprm") Found string "2YABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+"; File: "00001428.00000594.12355538.00424000.wprm") Found string "2YABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"; File: "00001428.00000594.12355538.00424000.wprm") Found string "2YABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+"; Source: "00000000-00001596.00000001.80705.003BD000.00000004.mdmp") Found string "2YABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"; Source: "00000000-00001596.00000001.80705.003BD000.00000004.mdmp")2c:T648,"5Ln7gt9.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\DIRECTORY\SHELLEX\ICONHANDLER") "5Ln7gt9.exe" (Access type: "OPEN"; Path: "HKCU\FOLDER") "5Ln7gt9.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\FOLDER") "5Ln7gt9.exe" (Access type: "QUERY"; Path: "HKLM\SOFTWARE\CLASSES\FOLDER") "5Ln7gt9.exe" (Access type: "OPEN"; Path: "HKCU\FOLDER\SHELLEX\ICONHANDLER") "5Ln7gt9.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\FOLDER\SHELLEX\ICONHANDLER") "5Ln7gt9.exe" (Access type: "OPEN"; Path: "HKCU\ALLFILESYSTEMOBJECTS") "5Ln7gt9.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\ALLFILESYSTEMOBJECTS") "5Ln7gt9.exe" (Access type: "QUERY"; Path: "HKLM\SOFTWARE\CLASSES\ALLFILESYSTEMOBJECTS") "5Ln7gt9.exe" (Access type: "OPEN"; Path: "HKCU\ALLFILESYSTEMOBJECTS\SHELLEX\ICONHANDLER") "5Ln7gt9.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\ALLFILESYSTEMOBJECTS\SHELLEX\ICONHANDLER") "5Ln7gt9.exe" (Access type: "QUERY"; Path: "HKCU\DIRECTORY") "5Ln7gt9.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\DIRECTORY") "5Ln7gt9.exe" (Access type: "QUERYVAL"; Path: "HKCU\DIRECTORY") "5Ln7gt9.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\DIRECTORY") "5Ln7gt9.exe" (Access type: "OPEN"; Path: "HKCU\DIRECTORY\DOCOBJECT") "5Ln7gt9.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\DIRECTORY\DOCOBJECT") "5Ln7gt9.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\FOLDER") "5Ln7gt9.exe" (Access type: "OPEN"; Path: "HKCU\FOLDER\DOCOBJECT") "5Ln7gt9.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\FOLDER\DOCOBJECT")2d:T12eb,Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00000772-9882-15-000A1F90 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00000772-9882-15-000A1F90 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00000772-9882-16-000A44B9 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00000772-9882-16-000A44B9 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00000772-9882-22-000A681F Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00000772-9882-22-000A681F Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00000772-9882-26-000A24E0 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00000772-9882-26-000A24E0 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00000772-9882-29-000A52B6 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00000772-9882-29-000A52B6 Assembly shows XOR instruction xor eax esp in Stream UID: 00000000-00000772-9882-31-000A2390 Assembly shows XOR instruction xor ecx esp in Stream UID: 00000000-00000772-9882-31-000A2390 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00000772-9882-33-000A2F1D Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00000772-9882-33-000A2F1D Assembly shows XOR instruction xor eax esp in Stream UID: 00000000-00000772-9882-36-000A3BA2 Assembly shows XOR instruction xor ecx esp in Stream UID: 00000000-00000772-9882-36-000A3BA2 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00000772-9882-37-000A3FEF Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00000772-9882-37-000A3FEF Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00000772-9882-40-000A2267 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00000772-9882-40-000A2267 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00000772-9882-41-000A6495 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00000772-9882-41-000A6495 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00000772-9882-42-000A202A Assembly shows XOR instruction xor eax 01h in Stream UID: 00000000-00000772-9882-42-000A202A Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00000772-9882-42-000A202A Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00000772-9882-43-000A1AE8 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00000772-9882-43-000A1AE8 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00000772-9882-44-000A2AAC Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00000772-9882-44-000A2AAC Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00000772-9882-52-000A4EFD Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00000772-9882-52-000A4EFD Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00000772-9882-57-000A6298 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00000772-9882-57-000A6298 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00000772-9882-59-000A621E Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00000772-9882-59-000A621E Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00000772-9882-60-000A597D Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00000772-9882-60-000A597D Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00000772-9882-62-000A55A0 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00000772-9882-62-000A55A0 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00000772-9882-63-000A5467 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00000772-9882-63-000A5467 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00000772-9882-65-000A53A1 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00000772-9882-65-000A53A1 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00000772-9882-66-000A2630 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00000772-9882-66-000A2630 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00000772-9882-71-000A2CAA Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00000772-9882-71-000A2CAA Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00000772-9882-72-000A18A3 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00000772-9882-72-000A18A3 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00000772-9882-73-000A17EE Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00000772-9882-73-000A17EE2e:T50b,Found string ":\Windows\system32\MSVCP140.dll" (Indicator: "\msvcp140.dll"; Source: "00000000-00000176.00000001.82037.00480000.00000004.mdmp") Found string ":\Windows\system32\MSVCP140.dll" (Indicator: "\msvcp140.dll"; Source: "00000000-00000772.00000000.79861.00230000.00000004.mdmp, 00000000-00000772.00000001.80710.00230000.00000004.mdmp") Found string ":\Windows\system32\MSVCP140.dll" (Indicator: "\msvcp140.dll"; Source: "00000000-00001596.00000001.80705.00250000.00000004.mdmp") Found string ":\Windows\system32\MSVCP140.dll" (Indicator: "\msvcp140.dll"; Source: "00000000-00002056.00000000.82391.00270000.00000004.mdmp, 00000000-00002056.00000001.82574.00270000.00000004.mdmp") Found string ":\Windows\system32\MSVCP140.dll" (Indicator: "\msvcp140.dll"; Source: "00000000-00002360.00000000.79712.001B0000.00000004.mdmp, 00000000-00002360.00000002.82587.001B0000.00000004.mdmp") Found string ":\Windows\system32\MSVCP140.dll" (Indicator: "\msvcp140.dll"; Source: "00000000-00003804.00000000.81033.003A0000.00000004.mdmp") Found string ":\Windows\system32\MSVCP140.dll" (Indicator: "\msvcp140.dll"; Source: "00000000-00003856.00000000.79785.001D0000.00000004.mdmp, 00000000-00003856.00000001.81708.001D0000.00000004.mdmp, 00000000-00003856.00000002.82041.001D0000.00000004.mdmp")2f:T210a,Contains base64 string in header "/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEA59dSNcqDdhV39MzSTNbR0" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEA59dSNcqDdhV39MzSTNbR0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.cn" Contains base64 string in header "Keep" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEA59dSNcqDdhV39MzSTNbR0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.cn" Contains base64 string in header "User" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEA59dSNcqDdhV39MzSTNbR0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.cn" Contains base64 string in header "ocsp" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEA59dSNcqDdhV39MzSTNbR0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.cn" Contains base64 string in header "digicert" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEA59dSNcqDdhV39MzSTNbR0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.cn" Contains base64 string in header "2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP" in header "GET /gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "2FUsCEHe9DWzbNvka6iEPxPBY0w0" in header "GET /gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "Keep" in header "GET /gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "User" in header "GET /gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "ocsp" in header "GET /gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "goog" in header "GET /gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "Keep" in header "GET /r/r1.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: c.pki.goog" Contains base64 string in header "User" in header "GET /r/r1.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: c.pki.goog" Contains base64 string in header "goog" in header "GET /r/r1.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: c.pki.goog" Contains base64 string in header "/wr2/9UVbN0w5E6Y" in header "GET /wr2/9UVbN0w5E6Y.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: c.pki.goog" Contains base64 string in header "Keep" in header "GET /wr2/9UVbN0w5E6Y.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: c.pki.goog" Contains base64 string in header "User" in header "GET /wr2/9UVbN0w5E6Y.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: c.pki.goog" Contains base64 string in header "goog" in header "GET /wr2/9UVbN0w5E6Y.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: c.pki.goog" Contains base64 string in header "Keep" in header "GET /r/gsr1.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: c.pki.goog" Contains base64 string in header "User" in header "GET /r/gsr1.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: c.pki.goog" Contains base64 string in header "goog" in header "GET /r/gsr1.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: c.pki.goog" Contains base64 string in header "Keep" in header "GET /r/r4.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: c.pki.goog" Contains base64 string in header "User" in header "GET /r/r4.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: c.pki.goog" Contains base64 string in header "goog" in header "GET /r/r4.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: c.pki.goog" Contains base64 string in header "/we2/yK5nPhtHKQs" in header "GET /we2/yK5nPhtHKQs.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: c.pki.goog" Contains base64 string in header "Keep" in header "GET /we2/yK5nPhtHKQs.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: c.pki.goog" Contains base64 string in header "User" in header "GET /we2/yK5nPhtHKQs.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: c.pki.goog" Contains base64 string in header "goog" in header "GET /we2/yK5nPhtHKQs.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: c.pki.goog" Contains base64 string in header "/we2/Gt0Gl6QoGAU" in header "GET /we2/Gt0Gl6QoGAU.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: c.pki.goog" Contains base64 string in header "Keep" in header "GET /we2/Gt0Gl6QoGAU.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: c.pki.goog" Contains base64 string in header "User" in header "GET /we2/Gt0Gl6QoGAU.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: c.pki.goog" Contains base64 string in header "goog" in header "GET /we2/Gt0Gl6QoGAU.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: c.pki.goog" Contains base64 string in header "Keep" in header "GET /we2/xuzt3PU9F_w.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: c.pki.goog" Contains base64 string in header "User" in header "GET /we2/xuzt3PU9F_w.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: c.pki.goog" Contains base64 string in header "goog" in header "GET /we2/xuzt3PU9F_w.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: c.pki.goog" Contains base64 string in header "Keep" in header "GET /we2/dTM3-0hpWfE.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: c.pki.goog" Contains base64 string in header "User" in header "GET /we2/dTM3-0hpWfE.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: c.pki.goog" Contains base64 string in header "goog" in header "GET /we2/dTM3-0hpWfE.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: c.pki.goog" Contains base64 string in header "/wr2/oBFYYahzgVI" in header "GET /wr2/oBFYYahzgVI.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: c.pki.goog" Contains base64 string in header "Keep" in header "GET /wr2/oBFYYahzgVI.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: c.pki.goog" Contains base64 string in header "User" in header "GET /wr2/oBFYYahzgVI.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: c.pki.goog" Contains base64 string in header "goog" in header "GET /wr2/oBFYYahzgVI.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: c.pki.goog"30:T2ff3,Found XOR loop in file "FI3gq62.exe" at offset 221782; code bytes = 30d0 Found XOR loop in file "FI3gq62.exe" at offset 258559; code bytes = 30d0 Found XOR loop in file "FI3gq62.exe" at offset 356622; code bytes = 30d0 Found XOR loop in file "FI3gq62.exe" at offset 491514; code bytes = 30d0 Found XOR loop in file "FI3gq62.exe" at offset 552535; code bytes = 30d0 Found XOR loop in file "FI3gq62.exe" at offset 683489; code bytes = 30d0 Found XOR loop in file "FI3gq62.exe" at offset 26031; code bytes = 33c1 Found XOR loop in file "FI3gq62.exe" at offset 196373; code bytes = 33c1 Found XOR loop in file "FI3gq62.exe" at offset 213404; code bytes = 33c1 Found XOR loop in file "FI3gq62.exe" at offset 285392; code bytes = 33c1 Found XOR loop in file "FI3gq62.exe" at offset 394673; code bytes = 33c1 Found XOR loop in file "FI3gq62.exe" at offset 479071; code bytes = 33c1 Found XOR loop in file "FI3gq62.exe" at offset 754105; code bytes = 33c1 Found XOR loop in file "FI3gq62.exe" at offset 90891; code bytes = 8030 Found XOR loop in file "FI3gq62.exe" at offset 102399; code bytes = 8030 Found XOR loop in file "FI3gq62.exe" at offset 103104; code bytes = 8030 Found XOR loop in file "FI3gq62.exe" at offset 166839; code bytes = 8030 Found XOR loop in file "FI3gq62.exe" at offset 308366; code bytes = 8030 Found XOR loop in file "FI3gq62.exe" at offset 328036; code bytes = 8030 Found XOR loop in file "FI3gq62.exe" at offset 604118; code bytes = 8030 Found XOR loop in file "FI3gq62.exe" at offset 638088; code bytes = 8030 Found XOR loop in file "FI3gq62.exe" at offset 652899; code bytes = 8030 Found XOR loop in file "db2FL06.exe" at offset 163258; code bytes = 30d0 Found XOR loop in file "db2FL06.exe" at offset 261281; code bytes = 30d0 Found XOR loop in file "db2FL06.exe" at offset 396100; code bytes = 30d0 Found XOR loop in file "db2FL06.exe" at offset 457097; code bytes = 30d0 Found XOR loop in file "db2FL06.exe" at offset 26031; code bytes = 33c1 Found XOR loop in file "db2FL06.exe" at offset 190083; code bytes = 33c1 Found XOR loop in file "db2FL06.exe" at offset 299299; code bytes = 33c1 Found XOR loop in file "db2FL06.exe" at offset 383665; code bytes = 33c1 Found XOR loop in file "db2FL06.exe" at offset 513465; code bytes = 33c1 Found XOR loop in file "db2FL06.exe" at offset 90891; code bytes = 8030 Found XOR loop in file "db2FL06.exe" at offset 102399; code bytes = 8030 Found XOR loop in file "db2FL06.exe" at offset 103104; code bytes = 8030 Found XOR loop in file "db2FL06.exe" at offset 213033; code bytes = 8030 Found XOR loop in file "db2FL06.exe" at offset 232695; code bytes = 8030 Found XOR loop in file "4xl958hh.exe" at offset 13306; code bytes = 30d0 Found XOR loop in file "4xl958hh.exe" at offset 13326; code bytes = 30d0 Found XOR loop in file "4xl958hh.exe" at offset 13353; code bytes = 30d0 Found XOR loop in file "4xl958hh.exe" at offset 13393; code bytes = 30d0 Found XOR loop in file "4xl958hh.exe" at offset 13413; code bytes = 30d0 Found XOR loop in file "4xl958hh.exe" at offset 13461; code bytes = 30d0 Found XOR loop in file "4xl958hh.exe" at offset 13502; code bytes = 30d0 Found XOR loop in file "4xl958hh.exe" at offset 13519; code bytes = 30d0 Found XOR loop in file "4xl958hh.exe" at offset 342301; code bytes = 30d0 Found XOR loop in file "4xl958hh.exe" at offset 344793; code bytes = 30d0 Found XOR loop in file "4xl958hh.exe" at offset 3331; code bytes = 33c1 Found XOR loop in file "4xl958hh.exe" at offset 3391; code bytes = 33c1 Found XOR loop in file "4xl958hh.exe" at offset 3419; code bytes = 33c1 Found XOR loop in file "4xl958hh.exe" at offset 8484; code bytes = 33c1 Found XOR loop in file "4xl958hh.exe" at offset 11234; code bytes = 33c1 Found XOR loop in file "4xl958hh.exe" at offset 137037; code bytes = 8030 Found XOR loop in file "4xl958hh.exe" at offset 170537; code bytes = 8030 Found XOR loop in file "4xl958hh.exe" at offset 171605; code bytes = 8030 Found XOR loop in file "4xl958hh.exe" at offset 171619; code bytes = 8030 Found XOR loop in file "4xl958hh.exe" at offset 173214; code bytes = 8030 Found XOR loop in file "4xl958hh.exe" at offset 173237; code bytes = 8030 Found XOR loop in file "4xl958hh.exe" at offset 344774; code bytes = 8030 Found XOR loop in file "Ta8tZ82.exe" at offset 300300; code bytes = 30d0 Found XOR loop in file "Ta8tZ82.exe" at offset 26031; code bytes = 33c1 Found XOR loop in file "Ta8tZ82.exe" at offset 189064; code bytes = 33c1 Found XOR loop in file "Ta8tZ82.exe" at offset 287873; code bytes = 33c1 Found XOR loop in file "Ta8tZ82.exe" at offset 324025; code bytes = 33c1 Found XOR loop in file "Ta8tZ82.exe" at offset 90891; code bytes = 8030 Found XOR loop in file "Ta8tZ82.exe" at offset 102399; code bytes = 8030 Found XOR loop in file "Ta8tZ82.exe" at offset 103104; code bytes = 8030 Found XOR loop in file "Ta8tZ82.exe" at offset 153466; code bytes = 8030 Found XOR loop in file "2Ev9506.exe" at offset 13306; code bytes = 30d0 Found XOR loop in file "2Ev9506.exe" at offset 13326; code bytes = 30d0 Found XOR loop in file "2Ev9506.exe" at offset 13353; code bytes = 30d0 Found XOR loop in file "2Ev9506.exe" at offset 13393; code bytes = 30d0 Found XOR loop in file "2Ev9506.exe" at offset 13413; code bytes = 30d0 Found XOR loop in file "2Ev9506.exe" at offset 13461; code bytes = 30d0 Found XOR loop in file "2Ev9506.exe" at offset 13502; code bytes = 30d0 Found XOR loop in file "2Ev9506.exe" at offset 13519; code bytes = 30d0 Found XOR loop in file "2Ev9506.exe" at offset 131774; code bytes = 30d0 Found XOR loop in file "2Ev9506.exe" at offset 132489; code bytes = 30d0 Found XOR loop in file "2Ev9506.exe" at offset 300317; code bytes = 30d0 Found XOR loop in file "2Ev9506.exe" at offset 302809; code bytes = 30d0 Found XOR loop in file "2Ev9506.exe" at offset 3331; code bytes = 33c1 Found XOR loop in file "2Ev9506.exe" at offset 3391; code bytes = 33c1 Found XOR loop in file "2Ev9506.exe" at offset 3419; code bytes = 33c1 Found XOR loop in file "2Ev9506.exe" at offset 8484; code bytes = 33c1 Found XOR loop in file "2Ev9506.exe" at offset 11234; code bytes = 33c1 Found XOR loop in file "2Ev9506.exe" at offset 179678; code bytes = 33c1 Found XOR loop in file "2Ev9506.exe" at offset 117633; code bytes = 8030 Found XOR loop in file "2Ev9506.exe" at offset 131913; code bytes = 8030 Found XOR loop in file "2Ev9506.exe" at offset 147082; code bytes = 8030 Found XOR loop in file "2Ev9506.exe" at offset 155764; code bytes = 8030 Found XOR loop in file "2Ev9506.exe" at offset 155845; code bytes = 8030 Found XOR loop in file "2Ev9506.exe" at offset 173958; code bytes = 8030 Found XOR loop in file "2Ev9506.exe" at offset 199281; code bytes = 8030 Found XOR loop in file "2Ev9506.exe" at offset 302790; code bytes = 8030 Found XOR loop in file "3yf84jj.exe" at offset 13306; code bytes = 30d0 Found XOR loop in file "3yf84jj.exe" at offset 13326; code bytes = 30d0 Found XOR loop in file "3yf84jj.exe" at offset 13353; code bytes = 30d0 Found XOR loop in file "3yf84jj.exe" at offset 13393; code bytes = 30d0 Found XOR loop in file "3yf84jj.exe" at offset 13413; code bytes = 30d0 Found XOR loop in file "3yf84jj.exe" at offset 13461; code bytes = 30d0 Found XOR loop in file "3yf84jj.exe" at offset 13502; code bytes = 30d0 Found XOR loop in file "3yf84jj.exe" at offset 13519; code bytes = 30d0 Found XOR loop in file "3yf84jj.exe" at offset 146717; code bytes = 30d0 Found XOR loop in file "3yf84jj.exe" at offset 149209; code bytes = 30d0 Found XOR loop in file "3yf84jj.exe" at offset 3331; code bytes = 33c1 Found XOR loop in file "3yf84jj.exe" at offset 3391; code bytes = 33c1 Found XOR loop in file "3yf84jj.exe" at offset 3419; code bytes = 33c1 Found XOR loop in file "3yf84jj.exe" at offset 8484; code bytes = 33c1 Found XOR loop in file "3yf84jj.exe" at offset 11234; code bytes = 33c1 Found XOR loop in file "3yf84jj.exe" at offset 126539; code bytes = 33c1 Found XOR loop in file "3yf84jj.exe" at offset 134910; code bytes = 33c1 Found XOR loop in file "3yf84jj.exe" at offset 136326; code bytes = 8030 Found XOR loop in file "3yf84jj.exe" at offset 136695; code bytes = 8030 Found XOR loop in file "3yf84jj.exe" at offset 149190; code bytes = 8030 Found XOR loop in file "1xy55nF7.exe" at offset 8856; code bytes = 30d0 Found XOR loop in file "1xy55nF7.exe" at offset 9121; code bytes = 30d0 Found XOR loop in file "1xy55nF7.exe" at offset 9139; code bytes = 30d0 Found XOR loop in file "1xy55nF7.exe" at offset 9169; code bytes = 30d0 Found XOR loop in file "1xy55nF7.exe" at offset 9216; code bytes = 30d0 Found XOR loop in file "1xy55nF7.exe" at offset 9234; code bytes = 30d0 Found XOR loop in file "1xy55nF7.exe" at offset 9257; code bytes = 30d0 Found XOR loop in file "1xy55nF7.exe" at offset 9291; code bytes = 30d0 Found XOR loop in file "1xy55nF7.exe" at offset 9620; code bytes = 30d0 Found XOR loop in file "1xy55nF7.exe" at offset 9669; code bytes = 30d0 Found XOR loop in file "1xy55nF7.exe" at offset 10278; code bytes = 30d0 Found XOR loop in file "1xy55nF7.exe" at offset 12008; code bytes = 30d0 Found XOR loop in file "1xy55nF7.exe" at offset 12128; code bytes = 30d0 Found XOR loop in file "1xy55nF7.exe" at offset 127773; code bytes = 30d0 Found XOR loop in file "1xy55nF7.exe" at offset 130265; code bytes = 30d0 Found XOR loop in file "1xy55nF7.exe" at offset 3331; code bytes = 33c1 Found XOR loop in file "1xy55nF7.exe" at offset 3391; code bytes = 33c1 Found XOR loop in file "1xy55nF7.exe" at offset 3419; code bytes = 33c1 Found XOR loop in file "1xy55nF7.exe" at offset 7663; code bytes = 33c1 Found XOR loop in file "1xy55nF7.exe" at offset 11234; code bytes = 33c1 Found XOR loop in file "1xy55nF7.exe" at offset 130246; code bytes = 8030 Found XOR loop in file "5Ln7gt9.exe" at offset 47568; code bytes = 33c1 Found XOR loop in file "5Ln7gt9.exe" at offset 47590; code bytes = 33c1 Found XOR loop in file "5Ln7gt9.exe" at offset 47612; code bytes = 33c1 Found XOR loop in file "5Ln7gt9.exe" at offset 47684; code bytes = 33c1 Found XOR loop in file "5Ln7gt9.exe" at offset 47780; code bytes = 33c1 Found XOR loop in file "5Ln7gt9.exe" at offset 47889; code bytes = 33c1 Found XOR loop in file "5Ln7gt9.exe" at offset 32194; code bytes = 8030 Found XOR loop in file "5Ln7gt9.exe" at offset 81794; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 317299; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 354084; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 452205; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 587162; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 648216; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 779235; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 26031; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 175492; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 210389; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 291865; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 308921; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 380942; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 490272; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 574719; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 896441; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 90891; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 102399; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 103104; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 223295; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 262331; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 403924; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 423602; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 699832; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 733810; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 748621; code bytes = 803031:T51d,Found string "https://www.youtube.com" (Indicator: "youtube.com"; File: "3fa03f784ec205ddfffcf521bd6cdb53b46ad6ed6fd84ec4ecd85c545c8e2edf") Found string "@shift /0start "" https://www.facebook.com/loginstart "" https://www.youtube.comstart "" https://accounts.google.com" (Indicator: "youtube.com"; File: "90BC.bat") file/memory contains long string with (Indicator: "youtube.com"; File: "supported_browsers_1_.htm") file/memory contains long string with (Indicator: "youtube.com"; File: "VKVIPYO9.txt") file/memory contains long string with (Indicator: "youtube.com"; File: "Y86S100B.txt") file/memory contains long string with (Indicator: "youtube.com"; File: "ZMCFBDAK.txt") file/memory contains long string with (Indicator: "youtube.com"; File: "ULYP033X.txt") file/memory contains long string with (Indicator: "youtube.com"; File: "0QDAPSZ6.txt") file/memory contains long string with (Indicator: "youtube.com"; File: "IWHKX3EJ.txt") Found string "CONSENTWP.2676bayoutube.com/102431383388163210825482504061830633367" (Indicator: "youtube.com"; File: "V6A6BIKD.txt") Found string "accounts.youtube.com" (Indicator: "youtube.com"; File: "PCAP") Found string "www.youtube.com" (Indicator: "youtube.com"; File: "PCAP") file/memory contains long string with (Indicator: "youtube.com"; File: "SSL")32:T7e2,file/memory contains long string with (Indicator: "GetCommandLine"; File: "4xl958hh.exe") file/memory contains long string with (Indicator: "GetCommandLine"; File: "3yf84jj.exe") file/memory contains long string with (Indicator: "GetCommandLine"; File: "1xy55nF7.exe") file/memory contains long string with (Indicator: "GetCommandLine"; File: "5Ln7gt9.exe") Found string "GetCommandLineA" (Indicator: "GetCommandLine"; File: "00001428.00000594.12355538.00424000.wprm") Found string "GetCommandLineW" (Indicator: "GetCommandLine"; File: "00001428.00000594.12355538.00424000.wprm") Found string "GetCursorPos" (Indicator: "GetCursorPos"; File: "00004020.00000FB4.15405603.00402000.wprm") Found string "GetCommandLineA" (Indicator: "GetCommandLine"; Source: "00000000-00000176.00000000.81368.00055000.00000002.mdmp") Found string "GetCommandLineW" (Indicator: "GetCommandLine"; Source: "00000000-00000176.00000000.81368.00055000.00000002.mdmp") Found string "GetCursorPos" (Indicator: "GetCursorPos"; Source: "00000000-00000176.00000001.82037.0005D000.00000004.mdmp") Found string "GetCommandLineA" (Indicator: "GetCommandLine"; Source: "00000000-00001596.00000000.80232.003B5000.00000002.mdmp, 00000000-00001596.00000001.80705.003BD000.00000004.mdmp") Found string "GetCommandLineW" (Indicator: "GetCommandLine"; Source: "00000000-00001596.00000000.80232.003B5000.00000002.mdmp, 00000000-00001596.00000001.80705.003BD000.00000004.mdmp") Found string "GetCommandLineW" (Indicator: "GetCommandLine"; Source: "00000000-00002056.00000000.82391.00417000.00000004.mdmp") Found string "GetCommandLineW" (Indicator: "GetCommandLine"; Source: "00000000-00002360.00000000.79712.001B0000.00000004.mdmp, 00000000-00002360.00000002.82587.001B0000.00000004.mdmp") Found string "GetCommandLineA" (Indicator: "GetCommandLine"; Source: "00000000-00003804.00000000.81033.01375000.00000002.mdmp") Found string "GetCommandLineW" (Indicator: "GetCommandLine"; Source: "00000000-00003804.00000000.81033.01375000.00000002.mdmp")33:T1b94,"3fa03f784ec205ddfffcf521bd6cdb53b46ad6ed6fd84ec4ecd85c545c8e2edf.exe" called "RtlGetVersion" with parameter 140100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00002360) "3fa03f784ec205ddfffcf521bd6cdb53b46ad6ed6fd84ec4ecd85c545c8e2edf.exe" called "RtlGetVersion" with parameter 000000000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00002360) "FI3gq62.exe" called "RtlGetVersion" with parameter 140100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00003856) "FI3gq62.exe" called "RtlGetVersion" with parameter 000000000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00003856) "db2FL06.exe" called "RtlGetVersion" with parameter 140100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00004180) "db2FL06.exe" called "RtlGetVersion" with parameter 000000000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00004180) "Ta8tZ82.exe" called "RtlGetVersion" with parameter 000000000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00000772) "1xy55nF7.exe" called "RtlGetVersion" with parameter 000000000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00004492) "AppLaunch.exe" called "RtlGetVersion" with parameter 140100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00003996) "AppLaunch.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00003996) "AppLaunch.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b002000310000000000000000001400000000000000000000000000000000000000000000000200000288ae3200330000330000000000000000000000008000000000000000934100d2708333000100000000000000020000000c000000580633005806330053063300000000000000000000002c0000000001f8f320000000000018fa200095e17d77926b1a00feffffff435c81775059817794000000a00000005206330050063300940000009cf52000fdfee7757cee20000100000018fa200092e072689415e519feffffff34f520004c9c72685c0c000048f520005f9c72680000000000000000 (UID: 00000000-00003996)34:T8ca,"AppLaunch.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b2031000084063300000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00003996) "AppLaunch.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b2031000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00004020) "AppLaunch.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b203100000000000000000000000000000000000000000000000000000000000000000000b2f4817746e9b377acee29000000e9710000e9710000000000000000f0000000f000e9710000000018ee290000000000acef290000000000010000007cee290040f58177000000000000000068ee2900 (UID: 00000000-00004020) "5Ln7gt9.exe" called "GetVersionExA" with parameter 9c0000000600000001000000b11d00000200000053657276696365205061636b2031000000000000000000000200000000000000d8ebce7510162f0000f0fd7f9a5c827700d0fd7f48ccfa0144f0fd7f00000000400000003f0000002800000000f0fd7f3cccfa01c15c8277608289772800000000f0fd7f9a5c827700d0fd7f60ccfa01578981778083897713179875d8ebce75 (UID: 00000000-00002056) "5Ln7gt9.exe" called "GetVersionExA" with parameter 9c0000000600000001000000b11d00000200000053657276696365205061636b2031000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00002056) "cmd.exe" called "GetVersionExA" with parameter 9c0000000600000001000000b11d00000200000053657276696365205061636b2031000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00000844)35:T81f,"3fa03f784ec205ddfffcf521bd6cdb53b46ad6ed6fd84ec4ecd85c545c8e2edf.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "3fa03f784ec205ddfffcf521bd6cdb53b46ad6ed6fd84ec4ecd85c545c8e2edf.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "FI3gq62.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "FI3gq62.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "db2FL06.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "db2FL06.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "Ta8tZ82.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "Ta8tZ82.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "1xy55nF7.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "1xy55nF7.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "2Ev9506.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "2Ev9506.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "3yf84jj.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "3yf84jj.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "4xl958hh.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "4xl958hh.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "5Ln7gt9.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED")36:T980,Found reference to API "GetWindowText" (Indicator: "GetWindowText"; File: "00004020.00000FB4.15405603.00402000.wprm") Found reference to API "FindWindow" (Indicator: "FindWindow"; File: "00004020.00000FB4.15405603.00402000.wprm") Found reference to API "EnumWindows" (Indicator: "EnumWindows"; File: "3fa03f784ec205ddfffcf521bd6cdb53b46ad6ed6fd84ec4ecd85c545c8e2edf") Found reference to API "GetForegroundWindow" (Indicator: "GetForegroundWindow"; File: "3fa03f784ec205ddfffcf521bd6cdb53b46ad6ed6fd84ec4ecd85c545c8e2edf") Found reference to API "GetWindowTextLengthW" (Indicator: "GetWindowText"; File: "3fa03f784ec205ddfffcf521bd6cdb53b46ad6ed6fd84ec4ecd85c545c8e2edf") Found reference to API "GetWindowTextW" (Indicator: "GetWindowText"; File: "3fa03f784ec205ddfffcf521bd6cdb53b46ad6ed6fd84ec4ecd85c545c8e2edf") Found reference to API "GetWindowText" (Indicator: "GetWindowText"; Source: "00000000-00000176.00000001.82037.0005D000.00000004.mdmp") Found reference to API "FindWindow" (Indicator: "FindWindow"; Source: "00000000-00000176.00000001.82037.0005D000.00000004.mdmp") Found reference to API "GetWindowTextLengthW" (Indicator: "GetWindowText"; Source: "00000000-00002056.00000000.82391.00417000.00000004.mdmp") Found reference to API "GetWindowTextW" (Indicator: "GetWindowText"; Source: "00000000-00002056.00000000.82391.00417000.00000004.mdmp") Found reference to API "GetForegroundWindow" (Indicator: "GetForegroundWindow"; Source: "00000000-00002056.00000000.82391.00417000.00000004.mdmp") Found reference to API "EnumWindows" (Indicator: "EnumWindows"; Source: "00000000-00002056.00000000.82391.00417000.00000004.mdmp") Found reference to API "GetWindowTextLengthW" (Indicator: "GetWindowText"; Source: "00000000-00002360.00000000.79712.001B0000.00000004.mdmp, 00000000-00002360.00000002.82587.001B0000.00000004.mdmp") Found reference to API "GetWindowTextW" (Indicator: "GetWindowText"; Source: "00000000-00002360.00000000.79712.001B0000.00000004.mdmp, 00000000-00002360.00000002.82587.001B0000.00000004.mdmp") Found reference to API "GetForegroundWindow" (Indicator: "GetForegroundWindow"; Source: "00000000-00002360.00000000.79712.001B0000.00000004.mdmp, 00000000-00002360.00000002.82587.001B0000.00000004.mdmp") Found reference to API "EnumWindows" (Indicator: "EnumWindows"; Source: "00000000-00002360.00000000.79712.001B0000.00000004.mdmp, 00000000-00002360.00000002.82587.001B0000.00000004.mdmp")37:T5b0,"AppLaunch.exe" queries volume information of "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe" at 00000000-00003996-0000010C-437870 "AppLaunch.exe" queries volume information of "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe" at 00000000-00004020-0000010C-368874 "AppLaunch.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel\v4.0_4.0.0.0__b77a5c561934e089\System.ServiceModel.dll" at 00000000-00004020-0000010C-4824172 "AppLaunch.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel\v4.0_4.0.0.0__b77a5c561934e089\System.ServiceModel.dll" at 00000000-00004020-0000010C-4829150 "AppLaunch.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel.Internals\v4.0_4.0.0.0__31bf3856ad364e35\System.ServiceModel.Internals.dll" at 00000000-00004020-0000010C-6787611 "AppLaunch.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel.Internals\v4.0_4.0.0.0__31bf3856ad364e35\System.ServiceModel.Internals.dll" at 00000000-00004020-0000010C-6791829 "AppLaunch.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll" at 00000000-00004020-0000010C-7422719 "cmd.exe" queries volume information of an entire harddrive"C:\" at 00000000-00000844-0000010C-54548938:T4a7,file/memory contains long string(File: "4xl958hh.exe") file/memory contains long string(File: "3yf84jj.exe") file/memory contains long string(File: "1xy55nF7.exe") file/memory contains long string(File: "5Ln7gt9.exe") Found string "GetCommandLineA" (Source: "00000000-00000176.00000000.81368.00055000.00000002.mdmp") Found string "GetCommandLineW" (Source: "00000000-00000176.00000000.81368.00055000.00000002.mdmp") Found string "GetCommandLineA" (Source: "00000000-00001596.00000000.80232.003B5000.00000002.mdmp, 00000000-00001596.00000001.80705.003BD000.00000004.mdmp") Found string "GetCommandLineW" (Source: "00000000-00001596.00000000.80232.003B5000.00000002.mdmp, 00000000-00001596.00000001.80705.003BD000.00000004.mdmp") Found string "GetCommandLineW" (Source: "00000000-00002056.00000000.82391.00417000.00000004.mdmp") Found string "GetCommandLineW" (Source: "00000000-00002360.00000000.79712.001B0000.00000004.mdmp, 00000000-00002360.00000002.82587.001B0000.00000004.mdmp") Found string "GetCommandLineA" (Source: "00000000-00003804.00000000.81033.01375000.00000002.mdmp") Found string "GetCommandLineW" (Source: "00000000-00003804.00000000.81033.01375000.00000002.mdmp")39:T5cc,"3fa03f784ec205ddfffcf521bd6cdb53b46ad6ed6fd84ec4ecd85c545c8e2edf.exe" called "CreateProcessA" with parameter "%TEMP%\IXP000.TMP\FI3gq62.exe" - (UID: 00000000-00002360) "3fa03f784ec205ddfffcf521bd6cdb53b46ad6ed6fd84ec4ecd85c545c8e2edf.exe" called "CreateProcessA" with parameter "%TEMP%\IXP000.TMP\5Ln7gt9.exe" - (UID: 00000000-00002360) "FI3gq62.exe" called "CreateProcessA" with parameter "%TEMP%\IXP001.TMP\db2FL06.exe" - (UID: 00000000-00003856) "FI3gq62.exe" called "CreateProcessA" with parameter "%TEMP%\IXP001.TMP\4xl958hh.exe" - (UID: 00000000-00003856) "db2FL06.exe" called "CreateProcessA" with parameter "%TEMP%\IXP002.TMP\Ta8tZ82.exe" - (UID: 00000000-00004180) "db2FL06.exe" called "CreateProcessA" with parameter "%TEMP%\IXP002.TMP\3yf84jj.exe" - (UID: 00000000-00004180) "Ta8tZ82.exe" called "CreateProcessA" with parameter "%TEMP%\IXP003.TMP\1xy55nF7.exe" - (UID: 00000000-00000772) "Ta8tZ82.exe" called "CreateProcessA" with parameter "%TEMP%\IXP003.TMP\2Ev9506.exe" - (UID: 00000000-00000772) "cmd.exe" called "CreateProcessW" with parameter ""%PROGRAMFILES%\Internet Explorer\iexplore.exe" https://www.facebook.com/login" - (UID: 00000000-00000844) "cmd.exe" called "CreateProcessW" with parameter ""%PROGRAMFILES%\Internet Explorer\iexplore.exe" https://www.youtube.com/" - (UID: 00000000-00000844) "cmd.exe" called "CreateProcessW" with parameter ""%PROGRAMFILES%\Internet Explorer\iexplore.exe" https://accounts.google.com/" - (UID: 00000000-00000844)3a:T35ea,"3fa03f784ec205ddfffcf521bd6cdb53b46ad6ed6fd84ec4ecd85c545c8e2edf.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\advpack.dll (UID: 00000000-00002360) "FI3gq62.exe" called "LoadLibrary" with a parameter feclient.dll (UID: 00000000-00003856) "FI3gq62.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\advpack.dll (UID: 00000000-00003856) "db2FL06.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\advpack.dll (UID: 00000000-00004180) "Ta8tZ82.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\advpack.dll (UID: 00000000-00000772) "AppLaunch.exe" called "LoadLibrary" with a parameter mscoree.dll (UID: 00000000-00003996) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\combase.dll (UID: 00000000-00003996) "AppLaunch.exe" called "LoadLibrary" with a parameter psapi.dll (UID: 00000000-00003996) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\mscorlib\36eaccfde177c2e7b93b8dbdde4e012a\mscorlib.ni.dll (UID: 00000000-00003996) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\ole32.dll (UID: 00000000-00003996) "AppLaunch.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00003996) "AppLaunch.exe" called "LoadLibrary" with a parameter api-ms-win-core-xstate-l2-1-0.dll (UID: 00000000-00003996) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\clrjit.dll (UID: 00000000-00003996) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System\2c3c912ea8f058f9d04c4650128feb3f\System.ni.dll (UID: 00000000-00003996) "AppLaunch.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00003996) "AppLaunch.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00003996) "AppLaunch.exe" called "LoadLibrary" with a parameter SspiCli.dll (UID: 00000000-00003996) "AppLaunch.exe" called "LoadLibrary" with a parameter advapi32 (UID: 00000000-00003996) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll (UID: 00000000-00003996) "AppLaunch.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00003996) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\nlssorting.dll (UID: 00000000-00003996) "4xl958hh.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00000176) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\combase.dll (UID: 00000000-00004020) "AppLaunch.exe" called "LoadLibrary" with a parameter psapi.dll (UID: 00000000-00004020) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\mscorlib\36eaccfde177c2e7b93b8dbdde4e012a\mscorlib.ni.dll (UID: 00000000-00004020) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\ole32.dll (UID: 00000000-00004020) "AppLaunch.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00004020) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\uxtheme.dll (UID: 00000000-00004020) "AppLaunch.exe" called "LoadLibrary" with a parameter api-ms-win-core-xstate-l2-1-0.dll (UID: 00000000-00004020) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\clrjit.dll (UID: 00000000-00004020) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System\2c3c912ea8f058f9d04c4650128feb3f\System.ni.dll (UID: 00000000-00004020) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Drawing\f7568d7f1b9d356f64779b4c0927cfb3\System.Drawing.ni.dll (UID: 00000000-00004020) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Windows.Forms\c9a4cbc00f690a9e3cddfc400f6e85bb\System.Windows.Forms.ni.dll (UID: 00000000-00004020) "AppLaunch.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00004020) "AppLaunch.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00004020) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\uxtheme.dll (UID: 00000000-00004020) "AppLaunch.exe" called "LoadLibrary" with a parameter uxtheme.dll (UID: 00000000-00004020) "AppLaunch.exe" called "LoadLibrary" with a parameter user32.dll (UID: 00000000-00004020) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Core\31fae3290fad30c31c98651462d22724\System.Core.ni.dll (UID: 00000000-00004020) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Configuration\96f7edb07b12303f0ec2595c7f3778c7\System.Configuration.ni.dll (UID: 00000000-00004020) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Xml\15af16d373cf0528cb74fc73d365fdbf\System.Xml.ni.dll (UID: 00000000-00004020) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\nlssorting.dll (UID: 00000000-00004020) "AppLaunch.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00004020) "AppLaunch.exe" called "LoadLibrary" with a parameter shell32.dll (UID: 00000000-00004020) "AppLaunch.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00004020) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll (UID: 00000000-00004020) "AppLaunch.exe" called "LoadLibrary" with a parameter bcrypt.dll (UID: 00000000-00004020) "AppLaunch.exe" called "LoadLibrary" with a parameter CRYPTSP.dll (UID: 00000000-00004020) "AppLaunch.exe" called "LoadLibrary" with a parameter CRYPTBASE.dll (UID: 00000000-00004020) "AppLaunch.exe" called "LoadLibrary" with a parameter imm32.dll (UID: 00000000-00004020) "AppLaunch.exe" called "LoadLibrary" with a parameter comctl32.dll (UID: 00000000-00004020) "AppLaunch.exe" called "LoadLibrary" with a parameter gdi32.dll (UID: 00000000-00004020) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\WindowsBase\1a4cc316fb6d09525321fc0be44692d8\WindowsBase.ni.dll (UID: 00000000-00004020) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\PresentationCore\468f4e17be144ca12a73a4297eacc9cc\PresentationCore.ni.dll (UID: 00000000-00004020) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\Presentatio5ae0f00f#\252cc7b0fae8cfe083bdc149957c0c54\PresentationFramework.ni.dll (UID: 00000000-00004020) "AppLaunch.exe" called "LoadLibrary" with a parameter KERNEL32.dll (UID: 00000000-00004020) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\PresentationCore\v4.0_4.0.0.0__31bf3856ad364e35\ucrtbase_clr0400.dll (UID: 00000000-00004020) "AppLaunch.exe" called "LoadLibrary" with a parameter ucrtbase_clr0400.dll (UID: 00000000-00004020) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\PresentationCore\v4.0_4.0.0.0__31bf3856ad364e35\SHLWAPI.dll (UID: 00000000-00004020) "AppLaunch.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00004020) "AppLaunch.exe" called "LoadLibrary" with a parameter dwrite.dll (UID: 00000000-00004020) "AppLaunch.exe" called "LoadLibrary" with a parameter api-ms-win-core-string-l1-1-0 (UID: 00000000-00004020) "AppLaunch.exe" called "LoadLibrary" with a parameter api-ms-win-core-datetime-l1-1-1 (UID: 00000000-00004020) "AppLaunch.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-obsolete-l1-2-0 (UID: 00000000-00004020) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\WPF\wpfgfx_v0400.dll (UID: 00000000-00004020) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\WPF\PresentationNative_v0400.dll (UID: 00000000-00004020) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll (UID: 00000000-00004020) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\en-US\tzres.dll.mui (UID: 00000000-00004020) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\VERSION.dll (UID: 00000000-00004020) "AppLaunch.exe" called "LoadLibrary" with a parameter VERSION.dll (UID: 00000000-00004020) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.ServiceModel\v4.0_4.0.0.0__b77a5c561934e089\System.ServiceModel.dll (UID: 00000000-00004020) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Runteb92aa12#\274e43040c8a7a02ef1065db3283005a\System.Runtime.Serialization. (UID: 00000000-00004020) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.IdentityModel\c2ef5bc545b98a289f02d0b3eddbe280\System.IdentityModel.ni.dll (UID: 00000000-00004020) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\SMDiagnostics\dc67dcb4b2fb4a3853d458cab08561f0\SMDiagnostics.ni.dll (UID: 00000000-00004020) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.ServiceModel.Internals\v4.0_4.0.0.0__31bf3856ad364e35\System.ServiceModel.Intern (UID: 00000000-00004020) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Transactions\3d760b4a3260a41ef84a3fd866780980\System.Transactions.ni.dll (UID: 00000000-00004020) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\clr.dll (UID: 00000000-00004020) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll (UID: 00000000-00004020) "AppLaunch.exe" called "LoadLibrary" with a parameter mscoree.dll (UID: 00000000-00004020) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ws2_32.dll (UID: 00000000-00004020) "AppLaunch.exe" called "LoadLibrary" with a parameter ws2_32.dll (UID: 00000000-00004020) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\diasymreader.dll (UID: 00000000-00004020) "5Ln7gt9.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\uxtheme.dll (UID: 00000000-00002056) "5Ln7gt9.exe" called "LoadLibrary" with a parameter Kernel32.dll (UID: 00000000-00002056) "5Ln7gt9.exe" called "LoadLibrary" with a parameter %TEMP%\IXP000.TMP\5Ln7gt9.exe (UID: 00000000-00002056) "5Ln7gt9.exe" called "LoadLibrary" with a parameter Kernel32.DLL (UID: 00000000-00002056) "5Ln7gt9.exe" called "LoadLibrary" with a parameter SHELL32.dll (UID: 00000000-00002056) "5Ln7gt9.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00002056) "5Ln7gt9.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00002056) "5Ln7gt9.exe" called "LoadLibrary" with a parameter propsys.dll (UID: 00000000-00002056) "5Ln7gt9.exe" called "LoadLibrary" with a parameter comctl32.dll (UID: 00000000-00002056) "5Ln7gt9.exe" called "LoadLibrary" with a parameter ntmarta.dll (UID: 00000000-00002056) "5Ln7gt9.exe" called "LoadLibrary" with a parameter Secur32.dll (UID: 00000000-00002056) "5Ln7gt9.exe" called "LoadLibrary" with a parameter API-MS-WIN-DOWNLEVEL-SHLWAPI-L1-1-0.DLL (UID: 00000000-00002056) "5Ln7gt9.exe" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00002056) "cmd.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\uxtheme.dll (UID: 00000000-00000844) "cmd.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00000844) "cmd.exe" called "LoadLibrary" with a parameter propsys.dll (UID: 00000000-00000844) "cmd.exe" called "LoadLibrary" with a parameter %WINDIR%\System32\ieframe.dll (UID: 00000000-00000844) "cmd.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00000844) "cmd.exe" called "LoadLibrary" with a parameter comctl32.dll (UID: 00000000-00000844) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-downlevel-ole32-l1-1-0.dll (UID: 00000000-00000844) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-downlevel-advapi32-l1-1-0.dll (UID: 00000000-00000844) "cmd.exe" called "LoadLibrary" with a parameter urlmon.dll (UID: 00000000-00000844) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-downlevel-shlwapi-l2-1-0.dll (UID: 00000000-00000844) "cmd.exe" called "LoadLibrary" with a parameter PROPSYS.dll (UID: 00000000-00000844) "cmd.exe" called "LoadLibrary" with a parameter %PROGRAMFILES%\Internet Explorer\ieproxy.dll (UID: 00000000-00000844) "cmd.exe" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00000844) "cmd.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00000844) "cmd.exe" called "LoadLibrary" with a parameter iertutil.dll (UID: 00000000-00000844) "cmd.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00000844) "cmd.exe" called "LoadLibrary" with a parameter API-MS-Win-Core-LocalRegistry-L1-1-0.dll (UID: 00000000-00000844)3b:Tb5db,"3fa03f784ec205ddfffcf521bd6cdb53b46ad6ed6fd84ec4ecd85c545c8e2edf.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00002360) "3fa03f784ec205ddfffcf521bd6cdb53b46ad6ed6fd84ec4ecd85c545c8e2edf.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00002360) "3fa03f784ec205ddfffcf521bd6cdb53b46ad6ed6fd84ec4ecd85c545c8e2edf.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00002360) "3fa03f784ec205ddfffcf521bd6cdb53b46ad6ed6fd84ec4ecd85c545c8e2edf.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00002360) "3fa03f784ec205ddfffcf521bd6cdb53b46ad6ed6fd84ec4ecd85c545c8e2edf.exe" called "GetProcAddress" with a parameter DelNodeRunDLL32 (UID: 00000000-00002360) "3fa03f784ec205ddfffcf521bd6cdb53b46ad6ed6fd84ec4ecd85c545c8e2edf.exe" called "GetProcAddress" with a parameter UnregisterTraceGuids (UID: 00000000-00002360) "FI3gq62.exe" called "GetProcAddress" with a parameter DecryptFileA (UID: 00000000-00003856) "FI3gq62.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00003856) "FI3gq62.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00003856) "FI3gq62.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00003856) "FI3gq62.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00003856) "FI3gq62.exe" called "GetProcAddress" with a parameter FeClientInitialize (UID: 00000000-00003856) "FI3gq62.exe" called "GetProcAddress" with a parameter DelNodeRunDLL32 (UID: 00000000-00003856) "FI3gq62.exe" called "GetProcAddress" with a parameter UnregisterTraceGuids (UID: 00000000-00003856) "db2FL06.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00004180) "db2FL06.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00004180) "db2FL06.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00004180) "db2FL06.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00004180) "db2FL06.exe" called "GetProcAddress" with a parameter DelNodeRunDLL32 (UID: 00000000-00004180) "db2FL06.exe" called "GetProcAddress" with a parameter UnregisterTraceGuids (UID: 00000000-00004180) "Ta8tZ82.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00000772) "Ta8tZ82.exe" called "GetProcAddress" with a parameter DelNodeRunDLL32 (UID: 00000000-00000772) "Ta8tZ82.exe" called "GetProcAddress" with a parameter UnregisterTraceGuids (UID: 00000000-00000772) "AppLaunch.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00003996) "AppLaunch.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00003996) "AppLaunch.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00003996) "AppLaunch.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00003996) "AppLaunch.exe" called "GetProcAddress" with a parameter DecodePointer (UID: 00000000-00003996) "AppLaunch.exe" called "GetProcAddress" with a parameter AddDllDirectory (UID: 00000000-00003996) "AppLaunch.exe" called "GetProcAddress" with a parameter CreateConfigStream (UID: 00000000-00003996) "AppLaunch.exe" called "GetProcAddress" with a parameter CreateConfigStream_RetAddr (UID: 00000000-00003996) "AppLaunch.exe" called "GetProcAddress" with a parameter GetNumaHighestNodeNumber (UID: 00000000-00003996) "AppLaunch.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00003996) "AppLaunch.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00003996) "AppLaunch.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00003996) "AppLaunch.exe" called "GetProcAddress" with a parameter GetSystemWindowsDirectoryW (UID: 00000000-00003996) "AppLaunch.exe" called "GetProcAddress" with a parameter AllocateAndInitializeSid (UID: 00000000-00003996) "AppLaunch.exe" called "GetProcAddress" with a parameter OpenProcessToken (UID: 00000000-00003996) "AppLaunch.exe" called "GetProcAddress" with a parameter GetTokenInformation (UID: 00000000-00003996) "AppLaunch.exe" called "GetProcAddress" with a parameter InitializeAcl (UID: 00000000-00003996) "AppLaunch.exe" called "GetProcAddress" with a parameter AddAccessAllowedAce (UID: 00000000-00003996) "AppLaunch.exe" called "GetProcAddress" with a parameter FreeSid (UID: 00000000-00003996) "AppLaunch.exe" called "GetProcAddress" with a parameter AddSIDToBoundaryDescriptor (UID: 00000000-00003996) "AppLaunch.exe" called "GetProcAddress" with a parameter CreateBoundaryDescriptorW (UID: 00000000-00003996) "AppLaunch.exe" called "GetProcAddress" with a parameter CreatePrivateNamespaceW (UID: 00000000-00003996) "AppLaunch.exe" called "GetProcAddress" with a parameter OpenPrivateNamespaceW (UID: 00000000-00003996) "AppLaunch.exe" called "GetProcAddress" with a parameter DeleteBoundaryDescriptor (UID: 00000000-00003996) "AppLaunch.exe" called "GetProcAddress" with a parameter WerRegisterRuntimeExceptionModule (UID: 00000000-00003996) "AppLaunch.exe" called "GetProcAddress" with a parameter RaiseException (UID: 00000000-00003996) "AppLaunch.exe" called "GetProcAddress" with a parameter EncodePointer (UID: 00000000-00003996) "AppLaunch.exe" called "GetProcAddress" with a parameter SetSystemFileCacheSize (UID: 00000000-00003996) "AppLaunch.exe" called "GetProcAddress" with a parameter NtSetSystemInformation (UID: 00000000-00003996) "AppLaunch.exe" called "GetProcAddress" with a parameter PrivIsDllSynchronizationHeld (UID: 00000000-00003996) "AppLaunch.exe" called "GetProcAddress" with a parameter GetProcessMemoryInfo (UID: 00000000-00003996) "AppLaunch.exe" called "GetProcAddress" with a parameter CoInitializeEx (UID: 00000000-00003996) "AppLaunch.exe" called "GetProcAddress" with a parameter SystemFunction036 (UID: 00000000-00003996) "AppLaunch.exe" called "GetProcAddress" with a parameter GetEnabledXStateFeatures (UID: 00000000-00003996) "AppLaunch.exe" called "GetProcAddress" with a parameter CoGetContextToken (UID: 00000000-00003996) "AppLaunch.exe" called "GetProcAddress" with a parameter sxsJitStartup (UID: 00000000-00003996) "AppLaunch.exe" called "GetProcAddress" with a parameter jitStartup (UID: 00000000-00003996) "AppLaunch.exe" called "GetProcAddress" with a parameter getJit (UID: 00000000-00003996) "AppLaunch.exe" called "GetProcAddress" with a parameter GetUserName (UID: 00000000-00003996) "AppLaunch.exe" called "GetProcAddress" with a parameter GetUserNameA (UID: 00000000-00003996) "AppLaunch.exe" called "GetProcAddress" with a parameter WideCharToMultiByte (UID: 00000000-00003996) "AppLaunch.exe" called "GetProcAddress" with a parameter GetUserNameExA (UID: 00000000-00003996) "AppLaunch.exe" called "GetProcAddress" with a parameter OpenSCManagerW (UID: 00000000-00003996) "AppLaunch.exe" called "GetProcAddress" with a parameter OpenServiceA (UID: 00000000-00003996) "AppLaunch.exe" called "GetProcAddress" with a parameter StartService (UID: 00000000-00003996) "AppLaunch.exe" called "GetProcAddress" with a parameter StartServiceA (UID: 00000000-00003996) "AppLaunch.exe" called "GetProcAddress" with a parameter CloseHandle (UID: 00000000-00003996) "AppLaunch.exe" called "GetProcAddress" with a parameter CloseHandleW (UID: 00000000-00003996) "AppLaunch.exe" called "GetProcAddress" with a parameter LookupPrivilegeValue (UID: 00000000-00003996) "AppLaunch.exe" called "GetProcAddress" with a parameter LookupPrivilegeValueW (UID: 00000000-00003996) "AppLaunch.exe" called "GetProcAddress" with a parameter GetCurrentProcess (UID: 00000000-00003996) "AppLaunch.exe" called "GetProcAddress" with a parameter OpenProcessTokenW (UID: 00000000-00003996) "AppLaunch.exe" called "GetProcAddress" with a parameter AdjustTokenPrivileges (UID: 00000000-00003996) "AppLaunch.exe" called "GetProcAddress" with a parameter AdjustTokenPrivilegesW (UID: 00000000-00003996) "AppLaunch.exe" called "GetProcAddress" with a parameter NtQuerySystemInformation (UID: 00000000-00003996) "AppLaunch.exe" called "GetProcAddress" with a parameter NtQuerySystemInformationW (UID: 00000000-00003996) "AppLaunch.exe" called "GetProcAddress" with a parameter OpenProcess (UID: 00000000-00003996) "AppLaunch.exe" called "GetProcAddress" with a parameter OpenProcessW (UID: 00000000-00003996) "AppLaunch.exe" called "GetProcAddress" with a parameter GetExitCodeProcess (UID: 00000000-00003996) "AppLaunch.exe" called "GetProcAddress" with a parameter GetExitCodeProcessW (UID: 00000000-00003996) "AppLaunch.exe" called "GetProcAddress" with a parameter ImpersonateLoggedOnUser (UID: 00000000-00003996) "AppLaunch.exe" called "GetProcAddress" with a parameter ControlService (UID: 00000000-00003996) "AppLaunch.exe" called "GetProcAddress" with a parameter ChangeServiceConfig (UID: 00000000-00003996) "AppLaunch.exe" called "GetProcAddress" with a parameter ChangeServiceConfigA (UID: 00000000-00003996) "AppLaunch.exe" called "GetProcAddress" with a parameter CoTaskMemFree (UID: 00000000-00003996) "AppLaunch.exe" called "GetProcAddress" with a parameter RegCloseKey (UID: 00000000-00003996) "AppLaunch.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00003996) "AppLaunch.exe" called "GetProcAddress" with a parameter LocaleNameToLCID (UID: 00000000-00003996) "AppLaunch.exe" called "GetProcAddress" with a parameter GetUserDefaultLocaleName (UID: 00000000-00003996) "AppLaunch.exe" called "GetProcAddress" with a parameter LCIDToLocaleName (UID: 00000000-00003996) "AppLaunch.exe" called "GetProcAddress" with a parameter GetUserPreferredUILanguages (UID: 00000000-00003996) "AppLaunch.exe" called "GetProcAddress" with a parameter SortGetHandle (UID: 00000000-00003996) "AppLaunch.exe" called "GetProcAddress" with a parameter SortCloseHandle (UID: 00000000-00003996) "AppLaunch.exe" called "GetProcAddress" with a parameter RegOpenKeyEx (UID: 00000000-00003996) "AppLaunch.exe" called "GetProcAddress" with a parameter RegOpenKeyExW (UID: 00000000-00003996) "AppLaunch.exe" called "GetProcAddress" with a parameter RegCreateKeyEx (UID: 00000000-00003996) "AppLaunch.exe" called "GetProcAddress" with a parameter RegCreateKeyExW (UID: 00000000-00003996) "AppLaunch.exe" called "GetProcAddress" with a parameter RegQueryValueEx (UID: 00000000-00003996) "AppLaunch.exe" called "GetProcAddress" with a parameter RegQueryValueExW (UID: 00000000-00003996) "AppLaunch.exe" called "GetProcAddress" with a parameter RegSetValueEx (UID: 00000000-00003996) "AppLaunch.exe" called "GetProcAddress" with a parameter RegSetValueExW (UID: 00000000-00003996) "AppLaunch.exe" called "GetProcAddress" with a parameter EventRegister (UID: 00000000-00003996) "AppLaunch.exe" called "GetProcAddress" with a parameter GetProcessExecutableHeap (UID: 00000000-00003996) "AppLaunch.exe" called "GetProcAddress" with a parameter GetProcessExecutableHeap_RetAddr (UID: 00000000-00003996) "AppLaunch.exe" called "GetProcAddress" with a parameter EventUnregister (UID: 00000000-00003996) "AppLaunch.exe" called "GetProcAddress" with a parameter CoUninitialize (UID: 00000000-00003996) "AppLaunch.exe" called "GetProcAddress" with a parameter CreateActCtxW (UID: 00000000-00003996) "AppLaunch.exe" called "GetProcAddress" with a parameter AddRefActCtx (UID: 00000000-00003996) "AppLaunch.exe" called "GetProcAddress" with a parameter ReleaseActCtx (UID: 00000000-00003996) "AppLaunch.exe" called "GetProcAddress" with a parameter ActivateActCtx (UID: 00000000-00003996) "AppLaunch.exe" called "GetProcAddress" with a parameter DeactivateActCtx (UID: 00000000-00003996) "AppLaunch.exe" called "GetProcAddress" with a parameter GetCurrentActCtx (UID: 00000000-00003996) "AppLaunch.exe" called "GetProcAddress" with a parameter QueryActCtxW (UID: 00000000-00003996) "AppLaunch.exe" called "GetProcAddress" with a parameter UnregisterTraceGuids (UID: 00000000-00003996) "2Ev9506.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00001596) "2Ev9506.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00001596) "2Ev9506.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00001596) "2Ev9506.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00001596) "3yf84jj.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00003804) "3yf84jj.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00003804) "3yf84jj.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00003804) "3yf84jj.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00003804) "AppLaunch.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00003808) "AppLaunch.exe" called "GetProcAddress" with a parameter UnregisterTraceGuids (UID: 00000000-00003808) "4xl958hh.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00000176) "4xl958hh.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00000176) "4xl958hh.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00000176) "4xl958hh.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00000176) "4xl958hh.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00000176) "4xl958hh.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00000176) "4xl958hh.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00000176) "4xl958hh.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00000176) "4xl958hh.exe" called "GetProcAddress" with a parameter GetTempPath2W (UID: 00000000-00000176) "AppLaunch.exe" called "GetProcAddress" with a parameter DecodePointer (UID: 00000000-00004020) "AppLaunch.exe" called "GetProcAddress" with a parameter GetSystemWindowsDirectoryW (UID: 00000000-00004020) "AppLaunch.exe" called "GetProcAddress" with a parameter AllocateAndInitializeSid (UID: 00000000-00004020) "AppLaunch.exe" called "GetProcAddress" with a parameter OpenProcessToken (UID: 00000000-00004020) "AppLaunch.exe" called "GetProcAddress" with a parameter GetTokenInformation (UID: 00000000-00004020) "AppLaunch.exe" called "GetProcAddress" with a parameter InitializeAcl (UID: 00000000-00004020) "AppLaunch.exe" called "GetProcAddress" with a parameter AddAccessAllowedAce (UID: 00000000-00004020) "AppLaunch.exe" called "GetProcAddress" with a parameter FreeSid (UID: 00000000-00004020) "AppLaunch.exe" called "GetProcAddress" with a parameter AddSIDToBoundaryDescriptor (UID: 00000000-00004020) "AppLaunch.exe" called "GetProcAddress" with a parameter CreateBoundaryDescriptorW (UID: 00000000-00004020) "AppLaunch.exe" called "GetProcAddress" with a parameter CreatePrivateNamespaceW (UID: 00000000-00004020) "AppLaunch.exe" called "GetProcAddress" with a parameter OpenPrivateNamespaceW (UID: 00000000-00004020) "AppLaunch.exe" called "GetProcAddress" with a parameter DeleteBoundaryDescriptor (UID: 00000000-00004020) "AppLaunch.exe" called "GetProcAddress" with a parameter WerRegisterRuntimeExceptionModule (UID: 00000000-00004020) "AppLaunch.exe" called "GetProcAddress" with a parameter RaiseException (UID: 00000000-00004020) "AppLaunch.exe" called "GetProcAddress" with a parameter EncodePointer (UID: 00000000-00004020) "AppLaunch.exe" called "GetProcAddress" with a parameter SetSystemFileCacheSize (UID: 00000000-00004020) "AppLaunch.exe" called "GetProcAddress" with a parameter NtSetSystemInformation (UID: 00000000-00004020) "AppLaunch.exe" called "GetProcAddress" with a parameter PrivIsDllSynchronizationHeld (UID: 00000000-00004020) "AppLaunch.exe" called "GetProcAddress" with a parameter AddDllDirectory (UID: 00000000-00004020) "AppLaunch.exe" called "GetProcAddress" with a parameter GetProcessMemoryInfo (UID: 00000000-00004020) "AppLaunch.exe" called "GetProcAddress" with a parameter CoInitializeEx (UID: 00000000-00004020) "AppLaunch.exe" called "GetProcAddress" with a parameter SystemFunction036 (UID: 00000000-00004020) "AppLaunch.exe" called "GetProcAddress" with a parameter ThemeInitApiHook (UID: 00000000-00004020) "AppLaunch.exe" called "GetProcAddress" with a parameter IsProcessDPIAware (UID: 00000000-00004020) "AppLaunch.exe" called "GetProcAddress" with a parameter CoGetContextToken (UID: 00000000-00004020) "AppLaunch.exe" called "GetProcAddress" with a parameter GetEnabledXStateFeatures (UID: 00000000-00004020) "AppLaunch.exe" called "GetProcAddress" with a parameter sxsJitStartup (UID: 00000000-00004020) "AppLaunch.exe" called "GetProcAddress" with a parameter jitStartup (UID: 00000000-00004020) "AppLaunch.exe" called "GetProcAddress" with a parameter getJit (UID: 00000000-00004020) "AppLaunch.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00004020) "AppLaunch.exe" called "GetProcAddress" with a parameter LocaleNameToLCID (UID: 00000000-00004020) "AppLaunch.exe" called "GetProcAddress" with a parameter GetUserDefaultLocaleName (UID: 00000000-00004020) "AppLaunch.exe" called "GetProcAddress" with a parameter LCIDToLocaleName (UID: 00000000-00004020) "AppLaunch.exe" called "GetProcAddress" with a parameter GetUserPreferredUILanguages (UID: 00000000-00004020) "AppLaunch.exe" called "GetProcAddress" with a parameter RegCloseKey (UID: 00000000-00004020) "AppLaunch.exe" called "GetProcAddress" with a parameter RegOpenKeyEx (UID: 00000000-00004020) "AppLaunch.exe" called "GetProcAddress" with a parameter RegOpenKeyExW (UID: 00000000-00004020) "AppLaunch.exe" called "GetProcAddress" with a parameter GetFullPathName (UID: 00000000-00004020) "AppLaunch.exe" called "GetProcAddress" with a parameter GetFullPathNameW (UID: 00000000-00004020) "AppLaunch.exe" called "GetProcAddress" with a parameter IsAppThemed (UID: 00000000-00004020) "AppLaunch.exe" called "GetProcAddress" with a parameter IsAppThemedW (UID: 00000000-00004020) "AppLaunch.exe" called "GetProcAddress" with a parameter CreateActCtx (UID: 00000000-00004020) "AppLaunch.exe" called "GetProcAddress" with a parameter CreateActCtxA (UID: 00000000-00004020) "AppLaunch.exe" called "GetProcAddress" with a parameter CoTaskMemAlloc (UID: 00000000-00004020) "AppLaunch.exe" called "GetProcAddress" with a parameter CoTaskMemFree (UID: 00000000-00004020) "AppLaunch.exe" called "GetProcAddress" with a parameter RegisterWindowMessage (UID: 00000000-00004020) "AppLaunch.exe" called "GetProcAddress" with a parameter RegisterWindowMessageW (UID: 00000000-00004020) "AppLaunch.exe" called "GetProcAddress" with a parameter CompareStringOrdinal (UID: 00000000-00004020) "AppLaunch.exe" called "GetProcAddress" with a parameter CloseHandle (UID: 00000000-00004020) "AppLaunch.exe" called "GetProcAddress" with a parameter GetCurrentProcess (UID: 00000000-00004020) "AppLaunch.exe" called "GetProcAddress" with a parameter GetCurrentProcessW (UID: 00000000-00004020) "AppLaunch.exe" called "GetProcAddress" with a parameter OpenProcessTokenW (UID: 00000000-00004020) "AppLaunch.exe" called "GetProcAddress" with a parameter SortGetHandle (UID: 00000000-00004020) "AppLaunch.exe" called "GetProcAddress" with a parameter SortCloseHandle (UID: 00000000-00004020) "AppLaunch.exe" called "GetProcAddress" with a parameter NtQuerySystemInformation (UID: 00000000-00004020) "AppLaunch.exe" called "GetProcAddress" with a parameter GetFileAttributesEx (UID: 00000000-00004020) "AppLaunch.exe" called "GetProcAddress" with a parameter GetFileAttributesExW (UID: 00000000-00004020) "AppLaunch.exe" called "GetProcAddress" with a parameter SetThreadErrorMode (UID: 00000000-00004020) "AppLaunch.exe" called "GetProcAddress" with a parameter CreateFile (UID: 00000000-00004020) "AppLaunch.exe" called "GetProcAddress" with a parameter CreateFileW (UID: 00000000-00004020) "AppLaunch.exe" called "GetProcAddress" with a parameter GetFileType (UID: 00000000-00004020) "AppLaunch.exe" called "GetProcAddress" with a parameter ConvertSidToStringSidW (UID: 00000000-00004020) "AppLaunch.exe" called "GetProcAddress" with a parameter SHGetFolderPathW (UID: 00000000-00004020) "AppLaunch.exe" called "GetProcAddress" with a parameter StringFromGUID2 (UID: 00000000-00004020) "AppLaunch.exe" called "GetProcAddress" with a parameter OpenThreadToken (UID: 00000000-00004020) "AppLaunch.exe" called "GetProcAddress" with a parameter GetProcessExecutableHeap (UID: 00000000-00004020) "AppLaunch.exe" called "GetProcAddress" with a parameter GetProcessExecutableHeap_RetAddr (UID: 00000000-00004020) "AppLaunch.exe" called "GetProcAddress" with a parameter BCryptGetFipsAlgorithmMode (UID: 00000000-00004020) "AppLaunch.exe" called "GetProcAddress" with a parameter CryptGetDefaultProviderW (UID: 00000000-00004020) "AppLaunch.exe" called "GetProcAddress" with a parameter CryptAcquireContextW (UID: 00000000-00004020) "AppLaunch.exe" called "GetProcAddress" with a parameter CPAcquireContext (UID: 00000000-00004020) "AppLaunch.exe" called "GetProcAddress" with a parameter CPReleaseContext (UID: 00000000-00004020) "AppLaunch.exe" called "GetProcAddress" with a parameter CPGenKey (UID: 00000000-00004020) "AppLaunch.exe" called "GetProcAddress" with a parameter CPDeriveKey (UID: 00000000-00004020) "AppLaunch.exe" called "GetProcAddress" with a parameter CPDestroyKey (UID: 00000000-00004020) "AppLaunch.exe" called "GetProcAddress" with a parameter CPSetKeyParam (UID: 00000000-00004020) "AppLaunch.exe" called "GetProcAddress" with a parameter CPGetKeyParam (UID: 00000000-00004020) "AppLaunch.exe" called "GetProcAddress" with a parameter CPExportKey (UID: 00000000-00004020) "AppLaunch.exe" called "GetProcAddress" with a parameter CPImportKey (UID: 00000000-00004020) "AppLaunch.exe" called "GetProcAddress" with a parameter CPEncrypt (UID: 00000000-00004020) "AppLaunch.exe" called "GetProcAddress" with a parameter CPDecrypt (UID: 00000000-00004020) "AppLaunch.exe" called "GetProcAddress" with a parameter CPCreateHash (UID: 00000000-00004020) "AppLaunch.exe" called "GetProcAddress" with a parameter CPHashData (UID: 00000000-00004020) "AppLaunch.exe" called "GetProcAddress" with a parameter CPHashSessionKey (UID: 00000000-00004020) "AppLaunch.exe" called "GetProcAddress" with a parameter CPDestroyHash (UID: 00000000-00004020) "AppLaunch.exe" called "GetProcAddress" with a parameter CPSignHash (UID: 00000000-00004020) "AppLaunch.exe" called "GetProcAddress" with a parameter CPVerifySignature (UID: 00000000-00004020) "AppLaunch.exe" called "GetProcAddress" with a parameter CPGenRandom (UID: 00000000-00004020) "AppLaunch.exe" called "GetProcAddress" with a parameter CPGetUserKey (UID: 00000000-00004020) "AppLaunch.exe" called "GetProcAddress" with a parameter CPSetProvParam (UID: 00000000-00004020) "AppLaunch.exe" called "GetProcAddress" with a parameter CPGetProvParam (UID: 00000000-00004020) "AppLaunch.exe" called "GetProcAddress" with a parameter CPSetHashParam (UID: 00000000-00004020) "AppLaunch.exe" called "GetProcAddress" with a parameter CPGetHashParam (UID: 00000000-00004020) "AppLaunch.exe" called "GetProcAddress" with a parameter CPDuplicateKey (UID: 00000000-00004020) "AppLaunch.exe" called "GetProcAddress" with a parameter CPDuplicateHash (UID: 00000000-00004020) "AppLaunch.exe" called "GetProcAddress" with a parameter EqualSid (UID: 00000000-00004020) "AppLaunch.exe" called "GetProcAddress" with a parameter CryptGenRandom (UID: 00000000-00004020) "AppLaunch.exe" called "GetProcAddress" with a parameter GetFileSize (UID: 00000000-00004020) "AppLaunch.exe" called "GetProcAddress" with a parameter ReadFile (UID: 00000000-00004020) "AppLaunch.exe" called "GetProcAddress" with a parameter GetSystemMetrics (UID: 00000000-00004020) "AppLaunch.exe" called "GetProcAddress" with a parameter GetModuleHandle (UID: 00000000-00004020) "AppLaunch.exe" called "GetProcAddress" with a parameter GetModuleHandleW (UID: 00000000-00004020) "AppLaunch.exe" called "GetProcAddress" with a parameter GetProcAddress (UID: 00000000-00004020) "AppLaunch.exe" called "GetProcAddress" with a parameter WideCharToMultiByte (UID: 00000000-00004020) "AppLaunch.exe" called "GetProcAddress" with a parameter LoadLibraryEx (UID: 00000000-00004020) "AppLaunch.exe" called "GetProcAddress" with a parameter LoadLibraryExW (UID: 00000000-00004020) "AppLaunch.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00004020) "AppLaunch.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00004020) "AppLaunch.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00004020) "AppLaunch.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00004020) "AppLaunch.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionAndSpinCount (UID: 00000000-00004020) "AppLaunch.exe" called "GetProcAddress" with a parameter ProcessIdToSessionId (UID: 00000000-00004020) "AppLaunch.exe" called "GetProcAddress" with a parameter ImmCreateContext (UID: 00000000-00004020) "AppLaunch.exe" called "GetProcAddress" with a parameter ImmDestroyContext (UID: 00000000-00004020) "AppLaunch.exe" called "GetProcAddress" with a parameter ImmNotifyIME (UID: 00000000-00004020) "AppLaunch.exe" called "GetProcAddress" with a parameter ImmAssociateContext (UID: 00000000-00004020) "AppLaunch.exe" called "GetProcAddress" with a parameter ImmReleaseContext (UID: 00000000-00004020) "AppLaunch.exe" called "GetProcAddress" with a parameter ImmGetContext (UID: 00000000-00004020) "AppLaunch.exe" called "GetProcAddress" with a parameter ImmGetCompositionStringA (UID: 00000000-00004020) "AppLaunch.exe" called "GetProcAddress" with a parameter ImmSetCompositionStringA (UID: 00000000-00004020) "AppLaunch.exe" called "GetProcAddress" with a parameter ImmGetCompositionStringW (UID: 00000000-00004020) "AppLaunch.exe" called "GetProcAddress" with a parameter ImmSetCompositionStringW (UID: 00000000-00004020) "AppLaunch.exe" called "GetProcAddress" with a parameter ImmSetCandidateWindow (UID: 00000000-00004020) "AppLaunch.exe" called "GetProcAddress" with a parameter AdjustWindowRectEx (UID: 00000000-00004020) "AppLaunch.exe" called "GetProcAddress" with a parameter GetCurrentThread (UID: 00000000-00004020) "AppLaunch.exe" called "GetProcAddress" with a parameter DuplicateHandle (UID: 00000000-00004020) "AppLaunch.exe" called "GetProcAddress" with a parameter GetCurrentThreadId (UID: 00000000-00004020) "AppLaunch.exe" called "GetProcAddress" with a parameter GetCurrentActCtx (UID: 00000000-00004020) "AppLaunch.exe" called "GetProcAddress" with a parameter ActivateActCtx (UID: 00000000-00004020) "AppLaunch.exe" called "GetProcAddress" with a parameter DefWindowProcW (UID: 00000000-00004020) "AppLaunch.exe" called "GetProcAddress" with a parameter GetStockObject (UID: 00000000-00004020) "AppLaunch.exe" called "GetProcAddress" with a parameter RegisterClass (UID: 00000000-00004020) "AppLaunch.exe" called "GetProcAddress" with a parameter RegisterClassW (UID: 00000000-00004020) "AppLaunch.exe" called "GetProcAddress" with a parameter CreateWindowEx (UID: 00000000-00004020) "AppLaunch.exe" called "GetProcAddress" with a parameter CreateWindowExW (UID: 00000000-00004020) "AppLaunch.exe" called "GetProcAddress" with a parameter SetWindowLong (UID: 00000000-00004020) "AppLaunch.exe" called "GetProcAddress" with a parameter SetWindowLongW (UID: 00000000-00004020) "AppLaunch.exe" called "GetProcAddress" with a parameter GetWindowLong (UID: 00000000-00004020) "AppLaunch.exe" called "GetProcAddress" with a parameter GetWindowLongW (UID: 00000000-00004020) "AppLaunch.exe" called "GetProcAddress" with a parameter RegQueryValueEx (UID: 00000000-00004020) "AppLaunch.exe" called "GetProcAddress" with a parameter RegQueryValueExW (UID: 00000000-00004020) "AppLaunch.exe" called "GetProcAddress" with a parameter CallWindowProc (UID: 00000000-00004020) "AppLaunch.exe" called "GetProcAddress" with a parameter CallWindowProcW (UID: 00000000-00004020) "AppLaunch.exe" called "GetProcAddress" with a parameter GetClientRect (UID: 00000000-00004020) "AppLaunch.exe" called "GetProcAddress" with a parameter GetWindowRect (UID: 00000000-00004020) "AppLaunch.exe" called "GetProcAddress" with a parameter GetParent (UID: 00000000-00004020) "AppLaunch.exe" called "GetProcAddress" with a parameter DeactivateActCtx (UID: 00000000-00004020) "AppLaunch.exe" called "GetProcAddress" with a parameter CryptImportKey (UID: 00000000-00004020) "AppLaunch.exe" called "GetProcAddress" with a parameter CryptExportKey (UID: 00000000-00004020) "AppLaunch.exe" called "GetProcAddress" with a parameter CryptCreateHash (UID: 00000000-00004020) "AppLaunch.exe" called "GetProcAddress" with a parameter CryptHashData (UID: 00000000-00004020) "AppLaunch.exe" called "GetProcAddress" with a parameter CryptGetHashParam (UID: 00000000-00004020) "AppLaunch.exe" called "GetProcAddress" with a parameter CryptDestroyHash (UID: 00000000-00004020) "AppLaunch.exe" called "GetProcAddress" with a parameter CryptDestroyKey (UID: 00000000-00004020) "AppLaunch.exe" called "GetProcAddress" with a parameter LocalAlloc (UID: 00000000-00004020) "AppLaunch.exe" called "GetProcAddress" with a parameter _calloc_base (UID: 00000000-00004020) "AppLaunch.exe" called "GetProcAddress" with a parameter InitializeSListHead (UID: 00000000-00004020) "AppLaunch.exe" called "GetProcAddress" with a parameter malloc (UID: 00000000-00004020) "AppLaunch.exe" called "GetProcAddress" with a parameter SetProcessDPIAware (UID: 00000000-00004020) "AppLaunch.exe" called "GetProcAddress" with a parameter GetEnvironmentVariableW (UID: 00000000-00004020) "AppLaunch.exe" called "GetProcAddress" with a parameter PathAppendW (UID: 00000000-00004020) "AppLaunch.exe" called "GetProcAddress" with a parameter DWriteCreateFactory (UID: 00000000-00004020) "AppLaunch.exe" called "GetProcAddress" with a parameter PathCombineW (UID: 00000000-00004020) "AppLaunch.exe" called "GetProcAddress" with a parameter LoadLibraryW (UID: 00000000-00004020) "AppLaunch.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00004020) "AppLaunch.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00004020) "AppLaunch.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00004020) "AppLaunch.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00004020) "AppLaunch.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00004020) "AppLaunch.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00004020) "AppLaunch.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00004020) "AppLaunch.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00004020) "AppLaunch.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00004020) "AppLaunch.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00004020) "AppLaunch.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00004020) "AppLaunch.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00004020) "AppLaunch.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00004020) "AppLaunch.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00004020) "AppLaunch.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00004020) "AppLaunch.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00004020) "AppLaunch.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00004020) "AppLaunch.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00004020) "AppLaunch.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00004020) "AppLaunch.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00004020) "AppLaunch.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00004020) "AppLaunch.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00004020) "AppLaunch.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00004020) "AppLaunch.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00004020) "AppLaunch.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00004020) "AppLaunch.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00004020) "AppLaunch.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00004020) "AppLaunch.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00004020) "AppLaunch.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00004020) "AppLaunch.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00004020) "AppLaunch.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00004020) "AppLaunch.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00004020) "AppLaunch.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00004020) "AppLaunch.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00004020) "AppLaunch.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00004020) "AppLaunch.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00004020) "AppLaunch.exe" called "GetProcAddress" with a parameter EnumSystemLocalesEx (UID: 00000000-00004020) "AppLaunch.exe" called "GetProcAddress" with a parameter GetDateFormatEx (UID: 00000000-00004020) "AppLaunch.exe" called "GetProcAddress" with a parameter GetTimeFormatEx (UID: 00000000-00004020) "AppLaunch.exe" called "GetProcAddress" with a parameter IsValidLocaleName (UID: 00000000-00004020) "AppLaunch.exe" called "GetProcAddress" with a parameter GdiEntry13 (UID: 00000000-00004020) "AppLaunch.exe" called "GetProcAddress" with a parameter EventWrite (UID: 00000000-00004020) "AppLaunch.exe" called "GetProcAddress" with a parameter EventRegister (UID: 00000000-00004020) "AppLaunch.exe" called "GetProcAddress" with a parameter EventUnregister (UID: 00000000-00004020) "AppLaunch.exe" called "GetProcAddress" with a parameter GetDynamicTimeZoneInformation (UID: 00000000-00004020) "AppLaunch.exe" called "GetProcAddress" with a parameter SHGetFolderPath (UID: 00000000-00004020) "AppLaunch.exe" called "GetProcAddress" with a parameter GetFileMUIPath (UID: 00000000-00004020) "AppLaunch.exe" called "GetProcAddress" with a parameter FreeLibrary (UID: 00000000-00004020) "AppLaunch.exe" called "GetProcAddress" with a parameter FreeLibraryW (UID: 00000000-00004020) "AppLaunch.exe" called "GetProcAddress" with a parameter LoadStringW (UID: 00000000-00004020) "AppLaunch.exe" called "GetProcAddress" with a parameter GetFileVersionInfoSizeW (UID: 00000000-00004020) "AppLaunch.exe" called "GetProcAddress" with a parameter GetFileVersionInfoW (UID: 00000000-00004020) "AppLaunch.exe" called "GetProcAddress" with a parameter VerQueryValueW (UID: 00000000-00004020) "AppLaunch.exe" called "GetProcAddress" with a parameter CryptAcquireContextA (UID: 00000000-00004020) "AppLaunch.exe" called "GetProcAddress" with a parameter CryptReleaseContext (UID: 00000000-00004020) "5Ln7gt9.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00002056) "5Ln7gt9.exe" called "GetProcAddress" with a parameter SystemFunction036 (UID: 00000000-00002056) "5Ln7gt9.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00002056) "5Ln7gt9.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00002056) "5Ln7gt9.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00002056) "5Ln7gt9.exe" called "GetProcAddress" with a parameter ThemeInitApiHook (UID: 00000000-00002056) "5Ln7gt9.exe" called "GetProcAddress" with a parameter IsProcessDPIAware (UID: 00000000-00002056) "5Ln7gt9.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00002056) "5Ln7gt9.exe" called "GetProcAddress" with a parameter GetLongPathNameW (UID: 00000000-00002056) "5Ln7gt9.exe" called "GetProcAddress" with a parameter SetSystemFileCacheSize (UID: 00000000-00002056) "5Ln7gt9.exe" called "GetProcAddress" with a parameter NtSetSystemInformation (UID: 00000000-00002056) "5Ln7gt9.exe" called "GetProcAddress" with a parameter PrivIsDllSynchronizationHeld (UID: 00000000-00002056) "5Ln7gt9.exe" called "GetProcAddress" with a parameter SHGetInstanceExplorer (UID: 00000000-00002056) "5Ln7gt9.exe" called "GetProcAddress" with a parameter OleInitialize (UID: 00000000-00002056) "5Ln7gt9.exe" called "GetProcAddress" with a parameter CreateBindCtx (UID: 00000000-00002056) "5Ln7gt9.exe" called "GetProcAddress" with a parameter CoTaskMemAlloc (UID: 00000000-00002056) "5Ln7gt9.exe" called "GetProcAddress" with a parameter RegisterTraceGuidsW (UID: 00000000-00002056) "5Ln7gt9.exe" called "GetProcAddress" with a parameter EventRegister (UID: 00000000-00002056) "5Ln7gt9.exe" called "GetProcAddress" with a parameter EventUnregister (UID: 00000000-00002056) "5Ln7gt9.exe" called "GetProcAddress" with a parameter EventEnabled (UID: 00000000-00002056) "5Ln7gt9.exe" called "GetProcAddress" with a parameter EventWrite (UID: 00000000-00002056) "5Ln7gt9.exe" called "GetProcAddress" with a parameter PSCreateMemoryPropertyStore (UID: 00000000-00002056) "5Ln7gt9.exe" called "GetProcAddress" with a parameter PSPropertyBag_WriteDWORD (UID: 00000000-00002056) "5Ln7gt9.exe" called "GetProcAddress" with a parameter CoGetApartmentType (UID: 00000000-00002056) "5Ln7gt9.exe" called "GetProcAddress" with a parameter CoRegisterInitializeSpy (UID: 00000000-00002056) "5Ln7gt9.exe" called "GetProcAddress" with a parameter CoTaskMemFree (UID: 00000000-00002056) "5Ln7gt9.exe" called "GetProcAddress" with a parameter CoGetMalloc (UID: 00000000-00002056) "5Ln7gt9.exe" called "GetProcAddress" with a parameter PSPropertyBag_ReadDWORD (UID: 00000000-00002056) "5Ln7gt9.exe" called "GetProcAddress" with a parameter StringFromGUID2 (UID: 00000000-00002056) "5Ln7gt9.exe" called "GetProcAddress" with a parameter RegEnumKeyW (UID: 00000000-00002056) "5Ln7gt9.exe" called "GetProcAddress" with a parameter PSPropertyBag_ReadBSTR (UID: 00000000-00002056) "5Ln7gt9.exe" called "GetProcAddress" with a parameter PSPropertyBag_ReadStrAlloc (UID: 00000000-00002056) "5Ln7gt9.exe" called "GetProcAddress" with a parameter OpenThreadToken (UID: 00000000-00002056) "5Ln7gt9.exe" called "GetProcAddress" with a parameter CoInitializeEx (UID: 00000000-00002056) "5Ln7gt9.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00002056) "5Ln7gt9.exe" called "GetProcAddress" with a parameter CLSIDFromOle1Class (UID: 00000000-00002056) "5Ln7gt9.exe" called "GetProcAddress" with a parameter GetCatalogObject (UID: 00000000-00002056) "5Ln7gt9.exe" called "GetProcAddress" with a parameter GetCatalogObject2 (UID: 00000000-00002056) "5Ln7gt9.exe" called "GetProcAddress" with a parameter DllGetClassObject (UID: 00000000-00002056) "5Ln7gt9.exe" called "GetProcAddress" with a parameter DllCanUnloadNow (UID: 00000000-00002056) "5Ln7gt9.exe" called "GetProcAddress" with a parameter InitializeSecurityDescriptor (UID: 00000000-00002056) "5Ln7gt9.exe" called "GetProcAddress" with a parameter SetEntriesInAclW (UID: 00000000-00002056) "5Ln7gt9.exe" called "GetProcAddress" with a parameter GetMartaExtensionInterface (UID: 00000000-00002056) "5Ln7gt9.exe" called "GetProcAddress" with a parameter SetSecurityDescriptorDacl (UID: 00000000-00002056) "5Ln7gt9.exe" called "GetProcAddress" with a parameter IsTextUnicode (UID: 00000000-00002056) "5Ln7gt9.exe" called "GetProcAddress" with a parameter CoUninitialize (UID: 00000000-00002056) "5Ln7gt9.exe" called "GetProcAddress" with a parameter ConvertSidToStringSidW (UID: 00000000-00002056) "5Ln7gt9.exe" called "GetProcAddress" with a parameter RegOpenKeyExW (UID: 00000000-00002056) "5Ln7gt9.exe" called "GetProcAddress" with a parameter RegGetValueW (UID: 00000000-00002056) "5Ln7gt9.exe" called "GetProcAddress" with a parameter RegCloseKey (UID: 00000000-00002056) "5Ln7gt9.exe" called "GetProcAddress" with a parameter CoTaskMemRealloc (UID: 00000000-00002056) "5Ln7gt9.exe" called "GetProcAddress" with a parameter InitPropVariantFromStringAsVector (UID: 00000000-00002056) "5Ln7gt9.exe" called "GetProcAddress" with a parameter PSCoerceToCanonicalValue (UID: 00000000-00002056) "5Ln7gt9.exe" called "GetProcAddress" with a parameter PropVariantToStringAlloc (UID: 00000000-00002056) "5Ln7gt9.exe" called "GetProcAddress" with a parameter PropVariantClear (UID: 00000000-00002056) "5Ln7gt9.exe" called "GetProcAddress" with a parameter CoAllowSetForegroundWindow (UID: 00000000-00002056) "5Ln7gt9.exe" called "GetProcAddress" with a parameter GetUserNameExW (UID: 00000000-00002056) "5Ln7gt9.exe" called "GetProcAddress" with a parameter PathCreateFromUrlW (UID: 00000000-00002056) "5Ln7gt9.exe" called "GetProcAddress" with a parameter SHGetFolderPathW (UID: 00000000-00002056) "5Ln7gt9.exe" called "GetProcAddress" with a parameter SaferGetPolicyInformation (UID: 00000000-00002056) "5Ln7gt9.exe" called "GetProcAddress" with a parameter CM_Get_Device_Interface_List_Size_ExW (UID: 00000000-00002056) "5Ln7gt9.exe" called "GetProcAddress" with a parameter CM_Get_Device_Interface_List_ExW (UID: 00000000-00002056) "5Ln7gt9.exe" called "GetProcAddress" with a parameter RtlDllShutdownInProgress (UID: 00000000-00002056) "5Ln7gt9.exe" called "GetProcAddress" with a parameter OleUninitialize (UID: 00000000-00002056) "5Ln7gt9.exe" called "GetProcAddress" with a parameter CoRevokeInitializeSpy (UID: 00000000-00002056) "5Ln7gt9.exe" called "GetProcAddress" with a parameter UnregisterTraceGuids (UID: 00000000-00002056) "cmd.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00000844) "cmd.exe" called "GetProcAddress" with a parameter ThemeInitApiHook (UID: 00000000-00000844) "cmd.exe" called "GetProcAddress" with a parameter IsProcessDPIAware (UID: 00000000-00000844) "cmd.exe" called "GetProcAddress" with a parameter CoTaskMemAlloc (UID: 00000000-00000844) "cmd.exe" called "GetProcAddress" with a parameter RegisterTraceGuidsW (UID: 00000000-00000844) "cmd.exe" called "GetProcAddress" with a parameter EventRegister (UID: 00000000-00000844) "cmd.exe" called "GetProcAddress" with a parameter EventUnregister (UID: 00000000-00000844) "cmd.exe" called "GetProcAddress" with a parameter EventEnabled (UID: 00000000-00000844) "cmd.exe" called "GetProcAddress" with a parameter EventWrite (UID: 00000000-00000844) "cmd.exe" called "GetProcAddress" with a parameter OpenThreadToken (UID: 00000000-00000844) "cmd.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00000844) "cmd.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00000844) "cmd.exe" called "GetProcAddress" with a parameter AcquireSRWLockShared (UID: 00000000-00000844) "cmd.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00000844) "cmd.exe" called "GetProcAddress" with a parameter ReleaseSRWLockShared (UID: 00000000-00000844) "cmd.exe" called "GetProcAddress" with a parameter EventSetInformation (UID: 00000000-00000844) "cmd.exe" called "GetProcAddress" with a parameter InitCommonControlsEx (UID: 00000000-00000844) "cmd.exe" called "GetProcAddress" with a parameter OpenProcessToken (UID: 00000000-00000844) "cmd.exe" called "GetProcAddress" with a parameter AllocateAndInitializeSid (UID: 00000000-00000844) "cmd.exe" called "GetProcAddress" with a parameter CheckTokenMembership (UID: 00000000-00000844) "cmd.exe" called "GetProcAddress" with a parameter FreeSid (UID: 00000000-00000844) "cmd.exe" called "GetProcAddress" with a parameter RegisterTraceGuidsA (UID: 00000000-00000844) "cmd.exe" called "GetProcAddress" with a parameter IsValidURL (UID: 00000000-00000844) "cmd.exe" called "GetProcAddress" with a parameter SHStrDupW (UID: 00000000-00000844) "cmd.exe" called "GetProcAddress" with a parameter CoTaskMemFree (UID: 00000000-00000844) "cmd.exe" called "GetProcAddress" with a parameter PSCreateMemoryPropertyStore (UID: 00000000-00000844) "cmd.exe" called "GetProcAddress" with a parameter PSCreateAdapterFromPropertyStore (UID: 00000000-00000844) "cmd.exe" called "GetProcAddress" with a parameter PropVariantToBSTR (UID: 00000000-00000844) "cmd.exe" called "GetProcAddress" with a parameter PropVariantClear (UID: 00000000-00000844) "cmd.exe" called "GetProcAddress" with a parameter IUnknown_Set (UID: 00000000-00000844) "cmd.exe" called "GetProcAddress" with a parameter ResolveDelayLoadedAPI (UID: 00000000-00000844) "cmd.exe" called "GetProcAddress" with a parameter PSPropertyBag_ReadStrAlloc (UID: 00000000-00000844) "cmd.exe" called "GetProcAddress" with a parameter PSPropertyBag_ReadDWORD (UID: 00000000-00000844) "cmd.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00000844) "cmd.exe" called "GetProcAddress" with a parameter FindWindowExW (UID: 00000000-00000844) "cmd.exe" called "GetProcAddress" with a parameter RegQueryValueExW (UID: 00000000-00000844) "cmd.exe" called "GetProcAddress" with a parameter OleUninitialize (UID: 00000000-00000844) "cmd.exe" called "GetProcAddress" with a parameter PostMessageW (UID: 00000000-00000844) "cmd.exe" called "GetProcAddress" with a parameter UnregisterTraceGuids (UID: 00000000-00000844)3c:T5f5,Found reference to API "GetCommandLineA" (Indicator: "GetCommandLine"; File: "00001428.00000594.12355538.00424000.wprm") Found reference to API "GetCommandLineW" (Indicator: "GetCommandLine"; File: "00001428.00000594.12355538.00424000.wprm") Found reference to API "GetCommandLineA" (Indicator: "GetCommandLine"; Source: "00000000-00000176.00000000.81368.00055000.00000002.mdmp") Found reference to API "GetCommandLineW" (Indicator: "GetCommandLine"; Source: "00000000-00000176.00000000.81368.00055000.00000002.mdmp") Found reference to API "GetCommandLineA" (Indicator: "GetCommandLine"; Source: "00000000-00001596.00000000.80232.003B5000.00000002.mdmp, 00000000-00001596.00000001.80705.003BD000.00000004.mdmp") Found reference to API "GetCommandLineW" (Indicator: "GetCommandLine"; Source: "00000000-00001596.00000000.80232.003B5000.00000002.mdmp, 00000000-00001596.00000001.80705.003BD000.00000004.mdmp") Found reference to API "GetCommandLineW" (Indicator: "GetCommandLine"; Source: "00000000-00002056.00000000.82391.00417000.00000004.mdmp") Found reference to API "GetCommandLineW" (Indicator: "GetCommandLine"; Source: "00000000-00002360.00000000.79712.001B0000.00000004.mdmp, 00000000-00002360.00000002.82587.001B0000.00000004.mdmp") Found reference to API "GetCommandLineA" (Indicator: "GetCommandLine"; Source: "00000000-00003804.00000000.81033.01375000.00000002.mdmp") Found reference to API "GetCommandLineW" (Indicator: "GetCommandLine"; Source: "00000000-00003804.00000000.81033.01375000.00000002.mdmp")3d:T534,":\Users\HAPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini" (Indicator: ":\users\hapubws\appdata\roaming\microsoft\windows\start menu\programs\startup\desktop.ini") in Source: 00000000-00002056.00000000.82391.00270000.00000004.mdmp 00000000-00002056.00000001.82574.00270000.00000004.mdmp "C:\Users\HAPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini" (Indicator: "c:\users\hapubws\appdata\roaming\microsoft\windows\start menu\programs\startup\desktop.ini") in Source: 00000000-00002056.00000000.82391.00270000.00000004.mdmp 00000000-00002056.00000000.82391.00480000.00000002.mdmp 00000000-00002056.00000001.82574.00270000.00000004.mdmp ":\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini" (Indicator: ":\programdata\microsoft\windows\start menu\programs\startup\desktop.ini") in Source: 00000000-00002056.00000000.82391.00270000.00000004.mdmp 00000000-00002056.00000001.82574.00270000.00000004.mdmp "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini" (Indicator: "c:\programdata\microsoft\windows\start menu\programs\startup\desktop.ini") in Source: 00000000-00002056.00000000.82391.00270000.00000004.mdmp 00000000-00002056.00000000.82391.00480000.00000002.mdmp 00000000-00002056.00000001.82574.00270000.00000004.mdmp3e:T85b,Process AppLaunch.exe created mutex with name "\Sessions\1\BaseNamedObjects\Global\CLR_PerfMon_WrapMutex" Process 5Ln7gt9.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\ZonesCacheCounterMutex" Process 5Ln7gt9.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\ZonesLockedCacheCounterMutex" Process iexplore.exe created mutex with name "\Sessions\1\BaseNamedObjects\UpdatingNewTabPageData" Process iexplore.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\!BrowserEmulation!SharedMemory!Mutex" Process iexplore.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\VERMGMTBlockListFileMutex" Process iexplore.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\URLBLOCK_FILEMAPSWITCH_MUTEX_3376" Process iexplore.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\URLBLOCK_HASHFILESWITCH_MUTEX" Process iexplore.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\URLBLOCK_DOWNLOAD_MUTEX" Process iexplore.exe created mutex with name "\Sessions\1\BaseNamedObjects\IsoScope_d30_IE_EarlyTabStart_0x6f4_Mutex" Process iexplore.exe created mutex with name "\Sessions\1\BaseNamedObjects\IsoScope_d30_ConnHashTable<3376>_HashTable_Mutex" Process iexplore.exe created mutex with name "\Sessions\1\BaseNamedObjects\{5312EE61-79E3-4A24-BFE1-132B85B23C3A}" Process iexplore.exe created mutex with name "\Sessions\1\BaseNamedObjects\IsoScope_d30_IESQMMUTEX_0_303" Process iexplore.exe created mutex with name "\Sessions\1\BaseNamedObjects\IsoScope_d30_IESQMMUTEX_0_331" Process iexplore.exe created mutex with name "\Sessions\1\BaseNamedObjects\{66D0969A-1E86-44CF-B4EC-3806DDDA3B5D}" Process iexplore.exe created mutex with name "\Sessions\1\BaseNamedObjects\IsoScope_d30_IESQMMUTEX_0_519" Process iexplore.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\ZonesCacheCounterMutex" Process iexplore.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\ZonesLockedCacheCounterMutex" Process iexplore.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\URLBLOCK_FILEMAPSWITCH_MUTEX_3568"3f:T713,"AppLaunch.exe" failed to load missing module "%WINDIR%\system32\combase.dll" - [base:0; Status:c0000135] "AppLaunch.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\ole32.dll" - [base:0; Status:c0000135] "AppLaunch.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll" - [base:0; Status:c0000135] "AppLaunch.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\uxtheme.dll" - [base:0; Status:c0000135] "AppLaunch.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll" - [base:0; Status:c0000135] "AppLaunch.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\PresentationCore\v4.0_4.0.0.0__31bf3856ad364e35\ucrtbase_clr0400.dll" - [base:0; Status:c0000135] "AppLaunch.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\PresentationCore\v4.0_4.0.0.0__31bf3856ad364e35\SHLWAPI.dll" - [base:0; Status:c0000135] "AppLaunch.exe" failed to load missing module "api-ms-win-core-datetime-l1-1-1" - [base:0; Status:c0000135] "AppLaunch.exe" failed to load missing module "api-ms-win-core-localization-obsolete-l1-2-0" - [base:0; Status:c0000135] "AppLaunch.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll" - [base:0; Status:c0000135] "AppLaunch.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\VERSION.dll" - [base:0; Status:c0000135] "AppLaunch.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ws2_32.dll" - [base:0; Status:c0000135]40:T589,"3fa03f784ec205ddfffcf521bd6cdb53b46ad6ed6fd84ec4ecd85c545c8e2edf" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE "FI3gq62.exe" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE "db2FL06.exe" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE "4xl958hh.exe" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE "Ta8tZ82.exe" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE "2Ev9506.exe" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE "3yf84jj.exe" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE "1xy55nF7.exe" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE41:T981,Found string "facebook.com/login" (Indicator: "facebook.com"; File: "screen_2.png") Found string "https://www.facebook.com/login" (Indicator: "facebook.com"; File: "3fa03f784ec205ddfffcf521bd6cdb53b46ad6ed6fd84ec4ecd85c545c8e2edf") Found string "https://www.youtube.com" (Indicator: "youtube"; File: "3fa03f784ec205ddfffcf521bd6cdb53b46ad6ed6fd84ec4ecd85c545c8e2edf") Found string "@shift /0start "" https://www.facebook.com/loginstart "" https://www.youtube.comstart "" https://accounts.google.com" (Indicator: "facebook.com"; File: "90BC.bat") file/memory contains long string with (Indicator: "youtube"; File: "_3C725D9F-9EC9-11F1-A045-005056914DD1_.dat") file/memory contains long string with (Indicator: "youtube"; File: "~DF6A65F6CA898816DE.TMP") file/memory contains long string with (Indicator: "youtube"; File: "VKVIPYO9.txt") file/memory contains long string with (Indicator: "youtube"; File: "Y86S100B.txt") file/memory contains long string with (Indicator: "youtube"; File: "ZMCFBDAK.txt") file/memory contains long string with (Indicator: "youtube"; File: "ULYP033X.txt") file/memory contains long string with (Indicator: "youtube"; File: "0QDAPSZ6.txt") file/memory contains long string with (Indicator: "youtube"; File: "IWHKX3EJ.txt") Found string "0xJx8q7pYXcLFkuIq..Bqiox9..AAA.0.0.Bqiox9.AWey6xNcZKm2VIfDYwNMBIAlq_8facebook.com/921726211441923129177399273157831273688fYyKamFh8COBMtYqAvPNV_CGfacebook.com/9217416559833631354134159197958031273688" (Indicator: "facebook.com"; File: "GWQIVFH0.txt") Found string "0xJx8q7pYXcLFkuIq..Bqiox9..AAA.0.0.Bqiox9.AWey6xNcZKm2VIfDYwNMBIAlq_8facebook.com/921726211441923129177399273157831273688" (Indicator: "facebook.com"; File: "X2RDLVWZ.txt") Found string "CONSENTWP.2676bayoutube.com/102431383388163210825482504061830633367" (Indicator: "youtube"; File: "V6A6BIKD.txt") Found string "accounts.youtube.com" (Indicator: "youtube"; File: "PCAP") Found string "www.facebook.com" (Indicator: "facebook.com"; File: "PCAP") Found string "www.youtube.com" (Indicator: "youtube"; File: "PCAP") Found string "GET /login HTTP/1.1Accept: text/html, application/xhtml+xml, */*User-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateDNT: 1Host: www.facebook.comConnection: Keep-AliveAccept-Language: en-US" (Indicator: "facebook.com"; File: "SSL") file/memory contains long string with (Indicator: "youtube"; File: "SSL")42:T8dc,"REGISTRY\USER\S-1-5-21-2092356043-4041700817-663127204-1001\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags" in Source: 00000000-00000176.00000001.82037.00480000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\App Paths" in Source: 00000000-00000772.00000001.80710.000A1000.00000020.mdmp "REGISTRY\USER\S-1-5-21-2092356043-4041700817-663127204-1001\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags" in Source: 00000000-00001596.00000001.80705.00250000.00000004.mdmp "Software\Policies\Microsoft\Internet Explorer\Main" in Source: 00000000-00002056.00000000.82391.00270000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\" in Source: 00000000-00002056.00000000.82391.00270000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\" in Source: 00000000-00002056.00000001.82574.00270000.00000004.mdmp "Software\Microsoft\Windows " in Source: 00000000-00002360.00000000.79712.001B0000.00000004.mdmp "REGISTRY\USER\S-1-5-21-2092356043-4041700817-663127204-1001\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags" in Source: 00000000-00002360.00000000.79712.001B0000.00000004.mdmp "7-663127204-1001\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags" in Source: 00000000-00002360.00000002.82587.001B0000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\App Paths" in Source: 00000000-00002360.00000002.82587.01251000.00000020.mdmp "REGISTRY\USER\S-1-5-21-2092356043-4041700817-663127204-1001\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags" in Source: 00000000-00003804.00000000.81033.003A0000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\App Paths" in Source: 00000000-00003856.00000000.79785.00AF1000.00000020.mdmp "Software\Microsoft\Windows\CurrentVersion\App Paths" in Source: 00000000-00004180.00000000.79828.001A1000.00000020.mdmp "ISTRY\USER\S-1-5-21-2092356043-4041700817-663127204-1001\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags" in Source: 00000000-00004180.00000000.79828.00340000.00000004.mdmp "REGISTRY\USER\S-1-5-21-2092356043-4041700817-663127204-1001\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags" in Source: 00000000-00004492.00000000.79905.000B0000.00000004.mdmp43:T2a44,"GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEA59dSNcqDdhV39MzSTNbR0%3D HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.digicert.cn" Response ==> HTTP/1.1 200 OK Server: Tengine Content-Type: application/ocsp-response Content-Length: 471 Connection: keep-alive Cache-Control: max-age=7200 Date: Sun 23 Aug 2026 05:34:11 GMT Via: ens-cache24.l2us5[0 0 200-0 H] ens-cache5.l2us5[1 0] ens-cache33.us34[0 0 200-0 H] ens-cache30.us34[3 0] Age: 1578 Ali-Swift-Global-Savetime: 1787463251 X-Cache: HIT TCP_MEM_HIT dirn:-2:-2 X-Swift-SaveTime: Sun 23 Aug 2026 05:34:12 GMT X-Swift-CacheTime: 3599 Timing-Allow-Origin: * EagleId: a3b53cb217874648295543261e with response body ==>30C28201C3930A0100C2A0C28201C38C30C28201C38806092B060105050730010104C28201C2B930C28201C2B530C281C29EC2A2160414C2B13EC3836903C3B8....... "GET /gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.pki.goog" Response ==> HTTP/1.1 200 OK Content-Security-Policy-Report-Only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/sytroprc:52:0 Cross-Origin-Opener-Policy-Report-Only: same-origin; report-to=sytroprc:52:0 Report-To: {"group":"sytroprc:52:0" "max_age":2592000 "endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/sytroprc:52:0"}] } Server: scaffolding on HTTPServer2 Content-Length: 1446 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Date: Sun 23 Aug 2026 04:54:32 GMT Cache-Control: public max-age=14400 Content-Type: application/ocsp-response Age: 3959 with response body ==>30C28205C2A20A0100C2A0C28205C29B30C28205C29706092B060105050730010104C28205C28830C28205C28430C281C29EC2A2160414C3BCC2B709C3AA4D79....... "GET /r/r1.crl HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: c.pki.goog" Response ==> HTTP/1.1 200 OK Accept-Ranges: bytes Content-Security-Policy-Report-Only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/cacerts Cross-Origin-Resource-Policy: cross-origin Cross-Origin-Opener-Policy: same-origin; report-to="cacerts" Report-To: {"group":"cacerts" "max_age":2592000 "endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/cacerts"}]} Content-Length: 993 X-Content-Type-Options: nosniff Server: sffe X-XSS-Protection: 0 Date: Sun 23 Aug 2026 05:52:20 GMT Expires: Sun 23 Aug 2026 06:42:20 GMT Cache-Control: public max-age=3000 Age: 492 Last-Modified: Wed 11 Feb 2026 14:38:00 GMT Content-Type: application/pkix-crl Vary: Accept-Encoding with response body ==>30C28203C39D30C28201C385020101300D06092AC28648C286C3B70D01010B05003047310B300906035504061302555331223020060355040A1319476F6F676C....... "GET /wr2/9UVbN0w5E6Y.crl HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: c.pki.goog" Response ==> HTTP/1.1 200 OK Accept-Ranges: bytes Content-Security-Policy-Report-Only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/cacerts Cross-Origin-Resource-Policy: cross-origin Cross-Origin-Opener-Policy: same-origin; report-to="cacerts" Report-To: {"group":"cacerts" "max_age":2592000 "endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/cacerts"}]} Content-Length: 38565 X-Content-Type-Options: nosniff Server: sffe X-XSS-Protection: 0 Date: Sun 23 Aug 2026 05:11:21 GMT Expires: Sun 23 Aug 2026 06:01:21 GMT Cache-Control: public max-age=3000 Last-Modified: Sun 23 Aug 2026 04:34:35 GMT Content-Type: application/pkix-crl Vary: Accept-Encoding Age: 2951 with response body ==>30C282C296C2A130C282C295C289020101300D06092AC28648C286C3B70D01010B0500303B310B3009060355040613025553311E301C060355040A1315476F6F....... "GET /r/gsr1.crl HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: c.pki.goog" Response ==> HTTP/1.1 200 OK Accept-Ranges: bytes Content-Security-Policy-Report-Only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/cacerts Cross-Origin-Resource-Policy: cross-origin Cross-Origin-Opener-Policy: same-origin; report-to="cacerts" Report-To: {"group":"cacerts" "max_age":2592000 "endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/cacerts"}]} Content-Length: 1739 X-Content-Type-Options: nosniff Server: sffe X-XSS-Protection: 0 Date: Sun 23 Aug 2026 05:56:28 GMT Expires: Sun 23 Aug 2026 06:46:28 GMT Cache-Control: public max-age=3000 Age: 245 Last-Modified: Tue 07 Jul 2026 08:38:00 GMT Content-Type: application/pkix-crl Vary: Accept-Encoding with response body ==>30C28206C38730C28205C2AF020101300D06092AC28648C286C3B70D01010B05003057310B300906035504061302424531193017060355040A1310476C6F6261....... "GET /r/r4.crl HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: c.pki.goog" Response ==> HTTP/1.1 200 OK Accept-Ranges: bytes Content-Security-Policy-Report-Only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/cacerts Cross-Origin-Resource-Policy: cross-origin Cross-Origin-Opener-Policy: same-origin; report-to="cacerts" Report-To: {"group":"cacerts" "max_age":2592000 "endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/cacerts"}]} Content-Length: 528 X-Content-Type-Options: nosniff Server: sffe X-XSS-Protection: 0 Date: Sun 23 Aug 2026 05:46:11 GMT Expires: Sun 23 Aug 2026 06:36:11 GMT Cache-Control: public max-age=3000 Age: 862 Last-Modified: Wed 11 Feb 2026 14:38:00 GMT Content-Type: application/pkix-crl Vary: Accept-Encoding with response body ==>30C282020C30C28201C293020101300A06082AC28648C38E3D0403033047310B300906035504061302555331223020060355040A1319476F6F676C6520547275....... "GET /we2/yK5nPhtHKQs.crl HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: c.pki.goog" Response ==> HTTP/1.1 200 OK Accept-Ranges: bytes Content-Security-Policy-Report-Only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/cacerts Cross-Origin-Resource-Policy: cross-origin Cross-Origin-Opener-Policy: same-origin; report-to="cacerts" Report-To: {"group":"cacerts" "max_age":2592000 "endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/cacerts"}]} Content-Length: 27751 X-Content-Type-Options: nosniff Server: sffe X-XSS-Protection: 0 Date: Sun 23 Aug 2026 05:59:43 GMT Expires: Sun 23 Aug 2026 06:49:43 GMT Cache-Control: public max-age=3000 Last-Modified: Sun 23 Aug 2026 05:09:53 GMT Content-Type: application/pkix-crl Vary: Accept-Encoding Age: 50 with response body ==>30C2826C6330C2826C08020101300A06082AC28648C38E3D040302303B310B3009060355040613025553311E301C060355040A1315476F6F676C652054727573....... "GET /we2/Gt0Gl6QoGAU.crl HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: c.pki.goog" Response ==> HTTP/1.1 200 OK Accept-Ranges: bytes Content-Security-Policy-Report-Only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/cacerts Cross-Origin-Resource-Policy: cross-origin Cross-Origin-Opener-Policy: same-origin; report-to="cacerts" Report-To: {"group":"cacerts" "max_age":2592000 "endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/cacerts"}]} Content-Length: 27734 X-Content-Type-Options: nosniff Server: sffe X-XSS-Protection: 0 Date: Sun 23 Aug 2026 05:22:11 GMT Expires: Sun 23 Aug 2026 06:12:11 GMT Cache-Control: public max-age=3000 Age: 2304 Last-Modified: Sun 23 Aug 2026 02:21:59 GMT Content-Type: application/pkix-crl Vary: Accept-Encoding with response body ==>30C2826C5230C2826BC3B8020101300A06082AC28648C38E3D040302303B310B3009060355040613025553311E301C060355040A1315476F6F676C6520547275....... "GET /we2/xuzt3PU9F_w.crl HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: c.pki.goog" Response ==> HTTP/1.1 200 OK Accept-Ranges: bytes Content-Security-Policy-Report-Only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/cacerts Cross-Origin-Resource-Policy: cross-origin Cross-Origin-Opener-Policy: same-origin; report-to="cacerts" Report-To: {"group":"cacerts" "max_age":2592000 "endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/cacerts"}]} Content-Length: 28368 X-Content-Type-Options: nosniff Server: sffe X-XSS-Protection: 0 Date: Sun 23 Aug 2026 05:52:41 GMT Expires: Sun 23 Aug 2026 06:42:41 GMT Cache-Control: public max-age=3000 Last-Modified: Sun 23 Aug 2026 02:26:52 GMT Content-Type: application/pkix-crl Vary: Accept-Encoding Age: 474 with response body ==>30C2826EC38C30C2826E72020101300A06082AC28648C38E3D040302303B310B3009060355040613025553311E301C060355040A1315476F6F676C6520547275....... "GET /we2/dTM3-0hpWfE.crl HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: c.pki.goog" Response ==> HTTP/1.1 200 OK Accept-Ranges: bytes Content-Security-Policy-Report-Only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/cacerts Cross-Origin-Resource-Policy: cross-origin Cross-Origin-Opener-Policy: same-origin; report-to="cacerts" Report-To: {"group":"cacerts" "max_age":2592000 "endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/cacerts"}]} Content-Length: 28584 X-Content-Type-Options: nosniff Server: sffe X-XSS-Protection: 0 Date: Sun 23 Aug 2026 05:55:20 GMT Expires: Sun 23 Aug 2026 06:45:20 GMT Cache-Control: public max-age=3000 Age: 315 Last-Modified: Sun 23 Aug 2026 02:31:04 GMT Content-Type: application/pkix-crl Vary: Accept-Encoding with response body ==>30C2826FC2A430C2826F4A020101300A06082AC28648C38E3D040302303B310B3009060355040613025553311E301C060355040A1315476F6F676C6520547275....... "GET /wr2/oBFYYahzgVI.crl HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: c.pki.goog" Response ==> HTTP/1.1 200 OK Accept-Ranges: bytes Content-Security-Policy-Report-Only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/cacerts Cross-Origin-Resource-Policy: cross-origin Cross-Origin-Opener-Policy: same-origin; report-to="cacerts" Report-To: {"group":"cacerts" "max_age":2592000 "endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/cacerts"}]} Content-Length: 38892 X-Content-Type-Options: nosniff Server: sffe X-XSS-Protection: 0 Date: Sun 23 Aug 2026 05:48:44 GMT Expires: Sun 23 Aug 2026 06:38:44 GMT Cache-Control: public max-age=3000 Age: 712 Last-Modified: Sun 23 Aug 2026 02:37:39 GMT Content-Type: application/pkix-crl Vary: Accept-Encoding with response body ==>30C282C297C3A830C282C296C390020101300D06092AC28648C286C3B70D01010B0500303B310B3009060355040613025553311E301C060355040A1315476F6F.......44:T26ae,"3fa03f784ec205ddfffcf521bd6cdb53b46ad6ed6fd84ec4ecd85c545c8e2edf.exe" loaded module "%WINDIR%\SYSTEM32\ADVPACK.DLL" at base 6de90000 "3fa03f784ec205ddfffcf521bd6cdb53b46ad6ed6fd84ec4ecd85c545c8e2edf.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 75570000 "FI3gq62.exe" loaded module "FECLIENT.DLL" at base 6df40000 "FI3gq62.exe" loaded module "%WINDIR%\SYSTEM32\ADVPACK.DLL" at base 654f0000 "FI3gq62.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 75570000 "db2FL06.exe" loaded module "%WINDIR%\SYSTEM32\ADVPACK.DLL" at base 654c0000 "db2FL06.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 75570000 "Ta8tZ82.exe" loaded module "%WINDIR%\SYSTEM32\ADVPACK.DLL" at base 654f0000 "Ta8tZ82.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 75570000 "1xy55nF7.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 75570000 "AppLaunch.exe" loaded module "MSCOREE.DLL" at base 6bca0000 "AppLaunch.exe" loaded module "PSAPI.DLL" at base 77960000 "AppLaunch.exe" loaded module "RPCRT4.DLL" at base 775b0000 "AppLaunch.exe" loaded module "KERNEL32.DLL" at base 75e30000 "AppLaunch.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\MSCORLIB\36EACCFDE177C2E7B93B8DBDDE4E012A\MSCORLIB.NI.DLL" at base 63960000 "AppLaunch.exe" loaded module "OLE32.DLL" at base 772b0000 "AppLaunch.exe" loaded module "CRYPTBASE.DLL" at base 755c0000 "AppLaunch.exe" loaded module "API-MS-WIN-CORE-XSTATE-L2-1-0.DLL" at base 6dfd0000 "AppLaunch.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\CLRJIT.DLL" at base 6d0a0000 "AppLaunch.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM\2C3C912EA8F058F9D04C4650128FEB3F\SYSTEM.NI.DLL" at base 62f00000 "AppLaunch.exe" loaded module "ADVAPI32.DLL" at base 77660000 "AppLaunch.exe" loaded module "SSPICLI.DLL" at base 75550000 "AppLaunch.exe" loaded module "ADVAPI32" at base 77660000 "AppLaunch.exe" loaded module "NTDLL.DLL" at base 777c0000 "AppLaunch.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\NLSSORTING.DLL" at base 6de80000 "AppLaunch.exe" loaded module "OLEAUT32.DLL" at base 75d90000 "2Ev9506.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 65520000 "2Ev9506.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 75570000 "3yf84jj.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 75570000 "4xl958hh.exe" loaded module "KERNEL32" at base 75e30000 "4xl958hh.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 75570000 "AppLaunch.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\MSCORLIB\36EACCFDE177C2E7B93B8DBDDE4E012A\MSCORLIB.NI.DLL" at base 63840000 "AppLaunch.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 74520000 "AppLaunch.exe" loaded module "API-MS-WIN-CORE-XSTATE-L2-1-0.DLL" at base 6de90000 "AppLaunch.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\CLRJIT.DLL" at base 68850000 "AppLaunch.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM\2C3C912EA8F058F9D04C4650128FEB3F\SYSTEM.NI.DLL" at base 622c0000 "AppLaunch.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.DRAWING\F7568D7F1B9D356F64779B4C0927CFB3\SYSTEM.DRAWING.NI.DLL" at base 63690000 "AppLaunch.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.WINDOWS.FORMS\C9A4CBC00F690A9E3CDDFC400F6E85BB\SYSTEM.WINDOWS.FORMS.NI.DLL" at base 61450000 "AppLaunch.exe" loaded module "UXTHEME.DLL" at base 74520000 "AppLaunch.exe" loaded module "USER32.DLL" at base 75f10000 "AppLaunch.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.CORE\31FAE3290FAD30C31C98651462D22724\SYSTEM.CORE.NI.DLL" at base 60c30000 "AppLaunch.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.CONFIGURATION\96F7EDB07B12303F0EC2595C7F3778C7\SYSTEM.CONFIGURATION.NI.DLL" at base 63580000 "AppLaunch.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.XML\15AF16D373CF0528CB74FC73D365FDBF\SYSTEM.XML.NI.DLL" at base 604b0000 "AppLaunch.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\NLSSORTING.DLL" at base 6a1e0000 "AppLaunch.exe" loaded module "SHELL32.DLL" at base 76540000 "AppLaunch.exe" loaded module "API-MS-WIN-SECURITY-SDDL-L1-1-0.DLL" at base 75fe0000 "AppLaunch.exe" loaded module "PROFAPI.DLL" at base 756e0000 "AppLaunch.exe" loaded module "BCRYPT.DLL" at base 751e0000 "AppLaunch.exe" loaded module "CRYPTSP.DLL" at base 750d0000 "AppLaunch.exe" loaded module "%WINDIR%\SYSTEM32\RSAENH.DLL" at base 74e60000 "AppLaunch.exe" loaded module "IMM32.DLL" at base 77920000 "AppLaunch.exe" loaded module "COMCTL32.DLL" at base 71e90000 "AppLaunch.exe" loaded module "GDI32.DLL" at base 77260000 "AppLaunch.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\WINDOWSBASE\1A4CC316FB6D09525321FC0BE44692D8\WINDOWSBASE.NI.DLL" at base 63160000 "AppLaunch.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\PRESENTATIONCORE\468F4E17BE144CA12A73A4297EACC9CC\PRESENTATIONCORE.NI.DLL" at base 5f870000 "AppLaunch.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\PRESENTATIO5AE0F00F#\252CC7B0FAE8CFE083BDC149957C0C54\PRESENTATIONFRAMEWORK.NI.DLL" at base 5e480000 "AppLaunch.exe" loaded module "UCRTBASE_CLR0400.DLL" at base 69f60000 "AppLaunch.exe" loaded module "SHLWAPI.DLL" at base 76410000 "AppLaunch.exe" loaded module "DWRITE.DLL" at base 63020000 "AppLaunch.exe" loaded module "API-MS-WIN-CORE-STRING-L1-1-0" at base 75970000 "AppLaunch.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\WPF\WPFGFX_V0400.DLL" at base 5e2f0000 "AppLaunch.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\WPF\PRESENTATIONNATIVE_V0400.DLL" at base 62f30000 "AppLaunch.exe" loaded module "VERSION.DLL" at base 74b60000 "AppLaunch.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.RUNTEB92AA12#\274E43040C8A7A02EF1065DB3283005A\SYSTEM.RUNTIME.SERIALIZATION.NI.DLL" at base 5e010000 "AppLaunch.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.IDENTITYMODEL\C2EF5BC545B98A289F02D0B3EDDBE280\SYSTEM.IDENTITYMODEL.NI.DLL" at base 5dd00000 "AppLaunch.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SMDIAGNOSTICS\DC67DCB4B2FB4A3853D458CAB08561F0\SMDIAGNOSTICS.NI.DLL" at base 68830000 "AppLaunch.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.TRANSACTIONS\3D760B4A3260A41EF84A3FD866780980\SYSTEM.TRANSACTIONS.NI.DLL" at base 5d5b0000 "AppLaunch.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_32\SYSTEM.TRANSACTIONS\V4.0_4.0.0.0__B77A5C561934E089\SYSTEM.TRANSACTIONS.DLL" at base 5d560000 "AppLaunch.exe" loaded module "WS2_32.DLL" at base 779d0000 "AppLaunch.exe" loaded module "%WINDIR%\SYSTEM32\MSWSOCK.DLL" at base 75090000 "AppLaunch.exe" loaded module "%WINDIR%\SYSTEM32\WSHTCPIP.DLL" at base 74bf0000 "AppLaunch.exe" loaded module "%WINDIR%\SYSTEM32\WSHIP6.DLL" at base 75080000 "AppLaunch.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\DIASYMREADER.DLL" at base 6a4f0000 "5Ln7gt9.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 74520000 "5Ln7gt9.exe" loaded module "KERNEL32.DLL" at base 75e30000 "5Ln7gt9.exe" loaded module "SHELL32.DLL" at base 76540000 "5Ln7gt9.exe" loaded module "OLE32.DLL" at base 772b0000 "5Ln7gt9.exe" loaded module "ADVAPI32.DLL" at base 77660000 "5Ln7gt9.exe" loaded module "PROPSYS.DLL" at base 74200000 "5Ln7gt9.exe" loaded module "COMCTL32.DLL" at base 74590000 "5Ln7gt9.exe" loaded module "OLEAUT32.DLL" at base 75d90000 "5Ln7gt9.exe" loaded module "CLBCATQ.DLL" at base 75d00000 "5Ln7gt9.exe" loaded module "%WINDIR%\SYSTEM32\PROPSYS.DLL" at base 74200000 "5Ln7gt9.exe" loaded module "NTMARTA.DLL" at base 74b30000 "5Ln7gt9.exe" loaded module "API-MS-WIN-SECURITY-SDDL-L1-1-0.DLL" at base 75fe0000 "5Ln7gt9.exe" loaded module "PROFAPI.DLL" at base 756e0000 "5Ln7gt9.exe" loaded module "%WINDIR%\SYSTEM32\URLMON.DLL" at base 76000000 "5Ln7gt9.exe" loaded module "SECUR32.DLL" at base 753f0000 "5Ln7gt9.exe" loaded module "RPCRT4.DLL" at base 775b0000 "5Ln7gt9.exe" loaded module "API-MS-WIN-DOWNLEVEL-SHLWAPI-L1-1-0.DLL" at base 75860000 "5Ln7gt9.exe" loaded module "SETUPAPI.DLL" at base 77410000 "5Ln7gt9.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 75570000 "cmd.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 74520000 "cmd.exe" loaded module "OLE32.DLL" at base 772b0000 "cmd.exe" loaded module "ADVAPI32.DLL" at base 77660000 "cmd.exe" loaded module "PROPSYS.DLL" at base 74200000 "cmd.exe" loaded module "KERNEL32.DLL" at base 75e30000 "cmd.exe" loaded module "OLEAUT32.DLL" at base 75d90000 "cmd.exe" loaded module "APPHELP.DLL" at base 75570000 "cmd.exe" loaded module "CLBCATQ.DLL" at base 75d00000 "cmd.exe" loaded module "COMCTL32.DLL" at base 74590000 "cmd.exe" loaded module "%WINDIR%\SYSTEM32\IEFRAME.DLL" at base 6a920000 "cmd.exe" loaded module "API-MS-WIN-DOWNLEVEL-OLE32-L1-1-0.DLL" at base 75960000 "cmd.exe" loaded module "API-MS-WIN-DOWNLEVEL-ADVAPI32-L1-1-0.DLL" at base 758c0000 "cmd.exe" loaded module "URLMON.DLL" at base 76000000 "cmd.exe" loaded module "API-MS-WIN-DOWNLEVEL-SHLWAPI-L2-1-0.DLL" at base 72210000 "cmd.exe" loaded module "%WINDIR%\SYSTEM32\PROPSYS.DLL" at base 74200000 "cmd.exe" loaded module "%PROGRAMFILES%\INTERNET EXPLORER\IEPROXY.DLL" at base 71cb0000 "cmd.exe" loaded module "IERTUTIL.DLL" at base 76150000 "cmd.exe" loaded module "%WINDIR%\SYSTEM32\SHELL32.DLL" at base 76540000 "cmd.exe" loaded module "USER32.DLL" at base 75f10000 "cmd.exe" loaded module "API-MS-WIN-CORE-LOCALREGISTRY-L1-1-0.DLL" at base 75e30000 "cmd.exe" loaded module "SETUPAPI.DLL" at base 77410000 "cmd.exe" loaded module "RPCRT4.DLL" at base 775b0000 "cmd.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 7557000045:Te37,"3fa03f784ec205ddfffcf521bd6cdb53b46ad6ed6fd84ec4ecd85c545c8e2edf" was detected as "Microsoft Cabinet" and name: "sfx" "3fa03f784ec205ddfffcf521bd6cdb53b46ad6ed6fd84ec4ecd85c545c8e2edf" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "3fa03f784ec205ddfffcf521bd6cdb53b46ad6ed6fd84ec4ecd85c545c8e2edf" was detected as "Microsoft Visual C/C++" and name: "Compiler" "3fa03f784ec205ddfffcf521bd6cdb53b46ad6ed6fd84ec4ecd85c545c8e2edf" was detected as "Microsoft Cabinet File" and name: "Archive" "3fa03f784ec205ddfffcf521bd6cdb53b46ad6ed6fd84ec4ecd85c545c8e2edf" was detected as "Microsoft Linker" and name: "Linker" "FI3gq62.exe" was detected as "Microsoft Cabinet" and name: "sfx" "FI3gq62.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "FI3gq62.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "FI3gq62.exe" was detected as "Microsoft Cabinet File" and name: "Archive" "FI3gq62.exe" was detected as "Microsoft Linker" and name: "Linker" "db2FL06.exe" was detected as "Microsoft Cabinet" and name: "sfx" "db2FL06.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "db2FL06.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "db2FL06.exe" was detected as "Microsoft Cabinet File" and name: "Archive" "db2FL06.exe" was detected as "Microsoft Linker" and name: "Linker" "4xl958hh.exe" was detected as "Microsoft Cabinet" and name: "sfx" "4xl958hh.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "4xl958hh.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "4xl958hh.exe" was detected as "Microsoft Cabinet File" and name: "Archive" "4xl958hh.exe" was detected as "Microsoft Linker" and name: "Linker" "Ta8tZ82.exe" was detected as "Microsoft Cabinet" and name: "sfx" "Ta8tZ82.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "Ta8tZ82.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "Ta8tZ82.exe" was detected as "Microsoft Cabinet File" and name: "Archive" "Ta8tZ82.exe" was detected as "Microsoft Linker" and name: "Linker" "2Ev9506.exe" was detected as "Microsoft Cabinet" and name: "sfx" "2Ev9506.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "2Ev9506.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "2Ev9506.exe" was detected as "Microsoft Cabinet File" and name: "Archive" "2Ev9506.exe" was detected as "Microsoft Linker" and name: "Linker" "3yf84jj.exe" was detected as "Microsoft Cabinet" and name: "sfx" "3yf84jj.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "3yf84jj.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "3yf84jj.exe" was detected as "Microsoft Cabinet File" and name: "Archive" "3yf84jj.exe" was detected as "Microsoft Linker" and name: "Linker" "1xy55nF7.exe" was detected as "Microsoft Cabinet" and name: "sfx" "1xy55nF7.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "1xy55nF7.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "1xy55nF7.exe" was detected as "Microsoft Cabinet File" and name: "Archive" "1xy55nF7.exe" was detected as "Microsoft Linker" and name: "Linker" "5Ln7gt9.exe" was detected as "Microsoft Cabinet" and name: "sfx" "5Ln7gt9.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "5Ln7gt9.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "5Ln7gt9.exe" was detected as "Microsoft Cabinet File" and name: "Archive" "5Ln7gt9.exe" was detected as "Microsoft Linker" and name: "Linker"46:T14b6,"3fa03f784ec205ddfffcf521bd6cdb53b46ad6ed6fd84ec4ecd85c545c8e2edf" file has an entrypoint instructions - "call 0x407155,jmp 0x406a6a,push 0x58,push 0x4072b8,call 0x407208,xor ebx, ebx,mov dword ptr [ebp - 0x20], ebx,lea eax, [ebp - 0x68],push eax,call dword ptr [0x40a184],mov dword ptr [ebp - 4], ebx,mov eax, dword ptr fs:[0x18],mov esi, dword ptr [eax + 4],mov edi, ebx,mov edx, 0x4088ac,mov ecx, esi,xor eax, eax,lock cmpxchg dword ptr [edx], ecx,test eax, eax,je 0x406abc,cmp eax, esi,jne 0x406aaf,xor esi, esi,inc esi,mov edi, esi,jmp 0x406abf,push 0x3e8,call dword ptr [0x40a188],jmp 0x406a93,xor esi, esi,inc esi," "FI3gq62.exe" file has an entrypoint instructions - "call 0x407155,jmp 0x406a6a,push 0x58,push 0x4072b8,call 0x407208,xor ebx, ebx,mov dword ptr [ebp - 0x20], ebx,lea eax, [ebp - 0x68],push eax,call dword ptr [0x40a184],mov dword ptr [ebp - 4], ebx,mov eax, dword ptr fs:[0x18],mov esi, dword ptr [eax + 4],mov edi, ebx,mov edx, 0x4088ac,mov ecx, esi,xor eax, eax,lock cmpxchg dword ptr [edx], ecx,test eax, eax,je 0x406abc,cmp eax, esi,jne 0x406aaf,xor esi, esi,inc esi,mov edi, esi,jmp 0x406abf,push 0x3e8,call dword ptr [0x40a188],jmp 0x406a93,xor esi, esi,inc esi," "db2FL06.exe" file has an entrypoint instructions - "call 0x407155,jmp 0x406a6a,push 0x58,push 0x4072b8,call 0x407208,xor ebx, ebx,mov dword ptr [ebp - 0x20], ebx,lea eax, [ebp - 0x68],push eax,call dword ptr [0x40a184],mov dword ptr [ebp - 4], ebx,mov eax, dword ptr fs:[0x18],mov esi, dword ptr [eax + 4],mov edi, ebx,mov edx, 0x4088ac,mov ecx, esi,xor eax, eax,lock cmpxchg dword ptr [edx], ecx,test eax, eax,je 0x406abc,cmp eax, esi,jne 0x406aaf,xor esi, esi,inc esi,mov edi, esi,jmp 0x406abf,push 0x3e8,call dword ptr [0x40a188],jmp 0x406a93,xor esi, esi,inc esi," "4xl958hh.exe" file has an entrypoint instructions - "call 0x402d28,jmp 0x402459,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,push ebx,push esi,mov eax, dword ptr [esp + 0x18],or eax, eax,jne 0x402612,mov ecx, dword ptr [esp + 0x14],mov eax, dword ptr [esp + 0x10],xor edx, edx,div ecx,mov ebx, eax,mov eax, dword ptr [esp + 0xc],div ecx,mov edx, ebx,jmp 0x402653,mov ecx, eax,mov ebx, dword ptr [esp + 0x14],mov edx, dword ptr [esp + 0x10],mov eax, dword ptr [esp + 0xc],shr ecx, 1,rcr ebx, 1,shr edx, 1,rcr eax, 1,or ecx, ecx,jne 0x402620,div ebx,mov esi, eax,mul dword ptr [esp + 0x18],mov ecx, eax,mov eax, dword ptr [esp + 0x14],mul esi,add edx, ecx," "Ta8tZ82.exe" file has an entrypoint instructions - "call 0x407155,jmp 0x406a6a,push 0x58,push 0x4072b8,call 0x407208,xor ebx, ebx,mov dword ptr [ebp - 0x20], ebx,lea eax, [ebp - 0x68],push eax,call dword ptr [0x40a184],mov dword ptr [ebp - 4], ebx,mov eax, dword ptr fs:[0x18],mov esi, dword ptr [eax + 4],mov edi, ebx,mov edx, 0x4088ac,mov ecx, esi,xor eax, eax,lock cmpxchg dword ptr [edx], ecx,test eax, eax,je 0x406abc,cmp eax, esi,jne 0x406aaf,xor esi, esi,inc esi,mov edi, esi,jmp 0x406abf,push 0x3e8,call dword ptr [0x40a188],jmp 0x406a93,xor esi, esi,inc esi," "2Ev9506.exe" file has an entrypoint instructions - "call 0x402d28,jmp 0x402459,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,push ebx,push esi,mov eax, dword ptr [esp + 0x18],or eax, eax,jne 0x402612,mov ecx, dword ptr [esp + 0x14],mov eax, dword ptr [esp + 0x10],xor edx, edx,div ecx,mov ebx, eax,mov eax, dword ptr [esp + 0xc],div ecx,mov edx, ebx,jmp 0x402653,mov ecx, eax,mov ebx, dword ptr [esp + 0x14],mov edx, dword ptr [esp + 0x10],mov eax, dword ptr [esp + 0xc],shr ecx, 1,rcr ebx, 1,shr edx, 1,rcr eax, 1,or ecx, ecx,jne 0x402620,div ebx,mov esi, eax,mul dword ptr [esp + 0x18],mov ecx, eax,mov eax, dword ptr [esp + 0x14],mul esi,add edx, ecx," "3yf84jj.exe" file has an entrypoint instructions - "call 0x402d28,jmp 0x402459,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,push ebx,push esi,mov eax, dword ptr [esp + 0x18],or eax, eax,jne 0x402612,mov ecx, dword ptr [esp + 0x14],mov eax, dword ptr [esp + 0x10],xor edx, edx,div ecx,mov ebx, eax,mov eax, dword ptr [esp + 0xc],div ecx,mov edx, ebx,jmp 0x402653,mov ecx, eax,mov ebx, dword ptr [esp + 0x14],mov edx, dword ptr [esp + 0x10],mov eax, dword ptr [esp + 0xc],shr ecx, 1,rcr ebx, 1,shr edx, 1,rcr eax, 1,or ecx, ecx,jne 0x402620,div ebx,mov esi, eax,mul dword ptr [esp + 0x18],mov ecx, eax,mov eax, dword ptr [esp + 0x14],mul esi,add edx, ecx," "1xy55nF7.exe" file has an entrypoint instructions - "call 0x4029f3,jmp 0x4021d8,push ebp,mov ebp, esp,jmp 0x402376,push dword ptr [ebp + 8],call 0x408295,pop ecx,test eax, eax,je 0x402385,push dword ptr [ebp + 8],call 0x40831e,pop ecx,test eax, eax,je 0x402369,pop ebp,ret ,cmp dword ptr [ebp + 8], -1,je 0x402d42,jmp 0x402d25,push ebp,mov ebp, esp,push dword ptr [ebp + 8],call 0x402d5f,pop ecx,pop ebp,ret ,cmp ecx, dword ptr [0x41d010],jne 0x4023ab,ret ,jmp 0x402d8c,push edi,push esi,push ebx,xor edi, edi,mov eax, dword ptr [esp + 0x14],or eax, eax,jge 0x4023d1,inc edi," "5Ln7gt9.exe" file has an entrypoint instructions - "push 0xac,push 0,push 0x418010,call 0x405070,add esp, 0xc,push 0,call 0x405076,mov dword ptr [0x418014], eax,push 0,push 0x1000,push 0,call 0x40507c,mov dword ptr [0x418010], eax,call 0x405000,mov eax, 0x417088,mov dword ptr [0x418034], eax,call 0x40de30,call 0x40dba1,call 0x40aaa0,call 0x40a329,"47:T7db,"3fa03f784ec205ddfffcf521bd6cdb53b46ad6ed6fd84ec4ecd85c545c8e2edf.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "3fa03f784ec205ddfffcf521bd6cdb53b46ad6ed6fd84ec4ecd85c545c8e2edf.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "FI3gq62.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "FI3gq62.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "db2FL06.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "db2FL06.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "Ta8tZ82.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "Ta8tZ82.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "1xy55nF7.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "1xy55nF7.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "2Ev9506.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "2Ev9506.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "3yf84jj.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "3yf84jj.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "4xl958hh.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "4xl958hh.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "5Ln7gt9.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "5Ln7gt9.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "cmd.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "cmd.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "cmd.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LOCALE"; Key: "00000409")48:T1095,Observed system executable string:"C:\Windows\system32\apphelp.dll" [Source: 00000772.00000304.545974.00090000.wprm] Observed system executable string:"%WINDIR%\system32\advpack.dll" [Source: 00000000-00002360-00000C2B-250539319] Observed system executable string:"rundll32.exe %WINDIR%\system32\advpack.dll,DelNodeRunDLL32 "%TEMP%\IXP000.TMP\"" [Source: 00000000-00002360-00000BC1-250696054] Observed system executable string:"rundll32.exe %WINDIR%\system32\advpack.dll,DelNodeRunDLL32 "%TEMP%\IXP001.TMP\"" [Source: 00000000-00003856-00000BC1-251406070] Observed system executable string:"rundll32.exe %WINDIR%\system32\advpack.dll,DelNodeRunDLL32 "%TEMP%\IXP002.TMP\"" [Source: 00000000-00004180-00000BC1-251947297] Observed system executable string:"rundll32.exe %WINDIR%\system32\advpack.dll,DelNodeRunDLL32 "%TEMP%\IXP003.TMP\"" [Source: 00000000-00000772-00000BC1-252552429] Observed system executable string:"%WINDIR%\system32\combase.dll" [Source: 00000000-00003996-00000C2B-254491310] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\mscorlib\36eaccfde177c2e7b93b8dbdde4e012a\mscorlib.ni.dll" [Source: 00000000-00003996-00000C2B-254699258] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\ole32.dll" [Source: 00000000-00003996-00000C2B-254721942] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\clrjit.dll" [Source: 00000000-00003996-00000C2B-254795191] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System\2c3c912ea8f058f9d04c4650128feb3f\System.ni.dll" [Source: 00000000-00003996-00000C2B-254825472] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll" [Source: 00000000-00003996-00000C2B-255153386] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\nlssorting.dll" [Source: 00000000-00003996-00000C2B-255523436] Observed system executable string:"%WINDIR%\system32\uxtheme.dll" [Source: 00000000-00004020-00000C2B-291182945] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Drawing\f7568d7f1b9d356f64779b4c0927cfb3\System.Drawing.ni.dll" [Source: 00000000-00004020-00000C2B-291449846] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Windows.Forms\c9a4cbc00f690a9e3cddfc400f6e85bb\System.Windows.Forms.ni.dll" [Source: 00000000-00004020-00000C2B-291579622] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\uxtheme.dll" [Source: 00000000-00004020-00000C2B-291664348] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Core\31fae3290fad30c31c98651462d22724\System.Core.ni.dll" [Source: 00000000-00004020-00000C2B-291735770] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Configuration\96f7edb07b12303f0ec2595c7f3778c7\System.Configuration.ni.dll" [Source: 00000000-00004020-00000C2B-291755435] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Xml\15af16d373cf0528cb74fc73d365fdbf\System.Xml.ni.dll" [Source: 00000000-00004020-00000C2B-291786357] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll" [Source: 00000000-00004020-00000C2B-291916496] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\WindowsBase\1a4cc316fb6d09525321fc0be44692d8\WindowsBase.ni.dll" [Source: 00000000-00004020-00000C2B-292533719] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\PresentationCore\468f4e17be144ca12a73a4297eacc9cc\PresentationCore.ni.dll" [Source: 00000000-00004020-00000C2B-292744938] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\Presentatio5ae0f00f#\252cc7b0fae8cfe083bdc149957c0c54\PresentationFramework.ni.dll" [Source: 00000000-00004020-00000C2B-293502841] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_32\PresentationCore\v4.0_4.0.0.0__31bf3856ad364e35\ucrtbase_clr0400.dll" [Source: 00000000-00004020-00000C2B-293586604]49:T5c3,Spawned process "FI3gq62.exe" (UID: 00000000-00003856) Spawned process "db2FL06.exe" (UID: 00000000-00004180) Spawned process "Ta8tZ82.exe" (UID: 00000000-00000772) Spawned process "1xy55nF7.exe" (UID: 00000000-00004492) Spawned process "AppLaunch.exe" (UID: 00000000-00003996) Spawned process "2Ev9506.exe" (UID: 00000000-00001596) Spawned process "AppLaunch.exe" (UID: 00000000-00001428) Spawned process "3yf84jj.exe" (UID: 00000000-00003804) Spawned process "AppLaunch.exe" (UID: 00000000-00003808) Spawned process "4xl958hh.exe" (UID: 00000000-00000176) Spawned process "AppLaunch.exe" (UID: 00000000-00004020) Spawned process "5Ln7gt9.exe" (UID: 00000000-00002056) Spawned process "cmd.exe" with commandline "/c "%TEMP%\\90BA.tmp\\90BB.tmp\\90BC.bat %TEMP%\\IXP000.TMP\\5Ln ..." (UID: 00000000-00000844), Spawned process "iexplore.exe" with commandline "https://www.facebook.com/login" (UID: 00000000-00003376), Spawned process "iexplore.exe" with commandline "https://www.youtube.com/" (UID: 00000000-00003568), Spawned process "iexplore.exe" with commandline "SCODEF:3376 CREDAT:275457 /prefetch:2" (UID: 00000000-00004592), Spawned process "iexplore.exe" with commandline "https://accounts.google.com/" (UID: 00000000-00003388), Spawned process "iexplore.exe" with commandline "SCODEF:3568 CREDAT:275457 /prefetch:2" (UID: 00000000-00003460), Spawned process "iexplore.exe" with commandline "SCODEF:3388 CREDAT:275457 /prefetch:2" (UID: 00000000-00002992)4a:T5c3,Spawned process "FI3gq62.exe" (UID: 00000000-00003856) Spawned process "db2FL06.exe" (UID: 00000000-00004180) Spawned process "Ta8tZ82.exe" (UID: 00000000-00000772) Spawned process "1xy55nF7.exe" (UID: 00000000-00004492) Spawned process "AppLaunch.exe" (UID: 00000000-00003996) Spawned process "2Ev9506.exe" (UID: 00000000-00001596) Spawned process "AppLaunch.exe" (UID: 00000000-00001428) Spawned process "3yf84jj.exe" (UID: 00000000-00003804) Spawned process "AppLaunch.exe" (UID: 00000000-00003808) Spawned process "4xl958hh.exe" (UID: 00000000-00000176) Spawned process "AppLaunch.exe" (UID: 00000000-00004020) Spawned process "5Ln7gt9.exe" (UID: 00000000-00002056) Spawned process "cmd.exe" with commandline "/c "%TEMP%\\90BA.tmp\\90BB.tmp\\90BC.bat %TEMP%\\IXP000.TMP\\5Ln ..." (UID: 00000000-00000844), Spawned process "iexplore.exe" with commandline "https://www.facebook.com/login" (UID: 00000000-00003376), Spawned process "iexplore.exe" with commandline "https://www.youtube.com/" (UID: 00000000-00003568), Spawned process "iexplore.exe" with commandline "SCODEF:3376 CREDAT:275457 /prefetch:2" (UID: 00000000-00004592), Spawned process "iexplore.exe" with commandline "https://accounts.google.com/" (UID: 00000000-00003388), Spawned process "iexplore.exe" with commandline "SCODEF:3568 CREDAT:275457 /prefetch:2" (UID: 00000000-00003460), Spawned process "iexplore.exe" with commandline "SCODEF:3388 CREDAT:275457 /prefetch:2" (UID: 00000000-00002992)4b:T77f,The input sample is signed with a certificate issued by "CN=WE2, O=Google Trust Services, C=US" (SHA1: 8B:39:F9:BF:C3:2C:0B:D5:AA:85:E8:2A:3F:53:83:79:4B:6A:45:A4; see report for more information) The input sample is signed with a certificate issued by "CN=GTS Root R4, O=Google Trust Services LLC, C=US" (SHA1: 4D:9A:CB:31:3D:73:DA:2E:9E:B4:51:A7:CF:63:09:AF:45:C9:93:C1; see report for more information) The input sample is signed with a certificate issued by "CN=GlobalSign Root CA, OU=Root CA, O=GlobalSign nv-sa, C=BE" (SHA1: 93:2B:ED:33:9A:A6:92:12:C8:93:75:B7:93:04:B4:75:49:0B:89:A0; see report for more information) The input sample is signed with a certificate issued by "CN=WE2, O=Google Trust Services, C=US" (SHA1: 23:74:91:83:30:33:0F:CE:BE:EB:94:FB:C9:D9:4E:31:00:D5:B5:33; see report for more information) The input sample is signed with a certificate issued by "CN=WE2, O=Google Trust Services, C=US" (SHA1: B9:F7:74:85:7B:1C:5F:E9:C2:86:5A:AA:63:0F:34:84:5F:79:D6:96; see report for more information) The input sample is signed with a certificate issued by "CN=WE2, O=Google Trust Services, C=US" (SHA1: 91:24:44:08:3E:65:60:72:3B:18:06:E2:82:7E:C0:8F:97:46:5D:B2; see report for more information) The input sample is signed with a certificate issued by "CN=DigiCert Global G2 TLS RSA SHA256 2020 CA1, O=DigiCert Inc, C=US" (SHA1: 8E:29:25:A3:FD:B5:B7:68:CB:96:AA:48:6C:C6:55:DC:FB:CD:CF:57; see report for more information) The input sample is signed with a certificate issued by "CN=DigiCert Global Root G2, OU=www.digicert.com, O=DigiCert Inc, C=US" (SHA1: 1B:51:1A:BE:AD:59:C6:CE:20:70:77:C0:BF:0E:00:43:B1:38:26:12; see report for more information) The input sample is signed with a certificate issued by "CN=DigiCert High Assurance EV Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US" (SHA1: B7:40:25:17:EE:AA:C8:0A:B0:46:81:18:6E:82:47:BD:78:51:CD:0A; see report for more information)4c:T1d81,"FI3gq62.exe" has type "PE32 executable for MS Windows 6.00 (GUI) Intel i386 5 sections"- Location: [%TEMP%\IXP000.TMP\FI3gq62.exe]- [targetUID: 00000000-00003856] "db2FL06.exe" has type "PE32 executable for MS Windows 6.00 (GUI) Intel i386 5 sections"- Location: [%TEMP%\IXP001.TMP\db2FL06.exe]- [targetUID: 00000000-00003856] "4xl958hh.exe" has type "PE32 executable for MS Windows 6.00 (console) Intel i386 5 sections"- Location: [%TEMP%\IXP001.TMP\4xl958hh.exe]- [targetUID: 00000000-00003856] "Ta8tZ82.exe" has type "PE32 executable for MS Windows 6.00 (GUI) Intel i386 5 sections"- Location: [%TEMP%\IXP002.TMP\Ta8tZ82.exe]- [targetUID: 00000000-00004180] "2Ev9506.exe" has type "PE32 executable for MS Windows 6.00 (console) Intel i386 5 sections"- Location: [%TEMP%\IXP003.TMP\2Ev9506.exe]- [targetUID: 00000000-00000772] "3yf84jj.exe" has type "PE32 executable for MS Windows 6.00 (console) Intel i386 5 sections"- Location: [%TEMP%\IXP002.TMP\3yf84jj.exe]- [targetUID: 00000000-00003804] "1xy55nF7.exe" has type "PE32 executable for MS Windows 6.00 (GUI) Intel i386 5 sections"- Location: [%TEMP%\IXP003.TMP\1xy55nF7.exe]- [targetUID: 00000000-00004492] "5Ln7gt9.exe" has type "PE32 executable for MS Windows 4.00 (GUI) Intel i386 5 sections"- Location: [%TEMP%\IXP000.TMP\5Ln7gt9.exe]- [targetUID: 00000000-00002360] "90BC.bat" has type "Unknown"- Location: [%TEMP%\90BA.tmp\90BB.tmp\90BC.bat]- [targetUID: 00000000-00000844] "_maTRyRZ22Z8wmKvUcQXclxgo-3469oiGT9DWDYPz6DhfgQe914iiBfD-GevAmvU9KONMKn3YhINqU49pVNahkCkeiF2w9Hlit1_1_.css" has type "Unknown"- [targetUID: N/A] "identifier_2_.htm" has type "Unknown"- [targetUID: N/A] "identifier_1_.htm" has type "Unknown"- [targetUID: N/A] "urlref_httpswww.facebook.comlogin" has type "HTML document ASCII text with very long lines (65536) with no line terminators"- [targetUID: N/A] "login_1_.htm" has type "Unknown"- [targetUID: N/A] "CYKV2ZF1.htm" has type "HTML document ASCII text with very long lines (57051) with CRLF line terminators"- [targetUID: N/A] "dinosaur_1_.png" has type "Unknown"- [targetUID: N/A] "75A092F4522006A97542D6AC4F4E69D2" has type "Unknown"- [targetUID: N/A] "imagestore.dat" has type "Unknown"- [targetUID: N/A] "9C69E496D546F49A980D7350EC49A180" has type "Unknown"- [targetUID: N/A] "F93E23F30C5B44AE13F273C2767B494E" has type "Unknown"- [targetUID: N/A] "FFA2A770194FEECF4A6E9B2A8579E9E9" has type "Unknown"- [targetUID: N/A] "68317AD4F8681C59B8DA0296EF2FCDBA" has type "Unknown"- [targetUID: N/A] "065AF3F276523AFC0C3BE786D678CDE3" has type "Unknown"- [targetUID: N/A] "KFOMCnqEu92Fr1ME7kSn66aGLdTylUAMQXC89YmC2DPNWub2bVmUiAw_1_.woff" has type "Unknown"- [targetUID: N/A] "KFOMCnqEu92Fr1ME7kSn66aGLdTylUAMQXC89YmC2DPNWubEbVmUiAw_1_.woff" has type "Unknown"- [targetUID: N/A] "_3C725D9F-9EC9-11F1-A045-005056914DD1_.dat" has type "Unknown"- [targetUID: N/A] "~DF6A65F6CA898816DE.TMP" has type "Unknown"- [targetUID: N/A] "ay1hV6OlegS_1_.ico" has type "Unknown"- [targetUID: N/A] "Qw3hZQNGEDjaO2m6tqIqX5E-AVS5_rSejo46_PCTRspJ0OosolrBEJL3HMXfxQASluL2m_dANVawBpSF_1_.woff" has type "Unknown"- [targetUID: N/A] "en-US.4" has type "Unknown"- [targetUID: N/A] "~DF3925AAB0EB36ACC2.TMP" has type "Unknown"- [targetUID: N/A] "~DF663F7047E430C21E.TMP" has type "Unknown"- [targetUID: N/A] "~DF62320677C3E26517.TMP" has type "Unknown"- [targetUID: N/A] "~DF25413A36F2891807.TMP" has type "Unknown"- [targetUID: N/A] "~DFC870DBAD731E6E42.TMP" has type "Unknown"- [targetUID: N/A] "~DF43BF1AAE729A66C0.TMP" has type "Unknown"- [targetUID: N/A] "firefox_1_.png" has type "Unknown"- [targetUID: N/A] "yt_logo_rgb_light_1_.png" has type "Unknown"- [targetUID: N/A] "edgium_1_.png" has type "Unknown"- [targetUID: N/A] "chrome_1_.png" has type "Unknown"- [targetUID: N/A] "supported_browsers_1_.htm" has type "Unknown"- [targetUID: N/A] "RecoveryStore._F4DED0A4-9EC8-11F1-A045-005056914DD1_.dat" has type "Unknown"- [targetUID: N/A] "RecoveryStore._3C725D9D-9EC9-11F1-A045-005056914DD1_.dat" has type "Unknown"- [targetUID: N/A] "RecoveryStore._1E2F642D-9EC8-11F1-A045-005056914DD1_.dat" has type "Unknown"- [targetUID: N/A] "_1E2F642F-9EC8-11F1-A045-005056914DD1_.dat" has type "Unknown"- [targetUID: N/A] "favicon_2_.ico" has type "Unknown"- [targetUID: N/A] "_3C725DA0-9EC9-11F1-A045-005056914DD1_.dat" has type "Unknown"- [targetUID: N/A] "_F4DED0A6-9EC8-11F1-A045-005056914DD1_.dat" has type "Unknown"- [targetUID: N/A] "_C2DADC0C-9ECD-11F1-A045-005056914DD1_.dat" has type "Unknown"- [targetUID: N/A] "b_lEtPAUPMI_1_.webp" has type "Unknown"- [targetUID: N/A] "googlelogo_color_74x24dp_1_.png" has type "Unknown"- [targetUID: N/A] "opera_1_.png" has type "Unknown"- [targetUID: N/A] "8A7891822FCFF127E4EADADE9757112B" has type "Unknown"- [targetUID: N/A] "B76BE66D46C355931939D8CF818D03FD_879AFEB08DCB012707582D902977FF92" has type "Unknown"- [targetUID: N/A] "8B2B9A00839EED1DFDCCC3BFC2F5DF12" has type "Unknown"- [targetUID: N/A] "24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA" has type "Unknown"- [targetUID: N/A] "CheckConnection_1_.htm" has type "Unknown"- [targetUID: N/A] "favicon_1_.ico" has type "Unknown"- [targetUID: N/A] "05DDC6AA91765AACACDB0A5F96DF8199" has type "Unknown"- [targetUID: N/A] "892580777767344DCAEF580FFA143EA6_EF1B61DD3F93C58DBD0734F13C15C0F6" has type "Unknown"- [targetUID: N/A] "VKVIPYO9.txt" has type "Unknown"- [targetUID: N/A] "Y86S100B.txt" has type "Unknown"- [targetUID: N/A] "AP3G3A7F.txt" has type "Unknown"- [targetUID: N/A] "ZMCFBDAK.txt" has type "Unknown"- [targetUID: N/A] "94W4AOYO.txt" has type "Unknown"- [targetUID: N/A] "KH39MQJJ.txt" has type "Unknown"- [targetUID: N/A] "ULYP033X.txt" has type "Unknown"- [targetUID: N/A] "L3IC3CKB.txt" has type "Unknown"- [targetUID: N/A] "4XITS0Z2.txt" has type "Unknown"- [targetUID: N/A] "B46811C17859FFB409CF0E904A4AA8F8" has type "Unknown"- [targetUID: N/A] "0QDAPSZ6.txt" has type "Unknown"- [targetUID: N/A] "IWHKX3EJ.txt" has type "Unknown"- [targetUID: N/A] "E2C6CBAF0AF08CF203BA74BF0D0AB6D5_49536AB5156BDD74EFF881D01C36A419" has type "Unknown"- [targetUID: N/A] "59D76868C250B3240414CE3EFBB12518_186C233666AF2B12C7CE91118FDFA5AE" has type "Unknown"- [targetUID: N/A] "6CAFE3B721B7CE350C58A8F3EB28AA44_C4935EE08CAA8E5372EBE50CFA866626" has type "Unknown"- [targetUID: N/A] "RDVUAWKE.txt" has type "Unknown"- [targetUID: N/A] "26C212D9399727259664BDFCA073966E_912C3CA51DE6018A7BE4CA7BC64AAFCD" has type "Unknown"- [targetUID: N/A] "8NG9PQT5.txt" has type "Unknown"- [targetUID: N/A] "CQQANRV2.txt" has type "Unknown"- [targetUID: N/A] "1E2DBD58769A756A24A9D033F9B07F3D" has type "Unknown"- [targetUID: N/A] "9DFE38F0CF4E54F251E86E53D05E8885" has type "Unknown"- [targetUID: N/A] "OSY1BVAM.htm" has type "gzip compressed data original size modulo 2^32 365"- [targetUID: N/A] "OCIQUL89.txt" has type "Unknown"- [targetUID: N/A] "favicon_1_.htm" has type "Unknown"- [targetUID: N/A] "GWQIVFH0.txt" has type "Unknown"- [targetUID: N/A] "4XLI964Z.txt" has type "Unknown"- [targetUID: N/A] "8XN60RBE.txt" has type "Unknown"- [targetUID: N/A] "X2RDLVWZ.txt" has type "Unknown"- [targetUID: N/A] "NB6RH1R1.txt" has type "Unknown"- [targetUID: N/A] "EWJ23EEV.txt" has type "Unknown"- [targetUID: N/A] "VXK715DQ.txt" has type "Unknown"- [targetUID: N/A] "V6A6BIKD.txt" has type "Unknown"- [targetUID: N/A] "34QYCT8Z.txt" has type "Unknown"- [targetUID: N/A] "bscframe_1_.htm" has type "Unknown"- [targetUID: N/A] "~DFF90939F7D0CE5AE4.TMP" has type "Unknown"- [targetUID: N/A]4d:Tb94,"3fa03f784ec205ddfffcf521bd6cdb53b46ad6ed6fd84ec4ecd85c545c8e2edf.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\SIDEBYSIDE"; Key: ""; Value: "") "3fa03f784ec205ddfffcf521bd6cdb53b46ad6ed6fd84ec4ecd85c545c8e2edf.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: ""; Value: "") "3fa03f784ec205ddfffcf521bd6cdb53b46ad6ed6fd84ec4ecd85c545c8e2edf.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SAFEBOOT\OPTION"; Key: ""; Value: "") "3fa03f784ec205ddfffcf521bd6cdb53b46ad6ed6fd84ec4ecd85c545c8e2edf.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SRP\GP\DLL"; Key: ""; Value: "") "3fa03f784ec205ddfffcf521bd6cdb53b46ad6ed6fd84ec4ecd85c545c8e2edf.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "3fa03f784ec205ddfffcf521bd6cdb53b46ad6ed6fd84ec4ecd85c545c8e2edf.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "3fa03f784ec205ddfffcf521bd6cdb53b46ad6ed6fd84ec4ecd85c545c8e2edf.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\SIDEBYSIDE\ASSEMBLYSTORAGEROOTS"; Key: ""; Value: "") "3fa03f784ec205ddfffcf521bd6cdb53b46ad6ed6fd84ec4ecd85c545c8e2edf.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS"; Key: ""; Value: "") "3fa03f784ec205ddfffcf521bd6cdb53b46ad6ed6fd84ec4ecd85c545c8e2edf.exe" (Access type: "OPEN"; Path: "HKCU\CONTROL PANEL\DESKTOP\MUICACHED\MACHINELANGUAGECONFIGURATION"; Key: ""; Value: "") "3fa03f784ec205ddfffcf521bd6cdb53b46ad6ed6fd84ec4ecd85c545c8e2edf.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\MUI\SETTINGS"; Key: ""; Value: "") "3fa03f784ec205ddfffcf521bd6cdb53b46ad6ed6fd84ec4ecd85c545c8e2edf.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\CONTROL PANEL\DESKTOP"; Key: ""; Value: "") "3fa03f784ec205ddfffcf521bd6cdb53b46ad6ed6fd84ec4ecd85c545c8e2edf.exe" (Access type: "OPEN"; Path: "HKCU\CONTROL PANEL\DESKTOP\LANGUAGECONFIGURATION"; Key: ""; Value: "") "3fa03f784ec205ddfffcf521bd6cdb53b46ad6ed6fd84ec4ecd85c545c8e2edf.exe" (Access type: "OPEN"; Path: "HKCU\CONTROL PANEL\DESKTOP"; Key: ""; Value: "") "3fa03f784ec205ddfffcf521bd6cdb53b46ad6ed6fd84ec4ecd85c545c8e2edf.exe" (Access type: "OPEN"; Path: "HKCU\CONTROL PANEL\DESKTOP\MUICACHED"; Key: ""; Value: "") "3fa03f784ec205ddfffcf521bd6cdb53b46ad6ed6fd84ec4ecd85c545c8e2edf.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: ""; Value: "") "3fa03f784ec205ddfffcf521bd6cdb53b46ad6ed6fd84ec4ecd85c545c8e2edf.exe" (Access type: "OPEN"; Path: "HKLM"; Key: ""; Value: "") "3fa03f784ec205ddfffcf521bd6cdb53b46ad6ed6fd84ec4ecd85c545c8e2edf.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\DIAGNOSTICS"; Key: ""; Value: "")4e:T10d8,"3fa03f784ec205ddfffcf521bd6cdb53b46ad6ed6fd84ec4ecd85c545c8e2edf.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\SIDEBYSIDE"; Key: "PREFEREXTERNALMANIFEST"; Value: "") "3fa03f784ec205ddfffcf521bd6cdb53b46ad6ed6fd84ec4ecd85c545c8e2edf.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "CWDILLEGALINDLLSEARCH"; Value: "") "3fa03f784ec205ddfffcf521bd6cdb53b46ad6ed6fd84ec4ecd85c545c8e2edf.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED"; Value: "") "3fa03f784ec205ddfffcf521bd6cdb53b46ad6ed6fd84ec4ecd85c545c8e2edf.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS"; Key: "SHOWDEBUGINFO"; Value: "") "3fa03f784ec205ddfffcf521bd6cdb53b46ad6ed6fd84ec4ecd85c545c8e2edf.exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP"; Key: "PREFERREDUILANGUAGES"; Value: "") "3fa03f784ec205ddfffcf521bd6cdb53b46ad6ed6fd84ec4ecd85c545c8e2edf.exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP\MUICACHED"; Key: "MACHINEPREFERREDUILANGUAGES"; Value: "") "3fa03f784ec205ddfffcf521bd6cdb53b46ad6ed6fd84ec4ecd85c545c8e2edf.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: "COMPATDLL"; Value: "") "3fa03f784ec205ddfffcf521bd6cdb53b46ad6ed6fd84ec4ecd85c545c8e2edf.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: "00060101.00060101"; Value: "") "3fa03f784ec205ddfffcf521bd6cdb53b46ad6ed6fd84ec4ecd85c545c8e2edf.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: ""; Value: "") "3fa03f784ec205ddfffcf521bd6cdb53b46ad6ed6fd84ec4ecd85c545c8e2edf.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "SAFEDLLSEARCHMODE"; Value: "") "3fa03f784ec205ddfffcf521bd6cdb53b46ad6ed6fd84ec4ecd85c545c8e2edf.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\GRE_INITIALIZE"; Key: "DISABLEMETAFILES"; Value: "") "3fa03f784ec205ddfffcf521bd6cdb53b46ad6ed6fd84ec4ecd85c545c8e2edf.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\COMPATIBILITY32"; Key: "3FA03F784EC205DDFFFCF521BD6CDB53B46AD6ED6FD84EC4ECD85C545C8E2EDF"; Value: "") "3fa03f784ec205ddfffcf521bd6cdb53b46ad6ed6fd84ec4ecd85c545c8e2edf.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINDOWS"; Key: "LOADAPPINIT_DLLS"; Value: "") "3fa03f784ec205ddfffcf521bd6cdb53b46ad6ed6fd84ec4ecd85c545c8e2edf.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE"; Key: "PAGEALLOCATORUSESYSTEMHEAP"; Value: "") "3fa03f784ec205ddfffcf521bd6cdb53b46ad6ed6fd84ec4ecd85c545c8e2edf.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE"; Key: "PAGEALLOCATORSYSTEMHEAPISPRIVATE"; Value: "") "3fa03f784ec205ddfffcf521bd6cdb53b46ad6ed6fd84ec4ecd85c545c8e2edf.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\CMF\CONFIG"; Key: "SYSTEM"; Value: "") "3fa03f784ec205ddfffcf521bd6cdb53b46ad6ed6fd84ec4ecd85c545c8e2edf.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\WINDOWS ERROR REPORTING\WMR"; Key: "DISABLE"; Value: "") "3fa03f784ec205ddfffcf521bd6cdb53b46ad6ed6fd84ec4ecd85c545c8e2edf.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\SETUP"; Key: "SOURCEPATH"; Value: "") "3fa03f784ec205ddfffcf521bd6cdb53b46ad6ed6fd84ec4ecd85c545c8e2edf.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION"; Key: "DEVICEPATH"; Value: "") "3fa03f784ec205ddfffcf521bd6cdb53b46ad6ed6fd84ec4ecd85c545c8e2edf.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US"; Value: "") "3fa03f784ec205ddfffcf521bd6cdb53b46ad6ed6fd84ec4ecd85c545c8e2edf.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US"; Value: "") "3fa03f784ec205ddfffcf521bd6cdb53b46ad6ed6fd84ec4ecd85c545c8e2edf.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\DATACOLLECTION"; Key: "COMMERCIALDATAOPTIN"; Value: "")4f:T5eb,"3fa03f784ec205ddfffcf521bd6cdb53b46ad6ed6fd84ec4ecd85c545c8e2edf.exe" reads file "c:\users\%osuser%\appdata\local\temp\ixp000.tmp\fi3gq62.exe" "3fa03f784ec205ddfffcf521bd6cdb53b46ad6ed6fd84ec4ecd85c545c8e2edf.exe" reads file "c:\users\%osuser%\appdata\local\temp\ixp000.tmp\5ln7gt9.exe" "FI3gq62.exe" reads file "c:\users\%osuser%\appdata\local\temp\ixp001.tmp\db2fl06.exe" "FI3gq62.exe" reads file "c:\users\%osuser%\appdata\local\temp\ixp001.tmp\4xl958hh.exe" "db2FL06.exe" reads file "c:\users\%osuser%\appdata\local\temp\ixp002.tmp\ta8tz82.exe" "db2FL06.exe" reads file "c:\users\%osuser%\appdata\local\temp\ixp002.tmp\3yf84jj.exe" "Ta8tZ82.exe" reads file "c:\users\%osuser%\appdata\local\temp\ixp003.tmp\1xy55nf7.exe" "Ta8tZ82.exe" reads file "c:\users\%osuser%\appdata\local\temp\ixp003.tmp\2ev9506.exe" "1xy55nF7.exe" reads file "c:\windows\microsoft.net\framework\v4.0.30319\applaunch.exe" "2Ev9506.exe" reads file "c:\windows\microsoft.net\framework\v4.0.30319\applaunch.exe" "3yf84jj.exe" reads file "c:\windows\microsoft.net\framework\v4.0.30319\applaunch.exe" "4xl958hh.exe" reads file "c:\windows\microsoft.net\framework\v4.0.30319\applaunch.exe" "5Ln7gt9.exe" reads file "c:\windows\system32\cmd.exe" "cmd.exe" reads file "c:\users\%osuser%\appdata\local\temp\90ba.tmp\90bb.tmp\90bc.bat" "cmd.exe" reads file "c:\windows\system32\ieframe.dll" "cmd.exe" reads file "c:\program files\internet explorer\ieproxy.dll" "cmd.exe" reads file "c:\program files\internet explorer\iexplore.exe"50:Tc9a,"3fa03f784ec205ddfffcf521bd6cdb53b46ad6ed6fd84ec4ecd85c545c8e2edf.exe" trying to touch file "C:\Windows\SYSTEM32\sechost.dll" "3fa03f784ec205ddfffcf521bd6cdb53b46ad6ed6fd84ec4ecd85c545c8e2edf.exe" trying to touch file "C:\3fa03f784ec205ddfffcf521bd6cdb53b46ad6ed6fd84ec4ecd85c545c8e2edf.exe.Local\" "3fa03f784ec205ddfffcf521bd6cdb53b46ad6ed6fd84ec4ecd85c545c8e2edf.exe" trying to touch file "C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18837_none_41e855142bd5705d" "3fa03f784ec205ddfffcf521bd6cdb53b46ad6ed6fd84ec4ecd85c545c8e2edf.exe" trying to touch file "C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18837_none_41e855142bd5705d\COMCTL32.dll" "3fa03f784ec205ddfffcf521bd6cdb53b46ad6ed6fd84ec4ecd85c545c8e2edf.exe" trying to touch file "C:\Cabinet.dll" "3fa03f784ec205ddfffcf521bd6cdb53b46ad6ed6fd84ec4ecd85c545c8e2edf.exe" trying to touch file "C:\Windows\system32\Cabinet.dll" "3fa03f784ec205ddfffcf521bd6cdb53b46ad6ed6fd84ec4ecd85c545c8e2edf.exe" trying to touch file "C:\VERSION.dll" "3fa03f784ec205ddfffcf521bd6cdb53b46ad6ed6fd84ec4ecd85c545c8e2edf.exe" trying to touch file "C:\Windows\system32\VERSION.dll" "3fa03f784ec205ddfffcf521bd6cdb53b46ad6ed6fd84ec4ecd85c545c8e2edf.exe" trying to touch file "C:\Windows\system32\apphelp.dll" "3fa03f784ec205ddfffcf521bd6cdb53b46ad6ed6fd84ec4ecd85c545c8e2edf.exe" trying to touch file "C:\Windows\AppPatch\AcLayers.DLL" "3fa03f784ec205ddfffcf521bd6cdb53b46ad6ed6fd84ec4ecd85c545c8e2edf.exe" trying to touch file "C:\SspiCli.dll" "3fa03f784ec205ddfffcf521bd6cdb53b46ad6ed6fd84ec4ecd85c545c8e2edf.exe" trying to touch file "C:\Windows\system32\SspiCli.dll" "3fa03f784ec205ddfffcf521bd6cdb53b46ad6ed6fd84ec4ecd85c545c8e2edf.exe" trying to touch file "C:\WINSPOOL.DRV" "3fa03f784ec205ddfffcf521bd6cdb53b46ad6ed6fd84ec4ecd85c545c8e2edf.exe" trying to touch file "C:\Windows\system32\WINSPOOL.DRV" "3fa03f784ec205ddfffcf521bd6cdb53b46ad6ed6fd84ec4ecd85c545c8e2edf.exe" trying to touch file "C:\MPR.dll" "3fa03f784ec205ddfffcf521bd6cdb53b46ad6ed6fd84ec4ecd85c545c8e2edf.exe" trying to touch file "C:\Windows\system32\MPR.dll" "3fa03f784ec205ddfffcf521bd6cdb53b46ad6ed6fd84ec4ecd85c545c8e2edf.exe" trying to touch file "C:\Windows\AppPatch\AcGenral.DLL" "3fa03f784ec205ddfffcf521bd6cdb53b46ad6ed6fd84ec4ecd85c545c8e2edf.exe" trying to touch file "C:\UxTheme.dll" "3fa03f784ec205ddfffcf521bd6cdb53b46ad6ed6fd84ec4ecd85c545c8e2edf.exe" trying to touch file "C:\Windows\system32\UxTheme.dll" "3fa03f784ec205ddfffcf521bd6cdb53b46ad6ed6fd84ec4ecd85c545c8e2edf.exe" trying to touch file "C:\WINMM.dll" "3fa03f784ec205ddfffcf521bd6cdb53b46ad6ed6fd84ec4ecd85c545c8e2edf.exe" trying to touch file "C:\Windows\system32\WINMM.dll" "3fa03f784ec205ddfffcf521bd6cdb53b46ad6ed6fd84ec4ecd85c545c8e2edf.exe" trying to touch file "C:\samcli.dll" "3fa03f784ec205ddfffcf521bd6cdb53b46ad6ed6fd84ec4ecd85c545c8e2edf.exe" trying to touch file "C:\Windows\system32\samcli.dll" "3fa03f784ec205ddfffcf521bd6cdb53b46ad6ed6fd84ec4ecd85c545c8e2edf.exe" trying to touch file "C:\MSACM32.dll" "3fa03f784ec205ddfffcf521bd6cdb53b46ad6ed6fd84ec4ecd85c545c8e2edf.exe" trying to touch file "C:\Windows\system32\MSACM32.dll"51:Tcf4,"3fa03f784ec205ddfffcf521bd6cdb53b46ad6ed6fd84ec4ecd85c545c8e2edf.exe" trying to access non-existent file "C:\Cabinet.dll" "3fa03f784ec205ddfffcf521bd6cdb53b46ad6ed6fd84ec4ecd85c545c8e2edf.exe" trying to access non-existent file "C:\VERSION.dll" "3fa03f784ec205ddfffcf521bd6cdb53b46ad6ed6fd84ec4ecd85c545c8e2edf.exe" trying to access non-existent file "C:\SspiCli.dll" "3fa03f784ec205ddfffcf521bd6cdb53b46ad6ed6fd84ec4ecd85c545c8e2edf.exe" trying to access non-existent file "C:\MPR.dll" "3fa03f784ec205ddfffcf521bd6cdb53b46ad6ed6fd84ec4ecd85c545c8e2edf.exe" trying to access non-existent file "C:\UxTheme.dll" "3fa03f784ec205ddfffcf521bd6cdb53b46ad6ed6fd84ec4ecd85c545c8e2edf.exe" trying to access non-existent file "C:\WINMM.dll" "3fa03f784ec205ddfffcf521bd6cdb53b46ad6ed6fd84ec4ecd85c545c8e2edf.exe" trying to access non-existent file "C:\samcli.dll" "3fa03f784ec205ddfffcf521bd6cdb53b46ad6ed6fd84ec4ecd85c545c8e2edf.exe" trying to access non-existent file "C:\MSACM32.dll" "3fa03f784ec205ddfffcf521bd6cdb53b46ad6ed6fd84ec4ecd85c545c8e2edf.exe" trying to access non-existent file "C:\sfc.dll" "3fa03f784ec205ddfffcf521bd6cdb53b46ad6ed6fd84ec4ecd85c545c8e2edf.exe" trying to access non-existent file "C:\sfc_os.DLL" "3fa03f784ec205ddfffcf521bd6cdb53b46ad6ed6fd84ec4ecd85c545c8e2edf.exe" trying to access non-existent file "C:\dwmapi.dll" "3fa03f784ec205ddfffcf521bd6cdb53b46ad6ed6fd84ec4ecd85c545c8e2edf.exe" trying to access non-existent file "C:\FLTLIB.DLL" "3fa03f784ec205ddfffcf521bd6cdb53b46ad6ed6fd84ec4ecd85c545c8e2edf.exe" trying to access non-existent file "C:\MSVCP140.dll" "3fa03f784ec205ddfffcf521bd6cdb53b46ad6ed6fd84ec4ecd85c545c8e2edf.exe" trying to access non-existent file "C:\VCRUNTIME140.dll" "3fa03f784ec205ddfffcf521bd6cdb53b46ad6ed6fd84ec4ecd85c545c8e2edf.exe" trying to access non-existent file "C:\api-ms-win-crt-runtime-l1-1-0.dll" "3fa03f784ec205ddfffcf521bd6cdb53b46ad6ed6fd84ec4ecd85c545c8e2edf.exe" trying to access non-existent file "C:\ucrtbase.DLL" "3fa03f784ec205ddfffcf521bd6cdb53b46ad6ed6fd84ec4ecd85c545c8e2edf.exe" trying to access non-existent file "C:\api-ms-win-core-timezone-l1-1-0.dll" "3fa03f784ec205ddfffcf521bd6cdb53b46ad6ed6fd84ec4ecd85c545c8e2edf.exe" trying to access non-existent file "C:\api-ms-win-core-file-l2-1-0.dll" "3fa03f784ec205ddfffcf521bd6cdb53b46ad6ed6fd84ec4ecd85c545c8e2edf.exe" trying to access non-existent file "C:\api-ms-win-core-localization-l1-2-0.dll" "3fa03f784ec205ddfffcf521bd6cdb53b46ad6ed6fd84ec4ecd85c545c8e2edf.exe" trying to access non-existent file "C:\api-ms-win-core-synch-l1-2-0.dll" "3fa03f784ec205ddfffcf521bd6cdb53b46ad6ed6fd84ec4ecd85c545c8e2edf.exe" trying to access non-existent file "C:\api-ms-win-core-processthreads-l1-1-1.dll" "3fa03f784ec205ddfffcf521bd6cdb53b46ad6ed6fd84ec4ecd85c545c8e2edf.exe" trying to access non-existent file "C:\api-ms-win-core-file-l1-2-0.dll" "3fa03f784ec205ddfffcf521bd6cdb53b46ad6ed6fd84ec4ecd85c545c8e2edf.exe" trying to access non-existent file "C:\api-ms-win-crt-heap-l1-1-0.dll" "3fa03f784ec205ddfffcf521bd6cdb53b46ad6ed6fd84ec4ecd85c545c8e2edf.exe" trying to access non-existent file "C:\api-ms-win-crt-string-l1-1-0.dll" "3fa03f784ec205ddfffcf521bd6cdb53b46ad6ed6fd84ec4ecd85c545c8e2edf.exe" trying to access non-existent file "C:\api-ms-win-crt-stdio-l1-1-0.dll"52:T87a,"3fa03f784ec205ddfffcf521bd6cdb53b46ad6ed6fd84ec4ecd85c545c8e2edf.exe" trying to access non-existent file "C:\3fa03f784ec205ddfffcf521bd6cdb53b46ad6ed6fd84ec4ecd85c545c8e2edf.exe.Local\" "3fa03f784ec205ddfffcf521bd6cdb53b46ad6ed6fd84ec4ecd85c545c8e2edf.exe" trying to access non-existent file "C:\WINSPOOL.DRV" "3fa03f784ec205ddfffcf521bd6cdb53b46ad6ed6fd84ec4ecd85c545c8e2edf.exe" trying to access non-existent file "C:\3fa03f784ec205ddfffcf521bd6cdb53b46ad6ed6fd84ec4ecd85c545c8e2edf.exe.Config" "3fa03f784ec205ddfffcf521bd6cdb53b46ad6ed6fd84ec4ecd85c545c8e2edf.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP" "3fa03f784ec205ddfffcf521bd6cdb53b46ad6ed6fd84ec4ecd85c545c8e2edf.exe" trying to access non-existent file "C:\3FA03F784EC205DDFFFCF521BD6CDB53B46AD6ED6FD84EC4ECD85C545C8E2EDF.EXE.LOCAL" "3fa03f784ec205ddfffcf521bd6cdb53b46ad6ed6fd84ec4ecd85c545c8e2edf.exe" trying to access non-existent file "C:\3FA03F784EC205DDFFFCF521BD6CDB53B46AD6ED6FD84EC4ECD85C545C8E2EDF.EXE.CONFIG" "FI3gq62.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP\FI3gq62.exe.Local\" "FI3gq62.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP\WINSPOOL.DRV" "FI3gq62.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP\FI3gq62.exe.Config" "FI3gq62.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP001.TMP" "FI3gq62.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP\FI3GQ62.EXE.LOCAL" "FI3gq62.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP\FI3GQ62.EXE.CONFIG" "db2FL06.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP001.TMP\db2FL06.exe.Local\" "db2FL06.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP001.TMP\WINSPOOL.DRV" "db2FL06.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP001.TMP\db2FL06.exe.Config" "db2FL06.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP002.TMP"53:T3cb9,Found requests in header "GET /login HTTP/1.1Accept: text/html, application/xhtml+xml, */*User-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateDNT: 1Host: www.facebook.comConnection: Keep-AliveAccept-Language: en-US"; in File: "SSL") Found requests in header "GET / HTTP/1.1Accept: text/html, application/xhtml+xml, */*Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: www.youtube.comDNT: 1Connection: Keep-AliveCookie: CONSENT=WP.2676ba"; in File: "SSL") Found requests in header "GET /supported_browsers?next_url=https%3A%2F%2Fwww.youtube.com%2F HTTP/1.1Accept: text/html, application/xhtml+xml, */*Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: www.youtube.comCookie: CONSENT=WP.2676ba; __Secure-YNID=21.YT=MUCj6aSbR3rxrHdsZ5BYGxwKkXHWBLHqLKfoLgpjZs4lP9F6Uim6H_htieIBgiCMfRWOgrsloQUs_iyaK9km388DQUl51tAu6dmus5WYYG6erqB4uVZyiOT1JveiLzL6dYQcSg-zW69iWPV-TuYSFsduRPl7doswfu-dwbOmOKhMbAoK_ZiQl7EHQLghD4yZ6Xz_P9m9RQv00_YWh2yawCUKsE9e6GlwqkxiG6XTE03B2Y1oSZ_FIH1-6kCZ5cASCzQI8-hnO0hQl6Eh_AzARiUJvIv8bPPm4R6tLTIDtpGviJ309IAprQ-zvM43vtgMGM0w6C3O0CniD0nLBRfPiwConnection: Keep-AliveDNT: 1"; in File: "SSL") Found requests in header "GET /img/desktop/supported_browsers/yt_logo_rgb_light.png HTTP/1.1Accept: image/png, image/svg+xml, image/*;q=0.8, */*;q=0.5Referer: https://www.youtube.com/supported_browsers?next_url=https%3A%2F%2Fwww.youtube.com%2FAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: www.youtube.comDNT: 1Connection: Keep-AliveCookie: CONSENT=WP.2676ba; __Secure-YNID=21.YT=JwjWC1_062HiDUtiPR7TPe8fNt_Ix0iHTTlugbGcd494m2w4LtvUdCGzujXae10-uHKZNU4RRTgOBaUSQhrml_jbHmxpCS4s3Ytd_reA2bWNrZWOfrRQ1_t7zj7J1tjhjkqpyOI4_6My02PscYEDOpul9slHeKXa1FOFGI7OLmembAf4uZ9bezjkK95RSje1iTQOAlpht7zni4ztjf33Q0BXQfFuU_WrZdlijW4R05Mn2DfggICuEdqbzKKPiezdbTP7iRoswGBPWKDsdN-UJzGzbIezqeC9JM9z-CwA6KMXqM3fOKKfzsQRs_P_S0tOeCVa8jAIQldYBIMOvrHBNw; hideBrowserUpgradeBox=true; YSC=amxSApYVCBA; __Secure-ROLLOUT_TOKEN=CPrskui8z8b6bRDMub-zibaWAxjMub-zibaWAw%3D%3D; VISITOR_INFO1_LIVE=9WFOTerMBz0; VISITOR_PRIVACY_METADATA=CgJVUxIEGgAgHg%3D%3D"; in File: "SSL") Found requests in header "GET /img/desktop/supported_browsers/dinosaur.png HTTP/1.1Accept: image/png, image/svg+xml, image/*;q=0.8, */*;q=0.5Referer: https://www.youtube.com/supported_browsers?next_url=https%3A%2F%2Fwww.youtube.com%2FAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: www.youtube.comDNT: 1Connection: Keep-AliveCookie: CONSENT=WP.2676ba; __Secure-YNID=21.YT=JwjWC1_062HiDUtiPR7TPe8fNt_Ix0iHTTlugbGcd494m2w4LtvUdCGzujXae10-uHKZNU4RRTgOBaUSQhrml_jbHmxpCS4s3Ytd_reA2bWNrZWOfrRQ1_t7zj7J1tjhjkqpyOI4_6My02PscYEDOpul9slHeKXa1FOFGI7OLmembAf4uZ9bezjkK95RSje1iTQOAlpht7zni4ztjf33Q0BXQfFuU_WrZdlijW4R05Mn2DfggICuEdqbzKKPiezdbTP7iRoswGBPWKDsdN-UJzGzbIezqeC9JM9z-CwA6KMXqM3fOKKfzsQRs_P_S0tOeCVa8jAIQldYBIMOvrHBNw; hideBrowserUpgradeBox=true; YSC=amxSApYVCBA; __Secure-ROLLOUT_TOKEN=CPrskui8z8b6bRDMub-zibaWAxjMub-zibaWAw%3D%3D; VISITOR_INFO1_LIVE=9WFOTerMBz0; VISITOR_PRIVACY_METADATA=CgJVUxIEGgAgHg%3D%3D"; in File: "SSL") Found requests in header "GET /img/desktop/supported_browsers/opera.png HTTP/1.1Accept: image/png, image/svg+xml, image/*;q=0.8, */*;q=0.5Referer: https://www.youtube.com/supported_browsers?next_url=https%3A%2F%2Fwww.youtube.com%2FAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: www.youtube.comDNT: 1Connection: Keep-AliveCookie: CONSENT=WP.2676ba; __Secure-YNID=21.YT=JwjWC1_062HiDUtiPR7TPe8fNt_Ix0iHTTlugbGcd494m2w4LtvUdCGzujXae10-uHKZNU4RRTgOBaUSQhrml_jbHmxpCS4s3Ytd_reA2bWNrZWOfrRQ1_t7zj7J1tjhjkqpyOI4_6My02PscYEDOpul9slHeKXa1FOFGI7OLmembAf4uZ9bezjkK95RSje1iTQOAlpht7zni4ztjf33Q0BXQfFuU_WrZdlijW4R05Mn2DfggICuEdqbzKKPiezdbTP7iRoswGBPWKDsdN-UJzGzbIezqeC9JM9z-CwA6KMXqM3fOKKfzsQRs_P_S0tOeCVa8jAIQldYBIMOvrHBNw; hideBrowserUpgradeBox=true; YSC=amxSApYVCBA; __Secure-ROLLOUT_TOKEN=CPrskui8z8b6bRDMub-zibaWAxjMub-zibaWAw%3D%3D; VISITOR_INFO1_LIVE=9WFOTerMBz0; VISITOR_PRIVACY_METADATA=CgJVUxIEGgAgHg%3D%3D"; in File: "SSL") Found requests in header "GET /img/desktop/supported_browsers/chrome.png HTTP/1.1Accept: image/png, image/svg+xml, image/*;q=0.8, */*;q=0.5Referer: https://www.youtube.com/supported_browsers?next_url=https%3A%2F%2Fwww.youtube.com%2FAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: www.youtube.comDNT: 1Connection: Keep-AliveCookie: CONSENT=WP.2676ba; __Secure-YNID=21.YT=JwjWC1_062HiDUtiPR7TPe8fNt_Ix0iHTTlugbGcd494m2w4LtvUdCGzujXae10-uHKZNU4RRTgOBaUSQhrml_jbHmxpCS4s3Ytd_reA2bWNrZWOfrRQ1_t7zj7J1tjhjkqpyOI4_6My02PscYEDOpul9slHeKXa1FOFGI7OLmembAf4uZ9bezjkK95RSje1iTQOAlpht7zni4ztjf33Q0BXQfFuU_WrZdlijW4R05Mn2DfggICuEdqbzKKPiezdbTP7iRoswGBPWKDsdN-UJzGzbIezqeC9JM9z-CwA6KMXqM3fOKKfzsQRs_P_S0tOeCVa8jAIQldYBIMOvrHBNw; hideBrowserUpgradeBox=true; YSC=amxSApYVCBA; __Secure-ROLLOUT_TOKEN=CPrskui8z8b6bRDMub-zibaWAxjMub-zibaWAw%3D%3D; VISITOR_INFO1_LIVE=9WFOTerMBz0; VISITOR_PRIVACY_METADATA=CgJVUxIEGgAgHg%3D%3D"; in File: "SSL") Found requests in header "GET /img/desktop/supported_browsers/edgium.png HTTP/1.1Accept: image/png, image/svg+xml, image/*;q=0.8, */*;q=0.5Referer: https://www.youtube.com/supported_browsers?next_url=https%3A%2F%2Fwww.youtube.com%2FAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: www.youtube.comDNT: 1Connection: Keep-AliveCookie: CONSENT=WP.2676ba; __Secure-YNID=21.YT=JwjWC1_062HiDUtiPR7TPe8fNt_Ix0iHTTlugbGcd494m2w4LtvUdCGzujXae10-uHKZNU4RRTgOBaUSQhrml_jbHmxpCS4s3Ytd_reA2bWNrZWOfrRQ1_t7zj7J1tjhjkqpyOI4_6My02PscYEDOpul9slHeKXa1FOFGI7OLmembAf4uZ9bezjkK95RSje1iTQOAlpht7zni4ztjf33Q0BXQfFuU_WrZdlijW4R05Mn2DfggICuEdqbzKKPiezdbTP7iRoswGBPWKDsdN-UJzGzbIezqeC9JM9z-CwA6KMXqM3fOKKfzsQRs_P_S0tOeCVa8jAIQldYBIMOvrHBNw; hideBrowserUpgradeBox=true; YSC=amxSApYVCBA; __Secure-ROLLOUT_TOKEN=CPrskui8z8b6bRDMub-zibaWAxjMub-zibaWAw%3D%3D; VISITOR_INFO1_LIVE=9WFOTerMBz0; VISITOR_PRIVACY_METADATA=CgJVUxIEGgAgHg%3D%3D"; in File: "SSL") Found requests in header "GET /img/desktop/supported_browsers/firefox.png HTTP/1.1Accept: image/png, image/svg+xml, image/*;q=0.8, */*;q=0.5Referer: https://www.youtube.com/supported_browsers?next_url=https%3A%2F%2Fwww.youtube.com%2FAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: www.youtube.comDNT: 1Connection: Keep-AliveCookie: CONSENT=WP.2676ba; __Secure-YNID=21.YT=JwjWC1_062HiDUtiPR7TPe8fNt_Ix0iHTTlugbGcd494m2w4LtvUdCGzujXae10-uHKZNU4RRTgOBaUSQhrml_jbHmxpCS4s3Ytd_reA2bWNrZWOfrRQ1_t7zj7J1tjhjkqpyOI4_6My02PscYEDOpul9slHeKXa1FOFGI7OLmembAf4uZ9bezjkK95RSje1iTQOAlpht7zni4ztjf33Q0BXQfFuU_WrZdlijW4R05Mn2DfggICuEdqbzKKPiezdbTP7iRoswGBPWKDsdN-UJzGzbIezqeC9JM9z-CwA6KMXqM3fOKKfzsQRs_P_S0tOeCVa8jAIQldYBIMOvrHBNw; hideBrowserUpgradeBox=true; YSC=amxSApYVCBA; __Secure-ROLLOUT_TOKEN=CPrskui8z8b6bRDMub-zibaWAxjMub-zibaWAw%3D%3D; VISITOR_INFO1_LIVE=9WFOTerMBz0; VISITOR_PRIVACY_METADATA=CgJVUxIEGgAgHg%3D%3D"; in File: "SSL") Found requests in header "GET /favicon.ico HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoHost: www.youtube.comDNT: 1Connection: Keep-AliveCookie: CONSENT=WP.2676ba; __Secure-YNID=21.YT=JwjWC1_062HiDUtiPR7TPe8fNt_Ix0iHTTlugbGcd494m2w4LtvUdCGzujXae10-uHKZNU4RRTgOBaUSQhrml_jbHmxpCS4s3Ytd_reA2bWNrZWOfrRQ1_t7zj7J1tjhjkqpyOI4_6My02PscYEDOpul9slHeKXa1FOFGI7OLmembAf4uZ9bezjkK95RSje1iTQOAlpht7zni4ztjf33Q0BXQfFuU_WrZdlijW4R05Mn2DfggICuEdqbzKKPiezdbTP7iRoswGBPWKDsdN-UJzGzbIezqeC9JM9z-CwA6KMXqM3fOKKfzsQRs_P_S0tOeCVa8jAIQldYBIMOvrHBNw; hideBrowserUpgradeBox=true; YSC=amxSApYVCBA; __Secure-ROLLOUT_TOKEN=CPrskui8z8b6bRDMub-zibaWAxjMub-zibaWAw%3D%3D; VISITOR_INFO1_LIVE=9WFOTerMBz0; VISITOR_PRIVACY_METADATA=CgJVUxIEGgAgHg%3D%3D"; in File: "SSL") Found requests in header "GET /rsrc.php/v5/yP/l/0,cross/_maTRyRZ22Z8wmKvUcQXclxgo-3469oiGT9DWDYPz6DhfgQe914iiBfD-GevAmvU9KONMKn3YhINqU49pVNahkCkeiF2w9Hlit1.css HTTP/1.1Accept: text/css, */*Referer: https://www.facebook.com/loginAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: static.xx.fbcdn.netDNT: 1Connection: Keep-Alive"; in File: "SSL") Found requests in header "GET /rsrc.php/y1/r/ay1hV6OlegS.ico HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoHost: static.xx.fbcdn.netDNT: 1Connection: Keep-Alive"; in File: "SSL") Found requests in header "GET /rsrc.php/yH/r/uR_TIYVE0g0.eot HTTP/1.1Accept: */*Referer: https://www.facebook.com/loginAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoOrigin: https://www.facebook.comAccept-Encoding: gzip, deflateHost: static.xx.fbcdn.netDNT: 1Connection: Keep-Alive"; in File: "SSL") Found requests in header "GET /rsrc.php/yP/r/b_lEtPAUPMI.webp HTTP/1.1Accept: image/png, image/svg+xml, image/*;q=0.8, */*;q=0.5Referer: https://www.facebook.com/loginAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: static.xx.fbcdn.netDNT: 1Connection: Keep-Alive"; in File: "SSL") Found requests in header "GET /rsrc.php/yP/r/kUc6oHI0fJd.woff HTTP/1.1Accept: */*Referer: https://www.facebook.com/loginAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoOrigin: https://www.facebook.comAccept-Encoding: gzip, deflateHost: static.xx.fbcdn.netDNT: 1Connection: Keep-Alive"; in File: "SSL") Found requests in header "GET /rsrc.php/yf/r/ipwqPKyH2FY.ttf HTTP/1.1Accept: */*Referer: https://www.facebook.com/loginAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoOrigin: https://www.facebook.comAccept-Encoding: gzip, deflateHost: static.xx.fbcdn.netDNT: 1Connection: Keep-Alive"; in File: "SSL") Found requests in header "GET /images/branding/googlelogo/2x/googlelogo_color_74x24dp.png HTTP/1.1Accept: image/png, image/svg+xml, image/*;q=0.8, */*;q=0.5Referer: https://accounts.google.com/Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: ssl.gstatic.comDNT: 1Connection: Keep-Alive"; in File: "SSL") Found requests in header "GET / HTTP/1.1Accept: text/html, application/xhtml+xml, */*User-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateDNT: 1Host: accounts.google.comConnection: Keep-AliveAccept-Language: en-US"; in File: "SSL") Found requests in header "GET /ServiceLogin?passive=1209600&continue=https%3A%2F%2Faccounts.google.com%2F&followup=https%3A%2F%2Faccounts.google.com%2F HTTP/1.1Accept: text/html, application/xhtml+xml, */*User-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateDNT: 1Host: accounts.google.comCookie: __Host-GAPS=1:dGicS1RezPPfbcGCIFiwvqga15Ufxw:eQBDkx1oX9wM_e52Connection: Keep-AliveAccept-Language: en-US"; in File: "SSL") Found requests in header "GET /v3/signin/identifier?continue=https://accounts.google.com/&followup=https://accounts.google.com/&passive=1209600&flowName=WebLiteSignIn&flowEntry=ServiceLogin&dsh=S-1040078446:1787464833935852 HTTP/1.1Accept: text/html, application/xhtml+xml, */*User-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateDNT: 1Host: accounts.google.comCookie: __Host-GAPS=1:dGicS1RezPPfbcGCIFiwvqga15Ufxw:eQBDkx1oX9wM_e52Connection: Keep-AliveAccept-Language: en-US"; in File: "SSL") Found requests in header "GET /_/bscframe HTTP/1.1Accept: text/html, application/xhtml+xml, */*Referer: https://accounts.google.com/Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: accounts.google.comDNT: 1Connection: Keep-AliveCookie: __Host-GAPS=1:dGicS1RezPPfbcGCIFiwvqga15Ufxw:eQBDkx1oX9wM_e52"; in File: "SSL") Found requests in header "GET /favicon.ico HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoHost: accounts.google.comDNT: 1Connection: Keep-AliveCookie: __Host-GAPS=1:dGicS1RezPPfbcGCIFiwvqga15Ufxw:eQBDkx1oX9wM_e52"; in File: "SSL") Found requests in header "POST /v3/signin/identifier?continue=https://accounts.google.com/&dsh=S-1040078446:1787464833935852&flowEntry=ServiceLogin&flowName=WebLiteSignIn&followup=https://accounts.google.com/ HTTP/1.1Accept: text/html, application/xhtml+xml, */*Referer: https://accounts.google.com/Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoContent-Type: application/x-www-form-urlencodedAccept-Encoding: gzip, deflateHost: accounts.google.comContent-Length: 262DNT: 1Connection: Keep-AliveCache-Control: no-cacheCookie: __Host-GAPS=1:dGicS1RezPPfbcGCIFiwvqga15Ufxw:eQBDkx1oX9wM_e52identifier=&hiddenPassword=&usi=S-1040078446%3A1787464833935852&domain=®ion=US&=&bgresponse=FNLReferenceError%3A+%27Symbol%27+is+undefined&pstMsg=1&checkConnection=youtube%3A60405&checkedDomains=youtube&action=1&at=ALX_P8uFwDkxla7r6QajbwX7DTRH%3A1787464834034"; in File: "SSL") Found requests in header "POST /v3/signin/identifier?checkConnection=youtube:60405&checkedDomains=youtube&continue=https://accounts.google.com/&dsh=S-1040078446:1787464833935852&flowEntry=ServiceLogin&flowName=WebLiteSignIn&followup=https://accounts.google.com/&pstMsg=1 HTTP/1.1Accept: text/html, application/xhtml+xml, */*Referer: https://accounts.google.com/Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoContent-Type: application/x-www-form-urlencodedAccept-Encoding: gzip, deflateHost: accounts.google.comContent-Length: 259DNT: 1Connection: Keep-AliveCache-Control: no-cacheCookie: __Host-GAPS=1:dGicS1RezPPfbcGCIFiwvqga15Ufxw:eQBDkx1oX9wM_e52identifier=&hiddenPassword=&usi=S-1040078446%3A1787464833935852&domain=®ion=US&=&bgresponse=FNLReferenceError%3A+%27Symbol%27+is+undefined&pstMsg=1&checkConnection=youtube%3A78&checkedDomains=youtube&action=1&at=ALX_P8uyVo_WZINfBhZduBmJkUgC%3A1787464865801"; in File: "SSL") Found requests in header "POST /v3/signin/identifier?checkConnection=youtube:78&checkedDomains=youtube&continue=https://accounts.google.com/&dsh=S-1040078446:1787464833935852&flowEntry=ServiceLogin&flowName=WebLiteSignIn&followup=https://accounts.google.com/&pstMsg=1 HTTP/1.1Accept: text/html, application/xhtml+xml, */*Referer: https://accounts.google.com/Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoContent-Type: application/x-www-form-urlencodedAccept-Encoding: gzip, deflateHost: accounts.google.comContent-Length: 259DNT: 1Connection: Keep-AliveCache-Control: no-cacheCookie: __Host-GAPS=1:dGicS1RezPPfbcGCIFiwvqga15Ufxw:eQBDkx1oX9wM_e52identifier=&hiddenPassword=&usi=S-1040078446%3A1787464833935852&domain=®ion=US&=&bgresponse=FNLReferenceError%3A+%27Symbol%27+is+undefined&pstMsg=1&checkConnection=youtube%3A72&checkedDomains=youtube&action=1&at=ALX_P8uA0VFUkW0r-Bo7epcvrplM%3A1787464895984"; in File: "SSL")54:T17857,"GET /login HTTP/1.1Accept: text/html, application/xhtml+xml, */*User-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateDNT: 1Host: www.facebook.comConnection: Keep-AliveAccept-Language: en-US" "HTTP/1.1 200 OKVary: Accept-EncodingContent-Encoding: gzipp3p: CP="Facebook has no P3P policy fb.me/p3p"Set-Cookie: fr=0xJx8q7pYXcLFkuIq..Bqiox9..AAA.0.0.Bqiox9.AWey6xNcZKm2VIfDYwNMBIAlq_8; expires=Sat, 21-Nov-2026 06:00:29 GMT; Max-Age=7776000; path=/; domain=.facebook.com; secure; httponly; SameSite=NoneSet-Cookie: sb=fYyKamFh8COBMtYqAvPNV_CG; expires=Mon, 27-Sep-2027 06:00:29 GMT; Max-Age=34560000; path=/; domain=.facebook.com; secure; httponly; SameSite=Nonereporting-endpoints: coop_report="https://www.facebook.com/browser_reporting/coop/?minimize=0", default="https://www.facebook.com/ajax/browser_error_reports/?device_level=unknown&brsid=7677102989740238160&cpp=C3&cv=1045827508&st=1787464830035", permissions_policy="https://www.facebook.com/ajax/browser_error_reports/"report-to: {"max_age":2592000,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coop\/?minimize=0"}],"group":"coop_report","include_subdomains":true}, {"max_age":259200,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/?device_level=unknown&brsid=7677102989740238160&cpp=C3&cv=1045827508&st=1787464830035"}]}, {"max_age":21600,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/"}],"group":"permissions_policy"}content-security-policy: default-src blob: 'self' https://*.fbsbx.com *.facebook.com *.fbcdn.net *.facebook.net *.whatsapp.com *.whatsapp.net;script-src *.facebook.com *.fbcdn.net *.facebook.net 127.0.0.1:* 'nonce-if" "zsPuFJ' blob: 'self' connect.facebook.net 'unsafe-eval' https://accounts.google.com https://*.google-analytics.com *.google.com;style-src *.fbcdn.net data: *.facebook.com 'unsafe-inline' https://accounts.google.com https://fonts.googleapis.com;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* wss://*.whatsapp.com:* wss://*.fbcdn.net attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' http://localhost:3103 wss://gateway.facebook.com wss://edge-chat.facebook.com wss://snaptu-d.facebook.com wss://kaios-d.facebook.com/ v.whatsapp.net *.fbsbx.com *.fb.com *.instagram.com *.ipification.com https://accounts.google.com https://*.google-analytics.com;font-src data: *.facebook.com *.fbcdn.net *.fbsbx.com https://fonts.gstatic.com;img-src *.fbcdn.net *.facebook.com data: https://*.fbsbx.com facebook.com *.cdninstagram.com fbsbx.com fbcdn.net connect.facebook.net blob: android-webview-video-poster: *.whatsapp.net *.fb.com *.oculuscdn.com *.tenor.co *.tenor.com *.giphy.com https://trustly.one/ https://*.trustly.one/ https://paywithmybank.com/ https://*.paywithmybank.com/ https://www.googleadservices.com https://googleads.g.doubleclick.net https://*.google-analytics.com;media-src *.cdninstagram.com blob: *.fbcdn.net *.fbsbx.com www.facebook.com *.facebook.com data: *.tenor.co *.tenor.com https://*.giphy.com;child-src data: blob: 'self' https://*.fbsbx.com *.facebook.com *.fbcdn.net;frame-src *.facebook.com *.fbsbx.com fbsbx.com data: www.instagram.com *.fbcdn.net accounts.meta.com *.accounts.meta.com *.fbthirdpartypixel.com *.ipification.com https://trustly.one/ https://*.trustly.one/ https://paywithmybank.com/ https://*.paywithmybank.com/ https://www.googleadservices.com https://googleads.g.doubleclick.net https://www.google.com https://td.doubleclick.net *.google.com *.doubleclick.net;manifest-src data: blob: 'self' https://*.fbsbx.com *.facebook.com *.fbcdn.net;object-src data: blob: 'self' https://*.fbsbx.com *.facebook.com *.fbcdn.net;worker-src blob: *.facebook.com data:;block-all-mixed-content;upgrade-insecure-requests;X-Frame-Options: DENYdocument-policy: force-load-at-topdocument-policy: include-js-call-stacks-in-crash-reports" "permissions-policy: accelerometer=(), attribution-reporting=(self), autoplay=(), bluetooth=(), browsing-topics=(self), camera=(self "https://www.fbsbx.com"), ch-device-memory=(), ch-downlink=(), ch-dpr=(), ch-ect=(), ch-rtt=(), ch-save-data=(), ch-ua-arch=(), ch-ua-bitness=(), ch-viewport-height=(), ch-viewport-width=(), ch-width=(), clipboard-read=(self), clipboard-write=(self), compute-pressure=(), display-capture=(self), encrypted-media=(self), fullscreen=(self), gamepad=*, geolocation=(self), gyroscope=(), hid=(), idle-detection=(), interest-cohort=(self), keyboard-map=(), local-fonts=(), magnetometer=(), microphone=(self), midi=(), otp-credentials=(), payment=(), picture-in-picture=(self), private-state-token-issuance=(), publickey-credentials-get=(self), screen-wake-lock=(), serial=(), shared-storage=(), shared-storage-select-url=(), private-state-token-redemption=(), usb=(), unload=(self), window-management=(), xr-spatial-tracking=(self);report-to="permissions_policy"cross-origin-resource-policy: same-origincross-origin-opener-policy: unsafe-nonePragma: no-cacheCache-Control: private, no-cache, no-store, must-revalidateExpires: Sat, 01 Jan 2000 00:00:00 GMTX-Content-Type-Options: nosniffX-XSS-Protection: 0accept-ch-lifetime: 4838400accept-ch: viewport-width,dpr,Sec-CH-Prefers-Color-Scheme,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Platform-Version,Sec-CH-UA-Modelorigin-agent-cluster: ?1Strict-Transport-Security: max-age=15552000; preloadContent-Type: text/html; charset="utf-8"X-FB-Debug: Rhw1yW7OHVrqhxnngOwEhIQBO83QmCIrUVmB5apXkB+He+1K8GrGC/Tiop/mAdozxCjfLZaO2GJFDXSCdnsv0g==Date: Sun, 23 Aug 2026 06:00:30 GMTX-FB-Connection-Quality: EXCELLENT; q=0.9, rtt=8, rtx=0, c=10, mss=1392, tbw=141, tp=-1, tpl=-1, uplat=197, ullat=0Alt-Svc: h3=":443"; ma=86400" "Server-Timing: slb_crtt;dur=8,slb_srtt;dur=-1,slb_req_start;dur=1787464829963514,slb_srv_hdr_rcvd;dur=197246,slb_cli_body_rcvd_first;dur=-1,slb_cli_body_rcvd_last;dur=-1,slb_conn_lat;dur=0,slb_ssl;dur=39,slb_rule_lat;dur=0Transfer-Encoding: chunkedConnection: keep-alive2fb3��}�s��v��`��L��`��7H�d��F�I� %Q��h4 �$w�=�X��t��O�^�_�i�yt��e�ڤ��/��|l�,�]F�s�e�V�|l3?i}��Zv|o�I;A��o��m7l�/��Ӹ��/�r~��c�V�qW��O;��ۛ4�&��J=��t��4t�qۧ��^��A��Sώ�(��]�"�?�O��t�ܹ��Pd��l'�(N�]�ѵ[��])W��^z�z��ad��{q!�ö�(�l�gux}}=%�qjG�?Z{!�Nҽ��(�ݏmo��|ٙ��8�R�u��U��:��t��e?�OD��ߨo��n��IZ��SQ��P��J��r�2��q��q*��q\��2N��ze\/��\P�'��&�U�'��(~U��I�;��b�D�u��L��I��ر2��]�Fa'u��Fځ��e?��h:�S6S�Ǌ�ak�ck�Q��kb��'��p��:��@u�~��a�.� �#��g��L�$Ѣ��YE�d2��MRF�,�Oƃ�x"��B�^��22诪�?�՘�_A��R�P��,�(�|!�9W�uÎ��>?P�>�>��H��2,~��'�4�dzl��%�E��&$��~��Z�6�+��я��X�]*n��B*�Vi��-=��t�=7��T��dCP�u�4��^�:��'�)�:��a�c)��ho�8��OLEStR�Lh�9�Ƥ�g�ulm�4��@��MՔL�S2��Q��H��*MLyL�8y��?(�I�V,�r�D��)�9OF�(��NH��P�k�"��`21Ke��Vꢼ��1�� &�}01�Q3��O��h2,��W��R��!2�NJo̅��-��T�9��hLҷsLXi�UWV˺�PwL�7�֢`J�9�4N�(\3L��Ӟp�P�kz+�u�ܥ�O$Uӆ��l�TdEUH��n��ퟘ��AdMZ�_�%BÉ%R�g��hbf�Й�A��QBg&�&&G�4�%47��(�3#�F#��L��+��`ٶ�Q��_�}��g֖�", "�aOXǖ��|/t�8��'l��?-��S�g�M��ƾ�/YT�@1M@d)�4M�`��'��H�L�f"є��`��eo��ԍ�� u��˚b�8�l7V⽻��R��<4Ύ�(��b�?�*B�q��X q�(t��[#H�8^b-}��q��l��K��*��Ln>,�5r��`�0J��g[��]#�Z8�\Z��&B$��H�܎��]�5��W8�OE�јG�?1�C��#�EUm8ֳ8�^�:��?��QN��3��p8��)��R�y��UT��vQ��l�M�"n`�c��)��+*Yj0�Ҏ�,b��D��F��C��N�а�bǍ;��%��>��)FC&��./V��{ꉩ�4��{��Q��(H]U�T8��Ɓ�UO3A��^�?Ue�J�ꟌE}$��ͺ^��2��ZgA�^�F�B��@��9n�?��K'Q�韌&c�H�P|�&��"I�痝�(v+~�W�ˎ��u4�{>(u<�x��?)�_n%�ֳ~Һ��V��I�?�GI�v��N�";��2�N�&�OH8nb+I2��+M�Xu��C��1=�̞^��~�ԓ�JI��^Ϡ��n"T��$ե�0�#u�R� y��qg�S�maMJ�-/��YetPF�b첚H�ZPE�U��hܹ�N�#��Y�8�s_��z�8-U��j��j|��{��ׅԻ��Q�P��Ϗ�j��[�VoI�i�%�Kk�MPŒ��@�a��J��GI�K�j��%�J�Bk �T�X^�z]�~׏��hiH%%�G5^�Y��ae�.U�@UPI:pa�a*t�]P2�JKQj��(�q�n��AR��B��Ġ1��)�ۉ��o ��L�$��i�kzO&�F[��=#Xo}��9��¾x*�VE�Dd`T��d�!��ƍ��F�&JR��x�k'q}�?��`e+��eD�d�Ŏ�XV� �/�hx�([��^�]��}��b�c2�E��VWZ=/��@ �gd�VZ��Ȅ�y�Q�6v`6s��i�õ�Fs!�"&z�$ˉ^��%m�Z��0��ml��ۇha�ƛ��b�8h�|-p "k:�+��cR�cw��'+v��7i��Eu*�^:K��'~Q�m��-��#N>��V�QҨ�F[��+;R��95�w��(�v�_U�Wzcj��ZɦF3X�$bUdUd��,�HkF�5��b��I�'��7��B��Ҵ�-`vC�+�Q8��I˨�h(AA��e��J��bdeG��+�Y�?�ceCҎ��Jf��Hjw(=�TO&&�.�eQ9*K��`コ��&�k��u��Mw�7�/�Z�Z�"þ�mۍԿ�~��q߶V� ��qc0pA/�� ;��)pl�Z��2�0��חQ�1�b�@f�虒qY��9��4Q2<�mj�`K��㉀$*g��1rL#g�J��Q`�n�z�_�9��*8��B�e�(��Z�v��u��,�P", "�yZw��M|߅�;��("p�h�D�5:�Y4gp�y8�6P�s0l>��b��S/�-��\-��;^Z1��J�Ii��k�xmIc�@%5%�*�E�y��Zq@LKCpX��@��D�<�b�B�Ap��ɶk��L�0ȍс�\Y d!ʗ�o]4~4��%PD��z��tCu��r�](��wH-q��[��GRfc�%�V\�UyE�K�0'�z��v��r��dT�%�I��r8��2�('T�p�Y3T5il��v��$�Arҩ�f�ɇ00"�ʣ�U�anxa�}�&�+��[þ��(o$I��@ap9r@��WVR�kn�d��+��}��n}��`��<��t��5n�O�}6�0Z�rzk^�ށ��]�|+��Xa�I��{�t6x`�u�(��Z��Џ��(�ȷ��)-;Z��?w��Bk{�_�l�#��n�_�ν$�b�Z��P��;��(@�+��z�Q��6�/I=��u}��P�Z�հ4vS;��W�A^wB�|ҩ��Up��N}�Il��~~и/��t�W�>չ�@8��{R̽�(��a�RƗH��E@f�=�9��d��9l��2�:$J�jf��-I��+F7��`gY�8ʽ�vR^��(�~$�a��V0��O<�8�:�RX��(�]�7O��f��|��'/�Fqj��'��I"�s�ΰ�'�##8Ԃ�z��M��?�x��#nt��mAX9��Dy�r��b�X�[�|h�M�]��Vƀ1"\wV�Ř��ܰZ.��P��]ptW��^b�*�(�*Z��㘈뛾��)� ��sG��f��PY��S|��Xq�;��ҐD]�Ԯ �--*&��:犛��"��Ϲ��B��+[�x�<˴��?��n(��Q��c��cKxǅ��F$�N��8�tx��O�\ك\O��O��-��_d�O��vNbk��P�H/'T]:�)z�*N�� A�/��ѭR�� R��(^[a�=�6*�"�`9WJ��8V�S`=��y"P�˗��VeX@c��rEAI��S�`Ykj�J2�3��)�F'@�/�%pm�a0��<��X�!0p2��=d�)�<��GE�;�A��E�.�R;9��H��A�zM9D�N�l��a0jk��8��Q@�H�}�ٮ�(k��=�J́�d{�\�EJ�� \Sޅ>t��P:��+��Cr�#� ��$��a�I��|,y��Bp��{�c({Cp��,�쩨��e��"��mr�䁘SR��H�t'�"">��C8T�"<�^��V��V��h�U�Q�x��,��.t��ի[�c�b��B�I܁��R4^�@o"{"�s�l.�O�uIP:�Z<�P�]<ƋGQ�ln�9�SЅ��-�4ۃ-��`}��G�~�Q��h[��-��P�x�K��I��w8L\)�C�k��8��*��ddjh��!Q��uG`E�Š3�OXy`,��"u!�1t}��Ԯ�`~��m��Q��+��&�D� �<���]�p��B�{�HT{��+��bAo`��.� dr]}GȂ��2!D��t�eY8zOr�+�!��S�N�F��3�?��\ �"%4�&&��p��&x��-�ܓDGM1�y@YJ�2,�:�H�h�р��C_��wS��gB��aHc�t��<1��nH,91&|��o��'&�8G�<��y*b6��\�Diك��=�B9�5�3c��ۼ��v`�D1��2A6�i�|�K\t0R� x�,{"*��\)n�.=.��v�f��s$�<#��@`K�N��Zhy�9�`��b�W��á\��zŔÊaVL�eF7��ruSX{�PAm"Ƕ��)_�yxp�bz��鍺P:ݎ�C�È��G�쏼C�� JN��ncT]�!OR�d��|O"��G뜋) 9XD��NNT�n��ڠ%��U��bj�ٍ��E�R��$)��\h_UWXp�x��w��z�B�Jb��A��FN4�PW]�<�ٸ�T��kxK��VfgBWy��7��7��F`U��l��W��/嚃D5TB��rlG�u�z�Қ��ة��n_e�47�G��::�Y�з�HvA��Ԋ��6��F�qR�᧴"�Z��=��±�g�{߸晠:B��1P��e��u� J�S`7�%�g��}��%��Y!J��{?��ayL��eM�PrF��iP��GO��8*?8��(�1@=�A�m��H��m��g�Ro��N�D<��F�)O ��Sd*��@%(~D�z��&��5�Q'��ڈ)S8��;b��H�Lf�%S_W�r��F�d4�m��C��v��9�o-#��o46�U-�*q؝��6U-��dw"wyڑ�T�Yʆ�BH�)�%��61Y��p(�T�<ʕh�=��@o��"�o�h�l�0�&Ȏ��˟�|u��7<�×�j��l�#!��fV��4y��`�5�yTk��bb�J��2w3�έ��X��b��\�(��y�m��p��8W��q", "��*yx3��P�ҏG��($d��.��-$|�]Icp�)��e�4�p�R��v\�Տ��R��q_2.\X��Ɣ> 6��T�7��c�Q��;�ےfh�L�VL�e�dBu�P�60��#�[Q} \�&�qd�:��T��:/ülVd�246�Q��Ҡ�Ѳ��El�<:�+�ɫhĕ�[� /��0�&ъ�Jr*��SM��!$!$▿��cR�Bd= �Zfݭ��GC�� ЗP�� jӁ��!��ј��`r��J]�Z_��!�e�*�G7T�^_�;�&�3cæ��Q�f��$�=^s#=fz+�(4�O��7�9[��%\n�pb��4�L�%t6��h2��O��_BgF�&F@��%1J�� (�3��*��<Ɵ��R>�l_�솭��⥣�G/J�Mx��i��L��i��DE�`��eo*h��*��H-iF��If�#/�û�9�|�8y�T�ϭ0��R2��Z��cf�8�+*34�e�8��r5bxŇ$ѣ�`�C��qP��'��h��+�`�'��&�z�E�CC�n��`�Ԇc=��i6M]f1�i��g�� K��'�+�p��QU�.�,��H��p��xW��'�P6E�1Z��?�*�y5�l��_ೇ�U��``��f�dʠ�J��}�Le��uDM�#�r=Q'��gƱi��Z��N 0��4�a!8�x�o�L�8CƢ>��Q�J��\�銕��0��/��\:���:��|�ھS&��;��ZR'��)d��:ꟈ=]G_�q�l]�tĈl�W��(^�"gu�Z�2p�a.fDqC��'B>ay�diL�Ȇܹ@��>�_��KI߃�Թx>�q��UX�(H��aN��o�["�6@��0߅��Y�SH�^h��S��j��L��$`C-w�b)2��V��b$��ࡷ��)�{?��\^��'��*��IO��jL[}��_`�G�H�-�T��v`��E�l�D�A ��A��+q0�/��E{EQt��j)/��eU��KS$��L��&� F��쥞d��rQ��'��GՌ��.(]A�9e|�)��?ed�٧��a��;��3m:�N��'�(�z��%��0q}�w�>Z"��uSp�TU��gy,��q*{}��b�8+��zv��>��p��\�z�T4�^��Qs��d��A"�B�|uu�WX�s^Q LC��G��W��,�Ȟ��Nm�S�?�N&��Y��xD�&1(�c�f��+��L�aғd�)x'�U��2Q��x8��7M��#�@k�/L8��x�3��e�/��.�P4�9�{�~��5QS5xԕE0��Pgh�fX/�u.�}�)A�I~2k΂��j��OǠ�E��d��"`V��l��W��v��X��3�l��ٕ��H(h��}��/=�[5��>_]5T��-�l5�1��-�M�r�Eu_��2�\��^GI0D��g%�g��1MǙ5�#�g��Ic��Y��n��Y�D��Ȟݏu�PW�#�{�ګ�a�{r��P1�f�U��d1BymJ1�ݽ"��D��6�f��!�oH��?�U��cPCzߐ�W=CV�fF�:�ң�u�\6b��kH�=!n�9t��r�g�6��|�4Q2<|Czߐ��{��hH�Y��ȱ��ߟ2�(ѐ�SLR��$2�DD3�7��(�!�oH�+��(@��}-�!�oH��Cq7��=D�U��X��=Kh_�{��x��{I��"�}��^�]��=E��T��@8=�q+��<��~[Q�HkOW�1��P��T�G�'H��$��}��A�L�:�JGT�?J|s��P!C]0��x-&s��>+/��1�DTA5ԋ��ǘb��@�.ü|'�=�(U�,��n�{��R�h&h��=�?#�ǘB]��RG��+�p��xa$]�v�{�6��(�dA�t�� $�� ӽ��"H:��=�pg��.V��Ũ��YNQ�� ii�,�}~��m��p�7��}�o�m��ݔ��½��ӎ��۾�p��v�Pٮ!;g��B��X�p�W�q)��s�g�6��3(��T��A�O�C!�b�A��+�xQåE+��ȡP��uIP:��p�S�mA��#n{�+%��^(�?1'�x��8��)��ԓ{*x��D�v{��T�Š3�I � 9�<:iH�8�{F��K��}�m�p��ϟ[��Yxׯ2�G:��쫹桑��W��s��9:`'i�m_�*��}6��a��F��/bG�١��=š�g1��a��}��C��6��`��l\d�R�5��t-��0\�q��J�&�l��b�sҳ`�m��Pf�o��UE��'��n��LTeFϥ�ϓ��8N�b��7�t��3Z!�L��1p�pyg��LA=�d�r�w��37p��Tv��UIQL�VL�2�Չqs�]��J��q�_Y�byܢd�<��w�ӗ#8��8j�96��;J�R�`Oa��l��8A�\��礸�f*K��\��Y=��J�*��H��3��>* �J�q1R�u��4Cֻ�y�Vۭd��Œ��Cc;��-��!��b�@=�S�!�d�u_%��s�}�u_'SZ,��g��}�u_��U!�k��o��k�d��/US�uO�_�u�pݗ��p�CO��|w��_��x4�c�;Iڭ��?�! ٸn�nmbw��o-p%0qӏ�t��xKW��M��d�<��^�4O��>��2x0F��-�3��ԏЪ�J6�Z�ƛ3l��8J�(��^��m�Q��]�Ŷ�}��ؖڭ��ر�M[��/OI�q��0m�c�[�'_v��덟$�~{'m��B;yJ��n|��i�s��.q�%I�R}��Z�1��`k�߼Ul�4zv�v�=�_��4��a�v0��o;/�b�-�mߵ�oOɷ�e�Q��_;��h�q�9�~��w��(=��ғt�-��qx��m�߀��+�O\PٰX��as�JbW/]Lo�'��B2��y��y��s�Ƽ��ח^�r.6�7|~��lnfo�r��s��R��GZ��ߘ˳�t1�į�?]��b��Vx��.��e?�<��8gf��v��-��b�(��bc��1x��w)pfړs� ��9O��r9��8S��L]�[3�[�=�_��K_4�o3YsV�o��|�}�M��q�_��}q�)�k��F�*;��ud�83��p��<|z�o�/��]7/�^�/�dͧ�ݙ��}�Ϩ��bʹ�b�nf��e��c.�Eou��(��]}�^��ֶlHvp�?��Ǉ��Q��o�h�?��-v�(i��d�Gn�~�eY��Bۭ4%��3��^x.x�sH#�w��~m�E��j�Ý�mX9��o��F|ug��]|q��P��&3d.�=��.��5{�g��x��,f��n��4iy��u?06��7g>�~�7v`��^��d��\��i�>�o"*��9c��s�o��o<;��!��n9zK羷x��h13��j S�f��B ��L{��"}�O��|��p�`�ڇ�ě�L��3�i)�j�U6R��؁t/��D�R��%��{ϛ׉ڇi�|�ŷ��Ȼ��˳�7�oD[�?\x��N��e��6��_��b��_x�+�g,��b2M��E4�%��<��M7��0�f��\|Yz�z5wg/Ke�^��˳�ݣl?��3s�,�'Ɨ��ˣ��`��8��a��'�1e�!L��3]܉Ɨ��Wi:�7�z��7؄g��s'�oӻ�ěz��W�ho�<�|pc�^?�_w��km\�m��vE٩g`�Q�?��׾3n��8Ӟ3#�8�V��;Q�s�A�s��[Ng�� ~@�o�<��f�M�h�>�*l��]�N�/� ��7��i|�o��9��C��q~�d�2$��⺸��m��dZ�|�ݼ|��=o�!_Y�X��O��ӥr� e�y1�^<ί#�a��<��͗;ѻ��m�l Çd9z��>Y3��f~'�]�_��ݣ��ݙ��̔��n9{x�f�m�2��:?�u�Y�s�6!��Q��v��%lWo�cpy��}��rt��:#q��Vg�`]е��z�u��<�Ke��`x�dͯ��L�mo�!m9zNlO�/fҋ<�p��mm��_��Է��,�/v`qD��Vsih�Ӎ{�v`��gT�Mi1�j�2(�kq�L�˳�h��a~��X3-��`y?IQ��>*��|1��}ށa�ff��z��~mß��g�_��4��9��,�ϖ��Y��6��uĄo]��}�O֙�,`��6�`��w1��Ŀ��-��b>��Ze"��T{83C8�ݮ=��&�j�>��9��[��=��&oWgב5{{��8�|��;��h�go�ӿ]o?��q��둱�z��isv7ن�}{;]-m'<��C��v��}��X��f!ˋ�kp�ro��:�(�nD�ٝ1��j��5$��q��}/��O��򸹸��^5��y��z��j��^*�B��M}K߿��M�EPTA��(xWMd�p��_��_��ә��ί��" "4000�is�H�.��L��~;`7�~�C�b�,K*Q��E$�$`,��j��d&v�卙��_lyr?y��Y��r>��9[�y=��K�@�߁��7�?�c�8=e�5�D�O�i� ��ߴ��v��$g0��ز��q��U6"��b��k25�vŗ�m�/f�=�G�N��}T��i��Y�*�&C��Ru86͢I|�� )�S�t��A��hX�ر'f9�ﺶzxV�n�m*�idJ�<��w��FG�l�Tl��-��d<��LŊ��N{gd��u��i��I?��셱p��L{Wٚ��I�Բ��%��Q��f�v�n�S�wV�a�"�c�θw�c�c�zO�c�{w�1'��脱�~��a{:�˙Z��LX�i?eV/��}��G'�樿��Щ��n�I�ԇ��32��3�/�t��ȬoE��F�$c4��wuF�q�*�&F��3qz�t4�?��8ƴ{7bl��%��}0ΰw�Τ�\�ǒ}�ӻ��q�O�/ɉa�"��pz��!��}0�3�]��pһ_��'�s��za�F��55%��2��j\K�0��=5c�ۙi��'@�Kd�}�!��]I��ILU4��v?^��!��4�,�y�1�Q�d��C~�Q2ͩ�{�Ms��/�e��kY�$@��v��PP��XV?��~|:�dZ�s��n,��lC�:��3�}�#ƴ�~�jڇ`�}��ô�4��W��Ǯ��.j茤TjoC��t��40�տ�Cc��g��8HJ��I��~�Q��G��:2�Fv�k��8ǖ��:`Lc��.�u�g�ö��J��4�R�}@�NU��=1����ڎt�X�wN7L�Rt�LX�C��ɨ��dN��`s2>�.�L�eU�dz@KS〻pj8�dpj��ُͩnSsx@CV��Ȝ��i��:S��:�9�a?K}Q�z[��Z��4P/��,c�/��{�,cҿ��9`�S��Xƴ�"P��R��R��Vh��3;`h��i�a��?�ԏj�a��LCjU��n�4��_'��!�i��F��B'�bh�_Zg�F��2ͺ�sHf��2�~��e��u�-�4��@��eN�u�꟝51��3�:@:dY�~�R]��=��Ak��p��-m��c;��q�;βW��h�==��q��9��9`Lv��r�ȅc��A�;^wLg�4��<��x�[C��}��M�ɤ�Z��:��t�k@��/�p鯔�0\zdA^��C�E��UУ�W!rl|��*nu�Fd��", "�愲�c��}��־T�F_��Վ��Z��^\}sւ��%0��:_�I�aM�Ks��#��5nA\j��a5��Ep��r��Wi8��*n��sΨ��O��׾r߻׎�5�^�ﵜ��?3�s9w�� \�l��0��Cz�}��{��X��i�$s��]��Ȕ7�_ܬ��f�ǿ�Yk(�_�.0'�)�A�HD�&~YN�`S׬q��k{4&S�Z�XJ�/�@Ԑ/��Pr��*�X��%�a�!�Z�Qr�U��ɖ��'ńU>M�}s��|��.`1X�p�c7�2�ؔo��w�=��IM�\uJh�M�F:��C͋��@�2��0��/�-��p(�p��/jl򃲶�R�q�t�C��EJL�*��H�m�Y�eV~Q¸��D��3m~)-��C��r�&�0�u椀��2,��c��\�d�vG�I��]_��3�M��~Ǟ�4�Ux-f�7l�/�~��E|�Ŗ֑?bG��w]�C�?��ޝ�q�u��ڑvdڎ>��H�Nu��1�M{��#x;:⠛�iL��>ч��;�i��PG2i�MS��?�-G��C��S7��n:��t�é>4u�r�;��Ǻ�ug�'�3�Mg��L��d��&:��CG7�c}4�Mg��1`s�O}jꓱ>��X7M[�L��O��c趩��i��ۆ>飩>�i�&:��8�d��Cx~ضn[�=��nO��Mݞ�#G�O��/��)X M��t��8�!ݦ�PH�T$V�!嫈k��a��h�.@/��Lx��~�x�w��_?�� ]�]U��"h�ˢ�?r��a�9?AV�Uմ��z�b9ӝ��8`~�R��߀��]��2l/��,a�G>��4��R�x2F�k�_l�,g�s��O�V��-�$-y�@%��x�x�,k��8t�1>�x�!|Eډ.�KW&�s�u��N�/y�p��b�]D~��YGy�!��;�ܔ-��%�t-�V+�QN��v{��1��u��S��u�F;��@�f�'r�\�_8�S��"��!E|��-�#��[)�TS$��M�Tp�l��n�"M��+U��"�eY�k��{��<[�*�N-��b*��[��D�O��e�#�X�27O16�!͢�Mx��2d!]�4EUj�#�s?𳭻�=�U��k��.gI�U��nUOYDR�c�^�Ѝ�&|��G��$ڸk�x��ggtSx��Ql�M�U�h~��H�S�Y&j��p��<�h��cw<}}�Ş��~z��|��n6��=q~��k��"ۆ=�� ,̒�:��t��4��TK��D��u��K?ɑm��I��Ï?j�u@&��D-|��0?�T�4�M�T-�:؄Z�C�$�t�>�!��Z?�� ?i�g��5��ک��P�b�Fy��]4�^kjL�Q�ꟴ�g��&�!Z�FV�oq��E��lv5C�ژo��JYW#��p�HE]MLMSH��O��=mv�vt2%��D��:;�n��d:��8��5D:��}�R�x��I��ܪ:��Ɔ��UR\�]#��c4��p�}�ۥM�Ǫ/l��fY��Q��N��!5�?��B�*�k��c��d4�io��]+s9�?�&�KGq�5�)蟴��_<\��F�R�*`��}8!��w0�c�⸁O��f�h/�+r�V~��I��G��:�J}��6֠jH��%��|n՜�i�i'�r�»�-�pUk��|��Gj��Y��B�t��xJ�w%��[Dv'PW�D5N9��p��S��Ő�8��J��K[M'bѩ�:�7��,��X]/n5e��:�4��Eӂ��Ap��셳�F>nD7�6��Q ��9�ױE�N{�RN��.�X�Aa:��#��߉I|��+�y��(t/{��L��1�it7P��*]}�inb��Y�5�9��_+��dIwc-��}�[c��e�� NؠCX=��ut�A��A�eM�Cڳ�p[S{�F�[�$�wծй�]{�8#��Q�]l�@1�gt/`W��C(�=ڄ�5��UG��![=�� ?qqO��bC��3~L��g��.oC7��|:��C��iL�i�!�� '��.!�^qȱ5��"��r��YXq��s��r�B��ï��W�9� X�+d��bJ�p�>�t��d�(��It޻>ӉcL!�&�l�UM��]��ߧ<�I�G�=n\�;�t혍�l?��v�!��zi&�d�.��'��ݚ��O_��G��e�}x}��~�}?�n./?�Gg�<�՞��쮝�O�x�z2�|?��X��*��[d�s�a��݅�~{��|��__�y�?݌��^0��]��t��;�9Zm��$8��o8R��B�Y��n��O`��SΓ�K�&��u��GL��Y6�ͳ�t.D��,a"D0��B/#�#��Ф��T��[μ[��S�>%:�\zq��<��H7c�<`��s�g�N�ț-0>�n�!y!!�v�r�&t�|��4��<͢�=��.��Z��=��E��,}9֊.��wsv!;�V˃�8)��M�Y�ٰd{�M�&�)��̝�4�W�x�c�X86.6�}�/}��]O�6��E[�s?�Xg��u�~��U;*5��"⌖�&��ɪ\�RK��(�Z�FqeM��rq��mM��fUk�_,��#S��I��)>��;��h��ݖ��ߝ��H�fo�o�\��b�z?��:��ܛ��+[+��̝��\_��҄.�.f��٫��۷�f.f��}�|<~u��lvv��ֽ��T�ŧg�'w��N��g��UY��K��]�A��f��e��O&�aLp�ז��w��uk8A��T��/7�n[6�C�+:�z�ˑ�<�<�G�ʟ�s�J��e>�^k�uӡ+o��T�M8�z`�R��W `��<]��F�߇��Q�iGڛ_n��E��̍p��M�]�@&��50�� LQ�7 ��0ȁᇛ'�v$3,ܿ��ʱ@V(��Hd�NP��Ll��U��H�e0W��O�$Jj�V�2Y��4V��Ē��<.�)��ތowa~��c)aD�pEU%�-V��ph��<�R�[�×.r"jG��܀�%,��s'�FQ6��$~��H&��u�1V��5�ş.]%�ȯs�H˒<|ЊO�ٖ�ֵG��t��eX��6ǉ>R q:?�4[�i%5]��KX�E�[i&��h�F��~��(�.� ��e�ۦd�KX7�YqQ+_˜Y�qF�{��5��,a��+�()Ըkt-e�8�9x*��oo�V;�\�K��Id��iЭ�# ��G�><+0]�8/0��i�V�]�Y�@M�v��`��(��Nf��=4��>�8�n�1�Jf)[��To��o��`m`��/�Ò l�P�>�l��A��_V��~�~�fl��}z< �E4�ְf� 1�5�I��ކ%�:�Ӂ��"��)�4��-��4O��~�z�nS��!Z��}c+��r��O��0�Y�0HrMע��_p��Q��=�4��4a�!��m��܏!��>EɃǶ_��>��{/�j��*�Q��U2��$]�9�|��ۓ1'y��O֔Ԯ��*�>��L��:��u�$J^�Jj+�?2?��Z��NY�hE��8��u��U"�]�>i̋�0%Mx�.�@�88�R�d�V0x_��^�u�fN��n�ǰ�� ʽe��uP��x��o:t�E��x��]&l�݀��h��՞Ү��o cؿJ!a�xK��!��H]��Y�S~Gѥ��/Ѯ҄{~��}D��9�;!h��G�[��o��aq�Y�ц�.��J妪��-[�Fy��yQ�~�{�I�\p��r�'��_s��B�'�<ê��gۘ��J81�ea�<��ku�b��\?�9 ��e��Km�Cw��Pe'ޒ�\��-J�&|�侤�I��7~�b��y:&W��Bl��E��wb:��`�A�Y��Ģ�1��3�ўfy2��Jx�?��zq��<�Wr$�O�b*��#_��5�ŖEQ�Q��F��>~&�넅�Bܭ�ĻaI��s�J$��7�en2��}o��}o�׹7M�C�,�u�Q�g�(�ĄQHrE?\�ɠ��ձ-R|��FB��:'�jɧ��瓳�˳�;��3�i�h��+��y��^�$0\�7왾�H&�JV��h�O�@�u��}a��/+��U��:MԪ��#�dY �� Jǳ we��]N�.nla�)!��V��]9��e��D�D-��vUq1��&�*_�9O�1��\�/Oo�"cH��E��g3,o�h��|�x��t�Q��W?}�MkGڿйb��}�|��E��^��$�$߂˟�c.��ǏR�Y_-ύP2�a��$�>��;k��>�Z��o��Z��9��(p�$(�S�*XXnr�\�p�R>|�� O� �_8I�{�2N��7/B�P�4��m�� f�"y�*��"��V��߾�C��Ջ��3�s?d�3��(�ԙ({��I�=�LaGr�D^N�bq�B�LZ��1�M��U.�-��+YYDs#~�k�sܿԾ�S��l�+��y=�s�:_d9�h6��<��B3M��e��0J�B��~%l7.�J��4��CA)�އa�3W~�>�%>V��\�a ̉��k�L6��\�*�4V�Z��k�It�2��a�|�u� !n�S�g�J��M��F+l6@��Ka%��xݿ��4�a/�=W.$�V"&6��egx6TJ��K@��,��'��h��Gy&�d�k��<�X��;��,�V��߿|��v��󎒔g`��e�|:�I��_��ݿ��7�F5��e]��Ș�/V��8�.�$��8=�ш�q��ݍ��8��?΄��v}�g��Z��oU��k�P `0G��E��]��y��96��Y��8n��Y��e9栲eA�T~�w��4s�Db-�֧W[Q��K}X�U�$;�I�bc�Ea��Kz_��e��%qe��Yy�S�ql3��`]2��4dB��gX��<��l�T֍(�l�6)I�L�3/ʢd,�d\�n�h��uJ��ɒ+0�`�DE��˧E�m�Ħ>DѴZzA½\��7�+l��X�Dk&��{�<�_~�{�/!6so��RةP`��`�Y�ŵACoq�0��o�ȶ,�u�5�Ql��,��7~�{%��U�$�n})G��d1X��jӛ�h$��=�X��X�6��PI��,M�.~�Q[��g+kR��s�w��Cڀ�� y��%䉗d &��:�"��]e#�|��[��Ž�u��U��+��(��y��ۧ!��,ȶY�f�l!��ir��a�?�BQz�ƋDH�#��瓿��!�ΖDCcR0��.�{�7��~qG�2�p��%��`�_�c��Fj2��0��4Ck�DQ:��A�ݏ|~J��'Kj��4��?Bŧ��c{�Y"�rB�c�F��Q��=��z��(]�� kR��6F�S�(q��B�c"]�T@��~H��A��7�R'�oh�Z�2{�x�l��U�"��:��H�/��r;�1O6�;��ajA�`�&�q�L�gS�7��g|��r��Y��Pn��ර��#9�:�"$L�JS"ЄR�Z�kq�f��W@Ok0� ��ڑm��FM:6:��r;��A�y��9ؾ$ׅI��U�_��du��<�.p�v`��}�!��xڱ�4��&;ʅU�G��e�gF��G��-�8��@еh5 ��ʇw�IHf�Q�Z��Y=8�b��L��G��(�*%�/\��UN�Kj�^A��<��L]��_�KKK��@ �=u��J[�� oǜۤϞvt֦}��c❴��݀��KC!��V�k�bv!Q�t�î�T�!�QG�|��El�ݑ�զ�ڑe��݆,�j{�t��X�6�u@�#��u��x��Bl�kͷur��F�6�W�}�t�O/S��?�e�DK�g��c�z��-k\)f'6�;��5�8s�W�pܱ){��i9��]�\]24�S�D��6bT�l[*X�FC8�Df��s��lc��ă��H{��dWa�1j��d��A*�^;��yi�Q=��h��(|�ü�x��j#��o��EŞn��Gǜ%޻(��Xk檲$�i�^�D3��#j�O�):y�2C FZMϤޟ_�D��X��j"��`Rf��l��M�ſ��F!B%�!W1��V��E@p��:��C��V�Jr,%1��] ͫV��{��Q�<Ў7��*ϲ(�b�jg�)z�񃥮��ҟGɏ�28ب��[P�e�;��0YQ��Z�8�]5�3�&�l`�"��UZ*�v��۠��X�W i�g�>T��d4��>�ݤ��\��DA�E�9��pf�A}�7Oq��;�P#��mY��Rת�ށ�v��l��q5*��M��߉�/��H �]�r�˼\��+Fw7[�c��^�ز*ǩ(r�q9��-F�l`U<�kF��"ϰ��,��!q^?t�d�6v�#V��X��5@w<��k�*��")�i}o�*z�=y^�Cs$�J^NK�� NS˨v�P�Rұ�r��&�V�.�MdDۿ�DX�:�>e�ҎƆ�Mkl�%d��DH<%�U��9��au��hch�Tю�)bf[L>��uW-��MsdU��zLx�8Cg8Y�@-�R�J7�� i�Ol@c�O�~@��T�R�i.X��RWa�i�v�5��3j�X�9�x�b�4��u$b�+��$%ҚV��?��F�-ǻ��}/>Rx�0�-ǛWfUq�"�P�-ߒDd_�EN�HasO��w��r�@�m�6"��(��F��b;��)�Y"4�v��y��L��-�"�V�A2�.Q�y�\I�y��Yg��R�4o�4=�X��>K�p��%�ŉ��XU��M��!7��LY��6�gD��%�`�*B�mX�#b�^/�HgC�2��tL�Q�1�(P�a��}-�H=@��`_~��y�Ӆ�xɭ�V�ik4��2Cml��ZA��iZe@�L"CkLYP�a�A̼Q��O��0ou�$#��l2<��S�7��_$y��ͷ^�р��v�m�{!�ǯn��i��VS�a2��2��|�J�(��I��/9Y�`۝8��i��!��r��Ff��}�LM�y�v�%�}�<6OXmj;@�mڎ��H8_�pƣ~��Tg��d��<�n�/��ي��q��Gm4{�폭�r�ӡH7$1$�D��L)SJlG/��Ϙ6�~/�x(�{>%,��9WW�y�táUZ}��i8e�3a�s%6��ah\��N��DEV��-Y�ޮoN�!��.B��E�3�ۍ�j�|m�Ȝp��䫺�m��Ր9��~�ץi�2�_-k��]}�j��9�2�+!_�ͮ�Vk�5��G,�ow�zq�� oq�)�Ğ�;��ϴ*%B@P4�E��UJB]˖��I��]��y>3?�bD�Kr��G.#�&��|��J!�"c^�u��0XE��I�2�s4$��n�:�h>��Y�:�S��-!XI��h�G��_�P�Iz�v�|Y��A��oTp[a��"J<�rY�1�35�l�Y+��g[w��]��S�� ݰ0�7d��p�!.Kȟ(��0��9̮U��4�x��9�;�(W��\�m5\-G�?b�PftZ)��Vh�K��Ko�)�R$cQT�e��f_x�D1pL�r��Q1o�㍎(��"{Q�-�k�N?+�\=8q��<2~�A�X��ߗ��<8}��0z��]~=�3�~L�&ӹ"��3��4�:W�Թ.�`��샑k�O��@�'��A#�m�H�-Ԯ��Pz�R5W��=��G�o��kG�Z��w��I*��Ф��6��ٽ��k�E��E-��)��2��=L��5�?��A��&�zc�(��=�qa��=b.Uƴ��:�^��r\�q�5�ڢ��AbZ��_m��X�s�}��z��[��;{�jvr{��)��O2�H��!u�&P�Z>�{l��~�O�߽;��sOnώ�ZC��tM�1Ozsv��b6��r�_��w��*��):�)&|şw�r�/=ڇ7x�SWs��3/��}Ies��ᧄy�ꬫ�L��(��s�k�A��q�Da~%�/��X�'�Y?ĴŦAD�Z�VѥP$n��.B��$��>=�Y��.�ÞҕO;,�E@󄅋�\��wY��k�񀧩Kz\�kX.��h^kF�l6�R�o�T}|I�Gr61#M�Z�ȓ��7��>db,�O>Bv"F��hɵ~Dd��H��ZJ.(×Fу��$Ŏ��)9#��]�f.V��I��~��HPLQ�`Qɯ��Ŀ��<�S�a��*�zWq)E�Gf��R��6�æ#%�'؜��R��#��,�r��kq�ww��i ��_��u��P㶚��a��n2;M6O��@p�m�袎�2��˂��?��Z�gq޾�i|T�u�7�Z=��.2?��V��!�wc`�?蛸Q��k�d��Eԧ��Z��Z;b�'eV^.��W1�� Sڊ�mb0O��m�F��N�;G"�d��Ba��bg%��3"UB^}�G#��G�jg֙��Eӡ��0��r%��HU(��ۻ��p�v=��3t��t��;��{wq��d+ ��ۋ��{w{�K�rF*G��D��/��=r^]��wUV{}{��}5;;C>Ļ�Tu��*Wwg�W�%x��;'��w��~��_�o~�螼9F<��g`�n.��M��wf��X�]�W�ư��g��p�ޞ��ԇg��ݵ;�9;�ԓ��0`�0~��p��w&�,��,O¢�ȍG�w"T�յ{quyqu�}�'"��;��G��h��I�]�إ��)��$��O�Q��#�B��F�%Tib2��GP!�j�R%��u(�"��S(�]l�D�ڎL$��ԊA!i�Ԛ��h��9�[b��ИNۙ��B�'&I�*��1I]��i�K7N��.(�\c�4�粔�;�ւ!�C_E�|L��e�&��1��c�O$��V/D��~�E��.��{�.�3�%�N�35V��Y�֬m��5�mǁ!�nu��3�KO&��Л��%P� 4�ѧO$��։$Vt(�{3��uBF�b��{��h9'!;��J�f��)��W+U>>��eW�M��Tr4�b��~��ʲ�-�$YnQ��R�㭒'>�Cmƥ�f�M�hvU�%��*�ztO�M�Y��Ǐ��-'�W�� t� y�N��$6��vp��T��¯9Ϲw�4K��6QPs$��~F�X�w)1}�$�[��;"{��F�_��H]H�ɭ�W�X�Z^�"�Sz��2�^\�&�3�H'��5t�� H��<Ēdh�ɸEٕ��[�a\�H8�$q4>~��,��j�6�d�w:��!vB��8�Y��1��G}S�Gt�+��Ղ�؇g:��޽��c3�ʂ_�`�}�SD��m{\��!��ӱy�^N��!kb�!��T�2�,�K�'��p�4Hڱ�n��O�=��\�4�9��tJF$}��CP�[�5<��L�c�P�'"[K�(�P�eQsO��<�ՙi�ɺ�#�ˇ{��VՑa�-�{�W�y��&��h57�'4��'Y��^7D��T��';�J�`��_EO��j�� Ӭ`��T��UٴF��E')噌N�'O�M�<9ek��&#�f�Y�y�p��k�Vo�rx��q��e�|�ے��l��sS��$��y�\��2��g�P^��ĶLg<�N D.S�C��?.��f9Ԁvs}}K�Y��6�]��ߝ�_p>��0��s�uW�$�]�"�o�غ�I+��'ٕLs-3��b��e1$�.:��?u�G��2�ɕ��6%�]��f��]H��J/�%YZ��~gC�UH�8�)��g�|%�;ʱ:�=��F��&��η�i�h��k��W��·l�T��J�1.�z�szO��]��tnl��B�[��c�S��BO�y_�4��q��+��܁Y�k�g��%.�-P�Hn��&�Q��˖H8]�)�5TtNj�|�plvm��їD�<�e��#��_��#��Ŵ$z�Wkû��{�o�?�J��#�x�lR�+�˽/Q��WVw߇/\yNvQ�<��B��{��#]�a�2n��]��C��B>�?��%I1v8�x��_�£F��CO��6��H�[��s��F�r��7�,��*��>jtM�{�ܘk��&��)�'.�C��j\�莴>��=J�}io�nb��b�.�O��Ѐ��?>��*1�_K��^3h�X�~��v?`�V�th��~Z�%jƚ�f��,�j:]��{��KVH�TNq��e�"�T��^� p�|� ��u��^�kZ#1{�y�FIɠ��U��9I/��4X�?=�?|��L��"��n�/�~�P�Q��" "2754�#T)�Zm�ou�� )%��]�1��z�ț��1�|v?D^__��wSI&^�b�Ҙs�D� z�nVR�Z�ϟ>燌��x�@�Z<�d㇅@�)ر��pk$�>H��|�g`�b��x��$8P"jE��*�.`��@�� b�n�.x;��|�'�B=��6ø<��'G��g�h�|�D�v�A�CG��&>�ͷ��X��B�j�B*�_�]��{��0֙07J4E��U|�R��?±$�i�3��Q��0�:��8�9NHX�X�׻Jl�;;�2ʟ��:� ��m��7o�刚�K��ytd�P;�"�4ýD�6��,��eu��蠻��$�?2��_�L��U".>=��2�c+��-X]6��'��@�(��p?}p�N��ʥKJ*��p�7QJ陃�y�[��I��v�A��'6� e��W��k�x�TK��m�]�ET�;��g��b@"�à�b&A�F�r��2�G��Y $��Y�s�PiI��lۘ�c˞�o��YjZ�3��H�/.Lܠ˄�[�{�b�V^�^�Ѐ�q��ԟ��2UI1��2�f¥5�R��ڱy��Ja#��P��#�'%M��0_��(.��.�I�t�1�˟3��4��yb��+�S�{��5{`.��?r%�/�1:j3�0��h��.P�"+��;ɠHIE�xK�C�ޱ@��[Fs��/��[��ͦ�L��vM�T��L=FehVYR�&��y��%`�GUUȉ� j_U� ��H�GH��6<��V��B�\�Uk.�wc/+ $)��h*QN�?Ar8�#$^�ʑ�UB��<��Ǜ��~^'�W��TuG϶��C �6\ԩL��|�!{��є��>؊ܵ�Β��1;��O+�Y�tI��p<�mcl8�e֪B��t`��И��x��K�%xt��w��I�sd(S��DXe� %1CZ��"{!!�0�.#Gye�,�m�@f�Jݵ_�R�I�i'Q�"f�a'Q\i��\��M0tY��r\T�M��h�&��u�7��%E�1�b��ϗ�Y"�$L��tP`r1��T��n[��\�GD�oS \��"�!)�';p8� ܘ�E�Ò29*^9�t�w�(ab"�/��B׉�gDa�d�T��k�vL�y~�Z�1�z�ϊ�r��H��R7x7��0�2p�D�H(x�X�-�ݍ��"��3�ޢN�τ��nj!?ېK��S�ժ�${d~ �n�!�`�jG2�8N�})�"� }sc+.J�*��1��'tw �`ę�j��=W&㓩X�r^�*�x @(�p璁" "��i�-�a�M�9��?Fܕ�K�I�O�$�9Mz��-�C�VТ*�%�)ܺت��@{�:��gu�a(�VD�EX&�^�VʚP�>7M.�2�Eɪ� �j!�+�:��LFQ��-;�s�Z��!�r�)Mj2@��(�R�B�[�\�e�L!X��tʖ<��Y� ��b��h��ٸ�@�� I��4��H��T�� z�V�8�Rx��뭴U*EqE<�f`%U��h/�#C@�IFIlS��VMb�*b��S7��+.�� +��WL3�E��Ƀ�&q��J!��9H\@om2>��.˞�m#B}�+�ĝ��9IA��P/�bT�b�}i�+�:��DW�u}��V��Z�}�0!��.�n%��:;z�u\X1d�8c�X��iV�u� 5@�ܚ�5�|5��Q��&�2�P�AT!nab~�$3/ژˌ+U�k�b��a�/�Q�V�icQ�Ez.��>��{կ��l��8��Ĳ�7{쎪k��J^_QT�>��ٶ*��N��Ch)!�сGP�R�X3U��H�8�t(iu��ee��W\�d0yv�-��q��]^�Uz��u\a��v�M*�OCO��x�~�i�� Ƶӹa��E��ܮ!G?hF��"��e��QuL�<�3H��?aPXy�|��Q�+��"�u��7��IP�%^d*XQ��@D$D�!Q��RiV��X��)�/�y��-��ʉE�*j��%�p�}��uY�#��Q|z7��6^�0��ޗT2��Sq��A*�<�T�7a%%��Z*��6�W�fk �M�"��_�N��a�qE,#ZC)�ۆ�u��R<�j��", "�.\�N�{r�P��4U;��t��~*n��Tٌ�*�,��z"�&�^afSZL��؃V#E�� Td�ݵz=ǤY_^�dDʝ�Z�[yj:f�#��/�z�t�s�f��U�@�6,t��S�R��n嶰�Q��8�,�10J\��lT�c��p��K�r¶��H��{ �b�JZ�0��:�ѩ�I��Ҽ�U�,W�ce��X�9�)��r��U��t�߇�!��k�d��0<�w��h`l�q�}��Du�v"�v�f�UX��z�+t�SI��Y��h��s�Gu��؍�Ӡ�\ʇ��n荶W��̃��$˴��|��A<��B-?Ut�q��Plz��FY�� 7A�G��j�P��8b�o�B*\�,��(�HL��5�b��q�q�(��vԔ�AWq�f��~�h$=*��b��h�vR�%�fP�7�[��%vc!$m��ĀIg�@a��{Y�+�-g�Ԭd�U�Hl�$��,�(62�PoY6'�#��~`��)o�b��5�Dʔ�x��P`孨'5�*��w>RŐrJ\��#��8�?�I��Wg��Mh�ʮ0�5�b��n�o`XZ��kN�(��>�뢏(,��R�㘨��Oai�8{Ś�F/Yio-zW��P��I��9�֝k��bK�2?��(�S�P�}�Z6f�5��<��)}g1�T��y6wFI��%�?X�Eؐ��#vS�X��i��H��".E��!_U[��O�XH�Iא��1��(��R�$qa�np+6��j�w��@f�r��W\qj�)"�zi/|&��$ވSY��bN�(�T�BtW.��*��@` Ŭ�3��=��)��x:��FҎn'A�� {S�\��0��H�$�.˰#N�p��К��?ă��2?�4q�.gyݐj��Oy�j��U�[�Q�E쇋��B5-(*-Qw$��JAU�WQ?qO-�҄dh8�*��dW��-�Ki�*�d�?YSg��5�z\v̯QI=��s_�d�Ei�,D>�KH�'��X,4�R�'��h5W� !��A,$�K\�"7�UH�+�ԋ��gۧ��)�NEs� �`N9�5�cŎV��3�y�!��z�"�"�EY/ �xн.K|�B��u׬�; л�D�(km��DU��<$G��Ӟ4ס��*A�"d=�n�V0ݯ��U�WaM"xΒ�iS��b>j��!)(G��@-�'��%~�@��=6��!a\a��t�|�n"z:�CzT;ॆ�y�ܝ�wYu��N�|��h6>�H��v", "�ʷS�)�Sn_��3 �g��'ʊ�E��ՙjZ6��̷%�tT�fsᅖW`hi!z�V�)B��k5��;ϛ�H�b&7�Wk�c�#��H]��US�n��<�)c��un�FH@P?U�ah��E�Js�l��X�J��f��=~H��^�Y�F�T�`��A-(�i�(�j��Al�c��ȃ�wL�Pp&�g}w��T9�e�.Ϊ�y�sV�A~)��6l��+��Y%v�y)�ɽ��ZU�P-"ɂpV��Nlm�a�u�LԊS�v�HNɨ;E;0ah4Y�v��I�� v-xې�P��bv�E�D��$��+ľ�dui~��St�v��XAD(��e��i큆�x��Q�F�GK�q��*��H1D�%�-��C߾m]��j'�`�h��2`�ZSڸ�]tEbu��a-Ф��/@�d�}gPvÐ�=#��O�� J��X��A��]0�rR5�jծǑ�v�|ڒ�=aZJ|)ߒY��+sa�V1�r��Kí��E��"�m%��l��Q��˱�]{U'�#s��i8�ӽE�%��%��Q�f�ے��뒴�؎W��^3 ��[�EC*A��N�d��J��'�H<�m*P�YɃXA�L�[��ѻ��h~G,Y�i�U/�М�k��h��+Al9�I�R[׊��t�2�ʵI��R٪y�G$Jx�o�,\͚O��]�r]�S�#��h6q�6�h�q�п�c��naE^��h[}��H�\��6hRP�Ls�:�7�P�)�5~uO/Z��<<%��Q[�'�2��srn�'NO�*l��KPqɗj��fC�ׁ��$��Q�+*ֲ,��r��OIM#�U�Ѭ��k�ۥv��`��M��?^�w��]O[�#V�a{@Ŋ��[�>)�a)X?��s��2U��h:�V\�ېu�|��,��LIh?_iWWV�Y�� x�H�+5f�JM�^�!�)�K�Q��U�K�!r5@�6�b�ؤ��\��5l�@j�M��d�.12��Ӎ^ƒ�t�9��V��q�4�M̪2�-�S`�m��Q�0�%��ck�@c��u�P�GS^�k�xO��P��HEwT��W�w&t�৥U_�1iC6A�vνA�9^=b��k�r)7��?ڄ�Qe�~�.��`�l�s��1��r�P*l��8_��Y��Sw�>~�*��,ޤx��kZB��(F�F��O��[(�N�:A��Y�M[-`+CgSt��:4��h2D�W,��Z�w�?��_�Y4>|<��Clx��J~�KQ�n�fw׷g�9�a�}҈�Ic\B��ݵB��߾��C�j�$��A�ح��=�t��q�!��b�}�A�A�X��U��-Y�@��ՃUp��y �I��aDHמ�&r3��I~�k_��b��E$$(߰��5ӟ�E�f�F��^�!�A|��"�~́�x3�\O��|��*F��J��󰾮�$��&�@1}Y$G��t�韴3��l�x��G��u�u`��Er4�S4s��";��<9�B��,�V��v��M-K4,�5^�O$9��QkwL��;�g�r/p'd�}�G�;��$��Ue��8��>�t&;��p��TF8p��(@N�b�i��~��Og��ə��`�n��!Kdy|%#�M�.6Q;2��z<�3Dow&�V:3��{=k�Y��9B�Kڰaϯ��}Ǔ?��x�_��s"oƒH��_N��j��2��}O��t;��b�q/�ྪ�� av�UI�qҲ�zdFQ��h�`��Șs?�?��'�Wuw)�-x*��m��Y٩��Q<�K�|�7�8�Z�ibE�W��X2%�"J^>E4le&L�@oՏ5j��'��dB�o*_��kS�WT?�3�eOqUUf��7�Ok��T��@|�~��&�}b��T\�9QKյ��"��s��J�A%U�;�!�'�s�T��5�;B��9��kz��m*)�T��,b<�i�%��ι�:zb�&�]�(��V��r��{�-�҈T��\@Q�:a� ��u�Y��7�m��;�Ɓ�.��}��߼!i]R�%�J]pZ��O*NY겮��q�d�'��,d1@��N�(��H�k�E��9�)��8P8�B(�^SU��.��ike��N��oa�Fo�o�" "��̽��1\�ٻ$Ȧw�ر��.��/�_��o.�,�^^=��>�~�]��,n��{��,�V񏿼�ps�_LO?.߼y}��z�:#��3ùs��Ѫ,ɉ��[�>��=�nߝ;�݇�u��/�?�W��~}u}��MO�޼��߬��v{�~f-߿0n��Gk��~�𧉷��Av~�.~~�L�_��7+[��_�o�gf��z8^��/��O?�~�]�?�>��l��Q�0XD�*��?�ݿ��(��2�ںZ�*ȱB4)��O�rUJZ�WQV��"�q�e1:T�� &�F׺��<[�a�2=�ْ�_R�vk�Y\y��[��d��dc�'��O�E��KT�tmrMJ~@V��9,�d�� O�7JX�{��ż�ɖ��y��d�K��Ջt�ʏ��d�O��E��=`ޒ%s��W��o�˄s/ڨ�R��g��&�#�B�B��E/��y��ݵ4mVl�2u��w}8$�u�`��$J�)�sZ�+�g-��m�eu>��ˋG>I��x��;{m^��'��>~�>��Ҿ͞nǋwN��L�V�7��ߚ�^p�_}y:�z��cэeY�=5Ǔ�e��%�?�w�4��`b�Cc20~�g��X�1��x�u ��m%&�t/֔k ^��9�N첺4coՅ �R$�ݴK�lJi�*-!�Z^�E`��+EK�a:�� ]TJ��*�@�00�xr�@�X�k%J��y��n��-��;FMBNw�r��:�5=�*�\�;$� ��Z0ljv�&;��υ�B;�$oݛ�C��ڏ�Y��g�G?��Y�â��ĊtK��O��_]F+?|mx�V�6��ݍ�(��=DQv��7�~V�V$C$��-]��?��"��g��o��.N�#͠�#��%��h<6k:��ò'� R�}��~!5�(��&/��n�30)��$��%�+��ER��p�N��2[��&�\�i$g*~�8��fyW�<[��y{dDչ7#��$�ڊ�ݏ��.{ǕE�vW=�!}��;$��"��Z��c��]�b�pIb��y�{~:��2Z��H %`�B�(�R�"P%w�&l�s��1�c��5��&[jt:��OM�4��ibNa(��Rty)�q��`Q#hhG��q>0��襰w2Ñi��tjM��r2�t�l�N̑mΨ1��k=4��3b{4�a��1�i�Mǰ&��=fs�;�S\6��9�|�iU�F�w �Y@� ��&z�h��$��.ў��I��.�#9��zt�LԿ��I}Cמ��hG!��bL_�@�0ӄ��OQw�!��{�� i2�R�VLX��ms�W�e��8�W�", "Mac&�V�E�M��g�e��n~�%n�1��E�u�9T�[�=�6U��vI�u�N8�y}��V<��c�<�� |��($��8�O8�Kv|��Y&>�|w޸xv��kk�+י��*h��"Mi�Z��,��GO;�Nts�O��i�u��h��cC7GS��Mc��>�m��M[�F�9�͡nu��MC7M}�[cݚ薣[Sݙ薥;�nZ�t��C[�p�M�閭;�nNu��X7��Dw��ƺiM��&��'��X�tә�á>vt��G��d�Ol}:�M��'}j�ӡ��m��n�C}l鶡�G�h�O��i��h>�>��P�ݶu��n�u{��l}l��D9�w��HG�[�i�w�H�DE�O;X��u�_�eH�K��lt��Ѓ��W��i��T�/KU��B��/6��k>D�?��֯?��j�?>?��0X�?z��5�+�}��o_1��|��_��U|m�<��O��ӻ��k?�0��/��7��ڿ�G㈿�iRF:/�b�0�2e닀��&�&��_��,�A�ϻ��", "1d14�=ײ۸��.��l��9�r�Y�)$Q�H�%QS��[h�m��u@t��n�hI3|��is��S��p2�m&Nhs�H:��{'�(,�b�М��jQ��j}x��Ԧ��S�>a�݃A��(��Ҷ�O��6�xmK��ܖ�y�jܶ(ے�-�2��T�R�qo��u��@]��w'�qе[��@��v�~�&|�6�%�W nk��PY��M�^�6��Y@��Г�5�z��OC&k��Xrn��`�Pt��Ɲ%aR��+��T:\M��kC�3�Hhٽ�.��}[�/�R��H�En'��[�d&[�2��A1um�o�uZ՜�!�{��eQ�7�{H'P,��:M�wn8��އ��R�Vk@��Q�@��ǀz300��N@`��3��6�~}tx�b4Ҫ��G`�r��*��~k:H�}Q�֙j��M*iRٖr;?�J�]��Qx띦W�YNgs�F�=��t��l{D�$Д�$4V��_�c�Бy��@�?�e}|h>��nf�P|~�"�.��,��o�m��(B�m��Pn��a[�hYwN��4�DϘ��*7L��v `.9n�u��t��C3H�4�T��1x��$�q��1ӓ��h��x<��s#ys(7�јs�4��}��~i.P��3��yo53<}�)_-��~~oV�H�Lܫ<>n��^�fh�}�N�G`�Ǡ{A��.�A�9�7U��P!��M�l�_�F~��1H9�mn��y��귗�A�ӝZЦ��G�e�l>��ۖq�� hזtݯ<$�J��n7�w��W��R�@Pk�v^�7&%<�Jr`�;p��1��>v�v�z$�r�$"Nw�k4�{��"#%c��XUU��8в�x�RO��$��]��G��&��x޶t��ּr[��N㴧��f8�64yY)+{686��&��Ͻ��X�a��a��sX[�� x�{wV�9^!z�G�W�D~5�", "{�*iٱخo��b��^�mnӆ<�0=Y~�:\~Ss��-9�Ѽ9{��ņ�Ic.iڶĘ��Gs [�Hww�V�~�!Q`Y�AH�E�v�oFoK��^�_��?��*ی��B��/�y�u��9��P�!�:lK��a9+ c?�kci�-��XV�Q�f7��ZTA}�KV�M@��E$�vA��!�o��.3�*�U��[��y��}X��ꎏA(��87��T@hd^CN�&��&82��gd�eQl��VF)?�#�s)'1p��d�[[!��BB�I�t�s��Cw[.�rdVd�Geqܵz��#�\�>��K�s"`B>GP�!h��"��b�d�9��2(��}HN�+_��V�&�e< �U��&#ޔ��Hi=5�*u��F��R?��*Ct3ح��0ob��W)��w�hܯ�@Y��!��a��5�B��h�xԴ�b��gE� ʸ��:��M�r��ߒ��v��k`jMrE�ؚa�/o[B%^�P�Y�k�Q}��yE�N`v��.e17�Rp¢�� g��P䢆{j�8w��j^F>-'G�|��sOFd,�f�Bk<�L��2�r��K�rN$�i�AVus��_ʘ��M�:�V��7�~��h�i]H�x��5⮲YсJ�x��SKV�l�l�a"#jNz,4�}3�j�g��^0�;��e�@9��L�N�Ǵ��4��LαP�V��4u��x=y/D��Ѹ��擺��8M�Y6��*\�c��&.'�?�)��x��%�7/*�_Ҳn��kn�I�x�#[��=2�"�6R�Qs�{�CyV&�4��mP�-�Ǆ}ԛ�LT�s��TV��;ΪU��o��*w[Z*,}�,�ќ�pE�8�rl4�~!7N��]n4_:i�sds�o>(��F�F�#E6��=�[1)x��vqv;C�2@��xX^nKc{X�6�zBة��Ny�jԻ] �[��X��*DGPh��ɜL�rK#k68��/�X-d��Kh��MSְZ~~�y��B��f�9"��k��5ն��}'*�T+�{�V!��$ս��}o/��^:+18��wb��~!{V��%��d�R�xl\5�k��b��@|J�x3uI�(P<��:��}kXTA]��fY>,��r�ݺ��g~��&�k�c��3�^��+�ܺ��#j�Ƥ�³"�3�1w��s�rB5�=�Ny7Q�vO��o�VM�I��j�O�ܖ\��]�YZ+l!P{>��t;9p��V�e{�=��<��ֳ��C@Su�<�.�� `�4�{��9_ޫ��|>��| G��_?��1�u�=O��_?s��k�³0g��^��9,��9h4�5��p��6��g�p~V��#~�T�p�a��L2��?N��QQk��4*��{R�G��I]ߖ��Θ��"�q�Oc�$�G��:�䙰��G�z|�K�;T��GY�Ç�d��~�s�`S��4�R\��E�_?�M��̡��·n�kt�-x��לC��7l?E��@X�U�F�U��|��G��O��;!Ѿ;��", "��]\2E��N�%�=|��R��ߣ��T��#@��7n E��4N��J3N�lYs>�op8x�W�LXr癰� ��]��c��2�'��f1k�E��ND�Up�3Яz�e�{c<��z&-��X�fT-U-F�q��|RG3V��<��ODX��| ��V8�e�I��f�/�Y��CYCwd�kڲ�p6tx6��NQkԦ��f��ddH��S��T\��n8��{?�Ҿ~�5�u�>��А{��Vx��<�x��5��{��Z��\~��\��6E7�|��`߯��ۭ��c�+g0��):n��F�C~��w�?��bTQUST[��'��aN|�E1��D�$��aaFT�W�/�� c��Qz,<.�l�(�:�j��e��e��Ej�k�@%��eo�de~F�Q�d��%F~Q�]�%�EYcQ*W�_%=E�HQzP��K��[��($J͈�%��1�f ��uͷ��D��m��\ax�(>�,!�֟7�5�ԏ��H�AL��g��(sK��P�1~@<�Y�� YPRfJ�H�E�/m�`j}$m��f��ae��V�6��?��sU��/(�0M�o��-��/�U��6"��ʂp�L��e��d��(�UL|�Y1�O�q�=��p�th3k��d��ä��?G�o/��r�3_�{��{s􏾖��*sFC?2�L�kf��~�5��2��'uѨM˖�ol$��`�Tn�f�o�UB��B��c��D ��OrL�X��3��Cg�g0_��h`<��-�f.�0�8��M.4�.?Ǫ?�|�nc��*��z+'#��c��i�Q.p��f�(��(�5��%�&��T�8��q]�9��01k^�>̯x.�C��R�^�G�ޟ:,a6]�M��t�yrQ�Z�O�xEyWQ.T��-A^��+��2j��܍ȡ�⇼��j��P��v@��>�b#L��/�0+�q��'?� �XjS�bDp�OM{�]K��e�|�gE9x:NN�G��݁"r��$>�T��x�G"�@"�n��j��]��h(�ѕr膣��w��1��ķa��n��M!��B�ޯEC��:�7t}J�C�%��;��2�ç��B��[{J.�Xk��>E�h�J�޹JJ��u�6lm��>��AAz"�n�s�o}��߶��J��v�>�Vq�gZ�MiC�}ؾ��nyr�nGW�ym�]з�ƫ��+�n(5j��Si��H�h�2��O4~��ѻ��a�h��#P:��"��Ѷ�d#��(S��oʻ��tc�S6I�*�\��M_J�!��O1�� Ѐ�I7I��a(7��3A��Y_��Z��͏w�>u��Y{*�V��遀h�zJ%I��;�S�UVq��}��zr�W�u��y�<��֧hJ3�?}3mi�I�Ru\� �(Mh�Śg��@�A#2��D�]�M�'��FP԰��E2�K,��5��[�-� !9J=��p�}#��`|�\b�oV�{�e^LR��@�J�x'|?n��T�dI��*��N�WU�.P�݉��)�Iƚ�A��ߵ��n�J;�~M`�֞�{+=M`{��{[%�T�.��>��8Z��\�`�f��2��P&�I�Z�O��l��ӳ۶��ͼ�#��jjc�/&��MMOi'��Y��HL~X3{��=�!C�nJ+�i�5�6c}*��'_�%i��]��)��[�w��J_r~��.�ykݔ^��i��ۣҹ�p|��Q�>��M�;�~��{��kx�-oJ?�@X�ܵ��W�NX��e��o�s:#��]f��l�B|࿔yR��X�(��ȱ2��/[��2JR0�!�? ?ue��b��ժI��ҋd\�`+�V6I0=8�Q�]��ov5/D�W��9^��wB/�O{��N.n�L��r��a�x�2�� d�3�F�3�9��ݕiR�L�B�n*��>3�>m�;{�i�^5��77-@fH�h.�e��Z�-��Dhaxz��y^ֆ�4Ӯ��<|�j�}/V��U��fa��Q5�JR�m}��Dp,�ca�K�'��,z�6��;��RI��w��0�Ò�D��@A��d��5�zĽ�~�/,�ǡ'KXާ��%,oN��ezr}�OJ?�&`;j��/�/�/��9*��3�'c?�J��0��c��{q}e�T8�C�o�$|v�U&�=�1�{<^��ɸn�L��o��m��{f_�"h��#B�L�O�!w�͡w��wiJ��w��{?��nzԴ��U��w��OHMZ�a�5�+��2Kzw�M��Q[_�r&��렴Ҝ��V�ey��#��#P�i�1��f�K��c�y3l�tl��jz�δ��7��=�nk�b�g��Rp��G~��f��p��5��z�e�#ׄ��C~?��Ag��w~��!��?�~��" "3ee6�}ks�8��Eo��[R��]��l�%�e�; ��(R�C��Q��"�ɪ.��Nu̸D"�L$2 ��]�]��/+gJ��U ;��g�Pkjͦ(H�V��܂̫uz��t��KoN�So�Wh�!�w��w�Z��bs'�OQ�I�Zy~y8G𦳢%��Ir�~��9W��*M�_~I3��_��ݔ_үǕ^j�sW�4�r�eS⽤y�/5M��_}�A�iZ��oz��GM֪H�J��Tl*2�;/��Y��T�H* b��r�B�*��HS�7�x�)�/^��dP<̐`��N�[Mi{F�O��-F�>��)0^�iC�w`DA��LԚ��j��Y�I�-��%I�} Q�}�93�j3u�$K�,|/�R�r�4[c~��I��g�^V�GrHm�,��q�v<:;�`�W�ki�֪�l��}5D��z=jH��/�`%�S��*J�I��,���:��JUv�Jl55E�)�P�E�C󘱯��~sq��޼?��rԉR�fc2�C��Y��i��TX��Pk9�Z��y5K�� ^KS'�E�t$bԒ��.��_D�2��Q�;-�Vr��5�Y~5��}��ft�Q˹��V�gQ�ql�m�|T/��V�Zi��\��Y:��vr�pb��{�E��\��Y��Y�+r��sw{�rIt��Y�K�zx5��-گ�C�K��>��H��W�E�/χ(��!&�%�>��+�M}}�Q.�CL�b�m2��C�K��¾�rc��h1�Q.�C��g�I��ܶ��!�%݌��%�M¯n/��\bRXf[k#�9��CL�Ț�7f�׳�A�Q.�CLK�*E㓷�C;D��1)�`�෽�`�JJ�_��1)�?WNgh��C�K��f�f��/o��ޝ�\l��Y��Ww�]�\l��ٗ@N��E�B��r�bR�G��V��/X��CL�6%��#�ss=�R�1)��R�Jo��!ʥ|�IiP��~\\+[��*�K��f9ћ��4��b�V?��֛��Pn�o�U.�CL�,��jh(!F�(��!&��ۭ��_/|��R>Ĥ��O�e�m|��0Q��f�_D��f��/%�ޡ\bR��i��R.��R?D��WY��@wn��8D��q.(��6^�;b��U.�i��e��j��C��,j��t=��P�e�*Wic�/��I�{�]'�r��CLs��Ak.��W��&E�'�%i�r}�^�)��S�y�~6ۍ�=�j+��~5�^��"]��m��Zˍ�Fǚ��/��؞�ݟ>�7�CP�b͘Ii��W�M��vB�!֌��B�T1��A�?�", "��7˞>�?l>��f�<��X3��tڿ�wn��k/8;�IO�9��Q��l�-"j�o�Ur��j��S�\;��T��T��&�n�ۖ:E��F��4ġ��5u �r�V�E��O2�7��-�&&֡��Sm��j��QO�i�H��Ɲ�e�!��J��"w��@�|�y]�w'�3��v��83tǛϱ�E�~�T�Y槪6+_�)��P��b�,$'��M��R�ď��E)`H�NJ#bܢ�L�I�Դ�*��`Kmv<�_ g��aj��Ej'�Ƙ5��n�N?>�ݔ�1��~��>}j�q�?��oGY�l.<��I�[_.��9��j��U�?��%ꩍ��6@s+�öd��!�d�&�\��96!qp�@��F�B&$8�\Y�cd�,��sC�N�n�}�p��*P`�Xc8ȸ�0-5=��E"�7�`t6h4��@��66U��oC��dI�҆�k�@K�`6,�a;:m{?x�Ui��t�}Є��!��A��6|ü1��E��]l֏��[�#��aa�\�( o�Ъ�6��R��`�ȇ�,ݵ@��x�Q�C�G��9n��9��L��|��3�v )86!��`�ܕ�-�`+��N��@�^ qg��x��B�;�Q'3��:�-��r�2sq��߁v�t�ۖ��K[�v�0̺D��>c+%�CGMR��Q��:��C��'ה��gm��4fHZgY�V!Y�w��pܖ��|�Їm6B�5>��ćյ&]5�a��Fr�]�%M��Q��K�{t�S2�vR�[�o�<3�{��4M�4a}En��?H� C��J�+��x��i�3 FS�A>l��S�V�c�f��T��$��@&�#�%3jށ��R�6+��^�XR!�L4��I��3g��`�@)��K�t��/01�R^dE$�b9��H��q��d�(t��8Q`e�.\��gC:�X8��a�U��a'CR��dP-�EQ��c$l��\�d��m��7T�$ǃMpC~�$��B%xS(��:�'۱)�5ffw��Km0K��p�̗ƑL5��-�!?��?��>X\l��ͧ%�F@�O�� @eZ��&{J��xt��g��0��+��q��Ӛ�5`��Z�K�_(i��v0k�ijW��HZn!�V��4٨gm��E4�1f�oiG�(W��%��n��ȥ��#)�YYV{�ji"L�)�*�w��Y%Y͞ Imp��_�>u�f[�� Microsoft Corporation\"\n \"Ta8tZ82.exe\" was detected as \"Microsoft Visual C++ 8\"\n \"2Ev9506.exe\" was detected as \"VC8 -> Microsoft Corporation\"\n \"3yf84jj.exe\" was detected as \"VC8 -> Microsoft Corporation\"\n \"1xy55nF7.exe\" was detected as \"VC8 -> Microsoft Corporation\"\n \"5Ln7gt9.exe\" was detected as \"PureBasic 4.x -> Neil Hodgson\"","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":10,"id":"static-18","sources":[{"report_type":"sandbox","report_id":"6a8a8c348a356097900e51ed"}]},{"level":"informative","category":"Unusual Characteristics","name":"Reads the windows installation language","description":"\"cmd.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE GROUPS\"; Key: \"1\")","origin":"Registry Access","mitre_attack_id":"T1614.001","relevance":2,"id":"registry-26","sources":[{"report_type":"sandbox","report_id":"6a8a8c348a356097900e51ed"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Section contains high entropy","description":"\"3fa03f784ec205ddfffcf521bd6cdb53b46ad6ed6fd84ec4ecd85c545c8e2edf\" has section name .rsrc with entropy \"7.945495330646731\"\n \"FI3gq62.exe\" has section name .rsrc with entropy \"7.928999464851307\"\n \"db2FL06.exe\" has section name .rsrc with entropy \"7.871113808808268\"\n \"Ta8tZ82.exe\" has section name .rsrc with entropy \"7.73305219534456\"\n \"3yf84jj.exe\" has section name .ext with entropy \"7.818347012646296\"\n \"5Ln7gt9.exe\" has section name .rdata with entropy \"7.110640338733979\"","origin":"Static Parser","mitre_attack_id":"T1027.009","relevance":1,"id":"static-6","sources":[{"report_type":"sandbox","report_id":"6a8a8c348a356097900e51ed"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Tries to detect debugger using ProcessDebugPort","description":"\"1xy55nF7.exe queries ProcessDebugPort (UID: 4492), \"2Ev9506.exe queries ProcessDebugPort (UID: 1596)\n \"3yf84jj.exe queries ProcessDebugPort (UID: 3804), \"4xl958hh.exe queries ProcessDebugPort (UID: 176)","origin":"API Call","mitre_attack_id":"T1622","relevance":5,"id":"api-238","sources":[{"report_type":"sandbox","report_id":"6a8a8c348a356097900e51ed"}]},{"level":"suspicious","category":"Environment Awareness","name":"Contains ability to query CPU information","description":"cpuid at 00000000-00004492-10330-306-00BF2E89\n cpuid at 00000000-00001428-11617-273-00420E9F\n cpuid at 00000000-00001428-11617-301-00401855\n cpuid at 00000000-00003804-12997-305-01362B07","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1082","relevance":10,"id":"stream-13","sources":[{"report_type":"sandbox","report_id":"6a8a8c348a356097900e51ed"}]},{"level":"suspicious","category":"Environment Awareness","name":"Contains ability to query security token membership for user discovery","description":"Observed token membership api used in \"advapi32.dll\" [Source: 3fa03f784ec205ddfffcf521bd6cdb53b46ad6ed6fd84ec4ecd85c545c8e2edf]\n Observed token membership api used in \"advapi32.dll\" [Source: FI3gq62.exe]\n Observed token membership api used in \"advapi32.dll\" [Source: db2FL06.exe]\n Observed token membership api used in \"advapi32.dll\" [Source: Ta8tZ82.exe]","origin":"Static Parser","mitre_attack_id":"T1033","relevance":3,"id":"static-210","sources":[{"report_type":"sandbox","report_id":"6a8a8c348a356097900e51ed"}]},{"level":"suspicious","category":"Environment Awareness","name":"Contains ability to retrieve a module handle","description":"GetModuleHandleW@KERNEL32.DLL at 00000000-00000772-9882-14-000A2BFB\n GetModuleHandleW@KERNEL32.DLL at 00000000-00000772-9882-87-000A6FBE\n GetModuleHandleExW@KERNEL32.DLL at 00000000-00004492-10330-54-00BF7FE5\n GetModuleHandleW@KERNEL32.DLL at 00000000-00004492-10330-68-00BF7F80\n GetModuleHandleW@KERNEL32.DLL at 00000000-00004492-10330-602-00BF2BD6\n GetModuleHandleW@KERNEL32.DLL at 00000000-00004492-10330-775-00BF2031\n GetModuleHandleExW@KERNEL32.DLL at 00000000-00003804-12997-78-013687EB\n GetModuleHandleW@KERNEL32.DLL at 00000000-00003804-12997-92-01368786\n GetModuleHandleW@KERNEL32.DLL at 00000000-00003804-12997-599-01362F0B\n GetModuleHandleW@KERNEL32.DLL at 00000000-00003804-12997-773-01362031","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1082","relevance":5,"id":"stream-121","sources":[{"report_type":"sandbox","report_id":"6a8a8c348a356097900e51ed"}]},{"level":"suspicious","category":"Environment Awareness","name":"Contains ability to retrieve the contents of the STARTUPINFO structure","description":"GetStartupInfoW@KERNEL32.DLL at 00000000-00000772-9882-11-000A6A60\n GetStartupInfoW@KERNEL32.DLL at 00000000-00004492-10330-497-00BFA027\n GetStartupInfoW@KERNEL32.DLL at 00000000-00003804-12997-497-0136A027","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1543","relevance":5,"id":"stream-133","sources":[{"report_type":"sandbox","report_id":"6a8a8c348a356097900e51ed"}]},{"level":"suspicious","category":"Environment Awareness","name":"Contains ability to retrieve the specified system metric or system configuration setting","description":"GetSystemMetrics@USER32.DLL at 00000000-00000772-9882-22-000A681F","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1082","relevance":5,"id":"stream-122","sources":[{"report_type":"sandbox","report_id":"6a8a8c348a356097900e51ed"}]},{"level":"suspicious","category":"Environment Awareness","name":"Contains ability to retrieve volume information","description":"GetVolumeInformationA@KERNEL32.DLL at 00000000-00000772-9882-60-000A597D","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1082","relevance":5,"id":"stream-130","sources":[{"report_type":"sandbox","report_id":"6a8a8c348a356097900e51ed"}]},{"level":"suspicious","category":"External Systems","name":"Detected Suricata Alert","description":"Detected alert \"ET INFO TLS Handshake Failure\" (SID: 2029340, Rev: 2, Severity: 2) categorized as \"Potentially Bad Traffic\"","origin":"Suricata Alerts","relevance":10,"id":"suricata-1","sources":[{"report_type":"sandbox","report_id":"6a8a8c348a356097900e51ed"}]},{"level":"suspicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"11/26 Antivirus vendors marked sample as malicious (42% detection rate)","origin":"External System","id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"6a8a8c348a356097900e51ed"}]},{"level":"suspicious","category":"General","name":"Contains ability to find and load resources of a specific module","description":"FindResourceA@KERNEL32.DLL at 00000000-00000772-9882-35-000A468F\n FindResourceA@KERNEL32.DLL at 00000000-00000772-9882-51-000A4FE0\n LoadResource@KERNEL32.DLL at 00000000-00000772-9882-57-000A6298\n FindResourceA@KERNEL32.DLL at 00000000-00000772-9882-58-000A6517\n FindResourceA@KERNEL32.DLL at 00000000-00000772-9882-71-000A2CAA","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1005","relevance":1,"id":"stream-32","sources":[{"report_type":"sandbox","report_id":"6a8a8c348a356097900e51ed"}]},{"level":"suspicious","category":"General","name":"Reads configuration files (.ini files)","description":"\"5Ln7gt9.exe\" reads file \"C:\\Users\\%OSUSER%\\Desktop\\desktop.ini\"","origin":"API Call","mitre_attack_id":"T1083","relevance":4,"id":"api-6","sources":[{"report_type":"sandbox","report_id":"6a8a8c348a356097900e51ed"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Drops executable files","description":"$60","origin":"Binary File","mitre_attack_id":"T1105","relevance":5,"id":"binary-1","sources":[{"report_type":"sandbox","report_id":"6a8a8c348a356097900e51ed"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Modifies auto-execute functionality by setting/creating a value in the registry","description":"$61","origin":"Registry Access","mitre_attack_id":"T1547.001","relevance":8,"id":"registry-0","sources":[{"report_type":"sandbox","report_id":"6a8a8c348a356097900e51ed"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Writes a PE file header to disc","description":"$62","origin":"API Call","mitre_attack_id":"T1105","relevance":5,"id":"api-43","sources":[{"report_type":"sandbox","report_id":"6a8a8c348a356097900e51ed"}]},{"level":"suspicious","category":"Network Related","name":"Sends traffic on typical HTTP outbound port, but without HTTP header","description":"TCP traffic to 57.144.202.1 on port 443 is sent without HTTP header\n TCP traffic to 163.181.60.207 on port 80 is sent without HTTP header\n TCP traffic to 142.251.154.4 on port 443 is sent without HTTP header\n TCP traffic to 57.145.2.128 on port 443 is sent without HTTP header\n TCP traffic to 142.251.186.94 on port 80 is sent without HTTP header\n TCP traffic to 142.251.116.84 on port 443 is sent without HTTP header\n TCP traffic to 142.251.186.95 on port 443 is sent without HTTP header\n TCP traffic to 142.251.186.94 on port 443 is sent without HTTP header\n TCP traffic to 142.250.138.101 on port 443 is sent without HTTP header\n TCP traffic to 142.251.152.119 on port 443 is sent without HTTP header\n TCP traffic to 142.250.114.94 on port 443 is sent without HTTP header","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":5,"id":"network-23","sources":[{"report_type":"sandbox","report_id":"6a8a8c348a356097900e51ed"}]},{"level":"suspicious","category":"Pattern Matching","name":"YARA signature match – SDBM hashing algorithm","description":"YARA signature for SDBM hashing algorithm file \"5Ln7gt9.exe\"","origin":"YARA Signature","mitre_attack_id":"T1027","relevance":1,"id":"yara-223","sources":[{"report_type":"sandbox","report_id":"6a8a8c348a356097900e51ed"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the command-line string for the current process","description":"GetCommandLineA@KERNEL32.DLL at 00000000-00004492-10330-801-00BF8123\n GetCommandLineA@KERNEL32.DLL at 00000000-00003804-12997-798-01368929","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1106","relevance":3,"id":"stream-118","sources":[{"report_type":"sandbox","report_id":"6a8a8c348a356097900e51ed"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the fully qualified path of module","description":"GetModuleFileNameA@KERNEL32.DLL at 00000000-00000772-9882-42-000A202A\n GetModuleFileNameA@KERNEL32.DLL at 00000000-00000772-9882-44-000A2AAC\n GetModuleFileNameA@KERNEL32.DLL at 00000000-00000772-9882-78-000A5C9E\n GetModuleFileNameW@KERNEL32.DLL at 00000000-00004492-10330-429-00BFC47B\n GetModuleFileNameW@KERNEL32.DLL at 00000000-00003804-12997-430-0136C709","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1106","relevance":5,"id":"stream-131","sources":[{"report_type":"sandbox","report_id":"6a8a8c348a356097900e51ed"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Tries to access/write temporary files","description":"Process \"%WINDIR%\\system32\\cmd.exe\" with commandline \"/c \"%TEMP%\\\\90BA.tmp\\\\90BB.tmp\\\\90BC.bat %TEMP%\\\\IXP000.TMP\\\\5Ln7gt9.exe\"\" (UID: 00000000-00000844)","origin":"Monitored Target","mitre_attack_id":"T1074.001","relevance":5,"id":"target-423","sources":[{"report_type":"sandbox","report_id":"6a8a8c348a356097900e51ed"}]},{"level":"suspicious","category":"System Destruction","name":"Marks file for deletion","description":"$63","origin":"API Call","mitre_attack_id":"T1070.004","relevance":10,"id":"api-26","sources":[{"report_type":"sandbox","report_id":"6a8a8c348a356097900e51ed"}]},{"level":"suspicious","category":"System Destruction","name":"Opens file with deletion access rights","description":"$64","origin":"API Call","mitre_attack_id":"T1070.004","relevance":7,"id":"api-25","sources":[{"report_type":"sandbox","report_id":"6a8a8c348a356097900e51ed"}]},{"level":"suspicious","category":"System Security","name":"Modifies proxy settings","description":"\"5Ln7gt9.exe\" (Access type: \"DELETEVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\")\n \"5Ln7gt9.exe\" (Access type: \"DELETEVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\")","origin":"Registry Access","mitre_attack_id":"T1090.001","relevance":10,"id":"registry-27","sources":[{"report_type":"sandbox","report_id":"6a8a8c348a356097900e51ed"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"CRC value set in PE header does not match actual value","description":"\"FI3gq62.exe\" claimed CRC 936361 while the actual is CRC 776326\n \"db2FL06.exe\" claimed CRC 776326 while the actual is CRC 553764\n \"4xl958hh.exe\" claimed CRC 553764 while the actual is CRC 410355\n \"2Ev9506.exe\" claimed CRC 352231 while the actual is CRC 326609","origin":"Static Parser","mitre_attack_id":"T1027","relevance":10,"id":"static-0","sources":[{"report_type":"sandbox","report_id":"6a8a8c348a356097900e51ed"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Imports suspicious APIs","description":"OpenProcessToken\n RegCloseKey\n RegDeleteValueA\n RegOpenKeyExA\n RegCreateKeyExA\n TerminateProcess\n LockResource\n GetModuleHandleW\n FindNextFileA\n DeleteFileA\n FindResourceA\n CreateFileA\n GetStartupInfoW\n UnhandledExceptionFilter\n GetTempFileNameA\n CreateThread\n GetVersionExA\n GetDriveTypeA\n CreateProcessA\n GetFileAttributesA\n GetTickCount\n GetSystemDirectoryA\n GetTempPathA\n GetSystemInfo\n GetProcAddress\n CreateDirectoryA\n LoadLibraryA\n GetModuleFileNameA\n Sleep\n WriteFile\n LoadLibraryExA\n FindFirstFileA\n CreateFileW\n FindNextFileW\n GetModuleHandleExW\n GetCommandLineW\n FindFirstFileExW\n GetFileSizeEx\n GetCommandLineA\n GetModuleFileNameW\n IsDebuggerPresent\n LoadLibraryExW\n DeleteFileW\n GetVersionExW\n FindResourceW\n GetTempFileNameW\n GetTempPathW\n LoadLibraryW\n GetSystemDirectoryW\n CreateDirectoryW\n GetNativeSystemInfo\n ShellExecuteExW\n GetWindowThreadProcessId","origin":"Static Parser","mitre_attack_id":"T1106","relevance":1,"id":"static-1","sources":[{"report_type":"sandbox","report_id":"6a8a8c348a356097900e51ed"}]},{"level":"malicious","category":"Exploit/Shellcode","name":"Writes shellcode to a remote process","description":"$65","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1055","relevance":8,"id":"stream-38","sources":[{"report_type":"sandbox","report_id":"6a8a8c348a356097900e51ed"}]},{"level":"malicious","category":"External Systems","name":"Sample detected by CrowdStrike Static Analysis and ML with relatively high confidence","description":"CrowdStrike Static Analysis and ML (QuickScan) yielded detection: win/malicious_confidence_100% (W)","origin":"External System","relevance":10,"id":"avtest-8","sources":[{"report_type":"sandbox","report_id":"6a8a8c348a356097900e51ed"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a large number of Antivirus engines","description":"11/26 Antivirus vendors marked sample as malicious (42% detection rate)","origin":"External System","relevance":10,"id":"avtest-3","sources":[{"report_type":"sandbox","report_id":"6a8a8c348a356097900e51ed"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a trusted antivirus engine","description":"Trusted antivirus vendors count marked sample as malicious (count = 2)","origin":"External System","mitre_attack_id":"T1204.002","relevance":10,"id":"avtest-5","sources":[{"report_type":"sandbox","report_id":"6a8a8c348a356097900e51ed"}]},{"level":"malicious","category":"General","name":"The analysis extracted a file that was identified as malicious","description":"19/27 Antivirus vendors marked dropped file \"4xl958hh.exe\" as malicious (classified as \"Gen:Variant.Zusy\" with 70% detection rate)\n 17/27 Antivirus vendors marked dropped file \"2Ev9506.exe\" as malicious (classified as \"Gen:Variant.Zusy\" with 62% detection rate)\n 19/27 Antivirus vendors marked dropped file \"3yf84jj.exe\" as malicious (classified as \"Gen:Variant.Zusy\" with 70% detection rate)\n 12/27 Antivirus vendors marked dropped file \"1xy55nF7.exe\" as malicious (classified as \"Kryptik.HUYV trojan\" with 44% detection rate)\n 14/27 Antivirus vendors marked dropped file \"5Ln7gt9.exe\" as malicious (classified as \"Trojan.Generic\" with 51% detection rate)","origin":"Binary File","mitre_attack_id":"T1204.002","relevance":10,"id":"binary-11","sources":[{"report_type":"sandbox","report_id":"6a8a8c348a356097900e51ed"}]},{"level":"malicious","category":"General","name":"The analysis spawned a process that was identified as malicious","description":"12/27 Antivirus vendors marked spawned process \"1xy55nF7.exe\" (PID: 4492) as malicious (classified as \"Kryptik.HUYV trojan\" with 44% detection rate)\n 17/27 Antivirus vendors marked spawned process \"2Ev9506.exe\" (PID: 1596) as malicious (classified as \"Gen:Variant.Zusy\" with 62% detection rate)\n 19/27 Antivirus vendors marked spawned process \"3yf84jj.exe\" (PID: 3804) as malicious (classified as \"Gen:Variant.Zusy\" with 70% detection rate)\n 19/27 Antivirus vendors marked spawned process \"4xl958hh.exe\" (PID: 176) as malicious (classified as \"Gen:Variant.Zusy\" with 70% detection rate)\n 14/27 Antivirus vendors marked spawned process \"5Ln7gt9.exe\" (PID: 2056) as malicious (classified as \"Trojan.Generic\" with 51% detection rate)","origin":"Monitored Target","mitre_attack_id":"T1204.002","relevance":10,"id":"target-58","sources":[{"report_type":"sandbox","report_id":"6a8a8c348a356097900e51ed"}]},{"level":"malicious","category":"Network Related","name":"Contacts multiple hosts","description":"Contacted 12 (or more) hosts in at least 0 different cls.countries","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":9,"id":"network-17","sources":[{"report_type":"sandbox","report_id":"6a8a8c348a356097900e51ed"}]},{"level":"malicious","category":"Network Related","name":"Uses network protocols on unusual ports","description":"TCP traffic to 77.91.124.55 on port 19071","origin":"Network Traffic","mitre_attack_id":"T1571","relevance":7,"id":"network-7","sources":[{"report_type":"sandbox","report_id":"6a8a8c348a356097900e51ed"}]},{"level":"malicious","category":"Unusual Characteristics","name":"Spawns many processes","description":"Spawned process \"3fa03f784ec205ddfffcf521bd6cdb53b46ad6ed6fd84ec4ecd85c545c8e2edf.exe\" (UID: 00000000-00002360)\n Spawned process \"FI3gq62.exe\" (UID: 00000000-00003856)\n Spawned process \"db2FL06.exe\" (UID: 00000000-00004180)\n Spawned process \"Ta8tZ82.exe\" (UID: 00000000-00000772)\n Spawned process \"1xy55nF7.exe\" (UID: 00000000-00004492)\n Spawned process \"AppLaunch.exe\" (UID: 00000000-00003996)\n Spawned process \"2Ev9506.exe\" (UID: 00000000-00001596)\n Spawned process \"AppLaunch.exe\" (UID: 00000000-00001428)\n Spawned process \"3yf84jj.exe\" (UID: 00000000-00003804)\n Spawned process \"AppLaunch.exe\" (UID: 00000000-00003808)\n Spawned process \"4xl958hh.exe\" (UID: 00000000-00000176)\n Spawned process \"AppLaunch.exe\" (UID: 00000000-00004020)\n Spawned process \"5Ln7gt9.exe\" (UID: 00000000-00002056)\n Spawned process \"cmd.exe\" with commandline \"/c \"%TEMP%\\\\90BA.tmp\\\\90BB.tmp\\\\90BC.bat %TEMP%\\\\IXP000.TMP\\\\5Ln7gt9.exe\"\" (UID: 00000000-00000844)","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":8,"id":"target-14","sources":[{"report_type":"sandbox","report_id":"6a8a8c348a356097900e51ed"}]}],"incidents":[{"name":"Spyware","details_count":1,"details":[{"detail":"Found a string that may be used as part of an injection method"}],"sources":[{"report_type":"sandbox","report_id":"6a8a8c348a356097900e51ed"}]},{"name":"Persistence","details_count":2,"details":[{"detail":"Modifies auto-execute functionality by setting/creating a value in the registry"},{"detail":"Spawns many processes"}],"sources":[{"report_type":"sandbox","report_id":"6a8a8c348a356097900e51ed"}]},{"name":"Fingerprint","details_count":3,"details":[{"detail":"Queries kernel debugger information"},{"detail":"Queries sensitive IE security settings"},{"detail":"Queries the display settings of system associated file extensions"}],"sources":[{"report_type":"sandbox","report_id":"6a8a8c348a356097900e51ed"}]},{"name":"Evasive","details_count":4,"details":[{"detail":"Marks file for deletion"},{"detail":"Able to check if a debugger is running"},{"detail":"Contains ability to adjust token privileges"},{"detail":"Contains ability to terminate a process"}],"sources":[{"report_type":"sandbox","report_id":"6a8a8c348a356097900e51ed"}]},{"name":"Network Behavior","details_count":1,"details":[{"detail":"Contacts 12 domains and 12 hosts"}],"sources":[{"report_type":"sandbox","report_id":"6a8a8c348a356097900e51ed"}]}],"intel_graph":{"map":{"Domain:accounts.google.com":{"type":"Domain","value":"accounts.google.com"},"Domain:accounts.youtube.com":{"type":"Domain","value":"accounts.youtube.com"},"Domain:c.pki.goog":{"type":"Domain","value":"c.pki.goog"},"Domain:fonts.googleapis.com":{"type":"Domain","value":"fonts.googleapis.com"},"Domain:fonts.gstatic.com":{"type":"Domain","value":"fonts.gstatic.com"},"Domain:ocsp.digicert.cn":{"type":"Domain","value":"ocsp.digicert.cn"},"Domain:ocsp.pki.goog":{"type":"Domain","value":"ocsp.pki.goog"},"Domain:ssl.gstatic.com":{"type":"Domain","value":"ssl.gstatic.com"},"Domain:static.xx.fbcdn.net":{"type":"Domain","value":"static.xx.fbcdn.net"},"Domain:www.facebook.com":{"type":"Domain","value":"www.facebook.com"},"Domain:www.google.com":{"type":"Domain","value":"www.google.com"},"Domain:www.youtube.com":{"type":"Domain","value":"www.youtube.com"},"File:0923a6fb53240bd2c207fb8f4994d0424d7554cf1ad6991d76807eee8d2185e7":{"type":"File","value":"0923a6fb53240bd2c207fb8f4994d0424d7554cf1ad6991d76807eee8d2185e7","filetype":"PE32 executable (console) Intel 80386, for MS Windows, 5 sections","filetype_short":"PE32","mime_type":"application/x-dosexec"},"File:0b031e233629f38520781a0acedbb8b7b5979d0f6a4576d37e2079198f4d7e7d":{"type":"File","value":"0b031e233629f38520781a0acedbb8b7b5979d0f6a4576d37e2079198f4d7e7d"},"File:1a9251dc3b3c064cfc5e2b90b6c7dc3c225f7017066db2b77e49dae90a94a399":{"type":"File","value":"1a9251dc3b3c064cfc5e2b90b6c7dc3c225f7017066db2b77e49dae90a94a399"},"File:34d9c803544fe8b7d82027b68237413e6137b0479d068bbb392cb1dded25b37f":{"type":"File","value":"34d9c803544fe8b7d82027b68237413e6137b0479d068bbb392cb1dded25b37f"},"File:386bc59396ea12ee20709565e4e2f8b51d6be38d84637668064882d78c1fb477":{"type":"File","value":"386bc59396ea12ee20709565e4e2f8b51d6be38d84637668064882d78c1fb477","verdict":{"verdict":"malicious","verdict_source":"indicator database","reasons":["confirmed malicious file","confirmed relationship with a Threat SmokeLoader"]},"filetype":"PE32 executable (GUI) Intel 80386, for MS Windows, 5 sections","filetype_short":"PE32","mime_type":"application/x-dosexec"},"File:3fa03f784ec205ddfffcf521bd6cdb53b46ad6ed6fd84ec4ecd85c545c8e2edf":{"type":"File","value":"3fa03f784ec205ddfffcf521bd6cdb53b46ad6ed6fd84ec4ecd85c545c8e2edf","verdict":{"verdict":"malicious","verdict_source":"indicator database","reasons":["confirmed malicious file","confirmed relationship with a Threat RedLineStealer","confirmed relationship with a Threat SmokeLoader"]},"filetype":"PE32 executable (GUI) Intel 80386, for MS Windows, 5 sections","filetype_short":"PE32","mime_type":"application/x-dosexec"},"File:4a37843c7145f9ae878a6345a92ecb21b4fe206e212c8114c91c39034d2ea7ec":{"type":"File","value":"4a37843c7145f9ae878a6345a92ecb21b4fe206e212c8114c91c39034d2ea7ec"},"File:741f2c012c1489a7563d9f332eb8cfadd7673983d59006d09dec5a86a49ef5ca":{"type":"File","value":"741f2c012c1489a7563d9f332eb8cfadd7673983d59006d09dec5a86a49ef5ca","filetype":"PE32 executable (GUI) Intel 80386, for MS Windows, 5 sections","filetype_short":"PE32","mime_type":"application/x-dosexec"},"File:7a32fc8a5ae6b56f78a2428df6502d88c69de9e54c26e4235f3a86814a55ae5b":{"type":"File","value":"7a32fc8a5ae6b56f78a2428df6502d88c69de9e54c26e4235f3a86814a55ae5b","filetype":"PE32 executable (console) Intel 80386, for MS Windows, 5 sections","filetype_short":"PE32","mime_type":"application/x-dosexec"},"File:893b7c343426774ab5a701f0d4a7817b4a02d0e7f78a4b45e7ba8a9a57ce44bb":{"type":"File","value":"893b7c343426774ab5a701f0d4a7817b4a02d0e7f78a4b45e7ba8a9a57ce44bb"},"File:8ee56a1aa73203798befaa1b303a3e9800b00b9908f9ec8a2d76804a6975eba2":{"type":"File","value":"8ee56a1aa73203798befaa1b303a3e9800b00b9908f9ec8a2d76804a6975eba2"},"File:abb2f23efcb2fed7a229ad9a2f3ac3309e2f65d032cf1ae3727a52f6c9b37124":{"type":"File","value":"abb2f23efcb2fed7a229ad9a2f3ac3309e2f65d032cf1ae3727a52f6c9b37124"},"File:abed45fcf32b29e53a86caa1af2a3e4110a2a601365b5eb7f3b4860e5d1f134a":{"type":"File","value":"abed45fcf32b29e53a86caa1af2a3e4110a2a601365b5eb7f3b4860e5d1f134a","filetype":"PE32 executable (GUI) Intel 80386, for MS Windows, 5 sections","filetype_short":"PE32","mime_type":"application/x-dosexec"},"File:b736077e8eccf72bc48e2a28576bb47d59bdaa335baa2dc333fb3701becfacaa":{"type":"File","value":"b736077e8eccf72bc48e2a28576bb47d59bdaa335baa2dc333fb3701becfacaa","filetype":"PE32 executable (GUI) Intel 80386, for MS Windows, 5 sections","filetype_short":"PE32","mime_type":"application/x-dosexec"},"File:c3dea90ca98985007f0de66bf0197fdcd2d4a35e365135bf37a18a4895d81668":{"type":"File","value":"c3dea90ca98985007f0de66bf0197fdcd2d4a35e365135bf37a18a4895d81668"},"File:c5d71f655ed6fd7a1383791d6ddb9b3d39cb28be17f74dd787c0ca4792b0dbe0":{"type":"File","value":"c5d71f655ed6fd7a1383791d6ddb9b3d39cb28be17f74dd787c0ca4792b0dbe0"},"File:da93632b4e1abf14d0dafae3c1df7eaa2c307199ab38ae4c80e1d2a89479a361":{"type":"File","value":"da93632b4e1abf14d0dafae3c1df7eaa2c307199ab38ae4c80e1d2a89479a361"},"File:e4376ea14db956de0e3bf7fbb625dbe787f9f959b959f74efc27ae603b053f99":{"type":"File","value":"e4376ea14db956de0e3bf7fbb625dbe787f9f959b959f74efc27ae603b053f99","verdict":{"verdict":"malicious","verdict_source":"indicator database","reasons":["confirmed malicious file","confirmed relationship with a Threat SmokeLoader"]},"filetype":"PE32 executable (console) Intel 80386, for MS Windows, 5 sections","filetype_short":"PE32","mime_type":"application/x-dosexec"},"File:eb52081ca63e7feac1c2a45585402d62b095e47f92d89bf9be08abba056d2dde":{"type":"File","value":"eb52081ca63e7feac1c2a45585402d62b095e47f92d89bf9be08abba056d2dde"},"File:fed69e2c91153ac1dd188ec2da5e9ef2c7713c21c74bdc5704f681fe16d54487":{"type":"File","value":"fed69e2c91153ac1dd188ec2da5e9ef2c7713c21c74bdc5704f681fe16d54487"},"File:ff817e5215c53b5e2653c8c780c16e4207a8575e2b40f8a37cfd228085a7ee41":{"type":"File","value":"ff817e5215c53b5e2653c8c780c16e4207a8575e2b40f8a37cfd228085a7ee41"},"Ip:142.250.114.94":{"type":"Ip","value":"142.250.114.94"},"Ip:142.250.138.101":{"type":"Ip","value":"142.250.138.101"},"Ip:142.251.116.84":{"type":"Ip","value":"142.251.116.84"},"Ip:142.251.152.119":{"type":"Ip","value":"142.251.152.119"},"Ip:142.251.154.4":{"type":"Ip","value":"142.251.154.4"},"Ip:142.251.186.94":{"type":"Ip","value":"142.251.186.94"},"Ip:142.251.186.95":{"type":"Ip","value":"142.251.186.95"},"Ip:163.181.60.207":{"type":"Ip","value":"163.181.60.207"},"Ip:57.144.202.1":{"type":"Ip","value":"57.144.202.1"},"Ip:57.145.2.128":{"type":"Ip","value":"57.145.2.128"},"Ip:77.91.124.55":{"type":"Ip","value":"77.91.124.55"},"Threat:98bcaeab215e23f1c1edb4075194c4bb3c746557cad619d1e2ef892ed9de6ee3":{"type":"Threat","value":"RedLineStealer","verdict":{"verdict":"malicious","verdict_source":"indicator database"}},"Threat:ada9ac3ecf1aea7a80d89fa364bc17118165a13672a8093fe8ddd6109d5d9133":{"type":"Threat","value":"SmokeLoader","verdict":{"verdict":"malicious","verdict_source":"indicator database"}},"Url:/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEA59dSNcqDdhV39MzSTNbR0%3D":{"type":"Url","value":"/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEA59dSNcqDdhV39MzSTNbR0%3D"},"Url:/gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D":{"type":"Url","value":"/gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D"},"Url:/r/gsr1.crl":{"type":"Url","value":"/r/gsr1.crl"},"Url:/r/r1.crl":{"type":"Url","value":"/r/r1.crl"},"Url:/r/r4.crl":{"type":"Url","value":"/r/r4.crl"},"Url:/we2/Gt0Gl6QoGAU.crl":{"type":"Url","value":"/we2/Gt0Gl6QoGAU.crl"},"Url:/we2/dTM3-0hpWfE.crl":{"type":"Url","value":"/we2/dTM3-0hpWfE.crl"},"Url:/we2/xuzt3PU9F_w.crl":{"type":"Url","value":"/we2/xuzt3PU9F_w.crl"},"Url:/we2/yK5nPhtHKQs.crl":{"type":"Url","value":"/we2/yK5nPhtHKQs.crl"},"Url:/wr2/9UVbN0w5E6Y.crl":{"type":"Url","value":"/wr2/9UVbN0w5E6Y.crl"},"Url:/wr2/oBFYYahzgVI.crl":{"type":"Url","value":"/wr2/oBFYYahzgVI.crl"}},"chains":[{"id":"1543653087784497431","root":"File:386bc59396ea12ee20709565e4e2f8b51d6be38d84637668064882d78c1fb477","edges":[],"verdict":{"verdict":"malicious","verdict_source":"indicator database","reasons":["confirmed malicious file","confirmed relationship with a Threat SmokeLoader"]}},{"id":"1543653098331055162","root":"File:386bc59396ea12ee20709565e4e2f8b51d6be38d84637668064882d78c1fb477","edges":[{"edge_kind":"extracted_from_archive","from_key":"File:386bc59396ea12ee20709565e4e2f8b51d6be38d84637668064882d78c1fb477","to_key":"File:e4376ea14db956de0e3bf7fbb625dbe787f9f959b959f74efc27ae603b053f99"}],"verdict":{"verdict":"malicious","verdict_source":"indicator database","reasons":["confirmed malicious file","confirmed relationship with a Threat SmokeLoader"]}},{"id":"1543653087784497430","root":"File:386bc59396ea12ee20709565e4e2f8b51d6be38d84637668064882d78c1fb477","edges":[{"edge_kind":"in_crowdstrike_knowledge_database","from_key":"File:386bc59396ea12ee20709565e4e2f8b51d6be38d84637668064882d78c1fb477","to_key":"Threat:ada9ac3ecf1aea7a80d89fa364bc17118165a13672a8093fe8ddd6109d5d9133"}],"verdict":{"verdict":"malicious","verdict_source":"indicator database"}},{"id":"1543653077508452557","root":"File:3fa03f784ec205ddfffcf521bd6cdb53b46ad6ed6fd84ec4ecd85c545c8e2edf","edges":[],"verdict":{"verdict":"malicious","verdict_source":"indicator database","reasons":["confirmed malicious file","confirmed relationship with a Threat RedLineStealer","confirmed relationship with a Threat SmokeLoader"]}},{"id":"1543653077504258251","root":"File:3fa03f784ec205ddfffcf521bd6cdb53b46ad6ed6fd84ec4ecd85c545c8e2edf","edges":[{"edge_kind":"in_crowdstrike_knowledge_database","from_key":"File:3fa03f784ec205ddfffcf521bd6cdb53b46ad6ed6fd84ec4ecd85c545c8e2edf","to_key":"Threat:98bcaeab215e23f1c1edb4075194c4bb3c746557cad619d1e2ef892ed9de6ee3"}],"verdict":{"verdict":"malicious","verdict_source":"indicator database"}},{"id":"1543653077504258252","root":"File:3fa03f784ec205ddfffcf521bd6cdb53b46ad6ed6fd84ec4ecd85c545c8e2edf","edges":[{"edge_kind":"in_crowdstrike_knowledge_database","from_key":"File:3fa03f784ec205ddfffcf521bd6cdb53b46ad6ed6fd84ec4ecd85c545c8e2edf","to_key":"Threat:ada9ac3ecf1aea7a80d89fa364bc17118165a13672a8093fe8ddd6109d5d9133"}],"verdict":{"verdict":"malicious","verdict_source":"indicator database"}},{"id":"1543653081434124272","root":"File:3fa03f784ec205ddfffcf521bd6cdb53b46ad6ed6fd84ec4ecd85c545c8e2edf","edges":[{"edge_kind":"extracted_from_archive","from_key":"File:3fa03f784ec205ddfffcf521bd6cdb53b46ad6ed6fd84ec4ecd85c545c8e2edf","to_key":"File:abed45fcf32b29e53a86caa1af2a3e4110a2a601365b5eb7f3b4860e5d1f134a"},{"edge_kind":"extracted_from_archive","from_key":"File:abed45fcf32b29e53a86caa1af2a3e4110a2a601365b5eb7f3b4860e5d1f134a","to_key":"File:7a32fc8a5ae6b56f78a2428df6502d88c69de9e54c26e4235f3a86814a55ae5b"}],"verdict":{"verdict":"unknown"}},{"id":"1543653081438318582","root":"File:741f2c012c1489a7563d9f332eb8cfadd7673983d59006d09dec5a86a49ef5ca","edges":[{"edge_kind":"extracted_from_archive","from_key":"File:741f2c012c1489a7563d9f332eb8cfadd7673983d59006d09dec5a86a49ef5ca","to_key":"File:0923a6fb53240bd2c207fb8f4994d0424d7554cf1ad6991d76807eee8d2185e7"}],"verdict":{"verdict":"unknown"}},{"id":"1543653081438318585","root":"File:741f2c012c1489a7563d9f332eb8cfadd7673983d59006d09dec5a86a49ef5ca","edges":[{"edge_kind":"extracted_from_archive","from_key":"File:741f2c012c1489a7563d9f332eb8cfadd7673983d59006d09dec5a86a49ef5ca","to_key":"File:b736077e8eccf72bc48e2a28576bb47d59bdaa335baa2dc333fb3701becfacaa"}],"verdict":{"verdict":"unknown"}},{"id":"1543653087943720746","root":"File:e4376ea14db956de0e3bf7fbb625dbe787f9f959b959f74efc27ae603b053f99","edges":[{"edge_kind":"in_crowdstrike_knowledge_database","from_key":"File:e4376ea14db956de0e3bf7fbb625dbe787f9f959b959f74efc27ae603b053f99","to_key":"Threat:ada9ac3ecf1aea7a80d89fa364bc17118165a13672a8093fe8ddd6109d5d9133"}],"verdict":{"verdict":"malicious","verdict_source":"indicator database"}},{"id":"sandbox_network","root":"File:3fa03f784ec205ddfffcf521bd6cdb53b46ad6ed6fd84ec4ecd85c545c8e2edf","edges":[{"edge_kind":"contacted_ip","from_key":"File:3fa03f784ec205ddfffcf521bd6cdb53b46ad6ed6fd84ec4ecd85c545c8e2edf","to_key":"Ip:77.91.124.55"},{"edge_kind":"contacted_ip","from_key":"File:3fa03f784ec205ddfffcf521bd6cdb53b46ad6ed6fd84ec4ecd85c545c8e2edf","to_key":"Ip:57.144.202.1"},{"edge_kind":"contacted_ip","from_key":"File:3fa03f784ec205ddfffcf521bd6cdb53b46ad6ed6fd84ec4ecd85c545c8e2edf","to_key":"Ip:163.181.60.207"},{"edge_kind":"contacted_ip","from_key":"File:3fa03f784ec205ddfffcf521bd6cdb53b46ad6ed6fd84ec4ecd85c545c8e2edf","to_key":"Ip:142.251.154.4"},{"edge_kind":"contacted_ip","from_key":"File:3fa03f784ec205ddfffcf521bd6cdb53b46ad6ed6fd84ec4ecd85c545c8e2edf","to_key":"Ip:57.145.2.128"},{"edge_kind":"contacted_ip","from_key":"File:3fa03f784ec205ddfffcf521bd6cdb53b46ad6ed6fd84ec4ecd85c545c8e2edf","to_key":"Ip:142.251.186.94"},{"edge_kind":"contacted_ip","from_key":"File:3fa03f784ec205ddfffcf521bd6cdb53b46ad6ed6fd84ec4ecd85c545c8e2edf","to_key":"Ip:142.251.116.84"},{"edge_kind":"contacted_ip","from_key":"File:3fa03f784ec205ddfffcf521bd6cdb53b46ad6ed6fd84ec4ecd85c545c8e2edf","to_key":"Ip:142.251.186.95"},{"edge_kind":"contacted_ip","from_key":"File:3fa03f784ec205ddfffcf521bd6cdb53b46ad6ed6fd84ec4ecd85c545c8e2edf","to_key":"Ip:142.251.186.94"},{"edge_kind":"contacted_ip","from_key":"File:3fa03f784ec205ddfffcf521bd6cdb53b46ad6ed6fd84ec4ecd85c545c8e2edf","to_key":"Ip:142.250.138.101"},{"edge_kind":"contacted_ip","from_key":"File:3fa03f784ec205ddfffcf521bd6cdb53b46ad6ed6fd84ec4ecd85c545c8e2edf","to_key":"Ip:142.251.152.119"},{"edge_kind":"contacted_ip","from_key":"File:3fa03f784ec205ddfffcf521bd6cdb53b46ad6ed6fd84ec4ecd85c545c8e2edf","to_key":"Ip:142.250.114.94"},{"edge_kind":"contacted_domain","from_key":"File:3fa03f784ec205ddfffcf521bd6cdb53b46ad6ed6fd84ec4ecd85c545c8e2edf","to_key":"Domain:accounts.google.com"},{"edge_kind":"resolves_to","from_key":"Domain:accounts.google.com","to_key":"Ip:142.251.116.84"},{"edge_kind":"contacted_domain","from_key":"File:3fa03f784ec205ddfffcf521bd6cdb53b46ad6ed6fd84ec4ecd85c545c8e2edf","to_key":"Domain:accounts.youtube.com"},{"edge_kind":"resolves_to","from_key":"Domain:accounts.youtube.com","to_key":"Ip:142.250.138.101"},{"edge_kind":"contacted_domain","from_key":"File:3fa03f784ec205ddfffcf521bd6cdb53b46ad6ed6fd84ec4ecd85c545c8e2edf","to_key":"Domain:c.pki.goog"},{"edge_kind":"resolves_to","from_key":"Domain:c.pki.goog","to_key":"Ip:142.251.186.94"},{"edge_kind":"contacted_domain","from_key":"File:3fa03f784ec205ddfffcf521bd6cdb53b46ad6ed6fd84ec4ecd85c545c8e2edf","to_key":"Domain:fonts.googleapis.com"},{"edge_kind":"resolves_to","from_key":"Domain:fonts.googleapis.com","to_key":"Ip:142.251.186.95"},{"edge_kind":"contacted_domain","from_key":"File:3fa03f784ec205ddfffcf521bd6cdb53b46ad6ed6fd84ec4ecd85c545c8e2edf","to_key":"Domain:fonts.gstatic.com"},{"edge_kind":"resolves_to","from_key":"Domain:fonts.gstatic.com","to_key":"Ip:142.250.114.94"},{"edge_kind":"contacted_domain","from_key":"File:3fa03f784ec205ddfffcf521bd6cdb53b46ad6ed6fd84ec4ecd85c545c8e2edf","to_key":"Domain:ocsp.digicert.cn"},{"edge_kind":"resolves_to","from_key":"Domain:ocsp.digicert.cn","to_key":"Ip:163.181.60.207"},{"edge_kind":"contacted_domain","from_key":"File:3fa03f784ec205ddfffcf521bd6cdb53b46ad6ed6fd84ec4ecd85c545c8e2edf","to_key":"Domain:ocsp.pki.goog"},{"edge_kind":"resolves_to","from_key":"Domain:ocsp.pki.goog","to_key":"Ip:142.251.186.94"},{"edge_kind":"contacted_domain","from_key":"File:3fa03f784ec205ddfffcf521bd6cdb53b46ad6ed6fd84ec4ecd85c545c8e2edf","to_key":"Domain:ssl.gstatic.com"},{"edge_kind":"resolves_to","from_key":"Domain:ssl.gstatic.com","to_key":"Ip:142.251.186.94"},{"edge_kind":"contacted_domain","from_key":"File:3fa03f784ec205ddfffcf521bd6cdb53b46ad6ed6fd84ec4ecd85c545c8e2edf","to_key":"Domain:static.xx.fbcdn.net"},{"edge_kind":"resolves_to","from_key":"Domain:static.xx.fbcdn.net","to_key":"Ip:57.145.2.128"},{"edge_kind":"contacted_domain","from_key":"File:3fa03f784ec205ddfffcf521bd6cdb53b46ad6ed6fd84ec4ecd85c545c8e2edf","to_key":"Domain:www.facebook.com"},{"edge_kind":"resolves_to","from_key":"Domain:www.facebook.com","to_key":"Ip:57.144.202.1"},{"edge_kind":"contacted_domain","from_key":"File:3fa03f784ec205ddfffcf521bd6cdb53b46ad6ed6fd84ec4ecd85c545c8e2edf","to_key":"Domain:www.google.com"},{"edge_kind":"resolves_to","from_key":"Domain:www.google.com","to_key":"Ip:142.251.152.119"},{"edge_kind":"contacted_domain","from_key":"File:3fa03f784ec205ddfffcf521bd6cdb53b46ad6ed6fd84ec4ecd85c545c8e2edf","to_key":"Domain:www.youtube.com"},{"edge_kind":"resolves_to","from_key":"Domain:www.youtube.com","to_key":"Ip:142.251.154.4"},{"edge_kind":"contacted_url","from_key":"File:3fa03f784ec205ddfffcf521bd6cdb53b46ad6ed6fd84ec4ecd85c545c8e2edf","to_key":"Url:/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEA59dSNcqDdhV39MzSTNbR0%3D"},{"edge_kind":"contacted_url","from_key":"File:3fa03f784ec205ddfffcf521bd6cdb53b46ad6ed6fd84ec4ecd85c545c8e2edf","to_key":"Url:/gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D"},{"edge_kind":"contacted_url","from_key":"File:3fa03f784ec205ddfffcf521bd6cdb53b46ad6ed6fd84ec4ecd85c545c8e2edf","to_key":"Url:/r/r1.crl"},{"edge_kind":"contacted_url","from_key":"File:3fa03f784ec205ddfffcf521bd6cdb53b46ad6ed6fd84ec4ecd85c545c8e2edf","to_key":"Url:/wr2/9UVbN0w5E6Y.crl"},{"edge_kind":"contacted_url","from_key":"File:3fa03f784ec205ddfffcf521bd6cdb53b46ad6ed6fd84ec4ecd85c545c8e2edf","to_key":"Url:/r/gsr1.crl"},{"edge_kind":"contacted_url","from_key":"File:3fa03f784ec205ddfffcf521bd6cdb53b46ad6ed6fd84ec4ecd85c545c8e2edf","to_key":"Url:/r/r4.crl"},{"edge_kind":"contacted_url","from_key":"File:3fa03f784ec205ddfffcf521bd6cdb53b46ad6ed6fd84ec4ecd85c545c8e2edf","to_key":"Url:/we2/yK5nPhtHKQs.crl"},{"edge_kind":"contacted_url","from_key":"File:3fa03f784ec205ddfffcf521bd6cdb53b46ad6ed6fd84ec4ecd85c545c8e2edf","to_key":"Url:/we2/Gt0Gl6QoGAU.crl"},{"edge_kind":"contacted_url","from_key":"File:3fa03f784ec205ddfffcf521bd6cdb53b46ad6ed6fd84ec4ecd85c545c8e2edf","to_key":"Url:/we2/xuzt3PU9F_w.crl"},{"edge_kind":"contacted_url","from_key":"File:3fa03f784ec205ddfffcf521bd6cdb53b46ad6ed6fd84ec4ecd85c545c8e2edf","to_key":"Url:/we2/dTM3-0hpWfE.crl"},{"edge_kind":"contacted_url","from_key":"File:3fa03f784ec205ddfffcf521bd6cdb53b46ad6ed6fd84ec4ecd85c545c8e2edf","to_key":"Url:/wr2/oBFYYahzgVI.crl"}],"verdict":{"verdict":"unknown","verdict_source":"sandbox"}},{"id":"sandbox_files","root":"File:3fa03f784ec205ddfffcf521bd6cdb53b46ad6ed6fd84ec4ecd85c545c8e2edf","edges":[{"edge_kind":"extracted","from_key":"File:3fa03f784ec205ddfffcf521bd6cdb53b46ad6ed6fd84ec4ecd85c545c8e2edf","to_key":"File:e4376ea14db956de0e3bf7fbb625dbe787f9f959b959f74efc27ae603b053f99"},{"edge_kind":"extracted","from_key":"File:3fa03f784ec205ddfffcf521bd6cdb53b46ad6ed6fd84ec4ecd85c545c8e2edf","to_key":"File:abed45fcf32b29e53a86caa1af2a3e4110a2a601365b5eb7f3b4860e5d1f134a"},{"edge_kind":"extracted","from_key":"File:3fa03f784ec205ddfffcf521bd6cdb53b46ad6ed6fd84ec4ecd85c545c8e2edf","to_key":"File:7a32fc8a5ae6b56f78a2428df6502d88c69de9e54c26e4235f3a86814a55ae5b"},{"edge_kind":"extracted","from_key":"File:3fa03f784ec205ddfffcf521bd6cdb53b46ad6ed6fd84ec4ecd85c545c8e2edf","to_key":"File:0923a6fb53240bd2c207fb8f4994d0424d7554cf1ad6991d76807eee8d2185e7"},{"edge_kind":"extracted","from_key":"File:3fa03f784ec205ddfffcf521bd6cdb53b46ad6ed6fd84ec4ecd85c545c8e2edf","to_key":"File:b736077e8eccf72bc48e2a28576bb47d59bdaa335baa2dc333fb3701becfacaa"},{"edge_kind":"extracted","from_key":"File:3fa03f784ec205ddfffcf521bd6cdb53b46ad6ed6fd84ec4ecd85c545c8e2edf","to_key":"File:34d9c803544fe8b7d82027b68237413e6137b0479d068bbb392cb1dded25b37f"},{"edge_kind":"extracted","from_key":"File:3fa03f784ec205ddfffcf521bd6cdb53b46ad6ed6fd84ec4ecd85c545c8e2edf","to_key":"File:386bc59396ea12ee20709565e4e2f8b51d6be38d84637668064882d78c1fb477"},{"edge_kind":"extracted","from_key":"File:3fa03f784ec205ddfffcf521bd6cdb53b46ad6ed6fd84ec4ecd85c545c8e2edf","to_key":"File:c3dea90ca98985007f0de66bf0197fdcd2d4a35e365135bf37a18a4895d81668"},{"edge_kind":"extracted","from_key":"File:3fa03f784ec205ddfffcf521bd6cdb53b46ad6ed6fd84ec4ecd85c545c8e2edf","to_key":"File:741f2c012c1489a7563d9f332eb8cfadd7673983d59006d09dec5a86a49ef5ca"},{"edge_kind":"extracted","from_key":"File:3fa03f784ec205ddfffcf521bd6cdb53b46ad6ed6fd84ec4ecd85c545c8e2edf","to_key":"File:4a37843c7145f9ae878a6345a92ecb21b4fe206e212c8114c91c39034d2ea7ec"},{"edge_kind":"extracted","from_key":"File:3fa03f784ec205ddfffcf521bd6cdb53b46ad6ed6fd84ec4ecd85c545c8e2edf","to_key":"File:da93632b4e1abf14d0dafae3c1df7eaa2c307199ab38ae4c80e1d2a89479a361"},{"edge_kind":"extracted","from_key":"File:3fa03f784ec205ddfffcf521bd6cdb53b46ad6ed6fd84ec4ecd85c545c8e2edf","to_key":"File:c5d71f655ed6fd7a1383791d6ddb9b3d39cb28be17f74dd787c0ca4792b0dbe0"},{"edge_kind":"extracted","from_key":"File:3fa03f784ec205ddfffcf521bd6cdb53b46ad6ed6fd84ec4ecd85c545c8e2edf","to_key":"File:abb2f23efcb2fed7a229ad9a2f3ac3309e2f65d032cf1ae3727a52f6c9b37124"},{"edge_kind":"extracted","from_key":"File:3fa03f784ec205ddfffcf521bd6cdb53b46ad6ed6fd84ec4ecd85c545c8e2edf","to_key":"File:ff817e5215c53b5e2653c8c780c16e4207a8575e2b40f8a37cfd228085a7ee41"},{"edge_kind":"extracted","from_key":"File:3fa03f784ec205ddfffcf521bd6cdb53b46ad6ed6fd84ec4ecd85c545c8e2edf","to_key":"File:0b031e233629f38520781a0acedbb8b7b5979d0f6a4576d37e2079198f4d7e7d"},{"edge_kind":"extracted","from_key":"File:3fa03f784ec205ddfffcf521bd6cdb53b46ad6ed6fd84ec4ecd85c545c8e2edf","to_key":"File:1a9251dc3b3c064cfc5e2b90b6c7dc3c225f7017066db2b77e49dae90a94a399"},{"edge_kind":"extracted","from_key":"File:3fa03f784ec205ddfffcf521bd6cdb53b46ad6ed6fd84ec4ecd85c545c8e2edf","to_key":"File:893b7c343426774ab5a701f0d4a7817b4a02d0e7f78a4b45e7ba8a9a57ce44bb"},{"edge_kind":"extracted","from_key":"File:3fa03f784ec205ddfffcf521bd6cdb53b46ad6ed6fd84ec4ecd85c545c8e2edf","to_key":"File:fed69e2c91153ac1dd188ec2da5e9ef2c7713c21c74bdc5704f681fe16d54487"},{"edge_kind":"extracted","from_key":"File:3fa03f784ec205ddfffcf521bd6cdb53b46ad6ed6fd84ec4ecd85c545c8e2edf","to_key":"File:8ee56a1aa73203798befaa1b303a3e9800b00b9908f9ec8a2d76804a6975eba2"},{"edge_kind":"extracted","from_key":"File:3fa03f784ec205ddfffcf521bd6cdb53b46ad6ed6fd84ec4ecd85c545c8e2edf","to_key":"File:eb52081ca63e7feac1c2a45585402d62b095e47f92d89bf9be08abba056d2dde"}],"verdict":{"verdict":"unknown","verdict_source":"sandbox"}}]}},"activity":{"stats":{"process_count":20,"spawned_processes_count":20,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":34,"imported_dlls_count":188,"dropped_files_count":0,"extracted_files_count":20,"files_written_count":18,"files_deleted_count":0,"registry_keys_created_count":2,"registry_keys_modified_count":0,"registry_keys_deleted_count":4,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":6,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":12,"dns_resolutions_count":12,"contacted_urls_count":11,"http_requests_count":11},"behavior_tags":["commodity","backdoor","smokeloader","redlinestealer","criminal","informationstealer","downloader"],"sample_flags":["Multi-Process","Network Traffic","Extracted Files","Decrypted SSL traffic"],"sandbox_reports":[{"id":"6a8a8c348a356097900e51ed","environment_id":100,"environment_description":"Windows 7 32 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"Gen:Heur.Crifi","contacted_countries":["DEU","USA"],"submit_name":"3fa03f784ec205ddfffcf521bd6cdb53b46ad6ed6fd84ec4ecd85c545c8e2edf","analysis_start_time":"2026-08-23T05:59:18+00:00","indicators_count":{"informative":226,"suspicious":62,"malicious":9},"tags":["Multi-Process","Network Traffic","Extracted Files","Decrypted SSL traffic"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":[{"address":"77.91.124.55","port":19071,"protocol":"TCP","country":"Germany","sources":[{"report_type":"sandbox","report_id":"6a8a8c348a356097900e51ed"}]},{"address":"57.144.202.1","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"6a8a8c348a356097900e51ed"}]},{"address":"163.181.60.207","port":80,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"6a8a8c348a356097900e51ed"}]},{"address":"142.251.154.4","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"6a8a8c348a356097900e51ed"}]},{"address":"57.145.2.128","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"6a8a8c348a356097900e51ed"}]},{"address":"142.251.186.94","port":80,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"6a8a8c348a356097900e51ed"}]},{"address":"142.251.116.84","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"6a8a8c348a356097900e51ed"}]},{"address":"142.251.186.95","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"6a8a8c348a356097900e51ed"}]},{"address":"142.251.186.94","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"6a8a8c348a356097900e51ed"}]},{"address":"142.250.138.101","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"6a8a8c348a356097900e51ed"}]},{"address":"142.251.152.119","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"6a8a8c348a356097900e51ed"}]},{"address":"142.250.114.94","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"6a8a8c348a356097900e51ed"}]}],"dns_resolutions":[{"domain":"accounts.google.com","address":"142.251.116.84","ttl":273,"country":"United States","sources":[{"report_type":"sandbox","report_id":"6a8a8c348a356097900e51ed"}]},{"domain":"accounts.youtube.com","address":"142.250.138.101","ttl":300,"country":"United States","sources":[{"report_type":"sandbox","report_id":"6a8a8c348a356097900e51ed"}]},{"domain":"c.pki.goog","address":"142.251.186.94","ttl":240,"country":"United States","sources":[{"report_type":"sandbox","report_id":"6a8a8c348a356097900e51ed"}]},{"domain":"fonts.googleapis.com","address":"142.251.186.95","ttl":274,"country":"United States","sources":[{"report_type":"sandbox","report_id":"6a8a8c348a356097900e51ed"}]},{"domain":"fonts.gstatic.com","address":"142.250.114.94","ttl":271,"country":"United States","sources":[{"report_type":"sandbox","report_id":"6a8a8c348a356097900e51ed"}]},{"domain":"ocsp.digicert.cn","address":"163.181.60.207","ttl":282,"country":"United States","sources":[{"report_type":"sandbox","report_id":"6a8a8c348a356097900e51ed"}]},{"domain":"ocsp.pki.goog","address":"142.251.186.94","ttl":28,"country":"United States","sources":[{"report_type":"sandbox","report_id":"6a8a8c348a356097900e51ed"}]},{"domain":"ssl.gstatic.com","address":"142.251.186.94","ttl":300,"country":"United States","sources":[{"report_type":"sandbox","report_id":"6a8a8c348a356097900e51ed"}]},{"domain":"static.xx.fbcdn.net","address":"57.145.2.128","ttl":3501,"country":"United States","sources":[{"report_type":"sandbox","report_id":"6a8a8c348a356097900e51ed"}]},{"domain":"www.facebook.com","address":"57.144.202.1","ttl":3576,"country":"United States","sources":[{"report_type":"sandbox","report_id":"6a8a8c348a356097900e51ed"}]},{"domain":"www.google.com","address":"142.251.152.119","ttl":229,"country":"United States","sources":[{"report_type":"sandbox","report_id":"6a8a8c348a356097900e51ed"}]},{"domain":"www.youtube.com","address":"142.251.154.4","ttl":300,"country":"United States","sources":[{"report_type":"sandbox","report_id":"6a8a8c348a356097900e51ed"}]}],"http_requests":[{"host":"ocsp.digicert.cn","host_ip":"163.181.60.207:80","url":"/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEA59dSNcqDdhV39MzSTNbR0%3D","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEA59dSNcqDdhV39MzSTNbR0%3D HTTP/1.1\nConnection: Keep-Alive\nAccept: */*\nUser-Agent: Microsoft-CryptoAPI/6.1\nHost: ocsp.digicert.cn","sources":[{"report_type":"sandbox","report_id":"6a8a8c348a356097900e51ed"}]},{"host":"ocsp.pki.goog","host_ip":"142.251.186.94:80","url":"/gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D HTTP/1.1\nConnection: Keep-Alive\nAccept: */*\nUser-Agent: Microsoft-CryptoAPI/6.1\nHost: ocsp.pki.goog","sources":[{"report_type":"sandbox","report_id":"6a8a8c348a356097900e51ed"}]},{"host":"c.pki.goog","host_ip":"142.251.186.94:80","url":"/r/r1.crl","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /r/r1.crl HTTP/1.1\nConnection: Keep-Alive\nAccept: */*\nUser-Agent: Microsoft-CryptoAPI/6.1\nHost: c.pki.goog","sources":[{"report_type":"sandbox","report_id":"6a8a8c348a356097900e51ed"}]},{"host":"c.pki.goog","host_ip":"142.251.186.94:80","url":"/wr2/9UVbN0w5E6Y.crl","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /wr2/9UVbN0w5E6Y.crl HTTP/1.1\nConnection: Keep-Alive\nAccept: */*\nUser-Agent: Microsoft-CryptoAPI/6.1\nHost: c.pki.goog","sources":[{"report_type":"sandbox","report_id":"6a8a8c348a356097900e51ed"}]},{"host":"c.pki.goog","host_ip":"142.251.186.94:80","url":"/r/gsr1.crl","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /r/gsr1.crl HTTP/1.1\nConnection: Keep-Alive\nAccept: */*\nUser-Agent: Microsoft-CryptoAPI/6.1\nHost: c.pki.goog","sources":[{"report_type":"sandbox","report_id":"6a8a8c348a356097900e51ed"}]},{"host":"c.pki.goog","host_ip":"142.251.186.94:80","url":"/r/r4.crl","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /r/r4.crl HTTP/1.1\nConnection: Keep-Alive\nAccept: */*\nUser-Agent: Microsoft-CryptoAPI/6.1\nHost: c.pki.goog","sources":[{"report_type":"sandbox","report_id":"6a8a8c348a356097900e51ed"}]},{"host":"c.pki.goog","host_ip":"142.251.186.94:80","url":"/we2/yK5nPhtHKQs.crl","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /we2/yK5nPhtHKQs.crl HTTP/1.1\nConnection: Keep-Alive\nAccept: */*\nUser-Agent: Microsoft-CryptoAPI/6.1\nHost: c.pki.goog","sources":[{"report_type":"sandbox","report_id":"6a8a8c348a356097900e51ed"}]},{"host":"c.pki.goog","host_ip":"142.251.186.94:80","url":"/we2/Gt0Gl6QoGAU.crl","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /we2/Gt0Gl6QoGAU.crl HTTP/1.1\nConnection: Keep-Alive\nAccept: */*\nUser-Agent: Microsoft-CryptoAPI/6.1\nHost: c.pki.goog","sources":[{"report_type":"sandbox","report_id":"6a8a8c348a356097900e51ed"}]},{"host":"c.pki.goog","host_ip":"142.251.186.94:80","url":"/we2/xuzt3PU9F_w.crl","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /we2/xuzt3PU9F_w.crl HTTP/1.1\nConnection: Keep-Alive\nAccept: */*\nUser-Agent: Microsoft-CryptoAPI/6.1\nHost: c.pki.goog","sources":[{"report_type":"sandbox","report_id":"6a8a8c348a356097900e51ed"}]},{"host":"c.pki.goog","host_ip":"142.251.186.94:80","url":"/we2/dTM3-0hpWfE.crl","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /we2/dTM3-0hpWfE.crl HTTP/1.1\nConnection: Keep-Alive\nAccept: */*\nUser-Agent: Microsoft-CryptoAPI/6.1\nHost: c.pki.goog","sources":[{"report_type":"sandbox","report_id":"6a8a8c348a356097900e51ed"}]},{"host":"c.pki.goog","host_ip":"142.251.186.94:80","url":"/wr2/oBFYYahzgVI.crl","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /wr2/oBFYYahzgVI.crl HTTP/1.1\nConnection: Keep-Alive\nAccept: */*\nUser-Agent: Microsoft-CryptoAPI/6.1\nHost: c.pki.goog","sources":[{"report_type":"sandbox","report_id":"6a8a8c348a356097900e51ed"}]}]},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"6a8a8c348a356097900e51ed"}],"processes":[{"pid":2360,"ppid":0,"name":"3fa03f784ec205ddfffcf521bd6cdb53b46ad6ed6fd84ec4ecd85c545c8e2edf.exe","command_line":"","sha256":"3fa03f784ec205ddfffcf521bd6cdb53b46ad6ed6fd84ec4ecd85c545c8e2edf","normalized_path":"C:\\3fa03f784ec205ddfffcf521bd6cdb53b46ad6ed6fd84ec4ecd85c545c8e2edf.exe","uid":"00000000-00002360","icon":"$66"},{"pid":3856,"ppid":2360,"name":"FI3gq62.exe","command_line":"","sha256":"abed45fcf32b29e53a86caa1af2a3e4110a2a601365b5eb7f3b4860e5d1f134a","normalized_path":"%TEMP%\\IXP000.TMP\\FI3gq62.exe","parent_uid":"00000000-00002360","uid":"00000000-00003856"},{"pid":4180,"ppid":3856,"name":"db2FL06.exe","command_line":"","sha256":"386bc59396ea12ee20709565e4e2f8b51d6be38d84637668064882d78c1fb477","normalized_path":"%TEMP%\\IXP001.TMP\\db2FL06.exe","parent_uid":"00000000-00003856","uid":"00000000-00004180"},{"pid":772,"ppid":4180,"name":"Ta8tZ82.exe","command_line":"","sha256":"741f2c012c1489a7563d9f332eb8cfadd7673983d59006d09dec5a86a49ef5ca","normalized_path":"%TEMP%\\IXP002.TMP\\Ta8tZ82.exe","parent_uid":"00000000-00004180","uid":"00000000-00000772"},{"pid":4492,"ppid":772,"name":"1xy55nF7.exe","command_line":"","sha256":"b736077e8eccf72bc48e2a28576bb47d59bdaa335baa2dc333fb3701becfacaa","normalized_path":"%TEMP%\\IXP003.TMP\\1xy55nF7.exe","parent_uid":"00000000-00000772","uid":"00000000-00004492"},{"pid":3996,"ppid":4492,"name":"AppLaunch.exe","command_line":"","sha256":"cfa7d98ad44c7fb11de5ff07da04f8fd4a3423564de05f87ba5e10bd13a1fe59","normalized_path":"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\AppLaunch.exe","parent_uid":"00000000-00004492","uid":"00000000-00003996"},{"pid":1596,"ppid":772,"name":"2Ev9506.exe","command_line":"","sha256":"0923a6fb53240bd2c207fb8f4994d0424d7554cf1ad6991d76807eee8d2185e7","normalized_path":"%TEMP%\\IXP003.TMP\\2Ev9506.exe","parent_uid":"00000000-00000772","uid":"00000000-00001596"},{"pid":1428,"ppid":1596,"name":"AppLaunch.exe","command_line":"","sha256":"cfa7d98ad44c7fb11de5ff07da04f8fd4a3423564de05f87ba5e10bd13a1fe59","normalized_path":"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\AppLaunch.exe","parent_uid":"00000000-00001596","uid":"00000000-00001428"},{"pid":3804,"ppid":4180,"name":"3yf84jj.exe","command_line":"","sha256":"e4376ea14db956de0e3bf7fbb625dbe787f9f959b959f74efc27ae603b053f99","normalized_path":"%TEMP%\\IXP002.TMP\\3yf84jj.exe","parent_uid":"00000000-00004180","uid":"00000000-00003804"},{"pid":3808,"ppid":3804,"name":"AppLaunch.exe","command_line":"","sha256":"cfa7d98ad44c7fb11de5ff07da04f8fd4a3423564de05f87ba5e10bd13a1fe59","normalized_path":"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\AppLaunch.exe","parent_uid":"00000000-00003804","uid":"00000000-00003808"},{"pid":176,"ppid":3856,"name":"4xl958hh.exe","command_line":"","sha256":"7a32fc8a5ae6b56f78a2428df6502d88c69de9e54c26e4235f3a86814a55ae5b","normalized_path":"%TEMP%\\IXP001.TMP\\4xl958hh.exe","parent_uid":"00000000-00003856","uid":"00000000-00000176"},{"pid":4020,"ppid":176,"name":"AppLaunch.exe","command_line":"","sha256":"cfa7d98ad44c7fb11de5ff07da04f8fd4a3423564de05f87ba5e10bd13a1fe59","normalized_path":"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\AppLaunch.exe","parent_uid":"00000000-00000176","uid":"00000000-00004020"},{"pid":2056,"ppid":2360,"name":"5Ln7gt9.exe","command_line":"","sha256":"34d9c803544fe8b7d82027b68237413e6137b0479d068bbb392cb1dded25b37f","normalized_path":"%TEMP%\\IXP000.TMP\\5Ln7gt9.exe","parent_uid":"00000000-00002360","uid":"00000000-00002056"},{"pid":844,"ppid":2056,"name":"cmd.exe","command_line":"/c \"%TEMP%\\90BA.tmp\\90BB.tmp\\90BC.bat %TEMP%\\IXP000.TMP\\5Ln7gt9.exe\"","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","normalized_path":"%WINDIR%\\system32\\cmd.exe","parent_uid":"00000000-00002056","uid":"00000000-00000844"},{"pid":3376,"ppid":844,"name":"iexplore.exe","command_line":"https://www.facebook.com/login","sha256":"8abc7daa81c8a20bfd88b6a60ecc9ed1292fbb6cedbd6f872f36512d9a194bba","normalized_path":"%PROGRAMFILES%\\Internet Explorer\\iexplore.exe","parent_uid":"00000000-00000844","uid":"00000000-00003376"},{"pid":4592,"ppid":3376,"name":"iexplore.exe","command_line":"SCODEF:3376 CREDAT:275457 /prefetch:2","sha256":"8abc7daa81c8a20bfd88b6a60ecc9ed1292fbb6cedbd6f872f36512d9a194bba","normalized_path":"%PROGRAMFILES%\\Internet Explorer\\iexplore.exe","parent_uid":"00000000-00003376","uid":"00000000-00004592"},{"pid":3568,"ppid":844,"name":"iexplore.exe","command_line":"https://www.youtube.com/","sha256":"8abc7daa81c8a20bfd88b6a60ecc9ed1292fbb6cedbd6f872f36512d9a194bba","normalized_path":"%PROGRAMFILES%\\Internet Explorer\\iexplore.exe","parent_uid":"00000000-00000844","uid":"00000000-00003568"},{"pid":3460,"ppid":3568,"name":"iexplore.exe","command_line":"SCODEF:3568 CREDAT:275457 /prefetch:2","sha256":"8abc7daa81c8a20bfd88b6a60ecc9ed1292fbb6cedbd6f872f36512d9a194bba","normalized_path":"%PROGRAMFILES%\\Internet Explorer\\iexplore.exe","parent_uid":"00000000-00003568","uid":"00000000-00003460"},{"pid":3388,"ppid":844,"name":"iexplore.exe","command_line":"https://accounts.google.com/","sha256":"8abc7daa81c8a20bfd88b6a60ecc9ed1292fbb6cedbd6f872f36512d9a194bba","normalized_path":"%PROGRAMFILES%\\Internet Explorer\\iexplore.exe","parent_uid":"00000000-00000844","uid":"00000000-00003388"},{"pid":2992,"ppid":3388,"name":"iexplore.exe","command_line":"SCODEF:3388 CREDAT:275457 /prefetch:2","sha256":"8abc7daa81c8a20bfd88b6a60ecc9ed1292fbb6cedbd6f872f36512d9a194bba","normalized_path":"%PROGRAMFILES%\\Internet Explorer\\iexplore.exe","parent_uid":"00000000-00003388","uid":"00000000-00002992"}],"all_imported_dlls":["apphelp.dll","devobj.dll","api-ms-win-crt-utility-l1-1-0.dll","propsys.dll","dui70.dll","d3d10warp.dll","samcli.dll","cfgmgr32.dll","api-ms-win-crt-math-l1-1-0.dll","bcrypt.dll","rsaenh.dll","diasymreader.dll","winmm.dll","comctl32.dll","api-ms-win-core-synch-l1-2-0.dll","WindowsCodecs.dll","mscorwks.dll","d3d10level9.dll","msacm32.dll","setupapi.dll","mscoreei.dll","WindowsBase.ni.dll","System.Runtime.Serialization.ni.dll","msvcr100.dll","sfc_os.dll","api-ms-win-downlevel-user32-l1-1-0.dll","api-ms-win-crt-runtime-l1-1-0.dll","api-ms-win-crt-filesystem-l1-1-0.dll","psapi.dll","rasadhlp.dll","ExplorerFrame.dll","bcryptprimitives.dll","rpcrt4.dll","nsi.dll","System.Xml.ni.dll","PresentationFramework.ni.dll","WSHTCPIP.DLL","api-ms-win-downlevel-shlwapi-l2-1-0.dll","netutils.dll","dhcpcsvc.dll","ntdll.dll","lpk.dll","vm3dum.dll","vm3dum_loader.dll","shell32.dll","uxtheme.dll","api-ms-win-core-timezone-l1-1-0.dll","ieframe.dll","sqmapi.dll","winnsi.dll","vm3dum_10.dll","mpr.dll","ws2_32.dll","msvcp140_clr0400.dll","System.Transactions.dll","Wldap32.dll","schannel.dll","mshtml.dll","cabinet.dll","fltLib.dll","System.ServiceModel.Internals.dll","mlang.dll","dxgi.dll","api-ms-win-crt-environment-l1-1-0.dll","System.Drawing.ni.dll","winbrand.dll","RpcRtRemote.dll","ssv.dll","msvcr90.dll","msimtf.dll","kernel32.dll","advapi32.dll","oleaut32.dll","api-ms-win-downlevel-version-l1-1-0.dll","ucrtbase.dll","clr.dll","nlssorting.dll","feclient.dll","vcruntime140.dll","ucrtbase_clr0400.dll","cryptbase.dll","gpapi.dll","api-ms-win-core-processthreads-l1-1-1.dll","System.Transactions.ni.dll","npmproxy.dll","srvcli.dll","duser.dll","winhttp.dll","d2d1.dll","deploy.dll","PresentationCore.ni.dll","System.ServiceModel.dll","msimg32.dll","wintrust.dll","webio.dll","user32.dll","AcLayers.dll","userenv.dll","AcGenral.dll","msctf.dll","rpcss.dll","comdlg32.dll","netapi32.dll","KernelBase.dll","msvcrt.dll","usp10.dll","sspicli.dll","api-ms-win-downlevel-ole32-l1-1-0.dll","iertutil.dll","ieui.dll","credssp.dll","PresentationNative_v0400.dll","mswsock.dll","cryptnet.dll","MSOHEV.DLL","jscript9.dll","normaliz.dll","api-ms-win-core-file-l2-1-0.dll","api-ms-win-core-file-l1-2-0.dll","System.Core.ni.dll","SensApi.dll","jp2ssv.dll","api-ms-win-core-localization-l1-2-0.dll","vcruntime140_clr0400.dll","ncrypt.dll","sxs.dll","xmllite.dll","api-ms-win-crt-heap-l1-1-0.dll","api-ms-win-crt-stdio-l1-1-0.dll","System.IdentityModel.ni.dll","wship6.dll","wkscli.dll","ole32.dll","wininet.dll","clrjit.dll","dhcpcsvc6.dll","powrprof.dll","VxSSL32.dll","msvcp140.dll","api-ms-win-crt-string-l1-1-0.dll","SMDiagnostics.ni.dll","secur32.dll","wshqos.dll","oleaccrc.dll","d3d11.dll","sfc.dll","dwmapi.dll","urlmon.dll","api-ms-win-downlevel-normaliz-l1-1-0.dll","mscoree.dll","wpfgfx_v0400.dll","FWPUCLNT.DLL","imagehlp.dll","gdi32.dll","api-ms-win-downlevel-advapi32-l1-1-0.dll","imm32.dll","ieproxy.dll","netprofm.dll","IPHLPAPI.DLL","URLREDIR.DLL","api-ms-win-crt-convert-l1-1-0.dll","api-ms-win-crt-locale-l1-1-0.dll","clbcatq.dll","api-ms-win-downlevel-shell32-l1-1-0.dll","IEShims.dll","nlaapi.dll","profapi.dll","api-ms-win-crt-time-l1-1-0.dll","api-ms-win-core-xstate-l2-1-0.dll","System.ni.dll","System.Windows.Forms.dll","mscorlib.ni.dll","DWrite.dll","api-ms-win-downlevel-advapi32-l2-1-0.dll","crypt32.dll","shlwapi.dll","version.dll","api-ms-win-downlevel-shlwapi-l1-1-0.dll","System.Windows.Forms.ni.dll","System.Configuration.ni.dll","cryptsp.dll","ntmarta.dll","msasn1.dll","advpack.dll","dnsapi.dll","oleacc.dll","UIAutomationCore.dll","sechost.dll"]},"file_activity":{"dropped_files":[],"extracted_files":[{"name":"3yf84jj.exe","sha256":"e4376ea14db956de0e3bf7fbb625dbe787f9f959b959f74efc27ae603b053f99","verdict":"malicious","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a8a8c348a356097900e51ed"}]},{"name":"FI3gq62.exe","sha256":"abed45fcf32b29e53a86caa1af2a3e4110a2a601365b5eb7f3b4860e5d1f134a","verdict":"undetected","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a8a8c348a356097900e51ed"}]},{"name":"4xl958hh.exe","sha256":"7a32fc8a5ae6b56f78a2428df6502d88c69de9e54c26e4235f3a86814a55ae5b","verdict":"undetected","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a8a8c348a356097900e51ed"}]},{"name":"2Ev9506.exe","sha256":"0923a6fb53240bd2c207fb8f4994d0424d7554cf1ad6991d76807eee8d2185e7","verdict":"undetected","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a8a8c348a356097900e51ed"}]},{"name":"1xy55nF7.exe","sha256":"b736077e8eccf72bc48e2a28576bb47d59bdaa335baa2dc333fb3701becfacaa","verdict":"undetected","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a8a8c348a356097900e51ed"}]},{"name":"5Ln7gt9.exe","sha256":"34d9c803544fe8b7d82027b68237413e6137b0479d068bbb392cb1dded25b37f","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"6a8a8c348a356097900e51ed"}]},{"name":"db2FL06.exe","sha256":"386bc59396ea12ee20709565e4e2f8b51d6be38d84637668064882d78c1fb477","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"6a8a8c348a356097900e51ed"}]},{"name":"90BC.bat","sha256":"c3dea90ca98985007f0de66bf0197fdcd2d4a35e365135bf37a18a4895d81668","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a8a8c348a356097900e51ed"}]},{"name":"Ta8tZ82.exe","sha256":"741f2c012c1489a7563d9f332eb8cfadd7673983d59006d09dec5a86a49ef5ca","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a8a8c348a356097900e51ed"}]},{"name":"_maTRyRZ22Z8wmKvUcQXclxgo-3469oiGT9DWDYPz6DhfgQe914iiBfD-GevAmvU9KONMKn3YhINqU49pVNahkCkeiF2w9Hlit1_1_.css","sha256":"4a37843c7145f9ae878a6345a92ecb21b4fe206e212c8114c91c39034d2ea7ec","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a8a8c348a356097900e51ed"}]},{"name":"identifier_2_.htm","sha256":"da93632b4e1abf14d0dafae3c1df7eaa2c307199ab38ae4c80e1d2a89479a361","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a8a8c348a356097900e51ed"}]},{"name":"identifier_1_.htm","sha256":"c5d71f655ed6fd7a1383791d6ddb9b3d39cb28be17f74dd787c0ca4792b0dbe0","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a8a8c348a356097900e51ed"}]},{"name":"urlref_httpswww.facebook.comlogin","sha256":"abb2f23efcb2fed7a229ad9a2f3ac3309e2f65d032cf1ae3727a52f6c9b37124","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a8a8c348a356097900e51ed"}]},{"name":"login_1_.htm","sha256":"ff817e5215c53b5e2653c8c780c16e4207a8575e2b40f8a37cfd228085a7ee41","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a8a8c348a356097900e51ed"}]},{"name":"CYKV2ZF1.htm","sha256":"0b031e233629f38520781a0acedbb8b7b5979d0f6a4576d37e2079198f4d7e7d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a8a8c348a356097900e51ed"}]},{"name":"dinosaur_1_.png","sha256":"1a9251dc3b3c064cfc5e2b90b6c7dc3c225f7017066db2b77e49dae90a94a399","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a8a8c348a356097900e51ed"}]},{"name":"75A092F4522006A97542D6AC4F4E69D2","sha256":"893b7c343426774ab5a701f0d4a7817b4a02d0e7f78a4b45e7ba8a9a57ce44bb","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a8a8c348a356097900e51ed"}]},{"name":"imagestore.dat","sha256":"fed69e2c91153ac1dd188ec2da5e9ef2c7713c21c74bdc5704f681fe16d54487","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a8a8c348a356097900e51ed"}]},{"name":"9C69E496D546F49A980D7350EC49A180","sha256":"8ee56a1aa73203798befaa1b303a3e9800b00b9908f9ec8a2d76804a6975eba2","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a8a8c348a356097900e51ed"}]},{"name":"F93E23F30C5B44AE13F273C2767B494E","sha256":"eb52081ca63e7feac1c2a45585402d62b095e47f92d89bf9be08abba056d2dde","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a8a8c348a356097900e51ed"}]}],"files_written":[{"path":"%TEMP%\\IXP000.TMP\\TMP4351$.TMP","sources":[{"report_type":"sandbox","report_id":"6a8a8c348a356097900e51ed"}]},{"path":"%TEMP%\\IXP000.TMP\\FI3gq62.exe","sources":[{"report_type":"sandbox","report_id":"6a8a8c348a356097900e51ed"}]},{"path":"%TEMP%\\IXP000.TMP\\5Ln7gt9.exe","sources":[{"report_type":"sandbox","report_id":"6a8a8c348a356097900e51ed"}]},{"path":"%TEMP%\\IXP001.TMP\\TMP4351$.TMP","sources":[{"report_type":"sandbox","report_id":"6a8a8c348a356097900e51ed"}]},{"path":"%TEMP%\\IXP001.TMP\\db2FL06.exe","sources":[{"report_type":"sandbox","report_id":"6a8a8c348a356097900e51ed"}]},{"path":"%TEMP%\\IXP001.TMP\\4xl958hh.exe","sources":[{"report_type":"sandbox","report_id":"6a8a8c348a356097900e51ed"}]},{"path":"%TEMP%\\IXP002.TMP\\TMP4351$.TMP","sources":[{"report_type":"sandbox","report_id":"6a8a8c348a356097900e51ed"}]},{"path":"%TEMP%\\IXP002.TMP\\Ta8tZ82.exe","sources":[{"report_type":"sandbox","report_id":"6a8a8c348a356097900e51ed"}]},{"path":"%TEMP%\\IXP002.TMP\\3yf84jj.exe","sources":[{"report_type":"sandbox","report_id":"6a8a8c348a356097900e51ed"}]},{"path":"%TEMP%\\IXP003.TMP\\TMP4351$.TMP","sources":[{"report_type":"sandbox","report_id":"6a8a8c348a356097900e51ed"}]},{"path":"%TEMP%\\IXP003.TMP\\1xy55nF7.exe","sources":[{"report_type":"sandbox","report_id":"6a8a8c348a356097900e51ed"}]},{"path":"%TEMP%\\IXP003.TMP\\2Ev9506.exe","sources":[{"report_type":"sandbox","report_id":"6a8a8c348a356097900e51ed"}]},{"path":"%TEMP%\\90BA.tmp","sources":[{"report_type":"sandbox","report_id":"6a8a8c348a356097900e51ed"}]},{"path":"%TEMP%\\90BA.tmp\\90BB.tmp","sources":[{"report_type":"sandbox","report_id":"6a8a8c348a356097900e51ed"}]},{"path":"%TEMP%\\90BA.tmp\\90BB.tmp\\90BC.tmp","sources":[{"report_type":"sandbox","report_id":"6a8a8c348a356097900e51ed"}]},{"path":"%TEMP%\\90BA.tmp\\90BB.tmp\\90CD.tmp","sources":[{"report_type":"sandbox","report_id":"6a8a8c348a356097900e51ed"}]},{"path":"%TEMP%\\90BA.tmp\\90BB.tmp\\90BC.bat","sources":[{"report_type":"sandbox","report_id":"6a8a8c348a356097900e51ed"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches","sources":[{"report_type":"sandbox","report_id":"6a8a8c348a356097900e51ed"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\RUNONCE\\","sources":[{"report_type":"sandbox","report_id":"6a8a8c348a356097900e51ed"}]},{"key":"HKLMHKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\TIMEZONEINFORMATION\\","sources":[{"report_type":"sandbox","report_id":"6a8a8c348a356097900e51ed"}]}],"keys_modified":null,"keys_deleted":[{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\RUNONCE\\WEXTRACT_CLEANUP0\\WEXTRACT_CLEANUP0","sources":[{"report_type":"sandbox","report_id":"6a8a8c348a356097900e51ed"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\RUNONCE\\WEXTRACT_CLEANUP1\\WEXTRACT_CLEANUP1","sources":[{"report_type":"sandbox","report_id":"6a8a8c348a356097900e51ed"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\RUNONCE\\WEXTRACT_CLEANUP2\\WEXTRACT_CLEANUP2","sources":[{"report_type":"sandbox","report_id":"6a8a8c348a356097900e51ed"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\RUNONCE\\WEXTRACT_CLEANUP3\\WEXTRACT_CLEANUP3","sources":[{"report_type":"sandbox","report_id":"6a8a8c348a356097900e51ed"}]}]},"mutex_activity":{"mutex_created":[{"name":"\\Sessions\\1\\BaseNamedObjects\\Global\\CLR_PerfMon_WrapMutex","sources":[{"report_type":"sandbox","report_id":"6a8a8c348a356097900e51ed"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"6a8a8c348a356097900e51ed"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"6a8a8c348a356097900e51ed"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\UpdatingNewTabPageData","sources":[{"report_type":"sandbox","report_id":"6a8a8c348a356097900e51ed"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\!BrowserEmulation!SharedMemory!Mutex","sources":[{"report_type":"sandbox","report_id":"6a8a8c348a356097900e51ed"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\VERMGMTBlockListFileMutex","sources":[{"report_type":"sandbox","report_id":"6a8a8c348a356097900e51ed"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\URLBLOCK_FILEMAPSWITCH_MUTEX_3376","sources":[{"report_type":"sandbox","report_id":"6a8a8c348a356097900e51ed"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\URLBLOCK_HASHFILESWITCH_MUTEX","sources":[{"report_type":"sandbox","report_id":"6a8a8c348a356097900e51ed"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\URLBLOCK_DOWNLOAD_MUTEX","sources":[{"report_type":"sandbox","report_id":"6a8a8c348a356097900e51ed"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\IsoScope_d30_IE_EarlyTabStart_0x6f4_Mutex","sources":[{"report_type":"sandbox","report_id":"6a8a8c348a356097900e51ed"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\IsoScope_d30_ConnHashTable<3376>_HashTable_Mutex","sources":[{"report_type":"sandbox","report_id":"6a8a8c348a356097900e51ed"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\{5312EE61-79E3-4A24-BFE1-132B85B23C3A}","sources":[{"report_type":"sandbox","report_id":"6a8a8c348a356097900e51ed"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\IsoScope_d30_IESQMMUTEX_0_303","sources":[{"report_type":"sandbox","report_id":"6a8a8c348a356097900e51ed"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\IsoScope_d30_IESQMMUTEX_0_331","sources":[{"report_type":"sandbox","report_id":"6a8a8c348a356097900e51ed"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\{66D0969A-1E86-44CF-B4EC-3806DDDA3B5D}","sources":[{"report_type":"sandbox","report_id":"6a8a8c348a356097900e51ed"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\IsoScope_d30_IESQMMUTEX_0_519","sources":[{"report_type":"sandbox","report_id":"6a8a8c348a356097900e51ed"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\IsoScope_d30_IESQMMUTEX_0_274","sources":[{"report_type":"sandbox","report_id":"6a8a8c348a356097900e51ed"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\_!SHMSFTHISTORY!_","sources":[{"report_type":"sandbox","report_id":"6a8a8c348a356097900e51ed"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\URLBLOCK_FILEMAPSWITCH_MUTEX_3568","sources":[{"report_type":"sandbox","report_id":"6a8a8c348a356097900e51ed"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\IsoScope_df0_IE_EarlyTabStart_0x9e8_Mutex","sources":[{"report_type":"sandbox","report_id":"6a8a8c348a356097900e51ed"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\IsoScope_df0_ConnHashTable<3568>_HashTable_Mutex","sources":[{"report_type":"sandbox","report_id":"6a8a8c348a356097900e51ed"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\IsoScope_df0_IESQMMUTEX_0_303","sources":[{"report_type":"sandbox","report_id":"6a8a8c348a356097900e51ed"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\IsoScope_df0_IESQMMUTEX_0_331","sources":[{"report_type":"sandbox","report_id":"6a8a8c348a356097900e51ed"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\MSIMGSIZECacheMutex","sources":[{"report_type":"sandbox","report_id":"6a8a8c348a356097900e51ed"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\IsoScope_df0_IESQMMUTEX_0_519","sources":[{"report_type":"sandbox","report_id":"6a8a8c348a356097900e51ed"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\IsoScope_df0_IESQMMUTEX_0_274","sources":[{"report_type":"sandbox","report_id":"6a8a8c348a356097900e51ed"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\URLBLOCK_FILEMAPSWITCH_MUTEX_3388","sources":[{"report_type":"sandbox","report_id":"6a8a8c348a356097900e51ed"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\IsoScope_d3c_IE_EarlyTabStart_0xd40_Mutex","sources":[{"report_type":"sandbox","report_id":"6a8a8c348a356097900e51ed"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\IsoScope_d3c_ConnHashTable<3388>_HashTable_Mutex","sources":[{"report_type":"sandbox","report_id":"6a8a8c348a356097900e51ed"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\IsoScope_d3c_IESQMMUTEX_0_303","sources":[{"report_type":"sandbox","report_id":"6a8a8c348a356097900e51ed"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\IsoScope_d3c_IESQMMUTEX_0_331","sources":[{"report_type":"sandbox","report_id":"6a8a8c348a356097900e51ed"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\IsoScope_d3c_IESQMMUTEX_0_519","sources":[{"report_type":"sandbox","report_id":"6a8a8c348a356097900e51ed"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\IsoScope_d3c_IESQMMUTEX_0_274","sources":[{"report_type":"sandbox","report_id":"6a8a8c348a356097900e51ed"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\IsoScope_d3c_IESQMMUTEX_0_506","sources":[{"report_type":"sandbox","report_id":"6a8a8c348a356097900e51ed"}]}]}},"report_ids":{"sandbox_job_ids":["6a8a8c348a356097900e51ed"]}}}]]}] 20:null 24:[["$","title","0",{"children":"Malicious Crifi.Generic Sample 3fa03f784ec2… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample 3fa03f784ec2…. Malware family: Crifi.Generic. Threat score 100/100. 13/28 AV engines flagged this file. 11 malicious and 26 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/3fa03f784ec205ddfffcf521bd6cdb53b46ad6ed6fd84ec4ecd85c545c8e2edf"}],["$","meta","4",{"property":"og:title","content":"Malicious Crifi.Generic Sample 3fa03f784ec2… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample 3fa03f784ec2…. Malware family: Crifi.Generic. Threat score 100/100. 13/28 AV engines flagged this file. 11 malicious and 26 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/3fa03f784ec205ddfffcf521bd6cdb53b46ad6ed6fd84ec4ecd85c545c8e2edf"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Crifi.Generic Sample 3fa03f784ec2… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample 3fa03f784ec2…. Malware family: Crifi.Generic. Threat score 100/100. 13/28 AV engines flagged this file. 11 malicious and 26 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L67","11",{}]]