24:I[7638,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/136wug8odqdqr.js"],"SampleDetailWrapper"] 63:I[27201,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 23:T481,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Crifi.Generic Sample 4c75a2e2511e… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 4c75a2e2511e…. Malware family: Crifi.Generic. Threat score 100/100. 12/28 AV engines flagged this file. 15 malicious and 17 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/4c75a2e2511e44061424cc86123e1ea5dc4f7c8aadebc5c3bdebbe746175b2c6","keywords":["Malicious","Crifi.Generic","malware analysis","sandbox report","threat intelligence","4c75a2e2511e44061424cc86123e1ea5dc4f7c8aadebc5c3bdebbe746175b2c6"],"about":{"@type":"SoftwareApplication","name":"file.exe","applicationCategory":["peexe","executable"],"identifier":"4c75a2e2511e44061424cc86123e1ea5dc4f7c8aadebc5c3bdebbe746175b2c6","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Crifi.Generic","antivirusDetections":{"malicious":12,"total":28},"behavioralIndicators":{"malicious":15,"suspicious":17},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}25:T25c4,Found reference to API (Indicator: "DosDateTimeToFileTime"; Source: "sample.bin"), Found reference to API (Indicator: "DeleteFileA"; Source: "sample.bin"), Found reference to API (Indicator: "AdjustTokenPrivileges"; Source: "sample.bin"), Found reference to API (Indicator: "MulDiv"; Source: "sample.bin"), Found reference to API (Indicator: "GetFileAttributesA"; Source: "sample.bin"), Found reference to API (Indicator: "SetForegroundWindow"; Source: "sample.bin"), Found reference to API (Indicator: "SeShutdownPrivilege"; Source: "sample.bin"), Found reference to API (Indicator: "GetPrivateProfileIntA"; Source: "sample.bin"), Found reference to API (Indicator: "GetExitCodeProcess"; Source: "sample.bin"), Found reference to API (Indicator: "FreeSid"; Source: "sample.bin"), Found reference to API (Indicator: "SetEvent"; Source: "sample.bin"), Found reference to API (Indicator: "GetSystemDirectoryA"; Source: "sample.bin"), Found reference to API (Indicator: "CreateDirectoryA"; Source: "sample.bin"), Found reference to API (Indicator: "GetDriveTypeA"; Source: "sample.bin"), Found reference to API (Indicator: "GlobalFree"; Source: "sample.bin"), Found reference to API (Indicator: "LoadLibraryA"; Source: "sample.bin"), Found reference to API (Indicator: "EqualSid"; Source: "sample.bin"), Found reference to API (Indicator: "CreateThread"; Source: "sample.bin"), Found reference to API (Indicator: "GetFileVersionInfoSizeA"; Source: "sample.bin"), Found reference to API (Indicator: "GetModuleHandleW"; Source: "sample.bin"), Found reference to API (Indicator: "DecryptFileA"; Source: "sample.bin"), Found reference to API (Indicator: "RegQueryValueExA"; Source: "sample.bin"), Found reference to API (Indicator: "GetCurrentProcessId"; Source: "sample.bin"), Found reference to API (Indicator: "RegSetValueExA"; Source: "sample.bin"), Found reference to API (Indicator: "FormatMessageA"; Source: "sample.bin"), Found reference to API (Indicator: "GetStartupInfoW"; Source: "sample.bin"), Found reference to API (Indicator: "GetCurrentDirectoryA"; Source: "sample.bin"), Found reference to API (Indicator: "SetFileAttributesA"; Source: "sample.bin"), Found reference to API (Indicator: "RegOpenKeyExA"; Source: "sample.bin"), Found reference to API (Indicator: "GetDesktopWindow"; Source: "sample.bin"), Found reference to API (Indicator: "CharNextA"; Source: "sample.bin"), Found reference to API (Indicator: "SetWindowPos"; Source: "sample.bin"), Found reference to API (Indicator: "ShowWindow"; Source: "sample.bin"), Found reference to API (Indicator: "GetSystemInfo"; Source: "sample.bin"), Found reference to API (Indicator: "SendMessageA"; Source: "sample.bin"), Found reference to API (Indicator: "UnhandledExceptionFilter"; Source: "sample.bin"), Found reference to API (Indicator: "VerQueryValueA"; Source: "sample.bin"), Found reference to API (Indicator: "DispatchMessageA"; Source: "sample.bin"), Found reference to API (Indicator: "GetWindowLongA"; Source: "sample.bin"), Found reference to API (Indicator: "LookupPrivilegeValueA"; Source: "sample.bin"), Found reference to API (Indicator: "FindFirstFileA"; Source: "sample.bin"), Found reference to API (Indicator: "GetProcAddress"; Source: "sample.bin"), Found reference to API (Indicator: "CreateMutexA"; Source: "sample.bin"), Found reference to API (Indicator: "CreateFileA"; Source: "sample.bin"), Found reference to API (Indicator: "GlobalAlloc"; Source: "sample.bin"), Found reference to API (Indicator: "CheckTokenMembership"; Source: "sample.bin"), Found reference to API (Indicator: "SetFileTime"; Source: "sample.bin"), Found reference to API (Indicator: "RegCloseKey"; Source: "sample.bin"), Found reference to API (Indicator: "GetTempPathA"; Source: "sample.bin"), Found reference to API (Indicator: "GetTokenInformation"; Source: "sample.bin"), Found reference to API (Indicator: "SizeofResource"; Source: "sample.bin"), Found reference to API (Indicator: "ResetEvent"; Source: "sample.bin"), Found reference to API (Indicator: "RemoveDirectoryA"; Source: "sample.bin"), Found reference to API (Indicator: "SetUnhandledExceptionFilter"; Source: "sample.bin"), Found reference to API (Indicator: "GlobalLock"; Source: "sample.bin"), Found reference to API (Indicator: "FindClose"; Source: "sample.bin"), Found reference to API (Indicator: "LocalFileTimeToFileTime"; Source: "sample.bin"), Found reference to API (Indicator: "IsDBCSLeadByte"; Source: "sample.bin"), Found reference to API (Indicator: "GetTickCount"; Source: "sample.bin"), Found reference to API (Indicator: "SetCurrentDirectoryA"; Source: "sample.bin"), Found reference to API (Indicator: "GetDC"; Source: "sample.bin"), Found reference to API (Indicator: "MsgWaitForMultipleObjects"; Source: "sample.bin"), Found reference to API (Indicator: "SetFilePointer"; Source: "sample.bin"), Found reference to API (Indicator: "GetShortPathNameA"; Source: "sample.bin"), Found reference to API (Indicator: "GetPrivateProfileStringA"; Source: "sample.bin"), Found reference to API (Indicator: "TerminateThread"; Source: "sample.bin"), Found reference to API (Indicator: "FreeResource"; Source: "sample.bin"), Found reference to API (Indicator: "lstrcmpA"; Source: "sample.bin"), Found reference to API (Indicator: "ExitProcess"; Source: "sample.bin"), Found reference to API (Indicator: "EnumResourceLanguagesA"; Source: "sample.bin"), Found reference to API (Indicator: "WritePrivateProfileStringA"; Source: "sample.bin"), Found reference to API (Indicator: "GetVolumeInformationA"; Source: "sample.bin"), Found reference to API (Indicator: "GetCurrentThreadId"; Source: "sample.bin"), Found reference to API (Indicator: "MessageBoxA"; Source: "sample.bin"), Found reference to API (Indicator: "SHBrowseForFolder"; Source: "sample.bin"), Found reference to API (Indicator: "GetModuleFileNameA"; Source: "sample.bin"), Found reference to API (Indicator: "GetCurrentProcess"; Source: "sample.bin"), Found reference to API (Indicator: "CharUpperA"; Source: "sample.bin"), Found reference to API (Indicator: "LocalFree"; Source: "sample.bin"), Found reference to API (Indicator: "LoadLibraryExA"; Source: "sample.bin"), Found reference to API (Indicator: "QueryPerformanceCounter"; Source: "sample.bin"), Found reference to API (Indicator: "RegDeleteValueA"; Source: "sample.bin"), Found reference to API (Indicator: "GetWindowRect"; Source: "sample.bin"), Found reference to API (Indicator: "CharPrevA"; Source: "sample.bin"), Found reference to API (Indicator: "GetDeviceCaps"; Source: "sample.bin"), Found reference to API (Indicator: "ReleaseDC"; Source: "sample.bin"), Found reference to API (Indicator: "HeapSetInformation"; Source: "sample.bin"), Found reference to API (Indicator: "GetSystemTimeAsFileTime"; Source: "sample.bin"), Found reference to API (Indicator: "SetWindowTextA"; Source: "sample.bin"), Found reference to API (Indicator: "ExpandEnvironmentStringsA"; Source: "sample.bin"), Found reference to API (Indicator: "AllocateAndInitializeSid"; Source: "sample.bin"), Found reference to API (Indicator: "EnableWindow"; Source: "sample.bin"), Found reference to API (Indicator: "PeekMessageA"; Source: "sample.bin"), Found reference to API (Indicator: "GetVersionExA"; Source: "sample.bin"), Found reference to API (Indicator: "LocalAlloc"; Source: "sample.bin"), Found reference to API (Indicator: "CreateEventA"; Source: "sample.bin"), Found reference to API (Indicator: "GetFileVersionInfoA"; Source: "sample.bin"), Found reference to API (Indicator: "GlobalUnlock"; Source: "sample.bin"), Found reference to API (Indicator: "RegQueryInfoKeyA"; Source: "sample.bin"), Found reference to API (Indicator: "CompareStringA"; Source: "sample.bin"), Found reference to API (Indicator: "WriteFile"; Source: "sample.bin"), Found reference to API (Indicator: "Sleep"; Source: "sample.bin"), Found reference to API (Indicator: "LoadStringA"; Source: "sample.bin"), Found reference to API (Indicator: "LoadResource"; Source: "sample.bin"), Found reference to API (Indicator: "TerminateProcess"; Source: "sample.bin"), Found reference to API (Indicator: "CreateProcessA"; Source: "sample.bin"), Found reference to API (Indicator: "FreeLibrary"; Source: "sample.bin"), Found reference to API (Indicator: "SHGetPathFromIDList"; Source: "sample.bin"), Found reference to API (Indicator: "RegCreateKeyExA"; Source: "sample.bin"), Found reference to API (Indicator: "MessageBeep"; Source: "sample.bin"), Found reference to API (Indicator: "FindNextFileA"; Source: "sample.bin"), Found reference to API (Indicator: "SetWindowLongA"; Source: "sample.bin"), Found reference to API (Indicator: "ReadFile"; Source: "sample.bin"), Found reference to API (Indicator: "CallWindowProcA"; Source: "sample.bin"), Found reference to API (Indicator: "OpenProcessToken"; Source: "sample.bin"), Found reference to API (Indicator: "ExitWindowsEx"; Source: "sample.bin"), Found reference to API (Indicator: "GetTempFileNameA"; Source: "sample.bin"), Found reference to API (Indicator: "GetVersion"; Source: "sample.bin"), Found reference to API (Indicator: "GetLastError"; Source: "sample.bin"), Found reference to API (Indicator: "LockResource"; Source: "sample.bin"), Found reference to API (Indicator: "GetDiskFreeSpaceA"; Source: "sample.bin"), Found reference to API (Indicator: "GetWindowsDirectoryA"; Source: "sample.bin"), Found reference to API (Indicator: "GetSystemMetrics"; Source: "sample.bin"), Found reference to API (Indicator: "WaitForSingleObject"; Source: "sample.bin"), Found reference to API (Indicator: "CloseHandle"; Source: "sample.bin"), Found reference to API (Indicator: "FindResourceA"; Source: "sample.bin")26:T42c,file/memory contains long string(File: "5jR9Wp3.exe") Found string "unknown compression method" (Source: "00000000-00002464.00000000.79701.00413000.00000002.mdmp") Found string "system.io.compression.dll" (Source: "00000000-00004180.00000000.79355.00410000.00000004.mdmp") Found string "clrcompression.dll" (Source: "00000000-00004180.00000000.79355.00410000.00000004.mdmp") Found string "system.io.compression.filesystem.dll" (Source: "00000000-00004180.00000000.79355.00410000.00000004.mdmp") Found string "system.io.compression.zipfile.dll" (Source: "00000000-00004180.00000000.79355.00410000.00000004.mdmp") Found string "system.io.compression.dll" (Source: "00000000-00004188.00000000.79023.00440000.00000004.mdmp") Found string "clrcompression.dll" (Source: "00000000-00004188.00000000.79023.00440000.00000004.mdmp") Found string "system.io.compression.filesystem.dll" (Source: "00000000-00004188.00000000.79023.00440000.00000004.mdmp") Found string "system.io.compression.zipfile.dll" (Source: "00000000-00004188.00000000.79023.00440000.00000004.mdmp")27:T48c,"4c75a2e2511e44061424cc86123e1ea5dc4f7c8aadebc5c3bdebbe746175b2c6.exe" called "FindResourceA" with parameter "3740368" - (UID: 00000000-00005732) "4c75a2e2511e44061424cc86123e1ea5dc4f7c8aadebc5c3bdebbe746175b2c6.exe" called "FindResourceA" with parameter "3740408" - (UID: 00000000-00005732) "4c75a2e2511e44061424cc86123e1ea5dc4f7c8aadebc5c3bdebbe746175b2c6.exe" called "FindResourceA" with parameter "3740424" - (UID: 00000000-00005732) "ei4JY63.exe" called "FindResourceA" with parameter "19927760" - (UID: 00000000-00005348) "ei4JY63.exe" called "FindResourceA" with parameter "19927800" - (UID: 00000000-00005348) "ei4JY63.exe" called "FindResourceA" with parameter "19927816" - (UID: 00000000-00005348) "BC6EJ61.exe" called "FindResourceA" with parameter "9310928" - (UID: 00000000-00005720) "BC6EJ61.exe" called "FindResourceA" with parameter "9310968" - (UID: 00000000-00005720) "BC6EJ61.exe" called "FindResourceA" with parameter "9310984" - (UID: 00000000-00005720) "Bw1Vp89.exe" called "FindResourceA" with parameter "19862224" - (UID: 00000000-00005724) "Bw1Vp89.exe" called "FindResourceA" with parameter "19862264" - (UID: 00000000-00005724)28:T827,"4c75a2e2511e44061424cc86123e1ea5dc4f7c8aadebc5c3bdebbe746175b2c6.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '3786864'}" (UID: 00000000-00005732) "4c75a2e2511e44061424cc86123e1ea5dc4f7c8aadebc5c3bdebbe746175b2c6.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '3786816'}" (UID: 00000000-00005732) "4c75a2e2511e44061424cc86123e1ea5dc4f7c8aadebc5c3bdebbe746175b2c6.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '3786768'}" (UID: 00000000-00005732) "ei4JY63.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '19974256'}" (UID: 00000000-00005348) "ei4JY63.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '19974208'}" (UID: 00000000-00005348) "ei4JY63.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '19974160'}" (UID: 00000000-00005348) "BC6EJ61.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '9357424'}" (UID: 00000000-00005720) "BC6EJ61.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '9357376'}" (UID: 00000000-00005720) "BC6EJ61.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '9357328'}" (UID: 00000000-00005720) "Bw1Vp89.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '19908720'}" (UID: 00000000-00005724) "Bw1Vp89.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '19908672'}" (UID: 00000000-00005724) "Bw1Vp89.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '19908624'}" (UID: 00000000-00005724) "AppLaunch.exe" called "LoadResource with parameter {'hModule': '1657995264', 'hResInfo': '1659036024'}" (UID: 00000000-00004136) "AppLaunch.exe" called "LoadResource with parameter {'hModule': '1657995264', 'hResInfo': '1659036008'}" (UID: 00000000-00004136) "5jR9Wp3.exe" called "LoadResource with parameter {'hModule': '4194304', 'hResInfo': '4296944'}" (UID: 00000000-00002464) "5jR9Wp3.exe" called "LoadResource with parameter {'hModule': '4194304', 'hResInfo': '4296960'}" (UID: 00000000-00002464)29:T672,"cmd.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\DESKTOP\NAMESPACE\{138508BC-1E03-49EA-9C8F-EA9E1D05D65D}") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\DESKTOP\NAMESPACE\{138508BC-1E03-49EA-9C8F-EA9E1D05D65D}") "cmd.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\DESKTOP\NAMESPACE") "cmd.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\DESKTOP\NAMESPACE\DELEGATEFOLDERS") "cmd.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\DESKTOP\NAMESPACE\DELEGATEFOLDERS") "cmd.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER") "cmd.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\SESSIONINFO\1") "cmd.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\SESSIONINFO\1\DESKTOP\NAMESPACE") "cmd.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\SESSIONINFO\1\DESKTOP\NAMESPACE\DELEGATEFOLDERS") "cmd.exe" (Access type: "OPEN"; Path: "HKCU\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\SHELLFOLDER") "cmd.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\SHELLFOLDER") "cmd.exe" (Access type: "QUERY"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\SHELLFOLDER") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\SHELLFOLDER")2a:T521,SetUnhandledExceptionFilter@KERNEL32.DLL at 00000000-00005724-53966-7-012F6F40 SetUnhandledExceptionFilter@KERNEL32.DLL at 00000000-00005724-53966-10-012F6CF0 SetUnhandledExceptionFilter@KERNEL32.DLL at 00000000-00006044-55011-1274-00EF67D5 SetUnhandledExceptionFilter@KERNEL32.DLL at 00000000-00006044-55011-1350-00EF8DF3 SetUnhandledExceptionFilter@KERNEL32.DLL at 00000000-00006044-55011-1658-00EF65BB SetUnhandledExceptionFilter@KERNEL32.DLL at 00000000-00006044-55011-2467-00EF6720 SetUnhandledExceptionFilter@KERNEL32.DLL at 00000000-00004188-56710-420-00E667D5 SetUnhandledExceptionFilter@KERNEL32.DLL at 00000000-00004188-56710-496-00E68DF3 SetUnhandledExceptionFilter@KERNEL32.DLL at 00000000-00004188-56710-804-00E665BB SetUnhandledExceptionFilter@KERNEL32.DLL at 00000000-00004188-56710-1258-00E66713 SetUnhandledExceptionFilter@KERNEL32.DLL at 00000000-00004180-57549-955-00A267D5 SetUnhandledExceptionFilter@KERNEL32.DLL at 00000000-00004180-57549-1031-00A28DF3 SetUnhandledExceptionFilter@KERNEL32.DLL at 00000000-00004180-57549-1339-00A265BB SetUnhandledExceptionFilter@KERNEL32.DLL at 00000000-00004180-57549-2035-00A26720 SetUnhandledExceptionFilter@KERNEL32.DLL at 00000000-00002464-58652-74-00409FD0 SetUnhandledExceptionFilter@KERNEL32.DLL at 00000000-00002464-58652-75-00409FB02b:T131e,Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00005724-53966-15-012F1F90 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00005724-53966-15-012F1F90 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00005724-53966-16-012F44B9 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00005724-53966-16-012F44B9 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00005724-53966-22-012F681F Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00005724-53966-22-012F681F Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00005724-53966-26-012F24E0 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00005724-53966-26-012F24E0 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00005724-53966-29-012F52B6 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00005724-53966-29-012F52B6 Assembly shows XOR instruction xor eax esp in Stream UID: 00000000-00005724-53966-31-012F2390 Assembly shows XOR instruction xor ecx esp in Stream UID: 00000000-00005724-53966-31-012F2390 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00005724-53966-33-012F2F1D Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00005724-53966-33-012F2F1D Assembly shows XOR instruction xor eax esp in Stream UID: 00000000-00005724-53966-36-012F3BA2 Assembly shows XOR instruction xor ecx esp in Stream UID: 00000000-00005724-53966-36-012F3BA2 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00005724-53966-37-012F3FEF Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00005724-53966-37-012F3FEF Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00005724-53966-40-012F2267 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00005724-53966-40-012F2267 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00005724-53966-41-012F6495 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00005724-53966-41-012F6495 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00005724-53966-42-012F202A Assembly shows XOR instruction xor eax 01h in Stream UID: 00000000-00005724-53966-42-012F202A Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00005724-53966-42-012F202A Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00005724-53966-43-012F1AE8 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00005724-53966-43-012F1AE8 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00005724-53966-44-012F2AAC Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00005724-53966-44-012F2AAC Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00005724-53966-52-012F4EFD Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00005724-53966-52-012F4EFD Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00005724-53966-57-012F6298 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00005724-53966-57-012F6298 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00005724-53966-59-012F621E Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00005724-53966-59-012F621E Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00005724-53966-60-012F597D Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00005724-53966-60-012F597D Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00005724-53966-62-012F55A0 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00005724-53966-62-012F55A0 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00005724-53966-63-012F5467 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00005724-53966-63-012F5467 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00005724-53966-65-012F53A1 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00005724-53966-65-012F53A1 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00005724-53966-66-012F2630 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00005724-53966-66-012F2630 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00005724-53966-71-012F2CAA Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00005724-53966-71-012F2CAA Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00005724-53966-72-012F18A3 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00005724-53966-72-012F18A3 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00005724-53966-73-012F17EE Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00005724-53966-73-012F17EE2c:T2cb6,Contains base64 string in header "Keep" in header "GET /r/gsr1.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: c.pki.goog" Contains base64 string in header "User" in header "GET /r/gsr1.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: c.pki.goog" Contains base64 string in header "goog" in header "GET /r/gsr1.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: c.pki.goog" Contains base64 string in header "Keep" in header "GET /r/r4.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: c.pki.goog" Contains base64 string in header "User" in header "GET /r/r4.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: c.pki.goog" Contains base64 string in header "goog" in header "GET /r/r4.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: c.pki.goog" Contains base64 string in header "/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEA59dSNcqDdhV39MzSTNbR0" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEA59dSNcqDdhV39MzSTNbR0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.cn" Contains base64 string in header "Keep" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEA59dSNcqDdhV39MzSTNbR0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.cn" Contains base64 string in header "User" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEA59dSNcqDdhV39MzSTNbR0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.cn" Contains base64 string in header "ocsp" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEA59dSNcqDdhV39MzSTNbR0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.cn" Contains base64 string in header "digicert" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEA59dSNcqDdhV39MzSTNbR0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.cn" Contains base64 string in header "/we2/yK5nPhtHKQs" in header "GET /we2/yK5nPhtHKQs.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: c.pki.goog" Contains base64 string in header "Keep" in header "GET /we2/yK5nPhtHKQs.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: c.pki.goog" Contains base64 string in header "User" in header "GET /we2/yK5nPhtHKQs.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: c.pki.goog" Contains base64 string in header "goog" in header "GET /we2/yK5nPhtHKQs.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: c.pki.goog" Contains base64 string in header "Keep" in header "GET /we2/xuzt3PU9F_w.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: c.pki.goog" Contains base64 string in header "User" in header "GET /we2/xuzt3PU9F_w.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: c.pki.goog" Contains base64 string in header "goog" in header "GET /we2/xuzt3PU9F_w.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: c.pki.goog" Contains base64 string in header "Keep" in header "GET /we2/dTM3-0hpWfE.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: c.pki.goog" Contains base64 string in header "User" in header "GET /we2/dTM3-0hpWfE.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: c.pki.goog" Contains base64 string in header "goog" in header "GET /we2/dTM3-0hpWfE.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: c.pki.goog" Contains base64 string in header "Keep" in header "GET /r/r1.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: c.pki.goog" Contains base64 string in header "User" in header "GET /r/r1.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: c.pki.goog" Contains base64 string in header "goog" in header "GET /r/r1.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: c.pki.goog" Contains base64 string in header "/wr2/oBFYYahzgVI" in header "GET /wr2/oBFYYahzgVI.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: c.pki.goog" Contains base64 string in header "Keep" in header "GET /wr2/oBFYYahzgVI.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: c.pki.goog" Contains base64 string in header "User" in header "GET /wr2/oBFYYahzgVI.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: c.pki.goog" Contains base64 string in header "goog" in header "GET /wr2/oBFYYahzgVI.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: c.pki.goog" Contains base64 string in header "Keep" in header "GET /r/gsr1.crl HTTP/1.1Cache-Control: max-age = 3000Connection: Keep-AliveAccept: */*If-Modified-Since: Tue, 07 Jul 2026 08:38:00 GMTUser-Agent: Microsoft-CryptoAPI/6.1Host: c.pki.goog" Contains base64 string in header "Modified" in header "GET /r/gsr1.crl HTTP/1.1Cache-Control: max-age = 3000Connection: Keep-AliveAccept: */*If-Modified-Since: Tue, 07 Jul 2026 08:38:00 GMTUser-Agent: Microsoft-CryptoAPI/6.1Host: c.pki.goog" Contains base64 string in header "2026" in header "GET /r/gsr1.crl HTTP/1.1Cache-Control: max-age = 3000Connection: Keep-AliveAccept: */*If-Modified-Since: Tue, 07 Jul 2026 08:38:00 GMTUser-Agent: Microsoft-CryptoAPI/6.1Host: c.pki.goog" Contains base64 string in header "goog" in header "GET /r/gsr1.crl HTTP/1.1Cache-Control: max-age = 3000Connection: Keep-AliveAccept: */*If-Modified-Since: Tue, 07 Jul 2026 08:38:00 GMTUser-Agent: Microsoft-CryptoAPI/6.1Host: c.pki.goog" Contains base64 string in header "Keep" in header "GET /r/r4.crl HTTP/1.1Cache-Control: max-age = 3000Connection: Keep-AliveAccept: */*If-Modified-Since: Wed, 11 Feb 2026 14:38:00 GMTUser-Agent: Microsoft-CryptoAPI/6.1Host: c.pki.goog" Contains base64 string in header "Modified" in header "GET /r/r4.crl HTTP/1.1Cache-Control: max-age = 3000Connection: Keep-AliveAccept: */*If-Modified-Since: Wed, 11 Feb 2026 14:38:00 GMTUser-Agent: Microsoft-CryptoAPI/6.1Host: c.pki.goog" Contains base64 string in header "2026" in header "GET /r/r4.crl HTTP/1.1Cache-Control: max-age = 3000Connection: Keep-AliveAccept: */*If-Modified-Since: Wed, 11 Feb 2026 14:38:00 GMTUser-Agent: Microsoft-CryptoAPI/6.1Host: c.pki.goog" Contains base64 string in header "goog" in header "GET /r/r4.crl HTTP/1.1Cache-Control: max-age = 3000Connection: Keep-AliveAccept: */*If-Modified-Since: Wed, 11 Feb 2026 14:38:00 GMTUser-Agent: Microsoft-CryptoAPI/6.1Host: c.pki.goog" Contains base64 string in header "Keep" in header "GET /we2/xuzt3PU9F_w.crl HTTP/1.1Cache-Control: max-age = 3000Connection: Keep-AliveAccept: */*If-Modified-Since: Mon, 24 Aug 2026 02:43:59 GMTUser-Agent: Microsoft-CryptoAPI/6.1Host: c.pki.goog" Contains base64 string in header "Modified" in header "GET /we2/xuzt3PU9F_w.crl HTTP/1.1Cache-Control: max-age = 3000Connection: Keep-AliveAccept: */*If-Modified-Since: Mon, 24 Aug 2026 02:43:59 GMTUser-Agent: Microsoft-CryptoAPI/6.1Host: c.pki.goog" Contains base64 string in header "2026" in header "GET /we2/xuzt3PU9F_w.crl HTTP/1.1Cache-Control: max-age = 3000Connection: Keep-AliveAccept: */*If-Modified-Since: Mon, 24 Aug 2026 02:43:59 GMTUser-Agent: Microsoft-CryptoAPI/6.1Host: c.pki.goog" Contains base64 string in header "goog" in header "GET /we2/xuzt3PU9F_w.crl HTTP/1.1Cache-Control: max-age = 3000Connection: Keep-AliveAccept: */*If-Modified-Since: Mon, 24 Aug 2026 02:43:59 GMTUser-Agent: Microsoft-CryptoAPI/6.1Host: c.pki.goog" Contains base64 string in header "Keep" in header "GET /we2/dTM3-0hpWfE.crl HTTP/1.1Cache-Control: max-age = 3000Connection: Keep-AliveAccept: */*If-Modified-Since: Mon, 24 Aug 2026 02:39:36 GMTUser-Agent: Microsoft-CryptoAPI/6.1Host: c.pki.goog" Contains base64 string in header "Modified" in header "GET /we2/dTM3-0hpWfE.crl HTTP/1.1Cache-Control: max-age = 3000Connection: Keep-AliveAccept: */*If-Modified-Since: Mon, 24 Aug 2026 02:39:36 GMTUser-Agent: Microsoft-CryptoAPI/6.1Host: c.pki.goog" Contains base64 string in header "2026" in header "GET /we2/dTM3-0hpWfE.crl HTTP/1.1Cache-Control: max-age = 3000Connection: Keep-AliveAccept: */*If-Modified-Since: Mon, 24 Aug 2026 02:39:36 GMTUser-Agent: Microsoft-CryptoAPI/6.1Host: c.pki.goog" Contains base64 string in header "goog" in header "GET /we2/dTM3-0hpWfE.crl HTTP/1.1Cache-Control: max-age = 3000Connection: Keep-AliveAccept: */*If-Modified-Since: Mon, 24 Aug 2026 02:39:36 GMTUser-Agent: Microsoft-CryptoAPI/6.1Host: c.pki.goog" Contains base64 string in header "Keep" in header "GET /r/r1.crl HTTP/1.1Cache-Control: max-age = 3000Connection: Keep-AliveAccept: */*If-Modified-Since: Wed, 11 Feb 2026 14:38:00 GMTUser-Agent: Microsoft-CryptoAPI/6.1Host: c.pki.goog" Contains base64 string in header "Modified" in header "GET /r/r1.crl HTTP/1.1Cache-Control: max-age = 3000Connection: Keep-AliveAccept: */*If-Modified-Since: Wed, 11 Feb 2026 14:38:00 GMTUser-Agent: Microsoft-CryptoAPI/6.1Host: c.pki.goog" Contains base64 string in header "2026" in header "GET /r/r1.crl HTTP/1.1Cache-Control: max-age = 3000Connection: Keep-AliveAccept: */*If-Modified-Since: Wed, 11 Feb 2026 14:38:00 GMTUser-Agent: Microsoft-CryptoAPI/6.1Host: c.pki.goog" Contains base64 string in header "goog" in header "GET /r/r1.crl HTTP/1.1Cache-Control: max-age = 3000Connection: Keep-AliveAccept: */*If-Modified-Since: Wed, 11 Feb 2026 14:38:00 GMTUser-Agent: Microsoft-CryptoAPI/6.1Host: c.pki.goog" Contains base64 string in header "/wr2/oBFYYahzgVI" in header "GET /wr2/oBFYYahzgVI.crl HTTP/1.1Cache-Control: max-age = 3000Connection: Keep-AliveAccept: */*If-Modified-Since: Mon, 24 Aug 2026 02:47:22 GMTUser-Agent: Microsoft-CryptoAPI/6.1Host: c.pki.goog" Contains base64 string in header "Keep" in header "GET /wr2/oBFYYahzgVI.crl HTTP/1.1Cache-Control: max-age = 3000Connection: Keep-AliveAccept: */*If-Modified-Since: Mon, 24 Aug 2026 02:47:22 GMTUser-Agent: Microsoft-CryptoAPI/6.1Host: c.pki.goog" Contains base64 string in header "Modified" in header "GET /wr2/oBFYYahzgVI.crl HTTP/1.1Cache-Control: max-age = 3000Connection: Keep-AliveAccept: */*If-Modified-Since: Mon, 24 Aug 2026 02:47:22 GMTUser-Agent: Microsoft-CryptoAPI/6.1Host: c.pki.goog" Contains base64 string in header "2026" in header "GET /wr2/oBFYYahzgVI.crl HTTP/1.1Cache-Control: max-age = 3000Connection: Keep-AliveAccept: */*If-Modified-Since: Mon, 24 Aug 2026 02:47:22 GMTUser-Agent: Microsoft-CryptoAPI/6.1Host: c.pki.goog" Contains base64 string in header "goog" in header "GET /wr2/oBFYYahzgVI.crl HTTP/1.1Cache-Control: max-age = 3000Connection: Keep-AliveAccept: */*If-Modified-Since: Mon, 24 Aug 2026 02:47:22 GMTUser-Agent: Microsoft-CryptoAPI/6.1Host: c.pki.goog"2d:T43f,The analysis contains indicators for crypto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Contains ability to perform decryption (API string) Matched sigs: Contains ability to perform AES/RC4 encryption (API string) Matched sigs: Able to use Microsoft's Enhanced Cryptographic Provider Matched sigs: Contains ability to use Cryptographic classes Matched sigs: Decrypted SSL network traffic Matched sigs: Contains ability to perform Base64 encoding/decoding Matched sigs: Contains CRYPTO related strings Matched sigs: Contains ability to decode base64 data Matched sigs: Contains reference to crypto DLLs Matched sigs: Calls an API typically used to import cryptographic keys into a CSP Matched sigs: HTTP requests contain Base64 strings Matched sigs: Dropped file has high entropy (likely encrypted/compressed content) Matched sigs: Drops file with high entropy indicating encryption/obfuscation Matched sigs: Sample file has high entropy (likely encrypted/compressed content) Matched sigs: Contains XOR operation loops [Stream disassembly]2e:T2219,Found XOR loop in file "ei4JY63.exe" at offset 266349; code bytes = 30d0 Found XOR loop in file "ei4JY63.exe" at offset 434902; code bytes = 30d0 Found XOR loop in file "ei4JY63.exe" at offset 482957; code bytes = 30d0 Found XOR loop in file "ei4JY63.exe" at offset 616542; code bytes = 30d0 Found XOR loop in file "ei4JY63.exe" at offset 26031; code bytes = 33c1 Found XOR loop in file "ei4JY63.exe" at offset 190082; code bytes = 33c1 Found XOR loop in file "ei4JY63.exe" at offset 251821; code bytes = 33c1 Found XOR loop in file "ei4JY63.exe" at offset 290545; code bytes = 33c1 Found XOR loop in file "ei4JY63.exe" at offset 360268; code bytes = 33c1 Found XOR loop in file "ei4JY63.exe" at offset 391730; code bytes = 33c1 Found XOR loop in file "ei4JY63.exe" at offset 481748; code bytes = 33c1 Found XOR loop in file "ei4JY63.exe" at offset 660196; code bytes = 33c1 Found XOR loop in file "ei4JY63.exe" at offset 731640; code bytes = 33c1 Found XOR loop in file "ei4JY63.exe" at offset 753593; code bytes = 33c1 Found XOR loop in file "ei4JY63.exe" at offset 90891; code bytes = 8030 Found XOR loop in file "ei4JY63.exe" at offset 102399; code bytes = 8030 Found XOR loop in file "ei4JY63.exe" at offset 103104; code bytes = 8030 Found XOR loop in file "ei4JY63.exe" at offset 156959; code bytes = 8030 Found XOR loop in file "ei4JY63.exe" at offset 213032; code bytes = 8030 Found XOR loop in file "ei4JY63.exe" at offset 264409; code bytes = 8030 Found XOR loop in file "ei4JY63.exe" at offset 293302; code bytes = 8030 Found XOR loop in file "ei4JY63.exe" at offset 460082; code bytes = 8030 Found XOR loop in file "ei4JY63.exe" at offset 668780; code bytes = 8030 Found XOR loop in file "BC6EJ61.exe" at offset 339098; code bytes = 30d0 Found XOR loop in file "BC6EJ61.exe" at offset 387145; code bytes = 30d0 Found XOR loop in file "BC6EJ61.exe" at offset 26031; code bytes = 33c1 Found XOR loop in file "BC6EJ61.exe" at offset 264513; code bytes = 33c1 Found XOR loop in file "BC6EJ61.exe" at offset 295950; code bytes = 33c1 Found XOR loop in file "BC6EJ61.exe" at offset 385936; code bytes = 33c1 Found XOR loop in file "BC6EJ61.exe" at offset 500665; code bytes = 33c1 Found XOR loop in file "BC6EJ61.exe" at offset 90891; code bytes = 8030 Found XOR loop in file "BC6EJ61.exe" at offset 102399; code bytes = 8030 Found XOR loop in file "BC6EJ61.exe" at offset 103104; code bytes = 8030 Found XOR loop in file "BC6EJ61.exe" at offset 180724; code bytes = 8030 Found XOR loop in file "BC6EJ61.exe" at offset 201770; code bytes = 8030 Found XOR loop in file "BC6EJ61.exe" at offset 364270; code bytes = 8030 Found XOR loop in file "4hj421HX.exe" at offset 369933; code bytes = 30d0 Found XOR loop in file "4hj421HX.exe" at offset 371403; code bytes = 30d0 Found XOR loop in file "4hj421HX.exe" at offset 371663; code bytes = 30d0 Found XOR loop in file "4hj421HX.exe" at offset 13643; code bytes = 33c1 Found XOR loop in file "4hj421HX.exe" at offset 13715; code bytes = 33c1 Found XOR loop in file "4hj421HX.exe" at offset 13747; code bytes = 33c1 Found XOR loop in file "4hj421HX.exe" at offset 23872; code bytes = 33c1 Found XOR loop in file "4hj421HX.exe" at offset 26490; code bytes = 33c1 Found XOR loop in file "4hj421HX.exe" at offset 141954; code bytes = 8030 Found XOR loop in file "Bw1Vp89.exe" at offset 163733; code bytes = 30d0 Found XOR loop in file "Bw1Vp89.exe" at offset 243239; code bytes = 30d0 Found XOR loop in file "Bw1Vp89.exe" at offset 291262; code bytes = 30d0 Found XOR loop in file "Bw1Vp89.exe" at offset 26031; code bytes = 33c1 Found XOR loop in file "Bw1Vp89.exe" at offset 188632; code bytes = 33c1 Found XOR loop in file "Bw1Vp89.exe" at offset 290053; code bytes = 33c1 Found XOR loop in file "Bw1Vp89.exe" at offset 298937; code bytes = 33c1 Found XOR loop in file "Bw1Vp89.exe" at offset 90891; code bytes = 8030 Found XOR loop in file "Bw1Vp89.exe" at offset 102399; code bytes = 8030 Found XOR loop in file "Bw1Vp89.exe" at offset 103104; code bytes = 8030 Found XOR loop in file "Bw1Vp89.exe" at offset 268403; code bytes = 8030 Found XOR loop in file "2Ix4962.exe" at offset 285965; code bytes = 30d0 Found XOR loop in file "2Ix4962.exe" at offset 287435; code bytes = 30d0 Found XOR loop in file "2Ix4962.exe" at offset 287695; code bytes = 30d0 Found XOR loop in file "2Ix4962.exe" at offset 13643; code bytes = 33c1 Found XOR loop in file "2Ix4962.exe" at offset 13715; code bytes = 33c1 Found XOR loop in file "2Ix4962.exe" at offset 13747; code bytes = 33c1 Found XOR loop in file "2Ix4962.exe" at offset 23872; code bytes = 33c1 Found XOR loop in file "2Ix4962.exe" at offset 26490; code bytes = 33c1 Found XOR loop in file "2Ix4962.exe" at offset 241839; code bytes = 33c1 Found XOR loop in file "2Ix4962.exe" at offset 193052; code bytes = 8030 Found XOR loop in file "3TI36uw.exe" at offset 173325; code bytes = 30d0 Found XOR loop in file "3TI36uw.exe" at offset 174795; code bytes = 30d0 Found XOR loop in file "3TI36uw.exe" at offset 175055; code bytes = 30d0 Found XOR loop in file "3TI36uw.exe" at offset 13643; code bytes = 33c1 Found XOR loop in file "3TI36uw.exe" at offset 13715; code bytes = 33c1 Found XOR loop in file "3TI36uw.exe" at offset 13747; code bytes = 33c1 Found XOR loop in file "3TI36uw.exe" at offset 23872; code bytes = 33c1 Found XOR loop in file "3TI36uw.exe" at offset 26490; code bytes = 33c1 Found XOR loop in file "3TI36uw.exe" at offset 137216; code bytes = 33c1 Found XOR loop in file "5jR9Wp3.exe" at offset 49744; code bytes = 33c1 Found XOR loop in file "5jR9Wp3.exe" at offset 49766; code bytes = 33c1 Found XOR loop in file "5jR9Wp3.exe" at offset 49788; code bytes = 33c1 Found XOR loop in file "5jR9Wp3.exe" at offset 49860; code bytes = 33c1 Found XOR loop in file "5jR9Wp3.exe" at offset 49956; code bytes = 33c1 Found XOR loop in file "5jR9Wp3.exe" at offset 50065; code bytes = 33c1 Found XOR loop in file "5jR9Wp3.exe" at offset 32706; code bytes = 8030 Found XOR loop in file "5jR9Wp3.exe" at offset 83850; code bytes = 8030 Found XOR loop in file "1Qj66VM8.exe" at offset 2151; code bytes = 8030 Found XOR loop in file "1Qj66VM8.exe" at offset 2163; code bytes = 8030 Found XOR loop in file "DISMHOST.EXE.6A8C05FD.bin" at offset 76665; code bytes = 30d0 Found XOR loop in file "DISMHOST.EXE.6A8C05FD.bin" at offset 77648; code bytes = 8030 Found XOR loop in file "DISMHOST.EXE.6A8C05FD.bin" at offset 77788; code bytes = 8030 Found XOR loop in file "DISMHOST.EXE.6A8C05FD.bin" at offset 78978; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 157047; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 362199; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 530843; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 578923; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 712574; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 862395; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 26031; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 282342; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 347663; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 386412; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 456168; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 487638; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 577714; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 756244; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 827737; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 858871; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 897465; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 90891; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 102399; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 103104; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 290275; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 308866; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 360259; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 389169; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 556031; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 764844; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 844796; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 870626; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 871510; code bytes = 80302f:T6c9,file/memory contains long string with (Indicator: "GetCommandLine"; File: "4hj421HX.exe") file/memory contains long string with (Indicator: "GetCommandLine"; File: "2Ix4962.exe") file/memory contains long string with (Indicator: "GetCommandLine"; File: "3TI36uw.exe") file/memory contains long string with (Indicator: "GetCommandLine"; File: "5jR9Wp3.exe") file/memory contains long string with (Indicator: "GetCommandLine"; File: "DISMHOST.EXE.6A8C05FD.bin") Found string "GetCommandLineA" (Indicator: "GetCommandLine"; File: "00000000-00006044.00000000.78694.00F13000.00000004.mdmp") Found string "GetCommandLineW" (Indicator: "GetCommandLine"; File: "00000000-00006044.00000000.78694.00F13000.00000004.mdmp") Found string "GetCursorPos" (Indicator: "GetCursorPos"; File: "00000000-00004180.00000000.79360.00A43000.00000004.mdmp") Found string "GetCommandLineW" (Indicator: "GetCommandLine"; Source: "00000000-00000636.00000001.83575.00AD1000.00000020.mdmp") Found string "GetCommandLineW" (Indicator: "GetCommandLine"; Source: "00000000-00002464.00000000.79692.00417000.00000004.mdmp") Found string "GetCommandLineA" (Indicator: "GetCommandLine"; Source: "00000000-00004180.00000000.79355.00A39000.00000002.mdmp") Found string "GetCommandLineW" (Indicator: "GetCommandLine"; Source: "00000000-00004180.00000000.79355.00A39000.00000002.mdmp") Found string "GetCursorPos" (Indicator: "GetCursorPos"; Source: "00000000-00004180.00000000.79360.00A43000.00000004.mdmp") Found string "GetCommandLineA" (Indicator: "GetCommandLine"; Source: "00000000-00004188.00000000.79028.00E79000.00000002.mdmp") Found string "GetCommandLineW" (Indicator: "GetCommandLine"; Source: "00000000-00004188.00000000.79028.00E79000.00000002.mdmp")30:T16a2,"4c75a2e2511e44061424cc86123e1ea5dc4f7c8aadebc5c3bdebbe746175b2c6.exe" called "RtlGetVersion" with parameter 140100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00005732) "4c75a2e2511e44061424cc86123e1ea5dc4f7c8aadebc5c3bdebbe746175b2c6.exe" called "RtlGetVersion" with parameter 000000000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00005732) "ei4JY63.exe" called "RtlGetVersion" with parameter 000000000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00005348) "BC6EJ61.exe" called "RtlGetVersion" with parameter 140100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00005720) "BC6EJ61.exe" called "RtlGetVersion" with parameter 000000000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00005720) "Bw1Vp89.exe" called "RtlGetVersion" with parameter 000000000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00005724) "1Qj66VM8.exe" called "RtlGetVersion" with parameter 140100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00005740) "1Qj66VM8.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00005740) "1Qj66VM8.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000014000000000000000000000000000000000000000000000002000002d0f35300400000400000000000000000000000008000000000000000ca420088f88154000100000000000000020000000c000000d0e95300d0e95300cbe95300000000000000000000004d0000000001e8f12f000000000008f82f0095e13e773b011a00feffffff435c42775059427794000000a0000000cae95300c8e95300940000008cf32f00fdfe33776cec2f000100000008f82f0092e0296ae8f6e8fffeffffff24f32f004c9c296a5c0c000038f32f005f9c296a0000000000000000 (UID: 00000000-00005740)31:T462,"1Qj66VM8.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b2031000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00005740) "AppLaunch.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b203100000000000000000000000000000000000000000000000000000000000000000000b2f4427796be4077dceb18000000f2710000f2710000000000000000f0000000f000f2710000000048eb180000000000dcec18000000000001000000aceb180040f54277000000000000000098eb1800 (UID: 00000000-00004136) "cmd.exe" called "GetVersionExA" with parameter 9c0000000600000001000000b11d00000200000053657276696365205061636b2031000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00004048)32:T81e,"4c75a2e2511e44061424cc86123e1ea5dc4f7c8aadebc5c3bdebbe746175b2c6.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "4c75a2e2511e44061424cc86123e1ea5dc4f7c8aadebc5c3bdebbe746175b2c6.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "ei4JY63.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "ei4JY63.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "BC6EJ61.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "BC6EJ61.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "Bw1Vp89.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "Bw1Vp89.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "1Qj66VM8.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "2Ix4962.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "2Ix4962.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "3TI36uw.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "3TI36uw.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "4hj421HX.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "4hj421HX.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "5jR9Wp3.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "5jR9Wp3.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED")33:T68a,Found reference to API "GetWindowText" (Indicator: "GetWindowText"; File: "00000000-00004180.00000000.79360.00A43000.00000004.mdmp") Found reference to API "FindWindow" (Indicator: "FindWindow"; File: "00000000-00004180.00000000.79360.00A43000.00000004.mdmp") Found reference to API "GetForegroundWindow" (Indicator: "GetForegroundWindow"; File: "4c75a2e2511e44061424cc86123e1ea5dc4f7c8aadebc5c3bdebbe746175b2c6") Found reference to API "EnumWindows" (Indicator: "EnumWindows"; File: "4c75a2e2511e44061424cc86123e1ea5dc4f7c8aadebc5c3bdebbe746175b2c6") Found reference to API "GetWindowTextW" (Indicator: "GetWindowText"; File: "4c75a2e2511e44061424cc86123e1ea5dc4f7c8aadebc5c3bdebbe746175b2c6") Found reference to API "GetWindowTextLengthW" (Indicator: "GetWindowText"; File: "4c75a2e2511e44061424cc86123e1ea5dc4f7c8aadebc5c3bdebbe746175b2c6") Found reference to API "GetWindowTextLengthW" (Indicator: "GetWindowText"; Source: "00000000-00002464.00000000.79692.00417000.00000004.mdmp") Found reference to API "GetWindowTextW" (Indicator: "GetWindowText"; Source: "00000000-00002464.00000000.79692.00417000.00000004.mdmp") Found reference to API "GetForegroundWindow" (Indicator: "GetForegroundWindow"; Source: "00000000-00002464.00000000.79692.00417000.00000004.mdmp") Found reference to API "EnumWindows" (Indicator: "EnumWindows"; Source: "00000000-00002464.00000000.79692.00417000.00000004.mdmp") Found reference to API "GetWindowText" (Indicator: "GetWindowText"; Source: "00000000-00004180.00000000.79360.00A43000.00000004.mdmp") Found reference to API "FindWindow" (Indicator: "FindWindow"; Source: "00000000-00004180.00000000.79360.00A43000.00000004.mdmp")34:T5b1,"1Qj66VM8.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Temp\IXP003.TMP\1Qj66VM8.exe" at 00000000-00005740-0000010C-1933494 "AppLaunch.exe" queries volume information of "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe" at 00000000-00004136-0000010C-339714 "AppLaunch.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel\v4.0_4.0.0.0__b77a5c561934e089\System.ServiceModel.dll" at 00000000-00004136-0000010C-2039492 "AppLaunch.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel\v4.0_4.0.0.0__b77a5c561934e089\System.ServiceModel.dll" at 00000000-00004136-0000010C-2044530 "AppLaunch.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel.Internals\v4.0_4.0.0.0__31bf3856ad364e35\System.ServiceModel.Internals.dll" at 00000000-00004136-0000010C-2567821 "AppLaunch.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel.Internals\v4.0_4.0.0.0__31bf3856ad364e35\System.ServiceModel.Internals.dll" at 00000000-00004136-0000010C-2571653 "AppLaunch.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll" at 00000000-00004136-0000010C-2904549 "cmd.exe" queries volume information of an entire harddrive"C:\" at 00000000-00004048-0000010C-45103135:T5ce,"4c75a2e2511e44061424cc86123e1ea5dc4f7c8aadebc5c3bdebbe746175b2c6.exe" called "CreateProcessA" with parameter "%TEMP%\IXP000.TMP\ei4JY63.exe" - (UID: 00000000-00005732) "4c75a2e2511e44061424cc86123e1ea5dc4f7c8aadebc5c3bdebbe746175b2c6.exe" called "CreateProcessA" with parameter "%TEMP%\IXP000.TMP\5jR9Wp3.exe" - (UID: 00000000-00005732) "ei4JY63.exe" called "CreateProcessA" with parameter "%TEMP%\IXP001.TMP\BC6EJ61.exe" - (UID: 00000000-00005348) "ei4JY63.exe" called "CreateProcessA" with parameter "%TEMP%\IXP001.TMP\4hj421HX.exe" - (UID: 00000000-00005348) "BC6EJ61.exe" called "CreateProcessA" with parameter "%TEMP%\IXP002.TMP\Bw1Vp89.exe" - (UID: 00000000-00005720) "BC6EJ61.exe" called "CreateProcessA" with parameter "%TEMP%\IXP002.TMP\3TI36uw.exe" - (UID: 00000000-00005720) "Bw1Vp89.exe" called "CreateProcessA" with parameter "%TEMP%\IXP003.TMP\1Qj66VM8.exe" - (UID: 00000000-00005724) "Bw1Vp89.exe" called "CreateProcessA" with parameter "%TEMP%\IXP003.TMP\2Ix4962.exe" - (UID: 00000000-00005724) "5jR9Wp3.exe" called "CreateProcessW" with parameter ""%WINDIR%\system32\cmd" /c "%TEMP%\E6B6.tmp\E7D0.tmp\E7D1.bat %TEMP%\I" - (UID: 00000000-00002464), "cmd.exe" called "CreateProcessW" with parameter ""%PROGRAMFILES%\Internet Explorer\iexplore.exe" https://www.facebook.com/login" - (UID: 00000000-00004048), "cmd.exe" called "CreateProcessW" with parameter ""%PROGRAMFILES%\Internet Explorer\iexplore.exe" https://accounts.google.com/" - (UID: 00000000-00004048)36:T3222,"4c75a2e2511e44061424cc86123e1ea5dc4f7c8aadebc5c3bdebbe746175b2c6.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\advpack.dll (UID: 00000000-00005732) "ei4JY63.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\advpack.dll (UID: 00000000-00005348) "BC6EJ61.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\advpack.dll (UID: 00000000-00005720) "Bw1Vp89.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\advpack.dll (UID: 00000000-00005724) "1Qj66VM8.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00005740) "1Qj66VM8.exe" called "LoadLibrary" with a parameter api-ms-win-core-quirks-l1-1-0.dll (UID: 00000000-00005740) "1Qj66VM8.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2.dll (UID: 00000000-00005740) "1Qj66VM8.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-0.dll (UID: 00000000-00005740) "1Qj66VM8.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoree.dll (UID: 00000000-00005740) "1Qj66VM8.exe" called "LoadLibrary" with a parameter mscoree.dll (UID: 00000000-00005740) "1Qj66VM8.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\combase.dll (UID: 00000000-00005740) "1Qj66VM8.exe" called "LoadLibrary" with a parameter psapi.dll (UID: 00000000-00005740) "1Qj66VM8.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\mscorlib\36eaccfde177c2e7b93b8dbdde4e012a\mscorlib.ni.dll (UID: 00000000-00005740) "1Qj66VM8.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\ole32.dll (UID: 00000000-00005740) "1Qj66VM8.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00005740) "1Qj66VM8.exe" called "LoadLibrary" with a parameter api-ms-win-core-xstate-l2-1-0.dll (UID: 00000000-00005740) "1Qj66VM8.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\clrjit.dll (UID: 00000000-00005740) "1Qj66VM8.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System\2c3c912ea8f058f9d04c4650128feb3f\System.ni.dll (UID: 00000000-00005740) "1Qj66VM8.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00005740) "1Qj66VM8.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00005740) "1Qj66VM8.exe" called "LoadLibrary" with a parameter SspiCli.dll (UID: 00000000-00005740) "1Qj66VM8.exe" called "LoadLibrary" with a parameter advapi32 (UID: 00000000-00005740) "1Qj66VM8.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll (UID: 00000000-00005740) "1Qj66VM8.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00005740) "1Qj66VM8.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\nlssorting.dll (UID: 00000000-00005740) "AppLaunch.exe" called "LoadLibrary" with a parameter psapi.dll (UID: 00000000-00004136) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\mscorlib\36eaccfde177c2e7b93b8dbdde4e012a\mscorlib.ni.dll (UID: 00000000-00004136) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\ole32.dll (UID: 00000000-00004136) "AppLaunch.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00004136) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\uxtheme.dll (UID: 00000000-00004136) "AppLaunch.exe" called "LoadLibrary" with a parameter api-ms-win-core-xstate-l2-1-0.dll (UID: 00000000-00004136) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\clrjit.dll (UID: 00000000-00004136) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System\2c3c912ea8f058f9d04c4650128feb3f\System.ni.dll (UID: 00000000-00004136) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Drawing\f7568d7f1b9d356f64779b4c0927cfb3\System.Drawing.ni.dll (UID: 00000000-00004136) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Windows.Forms\c9a4cbc00f690a9e3cddfc400f6e85bb\System.Windows.Forms.ni.dll (UID: 00000000-00004136) "AppLaunch.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00004136) "AppLaunch.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00004136) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\uxtheme.dll (UID: 00000000-00004136) "AppLaunch.exe" called "LoadLibrary" with a parameter uxtheme.dll (UID: 00000000-00004136) "AppLaunch.exe" called "LoadLibrary" with a parameter user32.dll (UID: 00000000-00004136) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Core\31fae3290fad30c31c98651462d22724\System.Core.ni.dll (UID: 00000000-00004136) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Configuration\96f7edb07b12303f0ec2595c7f3778c7\System.Configuration.ni.dll (UID: 00000000-00004136) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Xml\15af16d373cf0528cb74fc73d365fdbf\System.Xml.ni.dll (UID: 00000000-00004136) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\nlssorting.dll (UID: 00000000-00004136) "AppLaunch.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00004136) "AppLaunch.exe" called "LoadLibrary" with a parameter shell32.dll (UID: 00000000-00004136) "AppLaunch.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00004136) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll (UID: 00000000-00004136) "AppLaunch.exe" called "LoadLibrary" with a parameter bcrypt.dll (UID: 00000000-00004136) "AppLaunch.exe" called "LoadLibrary" with a parameter CRYPTSP.dll (UID: 00000000-00004136) "AppLaunch.exe" called "LoadLibrary" with a parameter CRYPTBASE.dll (UID: 00000000-00004136) "AppLaunch.exe" called "LoadLibrary" with a parameter imm32.dll (UID: 00000000-00004136) "AppLaunch.exe" called "LoadLibrary" with a parameter comctl32.dll (UID: 00000000-00004136) "AppLaunch.exe" called "LoadLibrary" with a parameter gdi32.dll (UID: 00000000-00004136) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\WindowsBase\1a4cc316fb6d09525321fc0be44692d8\WindowsBase.ni.dll (UID: 00000000-00004136) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\PresentationCore\468f4e17be144ca12a73a4297eacc9cc\PresentationCore.ni.dll (UID: 00000000-00004136) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\Presentatio5ae0f00f#\252cc7b0fae8cfe083bdc149957c0c54\PresentationFramework.ni.dll (UID: 00000000-00004136) "AppLaunch.exe" called "LoadLibrary" with a parameter KERNEL32.dll (UID: 00000000-00004136) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\PresentationCore\v4.0_4.0.0.0__31bf3856ad364e35\ucrtbase_clr0400.dll (UID: 00000000-00004136) "AppLaunch.exe" called "LoadLibrary" with a parameter ucrtbase_clr0400.dll (UID: 00000000-00004136) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\PresentationCore\v4.0_4.0.0.0__31bf3856ad364e35\SHLWAPI.dll (UID: 00000000-00004136) "AppLaunch.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00004136) "AppLaunch.exe" called "LoadLibrary" with a parameter dwrite.dll (UID: 00000000-00004136) "AppLaunch.exe" called "LoadLibrary" with a parameter api-ms-win-core-string-l1-1-0 (UID: 00000000-00004136) "AppLaunch.exe" called "LoadLibrary" with a parameter api-ms-win-core-datetime-l1-1-1 (UID: 00000000-00004136) "AppLaunch.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-obsolete-l1-2-0 (UID: 00000000-00004136) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\WPF\wpfgfx_v0400.dll (UID: 00000000-00004136) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\WPF\PresentationNative_v0400.dll (UID: 00000000-00004136) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll (UID: 00000000-00004136) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\en-US\tzres.dll.mui (UID: 00000000-00004136) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\VERSION.dll (UID: 00000000-00004136) "AppLaunch.exe" called "LoadLibrary" with a parameter VERSION.dll (UID: 00000000-00004136) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.ServiceModel\v4.0_4.0.0.0__b77a5c561934e089\System.ServiceModel.dll (UID: 00000000-00004136) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Runteb92aa12#\274e43040c8a7a02ef1065db3283005a\System.Runtime.Serialization. (UID: 00000000-00004136) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.IdentityModel\c2ef5bc545b98a289f02d0b3eddbe280\System.IdentityModel.ni.dll (UID: 00000000-00004136) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\SMDiagnostics\dc67dcb4b2fb4a3853d458cab08561f0\SMDiagnostics.ni.dll (UID: 00000000-00004136) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.ServiceModel.Internals\v4.0_4.0.0.0__31bf3856ad364e35\System.ServiceModel.Intern (UID: 00000000-00004136) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Transactions\3d760b4a3260a41ef84a3fd866780980\System.Transactions.ni.dll (UID: 00000000-00004136) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\clr.dll (UID: 00000000-00004136) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll (UID: 00000000-00004136) "AppLaunch.exe" called "LoadLibrary" with a parameter mscoree.dll (UID: 00000000-00004136) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ws2_32.dll (UID: 00000000-00004136) "AppLaunch.exe" called "LoadLibrary" with a parameter ws2_32.dll (UID: 00000000-00004136) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\diasymreader.dll (UID: 00000000-00004136) "cmd.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\uxtheme.dll (UID: 00000000-00004048) "cmd.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00004048) "cmd.exe" called "LoadLibrary" with a parameter propsys.dll (UID: 00000000-00004048) "cmd.exe" called "LoadLibrary" with a parameter comctl32.dll (UID: 00000000-00004048) "cmd.exe" called "LoadLibrary" with a parameter %WINDIR%\System32\ieframe.dll (UID: 00000000-00004048) "cmd.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00004048) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-downlevel-ole32-l1-1-0.dll (UID: 00000000-00004048) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-downlevel-advapi32-l1-1-0.dll (UID: 00000000-00004048) "cmd.exe" called "LoadLibrary" with a parameter urlmon.dll (UID: 00000000-00004048) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-downlevel-shlwapi-l2-1-0.dll (UID: 00000000-00004048) "cmd.exe" called "LoadLibrary" with a parameter PROPSYS.dll (UID: 00000000-00004048) "cmd.exe" called "LoadLibrary" with a parameter %PROGRAMFILES%\Internet Explorer\ieproxy.dll (UID: 00000000-00004048) "cmd.exe" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00004048) "cmd.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00004048) "cmd.exe" called "LoadLibrary" with a parameter iertutil.dll (UID: 00000000-00004048) "cmd.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00004048) "cmd.exe" called "LoadLibrary" with a parameter API-MS-Win-Core-LocalRegistry-L1-1-0.dll (UID: 00000000-00004048)37:T9968,"4c75a2e2511e44061424cc86123e1ea5dc4f7c8aadebc5c3bdebbe746175b2c6.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00005732) "4c75a2e2511e44061424cc86123e1ea5dc4f7c8aadebc5c3bdebbe746175b2c6.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00005732) "4c75a2e2511e44061424cc86123e1ea5dc4f7c8aadebc5c3bdebbe746175b2c6.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00005732) "4c75a2e2511e44061424cc86123e1ea5dc4f7c8aadebc5c3bdebbe746175b2c6.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00005732) "4c75a2e2511e44061424cc86123e1ea5dc4f7c8aadebc5c3bdebbe746175b2c6.exe" called "GetProcAddress" with a parameter DelNodeRunDLL32 (UID: 00000000-00005732) "4c75a2e2511e44061424cc86123e1ea5dc4f7c8aadebc5c3bdebbe746175b2c6.exe" called "GetProcAddress" with a parameter UnregisterTraceGuids (UID: 00000000-00005732) "ei4JY63.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00005348) "ei4JY63.exe" called "GetProcAddress" with a parameter DelNodeRunDLL32 (UID: 00000000-00005348) "ei4JY63.exe" called "GetProcAddress" with a parameter UnregisterTraceGuids (UID: 00000000-00005348) "BC6EJ61.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00005720) "BC6EJ61.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00005720) "BC6EJ61.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00005720) "BC6EJ61.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00005720) "BC6EJ61.exe" called "GetProcAddress" with a parameter DelNodeRunDLL32 (UID: 00000000-00005720) "BC6EJ61.exe" called "GetProcAddress" with a parameter UnregisterTraceGuids (UID: 00000000-00005720) "Bw1Vp89.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00005724) "Bw1Vp89.exe" called "GetProcAddress" with a parameter DelNodeRunDLL32 (UID: 00000000-00005724) "Bw1Vp89.exe" called "GetProcAddress" with a parameter UnregisterTraceGuids (UID: 00000000-00005724) "1Qj66VM8.exe" called "GetProcAddress" with a parameter SetRuntimeInfo (UID: 00000000-00005740) "1Qj66VM8.exe" called "GetProcAddress" with a parameter DecodePointer (UID: 00000000-00005740) "1Qj66VM8.exe" called "GetProcAddress" with a parameter EncodePointer (UID: 00000000-00005740) "1Qj66VM8.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00005740) "1Qj66VM8.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00005740) "1Qj66VM8.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00005740) "1Qj66VM8.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00005740) "1Qj66VM8.exe" called "GetProcAddress" with a parameter GetProcessWindowStation (UID: 00000000-00005740) "1Qj66VM8.exe" called "GetProcAddress" with a parameter GetUserObjectInformationW (UID: 00000000-00005740) "1Qj66VM8.exe" called "GetProcAddress" with a parameter _CorExeMain (UID: 00000000-00005740) "1Qj66VM8.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00005740) "1Qj66VM8.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00005740) "1Qj66VM8.exe" called "GetProcAddress" with a parameter AddDllDirectory (UID: 00000000-00005740) "1Qj66VM8.exe" called "GetProcAddress" with a parameter CreateConfigStream (UID: 00000000-00005740) "1Qj66VM8.exe" called "GetProcAddress" with a parameter CreateConfigStream_RetAddr (UID: 00000000-00005740) "1Qj66VM8.exe" called "GetProcAddress" with a parameter GetNumaHighestNodeNumber (UID: 00000000-00005740) "1Qj66VM8.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00005740) "1Qj66VM8.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00005740) "1Qj66VM8.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00005740) "1Qj66VM8.exe" called "GetProcAddress" with a parameter GetSystemWindowsDirectoryW (UID: 00000000-00005740) "1Qj66VM8.exe" called "GetProcAddress" with a parameter AllocateAndInitializeSid (UID: 00000000-00005740) "1Qj66VM8.exe" called "GetProcAddress" with a parameter OpenProcessToken (UID: 00000000-00005740) "1Qj66VM8.exe" called "GetProcAddress" with a parameter GetTokenInformation (UID: 00000000-00005740) "1Qj66VM8.exe" called "GetProcAddress" with a parameter InitializeAcl (UID: 00000000-00005740) "1Qj66VM8.exe" called "GetProcAddress" with a parameter AddAccessAllowedAce (UID: 00000000-00005740) "1Qj66VM8.exe" called "GetProcAddress" with a parameter FreeSid (UID: 00000000-00005740) "1Qj66VM8.exe" called "GetProcAddress" with a parameter AddSIDToBoundaryDescriptor (UID: 00000000-00005740) "1Qj66VM8.exe" called "GetProcAddress" with a parameter CreateBoundaryDescriptorW (UID: 00000000-00005740) "1Qj66VM8.exe" called "GetProcAddress" with a parameter CreatePrivateNamespaceW (UID: 00000000-00005740) "1Qj66VM8.exe" called "GetProcAddress" with a parameter OpenPrivateNamespaceW (UID: 00000000-00005740) "1Qj66VM8.exe" called "GetProcAddress" with a parameter DeleteBoundaryDescriptor (UID: 00000000-00005740) "1Qj66VM8.exe" called "GetProcAddress" with a parameter WerRegisterRuntimeExceptionModule (UID: 00000000-00005740) "1Qj66VM8.exe" called "GetProcAddress" with a parameter RaiseException (UID: 00000000-00005740) "1Qj66VM8.exe" called "GetProcAddress" with a parameter SetSystemFileCacheSize (UID: 00000000-00005740) "1Qj66VM8.exe" called "GetProcAddress" with a parameter NtSetSystemInformation (UID: 00000000-00005740) "1Qj66VM8.exe" called "GetProcAddress" with a parameter PrivIsDllSynchronizationHeld (UID: 00000000-00005740) "1Qj66VM8.exe" called "GetProcAddress" with a parameter GetProcessMemoryInfo (UID: 00000000-00005740) "1Qj66VM8.exe" called "GetProcAddress" with a parameter CoInitializeEx (UID: 00000000-00005740) "1Qj66VM8.exe" called "GetProcAddress" with a parameter SystemFunction036 (UID: 00000000-00005740) "1Qj66VM8.exe" called "GetProcAddress" with a parameter CoGetContextToken (UID: 00000000-00005740) "1Qj66VM8.exe" called "GetProcAddress" with a parameter GetEnabledXStateFeatures (UID: 00000000-00005740) "1Qj66VM8.exe" called "GetProcAddress" with a parameter sxsJitStartup (UID: 00000000-00005740) "1Qj66VM8.exe" called "GetProcAddress" with a parameter jitStartup (UID: 00000000-00005740) "1Qj66VM8.exe" called "GetProcAddress" with a parameter getJit (UID: 00000000-00005740) "1Qj66VM8.exe" called "GetProcAddress" with a parameter GetUserName (UID: 00000000-00005740) "1Qj66VM8.exe" called "GetProcAddress" with a parameter GetUserNameA (UID: 00000000-00005740) "1Qj66VM8.exe" called "GetProcAddress" with a parameter WideCharToMultiByte (UID: 00000000-00005740) "1Qj66VM8.exe" called "GetProcAddress" with a parameter GetUserNameExA (UID: 00000000-00005740) "1Qj66VM8.exe" called "GetProcAddress" with a parameter OpenSCManagerW (UID: 00000000-00005740) "1Qj66VM8.exe" called "GetProcAddress" with a parameter OpenServiceA (UID: 00000000-00005740) "1Qj66VM8.exe" called "GetProcAddress" with a parameter StartService (UID: 00000000-00005740) "1Qj66VM8.exe" called "GetProcAddress" with a parameter StartServiceA (UID: 00000000-00005740) "1Qj66VM8.exe" called "GetProcAddress" with a parameter CloseHandle (UID: 00000000-00005740) "1Qj66VM8.exe" called "GetProcAddress" with a parameter CloseHandleW (UID: 00000000-00005740) "1Qj66VM8.exe" called "GetProcAddress" with a parameter LookupPrivilegeValue (UID: 00000000-00005740) "1Qj66VM8.exe" called "GetProcAddress" with a parameter LookupPrivilegeValueW (UID: 00000000-00005740) "1Qj66VM8.exe" called "GetProcAddress" with a parameter GetCurrentProcess (UID: 00000000-00005740) "1Qj66VM8.exe" called "GetProcAddress" with a parameter OpenProcessTokenW (UID: 00000000-00005740) "1Qj66VM8.exe" called "GetProcAddress" with a parameter AdjustTokenPrivileges (UID: 00000000-00005740) "1Qj66VM8.exe" called "GetProcAddress" with a parameter AdjustTokenPrivilegesW (UID: 00000000-00005740) "1Qj66VM8.exe" called "GetProcAddress" with a parameter NtQuerySystemInformation (UID: 00000000-00005740) "1Qj66VM8.exe" called "GetProcAddress" with a parameter NtQuerySystemInformationW (UID: 00000000-00005740) "1Qj66VM8.exe" called "GetProcAddress" with a parameter OpenProcess (UID: 00000000-00005740) "1Qj66VM8.exe" called "GetProcAddress" with a parameter OpenProcessW (UID: 00000000-00005740) "1Qj66VM8.exe" called "GetProcAddress" with a parameter GetExitCodeProcess (UID: 00000000-00005740) "1Qj66VM8.exe" called "GetProcAddress" with a parameter GetExitCodeProcessW (UID: 00000000-00005740) "1Qj66VM8.exe" called "GetProcAddress" with a parameter ImpersonateLoggedOnUser (UID: 00000000-00005740) "1Qj66VM8.exe" called "GetProcAddress" with a parameter ControlService (UID: 00000000-00005740) "1Qj66VM8.exe" called "GetProcAddress" with a parameter ChangeServiceConfig (UID: 00000000-00005740) "1Qj66VM8.exe" called "GetProcAddress" with a parameter ChangeServiceConfigA (UID: 00000000-00005740) "1Qj66VM8.exe" called "GetProcAddress" with a parameter CoTaskMemFree (UID: 00000000-00005740) "1Qj66VM8.exe" called "GetProcAddress" with a parameter RegCloseKey (UID: 00000000-00005740) "1Qj66VM8.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00005740) "1Qj66VM8.exe" called "GetProcAddress" with a parameter LocaleNameToLCID (UID: 00000000-00005740) "1Qj66VM8.exe" called "GetProcAddress" with a parameter GetUserDefaultLocaleName (UID: 00000000-00005740) "1Qj66VM8.exe" called "GetProcAddress" with a parameter LCIDToLocaleName (UID: 00000000-00005740) "1Qj66VM8.exe" called "GetProcAddress" with a parameter GetUserPreferredUILanguages (UID: 00000000-00005740) "1Qj66VM8.exe" called "GetProcAddress" with a parameter SortGetHandle (UID: 00000000-00005740) "1Qj66VM8.exe" called "GetProcAddress" with a parameter SortCloseHandle (UID: 00000000-00005740) "1Qj66VM8.exe" called "GetProcAddress" with a parameter RegOpenKeyEx (UID: 00000000-00005740) "1Qj66VM8.exe" called "GetProcAddress" with a parameter RegOpenKeyExW (UID: 00000000-00005740) "1Qj66VM8.exe" called "GetProcAddress" with a parameter RegCreateKeyEx (UID: 00000000-00005740) "1Qj66VM8.exe" called "GetProcAddress" with a parameter RegCreateKeyExW (UID: 00000000-00005740) "1Qj66VM8.exe" called "GetProcAddress" with a parameter RegQueryValueEx (UID: 00000000-00005740) "1Qj66VM8.exe" called "GetProcAddress" with a parameter RegQueryValueExW (UID: 00000000-00005740) "1Qj66VM8.exe" called "GetProcAddress" with a parameter RegSetValueEx (UID: 00000000-00005740) "1Qj66VM8.exe" called "GetProcAddress" with a parameter RegSetValueExW (UID: 00000000-00005740) "1Qj66VM8.exe" called "GetProcAddress" with a parameter EventRegister (UID: 00000000-00005740) "1Qj66VM8.exe" called "GetProcAddress" with a parameter GetProcessExecutableHeap (UID: 00000000-00005740) "1Qj66VM8.exe" called "GetProcAddress" with a parameter GetProcessExecutableHeap_RetAddr (UID: 00000000-00005740) "1Qj66VM8.exe" called "GetProcAddress" with a parameter EventUnregister (UID: 00000000-00005740) "1Qj66VM8.exe" called "GetProcAddress" with a parameter CoUninitialize (UID: 00000000-00005740) "1Qj66VM8.exe" called "GetProcAddress" with a parameter CreateActCtxW (UID: 00000000-00005740) "1Qj66VM8.exe" called "GetProcAddress" with a parameter AddRefActCtx (UID: 00000000-00005740) "1Qj66VM8.exe" called "GetProcAddress" with a parameter ReleaseActCtx (UID: 00000000-00005740) "1Qj66VM8.exe" called "GetProcAddress" with a parameter ActivateActCtx (UID: 00000000-00005740) "1Qj66VM8.exe" called "GetProcAddress" with a parameter DeactivateActCtx (UID: 00000000-00005740) "1Qj66VM8.exe" called "GetProcAddress" with a parameter GetCurrentActCtx (UID: 00000000-00005740) "1Qj66VM8.exe" called "GetProcAddress" with a parameter QueryActCtxW (UID: 00000000-00005740) "1Qj66VM8.exe" called "GetProcAddress" with a parameter UnregisterTraceGuids (UID: 00000000-00005740) "2Ix4962.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00006044) "2Ix4962.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00006044) "2Ix4962.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00006044) "2Ix4962.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00006044) "AppLaunch.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00002296) "AppLaunch.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00002296) "AppLaunch.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00002296) "AppLaunch.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00002296) "AppLaunch.exe" called "GetProcAddress" with a parameter UnregisterTraceGuids (UID: 00000000-00002296) "4hj421HX.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00004180) "4hj421HX.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00004180) "4hj421HX.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00004180) "4hj421HX.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00004180) "AppLaunch.exe" called "GetProcAddress" with a parameter WerRegisterRuntimeExceptionModule (UID: 00000000-00004136) "AppLaunch.exe" called "GetProcAddress" with a parameter RaiseException (UID: 00000000-00004136) "AppLaunch.exe" called "GetProcAddress" with a parameter SetSystemFileCacheSize (UID: 00000000-00004136) "AppLaunch.exe" called "GetProcAddress" with a parameter NtSetSystemInformation (UID: 00000000-00004136) "AppLaunch.exe" called "GetProcAddress" with a parameter PrivIsDllSynchronizationHeld (UID: 00000000-00004136) "AppLaunch.exe" called "GetProcAddress" with a parameter AddDllDirectory (UID: 00000000-00004136) "AppLaunch.exe" called "GetProcAddress" with a parameter GetProcessMemoryInfo (UID: 00000000-00004136) "AppLaunch.exe" called "GetProcAddress" with a parameter CoInitializeEx (UID: 00000000-00004136) "AppLaunch.exe" called "GetProcAddress" with a parameter SystemFunction036 (UID: 00000000-00004136) "AppLaunch.exe" called "GetProcAddress" with a parameter ThemeInitApiHook (UID: 00000000-00004136) "AppLaunch.exe" called "GetProcAddress" with a parameter IsProcessDPIAware (UID: 00000000-00004136) "AppLaunch.exe" called "GetProcAddress" with a parameter GetEnabledXStateFeatures (UID: 00000000-00004136) "AppLaunch.exe" called "GetProcAddress" with a parameter sxsJitStartup (UID: 00000000-00004136) "AppLaunch.exe" called "GetProcAddress" with a parameter jitStartup (UID: 00000000-00004136) "AppLaunch.exe" called "GetProcAddress" with a parameter getJit (UID: 00000000-00004136) "AppLaunch.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00004136) "AppLaunch.exe" called "GetProcAddress" with a parameter LocaleNameToLCID (UID: 00000000-00004136) "AppLaunch.exe" called "GetProcAddress" with a parameter GetUserDefaultLocaleName (UID: 00000000-00004136) "AppLaunch.exe" called "GetProcAddress" with a parameter LCIDToLocaleName (UID: 00000000-00004136) "AppLaunch.exe" called "GetProcAddress" with a parameter GetUserPreferredUILanguages (UID: 00000000-00004136) "AppLaunch.exe" called "GetProcAddress" with a parameter RegCloseKey (UID: 00000000-00004136) "AppLaunch.exe" called "GetProcAddress" with a parameter RegOpenKeyEx (UID: 00000000-00004136) "AppLaunch.exe" called "GetProcAddress" with a parameter RegOpenKeyExW (UID: 00000000-00004136) "AppLaunch.exe" called "GetProcAddress" with a parameter GetFullPathName (UID: 00000000-00004136) "AppLaunch.exe" called "GetProcAddress" with a parameter GetFullPathNameW (UID: 00000000-00004136) "AppLaunch.exe" called "GetProcAddress" with a parameter IsAppThemed (UID: 00000000-00004136) "AppLaunch.exe" called "GetProcAddress" with a parameter IsAppThemedW (UID: 00000000-00004136) "AppLaunch.exe" called "GetProcAddress" with a parameter CreateActCtx (UID: 00000000-00004136) "AppLaunch.exe" called "GetProcAddress" with a parameter CreateActCtxA (UID: 00000000-00004136) "AppLaunch.exe" called "GetProcAddress" with a parameter CoTaskMemAlloc (UID: 00000000-00004136) "AppLaunch.exe" called "GetProcAddress" with a parameter CoTaskMemFree (UID: 00000000-00004136) "AppLaunch.exe" called "GetProcAddress" with a parameter RegisterWindowMessage (UID: 00000000-00004136) "AppLaunch.exe" called "GetProcAddress" with a parameter RegisterWindowMessageW (UID: 00000000-00004136) "AppLaunch.exe" called "GetProcAddress" with a parameter CompareStringOrdinal (UID: 00000000-00004136) "AppLaunch.exe" called "GetProcAddress" with a parameter CloseHandle (UID: 00000000-00004136) "AppLaunch.exe" called "GetProcAddress" with a parameter GetCurrentProcess (UID: 00000000-00004136) "AppLaunch.exe" called "GetProcAddress" with a parameter GetCurrentProcessW (UID: 00000000-00004136) "AppLaunch.exe" called "GetProcAddress" with a parameter OpenProcessToken (UID: 00000000-00004136) "AppLaunch.exe" called "GetProcAddress" with a parameter OpenProcessTokenW (UID: 00000000-00004136) "AppLaunch.exe" called "GetProcAddress" with a parameter SortGetHandle (UID: 00000000-00004136) "AppLaunch.exe" called "GetProcAddress" with a parameter SortCloseHandle (UID: 00000000-00004136) "AppLaunch.exe" called "GetProcAddress" with a parameter NtQuerySystemInformation (UID: 00000000-00004136) "AppLaunch.exe" called "GetProcAddress" with a parameter GetFileAttributesEx (UID: 00000000-00004136) "AppLaunch.exe" called "GetProcAddress" with a parameter GetFileAttributesExW (UID: 00000000-00004136) "AppLaunch.exe" called "GetProcAddress" with a parameter SetThreadErrorMode (UID: 00000000-00004136) "AppLaunch.exe" called "GetProcAddress" with a parameter CreateFile (UID: 00000000-00004136) "AppLaunch.exe" called "GetProcAddress" with a parameter CreateFileW (UID: 00000000-00004136) "AppLaunch.exe" called "GetProcAddress" with a parameter GetFileType (UID: 00000000-00004136) "AppLaunch.exe" called "GetProcAddress" with a parameter ConvertSidToStringSidW (UID: 00000000-00004136) "AppLaunch.exe" called "GetProcAddress" with a parameter SHGetFolderPathW (UID: 00000000-00004136) "AppLaunch.exe" called "GetProcAddress" with a parameter StringFromGUID2 (UID: 00000000-00004136) "AppLaunch.exe" called "GetProcAddress" with a parameter OpenThreadToken (UID: 00000000-00004136) "AppLaunch.exe" called "GetProcAddress" with a parameter GetProcessExecutableHeap (UID: 00000000-00004136) "AppLaunch.exe" called "GetProcAddress" with a parameter GetProcessExecutableHeap_RetAddr (UID: 00000000-00004136) "AppLaunch.exe" called "GetProcAddress" with a parameter BCryptGetFipsAlgorithmMode (UID: 00000000-00004136) "AppLaunch.exe" called "GetProcAddress" with a parameter CryptGetDefaultProviderW (UID: 00000000-00004136) "AppLaunch.exe" called "GetProcAddress" with a parameter CryptAcquireContextW (UID: 00000000-00004136) "AppLaunch.exe" called "GetProcAddress" with a parameter CPAcquireContext (UID: 00000000-00004136) "AppLaunch.exe" called "GetProcAddress" with a parameter CPReleaseContext (UID: 00000000-00004136) "AppLaunch.exe" called "GetProcAddress" with a parameter CPGenKey (UID: 00000000-00004136) "AppLaunch.exe" called "GetProcAddress" with a parameter CPDeriveKey (UID: 00000000-00004136) "AppLaunch.exe" called "GetProcAddress" with a parameter CPDestroyKey (UID: 00000000-00004136) "AppLaunch.exe" called "GetProcAddress" with a parameter CPSetKeyParam (UID: 00000000-00004136) "AppLaunch.exe" called "GetProcAddress" with a parameter CPGetKeyParam (UID: 00000000-00004136) "AppLaunch.exe" called "GetProcAddress" with a parameter CPExportKey (UID: 00000000-00004136) "AppLaunch.exe" called "GetProcAddress" with a parameter CPImportKey (UID: 00000000-00004136) "AppLaunch.exe" called "GetProcAddress" with a parameter CPEncrypt (UID: 00000000-00004136) "AppLaunch.exe" called "GetProcAddress" with a parameter CPDecrypt (UID: 00000000-00004136) "AppLaunch.exe" called "GetProcAddress" with a parameter CPCreateHash (UID: 00000000-00004136) "AppLaunch.exe" called "GetProcAddress" with a parameter CPHashData (UID: 00000000-00004136) "AppLaunch.exe" called "GetProcAddress" with a parameter CPHashSessionKey (UID: 00000000-00004136) "AppLaunch.exe" called "GetProcAddress" with a parameter CPDestroyHash (UID: 00000000-00004136) "AppLaunch.exe" called "GetProcAddress" with a parameter CPSignHash (UID: 00000000-00004136) "AppLaunch.exe" called "GetProcAddress" with a parameter CPVerifySignature (UID: 00000000-00004136) "AppLaunch.exe" called "GetProcAddress" with a parameter CPGenRandom (UID: 00000000-00004136) "AppLaunch.exe" called "GetProcAddress" with a parameter CPGetUserKey (UID: 00000000-00004136) "AppLaunch.exe" called "GetProcAddress" with a parameter CPSetProvParam (UID: 00000000-00004136) "AppLaunch.exe" called "GetProcAddress" with a parameter CPGetProvParam (UID: 00000000-00004136) "AppLaunch.exe" called "GetProcAddress" with a parameter CPSetHashParam (UID: 00000000-00004136) "AppLaunch.exe" called "GetProcAddress" with a parameter CPGetHashParam (UID: 00000000-00004136) "AppLaunch.exe" called "GetProcAddress" with a parameter CPDuplicateKey (UID: 00000000-00004136) "AppLaunch.exe" called "GetProcAddress" with a parameter CPDuplicateHash (UID: 00000000-00004136) "AppLaunch.exe" called "GetProcAddress" with a parameter GetTokenInformation (UID: 00000000-00004136) "AppLaunch.exe" called "GetProcAddress" with a parameter AllocateAndInitializeSid (UID: 00000000-00004136) "AppLaunch.exe" called "GetProcAddress" with a parameter EqualSid (UID: 00000000-00004136) "AppLaunch.exe" called "GetProcAddress" with a parameter FreeSid (UID: 00000000-00004136) "AppLaunch.exe" called "GetProcAddress" with a parameter CryptGenRandom (UID: 00000000-00004136) "AppLaunch.exe" called "GetProcAddress" with a parameter GetFileSize (UID: 00000000-00004136) "AppLaunch.exe" called "GetProcAddress" with a parameter ReadFile (UID: 00000000-00004136) "AppLaunch.exe" called "GetProcAddress" with a parameter GetSystemMetrics (UID: 00000000-00004136) "AppLaunch.exe" called "GetProcAddress" with a parameter GetModuleHandle (UID: 00000000-00004136) "AppLaunch.exe" called "GetProcAddress" with a parameter GetModuleHandleW (UID: 00000000-00004136) "AppLaunch.exe" called "GetProcAddress" with a parameter GetProcAddress (UID: 00000000-00004136) "AppLaunch.exe" called "GetProcAddress" with a parameter WideCharToMultiByte (UID: 00000000-00004136) "AppLaunch.exe" called "GetProcAddress" with a parameter LoadLibraryEx (UID: 00000000-00004136) "AppLaunch.exe" called "GetProcAddress" with a parameter LoadLibraryExW (UID: 00000000-00004136) "AppLaunch.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00004136) "AppLaunch.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00004136) "AppLaunch.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00004136) "AppLaunch.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00004136) "AppLaunch.exe" called "GetProcAddress" with a parameter EncodePointer (UID: 00000000-00004136) "AppLaunch.exe" called "GetProcAddress" with a parameter DecodePointer (UID: 00000000-00004136) "AppLaunch.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionAndSpinCount (UID: 00000000-00004136) "AppLaunch.exe" called "GetProcAddress" with a parameter ProcessIdToSessionId (UID: 00000000-00004136) "AppLaunch.exe" called "GetProcAddress" with a parameter ImmCreateContext (UID: 00000000-00004136) "AppLaunch.exe" called "GetProcAddress" with a parameter ImmDestroyContext (UID: 00000000-00004136) "AppLaunch.exe" called "GetProcAddress" with a parameter ImmNotifyIME (UID: 00000000-00004136) "AppLaunch.exe" called "GetProcAddress" with a parameter ImmAssociateContext (UID: 00000000-00004136) "AppLaunch.exe" called "GetProcAddress" with a parameter ImmReleaseContext (UID: 00000000-00004136) "AppLaunch.exe" called "GetProcAddress" with a parameter ImmGetContext (UID: 00000000-00004136) "AppLaunch.exe" called "GetProcAddress" with a parameter ImmGetCompositionStringA (UID: 00000000-00004136) "AppLaunch.exe" called "GetProcAddress" with a parameter ImmSetCompositionStringA (UID: 00000000-00004136) "AppLaunch.exe" called "GetProcAddress" with a parameter ImmGetCompositionStringW (UID: 00000000-00004136) "AppLaunch.exe" called "GetProcAddress" with a parameter ImmSetCompositionStringW (UID: 00000000-00004136) "AppLaunch.exe" called "GetProcAddress" with a parameter ImmSetCandidateWindow (UID: 00000000-00004136) "AppLaunch.exe" called "GetProcAddress" with a parameter AdjustWindowRectEx (UID: 00000000-00004136) "AppLaunch.exe" called "GetProcAddress" with a parameter GetCurrentThread (UID: 00000000-00004136) "AppLaunch.exe" called "GetProcAddress" with a parameter DuplicateHandle (UID: 00000000-00004136) "AppLaunch.exe" called "GetProcAddress" with a parameter GetCurrentThreadId (UID: 00000000-00004136) "AppLaunch.exe" called "GetProcAddress" with a parameter GetCurrentActCtx (UID: 00000000-00004136) "AppLaunch.exe" called "GetProcAddress" with a parameter ActivateActCtx (UID: 00000000-00004136) "AppLaunch.exe" called "GetProcAddress" with a parameter DefWindowProcW (UID: 00000000-00004136) "AppLaunch.exe" called "GetProcAddress" with a parameter GetStockObject (UID: 00000000-00004136) "AppLaunch.exe" called "GetProcAddress" with a parameter RegisterClass (UID: 00000000-00004136) "AppLaunch.exe" called "GetProcAddress" with a parameter RegisterClassW (UID: 00000000-00004136) "AppLaunch.exe" called "GetProcAddress" with a parameter CreateWindowEx (UID: 00000000-00004136) "AppLaunch.exe" called "GetProcAddress" with a parameter CreateWindowExW (UID: 00000000-00004136) "AppLaunch.exe" called "GetProcAddress" with a parameter SetWindowLong (UID: 00000000-00004136) "AppLaunch.exe" called "GetProcAddress" with a parameter SetWindowLongW (UID: 00000000-00004136) "AppLaunch.exe" called "GetProcAddress" with a parameter GetWindowLong (UID: 00000000-00004136) "AppLaunch.exe" called "GetProcAddress" with a parameter GetWindowLongW (UID: 00000000-00004136) "AppLaunch.exe" called "GetProcAddress" with a parameter RegQueryValueEx (UID: 00000000-00004136) "AppLaunch.exe" called "GetProcAddress" with a parameter RegQueryValueExW (UID: 00000000-00004136) "AppLaunch.exe" called "GetProcAddress" with a parameter CallWindowProc (UID: 00000000-00004136) "AppLaunch.exe" called "GetProcAddress" with a parameter CallWindowProcW (UID: 00000000-00004136) "AppLaunch.exe" called "GetProcAddress" with a parameter GetClientRect (UID: 00000000-00004136) "AppLaunch.exe" called "GetProcAddress" with a parameter GetWindowRect (UID: 00000000-00004136) "AppLaunch.exe" called "GetProcAddress" with a parameter GetParent (UID: 00000000-00004136) "AppLaunch.exe" called "GetProcAddress" with a parameter DeactivateActCtx (UID: 00000000-00004136) "AppLaunch.exe" called "GetProcAddress" with a parameter CryptImportKey (UID: 00000000-00004136) "AppLaunch.exe" called "GetProcAddress" with a parameter CryptExportKey (UID: 00000000-00004136) "AppLaunch.exe" called "GetProcAddress" with a parameter CryptCreateHash (UID: 00000000-00004136) "AppLaunch.exe" called "GetProcAddress" with a parameter CryptHashData (UID: 00000000-00004136) "AppLaunch.exe" called "GetProcAddress" with a parameter CryptGetHashParam (UID: 00000000-00004136) "AppLaunch.exe" called "GetProcAddress" with a parameter CryptDestroyHash (UID: 00000000-00004136) "AppLaunch.exe" called "GetProcAddress" with a parameter CryptDestroyKey (UID: 00000000-00004136) "AppLaunch.exe" called "GetProcAddress" with a parameter LocalAlloc (UID: 00000000-00004136) "AppLaunch.exe" called "GetProcAddress" with a parameter _calloc_base (UID: 00000000-00004136) "AppLaunch.exe" called "GetProcAddress" with a parameter InitializeSListHead (UID: 00000000-00004136) "AppLaunch.exe" called "GetProcAddress" with a parameter malloc (UID: 00000000-00004136) "AppLaunch.exe" called "GetProcAddress" with a parameter SetProcessDPIAware (UID: 00000000-00004136) "AppLaunch.exe" called "GetProcAddress" with a parameter GetEnvironmentVariableW (UID: 00000000-00004136) "AppLaunch.exe" called "GetProcAddress" with a parameter PathAppendW (UID: 00000000-00004136) "AppLaunch.exe" called "GetProcAddress" with a parameter DWriteCreateFactory (UID: 00000000-00004136) "AppLaunch.exe" called "GetProcAddress" with a parameter PathCombineW (UID: 00000000-00004136) "AppLaunch.exe" called "GetProcAddress" with a parameter LoadLibraryW (UID: 00000000-00004136) "AppLaunch.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00004136) "AppLaunch.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00004136) "AppLaunch.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00004136) "AppLaunch.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00004136) "AppLaunch.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00004136) "AppLaunch.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00004136) "AppLaunch.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00004136) "AppLaunch.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00004136) "AppLaunch.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00004136) "AppLaunch.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00004136) "AppLaunch.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00004136) "AppLaunch.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00004136) "AppLaunch.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00004136) "AppLaunch.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00004136) "AppLaunch.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00004136) "AppLaunch.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00004136) "AppLaunch.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00004136) "AppLaunch.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00004136) "AppLaunch.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00004136) "AppLaunch.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00004136) "AppLaunch.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00004136) "AppLaunch.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00004136) "AppLaunch.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00004136) "AppLaunch.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00004136) "AppLaunch.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00004136) "AppLaunch.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00004136) "AppLaunch.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00004136) "AppLaunch.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00004136) "AppLaunch.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00004136) "AppLaunch.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00004136) "AppLaunch.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00004136) "AppLaunch.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00004136) "AppLaunch.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00004136) "AppLaunch.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00004136) "AppLaunch.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00004136) "AppLaunch.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00004136) "AppLaunch.exe" called "GetProcAddress" with a parameter EnumSystemLocalesEx (UID: 00000000-00004136) "AppLaunch.exe" called "GetProcAddress" with a parameter GetDateFormatEx (UID: 00000000-00004136) "AppLaunch.exe" called "GetProcAddress" with a parameter GetTimeFormatEx (UID: 00000000-00004136) "AppLaunch.exe" called "GetProcAddress" with a parameter IsValidLocaleName (UID: 00000000-00004136) "AppLaunch.exe" called "GetProcAddress" with a parameter GdiEntry13 (UID: 00000000-00004136) "AppLaunch.exe" called "GetProcAddress" with a parameter EventWrite (UID: 00000000-00004136) "AppLaunch.exe" called "GetProcAddress" with a parameter EventRegister (UID: 00000000-00004136) "AppLaunch.exe" called "GetProcAddress" with a parameter EventUnregister (UID: 00000000-00004136) "AppLaunch.exe" called "GetProcAddress" with a parameter GetDynamicTimeZoneInformation (UID: 00000000-00004136) "AppLaunch.exe" called "GetProcAddress" with a parameter SHGetFolderPath (UID: 00000000-00004136) "AppLaunch.exe" called "GetProcAddress" with a parameter GetFileMUIPath (UID: 00000000-00004136) "AppLaunch.exe" called "GetProcAddress" with a parameter FreeLibrary (UID: 00000000-00004136) "AppLaunch.exe" called "GetProcAddress" with a parameter FreeLibraryW (UID: 00000000-00004136) "AppLaunch.exe" called "GetProcAddress" with a parameter LoadStringW (UID: 00000000-00004136) "AppLaunch.exe" called "GetProcAddress" with a parameter GetFileVersionInfoSizeW (UID: 00000000-00004136) "AppLaunch.exe" called "GetProcAddress" with a parameter GetFileVersionInfoW (UID: 00000000-00004136) "AppLaunch.exe" called "GetProcAddress" with a parameter VerQueryValueW (UID: 00000000-00004136) "AppLaunch.exe" called "GetProcAddress" with a parameter CryptAcquireContextA (UID: 00000000-00004136) "AppLaunch.exe" called "GetProcAddress" with a parameter CryptReleaseContext (UID: 00000000-00004136) "5jR9Wp3.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00002464) "5jR9Wp3.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00002464) "5jR9Wp3.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00002464) "5jR9Wp3.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00002464) "5jR9Wp3.exe" called "GetProcAddress" with a parameter UnregisterTraceGuids (UID: 00000000-00002464) "cmd.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00004048) "cmd.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00004048) "cmd.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00004048) "cmd.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00004048) "cmd.exe" called "GetProcAddress" with a parameter OleInitialize (UID: 00000000-00004048) "cmd.exe" called "GetProcAddress" with a parameter ThemeInitApiHook (UID: 00000000-00004048) "cmd.exe" called "GetProcAddress" with a parameter IsProcessDPIAware (UID: 00000000-00004048) "cmd.exe" called "GetProcAddress" with a parameter CoTaskMemAlloc (UID: 00000000-00004048) "cmd.exe" called "GetProcAddress" with a parameter RegisterTraceGuidsW (UID: 00000000-00004048) "cmd.exe" called "GetProcAddress" with a parameter EventRegister (UID: 00000000-00004048) "cmd.exe" called "GetProcAddress" with a parameter EventUnregister (UID: 00000000-00004048) "cmd.exe" called "GetProcAddress" with a parameter EventEnabled (UID: 00000000-00004048) "cmd.exe" called "GetProcAddress" with a parameter EventWrite (UID: 00000000-00004048) "cmd.exe" called "GetProcAddress" with a parameter LpkEditControl (UID: 00000000-00004048) "cmd.exe" called "GetProcAddress" with a parameter OpenThreadToken (UID: 00000000-00004048) "cmd.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00004048) "cmd.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00004048) "cmd.exe" called "GetProcAddress" with a parameter AcquireSRWLockShared (UID: 00000000-00004048) "cmd.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00004048) "cmd.exe" called "GetProcAddress" with a parameter ReleaseSRWLockShared (UID: 00000000-00004048) "cmd.exe" called "GetProcAddress" with a parameter EventSetInformation (UID: 00000000-00004048) "cmd.exe" called "GetProcAddress" with a parameter InitCommonControlsEx (UID: 00000000-00004048) "cmd.exe" called "GetProcAddress" with a parameter OpenProcessToken (UID: 00000000-00004048) "cmd.exe" called "GetProcAddress" with a parameter AllocateAndInitializeSid (UID: 00000000-00004048) "cmd.exe" called "GetProcAddress" with a parameter CheckTokenMembership (UID: 00000000-00004048) "cmd.exe" called "GetProcAddress" with a parameter FreeSid (UID: 00000000-00004048) "cmd.exe" called "GetProcAddress" with a parameter RegisterTraceGuidsA (UID: 00000000-00004048) "cmd.exe" called "GetProcAddress" with a parameter IsValidURL (UID: 00000000-00004048) "cmd.exe" called "GetProcAddress" with a parameter SHStrDupW (UID: 00000000-00004048) "cmd.exe" called "GetProcAddress" with a parameter CoTaskMemFree (UID: 00000000-00004048) "cmd.exe" called "GetProcAddress" with a parameter PSCreateMemoryPropertyStore (UID: 00000000-00004048) "cmd.exe" called "GetProcAddress" with a parameter PSCreateAdapterFromPropertyStore (UID: 00000000-00004048) "cmd.exe" called "GetProcAddress" with a parameter PropVariantToBSTR (UID: 00000000-00004048) "cmd.exe" called "GetProcAddress" with a parameter PropVariantClear (UID: 00000000-00004048) "cmd.exe" called "GetProcAddress" with a parameter IUnknown_Set (UID: 00000000-00004048) "cmd.exe" called "GetProcAddress" with a parameter ResolveDelayLoadedAPI (UID: 00000000-00004048) "cmd.exe" called "GetProcAddress" with a parameter PSPropertyBag_ReadStrAlloc (UID: 00000000-00004048) "cmd.exe" called "GetProcAddress" with a parameter PSPropertyBag_ReadDWORD (UID: 00000000-00004048) "cmd.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00004048) "cmd.exe" called "GetProcAddress" with a parameter FindWindowExW (UID: 00000000-00004048) "cmd.exe" called "GetProcAddress" with a parameter RegQueryValueExW (UID: 00000000-00004048) "cmd.exe" called "GetProcAddress" with a parameter OleUninitialize (UID: 00000000-00004048) "cmd.exe" called "GetProcAddress" with a parameter UnregisterTraceGuids (UID: 00000000-00004048)38:T513,Sleep@KERNEL32.DLL at 00000000-00005724-53966-11-012F6A60 WaitForSingleObject@KERNEL32.DLL at 00000000-00005724-53966-37-012F3FEF MsgWaitForMultipleObjects at 00000000-00005724-53966-95-012F3680 WaitForSingleObjectEx@KERNEL32.DLL at 00000000-00006044-55011-1491-00EF5EFE SleepConditionVariableSRW@KERNEL32.DLL at 00000000-00006044-55011-1628-00EF52B2 WaitForSingleObjectEx@KERNEL32.DLL at 00000000-00004188-56710-637-00E65EFE SleepConditionVariableSRW@KERNEL32.DLL at 00000000-00004188-56710-774-00E652B2 WaitForSingleObjectEx@KERNEL32.DLL at 00000000-00004180-57549-1172-00A25EFE SleepConditionVariableSRW@KERNEL32.DLL at 00000000-00004180-57549-1309-00A252B2 RegisterWaitForSingleObject@KERNEL32.DLL at 00000000-00002464-58652-36-00412722 Sleep@KERNEL32.DLL at 00000000-00002464-58652-147-00409311 WaitForSingleObject@KERNEL32.DLL at 00000000-00002464-58652-154-004098F7 WaitForSingleObject@KERNEL32.DLL at 00000000-00002464-58652-156-00409A1F Sleep@KERNEL32.DLL at 00000000-00002464-58652-178-0040E0C3 WaitForSingleObject@KERNEL32.DLL at 00000000-00002464-58652-219-0040548C WaitForSingleObject@KERNEL32.DLL at 00000000-00002464-58652-228-004053E4 WaitForSingleObject@KERNEL32.DLL at 00000000-00002464-58652-229-004053C1 Sleep@KERNEL32.DLL at 00000000-00002464-58652-233-004056D839:T57b,Found reference to API "GetCommandLineA" (Indicator: "GetCommandLine"; File: "00000000-00006044.00000000.78694.00F13000.00000004.mdmp") Found reference to API "GetCommandLineW" (Indicator: "GetCommandLine"; File: "00000000-00006044.00000000.78694.00F13000.00000004.mdmp") Found reference to API "CommandLineToArgvW" (Indicator: "CommandLineToArgv"; File: "4c75a2e2511e44061424cc86123e1ea5dc4f7c8aadebc5c3bdebbe746175b2c6") Found reference to API "GetCommandLineW" (Indicator: "GetCommandLine"; Source: "00000000-00000636.00000001.83575.00AD1000.00000020.mdmp") Found reference to API "CommandLineToArgvW" (Indicator: "CommandLineToArgv"; Source: "00000000-00000636.00000001.83575.00AD1000.00000020.mdmp") Found reference to API "GetCommandLineW" (Indicator: "GetCommandLine"; Source: "00000000-00002464.00000000.79692.00417000.00000004.mdmp") Found reference to API "GetCommandLineA" (Indicator: "GetCommandLine"; Source: "00000000-00004180.00000000.79355.00A39000.00000002.mdmp") Found reference to API "GetCommandLineW" (Indicator: "GetCommandLine"; Source: "00000000-00004180.00000000.79355.00A39000.00000002.mdmp") Found reference to API "GetCommandLineA" (Indicator: "GetCommandLine"; Source: "00000000-00004188.00000000.79028.00E79000.00000002.mdmp") Found reference to API "GetCommandLineW" (Indicator: "GetCommandLine"; Source: "00000000-00004188.00000000.79028.00E79000.00000002.mdmp")3a:T7e3,Process 1Qj66VM8.exe created mutex with name "\Sessions\1\BaseNamedObjects\Global\CLR_PerfMon_WrapMutex" Process AppLaunch.exe created mutex with name "\Sessions\1\BaseNamedObjects\Global\CLR_PerfMon_WrapMutex" Process iexplore.exe created mutex with name "\Sessions\1\BaseNamedObjects\UpdatingNewTabPageData" Process iexplore.exe created mutex with name "\Sessions\1\BaseNamedObjects\{5312EE61-79E3-4A24-BFE1-132B85B23C3A}" Process iexplore.exe created mutex with name "\Sessions\1\BaseNamedObjects\IsoScope_f04_IESQMMUTEX_0_303" Process iexplore.exe created mutex with name "\Sessions\1\BaseNamedObjects\IsoScope_f04_IESQMMUTEX_0_331" Process iexplore.exe created mutex with name "\Sessions\1\BaseNamedObjects\{66D0969A-1E86-44CF-B4EC-3806DDDA3B5D}" Process iexplore.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\ZonesCacheCounterMutex" Process iexplore.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\ZonesLockedCacheCounterMutex" Process iexplore.exe created mutex with name "\Sessions\1\BaseNamedObjects\IsoScope_f04_IESQMMUTEX_0_519" Process iexplore.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\!BrowserEmulation!SharedMemory!Mutex" Process iexplore.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\VERMGMTBlockListFileMutex" Process iexplore.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\URLBLOCK_FILEMAPSWITCH_MUTEX_3844" Process iexplore.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\URLBLOCK_HASHFILESWITCH_MUTEX" Process iexplore.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\URLBLOCK_DOWNLOAD_MUTEX" Process iexplore.exe created mutex with name "\Sessions\1\BaseNamedObjects\IsoScope_f04_IE_EarlyTabStart_0x102c_Mutex" Process iexplore.exe created mutex with name "\Sessions\1\BaseNamedObjects\IsoScope_f04_ConnHashTable<3844>_HashTable_Mutex" Process iexplore.exe created mutex with name "\Sessions\1\BaseNamedObjects\IsoScope_f04_IESQMMUTEX_0_274"3b:T96b,"1Qj66VM8.exe" failed to load missing module "api-ms-win-core-quirks-l1-1-0.dll" - [base:0; Status:c0000135] "1Qj66VM8.exe" failed to load missing module "api-ms-win-appmodel-runtime-l1-1-2.dll" - [base:0; Status:c0000135] "1Qj66VM8.exe" failed to load missing module "api-ms-win-appmodel-runtime-l1-1-0.dll" - [base:0; Status:c0000135] "1Qj66VM8.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoree.dll" - [base:0; Status:c0000135] "1Qj66VM8.exe" failed to load missing module "%WINDIR%\system32\combase.dll" - [base:0; Status:c0000135] "1Qj66VM8.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\ole32.dll" - [base:0; Status:c0000135] "1Qj66VM8.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll" - [base:0; Status:c0000135] "AppLaunch.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\ole32.dll" - [base:0; Status:c0000135] "AppLaunch.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\uxtheme.dll" - [base:0; Status:c0000135] "AppLaunch.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll" - [base:0; Status:c0000135] "AppLaunch.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\PresentationCore\v4.0_4.0.0.0__31bf3856ad364e35\ucrtbase_clr0400.dll" - [base:0; Status:c0000135] "AppLaunch.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\PresentationCore\v4.0_4.0.0.0__31bf3856ad364e35\SHLWAPI.dll" - [base:0; Status:c0000135] "AppLaunch.exe" failed to load missing module "api-ms-win-core-datetime-l1-1-1" - [base:0; Status:c0000135] "AppLaunch.exe" failed to load missing module "api-ms-win-core-localization-obsolete-l1-2-0" - [base:0; Status:c0000135] "AppLaunch.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll" - [base:0; Status:c0000135] "AppLaunch.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\VERSION.dll" - [base:0; Status:c0000135] "AppLaunch.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ws2_32.dll" - [base:0; Status:c0000135]3c:T651,"4c75a2e2511e44061424cc86123e1ea5dc4f7c8aadebc5c3bdebbe746175b2c6" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE "ei4JY63.exe" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE "BC6EJ61.exe" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE "4hj421HX.exe" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE "Bw1Vp89.exe" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE "2Ix4962.exe" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE "3TI36uw.exe" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE "1Qj66VM8.exe" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE "DISMHOST.EXE.6A8C05FD.bin" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE3d:T78a,Found string "https://accounts.google.com/v3/signin/identifier?checkConnection=youtube:274&checkedDomains=youtubeficontinue=https://acco" (Indicator: "youtube"; File: "screen_5.png") Found string "https://www.facebook.com/login" (Indicator: "facebook.com"; File: "4c75a2e2511e44061424cc86123e1ea5dc4f7c8aadebc5c3bdebbe746175b2c6") Found string "@shift /0start "" https://www.facebook.com/loginstart "" https://accounts.google.com" (Indicator: "facebook.com"; File: "E7D1.bat") file/memory contains long string with (Indicator: "youtube"; File: "~DF0843FE2919FA6B77.TMP") Found string "0BlgfzRYbJP1UirTU..Bqi8dN..AAA.0.0.Bqi8dN.AWczzOTiUgglzyEwDD8aSzKt-H0facebook.com/9217108729254431291961426016517531273875TceLajcfAA-3AamqnbaP7RHNfacebook.com/9217263174668831354322426172517831273875" (Indicator: "facebook.com"; File: "S0WUENBR.txt") Found string "0BlgfzRYbJP1UirTU..Bqi8dN..AAA.0.0.Bqi8dN.AWczzOTiUgglzyEwDD8aSzKt-H0facebook.com/9217108729254431291961426016517531273875" (Indicator: "facebook.com"; File: "8RPM4Z50.txt") Found string "CONSENTWP.2676bayoutube.com/102431383388163210825482504061830633367" (Indicator: "youtube"; File: "36HNBSN2.txt") Found string "accounts.youtube.com" (Indicator: "youtube"; File: "PCAP") Found string "www.facebook.com" (Indicator: "facebook.com"; File: "PCAP") Found string "GET /login HTTP/1.1Accept: text/html, application/xhtml+xml, */*Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: www.facebook.comDNT: 1Connection: Keep-Alive" (Indicator: "facebook.com"; File: "SSL") file/memory contains long string with (Indicator: "youtube"; File: "SSL") file/memory contains long string with (Indicator: "facebook.com"; File: "SSL") Found string ""%PROGRAMFILES%\Internet Explorer\iexplore.exe" https://www.facebook.com/login" (Indicator: "facebook.com"; Source: "00000000-00004048-00000C47-3681228356")3e:T1209,"Software\Microsoft\Active Setup\Installed Components\{89820200-ECBD-11CF-8B85-00AA005B4383}" in Source: 00000000-00000636.00000001.83575.00AD1000.00000020.mdmp "REGISTRY\USER\S-1-5-21-2092356043-4041700817-663127204-1001\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags" in Source: 00000000-00004180.00000000.79355.00410000.00000004.mdmp "REGISTRY\USER\S-1-5-21-2092356043-4041700817-663127204-1001\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags" in Source: 00000000-00004188.00000000.79023.00440000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\App Paths" in Source: 00000000-00005348.00000000.78221.01301000.00000020.mdmp "Software\Microsoft\Windows\CurrentVersion\App Paths" in Source: 00000000-00005720.00000001.79031.008E1000.00000020.mdmp "Software\Microsoft\Windows\CurrentVersion\App Paths" in Source: 00000000-00005724.00000000.78303.012F1000.00000020.mdmp "Software\Microsoft\Windows\CurrentVersion\App Paths" in Source: 00000000-00005732.00000000.78155.00391000.00000020.mdmp "SOFTWARE\Microsoft\Windows Defender\Features" in Source: 00000000-00005740.00000000.78350.01E00000.00000004.mdmp "SOFTWARE\Policies\Microsoft\Windows Defender" in Source: 00000000-00005740.00000000.78350.01E00000.00000004.mdmp "SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" in Source: 00000000-00005740.00000000.78350.01E00000.00000004.mdmp "SOFTWARE\Policies\Microsoft\Windows Defender Security Center\Notifications" in Source: 00000000-00005740.00000000.78350.01E00000.00000004.mdmp "SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU" in Source: 00000000-00005740.00000000.78350.01E00000.00000004.mdmp "SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate" in Source: 00000000-00005740.00000000.78350.01E00000.00000004.mdmp "System\CurrentControlSet\Control\Nls\RegionMapping" in Source: 00000000-00005740.00000000.78350.01E00000.00000004.mdmp "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Defender\Features" in Source: 00000000-00005740.00000000.78350.01E00000.00000004.mdmp "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender" in Source: 00000000-00005740.00000000.78350.01E00000.00000004.mdmp "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" in Source: 00000000-00005740.00000000.78350.01E00000.00000004.mdmp "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender Security Center\Notifications" in Source: 00000000-00005740.00000000.78350.01E00000.00000004.mdmp "SOFTWARE\Microsoft\Windows Defender\Features" in Source: 00000000-00005740.00000001.78364.01E00000.00000004.mdmp "SOFTWARE\Policies\Microsoft\Windows Defender" in Source: 00000000-00005740.00000001.78364.01E00000.00000004.mdmp "SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" in Source: 00000000-00005740.00000001.78364.01E00000.00000004.mdmp "SOFTWARE\Policies\Microsoft\Windows Defender Security Center\Notifications" in Source: 00000000-00005740.00000001.78364.01E00000.00000004.mdmp "SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU" in Source: 00000000-00005740.00000001.78364.01E00000.00000004.mdmp "SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate" in Source: 00000000-00005740.00000001.78364.01E00000.00000004.mdmp "System\CurrentControlSet\Control\Nls\RegionMapping" in Source: 00000000-00005740.00000001.78364.01E00000.00000004.mdmp "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Defender\Features" in Source: 00000000-00005740.00000001.78364.01E00000.00000004.mdmp "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender" in Source: 00000000-00005740.00000001.78364.01E00000.00000004.mdmp "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" in Source: 00000000-00005740.00000001.78364.01E00000.00000004.mdmp "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender Security Center\Notifications" in Source: 00000000-00005740.00000001.78364.01E00000.00000004.mdmp "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU" in Source: 00000000-00005740.00000001.78364.01E00000.00000004.mdmp "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate" in Source: 00000000-00005740.00000001.78364.01E00000.00000004.mdmp "EGISTRY\USER\S-1-5-21-2092356043-4041700817-663127204-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders" in Source: 00000000-00006044.00000000.78694.00290000.00000004.mdmp "REGISTRY\USER\S-1-5-21-2092356043-4041700817-663127204-1001\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags" in Source: 00000000-00006044.00000000.78694.00290000.00000004.mdmp3f:T28ff,"GET /r/gsr1.crl HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: c.pki.goog" Response ==> HTTP/1.1 200 OK Accept-Ranges: bytes Content-Security-Policy-Report-Only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/cacerts Cross-Origin-Resource-Policy: cross-origin Cross-Origin-Opener-Policy: same-origin; report-to="cacerts" Report-To: {"group":"cacerts" "max_age":2592000 "endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/cacerts"}]} Content-Length: 1739 X-Content-Type-Options: nosniff Server: sffe X-XSS-Protection: 0 Date: Mon 24 Aug 2026 04:05:49 GMT Expires: Mon 24 Aug 2026 04:55:49 GMT Cache-Control: public max-age=3000 Age: 1068 Last-Modified: Tue 07 Jul 2026 08:38:00 GMT Content-Type: application/pkix-crl Vary: Accept-Encoding with response body ==>30C28206C38730C28205C2AF020101300D06092AC28648C286C3B70D01010B05003057310B300906035504061302424531193017060355040A1310476C6F6261....... "GET /r/r4.crl HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: c.pki.goog" Response ==> HTTP/1.1 200 OK Accept-Ranges: bytes Content-Security-Policy-Report-Only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/cacerts Cross-Origin-Resource-Policy: cross-origin Cross-Origin-Opener-Policy: same-origin; report-to="cacerts" Report-To: {"group":"cacerts" "max_age":2592000 "endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/cacerts"}]} Content-Length: 528 X-Content-Type-Options: nosniff Server: sffe X-XSS-Protection: 0 Date: Mon 24 Aug 2026 03:37:57 GMT Expires: Mon 24 Aug 2026 04:27:57 GMT Cache-Control: public max-age=3000 Age: 2740 Last-Modified: Wed 11 Feb 2026 14:38:00 GMT Content-Type: application/pkix-crl Vary: Accept-Encoding with response body ==>30C282020C30C28201C293020101300A06082AC28648C38E3D0403033047310B300906035504061302555331223020060355040A1319476F6F676C6520547275....... "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEA59dSNcqDdhV39MzSTNbR0%3D HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.digicert.cn" Response ==> HTTP/1.1 200 OK Server: Tengine Content-Type: application/ocsp-response Content-Length: 471 Connection: keep-alive Cache-Control: max-age=7200 Date: Mon 24 Aug 2026 03:34:19 GMT Via: ens-cache24.l2us5[0 0 200-0 H] ens-cache35.l2us5[1 0] ens-cache33.us34[0 0 200-0 H] ens-cache38.us34[1 0] Age: 2958 Ali-Swift-Global-Savetime: 1787542459 X-Cache: HIT TCP_MEM_HIT dirn:-2:-2 X-Swift-SaveTime: Mon 24 Aug 2026 03:34:23 GMT X-Swift-CacheTime: 3596 Timing-Allow-Origin: * EagleId: a3b53cba17875454172313635e with response body ==>30C28201C3930A0100C2A0C28201C38C30C28201C38806092B060105050730010104C28201C2B930C28201C2B530C281C29EC2A2160414C2B13EC3836903C3B8....... "GET /we2/yK5nPhtHKQs.crl HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: c.pki.goog" Response ==> HTTP/1.1 200 OK Accept-Ranges: bytes Content-Security-Policy-Report-Only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/cacerts Cross-Origin-Resource-Policy: cross-origin Cross-Origin-Opener-Policy: same-origin; report-to="cacerts" Report-To: {"group":"cacerts" "max_age":2592000 "endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/cacerts"}]} Content-Length: 28599 X-Content-Type-Options: nosniff Server: sffe X-XSS-Protection: 0 Date: Mon 24 Aug 2026 03:43:18 GMT Expires: Mon 24 Aug 2026 04:33:18 GMT Cache-Control: public max-age=3000 Age: 2419 Last-Modified: Mon 24 Aug 2026 01:25:54 GMT Content-Type: application/pkix-crl Vary: Accept-Encoding with response body ==>30C2826FC2B330C2826F59020101300A06082AC28648C38E3D040302303B310B3009060355040613025553311E301C060355040A1315476F6F676C6520547275....... "GET /we2/xuzt3PU9F_w.crl HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: c.pki.goog" Response ==> HTTP/1.1 200 OK Accept-Ranges: bytes Content-Security-Policy-Report-Only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/cacerts Cross-Origin-Resource-Policy: cross-origin Cross-Origin-Opener-Policy: same-origin; report-to="cacerts" Report-To: {"group":"cacerts" "max_age":2592000 "endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/cacerts"}]} Content-Length: 29433 X-Content-Type-Options: nosniff Server: sffe X-XSS-Protection: 0 Date: Mon 24 Aug 2026 03:38:05 GMT Expires: Mon 24 Aug 2026 04:28:05 GMT Cache-Control: public max-age=3000 Last-Modified: Mon 24 Aug 2026 02:43:59 GMT Content-Type: application/pkix-crl Vary: Accept-Encoding Age: 2733 with response body ==>30C28272C3B530C28272C29C020101300A06082AC28648C38E3D040302303B310B3009060355040613025553311E301C060355040A1315476F6F676C65205472....... "GET /we2/dTM3-0hpWfE.crl HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: c.pki.goog" Response ==> HTTP/1.1 200 OK Accept-Ranges: bytes Content-Security-Policy-Report-Only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/cacerts Cross-Origin-Resource-Policy: cross-origin Cross-Origin-Opener-Policy: same-origin; report-to="cacerts" Report-To: {"group":"cacerts" "max_age":2592000 "endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/cacerts"}]} Content-Length: 29541 X-Content-Type-Options: nosniff Server: sffe X-XSS-Protection: 0 Date: Mon 24 Aug 2026 04:08:49 GMT Expires: Mon 24 Aug 2026 04:58:49 GMT Cache-Control: public max-age=3000 Last-Modified: Mon 24 Aug 2026 02:39:36 GMT Content-Type: application/pkix-crl Vary: Accept-Encoding Age: 890 with response body ==>30C282736130C2827307020101300A06082AC28648C38E3D040302303B310B3009060355040613025553311E301C060355040A1315476F6F676C652054727573....... "GET /r/r1.crl HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: c.pki.goog" Response ==> HTTP/1.1 200 OK Accept-Ranges: bytes Content-Security-Policy-Report-Only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/cacerts Cross-Origin-Resource-Policy: cross-origin Cross-Origin-Opener-Policy: same-origin; report-to="cacerts" Report-To: {"group":"cacerts" "max_age":2592000 "endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/cacerts"}]} Content-Length: 993 X-Content-Type-Options: nosniff Server: sffe X-XSS-Protection: 0 Date: Mon 24 Aug 2026 03:36:42 GMT Expires: Mon 24 Aug 2026 04:26:42 GMT Cache-Control: public max-age=3000 Age: 2817 Last-Modified: Wed 11 Feb 2026 14:38:00 GMT Content-Type: application/pkix-crl Vary: Accept-Encoding with response body ==>30C28203C39D30C28201C385020101300D06092AC28648C286C3B70D01010B05003047310B300906035504061302555331223020060355040A1319476F6F676C....... "GET /wr2/oBFYYahzgVI.crl HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: c.pki.goog" Response ==> HTTP/1.1 200 OK Accept-Ranges: bytes Content-Security-Policy-Report-Only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/cacerts Cross-Origin-Resource-Policy: cross-origin Cross-Origin-Opener-Policy: same-origin; report-to="cacerts" Report-To: {"group":"cacerts" "max_age":2592000 "endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/cacerts"}]} Content-Length: 39019 X-Content-Type-Options: nosniff Server: sffe X-XSS-Protection: 0 Date: Mon 24 Aug 2026 04:16:16 GMT Expires: Mon 24 Aug 2026 05:06:16 GMT Cache-Control: public max-age=3000 Last-Modified: Mon 24 Aug 2026 02:47:22 GMT Content-Type: application/pkix-crl Vary: Accept-Encoding Age: 443 with response body ==>30C282C2986730C282C2974F020101300D06092AC28648C286C3B70D01010B0500303B310B3009060355040613025553311E301C060355040A1315476F6F676C....... "GET /r/gsr1.crl HTTP/1.1 Cache-Control: max-age = 3000 Connection: Keep-Alive Accept: */* If-Modified-Since: Tue, 07 Jul 2026 08:38:00 GMT User-Agent: Microsoft-CryptoAPI/6.1 Host: c.pki.goog" Response ==> HTTP/1.1 304 Not Modified Date: Mon 24 Aug 2026 04:05:49 GMT Expires: Mon 24 Aug 2026 04:55:49 GMT Age: 1186 Last-Modified: Tue 07 Jul 2026 08:38:00 GMT Cache-Control: public max-age=3000 Vary: Accept-Encoding with no response body "GET /r/r4.crl HTTP/1.1 Cache-Control: max-age = 3000 Connection: Keep-Alive Accept: */* If-Modified-Since: Wed, 11 Feb 2026 14:38:00 GMT User-Agent: Microsoft-CryptoAPI/6.1 Host: c.pki.goog" Response ==> HTTP/1.1 304 Not Modified Date: Mon 24 Aug 2026 03:37:57 GMT Expires: Mon 24 Aug 2026 04:27:57 GMT Age: 2858 Last-Modified: Wed 11 Feb 2026 14:38:00 GMT Cache-Control: public max-age=3000 Vary: Accept-Encoding with no response body "GET /we2/xuzt3PU9F_w.crl HTTP/1.1 Cache-Control: max-age = 3000 Connection: Keep-Alive Accept: */* If-Modified-Since: Mon, 24 Aug 2026 02:43:59 GMT User-Agent: Microsoft-CryptoAPI/6.1 Host: c.pki.goog" Response ==> HTTP/1.1 304 Not Modified Date: Mon 24 Aug 2026 03:38:05 GMT Expires: Mon 24 Aug 2026 04:28:05 GMT Last-Modified: Mon 24 Aug 2026 02:43:59 GMT Cache-Control: public max-age=3000 Vary: Accept-Encoding Age: 2850 with no response body "GET /we2/dTM3-0hpWfE.crl HTTP/1.1 Cache-Control: max-age = 3000 Connection: Keep-Alive Accept: */* If-Modified-Since: Mon, 24 Aug 2026 02:39:36 GMT User-Agent: Microsoft-CryptoAPI/6.1 Host: c.pki.goog" Response ==> HTTP/1.1 304 Not Modified Date: Mon 24 Aug 2026 04:08:49 GMT Expires: Mon 24 Aug 2026 04:58:49 GMT Last-Modified: Mon 24 Aug 2026 02:39:36 GMT Cache-Control: public max-age=3000 Vary: Accept-Encoding Age: 1006 with no response body "GET /r/r1.crl HTTP/1.1 Cache-Control: max-age = 3000 Connection: Keep-Alive Accept: */* If-Modified-Since: Wed, 11 Feb 2026 14:38:00 GMT User-Agent: Microsoft-CryptoAPI/6.1 Host: c.pki.goog" Response ==> HTTP/1.1 304 Not Modified Date: Mon 24 Aug 2026 03:36:42 GMT Expires: Mon 24 Aug 2026 04:26:42 GMT Age: 2933 Last-Modified: Wed 11 Feb 2026 14:38:00 GMT Cache-Control: public max-age=3000 Vary: Accept-Encoding with no response body "GET /wr2/oBFYYahzgVI.crl HTTP/1.1 Cache-Control: max-age = 3000 Connection: Keep-Alive Accept: */* If-Modified-Since: Mon, 24 Aug 2026 02:47:22 GMT User-Agent: Microsoft-CryptoAPI/6.1 Host: c.pki.goog" Response ==> HTTP/1.1 304 Not Modified Date: Mon 24 Aug 2026 04:16:16 GMT Expires: Mon 24 Aug 2026 05:06:16 GMT Last-Modified: Mon 24 Aug 2026 02:47:22 GMT Cache-Control: public max-age=3000 Vary: Accept-Encoding Age: 559 with no response body40:T242e,"4c75a2e2511e44061424cc86123e1ea5dc4f7c8aadebc5c3bdebbe746175b2c6.exe" loaded module "%WINDIR%\SYSTEM32\ADVPACK.DLL" at base 69ef0000 "4c75a2e2511e44061424cc86123e1ea5dc4f7c8aadebc5c3bdebbe746175b2c6.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 75180000 "ei4JY63.exe" loaded module "%WINDIR%\SYSTEM32\ADVPACK.DLL" at base 69800000 "ei4JY63.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 75180000 "BC6EJ61.exe" loaded module "%WINDIR%\SYSTEM32\ADVPACK.DLL" at base 6c950000 "BC6EJ61.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 75180000 "Bw1Vp89.exe" loaded module "%WINDIR%\SYSTEM32\ADVPACK.DLL" at base 6c3c0000 "Bw1Vp89.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 75180000 "1Qj66VM8.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 68300000 "1Qj66VM8.exe" loaded module "USER32.DLL" at base 76260000 "1Qj66VM8.exe" loaded module "MSCOREE.DLL" at base 6be40000 "1Qj66VM8.exe" loaded module "PSAPI.DLL" at base 769f0000 "1Qj66VM8.exe" loaded module "RPCRT4.DLL" at base 768a0000 "1Qj66VM8.exe" loaded module "KERNEL32.DLL" at base 772f0000 "1Qj66VM8.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\MSCORLIB\36EACCFDE177C2E7B93B8DBDDE4E012A\MSCORLIB.NI.DLL" at base 63670000 "1Qj66VM8.exe" loaded module "OLE32.DLL" at base 76cf0000 "1Qj66VM8.exe" loaded module "CRYPTBASE.DLL" at base 751d0000 "1Qj66VM8.exe" loaded module "API-MS-WIN-CORE-XSTATE-L2-1-0.DLL" at base 6c970000 "1Qj66VM8.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\CLRJIT.DLL" at base 699c0000 "1Qj66VM8.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM\2C3C912EA8F058F9D04C4650128FEB3F\SYSTEM.NI.DLL" at base 62c10000 "1Qj66VM8.exe" loaded module "ADVAPI32.DLL" at base 76450000 "1Qj66VM8.exe" loaded module "SSPICLI.DLL" at base 75160000 "1Qj66VM8.exe" loaded module "ADVAPI32" at base 76450000 "1Qj66VM8.exe" loaded module "NTDLL.DLL" at base 773d0000 "1Qj66VM8.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\NLSSORTING.DLL" at base 6bf30000 "1Qj66VM8.exe" loaded module "OLEAUT32.DLL" at base 76950000 "2Ix4962.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 68300000 "2Ix4962.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 75180000 "3TI36uw.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 75180000 "4hj421HX.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 68300000 "4hj421HX.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 75180000 "AppLaunch.exe" loaded module "PSAPI.DLL" at base 769f0000 "AppLaunch.exe" loaded module "RPCRT4.DLL" at base 768a0000 "AppLaunch.exe" loaded module "KERNEL32.DLL" at base 772f0000 "AppLaunch.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\MSCORLIB\36EACCFDE177C2E7B93B8DBDDE4E012A\MSCORLIB.NI.DLL" at base 63550000 "AppLaunch.exe" loaded module "OLE32.DLL" at base 76cf0000 "AppLaunch.exe" loaded module "CRYPTBASE.DLL" at base 751d0000 "AppLaunch.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 73e20000 "AppLaunch.exe" loaded module "API-MS-WIN-CORE-XSTATE-L2-1-0.DLL" at base 6bf30000 "AppLaunch.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\CLRJIT.DLL" at base 68400000 "AppLaunch.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM\2C3C912EA8F058F9D04C4650128FEB3F\SYSTEM.NI.DLL" at base 61fd0000 "AppLaunch.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.DRAWING\F7568D7F1B9D356F64779B4C0927CFB3\SYSTEM.DRAWING.NI.DLL" at base 633a0000 "AppLaunch.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.WINDOWS.FORMS\C9A4CBC00F690A9E3CDDFC400F6E85BB\SYSTEM.WINDOWS.FORMS.NI.DLL" at base 61160000 "AppLaunch.exe" loaded module "ADVAPI32.DLL" at base 76450000 "AppLaunch.exe" loaded module "UXTHEME.DLL" at base 73e20000 "AppLaunch.exe" loaded module "USER32.DLL" at base 76260000 "AppLaunch.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.CORE\31FAE3290FAD30C31C98651462D22724\SYSTEM.CORE.NI.DLL" at base 60940000 "AppLaunch.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.CONFIGURATION\96F7EDB07B12303F0EC2595C7F3778C7\SYSTEM.CONFIGURATION.NI.DLL" at base 63290000 "AppLaunch.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.XML\15AF16D373CF0528CB74FC73D365FDBF\SYSTEM.XML.NI.DLL" at base 601c0000 "AppLaunch.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\NLSSORTING.DLL" at base 6a240000 "AppLaunch.exe" loaded module "NTDLL.DLL" at base 773d0000 "AppLaunch.exe" loaded module "SHELL32.DLL" at base 75610000 "AppLaunch.exe" loaded module "API-MS-WIN-SECURITY-SDDL-L1-1-0.DLL" at base 77570000 "AppLaunch.exe" loaded module "PROFAPI.DLL" at base 752e0000 "AppLaunch.exe" loaded module "BCRYPT.DLL" at base 74df0000 "AppLaunch.exe" loaded module "CRYPTSP.DLL" at base 74ce0000 "AppLaunch.exe" loaded module "%WINDIR%\SYSTEM32\RSAENH.DLL" at base 74a70000 "AppLaunch.exe" loaded module "IMM32.DLL" at base 76fe0000 "AppLaunch.exe" loaded module "COMCTL32.DLL" at base 71f20000 "AppLaunch.exe" loaded module "GDI32.DLL" at base 765a0000 "AppLaunch.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\WINDOWSBASE\1A4CC316FB6D09525321FC0BE44692D8\WINDOWSBASE.NI.DLL" at base 62e70000 "AppLaunch.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\PRESENTATIONCORE\468F4E17BE144CA12A73A4297EACC9CC\PRESENTATIONCORE.NI.DLL" at base 5f580000 "AppLaunch.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\PRESENTATIO5AE0F00F#\252CC7B0FAE8CFE083BDC149957C0C54\PRESENTATIONFRAMEWORK.NI.DLL" at base 5e190000 "AppLaunch.exe" loaded module "UCRTBASE_CLR0400.DLL" at base 69b80000 "AppLaunch.exe" loaded module "SHLWAPI.DLL" at base 763e0000 "AppLaunch.exe" loaded module "DWRITE.DLL" at base 62d30000 "AppLaunch.exe" loaded module "API-MS-WIN-CORE-STRING-L1-1-0" at base 75490000 "AppLaunch.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\WPF\WPFGFX_V0400.DLL" at base 5e000000 "AppLaunch.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\WPF\PRESENTATIONNATIVE_V0400.DLL" at base 5df10000 "AppLaunch.exe" loaded module "VERSION.DLL" at base 74770000 "AppLaunch.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.RUNTEB92AA12#\274E43040C8A7A02EF1065DB3283005A\SYSTEM.RUNTIME.SERIALIZATION.NI.DLL" at base 5dc30000 "AppLaunch.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.IDENTITYMODEL\C2EF5BC545B98A289F02D0B3EDDBE280\SYSTEM.IDENTITYMODEL.NI.DLL" at base 5d920000 "AppLaunch.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SMDIAGNOSTICS\DC67DCB4B2FB4A3853D458CAB08561F0\SMDIAGNOSTICS.NI.DLL" at base 699d0000 "AppLaunch.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.TRANSACTIONS\3D760B4A3260A41EF84A3FD866780980\SYSTEM.TRANSACTIONS.NI.DLL" at base 5d210000 "AppLaunch.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_32\SYSTEM.TRANSACTIONS\V4.0_4.0.0.0__B77A5C561934E089\SYSTEM.TRANSACTIONS.DLL" at base 682b0000 "AppLaunch.exe" loaded module "MSCOREE.DLL" at base 6be40000 "AppLaunch.exe" loaded module "WS2_32.DLL" at base 76cb0000 "AppLaunch.exe" loaded module "%WINDIR%\SYSTEM32\MSWSOCK.DLL" at base 74ca0000 "AppLaunch.exe" loaded module "%WINDIR%\SYSTEM32\WSHTCPIP.DLL" at base 74800000 "AppLaunch.exe" loaded module "%WINDIR%\SYSTEM32\WSHIP6.DLL" at base 74c90000 "AppLaunch.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\DIASYMREADER.DLL" at base 6a450000 "5jR9Wp3.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 75180000 "cmd.exe" loaded module "CRYPTBASE.DLL" at base 751d0000 "cmd.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 73e20000 "cmd.exe" loaded module "OLE32.DLL" at base 76cf0000 "cmd.exe" loaded module "ADVAPI32.DLL" at base 76450000 "cmd.exe" loaded module "PROPSYS.DLL" at base 73e60000 "cmd.exe" loaded module "KERNEL32.DLL" at base 772f0000 "cmd.exe" loaded module "COMCTL32.DLL" at base 741d0000 "cmd.exe" loaded module "OLEAUT32.DLL" at base 76950000 "cmd.exe" loaded module "APPHELP.DLL" at base 75180000 "cmd.exe" loaded module "CLBCATQ.DLL" at base 77590000 "cmd.exe" loaded module "%WINDIR%\SYSTEM32\IEFRAME.DLL" at base 6a6d0000 "cmd.exe" loaded module "API-MS-WIN-DOWNLEVEL-OLE32-L1-1-0.DLL" at base 753a0000 "cmd.exe" loaded module "API-MS-WIN-DOWNLEVEL-ADVAPI32-L1-1-0.DLL" at base 75340000 "cmd.exe" loaded module "URLMON.DLL" at base 76e60000 "cmd.exe" loaded module "API-MS-WIN-DOWNLEVEL-SHLWAPI-L2-1-0.DLL" at base 72080000 "cmd.exe" loaded module "%WINDIR%\SYSTEM32\PROPSYS.DLL" at base 73e60000 "cmd.exe" loaded module "%PROGRAMFILES%\INTERNET EXPLORER\IEPROXY.DLL" at base 6ff30000 "cmd.exe" loaded module "IERTUTIL.DLL" at base 765f0000 "cmd.exe" loaded module "%WINDIR%\SYSTEM32\SHELL32.DLL" at base 75610000 "cmd.exe" loaded module "USER32.DLL" at base 76260000 "cmd.exe" loaded module "API-MS-WIN-CORE-LOCALREGISTRY-L1-1-0.DLL" at base 772f0000 "cmd.exe" loaded module "SETUPAPI.DLL" at base 77000000 "cmd.exe" loaded module "RPCRT4.DLL" at base 768a0000 "cmd.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 7518000041:Tff3,"4c75a2e2511e44061424cc86123e1ea5dc4f7c8aadebc5c3bdebbe746175b2c6" was detected as "Microsoft Cabinet" and name: "sfx" "4c75a2e2511e44061424cc86123e1ea5dc4f7c8aadebc5c3bdebbe746175b2c6" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "4c75a2e2511e44061424cc86123e1ea5dc4f7c8aadebc5c3bdebbe746175b2c6" was detected as "Microsoft Visual C/C++" and name: "Compiler" "4c75a2e2511e44061424cc86123e1ea5dc4f7c8aadebc5c3bdebbe746175b2c6" was detected as "Microsoft Cabinet File" and name: "Archive" "4c75a2e2511e44061424cc86123e1ea5dc4f7c8aadebc5c3bdebbe746175b2c6" was detected as "Microsoft Linker" and name: "Linker" "ei4JY63.exe" was detected as "Microsoft Cabinet" and name: "sfx" "ei4JY63.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "ei4JY63.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "ei4JY63.exe" was detected as "Microsoft Cabinet File" and name: "Archive" "ei4JY63.exe" was detected as "Microsoft Linker" and name: "Linker" "BC6EJ61.exe" was detected as "Microsoft Cabinet" and name: "sfx" "BC6EJ61.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "BC6EJ61.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "BC6EJ61.exe" was detected as "Microsoft Cabinet File" and name: "Archive" "BC6EJ61.exe" was detected as "Microsoft Linker" and name: "Linker" "4hj421HX.exe" was detected as "Microsoft Cabinet" and name: "sfx" "4hj421HX.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "4hj421HX.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "4hj421HX.exe" was detected as "Microsoft Cabinet File" and name: "Archive" "4hj421HX.exe" was detected as "Microsoft Linker" and name: "Linker" "Bw1Vp89.exe" was detected as "Microsoft Cabinet" and name: "sfx" "Bw1Vp89.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "Bw1Vp89.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "Bw1Vp89.exe" was detected as "Microsoft Cabinet File" and name: "Archive" "Bw1Vp89.exe" was detected as "Microsoft Linker" and name: "Linker" "2Ix4962.exe" was detected as "Microsoft Cabinet" and name: "sfx" "2Ix4962.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "2Ix4962.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "2Ix4962.exe" was detected as "Microsoft Cabinet File" and name: "Archive" "2Ix4962.exe" was detected as "Microsoft Linker" and name: "Linker" "3TI36uw.exe" was detected as "Microsoft Cabinet" and name: "sfx" "3TI36uw.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "3TI36uw.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "3TI36uw.exe" was detected as "Microsoft Cabinet File" and name: "Archive" "3TI36uw.exe" was detected as "Microsoft Linker" and name: "Linker" "5jR9Wp3.exe" was detected as "Microsoft Cabinet" and name: "sfx" "5jR9Wp3.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "5jR9Wp3.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "5jR9Wp3.exe" was detected as "Microsoft Cabinet File" and name: "Archive" "5jR9Wp3.exe" was detected as "Microsoft Linker" and name: "Linker" "1Qj66VM8.exe" was detected as "Microsoft Cabinet" and name: "sfx" "1Qj66VM8.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "1Qj66VM8.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "1Qj66VM8.exe" was detected as "Microsoft Cabinet File" and name: "Archive" "1Qj66VM8.exe" was detected as "Microsoft Linker" and name: "Linker" "DISMHOST.EXE.6A8C05FD.bin" was detected as "Microsoft Cabinet" and name: "sfx" "DISMHOST.EXE.6A8C05FD.bin" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "DISMHOST.EXE.6A8C05FD.bin" was detected as "Microsoft Visual C/C++" and name: "Compiler" "DISMHOST.EXE.6A8C05FD.bin" was detected as "Microsoft Cabinet File" and name: "Archive" "DISMHOST.EXE.6A8C05FD.bin" was detected as "Microsoft Linker" and name: "Linker"42:T1920,"4c75a2e2511e44061424cc86123e1ea5dc4f7c8aadebc5c3bdebbe746175b2c6" file has an entrypoint instructions - "call 0x407155,jmp 0x406a6a,push 0x58,push 0x4072b8,call 0x407208,xor ebx, ebx,mov dword ptr [ebp - 0x20], ebx,lea eax, [ebp - 0x68],push eax,call dword ptr [0x40a184],mov dword ptr [ebp - 4], ebx,mov eax, dword ptr fs:[0x18],mov esi, dword ptr [eax + 4],mov edi, ebx,mov edx, 0x4088ac,mov ecx, esi,xor eax, eax,lock cmpxchg dword ptr [edx], ecx,test eax, eax,je 0x406abc,cmp eax, esi,jne 0x406aaf,xor esi, esi,inc esi,mov edi, esi,jmp 0x406abf,push 0x3e8,call dword ptr [0x40a188],jmp 0x406a93,xor esi, esi,inc esi," "ei4JY63.exe" file has an entrypoint instructions - "call 0x407155,jmp 0x406a6a,push 0x58,push 0x4072b8,call 0x407208,xor ebx, ebx,mov dword ptr [ebp - 0x20], ebx,lea eax, [ebp - 0x68],push eax,call dword ptr [0x40a184],mov dword ptr [ebp - 4], ebx,mov eax, dword ptr fs:[0x18],mov esi, dword ptr [eax + 4],mov edi, ebx,mov edx, 0x4088ac,mov ecx, esi,xor eax, eax,lock cmpxchg dword ptr [edx], ecx,test eax, eax,je 0x406abc,cmp eax, esi,jne 0x406aaf,xor esi, esi,inc esi,mov edi, esi,jmp 0x406abf,push 0x3e8,call dword ptr [0x40a188],jmp 0x406a93,xor esi, esi,inc esi," "BC6EJ61.exe" file has an entrypoint instructions - "call 0x407155,jmp 0x406a6a,push 0x58,push 0x4072b8,call 0x407208,xor ebx, ebx,mov dword ptr [ebp - 0x20], ebx,lea eax, [ebp - 0x68],push eax,call dword ptr [0x40a184],mov dword ptr [ebp - 4], ebx,mov eax, dword ptr fs:[0x18],mov esi, dword ptr [eax + 4],mov edi, ebx,mov edx, 0x4088ac,mov ecx, esi,xor eax, eax,lock cmpxchg dword ptr [edx], ecx,test eax, eax,je 0x406abc,cmp eax, esi,jne 0x406aaf,xor esi, esi,inc esi,mov edi, esi,jmp 0x406abf,push 0x3e8,call dword ptr [0x40a188],jmp 0x406a93,xor esi, esi,inc esi," "4hj421HX.exe" file has an entrypoint instructions - "call 0x406944,jmp 0x406106,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,push ecx,lea ecx, [esp + 8],sub ecx, eax,and ecx, 0xf,add eax, ecx,sbb ecx, ecx,or eax, ecx,pop ecx,jmp 0x406a60,push ecx,lea ecx, [esp + 8],sub ecx, eax,and ecx, 7,add eax, ecx,sbb ecx, ecx,or eax, ecx,pop ecx,jmp 0x406a60,int3 ,int3 ,int3 ,int3 ,push ebx,push esi,mov eax, dword ptr [esp + 0x18],or eax, eax,jne 0x4062f2,mov ecx, dword ptr [esp + 0x14],mov eax, dword ptr [esp + 0x10],xor edx, edx,div ecx,mov ebx, eax,mov eax, dword ptr [esp + 0xc]," "Bw1Vp89.exe" file has an entrypoint instructions - "call 0x407155,jmp 0x406a6a,push 0x58,push 0x4072b8,call 0x407208,xor ebx, ebx,mov dword ptr [ebp - 0x20], ebx,lea eax, [ebp - 0x68],push eax,call dword ptr [0x40a184],mov dword ptr [ebp - 4], ebx,mov eax, dword ptr fs:[0x18],mov esi, dword ptr [eax + 4],mov edi, ebx,mov edx, 0x4088ac,mov ecx, esi,xor eax, eax,lock cmpxchg dword ptr [edx], ecx,test eax, eax,je 0x406abc,cmp eax, esi,jne 0x406aaf,xor esi, esi,inc esi,mov edi, esi,jmp 0x406abf,push 0x3e8,call dword ptr [0x40a188],jmp 0x406a93,xor esi, esi,inc esi," "2Ix4962.exe" file has an entrypoint instructions - "call 0x406944,jmp 0x406106,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,push ecx,lea ecx, [esp + 8],sub ecx, eax,and ecx, 0xf,add eax, ecx,sbb ecx, ecx,or eax, ecx,pop ecx,jmp 0x406a60,push ecx,lea ecx, [esp + 8],sub ecx, eax,and ecx, 7,add eax, ecx,sbb ecx, ecx,or eax, ecx,pop ecx,jmp 0x406a60,int3 ,int3 ,int3 ,int3 ,push ebx,push esi,mov eax, dword ptr [esp + 0x18],or eax, eax,jne 0x4062f2,mov ecx, dword ptr [esp + 0x14],mov eax, dword ptr [esp + 0x10],xor edx, edx,div ecx,mov ebx, eax,mov eax, dword ptr [esp + 0xc]," "3TI36uw.exe" file has an entrypoint instructions - "call 0x406944,jmp 0x406106,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,push ecx,lea ecx, [esp + 8],sub ecx, eax,and ecx, 0xf,add eax, ecx,sbb ecx, ecx,or eax, ecx,pop ecx,jmp 0x406a60,push ecx,lea ecx, [esp + 8],sub ecx, eax,and ecx, 7,add eax, ecx,sbb ecx, ecx,or eax, ecx,pop ecx,jmp 0x406a60,int3 ,int3 ,int3 ,int3 ,push ebx,push esi,mov eax, dword ptr [esp + 0x18],or eax, eax,jne 0x4062f2,mov ecx, dword ptr [esp + 0x14],mov eax, dword ptr [esp + 0x10],xor edx, edx,div ecx,mov ebx, eax,mov eax, dword ptr [esp + 0xc]," "5jR9Wp3.exe" file has an entrypoint instructions - "push 0xac,push 0,push 0x418068,call 0x405070,add esp, 0xc,push 0,call 0x405076,mov dword ptr [0x41806c], eax,push 0,push 0x1000,push 0,call 0x40507c,mov dword ptr [0x418068], eax,call 0x405000,mov eax, 0x41707c,mov dword ptr [0x41808c], eax,call 0x40e4d0,call 0x40e23d,call 0x40b120,call 0x40a9a9," "1Qj66VM8.exe" file has an entrypoint instructions - "jmp dword ptr [0x402000],add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al," "DISMHOST.EXE.6A8C05FD.bin" file has an entrypoint instructions - "call 0x100a7e6,jmp 0x10097f4,int3 ,int3 ,int3 ,int3 ,int3 ,push 0x14,push 0x1010878,call 0x1009d10,and dword ptr [ebp - 4], 0,dec dword ptr [ebp + 0x10],js 0x1009afc,mov ecx, dword ptr [ebp + 8],sub ecx, dword ptr [ebp + 0xc],mov dword ptr [ebp + 8], ecx,call dword ptr [ebp + 0x14],jmp 0x1009abc,mov eax, dword ptr [ebp - 0x14],mov dword ptr [ebp - 0x1c], eax,mov eax, dword ptr [ebp - 0x1c],mov eax, dword ptr [eax],mov dword ptr [ebp - 0x20], eax,mov eax, dword ptr [ebp - 0x20],cmp dword ptr [eax], 0xe06d7363,je 0x1009af3,mov dword ptr [ebp - 0x24], 0,mov eax, dword ptr [ebp - 0x24],ret ,call dword ptr [0x1001210],mov esp, dword ptr [ebp - 0x18],"43:T881,"4c75a2e2511e44061424cc86123e1ea5dc4f7c8aadebc5c3bdebbe746175b2c6.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "4c75a2e2511e44061424cc86123e1ea5dc4f7c8aadebc5c3bdebbe746175b2c6.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "ei4JY63.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "ei4JY63.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "BC6EJ61.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "BC6EJ61.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "Bw1Vp89.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "Bw1Vp89.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "1Qj66VM8.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "1Qj66VM8.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "1Qj66VM8.exe" (Path: "HKCU\CONTROL PANEL\INTERNATIONAL"; Key: "LOCALENAME") "1Qj66VM8.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LOCALE"; Key: "00000409") "2Ix4962.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "2Ix4962.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "3TI36uw.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "3TI36uw.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "4hj421HX.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "4hj421HX.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "5jR9Wp3.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "5jR9Wp3.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "cmd.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "cmd.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "cmd.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LOCALE"; Key: "00000409")44:T1062,Observed system executable string:"C:\Windows\system32\apphelp.dll" [Source: 00005348.000014E4.1034851.00050000.wprm] Observed system executable string:"%WINDIR%\system32\advpack.dll" [Source: 00000000-00005732-00000C2B-222205137] Observed system executable string:"rundll32.exe %WINDIR%\system32\advpack.dll,DelNodeRunDLL32 "%TEMP%\IXP000.TMP\"" [Source: 00000000-00005732-00000BC1-222361965] Observed system executable string:"rundll32.exe %WINDIR%\system32\advpack.dll,DelNodeRunDLL32 "%TEMP%\IXP001.TMP\"" [Source: 00000000-00005348-00000BC1-223071632] Observed system executable string:"rundll32.exe %WINDIR%\system32\advpack.dll,DelNodeRunDLL32 "%TEMP%\IXP002.TMP\"" [Source: 00000000-00005720-00000BC1-223748707] Observed system executable string:"rundll32.exe %WINDIR%\system32\advpack.dll,DelNodeRunDLL32 "%TEMP%\IXP003.TMP\"" [Source: 00000000-00005724-00000BC1-224312026] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoree.dll" [Source: 00000000-00005740-00000C2B-225548269] Observed system executable string:"%WINDIR%\system32\combase.dll" [Source: 00000000-00005740-00000C2B-225866324] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\mscorlib\36eaccfde177c2e7b93b8dbdde4e012a\mscorlib.ni.dll" [Source: 00000000-00005740-00000C2B-226295101] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\ole32.dll" [Source: 00000000-00005740-00000C2B-226458645] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\clrjit.dll" [Source: 00000000-00005740-00000C2B-227014101] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System\2c3c912ea8f058f9d04c4650128feb3f\System.ni.dll" [Source: 00000000-00005740-00000C2B-227205550] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll" [Source: 00000000-00005740-00000C2B-228231327] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\nlssorting.dll" [Source: 00000000-00005740-00000C2B-228917603] Observed system executable string:"%WINDIR%\system32\uxtheme.dll" [Source: 00000000-00004136-00000C2B-241734347] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Drawing\f7568d7f1b9d356f64779b4c0927cfb3\System.Drawing.ni.dll" [Source: 00000000-00004136-00000C2B-241926993] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Windows.Forms\c9a4cbc00f690a9e3cddfc400f6e85bb\System.Windows.Forms.ni.dll" [Source: 00000000-00004136-00000C2B-241971193] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\uxtheme.dll" [Source: 00000000-00004136-00000C2B-242053088] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Core\31fae3290fad30c31c98651462d22724\System.Core.ni.dll" [Source: 00000000-00004136-00000C2B-242127557] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Configuration\96f7edb07b12303f0ec2595c7f3778c7\System.Configuration.ni.dll" [Source: 00000000-00004136-00000C2B-242147806] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Xml\15af16d373cf0528cb74fc73d365fdbf\System.Xml.ni.dll" [Source: 00000000-00004136-00000C2B-242178961] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll" [Source: 00000000-00004136-00000C2B-242302445] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\WindowsBase\1a4cc316fb6d09525321fc0be44692d8\WindowsBase.ni.dll" [Source: 00000000-00004136-00000C2B-242525547] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\PresentationCore\468f4e17be144ca12a73a4297eacc9cc\PresentationCore.ni.dll" [Source: 00000000-00004136-00000C2B-242578963] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\Presentatio5ae0f00f#\252cc7b0fae8cfe083bdc149957c0c54\PresentationFramework.ni.dll" [Source: 00000000-00004136-00000C2B-242638771]45:T4b2,Spawned process "ei4JY63.exe" (UID: 00000000-00005348) Spawned process "BC6EJ61.exe" (UID: 00000000-00005720) Spawned process "Bw1Vp89.exe" (UID: 00000000-00005724) Spawned process "1Qj66VM8.exe" (UID: 00000000-00005740) Spawned process "2Ix4962.exe" (UID: 00000000-00006044) Spawned process "AppLaunch.exe" (UID: 00000000-00005776) Spawned process "3TI36uw.exe" (UID: 00000000-00004188) Spawned process "AppLaunch.exe" (UID: 00000000-00002296) Spawned process "4hj421HX.exe" (UID: 00000000-00004180) Spawned process "AppLaunch.exe" (UID: 00000000-00004136) Spawned process "5jR9Wp3.exe" (UID: 00000000-00002464) Spawned process "cmd.exe" with commandline ""%WINDIR%\\system32\\cmd" /c "%TEMP%\\E6B6.tmp\\E7D0.tmp\\E7D1.b ..." (UID: 00000000-00004048), Spawned process "iexplore.exe" with commandline "https://www.facebook.com/login" (UID: 00000000-00003844), Spawned process "iexplore.exe" with commandline "https://accounts.google.com/" (UID: 00000000-00001960), Spawned process "iexplore.exe" with commandline "SCODEF:3844 CREDAT:275457 /prefetch:2" (UID: 00000000-00002372), Spawned process "iexplore.exe" with commandline "SCODEF:3844 CREDAT:209929 /prefetch:2" (UID: 00000000-00003444)46:T4b2,Spawned process "ei4JY63.exe" (UID: 00000000-00005348) Spawned process "BC6EJ61.exe" (UID: 00000000-00005720) Spawned process "Bw1Vp89.exe" (UID: 00000000-00005724) Spawned process "1Qj66VM8.exe" (UID: 00000000-00005740) Spawned process "2Ix4962.exe" (UID: 00000000-00006044) Spawned process "AppLaunch.exe" (UID: 00000000-00005776) Spawned process "3TI36uw.exe" (UID: 00000000-00004188) Spawned process "AppLaunch.exe" (UID: 00000000-00002296) Spawned process "4hj421HX.exe" (UID: 00000000-00004180) Spawned process "AppLaunch.exe" (UID: 00000000-00004136) Spawned process "5jR9Wp3.exe" (UID: 00000000-00002464) Spawned process "cmd.exe" with commandline ""%WINDIR%\\system32\\cmd" /c "%TEMP%\\E6B6.tmp\\E7D0.tmp\\E7D1.b ..." (UID: 00000000-00004048), Spawned process "iexplore.exe" with commandline "https://www.facebook.com/login" (UID: 00000000-00003844), Spawned process "iexplore.exe" with commandline "https://accounts.google.com/" (UID: 00000000-00001960), Spawned process "iexplore.exe" with commandline "SCODEF:3844 CREDAT:275457 /prefetch:2" (UID: 00000000-00002372), Spawned process "iexplore.exe" with commandline "SCODEF:3844 CREDAT:209929 /prefetch:2" (UID: 00000000-00003444)47:T92d,The input sample is signed with a certificate issued by "CN=WE2, O=Google Trust Services, C=US" (SHA1: 8B:39:F9:BF:C3:2C:0B:D5:AA:85:E8:2A:3F:53:83:79:4B:6A:45:A4; see report for more information) The input sample is signed with a certificate issued by "CN=GTS Root R4, O=Google Trust Services LLC, C=US" (SHA1: 4D:9A:CB:31:3D:73:DA:2E:9E:B4:51:A7:CF:63:09:AF:45:C9:93:C1; see report for more information) The input sample is signed with a certificate issued by "CN=GlobalSign Root CA, OU=Root CA, O=GlobalSign nv-sa, C=BE" (SHA1: 93:2B:ED:33:9A:A6:92:12:C8:93:75:B7:93:04:B4:75:49:0B:89:A0; see report for more information) The input sample is signed with a certificate issued by "CN=WE2, O=Google Trust Services, C=US" (SHA1: 23:74:91:83:30:33:0F:CE:BE:EB:94:FB:C9:D9:4E:31:00:D5:B5:33; see report for more information) The input sample is signed with a certificate issued by "CN=WE2, O=Google Trust Services, C=US" (SHA1: B9:F7:74:85:7B:1C:5F:E9:C2:86:5A:AA:63:0F:34:84:5F:79:D6:96; see report for more information) The input sample is signed with a certificate issued by "CN=DigiCert Global G2 TLS RSA SHA256 2020 CA1, O=DigiCert Inc, C=US" (SHA1: 0C:42:7B:F1:BC:44:D9:A7:A9:9C:D6:87:86:D1:8D:F1:C2:B7:33:96; see report for more information) The input sample is signed with a certificate issued by "CN=DigiCert Global Root G2, OU=www.digicert.com, O=DigiCert Inc, C=US" (SHA1: 1B:51:1A:BE:AD:59:C6:CE:20:70:77:C0:BF:0E:00:43:B1:38:26:12; see report for more information) The input sample is signed with a certificate issued by "CN=DigiCert High Assurance EV Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US" (SHA1: B7:40:25:17:EE:AA:C8:0A:B0:46:81:18:6E:82:47:BD:78:51:CD:0A; see report for more information) The input sample is signed with a certificate issued by "CN=WR2, O=Google Trust Services, C=US" (SHA1: 73:9A:62:97:AA:CA:61:63:4E:22:B5:79:1C:E8:65:F7:38:6D:44:25; see report for more information) The input sample is signed with a certificate issued by "CN=GTS Root R1, O=Google Trust Services LLC, C=US" (SHA1: 66:E4:16:12:60:B1:00:FE:E0:DE:28:7A:9A:52:93:B4:C2:22:4A:E6; see report for more information) The input sample is signed with a certificate issued by "CN=GlobalSign Root CA, OU=Root CA, O=GlobalSign nv-sa, C=BE" (SHA1: 08:74:54:87:E8:91:C1:9E:30:78:C1:F2:A0:7E:45:29:50:EF:36:F6; see report for more information)48:T1983,"ei4JY63.exe" has type "PE32 executable for MS Windows 6.00 (GUI) Intel i386 5 sections"- Location: [%TEMP%\IXP000.TMP\ei4JY63.exe]- [targetUID: 00000000-00005732] "BC6EJ61.exe" has type "PE32 executable for MS Windows 6.00 (GUI) Intel i386 5 sections"- Location: [%TEMP%\IXP001.TMP\BC6EJ61.exe]- [targetUID: 00000000-00005720] "4hj421HX.exe" has type "PE32 executable for MS Windows 6.00 (console) Intel i386 5 sections"- Location: [%TEMP%\IXP001.TMP\4hj421HX.exe]- [targetUID: 00000000-00004180] "Bw1Vp89.exe" has type "PE32 executable for MS Windows 6.00 (GUI) Intel i386 5 sections"- Location: [%TEMP%\IXP002.TMP\Bw1Vp89.exe]- [targetUID: 00000000-00005724] "2Ix4962.exe" has type "PE32 executable for MS Windows 6.00 (console) Intel i386 5 sections"- Location: [%TEMP%\IXP003.TMP\2Ix4962.exe]- [targetUID: 00000000-00006044] "3TI36uw.exe" has type "PE32 executable for MS Windows 6.00 (console) Intel i386 5 sections"- Location: [%TEMP%\IXP002.TMP\3TI36uw.exe]- [targetUID: 00000000-00005720] "5jR9Wp3.exe" has type "PE32 executable for MS Windows 4.00 (console) Intel i386 5 sections"- Location: [%TEMP%\IXP000.TMP\5jR9Wp3.exe]- [targetUID: 00000000-00005732] "1Qj66VM8.exe" has type "PE32 executable for MS Windows 4.00 (GUI) Intel i386 Mono/.Net assembly 3 sections"- Location: [%TEMP%\IXP003.TMP\1Qj66VM8.exe]- [targetUID: 00000000-00005724] "E7D1.bat" has type "ASCII text with CRLF line terminators"- Location: [%TEMP%\E6B6.tmp\E7D0.tmp\E7D1.bat]- [targetUID: 00000000-00004048] "aBIDyB4xhJy8wmKvUcQXclxgo-3469oiGT9DWDYPz6DhfgQe914iiBfD-GevAmvU9KONMKn3YhINqU49pVNahkCkeiF2w9Hlit1_1_.css" has type "Unknown"- [targetUID: N/A] "identifier_2_.htm" has type "Unknown"- [targetUID: N/A] "identifier_1_.htm" has type "Unknown"- [targetUID: N/A] "urlref_httpswww.facebook.comlogin" has type "HTML document ASCII text with very long lines (65536) with no line terminators"- [targetUID: N/A] "login_1_.htm" has type "Unknown"- [targetUID: N/A] "dism.log" has type "Unicode text UTF-8 (with BOM) text with very long lines (312) with CRLF line terminators"- [targetUID: N/A] "YG480PWX.htm" has type "HTML document ASCII text with very long lines (56721) with CRLF line terminators"- [targetUID: N/A] "DISMHOST.EXE.6A8C05FD.bin" has type "PE32 executable for MS Windows 5.01 (GUI) Intel i386 4 sections"- [targetUID: N/A] "75A092F4522006A97542D6AC4F4E69D2" has type "data"- [targetUID: N/A] "imagestore.dat" has type "data"- [targetUID: N/A] "_9E5B1B2F-9F82-11F1-8DC8-005056916C47_.dat" has type "Unknown"- [targetUID: N/A] "F93E23F30C5B44AE13F273C2767B494E" has type "data"- [targetUID: N/A] "FFA2A770194FEECF4A6E9B2A8579E9E9" has type "data"- [targetUID: N/A] "68317AD4F8681C59B8DA0296EF2FCDBA" has type "data"- [targetUID: N/A] "~DF0843FE2919FA6B77.TMP" has type "data"- [targetUID: N/A] "ay1hV6OlegS_1_.ico" has type "Unknown"- [targetUID: N/A] "en-US.4" has type "data"- [targetUID: N/A] "~DF7EB2E7ADA47AA155.TMP" has type "data"- [targetUID: N/A] "~DF860D7BB64A7DFA28.TMP" has type "data"- [targetUID: N/A] "~DF25358BE8BEB0247C.TMP" has type "data"- [targetUID: N/A] "dberr.txt" has type "ASCII text with CRLF line terminators"- [targetUID: N/A] "RecoveryStore._9E5B1B2B-9F82-11F1-8DC8-005056916C47_.dat" has type "Unknown"- [targetUID: N/A] "_9E5B1B2D-9F82-11F1-8DC8-005056916C47_.dat" has type "Unknown"- [targetUID: N/A] "favicon_2_.ico" has type "Unknown"- [targetUID: N/A] "57C8EDB95DF3F0AD4EE2DC2B8CFD4157" has type "Microsoft Cabinet archive data Windows 2000/XP setup 4987 bytes 1 file at 0x2c last modified Sep 04 2025 20:23:24 +A "disallowedcert.stl" number 1 1 datablock 0x1 compression"- [targetUID: N/A] "_3D308C66-9F87-11F1-8DC8-005056916C47_.dat" has type "Unknown"- [targetUID: N/A] "googlelogo_color_74x24dp_1_.png" has type "Unknown"- [targetUID: N/A] "8A7891822FCFF127E4EADADE9757112B" has type "data"- [targetUID: N/A] "B76BE66D46C355931939D8CF818D03FD_879AFEB08DCB012707582D902977FF92" has type "data"- [targetUID: N/A] "8B2B9A00839EED1DFDCCC3BFC2F5DF12" has type "data"- [targetUID: N/A] "CheckConnection_1_.htm" has type "Unknown"- [targetUID: N/A] "05DDC6AA91765AACACDB0A5F96DF8199" has type "data"- [targetUID: N/A] "892580777767344DCAEF580FFA143EA6_EF1B61DD3F93C58DBD0734F13C15C0F6" has type "data"- [targetUID: N/A] "61QF4LIB.txt" has type "ASCII text with very long lines (480)"- [targetUID: N/A] "I4PM4DK7.txt" has type "ASCII text with very long lines (480)"- [targetUID: N/A] "9MN1YJ3P.txt" has type "ASCII text with very long lines (480)"- [targetUID: N/A] "Q3O6JFWE.txt" has type "ASCII text with very long lines (480)"- [targetUID: N/A] "3B45RTR8.txt" has type "ASCII text"- [targetUID: N/A] "B46811C17859FFB409CF0E904A4AA8F8" has type "data"- [targetUID: N/A] "59D76868C250B3240414CE3EFBB12518_EB402F7745C659FC1A9D942768BC262C" has type "data"- [targetUID: N/A] "E2C6CBAF0AF08CF203BA74BF0D0AB6D5_49536AB5156BDD74EFF881D01C36A419" has type "data"- [targetUID: N/A] "6CAFE3B721B7CE350C58A8F3EB28AA44_C4935EE08CAA8E5372EBE50CFA866626" has type "data"- [targetUID: N/A] "8MHCBLHX.txt" has type "ASCII text"- [targetUID: N/A] "26C212D9399727259664BDFCA073966E_912C3CA51DE6018A7BE4CA7BC64AAFCD" has type "data"- [targetUID: N/A] "FARB3E5H.txt" has type "ASCII text"- [targetUID: N/A] "57C8EDB95DF3F0AD4EE2DC2B8CFD4157" has type "data"- [targetUID: N/A] "3WAG7E7T.txt" has type "ASCII text"- [targetUID: N/A] "1E2DBD58769A756A24A9D033F9B07F3D" has type "data"- [targetUID: N/A] "9DFE38F0CF4E54F251E86E53D05E8885" has type "data"- [targetUID: N/A] "NLQFCLA1.htm" has type "gzip compressed data original size modulo 2^32 365"- [targetUID: N/A] "J4LBTHE4.txt" has type "ASCII text"- [targetUID: N/A] "favicon_1_.htm" has type "Unknown"- [targetUID: N/A] "S0WUENBR.txt" has type "ASCII text"- [targetUID: N/A] "J14GCAZI.txt" has type "ASCII text"- [targetUID: N/A] "BAREB4XI.txt" has type "ASCII text"- [targetUID: N/A] "8RPM4Z50.txt" has type "ASCII text"- [targetUID: N/A] "0MQSOFXO.txt" has type "ASCII text"- [targetUID: N/A] "C35GOXQP.txt" has type "ASCII text"- [targetUID: N/A] "8W4Z332A.txt" has type "ASCII text"- [targetUID: N/A] "36HNBSN2.txt" has type "ASCII text"- [targetUID: N/A] "YVI3OU3W.txt" has type "ASCII text"- [targetUID: N/A] "bscframe_1_.htm" has type "Unknown"- [targetUID: N/A] "b_lEtPAUPMI_1_.webp" has type "Unknown"- [targetUID: N/A] "RGHAM2A2.txt" has type "ASCII text"- [targetUID: N/A] "NJX4RZLL.txt" has type "ASCII text"- [targetUID: N/A] "95T7G3A1.txt" has type "ASCII text"- [targetUID: N/A]49:Tb94,"4c75a2e2511e44061424cc86123e1ea5dc4f7c8aadebc5c3bdebbe746175b2c6.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\SIDEBYSIDE"; Key: ""; Value: "") "4c75a2e2511e44061424cc86123e1ea5dc4f7c8aadebc5c3bdebbe746175b2c6.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: ""; Value: "") "4c75a2e2511e44061424cc86123e1ea5dc4f7c8aadebc5c3bdebbe746175b2c6.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SAFEBOOT\OPTION"; Key: ""; Value: "") "4c75a2e2511e44061424cc86123e1ea5dc4f7c8aadebc5c3bdebbe746175b2c6.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SRP\GP\DLL"; Key: ""; Value: "") "4c75a2e2511e44061424cc86123e1ea5dc4f7c8aadebc5c3bdebbe746175b2c6.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "4c75a2e2511e44061424cc86123e1ea5dc4f7c8aadebc5c3bdebbe746175b2c6.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "4c75a2e2511e44061424cc86123e1ea5dc4f7c8aadebc5c3bdebbe746175b2c6.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\SIDEBYSIDE\ASSEMBLYSTORAGEROOTS"; Key: ""; Value: "") "4c75a2e2511e44061424cc86123e1ea5dc4f7c8aadebc5c3bdebbe746175b2c6.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS"; Key: ""; Value: "") "4c75a2e2511e44061424cc86123e1ea5dc4f7c8aadebc5c3bdebbe746175b2c6.exe" (Access type: "OPEN"; Path: "HKCU\CONTROL PANEL\DESKTOP\MUICACHED\MACHINELANGUAGECONFIGURATION"; Key: ""; Value: "") "4c75a2e2511e44061424cc86123e1ea5dc4f7c8aadebc5c3bdebbe746175b2c6.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\MUI\SETTINGS"; Key: ""; Value: "") "4c75a2e2511e44061424cc86123e1ea5dc4f7c8aadebc5c3bdebbe746175b2c6.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\CONTROL PANEL\DESKTOP"; Key: ""; Value: "") "4c75a2e2511e44061424cc86123e1ea5dc4f7c8aadebc5c3bdebbe746175b2c6.exe" (Access type: "OPEN"; Path: "HKCU\CONTROL PANEL\DESKTOP\LANGUAGECONFIGURATION"; Key: ""; Value: "") "4c75a2e2511e44061424cc86123e1ea5dc4f7c8aadebc5c3bdebbe746175b2c6.exe" (Access type: "OPEN"; Path: "HKCU\CONTROL PANEL\DESKTOP"; Key: ""; Value: "") "4c75a2e2511e44061424cc86123e1ea5dc4f7c8aadebc5c3bdebbe746175b2c6.exe" (Access type: "OPEN"; Path: "HKCU\CONTROL PANEL\DESKTOP\MUICACHED"; Key: ""; Value: "") "4c75a2e2511e44061424cc86123e1ea5dc4f7c8aadebc5c3bdebbe746175b2c6.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: ""; Value: "") "4c75a2e2511e44061424cc86123e1ea5dc4f7c8aadebc5c3bdebbe746175b2c6.exe" (Access type: "OPEN"; Path: "HKLM"; Key: ""; Value: "") "4c75a2e2511e44061424cc86123e1ea5dc4f7c8aadebc5c3bdebbe746175b2c6.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\DIAGNOSTICS"; Key: ""; Value: "")4a:T43e,"4c75a2e2511e44061424cc86123e1ea5dc4f7c8aadebc5c3bdebbe746175b2c6.exe" queries basic process information of the "C:\Windows\System32\advpack.dll" (UID: 5732) "4c75a2e2511e44061424cc86123e1ea5dc4f7c8aadebc5c3bdebbe746175b2c6.exe" queries basic process information of the "C:\Users\HAPUBWS\AppData\Local\Temp" (UID: 5732) "ei4JY63.exe" queries basic process information of the "C:\Windows\System32\advpack.dll" (UID: 5348) "ei4JY63.exe" queries basic process information of the "C:\Users\HAPUBWS\AppData\Local\Temp" (UID: 5348) "BC6EJ61.exe" queries basic process information of the "C:\Windows\System32\advpack.dll" (UID: 5720) "BC6EJ61.exe" queries basic process information of the "C:\Users\HAPUBWS\AppData\Local\Temp" (UID: 5720) "Bw1Vp89.exe" queries basic process information of the "C:\Windows\System32\advpack.dll" (UID: 5724) "Bw1Vp89.exe" queries basic process information of the "C:\Users\HAPUBWS\AppData\Local\Temp" (UID: 5724) "5jR9Wp3.exe" queries basic process information of the "C:\Users\HAPUBWS\AppData\Local\Temp\E6B6.tmp\E7D0.tmp\E7D1.bat" (UID: 2464)4b:T10d8,"4c75a2e2511e44061424cc86123e1ea5dc4f7c8aadebc5c3bdebbe746175b2c6.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\SIDEBYSIDE"; Key: "PREFEREXTERNALMANIFEST"; Value: "") "4c75a2e2511e44061424cc86123e1ea5dc4f7c8aadebc5c3bdebbe746175b2c6.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "CWDILLEGALINDLLSEARCH"; Value: "") "4c75a2e2511e44061424cc86123e1ea5dc4f7c8aadebc5c3bdebbe746175b2c6.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED"; Value: "") "4c75a2e2511e44061424cc86123e1ea5dc4f7c8aadebc5c3bdebbe746175b2c6.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS"; Key: "SHOWDEBUGINFO"; Value: "") "4c75a2e2511e44061424cc86123e1ea5dc4f7c8aadebc5c3bdebbe746175b2c6.exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP"; Key: "PREFERREDUILANGUAGES"; Value: "") "4c75a2e2511e44061424cc86123e1ea5dc4f7c8aadebc5c3bdebbe746175b2c6.exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP\MUICACHED"; Key: "MACHINEPREFERREDUILANGUAGES"; Value: "") "4c75a2e2511e44061424cc86123e1ea5dc4f7c8aadebc5c3bdebbe746175b2c6.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: "COMPATDLL"; Value: "") "4c75a2e2511e44061424cc86123e1ea5dc4f7c8aadebc5c3bdebbe746175b2c6.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: "00060101.00060101"; Value: "") "4c75a2e2511e44061424cc86123e1ea5dc4f7c8aadebc5c3bdebbe746175b2c6.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: ""; Value: "") "4c75a2e2511e44061424cc86123e1ea5dc4f7c8aadebc5c3bdebbe746175b2c6.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "SAFEDLLSEARCHMODE"; Value: "") "4c75a2e2511e44061424cc86123e1ea5dc4f7c8aadebc5c3bdebbe746175b2c6.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\GRE_INITIALIZE"; Key: "DISABLEMETAFILES"; Value: "") "4c75a2e2511e44061424cc86123e1ea5dc4f7c8aadebc5c3bdebbe746175b2c6.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\COMPATIBILITY32"; Key: "4C75A2E2511E44061424CC86123E1EA5DC4F7C8AADEBC5C3BDEBBE746175B2C6"; Value: "") "4c75a2e2511e44061424cc86123e1ea5dc4f7c8aadebc5c3bdebbe746175b2c6.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINDOWS"; Key: "LOADAPPINIT_DLLS"; Value: "") "4c75a2e2511e44061424cc86123e1ea5dc4f7c8aadebc5c3bdebbe746175b2c6.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE"; Key: "PAGEALLOCATORUSESYSTEMHEAP"; Value: "") "4c75a2e2511e44061424cc86123e1ea5dc4f7c8aadebc5c3bdebbe746175b2c6.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE"; Key: "PAGEALLOCATORSYSTEMHEAPISPRIVATE"; Value: "") "4c75a2e2511e44061424cc86123e1ea5dc4f7c8aadebc5c3bdebbe746175b2c6.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\CMF\CONFIG"; Key: "SYSTEM"; Value: "") "4c75a2e2511e44061424cc86123e1ea5dc4f7c8aadebc5c3bdebbe746175b2c6.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\WINDOWS ERROR REPORTING\WMR"; Key: "DISABLE"; Value: "") "4c75a2e2511e44061424cc86123e1ea5dc4f7c8aadebc5c3bdebbe746175b2c6.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\SETUP"; Key: "SOURCEPATH"; Value: "") "4c75a2e2511e44061424cc86123e1ea5dc4f7c8aadebc5c3bdebbe746175b2c6.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION"; Key: "DEVICEPATH"; Value: "") "4c75a2e2511e44061424cc86123e1ea5dc4f7c8aadebc5c3bdebbe746175b2c6.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US"; Value: "") "4c75a2e2511e44061424cc86123e1ea5dc4f7c8aadebc5c3bdebbe746175b2c6.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US"; Value: "") "4c75a2e2511e44061424cc86123e1ea5dc4f7c8aadebc5c3bdebbe746175b2c6.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\DATACOLLECTION"; Key: "COMMERCIALDATAOPTIN"; Value: "")4c:T5d9,"4c75a2e2511e44061424cc86123e1ea5dc4f7c8aadebc5c3bdebbe746175b2c6.exe" reads file "c:\users\%osuser%\appdata\local\temp\ixp000.tmp\ei4jy63.exe" "4c75a2e2511e44061424cc86123e1ea5dc4f7c8aadebc5c3bdebbe746175b2c6.exe" reads file "c:\users\%osuser%\appdata\local\temp\ixp000.tmp\5jr9wp3.exe" "ei4JY63.exe" reads file "c:\users\%osuser%\appdata\local\temp\ixp001.tmp\bc6ej61.exe" "ei4JY63.exe" reads file "c:\users\%osuser%\appdata\local\temp\ixp001.tmp\4hj421hx.exe" "BC6EJ61.exe" reads file "c:\users\%osuser%\appdata\local\temp\ixp002.tmp\bw1vp89.exe" "BC6EJ61.exe" reads file "c:\users\%osuser%\appdata\local\temp\ixp002.tmp\3ti36uw.exe" "Bw1Vp89.exe" reads file "c:\users\%osuser%\appdata\local\temp\ixp003.tmp\1qj66vm8.exe" "Bw1Vp89.exe" reads file "c:\users\%osuser%\appdata\local\temp\ixp003.tmp\2ix4962.exe" "1Qj66VM8.exe" reads file "c:\windows\microsoft.net\framework\v4.0.30319\config\machine.config" "1Qj66VM8.exe" reads file "c:\windows\assembly\nativeimages_v4.0.30319_32\mscorlib\36eaccfde177c2e7b93b8dbdde4e012a\mscorlib.ni.dll.aux" "1Qj66VM8.exe" reads file "c:\windows\assembly\nativeimages_v4.0.30319_32\system\0b2f69b43a576b9edcc807a30872bd91\system.ni.dll.aux" "1Qj66VM8.exe" reads file "c:\windows\assembly\nativeimages_v4.0.30319_32\system\2c3c912ea8f058f9d04c4650128feb3f\system.ni.dll.aux" "2Ix4962.exe" reads file "c:\windows\microsoft.net\framework\v4.0.30319\applaunch.exe" "3TI36uw.exe" reads file "c:\windows\microsoft.net\framework\v4.0.30319\applaunch.exe"4d:Tc9a,"4c75a2e2511e44061424cc86123e1ea5dc4f7c8aadebc5c3bdebbe746175b2c6.exe" trying to touch file "C:\Windows\SYSTEM32\sechost.dll" "4c75a2e2511e44061424cc86123e1ea5dc4f7c8aadebc5c3bdebbe746175b2c6.exe" trying to touch file "C:\4c75a2e2511e44061424cc86123e1ea5dc4f7c8aadebc5c3bdebbe746175b2c6.exe.Local\" "4c75a2e2511e44061424cc86123e1ea5dc4f7c8aadebc5c3bdebbe746175b2c6.exe" trying to touch file "C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18837_none_41e855142bd5705d" "4c75a2e2511e44061424cc86123e1ea5dc4f7c8aadebc5c3bdebbe746175b2c6.exe" trying to touch file "C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18837_none_41e855142bd5705d\COMCTL32.dll" "4c75a2e2511e44061424cc86123e1ea5dc4f7c8aadebc5c3bdebbe746175b2c6.exe" trying to touch file "C:\Cabinet.dll" "4c75a2e2511e44061424cc86123e1ea5dc4f7c8aadebc5c3bdebbe746175b2c6.exe" trying to touch file "C:\Windows\system32\Cabinet.dll" "4c75a2e2511e44061424cc86123e1ea5dc4f7c8aadebc5c3bdebbe746175b2c6.exe" trying to touch file "C:\VERSION.dll" "4c75a2e2511e44061424cc86123e1ea5dc4f7c8aadebc5c3bdebbe746175b2c6.exe" trying to touch file "C:\Windows\system32\VERSION.dll" "4c75a2e2511e44061424cc86123e1ea5dc4f7c8aadebc5c3bdebbe746175b2c6.exe" trying to touch file "C:\Windows\system32\apphelp.dll" "4c75a2e2511e44061424cc86123e1ea5dc4f7c8aadebc5c3bdebbe746175b2c6.exe" trying to touch file "C:\Windows\AppPatch\AcLayers.DLL" "4c75a2e2511e44061424cc86123e1ea5dc4f7c8aadebc5c3bdebbe746175b2c6.exe" trying to touch file "C:\SspiCli.dll" "4c75a2e2511e44061424cc86123e1ea5dc4f7c8aadebc5c3bdebbe746175b2c6.exe" trying to touch file "C:\Windows\system32\SspiCli.dll" "4c75a2e2511e44061424cc86123e1ea5dc4f7c8aadebc5c3bdebbe746175b2c6.exe" trying to touch file "C:\WINSPOOL.DRV" "4c75a2e2511e44061424cc86123e1ea5dc4f7c8aadebc5c3bdebbe746175b2c6.exe" trying to touch file "C:\Windows\system32\WINSPOOL.DRV" "4c75a2e2511e44061424cc86123e1ea5dc4f7c8aadebc5c3bdebbe746175b2c6.exe" trying to touch file "C:\MPR.dll" "4c75a2e2511e44061424cc86123e1ea5dc4f7c8aadebc5c3bdebbe746175b2c6.exe" trying to touch file "C:\Windows\system32\MPR.dll" "4c75a2e2511e44061424cc86123e1ea5dc4f7c8aadebc5c3bdebbe746175b2c6.exe" trying to touch file "C:\Windows\AppPatch\AcGenral.DLL" "4c75a2e2511e44061424cc86123e1ea5dc4f7c8aadebc5c3bdebbe746175b2c6.exe" trying to touch file "C:\UxTheme.dll" "4c75a2e2511e44061424cc86123e1ea5dc4f7c8aadebc5c3bdebbe746175b2c6.exe" trying to touch file "C:\Windows\system32\UxTheme.dll" "4c75a2e2511e44061424cc86123e1ea5dc4f7c8aadebc5c3bdebbe746175b2c6.exe" trying to touch file "C:\WINMM.dll" "4c75a2e2511e44061424cc86123e1ea5dc4f7c8aadebc5c3bdebbe746175b2c6.exe" trying to touch file "C:\Windows\system32\WINMM.dll" "4c75a2e2511e44061424cc86123e1ea5dc4f7c8aadebc5c3bdebbe746175b2c6.exe" trying to touch file "C:\samcli.dll" "4c75a2e2511e44061424cc86123e1ea5dc4f7c8aadebc5c3bdebbe746175b2c6.exe" trying to touch file "C:\Windows\system32\samcli.dll" "4c75a2e2511e44061424cc86123e1ea5dc4f7c8aadebc5c3bdebbe746175b2c6.exe" trying to touch file "C:\MSACM32.dll" "4c75a2e2511e44061424cc86123e1ea5dc4f7c8aadebc5c3bdebbe746175b2c6.exe" trying to touch file "C:\Windows\system32\MSACM32.dll"4e:Td0d,"4c75a2e2511e44061424cc86123e1ea5dc4f7c8aadebc5c3bdebbe746175b2c6.exe" trying to access non-existent file "C:\Cabinet.dll" "4c75a2e2511e44061424cc86123e1ea5dc4f7c8aadebc5c3bdebbe746175b2c6.exe" trying to access non-existent file "C:\VERSION.dll" "4c75a2e2511e44061424cc86123e1ea5dc4f7c8aadebc5c3bdebbe746175b2c6.exe" trying to access non-existent file "C:\SspiCli.dll" "4c75a2e2511e44061424cc86123e1ea5dc4f7c8aadebc5c3bdebbe746175b2c6.exe" trying to access non-existent file "C:\MPR.dll" "4c75a2e2511e44061424cc86123e1ea5dc4f7c8aadebc5c3bdebbe746175b2c6.exe" trying to access non-existent file "C:\UxTheme.dll" "4c75a2e2511e44061424cc86123e1ea5dc4f7c8aadebc5c3bdebbe746175b2c6.exe" trying to access non-existent file "C:\WINMM.dll" "4c75a2e2511e44061424cc86123e1ea5dc4f7c8aadebc5c3bdebbe746175b2c6.exe" trying to access non-existent file "C:\samcli.dll" "4c75a2e2511e44061424cc86123e1ea5dc4f7c8aadebc5c3bdebbe746175b2c6.exe" trying to access non-existent file "C:\MSACM32.dll" "4c75a2e2511e44061424cc86123e1ea5dc4f7c8aadebc5c3bdebbe746175b2c6.exe" trying to access non-existent file "C:\sfc.dll" "4c75a2e2511e44061424cc86123e1ea5dc4f7c8aadebc5c3bdebbe746175b2c6.exe" trying to access non-existent file "C:\sfc_os.DLL" "4c75a2e2511e44061424cc86123e1ea5dc4f7c8aadebc5c3bdebbe746175b2c6.exe" trying to access non-existent file "C:\dwmapi.dll" "4c75a2e2511e44061424cc86123e1ea5dc4f7c8aadebc5c3bdebbe746175b2c6.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP\ei4JY63.exe" "4c75a2e2511e44061424cc86123e1ea5dc4f7c8aadebc5c3bdebbe746175b2c6.exe" trying to access non-existent file "C:\FLTLIB.DLL" "4c75a2e2511e44061424cc86123e1ea5dc4f7c8aadebc5c3bdebbe746175b2c6.exe" trying to access non-existent file "C:\MSVCP140.dll" "4c75a2e2511e44061424cc86123e1ea5dc4f7c8aadebc5c3bdebbe746175b2c6.exe" trying to access non-existent file "C:\VCRUNTIME140.dll" "4c75a2e2511e44061424cc86123e1ea5dc4f7c8aadebc5c3bdebbe746175b2c6.exe" trying to access non-existent file "C:\api-ms-win-crt-runtime-l1-1-0.dll" "4c75a2e2511e44061424cc86123e1ea5dc4f7c8aadebc5c3bdebbe746175b2c6.exe" trying to access non-existent file "C:\ucrtbase.DLL" "4c75a2e2511e44061424cc86123e1ea5dc4f7c8aadebc5c3bdebbe746175b2c6.exe" trying to access non-existent file "C:\api-ms-win-core-timezone-l1-1-0.dll" "4c75a2e2511e44061424cc86123e1ea5dc4f7c8aadebc5c3bdebbe746175b2c6.exe" trying to access non-existent file "C:\api-ms-win-core-file-l2-1-0.dll" "4c75a2e2511e44061424cc86123e1ea5dc4f7c8aadebc5c3bdebbe746175b2c6.exe" trying to access non-existent file "C:\api-ms-win-core-localization-l1-2-0.dll" "4c75a2e2511e44061424cc86123e1ea5dc4f7c8aadebc5c3bdebbe746175b2c6.exe" trying to access non-existent file "C:\api-ms-win-core-synch-l1-2-0.dll" "4c75a2e2511e44061424cc86123e1ea5dc4f7c8aadebc5c3bdebbe746175b2c6.exe" trying to access non-existent file "C:\api-ms-win-core-processthreads-l1-1-1.dll" "4c75a2e2511e44061424cc86123e1ea5dc4f7c8aadebc5c3bdebbe746175b2c6.exe" trying to access non-existent file "C:\api-ms-win-core-file-l1-2-0.dll" "4c75a2e2511e44061424cc86123e1ea5dc4f7c8aadebc5c3bdebbe746175b2c6.exe" trying to access non-existent file "C:\api-ms-win-crt-heap-l1-1-0.dll" "4c75a2e2511e44061424cc86123e1ea5dc4f7c8aadebc5c3bdebbe746175b2c6.exe" trying to access non-existent file "C:\api-ms-win-crt-string-l1-1-0.dll"4f:T87a,"4c75a2e2511e44061424cc86123e1ea5dc4f7c8aadebc5c3bdebbe746175b2c6.exe" trying to access non-existent file "C:\4c75a2e2511e44061424cc86123e1ea5dc4f7c8aadebc5c3bdebbe746175b2c6.exe.Local\" "4c75a2e2511e44061424cc86123e1ea5dc4f7c8aadebc5c3bdebbe746175b2c6.exe" trying to access non-existent file "C:\WINSPOOL.DRV" "4c75a2e2511e44061424cc86123e1ea5dc4f7c8aadebc5c3bdebbe746175b2c6.exe" trying to access non-existent file "C:\4c75a2e2511e44061424cc86123e1ea5dc4f7c8aadebc5c3bdebbe746175b2c6.exe.Config" "4c75a2e2511e44061424cc86123e1ea5dc4f7c8aadebc5c3bdebbe746175b2c6.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP" "4c75a2e2511e44061424cc86123e1ea5dc4f7c8aadebc5c3bdebbe746175b2c6.exe" trying to access non-existent file "C:\4C75A2E2511E44061424CC86123E1EA5DC4F7C8AADEBC5C3BDEBBE746175B2C6.EXE.LOCAL" "4c75a2e2511e44061424cc86123e1ea5dc4f7c8aadebc5c3bdebbe746175b2c6.exe" trying to access non-existent file "C:\4C75A2E2511E44061424CC86123E1EA5DC4F7C8AADEBC5C3BDEBBE746175B2C6.EXE.CONFIG" "ei4JY63.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP\ei4JY63.exe.Local\" "ei4JY63.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP\WINSPOOL.DRV" "ei4JY63.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP\ei4JY63.exe.Config" "ei4JY63.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP001.TMP" "ei4JY63.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP\EI4JY63.EXE.LOCAL" "ei4JY63.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP\EI4JY63.EXE.CONFIG" "BC6EJ61.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP001.TMP\BC6EJ61.exe.Local\" "BC6EJ61.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP001.TMP\WINSPOOL.DRV" "BC6EJ61.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP001.TMP\BC6EJ61.exe.Config" "BC6EJ61.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP002.TMP"50:T2b1f,Found requests in header "GET /login HTTP/1.1Accept: text/html, application/xhtml+xml, */*Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: www.facebook.comDNT: 1Connection: Keep-Alive"; in File: "SSL") Found requests in header "GET / HTTP/1.1Accept: text/html, application/xhtml+xml, */*User-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateDNT: 1Host: accounts.google.comConnection: Keep-AliveAccept-Language: en-US"; in File: "SSL") Found requests in header "GET /ServiceLogin?passive=1209600&continue=https%3A%2F%2Faccounts.google.com%2F&followup=https%3A%2F%2Faccounts.google.com%2F HTTP/1.1Accept: text/html, application/xhtml+xml, */*User-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateDNT: 1Host: accounts.google.comCookie: __Host-GAPS=1:eDDK4ZSaCWBLEFGLyE394wB-rxFzsw:7_ZJirGneP_pE7QZConnection: Keep-AliveAccept-Language: en-US"; in File: "SSL") Found requests in header "GET /v3/signin/identifier?continue=https://accounts.google.com/&followup=https://accounts.google.com/&passive=1209600&flowName=WebLiteSignIn&flowEntry=ServiceLogin&dsh=S-803796963:1787545417511166 HTTP/1.1Accept: text/html, application/xhtml+xml, */*User-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateDNT: 1Host: accounts.google.comCookie: __Host-GAPS=1:eDDK4ZSaCWBLEFGLyE394wB-rxFzsw:7_ZJirGneP_pE7QZConnection: Keep-AliveAccept-Language: en-US"; in File: "SSL") Found requests in header "GET /_/bscframe HTTP/1.1Accept: text/html, application/xhtml+xml, */*Referer: https://accounts.google.com/Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: accounts.google.comDNT: 1Connection: Keep-AliveCookie: __Host-GAPS=1:eDDK4ZSaCWBLEFGLyE394wB-rxFzsw:7_ZJirGneP_pE7QZ"; in File: "SSL") Found requests in header "GET /favicon.ico HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoHost: accounts.google.comDNT: 1Connection: Keep-AliveCookie: __Host-GAPS=1:eDDK4ZSaCWBLEFGLyE394wB-rxFzsw:7_ZJirGneP_pE7QZ"; in File: "SSL") Found requests in header "POST /v3/signin/identifier?continue=https://accounts.google.com/&dsh=S-803796963:1787545417511166&flowEntry=ServiceLogin&flowName=WebLiteSignIn&followup=https://accounts.google.com/ HTTP/1.1Accept: text/html, application/xhtml+xml, */*Referer: https://accounts.google.com/Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoContent-Type: application/x-www-form-urlencodedAccept-Encoding: gzip, deflateHost: accounts.google.comContent-Length: 262DNT: 1Connection: Keep-AliveCache-Control: no-cacheCookie: __Host-GAPS=1:eDDK4ZSaCWBLEFGLyE394wB-rxFzsw:7_ZJirGneP_pE7QZidentifier=&hiddenPassword=&usi=S-803796963%3A1787545417511166&domain=®ion=US&=&bgresponse=FNLReferenceError%3A+%27Symbol%27+is+undefined&pstMsg=1&checkConnection=youtube%3A120028&checkedDomains=youtube&action=1&at=ALX_P8tAWzzsXaZ2N8RBt9fpWXzt%3A1787545417620"; in File: "SSL") Found requests in header "POST /v3/signin/identifier?checkConnection=youtube:120028&checkedDomains=youtube&continue=https://accounts.google.com/&dsh=S-803796963:1787545417511166&flowEntry=ServiceLogin&flowName=WebLiteSignIn&followup=https://accounts.google.com/&pstMsg=1 HTTP/1.1Accept: text/html, application/xhtml+xml, */*Referer: https://accounts.google.com/Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoContent-Type: application/x-www-form-urlencodedAccept-Encoding: gzip, deflateHost: accounts.google.comContent-Length: 259DNT: 1Connection: Keep-AliveCache-Control: no-cacheCookie: __Host-GAPS=1:eDDK4ZSaCWBLEFGLyE394wB-rxFzsw:7_ZJirGneP_pE7QZidentifier=&hiddenPassword=&usi=S-803796963%3A1787545417511166&domain=®ion=US&=&bgresponse=FNLReferenceError%3A+%27Symbol%27+is+undefined&pstMsg=1&checkConnection=youtube%3A274&checkedDomains=youtube&action=1&at=ALX_P8u1ss879IW1K1oy_JZ8q2KQ%3A1787545444639"; in File: "SSL") Found requests in header "POST /v3/signin/identifier?checkConnection=youtube:274&checkedDomains=youtube&continue=https://accounts.google.com/&dsh=S-803796963:1787545417511166&flowEntry=ServiceLogin&flowName=WebLiteSignIn&followup=https://accounts.google.com/&pstMsg=1 HTTP/1.1Accept: text/html, application/xhtml+xml, */*Referer: https://accounts.google.com/Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoContent-Type: application/x-www-form-urlencodedAccept-Encoding: gzip, deflateHost: accounts.google.comContent-Length: 258DNT: 1Connection: Keep-AliveCache-Control: no-cacheCookie: __Host-GAPS=1:eDDK4ZSaCWBLEFGLyE394wB-rxFzsw:7_ZJirGneP_pE7QZidentifier=&hiddenPassword=&usi=S-803796963%3A1787545417511166&domain=®ion=US&=&bgresponse=FNLReferenceError%3A+%27Symbol%27+is+undefined&pstMsg=1&checkConnection=youtube%3A91&checkedDomains=youtube&action=1&at=ALX_P8vn8-uiY29Dl7nieMcD2kKY%3A1787545474503"; in File: "SSL") Found requests in header "GET /images/branding/googlelogo/2x/googlelogo_color_74x24dp.png HTTP/1.1Accept: image/png, image/svg+xml, image/*;q=0.8, */*;q=0.5Referer: https://accounts.google.com/Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: ssl.gstatic.comDNT: 1Connection: Keep-Alive"; in File: "SSL") Found requests in header "GET /accounts/CheckConnection?pmpo=https://accounts.google.com&v=-2011976811×tamp=1787553319405 HTTP/1.1Accept: text/html, application/xhtml+xml, */*Referer: https://accounts.google.com/Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: accounts.youtube.comDNT: 1Connection: Keep-AliveCookie: CONSENT=WP.2676ba"; in File: "SSL") Found requests in header "GET /accounts/CheckConnection?pmpo=https://accounts.google.com&v=1256782010×tamp=1787553948182 HTTP/1.1Accept: text/html, application/xhtml+xml, */*Referer: https://accounts.google.com/Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: accounts.youtube.comDNT: 1Connection: Keep-AliveCookie: CONSENT=WP.2676ba"; in File: "SSL") Found requests in header "GET /accounts/CheckConnection?pmpo=https://accounts.google.com&v=-705754570×tamp=1787554766661 HTTP/1.1Accept: text/html, application/xhtml+xml, */*Referer: https://accounts.google.com/Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: accounts.youtube.comDNT: 1Connection: Keep-AliveCookie: CONSENT=WP.2676ba"; in File: "SSL") Found requests in header "GET /accounts/CheckConnection?pmpo=https://accounts.google.com&v=-784988010×tamp=1787555220193 HTTP/1.1Accept: text/html, application/xhtml+xml, */*Referer: https://accounts.google.com/Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: accounts.youtube.comDNT: 1Connection: Keep-AliveCookie: CONSENT=WP.2676ba"; in File: "SSL") Found requests in header "POST /v3/signin/identifier?checkConnection=youtube:91&checkedDomains=youtube&continue=https://accounts.google.com/&dsh=S-803796963:1787545417511166&flowEntry=ServiceLogin&flowName=WebLiteSignIn&followup=https://accounts.google.com/&pstMsg=1 HTTP/1.1Accept: text/html, application/xhtml+xml, */*Referer: https://accounts.google.com/Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoContent-Type: application/x-www-form-urlencodedAccept-Encoding: gzip, deflateHost: accounts.google.comContent-Length: 259DNT: 1Connection: Keep-AliveCache-Control: no-cacheCookie: __Host-GAPS=1:eDDK4ZSaCWBLEFGLyE394wB-rxFzsw:7_ZJirGneP_pE7QZidentifier=&hiddenPassword=&usi=S-803796963%3A1787545417511166&domain=®ion=US&=&bgresponse=FNLReferenceError%3A+%27Symbol%27+is+undefined&pstMsg=1&checkConnection=youtube%3A270&checkedDomains=youtube&action=1&at=ALX_P8v3On_Y2wPFYG-uH56Xk3Mo%3A1787545504658"; in File: "SSL") Found requests in header "GET /accounts/CheckConnection?pmpo=https://accounts.google.com&v=-834390478×tamp=1787570124867 HTTP/1.1Accept: text/html, application/xhtml+xml, */*Referer: https://accounts.google.com/Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: accounts.youtube.comDNT: 1Connection: Keep-AliveCookie: CONSENT=WP.2676ba"; in File: "SSL") Found requests in header "GET /favicon.ico HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoDNT: 1Connection: Keep-AliveHost: www.google.com"; in File: "SSL") Found requests in header "GET /rsrc.php/v5/yQ/l/0,cross/aBIDyB4xhJy8wmKvUcQXclxgo-3469oiGT9DWDYPz6DhfgQe914iiBfD-GevAmvU9KONMKn3YhINqU49pVNahkCkeiF2w9Hlit1.css HTTP/1.1Accept: text/css, */*Referer: https://www.facebook.com/loginAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: static.xx.fbcdn.netDNT: 1Connection: Keep-Alive"; in File: "SSL") Found requests in header "GET /rsrc.php/yH/r/uR_TIYVE0g0.eot HTTP/1.1Accept: */*Referer: https://www.facebook.com/loginAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoOrigin: https://www.facebook.comAccept-Encoding: gzip, deflateHost: static.xx.fbcdn.netDNT: 1Connection: Keep-Alive"; in File: "SSL") Found requests in header "GET /rsrc.php/y1/r/ay1hV6OlegS.ico HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoHost: static.xx.fbcdn.netDNT: 1Connection: Keep-Alive"; in File: "SSL") Found requests in header "GET /rsrc.php/yf/r/ipwqPKyH2FY.ttf HTTP/1.1Accept: */*Referer: https://www.facebook.com/loginAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoOrigin: https://www.facebook.comAccept-Encoding: gzip, deflateHost: static.xx.fbcdn.netDNT: 1Connection: Keep-Alive"; in File: "SSL") Found requests in header "GET /rsrc.php/yP/r/b_lEtPAUPMI.webp HTTP/1.1Accept: image/png, image/svg+xml, image/*;q=0.8, */*;q=0.5Referer: https://www.facebook.com/loginAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: static.xx.fbcdn.netDNT: 1Connection: Keep-Alive"; in File: "SSL") Found requests in header "GET /rsrc.php/yP/r/kUc6oHI0fJd.woff HTTP/1.1Accept: */*Referer: https://www.facebook.com/loginAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoOrigin: https://www.facebook.comAccept-Encoding: gzip, deflateHost: static.xx.fbcdn.netDNT: 1Connection: Keep-Alive"; in File: "SSL")51:T13bb4,"GET /login HTTP/1.1Accept: text/html, application/xhtml+xml, */*Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: www.facebook.comDNT: 1Connection: Keep-Alive" "HTTP/1.1 200 OKVary: Accept-EncodingContent-Encoding: gzipp3p: CP="Facebook has no P3P policy fb.me/p3p"Set-Cookie: fr=0BlgfzRYbJP1UirTU..Bqi8dN..AAA.0.0.Bqi8dN.AWczzOTiUgglzyEwDD8aSzKt-H0; expires=Sun, 22-Nov-2026 04:23:41 GMT; Max-Age=7776000; path=/; domain=.facebook.com; secure; httponly; SameSite=NoneSet-Cookie: sb=TceLajcfAA-3AamqnbaP7RHN; expires=Tue, 28-Sep-2027 04:23:41 GMT; Max-Age=34560000; path=/; domain=.facebook.com; secure; httponly; SameSite=Nonereporting-endpoints: coop_report="https://www.facebook.com/browser_reporting/coop/?minimize=0", coep_report="https://www.facebook.com/browser_reporting/coep/?minimize=0", default="https://www.facebook.com/ajax/browser_error_reports/?device_level=unknown&brsid=7677449125226692222&cpp=C3&cv=1045848037&st=1787545421651", permissions_policy="https://www.facebook.com/ajax/browser_error_reports/"report-to: {"max_age":2592000,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coop\/?minimize=0"}],"group":"coop_report","include_subdomains":true}, {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coep\/?minimize=0"}],"group":"coep_report"}, {"max_age":259200,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/?device_level=unknown&brsid=7677449125226692222&cpp=C3&cv=1045848037&st=1787545421651"}]}, {"max_age":21600,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/"}],"group":"permissions_policy"}content-sec" "urity-policy: default-src blob: 'self' https://*.fbsbx.com *.facebook.com *.fbcdn.net *.facebook.net *.whatsapp.com *.whatsapp.net;script-src *.facebook.com *.fbcdn.net *.facebook.net 127.0.0.1:* 'nonce-zfk3iLQ6' blob: 'self' connect.facebook.net 'unsafe-eval' https://accounts.google.com https://*.google-analytics.com *.google.com;style-src *.fbcdn.net data: *.facebook.com 'unsafe-inline' https://accounts.google.com https://fonts.googleapis.com;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* wss://*.whatsapp.com:* wss://*.fbcdn.net attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' http://localhost:3103 wss://gateway.facebook.com wss://edge-chat.facebook.com wss://snaptu-d.facebook.com wss://kaios-d.facebook.com/ v.whatsapp.net *.fbsbx.com *.fb.com *.instagram.com *.ipification.com https://accounts.google.com https://*.google-analytics.com;font-src data: *.facebook.com *.fbcdn.net *.fbsbx.com https://fonts.gstatic.com;img-src *.fbcdn.net *.facebook.com data: https://*.fbsbx.com facebook.com *.cdninstagram.com fbsbx.com fbcdn.net connect.facebook.net blob: android-webview-video-poster: *.whatsapp.net *.fb.com *.oculuscdn.com *.tenor.co *.tenor.com *.giphy.com https://trustly.one/ https://*.trustly.one/ https://paywithmybank.com/ https://*.paywithmybank.com/ https://www.googleadservices.com https://googleads.g.doubleclick.net https://*.google-analytics.com;media-src *.cdninstagram.com blob: *.fbcdn.net *.fbsbx.com www.facebook.com *.facebook.com data: *.tenor.co *.tenor.com https://*.giphy.com;child-src data: blob: 'self' https://*.fbsbx.com *.facebook.com *.fbcdn.net;frame-src *.facebook.com *.fbsbx.com fbsbx.com data: www.instagram.com *.fbcdn.net accounts.meta.com *.accounts.meta.com *.fbthirdpartypixel.com *.ipification.com https://trustly.one/ https://*.trustly.one/ https://paywithmybank.com/ https://*.paywithmybank.com/ https://www.googleadservices.com https://googleads.g.doubleclick.net https://www.google.com https://td.doubleclick.net *.google.com *.doubleclick.net;manifest-src data: blob: 'self' https://*.fbsbx.com *.facebook.com *.fbcdn.net;object-src data: blob: 'self' https://*.fbsbx.com *.facebook.com *.fbcdn.net;worker-src blob: *.facebook.com data:;block-all-mixed-content;upgrade-insecure-requests;X-Frame-Options: DENYdocument-policy: force-load-at-topdocument-policy: include-js-call-stacks-in-crash-reports" "permissions-policy: accelerometer=(), attribution-reporting=(self), autoplay=(), bluetooth=(), browsing-topics=(self), camera=(self "https://www.fbsbx.com"), ch-device-memory=(), ch-downlink=(), ch-dpr=(), ch-ect=(), ch-rtt=(), ch-save-data=(), ch-ua-arch=(), ch-ua-bitness=(), ch-viewport-height=(), ch-viewport-width=(), ch-width=(), clipboard-read=(self), clipboard-write=(self), compute-pressure=(), display-capture=(self), encrypted-media=(self), fullscreen=(self), gamepad=*, geolocation=(self), gyroscope=(), hid=(), idle-detection=(), interest-cohort=(self), keyboard-map=(), local-fonts=(), magnetometer=(), microphone=(self), midi=(), otp-credentials=(), payment=(), picture-in-picture=(self), private-state-token-issuance=(), publickey-credentials-get=(self), screen-wake-lock=(), serial=(), shared-storage=(), shared-storage-select-url=(), private-state-token-redemption=(), usb=(), unload=(self), window-management=(), xr-spatial-tracking=(self);report-to="permissions_policy"cross-origin-resource-policy: same-origincross-origin-embedder-policy-report-only: require-corp;report-to="coep_report"cross-origin-opener-policy: unsafe-none;report-to="coop_report"Pragma: no-cacheCache-Control: private, no-cache, no-store, must-revalidateExpires: Sat, 01 Jan 2000 00:00:00 GMTX-Content-Type-Options: nosniffX-XSS-Protection: 0accept-ch-lifetime: 4838400accept-ch: viewport-width,dpr,Sec-CH-Prefers-Color-Scheme,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Platform-Version,Sec-CH-UA-Modelorigin-agent-cluster: ?1Strict-Transport-Security: max-age=15552000; preloadContent-Type: text/html; charset="utf-8"X-FB-Debug: tQ/2KfVVkgo9PrzIlH+03xU8dxh5ZOquOWhwtV0t1Ci33MwCJjkHFjIWv1lUFryMRyhECZrSjWyF7s/1friR0w==Date: Mon, 24 Aug 2026 04:23:41 GMTX-FB-Connection-Quality: EXCELLENT; q=0.9, rtt=8, rtx=0, c=10, mss=1392, tbw=4448, tp=-1, tpl=-1, uplat=114, ullat=0Alt-Svc: h3=":443"; ma=86400" "Server-Timing: slb_crtt;dur=8,slb_srtt;dur=-1,slb_req_start;dur=1787545421590362,slb_srv_hdr_rcvd;dur=114119,slb_cli_body_rcvd_first;dur=-1,slb_cli_body_rcvd_last;dur=-1,slb_conn_lat;dur=0,slb_ssl;dur=100,slb_rule_lat;dur=0Transfer-Encoding: chunkedConnection: keep-alive560��}�s۸��ug�k(��DM��F�q۱d�L�(��hqQ��m��ﯰ� RJ�g��}L:��p��~��Ik��[�󡽴lwE�v��$��f8~��m��j�v��q�-�W�n�n9^��q��_֮���c�V�q��O;��4�&��$�R�>}{;].l'<��,Nb�t�ޞ��K�G��O=;j��r��Jl|�}�z�զs?��b��N�Q�ڻ��k�ֱ�<6Q��g��^x�j��ad��{q!V�ö�(�l�gux}}=%�qjG��J'��w[a��r�x7_��8�R�uʴUEp�o��I:߲7��7*�c�۵��~�ZX?�B�w*j?s��XJ\\9A��\NP��2N��2N��2��^��<\��帝��d22ӤC�2��b�*�O��A��2��'rO��ر2��H�.M��oi�DUUC#��²7�8څN�ĔM��0��M�Ul�;��?�_�xM��d�V�7?��t�o~�~��%�}~c��f�&I�jLaq��p26I�PY쟌��D*��B�]��22�PU��ƆjL�PP!��w��@5�)+�"*�B_(�D�Usݰ�i`��ḷ`Бi�U��`��I�I��[��\�?Q�noBJ��wl��÷�X�N�~$��BT�:Pqs��RQI�L��n�ٝ��O�bO8�d�'��k��.�X�.��]�I�0�5,V5r��`�0J��g[��]#�z8�\X��B$��H�܎�a��0��C�Eh4��O��Ѐ(��z��7`��0K�p�Mu��B$��A�Oi��.�.��5NFp�R�dg�n�qS�N��]Q�R��d8`�v�`[N&�vb�$�-/�tu��E;n�YF�.=^��AԐm�N12�01��o�tty�R5��u��x��?)�_n%�ֳ~Һ��V��I�?�GI�v��Z��N�";��"�N�&�O�8nb+I2��+M�Xu�C��1=�,�^��~�ԓ�JI��^Ϡ��#4��׮$��0�#u�R��y��`�S�maOJ�-��YetPG�j첚H�ZPE�U��h<��N` ��Y��s*_�mz�8-5��j��|��{��W�ܻ��Q�P��Ϗ�Z��[�VoI�i�%�Kk�-PŚ��@�ᘫʿ�GI�K�j��%hJ�Bo �T�X^�z]�~׏��hiH%%�G5��Y��ac�!U�@U�Hpa�a**tW]Q2(�KQj��(�y�ƖAR��B��`1��)�ۉ��o ��,�$��h�kzO&�F[��=#Xo}��9��¾x*�V%�Dd`T��d�!Y��ڍ��F�:JR��x�k'q}�?��`e+��mD�d�Ŏ�5�V� �/�hx�(ۇ�^�]��}��b�s2J%��VWZ=�.:�@ Tfd�VZ��̄�y�Q�6v`6s��i�Õ�Fs!�"&z�$kˉ^��%m�Z��7�0��m��ۇhcŦ��b�8�h�|/p !k�+]�cr�"cw��';v��i��Eu*�^:��'~Q�m��=�mT"N9��V�QҨ�F[��;R��95�w�N��P�*BoL�R�W+Y�h��$��ʂ�Қ側fth��5#��'!Atu��'E�V��W��iZ��W֣pp/��Q7(�P��^�3>*8��x%{?��Q��Ύ�CWn�2��L��s��X9��P>zTO&&<.�uQ9+Kh�`コ��_��\E�c۶kh|��h��~9��m��A�%��`�^Z;��@qvIS��ҵ'#exq�{ԫ��V�r��H��D8JU9Q8a��:��(L-'!�VÈ��飿g�", "1fc0a8�bTH��d��A��#��s�1��ȭ$��3DMݰܶ/�ɡ�j�%��B{�g��H��H4��Y��2*b��8I�N��RQ r�-0tVD��j8�E�"�B�2��`p+S�,<٣��m_C�qU�Z��z�c9N�n�#��n�kLT�u�\6a��,w�4V��:��BLB1��q�e��/E�#�"��h�H�[��0SP��S�p�C*q�V��\5��k��PŎY�Z��r�Q~�(Nwod�q��2�k'��ƦחQ�1�b�@f�蕒qY��)��6Q6<�}j��H��㉀ *W��1rL'g�J��S`�n�z�_9j�*8i�B�e�(��Z�~��}��(��y�w��]��BǍ��8C�f"�]�,�38�<��9��v1��n�>-��;^X1i�J�Ii��k�WxmIg�@%5%�+�E8y��Zq@LOCpY��@��Y�D�<�b�B*�Ap��k��,�0ʍх�\YO d#ʗ�o]t~4��%PB�+�t��y�Y�ߖ��g�-�0�WG;��/�TE_z@WF�eGB+�0i��₹^hb��k�M�U��߭��/I�س�Zߓ��|g]�([b�>8@�4�ڦ^�%�gW"��/�JW�ݠ��nj�V�7"��Bh�O:�u=;{��Q�B֩��:�m��o��ӞN��֧��}�^�K/)�Ny�k��%��p�YDj��~F.f�8Y��|�$��I��Y qK�$��э�b �Y�;�r�}��ƃ�wo4��iX�9�n��L�'��O-��BG�6�2�m�͓>p�Y;p�0��Q�Zp��I.e�ȳ�ܺ�+l�=vd��Z�[;��H]?`SfE[V΢�Q^�ܲp�mV��)Z𐆃�kW��1`�W��.D)&��_X-�>V(��.8��@E/1B\t�,��P�8%��?�ß�)� ��W�$)�N�H!��4vw�9E�!�� ]A&GZT�J]$�3�ux�L�PZ{�I*\��-�!i��F�G��~�/�$i� KFH��"@\�l��({" "��M�2�'*��o�Q(Cp�NՄ^�Fp��yʚ"��SA>�K��_��]�I@]�TQK��(�K�5��7�� aD �FWUА�6z��Fm��(��zO�a�x�v��,��0eJ"iB�+�bQ��EP�D� �h0�}l1�'HbO�aa��*��/�3��q��l,�^Y$)��]M�DA�aa0��U �x¦�򒠋�D�]�q��"��B�9<��Z�2��H��!D_̡+�Y�Y��@$�A�Xf��S�n��!��j`ʒ(Ȋ$�zzM�=4�K]�-��^�=�6�Չ=[�LuY�M9��H\�,9��d7Z��|��s�]M�&`l�̀o��\q�!��Ö1^i�2�F��O4��aTf�ػ��X�~�B�A�G#z�J|�8�tx��O�\ك\O��-��_d�O��vnbkǥP�H/'T]:�)z�*N�� A�/��٭R�T R]�(^Ya�=�7��"�`;W��8V�Sa=��e"P�˗��VX@g��rCAI��S�`Ykj�J2�3��)�F'@�/�%pk�a0��<��X��!0p2��=d��<��GU�;ҮA��E��R?9��ȝ��A*zM=:D�N�b��a0�k�и��Q@��HT|�ٮ�$k��3�J́�dG�\3DJ�� ע\S߅1t��P:��+��C�G~@�}�/�*�ЂTp��ꇟ��'|u��Cy��kܕ�De�fOEe�XŨ�\x��W�#_$��R@��ǈ$�Iw2�/"�n��0��Ce(�U/meE �m�;��f�D�>e�W:��*�߹�~�B�;��=@P��5:V*V>��*@O�\_D�eE�=�&�7bЎ��)��(�ٗ��k�xe�f�N_��?]�kA�BI�3ؒ��m�ѷXx��^%) ��]PTA�BIq�U��i!�N<��i�O��@�3�J�}V�[��y2254��(WQպ#��bP��',=0�S�|��!1t}�^�Ԯ��`��x�ې��5�:k/�%n�B��/I� �d��=��h��?�:ѵ�'�,��DE�'��q�R$�Ͼ]� ��q��eP�ňL��Y4�Q��5��'�L�4{=]sY�ޓ��Jo��)��(��X��tM.��Y�J�}Y�(�2PA!�!4mуO}��,~p�=�g��i��6U��J�p��#0��Sl��zC��$Z>��#�|�p,W1�^1�b�u�э��uñ\��3TКȱ�!xʗs_^\�X��8zy�>(�nG�١��aD��#��Gޥ�b|u�h%�K�kzQ_cT}ZC.��V��3��DZ��*�9S�r��b�+"\� �^�+��A[�U��&�1�/>��K��U��a2T��y�=�oWA�YI�!�u��6ԧ�p��l\d�R�5�J��VfWBwy��7�N��F`U��l��W��/��D-TB��r�@��z�Ҟ��8��a_e��6�G��.�:��Y��з�HvA�PjGR�M��F�qR�᧴"��=��±�g��q�A�:��ɯ�c�젣�[�*A��ivK�v��*R��KT��B�R��~`)��9b�ܡ�� y�Ԍu�8��4ǽq�gS�?��G��B�To��l+KH��W/B� �Ҝ��/��8M�=p�qy�+�gJ��R5*j�G�Q��-��J�Y=P*��k�f��ٍ��pLl��<��ڕt|�K�[A��o�W��*ܻ��?�bۚ��ܷ�{��y�g�[Le�ܐˎy�Y��27+��|�Է��{ �\�9��u�W9I0��Zl��QhƝ�cK�b�%xH��Q<(P��n��d�G��S��"��!��GѬ��9B:�z�-#��1�ɞ"@ 8�e ltlMN�I2��x*��D��jB��?��o��滲��|��"��8��l�R30�+��S��w_�ˇU�>*z��)��x�.��=j�@'I��!x��)��|�41L��z�4��y 'E�b*��Q��G��lh��]�", "u��:��)>�#�M�d��Q2�mU-�l�OFC�׏�[m<�GhGI��c��1R��Fc��P�2��Ɉ�S�2YKv'r��9K%��l<��"/[R��bO�ɣR��y��(��f�ʮ�kʇ츚�A@]� ��|0��|0�\��WwQx�>|-�ؾ�V>C�le%o��nc��I��]��G�&�(&V�T��P�nf��R�\�X�l_�솭��~�K'��^�l��-!d��4-�"��HGt5��04�|�JS�^W�n�U�}��.ҌV��G^"�O�sZ��q� i�w�[�`��d�ϵ"`χt��h5p�VTahr�9pI��j��I�G��$oh��0��'��0.��C�E~z�%6�CC�n��`�Ԇc=K�i6M]f)�e��`0��ʃ�p��sؕU��QU�.�,��?�4U��.8��>��hC�Y�h��IW�tȫW��=�>U�0�xOkfJ��t�߷�T]�G�=�.��u��jxg��Q�� U�f�6,Dg��a�)g�X�G��^� PQ*�\�R��>��@�R��j�c^�G!��2QE��5��q��傺y�-!�EǏVQ�D��:A��E�u�#�u@3\ET\��x勜�%:hI��ъ^��Ś�1-|#rp�%�˿z��/l�}^3,%}�R��=��7aq�$ V�9]b��n��?4�|��ETN!-z�+pJ�OHO%$j�Az2�BL��<��(��-[}��z닧��sy��Ϊ��'=m,�Ocj��[=2Dl��k6mX��϶I�7��>3(ѕ7�IL�{(��rt��^Q]�,�0�@�Z*�!"{Y�5��%�)�C�Όu��t�RO2��|rQy��'��G͌��.(]A�9e|��AY|�{9�Q}g�x�M��Ƀ(�zDq�� >��h��M%0�D�qR!T�^��d��ש8��v��C��E�Z��08g�WF��3s��%S�dt�x�geX}��Z:�{P\��I��I0K\aT.yE�0%3?H��g_�'x�4#{Fd^��o��@>��f�\'��̠��B��K2��O��k��\�Vq��D�J��$��4��=�2�V�Ϩ��s��$C��l�5��Y��#��DM��UW��;�g@ݡ�"�i��Թd�١!^$�ɬ��R,j[��C��ފ�Y��g^��=�Ʋ�v��x�`��ͮ܅WBA��3�~��ݪɀ6T����"�v�Sx�";t(G�QT��E�,��u�u�Ct�Y�V�{��C�r�Y�<�{6��<&��&�ϺuNt��X7z�u5�="�'��j&�'7@jx�!��nF�Q�%��kSJ�G��&r�t�%��5<-�}Czߐ�נH��4��0��ؗ]��Z��^Cz��q�q`H��ؗX8S�!�g��˵�� Фߐ��GX@Czϲ��oH�G��~@��b��uT-PΨ$�� !�G��}Cz_YW�GʖhH�ka�}Czߐ�J�!��;%�gh�!�@جB>gĪ��H�YB��{MtM��d�Kz/i�˼��&�`�S$N8�!�� KE^��S��R~9��z�U��tC|:EkO@�v�z��Bҏ��T��tDU��$9�=�1tA�n{��l�g��X�1��*��F��3��S��H�eX��$�g��e��M|�PۣwC��v�"�G�g��Sȣ+ùvY�j3�7��)�E�HWA�]��?�x/=YP0�(Ȣ I��<�t�났�N��{�F�d0��ա��+@�AF�bTR�s:.�,��uC�4�tt��>��Z�Ϯ�hC4��}�m��p��h7e��p�&8g��ᶯ�7��G�h77�]$T�k��0�k�и�G0�7��`\��)��ٳM��)�J�v�|܉ �'��ק��Ǩ��4�y �2��?L$fd��JC��8��3��"�w�JO#`�0l"�<�O��|�B��p�g�L�M�&��"�B!��C�%E@��j�mO!��]��ծ4��zUh�@�Ĝ��V��G��t�RO��|.��'�.�aXO�dɹ��MCꋃ|��q��?��>�h��o��n�܃�=��s��>��OF�H�|�}5�<4R^�jzN�T]~\8G�$m��K�\��ϖ7:�^ި;��K��>;t��8�,��?��϶�UbȒU�|,n�@��.Xg2��t?�D[j�t-�]0��i��J�&�N��R�sҫ`�m��Pf�o��UE��'��ݸ慨&�.L�KQ�g�=q� �b�ov��mQ�w��W�B��9N�c��v%��z*��Ygn�J�h�у��>�me�3��:I��4��M�=⸼�$��Eɒu�S�蠟/'pl5�i�hslbeo�w�h��8�,3��q�8��IqϹ�T��ѳz8kו�UVg%�X��gI{TX��R�(�3��醬w��6T�<�[�ZQ�%�'��vn[2+��C2��A�z>x��oO �ég��we��c�WQ��<�ؚ�,緯��q��کO��Ş$ɰy�s��l�:$B�4I�l.�6ɢ8�+w�i�$�H�pH�jˢ8��o.�l˒*�?9ޑ��p1e��hn�H&;c=J��p�I�l��"��J��Y�{��P��]i��j܈y��fY��$�g��R15�&~$��?F��98�"��]C~΀Q_;��E?��ắ�Z�C)�b�{�!��C�%E@��j�uO!��]��o��1�}�u�ɏ�耝��})��X�u��]�C��{�C)�b��ð��i��J�&�N��R�0uҫ`�u��Pf�o��*�s� Eg�pݣi��!��l��f[Y��̸%��NDR�4�@%3{�8.o�u�}5Z)|p�0�C6ˆ�J*��N��Y<(P��=�kB�`�u�p��aS�u_j��j��/��ẇ��u��|w��_��-�hʇ6��3;Iڭ��?�! Y�n�n�cw��α��o-�I`�v��7��7��J+�6�ws�V�㯲��kv��87�O��Çv��/�(�#�k��-;��$��~h[a�h�`��v_��?��v��_;��i�s>��9��6.�e��v?�ߗŻ��[{��o�Hۛ�Ƕ�N��j�ߺ��~�\��K�oI�TA�+�VnL"�(�Z�7o[��-�6n��_��:%��q�t��7��m�m��{N�--;��7��7pM�$��i��]��UUC�5Y�uC�e�-��qx��m�߀��K�O\�ذZ��aK�Jb7/]Mo�g��B2��i��ns��:I/f��0�o��(��mo�y�ݭ�o�b��s��f!�J��#-��c:�j�п��V�|��Vx��.��d?�>�[;�f��|�v��-��r�$��|m��)x��w)p�ڳs� ��=K��r9��+�vܽ8{m?��5��Mݽ_/.7�;ǻrn�o_�J��k�m��j��Y��Ejp�L��f��?�lِ��|��y��'��b+��p��s�I����\=߄��оx��F��|Mq~qu��`�^7�÷��/��ڿ�ota�X>M��V��<�K��V��U�|��q��m9�r'==K��1wO��v!��M�9W��3��̔[љ^��wk�^d񾸅�", ")W�SIL��͙��׷�ni_�RO�\ہ��!��//n_��a E��ݫ��(��n��Tw�O��f�i��ˋ��ګu1xq��ދ��TG��?N��׻�{O��~�*�~��{�O��s��.h�E`(�S-)t��E��W#�C��/v ��"W�ܿ�g��5њJ�E`W�םs��Tom�~�a!kι�w��[m��C��n>�Ww�8�_mo�w̻�b�5��L1_��}�l:��O��̴��X>��N��4��|=7��N�:#�;�מ羿��)3Y{qD��@W3��nX��|&��Mt}��g��M`n��Śj��*rΥ�.x�ly�]��k�b{��A6_��y��z��<н�ߝ��[`��k��qf=[o�q�[�g��7��߀��7�U��탤��I�A�eUkm�Ҕ��ldG��&Zy�E��m� m�|ߍ�B��w�/�}`�8��x�[�Sr+��W��k��̐�d��Tz��6]k��M��c2�J�"��<դ��U`�� X/��LH��l��3��ts�(=f��g;�_�x}��ET��ͅ�[S'r��c��߂'��8�!�n��n1zK�f�7��h>5��j,S��\�n�B��Ԟ�Ǉ�T�|�O��#��bj�-��9�H�j�y6��L��Ei휯v��i��vt}��h��i��ЄF�w8ٍ^_��W�<��Ǣw-�ux�_��y�}�.��u|��7�7O�fW�|v��p�h�ڇ�Ļ��S�y!��l��^3mu}�I�޵��=J��w�&��5�.�#��so&߉�l�]z�M��e��K��>��V��}>��Q��\%�2�ʒss��l��0��\|Yx�z3sg/�*��=�珻'��̧_��kˏ��~-��&��}��{��u\m��o��.[$o.��,�� q;��?i7�p\��[�onF�ϔ��/��q�d�j��ù��|v]W�<0��nqn��˄Y�`�]��^��_��z&n�3�\�V`��>m&߾ݙ��t>��`��t�ںrn�]��~�Egv~��4Y>5O��ӻ�'-7��bm��ص�4��3�;O8:c��S�|�?f:��W_��oy��zD�r�v��I�+�)��b��ϙ��h��)��{��j��vl+�K�N�<[�b��r6��p�oŧ��<��E��<�҃s��s�4��5��)��l{�}��p��=T��u~?1>e��f>|}��h��;�z�m�Pz~��=[��i��.��vy�vF�� +��S5��6��5��8޾�6](w�B67��6B�Y΃�`�� z��7�"|L��*�?��=��g��ʚj`��=ɏ/sox�8�>>��;K�L��*��-��k:1@�6��j��A9�m�&��=<)W�|�=8��z��ۥ�\_�i_f�]no�IZo��\��r��t��LO�٭8�j��<2�-F��|*�8��V��E�]�vx�b{��G��z~~w0��L��ڽ�;0��sj\��4�]i_eP׷�B�.�_�+O�Ěj�T��I��I�}��f��#�Y�Ƶ��P_|�<�|g?�ufЛ��-?�P��!��'�l�O�ۈ�ߺ`��/��s?��:}dΔ�+��s��^��7��ro��+��U&�-^i��f��g]ܥ�_M߇�7�0��Sw�5�fl��x�yf��v�f{+�p<�K2Ɠ�u�c��~�jڇ`�}��ô4��7��n��!zጥPjgC��?�t��g��u��\{?�f��q��@��+�8��:6��Ǽ9v�7'��u��&��|b�9�-0��T��m�:4�qKPIww5��Ӷ��vd�j?s�aڔbfz�rN��L�t�_lN'܅��~Q�9��8�.��~283��͙��f�{@C��W�9� ��t��6:89w?Ku��s?�k��"/��e��,cj�=P�1ݿ��G+s��g�>�b��!��`�QJ�죔��?�+��ɷ��-0��~T3� ��4�Ru7�~�m��7��i�uw��K��F�B'�bhh��2��R�4�"��!��u�i�W�Z�y��Y�Hɻh��}m��eퟝ55��g�u�tȲ��U:dHm��3�'��v ;�sٱ��_��u��w�ew��-@�p{v��Xܱ�s{��rl�1��U��c@.�}�P�9��4��kp��k��@��N��j3��@<��v��o��~/¥�\�KO,*+�y��w��*d��", "3a2d��;_ŵ.?L8�A�МP7`L��/4�֗��@��^<��@��Z��-�ޠ&��4�+�5i}!�i}�.�|%��-�Kkr�4��6�V��B0��*�_��M׾��~�WV}@U�V��/<��x��ς�\�=dY��*[>��O:x��I��l��Xr[;��Ly��ͪ��n�2~�K��\Ip��v�9iTaNmJF"j7��r��fM��'X�ڣ��J'Rt�~��|Y��]��R��c��$��n�G�7��~�'[��4�̹&��'#O��`��Q�ݨ0ʤbS>��U�do'U�rY�=(��64��0�+6�s��q2��JmX�1��_l[��וo��K��56�AY[5��c:�%��"E&��F��+�k��,�4��(i\�e*��͙v��!m��9v��M+�:sZAHDqk�m�d�Dj��%�Ū�qeR��`��۷��^��߱g[��T>�Y�5��KúI��:�'��N��a�r�q�_>��%�s�x�*R�H;2�n��`�npp��m�a�i薉|ų�>�Ǻ�ۺk��S�t��t�:�lꧺ��Lw)�c�&�;��u�ҝ��u�ԝ�;��'�鸺��cCw��L��Ǻi��k��5vuӚ��Dw�2\}l�&�DBu}2�M�է�>s��g�4m}��3C�Y�c趩O1\K�8�m蓙>��S��9C�x��әn�uۅˇm鶣�3ݞ��>��T��r|}��oH��<��s7�Λ�i�]��H��]Η��D�x��<�^u��e|��|�}'�o��?��p��o�#��o1�T��e��r�Gh�6s~*B��yˏ�?��r�ӛ��%C�p��_w��ʧ��Pp&ˋ��|~��U�v�]� [4�5�1��>��l��8�8��T��Ĺ��ޟYXx�g��f��S*�C^$��G��B�Y-��8�rG��0�aoA�Wa�=βh��ݪ��$��˸��'x�,Y{+�?�Ƴ5�*<̽$�6�:��0��3��L��>f��'�B4��v|�.�޼��ٙ��<��ս��s��H��A)"��#�~��9��"ۨs��MK��/" "��x;ϩ�.��(@�a,*�ّm��Q�)��{��׎�O�§o�+�N5Lc2��Nj�M��2S�Ċr~)n�3�oR{��6}~�b�V;�^��r��DlR��W��dF��6�^��<�?j9/��MC��ھŝ��z2q��'u7�W8�-jg��VeC�0�m#�51�4qL!%�2�!�7w�9;�Ɍ��&wOtf��x��A�^әKqzw��}ӔP��zyҫ$?��g�a�r�7k�Ht��g=��~�@Sñ��o�[�of6v�jf��.nH��44�\�Zu�7P}�W��6�MwֿkE`1�ڤ�s(�W��v��i��ho"�?"��'��}��X�v��eE�%�e/��p��N��Q=��5��m~fY��{5��u�(]��.c~/[-�Z��@�s�V�gD�'?�O��$;��(��Nr8��MC�}8��f,c��7E�Aoeο�YR��d�&1�;��v�~�cdb��y��1�C�4g��g��ͻ7Q��`�C��vab��c�"z�� ~�$��\�hc�n�^h��u�eI��WX�e@��5�-�P�� ~�6��o�o��nbOiboX��d��_сT�v�fK~�<�8�5�<�6��ߨ�\mɋ�yq#��-�zէ3��2OI�N��a��nj��C��)Gz6�!�1u{@�p��7?�^]vP�>Ti��[9�~i��T :_��淼(�>V��{M�&��c�i��C�i�� 8zI�m?ܘn��F�ypq��(C��(��N,�w��sZ��I��30�1d��ħ��W��B��rp��^�=�1�P4��Xe��M,{9��y�a��X6�X�_��X,n��2`^r�A�l�!��^�::�~M� òf�!��.<��^~/�ƽM�߇j7��=E��EIY\��H1�gt'�P��!̞�6�s��8O�w��LV�c��ow�{�:�~�K��Ln;T�e�@L2�r�v��/�ӐE�r��ݐ�&�lr��:��'jrr��T�?�tʷ��.o�0�_��u'�!��4f�4��K��K�XrlMk<��9s�/�8��Ϲ�o9�!R��kf��t-��߅�#1�a��P�Q>Z�x�}��g�.��l��CH�OqU��9Ϯ��W� ];f㧋��w_�9f�/W�?��칸=��0�_m~*��y�p��>S�~Y�]��1z>�>?}��0{t֫��^ֿm>�=��t��bN'oo޾*ӫl��.&��맫y~��o��dc<ƿ|��Ϗ��~��}��{CkM~�Z�A��xx�Gj��|6��q�3X��T�ls�2��~d<"KaF�#,iǖM��8�ľ�v�RdL��=�e�Y c�4`D=qMj�8�%��,��Ka>%�S^��q�&!X̣�ȿ��6/#��|x�/�a�d�4��s�e�i��$*ױ��%ϥ�>�y��Y�<��j��X��#��مl�,Xr,."�Rv�n��e��OhR��9h��)�(�ٛ2c��?��Y�>��k�a�b3?��"�(�k�O��5��`"垓͌*�+}��}cn�?1{ba�/79��py�]�mѵ�g7��gp@ҵ��n�<��{��ֻ>��dk�B||�ݞ�\]��څ��.n��㓳7WW?z�W7?��..o��]��no�.ߞ�xW��~�0�f��wg��wW�g��e]k��wＷ�n�z�d��z�.9��{aY�a��tj�wyk�O��_��~ӭ(�z;�M��)J�ݞ*�Qw��m�F5apIGBTo~9Ҧ̷�n��}��~zS�v�2}Ҿ�CW޾�˩��q��oX��e��뉍�K�OVIVhG��^� a��>�Z!(��K��#��Lg�-�#kd�F#��4%q��A?�2�#�a��P��B�uD"u��O`"`{��E��G��Ea�eETS�a��"��Y�9 �g��y��ie��c�[��:�V�W��+�ȃ/�'o�X<�G��k��(y��ou�,}��鄎��O�'kNZW��P��GM��O7��U� J��jb+��YX@C-�v��IZ��:.�2��.G5$sX�f��H�wKC�g�F6�X��Kػ� �qm<��K��T׏�2XdI\x~�X��|��ӡï$YF��^h�"ck�E|�|�W��;J�J2.��a��)��,��{N<`>�U�SGѣ��ѡҌa��!}D��0�,Y�!h�v��G�[��[~��x�֬�g��U��t�ѨU�!.)5��{�a�}�6��S�*�y��~&��XKE��4�D��H�?z�R��is)y��0Xҥ>OK�E��%��o\q>˂0f��c)��ʒ5�Y^x��1:B�^G,�y/5>AX@��9#��Ē�$4��T�5�z��H�_F�ҩ�E%>��Y�3�G��R�hS��\/��r��3��S��䥇�xE+3L;԰K�$�D�yOx�ȯ��3Z�~�Opq�8�{�G�5]�p!m��W�$O�#O�$��Z}�&�^��3{�3z\�I��t��g��0Z��j��\�v��*�YISp/^��a�1�Ӣ�扷d]�a&�3�S/ -�_B0R��J��IWL�yz�K��bE��(�&)B�H��O$�y��J��U��,+6m�\I�_�Z��]��7��{��:��p��<��]�W��8�I��K!��&��:�Eڏ{>?/�0�O`�!�oK�&ѐ|�+ȱ99{��N��;�d��*�L*�[B�J<�(�1|^./�7$��5{�o�$~eB#+��ps��3@��lH �zx�>��׍Dʪ��k�O��jU\c�9YIu�;�t��[Y��V��3��ō-�9%��sК�Ӿ�cDې=�̲�(��I=��*ܠ�'U\o�ڤ{B��r=��&��ӛ��pɠcM��|b�°H��-��Y�#�=��!}bb��OG��#�_�\1b�1��վA��7}<3/ɵ��OW)�̎��s/��%��߅O��Iv[x�|ӧ3��v��&uS��B�0�w^�E�n�c�M��5�磯I��y�`��3g1x^�_��ULW�a�)3d?��W�1��΍��(��o��<��%uC�H<*��b.��/��~��NK;ug; �:��2��G��Y�^6_^�7��o��Dg��g��N:s�t��h�t�Dն%��h!J^�*e�Wi��BY)�WO�o��UQ��Q�ߑ\{�^�҇* ��B;�M׆��.��H�&`:v��T86�i�t1�<(��-��/��a��qM�jK�k/�Ph�q�9L@��"�hH��2�%)��ά^��zed��"�Ŝ:U;r��Uas|�,��,�L&��zyE�?��V|TSd��EЀ�-w�J��|ݔīJ�?C��ޛ��ڑ��G��Y�yg݂�Z;�(�0�?��a��<��_��a��՟A퉲2�ɒ`��kOV��?>�뿈?�V�34��Р��3�!`��۳�S��`q��H��"@�>�X�/.��$[�67p?\��Cɍ@7G��r�?�dI�=�tzħx1渇VI��8�U0�F��h�Z �E� �M�v|oJJ�D6 `4��1�� bV�[��BL�/XU�dFAu�za��UvP��Q��E��ԕ��|��y6O�- ^�+�a��(�"X�z��k��%��X�S�W={��0��Uv�q�J+_��7IC�:e�a�:�x��H��$(��Q,nU��I#�;&��X��c?�P?re +�hn��My��7}fRÀ�x��Z�?ϒg|ΠQ�~Q"n�f��.��(�Y�^h�I�<��}'YUhT�/��YZA�&�w((%ԇ�1N��b��2��,�JV��1L�5�|�]�ɦ��8H��Fc��N��7�%'��$��M7��?ga��0��?c��fdn�=�vQ��T��g��2��"<��B�j5 Rb�^'i�gC��<��t*�"xp2��+�yR`2�'��|.Ӏ5��4b1�؝Ίd��g�jKi\�l)�y�̱(^�)��1�U��k�y�in~�mT��YX�e�(]��b`e �^�/��C�8Ȓ0Q� ��Ӄ��_+H8?"�'��L$�ګ�&2�#��$��Db�-Ѝp�G��(�4*s�'��Pи��0�#!�2��"�t*<�Q��N��:`� a��yY�X*w`qՕ@�<0�~s��(��QB ��T�냧�իL�Fi�=\��Jk$`Jsņ+��d�Xm�5�k�AQ8�K�#��k|x��qq��8��|�T��ߜ�{8�m�T�0�O��9�˿d0�k۟F݌rpTc�l�Y̧ހ!I��đút�菠<��:��U"�|��A�4[��M�ʶ��~+C�#��08�>��#?&��y��w�=݂�S��!Oj�Z��£�[c�4��!@a1xd��5_'"��]>��X��-�Pw}��ۥ�_t��H�l�8wy�6�W��6�h^B�d��^��@�օ�`=�U�W�lǠM�ԋ��I��;q;h�,�<��y�2��vL�{��7��$-A�Ikw��I�U�9{��zxCؿ��SWb��$u�l�b��U�Y��,��H�jG��c�V݈}��EO�m��v��%�}��udKS�ȝ9h[�U�-[:n��#?�G��7�ɒ��`�bE��OD��6��`Lp�:PrXo��X��$`�\}�[��m5��k��It�8s[*��Y�\t�y��?�f��/s�"��I��A�@l��D��XU�=��_$�@", "�uۃ��/��z%�ٷ��3��G��-C�;�<�hg�:;Z�p~Aۄ�d�o"��s�#}��h�w��[��ATD��?Y1��?�ܥ��[�|_�o�lu��enG�F�_�2{�1h��֭�|��)��l�-=#�bӌ#s�N3|�|�q��bA�r3Z�W\i?�g��4��#9!�˦[�b8�� f�s1��i��{��$~��rF�j#�0�V=r��a�B �'o��_�V3��O�$�g?^n�%k��͞ =�0�R��ј�C��'�ʪf�>~m�$b̄��q��Tk{��Z!*��`�}k��s�-��K�6�\5Ⓑ�r~z{��ܾ��T��Ym<8Yu�;J��=��)�"��P��-u6��<�~��e��¾I��֞o_��)R�W�Rjj��^��9�(6�y�xò�޾��F�%�`�_�h��"5�P�C2Q��>ˇ��8��/m�J��)ȋ�N�P�T�ܽ`�+Vs`��"<��3n݅��}{�r��O�s��M�f�Z�� r+�Fχmn�:y��Ep�vG��z��(�7Q��-/��G�{�ӛ�S$�7f�lVE}�M�h�P��_1z��C��p�=;��'�KӞ�z˲L@��􌔐��3kpU�ԧԇ�*�w�ƙ��GQ��k�%d�)�;�)��S�RoPqŸ�,�=�/��-��!��]��d"'��M!q@-�Q��/�hj��iM쉄��ÑH��:y+�D�t-�mN�u��Cm�:��j`J�V�R�C4VEc�UE�o��q\ǝ�-E�/Jm�K7O��z��و�&dH��;��֥%��Y��rO��X�n�~��;�mN��+��X,��"l��MG.��E@U"-�e�}�鎩|�-��y�r��G�@�q��!.�sUh�$ ��oH�t+��p��;!��¯�2��N4�%E�=è]oK�EwK��N�i�@�G��;3�<&�Z��v;Nl��-𦌑.�a��ϋ3�L6~�&��7++_�(d�.��O<�XbX]��U�/�Op:�f6��)o�&'��^�P��8�ME�ૅ�m��bIV@yW�>�d:��ա��7({|,��i�9/cq�02�W��n��]&i��m5�*�U7M��H�c�Lǵ&��,x�d��[��h��^WȳsH�z��$xS��f��r��D�N�*+c�Gk�풁D�«��as~��F�Y�Z(�5e�!�wǔp��S��~�$�~�Xp��hl��L-��o��Ү*�.gM��L�:,��i4S�tD�S��sIxd�g�5�- �6mG$��3�௤˽��a�g�`��|�{�i��z�&��KC�tF.O��?�J�i�\�qKbHeV��U�9�}��L��dڴ�{�&��p��r��Vx�͹�BΓlk��4M�9(��k��(��'��ΎD�N�;T�oo�X0��o��~}sj��M��WI� ��7��a�y*�"�NGِ��f��^C�ԚM)��.MÖi [��{+T�e䌢�)C9)�m��Z3��e��=b!�/�S�{��e�O)��UN�Vv�}��nvw�a9(�"r��9�u�X��g�g1Ba�G>��$xw�J�?��'.�g!�Pe�"��QʲẑN+ź��E�(�{f�{,�(�\��!҈j��-��Y��D3�y�dF!��T�܎�P�t�bf{fI��[oŧ�1��0�h�O[�?��@��K1��ʫ�{�=��q��t/7�\��Q+�F�Mw<��S��f�Eµ*��PC�Bfj�c�3�,iА��A;zв"��ri8�d�ِm"#��M�|�ؤ�V��G��n!��!��D�r=��A��1�0��q�cZ�b�T��"rޒ�A4�ޥ��p 1�g��/7�b,*9�~��߼��w?�y��ܞ�\�9#�s��ͻ�d��F�E�ϡH��6��#��\�vy�ܜ��؆�Dg��եww��}��~��|��9E�?Ō/�˶Y��uO��i��q�̢G��X��="��g�{-��I��T |�flh�#��XӇ�e(��pU�Ύ�� =Ҋ�Qڵ�!C��3��(�;T��y��=ǉ�@CQ�t�YT��^[�L�Y�7R��2��I�eb��<�u6��h(J��K�k�V��i�\ya�d��X��oĴŦAD�Z�Vѣp<^��P�{��bp)M�Y��n�F�ܵ��p�}��=;CJл��.��۳�C�\\ޝ�\"��z�O[위�A4J��f~9�}�۽w��1b:�=Cw��؉{}O�Fȕ��еyEYG�|��e��n�~B�ϳS��ʻ�>;��0`��J8]��nxQfqUZ��$��{��ʻ�|wqy�}ӧ"��;��'�4��Q��ԣ��)��+V�WIx�ˌ 9_y��EUD��#��ET��T��E��6�PW��j�9��Ȓ��lG�҆��cjŠ��jjݔ�j��]s��U��?1I�5fS�v��56]��$)d��?&�k�!��tJ1X��I�M_u�C}�H��Vy�HbC�B�ף9/� dR��h>�OCE�9��|��7�֣��s>X��i��U/�j��>V��j��'[��WV�_�d�[%�#�À�J��|p��f��7a�9TU��7��`��1\<��"=�nS��-'W��o� � t� 9�N��$6kd�wp�N�h^��/%/yp��ȑ��Qs ��B��Rb��I��MwD��7��H��{��)k\!No@�h�ܰUĳ��d!��M:gP�N�C5��u�� H��<Ēĵ&dܢ��{�aܶH8�� q4��%t�z��l��tz��e;�a�"�AvL�q��Oa��$�p1`�S�Zp��)�݇�~��6��Sb�"�VXm��71��M�C�r61YӘ�d�Ҙ�-d1oX��AҖ�8�vo$�df��R��f32"ٷ:�;�͉�X�!Gg�N�B-�x�%��.m�G��HҔ�uݜ�!��LsBֽ�|.�6�{UǆI�`��)\��^��j��ĞҴ}$�O�(�3��0D��L��g��J�`�˂_&��j��,Sa��T��Wٴ�ӱE')煌�O�'O�u�\Qukۡ��&#�n�۔�e�p��j��n�qx��)��k�!��R��I0=�r� �V�E�<��z�(�L��m��ĝM-D�S�C�Q;j$��`>��0ˡ�뫫JO��L�@e��A��(�!�"�JL��8��w�j,G�Q~��0F�Y�v�'��h��f��o��p��N1��{��|�2�G\Oq��e�"�T��^�(��|� �6��v��^�kZ#��2˓�f�*E�2I�uÜd/��tX�?=�?|��L��"��_�%��'��;�(�DF�R��(��/)A�_J��SbQ�J�;f�1c��l��:m��k�엓3_�u��<�<�8J��A�T�6��!#��2�=��Y�q%��l��?�-�$�<�0C)�r�GX(�"�ytW0��Cz MF�1��d��R��_��ub�a\^�Ǔ��V��}4q��a;�� #�#�N{�mG�?8dF$��٭��EW1��}��=��~�L��%�"�l�*>yFL��X�4�L�X�h~�v�d�Y�M��'$ Y*�ۻJl�;�2ʟ��:��Ko��9+�w�8v�E��v�E�y�{�\mpU�YH��B�Awu�9��I�~d�[��kd�&!3�'V��x��BM��`s�4V!��_��p�W.}I�@�?��:�)EyTvouk�u�wER�"��;i��H�Z��.�Z�!��$�R� y�f��F��E�7H$>��!fV/�%��:*�~qX��B��P^��9��$�`ƶmL��Ĳg.B��Ct8�!s�BMK�x�\i�Ņ�t�1z��!]��"�5Ym�N�'F2��v�ే��ߗ� �2��W/�ҪD^��` �zB�`�FA�q��9�d�D�a�*��p��t��w.H�V��*�D��S��=��$��Ȓ�ӤG�܂6m-�^��j`?X��Ǯ#{Q' B*�n�cd��RW��Ţ;4zU��eA��7��v3$�8�:!e:�M�P��jm��W��/�}m��nW��)vX�~w]^@u��dPOBA��GS/�a��J�*n�g��)��|bh�d��6��$6�!��=u��IY��b^��|�z�w��PO��-�#TQ��A�zk��,�ewY��oC9�^�%�Մ�I�E��z)��ߗ��B�X�Jt��3b_7�T�a�{�c��%�t%u��Sm��J!��!ҬT��Aꀶ�5�kV�j )��1L.\c*��:�F��B��If^�1�W��/Ŋ��P`��f�2Ţ��\�}^�'9�G�U�J�=fs�x4�Ǚ��e׸��VE��e@C�#;>�}�"!��9�֐�x,�k�f�t��.%��;vYB��'�J��A+8u\$�x��a�ޣ:|WXk��|�*$��0Pg�:*�_a:c��q�t��0t�AQ��b��kȑ�Z�a�c�H=q4@nTS$O/�Ri��O�V�_9_" "nyu��l�@b��G��!�}�ڣ��a��c�k��J�A� nd�sH��'�T��mt'�bJ�e^l*�@:�rbI�L��(�vI?\o_��C]��H-b��>��W"L)bi�%��d�T��m��>�A+��]XI��ơj�r��Hu��ȩ��±�l��=�ȃ�PJ�6��ʒ8�2�C��P�@b>�1�E�k�jzO�j��bGw��V?��s�&�qP垥�p�VO�ܤ�+�lj�)|�:{�k��5SC��L��^��1�֗�4�r'C:��V��3>��#�{��:X3��K Uk{A��)h)�#��n徰�Q��4#,�12j\j�lT�c۪��p��K�b¶�nH��{ �bmJZ�0��:�ѩ�I��U�,W�cc��W��@�w9Yߪ]T��^f�D��5S�*�t�G��K�vxQt��>�w��E[�Q;z��&��CW=��,.{r}�G˹ӣ��_�^g��i�C.�n��z��%�g.�(�4��)�4�2��>�z�zaG�P+��6[��F�QV�4�M��h�-�`��훿�� +~"�SBd*�#��&io�a��5�]�M\h��l��_4I�ꧨأ�=ڢ�vI��9a��YI[ ��'>>$�!1`V��$P�s�^/��|�Y 5+�l5:�/�e��!'��L"�[TT�{�:H"�&�L �p��D�T�D�m&�/��g�;B<��i��Fx�F�,�ሏ݉o�;��|�ۤ��1�2�?b", "1909)�@y/�I�2�Jb��E1��9��5/N�Oe�C��չ��pG�.�ze7�˖`��Ep]/�0,��5'T��JTܞ��u�G��)�qL�Sm水�T��bMu�� +�E_)v�$�SLTq��`��5R�ް%V��Z�z�өF�ξb-;3�ɚ؂��~��H*��<�;�$IP[䒴��"l��),�rq��Uh��C�"�Ő��/�إhl$��kHs��Y�b�@�)�b�B�y��׸;�Mv��d �V�{�+�:5��f��>�XR�oĩ��1'��@�v%��FP��x 0�b��B��yS��vєVH<�DNKT�i��Y�UD>Hf��W��+ci��"�b{�E��)}ʱS�9�y �SD�s�)�E��z�sȹ�9lޢH�ȅk��b"��b�@��Y�s��^�� x��e��4��]qړ�:TRbX%(RĂ�gz�-��5�o�UTҾ��*�I�Y�1�cJr��Clb��A["$�H�h�e��,L2��T��N�r6$��L�ޜo��=BDO'�xH�c��0Ob��.kNWԩ��k�r��"�A�vb7�v��3�-�4|��l�B�LY��D��6SM��ʒ��.��-D��Ƒ"E�@8�f��q�eiR��Z��-#xp�^��ے��j��mA|��4e ��M!��8��(Qi�-_��KAI��V��X��u�h��2�E��w�ZMQ��9��rL�;yp��iT��r�o�}�`��@"��Y1��Ui�_g��ZBv�JkEaV��y�'�b��8�D�H� ��#�S[;kX�d+��]o�F�S2�A�Lp�.�ҏT��4�tI�2��n��`34J�U̮�(�$��v��-ͯT�rJ��n�+��B<0��>`\#�=�0o��8)��hi5N�Z�")�h"�d��p��׍�a>�cQA�L�r��Q�L^k`J;�b��!�H��26?��1�Q^9�T�@��w惲S��6��1T�}��.&�(\Td��W�o�|ǚuހ]��U�v;��ӗ$��R�K��,��\��(P��\T*nW��x$�\Bn-¸/*�7'l_V�u��9�$��-��ϻV?4�U��>C�#4B%e�", "_uш��KOAd��C�/��֯�:�T�C�ʦ�B��?v��nJ�;��zUee��0�"qRUQ��}ֻծ��}�'��wA�>�m:�=ǎ�0��˶6��xU>|*�ˇ�40�"�)��D�;�K ��!��M��n@�ʒ�[�2!/�J��>m+��c��g�*�g�t�ەzf�I�u��n�(�g>��ƻ��L�<9�<�Ib�c�q�W��6,ܵ#��M:��I�3܍��,-)zжb�W�u�}bn��1*��x�t��Nܝ�hگ!��PE"��Ƕ�L�>PC�LdW�;dQ��TF9��#Τ�s�9j��A#��,r��I�\�E�|t;4)��E��Iûd�w�T��B��%u��O�f�6C��ɠL"䜜[wŉ��c�4\�f�{��u ��d�=))iuGT��,�[��®�M+t�a��c��8ŵQQ��5w�l�AZ^�mi��Ώ8I$��J.wK��oMi��z3,��:L>'��Z�p5ޟ��~}h�=Q�U�ГI<�{$�$N�ä�µ��Gz�ֻ��ݗ��2��w�a7�<�+C3�d,�Me�԰?��&��@��amժ�ǀ1�b񪃽�UL>8��qi��ߢ��ʎh�7�\Ù��6�4m�Ͷ�!�:qO��^b�IRC�H�k��8g�9 ċL]�=:-�4��ү�WQ��-��1�ʹ\"T��%3d�ђ��ՋћEc��ӮX��T�2j�bWA;��y��.�!�׸��4�\��v�ʸE��]j��<�d:�p�� x}E�x��V�*6��K�]E��I�uK��1��6�i��hG�٬�BއlK�m��f�djBS��J��:��:|�3D�]��3T�2��H1\b�R807��m��~��+�.��t�l�`�R�mz�f��@rGL�JO7zK��h�c"6XuB��u�m41��ܶ�N�97i�_G��`�|��M�U?6ֹA��LyU�X<3 j�B��#D �QSz�t��0��V}Ƥ�!t�:��x��*��ƥ��h^F�i�1��׃��/)��b�R�!B�@�-�[�|��guv:�=?�U*0�[��@״0��խI��4�o�t��(�N�:A��I��a+CgSt��tgj��).�OUP��Z"��߿��c�j��$��A�؍��=��´��k�p1ɾ[��U�`��g�6D��k�Ȗ�|�*�Bӵ��Q i��0��3['^�s��%�/t��?P��H�D�k��v��a��y�� y�I#��!��x�7C��ԍ��w{�jԟ��ȸ��*NB��'�?;r�3W�?jg��;�i��:��:��7�a��Mg��p��ggX�ӐEɲ��V�^��e��"��$'t6Z�n�i7{��-��Yn�G�;k��$��d�+�4K!�t&;��p��TF8p��)@N�j�i��a��Oo��˻��3��%�-&�,��1�dy|%#�M�.6Q;2��z<�3D�w&�6:3��[=k�YV�9B�Kڰf/o��}ϳ%?m�x�P��s"oƒH��_O��Z��2��}O��:t;�j�q/To�j��(��'�0;��8i�Q=2�(�M{J�Z�X�tkl̀�?�?��'�-�)o���K��W��fe��^DG��R �k�_s�tZa��ABcɔt�d(y�Ѱ��0�U?V�%��]��|�a�B�M�_��T��=�UU�-߂0o}Nr%dB:�Q�!�|��S/Pq�D-��z�~V��Y��J�Pe�z�E��)��5ot(?(μ��2��US��&��b�e��Oז%tFr�ߴ�o��aiu��*�LB0:[k��8#;��8G>�~a\��C�h��B�@��(�`�V��L�2Li'��ca��3�B��g�S"��$|�!�*��uG� A�:؞�PU{M��%��쑗", ")@=�$V�9�^G� [��ǟ��Sת�Q�b��Y�7�!�5',��n;cK^��ڶK7?��-�u��wa��$��Z��T�NK\�Y�)K]֭R/M��d1��,H�5�d!�u�>�x1� ��"G^hE�+��8n}#LOv��˯�F�~u��xg�wo�nO�}o~��dz��..W��7��_��oᇩ��M��"�z2^ݭ��Yy��?~8?˭3ǶN�/&��}��~�3��7��7iݟ$'�˸�J�w4�ޠO�LN�m�3{�� ~./V��Y6��)�盓�et�0�t��:{��N~��G��_��*��}aٗ�/_�Ǘ��ߟ��j��8�w~�~��0��'_��|}}�N~�g�*P��q��U��裼u�3-��j?��V��[�Cǰ�?�.�!��v��7�e��yʖ�&I�ݍ�(��=$Iq��~V�V$C$co[�v#&*5�7U6�O�ǿk$һ8Վ4�^PO,�6��LƓ��L˵�1��k_bMgxcܩԭj�x��_��p��30)��$��d�+��ER��p�N��X��:�\�H�T�bi�9v.��`e�:%2��#�QU��-)�ǘ�'%�V�N�~��t�;�,��5�ŏg�!�F`��-Ժ�-�o3�o��K[��*�/,H��ۋ��%>��-ēL�OERjP��t�O��M|۲��OˤG3�6��lj�ә3��i��r�f!��HeZ.�Rt�N��0!��F �Ў��"|>`j�<��ɸ�i9�", "c�m�'c�f��vLwj�m�pƝ��a��}#�Y�۳��Ę#��tk:��㱁�i�� ~�ˆ�;��8o��H��%�h�յ�E��!!�;�$��%�1[�;y��u$��V��_��[9��o��s5tv��$�[_��KI��5a�R�]�5Ɩ�Rt�4�)i�&,D�ⶹK�K�T�2ayq��1�A+�&��7IBQ��2�Ř��:��G�9I�UߋiQ�$��z/т}��%)�<��>�yv?�Y�Ԃ��;�8O8S�K��E!>�|�޸xv��ko�י��*hy��Ы��4[-]��@��c�4L�4\�4f�eX�e�e��Ϧ�T�n뎎�cݜꦫ[�>�MK��[ݚꖣ[3�5t��S7-[7Gwƺk��LwǺk��D7g�c閭��'�鸺��cCw��L��Ǻi��k�m�cW7��nNt��-��ǖn�MW��d��Om}��ӱ>��D7M[��g��m�S��'�n�d�O��n��4�Og�=�mW�mݶt��nO��D�Lt{�Ol�``�s��{�k��Fw��+��dE��jEȳ��!Ӑ��?��J��B��7O�#��_׺��D8cG��?��/+?&��~��_~��f��_�~��y�~�4~�w#?�!x��7s��4��r�(��x��Y�W��3?={~��7��<Ӿ.��Oc��u��5)+��d��w��+��U��iS[_��k{��]��", "fbc�=ْ⺒��2g��.ޗyc�b�)�y��^sb�}B.��ݧ��9w�}q�)Y�J�rS��i{��C��p�$}��u�3I� Biw��(��j�8��z��?^z��ġ��s�^�0��(�"�纴.�c8�v��m�j�C^��F8ץ3g��.Eʺd�K��&o�u�;��'�8�~pC�3�PY1��jt�m��0�R�\��u��%�B��d��!ԯ]j)��PM�2��&�t�yy��"�n�i��8�vm�C-��6z�%y�-��'S˲^��q�fX��Y}Q0��s2�S��i��8�&b�JZf�Ů�K3�!-�U�0�R�P+C7�A�JN�P��DW��\Â��M��?>��%�$�`$�PQ5�=��cP}�A=��V�7�˷IzIB�/�ߴ�1X��+"�qb9'��M�RL��n��.=��Z��d:��h��7�H��i򀅀� �/�3N�gp2-��~�?:t��qе�@gq�uAm��X�0��ӫV9[��8˽�Wm�a�{�v�.��C�Y;�:�X��z��@.S}$M#�[��/��0MO� `/;h{��| �)�E!xAZM"�8�ڇ(�^��TF�F"�M�p~�8�RY�z��?�ũ `�Z��l��v�`��)#�hL��Ԫ9A�� ˢ^oVW� eā�8�f��SQ�U�>��l��Ǌ��$�s�x2`��ܪ8�m��ݷ�]v#V@�߸H�c�9��Aӯo�wޯM�4� �U�o�k��s��.�.si��4��ډ՝�^��s$��_{�U��K�X8�^b��b��f{�X�!��X��Q��Z�� -�]��!0�h�757_)�8u��4�ӻɷZ0��@2��m��r�0�R�G�dݵ�jyU#��FU�q�^�iV�H�=�6��9�+�r��5&T�}��cp9 �3Y�}��e&��ˌ��^a�b�6q��~K��0�� J�d�i��UUz�UH/�7��Z�vqIgj+dP6�9.�Qo�=1�G3��l~܎��3b��F��rV�|$�� Microsoft Corporation\"\n \"Bw1Vp89.exe\" was detected as \"Microsoft Visual C++ 8\"\n \"2Ix4962.exe\" was detected as \"VC8 -> Microsoft Corporation\"\n \"3TI36uw.exe\" was detected as \"VC8 -> Microsoft Corporation\"\n \"5jR9Wp3.exe\" was detected as \"PureBasic 4.x -> Neil Hodgson\"\n \"1Qj66VM8.exe\" was detected as \"Microsoft Visual C# v7.0 / Basic .NET\"\n \"DISMHOST.EXE.6A8C05FD.bin\" was detected as \"Visual C++ 2005 Release -> Microsoft\"","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":10,"id":"static-18","sources":[{"report_type":"sandbox","report_id":"6a8bc714f9ffa2deee0d28a4"}]},{"level":"informative","category":"Unusual Characteristics","name":"Possibly uses a Windows Server utility","description":"\"register-cimprovider.exe\" (Indicator: \"register-cimprovider.exe\")","origin":"File/Memory","relevance":10,"id":"string-65","sources":[{"report_type":"sandbox","report_id":"6a8bc714f9ffa2deee0d28a4"}]},{"level":"informative","category":"Unusual Characteristics","name":"Reads the windows installation language","description":"\"1Qj66VM8.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE GROUPS\"; Key: \"1\")\n \"cmd.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE GROUPS\"; Key: \"1\")","origin":"Registry Access","mitre_attack_id":"T1614.001","relevance":2,"id":"registry-26","sources":[{"report_type":"sandbox","report_id":"6a8bc714f9ffa2deee0d28a4"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Section contains high entropy","description":"\"4c75a2e2511e44061424cc86123e1ea5dc4f7c8aadebc5c3bdebbe746175b2c6\" has section name .rsrc with entropy \"7.946310126111565\"\n \"ei4JY63.exe\" has section name .rsrc with entropy \"7.929704255874431\"\n \"BC6EJ61.exe\" has section name .rsrc with entropy \"7.865654608454986\"\n \"Bw1Vp89.exe\" has section name .rsrc with entropy \"7.696681960756718\"\n \"3TI36uw.exe\" has section name .data with entropy \"7.60688695265006\"\n \"5jR9Wp3.exe\" has section name .rdata with entropy \"7.111835561466389\"","origin":"Static Parser","mitre_attack_id":"T1027.009","relevance":1,"id":"static-6","sources":[{"report_type":"sandbox","report_id":"6a8bc714f9ffa2deee0d28a4"}]},{"level":"suspicious","category":"External Systems","name":"Detected Suricata Alert","description":"Detected alert \"ET INFO TLS Handshake Failure\" (SID: 2029340, Rev: 2, Severity: 2) categorized as \"Potentially Bad Traffic\"","origin":"Suricata Alerts","relevance":10,"id":"suricata-1","sources":[{"report_type":"sandbox","report_id":"6a8bc714f9ffa2deee0d28a4"}]},{"level":"suspicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"11/24 Antivirus vendors marked sample as malicious (45% detection rate)","origin":"External System","id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"6a8bc714f9ffa2deee0d28a4"}]},{"level":"suspicious","category":"General","name":"Contains ability to find and load resources of a specific module","description":"FindResourceA@KERNEL32.DLL at 00000000-00005724-53966-35-012F468F\n FindResourceA@KERNEL32.DLL at 00000000-00005724-53966-51-012F4FE0\n LoadResource@KERNEL32.DLL at 00000000-00005724-53966-57-012F6298\n FindResourceA@KERNEL32.DLL at 00000000-00005724-53966-58-012F6517\n FindResourceA@KERNEL32.DLL at 00000000-00005724-53966-71-012F2CAA\n FindResourceW@KERNEL32.DLL at 00000000-00002464-58652-188-00402C55\n FindResourceW@KERNEL32.DLL at 00000000-00002464-58652-189-004026C7\n LoadResource@KERNEL32.DLL at 00000000-00002464-58652-203-00402664\n FindResourceW@KERNEL32.DLL at 00000000-00002464-58652-242-00403E37\n FindResourceW@KERNEL32.DLL at 00000000-00002464-58652-256-00402E49","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1005","relevance":1,"id":"stream-32","sources":[{"report_type":"sandbox","report_id":"6a8bc714f9ffa2deee0d28a4"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Drops executable files","description":"$5b","origin":"Binary File","mitre_attack_id":"T1105","relevance":5,"id":"binary-1","sources":[{"report_type":"sandbox","report_id":"6a8bc714f9ffa2deee0d28a4"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Modifies auto-execute functionality by setting/creating a value in the registry","description":"$5c","origin":"Registry Access","mitre_attack_id":"T1547.001","relevance":8,"id":"registry-0","sources":[{"report_type":"sandbox","report_id":"6a8bc714f9ffa2deee0d28a4"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Writes a PE file header to disc","description":"$5d","origin":"API Call","mitre_attack_id":"T1105","relevance":5,"id":"api-43","sources":[{"report_type":"sandbox","report_id":"6a8bc714f9ffa2deee0d28a4"}]},{"level":"suspicious","category":"Network Related","name":"Sends traffic on typical HTTP outbound port, but without HTTP header","description":"TCP traffic to 57.144.202.1 on port 443 is sent without HTTP header\n TCP traffic to 172.253.135.84 on port 443 is sent without HTTP header\n TCP traffic to 173.194.208.94 on port 80 is sent without HTTP header\n TCP traffic to 163.181.60.206 on port 80 is sent without HTTP header\n TCP traffic to 142.251.186.94 on port 443 is sent without HTTP header\n TCP traffic to 192.178.220.138 on port 443 is sent without HTTP header\n TCP traffic to 142.251.153.119 on port 443 is sent without HTTP header\n TCP traffic to 57.145.2.128 on port 443 is sent without HTTP header\n TCP traffic to 150.171.109.65 on port 443 is sent without HTTP header","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":5,"id":"network-23","sources":[{"report_type":"sandbox","report_id":"6a8bc714f9ffa2deee0d28a4"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the command-line string for the current process","description":"GetCommandLineA@KERNEL32.DLL at 00000000-00006044-55011-2437-00EFC0DA\n GetCommandLineA@KERNEL32.DLL at 00000000-00004188-56710-1473-00E6C0DA\n GetCommandLineA@KERNEL32.DLL at 00000000-00004180-57549-2008-00A2C0DA\n GetCommandLineW@KERNEL32.DLL at 00000000-00002464-58652-152-0040973A\n GetCommandLineW@KERNEL32.DLL at 00000000-00002464-58652-237-0040249D","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1106","relevance":3,"id":"stream-118","sources":[{"report_type":"sandbox","report_id":"6a8bc714f9ffa2deee0d28a4"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the fully qualified path of module","description":"GetModuleFileNameA@KERNEL32.DLL at 00000000-00005724-53966-42-012F202A\n GetModuleFileNameA@KERNEL32.DLL at 00000000-00005724-53966-44-012F2AAC\n GetModuleFileNameA@KERNEL32.DLL at 00000000-00005724-53966-78-012F5C9E\n GetModuleFileNameW@KERNEL32.DLL at 00000000-00006044-55011-1883-00EFF7AB\n GetModuleFileNameW@KERNEL32.DLL at 00000000-00004188-56710-1029-00E6F7AB\n GetModuleFileNameW@KERNEL32.DLL at 00000000-00004180-57549-1564-00A2F7AB\n GetModuleFileNameW@KERNEL32.DLL at 00000000-00002464-58652-238-00409698","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1106","relevance":5,"id":"stream-131","sources":[{"report_type":"sandbox","report_id":"6a8bc714f9ffa2deee0d28a4"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Tries to access/write temporary files","description":"Process \"%WINDIR%\\system32\\cmd.exe\" with commandline \"\"%WINDIR%\\\\system32\\\\cmd\" /c \"%TEMP%\\\\E6B6.tmp\\\\E7D0.tmp\\\\E7D1.bat %TEMP%\\\\IXP000.TMP\\\\5jR9Wp3.exe\"\" (UID: 00000000-00004048)","origin":"Monitored Target","mitre_attack_id":"T1074.001","relevance":5,"id":"target-423","sources":[{"report_type":"sandbox","report_id":"6a8bc714f9ffa2deee0d28a4"}]},{"level":"suspicious","category":"System Destruction","name":"Marks file for deletion","description":"$5e","origin":"API Call","mitre_attack_id":"T1070.004","relevance":10,"id":"api-26","sources":[{"report_type":"sandbox","report_id":"6a8bc714f9ffa2deee0d28a4"}]},{"level":"suspicious","category":"System Destruction","name":"Opens file with deletion access rights","description":"$5f","origin":"API Call","mitre_attack_id":"T1070.004","relevance":7,"id":"api-25","sources":[{"report_type":"sandbox","report_id":"6a8bc714f9ffa2deee0d28a4"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"CRC value set in PE header does not match actual value","description":"\"ei4JY63.exe\" claimed CRC 920835 while the actual is CRC 813446\n \"BC6EJ61.exe\" claimed CRC 813446 while the actual is CRC 540237\n \"4hj421HX.exe\" claimed CRC 540237 while the actual is CRC 431844\n \"2Ix4962.exe\" claimed CRC 316493 while the actual is CRC 331996","origin":"Static Parser","mitre_attack_id":"T1027","relevance":10,"id":"static-0","sources":[{"report_type":"sandbox","report_id":"6a8bc714f9ffa2deee0d28a4"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Imports suspicious APIs","description":"$60","origin":"Static Parser","mitre_attack_id":"T1106","relevance":1,"id":"static-1","sources":[{"report_type":"sandbox","report_id":"6a8bc714f9ffa2deee0d28a4"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Timestamp in PE header is very old or in the future","description":"\"1Qj66VM8.exe\" claims program is from Fri Dec 15 06:19:45 2090","origin":"Static Parser","mitre_attack_id":"T1027","relevance":10,"id":"static-3","sources":[{"report_type":"sandbox","report_id":"6a8bc714f9ffa2deee0d28a4"}]},{"level":"malicious","category":"Exploit/Shellcode","name":"Writes shellcode to a remote process","description":"$61","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1055","relevance":8,"id":"stream-38","sources":[{"report_type":"sandbox","report_id":"6a8bc714f9ffa2deee0d28a4"}]},{"level":"malicious","category":"External Systems","name":"Sample detected by CrowdStrike Static Analysis and ML with relatively high confidence","description":"CrowdStrike Static Analysis and ML (QuickScan) yielded detection: win/malicious_confidence_100% (W)","origin":"External System","relevance":10,"id":"avtest-8","sources":[{"report_type":"sandbox","report_id":"6a8bc714f9ffa2deee0d28a4"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a large number of Antivirus engines","description":"11/24 Antivirus vendors marked sample as malicious (45% detection rate)","origin":"External System","relevance":10,"id":"avtest-3","sources":[{"report_type":"sandbox","report_id":"6a8bc714f9ffa2deee0d28a4"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a trusted antivirus engine","description":"Trusted antivirus vendors count marked sample as malicious (count = 2)","origin":"External System","mitre_attack_id":"T1204.002","relevance":10,"id":"avtest-5","sources":[{"report_type":"sandbox","report_id":"6a8bc714f9ffa2deee0d28a4"}]},{"level":"malicious","category":"General","name":"The analysis extracted a file that was identified as malicious","description":"17/24 Antivirus vendors marked dropped file \"4hj421HX.exe\" as malicious (classified as \"Trojan.Kryptik\" with 70% detection rate)\n 17/24 Antivirus vendors marked dropped file \"2Ix4962.exe\" as malicious (classified as \"Trojan.Kryptik\" with 70% detection rate)\n 18/26 Antivirus vendors marked dropped file \"1Qj66VM8.exe\" as malicious (classified as \"Trojan.MSIL\" with 69% detection rate)","origin":"Binary File","mitre_attack_id":"T1204.002","relevance":10,"id":"binary-11","sources":[{"report_type":"sandbox","report_id":"6a8bc714f9ffa2deee0d28a4"}]},{"level":"malicious","category":"General","name":"The analysis spawned a process that was identified as malicious","description":"18/26 Antivirus vendors marked spawned process \"1Qj66VM8.exe\" (PID: 5740) as malicious (classified as \"Trojan.MSIL\" with 69% detection rate)\n 17/24 Antivirus vendors marked spawned process \"2Ix4962.exe\" (PID: 6044) as malicious (classified as \"Trojan.Kryptik\" with 70% detection rate)\n 17/24 Antivirus vendors marked spawned process \"4hj421HX.exe\" (PID: 4180) as malicious (classified as \"Trojan.Kryptik\" with 70% detection rate)","origin":"Monitored Target","mitre_attack_id":"T1204.002","relevance":10,"id":"target-58","sources":[{"report_type":"sandbox","report_id":"6a8bc714f9ffa2deee0d28a4"}]},{"level":"malicious","category":"Network Related","name":"Uses network protocols on unusual ports","description":"TCP traffic to 77.91.124.55 on port 19071","origin":"Network Traffic","mitre_attack_id":"T1571","relevance":7,"id":"network-7","sources":[{"report_type":"sandbox","report_id":"6a8bc714f9ffa2deee0d28a4"}]},{"level":"malicious","category":"Pattern Matching","name":"YARA signature match","description":"YARA signature \"MALWARE_Win_MetaStealer\" matched process \"00000000-00004180\" as \"Detects MetaStealer infostealer\"","origin":"YARA Signature","relevance":9,"id":"yara-0","sources":[{"report_type":"sandbox","report_id":"6a8bc714f9ffa2deee0d28a4"}]},{"level":"malicious","category":"Ransomware/Banking","name":"Tries to disable Windows defender Anti Spyware","description":"\"1Qj66VM8.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS DEFENDER\"; Key: \"DISABLEANTISPYWARE\"; Value: \"0100000000\")","origin":"Registry Access","mitre_attack_id":"T1562.001","relevance":7,"id":"registry-76","sources":[{"report_type":"sandbox","report_id":"6a8bc714f9ffa2deee0d28a4"}]},{"level":"malicious","category":"Ransomware/Banking","name":"Tries to disable Windows defender via registry","description":"\"1Qj66VM8.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS DEFENDER\\REAL-TIME PROTECTION\"; Key: \"DISABLEBEHAVIORMONITORING\"; Value: \"0100000000\")\n \"1Qj66VM8.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS DEFENDER\\REAL-TIME PROTECTION\"; Key: \"DISABLEIOAVPROTECTION\"; Value: \"0100000000\")\n \"1Qj66VM8.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS DEFENDER\\REAL-TIME PROTECTION\"; Key: \"DISABLEONACCESSPROTECTION\"; Value: \"0100000000\")\n \"1Qj66VM8.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS DEFENDER\\REAL-TIME PROTECTION\"; Key: \"DISABLEREALTIMEMONITORING\"; Value: \"0100000000\")\n \"1Qj66VM8.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS DEFENDER\\REAL-TIME PROTECTION\"; Key: \"DISABLESCANONREALTIMEENABLE\"; Value: \"0100000000\")","origin":"Registry Access","mitre_attack_id":"T1562.001","relevance":7,"id":"registry-77","sources":[{"report_type":"sandbox","report_id":"6a8bc714f9ffa2deee0d28a4"}]},{"level":"malicious","category":"System Security","name":"Modifies Windows Auto-Updates feature","description":"\"1Qj66VM8.exe\" (Access type: \"SETVAL\"; Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\WINDOWSUPDATE\\AU\"; Key: \"NOAUTOUPDATE\"; Value: \"0100000000\")","origin":"Registry Access","mitre_attack_id":"T1112","relevance":9,"id":"registry-24","sources":[{"report_type":"sandbox","report_id":"6a8bc714f9ffa2deee0d28a4"}]},{"level":"malicious","category":"System Security","name":"Modifies windows defender settings","description":"\"1Qj66VM8.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS DEFENDER\\FEATURES\"; Key: \"TAMPERPROTECTION\"; Value: \"0000000000\")","origin":"Registry Access","mitre_attack_id":"T1562.001","relevance":8,"id":"registry-101","sources":[{"report_type":"sandbox","report_id":"6a8bc714f9ffa2deee0d28a4"}]},{"level":"malicious","category":"Unusual Characteristics","name":"Spawns many processes","description":"Spawned process \"4c75a2e2511e44061424cc86123e1ea5dc4f7c8aadebc5c3bdebbe746175b2c6.exe\" (UID: 00000000-00005732)\n Spawned process \"ei4JY63.exe\" (UID: 00000000-00005348)\n Spawned process \"BC6EJ61.exe\" (UID: 00000000-00005720)\n Spawned process \"Bw1Vp89.exe\" (UID: 00000000-00005724)\n Spawned process \"1Qj66VM8.exe\" (UID: 00000000-00005740)\n Spawned process \"2Ix4962.exe\" (UID: 00000000-00006044)\n Spawned process \"AppLaunch.exe\" (UID: 00000000-00005776)\n Spawned process \"3TI36uw.exe\" (UID: 00000000-00004188)\n Spawned process \"AppLaunch.exe\" (UID: 00000000-00002296)\n Spawned process \"4hj421HX.exe\" (UID: 00000000-00004180)\n Spawned process \"AppLaunch.exe\" (UID: 00000000-00004136)\n Spawned process \"5jR9Wp3.exe\" (UID: 00000000-00002464)\n Spawned process \"cmd.exe\" with commandline \"\"%WINDIR%\\\\system32\\\\cmd\" /c \"%TEMP%\\\\E6B6.tmp\\\\E7D0.tmp\\\\E7D1.bat %TEMP%\\\\IXP000.TMP\\\\5jR9Wp3.exe\"\" (UID: 00000000-00004048)","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":8,"id":"target-14","sources":[{"report_type":"sandbox","report_id":"6a8bc714f9ffa2deee0d28a4"}]}],"incidents":[{"name":"Spyware","details_count":1,"details":[{"detail":"Found a string that may be used as part of an injection method"}],"sources":[{"report_type":"sandbox","report_id":"6a8bc714f9ffa2deee0d28a4"}]},{"name":"Persistence","details_count":2,"details":[{"detail":"Modifies auto-execute functionality by setting/creating a value in the registry"},{"detail":"Spawns many processes"}],"sources":[{"report_type":"sandbox","report_id":"6a8bc714f9ffa2deee0d28a4"}]},{"name":"Fingerprint","details_count":1,"details":[{"detail":"Queries kernel debugger information"}],"sources":[{"report_type":"sandbox","report_id":"6a8bc714f9ffa2deee0d28a4"}]},{"name":"Evasive","details_count":6,"details":[{"detail":"Marks file for deletion"},{"detail":"Tries to disable Windows defender Anti Spyware"},{"detail":"Tries to disable Windows defender via registry"},{"detail":"Able to check if a debugger is running"},{"detail":"Contains ability to adjust token privileges"},{"detail":"Contains ability to terminate a process"}],"sources":[{"report_type":"sandbox","report_id":"6a8bc714f9ffa2deee0d28a4"}]},{"name":"Network Behavior","details_count":1,"details":[{"detail":"Contacts 8 domains and 8 hosts"}],"sources":[{"report_type":"sandbox","report_id":"6a8bc714f9ffa2deee0d28a4"}]}],"intel_graph":{"map":{"Domain:3e723b591bdb95ce8f5c9b7032dc572ca97351d0da5efc73459c1fbaf438e43b":{"type":"Domain","value":"www.facebook.com","verdict":{"verdict":"clean","verdict_source":"domain reputation data","reasons":["reported clean domain"]}},"Domain:accounts.google.com":{"type":"Domain","value":"accounts.google.com"},"Domain:accounts.youtube.com":{"type":"Domain","value":"accounts.youtube.com"},"Domain:c.pki.goog":{"type":"Domain","value":"c.pki.goog"},"Domain:ocsp.digicert.cn":{"type":"Domain","value":"ocsp.digicert.cn"},"Domain:ssl.gstatic.com":{"type":"Domain","value":"ssl.gstatic.com"},"Domain:static.xx.fbcdn.net":{"type":"Domain","value":"static.xx.fbcdn.net"},"Domain:www.google.com":{"type":"Domain","value":"www.google.com"},"File:0f4d1a073bc226a68cab0d85d13bd40d5b914afb4b22f5b02fbf059cbede1d18":{"type":"File","value":"0f4d1a073bc226a68cab0d85d13bd40d5b914afb4b22f5b02fbf059cbede1d18","filetype":"PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows, 3 sections","filetype_short":"PE32","mime_type":"application/x-dosexec"},"File:2facb8479a21034a3fa4eac1c0b1bb1275bac6936ea22a5908b5e315df48bfca":{"type":"File","value":"2facb8479a21034a3fa4eac1c0b1bb1275bac6936ea22a5908b5e315df48bfca"},"File:347d1ea6fcda8468ea088ab0e6298872e0894e86175f3043c2dd93746c990905":{"type":"File","value":"347d1ea6fcda8468ea088ab0e6298872e0894e86175f3043c2dd93746c990905"},"File:4022f6af97ab4943ce5196d1fc9b30b4a5cc66149021b690265162c3647d5126":{"type":"File","value":"4022f6af97ab4943ce5196d1fc9b30b4a5cc66149021b690265162c3647d5126","filetype":"data (from peinfo)","filetype_short":"DATA","mime_type":"application/x-iso9660-image"},"File:4bf5122f344554c53bde2ebb8cd2b7e3d1600ad631c385a5d7cce23c7785459a":{"type":"File","value":"4bf5122f344554c53bde2ebb8cd2b7e3d1600ad631c385a5d7cce23c7785459a","verdict":{"verdict":"likely_benign","verdict_source":"static analysis","reasons":["Very short text file without any suspicious content"]},"filetype":"very short file (no magic)","mime_type":"text/plain"},"File:4c75a2e2511e44061424cc86123e1ea5dc4f7c8aadebc5c3bdebbe746175b2c6":{"type":"File","value":"4c75a2e2511e44061424cc86123e1ea5dc4f7c8aadebc5c3bdebbe746175b2c6","verdict":{"verdict":"malicious","verdict_source":"indicator database","reasons":["File reported as packed by ClamAV antivirus","confirmed malicious file","confirmed relationship with a Threat RedLineStealer","confirmed relationship with a Threat SmokeLoader"]},"filetype":"PE32 executable (GUI) Intel 80386, for MS Windows, 5 sections","filetype_short":"PE32","mime_type":"application/x-dosexec"},"File:52c4113e7f308faa933ae6e8ff5d1b955ba62d1edac0eb7c972caa26e1ae4e2d":{"type":"File","value":"52c4113e7f308faa933ae6e8ff5d1b955ba62d1edac0eb7c972caa26e1ae4e2d"},"File:5dc7179dd8a43165265c836a5c446b13bafb715e4b42ad76fb8496a30faa5bd0":{"type":"File","value":"5dc7179dd8a43165265c836a5c446b13bafb715e4b42ad76fb8496a30faa5bd0"},"File:6f580a7007e75adbebbfe555f14bb659cc19666f6f4b3a4891700384352a6af7":{"type":"File","value":"6f580a7007e75adbebbfe555f14bb659cc19666f6f4b3a4891700384352a6af7"},"File:7d33210fa57805f799c84d871f7aba24e9ce769dfd14cdf13ca5e9164cccafe6":{"type":"File","value":"7d33210fa57805f799c84d871f7aba24e9ce769dfd14cdf13ca5e9164cccafe6","filetype":"PE32 executable (console) Intel 80386, for MS Windows, 5 sections","filetype_short":"PE32","mime_type":"application/x-dosexec"},"File:871e274a9afc9c4abc2c0ec388d11164835959a932c2e1131e32cbb5f06e6ae7":{"type":"File","value":"871e274a9afc9c4abc2c0ec388d11164835959a932c2e1131e32cbb5f06e6ae7"},"File:a2e272cd87fe16d1f6d7f4f880f1c49535af8b3e08546b594910dc25a418f1a3":{"type":"File","value":"a2e272cd87fe16d1f6d7f4f880f1c49535af8b3e08546b594910dc25a418f1a3"},"File:bc51a7ca6c7de7c274743b0babc5308c6ff75d42b5fa53a6ddfd15e8dd08819d":{"type":"File","value":"bc51a7ca6c7de7c274743b0babc5308c6ff75d42b5fa53a6ddfd15e8dd08819d","filetype":"PE32 executable (console) Intel 80386, for MS Windows, 5 sections","filetype_short":"PE32","mime_type":"application/x-dosexec"},"File:bdfb61d88fec43e8b7a4ba8be780d99818b5e61bd0609206fbfcfc26153fd63c":{"type":"File","value":"bdfb61d88fec43e8b7a4ba8be780d99818b5e61bd0609206fbfcfc26153fd63c"},"File:c021f998077b73bdbf8588ff4135c64c286e9e9827ff9944e24b7f974f45f38d":{"type":"File","value":"c021f998077b73bdbf8588ff4135c64c286e9e9827ff9944e24b7f974f45f38d","filetype":"PE32 executable (GUI) Intel 80386, for MS Windows, 5 sections","filetype_short":"PE32","mime_type":"application/x-dosexec"},"File:c7b6408aea66d8e918c32a3a8b2cad949adde916f575ca17954ad81fea56fd71":{"type":"File","value":"c7b6408aea66d8e918c32a3a8b2cad949adde916f575ca17954ad81fea56fd71"},"File:c9caf41a587249211cd208551f7a20833d62d27c65dd005f7a5a4dc0b6fdf359":{"type":"File","value":"c9caf41a587249211cd208551f7a20833d62d27c65dd005f7a5a4dc0b6fdf359"},"File:cfebc287dd09c37454dc8ef07248ea19bcda285e1d8b56fa6b362079bb707361":{"type":"File","value":"cfebc287dd09c37454dc8ef07248ea19bcda285e1d8b56fa6b362079bb707361","filetype":"PE32 executable (GUI) Intel 80386, for MS Windows, 5 sections","filetype_short":"PE32","mime_type":"application/x-dosexec"},"File:d46448d8335b005d018d5d40d75282f0361727e5ede7878fee181d92734ccc3c":{"type":"File","value":"d46448d8335b005d018d5d40d75282f0361727e5ede7878fee181d92734ccc3c"},"File:d61954427b7918e4540fc315516922d34af9414188edd0a0c808d3191659cf38":{"type":"File","value":"d61954427b7918e4540fc315516922d34af9414188edd0a0c808d3191659cf38","filetype":"PE32 executable (console) Intel 80386, for MS Windows, 5 sections","filetype_short":"PE32","mime_type":"application/x-dosexec"},"File:ecb636b278261eade712e68ec7d805d20e802628248da872d3d0ada1432ffc11":{"type":"File","value":"ecb636b278261eade712e68ec7d805d20e802628248da872d3d0ada1432ffc11"},"File:ed4d01b36d154179c85e5c07aa207d8dae0daef80a28ee9d3c410cdaa507cc2c":{"type":"File","value":"ed4d01b36d154179c85e5c07aa207d8dae0daef80a28ee9d3c410cdaa507cc2c","filetype":"data (from peinfo)","filetype_short":"DATA","mime_type":"application/x-iso9660-image"},"File:f3279f6bc69ed3e8803d117fe1321cb5b3220b33c2cf0b8635f85d721f01fa04":{"type":"File","value":"f3279f6bc69ed3e8803d117fe1321cb5b3220b33c2cf0b8635f85d721f01fa04","filetype":"PE32 executable (GUI) Intel 80386, for MS Windows, 5 sections","filetype_short":"PE32","mime_type":"application/x-dosexec"},"Ip:142.251.153.119":{"type":"Ip","value":"142.251.153.119"},"Ip:142.251.186.94":{"type":"Ip","value":"142.251.186.94"},"Ip:150.171.109.65":{"type":"Ip","value":"150.171.109.65"},"Ip:163.181.60.206":{"type":"Ip","value":"163.181.60.206"},"Ip:172.253.135.84":{"type":"Ip","value":"172.253.135.84"},"Ip:173.194.208.94":{"type":"Ip","value":"173.194.208.94"},"Ip:192.178.220.138":{"type":"Ip","value":"192.178.220.138"},"Ip:57.144.202.1":{"type":"Ip","value":"57.144.202.1"},"Ip:57.145.2.128":{"type":"Ip","value":"57.145.2.128"},"Ip:77.91.124.55":{"type":"Ip","value":"77.91.124.55"},"Threat:98bcaeab215e23f1c1edb4075194c4bb3c746557cad619d1e2ef892ed9de6ee3":{"type":"Threat","value":"RedLineStealer","verdict":{"verdict":"malicious","verdict_source":"indicator database"}},"Threat:ada9ac3ecf1aea7a80d89fa364bc17118165a13672a8093fe8ddd6109d5d9133":{"type":"Threat","value":"SmokeLoader","verdict":{"verdict":"malicious","verdict_source":"indicator database"}},"Url:/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEA59dSNcqDdhV39MzSTNbR0%3D":{"type":"Url","value":"/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEA59dSNcqDdhV39MzSTNbR0%3D"},"Url:/r/gsr1.crl":{"type":"Url","value":"/r/gsr1.crl"},"Url:/r/r1.crl":{"type":"Url","value":"/r/r1.crl"},"Url:/r/r4.crl":{"type":"Url","value":"/r/r4.crl"},"Url:/we2/dTM3-0hpWfE.crl":{"type":"Url","value":"/we2/dTM3-0hpWfE.crl"},"Url:/we2/xuzt3PU9F_w.crl":{"type":"Url","value":"/we2/xuzt3PU9F_w.crl"},"Url:/we2/yK5nPhtHKQs.crl":{"type":"Url","value":"/we2/yK5nPhtHKQs.crl"},"Url:/wr2/oBFYYahzgVI.crl":{"type":"Url","value":"/wr2/oBFYYahzgVI.crl"}},"chains":[{"id":"1543710630663327841","root":"Domain:3e723b591bdb95ce8f5c9b7032dc572ca97351d0da5efc73459c1fbaf438e43b","edges":[],"verdict":{"verdict":"clean","verdict_source":"domain reputation data","reasons":["reported clean domain"]}},{"id":"1543710619000141656","root":"File:4c75a2e2511e44061424cc86123e1ea5dc4f7c8aadebc5c3bdebbe746175b2c6","edges":[],"verdict":{"verdict":"malicious","verdict_source":"indicator database","reasons":["File reported as packed by ClamAV antivirus","confirmed malicious file","confirmed relationship with a Threat RedLineStealer","confirmed relationship with a Threat SmokeLoader"]}},{"id":"1543710629251703306","root":"File:4c75a2e2511e44061424cc86123e1ea5dc4f7c8aadebc5c3bdebbe746175b2c6","edges":[{"edge_kind":"extracted_from_archive","from_key":"File:4c75a2e2511e44061424cc86123e1ea5dc4f7c8aadebc5c3bdebbe746175b2c6","to_key":"File:7d33210fa57805f799c84d871f7aba24e9ce769dfd14cdf13ca5e9164cccafe6"}],"verdict":{"verdict":"likely_benign","verdict_source":"static analysis","reasons":["Very short text file without any suspicious content"]}},{"id":"1543710612533835284","root":"File:4c75a2e2511e44061424cc86123e1ea5dc4f7c8aadebc5c3bdebbe746175b2c6","edges":[{"edge_kind":"in_crowdstrike_knowledge_database","from_key":"File:4c75a2e2511e44061424cc86123e1ea5dc4f7c8aadebc5c3bdebbe746175b2c6","to_key":"Threat:98bcaeab215e23f1c1edb4075194c4bb3c746557cad619d1e2ef892ed9de6ee3"}],"verdict":{"verdict":"malicious","verdict_source":"indicator database"}},{"id":"1543710612538029589","root":"File:4c75a2e2511e44061424cc86123e1ea5dc4f7c8aadebc5c3bdebbe746175b2c6","edges":[{"edge_kind":"in_crowdstrike_knowledge_database","from_key":"File:4c75a2e2511e44061424cc86123e1ea5dc4f7c8aadebc5c3bdebbe746175b2c6","to_key":"Threat:ada9ac3ecf1aea7a80d89fa364bc17118165a13672a8093fe8ddd6109d5d9133"}],"verdict":{"verdict":"malicious","verdict_source":"indicator database"}},{"id":"1543710628379715643","root":"File:4c75a2e2511e44061424cc86123e1ea5dc4f7c8aadebc5c3bdebbe746175b2c6","edges":[{"edge_kind":"extracted_from_archive","from_key":"File:4c75a2e2511e44061424cc86123e1ea5dc4f7c8aadebc5c3bdebbe746175b2c6","to_key":"File:7d33210fa57805f799c84d871f7aba24e9ce769dfd14cdf13ca5e9164cccafe6"},{"edge_kind":"extracted_from_archive","from_key":"File:7d33210fa57805f799c84d871f7aba24e9ce769dfd14cdf13ca5e9164cccafe6","to_key":"File:4bf5122f344554c53bde2ebb8cd2b7e3d1600ad631c385a5d7cce23c7785459a"}],"verdict":{"verdict":"likely_benign","verdict_source":"static analysis","reasons":["Very short text file without any suspicious content"]}},{"id":"1543710628069337135","root":"File:4c75a2e2511e44061424cc86123e1ea5dc4f7c8aadebc5c3bdebbe746175b2c6","edges":[{"edge_kind":"extracted_from_archive","from_key":"File:4c75a2e2511e44061424cc86123e1ea5dc4f7c8aadebc5c3bdebbe746175b2c6","to_key":"File:7d33210fa57805f799c84d871f7aba24e9ce769dfd14cdf13ca5e9164cccafe6"},{"edge_kind":"extracted_from_archive","from_key":"File:7d33210fa57805f799c84d871f7aba24e9ce769dfd14cdf13ca5e9164cccafe6","to_key":"File:ed4d01b36d154179c85e5c07aa207d8dae0daef80a28ee9d3c410cdaa507cc2c"}],"verdict":{"verdict":"unknown"}},{"id":"1543710628069337130","root":"File:4c75a2e2511e44061424cc86123e1ea5dc4f7c8aadebc5c3bdebbe746175b2c6","edges":[{"edge_kind":"extracted_from_archive","from_key":"File:4c75a2e2511e44061424cc86123e1ea5dc4f7c8aadebc5c3bdebbe746175b2c6","to_key":"File:cfebc287dd09c37454dc8ef07248ea19bcda285e1d8b56fa6b362079bb707361"},{"edge_kind":"extracted_from_archive","from_key":"File:cfebc287dd09c37454dc8ef07248ea19bcda285e1d8b56fa6b362079bb707361","to_key":"File:d61954427b7918e4540fc315516922d34af9414188edd0a0c808d3191659cf38"}],"verdict":{"verdict":"unknown"}},{"id":"1543710628065142823","root":"File:4c75a2e2511e44061424cc86123e1ea5dc4f7c8aadebc5c3bdebbe746175b2c6","edges":[{"edge_kind":"extracted_from_archive","from_key":"File:4c75a2e2511e44061424cc86123e1ea5dc4f7c8aadebc5c3bdebbe746175b2c6","to_key":"File:cfebc287dd09c37454dc8ef07248ea19bcda285e1d8b56fa6b362079bb707361"},{"edge_kind":"extracted_from_archive","from_key":"File:cfebc287dd09c37454dc8ef07248ea19bcda285e1d8b56fa6b362079bb707361","to_key":"File:c021f998077b73bdbf8588ff4135c64c286e9e9827ff9944e24b7f974f45f38d"},{"edge_kind":"extracted_from_archive","from_key":"File:c021f998077b73bdbf8588ff4135c64c286e9e9827ff9944e24b7f974f45f38d","to_key":"File:f3279f6bc69ed3e8803d117fe1321cb5b3220b33c2cf0b8635f85d721f01fa04"},{"edge_kind":"extracted_from_archive","from_key":"File:f3279f6bc69ed3e8803d117fe1321cb5b3220b33c2cf0b8635f85d721f01fa04","to_key":"File:bc51a7ca6c7de7c274743b0babc5308c6ff75d42b5fa53a6ddfd15e8dd08819d"}],"verdict":{"verdict":"unknown"}},{"id":"1543710628069337132","root":"File:4c75a2e2511e44061424cc86123e1ea5dc4f7c8aadebc5c3bdebbe746175b2c6","edges":[{"edge_kind":"extracted_from_archive","from_key":"File:4c75a2e2511e44061424cc86123e1ea5dc4f7c8aadebc5c3bdebbe746175b2c6","to_key":"File:cfebc287dd09c37454dc8ef07248ea19bcda285e1d8b56fa6b362079bb707361"},{"edge_kind":"extracted_from_archive","from_key":"File:cfebc287dd09c37454dc8ef07248ea19bcda285e1d8b56fa6b362079bb707361","to_key":"File:c021f998077b73bdbf8588ff4135c64c286e9e9827ff9944e24b7f974f45f38d"},{"edge_kind":"extracted_from_archive","from_key":"File:c021f998077b73bdbf8588ff4135c64c286e9e9827ff9944e24b7f974f45f38d","to_key":"File:f3279f6bc69ed3e8803d117fe1321cb5b3220b33c2cf0b8635f85d721f01fa04"},{"edge_kind":"extracted_from_archive","from_key":"File:f3279f6bc69ed3e8803d117fe1321cb5b3220b33c2cf0b8635f85d721f01fa04","to_key":"File:0f4d1a073bc226a68cab0d85d13bd40d5b914afb4b22f5b02fbf059cbede1d18"},{"edge_kind":"extracted_from_archive","from_key":"File:0f4d1a073bc226a68cab0d85d13bd40d5b914afb4b22f5b02fbf059cbede1d18","to_key":"File:4022f6af97ab4943ce5196d1fc9b30b4a5cc66149021b690265162c3647d5126"}],"verdict":{"verdict":"unknown"}},{"id":"sandbox_network","root":"File:4c75a2e2511e44061424cc86123e1ea5dc4f7c8aadebc5c3bdebbe746175b2c6","edges":[{"edge_kind":"contacted_ip","from_key":"File:4c75a2e2511e44061424cc86123e1ea5dc4f7c8aadebc5c3bdebbe746175b2c6","to_key":"Ip:77.91.124.55"},{"edge_kind":"contacted_ip","from_key":"File:4c75a2e2511e44061424cc86123e1ea5dc4f7c8aadebc5c3bdebbe746175b2c6","to_key":"Ip:57.144.202.1"},{"edge_kind":"contacted_ip","from_key":"File:4c75a2e2511e44061424cc86123e1ea5dc4f7c8aadebc5c3bdebbe746175b2c6","to_key":"Ip:172.253.135.84"},{"edge_kind":"contacted_ip","from_key":"File:4c75a2e2511e44061424cc86123e1ea5dc4f7c8aadebc5c3bdebbe746175b2c6","to_key":"Ip:173.194.208.94"},{"edge_kind":"contacted_ip","from_key":"File:4c75a2e2511e44061424cc86123e1ea5dc4f7c8aadebc5c3bdebbe746175b2c6","to_key":"Ip:163.181.60.206"},{"edge_kind":"contacted_ip","from_key":"File:4c75a2e2511e44061424cc86123e1ea5dc4f7c8aadebc5c3bdebbe746175b2c6","to_key":"Ip:142.251.186.94"},{"edge_kind":"contacted_ip","from_key":"File:4c75a2e2511e44061424cc86123e1ea5dc4f7c8aadebc5c3bdebbe746175b2c6","to_key":"Ip:192.178.220.138"},{"edge_kind":"contacted_ip","from_key":"File:4c75a2e2511e44061424cc86123e1ea5dc4f7c8aadebc5c3bdebbe746175b2c6","to_key":"Ip:142.251.153.119"},{"edge_kind":"contacted_ip","from_key":"File:4c75a2e2511e44061424cc86123e1ea5dc4f7c8aadebc5c3bdebbe746175b2c6","to_key":"Ip:57.145.2.128"},{"edge_kind":"contacted_ip","from_key":"File:4c75a2e2511e44061424cc86123e1ea5dc4f7c8aadebc5c3bdebbe746175b2c6","to_key":"Ip:150.171.109.65"},{"edge_kind":"contacted_domain","from_key":"File:4c75a2e2511e44061424cc86123e1ea5dc4f7c8aadebc5c3bdebbe746175b2c6","to_key":"Domain:accounts.google.com"},{"edge_kind":"resolves_to","from_key":"Domain:accounts.google.com","to_key":"Ip:172.253.135.84"},{"edge_kind":"contacted_domain","from_key":"File:4c75a2e2511e44061424cc86123e1ea5dc4f7c8aadebc5c3bdebbe746175b2c6","to_key":"Domain:accounts.youtube.com"},{"edge_kind":"resolves_to","from_key":"Domain:accounts.youtube.com","to_key":"Ip:192.178.220.138"},{"edge_kind":"contacted_domain","from_key":"File:4c75a2e2511e44061424cc86123e1ea5dc4f7c8aadebc5c3bdebbe746175b2c6","to_key":"Domain:c.pki.goog"},{"edge_kind":"resolves_to","from_key":"Domain:c.pki.goog","to_key":"Ip:173.194.208.94"},{"edge_kind":"contacted_domain","from_key":"File:4c75a2e2511e44061424cc86123e1ea5dc4f7c8aadebc5c3bdebbe746175b2c6","to_key":"Domain:ocsp.digicert.cn"},{"edge_kind":"resolves_to","from_key":"Domain:ocsp.digicert.cn","to_key":"Ip:163.181.60.206"},{"edge_kind":"contacted_domain","from_key":"File:4c75a2e2511e44061424cc86123e1ea5dc4f7c8aadebc5c3bdebbe746175b2c6","to_key":"Domain:ssl.gstatic.com"},{"edge_kind":"resolves_to","from_key":"Domain:ssl.gstatic.com","to_key":"Ip:142.251.186.94"},{"edge_kind":"contacted_domain","from_key":"File:4c75a2e2511e44061424cc86123e1ea5dc4f7c8aadebc5c3bdebbe746175b2c6","to_key":"Domain:static.xx.fbcdn.net"},{"edge_kind":"resolves_to","from_key":"Domain:static.xx.fbcdn.net","to_key":"Ip:57.145.2.128"},{"edge_kind":"contacted_domain","from_key":"File:4c75a2e2511e44061424cc86123e1ea5dc4f7c8aadebc5c3bdebbe746175b2c6","to_key":"Domain:3e723b591bdb95ce8f5c9b7032dc572ca97351d0da5efc73459c1fbaf438e43b"},{"edge_kind":"resolves_to","from_key":"Domain:3e723b591bdb95ce8f5c9b7032dc572ca97351d0da5efc73459c1fbaf438e43b","to_key":"Ip:57.144.202.1"},{"edge_kind":"contacted_domain","from_key":"File:4c75a2e2511e44061424cc86123e1ea5dc4f7c8aadebc5c3bdebbe746175b2c6","to_key":"Domain:www.google.com"},{"edge_kind":"resolves_to","from_key":"Domain:www.google.com","to_key":"Ip:142.251.153.119"},{"edge_kind":"contacted_url","from_key":"File:4c75a2e2511e44061424cc86123e1ea5dc4f7c8aadebc5c3bdebbe746175b2c6","to_key":"Url:/r/gsr1.crl"},{"edge_kind":"contacted_url","from_key":"File:4c75a2e2511e44061424cc86123e1ea5dc4f7c8aadebc5c3bdebbe746175b2c6","to_key":"Url:/r/r4.crl"},{"edge_kind":"contacted_url","from_key":"File:4c75a2e2511e44061424cc86123e1ea5dc4f7c8aadebc5c3bdebbe746175b2c6","to_key":"Url:/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEA59dSNcqDdhV39MzSTNbR0%3D"},{"edge_kind":"contacted_url","from_key":"File:4c75a2e2511e44061424cc86123e1ea5dc4f7c8aadebc5c3bdebbe746175b2c6","to_key":"Url:/we2/yK5nPhtHKQs.crl"},{"edge_kind":"contacted_url","from_key":"File:4c75a2e2511e44061424cc86123e1ea5dc4f7c8aadebc5c3bdebbe746175b2c6","to_key":"Url:/we2/xuzt3PU9F_w.crl"},{"edge_kind":"contacted_url","from_key":"File:4c75a2e2511e44061424cc86123e1ea5dc4f7c8aadebc5c3bdebbe746175b2c6","to_key":"Url:/we2/dTM3-0hpWfE.crl"},{"edge_kind":"contacted_url","from_key":"File:4c75a2e2511e44061424cc86123e1ea5dc4f7c8aadebc5c3bdebbe746175b2c6","to_key":"Url:/r/r1.crl"},{"edge_kind":"contacted_url","from_key":"File:4c75a2e2511e44061424cc86123e1ea5dc4f7c8aadebc5c3bdebbe746175b2c6","to_key":"Url:/wr2/oBFYYahzgVI.crl"}],"verdict":{"verdict":"unknown","verdict_source":"sandbox"}},{"id":"sandbox_files","root":"File:4c75a2e2511e44061424cc86123e1ea5dc4f7c8aadebc5c3bdebbe746175b2c6","edges":[{"edge_kind":"extracted","from_key":"File:4c75a2e2511e44061424cc86123e1ea5dc4f7c8aadebc5c3bdebbe746175b2c6","to_key":"File:0f4d1a073bc226a68cab0d85d13bd40d5b914afb4b22f5b02fbf059cbede1d18"},{"edge_kind":"extracted","from_key":"File:4c75a2e2511e44061424cc86123e1ea5dc4f7c8aadebc5c3bdebbe746175b2c6","to_key":"File:ed4d01b36d154179c85e5c07aa207d8dae0daef80a28ee9d3c410cdaa507cc2c"},{"edge_kind":"extracted","from_key":"File:4c75a2e2511e44061424cc86123e1ea5dc4f7c8aadebc5c3bdebbe746175b2c6","to_key":"File:cfebc287dd09c37454dc8ef07248ea19bcda285e1d8b56fa6b362079bb707361"},{"edge_kind":"extracted","from_key":"File:4c75a2e2511e44061424cc86123e1ea5dc4f7c8aadebc5c3bdebbe746175b2c6","to_key":"File:c021f998077b73bdbf8588ff4135c64c286e9e9827ff9944e24b7f974f45f38d"},{"edge_kind":"extracted","from_key":"File:4c75a2e2511e44061424cc86123e1ea5dc4f7c8aadebc5c3bdebbe746175b2c6","to_key":"File:4022f6af97ab4943ce5196d1fc9b30b4a5cc66149021b690265162c3647d5126"},{"edge_kind":"extracted","from_key":"File:4c75a2e2511e44061424cc86123e1ea5dc4f7c8aadebc5c3bdebbe746175b2c6","to_key":"File:f3279f6bc69ed3e8803d117fe1321cb5b3220b33c2cf0b8635f85d721f01fa04"},{"edge_kind":"extracted","from_key":"File:4c75a2e2511e44061424cc86123e1ea5dc4f7c8aadebc5c3bdebbe746175b2c6","to_key":"File:7d33210fa57805f799c84d871f7aba24e9ce769dfd14cdf13ca5e9164cccafe6"},{"edge_kind":"extracted","from_key":"File:4c75a2e2511e44061424cc86123e1ea5dc4f7c8aadebc5c3bdebbe746175b2c6","to_key":"File:4bf5122f344554c53bde2ebb8cd2b7e3d1600ad631c385a5d7cce23c7785459a"},{"edge_kind":"extracted","from_key":"File:4c75a2e2511e44061424cc86123e1ea5dc4f7c8aadebc5c3bdebbe746175b2c6","to_key":"File:d61954427b7918e4540fc315516922d34af9414188edd0a0c808d3191659cf38"},{"edge_kind":"extracted","from_key":"File:4c75a2e2511e44061424cc86123e1ea5dc4f7c8aadebc5c3bdebbe746175b2c6","to_key":"File:bc51a7ca6c7de7c274743b0babc5308c6ff75d42b5fa53a6ddfd15e8dd08819d"},{"edge_kind":"extracted","from_key":"File:4c75a2e2511e44061424cc86123e1ea5dc4f7c8aadebc5c3bdebbe746175b2c6","to_key":"File:52c4113e7f308faa933ae6e8ff5d1b955ba62d1edac0eb7c972caa26e1ae4e2d"},{"edge_kind":"extracted","from_key":"File:4c75a2e2511e44061424cc86123e1ea5dc4f7c8aadebc5c3bdebbe746175b2c6","to_key":"File:ecb636b278261eade712e68ec7d805d20e802628248da872d3d0ada1432ffc11"},{"edge_kind":"extracted","from_key":"File:4c75a2e2511e44061424cc86123e1ea5dc4f7c8aadebc5c3bdebbe746175b2c6","to_key":"File:c9caf41a587249211cd208551f7a20833d62d27c65dd005f7a5a4dc0b6fdf359"},{"edge_kind":"extracted","from_key":"File:4c75a2e2511e44061424cc86123e1ea5dc4f7c8aadebc5c3bdebbe746175b2c6","to_key":"File:a2e272cd87fe16d1f6d7f4f880f1c49535af8b3e08546b594910dc25a418f1a3"},{"edge_kind":"extracted","from_key":"File:4c75a2e2511e44061424cc86123e1ea5dc4f7c8aadebc5c3bdebbe746175b2c6","to_key":"File:871e274a9afc9c4abc2c0ec388d11164835959a932c2e1131e32cbb5f06e6ae7"},{"edge_kind":"extracted","from_key":"File:4c75a2e2511e44061424cc86123e1ea5dc4f7c8aadebc5c3bdebbe746175b2c6","to_key":"File:2facb8479a21034a3fa4eac1c0b1bb1275bac6936ea22a5908b5e315df48bfca"},{"edge_kind":"extracted","from_key":"File:4c75a2e2511e44061424cc86123e1ea5dc4f7c8aadebc5c3bdebbe746175b2c6","to_key":"File:bdfb61d88fec43e8b7a4ba8be780d99818b5e61bd0609206fbfcfc26153fd63c"},{"edge_kind":"extracted","from_key":"File:4c75a2e2511e44061424cc86123e1ea5dc4f7c8aadebc5c3bdebbe746175b2c6","to_key":"File:c7b6408aea66d8e918c32a3a8b2cad949adde916f575ca17954ad81fea56fd71"},{"edge_kind":"extracted","from_key":"File:4c75a2e2511e44061424cc86123e1ea5dc4f7c8aadebc5c3bdebbe746175b2c6","to_key":"File:5dc7179dd8a43165265c836a5c446b13bafb715e4b42ad76fb8496a30faa5bd0"},{"edge_kind":"extracted","from_key":"File:4c75a2e2511e44061424cc86123e1ea5dc4f7c8aadebc5c3bdebbe746175b2c6","to_key":"File:6f580a7007e75adbebbfe555f14bb659cc19666f6f4b3a4891700384352a6af7"},{"edge_kind":"extracted","from_key":"File:4c75a2e2511e44061424cc86123e1ea5dc4f7c8aadebc5c3bdebbe746175b2c6","to_key":"File:d46448d8335b005d018d5d40d75282f0361727e5ede7878fee181d92734ccc3c"},{"edge_kind":"extracted","from_key":"File:4c75a2e2511e44061424cc86123e1ea5dc4f7c8aadebc5c3bdebbe746175b2c6","to_key":"File:347d1ea6fcda8468ea088ab0e6298872e0894e86175f3043c2dd93746c990905"}],"verdict":{"verdict":"unknown","verdict_source":"sandbox"}}]}},"activity":{"stats":{"process_count":17,"spawned_processes_count":17,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":20,"imported_dlls_count":188,"dropped_files_count":0,"extracted_files_count":22,"files_written_count":17,"files_deleted_count":0,"registry_keys_created_count":8,"registry_keys_modified_count":0,"registry_keys_deleted_count":4,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":12,"embedded_ips_count":0,"embedded_domains_count":1,"embedded_urls_count":0,"contacted_hosts_count":10,"dns_resolutions_count":8,"contacted_urls_count":8,"http_requests_count":8},"behavior_tags":["commodity","backdoor","smokeloader","redlinestealer","criminal","informationstealer","downloader","windows-server-utility"],"sample_flags":["Multi-Process","Network Traffic","Extracted Files","Decrypted SSL traffic"],"sandbox_reports":[{"id":"6a8bc714f9ffa2deee0d28a4","environment_id":100,"environment_description":"Windows 7 32 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"Gen:Heur.Crifi","contacted_countries":["DEU","USA"],"submit_name":"4c75a2e2511e44061424cc86123e1ea5dc4f7c8aadebc5c3bdebbe746175b2c6","analysis_start_time":"2026-08-24T04:22:46+00:00","indicators_count":{"informative":235,"suspicious":65,"malicious":13},"tags":["Multi-Process","Network Traffic","Extracted Files","Decrypted SSL traffic"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":[{"address":"77.91.124.55","port":19071,"protocol":"TCP","country":"Germany","sources":[{"report_type":"sandbox","report_id":"6a8bc714f9ffa2deee0d28a4"}]},{"address":"57.144.202.1","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"6a8bc714f9ffa2deee0d28a4"}]},{"address":"172.253.135.84","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"6a8bc714f9ffa2deee0d28a4"}]},{"address":"173.194.208.94","port":80,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"6a8bc714f9ffa2deee0d28a4"}]},{"address":"163.181.60.206","port":80,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"6a8bc714f9ffa2deee0d28a4"}]},{"address":"142.251.186.94","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"6a8bc714f9ffa2deee0d28a4"}]},{"address":"192.178.220.138","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"6a8bc714f9ffa2deee0d28a4"}]},{"address":"142.251.153.119","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"6a8bc714f9ffa2deee0d28a4"}]},{"address":"57.145.2.128","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"6a8bc714f9ffa2deee0d28a4"}]},{"address":"150.171.109.65","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"6a8bc714f9ffa2deee0d28a4"}]}],"dns_resolutions":[{"domain":"accounts.google.com","address":"172.253.135.84","ttl":133,"country":"United States","sources":[{"report_type":"sandbox","report_id":"6a8bc714f9ffa2deee0d28a4"}]},{"domain":"accounts.youtube.com","address":"192.178.220.138","ttl":300,"country":"United States","sources":[{"report_type":"sandbox","report_id":"6a8bc714f9ffa2deee0d28a4"}]},{"domain":"c.pki.goog","address":"173.194.208.94","ttl":31,"country":"United States","sources":[{"report_type":"sandbox","report_id":"6a8bc714f9ffa2deee0d28a4"}]},{"domain":"ocsp.digicert.cn","address":"163.181.60.206","ttl":293,"country":"United States","sources":[{"report_type":"sandbox","report_id":"6a8bc714f9ffa2deee0d28a4"}]},{"domain":"ssl.gstatic.com","address":"142.251.186.94","ttl":300,"country":"United States","sources":[{"report_type":"sandbox","report_id":"6a8bc714f9ffa2deee0d28a4"}]},{"domain":"static.xx.fbcdn.net","address":"57.145.2.128","ttl":1616,"country":"United States","sources":[{"report_type":"sandbox","report_id":"6a8bc714f9ffa2deee0d28a4"}]},{"domain":"www.facebook.com","address":"57.144.202.1","ttl":3571,"country":"United States","sources":[{"report_type":"sandbox","report_id":"6a8bc714f9ffa2deee0d28a4"}]},{"domain":"www.google.com","address":"142.251.153.119","ttl":269,"country":"United States","sources":[{"report_type":"sandbox","report_id":"6a8bc714f9ffa2deee0d28a4"}]}],"http_requests":[{"host":"c.pki.goog","host_ip":"173.194.208.94:80","url":"/r/gsr1.crl","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /r/gsr1.crl HTTP/1.1\nConnection: Keep-Alive\nAccept: */*\nUser-Agent: Microsoft-CryptoAPI/6.1\nHost: c.pki.goog","sources":[{"report_type":"sandbox","report_id":"6a8bc714f9ffa2deee0d28a4"}]},{"host":"c.pki.goog","host_ip":"173.194.208.94:80","url":"/r/r4.crl","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /r/r4.crl HTTP/1.1\nConnection: Keep-Alive\nAccept: */*\nUser-Agent: Microsoft-CryptoAPI/6.1\nHost: c.pki.goog","sources":[{"report_type":"sandbox","report_id":"6a8bc714f9ffa2deee0d28a4"}]},{"host":"ocsp.digicert.cn","host_ip":"163.181.60.206:80","url":"/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEA59dSNcqDdhV39MzSTNbR0%3D","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEA59dSNcqDdhV39MzSTNbR0%3D HTTP/1.1\nConnection: Keep-Alive\nAccept: */*\nUser-Agent: Microsoft-CryptoAPI/6.1\nHost: ocsp.digicert.cn","sources":[{"report_type":"sandbox","report_id":"6a8bc714f9ffa2deee0d28a4"}]},{"host":"c.pki.goog","host_ip":"173.194.208.94:80","url":"/we2/yK5nPhtHKQs.crl","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /we2/yK5nPhtHKQs.crl HTTP/1.1\nConnection: Keep-Alive\nAccept: */*\nUser-Agent: Microsoft-CryptoAPI/6.1\nHost: c.pki.goog","sources":[{"report_type":"sandbox","report_id":"6a8bc714f9ffa2deee0d28a4"}]},{"host":"c.pki.goog","host_ip":"173.194.208.94:80","url":"/we2/xuzt3PU9F_w.crl","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /we2/xuzt3PU9F_w.crl HTTP/1.1\nConnection: Keep-Alive\nAccept: */*\nUser-Agent: Microsoft-CryptoAPI/6.1\nHost: c.pki.goog","sources":[{"report_type":"sandbox","report_id":"6a8bc714f9ffa2deee0d28a4"}]},{"host":"c.pki.goog","host_ip":"173.194.208.94:80","url":"/we2/dTM3-0hpWfE.crl","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /we2/dTM3-0hpWfE.crl HTTP/1.1\nConnection: Keep-Alive\nAccept: */*\nUser-Agent: Microsoft-CryptoAPI/6.1\nHost: c.pki.goog","sources":[{"report_type":"sandbox","report_id":"6a8bc714f9ffa2deee0d28a4"}]},{"host":"c.pki.goog","host_ip":"173.194.208.94:80","url":"/r/r1.crl","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /r/r1.crl HTTP/1.1\nConnection: Keep-Alive\nAccept: */*\nUser-Agent: Microsoft-CryptoAPI/6.1\nHost: c.pki.goog","sources":[{"report_type":"sandbox","report_id":"6a8bc714f9ffa2deee0d28a4"}]},{"host":"c.pki.goog","host_ip":"173.194.208.94:80","url":"/wr2/oBFYYahzgVI.crl","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /wr2/oBFYYahzgVI.crl HTTP/1.1\nConnection: Keep-Alive\nAccept: */*\nUser-Agent: Microsoft-CryptoAPI/6.1\nHost: c.pki.goog","sources":[{"report_type":"sandbox","report_id":"6a8bc714f9ffa2deee0d28a4"}]}],"embedded_domains":[{"value":"www.facebook.com","sources":[{"report_type":"qsp","report_id":""}]}]},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"6a8bc714f9ffa2deee0d28a4"}],"processes":[{"pid":5732,"ppid":0,"name":"4c75a2e2511e44061424cc86123e1ea5dc4f7c8aadebc5c3bdebbe746175b2c6.exe","command_line":"","sha256":"4c75a2e2511e44061424cc86123e1ea5dc4f7c8aadebc5c3bdebbe746175b2c6","normalized_path":"C:\\4c75a2e2511e44061424cc86123e1ea5dc4f7c8aadebc5c3bdebbe746175b2c6.exe","uid":"00000000-00005732","icon":"$62"},{"pid":5348,"ppid":5732,"name":"ei4JY63.exe","command_line":"","sha256":"cfebc287dd09c37454dc8ef07248ea19bcda285e1d8b56fa6b362079bb707361","normalized_path":"%TEMP%\\IXP000.TMP\\ei4JY63.exe","parent_uid":"00000000-00005732","uid":"00000000-00005348"},{"pid":5720,"ppid":5348,"name":"BC6EJ61.exe","command_line":"","sha256":"c021f998077b73bdbf8588ff4135c64c286e9e9827ff9944e24b7f974f45f38d","normalized_path":"%TEMP%\\IXP001.TMP\\BC6EJ61.exe","parent_uid":"00000000-00005348","uid":"00000000-00005720"},{"pid":5724,"ppid":5720,"name":"Bw1Vp89.exe","command_line":"","sha256":"f3279f6bc69ed3e8803d117fe1321cb5b3220b33c2cf0b8635f85d721f01fa04","normalized_path":"%TEMP%\\IXP002.TMP\\Bw1Vp89.exe","parent_uid":"00000000-00005720","uid":"00000000-00005724"},{"pid":5740,"ppid":5724,"name":"1Qj66VM8.exe","command_line":"","sha256":"0f4d1a073bc226a68cab0d85d13bd40d5b914afb4b22f5b02fbf059cbede1d18","normalized_path":"%TEMP%\\IXP003.TMP\\1Qj66VM8.exe","parent_uid":"00000000-00005724","uid":"00000000-00005740"},{"pid":6044,"ppid":5724,"name":"2Ix4962.exe","command_line":"","sha256":"bc51a7ca6c7de7c274743b0babc5308c6ff75d42b5fa53a6ddfd15e8dd08819d","normalized_path":"%TEMP%\\IXP003.TMP\\2Ix4962.exe","parent_uid":"00000000-00005724","uid":"00000000-00006044"},{"pid":5776,"ppid":6044,"name":"AppLaunch.exe","command_line":"","sha256":"cfa7d98ad44c7fb11de5ff07da04f8fd4a3423564de05f87ba5e10bd13a1fe59","normalized_path":"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\AppLaunch.exe","parent_uid":"00000000-00006044","uid":"00000000-00005776"},{"pid":4188,"ppid":5720,"name":"3TI36uw.exe","command_line":"","sha256":"c9caf41a587249211cd208551f7a20833d62d27c65dd005f7a5a4dc0b6fdf359","normalized_path":"%TEMP%\\IXP002.TMP\\3TI36uw.exe","parent_uid":"00000000-00005720","uid":"00000000-00004188"},{"pid":2296,"ppid":4188,"name":"AppLaunch.exe","command_line":"","sha256":"cfa7d98ad44c7fb11de5ff07da04f8fd4a3423564de05f87ba5e10bd13a1fe59","normalized_path":"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\AppLaunch.exe","parent_uid":"00000000-00004188","uid":"00000000-00002296"},{"pid":4180,"ppid":5348,"name":"4hj421HX.exe","command_line":"","sha256":"d61954427b7918e4540fc315516922d34af9414188edd0a0c808d3191659cf38","normalized_path":"%TEMP%\\IXP001.TMP\\4hj421HX.exe","parent_uid":"00000000-00005348","uid":"00000000-00004180"},{"pid":4136,"ppid":4180,"name":"AppLaunch.exe","command_line":"","sha256":"cfa7d98ad44c7fb11de5ff07da04f8fd4a3423564de05f87ba5e10bd13a1fe59","normalized_path":"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\AppLaunch.exe","parent_uid":"00000000-00004180","uid":"00000000-00004136"},{"pid":2464,"ppid":5732,"name":"5jR9Wp3.exe","command_line":"","sha256":"7d33210fa57805f799c84d871f7aba24e9ce769dfd14cdf13ca5e9164cccafe6","normalized_path":"%TEMP%\\IXP000.TMP\\5jR9Wp3.exe","parent_uid":"00000000-00005732","uid":"00000000-00002464"},{"pid":4048,"ppid":2464,"name":"cmd.exe","command_line":"\"%WINDIR%\\system32\\cmd\" /c \"%TEMP%\\E6B6.tmp\\E7D0.tmp\\E7D1.bat %TEMP%\\IXP000.TMP\\5jR9Wp3.exe\"","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","normalized_path":"%WINDIR%\\system32\\cmd.exe","parent_uid":"00000000-00002464","uid":"00000000-00004048"},{"pid":3844,"ppid":4048,"name":"iexplore.exe","command_line":"https://www.facebook.com/login","sha256":"8abc7daa81c8a20bfd88b6a60ecc9ed1292fbb6cedbd6f872f36512d9a194bba","normalized_path":"%PROGRAMFILES%\\Internet Explorer\\iexplore.exe","parent_uid":"00000000-00004048","uid":"00000000-00003844"},{"pid":2372,"ppid":3844,"name":"iexplore.exe","command_line":"SCODEF:3844 CREDAT:275457 /prefetch:2","sha256":"8abc7daa81c8a20bfd88b6a60ecc9ed1292fbb6cedbd6f872f36512d9a194bba","normalized_path":"%PROGRAMFILES%\\Internet Explorer\\iexplore.exe","parent_uid":"00000000-00003844","uid":"00000000-00002372"},{"pid":3444,"ppid":3844,"name":"iexplore.exe","command_line":"SCODEF:3844 CREDAT:209929 /prefetch:2","sha256":"8abc7daa81c8a20bfd88b6a60ecc9ed1292fbb6cedbd6f872f36512d9a194bba","normalized_path":"%PROGRAMFILES%\\Internet Explorer\\iexplore.exe","parent_uid":"00000000-00003844","uid":"00000000-00003444"},{"pid":1960,"ppid":4048,"name":"iexplore.exe","command_line":"https://accounts.google.com/","sha256":"8abc7daa81c8a20bfd88b6a60ecc9ed1292fbb6cedbd6f872f36512d9a194bba","normalized_path":"%PROGRAMFILES%\\Internet Explorer\\iexplore.exe","parent_uid":"00000000-00004048","uid":"00000000-00001960"}],"all_imported_dlls":["msvcp140.dll","api-ms-win-crt-time-l1-1-0.dll","api-ms-win-core-xstate-l2-1-0.dll","System.Transactions.dll","comdlg32.dll","IPHLPAPI.DLL","oleacc.dll","dui70.dll","ucrtbase.dll","ole32.dll","advapi32.dll","lpk.dll","api-ms-win-downlevel-ole32-l1-1-0.dll","mscoreei.dll","npmproxy.dll","ssv.dll","d3d11.dll","msacm32.dll","System.Configuration.ni.dll","cryptsp.dll","jscript9.dll","powrprof.dll","nsi.dll","api-ms-win-core-processthreads-l1-1-1.dll","System.ServiceModel.dll","RpcRtRemote.dll","msimtf.dll","user32.dll","api-ms-win-downlevel-shlwapi-l1-1-0.dll","dnsapi.dll","msimg32.dll","mshtml.dll","api-ms-win-downlevel-user32-l1-1-0.dll","msctf.dll","netutils.dll","cryptnet.dll","d2d1.dll","dxgi.dll","sfc_os.dll","imm32.dll","VxSSL32.dll","api-ms-win-downlevel-shlwapi-l2-1-0.dll","srvcli.dll","msvcr90.dll","wship6.dll","sfc.dll","cfgmgr32.dll","feclient.dll","api-ms-win-crt-runtime-l1-1-0.dll","cryptbase.dll","nlssorting.dll","api-ms-win-downlevel-advapi32-l2-1-0.dll","System.ServiceModel.Internals.dll","sqmapi.dll","ntmarta.dll","URLREDIR.DLL","xmllite.dll","userenv.dll","gdi32.dll","clr.dll","secur32.dll","vm3dum_loader.dll","vm3dum_10.dll","vm3dum.dll","msvcrt.dll","comctl32.dll","api-ms-win-downlevel-advapi32-l1-1-0.dll","api-ms-win-core-file-l2-1-0.dll","mscorlib.ni.dll","IEShims.dll","dhcpcsvc6.dll","uxtheme.dll","setupapi.dll","ws2_32.dll","api-ms-win-crt-locale-l1-1-0.dll","ieproxy.dll","winnsi.dll","ExplorerFrame.dll","MSOHEV.DLL","System.IdentityModel.ni.dll","WindowsCodecs.dll","imagehlp.dll","mpr.dll","wkscli.dll","deploy.dll","KernelBase.dll","devobj.dll","WindowsBase.ni.dll","FWPUCLNT.DLL","AcGenral.dll","samcli.dll","api-ms-win-core-file-l1-2-0.dll","mscoree.dll","System.Windows.Forms.dll","System.Runtime.Serialization.ni.dll","api-ms-win-downlevel-shell32-l1-1-0.dll","api-ms-win-downlevel-version-l1-1-0.dll","normaliz.dll","ucrtbase_clr0400.dll","PresentationFramework.ni.dll","propsys.dll","crypt32.dll","rasadhlp.dll","SensApi.dll","shlwapi.dll","ieframe.dll","netapi32.dll","duser.dll","jp2ssv.dll","api-ms-win-crt-string-l1-1-0.dll","api-ms-win-crt-environment-l1-1-0.dll","wpfgfx_v0400.dll","PresentationNative_v0400.dll","bcryptprimitives.dll","gpapi.dll","fltLib.dll","System.Drawing.ni.dll","msasn1.dll","ieui.dll","wshqos.dll","mlang.dll","d3d10level9.dll","version.dll","winmm.dll","advpack.dll","vcruntime140_clr0400.dll","System.Transactions.ni.dll","mswsock.dll","nlaapi.dll","wintrust.dll","WSHTCPIP.DLL","sechost.dll","usp10.dll","api-ms-win-crt-convert-l1-1-0.dll","api-ms-win-crt-utility-l1-1-0.dll","PresentationCore.ni.dll","DWrite.dll","msvcp140_clr0400.dll","sspicli.dll","shell32.dll","api-ms-win-downlevel-normaliz-l1-1-0.dll","System.ni.dll","System.Xml.ni.dll","oleaccrc.dll","Wldap32.dll","wininet.dll","vcruntime140.dll","api-ms-win-crt-filesystem-l1-1-0.dll","clrjit.dll","bcrypt.dll","rsaenh.dll","diasymreader.dll","dhcpcsvc.dll","apphelp.dll","api-ms-win-crt-math-l1-1-0.dll","webio.dll","sxs.dll","oleaut32.dll","api-ms-win-crt-stdio-l1-1-0.dll","System.Windows.Forms.ni.dll","SMDiagnostics.ni.dll","netprofm.dll","msvcr100.dll","kernel32.dll","AcLayers.dll","iertutil.dll","api-ms-win-core-synch-l1-2-0.dll","winbrand.dll","credssp.dll","ncrypt.dll","UIAutomationCore.dll","rpcrt4.dll","psapi.dll","dwmapi.dll","urlmon.dll","api-ms-win-crt-heap-l1-1-0.dll","schannel.dll","winhttp.dll","mscorwks.dll","profapi.dll","cabinet.dll","ntdll.dll","rpcss.dll","d3d10warp.dll","api-ms-win-core-timezone-l1-1-0.dll","api-ms-win-core-localization-l1-2-0.dll","System.Core.ni.dll","clbcatq.dll"]},"file_activity":{"dropped_files":[],"extracted_files":[{"name":"1Qj66VM8.exe","sha256":"0f4d1a073bc226a68cab0d85d13bd40d5b914afb4b22f5b02fbf059cbede1d18","verdict":"undetected","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a8bc714f9ffa2deee0d28a4"}]},{"name":"ed4d01b36d154179c85e5c07aa207d8dae0daef80a28ee9d3c410cdaa507cc2c","sha256":"ed4d01b36d154179c85e5c07aa207d8dae0daef80a28ee9d3c410cdaa507cc2c","verdict":"undetected","sources":[{"report_type":"qsp","report_id":""}]},{"name":"ei4JY63.exe","sha256":"cfebc287dd09c37454dc8ef07248ea19bcda285e1d8b56fa6b362079bb707361","verdict":"undetected","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a8bc714f9ffa2deee0d28a4"}]},{"name":"BC6EJ61.exe","sha256":"c021f998077b73bdbf8588ff4135c64c286e9e9827ff9944e24b7f974f45f38d","verdict":"undetected","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a8bc714f9ffa2deee0d28a4"}]},{"name":"4022f6af97ab4943ce5196d1fc9b30b4a5cc66149021b690265162c3647d5126","sha256":"4022f6af97ab4943ce5196d1fc9b30b4a5cc66149021b690265162c3647d5126","verdict":"undetected","sources":[{"report_type":"qsp","report_id":""}]},{"name":"Bw1Vp89.exe","sha256":"f3279f6bc69ed3e8803d117fe1321cb5b3220b33c2cf0b8635f85d721f01fa04","verdict":"undetected","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a8bc714f9ffa2deee0d28a4"}]},{"name":"5jR9Wp3.exe","sha256":"7d33210fa57805f799c84d871f7aba24e9ce769dfd14cdf13ca5e9164cccafe6","verdict":"undetected","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a8bc714f9ffa2deee0d28a4"}]},{"name":"4bf5122f344554c53bde2ebb8cd2b7e3d1600ad631c385a5d7cce23c7785459a","sha256":"4bf5122f344554c53bde2ebb8cd2b7e3d1600ad631c385a5d7cce23c7785459a","verdict":"likely_benign","sources":[{"report_type":"qsp","report_id":""}]},{"name":"4hj421HX.exe","sha256":"d61954427b7918e4540fc315516922d34af9414188edd0a0c808d3191659cf38","verdict":"undetected","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a8bc714f9ffa2deee0d28a4"}]},{"name":"2Ix4962.exe","sha256":"bc51a7ca6c7de7c274743b0babc5308c6ff75d42b5fa53a6ddfd15e8dd08819d","verdict":"undetected","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a8bc714f9ffa2deee0d28a4"}]},{"name":"E7D1.bat","sha256":"52c4113e7f308faa933ae6e8ff5d1b955ba62d1edac0eb7c972caa26e1ae4e2d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a8bc714f9ffa2deee0d28a4"}]},{"name":"DISMHOST.EXE.6A8C05FD.bin","sha256":"ecb636b278261eade712e68ec7d805d20e802628248da872d3d0ada1432ffc11","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a8bc714f9ffa2deee0d28a4"}]},{"name":"3TI36uw.exe","sha256":"c9caf41a587249211cd208551f7a20833d62d27c65dd005f7a5a4dc0b6fdf359","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a8bc714f9ffa2deee0d28a4"}]},{"name":"aBIDyB4xhJy8wmKvUcQXclxgo-3469oiGT9DWDYPz6DhfgQe914iiBfD-GevAmvU9KONMKn3YhINqU49pVNahkCkeiF2w9Hlit1_1_.css","sha256":"a2e272cd87fe16d1f6d7f4f880f1c49535af8b3e08546b594910dc25a418f1a3","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a8bc714f9ffa2deee0d28a4"}]},{"name":"identifier_2_.htm","sha256":"871e274a9afc9c4abc2c0ec388d11164835959a932c2e1131e32cbb5f06e6ae7","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a8bc714f9ffa2deee0d28a4"}]},{"name":"identifier_1_.htm","sha256":"2facb8479a21034a3fa4eac1c0b1bb1275bac6936ea22a5908b5e315df48bfca","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a8bc714f9ffa2deee0d28a4"}]},{"name":"urlref_httpswww.facebook.comlogin","sha256":"bdfb61d88fec43e8b7a4ba8be780d99818b5e61bd0609206fbfcfc26153fd63c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a8bc714f9ffa2deee0d28a4"}]},{"name":"login_1_.htm","sha256":"c7b6408aea66d8e918c32a3a8b2cad949adde916f575ca17954ad81fea56fd71","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a8bc714f9ffa2deee0d28a4"}]},{"name":"dism.log","sha256":"5dc7179dd8a43165265c836a5c446b13bafb715e4b42ad76fb8496a30faa5bd0","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a8bc714f9ffa2deee0d28a4"}]},{"name":"YG480PWX.htm","sha256":"6f580a7007e75adbebbfe555f14bb659cc19666f6f4b3a4891700384352a6af7","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a8bc714f9ffa2deee0d28a4"}]},{"name":"75A092F4522006A97542D6AC4F4E69D2","sha256":"d46448d8335b005d018d5d40d75282f0361727e5ede7878fee181d92734ccc3c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a8bc714f9ffa2deee0d28a4"}]},{"name":"imagestore.dat","sha256":"347d1ea6fcda8468ea088ab0e6298872e0894e86175f3043c2dd93746c990905","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a8bc714f9ffa2deee0d28a4"}]}],"files_written":[{"path":"%TEMP%\\IXP000.TMP\\TMP4351$.TMP","sources":[{"report_type":"sandbox","report_id":"6a8bc714f9ffa2deee0d28a4"}]},{"path":"%TEMP%\\IXP000.TMP\\ei4JY63.exe","sources":[{"report_type":"sandbox","report_id":"6a8bc714f9ffa2deee0d28a4"}]},{"path":"%TEMP%\\IXP000.TMP\\5jR9Wp3.exe","sources":[{"report_type":"sandbox","report_id":"6a8bc714f9ffa2deee0d28a4"}]},{"path":"%TEMP%\\IXP001.TMP\\TMP4351$.TMP","sources":[{"report_type":"sandbox","report_id":"6a8bc714f9ffa2deee0d28a4"}]},{"path":"%TEMP%\\IXP001.TMP\\BC6EJ61.exe","sources":[{"report_type":"sandbox","report_id":"6a8bc714f9ffa2deee0d28a4"}]},{"path":"%TEMP%\\IXP001.TMP\\4hj421HX.exe","sources":[{"report_type":"sandbox","report_id":"6a8bc714f9ffa2deee0d28a4"}]},{"path":"%TEMP%\\IXP002.TMP\\TMP4351$.TMP","sources":[{"report_type":"sandbox","report_id":"6a8bc714f9ffa2deee0d28a4"}]},{"path":"%TEMP%\\IXP002.TMP\\Bw1Vp89.exe","sources":[{"report_type":"sandbox","report_id":"6a8bc714f9ffa2deee0d28a4"}]},{"path":"%TEMP%\\IXP002.TMP\\3TI36uw.exe","sources":[{"report_type":"sandbox","report_id":"6a8bc714f9ffa2deee0d28a4"}]},{"path":"%TEMP%\\IXP003.TMP\\TMP4351$.TMP","sources":[{"report_type":"sandbox","report_id":"6a8bc714f9ffa2deee0d28a4"}]},{"path":"%TEMP%\\IXP003.TMP\\1Qj66VM8.exe","sources":[{"report_type":"sandbox","report_id":"6a8bc714f9ffa2deee0d28a4"}]},{"path":"%TEMP%\\IXP003.TMP\\2Ix4962.exe","sources":[{"report_type":"sandbox","report_id":"6a8bc714f9ffa2deee0d28a4"}]},{"path":"%TEMP%\\E6B6.tmp","sources":[{"report_type":"sandbox","report_id":"6a8bc714f9ffa2deee0d28a4"}]},{"path":"%TEMP%\\E6B6.tmp\\E7D0.tmp","sources":[{"report_type":"sandbox","report_id":"6a8bc714f9ffa2deee0d28a4"}]},{"path":"%TEMP%\\E6B6.tmp\\E7D0.tmp\\E7D1.tmp","sources":[{"report_type":"sandbox","report_id":"6a8bc714f9ffa2deee0d28a4"}]},{"path":"%TEMP%\\E6B6.tmp\\E7D0.tmp\\E7F1.tmp","sources":[{"report_type":"sandbox","report_id":"6a8bc714f9ffa2deee0d28a4"}]},{"path":"%TEMP%\\E6B6.tmp\\E7D0.tmp\\E7D1.bat","sources":[{"report_type":"sandbox","report_id":"6a8bc714f9ffa2deee0d28a4"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\RUNONCE\\","sources":[{"report_type":"sandbox","report_id":"6a8bc714f9ffa2deee0d28a4"}]},{"key":"HKLMHKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\TIMEZONEINFORMATION\\","sources":[{"report_type":"sandbox","report_id":"6a8bc714f9ffa2deee0d28a4"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\WINDOWS DEFENDER\\FEATURES\\","sources":[{"report_type":"sandbox","report_id":"6a8bc714f9ffa2deee0d28a4"}]},{"key":"HKLMHKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS DEFENDER SECURITY CENTER\\NOTIFICATIONS\\","sources":[{"report_type":"sandbox","report_id":"6a8bc714f9ffa2deee0d28a4"}]},{"key":"HKLMHKLM\\SOFTWARE\\","sources":[{"report_type":"sandbox","report_id":"6a8bc714f9ffa2deee0d28a4"}]},{"key":"HKLMHKLM\\SOFTWARE\\POLICIES\\","sources":[{"report_type":"sandbox","report_id":"6a8bc714f9ffa2deee0d28a4"}]},{"key":"HKLMHKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\","sources":[{"report_type":"sandbox","report_id":"6a8bc714f9ffa2deee0d28a4"}]},{"key":"HKLMHKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS DEFENDER SECURITY CENTER\\","sources":[{"report_type":"sandbox","report_id":"6a8bc714f9ffa2deee0d28a4"}]}],"keys_modified":null,"keys_deleted":[{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\RUNONCE\\WEXTRACT_CLEANUP0\\WEXTRACT_CLEANUP0","sources":[{"report_type":"sandbox","report_id":"6a8bc714f9ffa2deee0d28a4"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\RUNONCE\\WEXTRACT_CLEANUP1\\WEXTRACT_CLEANUP1","sources":[{"report_type":"sandbox","report_id":"6a8bc714f9ffa2deee0d28a4"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\RUNONCE\\WEXTRACT_CLEANUP2\\WEXTRACT_CLEANUP2","sources":[{"report_type":"sandbox","report_id":"6a8bc714f9ffa2deee0d28a4"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\RUNONCE\\WEXTRACT_CLEANUP3\\WEXTRACT_CLEANUP3","sources":[{"report_type":"sandbox","report_id":"6a8bc714f9ffa2deee0d28a4"}]}]},"mutex_activity":{"mutex_created":[{"name":"\\Sessions\\1\\BaseNamedObjects\\Global\\CLR_PerfMon_WrapMutex","sources":[{"report_type":"sandbox","report_id":"6a8bc714f9ffa2deee0d28a4"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\UpdatingNewTabPageData","sources":[{"report_type":"sandbox","report_id":"6a8bc714f9ffa2deee0d28a4"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\{5312EE61-79E3-4A24-BFE1-132B85B23C3A}","sources":[{"report_type":"sandbox","report_id":"6a8bc714f9ffa2deee0d28a4"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\IsoScope_f04_IESQMMUTEX_0_303","sources":[{"report_type":"sandbox","report_id":"6a8bc714f9ffa2deee0d28a4"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\IsoScope_f04_IESQMMUTEX_0_331","sources":[{"report_type":"sandbox","report_id":"6a8bc714f9ffa2deee0d28a4"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\{66D0969A-1E86-44CF-B4EC-3806DDDA3B5D}","sources":[{"report_type":"sandbox","report_id":"6a8bc714f9ffa2deee0d28a4"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"6a8bc714f9ffa2deee0d28a4"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"6a8bc714f9ffa2deee0d28a4"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\IsoScope_f04_IESQMMUTEX_0_519","sources":[{"report_type":"sandbox","report_id":"6a8bc714f9ffa2deee0d28a4"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\!BrowserEmulation!SharedMemory!Mutex","sources":[{"report_type":"sandbox","report_id":"6a8bc714f9ffa2deee0d28a4"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\VERMGMTBlockListFileMutex","sources":[{"report_type":"sandbox","report_id":"6a8bc714f9ffa2deee0d28a4"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\URLBLOCK_FILEMAPSWITCH_MUTEX_3844","sources":[{"report_type":"sandbox","report_id":"6a8bc714f9ffa2deee0d28a4"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\URLBLOCK_HASHFILESWITCH_MUTEX","sources":[{"report_type":"sandbox","report_id":"6a8bc714f9ffa2deee0d28a4"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\URLBLOCK_DOWNLOAD_MUTEX","sources":[{"report_type":"sandbox","report_id":"6a8bc714f9ffa2deee0d28a4"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\IsoScope_f04_IE_EarlyTabStart_0x102c_Mutex","sources":[{"report_type":"sandbox","report_id":"6a8bc714f9ffa2deee0d28a4"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\IsoScope_f04_ConnHashTable<3844>_HashTable_Mutex","sources":[{"report_type":"sandbox","report_id":"6a8bc714f9ffa2deee0d28a4"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\IsoScope_f04_IESQMMUTEX_0_274","sources":[{"report_type":"sandbox","report_id":"6a8bc714f9ffa2deee0d28a4"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\_!SHMSFTHISTORY!_","sources":[{"report_type":"sandbox","report_id":"6a8bc714f9ffa2deee0d28a4"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\IsoScope_f04_IESQMMUTEX_0_506","sources":[{"report_type":"sandbox","report_id":"6a8bc714f9ffa2deee0d28a4"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\MSIMGSIZECacheMutex","sources":[{"report_type":"sandbox","report_id":"6a8bc714f9ffa2deee0d28a4"}]}]}},"report_ids":{"sandbox_job_ids":["6a8bc714f9ffa2deee0d28a4"]}}}]]}] 1e:null 22:[["$","title","0",{"children":"Malicious Crifi.Generic Sample 4c75a2e2511e… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample 4c75a2e2511e…. Malware family: Crifi.Generic. Threat score 100/100. 12/28 AV engines flagged this file. 15 malicious and 17 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/4c75a2e2511e44061424cc86123e1ea5dc4f7c8aadebc5c3bdebbe746175b2c6"}],["$","meta","4",{"property":"og:title","content":"Malicious Crifi.Generic Sample 4c75a2e2511e… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample 4c75a2e2511e…. Malware family: Crifi.Generic. Threat score 100/100. 12/28 AV engines flagged this file. 15 malicious and 17 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/4c75a2e2511e44061424cc86123e1ea5dc4f7c8aadebc5c3bdebbe746175b2c6"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Crifi.Generic Sample 4c75a2e2511e… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample 4c75a2e2511e…. Malware family: Crifi.Generic. Threat score 100/100. 12/28 AV engines flagged this file. 15 malicious and 17 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L63","11",{}]]