24:I[7638,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/136wug8odqdqr.js"],"SampleDetailWrapper"] 67:I[27201,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 23:T499,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Ser.Lazy.Generic Sample 46a870926fb6… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 46a870926fb6…. Malware family: Ser.Lazy.Generic. Threat score 100/100. 9/25 AV engines flagged this file. 19 malicious and 19 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/46a870926fb693596e4fea1ff6ed4bd228d8cc63a9e285997ded48b1484ab3f5","keywords":["Malicious","Ser.Lazy.Generic","malware analysis","sandbox report","threat intelligence","46a870926fb693596e4fea1ff6ed4bd228d8cc63a9e285997ded48b1484ab3f5"],"about":{"@type":"SoftwareApplication","name":"PO53623.exe","applicationCategory":["peexe","assembly","executable"],"identifier":"46a870926fb693596e4fea1ff6ed4bd228d8cc63a9e285997ded48b1484ab3f5","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Ser.Lazy.Generic","antivirusDetections":{"malicious":9,"total":25},"behavioralIndicators":{"malicious":19,"suspicious":19},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}25:T8e1,Found PE header "MZ" - Source: "00000000-00001384.00000001.66184.007E0000.00000004.mdmp") Found PE header "MZ" - Source: "00000000-00001384.00000001.66184.00870000.00000004.mdmp") Found PE header "MZ" - Source: "00000000-00001472.00000001.67059.00590000.00000004.mdmp") Found PE header "MZ" - Source: "00000000-00001472.00000001.67059.05180000.00000004.mdmp") Found PE header "MZ" - Source: "00000000-00003636.00000001.69283.0A5A0000.00000040.mdmp") Found PE header "MZ" - Source: "00000000-00003636.00000001.69283.0AC60000.00000004.mdmp") Found PE header "MZ" - Source: "00000000-00003636.00000001.69283.0AE20000.00000040.mdmp") Found PE header "MZ" - Source: "00000000-00003636.00000002.71203.0AC60000.00000004.mdmp") Found PE header "MZ" - Source: "00000000-00003636.00000002.71203.0AE20000.00000040.mdmp") Found PE header "MZ" - Source: "00000000-00003636.00000002.71203.10330000.00000040.mdmp") Found PE header "MZ" - Source: "00000000-00003636.00000002.71203.29D90000.00000040.mdmp") Found PE header "MZ" - Source: "00000000-00003636.00000002.71203.31900000.00000040.mdmp") Found PE header "MZ" - Source: "00000000-00003636.00000003.76263.00E40000.00000040.mdmp") Found PE header "MZ" - Source: "00000000-00003636.00000003.76263.04EF0000.00000040.mdmp") Found PE header "MZ" - Source: "00000000-00003636.00000003.76263.0A670000.00000040.mdmp") Found PE header "MZ" - Source: "00000000-00003636.00000003.76263.0AC60000.00000004.mdmp") Found PE header "MZ" - Source: "00000000-00003636.00000003.76263.10430000.00000002.mdmp") Found PE header "MZ" - Source: "00000000-00003636.00000003.76263.22240000.00000040.mdmp") Found PE header "MZ" - Source: "00000000-00003636.00000003.76263.2F020000.00000040.mdmp") Found PE header "MZ" - Source: "00000000-00003636.00000003.76263.36B50000.00000040.mdmp") Found PE header "MZ" - Source: "00000000-00003636.00000003.76263.3BDE0000.00000040.mdmp") Found PE header "MZ" - Source: "00000000-00003636.00000003.76263.46140000.00000040.mdmp") Found PE header "MZ" - Source: "00000000-00003636.00000003.76263.4DB70000.00000040.mdmp") Found PE header "MZ" - Source: "00000000-00003636.00000003.76263.52E20000.00000040.mdmp") Found PE header "MZ" - Source: "00000000-00003636.00000003.76263.55700000.00000040.mdmp")26:Tc98,Found string - function Xn(a){switch(a){case "true":return!0;case "false":return!1;case "null":return null;case "undefined":break;default:try{var b=a.match(/^(?:'(.*)'|"(.*)")$/);if(b)return b[1]||b[2]||"";if(/^[-+]?\d*(\.\d+)?$/.test(a)){var c=parseFloat(a);return c===c?c:void 0}}catch(d){}}};function Yn(a){if(a.google_ad_client)return String(a.google_ad_client);var b,c,d,e,f;if(null!=(e=null!=(d=null==(b=X(a).head_tag_slot_vars)?void 0:b.google_ad_client)?d:null==(c=a.document.querySelector(".adsbygoogle[data-ad-client]"))?void 0:c.getAttribute("data-ad-client")))b=e;else{b:{b=a.document.getElementsByTagName("script");a=a.navigator&&a.navigator.userAgent||"";a=RegExp("appbankapppuzdradb|daumapps|fban|fbios|fbav|fb_iab|gsa/|messengerforios|naver|niftyappmobile|nonavigation|pinterest|twitter|ucbrowser|yjnewsapp|youtube",; Source: "f_3_.txt"), Found string - e>>6&63,128|e&63))}b=new Uint8Array(c)}return b},Gh=/[0-9`~!@#$%^&*()_\-+=:;<>,.?|/\\[\]]/g,Jh=/^\S+@\S+\.\S+$/,Hh=/^\+\d{10,15}$/,Ch=/[.~]/g,Qh=/^[0-9A-Za-z_-]{43}$/,Oh=/^[0-9A-Fa-f]{64}$/,Rh={},Sh=(Rh.email="em",Rh.phone_number="pn",Rh.first_name="fn",Rh.last_name="ln",Rh.street="sa",Rh.city="ct",Rh.region="rg",Rh.country="co",Rh.postal_code="pc",Rh.error_code="ec",Rh),Th={},Uh=(Th.email="sha256_email_address",Th.phone_number="sha256_phone_number",Th.first_name="sha256_first_name",Th.last_name=; Source: "js_1_.js"), Found string - function uK(a){switch(a){case "true":return!0;case "false":return!1;case "null":return null;case "undefined":break;default:try{var b=a.match(/^(?:'(.*)'|"(.*)")$/);if(b)return b[1]||b[2]||"";if(/^[-+]?\d*(\.\d+)?$/.test(a)){var c=parseFloat(a);return c===c?c:void 0}}catch(d){}}};function vK(a){S.call(this);this.win=a;this.i=0;this.g=new u.Map}A(vK,S);function wK(a){a.win.document.visibilityState?xK(a,a.win.document,"visibilitychange",function(b){"hidden"===a.win.document.visibilityState&&yK(a,b);"visible"===a.win.document.visibilityState&&(a.i=0)}):"onpagehide"in a.win?(xK(a,a.win,"pagehide",function(b){yK(a,b)}) xK(a,a.win,"pageshow",function(){a.i=0})):xK(a,a.win,"beforeunload",function(b){yK(a,b)})}; Source: "f_2_.txt") Found string - "x"+bi.screen.height}Tc=Tc+Pe+(al||"");for($h=Tc.length;0ca.length;){Z=ca;ab=Z.push;Ca=X;var bb=new Xn;bb=Qj(bb,1,Ca.tagName);""!==Ca.className&&lj(bb,2,Ca.className.split(" ") ; Source: "f_2_.txt")27:T9f7,"powershell.exe" renamed original file"C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms" to "%APPDATA%\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms~RFfbf87.TMP" "powershell.exe" renamed original file"C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\3BE8EOGDG52GSP4U1A2M.temp" to "%APPDATA%\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms" "powershell.exe" renamed original file"C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms" to "%APPDATA%\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms~RFfdb51.TMP" "powershell.exe" renamed original file"C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\AA4C3E12YSM4DQOI38RG.temp" to "%APPDATA%\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms" "powershell.exe" renamed original file"C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms" to "%APPDATA%\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms~RFff41e.TMP" "powershell.exe" renamed original file"C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\G9MN6ACIZCS3MSM453C6.temp" to "%APPDATA%\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms" "powershell.exe" renamed original file"C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms" to "%APPDATA%\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms~RF100b07.TMP" "powershell.exe" renamed original file"C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\JG67KFSNSMUDX5M0WHCA.temp" to "%APPDATA%\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms" "iexplore.exe" renamed original file"C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\28c8b86deab549a1.customDestinations-ms" to "%APPDATA%\Microsoft\Windows\Recent\CustomDestinations\28c8b86deab549a1.customDestinations-ms~RF11c486.TMP" "iexplore.exe" renamed original file"C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\PG1TN8YB1B53P670GP0A.temp" to "%APPDATA%\Microsoft\Windows\Recent\CustomDestinations\28c8b86deab549a1.customDestinations-ms"28:T4c7,Found string "! " # $ % & ' ( ) * + , - . / 0 1 2 3 4 5 6 7 8 9 : ; < = > ? @ A B C D E F G H I J K L M N O P Q R S T U V W X Y Z [ \ ] ^ _ ` a b c d e f g h i j k l m n o p q r s t u v w x y z { | } ~" (Indicator: " ^ "; Source: "00000000-00001384.00000000.66074.042B0000.00000004.mdmp, 00000000-00001384.00000001.66184.042B0000.00000004.mdmp"), Found string "& ( 2 9 < > D ^ p t" (Indicator: " ^ "; Source: "00000000-00001384.00000000.66074.042B0000.00000004.mdmp, 00000000-00001384.00000001.66184.042B0000.00000004.mdmp"), Found string "[ \ ] ^ _ ` i" (Indicator: " ^ "; Source: "00000000-00001384.00000000.66074.05CA0000.00000004.mdmp, 00000000-00001384.00000001.66184.05CA0000.00000004.mdmp"), Found string "! " # $ % & ' ( ) * + - . / 0 1 2 3 4 5 6 7 8 9 : ; < = > ? @ A B C D E F G H I J K L M N O P Q R S T U V W X Y Z [ \ ] ^ _ ` a b c d e f g h i j k l m n o p q r s t u v w x y z { | } ~" (Indicator: " ^ "; Source: "00000000-00001472.00000000.66729.04330000.00000004.mdmp 00000000-00001472.00000001.67059.04330000.00000004.mdmp"), Found string "& ( 2 9 < > D ^ p t" (Indicator: " ^ "; Source: "00000000-00001472.00000000.66729.04330000.00000004.mdmp, 00000000-00001472.00000001.67059.04330000.00000004.mdmp")29:Te3ab,Contains base64 string in header "Keep" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAoFmyX1Sz2HlMxmMUd1OKM%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "User" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAoFmyX1Sz2HlMxmMUd1OKM%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "ocsp" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAoFmyX1Sz2HlMxmMUd1OKM%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "digicert" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAoFmyX1Sz2HlMxmMUd1OKM%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "2Bholo77zGjGxETUEQQU8JyF" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQlOydjtpho0%2Bholo77zGjGxETUEQQU8JyF%2FaKffY%2FJaLvV1IlNHb7TkP8CEAHqRFnqJyQkmYqUpX34D7k%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "Keep" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQlOydjtpho0%2Bholo77zGjGxETUEQQU8JyF%2FaKffY%2FJaLvV1IlNHb7TkP8CEAHqRFnqJyQkmYqUpX34D7k%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "User" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQlOydjtpho0%2Bholo77zGjGxETUEQQU8JyF%2FaKffY%2FJaLvV1IlNHb7TkP8CEAHqRFnqJyQkmYqUpX34D7k%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "ocsp" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQlOydjtpho0%2Bholo77zGjGxETUEQQU8JyF%2FaKffY%2FJaLvV1IlNHb7TkP8CEAHqRFnqJyQkmYqUpX34D7k%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "digicert" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQlOydjtpho0%2Bholo77zGjGxETUEQQU8JyF%2FaKffY%2FJaLvV1IlNHb7TkP8CEAHqRFnqJyQkmYqUpX34D7k%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "Keep" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "User" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "ocsp" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "digicert" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP" in header "GET /gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "2FUsCEHe9DWzbNvka6iEPxPBY0w0" in header "GET /gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "Keep" in header "GET /gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "User" in header "GET /gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "ocsp" in header "GET /gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "goog" in header "GET /gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "Keep" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAbY2QTVWENG9oovp1QifsQ%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "User" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAbY2QTVWENG9oovp1QifsQ%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "ocsp" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAbY2QTVWENG9oovp1QifsQ%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "digicert" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAbY2QTVWENG9oovp1QifsQ%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "//MEowSDBGMEQwQjAJBgUrDgMCGgUABBSLwZ6EW5gdYc9UaSEaaLjjETNtkAQUv1" in header "GET //MEowSDBGMEQwQjAJBgUrDgMCGgUABBSLwZ6EW5gdYc9UaSEaaLjjETNtkAQUv1%2B30c7dH4b0W1Ws3NcQwg6piOcCCQCnDkpMNIK3fw%3D%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: o.ss2.us" Contains base64 string in header "Keep" in header "GET //MEowSDBGMEQwQjAJBgUrDgMCGgUABBSLwZ6EW5gdYc9UaSEaaLjjETNtkAQUv1%2B30c7dH4b0W1Ws3NcQwg6piOcCCQCnDkpMNIK3fw%3D%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: o.ss2.us" Contains base64 string in header "User" in header "GET //MEowSDBGMEQwQjAJBgUrDgMCGgUABBSLwZ6EW5gdYc9UaSEaaLjjETNtkAQUv1%2B30c7dH4b0W1Ws3NcQwg6piOcCCQCnDkpMNIK3fw%3D%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: o.ss2.us" Contains base64 string in header "Keep" in header "GET /gtsr1/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBQwkcLWD4LqGJ7bE7B1XZsEbmfwUAQU5K8rJnEaK0gnhS9SZizv8IkTcT4CDQIDvFNZazTHGPUBUGY%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "User" in header "GET /gtsr1/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBQwkcLWD4LqGJ7bE7B1XZsEbmfwUAQU5K8rJnEaK0gnhS9SZizv8IkTcT4CDQIDvFNZazTHGPUBUGY%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "ocsp" in header "GET /gtsr1/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBQwkcLWD4LqGJ7bE7B1XZsEbmfwUAQU5K8rJnEaK0gnhS9SZizv8IkTcT4CDQIDvFNZazTHGPUBUGY%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "goog" in header "GET /gtsr1/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBQwkcLWD4LqGJ7bE7B1XZsEbmfwUAQU5K8rJnEaK0gnhS9SZizv8IkTcT4CDQIDvFNZazTHGPUBUGY%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "Keep" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAbY2QTVWENG9oovp1QifsQ%3D HTTP/1.1Cache-Control: max-age = 7200Connection: Keep-AliveAccept: */*If-Modified-Since: Wed, 20 Dec 2023 08:03:25 GMTUser-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "Modified" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAbY2QTVWENG9oovp1QifsQ%3D HTTP/1.1Cache-Control: max-age = 7200Connection: Keep-AliveAccept: */*If-Modified-Since: Wed, 20 Dec 2023 08:03:25 GMTUser-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "2023" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAbY2QTVWENG9oovp1QifsQ%3D HTTP/1.1Cache-Control: max-age = 7200Connection: Keep-AliveAccept: */*If-Modified-Since: Wed, 20 Dec 2023 08:03:25 GMTUser-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "ocsp" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAbY2QTVWENG9oovp1QifsQ%3D HTTP/1.1Cache-Control: max-age = 7200Connection: Keep-AliveAccept: */*If-Modified-Since: Wed, 20 Dec 2023 08:03:25 GMTUser-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "digicert" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAbY2QTVWENG9oovp1QifsQ%3D HTTP/1.1Cache-Control: max-age = 7200Connection: Keep-AliveAccept: */*If-Modified-Since: Wed, 20 Dec 2023 08:03:25 GMTUser-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "Keep" in header "GET /gts1c3/QqFxbi9M48c.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: crls.pki.goog" Contains base64 string in header "User" in header "GET /gts1c3/QqFxbi9M48c.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: crls.pki.goog" Contains base64 string in header "crls" in header "GET /gts1c3/QqFxbi9M48c.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: crls.pki.goog" Contains base64 string in header "goog" in header "GET /gts1c3/QqFxbi9M48c.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: crls.pki.goog" Contains base64 string in header "2BqGaCjIQPyd58u0" in header "GET /gts1c3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEGupzMnM%2BqGaCjIQPyd58u0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "Keep" in header "GET /gts1c3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEGupzMnM%2BqGaCjIQPyd58u0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "User" in header "GET /gts1c3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEGupzMnM%2BqGaCjIQPyd58u0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "ocsp" in header "GET /gts1c3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEGupzMnM%2BqGaCjIQPyd58u0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "goog" in header "GET /gts1c3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEGupzMnM%2BqGaCjIQPyd58u0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "/MFQwUjBQME4wTDAJBgUrDgMCGgUABBSIfaREXmfqfJR3TkMYnD7O5MhzEgQUnF8A36oB1zArOIiiuG1KnPIRkYMCEwZ" in header "GET /MFQwUjBQME4wTDAJBgUrDgMCGgUABBSIfaREXmfqfJR3TkMYnD7O5MhzEgQUnF8A36oB1zArOIiiuG1KnPIRkYMCEwZ%2FlEoqJ83z%2BsKuKwH5CO65xMY%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.rootg2.amazontrust.com" Contains base64 string in header "2BsKuKwH5CO65xMY" in header "GET /MFQwUjBQME4wTDAJBgUrDgMCGgUABBSIfaREXmfqfJR3TkMYnD7O5MhzEgQUnF8A36oB1zArOIiiuG1KnPIRkYMCEwZ%2FlEoqJ83z%2BsKuKwH5CO65xMY%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.rootg2.amazontrust.com" Contains base64 string in header "Keep" in header "GET /MFQwUjBQME4wTDAJBgUrDgMCGgUABBSIfaREXmfqfJR3TkMYnD7O5MhzEgQUnF8A36oB1zArOIiiuG1KnPIRkYMCEwZ%2FlEoqJ83z%2BsKuKwH5CO65xMY%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.rootg2.amazontrust.com" Contains base64 string in header "User" in header "GET /MFQwUjBQME4wTDAJBgUrDgMCGgUABBSIfaREXmfqfJR3TkMYnD7O5MhzEgQUnF8A36oB1zArOIiiuG1KnPIRkYMCEwZ%2FlEoqJ83z%2BsKuKwH5CO65xMY%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.rootg2.amazontrust.com" Contains base64 string in header "ocsp" in header "GET /MFQwUjBQME4wTDAJBgUrDgMCGgUABBSIfaREXmfqfJR3TkMYnD7O5MhzEgQUnF8A36oB1zArOIiiuG1KnPIRkYMCEwZ%2FlEoqJ83z%2BsKuKwH5CO65xMY%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.rootg2.amazontrust.com" Contains base64 string in header "Keep" in header "GET /rootg2.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: crl.rootg2.amazontrust.com" Contains base64 string in header "User" in header "GET /rootg2.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: crl.rootg2.amazontrust.com" Contains base64 string in header "Keep" in header "GET /gts1c3/moVDfISia2k.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: crls.pki.goog" Contains base64 string in header "User" in header "GET /gts1c3/moVDfISia2k.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: crls.pki.goog" Contains base64 string in header "crls" in header "GET /gts1c3/moVDfISia2k.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: crls.pki.goog" Contains base64 string in header "goog" in header "GET /gts1c3/moVDfISia2k.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: crls.pki.goog" Contains base64 string in header "/gtsr1/gtsr1" in header "GET /gtsr1/gtsr1.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: crl.pki.goog" Contains base64 string in header "Keep" in header "GET /gtsr1/gtsr1.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: crl.pki.goog" Contains base64 string in header "User" in header "GET /gtsr1/gtsr1.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: crl.pki.goog" Contains base64 string in header "goog" in header "GET /gtsr1/gtsr1.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: crl.pki.goog" Contains base64 string in header "2BHhJmodADfw" in header "GET /gts1c3/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEQCZXmpIP%2Bo%2BHhJmodADfw%2Fc HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "Keep" in header "GET /gts1c3/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEQCZXmpIP%2Bo%2BHhJmodADfw%2Fc HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "User" in header "GET /gts1c3/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEQCZXmpIP%2Bo%2BHhJmodADfw%2Fc HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "ocsp" in header "GET /gts1c3/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEQCZXmpIP%2Bo%2BHhJmodADfw%2Fc HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "goog" in header "GET /gts1c3/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEQCZXmpIP%2Bo%2BHhJmodADfw%2Fc HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "/rootca1" in header "GET /rootca1.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: crl.rootca1.amazontrust.com" Contains base64 string in header "Keep" in header "GET /rootca1.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: crl.rootca1.amazontrust.com" Contains base64 string in header "User" in header "GET /rootca1.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: crl.rootca1.amazontrust.com" Contains base64 string in header "2Fa9jFTaU9pkK3FAQUhBjMhTTsvAyUlC4IWZzHshBOCggCEwdzEjgLnWaIozse2b" in header "GET /MFQwUjBQME4wTDAJBgUrDgMCGgUABBRPWaOUU8%2B5VZ5%2Fa9jFTaU9pkK3FAQUhBjMhTTsvAyUlC4IWZzHshBOCggCEwdzEjgLnWaIozse2b%2BczaaODg8%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.rootca1.amazontrust.com" Contains base64 string in header "Keep" in header "GET /MFQwUjBQME4wTDAJBgUrDgMCGgUABBRPWaOUU8%2B5VZ5%2Fa9jFTaU9pkK3FAQUhBjMhTTsvAyUlC4IWZzHshBOCggCEwdzEjgLnWaIozse2b%2BczaaODg8%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.rootca1.amazontrust.com" Contains base64 string in header "User" in header "GET /MFQwUjBQME4wTDAJBgUrDgMCGgUABBRPWaOUU8%2B5VZ5%2Fa9jFTaU9pkK3FAQUhBjMhTTsvAyUlC4IWZzHshBOCggCEwdzEjgLnWaIozse2b%2BczaaODg8%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.rootca1.amazontrust.com" Contains base64 string in header "ocsp" in header "GET /MFQwUjBQME4wTDAJBgUrDgMCGgUABBRPWaOUU8%2B5VZ5%2Fa9jFTaU9pkK3FAQUhBjMhTTsvAyUlC4IWZzHshBOCggCEwdzEjgLnWaIozse2b%2BczaaODg8%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.rootca1.amazontrust.com" Contains base64 string in header "50dd7b0f" in header "GET /script?space=50dd7b0f-4105-441f-8f60-18cc3fcb090c&type=direct&page_id=1580123&screen_width=750&screen_height=346&os=Win32&refurl=&pageurl=file%3A%2F%2FC%3A%5CUsers%5CHAPUBWS%5CAppData%5CRoaming%5Cjyo.rquAu.html&rnd=1703066602178 HTTP/1.1Accept: application/javascript, */*;q=0.8Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: serving.bepolite.euDNT: 1Connection: Keep-Alive" Contains base64 string in header "4105" in header "GET /script?space=50dd7b0f-4105-441f-8f60-18cc3fcb090c&type=direct&page_id=1580123&screen_width=750&screen_height=346&os=Win32&refurl=&pageurl=file%3A%2F%2FC%3A%5CUsers%5CHAPUBWS%5CAppData%5CRoaming%5Cjyo.rquAu.html&rnd=1703066602178 HTTP/1.1Accept: application/javascript, */*;q=0.8Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: serving.bepolite.euDNT: 1Connection: Keep-Alive" Contains base64 string in header "441f" in header "GET /script?space=50dd7b0f-4105-441f-8f60-18cc3fcb090c&type=direct&page_id=1580123&screen_width=750&screen_height=346&os=Win32&refurl=&pageurl=file%3A%2F%2FC%3A%5CUsers%5CHAPUBWS%5CAppData%5CRoaming%5Cjyo.rquAu.html&rnd=1703066602178 HTTP/1.1Accept: application/javascript, */*;q=0.8Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: serving.bepolite.euDNT: 1Connection: Keep-Alive" Contains base64 string in header "8f60" in header "GET /script?space=50dd7b0f-4105-441f-8f60-18cc3fcb090c&type=direct&page_id=1580123&screen_width=750&screen_height=346&os=Win32&refurl=&pageurl=file%3A%2F%2FC%3A%5CUsers%5CHAPUBWS%5CAppData%5CRoaming%5Cjyo.rquAu.html&rnd=1703066602178 HTTP/1.1Accept: application/javascript, */*;q=0.8Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: serving.bepolite.euDNT: 1Connection: Keep-Alive" Contains base64 string in header "18cc3fcb090c" in header "GET /script?space=50dd7b0f-4105-441f-8f60-18cc3fcb090c&type=direct&page_id=1580123&screen_width=750&screen_height=346&os=Win32&refurl=&pageurl=file%3A%2F%2FC%3A%5CUsers%5CHAPUBWS%5CAppData%5CRoaming%5Cjyo.rquAu.html&rnd=1703066602178 HTTP/1.1Accept: application/javascript, */*;q=0.8Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: serving.bepolite.euDNT: 1Connection: Keep-Alive" Contains base64 string in header "page" in header "GET /script?space=50dd7b0f-4105-441f-8f60-18cc3fcb090c&type=direct&page_id=1580123&screen_width=750&screen_height=346&os=Win32&refurl=&pageurl=file%3A%2F%2FC%3A%5CUsers%5CHAPUBWS%5CAppData%5CRoaming%5Cjyo.rquAu.html&rnd=1703066602178 HTTP/1.1Accept: application/javascript, */*;q=0.8Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: serving.bepolite.euDNT: 1Connection: Keep-Alive" Contains base64 string in header "file" in header "GET /script?space=50dd7b0f-4105-441f-8f60-18cc3fcb090c&type=direct&page_id=1580123&screen_width=750&screen_height=346&os=Win32&refurl=&pageurl=file%3A%2F%2FC%3A%5CUsers%5CHAPUBWS%5CAppData%5CRoaming%5Cjyo.rquAu.html&rnd=1703066602178 HTTP/1.1Accept: application/javascript, */*;q=0.8Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: serving.bepolite.euDNT: 1Connection: Keep-Alive" Contains base64 string in header "html" in header "GET /script?space=50dd7b0f-4105-441f-8f60-18cc3fcb090c&type=direct&page_id=1580123&screen_width=750&screen_height=346&os=Win32&refurl=&pageurl=file%3A%2F%2FC%3A%5CUsers%5CHAPUBWS%5CAppData%5CRoaming%5Cjyo.rquAu.html&rnd=1703066602178 HTTP/1.1Accept: application/javascript, */*;q=0.8Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: serving.bepolite.euDNT: 1Connection: Keep-Alive" Contains base64 string in header "Language" in header "GET /script?space=50dd7b0f-4105-441f-8f60-18cc3fcb090c&type=direct&page_id=1580123&screen_width=750&screen_height=346&os=Win32&refurl=&pageurl=file%3A%2F%2FC%3A%5CUsers%5CHAPUBWS%5CAppData%5CRoaming%5Cjyo.rquAu.html&rnd=1703066602178 HTTP/1.1Accept: application/javascript, */*;q=0.8Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: serving.bepolite.euDNT: 1Connection: Keep-Alive" Contains base64 string in header "like" in header "GET /script?space=50dd7b0f-4105-441f-8f60-18cc3fcb090c&type=direct&page_id=1580123&screen_width=750&screen_height=346&os=Win32&refurl=&pageurl=file%3A%2F%2FC%3A%5CUsers%5CHAPUBWS%5CAppData%5CRoaming%5Cjyo.rquAu.html&rnd=1703066602178 HTTP/1.1Accept: application/javascript, */*;q=0.8Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: serving.bepolite.euDNT: 1Connection: Keep-Alive" Contains base64 string in header "Encoding" in header "GET /script?space=50dd7b0f-4105-441f-8f60-18cc3fcb090c&type=direct&page_id=1580123&screen_width=750&screen_height=346&os=Win32&refurl=&pageurl=file%3A%2F%2FC%3A%5CUsers%5CHAPUBWS%5CAppData%5CRoaming%5Cjyo.rquAu.html&rnd=1703066602178 HTTP/1.1Accept: application/javascript, */*;q=0.8Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: serving.bepolite.euDNT: 1Connection: Keep-Alive" Contains base64 string in header "gzip" in header "GET /script?space=50dd7b0f-4105-441f-8f60-18cc3fcb090c&type=direct&page_id=1580123&screen_width=750&screen_height=346&os=Win32&refurl=&pageurl=file%3A%2F%2FC%3A%5CUsers%5CHAPUBWS%5CAppData%5CRoaming%5Cjyo.rquAu.html&rnd=1703066602178 HTTP/1.1Accept: application/javascript, */*;q=0.8Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: serving.bepolite.euDNT: 1Connection: Keep-Alive" Contains base64 string in header "bepolite" in header "GET /script?space=50dd7b0f-4105-441f-8f60-18cc3fcb090c&type=direct&page_id=1580123&screen_width=750&screen_height=346&os=Win32&refurl=&pageurl=file%3A%2F%2FC%3A%5CUsers%5CHAPUBWS%5CAppData%5CRoaming%5Cjyo.rquAu.html&rnd=1703066602178 HTTP/1.1Accept: application/javascript, */*;q=0.8Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: serving.bepolite.euDNT: 1Connection: Keep-Alive" Contains base64 string in header "Keep" in header "GET /script?space=50dd7b0f-4105-441f-8f60-18cc3fcb090c&type=direct&page_id=1580123&screen_width=750&screen_height=346&os=Win32&refurl=&pageurl=file%3A%2F%2FC%3A%5CUsers%5CHAPUBWS%5CAppData%5CRoaming%5Cjyo.rquAu.html&rnd=1703066602178 HTTP/1.1Accept: application/javascript, */*;q=0.8Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: serving.bepolite.euDNT: 1Connection: Keep-Alive" Contains base64 string in header "50dd7b0f" in header "GET /script?space=50dd7b0f-4105-441f-8f60-18cc3fcb090c&type=direct&page_id=2640849&screen_width=750&screen_height=346&os=Win32&refurl=&pageurl=file%3A%2F%2FC%3A%5CUsers%5CHAPUBWS%5CAppData%5CRoaming%5CBJGIC..kG.html&rnd=1703067267588 HTTP/1.1Accept: application/javascript, */*;q=0.8Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: serving.bepolite.euDNT: 1Connection: Keep-Alive" Contains base64 string in header "4105" in header "GET /script?space=50dd7b0f-4105-441f-8f60-18cc3fcb090c&type=direct&page_id=2640849&screen_width=750&screen_height=346&os=Win32&refurl=&pageurl=file%3A%2F%2FC%3A%5CUsers%5CHAPUBWS%5CAppData%5CRoaming%5CBJGIC..kG.html&rnd=1703067267588 HTTP/1.1Accept: application/javascript, */*;q=0.8Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: serving.bepolite.euDNT: 1Connection: Keep-Alive" Contains base64 string in header "441f" in header "GET /script?space=50dd7b0f-4105-441f-8f60-18cc3fcb090c&type=direct&page_id=2640849&screen_width=750&screen_height=346&os=Win32&refurl=&pageurl=file%3A%2F%2FC%3A%5CUsers%5CHAPUBWS%5CAppData%5CRoaming%5CBJGIC..kG.html&rnd=1703067267588 HTTP/1.1Accept: application/javascript, */*;q=0.8Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: serving.bepolite.euDNT: 1Connection: Keep-Alive" Contains base64 string in header "8f60" in header "GET /script?space=50dd7b0f-4105-441f-8f60-18cc3fcb090c&type=direct&page_id=2640849&screen_width=750&screen_height=346&os=Win32&refurl=&pageurl=file%3A%2F%2FC%3A%5CUsers%5CHAPUBWS%5CAppData%5CRoaming%5CBJGIC..kG.html&rnd=1703067267588 HTTP/1.1Accept: application/javascript, */*;q=0.8Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: serving.bepolite.euDNT: 1Connection: Keep-Alive" Contains base64 string in header "18cc3fcb090c" in header "GET /script?space=50dd7b0f-4105-441f-8f60-18cc3fcb090c&type=direct&page_id=2640849&screen_width=750&screen_height=346&os=Win32&refurl=&pageurl=file%3A%2F%2FC%3A%5CUsers%5CHAPUBWS%5CAppData%5CRoaming%5CBJGIC..kG.html&rnd=1703067267588 HTTP/1.1Accept: application/javascript, */*;q=0.8Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: serving.bepolite.euDNT: 1Connection: Keep-Alive" Contains base64 string in header "page" in header "GET /script?space=50dd7b0f-4105-441f-8f60-18cc3fcb090c&type=direct&page_id=2640849&screen_width=750&screen_height=346&os=Win32&refurl=&pageurl=file%3A%2F%2FC%3A%5CUsers%5CHAPUBWS%5CAppData%5CRoaming%5CBJGIC..kG.html&rnd=1703067267588 HTTP/1.1Accept: application/javascript, */*;q=0.8Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: serving.bepolite.euDNT: 1Connection: Keep-Alive" Contains base64 string in header "file" in header "GET /script?space=50dd7b0f-4105-441f-8f60-18cc3fcb090c&type=direct&page_id=2640849&screen_width=750&screen_height=346&os=Win32&refurl=&pageurl=file%3A%2F%2FC%3A%5CUsers%5CHAPUBWS%5CAppData%5CRoaming%5CBJGIC..kG.html&rnd=1703067267588 HTTP/1.1Accept: application/javascript, */*;q=0.8Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: serving.bepolite.euDNT: 1Connection: Keep-Alive" Contains base64 string in header "html" in header "GET /script?space=50dd7b0f-4105-441f-8f60-18cc3fcb090c&type=direct&page_id=2640849&screen_width=750&screen_height=346&os=Win32&refurl=&pageurl=file%3A%2F%2FC%3A%5CUsers%5CHAPUBWS%5CAppData%5CRoaming%5CBJGIC..kG.html&rnd=1703067267588 HTTP/1.1Accept: application/javascript, */*;q=0.8Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: serving.bepolite.euDNT: 1Connection: Keep-Alive" Contains base64 string in header "Language" in header "GET /script?space=50dd7b0f-4105-441f-8f60-18cc3fcb090c&type=direct&page_id=2640849&screen_width=750&screen_height=346&os=Win32&refurl=&pageurl=file%3A%2F%2FC%3A%5CUsers%5CHAPUBWS%5CAppData%5CRoaming%5CBJGIC..kG.html&rnd=1703067267588 HTTP/1.1Accept: application/javascript, */*;q=0.8Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: serving.bepolite.euDNT: 1Connection: Keep-Alive" Contains base64 string in header "like" in header "GET /script?space=50dd7b0f-4105-441f-8f60-18cc3fcb090c&type=direct&page_id=2640849&screen_width=750&screen_height=346&os=Win32&refurl=&pageurl=file%3A%2F%2FC%3A%5CUsers%5CHAPUBWS%5CAppData%5CRoaming%5CBJGIC..kG.html&rnd=1703067267588 HTTP/1.1Accept: application/javascript, */*;q=0.8Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: serving.bepolite.euDNT: 1Connection: Keep-Alive" Contains base64 string in header "Encoding" in header "GET /script?space=50dd7b0f-4105-441f-8f60-18cc3fcb090c&type=direct&page_id=2640849&screen_width=750&screen_height=346&os=Win32&refurl=&pageurl=file%3A%2F%2FC%3A%5CUsers%5CHAPUBWS%5CAppData%5CRoaming%5CBJGIC..kG.html&rnd=1703067267588 HTTP/1.1Accept: application/javascript, */*;q=0.8Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: serving.bepolite.euDNT: 1Connection: Keep-Alive" Contains base64 string in header "gzip" in header "GET /script?space=50dd7b0f-4105-441f-8f60-18cc3fcb090c&type=direct&page_id=2640849&screen_width=750&screen_height=346&os=Win32&refurl=&pageurl=file%3A%2F%2FC%3A%5CUsers%5CHAPUBWS%5CAppData%5CRoaming%5CBJGIC..kG.html&rnd=1703067267588 HTTP/1.1Accept: application/javascript, */*;q=0.8Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: serving.bepolite.euDNT: 1Connection: Keep-Alive" Contains base64 string in header "bepolite" in header "GET /script?space=50dd7b0f-4105-441f-8f60-18cc3fcb090c&type=direct&page_id=2640849&screen_width=750&screen_height=346&os=Win32&refurl=&pageurl=file%3A%2F%2FC%3A%5CUsers%5CHAPUBWS%5CAppData%5CRoaming%5CBJGIC..kG.html&rnd=1703067267588 HTTP/1.1Accept: application/javascript, */*;q=0.8Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: serving.bepolite.euDNT: 1Connection: Keep-Alive" Contains base64 string in header "Keep" in header "GET /script?space=50dd7b0f-4105-441f-8f60-18cc3fcb090c&type=direct&page_id=2640849&screen_width=750&screen_height=346&os=Win32&refurl=&pageurl=file%3A%2F%2FC%3A%5CUsers%5CHAPUBWS%5CAppData%5CRoaming%5CBJGIC..kG.html&rnd=1703067267588 HTTP/1.1Accept: application/javascript, */*;q=0.8Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: serving.bepolite.euDNT: 1Connection: Keep-Alive" Contains base64 string in header "Keep" in header "GET /gts1c3/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEQDHvwlxZ6tgTQmj1PR%2BmThA HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "User" in header "GET /gts1c3/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEQDHvwlxZ6tgTQmj1PR%2BmThA HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "ocsp" in header "GET /gts1c3/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEQDHvwlxZ6tgTQmj1PR%2BmThA HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "goog" in header "GET /gts1c3/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEQDHvwlxZ6tgTQmj1PR%2BmThA HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "Keep" in header "GET /gts1c3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEDEixfO34qnbCeE6N8VMp00%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "User" in header "GET /gts1c3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEDEixfO34qnbCeE6N8VMp00%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "ocsp" in header "GET /gts1c3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEDEixfO34qnbCeE6N8VMp00%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "goog" in header "GET /gts1c3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEDEixfO34qnbCeE6N8VMp00%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "50dd7b0f" in header "GET /script?space=50dd7b0f-4105-441f-8f60-18cc3fcb090c&type=direct&page_id=1439366&screen_width=750&screen_height=346&os=Win32&refurl=&pageurl=file%3A%2F%2FC%3A%5CUsers%5CHAPUBWS%5CAppData%5CRoaming%5CvHImy.oGI.html&rnd=1703068954450 HTTP/1.1Accept: application/javascript, */*;q=0.8Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: serving.bepolite.euDNT: 1Connection: Keep-Alive" Contains base64 string in header "4105" in header "GET /script?space=50dd7b0f-4105-441f-8f60-18cc3fcb090c&type=direct&page_id=1439366&screen_width=750&screen_height=346&os=Win32&refurl=&pageurl=file%3A%2F%2FC%3A%5CUsers%5CHAPUBWS%5CAppData%5CRoaming%5CvHImy.oGI.html&rnd=1703068954450 HTTP/1.1Accept: application/javascript, */*;q=0.8Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: serving.bepolite.euDNT: 1Connection: Keep-Alive" Contains base64 string in header "441f" in header "GET /script?space=50dd7b0f-4105-441f-8f60-18cc3fcb090c&type=direct&page_id=1439366&screen_width=750&screen_height=346&os=Win32&refurl=&pageurl=file%3A%2F%2FC%3A%5CUsers%5CHAPUBWS%5CAppData%5CRoaming%5CvHImy.oGI.html&rnd=1703068954450 HTTP/1.1Accept: application/javascript, */*;q=0.8Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: serving.bepolite.euDNT: 1Connection: Keep-Alive" Contains base64 string in header "8f60" in header "GET /script?space=50dd7b0f-4105-441f-8f60-18cc3fcb090c&type=direct&page_id=1439366&screen_width=750&screen_height=346&os=Win32&refurl=&pageurl=file%3A%2F%2FC%3A%5CUsers%5CHAPUBWS%5CAppData%5CRoaming%5CvHImy.oGI.html&rnd=1703068954450 HTTP/1.1Accept: application/javascript, */*;q=0.8Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: serving.bepolite.euDNT: 1Connection: Keep-Alive" Contains base64 string in header "18cc3fcb090c" in header "GET /script?space=50dd7b0f-4105-441f-8f60-18cc3fcb090c&type=direct&page_id=1439366&screen_width=750&screen_height=346&os=Win32&refurl=&pageurl=file%3A%2F%2FC%3A%5CUsers%5CHAPUBWS%5CAppData%5CRoaming%5CvHImy.oGI.html&rnd=1703068954450 HTTP/1.1Accept: application/javascript, */*;q=0.8Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: serving.bepolite.euDNT: 1Connection: Keep-Alive" Contains base64 string in header "page" in header "GET /script?space=50dd7b0f-4105-441f-8f60-18cc3fcb090c&type=direct&page_id=1439366&screen_width=750&screen_height=346&os=Win32&refurl=&pageurl=file%3A%2F%2FC%3A%5CUsers%5CHAPUBWS%5CAppData%5CRoaming%5CvHImy.oGI.html&rnd=1703068954450 HTTP/1.1Accept: application/javascript, */*;q=0.8Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: serving.bepolite.euDNT: 1Connection: Keep-Alive" Contains base64 string in header "file" in header "GET /script?space=50dd7b0f-4105-441f-8f60-18cc3fcb090c&type=direct&page_id=1439366&screen_width=750&screen_height=346&os=Win32&refurl=&pageurl=file%3A%2F%2FC%3A%5CUsers%5CHAPUBWS%5CAppData%5CRoaming%5CvHImy.oGI.html&rnd=1703068954450 HTTP/1.1Accept: application/javascript, */*;q=0.8Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: serving.bepolite.euDNT: 1Connection: Keep-Alive" Contains base64 string in header "html" in header "GET /script?space=50dd7b0f-4105-441f-8f60-18cc3fcb090c&type=direct&page_id=1439366&screen_width=750&screen_height=346&os=Win32&refurl=&pageurl=file%3A%2F%2FC%3A%5CUsers%5CHAPUBWS%5CAppData%5CRoaming%5CvHImy.oGI.html&rnd=1703068954450 HTTP/1.1Accept: application/javascript, */*;q=0.8Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: serving.bepolite.euDNT: 1Connection: Keep-Alive" Contains base64 string in header "Language" in header "GET /script?space=50dd7b0f-4105-441f-8f60-18cc3fcb090c&type=direct&page_id=1439366&screen_width=750&screen_height=346&os=Win32&refurl=&pageurl=file%3A%2F%2FC%3A%5CUsers%5CHAPUBWS%5CAppData%5CRoaming%5CvHImy.oGI.html&rnd=1703068954450 HTTP/1.1Accept: application/javascript, */*;q=0.8Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: serving.bepolite.euDNT: 1Connection: Keep-Alive" Contains base64 string in header "like" in header "GET /script?space=50dd7b0f-4105-441f-8f60-18cc3fcb090c&type=direct&page_id=1439366&screen_width=750&screen_height=346&os=Win32&refurl=&pageurl=file%3A%2F%2FC%3A%5CUsers%5CHAPUBWS%5CAppData%5CRoaming%5CvHImy.oGI.html&rnd=1703068954450 HTTP/1.1Accept: application/javascript, */*;q=0.8Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: serving.bepolite.euDNT: 1Connection: Keep-Alive" Contains base64 string in header "Encoding" in header "GET /script?space=50dd7b0f-4105-441f-8f60-18cc3fcb090c&type=direct&page_id=1439366&screen_width=750&screen_height=346&os=Win32&refurl=&pageurl=file%3A%2F%2FC%3A%5CUsers%5CHAPUBWS%5CAppData%5CRoaming%5CvHImy.oGI.html&rnd=1703068954450 HTTP/1.1Accept: application/javascript, */*;q=0.8Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: serving.bepolite.euDNT: 1Connection: Keep-Alive" Contains base64 string in header "gzip" in header "GET /script?space=50dd7b0f-4105-441f-8f60-18cc3fcb090c&type=direct&page_id=1439366&screen_width=750&screen_height=346&os=Win32&refurl=&pageurl=file%3A%2F%2FC%3A%5CUsers%5CHAPUBWS%5CAppData%5CRoaming%5CvHImy.oGI.html&rnd=1703068954450 HTTP/1.1Accept: application/javascript, */*;q=0.8Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: serving.bepolite.euDNT: 1Connection: Keep-Alive" Contains base64 string in header "bepolite" in header "GET /script?space=50dd7b0f-4105-441f-8f60-18cc3fcb090c&type=direct&page_id=1439366&screen_width=750&screen_height=346&os=Win32&refurl=&pageurl=file%3A%2F%2FC%3A%5CUsers%5CHAPUBWS%5CAppData%5CRoaming%5CvHImy.oGI.html&rnd=1703068954450 HTTP/1.1Accept: application/javascript, */*;q=0.8Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: serving.bepolite.euDNT: 1Connection: Keep-Alive" Contains base64 string in header "Keep" in header "GET /script?space=50dd7b0f-4105-441f-8f60-18cc3fcb090c&type=direct&page_id=1439366&screen_width=750&screen_height=346&os=Win32&refurl=&pageurl=file%3A%2F%2FC%3A%5CUsers%5CHAPUBWS%5CAppData%5CRoaming%5CvHImy.oGI.html&rnd=1703068954450 HTTP/1.1Accept: application/javascript, */*;q=0.8Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: serving.bepolite.euDNT: 1Connection: Keep-Alive" Contains base64 string in header "50dd7b0f" in header "GET /script?space=50dd7b0f-4105-441f-8f60-18cc3fcb090c&type=direct&page_id=2535744&screen_width=750&screen_height=346&os=Win32&refurl=&pageurl=file%3A%2F%2FC%3A%5CUsers%5CHAPUBWS%5CAppData%5CRoaming%5Ck.hufeesg.html&rnd=1703070950363 HTTP/1.1Accept: application/javascript, */*;q=0.8Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: serving.bepolite.euDNT: 1Connection: Keep-Alive" Contains base64 string in header "4105" in header "GET /script?space=50dd7b0f-4105-441f-8f60-18cc3fcb090c&type=direct&page_id=2535744&screen_width=750&screen_height=346&os=Win32&refurl=&pageurl=file%3A%2F%2FC%3A%5CUsers%5CHAPUBWS%5CAppData%5CRoaming%5Ck.hufeesg.html&rnd=1703070950363 HTTP/1.1Accept: application/javascript, */*;q=0.8Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: serving.bepolite.euDNT: 1Connection: Keep-Alive" Contains base64 string in header "441f" in header "GET /script?space=50dd7b0f-4105-441f-8f60-18cc3fcb090c&type=direct&page_id=2535744&screen_width=750&screen_height=346&os=Win32&refurl=&pageurl=file%3A%2F%2FC%3A%5CUsers%5CHAPUBWS%5CAppData%5CRoaming%5Ck.hufeesg.html&rnd=1703070950363 HTTP/1.1Accept: application/javascript, */*;q=0.8Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: serving.bepolite.euDNT: 1Connection: Keep-Alive" Contains base64 string in header "8f60" in header "GET /script?space=50dd7b0f-4105-441f-8f60-18cc3fcb090c&type=direct&page_id=2535744&screen_width=750&screen_height=346&os=Win32&refurl=&pageurl=file%3A%2F%2FC%3A%5CUsers%5CHAPUBWS%5CAppData%5CRoaming%5Ck.hufeesg.html&rnd=1703070950363 HTTP/1.1Accept: application/javascript, */*;q=0.8Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: serving.bepolite.euDNT: 1Connection: Keep-Alive" Contains base64 string in header "18cc3fcb090c" in header "GET /script?space=50dd7b0f-4105-441f-8f60-18cc3fcb090c&type=direct&page_id=2535744&screen_width=750&screen_height=346&os=Win32&refurl=&pageurl=file%3A%2F%2FC%3A%5CUsers%5CHAPUBWS%5CAppData%5CRoaming%5Ck.hufeesg.html&rnd=1703070950363 HTTP/1.1Accept: application/javascript, */*;q=0.8Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: serving.bepolite.euDNT: 1Connection: Keep-Alive" Contains base64 string in header "page" in header "GET /script?space=50dd7b0f-4105-441f-8f60-18cc3fcb090c&type=direct&page_id=2535744&screen_width=750&screen_height=346&os=Win32&refurl=&pageurl=file%3A%2F%2FC%3A%5CUsers%5CHAPUBWS%5CAppData%5CRoaming%5Ck.hufeesg.html&rnd=1703070950363 HTTP/1.1Accept: application/javascript, */*;q=0.8Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: serving.bepolite.euDNT: 1Connection: Keep-Alive" Contains base64 string in header "file" in header "GET /script?space=50dd7b0f-4105-441f-8f60-18cc3fcb090c&type=direct&page_id=2535744&screen_width=750&screen_height=346&os=Win32&refurl=&pageurl=file%3A%2F%2FC%3A%5CUsers%5CHAPUBWS%5CAppData%5CRoaming%5Ck.hufeesg.html&rnd=1703070950363 HTTP/1.1Accept: application/javascript, */*;q=0.8Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: serving.bepolite.euDNT: 1Connection: Keep-Alive" Contains base64 string in header "html" in header "GET /script?space=50dd7b0f-4105-441f-8f60-18cc3fcb090c&type=direct&page_id=2535744&screen_width=750&screen_height=346&os=Win32&refurl=&pageurl=file%3A%2F%2FC%3A%5CUsers%5CHAPUBWS%5CAppData%5CRoaming%5Ck.hufeesg.html&rnd=1703070950363 HTTP/1.1Accept: application/javascript, */*;q=0.8Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: serving.bepolite.euDNT: 1Connection: Keep-Alive" Contains base64 string in header "Language" in header "GET /script?space=50dd7b0f-4105-441f-8f60-18cc3fcb090c&type=direct&page_id=2535744&screen_width=750&screen_height=346&os=Win32&refurl=&pageurl=file%3A%2F%2FC%3A%5CUsers%5CHAPUBWS%5CAppData%5CRoaming%5Ck.hufeesg.html&rnd=1703070950363 HTTP/1.1Accept: application/javascript, */*;q=0.8Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: serving.bepolite.euDNT: 1Connection: Keep-Alive" Contains base64 string in header "like" in header "GET /script?space=50dd7b0f-4105-441f-8f60-18cc3fcb090c&type=direct&page_id=2535744&screen_width=750&screen_height=346&os=Win32&refurl=&pageurl=file%3A%2F%2FC%3A%5CUsers%5CHAPUBWS%5CAppData%5CRoaming%5Ck.hufeesg.html&rnd=1703070950363 HTTP/1.1Accept: application/javascript, */*;q=0.8Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: serving.bepolite.euDNT: 1Connection: Keep-Alive" Contains base64 string in header "Encoding" in header "GET /script?space=50dd7b0f-4105-441f-8f60-18cc3fcb090c&type=direct&page_id=2535744&screen_width=750&screen_height=346&os=Win32&refurl=&pageurl=file%3A%2F%2FC%3A%5CUsers%5CHAPUBWS%5CAppData%5CRoaming%5Ck.hufeesg.html&rnd=1703070950363 HTTP/1.1Accept: application/javascript, */*;q=0.8Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: serving.bepolite.euDNT: 1Connection: Keep-Alive" Contains base64 string in header "gzip" in header "GET /script?space=50dd7b0f-4105-441f-8f60-18cc3fcb090c&type=direct&page_id=2535744&screen_width=750&screen_height=346&os=Win32&refurl=&pageurl=file%3A%2F%2FC%3A%5CUsers%5CHAPUBWS%5CAppData%5CRoaming%5Ck.hufeesg.html&rnd=1703070950363 HTTP/1.1Accept: application/javascript, */*;q=0.8Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: serving.bepolite.euDNT: 1Connection: Keep-Alive" Contains base64 string in header "bepolite" in header "GET /script?space=50dd7b0f-4105-441f-8f60-18cc3fcb090c&type=direct&page_id=2535744&screen_width=750&screen_height=346&os=Win32&refurl=&pageurl=file%3A%2F%2FC%3A%5CUsers%5CHAPUBWS%5CAppData%5CRoaming%5Ck.hufeesg.html&rnd=1703070950363 HTTP/1.1Accept: application/javascript, */*;q=0.8Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: serving.bepolite.euDNT: 1Connection: Keep-Alive" Contains base64 string in header "Keep" in header "GET /script?space=50dd7b0f-4105-441f-8f60-18cc3fcb090c&type=direct&page_id=2535744&screen_width=750&screen_height=346&os=Win32&refurl=&pageurl=file%3A%2F%2FC%3A%5CUsers%5CHAPUBWS%5CAppData%5CRoaming%5Ck.hufeesg.html&rnd=1703070950363 HTTP/1.1Accept: application/javascript, */*;q=0.8Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: serving.bepolite.euDNT: 1Connection: Keep-Alive" Contains base64 string in header "50dd7b0f" in header "GET /script?space=50dd7b0f-4105-441f-8f60-18cc3fcb090c&type=direct&page_id=1105210&screen_width=750&screen_height=346&os=Win32&refurl=&pageurl=file%3A%2F%2FC%3A%5CUsers%5CHAPUBWS%5CAppData%5CRoaming%5CxIDknlGKD.html&rnd=1703072395399 HTTP/1.1Accept: application/javascript, */*;q=0.8Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: serving.bepolite.euDNT: 1Connection: Keep-Alive" Contains base64 string in header "4105" in header "GET /script?space=50dd7b0f-4105-441f-8f60-18cc3fcb090c&type=direct&page_id=1105210&screen_width=750&screen_height=346&os=Win32&refurl=&pageurl=file%3A%2F%2FC%3A%5CUsers%5CHAPUBWS%5CAppData%5CRoaming%5CxIDknlGKD.html&rnd=1703072395399 HTTP/1.1Accept: application/javascript, */*;q=0.8Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: serving.bepolite.euDNT: 1Connection: Keep-Alive" Contains base64 string in header "441f" in header "GET /script?space=50dd7b0f-4105-441f-8f60-18cc3fcb090c&type=direct&page_id=1105210&screen_width=750&screen_height=346&os=Win32&refurl=&pageurl=file%3A%2F%2FC%3A%5CUsers%5CHAPUBWS%5CAppData%5CRoaming%5CxIDknlGKD.html&rnd=1703072395399 HTTP/1.1Accept: application/javascript, */*;q=0.8Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: serving.bepolite.euDNT: 1Connection: Keep-Alive" Contains base64 string in header "8f60" in header "GET /script?space=50dd7b0f-4105-441f-8f60-18cc3fcb090c&type=direct&page_id=1105210&screen_width=750&screen_height=346&os=Win32&refurl=&pageurl=file%3A%2F%2FC%3A%5CUsers%5CHAPUBWS%5CAppData%5CRoaming%5CxIDknlGKD.html&rnd=1703072395399 HTTP/1.1Accept: application/javascript, */*;q=0.8Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: serving.bepolite.euDNT: 1Connection: Keep-Alive" Contains base64 string in header "18cc3fcb090c" in header "GET /script?space=50dd7b0f-4105-441f-8f60-18cc3fcb090c&type=direct&page_id=1105210&screen_width=750&screen_height=346&os=Win32&refurl=&pageurl=file%3A%2F%2FC%3A%5CUsers%5CHAPUBWS%5CAppData%5CRoaming%5CxIDknlGKD.html&rnd=1703072395399 HTTP/1.1Accept: application/javascript, */*;q=0.8Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: serving.bepolite.euDNT: 1Connection: Keep-Alive" Contains base64 string in header "page" in header "GET /script?space=50dd7b0f-4105-441f-8f60-18cc3fcb090c&type=direct&page_id=1105210&screen_width=750&screen_height=346&os=Win32&refurl=&pageurl=file%3A%2F%2FC%3A%5CUsers%5CHAPUBWS%5CAppData%5CRoaming%5CxIDknlGKD.html&rnd=1703072395399 HTTP/1.1Accept: application/javascript, */*;q=0.8Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: serving.bepolite.euDNT: 1Connection: Keep-Alive" Contains base64 string in header "file" in header "GET /script?space=50dd7b0f-4105-441f-8f60-18cc3fcb090c&type=direct&page_id=1105210&screen_width=750&screen_height=346&os=Win32&refurl=&pageurl=file%3A%2F%2FC%3A%5CUsers%5CHAPUBWS%5CAppData%5CRoaming%5CxIDknlGKD.html&rnd=1703072395399 HTTP/1.1Accept: application/javascript, */*;q=0.8Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: serving.bepolite.euDNT: 1Connection: Keep-Alive" Contains base64 string in header "html" in header "GET /script?space=50dd7b0f-4105-441f-8f60-18cc3fcb090c&type=direct&page_id=1105210&screen_width=750&screen_height=346&os=Win32&refurl=&pageurl=file%3A%2F%2FC%3A%5CUsers%5CHAPUBWS%5CAppData%5CRoaming%5CxIDknlGKD.html&rnd=1703072395399 HTTP/1.1Accept: application/javascript, */*;q=0.8Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: serving.bepolite.euDNT: 1Connection: Keep-Alive" Contains base64 string in header "Language" in header "GET /script?space=50dd7b0f-4105-441f-8f60-18cc3fcb090c&type=direct&page_id=1105210&screen_width=750&screen_height=346&os=Win32&refurl=&pageurl=file%3A%2F%2FC%3A%5CUsers%5CHAPUBWS%5CAppData%5CRoaming%5CxIDknlGKD.html&rnd=1703072395399 HTTP/1.1Accept: application/javascript, */*;q=0.8Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: serving.bepolite.euDNT: 1Connection: Keep-Alive" Contains base64 string in header "like" in header "GET /script?space=50dd7b0f-4105-441f-8f60-18cc3fcb090c&type=direct&page_id=1105210&screen_width=750&screen_height=346&os=Win32&refurl=&pageurl=file%3A%2F%2FC%3A%5CUsers%5CHAPUBWS%5CAppData%5CRoaming%5CxIDknlGKD.html&rnd=1703072395399 HTTP/1.1Accept: application/javascript, */*;q=0.8Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: serving.bepolite.euDNT: 1Connection: Keep-Alive" Contains base64 string in header "Encoding" in header "GET /script?space=50dd7b0f-4105-441f-8f60-18cc3fcb090c&type=direct&page_id=1105210&screen_width=750&screen_height=346&os=Win32&refurl=&pageurl=file%3A%2F%2FC%3A%5CUsers%5CHAPUBWS%5CAppData%5CRoaming%5CxIDknlGKD.html&rnd=1703072395399 HTTP/1.1Accept: application/javascript, */*;q=0.8Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: serving.bepolite.euDNT: 1Connection: Keep-Alive" Contains base64 string in header "gzip" in header "GET /script?space=50dd7b0f-4105-441f-8f60-18cc3fcb090c&type=direct&page_id=1105210&screen_width=750&screen_height=346&os=Win32&refurl=&pageurl=file%3A%2F%2FC%3A%5CUsers%5CHAPUBWS%5CAppData%5CRoaming%5CxIDknlGKD.html&rnd=1703072395399 HTTP/1.1Accept: application/javascript, */*;q=0.8Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: serving.bepolite.euDNT: 1Connection: Keep-Alive" Contains base64 string in header "bepolite" in header "GET /script?space=50dd7b0f-4105-441f-8f60-18cc3fcb090c&type=direct&page_id=1105210&screen_width=750&screen_height=346&os=Win32&refurl=&pageurl=file%3A%2F%2FC%3A%5CUsers%5CHAPUBWS%5CAppData%5CRoaming%5CxIDknlGKD.html&rnd=1703072395399 HTTP/1.1Accept: application/javascript, */*;q=0.8Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: serving.bepolite.euDNT: 1Connection: Keep-Alive" Contains base64 string in header "Keep" in header "GET /script?space=50dd7b0f-4105-441f-8f60-18cc3fcb090c&type=direct&page_id=1105210&screen_width=750&screen_height=346&os=Win32&refurl=&pageurl=file%3A%2F%2FC%3A%5CUsers%5CHAPUBWS%5CAppData%5CRoaming%5CxIDknlGKD.html&rnd=1703072395399 HTTP/1.1Accept: application/javascript, */*;q=0.8Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: serving.bepolite.euDNT: 1Connection: Keep-Alive" Contains base64 string in header "Keep" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTk45WiKdPUwcMf8JgMC07ACYqr2AQUt2ui6qiqhIx56rTaD5iyxZV2ufQCEATiBJD97V%2Bh8cNnTUFY7lA%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "User" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTk45WiKdPUwcMf8JgMC07ACYqr2AQUt2ui6qiqhIx56rTaD5iyxZV2ufQCEATiBJD97V%2Bh8cNnTUFY7lA%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "ocsp" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTk45WiKdPUwcMf8JgMC07ACYqr2AQUt2ui6qiqhIx56rTaD5iyxZV2ufQCEATiBJD97V%2Bh8cNnTUFY7lA%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "digicert" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTk45WiKdPUwcMf8JgMC07ACYqr2AQUt2ui6qiqhIx56rTaD5iyxZV2ufQCEATiBJD97V%2Bh8cNnTUFY7lA%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com"2a:T45b,The analysis contains indicators for cyrpto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Contains CRYPTO related strings Matched sigs: Contains ability to use Cryptographic classes Matched sigs: Decrypted SSL network traffic Matched sigs: Found XOR operators (encryption/decryption) Matched sigs: Calls an API typically used to encrypt data Matched sigs: Contains ability to decrypt/decode data Matched sigs: Calls an API typically used to decrypt data Matched sigs: Contains ability to perform Base64 encoding/decoding Matched sigs: Reads the cryptographic machine GUID Matched sigs: Calls an API typically to import asymmetric cryptographic keys into a CSP Matched sigs: Calls an API typically used to decrypt a block of data Matched sigs: Calls an API typically to import cryptographic keys into a CSP Matched sigs: Dropped file has high entropy (likely encrypted/compressed content) Matched sigs: Calls an API typically used to encrypt a block of data Matched sigs: HTTP requests contain Base64 strings Matched sigs: HTTP request contains Base64 encoded artifacts2b:Tec8,"PO53623.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00001384) "PO53623.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b00200031000000380000000000740138000000000001000000140000005001380015000000680e3c0000000000150000001800010114000000432a196d48f71d0095e19c77c7340700000000000200000290a53b0030360006680e3c00010000000000000080000000600e3c0030360006680e3c000100000000000000020000000c00000070ee3a0070ee3a006bee3a0000000000f4f61d0000003800680e3c0138f61d0000f71d0058fc1d0095e19c77e7340700feffffff435ca0775059a07794000000a00000006aee3a0068ee3a0094000000dcf71d00fdfeb577ec0b000084f71d0088f71d00 (UID: 00000000-00001384) "PO53623.exe" called "RtlGetVersion" with parameter 140100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00001384) "PO53623.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b002000310000000000fcec1d0000000000060000000000057228ed1d00020000402cef1d002cef1d001a12a2770000000014ed1d000000000000c23a000203a277000200008801a2770000000070ef1d00a401a2770000000000000000000000015500530045005200330032002e0064006c006c00000000000000000000009b7700009b7700000000daed1d00d0009b77fcec1d00d8ed1d0024ee1d0095e19c77272e0700fefffffff5f6a07716f8a077e01c3800daed1d00d0ed1d00d0ed1d000100000034ee1d009ef8a077626fa07764f8a077fbc8ba777412057294ee1d000000000000009b77 (UID: 00000000-00001384) "PO53623.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000a0000000c00000090056804900568048b056804000000000c0000000000680400000001d4e01d00f0e11d0030e31d0095e19c77e7340700feffffff435ca0775059a07734020000020000003878410098ab4100c06738003200020066006d0017050000170000007300740065006d00a0ab4100e504000016000000886c3800050000001c5c9f7732a89a75ffffffff2500000010e21d003000000000000000d4e21d00b0e21d00c6242e01000000000000100000100000020000000000040000000000020140854c0101060100000000560d000000000054e21d002da99a75 (UID: 00000000-00001384) "PO53623.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b00200031000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000200000077eb2d3ba8e21d00a8e21d0050b22f7497b22f740432763b0000000008e41d0001000000010000000000000078e21d000000000094e31d00eed42574dc89594ffeffffff97b22f742bb32f74000000000010000000000100fffffe7f03000000040000004a020000000001000600004f940000000600000001000000b11d00000200000053657276696365205061636b2031007f02000000000000008c47337450784100 (UID: 00000000-00001384)2c:T1d59,"PO53623.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b20310000610000004257530077696e6469723d433a5c57696e646f77730077696e646f77735f74726163696e675f666c6167733d330077696e646f77735f74726163696e675f6c6f6766696c653d433a5c42565442696e5c54657374735c696e04000004ccfa000010a93a00d8a73a006c6f6766 (UID: 00000000-00001384) "PO53623.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b20310000f5f6a07703c8ba77f42e0c7200c23a00a0350c7253c8ba77f4ee1d0040a43a00b2f4a07763c8ba7704ef1d0000000572000005720000000060ee1d00f0000000f00005720000000070ee1d005300000004f01d000000000001000000d4ee1d0040f5a0770000000000000000c0ee1d00 (UID: 00000000-00001384) "PO53623.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b2031007f02000000000000008c473374507841008c473374000000005078410054e31d00086da0771881a8770000000008e41d0000000000de54276594e31d0095e19c770f370700feffffff6b2ca17731199b7502100000000000000000010068e31d00c89fa0778c4733740000000000000000 (UID: 00000000-00001384) "PO53623.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b2031000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00001384) "PO53623.exe" called "GetVersionExA" with parameter 9c0000000600000001000000b11d00000200000053657276696365205061636b2031000000000000000000000200000000000000d8eb0b76f87f410000e0fd7f9a5ca17700f0fd7f08e01d0044e0fd7f00000000400000003f0000001e00000000e0fd7ffcdf1d00c15ca1776082a8771e00000000e0fd7f9a5ca17700f0fd7f20e01d005789a0778083a87713179b75d8eb0b76 (UID: 00000000-00001384) "PO53623.exe" called "GetVersionExA" with parameter 9c0000000600000001000000b11d00000200000053657276696365205061636b2031000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00001384) "powershell.exe" called "GetVersionExA" with parameter 9c0000000600000001000000b11d00000200000053657276696365205061636b2031000000000000000000000200000000000000d8eb0b7660e2310000f0fd7f9a5ca17700e0fd7f00bd110044f0fd7f00000000400000003f0000001d00000000f0fd7ff4bc1100c15ca1776082a8771d00000000f0fd7f9a5ca17700e0fd7f18bd11005789a0778083a87713179b75d8eb0b76 (UID: 00000000-00002724) "powershell.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b2031000072006f0073006f00660074002e004e00450054005c004600720061006d00650077006f0072006b005c00760032002e0030002e00350030003700320037005c006d00730063006f00720077006b0073002e0064006c006c002e0032002e004d0061006e00690066006500730074000000 (UID: 00000000-00002724) "powershell.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b20310000636da16b00004901000000006c6da16b480a8ac9d8d74b61a4ec1100a0ec110000000000000000000000000000000000d8d74b61f8eb11000000000068ec1100a4ec110038ec1100ff23a16bc83baa6b78ec11003117a16b080000001c5c9f7714a1a077ffffffff2400000060ec1100 (UID: 00000000-00002724) "powershell.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b2031000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00002724) "PO53623.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b2031000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00003392) "PO53623.exe" called "GetVersionExA" with parameter 9c0000000600000001000000b11d00000200000053657276696365205061636b2031000000000000000000000200000000000000d8eb0b76c88372000030fd7f9a5ca17700f0fd7f18e52f004430fd7f00000000400000003f0000001c0000000030fd7f0ce52f00c15ca1776082a8771c0000000030fd7f9a5ca17700f0fd7f30e52f005789a0778083a87713179b75d8eb0b76 (UID: 00000000-00003392) "PO53623.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b2031000095e19c7797360700fefffffff5f6a077634da177c86b70008ef14c73bce44c00b2f4a07773ca887764f42f0000004c7300004c73804da17757ca8877e0000000e0004c7300000000d0f32f005c124c7364f52f00000000000100000034f42f0040f5a077000000000000000020f42f00 (UID: 00000000-00003392) "powershell.exe" called "GetVersionExA" with parameter 9c0000000600000001000000b11d00000200000053657276696365205061636b2031000000000000000000000200000000000000d8eb0b76600c30000060fd7f9a5ca17700f0fd7f10bd0c004460fd7f00000000400000003f0000001e0000000060fd7f04bd0c00c15ca1776082a8771e0000000060fd7f9a5ca17700f0fd7f28bd0c005789a0778083a87713179b75d8eb0b76 (UID: 00000000-00003364) "powershell.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b2031000072006f0073006f00660074002e004e00450054005c004600720061006d00650077006f0072006b005c00760032002e0030002e00350030003700320037005c006d00730063006f00720077006b0073002e0064006c006c002e0032002e004d0061006e00690066006500730074000000 (UID: 00000000-00003364) "powershell.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b20310000636d4c6a0000f001000000006c6d4c6a74d2bfcbd8d72961b4ec0c00b0ec0c0000000000000000000000000000000000d8d7296108ec0c000000000078ec0c00b4ec0c0048ec0c00ff234c6ac83b556a88ec0c0031174c6a080000001c5c9f7714a1a077ffffffff2400000070ec0c00 (UID: 00000000-00003364) "powershell.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b2031000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00003364) "Bins.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b203100342c2c4973576f77363450726f636573732c6b65726e656c33322e646c6c2c223235323a30323a35302e393233222c52583d302c50583d300030006c69634b6579546f6b656e3d623033663566376631316435306133612220616c6c6f77446566696e6974696f6e3d224d616368696e65 (UID: 00000000-00001472) "Bins.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b20310000f5f6a07735a9bc77f42e0c7230913a00a0350c7205a9bc7724e81b00b06c3a00b2f4a07715a9bc7734e81b0000000572000005720000000090e71b00f0000000f000057200000000a0e71b005300000034e91b00000000000100000004e81b0040f5a0770000000000000000f0e71b00 (UID: 00000000-00001472) "Bins.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b2031007f02000000000000008c473374880e42008c47337400000000880e420084dc1b00086da0771881a8770000000038dd1b0000000000de54ac64c4dc1b0095e19c77095f0700feffffff6b2ca17731199b7502100000000000000000010098dc1b00c89fa0778c4733740000000000000000 (UID: 00000000-00001472)2d:T6db,Found string "SELECT * FROM CHUCVU WHERE MaCV = '" (Indicator: "select * from "; File: "PO53623.exe") Found string "SELECT * FROM PHONGBAN" (Indicator: "select * from "; File: "PO53623.exe") Found string "SELECT * FROM CHUCVU" (Indicator: "select * from "; File: "PO53623.exe") Found string "SELECT * FROM VITRICONGVIEC" (Indicator: "select * from "; File: "PO53623.exe") Found string "SELECT * FROM NHANVIEN where BangCap = ''" (Indicator: "select * from "; File: "PO53623.exe") Found string "SELECT * FROM NHANVIEN where BangCap=N'" (Indicator: "select * from "; File: "PO53623.exe") Found string "SELECT * FROM NHANVIEN where DiaChi=N'" (Indicator: "select * from "; File: "PO53623.exe") Found string "SELECT CASE WHEN EXISTS(SELECT * FROM PHONGBAN WHERE MaPB = '" (Indicator: "select * from "; File: "PO53623.exe") Found string "') THEN 1 WHEN NOT EXISTS(SELECT * FROM PHONGBAN WHERE MaPB = '" (Indicator: "select * from "; File: "PO53623.exe") Found string "SELECT * FROM dbo.VITRICONGVIEC" (Indicator: "select * from "; File: "PO53623.exe") Found string "ELECT CASE WHEN EXISTS(SELECT * FROM PHONGBAN WHERE MaPB = '" (Indicator: "select * from "; Source: "00000000-00001384.00000001.66184.01212000.00000020.mdmp") Found string ") THEN 1 WHEN NOT EXISTS(SELECT * FROM PHONGBAN WHERE MaPB = '" (Indicator: "select * from "; Source: "00000000-00001384.00000001.66184.01212000.00000020.mdmp") Found string "ELECT CASE WHEN EXISTS(SELECT * FROM PHONGBAN WHERE MaPB = '" (Indicator: "select * from "; Source: "00000000-00001472.00000000.66729.00F42000.00000020.mdmp") Found string ") THEN 1 WHEN NOT EXISTS(SELECT * FROM PHONGBAN WHERE MaPB = '" (Indicator: "select * from "; Source: "00000000-00001472.00000000.66729.00F42000.00000020.mdmp")2e:T718,"Bins.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{07B41F79-1AEC-4782-A6E8-8C28FFBA35ED}"; Key: "ENABLEDHCP"; Value: "") "Bins.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{07B41F79-1AEC-4782-A6E8-8C28FFBA35ED}"; Key: "REGISTRATIONENABLED"; Value: "") "Bins.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{07B41F79-1AEC-4782-A6E8-8C28FFBA35ED}"; Key: "REGISTERADAPTERNAME"; Value: "") "Bins.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{07B41F79-1AEC-4782-A6E8-8C28FFBA35ED}"; Key: "DOMAIN"; Value: "") "Bins.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{07B41F79-1AEC-4782-A6E8-8C28FFBA35ED}"; Key: "DHCPDOMAIN"; Value: "") "Bins.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E29AC6C2-7037-11DE-816D-806E6F6E6963}"; Key: "ENABLEDHCP"; Value: "") "Bins.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E29AC6C2-7037-11DE-816D-806E6F6E6963}"; Key: "REGISTRATIONENABLED"; Value: "") "Bins.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E29AC6C2-7037-11DE-816D-806E6F6E6963}"; Key: "REGISTERADAPTERNAME"; Value: "") "Bins.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E29AC6C2-7037-11DE-816D-806E6F6E6963}"; Key: "DOMAIN"; Value: "") "Bins.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E29AC6C2-7037-11DE-816D-806E6F6E6963}"; Key: "DHCPDOMAIN"; Value: "")2f:T5c8,"PO53623.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APP PATHS\SCHTASKS.EXE") "PO53623.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APP PATHS\SCHTASKS.EXE") "PO53623.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APP PATHS\POWERSHELL.EXE") "PO53623.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APP PATHS\POWERSHELL.EXE") "PO53623.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APP PATHS\POWERSHELL.EXE"; Key: "APPENDPATH") "PO53623.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APP PATHS\POWERSHELL.EXE"; Key: "PATH") "PO53623.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APP PATHS\PO53623.EXE") "PO53623.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APP PATHS\PO53623.EXE") "Bins.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APP PATHS\SCHTASKS.EXE") "Bins.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APP PATHS\SCHTASKS.EXE") "Bins.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APP PATHS\POWERSHELL.EXE") "Bins.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APP PATHS\POWERSHELL.EXE") "Bins.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APP PATHS\POWERSHELL.EXE"; Key: "APPENDPATH") "Bins.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APP PATHS\POWERSHELL.EXE"; Key: "PATH") "Bins.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APP PATHS\IEXPLORE.EXE")30:T59d,"powershell.exe" trying to touch file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations" "powershell.exe" trying to touch file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms" "powershell.exe" trying to touch file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\3BE8EOGDG52GSP4U1A2M.TEMP" "powershell.exe" trying to touch file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\3BE8EOGDG52GSP4U1A2M.temp" "powershell.exe" trying to touch file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms" "powershell.exe" trying to touch file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms~RFfbf87.TMP" "powershell.exe" trying to touch file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\AA4C3E12YSM4DQOI38RG.TEMP" "powershell.exe" trying to touch file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\AA4C3E12YSM4DQOI38RG.temp" "powershell.exe" trying to touch file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms~RFfdb51.TMP"31:T96d,"Bins.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "Bins.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "Bins.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS"; Key: "") "Bins.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS"; Key: "") "Bins.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "Bins.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "Bins.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS"; Key: "") "Bins.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS"; Key: "") "Bins.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED"; Key: "") "Bins.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES"; Key: "") "Bins.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS"; Key: "") "Bins.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS"; Key: "") "Bins.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED"; Key: "") "Bins.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES"; Key: "") "Bins.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS"; Key: "") "Bins.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS"; Key: "") "Bins.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT"; Key: "") "Bins.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES"; Key: "") "Bins.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CRLS"; Key: "") "Bins.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CTLS"; Key: "") "Bins.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE"; Key: "") "Bins.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE\CERTIFICATES"; Key: "") "Bins.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE\CRLS"; Key: "") "Bins.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE\CTLS"; Key: "") "Bins.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE"; Key: "")32:T4df,"Bins.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\AUTOUPDATE"; Key: "DISALLOWEDCERTSYNCDELTATIME") "Bins.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\CERTIFICATES\02FAF3E291435468607857694DF5E45B68851868"; Key: "BLOB") "Bins.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\CERTIFICATES\039EEDB80BE7A03C6953893B20D2D9323A4C2AFD"; Key: "BLOB") "Bins.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\CERTIFICATES\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43"; Key: "BLOB") "Bins.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\CERTIFICATES\07E032E020B72C3F192F0628A2593A19A70F069E"; Key: "BLOB") "Bins.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\CERTIFICATES\2796BAE63F1801E277261BA0D77770028F20EEE4"; Key: "BLOB") "Bins.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\CERTIFICATES\323C118E1BF7B8B65254E2E2100DD6029037F096"; Key: "BLOB") "Bins.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\CERTIFICATES\3679CA35668772304D30A5FB873B0FA77BB70D54"; Key: "BLOB") "Bins.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\CERTIFICATES\3E2BF7F2031B96F38CE6C4D8A85D3E2D58476A0F"; Key: "BLOB")33:T9d9,"PO53623.exe" called "CreateDirectoryW" with parameter C:\Users\%OSUSER% (UID: 00000000-00001384) "PO53623.exe" called "CreateDirectoryW" with parameter %USERPROFILE%\AppData\Roaming (UID: 00000000-00001384) "PO53623.exe" called "CreateDirectoryW" with parameter %LOCALAPPDATA%\Microsoft\Windows\Caches (UID: 00000000-00001384) "powershell.exe" called "CreateDirectoryW" with parameter %LOCALAPPDATA%\Microsoft\Windows\Caches (UID: 00000000-00002724) "powershell.exe" called "CreateDirectoryW" with parameter %APPDATA%\Microsoft\Windows\Recent\CustomDestinations (UID: 00000000-00002724) "powershell.exe" called "CreateDirectoryW" with parameter C:\Users\%OSUSER% (UID: 00000000-00002724) "powershell.exe" called "CreateDirectoryW" with parameter %USERPROFILE%\AppData\Roaming (UID: 00000000-00002724) "PO53623.exe" called "CreateDirectoryW" with parameter %PROGRAMFILES%\Microsoft DN1 (UID: 00000000-00003392) "PO53623.exe" called "CreateDirectoryW" with parameter %LOCALAPPDATA%\Microsoft Vision\ (UID: 00000000-00003392) "PO53623.exe" called "CreateDirectoryW" with parameter %USERPROFILE%\Documents (UID: 00000000-00003392) "powershell.exe" called "CreateDirectoryW" with parameter %LOCALAPPDATA%\Microsoft\Windows\Caches (UID: 00000000-00003364) "powershell.exe" called "CreateDirectoryW" with parameter %APPDATA%\Microsoft\Windows\Recent\CustomDestinations (UID: 00000000-00003364) "powershell.exe" called "CreateDirectoryW" with parameter C:\Users\%OSUSER% (UID: 00000000-00003364) "powershell.exe" called "CreateDirectoryW" with parameter %USERPROFILE%\AppData\Roaming (UID: 00000000-00003364) "Bins.exe" called "CreateDirectoryW" with parameter C:\Users\%OSUSER% (UID: 00000000-00001472) "Bins.exe" called "CreateDirectoryW" with parameter %USERPROFILE%\AppData\Roaming (UID: 00000000-00001472) "Bins.exe" called "CreateDirectoryW" with parameter %LOCALAPPDATA%\Microsoft\Windows\Caches (UID: 00000000-00001472) "powershell.exe" called "CreateDirectoryW" with parameter %LOCALAPPDATA%\Microsoft\Windows\Caches (UID: 00000000-00001808) "powershell.exe" called "CreateDirectoryW" with parameter %APPDATA%\Microsoft\Windows\Recent\CustomDestinations (UID: 00000000-00001808) "powershell.exe" called "CreateDirectoryW" with parameter C:\Users\%OSUSER% (UID: 00000000-00001808) "powershell.exe" called "CreateDirectoryW" with parameter %USERPROFILE%\AppData\Roaming (UID: 00000000-00001808) "Bins.exe" called "CreateDirectoryW" with parameter %PROGRAMFILES%\Microsoft DN1 (UID: 00000000-00003636)34:T619,"PO53623.exe" called "CreateProcessW" with parameter ""%WINDIR%\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "%APPDATA%\jKWU" - (UID: 00000000-00001384), "PO53623.exe" called "CreateProcessW" with parameter ""%WINDIR%\System32\schtasks.exe" /Create /TN "Updates\jKWUyswkzQirl" /XML "%TEMP%\tmpB818.tmp"" - (UID: 00000000-00001384), "PO53623.exe" called "CreateProcessA" with parameter "C:\PO53623.exe" - (UID: 00000000-00001384), "PO53623.exe" called "CreateProcessA" with parameter "powershell Add-MpPreference -ExclusionPath C:\" - (UID: 00000000-00003392), "PO53623.exe" called "CreateProcessW" with parameter "%USERPROFILE%\Documents\Bins.exe" - (UID: 00000000-00003392), "Bins.exe" called "CreateProcessW" with parameter ""%WINDIR%\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "%APPDATA%\jKWU" - (UID: 00000000-00001472) "Bins.exe" called "CreateProcessW" with parameter ""%WINDIR%\System32\schtasks.exe" /Create /TN "Updates\jKWUyswkzQirl" /XML "%TEMP%\tmpEB38.tmp"" - (UID: 00000000-00001472) "Bins.exe" called "CreateProcessA" with parameter "%USERPROFILE%\Documents\Bins.exe" - (UID: 00000000-00001472) "Bins.exe" called "CreateProcessA" with parameter "powershell Add-MpPreference -ExclusionPath C:\" - (UID: 00000000-00003636) "Bins.exe" called "CreateProcessW" with parameter ""%TEMP%\24.exe"" - (UID: 00000000-00003636) "Bins.exe" called "CreateProcessW" with parameter ""C:\Program Files\Internet Explorer\iexplore.exe" %APPDATA%\pbE.hwspK.html" - (UID: 00000000-00003636)35:Tff7a,"PO53623.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-0.dll (UID: 00000000-00001384) "PO53623.exe" called "LoadLibrary" with a parameter VERSION.dll (UID: 00000000-00001384) "PO53623.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\clr.dll (UID: 00000000-00001384) "PO53623.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00001384) "PO53623.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00001384) "PO53623.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00001384) "PO53623.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00001384) "PO53623.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00001384) "PO53623.exe" called "LoadLibrary" with a parameter api-ms-win-core-quirks-l1-1-0.dll (UID: 00000000-00001384) "PO53623.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2.dll (UID: 00000000-00001384) "PO53623.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoree.dll (UID: 00000000-00001384) "PO53623.exe" called "LoadLibrary" with a parameter mscoree.dll (UID: 00000000-00001384) "PO53623.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\combase.dll (UID: 00000000-00001384) "PO53623.exe" called "LoadLibrary" with a parameter psapi.dll (UID: 00000000-00001384) "PO53623.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\mscorlib\36eaccfde177c2e7b93b8dbdde4e012a\mscorlib.ni.dll (UID: 00000000-00001384) "PO53623.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\ole32.dll (UID: 00000000-00001384) "PO53623.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00001384) "PO53623.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\uxtheme.dll (UID: 00000000-00001384) "PO53623.exe" called "LoadLibrary" with a parameter api-ms-win-core-xstate-l2-1-0.dll (UID: 00000000-00001384) "PO53623.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\clrjit.dll (UID: 00000000-00001384) "PO53623.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System\2c3c912ea8f058f9d04c4650128feb3f\System.ni.dll (UID: 00000000-00001384) "PO53623.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Drawing\f7568d7f1b9d356f64779b4c0927cfb3\System.Drawing.ni.dll (UID: 00000000-00001384) "PO53623.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Windows.Forms\c9a4cbc00f690a9e3cddfc400f6e85bb\System.Windows.Forms.ni.dll (UID: 00000000-00001384) "PO53623.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00001384) "PO53623.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00001384) "PO53623.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\uxtheme.dll (UID: 00000000-00001384) "PO53623.exe" called "LoadLibrary" with a parameter uxtheme.dll (UID: 00000000-00001384) "PO53623.exe" called "LoadLibrary" with a parameter user32.dll (UID: 00000000-00001384) "PO53623.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Core\31fae3290fad30c31c98651462d22724\System.Core.ni.dll (UID: 00000000-00001384) "PO53623.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Configuration\96f7edb07b12303f0ec2595c7f3778c7\System.Configuration.ni.dll (UID: 00000000-00001384) "PO53623.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Xml\15af16d373cf0528cb74fc73d365fdbf\System.Xml.ni.dll (UID: 00000000-00001384) "PO53623.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\nlssorting.dll (UID: 00000000-00001384) "PO53623.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00001384) "PO53623.exe" called "LoadLibrary" with a parameter shell32.dll (UID: 00000000-00001384) "PO53623.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00001384) "PO53623.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll (UID: 00000000-00001384) "PO53623.exe" called "LoadLibrary" with a parameter bcrypt.dll (UID: 00000000-00001384) "PO53623.exe" called "LoadLibrary" with a parameter CRYPTSP.dll (UID: 00000000-00001384) "PO53623.exe" called "LoadLibrary" with a parameter CRYPTBASE.dll (UID: 00000000-00001384) "PO53623.exe" called "LoadLibrary" with a parameter imm32.dll (UID: 00000000-00001384) "PO53623.exe" called "LoadLibrary" with a parameter comctl32.dll (UID: 00000000-00001384) "PO53623.exe" called "LoadLibrary" with a parameter gdi32.dll (UID: 00000000-00001384) "PO53623.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\Microsoft.V9921e851#\a891970b44db9e340c3ef3efa95b793c\Microsoft.VisualBasic.ni.dll (UID: 00000000-00001384) "PO53623.exe" called "LoadLibrary" with a parameter gdiplus.dll (UID: 00000000-00001384) "PO53623.exe" called "LoadLibrary" with a parameter %WINDIR%\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.23894_none_5c0be957a009922e\gdiplus.dll (UID: 00000000-00001384) "PO53623.exe" called "LoadLibrary" with a parameter API-MS-Win-Core-LocalRegistry-L1-1-0.dll (UID: 00000000-00001384) "PO53623.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\en-US\mscorrc.dll (UID: 00000000-00001384) "PO53623.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\en\mscorrc.dll (UID: 00000000-00001384) "PO53623.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll (UID: 00000000-00001384) "PO53623.exe" called "LoadLibrary" with a parameter WindowsCodecs.dll (UID: 00000000-00001384) "PO53623.exe" called "LoadLibrary" with a parameter amsi.dll (UID: 00000000-00001384) "PO53623.exe" called "LoadLibrary" with a parameter ntdll (UID: 00000000-00001384) "PO53623.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll (UID: 00000000-00001384) "PO53623.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll (UID: 00000000-00001384) "PO53623.exe" called "LoadLibrary" with a parameter ntmarta.dll (UID: 00000000-00001384) "PO53623.exe" called "LoadLibrary" with a parameter SspiCli.dll (UID: 00000000-00001384) "PO53623.exe" called "LoadLibrary" with a parameter SHELL32.dll (UID: 00000000-00001384) "PO53623.exe" called "LoadLibrary" with a parameter propsys.dll (UID: 00000000-00001384) "PO53623.exe" called "LoadLibrary" with a parameter api-ms-win-downlevel-advapi32-l1-1-0.dll (UID: 00000000-00001384) "PO53623.exe" called "LoadLibrary" with a parameter Secur32.dll (UID: 00000000-00001384) "PO53623.exe" called "LoadLibrary" with a parameter API-MS-WIN-DOWNLEVEL-SHLWAPI-L1-1-0.DLL (UID: 00000000-00001384) "PO53623.exe" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00001384) "PO53623.exe" called "LoadLibrary" with a parameter API-MS-Win-Security-LSALookup-L1-1-0.dll (UID: 00000000-00001384) "powershell.exe" called "LoadLibrary" with a parameter comctl32.dll (UID: 00000000-00002724) "powershell.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00002724) "powershell.exe" called "LoadLibrary" with a parameter SHELL32.dll (UID: 00000000-00002724) "powershell.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00002724) "powershell.exe" called "LoadLibrary" with a parameter propsys.dll (UID: 00000000-00002724) "powershell.exe" called "LoadLibrary" with a parameter ntmarta.dll (UID: 00000000-00002724) "powershell.exe" called "LoadLibrary" with a parameter API-MS-Win-Core-LocalRegistry-L1-1-0.dll (UID: 00000000-00002724) "powershell.exe" called "LoadLibrary" with a parameter PROPSYS.dll (UID: 00000000-00002724) "powershell.exe" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00002724) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\shell32.dll (UID: 00000000-00002724) "powershell.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00002724) "powershell.exe" called "LoadLibrary" with a parameter ntshrui.dll (UID: 00000000-00002724) "powershell.exe" called "LoadLibrary" with a parameter srvcli.dll (UID: 00000000-00002724) "powershell.exe" called "LoadLibrary" with a parameter cscapi.dll (UID: 00000000-00002724) "powershell.exe" called "LoadLibrary" with a parameter slc.dll (UID: 00000000-00002724) "powershell.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00002724) "powershell.exe" called "LoadLibrary" with a parameter CRYPTBASE.dll (UID: 00000000-00002724) "powershell.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00002724) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00002724) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00002724) "powershell.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00002724) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00002724) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll (UID: 00000000-00002724) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2.dll (UID: 00000000-00002724) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-0.dll (UID: 00000000-00002724) "powershell.exe" called "LoadLibrary" with a parameter VERSION.dll (UID: 00000000-00002724) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v2.0.50727\mscorwks.dll (UID: 00000000-00002724) "powershell.exe" called "LoadLibrary" with a parameter mscoree.dll (UID: 00000000-00002724) "powershell.exe" called "LoadLibrary" with a parameter ntdll (UID: 00000000-00002724) "powershell.exe" called "LoadLibrary" with a parameter shell32.dll (UID: 00000000-00002724) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v2.0.50727_32\mscorlib\9f895c66454577eff9c77442d0c84f71\mscorlib.ni.dll (UID: 00000000-00002724) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v2.0.50727\ole32.dll (UID: 00000000-00002724) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v2.0.50727\OLEAUT32.dll (UID: 00000000-00002724) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v2.0.50727_32\System\ad92dab7f418877d6a1e0358ce35658a\System.ni.dll (UID: 00000000-00002724) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v2.0.50727_32\Microsoft.PowerShel#\8229f0505633d4bcef019b9d4fab9f18\Microsoft.PowerShell.ConsoleH (UID: 00000000-00002724) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v2.0.50727_32\System.Management.A#\84c47b5a5813a5f040aee9715a0ff7c0\System.Management.Automation. (UID: 00000000-00002724) "powershell.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00002724) "powershell.exe" called "LoadLibrary" with a parameter version.dll (UID: 00000000-00002724) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\GAC_MSIL\System.Management.Automation\1.0.0.0__31bf3856ad364e35\System.Management.Automation.dll (UID: 00000000-00002724) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\GAC_MSIL\System\2.0.0.0__b77a5c561934e089\psapi.dll (UID: 00000000-00002724) "powershell.exe" called "LoadLibrary" with a parameter psapi.dll (UID: 00000000-00002724) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\GAC_MSIL\System\2.0.0.0__b77a5c561934e089\ntdll.dll (UID: 00000000-00002724) "powershell.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00002724) "powershell.exe" called "LoadLibrary" with a parameter user32.dll (UID: 00000000-00002724) "powershell.exe" called "LoadLibrary" with a parameter AdvApi32.dll (UID: 00000000-00002724) "powershell.exe" called "LoadLibrary" with a parameter CRYPTSP.dll (UID: 00000000-00002724) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v2.0.50727_32\System.Core\bd9ff1a4363781a57e8f7392f230a203\System.Core.ni.dll (UID: 00000000-00002724) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v2.0.50727_32\Microsoft.PowerShel#\49cae79ac18bad142e1ab5a46a8ac306\Microsoft.PowerShell.Commands (UID: 00000000-00002724) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v2.0.50727_32\System.Configuratio#\d6acc39f6c1ea42d8b3150db6184a969\System.Configuration.Install. (UID: 00000000-00002724) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v2.0.50727_32\Microsoft.WSMan.Man#\7bf5729401cff7ea7898124e9818ed20\Microsoft.WSMan.Management.ni (UID: 00000000-00002724) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v2.0.50727_32\System.Transactions\fec007ea17ac8956cc5d6d4074dada6a\System.Transactions.ni.dll (UID: 00000000-00002724) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\GAC_32\System.Transactions\2.0.0.0__b77a5c561934e089\System.Transactions.dll (UID: 00000000-00002724) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v2.0.50727_32\Microsoft.PowerShel#\f1831ce4588265a3f72e0a581ba58f2a\Microsoft.PowerShell.Commands (UID: 00000000-00002724) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v2.0.50727_32\Microsoft.PowerShel#\344e681515d07b93a4f1383f0d625e1e\Microsoft.PowerShell.Commands (UID: 00000000-00002724) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v2.0.50727_32\Microsoft.PowerShel#\573750f17b5b8316f04a10956fdd1d97\Microsoft.PowerShell.Security (UID: 00000000-00002724) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v2.0.50727\culture.dll (UID: 00000000-00002724) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v2.0.50727\en-US\mscorrc.dll (UID: 00000000-00002724) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v2.0.50727\en\mscorrc.dll (UID: 00000000-00002724) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v2.0.50727\mscorrc.dll (UID: 00000000-00002724) "powershell.exe" called "LoadLibrary" with a parameter KERNEL32.dll (UID: 00000000-00002724) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v2.0.50727_32\System.Xml\77c1dc46ea139bf5e1eaa9b87ef03c7a\System.Xml.ni.dll (UID: 00000000-00002724) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v2.0.50727_32\System.Management\00c2b464e52d4e82c04d61592a12a89d\System.Management.ni.dll (UID: 00000000-00002724) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v2.0.50727_32\System.DirectorySer#\237ed1739105c1bebe48d41905fdb3ee\System.DirectoryServices.ni.d (UID: 00000000-00002724) "powershell.exe" called "LoadLibrary" with a parameter shfolder.dll (UID: 00000000-00002724) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\secur32.dll (UID: 00000000-00002724) "powershell.exe" called "LoadLibrary" with a parameter secur32.dll (UID: 00000000-00002724) "powershell.exe" called "LoadLibrary" with a parameter SspiCli.dll (UID: 00000000-00002724) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v2.0.50727_32\System.Data\511c39d1efa06d262a6b2f47e2726c73\System.Data.ni.dll (UID: 00000000-00002724) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\GAC_32\System.Data\2.0.0.0__b77a5c561934e089\System.Data.dll (UID: 00000000-00002724) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v2.0.50727\mscorjit.dll (UID: 00000000-00002724) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v2.0.50727\diasymreader.dll (UID: 00000000-00002724) "powershell.exe" called "LoadLibrary" with a parameter GDI32.dll (UID: 00000000-00002724) "powershell.exe" called "LoadLibrary" with a parameter netutils.dll (UID: 00000000-00002724) "schtasks.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00002436) "schtasks.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00002436) "schtasks.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00002436) "schtasks.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00002436) "schtasks.exe" called "LoadLibrary" with a parameter %WINDIR%\System32\schtasks.exe (UID: 00000000-00002436) "schtasks.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\uxtheme.dll (UID: 00000000-00002436) "schtasks.exe" called "LoadLibrary" with a parameter API-MS-Win-Security-LSALookup-L1-1-0.dll (UID: 00000000-00002436) "PO53623.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00003392) "PO53623.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00003392) "PO53623.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00003392) "PO53623.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00003392) "PO53623.exe" called "LoadLibrary" with a parameter API-MS-Win-Core-LocalRegistry-L1-1-0.dll (UID: 00000000-00003392) "PO53623.exe" called "LoadLibrary" with a parameter setupapi.dll (UID: 00000000-00003392) "PO53623.exe" called "LoadLibrary" with a parameter ntmarta.dll (UID: 00000000-00003392) "PO53623.exe" called "LoadLibrary" with a parameter WINTRUST.dll (UID: 00000000-00003392) "PO53623.exe" called "LoadLibrary" with a parameter msdmo.dll (UID: 00000000-00003392) "PO53623.exe" called "LoadLibrary" with a parameter imm32.dll (UID: 00000000-00003392) "PO53623.exe" called "LoadLibrary" with a parameter avicap32.dll (UID: 00000000-00003392) "PO53623.exe" called "LoadLibrary" with a parameter User32.dll (UID: 00000000-00003392) "PO53623.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00003392) "PO53623.exe" called "LoadLibrary" with a parameter comctl32.dll (UID: 00000000-00003392) "PO53623.exe" called "LoadLibrary" with a parameter USER32.DLL (UID: 00000000-00003392) "PO53623.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00003392) "powershell.exe" called "LoadLibrary" with a parameter comctl32.dll (UID: 00000000-00003364) "powershell.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00003364) "powershell.exe" called "LoadLibrary" with a parameter SHELL32.dll (UID: 00000000-00003364) "powershell.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00003364) "powershell.exe" called "LoadLibrary" with a parameter API-MS-Win-Core-LocalRegistry-L1-1-0.dll (UID: 00000000-00003364) "powershell.exe" called "LoadLibrary" with a parameter propsys.dll (UID: 00000000-00003364) "powershell.exe" called "LoadLibrary" with a parameter ntmarta.dll (UID: 00000000-00003364) "powershell.exe" called "LoadLibrary" with a parameter PROPSYS.dll (UID: 00000000-00003364) "powershell.exe" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00003364) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\shell32.dll (UID: 00000000-00003364) "powershell.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00003364) "powershell.exe" called "LoadLibrary" with a parameter ntshrui.dll (UID: 00000000-00003364) "powershell.exe" called "LoadLibrary" with a parameter srvcli.dll (UID: 00000000-00003364) "powershell.exe" called "LoadLibrary" with a parameter cscapi.dll (UID: 00000000-00003364) "powershell.exe" called "LoadLibrary" with a parameter slc.dll (UID: 00000000-00003364) "powershell.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00003364) "powershell.exe" called "LoadLibrary" with a parameter CRYPTBASE.dll (UID: 00000000-00003364) "powershell.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00003364) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00003364) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00003364) "powershell.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00003364) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00003364) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll (UID: 00000000-00003364) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2.dll (UID: 00000000-00003364) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-0.dll (UID: 00000000-00003364) "powershell.exe" called "LoadLibrary" with a parameter VERSION.dll (UID: 00000000-00003364) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v2.0.50727\mscorwks.dll (UID: 00000000-00003364) "powershell.exe" called "LoadLibrary" with a parameter mscoree.dll (UID: 00000000-00003364) "powershell.exe" called "LoadLibrary" with a parameter ntdll (UID: 00000000-00003364) "powershell.exe" called "LoadLibrary" with a parameter shell32.dll (UID: 00000000-00003364) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v2.0.50727_32\mscorlib\9f895c66454577eff9c77442d0c84f71\mscorlib.ni.dll (UID: 00000000-00003364) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v2.0.50727\ole32.dll (UID: 00000000-00003364) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v2.0.50727\OLEAUT32.dll (UID: 00000000-00003364) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v2.0.50727_32\System\ad92dab7f418877d6a1e0358ce35658a\System.ni.dll (UID: 00000000-00003364) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v2.0.50727_32\Microsoft.PowerShel#\8229f0505633d4bcef019b9d4fab9f18\Microsoft.PowerShell.ConsoleH (UID: 00000000-00003364) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v2.0.50727_32\System.Management.A#\84c47b5a5813a5f040aee9715a0ff7c0\System.Management.Automation. (UID: 00000000-00003364) "powershell.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00003364) "powershell.exe" called "LoadLibrary" with a parameter version.dll (UID: 00000000-00003364) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\GAC_MSIL\System.Management.Automation\1.0.0.0__31bf3856ad364e35\System.Management.Automation.dll (UID: 00000000-00003364) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\GAC_MSIL\System\2.0.0.0__b77a5c561934e089\psapi.dll (UID: 00000000-00003364) "powershell.exe" called "LoadLibrary" with a parameter psapi.dll (UID: 00000000-00003364) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\GAC_MSIL\System\2.0.0.0__b77a5c561934e089\ntdll.dll (UID: 00000000-00003364) "powershell.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00003364) "powershell.exe" called "LoadLibrary" with a parameter user32.dll (UID: 00000000-00003364) "powershell.exe" called "LoadLibrary" with a parameter AdvApi32.dll (UID: 00000000-00003364) "powershell.exe" called "LoadLibrary" with a parameter CRYPTSP.dll (UID: 00000000-00003364) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v2.0.50727_32\System.Core\bd9ff1a4363781a57e8f7392f230a203\System.Core.ni.dll (UID: 00000000-00003364) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v2.0.50727_32\Microsoft.PowerShel#\49cae79ac18bad142e1ab5a46a8ac306\Microsoft.PowerShell.Commands (UID: 00000000-00003364) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v2.0.50727_32\System.Configuratio#\d6acc39f6c1ea42d8b3150db6184a969\System.Configuration.Install. (UID: 00000000-00003364) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v2.0.50727_32\Microsoft.WSMan.Man#\7bf5729401cff7ea7898124e9818ed20\Microsoft.WSMan.Management.ni (UID: 00000000-00003364) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v2.0.50727_32\System.Transactions\fec007ea17ac8956cc5d6d4074dada6a\System.Transactions.ni.dll (UID: 00000000-00003364) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\GAC_32\System.Transactions\2.0.0.0__b77a5c561934e089\System.Transactions.dll (UID: 00000000-00003364) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v2.0.50727_32\Microsoft.PowerShel#\f1831ce4588265a3f72e0a581ba58f2a\Microsoft.PowerShell.Commands (UID: 00000000-00003364) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v2.0.50727_32\Microsoft.PowerShel#\344e681515d07b93a4f1383f0d625e1e\Microsoft.PowerShell.Commands (UID: 00000000-00003364) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v2.0.50727_32\Microsoft.PowerShel#\573750f17b5b8316f04a10956fdd1d97\Microsoft.PowerShell.Security (UID: 00000000-00003364) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v2.0.50727\culture.dll (UID: 00000000-00003364) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v2.0.50727\en-US\mscorrc.dll (UID: 00000000-00003364) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v2.0.50727\en\mscorrc.dll (UID: 00000000-00003364) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v2.0.50727\mscorrc.dll (UID: 00000000-00003364) "powershell.exe" called "LoadLibrary" with a parameter KERNEL32.dll (UID: 00000000-00003364) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v2.0.50727_32\System.Xml\77c1dc46ea139bf5e1eaa9b87ef03c7a\System.Xml.ni.dll (UID: 00000000-00003364) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v2.0.50727_32\System.Management\00c2b464e52d4e82c04d61592a12a89d\System.Management.ni.dll (UID: 00000000-00003364) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v2.0.50727_32\System.DirectorySer#\237ed1739105c1bebe48d41905fdb3ee\System.DirectoryServices.ni.d (UID: 00000000-00003364) "powershell.exe" called "LoadLibrary" with a parameter shfolder.dll (UID: 00000000-00003364) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\secur32.dll (UID: 00000000-00003364) "powershell.exe" called "LoadLibrary" with a parameter secur32.dll (UID: 00000000-00003364) "powershell.exe" called "LoadLibrary" with a parameter SspiCli.dll (UID: 00000000-00003364) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v2.0.50727_32\System.Data\511c39d1efa06d262a6b2f47e2726c73\System.Data.ni.dll (UID: 00000000-00003364) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\GAC_32\System.Data\2.0.0.0__b77a5c561934e089\System.Data.dll (UID: 00000000-00003364) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v2.0.50727\mscorjit.dll (UID: 00000000-00003364) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v2.0.50727\diasymreader.dll (UID: 00000000-00003364) "powershell.exe" called "LoadLibrary" with a parameter GDI32.dll (UID: 00000000-00003364) "powershell.exe" called "LoadLibrary" with a parameter netutils.dll (UID: 00000000-00003364) "Bins.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00001472) "Bins.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00001472) "Bins.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00001472) "Bins.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00001472) "Bins.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00001472) "Bins.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll (UID: 00000000-00001472) "Bins.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00001472) "Bins.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2.dll (UID: 00000000-00001472) "Bins.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-0.dll (UID: 00000000-00001472) "Bins.exe" called "LoadLibrary" with a parameter VERSION.dll (UID: 00000000-00001472) "Bins.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\clr.dll (UID: 00000000-00001472) "Bins.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00001472) "Bins.exe" called "LoadLibrary" with a parameter api-ms-win-core-quirks-l1-1-0.dll (UID: 00000000-00001472) "Bins.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoree.dll (UID: 00000000-00001472) "Bins.exe" called "LoadLibrary" with a parameter mscoree.dll (UID: 00000000-00001472) "Bins.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\combase.dll (UID: 00000000-00001472) "Bins.exe" called "LoadLibrary" with a parameter psapi.dll (UID: 00000000-00001472) "Bins.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\mscorlib\36eaccfde177c2e7b93b8dbdde4e012a\mscorlib.ni.dll (UID: 00000000-00001472) "Bins.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\ole32.dll (UID: 00000000-00001472) "Bins.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00001472) "Bins.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\uxtheme.dll (UID: 00000000-00001472) "Bins.exe" called "LoadLibrary" with a parameter api-ms-win-core-xstate-l2-1-0.dll (UID: 00000000-00001472) "Bins.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\clrjit.dll (UID: 00000000-00001472) "Bins.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System\2c3c912ea8f058f9d04c4650128feb3f\System.ni.dll (UID: 00000000-00001472) "Bins.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Drawing\f7568d7f1b9d356f64779b4c0927cfb3\System.Drawing.ni.dll (UID: 00000000-00001472) "Bins.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Windows.Forms\c9a4cbc00f690a9e3cddfc400f6e85bb\System.Windows.Forms.ni.dll (UID: 00000000-00001472) "Bins.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00001472) "Bins.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00001472) "Bins.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\uxtheme.dll (UID: 00000000-00001472) "Bins.exe" called "LoadLibrary" with a parameter uxtheme.dll (UID: 00000000-00001472) "Bins.exe" called "LoadLibrary" with a parameter user32.dll (UID: 00000000-00001472) "Bins.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Core\31fae3290fad30c31c98651462d22724\System.Core.ni.dll (UID: 00000000-00001472) "Bins.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Configuration\96f7edb07b12303f0ec2595c7f3778c7\System.Configuration.ni.dll (UID: 00000000-00001472) "Bins.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Xml\15af16d373cf0528cb74fc73d365fdbf\System.Xml.ni.dll (UID: 00000000-00001472) "Bins.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\nlssorting.dll (UID: 00000000-00001472) "Bins.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00001472) "Bins.exe" called "LoadLibrary" with a parameter shell32.dll (UID: 00000000-00001472) "Bins.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll (UID: 00000000-00001472) "Bins.exe" called "LoadLibrary" with a parameter bcrypt.dll (UID: 00000000-00001472) "Bins.exe" called "LoadLibrary" with a parameter CRYPTSP.dll (UID: 00000000-00001472) "Bins.exe" called "LoadLibrary" with a parameter CRYPTBASE.dll (UID: 00000000-00001472) "Bins.exe" called "LoadLibrary" with a parameter imm32.dll (UID: 00000000-00001472) "Bins.exe" called "LoadLibrary" with a parameter comctl32.dll (UID: 00000000-00001472) "Bins.exe" called "LoadLibrary" with a parameter gdi32.dll (UID: 00000000-00001472) "Bins.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\Microsoft.V9921e851#\a891970b44db9e340c3ef3efa95b793c\Microsoft.VisualBasic.ni.dll (UID: 00000000-00001472) "Bins.exe" called "LoadLibrary" with a parameter gdiplus.dll (UID: 00000000-00001472) "Bins.exe" called "LoadLibrary" with a parameter %WINDIR%\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.23894_none_5c0be957a009922e\gdiplus.dll (UID: 00000000-00001472) "Bins.exe" called "LoadLibrary" with a parameter API-MS-Win-Core-LocalRegistry-L1-1-0.dll (UID: 00000000-00001472) "Bins.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\en-US\mscorrc.dll (UID: 00000000-00001472) "Bins.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\en\mscorrc.dll (UID: 00000000-00001472) "Bins.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll (UID: 00000000-00001472) "Bins.exe" called "LoadLibrary" with a parameter WindowsCodecs.dll (UID: 00000000-00001472) "Bins.exe" called "LoadLibrary" with a parameter amsi.dll (UID: 00000000-00001472) "Bins.exe" called "LoadLibrary" with a parameter ntdll (UID: 00000000-00001472) "Bins.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll (UID: 00000000-00001472) "Bins.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll (UID: 00000000-00001472) "Bins.exe" called "LoadLibrary" with a parameter SHELL32.dll (UID: 00000000-00001472) "Bins.exe" called "LoadLibrary" with a parameter propsys.dll (UID: 00000000-00001472) "Bins.exe" called "LoadLibrary" with a parameter ntmarta.dll (UID: 00000000-00001472) "Bins.exe" called "LoadLibrary" with a parameter api-ms-win-downlevel-advapi32-l1-1-0.dll (UID: 00000000-00001472) "Bins.exe" called "LoadLibrary" with a parameter Secur32.dll (UID: 00000000-00001472) "Bins.exe" called "LoadLibrary" with a parameter API-MS-WIN-DOWNLEVEL-SHLWAPI-L1-1-0.DLL (UID: 00000000-00001472) "Bins.exe" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00001472) "Bins.exe" called "LoadLibrary" with a parameter API-MS-Win-Security-LSALookup-L1-1-0.dll (UID: 00000000-00001472) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\uxtheme.dll (UID: 00000000-00001808) "powershell.exe" called "LoadLibrary" with a parameter comctl32.dll (UID: 00000000-00001808) "powershell.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00001808) "powershell.exe" called "LoadLibrary" with a parameter SHELL32.dll (UID: 00000000-00001808) "powershell.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00001808) "powershell.exe" called "LoadLibrary" with a parameter API-MS-Win-Core-LocalRegistry-L1-1-0.dll (UID: 00000000-00001808) "powershell.exe" called "LoadLibrary" with a parameter propsys.dll (UID: 00000000-00001808) "powershell.exe" called "LoadLibrary" with a parameter ntmarta.dll (UID: 00000000-00001808) "powershell.exe" called "LoadLibrary" with a parameter PROPSYS.dll (UID: 00000000-00001808) "powershell.exe" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00001808) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\shell32.dll (UID: 00000000-00001808) "powershell.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00001808) "powershell.exe" called "LoadLibrary" with a parameter ntshrui.dll (UID: 00000000-00001808) "powershell.exe" called "LoadLibrary" with a parameter srvcli.dll (UID: 00000000-00001808) "powershell.exe" called "LoadLibrary" with a parameter cscapi.dll (UID: 00000000-00001808) "powershell.exe" called "LoadLibrary" with a parameter slc.dll (UID: 00000000-00001808) "powershell.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00001808) "powershell.exe" called "LoadLibrary" with a parameter CRYPTBASE.dll (UID: 00000000-00001808) "powershell.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00001808) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00001808) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00001808) "powershell.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00001808) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00001808) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll (UID: 00000000-00001808) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2.dll (UID: 00000000-00001808) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-0.dll (UID: 00000000-00001808) "powershell.exe" called "LoadLibrary" with a parameter VERSION.dll (UID: 00000000-00001808) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v2.0.50727\mscorwks.dll (UID: 00000000-00001808) "powershell.exe" called "LoadLibrary" with a parameter mscoree.dll (UID: 00000000-00001808) "powershell.exe" called "LoadLibrary" with a parameter ntdll (UID: 00000000-00001808) "powershell.exe" called "LoadLibrary" with a parameter shell32.dll (UID: 00000000-00001808) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v2.0.50727_32\mscorlib\9f895c66454577eff9c77442d0c84f71\mscorlib.ni.dll (UID: 00000000-00001808) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v2.0.50727\ole32.dll (UID: 00000000-00001808) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v2.0.50727\OLEAUT32.dll (UID: 00000000-00001808) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v2.0.50727_32\System\ad92dab7f418877d6a1e0358ce35658a\System.ni.dll (UID: 00000000-00001808) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v2.0.50727_32\Microsoft.PowerShel#\8229f0505633d4bcef019b9d4fab9f18\Microsoft.PowerShell.ConsoleH (UID: 00000000-00001808) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v2.0.50727_32\System.Management.A#\84c47b5a5813a5f040aee9715a0ff7c0\System.Management.Automation. (UID: 00000000-00001808) "powershell.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00001808) "powershell.exe" called "LoadLibrary" with a parameter version.dll (UID: 00000000-00001808) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\GAC_MSIL\System.Management.Automation\1.0.0.0__31bf3856ad364e35\System.Management.Automation.dll (UID: 00000000-00001808) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\GAC_MSIL\System\2.0.0.0__b77a5c561934e089\psapi.dll (UID: 00000000-00001808) "powershell.exe" called "LoadLibrary" with a parameter psapi.dll (UID: 00000000-00001808) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\GAC_MSIL\System\2.0.0.0__b77a5c561934e089\ntdll.dll (UID: 00000000-00001808) "powershell.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00001808) "powershell.exe" called "LoadLibrary" with a parameter user32.dll (UID: 00000000-00001808) "powershell.exe" called "LoadLibrary" with a parameter AdvApi32.dll (UID: 00000000-00001808) "powershell.exe" called "LoadLibrary" with a parameter CRYPTSP.dll (UID: 00000000-00001808) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v2.0.50727_32\System.Core\bd9ff1a4363781a57e8f7392f230a203\System.Core.ni.dll (UID: 00000000-00001808) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v2.0.50727_32\Microsoft.PowerShel#\49cae79ac18bad142e1ab5a46a8ac306\Microsoft.PowerShell.Commands (UID: 00000000-00001808) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v2.0.50727_32\System.Configuratio#\d6acc39f6c1ea42d8b3150db6184a969\System.Configuration.Install. (UID: 00000000-00001808) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v2.0.50727_32\Microsoft.WSMan.Man#\7bf5729401cff7ea7898124e9818ed20\Microsoft.WSMan.Management.ni (UID: 00000000-00001808) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v2.0.50727_32\System.Transactions\fec007ea17ac8956cc5d6d4074dada6a\System.Transactions.ni.dll (UID: 00000000-00001808) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\GAC_32\System.Transactions\2.0.0.0__b77a5c561934e089\System.Transactions.dll (UID: 00000000-00001808) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v2.0.50727_32\Microsoft.PowerShel#\f1831ce4588265a3f72e0a581ba58f2a\Microsoft.PowerShell.Commands (UID: 00000000-00001808) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v2.0.50727_32\Microsoft.PowerShel#\344e681515d07b93a4f1383f0d625e1e\Microsoft.PowerShell.Commands (UID: 00000000-00001808) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v2.0.50727_32\Microsoft.PowerShel#\573750f17b5b8316f04a10956fdd1d97\Microsoft.PowerShell.Security (UID: 00000000-00001808) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v2.0.50727\culture.dll (UID: 00000000-00001808) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v2.0.50727\en-US\mscorrc.dll (UID: 00000000-00001808) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v2.0.50727\en\mscorrc.dll (UID: 00000000-00001808) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v2.0.50727\mscorrc.dll (UID: 00000000-00001808) "powershell.exe" called "LoadLibrary" with a parameter KERNEL32.dll (UID: 00000000-00001808) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v2.0.50727_32\System.Xml\77c1dc46ea139bf5e1eaa9b87ef03c7a\System.Xml.ni.dll (UID: 00000000-00001808) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v2.0.50727_32\System.Management\00c2b464e52d4e82c04d61592a12a89d\System.Management.ni.dll (UID: 00000000-00001808) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v2.0.50727_32\System.DirectorySer#\237ed1739105c1bebe48d41905fdb3ee\System.DirectoryServices.ni.d (UID: 00000000-00001808) "powershell.exe" called "LoadLibrary" with a parameter shfolder.dll (UID: 00000000-00001808) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\secur32.dll (UID: 00000000-00001808) "powershell.exe" called "LoadLibrary" with a parameter secur32.dll (UID: 00000000-00001808) "powershell.exe" called "LoadLibrary" with a parameter SspiCli.dll (UID: 00000000-00001808) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v2.0.50727_32\System.Data\511c39d1efa06d262a6b2f47e2726c73\System.Data.ni.dll (UID: 00000000-00001808) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\GAC_32\System.Data\2.0.0.0__b77a5c561934e089\System.Data.dll (UID: 00000000-00001808) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v2.0.50727\mscorjit.dll (UID: 00000000-00001808) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v2.0.50727\diasymreader.dll (UID: 00000000-00001808) "powershell.exe" called "LoadLibrary" with a parameter GDI32.dll (UID: 00000000-00001808) "powershell.exe" called "LoadLibrary" with a parameter netutils.dll (UID: 00000000-00001808) "schtasks.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00003256) "schtasks.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00003256) "schtasks.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00003256) "schtasks.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00003256) "schtasks.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\uxtheme.dll (UID: 00000000-00003256) "schtasks.exe" called "LoadLibrary" with a parameter API-MS-Win-Security-LSALookup-L1-1-0.dll (UID: 00000000-00003256) "Bins.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\uxtheme.dll (UID: 00000000-00003636) "Bins.exe" called "LoadLibrary" with a parameter API-MS-Win-Core-LocalRegistry-L1-1-0.dll (UID: 00000000-00003636) "Bins.exe" called "LoadLibrary" with a parameter setupapi.dll (UID: 00000000-00003636) "Bins.exe" called "LoadLibrary" with a parameter ntmarta.dll (UID: 00000000-00003636) "Bins.exe" called "LoadLibrary" with a parameter WINTRUST.dll (UID: 00000000-00003636) "Bins.exe" called "LoadLibrary" with a parameter msdmo.dll (UID: 00000000-00003636) "Bins.exe" called "LoadLibrary" with a parameter imm32.dll (UID: 00000000-00003636) "Bins.exe" called "LoadLibrary" with a parameter avicap32.dll (UID: 00000000-00003636) "Bins.exe" called "LoadLibrary" with a parameter User32.dll (UID: 00000000-00003636) "Bins.exe" called "LoadLibrary" with a parameter USER32.DLL (UID: 00000000-00003636) "Bins.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00003636) "Bins.exe" called "LoadLibrary" with a parameter Ws2_32.dll (UID: 00000000-00003636) "Bins.exe" called "LoadLibrary" with a parameter API-MS-Win-Security-LSALookup-L1-1-0.dll (UID: 00000000-00003636) "Bins.exe" called "LoadLibrary" with a parameter CRYPTBASE.dll (UID: 00000000-00003636) "Bins.exe" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00003636) "Bins.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00003636) "Bins.exe" called "LoadLibrary" with a parameter api-ms-win-downlevel-shlwapi-l2-1-0.dll (UID: 00000000-00003636) "Bins.exe" called "LoadLibrary" with a parameter Secur32.dll (UID: 00000000-00003636) "Bins.exe" called "LoadLibrary" with a parameter SHELL32.dll (UID: 00000000-00003636) "Bins.exe" called "LoadLibrary" with a parameter api-ms-win-downlevel-advapi32-l2-1-0.dll (UID: 00000000-00003636) "Bins.exe" called "LoadLibrary" with a parameter api-ms-win-downlevel-ole32-l1-1-0.dll (UID: 00000000-00003636) "Bins.exe" called "LoadLibrary" with a parameter WS2_32.dll (UID: 00000000-00003636) "Bins.exe" called "LoadLibrary" with a parameter winhttp.dll (UID: 00000000-00003636) "Bins.exe" called "LoadLibrary" with a parameter CRYPT32.dll (UID: 00000000-00003636) "Bins.exe" called "LoadLibrary" with a parameter USERENV.dll (UID: 00000000-00003636) "Bins.exe" called "LoadLibrary" with a parameter IPHLPAPI.DLL (UID: 00000000-00003636) "Bins.exe" called "LoadLibrary" with a parameter DNSAPI.dll (UID: 00000000-00003636) "Bins.exe" called "LoadLibrary" with a parameter dhcpcsvc.DLL (UID: 00000000-00003636) "Bins.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00003636) "Bins.exe" called "LoadLibrary" with a parameter urlmon.dll (UID: 00000000-00003636) "Bins.exe" called "LoadLibrary" with a parameter Comctl32.dll (UID: 00000000-00003636) "Bins.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\ws2_32 (UID: 00000000-00003636) "Bins.exe" called "LoadLibrary" with a parameter secur32.dll (UID: 00000000-00003636) "Bins.exe" called "LoadLibrary" with a parameter ncrypt.dll (UID: 00000000-00003636) "Bins.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\bcryptprimitives.dll (UID: 00000000-00003636) "Bins.exe" called "LoadLibrary" with a parameter CRYPTSP.dll (UID: 00000000-00003636) "Bins.exe" called "LoadLibrary" with a parameter API-MS-Win-Security-SDDL-L1-1-0.dll (UID: 00000000-00003636) "Bins.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00003636) "Bins.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\cryptnet.dll (UID: 00000000-00003636) "Bins.exe" called "LoadLibrary" with a parameter cryptnet.dll (UID: 00000000-00003636) "Bins.exe" called "LoadLibrary" with a parameter SensApi.dll (UID: 00000000-00003636) "Bins.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00003636) "Bins.exe" called "LoadLibrary" with a parameter WINHTTP.dll (UID: 00000000-00003636) "Bins.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00003636) "Bins.exe" called "LoadLibrary" with a parameter SspiCli.dll (UID: 00000000-00003636) "Bins.exe" called "LoadLibrary" with a parameter RPCRT4.dll (UID: 00000000-00003636) "Bins.exe" called "LoadLibrary" with a parameter NSI.dll (UID: 00000000-00003636) "Bins.exe" called "LoadLibrary" with a parameter CFGMGR32.dll (UID: 00000000-00003636) "Bins.exe" called "LoadLibrary" with a parameter profapi.dll (UID: 00000000-00003636) "Bins.exe" called "LoadLibrary" with a parameter API-MS-WIN-Service-Management-L1-1-0.dll (UID: 00000000-00003636) "Bins.exe" called "LoadLibrary" with a parameter API-MS-WIN-Service-winsvc-L1-1-0.dll (UID: 00000000-00003636) "Bins.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\CRYPT32.dll (UID: 00000000-00003636) "Bins.exe" called "LoadLibrary" with a parameter comctl32.dll (UID: 00000000-00003636) "Bins.exe" called "LoadLibrary" with a parameter propsys.dll (UID: 00000000-00003636) "Bins.exe" called "LoadLibrary" with a parameter PROPSYS.dll (UID: 00000000-00003636) "Bins.exe" called "LoadLibrary" with a parameter API-MS-WIN-DOWNLEVEL-SHLWAPI-L1-1-0.DLL (UID: 00000000-00003636) "Bins.exe" called "LoadLibrary" with a parameter bcrypt.dll (UID: 00000000-00003636) "Bins.exe" called "LoadLibrary" with a parameter iertutil.dll (UID: 00000000-00003636) "powershell.exe" called "LoadLibrary" with a parameter comctl32.dll (UID: 00000000-00003808) "powershell.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00003808) "powershell.exe" called "LoadLibrary" with a parameter SHELL32.dll (UID: 00000000-00003808) "powershell.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00003808) "powershell.exe" called "LoadLibrary" with a parameter propsys.dll (UID: 00000000-00003808) "powershell.exe" called "LoadLibrary" with a parameter ntmarta.dll (UID: 00000000-00003808) "powershell.exe" called "LoadLibrary" with a parameter API-MS-Win-Core-LocalRegistry-L1-1-0.dll (UID: 00000000-00003808) "powershell.exe" called "LoadLibrary" with a parameter PROPSYS.dll (UID: 00000000-00003808) "powershell.exe" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00003808) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\shell32.dll (UID: 00000000-00003808) "powershell.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00003808) "powershell.exe" called "LoadLibrary" with a parameter ntshrui.dll (UID: 00000000-00003808) "powershell.exe" called "LoadLibrary" with a parameter srvcli.dll (UID: 00000000-00003808) "powershell.exe" called "LoadLibrary" with a parameter cscapi.dll (UID: 00000000-00003808) "powershell.exe" called "LoadLibrary" with a parameter slc.dll (UID: 00000000-00003808) "powershell.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00003808) "powershell.exe" called "LoadLibrary" with a parameter CRYPTBASE.dll (UID: 00000000-00003808) "powershell.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00003808) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00003808) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00003808) "powershell.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00003808) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00003808) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll (UID: 00000000-00003808) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2.dll (UID: 00000000-00003808) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-0.dll (UID: 00000000-00003808) "powershell.exe" called "LoadLibrary" with a parameter VERSION.dll (UID: 00000000-00003808) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v2.0.50727\mscorwks.dll (UID: 00000000-00003808) "powershell.exe" called "LoadLibrary" with a parameter mscoree.dll (UID: 00000000-00003808) "powershell.exe" called "LoadLibrary" with a parameter ntdll (UID: 00000000-00003808) "powershell.exe" called "LoadLibrary" with a parameter shell32.dll (UID: 00000000-00003808) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v2.0.50727_32\mscorlib\9f895c66454577eff9c77442d0c84f71\mscorlib.ni.dll (UID: 00000000-00003808) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v2.0.50727\ole32.dll (UID: 00000000-00003808) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v2.0.50727\OLEAUT32.dll (UID: 00000000-00003808) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v2.0.50727_32\System\ad92dab7f418877d6a1e0358ce35658a\System.ni.dll (UID: 00000000-00003808) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v2.0.50727_32\Microsoft.PowerShel#\8229f0505633d4bcef019b9d4fab9f18\Microsoft.PowerShell.ConsoleH (UID: 00000000-00003808) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v2.0.50727_32\System.Management.A#\84c47b5a5813a5f040aee9715a0ff7c0\System.Management.Automation. (UID: 00000000-00003808) "powershell.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00003808) "powershell.exe" called "LoadLibrary" with a parameter version.dll (UID: 00000000-00003808) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\GAC_MSIL\System.Management.Automation\1.0.0.0__31bf3856ad364e35\System.Management.Automation.dll (UID: 00000000-00003808) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\GAC_MSIL\System\2.0.0.0__b77a5c561934e089\psapi.dll (UID: 00000000-00003808) "powershell.exe" called "LoadLibrary" with a parameter psapi.dll (UID: 00000000-00003808) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\GAC_MSIL\System\2.0.0.0__b77a5c561934e089\ntdll.dll (UID: 00000000-00003808) "powershell.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00003808) "powershell.exe" called "LoadLibrary" with a parameter user32.dll (UID: 00000000-00003808) "powershell.exe" called "LoadLibrary" with a parameter AdvApi32.dll (UID: 00000000-00003808) "powershell.exe" called "LoadLibrary" with a parameter CRYPTSP.dll (UID: 00000000-00003808) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v2.0.50727_32\System.Core\bd9ff1a4363781a57e8f7392f230a203\System.Core.ni.dll (UID: 00000000-00003808) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v2.0.50727_32\Microsoft.PowerShel#\49cae79ac18bad142e1ab5a46a8ac306\Microsoft.PowerShell.Commands (UID: 00000000-00003808) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v2.0.50727_32\System.Configuratio#\d6acc39f6c1ea42d8b3150db6184a969\System.Configuration.Install. (UID: 00000000-00003808) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v2.0.50727_32\Microsoft.WSMan.Man#\7bf5729401cff7ea7898124e9818ed20\Microsoft.WSMan.Management.ni (UID: 00000000-00003808) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v2.0.50727_32\System.Transactions\fec007ea17ac8956cc5d6d4074dada6a\System.Transactions.ni.dll (UID: 00000000-00003808) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\GAC_32\System.Transactions\2.0.0.0__b77a5c561934e089\System.Transactions.dll (UID: 00000000-00003808) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v2.0.50727_32\Microsoft.PowerShel#\f1831ce4588265a3f72e0a581ba58f2a\Microsoft.PowerShell.Commands (UID: 00000000-00003808) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v2.0.50727_32\Microsoft.PowerShel#\344e681515d07b93a4f1383f0d625e1e\Microsoft.PowerShell.Commands (UID: 00000000-00003808) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v2.0.50727_32\Microsoft.PowerShel#\573750f17b5b8316f04a10956fdd1d97\Microsoft.PowerShell.Security (UID: 00000000-00003808) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v2.0.50727\culture.dll (UID: 00000000-00003808) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v2.0.50727\en-US\mscorrc.dll (UID: 00000000-00003808) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v2.0.50727\en\mscorrc.dll (UID: 00000000-00003808) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v2.0.50727\mscorrc.dll (UID: 00000000-00003808) "powershell.exe" called "LoadLibrary" with a parameter KERNEL32.dll (UID: 00000000-00003808) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v2.0.50727_32\System.Xml\77c1dc46ea139bf5e1eaa9b87ef03c7a\System.Xml.ni.dll (UID: 00000000-00003808) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v2.0.50727_32\System.Management\00c2b464e52d4e82c04d61592a12a89d\System.Management.ni.dll (UID: 00000000-00003808) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v2.0.50727_32\System.DirectorySer#\237ed1739105c1bebe48d41905fdb3ee\System.DirectoryServices.ni.d (UID: 00000000-00003808) "powershell.exe" called "LoadLibrary" with a parameter shfolder.dll (UID: 00000000-00003808) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\secur32.dll (UID: 00000000-00003808) "powershell.exe" called "LoadLibrary" with a parameter secur32.dll (UID: 00000000-00003808) "powershell.exe" called "LoadLibrary" with a parameter SspiCli.dll (UID: 00000000-00003808) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v2.0.50727_32\System.Data\511c39d1efa06d262a6b2f47e2726c73\System.Data.ni.dll (UID: 00000000-00003808) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\GAC_32\System.Data\2.0.0.0__b77a5c561934e089\System.Data.dll (UID: 00000000-00003808) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v2.0.50727\mscorjit.dll (UID: 00000000-00003808) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v2.0.50727\diasymreader.dll (UID: 00000000-00003808) "powershell.exe" called "LoadLibrary" with a parameter GDI32.dll (UID: 00000000-00003808) "powershell.exe" called "LoadLibrary" with a parameter netutils.dll (UID: 00000000-00003808) "24.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2 (UID: 00000000-00002880) "netsh.exe" called "LoadLibrary" with a parameter NSHWFP.DLL (UID: 00000000-00003304) "netsh.exe" called "LoadLibrary" with a parameter DHCPCMONITOR.DLL (UID: 00000000-00003304) "netsh.exe" called "LoadLibrary" with a parameter Dhcpcsvc.dll (UID: 00000000-00003304) "netsh.exe" called "LoadLibrary" with a parameter Dhcpqec.dll (UID: 00000000-00003304) "netsh.exe" called "LoadLibrary" with a parameter WSHELPER.DLL (UID: 00000000-00003304) "netsh.exe" called "LoadLibrary" with a parameter NSHHTTP.DLL (UID: 00000000-00003304) "netsh.exe" called "LoadLibrary" with a parameter FWCFG.DLL (UID: 00000000-00003304) "netsh.exe" called "LoadLibrary" with a parameter AUTHFWCFG.DLL (UID: 00000000-00003304) "netsh.exe" called "LoadLibrary" with a parameter API-MS-Win-Core-LocalRegistry-L1-1-0.dll (UID: 00000000-00003304) "netsh.exe" called "LoadLibrary" with a parameter IFMON.DLL (UID: 00000000-00003304) "netsh.exe" called "LoadLibrary" with a parameter NETIOHLP.DLL (UID: 00000000-00003304) "netsh.exe" called "LoadLibrary" with a parameter WHHELPER.DLL (UID: 00000000-00003304) "netsh.exe" called "LoadLibrary" with a parameter HNETMON.DLL (UID: 00000000-00003304) "netsh.exe" called "LoadLibrary" with a parameter RPCNSH.DLL (UID: 00000000-00003304) "netsh.exe" called "LoadLibrary" with a parameter DOT3CFG.DLL (UID: 00000000-00003304) "netsh.exe" called "LoadLibrary" with a parameter NAPMONTR.DLL (UID: 00000000-00003304) "netsh.exe" called "LoadLibrary" with a parameter NSHIPSEC.DLL (UID: 00000000-00003304) "netsh.exe" called "LoadLibrary" with a parameter NETTRACE.DLL (UID: 00000000-00003304) "netsh.exe" called "LoadLibrary" with a parameter WCNNETSH.DLL (UID: 00000000-00003304) "netsh.exe" called "LoadLibrary" with a parameter P2PNETSH.DLL (UID: 00000000-00003304) "netsh.exe" called "LoadLibrary" with a parameter WLANCFG.DLL (UID: 00000000-00003304) "netsh.exe" called "LoadLibrary" with a parameter WWANCFG.DLL (UID: 00000000-00003304) "netsh.exe" called "LoadLibrary" with a parameter PEERDISTSH.DLL (UID: 00000000-00003304) "netsh.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00003304) "netsh.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\uxtheme.dll (UID: 00000000-00003304) "netsh.exe" called "LoadLibrary" with a parameter CRYPTSP.dll (UID: 00000000-00003304) "netsh.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00003304) "netsh.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00003304) "netsh.exe" called "LoadLibrary" with a parameter API-MS-WIN-Service-Management-L1-1-0.dll (UID: 00000000-00003304) "netsh.exe" called "LoadLibrary" with a parameter API-MS-WIN-Service-Management-L2-1-0.dll (UID: 00000000-00003304) "netsh.exe" called "LoadLibrary" with a parameter API-MS-WIN-Service-winsvc-L1-1-0.dll (UID: 00000000-00003304) "netsh.exe" called "LoadLibrary" with a parameter API-MS-Win-Security-LSALookup-L1-1-0.dll (UID: 00000000-00003304) "netsh.exe" called "LoadLibrary" with a parameter CRYPTBASE.dll (UID: 00000000-00003304) "netsh.exe" called "LoadLibrary" with a parameter HTTPAPI.dll (UID: 00000000-00003304) "netsh.exe" called "LoadLibrary" with a parameter userenv.dll (UID: 00000000-00003304) "netsh.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\bcryptprimitives.dll (UID: 00000000-00003304) "netsh.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00003304) "netsh.exe" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00003304)36:T978,"SELECT * FROM CHUCVU WHERE MaCV = '" (Source: PO53623.exe, Indicator: "select * from chucvu where macv = '") "SELECT * FROM PHONGBAN" (Source: PO53623.exe, Indicator: "select * from phongban") "SELECT * FROM CHUCVU" (Source: PO53623.exe, Indicator: "select * from chucvu") "SELECT * FROM VITRICONGVIEC" (Source: PO53623.exe, Indicator: "select * from vitricongviec") "SELECT NV.MaNV,NV.HoTen FROM PHONGBAN AS PB, NHANVIEN AS NV where PB.TenPB = N'" (Source: PO53623.exe, Indicator: "select nv.manv,nv.hoten from phongban as pb, nhanvien as nv where pb.tenpb = n'") "SELECT * FROM NHANVIEN where BangCap = ''" (Source: PO53623.exe, Indicator: "select * from nhanvien where bangcap = ''") "SELECT * FROM NHANVIEN where BangCap=N'" (Source: PO53623.exe, Indicator: "select * from nhanvien where bangcap=n'") "SELECT * FROM NHANVIEN where DiaChi=N'" (Source: PO53623.exe, Indicator: "select * from nhanvien where diachi=n'") "select MaNV,HoTen,SDT,DiaChi from NHANVIEN where HoTen like '%" (Source: PO53623.exe, Indicator: "select manv,hoten,sdt,diachi from nhanvien where hoten like '%") "select MaNV,HoTen,SDT,DiaChi from NHANVIEN where MaNV = '" (Source: PO53623.exe, Indicator: "select manv,hoten,sdt,diachi from nhanvien where manv = '") "select MaCV as N'Mã chức vụ', TenCV as N'Tên chức vụ' from CHUCVU" (Source: 600000e-ChucVu~LoadAgain, Indicator: "select macv as n'mã chức vụ', tencv as n'tên chức vụ' from chucvu") "SELECT CASE WHEN EXISTS(SELECT * FROM PHONGBAN WHERE MaPB = '" (Source: 600007e-PhongBan~buttonThem_Click, Indicator: "select case when exists(select * from phongban where mapb = '") "SELECT DISTINCT BangCap FROM NHANVIEN" (Source: 6000098-TimKiemNhanVien~cbxTieuChi_TextChanged, Indicator: "select distinct bangcap from nhanvien") "select distinct DiaChi from NHANVIEN" (Source: 6000098-TimKiemNhanVien~cbxTieuChi_TextChanged, Indicator: "select distinct diachi from nhanvien") "SELECT MaVT as N'Mã vị trí', TenVT as N'Tên vị trí' FROM dbo.VITRICONGVIEC" (Source: 60000a4-Vitri~hienthi, Indicator: "select mavt as n'mã vị trí', tenvt as n'tên vị trí' from dbo.vitricongviec") "SELECT * FROM dbo.VITRICONGVIEC" (Source: 60000ac-Vitri~check1, Indicator: "select * from dbo.vitricongviec") "INSERT INTO dbo.VITRICONGVIEC (MaVT,TenVT) VALUES ('" (Source: 60000ad-Vitri~btn_save_Click, Indicator: "insert into dbo.vitricongviec (mavt,tenvt) values ('")37:T9d3,Found reference to API (Indicator: "OpenFile"; File: "PO53623.exe") Found reference to API (Indicator: "GetObject"; File: "PO53623.exe") Found reference to API (Indicator: "MessageBox"; File: "PO53623.exe") Found reference to API (Indicator: "NtAllocateVirtualMemory"; File: "00003392.00000D40.6261497.00401000.wprm") Found reference to API (Indicator: "Wow64DisableWow64FsRedirection"; File: "00003392.00000D40.6261497.00401000.wprm") Found reference to API (Indicator: "MessageBoxA"; File: "00003392.00000D40.6261497.00401000.wprm") Found reference to API (Indicator: "NtWriteVirtualMemory"; File: "00003392.00000D40.6261497.00401000.wprm") Found reference to API (Indicator: "NtProtectVirtualMemory"; File: "00003392.00000D40.6261497.00401000.wprm") Found reference to API (Indicator: "Wow64RevertWow64FsRedirection"; File: "00003392.00000D40.6261497.00401000.wprm") Found reference to API (Indicator: "RtlNtStatusToDosError"; File: "00003392.00000D40.6261497.00401000.wprm") Found reference to API (Indicator: "RtlSetLastWin32Error"; File: "00003392.00000D40.6261497.00401000.wprm") Found reference to API (Indicator: "RtlCreateUserThread"; File: "00003392.00000D40.6261497.00401000.wprm") Found reference to API (Indicator: "RtlAdjustPrivilege"; File: "00003392.00000D40.6261497.00401000.wprm") Found reference to API (Indicator: "NtRaiseHardError"; File: "00003392.00000D40.6261497.00401000.wprm") Found reference to API (Indicator: "FlsGetValue"; File: "00000000-00002880.00000001.70364.00F91000.00000040.mdmp") Found reference to API (Indicator: "FlsSetValue"; File: "00000000-00002880.00000001.70364.00F91000.00000040.mdmp") Found reference to API (Indicator: "OpenFile"; Source: "00000000-00001384.00000001.66184.01212000.00000020.mdmp") Found reference to API (Indicator: "GetObject"; Source: "00000000-00001384.00000001.66184.01212000.00000020.mdmp") Found reference to API (Indicator: "MessageBox"; Source: "00000000-00001384.00000001.66184.01212000.00000020.mdmp") Found reference to API (Indicator: "OpenFile"; Source: "00000000-00001472.00000000.66729.00F42000.00000020.mdmp") Found reference to API (Indicator: "GetObject"; Source: "00000000-00001472.00000000.66729.00F42000.00000020.mdmp, 00000000-00001472.00000001.67059.00590000.00000004.mdmp, 00000000-00001472.00000001.67059.05180000.00000004.mdmp") Found reference to API (Indicator: "MessageBox"; Source: "00000000-00001472.00000000.66729.00F42000.00000020.mdmp, 00000000-00001472.00000001.67059.05180000.00000004.mdmp")38:T433,"o enable assembly bind failure logging, set the registry value [HKLM\Software\Microsoft\Fusion!EnableLog] (DWORD) to 1." in Source: 00000000-00001384.00000000.66074.00380000.00000004.mdmp 00000000-00001384.00000001.66184.00380000.00000004.mdmp "o turn this feature off, remove the registry value [HKLM\Software\Microsoft\Fusion!EnableLog]." in Source: 00000000-00001384.00000000.66074.00380000.00000004.mdmp 00000000-00001384.00000001.66184.00380000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\" in Source: 00000000-00001384.00000001.66184.05200000.00000004.mdmp "o enable assembly bind failure logging, set the registry value [HKLM\Software\Microsoft\Fusion!EnableLog] (DWORD) to 1." in Source: 00000000-00001472.00000000.66729.00380000.00000004.mdmp 00000000-00001472.00000001.67059.00380000.00000004.mdmp "o turn this feature off, remove the registry value [HKLM\Software\Microsoft\Fusion!EnableLog]." in Source: 00000000-00001472.00000000.66729.00380000.00000004.mdmp 00000000-00001472.00000001.67059.00380000.00000004.mdmp39:T12c5,"PO53623.exe" failed to load missing module "api-ms-win-appmodel-runtime-l1-1-0.dll" - [base:0; Status:c0000135] "PO53623.exe" failed to load missing module "api-ms-win-core-fibers-l1-1-1" - [base:0; Status:c0000135] "PO53623.exe" failed to load missing module "api-ms-win-core-localization-l1-2-1" - [base:0; Status:c0000135] "PO53623.exe" failed to load missing module "api-ms-win-core-quirks-l1-1-0.dll" - [base:0; Status:c0000135] "PO53623.exe" failed to load missing module "api-ms-win-appmodel-runtime-l1-1-2.dll" - [base:0; Status:c0000135] "PO53623.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoree.dll" - [base:0; Status:c0000135] "PO53623.exe" failed to load missing module "%WINDIR%\system32\combase.dll" - [base:0; Status:c0000135] "PO53623.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\ole32.dll" - [base:0; Status:c0000135] "PO53623.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\uxtheme.dll" - [base:0; Status:c0000135] "PO53623.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll" - [base:0; Status:c0000135] "PO53623.exe" failed to load missing module "amsi.dll" - [base:0; Status:c0000135] "PO53623.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll" - [base:0; Status:c0000135] "PO53623.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "api-ms-win-core-fibers-l1-1-1" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "api-ms-win-core-localization-l1-2-1" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "api-ms-win-appmodel-runtime-l1-1-2.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "api-ms-win-appmodel-runtime-l1-1-0.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v2.0.50727\ole32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v2.0.50727\OLEAUT32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\assembly\GAC_MSIL\System\2.0.0.0__b77a5c561934e089\psapi.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\assembly\GAC_MSIL\System\2.0.0.0__b77a5c561934e089\ntdll.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\secur32.dll" - [base:0; Status:c0000135] "schtasks.exe" failed to load missing module "api-ms-win-core-fibers-l1-1-1" - [base:0; Status:c0000135] "schtasks.exe" failed to load missing module "api-ms-win-core-localization-l1-2-1" - [base:0; Status:c0000135] "Bins.exe" failed to load missing module "api-ms-win-core-fibers-l1-1-1" - [base:0; Status:c0000135] "Bins.exe" failed to load missing module "api-ms-win-core-localization-l1-2-1" - [base:0; Status:c0000135] "Bins.exe" failed to load missing module "api-ms-win-appmodel-runtime-l1-1-2.dll" - [base:0; Status:c0000135] "Bins.exe" failed to load missing module "api-ms-win-appmodel-runtime-l1-1-0.dll" - [base:0; Status:c0000135] "Bins.exe" failed to load missing module "api-ms-win-core-quirks-l1-1-0.dll" - [base:0; Status:c0000135] "Bins.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoree.dll" - [base:0; Status:c0000135] "Bins.exe" failed to load missing module "%WINDIR%\system32\combase.dll" - [base:0; Status:c0000135] "Bins.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\ole32.dll" - [base:0; Status:c0000135] "Bins.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\uxtheme.dll" - [base:0; Status:c0000135] "Bins.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll" - [base:0; Status:c0000135] "Bins.exe" failed to load missing module "amsi.dll" - [base:0; Status:c0000135] "Bins.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll" - [base:0; Status:c0000135] "Bins.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll" - [base:0; Status:c0000135] "24.exe" failed to load missing module "api-ms-win-appmodel-runtime-l1-1-2" - [base:0; Status:c0000135]3a:T48af,"GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAoFmyX1Sz2HlMxmMUd1OKM%3D HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.digicert.com" Response ==> HTTP/1.1 200 OK Accept-Ranges: bytes Age: 5945 Cache-Control: max-age=7200 Content-Type: application/ocsp-response Date: Wed 20 Dec 2023 08:30:51 GMT Last-Modified: Wed 20 Dec 2023 06:51:46 GMT Server: ECAcc (sac/2570) X-Cache: HIT Content-Length: 471 with response body ==>308201D30A0100A08201CC308201C806092B0601050507300101048201B9308201B530819EA216041403DE503556D14CBB66F0A3E21B1BC397B23DD155180F32....... "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQlOydjtpho0%2Bholo77zGjGxETUEQQU8JyF%2FaKffY%2FJaLvV1IlNHb7TkP8CEAHqRFnqJyQkmYqUpX34D7k%3D HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.digicert.com" Response ==> HTTP/1.1 200 OK Accept-Ranges: bytes Age: 1354 Cache-Control: max-age=7200 Content-Type: application/ocsp-response Date: Wed 20 Dec 2023 08:30:52 GMT Last-Modified: Wed 20 Dec 2023 08:08:19 GMT Server: ECAcc (sac/255F) X-Cache: HIT Content-Length: 727 with response body ==>308202D30A0100A08202CC308202C806092B0601050507300101048202B9308202B530819EA2160414F09C85FDA29F7D8FC968BBD5D4894D1DBED390FF180F32....... "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.digicert.com" Response ==> HTTP/1.1 200 OK Accept-Ranges: bytes Age: 4683 Cache-Control: max-age=7200 Content-Type: application/ocsp-response Date: Wed 20 Dec 2023 08:31:04 GMT Last-Modified: Wed 20 Dec 2023 07:13:01 GMT Server: ECAcc (sac/2551) X-Cache: HIT Content-Length: 471 with response body ==>308201D30A0100A08201CC308201C806092B0601050507300101048201B9308201B530819EA216041403DE503556D14CBB66F0A3E21B1BC397B23DD155180F32....... "GET /gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.pki.goog" Response ==> HTTP/1.1 200 OK Server: ocsp_responder Content-Length: 1445 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Date: Wed 20 Dec 2023 08:18:44 GMT Cache-Control: public max-age=14400 Content-Type: application/ocsp-response Age: 742 with response body ==>308205A10A0100A082059A3082059606092B0601050507300101048205873082058330819EA2160414D49BADF2AB3CB9FF1A3E0C506DCF192780868DAA180F32....... "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAbY2QTVWENG9oovp1QifsQ%3D HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.digicert.com" Response ==> HTTP/1.1 200 OK Accept-Ranges: bytes Age: 1661 Cache-Control: max-age=7200 Content-Type: application/ocsp-response Date: Wed 20 Dec 2023 08:31:06 GMT Last-Modified: Wed 20 Dec 2023 08:03:25 GMT Server: ECAcc (sac/254F) X-Cache: HIT Content-Length: 471 with response body ==>308201D30A0100A08201CC308201C806092B0601050507300101048201B9308201B530819EA216041403DE503556D14CBB66F0A3E21B1BC397B23DD155180F32....... "GET //MEowSDBGMEQwQjAJBgUrDgMCGgUABBSLwZ6EW5gdYc9UaSEaaLjjETNtkAQUv1%2B30c7dH4b0W1Ws3NcQwg6piOcCCQCnDkpMNIK3fw%3D%3D HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: o.ss2.us" Response ==> HTTP/1.1 200 OK Content-Type: application/ocsp-response Content-Length: 2065 Connection: keep-alive Server: Sucuri/Cloudproxy Date: Tue 19 Dec 2023 17:15:53 GMT X-Sucuri-ID: 11024 Content-Transfer-Encoding: Binary Cache-Control: public no-transform must-revalidate Last-Modified: Tue 19 Dec 2023 14:47:42 GMT Expires: Wed 20 Dec 2023 14:47:42 GMT ETag: "0bcab7c66868777bbb080396dd817c69379bcc9d" P3P: CP="IDC DSP COR LAW CUR ADM DEV TAI PSA PSD IVA IVD HIS OUR SAM PUB LEG UNI COM NAV STA" X-Sucuri-Cache: HIT X-Cache: Hit from cloudfront Via: 1.1 88734c1b1a8053ae83daf0f85731c788.cloudfront.net (CloudFront) X-Amz-Cf-Pop: SFO20-C1 X-Amz-Cf-Id: LqN2bD6lPbvGxO8BnZizJwkjKSnbw_ILziD06OHaMJzaM3zAYhceHg== Age: 54912 with response body ==>....... "GET /gtsr1/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBQwkcLWD4LqGJ7bE7B1XZsEbmfwUAQU5K8rJnEaK0gnhS9SZizv8IkTcT4CDQIDvFNZazTHGPUBUGY%3D HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.pki.goog" Response ==> HTTP/1.1 200 OK Server: ocsp_responder Content-Length: 724 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Date: Wed 20 Dec 2023 08:17:25 GMT Cache-Control: public max-age=14400 Content-Type: application/ocsp-response Age: 823 with response body ==>308202D00A0100A08202C9308202C506092B0601050507300101048202B6308202B230819BA2160414E4AF2B26711A2B4827852F52662CEFF08913713E180F32....... "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAbY2QTVWENG9oovp1QifsQ%3D HTTP/1.1 Cache-Control: max-age = 7200 Connection: Keep-Alive Accept: */* If-Modified-Since: Wed, 20 Dec 2023 08:03:25 GMT User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.digicert.com" Response ==> HTTP/1.1 304 Not Modified Accept-Ranges: bytes Age: 1663 Cache-Control: max-age=7200 Date: Wed 20 Dec 2023 08:31:08 GMT Last-Modified: Wed 20 Dec 2023 08:03:25 GMT Server: ECAcc (sac/254F) X-Cache: HIT with response body ==>....... "GET /gts1c3/QqFxbi9M48c.crl HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: crls.pki.goog" Response ==> HTTP/1.1 200 OK Accept-Ranges: bytes Content-Security-Policy-Report-Only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/cacerts Cross-Origin-Resource-Policy: cross-origin Cross-Origin-Opener-Policy: same-origin; report-to="cacerts" Report-To: {"group":"cacerts" "max_age":2592000 "endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/cacerts"}]} Content-Length: 17310 X-Content-Type-Options: nosniff Server: sffe X-XSS-Protection: 0 Date: Wed 20 Dec 2023 07:55:58 GMT Expires: Wed 20 Dec 2023 08:45:58 GMT Cache-Control: public max-age=3000 Age: 2110 Last-Modified: Wed 20 Dec 2023 05:17:03 GMT Content-Type: application/pkix-crl Vary: Accept-Encoding with response body ==>3082439A30824282020101300D06092A864886F70D01010B05003046310B300906035504061302555331223020060355040A1319476F6F676C65205472757374....... "GET /gts1c3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEGupzMnM%2BqGaCjIQPyd58u0%3D HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.pki.goog" Response ==> HTTP/1.1 200 OK Server: ocsp_responder Content-Length: 471 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Date: Wed 20 Dec 2023 07:58:30 GMT Cache-Control: public max-age=14400 Content-Type: application/ocsp-response Age: 1958 with response body ==>308201D30A0100A08201CC308201C806092B0601050507300101048201B9308201B530819EA21604148A747FAF85CDEE95CD3D9CD0E24614F371351D27180F32....... "GET /MFQwUjBQME4wTDAJBgUrDgMCGgUABBSIfaREXmfqfJR3TkMYnD7O5MhzEgQUnF8A36oB1zArOIiiuG1KnPIRkYMCEwZ%2FlEoqJ83z%2BsKuKwH5CO65xMY%3D HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.rootg2.amazontrust.com" Response ==> HTTP/1.1 200 OK Content-Type: application/ocsp-response Content-Length: 1548 Connection: keep-alive Date: Wed 20 Dec 2023 07:54:51 GMT Last-Modified: Wed 20 Dec 2023 07:54:51 GMT ETag: 4d4ac5c753a5e73f11fab72037c5c105aef7caae Expires: Wed 27 Dec 2023 07:54:51 GMT Cache-Control: max-age=302400 public no-transform must-revalidate Server: with response body ==>....... "GET /rootg2.crl HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: crl.rootg2.amazontrust.com" Response ==> HTTP/1.1 200 OK Content-Type: binary/octet-stream Content-Length: 713 Connection: keep-alive Last-Modified: Tue 12 Dec 2023 16:07:53 GMT x-amz-server-side-encryption: AES256 x-amz-version-id: KmUqfDvHR14kPY9rAFrRXNPQFtVuHwHK Accept-Ranges: bytes Server: AmazonS3 Date: Wed 20 Dec 2023 07:08:16 GMT ETag: "17529b3e2cbd518730e68190e9f121a9" Vary: Accept-Encoding X-Cache: Hit from cloudfront Via: 1.1 2160425a36a5a0604048dda5b151b504.cloudfront.net (CloudFront) X-Amz-Cf-Pop: SFO53-C1 X-Amz-Cf-Id: rlrkdR8MYFKzXA1BUNWuiBpLXHKwNX6Xm6VOpG3Ai0zXP2iwmwZhew== Age: 4973 with response body ==>....... "GET /gts1c3/moVDfISia2k.crl HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: crls.pki.goog" Response ==> HTTP/1.1 200 OK Accept-Ranges: bytes Content-Security-Policy-Report-Only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/cacerts Cross-Origin-Resource-Policy: cross-origin Cross-Origin-Opener-Policy: same-origin; report-to="cacerts" Report-To: {"group":"cacerts" "max_age":2592000 "endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/cacerts"}]} Content-Length: 18093 X-Content-Type-Options: nosniff Server: sffe X-XSS-Protection: 0 Date: Wed 20 Dec 2023 07:50:42 GMT Expires: Wed 20 Dec 2023 08:40:42 GMT Cache-Control: public max-age=3000 Age: 2426 Last-Modified: Wed 20 Dec 2023 06:08:47 GMT Content-Type: application/pkix-crl Vary: Accept-Encoding with response body ==>308246A930824591020101300D06092A864886F70D01010B05003046310B300906035504061302555331223020060355040A1319476F6F676C65205472757374....... "GET /gtsr1/gtsr1.crl HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: crl.pki.goog" Response ==> HTTP/1.1 200 OK Accept-Ranges: bytes Content-Security-Policy-Report-Only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/cacerts Cross-Origin-Resource-Policy: cross-origin Cross-Origin-Opener-Policy: same-origin; report-to="cacerts" Report-To: {"group":"cacerts" "max_age":2592000 "endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/cacerts"}]} Content-Length: 854 X-Content-Type-Options: nosniff Server: sffe X-XSS-Protection: 0 Date: Wed 20 Dec 2023 08:19:35 GMT Expires: Wed 20 Dec 2023 09:09:35 GMT Cache-Control: public max-age=3000 Age: 693 Last-Modified: Mon 18 Sep 2023 16:18:00 GMT Content-Type: application/pkix-crl Vary: Accept-Encoding with response body ==>308203523082013A020101300D06092A864886F70D01010B05003047310B300906035504061302555331223020060355040A1319476F6F676C65205472757374....... "GET /gts1c3/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEQCZXmpIP%2Bo%2BHhJmodADfw%2Fc HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.pki.goog" Response ==> HTTP/1.1 200 OK Server: ocsp_responder Content-Length: 472 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Date: Wed 20 Dec 2023 07:43:44 GMT Cache-Control: public max-age=14400 Content-Type: application/ocsp-response Age: 2844 with response body ==>308201D40A0100A08201CD308201C906092B0601050507300101048201BA308201B630819FA21604148A747FAF85CDEE95CD3D9CD0E24614F371351D27180F32....... "GET /rootca1.crl HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: crl.rootca1.amazontrust.com" Response ==> HTTP/1.1 200 OK Content-Type: binary/octet-stream Content-Length: 651 Connection: keep-alive Last-Modified: Tue 12 Dec 2023 16:05:31 GMT x-amz-server-side-encryption: AES256 x-amz-version-id: ohfF1zGEqFRI.EeXuWIFZpehQlNubevK Accept-Ranges: bytes Server: AmazonS3 Date: Wed 20 Dec 2023 05:44:28 GMT ETag: "9058c82ab542b2701eb78e0a4e482593" Vary: Accept-Encoding X-Cache: Hit from cloudfront Via: 1.1 e124ba8d7ba1d81e2fdc59ac89f11b70.cloudfront.net (CloudFront) X-Amz-Cf-Pop: SFO5-P2 X-Amz-Cf-Id: XDUZX1o-ixG_4CnXKXz7pqu1IchIIxh76uNBPiXogwEf6XtKOr1PQg== Age: 10001 with response body ==>....... "GET /MFQwUjBQME4wTDAJBgUrDgMCGgUABBRPWaOUU8%2B5VZ5%2Fa9jFTaU9pkK3FAQUhBjMhTTsvAyUlC4IWZzHshBOCggCEwdzEjgLnWaIozse2b%2BczaaODg8%3D HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.rootca1.amazontrust.com" Response ==> HTTP/1.1 200 OK Content-Type: application/ocsp-response Content-Length: 1426 Connection: keep-alive Date: Wed 20 Dec 2023 08:29:05 GMT Last-Modified: Wed 20 Dec 2023 08:29:05 GMT ETag: 95814ffd8bdfafd094d77abde00aeba3e16e1c83 Expires: Wed 27 Dec 2023 08:29:05 GMT Cache-Control: max-age=302400 public no-transform must-revalidate Server: with response body ==>....... "GET /script?space=50dd7b0f-4105-441f-8f60-18cc3fcb090c&type=direct&page_id=1580123&screen_width=750&screen_height=346&os=Win32&refurl=&pageurl=file%3A%2F%2FC%3A%5CUsers%5CHAPUBWS%5CAppData%5CRoaming%5Cjyo.rquAu.html&rnd=1703066602178 HTTP/1.1 Accept: application/javascript, */*;q=0.8 Accept-Language: en-US User-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like Gecko Accept-Encoding: gzip, deflate Host: serving.bepolite.eu DNT: 1 Connection: Keep-Alive" Response ==> HTTP/1.1 302 Found Date: Wed 20 Dec 2023 08:29:23 GMT Server: Varnish X-Varnish: 391125499 Location: https://serving.bepolite.eu/script?space=50dd7b0f-4105-441f-8f60-18cc3fcb090c&type=direct&page_id=1580123&screen_width=750&screen_height=346&os=Win32&refurl=&pageurl=file%3A%2F%2FC%3A%5CUsers%5CHAPUBWS%5CAppData%5CRoaming%5Cjyo.rquAu.html&rnd=1703066602178 Content-Length: 0 Connection: keep-alive with response body ==>....... "GET /script?space=50dd7b0f-4105-441f-8f60-18cc3fcb090c&type=direct&page_id=2640849&screen_width=750&screen_height=346&os=Win32&refurl=&pageurl=file%3A%2F%2FC%3A%5CUsers%5CHAPUBWS%5CAppData%5CRoaming%5CBJGIC..kG.html&rnd=1703067267588 HTTP/1.1 Accept: application/javascript, */*;q=0.8 Accept-Language: en-US User-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like Gecko Accept-Encoding: gzip, deflate Host: serving.bepolite.eu DNT: 1 Connection: Keep-Alive" Response ==> HTTP/1.1 302 Found Date: Wed 20 Dec 2023 08:29:23 GMT Server: Varnish X-Varnish: 389993867 Location: https://serving.bepolite.eu/script?space=50dd7b0f-4105-441f-8f60-18cc3fcb090c&type=direct&page_id=2640849&screen_width=750&screen_height=346&os=Win32&refurl=&pageurl=file%3A%2F%2FC%3A%5CUsers%5CHAPUBWS%5CAppData%5CRoaming%5CBJGIC..kG.html&rnd=1703067267588 Content-Length: 0 Connection: keep-alive with response body ==>....... "GET /gts1c3/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEQDHvwlxZ6tgTQmj1PR%2BmThA HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.pki.goog" Response ==> HTTP/1.1 200 OK Server: ocsp_responder Content-Length: 472 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Date: Wed 20 Dec 2023 07:36:47 GMT Cache-Control: public max-age=14400 Content-Type: application/ocsp-response Age: 3269 with response body ==>308201D40A0100A08201CD308201C906092B0601050507300101048201BA308201B630819FA21604148A747FAF85CDEE95CD3D9CD0E24614F371351D27180F32....... "GET /gts1c3/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEQDHvwlxZ6tgTQmj1PR%2BmThA HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.pki.goog" Response ==> HTTP/1.1 200 OK Server: ocsp_responder Content-Length: 472 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Date: Wed 20 Dec 2023 07:36:47 GMT Cache-Control: public max-age=14400 Content-Type: application/ocsp-response Age: 3270 with response body ==>308201D40A0100A08201CD308201C906092B0601050507300101048201BA308201B630819FA21604148A747FAF85CDEE95CD3D9CD0E24614F371351D27180F32....... "GET /gts1c3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEDEixfO34qnbCeE6N8VMp00%3D HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.pki.goog" Response ==> HTTP/1.1 200 OK Server: ocsp_responder Content-Length: 471 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Date: Wed 20 Dec 2023 07:57:44 GMT Cache-Control: public max-age=14400 Content-Type: application/ocsp-response Age: 2014 with response body ==>308201D30A0100A08201CC308201C806092B0601050507300101048201B9308201B530819EA21604148A747FAF85CDEE95CD3D9CD0E24614F371351D27180F32....... "GET /gts1c3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEDEixfO34qnbCeE6N8VMp00%3D HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.pki.goog" Response ==> HTTP/1.1 200 OK Server: ocsp_responder Content-Length: 471 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Date: Wed 20 Dec 2023 07:57:44 GMT Cache-Control: public max-age=14400 Content-Type: application/ocsp-response Age: 2015 with response body ==>308201D30A0100A08201CC308201C806092B0601050507300101048201B9308201B530819EA21604148A747FAF85CDEE95CD3D9CD0E24614F371351D27180F32....... "GET /script?space=50dd7b0f-4105-441f-8f60-18cc3fcb090c&type=direct&page_id=1439366&screen_width=750&screen_height=346&os=Win32&refurl=&pageurl=file%3A%2F%2FC%3A%5CUsers%5CHAPUBWS%5CAppData%5CRoaming%5CvHImy.oGI.html&rnd=1703068954450 HTTP/1.1 Accept: application/javascript, */*;q=0.8 Accept-Language: en-US User-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like Gecko Accept-Encoding: gzip, deflate Host: serving.bepolite.eu DNT: 1 Connection: Keep-Alive" Response ==> HTTP/1.1 302 Found Date: Wed 20 Dec 2023 08:29:32 GMT Server: Varnish X-Varnish: 390292945 Location: https://serving.bepolite.eu/script?space=50dd7b0f-4105-441f-8f60-18cc3fcb090c&type=direct&page_id=1439366&screen_width=750&screen_height=346&os=Win32&refurl=&pageurl=file%3A%2F%2FC%3A%5CUsers%5CHAPUBWS%5CAppData%5CRoaming%5CvHImy.oGI.html&rnd=1703068954450 Content-Length: 0 Connection: keep-alive with response body ==>....... "GET /script?space=50dd7b0f-4105-441f-8f60-18cc3fcb090c&type=direct&page_id=2535744&screen_width=750&screen_height=346&os=Win32&refurl=&pageurl=file%3A%2F%2FC%3A%5CUsers%5CHAPUBWS%5CAppData%5CRoaming%5Ck.hufeesg.html&rnd=1703070950363 HTTP/1.1 Accept: application/javascript, */*;q=0.8 Accept-Language: en-US User-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like Gecko Accept-Encoding: gzip, deflate Host: serving.bepolite.eu DNT: 1 Connection: Keep-Alive" Response ==> HTTP/1.1 302 Found Date: Wed 20 Dec 2023 08:29:39 GMT Server: Varnish X-Varnish: 390900718 Location: https://serving.bepolite.eu/script?space=50dd7b0f-4105-441f-8f60-18cc3fcb090c&type=direct&page_id=2535744&screen_width=750&screen_height=346&os=Win32&refurl=&pageurl=file%3A%2F%2FC%3A%5CUsers%5CHAPUBWS%5CAppData%5CRoaming%5Ck.hufeesg.html&rnd=1703070950363 Content-Length: 0 Connection: keep-alive with response body ==>.......3b:T8e57,"PO53623.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-0.DLL" at base 0 "PO53623.exe" loaded module "VERSION.DLL" at base 74d50000 "PO53623.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 70ed0000 "PO53623.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 0 "PO53623.exe" loaded module "KERNEL32" at base 77b10000 "PO53623.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 0 "PO53623.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\CLR.DLL" at base 65180000 "PO53623.exe" loaded module "USER32.DLL" at base 76610000 "PO53623.exe" loaded module "API-MS-WIN-CORE-QUIRKS-L1-1-0.DLL" at base 0 "PO53623.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-2.DLL" at base 0 "PO53623.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\MSCOREE.DLL" at base 0 "PO53623.exe" loaded module "MSCOREE.DLL" at base 725c0000 "PO53623.exe" loaded module "%WINDIR%\SYSTEM32\COMBASE.DLL" at base 0 "PO53623.exe" loaded module "PSAPI.DLL" at base 778c0000 "PO53623.exe" loaded module "KERNEL32.DLL" at base 77b10000 "PO53623.exe" loaded module "RPCRT4.DLL" at base 75c90000 "PO53623.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\MSCORLIB\36EACCFDE177C2E7B93B8DBDDE4E012A\MSCORLIB.NI.DLL" at base 63d70000 "PO53623.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\OLE32.DLL" at base 0 "PO53623.exe" loaded module "OLE32.DLL" at base 76b10000 "PO53623.exe" loaded module "CRYPTBASE.DLL" at base 757b0000 "PO53623.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 74360000 "PO53623.exe" loaded module "API-MS-WIN-CORE-XSTATE-L2-1-0.DLL" at base 72de0000 "PO53623.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\CLRJIT.DLL" at base 6bda0000 "PO53623.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM\2C3C912EA8F058F9D04C4650128FEB3F\SYSTEM.NI.DLL" at base 63310000 "PO53623.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.DRAWING\F7568D7F1B9D356F64779B4C0927CFB3\SYSTEM.DRAWING.NI.DLL" at base 6bab0000 "PO53623.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.WINDOWS.FORMS\C9A4CBC00F690A9E3CDDFC400F6E85BB\SYSTEM.WINDOWS.FORMS.NI.DLL" at base 624a0000 "PO53623.exe" loaded module "ADVAPI32.DLL" at base 778d0000 "PO53623.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM.WINDOWS.FORMS\V4.0_4.0.0.0__B77A5C561934E089\UXTHEME.DLL" at base 0 "PO53623.exe" loaded module "UXTHEME.DLL" at base 74360000 "PO53623.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.CORE\31FAE3290FAD30C31C98651462D22724\SYSTEM.CORE.NI.DLL" at base 61c80000 "PO53623.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.CONFIGURATION\96F7EDB07B12303F0EC2595C7F3778C7\SYSTEM.CONFIGURATION.NI.DLL" at base 65e60000 "PO53623.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.XML\15AF16D373CF0528CB74FC73D365FDBF\SYSTEM.XML.NI.DLL" at base 61500000 "PO53623.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\NLSSORTING.DLL" at base 6d8f0000 "PO53623.exe" loaded module "NTDLL.DLL" at base 779b0000 "PO53623.exe" loaded module "SHELL32.DLL" at base 76c70000 "PO53623.exe" loaded module "API-MS-WIN-SECURITY-SDDL-L1-1-0.DLL" at base 76050000 "PO53623.exe" loaded module "PROFAPI.DLL" at base 758c0000 "PO53623.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_32\MSCORLIB\V4.0_4.0.0.0__B77A5C561934E089\BCRYPT.DLL" at base 0 "PO53623.exe" loaded module "BCRYPT.DLL" at base 753d0000 "PO53623.exe" loaded module "CRYPTSP.DLL" at base 752c0000 "PO53623.exe" loaded module "%WINDIR%\SYSTEM32\RSAENH.DLL" at base 75050000 "PO53623.exe" loaded module "IMM32.DLL" at base 76760000 "PO53623.exe" loaded module "COMCTL32.DLL" at base 72050000 "PO53623.exe" loaded module "GDI32.DLL" at base 760d0000 "PO53623.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\MICROSOFT.V9921E851#\A891970B44DB9E340C3EF3EFA95B793C\MICROSOFT.VISUALBASIC.NI.DLL" at base 65c70000 "PO53623.exe" loaded module "GDIPLUS.DLL" at base 741c0000 "PO53623.exe" loaded module "%WINDIR%\WINSXS\X86_MICROSOFT.WINDOWS.GDIPLUS_6595B64144CCF1DF_1.1.7601.23894_NONE_5C0BE957A009922E\GDIPLUS.DLL" at base 741c0000 "PO53623.exe" loaded module "API-MS-WIN-CORE-LOCALREGISTRY-L1-1-0.DLL" at base 77b10000 "PO53623.exe" loaded module "WINDOWSCODECS.DLL" at base 73cc0000 "PO53623.exe" loaded module "AMSI.DLL" at base 0 "PO53623.exe" loaded module "NTDLL" at base 779b0000 "PO53623.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM\V4.0_4.0.0.0__B77A5C561934E089\NTDLL.DLL" at base 0 "PO53623.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_32\MSCORLIB\V4.0_4.0.0.0__B77A5C561934E089\SHELL32.DLL" at base 0 "PO53623.exe" loaded module "NTMARTA.DLL" at base 749d0000 "PO53623.exe" loaded module "SSPICLI.DLL" at base 75740000 "PO53623.exe" loaded module "PROPSYS.DLL" at base 744a0000 "PO53623.exe" loaded module "COMCTL32.DLL" at base 745a0000 "PO53623.exe" loaded module "OLEAUT32.DLL" at base 76780000 "PO53623.exe" loaded module "APPHELP.DLL" at base 75760000 "PO53623.exe" loaded module "CLBCATQ.DLL" at base 76120000 "PO53623.exe" loaded module "%WINDIR%\SYSTEM32\IEFRAME.DLL" at base 6a790000 "PO53623.exe" loaded module "SETUPAPI.DLL" at base 761b0000 "PO53623.exe" loaded module "%WINDIR%\SYSTEM32\PROPSYS.DLL" at base 744a0000 "PO53623.exe" loaded module "API-MS-WIN-DOWNLEVEL-ADVAPI32-L1-1-0.DLL" at base 758f0000 "PO53623.exe" loaded module "%WINDIR%\SYSTEM32\URLMON.DLL" at base 76420000 "PO53623.exe" loaded module "SECUR32.DLL" at base 755f0000 "PO53623.exe" loaded module "API-MS-WIN-DOWNLEVEL-SHLWAPI-L1-1-0.DLL" at base 758e0000 "PO53623.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 75760000 "PO53623.exe" loaded module "API-MS-WIN-SECURITY-LSALOOKUP-L1-1-0.DLL" at base 76050000 "PO53623.exe" loaded module "RPCRTREMOTE.DLL" at base 75850000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\SHELL32.DLL" at base 76c70000 "powershell.exe" loaded module "OLE32.DLL" at base 76b10000 "powershell.exe" loaded module "USERENV.DLL" at base 75900000 "powershell.exe" loaded module "API-MS-WIN-SECURITY-SDDL-L1-1-0.DLL" at base 76050000 "powershell.exe" loaded module "COMCTL32.DLL" at base 745a0000 "powershell.exe" loaded module "ADVAPI32.DLL" at base 778d0000 "powershell.exe" loaded module "KERNEL32.DLL" at base 77b10000 "powershell.exe" loaded module "SHELL32.DLL" at base 76c70000 "powershell.exe" loaded module "OLEAUT32.DLL" at base 76780000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\PROPSYS.DLL" at base 744a0000 "powershell.exe" loaded module "NTMARTA.DLL" at base 749d0000 "powershell.exe" loaded module "API-MS-WIN-CORE-LOCALREGISTRY-L1-1-0.DLL" at base 77b10000 "powershell.exe" loaded module "SETUPAPI.DLL" at base 761b0000 "powershell.exe" loaded module "RPCRT4.DLL" at base 75c90000 "powershell.exe" loaded module "APPHELP.DLL" at base 75760000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\SHDOCVW.DLL" at base 6f9a0000 "powershell.exe" loaded module "PROPSYS.DLL" at base 744a0000 "powershell.exe" loaded module "LINKINFO.DLL" at base 6fd70000 "powershell.exe" loaded module "PROFAPI.DLL" at base 758c0000 "powershell.exe" loaded module "USER32.DLL" at base 76610000 "powershell.exe" loaded module "NTSHRUI.DLL" at base 72f60000 "powershell.exe" loaded module "SRVCLI.DLL" at base 754d0000 "powershell.exe" loaded module "CSCAPI.DLL" at base 6fe20000 "powershell.exe" loaded module "SLC.DLL" at base 73c60000 "powershell.exe" loaded module "SHLWAPI.DLL" at base 75ff0000 "powershell.exe" loaded module "CRYPTSP.DLL" at base 752c0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\RSAENH.DLL" at base 75050000 "powershell.exe" loaded module "CRYPTBASE.DLL" at base 757b0000 "powershell.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 70ed0000 "powershell.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 0 "powershell.exe" loaded module "KERNEL32" at base 77b10000 "powershell.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 0 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\MSCOREEI.DLL" at base 72530000 "powershell.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-2.DLL" at base 0 "powershell.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-0.DLL" at base 0 "powershell.exe" loaded module "VERSION.DLL" at base 74d50000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V2.0.50727\MSCORWKS.DLL" at base 60f50000 "powershell.exe" loaded module "MSCOREE.DLL" at base 725c0000 "powershell.exe" loaded module "NTDLL" at base 779b0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\MSCOREE.DLL" at base 725c0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\MSCORLIB\9F895C66454577EFF9C77442D0C84F71\MSCORLIB.NI.DLL" at base 60450000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V2.0.50727\OLE32.DLL" at base 0 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V2.0.50727\OLEAUT32.DLL" at base 0 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\SYSTEM\AD92DAB7F418877D6A1E0358CE35658A\SYSTEM.NI.DLL" at base 65180000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\MICROSOFT.POWERSHEL#\8229F0505633D4BCEF019B9D4FAB9F18\MICROSOFT.POWERSHELL.CONSOLEHOST.NI.DLL" at base 6bbd0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\SYSTEM.MANAGEMENT.A#\84C47B5A5813A5F040AEE9715A0FF7C0\SYSTEM.MANAGEMENT.AUTOMATION.NI.DLL" at base 64900000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\GAC_MSIL\SYSTEM\2.0.0.0__B77A5C561934E089\PSAPI.DLL" at base 0 "powershell.exe" loaded module "PSAPI.DLL" at base 778c0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\GAC_MSIL\SYSTEM\2.0.0.0__B77A5C561934E089\NTDLL.DLL" at base 0 "powershell.exe" loaded module "NTDLL.DLL" at base 779b0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\SYSTEM.CORE\BD9FF1A4363781A57E8F7392F230A203\SYSTEM.CORE.NI.DLL" at base 646c0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\MICROSOFT.POWERSHEL#\49CAE79AC18BAD142E1AB5A46A8AC306\MICROSOFT.POWERSHELL.COMMANDS.DIAGNOSTICS.NI.DLL" at base 6bde0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\SYSTEM.CONFIGURATIO#\D6ACC39F6C1EA42D8B3150DB6184A969\SYSTEM.CONFIGURATION.INSTALL.NI.DLL" at base 734b0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\MICROSOFT.WSMAN.MAN#\7BF5729401CFF7EA7898124E9818ED20\MICROSOFT.WSMAN.MANAGEMENT.NI.DLL" at base 6bb40000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\SYSTEM.TRANSACTIONS\FEC007EA17AC8956CC5D6D4074DADA6A\SYSTEM.TRANSACTIONS.NI.DLL" at base 6a4c0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\GAC_32\SYSTEM.TRANSACTIONS\2.0.0.0__B77A5C561934E089\SYSTEM.TRANSACTIONS.DLL" at base 6bd30000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\MICROSOFT.POWERSHEL#\F1831CE4588265A3F72E0A581BA58F2A\MICROSOFT.POWERSHELL.COMMANDS.UTILITY.NI.DLL" at base 64520000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\MICROSOFT.POWERSHEL#\344E681515D07B93A4F1383F0D625E1E\MICROSOFT.POWERSHELL.COMMANDS.MANAGEMENT.NI.DLL" at base 64450000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\MICROSOFT.POWERSHEL#\573750F17B5B8316F04A10956FDD1D97\MICROSOFT.POWERSHELL.SECURITY.NI.DLL" at base 6bdb0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V2.0.50727\CULTURE.DLL" at base 72de0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\SYSTEM.XML\77C1DC46EA139BF5E1EAA9B87EF03C7A\SYSTEM.XML.NI.DLL" at base 63f10000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\SYSTEM.MANAGEMENT\00C2B464E52D4E82C04D61592A12A89D\SYSTEM.MANAGEMENT.NI.DLL" at base 63e00000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\SYSTEM.DIRECTORYSER#\237ED1739105C1BEBE48D41905FDB3EE\SYSTEM.DIRECTORYSERVICES.NI.DLL" at base 63ce0000 "powershell.exe" loaded module "SHFOLDER.DLL" at base 72de0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\GAC_32\MSCORLIB\2.0.0.0__B77A5C561934E089\SECUR32.DLL" at base 0 "powershell.exe" loaded module "SECUR32.DLL" at base 755f0000 "powershell.exe" loaded module "SSPICLI.DLL" at base 75740000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\SYSTEM.DATA\511C39D1EFA06D262A6B2F47E2726C73\SYSTEM.DATA.NI.DLL" at base 63680000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\GAC_32\SYSTEM.DATA\2.0.0.0__B77A5C561934E089\SYSTEM.DATA.DLL" at base 633a0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V2.0.50727\MSCORJIT.DLL" at base 6bae0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V2.0.50727\DIASYMREADER.DLL" at base 63310000 "powershell.exe" loaded module "GDI32.DLL" at base 760d0000 "powershell.exe" loaded module "NETUTILS.DLL" at base 73e90000 "schtasks.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 70ed0000 "schtasks.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 0 "schtasks.exe" loaded module "KERNEL32" at base 77b10000 "schtasks.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 0 "schtasks.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 73450000 "schtasks.exe" loaded module "KERNEL32.DLL" at base 77b10000 "schtasks.exe" loaded module "CRYPTBASE.DLL" at base 757b0000 "schtasks.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 74360000 "schtasks.exe" loaded module "RPCRT4.DLL" at base 75c90000 "schtasks.exe" loaded module "API-MS-WIN-SECURITY-LSALOOKUP-L1-1-0.DLL" at base 76050000 "schtasks.exe" loaded module "ADVAPI32.DLL" at base 778d0000 "schtasks.exe" loaded module "CLBCATQ.DLL" at base 76120000 "schtasks.exe" loaded module "%WINDIR%\SYSTEM32\TASKSCHD.DLL" at base 73ea0000 "schtasks.exe" loaded module "SSPICLI.DLL" at base 75740000 "PO53623.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 73450000 "PO53623.exe" loaded module "%WINDIR%\SYSTEM32\DEVENUM.DLL" at base 734e0000 "PO53623.exe" loaded module "WINTRUST.DLL" at base 75930000 "PO53623.exe" loaded module "MSDMO.DLL" at base 73840000 "PO53623.exe" loaded module "AVICAP32.DLL" at base 734c0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V2.0.50727\MSCORWKS.DLL" at base 60d30000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\MSCORLIB\9F895C66454577EFF9C77442D0C84F71\MSCORLIB.NI.DLL" at base 60230000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\SYSTEM\AD92DAB7F418877D6A1E0358CE35658A\SYSTEM.NI.DLL" at base 5fa80000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\MICROSOFT.POWERSHEL#\8229F0505633D4BCEF019B9D4FAB9F18\MICROSOFT.POWERSHELL.CONSOLEHOST.NI.DLL" at base 6bda0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\SYSTEM.MANAGEMENT.A#\84C47B5A5813A5F040AEE9715A0FF7C0\SYSTEM.MANAGEMENT.AUTOMATION.NI.DLL" at base 5ef10000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\SYSTEM.CORE\BD9FF1A4363781A57E8F7392F230A203\SYSTEM.CORE.NI.DLL" at base 5ecd0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\MICROSOFT.POWERSHEL#\49CAE79AC18BAD142E1AB5A46A8AC306\MICROSOFT.POWERSHELL.COMMANDS.DIAGNOSTICS.NI.DLL" at base 6bd30000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\SYSTEM.CONFIGURATIO#\D6ACC39F6C1EA42D8B3150DB6184A969\SYSTEM.CONFIGURATION.INSTALL.NI.DLL" at base 734a0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\MICROSOFT.WSMAN.MAN#\7BF5729401CFF7EA7898124E9818ED20\MICROSOFT.WSMAN.MANAGEMENT.NI.DLL" at base 65ee0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\SYSTEM.TRANSACTIONS\FEC007EA17AC8956CC5D6D4074DADA6A\SYSTEM.TRANSACTIONS.NI.DLL" at base 65cb0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\GAC_32\SYSTEM.TRANSACTIONS\2.0.0.0__B77A5C561934E089\SYSTEM.TRANSACTIONS.DLL" at base 6b540000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\MICROSOFT.POWERSHEL#\F1831CE4588265A3F72E0A581BA58F2A\MICROSOFT.POWERSHELL.COMMANDS.UTILITY.NI.DLL" at base 5eb30000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\MICROSOFT.POWERSHEL#\344E681515D07B93A4F1383F0D625E1E\MICROSOFT.POWERSHELL.COMMANDS.MANAGEMENT.NI.DLL" at base 5ea60000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\MICROSOFT.POWERSHEL#\573750F17B5B8316F04A10956FDD1D97\MICROSOFT.POWERSHELL.SECURITY.NI.DLL" at base 6cb80000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V2.0.50727\CULTURE.DLL" at base 72030000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\SYSTEM.XML\77C1DC46EA139BF5E1EAA9B87EF03C7A\SYSTEM.XML.NI.DLL" at base 5e520000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\SYSTEM.MANAGEMENT\00C2B464E52D4E82C04D61592A12A89D\SYSTEM.MANAGEMENT.NI.DLL" at base 5e410000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\SYSTEM.DIRECTORYSER#\237ED1739105C1BEBE48D41905FDB3EE\SYSTEM.DIRECTORYSERVICES.NI.DLL" at base 5e2f0000 "powershell.exe" loaded module "SHFOLDER.DLL" at base 72030000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\SYSTEM.DATA\511C39D1EFA06D262A6B2F47E2726C73\SYSTEM.DATA.NI.DLL" at base 5dc90000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\GAC_32\SYSTEM.DATA\2.0.0.0__B77A5C561934E089\SYSTEM.DATA.DLL" at base 5d9b0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V2.0.50727\MSCORJIT.DLL" at base 69000000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V2.0.50727\DIASYMREADER.DLL" at base 5d920000 "Bins.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 70ed0000 "Bins.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 0 "Bins.exe" loaded module "KERNEL32" at base 77b10000 "Bins.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 0 "Bins.exe" loaded module "ADVAPI32.DLL" at base 778d0000 "Bins.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\MSCOREEI.DLL" at base 72530000 "Bins.exe" loaded module "SHLWAPI.DLL" at base 75ff0000 "Bins.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-2.DLL" at base 0 "Bins.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-0.DLL" at base 0 "Bins.exe" loaded module "VERSION.DLL" at base 74d50000 "Bins.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\CLR.DLL" at base 649d0000 "Bins.exe" loaded module "USER32.DLL" at base 76610000 "Bins.exe" loaded module "API-MS-WIN-CORE-QUIRKS-L1-1-0.DLL" at base 0 "Bins.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\MSCOREE.DLL" at base 0 "Bins.exe" loaded module "MSCOREE.DLL" at base 725c0000 "Bins.exe" loaded module "%WINDIR%\SYSTEM32\COMBASE.DLL" at base 0 "Bins.exe" loaded module "PSAPI.DLL" at base 778c0000 "Bins.exe" loaded module "KERNEL32.DLL" at base 77b10000 "Bins.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\MSCORLIB\36EACCFDE177C2E7B93B8DBDDE4E012A\MSCORLIB.NI.DLL" at base 635c0000 "Bins.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\OLE32.DLL" at base 0 "Bins.exe" loaded module "RPCRT4.DLL" at base 75c90000 "Bins.exe" loaded module "OLE32.DLL" at base 76b10000 "Bins.exe" loaded module "CRYPTBASE.DLL" at base 757b0000 "Bins.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 74360000 "Bins.exe" loaded module "API-MS-WIN-CORE-XSTATE-L2-1-0.DLL" at base 734f0000 "Bins.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\CLRJIT.DLL" at base 6bbd0000 "Bins.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM\2C3C912EA8F058F9D04C4650128FEB3F\SYSTEM.NI.DLL" at base 62b60000 "Bins.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.DRAWING\F7568D7F1B9D356F64779B4C0927CFB3\SYSTEM.DRAWING.NI.DLL" at base 6ba20000 "Bins.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.WINDOWS.FORMS\C9A4CBC00F690A9E3CDDFC400F6E85BB\SYSTEM.WINDOWS.FORMS.NI.DLL" at base 61cf0000 "Bins.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM.WINDOWS.FORMS\V4.0_4.0.0.0__B77A5C561934E089\UXTHEME.DLL" at base 0 "Bins.exe" loaded module "UXTHEME.DLL" at base 74360000 "Bins.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.CORE\31FAE3290FAD30C31C98651462D22724\SYSTEM.CORE.NI.DLL" at base 614d0000 "Bins.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.CONFIGURATION\96F7EDB07B12303F0EC2595C7F3778C7\SYSTEM.CONFIGURATION.NI.DLL" at base 65d50000 "Bins.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.XML\15AF16D373CF0528CB74FC73D365FDBF\SYSTEM.XML.NI.DLL" at base 651b0000 "Bins.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\NLSSORTING.DLL" at base 734d0000 "Bins.exe" loaded module "NTDLL.DLL" at base 779b0000 "Bins.exe" loaded module "SHELL32.DLL" at base 76c70000 "Bins.exe" loaded module "API-MS-WIN-SECURITY-SDDL-L1-1-0.DLL" at base 76050000 "Bins.exe" loaded module "PROFAPI.DLL" at base 758c0000 "Bins.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_32\MSCORLIB\V4.0_4.0.0.0__B77A5C561934E089\BCRYPT.DLL" at base 0 "Bins.exe" loaded module "BCRYPT.DLL" at base 753d0000 "Bins.exe" loaded module "CRYPTSP.DLL" at base 752c0000 "Bins.exe" loaded module "%WINDIR%\SYSTEM32\RSAENH.DLL" at base 75050000 "Bins.exe" loaded module "IMM32.DLL" at base 76760000 "Bins.exe" loaded module "COMCTL32.DLL" at base 72050000 "Bins.exe" loaded module "GDI32.DLL" at base 760d0000 "Bins.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\MICROSOFT.V9921E851#\A891970B44DB9E340C3EF3EFA95B793C\MICROSOFT.VISUALBASIC.NI.DLL" at base 612e0000 "Bins.exe" loaded module "GDIPLUS.DLL" at base 741c0000 "Bins.exe" loaded module "%WINDIR%\WINSXS\X86_MICROSOFT.WINDOWS.GDIPLUS_6595B64144CCF1DF_1.1.7601.23894_NONE_5C0BE957A009922E\GDIPLUS.DLL" at base 741c0000 "Bins.exe" loaded module "API-MS-WIN-CORE-LOCALREGISTRY-L1-1-0.DLL" at base 77b10000 "Bins.exe" loaded module "WINDOWSCODECS.DLL" at base 73cc0000 "Bins.exe" loaded module "AMSI.DLL" at base 0 "Bins.exe" loaded module "NTDLL" at base 779b0000 "Bins.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM\V4.0_4.0.0.0__B77A5C561934E089\NTDLL.DLL" at base 0 "Bins.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_32\MSCORLIB\V4.0_4.0.0.0__B77A5C561934E089\SHELL32.DLL" at base 0 "Bins.exe" loaded module "PROPSYS.DLL" at base 744a0000 "Bins.exe" loaded module "COMCTL32.DLL" at base 745a0000 "Bins.exe" loaded module "OLEAUT32.DLL" at base 76780000 "Bins.exe" loaded module "APPHELP.DLL" at base 75760000 "Bins.exe" loaded module "CLBCATQ.DLL" at base 76120000 "Bins.exe" loaded module "%WINDIR%\SYSTEM32\IEFRAME.DLL" at base 6a790000 "Bins.exe" loaded module "%WINDIR%\SYSTEM32\PROPSYS.DLL" at base 744a0000 "Bins.exe" loaded module "NTMARTA.DLL" at base 749d0000 "Bins.exe" loaded module "SETUPAPI.DLL" at base 761b0000 "Bins.exe" loaded module "API-MS-WIN-DOWNLEVEL-ADVAPI32-L1-1-0.DLL" at base 758f0000 "Bins.exe" loaded module "%WINDIR%\SYSTEM32\URLMON.DLL" at base 76420000 "Bins.exe" loaded module "SECUR32.DLL" at base 755f0000 "Bins.exe" loaded module "API-MS-WIN-DOWNLEVEL-SHLWAPI-L1-1-0.DLL" at base 758e0000 "Bins.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 75760000 "Bins.exe" loaded module "API-MS-WIN-SECURITY-LSALOOKUP-L1-1-0.DLL" at base 76050000 "Bins.exe" loaded module "RPCRTREMOTE.DLL" at base 75850000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 74360000 "powershell.exe" loaded module "CLBCATQ.DLL" at base 76120000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V2.0.50727\MSCORWKS.DLL" at base 60780000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\MSCORLIB\9F895C66454577EFF9C77442D0C84F71\MSCORLIB.NI.DLL" at base 64e30000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\SYSTEM\AD92DAB7F418877D6A1E0358CE35658A\SYSTEM.NI.DLL" at base 64680000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\SYSTEM.MANAGEMENT.A#\84C47B5A5813A5F040AEE9715A0FF7C0\SYSTEM.MANAGEMENT.AUTOMATION.NI.DLL" at base 63b10000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\SYSTEM.CORE\BD9FF1A4363781A57E8F7392F230A203\SYSTEM.CORE.NI.DLL" at base 65c90000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\SYSTEM.CONFIGURATIO#\D6ACC39F6C1EA42D8B3150DB6184A969\SYSTEM.CONFIGURATION.INSTALL.NI.DLL" at base 6cb80000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\SYSTEM.TRANSACTIONS\FEC007EA17AC8956CC5D6D4074DADA6A\SYSTEM.TRANSACTIONS.NI.DLL" at base 6baa0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\MICROSOFT.POWERSHEL#\F1831CE4588265A3F72E0A581BA58F2A\MICROSOFT.POWERSHELL.COMMANDS.UTILITY.NI.DLL" at base 63970000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\MICROSOFT.POWERSHEL#\344E681515D07B93A4F1383F0D625E1E\MICROSOFT.POWERSHELL.COMMANDS.MANAGEMENT.NI.DLL" at base 6a490000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V2.0.50727\CULTURE.DLL" at base 734b0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\SYSTEM.XML\77C1DC46EA139BF5E1EAA9B87EF03C7A\SYSTEM.XML.NI.DLL" at base 63430000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\SYSTEM.MANAGEMENT\00C2B464E52D4E82C04D61592A12A89D\SYSTEM.MANAGEMENT.NI.DLL" at base 63320000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\SYSTEM.DIRECTORYSER#\237ED1739105C1BEBE48D41905FDB3EE\SYSTEM.DIRECTORYSERVICES.NI.DLL" at base 63200000 "powershell.exe" loaded module "SHFOLDER.DLL" at base 734b0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\SYSTEM.DATA\511C39D1EFA06D262A6B2F47E2726C73\SYSTEM.DATA.NI.DLL" at base 62ba0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\GAC_32\SYSTEM.DATA\2.0.0.0__B77A5C561934E089\SYSTEM.DATA.DLL" at base 628c0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V2.0.50727\MSCORJIT.DLL" at base 6ba40000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V2.0.50727\DIASYMREADER.DLL" at base 62830000 "Bins.exe" loaded module "%WINDIR%\SYSTEM32\DEVENUM.DLL" at base 734c0000 "Bins.exe" loaded module "WINTRUST.DLL" at base 75930000 "Bins.exe" loaded module "MSDMO.DLL" at base 734f0000 "Bins.exe" loaded module "AVICAP32.DLL" at base 734a0000 "Bins.exe" loaded module "%WINDIR%\SYSTEM32\MSWSOCK.DLL" at base 75280000 "Bins.exe" loaded module "%WINDIR%\SYSTEM32\WSHTCPIP.DLL" at base 74de0000 "Bins.exe" loaded module "WS2_32.DLL" at base 76570000 "Bins.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\WBEMPROX.DLL" at base 6e2b0000 "Bins.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\WBEMSVC.DLL" at base 6d620000 "Bins.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\FASTPROX.DLL" at base 6e520000 "Bins.exe" loaded module "SAMLIB.DLL" at base 74470000 "Bins.exe" loaded module "API-MS-WIN-DOWNLEVEL-SHLWAPI-L2-1-0.DLL" at base 68fc0000 "Bins.exe" loaded module "API-MS-WIN-DOWNLEVEL-ADVAPI32-L2-1-0.DLL" at base 71b10000 "Bins.exe" loaded module "API-MS-WIN-DOWNLEVEL-OLE32-L1-1-0.DLL" at base 75960000 "Bins.exe" loaded module "WINHTTP.DLL" at base 71ca0000 "Bins.exe" loaded module "CRYPT32.DLL" at base 759f0000 "Bins.exe" loaded module "USERENV.DLL" at base 75900000 "Bins.exe" loaded module "%WINDIR%\SYSTEM32\WSHIP6.DLL" at base 75270000 "Bins.exe" loaded module "IPHLPAPI.DLL" at base 73c10000 "Bins.exe" loaded module "DNSAPI.DLL" at base 75140000 "Bins.exe" loaded module "DHCPCSVC6.DLL" at base 73b20000 "Bins.exe" loaded module "DHCPCSVC.DLL" at base 73a50000 "Bins.exe" loaded module "%WINDIR%\SYSTEM32\NETPROFM.DLL" at base 6db80000 "Bins.exe" loaded module "RASADHLP.DLL" at base 71f40000 "Bins.exe" loaded module "URLMON.DLL" at base 76420000 "Bins.exe" loaded module "%WINDIR%\SYSTEM32\NPMPROXY.DLL" at base 6cbb0000 "Bins.exe" loaded module "%WINDIR%\SYSTEM32\OLEAUT32.DLL" at base 76780000 "Bins.exe" loaded module "%WINDIR%\SYSTEM32\WININET.DLL" at base 75d40000 "Bins.exe" loaded module "%WINDIR%\SYSTEM32\FWPUCLNT.DLL" at base 73b40000 "Bins.exe" loaded module "%WINDIR%\SYSTEM32\WS2_32" at base 76570000 "Bins.exe" loaded module "CREDSSP.DLL" at base 74f80000 "Bins.exe" loaded module "%WINDIR%\SYSTEM32\SCHANNEL.DLL" at base 750c0000 "Bins.exe" loaded module "NCRYPT.DLL" at base 753f0000 "Bins.exe" loaded module "%WINDIR%\SYSTEM32\BCRYPTPRIMITIVES.DLL" at base 74f90000 "Bins.exe" loaded module "GPAPI.DLL" at base 74e90000 "Bins.exe" loaded module "API-MS-WIN-SERVICE-MANAGEMENT-L1-1-0.DLL" at base 76050000 "Bins.exe" loaded module "API-MS-WIN-SERVICE-MANAGEMENT-L2-1-0.DLL" at base 76050000 "Bins.exe" loaded module "%WINDIR%\SYSTEM32\CRYPTNET.DLL" at base 71f20000 "Bins.exe" loaded module "CRYPTNET.DLL" at base 71f20000 "Bins.exe" loaded module "SENSAPI.DLL" at base 734e0000 "Bins.exe" loaded module "SSPICLI.DLL" at base 75740000 "Bins.exe" loaded module "NSI.DLL" at base 76070000 "Bins.exe" loaded module "CFGMGR32.DLL" at base 75970000 "Bins.exe" loaded module "API-MS-WIN-SERVICE-WINSVC-L1-1-0.DLL" at base 76050000 "Bins.exe" loaded module "%WINDIR%\SYSTEM32\CRYPT32.DLL" at base 759f0000 "Bins.exe" loaded module "%WINDIR%\SYSTEM32\SHDOCVW.DLL" at base 6f9a0000 "Bins.exe" loaded module "%WINDIR%\SYSTEM32\SHELL32.DLL" at base 76c70000 "Bins.exe" loaded module "%PROGRAMFILES%\INTERNET EXPLORER\IEPROXY.DLL" at base 6be30000 "Bins.exe" loaded module "IERTUTIL.DLL" at base 76820000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V2.0.50727\MSCORWKS.DLL" at base 65380000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\MSCORLIB\9F895C66454577EFF9C77442D0C84F71\MSCORLIB.NI.DLL" at base 64880000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\SYSTEM\AD92DAB7F418877D6A1E0358CE35658A\SYSTEM.NI.DLL" at base 640d0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\SYSTEM.MANAGEMENT.A#\84C47B5A5813A5F040AEE9715A0FF7C0\SYSTEM.MANAGEMENT.AUTOMATION.NI.DLL" at base 63850000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\SYSTEM.CORE\BD9FF1A4363781A57E8F7392F230A203\SYSTEM.CORE.NI.DLL" at base 63610000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\SYSTEM.CONFIGURATIO#\D6ACC39F6C1EA42D8B3150DB6184A969\SYSTEM.CONFIGURATION.INSTALL.NI.DLL" at base 6bb90000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\MICROSOFT.WSMAN.MAN#\7BF5729401CFF7EA7898124E9818ED20\MICROSOFT.WSMAN.MANAGEMENT.NI.DLL" at base 6bb00000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\SYSTEM.TRANSACTIONS\FEC007EA17AC8956CC5D6D4074DADA6A\SYSTEM.TRANSACTIONS.NI.DLL" at base 6ba60000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\GAC_32\SYSTEM.TRANSACTIONS\2.0.0.0__B77A5C561934E089\SYSTEM.TRANSACTIONS.DLL" at base 6ba10000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\MICROSOFT.POWERSHEL#\F1831CE4588265A3F72E0A581BA58F2A\MICROSOFT.POWERSHELL.COMMANDS.UTILITY.NI.DLL" at base 63470000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\MICROSOFT.POWERSHEL#\344E681515D07B93A4F1383F0D625E1E\MICROSOFT.POWERSHELL.COMMANDS.MANAGEMENT.NI.DLL" at base 633a0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V2.0.50727\CULTURE.DLL" at base 734a0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\SYSTEM.XML\77C1DC46EA139BF5E1EAA9B87EF03C7A\SYSTEM.XML.NI.DLL" at base 62e60000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\SYSTEM.MANAGEMENT\00C2B464E52D4E82C04D61592A12A89D\SYSTEM.MANAGEMENT.NI.DLL" at base 62d50000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\SYSTEM.DIRECTORYSER#\237ED1739105C1BEBE48D41905FDB3EE\SYSTEM.DIRECTORYSERVICES.NI.DLL" at base 62c30000 "powershell.exe" loaded module "SHFOLDER.DLL" at base 734a0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\SYSTEM.DATA\511C39D1EFA06D262A6B2F47E2726C73\SYSTEM.DATA.NI.DLL" at base 625d0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\GAC_32\SYSTEM.DATA\2.0.0.0__B77A5C561934E089\SYSTEM.DATA.DLL" at base 622f0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V2.0.50727\MSCORJIT.DLL" at base 6b530000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V2.0.50727\DIASYMREADER.DLL" at base 6a4d0000 "24.exe" loaded module "KERNEL32.DLL" at base 77b10000 "24.exe" loaded module "%WINDIR%\SYSTEM32\MSWSOCK.DLL" at base 75280000 "24.exe" loaded module "%WINDIR%\SYSTEM32\WSHTCPIP.DLL" at base 74de0000 "24.exe" loaded module "DHCPCSVC6.DLL" at base 73b20000 "24.exe" loaded module "IPHLPAPI.DLL" at base 73c10000 "24.exe" loaded module "RPCRT4.DLL" at base 75c90000 "24.exe" loaded module "DHCPCSVC.DLL" at base 73a50000 "24.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-2" at base 0 "netsh.exe" loaded module "NSHWFP.DLL" at base 6ba00000 "netsh.exe" loaded module "DHCPCMONITOR.DLL" at base 734a0000 "netsh.exe" loaded module "WSHELPER.DLL" at base 72030000 "netsh.exe" loaded module "KERNEL32.DLL" at base 77b10000 "netsh.exe" loaded module "NSHHTTP.DLL" at base 6cb70000 "netsh.exe" loaded module "FWCFG.DLL" at base 6bdb0000 "netsh.exe" loaded module "AUTHFWCFG.DLL" at base 6b530000 "netsh.exe" loaded module "API-MS-WIN-CORE-LOCALREGISTRY-L1-1-0.DLL" at base 77b10000 "netsh.exe" loaded module "IFMON.DLL" at base 6be90000 "netsh.exe" loaded module "NETIOHLP.DLL" at base 6b4b0000 "netsh.exe" loaded module "WHHELPER.DLL" at base 6bda0000 "netsh.exe" loaded module "HNETMON.DLL" at base 6b9f0000 "netsh.exe" loaded module "RPCNSH.DLL" at base 6b9e0000 "netsh.exe" loaded module "DOT3CFG.DLL" at base 6b680000 "netsh.exe" loaded module "NAPMONTR.DLL" at base 6a480000 "netsh.exe" loaded module "NSHIPSEC.DLL" at base 68fe0000 "netsh.exe" loaded module "RPCRT4.DLL" at base 75c90000 "netsh.exe" loaded module "NETTRACE.DLL" at base 65e10000 "netsh.exe" loaded module "WCNNETSH.DLL" at base 6b520000 "netsh.exe" loaded module "P2PNETSH.DLL" at base 690d0000 "netsh.exe" loaded module "WLANCFG.DLL" at base 65c50000 "netsh.exe" loaded module "WWANCFG.DLL" at base 6b500000 "netsh.exe" loaded module "PEERDISTSH.DLL" at base 65860000 "netsh.exe" loaded module "OLE32.DLL" at base 76b10000 "netsh.exe" loaded module "CRYPTBASE.DLL" at base 757b0000 "netsh.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 74360000 "netsh.exe" loaded module "CRYPTSP.DLL" at base 752c0000 "netsh.exe" loaded module "USER32.DLL" at base 76610000 "netsh.exe" loaded module "CLBCATQ.DLL" at base 76120000 "netsh.exe" loaded module "%WINDIR%\SYSTEM32\QAGENT.DLL" at base 727c0000 "netsh.exe" loaded module "ADVAPI32.DLL" at base 778d0000 "netsh.exe" loaded module "API-MS-WIN-SERVICE-MANAGEMENT-L1-1-0.DLL" at base 76050000 "netsh.exe" loaded module "API-MS-WIN-SERVICE-MANAGEMENT-L2-1-0.DLL" at base 76050000 "netsh.exe" loaded module "API-MS-WIN-SERVICE-WINSVC-L1-1-0.DLL" at base 76050000 "netsh.exe" loaded module "API-MS-WIN-SECURITY-LSALOOKUP-L1-1-0.DLL" at base 76050000 "netsh.exe" loaded module "%WINDIR%\SYSTEM32\RSAENH.DLL" at base 75050000 "netsh.exe" loaded module "RPCRTREMOTE.DLL" at base 75850000 "netsh.exe" loaded module "HTTPAPI.DLL" at base 6ffa0000 "netsh.exe" loaded module "USERENV.DLL" at base 75900000 "netsh.exe" loaded module "GPAPI.DLL" at base 74e90000 "netsh.exe" loaded module "%WINDIR%\SYSTEM32\BCRYPTPRIMITIVES.DLL" at base 74f90000 "netsh.exe" loaded module "OLEAUT32.DLL" at base 767800003c:T978,"SELECT * FROM CHUCVU WHERE MaCV = '" (Source: PO53623.exe, Indicator: "select * from chucvu where macv = '") "SELECT * FROM PHONGBAN" (Source: PO53623.exe, Indicator: "select * from phongban") "SELECT * FROM CHUCVU" (Source: PO53623.exe, Indicator: "select * from chucvu") "SELECT * FROM VITRICONGVIEC" (Source: PO53623.exe, Indicator: "select * from vitricongviec") "SELECT NV.MaNV,NV.HoTen FROM PHONGBAN AS PB, NHANVIEN AS NV where PB.TenPB = N'" (Source: PO53623.exe, Indicator: "select nv.manv,nv.hoten from phongban as pb, nhanvien as nv where pb.tenpb = n'") "SELECT * FROM NHANVIEN where BangCap = ''" (Source: PO53623.exe, Indicator: "select * from nhanvien where bangcap = ''") "SELECT * FROM NHANVIEN where BangCap=N'" (Source: PO53623.exe, Indicator: "select * from nhanvien where bangcap=n'") "SELECT * FROM NHANVIEN where DiaChi=N'" (Source: PO53623.exe, Indicator: "select * from nhanvien where diachi=n'") "select MaNV,HoTen,SDT,DiaChi from NHANVIEN where HoTen like '%" (Source: PO53623.exe, Indicator: "select manv,hoten,sdt,diachi from nhanvien where hoten like '%") "select MaNV,HoTen,SDT,DiaChi from NHANVIEN where MaNV = '" (Source: PO53623.exe, Indicator: "select manv,hoten,sdt,diachi from nhanvien where manv = '") "select MaCV as N'Mã chức vụ', TenCV as N'Tên chức vụ' from CHUCVU" (Source: 600000e-ChucVu~LoadAgain, Indicator: "select macv as n'mã chức vụ', tencv as n'tên chức vụ' from chucvu") "SELECT CASE WHEN EXISTS(SELECT * FROM PHONGBAN WHERE MaPB = '" (Source: 600007e-PhongBan~buttonThem_Click, Indicator: "select case when exists(select * from phongban where mapb = '") "SELECT DISTINCT BangCap FROM NHANVIEN" (Source: 6000098-TimKiemNhanVien~cbxTieuChi_TextChanged, Indicator: "select distinct bangcap from nhanvien") "select distinct DiaChi from NHANVIEN" (Source: 6000098-TimKiemNhanVien~cbxTieuChi_TextChanged, Indicator: "select distinct diachi from nhanvien") "SELECT MaVT as N'Mã vị trí', TenVT as N'Tên vị trí' FROM dbo.VITRICONGVIEC" (Source: 60000a4-Vitri~hienthi, Indicator: "select mavt as n'mã vị trí', tenvt as n'tên vị trí' from dbo.vitricongviec") "SELECT * FROM dbo.VITRICONGVIEC" (Source: 60000ac-Vitri~check1, Indicator: "select * from dbo.vitricongviec") "INSERT INTO dbo.VITRICONGVIEC (MaVT,TenVT) VALUES ('" (Source: 60000ad-Vitri~btn_save_Click, Indicator: "insert into dbo.vitricongviec (mavt,tenvt) values ('")3d:T1a2f,"PO53623.exe" touched "Computer" (Path: "HKCU\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\SHELLFOLDER") "PO53623.exe" touched "Network" (Path: "HKCU\CLSID\{208D2C60-3AEA-1069-A2D7-08002B30309D}\SHELLFOLDER") "PO53623.exe" touched "Recycle Bin" (Path: "HKCU\CLSID\{645FF040-5081-101B-9F08-00AA002F954E}\SHELLFOLDER") "PO53623.exe" touched "Control Panel" (Path: "HKCU\CLSID\{26EE0668-A00A-44D7-9371-BEB064C98683}\SHELLFOLDER") "PO53623.exe" touched "UsersFiles" (Path: "HKCU\CLSID\{59031A47-3F72-44A7-89C5-5595FE6B30EE}\SHELLFOLDER") "PO53623.exe" touched "UsersLibraries" (Path: "HKCU\CLSID\{031E4825-7B94-4DC3-B131-E946B44C8DD5}\SHELLFOLDER") "PO53623.exe" touched "CLSID_SearchFolder" (Path: "HKCU\CLSID\{04731B67-D933-450A-90E6-4ACD2E9408FE}\SHELLFOLDER") "PO53623.exe" touched "Microsoft OneNote Namespace Extension for Windows Desktop Search" (Path: "HKCU\CLSID\{0875DCB6-C686-4243-9432-ADCCF0B9F2D7}\SHELLFOLDER") "PO53623.exe" touched "IE History and Feeds Shell Data Source for Windows Search" (Path: "HKCU\CLSID\{11016101-E366-4D22-BC06-4ADA335C892B}\SHELLFOLDER") "PO53623.exe" touched "@C:\Program Files (x86)\Microsoft Office\Office15\MAPISHELL.DLL,-110" (Path: "HKCU\CLSID\{138508BC-1E03-49EA-9C8F-EA9E1D05D65D}\SHELLFOLDER") "PO53623.exe" touched "Public Folder" (Path: "HKCU\CLSID\{4336A54D-038B-4685-AB02-99BB52D3FB8B}\SHELLFOLDER") "PO53623.exe" touched "Control Panel command object for Start menu and desktop" (Path: "HKCU\CLSID\{5399E694-6CE5-4D6C-8FCE-1D8870FDCBA0}\SHELLFOLDER") "PO53623.exe" touched "@%systemroot%\system32\mssvp.dll,-110" (Path: "HKCU\CLSID\{89D83576-6BD1-4C86-9454-BEB04E94C819}\SHELLFOLDER") "PO53623.exe" touched "DXP" (Path: "HKCU\CLSID\{8FD8B88D-30E1-4F25-AC2B-553D3D65F0EA}\SHELLFOLDER") "PO53623.exe" touched "CLSID_SearchHome" (Path: "HKCU\CLSID\{9343812E-1C37-4A49-A12E-4B2D810D956B}\SHELLFOLDER") "PO53623.exe" touched "Windows Search Service Media Center Namespace Extension Handler" (Path: "HKCU\CLSID\{98D99750-0B8A-4C59-9151-589053683D73}\SHELLFOLDER") "PO53623.exe" touched "Other Users Folder" (Path: "HKCU\CLSID\{B4FB3F98-C1EA-428D-A78A-D1F5659CBA93}\SHELLFOLDER") "PO53623.exe" touched "@%systemroot%\system32\mssvp.dll,-112" (Path: "HKCU\CLSID\{BD7A2E7B-21CB-41B2-A086-B309680C6B7E}\SHELLFOLDER") "PO53623.exe" touched "CLSID_StartMenuProviderFolder" (Path: "HKCU\CLSID\{DAF95313-E44D-46AF-BE1B-CBACEA2C3065}\SHELLFOLDER") "PO53623.exe" touched "CLSID_StartMenuPathCompleteProviderFolder" (Path: "HKCU\CLSID\{E345F35F-9397-435C-8F95-4E922C26259E}\SHELLFOLDER") "PO53623.exe" touched "Games Explorer" (Path: "HKCU\CLSID\{ED228FDF-9EA8-4870-83B1-96B02CFE0D52}\SHELLFOLDER") "PO53623.exe" touched "Computers and Devices" (Path: "HKCU\CLSID\{F02C1A0D-BE21-4350-88B0-7367FC96EF3C}\SHELLFOLDER") "PO53623.exe" touched "Sticky Notes Namespace Extension for Windows Desktop Search" (Path: "HKCU\CLSID\{F3F5824C-AD58-4728-AF59-A1EBE3392799}\SHELLFOLDER") "PO53623.exe" touched "Memory Mapped Cache Mgr" (Path: "HKCU\CLSID\{1F486A52-3CB1-48FD-8F50-B8DC300D9F9D}") "PO53623.exe" touched "Security Manager" (Path: "HKLM\SOFTWARE\CLASSES\CLSID\{7B8A2D94-0AC9-11D1-896C-00C04FB6BFC4}") "powershell.exe" touched "NDP SymBinder" (Path: "HKCU\CLSID\{0A29FF9E-7F9C-4437-8B11-F424491E3931}\INPROCSERVER32") "powershell.exe" touched "Custom Destination List" (Path: "HKCU\CLSID\{77F10CF0-3DB5-4966-B520-B7C54FD35ED6}") "powershell.exe" touched "Start Menu Cache" (Path: "HKCU\CLSID\{660B90C8-73A9-4B58-8CAE-355B7F55341B}") "powershell.exe" touched "Start Menu Pin" (Path: "HKLM\SOFTWARE\CLASSES\CLSID\{A2A9545D-A0C2-42B4-9708-A0B2BADD77C8}") "powershell.exe" touched "Taskband Pin" (Path: "HKCU\CLSID\{90AA3A4E-1CBA-4233-B8BB-535773D48449}\TREATAS") "powershell.exe" touched "Shortcut" (Path: "HKCU\CLSID\{00021401-0000-0000-C000-000000000046}\IMPLEMENTED CATEGORIES\{00021490-0000-0000-C000-000000000046}") "powershell.exe" touched "Internet Shortcut" (Path: "HKCU\CLSID\{FBF23B40-E3F0-101B-8488-00AA003E56F8}\IMPLEMENTED CATEGORIES\{00021490-0000-0000-C000-000000000046}") "powershell.exe" touched "User Pinned" (Path: "HKCU\CLSID\{1F3427C8-5C10-4210-AA03-2EE45287D668}\SHELLFOLDER") "powershell.exe" touched "Shell File System Folder" (Path: "HKCU\CLSID\{F3364BA0-65B9-11CE-A9BA-00AA004AE837}\INPROCSERVER32") "powershell.exe" touched "User Assist" (Path: "HKCU\CLSID\{DD313E04-FEFF-11D1-8ECD-0000F87A470C}\TREATAS") "powershell.exe" touched "Shared Task Scheduler" (Path: "HKCU\CLSID\{603D3801-BD81-11D0-A3A5-00C04FD706EC}\TREATAS") "powershell.exe" touched "Property System Both Class Factory" (Path: "HKCU\CLSID\{76765B11-3F95-4AF2-AC9D-EA55D8994F1A}\TREATAS") "powershell.exe" touched "A collection of IUnknown objects that can be enumerated" (Path: "HKCU\CLSID\{2D3468C1-36A7-43B6-AC24-D3F02FD9607A}\TREATAS") "schtasks.exe" touched "TaskScheduler class" (Path: "HKCU\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}") "PO53623.exe" touched "System Device Enumerator" (Path: "HKCU\CLSID\{62BE5D10-60EB-11D0-BD3B-00A0C911CE86}") "PO53623.exe" touched "VFW Capture Class Manager" (Path: "HKCU\CLSID\{860BB310-5D01-11D0-BD3B-00A0C911CE86}") "Bins.exe" touched "delegate folder that appears in Users Files Folder" (Path: "HKCU\CLSID\{DFFACDC5-679F-4156-8947-C5C76BC0B67F}\INPROCSERVER32") "Bins.exe" touched "NetworkListManager" (Path: "HKCU\CLSID\{DCB00C01-570F-4A9B-8D69-199FDBA5723B}\TREATAS") "Bins.exe" touched "Network List Manager" (Path: "HKCU\CLSID\{A47979D2-C419-11D9-A5B4-001185AD2B89}\TREATAS") "Bins.exe" touched "PSFactoryBuffer" (Path: "HKCU\CLSID\{1299CF18-C4F5-4B6A-BB0F-2299F0398E27}\TREATAS") "Bins.exe" touched "WinInetBroker Class" (Path: "HKCU\CLSID\{C39EE728-D419-4BD4-A3EF-EDA059DBD935}\LOCALSERVER32") "Bins.exe" touched "Application Registration" (Path: "HKCU\CLSID\{591209C7-767B-42B2-9FBA-44EE4615F2C7}\TREATAS") "Bins.exe" touched "Search Gatherer Notification" (Path: "HKCU\CLSID\{9E175B6D-F52A-11D8-B9A5-505054503030}\TREATAS") "Bins.exe" touched "WBEM Locator" (Path: "HKCU\CLSID\{4590F811-1D3A-11D0-891F-00AA004B2E24}\TREATAS") "Bins.exe" touched "Windows Management and Instrumentation" (Path: "HKCU\CLSID\{8BC3F05E-D86B-11D0-A075-00C04FB68820}\TREATAS") "Bins.exe" touched "Microsoft WBEM (non)Standard Marshaling for IWbemServices" (Path: "HKCU\CLSID\{D68AF00A-29CB-43FA-8504-CE99A996D9EA}\TREATAS") "Bins.exe" touched "Microsoft WBEM (non)Standard Marshaling for IEnumWbemClassObject" (Path: "HKCU\CLSID\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\TREATAS") "netsh.exe" touched "Nap Config Read class" (Path: "HKCU\CLSID\{EA4A0A43-1C8F-4C7B-A4B1-28ECBD96BA8C}") "netsh.exe" touched "Quarantine Agent Management class" (Path: "HKCU\CLSID\{EB082BA1-DF8A-46BE-82F3-35BF9E9BE52F}")3e:Tbb1,"PO53623.exe" file has an entrypoint instructions - "jmp dword ptr [0x402000],add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al," "Bins.exe" file has an entrypoint instructions - "jmp dword ptr [0x402000],add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al," "24.exe" file has an entrypoint instructions - "pushal ,mov esi, 0x41a000,lea edi, [esi - 0x19000],push edi,or ebp, 0xffffffff,jmp 0x42af72,nop ,nop ,nop ,nop ,nop ,nop ,mov al, byte ptr [esi],inc esi,mov byte ptr [edi], al,inc edi,add ebx, ebx,jne 0x42af79,mov ebx, dword ptr [esi],sub esi, -4,adc ebx, ebx,jb 0x42af68,mov eax, 1,add ebx, ebx,jne 0x42af8b,mov ebx, dword ptr [esi],sub esi, -4,adc ebx, ebx,adc eax, eax,add ebx, ebx,jae 0x42af80,jne 0x42af9c,mov ebx, dword ptr [esi],sub esi, -4,adc ebx, ebx,jae 0x42af80,xor ecx, ecx,sub eax, 3,jb 0x42afb0,shl eax, 8,mov al, byte ptr [esi],inc esi,xor eax, 0xffffffff,je 0x42b022,mov ebp, eax,add ebx, ebx,jne 0x42afbb,"3f:T796,Observed system executable string:"/C:\ PROGRA~2Vyd* MICROS~1VQt* WindowsSTARTM~1ProgramsVyd*ACCESS~1WINDOW~1WINDOW~1.LNKC:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk1SPS1SPSdet-qvatnpjdiob/C:\ PROGRA~2Vyd* MICROS~1VQt* WindowsSTARTM~1ProgramsVyd*ACCESS~1WINDOW~1WINDOW~1.LNKC:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk1SPS1SPSdet-qvatnpjdiob/C:\WindowsSystem32WINDOW~1v1.0powershell_ise.exeC:\Windows\System32\WindowsPowerShell\v1.0\powershell_ise.exe%systemroot%\system32\windowspowershell\v1.0\powershell_ise.exe1SPS1SPSdet-qvatnpjdiob/C:\Windowshh.exeC:\Windows\hh.exe%systemroot%\hh.exe1SPS1SPSdet-qvatnpjdiob" [Source: G9MN6ACIZCS3MSM453C6.temp] Observed system executable string:"%WINDIR%\System32\WindowsPowerShell\v1.0\powershell.exe" [Source: 00000000-00001384-00000C41-10105382647] Observed system executable string:""%WINDIR%\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "%APPDATA%\jKWU" [Source: 00000000-00001384-00000C41-10105382647], Observed system executable string:"%WINDIR%\System32\schtasks.exe" [Source: 00000000-00001384-00000C41-11413681087], Observed system executable string:""%WINDIR%\System32\schtasks.exe" /Create /TN "Updates\jKWUyswkzQirl" /XML "%TEMP%\tmpB818.tmp"" [Source: 00000000-00001384-00000C41-11413681087], Observed system executable string:"%WINDIR%\system32\windowspowershell\v1.0\powershell_ise.exe" [Source: 00000000-00002724-00000C28-3279155680], Observed system executable string:""%WINDIR%\System32\schtasks.exe" /Create /TN "Updates\jKWUyswkzQirl" /XML "%TEMP%\tmpEB38.tmp"" [Source: 00000000-00001472-00000C41-17866258644]40:T52d,"PO53623.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "PO53623.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "PO53623.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LOCALE"; Key: "00000409") "PO53623.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN") "PO53623.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN") "powershell.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "powershell.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "powershell.exe" (Path: "HKCU\CONTROL PANEL\INTERNATIONAL"; Key: "SYEARMONTH") "schtasks.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "schtasks.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "Bins.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "Bins.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "Bins.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LOCALE"; Key: "00000409") "Bins.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN") "Bins.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN")41:T9c4,file/memory contains long string with (Indicator: "text/javascript"; File: "SSL") file/memory contains long string with (Indicator: "text/javascript"; File: "js_3_.js") file/memory contains long string with (Indicator: "text/javascript"; File: "analytics_2_.js") file/memory contains long string with (Indicator: "text/javascript"; File: "f_3_.txt") file/memory contains long string with (Indicator: "text/javascript"; File: "js_1_.js") Found string "" (Indicator: "text/javascript"; File: "pbE.hwspK.html") Found string "" (Indicator: "text/javascript"; File: "pbE.hwspK.html") Found string "" (Indicator: "text/javascript"; File: "TKECIHUJ.htm") Found string "" (Indicator: "text/javascript"; File: "TKECIHUJ.htm") Found string "" (Indicator: "text/javascript"; File: "TKECIHUJ.htm") Found string "" (Indicator: "text/javascript"; File: "TKECIHUJ.htm")42:Tfeb,Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\clr.dll" [Source: 00000000-00001384-00000C25-42774282] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoree.dll" [Source: 00000000-00001384-00000C25-42995944] Observed system executable string:"%WINDIR%\system32\combase.dll" [Source: 00000000-00001384-00000C25-43034349] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\mscorlib\36eaccfde177c2e7b93b8dbdde4e012a\mscorlib.ni.dll" [Source: 00000000-00001384-00000C25-43133239] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\ole32.dll" [Source: 00000000-00001384-00000C25-43164554] Observed system executable string:"%WINDIR%\system32\uxtheme.dll" [Source: 00000000-00001384-00000C25-43192296] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\clrjit.dll" [Source: 00000000-00001384-00000C25-43278614] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System\2c3c912ea8f058f9d04c4650128feb3f\System.ni.dll" [Source: 00000000-00001384-00000C25-43317085] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Drawing\f7568d7f1b9d356f64779b4c0927cfb3\System.Drawing.ni.dll" [Source: 00000000-00001384-00000C25-43336536] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Windows.Forms\c9a4cbc00f690a9e3cddfc400f6e85bb\System.Windows.Forms.ni.dll" [Source: 00000000-00001384-00000C25-43366380] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\uxtheme.dll" [Source: 00000000-00001384-00000C25-43427910] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Core\31fae3290fad30c31c98651462d22724\System.Core.ni.dll" [Source: 00000000-00001384-00000C25-43489330] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Configuration\96f7edb07b12303f0ec2595c7f3778c7\System.Configuration.ni.dll" [Source: 00000000-00001384-00000C25-43504125] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Xml\15af16d373cf0528cb74fc73d365fdbf\System.Xml.ni.dll" [Source: 00000000-00001384-00000C25-43541211] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\nlssorting.dll" [Source: 00000000-00001384-00000C25-43562479] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll" [Source: 00000000-00001384-00000C25-43662537] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\Microsoft.V9921e851#\a891970b44db9e340c3ef3efa95b793c\Microsoft.VisualBasic.ni.dll" [Source: 00000000-00001384-00000C25-44231685] Observed system executable string:"%WINDIR%\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.23894_none_5c0be957a009922e\gdiplus.dll" [Source: 00000000-00001384-00000C25-44274216] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\en-US\mscorrc.dll" [Source: 00000000-00001384-00000C25-44522008] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\en\mscorrc.dll" [Source: 00000000-00001384-00000C25-44534125] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll" [Source: 00000000-00001384-00000C25-44546821] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll" [Source: 00000000-00001384-00000C25-45501623] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll" [Source: 00000000-00001384-00000C25-45693776] Observed system executable string:"%WINDIR%\system32\shell32.dll" [Source: 00000000-00002724-00000C25-48151036] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll" [Source: 00000000-00002724-00000C25-49168475]43:T42f,"powershell.exe" renamed original file"C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms" to "%APPDATA%\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms~RFfbf87.TMP" "powershell.exe" renamed original file"C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms" to "%APPDATA%\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms~RFfdb51.TMP" "powershell.exe" renamed original file"C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms" to "%APPDATA%\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms~RFff41e.TMP" "powershell.exe" renamed original file"C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms" to "%APPDATA%\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms~RF100b07.TMP"44:T9e1,Spawned process "powershell.exe" with commandline "Add-MpPreference -ExclusionPath "%APPDATA%\\jKWUyswkzQirl.exe"" (UID: 00000000-00002724) Spawned process "schtasks.exe" with commandline "/Create /TN "Updates\\jKWUyswkzQirl" /XML "%TEMP%\\tmpB818.tmp"" (UID: 00000000-00002436) Spawned process "PO53623.exe" (UID: 00000000-00003392) Spawned process "powershell.exe" with commandline "powershell Add-MpPreference -ExclusionPath C:\\" (UID: 00000000-00003364) Spawned process "Bins.exe" (UID: 00000000-00001472) Spawned process "powershell.exe" with commandline "Add-MpPreference -ExclusionPath "%APPDATA%\\jKWUyswkzQirl.exe"" (UID: 00000000-00001808) Spawned process "schtasks.exe" with commandline "/Create /TN "Updates\\jKWUyswkzQirl" /XML "%TEMP%\\tmpEB38.tmp"" (UID: 00000000-00003256) Spawned process "Bins.exe" (UID: 00000000-00003636) Spawned process "powershell.exe" with commandline "powershell Add-MpPreference -ExclusionPath C:\\" (UID: 00000000-00003808) Spawned process "24.exe" (UID: 00000000-00002880) Spawned process "netsh.exe" with commandline "netsh advfirewall firewall add rule name="3389" dir=in action=al ..." (UID: 00000000-00003304) Spawned process "iexplore.exe" with commandline "%APPDATA%\\pbE.hwspK.html" (UID: 00000000-00002944) Spawned process "iexplore.exe" with commandline "SCODEF:2944 CREDAT:275457 /prefetch:2" (UID: 00000000-00003276) Spawned process "iexplore.exe" with commandline "SCODEF:2944 CREDAT:996357 /prefetch:2" (UID: 00000000-00000308) Spawned process "iexplore.exe" with commandline "SCODEF:2944 CREDAT:996372 /prefetch:2" (UID: 00000000-00000312) Spawned process "iexplore.exe" with commandline "SCODEF:2944 CREDAT:799761 /prefetch:2" (UID: 00000000-00004064) Spawned process "iexplore.exe" with commandline "SCODEF:2944 CREDAT:2307093 /prefetch:2" (UID: 00000000-00003168) Spawned process "iexplore.exe" with commandline "SCODEF:2944 CREDAT:1258539 /prefetch:2" (UID: 00000000-00002976) Spawned process "iexplore.exe" with commandline "SCODEF:2944 CREDAT:603191 /prefetch:2" (UID: 00000000-00002628) Spawned process "iexplore.exe" with commandline "SCODEF:2944 CREDAT:1389613 /prefetch:2" (UID: 00000000-00002508) Spawned process "iexplore.exe" with commandline "SCODEF:2944 CREDAT:2700337 /prefetch:2" (UID: 00000000-00004128) Spawned process "iexplore.exe" with commandline "SCODEF:2944 CREDAT:2176056 /prefetch:2" (UID: 00000000-00004432) Spawned process "iexplore.exe" with commandline "SCODEF:2944 CREDAT:1455157 /prefetch:2" (UID: 00000000-00004968)45:T9e1,Spawned process "powershell.exe" with commandline "Add-MpPreference -ExclusionPath "%APPDATA%\\jKWUyswkzQirl.exe"" (UID: 00000000-00002724) Spawned process "schtasks.exe" with commandline "/Create /TN "Updates\\jKWUyswkzQirl" /XML "%TEMP%\\tmpB818.tmp"" (UID: 00000000-00002436) Spawned process "PO53623.exe" (UID: 00000000-00003392) Spawned process "powershell.exe" with commandline "powershell Add-MpPreference -ExclusionPath C:\\" (UID: 00000000-00003364) Spawned process "Bins.exe" (UID: 00000000-00001472) Spawned process "powershell.exe" with commandline "Add-MpPreference -ExclusionPath "%APPDATA%\\jKWUyswkzQirl.exe"" (UID: 00000000-00001808) Spawned process "schtasks.exe" with commandline "/Create /TN "Updates\\jKWUyswkzQirl" /XML "%TEMP%\\tmpEB38.tmp"" (UID: 00000000-00003256) Spawned process "Bins.exe" (UID: 00000000-00003636) Spawned process "powershell.exe" with commandline "powershell Add-MpPreference -ExclusionPath C:\\" (UID: 00000000-00003808) Spawned process "24.exe" (UID: 00000000-00002880) Spawned process "netsh.exe" with commandline "netsh advfirewall firewall add rule name="3389" dir=in action=al ..." (UID: 00000000-00003304) Spawned process "iexplore.exe" with commandline "%APPDATA%\\pbE.hwspK.html" (UID: 00000000-00002944) Spawned process "iexplore.exe" with commandline "SCODEF:2944 CREDAT:275457 /prefetch:2" (UID: 00000000-00003276) Spawned process "iexplore.exe" with commandline "SCODEF:2944 CREDAT:996357 /prefetch:2" (UID: 00000000-00000308) Spawned process "iexplore.exe" with commandline "SCODEF:2944 CREDAT:996372 /prefetch:2" (UID: 00000000-00000312) Spawned process "iexplore.exe" with commandline "SCODEF:2944 CREDAT:799761 /prefetch:2" (UID: 00000000-00004064) Spawned process "iexplore.exe" with commandline "SCODEF:2944 CREDAT:2307093 /prefetch:2" (UID: 00000000-00003168) Spawned process "iexplore.exe" with commandline "SCODEF:2944 CREDAT:1258539 /prefetch:2" (UID: 00000000-00002976) Spawned process "iexplore.exe" with commandline "SCODEF:2944 CREDAT:603191 /prefetch:2" (UID: 00000000-00002628) Spawned process "iexplore.exe" with commandline "SCODEF:2944 CREDAT:1389613 /prefetch:2" (UID: 00000000-00002508) Spawned process "iexplore.exe" with commandline "SCODEF:2944 CREDAT:2700337 /prefetch:2" (UID: 00000000-00004128) Spawned process "iexplore.exe" with commandline "SCODEF:2944 CREDAT:2176056 /prefetch:2" (UID: 00000000-00004432) Spawned process "iexplore.exe" with commandline "SCODEF:2944 CREDAT:1455157 /prefetch:2" (UID: 00000000-00004968)46:Ta76d,"Bins.exe" has type "PE32 executable (GUI) Intel 80386 Mono/.Net assembly for MS Windows"- Location: [%USERPROFILE%\Documents\Bins.exe]- [targetUID: 00000000-00003636] "24.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows UPX compressed"- Location: [%TEMP%\24.exe]- [targetUID: 00000000-00003636] "urlblockindex_1_.bin" has type "data"- [targetUID: N/A] "f_2_.txt" has type "ASCII text with very long lines"- [targetUID: N/A] "js_2_.js" has type "ASCII text with very long lines"- [targetUID: N/A] "js_3_.js" has type "ASCII text with very long lines"- [targetUID: N/A] "js_1_.js" has type "ASCII text with very long lines"- [targetUID: N/A] "TKECIHUJ.htm" has type "HTML document UTF-8 Unicode text with very long lines with CRLF NEL line terminators"- Location: [%LOCALAPPDATA%\Microsoft\Windows\Temporary Internet Files\Content.IE5\2UXTWTJR\TKECIHUJ.htm]- [targetUID: 00000000-00002944] "f_3_.txt" has type "ASCII text with very long lines"- [targetUID: N/A] "f_2_.txt" has type "JSON data"- [targetUID: N/A] "saresponsive_2_.js" has type "UTF-8 Unicode text with very long lines with CRLF line terminators"- [targetUID: N/A] "10DBD584E0BEA56315CB62A032695FDD" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\10DBD584E0BEA56315CB62A032695FDD]- [targetUID: 00000000-00003636] "analytics_2_.js" has type "ASCII text with very long lines"- [targetUID: N/A] "WqMHmx7c167hfK0qCLgNv54TxztYQ6WrvVc-5GKbZJk_1_.js" has type "ASCII text with very long lines"- [targetUID: N/A] "~DF992F5DFBC93C8516.TMP" has type "data"- Location: [%TEMP%\~DF992F5DFBC93C8516.TMP]- [targetUID: 00000000-00002944] "js__file_upload_1_.js" has type "UTF-8 Unicode text with very long lines"- [targetUID: N/A] "~DFCB55E1B0867CC064.TMP" has type "data"- Location: [%TEMP%\~DFCB55E1B0867CC064.TMP]- [targetUID: 00000000-00002944] "~DFB9E56D64B612DA53.TMP" has type "data"- Location: [%TEMP%\~DFB9E56D64B612DA53.TMP]- [targetUID: 00000000-00002944] "~DFE39FA66303298C75.TMP" has type "data"- Location: [%TEMP%\~DFE39FA66303298C75.TMP]- [targetUID: 00000000-00002944] "~DF633135EEDDB63B23.TMP" has type "data"- Location: [%TEMP%\~DF633135EEDDB63B23.TMP]- [targetUID: 00000000-00002944] "~DFFD1A2DC79BFDB5D6.TMP" has type "data"- Location: [%TEMP%\~DFFD1A2DC79BFDB5D6.TMP]- [targetUID: 00000000-00002944] "~DF516805D85DC744F7.TMP" has type "data"- Location: [%TEMP%\~DF516805D85DC744F7.TMP]- [targetUID: 00000000-00002944] "~DFDC44E5F9E917E285.TMP" has type "data"- Location: [%TEMP%\~DFDC44E5F9E917E285.TMP]- [targetUID: 00000000-00002944] "~DFA784416CF06565FC.TMP" has type "data"- Location: [%TEMP%\~DFA784416CF06565FC.TMP]- [targetUID: 00000000-00002944] "~DFE98BABDD72418E29.TMP" has type "data"- Location: [%TEMP%\~DFE98BABDD72418E29.TMP]- [targetUID: 00000000-00002944] "~DF0B851F8624C057CE.TMP" has type "data"- Location: [%TEMP%\~DF0B851F8624C057CE.TMP]- [targetUID: 00000000-00002944] "~DF4246D01F9D58C68D.TMP" has type "data"- Location: [%TEMP%\~DF4246D01F9D58C68D.TMP]- [targetUID: 00000000-00002944] "~DFDC67EDD84E782B80.TMP" has type "data"- Location: [%TEMP%\~DFDC67EDD84E782B80.TMP]- [targetUID: 00000000-00002944] "~DFBB32AE98E8788839.TMP" has type "data"- Location: [%TEMP%\~DFBB32AE98E8788839.TMP]- [targetUID: 00000000-00002944] "~DF673FB79EAC572A2C.TMP" has type "data"- Location: [%TEMP%\~DF673FB79EAC572A2C.TMP]- [targetUID: 00000000-00002944] "~DF3FEBA25FCC2DE08C.TMP" has type "data"- Location: [%TEMP%\~DF3FEBA25FCC2DE08C.TMP]- [targetUID: 00000000-00002944] "~DF2111FD8202D9AFF3.TMP" has type "data"- Location: [%TEMP%\~DF2111FD8202D9AFF3.TMP]- [targetUID: 00000000-00002944] "en-US.4" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\Internet Explorer\DomainSuggestions\en-US.4]- [targetUID: 00000000-00002944] "70DAE932E3BCB3C00656A27B544BA9CA" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\70DAE932E3BCB3C00656A27B544BA9CA]- [targetUID: 00000000-00003276] "sodar2_1_.js" has type "ASCII text with very long lines"- [targetUID: N/A] "A3E6546D43CF3C4D85B14CC51DAFA332" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\A3E6546D43CF3C4D85B14CC51DAFA332]- [targetUID: 00000000-00003276] "_97DEFBB9-9F4A-11EE-83AB-005056918117_.dat" has type "Composite Document File V2 Document Cannot read section info"- [targetUID: N/A] "_8FF8FD1C-9F54-11EE-83AB-005056918117_.dat" has type "Composite Document File V2 Document Cannot read section info"- [targetUID: N/A] "_8FF8FD1B-9F54-11EE-83AB-005056918117_.dat" has type "Composite Document File V2 Document Cannot read section info"- [targetUID: N/A] "_1A040520-9F19-11EE-83AB-005056918117_.dat" has type "Composite Document File V2 Document Cannot read section info"- [targetUID: N/A] "_5B1319F9-9F3B-11EE-83AB-005056918117_.dat" has type "Composite Document File V2 Document Cannot read section info"- [targetUID: N/A] "_6DB9F8FC-9F2F-11EE-83AB-005056918117_.dat" has type "Composite Document File V2 Document Cannot read section info"- [targetUID: N/A] "_5B1319F8-9F3B-11EE-83AB-005056918117_.dat" has type "Composite Document File V2 Document Cannot read section info"- [targetUID: N/A] "~DFCA3E18AE2F2EF491.TMP" has type "data"- Location: [%TEMP%\~DFCA3E18AE2F2EF491.TMP]- [targetUID: 00000000-00002944] "~DFD3BCF02C37B2A6B5.TMP" has type "data"- Location: [%TEMP%\~DFD3BCF02C37B2A6B5.TMP]- [targetUID: 00000000-00002944] "~DFDAD3B232698010D3.TMP" has type "data"- Location: [%TEMP%\~DFDAD3B232698010D3.TMP]- [targetUID: 00000000-00002944] "~DFF8FCF58B54755482.TMP" has type "data"- Location: [%TEMP%\~DFF8FCF58B54755482.TMP]- [targetUID: 00000000-00002944] "~DF43C6FFCEA18BB4B1.TMP" has type "data"- Location: [%TEMP%\~DF43C6FFCEA18BB4B1.TMP]- [targetUID: 00000000-00002944] "~DF0789426FF13D2E71.TMP" has type "data"- Location: [%TEMP%\~DF0789426FF13D2E71.TMP]- [targetUID: 00000000-00002944] "~DFFEDA1657947AAA9A.TMP" has type "data"- Location: [%TEMP%\~DFFEDA1657947AAA9A.TMP]- [targetUID: 00000000-00002944] "~DF1FEDE64777CE2501.TMP" has type "data"- Location: [%TEMP%\~DF1FEDE64777CE2501.TMP]- [targetUID: 00000000-00002944] "~DF825AB57AB3621A0A.TMP" has type "data"- Location: [%TEMP%\~DF825AB57AB3621A0A.TMP]- [targetUID: 00000000-00002944] "~DFE53B0E44FE350F29.TMP" has type "data"- Location: [%TEMP%\~DFE53B0E44FE350F29.TMP]- [targetUID: 00000000-00002944] "_761769F8-9F35-11EE-83AB-005056918117_.dat" has type "Composite Document File V2 Document Cannot read section info"- [targetUID: N/A] "_AC4151F4-9F21-11EE-83AB-005056918117_.dat" has type "Composite Document File V2 Document Cannot read section info"- [targetUID: N/A] "_761769F7-9F35-11EE-83AB-005056918117_.dat" has type "Composite Document File V2 Document Cannot read section info"- [targetUID: N/A] "_6E293973-9F27-11EE-83AB-005056918117_.dat" has type "Composite Document File V2 Document Cannot read section info"- [targetUID: N/A] "_6DB9F8FB-9F2F-11EE-83AB-005056918117_.dat" has type "Composite Document File V2 Document Cannot read section info"- [targetUID: N/A] "_1A040521-9F19-11EE-83AB-005056918117_.dat" has type "Composite Document File V2 Document Cannot read section info"- [targetUID: N/A] "_F9E72E6A-9F44-11EE-83AB-005056918117_.dat" has type "Composite Document File V2 Document Cannot read section info"- [targetUID: N/A] "_761769FA-9F35-11EE-83AB-005056918117_.dat" has type "Composite Document File V2 Document Cannot read section info"- [targetUID: N/A] "_6E293971-9F27-11EE-83AB-005056918117_.dat" has type "Composite Document File V2 Document Cannot read section info"- [targetUID: N/A] "_6DB9F8FD-9F2F-11EE-83AB-005056918117_.dat" has type "Composite Document File V2 Document Cannot read section info"- [targetUID: N/A] "Bins.exePTZ3OQB5.htm" has type "HTML document ASCII text with very long lines"- Location: [%LOCALAPPDATA%\Microsoft\Windows\Temporary Internet Files\Content.IE5\CKDNCXYS\Bins.exePTZ3OQB5.htm]- [targetUID: 00000000-00003636] "jtiAoryjf.html" has type "HTML document ASCII text with very long lines"- Location: [%APPDATA%\jtiAoryjf.html]- [targetUID: 00000000-00003636] "wpjGGdCdB.html" has type "HTML document ASCII text with very long lines"- Location: [%APPDATA%\wpjGGdCdB.html]- [targetUID: 00000000-00003636] "Kr.izfJwD.html" has type "HTML document ASCII text with very long lines"- Location: [%APPDATA%\Kr.izfJwD.html]- [targetUID: 00000000-00003636] "aBDpxmlsx.html" has type "HTML document ASCII text with very long lines"- Location: [%APPDATA%\aBDpxmlsx.html]- [targetUID: 00000000-00003636] "uyspfppby.html" has type "HTML document ASCII text with very long lines"- Location: [%APPDATA%\uyspfppby.html]- [targetUID: 00000000-00003636] "aHmJKtizD.html" has type "HTML document ASCII text with very long lines"- Location: [%APPDATA%\aHmJKtizD.html]- [targetUID: 00000000-00003636] "geCvFhdly.html" has type "HTML document ASCII text with very long lines"- Location: [%APPDATA%\geCvFhdly.html]- [targetUID: 00000000-00003636] "pbE.hwspK.html" has type "HTML document ASCII text with very long lines"- Location: [%APPDATA%\pbE.hwspK.html]- [targetUID: 00000000-00003636] "Bins.exeH8Q8AAI4.htm" has type "HTML document ASCII text with very long lines"- Location: [%LOCALAPPDATA%\Microsoft\Windows\Temporary Internet Files\Content.IE5\CKDNCXYS\Bins.exeH8Q8AAI4.htm]- [targetUID: 00000000-00003636] "Bins.exe_5_.htm" has type "HTML document ASCII text with very long lines"- [targetUID: N/A] "AgJorBrbq.html" has type "HTML document ASCII text with very long lines"- Location: [%APPDATA%\AgJorBrbq.html]- [targetUID: 00000000-00003636] "Bins.exe_3_.htm" has type "HTML document ASCII text with very long lines"- [targetUID: N/A] "Bins.exe_6_.htm" has type "HTML document ASCII text with very long lines"- [targetUID: N/A] "Bins.exe_7_.htm" has type "HTML document ASCII text with very long lines"- [targetUID: N/A] "BKaEvgIpa.html" has type "HTML document ASCII text with very long lines"- Location: [%APPDATA%\BKaEvgIpa.html]- [targetUID: 00000000-00003636] "BJGIC..kG.html" has type "HTML document ASCII text with very long lines"- Location: [%APPDATA%\BJGIC..kG.html]- [targetUID: 00000000-00003636] "Bins.exe_2_.htm" has type "HTML document ASCII text with very long lines"- [targetUID: N/A] "Bins.exe_9_.htm" has type "HTML document ASCII text with very long lines"- [targetUID: N/A] "xIDknlGKD.html" has type "HTML document ASCII text with very long lines"- Location: [%APPDATA%\xIDknlGKD.html]- [targetUID: 00000000-00003636] "runner_1_.htm" has type "HTML document ASCII text with very long lines"- [targetUID: N/A] "logo_1_.png" has type "PNG image data 203 x 71 8-bit/color RGB non-interlaced"- [targetUID: N/A] "zrt_lookup_1_.htm" has type "HTML document ASCII text with very long lines"- [targetUID: N/A] "zrt_lookup_nohtml_1_.htm" has type "HTML document ASCII text with very long lines"- [targetUID: N/A] "script_6_.js" has type "ASCII text with very long lines"- [targetUID: N/A] "script_1_.js" has type "ASCII text with very long lines"- [targetUID: N/A] "script_2_.js" has type "ASCII text with very long lines"- [targetUID: N/A] "script_3_.js" has type "ASCII text with very long lines"- [targetUID: N/A] "script_7_.js" has type "ASCII text with very long lines"- [targetUID: N/A] "script_5_.js" has type "ASCII text with very long lines"- [targetUID: N/A] "script_8_.js" has type "ASCII text with very long lines"- [targetUID: N/A] "script_4_.js" has type "ASCII text with very long lines"- [targetUID: N/A] "ubr__style_1_.css" has type "ASCII text with very long lines with CRLF line terminators"- [targetUID: N/A] "_AC4151F6-9F21-11EE-83AB-005056918117_.dat" has type "Composite Document File V2 Document Cannot read section info"- [targetUID: N/A] "RecoveryStore._1A04051D-9F19-11EE-83AB-005056918117_.dat" has type "Composite Document File V2 Document Cannot read section info"- [targetUID: N/A] "_1A04051F-9F19-11EE-83AB-005056918117_.dat" has type "Composite Document File V2 Document Cannot read section info"- [targetUID: N/A] "57C8EDB95DF3F0AD4EE2DC2B8CFD4157" has type "Microsoft Cabinet archive data Windows 2000/XP setup 4770 bytes 1 file at 0x2c +A "disallowedcert.stl" number 1 1 datablock 0x1 compression"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\57C8EDB95DF3F0AD4EE2DC2B8CFD4157]- [targetUID: 00000000-00003636] "_5B1319F7-9F3B-11EE-83AB-005056918117_.dat" has type "Composite Document File V2 Document Cannot read section info"- [targetUID: N/A] "_6E293974-9F27-11EE-83AB-005056918117_.dat" has type "Composite Document File V2 Document Cannot read section info"- [targetUID: N/A] "_AC4151F5-9F21-11EE-83AB-005056918117_.dat" has type "Composite Document File V2 Document Cannot read section info"- [targetUID: N/A] "_761769F9-9F35-11EE-83AB-005056918117_.dat" has type "Composite Document File V2 Document Cannot read section info"- [targetUID: N/A] "_AC4151F7-9F21-11EE-83AB-005056918117_.dat" has type "Composite Document File V2 Document Cannot read section info"- [targetUID: N/A] "_AC4151F8-9F21-11EE-83AB-005056918117_.dat" has type "Composite Document File V2 Document Cannot read section info"- [targetUID: N/A] "_6E293972-9F27-11EE-83AB-005056918117_.dat" has type "Composite Document File V2 Document Cannot read section info"- [targetUID: N/A] "_97DEFBBA-9F4A-11EE-83AB-005056918117_.dat" has type "Composite Document File V2 Document Cannot read section info"- [targetUID: N/A] "B66240B0F6C84BD4857ABA60CF5CE4A0_5043E0F5DF723415C9EECC201C838A62" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\B66240B0F6C84BD4857ABA60CF5CE4A0_5043E0F5DF723415C9EECC201C838A62]- [targetUID: 00000000-00002976] "dl__1_.png" has type "PNG image data 154 x 32 8-bit colormap non-interlaced"- [targetUID: N/A] "dl_hover__1_.png" has type "PNG image data 154 x 32 8-bit colormap non-interlaced"- [targetUID: N/A] "tmp908B.tmp" has type "XML 1.0 document ASCII text"- [targetUID: N/A] "BAD725C80F9E10846F35D039A996E4A8_88B6AE015495C1ECC395D19C1DD02894" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\BAD725C80F9E10846F35D039A996E4A8_88B6AE015495C1ECC395D19C1DD02894]- [targetUID: 00000000-00002976] "24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA]- [targetUID: 00000000-00002976] "75CA58072B9926F763A91F0CC2798706_B5D3A17E5BEDD2EDA793611A0A74E1E8" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\75CA58072B9926F763A91F0CC2798706_B5D3A17E5BEDD2EDA793611A0A74E1E8]- [targetUID: 00000000-00002976] "4748633DC5731827D4B432DBAC7A3ECE" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\4748633DC5731827D4B432DBAC7A3ECE]- [targetUID: 00000000-00003276] "aframe_1_.htm" has type "HTML document ASCII text with very long lines with no line terminators"- [targetUID: N/A] "aframe_5_.htm" has type "HTML document ASCII text with very long lines with no line terminators"- [targetUID: N/A] "aframe_2_.htm" has type "HTML document ASCII text with very long lines with no line terminators"- [targetUID: N/A] "aframe_3_.htm" has type "HTML document ASCII text with very long lines with no line terminators"- [targetUID: N/A] "aframe_4_.htm" has type "HTML document ASCII text with very long lines with no line terminators"- [targetUID: N/A] "aframe_6_.htm" has type "HTML document ASCII text with very long lines with no line terminators"- [targetUID: N/A] "14561BF7422BB6F70A9CB14F5AA8A7DA_582DC597430784041BB93D3718D1C412" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\14561BF7422BB6F70A9CB14F5AA8A7DA_582DC597430784041BB93D3718D1C412]- [targetUID: 00000000-00003636] "CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA]- [targetUID: 00000000-00002976] "103621DE9CD5414CC2538780B4B75751" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\103621DE9CD5414CC2538780B4B75751]- [targetUID: 00000000-00002976] "BCB67D7ECB470284AF35679F339E879F" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\BCB67D7ECB470284AF35679F339E879F]- [targetUID: 00000000-00003276] "620BEF1064BD8E252C599957B3C91896" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\620BEF1064BD8E252C599957B3C91896]- [targetUID: 00000000-00003276] "20-12-2023_17.31.44" has type "data"- Location: [%LOCALAPPDATA%\Microsoft Vision\20-12-2023_17.31.44]- [targetUID: 00000000-00003636] "ads_5_.htm" has type "HTML document ASCII text with very long lines with no line terminators"- [targetUID: N/A] "lg-share-en_1_.gif" has type "GIF image data version 89a 125 x 16"- [targetUID: N/A] "flag_1_.png" has type "PNG image data 16 x 11 8-bit/color RGB non-interlaced"- [targetUID: N/A] "5FBDD363E26A6CF8D0B9031B059A78FC" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\MetaData\5FBDD363E26A6CF8D0B9031B059A78FC]- [targetUID: 00000000-00002976] "57T178LE.txt" has type "ASCII text"- Location: [%APPDATA%\Microsoft\Windows\Cookies\57T178LE.txt]- [targetUID: 00000000-00002976] "5FBDD363E26A6CF8D0B9031B059A78FC" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\5FBDD363E26A6CF8D0B9031B059A78FC]- [targetUID: 00000000-00002976] "F2DDCD2B5F37625B82E81F4976CEE400_BB0E5383BB6E3CF78C8AC8388DB6A7BF" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\F2DDCD2B5F37625B82E81F4976CEE400_BB0E5383BB6E3CF78C8AC8388DB6A7BF]- [targetUID: 00000000-00002976] "265C0DEB29181DD1891051371C5F863A_2904BACC9596DCBFDE1A1AD512218F17" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\265C0DEB29181DD1891051371C5F863A_2904BACC9596DCBFDE1A1AD512218F17]- [targetUID: 00000000-00002976] "E573CDF4C6D731D56A665145182FD759_C6D215F6D8D45C9E04997EF7C0D222E4" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\E573CDF4C6D731D56A665145182FD759_C6D215F6D8D45C9E04997EF7C0D222E4]- [targetUID: 00000000-00002976] "80237EE4964FC9C409AAF55BF996A292_D46D6FA25B74360E1349F9015B5CCE53" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\80237EE4964FC9C409AAF55BF996A292_D46D6FA25B74360E1349F9015B5CCE53]- [targetUID: 00000000-00002944] "E2C6CBAF0AF08CF203BA74BF0D0AB6D5_0FB9553B978E7F00C6B2309507DEB64A" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_0FB9553B978E7F00C6B2309507DEB64A]- [targetUID: 00000000-00002944] "B398B80134F72209547439DB21AB308D_23FFFDCAABB8E63694AD1202ED02BF57" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\B398B80134F72209547439DB21AB308D_23FFFDCAABB8E63694AD1202ED02BF57]- [targetUID: 00000000-00003636] "80237EE4964FC9C409AAF55BF996A292_C5130A0BDC8C859A2757D77746C10868" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\80237EE4964FC9C409AAF55BF996A292_C5130A0BDC8C859A2757D77746C10868]- [targetUID: 00000000-00002944] "F07644E38ED7C9F37D11EEC6D4335E02_EC50BC49A28D68A36F5274F1BD1417C1" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\F07644E38ED7C9F37D11EEC6D4335E02_EC50BC49A28D68A36F5274F1BD1417C1]- [targetUID: 00000000-00002976] "A16C6C16D94F76E0808C087DFC657D99_622063C24DB418AA522B5CFF45000BF1" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\A16C6C16D94F76E0808C087DFC657D99_622063C24DB418AA522B5CFF45000BF1]- [targetUID: 00000000-00002976] "7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776]- [targetUID: 00000000-00002976] "B398B80134F72209547439DB21AB308D_A4CF52CCA82D7458083F7280801A3A04" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\B398B80134F72209547439DB21AB308D_A4CF52CCA82D7458083F7280801A3A04]- [targetUID: 00000000-00002976] "YNJOVRYS.txt" has type "ASCII text"- Location: [%APPDATA%\Microsoft\Windows\Cookies\YNJOVRYS.txt]- [targetUID: 00000000-00002944] "B66240B0F6C84BD4857ABA60CF5CE4A0_5043E0F5DF723415C9EECC201C838A62" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\MetaData\B66240B0F6C84BD4857ABA60CF5CE4A0_5043E0F5DF723415C9EECC201C838A62]- [targetUID: 00000000-00002976] "75CA58072B9926F763A91F0CC2798706_B5D3A17E5BEDD2EDA793611A0A74E1E8" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\MetaData\75CA58072B9926F763A91F0CC2798706_B5D3A17E5BEDD2EDA793611A0A74E1E8]- [targetUID: 00000000-00002976] "20-12-2023_16.23.27" has type "data"- Location: [%LOCALAPPDATA%\Microsoft Vision\20-12-2023_16.23.27]- [targetUID: 00000000-00003636] "BAD725C80F9E10846F35D039A996E4A8_88B6AE015495C1ECC395D19C1DD02894" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\MetaData\BAD725C80F9E10846F35D039A996E4A8_88B6AE015495C1ECC395D19C1DD02894]- [targetUID: 00000000-00002976] "F2DDCD2B5F37625B82E81F4976CEE400_BB0E5383BB6E3CF78C8AC8388DB6A7BF" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\MetaData\F2DDCD2B5F37625B82E81F4976CEE400_BB0E5383BB6E3CF78C8AC8388DB6A7BF]- [targetUID: 00000000-00002976] "E2C6CBAF0AF08CF203BA74BF0D0AB6D5_0FB9553B978E7F00C6B2309507DEB64A" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_0FB9553B978E7F00C6B2309507DEB64A]- [targetUID: 00000000-00002944] "80237EE4964FC9C409AAF55BF996A292_D46D6FA25B74360E1349F9015B5CCE53" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\MetaData\80237EE4964FC9C409AAF55BF996A292_D46D6FA25B74360E1349F9015B5CCE53]- [targetUID: 00000000-00002944] "80237EE4964FC9C409AAF55BF996A292_C5130A0BDC8C859A2757D77746C10868" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\MetaData\80237EE4964FC9C409AAF55BF996A292_C5130A0BDC8C859A2757D77746C10868]- [targetUID: 00000000-00002944] "A16C6C16D94F76E0808C087DFC657D99_622063C24DB418AA522B5CFF45000BF1" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\MetaData\A16C6C16D94F76E0808C087DFC657D99_622063C24DB418AA522B5CFF45000BF1]- [targetUID: 00000000-00002976] "24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA]- [targetUID: 00000000-00002976] "14561BF7422BB6F70A9CB14F5AA8A7DA_582DC597430784041BB93D3718D1C412" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\MetaData\14561BF7422BB6F70A9CB14F5AA8A7DA_582DC597430784041BB93D3718D1C412]- [targetUID: 00000000-00003636] "265C0DEB29181DD1891051371C5F863A_2904BACC9596DCBFDE1A1AD512218F17" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\MetaData\265C0DEB29181DD1891051371C5F863A_2904BACC9596DCBFDE1A1AD512218F17]- [targetUID: 00000000-00002976] "F07644E38ED7C9F37D11EEC6D4335E02_EC50BC49A28D68A36F5274F1BD1417C1" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\MetaData\F07644E38ED7C9F37D11EEC6D4335E02_EC50BC49A28D68A36F5274F1BD1417C1]- [targetUID: 00000000-00002976] "7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776]- [targetUID: 00000000-00002976] "B398B80134F72209547439DB21AB308D_A4CF52CCA82D7458083F7280801A3A04" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\MetaData\B398B80134F72209547439DB21AB308D_A4CF52CCA82D7458083F7280801A3A04]- [targetUID: 00000000-00002976] "E573CDF4C6D731D56A665145182FD759_C6D215F6D8D45C9E04997EF7C0D222E4" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\MetaData\E573CDF4C6D731D56A665145182FD759_C6D215F6D8D45C9E04997EF7C0D222E4]- [targetUID: 00000000-00002976] "B398B80134F72209547439DB21AB308D_23FFFDCAABB8E63694AD1202ED02BF57" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\MetaData\B398B80134F72209547439DB21AB308D_23FFFDCAABB8E63694AD1202ED02BF57]- [targetUID: 00000000-00003636] "CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\MetaData\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA]- [targetUID: 00000000-00002976] "Q85GI333.txt" has type "ASCII text"- Location: [%APPDATA%\Microsoft\Windows\Cookies\Q85GI333.txt]- [targetUID: 00000000-00002944] "57C8EDB95DF3F0AD4EE2DC2B8CFD4157" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157]- [targetUID: 00000000-00003636] "20-12-2023_14.11.17" has type "data"- Location: [%LOCALAPPDATA%\Microsoft Vision\20-12-2023_14.11.17]- [targetUID: 00000000-00003636] "10DBD584E0BEA56315CB62A032695FDD" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\MetaData\10DBD584E0BEA56315CB62A032695FDD]- [targetUID: 00000000-00003636] "5A61F5EE954AF7C40FE1289BACE2A6BA" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\MetaData\5A61F5EE954AF7C40FE1289BACE2A6BA]- [targetUID: 00000000-00003636] "620BEF1064BD8E252C599957B3C91896" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\MetaData\620BEF1064BD8E252C599957B3C91896]- [targetUID: 00000000-00003276] "BCB67D7ECB470284AF35679F339E879F" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\MetaData\BCB67D7ECB470284AF35679F339E879F]- [targetUID: 00000000-00003276] "20-12-2023_12.23.49" has type "data"- Location: [%LOCALAPPDATA%\Microsoft Vision\20-12-2023_12.23.49]- [targetUID: 00000000-00003636] "KWIFW5Y2.txt" has type "ASCII text"- Location: [%APPDATA%\Microsoft\Windows\Cookies\KWIFW5Y2.txt]- [targetUID: 00000000-00004968] "RB1SDWDT.txt" has type "ASCII text"- Location: [%APPDATA%\Microsoft\Windows\Cookies\RB1SDWDT.txt]- [targetUID: 00000000-00002976] "70DAE932E3BCB3C00656A27B544BA9CA" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\MetaData\70DAE932E3BCB3C00656A27B544BA9CA]- [targetUID: 00000000-00003276] "A3E6546D43CF3C4D85B14CC51DAFA332" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\MetaData\A3E6546D43CF3C4D85B14CC51DAFA332]- [targetUID: 00000000-00003276] "103621DE9CD5414CC2538780B4B75751" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751]- [targetUID: 00000000-00002976] "4748633DC5731827D4B432DBAC7A3ECE" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\MetaData\4748633DC5731827D4B432DBAC7A3ECE]- [targetUID: 00000000-00003276] "YR4TYK3B.txt" has type "ASCII text"- Location: [%APPDATA%\Microsoft\Windows\Cookies\YR4TYK3B.txt]- [targetUID: 00000000-00000312] "8M34G1QT.txt" has type "ASCII text"- Location: [%APPDATA%\Microsoft\Windows\Cookies\8M34G1QT.txt]- [targetUID: 00000000-00002976] "FSLWDQT4.txt" has type "ASCII text"- Location: [%APPDATA%\Microsoft\Windows\Cookies\FSLWDQT4.txt]- [targetUID: 00000000-00000308] "XOOFVCQE.txt" has type "ASCII text"- Location: [%APPDATA%\Microsoft\Windows\Cookies\XOOFVCQE.txt]- [targetUID: 00000000-00004968] "NRLO2UT0.txt" has type "ASCII text"- Location: [%APPDATA%\Microsoft\Windows\Cookies\NRLO2UT0.txt]- [targetUID: 00000000-00000312] "SPOZ7Q8Z.txt" has type "ASCII text"- Location: [%APPDATA%\Microsoft\Windows\Cookies\SPOZ7Q8Z.txt]- [targetUID: 00000000-00004968] "VN7IA5NP.txt" has type "ASCII text"- Location: [%APPDATA%\Microsoft\Windows\Cookies\VN7IA5NP.txt]- [targetUID: 00000000-00004064] "DB755UZD.txt" has type "ASCII text"- Location: [%APPDATA%\Microsoft\Windows\Cookies\DB755UZD.txt]- [targetUID: 00000000-00004128] "1XEVUL8K.txt" has type "ASCII text"- Location: [%APPDATA%\Microsoft\Windows\Cookies\1XEVUL8K.txt]- [targetUID: 00000000-00004968] "DQ2ZA76Z.txt" has type "ASCII text"- Location: [%APPDATA%\Microsoft\Windows\Cookies\DQ2ZA76Z.txt]- [targetUID: 00000000-00000312] "7TAMG3JZ.txt" has type "ASCII text"- Location: [%APPDATA%\Microsoft\Windows\Cookies\7TAMG3JZ.txt]- [targetUID: 00000000-00000312] "PN7QVOYY.txt" has type "ASCII text"- Location: [%APPDATA%\Microsoft\Windows\Cookies\PN7QVOYY.txt]- [targetUID: 00000000-00004064] "NE463YZX.txt" has type "ASCII text"- Location: [%APPDATA%\Microsoft\Windows\Cookies\NE463YZX.txt]- [targetUID: 00000000-00002976] "VRQAO281.txt" has type "ASCII text"- Location: [%APPDATA%\Microsoft\Windows\Cookies\VRQAO281.txt]- [targetUID: 00000000-00002976] "OO00UU6R.txt" has type "ASCII text"- Location: [%APPDATA%\Microsoft\Windows\Cookies\OO00UU6R.txt]- [targetUID: 00000000-00004064] "HRZ05CL0.txt" has type "ASCII text"- Location: [%APPDATA%\Microsoft\Windows\Cookies\HRZ05CL0.txt]- [targetUID: 00000000-00000308] "VV0NXVZX.txt" has type "ASCII text"- Location: [%APPDATA%\Microsoft\Windows\Cookies\VV0NXVZX.txt]- [targetUID: 00000000-00002628] "FNH41727.txt" has type "ASCII text"- Location: [%APPDATA%\Microsoft\Windows\Cookies\FNH41727.txt]- [targetUID: 00000000-00003168] "B2IL2YEA.txt" has type "ASCII text"- Location: [%APPDATA%\Microsoft\Windows\Cookies\B2IL2YEA.txt]- [targetUID: 00000000-00000312] "BUJ41FS7.txt" has type "ASCII text"- Location: [%APPDATA%\Microsoft\Windows\Cookies\BUJ41FS7.txt]- [targetUID: 00000000-00004064] "1XN956B2.txt" has type "ASCII text"- Location: [%APPDATA%\Microsoft\Windows\Cookies\1XN956B2.txt]- [targetUID: 00000000-00002628] "M11ECP0A.txt" has type "ASCII text"- Location: [%APPDATA%\Microsoft\Windows\Cookies\M11ECP0A.txt]- [targetUID: 00000000-00002628] "99Q46H9Z.txt" has type "ASCII text"- Location: [%APPDATA%\Microsoft\Windows\Cookies\99Q46H9Z.txt]- [targetUID: 00000000-00002976] "8VJ8UIVV.txt" has type "ASCII text"- Location: [%APPDATA%\Microsoft\Windows\Cookies\8VJ8UIVV.txt]- [targetUID: 00000000-00002976] "BRIA7CSJ.txt" has type "ASCII text"- Location: [%APPDATA%\Microsoft\Windows\Cookies\BRIA7CSJ.txt]- [targetUID: 00000000-00004432] "62QETUPD.txt" has type "ASCII text"- Location: [%APPDATA%\Microsoft\Windows\Cookies\62QETUPD.txt]- [targetUID: 00000000-00002628] "IOCTT7JV.txt" has type "ASCII text"- Location: [%APPDATA%\Microsoft\Windows\Cookies\IOCTT7JV.txt]- [targetUID: 00000000-00004128] "V5T0U3B4.txt" has type "ASCII text"- Location: [%APPDATA%\Microsoft\Windows\Cookies\V5T0U3B4.txt]- [targetUID: 00000000-00000312] "Q7DF37X9.txt" has type "ASCII text"- Location: [%APPDATA%\Microsoft\Windows\Cookies\Q7DF37X9.txt]- [targetUID: 00000000-00003168] "VFO2VNS0.txt" has type "ASCII text"- Location: [%APPDATA%\Microsoft\Windows\Cookies\VFO2VNS0.txt]- [targetUID: 00000000-00002628] "UENM2B78.txt" has type "ASCII text"- Location: [%APPDATA%\Microsoft\Windows\Cookies\UENM2B78.txt]- [targetUID: 00000000-00002508] "YKTHA6IA.txt" has type "ASCII text"- Location: [%APPDATA%\Microsoft\Windows\Cookies\YKTHA6IA.txt]- [targetUID: 00000000-00002976] "V6FFNS7Z.txt" has type "ASCII text"- Location: [%APPDATA%\Microsoft\Windows\Cookies\V6FFNS7Z.txt]- [targetUID: 00000000-00002508] "HPLHR753.txt" has type "ASCII text"- Location: [%APPDATA%\Microsoft\Windows\Cookies\HPLHR753.txt]- [targetUID: 00000000-00002976] "9PQWSXP3.txt" has type "ASCII text"- Location: [%APPDATA%\Microsoft\Windows\Cookies\9PQWSXP3.txt]- [targetUID: 00000000-00004064] "5Q5IHRUF.txt" has type "ASCII text"- Location: [%APPDATA%\Microsoft\Windows\Cookies\5Q5IHRUF.txt]- [targetUID: 00000000-00002628] "F12Q8JER.txt" has type "ASCII text"- Location: [%APPDATA%\Microsoft\Windows\Cookies\F12Q8JER.txt]- [targetUID: 00000000-00002976] "FAEF43CK.txt" has type "ASCII text"- Location: [%APPDATA%\Microsoft\Windows\Cookies\FAEF43CK.txt]- [targetUID: 00000000-00004064] "Z8VXQRDU.txt" has type "ASCII text"- Location: [%APPDATA%\Microsoft\Windows\Cookies\Z8VXQRDU.txt]- [targetUID: 00000000-00004128] "53P3JUA9.txt" has type "ASCII text"- Location: [%APPDATA%\Microsoft\Windows\Cookies\53P3JUA9.txt]- [targetUID: 00000000-00004064] "XXTEQ2LS.txt" has type "ASCII text"- Location: [%APPDATA%\Microsoft\Windows\Cookies\XXTEQ2LS.txt]- [targetUID: 00000000-00004968] "RQG99JVY.txt" has type "ASCII text"- Location: [%APPDATA%\Microsoft\Windows\Cookies\RQG99JVY.txt]- [targetUID: 00000000-00000308] "NN8ZBOEN.txt" has type "ASCII text"- Location: [%APPDATA%\Microsoft\Windows\Cookies\NN8ZBOEN.txt]- [targetUID: 00000000-00000312] "KYL8U6LI.txt" has type "ASCII text"- Location: [%APPDATA%\Microsoft\Windows\Cookies\KYL8U6LI.txt]- [targetUID: 00000000-00000312] "Z9RF1AM0.txt" has type "ASCII text"- Location: [%APPDATA%\Microsoft\Windows\Cookies\Z9RF1AM0.txt]- [targetUID: 00000000-00002976] "729BIX74.txt" has type "ASCII text"- Location: [%APPDATA%\Microsoft\Windows\Cookies\729BIX74.txt]- [targetUID: 00000000-00000312] "ATQK6P93.txt" has type "ASCII text"- Location: [%APPDATA%\Microsoft\Windows\Cookies\ATQK6P93.txt]- [targetUID: 00000000-00002628] "CARH70MJ.txt" has type "ASCII text"- Location: [%APPDATA%\Microsoft\Windows\Cookies\CARH70MJ.txt]- [targetUID: 00000000-00002508] "9NSN16LR.txt" has type "ASCII text"- Location: [%APPDATA%\Microsoft\Windows\Cookies\9NSN16LR.txt]- [targetUID: 00000000-00002976] "S40N5P3I.txt" has type "ASCII text"- Location: [%APPDATA%\Microsoft\Windows\Cookies\S40N5P3I.txt]- [targetUID: 00000000-00002976] "72RSLA11.txt" has type "ASCII text"- Location: [%APPDATA%\Microsoft\Windows\Cookies\72RSLA11.txt]- [targetUID: 00000000-00004968] "Q9CUUB1L.txt" has type "ASCII text"- Location: [%APPDATA%\Microsoft\Windows\Cookies\Q9CUUB1L.txt]- [targetUID: 00000000-00002944] "2WHB8WHY.txt" has type "ASCII text"- Location: [%APPDATA%\Microsoft\Windows\Cookies\2WHB8WHY.txt]- [targetUID: 00000000-00002944] "C43K86AC.txt" has type "ASCII text"- Location: [%APPDATA%\Microsoft\Windows\Cookies\C43K86AC.txt]- [targetUID: 00000000-00002944] "www.google_1_.xml" has type "ASCII text with no line terminators"- [targetUID: N/A] "2Y1UOUTR.txt" has type "ASCII text"- Location: [%APPDATA%\Microsoft\Windows\Cookies\2Y1UOUTR.txt]- [targetUID: 00000000-00000308] "YN5GYRIN.txt" has type "ASCII text"- Location: [%APPDATA%\Microsoft\Windows\Cookies\YN5GYRIN.txt]- [targetUID: 00000000-00004968] "20-12-2023_10.15.06" has type "data"- Location: [%LOCALAPPDATA%\Microsoft Vision\20-12-2023_10.15.06]- [targetUID: 00000000-00003636] "KHN8SD5G.txt" has type "ASCII text"- Location: [%APPDATA%\Microsoft\Windows\Cookies\KHN8SD5G.txt]- [targetUID: 00000000-00003636] "KA67ZOSZ.txt" has type "ASCII text"- Location: [%APPDATA%\Microsoft\Windows\Cookies\KA67ZOSZ.txt]- [targetUID: 00000000-00003636] "C647FVRG.txt" has type "ASCII text"- Location: [%APPDATA%\Microsoft\Windows\Cookies\C647FVRG.txt]- [targetUID: 00000000-00003636] "WG7M7SQ2.txt" has type "ASCII text"- Location: [%APPDATA%\Microsoft\Windows\Cookies\WG7M7SQ2.txt]- [targetUID: 00000000-00003636] "GQ7QXDFJ.txt" has type "ASCII text"- Location: [%APPDATA%\Microsoft\Windows\Cookies\GQ7QXDFJ.txt]- [targetUID: 00000000-00003636] "671K1UJC.txt" has type "ASCII text"- Location: [%APPDATA%\Microsoft\Windows\Cookies\671K1UJC.txt]- [targetUID: 00000000-00003636] "A7ICG9N7.txt" has type "ASCII text"- Location: [%APPDATA%\Microsoft\Windows\Cookies\A7ICG9N7.txt]- [targetUID: 00000000-00003636] "76Q2CQTV.txt" has type "ASCII text"- Location: [%APPDATA%\Microsoft\Windows\Cookies\76Q2CQTV.txt]- [targetUID: 00000000-00003636] "IC220FVW.txt" has type "ASCII text"- Location: [%APPDATA%\Microsoft\Windows\Cookies\IC220FVW.txt]- [targetUID: 00000000-00003636] "TXJHZOCB.txt" has type "ASCII text"- Location: [%APPDATA%\Microsoft\Windows\Cookies\TXJHZOCB.txt]- [targetUID: 00000000-00003636] "SAGYOVRX.txt" has type "ASCII text"- Location: [%APPDATA%\Microsoft\Windows\Cookies\SAGYOVRX.txt]- [targetUID: 00000000-00003636] "1IWBPZK8.txt" has type "ASCII text"- Location: [%APPDATA%\Microsoft\Windows\Cookies\1IWBPZK8.txt]- [targetUID: 00000000-00003636] "JAH50LP7.txt" has type "ASCII text"- Location: [%APPDATA%\Microsoft\Windows\Cookies\JAH50LP7.txt]- [targetUID: 00000000-00003636] "AQXZ51L9.txt" has type "ASCII text"- Location: [%APPDATA%\Microsoft\Windows\Cookies\AQXZ51L9.txt]- [targetUID: 00000000-00003636] "VP67MEOI.txt" has type "ASCII text"- Location: [%APPDATA%\Microsoft\Windows\Cookies\VP67MEOI.txt]- [targetUID: 00000000-00003636] "8KCLP7LC.txt" has type "ASCII text"- Location: [%APPDATA%\Microsoft\Windows\Cookies\8KCLP7LC.txt]- [targetUID: 00000000-00003636] "X8JT3PTS.txt" has type "ASCII text"- Location: [%APPDATA%\Microsoft\Windows\Cookies\X8JT3PTS.txt]- [targetUID: 00000000-00003636] "KBDGTSMY.txt" has type "ASCII text"- Location: [%APPDATA%\Microsoft\Windows\Cookies\KBDGTSMY.txt]- [targetUID: 00000000-00003636] "DAVDZF12.txt" has type "ASCII text"- Location: [%APPDATA%\Microsoft\Windows\Cookies\DAVDZF12.txt]- [targetUID: 00000000-00003636] "NLO302O4.txt" has type "ASCII text"- Location: [%APPDATA%\Microsoft\Windows\Cookies\NLO302O4.txt]- [targetUID: 00000000-00003636] "arrow_1_.gif" has type "GIF image data version 89a 6 x 9"- [targetUID: N/A] "menubg_1_.gif" has type "GIF image data version 89a 3 x 3"- [targetUID: N/A] "20-12-2023_14.38.23" has type "data"- Location: [%LOCALAPPDATA%\Microsoft Vision\20-12-2023_14.38.23]- [targetUID: 00000000-00003636] "addthis_widget_1_.js" has type "ASCII text with no line terminators"- [targetUID: N/A] "jKWUyswkzQirl.exe" has type "PE32 executable (GUI) Intel 80386 Mono/.Net assembly for MS Windows"- Location: [%APPDATA%\jKWUyswkzQirl.exe]- [targetUID: 00000000-00001384] "saresponsive_1_.js" has type "UTF-8 Unicode text with very long lines with CRLF line terminators"- [targetUID: N/A] "5A61F5EE954AF7C40FE1289BACE2A6BA" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\5A61F5EE954AF7C40FE1289BACE2A6BA]- [targetUID: 00000000-00003636] "~DF2E0CE479D598DF75.TMP" has type "data"- Location: [%TEMP%\~DF2E0CE479D598DF75.TMP]- [targetUID: 00000000-00002944] "nkthpFinK.html" has type "HTML document ASCII text with very long lines"- Location: [%APPDATA%\nkthpFinK.html]- [targetUID: 00000000-00003636] "Bins.exe3HPTP0JI.htm" has type "HTML document ASCII text with very long lines"- Location: [%LOCALAPPDATA%\Microsoft\Windows\Temporary Internet Files\Content.IE5\CKDNCXYS\Bins.exe3HPTP0JI.htm]- [targetUID: 00000000-00003636] "Bins.exeRRI4IE3C.htm" has type "HTML document ASCII text with very long lines"- Location: [%LOCALAPPDATA%\Microsoft\Windows\Temporary Internet Files\Content.IE5\CKDNCXYS\Bins.exeRRI4IE3C.htm]- [targetUID: 00000000-00003636] "Bins.exeR1XAC8XB.htm" has type "HTML document ASCII text with very long lines"- Location: [%LOCALAPPDATA%\Microsoft\Windows\Temporary Internet Files\Content.IE5\CKDNCXYS\Bins.exeR1XAC8XB.htm]- [targetUID: 00000000-00003636] "Bins.exeC5PWJOFT.htm" has type "HTML document ASCII text with very long lines"- Location: [%LOCALAPPDATA%\Microsoft\Windows\Temporary Internet Files\Content.IE5\CKDNCXYS\Bins.exeC5PWJOFT.htm]- [targetUID: 00000000-00003636] "Bins.exeBE3A2KOT.htm" has type "HTML document ASCII text with very long lines"- Location: [%LOCALAPPDATA%\Microsoft\Windows\Temporary Internet Files\Content.IE5\CKDNCXYS\Bins.exeBE3A2KOT.htm]- [targetUID: 00000000-00003636] "Bins.exeO9BQ360L.htm" has type "HTML document ASCII text with very long lines"- Location: [%LOCALAPPDATA%\Microsoft\Windows\Temporary Internet Files\Content.IE5\CKDNCXYS\Bins.exeO9BQ360L.htm]- [targetUID: 00000000-00003636] "vHImy.oGI.html" has type "HTML document ASCII text with very long lines"- Location: [%APPDATA%\vHImy.oGI.html]- [targetUID: 00000000-00003636] "msmqzCpGg.html" has type "HTML document ASCII text with very long lines"- Location: [%APPDATA%\msmqzCpGg.html]- [targetUID: 00000000-00003636] "bxlKf.hho.html" has type "HTML document ASCII text with very long lines"- Location: [%APPDATA%\bxlKf.hho.html]- [targetUID: 00000000-00003636] "Bins.exe_1_.htm" has type "HTML document ASCII text with very long lines"- [targetUID: N/A] "k.hufeesg.html" has type "HTML document ASCII text with very long lines"- Location: [%APPDATA%\k.hufeesg.html]- [targetUID: 00000000-00003636] "Bins.exeYMCPTPB2.htm" has type "HTML document ASCII text with very long lines"- Location: [%LOCALAPPDATA%\Microsoft\Windows\Temporary Internet Files\Content.IE5\CKDNCXYS\Bins.exeYMCPTPB2.htm]- [targetUID: 00000000-00003636] "Bins.exe_4_.htm" has type "HTML document ASCII text with very long lines"- [targetUID: N/A] "Bins.exe_10_.htm" has type "HTML document ASCII text with very long lines"- [targetUID: N/A] "jyo.rquAu.html" has type "HTML document ASCII text with very long lines"- Location: [%APPDATA%\jyo.rquAu.html]- [targetUID: 00000000-00003636] "rsmkwycme.html" has type "HTML document ASCII text with very long lines"- Location: [%APPDATA%\rsmkwycme.html]- [targetUID: 00000000-00003636] "Bins.exe1W1Y6NRZ.htm" has type "HTML document ASCII text with very long lines"- Location: [%LOCALAPPDATA%\Microsoft\Windows\Temporary Internet Files\Content.IE5\CKDNCXYS\Bins.exe1W1Y6NRZ.htm]- [targetUID: 00000000-00003636] "Bpqb.JkcD.html" has type "HTML document ASCII text with very long lines"- Location: [%APPDATA%\Bpqb.JkcD.html]- [targetUID: 00000000-00003636] "Bins.exe_8_.htm" has type "HTML document ASCII text with very long lines"- [targetUID: N/A] "tmpEB38.tmp" has type "XML 1.0 document ASCII text"- Location: [%TEMP%\tmpEB38.tmp]- [targetUID: 00000000-00001472] "tmpB818.tmp" has type "XML 1.0 document ASCII text"- Location: [%TEMP%\tmpB818.tmp]- [targetUID: 00000000-00002436] "ads_2_.htm" has type "HTML document ASCII text with very long lines with no line terminators"- [targetUID: N/A] "ads_1_.htm" has type "HTML document ASCII text with very long lines with no line terminators"- [targetUID: N/A] "ads_3_.htm" has type "HTML document ASCII text with very long lines with no line terminators"- [targetUID: N/A] "ads_4_.htm" has type "HTML document ASCII text with very long lines with no line terminators"- [targetUID: N/A] "ads_6_.htm" has type "HTML document ASCII text with very long lines with no line terminators"- [targetUID: N/A] "ads_7_.htm" has type "HTML document ASCII text with very long lines with no line terminators"- [targetUID: N/A] "45CDC0ZZ.txt" has type "ASCII text"- Location: [%APPDATA%\Microsoft\Windows\Cookies\45CDC0ZZ.txt]- [targetUID: 00000000-00002976] "addthis_widget_2_.js" has type "ASCII text with no line terminators"- [targetUID: N/A]47:T896,"~DF992F5DFBC93C8516.TMP" has type "data" - Location: [%TEMP%\~DF992F5DFBC93C8516.TMP] "~DFCB55E1B0867CC064.TMP" has type "data" - Location: [%TEMP%\~DFCB55E1B0867CC064.TMP] "~DFB9E56D64B612DA53.TMP" has type "data" - Location: [%TEMP%\~DFB9E56D64B612DA53.TMP] "~DFE39FA66303298C75.TMP" has type "data" - Location: [%TEMP%\~DFE39FA66303298C75.TMP] "~DF633135EEDDB63B23.TMP" has type "data" - Location: [%TEMP%\~DF633135EEDDB63B23.TMP] "~DFFD1A2DC79BFDB5D6.TMP" has type "data" - Location: [%TEMP%\~DFFD1A2DC79BFDB5D6.TMP] "~DF516805D85DC744F7.TMP" has type "data" - Location: [%TEMP%\~DF516805D85DC744F7.TMP] "~DFDC44E5F9E917E285.TMP" has type "data" - Location: [%TEMP%\~DFDC44E5F9E917E285.TMP] "~DFA784416CF06565FC.TMP" has type "data" - Location: [%TEMP%\~DFA784416CF06565FC.TMP] "~DFE98BABDD72418E29.TMP" has type "data" - Location: [%TEMP%\~DFE98BABDD72418E29.TMP] "~DF0B851F8624C057CE.TMP" has type "data" - Location: [%TEMP%\~DF0B851F8624C057CE.TMP] "~DF4246D01F9D58C68D.TMP" has type "data" - Location: [%TEMP%\~DF4246D01F9D58C68D.TMP] "~DFDC67EDD84E782B80.TMP" has type "data" - Location: [%TEMP%\~DFDC67EDD84E782B80.TMP] "~DFBB32AE98E8788839.TMP" has type "data" - Location: [%TEMP%\~DFBB32AE98E8788839.TMP] "~DF673FB79EAC572A2C.TMP" has type "data" - Location: [%TEMP%\~DF673FB79EAC572A2C.TMP] "~DF3FEBA25FCC2DE08C.TMP" has type "data" - Location: [%TEMP%\~DF3FEBA25FCC2DE08C.TMP] "~DF2111FD8202D9AFF3.TMP" has type "data" - Location: [%TEMP%\~DF2111FD8202D9AFF3.TMP] "~DFCA3E18AE2F2EF491.TMP" has type "data" - Location: [%TEMP%\~DFCA3E18AE2F2EF491.TMP] "~DFD3BCF02C37B2A6B5.TMP" has type "data" - Location: [%TEMP%\~DFD3BCF02C37B2A6B5.TMP] "~DFDAD3B232698010D3.TMP" has type "data" - Location: [%TEMP%\~DFDAD3B232698010D3.TMP] "~DFF8FCF58B54755482.TMP" has type "data" - Location: [%TEMP%\~DFF8FCF58B54755482.TMP] "~DF43C6FFCEA18BB4B1.TMP" has type "data" - Location: [%TEMP%\~DF43C6FFCEA18BB4B1.TMP] "~DF0789426FF13D2E71.TMP" has type "data" - Location: [%TEMP%\~DF0789426FF13D2E71.TMP] "~DFFEDA1657947AAA9A.TMP" has type "data" - Location: [%TEMP%\~DFFEDA1657947AAA9A.TMP] "~DF1FEDE64777CE2501.TMP" has type "data" - Location: [%TEMP%\~DF1FEDE64777CE2501.TMP]48:T664,"PO53623.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: ""; Value: "") "PO53623.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\TIME ZONES\ROMANCE STANDARD TIME\DYNAMIC DST"; Key: ""; Value: "") "PO53623.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: ""; Value: "") "PO53623.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: ""; Value: "") "PO53623.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SAFEBOOT\OPTION"; Key: ""; Value: "") "PO53623.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SRP\GP\DLL"; Key: ""; Value: "") "PO53623.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "PO53623.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "PO53623.exe" (Access type: "OPEN"; Path: "HKLM"; Key: ""; Value: "") "PO53623.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\DIAGNOSTICS"; Key: ""; Value: "") "PO53623.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\.NETFRAMEWORK\POLICY\"; Key: ""; Value: "") "PO53623.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\.NETFRAMEWORK\POLICY\V4.0"; Key: ""; Value: "") "PO53623.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\.NETFRAMEWORK"; Key: ""; Value: "") "PO53623.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\.NETFRAMEWORK"; Key: ""; Value: "")49:T681,"schtasks.exe" (Access type: "OPEN"; Path: "HKCU\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}"; Key: ""; Value: "") "schtasks.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}"; Key: ""; Value: "") "schtasks.exe" (Access type: "OPEN"; Path: "HKCU\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\TREATAS"; Key: ""; Value: "") "schtasks.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\TREATAS"; Key: ""; Value: "") "schtasks.exe" (Access type: "OPEN"; Path: "HKCU\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\PROGID"; Key: ""; Value: "") "schtasks.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\PROGID"; Key: ""; Value: "") "schtasks.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\PROGID"; Key: ""; Value: "") "schtasks.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}"; Key: ""; Value: "") "schtasks.exe" (Access type: "OPEN"; Path: "HKCU\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\INPROCSERVER32"; Key: ""; Value: "") "schtasks.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\INPROCSERVER32"; Key: ""; Value: "") "schtasks.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\INPROCSERVER32"; Key: "INPROCSERVER32"; Value: "") "schtasks.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\INPROCSERVER32"; Key: ""; Value: "")4a:Tab0,"PO53623.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "BIAS"; Value: "") "PO53623.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "STANDARDNAME"; Value: "") "PO53623.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "STANDARDBIAS"; Value: "") "PO53623.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "STANDARDSTART"; Value: "") "PO53623.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "DAYLIGHTNAME"; Value: "") "PO53623.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "DAYLIGHTBIAS"; Value: "") "PO53623.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "DAYLIGHTSTART"; Value: "") "PO53623.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "TIMEZONEKEYNAME"; Value: "") "PO53623.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "DYNAMICDAYLIGHTTIMEDISABLED"; Value: "") "PO53623.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "ACTIVETIMEBIAS"; Value: "") "PO53623.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "CWDILLEGALINDLLSEARCH"; Value: "") "PO53623.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: "COMPATDLL"; Value: "") "PO53623.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: "00060101.00060101"; Value: "") "PO53623.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: ""; Value: "") "PO53623.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED"; Value: "") "PO53623.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "SAFEDLLSEARCHMODE"; Value: "") "PO53623.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\.NETFRAMEWORK"; Key: "INSTALLROOT"; Value: "") "PO53623.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\.NETFRAMEWORK"; Key: "CLRLOADLOGDIR"; Value: "") "PO53623.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\GRE_INITIALIZE"; Key: "DISABLEMETAFILES"; Value: "") "PO53623.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\COMPATIBILITY32"; Key: "PO53623"; Value: "")4b:T4e4,"PO53623.exe" reads file "c:\windows\microsoft.net\framework\v4.0.30319\config\machine.config" "PO53623.exe" reads file "c:\windows\assembly\nativeimages_v4.0.30319_32\mscorlib\36eaccfde177c2e7b93b8dbdde4e012a\mscorlib.ni.dll.aux" "PO53623.exe" reads file "c:\windows\assembly\nativeimages_v4.0.30319_32\system.windows.forms\c9a4cbc00f690a9e3cddfc400f6e85bb\system.windows.forms.ni.dll.aux" "PO53623.exe" reads file "c:\windows\assembly\nativeimages_v4.0.30319_32\system\0b2f69b43a576b9edcc807a30872bd91\system.ni.dll.aux" "PO53623.exe" reads file "c:\windows\assembly\nativeimages_v4.0.30319_32\system\2c3c912ea8f058f9d04c4650128feb3f\system.ni.dll.aux" "PO53623.exe" reads file "c:\windows\assembly\nativeimages_v4.0.30319_32\system.drawing\f7568d7f1b9d356f64779b4c0927cfb3\system.drawing.ni.dll.aux" "PO53623.exe" reads file "c:\windows\assembly\nativeimages_v4.0.30319_32\system.configuration\96f7edb07b12303f0ec2595c7f3778c7\system.configuration.ni.dll.aux" "PO53623.exe" reads file "c:\windows\assembly\nativeimages_v4.0.30319_32\system.core\31fae3290fad30c31c98651462d22724\system.core.ni.dll.aux" "PO53623.exe" reads file "c:\windows\assembly\nativeimages_v4.0.30319_32\system.xml\15af16d373cf0528cb74fc73d365fdbf\system.xml.ni.dll.aux"4c:T5a1,"PO53623.exe" trying to touch file "C:\Windows\SYSTEM32\MSCOREE.DLL" "PO53623.exe" trying to touch file "C:\Windows\SYSTEM32\sechost.dll" "PO53623.exe" trying to touch file "C:\Windows\SYSTEM32\MSCOREE.DLL.local" "PO53623.exe" trying to touch file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll" "PO53623.exe" trying to touch file "C:\Windows\system32\api-ms-win-core-synch-l1-2-0.DLL" "PO53623.exe" trying to touch file "C:\Windows\system32\api-ms-win-core-fibers-l1-1-1.DLL" "PO53623.exe" trying to touch file "C:\Windows\system32\api-ms-win-core-localization-l1-2-1.DLL" "PO53623.exe" trying to touch file "C:\Windows\Microsoft.NET\Framework\v1.0.3705\clr.dll" "PO53623.exe" trying to touch file "C:\Windows\Microsoft.NET\Framework\v1.0.3705\mscorwks.dll" "PO53623.exe" trying to touch file "C:\Windows\Microsoft.NET\Framework\v1.1.4322\clr.dll" "PO53623.exe" trying to touch file "C:\Windows\Microsoft.NET\Framework\v1.1.4322\mscorwks.dll" "PO53623.exe" trying to touch file "C:\Windows\Microsoft.NET\Framework\v2.0.50727\clr.dll" "PO53623.exe" trying to touch file "C:\Windows\system32\IMM32.DLL" "PO53623.exe" trying to touch file "C:\PO53623.exe.config" "PO53623.exe" trying to touch file "C:\Windows\Temp\VxOle32.dll" "PO53623.exe" trying to touch file "C:\FLTLIB.DLL" "PO53623.exe" trying to touch file "C:\Windows\system32\FLTLIB.DLL" "PO53623.exe" trying to touch file "\FileSystem\Filters\FltMgrMsg"4d:T920,"PO53623.exe" touched file "C:\Windows\Microsoft.NET\Framework\v1.0.3705\clr.dll" "PO53623.exe" touched file "C:\Windows\Microsoft.NET\Framework\v1.0.3705\mscorwks.dll" "PO53623.exe" touched file "C:\Windows\Microsoft.NET\Framework\v1.1.4322\clr.dll" "PO53623.exe" touched file "C:\Windows\Microsoft.NET\Framework\v1.1.4322\mscorwks.dll" "PO53623.exe" touched file "C:\Windows\Microsoft.NET\Framework\v2.0.50727\clr.dll" "PO53623.exe" touched file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\Windows\Caches" "PO53623.exe" touched file "%LOCALAPPDATA%\Microsoft\Windows\Caches" "powershell.exe" touched file "C:\Windows\Microsoft.NET\Framework\v1.0.3705\clr.dll" "powershell.exe" touched file "C:\Windows\Microsoft.NET\Framework\v1.0.3705\mscorwks.dll" "powershell.exe" touched file "C:\Windows\Microsoft.NET\Framework\v1.1.4322\clr.dll" "powershell.exe" touched file "C:\Windows\Microsoft.NET\Framework\v1.1.4322\mscorwks.dll" "powershell.exe" touched file "C:\Windows\Microsoft.NET\Framework\v2.0.50727\clr.dll" "powershell.exe" touched file "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe.config" "powershell.exe" touched file "C:\Windows\Microsoft.NET\Framework\v2.0.50727\config\security.config" "powershell.exe" touched file "C:\Windows\Microsoft.NET\Framework\v2.0.50727\config\security.config.cch" "powershell.exe" touched file "C:\Windows\Microsoft.NET\Framework\v2.0.50727\config\enterprisesec.config" "powershell.exe" touched file "C:\Windows\Microsoft.NET\Framework\v2.0.50727\config\enterprisesec.config.cch" "powershell.exe" touched file "C:\Windows\assembly\GAC_MSIL\System.Management.Automation\1.0.0.0__31bf3856ad364e35\System.Management.Automation.pdb" "powershell.exe" touched file "C:\Windows\System.Management.Automation.pdb" "powershell.exe" touched file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\Windows\Caches" "powershell.exe" touched file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations" "powershell.exe" touched file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\3BE8EOGDG52GSP4U1A2M.temp" "powershell.exe" touched file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms~RFfbf87.TMP"4e:T56c,"PO53623.exe" trying to access non-existent file "C:\Windows\system32\api-ms-win-core-fibers-l1-1-1.DLL" "PO53623.exe" trying to access non-existent file "C:\Windows\system32\api-ms-win-core-localization-l1-2-1.DLL" "PO53623.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v1.0.3705\clr.dll" "PO53623.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v1.0.3705\mscorwks.dll" "PO53623.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v1.1.4322\clr.dll" "PO53623.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v1.1.4322\mscorwks.dll" "PO53623.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v2.0.50727\clr.dll" "PO53623.exe" trying to access non-existent file "C:\FLTLIB.DLL" "PO53623.exe" trying to access non-existent file "C:\Windows\system32\api-ms-win-appmodel-runtime-l1-1-2.dll" "PO53623.exe" trying to access non-existent file "C:\Windows\system32\api-ms-win-appmodel-runtime-l1-1-0.dll" "PO53623.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\VCRUNTIME140_CLR0400.dll" "PO53623.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\ucrtbase_clr0400.dll" "PO53623.exe" trying to access non-existent file "C:\Windows\system32\api-ms-win-core-quirks-l1-1-0.dll"4f:T517,"PO53623.exe" trying to access non-existent file "C:\Windows\SYSTEM32\MSCOREE.DLL.local" "PO53623.exe" trying to access non-existent file "C:\PO53623.exe.config" "PO53623.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\fusion.localgac" "PO53623.exe" trying to access non-existent file "C:\Windows\assembly\NativeImages_v4.0.30319_32\iPzt\" "PO53623.exe" trying to access non-existent file "C:\PO53623.INI" "PO53623.exe" trying to access non-existent file "C:\PO53623.exe.Local\" "PO53623.exe" trying to access non-existent file "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe:Zone.Identifier" "PO53623.exe" trying to access non-existent file "C:\Windows\System32\schtasks.exe:Zone.Identifier" "PO53623.exe" trying to access non-existent file "\Device\HarddiskVolume2\Windows\System32\MSCOREE.DLL.LOCAL" "PO53623.exe" trying to access non-existent file "\Device\HarddiskVolume2\PO53623.EXE.CONFIG" "PO53623.exe" trying to access non-existent file "\Device\HarddiskVolume2\Windows\Microsoft.NET\Framework\v4.0.30319\FUSION.LOCALGAC" "PO53623.exe" trying to access non-existent file "\Device\HarddiskVolume2\Windows\assembly\NativeImages_v4.0.30319_32\IPZT" "PO53623.exe" trying to access non-existent file "\Device\HarddiskVolume2\PO53623.INI"50:Td56,Found http requests in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAoFmyX1Sz2HlMxmMUd1OKM%3D" Found http requests in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQlOydjtpho0%2Bholo77zGjGxETUEQQU8JyF%2FaKffY%2FJaLvV1IlNHb7TkP8CEAHqRFnqJyQkmYqUpX34D7k%3D" Found http requests in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D" Found http requests in header "GET /gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D" Found http requests in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAbY2QTVWENG9oovp1QifsQ%3D" Found http requests in header "GET //MEowSDBGMEQwQjAJBgUrDgMCGgUABBSLwZ6EW5gdYc9UaSEaaLjjETNtkAQUv1%2B30c7dH4b0W1Ws3NcQwg6piOcCCQCnDkpMNIK3fw%3D%3D" Found http requests in header "GET /gtsr1/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBQwkcLWD4LqGJ7bE7B1XZsEbmfwUAQU5K8rJnEaK0gnhS9SZizv8IkTcT4CDQIDvFNZazTHGPUBUGY%3D" Found http requests in header "GET /gts1c3/QqFxbi9M48c.crl" Found http requests in header "GET /gts1c3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEGupzMnM%2BqGaCjIQPyd58u0%3D" Found http requests in header "GET /MFQwUjBQME4wTDAJBgUrDgMCGgUABBSIfaREXmfqfJR3TkMYnD7O5MhzEgQUnF8A36oB1zArOIiiuG1KnPIRkYMCEwZ%2FlEoqJ83z%2BsKuKwH5CO65xMY%3D" Found http requests in header "GET /rootg2.crl" Found http requests in header "GET /gts1c3/moVDfISia2k.crl" Found http requests in header "GET /gtsr1/gtsr1.crl" Found http requests in header "GET /gts1c3/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEQCZXmpIP%2Bo%2BHhJmodADfw%2Fc" Found http requests in header "GET /rootca1.crl" Found http requests in header "GET /MFQwUjBQME4wTDAJBgUrDgMCGgUABBRPWaOUU8%2B5VZ5%2Fa9jFTaU9pkK3FAQUhBjMhTTsvAyUlC4IWZzHshBOCggCEwdzEjgLnWaIozse2b%2BczaaODg8%3D" Found http requests in header "GET /script?space=50dd7b0f-4105-441f-8f60-18cc3fcb090c&type=direct&page_id=1580123&screen_width=750&screen_height=346&os=Win32&refurl=&pageurl=file%3A%2F%2FC%3A%5CUsers%5CHAPUBWS%5CAppData%5CRoaming%5Cjyo.rquAu.html&rnd=1703066602178" Found http requests in header "GET /script?space=50dd7b0f-4105-441f-8f60-18cc3fcb090c&type=direct&page_id=2640849&screen_width=750&screen_height=346&os=Win32&refurl=&pageurl=file%3A%2F%2FC%3A%5CUsers%5CHAPUBWS%5CAppData%5CRoaming%5CBJGIC..kG.html&rnd=1703067267588" Found http requests in header "GET /gts1c3/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEQDHvwlxZ6tgTQmj1PR%2BmThA" Found http requests in header "GET /gts1c3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEDEixfO34qnbCeE6N8VMp00%3D" Found http requests in header "GET /script?space=50dd7b0f-4105-441f-8f60-18cc3fcb090c&type=direct&page_id=1439366&screen_width=750&screen_height=346&os=Win32&refurl=&pageurl=file%3A%2F%2FC%3A%5CUsers%5CHAPUBWS%5CAppData%5CRoaming%5CvHImy.oGI.html&rnd=1703068954450" Found http requests in header "GET /script?space=50dd7b0f-4105-441f-8f60-18cc3fcb090c&type=direct&page_id=2535744&screen_width=750&screen_height=346&os=Win32&refurl=&pageurl=file%3A%2F%2FC%3A%5CUsers%5CHAPUBWS%5CAppData%5CRoaming%5Ck.hufeesg.html&rnd=1703070950363"51:T2f9a,Found requests in header "GET /images/est/flag.png HTTP/1.1Accept: image/png, image/svg+xml, image/*;q=0.8, */*;q=0.5Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: www.upload.eeDNT: 1Connection: Keep-AliveCookie: lng=eng"; in File: "SSL") Found requests in header "GET /images/rus/flag.png HTTP/1.1Accept: image/png, image/svg+xml, image/*;q=0.8, */*;q=0.5Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: www.upload.eeDNT: 1Connection: Keep-AliveCookie: lng=eng"; in File: "SSL") Found requests in header "GET /static/ubr__style.css HTTP/1.1Accept: text/css, */*Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: www.upload.eeDNT: 1Connection: Keep-AliveCookie: lng=eng"; in File: "SSL") Found requests in header "GET /js/js__file_upload.js HTTP/1.1Accept: application/javascript, */*;q=0.8Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: www.upload.eeDNT: 1Connection: Keep-AliveCookie: lng=eng"; in File: "SSL") Found requests in header "GET /images/eng/flag.png HTTP/1.1Accept: image/png, image/svg+xml, image/*;q=0.8, */*;q=0.5Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: www.upload.eeDNT: 1Connection: Keep-AliveCookie: lng=eng"; in File: "SSL") Found requests in header "GET /images/arrow.gif HTTP/1.1Accept: image/png, image/svg+xml, image/*;q=0.8, */*;q=0.5Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: www.upload.eeDNT: 1Connection: Keep-AliveCookie: lng=eng"; in File: "SSL") Found requests in header "GET /images/eng/logo.png HTTP/1.1Accept: image/png, image/svg+xml, image/*;q=0.8, */*;q=0.5Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: www.upload.eeDNT: 1Connection: Keep-AliveCookie: lng=eng"; in File: "SSL") Found requests in header "GET /images/dl_.png HTTP/1.1Accept: image/png, image/svg+xml, image/*;q=0.8, */*;q=0.5Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: www.upload.eeDNT: 1Connection: Keep-AliveCookie: lng=eng"; in File: "SSL") Found requests in header "GET /images/menubg.gif HTTP/1.1Accept: image/png, image/svg+xml, image/*;q=0.8, */*;q=0.5Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: www.upload.eeDNT: 1Connection: Keep-AliveCookie: lng=eng"; in File: "SSL") Found requests in header "GET /images/eng/logo.png HTTP/1.1Accept: image/png, image/svg+xml, image/*;q=0.8, */*;q=0.5Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: www.upload.eeIf-Modified-Since: Sat, 10 Dec 2011 17:22:00 GMTIf-None-Match: "4ee39538-28cb"DNT: 1Connection: Keep-AliveCookie: lng=eng"; in File: "SSL") Found requests in header "GET /images/rus/flag.png HTTP/1.1Accept: image/png, image/svg+xml, image/*;q=0.8, */*;q=0.5Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: www.upload.eeIf-Modified-Since: Sat, 10 Dec 2011 17:22:10 GMTIf-None-Match: "4ee39542-160"DNT: 1Connection: Keep-AliveCookie: lng=eng"; in File: "SSL") Found requests in header "GET /images/eng/flag.png HTTP/1.1Accept: image/png, image/svg+xml, image/*;q=0.8, */*;q=0.5Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: www.upload.eeIf-Modified-Since: Fri, 04 Oct 2013 09:04:37 GMTIf-None-Match: "524e84a5-246"DNT: 1Connection: Keep-AliveCookie: lng=eng"; in File: "SSL") Found requests in header "GET /js/js__file_upload.js HTTP/1.1Accept: application/javascript, */*;q=0.8Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: www.upload.eeIf-Modified-Since: Tue, 17 Oct 2023 12:32:21 GMTIf-None-Match: W/"652e7ed5-651c"DNT: 1Connection: Keep-AliveCookie: lng=eng"; in File: "SSL") Found requests in header "GET /static/ubr__style.css HTTP/1.1Accept: text/css, */*Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: www.upload.eeIf-Modified-Since: Tue, 17 Oct 2023 12:17:20 GMTIf-None-Match: W/"652e7b50-24da"DNT: 1Connection: Keep-AliveCookie: lng=eng"; in File: "SSL") Found requests in header "GET /images/est/flag.png HTTP/1.1Accept: image/png, image/svg+xml, image/*;q=0.8, */*;q=0.5Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: www.upload.eeIf-Modified-Since: Sat, 10 Dec 2011 17:21:35 GMTIf-None-Match: "4ee3951f-15e"DNT: 1Connection: Keep-AliveCookie: lng=eng"; in File: "SSL") Found requests in header "GET /images/arrow.gif HTTP/1.1Accept: image/png, image/svg+xml, image/*;q=0.8, */*;q=0.5Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: www.upload.eeIf-Modified-Since: Sun, 14 Apr 2013 07:15:01 GMTIf-None-Match: "516a5775-3b"DNT: 1Connection: Keep-AliveCookie: lng=eng"; in File: "SSL") Found requests in header "GET /images/dl_.png HTTP/1.1Accept: image/png, image/svg+xml, image/*;q=0.8, */*;q=0.5Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: www.upload.eeIf-Modified-Since: Thu, 01 Dec 2016 09:37:27 GMTIf-None-Match: "583fef57-76c"DNT: 1Connection: Keep-AliveCookie: lng=eng"; in File: "SSL") Found requests in header "GET /images/dl_hover_.png HTTP/1.1Accept: image/png, image/svg+xml, image/*;q=0.8, */*;q=0.5Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: www.upload.eeDNT: 1Connection: Keep-AliveCookie: lng=eng"; in File: "SSL") Found requests in header "GET /pagead/html/r20231207/r20190131/zrt_lookup.html HTTP/1.1Accept: text/html, application/xhtml+xml, */*Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: googleads.g.doubleclick.netIf-None-Match: 14902866265712643852DNT: 1Connection: Keep-Alive"; in File: "SSL") Found requests in header "GET /pagead/ads?client=ca-pub-5364884771898146&output=html&adk=1812271804&adf=3025194257&lmt=1703070100&plat=1%3A1048584%2C2%3A1048584%2C3%3A3211264%2C4%3A3211264%2C8%3A4194304%2C9%3A134250504%2C16%3A8388608%2C17%3A32%2C24%3A32%2C25%3A32%2C30%3A1048576%2C32%3A32%2C41%3A32%2C42%3A32&format=0x0&url=file%3A%2F%2FC%3A%5CUsers%5CHAPUBWS%5CAppData%5CRoaming%5Ck.hufeesg.html&ea=0&pra=5&wgl=1&easpi=0&asro=0&asiscm=1&aslmt=0.4&asamt=-1&asedf=0&asefa=1&aseiel=1~2~4~6&aslcwct=150&asacwct=25&dt=1703070950528&bpp=59813&bdt=-M&idt=59988&shv=r20231207&mjsv=m202312070101&ptt=9&saldr=aa&abxe=1&nras=1&correlator=5584564366234&frm=20&pv=2&ga_vid=274169830.1703066907&ga_sid=1703071070&ga_hid=931347174&ga_fc=1&u_tz=60&u_his=1&u_h=800&u_w=1280&u_ah=760&u_aw=1280&u_cd=24&u_sd=1&adx=-12245933&ady=-12245933&biw=750&bih=346&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C95320884&oid=2&pvsid=4221332360872920&tmod=764638823&nvt=1&fsapi=1&top=file%3A%2F%2F%2FC%3A%2FUsers%2FHAPUBWS%2FAppData%2FRoaming%2Fk.hufeesg.html&fc=1920&docm=11&brdim=112%2C149%2C104%2C42%2C1280%2C%2C783%2C478%2C767%2C363&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=33792&bc=1&ifi=1&uci=a!1&dtd=M HTTP/1.1Accept: text/html, application/xhtml+xml, */*Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: googleads.g.doubleclick.netDNT: 1Connection: Keep-Alive"; in File: "SSL") Found requests in header "GET /pagead/ads?client=ca-pub-5364884771898146&output=html&adk=1812271804&adf=3025194257&lmt=1703077092&plat=1%3A1048584%2C2%3A1048584%2C3%3A3211264%2C4%3A3211264%2C8%3A4194304%2C9%3A134250504%2C16%3A8388608%2C17%3A32%2C24%3A32%2C25%3A32%2C30%3A1048576%2C32%3A32%2C41%3A32%2C42%3A32&format=0x0&url=file%3A%2F%2FC%3A%5CUsers%5CHAPUBWS%5CAppData%5CRoaming%5CmsmqzCpGg.html&ea=0&pra=5&wgl=1&easpi=0&asro=0&asiscm=1&aslmt=0.4&asamt=-1&asedf=0&asefa=1&aseiel=1~2~4~6&aslcwct=150&asacwct=25&dt=1703077877680&bpp=60005&bdt=-M&idt=M&shv=r20231207&mjsv=m202312070101&ptt=9&saldr=aa&abxe=1&nras=1&correlator=682052785618&frm=20&pv=2&ga_vid=274169830.1703066907&ga_sid=1703078178&ga_hid=122175310&ga_fc=1&u_tz=60&u_his=1&u_h=800&u_w=1280&u_ah=760&u_aw=1280&u_cd=24&u_sd=1&adx=-12245933&ady=-12245933&biw=750&bih=346&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44759837%2C95320885&oid=2&pvsid=3695690652538393&tmod=1781222597&nvt=1&fsapi=1&top=file%3A%2F%2F%2FC%3A%2FUsers%2FHAPUBWS%2FAppData%2FRoaming%2FmsmqzCpGg.html&fc=1920&docm=11&brdim=112%2C149%2C104%2C42%2C1280%2C%2C783%2C478%2C767%2C363&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=33792&bc=1&ifi=1&uci=a!1&dtd=M HTTP/1.1Accept: text/html, application/xhtml+xml, */*Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: googleads.g.doubleclick.netDNT: 1Connection: Keep-Alive"; in File: "SSL") Found requests in header "GET /pagead/ads?client=ca-pub-5364884771898146&output=html&adk=1812271804&adf=3025194257&lmt=1703079803&plat=1%3A1048584%2C2%3A1048584%2C3%3A3211264%2C4%3A3211264%2C8%3A4194304%2C9%3A134250504%2C16%3A8388608%2C17%3A32%2C24%3A32%2C25%3A32%2C30%3A1048576%2C32%3A32%2C41%3A32%2C42%3A32&format=0x0&url=file%3A%2F%2FC%3A%5CUsers%5CHAPUBWS%5CAppData%5CRoaming%5CjtiAoryjf.html&ea=0&pra=5&wgl=1&easpi=0&asro=0&asiscm=1&aslmt=0.4&asamt=-1&asedf=0&asefa=1&aseiel=1~2~4~6&aslcwct=150&asacwct=25&dt=1703081389795&bpp=58&bdt=-M&idt=M&shv=r20231207&mjsv=m202312070101&ptt=9&saldr=aa&abxe=1&nras=1&correlator=1384350671870&frm=20&pv=2&ga_vid=274169830.1703066907&ga_sid=1703081820&ga_hid=1425962088&ga_fc=1&u_tz=60&u_his=1&u_h=800&u_w=1280&u_ah=760&u_aw=1280&u_cd=24&u_sd=1&adx=-12245933&ady=-12245933&biw=750&bih=346&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C31079438%2C95320884&oid=2&pvsid=570425132829843&tmod=9331265&nvt=1&fsapi=1&top=file%3A%2F%2F%2FC%3A%2FUsers%2FHAPUBWS%2FAppData%2FRoaming%2FjtiAoryjf.html&fc=1920&docm=11&brdim=0%2C107%2C0%2C85%2C1280%2C%2C767%2C385%2C767%2C363&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=33792&bc=1&ifi=1&uci=a!1&dtd=M HTTP/1.1Accept: text/html, application/xhtml+xml, */*Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: googleads.g.doubleclick.netDNT: 1Connection: Keep-Alive"; in File: "SSL") Found requests in header "GET /analytics.js HTTP/1.1Accept: application/javascript, */*;q=0.8Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: www.google-analytics.comIf-Modified-Since: Tue, 12 Dec 2023 18:09:08 GMTDNT: 1Connection: Keep-Alive"; in File: "SSL") Found requests in header "GET /script?space=50dd7b0f-4105-441f-8f60-18cc3fcb090c&type=direct&page_id=1582480&screen_width=750&screen_height=346&os=Win32&refurl=&pageurl=file%3A%2F%2FC%3A%5CUsers%5CHAPUBWS%5CAppData%5CRoaming%5CaHmJKtizD.html&rnd=1703091115103 HTTP/1.1Accept: application/javascript, */*;q=0.8Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateDNT: 1Cookie: bepolite_id=f80e496ccfa32edd25394772808105b7Connection: Keep-AliveHost: serving.bepolite.eu"; in File: "SSL") Found requests in header "GET /?dupud=997369 HTTP/1.1Accept: application/javascript, */*;q=0.8Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: du0pud0sdlmzf.cloudfront.netDNT: 1Connection: Keep-Alive"; in File: "SSL")52:T515,Found reference to API "WSASend" (Indicator: "WSASend"; Source: "00000000-00003636-00000C26-79113929") Found reference to API "WSARecv" (Indicator: "WSARecv"; Source: "00000000-00003636-00000C26-79114929") Found reference to API "WinHttpOpen" (Indicator: "WinHttpOpen"; Source: "00000000-00003636-00000C26-80184497") Found reference to API "WinHttpConnect" (Indicator: "WinHttpConnect"; Source: "00000000-00003636-00000C26-80339586") Found reference to API "WinHttpOpenRequest" (Indicator: "HttpOpenRequest"; Source: "00000000-00003636-00000C26-80339899") Found reference to API "WinHttpOpenRequest" (Indicator: "WinHttpOpen"; Source: "00000000-00003636-00000C26-80339899") Found reference to API "WinHttpOpenRequest" (Indicator: "WinHttpOpenRequest"; Source: "00000000-00003636-00000C26-80339899") Found reference to API "WinHttpSendRequest" (Indicator: "HttpSendRequest"; Source: "00000000-00003636-00000C26-80629486") Found reference to API "WinHttpSendRequest" (Indicator: "WinHttpSendRequest"; Source: "00000000-00003636-00000C26-80629486") Found reference to API "WinHttpQueryHeaders" (Indicator: "WinHttpQueryHeaders"; Source: "00000000-00003636-00000C26-80667357") Found reference to API "WinHttpReadData" (Indicator: "WinHttpReadData"; Source: "00000000-00003636-00000C26-80668023")53:Tbb3d,"GET /images/est/flag.png HTTP/1.1Accept: image/png, image/svg+xml, image/*;q=0.8, */*;q=0.5Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: www.upload.eeDNT: 1Connection: Keep-AliveCookie: lng=eng" "GET /images/rus/flag.png HTTP/1.1Accept: image/png, image/svg+xml, image/*;q=0.8, */*;q=0.5Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: www.upload.eeDNT: 1Connection: Keep-AliveCookie: lng=eng" "GET /static/ubr__style.css HTTP/1.1Accept: text/css, */*Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: www.upload.eeDNT: 1Connection: Keep-AliveCookie: lng=eng" "GET /js/js__file_upload.js HTTP/1.1Accept: application/javascript, */*;q=0.8Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: www.upload.eeDNT: 1Connection: Keep-AliveCookie: lng=eng" "GET /images/eng/flag.png HTTP/1.1Accept: image/png, image/svg+xml, image/*;q=0.8, */*;q=0.5Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: www.upload.eeDNT: 1Connection: Keep-AliveCookie: lng=eng" "GET /images/arrow.gif HTTP/1.1Accept: image/png, image/svg+xml, image/*;q=0.8, */*;q=0.5Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: www.upload.eeDNT: 1Connection: Keep-AliveCookie: lng=eng" "GET /images/eng/logo.png HTTP/1.1Accept: image/png, image/svg+xml, image/*;q=0.8, */*;q=0.5Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: www.upload.eeDNT: 1Connection: Keep-AliveCookie: lng=eng" "GET /images/dl_.png HTTP/1.1Accept: image/png, image/svg+xml, image/*;q=0.8, */*;q=0.5Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: www.upload.eeDNT: 1Connection: Keep-AliveCookie: lng=eng" "HTTP/1.1 200 OKServer: nginxDate: Wed, 20 Dec 2023 08:31:11 GMTContent-Type: image/gifContent-Length: 59Last-Modified: Sun, 14 Apr 2013 07:15:01 GMTConnection: keep-aliveKeep-Alive: timeout=20ETag: "516a5775-3b"Expires: Wed, 27 Dec 2023 08:31:11 GMTCache-Control: max-age=604800Accept-Ranges: bytesGIF89a�0x��!�,�a��j��lN�;" "HTTP/1.1 200 OKServer: nginxDate: Wed, 20 Dec 2023 08:31:11 GMTContent-Type: image/pngContent-Length: 10443Last-Modified: Sat, 10 Dec 2011 17:22:00 GMTConnection: keep-aliveKeep-Alive: timeout=20ETag: "4ee39538-28cb"Expires: Wed, 27 Dec 2023 08:31:11 GMTCache-Control: max-age=604800Accept-Ranges: bytes�PNGIHDR�G&�$�(�IDATx��\|��*�(�b��(J��|��|O��)J�!��!��.E�� Jzi�$�׽w��{��{H�~?�{��~�8gg�9sf�3gg��W��Ԙ�G��a~�a~�#�O~��O~��:�<�OP�<<��I�<��TY�TB9��*�0I�Z�R�U]��UAq@��4F`$s*Ʌ(�+�m�킩�D&2�\+-�`|�C��6�UZ+��2<>3��bV�j�x��-�W�B�}�e��rz�d^^s��y��I(PQ��~k�e��4��QFscd�gŭE�mŞ��69]��q#�Y��m��j��1��-q��\> E�n�8t�8�g��16WW�LT�Z�m��e�L߅,ɀ/��=�Mbd��o+��>�~��r�'{�.��&$��b��\�YwR¢2��ln@��r�(4@�{��b�2��"4*Y�$�Krß��i��U?Tk��x0*{"��uDH��kx�K�^�9xN�HpC��"v�w��d��#�M�6��Kqqq`��Ik۶mq2)2$�!fff6�y��O�^��O2��o��>�W�}�<�āy7I�8��y�d#�]�齐o��0O��P��C<�g��K�E��͒j�?r;�z��>2��&�8}O��MO9��73>O��e�$VY��o��Cݑ ��æL�.T��-p)�^�N�d��$؝�!)�>c�;�ldn�{ɒ%q^D��.��R�? �t�R�rR��˄��Go�{/��MDξ��Xű^q.EX�QK�&x�2v��~�Q��މ��\��v7p6��n\�Np��$�N��7�_s��? � #�3�6?��A!E6:��un��6��>�c"�c�ߋ��&j�@T��.�1��>�-J,��j\��&H�O��D�G!��B�ip`��.cUUU��P5�|b��V�*��*��B�p� �s��ǥ��8��xR��}��4Y ��_rT #v��;^��H0J�/>&�T�i'��o'H�x7&�W"��Ŭ�%�l��x�/E��Cٴr��g4�f�o�W��|�A�z+�%x��RE�d��<��8ǣ]�J$kR�3J�(��3��ϼ��`�pȃx�mD��OK8�t��]~�f�Rc�۩�� d��~ٲeX��ƍi�Ν;7ߗ��x��e��|��7V��T/��F��Q��>��@��+N��~+��3��+օ��ޱ�0�(G-�t9,�;�j��wK��[�,��g�Վ��۰Wk2��I��[�XFӫ�E"��^��7�۱��Q�<��9J��-Xɿ��O��Mx��J:�gj��g$0��oek-��4��X��A}�5��Q�1wAXZZڼ:P�'''3��FV<8ϗ��"��@��ְ=��ݔފ�͏��iE��H{jߌ�z��wݲ��/��o`Vb��wRU��azİ\X�ǃ_W�&��n�q�a�`��8�`��NؑZ�eޚ�VX�[9��5�4��l��~��}��@��Á��t$�X�"5[��)�Ktɒ��s��V��"�s��ƑpK��z�F��<�z��h��(06l �v`�n�:R!-�k׮��+<��"��LC�yzs�F��SP&��7W&��򬬬��ӓ�!Fp$ �`Q޸o��w��6��}��n��^3V�E��}�; �U"�O~bP�F�$�5Z⧧��&I@��ſ-�%�h��QN�#��<��Q�鄑�l�Q��&ū�K��s�3��V��pM}�R~%/�uv�b^�v�>��nX��:F9!�]�vv�qb�YϦ_�GH�;V��;��(`��ϲW�+-r�,]<�@�31�7�\;��ivqX�DzQDDN��9��y+i��ͷ�-��t�tw��x}��k��{�}��]�ٮ��\W�Hfy>K1��&��BʻD9�F0OJFH�&�� 1��.��0+��f�9V�!�0]�I��,��6�!$��.Qn�`�ct�z�e� ��[��W�x�u��,�!�%0/K��h;r$ ��9��x)�܍��_��I��F��\�$/��}Y�E^�Y��#|p�X,�ݩ��2��zPu_N\�'�蜯�>�ym.�i�L�H�S$��Ki24:_��kH��*�M3��=�E8;G��,x�ʩj�H�*�{m�M��X�e�-�ww�t�B�H'�`�M��Ü��у5b��@��)N�+|��g{H�Z��t]��R�.�!{X�]H:�;,�,'��s�=�Qi�/��ɟ�2�̅'R��W��=چZ؁0:ǖ唃��8�;v�SG�g�Vp$!�K)))$O��}@�R�7�;�q�:��<��i�CBX��$�TzMC(;�Fd$�9l($;��"�T�gcq�R}ns��Mf:�f I$��Ud�vشw��}�Q*�&r�r�Z��Y%P��F��%��sp�l�8�='��s�Α��f9H��[T��þ�/y��s��r��B-$�t��Bz�T��d� ,Z�hVa��ٍF��{)Z8�� (� 2z��[�}�%��MP��Wf9_��h;�|M�q�Txy��pd�C�ˬ�Vf��^�e�-��|��u%�E�S��r�(��S�T�#��/�r�u�.�A7��k��.�}��0u��)aQ-�#�?��W%S�|�2�Q�u�֠��^d�۱+aaa�7nhIS��Rq:��$DB�tg('��p�"}Z��˘�B��T�٥Q��'��V�L-��:�[;�J3�1��J��E71#�I��P��ꄩI�\fF4:�KU�3(D��6�*aƫ��˒.F�A�1��J�-1�Ч��<�V�h��a$X�z�:$��%��X+d��֏��$x��*��a�X��3nj��G4�~)�9|�[��Ey"�r��B�Yv�un(��^]�'$��<"�ڵkauJ�!�Js@!κ��2��Zo]oSP��l��z��`�y!��AJ�a��)NEF�X~�&�C��H/�Z��=��r�Si��v��!Yf��[�96�f~>��P��.5�َ��j"��y�B�8\"B��'$�E��/�Z 1ؔ��L�'ܐ�Nؑ��y��ck{��ĞQNɟ0ACΏ�:�K��q�疫��A��N��UxA��.��0i��ahBl�dNNNHHHpp0!<*<`�#G��<�hT*h�� wu��R��``�|��l�}�I��y��?b��g�_�i1��b��L�@"i�9L�T쀑�͘*{.ā\6nya��řN��Kpd_e�>��]/��dO f~1ĉ��y�ܐ�}�9��%� E��ƺ�n�e$��MKѬ� `��'�B�Q�{��G��~�@A�s3l�l��(�b@�h>�N�t��/�2��&��Yxᎏ�B�>��C�C�A�\-��w$�A�H}�q_|��%��pM�m0�K��@@��d��5ip`��Q]*7�X�a��S�(ۮ��w��`#� #��Mwc��,��3f̘�Ex��-+�Zg��|��t:D��i�{)��f ��t�3��4˛�V��#i$)��G��M�l7��TЁӐ��ӑ�db�b߯��J��\��k��OVp�@��o%ܬ�+��~�8xf�n��5?"��t��j�C��"MN7M��?B�İoD��̶�j��{�X�"l d��V�[Y��O�c��*4N^�q��a�j��`�F��Oa%�F�O�^�.�H��&�a6��t��a��d6�oWٿ�~EM��g�>�M�L5?5��4�SSMOO3�̩tU��3S-OM�@� +�C�:��Yx�odF- <%Y3Ħ��OKE�^ĠCơN� �ri>�P@��{�@;��K�N5�2��p��Ŭ�l=�n7�ߐ�9?u��1b�y�ֲ�(�)�O��\K��Xh�f�Kr]H��;�M5HC4��VjΌ�Q�4�3�L3B]�oi;��r��e%��v��L$�p�_��%�큿��ਧV�lk��dCyIII=�ۥK�)RQϞ=+މ��F3��p��6ȄQ��2�4��g�u}�D��@�Ӂ��i��v��A좎odld�$�Bf��_��v�f�.ta��ALd�7=fz��v��m��jA�1�M0��sug¿��ZO�Yc� ��X��*9�]r�S�L0��K��(�y��4��e�y�s�?��t�K�2��,W��T8��>)��Z��ܧ��N�@![�y�O*��=��kD}�;��J��'��k=��:P��Z�Q��>�;�B��*��,�Z�x5�t��)��V�`z/ǿ!{]h��O+��`�f{�)�=h}j��U��uS7��+�S�:�f��Ag��[a��!��a4p�^�RxrAC`��b�8� 3��C��TK��9z��a��@�~)�Q&6Ϳ.2�0� ̂A�d�-�*K#�аU��B�m&��H�y�I��HUFid&�e�t��?ntt�W�X� -r�`�Մ�+��Е��K6�X�%F��8#6Ⱥ��P4@�)u�or�� Ĭ\��`��H�+� ��ݣ�t-'��&c�&�$s�̅�B�$��u�y��N��h��͒�I��k`��2"��B�h��G'��X�N3"t2��D#\�<=>A��G�^+��<:Y�z��9Ā��V�Y��$&O�L��>ڹ��m�$LZ��Z��~%uƉ>'L�9�=��&�ѽ�&�`0�߬��[��:@��G�$6��(��͓+ö�&��ol1A�G�槹�N4�#XDEz�u=��u��)7�F��Q�0��R*F��ln1-J�� A�9ƍ�]�{�X%A�lB�n��3�4b��x�H]x�)_��'�ַ�aX��1W�ʕ�w8p7��-��}��*ATU��R��E[�lh<\��<��5��V�i.��Ɖ'+��c�I��<�b�$@��|�B��K��mO�O1�.��+H��f'��d��Q��͘�G&JޢP�8#VR��v�&��X�C�t��8��z+C�_��Y�ˠ��#�L��&��PG-�!��U�8��N��K��ɆG��2j�XJW�3�� D݇��/��'N�� W��Ab�)�Tx�?ŗHo��g�O�54��I=�X�G�<Z�y�r��~h�$��]sL�(=�,u��GT;��M�)�50��Br��\��lJIg_��c�0,�7$?�0�'��6u��n>��[��)J�{�-�h�0�-�V��-�x�Fy��@��9ʼ��K�*뎹h6�!��X\��ct]��\88�0a��0D�kh�޽�0^i� O9�x��;�F��;��j:J��(�C#u�FS�l��:T5U�Z�%��谵V$e#仇�y��_4�mh:F]4;MG�4)�H%�d�p�K��~�� e��F�B~B��tuCuG��h��+��6�>v��w0��X��]k�46Y��yNV�P��v�|�Uw\~�{�!�.��#��}�CY @��O��d�<�5�WxhU��%X�[)�M�� vŦ;�l�|��D��6�i�;�[N��K1��A��%>�)ρc��<��/��~�z�/Q��nܸ��`��feC�5>��ުc!��z�D12%nUh��4�noS$��qȨ�Z��ЕVj�f��;z�$��4x��zc\jB�O��W��E�z��t\@�ZNCJZ��F�ss��/��G��G��_#��>Xd�zD�}�ĸy͟`�ҐR��Tc�>/T�ӊ��W�./��%6�d��wk�t�헼#��98�$luprk�u�F��5��I�Bl]NuEM�0�A��t��)�;�5�5&7�8v��򞆏{�M��r��5 �j�_'Jl;�u{7.oE7'l>�G+w4�A8Xd<|�̸�;��5۾B�h�1��U�ߙ�+�v�� 䖣��b�Em/�0��G��Sj/�p4��oƩ��.|�t�ޥt*��p�oBO��ʜme�/�է9(��nM��Cs�;ʛ|�}��~ޮ�vÎT�|fhn��_�m䞏��[J��)�=�e��"��]x��Ă&��|>xc��~}��1��UDp�q��a�1��`��Ŝm�?.��Ќn6��Ry��o�0��_#�a�ϴ��F�RǴv�ِ��vM�䟯>�U^Ȧ��J!��h28��~��&�3��rxu��2�XnӺ��gY��;��meM�d��t��Ǿ��Y�UF�s�C%��b�:�8�*oIL��BO�?��Ӭ�׬��NPj��t��>7fg��}Y��#ڏ�2n<�١�"=��3F�ɑK�z�\��xhhV��r>_rQ��}�xN^̸��Z{U�M�S�tHVa�Ucs��Cmȩ�;��S��l)�S��W�)ڪ��0��m��<; O��Y\ѳò/]�e�{�X�]�U�Cn̽��X��k�[y�z��ۯY�(�ҟg�42�\C��:�{��KC��2#�aajE��I{�_��Ù�G�4vfo)��\�G<�\Z��䳚��s�+�˃E��e�1�c�ܛM��Z�-��e�� +��=4$=�+��:�9�$b�i��)Vd�aaCl��>�֓�d�^��U��JȦZ��B�o�x��F�{��.�7��)�_%�2*�T�z�¿~��4:��3�� I�Zz��È�g��<|�g&��7��+y_y��j�8� ��G�:�Άe��d]��6_�؁�L��1:r��3}v��MM��%�]�o��z%��M��Q�K�W<��k^k��k��/��0��{��98��=�F�+�[S+�J=U��7̳�gFl�S�L9��+#�5��ݳ7]<}͌N��2�L��~;��yE��KRK��kJ��ɶ�v��'��Y�5U�gJ��j��?�).5��н9g�J햼��?ݳ��M��9��i�F0='�11��Ʊ��?��:��A�}��۬��*��)��I]N�מU�hו2��N�K��ڨ臅��Υg��)��7dW��1��9�}� ��Ӳ��1��}��7q�v�%�vfνD�n��N@V��g��;�}�ɋ��y��uL:|��cܼ�~Kױ�ۏ\��CG��Zx˻j��nc~[p��N]�NAܮ+='f�ln�_p��9�簼��X��'�~��O~��ɏ0?��'?��'?��G��G��a~�a~�#�O~�#�O~��>5]��7EIEND�B`�", "HTTP/1.1 200 OKServer: nginxDate: Wed 20 Dec 2023 08:31:11 GMTContent-Type: application/javascriptLast-Modified: Tue 17 Oct 2023 12:32:21 GMTTransfer-Encoding: chunkedConnection: keep-aliveKeep-Alive: timeout=20ETag: W/"652e7ed5-651c"Expires: Wed 27 Dec 2023 08:31:11 GMTCache-Control: max-age=604800Vary: Accept-EncodingContent-Encoding: gzip1df6��=m{۸��_A�&ʒ��]M3n�xoݼ��鵵]=�I�)R%)��Ϻo��fP��dw��O�k�3��`00�g8��Yos�HGe��(:,��Y��E�x��5˭)g��0�F�O�G��)��g3��e{g��ی��(�䲝�$qz�x��ws:%�-{P�T�9OB�(�^L9/�i��!�X�x3��~x��.��yN�$r%�,7k��e��q9u�<�tRΣ�{��޻O'�t_�\�5fI��8��,w�7�P�M�>��g��V�(��ĳ�oe��H[<�ܭr06��l�o�Hv��z@��n��;~�� <��E�-�&�)��E��|g��ǮV�.KAB��R�]�T�6*~�yA5{Mtq�(y{�ei$��K��,�w·{w��K|L�1��1=��1��mz��gh��$߹�,Y��4.y�G��:q窓t�wfC��~��vw|~��cx��7�\�M\��.�:[�ɻ��;��'�w��R��q>=��6�nީƈF��]�H�j�F�r��h��CP闥��[�Aޱr�'�樷��pB��⻣o�e�䍲R$�[@,��ِ�q�C��x��$��Y�p$�@�Bb4��``��-)Aɓ@��]�J��Q2s*5�URK��8\b�".��l�h��8�:��a��Q��$�qh� �z��;_S�AM��Ι��e�.�.΅��IX��5Ư�[��ja��+��SP�㖠��#��w��G�{�w�=��y��?�8��w.��;@|:>��C��Vų�3�G�.�!��v��0��e�,)S��1�H4�ӹ��.�e9ͳ+�7��]Z�ۣ<�;4�8�q-�%��M}��Ɠi��8�H�~�c�R`��[�4�z�7�=P{ȓ䏨��xk��y8�%��kR?�!�/�" �vG�9~��өCÿ%`��6{*�{�j��XL�P��;W�7�+m�r�pi��;L�J6�Y��#�8��Iy�uċ��<�X�/II��f(�k�V�X��_%�� hWj�G��=�^f��M��<}NF�%0>�c�0��J��'�(&��Pd7WegY�9OgqA]��\%,CeM�?��(n]eӒm�^ �7�N2`��Z��o��}�Zf��H�㨃n�;t=Ic�7�:C@y�v`�6W��q$��gS#��/w��x�+Z�r�k�Rh��40�Zk��lFwF�!�I��x'A�A_K��'0�I�TK�3��8KJ��)�=I6��$^��Ȟ��ƕ4�$�ʝ�k+�*[�h��g��[��RXRX��={O�A]�!��Z��#'�$�8̢�*_�/�!a4R��U��P��Z�N��l��;h��Q@��Ճ��6�P�ݲٜ��)-�ah��R�~��`6�r7�Fz=2�ǰ�H^y�83�8��탬��@Yf��m��5r��[�f�1��_Q��]u։�;J�j��C��엂�j�:Ֆ�$�hM%f��m�J%��^^DWi�QJnã{�J)c^�A�$ݚ#��N��f�5!*X�p��5q[��C�G�n��G�Q�deo��Q��6+��x5��0�#p��8M��C;�H$�ݷ�k=�+�7ɖ��G��X$k��\�$��fb��RQHk��Fo�:� D+�J�OX�̚�kn!.�ք��`EOq�u�Z݀+��ȊK�rc��x�π�ld�e9��nnn��n��=HQgz3p�Xҽ,�N�rd��1��є��^�n��Ef�{��K�b��Psش �PJPw6{=B�e1BOk%��-l��H�d��j2JXQX�^(0@c�y��UN��-��9_�xd)�6�WU�C�n�&��g��Q��@0�(g��}�О�W�fٍa��O�n��a��"F�6�D��%��v�L�@��RB��%i�BE?��}kܕ�U��}�z�P�#�z�[~�S��nx~�0&VZ�9�nk{[��ȅX�bЬ'L}A�ᐜ=�ұ܄? �޳��>}|��k�&)�a��wI�@/�|Q�֐�D� �E Q�M1�(�a�͒��Y��F��]��A�e��a�0f5H�I�X��(��J�Y"툎��H�Z�Rd�t$��`}X)�n�ӧ�򥡿?��PGV;�E5؇��`L��e��M��U��ʼ r j�C�?��խж�q��˚��b6��0(�7��TF��Xr,U�>?N��w�y(z�\S+!)�L_E��v��'zsb��;��ŴMʹ��T�x�n�$�󻎜6hX��-1h<�2k�֨k}L8��^Z,r�K��AX.h�p:��[�ݮv��)�Z�аX��<}޵�:�&q�D�P4#��oK��/˫��ۮ��OX�!�`�m��c��w��;�X��ӱ�9A�37�˵!e��#EB!W�z��OT��,�|5�#Z԰a>��(�]x��~T�T�&��kHՄ��-?YPDdD��͘��k9a�*V˅u{uֱ��ؔEJǠ��g�Ɣ�^��FC�x�X�:+v�}��r=�Uy��Z��]^lo�"��5g`]�di�:o@�פ��2��J�UX��r|7��Z٘bns�B��e*NdP��f��SH!_U�7��ghZ��<�{�M\�Qvym�g.�C�k��xPb7�}^��b�Nݹ�OD�� &�'#ק��:�s��{�t++{��Kч�N�k&洊`�� 2��0�5��??J!��o�m��'�^E��b,�l��m��?�h��U��q��k��t�77�j堀"ԥ��-"x��?�졿�QX��gz��J˨%6Je�9G�ȿf��$�X��_�a�&U��ß�?�l��F:+�lDx��~ƻ�4D�Yi�\C/��:��Cxu�N��t3chm��F`o�� [5�3�?��3c��9�G�l��/Ѹ��jƜ��oD��PR��<��LU�K��r)V��3Z��0�gEL)-��0�h�\��+��D��!��~��&|\�"��R�y��f�u�q��(�o��˯q'm��}L�G?ѽ�w�t��m#W�2�0�M��f��-��;!A�@�bڀ�h+0o�O��-{��>�\+��T6)��Z#r�ׅ4��7v�kѶl��_��s��uSV��頊�9��ɗX�&��"��QX��J$�Kn�^��*�f�4�]�[�ڃ��,|BN&267�&��i�(��%,m��1�GN�;g�tPf"�H�v�<�q:>�_��#SПqʌ8e9�Pd7��Y��"ק��bΧ��ZsΆV�Le��|��¨M�W(p��*��TНL��\��I��n��h�6Xi}��"��Ա��栅��/�Wt+ͻ�8�ЖHN��8�f��:��7��T��П!�n�9�_�b�r��~��ș��m#O��iG9�;ǯah*Qy�z6ʃF��b8�KZ閛O�F�'v&Rl�uV@�Wz�h��=<�#�j�JNK��~M��F��%L݂�bÒ�͔��*��v`��fB{F��?I�|7�g�;$^o辅v��B��Iu��=$�y��%��9��ĸ�%z�uY�?��T��n�$�``�18=��D<��V�3�hR�I+�$�W�}h�a�%�_��d�:�J��E�w`�R�F��F�\HIrΞ��x>5h�UN�A��$Noj��ZRBHY��q��-�Ji�-��N'6��`*{��5�C��ӻ�?��'��8&�dW�Ӷ��Ѭ�Һ,W��^�K�<��ĭ�~W�Β�]�sz��}�o{��h6[��X8��ͷ_�&�Y��K��K��gͳ��4I�ܹ��>#KK��"��ا��1��qqW,��,/c�'M��A�sxdb�8�Z��`./��v�H{tz-;�$Bn��=#V@Z�ji��"|kv/��.7��%~j�3Dx#�*c��Ӏ��PVVi��,�i��Kd��MreyP)R<��<:�;V��y)`�l�#�M$��V��`��;J�M�%i�_8W�@ODbh}'s�T��a��=��K-�oeQ�~n=�Qu��W��Q�ұ�V]j%i(� ~~��<��k��*J6��Dt�C��T�l$u�@��雨Y�ߕS`��U��{�Ē�ҵ� g�#��Kb0��vcF(}C��#M�R�!�;EV��7�F5�vӸ9#{4�k�RM�J�4�z�|N5$�-p}Bz�iש�B�G�v�;�D+o(/KCq�m�h�I�� b�S��e�Ȯ��nךb�(��/��#�\q]��.f�*�]��rW�|XW��x�TNJ��c��~�}��}Gc�V"��s��et��g� �+�@DϿC��í~��"�ٮ酊�jViw��2$�:8�SP�P��UG�t�]�K[��O)��s{�q��s��{�8U��~Z��mO�f��Ѽ6��o[jc�r��B�鰩#��b��n ��L��lU�k��h��:��y/fYVN�ݫ;��E��Ҫ�"!�p5�Q��Ze�v4PCb��r:��2ś��#�3f>�T�b��}-e�؞*ǲ�ƶ��:yw�ؽ^�L��ڑ��~+��4I��F��cf�jUO��L�O ��x��B��tf��~�iP� [�P�M$��@BR��6Zn6��͆j��;v�4�mV��Ȋx��.*��[��}}��s.5vţ�5��p�8]��c��{��\�l�Oa�q��*��;DK��4��]J�!��Q"'��4�A�J;��R�f��`�fx�G_�0�m� ��i�^�V+-�ou�k��~C�M��gE��ks$0_��O��nsm��:�n��e��L�͹_��tRف�HD�򛇶�n��}{϶=_�!��80Y��@I�(�9��Tk�4��J��TR^��G~��>�l0q�Z-��rĎ�JA�O�Ҝ�͙V#�YV��a�Cf�d��m^ty�z.��n��Ϙ�-�r% �3�C+��͓�`��R_��}�H$��D�KS"f6N��@��5�T��.f͛M"�� z݇`m0r6��Z�q��3�\h�zi��Ю�&t��Z�H�|ل�m��me�~7�y��G�TM��N��<�g]ŰkӺ<�� v2J��U��J�T��g��%��ays�LG�^`��*�@(��y��Y'[�TQ%βC]H�-�(D�H7�}��Ru�[��^.�[��$@��g\E��b��Q��"�OO��p7�Y"��g��'+V��ި^^^��<�G�E�ڒC�{%��k�T�K�|'p��Mp��)�I|�4�9%D��I;ac.��=&�C�Ot�-�iv��a��x&��<. c�5��2��y~��?rZ0V�-�{`Z��P<�V]�~-�� {Oj��&.%��@�X�Ơ�Ӻ��P��:N��CWh�g��z��T8�`��R�׽5"�K>�/�=��4��E��<�I_�5>��/�d`tg��S��`pd��?��E81;�p�J�F>��TS��Nț�u�,п��a��7[[֑02�쒉�,�"� �4�}>cmt< џ�IȢ�v[�'��OG��׀ r.>Pb�?�`�苋�yZѬH�1�]C��=e0", "HTTP/1.1 200 OKServer: nginxDate: Wed, 20 Dec 2023 08:31:11 GMTContent-Type: image/pngContent-Length: 352Last-Modified: Sat, 10 Dec 2011 17:22:10 GMTConnection: keep-aliveKeep-Alive: timeout=20ETag: "4ee39542-160"Expires: Wed, 27 Dec 2023 08:31:11 GMTCache-Control: max-age=604800Accept-Ranges: bytes�PNGIHDR��ngAMA��7��tEXtSoftwareAdobe ImageReadyq�e<�IDAT(�m�=N�Q��v4�X��XxnB�=<�W��.��HL��۵xD>d�ٝ�ُl9�"��`2�L(@f��3Gy��{�3��-�R"�,�\�~O�ekDdki_x;�ӲZ}�M�-��̖�Ϝv�k�ɑS�F[�N�Ć��{X�K��v��^�Pa�Vn�cV�H��a�S�ɔ-�(��6�%y�n�ǌc�X��i�^f�[�Ѥ��Ǵ׮��Ϟ��ԩ��䆿~��߿�ܹ��ĉ��߼��׹ٴ@�3�׬~�sq�f�̙F�8��;�+��#�K�>>�0N�@H�;C�6�ѡ�ٱ��3�#��y��̼ܶ%�+��Ԧs�iP�C{�q=o�IDATx͘��J�GT0#�5m��Or�{M��5��7�0�l�(�ޯ��o��Y\;��Lpmr흙Vq#��w(�԰�!$hZ>|%5$�{��2(��6v�.�T��=E�(�W��+*�}I��IZ�VZuk��]��H��-��+ISu�9԰��U,W�ě�\�_Qq&:�P��4��H`BB7i(��Kw��v�ۑ]�A]�%i�:MӍ�\hr5�r��m$��H[�:�8oa��r��'��:t�,71�4��B�Ä��As%��PK��-��"��4鏀eqh��h�U�Z�z��0�}��Y;�aڸR�BZ޲��ژ"*�X�0�A�o&r)��)��0:.N�ʔ[�}��擩i�B�Sy��Op��e�?�5��P�|C=9Ay��p��I{�Y�v�=�?JRJ5�C:��VH�&PE��"_��+�s��h��v��VI�q9��I��6��U��je2Q1^��]*��R��t��rsm�BMgv�]��`�3�{��V��&Ӡ��oG��y��ٳ��G�aH'��M|��o\>I�4��;�;i��s4_�Ȑ�ra�9��M�� C�hJ�\��Lh�G�<*�_�I��NrP�M�P��=`[�֣c�#i?}+�&�H�d޾�N��ׂW�Ļ��^f8�֩�D��˓X�l`4)�ߥI��1�z��9��+R��L�ߡ#��"]��Y)@��D@��W��|�q�Xmk��k&��d�@�}5�I�� ={�8��zY�l+]��{Η��<�}��'=��FJ�i;��CF��@�/�A�L4�no�оѕ�jZ��&�Yo��X��-��pA��%d�m9��;Vf�;�;{:g|�g�3\̗��|�X��΢�>,D�s��g�A�s�o�{��c�3{��]��2IEND�B`�", "HTTP/1.1 200 OKServer: nginxDate: Wed, 20 Dec 2023 08:31:11 GMTContent-Type: image/pngContent-Length: 582Last-Modified: Fri, 04 Oct 2013 09:04:37 GMTConnection: keep-aliveKeep-Alive: timeout=20ETag: "524e84a5-246"Expires: Wed, 27 Dec 2023 08:31:11 GMTCache-Control: max-age=604800Accept-Ranges: bytes�PNGIHDR��ntEXtSoftwareAdobe ImageReadyq�e<�IDAT(�c�4sߎ�o��Ki�É�n�}�6�qMB�ᙽ�#m�m̆�Ɲs��eX��En�_��?��_+�1i��޹N�x��ߟ6]`Hj9��K��?��mӮ��tIߥ/��|��筺$i2�aᆻu�>�w�OS��b�f��ˋ��Nd:�4��M��̵�kk�O��?>�d��R��ZZ~71��U[�g�[��lm��Y@��?'��`��3�|Tڎ+W��grJu��I6V �VA�F�R��w请6O�9�y�!X��p��l?��=rcEy)E�_9XA�MK!��;��ؑ��s�ot��0v�F@��36��<&��[ح��&�[/�j�IX�l'-�N��d{�m�o��bXZ��á�n�zl�B�z��>&u�n)�-vE`.��9*�vKm��-$��E(VSŦ|��]!2uh��X!��V�h,��l�]_h�@��<��w}�?@_�!�b͕��\�Y�+��i;�<�Վ�W:SO��xZ�ؙ��/U^xTeA?mV�W�NE��O+��Q�|e��'g~�o��iA�l��%�w�D��bָ��}Z�d�_mQ��\=\-��:}�Xv��x=v��ǫ��O��J`�A�˹?5��Q��ϲK:x=�vϰ-��<��%�R�s��R9q��a��$��X��p-��P��4��=��F�P�VZ�he��8?l��D�^�O��UN��A�_+'Q��YJ�Y"U��%�w_�EE��EOa�T`h�]@��K�V�3dPt��\�u?�E��6a��bQ�^�A��}+�Rv2-=��R�$x�r|�_�Ɓ�>�:��k�G&�!��(L)�#4I��_9R��t�a-��djH�ae�J�܏u��+|h`�m��Y�E�4�� '! &|؊�A��y��屯�x��+��7��"C�H})!�s2��%3-`�7��()�4^P6�ؒ�|O�<߱�y�^L��y6��RV�h4e��@5f�$||��Ak;�R13qG�#��&��v��h�ؑ�E��,��U�}��v蹹2\�9o�`��ȕ�mQ��H��=��V@F�,�1��&�E�V�j"'�A-�{��?+��]�+XJ�ϓJ!zwl�a�C��3�{��+#`�ghQ^+�F��w.�#׬��-��<��s��oW$�{mXj�ֽ�Z�T��4�葀�es|��`�n�)P�J�LS��W/cܰ�W�Zgd4p�X��oэ0K_�|7��lp~�[�v�~΄�lty+��V�T�k��y!^�Հ6�_n.ͧ��fD��q[�t0�_��H�;g�4��Sn��i{v�|�b�ׯ.Dg��9t��B�Չ��u��t��\&�Gsg�pd��Μ]^�_k�ghf��=��k�a#ʫ��=a�I�o}a��Kl&�f�x��˱y��=]��\��3��i��Ͷ>^K�b��]s��W��}�DpP�(6��x�E�Lh01�9bAaF��/K�eI;K*�H��g�T�_�i!��w�dyJQ�X��U��I��$�b��`��Y��1��Q �&�?��W�#��O�;�ł^�J��e�LI7H��Q�q�b|�tADRˉ�h�yԞ��MQ�Y�9b&��t؟�0^S##FJ��-��ĢB ��p��R׆�ID�҄�D�P"�5�7\9�L��!��H)(d��c��S�|+{��{�Ŕ Q,.��2��s'�}��̰jr�Q�@��+�X!��(�JßT~�0�#�X�+�޿��i{5�Pb\x�B�4:EMh�xU�g�7��E�mǢ ��P�᷉C4� ��n_nO�X��Jj�JR7��3��x?ֿ|I��/� �u\Wk��e��+G��Vd>�n��Ye�.xI��Jp��Ν]��%��$�Hj�� .�J$�ɍ4L�W�t>�݄U>�U�C$T=�~ɈQ� S��sݖ��p�Cqy��Ko(r�K�~��Ť�cK��I�":U��֒��Q��S��:� �s�q�n��l߻��w�J=�y�*��T�oT�h��%vZ�f*:�⋑C�$T��y��r��{�:��y�A|��[�eu�I~O�!B;ȻWck��sa��]ȧ�B��{��إ·ԂZjE-��]S��M+I`%��C�RTnw�2�P��b��xV�o��6��6�.aL��!y��"/��Km�#�#��]CVY��r��E�V�͸瑒-*0�F�)/�A��Z�-��EF4Ⱥ�D�c�3�R1��ew��)D��좈�dv��R�2�p�m��5��@��+��q3��q�1��"��'�1��m��u�t�)��}�}A��pp#��8r�DVz�!�=RC�ltxs�๔bB_ӌ7w��vlA�4c{.s=��z6-p�M�+7��tet�V޿�� J1�!��w��Q2�mް�3x8BH��#��D�;viG,��X�V��o�R��M�n5h)鋀�=Y*H��%&�#��*PIr�ZW��3�ڹ>��E��z+�I��lo\wM֐"��/�V�l�x�N�gV�Ҭ��˓�|>|��҃lg�|�72j��$0", "HTTP/1.1 200 OKServer: nginxDate: Wed 20 Dec 2023 08:31:11 GMTContent-Type: image/pngContent-Length: 350Last-Modified: Sat 10 Dec 2011 17:21:35 GMTConnection: keep-aliveKeep-Alive: timeout=20ETag: "4ee3951f-15e"Expires: Wed 27 Dec 2023 08:31:11 GMTCache-Control: max-age=604800Accept-Ranges: bytes�PNGIHDR��ngAMA��7��tEXtSoftwareAdobe ImageReadyq�e<�IDAT(S�P�M�@K�(��(Qϥ$tE'$p�Ǥ��,��1��{o=��$�BDC��s܋Unri6�v|$8$2=`�0Osxi��"��7�D#��c܌^-e��;��.a��$�8x#��Q�ӳ?��l��M��5�u8�|�� o�1�w��U��[�!A¾�˲d&��0��i]�9�rA�%ԯz=�]l佁�¶m|��E{��~�U��IEND�B`�", "GET /images/menubg.gif HTTP/1.1Accept: image/png, image/svg+xml, image/*;q=0.8, */*;q=0.5Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip deflateHost: www.upload.eeDNT: 1Connection: Keep-AliveCookie: lng=eng", "HTTP/1.1 200 OKServer: nginxDate: Wed 20 Dec 2023 08:31:12 GMTContent-Type: image/gifContent-Length: 51Last-Modified: Sun 14 Apr 2013 07:15:29 GMTConnection: keep-aliveKeep-Alive: timeout=20ETag: "516a5791-33"Expires: Wed 27 Dec 2023 08:31:12 GMTCache-Control: max-age=604800Accept-Ranges: bytesGIF89a��!�� Lp;", "GET /images/eng/logo.png HTTP/1.1Accept: image/png image/svg+xml image/*;q=0.8 */*;q=0.5Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip deflateHost: www.upload.eeIf-Modified-Since: Sat 10 Dec 2011 17:22:00 GMTIf-None-Match: "4ee39538-28cb"DNT: 1Connection: Keep-AliveCookie: lng=eng", "GET /images/rus/flag.png HTTP/1.1Accept: image/png image/svg+xml image/*;q=0.8 */*;q=0.5Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip deflateHost: www.upload.eeIf-Modified-Since: Sat 10 Dec 2011 17:22:10 GMTIf-None-Match: "4ee39542-160"DNT: 1Connection: Keep-AliveCookie: lng=eng", "GET /images/eng/flag.png HTTP/1.1Accept: image/png image/svg+xml image/*;q=0.8 */*;q=0.5Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip deflateHost: www.upload.eeIf-Modified-Since: Fri 04 Oct 2013 09:04:37 GMTIf-None-Match: "524e84a5-246"DNT: 1Connection: Keep-AliveCookie: lng=eng", "GET /js/js__file_upload.js HTTP/1.1Accept: application/javascript */*;q=0.8Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip deflateHost: www.upload.eeIf-Modified-Since: Tue 17 Oct 2023 12:32:21 GMTIf-None-Match: W/"652e7ed5-651c"DNT: 1Connection: Keep-AliveCookie: lng=eng", "GET /static/ubr__style.css HTTP/1.1Accept: text/css */*Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip deflateHost: www.upload.eeIf-Modified-Since: Tue 17 Oct 2023 12:17:20 GMTIf-None-Match: W/"652e7b50-24da"DNT: 1Connection: Keep-AliveCookie: lng=eng", "GET /images/est/flag.png HTTP/1.1Accept: image/png image/svg+xml image/*;q=0.8 */*;q=0.5Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip deflateHost: www.upload.eeIf-Modified-Since: Sat 10 Dec 2011 17:21:35 GMTIf-None-Match: "4ee3951f-15e"DNT: 1Connection: Keep-AliveCookie: lng=eng", "HTTP/1.1 304 Not ModifiedServer: nginxDate: Wed 20 Dec 2023 08:31:14 GMTLast-Modified: Tue 17 Oct 2023 12:32:21 GMTConnection: keep-aliveKeep-Alive: timeout=20ETag: "652e7ed5-651c"Expires: Wed 27 Dec 2023 08:31:14 GMTCache-Control: max-age=604800Vary: Accept-Encoding"54:T6477,Pattern match: "www.inkscape.org" Heuristic match: "jkNb.Ni" Pattern match: "h.hg//e1i" Pattern match: "http://www.java.com/en/download/manual.jsp" Pattern match: "http://crls.pki.goog/gts1c3/moVDfISia2k.crlF^Wj#" Pattern match: "https://pagead2.googlesyndication.com/bg/%{basename}.js" Pattern match: "http://crls.pki.goog/gts1c3/QqFxbi9M48c.crl%" Pattern match: "crl3.digicert.com/DigicertSHA2SecureServerCA-1.crl0?9http://crl4.digicert.com/DigicertSHA2SecureServerCA-1.crl0" Pattern match: "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd" Pattern match: "https://pagead2.googlesyndication.com+b,d=La(a)-b.length;if" Pattern match: "https://static.bepolite.eu/scripts/'+scs[i];n?b.insertBefore" Pattern match: "http://schemas.microsoft.com/windows/2004/02/mit/task" Pattern match: "google.com/recaptcha" Pattern match: "NOFORMmicrosoft.com/102433237894403108561027971357230938743SRCHUIDV=2&GUID=426377958C8445E3B4EA69482BD0E747&dmnchg=1microsoft.com/102433237894403108561027971357230938743SRCHUSRDOB=20220131microsoft.com/102433237894403108561027971357230938743SRCHHPGUSRSRCHL" Pattern match: "MUIDB2D8103927F0C61722957107F7E4060BBwww.msn.com/9216279790592031155605205027478931077200sptmarketen-us||us|en-us|en-us|en||RefA=11E51919783F496DABD6D9555117BA8C.RefC=2023-12-20T08:32:16Zwww.msn.com/102463133491231224203265014679231077200" Pattern match: "9216279790592031155605205074279031077200MUID2D8103927F0C61722957107F7E4060BBmsn.com/1025279790592031155605145211878931077200USRLOCmsn.com/921763133491231224203265030279331077200" Pattern match: "9216279790592031155605205074279031077200MUID2D8103927F0C61722957107F7E4060BBmsn.com/1025279790592031155605145211878931077200" Pattern match: ".bepolite.eu/2147484673326421952031095255150687279331077171" Pattern match: ".bepolite.eu/2147484673425421952031095255138120969231077217" Pattern match: ".bepolite.eu/2147484673405421952031095255159723223031077206" Pattern match: ".bepolite.eu/2147484673378421952031095255418654983431077191" Pattern match: ".bepolite.eu/2147484673394421952031095255265014679231077200" Pattern match: ".bepolite.eu/2147484673337421952031095255112052355831077168" Pattern match: ".bepolite.eu/2147484673416421952031095255231391869631077222" Pattern match: ".bepolite.eu/2147484673332421952031095255362545282531077175" Pattern match: ".bepolite.eu/2147484673373421952031095255196912325031077189" Pattern match: ".bepolite.eu/2147484673376421952031095255307738903131077190" Pattern match: ".bepolite.eu/2147484673364421952031095255293033755431077184" Pattern match: ".bepolite.eu/214748467333742195203109525551955955331077168" Pattern match: ".bepolite.eu/214748467340442195203109525587634914931077215" Pattern match: ".bepolite.eu/214748467337342195203109525522948039231077197" Pattern match: ".bepolite.eu/214748467340942195203109525586944194031077208" Pattern match: ".bepolite.eu/214748467333742195203109525529760978231077179" Pattern match: ".bepolite.eu/214748467318925222431095256305679847031077222" Pattern match: "MUIDB2B3DC0D2569D6F460202D33F57D16E1Eieonline.microsoft.com/9216275790592031155605148654115031077198" Pattern match: "MUIDB2D8103927F0C61722957107F7E4060BBwww.msn.com/9216279790592031155605205027478931077200" Pattern match: "MUID2D8103927F0C61722957107F7E4060BBmsn.com/1025279790592031155605145211878931077200" Pattern match: "nactkwww.msn.com/spartan/108834324326431367516156339216030633261" Pattern match: "www.upload.ee/9217323633523231082783368957659731077218" Pattern match: "www.upload.ee/9217252633523231082783269885780131077179" Pattern match: "www.upload.ee/9217278633523231082783155644406231077194" Pattern match: "www.upload.ee/9217233633523231082783112161556031077168" Pattern match: "www.upload.ee/9217221633523231082783221732335831077161" Pattern match: "www.upload.ee/9217273633523231082783238593678231077191" Pattern match: "www.upload.ee/9217261633523231082783413277857731077184" Pattern match: "www.upload.ee/9217256633523231082783186235998431077182" Pattern match: "www.upload.ee/9217218633523231082783295390189631077159" Pattern match: "www.upload.ee/9217229633523231082783314973830931077165" Pattern match: "www.upload.ee/9217295633523231082783182072902031077203" Pattern match: "www.upload.ee/9217247633523231082783113009554131077176" Pattern match: "www.upload.ee/9217292633523231082783255668355631077201" Pattern match: "www.upload.ee/9217215633523231082783249650843631077157" Pattern match: "www.upload.ee/9217315633523231082783226345169331077213" Pattern match: "www.upload.ee/9217239633523231082783150765279431077171" Pattern match: "www.upload.ee/9217307633523231082783257659674631077209" Pattern match: "www.upload.ee/921726763352323108278380872948731077188" Pattern match: "www.upload.ee/921730163352323108278399611222531077206" Pattern match: "www.upload.ee/921722463352323108278388040481831077163" Heuristic match: "ocsp.digicert.com" Heuristic match: "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAoFmyX1Sz2HlMxmMUd1OKM%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Heuristic match: "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQlOydjtpho0%2Bholo77zGjGxETUEQQU8JyF%2FaKffY%2FJaLvV1IlNHb7TkP8CEAHqRFnqJyQkmYqUpX34D7k%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Heuristic match: "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Heuristic match: "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAbY2QTVWENG9oovp1QifsQ%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Heuristic match: "o.ss2.us" Heuristic match: "GET //MEowSDBGMEQwQjAJBgUrDgMCGgUABBSLwZ6EW5gdYc9UaSEaaLjjETNtkAQUv1%2B30c7dH4b0W1Ws3NcQwg6piOcCCQCnDkpMNIK3fw%3D%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: o.ss2.us" Heuristic match: "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAbY2QTVWENG9oovp1QifsQ%3D HTTP/1.1Cache-Control: max-age = 7200Connection: Keep-AliveAccept: */*If-Modified-Since: Wed, 20 Dec 2023 08:03:25 GMTUser-Agent: Micr" Heuristic match: "ocsp.rootg2.amazontrust.com" Heuristic match: "GET /MFQwUjBQME4wTDAJBgUrDgMCGgUABBSIfaREXmfqfJR3TkMYnD7O5MhzEgQUnF8A36oB1zArOIiiuG1KnPIRkYMCEwZ%2FlEoqJ83z%2BsKuKwH5CO65xMY%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.rootg2.amazontrust.com" Heuristic match: "crl.rootg2.amazontrust.com" Heuristic match: "GET /rootg2.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: crl.rootg2.amazontrust.com" Heuristic match: "crl.rootca1.amazontrust.com" Heuristic match: "GET /rootca1.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: crl.rootca1.amazontrust.com" Heuristic match: "ocsp.rootca1.amazontrust.com" Heuristic match: "GET /MFQwUjBQME4wTDAJBgUrDgMCGgUABBRPWaOUU8%2B5VZ5%2Fa9jFTaU9pkK3FAQUhBjMhTTsvAyUlC4IWZzHshBOCggCEwdzEjgLnWaIozse2b%2BczaaODg8%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.rootca1.amazontrust.com" Heuristic match: "serving.bepolite.eu" Heuristic match: "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTk45WiKdPUwcMf8JgMC07ACYqr2AQUt2ui6qiqhIx56rTaD5iyxZV2ufQCEATiBJD97V%2Bh8cNnTUFY7lA%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Heuristic match: "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAqvpsXKY8RRQeo74ffHUxc%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Heuristic match: "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Heuristic match: "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEA177el9ggmWelJjG4vdGL0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Heuristic match: "du0pud0sdlmzf.cloudfront.net" Heuristic match: "fe0.google.com" Heuristic match: "googleads.g.doubleclick.net" Heuristic match: "pagead2.googlesyndication.com" Heuristic match: "static.bepolite.eu" Heuristic match: "tpc.googlesyndication.com" Pattern match: "www.google.com" Pattern match: "www.upload.ee" Pattern match: "www.upload.eeDNT" Pattern match: "www.upload.eeIf-Modified-Since" Pattern match: "https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml" Pattern match: "www.google-analytics.comIf-Modified-Since" Heuristic match: "GET /script?space=50dd7b0f-4105-441f-8f60-18cc3fcb090c&type=direct&page_id=1582480&screen_width=750&screen_height=346&os=Win32&refurl=&pageurl=file%3A%2F%2FC%3A%5CUsers%5CHAPUBWS%5CAppData%5CRoaming%5CaHmJKtizD.html&rnd=1703091115103 HTTP/1.1Accept: applic" Pattern match: "https://www.googleadservices.com/pagead/p3p.xml" Pattern match: "https://tpc.googlesyndication.com/sodar/sodar2/225/runner.htmlAccept-Language" Pattern match: "https://csp.withgoogle.com/csp/botguard-scsCross-Origin-Resource-Policy" Pattern match: "https://www.google.com/recaptcha/api2/aframeAccept-Language" Heuristic match: "GET /script?space=50dd7b0f-4105-441f-8f60-18cc3fcb090c&type=direct&page_id=2640849&screen_width=750&screen_height=346&os=Win32&refurl=&pageurl=file%3A%2F%2FC%3A%5CUsers%5CHAPUBWS%5CAppData%5CRoaming%5CBJGIC..kG.html&rnd=1703067267588 HTTP/1.1Accept: applic" Heuristic match: "GET /script?space=50dd7b0f-4105-441f-8f60-18cc3fcb090c&type=direct&page_id=1580123&screen_width=750&screen_height=346&os=Win32&refurl=&pageurl=file%3A%2F%2FC%3A%5CUsers%5CHAPUBWS%5CAppData%5CRoaming%5Cjyo.rquAu.html&rnd=1703066602178 HTTP/1.1Accept: applic" Heuristic match: "GET /script?space=50dd7b0f-4105-441f-8f60-18cc3fcb090c&type=direct&page_id=1439366&screen_width=750&screen_height=346&os=Win32&refurl=&pageurl=file%3A%2F%2FC%3A%5CUsers%5CHAPUBWS%5CAppData%5CRoaming%5CvHImy.oGI.html&rnd=1703068954450 HTTP/1.1Accept: applic" Heuristic match: "GET /script?space=50dd7b0f-4105-441f-8f60-18cc3fcb090c&type=direct&page_id=2535744&screen_width=750&screen_height=346&os=Win32&refurl=&pageurl=file%3A%2F%2FC%3A%5CUsers%5CHAPUBWS%5CAppData%5CRoaming%5Ck.hufeesg.html&rnd=1703070950363 HTTP/1.1Accept: applic" Heuristic match: "GET /script?space=50dd7b0f-4105-441f-8f60-18cc3fcb090c&type=direct&page_id=1105210&screen_width=750&screen_height=346&os=Win32&refurl=&pageurl=file%3A%2F%2FC%3A%5CUsers%5CHAPUBWS%5CAppData%5CRoaming%5CxIDknlGKD.html&rnd=1703072395399 HTTP/1.1Accept: applic" Heuristic match: "GET /script?space=50dd7b0f-4105-441f-8f60-18cc3fcb090c&type=direct&page_id=3094759&screen_width=750&screen_height=346&os=Win32&refurl=&pageurl=file%3A%2F%2FC%3A%5CUsers%5CHAPUBWS%5CAppData%5CRoaming%5CBpqb.JkcD.html&rnd=1703074860261 HTTP/1.1Accept: applic" Heuristic match: "GET /script?space=50dd7b0f-4105-441f-8f60-18cc3fcb090c&type=direct&page_id=1307798&screen_width=750&screen_height=346&os=Win32&refurl=&pageurl=file%3A%2F%2FC%3A%5CUsers%5CHAPUBWS%5CAppData%5CRoaming%5CgeCvFhdly.html&rnd=1703076432141 HTTP/1.1Accept: applic" Heuristic match: "GET /script?space=50dd7b0f-4105-441f-8f60-18cc3fcb090c&type=direct&page_id=5575995&screen_width=750&screen_height=346&os=Win32&refurl=&pageurl=file%3A%2F%2FC%3A%5CUsers%5CHAPUBWS%5CAppData%5CRoaming%5CAgJorBrbq.html&rnd=1703077332332 HTTP/1.1Accept: applic" Heuristic match: "GET /script?space=50dd7b0f-4105-441f-8f60-18cc3fcb090c&type=direct&page_id=7484644&screen_width=750&screen_height=346&os=Win32&refurl=&pageurl=file%3A%2F%2FC%3A%5CUsers%5CHAPUBWS%5CAppData%5CRoaming%5CmsmqzCpGg.html&rnd=1703077877399 HTTP/1.1Accept: applic" Heuristic match: "GET /script?space=50dd7b0f-4105-441f-8f60-18cc3fcb090c&type=direct&page_id=1480521&screen_width=750&screen_height=346&os=Win32&refurl=&pageurl=file%3A%2F%2FC%3A%5CUsers%5CHAPUBWS%5CAppData%5CRoaming%5CBKaEvgIpa.html&rnd=1703080164328 HTTP/1.1Accept: applic" Heuristic match: "GET /script?space=50dd7b0f-4105-441f-8f60-18cc3fcb090c&type=direct&page_id=5386135&screen_width=750&screen_height=346&os=Win32&refurl=&pageurl=file%3A%2F%2FC%3A%5CUsers%5CHAPUBWS%5CAppData%5CRoaming%5CjtiAoryjf.html&rnd=1703081209728 HTTP/1.1Accept: applic" Heuristic match: "GET /script?space=50dd7b0f-4105-441f-8f60-18cc3fcb090c&type=direct&page_id=8392843&screen_width=750&screen_height=346&os=Win32&refurl=&pageurl=file%3A%2F%2FC%3A%5CUsers%5CHAPUBWS%5CAppData%5CRoaming%5CKr.izfJwD.html&rnd=1703083756203 HTTP/1.1Accept: applic" Heuristic match: "GET /script?space=50dd7b0f-4105-441f-8f60-18cc3fcb090c&type=direct&page_id=9163783&screen_width=750&screen_height=346&os=Win32&refurl=&pageurl=file%3A%2F%2FC%3A%5CUsers%5CHAPUBWS%5CAppData%5CRoaming%5CaBDpxmlsx.html&rnd=1703084601159 HTTP/1.1Accept: applic" Heuristic match: "GET /script?space=50dd7b0f-4105-441f-8f60-18cc3fcb090c&type=direct&page_id=6405930&screen_width=750&screen_height=346&os=Win32&refurl=&pageurl=file%3A%2F%2FC%3A%5CUsers%5CHAPUBWS%5CAppData%5CRoaming%5CnkthpFinK.html&rnd=1703087255254 HTTP/1.1Accept: applic" Heuristic match: "GET /script?space=50dd7b0f-4105-441f-8f60-18cc3fcb090c&type=direct&page_id=6372294&screen_width=750&screen_height=346&os=Win32&refurl=&pageurl=file%3A%2F%2FC%3A%5CUsers%5CHAPUBWS%5CAppData%5CRoaming%5CwpjGGdCdB.html&rnd=1703088095210 HTTP/1.1Accept: applic" Heuristic match: "GET /script?space=50dd7b0f-4105-441f-8f60-18cc3fcb090c&type=direct&page_id=7596963&screen_width=750&screen_height=346&os=Win32&refurl=&pageurl=file%3A%2F%2FC%3A%5CUsers%5CHAPUBWS%5CAppData%5CRoaming%5Cuyspfppby.html&rnd=1703091915509 HTTP/1.1Accept: applic" Pattern match: "https://csp.withgoogle.com/csp/report-to/adspam-signals-scs}]}Date" Pattern match: "https://csp.withgoogle.com/csp/report-to/adspam-signals-scs}]}Content-Length" Pattern match: "www.google.comDNT" Pattern match: "https://csp.withgoogle.com/csp/report-to/recaptcha}]}Expires" Pattern match: "jquery.org/license" Pattern match: "https://digital.tv3.ee/bepolite-id/?utm_src=banner}if" Pattern match: "stackoverflow.com/questions/1145850/var" Pattern match: "www.googletagmanager.comDNT" Pattern match: "www.googletagmanager.com" Pattern match: "https://www.googletagmanager.com/a?id=+mg.ctid,Pg=void" Pattern match: "https://pagead2.googlesyndication.com/pagead/gen_204?id=tcfe;Jh(a,function(d,e){if(d||0===d)c+=&+e+=+encodeURIComponent(+d)});Oh(c,b)},Oh=function(a,b){var" Pattern match: "https://+h,m=http://+h,n=1,p=E.getElementsByTagName(script),q=0;q" Pattern match: "https://,http://,a.sg" Pattern match: "www.gstatic.com/call-tracking/call-tracking_+(tl.Qi||tl.gk)+.js},vl={},wl=function(a,b,c,d){K(22);if(c){d=d||{};var" Pattern match: "https://+c" Pattern match: "www.googleadservices.com$/,Mm=function(a){a||" Pattern match: "https://+xe.Gc,Nn=Mn+/gtm/static/,On=Number('')||5,Pn=Number('')||50,Qn=Mn,Rn=Nn,Sn=!1,Tn=0,Un=Aa();function" Pattern match: "https://td.doubleclick.net};var" Pattern match: "https://,http://,n+e" Pattern match: "https://,http://,xe.Gc+f" Pattern match: "https://www.google-analytics.com/analytics.js;Fw=!0;var" Pattern match: "https://cct.google/taggy/agent.js" Pattern match: "https://+xe.Gc+/debug/bootstrap?id=+mg.ctid+&src=+w+&cond=+u+>m=+cj()" Pattern match: "https://ampcid.google.com/v1/publisher:getClientId" Pattern match: "www.google-analytics.com},Ge=function(a){switch(a){default:case" Pattern match: "https://stats.g.doubleclick.net/j/collect" Pattern match: "https://www.google.com/ads/ga-audiences,a.google,c" Pattern match: "https://tagassistant.google.com/" Pattern match: "https://stats.g.doubleclick.net/j/collect,ca.U,ca" Pattern match: "www.google-analytics.com==a.host&&(a.port||b)==b&&D(a.path,/plugins/)?!0:!1},ne=function(a){var" Pattern match: "https://digital.tv3.ee/bepolite-id/?utm_src=banner" Pattern match: "stackoverflow.com/questions/1145850/" Pattern match: "https://pagead2.googlesyndication.com/pagead/gen_204?id=tcfe;Be(a,function(d,e){if(d||0===d)c+=&+e+=+encodeURIComponent(+d)});Ue(c,b)" Pattern match: "https://pagead2.googlesyndication.com/pagead/js/logging_library.js" Pattern match: "https://pagead2.googlesyndication.com+b,d=Cf(a)-b.length;if" Pattern match: "https://pagead2.googlesyndication.com/pagead/ping,Qg,void" Pattern match: "https://pagead2.googlesyndication.com/pagead/js/err_rep.js" Pattern match: "https://pagead2.googlesyndication.com/pagead/gen_204?id=plmetrics;window.LayoutShift&&" Pattern match: "https://googleads.g.doubleclick.net" Pattern match: "https://www.google.com/adsense" Pattern match: "https://adsense.com" Pattern match: "https://pagead2.googlesyndication.com/pagead/managed/js/adsense/,/,slotcar_library,.js" Pattern match: "https://googleads.g.doubleclick.net/pagead/html/,/,/zrt_lookup_nohtml,.html" Pattern match: "https://www.googletagmanager.com/a?id=+Tf.ctid,Qk=void" Pattern match: "https://pagead2.googlesyndication.com/pagead/gen_204?id=tcfe;Fl(a,function(d,e){if(d||0===d)c+=&+e+=+encodeURIComponent(+d)});Kl(c,b)},Kl=function(a,b){var" Pattern match: "https://+g,m=http://+g,n=1,p=E.getElementsByTagName(script),q=0;q" Pattern match: "www.googleadservices.com$/,Oq=function(a){a||" Pattern match: "https://+ni.yd,Or=Nr+/gtm/static/,Pr=Number('')||5,Qr=Number('')||50,Rr=Nr,Sr=Or,Tr=!1,Ur=0,Vr=Ka();function" Pattern match: "https://,http://,p+f" Pattern match: "https://,http://,ni.yd+e" Pattern match: "http://,https://,javascript:,file://" Pattern match: "www.youtube.com,www.youtube-nocookie.com],uC,vC=!1" Pattern match: "https://www.youtube.com/iframe_api" Pattern match: "https://www.merchant-center-analytics.goog/mc/collect;var" Pattern match: "https://+a+.google-analytics.com/g/collect},pF=function(){var" Pattern match: "https://stats.g.doubleclick.net/g/collect,v=2&+q.join(&)" Pattern match: "https://www.%/ads/ga-audiences?v=1&t=sr&slf_rd=1&_r=4&.replace(%,f):void" Pattern match: "https://+ni.yd+/debug/bootstrap?id=+Tf.ctid+&src=+w+&cond=+u+>m=+hn()" Pattern match: "http://www.w3.org/1999/xhtml" Pattern match: "https://www.upload.ee/" Pattern match: "https://www.upload.ee/static/ubr__style.css" Pattern match: "https://www.upload.ee/favicon.ico" Pattern match: "https://www.upload.ee/js/js__file_upload.js" Pattern match: "https://www.upload.ee/login.html" Pattern match: "https://www.upload.ee/forgotpassword.html" Pattern match: "https://www.upload.ee/images/est/flag.png" Pattern match: "https://www.upload.ee/images/menubg.gif" Pattern match: "https://www.upload.ee/images/arrow.gif" Pattern match: "https://www.upload.ee/?page=myfiles" Pattern match: "https://www.upload.ee/?page=mygalleries" Pattern match: "https://www.upload.ee/top/toprated.html?p=0" Pattern match: "https://www.upload.ee/top/mostviewed.html?p=0" Pattern match: "https://www.upload.ee/top/mostdownloaded.html?p=0" Pattern match: "https://www.upload.ee/top/mostrated.html?p=0" Pattern match: "https://www.upload.ee/top/mostcommented.html?p=0" Pattern match: "https://www.upload.ee/top/lastadded.html?p=0" Pattern match: "https://www.upload.ee/top/lastviewed.html?p=0" Pattern match: "https://www.upload.ee/top/az.html?p=0" Pattern match: "https://www.upload.ee/topgal/mostviewed.html?p=0" Pattern match: "https://www.upload.ee/topgal/mostcommented.html?p=0" Pattern match: "https://www.upload.ee/topgal/lastadded.html?p=0" Pattern match: "https://www.upload.ee/topgal/lastviewed.html?p=0" Pattern match: "https://www.upload.ee/topgal/az.html?p=0" Pattern match: "https://www.upload.ee/download/16071907/018665e6d4b51e093fe5/Bins.exe" Pattern match: "https://www.addthis.com/bookmark.php?v=250" Pattern match: "https://www.upload.ee/files/16071907/Bins.exe.html" Pattern match: "https://www.upload.ee/files/16071907/Bins.exe.html[/url" Pattern match: "https://www.upload.ee/files/16071907/Bins.exe.html">https://www.upload.ee/files/16071907/Bins.exe.html</a>" Pattern match: "https://www.upload.ee/files/16071907/Bins.exe.html][img]https://www.upload.ee/images/dl_f.gif[/img][/url" Pattern match: "https://www.upload.ee/files/16071907/Bins.exe.html"><img" Pattern match: "https://www.googletagmanager.com/gtag/js?id=UA-6703115-1" Pattern match: "serving.bepolite.eu/script?space=" Pattern match: "du0pud0sdlmzf.cloudfront.net/?dupud=997369" Pattern match: "https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js" Pattern match: "http://googleads.g.doubleclick.net]=!0,ag[http://pagead2.googlesyndication.com]=!0,ag[https://googleads.g.doubleclick.net]=!0,ag[https://pagead2.googlesyndication.com]=!0,ag" Pattern match: "https://tpc.googlesyndication.com/sodar/%{basename}.js" Pattern match: "https://pagead2.googlesyndication.com/pagead/gen_204?id=+b;Ff(a,function(e,f){if(e||0===e)d+=&+f+=+encodeURIComponent(+e)});uk(d,c)" Pattern match: "https://cdn.ampproject.org/rtv/,/amp4ads-host-v0.js" Pattern match: "https://pagead2.googlesyndication.com/pagead/gen_204,b.join(&)" Pattern match: "fonts.googleapis.com/css" Pattern match: "https://pagead2.googlesyndication.com+b,d=Cm(a)-b.length;if" Pattern match: "https://pagead2.googlesyndication.com/pagead/ping,Bo,void" Pattern match: "http://mathiasbynens.be/" Pattern match: "https://cse.google.com/cse.js" Pattern match: "https://www.gstatic.com" Pattern match: "https://www.google.com/s2/favicons?sz=64&domain_url=+encodeURIComponent(this.host)" Pattern match: "https://www.gstatic.com/prose/protected/%{version}/iframe.html?cx=%{cxId}&host=%{host}&hl=%{lang}&lrh=%{lrh}&client=%{client}&origin=%{origin" Pattern match: "http://www.w3.org/2000/svg" Pattern match: "https://fonts.googleapis.com/css2?family=Google+Symbols:opsz,wght,FILL,GRAD@20..48,100..700,0..1,-50..200/" Pattern match: "https://www.google.com/adsense/search/async-ads.js" Pattern match: "http://google.com,resultsPageQueryParam:q,relatedSearchTargeting:content,relatedSearchResultClickedCallback:a.Xa.bind(a),relatedSearchUseResultCallback:!0,cx:a.G};a.ka&&(c.adLoadedCallback=a.wa.bind(a))" Pattern match: "https://www.gstatic.com===b.origin&&resize===b.data.action&&(a.g.style.height=Math.ceil(b.data.height)+1+px)" Pattern match: "https://www.gstatic.com/adsense/autoads/icons/gpp_good_24px_grey_800.svg;E" Pattern match: "https://www.gstatic.com/adsense/autoads/icons/arrow_left_24px_grey_800.svg;b.setAttribute(aria-label,a.l);hE(b);E" Pattern match: "https://www.gstatic.com/adsense/autoads/icons/gpp_good_24px_grey_800.svg,d" Pattern match: "https://www.gstatic.com/adsense/autoads/icons/gpp_good_24px_blue_600.svg,2px" Pattern match: "http://example.com" Pattern match: "https://fundingchoicesmessages.google.com/i/%{id" Pattern match: "https://partner.googleadservices.com/gampad/cookie.js" Pattern match: "www.==a.substring(0,4)&&(a=a.substring(4,a.length))" Pattern match: "https://+e+g+(J(a.za,9)&&c.google_debug_params?c.google_debug_params:)" Pattern match: "http://www.w3.org/2000/svg,path" Pattern match: "https://fonts.googleapis.com/css2?family=Google+Material+Icons:wght@400;500;700" Pattern match: "https://support.google.com/adsense/answer/11188578" Pattern match: "https://www.google.com/adsense/search/ads.js" Pattern match: "www.google.com/adsense/search/ads.js" Pattern match: "https://securepubads.g.doubleclick.net/static/topics/topics_frame.html" Pattern match: "https://pagead2.googlesyndication.com/pagead/js/,/,/rum,.js" Pattern match: "https://assets.msn.com/config/v1/"" Pattern match: "https://+l+/OneCollector/1.0+function(t){return?+Object.keys(t).map" Pattern match: "www.bing.com" Pattern match: "https://assets.msn.com/bundles/v1/homePage/latest/midlevel/vendors.ef7dde432bed42c1b7db.js" Pattern match: "https://assets.msn.com/bundles/v1/homePage/latest/midlevel/microsoft.f0dc8bbbc7b4d116660b.js" Pattern match: "https://assets.msn.com/bundles/v1/homePage/latest/midlevel/common.a878ea7bfce3fb435465.js" Pattern match: "https://assets.msn.com/bundles/v1/homePage/latest/midlevel/experience.0f30a2bb04a428617069.js" Heuristic match: "%WINDIR%\assembly\NativeImages_v2.0.50727_32\Microsoft.WSMan.Man#\7bf5729401cff7ea7898124e9818ed20\Microsoft.WSMan.Management.ni" Heuristic match: "C:\%SystemRoot%\system32\WindowsPowerShell\v1.0\Add-MpPreference.COM" Heuristic match: "%ALLUSERSPROFILE%\Oracle\Java\javapath\Add-MpPreference.COM" Heuristic match: "%WINDIR%\system32\Add-MpPreference.COM" Heuristic match: "%WINDIR%\Add-MpPreference.COM" Heuristic match: "%WINDIR%\System32\Wbem\Add-MpPreference.COM" Heuristic match: "%WINDIR%\System32\WindowsPowerShell\v1.0\Add-MpPreference.COM" Heuristic match: "%LOCALAPPDATA%\Programs\Python\Python38-32\Scripts\Add-MpPreference.COM" Heuristic match: "%LOCALAPPDATA%\Programs\Python\Python38-32\Add-MpPreference.COM" Heuristic match: "%LOCALAPPDATA%\Programs\Python\Python36-32\Scripts\Add-MpPreference.COM" Heuristic match: "%LOCALAPPDATA%\Programs\Python\Python36-32\Add-MpPreference.COM" Heuristic match: "XT=.CO" Pattern match: "Microsoft.NET/Framework/v4.0.30319/" Heuristic match: "\Microsoft.NET" Heuristic match: "e=System.Co" Heuristic match: "BkAM).Tt" Heuristic match: "AM).Tt" Heuristic match: ".N.N.N.N.N.N.N.N.N.N.N.N.N.N.N.N.N.N.N.N.N.N.N.N.N.N.N.N.N.N.N.N.N.N.N.N.N.N.N.NF" Heuristic match: "4.0.mn" Heuristic match: "ation.Sc"55:Tc70c,Found URL "http://schemas.xmlsoap.org/soap/envelope/" - Source: "00000000-00002880.00000000.68697.00F91000.00000040.mdmp") Found URL "http://schemas.xmlsoap.org/soap/encoding/" - Source: "00000000-00002880.00000000.68697.00F91000.00000040.mdmp") Found URL "http://[fe80:connectedurn:schemas-upnp-org:service:wancommoninterfaceconfig:0.0.0.0m-search" - Source: "00000000-00002880.00000000.68697.00F91000.00000040.mdmp") Found URL "http://192.168.241.242:2869/upnphost/udhisapi.dll?content=uuid:4f8e1a2d-3fec-4a15-86de-6f8fafe83a56vb6[ob6b-js" - Source: "00000000-00002880.00000001.70364.00210000.00000004.mdmp") Found URL "http://192.168.243.212:2869/upnphost/udhisapi.dll?content=uuid:1afae495-5c1f-43eb-b508-8395c601874eupnp:rootdeviceuuid:1afae495-5c1f-43eb-b508-8395c601874e::upnp:rootdevicehttp://192.168.243.38:2869/upnphost/udhisapi.dll?content=uuid:1afae495-5c1f-43eb-b508-8395c601874eupnp:rootdeviceuuid:1afae495-5c1f-43eb-b508-8395c601874e::upnp:rootdevicehttp://192.168.243.111:2869/upnphost/udhisapi.dll?content=uuid:4f8e1a2d-3fec-4a15-86de-6f8fafe83a56upnp:rootdeviceuuid:4f8e1a2d-3fec-4a15-86de-6f8fafe83a56::upnp:rootdevicehttp://192.168.243.163:2869/upnphost/udhisapi.dll?content=uuid:4f8e1a2d-3fec-4a15-86de-6f8fafe83a56upnp:rootdeviceuuid:4f8e1a2d-3fec-4a15-86de-6f8fafe83a56::upnp:rootdevice5ed" - Source: "00000000-00002880.00000001.70364.00210000.00000004.mdmp") Found URL "http://192.168.241.242:2869/http://192.168.241.242:2869/http://192.168.241.242:2869/http://192.168.241.242:2869/jb6ghttp://192.168.241.242:2869/upnphost/udhisapi.dll?content=uuid:4f8e1a2d-3fec-4a15-86de-6f8fafe83a56upnp:rootdeviceuuid:4f8e1a2d-3fec-4a15-86de-6f8fafe83a56::upnp:rootdeviceob6bul!%rsion=" - Source: "00000000-00002880.00000001.70364.00210000.00000004.mdmp") Found URL "http://www.microsoft.com" - Source: "00000000-00002880.00000001.70364.00210000.00000004.mdmp") Found URL "http://go.microsoft.com/fwlink/?linkid=105926" - Source: "00000000-00002880.00000001.70364.00210000.00000004.mdmp") Found URL "http://schemas.xmlsoap.org/soap/envelope/" - Source: "00000000-00002880.00000001.70364.00F91000.00000040.mdmp") Found URL "http://schemas.xmlsoap.org/soap/encoding/" - Source: "00000000-00002880.00000001.70364.00F91000.00000040.mdmp") Found URL "http://[fe80:connectedurn:schemas-upnp-org:service:wancommoninterfaceconfig:0.0.0.0m-search" - Source: "00000000-00002880.00000001.70364.00F91000.00000040.mdmp") Found URL "http://ocsp.digicert.comhttp://crl3.digicert.com/digicertglobalrootca.crl[.shellclassinfolocalizedresourcename@%systemroot%\system32\shell32.dll,-21813det-qvatnpjdiobintel(r)" - Source: "00000000-00003636.00000001.69283.002F0000.00000004.mdmp") Found URL "http://crl3.digicert.com/rapidsslglobaltlsrsa4096sha2562022ca1.crl1c412hapubws-pc192.168.241.2401700817clsid\" - Source: "00000000-00003636.00000001.69283.002F0000.00000004.mdmp") Found URL "http://crl3.digicert.com/rapidsslglobaltlsrsa4096sha2562022ca1.crlhttp://crl4.digicert.com/rapidsslglobaltlsrsa4096sha2562022ca1.crl\windowshurrentve\ion\shelpompatibity\objec\" - Source: "00000000-00003636.00000001.69283.002F0000.00000004.mdmp") Found URL "https://www.upload.ee/files/16071907/bins.exe.htmlile:///c:/users/hapubws/appdata/local/temp/24.exeile:///c:/users/hapubws/appdata/local/temp/24.exeile:///c:/users/hapubws/appdata/local/temp/24.exec:/users/hapubws/appdata/roaming/pbe.hwspk.htmlttps://www.upload.ee/files/16071907/bins.exe.htmlc:/users/hapubws/appdata/roaming/rsmkwycme.htmlttps://www.upload.ee/files/16071907/bins.exe.htmlc:/users/hapubws/appdata/roaming/pbe.hwspk.htmlc:/users/hapubws/appdata/roaming/rsmkwycme.htmltps://www.upload.ee/files/16071907/bins.exe.html/8/8/icrosoft\windows\network" - Source: "00000000-00003636.00000001.69283.002F0000.00000004.mdmp") Found URL "http://crl3.digicert.com/rapidsslglobaltlsrsa4096sha2562022ca1.crl0hbhttp://crl4.digicert.com/rapidsslglobaltlsrsa4096sha2562022ca1.crl0>705030)0'http://www.digicert.com/cps0" - Source: "00000000-00003636.00000001.69283.002F0000.00000004.mdmp") Found URL "http://ocsp.digicert.com0qehttp://cacerts.digicert.com/rapidsslglobaltlsrsa4096sha2562022ca1.crt0" - Source: "00000000-00003636.00000001.69283.002F0000.00000004.mdmp") Found URL "http://ocsp.digicert.com0@4http://cacerts.digicert.com/digicertglobalrootca.crt0b;09071http://crl3.dilmemlmemlmemlmemmoc.iyiqiiqiyi.comse.elgooggoogle.esma>,lp.teno.wwwwww.onet.plten.baldleiyyieldlab.netmoc.samseesmas.commoc.eneselziizlesene.comoi.ezagurttrugaze.iomoc.ukuoyyouku.commoc.831piip138.compj.trpssggssprt.jpmoc.udiabbaidu.comten.oisamessemasio.netmoc.8nawukkuwan8.commoc.aa.wwwwww.aa.comvog.sri.wwwwww.irs.govten.qirenwoowneriq.netmoc.elibom-tt-mobile.comoi.avitcenocconectiva.iomoc.selifgnngfiles.commoc.topsemaggamespot.commoc.ytsatbaabtasty.comten.hgihdaadhigh.netten.tensoozzoosnet.netmoc.oohayyahoo.commoc.sodibayyabidos.commoc.todrappardot.commoc.uogukkugou.commoc.llodratsstardoll.comten.krtbwwbtrk.netmoc.sxndaadnxs.commoc.otuatibbitauto.commoc.pdtdaadtdp.commoc.tcejorpnocibur.ndc-2pattap2-cdn.rubiconproject.commoc.aidemylurnu.gnitegrattargeting.unrulymedia.commoc.enilnotfosorcim.nigollogin.microsoftonline.commoc.cihpargoeglanoitan.wwwwww.nationalgeographic.com/user/sync/ssps/moc.sknilrewop.xppx.powerlinks.commoc.ertaehtdib.ybsda.hctammatch.adsby.bidtheatre.commoc.ylezimitpo.gol.883373126621373388.log.optimizely.commoc.ylezimitpo.gol.9631108558011369.log.optimizely.commoc.ylezimitpo.gol.857236002200632758.log.optimizely.comwdigesttssspntlmpku2uvysnvysn6f00bm0.!z&r'hm9ckx(c49?c49yc49il" - Source: "00000000-00003636.00000001.69283.002F0000.00000004.mdmp") Found URL "http://crl.usertrust.com/addtrustexternalcaroot.crl05)0'0%http://ocsp.usertrust.com0ql" - Source: "00000000-00003636.00000001.69283.002F0000.00000004.mdmp") Found URL "http://g.symcd.com0e0c0a60301%http://www.geotrust.com/resources/cps06/0-0+%http://g.symcb.com/geotrustpca-g3.crl0symantecpki-1-697033ti^l" - Source: "00000000-00003636.00000001.69283.002F0000.00000004.mdmp") Found URL "http://g1.symcb.com/crls/gtglobal.crl0/" - Source: "00000000-00003636.00000001.69283.002F0000.00000004.mdmp") Found URL "http://g2.symcb.com0le0c0a60301%http://www.geotrust.com/resources/cps0)symantecpki-1-53902ol!o!yj>9iqmgvw,czc;eglnonic" - Source: "00000000-00003636.00000001.69283.002F0000.00000004.mdmp") Found URL "http://crl3.digicert.comootca.crl0=6040ez<*" - Source: "00000000-00003636.00000001.69283.002F0000.00000004.mdmp") Found URL "http://isrg.trustid.ocsp.identrust.com0;/http://apps.identrust.com/roots/dstrootcax3.p7c0m0k0000." - Source: "00000000-00003636.00000001.69283.002F0000.00000004.mdmp") Found URL "http://cps.root-x1.letsencrypt.org0<50301+http://crl.identrust.com/dstrootcax3crl.crl0ig'" - Source: "00000000-00003636.00000001.69283.002F0000.00000004.mdmp") Found URL "https://www.verisign.com/cps04*0(0&" - Source: "00000000-00003636.00000001.69283.002F0000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl0internet1verisign," - Source: "00000000-00003636.00000001.69283.002F0000.00000004.mdmp") Found URL "http://www.usertrust.com1utn-userfirst-hardware0110315000000z140314235959z0384771florida1english1sea" - Source: "00000000-00003636.00000001.69283.002F0000.00000004.mdmp") Found URL "https://secure.comodo.com/cps0" - Source: "00000000-00003636.00000001.69283.002F0000.00000004.mdmp") Found URL "http://crl.comodoca.com/utn-userfirst-hardware.crl060http://crl.comodo.net/utn-userfirst-hardware.crl0qe0c0;/http://crt.comodoca.com/utnaddtrustserverca.crt0$http://ocsp.comodoca.com05addons.mozilla.orgwww.addons.mozilla.org0zsb)j9e/salt" - Source: "00000000-00003636.00000001.69283.002F0000.00000004.mdmp") Found URL "http://crl.comodoca.com/utn-userfirst-hardware.crl060http://crl.comodo.net/utn-userfirst-hardware.crl0qe0c0;/http://crt.comodoca.com/utnaddtrustserverca.crt0$http://ocsp.comodoca.com0%www.google.comgoogle.com0io]l,e9n0p1+0)" - Source: "00000000-00003636.00000001.69283.002F0000.00000004.mdmp") Found URL "http://www.public-trust.com/cps/omniroot.html0w0u1gte" - Source: "00000000-00003636.00000001.69283.002F0000.00000004.mdmp") Found URL "http://www.public-trust.com/cgi-bin/crl/2018/cdp.crl0dmxt*j]+xijom5o" - Source: "00000000-00003636.00000001.69283.002F0000.00000004.mdmp") Found URL "http://ocsp.entrust.net03,0*0(" - Source: "00000000-00003636.00000001.69283.002F0000.00000004.mdmp") Found URL "http://crl.entrust.net/server1.crl0;8kbv7.11c)d[b" - Source: "00000000-00003636.00000001.69283.002F0000.00000004.mdmp") Found URL "http://www.diginotar.nl/cps/pkioverheid0w0u1staat" - Source: "00000000-00003636.00000001.69283.002F0000.00000004.mdmp") Found URL "http://crl.pkioverheid.nl/domovlatestcrl.crl0]ko)tsz'salt" - Source: "00000000-00003636.00000001.69283.002F0000.00000004.mdmp") Found URL "http://crl.comodoca.com/utn-userfirst-hardware.crl060http://crl.comodo.net/utn-userfirst-hardware.crl0qe0c0;/http://crt.comodoca.com/utnaddtrustserverca.crt0$http://ocsp.comodoca.com0/login.skype.comwww.login.skype.com0ynsld1r06x7y1%2+jopijlf0cth" - Source: "00000000-00003636.00000001.69283.002F0000.00000004.mdmp") Found URL "http://www.diginotar.nl/cps/pkioverheid0\0z1staat" - Source: "00000000-00003636.00000001.69283.002F0000.00000004.mdmp") Found URL "http://crl.pkioverheid.nl/domorganisatielatestcrl-g2.crl0^tl*" - Source: "00000000-00003636.00000001.69283.002F0000.00000004.mdmp") Found URL "http://cybertrust.omniroot.com/repository.cfm0w0u1gte" - Source: "00000000-00003636.00000001.69283.002F0000.00000004.mdmp") Found URL "http://www.public-trust.com/cgi-bin/crl/2018/cdp.crl0j)z" - Source: "00000000-00003636.00000001.69283.002F0000.00000004.mdmp") Found URL "http://crl.comodoca.com/utn-userfirst-hardware.crl060http://crl.comodo.net/utn-userfirst-hardware.crl0qe0c0;/http://crt.comodoca.com/utnaddtrustserverca.crt0$http://ocsp.comodoca.com0/login.yahoo.comwww.login.yahoo.com0yvr,0ab^salt" - Source: "00000000-00003636.00000001.69283.002F0000.00000004.mdmp") Found URL "http://www.usertrust.com1utn-userfirst-hardware0110315000000z140314235959z0384771florida1tampa1sea" - Source: "00000000-00003636.00000001.69283.002F0000.00000004.mdmp") Found URL "http://crl.comodoca.com/utn-userfirst-hardware.crl060http://crl.comodo.net/utn-userfirst-hardware.crl0qe0c0;/http://crt.comodoca.com/utnaddtrustserverca.crt0$http://ocsp.comodoca.com0global" - Source: "00000000-00003636.00000001.69283.002F0000.00000004.mdmp") Found URL "http://crl.entrust.net/server1.crl0;8kbv7.1q7z?,o2;n)wp+(the" - Source: "00000000-00003636.00000001.69283.002F0000.00000004.mdmp") Found URL "https://www.verisign.com/repository/cpsthis" - Source: "00000000-00003636.00000001.69283.002F0000.00000004.mdmp") Found URL "https://www.verisign.com;" - Source: "00000000-00003636.00000001.69283.002F0000.00000004.mdmp") Found URL "https://www.verisign.com/repository/verisignlogo.gif0d=0;090*0(https://www.verisign.com/rpa0salt" - Source: "00000000-00003636.00000001.69283.002F0000.00000004.mdmp") Found URL "http://crl.comodoca.com/utn-userfirst-hardware.crl060http://crl.comodo.net/utn-userfirst-hardware.crl0qe0c0;/http://crt.comodoca.com/utnaddtrustserverca.crt0$http://ocsp.comodoca.com0/mail.google.comwww.mail.google.com0?=*k!\yro2;nsalt" - Source: "00000000-00003636.00000001.69283.002F0000.00000004.mdmp") Found URL "http://crl.comodoca.com/utn-userfirst-hardware.crl060http://crl.comodo.net/utn-userfirst-hardware.crl0qe0c0;/http://crt.comodoca.com/utnaddtrustserverca.crt0$http://ocsp.comodoca.com0-login.live.comwww.login.live.com0nwk1uy1un:nd" - Source: "00000000-00003636.00000001.69283.002F0000.00000004.mdmp") Found URL "https://www.verisign.com/repository/verisignlogo.gif0d=0;090*0(https://www.verisign.com/rpa0f$\_)$bf!;8kb%2+joki0!!salt" - Source: "00000000-00003636.00000001.69283.002F0000.00000004.mdmp") Found URL "http://crl.comodoca.com/utn-userfirst-hardware.crl060http://crl.comodo.net/utn-userfirst-hardware.crl0qe0c0;/http://crt.comodoca.com/utnaddtrustserverca.crt0$http://ocsp.comodoca.com0login.yahoo.com0kw(=n" - Source: "00000000-00003636.00000001.69283.002F0000.00000004.mdmp") Found URL "http://ocsp.entrust.net0d=0;09000." - Source: "00000000-00003636.00000001.69283.002F0000.00000004.mdmp") Found URL "http://www.digicert.com.my/cps.htm02+0)0'!http://crl.entrust.net/2048ca.crl09yk3y!gte" - Source: "00000000-00003636.00000001.69283.002F0000.00000004.mdmp") Found URL "http://www.public-trust.com/cgi-bin/crl/2018/cdp.crl0\0" - Source: "00000000-00003636.00000001.69283.002F0000.00000004.mdmp") Found URL "http://crl.pkioverheid.nl/domovlatestcrl.crl00ev" - Source: "00000000-00003636.00000001.69283.002F0000.00000004.mdmp") Found URL "http://www.public-trust.com/cgi-bin/crl/2018/cdp.crl0or" - Source: "00000000-00003636.00000001.69283.002F0000.00000004.mdmp") Found URL "http://crl.comodoca.com/utn-userfirst-hardware.crl060http://crl.comodo.net/utn-userfirst-hardware.crl0qe0c0;/http://crt.comodoca.com/utnaddtrustserverca.crt0$http://ocsp.comodoca.com0login.yahoo.com0oc*9entrust.net1;092www.entrust.net/cps" - Source: "00000000-00003636.00000001.69283.002F0000.00000004.mdmp") Found URL "http://crl.entrust.net/server1.crl0v7.1ctj7+>.entrusqcom1" - Source: "00000000-00003636.00000001.69283.002F0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl0th0f0d8http://www.microsoft.com/pki/certs/microsoftrootcert.crt0>ej-+\lu>gvpob\hzagxr" - Source: "00000000-00003636.00000001.69283.002F0000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif0\:oj?microsoftwindowscth" - Source: "00000000-00003636.00000001.69283.002F0000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif03130$j0_b>mnk't" - Source: "00000000-00003636.00000001.69283.0AC60000.00000004.mdmp") Found URL "http://www.microsoft.com0gt:(y<%qtz-r9lv<;7=_somj," - Source: "00000000-00003636.00000001.69283.0AC60000.00000004.mdmp") Found URL "https://www.upload.ee/files/16071907/bins.exe.htmlhttps://www.upload.ee/files/16071907/bins.exe.htmle^dvxcpx" - Source: "00000000-00003636.00000001.69283.0AC60000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0ta[17iusai:" - Source: "00000000-00003636.00000001.69283.0AC60000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00003636.00000001.69283.0AC60000.00000004.mdmp") Found URL "http://ocsp.digicert.com0@4http://cacerts.digicert.com/digicertglobalrootca.crt0b;09071http://crl3.digicert.com/digicertglobalrootca.crl0=6040ez<*nonicnonic" - Source: "00000000-00003636.00000001.69283.0AC60000.00000004.mdmp") Found URL "http://crl3.digicert.com/rapid096sha2562022ca1.crl0hbhttp://crl4.digicert.com/rapidsslglobaltlsrsa4096sha2562022ca1.crl0>705030)0'http://www.digicert.com/cps0" - Source: "00000000-00003636.00000001.69283.0AC60000.00000004.mdmp") Found URL "http://ocsp.digicert.com0qehttp://cacerts.digicert.com/rapidsslglobaltlsrsa4096sha2562022ca1.crt0" - Source: "00000000-00003636.00000001.69283.0AC60000.00000004.mdmp") Found URL "http://ocsp.digicert.com0@4http://cacerts.digicert.com/digicertglobalrootca.crt0b;09071http://crl3.digicert.com/digicertglobalrootca.crl0=6040ez<*digicert" - Source: "00000000-00003636.00000001.69283.0AC60000.00000004.mdmp") Found URL "http://crl3.digicert.com/rapidsslglobaltlsrsa4096sha2562022ca1.crl0hbhttp://crl4.digicert.com/rapidsslglobaltlsrsa4096sha2562022ca1.crl0>705030)0'http://www.digicert.com/cps0" - Source: "00000000-00003636.00000001.69283.0AC60000.00000004.mdmp") Found URL "http://www.w3.org/1999/xhtml" - Source: "00000000-00003636.00000001.69283.0AC60000.00000004.mdmp") Found URL "http://www.w3.org/tr/xhtml1/dtd/xhtml1-transitional.dtd" - Source: "00000000-00003636.00000001.69283.0B110000.00000004.mdmp") Found URL "http://ocsp.digicert.comhttp://crl3.digicert.com/digicertglobalrootca.crl[.shellclassinfolocalizedresourcename@%systemroot%\system32\shell32.dll,-21813det-qvatnpjdiobintel(r)" - Source: "00000000-00003636.00000002.71203.002F0000.00000004.mdmp") Found URL "http://crl3.digicert.com/rapidsslglobaltlsrsa4096sha2562022ca1.crl1c412hapubws-pc192.168.241.2401700817clsid\" - Source: "00000000-00003636.00000002.71203.002F0000.00000004.mdmp") Found URL "http://crl3.digicert.com/rapidsslglobaltlsrsa4096sha2562022ca1.crlhttp://crl4.digicert.com/rapidsslglobaltlsrsa4096sha2562022ca1.crlebcache_" - Source: "00000000-00003636.00000002.71203.002F0000.00000004.mdmp") Found URL "https://www.upload.ee/files/16071907/bins.exe.htmlile:///c:/users/hapubws/appdata/local/temp/24.exeile:///c:/users/hapubws/appdata/local/temp/24.exeile:///c:/users/hapubws/appdata/local/temp/24.exec:/users/hapubws/appdata/roaming/pbe.hwspk.htmlttps://www.upload.ee/files/16071907/bins.exe.htmlc:/users/hapubws/appdata/roaming/rsmkwycme.htmlc:/users/hapubws/appdata/roaming/jyo.rquau.htmlc:/users/hapubws/appdata/roaming/pbe.hwspk.htmlc:/users/hapubws/appdata/roaming/rsmkwycme.htmlc:/users/hapubws/appdata/roaming/bjgic..kg.htmlc:/users/hapubws/appdata/roaming/jyo.rquau.htmlc:/users/hapubws/appdata/roaming/vhimy.ogi.htmlc:/users/hapubws/appdata/roaming/bjgic..kg.htmlttps://www.upload.ee/files/16071907/bins.exe.htmlc:/users/hapubws/appdata/roaming/bxlkf.hho.htmlc:/users/hapubws/appdata/roaming/vhimy.ogi.htmlicrosoft\windows\network" - Source: "00000000-00003636.00000002.71203.002F0000.00000004.mdmp") Found URL "http://crl3.digicert.com/rapidsslglobaltlsrsa4096sha2562022ca1.crl0hbhttp://crl4.digicert.com/rapidsslglobaltlsrsa4096sha2562022ca1.crl0>705030)0'http://www.digicert.com/cps0" - Source: "00000000-00003636.00000002.71203.002F0000.00000004.mdmp") Found URL "http://ocsp.digicert.com0qehttp://cacerts.digicert.com/rapidsslglobaltlsrsa4096sha2562022ca1.crt0" - Source: "00000000-00003636.00000002.71203.002F0000.00000004.mdmp") Found URL "http://ocsp.digicert.com0@4http://cacerts.digicert.com/digicertglobalrootca.crt0b;09071http://crl3.dilmemlmemlmemlmemmoc.iyiqiiqiyi.comse.elgooggoogle.esma>,lp.teno.wwwwww.onet.plten.baldleiyyieldlab.netmoc.samseesmas.commoc.eneselziizlesene.comoi.ezagurttrugaze.iomoc.ukuoyyouku.commoc.831piip138.compj.trpssggssprt.jpmoc.udiabbaidu.comten.oisamessemasio.netmoc.8nawukkuwan8.commoc.aa.wwwwww.aa.comvog.sri.wwwwww.irs.govten.qirenwoowneriq.netmoc.elibom-tt-mobile.comoi.avitcenocconectiva.iomoc.selifgnngfiles.commoc.topsemaggamespot.commoc.ytsatbaabtasty.comten.hgihdaadhigh.netten.tensoozzoosnet.netmoc.oohayyahoo.commoc.sodibayyabidos.commoc.todrappardot.commoc.uogukkugou.commoc.llodratsstardoll.comten.krtbwwbtrk.netmoc.sxndaadnxs.commoc.otuatibbitauto.commoc.pdtdaadtdp.commoc.tcejorpnocibur.ndc-2pattap2-cdn.rubiconproject.commoc.aidemylurnu.gnitegrattargeting.unrulymedia.commoc.enilnotfosorcim.nigollogin.microsoftonline.commoc.cihpargoeglanoitan.wwwwww.nationalgeographic.com/user/sync/ssps/moc.sknilrewop.xppx.powerlinks.commoc.ertaehtdib.ybsda.hctammatch.adsby.bidtheatre.commoc.ylezimitpo.gol.883373126621373388.log.optimizely.commoc.ylezimitpo.gol.9631108558011369.log.optimizely.commoc.ylezimitpo.gol.857236002200632758.log.optimizely.comyn<3wdigesttssspntlmpku2uvysnvysn6f00bm0.!z&r'hm9ckx(c49?c49yc49il" - Source: "00000000-00003636.00000002.71203.002F0000.00000004.mdmp") Found URL "http://crl.usertrust.com/addtrustexternalcaroot.crl05)0'0%http://ocsp.usertrust.com0ql" - Source: "00000000-00003636.00000002.71203.002F0000.00000004.mdmp") Found URL "http://g.symcd.com0e0c0a60301%http://www.geotrust.com/resources/cps06/0-0+%http://g.symcb.com/geotrustpca-g3.crl0symantecpki-1-697033ti^l" - Source: "00000000-00003636.00000002.71203.002F0000.00000004.mdmp") Found URL "http://g1.symcb.com/crls/gtglobal.crl0/" - Source: "00000000-00003636.00000002.71203.002F0000.00000004.mdmp") Found URL "http://g2.symcb.com0le0c0a60301%http://www.geotrust.com/resources/cps0)symantecpki-1-53902ol!o!yj>9iqmgvw,czc;eglnonic" - Source: "00000000-00003636.00000002.71203.002F0000.00000004.mdmp") Found URL "http://crl3.digicert.comootca.crl0=6040ez<*" - Source: "00000000-00003636.00000002.71203.002F0000.00000004.mdmp") Found URL "http://isrg.trustid.ocsp.identrust.com0;/http://apps.identrust.com/roots/dstrootcax3.p7c0m0k0000." - Source: "00000000-00003636.00000002.71203.002F0000.00000004.mdmp") Found URL "http://cps.root-x1.letsencrypt.org0<50301+http://crl.identrust.com/dstrootcax3crl.crl0ig'" - Source: "00000000-00003636.00000002.71203.002F0000.00000004.mdmp") Found URL "https://www.verisign.com/cps04*0(0&" - Source: "00000000-00003636.00000002.71203.002F0000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl0internet1verisign," - Source: "00000000-00003636.00000002.71203.002F0000.00000004.mdmp") Found URL "http://www.usertrust.com1utn-userfirst-hardware0110315000000z140314235959z0384771florida1english1sea" - Source: "00000000-00003636.00000002.71203.002F0000.00000004.mdmp") Found URL "https://secure.comodo.com/cps0" - Source: "00000000-00003636.00000002.71203.002F0000.00000004.mdmp") Found URL "http://crl.comodoca.com/utn-userfirst-hardware.crl060http://crl.comodo.net/utn-userfirst-hardware.crl0qe0c0;/http://crt.comodoca.com/utnaddtrustserverca.crt0$http://ocsp.comodoca.com05addons.mozilla.orgwww.addons.mozilla.org0zsb)j9e/salt" - Source: "00000000-00003636.00000002.71203.002F0000.00000004.mdmp") Found URL "http://crl.comodoca.com/utn-userfirst-hardware.crl060http://crl.comodo.net/utn-userfirst-hardware.crl0qe0c0;/http://crt.comodoca.com/utnaddtrustserverca.crt0$http://ocsp.comodoca.com0%www.google.comgoogle.com0io]l,e9n0p1+0)" - Source: "00000000-00003636.00000002.71203.002F0000.00000004.mdmp") Found URL "http://www.public-trust.com/cps/omniroot.html0w0u1gte" - Source: "00000000-00003636.00000002.71203.002F0000.00000004.mdmp") Found URL "http://www.public-trust.com/cgi-bin/crl/2018/cdp.crl0dmxt*j]+xijom5o" - Source: "00000000-00003636.00000002.71203.002F0000.00000004.mdmp") Found URL "http://ocsp.entrust.net03,0*0(" - Source: "00000000-00003636.00000002.71203.002F0000.00000004.mdmp") Found URL "http://crl.entrust.net/server1.crl0;8kbv7.11c)d[b" - Source: "00000000-00003636.00000002.71203.002F0000.00000004.mdmp") Found URL "http://www.diginotar.nl/cps/pkioverheid0w0u1staat" - Source: "00000000-00003636.00000002.71203.002F0000.00000004.mdmp") Found URL "http://crl.pkioverheid.nl/domovlatestcrl.crl0]ko)tsz'salt" - Source: "00000000-00003636.00000002.71203.002F0000.00000004.mdmp") Found URL "http://crl.comodoca.com/utn-userfirst-hardware.crl060http://crl.comodo.net/utn-userfirst-hardware.crl0qe0c0;/http://crt.comodoca.com/utnaddtrustserverca.crt0$http://ocsp.comodoca.com0/login.skype.comwww.login.skype.com0ynsld1r06x7y1%2+jopijlf0cth" - Source: "00000000-00003636.00000002.71203.002F0000.00000004.mdmp") Found URL "http://www.diginotar.nl/cps/pkioverheid0\0z1staat" - Source: "00000000-00003636.00000002.71203.002F0000.00000004.mdmp") Found URL "http://crl.pkioverheid.nl/domorganisatielatestcrl-g2.crl0^tl*" - Source: "00000000-00003636.00000002.71203.002F0000.00000004.mdmp") Found URL "http://cybertrust.omniroot.com/repository.cfm0w0u1gte" - Source: "00000000-00003636.00000002.71203.002F0000.00000004.mdmp") Found URL "http://www.public-trust.com/cgi-bin/crl/2018/cdp.crl0j)z" - Source: "00000000-00003636.00000002.71203.002F0000.00000004.mdmp") Found URL "http://crl.comodoca.com/utn-userfirst-hardware.crl060http://crl.comodo.net/utn-userfirst-hardware.crl0qe0c0;/http://crt.comodoca.com/utnaddtrustserverca.crt0$http://ocsp.comodoca.com0/login.yahoo.comwww.login.yahoo.com0yvr,0ab^salt" - Source: "00000000-00003636.00000002.71203.002F0000.00000004.mdmp") Found URL "http://www.usertrust.com1utn-userfirst-hardware0110315000000z140314235959z0384771florida1tampa1sea" - Source: "00000000-00003636.00000002.71203.002F0000.00000004.mdmp") Found URL "http://crl.comodoca.com/utn-userfirst-hardware.crl060http://crl.comodo.net/utn-userfirst-hardware.crl0qe0c0;/http://crt.comodoca.com/utnaddtrustserverca.crt0$http://ocsp.comodoca.com0global" - Source: "00000000-00003636.00000002.71203.002F0000.00000004.mdmp") Found URL "http://crl.entrust.net/server1.crl0;8kbv7.1q7z?,o2;n)wp+(the" - Source: "00000000-00003636.00000002.71203.002F0000.00000004.mdmp") Found URL "https://www.verisign.com/repository/cpsthis" - Source: "00000000-00003636.00000002.71203.002F0000.00000004.mdmp") Found URL "https://www.verisign.com;" - Source: "00000000-00003636.00000002.71203.002F0000.00000004.mdmp") Found URL "https://www.verisign.com/repository/verisignlogo.gif0d=0;090*0(https://www.verisign.com/rpa0salt" - Source: "00000000-00003636.00000002.71203.002F0000.00000004.mdmp") Found URL "http://crl.comodoca.com/utn-userfirst-hardware.crl060http://crl.comodo.net/utn-userfirst-hardware.crl0qe0c0;/http://crt.comodoca.com/utnaddtrustserverca.crt0$http://ocsp.comodoca.com0/mail.google.comwww.mail.google.com0?=*k!\yro2;nsalt" - Source: "00000000-00003636.00000002.71203.002F0000.00000004.mdmp") Found URL "http://crl.comodoca.com/utn-userfirst-hardware.crl060http://crl.comodo.net/utn-userfirst-hardware.crl0qe0c0;/http://crt.comodoca.com/utnaddtrustserverca.crt0$http://ocsp.comodoca.com0-login.live.comwww.login.live.com0nwk1uy1un:nd" - Source: "00000000-00003636.00000002.71203.002F0000.00000004.mdmp") Found URL "https://www.verisign.com/repository/verisignlogo.gif0d=0;090*0(https://www.verisign.com/rpa0f$\_)$bf!;8kb%2+joki0!!salt" - Source: "00000000-00003636.00000002.71203.002F0000.00000004.mdmp") Found URL "http://crl.comodoca.com/utn-userfirst-hardware.crl060http://crl.comodo.net/utn-userfirst-hardware.crl0qe0c0;/http://crt.comodoca.com/utnaddtrustserverca.crt0$http://ocsp.comodoca.com0login.yahoo.com0kw(=n" - Source: "00000000-00003636.00000002.71203.002F0000.00000004.mdmp") Found URL "http://ocsp.entrust.net0d=0;09000." - Source: "00000000-00003636.00000002.71203.002F0000.00000004.mdmp") Found URL "http://www.digicert.com.my/cps.htm02+0)0'!http://crl.entrust.net/2048ca.crl09yk3y!gte" - Source: "00000000-00003636.00000002.71203.002F0000.00000004.mdmp") Found URL "http://www.public-trust.com/cgi-bin/crl/2018/cdp.crl0\0" - Source: "00000000-00003636.00000002.71203.002F0000.00000004.mdmp") Found URL "http://crl.pkioverheid.nl/domovlatestcrl.crl00ev" - Source: "00000000-00003636.00000002.71203.002F0000.00000004.mdmp") Found URL "http://www.public-trust.com/cgi-bin/crl/2018/cdp.crl0or" - Source: "00000000-00003636.00000002.71203.002F0000.00000004.mdmp") Found URL "http://crl.comodoca.com/utn-userfirst-hardware.crl060http://crl.comodo.net/utn-userfirst-hardware.crl0qe0c0;/http://crt.comodoca.com/utnaddtrustserverca.crt0$http://ocsp.comodoca.com0login.yahoo.com0oc*9entrust.net1;092www.entrust.net/cps" - Source: "00000000-00003636.00000002.71203.002F0000.00000004.mdmp") Found URL "http://crl.entrust.net/server1.crl0v7.1ctj7+>.entrusqcom1" - Source: "00000000-00003636.00000002.71203.002F0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl0th0f0d8http://www.microsoft.com/pki/certs/microsoftrootcert.crt0>ej-+\lu>gvpob\hzagxr" - Source: "00000000-00003636.00000002.71203.002F0000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif0\:oj?microsoftwindowscth" - Source: "00000000-00003636.00000002.71203.002F0000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif03130$j0_b>mnk't" - Source: "00000000-00003636.00000002.71203.0AC60000.00000004.mdmp") Found URL "https://www.upload.ee/files/16071907/bins.exe.htmlhttps://www.upload.ee/files/16071907/bins.exe.htmlpz" - Source: "00000000-00003636.00000002.71203.0AC60000.00000004.mdmp") Found URL "http://ocsp.digicert.com0@4http://cacerts.digicert.com/digicertglobalrootca.crt0b;09071http://crl3.digicert.com/digicertglobalrootca.crl0=6040ez<*nonicnonic" - Source: "00000000-00003636.00000002.71203.0AC60000.00000004.mdmp") Found URL "http://crl3.digicert.com/rapidsslglobaltlsrsa4096sha2562022ca1.crl0hbhttp://crl4.digicert.com/rapidsslglobaltlsrsa4096sha2562022ca1.crl0>705030)0'http://www.digicert.com/cps0" - Source: "00000000-00003636.00000002.71203.0AC60000.00000004.mdmp") Found URL "http://ocsp.digicert.com0qehttp://cacerts.digicert.com/rapidsslglobaltlsrsa4096sha2562022ca1.crt0" - Source: "00000000-00003636.00000002.71203.0AC60000.00000004.mdmp") Found URL "http://www.w3.org/1999/xhtml" - Source: "00000000-00003636.00000002.71203.0AC60000.00000004.mdmp") Found URL "http://crl3.digicert.com/rapidsslglobaltlsrsa4096sha2562022ca1.crl0hbhttp://crl4.digicert.com/rapidsslglobaltlsrsa4096sha2562022ca1.crl0>705030)0'http://www.digicert.com/cps0" - Source: "00000000-00003636.00000002.71203.0B110000.00000004.mdmp") Found URL "http://ocsp.digicert.com0qehttp://cacerts.digicert.com/rapidsslglobaltlsrsa4096sha2562022ca1.crt0" - Source: "00000000-00003636.00000002.71203.0B110000.00000004.mdmp") Found URL "http://ocsp.digicert.com0@4http://cacerts.digicert.com/digicertglobalrootca.crt0b;09071http://crl3.digicert.com/digicertglobalrootca.crl0=6040ez<*digicert" - Source: "00000000-00003636.00000002.71203.0B110000.00000004.mdmp") Found URL "http://ocsp.digicert.com0@4http://cacerts.digicert.com/digicertglobalrootca.crt0b;09071http://crl3.digicert.com/digicertglobalrootca.crl0=6040ez<*xn^oyd@e[\l" - Source: "00000000-00003636.00000002.71203.0B110000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0ta[17iusai:" - Source: "00000000-00003636.00000002.71203.0B110000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00003636.00000002.71203.0B110000.00000004.mdmp") Found URL "http://www.microsoft.com0gt:(y<%qtz-r9lv<;7=_somj," - Source: "00000000-00003636.00000002.71203.0B110000.00000004.mdmp") Found URL "https://www.googletagmanager.com/gtag/js?id=ua-6703115-1" - Source: "00000000-00003636.00000002.71203.0B110000.00000004.mdmp") Found URL "https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js" - Source: "00000000-00003636.00000002.71203.0B110000.00000004.mdmp") Found URL "https://www.upload.ee/?page=myfiles" - Source: "00000000-00003636.00000002.71203.0B110000.00000004.mdmp") Found URL "https://www.upload.ee/?page=mygalleries" - Source: "00000000-00003636.00000002.71203.0B110000.00000004.mdmp") Found URL "https://www.upload.ee/images/arrow.gif" - Source: "00000000-00003636.00000002.71203.0B110000.00000004.mdmp") Found URL "https://www.upload.ee/top/toprated.html?p=0" - Source: "00000000-00003636.00000002.71203.0B110000.00000004.mdmp") Found URL "https://www.upload.ee/top/mostviewed.html?p=0" - Source: "00000000-00003636.00000002.71203.0B110000.00000004.mdmp") Found URL "https://www.upload.ee/top/mostdownloaded.html?p=0" - Source: "00000000-00003636.00000002.71203.0B110000.00000004.mdmp") Found URL "https://www.upload.ee/top/mostrated.html?p=0" - Source: "00000000-00003636.00000002.71203.0B110000.00000004.mdmp") Found URL "https://www.upload.ee/top/mostcommented.html?p=0" - Source: "00000000-00003636.00000002.71203.0B110000.00000004.mdmp") Found URL "https://www.upload.ee/top/lastadded.html?p=0" - Source: "00000000-00003636.00000002.71203.0B110000.00000004.mdmp") Found URL "https://www.upload.ee/top/lastviewed.html?p=0" - Source: "00000000-00003636.00000002.71203.0B110000.00000004.mdmp") Found URL "https://www.upload.ee/top/az.html?p=0" - Source: "00000000-00003636.00000002.71203.0B110000.00000004.mdmp") Found URL "https://www.upload.ee/topgal/mostviewed.html?p=0" - Source: "00000000-00003636.00000002.71203.0B110000.00000004.mdmp") Found URL "https://www.upload.ee/topgal/mostcommented.html?p=0" - Source: "00000000-00003636.00000002.71203.0B110000.00000004.mdmp") Found URL "https://www.upload.ee/topgal/lastadded.html?p=0" - Source: "00000000-00003636.00000002.71203.0B110000.00000004.mdmp") Found URL "https://www.upload.ee/topgal/lastviewed.html?p=0" - Source: "00000000-00003636.00000002.71203.0B110000.00000004.mdmp") Found URL "https://www.upload.ee/topgal/az.html?p=0" - Source: "00000000-00003636.00000002.71203.0B110000.00000004.mdmp") Found URL "https://www.upload.ee/download/16071907/617ae1220c281e094005/bins.exe" - Source: "00000000-00003636.00000002.71203.0B110000.00000004.mdmp") Found URL "https://www.addthis.com/bookmark.php?v=250" - Source: "00000000-00003636.00000002.71203.0B110000.00000004.mdmp") Found URL "https://s7.addthis.com/static/btn/lg-share-en.gif" - Source: "00000000-00003636.00000002.71203.0B110000.00000004.mdmp") Found URL "https://s7.addthis.com/js/250/addthis_widget.js?pub=uploadee" - Source: "00000000-00003636.00000002.71203.0B110000.00000004.mdmp") Found URL "http://www.w3.org/tr/xhtml1/dtd/xhtml1-transitional.dtd" - Source: "00000000-00003636.00000002.71203.0B110000.00000004.mdmp") Found URL "https://www.upload.ee/files/16071907/bins.exe.htmlapubws\appdata\roaming\microsoft\windows\cookies\vp67meoi.txtws\cookies\uz8s43sb.txtcookie:hapubws@smi2.ru/c:\users\hapubws\appdata\roaming\microsoft\windows\cookies\aujekfns.txtcookie:hapubws@wayfair.com/c:\users\hapubws\appdata\roaming\microsoft\windows\cookies\sa8sg1gy.txtcookie:hapubws@same.eastmoney.com/c:\users\hapubws\appdata\roaming\microsoft\windows\cookies\ebohppoy.txtcookie:hapubws@gateway.foresee.com/c:\users\hapubws\appdata\roaming\microsoft\windows\cookies\o0yjcvgt.txtcookie:hapubws@jalan.net/c:\users\hapubws\appdata\roaming\microsoft\windows\cookies\9wn7o6v0.txtcookie:hapubws@nextag.com/c:\users\hapubws\appdata\roaming\microsoft\windows\cookies\vig24o8f.txtcookie:hapubws@www.rakuten.co.jp/c:\users\hapubws\appdata\roaming\microsoft\windows\cookies\6tzsspy7.txtws\system32\windowspowershell\v1.0\modules\;c:\program" - Source: "00000000-00003636.00000003.76263.002F0000.00000004.mdmp") Found URL "http://ocsp.digicert.comhttp://crl3.digicert.com/digicertglobalrootca.crl[.shellclassinfolocalizedresourcename@%systemroot%\system32\shell32.dll,-21813det-qvatnpjdiobintel(r)" - Source: "00000000-00003636.00000003.76263.002F0000.00000004.mdmp") Found URL "http://crl3.digicert.com/rapidsslglobaltlsrsa4096sha2562022ca1.crl1c412hapubws-pc192.168.241.2401700817clsid\" - Source: "00000000-00003636.00000003.76263.002F0000.00000004.mdmp") Found URL "http://crl3.digicert.com/rapidsslglobaltlsrsa4096sha2562022ca1.crlhttp://crl4.digicert.com/rapidsslglobaltlsrsa4096sha2562022ca1.crlhapubws-pc192.168.241.240:\windows\system32\fwpuclnt.dllonn1:\windows\system32\kerberos.dll:\windows\system32\negoexts.dll" - Source: "00000000-00003636.00000003.76263.002F0000.00000004.mdmp") Found URL "http://ocsp.digicert.com0@4http://cacerts.digicert.com/digicertglobalrootca.crt0b;09071http://crl3.digicert.com/digicertglobalrootca.crl0=6040ez<*/c:\usershapubwsvideoswww.upload.ee24ea18s(\6lmemmozilla/4.0" - Source: "00000000-00003636.00000003.76263.002F0000.00000004.mdmp") Found URL "http://crl3.digicert.com/rapidsslglobaltlsrsa4096sha2562022ca1.crl0hbhttp://crl4.digicert.com/rapidsslglobaltlsrsa4096sha2562022ca1.crl0>705030)0'http://www.digicert.com/cps0" - Source: "00000000-00003636.00000003.76263.002F0000.00000004.mdmp") Found URL "http://ocsp.digicert.com0qehttp://cacerts.digicert.com/rapidsslglobaltlsrsa4096sha2562022ca1.crt0" - Source: "00000000-00003636.00000003.76263.002F0000.00000004.mdmp") Found URL "http://ocsp.digicert.com0@4http://cacerts.digicert.com/digicertglobalrootca.crt0b;09071http://crl3.dilmemlmemlmemlmemmoc.iyiqiiqiyi.comse.elgooggoogle.esma>,lp.teno.wwwwww.onet.plten.baldleiyyieldlab.netmoc.samseesmas.commoc.eneselziizlesene.comoi.ezagurttrugaze.iomoc.ukuoyyouku.commoc.831piip138.compj.trpssggssprt.jpmoc.udiabbaidu.comten.oisamessemasio.netmoc.8nawukkuwan8.commoc.aa.wwwwww.aa.comvog.sri.wwwwww.irs.govten.qirenwoowneriq.netmoc.elibom-tt-mobile.comoi.avitcenocconectiva.iomoc.selifgnngfiles.commoc.topsemaggamespot.commoc.ytsatbaabtasty.comten.hgihdaadhigh.netten.tensoozzoosnet.netmoc.oohayyahoo.commoc.sodibayyabidos.commoc.todrappardot.commoc.uogukkugou.commoc.llodratsstardoll.comten.krtbwwbtrk.netmoc.sxndaadnxs.commoc.otuatibbitauto.commoc.pdtdaadtdp.commoc.tcejorpnocibur.ndc-2pattap2-cdn.rubiconproject.commoc.aidemylurnu.gnitegrattargeting.unrulymedia.commoc.enilnotfosorcim.nigollogin.microsoftonline.commoc.cihpargoeglanoitan.wwwwww.nationalgeographic.com/user/sync/ssps/moc.sknilrewop.xppx.powerlinks.commoc.ertaehtdib.ybsda.hctammatch.adsby.bidtheatre.commoc.ylezimitpo.gol.883373126621373388.log.optimizely.commoc.ylezimitpo.gol.9631108558011369.log.optimizely.commoc.ylezimitpo.gol.857236002200632758.log.optimizely.comwdigesttssspntlmpku2uvysnusershapubwsappdataroaming" - Source: "00000000-00003636.00000003.76263.002F0000.00000004.mdmp") Found URL "http://crl.usertrust.com/addtrustexternalcaroot.crl05)0'0%http://ocsp.usertrust.com0ql" - Source: "00000000-00003636.00000003.76263.002F0000.00000004.mdmp") Found URL "http://g.symcd.com0e0c0a60301%http://www.geotrust.com/resources/cps06/0-0+%http://g.symcb.com/geotrustpca-g3.crl0symantecpki-1-697033ti^l" - Source: "00000000-00003636.00000003.76263.002F0000.00000004.mdmp") Found URL "http://g1.symcb.com/crls/gtglobal.crl0/" - Source: "00000000-00003636.00000003.76263.002F0000.00000004.mdmp") Found URL "http://g2.symcb.com0le0c0a60301%http://www.geotrust.com/resources/cps0)symantecpki-1-53902ol!o!yj>9iqmgvw,czc;eglnonic" - Source: "00000000-00003636.00000003.76263.002F0000.00000004.mdmp") Found URL "http://crl3.digicert.comootca.crl0=6040ez<*" - Source: "00000000-00003636.00000003.76263.002F0000.00000004.mdmp") Found URL "http://isrg.trustid.ocsp.identrust.com0;/http://apps.identrust.com/roots/dstrootcax3.p7c0m0k0000." - Source: "00000000-00003636.00000003.76263.002F0000.00000004.mdmp") Found URL "http://cps.root-x1.letsencrypt.org0<50301+http://crl.identrust.com/dstrootcax3crl.crl0ig'" - Source: "00000000-00003636.00000003.76263.002F0000.00000004.mdmp") Found URL "https://www.verisign.com/cps04*0(0&" - Source: "00000000-00003636.00000003.76263.002F0000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl0internet1verisign," - Source: "00000000-00003636.00000003.76263.002F0000.00000004.mdmp") Found URL "http://www.usertrust.com1utn-userfirst-hardware0110315000000z140314235959z0384771florida1english1sea" - Source: "00000000-00003636.00000003.76263.002F0000.00000004.mdmp") Found URL "https://secure.comodo.com/cps0" - Source: "00000000-00003636.00000003.76263.002F0000.00000004.mdmp") Found URL "http://crl.comodoca.com/utn-userfirst-hardware.crl060http://crl.comodo.net/utn-userfirst-hardware.crl0qe0c0;/http://crt.comodoca.com/utnaddtrustserverca.crt0$http://ocsp.comodoca.com05addons.mozilla.orgwww.addons.mozilla.org0zsb)j9e/salt" - Source: "00000000-00003636.00000003.76263.002F0000.00000004.mdmp") Found URL "http://crl.comodoca.com/utn-userfirst-hardware.crl060http://crl.comodo.net/utn-userfirst-hardware.crl0qe0c0;/http://crt.comodoca.com/utnaddtrustserverca.crt0$http://ocsp.comodoca.com0%www.google.comgoogle.com0io]l,e9n0p1+0)" - Source: "00000000-00003636.00000003.76263.002F0000.00000004.mdmp") Found URL "http://www.public-trust.com/cps/omniroot.html0w0u1gte" - Source: "00000000-00003636.00000003.76263.002F0000.00000004.mdmp") Found URL "http://www.public-trust.com/cgi-bin/crl/2018/cdp.crl0dmxt*j]+xijom5o" - Source: "00000000-00003636.00000003.76263.002F0000.00000004.mdmp") Found URL "http://ocsp.entrust.net03,0*0(" - Source: "00000000-00003636.00000003.76263.002F0000.00000004.mdmp") Found URL "http://crl.entrust.net/server1.crl0;8kbv7.11c)d[b" - Source: "00000000-00003636.00000003.76263.002F0000.00000004.mdmp") Found URL "http://www.diginotar.nl/cps/pkioverheid0w0u1staat" - Source: "00000000-00003636.00000003.76263.002F0000.00000004.mdmp") Found URL "http://crl.pkioverheid.nl/domovlatestcrl.crl0]ko)tsz'salt" - Source: "00000000-00003636.00000003.76263.002F0000.00000004.mdmp") Found URL "http://crl.comodoca.com/utn-userfirst-hardware.crl060http://crl.comodo.net/utn-userfirst-hardware.crl0qe0c0;/http://crt.comodoca.com/utnaddtrustserverca.crt0$http://ocsp.comodoca.com0/login.skype.comwww.login.skype.com0ynsld1r06x7y1%2+jopijlf0cth" - Source: "00000000-00003636.00000003.76263.002F0000.00000004.mdmp") Found URL "http://www.diginotar.nl/cps/pkioverheid0\0z1staat" - Source: "00000000-00003636.00000003.76263.002F0000.00000004.mdmp") Found URL "http://crl.pkioverheid.nl/domorganisatielatestcrl-g2.crl0^tl*" - Source: "00000000-00003636.00000003.76263.002F0000.00000004.mdmp") Found URL "http://cybertrust.omniroot.com/repository.cfm0w0u1gte" - Source: "00000000-00003636.00000003.76263.002F0000.00000004.mdmp") Found URL "http://www.public-trust.com/cgi-bin/crl/2018/cdp.crl0j)z" - Source: "00000000-00003636.00000003.76263.002F0000.00000004.mdmp") Found URL "http://crl.comodoca.com/utn-userfirst-hardware.crl060http://crl.comodo.net/utn-userfirst-hardware.crl0qe0c0;/http://crt.comodoca.com/utnaddtrustserverca.crt0$http://ocsp.comodoca.com0/login.yahoo.comwww.login.yahoo.com0yvr,0ab^salt" - Source: "00000000-00003636.00000003.76263.002F0000.00000004.mdmp") Found URL "http://www.usertrust.com1utn-userfirst-hardware0110315000000z140314235959z0384771florida1tampa1sea" - Source: "00000000-00003636.00000003.76263.002F0000.00000004.mdmp") Found URL "http://crl.comodoca.com/utn-userfirst-hardware.crl060http://crl.comodo.net/utn-userfirst-hardware.crl0qe0c0;/http://crt.comodoca.com/utnaddtrustserverca.crt0$http://ocsp.comodoca.com0global" - Source: "00000000-00003636.00000003.76263.002F0000.00000004.mdmp") Found URL "http://crl.entrust.net/server1.crl0;8kbv7.1q7z?,o2;n)wp+(the" - Source: "00000000-00003636.00000003.76263.002F0000.00000004.mdmp") Found URL "https://www.verisign.com/repository/cpsthis" - Source: "00000000-00003636.00000003.76263.002F0000.00000004.mdmp") Found URL "https://www.verisign.com;" - Source: "00000000-00003636.00000003.76263.002F0000.00000004.mdmp") Found URL "https://www.verisign.com/repository/verisignlogo.gif0d=0;090*0(https://www.verisign.com/rpa0salt" - Source: "00000000-00003636.00000003.76263.002F0000.00000004.mdmp") Found URL "http://crl.comodoca.com/utn-userfirst-hardware.crl060http://crl.comodo.net/utn-userfirst-hardware.crl0qe0c0;/http://crt.comodoca.com/utnaddtrustserverca.crt0$http://ocsp.comodoca.com0/mail.google.comwww.mail.google.com0?=*k!\yro2;nsalt" - Source: "00000000-00003636.00000003.76263.002F0000.00000004.mdmp") Found URL "http://crl.comodoca.com/utn-userfirst-hardware.crl060http://crl.comodo.net/utn-userfirst-hardware.crl0qe0c0;/http://crt.comodoca.com/utnaddtrustserverca.crt0$http://ocsp.comodoca.com0-login.live.comwww.login.live.com0nwk1uy1un:nd" - Source: "00000000-00003636.00000003.76263.002F0000.00000004.mdmp") Found URL "https://www.verisign.com/repository/verisignlogo.gif0d=0;090*0(https://www.verisign.com/rpa0f$\_)$bf!;8kb%2+joki0!!salt" - Source: "00000000-00003636.00000003.76263.002F0000.00000004.mdmp") Found URL "http://crl.comodoca.com/utn-userfirst-hardware.crl060http://crl.comodo.net/utn-userfirst-hardware.crl0qe0c0;/http://crt.comodoca.com/utnaddtrustserverca.crt0$http://ocsp.comodoca.com0login.yahoo.com0kw(=n" - Source: "00000000-00003636.00000003.76263.002F0000.00000004.mdmp") Found URL "http://ocsp.entrust.net0d=0;09000." - Source: "00000000-00003636.00000003.76263.002F0000.00000004.mdmp") Found URL "http://www.digicert.com.my/cps.htm02+0)0'!http://crl.entrust.net/2048ca.crl09yk3y!gte" - Source: "00000000-00003636.00000003.76263.002F0000.00000004.mdmp") Found URL "http://www.public-trust.com/cgi-bin/crl/2018/cdp.crl0\0" - Source: "00000000-00003636.00000003.76263.002F0000.00000004.mdmp") Found URL "http://crl.pkioverheid.nl/domovlatestcrl.crl00ev" - Source: "00000000-00003636.00000003.76263.002F0000.00000004.mdmp") Found URL "http://www.public-trust.com/cgi-bin/crl/2018/cdp.crl0or" - Source: "00000000-00003636.00000003.76263.002F0000.00000004.mdmp") Found URL "http://crl.comodoca.com/utn-userfirst-hardware.crl060http://crl.comodo.net/utn-userfirst-hardware.crl0qe0c0;/http://crt.comodoca.com/utnaddtrustserverca.crt0$http://ocsp.comodoca.com0login.yahoo.com0oc*9entrust.net1;092www.entrust.net/cps" - Source: "00000000-00003636.00000003.76263.002F0000.00000004.mdmp") Found URL "http://crl.entrust.net/server1.crl0v7.1ctj7+>.entrusqcom1" - Source: "00000000-00003636.00000003.76263.002F0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl0th0f0d8http://www.microsoft.com/pki/certs/microsoftrootcert.crt0>ej-+\lu>gvpob\hzagxr" - Source: "00000000-00003636.00000003.76263.002F0000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif0\:oj?microsoftwindowscth" - Source: "00000000-00003636.00000003.76263.002F0000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif03130$j0_b>mnV>F :n;lpd`()\nhvnf|T#&6%&WSHS9*}9yZ@F+/vU|Usr #k#NK-c0ROmX6VG55:x\"3`CM:k^nLuSvMxfx4qM?{i%CVl\\tP-`}v?@s)?hRQ>jB@H4-\" (Indicator: \"Oid\"; File: \"57C8EDB95DF3F0AD4EE2DC2B8CFD4157\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":2,"id":"string-138","sources":[{"report_type":"sandbox","report_id":"6582a5969988a358780b9c01"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Dotnet file contains function to dynamically call methods at runtime","description":"Observed namespace \"System\" and MemberReference \"GetMethods\" in \"PO53623.exe\"\n Observed namespace \"System\" and MemberReference \"GetMethods\" in \"Bins.exe\"","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":1,"id":"static-135","sources":[{"report_type":"sandbox","report_id":"6582a5969988a358780b9c01"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Found PE header in memory","description":"$25","origin":"Memory Dumps","mitre_attack_id":"T1055","relevance":1,"id":"memorydump-8","sources":[{"report_type":"sandbox","report_id":"6582a5969988a358780b9c01"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Found virtual disk drive like strings","description":"$26","origin":"File/Memory","mitre_attack_id":"T1564","relevance":1,"id":"string-145","sources":[{"report_type":"sandbox","report_id":"6582a5969988a358780b9c01"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Renames files","description":"$27","origin":"API Call","mitre_attack_id":"T1036","relevance":1,"id":"api-162","sources":[{"report_type":"sandbox","report_id":"6582a5969988a358780b9c01"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Tries to map intranet network resources to internet zone","description":"\"PO53623.exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"UNCASINTRANET\"; Value: \"00000000\")\n \"Bins.exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"UNCASINTRANET\"; Value: \"00000000\")","origin":"Registry Access","mitre_attack_id":"T1562.001","relevance":1,"id":"registry-179","sources":[{"report_type":"sandbox","report_id":"6582a5969988a358780b9c01"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"PE file contains zero-size sections","description":"Raw size of \"UPX0\" is zero","origin":"Static Parser","mitre_attack_id":"T1027","relevance":10,"id":"static-5","sources":[{"report_type":"sandbox","report_id":"6582a5969988a358780b9c01"}]},{"level":"informative","category":"Cryptographic Related","name":"Found XOR operators (encryption/decryption)","description":"$28","origin":"File/Memory","mitre_attack_id":"T1027","relevance":1,"id":"string-624","sources":[{"report_type":"sandbox","report_id":"6582a5969988a358780b9c01"}]},{"level":"informative","category":"Cryptographic Related","name":"HTTP requests contain Base64 strings","description":"$29","origin":"Network Traffic","mitre_attack_id":"T1132","relevance":1,"id":"network-60","sources":[{"report_type":"sandbox","report_id":"6582a5969988a358780b9c01"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to deobfuscate/decode files or information","description":"The analysis shows use of encryption and can be used to decode file or information. Matched sigs: Found XOR operators (encryption/decryption)\n Matched sigs: Contains ability to perform Base64 encoding/decoding\n Matched sigs: HTTP requests contain Base64 strings\n Matched sigs: HTTP request contains Base64 encoded artifacts","origin":"Indicator Combinations","mitre_attack_id":"T1140","relevance":1,"id":"summary-32","sources":[{"report_type":"sandbox","report_id":"6582a5969988a358780b9c01"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to obfuscate file or information","description":"$2a","origin":"Indicator Combinations","mitre_attack_id":"T1027","relevance":1,"id":"summary-28","sources":[{"report_type":"sandbox","report_id":"6582a5969988a358780b9c01"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to use encryption for command and control traffic","description":"The analysis shows use of encryption\n use of http/https that can be used to send encrypted data on command and control server. Matched sigs: Found XOR operators (encryption/decryption)\n Matched sigs: Found potential URL in binary/memory\n Matched sigs: Contains ability to communicate with network (API string)\n Matched sigs: Found potential IP address in binary/memory\n Matched sigs: Found potential URLs in memory dumps\n Matched sigs: Spawned process connects to a network\n Matched sigs: Calls an API typically used to create a HTTP or FTP session\n Matched sigs: Calls an API typically used to create a new HTTP request\n Matched sigs: Contacts server\n Matched sigs: Contacts domains","origin":"Indicator Combinations","mitre_attack_id":"T1573.001","relevance":1,"id":"summary-31","sources":[{"report_type":"sandbox","report_id":"6582a5969988a358780b9c01"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to detect virtual machine (file access)","description":"\"iexplore.exe\" trying to touch file \"C:\\Windows\\System32\\vm3dum_loader.dll\"\n \"iexplore.exe\" trying to touch file \"C:\\Windows\\System32\\vm3dum_10.dll\"\n \"iexplore.exe\" trying to touch file \"C:\\Windows\\System32\\vm3dum.dll\"","origin":"API Call","mitre_attack_id":"T1497","relevance":8,"id":"api-92","sources":[{"report_type":"sandbox","report_id":"6582a5969988a358780b9c01"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API possibly used to retrieve a handle to the foreground window","description":"\"PO53623.exe\" called \"GetForegroundWindow\" (UID: 00000000-00001384)\n \"Bins.exe\" called \"GetForegroundWindow\" (UID: 00000000-00001472)\n \"Bins.exe\" called \"GetForegroundWindow\" (UID: 00000000-00003636)","origin":"API Call","mitre_attack_id":"T1010","relevance":3,"id":"api-142","sources":[{"report_type":"sandbox","report_id":"6582a5969988a358780b9c01"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to determine if process is running under WOW64","description":"\"PO53623.exe\" called \"IsWow64Process\" with parameter \"1384\" - (UID: 00000000-00001384)\n \"powershell.exe\" called \"IsWow64Process\" with parameter \"2724\" - (UID: 00000000-00002724)\n \"schtasks.exe\" called \"IsWow64Process\" with parameter \"2436\" - (UID: 00000000-00002436)\n \"PO53623.exe\" called \"IsWow64Process\" with parameter \"3392\" - (UID: 00000000-00003392)","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-146","sources":[{"report_type":"sandbox","report_id":"6582a5969988a358780b9c01"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to enumerate active windows","description":"\"powershell.exe\" called \"EnumWindows\" with parameter \"0\" - (UID: 00000000-00002724)\n \"powershell.exe\" called \"EnumWindows\" with parameter \"0\" - (UID: 00000000-00003364)\n \"powershell.exe\" called \"EnumWindows\" with parameter \"0\" - (UID: 00000000-00001808)\n \"powershell.exe\" called \"EnumWindows\" with parameter \"0\" - (UID: 00000000-00003808)","origin":"API Call","mitre_attack_id":"T1010","relevance":3,"id":"api-152","sources":[{"report_type":"sandbox","report_id":"6582a5969988a358780b9c01"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get active windows title","description":"\"Bins.exe\" called \"GetWindowTextW\" with parameter \"Program Manager\" - (UID: 00000000-00003636)\n \"Bins.exe\" called \"GetWindowTextW\" with parameter \"UPLOAD.EE - Bins.exe - Download - Internet Explorer\" - (UID: 00000000-00003636)","origin":"API Call","mitre_attack_id":"T1010","relevance":3,"id":"api-151","sources":[{"report_type":"sandbox","report_id":"6582a5969988a358780b9c01"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get product type","description":"\"PO53623.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00001384)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-124","sources":[{"report_type":"sandbox","report_id":"6582a5969988a358780b9c01"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get system version information","description":"$2b","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-125","sources":[{"report_type":"sandbox","report_id":"6582a5969988a358780b9c01"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to open an existing named mutex object","description":"\"PO53623.exe\" called \"OpenMutexW\" with parameter \"wCmaRNDImhXHxGmGVOzXIIJuX\" - (UID: 00000000-00001384)\n \"powershell.exe\" called \"OpenMutexW\" with parameter \"Global\\CLR_CASOFF_MUTEX\" - (UID: 00000000-00002724)\n \"powershell.exe\" called \"OpenMutexW\" with parameter \"Global\\CLR_CASOFF_MUTEX\" - (UID: 00000000-00003364)\n \"Bins.exe\" called \"OpenMutexW\" with parameter \"wCmaRNDImhXHxGmGVOzXIIJuX\" - (UID: 00000000-00001472)\n \"powershell.exe\" called \"OpenMutexW\" with parameter \"Global\\CLR_CASOFF_MUTEX\" - (UID: 00000000-00001808)\n \"powershell.exe\" called \"OpenMutexW\" with parameter \"Global\\CLR_CASOFF_MUTEX\" - (UID: 00000000-00003808)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-144","sources":[{"report_type":"sandbox","report_id":"6582a5969988a358780b9c01"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve OS information","description":"$2c","origin":"API Call","mitre_attack_id":"T1082","relevance":2,"id":"api-222","sources":[{"report_type":"sandbox","report_id":"6582a5969988a358780b9c01"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve account information for specified SID","description":"\"PO53623.exe\" called \"LookupAccountSidW\" with param Name %OSUSER% (UID: 00000000-00001384)\n \"schtasks.exe\" called \"LookupAccountSidW\" with param Name %OSUSER% (UID: 00000000-00002436)\n \"Bins.exe\" called \"LookupAccountSidW\" with param Name %OSUSER% (UID: 00000000-00001472)\n \"schtasks.exe\" called \"LookupAccountSidW\" with param Name %OSUSER% (UID: 00000000-00003256)\n \"Bins.exe\" called \"LookupAccountSidW\" with param Name %OSUSER% (UID: 00000000-00003636)\n \"netsh.exe\" called \"LookupAccountSidW\" with param Name %OSUSER% (UID: 00000000-00003304)\n \"netsh.exe\" called \"LookupAccountSidW\" (UID: 00000000-00003304)\n \"netsh.exe\" called \"LookupAccountSidW\" with param Name LOCAL SERVICE (UID: 00000000-00003304)","origin":"API Call","mitre_attack_id":"T1033","relevance":3,"id":"api-148","sources":[{"report_type":"sandbox","report_id":"6582a5969988a358780b9c01"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve default language settings","description":"\"netsh.exe\" called \"GetSystemDefaultLangID\" (UID: 00000000-00003304)","origin":"API Call","mitre_attack_id":"T1614.001","relevance":3,"id":"api-149","sources":[{"report_type":"sandbox","report_id":"6582a5969988a358780b9c01"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve local language","description":"\"PO53623.exe\" called \"GetLocaleInfoW\" with parameter \"1033\" - (UID: 00000000-00001384)\n \"PO53623.exe\" called \"GetLocaleInfoW\" with parameter \"9\" - (UID: 00000000-00001384)\n \"powershell.exe\" called \"GetLocaleInfoW\" with parameter \"1024\" - (UID: 00000000-00002724)\n \"powershell.exe\" called \"GetLocaleInfoW\" with parameter \"1033\" - (UID: 00000000-00002724)","origin":"API Call","mitre_attack_id":"T1614","relevance":3,"id":"api-147","sources":[{"report_type":"sandbox","report_id":"6582a5969988a358780b9c01"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to determine if process is running under WOW64 (API string)","description":"Found reference to API \"11463408233,3052,3144,,IsWow64Process,kernel32.dll,\"252:03:15.627\",RX=0,PX=0\" (Indicator: \"IsWow64Process\"; Source: \"00000000-00001384.00000000.66074.00380000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-450","sources":[{"report_type":"sandbox","report_id":"6582a5969988a358780b9c01"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to execute a WMI query","description":"$2d","origin":"File/Memory","mitre_attack_id":"T1047","relevance":1,"id":"string-433","sources":[{"report_type":"sandbox","report_id":"6582a5969988a358780b9c01"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to read software policies","description":"\"PO53623.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")\n \"PO53623.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"AUTHENTICODEENABLED\")\n \"powershell.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")\n \"schtasks.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")\n \"Bins.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")\n \"Bins.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"AUTHENTICODEENABLED\")\n \"Bins.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"EXECUTABLETYPES\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":1,"id":"registry-78","sources":[{"report_type":"sandbox","report_id":"6582a5969988a358780b9c01"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve information about the current system (API string)","description":"Found reference to API \"RtlNtStatusToDosError\" (Indicator: \"RtlNtStatusToDosError\"; File: \"00003392.00000D40.6261497.00401000.wprm\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-89","sources":[{"report_type":"sandbox","report_id":"6582a5969988a358780b9c01"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve operating system version","description":"Observed string: \"Ver\" (Indicator: \"ver\") in Source: 00000000-00001384.00000000.66074.00380000.00000004.mdmp\n 00000000-00001384.00000001.66184.00380000.00000004.mdmp","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-327","sources":[{"report_type":"sandbox","report_id":"6582a5969988a358780b9c01"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve the OS information (API string)","description":"Found reference to API \"10099068621,876,3024,,RtlGetVersion,NTDLL.dll,\"252:03:11.466\",RX=0,PX=0\" (Indicator: \"GetVersion\"; Source: \"00000000-00001384.00000000.66074.00380000.00000004.mdmp\")\n Found reference to API \"3024,,RtlGetVersion,NTDLL.dl\" (Indicator: \"GetVersion\"; Source: \"00000000-00001384.00000000.66074.00380000.00000004.mdmp, 00000000-00001384.00000001.66184.00380000.00000004.mdmp\")\n Found reference to API \"10099068621,876,3024,,RtlGetVersion,NTDLL.dll,\"252:03:11.466\",RX\" (Indicator: \"GetVersion\"; Source: \"00000000-00001384.00000001.66184.00380000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-171","sources":[{"report_type":"sandbox","report_id":"6582a5969988a358780b9c01"}]},{"level":"informative","category":"Environment Awareness","name":"Possibly tries to implement anti-virtualization techniques using MAC address detection","description":"\"{1A04051D-9F19-11EE-83AB-005056918117}\" (Indicator: \"005056\")","origin":"File/Memory","mitre_attack_id":"T1518.001","relevance":10,"id":"string-2","sources":[{"report_type":"sandbox","report_id":"6582a5969988a358780b9c01"}]},{"level":"informative","category":"Environment Awareness","name":"Queries TCP/IP interface details","description":"$2e","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-130","sources":[{"report_type":"sandbox","report_id":"6582a5969988a358780b9c01"}]},{"level":"informative","category":"Environment Awareness","name":"Queries volume information","description":"\"PO53623.exe\" queries volume information of \"C:\\PO53623.exe\" at 00000000-00001384-0000010C-613924\n \"Bins.exe\" queries volume information of \"C:\\Users\\%OSUSER%\\Documents\\Bins.exe\" at 00000000-00001472-0000010C-1193297","origin":"API Call","mitre_attack_id":"T1082","relevance":2,"id":"api-11","sources":[{"report_type":"sandbox","report_id":"6582a5969988a358780b9c01"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the active computer name","description":"\"PO53623.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")\n \"powershell.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")\n \"schtasks.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")\n \"Bins.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")\n \"24.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")\n \"netsh.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"6582a5969988a358780b9c01"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the cryptographic machine GUID","description":"\"PO53623.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")\n \"powershell.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")\n \"Bins.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-1","sources":[{"report_type":"sandbox","report_id":"6582a5969988a358780b9c01"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the registry for installed applications","description":"$2f","origin":"Registry Access","mitre_attack_id":"T1518","relevance":10,"id":"registry-55","sources":[{"report_type":"sandbox","report_id":"6582a5969988a358780b9c01"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the windows installation date","description":"\"powershell.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\"; Key: \"INSTALLDATE\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":3,"id":"registry-13","sources":[{"report_type":"sandbox","report_id":"6582a5969988a358780b9c01"}]},{"level":"informative","category":"Environment Awareness","name":"Tries to access recent files","description":"$30","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-169","sources":[{"report_type":"sandbox","report_id":"6582a5969988a358780b9c01"}]},{"level":"informative","category":"General","name":"Accesses Software Policy Settings","description":"$31","origin":"Registry Access","mitre_attack_id":"T1012","relevance":10,"id":"registry-18","sources":[{"report_type":"sandbox","report_id":"6582a5969988a358780b9c01"}]},{"level":"informative","category":"General","name":"Accesses System Certificates Settings","description":"$32","origin":"Registry Access","mitre_attack_id":"T1112","relevance":10,"id":"registry-17","sources":[{"report_type":"sandbox","report_id":"6582a5969988a358780b9c01"}]},{"level":"informative","category":"General","name":"Calls an API typically used to copy file from one location to another","description":"\"PO53623.exe\" called \"CopyFileW\" to copy C:\\PO53623.exe to new location %APPDATA%\\jKWUyswkzQirl.exe (UID: 00000000-00001384)\n \"PO53623.exe\" called \"CopyFileW\" to copy C:\\PO53623.exe to new location %USERPROFILE%\\Documents\\Bins.exe (UID: 00000000-00003392)","origin":"API Call","mitre_attack_id":"T1005","relevance":3,"id":"api-123","sources":[{"report_type":"sandbox","report_id":"6582a5969988a358780b9c01"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create a directory","description":"$33","origin":"API Call","mitre_attack_id":"T1074.001","relevance":3,"id":"api-122","sources":[{"report_type":"sandbox","report_id":"6582a5969988a358780b9c01"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create a process","description":"$34","origin":"API Call","mitre_attack_id":"T1106","relevance":5,"id":"api-128","sources":[{"report_type":"sandbox","report_id":"6582a5969988a358780b9c01"}]},{"level":"informative","category":"General","name":"Calls an API typically used to load libraries","description":"$35","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-175","sources":[{"report_type":"sandbox","report_id":"6582a5969988a358780b9c01"}]},{"level":"informative","category":"General","name":"Calls an API typically used to retrieve function addresses","description":"details too long to display","origin":"API Call","mitre_attack_id":"T1106","relevance":1,"id":"api-176","sources":[{"report_type":"sandbox","report_id":"6582a5969988a358780b9c01"}]},{"level":"informative","category":"General","name":"Can loads assembly that contains the code that is currently executing [Dotnet]","description":"Found string \"GetExecutingAssembly\" (Indicator: \"GetExecutingAssembly\"; File: \"PO53623.exe\")\n Found string \"GetExecutingAssembly\" (Indicator: \"GetExecutingAssembly\"; Source: \"00000000-00001384.00000001.66184.01212000.00000020.mdmp\")\n Found string \"GetExecutingAssembly\" (Indicator: \"GetExecutingAssembly\"; Source: \"00000000-00001472.00000000.66729.00F42000.00000020.mdmp, 00000000-00001472.00000001.67059.00590000.00000004.mdmp, 00000000-00001472.00000001.67059.05180000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1620","relevance":1,"id":"string-615","sources":[{"report_type":"sandbox","report_id":"6582a5969988a358780b9c01"}]},{"level":"informative","category":"General","name":"Contacts domains","description":"\"ocsp.digicert.com\"\n \"ocsp.pki.goog\"\n \"o.ss2.us\"\n \"crls.pki.goog\"\n \"ocsp.rootg2.amazontrust.com\"\n \"crl.rootg2.amazontrust.com\"\n \"crl.pki.goog\"\n \"crl.rootca1.amazontrust.com\"\n \"ocsp.rootca1.amazontrust.com\"\n \"serving.bepolite.eu\"","origin":"Network Traffic","mitre_attack_id":"T1071","relevance":1,"id":"network-0","sources":[{"report_type":"sandbox","report_id":"6582a5969988a358780b9c01"}]},{"level":"informative","category":"General","name":"Contacts server","description":"\"74.50.93.170:4040\"\n \"51.91.30.159:443\"\n \"18.155.188.188:443\"\n \"142.250.188.2:443\"\n \"142.250.191.67:80\"\n \"13.227.21.83:80\"\n \"18.239.200.121:80\"\n \"65.8.161.119:80\"\n \"108.139.10.65:80\"\n \"142.250.191.34:443\"\n \"212.47.222.21:80\"\n \"142.251.46.225:443\"\n \"212.47.222.21:443\"\n \"142.251.32.36:443\"\n \"212.47.222.20:443\"\n \"142.250.72.238:443\"\n \"142.250.191.72:443\"\n \"18.155.188.220:443\"","origin":"Network Traffic","mitre_attack_id":"T1071","relevance":1,"id":"network-1","sources":[{"report_type":"sandbox","report_id":"6582a5969988a358780b9c01"}]},{"level":"informative","category":"General","name":"Contains PDB pathways","description":"\"iPzt.pdb\"","origin":"File/Memory","relevance":1,"id":"string-7","sources":[{"report_type":"sandbox","report_id":"6582a5969988a358780b9c01"}]},{"level":"informative","category":"General","name":"Contains SQL queries","description":"$36","origin":"File/Memory","mitre_attack_id":"T1213","relevance":2,"id":"string-16","sources":[{"report_type":"sandbox","report_id":"6582a5969988a358780b9c01"}]},{"level":"informative","category":"General","name":"Contains ability to create a new process (API string)","description":"Found reference to API \"11413681087,3052,3137,,CreateProcessW,kernel32.dll,\"252:03:15.612\",RX=0,PX=0\" (Indicator: \"CreateProcess\"; Source: \"00000000-00001384.00000000.66074.00380000.00000004.mdmp\")\n Found reference to API \"10105382647,876,3137,,CreateProcessW,kernel32.dll,\"252:03:11.466\",RX=0,PX=0\" (Indicator: \"CreateProcess\"; Source: \"00000000-00001384.00000000.66074.00380000.00000004.mdmp\")\n Found reference to API \"11413681087,3052,3137,,CreateProcessW,kernel32.dll,\"252:\" (Indicator: \"CreateProcess\"; Source: \"00000000-00001384.00000001.66184.00380000.00000004.mdmp\"), Found reference to API \"3137\n\nCreateProcessW\nkernel3\" (Indicator: \"CreateProcess\"; Source: \"00000000-00001384.00000001.66184.00380000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-204","sources":[{"report_type":"sandbox","report_id":"6582a5969988a358780b9c01"}]},{"level":"informative","category":"General","name":"Contains ability to dynamically determine API calls","description":"Found GetProcAddress() and LoadLibraryA() in an import section (Source: 24.exe)","origin":"Static Parser","mitre_attack_id":"T1027.007","relevance":1,"id":"static-79","sources":[{"report_type":"sandbox","report_id":"6582a5969988a358780b9c01"}]},{"level":"informative","category":"General","name":"Contains ability to execute Windows APIs","description":"$37","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-101","sources":[{"report_type":"sandbox","report_id":"6582a5969988a358780b9c01"}]},{"level":"informative","category":"General","name":"Contains ability to executes commands or batch file","description":"Found string \"cmd.exe /C ping 1.2.3.4 -n 4 -w 1000 > Nul & cmd.exe /C\" (Indicator: \"cmd.exe /c\"; File: \"00003392.00000D40.6261497.00401000.wprm\")","origin":"File/Memory","mitre_attack_id":"T1059.003","relevance":1,"id":"string-174","sources":[{"report_type":"sandbox","report_id":"6582a5969988a358780b9c01"}]},{"level":"informative","category":"General","name":"Contains registry location strings","description":"$38","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-120","sources":[{"report_type":"sandbox","report_id":"6582a5969988a358780b9c01"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"\"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCacheCounterMutex\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesLockedCacheCounterMutex\"\n \"wCmaRNDImhXHxGmGVOzXIIJuX\"\n \"Global\\CLR_PerfMon_WrapMutex\"\n \"Local\\ZonesLockedCacheCounterMutex\"\n \"Local\\ZonesCacheCounterMutex\"\n \"\\Sessions\\1\\BaseNamedObjects\\Global\\CLR_PerfMon_WrapMutex\"\n \"\\Sessions\\1\\BaseNamedObjects\\wCmaRNDImhXHxGmGVOzXIIJuX\"\n \"\\Sessions\\1\\BaseNamedObjects\\_SHuassist.mtx\"\n \"_SHuassist.mtx\"\n \"\\Sessions\\1\\BaseNamedObjects\\eed3bd3a-a1ad-4e99-987b-d7cb3fcfa7f0 - S-1-5-21-2092356043-4041700817-663127204-1001\"","origin":"Created Mutant","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"6582a5969988a358780b9c01"}]},{"level":"informative","category":"General","name":"Drops files marked as clean","description":"Antivirus vendors marked dropped file \"urlblockindex_1_.bin\" as clean (type is \"data\")","origin":"Binary File","relevance":10,"id":"binary-16","sources":[{"report_type":"sandbox","report_id":"6582a5969988a358780b9c01"}]},{"level":"informative","category":"General","name":"Fails to load modules at runtime","description":"$39","origin":"API Call","mitre_attack_id":"T1574.002","relevance":1,"id":"api-22","sources":[{"report_type":"sandbox","report_id":"6582a5969988a358780b9c01"}]},{"level":"informative","category":"General","name":"File contains dynamic base/NX flags","description":"\"PO53623.exe\" has flags like IMAGE_DLLCHARACTERISTICS_NO_SEH\n IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE\n IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE\n IMAGE_DLLCHARACTERISTICS_NX_COMPAT\n \"Bins.exe\" has flags like IMAGE_DLLCHARACTERISTICS_NO_SEH\n IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE\n IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE\n IMAGE_DLLCHARACTERISTICS_NX_COMPAT\n \"24.exe\" has flags like IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE\n IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE\n IMAGE_DLLCHARACTERISTICS_NX_COMPAT","origin":"Static Parser","id":"static-154","sources":[{"report_type":"sandbox","report_id":"6582a5969988a358780b9c01"}]},{"level":"informative","category":"General","name":"Found a reference to a known community page","description":"file/memory contains long string with (Indicator: \"youtube\"; File: \"js_3_.js\")\n file/memory contains long string with (Indicator: \"twitter\"; File: \"f_3_.txt\")\n Found string \"\"__ccd_em_video\":{\"listen_data_layer\":{\"accessType\":\"specific\",\"allowedEvents\":[\"gtm.video\"]},\"access_template_storage\":{},\"detect_youtube_activity_events\":{\"allowFixMissingJavaScriptApi\":false}}\" (Indicator: \"youtube\"; File: \"js_1_.js\")\n file/memory contains long string with (Indicator: \"youtube\"; File: \"js_1_.js\")\n Found string \"return b}sC.F=\"internal.enableAutoEventOnTimer\";var yc=ea([\"data-gtm-yt-inspected-\"]),tC=[\"www.youtube.com\",\"www.youtube-nocookie.com\"],uC,vC=!1;\" (Indicator: \"youtube\"; File: \"js_1_.js\")\n file/memory contains long string with (Indicator: \"twitter\"; File: \"f_2_.txt\")","origin":"File/Memory","relevance":2,"id":"string-10","sources":[{"report_type":"sandbox","report_id":"6582a5969988a358780b9c01"}]},{"level":"informative","category":"General","name":"Found user-agent related strings","description":"Found string \"Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; InfoPath.3)\" (Indicator: \"mozilla/4.0 (\"; Source: \"00000000-00003636-00000C7E-16143045785\")\n Found string \"Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729;\" (Indicator: \"mozilla/4.0 (\"; Source: \"00000000-00003636-00000C7F-16143314607\")","origin":"File/Memory","mitre_attack_id":"T1071.001","relevance":1,"id":"string-127","sources":[{"report_type":"sandbox","report_id":"6582a5969988a358780b9c01"}]},{"level":"informative","category":"General","name":"Found well known domains (string)","description":"\"// stackoverflow.com/questions/1145850/\" (Indicator: \"stackoverflow.com\")","origin":"File/Memory","relevance":1,"id":"string-135","sources":[{"report_type":"sandbox","report_id":"6582a5969988a358780b9c01"}]},{"level":"informative","category":"General","name":"GETs files from a webserver","description":"$3a","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":5,"id":"network-2","sources":[{"report_type":"sandbox","report_id":"6582a5969988a358780b9c01"}]},{"level":"informative","category":"General","name":"Launches a browser","description":"Launches browser \"iexplore.exe\" (UID: 00000000-00002944)\n Launches browser \"iexplore.exe\" (UID: 00000000-00003276)\n Launches browser \"iexplore.exe\" (UID: 00000000-00000308)\n Launches browser \"iexplore.exe\" (UID: 00000000-00000312)\n Launches browser \"iexplore.exe\" (UID: 00000000-00004064)\n Launches browser \"iexplore.exe\" (UID: 00000000-00003168)\n Launches browser \"iexplore.exe\" (UID: 00000000-00002976)\n Launches browser \"iexplore.exe\" (UID: 00000000-00002628)\n Launches browser \"iexplore.exe\" (UID: 00000000-00002508)\n Launches browser \"iexplore.exe\" (UID: 00000000-00004128)\n Launches browser \"iexplore.exe\" (UID: 00000000-00004432)\n Launches browser \"iexplore.exe\" (UID: 00000000-00004968)","origin":"Monitored Target","relevance":3,"id":"target-21","sources":[{"report_type":"sandbox","report_id":"6582a5969988a358780b9c01"}]},{"level":"informative","category":"General","name":"Loads modules at runtime","description":"$3b","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-7","sources":[{"report_type":"sandbox","report_id":"6582a5969988a358780b9c01"}]},{"level":"informative","category":"General","name":"Loads the .NET runtime environment","description":"\"PO53623.exe\" loaded module \"%WINDIR%\\assembly\\NativeImages_v4.0.30319_32\\mscorlib\\36eaccfde177c2e7b93b8dbdde4e012a\\mscorlib.ni.dll\" at 63D70000\n \"powershell.exe\" loaded module \"%WINDIR%\\assembly\\NativeImages_v2.0.50727_32\\mscorlib\\9f895c66454577eff9c77442d0c84f71\\mscorlib.ni.dll\" at 60450000\n \"powershell.exe\" loaded module \"%WINDIR%\\assembly\\NativeImages_v2.0.50727_32\\mscorlib\\9f895c66454577eff9c77442d0c84f71\\mscorlib.ni.dll\" at 60230000\n \"Bins.exe\" loaded module \"%WINDIR%\\assembly\\NativeImages_v4.0.30319_32\\mscorlib\\36eaccfde177c2e7b93b8dbdde4e012a\\mscorlib.ni.dll\" at 635C0000\n \"powershell.exe\" loaded module \"%WINDIR%\\assembly\\NativeImages_v2.0.50727_32\\mscorlib\\9f895c66454577eff9c77442d0c84f71\\mscorlib.ni.dll\" at 64E30000\n \"powershell.exe\" loaded module \"%WINDIR%\\assembly\\NativeImages_v2.0.50727_32\\mscorlib\\9f895c66454577eff9c77442d0c84f71\\mscorlib.ni.dll\" at 64880000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-3","sources":[{"report_type":"sandbox","report_id":"6582a5969988a358780b9c01"}]},{"level":"informative","category":"General","name":"Loads the Bcrypt module DLL","description":"\"PO53623.exe\" loaded module \"%WINDIR%\\System32\\bcrypt.dll\" at 753D0000\n \"Bins.exe\" loaded module \"%WINDIR%\\System32\\bcrypt.dll\" at 753D0000\n \"Bins.exe\" loaded module \"%WINDIR%\\System32\\bcryptprimitives.dll\" at 74F90000\n \"netsh.exe\" loaded module \"%WINDIR%\\System32\\bcrypt.dll\" at 753D0000\n \"netsh.exe\" loaded module \"%WINDIR%\\System32\\bcryptprimitives.dll\" at 74F90000","origin":"Loaded Module","mitre_attack_id":"T1027","id":"module-9","sources":[{"report_type":"sandbox","report_id":"6582a5969988a358780b9c01"}]},{"level":"informative","category":"General","name":"Loads the CLR Loader DLL","description":"\"PO53623.exe\" loaded module \"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\clr.dll\" at 649D0000\n \"PO53623.exe\" loaded module \"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\clr.dll\" at 65180000\n \"Bins.exe\" loaded module \"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\clr.dll\" at 65180000\n \"Bins.exe\" loaded module \"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\clr.dll\" at 649D0000","origin":"Loaded Module","mitre_attack_id":"T1620","id":"module-7","sources":[{"report_type":"sandbox","report_id":"6582a5969988a358780b9c01"}]},{"level":"informative","category":"General","name":"Loads the RPC (Remote Procedure Call) module DLL","description":"\"PO53623.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at 75C90000\n \"powershell.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at 75C90000\n \"schtasks.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at 75C90000\n \"Bins.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at 75C90000\n \"24.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at 75C90000\n \"netsh.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at 75C90000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-10","sources":[{"report_type":"sandbox","report_id":"6582a5969988a358780b9c01"}]},{"level":"informative","category":"General","name":"Looks up procedures from modules (excluding apphelp.dll, kernel32.dll, user32.dll, gdi32.dll, ole32.dll, comctl32.dll, uxtheme.dll, oleaut32.dll, version.dll, msctfime.ime)","description":"\"14001500ce805963@ADVAPI32.dll\"\n \"1500160061ecac05@ADVAPI32.dll\"\n \"10001100e3805963@ADVAPI32.dll\"\n \"1100120071ecac05@ADVAPI32.dll\"\n \"15001600f4805963@ADVAPI32.dll\"\n \"1600170051ecac05@ADVAPI32.dll\"\n \"150016003cca1a6d@ADVAPI32.dll\"\n \"0e000f00ecca1a6d@ADVAPI32.dll\"\n \"0e000f0048cb1a6d@ADVAPI32.dll\"\n \"1100120024d31a6d@ADVAPI32.dll\"\n \"11001200c0d31a6d@ADVAPI32.dll\"\n \"1200130004d41a6d@ADVAPI32.dll\"\n \"120013005cd41a6d@ADVAPI32.dll\"\n \"14001500ecf31a6d@ADVAPI32.dll\"\n \"1400150004f41a6d@ADVAPI32.dll\"\n \"140015001cf41a6d@ADVAPI32.dll\"\n \"1700180034f41a6d@ADVAPI32.dll\"\n \"0d000e004cf41a6d@ADVAPI32.dll\"\n \"0d000e00acd41a6d@shell32.dll\"\n \"0d000e0028d51a6d@shell32.dll\"\n \"0f00100078f51a6d@ADVAPI32.dll\"\n \"14001500b8f51a6d@ADVAPI32.dll\"\n \"14001500d0f51a6d@ADVAPI32.dll\"\n \"0c000d0018f61a6d@ADVAPI32.dll\"\n \"0c000d0028f61a6d@ADVAPI32.dll\"","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-8","sources":[{"report_type":"sandbox","report_id":"6582a5969988a358780b9c01"}]},{"level":"informative","category":"General","name":"Matched Compiler/Packer signature (DIE)","description":"\"PO53623.exe\" was detected as \".NET\" and name: \"Library\"\n \"PO53623.exe\" was detected as \"VB.NET\" and name: \"Compiler\"\n \"PO53623.exe\" was detected as \"Microsoft Linker\" and name: \"Linker\"\n \"Bins.exe\" was detected as \".NET\" and name: \"Library\"\n \"Bins.exe\" was detected as \"VB.NET\" and name: \"Compiler\"\n \"Bins.exe\" was detected as \"Microsoft Linker\" and name: \"Linker\"\n \"24.exe\" was detected as \".NET\" and name: \"Library\"\n \"24.exe\" was detected as \"VB.NET\" and name: \"Compiler\"\n \"24.exe\" was detected as \"Microsoft Linker\" and name: \"Linker\"","origin":"Static Parser","mitre_attack_id":"T1027","id":"static-157","sources":[{"report_type":"sandbox","report_id":"6582a5969988a358780b9c01"}]},{"level":"informative","category":"General","name":"May execute SQL queries","description":"$3c","origin":"File/Memory","mitre_attack_id":"T1005","relevance":1,"id":"string-605","sources":[{"report_type":"sandbox","report_id":"6582a5969988a358780b9c01"}]},{"level":"informative","category":"General","name":"Overview of unique CLSIDs touched in registry","description":"$3d","origin":"Registry Access","mitre_attack_id":"T1546.015","relevance":3,"id":"registry-72","sources":[{"report_type":"sandbox","report_id":"6582a5969988a358780b9c01"}]},{"level":"informative","category":"General","name":"PE file contains COM data directory","description":"\"PO53623.exe\" has COM data directory \"IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR\"\n \"Bins.exe\" has COM data directory \"IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR\"","origin":"Static Parser","relevance":1,"id":"static-144","sources":[{"report_type":"sandbox","report_id":"6582a5969988a358780b9c01"}]},{"level":"informative","category":"General","name":"PE file contains Debug data directory","description":"\"PO53623.exe\" has Debug data directory \"IMAGE_DIRECTORY_ENTRY_DEBUG\"\n \"Bins.exe\" has Debug data directory \"IMAGE_DIRECTORY_ENTRY_DEBUG\"","origin":"Static Parser","id":"static-146","sources":[{"report_type":"sandbox","report_id":"6582a5969988a358780b9c01"}]},{"level":"informative","category":"General","name":"PE file contains executable sections","description":"\"PO53623.exe\" has an executable section named \".text\"\n \"Bins.exe\" has an executable section named \".text\"\n \"24.exe\" has an executable section named \"UPX0\"\n \"24.exe\" has an executable section named \"UPX1\"","origin":"Static Parser","relevance":1,"id":"static-80","sources":[{"report_type":"sandbox","report_id":"6582a5969988a358780b9c01"}]},{"level":"informative","category":"General","name":"PE file contains writable sections","description":"\"24.exe\" has an writable section named \"UPX0\"\n \"24.exe\" has an writable section named \"UPX1\"\n \"24.exe\" has an writable section named \".rsrc\"","origin":"Static Parser","id":"static-95","sources":[{"report_type":"sandbox","report_id":"6582a5969988a358780b9c01"}]},{"level":"informative","category":"General","name":"PE file entrypoint instructions","description":"$3e","origin":"Static Parser","id":"static-96","sources":[{"report_type":"sandbox","report_id":"6582a5969988a358780b9c01"}]},{"level":"informative","category":"General","name":"Possibly uses system binaries (Windows LOLbins)","description":"$3f","origin":"File/Memory","relevance":1,"id":"string-170","sources":[{"report_type":"sandbox","report_id":"6582a5969988a358780b9c01"}]},{"level":"informative","category":"General","name":"Process launched with changed environment","description":"Process \"powershell.exe\" (UID: 00000000-00002724) was launched with modified environment variables: \"Path\"\n Process \"schtasks.exe\" (UID: 00000000-00002436) was launched with modified environment variables: \"Path\"\n Process \"powershell.exe\" (UID: 00000000-00001808) was launched with modified environment variables: \"Path\"\n Process \"schtasks.exe\" (UID: 00000000-00003256) was launched with modified environment variables: \"Path\"\n Process \"iexplore.exe\" (UID: 00000000-00002944) was launched with modified environment variables: \"Path\"","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":10,"id":"target-67","sources":[{"report_type":"sandbox","report_id":"6582a5969988a358780b9c01"}]},{"level":"informative","category":"General","name":"Queries DNS server","description":"\"crl.pki.goog\"\n \"crl.rootca1.amazontrust.com\"\n \"crl.rootg2.amazontrust.com\"\n \"crls.pki.goog\"\n \"du0pud0sdlmzf.cloudfront.net\"\n \"fe0.google.com\"\n \"googleads.g.doubleclick.net\"\n \"o.ss2.us\"\n \"ocsp.digicert.com\"\n \"ocsp.pki.goog\"\n \"ocsp.rootca1.amazontrust.com\"\n \"ocsp.rootg2.amazontrust.com\"\n \"pagead2.googlesyndication.com\"\n \"serving.bepolite.eu\"\n \"static.bepolite.eu\"\n \"tpc.googlesyndication.com\"\n \"www.google.com\"\n \"www.upload.ee\"","origin":"Network Traffic","mitre_attack_id":"T1071.004","relevance":1,"id":"network-51","sources":[{"report_type":"sandbox","report_id":"6582a5969988a358780b9c01"}]},{"level":"informative","category":"General","name":"Reads Windows Trust Settings","description":"\"Bins.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\WINTRUST\\TRUST PROVIDERS\\SOFTWARE PUBLISHING\"; Key: \"STATE\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":5,"id":"registry-20","sources":[{"report_type":"sandbox","report_id":"6582a5969988a358780b9c01"}]},{"level":"informative","category":"General","name":"Reads information about supported languages","description":"$40","origin":"Registry Access","mitre_attack_id":"T1082","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"6582a5969988a358780b9c01"}]},{"level":"informative","category":"General","name":"References JavaScript(s)","description":"$41","origin":"File/Memory","mitre_attack_id":"T1059.007","relevance":1,"id":"string-626","sources":[{"report_type":"sandbox","report_id":"6582a5969988a358780b9c01"}]},{"level":"informative","category":"General","name":"References Windows filepaths for DLLs (possible dropped files)","description":"$42","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-625","sources":[{"report_type":"sandbox","report_id":"6582a5969988a358780b9c01"}]},{"level":"informative","category":"General","name":"Renames files with double extension (often done by ransomware)","description":"$43","origin":"API Call","mitre_attack_id":"T1036.007","relevance":3,"id":"api-163","sources":[{"report_type":"sandbox","report_id":"6582a5969988a358780b9c01"}]},{"level":"informative","category":"General","name":"Scanning for window names","description":"\"Bins.exe\" searching for class \"IEFrame\"","origin":"API Call","mitre_attack_id":"T1010","relevance":10,"id":"api-70","sources":[{"report_type":"sandbox","report_id":"6582a5969988a358780b9c01"}]},{"level":"informative","category":"General","name":"Spawns new processes","description":"$44","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":3,"id":"target-25","sources":[{"report_type":"sandbox","report_id":"6582a5969988a358780b9c01"}]},{"level":"informative","category":"General","name":"Spawns new processes that are not known child processes","description":"$45","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":3,"id":"target-103","sources":[{"report_type":"sandbox","report_id":"6582a5969988a358780b9c01"}]},{"level":"informative","category":"General","name":"Uses 32 bit executable PE","description":"\"PO53623.exe\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE\n \"Bins.exe\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE\n \"24.exe\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE","origin":"Static Parser","id":"static-153","sources":[{"report_type":"sandbox","report_id":"6582a5969988a358780b9c01"}]},{"level":"informative","category":"General","name":"Writes files in a temp directory","description":"\"PO53623.exe\" writes to a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\tmpB818.tmp\"\n \"Bins.exe\" writes to a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\tmpEB38.tmp\"\n \"Bins.exe\" writes to a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\24.exe\"\n \"iexplore.exe\" writes to a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\~DF43C6FFCEA18BB4B1.TMP\"\n \"iexplore.exe\" writes to a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\~DF825AB57AB3621A0A.TMP\"\n \"iexplore.exe\" writes to a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\~DFB9E56D64B612DA53.TMP\"","origin":"API Call","mitre_attack_id":"T1005","relevance":1,"id":"api-267","sources":[{"report_type":"sandbox","report_id":"6582a5969988a358780b9c01"}]},{"level":"informative","category":"Installation/Persistence","name":"Connects to LPC ports","description":"\"PO53623.exe\" connecting to \"\\ThemeApiPort\"\n \"schtasks.exe\" connecting to \"\\ThemeApiPort\"\n \"Bins.exe\" connecting to \"\\ThemeApiPort\"\n \"netsh.exe\" connecting to \"\\ThemeApiPort\"","origin":"API Call","mitre_attack_id":"T1559","relevance":1,"id":"api-16","sources":[{"report_type":"sandbox","report_id":"6582a5969988a358780b9c01"}]},{"level":"informative","category":"Installation/Persistence","name":"Creates a thread in a self process","description":"\"PO53623.exe\" creates a thread in process \"-1\" (Handle: 4294967295)\n \"powershell.exe\" creates a thread in process \"-1\" (Handle: 4294967295)\n \"schtasks.exe\" creates a thread in process \"-1\" (Handle: 4294967295)\n \"Bins.exe\" creates a thread in process \"-1\" (Handle: 4294967295)","origin":"API Call","mitre_attack_id":"T1055.003","relevance":3,"id":"api-264","sources":[{"report_type":"sandbox","report_id":"6582a5969988a358780b9c01"}]},{"level":"informative","category":"Installation/Persistence","name":"Dropped files","description":"$46","origin":"Binary File","mitre_attack_id":"T1105","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"6582a5969988a358780b9c01"}]},{"level":"informative","category":"Installation/Persistence","name":"Drops XML files","description":"\"tmp908B.tmp\" has type \"XML 1.0 document ASCII text\"\n \"www.google_1_.xml\" has type \"ASCII text with no line terminators\"\n \"tmpEB38.tmp\" has type \"XML 1.0 document ASCII text\" - Location: [%TEMP%\\tmpEB38.tmp]\n \"tmpB818.tmp\" has type \"XML 1.0 document ASCII text\" - Location: [%TEMP%\\tmpB818.tmp]","origin":"Binary File","mitre_attack_id":"T1105","relevance":1,"id":"binary-39","sources":[{"report_type":"sandbox","report_id":"6582a5969988a358780b9c01"}]},{"level":"informative","category":"Installation/Persistence","name":"Drops temp files","description":"$47","origin":"Binary File","mitre_attack_id":"T1105","relevance":1,"id":"binary-53","sources":[{"report_type":"sandbox","report_id":"6582a5969988a358780b9c01"}]},{"level":"informative","category":"Installation/Persistence","name":"Opens registry keys","description":"$48","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-177","sources":[{"report_type":"sandbox","report_id":"6582a5969988a358780b9c01"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries COM task scheduler class object","description":"$49","origin":"Registry Access","mitre_attack_id":"T1053","relevance":3,"id":"registry-141","sources":[{"report_type":"sandbox","report_id":"6582a5969988a358780b9c01"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries basic information of the specified process","description":"\"PO53623.exe\" queries basic process information of the \"C:\\Users\\HAPUBWS\\Documents\\Bins.exe\" (UID: 3392)\n \"24.exe\" queries basic process information of the \"C:\\Windows\\Globalization\\Sorting\\SortDefault.nls\" (UID: 2880)","origin":"API Call","mitre_attack_id":"T1057","relevance":1,"id":"api-235","sources":[{"report_type":"sandbox","report_id":"6582a5969988a358780b9c01"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries registry keys","description":"$4a","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-172","sources":[{"report_type":"sandbox","report_id":"6582a5969988a358780b9c01"}]},{"level":"informative","category":"Installation/Persistence","name":"Reads files","description":"$4b","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-243","sources":[{"report_type":"sandbox","report_id":"6582a5969988a358780b9c01"}]},{"level":"informative","category":"Installation/Persistence","name":"Shows ability to use execution guardrails","description":"The analysis shows indicators which can be used as execution guardrails to ensure that payload only executes against intended targets/system. Matched sigs: Tries to sleep for a long time (more than two minutes)\n Matched sigs: Calls an API typically used to find device information\n Matched sigs: Attempts to detect virtual machine (file access)","origin":"Indicator Combinations","mitre_attack_id":"T1480","relevance":1,"id":"summary-29","sources":[{"report_type":"sandbox","report_id":"6582a5969988a358780b9c01"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files","description":"$4c","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-263","sources":[{"report_type":"sandbox","report_id":"6582a5969988a358780b9c01"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files in the Windows directory","description":"$4d","origin":"API Call","mitre_attack_id":"T1083","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"6582a5969988a358780b9c01"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access LNK files (Windows shortcut)","description":"\"powershell.exe\" trying to access LNK file \"\\Device\\HarddiskVolume2\\%ProgramData%\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Windows PowerShell\\Windows PowerShell.lnk\"\n \"powershell.exe\" trying to access LNK file \"C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Windows PowerShell\\Windows PowerShell.lnk\"\n \"powershell.exe\" trying to access LNK file \"Z:\\%ProgramData%\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Windows PowerShell\\Windows PowerShell.lnk\"\n \"powershell.exe\" trying to access LNK file \"%ALLUSERSPROFILE%\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Windows PowerShell\\Windows PowerShell.lnk\"","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-203","sources":[{"report_type":"sandbox","report_id":"6582a5969988a358780b9c01"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access Powershell profile file","description":"\"powershell.exe\" trying to access file \"\\Device\\HarddiskVolume2\\Windows\\System32\\WindowsPowerShell\\v1.0\\PROFILE.PS1\"\n \"powershell.exe\" trying to access file \"\\Device\\HarddiskVolume2\\Windows\\System32\\WindowsPowerShell\\v1.0\\MICROSOFT.POWERSHELL_PROFILE.PS1\"\n \"powershell.exe\" trying to access file \"\\Device\\HarddiskVolume2\\Users\\%OSUSER%\\Documents\\WINDOWSPOWERSHELL\\PROFILE.PS1\"\n \"powershell.exe\" trying to access file \"\\Device\\HarddiskVolume2\\Users\\%OSUSER%\\Documents\\WINDOWSPOWERSHELL\\MICROSOFT.POWERSHELL_PROFILE.PS1\"","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-173","sources":[{"report_type":"sandbox","report_id":"6582a5969988a358780b9c01"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (executable)","description":"$4e","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-126","sources":[{"report_type":"sandbox","report_id":"6582a5969988a358780b9c01"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (non-executable)","description":"$4f","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-161","sources":[{"report_type":"sandbox","report_id":"6582a5969988a358780b9c01"}]},{"level":"informative","category":"Installation/Persistence","name":"Writes files","description":"\"PO53623.exe\" writes file \"c:\\users\\%osuser%\\appdata\\roaming\\jkwuyswkzqirl.exe\"\n \"PO53623.exe\" writes file \"c:\\users\\%osuser%\\appdata\\local\\temp\\tmpb818.tmp\"\n \"powershell.exe\" writes file \"c:\\users\\%osuser%\\appdata\\roaming\\microsoft\\windows\\recent\\customdestinations\\3be8eogdg52gsp4u1a2m.temp\"\n \"PO53623.exe\" writes file \"c:\\users\\%osuser%\\documents\\bins.exe\"","origin":"API Call","relevance":1,"id":"api-242","sources":[{"report_type":"sandbox","report_id":"6582a5969988a358780b9c01"}]},{"level":"informative","category":"Network Related","name":"Calls an API typically used to create a new HTTP request","description":"\"Bins.exe\" called \"HttpOpenRequestW\" with parameter HTTP method:\"GET\" object: /files/16071907/Bins.exe.html\" - (UID: 00000000-00003636)","origin":"API Call","mitre_attack_id":"T1071","relevance":3,"id":"api-143","sources":[{"report_type":"sandbox","report_id":"6582a5969988a358780b9c01"}]},{"level":"informative","category":"Network Related","name":"Calls an API typically used to register an interface (RPC)","description":"\"PO53623.exe\" called \"RpcServerRegisterIf2\" (UID: 00000000-00001384)\n \"Bins.exe\" called \"RpcServerRegisterIf2\" (UID: 00000000-00001472)\n \"Bins.exe\" called \"RpcServerRegisterIf2\" (UID: 00000000-00003636)\n \"netsh.exe\" called \"RpcServerRegisterIf2\" (UID: 00000000-00003304)","origin":"API Call","mitre_attack_id":"T1021","relevance":3,"id":"api-219","sources":[{"report_type":"sandbox","report_id":"6582a5969988a358780b9c01"}]},{"level":"informative","category":"Network Related","name":"Calls an API typically used to retrieve the URL data","description":"\"Bins.exe\" called \"InternetReadFile\" with parameter 703 (UID: 00000000-00003636)\n \"Bins.exe\" called \"InternetReadFile\" with parameter 1345 (UID: 00000000-00003636)\n \"Bins.exe\" called \"InternetReadFile\" with parameter 6144 (UID: 00000000-00003636)\n \"Bins.exe\" called \"InternetReadFile\" with parameter 5118 (UID: 00000000-00003636)\n \"Bins.exe\" called \"InternetReadFile\" with parameter 702 (UID: 00000000-00003636)\n \"Bins.exe\" called \"InternetReadFile\" with parameter 1346 (UID: 00000000-00003636)\n \"Bins.exe\" called \"InternetReadFile\" with parameter 5119 (UID: 00000000-00003636)","origin":"API Call","mitre_attack_id":"T1105","relevance":3,"id":"api-118","sources":[{"report_type":"sandbox","report_id":"6582a5969988a358780b9c01"}]},{"level":"informative","category":"Network Related","name":"Calls an API used to connect to internet","description":"\"Bins.exe\" called \"InternetOpenA with parameter Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; InfoPath.3)\" (UID: 00000000-00003636)\n \"Bins.exe\" called \"InternetOpenW with parameter Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729;\" (UID: 00000000-00003636)","origin":"API Call","mitre_attack_id":"T1071.001","relevance":1,"id":"api-199","sources":[{"report_type":"sandbox","report_id":"6582a5969988a358780b9c01"}]},{"level":"informative","category":"Network Related","name":"Communicates with HTTP webserver (GET/POST requests)","description":"$50","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":1,"id":"network-62","sources":[{"report_type":"sandbox","report_id":"6582a5969988a358780b9c01"}]},{"level":"informative","category":"Network Related","name":"Communicates with HTTPS webserver (GET/POST requests)","description":"$51","origin":"File/Memory","mitre_attack_id":"T1071.001","relevance":1,"id":"string-505","sources":[{"report_type":"sandbox","report_id":"6582a5969988a358780b9c01"}]},{"level":"informative","category":"Network Related","name":"Contains ability to communicate with network (API string)","description":"$52","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-601","sources":[{"report_type":"sandbox","report_id":"6582a5969988a358780b9c01"}]},{"level":"informative","category":"Network Related","name":"Contains ability to set the value of an HTTP request header","description":"file/memory contains long string with (Indicator: \".setRequestHeader\"; File: \"js__file_upload_1_.js\")\n file/memory contains long string with (Indicator: \".setRequestHeader\"; File: \"SSL\")\n file/memory contains long string with (Indicator: \".setRequestHeader\"; File: \"analytics_2_.js\")","origin":"File/Memory","mitre_attack_id":"T1071.001","relevance":1,"id":"string-623","sources":[{"report_type":"sandbox","report_id":"6582a5969988a358780b9c01"}]},{"level":"informative","category":"Network Related","name":"Decrypted SSL network traffic","description":"$53","origin":"File/Memory","mitre_attack_id":"T1573","relevance":3,"id":"string-102","sources":[{"report_type":"sandbox","report_id":"6582a5969988a358780b9c01"}]},{"level":"informative","category":"Network Related","name":"Detects NETSH process execution","description":"Process \"netsh.exe\" with commandline \"netsh advfirewall firewall add rule name=\"3389\" dir=in action=allow protocol=TCP localport=3389\" (UID: 00000000-00003304)","origin":"Monitored Target","mitre_attack_id":"T1562.004","relevance":2,"id":"target-186","sources":[{"report_type":"sandbox","report_id":"6582a5969988a358780b9c01"}]},{"level":"informative","category":"Network Related","name":"Found domain strings related to cloud services(possible C&C communication)","description":"file/memory contains long string with (Indicator: \".googleapis.com\"; File: \"f_2_.txt\")","origin":"File/Memory","mitre_attack_id":"T1102","relevance":1,"id":"string-186","sources":[{"report_type":"sandbox","report_id":"6582a5969988a358780b9c01"}]},{"level":"informative","category":"Network Related","name":"Found potential IP address in binary/memory","description":"\"1.0.0.0\"\n \"16.0.0.0\"\n Potential IP \"1.2.3.4\" found in string \"cmd.exe /C ping 1.2.3.4 -n 4 -w 1000 > Nul & cmd.exe /C\"\n \"0.0.0.0\"\n Potential IP \"4.0.0.0\" found in string \"em.Windows.Forms,4.0.0.0,,b77a5c561934e089\"\n \"192.168.241.240\"\n Potential IP \"4.0.0.0\" found in string \"n=4.0.0.0, C\"\n Potential IP \"4.0.0.0\" found in string \"4.0.0.0, Cul\"\n Potential IP \"16.10.0.0\" found in string \"KMicrosoft.VisualStudio.Editors.SettingsDesigner.SettingsSingleFileGenerator\t16.10.0.0\"\n Potential IP \"4.0.0.0\" found in string \"ystem.Numerics,4.0.0.0,,b77a5c561934e089,MSIL\"\n Potential IP \"4.0.0.0\" found in string \"em.Management,4.0.0.0,,b03f5f7f11d50a3a,MSIL\"","origin":"File/Memory","mitre_attack_id":"T1071","id":"string-14","sources":[{"report_type":"sandbox","report_id":"6582a5969988a358780b9c01"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"$54","origin":"File/Memory","mitre_attack_id":"T1071","relevance":3,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"6582a5969988a358780b9c01"}]},{"level":"informative","category":"Network Related","name":"Found potential URLs in memory dumps","description":"$55","origin":"Memory Dumps","mitre_attack_id":"T1071","relevance":1,"id":"memorydump-2","sources":[{"report_type":"sandbox","report_id":"6582a5969988a358780b9c01"}]},{"level":"informative","category":"Network Related","name":"Found string related to HTTP headers","description":"$56","origin":"File/Memory","mitre_attack_id":"T1071.001","relevance":1,"id":"string-457","sources":[{"report_type":"sandbox","report_id":"6582a5969988a358780b9c01"}]},{"level":"informative","category":"Network Related","name":"HTTP request contains Base64 encoded artifacts","description":"\"G]]9_\"\n \"zx^m\"\n \"~)^dhjh\" (Indicator: \"password\"; File: \"pbE.hwspK.html\")\n Found string \" Forgot password?\" (Indicator: \"password\"; File: \"pbE.hwspK.html\")\n file/memory contains long string with (Indicator: \"password\"; File: \"f_2_.txt\")","origin":"File/Memory","mitre_attack_id":"T1555","relevance":1,"id":"string-475","sources":[{"report_type":"sandbox","report_id":"6582a5969988a358780b9c01"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Read system defined device setup information from registry","description":"\"PO53623.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\CLASS\\{4D36E968-E325-11CE-BFC1-08002BE10318}\\0002\"; Key: \"PRUNINGMODE\")\n \"Bins.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\CLASS\\{4D36E968-E325-11CE-BFC1-08002BE10318}\\0002\"; Key: \"PRUNINGMODE\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":3,"id":"registry-106","sources":[{"report_type":"sandbox","report_id":"6582a5969988a358780b9c01"}]},{"level":"informative","category":"System Security","name":"Calls an API typically used to add a user account","description":"\"Bins.exe\" called \"NetUserAdd\" (UID: 00000000-00003636)","origin":"API Call","mitre_attack_id":"T1136.001","relevance":3,"id":"api-245","sources":[{"report_type":"sandbox","report_id":"6582a5969988a358780b9c01"}]},{"level":"informative","category":"System Security","name":"Calls an API typically used to enable or disable privileges in the specified access token","description":"\"PO53623.exe\" called an API \"AdjustTokenPrivileges\" (UID: 00000000-00001384)\n \"powershell.exe\" called an API \"AdjustTokenPrivileges\" (UID: 00000000-00002724)\n \"powershell.exe\" called an API \"AdjustTokenPrivileges\" (UID: 00000000-00003364)\n \"Bins.exe\" called an API \"AdjustTokenPrivileges\" (UID: 00000000-00001472)\n \"powershell.exe\" called an API \"AdjustTokenPrivileges\" (UID: 00000000-00001808)\n \"powershell.exe\" called an API \"AdjustTokenPrivileges\" (UID: 00000000-00003808)","origin":"API Call","mitre_attack_id":"T1134","relevance":3,"id":"api-111","sources":[{"report_type":"sandbox","report_id":"6582a5969988a358780b9c01"}]},{"level":"informative","category":"System Security","name":"Contains ability to access device drivers","description":"$5b","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-474","sources":[{"report_type":"sandbox","report_id":"6582a5969988a358780b9c01"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify access token privileges (API string)","description":"Found reference to API \"SeDebugPrivilegeT\" (Indicator: \"SeDebugPrivilege\"; Source: \"00000000-00001384.00000000.66074.05200000.00000004.mdmp, 00000000-00001384.00000001.66184.05200000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1134","relevance":1,"id":"string-77","sources":[{"report_type":"sandbox","report_id":"6582a5969988a358780b9c01"}]},{"level":"informative","category":"System Security","name":"Contains ability to terminate a process (API string)","description":"Found reference to API \"CorExitProcess\" (Indicator: \"ExitProcess\"; File: \"00000000-00002880.00000001.70364.00F91000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1489","relevance":1,"id":"string-316","sources":[{"report_type":"sandbox","report_id":"6582a5969988a358780b9c01"}]},{"level":"informative","category":"System Security","name":"Creates or modifies windows services","description":"\"Bins.exe\" (Access type: \"CREATE\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\TCPIP\\PARAMETERS\")\n \"netsh.exe\" (Access type: \"CREATE\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\NAPAGENT\\LOCALCONFIG\")\n \"netsh.exe\" (Access type: \"CREATE\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\NAPAGENT\\LOCALCONFIG\\ENROLL\\HCSGROUPS\")\n \"netsh.exe\" (Access type: \"CREATE\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\NAPAGENT\\SHAS\")\n \"netsh.exe\" (Access type: \"CREATE\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\NAPAGENT\\QECS\")\n \"netsh.exe\" (Access type: \"CREATE\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\NAPAGENT\\LOCALCONFIG\\UI\")","origin":"Registry Access","mitre_attack_id":"T1543.003","relevance":10,"id":"registry-67","sources":[{"report_type":"sandbox","report_id":"6582a5969988a358780b9c01"}]},{"level":"informative","category":"System Security","name":"Opens the Kernel Security Device Driver (KsecDD) of Windows","description":"\"PO53623.exe\" opened \"\\Device\\KsecDD\"\n \"schtasks.exe\" opened \"\\Device\\KsecDD\"\n \"Bins.exe\" opened \"\\Device\\KsecDD\"\n \"netsh.exe\" opened \"\\Device\\KsecDD\"","origin":"API Call","relevance":10,"id":"api-37","sources":[{"report_type":"sandbox","report_id":"6582a5969988a358780b9c01"}]},{"level":"informative","category":"System Security","name":"Queries services related registry keys","description":"$5c","origin":"Registry Access","mitre_attack_id":"T1007","relevance":1,"id":"registry-173","sources":[{"report_type":"sandbox","report_id":"6582a5969988a358780b9c01"}]},{"level":"informative","category":"System Security","name":"Uses powershell with a add-mppreference commandline param","description":"Process \"powershell.exe\" with commandline \"Add-MpPreference -ExclusionPath \"%APPDATA%\\\\jKWUyswkzQirl.exe\"\" (UID: 00000000-00002724)\n Process \"powershell.exe\" with commandline \"powershell Add-MpPreference -ExclusionPath C:\\\\\" (UID: 00000000-00003364)\n Process \"powershell.exe\" with commandline \"Add-MpPreference -ExclusionPath \"%APPDATA%\\\\jKWUyswkzQirl.exe\"\" (UID: 00000000-00001808)\n Process \"powershell.exe\" with commandline \"powershell Add-MpPreference -ExclusionPath C:\\\\\" (UID: 00000000-00003808)","origin":"Monitored Target","mitre_attack_id":"T1562","relevance":3,"id":"target-236","sources":[{"report_type":"sandbox","report_id":"6582a5969988a358780b9c01"}]},{"level":"informative","category":"Unusual Characteristics","name":"Contains ability to reboot/shutdown the operating system (API string)","description":"Found reference to API \"NtRaiseHardError\" (Indicator: \"RaiseHardError\"; File: \"00003392.00000D40.6261497.00401000.wprm\")","origin":"File/Memory","mitre_attack_id":"T1529","relevance":3,"id":"string-189","sources":[{"report_type":"sandbox","report_id":"6582a5969988a358780b9c01"}]},{"level":"informative","category":"Unusual Characteristics","name":"Drops executable files inside temp directory","description":"\"24.exe\" has type \"PE32 executable (GUI) Intel 80386 for MS Windows UPX compressed\"- Location: [%TEMP%\\24.exe]- [targetUID: 00000000-00003636]","origin":"Binary File","mitre_attack_id":"T1105","relevance":3,"id":"binary-33","sources":[{"report_type":"sandbox","report_id":"6582a5969988a358780b9c01"}]},{"level":"informative","category":"Unusual Characteristics","name":"Drops files inside appdata directory","description":"$5d","origin":"Binary File","mitre_attack_id":"T1036","relevance":3,"id":"binary-37","sources":[{"report_type":"sandbox","report_id":"6582a5969988a358780b9c01"}]},{"level":"informative","category":"Unusual Characteristics","name":"Drops files with image extension","description":"\"logo_1_.png\" has type \"PNG image data 203 x 71 8-bit/color RGB non-interlaced\" and extension \"png\"\n \"dl__1_.png\" has type \"PNG image data 154 x 32 8-bit colormap non-interlaced\" and extension \"png\"\n \"dl_hover__1_.png\" has type \"PNG image data 154 x 32 8-bit colormap non-interlaced\" and extension \"png\"\n \"lg-share-en_1_.gif\" has type \"GIF image data version 89a 125 x 16\" and extension \"gif\"\n \"flag_1_.png\" has type \"PNG image data 16 x 11 8-bit/color RGB non-interlaced\" and extension \"png\"\n \"arrow_1_.gif\" has type \"GIF image data version 89a 6 x 9\" and extension \"gif\"\n \"menubg_1_.gif\" has type \"GIF image data version 89a 3 x 3\" and extension \"gif\"","origin":"Binary File","mitre_attack_id":"T1105","id":"binary-56","sources":[{"report_type":"sandbox","report_id":"6582a5969988a358780b9c01"}]},{"level":"informative","category":"Unusual Characteristics","name":"Matched Compiler/Packer signature","description":"\"PO53623.exe\" was detected as \"Microsoft visual C# v7.0 / Basic .NET\"\n \"Bins.exe\" was detected as \"Microsoft visual C# v7.0 / Basic .NET\"\n \"24.exe\" was detected as \"Netopsystems FEAD Optimizer 1\"","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":10,"id":"static-18","sources":[{"report_type":"sandbox","report_id":"6582a5969988a358780b9c01"}]},{"level":"informative","category":"Unusual Characteristics","name":"Opens many files with write access (often indicator for full-system infection)","description":"\"iexplore.exe\" opens more than 500 files with write access","origin":"API Call","mitre_attack_id":"T1491.001","relevance":10,"id":"api-49","sources":[{"report_type":"sandbox","report_id":"6582a5969988a358780b9c01"}]},{"level":"informative","category":"Unusual Characteristics","name":"Reads the windows installation language","description":"\"PO53623.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE GROUPS\"; Key: \"1\")\n \"Bins.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE GROUPS\"; Key: \"1\")","origin":"Registry Access","mitre_attack_id":"T1614.001","relevance":2,"id":"registry-26","sources":[{"report_type":"sandbox","report_id":"6582a5969988a358780b9c01"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"PE file has unusual entropy sections","description":".rsrc\n .rsrc\n UPX1 with unusual entropies 7.3661269592\n 7.3661269592\n 7.91532406846","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":3,"id":"static-6","sources":[{"report_type":"sandbox","report_id":"6582a5969988a358780b9c01"}]},{"level":"suspicious","category":"Exploit/Shellcode","name":"Possible heap spraying attempt detected","description":"\"Bins.exe\" issued more than 3000 memory allocations","origin":"API Call","mitre_attack_id":"T1189","relevance":10,"id":"api-88","sources":[{"report_type":"sandbox","report_id":"6582a5969988a358780b9c01"}]},{"level":"suspicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"27/69 Antivirus vendors marked sample as malicious (39% detection rate)","origin":"External System","id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"6582a5969988a358780b9c01"}]},{"level":"suspicious","category":"General","name":"Reads configuration files (.ini files)","description":"$5e","origin":"API Call","mitre_attack_id":"T1083","relevance":4,"id":"api-6","sources":[{"report_type":"sandbox","report_id":"6582a5969988a358780b9c01"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Drops executable files","description":"\"Bins.exe\" has type \"PE32 executable (GUI) Intel 80386 Mono/.Net assembly for MS Windows\"- Location: [%USERPROFILE%\\Documents\\Bins.exe]- [targetUID: 00000000-00003636]\n \"24.exe\" has type \"PE32 executable (GUI) Intel 80386 for MS Windows UPX compressed\"- Location: [%TEMP%\\24.exe]- [targetUID: 00000000-00003636]\n \"jKWUyswkzQirl.exe\" has type \"PE32 executable (GUI) Intel 80386 Mono/.Net assembly for MS Windows\"- Location: [%APPDATA%\\jKWUyswkzQirl.exe]- [targetUID: 00000000-00001384]","origin":"Binary File","mitre_attack_id":"T1105","relevance":10,"id":"binary-1","sources":[{"report_type":"sandbox","report_id":"6582a5969988a358780b9c01"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Modifies auto-execute functionality by setting/creating a value in the registry","description":"\"PO53623.exe\" (Access type: \"SETVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\RUN\"; Key: \"IMAGES\"; Value: \"%USERPROFILE%\\Documents\\Bins.exe\")","origin":"Registry Access","mitre_attack_id":"T1547.001","relevance":8,"id":"registry-0","sources":[{"report_type":"sandbox","report_id":"6582a5969988a358780b9c01"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Writes a PE file header to disc","description":"\"Bins.exe\" wrote 60000 bytes starting with PE header signature to file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\24.exe\": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000180100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ...","origin":"API Call","mitre_attack_id":"T1105","relevance":10,"id":"api-43","sources":[{"report_type":"sandbox","report_id":"6582a5969988a358780b9c01"}]},{"level":"suspicious","category":"Network Related","name":"Sends traffic on typical HTTP outbound port, but without HTTP header","description":"$5f","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":5,"id":"network-23","sources":[{"report_type":"sandbox","report_id":"6582a5969988a358780b9c01"}]},{"level":"suspicious","category":"Ransomware/Banking","name":"Checks warning level of secure to non-secure traffic redirection","description":"\"Bins.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\"; Key: \"WARNONHTTPSTOHTTPREDIRECT\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":7,"id":"registry-9","sources":[{"report_type":"sandbox","report_id":"6582a5969988a358780b9c01"}]},{"level":"suspicious","category":"Remote Access Related","name":"Contains indicators of bot communication commands","description":"Found string \"1,Zw[L.g.oa]=1,Zw[L.g.ic]=1,Zw[L.g.Ba]=1,Zw)),$w={},ax=Object.freeze(($w.checkout_progress=1,$w.set_checkout_option=1,$w[L.g.Gg]=1,$w[L.g.Hg]=1,$w[L.g.bc]=1,$w[L.g.fc]=1,$w[L.g.Ig]=1,$w[L.g.Gb]=1,$w[L.g.oa]=1,$w[L.g.ic]=1,$w[L.g.Jg]=1,$w)),bx={},cx=Object.freeze((bx.generate_lead=1,bx.login=1,bx.search=1,bx.select_content=1,bx.share=1,bx.sign_up=1,bx.view_search_results=1,bx[L.g.hc]=1,bx[L.g.Xa]=1,bx[L.g.kb]=1,bx[L.g.Ya]=1,bx[L.g.Ba]=1,bx)),dx=function(a){var b=\"general\";ax[a]?b=\"ecommerce\":cx[a]?\" (Indicator: \"login=\"; File: \"js_3_.js\")","origin":"File/Memory","mitre_attack_id":"T1041","relevance":3,"id":"string-29","sources":[{"report_type":"sandbox","report_id":"6582a5969988a358780b9c01"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Calls an API typically used to enumerate process encountered in a system snapshot","description":"$60","origin":"API Call","mitre_attack_id":"T1057","relevance":5,"id":"api-104","sources":[{"report_type":"sandbox","report_id":"6582a5969988a358780b9c01"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Found browser information locations related strings","description":"\"Local\\Google\\Chrome\\User Data\\Default\\Network\\Cookies\" (Indicator: \"google\\chrome\\user data\") in Source: 38743-169-0040314B\n \"\\Mozilla\\Firefox\\\" (Indicator: \"mozilla\\firefox\\\") in Source: 38743-169-0040314B\n \"\\Microsoft\\Edge\\User Data\\Default\\cookies\" (Indicator: \"microsoft\\edge\\user data\") in Source: 38743-169-0040314B","origin":"File/Memory","mitre_attack_id":"T1005","relevance":5,"id":"string-93","sources":[{"report_type":"sandbox","report_id":"6582a5969988a358780b9c01"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Found system commands related strings","description":"Found string \"cmd.exe /C ping 1.2.3.4 -n 4 -w 1000 > Nul & cmd.exe /C\" (Indicator: \"ping\"; File: \"00003392.00000D40.6261497.00401000.wprm\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":3,"id":"string-126","sources":[{"report_type":"sandbox","report_id":"6582a5969988a358780b9c01"}]},{"level":"suspicious","category":"System Destruction","name":"Marks file for deletion","description":"$61","origin":"API Call","mitre_attack_id":"T1070.004","relevance":10,"id":"api-26","sources":[{"report_type":"sandbox","report_id":"6582a5969988a358780b9c01"}]},{"level":"suspicious","category":"System Destruction","name":"Opens file with deletion access rights","description":"$62","origin":"API Call","mitre_attack_id":"T1070.004","relevance":7,"id":"api-25","sources":[{"report_type":"sandbox","report_id":"6582a5969988a358780b9c01"}]},{"level":"suspicious","category":"System Security","name":"Modifies proxy settings","description":"\"PO53623.exe\" (Access type: \"DELETEVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\")\n \"PO53623.exe\" (Access type: \"DELETEVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\")\n \"Bins.exe\" (Access type: \"DELETEVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\")\n \"Bins.exe\" (Access type: \"DELETEVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\")\n \"Bins.exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\"; Key: \"PROXYENABLE\"; Value: \"00000000\")\n \"Bins.exe\" (Access type: \"DELETEVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\"; Key: \"PROXYSERVER\")\n \"Bins.exe\" (Access type: \"DELETEVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\"; Key: \"PROXYOVERRIDE\")","origin":"Registry Access","mitre_attack_id":"T1112","relevance":10,"id":"registry-27","sources":[{"report_type":"sandbox","report_id":"6582a5969988a358780b9c01"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Entrypoint in PE header is within an uncommon section","description":"\"24.exe\" has an entrypoint in section \"UPX1\"","origin":"Static Parser","mitre_attack_id":"T1027","relevance":10,"id":"static-4","sources":[{"report_type":"sandbox","report_id":"6582a5969988a358780b9c01"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Imports suspicious APIs","description":"VirtualProtect\n GetProcAddress\n LoadLibraryA","origin":"Static Parser","mitre_attack_id":"T1106","relevance":1,"id":"static-1","sources":[{"report_type":"sandbox","report_id":"6582a5969988a358780b9c01"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Timestamp in PE header is very old or in the future","description":"\"PO53623.exe\" claims program is from Mon Jun 26 00:20:31 2102\n \"Bins.exe\" claims program is from Mon Jun 26 00:20:31 2102","origin":"Static Parser","mitre_attack_id":"T1027","relevance":10,"id":"static-3","sources":[{"report_type":"sandbox","report_id":"6582a5969988a358780b9c01"}]},{"level":"malicious","category":"Anti-Detection/Stealthyness","name":"Calls an API typically used to create a thread in another process","description":"\"Bins.exe\" called \"CreateRemoteThread\" with parameters {\"hProcess\": \"480\"\n \"lpThreadAttributes\": \"0\"\n \"dwStackSize\": \"0\"\n \"lpStartAddress\": \"39452942\"\n \"lpParameter\": \"39583744\"\n \"dwCreationFlags\": \"0\"\n \"lpThreadId\": \"0\"}","origin":"API Call","mitre_attack_id":"T1055","relevance":10,"id":"api-106","sources":[{"report_type":"sandbox","report_id":"6582a5969988a358780b9c01"}]},{"level":"malicious","category":"Anti-Detection/Stealthyness","name":"Creates a process in suspended mode (likely for process injection)","description":"\"PO53623.exe\" called \"CreateProcessA\" with parameter \"C:\\PO53623.exe\" - (UID: 00000000-00001384)\n \"Bins.exe\" called \"CreateProcessA\" with parameter \"%USERPROFILE%\\Documents\\Bins.exe\" - (UID: 00000000-00001472)","origin":"API Call","mitre_attack_id":"T1055","relevance":10,"id":"api-129","sources":[{"report_type":"sandbox","report_id":"6582a5969988a358780b9c01"}]},{"level":"malicious","category":"Anti-Detection/Stealthyness","name":"Tries to hide tracks of having downloaded a file from the internet","description":"\"PO53623.exe\" opened \"C:\\Users\\%OSUSER%\\Documents\\Bins.exe:Zone.Identifier\" with delete access\n \"PO53623.exe\" opened \"C:\\PO53623.exe:Zone.Identifier\" with delete access\n \"PO53623.exe\" opened \"\\Device\\HarddiskVolume2\\Users\\%OSUSER%\\Documents\\Bins.exe:ZONE.IDENTIFIER\" with delete access\n \"PO53623.exe\" opened \"\\Device\\HarddiskVolume2\\PO53623.exe:ZONE.IDENTIFIER\" with delete access","origin":"API Call","mitre_attack_id":"T1070.004","relevance":7,"id":"api-42","sources":[{"report_type":"sandbox","report_id":"6582a5969988a358780b9c01"}]},{"level":"malicious","category":"Anti-Detection/Stealthyness","name":"Writes PE header to memory","description":"\"PO53623.exe wrote PE header bytes (\"MZ\") to a remote process \"C:\\PO53623.exe\", which might be an injection preparation attempt ..., \"Bins.exe wrote PE header bytes (\"MZ\") to a remote process \"C:\\Users\\%OSUSER%\\Documents\\Bins.exe\"\n which might be an injection preparation attempt ...","origin":"API Call","mitre_attack_id":"T1055.002","relevance":7,"id":"api-83","sources":[{"report_type":"sandbox","report_id":"6582a5969988a358780b9c01"}]},{"level":"malicious","category":"External Systems","name":"Sample detected by CrowdStrike Static Analysis and ML with relatively high confidence","description":"CrowdStrike Static Analysis and ML (QuickScan) yielded detection: win/malicious_confidence_100% (W)","origin":"External System","relevance":10,"id":"avtest-8","sources":[{"report_type":"sandbox","report_id":"6582a5969988a358780b9c01"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a large number of Antivirus engines","description":"27/69 Antivirus vendors marked sample as malicious (39% detection rate)","origin":"External System","relevance":10,"id":"avtest-3","sources":[{"report_type":"sandbox","report_id":"6582a5969988a358780b9c01"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a trusted Antivirus engine","description":"No specific details available","origin":"External System","relevance":10,"id":"avtest-5","sources":[{"report_type":"sandbox","report_id":"6582a5969988a358780b9c01"}]},{"level":"malicious","category":"General","name":"The analysis extracted a file that was identified as malicious","description":"27/69 Antivirus vendors marked dropped file \"Bins.exe\" as malicious (classified as \"MSIL.Kryptik\" with 39% detection rate)\n 58/72 Antivirus vendors marked dropped file \"24.exe\" as malicious (classified as \"Gen:Trojan.Heur.RP\" with 80% detection rate)\n 27/69 Antivirus vendors marked dropped file \"jKWUyswkzQirl.exe\" as malicious (classified as \"MSIL.Kryptik\" with 39% detection rate)","origin":"Binary File","mitre_attack_id":"T1204.002","relevance":10,"id":"binary-11","sources":[{"report_type":"sandbox","report_id":"6582a5969988a358780b9c01"}]},{"level":"malicious","category":"General","name":"The analysis spawned a process that was identified as malicious","description":"27/69 Antivirus vendors marked spawned process \"PO53623.exe\" (PID: 3392) as malicious (classified as \"MSIL.Kryptik\" with 39% detection rate)\n 27/69 Antivirus vendors marked spawned process \"Bins.exe\" (PID: 1472) as malicious (classified as \"MSIL.Kryptik\" with 39% detection rate)\n 27/69 Antivirus vendors marked spawned process \"Bins.exe\" (PID: 3636) as malicious (classified as \"MSIL.Kryptik\" with 39% detection rate)\n 58/72 Antivirus vendors marked spawned process \"24.exe\" (PID: 2880) as malicious (classified as \"Gen:Trojan.Heur.RP\" with 80% detection rate)","origin":"Monitored Target","mitre_attack_id":"T1204.002","relevance":10,"id":"target-58","sources":[{"report_type":"sandbox","report_id":"6582a5969988a358780b9c01"}]},{"level":"malicious","category":"Installation/Persistence","name":"Allocates virtual memory in a remote process","description":"\"PO53623.exe\" allocated memory in \"C:\\PO53623.exe\"\n \"Bins.exe\" allocated memory in \"%USERPROFILE%\\Documents\\Bins.exe\"\n \"24.exe\" allocated memory in \"%TEMP%\\24.exe\"","origin":"API Call","mitre_attack_id":"T1055","relevance":7,"id":"api-20","sources":[{"report_type":"sandbox","report_id":"6582a5969988a358780b9c01"}]},{"level":"malicious","category":"Installation/Persistence","name":"Writes data to a remote process","description":"$63","origin":"API Call","mitre_attack_id":"T1055","relevance":6,"id":"api-0","sources":[{"report_type":"sandbox","report_id":"6582a5969988a358780b9c01"}]},{"level":"malicious","category":"Network Related","name":"Contacts many different hosts","description":"Contacted 18 (or more) hosts in at least 0 different countries","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":9,"id":"network-17","sources":[{"report_type":"sandbox","report_id":"6582a5969988a358780b9c01"}]},{"level":"malicious","category":"Network Related","name":"Detected many DNS responses with a low TTL","description":"\"crl.pki.goog\" with TTL 282\n \"crl.rootca1.amazontrust.com\" with TTL 60\n \"crl.rootg2.amazontrust.com\" with TTL 60\n \"crls.pki.goog\" with TTL 223\n \"du0pud0sdlmzf.cloudfront.net\" with TTL 60\n \"fe0.google.com\" with TTL 60\n \"googleads.g.doubleclick.net\" with TTL 300\n \"o.ss2.us\" with TTL 60\n \"ocsp.pki.goog\" with TTL 109\n \"ocsp.rootca1.amazontrust.com\" with TTL 60\n \"ocsp.rootg2.amazontrust.com\" with TTL 60\n \"pagead2.googlesyndication.com\" with TTL 300\n \"tpc.googlesyndication.com\" with TTL 300\n \"www.google.com\" with TTL 227","origin":"Network Traffic","mitre_attack_id":"T1071.004","relevance":3,"id":"network-35","sources":[{"report_type":"sandbox","report_id":"6582a5969988a358780b9c01"}]},{"level":"malicious","category":"Network Related","name":"Found more than one unique user-agent","description":"Found the following user-agents: Microsoft-CryptoAPI/6.1\n Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like Gecko","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":5,"id":"network-15","sources":[{"report_type":"sandbox","report_id":"6582a5969988a358780b9c01"}]},{"level":"malicious","category":"Network Related","name":"Uses network protocols on unusual ports","description":"TCP traffic to 74.50.93.170 on port 4040","origin":"Network Traffic","mitre_attack_id":"T1571","relevance":7,"id":"network-7","sources":[{"report_type":"sandbox","report_id":"6582a5969988a358780b9c01"}]},{"level":"malicious","category":"Spyware/Information Retrieval","name":"Collects system information using GET request","description":"$64","origin":"Network Traffic","mitre_attack_id":"T1041","relevance":10,"id":"network-39","sources":[{"report_type":"sandbox","report_id":"6582a5969988a358780b9c01"}]},{"level":"malicious","category":"System Security","name":"Modifies firewall settings","description":"Process \"netsh.exe\" with commandline \"netsh advfirewall firewall add rule name=\"3389\" dir=in action=allow protocol=TCP localport=3389\" (UID: 00000000-00003304)","origin":"Monitored Target","mitre_attack_id":"T1562.004","relevance":8,"id":"target-15","sources":[{"report_type":"sandbox","report_id":"6582a5969988a358780b9c01"}]},{"level":"malicious","category":"System Security","name":"Tries to hide user accounts","description":"\"Bins.exe\" (Access type: \"SETVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\WINLOGON\\SPECIALACCOUNTS\\USERLIST\"; Key: \"SFKGJ..\")","origin":"Registry Access","mitre_attack_id":"T1564.002","relevance":10,"id":"registry-109","sources":[{"report_type":"sandbox","report_id":"6582a5969988a358780b9c01"}]},{"level":"malicious","category":"Unusual Characteristics","name":"Spawns a lot of processes","description":"$65","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":8,"id":"target-14","sources":[{"report_type":"sandbox","report_id":"6582a5969988a358780b9c01"}]}],"incidents":[{"name":"Spyware","details_count":3,"details":[{"detail":"Found a string that may be used as part of an injection method"},{"detail":"Collects system information using GET request"},{"detail":"Found browser information locations related strings"}],"sources":[{"report_type":"sandbox","report_id":"6582a5969988a358780b9c01"}]},{"name":"Persistence","details_count":5,"details":[{"detail":"Writes data to a remote process"},{"detail":"Modifies auto-execute functionality by setting/creating a value in the registry"},{"detail":"Schedules a task to be executed at a specific time and date"},{"detail":"Spawns a lot of processes"},{"detail":"Modifies firewall settings"}],"sources":[{"report_type":"sandbox","report_id":"6582a5969988a358780b9c01"}]},{"name":"Fingerprint","details_count":3,"details":[{"detail":"Queries process information"},{"detail":"Queries the internet cache settings (often used to hide footprints in index.dat or internet cache)"},{"detail":"Queries sensitive IE security settings"}],"sources":[{"report_type":"sandbox","report_id":"6582a5969988a358780b9c01"}]},{"name":"Evasive","details_count":4,"details":[{"detail":"Tries to sleep for a long time (more than two minutes)"},{"detail":"Tries to hide tracks of having downloaded a file from the internet"},{"detail":"PE file has a section name known to be used by a packer/protector"},{"detail":"Input file contains API references not part of its Import Address Table (IAT)"}],"sources":[{"report_type":"sandbox","report_id":"6582a5969988a358780b9c01"}]},{"name":"Spreading","details_count":2,"details":[{"detail":"Opens the MountPointManager (often used to detect additional infection locations)"},{"detail":"Detected many DNS responses with a low TTL"}],"sources":[{"report_type":"sandbox","report_id":"6582a5969988a358780b9c01"}]},{"name":"Network","details_count":1,"details":[{"detail":"Calls an API typically used to create a HTTP or FTP session"}],"sources":[{"report_type":"sandbox","report_id":"6582a5969988a358780b9c01"}]},{"name":"Network Behavior","details_count":1,"details":[{"detail":"Contacts 18 domains and 18 hosts"}],"sources":[{"report_type":"sandbox","report_id":"6582a5969988a358780b9c01"}]}]},"activity":{"stats":{"process_count":24,"spawned_processes_count":24,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":54,"imported_dlls_count":252,"dropped_files_count":0,"extracted_files_count":24,"files_written_count":128,"files_deleted_count":0,"registry_keys_created_count":103,"registry_keys_modified_count":0,"registry_keys_deleted_count":4,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":107,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":18,"dns_resolutions_count":18,"contacted_urls_count":39,"http_requests_count":39},"behavior_tags":null,"sample_flags":["Multi-Process","Network Traffic","Extracted Files","Decrypted SSL traffic"],"sandbox_reports":[{"id":"6582a5969988a358780b9c01","environment_id":110,"environment_description":"Windows 7 32 bit (HWP Support)","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"MSIL.Kryptik","contacted_countries":["DEU","FRA","USA"],"submit_name":"PO53623.exe","analysis_start_time":"2023-12-20T08:28:07+00:00","indicators_count":{"informative":162,"suspicious":76,"malicious":27},"tags":["Multi-Process","Network Traffic","Extracted Files","Decrypted SSL traffic"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":[{"address":"74.50.93.170","port":4040,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"6582a5969988a358780b9c01"}]},{"address":"51.91.30.159","port":443,"protocol":"TCP","country":"France","sources":[{"report_type":"sandbox","report_id":"6582a5969988a358780b9c01"}]},{"address":"18.155.188.188","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"6582a5969988a358780b9c01"}]},{"address":"142.250.188.2","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"6582a5969988a358780b9c01"}]},{"address":"142.250.191.67","port":80,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"6582a5969988a358780b9c01"}]},{"address":"13.227.21.83","port":80,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"6582a5969988a358780b9c01"}]},{"address":"18.239.200.121","port":80,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"6582a5969988a358780b9c01"}]},{"address":"65.8.161.119","port":80,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"6582a5969988a358780b9c01"}]},{"address":"108.139.10.65","port":80,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"6582a5969988a358780b9c01"}]},{"address":"142.250.191.34","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"6582a5969988a358780b9c01"}]},{"address":"212.47.222.21","port":80,"protocol":"TCP","country":"Germany","sources":[{"report_type":"sandbox","report_id":"6582a5969988a358780b9c01"}]},{"address":"142.251.46.225","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"6582a5969988a358780b9c01"}]},{"address":"212.47.222.21","port":443,"protocol":"TCP","country":"Germany","sources":[{"report_type":"sandbox","report_id":"6582a5969988a358780b9c01"}]},{"address":"142.251.32.36","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"6582a5969988a358780b9c01"}]},{"address":"212.47.222.20","port":443,"protocol":"TCP","country":"Germany","sources":[{"report_type":"sandbox","report_id":"6582a5969988a358780b9c01"}]},{"address":"142.250.72.238","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"6582a5969988a358780b9c01"}]},{"address":"142.250.191.72","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"6582a5969988a358780b9c01"}]},{"address":"18.155.188.220","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"6582a5969988a358780b9c01"}]}],"dns_resolutions":[{"domain":"crl.pki.goog","address":"142.250.191.67","ttl":282,"country":"United States","sources":[{"report_type":"sandbox","report_id":"6582a5969988a358780b9c01"}]},{"domain":"crl.rootca1.amazontrust.com","address":"108.139.10.65","ttl":60,"country":"United States","registrar_name":"MarkMonitor, Inc.","registrar_organization":"Amazon Trust Services LLC","registrar_name_servers":"NS-1249.AWSDNS-28.ORG","registrar_creation_date":"2007-05-11T00:00:00+00:00","sources":[{"report_type":"sandbox","report_id":"6582a5969988a358780b9c01"}]},{"domain":"crl.rootg2.amazontrust.com","address":"65.8.161.119","ttl":60,"country":"United States","registrar_name":"MarkMonitor, Inc.","registrar_organization":"Amazon Trust Services LLC","registrar_name_servers":"NS-1249.AWSDNS-28.ORG","registrar_creation_date":"2007-05-11T00:00:00+00:00","sources":[{"report_type":"sandbox","report_id":"6582a5969988a358780b9c01"}]},{"domain":"crls.pki.goog","address":"142.250.191.67","ttl":223,"country":"United States","sources":[{"report_type":"sandbox","report_id":"6582a5969988a358780b9c01"}]},{"domain":"du0pud0sdlmzf.cloudfront.net","address":"18.155.188.220","ttl":60,"country":"United States","registrar_name":"MarkMonitor, Inc.","registrar_organization":"Amazon.com, Inc.","registrar_name_servers":"NS-1306.AWSDNS-35.ORG","registrar_creation_date":"2008-04-25T00:00:00+00:00","sources":[{"report_type":"sandbox","report_id":"6582a5969988a358780b9c01"}]},{"domain":"fe0.google.com","ttl":60,"country":"-","registrar_name":"MarkMonitor, Inc.","registrar_organization":"Google Inc.","registrar_name_servers":"NS1.GOOGLE.COM","registrar_creation_date":"1997-09-15T00:00:00+00:00","sources":[{"report_type":"sandbox","report_id":"6582a5969988a358780b9c01"}]},{"domain":"googleads.g.doubleclick.net","address":"142.250.191.34","ttl":300,"country":"United States","registrar_name":"MarkMonitor, Inc.","registrar_organization":"Google Inc.","registrar_name_servers":"NS1.GOOGLE.COM","registrar_creation_date":"1996-01-16T00:00:00+00:00","sources":[{"report_type":"sandbox","report_id":"6582a5969988a358780b9c01"}]},{"domain":"o.ss2.us","address":"13.227.21.83","ttl":60,"country":"United States","registrar_name":"GODADDY.COM, INC.","registrar_name_servers":"NS-19.AWSDNS-02.COM","registrar_creation_date":"2015-04-16T18:03:31+00:00","sources":[{"report_type":"sandbox","report_id":"6582a5969988a358780b9c01"}]},{"domain":"ocsp.digicert.com","address":"192.229.211.108","ttl":21111,"country":"United States","registrar_name":"GODADDY.COM, LLC","registrar_organization":"DigiCert, Inc.","registrar_name_servers":"NS1.P03.DYNECT.NET","registrar_creation_date":"1996-12-02T00:00:00+00:00","sources":[{"report_type":"sandbox","report_id":"6582a5969988a358780b9c01"}]},{"domain":"ocsp.pki.goog","address":"142.250.191.67","ttl":109,"country":"United States","sources":[{"report_type":"sandbox","report_id":"6582a5969988a358780b9c01"}]},{"domain":"ocsp.rootca1.amazontrust.com","address":"18.239.200.121","ttl":60,"country":"United States","sources":[{"report_type":"sandbox","report_id":"6582a5969988a358780b9c01"}]},{"domain":"ocsp.rootg2.amazontrust.com","address":"18.239.200.121","ttl":60,"country":"United States","sources":[{"report_type":"sandbox","report_id":"6582a5969988a358780b9c01"}]},{"domain":"pagead2.googlesyndication.com","address":"142.250.188.2","ttl":300,"country":"United States","sources":[{"report_type":"sandbox","report_id":"6582a5969988a358780b9c01"}]},{"domain":"serving.bepolite.eu","address":"212.47.222.21","ttl":3254,"country":"Germany","sources":[{"report_type":"sandbox","report_id":"6582a5969988a358780b9c01"}]},{"domain":"static.bepolite.eu","address":"212.47.222.21","ttl":3600,"country":"Germany","sources":[{"report_type":"sandbox","report_id":"6582a5969988a358780b9c01"}]},{"domain":"tpc.googlesyndication.com","address":"142.251.46.225","ttl":300,"country":"United States","sources":[{"report_type":"sandbox","report_id":"6582a5969988a358780b9c01"}]},{"domain":"www.google.com","address":"142.251.32.36","ttl":227,"country":"United States","sources":[{"report_type":"sandbox","report_id":"6582a5969988a358780b9c01"}]},{"domain":"www.upload.ee","address":"51.91.30.159","ttl":3600,"country":"France","sources":[{"report_type":"sandbox","report_id":"6582a5969988a358780b9c01"}]}],"http_requests":[{"host":"ocsp.digicert.com","host_ip":"192.229.211.108:80","url":"/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAoFmyX1Sz2HlMxmMUd1OKM%3D","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAoFmyX1Sz2HlMxmMUd1OKM%3D HTTP/1.1\nConnection: Keep-Alive\nAccept: */*\nUser-Agent: Microsoft-CryptoAPI/6.1\nHost: ocsp.digicert.com","sources":[{"report_type":"sandbox","report_id":"6582a5969988a358780b9c01"}]},{"host":"ocsp.digicert.com","host_ip":"192.229.211.108:80","url":"/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQlOydjtpho0%2Bholo77zGjGxETUEQQU8JyF%2FaKffY%2FJaLvV1IlNHb7TkP8CEAHqRFnqJyQkmYqUpX34D7k%3D","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQlOydjtpho0%2Bholo77zGjGxETUEQQU8JyF%2FaKffY%2FJaLvV1IlNHb7TkP8CEAHqRFnqJyQkmYqUpX34D7k%3D HTTP/1.1\nConnection: Keep-Alive\nAccept: */*\nUser-Agent: Microsoft-CryptoAPI/6.1\nHost: ocsp.digicert.com","sources":[{"report_type":"sandbox","report_id":"6582a5969988a358780b9c01"}]},{"host":"ocsp.digicert.com","host_ip":"192.229.211.108:80","url":"/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D HTTP/1.1\nConnection: Keep-Alive\nAccept: */*\nUser-Agent: Microsoft-CryptoAPI/6.1\nHost: ocsp.digicert.com","sources":[{"report_type":"sandbox","report_id":"6582a5969988a358780b9c01"}]},{"host":"ocsp.pki.goog","host_ip":"142.250.191.67:80","url":"/gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D HTTP/1.1\nConnection: Keep-Alive\nAccept: */*\nUser-Agent: Microsoft-CryptoAPI/6.1\nHost: ocsp.pki.goog","sources":[{"report_type":"sandbox","report_id":"6582a5969988a358780b9c01"}]},{"host":"ocsp.digicert.com","host_ip":"192.229.211.108:80","url":"/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAbY2QTVWENG9oovp1QifsQ%3D","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAbY2QTVWENG9oovp1QifsQ%3D HTTP/1.1\nConnection: Keep-Alive\nAccept: */*\nUser-Agent: Microsoft-CryptoAPI/6.1\nHost: ocsp.digicert.com","sources":[{"report_type":"sandbox","report_id":"6582a5969988a358780b9c01"}]},{"host":"o.ss2.us","host_ip":"13.227.21.83:80","url":"//MEowSDBGMEQwQjAJBgUrDgMCGgUABBSLwZ6EW5gdYc9UaSEaaLjjETNtkAQUv1%2B30c7dH4b0W1Ws3NcQwg6piOcCCQCnDkpMNIK3fw%3D%3D","method":"GET","response_code":"200","response_phrase":"OK","header":"GET //MEowSDBGMEQwQjAJBgUrDgMCGgUABBSLwZ6EW5gdYc9UaSEaaLjjETNtkAQUv1%2B30c7dH4b0W1Ws3NcQwg6piOcCCQCnDkpMNIK3fw%3D%3D HTTP/1.1\nConnection: Keep-Alive\nAccept: */*\nUser-Agent: Microsoft-CryptoAPI/6.1\nHost: o.ss2.us","sources":[{"report_type":"sandbox","report_id":"6582a5969988a358780b9c01"}]},{"host":"ocsp.pki.goog","host_ip":"142.250.191.67:80","url":"/gtsr1/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBQwkcLWD4LqGJ7bE7B1XZsEbmfwUAQU5K8rJnEaK0gnhS9SZizv8IkTcT4CDQIDvFNZazTHGPUBUGY%3D","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /gtsr1/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBQwkcLWD4LqGJ7bE7B1XZsEbmfwUAQU5K8rJnEaK0gnhS9SZizv8IkTcT4CDQIDvFNZazTHGPUBUGY%3D HTTP/1.1\nConnection: Keep-Alive\nAccept: */*\nUser-Agent: Microsoft-CryptoAPI/6.1\nHost: ocsp.pki.goog","sources":[{"report_type":"sandbox","report_id":"6582a5969988a358780b9c01"}]},{"host":"crls.pki.goog","host_ip":"142.250.191.67:80","url":"/gts1c3/QqFxbi9M48c.crl","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /gts1c3/QqFxbi9M48c.crl HTTP/1.1\nConnection: Keep-Alive\nAccept: */*\nUser-Agent: Microsoft-CryptoAPI/6.1\nHost: crls.pki.goog","sources":[{"report_type":"sandbox","report_id":"6582a5969988a358780b9c01"}]},{"host":"ocsp.pki.goog","host_ip":"142.250.191.67:80","url":"/gts1c3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEGupzMnM%2BqGaCjIQPyd58u0%3D","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /gts1c3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEGupzMnM%2BqGaCjIQPyd58u0%3D HTTP/1.1\nConnection: Keep-Alive\nAccept: */*\nUser-Agent: Microsoft-CryptoAPI/6.1\nHost: ocsp.pki.goog","sources":[{"report_type":"sandbox","report_id":"6582a5969988a358780b9c01"}]},{"host":"ocsp.rootg2.amazontrust.com","host_ip":"18.239.200.121:80","url":"/MFQwUjBQME4wTDAJBgUrDgMCGgUABBSIfaREXmfqfJR3TkMYnD7O5MhzEgQUnF8A36oB1zArOIiiuG1KnPIRkYMCEwZ%2FlEoqJ83z%2BsKuKwH5CO65xMY%3D","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /MFQwUjBQME4wTDAJBgUrDgMCGgUABBSIfaREXmfqfJR3TkMYnD7O5MhzEgQUnF8A36oB1zArOIiiuG1KnPIRkYMCEwZ%2FlEoqJ83z%2BsKuKwH5CO65xMY%3D HTTP/1.1\nConnection: Keep-Alive\nAccept: */*\nUser-Agent: Microsoft-CryptoAPI/6.1\nHost: ocsp.rootg2.amazontrust.com","sources":[{"report_type":"sandbox","report_id":"6582a5969988a358780b9c01"}]},{"host":"crl.rootg2.amazontrust.com","host_ip":"65.8.161.119:80","url":"/rootg2.crl","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /rootg2.crl HTTP/1.1\nConnection: Keep-Alive\nAccept: */*\nUser-Agent: Microsoft-CryptoAPI/6.1\nHost: crl.rootg2.amazontrust.com","sources":[{"report_type":"sandbox","report_id":"6582a5969988a358780b9c01"}]},{"host":"crls.pki.goog","host_ip":"142.250.191.67:80","url":"/gts1c3/moVDfISia2k.crl","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /gts1c3/moVDfISia2k.crl HTTP/1.1\nConnection: Keep-Alive\nAccept: */*\nUser-Agent: Microsoft-CryptoAPI/6.1\nHost: crls.pki.goog","sources":[{"report_type":"sandbox","report_id":"6582a5969988a358780b9c01"}]},{"host":"crl.pki.goog","host_ip":"142.250.191.67:80","url":"/gtsr1/gtsr1.crl","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /gtsr1/gtsr1.crl HTTP/1.1\nConnection: Keep-Alive\nAccept: */*\nUser-Agent: Microsoft-CryptoAPI/6.1\nHost: crl.pki.goog","sources":[{"report_type":"sandbox","report_id":"6582a5969988a358780b9c01"}]},{"host":"ocsp.pki.goog","host_ip":"142.250.191.67:80","url":"/gts1c3/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEQCZXmpIP%2Bo%2BHhJmodADfw%2Fc","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /gts1c3/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEQCZXmpIP%2Bo%2BHhJmodADfw%2Fc HTTP/1.1\nConnection: Keep-Alive\nAccept: */*\nUser-Agent: Microsoft-CryptoAPI/6.1\nHost: ocsp.pki.goog","sources":[{"report_type":"sandbox","report_id":"6582a5969988a358780b9c01"}]},{"host":"crl.rootca1.amazontrust.com","host_ip":"108.139.10.65:80","url":"/rootca1.crl","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /rootca1.crl HTTP/1.1\nConnection: Keep-Alive\nAccept: */*\nUser-Agent: Microsoft-CryptoAPI/6.1\nHost: crl.rootca1.amazontrust.com","sources":[{"report_type":"sandbox","report_id":"6582a5969988a358780b9c01"}]},{"host":"ocsp.rootca1.amazontrust.com","host_ip":"18.239.200.121:80","url":"/MFQwUjBQME4wTDAJBgUrDgMCGgUABBRPWaOUU8%2B5VZ5%2Fa9jFTaU9pkK3FAQUhBjMhTTsvAyUlC4IWZzHshBOCggCEwdzEjgLnWaIozse2b%2BczaaODg8%3D","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /MFQwUjBQME4wTDAJBgUrDgMCGgUABBRPWaOUU8%2B5VZ5%2Fa9jFTaU9pkK3FAQUhBjMhTTsvAyUlC4IWZzHshBOCggCEwdzEjgLnWaIozse2b%2BczaaODg8%3D HTTP/1.1\nConnection: Keep-Alive\nAccept: */*\nUser-Agent: Microsoft-CryptoAPI/6.1\nHost: ocsp.rootca1.amazontrust.com","sources":[{"report_type":"sandbox","report_id":"6582a5969988a358780b9c01"}]},{"host":"serving.bepolite.eu","host_ip":"212.47.222.21:80","url":"/script?space=50dd7b0f-4105-441f-8f60-18cc3fcb090c&type=direct&page_id=1580123&screen_width=750&screen_height=346&os=Win32&refurl=&pageurl=file%3A%2F%2FC%3A%5CUsers%5CHAPUBWS%5CAppData%5CRoaming%5Cjyo.rquAu.html&rnd=1703066602178","method":"GET","response_code":"302","response_phrase":"Found","header":"GET /script?space=50dd7b0f-4105-441f-8f60-18cc3fcb090c&type=direct&page_id=1580123&screen_width=750&screen_height=346&os=Win32&refurl=&pageurl=file%3A%2F%2FC%3A%5CUsers%5CHAPUBWS%5CAppData%5CRoaming%5Cjyo.rquAu.html&rnd=1703066602178 HTTP/1.1\nAccept: application/javascript, */*;q=0.8\nAccept-Language: en-US\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like Gecko\nAccept-Encoding: gzip, deflate\nHost: serving.bepolite.eu\nDNT: 1\nConnection: Keep-Alive","sources":[{"report_type":"sandbox","report_id":"6582a5969988a358780b9c01"}]},{"host":"serving.bepolite.eu","host_ip":"212.47.222.21:80","url":"/script?space=50dd7b0f-4105-441f-8f60-18cc3fcb090c&type=direct&page_id=2640849&screen_width=750&screen_height=346&os=Win32&refurl=&pageurl=file%3A%2F%2FC%3A%5CUsers%5CHAPUBWS%5CAppData%5CRoaming%5CBJGIC..kG.html&rnd=1703067267588","method":"GET","response_code":"302","response_phrase":"Found","header":"GET /script?space=50dd7b0f-4105-441f-8f60-18cc3fcb090c&type=direct&page_id=2640849&screen_width=750&screen_height=346&os=Win32&refurl=&pageurl=file%3A%2F%2FC%3A%5CUsers%5CHAPUBWS%5CAppData%5CRoaming%5CBJGIC..kG.html&rnd=1703067267588 HTTP/1.1\nAccept: application/javascript, */*;q=0.8\nAccept-Language: en-US\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like Gecko\nAccept-Encoding: gzip, deflate\nHost: serving.bepolite.eu\nDNT: 1\nConnection: Keep-Alive","sources":[{"report_type":"sandbox","report_id":"6582a5969988a358780b9c01"}]},{"host":"ocsp.pki.goog","host_ip":"142.250.191.67:80","url":"/gts1c3/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEQDHvwlxZ6tgTQmj1PR%2BmThA","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /gts1c3/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEQDHvwlxZ6tgTQmj1PR%2BmThA HTTP/1.1\nConnection: Keep-Alive\nAccept: */*\nUser-Agent: Microsoft-CryptoAPI/6.1\nHost: ocsp.pki.goog","sources":[{"report_type":"sandbox","report_id":"6582a5969988a358780b9c01"}]},{"host":"ocsp.pki.goog","host_ip":"142.250.191.67:80","url":"/gts1c3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEDEixfO34qnbCeE6N8VMp00%3D","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /gts1c3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEDEixfO34qnbCeE6N8VMp00%3D HTTP/1.1\nConnection: Keep-Alive\nAccept: */*\nUser-Agent: Microsoft-CryptoAPI/6.1\nHost: ocsp.pki.goog","sources":[{"report_type":"sandbox","report_id":"6582a5969988a358780b9c01"}]},{"host":"serving.bepolite.eu","host_ip":"212.47.222.21:80","url":"/script?space=50dd7b0f-4105-441f-8f60-18cc3fcb090c&type=direct&page_id=1439366&screen_width=750&screen_height=346&os=Win32&refurl=&pageurl=file%3A%2F%2FC%3A%5CUsers%5CHAPUBWS%5CAppData%5CRoaming%5CvHImy.oGI.html&rnd=1703068954450","method":"GET","response_code":"302","response_phrase":"Found","header":"GET /script?space=50dd7b0f-4105-441f-8f60-18cc3fcb090c&type=direct&page_id=1439366&screen_width=750&screen_height=346&os=Win32&refurl=&pageurl=file%3A%2F%2FC%3A%5CUsers%5CHAPUBWS%5CAppData%5CRoaming%5CvHImy.oGI.html&rnd=1703068954450 HTTP/1.1\nAccept: application/javascript, */*;q=0.8\nAccept-Language: en-US\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like Gecko\nAccept-Encoding: gzip, deflate\nHost: serving.bepolite.eu\nDNT: 1\nConnection: Keep-Alive","sources":[{"report_type":"sandbox","report_id":"6582a5969988a358780b9c01"}]},{"host":"serving.bepolite.eu","host_ip":"212.47.222.21:80","url":"/script?space=50dd7b0f-4105-441f-8f60-18cc3fcb090c&type=direct&page_id=2535744&screen_width=750&screen_height=346&os=Win32&refurl=&pageurl=file%3A%2F%2FC%3A%5CUsers%5CHAPUBWS%5CAppData%5CRoaming%5Ck.hufeesg.html&rnd=1703070950363","method":"GET","response_code":"302","response_phrase":"Found","header":"GET /script?space=50dd7b0f-4105-441f-8f60-18cc3fcb090c&type=direct&page_id=2535744&screen_width=750&screen_height=346&os=Win32&refurl=&pageurl=file%3A%2F%2FC%3A%5CUsers%5CHAPUBWS%5CAppData%5CRoaming%5Ck.hufeesg.html&rnd=1703070950363 HTTP/1.1\nAccept: application/javascript, */*;q=0.8\nAccept-Language: en-US\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like Gecko\nAccept-Encoding: gzip, deflate\nHost: serving.bepolite.eu\nDNT: 1\nConnection: Keep-Alive","sources":[{"report_type":"sandbox","report_id":"6582a5969988a358780b9c01"}]},{"host":"serving.bepolite.eu","host_ip":"212.47.222.21:80","url":"/script?space=50dd7b0f-4105-441f-8f60-18cc3fcb090c&type=direct&page_id=1105210&screen_width=750&screen_height=346&os=Win32&refurl=&pageurl=file%3A%2F%2FC%3A%5CUsers%5CHAPUBWS%5CAppData%5CRoaming%5CxIDknlGKD.html&rnd=1703072395399","method":"GET","response_code":"302","response_phrase":"Found","header":"GET /script?space=50dd7b0f-4105-441f-8f60-18cc3fcb090c&type=direct&page_id=1105210&screen_width=750&screen_height=346&os=Win32&refurl=&pageurl=file%3A%2F%2FC%3A%5CUsers%5CHAPUBWS%5CAppData%5CRoaming%5CxIDknlGKD.html&rnd=1703072395399 HTTP/1.1\nAccept: application/javascript, */*;q=0.8\nAccept-Language: en-US\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like Gecko\nAccept-Encoding: gzip, deflate\nHost: serving.bepolite.eu\nDNT: 1\nConnection: Keep-Alive","sources":[{"report_type":"sandbox","report_id":"6582a5969988a358780b9c01"}]},{"host":"ocsp.digicert.com","host_ip":"192.229.211.108:80","url":"/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTk45WiKdPUwcMf8JgMC07ACYqr2AQUt2ui6qiqhIx56rTaD5iyxZV2ufQCEATiBJD97V%2Bh8cNnTUFY7lA%3D","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTk45WiKdPUwcMf8JgMC07ACYqr2AQUt2ui6qiqhIx56rTaD5iyxZV2ufQCEATiBJD97V%2Bh8cNnTUFY7lA%3D HTTP/1.1\nConnection: Keep-Alive\nAccept: */*\nUser-Agent: Microsoft-CryptoAPI/6.1\nHost: ocsp.digicert.com","sources":[{"report_type":"sandbox","report_id":"6582a5969988a358780b9c01"}]},{"host":"serving.bepolite.eu","host_ip":"212.47.222.21:80","url":"/script?space=50dd7b0f-4105-441f-8f60-18cc3fcb090c&type=direct&page_id=3094759&screen_width=750&screen_height=346&os=Win32&refurl=&pageurl=file%3A%2F%2FC%3A%5CUsers%5CHAPUBWS%5CAppData%5CRoaming%5CBpqb.JkcD.html&rnd=1703074860261","method":"GET","response_code":"302","response_phrase":"Found","header":"GET /script?space=50dd7b0f-4105-441f-8f60-18cc3fcb090c&type=direct&page_id=3094759&screen_width=750&screen_height=346&os=Win32&refurl=&pageurl=file%3A%2F%2FC%3A%5CUsers%5CHAPUBWS%5CAppData%5CRoaming%5CBpqb.JkcD.html&rnd=1703074860261 HTTP/1.1\nAccept: application/javascript, */*;q=0.8\nAccept-Language: en-US\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like Gecko\nAccept-Encoding: gzip, deflate\nHost: serving.bepolite.eu\nDNT: 1\nConnection: Keep-Alive","sources":[{"report_type":"sandbox","report_id":"6582a5969988a358780b9c01"}]},{"host":"serving.bepolite.eu","host_ip":"212.47.222.21:80","url":"/script?space=50dd7b0f-4105-441f-8f60-18cc3fcb090c&type=direct&page_id=1307798&screen_width=750&screen_height=346&os=Win32&refurl=&pageurl=file%3A%2F%2FC%3A%5CUsers%5CHAPUBWS%5CAppData%5CRoaming%5CgeCvFhdly.html&rnd=1703076432141","method":"GET","response_code":"302","response_phrase":"Found","header":"GET /script?space=50dd7b0f-4105-441f-8f60-18cc3fcb090c&type=direct&page_id=1307798&screen_width=750&screen_height=346&os=Win32&refurl=&pageurl=file%3A%2F%2FC%3A%5CUsers%5CHAPUBWS%5CAppData%5CRoaming%5CgeCvFhdly.html&rnd=1703076432141 HTTP/1.1\nAccept: application/javascript, */*;q=0.8\nAccept-Language: en-US\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like Gecko\nAccept-Encoding: gzip, deflate\nHost: serving.bepolite.eu\nDNT: 1\nConnection: Keep-Alive","sources":[{"report_type":"sandbox","report_id":"6582a5969988a358780b9c01"}]},{"host":"serving.bepolite.eu","host_ip":"212.47.222.21:80","url":"/script?space=50dd7b0f-4105-441f-8f60-18cc3fcb090c&type=direct&page_id=5575995&screen_width=750&screen_height=346&os=Win32&refurl=&pageurl=file%3A%2F%2FC%3A%5CUsers%5CHAPUBWS%5CAppData%5CRoaming%5CAgJorBrbq.html&rnd=1703077332332","method":"GET","response_code":"302","response_phrase":"Found","header":"GET /script?space=50dd7b0f-4105-441f-8f60-18cc3fcb090c&type=direct&page_id=5575995&screen_width=750&screen_height=346&os=Win32&refurl=&pageurl=file%3A%2F%2FC%3A%5CUsers%5CHAPUBWS%5CAppData%5CRoaming%5CAgJorBrbq.html&rnd=1703077332332 HTTP/1.1\nAccept: application/javascript, */*;q=0.8\nAccept-Language: en-US\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like Gecko\nAccept-Encoding: gzip, deflate\nHost: serving.bepolite.eu\nDNT: 1\nConnection: Keep-Alive","sources":[{"report_type":"sandbox","report_id":"6582a5969988a358780b9c01"}]},{"host":"serving.bepolite.eu","host_ip":"212.47.222.21:80","url":"/script?space=50dd7b0f-4105-441f-8f60-18cc3fcb090c&type=direct&page_id=7484644&screen_width=750&screen_height=346&os=Win32&refurl=&pageurl=file%3A%2F%2FC%3A%5CUsers%5CHAPUBWS%5CAppData%5CRoaming%5CmsmqzCpGg.html&rnd=1703077877399","method":"GET","response_code":"302","response_phrase":"Found","header":"GET /script?space=50dd7b0f-4105-441f-8f60-18cc3fcb090c&type=direct&page_id=7484644&screen_width=750&screen_height=346&os=Win32&refurl=&pageurl=file%3A%2F%2FC%3A%5CUsers%5CHAPUBWS%5CAppData%5CRoaming%5CmsmqzCpGg.html&rnd=1703077877399 HTTP/1.1\nAccept: application/javascript, */*;q=0.8\nAccept-Language: en-US\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like Gecko\nAccept-Encoding: gzip, deflate\nHost: serving.bepolite.eu\nDNT: 1\nConnection: Keep-Alive","sources":[{"report_type":"sandbox","report_id":"6582a5969988a358780b9c01"}]},{"host":"serving.bepolite.eu","host_ip":"212.47.222.21:80","url":"/script?space=50dd7b0f-4105-441f-8f60-18cc3fcb090c&type=direct&page_id=1480521&screen_width=750&screen_height=346&os=Win32&refurl=&pageurl=file%3A%2F%2FC%3A%5CUsers%5CHAPUBWS%5CAppData%5CRoaming%5CBKaEvgIpa.html&rnd=1703080164328","method":"GET","response_code":"302","response_phrase":"Found","header":"GET /script?space=50dd7b0f-4105-441f-8f60-18cc3fcb090c&type=direct&page_id=1480521&screen_width=750&screen_height=346&os=Win32&refurl=&pageurl=file%3A%2F%2FC%3A%5CUsers%5CHAPUBWS%5CAppData%5CRoaming%5CBKaEvgIpa.html&rnd=1703080164328 HTTP/1.1\nAccept: application/javascript, */*;q=0.8\nAccept-Language: en-US\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like Gecko\nAccept-Encoding: gzip, deflate\nHost: serving.bepolite.eu\nDNT: 1\nConnection: Keep-Alive","sources":[{"report_type":"sandbox","report_id":"6582a5969988a358780b9c01"}]},{"host":"ocsp.digicert.com","host_ip":"192.229.211.108:80","url":"/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAqvpsXKY8RRQeo74ffHUxc%3D","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAqvpsXKY8RRQeo74ffHUxc%3D HTTP/1.1\nConnection: Keep-Alive\nAccept: */*\nUser-Agent: Microsoft-CryptoAPI/6.1\nHost: ocsp.digicert.com","sources":[{"report_type":"sandbox","report_id":"6582a5969988a358780b9c01"}]},{"host":"ocsp.digicert.com","host_ip":"192.229.211.108:80","url":"/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D HTTP/1.1\nConnection: Keep-Alive\nAccept: */*\nUser-Agent: Microsoft-CryptoAPI/6.1\nHost: ocsp.digicert.com","sources":[{"report_type":"sandbox","report_id":"6582a5969988a358780b9c01"}]},{"host":"serving.bepolite.eu","host_ip":"212.47.222.21:80","url":"/script?space=50dd7b0f-4105-441f-8f60-18cc3fcb090c&type=direct&page_id=5386135&screen_width=750&screen_height=346&os=Win32&refurl=&pageurl=file%3A%2F%2FC%3A%5CUsers%5CHAPUBWS%5CAppData%5CRoaming%5CjtiAoryjf.html&rnd=1703081209728","method":"GET","response_code":"302","response_phrase":"Found","header":"GET /script?space=50dd7b0f-4105-441f-8f60-18cc3fcb090c&type=direct&page_id=5386135&screen_width=750&screen_height=346&os=Win32&refurl=&pageurl=file%3A%2F%2FC%3A%5CUsers%5CHAPUBWS%5CAppData%5CRoaming%5CjtiAoryjf.html&rnd=1703081209728 HTTP/1.1\nAccept: application/javascript, */*;q=0.8\nAccept-Language: en-US\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like Gecko\nAccept-Encoding: gzip, deflate\nHost: serving.bepolite.eu\nDNT: 1\nConnection: Keep-Alive","sources":[{"report_type":"sandbox","report_id":"6582a5969988a358780b9c01"}]},{"host":"ocsp.digicert.com","host_ip":"192.229.211.108:80","url":"/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEA177el9ggmWelJjG4vdGL0%3D","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEA177el9ggmWelJjG4vdGL0%3D HTTP/1.1\nConnection: Keep-Alive\nAccept: */*\nUser-Agent: Microsoft-CryptoAPI/6.1\nHost: ocsp.digicert.com","sources":[{"report_type":"sandbox","report_id":"6582a5969988a358780b9c01"}]},{"host":"serving.bepolite.eu","host_ip":"212.47.222.21:80","url":"/script?space=50dd7b0f-4105-441f-8f60-18cc3fcb090c&type=direct&page_id=8392843&screen_width=750&screen_height=346&os=Win32&refurl=&pageurl=file%3A%2F%2FC%3A%5CUsers%5CHAPUBWS%5CAppData%5CRoaming%5CKr.izfJwD.html&rnd=1703083756203","method":"GET","response_code":"302","response_phrase":"Found","header":"GET /script?space=50dd7b0f-4105-441f-8f60-18cc3fcb090c&type=direct&page_id=8392843&screen_width=750&screen_height=346&os=Win32&refurl=&pageurl=file%3A%2F%2FC%3A%5CUsers%5CHAPUBWS%5CAppData%5CRoaming%5CKr.izfJwD.html&rnd=1703083756203 HTTP/1.1\nAccept: application/javascript, */*;q=0.8\nAccept-Language: en-US\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like Gecko\nAccept-Encoding: gzip, deflate\nHost: serving.bepolite.eu\nDNT: 1\nConnection: Keep-Alive","sources":[{"report_type":"sandbox","report_id":"6582a5969988a358780b9c01"}]},{"host":"serving.bepolite.eu","host_ip":"212.47.222.21:80","url":"/script?space=50dd7b0f-4105-441f-8f60-18cc3fcb090c&type=direct&page_id=9163783&screen_width=750&screen_height=346&os=Win32&refurl=&pageurl=file%3A%2F%2FC%3A%5CUsers%5CHAPUBWS%5CAppData%5CRoaming%5CaBDpxmlsx.html&rnd=1703084601159","method":"GET","response_code":"302","response_phrase":"Found","header":"GET /script?space=50dd7b0f-4105-441f-8f60-18cc3fcb090c&type=direct&page_id=9163783&screen_width=750&screen_height=346&os=Win32&refurl=&pageurl=file%3A%2F%2FC%3A%5CUsers%5CHAPUBWS%5CAppData%5CRoaming%5CaBDpxmlsx.html&rnd=1703084601159 HTTP/1.1\nAccept: application/javascript, */*;q=0.8\nAccept-Language: en-US\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like Gecko\nAccept-Encoding: gzip, deflate\nHost: serving.bepolite.eu\nDNT: 1\nConnection: Keep-Alive","sources":[{"report_type":"sandbox","report_id":"6582a5969988a358780b9c01"}]},{"host":"serving.bepolite.eu","host_ip":"212.47.222.21:80","url":"/script?space=50dd7b0f-4105-441f-8f60-18cc3fcb090c&type=direct&page_id=6405930&screen_width=750&screen_height=346&os=Win32&refurl=&pageurl=file%3A%2F%2FC%3A%5CUsers%5CHAPUBWS%5CAppData%5CRoaming%5CnkthpFinK.html&rnd=1703087255254","method":"GET","response_code":"302","response_phrase":"Found","header":"GET /script?space=50dd7b0f-4105-441f-8f60-18cc3fcb090c&type=direct&page_id=6405930&screen_width=750&screen_height=346&os=Win32&refurl=&pageurl=file%3A%2F%2FC%3A%5CUsers%5CHAPUBWS%5CAppData%5CRoaming%5CnkthpFinK.html&rnd=1703087255254 HTTP/1.1\nAccept: application/javascript, */*;q=0.8\nAccept-Language: en-US\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like Gecko\nAccept-Encoding: gzip, deflate\nHost: serving.bepolite.eu\nDNT: 1\nConnection: Keep-Alive","sources":[{"report_type":"sandbox","report_id":"6582a5969988a358780b9c01"}]},{"host":"serving.bepolite.eu","host_ip":"212.47.222.21:80","url":"/script?space=50dd7b0f-4105-441f-8f60-18cc3fcb090c&type=direct&page_id=6372294&screen_width=750&screen_height=346&os=Win32&refurl=&pageurl=file%3A%2F%2FC%3A%5CUsers%5CHAPUBWS%5CAppData%5CRoaming%5CwpjGGdCdB.html&rnd=1703088095210","method":"GET","response_code":"302","response_phrase":"Found","header":"GET /script?space=50dd7b0f-4105-441f-8f60-18cc3fcb090c&type=direct&page_id=6372294&screen_width=750&screen_height=346&os=Win32&refurl=&pageurl=file%3A%2F%2FC%3A%5CUsers%5CHAPUBWS%5CAppData%5CRoaming%5CwpjGGdCdB.html&rnd=1703088095210 HTTP/1.1\nAccept: application/javascript, */*;q=0.8\nAccept-Language: en-US\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like Gecko\nAccept-Encoding: gzip, deflate\nHost: serving.bepolite.eu\nDNT: 1\nConnection: Keep-Alive","sources":[{"report_type":"sandbox","report_id":"6582a5969988a358780b9c01"}]},{"host":"serving.bepolite.eu","host_ip":"212.47.222.21:80","url":"/script?space=50dd7b0f-4105-441f-8f60-18cc3fcb090c&type=direct&page_id=1582480&screen_width=750&screen_height=346&os=Win32&refurl=&pageurl=file%3A%2F%2FC%3A%5CUsers%5CHAPUBWS%5CAppData%5CRoaming%5CaHmJKtizD.html&rnd=1703091115103","method":"GET","response_code":"302","response_phrase":"Found","header":"GET /script?space=50dd7b0f-4105-441f-8f60-18cc3fcb090c&type=direct&page_id=1582480&screen_width=750&screen_height=346&os=Win32&refurl=&pageurl=file%3A%2F%2FC%3A%5CUsers%5CHAPUBWS%5CAppData%5CRoaming%5CaHmJKtizD.html&rnd=1703091115103 HTTP/1.1\nAccept: application/javascript, */*;q=0.8\nAccept-Language: en-US\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like Gecko\nAccept-Encoding: gzip, deflate\nHost: serving.bepolite.eu\nDNT: 1\nConnection: Keep-Alive","sources":[{"report_type":"sandbox","report_id":"6582a5969988a358780b9c01"}]},{"host":"serving.bepolite.eu","host_ip":"212.47.222.21:80","url":"/script?space=50dd7b0f-4105-441f-8f60-18cc3fcb090c&type=direct&page_id=7596963&screen_width=750&screen_height=346&os=Win32&refurl=&pageurl=file%3A%2F%2FC%3A%5CUsers%5CHAPUBWS%5CAppData%5CRoaming%5Cuyspfppby.html&rnd=1703091915509","method":"GET","response_code":"302","response_phrase":"Found","header":"GET /script?space=50dd7b0f-4105-441f-8f60-18cc3fcb090c&type=direct&page_id=7596963&screen_width=750&screen_height=346&os=Win32&refurl=&pageurl=file%3A%2F%2FC%3A%5CUsers%5CHAPUBWS%5CAppData%5CRoaming%5Cuyspfppby.html&rnd=1703091915509 HTTP/1.1\nAccept: application/javascript, */*;q=0.8\nAccept-Language: en-US\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like Gecko\nAccept-Encoding: gzip, deflate\nHost: serving.bepolite.eu\nDNT: 1\nConnection: Keep-Alive","sources":[{"report_type":"sandbox","report_id":"6582a5969988a358780b9c01"}]}]},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"6582a5969988a358780b9c01"}],"processes":[{"pid":1384,"ppid":0,"name":"PO53623.exe","command_line":"","sha256":"46a870926fb693596e4fea1ff6ed4bd228d8cc63a9e285997ded48b1484ab3f5","normalized_path":"C:\\PO53623.exe","uid":"00000000-00001384","icon":"$66"},{"pid":2724,"ppid":1384,"name":"powershell.exe","command_line":"Add-MpPreference -ExclusionPath \"%APPDATA%\\jKWUyswkzQirl.exe\"","sha256":"6c05e11399b7e3c8ed31bae72014cf249c144a8f4a2c54a758eb2e6fad47aec7","normalized_path":"%WINDIR%\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","parent_uid":"00000000-00001384","uid":"00000000-00002724"},{"pid":2436,"ppid":1384,"name":"schtasks.exe","command_line":"/Create /TN \"Updates\\jKWUyswkzQirl\" /XML \"%TEMP%\\tmpB818.tmp\"","sha256":"15018d0093befabba8b927743191030d1f8c17bb97fdb48c2fc3eab20e2d4b3d","normalized_path":"%WINDIR%\\System32\\schtasks.exe","parent_uid":"00000000-00001384","uid":"00000000-00002436"},{"pid":3392,"ppid":1384,"name":"PO53623.exe","command_line":"","sha256":"46a870926fb693596e4fea1ff6ed4bd228d8cc63a9e285997ded48b1484ab3f5","normalized_path":"C:\\PO53623.exe","parent_uid":"00000000-00001384","uid":"00000000-00003392"},{"pid":3364,"ppid":3392,"name":"powershell.exe","command_line":"powershell Add-MpPreference -ExclusionPath C:\\","sha256":"6c05e11399b7e3c8ed31bae72014cf249c144a8f4a2c54a758eb2e6fad47aec7","normalized_path":"%WINDIR%\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","parent_uid":"00000000-00003392","uid":"00000000-00003364"},{"pid":1472,"ppid":3392,"name":"Bins.exe","command_line":"","sha256":"46a870926fb693596e4fea1ff6ed4bd228d8cc63a9e285997ded48b1484ab3f5","normalized_path":"%USERPROFILE%\\Documents\\Bins.exe","parent_uid":"00000000-00003392","uid":"00000000-00001472"},{"pid":1808,"ppid":1472,"name":"powershell.exe","command_line":"Add-MpPreference -ExclusionPath \"%APPDATA%\\jKWUyswkzQirl.exe\"","sha256":"6c05e11399b7e3c8ed31bae72014cf249c144a8f4a2c54a758eb2e6fad47aec7","normalized_path":"%WINDIR%\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","parent_uid":"00000000-00001472","uid":"00000000-00001808"},{"pid":3256,"ppid":1472,"name":"schtasks.exe","command_line":"/Create /TN \"Updates\\jKWUyswkzQirl\" /XML \"%TEMP%\\tmpEB38.tmp\"","sha256":"15018d0093befabba8b927743191030d1f8c17bb97fdb48c2fc3eab20e2d4b3d","normalized_path":"%WINDIR%\\System32\\schtasks.exe","parent_uid":"00000000-00001472","uid":"00000000-00003256"},{"pid":3636,"ppid":1472,"name":"Bins.exe","command_line":"","sha256":"46a870926fb693596e4fea1ff6ed4bd228d8cc63a9e285997ded48b1484ab3f5","normalized_path":"%USERPROFILE%\\Documents\\Bins.exe","parent_uid":"00000000-00001472","uid":"00000000-00003636"},{"pid":3808,"ppid":3636,"name":"powershell.exe","command_line":"powershell Add-MpPreference -ExclusionPath C:\\","sha256":"6c05e11399b7e3c8ed31bae72014cf249c144a8f4a2c54a758eb2e6fad47aec7","normalized_path":"%WINDIR%\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","parent_uid":"00000000-00003636","uid":"00000000-00003808"},{"pid":2880,"ppid":3636,"name":"24.exe","command_line":"","sha256":"0df3d05900e7b530f6c2a281d43c47839f2cf2a5d386553c8dc46e463a635a2c","normalized_path":"%TEMP%\\24.exe","parent_uid":"00000000-00003636","uid":"00000000-00002880"},{"pid":3304,"ppid":2880,"name":"netsh.exe","command_line":"netsh advfirewall firewall add rule name=\"3389\" dir=in action=allow protocol=TCP localport=3389","sha256":"661f5d4ce4f0a6cb32669a43ce5deec6d5a9e19b2387f22c5012405e92169943","normalized_path":"%WINDIR%\\system32\\netsh.exe","parent_uid":"00000000-00002880","uid":"00000000-00003304"},{"pid":2944,"ppid":3636,"name":"iexplore.exe","command_line":"%APPDATA%\\pbE.hwspK.html","sha256":"8abc7daa81c8a20bfd88b6a60ecc9ed1292fbb6cedbd6f872f36512d9a194bba","normalized_path":"%PROGRAMFILES%\\Internet Explorer\\iexplore.exe","parent_uid":"00000000-00003636","uid":"00000000-00002944"},{"pid":3276,"ppid":2944,"name":"iexplore.exe","command_line":"SCODEF:2944 CREDAT:275457 /prefetch:2","sha256":"8abc7daa81c8a20bfd88b6a60ecc9ed1292fbb6cedbd6f872f36512d9a194bba","normalized_path":"%PROGRAMFILES%\\Internet Explorer\\iexplore.exe","parent_uid":"00000000-00002944","uid":"00000000-00003276"},{"pid":308,"ppid":2944,"name":"iexplore.exe","command_line":"SCODEF:2944 CREDAT:996357 /prefetch:2","sha256":"8abc7daa81c8a20bfd88b6a60ecc9ed1292fbb6cedbd6f872f36512d9a194bba","normalized_path":"%PROGRAMFILES%\\Internet Explorer\\iexplore.exe","parent_uid":"00000000-00002944","uid":"00000000-00000308"},{"pid":312,"ppid":2944,"name":"iexplore.exe","command_line":"SCODEF:2944 CREDAT:996372 /prefetch:2","sha256":"8abc7daa81c8a20bfd88b6a60ecc9ed1292fbb6cedbd6f872f36512d9a194bba","normalized_path":"%PROGRAMFILES%\\Internet Explorer\\iexplore.exe","parent_uid":"00000000-00002944","uid":"00000000-00000312"},{"pid":4064,"ppid":2944,"name":"iexplore.exe","command_line":"SCODEF:2944 CREDAT:799761 /prefetch:2","sha256":"8abc7daa81c8a20bfd88b6a60ecc9ed1292fbb6cedbd6f872f36512d9a194bba","normalized_path":"%PROGRAMFILES%\\Internet Explorer\\iexplore.exe","parent_uid":"00000000-00002944","uid":"00000000-00004064"},{"pid":3168,"ppid":2944,"name":"iexplore.exe","command_line":"SCODEF:2944 CREDAT:2307093 /prefetch:2","sha256":"8abc7daa81c8a20bfd88b6a60ecc9ed1292fbb6cedbd6f872f36512d9a194bba","normalized_path":"%PROGRAMFILES%\\Internet Explorer\\iexplore.exe","parent_uid":"00000000-00002944","uid":"00000000-00003168"},{"pid":2976,"ppid":2944,"name":"iexplore.exe","command_line":"SCODEF:2944 CREDAT:1258539 /prefetch:2","sha256":"8abc7daa81c8a20bfd88b6a60ecc9ed1292fbb6cedbd6f872f36512d9a194bba","normalized_path":"%PROGRAMFILES%\\Internet Explorer\\iexplore.exe","parent_uid":"00000000-00002944","uid":"00000000-00002976"},{"pid":2628,"ppid":2944,"name":"iexplore.exe","command_line":"SCODEF:2944 CREDAT:603191 /prefetch:2","sha256":"8abc7daa81c8a20bfd88b6a60ecc9ed1292fbb6cedbd6f872f36512d9a194bba","normalized_path":"%PROGRAMFILES%\\Internet Explorer\\iexplore.exe","parent_uid":"00000000-00002944","uid":"00000000-00002628"},{"pid":2508,"ppid":2944,"name":"iexplore.exe","command_line":"SCODEF:2944 CREDAT:1389613 /prefetch:2","sha256":"8abc7daa81c8a20bfd88b6a60ecc9ed1292fbb6cedbd6f872f36512d9a194bba","normalized_path":"%PROGRAMFILES%\\Internet Explorer\\iexplore.exe","parent_uid":"00000000-00002944","uid":"00000000-00002508"},{"pid":4128,"ppid":2944,"name":"iexplore.exe","command_line":"SCODEF:2944 CREDAT:2700337 /prefetch:2","sha256":"8abc7daa81c8a20bfd88b6a60ecc9ed1292fbb6cedbd6f872f36512d9a194bba","normalized_path":"%PROGRAMFILES%\\Internet Explorer\\iexplore.exe","parent_uid":"00000000-00002944","uid":"00000000-00004128"},{"pid":4432,"ppid":2944,"name":"iexplore.exe","command_line":"SCODEF:2944 CREDAT:2176056 /prefetch:2","sha256":"8abc7daa81c8a20bfd88b6a60ecc9ed1292fbb6cedbd6f872f36512d9a194bba","normalized_path":"%PROGRAMFILES%\\Internet Explorer\\iexplore.exe","parent_uid":"00000000-00002944","uid":"00000000-00004432"},{"pid":4968,"ppid":2944,"name":"iexplore.exe","command_line":"SCODEF:2944 CREDAT:1455157 /prefetch:2","sha256":"8abc7daa81c8a20bfd88b6a60ecc9ed1292fbb6cedbd6f872f36512d9a194bba","normalized_path":"%PROGRAMFILES%\\Internet Explorer\\iexplore.exe","parent_uid":"00000000-00002944","uid":"00000000-00004968"}],"all_imported_dlls":["advapi32.dll","userenv.dll","ntshrui.dll","wlanapi.dll","mlang.dll","msimtf.dll","d3d10warp.dll","FWPUCLNT.DLL","credssp.dll","mprapi.dll","msvcr100.dll","clbcatq.dll","shdocvw.dll","System.Data.ni.dll","ieui.dll","secur32.dll","Microsoft.PowerShell.ConsoleHost.ni.dll","msasn1.dll","profapi.dll","System.Management.Automation.ni.dll","rasman.dll","winipsec.dll","netiohlp.dll","nettrace.dll","fltLib.dll","api-ms-win-downlevel-advapi32-l1-1-0.dll","authfwcfg.dll","Microsoft.PowerShell.Commands.Management.ni.dll","Microsoft.PowerShell.Security.ni.dll","dhcpcsvc6.dll","wshelper.dll","RpcRtRemote.dll","NAPMONTR.DLL","dwmapi.dll","msctf.dll","api-ms-win-downlevel-ole32-l1-1-0.dll","mscorwks.dll","api-ms-win-downlevel-advapi32-l2-1-0.dll","normaliz.dll","atl.dll","samlib.dll","oleacc.dll","gdi32.dll","System.Core.ni.dll","shell32.dll","webservices.dll","System.Drawing.ni.dll","Wldap32.dll","schannel.dll","dot3api.dll","oleaccrc.dll","ssv.dll","MSOHEV.DLL","dot3cfg.dll","msimg32.dll","Microsoft.WSMan.Runtime.dll","System.Data.dll","netapi32.dll","polstore.dll","clrjit.dll","System.Transactions.ni.dll","diasymreader.dll","httpapi.dll","d2d1.dll","crypt32.dll","mscorjit.dll","avicap32.dll","fwcfg.dll","System.Windows.Forms.dll","linkinfo.dll","wbemcomn.dll","ntdsapi.dll","gpapi.dll","ws2help.dll","hnetmon.dll","ntdll.dll","shlwapi.dll","sspicli.dll","bcryptprimitives.dll","p2pcollab.dll","wlancfg.dll","SwDir_1231201.dll","System.Windows.Forms.ni.dll","slc.dll","api-ms-win-downlevel-shlwapi-l2-1-0.dll","ndfapi.dll","IEShims.dll","imagehlp.dll","ole32.dll","ws2_32.dll","wbemsvc.dll","tzres.dll","winhttp.dll","webio.dll","ExplorerFrame.dll","npctrl.dll","Microsoft.VisualBasic.ni.dll","eappcfg.dll","vcruntime140_clr0400.dll","rasadhlp.dll","wdi.dll","sqmapi.dll","deploy.dll","System.Xml.ni.dll","Microsoft.WSMan.Management.ni.dll","vm3dum_loader.dll","d3d10level9.dll","netutils.dll","mswsock.dll","QUTIL.DLL","d3d11.dll","sechost.dll","clr.dll","api-ms-win-downlevel-shell32-l1-1-0.dll","System.Management.ni.dll","msdmo.dll","msxml3r.dll","usp10.dll","whhelper.dll","PeerDistSh.dll","System.ni.dll","System.DirectoryServices.ni.dll","msvcr90.dll","KernelBase.dll","wininet.dll","ieframe.dll","wevtapi.dll","tdh.dll","kernel32.dll","imm32.dll","dhcpcsvc.dll","odbc32.dll","p2pnetsh.dll","Wpc.dll","samcli.dll","nci.dll","vm3dum_10.dll","rpcnsh.dll","mscorlib.ni.dll","wbemprox.dll","mpr.dll","mfc42u.dll","propsys.dll","urlmon.dll","cscapi.dll","wshqos.dll","cryptnet.dll","WcnNetsh.dll","powrprof.dll","cryptsp.dll","devobj.dll","psapi.dll","System.Management.Automation.dll","winnsi.dll","ncrypt.dll","eappprxy.dll","adsldpc.dll","msvcr80.dll","msvcrt.dll","System.Configuration.ni.dll","WindowsCodecs.dll","api-ms-win-downlevel-shlwapi-l1-1-0.dll","api-ms-win-downlevel-version-l1-1-0.dll","devrtl.dll","wlanhlp.dll","version.dll","ntmarta.dll","credui.dll","odbcint.dll","VxSSL32.dll","api-ms-win-core-xstate-l2-1-0.dll","api-ms-win-downlevel-user32-l1-1-0.dll","System.Configuration.Install.ni.dll","winmm.dll","npmproxy.dll","rasmontr.dll","duser.dll","dui70.dll","xmllite.dll","cfgmgr32.dll","logoncli.dll","activeds.dll","url.dll","jp2ssv.dll","WSHTCPIP.DLL","netprofm.dll","vm3dum.dll","rpcss.dll","comctl32.dll","mscorrc.dll","setupapi.dll","ktmw32.dll","wintrust.dll","nlaapi.dll","mscoree.dll","bcrypt.dll","FirewallAPI.dll","QAGENT.DLL","System.Transactions.dll","devenum.dll","nshipsec.dll","api-ms-win-core-synch-l1-2-0.dll","SensApi.dll","rasapi32.dll","nshwfp.dll","ucrtbase_clr0400.dll","msxml3.dll","GdiPlus.dll","ifmon.dll","certcli.dll","user32.dll","Microsoft.PowerShell.Commands.Diagnostics.ni.dll","shfolder.dll","ieproxy.dll","jscript9.dll","nshhttp.dll","iertutil.dll","wlanutil.dll","wwancfg.dll","api-ms-win-downlevel-normaliz-l1-1-0.dll","wwapi.dll","nsi.dll","rsaenh.dll","dnsapi.dll","onex.dll","UIAutomationCore.dll","cryptbase.dll","apphelp.dll","srvcli.dll","taskschd.dll","P2P.dll","comdlg32.dll","DWrite.dll","URLREDIR.DLL","lpk.dll","rpcrt4.dll","oleaut32.dll","IPHLPAPI.DLL","dhcpcmonitor.dll","netshell.dll","uxtheme.dll","nlssorting.dll","DHCPQEC.DLL","dxgi.dll","mscoreei.dll","wkscli.dll","Microsoft.PowerShell.Commands.Utility.ni.dll","msvfw32.dll","fastprox.dll","wship6.dll","sxs.dll","mshtml.dll"]},"file_activity":{"dropped_files":null,"extracted_files":[{"name":"jKWUyswkzQirl.exe","sha256":"46a870926fb693596e4fea1ff6ed4bd228d8cc63a9e285997ded48b1484ab3f5","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"6582a5969988a358780b9c01"}]},{"name":"24.exe","sha256":"0df3d05900e7b530f6c2a281d43c47839f2cf2a5d386553c8dc46e463a635a2c","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"6582a5969988a358780b9c01"}]},{"name":"Bins.exe","sha256":"46a870926fb693596e4fea1ff6ed4bd228d8cc63a9e285997ded48b1484ab3f5","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"6582a5969988a358780b9c01"}]},{"name":"urlblockindex_1_.bin","sha256":"775853600060162c4b4e5f883f9fd5a278e61c471b3ee1826396b6d129499aa7","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6582a5969988a358780b9c01"}]},{"name":"AgJorBrbq.html","sha256":"5c8486f79370c19109d2718658f60c95a923eb519e7aba3dbae466b8df0814ad","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6582a5969988a358780b9c01"}]},{"name":"BJGIC..kG.html","sha256":"8a59fa5c778bbbc11fa2ffeac756a5932ae75f618bcf1551449e1d6a987e9ce0","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6582a5969988a358780b9c01"}]},{"name":"BKaEvgIpa.html","sha256":"1afba72ecbcdd5505ccf38b39b1234ae8a93ed0adbb1a81fd986ebb13ccbfd6c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6582a5969988a358780b9c01"}]},{"name":"Bpqb.JkcD.html","sha256":"2c1d3d36719483efb3cfe6e84aa674ff905ba5e2eb45db51493ca5c9a278983a","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6582a5969988a358780b9c01"}]},{"name":"Kr.izfJwD.html","sha256":"01e9f1c072ff3ca586ed205cb0057ab005764ee831db7250153f82b9d454b41e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6582a5969988a358780b9c01"}]},{"name":"1IWBPZK8.txt","sha256":"70085a786b7be7e86bac42000ee3b98768c01aee4f61c745ad1fe8ac867cabf1","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6582a5969988a358780b9c01"}]},{"name":"1XEVUL8K.txt","sha256":"ef3934dbc6ee6b8eb619e248df7aaafb8d8fe8796ad9eddd4eec8e42613c4dbd","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6582a5969988a358780b9c01"}]},{"name":"1XN956B2.txt","sha256":"4a02ff6a8d9eb70746e75a447b3600ba28c66f3c08737595f530a70013ad5e51","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6582a5969988a358780b9c01"}]},{"name":"2WHB8WHY.txt","sha256":"eda195a3016817aed99814c839136056dde3496754000850aeb35f067937e0de","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6582a5969988a358780b9c01"}]},{"name":"2Y1UOUTR.txt","sha256":"7c23902027731265f08beb00eb97c1fb0711a2b5eaf5039bb08f74fa7e0820fc","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6582a5969988a358780b9c01"}]},{"name":"45CDC0ZZ.txt","sha256":"5accdd83e10125da625e6719da81028ece59e89a533e69ee099bcea61a46f18b","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6582a5969988a358780b9c01"}]},{"name":"53P3JUA9.txt","sha256":"235da04e12b631015df30a47b67eff381a602e2c05ab4883ff6911af9d02ea28","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6582a5969988a358780b9c01"}]},{"name":"57T178LE.txt","sha256":"ee7b87ca2eb07dfa1959c566c7a077f2105bb283223fba8ed9a918c1aa27d38e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6582a5969988a358780b9c01"}]},{"name":"5Q5IHRUF.txt","sha256":"fc37bbe3a84800dd0e0a1fa587af5e6cd8c6095368a68068970248167529678e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6582a5969988a358780b9c01"}]},{"name":"62QETUPD.txt","sha256":"bbfdf3ff6ee02ea4deb74addf1103bdff094b66bfefc3bee849781fbdd0e706d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6582a5969988a358780b9c01"}]},{"name":"671K1UJC.txt","sha256":"0b1c01d22165264a8c2d09123b117b169287f12ced0a705fae0613817893cf8c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6582a5969988a358780b9c01"}]},{"name":"729BIX74.txt","sha256":"1b5d8b1f2c40fc70b6204be9ad2f31a06a9408f92849b169a403f8ab2df54cf6","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6582a5969988a358780b9c01"}]},{"name":"72RSLA11.txt","sha256":"01e0a517d92c05a1e45af4ec47df3d72bc001ce399b96de23f4c70d96bfb519d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6582a5969988a358780b9c01"}]},{"name":"76Q2CQTV.txt","sha256":"d9cc77c9de576343b847652696cdd2064a5787e346b3cff7d21fc92180fb689d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6582a5969988a358780b9c01"}]},{"name":"7TAMG3JZ.txt","sha256":"303c4137ef801d3f01fa2cda85e57c1902470c8b813a2e0dbd8d49ae53ea4b5a","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6582a5969988a358780b9c01"}]}],"files_written":[{"path":"\\FileSystem\\Filters\\FltMgrMsg","sources":[{"report_type":"sandbox","report_id":"6582a5969988a358780b9c01"}]},{"path":"%SAMPLEDIR%\\Users\\%OSUSER%","sources":[{"report_type":"sandbox","report_id":"6582a5969988a358780b9c01"}]},{"path":"%USERPROFILE%\\AppData\\Roaming","sources":[{"report_type":"sandbox","report_id":"6582a5969988a358780b9c01"}]},{"path":"%APPDATA%\\jKWUyswkzQirl.exe","sources":[{"report_type":"sandbox","report_id":"6582a5969988a358780b9c01"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches","sources":[{"report_type":"sandbox","report_id":"6582a5969988a358780b9c01"}]},{"path":"%TEMP%\\tmpB818.tmp","sources":[{"report_type":"sandbox","report_id":"6582a5969988a358780b9c01"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Recent\\CustomDestinations","sources":[{"report_type":"sandbox","report_id":"6582a5969988a358780b9c01"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Recent\\CustomDestinations\\3BE8EOGDG52GSP4U1A2M.temp","sources":[{"report_type":"sandbox","report_id":"6582a5969988a358780b9c01"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Recent\\CustomDestinations\\d93f411851d7c929.customDestinations-ms~RFfbf87.TMP","sources":[{"report_type":"sandbox","report_id":"6582a5969988a358780b9c01"}]},{"path":"%USERPROFILE%\\Documents","sources":[{"report_type":"sandbox","report_id":"6582a5969988a358780b9c01"}]},{"path":"%USERPROFILE%\\Documents\\Bins.exe","sources":[{"report_type":"sandbox","report_id":"6582a5969988a358780b9c01"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Recent\\CustomDestinations\\AA4C3E12YSM4DQOI38RG.temp","sources":[{"report_type":"sandbox","report_id":"6582a5969988a358780b9c01"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Recent\\CustomDestinations\\d93f411851d7c929.customDestinations-ms~RFfdb51.TMP","sources":[{"report_type":"sandbox","report_id":"6582a5969988a358780b9c01"}]},{"path":"%TEMP%\\tmpEB38.tmp","sources":[{"report_type":"sandbox","report_id":"6582a5969988a358780b9c01"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Recent\\CustomDestinations\\G9MN6ACIZCS3MSM453C6.temp","sources":[{"report_type":"sandbox","report_id":"6582a5969988a358780b9c01"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Recent\\CustomDestinations\\d93f411851d7c929.customDestinations-ms~RFff41e.TMP","sources":[{"report_type":"sandbox","report_id":"6582a5969988a358780b9c01"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{E29AC6C2-7037-11DE-816D-806E6F6E6963}","sources":[{"report_type":"sandbox","report_id":"6582a5969988a358780b9c01"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{F5E5586C-DA91-47DA-AEAC-0A88CD2FFB01}","sources":[{"report_type":"sandbox","report_id":"6582a5969988a358780b9c01"}]},{"path":"%PROGRAMFILES%\\Microsoft DN1","sources":[{"report_type":"sandbox","report_id":"6582a5969988a358780b9c01"}]},{"path":"%LOCALAPPDATA%\\Microsoft Vision","sources":[{"report_type":"sandbox","report_id":"6582a5969988a358780b9c01"}]},{"path":"%LOCALAPPDATA%\\Microsoft Vision\\20-12-2023_08.37.24","sources":[{"report_type":"sandbox","report_id":"6582a5969988a358780b9c01"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\counters.dat","sources":[{"report_type":"sandbox","report_id":"6582a5969988a358780b9c01"}]},{"path":"%USERPROFILE%\\AppData\\Local","sources":[{"report_type":"sandbox","report_id":"6582a5969988a358780b9c01"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files","sources":[{"report_type":"sandbox","report_id":"6582a5969988a358780b9c01"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies","sources":[{"report_type":"sandbox","report_id":"6582a5969988a358780b9c01"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\History","sources":[{"report_type":"sandbox","report_id":"6582a5969988a358780b9c01"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\57C8EDB95DF3F0AD4EE2DC2B8CFD4157","sources":[{"report_type":"sandbox","report_id":"6582a5969988a358780b9c01"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\Content\\57C8EDB95DF3F0AD4EE2DC2B8CFD4157","sources":[{"report_type":"sandbox","report_id":"6582a5969988a358780b9c01"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\B398B80134F72209547439DB21AB308D_23FFFDCAABB8E63694AD1202ED02BF57","sources":[{"report_type":"sandbox","report_id":"6582a5969988a358780b9c01"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\Content\\B398B80134F72209547439DB21AB308D_23FFFDCAABB8E63694AD1202ED02BF57","sources":[{"report_type":"sandbox","report_id":"6582a5969988a358780b9c01"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\14561BF7422BB6F70A9CB14F5AA8A7DA_582DC597430784041BB93D3718D1C412","sources":[{"report_type":"sandbox","report_id":"6582a5969988a358780b9c01"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\Content\\14561BF7422BB6F70A9CB14F5AA8A7DA_582DC597430784041BB93D3718D1C412","sources":[{"report_type":"sandbox","report_id":"6582a5969988a358780b9c01"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\10DBD584E0BEA56315CB62A032695FDD","sources":[{"report_type":"sandbox","report_id":"6582a5969988a358780b9c01"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\Content\\10DBD584E0BEA56315CB62A032695FDD","sources":[{"report_type":"sandbox","report_id":"6582a5969988a358780b9c01"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\5A61F5EE954AF7C40FE1289BACE2A6BA","sources":[{"report_type":"sandbox","report_id":"6582a5969988a358780b9c01"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\Content\\5A61F5EE954AF7C40FE1289BACE2A6BA","sources":[{"report_type":"sandbox","report_id":"6582a5969988a358780b9c01"}]},{"path":"%TEMP%\\24.exe","sources":[{"report_type":"sandbox","report_id":"6582a5969988a358780b9c01"}]},{"path":"%LOCALAPPDATA%\\Microsoft Vision\\20-12-2023_10.15.06","sources":[{"report_type":"sandbox","report_id":"6582a5969988a358780b9c01"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\AQXZ51L9.txt","sources":[{"report_type":"sandbox","report_id":"6582a5969988a358780b9c01"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\CKDNCXYS\\Bins.exe[1].htm","sources":[{"report_type":"sandbox","report_id":"6582a5969988a358780b9c01"}]},{"path":"%APPDATA%\\pbE.hwspK.html","sources":[{"report_type":"sandbox","report_id":"6582a5969988a358780b9c01"}]},{"path":"%LOCALAPPDATA%\\Microsoft Vision\\20-12-2023_10.31.10","sources":[{"report_type":"sandbox","report_id":"6582a5969988a358780b9c01"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\IC220FVW.txt","sources":[{"report_type":"sandbox","report_id":"6582a5969988a358780b9c01"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\CKDNCXYS\\Bins.exe[2].htm","sources":[{"report_type":"sandbox","report_id":"6582a5969988a358780b9c01"}]},{"path":"%APPDATA%\\rsmkwycme.html","sources":[{"report_type":"sandbox","report_id":"6582a5969988a358780b9c01"}]},{"path":"%LOCALAPPDATA%\\Microsoft Vision\\20-12-2023_10.45.16","sources":[{"report_type":"sandbox","report_id":"6582a5969988a358780b9c01"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\GQ7QXDFJ.txt","sources":[{"report_type":"sandbox","report_id":"6582a5969988a358780b9c01"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\CKDNCXYS\\Bins.exe[3].htm","sources":[{"report_type":"sandbox","report_id":"6582a5969988a358780b9c01"}]},{"path":"%APPDATA%\\jyo.rquAu.html","sources":[{"report_type":"sandbox","report_id":"6582a5969988a358780b9c01"}]},{"path":"%LOCALAPPDATA%\\Microsoft Vision\\20-12-2023_10.56.21","sources":[{"report_type":"sandbox","report_id":"6582a5969988a358780b9c01"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\NLO302O4.txt","sources":[{"report_type":"sandbox","report_id":"6582a5969988a358780b9c01"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\CKDNCXYS\\Bins.exe[4].htm","sources":[{"report_type":"sandbox","report_id":"6582a5969988a358780b9c01"}]},{"path":"%APPDATA%\\BJGIC..kG.html","sources":[{"report_type":"sandbox","report_id":"6582a5969988a358780b9c01"}]},{"path":"%LOCALAPPDATA%\\Microsoft Vision\\20-12-2023_11.10.27","sources":[{"report_type":"sandbox","report_id":"6582a5969988a358780b9c01"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\TXJHZOCB.txt","sources":[{"report_type":"sandbox","report_id":"6582a5969988a358780b9c01"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\CKDNCXYS\\Bins.exe[5].htm","sources":[{"report_type":"sandbox","report_id":"6582a5969988a358780b9c01"}]},{"path":"%APPDATA%\\vHImy.oGI.html","sources":[{"report_type":"sandbox","report_id":"6582a5969988a358780b9c01"}]},{"path":"%LOCALAPPDATA%\\Microsoft Vision\\20-12-2023_11.30.33","sources":[{"report_type":"sandbox","report_id":"6582a5969988a358780b9c01"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\WG7M7SQ2.txt","sources":[{"report_type":"sandbox","report_id":"6582a5969988a358780b9c01"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\CKDNCXYS\\Bins.exe[6].htm","sources":[{"report_type":"sandbox","report_id":"6582a5969988a358780b9c01"}]},{"path":"%APPDATA%\\bxlKf.hho.html","sources":[{"report_type":"sandbox","report_id":"6582a5969988a358780b9c01"}]},{"path":"%LOCALAPPDATA%\\Microsoft Vision\\20-12-2023_11.51.40","sources":[{"report_type":"sandbox","report_id":"6582a5969988a358780b9c01"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\8KCLP7LC.txt","sources":[{"report_type":"sandbox","report_id":"6582a5969988a358780b9c01"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\CKDNCXYS\\Bins.exe[7].htm","sources":[{"report_type":"sandbox","report_id":"6582a5969988a358780b9c01"}]},{"path":"%APPDATA%\\k.hufeesg.html","sources":[{"report_type":"sandbox","report_id":"6582a5969988a358780b9c01"}]},{"path":"%LOCALAPPDATA%\\Microsoft Vision\\20-12-2023_12.23.49","sources":[{"report_type":"sandbox","report_id":"6582a5969988a358780b9c01"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\1IWBPZK8.txt","sources":[{"report_type":"sandbox","report_id":"6582a5969988a358780b9c01"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\CKDNCXYS\\Bins.exe[8].htm","sources":[{"report_type":"sandbox","report_id":"6582a5969988a358780b9c01"}]},{"path":"%APPDATA%\\xIDknlGKD.html","sources":[{"report_type":"sandbox","report_id":"6582a5969988a358780b9c01"}]},{"path":"%LOCALAPPDATA%\\Microsoft Vision\\20-12-2023_12.46.55","sources":[{"report_type":"sandbox","report_id":"6582a5969988a358780b9c01"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\KA67ZOSZ.txt","sources":[{"report_type":"sandbox","report_id":"6582a5969988a358780b9c01"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\CKDNCXYS\\Bins.exe[9].htm","sources":[{"report_type":"sandbox","report_id":"6582a5969988a358780b9c01"}]},{"path":"%APPDATA%\\Bpqb.JkcD.html","sources":[{"report_type":"sandbox","report_id":"6582a5969988a358780b9c01"}]},{"path":"%LOCALAPPDATA%\\Microsoft Vision\\20-12-2023_13.09.00","sources":[{"report_type":"sandbox","report_id":"6582a5969988a358780b9c01"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\76Q2CQTV.txt","sources":[{"report_type":"sandbox","report_id":"6582a5969988a358780b9c01"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\CKDNCXYS\\Bins.exe[10].htm","sources":[{"report_type":"sandbox","report_id":"6582a5969988a358780b9c01"}]},{"path":"%APPDATA%\\geCvFhdly.html","sources":[{"report_type":"sandbox","report_id":"6582a5969988a358780b9c01"}]},{"path":"%LOCALAPPDATA%\\Microsoft Vision\\20-12-2023_13.28.05","sources":[{"report_type":"sandbox","report_id":"6582a5969988a358780b9c01"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\A7ICG9N7.txt","sources":[{"report_type":"sandbox","report_id":"6582a5969988a358780b9c01"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\CKDNCXYS\\Bins.exeYMCPTPB2.htm","sources":[{"report_type":"sandbox","report_id":"6582a5969988a358780b9c01"}]},{"path":"%APPDATA%\\AgJorBrbq.html","sources":[{"report_type":"sandbox","report_id":"6582a5969988a358780b9c01"}]},{"path":"%LOCALAPPDATA%\\Microsoft Vision\\20-12-2023_13.53.11","sources":[{"report_type":"sandbox","report_id":"6582a5969988a358780b9c01"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\KBDGTSMY.txt","sources":[{"report_type":"sandbox","report_id":"6582a5969988a358780b9c01"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\CKDNCXYS\\Bins.exeH8Q8AAI4.htm","sources":[{"report_type":"sandbox","report_id":"6582a5969988a358780b9c01"}]},{"path":"%APPDATA%\\msmqzCpGg.html","sources":[{"report_type":"sandbox","report_id":"6582a5969988a358780b9c01"}]},{"path":"%LOCALAPPDATA%\\Microsoft Vision\\20-12-2023_14.11.17","sources":[{"report_type":"sandbox","report_id":"6582a5969988a358780b9c01"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\671K1UJC.txt","sources":[{"report_type":"sandbox","report_id":"6582a5969988a358780b9c01"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\CKDNCXYS\\Bins.exe1W1Y6NRZ.htm","sources":[{"report_type":"sandbox","report_id":"6582a5969988a358780b9c01"}]},{"path":"%APPDATA%\\BKaEvgIpa.html","sources":[{"report_type":"sandbox","report_id":"6582a5969988a358780b9c01"}]},{"path":"%LOCALAPPDATA%\\Microsoft Vision\\20-12-2023_14.38.23","sources":[{"report_type":"sandbox","report_id":"6582a5969988a358780b9c01"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\C647FVRG.txt","sources":[{"report_type":"sandbox","report_id":"6582a5969988a358780b9c01"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\CKDNCXYS\\Bins.exe3HPTP0JI.htm","sources":[{"report_type":"sandbox","report_id":"6582a5969988a358780b9c01"}]},{"path":"%APPDATA%\\jtiAoryjf.html","sources":[{"report_type":"sandbox","report_id":"6582a5969988a358780b9c01"}]},{"path":"%LOCALAPPDATA%\\Microsoft Vision\\20-12-2023_15.29.10","sources":[{"report_type":"sandbox","report_id":"6582a5969988a358780b9c01"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\JAH50LP7.txt","sources":[{"report_type":"sandbox","report_id":"6582a5969988a358780b9c01"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\CKDNCXYS\\Bins.exeR1XAC8XB.htm","sources":[{"report_type":"sandbox","report_id":"6582a5969988a358780b9c01"}]},{"path":"%APPDATA%\\Kr.izfJwD.html","sources":[{"report_type":"sandbox","report_id":"6582a5969988a358780b9c01"}]},{"path":"%LOCALAPPDATA%\\Microsoft Vision\\20-12-2023_15.43.15","sources":[{"report_type":"sandbox","report_id":"6582a5969988a358780b9c01"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\SAGYOVRX.txt","sources":[{"report_type":"sandbox","report_id":"6582a5969988a358780b9c01"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\CKDNCXYS\\Bins.exeC5PWJOFT.htm","sources":[{"report_type":"sandbox","report_id":"6582a5969988a358780b9c01"}]},{"path":"%APPDATA%\\aBDpxmlsx.html","sources":[{"report_type":"sandbox","report_id":"6582a5969988a358780b9c01"}]},{"path":"%LOCALAPPDATA%\\Microsoft Vision\\20-12-2023_15.57.20","sources":[{"report_type":"sandbox","report_id":"6582a5969988a358780b9c01"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\DAVDZF12.txt","sources":[{"report_type":"sandbox","report_id":"6582a5969988a358780b9c01"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\CKDNCXYS\\Bins.exeO9BQ360L.htm","sources":[{"report_type":"sandbox","report_id":"6582a5969988a358780b9c01"}]},{"path":"%APPDATA%\\wpjGGdCdB.html","sources":[{"report_type":"sandbox","report_id":"6582a5969988a358780b9c01"}]},{"path":"%LOCALAPPDATA%\\Microsoft Vision\\20-12-2023_16.23.27","sources":[{"report_type":"sandbox","report_id":"6582a5969988a358780b9c01"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\X8JT3PTS.txt","sources":[{"report_type":"sandbox","report_id":"6582a5969988a358780b9c01"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\CKDNCXYS\\Bins.exePTZ3OQB5.htm","sources":[{"report_type":"sandbox","report_id":"6582a5969988a358780b9c01"}]},{"path":"%APPDATA%\\nkthpFinK.html","sources":[{"report_type":"sandbox","report_id":"6582a5969988a358780b9c01"}]},{"path":"%LOCALAPPDATA%\\Microsoft Vision\\20-12-2023_16.51.34","sources":[{"report_type":"sandbox","report_id":"6582a5969988a358780b9c01"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\VP67MEOI.txt","sources":[{"report_type":"sandbox","report_id":"6582a5969988a358780b9c01"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\CKDNCXYS\\Bins.exeBE3A2KOT.htm","sources":[{"report_type":"sandbox","report_id":"6582a5969988a358780b9c01"}]},{"path":"%APPDATA%\\aHmJKtizD.html","sources":[{"report_type":"sandbox","report_id":"6582a5969988a358780b9c01"}]},{"path":"%LOCALAPPDATA%\\Microsoft Vision\\20-12-2023_17.31.44","sources":[{"report_type":"sandbox","report_id":"6582a5969988a358780b9c01"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\KHN8SD5G.txt","sources":[{"report_type":"sandbox","report_id":"6582a5969988a358780b9c01"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\CKDNCXYS\\Bins.exeRRI4IE3C.htm","sources":[{"report_type":"sandbox","report_id":"6582a5969988a358780b9c01"}]},{"path":"%APPDATA%\\uyspfppby.html","sources":[{"report_type":"sandbox","report_id":"6582a5969988a358780b9c01"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Recent\\CustomDestinations\\JG67KFSNSMUDX5M0WHCA.temp","sources":[{"report_type":"sandbox","report_id":"6582a5969988a358780b9c01"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Recent\\CustomDestinations\\d93f411851d7c929.customDestinations-ms~RF100b07.TMP","sources":[{"report_type":"sandbox","report_id":"6582a5969988a358780b9c01"}]},{"path":"%USERPROFILE%\\Favorites","sources":[{"report_type":"sandbox","report_id":"6582a5969988a358780b9c01"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\PrivacIE","sources":[{"report_type":"sandbox","report_id":"6582a5969988a358780b9c01"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\DNTException","sources":[{"report_type":"sandbox","report_id":"6582a5969988a358780b9c01"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\IECompatCache","sources":[{"report_type":"sandbox","report_id":"6582a5969988a358780b9c01"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\IECompatUACache","sources":[{"report_type":"sandbox","report_id":"6582a5969988a358780b9c01"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\Recovery\\High\\Active","sources":[{"report_type":"sandbox","report_id":"6582a5969988a358780b9c01"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\Recovery\\High\\Active\\RecoveryStore.{1A04051D-9F19-11EE-83AB-005056918117}.dat","sources":[{"report_type":"sandbox","report_id":"6582a5969988a358780b9c01"}]},{"path":"%TEMP%\\~DF43C6FFCEA18BB4B1.TMP","sources":[{"report_type":"sandbox","report_id":"6582a5969988a358780b9c01"}]},{"path":"%TEMP%\\JavaDeployReg.log","sources":[{"report_type":"sandbox","report_id":"6582a5969988a358780b9c01"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKLMHKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\TIMEZONEINFORMATION\\","sources":[{"report_type":"sandbox","report_id":"6582a5969988a358780b9c01"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\GDIPLUS\\","sources":[{"report_type":"sandbox","report_id":"6582a5969988a358780b9c01"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\","sources":[{"report_type":"sandbox","report_id":"6582a5969988a358780b9c01"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\WINTRUST\\TRUST PROVIDERS\\SOFTWARE PUBLISHING\\","sources":[{"report_type":"sandbox","report_id":"6582a5969988a358780b9c01"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\MY\\","sources":[{"report_type":"sandbox","report_id":"6582a5969988a358780b9c01"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\","sources":[{"report_type":"sandbox","report_id":"6582a5969988a358780b9c01"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"6582a5969988a358780b9c01"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"6582a5969988a358780b9c01"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"6582a5969988a358780b9c01"}]},{"key":"HKCUHKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\","sources":[{"report_type":"sandbox","report_id":"6582a5969988a358780b9c01"}]},{"key":"HKCUHKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"6582a5969988a358780b9c01"}]},{"key":"HKCUHKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"6582a5969988a358780b9c01"}]},{"key":"HKCUHKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"6582a5969988a358780b9c01"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\","sources":[{"report_type":"sandbox","report_id":"6582a5969988a358780b9c01"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"6582a5969988a358780b9c01"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"6582a5969988a358780b9c01"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"6582a5969988a358780b9c01"}]},{"key":"HKLMHKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\","sources":[{"report_type":"sandbox","report_id":"6582a5969988a358780b9c01"}]},{"key":"HKLMHKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"6582a5969988a358780b9c01"}]},{"key":"HKLMHKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"6582a5969988a358780b9c01"}]},{"key":"HKLMHKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"6582a5969988a358780b9c01"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\ENTERPRISECERTIFICATES\\CA\\","sources":[{"report_type":"sandbox","report_id":"6582a5969988a358780b9c01"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\ENTERPRISECERTIFICATES\\CA\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"6582a5969988a358780b9c01"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\ENTERPRISECERTIFICATES\\CA\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"6582a5969988a358780b9c01"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\ENTERPRISECERTIFICATES\\CA\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"6582a5969988a358780b9c01"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\","sources":[{"report_type":"sandbox","report_id":"6582a5969988a358780b9c01"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"6582a5969988a358780b9c01"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"6582a5969988a358780b9c01"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"6582a5969988a358780b9c01"}]},{"key":"HKCUHKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\","sources":[{"report_type":"sandbox","report_id":"6582a5969988a358780b9c01"}]},{"key":"HKCUHKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"6582a5969988a358780b9c01"}]},{"key":"HKCUHKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"6582a5969988a358780b9c01"}]},{"key":"HKCUHKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"6582a5969988a358780b9c01"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\","sources":[{"report_type":"sandbox","report_id":"6582a5969988a358780b9c01"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"6582a5969988a358780b9c01"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"6582a5969988a358780b9c01"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"6582a5969988a358780b9c01"}]},{"key":"HKLMHKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\","sources":[{"report_type":"sandbox","report_id":"6582a5969988a358780b9c01"}]},{"key":"HKLMHKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"6582a5969988a358780b9c01"}]},{"key":"HKLMHKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"6582a5969988a358780b9c01"}]},{"key":"HKLMHKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"6582a5969988a358780b9c01"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\ENTERPRISECERTIFICATES\\DISALLOWED\\","sources":[{"report_type":"sandbox","report_id":"6582a5969988a358780b9c01"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\ENTERPRISECERTIFICATES\\DISALLOWED\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"6582a5969988a358780b9c01"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\ENTERPRISECERTIFICATES\\DISALLOWED\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"6582a5969988a358780b9c01"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\ENTERPRISECERTIFICATES\\DISALLOWED\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"6582a5969988a358780b9c01"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\ROOT\\","sources":[{"report_type":"sandbox","report_id":"6582a5969988a358780b9c01"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\ROOT\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"6582a5969988a358780b9c01"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\ROOT\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"6582a5969988a358780b9c01"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\ROOT\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"6582a5969988a358780b9c01"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\ROOT\\","sources":[{"report_type":"sandbox","report_id":"6582a5969988a358780b9c01"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\ROOT\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"6582a5969988a358780b9c01"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\ROOT\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"6582a5969988a358780b9c01"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\ROOT\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"6582a5969988a358780b9c01"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\AUTHROOT\\","sources":[{"report_type":"sandbox","report_id":"6582a5969988a358780b9c01"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\AUTHROOT\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"6582a5969988a358780b9c01"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\SMARTCARDROOT\\","sources":[{"report_type":"sandbox","report_id":"6582a5969988a358780b9c01"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\SMARTCARDROOT\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"6582a5969988a358780b9c01"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\SMARTCARDROOT\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"6582a5969988a358780b9c01"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\SMARTCARDROOT\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"6582a5969988a358780b9c01"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\TRUSTEDPEOPLE\\","sources":[{"report_type":"sandbox","report_id":"6582a5969988a358780b9c01"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\TRUSTEDPEOPLE\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"6582a5969988a358780b9c01"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\TRUSTEDPEOPLE\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"6582a5969988a358780b9c01"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\TRUSTEDPEOPLE\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"6582a5969988a358780b9c01"}]},{"key":"HKCUHKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\TRUSTEDPEOPLE\\","sources":[{"report_type":"sandbox","report_id":"6582a5969988a358780b9c01"}]},{"key":"HKCUHKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\TRUSTEDPEOPLE\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"6582a5969988a358780b9c01"}]},{"key":"HKCUHKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\TRUSTEDPEOPLE\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"6582a5969988a358780b9c01"}]},{"key":"HKCUHKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\TRUSTEDPEOPLE\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"6582a5969988a358780b9c01"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\TRUST\\","sources":[{"report_type":"sandbox","report_id":"6582a5969988a358780b9c01"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\TRUST\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"6582a5969988a358780b9c01"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\TRUST\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"6582a5969988a358780b9c01"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\TRUST\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"6582a5969988a358780b9c01"}]},{"key":"HKCUHKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\TRUST\\","sources":[{"report_type":"sandbox","report_id":"6582a5969988a358780b9c01"}]},{"key":"HKCUHKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\TRUST\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"6582a5969988a358780b9c01"}]},{"key":"HKCUHKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\TRUST\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"6582a5969988a358780b9c01"}]},{"key":"HKCUHKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\TRUST\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"6582a5969988a358780b9c01"}]},{"key":"HKLMHKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\SECURITYPROVIDERS\\SCHANNEL\\","sources":[{"report_type":"sandbox","report_id":"6582a5969988a358780b9c01"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\CONNECTIONS\\","sources":[{"report_type":"sandbox","report_id":"6582a5969988a358780b9c01"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\INTERNET EXPLORER\\TOOLBAR\\","sources":[{"report_type":"sandbox","report_id":"6582a5969988a358780b9c01"}]},{"key":"HKLMHKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\TCPIP\\PARAMETERS\\","sources":[{"report_type":"sandbox","report_id":"6582a5969988a358780b9c01"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\TRUSTEDPEOPLE\\","sources":[{"report_type":"sandbox","report_id":"6582a5969988a358780b9c01"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\TRUSTEDPEOPLE\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"6582a5969988a358780b9c01"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\TRUSTEDPEOPLE\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"6582a5969988a358780b9c01"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\TRUSTEDPEOPLE\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"6582a5969988a358780b9c01"}]},{"key":"HKLMHKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\TRUSTEDPEOPLE\\","sources":[{"report_type":"sandbox","report_id":"6582a5969988a358780b9c01"}]},{"key":"HKLMHKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\TRUSTEDPEOPLE\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"6582a5969988a358780b9c01"}]},{"key":"HKLMHKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\TRUSTEDPEOPLE\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"6582a5969988a358780b9c01"}]},{"key":"HKLMHKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\TRUSTEDPEOPLE\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"6582a5969988a358780b9c01"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\ENTERPRISECERTIFICATES\\TRUSTEDPEOPLE\\","sources":[{"report_type":"sandbox","report_id":"6582a5969988a358780b9c01"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\ENTERPRISECERTIFICATES\\TRUSTEDPEOPLE\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"6582a5969988a358780b9c01"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\ENTERPRISECERTIFICATES\\TRUSTEDPEOPLE\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"6582a5969988a358780b9c01"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\ENTERPRISECERTIFICATES\\TRUSTEDPEOPLE\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"6582a5969988a358780b9c01"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\TRUST\\","sources":[{"report_type":"sandbox","report_id":"6582a5969988a358780b9c01"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\TRUST\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"6582a5969988a358780b9c01"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\TRUST\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"6582a5969988a358780b9c01"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\TRUST\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"6582a5969988a358780b9c01"}]},{"key":"HKLMHKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\TRUST\\","sources":[{"report_type":"sandbox","report_id":"6582a5969988a358780b9c01"}]},{"key":"HKLMHKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\TRUST\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"6582a5969988a358780b9c01"}]},{"key":"HKLMHKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\TRUST\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"6582a5969988a358780b9c01"}]},{"key":"HKLMHKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\TRUST\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"6582a5969988a358780b9c01"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\ENTERPRISECERTIFICATES\\TRUST\\","sources":[{"report_type":"sandbox","report_id":"6582a5969988a358780b9c01"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\ENTERPRISECERTIFICATES\\TRUST\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"6582a5969988a358780b9c01"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\ENTERPRISECERTIFICATES\\TRUST\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"6582a5969988a358780b9c01"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\ENTERPRISECERTIFICATES\\TRUST\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"6582a5969988a358780b9c01"}]}],"keys_modified":null,"keys_deleted":[{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\PROXYSERVER\\PROXYSERVER","sources":[{"report_type":"sandbox","report_id":"6582a5969988a358780b9c01"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\PROXYOVERRIDE\\PROXYOVERRIDE","sources":[{"report_type":"sandbox","report_id":"6582a5969988a358780b9c01"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\AUTOCONFIGURL\\AUTOCONFIGURL","sources":[{"report_type":"sandbox","report_id":"6582a5969988a358780b9c01"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\AUTODETECT\\AUTODETECT","sources":[{"report_type":"sandbox","report_id":"6582a5969988a358780b9c01"}]}]},"mutex_activity":{"mutex_created":[{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"6582a5969988a358780b9c01"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"6582a5969988a358780b9c01"}]},{"name":"wCmaRNDImhXHxGmGVOzXIIJuX","sources":[{"report_type":"sandbox","report_id":"6582a5969988a358780b9c01"}]},{"name":"Global\\CLR_PerfMon_WrapMutex","sources":[{"report_type":"sandbox","report_id":"6582a5969988a358780b9c01"}]},{"name":"Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"6582a5969988a358780b9c01"}]},{"name":"Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"6582a5969988a358780b9c01"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Global\\CLR_PerfMon_WrapMutex","sources":[{"report_type":"sandbox","report_id":"6582a5969988a358780b9c01"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\wCmaRNDImhXHxGmGVOzXIIJuX","sources":[{"report_type":"sandbox","report_id":"6582a5969988a358780b9c01"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\_SHuassist.mtx","sources":[{"report_type":"sandbox","report_id":"6582a5969988a358780b9c01"}]},{"name":"_SHuassist.mtx","sources":[{"report_type":"sandbox","report_id":"6582a5969988a358780b9c01"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\eed3bd3a-a1ad-4e99-987b-d7cb3fcfa7f0 - S-1-5-21-2092356043-4041700817-663127204-1001","sources":[{"report_type":"sandbox","report_id":"6582a5969988a358780b9c01"}]},{"name":"eed3bd3a-a1ad-4e99-987b-d7cb3fcfa7f0 - S-1-5-21-2092356043-4041700817-663127204-1001","sources":[{"report_type":"sandbox","report_id":"6582a5969988a358780b9c01"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\RasPbFile","sources":[{"report_type":"sandbox","report_id":"6582a5969988a358780b9c01"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Global\\3a886eb8-fe40-4d0a-b78b-9e0bcb683fb7","sources":[{"report_type":"sandbox","report_id":"6582a5969988a358780b9c01"}]},{"name":"RasPbFile","sources":[{"report_type":"sandbox","report_id":"6582a5969988a358780b9c01"}]},{"name":"Global\\3a886eb8-fe40-4d0a-b78b-9e0bcb683fb7","sources":[{"report_type":"sandbox","report_id":"6582a5969988a358780b9c01"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\IsoScope_b80_IESQMMUTEX_0_519","sources":[{"report_type":"sandbox","report_id":"6582a5969988a358780b9c01"}]},{"name":"IsoScope_b80_IESQMMUTEX_0_303","sources":[{"report_type":"sandbox","report_id":"6582a5969988a358780b9c01"}]},{"name":"{5312EE61-79E3-4A24-BFE1-132B85B23C3A}","sources":[{"report_type":"sandbox","report_id":"6582a5969988a358780b9c01"}]},{"name":"IsoScope_b80_IESQMMUTEX_0_331","sources":[{"report_type":"sandbox","report_id":"6582a5969988a358780b9c01"}]},{"name":"Local\\VERMGMTBlockListFileMutex","sources":[{"report_type":"sandbox","report_id":"6582a5969988a358780b9c01"}]},{"name":"UpdatingNewTabPageData","sources":[{"report_type":"sandbox","report_id":"6582a5969988a358780b9c01"}]},{"name":"IsoScope_b80_IESQMMUTEX_0_519","sources":[{"report_type":"sandbox","report_id":"6582a5969988a358780b9c01"}]},{"name":"Local\\!BrowserEmulation!SharedMemory!Mutex","sources":[{"report_type":"sandbox","report_id":"6582a5969988a358780b9c01"}]},{"name":"Local\\URLBLOCK_FILEMAPSWITCH_MUTEX_2944","sources":[{"report_type":"sandbox","report_id":"6582a5969988a358780b9c01"}]},{"name":"IsoScope_b80_ConnHashTable<2944>_HashTable_Mutex","sources":[{"report_type":"sandbox","report_id":"6582a5969988a358780b9c01"}]},{"name":"Local\\URLBLOCK_HASHFILESWITCH_MUTEX","sources":[{"report_type":"sandbox","report_id":"6582a5969988a358780b9c01"}]},{"name":"IsoScope_b80_IE_EarlyTabStart_0xe58_Mutex","sources":[{"report_type":"sandbox","report_id":"6582a5969988a358780b9c01"}]},{"name":"Local\\URLBLOCK_DOWNLOAD_MUTEX","sources":[{"report_type":"sandbox","report_id":"6582a5969988a358780b9c01"}]},{"name":"{66D0969A-1E86-44CF-B4EC-3806DDDA3B5D}","sources":[{"report_type":"sandbox","report_id":"6582a5969988a358780b9c01"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\UpdatingNewTabPageData","sources":[{"report_type":"sandbox","report_id":"6582a5969988a358780b9c01"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\!BrowserEmulation!SharedMemory!Mutex","sources":[{"report_type":"sandbox","report_id":"6582a5969988a358780b9c01"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\VERMGMTBlockListFileMutex","sources":[{"report_type":"sandbox","report_id":"6582a5969988a358780b9c01"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\URLBLOCK_FILEMAPSWITCH_MUTEX_2944","sources":[{"report_type":"sandbox","report_id":"6582a5969988a358780b9c01"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\URLBLOCK_HASHFILESWITCH_MUTEX","sources":[{"report_type":"sandbox","report_id":"6582a5969988a358780b9c01"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\URLBLOCK_DOWNLOAD_MUTEX","sources":[{"report_type":"sandbox","report_id":"6582a5969988a358780b9c01"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\IsoScope_b80_IE_EarlyTabStart_0xe58_Mutex","sources":[{"report_type":"sandbox","report_id":"6582a5969988a358780b9c01"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\IsoScope_b80_ConnHashTable<2944>_HashTable_Mutex","sources":[{"report_type":"sandbox","report_id":"6582a5969988a358780b9c01"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\{5312EE61-79E3-4A24-BFE1-132B85B23C3A}","sources":[{"report_type":"sandbox","report_id":"6582a5969988a358780b9c01"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\IsoScope_b80_IESQMMUTEX_0_303","sources":[{"report_type":"sandbox","report_id":"6582a5969988a358780b9c01"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\IsoScope_b80_IESQMMUTEX_0_331","sources":[{"report_type":"sandbox","report_id":"6582a5969988a358780b9c01"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\{66D0969A-1E86-44CF-B4EC-3806DDDA3B5D}","sources":[{"report_type":"sandbox","report_id":"6582a5969988a358780b9c01"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\MSIMGSIZECacheMutex","sources":[{"report_type":"sandbox","report_id":"6582a5969988a358780b9c01"}]},{"name":"IsoScope_b80_IESQMMUTEX_0_274","sources":[{"report_type":"sandbox","report_id":"6582a5969988a358780b9c01"}]},{"name":"Local\\MSIMGSIZECacheMutex","sources":[{"report_type":"sandbox","report_id":"6582a5969988a358780b9c01"}]},{"name":"IsoScope_b80_IESQMMUTEX_0_506","sources":[{"report_type":"sandbox","report_id":"6582a5969988a358780b9c01"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\IsoScope_b80_IESQMMUTEX_0_274","sources":[{"report_type":"sandbox","report_id":"6582a5969988a358780b9c01"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\IsoScope_b80_IESQMMUTEX_0_506","sources":[{"report_type":"sandbox","report_id":"6582a5969988a358780b9c01"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\_!SHMSFTHISTORY!_","sources":[{"report_type":"sandbox","report_id":"6582a5969988a358780b9c01"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\https://www.google.com/","sources":[{"report_type":"sandbox","report_id":"6582a5969988a358780b9c01"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\InternetExplorerDOMStoreQuota","sources":[{"report_type":"sandbox","report_id":"6582a5969988a358780b9c01"}]},{"name":"_!SHMSFTHISTORY!_","sources":[{"report_type":"sandbox","report_id":"6582a5969988a358780b9c01"}]},{"name":"Local\\InternetExplorerDOMStoreQuota","sources":[{"report_type":"sandbox","report_id":"6582a5969988a358780b9c01"}]},{"name":"Local\\https://www.google.com/","sources":[{"report_type":"sandbox","report_id":"6582a5969988a358780b9c01"}]}]}},"report_ids":{"sandbox_job_ids":["6582a5969988a358780b9c01"]}}}]]}] 1e:null 22:[["$","title","0",{"children":"Malicious Ser.Lazy.Generic Sample 46a870926fb6… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample 46a870926fb6…. Malware family: Ser.Lazy.Generic. Threat score 100/100. 9/25 AV engines flagged this file. 19 malicious and 19 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/46a870926fb693596e4fea1ff6ed4bd228d8cc63a9e285997ded48b1484ab3f5"}],["$","meta","4",{"property":"og:title","content":"Malicious Ser.Lazy.Generic Sample 46a870926fb6… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample 46a870926fb6…. Malware family: Ser.Lazy.Generic. Threat score 100/100. 9/25 AV engines flagged this file. 19 malicious and 19 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/46a870926fb693596e4fea1ff6ed4bd228d8cc63a9e285997ded48b1484ab3f5"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Ser.Lazy.Generic Sample 46a870926fb6… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample 46a870926fb6…. Malware family: Ser.Lazy.Generic. Threat score 100/100. 9/25 AV engines flagged this file. 19 malicious and 19 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L67","11",{}]]