24:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/1f7k-b47qno-6.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/3fc9w1ah_nm2g.js"],"SampleDetailWrapper"] 72:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/1f7k-b47qno-6.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 23:T49f,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Trojan.Generic Sample 46ac37f4635f… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 46ac37f4635f…. Malware family: Trojan.Generic. Threat score 100/100. 6/25 AV engines flagged this file. 15 malicious and 17 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/46ac37f4635f315ac0e174392855fa549410746e8826b2d3b066d2352b1d6ca4","keywords":["Malicious","Trojan.Generic","malware analysis","sandbox report","threat intelligence","46ac37f4635f315ac0e174392855fa549410746e8826b2d3b066d2352b1d6ca4"],"about":{"@type":"SoftwareApplication","name":"d470377f9b683b10aa2230b05a5fcdcd.exe","applicationCategory":["peexe","executable"],"identifier":"46ac37f4635f315ac0e174392855fa549410746e8826b2d3b066d2352b1d6ca4","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Trojan.Generic","antivirusDetections":{"malicious":6,"total":25},"behavioralIndicators":{"malicious":15,"suspicious":17},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}25:T513,"d470377f9b683b10aa2230b05a5fcdcd.exe" called "FindResourceA" with parameter "12718924" - (UID: 00000000-00003280) "d470377f9b683b10aa2230b05a5fcdcd.exe" called "FindResourceA" with parameter "1768252" - (UID: 00000000-00003280) "d470377f9b683b10aa2230b05a5fcdcd.exe" called "FindResourceA" with parameter "12718792" - (UID: 00000000-00003280) "d470377f9b683b10aa2230b05a5fcdcd.exe" called "FindResourceA" with parameter "12718800" - (UID: 00000000-00003280) "d470377f9b683b10aa2230b05a5fcdcd.exe" called "FindResourceA" with parameter "12718828" - (UID: 00000000-00003280) "cv7VU08.exe" called "FindResourceA" with parameter "521748" - (UID: 00000000-00001540) "cv7VU08.exe" called "FindResourceA" with parameter "3871432" - (UID: 00000000-00001540) "cv7VU08.exe" called "FindResourceA" with parameter "3871440" - (UID: 00000000-00001540) "cv7VU08.exe" called "FindResourceA" with parameter "3871468" - (UID: 00000000-00001540) "Eh9VZ39.exe" called "FindResourceA" with parameter "1702088" - (UID: 00000000-00004044) "Eh9VZ39.exe" called "FindResourceA" with parameter "13112008" - (UID: 00000000-00004044) "Eh9VZ39.exe" called "FindResourceA" with parameter "13112016" - (UID: 00000000-00004044) "Eh9VZ39.exe" called "FindResourceA" with parameter "13112044" - (UID: 00000000-00004044)26:Ta3f,"d470377f9b683b10aa2230b05a5fcdcd.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '12765152'}" (UID: 00000000-00003280) "d470377f9b683b10aa2230b05a5fcdcd.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '12765264'}" (UID: 00000000-00003280) "d470377f9b683b10aa2230b05a5fcdcd.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '12765296'}" (UID: 00000000-00003280) "d470377f9b683b10aa2230b05a5fcdcd.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '12765280'}" (UID: 00000000-00003280) "cv7VU08.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '3917904'}" (UID: 00000000-00001540) "cv7VU08.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '3917936'}" (UID: 00000000-00001540) "cv7VU08.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '3917920'}" (UID: 00000000-00001540) "Eh9VZ39.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '13158480'}" (UID: 00000000-00004044) "Eh9VZ39.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '13158512'}" (UID: 00000000-00004044) "Eh9VZ39.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '13158496'}" (UID: 00000000-00004044) "Eh9VZ39.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '13158464'}" (UID: 00000000-00004044) "2GR5823.exe" called "LoadResource with parameter {'hModule': '3276800', 'hResInfo': '4146472'}" (UID: 00000000-00002340) "2GR5823.exe" called "LoadResource with parameter {'hModule': '3276800', 'hResInfo': '4146488'}" (UID: 00000000-00002340) "2GR5823.exe" called "LoadResource with parameter {'hModule': '3276800', 'hResInfo': '4146312'}" (UID: 00000000-00002340) "2GR5823.exe" called "LoadResource with parameter {'hModule': '3276800', 'hResInfo': '4146520'}" (UID: 00000000-00002340) "2GR5823.exe" called "LoadResource with parameter {'hModule': '3276800', 'hResInfo': '4146168'}" (UID: 00000000-00002340) "2GR5823.exe" called "LoadResource with parameter {'hModule': '3276800', 'hResInfo': '4146504'}" (UID: 00000000-00002340) "2GR5823.exe" called "LoadResource with parameter {'hModule': '3276800', 'hResInfo': '4146184'}" (UID: 00000000-00002340) "2GR5823.exe" called "LoadResource with parameter {'hModule': '3276800', 'hResInfo': '4146328'}" (UID: 00000000-00002340) "2GR5823.exe" called "LoadResource with parameter {'hModule': '3276800', 'hResInfo': '4146536'}" (UID: 00000000-00002340) "2GR5823.exe" called "LoadResource with parameter {'hModule': '3276800', 'hResInfo': '4146200'}" (UID: 00000000-00002340)27:T60c,Found reference to API "CreateThread" (Indicator: "CreateThread"; File: "d470377f9b683b10aa2230b05a5fcdcd.exe") Found reference to API "VirtualAlloc" (Indicator: "VirtualAlloc"; File: "6AT6wL0.exe.1951796743") Found reference to API "VirtualFree" (Indicator: "VirtualFree"; File: "6AT6wL0.exe.1951796743") Found reference to API "[InjectDependency] WriteProcessMemory failed6" (Indicator: "WriteProcessMemory"; Source: "00000000-00001484.00000000.67206.03360000.00000004.mdmp, 00000000-00001484.00000001.69129.03360000.00000004.mdmp, 00000000-00001484.00000002.71052.03360000.00000004.mdmp") Found reference to API "VirtualAlloc" (Indicator: "VirtualAlloc"; Source: "00000000-00001484.00000001.69129.00DC2000.00000040.mdmp") Found reference to API "CreateThread" (Indicator: "CreateThread"; Source: "00000000-00001484.00000001.69129.00DC2000.00000040.mdmp") Found reference to API "VirtualFree" (Indicator: "VirtualFree"; Source: "00000000-00001484.00000001.69129.00DC2000.00000040.mdmp") Found reference to API "VirtualAllocEx" (Indicator: "VirtualAlloc"; Source: "00000000-00001484.00000001.69129.00DC2000.00000040.mdmp") Found reference to API "VirtualAllocEx" (Indicator: "VirtualAllocEx"; Source: "00000000-00001484.00000001.69129.00DC2000.00000040.mdmp") Found reference to API "VirtualFreeEx" (Indicator: "VirtualFree"; Source: "00000000-00001484.00000001.69129.00DC2000.00000040.mdmp") Found reference to API "WriteProcessMemory" (Indicator: "WriteProcessMemory"; Source: "00000000-00001484.00000001.69129.00DC2000.00000040.mdmp")28:T436,Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; File: "d470377f9b683b10aa2230b05a5fcdcd.exe") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; File: "d470377f9b683b10aa2230b05a5fcdcd.exe") Found reference to API "LoadLibraryExA" (Indicator: "LoadLibrary"; File: "d470377f9b683b10aa2230b05a5fcdcd.exe") Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; File: "6AT6wL0.exe.1951796743") Found reference to API "LoadLibraryA(" (Indicator: "LoadLibrary"; Source: "00000000-00001484.00000000.67206.03360000.00000004.mdmp, 00000000-00001484.00000001.69129.03360000.00000004.mdmp, 00000000-00001484.00000002.71052.03360000.00000004.mdmp") Found reference to API "LoadLibrary" (Indicator: "LoadLibrary"; Source: "00000000-00001484.00000001.69129.00DC2000.00000040.mdmp") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; Source: "00000000-00001484.00000001.69129.00DC2000.00000040.mdmp") Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; Source: "00000000-00001484.00000002.71052.01131000.00000040.mdmp")29:T283c,Found reference to "MSCF2Wqh disallowedcert.stl|f~3"{-UAV>F :n;lpd`() hvnf|T#&6%&WSHS9*}9yZ@F+/vU|Usr #k#NK-c0ROmX6VG55:x"3`CM:k^nLuSvMxfx4qM?{i%CVl\tP-`}v?@s)?hRQ>jB@H4-" (Indicator: "Oid"; File: "57C8EDB95DF3F0AD4EE2DC2B8CFD4157") file/memory contains long string with (Indicator: "Oid"; File: "SSL") Found reference to "System.Security.Cryptography.RandomNumberGenerator" (Indicator: "RandomNumberGenerator"; Source: "00000000-00001484.00000000.67206.03360000.00000004.mdmp, 00000000-00001484.00000001.69129.03360000.00000004.mdmp, 00000000-00001484.00000002.71052.03360000.00000004.mdmp") Found reference to "System.Security.Cryptography.AesCryptoServiceProvider, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "Aes"; Source: "00000000-00001484.00000000.67206.03360000.00000004.mdmp, 00000000-00001484.00000001.69129.03360000.00000004.mdmp, 00000000-00001484.00000002.71052.03360000.00000004.mdmp") Found reference to "System.Security.Cryptography.AesCryptoServiceProvider, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "AesCryptoServiceProvider"; Source: "00000000-00001484.00000000.67206.03360000.00000004.mdmp, 00000000-00001484.00000001.69129.03360000.00000004.mdmp, 00000000-00001484.00000002.71052.03360000.00000004.mdmp") Found reference to "System.Security.Cryptography.RSACng, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "RSACng"; Source: "00000000-00001484.00000000.67206.03360000.00000004.mdmp, 00000000-00001484.00000001.69129.03360000.00000004.mdmp, 00000000-00001484.00000002.71052.03360000.00000004.mdmp") Found reference to "System.Security.Cryptography.DSACng, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "DSACng"; Source: "00000000-00001484.00000000.67206.03360000.00000004.mdmp, 00000000-00001484.00000001.69129.03360000.00000004.mdmp, 00000000-00001484.00000002.71052.03360000.00000004.mdmp") Found reference to "System.Security.Cryptography.AesManaged, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "Aes"; Source: "00000000-00001484.00000000.67206.03360000.00000004.mdmp, 00000000-00001484.00000001.69129.03360000.00000004.mdmp, 00000000-00001484.00000002.71052.03360000.00000004.mdmp") Found reference to "System.Security.Cryptography.AesManaged, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "AesManaged"; Source: "00000000-00001484.00000000.67206.03360000.00000004.mdmp, 00000000-00001484.00000001.69129.03360000.00000004.mdmp, 00000000-00001484.00000002.71052.03360000.00000004.mdmp") Found reference to "System.Security.Cryptography.ECDiffieHellmanCng, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "ECDiffieHellman"; Source: "00000000-00001484.00000000.67206.03360000.00000004.mdmp, 00000000-00001484.00000001.69129.03360000.00000004.mdmp, 00000000-00001484.00000002.71052.03360000.00000004.mdmp") Found reference to "System.Security.Cryptography.ECDiffieHellmanCng, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "ECDiffieHellmanCng"; Source: "00000000-00001484.00000000.67206.03360000.00000004.mdmp, 00000000-00001484.00000001.69129.03360000.00000004.mdmp, 00000000-00001484.00000002.71052.03360000.00000004.mdmp") Found reference to "System.Security.Cryptography.ECDsaCng, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "ECDsa"; Source: "00000000-00001484.00000000.67206.03360000.00000004.mdmp, 00000000-00001484.00000001.69129.03360000.00000004.mdmp, 00000000-00001484.00000002.71052.03360000.00000004.mdmp") Found reference to "System.Security.Cryptography.ECDsaCng, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "ECDsaCng"; Source: "00000000-00001484.00000000.67206.03360000.00000004.mdmp, 00000000-00001484.00000001.69129.03360000.00000004.mdmp, 00000000-00001484.00000002.71052.03360000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA256CryptoServiceProvider, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "SHA256CryptoServiceProvider"; Source: "00000000-00001484.00000000.67206.03360000.00000004.mdmp, 00000000-00001484.00000001.69129.03360000.00000004.mdmp, 00000000-00001484.00000002.71052.03360000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA384Cng, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "SHA384"; Source: "00000000-00001484.00000000.67206.03360000.00000004.mdmp, 00000000-00001484.00000001.69129.03360000.00000004.mdmp, 00000000-00001484.00000002.71052.03360000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA384CryptoServiceProvider, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "SHA384"; Source: "00000000-00001484.00000000.67206.03360000.00000004.mdmp, 00000000-00001484.00000001.69129.03360000.00000004.mdmp, 00000000-00001484.00000002.71052.03360000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA384CryptoServiceProvider, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "SHA384CryptoServiceProvider"; Source: "00000000-00001484.00000000.67206.03360000.00000004.mdmp, 00000000-00001484.00000001.69129.03360000.00000004.mdmp, 00000000-00001484.00000002.71052.03360000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA512Cng, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "SHA512"; Source: "00000000-00001484.00000000.67206.03360000.00000004.mdmp, 00000000-00001484.00000001.69129.03360000.00000004.mdmp, 00000000-00001484.00000002.71052.03360000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA512CryptoServiceProvider, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "SHA512"; Source: "00000000-00001484.00000000.67206.03360000.00000004.mdmp, 00000000-00001484.00000001.69129.03360000.00000004.mdmp, 00000000-00001484.00000002.71052.03360000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA512CryptoServiceProvider, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "SHA512CryptoServiceProvider"; Source: "00000000-00001484.00000000.67206.03360000.00000004.mdmp, 00000000-00001484.00000001.69129.03360000.00000004.mdmp, 00000000-00001484.00000002.71052.03360000.00000004.mdmp") Found reference to "RandomNumberGenerator" (Indicator: "RandomNumberGenerator"; Source: "00000000-00001484.00000000.67206.03360000.00000004.mdmp, 00000000-00001484.00000001.69129.03360000.00000004.mdmp, 00000000-00001484.00000002.71052.03360000.00000004.mdmp") Found reference to "System.Security.Cryptography.HashAlgorithm" (Indicator: "HashAlgorithm"; Source: "00000000-00001484.00000000.67206.03360000.00000004.mdmp, 00000000-00001484.00000001.69129.03360000.00000004.mdmp, 00000000-00001484.00000002.71052.03360000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA256CryptoServiceProvider" (Indicator: "SHA256CryptoServiceProvider"; Source: "00000000-00001484.00000000.67206.03360000.00000004.mdmp, 00000000-00001484.00000001.69129.03360000.00000004.mdmp, 00000000-00001484.00000002.71052.03360000.00000004.mdmp") Found reference to "SHA384" (Indicator: "SHA384"; Source: "00000000-00001484.00000000.67206.03360000.00000004.mdmp, 00000000-00001484.00000001.69129.03360000.00000004.mdmp, 00000000-00001484.00000002.71052.03360000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA384" (Indicator: "SHA384"; Source: "00000000-00001484.00000000.67206.03360000.00000004.mdmp, 00000000-00001484.00000001.69129.03360000.00000004.mdmp, 00000000-00001484.00000002.71052.03360000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA384Cng" (Indicator: "SHA384"; Source: "00000000-00001484.00000000.67206.03360000.00000004.mdmp, 00000000-00001484.00000001.69129.03360000.00000004.mdmp, 00000000-00001484.00000002.71052.03360000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA384CryptoServiceProvider" (Indicator: "SHA384"; Source: "00000000-00001484.00000000.67206.03360000.00000004.mdmp, 00000000-00001484.00000001.69129.03360000.00000004.mdmp, 00000000-00001484.00000002.71052.03360000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA384CryptoServiceProvider" (Indicator: "SHA384CryptoServiceProvider"; Source: "00000000-00001484.00000000.67206.03360000.00000004.mdmp, 00000000-00001484.00000001.69129.03360000.00000004.mdmp, 00000000-00001484.00000002.71052.03360000.00000004.mdmp") Found reference to "SHA512" (Indicator: "SHA512"; Source: "00000000-00001484.00000000.67206.03360000.00000004.mdmp, 00000000-00001484.00000001.69129.03360000.00000004.mdmp, 00000000-00001484.00000002.71052.03360000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA512" (Indicator: "SHA512"; Source: "00000000-00001484.00000000.67206.03360000.00000004.mdmp, 00000000-00001484.00000001.69129.03360000.00000004.mdmp, 00000000-00001484.00000002.71052.03360000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA512Cng" (Indicator: "SHA512"; Source: "00000000-00001484.00000000.67206.03360000.00000004.mdmp, 00000000-00001484.00000001.69129.03360000.00000004.mdmp, 00000000-00001484.00000002.71052.03360000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA512CryptoServiceProvider" (Indicator: "SHA512"; Source: "00000000-00001484.00000000.67206.03360000.00000004.mdmp, 00000000-00001484.00000001.69129.03360000.00000004.mdmp, 00000000-00001484.00000002.71052.03360000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA512CryptoServiceProvider" (Indicator: "SHA512CryptoServiceProvider"; Source: "00000000-00001484.00000000.67206.03360000.00000004.mdmp, 00000000-00001484.00000001.69129.03360000.00000004.mdmp, 00000000-00001484.00000002.71052.03360000.00000004.mdmp")2a:T6f2,"powershell.exe" called "CryptImportKey" with parameters {"hProv": "2e4a68" "pbData": "0602000000240000525341310004000001000100b5fc90e7027f67871e773a8fde8938c81dd402ba65b9201d60593e96c492651e889cc13f1415ebb53fac1131ae0bd333c5ee6021672d9718ea31a8aebd0da0072f25d87dba6fc90ffd598ed4da35e44c398c454307e8e33b8426143daec9f596836f97c8f74750e5975c64e2189f45def46b2a2b1247adc3652bf5c308055da9" "dwDataLen": "148" "dwFlags": "0" "phKey": "80f42b00"} "powershell.exe" called "CryptImportKey" with parameters {"hProv": "2e4a68" "pbData": "0602000000240000525341310004000001000100b5fc90e7027f67871e773a8fde8938c81dd402ba65b9201d60593e96c492651e889cc13f1415ebb53fac1131ae0bd333c5ee6021672d9718ea31a8aebd0da0072f25d87dba6fc90ffd598ed4da35e44c398c454307e8e33b8426143daec9f596836f97c8f74750e5975c64e2189f45def46b2a2b1247adc3652bf5c308055da9" "dwDataLen": "148" "dwFlags": "0" "phKey": "00f82b00"} "powershell.exe" called "CryptImportKey" with parameters {"hProv": "2e4a68" "pbData": "0602000000240000525341310004000001000100b5fc90e7027f67871e773a8fde8938c81dd402ba65b9201d60593e96c492651e889cc13f1415ebb53fac1131ae0bd333c5ee6021672d9718ea31a8aebd0da0072f25d87dba6fc90ffd598ed4da35e44c398c454307e8e33b8426143daec9f596836f97c8f74750e5975c64e2189f45def46b2a2b1247adc3652bf5c308055da9" "dwDataLen": "148" "dwFlags": "0" "phKey": "00fa2b00"} "powershell.exe" called "CryptImportKey" with parameters {"hProv": "2e4a68" "pbData": "0602000000240000525341310004000001000100b5fc90e7027f67871e773a8fde8938c81dd402ba65b9201d60593e96c492651e889cc13f1415ebb53fac1131ae0bd333c5ee6021672d9718ea31a8aebd0da0072f25d87dba6fc90ffd598ed4da35e44c398c454307e8e33b8426143daec9f596836f97c8f74750e5975c64e2189f45def46b2a2b1247adc3652bf5c308055da9" "dwDataLen": "148" "dwFlags": "0" "phKey": "80f92b00"}2b:T4812,Contains base64 string in header "Keep" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "User" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "ocsp" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "digicert" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP" in header "GET /gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "2FUsCEHe9DWzbNvka6iEPxPBY0w0" in header "GET /gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "Keep" in header "GET /gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "User" in header "GET /gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "ocsp" in header "GET /gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "goog" in header "GET /gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEATh56TcXPLzbcArQrhdFZ8" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEATh56TcXPLzbcArQrhdFZ8%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "Keep" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEATh56TcXPLzbcArQrhdFZ8%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "User" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEATh56TcXPLzbcArQrhdFZ8%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "ocsp" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEATh56TcXPLzbcArQrhdFZ8%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "digicert" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEATh56TcXPLzbcArQrhdFZ8%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "/gtsr1/gtsr1" in header "GET /gtsr1/gtsr1.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: crl.pki.goog" Contains base64 string in header "Keep" in header "GET /gtsr1/gtsr1.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: crl.pki.goog" Contains base64 string in header "User" in header "GET /gtsr1/gtsr1.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: crl.pki.goog" Contains base64 string in header "goog" in header "GET /gtsr1/gtsr1.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: crl.pki.goog" Contains base64 string in header "Keep" in header "GET /gts1c3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEGpYRvzN3kAuEMlMWsqSFLc%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "User" in header "GET /gts1c3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEGpYRvzN3kAuEMlMWsqSFLc%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "ocsp" in header "GET /gts1c3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEGpYRvzN3kAuEMlMWsqSFLc%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "goog" in header "GET /gts1c3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEGpYRvzN3kAuEMlMWsqSFLc%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "Keep" in header "GET /gtsr1/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBQwkcLWD4LqGJ7bE7B1XZsEbmfwUAQU5K8rJnEaK0gnhS9SZizv8IkTcT4CDQIDvFNZazTHGPUBUGY%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "User" in header "GET /gtsr1/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBQwkcLWD4LqGJ7bE7B1XZsEbmfwUAQU5K8rJnEaK0gnhS9SZizv8IkTcT4CDQIDvFNZazTHGPUBUGY%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "ocsp" in header "GET /gtsr1/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBQwkcLWD4LqGJ7bE7B1XZsEbmfwUAQU5K8rJnEaK0gnhS9SZizv8IkTcT4CDQIDvFNZazTHGPUBUGY%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "goog" in header "GET /gtsr1/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBQwkcLWD4LqGJ7bE7B1XZsEbmfwUAQU5K8rJnEaK0gnhS9SZizv8IkTcT4CDQIDvFNZazTHGPUBUGY%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "2Bsl" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTPJvUY%2Bsl%2Bj4yzQuAcL2oQno5fCgQUUWj%2FkK8CB3U8zNllZGKiErhZcjsCEA84b5kxAOGeKVwpjCxm%2Fyw%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "2Fyw" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTPJvUY%2Bsl%2Bj4yzQuAcL2oQno5fCgQUUWj%2FkK8CB3U8zNllZGKiErhZcjsCEA84b5kxAOGeKVwpjCxm%2Fyw%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "Keep" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTPJvUY%2Bsl%2Bj4yzQuAcL2oQno5fCgQUUWj%2FkK8CB3U8zNllZGKiErhZcjsCEA84b5kxAOGeKVwpjCxm%2Fyw%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "User" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTPJvUY%2Bsl%2Bj4yzQuAcL2oQno5fCgQUUWj%2FkK8CB3U8zNllZGKiErhZcjsCEA84b5kxAOGeKVwpjCxm%2Fyw%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "ocsp" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTPJvUY%2Bsl%2Bj4yzQuAcL2oQno5fCgQUUWj%2FkK8CB3U8zNllZGKiErhZcjsCEA84b5kxAOGeKVwpjCxm%2Fyw%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "digicert" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTPJvUY%2Bsl%2Bj4yzQuAcL2oQno5fCgQUUWj%2FkK8CB3U8zNllZGKiErhZcjsCEA84b5kxAOGeKVwpjCxm%2Fyw%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "/gts1c3/zdATt0Ex" in header "GET /gts1c3/zdATt0Ex_Fk.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: crls.pki.goog" Contains base64 string in header "Keep" in header "GET /gts1c3/zdATt0Ex_Fk.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: crls.pki.goog" Contains base64 string in header "User" in header "GET /gts1c3/zdATt0Ex_Fk.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: crls.pki.goog" Contains base64 string in header "crls" in header "GET /gts1c3/zdATt0Ex_Fk.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: crls.pki.goog" Contains base64 string in header "goog" in header "GET /gts1c3/zdATt0Ex_Fk.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: crls.pki.goog" Contains base64 string in header "Keep" in header "GET /gts1c3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEBZwXm7t3kKEEFjsmHQeLcQ%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "User" in header "GET /gts1c3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEBZwXm7t3kKEEFjsmHQeLcQ%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "ocsp" in header "GET /gts1c3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEBZwXm7t3kKEEFjsmHQeLcQ%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "goog" in header "GET /gts1c3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEBZwXm7t3kKEEFjsmHQeLcQ%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "Keep" in header "GET /gts1c3/moVDfISia2k.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: crls.pki.goog" Contains base64 string in header "User" in header "GET /gts1c3/moVDfISia2k.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: crls.pki.goog" Contains base64 string in header "crls" in header "GET /gts1c3/moVDfISia2k.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: crls.pki.goog" Contains base64 string in header "goog" in header "GET /gts1c3/moVDfISia2k.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: crls.pki.goog" Contains base64 string in header "2Bsl" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTPJvUY%2Bsl%2Bj4yzQuAcL2oQno5fCgQUUWj%2FkK8CB3U8zNllZGKiErhZcjsCEAcpLgRNzv6uFuf5CFWQE%2F4%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "Keep" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTPJvUY%2Bsl%2Bj4yzQuAcL2oQno5fCgQUUWj%2FkK8CB3U8zNllZGKiErhZcjsCEAcpLgRNzv6uFuf5CFWQE%2F4%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "User" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTPJvUY%2Bsl%2Bj4yzQuAcL2oQno5fCgQUUWj%2FkK8CB3U8zNllZGKiErhZcjsCEAcpLgRNzv6uFuf5CFWQE%2F4%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "ocsp" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTPJvUY%2Bsl%2Bj4yzQuAcL2oQno5fCgQUUWj%2FkK8CB3U8zNllZGKiErhZcjsCEAcpLgRNzv6uFuf5CFWQE%2F4%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "digicert" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTPJvUY%2Bsl%2Bj4yzQuAcL2oQno5fCgQUUWj%2FkK8CB3U8zNllZGKiErhZcjsCEAcpLgRNzv6uFuf5CFWQE%2F4%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "Keep" in header "GET /gts1c3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEDEixfO34qnbCeE6N8VMp00%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "User" in header "GET /gts1c3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEDEixfO34qnbCeE6N8VMp00%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "ocsp" in header "GET /gts1c3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEDEixfO34qnbCeE6N8VMp00%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "goog" in header "GET /gts1c3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEDEixfO34qnbCeE6N8VMp00%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "2BrkS7QYXjzkCEAqvpsXKY8RRQeo74ffHUxc" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAqvpsXKY8RRQeo74ffHUxc%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "Keep" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAqvpsXKY8RRQeo74ffHUxc%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "User" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAqvpsXKY8RRQeo74ffHUxc%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "ocsp" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAqvpsXKY8RRQeo74ffHUxc%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "digicert" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAqvpsXKY8RRQeo74ffHUxc%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "Keep" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "User" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "ocsp" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "digicert" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "2BrkS7QYXjzkCEA177el9ggmWelJjG4vdGL0" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEA177el9ggmWelJjG4vdGL0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "Keep" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEA177el9ggmWelJjG4vdGL0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "User" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEA177el9ggmWelJjG4vdGL0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "ocsp" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEA177el9ggmWelJjG4vdGL0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "digicert" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEA177el9ggmWelJjG4vdGL0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com"2c:T4ff,The analysis contains indicators for cyrpto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Contains ability to perform AES/RC4 encryption (API string) Matched sigs: Contains ability to perform decryption (API string) Matched sigs: Contains ability to use Microsoft's Enhanced Cryptographic Provider Matched sigs: Contains CRYPTO related strings Matched sigs: Contains ability to use Cryptographic classes Matched sigs: Contains ability to perform Base64 encoding/decoding Matched sigs: Decrypted SSL network traffic Matched sigs: Contains ability to decrypt/decode data Matched sigs: Contains ability to perform encryption (API string) Matched sigs: Contains ability to perform encryption/decryption using RSA algorithm Matched sigs: Tries to steal crypto wallet extension (string) Matched sigs: Contains reference to cryptographic keys Matched sigs: Contains ability to decode base64 data Matched sigs: Calls an API typically to import cryptographic keys into a CSP Matched sigs: Reads the cryptographic machine GUID Matched sigs: HTTP requests contain Base64 strings Matched sigs: Dropped file has high entropy (likely encrypted/compressed content) Matched sigs: Sample file has high entropy (likely encrypted/compressed content)2d:T2510,"d470377f9b683b10aa2230b05a5fcdcd.exe" called "RtlGetVersion" with parameter 000000000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00003280) "cv7VU08.exe" called "RtlGetVersion" with parameter 000000000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00001540) "Eh9VZ39.exe" called "RtlGetVersion" with parameter 000000000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00004044) "2GR5823.exe" called "RtlGetVersion" with parameter 140100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00002340) "2GR5823.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00002340) "2GR5823.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000099049966cc04cc66cc04ff6699040099cc043399cc046699cc049999cc04cc99cc04ff99cc0400cccc0433cccc0466cccc0499cccc04cccccc04ffcccc0400ffcc0433ffcc0466ff990499ffcc04ccffcc04ffffcc043300cc046600ff049900ff040033cc043333ff046633ff049933ff04cc33ff04ff33ff040066ff043366ff046666cc049966ff04cc66ff04ff66cc040099ff043399ff046699ff049999ff04cc99ff04ff99ff0400ccff0433ccff0466ccff0499ccff04ccccff040000246aa0e0c30266ffcc0499ffff04ccffff0490e0c3020000246a0000000001000000 (UID: 00000000-00002340) "2GR5823.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000010000000001011e4f32c51748e7c3022a9d8e76000000002483a376040000000000000000000000c4f8c30200000000e79c8e76020007805ce1c3020000000074000000ace1c302feffffff34e1c302cf005277d6005277abb59575740000003a000000ace1c3026f006e0008e1c3026e00740070e1c302 (UID: 00000000-00002340) "2GR5823.exe" called "RtlGetVersion" with parameter 000000000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00002340) "2GR5823.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000099049966cc04cc66cc04ff6699040099cc043399cc046699cc049999cc04cc99cc04ff99cc0400cccc0433cccc0466cccc0499cccc04cccccc04ffcccc0400ffcc0433ffcc0466ff990499ffcc04ccffcc04ffffcc043300cc046600ff049900ff040033cc043333ff046633ff049933ff04cc33ff04ff33ff040066ff043366ff046666cc049966ff04cc66ff04ff66cc040099ff043399ff046699ff049999ff04cc99ff04ff99ff0400ccff0433ccff0466ccff0499ccff04ccccff040000246a20df770466ffcc0499ffff04ccffff0410df77040000246a0000000001000000 (UID: 00000000-00002340) "2GR5823.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000099049966cc04cc66cc04ff6699040099cc043399cc046699cc049999cc04cc99cc04ff99cc0400cccc0433cccc0466cccc0499cccc04cccccc04ffcccc0400ffcc0433ffcc0466ff990499ffcc04ccffcc04ffffcc043300cc046600ff049900ff040033cc043333ff046633ff049933ff04cc33ff04ff33ff040066ff043366ff046666cc049966ff04cc66ff04ff66cc040099ff043399ff046699ff049999ff04cc99ff04ff99ff0400ccff0433ccff0466ccff0499ccff04ccccff040000246a70e2cc0466ffcc0499ffff04ccffff0460e2cc040000246a0000000001000000 (UID: 00000000-00002340) "5cN0su3.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b00200031000000000014f1350000000000060000000000c27140f135000200004044f3350044f335001a125377000000002cf1350000000000e86f3c000203537700020000880153770000000088f33500a40153770000000000000000000000015500530045005200330032002e0064006c006c00000000000000000000004c7700004c7700000000f2f13500d0004c7714f13500f0f135003cf2350095e14d77dd650700fefffffff5f6517716f85177a81e3a00f2f13500e8f13500e8f13500010000004cf235009ef85177626f517764f85177799f63777412c271acf235000000000000004c77 (UID: 00000000-00001484) "5cN0su3.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b00200031000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ff2b5177119763770000000094013a0000003a0000003a000000000019004c001900000012000000000000000000000000000000 (UID: 00000000-00001484) "5cN0su3.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b00200031000000760238017602000000000cf9350014c60d6c00003a0007000000d0cd3e0000003a0038ce3e00a0563f000000000028f93500000000000600000014fa3500070000000700000017685177d8cd3e0000000000435c51772197637700000000bc013a0000003a0050013a0034fa3500145c517750013a000197637774013a0000000000060000000001760250013a000d000000a0563f00f22c52770d00000000fe00fe07000000000000005001760200100000c8057d02000000000200000240d03e00110000112d7b0700feffffff0000000080000000000000002923000aa8583c00 (UID: 00000000-00001484) "5cN0su3.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00001484) "5cN0su3.exe" called "RtlGetVersion" with parameter 140100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00001484)2e:T1027,"2GR5823.exe" called "GetVersionExA" with parameter 9c0000000600000001000000b11d00000200000053657276696365205061636b2031000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00002340) "5cN0su3.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b2031000084f235008a872875683b3e0034f33500980adb00980adb00000000002c302875b2f45177f19f63771cf335000000c2710000c27184f23500acf23500f0000000f000c2710000000088f23500000000001cf435000000000001000000ecf2350040f551770000000000000000d8f23500 (UID: 00000000-00001484) "5cN0su3.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b203100001ea3000173900001d0fa3500a090000184fa3500c448010112000000acc200010000000010000000c448010112000000acc20001a09c000106000000029e0001060000005a9e000101be000146dd0001d0fa3500219e0001dcfa350078046700c4480101120000000600000045e30001 (UID: 00000000-00001484) "5cN0su3.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b203100005e3ce9009f22e900d0fa3500cc22e90084fa3500608bfb00ac0000002c8fe900c8f9350010000000608bfb00ac0000002c8fe9008433e9000e0000004237e9000e0000009a37e900018ae90042e8e900d0fa35006137e900dcfa35005c04e201608bfb00ac0000000e00000089eee900 (UID: 00000000-00001484) "5cN0su3.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b203100000000e2010040010018f6fd0054f7000054f70000ed1fe9000040e201000001000cf6fd00b820e900e4f83500f050110154f700000000e900e4f83500cb22e9007ef30001eff300010000e900f05011016c27e2014cfb3500fcf835000000e9000100000000000000a4c4ee0046020000 (UID: 00000000-00001484) "5cN0su3.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b203100002c7040000000000000007900740068006f006e005c0050007900740068006f006e00330038002d00330032005c0053006300720069007000740073005c003b0043003a005c00550073006500720073005c0048004100500055004200570053005c004100700070004400610074006100 (UID: 00000000-00001484) "5cN0su3.exe" called "GetVersionExA" with parameter 9c0000000600000001000000b11d00000200000053657276696365205061636b2031000000000000000000000200000000000000d8ebcd7628e4460000f0fd7f9a5c527700e0fd7f70bc350044f0fd7f00000000400000003f0000002f00000000f0fd7f64bc3500c15c5277608259772f00000000f0fd7f9a5c527700e0fd7f88bc3500578951778083597713175e75d8ebcd76 (UID: 00000000-00001484) "powershell.exe" called "GetVersionExA" with parameter 9c0000000600000001000000b11d00000200000053657276696365205061636b2031000000000000000000000200000000000000d8ebcd7698bd2a000070fd7f9a5c527700f0fd7fe8bd0d004470fd7f00000000400000003f0000001d0000000070fd7fdcbd0d00c15c5277608259771d0000000070fd7f9a5c527700f0fd7f00be0d00578951778083597713175e75d8ebcd76 (UID: 00000000-00003228) "powershell.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b2031000072006f0073006f00660074002e004e00450054005c004600720061006d00650077006f0072006b005c00760032002e0030002e00350030003700320037005c006d00730063006f00720077006b0073002e0064006c006c002e0032002e004d0061006e00690066006500730074000000 (UID: 00000000-00003228) "powershell.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b20310000636d776500004801000000006c6d77655da937e4d8d73e608ced0d0088ed0d0000000000000000000000000000000000d8d73e60e0ec0d000000000050ed0d008ced0d0020ed0d00ff237765c83b806560ed0d0031177765080000001c5c507714a15177ffffffff2400000048ed0d00 (UID: 00000000-00003228) "powershell.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b2031000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00003228)2f:T422,Found string "SELECT * FROM Win32_LogicalDisk WHERE DeviceID = '" (Indicator: "select * from "; Source: "00000000-00001484.00000000.67206.03360000.00000004.mdmp, 00000000-00001484.00000001.69129.03360000.00000004.mdmp, 00000000-00001484.00000002.71052.03360000.00000004.mdmp") Found string "SELECT * FROM Win32_Processor" (Indicator: "select * from "; Source: "00000000-00001484.00000000.67206.03360000.00000004.mdmp, 00000000-00001484.00000001.69129.03360000.00000004.mdmp, 00000000-00001484.00000002.71052.03360000.00000004.mdmp") Found string "SELECT * FROM Win32_PhysicalMemory" (Indicator: "select * from "; Source: "00000000-00001484.00000000.67206.03360000.00000004.mdmp, 00000000-00001484.00000001.69129.03360000.00000004.mdmp, 00000000-00001484.00000002.71052.03360000.00000004.mdmp") Found string "SELECT * FROM Win32_VideoController" (Indicator: "select * from "; Source: "00000000-00001484.00000000.67206.03360000.00000004.mdmp, 00000000-00001484.00000001.69129.03360000.00000004.mdmp, 00000000-00001484.00000002.71052.03360000.00000004.mdmp")30:T67c,"d470377f9b683b10aa2230b05a5fcdcd.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "d470377f9b683b10aa2230b05a5fcdcd.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "cv7VU08.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "cv7VU08.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "Eh9VZ39.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "Eh9VZ39.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "2GR5823.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "2GR5823.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "5cN0su3.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "5cN0su3.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "cmd.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "cmd.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "schtasks.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED")31:T54c,"5cN0su3.exe" called "CreateDirectoryW" with parameter C:\Users\%OSUSER% (UID: 00000000-00001484) "5cN0su3.exe" called "CreateDirectoryW" with parameter %USERPROFILE%\AppData\Roaming (UID: 00000000-00001484) "5cN0su3.exe" called "CreateDirectoryW" with parameter %LOCALAPPDATA%\MaxLoonaFest131 (UID: 00000000-00001484) "5cN0su3.exe" called "CreateDirectoryW" with parameter %TEMP%\FANBooster131 (UID: 00000000-00001484) "5cN0su3.exe" called "CreateDirectoryW" with parameter %LOCALAPPDATA%\Microsoft\Windows\Caches (UID: 00000000-00001484) "5cN0su3.exe" called "CreateDirectoryW" with parameter %ALLUSERSPROFILE%\OfficeTrackerNMP131 (UID: 00000000-00001484) "5cN0su3.exe" called "CreateDirectoryW" with parameter %TEMP%\tempCMSD9vvTmlLJqBA (UID: 00000000-00001484) "5cN0su3.exe" called "CreateDirectoryW" with parameter %TEMP%\tempAVSD9vvTmlLJqBA (UID: 00000000-00001484) "powershell.exe" called "CreateDirectoryW" with parameter %LOCALAPPDATA%\Microsoft\Windows\Caches (UID: 00000000-00003228) "powershell.exe" called "CreateDirectoryW" with parameter %APPDATA%\Microsoft\Windows\Recent\CustomDestinations (UID: 00000000-00003228) "powershell.exe" called "CreateDirectoryW" with parameter C:\Users\%OSUSER% (UID: 00000000-00003228) "powershell.exe" called "CreateDirectoryW" with parameter %USERPROFILE%\AppData\Roaming (UID: 00000000-00003228)32:T405,"d470377f9b683b10aa2230b05a5fcdcd.exe" called "CreateProcessA" with parameter "%TEMP%\IXP000.TMP\cv7VU08.exe" - (UID: 00000000-00003280) "cv7VU08.exe" called "CreateProcessA" with parameter "%TEMP%\IXP001.TMP\Eh9VZ39.exe" - (UID: 00000000-00001540) "Eh9VZ39.exe" called "CreateProcessA" with parameter "%TEMP%\IXP002.TMP\2GR5823.exe" - (UID: 00000000-00004044) "Eh9VZ39.exe" called "CreateProcessA" with parameter "%TEMP%\IXP002.TMP\5cN0su3.exe" - (UID: 00000000-00004044) "5cN0su3.exe" called "CreateProcessW" with parameter ""powershell" Get-MpPreference -verbose" - (UID: 00000000-00001484) "5cN0su3.exe" called "CreateProcessW" with parameter ""cmd.exe" /c schtasks /create /f /RU "%OSUSER%" /tr "%ALLUSERSPROFILE%\OfficeTrackerNMP131\OfficeTrackerNMP131.exe" /tn "OfficeTracker" - (UID: 00000000-00001484), "cmd.exe" called "CreateProcessW" with parameter "schtasks /create /f /RU "%OSUSER%" /tr "%ALLUSERSPROFILE%\OfficeTrackerNMP131\OfficeTrackerNMP131.exe" /tn "OfficeTrackerNMP131 HR" /" - (UID: 00000000-00003008)33:T55c6,"d470377f9b683b10aa2230b05a5fcdcd.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00003280) "d470377f9b683b10aa2230b05a5fcdcd.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00003280) "d470377f9b683b10aa2230b05a5fcdcd.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00003280) "d470377f9b683b10aa2230b05a5fcdcd.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00003280) "d470377f9b683b10aa2230b05a5fcdcd.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\advpack.dll (UID: 00000000-00003280) "cv7VU08.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\advpack.dll (UID: 00000000-00001540) "Eh9VZ39.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\advpack.dll (UID: 00000000-00004044) "2GR5823.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00002340) "2GR5823.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00002340) "2GR5823.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00002340) "2GR5823.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00002340) "2GR5823.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\uxtheme.dll (UID: 00000000-00002340) "2GR5823.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00002340) "2GR5823.exe" called "LoadLibrary" with a parameter %TEMP%\IXP002.TMP\2GR5823.exe (UID: 00000000-00002340) "2GR5823.exe" called "LoadLibrary" with a parameter api-ms-win-core-sysinfo-l1-2-1 (UID: 00000000-00002340) "2GR5823.exe" called "LoadLibrary" with a parameter dwmapi.dll (UID: 00000000-00002340) "2GR5823.exe" called "LoadLibrary" with a parameter comctl32.dll (UID: 00000000-00002340) "2GR5823.exe" called "LoadLibrary" with a parameter UxTheme.dll (UID: 00000000-00002340) "2GR5823.exe" called "LoadLibrary" with a parameter IMM32.dll (UID: 00000000-00002340) "2GR5823.exe" called "LoadLibrary" with a parameter comctl32 (UID: 00000000-00002340) "2GR5823.exe" called "LoadLibrary" with a parameter SHELL32.dll (UID: 00000000-00002340) "2GR5823.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00002340) "2GR5823.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00002340) "2GR5823.exe" called "LoadLibrary" with a parameter propsys.dll (UID: 00000000-00002340) "2GR5823.exe" called "LoadLibrary" with a parameter %WINDIR%\System32\ieframe.dll (UID: 00000000-00002340) "2GR5823.exe" called "LoadLibrary" with a parameter api-ms-win-downlevel-ole32-l1-1-0.dll (UID: 00000000-00002340) "2GR5823.exe" called "LoadLibrary" with a parameter urlmon.dll (UID: 00000000-00002340) "2GR5823.exe" called "LoadLibrary" with a parameter api-ms-win-downlevel-shlwapi-l2-1-0.dll (UID: 00000000-00002340) "2GR5823.exe" called "LoadLibrary" with a parameter PROPSYS.dll (UID: 00000000-00002340) "2GR5823.exe" called "LoadLibrary" with a parameter %PROGRAMFILES%\Internet Explorer\ieproxy.dll (UID: 00000000-00002340) "2GR5823.exe" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00002340) "2GR5823.exe" called "LoadLibrary" with a parameter iertutil.dll (UID: 00000000-00002340) "2GR5823.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00002340) "2GR5823.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-1 (UID: 00000000-00002340) "2GR5823.exe" called "LoadLibrary" with a parameter ext-ms-win-kernel32-package-current-l1-1-0 (UID: 00000000-00002340) "5cN0su3.exe" called "LoadLibrary" with a parameter imm32.dll (UID: 00000000-00001484) "5cN0su3.exe" called "LoadLibrary" with a parameter comctl32.dll (UID: 00000000-00001484) "5cN0su3.exe" called "LoadLibrary" with a parameter SHFolder.dll (UID: 00000000-00001484) "5cN0su3.exe" called "LoadLibrary" with a parameter %TEMP%\IXP002.TMP\5cN0su3.ENU (UID: 00000000-00001484) "5cN0su3.exe" called "LoadLibrary" with a parameter %TEMP%\IXP002.TMP\5cN0su3.EN (UID: 00000000-00001484) "5cN0su3.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\uxtheme.dll (UID: 00000000-00001484) "5cN0su3.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00001484) "5cN0su3.exe" called "LoadLibrary" with a parameter SspiCli.dll (UID: 00000000-00001484) "5cN0su3.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00001484) "5cN0su3.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00001484) "5cN0su3.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00001484) "5cN0su3.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00001484) "5cN0su3.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll (UID: 00000000-00001484) "5cN0su3.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00001484) "5cN0su3.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2.dll (UID: 00000000-00001484) "5cN0su3.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-0.dll (UID: 00000000-00001484) "5cN0su3.exe" called "LoadLibrary" with a parameter VERSION.dll (UID: 00000000-00001484) "5cN0su3.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\clr.dll (UID: 00000000-00001484) "5cN0su3.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00001484) "5cN0su3.exe" called "LoadLibrary" with a parameter api-ms-win-core-quirks-l1-1-0.dll (UID: 00000000-00001484) "5cN0su3.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoree.dll (UID: 00000000-00001484) "5cN0su3.exe" called "LoadLibrary" with a parameter mscoree.dll (UID: 00000000-00001484) "5cN0su3.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\combase.dll (UID: 00000000-00001484) "5cN0su3.exe" called "LoadLibrary" with a parameter psapi.dll (UID: 00000000-00001484) "5cN0su3.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\mscorlib\36eaccfde177c2e7b93b8dbdde4e012a\mscorlib.ni.dll (UID: 00000000-00001484) "5cN0su3.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\ole32.dll (UID: 00000000-00001484) "5cN0su3.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00001484) "5cN0su3.exe" called "LoadLibrary" with a parameter api-ms-win-core-xstate-l2-1-0.dll (UID: 00000000-00001484) "5cN0su3.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\clrjit.dll (UID: 00000000-00001484) "5cN0su3.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System\2c3c912ea8f058f9d04c4650128feb3f\System.ni.dll (UID: 00000000-00001484) "5cN0su3.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Core\31fae3290fad30c31c98651462d22724\System.Core.ni.dll (UID: 00000000-00001484) "5cN0su3.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\Microsoft.CSharp\f73f48afb5512225dedaee9c88ac5050\Microsoft.CSharp.ni.dll (UID: 00000000-00001484) "5cN0su3.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00001484) "5cN0su3.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00001484) "5cN0su3.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\nlssorting.dll (UID: 00000000-00001484) "5cN0su3.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Configuration\96f7edb07b12303f0ec2595c7f3778c7\System.Configuration.ni.dll (UID: 00000000-00001484) "5cN0su3.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Xml\15af16d373cf0528cb74fc73d365fdbf\System.Xml.ni.dll (UID: 00000000-00001484) "5cN0su3.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00001484) "5cN0su3.exe" called "LoadLibrary" with a parameter shell32.dll (UID: 00000000-00001484) "5cN0su3.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll (UID: 00000000-00001484) "5cN0su3.exe" called "LoadLibrary" with a parameter bcrypt.dll (UID: 00000000-00001484) "5cN0su3.exe" called "LoadLibrary" with a parameter CRYPTSP.dll (UID: 00000000-00001484) "5cN0su3.exe" called "LoadLibrary" with a parameter CRYPTBASE.dll (UID: 00000000-00001484) "5cN0su3.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll (UID: 00000000-00001484) "5cN0su3.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll (UID: 00000000-00001484) "5cN0su3.exe" called "LoadLibrary" with a parameter API-MS-Win-Security-LSALookup-L1-1-0.dll (UID: 00000000-00001484) "5cN0su3.exe" called "LoadLibrary" with a parameter propsys.dll (UID: 00000000-00001484) "5cN0su3.exe" called "LoadLibrary" with a parameter ntmarta.dll (UID: 00000000-00001484) "5cN0su3.exe" called "LoadLibrary" with a parameter SHELL32.dll (UID: 00000000-00001484) "5cN0su3.exe" called "LoadLibrary" with a parameter %WINDIR%\System32\shdocvw.dll (UID: 00000000-00001484) "5cN0su3.exe" called "LoadLibrary" with a parameter PROPSYS.dll (UID: 00000000-00001484) "5cN0su3.exe" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00001484) "5cN0su3.exe" called "LoadLibrary" with a parameter ntshrui.dll (UID: 00000000-00001484) "5cN0su3.exe" called "LoadLibrary" with a parameter srvcli.dll (UID: 00000000-00001484) "5cN0su3.exe" called "LoadLibrary" with a parameter cscapi.dll (UID: 00000000-00001484) "5cN0su3.exe" called "LoadLibrary" with a parameter slc.dll (UID: 00000000-00001484) "5cN0su3.exe" called "LoadLibrary" with a parameter API-MS-Win-Security-SDDL-L1-1-0.dll (UID: 00000000-00001484) "5cN0su3.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ws2_32.dll (UID: 00000000-00001484) "5cN0su3.exe" called "LoadLibrary" with a parameter ws2_32.dll (UID: 00000000-00001484) "powershell.exe" called "LoadLibrary" with a parameter SHELL32.dll (UID: 00000000-00003228) "powershell.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00003228) "powershell.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00003228) "powershell.exe" called "LoadLibrary" with a parameter propsys.dll (UID: 00000000-00003228) "powershell.exe" called "LoadLibrary" with a parameter ntmarta.dll (UID: 00000000-00003228) "powershell.exe" called "LoadLibrary" with a parameter API-MS-Win-Core-LocalRegistry-L1-1-0.dll (UID: 00000000-00003228) "powershell.exe" called "LoadLibrary" with a parameter PROPSYS.dll (UID: 00000000-00003228) "powershell.exe" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00003228) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\shell32.dll (UID: 00000000-00003228) "powershell.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00003228) "powershell.exe" called "LoadLibrary" with a parameter ntshrui.dll (UID: 00000000-00003228) "powershell.exe" called "LoadLibrary" with a parameter srvcli.dll (UID: 00000000-00003228) "powershell.exe" called "LoadLibrary" with a parameter cscapi.dll (UID: 00000000-00003228) "powershell.exe" called "LoadLibrary" with a parameter slc.dll (UID: 00000000-00003228) "powershell.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00003228) "powershell.exe" called "LoadLibrary" with a parameter CRYPTBASE.dll (UID: 00000000-00003228) "powershell.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00003228) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00003228) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00003228) "powershell.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00003228) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00003228) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll (UID: 00000000-00003228) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2.dll (UID: 00000000-00003228) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-0.dll (UID: 00000000-00003228) "powershell.exe" called "LoadLibrary" with a parameter VERSION.dll (UID: 00000000-00003228) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v2.0.50727\mscorwks.dll (UID: 00000000-00003228) "powershell.exe" called "LoadLibrary" with a parameter mscoree.dll (UID: 00000000-00003228) "powershell.exe" called "LoadLibrary" with a parameter ntdll (UID: 00000000-00003228) "powershell.exe" called "LoadLibrary" with a parameter shell32.dll (UID: 00000000-00003228) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v2.0.50727_32\mscorlib\9f895c66454577eff9c77442d0c84f71\mscorlib.ni.dll (UID: 00000000-00003228) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v2.0.50727\ole32.dll (UID: 00000000-00003228) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v2.0.50727\OLEAUT32.dll (UID: 00000000-00003228) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v2.0.50727_32\System\ad92dab7f418877d6a1e0358ce35658a\System.ni.dll (UID: 00000000-00003228) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v2.0.50727_32\Microsoft.PowerShel#\8229f0505633d4bcef019b9d4fab9f18\Microsoft.PowerShell.ConsoleH (UID: 00000000-00003228) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v2.0.50727_32\System.Management.A#\84c47b5a5813a5f040aee9715a0ff7c0\System.Management.Automation. (UID: 00000000-00003228) "powershell.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00003228) "powershell.exe" called "LoadLibrary" with a parameter version.dll (UID: 00000000-00003228) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\GAC_MSIL\System.Management.Automation\1.0.0.0__31bf3856ad364e35\System.Management.Automation.dll (UID: 00000000-00003228) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\GAC_MSIL\System\2.0.0.0__b77a5c561934e089\psapi.dll (UID: 00000000-00003228) "powershell.exe" called "LoadLibrary" with a parameter psapi.dll (UID: 00000000-00003228) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\GAC_MSIL\System\2.0.0.0__b77a5c561934e089\ntdll.dll (UID: 00000000-00003228) "powershell.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00003228) "powershell.exe" called "LoadLibrary" with a parameter user32.dll (UID: 00000000-00003228) "powershell.exe" called "LoadLibrary" with a parameter AdvApi32.dll (UID: 00000000-00003228) "powershell.exe" called "LoadLibrary" with a parameter CRYPTSP.dll (UID: 00000000-00003228) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v2.0.50727_32\System.Core\bd9ff1a4363781a57e8f7392f230a203\System.Core.ni.dll (UID: 00000000-00003228) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v2.0.50727_32\Microsoft.PowerShel#\49cae79ac18bad142e1ab5a46a8ac306\Microsoft.PowerShell.Commands (UID: 00000000-00003228) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v2.0.50727_32\System.Configuratio#\d6acc39f6c1ea42d8b3150db6184a969\System.Configuration.Install. (UID: 00000000-00003228) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v2.0.50727_32\Microsoft.WSMan.Man#\7bf5729401cff7ea7898124e9818ed20\Microsoft.WSMan.Management.ni (UID: 00000000-00003228) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v2.0.50727_32\System.Transactions\fec007ea17ac8956cc5d6d4074dada6a\System.Transactions.ni.dll (UID: 00000000-00003228) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\GAC_32\System.Transactions\2.0.0.0__b77a5c561934e089\System.Transactions.dll (UID: 00000000-00003228) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v2.0.50727_32\Microsoft.PowerShel#\f1831ce4588265a3f72e0a581ba58f2a\Microsoft.PowerShell.Commands (UID: 00000000-00003228) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v2.0.50727_32\Microsoft.PowerShel#\344e681515d07b93a4f1383f0d625e1e\Microsoft.PowerShell.Commands (UID: 00000000-00003228) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v2.0.50727_32\Microsoft.PowerShel#\573750f17b5b8316f04a10956fdd1d97\Microsoft.PowerShell.Security (UID: 00000000-00003228) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v2.0.50727\culture.dll (UID: 00000000-00003228) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v2.0.50727\en-US\mscorrc.dll (UID: 00000000-00003228) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v2.0.50727\en\mscorrc.dll (UID: 00000000-00003228) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v2.0.50727\mscorrc.dll (UID: 00000000-00003228) "powershell.exe" called "LoadLibrary" with a parameter KERNEL32.dll (UID: 00000000-00003228) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v2.0.50727_32\System.Xml\77c1dc46ea139bf5e1eaa9b87ef03c7a\System.Xml.ni.dll (UID: 00000000-00003228) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v2.0.50727_32\System.Management\00c2b464e52d4e82c04d61592a12a89d\System.Management.ni.dll (UID: 00000000-00003228) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v2.0.50727_32\System.DirectorySer#\237ed1739105c1bebe48d41905fdb3ee\System.DirectoryServices.ni.d (UID: 00000000-00003228) "powershell.exe" called "LoadLibrary" with a parameter shfolder.dll (UID: 00000000-00003228) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\secur32.dll (UID: 00000000-00003228) "powershell.exe" called "LoadLibrary" with a parameter secur32.dll (UID: 00000000-00003228) "powershell.exe" called "LoadLibrary" with a parameter SspiCli.dll (UID: 00000000-00003228) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v2.0.50727_32\System.Data\511c39d1efa06d262a6b2f47e2726c73\System.Data.ni.dll (UID: 00000000-00003228) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\GAC_32\System.Data\2.0.0.0__b77a5c561934e089\System.Data.dll (UID: 00000000-00003228) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v2.0.50727\mscorjit.dll (UID: 00000000-00003228) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v2.0.50727\diasymreader.dll (UID: 00000000-00003228) "powershell.exe" called "LoadLibrary" with a parameter GDI32.dll (UID: 00000000-00003228) "powershell.exe" called "LoadLibrary" with a parameter netutils.dll (UID: 00000000-00003228) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00003008) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00003008) "cmd.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00003008) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00003008) "schtasks.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00000956) "schtasks.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00000956) "schtasks.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00000956) "schtasks.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00000956) "schtasks.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\schtasks.exe (UID: 00000000-00000956) "schtasks.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\uxtheme.dll (UID: 00000000-00000956) "schtasks.exe" called "LoadLibrary" with a parameter API-MS-Win-Security-LSALookup-L1-1-0.dll (UID: 00000000-00000956) "schtasks.exe" called "LoadLibrary" with a parameter SspiCli.dll (UID: 00000000-00000956) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00003908) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00003908) "cmd.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00003908) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00003908) "schtasks.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\schtasks.exe (UID: 00000000-00003728) "schtasks.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\uxtheme.dll (UID: 00000000-00003728) "schtasks.exe" called "LoadLibrary" with a parameter API-MS-Win-Security-LSALookup-L1-1-0.dll (UID: 00000000-00003728) "schtasks.exe" called "LoadLibrary" with a parameter SspiCli.dll (UID: 00000000-00003728)34:T1ab3,"SELECT * FROM Win32_LogicalDisk WHERE DeviceID = '" (Source: 00000000-00001484.00000000.67206.03360000.00000004.mdmp, 00000000-00001484.00000001.69129.03360000.00000004.mdmp, 00000000-00001484.00000002.71052.03360000.00000004.mdmp, Indicator: "select * from win32_logicaldisk where deviceid = '") "SELECT * FROM Win32_Processor" (Source: 00000000-00001484.00000000.67206.03360000.00000004.mdmp, 00000000-00001484.00000001.69129.03360000.00000004.mdmp, 00000000-00001484.00000002.71052.03360000.00000004.mdmp, Indicator: "select * from win32_processor") "SELECT * FROM Win32_PhysicalMemory" (Source: 00000000-00001484.00000000.67206.03360000.00000004.mdmp, 00000000-00001484.00000001.69129.03360000.00000004.mdmp, 00000000-00001484.00000002.71052.03360000.00000004.mdmp, Indicator: "select * from win32_physicalmemory") "SELECT * FROM Win32_VideoController" (Source: 00000000-00001484.00000000.67206.03360000.00000004.mdmp, 00000000-00001484.00000001.69129.03360000.00000004.mdmp, 00000000-00001484.00000002.71052.03360000.00000004.mdmp, Indicator: "select * from win32_videocontroller") "SELECT action_url, origin_url, username_value, password_value FROM logins" (Source: 00000000-00001484.00000000.67206.03360000.00000004.mdmp, 00000000-00001484.00000001.69129.03360000.00000004.mdmp, 00000000-00001484.00000002.71052.03360000.00000004.mdmp, Indicator: "select action_url, origin_url, username_value, password_value from logins") "SELECT name, value FROM autofill" (Source: 00000000-00001484.00000000.67206.03360000.00000004.mdmp, 00000000-00001484.00000001.69129.03360000.00000004.mdmp, 00000000-00001484.00000002.71052.03360000.00000004.mdmp, Indicator: "select name, value from autofill") "SELECT tab_url, target_path FROM downloads" (Source: 00000000-00001484.00000000.67206.03360000.00000004.mdmp, 00000000-00001484.00000001.69129.03360000.00000004.mdmp, 00000000-00001484.00000002.71052.03360000.00000004.mdmp, Indicator: "select tab_url, target_path from downloads") "SELECT name_on_card, expiration_month, expiration_year, card_number_encrypted, origin, billing_address_id, nickname FROM credit_cards" (Source: 00000000-00001484.00000000.67206.03360000.00000004.mdmp, 00000000-00001484.00000001.69129.03360000.00000004.mdmp, 00000000-00001484.00000002.71052.03360000.00000004.mdmp, Indicator: "select name_on_card, expiration_month, expiration_year, card_number_encrypted, origin, billing_address_id, nickname from credit_cards") "SELECT name_on_card, exp_month, exp_year, last_four, nickname, bank_name, card_art_url, network FROM masked_credit_cards" (Source: 00000000-00001484.00000000.67206.03360000.00000004.mdmp, 00000000-00001484.00000001.69129.03360000.00000004.mdmp, 00000000-00001484.00000002.71052.03360000.00000004.mdmp, Indicator: "select name_on_card, exp_month, exp_year, last_four, nickname, bank_name, card_art_url, network from masked_credit_cards") "SELECT host_key, is_httponly, path, is_secure, expires_utc, name, value, encrypted_value FROM cookies" (Source: 00000000-00001484.00000000.67206.03360000.00000004.mdmp, 00000000-00001484.00000001.69129.03360000.00000004.mdmp, 00000000-00001484.00000002.71052.03360000.00000004.mdmp, Indicator: "select host_key, is_httponly, path, is_secure, expires_utc, name, value, encrypted_value from cookies") "SELECT service, encrypted_token FROM token_service" (Source: 00000000-00001484.00000000.67206.03360000.00000004.mdmp, 00000000-00001484.00000001.69129.03360000.00000004.mdmp, 00000000-00001484.00000002.71052.03360000.00000004.mdmp, Indicator: "select service, encrypted_token from token_service") "SELECT url, last_visit_time FROM(SELECT url, last_visit_time, id FROM urls ORDER BY id DESC LIMIT 2500) ORDER BY id ASC" (Source: 00000000-00001484.00000000.67206.03360000.00000004.mdmp, 00000000-00001484.00000001.69129.03360000.00000004.mdmp, 00000000-00001484.00000002.71052.03360000.00000004.mdmp, Indicator: "select url, last_visit_time from(select url, last_visit_time, id from urls order by id desc limit 2500) order by id asc"), "SELECT * FROM" (Source: 00000000-00001484.00000000.67206.03360000.00000004.mdmp, 00000000-00001484.00000001.69129.03360000.00000004.mdmp, 00000000-00001484.00000002.71052.03360000.00000004.mdmp, Indicator: "select * from"), "CREATE TABLE" (Source: 00000000-00001484.00000000.67206.03360000.00000004.mdmp, 00000000-00001484.00000001.69129.03360000.00000004.mdmp, 00000000-00001484.00000002.71052.03360000.00000004.mdmp, Indicator: "create table"), "SELECT name FROM sqlite_master WHERE type='table';" (Source: 00000000-00001484.00000000.67206.03360000.00000004.mdmp, 00000000-00001484.00000001.69129.03360000.00000004.mdmp, 00000000-00001484.00000002.71052.03360000.00000004.mdmp, Indicator: "select name from sqlite_master where type='table';"), "SELECT encryptedUsername encryptedPassword formSubmitURL FROM moz_logins" (Source: 00000000-00001484.00000000.67206.03360000.00000004.mdmp, 00000000-00001484.00000001.69129.03360000.00000004.mdmp, 00000000-00001484.00000002.71052.03360000.00000004.mdmp, Indicator: "select encryptedusername encryptedpassword formsubmiturl from moz_logins"), "SELECT fieldname value FROM moz_formhistory;" (Source: 00000000-00001484.00000000.67206.03360000.00000004.mdmp, 00000000-00001484.00000001.69129.03360000.00000004.mdmp, 00000000-00001484.00000002.71052.03360000.00000004.mdmp, Indicator: "select fieldname value from moz_formhistory;"), "SELECT place_id content FROM moz_annos WHERE anno_attribute_id = 1" (Source: 00000000-00001484.00000000.67206.03360000.00000004.mdmp, 00000000-00001484.00000001.69129.03360000.00000004.mdmp, 00000000-00001484.00000002.71052.03360000.00000004.mdmp, Indicator: "select place_id content from moz_annos where anno_attribute_id = 1"), "SELECT url FROM moz_places WHERE id = {0}" (Source: 00000000-00001484.00000000.67206.03360000.00000004.mdmp, 00000000-00001484.00000001.69129.03360000.00000004.mdmp, 00000000-00001484.00000002.71052.03360000.00000004.mdmp, Indicator: "select url from moz_places where id = {0}"), "SELECT host isHttpOnly path isSecure expiry name value FROM moz_cookies" (Source: 00000000-00001484.00000000.67206.03360000.00000004.mdmp, 00000000-00001484.00000001.69129.03360000.00000004.mdmp, 00000000-00001484.00000002.71052.03360000.00000004.mdmp, Indicator: "select host ishttponly path issecure expiry name value from moz_cookies"), "SELECT place_id visit_date FROM(SELECT place_id, visit_date, id FROM moz_historyvisits ORDER BY id DESC LIMIT 2500) ORDER BY id ASC" (Source: 00000000-00001484.00000000.67206.03360000.00000004.mdmp, 00000000-00001484.00000001.69129.03360000.00000004.mdmp, 00000000-00001484.00000002.71052.03360000.00000004.mdmp, Indicator: "select place_id visit_date from(select place_id, visit_date, id from moz_historyvisits order by id desc limit 2500) order by id asc")35:Ta37,Found reference to API "CreateProcessA" (Indicator: "CreateProcess"; File: "d470377f9b683b10aa2230b05a5fcdcd.exe") Found reference to API "ElevateCreateProcess WRPMitigationLayer" (Indicator: "CreateProcess"; File: "00001540.00000604.736734.00090000.wprm") Found reference to API "__COMPAT_LAYER=ElevateCreateProcess WRPMitigationLayer" (Indicator: "CreateProcess"; Source: "00000000-00001484.00000000.67206.003A0000.00000004.mdmp, 00000000-00001484.00000000.67206.009C0000.00000004.mdmp, 00000000-00001484.00000000.67206.00C40000.00000004.mdmp, 00000000-00001484.00000001.69129.003A0000.00000004.mdmp, 00000000-00001484.00000001.69129.00660000.00000004.mdmp, 00000000-00001484.00000001.69129.009C0000.00000004.mdmp, 00000000-00001484.00000001.69129.00C40000.00000004.mdmp, 00000000-00001484.00000002.71052.003A0000.00000004.mdmp, 00000000-00001484.00000002.71052.009C0000.00000004.mdmp, 00000000-00001484.00000002.71052.00C40000.00000004.mdmp") Found reference to API "ElevateCreateProcess" (Indicator: "CreateProcess"; Source: "00000000-00001484.00000000.67206.003A0000.00000004.mdmp, 00000000-00001484.00000001.69129.003A0000.00000004.mdmp, 00000000-00001484.00000002.71052.003A0000.00000004.mdmp") Found reference to API "_COMPAT_LAYER=ElevateCreateProcess WRPMitigationLayer" (Indicator: "CreateProcess"; Source: "00000000-00001484.00000000.67206.003A0000.00000004.mdmp") Found reference to API "ElevateCreateProcess WRPMitigationLayer" (Indicator: "CreateProcess"; Source: "00000000-00001484.00000000.67206.003A0000.00000004.mdmp") Found reference to API "8897248765,952,3137,,CreateProcessW,kernel32.dll,"252:03:18.611",RX=0,PX=0" (Indicator: "CreateProcess"; Source: "00000000-00001484.00000000.67206.003A0000.00000004.mdmp") Found reference to API "__COMPAT_LAYER=ElevateCreateProcess WRPMitigC" (Indicator: "CreateProcess"; Source: "00000000-00001484.00000000.67206.009C0000.00000004.mdmp, 00000000-00001484.00000001.69129.009C0000.00000004.mdmp, 00000000-00001484.00000002.71052.009C0000.00000004.mdmp") Found reference to API "CreateProcess" (Indicator: "CreateProcess"; Source: "00000000-00001484.00000001.69129.00DC2000.00000040.mdmp") Found reference to API "__COMPAT_LAYER=ElevateCreateProcess WRPMitig" (Indicator: "CreateProcess"; Source: "00000000-00001540.00000000.66773.006B0000.00000004.mdmp") Found reference to API "__COMPAT_LAYER=ElevateCreateProcess WRPMitigationLayer" (Indicator: "CreateProcess"; Source: "00000000-00001540.00000000.66773.006B0000.00000004.mdmp, 00000000-00001540.00000001.68696.000B0000.00000004.mdmp, 00000000-00001540.00000001.68696.00D10000.00000004.mdmp")36:T7edb,Found reference to API (Indicator: "CheckTokenMembership"; File: "d470377f9b683b10aa2230b05a5fcdcd.exe") Found reference to API (Indicator: "HeapSetInformation"; File: "d470377f9b683b10aa2230b05a5fcdcd.exe") Found reference to API (Indicator: "DecryptFileA"; File: "d470377f9b683b10aa2230b05a5fcdcd.exe") Found reference to API (Indicator: "SHBrowseForFolder"; File: "d470377f9b683b10aa2230b05a5fcdcd.exe") Found reference to API (Indicator: "SHGetPathFromIDList"; File: "d470377f9b683b10aa2230b05a5fcdcd.exe") Found reference to API (Indicator: "GetTokenInformation"; File: "d470377f9b683b10aa2230b05a5fcdcd.exe") Found reference to API (Indicator: "RegDeleteValueA"; File: "d470377f9b683b10aa2230b05a5fcdcd.exe") Found reference to API (Indicator: "RegOpenKeyExA"; File: "d470377f9b683b10aa2230b05a5fcdcd.exe") Found reference to API (Indicator: "RegQueryInfoKeyA"; File: "d470377f9b683b10aa2230b05a5fcdcd.exe") Found reference to API (Indicator: "FreeSid"; File: "d470377f9b683b10aa2230b05a5fcdcd.exe") Found reference to API (Indicator: "OpenProcessToken"; File: "d470377f9b683b10aa2230b05a5fcdcd.exe") Found reference to API (Indicator: "RegSetValueExA"; File: "d470377f9b683b10aa2230b05a5fcdcd.exe") Found reference to API (Indicator: "RegCreateKeyExA"; File: "d470377f9b683b10aa2230b05a5fcdcd.exe") Found reference to API (Indicator: "LookupPrivilegeValueA"; File: "d470377f9b683b10aa2230b05a5fcdcd.exe") Found reference to API (Indicator: "AllocateAndInitializeSid"; File: "d470377f9b683b10aa2230b05a5fcdcd.exe") Found reference to API (Indicator: "RegQueryValueExA"; File: "d470377f9b683b10aa2230b05a5fcdcd.exe") Found reference to API (Indicator: "EqualSid"; File: "d470377f9b683b10aa2230b05a5fcdcd.exe") Found reference to API (Indicator: "RegCloseKey"; File: "d470377f9b683b10aa2230b05a5fcdcd.exe") Found reference to API (Indicator: "AdjustTokenPrivileges"; File: "d470377f9b683b10aa2230b05a5fcdcd.exe") Found reference to API (Indicator: "GetShortPathNameA"; File: "d470377f9b683b10aa2230b05a5fcdcd.exe") Found reference to API (Indicator: "GetModuleFileNameA"; File: "d470377f9b683b10aa2230b05a5fcdcd.exe") Found reference to API (Indicator: "FindFirstFileA"; File: "d470377f9b683b10aa2230b05a5fcdcd.exe") Found reference to API (Indicator: "GetCurrentProcess"; File: "d470377f9b683b10aa2230b05a5fcdcd.exe") Found reference to API (Indicator: "FindNextFileA"; File: "d470377f9b683b10aa2230b05a5fcdcd.exe") Found reference to API (Indicator: "ExpandEnvironmentStringsA"; File: "d470377f9b683b10aa2230b05a5fcdcd.exe") Found reference to API (Indicator: "FindClose"; File: "d470377f9b683b10aa2230b05a5fcdcd.exe") Found reference to API (Indicator: "LocalAlloc"; File: "d470377f9b683b10aa2230b05a5fcdcd.exe") Found reference to API (Indicator: "lstrcmpA"; File: "d470377f9b683b10aa2230b05a5fcdcd.exe") Found reference to API (Indicator: "CompareStringA"; File: "d470377f9b683b10aa2230b05a5fcdcd.exe") Found reference to API (Indicator: "GetLastError"; File: "d470377f9b683b10aa2230b05a5fcdcd.exe") Found reference to API (Indicator: "GetFileAttributesA"; File: "d470377f9b683b10aa2230b05a5fcdcd.exe") Found reference to API (Indicator: "GetSystemDirectoryA"; File: "d470377f9b683b10aa2230b05a5fcdcd.exe") Found reference to API (Indicator: "LoadLibraryA"; File: "d470377f9b683b10aa2230b05a5fcdcd.exe") Found reference to API (Indicator: "DeleteFileA"; File: "d470377f9b683b10aa2230b05a5fcdcd.exe") Found reference to API (Indicator: "GlobalAlloc"; File: "d470377f9b683b10aa2230b05a5fcdcd.exe") Found reference to API (Indicator: "GlobalFree"; File: "d470377f9b683b10aa2230b05a5fcdcd.exe") Found reference to API (Indicator: "CloseHandle"; File: "d470377f9b683b10aa2230b05a5fcdcd.exe") Found reference to API (Indicator: "WritePrivateProfileStringA"; File: "d470377f9b683b10aa2230b05a5fcdcd.exe") Found reference to API (Indicator: "IsDBCSLeadByte"; File: "d470377f9b683b10aa2230b05a5fcdcd.exe") Found reference to API (Indicator: "GetWindowsDirectoryA"; File: "d470377f9b683b10aa2230b05a5fcdcd.exe") Found reference to API (Indicator: "SetFileAttributesA"; File: "d470377f9b683b10aa2230b05a5fcdcd.exe") Found reference to API (Indicator: "GetProcAddress"; File: "d470377f9b683b10aa2230b05a5fcdcd.exe") Found reference to API (Indicator: "GlobalLock"; File: "d470377f9b683b10aa2230b05a5fcdcd.exe") Found reference to API (Indicator: "LocalFree"; File: "d470377f9b683b10aa2230b05a5fcdcd.exe") Found reference to API (Indicator: "RemoveDirectoryA"; File: "d470377f9b683b10aa2230b05a5fcdcd.exe") Found reference to API (Indicator: "FreeLibrary"; File: "d470377f9b683b10aa2230b05a5fcdcd.exe") Found reference to API (Indicator: "CreateDirectoryA"; File: "d470377f9b683b10aa2230b05a5fcdcd.exe") Found reference to API (Indicator: "GetPrivateProfileIntA"; File: "d470377f9b683b10aa2230b05a5fcdcd.exe") Found reference to API (Indicator: "GetPrivateProfileStringA"; File: "d470377f9b683b10aa2230b05a5fcdcd.exe") Found reference to API (Indicator: "GlobalUnlock"; File: "d470377f9b683b10aa2230b05a5fcdcd.exe") Found reference to API (Indicator: "ReadFile"; File: "d470377f9b683b10aa2230b05a5fcdcd.exe") Found reference to API (Indicator: "SizeofResource"; File: "d470377f9b683b10aa2230b05a5fcdcd.exe") Found reference to API (Indicator: "WriteFile"; File: "d470377f9b683b10aa2230b05a5fcdcd.exe") Found reference to API (Indicator: "GetDriveTypeA"; File: "d470377f9b683b10aa2230b05a5fcdcd.exe") Found reference to API (Indicator: "LoadLibraryExA"; File: "d470377f9b683b10aa2230b05a5fcdcd.exe") Found reference to API (Indicator: "SetFileTime"; File: "d470377f9b683b10aa2230b05a5fcdcd.exe") Found reference to API (Indicator: "SetFilePointer"; File: "d470377f9b683b10aa2230b05a5fcdcd.exe") Found reference to API (Indicator: "FindResourceA"; File: "d470377f9b683b10aa2230b05a5fcdcd.exe") Found reference to API (Indicator: "CreateMutexA"; File: "d470377f9b683b10aa2230b05a5fcdcd.exe") Found reference to API (Indicator: "GetVolumeInformationA"; File: "d470377f9b683b10aa2230b05a5fcdcd.exe") Found reference to API (Indicator: "WaitForSingleObject"; File: "d470377f9b683b10aa2230b05a5fcdcd.exe") Found reference to API (Indicator: "GetCurrentDirectoryA"; File: "d470377f9b683b10aa2230b05a5fcdcd.exe") Found reference to API (Indicator: "FreeResource"; File: "d470377f9b683b10aa2230b05a5fcdcd.exe") Found reference to API (Indicator: "GetVersion"; File: "d470377f9b683b10aa2230b05a5fcdcd.exe") Found reference to API (Indicator: "SetCurrentDirectoryA"; File: "d470377f9b683b10aa2230b05a5fcdcd.exe") Found reference to API (Indicator: "GetTempPathA"; File: "d470377f9b683b10aa2230b05a5fcdcd.exe") Found reference to API (Indicator: "LocalFileTimeToFileTime"; File: "d470377f9b683b10aa2230b05a5fcdcd.exe") Found reference to API (Indicator: "CreateFileA"; File: "d470377f9b683b10aa2230b05a5fcdcd.exe") Found reference to API (Indicator: "SetEvent"; File: "d470377f9b683b10aa2230b05a5fcdcd.exe") Found reference to API (Indicator: "TerminateThread"; File: "d470377f9b683b10aa2230b05a5fcdcd.exe") Found reference to API (Indicator: "GetVersionExA"; File: "d470377f9b683b10aa2230b05a5fcdcd.exe") Found reference to API (Indicator: "LockResource"; File: "d470377f9b683b10aa2230b05a5fcdcd.exe") Found reference to API (Indicator: "GetSystemInfo"; File: "d470377f9b683b10aa2230b05a5fcdcd.exe") Found reference to API (Indicator: "CreateThread"; File: "d470377f9b683b10aa2230b05a5fcdcd.exe") Found reference to API (Indicator: "ResetEvent"; File: "d470377f9b683b10aa2230b05a5fcdcd.exe") Found reference to API (Indicator: "LoadResource"; File: "d470377f9b683b10aa2230b05a5fcdcd.exe") Found reference to API (Indicator: "ExitProcess"; File: "d470377f9b683b10aa2230b05a5fcdcd.exe") Found reference to API (Indicator: "GetModuleHandleW"; File: "d470377f9b683b10aa2230b05a5fcdcd.exe") Found reference to API (Indicator: "CreateProcessA"; File: "d470377f9b683b10aa2230b05a5fcdcd.exe") Found reference to API (Indicator: "FormatMessageA"; File: "d470377f9b683b10aa2230b05a5fcdcd.exe") Found reference to API (Indicator: "GetTempFileNameA"; File: "d470377f9b683b10aa2230b05a5fcdcd.exe") Found reference to API (Indicator: "DosDateTimeToFileTime"; File: "d470377f9b683b10aa2230b05a5fcdcd.exe") Found reference to API (Indicator: "CreateEventA"; File: "d470377f9b683b10aa2230b05a5fcdcd.exe") Found reference to API (Indicator: "GetExitCodeProcess"; File: "d470377f9b683b10aa2230b05a5fcdcd.exe") Found reference to API (Indicator: "GetDeviceCaps"; File: "d470377f9b683b10aa2230b05a5fcdcd.exe") Found reference to API (Indicator: "GetDesktopWindow"; File: "d470377f9b683b10aa2230b05a5fcdcd.exe") Found reference to API (Indicator: "CharUpperA"; File: "d470377f9b683b10aa2230b05a5fcdcd.exe") Found reference to API (Indicator: "ExitWindowsEx"; File: "d470377f9b683b10aa2230b05a5fcdcd.exe") Found reference to API (Indicator: "MessageBeep"; File: "d470377f9b683b10aa2230b05a5fcdcd.exe") Found reference to API (Indicator: "CharPrevA"; File: "d470377f9b683b10aa2230b05a5fcdcd.exe") Found reference to API (Indicator: "LoadStringA"; File: "d470377f9b683b10aa2230b05a5fcdcd.exe") Found reference to API (Indicator: "CharNextA"; File: "d470377f9b683b10aa2230b05a5fcdcd.exe") Found reference to API (Indicator: "EnableWindow"; File: "d470377f9b683b10aa2230b05a5fcdcd.exe") Found reference to API (Indicator: "ReleaseDC"; File: "d470377f9b683b10aa2230b05a5fcdcd.exe") Found reference to API (Indicator: "SetForegroundWindow"; File: "d470377f9b683b10aa2230b05a5fcdcd.exe") Found reference to API (Indicator: "PeekMessageA"; File: "d470377f9b683b10aa2230b05a5fcdcd.exe") Found reference to API (Indicator: "SendMessageA"; File: "d470377f9b683b10aa2230b05a5fcdcd.exe") Found reference to API (Indicator: "MessageBoxA"; File: "d470377f9b683b10aa2230b05a5fcdcd.exe") Found reference to API (Indicator: "SetWindowTextA"; File: "d470377f9b683b10aa2230b05a5fcdcd.exe") Found reference to API (Indicator: "GetWindowLongA"; File: "d470377f9b683b10aa2230b05a5fcdcd.exe") Found reference to API (Indicator: "CallWindowProcA"; File: "d470377f9b683b10aa2230b05a5fcdcd.exe") Found reference to API (Indicator: "SetWindowLongA"; File: "d470377f9b683b10aa2230b05a5fcdcd.exe") Found reference to API (Indicator: "ShowWindow"; File: "d470377f9b683b10aa2230b05a5fcdcd.exe") Found reference to API (Indicator: "MsgWaitForMultipleObjects"; File: "d470377f9b683b10aa2230b05a5fcdcd.exe") Found reference to API (Indicator: "SetWindowPos"; File: "d470377f9b683b10aa2230b05a5fcdcd.exe") Found reference to API (Indicator: "GetDC"; File: "d470377f9b683b10aa2230b05a5fcdcd.exe") Found reference to API (Indicator: "GetWindowRect"; File: "d470377f9b683b10aa2230b05a5fcdcd.exe") Found reference to API (Indicator: "DispatchMessageA"; File: "d470377f9b683b10aa2230b05a5fcdcd.exe") Found reference to API (Indicator: "GetFileVersionInfoSizeA"; File: "d470377f9b683b10aa2230b05a5fcdcd.exe") Found reference to API (Indicator: "VerQueryValueA"; File: "d470377f9b683b10aa2230b05a5fcdcd.exe") Found reference to API (Indicator: "GetFileVersionInfoA"; File: "d470377f9b683b10aa2230b05a5fcdcd.exe") Found reference to API (Indicator: "Sleep"; File: "d470377f9b683b10aa2230b05a5fcdcd.exe") Found reference to API (Indicator: "GetStartupInfoW"; File: "d470377f9b683b10aa2230b05a5fcdcd.exe") Found reference to API (Indicator: "UnhandledExceptionFilter"; File: "d470377f9b683b10aa2230b05a5fcdcd.exe") Found reference to API (Indicator: "SetUnhandledExceptionFilter"; File: "d470377f9b683b10aa2230b05a5fcdcd.exe") Found reference to API (Indicator: "TerminateProcess"; File: "d470377f9b683b10aa2230b05a5fcdcd.exe") Found reference to API (Indicator: "QueryPerformanceCounter"; File: "d470377f9b683b10aa2230b05a5fcdcd.exe") Found reference to API (Indicator: "GetCurrentProcessId"; File: "d470377f9b683b10aa2230b05a5fcdcd.exe") Found reference to API (Indicator: "GetCurrentThreadId"; File: "d470377f9b683b10aa2230b05a5fcdcd.exe") Found reference to API (Indicator: "GetSystemTimeAsFileTime"; File: "d470377f9b683b10aa2230b05a5fcdcd.exe") Found reference to API (Indicator: "GetTickCount"; File: "d470377f9b683b10aa2230b05a5fcdcd.exe") Found reference to API (Indicator: "EnumResourceLanguagesA"; File: "d470377f9b683b10aa2230b05a5fcdcd.exe") Found reference to API (Indicator: "GetDiskFreeSpaceA"; File: "d470377f9b683b10aa2230b05a5fcdcd.exe") Found reference to API (Indicator: "MulDiv"; File: "d470377f9b683b10aa2230b05a5fcdcd.exe") Found reference to API (Indicator: "GetSystemMetrics"; File: "d470377f9b683b10aa2230b05a5fcdcd.exe") Found reference to API (Indicator: "FlsSetValue"; File: "00000000-00002340.00000000.66838.00321000.00000020.mdmp") Found reference to API (Indicator: "GetModuleHandleA"; File: "00000000-00001484.00000002.71052.01131000.00000040.mdmp") Found reference to API (Indicator: "SysFreeString"; File: "00000000-00001484.00000002.71052.01131000.00000040.mdmp") Found reference to API (Indicator: "CreateFontA"; File: "00000000-00001484.00000002.71052.01131000.00000040.mdmp") Found reference to API (Indicator: "ShellExecuteA"; File: "00000000-00001484.00000002.71052.01131000.00000040.mdmp") Found reference to API (Indicator: "DecodePointer"; File: "6AT6wL0.exe.1951796743") Found reference to API (Indicator: "FlsAlloc"; File: "6AT6wL0.exe.1951796743") Found reference to API (Indicator: "FlsGetValue"; File: "6AT6wL0.exe.1951796743") Found reference to API (Indicator: "FlsFree"; File: "6AT6wL0.exe.1951796743") Found reference to API (Indicator: "EncodePointer"; File: "6AT6wL0.exe.1951796743") Found reference to API (Indicator: "GetActiveWindow"; File: "6AT6wL0.exe.1951796743") Found reference to API (Indicator: "GetLastActivePopup"; File: "6AT6wL0.exe.1951796743") Found reference to API (Indicator: "GetUserObjectInformationA"; File: "6AT6wL0.exe.1951796743") Found reference to API (Indicator: "GetProcessWindowStation"; File: "6AT6wL0.exe.1951796743") Found reference to API (Indicator: "GetFullPathNameW"; File: "6AT6wL0.exe.1951796743") Found reference to API (Indicator: "GetComputerNameA"; File: "6AT6wL0.exe.1951796743") Found reference to API (Indicator: "GetDateFormatW"; File: "6AT6wL0.exe.1951796743") Found reference to API (Indicator: "GlobalDeleteAtom"; File: "6AT6wL0.exe.1951796743") Found reference to API (Indicator: "SystemTimeToTzSpecificLocalTime"; File: "6AT6wL0.exe.1951796743") Found reference to API (Indicator: "InterlockedIncrement"; File: "6AT6wL0.exe.1951796743") Found reference to API (Indicator: "GetSystemWindowsDirectoryW"; File: "6AT6wL0.exe.1951796743") Found reference to API (Indicator: "InterlockedCompareExchange"; File: "6AT6wL0.exe.1951796743") Found reference to API (Indicator: "BackupSeek"; File: "6AT6wL0.exe.1951796743") Found reference to API (Indicator: "FindNextVolumeMountPointA"; File: "6AT6wL0.exe.1951796743") Found reference to API (Indicator: "GetConsoleAliasesLengthA"; File: "6AT6wL0.exe.1951796743") Found reference to API (Indicator: "TlsSetValue"; File: "6AT6wL0.exe.1951796743") Found reference to API (Indicator: "GetCurrencyFormatW"; File: "6AT6wL0.exe.1951796743") Found reference to API (Indicator: "LoadLibraryW"; File: "6AT6wL0.exe.1951796743") Found reference to API (Indicator: "AssignProcessToJobObject"; File: "6AT6wL0.exe.1951796743") Found reference to API (Indicator: "GetVersionExW"; File: "6AT6wL0.exe.1951796743") Found reference to API (Indicator: "CreateFileW"; File: "6AT6wL0.exe.1951796743") Found reference to API (Indicator: "GetVolumePathNameA"; File: "6AT6wL0.exe.1951796743") Found reference to API (Indicator: "CreateJobObjectA"; File: "6AT6wL0.exe.1951796743") Found reference to API (Indicator: "LCMapStringA"; File: "6AT6wL0.exe.1951796743") Found reference to API (Indicator: "InterlockedExchange"; File: "6AT6wL0.exe.1951796743") Found reference to API (Indicator: "SetLastError"; File: "6AT6wL0.exe.1951796743") Found reference to API (Indicator: "GetProcessHeaps"; File: "6AT6wL0.exe.1951796743") Found reference to API (Indicator: "VirtualAlloc"; File: "6AT6wL0.exe.1951796743") Found reference to API (Indicator: "BackupWrite"; File: "6AT6wL0.exe.1951796743") Found reference to API (Indicator: "EnumDateFormatsExA"; File: "6AT6wL0.exe.1951796743") Found reference to API (Indicator: "SetComputerNameA"; File: "6AT6wL0.exe.1951796743") Found reference to API (Indicator: "OpenMutexA"; File: "6AT6wL0.exe.1951796743") Found reference to API (Indicator: "CreateFileMappingA"; File: "6AT6wL0.exe.1951796743") Found reference to API (Indicator: "CreateFileMappingW"; File: "6AT6wL0.exe.1951796743") Found reference to API (Indicator: "FindFirstVolumeMountPointW"; File: "6AT6wL0.exe.1951796743") Found reference to API (Indicator: "BeginUpdateResourceA"; File: "6AT6wL0.exe.1951796743") Found reference to API (Indicator: "GlobalFindAtomW"; File: "6AT6wL0.exe.1951796743") Found reference to API (Indicator: "CreateIoCompletionPort"; File: "6AT6wL0.exe.1951796743") Found reference to API (Indicator: "FindFirstChangeNotificationA"; File: "6AT6wL0.exe.1951796743") Found reference to API (Indicator: "VirtualProtect"; File: "6AT6wL0.exe.1951796743") Found reference to API (Indicator: "OpenSemaphoreW"; File: "6AT6wL0.exe.1951796743") Found reference to API (Indicator: "FindAtomW"; File: "6AT6wL0.exe.1951796743") Found reference to API (Indicator: "GlobalAddAtomW"; File: "6AT6wL0.exe.1951796743") Found reference to API (Indicator: "RegisterEventSourceW"; File: "6AT6wL0.exe.1951796743") Found reference to API (Indicator: "GetCommandLineA"; File: "6AT6wL0.exe.1951796743") Found reference to API (Indicator: "GetStartupInfoA"; File: "6AT6wL0.exe.1951796743") Found reference to API (Indicator: "GetStdHandle"; File: "6AT6wL0.exe.1951796743") Found reference to API (Indicator: "GetCPInfo"; File: "6AT6wL0.exe.1951796743") Found reference to API (Indicator: "InterlockedDecrement"; File: "6AT6wL0.exe.1951796743") Found reference to API (Indicator: "GetACP"; File: "6AT6wL0.exe.1951796743") Found reference to API (Indicator: "GetOEMCP"; File: "6AT6wL0.exe.1951796743") Found reference to API (Indicator: "IsValidCodePage"; File: "6AT6wL0.exe.1951796743") Found reference to API (Indicator: "TlsGetValue"; File: "6AT6wL0.exe.1951796743") Found reference to API (Indicator: "TlsAlloc"; File: "6AT6wL0.exe.1951796743") Found reference to API (Indicator: "TlsFree"; File: "6AT6wL0.exe.1951796743") Found reference to API (Indicator: "HeapSize"; File: "6AT6wL0.exe.1951796743") Found reference to API (Indicator: "HeapFree"; File: "6AT6wL0.exe.1951796743") Found reference to API (Indicator: "IsDebuggerPresent"; File: "6AT6wL0.exe.1951796743") Found reference to API (Indicator: "DeleteCriticalSection"; File: "6AT6wL0.exe.1951796743") Found reference to API (Indicator: "LeaveCriticalSection"; File: "6AT6wL0.exe.1951796743") Found reference to API (Indicator: "EnterCriticalSection"; File: "6AT6wL0.exe.1951796743") Found reference to API (Indicator: "InitializeCriticalSectionAndSpinCount"; File: "6AT6wL0.exe.1951796743") Found reference to API (Indicator: "FreeEnvironmentStringsA"; File: "6AT6wL0.exe.1951796743") Found reference to API (Indicator: "GetEnvironmentStrings"; File: "6AT6wL0.exe.1951796743") Found reference to API (Indicator: "FreeEnvironmentStringsW"; File: "6AT6wL0.exe.1951796743") Found reference to API (Indicator: "WideCharToMultiByte"; File: "6AT6wL0.exe.1951796743") Found reference to API (Indicator: "GetEnvironmentStringsW"; File: "6AT6wL0.exe.1951796743") Found reference to API (Indicator: "SetHandleCount"; File: "6AT6wL0.exe.1951796743") Found reference to API (Indicator: "GetFileType"; File: "6AT6wL0.exe.1951796743") Found reference to API (Indicator: "HeapCreate"; File: "6AT6wL0.exe.1951796743") Found reference to API (Indicator: "VirtualFree"; File: "6AT6wL0.exe.1951796743") Found reference to API (Indicator: "MultiByteToWideChar"; File: "6AT6wL0.exe.1951796743") Found reference to API (Indicator: "LCMapStringW"; File: "6AT6wL0.exe.1951796743") Found reference to API (Indicator: "GetStringTypeA"; File: "6AT6wL0.exe.1951796743") Found reference to API (Indicator: "GetStringTypeW"; File: "6AT6wL0.exe.1951796743") Found reference to API (Indicator: "GetLocaleInfoA"; File: "6AT6wL0.exe.1951796743") Found reference to API (Indicator: "HeapAlloc"; File: "6AT6wL0.exe.1951796743") Found reference to API (Indicator: "HeapReAlloc"; File: "6AT6wL0.exe.1951796743") Found reference to API (Indicator: "RtlUnwind"; File: "6AT6wL0.exe.1951796743") Found reference to API (Indicator: "CheckRemoteDebuggerPresent"; Source: "00000000-00001484.00000000.67206.01E60000.00000040.mdmp, 00000000-00001484.00000001.69129.01E60000.00000040.mdmp, 00000000-00001484.00000002.71052.01E60000.00000040.mdmp") Found reference to API (Indicator: "GetACP"; Source: "00000000-00001484.00000000.67206.01E60000.00000040.mdmp") Found reference to API (Indicator: "DisplayVersion"; Source: "00000000-00001484.00000000.67206.03360000.00000004.mdmp, 00000000-00001484.00000001.69129.03360000.00000004.mdmp, 00000000-00001484.00000002.71052.03360000.00000004.mdmp") Found reference to API (Indicator: "Local State"; Source: "00000000-00001484.00000000.67206.03360000.00000004.mdmp, 00000000-00001484.00000001.69129.03360000.00000004.mdmp, 00000000-00001484.00000002.71052.03360000.00000004.mdmp") Found reference to API (Indicator: "VaultEnumerateItems"; Source: "00000000-00001484.00000000.67206.03360000.00000004.mdmp, 00000000-00001484.00000001.69129.03360000.00000004.mdmp, 00000000-00001484.00000002.71052.03360000.00000004.mdmp") Found reference to API (Indicator: "VaultFree"; Source: "00000000-00001484.00000000.67206.03360000.00000004.mdmp, 00000000-00001484.00000001.69129.03360000.00000004.mdmp, 00000000-00001484.00000002.71052.03360000.00000004.mdmp") Found reference to API (Indicator: "VaultOpenVault"; Source: "00000000-00001484.00000000.67206.03360000.00000004.mdmp, 00000000-00001484.00000001.69129.03360000.00000004.mdmp, 00000000-00001484.00000002.71052.03360000.00000004.mdmp") Found reference to API (Indicator: "VaultCloseVault"; Source: "00000000-00001484.00000000.67206.03360000.00000004.mdmp, 00000000-00001484.00000001.69129.03360000.00000004.mdmp, 00000000-00001484.00000002.71052.03360000.00000004.mdmp") Found reference to API (Indicator: "VaultGetItem"; Source: "00000000-00001484.00000000.67206.03360000.00000004.mdmp, 00000000-00001484.00000001.69129.03360000.00000004.mdmp, 00000000-00001484.00000002.71052.03360000.00000004.mdmp") Found reference to API (Indicator: "GetTickCount64"; Source: "00000000-00001484.00000001.69129.00DC2000.00000040.mdmp") Found reference to API (Indicator: "GetCurrentHwProfileA"; Source: "00000000-00001484.00000001.69129.00DC2000.00000040.mdmp") Found reference to API (Indicator: "CredEnumerateA"; Source: "00000000-00001484.00000001.69129.00DC2000.00000040.mdmp") Found reference to API (Indicator: "CreateCompatibleDC"; Source: "00000000-00001484.00000001.69129.00DC2000.00000040.mdmp") Found reference to API (Indicator: "ReleaseDC"; Source: "00000000-00001484.00000001.69129.00DC2000.00000040.mdmp") Found reference to API (Indicator: "GetDC"; Source: "00000000-00001484.00000001.69129.00DC2000.00000040.mdmp") Found reference to API (Indicator: "CryptUnprotectData"; Source: "00000000-00001484.00000001.69129.00DC2000.00000040.mdmp") Found reference to API (Indicator: "VirtualAlloc"; Source: "00000000-00001484.00000001.69129.00DC2000.00000040.mdmp") Found reference to API (Indicator: "HeapAlloc"; Source: "00000000-00001484.00000001.69129.00DC2000.00000040.mdmp") Found reference to API (Indicator: "ResumeThread"; Source: "00000000-00001484.00000001.69129.00DC2000.00000040.mdmp") Found reference to API (Indicator: "CreateThread"; Source: "00000000-00001484.00000001.69129.00DC2000.00000040.mdmp") Found reference to API (Indicator: "TerminateThread"; Source: "00000000-00001484.00000001.69129.00DC2000.00000040.mdmp") Found reference to API (Indicator: "CreateRemoteThread"; Source: "00000000-00001484.00000001.69129.00DC2000.00000040.mdmp") Found reference to API (Indicator: "PathAppend"; Source: "00000000-00001484.00000001.69129.00DC2000.00000040.mdmp") Found reference to API (Indicator: "LoadResource"; Source: "00000000-00001484.00000001.69129.00DC2000.00000040.mdmp") Found reference to API (Indicator: "FindResource"; Source: "00000000-00001484.00000001.69129.00DC2000.00000040.mdmp") Found reference to API (Indicator: "SizeofResource"; Source: "00000000-00001484.00000001.69129.00DC2000.00000040.mdmp") Found reference to API (Indicator: "LockResource"; Source: "00000000-00001484.00000001.69129.00DC2000.00000040.mdmp") Found reference to API (Indicator: "CredFree"; Source: "00000000-00001484.00000001.69129.00DC2000.00000040.mdmp") Found reference to API (Indicator: "VirtualFree"; Source: "00000000-00001484.00000001.69129.00DC2000.00000040.mdmp") Found reference to API (Indicator: "HeapFree"; Source: "00000000-00001484.00000001.69129.00DC2000.00000040.mdmp") Found reference to API (Indicator: "GetModuleHandle"; Source: "00000000-00001484.00000001.69129.00DC2000.00000040.mdmp") Found reference to API (Indicator: "CloseHandle"; Source: "00000000-00001484.00000001.69129.00DC2000.00000040.mdmp") Found reference to API (Indicator: "DuplicateHandle"; Source: "00000000-00001484.00000001.69129.00DC2000.00000040.mdmp") Found reference to API (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00001484.00000001.69129.00DC2000.00000040.mdmp") Found reference to API (Indicator: "PathCombine"; Source: "00000000-00001484.00000001.69129.00DC2000.00000040.mdmp") Found reference to API (Indicator: "PathIsRelative"; Source: "00000000-00001484.00000001.69129.00DC2000.00000040.mdmp") Found reference to API (Indicator: "RtlUnicodeStringToAnsiString"; Source: "00000000-00001484.00000001.69129.00DC2000.00000040.mdmp") Found reference to API (Indicator: "GetTempPath"; Source: "00000000-00001484.00000001.69129.00DC2000.00000040.mdmp") Found reference to API (Indicator: "SHGetKnownFolderPath"; Source: "00000000-00001484.00000001.69129.00DC2000.00000040.mdmp") Found reference to API (Indicator: "SetupDiGetDeviceInterfaceDetail"; Source: "00000000-00001484.00000001.69129.00DC2000.00000040.mdmp") Found reference to API (Indicator: "RtlGetVersion"; Source: "00000000-00001484.00000001.69129.00DC2000.00000040.mdmp") Found reference to API (Indicator: "NtQuerySystemInformation"; Source: "00000000-00001484.00000001.69129.00DC2000.00000040.mdmp") Found reference to API (Indicator: "GetSystemInfo"; Source: "00000000-00001484.00000001.69129.00DC2000.00000040.mdmp") Found reference to API (Indicator: "GetProcessHeap"; Source: "00000000-00001484.00000001.69129.00DC2000.00000040.mdmp") Found reference to API (Indicator: "CreateCompatibleBitmap"; Source: "00000000-00001484.00000001.69129.00DC2000.00000040.mdmp") Found reference to API (Indicator: "Sleep"; Source: "00000000-00001484.00000001.69129.00DC2000.00000040.mdmp") Found reference to API (Indicator: "QueryPerformanceCounter"; Source: "00000000-00001484.00000001.69129.00DC2000.00000040.mdmp") Found reference to API (Indicator: "SetupDiEnumDeviceInterfaces"; Source: "00000000-00001484.00000001.69129.00DC2000.00000040.mdmp") Found reference to API (Indicator: "GetExitCodeProcess"; Source: "00000000-00001484.00000001.69129.00DC2000.00000040.mdmp") Found reference to API (Indicator: "CreateProcess"; Source: "00000000-00001484.00000001.69129.00DC2000.00000040.mdmp") Found reference to API (Indicator: "OpenProcess"; Source: "00000000-00001484.00000001.69129.00DC2000.00000040.mdmp") Found reference to API (Indicator: "NtQueryInformationProcess"; Source: "00000000-00001484.00000001.69129.00DC2000.00000040.mdmp") Found reference to API (Indicator: "GetCurrentProcess"; Source: "00000000-00001484.00000001.69129.00DC2000.00000040.mdmp") Found reference to API (Indicator: "GetProcAddress"; Source: "00000000-00001484.00000001.69129.00DC2000.00000040.mdmp, 00000000-00001484.00000002.71052.01131000.00000040.mdmp") Found reference to API (Indicator: "SetupDiGetClassDevs"; Source: "00000000-00001484.00000001.69129.00DC2000.00000040.mdmp") Found reference to API (Indicator: "WaitForSingleObject"; Source: "00000000-00001484.00000001.69129.00DC2000.00000040.mdmp") Found reference to API (Indicator: "NtDuplicateObject"; Source: "00000000-00001484.00000001.69129.00DC2000.00000040.mdmp") Found reference to API (Indicator: "DeleteObject"; Source: "00000000-00001484.00000001.69129.00DC2000.00000040.mdmp") Found reference to API (Indicator: "SelectObject"; Source: "00000000-00001484.00000001.69129.00DC2000.00000040.mdmp") Found reference to API (Indicator: "NtQueryObject"; Source: "00000000-00001484.00000001.69129.00DC2000.00000040.mdmp") Found reference to API (Indicator: "BitBlt"; Source: "00000000-00001484.00000001.69129.00DC2000.00000040.mdmp") Found reference to API (Indicator: "IsProcessorFeaturePresent"; Source: "00000000-00001484.00000001.69129.00DC2000.00000040.mdmp") Found reference to API (Indicator: "CreateEvent"; Source: "00000000-00001484.00000001.69129.00DC2000.00000040.mdmp") Found reference to API (Indicator: "SetEvent"; Source: "00000000-00001484.00000001.69129.00DC2000.00000040.mdmp") Found reference to API (Indicator: "ResetEvent"; Source: "00000000-00001484.00000001.69129.00DC2000.00000040.mdmp") Found reference to API (Indicator: "GetKeyboardLayoutList"; Source: "00000000-00001484.00000001.69129.00DC2000.00000040.mdmp") Found reference to API (Indicator: "GetThreadContext"; Source: "00000000-00001484.00000001.69129.00DC2000.00000040.mdmp") Found reference to API (Indicator: "GetConsoleWindow"; Source: "00000000-00001484.00000001.69129.00DC2000.00000040.mdmp") Found reference to API (Indicator: "ShowWindow"; Source: "00000000-00001484.00000001.69129.00DC2000.00000040.mdmp") Found reference to API (Indicator: "VirtualAllocEx"; Source: "00000000-00001484.00000001.69129.00DC2000.00000040.mdmp") Found reference to API (Indicator: "VirtualFreeEx"; Source: "00000000-00001484.00000001.69129.00DC2000.00000040.mdmp") Found reference to API (Indicator: "GetModuleFileNameEx"; Source: "00000000-00001484.00000001.69129.00DC2000.00000040.mdmp") Found reference to API (Indicator: "VirtualProtectEx"; Source: "00000000-00001484.00000001.69129.00DC2000.00000040.mdmp") Found reference to API (Indicator: "LoadLibrary"; Source: "00000000-00001484.00000001.69129.00DC2000.00000040.mdmp") Found reference to API (Indicator: "FreeLibrary"; Source: "00000000-00001484.00000001.69129.00DC2000.00000040.mdmp") Found reference to API (Indicator: "ReadProcessMemory"; Source: "00000000-00001484.00000001.69129.00DC2000.00000040.mdmp") Found reference to API (Indicator: "WriteProcessMemory"; Source: "00000000-00001484.00000001.69129.00DC2000.00000040.mdmp") Found reference to API (Indicator: "CreateDirectory"; Source: "00000000-00001484.00000001.69129.00DC2000.00000040.mdmp") Found reference to API (Indicator: "DecodePointer"; Source: "00000000-00001484.00000001.69129.01E60000.00000040.mdmp, 00000000-00001484.00000002.71052.01E60000.00000040.mdmp") Found reference to API (Indicator: "GetEnvironmentVariableW"; Source: "00000000-00001484.00000001.69129.01E60000.00000040.mdmp, 00000000-00001484.00000002.71052.01E60000.00000040.mdmp") Found reference to API (Indicator: "GetModuleHandleA"; Source: "00000000-00001484.00000002.71052.01131000.00000040.mdmp") Found reference to API (Indicator: "ExitProcess"; Source: "00000000-00001484.00000002.71052.01131000.00000040.mdmp") Found reference to API (Indicator: "LoadLibraryA"; Source: "00000000-00001484.00000002.71052.01131000.00000040.mdmp") Found reference to API (Indicator: "MessageBoxA"; Source: "00000000-00001484.00000002.71052.01131000.00000040.mdmp") Found reference to API (Indicator: "RegCloseKey"; Source: "00000000-00001484.00000002.71052.01131000.00000040.mdmp") Found reference to API (Indicator: "SysFreeString"; Source: "00000000-00001484.00000002.71052.01131000.00000040.mdmp") Found reference to API (Indicator: "CreateFontA"; Source: "00000000-00001484.00000002.71052.01131000.00000040.mdmp") Found reference to API (Indicator: "ShellExecuteA"; Source: "00000000-00001484.00000002.71052.01131000.00000040.mdmp") Found reference to API (Indicator: "GetFileVersionInfoA"; Source: "00000000-00001484.00000002.71052.01131000.00000040.mdmp")37:T454,Found reference to API "SizeofResource" (Indicator: "SizeofResource"; File: "d470377f9b683b10aa2230b05a5fcdcd.exe") Found reference to API "FindResourceA" (Indicator: "FindResource"; File: "d470377f9b683b10aa2230b05a5fcdcd.exe") Found reference to API "FreeResource" (Indicator: "FreeResource"; File: "d470377f9b683b10aa2230b05a5fcdcd.exe") Found reference to API "LockResource" (Indicator: "LockResource"; File: "d470377f9b683b10aa2230b05a5fcdcd.exe") Found reference to API "LoadResource" (Indicator: "LoadResource"; File: "d470377f9b683b10aa2230b05a5fcdcd.exe") Found reference to API "LoadResource" (Indicator: "LoadResource"; Source: "00000000-00001484.00000001.69129.00DC2000.00000040.mdmp") Found reference to API "FindResource" (Indicator: "FindResource"; Source: "00000000-00001484.00000001.69129.00DC2000.00000040.mdmp") Found reference to API "SizeofResource" (Indicator: "SizeofResource"; Source: "00000000-00001484.00000001.69129.00DC2000.00000040.mdmp") Found reference to API "LockResource" (Indicator: "LockResource"; Source: "00000000-00001484.00000001.69129.00DC2000.00000040.mdmp")38:T66c,":\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup" (Indicator: ":\programdata\microsoft\windows\start menu\programs\startup") in Source: 00000000-00001484.00000001.69129.003A0000.00000004.mdmp 00000000-00001484.00000002.71052.003A0000.00000004.mdmp ":\Users\HAPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup" (Indicator: ":\users\hapubws\appdata\roaming\microsoft\windows\start menu\programs\startup") in Source: 00000000-00001484.00000001.69129.003A0000.00000004.mdmp 00000000-00001484.00000002.71052.003A0000.00000004.mdmp "C:\Users\HAPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\FANBooster131.lnk" (Indicator: "c:\users\hapubws\appdata\roaming\microsoft\windows\start menu\programs\startup\fanbooster131.lnk") in Source: 00000000-00001484.00000001.69129.003A0000.00000004.mdmp 00000000-00001484.00000001.69129.03360000.00000004.mdmp 00000000-00001484.00000002.71052.003A0000.00000004.mdmp 00000000-00001484.00000002.71052.03360000.00000004.mdmp "c:\users\hapubws\appdata\roaming\microsoft\windows\start menu\programs\startup\fanbooster131.lnk" (Indicator: "c:\users\hapubws\appdata\roaming\microsoft\windows\start menu\programs\startup\fanbooster131.lnk") in Source: 00000000-00001484.00000001.69129.003A0000.00000004.mdmp 00000000-00001484.00000002.71052.003A0000.00000004.mdmp "C:\Users\HAPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup" (Indicator: "c:\users\hapubws\appdata\roaming\microsoft\windows\start menu\programs\startup") in Source: 00000000-00001484.00000001.69129.03360000.00000004.mdmp 00000000-00001484.00000002.71052.03360000.00000004.mdmp39:T3131,"Software\Microsoft\Windows\CurrentVersion\App Paths" in Source: d470377f9b683b10aa2230b05a5fcdcd.exe "DSystem\CurrentControlSet\Control\Session Manager" in Source: d470377f9b683b10aa2230b05a5fcdcd.exe "Software\Microsoft\Windows\CurrentVersion\RunOnce" in Source: d470377f9b683b10aa2230b05a5fcdcd.exe "System\CurrentControlSet\Control\Session Manager\FileRenameOperations" in Source: d470377f9b683b10aa2230b05a5fcdcd.exe "System\CurrentControlSet\Control\Session Manager" in Source: 62007-17-0040256D "Software\Enigma Protector\29AEB4A0365755F6-B862CAE984EA4D0E" in Source: 00000000-00001484.00000000.67206.003A0000.00000004.mdmp 00000000-00001484.00000001.69129.003A0000.00000004.mdmp 00000000-00001484.00000002.71052.003A0000.00000004.mdmp "Software\Enigma Protector\%.8x%.8x-%.8x%.8x" in Source: 00000000-00001484.00000000.67206.003A0000.00000004.mdmp 00000000-00001484.00000000.67206.01E60000.00000040.mdmp 00000000-00001484.00000001.69129.003A0000.00000004.mdmp 00000000-00001484.00000001.69129.01E60000.00000040.mdmp 00000000-00001484.00000002.71052.003A0000.00000004.mdmp 00000000-00001484.00000002.71052.01E60000.00000040.mdmp "REGISTRY\USER\S-1-5-21-2092356043-4041700817-663127204-1001\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Layers" in Source: 00000000-00001484.00000000.67206.003A0000.00000004.mdmp "Read?HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00001484.00000000.67206.007A0000.00000004.mdmp 00000000-00001484.00000001.69129.007A0000.00000004.mdmp 00000000-00001484.00000002.71052.007A0000.00000004.mdmp "Read3HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework" in Source: 00000000-00001484.00000000.67206.007A0000.00000004.mdmp 00000000-00001484.00000001.69129.007A0000.00000004.mdmp 00000000-00001484.00000002.71052.007A0000.00000004.mdmp "SOFTWARE\EnigmaDevelopers" in Source: 00000000-00001484.00000000.67206.01E20000.00000040.mdmp 00000000-00001484.00000001.69129.01E20000.00000040.mdmp 00000000-00001484.00000002.71052.01E20000.00000040.mdmp "Software\Enigma Protector\29AEB4A0365755F6-B862CAE984EA4D0E\02F01F553A112DCE-00C9DB38C18D5FD1" in Source: 00000000-00001484.00000000.67206.01E60000.00000040.mdmp 00000000-00001484.00000001.69129.01E60000.00000040.mdmp 00000000-00001484.00000002.71052.01E60000.00000040.mdmp "System\CurrentControlSet\Control\Nls\RegionMapping" in Source: 00000000-00001484.00000000.67206.03360000.00000004.mdmp 00000000-00001484.00000001.69129.03360000.00000004.mdmp 00000000-00001484.00000002.71052.03360000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\AppContext" in Source: 00000000-00001484.00000000.67206.03360000.00000004.mdmp 00000000-00001484.00000001.69129.03360000.00000004.mdmp 00000000-00001484.00000002.71052.03360000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Net.ServicePointManag" in Source: 00000000-00001484.00000000.67206.03360000.00000004.mdmp 00000000-00001484.00000001.69129.03360000.00000004.mdmp 00000000-00001484.00000002.71052.03360000.00000004.mdmp "Software\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00001484.00000000.67206.03360000.00000004.mdmp 00000000-00001484.00000001.69129.03360000.00000004.mdmp 00000000-00001484.00000002.71052.03360000.00000004.mdmp "Software\Microsoft\Windows NT\CurrentVersion\InstallationType" in Source: 00000000-00001484.00000000.67206.03360000.00000004.mdmp 00000000-00001484.00000001.69129.03360000.00000004.mdmp 00000000-00001484.00000002.71052.03360000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00001484.00000000.67206.03360000.00000004.mdmp 00000000-00001484.00000001.69129.03360000.00000004.mdmp 00000000-00001484.00000002.71052.03360000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v{0}" in Source: 00000000-00001484.00000000.67206.03360000.00000004.mdmp 00000000-00001484.00000001.69129.03360000.00000004.mdmp 00000000-00001484.00000002.71052.03360000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319" in Source: 00000000-00001484.00000000.67206.03360000.00000004.mdmp 00000000-00001484.00000001.69129.03360000.00000004.mdmp 00000000-00001484.00000002.71052.03360000.00000004.mdmp "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework\v4.0.30319" in Source: 00000000-00001484.00000000.67206.03360000.00000004.mdmp 00000000-00001484.00000001.69129.03360000.00000004.mdmp 00000000-00001484.00000002.71052.03360000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Net.ServicePointManager.UseHttpPipeliningAndBufferPooling" in Source: 00000000-00001484.00000000.67206.03360000.00000004.mdmp 00000000-00001484.00000001.69129.03360000.00000004.mdmp 00000000-00001484.00000002.71052.03360000.00000004.mdmp "Access to the registry key 'HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Defender\Features' is denied.andling" in Source: 00000000-00001484.00000000.67206.03360000.00000004.mdmp 00000000-00001484.00000001.69129.03360000.00000004.mdmp 00000000-00001484.00000002.71052.03360000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Net.ServicePointManager.UseSafeSynchronousClose" in Source: 00000000-00001484.00000000.67206.03360000.00000004.mdmp 00000000-00001484.00000001.69129.03360000.00000004.mdmp 00000000-00001484.00000002.71052.03360000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Net.ServicePointManager.UseStrictRfcInterimResponseHandling" in Source: 00000000-00001484.00000000.67206.03360000.00000004.mdmp 00000000-00001484.00000001.69129.03360000.00000004.mdmp 00000000-00001484.00000002.71052.03360000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Uri.AllowDangerousUnicodeDecompositions" in Source: 00000000-00001484.00000000.67206.03360000.00000004.mdmp 00000000-00001484.00000001.69129.03360000.00000004.mdmp 00000000-00001484.00000002.71052.03360000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Uri.UseStrictIPv6AddressParsing" in Source: 00000000-00001484.00000000.67206.03360000.00000004.mdmp 00000000-00001484.00000001.69129.03360000.00000004.mdmp 00000000-00001484.00000002.71052.03360000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Uri.AllowAllUriEncodingExpansion" in Source: 00000000-00001484.00000000.67206.03360000.00000004.mdmp 00000000-00001484.00000001.69129.03360000.00000004.mdmp 00000000-00001484.00000002.71052.03360000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Net.ServicePointManager.SchSendAuxRecord" in Source: 00000000-00001484.00000000.67206.03360000.00000004.mdmp 00000000-00001484.00000001.69129.03360000.00000004.mdmp 00000000-00001484.00000002.71052.03360000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Net.ServicePointManager.RequireCertificateEKUs" in Source: 00000000-00001484.00000000.67206.03360000.00000004.mdmp 00000000-00001484.00000001.69129.03360000.00000004.mdmp 00000000-00001484.00000002.71052.03360000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Net.ServicePointManager.SecurityProtocol" in Source: 00000000-00001484.00000000.67206.03360000.00000004.mdmp 00000000-00001484.00000001.69129.03360000.00000004.mdmp 00000000-00001484.00000002.71052.03360000.00000004.mdmp "SOFTWARE\Microsoft\Windows Defender\Features" in Source: 00000000-00001484.00000000.67206.03360000.00000004.mdmp 00000000-00001484.00000001.69129.03360000.00000004.mdmp 00000000-00001484.00000002.71052.03360000.00000004.mdmp "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Defender\Features" in Source: 00000000-00001484.00000000.67206.03360000.00000004.mdmp 00000000-00001484.00000001.69129.03360000.00000004.mdmp 00000000-00001484.00000002.71052.03360000.00000004.mdmp "Access to the registry key 'HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Defender\Features' is denied." in Source: 00000000-00001484.00000000.67206.03360000.00000004.mdmp 00000000-00001484.00000001.69129.03360000.00000004.mdmp 00000000-00001484.00000002.71052.03360000.00000004.mdmp "SOFTWARE\Policies\Microsoft\Windows Defender" in Source: 00000000-00001484.00000000.67206.03360000.00000004.mdmp 00000000-00001484.00000001.69129.03360000.00000004.mdmp 00000000-00001484.00000002.71052.03360000.00000004.mdmp "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender" in Source: 00000000-00001484.00000000.67206.03360000.00000004.mdmp 00000000-00001484.00000001.69129.03360000.00000004.mdmp 00000000-00001484.00000002.71052.03360000.00000004.mdmp "SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" in Source: 00000000-00001484.00000000.67206.03360000.00000004.mdmp 00000000-00001484.00000001.69129.03360000.00000004.mdmp 00000000-00001484.00000002.71052.03360000.00000004.mdmp "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" in Source: 00000000-00001484.00000000.67206.03360000.00000004.mdmp 00000000-00001484.00000001.69129.03360000.00000004.mdmp 00000000-00001484.00000002.71052.03360000.00000004.mdmp "SOFTWARE\Microsoft\Cryptography" in Source: 00000000-00001484.00000000.67206.03360000.00000004.mdmp 00000000-00001484.00000001.69129.03360000.00000004.mdmp 00000000-00001484.00000002.71052.03360000.00000004.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00001484.00000000.67206.03360000.00000004.mdmp 00000000-00001484.00000001.69129.03360000.00000004.mdmp 00000000-00001484.00000002.71052.03360000.00000004.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall" in Source: 00000000-00001484.00000000.67206.03360000.00000004.mdmp 00000000-00001484.00000001.69129.03360000.00000004.mdmp 00000000-00001484.00000002.71052.03360000.00000004.mdmp "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" in Source: 00000000-00001484.00000000.67206.03360000.00000004.mdmp 00000000-00001484.00000001.69129.03360000.00000004.mdmp 00000000-00001484.00000002.71052.03360000.00000004.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Run" in Source: 00000000-00001484.00000000.67206.03360000.00000004.mdmp 00000000-00001484.00000001.69129.03360000.00000004.mdmp 00000000-00001484.00000002.71052.03360000.00000004.mdmp "SYSTEM\CurrentControlSet\Services\vmhgfs+" in Source: 00000000-00001484.00000000.67206.03360000.00000004.mdmp 00000000-00001484.00000001.69129.03360000.00000004.mdmp 00000000-00001484.00000002.71052.03360000.00000004.mdmp "SYSTEM\CurrentControlSet\Services\VBoxGuest" in Source: 00000000-00001484.00000000.67206.03360000.00000004.mdmp 00000000-00001484.00000001.69129.03360000.00000004.mdmp 00000000-00001484.00000002.71052.03360000.00000004.mdmp "BraveSoftware\Brave-Browser\User Data" in Source: 00000000-00001484.00000000.67206.03360000.00000004.mdmp 00000000-00001484.00000001.69129.03360000.00000004.mdmp 00000000-00001484.00000002.71052.03360000.00000004.mdmp "SOFTWARE\Classes\Foxmail\shell\open\command" in Source: 00000000-00001484.00000000.67206.03360000.00000004.mdmp 00000000-00001484.00000001.69129.03360000.00000004.mdmp 00000000-00001484.00000002.71052.03360000.00000004.mdmp "Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676z" in Source: 00000000-00001484.00000000.67206.03360000.00000004.mdmp 00000000-00001484.00000001.69129.03360000.00000004.mdmp 00000000-00001484.00000002.71052.03360000.00000004.mdmp "Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676" in Source: 00000000-00001484.00000000.67206.03360000.00000004.mdmp 00000000-00001484.00000001.69129.03360000.00000004.mdmp 00000000-00001484.00000002.71052.03360000.00000004.mdmp "Software\Microsoft\Windows Messaging Subsystem\Profiles\9375CFF0413111d3B88A00104B2A6676X" in Source: 00000000-00001484.00000000.67206.03360000.00000004.mdmp 00000000-00001484.00000001.69129.03360000.00000004.mdmp 00000000-00001484.00000002.71052.03360000.00000004.mdmp "Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676" in Source: 00000000-00001484.00000000.67206.03360000.00000004.mdmp 00000000-00001484.00000001.69129.03360000.00000004.mdmp 00000000-00001484.00000002.71052.03360000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Run" in Source: 00000000-00001484.00000001.69129.03360000.00000004.mdmp 00000000-00001484.00000002.71052.03360000.00000004.mdmp "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" in Source: 00000000-00001484.00000001.69129.03360000.00000004.mdmp 00000000-00001484.00000002.71052.03360000.00000004.mdmp3a:T515,"\Sessions\1\BaseNamedObjects\IsoScope_cc0_IESQMMUTEX_0_519" "Local\ZonesCacheCounterMutex" "{5312EE61-79E3-4A24-BFE1-132B85B23C3A}" "IsoScope_cc0_IESQMMUTEX_0_331" "Local\VERMGMTBlockListFileMutex" "Local\!BrowserEmulation!SharedMemory!Mutex" "IsoScope_cc0_IE_EarlyTabStart_0x544_Mutex" "IsoScope_cc0_ConnHashTable<3264>_HashTable_Mutex" "Local\URLBLOCK_HASHFILESWITCH_MUTEX" "IsoScope_cc0_IESQMMUTEX_0_303" "IsoScope_cc0_IESQMMUTEX_0_519" "Local\ZonesLockedCacheCounterMutex" "{66D0969A-1E86-44CF-B4EC-3806DDDA3B5D}" "Local\URLBLOCK_FILEMAPSWITCH_MUTEX_3264" "Local\URLBLOCK_DOWNLOAD_MUTEX" "\Sessions\1\BaseNamedObjects\Local\!BrowserEmulation!SharedMemory!Mutex" "\Sessions\1\BaseNamedObjects\Local\VERMGMTBlockListFileMutex" "\Sessions\1\BaseNamedObjects\Local\URLBLOCK_FILEMAPSWITCH_MUTEX_3264" "\Sessions\1\BaseNamedObjects\Local\URLBLOCK_HASHFILESWITCH_MUTEX" "\Sessions\1\BaseNamedObjects\Local\URLBLOCK_DOWNLOAD_MUTEX" "\Sessions\1\BaseNamedObjects\Local\ZonesCacheCounterMutex" "\Sessions\1\BaseNamedObjects\Local\ZonesLockedCacheCounterMutex" "\Sessions\1\BaseNamedObjects\IsoScope_cc0_IE_EarlyTabStart_0x544_Mutex" "\Sessions\1\BaseNamedObjects\IsoScope_cc0_ConnHashTable<3264>_HashTable_Mutex" "\Sessions\1\BaseNamedObjects\{5312EE61-79E3-4A24-BFE1-132B85B23C3A}"3b:Tf93,"d470377f9b683b10aa2230b05a5fcdcd.exe" failed to load missing module "api-ms-win-core-fibers-l1-1-1" - [base:0; Status:c0000135] "d470377f9b683b10aa2230b05a5fcdcd.exe" failed to load missing module "api-ms-win-core-localization-l1-2-1" - [base:0; Status:c0000135] "2GR5823.exe" failed to load missing module "api-ms-win-core-fibers-l1-1-1" - [base:0; Status:c0000135] "2GR5823.exe" failed to load missing module "api-ms-win-core-localization-l1-2-1" - [base:0; Status:c0000135] "2GR5823.exe" failed to load missing module "api-ms-win-core-sysinfo-l1-2-1" - [base:0; Status:c0000135] "2GR5823.exe" failed to load missing module "api-ms-win-appmodel-runtime-l1-1-1" - [base:0; Status:c0000135] "2GR5823.exe" failed to load missing module "ext-ms-win-kernel32-package-current-l1-1-0" - [base:0; Status:c0000135] "5cN0su3.exe" failed to load missing module "api-ms-win-core-fibers-l1-1-1" - [base:0; Status:c0000135] "5cN0su3.exe" failed to load missing module "api-ms-win-core-localization-l1-2-1" - [base:0; Status:c0000135] "5cN0su3.exe" failed to load missing module "api-ms-win-appmodel-runtime-l1-1-2.dll" - [base:0; Status:c0000135] "5cN0su3.exe" failed to load missing module "api-ms-win-appmodel-runtime-l1-1-0.dll" - [base:0; Status:c0000135] "5cN0su3.exe" failed to load missing module "api-ms-win-core-quirks-l1-1-0.dll" - [base:0; Status:c0000135] "5cN0su3.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoree.dll" - [base:0; Status:c0000135] "5cN0su3.exe" failed to load missing module "%WINDIR%\system32\combase.dll" - [base:0; Status:c0000135] "5cN0su3.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\ole32.dll" - [base:0; Status:c0000135] "5cN0su3.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll" - [base:0; Status:c0000135] "5cN0su3.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll" - [base:0; Status:c0000135] "5cN0su3.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll" - [base:0; Status:c0000135] "5cN0su3.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ws2_32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "api-ms-win-core-fibers-l1-1-1" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "api-ms-win-core-localization-l1-2-1" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "api-ms-win-appmodel-runtime-l1-1-2.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "api-ms-win-appmodel-runtime-l1-1-0.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v2.0.50727\ole32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v2.0.50727\OLEAUT32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\assembly\GAC_MSIL\System\2.0.0.0__b77a5c561934e089\psapi.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\assembly\GAC_MSIL\System\2.0.0.0__b77a5c561934e089\ntdll.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\secur32.dll" - [base:0; Status:c0000135] "cmd.exe" failed to load missing module "api-ms-win-core-fibers-l1-1-1" - [base:0; Status:c0000135] "cmd.exe" failed to load missing module "api-ms-win-core-localization-l1-2-1" - [base:0; Status:c0000135] "schtasks.exe" failed to load missing module "api-ms-win-core-fibers-l1-1-1" - [base:0; Status:c0000135] "schtasks.exe" failed to load missing module "api-ms-win-core-localization-l1-2-1" - [base:0; Status:c0000135]3c:T855,Found string "https://facebook.com/login" (Indicator: "facebook.com"; File: "d470377f9b683b10aa2230b05a5fcdcd.exe") Found string "https://www.youtube.com/" (Indicator: "youtube"; File: "d470377f9b683b10aa2230b05a5fcdcd.exe") file/memory contains long string with (Indicator: "youtube"; File: "8D6SMO91.txt") file/memory contains long string with (Indicator: "youtube"; File: "css_1_.css") file/memory contains long string with (Indicator: "facebook.com"; File: "5PIMNQT1.txt") Found string "VISITOR_INFO1_LIVEpEG0eY8XeWIyoutube.com/921732269185283111490785266324931078690CONSENTWP.2676bayoutube.com/102431383388163210825482504061830633367hideBrowserUpgradeBoxtrueyoutube.com/921710698338563108151484341524731078690" (Indicator: "youtube"; File: "4SQUY4XE.txt") Found string "0gyISezr3jNBHdgGi..BljMnU.9a.AAA.0.0.BljMnU.AWXaHEwWV0gfacebook.com/92173639812608310968021106147299310786901MmMZepfKijxu-2KmG20DpAkfacebook.com/921788929945631159164112386330231078690" (Indicator: "facebook.com"; File: "18WJSOA9.txt") Found string "CONSENTWP.2676bayoutube.com/102431383388163210825482504061830633367hideBrowserUpgradeBoxtrueyoutube.com/921710698338563108151484341524731078690" (Indicator: "youtube"; File: "XKM2W2DO.txt") Found string "0gyISezr3jNBHdgGi..BljMnU.9a.AAA.0.0.BljMnU.AWXaHEwWV0gfacebook.com/9217363981260831096802110614729931078690" (Indicator: "facebook.com"; File: "3JJI1END.txt") Found string "accounts.youtube.com" (Indicator: "youtube"; File: "PCAP") Found string "facebook.com" (Indicator: "facebook.com"; File: "PCAP") Found string "www.facebook.com" (Indicator: "facebook.com"; File: "PCAP") Found string "www.youtube.com" (Indicator: "youtube"; File: "PCAP") Found string "GET /login HTTP/1.1Accept: text/html, application/xhtml+xml, */*Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: facebook.comDNT: 1Connection: Keep-Alive" (Indicator: "facebook.com"; File: "SSL") file/memory contains long string with (Indicator: "facebook.com"; File: "SSL") file/memory contains long string with (Indicator: "youtube"; File: "SSL")3d:T3049,"GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.digicert.com" Response ==> HTTP/1.1 200 OK Accept-Ranges: bytes Age: 1938 Cache-Control: max-age=7200 Content-Type: application/ocsp-response Date: Thu 28 Dec 2023 01:05:19 GMT Last-Modified: Thu 28 Dec 2023 00:33:01 GMT Server: ECAcc (sac/2551) X-Cache: HIT Content-Length: 471 with response body ==>308201D30A0100A08201CC308201C806092B0601050507300101048201B9308201B530819EA216041403DE503556D14CBB66F0A3E21B1BC397B23DD155180F32....... "GET /gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.pki.goog" Response ==> HTTP/1.1 200 OK Server: ocsp_responder Content-Length: 1445 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Date: Thu 28 Dec 2023 00:42:13 GMT Cache-Control: public max-age=14400 Content-Type: application/ocsp-response Age: 1386 with response body ==>308205A10A0100A082059A3082059606092B0601050507300101048205873082058330819EA2160414D49BADF2AB3CB9FF1A3E0C506DCF192780868DAA180F32....... "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEATh56TcXPLzbcArQrhdFZ8%3D HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.digicert.com" Response ==> HTTP/1.1 200 OK Accept-Ranges: bytes Age: 6514 Cache-Control: max-age=7200 Content-Type: application/ocsp-response Date: Thu 28 Dec 2023 01:05:22 GMT Last-Modified: Wed 27 Dec 2023 23:16:48 GMT Server: ECAcc (sac/254A) X-Cache: HIT Content-Length: 471 with response body ==>308201D30A0100A08201CC308201C806092B0601050507300101048201B9308201B530819EA2160414B13EC36903F8BF4701D498261A0802EF63642BC3180F32....... "GET /gtsr1/gtsr1.crl HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: crl.pki.goog" Response ==> HTTP/1.1 200 OK Accept-Ranges: bytes Content-Security-Policy-Report-Only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/cacerts Cross-Origin-Resource-Policy: cross-origin Cross-Origin-Opener-Policy: same-origin; report-to="cacerts" Report-To: {"group":"cacerts" "max_age":2592000 "endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/cacerts"}]} Content-Length: 854 X-Content-Type-Options: nosniff Server: sffe X-XSS-Protection: 0 Date: Thu 28 Dec 2023 00:30:04 GMT Expires: Thu 28 Dec 2023 01:20:04 GMT Cache-Control: public max-age=3000 Age: 2118 Last-Modified: Mon 18 Sep 2023 16:18:00 GMT Content-Type: application/pkix-crl Vary: Accept-Encoding with response body ==>308203523082013A020101300D06092A864886F70D01010B05003047310B300906035504061302555331223020060355040A1319476F6F676C65205472757374....... "GET /gts1c3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEGpYRvzN3kAuEMlMWsqSFLc%3D HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.pki.goog" Response ==> HTTP/1.1 200 OK Server: ocsp_responder Content-Length: 471 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Date: Thu 28 Dec 2023 00:52:47 GMT Cache-Control: public max-age=14400 Content-Type: application/ocsp-response Age: 756 with response body ==>308201D30A0100A08201CC308201C806092B0601050507300101048201B9308201B530819EA21604148A747FAF85CDEE95CD3D9CD0E24614F371351D27180F32....... "GET /gtsr1/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBQwkcLWD4LqGJ7bE7B1XZsEbmfwUAQU5K8rJnEaK0gnhS9SZizv8IkTcT4CDQIDvFNZazTHGPUBUGY%3D HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.pki.goog" Response ==> HTTP/1.1 200 OK Server: ocsp_responder Content-Length: 724 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Date: Thu 28 Dec 2023 00:40:51 GMT Cache-Control: public max-age=14400 Content-Type: application/ocsp-response Age: 1472 with response body ==>308202D00A0100A08202C9308202C506092B0601050507300101048202B6308202B230819BA2160414E4AF2B26711A2B4827852F52662CEFF08913713E180F32....... "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTPJvUY%2Bsl%2Bj4yzQuAcL2oQno5fCgQUUWj%2FkK8CB3U8zNllZGKiErhZcjsCEA84b5kxAOGeKVwpjCxm%2Fyw%3D HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.digicert.com" Response ==> HTTP/1.1 200 OK Accept-Ranges: bytes Age: 5879 Cache-Control: max-age=7200 Content-Type: application/ocsp-response Date: Thu 28 Dec 2023 01:05:23 GMT Last-Modified: Wed 27 Dec 2023 23:27:24 GMT Server: ECAcc (sac/252E) X-Cache: HIT Content-Length: 471 with response body ==>308201D30A0100A08201CC308201C806092B0601050507300101048201B9308201B530819EA21604145168FF90AF0207753CCCD9656462A212B859723B180F32....... "GET /gts1c3/zdATt0Ex_Fk.crl HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: crls.pki.goog" Response ==> HTTP/1.1 200 OK Accept-Ranges: bytes Content-Security-Policy-Report-Only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/cacerts Cross-Origin-Resource-Policy: cross-origin Cross-Origin-Opener-Policy: same-origin; report-to="cacerts" Report-To: {"group":"cacerts" "max_age":2592000 "endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/cacerts"}]} Content-Length: 17319 X-Content-Type-Options: nosniff Server: sffe X-XSS-Protection: 0 Date: Thu 28 Dec 2023 01:05:03 GMT Expires: Thu 28 Dec 2023 01:55:03 GMT Cache-Control: public max-age=3000 Last-Modified: Wed 27 Dec 2023 23:38:44 GMT Content-Type: application/pkix-crl Vary: Accept-Encoding Age: 20 with response body ==>308243A33082428B020101300D06092A864886F70D01010B05003046310B300906035504061302555331223020060355040A1319476F6F676C65205472757374....... "GET /gts1c3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEBZwXm7t3kKEEFjsmHQeLcQ%3D HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.pki.goog" Response ==> HTTP/1.1 200 OK Server: ocsp_responder Content-Length: 471 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Date: Thu 28 Dec 2023 00:18:05 GMT Cache-Control: public max-age=14400 Content-Type: application/ocsp-response Age: 2839 with response body ==>308201D30A0100A08201CC308201C806092B0601050507300101048201B9308201B530819EA21604148A747FAF85CDEE95CD3D9CD0E24614F371351D27180F32....... "GET /gtsr1/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBQwkcLWD4LqGJ7bE7B1XZsEbmfwUAQU5K8rJnEaK0gnhS9SZizv8IkTcT4CDQIDvFNZazTHGPUBUGY%3D HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.pki.goog" Response ==> HTTP/1.1 200 OK Server: ocsp_responder Content-Length: 724 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Date: Thu 28 Dec 2023 00:40:51 GMT Cache-Control: public max-age=14400 Content-Type: application/ocsp-response Age: 1473 with response body ==>308202D00A0100A08202C9308202C506092B0601050507300101048202B6308202B230819BA2160414E4AF2B26711A2B4827852F52662CEFF08913713E180F32....... "GET /gts1c3/moVDfISia2k.crl HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: crls.pki.goog" Response ==> HTTP/1.1 200 OK Accept-Ranges: bytes Content-Security-Policy-Report-Only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/cacerts Cross-Origin-Resource-Policy: cross-origin Cross-Origin-Opener-Policy: same-origin; report-to="cacerts" Report-To: {"group":"cacerts" "max_age":2592000 "endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/cacerts"}]} Content-Length: 18095 X-Content-Type-Options: nosniff Server: sffe X-XSS-Protection: 0 Date: Thu 28 Dec 2023 00:56:34 GMT Expires: Thu 28 Dec 2023 01:46:34 GMT Cache-Control: public max-age=3000 Age: 530 Last-Modified: Wed 27 Dec 2023 21:08:42 GMT Content-Type: application/pkix-crl Vary: Accept-Encoding with response body ==>308246AB30824593020101300D06092A864886F70D01010B05003046310B300906035504061302555331223020060355040A1319476F6F676C65205472757374....... "GET /gtsr1/gtsr1.crl HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: crl.pki.goog" Response ==> HTTP/1.1 200 OK Accept-Ranges: bytes Content-Security-Policy-Report-Only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/cacerts Cross-Origin-Resource-Policy: cross-origin Cross-Origin-Opener-Policy: same-origin; report-to="cacerts" Report-To: {"group":"cacerts" "max_age":2592000 "endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/cacerts"}]} Content-Length: 854 X-Content-Type-Options: nosniff Server: sffe X-XSS-Protection: 0 Date: Thu 28 Dec 2023 00:30:04 GMT Expires: Thu 28 Dec 2023 01:20:04 GMT Cache-Control: public max-age=3000 Age: 2120 Last-Modified: Mon 18 Sep 2023 16:18:00 GMT Content-Type: application/pkix-crl Vary: Accept-Encoding with response body ==>308203523082013A020101300D06092A864886F70D01010B05003047310B300906035504061302555331223020060355040A1319476F6F676C65205472757374....... "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTPJvUY%2Bsl%2Bj4yzQuAcL2oQno5fCgQUUWj%2FkK8CB3U8zNllZGKiErhZcjsCEAcpLgRNzv6uFuf5CFWQE%2F4%3D HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.digicert.com" Response ==> HTTP/1.1 200 OK Accept-Ranges: bytes Age: 4551 Cache-Control: max-age=7200 Content-Type: application/ocsp-response Date: Thu 28 Dec 2023 01:05:26 GMT Last-Modified: Wed 27 Dec 2023 23:49:36 GMT Server: ECAcc (sac/252E) X-Cache: HIT Content-Length: 471 with response body ==>308201D30A0100A08201CC308201C806092B0601050507300101048201B9308201B530819EA21604145168FF90AF0207753CCCD9656462A212B859723B180F32....... "GET /gts1c3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEDEixfO34qnbCeE6N8VMp00%3D HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.pki.goog" Response ==> HTTP/1.1 200 OK Server: ocsp_responder Content-Length: 471 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Date: Thu 28 Dec 2023 00:46:29 GMT Cache-Control: public max-age=14400 Content-Type: application/ocsp-response Age: 1142 with response body ==>308201D30A0100A08201CC308201C806092B0601050507300101048201B9308201B530819EA21604148A747FAF85CDEE95CD3D9CD0E24614F371351D27180F32....... "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAqvpsXKY8RRQeo74ffHUxc%3D HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.digicert.com" Response ==> HTTP/1.1 200 OK Accept-Ranges: bytes Age: 4244 Cache-Control: max-age=7200 Content-Type: application/ocsp-response Date: Thu 28 Dec 2023 01:06:09 GMT Last-Modified: Wed 27 Dec 2023 23:55:25 GMT Server: ECAcc (sac/2548) X-Cache: HIT Content-Length: 471 with response body ==>308201D30A0100A08201CC308201C806092B0601050507300101048201B9308201B530819EA21604144E2254201895E6E36EE60FFAFAB912ED06178F39180F32....... "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.digicert.com" Response ==> HTTP/1.1 200 OK Accept-Ranges: bytes Age: 4509 Cache-Control: max-age=7200 Content-Type: application/ocsp-response Date: Thu 28 Dec 2023 01:06:10 GMT Last-Modified: Wed 27 Dec 2023 23:51:01 GMT Server: ECAcc (sac/2561) X-Cache: HIT Content-Length: 471 with response body ==>308201D30A0100A08201CC308201C806092B0601050507300101048201B9308201B530819EA21604144E2254201895E6E36EE60FFAFAB912ED06178F39180F32....... "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEA177el9ggmWelJjG4vdGL0%3D HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.digicert.com" Response ==> HTTP/1.1 200 OK Accept-Ranges: bytes Age: 6562 Cache-Control: max-age=7200 Content-Type: application/ocsp-response Date: Thu 28 Dec 2023 01:06:10 GMT Last-Modified: Wed 27 Dec 2023 23:16:48 GMT Server: ECAcc (sac/254A) X-Cache: HIT Content-Length: 471 with response body ==>308201D30A0100A08201CC308201C806092B0601050507300101048201B9308201B530819EA21604144E2254201895E6E36EE60FFAFAB912ED06178F39180F32.......3e:T43bf,"d470377f9b683b10aa2230b05a5fcdcd.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 70f10000 "d470377f9b683b10aa2230b05a5fcdcd.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 0 "d470377f9b683b10aa2230b05a5fcdcd.exe" loaded module "KERNEL32" at base 76cf0000 "d470377f9b683b10aa2230b05a5fcdcd.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 0 "d470377f9b683b10aa2230b05a5fcdcd.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 6b600000 "d470377f9b683b10aa2230b05a5fcdcd.exe" loaded module "%WINDIR%\SYSTEM32\ADVPACK.DLL" at base 6c080000 "d470377f9b683b10aa2230b05a5fcdcd.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 75270000 "cv7VU08.exe" loaded module "%WINDIR%\SYSTEM32\ADVPACK.DLL" at base 6b5d0000 "cv7VU08.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 75270000 "Eh9VZ39.exe" loaded module "%WINDIR%\SYSTEM32\ADVPACK.DLL" at base 6c080000 "Eh9VZ39.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 75270000 "2GR5823.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 70f10000 "2GR5823.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 0 "2GR5823.exe" loaded module "KERNEL32" at base 76cf0000 "2GR5823.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 0 "2GR5823.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 73f40000 "2GR5823.exe" loaded module "KERNEL32.DLL" at base 76cf0000 "2GR5823.exe" loaded module "API-MS-WIN-CORE-SYSINFO-L1-2-1" at base 0 "2GR5823.exe" loaded module "DWMAPI.DLL" at base 73d10000 "2GR5823.exe" loaded module "COMCTL32.DLL" at base 74290000 "2GR5823.exe" loaded module "UXTHEME.DLL" at base 73f40000 "2GR5823.exe" loaded module "IMM32.DLL" at base 767b0000 "2GR5823.exe" loaded module "COMCTL32" at base 74290000 "2GR5823.exe" loaded module "SHELL32.DLL" at base 75790000 "2GR5823.exe" loaded module "OLE32.DLL" at base 76dd0000 "2GR5823.exe" loaded module "ADVAPI32.DLL" at base 76580000 "2GR5823.exe" loaded module "PROPSYS.DLL" at base 74080000 "2GR5823.exe" loaded module "OLEAUT32.DLL" at base 77420000 "2GR5823.exe" loaded module "APPHELP.DLL" at base 75270000 "2GR5823.exe" loaded module "CLBCATQ.DLL" at base 75700000 "2GR5823.exe" loaded module "%WINDIR%\SYSTEM32\IEFRAME.DLL" at base 6a240000 "2GR5823.exe" loaded module "API-MS-WIN-DOWNLEVEL-OLE32-L1-1-0.DLL" at base 753f0000 "2GR5823.exe" loaded module "URLMON.DLL" at base 772b0000 "2GR5823.exe" loaded module "API-MS-WIN-DOWNLEVEL-SHLWAPI-L2-1-0.DLL" at base 65fb0000 "2GR5823.exe" loaded module "%WINDIR%\SYSTEM32\PROPSYS.DLL" at base 74080000 "2GR5823.exe" loaded module "%PROGRAMFILES%\INTERNET EXPLORER\IEPROXY.DLL" at base 65fc0000 "2GR5823.exe" loaded module "IERTUTIL.DLL" at base 76830000 "2GR5823.exe" loaded module "%WINDIR%\SYSTEM32\SHELL32.DLL" at base 75790000 "2GR5823.exe" loaded module "USER32.DLL" at base 766e0000 "2GR5823.exe" loaded module "SETUPAPI.DLL" at base 76b00000 "2GR5823.exe" loaded module "RPCRT4.DLL" at base 763e0000 "2GR5823.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 75270000 "2GR5823.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-1" at base 0 "2GR5823.exe" loaded module "EXT-MS-WIN-KERNEL32-PACKAGE-CURRENT-L1-1-0" at base 0 "5cN0su3.exe" loaded module "IMM32.DLL" at base 767b0000 "5cN0su3.exe" loaded module "COMCTL32.DLL" at base 71c20000 "5cN0su3.exe" loaded module "SHFOLDER.DLL" at base 72a50000 "5cN0su3.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 73f40000 "5cN0su3.exe" loaded module "KERNEL32.DLL" at base 76cf0000 "5cN0su3.exe" loaded module "OLE32.DLL" at base 76dd0000 "5cN0su3.exe" loaded module "ADVAPI32.DLL" at base 76580000 "5cN0su3.exe" loaded module "PROFAPI.DLL" at base 753d0000 "5cN0su3.exe" loaded module "API-MS-WIN-SECURITY-SDDL-L1-1-0.DLL" at base 77400000 "5cN0su3.exe" loaded module "SSPICLI.DLL" at base 75250000 "5cN0su3.exe" loaded module "RPCRT4.DLL" at base 763e0000 "5cN0su3.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 70f10000 "5cN0su3.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 0 "5cN0su3.exe" loaded module "KERNEL32" at base 76cf0000 "5cN0su3.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 0 "5cN0su3.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\MSCOREEI.DLL" at base 6bba0000 "5cN0su3.exe" loaded module "SHLWAPI.DLL" at base 767d0000 "5cN0su3.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-2.DLL" at base 0 "5cN0su3.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-0.DLL" at base 0 "5cN0su3.exe" loaded module "VERSION.DLL" at base 74860000 "5cN0su3.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\CLR.DLL" at base 634f0000 "5cN0su3.exe" loaded module "USER32.DLL" at base 766e0000 "5cN0su3.exe" loaded module "API-MS-WIN-CORE-QUIRKS-L1-1-0.DLL" at base 0 "5cN0su3.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\MSCOREE.DLL" at base 0 "5cN0su3.exe" loaded module "MSCOREE.DLL" at base 6bc30000 "5cN0su3.exe" loaded module "%WINDIR%\SYSTEM32\COMBASE.DLL" at base 0 "5cN0su3.exe" loaded module "PSAPI.DLL" at base 76af0000 "5cN0su3.exe" loaded module "%WINDIR%\SYSTEM32\MSCOREE.DLL" at base 6bc30000 "5cN0su3.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\MSCORLIB\36EACCFDE177C2E7B93B8DBDDE4E012A\MSCORLIB.NI.DLL" at base 620e0000 "5cN0su3.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\OLE32.DLL" at base 0 "5cN0su3.exe" loaded module "CRYPTBASE.DLL" at base 752c0000 "5cN0su3.exe" loaded module "API-MS-WIN-CORE-XSTATE-L2-1-0.DLL" at base 72a40000 "5cN0su3.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\CLRJIT.DLL" at base 65980000 "5cN0su3.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM\2C3C912EA8F058F9D04C4650128FEB3F\SYSTEM.NI.DLL" at base 61680000 "5cN0su3.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.CORE\31FAE3290FAD30C31C98651462D22724\SYSTEM.CORE.NI.DLL" at base 60e60000 "5cN0su3.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\MICROSOFT.CSHARP\F73F48AFB5512225DEDAEE9C88AC5050\MICROSOFT.CSHARP.NI.DLL" at base 60cc0000 "5cN0su3.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\NLSSORTING.DLL" at base 72a20000 "5cN0su3.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.CONFIGURATION\96F7EDB07B12303F0EC2595C7F3778C7\SYSTEM.CONFIGURATION.NI.DLL" at base 60bb0000 "5cN0su3.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.XML\15AF16D373CF0528CB74FC73D365FDBF\SYSTEM.XML.NI.DLL" at base 60430000 "5cN0su3.exe" loaded module "NTDLL.DLL" at base 774c0000 "5cN0su3.exe" loaded module "SHELL32.DLL" at base 75790000 "5cN0su3.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_32\MSCORLIB\V4.0_4.0.0.0__B77A5C561934E089\BCRYPT.DLL" at base 0 "5cN0su3.exe" loaded module "BCRYPT.DLL" at base 74ee0000 "5cN0su3.exe" loaded module "CRYPTSP.DLL" at base 74dd0000 "5cN0su3.exe" loaded module "%WINDIR%\SYSTEM32\RSAENH.DLL" at base 74b60000 "5cN0su3.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM\V4.0_4.0.0.0__B77A5C561934E089\PSAPI.DLL" at base 0 "5cN0su3.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 75270000 "5cN0su3.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_32\MSCORLIB\V4.0_4.0.0.0__B77A5C561934E089\SHELL32.DLL" at base 0 "5cN0su3.exe" loaded module "CLBCATQ.DLL" at base 75700000 "5cN0su3.exe" loaded module "%WINDIR%\SYSTEM32\SHELL32.DLL" at base 75790000 "5cN0su3.exe" loaded module "API-MS-WIN-SECURITY-LSALOOKUP-L1-1-0.DLL" at base 77400000 "5cN0su3.exe" loaded module "RPCRTREMOTE.DLL" at base 75360000 "5cN0su3.exe" loaded module "PROPSYS.DLL" at base 74080000 "5cN0su3.exe" loaded module "COMCTL32.DLL" at base 74290000 "5cN0su3.exe" loaded module "OLEAUT32.DLL" at base 77420000 "5cN0su3.exe" loaded module "SETUPAPI.DLL" at base 76b00000 "5cN0su3.exe" loaded module "%WINDIR%\SYSTEM32\PROPSYS.DLL" at base 74080000 "5cN0su3.exe" loaded module "NTMARTA.DLL" at base 746f0000 "5cN0su3.exe" loaded module "APPHELP.DLL" at base 75270000 "5cN0su3.exe" loaded module "%WINDIR%\SYSTEM32\SHDOCVW.DLL" at base 6eed0000 "5cN0su3.exe" loaded module "LINKINFO.DLL" at base 6eb30000 "5cN0su3.exe" loaded module "NTSHRUI.DLL" at base 72b40000 "5cN0su3.exe" loaded module "SRVCLI.DLL" at base 74fc0000 "5cN0su3.exe" loaded module "CSCAPI.DLL" at base 707d0000 "5cN0su3.exe" loaded module "SLC.DLL" at base 73780000 "5cN0su3.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM\V4.0_4.0.0.0__B77A5C561934E089\WS2_32.DLL" at base 0 "5cN0su3.exe" loaded module "WS2_32.DLL" at base 764c0000 "5cN0su3.exe" loaded module "%WINDIR%\SYSTEM32\MSWSOCK.DLL" at base 74d90000 "5cN0su3.exe" loaded module "%WINDIR%\SYSTEM32\WSHTCPIP.DLL" at base 748f0000 "5cN0su3.exe" loaded module "%WINDIR%\SYSTEM32\WSHIP6.DLL" at base 74d80000 "powershell.exe" loaded module "KERNEL32.DLL" at base 76cf0000 "powershell.exe" loaded module "SHELL32.DLL" at base 75790000 "powershell.exe" loaded module "OLEAUT32.DLL" at base 77420000 "powershell.exe" loaded module "OLE32.DLL" at base 76dd0000 "powershell.exe" loaded module "ADVAPI32.DLL" at base 76580000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\PROPSYS.DLL" at base 74080000 "powershell.exe" loaded module "NTMARTA.DLL" at base 746f0000 "powershell.exe" loaded module "API-MS-WIN-CORE-LOCALREGISTRY-L1-1-0.DLL" at base 76cf0000 "powershell.exe" loaded module "SETUPAPI.DLL" at base 76b00000 "powershell.exe" loaded module "RPCRT4.DLL" at base 763e0000 "powershell.exe" loaded module "APPHELP.DLL" at base 75270000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\SHDOCVW.DLL" at base 6eed0000 "powershell.exe" loaded module "PROPSYS.DLL" at base 74080000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\SHELL32.DLL" at base 75790000 "powershell.exe" loaded module "LINKINFO.DLL" at base 6eb30000 "powershell.exe" loaded module "API-MS-WIN-SECURITY-SDDL-L1-1-0.DLL" at base 77400000 "powershell.exe" loaded module "PROFAPI.DLL" at base 753d0000 "powershell.exe" loaded module "USER32.DLL" at base 766e0000 "powershell.exe" loaded module "NTSHRUI.DLL" at base 72b40000 "powershell.exe" loaded module "SRVCLI.DLL" at base 74fc0000 "powershell.exe" loaded module "CSCAPI.DLL" at base 707d0000 "powershell.exe" loaded module "SLC.DLL" at base 73780000 "powershell.exe" loaded module "SHLWAPI.DLL" at base 767d0000 "powershell.exe" loaded module "CRYPTSP.DLL" at base 74dd0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\RSAENH.DLL" at base 74b60000 "powershell.exe" loaded module "CRYPTBASE.DLL" at base 752c0000 "powershell.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 70f10000 "powershell.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 0 "powershell.exe" loaded module "KERNEL32" at base 76cf0000 "powershell.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 0 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\MSCOREEI.DLL" at base 6bba0000 "powershell.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-2.DLL" at base 0 "powershell.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-0.DLL" at base 0 "powershell.exe" loaded module "VERSION.DLL" at base 74860000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V2.0.50727\MSCORWKS.DLL" at base 5fe80000 "powershell.exe" loaded module "MSCOREE.DLL" at base 6bc30000 "powershell.exe" loaded module "NTDLL" at base 774c0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\MSCOREE.DLL" at base 6bc30000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\MSCORLIB\9F895C66454577EFF9C77442D0C84F71\MSCORLIB.NI.DLL" at base 5f380000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V2.0.50727\OLE32.DLL" at base 0 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V2.0.50727\OLEAUT32.DLL" at base 0 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\SYSTEM\AD92DAB7F418877D6A1E0358CE35658A\SYSTEM.NI.DLL" at base 5ebd0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\MICROSOFT.POWERSHEL#\8229F0505633D4BCEF019B9D4FAB9F18\MICROSOFT.POWERSHELL.CONSOLEHOST.NI.DLL" at base 5eb40000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\SYSTEM.MANAGEMENT.A#\84C47B5A5813A5F040AEE9715A0FF7C0\SYSTEM.MANAGEMENT.AUTOMATION.NI.DLL" at base 5dfd0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\GAC_MSIL\SYSTEM\2.0.0.0__B77A5C561934E089\PSAPI.DLL" at base 0 "powershell.exe" loaded module "PSAPI.DLL" at base 76af0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\GAC_MSIL\SYSTEM\2.0.0.0__B77A5C561934E089\NTDLL.DLL" at base 0 "powershell.exe" loaded module "NTDLL.DLL" at base 774c0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\SYSTEM.CORE\BD9FF1A4363781A57E8F7392F230A203\SYSTEM.CORE.NI.DLL" at base 5dd90000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\MICROSOFT.POWERSHEL#\49CAE79AC18BAD142E1AB5A46A8AC306\MICROSOFT.POWERSHELL.COMMANDS.DIAGNOSTICS.NI.DLL" at base 5dd40000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\SYSTEM.CONFIGURATIO#\D6ACC39F6C1EA42D8B3150DB6184A969\SYSTEM.CONFIGURATION.INSTALL.NI.DLL" at base 6b5d0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\MICROSOFT.WSMAN.MAN#\7BF5729401CFF7EA7898124E9818ED20\MICROSOFT.WSMAN.MANAGEMENT.NI.DLL" at base 5dcb0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\SYSTEM.TRANSACTIONS\FEC007EA17AC8956CC5D6D4074DADA6A\SYSTEM.TRANSACTIONS.NI.DLL" at base 5dc10000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\GAC_32\SYSTEM.TRANSACTIONS\2.0.0.0__B77A5C561934E089\SYSTEM.TRANSACTIONS.DLL" at base 5dbc0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\MICROSOFT.POWERSHEL#\F1831CE4588265A3F72E0A581BA58F2A\MICROSOFT.POWERSHELL.COMMANDS.UTILITY.NI.DLL" at base 5da20000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\MICROSOFT.POWERSHEL#\344E681515D07B93A4F1383F0D625E1E\MICROSOFT.POWERSHELL.COMMANDS.MANAGEMENT.NI.DLL" at base 5d950000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\MICROSOFT.POWERSHEL#\573750F17B5B8316F04A10956FDD1D97\MICROSOFT.POWERSHELL.SECURITY.NI.DLL" at base 5d920000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V2.0.50727\CULTURE.DLL" at base 6c030000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\SYSTEM.XML\77C1DC46EA139BF5E1EAA9B87EF03C7A\SYSTEM.XML.NI.DLL" at base 5d3e0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\SYSTEM.MANAGEMENT\00C2B464E52D4E82C04D61592A12A89D\SYSTEM.MANAGEMENT.NI.DLL" at base 5d2d0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\SYSTEM.DIRECTORYSER#\237ED1739105C1BEBE48D41905FDB3EE\SYSTEM.DIRECTORYSERVICES.NI.DLL" at base 5d1b0000 "powershell.exe" loaded module "SHFOLDER.DLL" at base 72a50000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\GAC_32\MSCORLIB\2.0.0.0__B77A5C561934E089\SECUR32.DLL" at base 0 "powershell.exe" loaded module "SECUR32.DLL" at base 75100000 "powershell.exe" loaded module "SSPICLI.DLL" at base 75250000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\SYSTEM.DATA\511C39D1EFA06D262A6B2F47E2726C73\SYSTEM.DATA.NI.DLL" at base 5cb20000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\GAC_32\SYSTEM.DATA\2.0.0.0__B77A5C561934E089\SYSTEM.DATA.DLL" at base 5c840000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V2.0.50727\MSCORJIT.DLL" at base 5c7e0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V2.0.50727\DIASYMREADER.DLL" at base 5c750000 "powershell.exe" loaded module "GDI32.DLL" at base 776c0000 "powershell.exe" loaded module "NETUTILS.DLL" at base 73a70000 "cmd.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 70f10000 "cmd.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 0 "cmd.exe" loaded module "KERNEL32" at base 76cf0000 "cmd.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 0 "cmd.exe" loaded module "KERNEL32.DLL" at base 76cf0000 "cmd.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 75270000 "schtasks.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 70f10000 "schtasks.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 0 "schtasks.exe" loaded module "KERNEL32" at base 76cf0000 "schtasks.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 0 "schtasks.exe" loaded module "CRYPTBASE.DLL" at base 752c0000 "schtasks.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 73f40000 "schtasks.exe" loaded module "RPCRT4.DLL" at base 763e0000 "schtasks.exe" loaded module "API-MS-WIN-SECURITY-LSALOOKUP-L1-1-0.DLL" at base 77400000 "schtasks.exe" loaded module "ADVAPI32.DLL" at base 76580000 "schtasks.exe" loaded module "CLBCATQ.DLL" at base 75700000 "schtasks.exe" loaded module "%WINDIR%\SYSTEM32\TASKSCHD.DLL" at base 739d0000 "schtasks.exe" loaded module "SSPICLI.DLL" at base 75250000 "schtasks.exe" loaded module "XMLLITE.DLL" at base 73be00003f:Taba,"d470377f9b683b10aa2230b05a5fcdcd.exe" was detected as "Microsoft Cabinet" and name: "sfx" "d470377f9b683b10aa2230b05a5fcdcd.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "d470377f9b683b10aa2230b05a5fcdcd.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "d470377f9b683b10aa2230b05a5fcdcd.exe" was detected as "Microsoft Cabinet File" and name: "Archive" "d470377f9b683b10aa2230b05a5fcdcd.exe" was detected as "Microsoft Linker" and name: "Linker" "cv7VU08.exe" was detected as "Microsoft Cabinet" and name: "sfx" "cv7VU08.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "cv7VU08.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "cv7VU08.exe" was detected as "Microsoft Cabinet File" and name: "Archive" "cv7VU08.exe" was detected as "Microsoft Linker" and name: "Linker" "Eh9VZ39.exe" was detected as "Microsoft Cabinet" and name: "sfx" "Eh9VZ39.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "Eh9VZ39.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "Eh9VZ39.exe" was detected as "Microsoft Cabinet File" and name: "Archive" "Eh9VZ39.exe" was detected as "Microsoft Linker" and name: "Linker" "5cN0su3.exe" was detected as "Microsoft Cabinet" and name: "sfx" "5cN0su3.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "5cN0su3.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "5cN0su3.exe" was detected as "Microsoft Cabinet File" and name: "Archive" "5cN0su3.exe" was detected as "Microsoft Linker" and name: "Linker" "2GR5823.exe" was detected as "Microsoft Cabinet" and name: "sfx" "2GR5823.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "2GR5823.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "2GR5823.exe" was detected as "Microsoft Cabinet File" and name: "Archive" "2GR5823.exe" was detected as "Microsoft Linker" and name: "Linker" "6AT6wL0.exe" was detected as "Microsoft Cabinet" and name: "sfx" "6AT6wL0.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "6AT6wL0.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "6AT6wL0.exe" was detected as "Microsoft Cabinet File" and name: "Archive" "6AT6wL0.exe" was detected as "Microsoft Linker" and name: "Linker" "7gT2oH15.exe" was detected as "Microsoft Cabinet" and name: "sfx" "7gT2oH15.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "7gT2oH15.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "7gT2oH15.exe" was detected as "Microsoft Cabinet File" and name: "Archive" "7gT2oH15.exe" was detected as "Microsoft Linker" and name: "Linker"40:T945,"2GR5823.exe" touched "Computer" (Path: "HKCU\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\SHELLFOLDER") "2GR5823.exe" touched "Network" (Path: "HKCU\CLSID\{208D2C60-3AEA-1069-A2D7-08002B30309D}\SHELLFOLDER") "2GR5823.exe" touched "Property System Both Class Factory" (Path: "HKCU\CLSID\{76765B11-3F95-4AF2-AC9D-EA55D8994F1A}") "2GR5823.exe" touched "Application Registration" (Path: "HKCU\CLSID\{591209C7-767B-42B2-9FBA-44EE4615F2C7}\TREATAS") "5cN0su3.exe" touched "Shortcut" (Path: "HKCU\CLSID\{00021401-0000-0000-C000-000000000046}\INPROCSERVER32") "5cN0su3.exe" touched "Memory Mapped Cache Mgr" (Path: "HKCU\CLSID\{1F486A52-3CB1-48FD-8F50-B8DC300D9F9D}") "5cN0su3.exe" touched "UsersFiles" (Path: "HKCU\CLSID\{59031A47-3F72-44A7-89C5-5595FE6B30EE}\SHELLFOLDER") "5cN0su3.exe" touched "delegate folder that appears in Users Files Folder" (Path: "HKCU\CLSID\{DFFACDC5-679F-4156-8947-C5C76BC0B67F}\SHELLFOLDER") "5cN0su3.exe" touched "Shell File System Folder" (Path: "HKCU\CLSID\{0E5AAE11-A475-4C5B-AB00-C66DE400274E}\INPROCSERVER32") "powershell.exe" touched "Custom Destination List" (Path: "HKCU\CLSID\{77F10CF0-3DB5-4966-B520-B7C54FD35ED6}") "powershell.exe" touched "Start Menu Cache" (Path: "HKCU\CLSID\{660B90C8-73A9-4B58-8CAE-355B7F55341B}") "powershell.exe" touched "Start Menu Pin" (Path: "HKLM\SOFTWARE\CLASSES\CLSID\{A2A9545D-A0C2-42B4-9708-A0B2BADD77C8}") "powershell.exe" touched "Taskband Pin" (Path: "HKCU\CLSID\{90AA3A4E-1CBA-4233-B8BB-535773D48449}\TREATAS") "powershell.exe" touched "Internet Shortcut" (Path: "HKCU\CLSID\{FBF23B40-E3F0-101B-8488-00AA003E56F8}\IMPLEMENTED CATEGORIES\{00021490-0000-0000-C000-000000000046}") "powershell.exe" touched "User Pinned" (Path: "HKCU\CLSID\{1F3427C8-5C10-4210-AA03-2EE45287D668}\SHELLFOLDER") "powershell.exe" touched "User Assist" (Path: "HKCU\CLSID\{DD313E04-FEFF-11D1-8ECD-0000F87A470C}\TREATAS") "powershell.exe" touched "Shared Task Scheduler" (Path: "HKCU\CLSID\{603D3801-BD81-11D0-A3A5-00C04FD706EC}\TREATAS") "powershell.exe" touched "A collection of IUnknown objects that can be enumerated" (Path: "HKCU\CLSID\{2D3468C1-36A7-43B6-AC24-D3F02FD9607A}\TREATAS") "powershell.exe" touched "NDP SymBinder" (Path: "HKCU\CLSID\{0A29FF9E-7F9C-4437-8B11-F424491E3931}\INPROCSERVER32") "schtasks.exe" touched "TaskScheduler class" (Path: "HKCU\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}")41:T102c,"d470377f9b683b10aa2230b05a5fcdcd.exe" file has an entrypoint instructions - "call 0x407155,jmp 0x406a6a,push 0x58,push 0x4072b8,call 0x407208,xor ebx, ebx,mov dword ptr [ebp - 0x20], ebx,lea eax, [ebp - 0x68],push eax,call dword ptr [0x40a184],mov dword ptr [ebp - 4], ebx,mov eax, dword ptr fs:[0x18],mov esi, dword ptr [eax + 4],mov edi, ebx,mov edx, 0x4088ac,mov ecx, esi,xor eax, eax,lock cmpxchg dword ptr [edx], ecx,test eax, eax,je 0x406abc,cmp eax, esi,jne 0x406aaf,xor esi, esi,inc esi,mov edi, esi,jmp 0x406abf,push 0x3e8,call dword ptr [0x40a188],jmp 0x406a93,xor esi, esi,inc esi," "cv7VU08.exe" file has an entrypoint instructions - "call 0x407155,jmp 0x406a6a,push 0x58,push 0x4072b8,call 0x407208,xor ebx, ebx,mov dword ptr [ebp - 0x20], ebx,lea eax, [ebp - 0x68],push eax,call dword ptr [0x40a184],mov dword ptr [ebp - 4], ebx,mov eax, dword ptr fs:[0x18],mov esi, dword ptr [eax + 4],mov edi, ebx,mov edx, 0x4088ac,mov ecx, esi,xor eax, eax,lock cmpxchg dword ptr [edx], ecx,test eax, eax,je 0x406abc,cmp eax, esi,jne 0x406aaf,xor esi, esi,inc esi,mov edi, esi,jmp 0x406abf,push 0x3e8,call dword ptr [0x40a188],jmp 0x406a93,xor esi, esi,inc esi," "Eh9VZ39.exe" file has an entrypoint instructions - "call 0x407155,jmp 0x406a6a,push 0x58,push 0x4072b8,call 0x407208,xor ebx, ebx,mov dword ptr [ebp - 0x20], ebx,lea eax, [ebp - 0x68],push eax,call dword ptr [0x40a184],mov dword ptr [ebp - 4], ebx,mov eax, dword ptr fs:[0x18],mov esi, dword ptr [eax + 4],mov edi, ebx,mov edx, 0x4088ac,mov ecx, esi,xor eax, eax,lock cmpxchg dword ptr [edx], ecx,test eax, eax,je 0x406abc,cmp eax, esi,jne 0x406aaf,xor esi, esi,inc esi,mov edi, esi,jmp 0x406abf,push 0x3e8,call dword ptr [0x40a188],jmp 0x406a93,xor esi, esi,inc esi," "5cN0su3.exe" file has an entrypoint instructions - "jmp 0x85c48a,add byte ptr [eax + ecx], dl,add byte ptr [eax], al,add byte ptr [eax], al,pushal ,call 0x85c490,pop ebp,sub ebp, 0x10,sub ebp, 0x45c480,jmp 0x85c4a6,lodsd eax, dword ptr [esi],push ebp,inc eax,fnstcw word ptr [eax + 0x45c480],add eax, ebp,add eax, 0x4c,mov ecx, 0x5e1,mov edx, 0x325a1203,xor byte ptr [eax], dl,inc eax,dec ecx,jne 0x85c4bd,jmp 0x85c4d0,fadd qword ptr gs:[si - 0x3178],mov byte ptr [edx + 0x303033f], cl,add dl, 0xfb,add eax, dword ptr [ebx],add eax, dword ptr [eax],into ," "2GR5823.exe" file has an entrypoint instructions - "call 0x420aea,jmp 0x4203fb,push ebp,mov ebp, esp,push esi,push dword ptr [ebp + 8],mov esi, ecx,call 0x4205e7,mov dword ptr [esi], 0x49fdf0,mov eax, esi,pop esi,pop ebp,ret 4,and dword ptr [ecx + 4], 0,mov eax, ecx,and dword ptr [ecx + 8], 0,mov dword ptr [ecx + 4], 0x49fdf8,mov dword ptr [ecx], 0x49fdf0,ret ,push ebp,mov ebp, esp,push esi,push dword ptr [ebp + 8],mov esi, ecx,call 0x4205e7,mov dword ptr [esi], 0x49fe0c,mov eax, esi,pop esi,pop ebp,ret 4,and dword ptr [ecx + 4], 0,mov eax, ecx,and dword ptr [ecx + 8], 0," "6AT6wL0.exe" file has an entrypoint instructions - "call 0x405a69,jmp 0x401f8b,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,mov edx, dword ptr [esp + 0xc],mov ecx, dword ptr [esp + 4],test edx, edx,je 0x402195,xor eax, eax,mov al, byte ptr [esp + 8],test al, al,jne 0x40214c,cmp edx, 0x100,jb 0x40214c,cmp dword ptr [0x870088], 0,je 0x40214c,jmp 0x405b56,push edi,mov edi, ecx,cmp edx, 4,jb 0x402185,neg ecx,and ecx, 3,je 0x402167,sub edx, ecx,mov byte ptr [edi], al,add edi, 1,sub ecx, 1,jne 0x40215d,mov ecx, eax,shl eax, 8," "7gT2oH15.exe" file has an entrypoint instructions - "call 0x4031a7,jne 0x4031af,je 0x4031af,jnp 0x403153,and dword ptr [ecx - 0x74fb3b7d], ecx,pop esp,and al, 0xfc,jmp 0x4031c2,add al, 0x81,jmp 0x403163,xor dword ptr [eax], eax,add bl, ch,add eax, 0x4f5eb20,and byte ptr [edi + eax + 0x75], dh,add eax, 0xb1d340c7,rol bh, 1,inc esp,and al, 0xfc,xor byte ptr [eax], al,add byte ptr [eax], al,sub esp, 4,jne 0x4031e2,je 0x4031e2,int3 ,dec esi,xchg eax, esi,add eax, dword ptr [ebx + 0x548b04c4],and al, 0xfc,jmp 0x4031f1,add al, 0x29,shr bl, 5,add ch, bl,stc ,add al, 2,jmp 0x4031fc,or byte ptr [edx], cl,loop 0x403246,mov byte ptr [ebx + eax + 2], ah,je 0x403206,jne 0x403206,mov cl, 0xb5,dec edi,"42:T4dd,Observed system executable string:"/C:\ PROGRA~2Vyd* MICROS~1VQt* WindowsSTARTM~1ProgramsVyd*ACCESS~1WINDOW~1WINDOW~1.LNKC:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk1SPS1SPSdet-cmfsgthlqxo/C:\ PROGRA~2Vyd* MICROS~1VQt* WindowsSTARTM~1ProgramsVyd*ACCESS~1WINDOW~1WINDOW~1.LNKC:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk1SPS1SPSdet-cmfsgthlqxo/C:\WindowsSystem32WINDOW~1v1.0powershell_ise.exeC:\Windows\System32\WindowsPowerShell\v1.0\powershell_ise.exe%systemroot%\system32\windowspowershell\v1.0\powershell_ise.exe1SPS1SPSdet-cmfsgthlqxo/C:\Windowshh.exeC:\Windows\hh.exe%systemroot%\hh.exe1SPS1SPSdet-cmfsgthlqxo" [Source: HYPJEWEFN94RHMBSVEW0.temp] Observed system executable string:"%WINDIR%\system32\windowspowershell\v1.0\powershell_ise.exe" [Source: 00000000-00003228-00000C28-3412173317] Observed system executable string:"%WINDIR%\system32\schtasks.exe" [Source: 00000000-00003008-00000C41-2256664061]43:T731,"d470377f9b683b10aa2230b05a5fcdcd.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "d470377f9b683b10aa2230b05a5fcdcd.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "cv7VU08.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "cv7VU08.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "Eh9VZ39.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "Eh9VZ39.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "2GR5823.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "2GR5823.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "2GR5823.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LOCALE"; Key: "00000409") "5cN0su3.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "5cN0su3.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "5cN0su3.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LOCALE"; Key: "00000409") "powershell.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "powershell.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "powershell.exe" (Path: "HKCU\CONTROL PANEL\INTERNATIONAL"; Key: "SYEARMONTH") "cmd.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "cmd.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "cmd.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LOCALE"; Key: "00000409") "schtasks.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "schtasks.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US")44:T520,Found string "" (Indicator: "text/javascript"; File: "YWFOO1FA.htm") Found string "" (Indicator: "text/javascript"; File: "YWFOO1FA.htm") Found string "" (Indicator: "text/javascript"; File: "YWFOO1FA.htm") Found string "" (Indicator: "text/javascript"; File: "YWFOO1FA.htm")45:Tf0f,Observed system executable string:"C:\Windows\system32\apphelp.dll" [Source: 00001540.00000604.736734.00090000.wprm] Observed system executable string:"%WINDIR%\system32\advpack.dll" [Source: 00000000-00003280-00000C25-45032782] Observed system executable string:"rundll32.exe %WINDIR%\system32\advpack.dll,DelNodeRunDLL32 "%TEMP%\IXP000.TMP\"" [Source: 00000000-00003280-00000BC1-45044295] Observed system executable string:"rundll32.exe %WINDIR%\system32\advpack.dll,DelNodeRunDLL32 "%TEMP%\IXP001.TMP\"" [Source: 00000000-00001540-00000BC1-45585762] Observed system executable string:"rundll32.exe %WINDIR%\system32\advpack.dll,DelNodeRunDLL32 "%TEMP%\IXP002.TMP\"" [Source: 00000000-00004044-00000BC1-46204682] Observed system executable string:"%WINDIR%\system32\uxtheme.dll" [Source: 00000000-00002340-00000C25-46623592] Observed system executable string:"%WINDIR%\System32\ieframe.dll" [Source: 00000000-00002340-00000C25-47686753] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll" [Source: 00000000-00001484-00000C25-54056795] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\clr.dll" [Source: 00000000-00001484-00000C25-54194227] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoree.dll" [Source: 00000000-00001484-00000C25-54500204] Observed system executable string:"%WINDIR%\system32\combase.dll" [Source: 00000000-00001484-00000C25-55030483] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\mscorlib\36eaccfde177c2e7b93b8dbdde4e012a\mscorlib.ni.dll" [Source: 00000000-00001484-00000C25-55189669] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\ole32.dll" [Source: 00000000-00001484-00000C25-55237724] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\clrjit.dll" [Source: 00000000-00001484-00000C25-55317018] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System\2c3c912ea8f058f9d04c4650128feb3f\System.ni.dll" [Source: 00000000-00001484-00000C25-55455891] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Core\31fae3290fad30c31c98651462d22724\System.Core.ni.dll" [Source: 00000000-00001484-00000C25-55512431] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\Microsoft.CSharp\f73f48afb5512225dedaee9c88ac5050\Microsoft.CSharp.ni.dll" [Source: 00000000-00001484-00000C25-55551149] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\nlssorting.dll" [Source: 00000000-00001484-00000C25-55697200] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Configuration\96f7edb07b12303f0ec2595c7f3778c7\System.Configuration.ni.dll" [Source: 00000000-00001484-00000C25-55761922] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Xml\15af16d373cf0528cb74fc73d365fdbf\System.Xml.ni.dll" [Source: 00000000-00001484-00000C25-55808955] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll" [Source: 00000000-00001484-00000C25-55913007] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll" [Source: 00000000-00001484-00000C25-56126440] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll" [Source: 00000000-00001484-00000C25-66267471] Observed system executable string:"%WINDIR%\System32\shdocvw.dll" [Source: 00000000-00001484-00000C25-69078741] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ws2_32.dll" [Source: 00000000-00001484-00000C25-76525913]46:T618,Spawned process "cv7VU08.exe" (UID: 00000000-00001540) Spawned process "Eh9VZ39.exe" (UID: 00000000-00004044) Spawned process "2GR5823.exe" (UID: 00000000-00002340) Spawned process "iexplore.exe" with commandline "https://accounts.google.com/" (UID: 00000000-00003264) Spawned process "iexplore.exe" with commandline "https://facebook.com/login" (UID: 00000000-00001256) Spawned process "iexplore.exe" with commandline "https://www.youtube.com/" (UID: 00000000-00001404) Spawned process "iexplore.exe" with commandline "SCODEF:3264 CREDAT:275457 /prefetch:2" (UID: 00000000-00001356) Spawned process "iexplore.exe" with commandline "SCODEF:1256 CREDAT:275457 /prefetch:2" (UID: 00000000-00003392) Spawned process "5cN0su3.exe" (UID: 00000000-00001484) Spawned process "iexplore.exe" with commandline "SCODEF:1404 CREDAT:275457 /prefetch:2" (UID: 00000000-00003812) Spawned process "powershell.exe" with commandline ""powershell" Get-MpPreference -verbose" (UID: 00000000-00003228) Spawned process "cmd.exe" with commandline "/c schtasks /create /f /RU "%OSUSER%" /tr "%ALLUSERSPROFILE%\\Of ..." (UID: 00000000-00003008), Spawned process "schtasks.exe" with commandline "schtasks /create /f /RU "%OSUSER%" /tr "%ALLUSERSPROFILE%\\Offi ..." (UID: 00000000-00000956) Spawned process "cmd.exe" with commandline "/c schtasks /create /f /RU "%OSUSER%" /tr "%ALLUSERSPROFILE%\\Of ..." (UID: 00000000-00003908), Spawned process "schtasks.exe" with commandline "schtasks /create /f /RU "%OSUSER%" /tr "%ALLUSERSPROFILE%\\Offi ..." (UID: 00000000-00003728)47:T618,Spawned process "cv7VU08.exe" (UID: 00000000-00001540) Spawned process "Eh9VZ39.exe" (UID: 00000000-00004044) Spawned process "2GR5823.exe" (UID: 00000000-00002340) Spawned process "iexplore.exe" with commandline "https://accounts.google.com/" (UID: 00000000-00003264) Spawned process "iexplore.exe" with commandline "https://facebook.com/login" (UID: 00000000-00001256) Spawned process "iexplore.exe" with commandline "https://www.youtube.com/" (UID: 00000000-00001404) Spawned process "iexplore.exe" with commandline "SCODEF:3264 CREDAT:275457 /prefetch:2" (UID: 00000000-00001356) Spawned process "iexplore.exe" with commandline "SCODEF:1256 CREDAT:275457 /prefetch:2" (UID: 00000000-00003392) Spawned process "5cN0su3.exe" (UID: 00000000-00001484) Spawned process "iexplore.exe" with commandline "SCODEF:1404 CREDAT:275457 /prefetch:2" (UID: 00000000-00003812) Spawned process "powershell.exe" with commandline ""powershell" Get-MpPreference -verbose" (UID: 00000000-00003228) Spawned process "cmd.exe" with commandline "/c schtasks /create /f /RU "%OSUSER%" /tr "%ALLUSERSPROFILE%\\Of ..." (UID: 00000000-00003008), Spawned process "schtasks.exe" with commandline "schtasks /create /f /RU "%OSUSER%" /tr "%ALLUSERSPROFILE%\\Offi ..." (UID: 00000000-00000956) Spawned process "cmd.exe" with commandline "/c schtasks /create /f /RU "%OSUSER%" /tr "%ALLUSERSPROFILE%\\Of ..." (UID: 00000000-00003908), Spawned process "schtasks.exe" with commandline "schtasks /create /f /RU "%OSUSER%" /tr "%ALLUSERSPROFILE%\\Offi ..." (UID: 00000000-00003728)48:T51de,"cv7VU08.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP000.TMP\cv7VU08.exe]- [targetUID: 00000000-00003280] "Eh9VZ39.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP001.TMP\Eh9VZ39.exe]- [targetUID: 00000000-00004044] "5cN0su3.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP002.TMP\5cN0su3.exe]- [targetUID: 00000000-00004044] "urlref_httpswww.youtube.com" has type "HTML document UTF-8 Unicode text with very long lines"- [targetUID: N/A] "2GR5823.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP002.TMP\2GR5823.exe]- [targetUID: 00000000-00002340] "urlref_httpsaccounts.google.com" has type "HTML document UTF-8 Unicode text with very long lines"- [targetUID: N/A] "6AT6wL0.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP001.TMP\6AT6wL0.exe]- [targetUID: 00000000-00001540] "7gT2oH15.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP000.TMP\7gT2oH15.exe]- [targetUID: 00000000-00003280] "4lCu2zih0ca_1_.svg" has type "SVG Scalable Vector Graphics image"- [targetUID: N/A] "FANBooster131.lnk" has type "MS Windows shortcut Item id list present Points to a file or directory Has Description string Has Relative path Archive ctime=Thu Dec 28 00:06:43 2023 mtime=Thu Dec 28 00:06:43 2023 atime=Wed Dec 27 23:04:10 2023 length=1527296 window=hide"- Location: [%APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\FANBooster131.lnk]- [targetUID: 00000000-00001484] "urlblockindex_1_.bin" has type "data"- [targetUID: N/A] "identifier_1_.htm" has type "HTML document UTF-8 Unicode text with very long lines"- [targetUID: N/A] "sLMNFasP7gH_1_.js" has type "ASCII text with very long lines"- [targetUID: N/A] "YWFOO1FA.htm" has type "HTML document UTF-8 Unicode text with very long lines with CRLF NEL line terminators"- Location: [%LOCALAPPDATA%\Microsoft\Windows\Temporary Internet Files\Content.IE5\CKDNCXYS\YWFOO1FA.htm]- [targetUID: 00000000-00003264] "6bjw9N12j0I_1_.js" has type "ASCII text with very long lines"- [targetUID: N/A] "login_1_.htm" has type "HTML document UTF-8 Unicode text with very long lines"- [targetUID: N/A] "urlref_httpsfacebook.comlogin" has type "HTML document UTF-8 Unicode text with very long lines"- [targetUID: N/A] "dinosaur_1_.png" has type "PNG image data 1200 x 800 8-bit/color RGBA non-interlaced"- [targetUID: N/A] "xGzxHIbkRpC_1_.js" has type "C source ASCII text with very long lines"- [targetUID: N/A] "sKtrEJAtiUM_1_.js" has type "ASCII text with very long lines"- [targetUID: N/A] "_cNbISKpDhw_1_.js" has type "ASCII text with very long lines"- [targetUID: N/A] "Ch_YChJCKQS_1_.js" has type "ASCII text with very long lines"- [targetUID: N/A] "x5_Htks8xgp_1_.js" has type "C source ASCII text with very long lines"- [targetUID: N/A] "CheckConnection_1_.htm" has type "HTML document ASCII text with very long lines"- [targetUID: N/A] "DrNGezcSqaJ_1_.css" has type "ASCII text with very long lines"- [targetUID: N/A] "aBIoq18cchP_1_.js" has type "ASCII text with very long lines"- [targetUID: N/A] "qvzskUrYlYC_1_.js" has type "ASCII text with very long lines"- [targetUID: N/A] "4UabrENHsxJlGDuGo1OIlLU94YtzCwA_1_.woff" has type "Web Open Font Format TrueType length 26412 version 1.1"- [targetUID: N/A] "4UaGrENHsxJlGDuGo1OIlL3Owpg_1_.woff" has type "Web Open Font Format TrueType length 26180 version 1.1"- [targetUID: N/A] "KFOlCnqEu92Fr1MmEU9fBBc-_1_.woff" has type "Web Open Font Format TrueType length 20544 version 1.1"- [targetUID: N/A] "~DF8C2917B518D97FB0.TMP" has type "data"- Location: [%TEMP%\~DF8C2917B518D97FB0.TMP]- [targetUID: 00000000-00003264] "KFOmCnqEu92Fr1Mu4mxM_1_.woff" has type "Web Open Font Format TrueType length 20344 version 1.1"- [targetUID: N/A] "KFOlCnqEu92Fr1MmEU9fBBc-_1_.woff" has type "Web Open Font Format TrueType length 20012 version 1.1"- [targetUID: N/A] "Jn0xcQmjzFV_1_.js" has type "C source ASCII text with very long lines"- [targetUID: N/A] "KFOkCnqEu92Fr1MmgVxIIzQ_1_.woff" has type "Web Open Font Format TrueType length 19936 version 1.1"- [targetUID: N/A] "KFOlCnqEu92Fr1MmSU5fBBc-_1_.woff" has type "Web Open Font Format TrueType length 19916 version 1.1"- [targetUID: N/A] "KFOlCnqEu92Fr1MmWUlfBBc-_1_.woff" has type "Web Open Font Format TrueType length 19888 version 1.1"- [targetUID: N/A] "L3lExXePTzJ_1_.css" has type "ASCII text with very long lines"- [targetUID: N/A] "Qw3hZQNGEDjaO2m6tqIqX5E-AVS5_rSejo46_PCTRspJ0OosolrBEJL3HMXfxQASluL2m_dANVawBpSF_1_.woff" has type "Web Open Font Format TrueType length 18412 version 1.1"- [targetUID: N/A] "en-US.4" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\Internet Explorer\DomainSuggestions\en-US.4]- [targetUID: 00000000-00001404] "70DAE932E3BCB3C00656A27B544BA9CA" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\70DAE932E3BCB3C00656A27B544BA9CA]- [targetUID: 00000000-00001356] "C88418EDBE65AF3960916D9E8011370D" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\C88418EDBE65AF3960916D9E8011370D]- [targetUID: 00000000-00003812] "~DFF7817E6320173843.TMP" has type "data"- Location: [%TEMP%\~DFF7817E6320173843.TMP]- [targetUID: 00000000-00003264] "~DF21CB5C34A428FBCF.TMP" has type "data"- Location: [%TEMP%\~DF21CB5C34A428FBCF.TMP]- [targetUID: 00000000-00001256] "~DF35ABBD9C9CB03AE4.TMP" has type "data"- Location: [%TEMP%\~DF35ABBD9C9CB03AE4.TMP]- [targetUID: 00000000-00001404] "~DF4610EFEC7BDC2711.TMP" has type "data"- Location: [%TEMP%\~DF4610EFEC7BDC2711.TMP]- [targetUID: 00000000-00001404] "~DFA5B91207890C8A7B.TMP" has type "data"- Location: [%TEMP%\~DFA5B91207890C8A7B.TMP]- [targetUID: 00000000-00001404] "~DF89E5C1E7847B5EC3.TMP" has type "data"- Location: [%TEMP%\~DF89E5C1E7847B5EC3.TMP]- [targetUID: 00000000-00003264] "~DFB5CC5924DD257F42.TMP" has type "data"- Location: [%TEMP%\~DFB5CC5924DD257F42.TMP]- [targetUID: 00000000-00001256] "HtdXy-2D6mm_1_.js" has type "ASCII text with very long lines"- [targetUID: N/A] "lFK_RCKM9IT_1_.js" has type "C source ASCII text with very long lines"- [targetUID: N/A] "imagestore.dat" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\Internet Explorer\imagestore\3mt7jhv\imagestore.dat]- [targetUID: 00000000-00003812] "_BEC363E7-A514-11EE-96B4-00505691C809_.dat" has type "Composite Document File V2 Document Cannot read section info"- [targetUID: N/A] "firefox_1_.png" has type "PNG image data 128 x 128 8-bit/color RGBA non-interlaced"- [targetUID: N/A] "yt_logo_rgb_light_1_.png" has type "PNG image data 1588 x 356 8-bit colormap non-interlaced"- [targetUID: N/A] "edgium_1_.png" has type "PNG image data 128 x 128 8-bit/color RGBA non-interlaced"- [targetUID: N/A] "Y0L6f5sxdIV_1_.png" has type "PNG image data 283 x 315 8-bit colormap non-interlaced"- [targetUID: N/A] "ysfm_2i9xtW_1_.js" has type "ASCII text with very long lines"- [targetUID: N/A] "chrome_1_.png" has type "PNG image data 128 x 128 8-bit/color RGBA non-interlaced"- [targetUID: N/A] "_BEC38AF7-A514-11EE-96B4-00505691C809_.dat" has type "Composite Document File V2 Document Cannot read section info"- [targetUID: N/A] "supported_browsers_1_.htm" has type "HTML document UTF-8 Unicode text with very long lines with no line terminators"- [targetUID: N/A] "RecoveryStore._BEC363E5-A514-11EE-96B4-00505691C809_.dat" has type "Composite Document File V2 Document Cannot read section info"- [targetUID: N/A] "RecoveryStore._BEC38AF5-A514-11EE-96B4-00505691C809_.dat" has type "Composite Document File V2 Document Cannot read section info"- [targetUID: N/A] "RecoveryStore._BF276D62-A514-11EE-96B4-00505691C809_.dat" has type "Composite Document File V2 Document Cannot read section info"- [targetUID: N/A] "favicon_3_.ico" has type "MS Windows icon resource - 2 icons 16x16 32 bits/pixel 32x32 32 bits/pixel"- [targetUID: N/A] "RKK6hMCj3R1_1_.js" has type "ASCII text with very long lines"- [targetUID: N/A] "57C8EDB95DF3F0AD4EE2DC2B8CFD4157" has type "Microsoft Cabinet archive data Windows 2000/XP setup 4770 bytes 1 file at 0x2c +A "disallowedcert.stl" number 1 1 datablock 0x1 compression"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\57C8EDB95DF3F0AD4EE2DC2B8CFD4157]- [targetUID: 00000000-00001356] "_9D0EBB7E-A515-11EE-96B4-00505691C809_.dat" has type "Composite Document File V2 Document Cannot read section info"- [targetUID: N/A] "_C269F93B-A517-11EE-96B4-00505691C809_.dat" has type "Composite Document File V2 Document Cannot read section info"- [targetUID: N/A] "_E8DF2DCE-A514-11EE-96B4-00505691C809_.dat" has type "Composite Document File V2 Document Cannot read section info"- [targetUID: N/A] "hLRJ1GG_y0J_1_.ico" has type "MS Windows icon resource - 1 icon 32x32 32 bits/pixel"- [targetUID: N/A] "2W2z89vRC58_1_.css" has type "ASCII text with very long lines"- [targetUID: N/A] "opera_1_.png" has type "PNG image data 128 x 128 8-bit/color RGBA non-interlaced"- [targetUID: N/A] "1FPNULrhhBJ_1_.css" has type "ASCII text with very long lines"- [targetUID: N/A] "M08arqdo_nN_1_.js" has type "ASCII text with very long lines"- [targetUID: N/A] "EQ0cyse2DGv_1_.css" has type "ASCII text with very long lines"- [targetUID: N/A] "24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA]- [targetUID: 00000000-00003812] "CbM6CZG2ZAb_1_.js" has type "ASCII text with very long lines"- [targetUID: N/A] "www.facebook_1_.xml" has type "ASCII text with very long lines with no line terminators"- [targetUID: N/A] "favicon_1_.ico" has type "MS Windows icon resource - 1 icon 16x16 32 bits/pixel"- [targetUID: N/A] "3FPJ9YC_wUr_1_.js" has type "ASCII text with very long lines"- [targetUID: N/A] "Vlv1mM1xMEH_1_.css" has type "ASCII text with very long lines"- [targetUID: N/A] "4748633DC5731827D4B432DBAC7A3ECE" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\4748633DC5731827D4B432DBAC7A3ECE]- [targetUID: 00000000-00003812] "CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA]- [targetUID: 00000000-00003812] "v75M7CPu9-P_1_.js" has type "C source ASCII text"- [targetUID: N/A] "VUQHIPEV.txt" has type "ASCII text"- Location: [%APPDATA%\Microsoft\Windows\Cookies\VUQHIPEV.txt]- [targetUID: 00000000-00001356] "E87CE99F124623F95572A696C80EFCAF_9FBD3BA6168F3C4317F2AAB1E548FE96" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\E87CE99F124623F95572A696C80EFCAF_9FBD3BA6168F3C4317F2AAB1E548FE96]- [targetUID: 00000000-00003812] "35DDEDF268117918D1D277A171D8DF7B_CEEA988A949E786F186C7AE5E6F84BAD" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\35DDEDF268117918D1D277A171D8DF7B_CEEA988A949E786F186C7AE5E6F84BAD]- [targetUID: 00000000-00003392] "80237EE4964FC9C409AAF55BF996A292_D46D6FA25B74360E1349F9015B5CCE53" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\80237EE4964FC9C409AAF55BF996A292_D46D6FA25B74360E1349F9015B5CCE53]- [targetUID: 00000000-00003264] "E2C6CBAF0AF08CF203BA74BF0D0AB6D5_0FB9553B978E7F00C6B2309507DEB64A" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_0FB9553B978E7F00C6B2309507DEB64A]- [targetUID: 00000000-00003264] "80237EE4964FC9C409AAF55BF996A292_C5130A0BDC8C859A2757D77746C10868" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\80237EE4964FC9C409AAF55BF996A292_C5130A0BDC8C859A2757D77746C10868]- [targetUID: 00000000-00003264] "F07644E38ED7C9F37D11EEC6D4335E02_EC50BC49A28D68A36F5274F1BD1417C1" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\F07644E38ED7C9F37D11EEC6D4335E02_EC50BC49A28D68A36F5274F1BD1417C1]- [targetUID: 00000000-00001356] "F2DDCD2B5F37625B82E81F4976CEE400_BFB422D89E28A298A60024A8D8A2EA06" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\F2DDCD2B5F37625B82E81F4976CEE400_BFB422D89E28A298A60024A8D8A2EA06]- [targetUID: 00000000-00001356] "7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776]- [targetUID: 00000000-00003812] "35DDEDF268117918D1D277A171D8DF7B_8F4E63DF7A6F59A07180A072992A7C81" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\35DDEDF268117918D1D277A171D8DF7B_8F4E63DF7A6F59A07180A072992A7C81]- [targetUID: 00000000-00003392] "EDC238BFF48A31D55A97E1E93892934B_C20E0DA2D0F89FE526E1490F4A2EE5AB" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\EDC238BFF48A31D55A97E1E93892934B_C20E0DA2D0F89FE526E1490F4A2EE5AB]- [targetUID: 00000000-00003392] "LDFDUeRDitE_1_.js" has type "ASCII text"- [targetUID: N/A] "68PY1XKX.txt" has type "ASCII text"- Location: [%APPDATA%\Microsoft\Windows\Cookies\68PY1XKX.txt]- [targetUID: 00000000-00003264] "-EdnrNYFrJy_1_.js" has type "ASCII text with very long lines"- [targetUID: N/A] "dXk5exdOVhk_1_.js" has type "ASCII text with very long lines"- [targetUID: N/A] "35DDEDF268117918D1D277A171D8DF7B_CEEA988A949E786F186C7AE5E6F84BAD" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\MetaData\35DDEDF268117918D1D277A171D8DF7B_CEEA988A949E786F186C7AE5E6F84BAD]- [targetUID: 00000000-00003392] "E2C6CBAF0AF08CF203BA74BF0D0AB6D5_0FB9553B978E7F00C6B2309507DEB64A" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_0FB9553B978E7F00C6B2309507DEB64A]- [targetUID: 00000000-00003264] "35DDEDF268117918D1D277A171D8DF7B_8F4E63DF7A6F59A07180A072992A7C81" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\MetaData\35DDEDF268117918D1D277A171D8DF7B_8F4E63DF7A6F59A07180A072992A7C81]- [targetUID: 00000000-00003392] "80237EE4964FC9C409AAF55BF996A292_D46D6FA25B74360E1349F9015B5CCE53" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\MetaData\80237EE4964FC9C409AAF55BF996A292_D46D6FA25B74360E1349F9015B5CCE53]- [targetUID: 00000000-00003264] "80237EE4964FC9C409AAF55BF996A292_C5130A0BDC8C859A2757D77746C10868" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\MetaData\80237EE4964FC9C409AAF55BF996A292_C5130A0BDC8C859A2757D77746C10868]- [targetUID: 00000000-00003264] "24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA]- [targetUID: 00000000-00003812] "E87CE99F124623F95572A696C80EFCAF_9FBD3BA6168F3C4317F2AAB1E548FE96" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\MetaData\E87CE99F124623F95572A696C80EFCAF_9FBD3BA6168F3C4317F2AAB1E548FE96]- [targetUID: 00000000-00003812] "F2DDCD2B5F37625B82E81F4976CEE400_BFB422D89E28A298A60024A8D8A2EA06" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\MetaData\F2DDCD2B5F37625B82E81F4976CEE400_BFB422D89E28A298A60024A8D8A2EA06]- [targetUID: 00000000-00001356] "F07644E38ED7C9F37D11EEC6D4335E02_EC50BC49A28D68A36F5274F1BD1417C1" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\MetaData\F07644E38ED7C9F37D11EEC6D4335E02_EC50BC49A28D68A36F5274F1BD1417C1]- [targetUID: 00000000-00001356] "7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776]- [targetUID: 00000000-00003812] "EDC238BFF48A31D55A97E1E93892934B_C20E0DA2D0F89FE526E1490F4A2EE5AB" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\MetaData\EDC238BFF48A31D55A97E1E93892934B_C20E0DA2D0F89FE526E1490F4A2EE5AB]- [targetUID: 00000000-00003392] "CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\MetaData\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA]- [targetUID: 00000000-00003812] "PMAPMLXD.txt" has type "ASCII text"- Location: [%APPDATA%\Microsoft\Windows\Cookies\PMAPMLXD.txt]- [targetUID: 00000000-00001356] "8D6SMO91.txt" has type "ASCII text"- Location: [%APPDATA%\Microsoft\Windows\Cookies\8D6SMO91.txt]- [targetUID: 00000000-00003812] "css_2_.css" has type "ASCII text"- [targetUID: N/A] "57C8EDB95DF3F0AD4EE2DC2B8CFD4157" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157]- [targetUID: 00000000-00001356] "css_1_.css" has type "ASCII text"- [targetUID: N/A] "5PIMNQT1.txt" has type "ASCII text"- Location: [%APPDATA%\Microsoft\Windows\Cookies\5PIMNQT1.txt]- [targetUID: 00000000-00003392] "PUOX68ZA.txt" has type "ASCII text"- Location: [%APPDATA%\Microsoft\Windows\Cookies\PUOX68ZA.txt]- [targetUID: 00000000-00001356] "4SQUY4XE.txt" has type "ASCII text"- Location: [%APPDATA%\Microsoft\Windows\Cookies\4SQUY4XE.txt]- [targetUID: 00000000-00003812] "QJDEYBUQ.txt" has type "ASCII text"- Location: [%APPDATA%\Microsoft\Windows\Cookies\QJDEYBUQ.txt]- [targetUID: 00000000-00001356] "HKKNMIBT.htm" has type "gzip compressed data original size modulo 2^32 338"- Location: [%LOCALAPPDATA%\Microsoft\Windows\Temporary Internet Files\Content.IE5\QQW0X29Y\HKKNMIBT.htm]- [targetUID: 00000000-00001356] "K37XGSIA.txt" has type "ASCII text"- Location: [%APPDATA%\Microsoft\Windows\Cookies\K37XGSIA.txt]- [targetUID: 00000000-00001356] "99ND0231.txt" has type "ASCII text"- Location: [%APPDATA%\Microsoft\Windows\Cookies\99ND0231.txt]- [targetUID: 00000000-00001356] "USPTQI6Y.txt" has type "ASCII text"- Location: [%APPDATA%\Microsoft\Windows\Cookies\USPTQI6Y.txt]- [targetUID: 00000000-00001356] "18WJSOA9.txt" has type "ASCII text"- Location: [%APPDATA%\Microsoft\Windows\Cookies\18WJSOA9.txt]- [targetUID: 00000000-00003392] "70DAE932E3BCB3C00656A27B544BA9CA" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\MetaData\70DAE932E3BCB3C00656A27B544BA9CA]- [targetUID: 00000000-00001356] "C88418EDBE65AF3960916D9E8011370D" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\MetaData\C88418EDBE65AF3960916D9E8011370D]- [targetUID: 00000000-00003812] "4748633DC5731827D4B432DBAC7A3ECE" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\MetaData\4748633DC5731827D4B432DBAC7A3ECE]- [targetUID: 00000000-00003812] "XKM2W2DO.txt" has type "ASCII text"- Location: [%APPDATA%\Microsoft\Windows\Cookies\XKM2W2DO.txt]- [targetUID: 00000000-00003812] "H70RS74R.txt" has type "ASCII text"- Location: [%APPDATA%\Microsoft\Windows\Cookies\H70RS74R.txt]- [targetUID: 00000000-00003264] "B45SFX54.txt" has type "ASCII text"- Location: [%APPDATA%\Microsoft\Windows\Cookies\B45SFX54.txt]- [targetUID: 00000000-00001356] "XXW3FBK6.txt" has type "ASCII text"- Location: [%APPDATA%\Microsoft\Windows\Cookies\XXW3FBK6.txt]- [targetUID: 00000000-00001356] "3JJI1END.txt" has type "ASCII text"- Location: [%APPDATA%\Microsoft\Windows\Cookies\3JJI1END.txt]- [targetUID: 00000000-00003392] "BLEZPCEQ.txt" has type "ASCII text"- Location: [%APPDATA%\Microsoft\Windows\Cookies\BLEZPCEQ.txt]- [targetUID: 00000000-00003264] "ZW9XC0AI.txt" has type "ASCII text"- Location: [%APPDATA%\Microsoft\Windows\Cookies\ZW9XC0AI.txt]- [targetUID: 00000000-00001356] "HUTXH4Z8.txt" has type "ASCII text"- Location: [%APPDATA%\Microsoft\Windows\Cookies\HUTXH4Z8.txt]- [targetUID: 00000000-00003264] "O7nelmd9XSI_1_.png" has type "PNG image data 1 x 1 1-bit colormap non-interlaced"- [targetUID: N/A] "NPYCW93G.txt" has type "ASCII text"- Location: [%APPDATA%\Microsoft\Windows\Cookies\NPYCW93G.txt]- [targetUID: 00000000-00003264] "bscframe_1_.htm" has type "HTML document ASCII text with no line terminators"- [targetUID: N/A] "rise131M9Asphalt.tmp" has type "ASCII text with no line terminators"- Location: [%TEMP%\rise131M9Asphalt.tmp]- [targetUID: 00000000-00001484] "FANBooster131.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\FANBooster131\FANBooster131.exe]- [targetUID: 00000000-00001484] "OfficeTrackerNMP131.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%ALLUSERSPROFILE%\OfficeTrackerNMP131\OfficeTrackerNMP131.exe]- [targetUID: 00000000-00001484] "MaxLoonaFest131.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%LOCALAPPDATA%\MaxLoonaFest131\MaxLoonaFest131.exe]- [targetUID: 00000000-00001484]49:T974,"d470377f9b683b10aa2230b05a5fcdcd.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: ""; Value: "") "d470377f9b683b10aa2230b05a5fcdcd.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SAFEBOOT\OPTION"; Key: ""; Value: "") "d470377f9b683b10aa2230b05a5fcdcd.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SRP\GP\DLL"; Key: ""; Value: "") "d470377f9b683b10aa2230b05a5fcdcd.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "d470377f9b683b10aa2230b05a5fcdcd.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "d470377f9b683b10aa2230b05a5fcdcd.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\SIDEBYSIDE\ASSEMBLYSTORAGEROOTS"; Key: ""; Value: "") "d470377f9b683b10aa2230b05a5fcdcd.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS"; Key: ""; Value: "") "d470377f9b683b10aa2230b05a5fcdcd.exe" (Access type: "OPEN"; Path: "HKCU\CONTROL PANEL\DESKTOP\MUICACHED\MACHINELANGUAGECONFIGURATION"; Key: ""; Value: "") "d470377f9b683b10aa2230b05a5fcdcd.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\MUI\SETTINGS"; Key: ""; Value: "") "d470377f9b683b10aa2230b05a5fcdcd.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\CONTROL PANEL\DESKTOP"; Key: ""; Value: "") "d470377f9b683b10aa2230b05a5fcdcd.exe" (Access type: "OPEN"; Path: "HKCU\CONTROL PANEL\DESKTOP\LANGUAGECONFIGURATION"; Key: ""; Value: "") "d470377f9b683b10aa2230b05a5fcdcd.exe" (Access type: "OPEN"; Path: "HKCU\CONTROL PANEL\DESKTOP"; Key: ""; Value: "") "d470377f9b683b10aa2230b05a5fcdcd.exe" (Access type: "OPEN"; Path: "HKCU\CONTROL PANEL\DESKTOP\MUICACHED"; Key: ""; Value: "") "d470377f9b683b10aa2230b05a5fcdcd.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: ""; Value: "") "d470377f9b683b10aa2230b05a5fcdcd.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\SIDEBYSIDE"; Key: ""; Value: "") "d470377f9b683b10aa2230b05a5fcdcd.exe" (Access type: "OPEN"; Path: "HKLM"; Key: ""; Value: "") "d470377f9b683b10aa2230b05a5fcdcd.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\DIAGNOSTICS"; Key: ""; Value: "")4a:T681,"schtasks.exe" (Access type: "OPEN"; Path: "HKCU\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}"; Key: ""; Value: "") "schtasks.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}"; Key: ""; Value: "") "schtasks.exe" (Access type: "OPEN"; Path: "HKCU\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\TREATAS"; Key: ""; Value: "") "schtasks.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\TREATAS"; Key: ""; Value: "") "schtasks.exe" (Access type: "OPEN"; Path: "HKCU\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\PROGID"; Key: ""; Value: "") "schtasks.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\PROGID"; Key: ""; Value: "") "schtasks.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\PROGID"; Key: ""; Value: "") "schtasks.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}"; Key: ""; Value: "") "schtasks.exe" (Access type: "OPEN"; Path: "HKCU\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\INPROCSERVER32"; Key: ""; Value: "") "schtasks.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\INPROCSERVER32"; Key: ""; Value: "") "schtasks.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\INPROCSERVER32"; Key: "INPROCSERVER32"; Value: "") "schtasks.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\INPROCSERVER32"; Key: ""; Value: "")4b:Te12,"d470377f9b683b10aa2230b05a5fcdcd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "CWDILLEGALINDLLSEARCH"; Value: "") "d470377f9b683b10aa2230b05a5fcdcd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED"; Value: "") "d470377f9b683b10aa2230b05a5fcdcd.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS"; Key: "SHOWDEBUGINFO"; Value: "") "d470377f9b683b10aa2230b05a5fcdcd.exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP"; Key: "PREFERREDUILANGUAGES"; Value: "") "d470377f9b683b10aa2230b05a5fcdcd.exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP\MUICACHED"; Key: "MACHINEPREFERREDUILANGUAGES"; Value: "") "d470377f9b683b10aa2230b05a5fcdcd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: "COMPATDLL"; Value: "") "d470377f9b683b10aa2230b05a5fcdcd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: "00060101.00060101"; Value: "") "d470377f9b683b10aa2230b05a5fcdcd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: ""; Value: "") "d470377f9b683b10aa2230b05a5fcdcd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\SIDEBYSIDE"; Key: "PREFEREXTERNALMANIFEST"; Value: "") "d470377f9b683b10aa2230b05a5fcdcd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "SAFEDLLSEARCHMODE"; Value: "") "d470377f9b683b10aa2230b05a5fcdcd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\GRE_INITIALIZE"; Key: "DISABLEMETAFILES"; Value: "") "d470377f9b683b10aa2230b05a5fcdcd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\COMPATIBILITY32"; Key: "D470377F9B683B10AA2230B05A5FCDCD"; Value: "") "d470377f9b683b10aa2230b05a5fcdcd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINDOWS"; Key: "LOADAPPINIT_DLLS"; Value: "") "d470377f9b683b10aa2230b05a5fcdcd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE"; Key: "PAGEALLOCATORUSESYSTEMHEAP"; Value: "") "d470377f9b683b10aa2230b05a5fcdcd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE"; Key: "PAGEALLOCATORSYSTEMHEAPISPRIVATE"; Value: "") "d470377f9b683b10aa2230b05a5fcdcd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\WINDOWS ERROR REPORTING\WMR"; Key: "DISABLE"; Value: "") "d470377f9b683b10aa2230b05a5fcdcd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\SETUP"; Key: "SOURCEPATH"; Value: "") "d470377f9b683b10aa2230b05a5fcdcd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION"; Key: "DEVICEPATH"; Value: "") "d470377f9b683b10aa2230b05a5fcdcd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US"; Value: "") "d470377f9b683b10aa2230b05a5fcdcd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US"; Value: "") "d470377f9b683b10aa2230b05a5fcdcd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\DATACOLLECTION"; Key: "COMMERCIALDATAOPTIN"; Value: "") "d470377f9b683b10aa2230b05a5fcdcd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "PENDINGFILERENAMEOPERATIONS"; Value: "")4c:T95a,"d470377f9b683b10aa2230b05a5fcdcd.exe" trying to touch file "C:\Windows\SYSTEM32\sechost.dll" "d470377f9b683b10aa2230b05a5fcdcd.exe" trying to touch file "C:\d470377f9b683b10aa2230b05a5fcdcd.exe.Local\" "d470377f9b683b10aa2230b05a5fcdcd.exe" trying to touch file "C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18837_none_41e855142bd5705d" "d470377f9b683b10aa2230b05a5fcdcd.exe" trying to touch file "C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18837_none_41e855142bd5705d\COMCTL32.dll" "d470377f9b683b10aa2230b05a5fcdcd.exe" trying to touch file "C:\Cabinet.dll" "d470377f9b683b10aa2230b05a5fcdcd.exe" trying to touch file "C:\Windows\system32\Cabinet.dll" "d470377f9b683b10aa2230b05a5fcdcd.exe" trying to touch file "C:\VERSION.dll" "d470377f9b683b10aa2230b05a5fcdcd.exe" trying to touch file "C:\Windows\system32\VERSION.dll" "d470377f9b683b10aa2230b05a5fcdcd.exe" trying to touch file "C:\Windows\system32\apphelp.dll" "d470377f9b683b10aa2230b05a5fcdcd.exe" trying to touch file "C:\Windows\AppPatch\sysmain.sdb" "d470377f9b683b10aa2230b05a5fcdcd.exe" trying to touch file "C:\Windows\AppPatch\AcLayers.DLL" "d470377f9b683b10aa2230b05a5fcdcd.exe" trying to touch file "C:\SspiCli.dll" "d470377f9b683b10aa2230b05a5fcdcd.exe" trying to touch file "C:\Windows\system32\SspiCli.dll" "d470377f9b683b10aa2230b05a5fcdcd.exe" trying to touch file "C:\WINSPOOL.DRV" "d470377f9b683b10aa2230b05a5fcdcd.exe" trying to touch file "C:\Windows\system32\WINSPOOL.DRV" "d470377f9b683b10aa2230b05a5fcdcd.exe" trying to touch file "C:\MPR.dll" "d470377f9b683b10aa2230b05a5fcdcd.exe" trying to touch file "C:\Windows\system32\MPR.dll" "d470377f9b683b10aa2230b05a5fcdcd.exe" trying to touch file "C:\Windows\AppPatch\AcGenral.DLL" "d470377f9b683b10aa2230b05a5fcdcd.exe" trying to touch file "C:\UxTheme.dll" "d470377f9b683b10aa2230b05a5fcdcd.exe" trying to touch file "C:\Windows\system32\UxTheme.dll" "d470377f9b683b10aa2230b05a5fcdcd.exe" trying to touch file "C:\WINMM.dll" "d470377f9b683b10aa2230b05a5fcdcd.exe" trying to touch file "C:\Windows\system32\WINMM.dll" "d470377f9b683b10aa2230b05a5fcdcd.exe" trying to touch file "C:\samcli.dll" "d470377f9b683b10aa2230b05a5fcdcd.exe" trying to touch file "C:\Windows\system32\samcli.dll" "d470377f9b683b10aa2230b05a5fcdcd.exe" trying to touch file "C:\MSACM32.dll"4d:T497,"5cN0su3.exe" trying to access LNK file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\FANBOOSTER131.LNK" "5cN0su3.exe" trying to access LNK file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\FANBooster131.lnk" "5cN0su3.exe" trying to access LNK file "%APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\FANBOOSTER131.LNK" "5cN0su3.exe" trying to access LNK file "%APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\FANBooster131.lnk" "powershell.exe" trying to access LNK file "\Device\HarddiskVolume2\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk" "powershell.exe" trying to access LNK file "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk" "powershell.exe" trying to access LNK file "Z:\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk" "powershell.exe" trying to access LNK file "%ALLUSERSPROFILE%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk"4e:T890,"d470377f9b683b10aa2230b05a5fcdcd.exe" trying to access non-existent file "C:\Cabinet.dll" "d470377f9b683b10aa2230b05a5fcdcd.exe" trying to access non-existent file "C:\VERSION.dll" "d470377f9b683b10aa2230b05a5fcdcd.exe" trying to access non-existent file "C:\SspiCli.dll" "d470377f9b683b10aa2230b05a5fcdcd.exe" trying to access non-existent file "C:\MPR.dll" "d470377f9b683b10aa2230b05a5fcdcd.exe" trying to access non-existent file "C:\UxTheme.dll" "d470377f9b683b10aa2230b05a5fcdcd.exe" trying to access non-existent file "C:\WINMM.dll" "d470377f9b683b10aa2230b05a5fcdcd.exe" trying to access non-existent file "C:\samcli.dll" "d470377f9b683b10aa2230b05a5fcdcd.exe" trying to access non-existent file "C:\MSACM32.dll" "d470377f9b683b10aa2230b05a5fcdcd.exe" trying to access non-existent file "C:\sfc.dll" "d470377f9b683b10aa2230b05a5fcdcd.exe" trying to access non-existent file "C:\sfc_os.DLL" "d470377f9b683b10aa2230b05a5fcdcd.exe" trying to access non-existent file "C:\dwmapi.dll" "d470377f9b683b10aa2230b05a5fcdcd.exe" trying to access non-existent file "C:\FLTLIB.DLL" "d470377f9b683b10aa2230b05a5fcdcd.exe" trying to access non-existent file "C:\Windows\system32\api-ms-win-core-fibers-l1-1-1.DLL" "d470377f9b683b10aa2230b05a5fcdcd.exe" trying to access non-existent file "C:\Windows\system32\api-ms-win-core-localization-l1-2-1.DLL" "d470377f9b683b10aa2230b05a5fcdcd.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP\cv7VU08.exe" "d470377f9b683b10aa2230b05a5fcdcd.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP\7gT2oH15.exe" "d470377f9b683b10aa2230b05a5fcdcd.exe" trying to access non-existent file "\Device\HarddiskVolume2\CABINET.DLL" "d470377f9b683b10aa2230b05a5fcdcd.exe" trying to access non-existent file "\Device\HarddiskVolume2\VERSION.DLL" "d470377f9b683b10aa2230b05a5fcdcd.exe" trying to access non-existent file "\Device\HarddiskVolume2\SSPICLI.DLL" "d470377f9b683b10aa2230b05a5fcdcd.exe" trying to access non-existent file "\Device\HarddiskVolume2\MPR.DLL" "d470377f9b683b10aa2230b05a5fcdcd.exe" trying to access non-existent file "\Device\HarddiskVolume2\UXTHEME.DLL"4f:T991,"d470377f9b683b10aa2230b05a5fcdcd.exe" trying to access non-existent file "C:\d470377f9b683b10aa2230b05a5fcdcd.exe.Local\" "d470377f9b683b10aa2230b05a5fcdcd.exe" trying to access non-existent file "C:\WINSPOOL.DRV" "d470377f9b683b10aa2230b05a5fcdcd.exe" trying to access non-existent file "C:\d470377f9b683b10aa2230b05a5fcdcd.exe.Config" "d470377f9b683b10aa2230b05a5fcdcd.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP" "d470377f9b683b10aa2230b05a5fcdcd.exe" trying to access non-existent file "\Device\HarddiskVolume2\D470377F9B683B10AA2230B05A5FCDCD.EXE.LOCAL" "d470377f9b683b10aa2230b05a5fcdcd.exe" trying to access non-existent file "\Device\HarddiskVolume2\WINSPOOL.DRV" "d470377f9b683b10aa2230b05a5fcdcd.exe" trying to access non-existent file "\Device\HarddiskVolume2\D470377F9B683B10AA2230B05A5FCDCD.EXE.CONFIG" "d470377f9b683b10aa2230b05a5fcdcd.exe" trying to access non-existent file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP" "cv7VU08.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP\cv7VU08.exe.Local\" "cv7VU08.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP\WINSPOOL.DRV" "cv7VU08.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP\cv7VU08.exe.Config" "cv7VU08.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP001.TMP" "cv7VU08.exe" trying to access non-existent file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP\CV7VU08.EXE.LOCAL" "cv7VU08.exe" trying to access non-existent file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP\WINSPOOL.DRV" "cv7VU08.exe" trying to access non-existent file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP\CV7VU08.EXE.CONFIG" "cv7VU08.exe" trying to access non-existent file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\IXP001.TMP" "Eh9VZ39.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP001.TMP\Eh9VZ39.exe.Local\" "Eh9VZ39.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP001.TMP\WINSPOOL.DRV" "Eh9VZ39.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP001.TMP\Eh9VZ39.exe.Config" "Eh9VZ39.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP002.TMP"50:T82e,Found http requests in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D" Found http requests in header "GET /gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D" Found http requests in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEATh56TcXPLzbcArQrhdFZ8%3D" Found http requests in header "GET /gtsr1/gtsr1.crl" Found http requests in header "GET /gts1c3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEGpYRvzN3kAuEMlMWsqSFLc%3D" Found http requests in header "GET /gtsr1/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBQwkcLWD4LqGJ7bE7B1XZsEbmfwUAQU5K8rJnEaK0gnhS9SZizv8IkTcT4CDQIDvFNZazTHGPUBUGY%3D" Found http requests in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTPJvUY%2Bsl%2Bj4yzQuAcL2oQno5fCgQUUWj%2FkK8CB3U8zNllZGKiErhZcjsCEA84b5kxAOGeKVwpjCxm%2Fyw%3D" Found http requests in header "GET /gts1c3/zdATt0Ex_Fk.crl" Found http requests in header "GET /gts1c3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEBZwXm7t3kKEEFjsmHQeLcQ%3D" Found http requests in header "GET /gts1c3/moVDfISia2k.crl" Found http requests in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTPJvUY%2Bsl%2Bj4yzQuAcL2oQno5fCgQUUWj%2FkK8CB3U8zNllZGKiErhZcjsCEAcpLgRNzv6uFuf5CFWQE%2F4%3D" Found http requests in header "GET /gts1c3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEDEixfO34qnbCeE6N8VMp00%3D" Found http requests in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAqvpsXKY8RRQeo74ffHUxc%3D" Found http requests in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D" Found http requests in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEA177el9ggmWelJjG4vdGL0%3D"51:T2d41,Found requests in header "GET / HTTP/1.1Accept: text/html, application/xhtml+xml, */*User-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateDNT: 1Host: accounts.google.comConnection: Keep-AliveAccept-Language: en-US"; in File: "SSL") Found requests in header "GET /ServiceLogin?passive=1209600&continue=https%3A%2F%2Faccounts.google.com%2F&followup=https%3A%2F%2Faccounts.google.com%2F HTTP/1.1Accept: text/html, application/xhtml+xml, */*User-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateDNT: 1Host: accounts.google.comCookie: __Host-GAPS=1:lcUVA0wwALlPRKSMLE4jF-2TT91ELg:CvJeG59YZvRr1bYgConnection: Keep-AliveAccept-Language: en-US"; in File: "SSL") Found requests in header "GET /InteractiveLogin?continue=https://accounts.google.com/&followup=https://accounts.google.com/&passive=1209600&ifkv=ASKXGp23SCdc4OCD0jBFEUnF-x89VrdyLY0d7q2NMtETpWmyaiaghK1E6hbDBI1n217-LpN4fy0d HTTP/1.1Accept: text/html, application/xhtml+xml, */*User-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateDNT: 1Host: accounts.google.comCookie: __Host-GAPS=1:7LN-76IDdZqyq11zU82F9wrYlsk6zw:aVADXywr0vjNOl4SConnection: Keep-AliveAccept-Language: en-US"; in File: "SSL") Found requests in header "GET /v3/signin/identifier?continue=https%3A%2F%2Faccounts.google.com%2F&followup=https%3A%2F%2Faccounts.google.com%2F&ifkv=ASKXGp3RjdA7K7Sa6-FuxZEeXd_cKeEoj56zJXyMzi4erkM9xog5caeEEEWOKWQm9bjuGZuxJfHYww&passive=1209600&flowName=GlifWebSignIn&flowEntry=ServiceLogin&dsh=S-2147220249%3A1703725525511524&theme=glif HTTP/1.1Accept: text/html, application/xhtml+xml, */*User-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateDNT: 1Host: accounts.google.comCookie: __Host-GAPS=1:7LN-76IDdZqyq11zU82F9wrYlsk6zw:aVADXywr0vjNOl4SConnection: Keep-AliveAccept-Language: en-US"; in File: "SSL") Found requests in header "GET /favicon.ico HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoHost: accounts.google.comDNT: 1Connection: Keep-AliveCookie: __Host-GAPS=1:7LN-76IDdZqyq11zU82F9wrYlsk6zw:aVADXywr0vjNOl4S"; in File: "SSL") Found requests in header "POST /v3/signin/_/AccountsSignInUi/data/batchexecute?rpcids=UEkKwb&source-path=%2Fv3%2Fsignin%2Fidentifier&f.sid=7575639068520443693&bl=boq_identityfrontendauthuiserver_20231210.08_p0&hl=en-US&_reqid=4295&rt=c HTTP/1.1Accept: */*X-Same-Domain: 1x-goog-ext-278367001-jspb: ["GlifWebSignIn"]x-goog-ext-391502476-jspb: ["S-2147220249:1703725525511524",null,null,"ASKXGp3RjdA7K7Sa6-FuxZEeXd_cKeEoj56zJXyMzi4erkM9xog5caeEEEWOKWQm9bjuGZuxJfHYww"]Content-Type: application/x-www-form-urlencoded;charset=utf-8Referer: https://accounts.google.com/Accept-Language: en-USAccept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoHost: accounts.google.comContent-Length: 166DNT: 1Connection: Keep-AliveCache-Control: no-cacheCookie: __Host-GAPS=1:7LN-76IDdZqyq11zU82F9wrYlsk6zw:aVADXywr0vjNOl4S; OTZ=7356971_52_52_123900_48_436380"; in File: "SSL") Found requests in header "GET /_/bscframe HTTP/1.1Accept: text/html, application/xhtml+xml, */*Referer: https://accounts.google.com/Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: accounts.google.comDNT: 1Connection: Keep-AliveCookie: __Host-GAPS=1:7LN-76IDdZqyq11zU82F9wrYlsk6zw:aVADXywr0vjNOl4S; OTZ=7356971_52_52_123900_48_436380"; in File: "SSL") Found requests in header "GET /generate_204?IbUO0w HTTP/1.1Accept: image/png, image/svg+xml, image/*;q=0.8, */*;q=0.5Referer: https://accounts.google.com/Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: accounts.google.comDNT: 1Connection: Keep-AliveCookie: __Host-GAPS=1:1mbRX0ReW3hHV_1C1zHv6Ytyy3y73A:YVQBYHJROSgFHoJ0; OTZ=7356971_52_52_123900_48_436380"; in File: "SSL") Found requests in header "GET /login HTTP/1.1Accept: text/html, application/xhtml+xml, */*Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: facebook.comDNT: 1Connection: Keep-Alive"; in File: "SSL") Found requests in header "GET /security/hsts-pixel.gif?c=5 HTTP/1.1Accept: image/png, image/svg+xml, image/*;q=0.8, */*;q=0.5Referer: https://www.facebook.com/loginAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateDNT: 1Host: fbsbx.comConnection: Keep-Alive"; in File: "SSL") Found requests in header "GET /supported_browsers?next_url=https%3A%2F%2Fwww.youtube.com%2F HTTP/1.1Accept: text/html, application/xhtml+xml, */*Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: www.youtube.comCookie: CONSENT=WP.2676baConnection: Keep-AliveDNT: 1"; in File: "SSL") Found requests in header "GET /img/desktop/supported_browsers/yt_logo_rgb_light.png HTTP/1.1Accept: image/png, image/svg+xml, image/*;q=0.8, */*;q=0.5Referer: https://www.youtube.com/supported_browsers?next_url=https%3A%2F%2Fwww.youtube.com%2FAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: www.youtube.comDNT: 1Connection: Keep-AliveCookie: VISITOR_INFO1_LIVE=pEG0eY8XeWI; CONSENT=WP.2676ba; hideBrowserUpgradeBox=true; YSC=pfjTfjWFe5A; VISITOR_PRIVACY_METADATA=CgJVUxIEGgAgDg%3D%3D"; in File: "SSL") Found requests in header "GET /img/desktop/supported_browsers/dinosaur.png HTTP/1.1Accept: image/png, image/svg+xml, image/*;q=0.8, */*;q=0.5Referer: https://www.youtube.com/supported_browsers?next_url=https%3A%2F%2Fwww.youtube.com%2FAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: www.youtube.comDNT: 1Connection: Keep-AliveCookie: VISITOR_INFO1_LIVE=pEG0eY8XeWI; CONSENT=WP.2676ba; hideBrowserUpgradeBox=true; YSC=pfjTfjWFe5A; VISITOR_PRIVACY_METADATA=CgJVUxIEGgAgDg%3D%3D"; in File: "SSL") Found requests in header "GET /img/desktop/supported_browsers/firefox.png HTTP/1.1Accept: image/png, image/svg+xml, image/*;q=0.8, */*;q=0.5Referer: https://www.youtube.com/supported_browsers?next_url=https%3A%2F%2Fwww.youtube.com%2FAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: www.youtube.comDNT: 1Connection: Keep-AliveCookie: VISITOR_INFO1_LIVE=pEG0eY8XeWI; CONSENT=WP.2676ba; hideBrowserUpgradeBox=true; YSC=pfjTfjWFe5A; VISITOR_PRIVACY_METADATA=CgJVUxIEGgAgDg%3D%3D"; in File: "SSL") Found requests in header "GET /img/desktop/supported_browsers/chrome.png HTTP/1.1Accept: image/png, image/svg+xml, image/*;q=0.8, */*;q=0.5Referer: https://www.youtube.com/supported_browsers?next_url=https%3A%2F%2Fwww.youtube.com%2FAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: www.youtube.comDNT: 1Connection: Keep-AliveCookie: VISITOR_INFO1_LIVE=pEG0eY8XeWI; CONSENT=WP.2676ba; hideBrowserUpgradeBox=true; YSC=pfjTfjWFe5A; VISITOR_PRIVACY_METADATA=CgJVUxIEGgAgDg%3D%3D"; in File: "SSL") Found requests in header "GET /img/desktop/supported_browsers/opera.png HTTP/1.1Accept: image/png, image/svg+xml, image/*;q=0.8, */*;q=0.5Referer: https://www.youtube.com/supported_browsers?next_url=https%3A%2F%2Fwww.youtube.com%2FAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: www.youtube.comDNT: 1Connection: Keep-AliveCookie: VISITOR_INFO1_LIVE=pEG0eY8XeWI; CONSENT=WP.2676ba; hideBrowserUpgradeBox=true; YSC=pfjTfjWFe5A; VISITOR_PRIVACY_METADATA=CgJVUxIEGgAgDg%3D%3D"; in File: "SSL") Found requests in header "GET /img/desktop/supported_browsers/edgium.png HTTP/1.1Accept: image/png, image/svg+xml, image/*;q=0.8, */*;q=0.5Referer: https://www.youtube.com/supported_browsers?next_url=https%3A%2F%2Fwww.youtube.com%2FAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: www.youtube.comDNT: 1Connection: Keep-AliveCookie: VISITOR_INFO1_LIVE=pEG0eY8XeWI; CONSENT=WP.2676ba; hideBrowserUpgradeBox=true; YSC=pfjTfjWFe5A; VISITOR_PRIVACY_METADATA=CgJVUxIEGgAgDg%3D%3D"; in File: "SSL") Found requests in header "GET /favicon.ico HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoHost: www.youtube.comDNT: 1Connection: Keep-AliveCookie: VISITOR_INFO1_LIVE=pEG0eY8XeWI; CONSENT=WP.2676ba; hideBrowserUpgradeBox=true; YSC=pfjTfjWFe5A; VISITOR_PRIVACY_METADATA=CgJVUxIEGgAgDg%3D%3D"; in File: "SSL") Found requests in header "GET /login HTTP/1.1Accept: text/html, application/xhtml+xml, */*Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateDNT: 1Connection: Keep-AliveHost: www.facebook.com"; in File: "SSL") Found requests in header "GET /css?family=YouTube+Sans:500 HTTP/1.1Accept: text/css, */*Referer: https://www.youtube.com/supported_browsers?next_url=https%3A%2F%2Fwww.youtube.com%2FAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: fonts.googleapis.comDNT: 1Connection: Keep-Alive"; in File: "SSL") Found requests in header "GET /s/roboto/v30/KFOmCnqEu92Fr1Mu4mxM.woff HTTP/1.1Accept: */*Referer: https://www.youtube.com/supported_browsers?next_url=https%3A%2F%2Fwww.youtube.com%2FAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoOrigin: https://www.youtube.comAccept-Encoding: gzip, deflateHost: fonts.gstatic.comDNT: 1Connection: Keep-Alive"; in File: "SSL") Found requests in header "GET /s/youtubesans/v23/Qw3hZQNGEDjaO2m6tqIqX5E-AVS5_rSejo46_PCTRspJ0OosolrBEJL3HMXfxQASluL2m_dANVawBpSF.woff HTTP/1.1Accept: */*Referer: https://www.youtube.com/supported_browsers?next_url=https%3A%2F%2Fwww.youtube.com%2FAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoOrigin: https://www.youtube.comAccept-Encoding: gzip, deflateHost: fonts.gstatic.comDNT: 1Connection: Keep-Alive"; in File: "SSL") Found requests in header "GET /s/roboto/v30/KFOlCnqEu92Fr1MmEU9fBBc-.woff HTTP/1.1Accept: */*Referer: https://www.youtube.com/supported_browsers?next_url=https%3A%2F%2Fwww.youtube.com%2FAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoOrigin: https://www.youtube.comAccept-Encoding: gzip, deflateHost: fonts.gstatic.comDNT: 1Connection: Keep-Alive"; in File: "SSL") Found requests in header "GET /s/roboto/v18/KFOlCnqEu92Fr1MmSU5fBBc-.woff HTTP/1.1Accept: */*Referer: https://accounts.google.com/Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoOrigin: https://accounts.google.comAccept-Encoding: gzip, deflateHost: fonts.gstatic.comDNT: 1Connection: Keep-Alive"; in File: "SSL") Found requests in header "GET /s/roboto/v18/KFOkCnqEu92Fr1MmgVxIIzQ.woff HTTP/1.1Accept: */*Referer: https://accounts.google.com/Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoOrigin: https://accounts.google.comAccept-Encoding: gzip, deflateHost: fonts.gstatic.comDNT: 1Connection: Keep-Alive"; in File: "SSL")52:T8431,"GET / HTTP/1.1Accept: text/html, application/xhtml+xml, */*User-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateDNT: 1Host: accounts.google.comConnection: Keep-AliveAccept-Language: en-US" "HTTP/1.1 302 Moved TemporarilyContent-Type: text/html; charset=UTF-8Strict-Transport-Security: max-age=31536000; includeSubDomainsSet-Cookie: __Host-GAPS=1:lcUVA0wwALlPRKSMLE4jF-2TT91ELg:CvJeG59YZvRr1bYg;Path=/;Expires=Sat, 27-Dec-2025 01:05:24 GMT;Secure;HttpOnly;Priority=HIGHX-Frame-Options: DENYContent-Security-Policy: script-src 'nonce-A1ZmcwKdJR3g7dY8gI87Kg' 'unsafe-inline' 'unsafe-eval';object-src 'none';base-uri 'self';report-uri /cspreportLocation: https://accounts.google.com/ServiceLogin?passive=1209600&continue=https%3A%2F%2Faccounts.google.com%2F&followup=https%3A%2F%2Faccounts.google.com%2FContent-Encoding: gzipDate: Thu, 28 Dec 2023 01:05:24 GMTExpires: Thu, 28 Dec 2023 01:05:24 GMTCache-Control: private, max-age=0X-Content-Type-Options: nosniffX-XSS-Protection: 1; mode=blockServer: GSEAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Transfer-Encoding: chunked" "GET /ServiceLogin?passive=1209600&continue=https%3A%2F%2Faccounts.google.com%2F&followup=https%3A%2F%2Faccounts.google.com%2F HTTP/1.1Accept: text/html, application/xhtml+xml, */*User-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateDNT: 1Host: accounts.google.comCookie: __Host-GAPS=1:lcUVA0wwALlPRKSMLE4jF-2TT91ELg:CvJeG59YZvRr1bYgConnection: Keep-AliveAccept-Language: en-US" "HTTP/1.1 302 FoundContent-Type: application/binarySet-Cookie: __Host-GAPS=1:7LN-76IDdZqyq11zU82F9wrYlsk6zw:aVADXywr0vjNOl4S; Expires=Sat, 27-Dec-2025 01:05:25 GMT; Path=/; Secure; HttpOnly; Priority=HIGHCache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Thu, 28 Dec 2023 01:05:25 GMTLocation: https://accounts.google.com/InteractiveLogin?continue=https://accounts.google.com/&followup=https://accounts.google.com/&passive=1209600&ifkv=ASKXGp23SCdc4OCD0jBFEUnF-x89VrdyLY0d7q2NMtETpWmyaiaghK1E6hbDBI1n217-LpN4fy0dStrict-Transport-Security: max-age=31536000; includeSubDomainsPermissions-Policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factor=*, ch-ua-platform=*, ch-ua-platform-version=*Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/AccountsSigninPassiveLoginHttp/cspreportContent-Security-Policy: script-src 'nonce-XfEuJyBFzhIjA84ky71JxQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/AccountsSigninPassiveLoginHttp/cspreport;worker-src 'self'Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factor, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionCross-Origin-Resource-Policy: cross-originCross-Origin-Opener-Policy: unsafe-noneServer: ESFContent-Length: 0X-XSS-Protection: 0X-Content-Type-Options: nosniffAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000" "GET /InteractiveLogin?continue=https://accounts.google.com/&followup=https://accounts.google.com/&passive=1209600&ifkv=ASKXGp23SCdc4OCD0jBFEUnF-x89VrdyLY0d7q2NMtETpWmyaiaghK1E6hbDBI1n217-LpN4fy0d HTTP/1.1Accept: text/html, application/xhtml+xml, */*User-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateDNT: 1Host: accounts.google.comCookie: __Host-GAPS=1:7LN-76IDdZqyq11zU82F9wrYlsk6zw:aVADXywr0vjNOl4SConnection: Keep-AliveAccept-Language: en-US" "HTTP/1.1 302 Moved TemporarilyContent-Type: text/html; charset=UTF-8X-Frame-Options: DENYCache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Thu, 28 Dec 2023 01:05:25 GMTLocation: https://accounts.google.com/v3/signin/identifier?continue=https%3A%2F%2Faccounts.google.com%2F&followup=https%3A%2F%2Faccounts.google.com%2F&ifkv=ASKXGp3RjdA7K7Sa6-FuxZEeXd_cKeEoj56zJXyMzi4erkM9xog5caeEEEWOKWQm9bjuGZuxJfHYww&passive=1209600&flowName=GlifWebSignIn&flowEntry=ServiceLogin&dsh=S-2147220249%3A1703725525511524&theme=glifStrict-Transport-Security: max-age=31536000; includeSubDomainsCross-Origin-Opener-Policy-Report-Only: same-origin; report-to="coop_gse_qebhlk"Content-Security-Policy: script-src 'nonce-O9VAaQI56Wdv3LkAtgEHQQ' 'unsafe-inline' 'unsafe-eval';object-src 'none';base-uri 'self';report-uri /cspreportContent-Security-Policy: require-trusted-types-for 'script';report-uri /cspreportReport-To: {"group":"coop_gse_qebhlk","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gse_qebhlk"}]}Content-Encoding: gzipX-Content-Type-Options: nosniffX-XSS-Protection: 1; mode=blockServer: GSEAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Transfer-Encoding: chunked" "0000000100000001�000000010000000100000001000000010000000100000001000000010000000100000001�00000001R00000001�00000001n00000001�00000001@0000000100000001}1�16c+�}�\�-�`]�%//��n^��+6}�Ivw朓��UL�Zj�D��]"�"�iN��E���dˌ��^��˸h��'�{��jǍ��_��UL�L��1W�Pٸ��<�'uV��(��OR��s%�2�q8�tb(�}BoYj��h�|��g/��B�$�T��g��ب��L��Bv��Q�w6��D��:�\�+@q�FgI��X��<4��S��{e�P�y�>��KA�&8\�ޡϲ�ʪ�:P4؇%��꼈�@E^��V��eQ�h�$Z\��4��P��Z��{3��?�r�" "GET /v3/signin/identifier?continue=https%3A%2F%2Faccounts.google.com%2F&followup=https%3A%2F%2Faccounts.google.com%2F&ifkv=ASKXGp3RjdA7K7Sa6-FuxZEeXd_cKeEoj56zJXyMzi4erkM9xog5caeEEEWOKWQm9bjuGZuxJfHYww&passive=1209600&flowName=GlifWebSignIn&flowEntry=ServiceLogin&dsh=S-2147220249%3A1703725525511524&theme=glif HTTP/1.1Accept: text/html, application/xhtml+xml, */*User-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateDNT: 1Host: accounts.google.comCookie: __Host-GAPS=1:7LN-76IDdZqyq11zU82F9wrYlsk6zw:aVADXywr0vjNOl4SConnection: Keep-AliveAccept-Language: en-US" "HTTP/1.1 200 OKContent-Type: text/html; charset=utf-8X-Frame-Options: DENYVary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Sitex-auto-login: realm=com.google&args=continue%3Dhttps://accounts.google.com/x-ua-compatible: IE=edgeCache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Thu, 28 Dec 2023 01:05:25 GMTStrict-Transport-Security: max-age=31536000; includeSubDomainsReport-To: {"group":"AccountsSignInUi","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/AccountsSignInUi"}]}Permissions-Policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factor=*, ch-ua-platform=*, ch-ua-platform-version=*Content-Security-Policy: script-src 'nonce-wfwZ5cniQ4_OL6xpr89lmw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /v3/signin/_/AccountsSignInUi/cspreport;worker-src 'self'Content-Security-Policy: require-trusted-types-for 'script';report-uri /v3/signin/_/AccountsSignInUi/cspreportCross-Origin-Resource-Policy: same-siteCross-Origin-Opener-Policy-Report-Only: same-origin; report-to="AccountsSignInUi"Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factor, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionContent-Encoding: gzipServer: ESFX-XSS-Protection: 0X-Content-Type-Options: nosniffAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Transfer-Encoding: chunked" "�i��0l}�/�q��?��/�yWd�%��}+裸�y�uy��F�� ]]ę3�^-��՛��4�u�R��b?~��*��>��v�x��aw��r��أ�2�#[`�b��" "00000001�00000001]00000001Y000001�cc0�6�+�ڗU��")i$��>��8>��xk�[y��M��sW��"W��hykS�dD��F��@7�m3��_��hW�O`|��DGUu[$��u6Z��o�K�+#l�q.t>#C?vЏp��~�$�[�T�`a�(��`5V�>��1]��5��U��"��5Vz�@�`HM�7RS�a�|�Ź M6��@�@�;9<��S:��B�ɬ�!�Z��RM�Խ��V(��,i�G��q��66��G��1�c�x`�"�.�(V��迵lT��A��궃��h�ι�P*��.0(�Ml�@SkB�cUٌ��+��A��-��z�O2�e($| ��4~��Whh�/��A�Մ�3��Oc2�M��t�F�N�3l�A��1��C�A?o�3qә8�>�^��ĩ+7�곿��F��J3�R�B^�8�Ȧ��#��5��W}f�PikyS�'<�=X�QP�+l�C)ʵy��С>��N��c��95�g��!��؟G��n��z�{��K��lG|t)VX��+��)��;'��k$x{T��K�:�Q�萍;�e��-*��̳��B�@�3�NR�T:��]��K�䲆X��!R��h��N[dR`;�xP;�.�߽��Ć��!o�?b�spy7IG� }��V��ҪĚJ8��NcC��COˍ�b5�|��=�[;��Hx�r�E%K�~B�v;�r�H��(�>��`��-��}*�1d��+��R�ј��2�]��֦T��F�R.?}n��Y؟��G��?�3��J��G�t��r�S;��Q��I�)¦��UN�*+�,ǠM��t��R��+=�r��y�T�xȖc�@��ךH�V��y��>E�5��~��f�g&r��h��L_�1@+��0|6j�oĔ��Pm��J��F�� v�d�oU>�R�E4G��`e�O��̩��K��t:�⾜N��ƃ��2Ԏ��ې9:��v�9 ��9>m�H�6�$�0j?��a8�"�mrB�I�0�|�1�P8*��\�q]�M��J6�>�<�H@f_��s�x��0@��vQ�Z�b�Y[�iEgQ�E�r<|��O; �\siU��1��cHZ�q��p�oC�Ҍ}uU��2�go�@Tx��\ռ/ɲ�p��&�zm��|�xf��${�VJ��Ǐ��?�b�Y5t/�|��*b�q ��5�\�&�+�qzu�Ϳ��}�}%]�G\�L#�p��Nn�4�)��&�I[�8@��|��x", "�U��`N�'��;�� 3�p:>�]ލ>�0��}3zp:p�B�-o^@PoH��F�8,��C��3`��^�Ċ�º�1:�t�p�On� ��4��?�Y�NP��0 ��9�C�!a#|&lH� lfn�45�VgF��"^�L�N�qȍG򷔏ܧu�N��u��a��<� ��A�t�ਦ�g��}�AȔ� Zt׃�Is#��f��=�<��ie�z��&X߾L��Il�.f;r��V(ۿ�l��|�R�N�a��99q+4��*0g��7C>�[��ۡy��h�[�FϢM�Ё҃yǌ4L�\�l��|[��_�i�;$��P��׭�ͱ�,U.gH0�+7�nP/��=ۀ�*��^��T��NX��0�c��/��YnPs��9�'��V��L�Ld΁��k05��c�j�~��OU�~�Qu�_U�~v�d�-jw9Q �{@Խ�D��@Խ��T�F_^��Ge0��", "00000001�00000001]00000001Y00000001s00000001�00000001H0000000100000001�00000001+00000001�00000001�00007f7*�Z�Ɔ��%��N��)��&� �8��+iFbF=��Y�P_�Mw�ս�<��ȀQ�u\X��c[�:�Z|�2�'�B�Ԭ�ɸk�V�w�muگ�k ,cqD��\!:�?e�EPCi:`F��,��+�$�΃bka��(��H�'��h��|�mPI��бL��/y��'!��9�:�sTu:��B��5�� w�oʜ!��r`E��d��Q�UhW��89�{sH�9�JN��Lt��U��^��J\8[��g烟�-��H~�2Y��Wv��!-��I?�"�gFV~ː��Ȭ��z�kTN�'�/�Gz;A�bV�:�OٰaL*��w�p�%�Hu˧�]�5tE�@��t�͚�Y�׫k�X%*iiE��ѯ1��_�4��$l{�ӑ��"�7Wߞ�,�Hay49L��B�(_��x�v~�vgv�E69�)C'G��#XTS[^TN�\O`a�*�C5�ɟ��ݛ��i.�Uf�v�ъ*-��F:�=��:�5�x&�[��i��b�")��=�iJm)$�I�]KS��U��RISL�a�瞦8��u�9��@.rXLS$œ��?M�-�D�"��ki�au��R�b@j#i�)=�c�� շ5��Wh��HR<��M�iJ��ҥ�i��Ri%�Î9��Sc��)��s�SW�:��S o��H�nG��H(_GH�Ω�A�HU$U�JU�@r6��,-��N �$+�l$�-��{@�0%h��p%3�H�T�qݭ�L{ZR�ͳ��uų��#F��M�!��(��?~��ߠ�8F?U�Fw?0��p/�u88^��\��G��㫿��؛⫁��ϟ�o��N��śq7��0sDV�M�$YI}�y��_�[��Z_b�z�Pa��:��8*�&��-sT4��d[u�۫��m�S�?a��8S�^7<��Fb�O1�U4��Jw��iͮ�g��~u��N�݋��ρ_mp��.~_�t_�T�6)w��'QQӝHhΕ�H� ��H��K?�`��|+f�$�2��s ��HOH�`�Y.��t��9�M@��b�SѵK��U�ytW��|�!�yt�" "%_�V%@��rs|$�i��M^��Y9�W�1#dy�6�<`oH��:�Ĉ��4��,��LQ�e��~��?Y��ݱ��UU=X��>M��}Ԝ��6�]yѺ��Cp�[<1�`��X&?��Oܝ;�h=]A_�:nq�//��\�-4�j��}��8��O��DO�f��|D7!a��7I��eMS��E�(�]l;��ʠ�D�U��'��j�L�ʢB��m��}\<��߫r��0ɇ�t��/��III)^�e��@�m"YH$U��n��ږ��H��k�2o��Eg�5춾��|�p�>��S=i�BVo�� ?T�X�l�G��QF��ɹ��\�y��z�8Ll�I��I�x�<��u_d9d�w��]��0�HCN��R譝�w"��:G��*Dݰ-V�o��E7q�R��T!Au��Q��8��X��", "00000001�00000001�00000001M00000001�00000001�0000000160000000100000001�00000001�01�66a^��"-`�z�HR )��kkw�u$�vҏ��J��,zD�Ո�!��9��"��5�}��M��њA޳.q�nkb:�Z7:�I�Of�L��7(�>�C4"Cr#!�T�T�V8R��sn�/CPː[��B��!�52��;��A�!C��dh�>��I !��%��a��C�P�c[��B��5~��;��A��7��f^��I !��*,��(Qw�o��o��{��9z�0@�� D7��o�fE��Z�&�"f3gfG��˗�k��(I�a$�%y�I_]�W��$Վ+N2\1KP˩[��B��$�5��;K��A�c�$ӱ\�4�wJk��f@�F�%�.�{N:Չj��5�;�U��M��L�OP˫[��B��$�5��;O��A�Y[f:�˖�D�Aْ��?�wH�$��%�)u62�-�[�N�-��X�-z�!s��`�[Bl�nn��-U͊ %��\�4��ʖ��-̀ؒ .�ڷH��k�}��!�R�{zx0@-�Bl�C!s��`�^Bl�nn�/U͊ ��%��xyZ0ˁ.�h��K��5��Ϥ�Ɐ��G�~Mo_ٛ��@��ަ��Tq�#�]E�(�RL��ֳ��;�(Mo_�Eڏ��@@/��TDr�w�C/u]}�sc�K�\l��%�Wpn_,��\��iN�Ry�sdMʻ�c]��~�W�[og�'�ʨ��Z/�WF�zȟ��X��C��37d%�G��JX�8�JX��JXo��V2��v0n0�4(�,-n��ĸ��-K��,1n �ĸ!�c�=x7��e�=�%ŌU�3TYZ�Hei1��ŌS�3LYZ�(u��|�]Dͯy s�㗫��\�X�*�G(W�=.��Up��S��YX�b�%�õ��p-f��7\��|�=m˾�J��o�/@", "��,�O0�K��mi��x8��`~�D��3L�w){L��#P44��õuU�l��_~z��P��.�[o��4y|2�ߦ��z8[��:S��m�z��j�8�I�� ;~^-e��FxXl��ҋ�2��aq=�T��^o6��y�=��ܥv�W�Y��d{��~� tM�4�Xm��X�x�盯�t�)�<��Q�d��M|�4;싾f�Ɋ��^��ɫ�7��W�"�b79]�*��:[��ӭ��zj�Lno4͌Kӧi零�k>{��_%�?��r�r�j'e�ם7!^8T��z��P��/��$/�:�-�2��_x��߿{��E�'�^��C��*1��" "00000001�00000001]00000001[00000001�00000001�0000000160000000100000001�00000001+00000001�00000001t00000001:00000001�00000001�00000001100000001�00001�7ed,,˾4��$M7Is�$y3Xt��Kl �L�{%߰��%��>-�ҹ��|G>��W��fh�ͮ��ݑ7��1�f��_ޙ�E�AG��̦��pLW��7�\�7��Z�~��,֫NO�1��@0u�qJG��S�M�-�^;��M�*l;#P;+4{@0��I�76?��}�wE�*�m�TmF��˖:f�<�F��98��S�&fG�I4��~QU~��끙��k��bC��jS%��$�f�߅�0��yO��y�H�Ц&O^��I��r��-N��t1Y��պ�:8v��=M?n}��*��2��!�J�*IG�demr�#)p��X:�-q0��M��UN�3��'��.r��uPM�N��6]~��jb�8!�z�F�fy��3d�C�]�"`�זܓskf8?��1�`M�^��Bà6(Ӻ^j$ܠ��$S'(�7l">P�EI�@%��܁�|�Zu�չ�Ts��|��r��o��wb[��m��L8�T�uK^J�a�j��y��_�ed|I,-)�KU��Z�k�^ߺ%^�0A�x� [I�o!^�T�Pͅ��ŤƂ��P[�ո�^�U��)� �=��B-��r؂7��\��u>U�<�E��C8X�u�k��H�K;ZS�x��4q�̲��3X�v`��ZzD�=R�D��~\i��ņ��z��i�Z�6�:�ĵ�Ÿ-p��@|��=FeJy��T�s�u)Ix~�g�'��P�$Ʊ��ӭ>7�{~�pw�.��UY -SHP h`�D]��:�:�N�/f��Y��e��+Qb�kA�f��z��/��h0�?F��i��J��ի7��̚w�ޚ��댾�-3#�u7��5�H:Rz}yk1��ӫ��'��r`oxu��51�լ;�޾��<�y��s)�� 8��u=f��~}z;~�7�o��V�}vG�5��B"E��)D4i��-{��Tb�/�&7��#m��PZ��p�DKTu��=q�U��δy�ی��q'!�17;��^n�/v%X&" "��g�|c��v��.�R��_�[a�v�.��'�~L� C��ʻ��q�^��*F�#<��+]�$-[�R��Ip+j��ҩe�#��gl��{d�{�z_�Xq�|��wR�3�~��_��\kl�,@g".��T&??b�� EKg�$�0"��]��R&a�i�c�.{�_��r�W*�%��/-�[��hS�~��4+�}��Ni�z��[�^��nK�o�_ҿ?��Lg��}�_�ݔF��ԘY��ѻ�x�Z(O˰��ǚr�8k=v��6Y��2<�s��6��T՛X/��W�tݵ35&$��z�B��9�|��4�͕�ȷeN#��9��Q�l�OZ]��kEcջl��Ћ��tG�ϡ��!��.�;��;�*�{��E��E��=sr�y��σ��gƜ��񺣨�g��񺣨�g"D�Q�x�QT�ǀo�*�KepU��1G�s��GD��R��g�R�_Ó򨐋D��\$��\$�/��x��O�\$��\$<5�"�%�"�!�.>�z��"M{�R`b�Г�58zB�I�7=!��g*��|�sGOH>�耣'$�t\��Έ�W�a�$A5�dQ�6A5�dQ�$A��AU��8/'`�L�R�s'qr��S�+��}��QKo'��aa�$t��@�$4� �$4D��$4p��$4�Ò��G@f�hZ_�Xs!�E8�N/��2[��>0��X�e(��X�e(HI�$c�5�h&c(c�5��'c(c�5��(c(c�5�/ O}�+8m��" "00000001�0000000100000001�00000001n00000001�00000001800000001�00000001W00000001�000000010000000100000001b00000001@00000001200000001$00000001�0000000100000001�1lc9f��i��i�I3�}�͉j��Hr��%#��I��fiZ��,}�k�6��z|V��,0��i��I��i�+��G`u��X�&��:B��\��U�iʄ5֭JLSSo�aҪ�45eЄB7��~:�A?��\Y��hj�!c��1��O��H�xAK�&V�M,�X�4�\�p5`;:~�c��Ep\�Q\/:w.P�L;�Ǐ��s~�y;�Ǜ��s~�x;�Ǜ��8�SpC��W2��ǎ��/T��/��&�D ��xAP$�[վ�6�3��~�nJ�~��4��-L-�j��y&�.��N:I�4�es��/�y��֧��)`ĩgXi-ߓ��j�yz�.��M�W�j"��+铤�0�/ە�l��d��Aq(�2�O�0dmxU\TN$Z0��O�e�`h� ��aF��.PU�/�cGQ`��\��̨˩g�S�j��*�1*=$�;��vT}"��'�?]W�~�`c7��2�q��z�WOFXc�!�[��;t�h��|>;��&��B;9�/4��?UHx�`�A��e8Ƞby84�@��Pp�z�|;��_t��[�9/\4]�.�l�O��*A9K�1F�~��@?��'�ވ2�<��n��:�rI��]8��?��f��>�n�X��<�3;��lM4�Gz�|2�F��[�$M�~swt�mø��'S�}�1c�1)W��"�@��s�_�Gk:�B�$[o%B@��(E�b��nm�@�R�-�0j��[�L$��Px��v�/�@,E��v�ef��)��T�׃y��G�@*d1J$KY:��vmjΎ��#ʘz3á3pR!KW�Y��'/��GѓH�&ă�#�0=�T�", "e��c@��֊��f��C��&Y �T�$[��pI�b)�x�G�V�1)E�%H�L�p(ě�6�`�ы�/�-�|�t�{uz�^�0H �8��G�P��M��֟暇�B&C8\L%K�l�G��tVAzqs��s>L)4B�v��L}<;r�oz!S�>�̈́�_R��1\]X4��pJ�8�4��"�kF/��z�B�9(�A�*�{G��i��y~U��$��5�Z//��OB�|��1��İ&�}q�(��׷KM�}8RN�-�󺤗�3�o�-�Y� ��`�?f�$�oJ'�z/"��neAD�ɥ�b|�."'9��ƞ4>�B�\�Q�I>��p�O?׮gΞ��3\F�;�r�$A��PEe�n~�}��'��}�G>l�l�@�G]�N�|��FF&a��+uƽ��!�q�~��i[y�Nc�f��%�g4��m��q�_�8;�$�[�!1��U>�[r��0Q�G��L�j;��Y�&ze�^{c��m�s��z힘��x�j�,��7�:7=QY�|ڕ��F�7��ɀ�,��/O`m$�El��9$��W��_�2��czH^��~m�Q�i��;Gyr5�2b�3��g��YM�&^�zZ�>��U��,CUd�d��v;��I�T@�v&�v$�&��KT��4��ߴ��":S��L{��&5�J��^� S]��wnX��3��vx<�e�\ӝl�}�0��Ƈ��+�1�Z�6�(ȉ� #|��SI+�q�]$�f�{��p�ҍ��<�*��y��A��Ƌ��8��%��R�ũZyg�d0m�f�@3�Ud1��cˇeꭤ9a9�n��x�E��wH�Bea�@�X>%Dr�ܑ�|P� ��F�ڕ9�w^n��2i%#!��'��11�Nu�Eb�ҝ��v��E/S�\�0f�ʼ�W�t�jNPY3,��_��NQ��|�`��O�Q: ��?K��ϊ��a֒��8_^��I��w�Ȝ/G�xT��{��î$�U��7dOB؆L,�V��4$�Ƥ3-�G1y�0��\T��J;��/��?9�^��K��owQ#�"�"fψ�d��Ml��b7��@;�Uq%U8^��]-2E��a��VE\n� b�#��:�j��UI��Y��,Ǳ!lQ��Q\��&��s��.��H#��uU�t��5U�|a�T2��Y4�:H�"�.�!�b#�]�V�5�6��OK��gI��i�q~3ZR��ۑ�;u*?_o��O�@�}M��0��X%��QTT_�@��yb�ڦ��V�;p[��?��Q��*k+}�"R��I�V2��ۂk|�G�ş�w숞��g�e�޾VMMT�g�p�:�Í$y��`,�Q9�?��1��{R��X�|��"�X��N�_N�t]4��~��<��j3+��L�XM��(�S�7��", "00000001�0000000100000001k00000001o0000000100000001G00000001�00000001�00000001X00000001H00000001H00000001I00000001900000001�001�99c�'Q�R��J�Z�⃉�`ab�A��ݻ��>of_v�|��cfv{3��3��V��)��T;l��7�+2��+?�/W��ź�Gv��l/��_g9km��dY4ѓY�J8bތ��QSס�}�{1�W�OϟMo�B�4�W̹�j�7}*u��r�e�CB��`��ʆ��/��D\>��vҎ~�Q��l$�@��gz�bYe�47��@��4�2�A��MxX�F�N��P$��=;<��+��ˋ۽�y=�X��AX]ru��L��M��@P�M�G��;^��N�Jb�ΙӖbn��g�6��i�.hx��K��6�^yQ��mЦ��--��UWoDq�_�r�G�z�0C��(��5�@L�V>[�:�(�UÈ�>!]S�?ʀ?4n�h�ܠ�X�L��r'�:��{5&N\�3)�s�Yyn�fW��+LH��s�D�G�w�}mE�=��g��E�t��T�7��O�0��%z�[�%��6��(P�ES�y�=d^��kK�qEm�5�Ghg�:b�#t�a�|�]��/�ac��X��4N��~��`vH��$��%��T6��Z��֊|I�Kj�b:��dy�5�V�M��$��p)5]9��\ [#�jTi=��L�m��n1"��삩<�-S��7��x��{��*MIl�J�W�w�*]�]+K�Ho�f��ӳ��>m�D��J_�W�~�&�J��|��|��N��U�a�~]/��/�uf�S�-U��f�L�-�.��\�R�ѥ�h��1Ǭy�qz��V7�LT��d*�d�q��n�Ґ�NW�V�n��*��,�*"M�Lwy>?��U�Ua�ʀ��~6�!��ͳ�&��7�-��N��u��h;yNT�`��|�N�ݢ�s��Y��I&�_|Ii�o�gB�K��T�M��s�[��"��*�Q×�vP��rH��yJz�HE�UO��'+$�g?%��DxO$R�1�*p�?cy�i��n��rO��f��{�G��㟦�_N�|�xL��g˓�u��G۳>׏��n4��[��y�j��Qpj��V��Z" "L[mY�E��L�E�r6�0��y�mL�6��%�r�-oR��")��h��|�+�ͣQ��7/�؄|�f�ݚ�o��{�&ݛ8�*G&�'L9�S��n]�XӚ�^مFe'��6eUo��Feb��b|�skT��m�r�6eq�&e��g�Fe:�6e@��8؊6e��;á��jc3� ��p��/�a�қه��I��Ѻ��6�ɺQ�hS��|K�iw%.+��~�:�}��1+�.RU�L�vu��f�5��0�HW��5�3�uY>#]��ʍj�)g��@K�yB�:p®\:�M�9S��b��n��O��ٽw��3\�P��nX(T�b��B,��J��=h��Ț[m#rbם��g��[2Zv��Zx�J�}4�&��E�@�E�Q��ėi��t@yN@u��e`�o��n��҃Z;��]`E`��&bҏ�!H~8@^�a�8V{�}�S#��C��F��Y+��!Q]�rj+5��>H��O�d��> ��W1=�SrJ�[��[��.��O��P��@Ci��>_�>��'A�x��>L;�՗Π�뒶�M�.�O�ɑ��ܽ�On�7��|3�W��>>��Y~uSX)��eći:��z�L��oTZ�6��0M��dH�B}��?<[7�Arp�dtK��! �F��.r��H54��l"FX�Bs��<`dʝ��(�ɻ��\#�@2��Ջ�h�$)s2��^��4�Ns�_�8(�/B�i�{�0ɲARp��|/�1�y�aOn+[/��S�b(Ɏ��mw�>��,<��-�C��u�;��Wo��7�� Q16��'�ղ噪98(�S��Y��Z�#��S8�pN�Dp R��HJ'�d�(��lc\��9'>��b��B52SPQ��B��_�(�\��n!y�{�7HǢ0�,{��i,٠��8�o��בn��2ڵ��c�"d��~8��^��G��;��Ն�7��U�אx^�'�ͩ�e��Bk�?�-`h��ٻ��4��i�.��?��нt?�H1k�['�~��;;�`Q�GI��puk��:��_��϶�#�F�wI㫄��C��", "�CS<�a9��V�o��r�ˇߪ}��$_�T-��0<�! ��Њ��wR�ɂW��6X��%87��h!��*zj^֙��`�MC�?��"53:T667d,Pattern match: "https://facebook.com/login" Pattern match: "https://www.youtube.com/" Pattern match: "https://accounts.google.com/" Heuristic match: "bT_.Tp" Heuristic match: "LO.rU" Heuristic match: "Nepp.gG" Pattern match: "http://www.w3.org/2000/svg" Pattern match: "https://www.facebook.com/legal/license/aJoeSHn7XcN/__d" Pattern match: "rsrc.php/v3/yB/r/TwAHgQi2ZPB.png" Pattern match: "http://crls.pki.goog/gts1c3/moVDfISia2k.crlA-W1c@uc*qxfO%U3g" Pattern match: "http://crls.pki.goog/gts1c3/zdATt0Ex_Fk.crlW.j`N9" Pattern match: "https://fonts.googleapis.com/css?family=YouTube+Sans:500" Pattern match: "rsrc.php/v3/yL/r/unHwF9CkMyM.png" Pattern match: "NOFORMmicrosoft.com/102433237894403108561027971357230938743SRCHUIDV=2&GUID=426377958C8445E3B4EA69482BD0E747&dmnchg=1microsoft.com/102433237894403108561027971357230938743SRCHUSRDOB=20220131microsoft.com/102433237894403108561027971357230938743SRCHHPGUSRSRCHL" Pattern match: "921732269185283111490785266324931078690CONSENTWP.2676bayoutube.com/102431383388163210825482504061830633367hideBrowserUpgradeBoxtrueyoutube.com/921710698338563108151484341524731078690VISITOR_PRIVACY_METADATACgJVUxIEGgAgDg%3D%3Dyoutube.com/921732269185283111" Pattern match: "https://fonts.gstatic.com/s/roboto/v30/KFOmCnqEu92Fr1Mu4mxM.woff" Pattern match: "https://fonts.google.com/license/googlerestricted@font-face" Pattern match: "0gyISezr3jNBHdgGi..BljMnU.9a.AAA.0.0.BljMnU.AWXaHEwWV0gfacebook.com/92173639812608310968021106147299310786901MmMZepfKijxu-2KmG20DpAkfacebook.com/921788929945631159164112386330231078690_js_datr1MmMZc7ONWcWzsPuflRNWIYMfacebook.com/108926390378243115915614790" Pattern match: "MUIDB00CC41C36F676EA416CC52366E2B6F80www.msn.com/9216282349900831157152182809166531078691sptmarketen-us||us|en-us|en-us|en||RefA=A9A058FB33F8451FA98CC18C8FB8CE1C.RefC=2023-12-28T01:06:10Zwww.msn.com/102465692800031225750183655966631078691" Pattern match: "921732269185283111490785266324931078690CONSENTWP.2676bayoutube.com/102431383388163210825482504061830633367hideBrowserUpgradeBoxtrueyoutube.com/921710698338563108151484341524731078690" Pattern match: "-phkgoogle.com/9217128667174431115511250122847831078690" Pattern match: "aVADXywr0vjNOl4Saccounts.google.com/92173790321792312255481151607308310786907356971_52_52_123900_48_436380accounts.google.com/1089158984640031084725171865171131078690" Pattern match: "YVQBYHJROSgFHoJ0accounts.google.com/92173880321792312255481846864911310786907356971_52_52_123900_48_436380accounts.google.com/1089158984640031084725171865171131078690" Pattern match: "9216282349900831157152182809166531078691MUID00CC41C36F676EA416CC52366E2B6F80msn.com/1025282349900831157152182809166531078691USRLOCmsn.com/921765692800031225750183655966631078691" Pattern match: "0gyISezr3jNBHdgGi..BljMnU.9a.AAA.0.0.BljMnU.AWXaHEwWV0gfacebook.com/92173639812608310968021106147299310786901MmMZepfKijxu-2KmG20DpAkfacebook.com/921788929945631159164112386330231078690" Pattern match: "CONSENTWP.2676bayoutube.com/102431383388163210825482504061830633367hideBrowserUpgradeBoxtrueyoutube.com/921710698338563108151484341524731078690" Pattern match: "9216282349900831157152182809166531078691MUID00CC41C36F676EA416CC52366E2B6F80msn.com/1025282349900831157152182809166531078691" Pattern match: "aVADXywr0vjNOl4Saccounts.google.com/9217379032179231225548115160730831078690" Pattern match: "CvJeG59YZvRr1bYgaccounts.google.com/9217378032179231225548107980729531078690" Pattern match: "0gyISezr3jNBHdgGi..BljMnU.9a.AAA.0.0.BljMnU.AWXaHEwWV0gfacebook.com/9217363981260831096802110614729931078690" Pattern match: "MUIDB388495EC694B69960BCA861968CF6869ieonline.microsoft.com/9216281349900831157152172823564431078691" Pattern match: "TESTCOOKIESENABLEDaccounts.google.com/v3/signin/1088229747776031078690170182669931078690" Pattern match: "MUIDB00CC41C36F676EA416CC52366E2B6F80www.msn.com/9216282349900831157152182809166531078691" Pattern match: "MUID00CC41C36F676EA416CC52366E2B6F80msn.com/1025282349900831157152182809166531078691" Heuristic match: "ocsp.digicert.com" Heuristic match: "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Heuristic match: "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEATh56TcXPLzbcArQrhdFZ8%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Heuristic match: "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTPJvUY%2Bsl%2Bj4yzQuAcL2oQno5fCgQUUWj%2FkK8CB3U8zNllZGKiErhZcjsCEA84b5kxAOGeKVwpjCxm%2Fyw%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Heuristic match: "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTPJvUY%2Bsl%2Bj4yzQuAcL2oQno5fCgQUUWj%2FkK8CB3U8zNllZGKiErhZcjsCEAcpLgRNzv6uFuf5CFWQE%2F4%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Heuristic match: "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAqvpsXKY8RRQeo74ffHUxc%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Heuristic match: "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Heuristic match: "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEA177el9ggmWelJjG4vdGL0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Heuristic match: "accounts.google.com" Heuristic match: "accounts.youtube.com" Heuristic match: "connect.facebook.net" Heuristic match: "facebook.com" Heuristic match: "fbcdn.net" Heuristic match: "fbsbx.com" Heuristic match: "fonts.googleapis.com" Heuristic match: "fonts.gstatic.com" Heuristic match: "play.google.com" Heuristic match: "static.xx.fbcdn.net" Pattern match: "www.facebook.com" Pattern match: "www.google.com" Pattern match: "www.gstatic.com" Pattern match: "www.youtube.com" Pattern match: "https://accounts.google.com/ServiceLogin?passive=1209600&continue=https%3A%2F%2Faccounts.google.com%2F&followup=https%3A%2F%2Faccounts.google.com%2FContent-Encoding" Pattern match: "https://accounts.google.com/InteractiveLogin?continue=https://accounts.google.com/&followup=https://accounts.google.com/&passive=1209600&ifkv=ASKXGp23SCdc4OCD0jBFEUnF-x89VrdyLY0d7q2NMtETpWmyaiaghK1E6hbDBI1n217-LpN4fy0dStrict-Transport-Security" Pattern match: "https://accounts.google.com/&followup=https://accounts.google.com/&passive=1209600&ifkv=ASKXGp23SCdc4OCD0jBFEUnF-x89VrdyLY0d7q2NMtETpWmyaiaghK1E6hbDBI1n217-LpN4fy0d" Pattern match: "https://accounts.google.com/v3/signin/identifier?continue=https%3A%2F%2Faccounts.google.com%2F&followup=https%3A%2F%2Faccounts.google.com%2F&ifkv=ASKXGp3RjdA7K7Sa6-FuxZEeXd_cKeEoj56zJXyMzi4erkM9xog5caeEEEWOKWQm9bjuGZuxJfHYww&passive=1209600&flowName=GlifWe" Pattern match: "accounts.google.com/x-ua-compatible" Pattern match: "https://www.google.com/favicon.icoStrict-Transport-Security" Pattern match: "https://accounts.google.com/Accept-Language" Pattern match: "https://csp.withgoogle.com/csp/report-to/AccountsSignInSignUpUi}]}Accept-CH" Pattern match: "https://csp.withgoogle.com/csp/report-to/AccountsSignInUi}]}Permissions-Policy" Pattern match: "https://www.facebook.com/loginStrict-Transport-Security" Pattern match: "https://fbcdn.net/security/hsts-pixel.gif?c=2.5reporting-endpoints" Pattern match: "https://www.facebook.com/loginAccept-Language" Pattern match: "https://connect.facebook.net/security/hsts-pixel.gifreporting-endpoints" Pattern match: "www.youtube.comCookie" Pattern match: "https://www.youtube.com/supported_browsers?next_url=https%3A%2F%2Fwww.youtube.com%2FStrict-Transport-Security" Pattern match: "https://csp.withgoogle.com/csp/report-to/youtube_main}]}Permissions-Policy" Pattern match: "https://www.youtube.com/supported_browsers?next_url=https%3A%2F%2Fwww.youtube.com%2FAccept-Language" Pattern match: "https://csp.withgoogle.com/csp/report-to/youtube-marketing}]}Content-Length" Pattern match: "www.youtube.comDNT" Pattern match: "fb.me/p3pSet-Cookie" Pattern match: "https://*.fbsbx.com" Pattern match: "https://csp.withgoogle.com/csp/apps-themesCross-Origin-Resource-Policy" Pattern match: "rsrc.php/v3/y9/l/0,cross/2W2z89vRC58.css?_nc_x=Ij3Wp8lg5Kz" Pattern match: "rsrc.php/v3/ya/l/0,cross/EQ0cyse2DGv.css?_nc_x=Ij3Wp8lg5Kz" Pattern match: "rsrc.php/v3/yQ/l/0,cross/DrNGezcSqaJ.css?_nc_x=Ij3Wp8lg5Kz" Pattern match: "rsrc.php/v3/y5/l/0,cross/L3lExXePTzJ.css?_nc_x=Ij3Wp8lg5Kz" Pattern match: "rsrc.php/v3/yc/l/0,cross/1FPNULrhhBJ.css?_nc_x=Ij3Wp8lg5Kz" Pattern match: "rsrc.php/v3/yh/r/sLMNFasP7gH.js?_nc_x=Ij3Wp8lg5Kz" Pattern match: "rsrc.php/v3/ye/l/0,cross/Vlv1mM1xMEH.css?_nc_x=Ij3Wp8lg5Kz" Pattern match: "rsrc.php/y1/r/4lCu2zih0ca.svg" Pattern match: "rsrc.php/v3/yE/r/xGzxHIbkRpC.js?_nc_x=Ij3Wp8lg5Kz" Pattern match: "rsrc.php/v3i7M54/yf/l/en_US/_cNbISKpDhw.js?_nc_x=Ij3Wp8lg5Kz" Pattern match: "rsrc.php/v3/yu/r/-EdnrNYFrJy.js?_nc_x=Ij3Wp8lg5Kz" Pattern match: "rsrc.php/v3/yt/r/v75M7CPu9-P.js?_nc_x=Ij3Wp8lg5Kz" Pattern match: "rsrc.php/v3/yk/r/RKK6hMCj3R1.js?_nc_x=Ij3Wp8lg5Kz" Pattern match: "rsrc.php/v3/yU/r/O7nelmd9XSI.png" Pattern match: "rsrc.php/v3/yB/r/Y0L6f5sxdIV.png" Pattern match: "rsrc.php/v3/yq/r/6bjw9N12j0I.js?_nc_x=Ij3Wp8lg5Kz" Pattern match: "rsrc.php/v3/yz/r/lFK_RCKM9IT.js?_nc_x=Ij3Wp8lg5Kz" Pattern match: "rsrc.php/v3/yp/r/sKtrEJAtiUM.js?_nc_x=Ij3Wp8lg5Kz" Pattern match: "rsrc.php/v3/yv/r/qvzskUrYlYC.js?_nc_x=Ij3Wp8lg5Kz" Pattern match: "rsrc.php/v3/y2/r/3FPJ9YC_wUr.js?_nc_x=Ij3Wp8lg5Kz" Pattern match: "rsrc.php/v3/yC/r/M08arqdo_nN.js?_nc_x=Ij3Wp8lg5Kz" Pattern match: "rsrc.php/v3/yq/r/x5_Htks8xgp.js?_nc_x=Ij3Wp8lg5Kz" Pattern match: "rsrc.php/v3/yU/r/Jn0xcQmjzFV.js?_nc_x=Ij3Wp8lg5Kz" Pattern match: "rsrc.php/v3/yh/r/ysfm_2i9xtW.js?_nc_x=Ij3Wp8lg5Kz" Pattern match: "rsrc.php/v3/yP/r/aBIoq18cchP.js?_nc_x=Ij3Wp8lg5Kz" Pattern match: "rsrc.php/v3ihVQ4/y8/l/en_US/Ch_YChJCKQS.js?_nc_x=Ij3Wp8lg5Kz" Pattern match: "rsrc.php/v3/yo/r/LDFDUeRDitE.js?_nc_x=Ij3Wp8lg5Kz" Pattern match: "rsrc.php/v3/yv/r/HtdXy-2D6mm.js?_nc_x=Ij3Wp8lg5Kz" Pattern match: "rsrc.php/yb/r/hLRJ1GG_y0J.ico" Pattern match: "https://csp.withgoogle.com/csp/boq-infra/identity-boq-js-css-signersCross-Origin-Resource-Policy" Pattern match: "https://csp.withgoogle.com/csp/report-to/static-on-bigtable}]}Content-Length" Pattern match: "https://accounts.google.comContent-Security-Policy" Pattern match: "accounts.google.com/v3/signin/identifier\,null,[\\],0]],\7575639068520443693\,3,[null,\S-2147220249:1703725525511524\]],null,null,null,null,null,null,-3600,null,null,null,null,null,1],[1703722294000,null,null,null,null,null,null,[[[307,64002,nul" Pattern match: "https://accounts.google.comAccess-Control-Request-Method" Pattern match: "https://accounts.google.comAccess-Control-Allow-Methods" Pattern match: "https://accounts.google.comCross-Origin-Resource-Policy" Pattern match: "https://accounts.google.com/v3/signin/" Pattern match: "https://www.gstatic.com/_/mss/boq-identity/_/ss/k=boq-identity.AccountsSignInUi.dEB8J-yETiQ.L.B1.O/am=P4GFJI4NgBgzyzl_zzg5DAAAAAAAAAAAsAawAw/d=1/ed=1/rs=AOaEmlELezs-m55pGkAIN8zMOCtbT9x9lQ/m=identifierview,_b,_tp" Pattern match: "fonts.gstatic.com/s/productsans/v9/pxiDypQkot1TnFhsFMOfGShVGdeOYktMqlap.woff2" Pattern match: "https://www.gstatic.com/_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en_US.Esgs9sUIcrA.es5.O/am=P4GFJI4NgBgzyzl_zzg5DAAAAAAAAAAAsAawAw/d=1/excm=_b,_tp,identifierview/ed=1/dg=0/wt=2/ujg=1/rs=AOaEmlGk5Vz2a80DM5XwjSrI9XblpXjVGw/m=_b,_tp" Pattern match: "fonts.gstatic.com/s/roboto/v18/KFOkCnqEu92Fr1MmgVxFIzIXKMnyrYk.woff2" Pattern match: "https://accounts.google.com/AccountChooser?continue\u003dhttps://accounts.google.com/\u0026followup\u003dhttps://accounts.google.com/],[null,[null,null,https://accounts.google.com/Logout?continue\u003dhttps://accounts.google.com/restart?continue%3Dhttps:" Pattern match: "www.youtube.com\//g" Pattern match: "https://www.youtube.com/error_204?t=jserror&level=ERROR" Pattern match: "https://www.youtube.com/s/desktop/28b0985e/img/favicon.ico" Pattern match: "https://i.ytimg.com/generate_204" Pattern match: "https://www.youtube.com/s/desktop/28b0985e/jsbin/scheduler.vflset/scheduler.js" Pattern match: "https://www.youtube.com/s/desktop/28b0985e/jsbin/network.vflset/network.js" Pattern match: "https://www.youtube.com/s/desktop/28b0985e/cssbin/www-main-desktop-watch-page-skeleton.css" Pattern match: "https://www.facebook.com/legal/license/OKBVmODmb-W/" Pattern match: "https://static.xx.fbcdn.net/rsrc.php/v3/ym/r/5NogN3rgY0F.png" Pattern match: "https://static.xx.fbcdn.net/rsrc.php/v3/ya/l/0,cross/EQ0cyse2DGv.css?_nc_x=Ij3Wp8lg5Kz" Pattern match: "https://static.xx.fbcdn.net/rsrc.php/v3/y5/l/0,cross/L3lExXePTzJ.css?_nc_x=Ij3Wp8lg5Kz" Pattern match: "https://static.xx.fbcdn.net/rsrc.php/v3/yQ/l/0,cross/DrNGezcSqaJ.css?_nc_x=Ij3Wp8lg5Kz" Pattern match: "https://static.xx.fbcdn.net/rsrc.php/v3/ye/l/0,cross/Vlv1mM1xMEH.css?_nc_x=Ij3Wp8lg5Kz" Pattern match: "https://static.xx.fbcdn.net/rsrc.php/v3/yc/l/0,cross/1FPNULrhhBJ.css?_nc_x=Ij3Wp8lg5Kz" Pattern match: "https://static.xx.fbcdn.net/rsrc.php/v3/yh/r/sLMNFasP7gH.js?_nc_x=Ij3Wp8lg5Kz" Pattern match: "www.kfc.co.th,learn.pantheon.io,www.landmarkshops.in,www.ncl.com,s0.wp.com,www.tatacliq.com,bs.serving-sys.com,kohls.com,lazada.co.th,xg4ken.com,technopark.ru,officedepot.com.mx,bestbuy.com.mx,booking.com,nibio.no,myworkdayjob" Pattern match: "www.facebook.com\/login}]],[UITinyViewportAction,init,[],[]],[ResetScrollOnUnload,init,[__elem_a588f507_0_0_\/s],[{__m:__elem_a588f507_0_0_\/s}]],[KeyboardActivityLogger,init,[],[]],[FocusRing,init,[],[]],[ErrorMessageConsole,list" Pattern match: "https://static.xx.fbcdn.net/rsrc.php/v3/y9/l/0,cross/2W2z89vRC58.css?_nc_x=Ij3Wp8lg5Kz" Pattern match: "https://static.xx.fbcdn.net/rsrc.php/v3/yE/r/xGzxHIbkRpC.js?_nc_x=Ij3Wp8lg5Kz" Pattern match: "https://static.xx.fbcdn.net/rsrc.php/v3i7M54/yf/l/en_US/_cNbISKpDhw.js?_nc_x=Ij3Wp8lg5Kz" Pattern match: "https://static.xx.fbcdn.net/rsrc.php/v3/yu/r/-EdnrNYFrJy.js?_nc_x=Ij3Wp8lg5Kz" Pattern match: "https://static.xx.fbcdn.net/rsrc.php/v3/yt/r/v75M7CPu9-P.js?_nc_x=Ij3Wp8lg5Kz" Pattern match: "https://www.facebook.com/login,serverLID:7317445408524383540}]],[FalcoLoggerTransports,attach,[],[]],[Chromedome,start,[],[{}]],[DimensionTracking],[ClickRefLogger],[NavigationClickPointHandler],[WebDevicePerfInfoLogging,doLog,[],[]],[" Pattern match: "https://www.internalfb.com/intern/invariant/+a+/;b.length" Pattern match: "https://fburl.com/debugjs" Pattern match: "https://www.facebook.com/legal/license/Ga6vBwdwgUx/" Pattern match: "https://www.facebook.com/legal/license/A4tfXiHOGrs/" Pattern match: "https://secure.facebook.com/:document.referrer,d=c.indexOf(/,8);c=c.substring(0,d);if(l(c)){d=new" Pattern match: "www.+" Pattern match: "www.novi" Pattern match: "https://www.facebook.com/login/" Pattern match: "https://static.xx.fbcdn.net/rsrc.php/v3/y_/l/0,cross/piXcg3ZJdR_.css?_nc_x=Ij3Wp8lg5Kz" Pattern match: "https://static.xx.fbcdn.net/rsrc.php/v3/y_/l/0,cross/VFpI6CDFC7e.css?_nc_x=Ij3Wp8lg5Kz" Pattern match: "https://static.xx.fbcdn.net/rsrc.php/v3/yv/l/0,cross/WXwHRQiNCXI.css?_nc_x=Ij3Wp8lg5Kz" Pattern match: "https://static.xx.fbcdn.net/rsrc.php/v3/yt/r/iZpNYL8JfUb.js?_nc_x=Ij3Wp8lg5Kz" Pattern match: "www.facebook.com\/login}]],[UITinyViewportAction,init,[],[]],[ResetScrollOnUnload,init,[__elem_a588f507_0_0_bD],[{__m:__elem_a588f507_0_0_bD}]],[KeyboardActivityLogger,init,[],[]],[FocusRing,init,[],[]],[ErrorMessageConsole,listen" Pattern match: "https://static.xx.fbcdn.net/rsrc.php/v3/yl/l/0,cross/R2oOyt8zLzV.css?_nc_x=Ij3Wp8lg5Kz" Pattern match: "https://www.facebook.com/login,serverLID:7317446438596923968}]],[FalcoLoggerTransports,attach,[],[]],[Chromedome,start,[],[{}]],[DimensionTracking],[ClickRefLogger],[NavigationClickPointHandler],[ServiceWorkerURLCleaner,removeRedirectID" Pattern match: "https://www.gstatic.com/_/mss/boq-identity/_/ss/k=boq-identity.AccountsSignInUi.EUkLMShNfWA.L.I11.O/am=P4GFZI4NgBgzyzl_zzg5DAAAAAAAAAAAsAawAw/d=1/ed=1/rs=AOaEmlGCZAzGFYX_3pQOxMGtUlcC7xuWhA/m=identifierview,_b,_tp" Pattern match: "fonts.gstatic.com/s/productsans/v9/pxiDypQkot1TnFhsFMOfGShVF9eI.woff" Pattern match: "https://www.gstatic.com/_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en_US.Esgs9sUIcrA.es5.O/am=P4GFZI4NgBgzyzl_zzg5DAAAAAAAAAAAsAawAw/d=1/excm=_b,_tp,identifierview/ed=1/dg=0/wt=2/ujg=1/rs=AOaEmlH7PzU0xJlt26l3lAuQiC9uvvi0-Q/m=_b,_tp" Pattern match: "fonts.gstatic.com/s/roboto/v18/KFOkCnqEu92Fr1MmgVxIIzQ.woff" Pattern match: "https://assets.msn.com/config/v1/"" Pattern match: "https://+l+/OneCollector/1.0+function(t){return?+Object.keys(t).map" Pattern match: "www.bing.com" Pattern match: "https://assets.msn.com/bundles/v1/homePage/latest/midlevel/vendors.ef7dde432bed42c1b7db.js" Pattern match: "https://assets.msn.com/bundles/v1/homePage/latest/midlevel/microsoft.f0dc8bbbc7b4d116660b.js" Pattern match: "https://assets.msn.com/bundles/v1/homePage/latest/midlevel/common.a878ea7bfce3fb435465.js" Pattern match: "https://assets.msn.com/bundles/v1/homePage/latest/midlevel/experience.0f30a2bb04a428617069.js" Heuristic match: "%WINDIR%\assembly\NativeImages_v2.0.50727_32\Microsoft.WSMan.Man#\7bf5729401cff7ea7898124e9818ed20\Microsoft.WSMan.Management.ni" Heuristic match: "%ALLUSERSPROFILE%\Oracle\Java\javapath\Get-MpPreference.COM" Heuristic match: "%WINDIR%\system32\Get-MpPreference.COM" Heuristic match: "%WINDIR%\Get-MpPreference.COM" Heuristic match: "%WINDIR%\System32\Wbem\Get-MpPreference.COM" Heuristic match: "%WINDIR%\System32\WindowsPowerShell\v1.0\Get-MpPreference.COM" Heuristic match: "%LOCALAPPDATA%\Programs\Python\Python38-32\Scripts\Get-MpPreference.COM" Heuristic match: "%LOCALAPPDATA%\Programs\Python\Python38-32\Get-MpPreference.COM" Heuristic match: "%LOCALAPPDATA%\Programs\Python\Python36-32\Scripts\Get-MpPreference.COM" Heuristic match: "%LOCALAPPDATA%\Programs\Python\Python36-32\Get-MpPreference.COM" Pattern match: "Microsoft.NET/Framework/v4.0.30319/" Pattern match: "IXP002.TMP/5cN0su3.exe" Pattern match: "IXP002.TMP/5cN0su3.exe.config" Heuristic match: "gf3ul6)sfuk" - Source: "00000000-00001484.00000001.69129.0112E000.00000080.mdmp") Found URL "http://pki-crl.symauth.com/offlineca/theinstituteofelectricalandelectronicsengineersincieeerootca.crl0verisignmpki-2-3990" - Source: "00000000-00001484.00000001.69129.0112E000.00000080.mdmp") Found URL "https://t.me/riseprosupport" - Source: "00000000-00001484.00000001.69129.03360000.00000004.mdmp") Found URL "https://t.me/riseprosupportdefault1.1.1.1invariant" - Source: "00000000-00001484.00000001.69129.03360000.00000004.mdmp") Found URL "http://user.configfile:.configfile://datadirectoryfile:http:\\?\globalroot" - Source: "00000000-00001484.00000001.69129.03360000.00000004.mdmp") Found URL "http://go.microsoft.com/fwlink/?linkid=42127" - Source: "00000000-00001484.00000001.69129.03360000.00000004.mdmp") Found URL "http://www.w3.org/2000/09/xmldsig" - Source: "00000000-00001484.00000001.69129.03360000.00000004.mdmp") Found URL "https://enigmaprotector.com/e-mail" - Source: "00000000-00001484.00000002.71052.01131000.00000040.mdmp") Found URL "https://t.me/riseprosupport" - Source: "00000000-00001484.00000002.71052.03360000.00000004.mdmp") Found URL "https://t.me/riseprosupportdefault1.1.1.1invariant" - Source: "00000000-00001484.00000002.71052.03360000.00000004.mdmp") Found URL "http://user.configfile:.configfile://datadirectoryfile:http:\\?\globalroot" - Source: "00000000-00001484.00000002.71052.03360000.00000004.mdmp") Found URL "http://go.microsoft.com/fwlink/?linkid=42127" - Source: "00000000-00001484.00000002.71052.03360000.00000004.mdmp") Found URL "http://www.w3.org/2000/09/xmldsig" - Source: "00000000-00001484.00000002.71052.03360000.00000004.mdmp") Found URL "https://www.youtube.com/chxreadingstringime.dllsenumerateprocessesexwionwdevicepairingfolder.dlldevicepairinghandler.dll\windows\system32\ieframe.dll\windows\system32\ieframe.dll\windows\system32\shell32.dllttps://accounts.google.com/locationnotifications.exettps://accounts.google.com/mediametadatahandler.dllmsvcp140_atomic_wait.dllhttps://www.youtube.com/\mi;elevatecreateprocesswrpmitigationapphelp.dllen-usen-usar-sapt-brzh-twzh-cnzh-hkcs-czda-dkel-gres-esfi-fifr-frde-dehe-ilhu-huit-itja-jpko-krnl-nlnb-nopl-plpt-ptru-rusv-setr-trbg-bghr-hret-eelv-lvlt-ltro-rosr-latn-cssk-sksl-sith-thuk-uafy-nlqps-plocqps-plocm:\windows\apppatch\aclayers.dll127>52c64b7ec:\windows\system32\imm32.dllh;c:\windows\system32;c:\windows;c:\windows\system32\wbem;c:\windows\system32\windowspowershell\v1.0\;c:\users\hapubws\appdata\local\programs\python\python38-32\scripts\;c:\users\hapubws\appdata\local\programs\python\python38-:\windows\system32\winspool.drvpdata\lo1:\windows\system32\setupapi.dllmp\1:\windows\system32\cfgmgr32.dll:\windows\system32\sfc.dllms-win-core-processthreads-l1-1-0:\windows\apppatch\acgenral.dlldata=c:\users\hapubws\appdata\roamingcommonprogramfiles=c:\program" - Source: "00000000-00002340.00000000.66838.009B0000.00000004.mdmp") Found URL "https://facebook.com/loginwindowsanytimeupgradeui.exeware\microsoft\oleautindowsindows:\windows\inf:\windows\infindowsfficient" - Source: "00000000-00002340.00000000.66838.009B0000.00000004.mdmp") Found URL "https://www.youtube.com/api-ms-win-core-rtlsupport-l1-1-0.dllapi-ms-win-core-sysinfo-l1-1-0.dllapi-ms-win-core-threadpool-l1-1-0.dllapi-ms-win-crt-filesystem-l1-1-0.dllhttps://www.youtube.com/https://www.youtube.com/https://www.youtube.com/api-ms-win-security-sddl-l1-1-0.dllapi-ms-win-service-core-l1-1-0.dllapi-ms-win-service-winsvc-l1-1-0.dllauxiliarydisplayclassinstaller.dllommonprogramfiles=c:\program" - Source: "00000000-00002340.00000000.66838.009B0000.00000004.mdmp")55:T7bb,Found string "GET / HTTP/1.1Accept: text/html, application/xhtml+xml, */*User-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateDNT: 1Host: accounts.google.comConnection: Keep-AliveAccept-Language: en-US" (Indicator: "HTTP/1.1"; File: "SSL") file/memory contains long string with (Indicator: "HTTP/1.1"; File: "SSL") Found string "HTTP/1.1 204 No ContentContent-Length: 0Cross-Origin-Resource-Policy: cross-originDate: Thu, 28 Dec 2023 01:05:38 GMTAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000" (Indicator: "HTTP/1.1"; File: "SSL") Found string "GET /login HTTP/1.1Accept: text/html, application/xhtml+xml, */*Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: facebook.comDNT: 1Connection: Keep-Alive" (Indicator: "HTTP/1.1"; File: "SSL") Found string "GET /login HTTP/1.1Accept: text/html, application/xhtml+xml, */*Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateDNT: 1Connection: Keep-AliveHost: www.facebook.com" (Indicator: "HTTP/1.1"; File: "SSL") Found string "HTTP/1.1 304 Not ModifiedDate: Sun, 24 Dec 2023 10:06:23 GMTExpires: Mon, 23 Dec 2024 10:06:23 GMTAge: 313144Last-Modified: Mon, 16 Oct 2017 17:32:56 GMTCache-Control: public, max-age=31536000Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000" (Indicator: "HTTP/1.1"; File: "SSL") Found string "GET /rsrc.php/yb/r/hLRJ1GG_y0J.ico HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoHost: static.xx.fbcdn.netDNT: 1Connection: Keep-Alive" (Indicator: "HTTP/1.1"; File: "SSL") Found string "GET /favicon.ico HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoDNT: 1Connection: Keep-AliveHost: www.google.com" (Indicator: "HTTP/1.1"; File: "SSL")56:T2195,Contains base62 string in header "MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAU" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base62 string in header "2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base62 string in header "MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V" in header "GET /gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base62 string in header "MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfq" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEATh56TcXPLzbcArQrhdFZ8%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base62 string in header "hLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQ" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEATh56TcXPLzbcArQrhdFZ8%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base62 string in header "P4v0cB1JgmGggC72NkK8MCEATh56TcXPL" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEATh56TcXPLzbcArQrhdFZ8%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base62 string in header "MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHL" in header "GET /gts1c3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEGpYRvzN3kAuEMlMWsqSFLc%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base62 string in header "2Fr4XN7pXNPZzQ4kYU83E1HScCEGpYRvz" in header "GET /gts1c3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEGpYRvzN3kAuEMlMWsqSFLc%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base62 string in header "ME4wTDBKMEgwRjAJBgUrDgMCGgUABBQwk" in header "GET /gtsr1/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBQwkcLWD4LqGJ7bE7B1XZsEbmfwUAQU5K8rJnEaK0gnhS9SZizv8IkTcT4CDQIDvFNZazTHGPUBUGY%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base62 string in header "cLWD4LqGJ7bE7B1XZsEbmfwUAQU5K8rJn" in header "GET /gtsr1/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBQwkcLWD4LqGJ7bE7B1XZsEbmfwUAQU5K8rJnEaK0gnhS9SZizv8IkTcT4CDQIDvFNZazTHGPUBUGY%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base62 string in header "EaK0gnhS9SZizv8IkTcT4CDQIDvFNZazT" in header "GET /gtsr1/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBQwkcLWD4LqGJ7bE7B1XZsEbmfwUAQU5K8rJnEaK0gnhS9SZizv8IkTcT4CDQIDvFNZazTHGPUBUGY%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base62 string in header "MFEwTzBNMEswSTAJBgUrDgMCGgUABBTPJ" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTPJvUY%2Bsl%2Bj4yzQuAcL2oQno5fCgQUUWj%2FkK8CB3U8zNllZGKiErhZcjsCEA84b5kxAOGeKVwpjCxm%2Fyw%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base62 string in header "2FkK8CB3U8zNllZGKiErhZcjsCEA84b5k" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTPJvUY%2Bsl%2Bj4yzQuAcL2oQno5fCgQUUWj%2FkK8CB3U8zNllZGKiErhZcjsCEA84b5kxAOGeKVwpjCxm%2Fyw%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base62 string in header "MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHL" in header "GET /gts1c3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEBZwXm7t3kKEEFjsmHQeLcQ%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base62 string in header "2Fr4XN7pXNPZzQ4kYU83E1HScCEBZwXm7" in header "GET /gts1c3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEBZwXm7t3kKEEFjsmHQeLcQ%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base62 string in header "MFEwTzBNMEswSTAJBgUrDgMCGgUABBTPJ" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTPJvUY%2Bsl%2Bj4yzQuAcL2oQno5fCgQUUWj%2FkK8CB3U8zNllZGKiErhZcjsCEAcpLgRNzv6uFuf5CFWQE%2F4%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base62 string in header "2FkK8CB3U8zNllZGKiErhZcjsCEAcpLgR" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTPJvUY%2Bsl%2Bj4yzQuAcL2oQno5fCgQUUWj%2FkK8CB3U8zNllZGKiErhZcjsCEAcpLgRNzv6uFuf5CFWQE%2F4%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base62 string in header "MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHL" in header "GET /gts1c3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEDEixfO34qnbCeE6N8VMp00%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base62 string in header "2Fr4XN7pXNPZzQ4kYU83E1HScCEDEixfO" in header "GET /gts1c3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEDEixfO34qnbCeE6N8VMp00%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base62 string in header "MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAqvpsXKY8RRQeo74ffHUxc%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base62 string in header "2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAqvpsXKY8RRQeo74ffHUxc%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base62 string in header "2BrkS7QYXjzkCEAqvpsXKY8RRQeo74ffH" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAqvpsXKY8RRQeo74ffHUxc%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base62 string in header "MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base62 string in header "2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base62 string in header "2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base62 string in header "MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEA177el9ggmWelJjG4vdGL0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base62 string in header "2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEA177el9ggmWelJjG4vdGL0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base62 string in header "2BrkS7QYXjzkCEA177el9ggmWelJjG4vd" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEA177el9ggmWelJjG4vdGL0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com"57:T74c,Observed string: "__d("URISchemes",["$InternalEnum"],(function(a,b,c,d,e,f){"use strict";var g=new Set(["about","accountscenter","aidemos","aistudio","apk","blob","cmms","fb","fba","fbatwork","fb-ama","fb-internal","fb-workchat","fb-workchat-secure","fb-messenger","fb-messenger-public","fb-messenger-group-thread","fb-page-messages","fb-pma","fbcf","fbconnect","fbinternal","fbmobilehome","fbrpc","file","flipper","ftp","gtalk","http","https","mailto","wss","ms-app","intent","itms","itms-apps","itms-services","lasso","market","svn+ssh","fbstaging","tel","sms","pebblejs","sftp","whatsapp","moments","flash","fblite","chrome-extension","webcal","instagram","iglite","fb124024574287414","fb124024574287414rc","fb124024574287414master","fb1576585912599779","fb929757330408142","designpack","fbpixelcloud","fbapi20130214","fb1196383223757595","tbauth","oculus","oculus.store","oculus.feed","oculusstore","socialplatform","odh","com.oculus.rd","aria","skype","ms-windows-store","callto","messenger","workchat","fb236786383180508","fb1775440806014337","data","fb-mk","munki","origami-file","fb-nimble-vrsrecorder","fb-nimble-monohandtrackingvis","together","togetherbl","horizonlauncher","venues","whatsapp-consumer","whatsapp-smb","fb-ide-opener","fb-vscode","fb-vscode-insiders","editor","spark-studio","spark-player","spark-simulator","arstudio","manifold","origami-internal","origami-public","stella","mwa","mattermost","logaggregator","pcoip","cinema","home","oculus360photos","systemux"]),h=b("$InternalEnum")({EXPLICITLY_ALLOWED_SCHEMES_ONLY:"explicitly_allowed_schemes_only",INCLUDE_DEFAULTS:"include_defaults"});function a(a,b,c){b===void 0&&(b=h.INCLUDE_DEFAULTS);return a==null||a===""?!0:(c==null?void 0:c.has(a.toLowerCase()))||b===h.INCLUDE_DEFAULTS&&g.has(a.toLowerCase())}f.Options=h;f.isAllowed=a}),66);" (Indicator: ""sftp") in Source: sLMNFasP7gH_1_.js58:T660,"d470377f9b683b10aa2230b05a5fcdcd.exe" called "FindFirstFileW" with parameter %TEMP%\IXP000.TMP\*.* (UID: 00000000-00003280) "d470377f9b683b10aa2230b05a5fcdcd.exe" called "FindNextFileW" with parameter .. (UID: 00000000-00003280) "d470377f9b683b10aa2230b05a5fcdcd.exe" called "FindNextFileW" with parameter 7gT2oH15.exe (UID: 00000000-00003280) "d470377f9b683b10aa2230b05a5fcdcd.exe" called "FindNextFileW" with parameter cv7VU08.exe (UID: 00000000-00003280) "cv7VU08.exe" called "FindFirstFileW" with parameter %TEMP%\IXP001.TMP\*.* (UID: 00000000-00001540) "cv7VU08.exe" called "FindNextFileW" with parameter .. (UID: 00000000-00001540) "cv7VU08.exe" called "FindNextFileW" with parameter 6AT6wL0.exe (UID: 00000000-00001540) "cv7VU08.exe" called "FindNextFileW" with parameter Eh9VZ39.exe (UID: 00000000-00001540) "Eh9VZ39.exe" called "FindFirstFileW" with parameter %TEMP%\IXP002.TMP\*.* (UID: 00000000-00004044) "Eh9VZ39.exe" called "FindNextFileW" with parameter .. (UID: 00000000-00004044) "Eh9VZ39.exe" called "FindNextFileW" with parameter 2GR5823.exe (UID: 00000000-00004044) "Eh9VZ39.exe" called "FindNextFileW" with parameter 5cN0su3.exe (UID: 00000000-00004044) "2GR5823.exe" called "FindFirstFileW" with parameter %WINDIR%\System32\*.* (UID: 00000000-00002340) "2GR5823.exe" called "FindNextFileW" with parameter .. (UID: 00000000-00002340) "2GR5823.exe" called "FindNextFileW" with parameter 0409 (UID: 00000000-00002340) "2GR5823.exe" called "FindNextFileW" with parameter 12520437.cpx (UID: 00000000-00002340) "2GR5823.exe" called "FindNextFileW" with parameter 12520850.cpx (UID: 00000000-00002340)59:T1ee4,file/memory contains long string with (Indicator: ".decrypt"; File: "qvzskUrYlYC_1_.js") file/memory contains long string with (Indicator: ".encrypt"; File: "qvzskUrYlYC_1_.js") file/memory contains long string with (Indicator: "base64"; File: "qvzskUrYlYC_1_.js") file/memory contains long string with (Indicator: "blowfish"; File: "qvzskUrYlYC_1_.js") file/memory contains long string with (Indicator: "aes"; File: "SSL") file/memory contains long string with (Indicator: "aes"; File: "6bjw9N12j0I_1_.js") file/memory contains long string with (Indicator: ".encrypt"; File: "6bjw9N12j0I_1_.js") file/memory contains long string with (Indicator: "base64"; File: "6bjw9N12j0I_1_.js") file/memory contains long string with (Indicator: ".decrypt"; File: "6bjw9N12j0I_1_.js") file/memory contains long string with (Indicator: "base64"; File: "login_1_.htm") file/memory contains long string with (Indicator: ".encrypt"; File: "sKtrEJAtiUM_1_.js") file/memory contains long string with (Indicator: "base64"; File: "sKtrEJAtiUM_1_.js") file/memory contains long string with (Indicator: "blowfish"; File: "sKtrEJAtiUM_1_.js") file/memory contains long string with (Indicator: "base64"; File: "sLMNFasP7gH_1_.js") file/memory contains long string with (Indicator: "base64"; File: "identifier_1_.htm") Found string "icrosoft Enhanced RSA and AES Cryptographic Provider" (Indicator: "aes"; Source: "00000000-00001484.00000000.67206.003A0000.00000004.mdmp, 00000000-00001484.00000001.69129.003A0000.00000004.mdmp, 00000000-00001484.00000002.71052.003A0000.00000004.mdmp") Found string "Microsoft Enhanced RSA and AES Cryptographic Provider" (Indicator: "aes"; Source: "00000000-00001484.00000000.67206.003A0000.00000004.mdmp, 00000000-00001484.00000000.67206.03360000.00000004.mdmp, 00000000-00001484.00000001.69129.003A0000.00000004.mdmp, 00000000-00001484.00000001.69129.03360000.00000004.mdmp, 00000000-00001484.00000002.71052.003A0000.00000004.mdmp, 00000000-00001484.00000002.71052.03360000.00000004.mdmp") Found string "FTWARE\Microsoft\Cryptography\Defaults\Provider\Microsoft Enhanced RSA and AES Cryptographic Provider" (Indicator: "aes"; Source: "00000000-00001484.00000000.67206.003A0000.00000004.mdmp") Found string "/* RIJNDAEL by Joan Daemen and Vincent Rijmen */" (Indicator: "rijndael"; Source: "00000000-00001484.00000000.67206.01E20000.00000040.mdmp, 00000000-00001484.00000001.69129.01E20000.00000040.mdmp, 00000000-00001484.00000002.71052.01E20000.00000040.mdmp") Found string "Switch.System.Security.Cryptography.DoNotAddrOfCspParentWindowHandle" (Indicator: "System.Security.Cryptography"; Source: "00000000-00001484.00000000.67206.03360000.00000004.mdmp, 00000000-00001484.00000001.69129.03360000.00000004.mdmp, 00000000-00001484.00000002.71052.03360000.00000004.mdmp") Found string "Switch.System.Security.Cryptography.UseLegacyFipsThrow" (Indicator: "System.Security.Cryptography"; Source: "00000000-00001484.00000000.67206.03360000.00000004.mdmp, 00000000-00001484.00000001.69129.03360000.00000004.mdmp, 00000000-00001484.00000002.71052.03360000.00000004.mdmp") Found string "System.Security.Cryptography.RandomNumberGenerator" (Indicator: "System.Security.Cryptography"; Source: "00000000-00001484.00000000.67206.03360000.00000004.mdmp, 00000000-00001484.00000001.69129.03360000.00000004.mdmp, 00000000-00001484.00000002.71052.03360000.00000004.mdmp") Found string "Uses RsaCryptoServiceProvider to encrypt and decrypt" (Indicator: "RsaCryptoServiceProvider"; Source: "00000000-00001484.00000000.67206.03360000.00000004.mdmp, 00000000-00001484.00000001.69129.03360000.00000004.mdmp, 00000000-00001484.00000002.71052.03360000.00000004.mdmp") Found string "System.Security.Cryptography.SHA1" (Indicator: "System.Security.Cryptography"; Source: "00000000-00001484.00000000.67206.03360000.00000004.mdmp, 00000000-00001484.00000001.69129.03360000.00000004.mdmp, 00000000-00001484.00000002.71052.03360000.00000004.mdmp") Found string "System.Security.Cryptography.AesCryptoServiceProvider, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "aes"; Source: "00000000-00001484.00000000.67206.03360000.00000004.mdmp, 00000000-00001484.00000001.69129.03360000.00000004.mdmp, 00000000-00001484.00000002.71052.03360000.00000004.mdmp") Found string "System.Security.Cryptography.AesCryptoServiceProvider, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "aescryptoserviceprovider"; Source: "00000000-00001484.00000000.67206.03360000.00000004.mdmp, 00000000-00001484.00000001.69129.03360000.00000004.mdmp, 00000000-00001484.00000002.71052.03360000.00000004.mdmp") Found string "System.Security.Cryptography.AesCryptoServiceProvider, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "System.Security.Cryptography"; Source: "00000000-00001484.00000000.67206.03360000.00000004.mdmp, 00000000-00001484.00000001.69129.03360000.00000004.mdmp, 00000000-00001484.00000002.71052.03360000.00000004.mdmp") Found string "System.Security.Cryptography.RSACng, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "System.Security.Cryptography"; Source: "00000000-00001484.00000000.67206.03360000.00000004.mdmp, 00000000-00001484.00000001.69129.03360000.00000004.mdmp, 00000000-00001484.00000002.71052.03360000.00000004.mdmp") Found string "System.Security.Cryptography.DSACng, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "System.Security.Cryptography"; Source: "00000000-00001484.00000000.67206.03360000.00000004.mdmp, 00000000-00001484.00000001.69129.03360000.00000004.mdmp, 00000000-00001484.00000002.71052.03360000.00000004.mdmp") Found string "System.Security.Cryptography.AesManaged, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "aes"; Source: "00000000-00001484.00000000.67206.03360000.00000004.mdmp, 00000000-00001484.00000001.69129.03360000.00000004.mdmp, 00000000-00001484.00000002.71052.03360000.00000004.mdmp") Found string "System.Security.Cryptography.AesManaged, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "System.Security.Cryptography"; Source: "00000000-00001484.00000000.67206.03360000.00000004.mdmp, 00000000-00001484.00000001.69129.03360000.00000004.mdmp, 00000000-00001484.00000002.71052.03360000.00000004.mdmp") Found string "System.Security.Cryptography.ECDiffieHellmanCng, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "System.Security.Cryptography"; Source: "00000000-00001484.00000000.67206.03360000.00000004.mdmp, 00000000-00001484.00000001.69129.03360000.00000004.mdmp, 00000000-00001484.00000002.71052.03360000.00000004.mdmp") Found string "System.Security.Cryptography.ECDsaCng, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "ecdsa"; Source: "00000000-00001484.00000000.67206.03360000.00000004.mdmp, 00000000-00001484.00000001.69129.03360000.00000004.mdmp, 00000000-00001484.00000002.71052.03360000.00000004.mdmp") Found string "System.Security.Cryptography.ECDsaCng, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "System.Security.Cryptography"; Source: "00000000-00001484.00000000.67206.03360000.00000004.mdmp, 00000000-00001484.00000001.69129.03360000.00000004.mdmp, 00000000-00001484.00000002.71052.03360000.00000004.mdmp") Found string "System.Security.Cryptography.MD5Cng, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "System.Security.Cryptography"; Source: "00000000-00001484.00000000.67206.03360000.00000004.mdmp, 00000000-00001484.00000001.69129.03360000.00000004.mdmp, 00000000-00001484.00000002.71052.03360000.00000004.mdmp")5a:T52b,Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; File: "d470377f9b683b10aa2230b05a5fcdcd.exe") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; File: "d470377f9b683b10aa2230b05a5fcdcd.exe") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; File: "d470377f9b683b10aa2230b05a5fcdcd.exe") Found reference to API "GetModuleHandleA" (Indicator: "GetModuleHandle"; File: "00000000-00001484.00000002.71052.01131000.00000040.mdmp") Found reference to API "GetEnvironmentStrings" (Indicator: "GetEnvironmentStrings"; File: "6AT6wL0.exe.1951796743") Found reference to API "GetEnvironmentStringsW" (Indicator: "GetEnvironmentStrings"; File: "6AT6wL0.exe.1951796743") Found reference to API "GetModuleHandle" (Indicator: "GetModuleHandle"; Source: "00000000-00001484.00000001.69129.00DC2000.00000040.mdmp") Found reference to API "NtQueryInformationProcess" (Indicator: "QueryInformationProcess"; Source: "00000000-00001484.00000001.69129.00DC2000.00000040.mdmp") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; Source: "00000000-00001484.00000001.69129.00DC2000.00000040.mdmp") Found reference to API "GetModuleHandleA" (Indicator: "GetModuleHandle"; Source: "00000000-00001484.00000002.71052.01131000.00000040.mdmp")5b:T593,Found reference to API "GetFileAttributesA" (Indicator: "GetFileAttributes"; File: "d470377f9b683b10aa2230b05a5fcdcd.exe") Found reference to API "GetSystemDirectoryA" (Indicator: "GetSystemDirectory"; File: "d470377f9b683b10aa2230b05a5fcdcd.exe") Found reference to API "GetCurrentDirectoryA" (Indicator: "GetCurrentDirectory"; File: "d470377f9b683b10aa2230b05a5fcdcd.exe") Found reference to API "GetTempPathA" (Indicator: "GetTempPath"; File: "d470377f9b683b10aa2230b05a5fcdcd.exe") Found reference to API "GetTempFileNameA" (Indicator: "GetTempFileName"; File: "d470377f9b683b10aa2230b05a5fcdcd.exe") Found reference to API "GetFileVersionInfoSizeA" (Indicator: "GetFileVersionInfo"; File: "d470377f9b683b10aa2230b05a5fcdcd.exe") Found reference to API "GetFileVersionInfoSizeA" (Indicator: "GetFileVersionInfoSize"; File: "d470377f9b683b10aa2230b05a5fcdcd.exe") Found reference to API "GetFileVersionInfoA" (Indicator: "GetFileVersionInfo"; File: "d470377f9b683b10aa2230b05a5fcdcd.exe") Found reference to API "GetCurrentDirectoryW$" (Indicator: "GetCurrentDirectory"; Source: "00000000-00001484.00000000.67206.01E60000.00000040.mdmp") Found reference to API "GetTempPath" (Indicator: "GetTempPath"; Source: "00000000-00001484.00000001.69129.00DC2000.00000040.mdmp") Found reference to API "GetFileVersionInfoA" (Indicator: "GetFileVersionInfo"; Source: "00000000-00001484.00000002.71052.01131000.00000040.mdmp")5c:T426,Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; File: "d470377f9b683b10aa2230b05a5fcdcd.exe") Found reference to API "OpenProcessToken" (Indicator: "OpenProcessToken"; File: "d470377f9b683b10aa2230b05a5fcdcd.exe") file/memory contains long string with (Indicator: "OpenProcessToken"; File: "d470377f9b683b10aa2230b05a5fcdcd.exe") Found reference to API "GetUserObjectInformationA" (Indicator: "GetUserObjectInformation"; File: "6AT6wL0.exe.1951796743") Found reference to API "GetProcessWindowStation" (Indicator: "GetProcessWindowStation"; File: "6AT6wL0.exe.1951796743") Found reference to API "NtQuerySystemInformation" (Indicator: "NtQuerySystemInformation"; Source: "00000000-00001484.00000001.69129.00DC2000.00000040.mdmp") Found reference to API "NtQueryInformationProcess" (Indicator: "NtQueryInformationProcess"; Source: "00000000-00001484.00000001.69129.00DC2000.00000040.mdmp") Found reference to API "NtQueryObject" (Indicator: "NtQueryObject"; Source: "00000000-00001484.00000001.69129.00DC2000.00000040.mdmp")5d:Tc95,Found string "passwordFormat" (Indicator: "password"; Source: "00000000-00001484.00000000.67206.03360000.00000004.mdmp, 00000000-00001484.00000001.69129.03360000.00000004.mdmp, 00000000-00001484.00000002.71052.03360000.00000004.mdmp") Found string "passwordAttemptWindow" (Indicator: "password"; Source: "00000000-00001484.00000000.67206.03360000.00000004.mdmp, 00000000-00001484.00000001.69129.03360000.00000004.mdmp, 00000000-00001484.00000002.71052.03360000.00000004.mdmp") Found string "passwordStrengthRegularExpression" (Indicator: "password"; Source: "00000000-00001484.00000000.67206.03360000.00000004.mdmp, 00000000-00001484.00000001.69129.03360000.00000004.mdmp, 00000000-00001484.00000002.71052.03360000.00000004.mdmp") Found string "passwordFormat="Hashed"" (Indicator: "password"; Source: "00000000-00001484.00000000.67206.03360000.00000004.mdmp, 00000000-00001484.00000001.69129.03360000.00000004.mdmp, 00000000-00001484.00000002.71052.03360000.00000004.mdmp") Found string "passwordAttemptWindow="10"" (Indicator: "password"; Source: "00000000-00001484.00000000.67206.03360000.00000004.mdmp, 00000000-00001484.00000001.69129.03360000.00000004.mdmp, 00000000-00001484.00000002.71052.03360000.00000004.mdmp") Found string "passwordStrengthRegularExpression="" />" (Indicator: "password"; Source: "00000000-00001484.00000000.67206.03360000.00000004.mdmp, 00000000-00001484.00000001.69129.03360000.00000004.mdmp, 00000000-00001484.00000002.71052.03360000.00000004.mdmp") Found string "passwords.txt" (Indicator: "password"; Source: "00000000-00001484.00000000.67206.03360000.00000004.mdmp, 00000000-00001484.00000001.69129.03360000.00000004.mdmp, 00000000-00001484.00000002.71052.03360000.00000004.mdmp") Found string "password" (Indicator: "password"; Source: "00000000-00001484.00000000.67206.03360000.00000004.mdmp, 00000000-00001484.00000001.69129.03360000.00000004.mdmp, 00000000-00001484.00000002.71052.03360000.00000004.mdmp") Found string "catch save passwords$" (Indicator: "password"; Source: "00000000-00001484.00000000.67206.03360000.00000004.mdmp, 00000000-00001484.00000001.69129.03360000.00000004.mdmp, 00000000-00001484.00000002.71052.03360000.00000004.mdmp") Found string "SELECT action_url, origin_url, username_value, password_value FROM logins" (Indicator: "password"; Source: "00000000-00001484.00000000.67206.03360000.00000004.mdmp, 00000000-00001484.00000001.69129.03360000.00000004.mdmp, 00000000-00001484.00000002.71052.03360000.00000004.mdmp") Found string "catch passwords sql" (Indicator: "password"; Source: "00000000-00001484.00000000.67206.03360000.00000004.mdmp, 00000000-00001484.00000001.69129.03360000.00000004.mdmp, 00000000-00001484.00000002.71052.03360000.00000004.mdmp") Found string "mark_check_passwords" (Indicator: "password"; Source: "00000000-00001484.00000000.67206.03360000.00000004.mdmp, 00000000-00001484.00000001.69129.03360000.00000004.mdmp, 00000000-00001484.00000002.71052.03360000.00000004.mdmp") Found string "catch quantum passwords sql" (Indicator: "password"; Source: "00000000-00001484.00000000.67206.03360000.00000004.mdmp, 00000000-00001484.00000001.69129.03360000.00000004.mdmp, 00000000-00001484.00000002.71052.03360000.00000004.mdmp")5e:T538,Found string "SELECT * FROM Win32_LogicalDisk WHERE DeviceID = '" (Indicator: " Win32_LogicalDisk"; Source: "00000000-00001484.00000000.67206.03360000.00000004.mdmp, 00000000-00001484.00000001.69129.03360000.00000004.mdmp, 00000000-00001484.00000002.71052.03360000.00000004.mdmp") Found string "SELECT * FROM Win32_Processor" (Indicator: " Win32_Process"; Source: "00000000-00001484.00000000.67206.03360000.00000004.mdmp, 00000000-00001484.00000001.69129.03360000.00000004.mdmp, 00000000-00001484.00000002.71052.03360000.00000004.mdmp") Found string "SELECT * FROM Win32_Processor" (Indicator: " Win32_Processor"; Source: "00000000-00001484.00000000.67206.03360000.00000004.mdmp, 00000000-00001484.00000001.69129.03360000.00000004.mdmp, 00000000-00001484.00000002.71052.03360000.00000004.mdmp") Found string "SELECT * FROM Win32_PhysicalMemory" (Indicator: " Win32_PhysicalMemory"; Source: "00000000-00001484.00000000.67206.03360000.00000004.mdmp, 00000000-00001484.00000001.69129.03360000.00000004.mdmp, 00000000-00001484.00000002.71052.03360000.00000004.mdmp") Found string "SELECT * FROM Win32_VideoController" (Indicator: " Win32_VideoController"; Source: "00000000-00001484.00000000.67206.03360000.00000004.mdmp, 00000000-00001484.00000001.69129.03360000.00000004.mdmp, 00000000-00001484.00000002.71052.03360000.00000004.mdmp")5f:T783,Found string ":\Windows\System32\DriverStore" (Indicator: "system32\drivers"; Source: "00000000-00001484.00000000.67206.003A0000.00000004.mdmp, 00000000-00001484.00000001.69129.003A0000.00000004.mdmp, 00000000-00001484.00000002.71052.003A0000.00000004.mdmp") Found string ":\Windows\System32\DriverStore\infpub.dat" (Indicator: "system32\drivers"; Source: "00000000-00001484.00000000.67206.003A0000.00000004.mdmp, 00000000-00001484.00000001.69129.003A0000.00000004.mdmp, 00000000-00001484.00000002.71052.003A0000.00000004.mdmp") Found string ":\Windows\System32\DriverStore\infstor.dat" (Indicator: "system32\drivers"; Source: "00000000-00001484.00000000.67206.003A0000.00000004.mdmp, 00000000-00001484.00000001.69129.003A0000.00000004.mdmp, 00000000-00001484.00000002.71052.003A0000.00000004.mdmp") Found string ":\Windows\System32\DriverStore\infstrng.dat" (Indicator: "system32\drivers"; Source: "00000000-00001484.00000000.67206.003A0000.00000004.mdmp, 00000000-00001484.00000001.69129.003A0000.00000004.mdmp, 00000000-00001484.00000002.71052.003A0000.00000004.mdmp") Found string ":\Windows\System32\DriverStore\drvindex.dat" (Indicator: "system32\drivers"; Source: "00000000-00001484.00000000.67206.003A0000.00000004.mdmp, 00000000-00001484.00000001.69129.003A0000.00000004.mdmp, 00000000-00001484.00000002.71052.003A0000.00000004.mdmp") Found string ":\Windows\System32\DriverStore\FileRepository" (Indicator: "system32\drivers"; Source: "00000000-00001484.00000000.67206.003A0000.00000004.mdmp, 00000000-00001484.00000001.69129.003A0000.00000004.mdmp, 00000000-00001484.00000002.71052.003A0000.00000004.mdmp") Found string "\Device\HarddiskVolume2\Windows\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll" (Indicator: "\Device\"; Source: "00000000-00001484.00000000.67206.003A0000.00000004.mdmp, 00000000-00001484.00000001.69129.003A0000.00000004.mdmp, 00000000-00001484.00000002.71052.003A0000.00000004.mdmp")60:T1038,Found string "Set-MpPreference -DisableRealtimeMonitoring $true" (Indicator: "Set-MpPreference"; Source: "00000000-00001484.00000000.67206.03360000.00000004.mdmp, 00000000-00001484.00000001.69129.03360000.00000004.mdmp, 00000000-00001484.00000002.71052.03360000.00000004.mdmp") Found string "Set-MpPreference -DisableBehaviorMonitoring $true" (Indicator: "Set-MpPreference"; Source: "00000000-00001484.00000000.67206.03360000.00000004.mdmp, 00000000-00001484.00000001.69129.03360000.00000004.mdmp, 00000000-00001484.00000002.71052.03360000.00000004.mdmp") Found string "Set-MpPreference -DisableBlockAtFirstSeen $true" (Indicator: "Set-MpPreference"; Source: "00000000-00001484.00000000.67206.03360000.00000004.mdmp, 00000000-00001484.00000001.69129.03360000.00000004.mdmp, 00000000-00001484.00000002.71052.03360000.00000004.mdmp") Found string "Set-MpPreference -DisableIOAVProtection $true" (Indicator: "Set-MpPreference"; Source: "00000000-00001484.00000000.67206.03360000.00000004.mdmp, 00000000-00001484.00000001.69129.03360000.00000004.mdmp, 00000000-00001484.00000002.71052.03360000.00000004.mdmp") Found string "Set-MpPreference -DisablePrivacyMode $true" (Indicator: "Set-MpPreference"; Source: "00000000-00001484.00000000.67206.03360000.00000004.mdmp, 00000000-00001484.00000001.69129.03360000.00000004.mdmp, 00000000-00001484.00000002.71052.03360000.00000004.mdmp") Found string "Set-MpPreference -SignatureDisableUpdateOnStartupWithoutEngine $true" (Indicator: "Set-MpPreference"; Source: "00000000-00001484.00000000.67206.03360000.00000004.mdmp, 00000000-00001484.00000001.69129.03360000.00000004.mdmp, 00000000-00001484.00000002.71052.03360000.00000004.mdmp") Found string "Set-MpPreference -DisableArchiveScanning $true" (Indicator: "Set-MpPreference"; Source: "00000000-00001484.00000000.67206.03360000.00000004.mdmp, 00000000-00001484.00000001.69129.03360000.00000004.mdmp, 00000000-00001484.00000002.71052.03360000.00000004.mdmp") Found string "Set-MpPreference -DisableIntrusionPreventionSystem $true" (Indicator: "Set-MpPreference"; Source: "00000000-00001484.00000000.67206.03360000.00000004.mdmp, 00000000-00001484.00000001.69129.03360000.00000004.mdmp, 00000000-00001484.00000002.71052.03360000.00000004.mdmp") Found string "Set-MpPreference -DisableScriptScanning $true" (Indicator: "Set-MpPreference"; Source: "00000000-00001484.00000000.67206.03360000.00000004.mdmp, 00000000-00001484.00000001.69129.03360000.00000004.mdmp, 00000000-00001484.00000002.71052.03360000.00000004.mdmp") Found string "Set-MpPreference -SubmitSamplesConsent 2" (Indicator: "Set-MpPreference"; Source: "00000000-00001484.00000000.67206.03360000.00000004.mdmp, 00000000-00001484.00000001.69129.03360000.00000004.mdmp, 00000000-00001484.00000002.71052.03360000.00000004.mdmp") Found string "Set-MpPreference -MAPSReporting 0" (Indicator: "Set-MpPreference"; Source: "00000000-00001484.00000000.67206.03360000.00000004.mdmp, 00000000-00001484.00000001.69129.03360000.00000004.mdmp, 00000000-00001484.00000002.71052.03360000.00000004.mdmp") Found string "Set-MpPreference -HighThreatDefaultAction 6 -Force" (Indicator: "Set-MpPreference"; Source: "00000000-00001484.00000000.67206.03360000.00000004.mdmp, 00000000-00001484.00000001.69129.03360000.00000004.mdmp, 00000000-00001484.00000002.71052.03360000.00000004.mdmp") Found string "Set-MpPreference -ModerateThreatDefaultAction 6" (Indicator: "Set-MpPreference"; Source: "00000000-00001484.00000000.67206.03360000.00000004.mdmp, 00000000-00001484.00000001.69129.03360000.00000004.mdmp, 00000000-00001484.00000002.71052.03360000.00000004.mdmp") Found string "Set-MpPreference -LowThreatDefaultAction 6" (Indicator: "Set-MpPreference"; Source: "00000000-00001484.00000000.67206.03360000.00000004.mdmp, 00000000-00001484.00000001.69129.03360000.00000004.mdmp, 00000000-00001484.00000002.71052.03360000.00000004.mdmp") Found string "Set-MpPreference -SevereThreatDefaultAction 6" (Indicator: "Set-MpPreference"; Source: "00000000-00001484.00000000.67206.03360000.00000004.mdmp, 00000000-00001484.00000001.69129.03360000.00000004.mdmp, 00000000-00001484.00000002.71052.03360000.00000004.mdmp")61:T11a2,Observed import api "AllocateAndInitializeSid" which can "Allocates and initializes a security identifier (SID) with up to eight subauthorities" [Source: d470377f9b683b10aa2230b05a5fcdcd.exe] Observed import api "EqualSid" which can "Tests two security identifier (SID) values for equality" [Source: d470377f9b683b10aa2230b05a5fcdcd.exe] Observed import api "FreeSid" which can "Frees a security identifier (SID) previously allocated by using the AllocateAndInitializeSid function" [Source: d470377f9b683b10aa2230b05a5fcdcd.exe] Observed import api "GetTokenInformation" which can "Retrieves a specified type of information about an access token" [Source: d470377f9b683b10aa2230b05a5fcdcd.exe] Observed import api "InitializeSid" which can "Initializes a security identifier (SID)" [Source: d470377f9b683b10aa2230b05a5fcdcd.exe] Observed import api "AllocateAndInitializeSid" which can "Allocates and initializes a security identifier (SID) with up to eight subauthorities" [Source: cv7VU08.exe] Observed import api "EqualSid" which can "Tests two security identifier (SID) values for equality" [Source: cv7VU08.exe] Observed import api "FreeSid" which can "Frees a security identifier (SID) previously allocated by using the AllocateAndInitializeSid function" [Source: cv7VU08.exe] Observed import api "GetTokenInformation" which can "Retrieves a specified type of information about an access token" [Source: cv7VU08.exe] Observed import api "InitializeSid" which can "Initializes a security identifier (SID)" [Source: cv7VU08.exe] Observed import api "AllocateAndInitializeSid" which can "Allocates and initializes a security identifier (SID) with up to eight subauthorities" [Source: Eh9VZ39.exe] Observed import api "EqualSid" which can "Tests two security identifier (SID) values for equality" [Source: Eh9VZ39.exe] Observed import api "FreeSid" which can "Frees a security identifier (SID) previously allocated by using the AllocateAndInitializeSid function" [Source: Eh9VZ39.exe] Observed import api "GetTokenInformation" which can "Retrieves a specified type of information about an access token" [Source: Eh9VZ39.exe] Observed import api "InitializeSid" which can "Initializes a security identifier (SID)" [Source: Eh9VZ39.exe] Observed import api "AddAce" which can "Adds one or more access control entries (ACEs) to a specified access control list (ACL)" [Source: 2GR5823.exe] Observed import api "AllocateAndInitializeSid" which can "Allocates and initializes a security identifier (SID) with up to eight subauthorities" [Source: 2GR5823.exe] Observed import api "CheckTokenMembership" which can "Determines whether a specified security identifier (SID) is enabled in an access token" [Source: 2GR5823.exe] Observed import api "CopySid" which can "Copies a security identifier (SID) to a buffer" [Source: 2GR5823.exe] Observed import api "DuplicateToken" which can "Creates a new access token that duplicates one already in existence" [Source: 2GR5823.exe] Observed import api "DuplicateTokenEx" which can "Creates a new access token that duplicates an existing token" [Source: 2GR5823.exe] Observed import api "FreeSid" which can "Frees a security identifier (SID) previously allocated by using the AllocateAndInitializeSid function" [Source: 2GR5823.exe] Observed import api "GetAce" which can "Obtains a pointer to an access control entry (ACE) in an access control list (ACL)" [Source: 2GR5823.exe] Observed import api "GetAclInformation" which can "Retrieves information about an access control list (ACL)" [Source: 2GR5823.exe] Observed import api "GetLengthSid" which can "Returns the length in bytes of a valid security identifier (SID)" [Source: 2GR5823.exe] Observed import api "GetSecurityDescriptorDacl" which can "Retrieves a pointer to the discretionary access control list (DACL) in a specified security descriptor" [Source: 2GR5823.exe] Observed import api "GetTokenInformation" which can "Retrieves a specified type of information about an access token" [Source: 2GR5823.exe] Observed import api "InitializeAcl" which can "Initializes a new ACL structure" [Source: 2GR5823.exe] Observed import api "InitializeSecurityDescriptor" which can "Initializes a new security descriptor" [Source: 2GR5823.exe] Observed import api "InitializeSid" which can "Initializes a security identifier (SID)" [Source: 2GR5823.exe] Observed import api "SetSecurityDescriptorDacl" which can "Sets information in a discretionary access control list (DACL)" [Source: 2GR5823.exe]62:T9ac,"5cN0su3.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS"; Key: "WINSOCK_REGISTRY_VERSION"; Value: "") "5cN0su3.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS"; Key: "NAMESPACE_CALLOUT"; Value: "") "5cN0su3.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9"; Key: "SERIAL_ACCESS_NUM"; Value: "") "5cN0su3.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9"; Key: "NEXT_CATALOG_ENTRY_ID"; Value: "") "5cN0su3.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9"; Key: "NUM_CATALOG_ENTRIES"; Value: "") "5cN0su3.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000001"; Key: "PACKEDCATALOGITEM"; Value: "") "5cN0su3.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000002"; Key: "PACKEDCATALOGITEM"; Value: "") "5cN0su3.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000003"; Key: "PACKEDCATALOGITEM"; Value: "") "5cN0su3.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000004"; Key: "PACKEDCATALOGITEM"; Value: "") "5cN0su3.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000005"; Key: "PACKEDCATALOGITEM"; Value: "") "5cN0su3.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000006"; Key: "PACKEDCATALOGITEM"; Value: "") "5cN0su3.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000007"; Key: "PACKEDCATALOGITEM"; Value: "") "5cN0su3.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000008"; Key: "PACKEDCATALOGITEM"; Value: "") "5cN0su3.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000009"; Key: "PACKEDCATALOGITEM"; Value: "")63:T1038,Found string "Set-MpPreference -DisableRealtimeMonitoring $true" (Indicator: "Set-MpPreference"; Source: "00000000-00001484.00000000.67206.03360000.00000004.mdmp, 00000000-00001484.00000001.69129.03360000.00000004.mdmp, 00000000-00001484.00000002.71052.03360000.00000004.mdmp") Found string "Set-MpPreference -DisableBehaviorMonitoring $true" (Indicator: "Set-MpPreference"; Source: "00000000-00001484.00000000.67206.03360000.00000004.mdmp, 00000000-00001484.00000001.69129.03360000.00000004.mdmp, 00000000-00001484.00000002.71052.03360000.00000004.mdmp") Found string "Set-MpPreference -DisableBlockAtFirstSeen $true" (Indicator: "Set-MpPreference"; Source: "00000000-00001484.00000000.67206.03360000.00000004.mdmp, 00000000-00001484.00000001.69129.03360000.00000004.mdmp, 00000000-00001484.00000002.71052.03360000.00000004.mdmp") Found string "Set-MpPreference -DisableIOAVProtection $true" (Indicator: "Set-MpPreference"; Source: "00000000-00001484.00000000.67206.03360000.00000004.mdmp, 00000000-00001484.00000001.69129.03360000.00000004.mdmp, 00000000-00001484.00000002.71052.03360000.00000004.mdmp") Found string "Set-MpPreference -DisablePrivacyMode $true" (Indicator: "Set-MpPreference"; Source: "00000000-00001484.00000000.67206.03360000.00000004.mdmp, 00000000-00001484.00000001.69129.03360000.00000004.mdmp, 00000000-00001484.00000002.71052.03360000.00000004.mdmp") Found string "Set-MpPreference -SignatureDisableUpdateOnStartupWithoutEngine $true" (Indicator: "Set-MpPreference"; Source: "00000000-00001484.00000000.67206.03360000.00000004.mdmp, 00000000-00001484.00000001.69129.03360000.00000004.mdmp, 00000000-00001484.00000002.71052.03360000.00000004.mdmp") Found string "Set-MpPreference -DisableArchiveScanning $true" (Indicator: "Set-MpPreference"; Source: "00000000-00001484.00000000.67206.03360000.00000004.mdmp, 00000000-00001484.00000001.69129.03360000.00000004.mdmp, 00000000-00001484.00000002.71052.03360000.00000004.mdmp") Found string "Set-MpPreference -DisableIntrusionPreventionSystem $true" (Indicator: "Set-MpPreference"; Source: "00000000-00001484.00000000.67206.03360000.00000004.mdmp, 00000000-00001484.00000001.69129.03360000.00000004.mdmp, 00000000-00001484.00000002.71052.03360000.00000004.mdmp") Found string "Set-MpPreference -DisableScriptScanning $true" (Indicator: "Set-MpPreference"; Source: "00000000-00001484.00000000.67206.03360000.00000004.mdmp, 00000000-00001484.00000001.69129.03360000.00000004.mdmp, 00000000-00001484.00000002.71052.03360000.00000004.mdmp") Found string "Set-MpPreference -SubmitSamplesConsent 2" (Indicator: "Set-MpPreference"; Source: "00000000-00001484.00000000.67206.03360000.00000004.mdmp, 00000000-00001484.00000001.69129.03360000.00000004.mdmp, 00000000-00001484.00000002.71052.03360000.00000004.mdmp") Found string "Set-MpPreference -MAPSReporting 0" (Indicator: "Set-MpPreference"; Source: "00000000-00001484.00000000.67206.03360000.00000004.mdmp, 00000000-00001484.00000001.69129.03360000.00000004.mdmp, 00000000-00001484.00000002.71052.03360000.00000004.mdmp") Found string "Set-MpPreference -HighThreatDefaultAction 6 -Force" (Indicator: "Set-MpPreference"; Source: "00000000-00001484.00000000.67206.03360000.00000004.mdmp, 00000000-00001484.00000001.69129.03360000.00000004.mdmp, 00000000-00001484.00000002.71052.03360000.00000004.mdmp") Found string "Set-MpPreference -ModerateThreatDefaultAction 6" (Indicator: "Set-MpPreference"; Source: "00000000-00001484.00000000.67206.03360000.00000004.mdmp, 00000000-00001484.00000001.69129.03360000.00000004.mdmp, 00000000-00001484.00000002.71052.03360000.00000004.mdmp") Found string "Set-MpPreference -LowThreatDefaultAction 6" (Indicator: "Set-MpPreference"; Source: "00000000-00001484.00000000.67206.03360000.00000004.mdmp, 00000000-00001484.00000001.69129.03360000.00000004.mdmp, 00000000-00001484.00000002.71052.03360000.00000004.mdmp") Found string "Set-MpPreference -SevereThreatDefaultAction 6" (Indicator: "Set-MpPreference"; Source: "00000000-00001484.00000000.67206.03360000.00000004.mdmp, 00000000-00001484.00000001.69129.03360000.00000004.mdmp, 00000000-00001484.00000002.71052.03360000.00000004.mdmp")64:T429,"cv7VU08.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP000.TMP\cv7VU08.exe]- [targetUID: 00000000-00003280] "Eh9VZ39.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP001.TMP\Eh9VZ39.exe]- [targetUID: 00000000-00004044] "5cN0su3.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP002.TMP\5cN0su3.exe]- [targetUID: 00000000-00004044] "2GR5823.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP002.TMP\2GR5823.exe]- [targetUID: 00000000-00002340] "6AT6wL0.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP001.TMP\6AT6wL0.exe]- [targetUID: 00000000-00001540] "7gT2oH15.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP000.TMP\7gT2oH15.exe]- [targetUID: 00000000-00003280] "FANBooster131.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\FANBooster131\FANBooster131.exe]- [targetUID: 00000000-00001484]65:T148e,Dropped file: "FANBooster131.lnk" - Location: [%APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\FANBooster131.lnk]- [targetUID: 00000000-00001484] Dropped file: "YWFOO1FA.htm" - Location: [%LOCALAPPDATA%\Microsoft\Windows\Temporary Internet Files\Content.IE5\CKDNCXYS\YWFOO1FA.htm]- [targetUID: 00000000-00003264] Dropped file: "en-US.4" - Location: [%LOCALAPPDATA%\Microsoft\Internet Explorer\DomainSuggestions\en-US.4]- [targetUID: 00000000-00001404] Dropped file: "70DAE932E3BCB3C00656A27B544BA9CA" - Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\70DAE932E3BCB3C00656A27B544BA9CA]- [targetUID: 00000000-00001356] Dropped file: "C88418EDBE65AF3960916D9E8011370D" - Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\C88418EDBE65AF3960916D9E8011370D]- [targetUID: 00000000-00003812] Dropped file: "imagestore.dat" - Location: [%LOCALAPPDATA%\Microsoft\Internet Explorer\imagestore\3mt7jhv\imagestore.dat]- [targetUID: 00000000-00003812] Dropped file: "HYPJEWEFN94RHMBSVEW0.temp" - Location: [%APPDATA%\Microsoft\Windows\Recent\CustomDestinations\HYPJEWEFN94RHMBSVEW0.temp]- [targetUID: 00000000-00003228] Dropped file: "57C8EDB95DF3F0AD4EE2DC2B8CFD4157" - Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\57C8EDB95DF3F0AD4EE2DC2B8CFD4157]- [targetUID: 00000000-00001356] Dropped file: "24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA" - Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA]- [targetUID: 00000000-00003812] Dropped file: "4748633DC5731827D4B432DBAC7A3ECE" - Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\4748633DC5731827D4B432DBAC7A3ECE]- [targetUID: 00000000-00003812] Dropped file: "CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA" - Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA]- [targetUID: 00000000-00003812] Dropped file: "VUQHIPEV.txt" - Location: [%APPDATA%\Microsoft\Windows\Cookies\VUQHIPEV.txt]- [targetUID: 00000000-00001356] Dropped file: "E87CE99F124623F95572A696C80EFCAF_9FBD3BA6168F3C4317F2AAB1E548FE96" - Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\E87CE99F124623F95572A696C80EFCAF_9FBD3BA6168F3C4317F2AAB1E548FE96]- [targetUID: 00000000-00003812] Dropped file: "35DDEDF268117918D1D277A171D8DF7B_CEEA988A949E786F186C7AE5E6F84BAD" - Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\35DDEDF268117918D1D277A171D8DF7B_CEEA988A949E786F186C7AE5E6F84BAD]- [targetUID: 00000000-00003392] Dropped file: "80237EE4964FC9C409AAF55BF996A292_D46D6FA25B74360E1349F9015B5CCE53" - Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\80237EE4964FC9C409AAF55BF996A292_D46D6FA25B74360E1349F9015B5CCE53]- [targetUID: 00000000-00003264] Dropped file: "E2C6CBAF0AF08CF203BA74BF0D0AB6D5_0FB9553B978E7F00C6B2309507DEB64A" - Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_0FB9553B978E7F00C6B2309507DEB64A]- [targetUID: 00000000-00003264] Dropped file: "80237EE4964FC9C409AAF55BF996A292_C5130A0BDC8C859A2757D77746C10868" - Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\80237EE4964FC9C409AAF55BF996A292_C5130A0BDC8C859A2757D77746C10868]- [targetUID: 00000000-00003264] Dropped file: "F07644E38ED7C9F37D11EEC6D4335E02_EC50BC49A28D68A36F5274F1BD1417C1" - Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\F07644E38ED7C9F37D11EEC6D4335E02_EC50BC49A28D68A36F5274F1BD1417C1]- [targetUID: 00000000-00001356] Dropped file: "F2DDCD2B5F37625B82E81F4976CEE400_BFB422D89E28A298A60024A8D8A2EA06" - Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\F2DDCD2B5F37625B82E81F4976CEE400_BFB422D89E28A298A60024A8D8A2EA06]- [targetUID: 00000000-00001356] Dropped file: "7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776" - Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776]- [targetUID: 00000000-00003812] Dropped file: "35DDEDF268117918D1D277A171D8DF7B_8F4E63DF7A6F59A07180A072992A7C81" - Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\35DDEDF268117918D1D277A171D8DF7B_8F4E63DF7A6F59A07180A072992A7C81]- [targetUID: 00000000-00003392] Dropped file: "EDC238BFF48A31D55A97E1E93892934B_C20E0DA2D0F89FE526E1490F4A2EE5AB" - Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\EDC238BFF48A31D55A97E1E93892934B_C20E0DA2D0F89FE526E1490F4A2EE5AB]- [targetUID: 00000000-00003392] Dropped file: "68PY1XKX.txt" - Location: [%APPDATA%\Microsoft\Windows\Cookies\68PY1XKX.txt]- [targetUID: 00000000-00003264] Dropped file: "35DDEDF268117918D1D277A171D8DF7B_CEEA988A949E786F186C7AE5E6F84BAD" - Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\MetaData\35DDEDF268117918D1D277A171D8DF7B_CEEA988A949E786F186C7AE5E6F84BAD]- [targetUID: 00000000-00003392] Dropped file: "E2C6CBAF0AF08CF203BA74BF0D0AB6D5_0FB9553B978E7F00C6B2309507DEB64A" - Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_0FB9553B978E7F00C6B2309507DEB64A]- [targetUID: 00000000-00003264]66:T8004,"initAft()