24:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/1f7k-b47qno-6.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/3fc9w1ah_nm2g.js"],"SampleDetailWrapper"] 7a:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/1f7k-b47qno-6.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 23:T4dd,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Win/malicious_confidence_100% Sample 7ca6811b3a9f… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 7ca6811b3a9f…. Malware family: Win/malicious_confidence_100%. Threat score 100/100. 10/27 AV engines flagged this file. 24 malicious and 35 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/7ca6811b3a9febcffeeee9d839ad6b8eb096688c666be805325d1acf663cc833","keywords":["Malicious","Win/malicious_confidence_100%","malware analysis","sandbox report","threat intelligence","7ca6811b3a9febcffeeee9d839ad6b8eb096688c666be805325d1acf663cc833"],"about":{"@type":"SoftwareApplication","name":"d94fc8dcbc9e403657f9323967855f59.exe","applicationCategory":["peexe","executable"],"identifier":"7ca6811b3a9febcffeeee9d839ad6b8eb096688c666be805325d1acf663cc833","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Win/malicious_confidence_100%","antivirusDetections":{"malicious":10,"total":27},"behavioralIndicators":{"malicious":24,"suspicious":35},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}25:T25c4,Found reference to API (Indicator: "DosDateTimeToFileTime"; Source: "sample.bin"), Found reference to API (Indicator: "DeleteFileA"; Source: "sample.bin"), Found reference to API (Indicator: "AdjustTokenPrivileges"; Source: "sample.bin"), Found reference to API (Indicator: "MulDiv"; Source: "sample.bin"), Found reference to API (Indicator: "GetFileAttributesA"; Source: "sample.bin"), Found reference to API (Indicator: "SetForegroundWindow"; Source: "sample.bin"), Found reference to API (Indicator: "SeShutdownPrivilege"; Source: "sample.bin"), Found reference to API (Indicator: "GetPrivateProfileIntA"; Source: "sample.bin"), Found reference to API (Indicator: "GetExitCodeProcess"; Source: "sample.bin"), Found reference to API (Indicator: "FreeSid"; Source: "sample.bin"), Found reference to API (Indicator: "SetEvent"; Source: "sample.bin"), Found reference to API (Indicator: "GetSystemDirectoryA"; Source: "sample.bin"), Found reference to API (Indicator: "CreateDirectoryA"; Source: "sample.bin"), Found reference to API (Indicator: "GetDriveTypeA"; Source: "sample.bin"), Found reference to API (Indicator: "GlobalFree"; Source: "sample.bin"), Found reference to API (Indicator: "LoadLibraryA"; Source: "sample.bin"), Found reference to API (Indicator: "EqualSid"; Source: "sample.bin"), Found reference to API (Indicator: "CreateThread"; Source: "sample.bin"), Found reference to API (Indicator: "GetFileVersionInfoSizeA"; Source: "sample.bin"), Found reference to API (Indicator: "GetModuleHandleW"; Source: "sample.bin"), Found reference to API (Indicator: "DecryptFileA"; Source: "sample.bin"), Found reference to API (Indicator: "RegQueryValueExA"; Source: "sample.bin"), Found reference to API (Indicator: "GetCurrentProcessId"; Source: "sample.bin"), Found reference to API (Indicator: "RegSetValueExA"; Source: "sample.bin"), Found reference to API (Indicator: "FormatMessageA"; Source: "sample.bin"), Found reference to API (Indicator: "GetStartupInfoW"; Source: "sample.bin"), Found reference to API (Indicator: "GetCurrentDirectoryA"; Source: "sample.bin"), Found reference to API (Indicator: "SetFileAttributesA"; Source: "sample.bin"), Found reference to API (Indicator: "RegOpenKeyExA"; Source: "sample.bin"), Found reference to API (Indicator: "GetDesktopWindow"; Source: "sample.bin"), Found reference to API (Indicator: "CharNextA"; Source: "sample.bin"), Found reference to API (Indicator: "SetWindowPos"; Source: "sample.bin"), Found reference to API (Indicator: "ShowWindow"; Source: "sample.bin"), Found reference to API (Indicator: "GetSystemInfo"; Source: "sample.bin"), Found reference to API (Indicator: "SendMessageA"; Source: "sample.bin"), Found reference to API (Indicator: "UnhandledExceptionFilter"; Source: "sample.bin"), Found reference to API (Indicator: "VerQueryValueA"; Source: "sample.bin"), Found reference to API (Indicator: "DispatchMessageA"; Source: "sample.bin"), Found reference to API (Indicator: "GetWindowLongA"; Source: "sample.bin"), Found reference to API (Indicator: "LookupPrivilegeValueA"; Source: "sample.bin"), Found reference to API (Indicator: "FindFirstFileA"; Source: "sample.bin"), Found reference to API (Indicator: "GetProcAddress"; Source: "sample.bin"), Found reference to API (Indicator: "CreateMutexA"; Source: "sample.bin"), Found reference to API (Indicator: "CreateFileA"; Source: "sample.bin"), Found reference to API (Indicator: "GlobalAlloc"; Source: "sample.bin"), Found reference to API (Indicator: "CheckTokenMembership"; Source: "sample.bin"), Found reference to API (Indicator: "SetFileTime"; Source: "sample.bin"), Found reference to API (Indicator: "RegCloseKey"; Source: "sample.bin"), Found reference to API (Indicator: "GetTempPathA"; Source: "sample.bin"), Found reference to API (Indicator: "GetTokenInformation"; Source: "sample.bin"), Found reference to API (Indicator: "SizeofResource"; Source: "sample.bin"), Found reference to API (Indicator: "ResetEvent"; Source: "sample.bin"), Found reference to API (Indicator: "RemoveDirectoryA"; Source: "sample.bin"), Found reference to API (Indicator: "SetUnhandledExceptionFilter"; Source: "sample.bin"), Found reference to API (Indicator: "GlobalLock"; Source: "sample.bin"), Found reference to API (Indicator: "FindClose"; Source: "sample.bin"), Found reference to API (Indicator: "LocalFileTimeToFileTime"; Source: "sample.bin"), Found reference to API (Indicator: "IsDBCSLeadByte"; Source: "sample.bin"), Found reference to API (Indicator: "GetTickCount"; Source: "sample.bin"), Found reference to API (Indicator: "SetCurrentDirectoryA"; Source: "sample.bin"), Found reference to API (Indicator: "GetDC"; Source: "sample.bin"), Found reference to API (Indicator: "MsgWaitForMultipleObjects"; Source: "sample.bin"), Found reference to API (Indicator: "SetFilePointer"; Source: "sample.bin"), Found reference to API (Indicator: "GetShortPathNameA"; Source: "sample.bin"), Found reference to API (Indicator: "GetPrivateProfileStringA"; Source: "sample.bin"), Found reference to API (Indicator: "TerminateThread"; Source: "sample.bin"), Found reference to API (Indicator: "FreeResource"; Source: "sample.bin"), Found reference to API (Indicator: "lstrcmpA"; Source: "sample.bin"), Found reference to API (Indicator: "ExitProcess"; Source: "sample.bin"), Found reference to API (Indicator: "EnumResourceLanguagesA"; Source: "sample.bin"), Found reference to API (Indicator: "WritePrivateProfileStringA"; Source: "sample.bin"), Found reference to API (Indicator: "GetVolumeInformationA"; Source: "sample.bin"), Found reference to API (Indicator: "GetCurrentThreadId"; Source: "sample.bin"), Found reference to API (Indicator: "MessageBoxA"; Source: "sample.bin"), Found reference to API (Indicator: "SHBrowseForFolder"; Source: "sample.bin"), Found reference to API (Indicator: "GetModuleFileNameA"; Source: "sample.bin"), Found reference to API (Indicator: "GetCurrentProcess"; Source: "sample.bin"), Found reference to API (Indicator: "CharUpperA"; Source: "sample.bin"), Found reference to API (Indicator: "LocalFree"; Source: "sample.bin"), Found reference to API (Indicator: "LoadLibraryExA"; Source: "sample.bin"), Found reference to API (Indicator: "QueryPerformanceCounter"; Source: "sample.bin"), Found reference to API (Indicator: "RegDeleteValueA"; Source: "sample.bin"), Found reference to API (Indicator: "GetWindowRect"; Source: "sample.bin"), Found reference to API (Indicator: "CharPrevA"; Source: "sample.bin"), Found reference to API (Indicator: "GetDeviceCaps"; Source: "sample.bin"), Found reference to API (Indicator: "ReleaseDC"; Source: "sample.bin"), Found reference to API (Indicator: "HeapSetInformation"; Source: "sample.bin"), Found reference to API (Indicator: "GetSystemTimeAsFileTime"; Source: "sample.bin"), Found reference to API (Indicator: "SetWindowTextA"; Source: "sample.bin"), Found reference to API (Indicator: "ExpandEnvironmentStringsA"; Source: "sample.bin"), Found reference to API (Indicator: "AllocateAndInitializeSid"; Source: "sample.bin"), Found reference to API (Indicator: "EnableWindow"; Source: "sample.bin"), Found reference to API (Indicator: "PeekMessageA"; Source: "sample.bin"), Found reference to API (Indicator: "GetVersionExA"; Source: "sample.bin"), Found reference to API (Indicator: "LocalAlloc"; Source: "sample.bin"), Found reference to API (Indicator: "CreateEventA"; Source: "sample.bin"), Found reference to API (Indicator: "GetFileVersionInfoA"; Source: "sample.bin"), Found reference to API (Indicator: "GlobalUnlock"; Source: "sample.bin"), Found reference to API (Indicator: "RegQueryInfoKeyA"; Source: "sample.bin"), Found reference to API (Indicator: "CompareStringA"; Source: "sample.bin"), Found reference to API (Indicator: "WriteFile"; Source: "sample.bin"), Found reference to API (Indicator: "Sleep"; Source: "sample.bin"), Found reference to API (Indicator: "LoadStringA"; Source: "sample.bin"), Found reference to API (Indicator: "LoadResource"; Source: "sample.bin"), Found reference to API (Indicator: "TerminateProcess"; Source: "sample.bin"), Found reference to API (Indicator: "CreateProcessA"; Source: "sample.bin"), Found reference to API (Indicator: "FreeLibrary"; Source: "sample.bin"), Found reference to API (Indicator: "SHGetPathFromIDList"; Source: "sample.bin"), Found reference to API (Indicator: "RegCreateKeyExA"; Source: "sample.bin"), Found reference to API (Indicator: "MessageBeep"; Source: "sample.bin"), Found reference to API (Indicator: "FindNextFileA"; Source: "sample.bin"), Found reference to API (Indicator: "SetWindowLongA"; Source: "sample.bin"), Found reference to API (Indicator: "ReadFile"; Source: "sample.bin"), Found reference to API (Indicator: "CallWindowProcA"; Source: "sample.bin"), Found reference to API (Indicator: "OpenProcessToken"; Source: "sample.bin"), Found reference to API (Indicator: "ExitWindowsEx"; Source: "sample.bin"), Found reference to API (Indicator: "GetTempFileNameA"; Source: "sample.bin"), Found reference to API (Indicator: "GetVersion"; Source: "sample.bin"), Found reference to API (Indicator: "GetLastError"; Source: "sample.bin"), Found reference to API (Indicator: "LockResource"; Source: "sample.bin"), Found reference to API (Indicator: "GetDiskFreeSpaceA"; Source: "sample.bin"), Found reference to API (Indicator: "GetWindowsDirectoryA"; Source: "sample.bin"), Found reference to API (Indicator: "GetSystemMetrics"; Source: "sample.bin"), Found reference to API (Indicator: "WaitForSingleObject"; Source: "sample.bin"), Found reference to API (Indicator: "CloseHandle"; Source: "sample.bin"), Found reference to API (Indicator: "FindResourceA"; Source: "sample.bin")26:T4ff,"1sW61HT2.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\FOLDERDESCRIPTIONS\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}") "1sW61HT2.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\FOLDERDESCRIPTIONS\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\PROPERTYBAG") "1sW61HT2.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\SESSIONINFO\1") "1sW61HT2.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\SESSIONINFO\1\KNOWNFOLDERS") "1sW61HT2.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\USER SHELL FOLDERS") "1sW61HT2.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\USER SHELL FOLDERS") "1sW61HT2.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\FOLDERDESCRIPTIONS") "1sW61HT2.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\FOLDERDESCRIPTIONS\{1B3EA5DC-B587-4786-B4EF-BD1DC332AEAE}") "1sW61HT2.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\FOLDERDESCRIPTIONS\{1B3EA5DC-B587-4786-B4EF-BD1DC332AEAE}")27:T513,SetUnhandledExceptionFilter@KERNEL32.DLL at 00000000-00005816-22033-7-00C46F40 SetUnhandledExceptionFilter@KERNEL32.DLL at 00000000-00005816-22033-10-00C46CF0 SetUnhandledExceptionFilter@KERNEL32.DLL at 00000000-00005868-22530-7-01046F40 SetUnhandledExceptionFilter@KERNEL32.DLL at 00000000-00005868-22530-10-01046CF0 SetUnhandledExceptionFilter@KERNEL32.DLL at 00000000-00005944-23959-7-01216F40 SetUnhandledExceptionFilter@KERNEL32.DLL at 00000000-00005944-23959-10-01216CF0 SetUnhandledExceptionFilter@KERNEL32.DLL at 00000000-00006008-24920-4-00F415B4 SetUnhandledExceptionFilter@KERNEL32.DLL at 00000000-00006008-24920-6-00F26E1D SetUnhandledExceptionFilter@KERNEL32.DLL at 00000000-00006008-24920-2588-00EC3480 SetUnhandledExceptionFilter@KERNEL32.DLL at 00000000-00006008-24920-3175-00F26A74 SetUnhandledExceptionFilter@KERNEL32.DLL at 00000000-00006008-24920-4879-00F26BFA SetUnhandledExceptionFilter@KERNEL32.DLL at 00000000-00004644-28990-4-010E15B4 SetUnhandledExceptionFilter@KERNEL32.DLL at 00000000-00004644-28990-6-010C6E1D SetUnhandledExceptionFilter@KERNEL32.DLL at 00000000-00004644-28990-2592-01063480 SetUnhandledExceptionFilter@KERNEL32.DLL at 00000000-00004644-28990-3175-010C6A74 SetUnhandledExceptionFilter@KERNEL32.DLL at 00000000-00004644-28990-4876-010C6BFA28:T131e,Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00005816-22033-15-00C41F90 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00005816-22033-15-00C41F90 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00005816-22033-16-00C444B9 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00005816-22033-16-00C444B9 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00005816-22033-22-00C4681F Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00005816-22033-22-00C4681F Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00005816-22033-26-00C424E0 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00005816-22033-26-00C424E0 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00005816-22033-29-00C452B6 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00005816-22033-29-00C452B6 Assembly shows XOR instruction xor eax esp in Stream UID: 00000000-00005816-22033-31-00C42390 Assembly shows XOR instruction xor ecx esp in Stream UID: 00000000-00005816-22033-31-00C42390 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00005816-22033-33-00C42F1D Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00005816-22033-33-00C42F1D Assembly shows XOR instruction xor eax esp in Stream UID: 00000000-00005816-22033-36-00C43BA2 Assembly shows XOR instruction xor ecx esp in Stream UID: 00000000-00005816-22033-36-00C43BA2 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00005816-22033-37-00C43FEF Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00005816-22033-37-00C43FEF Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00005816-22033-40-00C42267 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00005816-22033-40-00C42267 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00005816-22033-41-00C46495 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00005816-22033-41-00C46495 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00005816-22033-42-00C4202A Assembly shows XOR instruction xor eax 01h in Stream UID: 00000000-00005816-22033-42-00C4202A Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00005816-22033-42-00C4202A Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00005816-22033-43-00C41AE8 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00005816-22033-43-00C41AE8 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00005816-22033-44-00C42AAC Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00005816-22033-44-00C42AAC Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00005816-22033-52-00C44EFD Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00005816-22033-52-00C44EFD Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00005816-22033-57-00C46298 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00005816-22033-57-00C46298 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00005816-22033-59-00C4621E Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00005816-22033-59-00C4621E Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00005816-22033-60-00C4597D Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00005816-22033-60-00C4597D Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00005816-22033-62-00C455A0 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00005816-22033-62-00C455A0 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00005816-22033-63-00C45467 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00005816-22033-63-00C45467 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00005816-22033-65-00C453A1 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00005816-22033-65-00C453A1 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00005816-22033-66-00C42630 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00005816-22033-66-00C42630 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00005816-22033-71-00C42CAA Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00005816-22033-71-00C42CAA Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00005816-22033-72-00C418A3 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00005816-22033-72-00C418A3 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00005816-22033-73-00C417EE Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00005816-22033-73-00C417EE29:Tdac3,Found XOR loop in file "FANBooster131.exe" at offset 1274152; code bytes = 30d0 Found XOR loop in file "FANBooster131.exe" at offset 1287765; code bytes = 30d0 Found XOR loop in file "FANBooster131.exe" at offset 1485168; code bytes = 30d0 Found XOR loop in file "FANBooster131.exe" at offset 1507775; code bytes = 30d0 Found XOR loop in file "FANBooster131.exe" at offset 1514635; code bytes = 30d0 Found XOR loop in file "FANBooster131.exe" at offset 1514887; code bytes = 30d0 Found XOR loop in file "FANBooster131.exe" at offset 1515347; code bytes = 30d0 Found XOR loop in file "FANBooster131.exe" at offset 1516553; code bytes = 30d0 Found XOR loop in file "FANBooster131.exe" at offset 1521461; code bytes = 30d0 Found XOR loop in file "FANBooster131.exe" at offset 1522625; code bytes = 30d0 Found XOR loop in file "FANBooster131.exe" at offset 1538921; code bytes = 30d0 Found XOR loop in file "FANBooster131.exe" at offset 688249; code bytes = 33c1 Found XOR loop in file "FANBooster131.exe" at offset 688345; code bytes = 33c1 Found XOR loop in file "FANBooster131.exe" at offset 688444; code bytes = 33c1 Found XOR loop in file "FANBooster131.exe" at offset 688500; code bytes = 33c1 Found XOR loop in file "FANBooster131.exe" at offset 688526; code bytes = 33c1 Found XOR loop in file "FANBooster131.exe" at offset 688604; code bytes = 33c1 Found XOR loop in file "FANBooster131.exe" at offset 688747; code bytes = 33c1 Found XOR loop in file "FANBooster131.exe" at offset 688843; code bytes = 33c1 Found XOR loop in file "FANBooster131.exe" at offset 689850; code bytes = 33c1 Found XOR loop in file "FANBooster131.exe" at offset 690446; code bytes = 33c1 Found XOR loop in file "FANBooster131.exe" at offset 764137; code bytes = 33c1 Found XOR loop in file "FANBooster131.exe" at offset 817238; code bytes = 33c1 Found XOR loop in file "FANBooster131.exe" at offset 817472; code bytes = 33c1 Found XOR loop in file "FANBooster131.exe" at offset 909588; code bytes = 33c1 Found XOR loop in file "FANBooster131.exe" at offset 924330; code bytes = 33c1 Found XOR loop in file "FANBooster131.exe" at offset 942350; code bytes = 33c1 Found XOR loop in file "FANBooster131.exe" at offset 948128; code bytes = 33c1 Found XOR loop in file "FANBooster131.exe" at offset 953465; code bytes = 33c1 Found XOR loop in file "FANBooster131.exe" at offset 953616; code bytes = 33c1 Found XOR loop in file "FANBooster131.exe" at offset 969842; code bytes = 33c1 Found XOR loop in file "FANBooster131.exe" at offset 971092; code bytes = 33c1 Found XOR loop in file "FANBooster131.exe" at offset 983876; code bytes = 33c1 Found XOR loop in file "FANBooster131.exe" at offset 985045; code bytes = 33c1 Found XOR loop in file "FANBooster131.exe" at offset 985160; code bytes = 33c1 Found XOR loop in file "FANBooster131.exe" at offset 989471; code bytes = 33c1 Found XOR loop in file "FANBooster131.exe" at offset 989786; code bytes = 33c1 Found XOR loop in file "FANBooster131.exe" at offset 990362; code bytes = 33c1 Found XOR loop in file "FANBooster131.exe" at offset 992172; code bytes = 33c1 Found XOR loop in file "FANBooster131.exe" at offset 992479; code bytes = 33c1 Found XOR loop in file "FANBooster131.exe" at offset 992865; code bytes = 33c1 Found XOR loop in file "FANBooster131.exe" at offset 992957; code bytes = 33c1 Found XOR loop in file "FANBooster131.exe" at offset 993612; code bytes = 33c1 Found XOR loop in file "FANBooster131.exe" at offset 995617; code bytes = 33c1 Found XOR loop in file "FANBooster131.exe" at offset 999815; code bytes = 33c1 Found XOR loop in file "FANBooster131.exe" at offset 1000389; code bytes = 33c1 Found XOR loop in file "FANBooster131.exe" at offset 1001271; code bytes = 33c1 Found XOR loop in file "FANBooster131.exe" at offset 1001375; code bytes = 33c1 Found XOR loop in file "FANBooster131.exe" at offset 1002055; code bytes = 33c1 Found XOR loop in file "FANBooster131.exe" at offset 1002170; code bytes = 33c1 Found XOR loop in file "FANBooster131.exe" at offset 1006463; code bytes = 33c1 Found XOR loop in file "FANBooster131.exe" at offset 1007340; code bytes = 33c1 Found XOR loop in file "FANBooster131.exe" at offset 1027259; code bytes = 33c1 Found XOR loop in file "FANBooster131.exe" at offset 1033356; code bytes = 33c1 Found XOR loop in file "FANBooster131.exe" at offset 1034159; code bytes = 33c1 Found XOR loop in file "FANBooster131.exe" at offset 1289436; code bytes = 33c1 Found XOR loop in file "FANBooster131.exe" at offset 1441388; code bytes = 33c1 Found XOR loop in file "FANBooster131.exe" at offset 1505345; code bytes = 33c1 Found XOR loop in file "FANBooster131.exe" at offset 1507059; code bytes = 33c1 Found XOR loop in file "FANBooster131.exe" at offset 1513223; code bytes = 33c1 Found XOR loop in file "FANBooster131.exe" at offset 735579; code bytes = 8030 Found XOR loop in file "FANBooster131.exe" at offset 735612; code bytes = 8030 Found XOR loop in file "FANBooster131.exe" at offset 735686; code bytes = 8030 Found XOR loop in file "FANBooster131.exe" at offset 735764; code bytes = 8030 Found XOR loop in file "FANBooster131.exe" at offset 735781; code bytes = 8030 Found XOR loop in file "FANBooster131.exe" at offset 735802; code bytes = 8030 Found XOR loop in file "FANBooster131.exe" at offset 735842; code bytes = 8030 Found XOR loop in file "FANBooster131.exe" at offset 735923; code bytes = 8030 Found XOR loop in file "FANBooster131.exe" at offset 735946; code bytes = 8030 Found XOR loop in file "FANBooster131.exe" at offset 735963; code bytes = 8030 Found XOR loop in file "FANBooster131.exe" at offset 736030; code bytes = 8030 Found XOR loop in file "FANBooster131.exe" at offset 736068; code bytes = 8030 Found XOR loop in file "FANBooster131.exe" at offset 736997; code bytes = 8030 Found XOR loop in file "FANBooster131.exe" at offset 737018; code bytes = 8030 Found XOR loop in file "FANBooster131.exe" at offset 833270; code bytes = 8030 Found XOR loop in file "FANBooster131.exe" at offset 838380; code bytes = 8030 Found XOR loop in file "FANBooster131.exe" at offset 845494; code bytes = 8030 Found XOR loop in file "FANBooster131.exe" at offset 845523; code bytes = 8030 Found XOR loop in file "FANBooster131.exe" at offset 857223; code bytes = 8030 Found XOR loop in file "FANBooster131.exe" at offset 869347; code bytes = 8030 Found XOR loop in file "FANBooster131.exe" at offset 869366; code bytes = 8030 Found XOR loop in file "FANBooster131.exe" at offset 869863; code bytes = 8030 Found XOR loop in file "FANBooster131.exe" at offset 925121; code bytes = 8030 Found XOR loop in file "FANBooster131.exe" at offset 925175; code bytes = 8030 Found XOR loop in file "FANBooster131.exe" at offset 925196; code bytes = 8030 Found XOR loop in file "FANBooster131.exe" at offset 925223; code bytes = 8030 Found XOR loop in file "FANBooster131.exe" at offset 925256; code bytes = 8030 Found XOR loop in file "FANBooster131.exe" at offset 925280; code bytes = 8030 Found XOR loop in file "FANBooster131.exe" at offset 925297; code bytes = 8030 Found XOR loop in file "FANBooster131.exe" at offset 925319; code bytes = 8030 Found XOR loop in file "FANBooster131.exe" at offset 925429; code bytes = 8030 Found XOR loop in file "FANBooster131.exe" at offset 925471; code bytes = 8030 Found XOR loop in file "FANBooster131.exe" at offset 1337260; code bytes = 8030 Found XOR loop in file "FANBooster131.exe" at offset 1349610; code bytes = 8030 Found XOR loop in file "FANBooster131.exe" at offset 1362066; code bytes = 8030 Found XOR loop in file "FANBooster131.exe" at offset 1495860; code bytes = 8030 Found XOR loop in file "FANBooster131.exe" at offset 1517374; code bytes = 8030 Found XOR loop in file "FANBooster131.exe" at offset 1521442; code bytes = 8030 Found XOR loop in file "FANBooster131.exe" at offset 1522614; code bytes = 8030 Found XOR loop in file "FANBooster131.exe" at offset 1523404; code bytes = 8030 Found XOR loop in file "FANBooster131.exe" at offset 1537116; code bytes = 8030 Found XOR loop in file "FANBooster131.exe" at offset 1538890; code bytes = 8030 Found XOR loop in file "cZ2SE56.exe" at offset 142518; code bytes = 30d0 Found XOR loop in file "cZ2SE56.exe" at offset 223622; code bytes = 30d0 Found XOR loop in file "cZ2SE56.exe" at offset 228776; code bytes = 30d0 Found XOR loop in file "cZ2SE56.exe" at offset 230907; code bytes = 30d0 Found XOR loop in file "cZ2SE56.exe" at offset 241625; code bytes = 30d0 Found XOR loop in file "cZ2SE56.exe" at offset 279322; code bytes = 30d0 Found XOR loop in file "cZ2SE56.exe" at offset 293226; code bytes = 30d0 Found XOR loop in file "cZ2SE56.exe" at offset 339377; code bytes = 30d0 Found XOR loop in file "cZ2SE56.exe" at offset 342180; code bytes = 30d0 Found XOR loop in file "cZ2SE56.exe" at offset 348129; code bytes = 30d0 Found XOR loop in file "cZ2SE56.exe" at offset 355611; code bytes = 30d0 Found XOR loop in file "cZ2SE56.exe" at offset 358839; code bytes = 30d0 Found XOR loop in file "cZ2SE56.exe" at offset 581072; code bytes = 30d0 Found XOR loop in file "cZ2SE56.exe" at offset 759428; code bytes = 30d0 Found XOR loop in file "cZ2SE56.exe" at offset 816175; code bytes = 30d0 Found XOR loop in file "cZ2SE56.exe" at offset 925010; code bytes = 30d0 Found XOR loop in file "cZ2SE56.exe" at offset 946189; code bytes = 30d0 Found XOR loop in file "cZ2SE56.exe" at offset 1011664; code bytes = 30d0 Found XOR loop in file "cZ2SE56.exe" at offset 1029188; code bytes = 30d0 Found XOR loop in file "cZ2SE56.exe" at offset 1058534; code bytes = 30d0 Found XOR loop in file "cZ2SE56.exe" at offset 1080453; code bytes = 30d0 Found XOR loop in file "cZ2SE56.exe" at offset 1086206; code bytes = 30d0 Found XOR loop in file "cZ2SE56.exe" at offset 1167993; code bytes = 30d0 Found XOR loop in file "cZ2SE56.exe" at offset 1174780; code bytes = 30d0 Found XOR loop in file "cZ2SE56.exe" at offset 1233452; code bytes = 30d0 Found XOR loop in file "cZ2SE56.exe" at offset 1277870; code bytes = 30d0 Found XOR loop in file "cZ2SE56.exe" at offset 1282074; code bytes = 30d0 Found XOR loop in file "cZ2SE56.exe" at offset 1283625; code bytes = 30d0 Found XOR loop in file "cZ2SE56.exe" at offset 1358480; code bytes = 30d0 Found XOR loop in file "cZ2SE56.exe" at offset 1467136; code bytes = 30d0 Found XOR loop in file "cZ2SE56.exe" at offset 26031; code bytes = 33c1 Found XOR loop in file "cZ2SE56.exe" at offset 164105; code bytes = 33c1 Found XOR loop in file "cZ2SE56.exe" at offset 230228; code bytes = 33c1 Found XOR loop in file "cZ2SE56.exe" at offset 342845; code bytes = 33c1 Found XOR loop in file "cZ2SE56.exe" at offset 540344; code bytes = 33c1 Found XOR loop in file "cZ2SE56.exe" at offset 567251; code bytes = 33c1 Found XOR loop in file "cZ2SE56.exe" at offset 742115; code bytes = 33c1 Found XOR loop in file "cZ2SE56.exe" at offset 764293; code bytes = 33c1 Found XOR loop in file "cZ2SE56.exe" at offset 871103; code bytes = 33c1 Found XOR loop in file "cZ2SE56.exe" at offset 892133; code bytes = 33c1 Found XOR loop in file "cZ2SE56.exe" at offset 917469; code bytes = 33c1 Found XOR loop in file "cZ2SE56.exe" at offset 1004634; code bytes = 33c1 Found XOR loop in file "cZ2SE56.exe" at offset 1233115; code bytes = 33c1 Found XOR loop in file "cZ2SE56.exe" at offset 1237219; code bytes = 33c1 Found XOR loop in file "cZ2SE56.exe" at offset 1273525; code bytes = 33c1 Found XOR loop in file "cZ2SE56.exe" at offset 1331677; code bytes = 33c1 Found XOR loop in file "cZ2SE56.exe" at offset 1446115; code bytes = 33c1 Found XOR loop in file "cZ2SE56.exe" at offset 1524665; code bytes = 33c1 Found XOR loop in file "cZ2SE56.exe" at offset 90891; code bytes = 8030 Found XOR loop in file "cZ2SE56.exe" at offset 102399; code bytes = 8030 Found XOR loop in file "cZ2SE56.exe" at offset 103104; code bytes = 8030 Found XOR loop in file "cZ2SE56.exe" at offset 191360; code bytes = 8030 Found XOR loop in file "cZ2SE56.exe" at offset 224684; code bytes = 8030 Found XOR loop in file "cZ2SE56.exe" at offset 262634; code bytes = 8030 Found XOR loop in file "cZ2SE56.exe" at offset 338312; code bytes = 8030 Found XOR loop in file "cZ2SE56.exe" at offset 389671; code bytes = 8030 Found XOR loop in file "cZ2SE56.exe" at offset 556332; code bytes = 8030 Found XOR loop in file "cZ2SE56.exe" at offset 556616; code bytes = 8030 Found XOR loop in file "cZ2SE56.exe" at offset 660325; code bytes = 8030 Found XOR loop in file "cZ2SE56.exe" at offset 669674; code bytes = 8030 Found XOR loop in file "cZ2SE56.exe" at offset 684790; code bytes = 8030 Found XOR loop in file "cZ2SE56.exe" at offset 806594; code bytes = 8030 Found XOR loop in file "cZ2SE56.exe" at offset 858705; code bytes = 8030 Found XOR loop in file "cZ2SE56.exe" at offset 1094379; code bytes = 8030 Found XOR loop in file "cZ2SE56.exe" at offset 1156464; code bytes = 8030 Found XOR loop in file "cZ2SE56.exe" at offset 1157199; code bytes = 8030 Found XOR loop in file "cZ2SE56.exe" at offset 1159225; code bytes = 8030 Found XOR loop in file "cZ2SE56.exe" at offset 1177397; code bytes = 8030 Found XOR loop in file "cZ2SE56.exe" at offset 1317051; code bytes = 8030 Found XOR loop in file "cZ2SE56.exe" at offset 1366291; code bytes = 8030 Found XOR loop in file "cZ2SE56.exe" at offset 1427527; code bytes = 8030 Found XOR loop in file "nO2Ue30.exe" at offset 243532; code bytes = 30d0 Found XOR loop in file "nO2Ue30.exe" at offset 246335; code bytes = 30d0 Found XOR loop in file "nO2Ue30.exe" at offset 252284; code bytes = 30d0 Found XOR loop in file "nO2Ue30.exe" at offset 259766; code bytes = 30d0 Found XOR loop in file "nO2Ue30.exe" at offset 262986; code bytes = 30d0 Found XOR loop in file "nO2Ue30.exe" at offset 485106; code bytes = 30d0 Found XOR loop in file "nO2Ue30.exe" at offset 663380; code bytes = 30d0 Found XOR loop in file "nO2Ue30.exe" at offset 720102; code bytes = 30d0 Found XOR loop in file "nO2Ue30.exe" at offset 828871; code bytes = 30d0 Found XOR loop in file "nO2Ue30.exe" at offset 850050; code bytes = 30d0 Found XOR loop in file "nO2Ue30.exe" at offset 915492; code bytes = 30d0 Found XOR loop in file "nO2Ue30.exe" at offset 932992; code bytes = 30d0 Found XOR loop in file "nO2Ue30.exe" at offset 962330; code bytes = 30d0 Found XOR loop in file "nO2Ue30.exe" at offset 984241; code bytes = 30d0 Found XOR loop in file "nO2Ue30.exe" at offset 989994; code bytes = 30d0 Found XOR loop in file "nO2Ue30.exe" at offset 26031; code bytes = 33c1 Found XOR loop in file "nO2Ue30.exe" at offset 247000; code bytes = 33c1 Found XOR loop in file "nO2Ue30.exe" at offset 444403; code bytes = 33c1 Found XOR loop in file "nO2Ue30.exe" at offset 471285; code bytes = 33c1 Found XOR loop in file "nO2Ue30.exe" at offset 646075; code bytes = 33c1 Found XOR loop in file "nO2Ue30.exe" at offset 668228; code bytes = 33c1 Found XOR loop in file "nO2Ue30.exe" at offset 774997; code bytes = 33c1 Found XOR loop in file "nO2Ue30.exe" at offset 796019; code bytes = 33c1 Found XOR loop in file "nO2Ue30.exe" at offset 821330; code bytes = 33c1 Found XOR loop in file "nO2Ue30.exe" at offset 908462; code bytes = 33c1 Found XOR loop in file "nO2Ue30.exe" at offset 1034681; code bytes = 33c1 Found XOR loop in file "nO2Ue30.exe" at offset 90891; code bytes = 8030 Found XOR loop in file "nO2Ue30.exe" at offset 102399; code bytes = 8030 Found XOR loop in file "nO2Ue30.exe" at offset 103104; code bytes = 8030 Found XOR loop in file "nO2Ue30.exe" at offset 199444; code bytes = 8030 Found XOR loop in file "nO2Ue30.exe" at offset 242467; code bytes = 8030 Found XOR loop in file "nO2Ue30.exe" at offset 293802; code bytes = 8030 Found XOR loop in file "nO2Ue30.exe" at offset 460383; code bytes = 8030 Found XOR loop in file "nO2Ue30.exe" at offset 460667; code bytes = 8030 Found XOR loop in file "nO2Ue30.exe" at offset 564318; code bytes = 8030 Found XOR loop in file "nO2Ue30.exe" at offset 573667; code bytes = 8030 Found XOR loop in file "nO2Ue30.exe" at offset 588783; code bytes = 8030 Found XOR loop in file "nO2Ue30.exe" at offset 710521; code bytes = 8030 Found XOR loop in file "nO2Ue30.exe" at offset 762599; code bytes = 8030 Found XOR loop in file "nO2Ue30.exe" at offset 998150; code bytes = 8030 Found XOR loop in file "4OG898Ow.exe" at offset 72323; code bytes = 30d0 Found XOR loop in file "4OG898Ow.exe" at offset 122082; code bytes = 30d0 Found XOR loop in file "4OG898Ow.exe" at offset 376916; code bytes = 30d0 Found XOR loop in file "4OG898Ow.exe" at offset 376937; code bytes = 30d0 Found XOR loop in file "4OG898Ow.exe" at offset 691258; code bytes = 30d0 Found XOR loop in file "4OG898Ow.exe" at offset 887915; code bytes = 30d0 Found XOR loop in file "4OG898Ow.exe" at offset 888929; code bytes = 30d0 Found XOR loop in file "4OG898Ow.exe" at offset 891921; code bytes = 30d0 Found XOR loop in file "4OG898Ow.exe" at offset 900833; code bytes = 30d0 Found XOR loop in file "4OG898Ow.exe" at offset 913601; code bytes = 30d0 Found XOR loop in file "4OG898Ow.exe" at offset 130790; code bytes = 33c1 Found XOR loop in file "4OG898Ow.exe" at offset 140043; code bytes = 33c1 Found XOR loop in file "4OG898Ow.exe" at offset 140172; code bytes = 33c1 Found XOR loop in file "4OG898Ow.exe" at offset 351053; code bytes = 33c1 Found XOR loop in file "4OG898Ow.exe" at offset 463773; code bytes = 33c1 Found XOR loop in file "4OG898Ow.exe" at offset 463848; code bytes = 33c1 Found XOR loop in file "4OG898Ow.exe" at offset 597022; code bytes = 33c1 Found XOR loop in file "4OG898Ow.exe" at offset 701978; code bytes = 33c1 Found XOR loop in file "4OG898Ow.exe" at offset 709317; code bytes = 33c1 Found XOR loop in file "4OG898Ow.exe" at offset 709765; code bytes = 33c1 Found XOR loop in file "4OG898Ow.exe" at offset 710341; code bytes = 33c1 Found XOR loop in file "4OG898Ow.exe" at offset 710789; code bytes = 33c1 Found XOR loop in file "4OG898Ow.exe" at offset 895349; code bytes = 33c1 Found XOR loop in file "4OG898Ow.exe" at offset 905289; code bytes = 33c1 Found XOR loop in file "4OG898Ow.exe" at offset 1330; code bytes = 8030 Found XOR loop in file "4OG898Ow.exe" at offset 1959; code bytes = 8030 Found XOR loop in file "4OG898Ow.exe" at offset 232120; code bytes = 8030 Found XOR loop in file "4OG898Ow.exe" at offset 356589; code bytes = 8030 Found XOR loop in file "4OG898Ow.exe" at offset 674772; code bytes = 8030 Found XOR loop in file "4OG898Ow.exe" at offset 687130; code bytes = 8030 Found XOR loop in file "4OG898Ow.exe" at offset 887876; code bytes = 8030 Found XOR loop in file "4OG898Ow.exe" at offset 890824; code bytes = 8030 Found XOR loop in file "4OG898Ow.exe" at offset 894056; code bytes = 8030 Found XOR loop in file "4OG898Ow.exe" at offset 913562; code bytes = 8030 Found XOR loop in file "zW9af77.exe" at offset 273895; code bytes = 30d0 Found XOR loop in file "zW9af77.exe" at offset 329386; code bytes = 30d0 Found XOR loop in file "zW9af77.exe" at offset 390149; code bytes = 30d0 Found XOR loop in file "zW9af77.exe" at offset 568326; code bytes = 30d0 Found XOR loop in file "zW9af77.exe" at offset 625016; code bytes = 30d0 Found XOR loop in file "zW9af77.exe" at offset 733745; code bytes = 30d0 Found XOR loop in file "zW9af77.exe" at offset 754899; code bytes = 30d0 Found XOR loop in file "zW9af77.exe" at offset 820308; code bytes = 30d0 Found XOR loop in file "zW9af77.exe" at offset 837808; code bytes = 30d0 Found XOR loop in file "zW9af77.exe" at offset 893442; code bytes = 30d0 Found XOR loop in file "zW9af77.exe" at offset 26031; code bytes = 33c1 Found XOR loop in file "zW9af77.exe" at offset 147919; code bytes = 33c1 Found XOR loop in file "zW9af77.exe" at offset 349454; code bytes = 33c1 Found XOR loop in file "zW9af77.exe" at offset 376328; code bytes = 33c1 Found XOR loop in file "zW9af77.exe" at offset 551029; code bytes = 33c1 Found XOR loop in file "zW9af77.exe" at offset 573174; code bytes = 33c1 Found XOR loop in file "zW9af77.exe" at offset 679887; code bytes = 33c1 Found XOR loop in file "zW9af77.exe" at offset 700901; code bytes = 33c1 Found XOR loop in file "zW9af77.exe" at offset 726204; code bytes = 33c1 Found XOR loop in file "zW9af77.exe" at offset 813286; code bytes = 33c1 Found XOR loop in file "zW9af77.exe" at offset 908217; code bytes = 33c1 Found XOR loop in file "zW9af77.exe" at offset 90891; code bytes = 8030 Found XOR loop in file "zW9af77.exe" at offset 102399; code bytes = 8030 Found XOR loop in file "zW9af77.exe" at offset 103104; code bytes = 8030 Found XOR loop in file "zW9af77.exe" at offset 185308; code bytes = 8030 Found XOR loop in file "zW9af77.exe" at offset 288876; code bytes = 8030 Found XOR loop in file "zW9af77.exe" at offset 365426; code bytes = 8030 Found XOR loop in file "zW9af77.exe" at offset 365710; code bytes = 8030 Found XOR loop in file "zW9af77.exe" at offset 469321; code bytes = 8030 Found XOR loop in file "zW9af77.exe" at offset 478653; code bytes = 8030 Found XOR loop in file "zW9af77.exe" at offset 493761; code bytes = 8030 Found XOR loop in file "zW9af77.exe" at offset 615443; code bytes = 8030 Found XOR loop in file "zW9af77.exe" at offset 667505; code bytes = 8030 Found XOR loop in file "zW9af77.exe" at offset 885179; code bytes = 8030 Found XOR loop in file "zW9af77.exe" at offset 901833; code bytes = 8030 Found XOR loop in file "2IW9992.exe" at offset 244510; code bytes = 30d0 Found XOR loop in file "2IW9992.exe" at offset 463521; code bytes = 30d0 Found XOR loop in file "2IW9992.exe" at offset 467657; code bytes = 30d0 Found XOR loop in file "2IW9992.exe" at offset 468945; code bytes = 30d0 Found XOR loop in file "2IW9992.exe" at offset 469979; code bytes = 30d0 Found XOR loop in file "2IW9992.exe" at offset 470275; code bytes = 30d0 Found XOR loop in file "2IW9992.exe" at offset 471735; code bytes = 30d0 Found XOR loop in file "2IW9992.exe" at offset 43966; code bytes = 33c1 Found XOR loop in file "2IW9992.exe" at offset 66836; code bytes = 33c1 Found XOR loop in file "2IW9992.exe" at offset 237488; code bytes = 33c1 Found XOR loop in file "2IW9992.exe" at offset 299008; code bytes = 33c1 Found XOR loop in file "2IW9992.exe" at offset 462747; code bytes = 33c1 Found XOR loop in file "2IW9992.exe" at offset 195580; code bytes = 8030 Found XOR loop in file "2IW9992.exe" at offset 207930; code bytes = 8030 Found XOR loop in file "2IW9992.exe" at offset 464074; code bytes = 8030 Found XOR loop in file "2IW9992.exe" at offset 467642; code bytes = 8030 Found XOR loop in file "2IW9992.exe" at offset 469960; code bytes = 8030 Found XOR loop in file "2IW9992.exe" at offset 470696; code bytes = 8030 Found XOR loop in file "2IW9992.exe" at offset 471840; code bytes = 8030 Found XOR loop in file "2IW9992.exe" at offset 474787; code bytes = 8030 Found XOR loop in file "2IW9992.exe" at offset 476003; code bytes = 8030 Found XOR loop in file "5UO2EL6.exe" at offset 276641; code bytes = 30d0 Found XOR loop in file "5UO2EL6.exe" at offset 280777; code bytes = 30d0 Found XOR loop in file "5UO2EL6.exe" at offset 282065; code bytes = 30d0 Found XOR loop in file "5UO2EL6.exe" at offset 283099; code bytes = 30d0 Found XOR loop in file "5UO2EL6.exe" at offset 283395; code bytes = 30d0 Found XOR loop in file "5UO2EL6.exe" at offset 284855; code bytes = 30d0 Found XOR loop in file "5UO2EL6.exe" at offset 43966; code bytes = 33c1 Found XOR loop in file "5UO2EL6.exe" at offset 66836; code bytes = 33c1 Found XOR loop in file "5UO2EL6.exe" at offset 275867; code bytes = 33c1 Found XOR loop in file "5UO2EL6.exe" at offset 195580; code bytes = 8030 Found XOR loop in file "5UO2EL6.exe" at offset 207930; code bytes = 8030 Found XOR loop in file "5UO2EL6.exe" at offset 265591; code bytes = 8030 Found XOR loop in file "5UO2EL6.exe" at offset 277194; code bytes = 8030 Found XOR loop in file "5UO2EL6.exe" at offset 280762; code bytes = 8030 Found XOR loop in file "5UO2EL6.exe" at offset 283080; code bytes = 8030 Found XOR loop in file "5UO2EL6.exe" at offset 283816; code bytes = 8030 Found XOR loop in file "5UO2EL6.exe" at offset 284960; code bytes = 8030 Found XOR loop in file "5UO2EL6.exe" at offset 287907; code bytes = 8030 Found XOR loop in file "5UO2EL6.exe" at offset 289123; code bytes = 8030 Found XOR loop in file "3up60Ma.exe" at offset 1293; code bytes = 30d0 Found XOR loop in file "3up60Ma.exe" at offset 1173; code bytes = 8030 Found XOR loop in file "3up60Ma.exe" at offset 24690; code bytes = 8030 Found XOR loop in file "DISMHOST.EXE.6A9813CA.bin" at offset 76665; code bytes = 30d0 Found XOR loop in file "DISMHOST.EXE.6A9813CA.bin" at offset 77648; code bytes = 8030 Found XOR loop in file "DISMHOST.EXE.6A9813CA.bin" at offset 77788; code bytes = 8030 Found XOR loop in file "DISMHOST.EXE.6A9813CA.bin" at offset 78978; code bytes = 8030 Found XOR loop in file "1sW61HT2.exe" at offset 1274152; code bytes = 30d0 Found XOR loop in file "1sW61HT2.exe" at offset 1287765; code bytes = 30d0 Found XOR loop in file "1sW61HT2.exe" at offset 1485168; code bytes = 30d0 Found XOR loop in file "1sW61HT2.exe" at offset 1507775; code bytes = 30d0 Found XOR loop in file "1sW61HT2.exe" at offset 1514635; code bytes = 30d0 Found XOR loop in file "1sW61HT2.exe" at offset 1514887; code bytes = 30d0 Found XOR loop in file "1sW61HT2.exe" at offset 1515347; code bytes = 30d0 Found XOR loop in file "1sW61HT2.exe" at offset 1516553; code bytes = 30d0 Found XOR loop in file "1sW61HT2.exe" at offset 1521461; code bytes = 30d0 Found XOR loop in file "1sW61HT2.exe" at offset 1522625; code bytes = 30d0 Found XOR loop in file "1sW61HT2.exe" at offset 1538921; code bytes = 30d0 Found XOR loop in file "1sW61HT2.exe" at offset 688249; code bytes = 33c1 Found XOR loop in file "1sW61HT2.exe" at offset 688345; code bytes = 33c1 Found XOR loop in file "1sW61HT2.exe" at offset 688444; code bytes = 33c1 Found XOR loop in file "1sW61HT2.exe" at offset 688500; code bytes = 33c1 Found XOR loop in file "1sW61HT2.exe" at offset 688526; code bytes = 33c1 Found XOR loop in file "1sW61HT2.exe" at offset 688604; code bytes = 33c1 Found XOR loop in file "1sW61HT2.exe" at offset 688747; code bytes = 33c1 Found XOR loop in file "1sW61HT2.exe" at offset 688843; code bytes = 33c1 Found XOR loop in file "1sW61HT2.exe" at offset 689850; code bytes = 33c1 Found XOR loop in file "1sW61HT2.exe" at offset 690446; code bytes = 33c1 Found XOR loop in file "1sW61HT2.exe" at offset 764137; code bytes = 33c1 Found XOR loop in file "1sW61HT2.exe" at offset 817238; code bytes = 33c1 Found XOR loop in file "1sW61HT2.exe" at offset 817472; code bytes = 33c1 Found XOR loop in file "1sW61HT2.exe" at offset 909588; code bytes = 33c1 Found XOR loop in file "1sW61HT2.exe" at offset 924330; code bytes = 33c1 Found XOR loop in file "1sW61HT2.exe" at offset 942350; code bytes = 33c1 Found XOR loop in file "1sW61HT2.exe" at offset 948128; code bytes = 33c1 Found XOR loop in file "1sW61HT2.exe" at offset 953465; code bytes = 33c1 Found XOR loop in file "1sW61HT2.exe" at offset 953616; code bytes = 33c1 Found XOR loop in file "1sW61HT2.exe" at offset 969842; code bytes = 33c1 Found XOR loop in file "1sW61HT2.exe" at offset 971092; code bytes = 33c1 Found XOR loop in file "1sW61HT2.exe" at offset 983876; code bytes = 33c1 Found XOR loop in file "1sW61HT2.exe" at offset 985045; code bytes = 33c1 Found XOR loop in file "1sW61HT2.exe" at offset 985160; code bytes = 33c1 Found XOR loop in file "1sW61HT2.exe" at offset 989471; code bytes = 33c1 Found XOR loop in file "1sW61HT2.exe" at offset 989786; code bytes = 33c1 Found XOR loop in file "1sW61HT2.exe" at offset 990362; code bytes = 33c1 Found XOR loop in file "1sW61HT2.exe" at offset 992172; code bytes = 33c1 Found XOR loop in file "1sW61HT2.exe" at offset 992479; code bytes = 33c1 Found XOR loop in file "1sW61HT2.exe" at offset 992865; code bytes = 33c1 Found XOR loop in file "1sW61HT2.exe" at offset 992957; code bytes = 33c1 Found XOR loop in file "1sW61HT2.exe" at offset 993612; code bytes = 33c1 Found XOR loop in file "1sW61HT2.exe" at offset 995617; code bytes = 33c1 Found XOR loop in file "1sW61HT2.exe" at offset 999815; code bytes = 33c1 Found XOR loop in file "1sW61HT2.exe" at offset 1000389; code bytes = 33c1 Found XOR loop in file "1sW61HT2.exe" at offset 1001271; code bytes = 33c1 Found XOR loop in file "1sW61HT2.exe" at offset 1001375; code bytes = 33c1 Found XOR loop in file "1sW61HT2.exe" at offset 1002055; code bytes = 33c1 Found XOR loop in file "1sW61HT2.exe" at offset 1002170; code bytes = 33c1 Found XOR loop in file "1sW61HT2.exe" at offset 1006463; code bytes = 33c1 Found XOR loop in file "1sW61HT2.exe" at offset 1007340; code bytes = 33c1 Found XOR loop in file "1sW61HT2.exe" at offset 1027259; code bytes = 33c1 Found XOR loop in file "1sW61HT2.exe" at offset 1033356; code bytes = 33c1 Found XOR loop in file "1sW61HT2.exe" at offset 1034159; code bytes = 33c1 Found XOR loop in file "1sW61HT2.exe" at offset 1289436; code bytes = 33c1 Found XOR loop in file "1sW61HT2.exe" at offset 1441388; code bytes = 33c1 Found XOR loop in file "1sW61HT2.exe" at offset 1505345; code bytes = 33c1 Found XOR loop in file "1sW61HT2.exe" at offset 1507059; code bytes = 33c1 Found XOR loop in file "1sW61HT2.exe" at offset 1513223; code bytes = 33c1 Found XOR loop in file "1sW61HT2.exe" at offset 735579; code bytes = 8030 Found XOR loop in file "1sW61HT2.exe" at offset 735612; code bytes = 8030 Found XOR loop in file "1sW61HT2.exe" at offset 735686; code bytes = 8030 Found XOR loop in file "1sW61HT2.exe" at offset 735764; code bytes = 8030 Found XOR loop in file "1sW61HT2.exe" at offset 735781; code bytes = 8030 Found XOR loop in file "1sW61HT2.exe" at offset 735802; code bytes = 8030 Found XOR loop in file "1sW61HT2.exe" at offset 735842; code bytes = 8030 Found XOR loop in file "1sW61HT2.exe" at offset 735923; code bytes = 8030 Found XOR loop in file "1sW61HT2.exe" at offset 735946; code bytes = 8030 Found XOR loop in file "1sW61HT2.exe" at offset 735963; code bytes = 8030 Found XOR loop in file "1sW61HT2.exe" at offset 736030; code bytes = 8030 Found XOR loop in file "1sW61HT2.exe" at offset 736068; code bytes = 8030 Found XOR loop in file "1sW61HT2.exe" at offset 736997; code bytes = 8030 Found XOR loop in file "1sW61HT2.exe" at offset 737018; code bytes = 8030 Found XOR loop in file "1sW61HT2.exe" at offset 833270; code bytes = 8030 Found XOR loop in file "1sW61HT2.exe" at offset 838380; code bytes = 8030 Found XOR loop in file "1sW61HT2.exe" at offset 845494; code bytes = 8030 Found XOR loop in file "1sW61HT2.exe" at offset 845523; code bytes = 8030 Found XOR loop in file "1sW61HT2.exe" at offset 857223; code bytes = 8030 Found XOR loop in file "1sW61HT2.exe" at offset 869347; code bytes = 8030 Found XOR loop in file "1sW61HT2.exe" at offset 869366; code bytes = 8030 Found XOR loop in file "1sW61HT2.exe" at offset 869863; code bytes = 8030 Found XOR loop in file "1sW61HT2.exe" at offset 925121; code bytes = 8030 Found XOR loop in file "1sW61HT2.exe" at offset 925175; code bytes = 8030 Found XOR loop in file "1sW61HT2.exe" at offset 925196; code bytes = 8030 Found XOR loop in file "1sW61HT2.exe" at offset 925223; code bytes = 8030 Found XOR loop in file "1sW61HT2.exe" at offset 925256; code bytes = 8030 Found XOR loop in file "1sW61HT2.exe" at offset 925280; code bytes = 8030 Found XOR loop in file "1sW61HT2.exe" at offset 925297; code bytes = 8030 Found XOR loop in file "1sW61HT2.exe" at offset 925319; code bytes = 8030 Found XOR loop in file "1sW61HT2.exe" at offset 925429; code bytes = 8030 Found XOR loop in file "1sW61HT2.exe" at offset 925471; code bytes = 8030 Found XOR loop in file "1sW61HT2.exe" at offset 1337260; code bytes = 8030 Found XOR loop in file "1sW61HT2.exe" at offset 1349610; code bytes = 8030 Found XOR loop in file "1sW61HT2.exe" at offset 1362066; code bytes = 8030 Found XOR loop in file "1sW61HT2.exe" at offset 1495860; code bytes = 8030 Found XOR loop in file "1sW61HT2.exe" at offset 1517374; code bytes = 8030 Found XOR loop in file "1sW61HT2.exe" at offset 1521442; code bytes = 8030 Found XOR loop in file "1sW61HT2.exe" at offset 1522614; code bytes = 8030 Found XOR loop in file "1sW61HT2.exe" at offset 1523404; code bytes = 8030 Found XOR loop in file "1sW61HT2.exe" at offset 1537116; code bytes = 8030 Found XOR loop in file "1sW61HT2.exe" at offset 1538890; code bytes = 8030 Found XOR loop in file "OfficeTrackerNMP131.exe" at offset 1274152; code bytes = 30d0 Found XOR loop in file "OfficeTrackerNMP131.exe" at offset 1287765; code bytes = 30d0 Found XOR loop in file "OfficeTrackerNMP131.exe" at offset 1485168; code bytes = 30d0 Found XOR loop in file "OfficeTrackerNMP131.exe" at offset 1507775; code bytes = 30d0 Found XOR loop in file "OfficeTrackerNMP131.exe" at offset 1514635; code bytes = 30d0 Found XOR loop in file "OfficeTrackerNMP131.exe" at offset 1514887; code bytes = 30d0 Found XOR loop in file "OfficeTrackerNMP131.exe" at offset 1515347; code bytes = 30d0 Found XOR loop in file "OfficeTrackerNMP131.exe" at offset 1516553; code bytes = 30d0 Found XOR loop in file "OfficeTrackerNMP131.exe" at offset 1521461; code bytes = 30d0 Found XOR loop in file "OfficeTrackerNMP131.exe" at offset 1522625; code bytes = 30d0 Found XOR loop in file "OfficeTrackerNMP131.exe" at offset 1538921; code bytes = 30d0 Found XOR loop in file "OfficeTrackerNMP131.exe" at offset 688249; code bytes = 33c1 Found XOR loop in file "OfficeTrackerNMP131.exe" at offset 688345; code bytes = 33c1 Found XOR loop in file "OfficeTrackerNMP131.exe" at offset 688444; code bytes = 33c1 Found XOR loop in file "OfficeTrackerNMP131.exe" at offset 688500; code bytes = 33c1 Found XOR loop in file "OfficeTrackerNMP131.exe" at offset 688526; code bytes = 33c1 Found XOR loop in file "OfficeTrackerNMP131.exe" at offset 688604; code bytes = 33c1 Found XOR loop in file "OfficeTrackerNMP131.exe" at offset 688747; code bytes = 33c1 Found XOR loop in file "OfficeTrackerNMP131.exe" at offset 688843; code bytes = 33c1 Found XOR loop in file "OfficeTrackerNMP131.exe" at offset 689850; code bytes = 33c1 Found XOR loop in file "OfficeTrackerNMP131.exe" at offset 690446; code bytes = 33c1 Found XOR loop in file "OfficeTrackerNMP131.exe" at offset 764137; code bytes = 33c1 Found XOR loop in file "OfficeTrackerNMP131.exe" at offset 817238; code bytes = 33c1 Found XOR loop in file "OfficeTrackerNMP131.exe" at offset 817472; code bytes = 33c1 Found XOR loop in file "OfficeTrackerNMP131.exe" at offset 909588; code bytes = 33c1 Found XOR loop in file "OfficeTrackerNMP131.exe" at offset 924330; code bytes = 33c1 Found XOR loop in file "OfficeTrackerNMP131.exe" at offset 942350; code bytes = 33c1 Found XOR loop in file "OfficeTrackerNMP131.exe" at offset 948128; code bytes = 33c1 Found XOR loop in file "OfficeTrackerNMP131.exe" at offset 953465; code bytes = 33c1 Found XOR loop in file "OfficeTrackerNMP131.exe" at offset 953616; code bytes = 33c1 Found XOR loop in file "OfficeTrackerNMP131.exe" at offset 969842; code bytes = 33c1 Found XOR loop in file "OfficeTrackerNMP131.exe" at offset 971092; code bytes = 33c1 Found XOR loop in file "OfficeTrackerNMP131.exe" at offset 983876; code bytes = 33c1 Found XOR loop in file "OfficeTrackerNMP131.exe" at offset 985045; code bytes = 33c1 Found XOR loop in file "OfficeTrackerNMP131.exe" at offset 985160; code bytes = 33c1 Found XOR loop in file "OfficeTrackerNMP131.exe" at offset 989471; code bytes = 33c1 Found XOR loop in file "OfficeTrackerNMP131.exe" at offset 989786; code bytes = 33c1 Found XOR loop in file "OfficeTrackerNMP131.exe" at offset 990362; code bytes = 33c1 Found XOR loop in file "OfficeTrackerNMP131.exe" at offset 992172; code bytes = 33c1 Found XOR loop in file "OfficeTrackerNMP131.exe" at offset 992479; code bytes = 33c1 Found XOR loop in file "OfficeTrackerNMP131.exe" at offset 992865; code bytes = 33c1 Found XOR loop in file "OfficeTrackerNMP131.exe" at offset 992957; code bytes = 33c1 Found XOR loop in file "OfficeTrackerNMP131.exe" at offset 993612; code bytes = 33c1 Found XOR loop in file "OfficeTrackerNMP131.exe" at offset 995617; code bytes = 33c1 Found XOR loop in file "OfficeTrackerNMP131.exe" at offset 999815; code bytes = 33c1 Found XOR loop in file "OfficeTrackerNMP131.exe" at offset 1000389; code bytes = 33c1 Found XOR loop in file "OfficeTrackerNMP131.exe" at offset 1001271; code bytes = 33c1 Found XOR loop in file "OfficeTrackerNMP131.exe" at offset 1001375; code bytes = 33c1 Found XOR loop in file "OfficeTrackerNMP131.exe" at offset 1002055; code bytes = 33c1 Found XOR loop in file "OfficeTrackerNMP131.exe" at offset 1002170; code bytes = 33c1 Found XOR loop in file "OfficeTrackerNMP131.exe" at offset 1006463; code bytes = 33c1 Found XOR loop in file "OfficeTrackerNMP131.exe" at offset 1007340; code bytes = 33c1 Found XOR loop in file "OfficeTrackerNMP131.exe" at offset 1027259; code bytes = 33c1 Found XOR loop in file "OfficeTrackerNMP131.exe" at offset 1033356; code bytes = 33c1 Found XOR loop in file "OfficeTrackerNMP131.exe" at offset 1034159; code bytes = 33c1 Found XOR loop in file "OfficeTrackerNMP131.exe" at offset 1289436; code bytes = 33c1 Found XOR loop in file "OfficeTrackerNMP131.exe" at offset 1441388; code bytes = 33c1 Found XOR loop in file "OfficeTrackerNMP131.exe" at offset 1505345; code bytes = 33c1 Found XOR loop in file "OfficeTrackerNMP131.exe" at offset 1507059; code bytes = 33c1 Found XOR loop in file "OfficeTrackerNMP131.exe" at offset 1513223; code bytes = 33c1 Found XOR loop in file "OfficeTrackerNMP131.exe" at offset 735579; code bytes = 8030 Found XOR loop in file "OfficeTrackerNMP131.exe" at offset 735612; code bytes = 8030 Found XOR loop in file "OfficeTrackerNMP131.exe" at offset 735686; code bytes = 8030 Found XOR loop in file "OfficeTrackerNMP131.exe" at offset 735764; code bytes = 8030 Found XOR loop in file "OfficeTrackerNMP131.exe" at offset 735781; code bytes = 8030 Found XOR loop in file "OfficeTrackerNMP131.exe" at offset 735802; code bytes = 8030 Found XOR loop in file "OfficeTrackerNMP131.exe" at offset 735842; code bytes = 8030 Found XOR loop in file "OfficeTrackerNMP131.exe" at offset 735923; code bytes = 8030 Found XOR loop in file "OfficeTrackerNMP131.exe" at offset 735946; code bytes = 8030 Found XOR loop in file "OfficeTrackerNMP131.exe" at offset 735963; code bytes = 8030 Found XOR loop in file "OfficeTrackerNMP131.exe" at offset 736030; code bytes = 8030 Found XOR loop in file "OfficeTrackerNMP131.exe" at offset 736068; code bytes = 8030 Found XOR loop in file "OfficeTrackerNMP131.exe" at offset 736997; code bytes = 8030 Found XOR loop in file "OfficeTrackerNMP131.exe" at offset 737018; code bytes = 8030 Found XOR loop in file "OfficeTrackerNMP131.exe" at offset 833270; code bytes = 8030 Found XOR loop in file "OfficeTrackerNMP131.exe" at offset 838380; code bytes = 8030 Found XOR loop in file "OfficeTrackerNMP131.exe" at offset 845494; code bytes = 8030 Found XOR loop in file "OfficeTrackerNMP131.exe" at offset 845523; code bytes = 8030 Found XOR loop in file "OfficeTrackerNMP131.exe" at offset 857223; code bytes = 8030 Found XOR loop in file "OfficeTrackerNMP131.exe" at offset 869347; code bytes = 8030 Found XOR loop in file "OfficeTrackerNMP131.exe" at offset 869366; code bytes = 8030 Found XOR loop in file "OfficeTrackerNMP131.exe" at offset 869863; code bytes = 8030 Found XOR loop in file "OfficeTrackerNMP131.exe" at offset 925121; code bytes = 8030 Found XOR loop in file "OfficeTrackerNMP131.exe" at offset 925175; code bytes = 8030 Found XOR loop in file "OfficeTrackerNMP131.exe" at offset 925196; code bytes = 8030 Found XOR loop in file "OfficeTrackerNMP131.exe" at offset 925223; code bytes = 8030 Found XOR loop in file "OfficeTrackerNMP131.exe" at offset 925256; code bytes = 8030 Found XOR loop in file "OfficeTrackerNMP131.exe" at offset 925280; code bytes = 8030 Found XOR loop in file "OfficeTrackerNMP131.exe" at offset 925297; code bytes = 8030 Found XOR loop in file "OfficeTrackerNMP131.exe" at offset 925319; code bytes = 8030 Found XOR loop in file "OfficeTrackerNMP131.exe" at offset 925429; code bytes = 8030 Found XOR loop in file "OfficeTrackerNMP131.exe" at offset 925471; code bytes = 8030 Found XOR loop in file "OfficeTrackerNMP131.exe" at offset 1337260; code bytes = 8030 Found XOR loop in file "OfficeTrackerNMP131.exe" at offset 1349610; code bytes = 8030 Found XOR loop in file "OfficeTrackerNMP131.exe" at offset 1362066; code bytes = 8030 Found XOR loop in file "OfficeTrackerNMP131.exe" at offset 1495860; code bytes = 8030 Found XOR loop in file "OfficeTrackerNMP131.exe" at offset 1517374; code bytes = 8030 Found XOR loop in file "OfficeTrackerNMP131.exe" at offset 1521442; code bytes = 8030 Found XOR loop in file "OfficeTrackerNMP131.exe" at offset 1522614; code bytes = 8030 Found XOR loop in file "OfficeTrackerNMP131.exe" at offset 1523404; code bytes = 8030 Found XOR loop in file "OfficeTrackerNMP131.exe" at offset 1537116; code bytes = 8030 Found XOR loop in file "OfficeTrackerNMP131.exe" at offset 1538890; code bytes = 8030 Found XOR loop in file "MaxLoonaFest131.exe" at offset 1274152; code bytes = 30d0 Found XOR loop in file "MaxLoonaFest131.exe" at offset 1287765; code bytes = 30d0 Found XOR loop in file "MaxLoonaFest131.exe" at offset 1485168; code bytes = 30d0 Found XOR loop in file "MaxLoonaFest131.exe" at offset 1507775; code bytes = 30d0 Found XOR loop in file "MaxLoonaFest131.exe" at offset 1514635; code bytes = 30d0 Found XOR loop in file "MaxLoonaFest131.exe" at offset 1514887; code bytes = 30d0 Found XOR loop in file "MaxLoonaFest131.exe" at offset 1515347; code bytes = 30d0 Found XOR loop in file "MaxLoonaFest131.exe" at offset 1516553; code bytes = 30d0 Found XOR loop in file "MaxLoonaFest131.exe" at offset 1521461; code bytes = 30d0 Found XOR loop in file "MaxLoonaFest131.exe" at offset 1522625; code bytes = 30d0 Found XOR loop in file "MaxLoonaFest131.exe" at offset 1538921; code bytes = 30d0 Found XOR loop in file "MaxLoonaFest131.exe" at offset 688249; code bytes = 33c1 Found XOR loop in file "MaxLoonaFest131.exe" at offset 688345; code bytes = 33c1 Found XOR loop in file "MaxLoonaFest131.exe" at offset 688444; code bytes = 33c1 Found XOR loop in file "MaxLoonaFest131.exe" at offset 688500; code bytes = 33c1 Found XOR loop in file "MaxLoonaFest131.exe" at offset 688526; code bytes = 33c1 Found XOR loop in file "MaxLoonaFest131.exe" at offset 688604; code bytes = 33c1 Found XOR loop in file "MaxLoonaFest131.exe" at offset 688747; code bytes = 33c1 Found XOR loop in file "MaxLoonaFest131.exe" at offset 688843; code bytes = 33c1 Found XOR loop in file "MaxLoonaFest131.exe" at offset 689850; code bytes = 33c1 Found XOR loop in file "MaxLoonaFest131.exe" at offset 690446; code bytes = 33c1 Found XOR loop in file "MaxLoonaFest131.exe" at offset 764137; code bytes = 33c1 Found XOR loop in file "MaxLoonaFest131.exe" at offset 817238; code bytes = 33c1 Found XOR loop in file "MaxLoonaFest131.exe" at offset 817472; code bytes = 33c1 Found XOR loop in file "MaxLoonaFest131.exe" at offset 909588; code bytes = 33c1 Found XOR loop in file "MaxLoonaFest131.exe" at offset 924330; code bytes = 33c1 Found XOR loop in file "MaxLoonaFest131.exe" at offset 942350; code bytes = 33c1 Found XOR loop in file "MaxLoonaFest131.exe" at offset 948128; code bytes = 33c1 Found XOR loop in file "MaxLoonaFest131.exe" at offset 953465; code bytes = 33c1 Found XOR loop in file "MaxLoonaFest131.exe" at offset 953616; code bytes = 33c1 Found XOR loop in file "MaxLoonaFest131.exe" at offset 969842; code bytes = 33c1 Found XOR loop in file "MaxLoonaFest131.exe" at offset 971092; code bytes = 33c1 Found XOR loop in file "MaxLoonaFest131.exe" at offset 983876; code bytes = 33c1 Found XOR loop in file "MaxLoonaFest131.exe" at offset 985045; code bytes = 33c1 Found XOR loop in file "MaxLoonaFest131.exe" at offset 985160; code bytes = 33c1 Found XOR loop in file "MaxLoonaFest131.exe" at offset 989471; code bytes = 33c1 Found XOR loop in file "MaxLoonaFest131.exe" at offset 989786; code bytes = 33c1 Found XOR loop in file "MaxLoonaFest131.exe" at offset 990362; code bytes = 33c1 Found XOR loop in file "MaxLoonaFest131.exe" at offset 992172; code bytes = 33c1 Found XOR loop in file "MaxLoonaFest131.exe" at offset 992479; code bytes = 33c1 Found XOR loop in file "MaxLoonaFest131.exe" at offset 992865; code bytes = 33c1 Found XOR loop in file "MaxLoonaFest131.exe" at offset 992957; code bytes = 33c1 Found XOR loop in file "MaxLoonaFest131.exe" at offset 993612; code bytes = 33c1 Found XOR loop in file "MaxLoonaFest131.exe" at offset 995617; code bytes = 33c1 Found XOR loop in file "MaxLoonaFest131.exe" at offset 999815; code bytes = 33c1 Found XOR loop in file "MaxLoonaFest131.exe" at offset 1000389; code bytes = 33c1 Found XOR loop in file "MaxLoonaFest131.exe" at offset 1001271; code bytes = 33c1 Found XOR loop in file "MaxLoonaFest131.exe" at offset 1001375; code bytes = 33c1 Found XOR loop in file "MaxLoonaFest131.exe" at offset 1002055; code bytes = 33c1 Found XOR loop in file "MaxLoonaFest131.exe" at offset 1002170; code bytes = 33c1 Found XOR loop in file "MaxLoonaFest131.exe" at offset 1006463; code bytes = 33c1 Found XOR loop in file "MaxLoonaFest131.exe" at offset 1007340; code bytes = 33c1 Found XOR loop in file "MaxLoonaFest131.exe" at offset 1027259; code bytes = 33c1 Found XOR loop in file "MaxLoonaFest131.exe" at offset 1033356; code bytes = 33c1 Found XOR loop in file "MaxLoonaFest131.exe" at offset 1034159; code bytes = 33c1 Found XOR loop in file "MaxLoonaFest131.exe" at offset 1289436; code bytes = 33c1 Found XOR loop in file "MaxLoonaFest131.exe" at offset 1441388; code bytes = 33c1 Found XOR loop in file "MaxLoonaFest131.exe" at offset 1505345; code bytes = 33c1 Found XOR loop in file "MaxLoonaFest131.exe" at offset 1507059; code bytes = 33c1 Found XOR loop in file "MaxLoonaFest131.exe" at offset 1513223; code bytes = 33c1 Found XOR loop in file "MaxLoonaFest131.exe" at offset 735579; code bytes = 8030 Found XOR loop in file "MaxLoonaFest131.exe" at offset 735612; code bytes = 8030 Found XOR loop in file "MaxLoonaFest131.exe" at offset 735686; code bytes = 8030 Found XOR loop in file "MaxLoonaFest131.exe" at offset 735764; code bytes = 8030 Found XOR loop in file "MaxLoonaFest131.exe" at offset 735781; code bytes = 8030 Found XOR loop in file "MaxLoonaFest131.exe" at offset 735802; code bytes = 8030 Found XOR loop in file "MaxLoonaFest131.exe" at offset 735842; code bytes = 8030 Found XOR loop in file "MaxLoonaFest131.exe" at offset 735923; code bytes = 8030 Found XOR loop in file "MaxLoonaFest131.exe" at offset 735946; code bytes = 8030 Found XOR loop in file "MaxLoonaFest131.exe" at offset 735963; code bytes = 8030 Found XOR loop in file "MaxLoonaFest131.exe" at offset 736030; code bytes = 8030 Found XOR loop in file "MaxLoonaFest131.exe" at offset 736068; code bytes = 8030 Found XOR loop in file "MaxLoonaFest131.exe" at offset 736997; code bytes = 8030 Found XOR loop in file "MaxLoonaFest131.exe" at offset 737018; code bytes = 8030 Found XOR loop in file "MaxLoonaFest131.exe" at offset 833270; code bytes = 8030 Found XOR loop in file "MaxLoonaFest131.exe" at offset 838380; code bytes = 8030 Found XOR loop in file "MaxLoonaFest131.exe" at offset 845494; code bytes = 8030 Found XOR loop in file "MaxLoonaFest131.exe" at offset 845523; code bytes = 8030 Found XOR loop in file "MaxLoonaFest131.exe" at offset 857223; code bytes = 8030 Found XOR loop in file "MaxLoonaFest131.exe" at offset 869347; code bytes = 8030 Found XOR loop in file "MaxLoonaFest131.exe" at offset 869366; code bytes = 8030 Found XOR loop in file "MaxLoonaFest131.exe" at offset 869863; code bytes = 8030 Found XOR loop in file "MaxLoonaFest131.exe" at offset 925121; code bytes = 8030 Found XOR loop in file "MaxLoonaFest131.exe" at offset 925175; code bytes = 8030 Found XOR loop in file "MaxLoonaFest131.exe" at offset 925196; code bytes = 8030 Found XOR loop in file "MaxLoonaFest131.exe" at offset 925223; code bytes = 8030 Found XOR loop in file "MaxLoonaFest131.exe" at offset 925256; code bytes = 8030 Found XOR loop in file "MaxLoonaFest131.exe" at offset 925280; code bytes = 8030 Found XOR loop in file "MaxLoonaFest131.exe" at offset 925297; code bytes = 8030 Found XOR loop in file "MaxLoonaFest131.exe" at offset 925319; code bytes = 8030 Found XOR loop in file "MaxLoonaFest131.exe" at offset 925429; code bytes = 8030 Found XOR loop in file "MaxLoonaFest131.exe" at offset 925471; code bytes = 8030 Found XOR loop in file "MaxLoonaFest131.exe" at offset 1337260; code bytes = 8030 Found XOR loop in file "MaxLoonaFest131.exe" at offset 1349610; code bytes = 8030 Found XOR loop in file "MaxLoonaFest131.exe" at offset 1362066; code bytes = 8030 Found XOR loop in file "MaxLoonaFest131.exe" at offset 1495860; code bytes = 8030 Found XOR loop in file "MaxLoonaFest131.exe" at offset 1517374; code bytes = 8030 Found XOR loop in file "MaxLoonaFest131.exe" at offset 1521442; code bytes = 8030 Found XOR loop in file "MaxLoonaFest131.exe" at offset 1522614; code bytes = 8030 Found XOR loop in file "MaxLoonaFest131.exe" at offset 1523404; code bytes = 8030 Found XOR loop in file "MaxLoonaFest131.exe" at offset 1537116; code bytes = 8030 Found XOR loop in file "MaxLoonaFest131.exe" at offset 1538890; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 144577; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 239342; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 283857; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 319335; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 324489; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 326628; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 337346; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 375068; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 388972; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 435156; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 437959; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 443908; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 451390; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 454618; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 676957; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 855410; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 912182; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1021065; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1042260; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1107768; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1125300; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1154654; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1176590; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1182351; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1264171; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1270958; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1329663; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1374105; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1378317; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1379868; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1454756; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1588919; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 26031; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 141730; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 143358; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 151093; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 325949; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 438624; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 636221; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 663136; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 838089; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 860275; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 967142; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 988180; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1013516; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1100738; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1329326; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1333430; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1369760; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1427945; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1542431; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1619472; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1656739; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1738979; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1750059; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1769913; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 90891; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 102399; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 103104; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 244058; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 320397; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 358363; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 434091; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 485458; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 652209; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 652493; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 756251; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 765616; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 780732; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 902601; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 954728; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1190524; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1252642; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1253377; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1255403; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1273575; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1413302; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1462567; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1523835; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1589146; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1643297; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1689228; code bytes = 80302a:T430,file/memory contains long string with (Indicator: "GetCommandLine"; File: "2IW9992.exe") file/memory contains long string with (Indicator: "GetCommandLine"; File: "5UO2EL6.exe") file/memory contains long string with (Indicator: "GetCommandLine"; File: "DISMHOST.EXE.6A9813CA.bin") Found string "GetCommandLineA" (Indicator: "GetCommandLine"; File: "7ca6811b3a9febcffeeee9d839ad6b8eb096688c666be805325d1acf663cc833") Found string "GetCommandLineW" (Indicator: "GetCommandLine"; File: "7ca6811b3a9febcffeeee9d839ad6b8eb096688c666be805325d1acf663cc833") Found string "GetCursorPos" (Indicator: "GetCursorPos"; File: "7ca6811b3a9febcffeeee9d839ad6b8eb096688c666be805325d1acf663cc833") Found string "GetCommandLineW" (Indicator: "GetCommandLine"; Source: "00000000-00003472.00000000.87211.001F1000.00000020.mdmp") Found string "GetCommandLineA" (Indicator: "GetCommandLine"; Source: "00000000-00004644.00000000.90807.01117000.00000002.mdmp") Found string "GetCommandLineW" (Indicator: "GetCommandLine"; Source: "00000000-00004644.00000000.90807.01117000.00000002.mdmp")2b:T88d,Found reference to API "GetLocaleInfoEx" (Indicator: "GetLocaleInfo"; File: "7ca6811b3a9febcffeeee9d839ad6b8eb096688c666be805325d1acf663cc833") Found reference to API "GetLocaleInfoA" (Indicator: "GetLocaleInfo"; File: "7ca6811b3a9febcffeeee9d839ad6b8eb096688c666be805325d1acf663cc833") Found reference to API "GetUserDefaultLocaleName" (Indicator: "GetUserDefaultLocaleName"; File: "7ca6811b3a9febcffeeee9d839ad6b8eb096688c666be805325d1acf663cc833") Found reference to API "GetUserDefaultLCID" (Indicator: "GetUserDefaultLCID"; File: "7ca6811b3a9febcffeeee9d839ad6b8eb096688c666be805325d1acf663cc833") Found reference to API "GetLocaleInfoW" (Indicator: "GetLocaleInfo"; File: "7ca6811b3a9febcffeeee9d839ad6b8eb096688c666be805325d1acf663cc833") Found reference to API "EnumSystemLocalesW" (Indicator: "EnumSystemLocales"; File: "7ca6811b3a9febcffeeee9d839ad6b8eb096688c666be805325d1acf663cc833") Found reference to API "EnumSystemLocalesEx" (Indicator: "EnumSystemLocales"; File: "00000000-00006008.00000000.78573.00E41000.00000020.mdmp") Found reference to API "GetLocaleInfoW" (Indicator: "GetLocaleInfo"; Source: "00000000-00003472.00000000.87211.001F1000.00000020.mdmp") Found reference to API "EnumSystemLocalesEx" (Indicator: "EnumSystemLocales"; Source: "00000000-00004644.00000000.90807.01117000.00000002.mdmp") Found reference to API "GetLocaleInfoEx" (Indicator: "GetLocaleInfo"; Source: "00000000-00004644.00000000.90807.01117000.00000002.mdmp") Found reference to API "GetUserDefaultLocaleName" (Indicator: "GetUserDefaultLocaleName"; Source: "00000000-00004644.00000000.90807.01117000.00000002.mdmp") Found reference to API "GetLocaleInfoA" (Indicator: "GetLocaleInfo"; Source: "00000000-00004644.00000000.90807.01117000.00000002.mdmp") Found reference to API "GetLocaleInfoW" (Indicator: "GetLocaleInfo"; Source: "00000000-00004644.00000000.90807.01117000.00000002.mdmp") Found reference to API "GetUserDefaultLCID" (Indicator: "GetUserDefaultLCID"; Source: "00000000-00004644.00000000.90807.01117000.00000002.mdmp") Found reference to API "EnumSystemLocalesW" (Indicator: "EnumSystemLocales"; Source: "00000000-00004644.00000000.90807.01117000.00000002.mdmp")2c:T454,Found reference to API "GetTimeFormatW" (Indicator: "GetTimeFormat"; File: "7ca6811b3a9febcffeeee9d839ad6b8eb096688c666be805325d1acf663cc833") Found reference to API "GetDateFormatW" (Indicator: "GetDateFormat"; File: "7ca6811b3a9febcffeeee9d839ad6b8eb096688c666be805325d1acf663cc833") Found reference to API "GetDateFormatEx" (Indicator: "GetDateFormat"; File: "00000000-00006008.00000000.78573.00E41000.00000020.mdmp") Found reference to API "GetTimeFormatEx" (Indicator: "GetTimeFormat"; File: "00000000-00006008.00000000.78573.00E41000.00000020.mdmp") Found reference to API "GetDateFormatEx" (Indicator: "GetDateFormat"; Source: "00000000-00004644.00000000.90807.01117000.00000002.mdmp") Found reference to API "GetTimeFormatEx" (Indicator: "GetTimeFormat"; Source: "00000000-00004644.00000000.90807.01117000.00000002.mdmp") Found reference to API "GetDateFormatW" (Indicator: "GetDateFormat"; Source: "00000000-00004644.00000000.90807.01117000.00000002.mdmp") Found reference to API "GetTimeFormatW" (Indicator: "GetTimeFormat"; Source: "00000000-00004644.00000000.90807.01117000.00000002.mdmp")2d:T45f,Found reference to API "GetKeyboardLayoutList" (Indicator: "GetKeyboardLayoutList"; File: "7ca6811b3a9febcffeeee9d839ad6b8eb096688c666be805325d1acf663cc833") Found reference to API "GetKeyboardLayoutNameW" (Indicator: "GetKeyboardLayout"; File: "7ca6811b3a9febcffeeee9d839ad6b8eb096688c666be805325d1acf663cc833") Found reference to API "GetUserDefaultUILanguage" (Indicator: "GetUserDefaultUILanguage"; File: "7ca6811b3a9febcffeeee9d839ad6b8eb096688c666be805325d1acf663cc833") Found reference to API "GetSystemDefaultUILanguage" (Indicator: "GetSystemDefaultUILanguage"; File: "7ca6811b3a9febcffeeee9d839ad6b8eb096688c666be805325d1acf663cc833") Found reference to API "GetSystemDefaultUILanguage" (Indicator: "GetSystemDefaultUILanguage"; Source: "00000000-00003472.00000000.87211.001F1000.00000020.mdmp") Found reference to API "GetUserDefaultUILanguage" (Indicator: "GetUserDefaultUILanguage"; Source: "00000000-00003472.00000000.87211.001F1000.00000020.mdmp") Found reference to API "GetKeyboardLayoutList" (Indicator: "GetKeyboardLayoutList"; Source: "00000000-00004644.00000000.90807.01117000.00000002.mdmp")2e:T3e21,"7ca6811b3a9febcffeeee9d839ad6b8eb096688c666be805325d1acf663cc833.exe" called "RtlGetVersion" with parameter 140100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00005816) "7ca6811b3a9febcffeeee9d839ad6b8eb096688c666be805325d1acf663cc833.exe" called "RtlGetVersion" with parameter 000000000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00005816) "cZ2SE56.exe" called "RtlGetVersion" with parameter 140100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00005868) "cZ2SE56.exe" called "RtlGetVersion" with parameter 000000000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00005868) "nO2Ue30.exe" called "RtlGetVersion" with parameter 140100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00006080) "nO2Ue30.exe" called "RtlGetVersion" with parameter 000000000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00006080) "zW9af77.exe" called "RtlGetVersion" with parameter 000000000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00005944) "1sW61HT2.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00006008) "1sW61HT2.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b00200031000000000000000000000000000000000000000000000000000a781d5204ce2d0004ce2d001e75bb6900000000487954003cd52d0090010000000000000000000000000000e0d22d005ecb1a769001000000000000005d18763cd52d000e5d1876d4d02d00dcaa1c76010000000000000072000000ffffffffffffffff5cce2d007802000000000000250000005cce2d007b00370035003800340037003100370037002d0046003000370037002d0034003100370031002d0042004400320043002d0041003600420042003200310036006bed6552b4ce2d006d8217770c8c540004010000 (UID: 00000000-00006008) "1sW61HT2.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b002000310000005c00030000000000000002000000b8e35400a0315300e86c4c003200020001000000bc0200000e0000000000000000000000a83153008a0200000d000000b0714c0005000000000000003200000098eb5400d4b92d00cc410177b8e3540028000000fc000000ff2b00779e983777d8eb4775ac014c0000004c002c002000010000000000ffffa703000004000000010000002d001b000100000002000000010000000000000000000000f86f4c00f8070000200000000000000000000000a0315300e86c4c00086e4c0098e45400b0714c000000000050b92d0000000000d0ba2d00 (UID: 00000000-00006008) "1sW61HT2.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b00200031000000ffff2b00230034000000620b1a7600000000f86f4c00000000005000000064ce540002000000884253000000000001000008a8fc530020744c00380b1a76e8cc2d00020000009ccd2d003f08ce750200000088425300000000000100001888fbcd758ccd2d00c81c1c7662cf2d0095fbcd75c0ce2d008842530000000000000000000000000048ce2d0000004c007b00370035003800340037003100370037002d0046003000370037002d0034003100370031002d0042004400320043002d00410036004200420032003100360017ee655208ce2d006d8217770c8c540004010000 (UID: 00000000-00006008) "1sW61HT2.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b00200031000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000007b00370035003800340037003100370037002d0046003000370037002d0034003100370031002d0042004400320043002d004100360042004200320031003600ffe4655220c72d006d821777ec58560004010000 (UID: 00000000-00006008) "1sW61HT2.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b002000310000000000c4004c00c82f4c0004630000b8c02d0067e5fd7600004c00c06756000000000000004c0000000000c0675600000000008a6200e800000000986b5600c4004c0080575600003b000000004c0000000000c067560000004c00806456000000000034000135fae037770000000000004c00b06956000000000000004c000000100080645600e0c12d00046400777b00370035003800340037003100370037002d0046003000370037002d0034003100370031002d0042004400320043002d004100360042004200320031003600c3e265525cc12d006d821777a45f560004010000 (UID: 00000000-00006008) "1sW61HT2.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b002000310000002d0098cf4e76a0331a76fe571a7605400080f4da2d000000000043003a005c00550073006500720073005c0048004100500055004200570053000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000007b00370035003800340037003100370037002d0046003000370037002d0034003100370031002d0042004400320043002d004100360042004200320031003600e798655238bb2d006d8217777451570004010000 (UID: 00000000-00006008) "1sW61HT2.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b002000310000005700f83b0000ff07000000004c00000000007f070000c4004c00c82f4c00e8440000a8ba2d0067e5fd7600004c00a05857000000000000004c0000000000a058570000000000944400d080000000485b5700c4004c0028a45600003b000000004c0000000000a0585700001b000000004c0098555700f83b0000ff07000000004c00000000007f070000c4004c007b00370035003800340037003100370037002d0046003000370037002d0034003100370031002d0042004400320043002d004100360042004200320031003600e798655238bb2d006d8217779453570004010000 (UID: 00000000-00006008) "1sW61HT2.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b002000310000005700f83b0000ff07000000004c00000000007f070000c4004c00c82f4c00a4440000a8ba2d0067e5fd7600004c00c05a57000000000000004c0000000000c05a5700000000005044001480000000685d5700c4004c0048465300003b000000004c0000000000c05a5700001b000000004c00b8575700f83b0000ff07000000004c00000000007f070000c4004c007b00370035003800340037003100370037002d0046003000370037002d0034003100370031002d0042004400320043002d004100360042004200320031003600e798655238bb2d006d8217773c55570004010000 (UID: 00000000-00006008) "1sW61HT2.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b002000310000005700f83b0000ff07000000004c00000000007f070000c4004c00c82f4c006f440000a8ba2d0067e5fd7600004c00685c57000000000000004c0000000000685c5700000000001b44005f80000000105f5700c4004c00e0a35600003b000000004c0000000000685c5700001b000000004c0060595700f83b0000ff07000000004c00000000007f070000c4004c007b00370035003800340037003100370037002d0046003000370037002d0034003100370031002d0042004400320043002d004100360042004200320031003600e798655238bb2d006d8217776c56570004010000 (UID: 00000000-00006008) "1sW61HT2.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b002000310000005700f83b0000ff07000000004c00000000007f070000c4004c00c82f4c0049440000a8ba2d0067e5fd7600004c00985d57000000000000004c0000000000985d570000000000f54300b68000000040605700c4004c00e0a35600003b000000004c0000000000985d5700001b000000004c00905a5700f83b0000ff07000000004c00000000007f070000c4004c007b00370035003800340037003100370037002d0046003000370037002d0034003100370031002d0042004400320043002d004100360042004200320031003600e798655238bb2d006d8217779c57570004010000 (UID: 00000000-00006008) "1sW61HT2.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b002000310000005700f83b0000ff07000000004c00000000007f070000c4004c00c82f4c0023440000a8ba2d0067e5fd7600004c00c85e57000000000000004c0000000000c85e570000000000cf43008c8000000070615700c4004c00e0a35600003b000000004c0000000000c85e5700001b000000004c00c05b5700f83b0000ff07000000004c00000000007f070000c4004c007b00370035003800340037003100370037002d0046003000370037002d0034003100370031002d0042004400320043002d004100360042004200320031003600e798655238bb2d006d821777c458570004010000 (UID: 00000000-00006008) "1sW61HT2.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b002000310000005700f83b0000ff07000000004c00000000007f070000c4004c00c82f4c00fe430000a8ba2d0067e5fd7600004c00f05f57000000000000004c0000000000f05f570000000000aa4300e98000000098625700c4004c00e0a35600003b000000004c0000000000f05f5700001b000000004c00e85c5700f83b0000ff07000000004c00000000007f070000c4004c007b00370035003800340037003100370037002d0046003000370037002d0034003100370031002d0042004400320043002d004100360042004200320031003600e798655238bb2d006d821777f459570004010000 (UID: 00000000-00006008) "1sW61HT2.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b002000310000005700f83b0000ff07000000004c00000000007f070000c4004c00c82f4c00d8430000a8ba2d0067e5fd7600004c00206157000000000000004c00000000002061570000000000844300c780000000c8635700c4004c00e0a35600003b000000004c000000000020615700001b000000004c00185e5700f83b0000ff07000000004c00000000007f070000c4004c007b00370035003800340037003100370037002d0046003000370037002d0034003100370031002d0042004400320043002d004100360042004200320031003600e798655238bb2d006d821777245b570004010000 (UID: 00000000-00006008) "1sW61HT2.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b002000310000005700f83b0000ff07000000004c00000000007f070000c4004c00c82f4c00b2430000a8ba2d0067e5fd7600004c00506257000000000000004c000000000050625700000000005e43001d80000000f8645700c4004c00e0a35600003b000000004c000000000050625700001b000000004c00485f5700f83b0000ff07000000004c00000000007f070000c4004c007b00370035003800340037003100370037002d0046003000370037002d0034003100370031002d0042004400320043002d004100360042004200320031003600e798655238bb2d006d8217774c5c570004010000 (UID: 00000000-00006008) "1sW61HT2.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b002000310000005700f83b0000ff07000000004c00000000007f070000c4004c00c82f4c008d430000a8ba2d0067e5fd7600004c00786357000000000000004c000000000078635700000000003943007a8000000020665700c4004c00e0a35600003b000000004c000000000078635700001b000000004c0070605700f83b0000ff07000000004c00000000007f070000c4004c007b00370035003800340037003100370037002d0046003000370037002d0034003100370031002d0042004400320043002d004100360042004200320031003600e798655238bb2d006d821777845d570004010000 (UID: 00000000-00006008) "1sW61HT2.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000e6711d5258c42d0058c42d001e75bb6900000000d036580090cb2d001c02000000000000000000000000000034c92d005ecb1a761c02000000000000005d187690cb2d000e5d187628c72d00dcaa1c76010000000000000072000000ffffffffffffffffb0c42d00780200000000000025000000b0c42d007b00370035003800340037003100370037002d0046003000370037002d0034003100370031002d0042004400320043002d00410036004200420032003100360017e7655208c52d006d82177704d2570004010000 (UID: 00000000-00006008) "1sW61HT2.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b00200031000000ffff1300af0184000000620b1a7600000000f86f4c00000000005000000064ce5400020000008842530000000000010000080809540020744c00380b1a763cc32d0002000000f0c32d003f08ce750200000088425300000000000100001888fbcd75e0c32d00c81c1c76b6c52d0095fbcd7514c52d00884253000000000000000000000000009cc42d0000004c007b00370035003800340037003100370037002d0046003000370037002d0034003100370031002d0042004400320043002d004100360042004200320031003600c3e765525cc42d006d82177704d2570004010000 (UID: 00000000-00006008)2f:T5ba,FindFirstFileA@KERNEL32.DLL at 00000000-00005816-22033-31-00C42390 FindFirstFileA@KERNEL32.DLL at 00000000-00005868-22530-31-01042390 FindFirstFileA@KERNEL32.DLL at 00000000-00005944-23959-31-01212390 FindNextFileW@KERNEL32.DLL at 00000000-00006008-24920-2470-00F246A9 FindFirstFileExW@KERNEL32.DLL at 00000000-00006008-24920-2471-00F246EA FindFirstFileA@KERNEL32.DLL at 00000000-00006008-24920-2608-00E8F8A0 FindFirstFileA@KERNEL32.DLL at 00000000-00006008-24920-2638-00E91200 FindFirstFileA@KERNEL32.DLL at 00000000-00006008-24920-2642-00E71350 FindFirstFileA@KERNEL32.DLL at 00000000-00006008-24920-2809-00E5A0D0 FindFirstFileW@KERNEL32.DLL at 00000000-00006008-24920-2859-00F24750 FindFirstFileExW@KERNEL32.DLL at 00000000-00006008-24920-3304-00F59E51 FindNextFileA@KERNEL32.DLL at 00000000-00006008-24920-3573-00E55485 FindNextFileW@KERNEL32.DLL at 00000000-00004644-28990-2474-010C46A9 FindFirstFileExW@KERNEL32.DLL at 00000000-00004644-28990-2475-010C46EA FindFirstFileA@KERNEL32.DLL at 00000000-00004644-28990-2611-0102F8A0 FindFirstFileA@KERNEL32.DLL at 00000000-00004644-28990-2640-01031200 FindFirstFileA@KERNEL32.DLL at 00000000-00004644-28990-2644-01011350 FindFirstFileA@KERNEL32.DLL at 00000000-00004644-28990-2809-00FFA0D0 FindFirstFileW@KERNEL32.DLL at 00000000-00004644-28990-2859-010C4750 FindFirstFileExW@KERNEL32.DLL at 00000000-00004644-28990-3304-010F9E51 FindNextFileA@KERNEL32.DLL at 00000000-00004644-28990-3573-00FF548530:T46f,GetSystemTimeAsFileTime@KERNEL32.DLL at 00000000-00005816-22033-83-00C47155 GetSystemTimeAsFileTime@KERNEL32.DLL at 00000000-00005868-22530-83-01047155 GetSystemTimeAsFileTime@KERNEL32.DLL at 00000000-00005944-23959-83-01217155 GetSystemTimeAsFileTime@KERNEL32.DLL at 00000000-00006008-24920-2591-00F4A4BB GetSystemTimeAsFileTime@KERNEL32.DLL at 00000000-00006008-24920-2736-00F2601A GetSystemTime@KERNEL32.DLL at 00000000-00006008-24920-3112-00EF6530 GetSystemTimeAsFileTime@KERNEL32.DLL at 00000000-00006008-24920-3113-00EF65F0 GetSystemTimeAsFileTime@KERNEL32.DLL at 00000000-00006008-24920-3195-00F26CC5 GetLocalTime@KERNEL32.DLL at 00000000-00006008-24920-3591-00E58682 GetSystemTimeAsFileTime@KERNEL32.DLL at 00000000-00004644-28990-2595-010EA4BB GetSystemTimeAsFileTime@KERNEL32.DLL at 00000000-00004644-28990-2737-010C601A GetSystemTime@KERNEL32.DLL at 00000000-00004644-28990-3112-01096530 GetSystemTimeAsFileTime@KERNEL32.DLL at 00000000-00004644-28990-3113-010965F0 GetSystemTimeAsFileTime@KERNEL32.DLL at 00000000-00004644-28990-3195-010C6CC5 GetLocalTime@KERNEL32.DLL at 00000000-00004644-28990-3591-00FF868231:T706,GetUserDefaultLCID@KERNEL32.DLL at 00000000-00006008-24920-2376-00F54563 EnumSystemLocalesW@KERNEL32.DLL at 00000000-00006008-24920-2383-00F53F5B GetLocaleInfoW@KERNEL32.DLL at 00000000-00006008-24920-2394-00F544DF GetUserDefaultLCID@KERNEL32.DLL at 00000000-00006008-24920-2419-00F5D640 EnumSystemLocalesW@KERNEL32.DLL at 00000000-00006008-24920-2420-00F5CF77 EnumSystemLocalesW@KERNEL32.DLL at 00000000-00006008-24920-2421-00F5D05D GetLocaleInfoW@KERNEL32.DLL at 00000000-00006008-24920-2423-00F5D464 EnumSystemLocalesW@KERNEL32.DLL at 00000000-00006008-24920-2424-00F5CFC2 GetLocaleInfoEx@KERNEL32.DLL at 00000000-00006008-24920-2947-00F24A14 GetLocaleInfoW@KERNEL32.DLL at 00000000-00006008-24920-3395-00F5CED2 GetLocaleInfoW@KERNEL32.DLL at 00000000-00006008-24920-3398-00F5D0EA GetLocaleInfoW@KERNEL32.DLL at 00000000-00006008-24920-3399-00F5D56A GetLocaleInfoW@KERNEL32.DLL at 00000000-00006008-24920-3400-00F5D33D GetLocaleInfoA@KERNEL32.DLL at 00000000-00006008-24920-3591-00E58682 GetUserDefaultLCID@KERNEL32.DLL at 00000000-00004644-28990-2381-010F4563 EnumSystemLocalesW@KERNEL32.DLL at 00000000-00004644-28990-2388-010F3F5B GetLocaleInfoW@KERNEL32.DLL at 00000000-00004644-28990-2399-010F44DF GetUserDefaultLCID@KERNEL32.DLL at 00000000-00004644-28990-2424-010FD640 EnumSystemLocalesW@KERNEL32.DLL at 00000000-00004644-28990-2425-010FCF77 EnumSystemLocalesW@KERNEL32.DLL at 00000000-00004644-28990-2426-010FD05D GetLocaleInfoW@KERNEL32.DLL at 00000000-00004644-28990-2428-010FD464 EnumSystemLocalesW@KERNEL32.DLL at 00000000-00004644-28990-2429-010FCFC2 GetLocaleInfoEx@KERNEL32.DLL at 00000000-00004644-28990-2947-010C4A14 GetLocaleInfoW@KERNEL32.DLL at 00000000-00004644-28990-3395-010FCED2 GetLocaleInfoW@KERNEL32.DLL at 00000000-00004644-28990-3398-010FD0EA32:T574,"7ca6811b3a9febcffeeee9d839ad6b8eb096688c666be805325d1acf663cc833.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "7ca6811b3a9febcffeeee9d839ad6b8eb096688c666be805325d1acf663cc833.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "cZ2SE56.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "cZ2SE56.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "nO2Ue30.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "nO2Ue30.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "zW9af77.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "zW9af77.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "1sW61HT2.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "1sW61HT2.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "OfficeTrackerNMP131.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED")33:T460,Found API call GetVersionExA@KERNEL32.DLL directly followed by "cmp ecx, 02h" and "ret" at 00000000-00006008-24920-1526-00EF5590 Found API call GetSystemTime@KERNEL32.DLL directly followed by "cmp eax, 04h" and "jc 00EF6571h" at 00000000-00006008-24920-3112-00EF6530 Found API call GetTimeZoneInformation@KERNEL32.DLL directly followed by "cmp eax, FFFFFFFFh" and "je 00F5629Ch" at 00000000-00006008-24920-3372-00F56172 Found API call GetLocalTime@KERNEL32.DLL directly followed by "cmp ecx, esi" and "shl ecx, 02h" at 00000000-00006008-24920-3591-00E58682 Found API call GetVersionExA@KERNEL32.DLL directly followed by "cmp ecx, 02h" and "ret" at 00000000-00004644-28990-1527-01095590 Found API call GetSystemTime@KERNEL32.DLL directly followed by "cmp eax, 04h" and "jc 01096571h" at 00000000-00004644-28990-3112-01096530 Found API call GetTimeZoneInformation@KERNEL32.DLL directly followed by "cmp eax, FFFFFFFFh" and "je 010F629Ch" at 00000000-00004644-28990-3372-010F6172 Found API call GetLocalTime@KERNEL32.DLL directly followed by "cmp ecx, esi" and "shl ecx, 02h" at 00000000-00004644-28990-3591-00FF868234:T9ef,"7ca6811b3a9febcffeeee9d839ad6b8eb096688c666be805325d1acf663cc833.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\advpack.dll (UID: 00000000-00005816) "cZ2SE56.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\advpack.dll (UID: 00000000-00005868) "nO2Ue30.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\advpack.dll (UID: 00000000-00006080) "zW9af77.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\advpack.dll (UID: 00000000-00005944) "1sW61HT2.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00006008) "1sW61HT2.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\uxtheme.dll (UID: 00000000-00006008) "1sW61HT2.exe" called "LoadLibrary" with a parameter propsys.dll (UID: 00000000-00006008) "1sW61HT2.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00006008) "1sW61HT2.exe" called "LoadLibrary" with a parameter comctl32.dll (UID: 00000000-00006008) "1sW61HT2.exe" called "LoadLibrary" with a parameter ntmarta.dll (UID: 00000000-00006008) "1sW61HT2.exe" called "LoadLibrary" with a parameter SHELL32.dll (UID: 00000000-00006008) "1sW61HT2.exe" called "LoadLibrary" with a parameter %WINDIR%\System32\shdocvw.dll (UID: 00000000-00006008) "1sW61HT2.exe" called "LoadLibrary" with a parameter PROPSYS.dll (UID: 00000000-00006008) "1sW61HT2.exe" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00006008) "1sW61HT2.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00006008) "1sW61HT2.exe" called "LoadLibrary" with a parameter ntshrui.dll (UID: 00000000-00006008) "1sW61HT2.exe" called "LoadLibrary" with a parameter srvcli.dll (UID: 00000000-00006008) "1sW61HT2.exe" called "LoadLibrary" with a parameter cscapi.dll (UID: 00000000-00006008) "1sW61HT2.exe" called "LoadLibrary" with a parameter slc.dll (UID: 00000000-00006008) "1sW61HT2.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00006008) "1sW61HT2.exe" called "LoadLibrary" with a parameter API-MS-Win-Security-SDDL-L1-1-0.dll (UID: 00000000-00006008) "1sW61HT2.exe" called "LoadLibrary" with a parameter SspiCli.dll (UID: 00000000-00006008) "1sW61HT2.exe" called "LoadLibrary" with a parameter winhttp.dll (UID: 00000000-00006008) "1sW61HT2.exe" called "LoadLibrary" with a parameter WININET.DLL (UID: 00000000-00006008) "schtasks.exe" called "LoadLibrary" with a parameter SspiCli.dll (UID: 00000000-00006108) "schtasks.exe" called "LoadLibrary" with a parameter SspiCli.dll (UID: 00000000-00006100)35:T2dc5,"7ca6811b3a9febcffeeee9d839ad6b8eb096688c666be805325d1acf663cc833.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00005816) "7ca6811b3a9febcffeeee9d839ad6b8eb096688c666be805325d1acf663cc833.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00005816) "7ca6811b3a9febcffeeee9d839ad6b8eb096688c666be805325d1acf663cc833.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00005816) "7ca6811b3a9febcffeeee9d839ad6b8eb096688c666be805325d1acf663cc833.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00005816) "7ca6811b3a9febcffeeee9d839ad6b8eb096688c666be805325d1acf663cc833.exe" called "GetProcAddress" with a parameter DelNodeRunDLL32 (UID: 00000000-00005816) "cZ2SE56.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00005868) "cZ2SE56.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00005868) "cZ2SE56.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00005868) "cZ2SE56.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00005868) "cZ2SE56.exe" called "GetProcAddress" with a parameter DelNodeRunDLL32 (UID: 00000000-00005868) "nO2Ue30.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00006080) "nO2Ue30.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00006080) "nO2Ue30.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00006080) "nO2Ue30.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00006080) "nO2Ue30.exe" called "GetProcAddress" with a parameter DelNodeRunDLL32 (UID: 00000000-00006080) "zW9af77.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00005944) "zW9af77.exe" called "GetProcAddress" with a parameter DelNodeRunDLL32 (UID: 00000000-00005944) "1sW61HT2.exe" called "GetProcAddress" with a parameter StringFromGUID2 (UID: 00000000-00006008) "1sW61HT2.exe" called "GetProcAddress" with a parameter OpenThreadToken (UID: 00000000-00006008) "1sW61HT2.exe" called "GetProcAddress" with a parameter SystemFunction036 (UID: 00000000-00006008) "1sW61HT2.exe" called "GetProcAddress" with a parameter ThemeInitApiHook (UID: 00000000-00006008) "1sW61HT2.exe" called "GetProcAddress" with a parameter IsProcessDPIAware (UID: 00000000-00006008) "1sW61HT2.exe" called "GetProcAddress" with a parameter CLSIDFromOle1Class (UID: 00000000-00006008) "1sW61HT2.exe" called "GetProcAddress" with a parameter GetCatalogObject (UID: 00000000-00006008) "1sW61HT2.exe" called "GetProcAddress" with a parameter GetCatalogObject2 (UID: 00000000-00006008) "1sW61HT2.exe" called "GetProcAddress" with a parameter DllGetClassObject (UID: 00000000-00006008) "1sW61HT2.exe" called "GetProcAddress" with a parameter DllCanUnloadNow (UID: 00000000-00006008) "1sW61HT2.exe" called "GetProcAddress" with a parameter CoTaskMemFree (UID: 00000000-00006008) "1sW61HT2.exe" called "GetProcAddress" with a parameter RegisterTraceGuidsW (UID: 00000000-00006008) "1sW61HT2.exe" called "GetProcAddress" with a parameter EventRegister (UID: 00000000-00006008) "1sW61HT2.exe" called "GetProcAddress" with a parameter EventUnregister (UID: 00000000-00006008) "1sW61HT2.exe" called "GetProcAddress" with a parameter EventEnabled (UID: 00000000-00006008) "1sW61HT2.exe" called "GetProcAddress" with a parameter EventWrite (UID: 00000000-00006008) "1sW61HT2.exe" called "GetProcAddress" with a parameter PSCreateMemoryPropertyStore (UID: 00000000-00006008) "1sW61HT2.exe" called "GetProcAddress" with a parameter CoTaskMemAlloc (UID: 00000000-00006008) "1sW61HT2.exe" called "GetProcAddress" with a parameter CoGetApartmentType (UID: 00000000-00006008) "1sW61HT2.exe" called "GetProcAddress" with a parameter CoRegisterInitializeSpy (UID: 00000000-00006008) "1sW61HT2.exe" called "GetProcAddress" with a parameter LpkEditControl (UID: 00000000-00006008) "1sW61HT2.exe" called "GetProcAddress" with a parameter CoGetMalloc (UID: 00000000-00006008) "1sW61HT2.exe" called "GetProcAddress" with a parameter CreateBindCtx (UID: 00000000-00006008) "1sW61HT2.exe" called "GetProcAddress" with a parameter CM_Get_Device_Interface_List_Size_ExW (UID: 00000000-00006008) "1sW61HT2.exe" called "GetProcAddress" with a parameter RegEnumKeyW (UID: 00000000-00006008) "1sW61HT2.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00006008) "1sW61HT2.exe" called "GetProcAddress" with a parameter CM_Get_Device_Interface_List_ExW (UID: 00000000-00006008) "1sW61HT2.exe" called "GetProcAddress" with a parameter InitializeSecurityDescriptor (UID: 00000000-00006008) "1sW61HT2.exe" called "GetProcAddress" with a parameter SetEntriesInAclW (UID: 00000000-00006008) "1sW61HT2.exe" called "GetProcAddress" with a parameter GetMartaExtensionInterface (UID: 00000000-00006008) "1sW61HT2.exe" called "GetProcAddress" with a parameter SetSecurityDescriptorDacl (UID: 00000000-00006008) "1sW61HT2.exe" called "GetProcAddress" with a parameter IsTextUnicode (UID: 00000000-00006008) "1sW61HT2.exe" called "GetProcAddress" with a parameter CoInitializeEx (UID: 00000000-00006008) "1sW61HT2.exe" called "GetProcAddress" with a parameter CoUninitialize (UID: 00000000-00006008) "1sW61HT2.exe" called "GetProcAddress" with a parameter ConvertSidToStringSidW (UID: 00000000-00006008) "1sW61HT2.exe" called "GetProcAddress" with a parameter PropVariantClear (UID: 00000000-00006008) "1sW61HT2.exe" called "GetProcAddress" with a parameter RegQueryValueW (UID: 00000000-00006008) "1sW61HT2.exe" called "GetProcAddress" with a parameter ApphelpCheckShellObject (UID: 00000000-00006008) "1sW61HT2.exe" called "GetProcAddress" with a parameter PSPropertyBag_ReadDWORD (UID: 00000000-00006008) "1sW61HT2.exe" called "GetProcAddress" with a parameter PSPropertyBag_ReadBSTR (UID: 00000000-00006008) "1sW61HT2.exe" called "GetProcAddress" with a parameter PSPropertyBag_ReadGUID (UID: 00000000-00006008) "1sW61HT2.exe" called "GetProcAddress" with a parameter CreateLinkInfoW (UID: 00000000-00006008) "1sW61HT2.exe" called "GetProcAddress" with a parameter IsCharAlphaW (UID: 00000000-00006008) "1sW61HT2.exe" called "GetProcAddress" with a parameter CharPrevW (UID: 00000000-00006008) "1sW61HT2.exe" called "GetProcAddress" with a parameter GetNetResourceFromLocalPathW (UID: 00000000-00006008) "1sW61HT2.exe" called "GetProcAddress" with a parameter NetShareEnum (UID: 00000000-00006008) "1sW61HT2.exe" called "GetProcAddress" with a parameter CscNetApiGetInterface (UID: 00000000-00006008) "1sW61HT2.exe" called "GetProcAddress" with a parameter SLGetWindowsInformationDWORD (UID: 00000000-00006008) "1sW61HT2.exe" called "GetProcAddress" with a parameter PathRemoveFileSpecW (UID: 00000000-00006008) "1sW61HT2.exe" called "GetProcAddress" with a parameter RegOpenKeyExW (UID: 00000000-00006008) "1sW61HT2.exe" called "GetProcAddress" with a parameter RegQueryValueExW (UID: 00000000-00006008) "1sW61HT2.exe" called "GetProcAddress" with a parameter RegCloseKey (UID: 00000000-00006008) "1sW61HT2.exe" called "GetProcAddress" with a parameter ConvertStringSecurityDescriptorToSecurityDescriptorW (UID: 00000000-00006008) "1sW61HT2.exe" called "GetProcAddress" with a parameter CharNextW (UID: 00000000-00006008) "1sW61HT2.exe" called "GetProcAddress" with a parameter DestroyLinkInfo (UID: 00000000-00006008) "1sW61HT2.exe" called "GetProcAddress" with a parameter CoRevokeInitializeSpy (UID: 00000000-00006008) "1sW61HT2.exe" called "GetProcAddress" with a parameter NdrOleInitializeExtension (UID: 00000000-00006008) "1sW61HT2.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00006008) "1sW61HT2.exe" called "GetProcAddress" with a parameter CoGetMarshalSizeMax (UID: 00000000-00006008) "1sW61HT2.exe" called "GetProcAddress" with a parameter CoMarshalInterface (UID: 00000000-00006008) "1sW61HT2.exe" called "GetProcAddress" with a parameter CoUnmarshalInterface (UID: 00000000-00006008) "1sW61HT2.exe" called "GetProcAddress" with a parameter StringFromIID (UID: 00000000-00006008) "1sW61HT2.exe" called "GetProcAddress" with a parameter CoGetPSClsid (UID: 00000000-00006008) "1sW61HT2.exe" called "GetProcAddress" with a parameter CoReleaseMarshalData (UID: 00000000-00006008) "1sW61HT2.exe" called "GetProcAddress" with a parameter DcomChannelSetHResult (UID: 00000000-00006008) "1sW61HT2.exe" called "GetProcAddress" with a parameter GetUserNameExA (UID: 00000000-00006008) "1sW61HT2.exe" called "GetProcAddress" with a parameter O/ (UID: 00000000-00006008) "1sW61HT2.exe" called "GetProcAddress" with a parameter O (UID: 00000000-00006008) "1sW61HT2.exe" called "GetProcAddress" with a parameter ?/ (UID: 00000000-00006008) "1sW61HT2.exe" called "GetProcAddress" with a parameter ? (UID: 00000000-00006008) "1sW61HT2.exe" called "GetProcAddress" with a parameter WSPStartup (UID: 00000000-00006008) "1sW61HT2.exe" called "GetProcAddress" with a parameter WSHOpenSocket (UID: 00000000-00006008) "1sW61HT2.exe" called "GetProcAddress" with a parameter WSHOpenSocket2 (UID: 00000000-00006008) "1sW61HT2.exe" called "GetProcAddress" with a parameter WSHJoinLeaf (UID: 00000000-00006008) "1sW61HT2.exe" called "GetProcAddress" with a parameter WSHNotify (UID: 00000000-00006008) "1sW61HT2.exe" called "GetProcAddress" with a parameter WSHGetSocketInformation (UID: 00000000-00006008) "1sW61HT2.exe" called "GetProcAddress" with a parameter WSHSetSocketInformation (UID: 00000000-00006008) "1sW61HT2.exe" called "GetProcAddress" with a parameter WSHGetSockaddrType (UID: 00000000-00006008) "1sW61HT2.exe" called "GetProcAddress" with a parameter WSHGetWildcardSockaddr (UID: 00000000-00006008) "1sW61HT2.exe" called "GetProcAddress" with a parameter WSHGetBroadcastSockaddr (UID: 00000000-00006008) "1sW61HT2.exe" called "GetProcAddress" with a parameter WSHAddressToString (UID: 00000000-00006008) "1sW61HT2.exe" called "GetProcAddress" with a parameter WSHStringToAddress (UID: 00000000-00006008) "1sW61HT2.exe" called "GetProcAddress" with a parameter WSHIoctl (UID: 00000000-00006008) "schtasks.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00006108) "schtasks.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00006108) "schtasks.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00006108) "schtasks.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00006108) "schtasks.exe" called "GetProcAddress" with a parameter GetUserNameExW (UID: 00000000-00006108) "schtasks.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00006100) "schtasks.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00006100) "schtasks.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00006100) "schtasks.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00006100) "schtasks.exe" called "GetProcAddress" with a parameter GetUserNameExW (UID: 00000000-00006100) "OfficeTrackerNMP131.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00004644) "OfficeTrackerNMP131.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00004644) "OfficeTrackerNMP131.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00004644) "OfficeTrackerNMP131.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00004644)36:T1452,"CREATE TABLE sqlite_master( type text, name text, tbl_name text, rootpage integer, sql text)" (Source: 24920-928-00F16790, Indicator: "create table sqlite_master( type text, name text, tbl_name text, rootpage integer, sql text)"), "SELECT name rootpage sql FROM '%q'.%s" (Source: 24920-928-00F16790, Indicator: "select name rootpage sql from '%q'.%s"), "SELECT name rootpage sql FROM '%q'.%s WHERE %s" (Source: 24920-973-00F02E90, Indicator: "select name rootpage sql from '%q'.%s where %s"), "UPDATE %Q.%s SET type='%s' name=%Q tbl_name=%Q rootpage=#%d sql=%Q WHERE rowid=#%d" (Source: 24920-1124-00F0F4F0, Indicator: "update %q.%s set type='%s' name=%q tbl_name=%q rootpage=#%d sql=%q where rowid=#%d"), "CREATE TABLE" (Source: 24920-1130-00F0F340, Indicator: "create table"), "INSERT INTO %Q.%s VALUES('index',%Q,%Q,#%d,%Q);" (Source: 24920-1313-00F0FB70, Indicator: "insert into %q.%s values('index',%q,%q,#%d,%q);"), "DELETE FROM %Q.%s WHERE tbl_name=%Q and type!='trigger'" (Source: 24920-1326-00F0F800, Indicator: "delete from %q.%s where tbl_name=%q and type!='trigger'"), "DELETE FROM %Q.sqlite_stat1 WHERE tbl=%Q" (Source: 24920-1326-00F0F800, Indicator: "delete from %q.sqlite_stat1 where tbl=%q"), "DELETE FROM %Q.%s WHERE name=%Q" (Source: 24920-1372-00F10320, Indicator: "delete from %q.%s where name=%q"), "DELETE FROM %Q.sqlite_stat1 WHERE idx=%Q" (Source: 24920-1372-00F10320, Indicator: "delete from %q.sqlite_stat1 where idx=%q"), "UPDATE %Q.%s SET sql = sqlite_rename_table(sql, %Q) tbl_name = %Q name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqlite_autoindex%%' AND type='index' THEN 'sqlite_autoindex_' || %Q || substr(name,%d+18) ELSE name END WHERE tbl_name=%Q AND (type='" (Source: 24920-1398-00F0D2C0, Indicator: "update %q.%s set sql = sqlite_rename_table(sql, %q) tbl_name = %q name = case when type='table' then %q when name like 'sqlite_autoindex%%' and type='index' then 'sqlite_autoindex_' || %q || substr(name,%d+18) else name end where tbl_name=%q and (type='") "UPDATE "%w".%s SET sql = substr(sql,1,%d) || ', ' || %Q || substr(sql,%d) WHERE type = 'table' AND name = %Q" (Source: 24920-1400-00F0D570, Indicator: "update "%w".%s set sql = substr(sql,1,%d) || ', ' || %q || substr(sql,%d) where type = 'table' and name = %q"), "UPDATE %Q.%s SET type='table' name=%Q tbl_name=%Q rootpage=0 sql=%Q WHERE rowid=#%d" (Source: 24920-1403-00F1C570, Indicator: "update %q.%s set type='table' name=%q tbl_name=%q rootpage=0 sql=%q where rowid=#%d"), "CREATE TABLE sqlite_master(" (Source: 00000000-00004644.00000000.90807.01117000.00000002.mdmp, Indicator: "create table sqlite_master(") "CREATE TABLE" (Source: 00000000-00004644.00000000.90807.01117000.00000002.mdmp, Indicator: "create table") "SELECT name, rootpage, sql FROM '%q'.%s WHERE %s" (Source: 00000000-00004644.00000000.90807.01117000.00000002.mdmp, Indicator: "select name, rootpage, sql from '%q'.%s where %s") "UPDATE %Q.%s SET sql = sqlite_rename_table(sql, %Q), tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqlite_autoindex%%' AND type='index' THEN 'sqlite_autoindex_' || %Q || substr(name,%d+18) ELSE name END WHERE tbl_name=%Q AND (type='table' OR type='index' OR type='trigger');" (Source: 00000000-00004644.00000000.90807.01117000.00000002.mdmp, Indicator: "update %q.%s set sql = sqlite_rename_table(sql, %q) tbl_name = %q name = case when type='table' then %q when name like 'sqlite_autoindex%%' and type='index' then 'sqlite_autoindex_' || %q || substr(name,%d+18) else name end where tbl_name=%q and (type='table' or type='index' or type='trigger');"), "UPDATE "%w".%s SET sql = substr(sql,1,%d) || ', ' || %Q || substr(sql,%d) WHERE type = 'table' AND name = %Q" (Source: 00000000-00004644.00000000.90807.01117000.00000002.mdmp, Indicator: "update "%w".%s set sql = substr(sql,1,%d) || ', ' || %q || substr(sql,%d) where type = 'table' and name = %q"), "UPDATE %Q.%s SET type='%s' name=%Q tbl_name=%Q rootpage=#%d sql=%Q WHERE rowid=#%d" (Source: 00000000-00004644.00000000.90807.01117000.00000002.mdmp, Indicator: "update %q.%s set type='%s' name=%q tbl_name=%q rootpage=#%d sql=%q where rowid=#%d"), "DELETE FROM %Q.%s WHERE tbl_name=%Q and type!='trigger'" (Source: 00000000-00004644.00000000.90807.01117000.00000002.mdmp, Indicator: "delete from %q.%s where tbl_name=%q and type!='trigger'"), "DELETE FROM %Q.sqlite_stat1 WHERE tbl=%Q" (Source: 00000000-00004644.00000000.90807.01117000.00000002.mdmp, Indicator: "delete from %q.sqlite_stat1 where tbl=%q"), "INSERT INTO %Q.%s VALUES('index',%Q,%Q,#%d,%Q);" (Source: 00000000-00004644.00000000.90807.01117000.00000002.mdmp, Indicator: "insert into %q.%s values('index',%q,%q,#%d,%q);"), "DELETE FROM %Q.%s WHERE name=%Q" (Source: 00000000-00004644.00000000.90807.01117000.00000002.mdmp, Indicator: "delete from %q.%s where name=%q"), "DELETE FROM %Q.sqlite_stat1 WHERE idx=%Q" (Source: 00000000-00004644.00000000.90807.01117000.00000002.mdmp, Indicator: "delete from %q.sqlite_stat1 where idx=%q"), "SELECT name rootpage sql FROM '%q'.%s" (Source: 00000000-00004644.00000000.90807.01117000.00000002.mdmp, Indicator: "select name rootpage sql from '%q'.%s")37:T674,Sleep@KERNEL32.DLL at 00000000-00005816-22033-11-00C46A60 WaitForSingleObject@KERNEL32.DLL at 00000000-00005816-22033-37-00C43FEF MsgWaitForMultipleObjects at 00000000-00005816-22033-95-00C43680 Sleep@KERNEL32.DLL at 00000000-00005868-22530-11-01046A60 WaitForSingleObject@KERNEL32.DLL at 00000000-00005868-22530-37-01043FEF MsgWaitForMultipleObjects at 00000000-00005868-22530-95-01043680 Sleep@KERNEL32.DLL at 00000000-00005944-23959-11-01216A60 WaitForSingleObject@KERNEL32.DLL at 00000000-00005944-23959-37-01213FEF MsgWaitForMultipleObjects at 00000000-00005944-23959-95-01213680 Sleep@KERNEL32.DLL at 00000000-00006008-24920-1527-00EF65C0 Sleep@KERNEL32.DLL at 00000000-00006008-24920-1532-00EF6230 Sleep@KERNEL32.DLL at 00000000-00006008-24920-1537-00EF5B80 Sleep@KERNEL32.DLL at 00000000-00006008-24920-1543-00EF5800 WaitForSingleObject@KERNEL32.DLL at 00000000-00006008-24920-2792-00E6A230 WaitForSingleObject@KERNEL32.DLL at 00000000-00006008-24920-2800-00E65CC0 Sleep@KERNEL32.DLL at 00000000-00006008-24920-2804-00E63300 WaitForSingleObject@KERNEL32.DLL at 00000000-00006008-24920-2847-00E53950 Sleep@KERNEL32.DLL at 00000000-00006008-24920-3032-00E6FC00 WaitForSingleObject@KERNEL32.DLL at 00000000-00006008-24920-4364-00EC5586 WaitForSingleObject@KERNEL32.DLL at 00000000-00006008-24920-4387-00EC621D Sleep@KERNEL32.DLL at 00000000-00004644-28990-1528-010965C0 Sleep@KERNEL32.DLL at 00000000-00004644-28990-1533-01096230 Sleep@KERNEL32.DLL at 00000000-00004644-28990-1538-01095B80 Sleep@KERNEL32.DLL at 00000000-00004644-28990-1544-01095800 WaitForSingleObject@KERNEL32.DLL at 00000000-00004644-28990-2792-0100A23038:T581,LoadLibraryA@KERNEL32.DLL at 00000000-00005816-22033-33-00C42F1D LoadLibraryExA@KERNEL32.DLL at 00000000-00005816-22033-41-00C46495 LoadLibraryA@KERNEL32.DLL at 00000000-00005816-22033-42-00C4202A LoadLibraryA@KERNEL32.DLL at 00000000-00005816-22033-73-00C417EE LoadLibraryA@KERNEL32.DLL at 00000000-00005816-22033-112-00C44224 LoadLibraryA@KERNEL32.DLL at 00000000-00005868-22530-33-01042F1D LoadLibraryExA@KERNEL32.DLL at 00000000-00005868-22530-41-01046495 LoadLibraryA@KERNEL32.DLL at 00000000-00005868-22530-42-0104202A LoadLibraryA@KERNEL32.DLL at 00000000-00005868-22530-73-010417EE LoadLibraryA@KERNEL32.DLL at 00000000-00005868-22530-112-01044224 LoadLibraryA@KERNEL32.DLL at 00000000-00005944-23959-33-01212F1D LoadLibraryExA@KERNEL32.DLL at 00000000-00005944-23959-41-01216495 LoadLibraryA@KERNEL32.DLL at 00000000-00005944-23959-42-0121202A LoadLibraryA@KERNEL32.DLL at 00000000-00005944-23959-73-012117EE LoadLibraryA@KERNEL32.DLL at 00000000-00005944-23959-112-01214224 LoadLibraryA@KERNEL32.DLL at 00000000-00006008-24920-2715-00E8D100 LoadLibraryExW@KERNEL32.DLL at 00000000-00006008-24920-3250-00F410D7 LoadLibraryA@KERNEL32.DLL at 00000000-00006008-24920-4323-00EC391F LoadLibraryA@KERNEL32.DLL at 00000000-00004644-28990-2717-0102D100 LoadLibraryExW@KERNEL32.DLL at 00000000-00004644-28990-3250-010E10D7 LoadLibraryA@KERNEL32.DLL at 00000000-00004644-28990-4322-0106391F39:T4fc,"7ca6811b3a9febcffeeee9d839ad6b8eb096688c666be805325d1acf663cc833" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE "cZ2SE56.exe" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE "nO2Ue30.exe" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE "zW9af77.exe" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE "2IW9992.exe" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE "5UO2EL6.exe" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE "DISMHOST.EXE.6A9813CA.bin" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE3a:Td00,"Software\Microsoft\Active Setup\Installed Components\{89820200-ECBD-11CF-8B85-00AA005B4383}" in Source: 00000000-00003472.00000000.87211.001F1000.00000020.mdmp "Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676" in Source: 00000000-00004644.00000000.90807.00330000.00000004.mdmp "Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676" in Source: 00000000-00004644.00000000.90807.00330000.00000004.mdmp "Software\Microsoft\Windows Messaging Subsystem\Profiles\9375CFF0413111d3B88A00104B2A6676" in Source: 00000000-00004644.00000000.90807.00330000.00000004.mdmp "Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676" in Source: 00000000-00004644.00000000.90807.00330000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\App Paths" in Source: 00000000-00005816.00000002.82216.00C41000.00000020.mdmp "Software\Microsoft\Windows\CurrentVersion\App Paths" in Source: 00000000-00005868.00000001.80369.01041000.00000020.mdmp "Software\Microsoft\Windows\CurrentVersion\App Paths" in Source: 00000000-00005944.00000002.82367.01211000.00000020.mdmp "Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676" in Source: 00000000-00006008.00000000.78573.004C0000.00000004.mdmp "Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676" in Source: 00000000-00006008.00000000.78573.004C0000.00000004.mdmp "Software\Microsoft\Windows Messaging Subsystem\Profiles\9375CFF0413111d3B88A00104B2A6676" in Source: 00000000-00006008.00000000.78573.004C0000.00000004.mdmp "Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676" in Source: 00000000-00006008.00000000.78573.004C0000.00000004.mdmp "Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676" in Source: 00000000-00006008.00000001.80496.004C0000.00000004.mdmp "Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676" in Source: 00000000-00006008.00000001.80496.004C0000.00000004.mdmp "Software\Microsoft\Windows Messaging Subsystem\Profiles\9375CFF0413111d3B88A00104B2A6676" in Source: 00000000-00006008.00000001.80496.004C0000.00000004.mdmp "Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676" in Source: 00000000-00006008.00000001.80496.004C0000.00000004.mdmp "Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676" in Source: 00000000-00006008.00000002.82419.004C0000.00000004.mdmp "Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676" in Source: 00000000-00006008.00000002.82419.004C0000.00000004.mdmp "Software\Microsoft\Windows Messaging Subsystem\Profiles\9375CFF0413111d3B88A00104B2A6676" in Source: 00000000-00006008.00000002.82419.004C0000.00000004.mdmp "Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676" in Source: 00000000-00006008.00000002.82419.004C0000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\App Paths" in Source: 00000000-00006080.00000002.82332.00C91000.00000020.mdmp3b:Td17,"7ca6811b3a9febcffeeee9d839ad6b8eb096688c666be805325d1acf663cc833.exe" loaded module "%WINDIR%\SYSTEM32\ADVPACK.DLL" at base 69b70000 "7ca6811b3a9febcffeeee9d839ad6b8eb096688c666be805325d1acf663cc833.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 74d60000 "cZ2SE56.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 699d0000 "cZ2SE56.exe" loaded module "%WINDIR%\SYSTEM32\ADVPACK.DLL" at base 69400000 "cZ2SE56.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 74d60000 "nO2Ue30.exe" loaded module "%WINDIR%\SYSTEM32\ADVPACK.DLL" at base 69b70000 "nO2Ue30.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 74d60000 "zW9af77.exe" loaded module "%WINDIR%\SYSTEM32\ADVPACK.DLL" at base 69400000 "zW9af77.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 74d60000 "1sW61HT2.exe" loaded module "ADVAPI32.DLL" at base 75bc0000 "1sW61HT2.exe" loaded module "KERNEL32.DLL" at base 75c90000 "1sW61HT2.exe" loaded module "CRYPTBASE.DLL" at base 74db0000 "1sW61HT2.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 73b30000 "1sW61HT2.exe" loaded module "CLBCATQ.DLL" at base 758f0000 "1sW61HT2.exe" loaded module "%WINDIR%\SYSTEM32\SHELL32.DLL" at base 76120000 "1sW61HT2.exe" loaded module "PROPSYS.DLL" at base 739c0000 "1sW61HT2.exe" loaded module "OLE32.DLL" at base 75dd0000 "1sW61HT2.exe" loaded module "COMCTL32.DLL" at base 73d50000 "1sW61HT2.exe" loaded module "OLEAUT32.DLL" at base 75f30000 "1sW61HT2.exe" loaded module "SETUPAPI.DLL" at base 752a0000 "1sW61HT2.exe" loaded module "RPCRT4.DLL" at base 75550000 "1sW61HT2.exe" loaded module "%WINDIR%\SYSTEM32\PROPSYS.DLL" at base 739c0000 "1sW61HT2.exe" loaded module "NTMARTA.DLL" at base 74320000 "1sW61HT2.exe" loaded module "SHELL32.DLL" at base 76120000 "1sW61HT2.exe" loaded module "API-MS-WIN-SECURITY-SDDL-L1-1-0.DLL" at base 75c70000 "1sW61HT2.exe" loaded module "PROFAPI.DLL" at base 74ec0000 "1sW61HT2.exe" loaded module "APPHELP.DLL" at base 74d60000 "1sW61HT2.exe" loaded module "%WINDIR%\SYSTEM32\SHDOCVW.DLL" at base 6f6d0000 "1sW61HT2.exe" loaded module "LINKINFO.DLL" at base 6fbe0000 "1sW61HT2.exe" loaded module "USER32.DLL" at base 75af0000 "1sW61HT2.exe" loaded module "NTSHRUI.DLL" at base 71f20000 "1sW61HT2.exe" loaded module "SRVCLI.DLL" at base 74ab0000 "1sW61HT2.exe" loaded module "CSCAPI.DLL" at base 70240000 "1sW61HT2.exe" loaded module "SLC.DLL" at base 733b0000 "1sW61HT2.exe" loaded module "SHLWAPI.DLL" at base 77160000 "1sW61HT2.exe" loaded module "SSPICLI.DLL" at base 74d40000 "1sW61HT2.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 74d60000 "1sW61HT2.exe" loaded module "WINHTTP.DLL" at base 70d00000 "1sW61HT2.exe" loaded module "WININET.DLL" at base 75640000 "1sW61HT2.exe" loaded module "%WINDIR%\SYSTEM32\MSWSOCK.DLL" at base 74880000 "1sW61HT2.exe" loaded module "%WINDIR%\SYSTEM32\WSHTCPIP.DLL" at base 743e0000 "schtasks.exe" loaded module "%WINDIR%\SYSTEM32\TASKSCHD.DLL" at base 734c0000 "schtasks.exe" loaded module "SSPICLI.DLL" at base 74d40000 "schtasks.exe" loaded module "ADVAPI32.DLL" at base 75bc0000 "schtasks.exe" loaded module "API-MS-WIN-SECURITY-LSALOOKUP-L1-1-0.DLL" at base 75c70000 "schtasks.exe" loaded module "XMLLITE.DLL" at base 73550000 "OfficeTrackerNMP131.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 699d00003c:T100c,"7ca6811b3a9febcffeeee9d839ad6b8eb096688c666be805325d1acf663cc833" was detected as "Microsoft Cabinet" and name: "sfx" "7ca6811b3a9febcffeeee9d839ad6b8eb096688c666be805325d1acf663cc833" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "7ca6811b3a9febcffeeee9d839ad6b8eb096688c666be805325d1acf663cc833" was detected as "Microsoft Visual C/C++" and name: "Compiler" "7ca6811b3a9febcffeeee9d839ad6b8eb096688c666be805325d1acf663cc833" was detected as "Microsoft Cabinet File" and name: "Archive" "7ca6811b3a9febcffeeee9d839ad6b8eb096688c666be805325d1acf663cc833" was detected as "Microsoft Linker" and name: "Linker" "FANBooster131.exe" was detected as "Microsoft Cabinet" and name: "sfx" "FANBooster131.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "FANBooster131.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "FANBooster131.exe" was detected as "Microsoft Cabinet File" and name: "Archive" "FANBooster131.exe" was detected as "Microsoft Linker" and name: "Linker" "cZ2SE56.exe" was detected as "Microsoft Cabinet" and name: "sfx" "cZ2SE56.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "cZ2SE56.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "cZ2SE56.exe" was detected as "Microsoft Cabinet File" and name: "Archive" "cZ2SE56.exe" was detected as "Microsoft Linker" and name: "Linker" "nO2Ue30.exe" was detected as "Microsoft Cabinet" and name: "sfx" "nO2Ue30.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "nO2Ue30.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "nO2Ue30.exe" was detected as "Microsoft Cabinet File" and name: "Archive" "nO2Ue30.exe" was detected as "Microsoft Linker" and name: "Linker" "4OG898Ow.exe" was detected as "Microsoft Cabinet" and name: "sfx" "4OG898Ow.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "4OG898Ow.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "4OG898Ow.exe" was detected as "Microsoft Cabinet File" and name: "Archive" "4OG898Ow.exe" was detected as "Microsoft Linker" and name: "Linker" "zW9af77.exe" was detected as "Microsoft Cabinet" and name: "sfx" "zW9af77.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "zW9af77.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "zW9af77.exe" was detected as "Microsoft Cabinet File" and name: "Archive" "zW9af77.exe" was detected as "Microsoft Linker" and name: "Linker" "2IW9992.exe" was detected as "Microsoft Cabinet" and name: "sfx" "2IW9992.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "2IW9992.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "2IW9992.exe" was detected as "Microsoft Cabinet File" and name: "Archive" "2IW9992.exe" was detected as "Microsoft Linker" and name: "Linker" "5UO2EL6.exe" was detected as "Microsoft Cabinet" and name: "sfx" "5UO2EL6.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "5UO2EL6.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "5UO2EL6.exe" was detected as "Microsoft Cabinet File" and name: "Archive" "5UO2EL6.exe" was detected as "Microsoft Linker" and name: "Linker" "3up60Ma.exe" was detected as "Microsoft Cabinet" and name: "sfx" "3up60Ma.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "3up60Ma.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "3up60Ma.exe" was detected as "Microsoft Cabinet File" and name: "Archive" "3up60Ma.exe" was detected as "Microsoft Linker" and name: "Linker" "DISMHOST.EXE.6A9813CA.bin" was detected as "Microsoft Cabinet" and name: "sfx" "DISMHOST.EXE.6A9813CA.bin" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "DISMHOST.EXE.6A9813CA.bin" was detected as "Microsoft Visual C/C++" and name: "Compiler" "DISMHOST.EXE.6A9813CA.bin" was detected as "Microsoft Cabinet File" and name: "Archive" "DISMHOST.EXE.6A9813CA.bin" was detected as "Microsoft Linker" and name: "Linker"3d:T17d3,"7ca6811b3a9febcffeeee9d839ad6b8eb096688c666be805325d1acf663cc833" file has an entrypoint instructions - "call 0x407155,jmp 0x406a6a,push 0x58,push 0x4072b8,call 0x407208,xor ebx, ebx,mov dword ptr [ebp - 0x20], ebx,lea eax, [ebp - 0x68],push eax,call dword ptr [0x40a184],mov dword ptr [ebp - 4], ebx,mov eax, dword ptr fs:[0x18],mov esi, dword ptr [eax + 4],mov edi, ebx,mov edx, 0x4088ac,mov ecx, esi,xor eax, eax,lock cmpxchg dword ptr [edx], ecx,test eax, eax,je 0x406abc,cmp eax, esi,jne 0x406aaf,xor esi, esi,inc esi,mov edi, esi,jmp 0x406abf,push 0x3e8,call dword ptr [0x40a188],jmp 0x406a93,xor esi, esi,inc esi," "FANBooster131.exe" file has an entrypoint instructions - "call 0x4e6d12,jmp 0x4e64df,cmp ecx, dword ptr [0x56d048],jne 0x4e666e,ret ,jmp 0x4e6e45,push ebp,mov ebp, esp,and dword ptr [0x56f3d0], 0,sub esp, 0x24,or dword ptr [0x56d050], 1,push 0xa,call dword ptr [0x5370d8],test eax, eax,je 0x4e6843,and dword ptr [ebp - 0x10], 0,xor eax, eax,push ebx,push esi,push edi,xor ecx, ecx,lea edi, [ebp - 0x24],push ebx,cpuid ,mov esi, ebx,pop ebx,nop ,mov dword ptr [edi], eax,mov dword ptr [edi + 4], esi,mov dword ptr [edi + 8], ecx,xor ecx, ecx,mov dword ptr [edi + 0xc], edx,mov eax, dword ptr [ebp - 0x24],mov edi, dword ptr [ebp - 0x20]," "cZ2SE56.exe" file has an entrypoint instructions - "call 0x407155,jmp 0x406a6a,push 0x58,push 0x4072b8,call 0x407208,xor ebx, ebx,mov dword ptr [ebp - 0x20], ebx,lea eax, [ebp - 0x68],push eax,call dword ptr [0x40a184],mov dword ptr [ebp - 4], ebx,mov eax, dword ptr fs:[0x18],mov esi, dword ptr [eax + 4],mov edi, ebx,mov edx, 0x4088ac,mov ecx, esi,xor eax, eax,lock cmpxchg dword ptr [edx], ecx,test eax, eax,je 0x406abc,cmp eax, esi,jne 0x406aaf,xor esi, esi,inc esi,mov edi, esi,jmp 0x406abf,push 0x3e8,call dword ptr [0x40a188],jmp 0x406a93,xor esi, esi,inc esi," "nO2Ue30.exe" file has an entrypoint instructions - "call 0x407155,jmp 0x406a6a,push 0x58,push 0x4072b8,call 0x407208,xor ebx, ebx,mov dword ptr [ebp - 0x20], ebx,lea eax, [ebp - 0x68],push eax,call dword ptr [0x40a184],mov dword ptr [ebp - 4], ebx,mov eax, dword ptr fs:[0x18],mov esi, dword ptr [eax + 4],mov edi, ebx,mov edx, 0x4088ac,mov ecx, esi,xor eax, eax,lock cmpxchg dword ptr [edx], ecx,test eax, eax,je 0x406abc,cmp eax, esi,jne 0x406aaf,xor esi, esi,inc esi,mov edi, esi,jmp 0x406abf,push 0x3e8,call dword ptr [0x40a188],jmp 0x406a93,xor esi, esi,inc esi," "4OG898Ow.exe" file has an entrypoint instructions - "call 0x420aea,jmp 0x4203fb,push ebp,mov ebp, esp,push esi,push dword ptr [ebp + 8],mov esi, ecx,call 0x4205e7,mov dword ptr [esi], 0x49fdf0,mov eax, esi,pop esi,pop ebp,ret 4,and dword ptr [ecx + 4], 0,mov eax, ecx,and dword ptr [ecx + 8], 0,mov dword ptr [ecx + 4], 0x49fdf8,mov dword ptr [ecx], 0x49fdf0,ret ,push ebp,mov ebp, esp,push esi,push dword ptr [ebp + 8],mov esi, ecx,call 0x4205e7,mov dword ptr [esi], 0x49fe0c,mov eax, esi,pop esi,pop ebp,ret 4,and dword ptr [ecx + 4], 0,mov eax, ecx,and dword ptr [ecx + 8], 0," "zW9af77.exe" file has an entrypoint instructions - "call 0x407155,jmp 0x406a6a,push 0x58,push 0x4072b8,call 0x407208,xor ebx, ebx,mov dword ptr [ebp - 0x20], ebx,lea eax, [ebp - 0x68],push eax,call dword ptr [0x40a184],mov dword ptr [ebp - 4], ebx,mov eax, dword ptr fs:[0x18],mov esi, dword ptr [eax + 4],mov edi, ebx,mov edx, 0x4088ac,mov ecx, esi,xor eax, eax,lock cmpxchg dword ptr [edx], ecx,test eax, eax,je 0x406abc,cmp eax, esi,jne 0x406aaf,xor esi, esi,inc esi,mov edi, esi,jmp 0x406abf,push 0x3e8,call dword ptr [0x40a188],jmp 0x406a93,xor esi, esi,inc esi," "2IW9992.exe" file has an entrypoint instructions - "call 0x40b7c2,jmp 0x40b166,and dword ptr [ecx + 4], 0,mov eax, ecx,and dword ptr [ecx + 8], 0,mov dword ptr [ecx + 4], 0x42a760,mov dword ptr [ecx], 0x42964c,ret ,and dword ptr [ecx + 4], 0,mov eax, ecx,and dword ptr [ecx + 8], 0,mov dword ptr [ecx + 4], 0x42a770,mov dword ptr [ecx], 0x4295a0,ret ,lea eax, [ecx + 4],mov dword ptr [ecx], 0x429330,push eax,call 0x410ff3,pop ecx,ret ,push ebp,mov ebp, esp,sub esp, 0xc,lea ecx, [ebp - 0xc],call 0x40b2f2,push 0x437784,lea eax, [ebp - 0xc],push eax," "5UO2EL6.exe" file has an entrypoint instructions - "call 0x40b7c2,jmp 0x40b166,and dword ptr [ecx + 4], 0,mov eax, ecx,and dword ptr [ecx + 8], 0,mov dword ptr [ecx + 4], 0x42a760,mov dword ptr [ecx], 0x42964c,ret ,and dword ptr [ecx + 4], 0,mov eax, ecx,and dword ptr [ecx + 8], 0,mov dword ptr [ecx + 4], 0x42a770,mov dword ptr [ecx], 0x4295a0,ret ,lea eax, [ecx + 4],mov dword ptr [ecx], 0x429330,push eax,call 0x410ff3,pop ecx,ret ,push ebp,mov ebp, esp,sub esp, 0xc,lea ecx, [ebp - 0xc],call 0x40b2f2,push 0x437784,lea eax, [ebp - 0xc],push eax," "3up60Ma.exe" file has an entrypoint instructions - "call 0x4032e6,jne 0x4032ed,je 0x4032ed,test eax, 0xeb5b9ba5,or al, byte ptr [ecx + eax*4 - 0x15],out 0x32, al,add byte ptr [eax], al,jmp 0x4032fe,and ch, bl,cmc ,inc esp,and dh, byte ptr [esi + eax + 0x75],add al, 0x94,push ss,xor dword ptr [ecx - 0x3dbbb39], ebx,xor byte ptr [eax], al,add byte ptr [eax], al,sub esp, 4,jne 0x403317,je 0x403317,dec ebp,lahf ,mov edx, dword ptr [esp],add esp, 4,jmp 0x403325,mov byte ptr [ecx], ch,shr bl, 5,test al, 0xeb,stc ,mov byte ptr [eax - 0x4373fa15], ch,shr bl, 1,pop es,add eax, dword ptr fs:[edx],je 0x40333c,jne 0x40333c,jb 0x40337c,and dh, byte ptr [esi],in eax, dx,push dword ptr [eax + 0xa4],jne 0x403349," "DISMHOST.EXE.6A9813CA.bin" file has an entrypoint instructions - "call 0x100a7e6,jmp 0x10097f4,int3 ,int3 ,int3 ,int3 ,int3 ,push 0x14,push 0x1010878,call 0x1009d10,and dword ptr [ebp - 4], 0,dec dword ptr [ebp + 0x10],js 0x1009afc,mov ecx, dword ptr [ebp + 8],sub ecx, dword ptr [ebp + 0xc],mov dword ptr [ebp + 8], ecx,call dword ptr [ebp + 0x14],jmp 0x1009abc,mov eax, dword ptr [ebp - 0x14],mov dword ptr [ebp - 0x1c], eax,mov eax, dword ptr [ebp - 0x1c],mov eax, dword ptr [eax],mov dword ptr [ebp - 0x20], eax,mov eax, dword ptr [ebp - 0x20],cmp dword ptr [eax], 0xe06d7363,je 0x1009af3,mov dword ptr [ebp - 0x24], 0,mov eax, dword ptr [ebp - 0x24],ret ,call dword ptr [0x1001210],mov esp, dword ptr [ebp - 0x18],"3e:T4ce,"7ca6811b3a9febcffeeee9d839ad6b8eb096688c666be805325d1acf663cc833.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "7ca6811b3a9febcffeeee9d839ad6b8eb096688c666be805325d1acf663cc833.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "cZ2SE56.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "cZ2SE56.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "nO2Ue30.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "nO2Ue30.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "zW9af77.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "zW9af77.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "1sW61HT2.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "1sW61HT2.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "OfficeTrackerNMP131.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "OfficeTrackerNMP131.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US")3f:T45b,Observed system executable string:"C:\Windows\system32\apphelp.dll" [Source: 00005868.000016EC.1177453.00050000.wprm] Observed system executable string:"%WINDIR%\system32\advpack.dll" [Source: 00000000-00005816-00000C2B-227502169] Observed system executable string:"rundll32.exe %WINDIR%\system32\advpack.dll,DelNodeRunDLL32 "%TEMP%\IXP000.TMP\"" [Source: 00000000-00005816-00000BC1-227628175] Observed system executable string:"rundll32.exe %WINDIR%\system32\advpack.dll,DelNodeRunDLL32 "%TEMP%\IXP001.TMP\"" [Source: 00000000-00005868-00000BC1-228251888] Observed system executable string:"rundll32.exe %WINDIR%\system32\advpack.dll,DelNodeRunDLL32 "%TEMP%\IXP002.TMP\"" [Source: 00000000-00006080-00000BC1-228839810] Observed system executable string:"rundll32.exe %WINDIR%\system32\advpack.dll,DelNodeRunDLL32 "%TEMP%\IXP003.TMP\"" [Source: 00000000-00005944-00000BC1-229480837] Observed system executable string:"%WINDIR%\system32\uxtheme.dll" [Source: 00000000-00006008-00000C2B-230288669] Observed system executable string:"%WINDIR%\System32\shdocvw.dll" [Source: 00000000-00006008-00000C2B-232892526]40:Tb3f,"FANBooster131.exe" has type "PE32 executable for MS Windows 6.00 (GUI) Intel i386 5 sections"- Location: [%TEMP%\FANBooster131\FANBooster131.exe]- [targetUID: 00000000-00006008] "cZ2SE56.exe" has type "PE32 executable for MS Windows 6.00 (GUI) Intel i386 5 sections"- Location: [%TEMP%\IXP000.TMP\cZ2SE56.exe]- [targetUID: 00000000-00005816] "nO2Ue30.exe" has type "PE32 executable for MS Windows 6.00 (GUI) Intel i386 5 sections"- Location: [%TEMP%\IXP001.TMP\nO2Ue30.exe]- [targetUID: 00000000-00005868] "4OG898Ow.exe" has type "PE32 executable for MS Windows 5.01 (GUI) Intel i386 5 sections"- Location: [%TEMP%\IXP001.TMP\4OG898Ow.exe]- [targetUID: 00000000-00005868] "zW9af77.exe" has type "PE32 executable for MS Windows 6.00 (GUI) Intel i386 5 sections"- Location: [%TEMP%\IXP002.TMP\zW9af77.exe]- [targetUID: 00000000-00005944] "2IW9992.exe" has type "PE32 executable for MS Windows 6.00 (console) Intel i386 5 sections"- Location: [%TEMP%\IXP003.TMP\2IW9992.exe]- [targetUID: 00000000-00005944] "5UO2EL6.exe" has type "PE32 executable for MS Windows 6.00 (console) Intel i386 5 sections"- Location: [%TEMP%\IXP000.TMP\5UO2EL6.exe]- [targetUID: 00000000-00005816] "3up60Ma.exe" has type "PE32 executable for MS Windows 5.01 (GUI) Intel i386"- Location: [%TEMP%\IXP002.TMP\3up60Ma.exe]- [targetUID: 00000000-00006080] "FANBooster131.lnk" has type "MS Windows shortcut Item id list present Points to a file or directory Has Description string Has Relative path Unicoded MachineID hapubws-pc KnownFolderID F3CE0F7C-4901-4ACC-8648-D5D44B04EF8F Archive NeedIndexed ctime=Wed Sep 2 09:58:01 2026 atime=Wed Sep 2 09:58:01 2026 mtime=Sun Nov 26 18:32:00 2023 length=1539756 window=normal IDListSize 0x01f6 Root folder "59031A47-3F72-44A7-89C5-5595FE6B30EE" LocalBasePath "C:\Users\""- Location: [%APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\FANBooster131.lnk]- [targetUID: 00000000-00006008] "dism.log" has type "Unicode text UTF-8 (with BOM) text with very long lines (312) with CRLF line terminators"- [targetUID: N/A] "DISMHOST.EXE.6A9813CA.bin" has type "PE32 executable for MS Windows 5.01 (GUI) Intel i386 4 sections"- [targetUID: N/A] "rise131M9Asphalt.tmp" has type "ASCII text with no line terminators"- Location: [%TEMP%\rise131M9Asphalt.tmp]- [targetUID: 00000000-00006008] "1sW61HT2.exe" has type "PE32 executable for MS Windows 6.00 (GUI) Intel i386 5 sections"- Location: [%TEMP%\IXP003.TMP\1sW61HT2.exe]- [targetUID: 00000000-00005944] "OfficeTrackerNMP131.exe" has type "PE32 executable for MS Windows 6.00 (GUI) Intel i386 5 sections"- Location: [%ALLUSERSPROFILE%\OfficeTrackerNMP131\OfficeTrackerNMP131.exe]- [targetUID: 00000000-00006008] "MaxLoonaFest131.exe" has type "PE32 executable for MS Windows 6.00 (GUI) Intel i386 5 sections"- Location: [%LOCALAPPDATA%\MaxLoonaFest131\MaxLoonaFest131.exe]- [targetUID: 00000000-00006008]41:Tadb,"7ca6811b3a9febcffeeee9d839ad6b8eb096688c666be805325d1acf663cc833.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\SIDEBYSIDE"; Key: ""; Value: "") "7ca6811b3a9febcffeeee9d839ad6b8eb096688c666be805325d1acf663cc833.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: ""; Value: "") "7ca6811b3a9febcffeeee9d839ad6b8eb096688c666be805325d1acf663cc833.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SAFEBOOT\OPTION"; Key: ""; Value: "") "7ca6811b3a9febcffeeee9d839ad6b8eb096688c666be805325d1acf663cc833.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SRP\GP\DLL"; Key: ""; Value: "") "7ca6811b3a9febcffeeee9d839ad6b8eb096688c666be805325d1acf663cc833.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "7ca6811b3a9febcffeeee9d839ad6b8eb096688c666be805325d1acf663cc833.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "7ca6811b3a9febcffeeee9d839ad6b8eb096688c666be805325d1acf663cc833.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\SIDEBYSIDE\ASSEMBLYSTORAGEROOTS"; Key: ""; Value: "") "7ca6811b3a9febcffeeee9d839ad6b8eb096688c666be805325d1acf663cc833.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS"; Key: ""; Value: "") "7ca6811b3a9febcffeeee9d839ad6b8eb096688c666be805325d1acf663cc833.exe" (Access type: "OPEN"; Path: "HKCU\CONTROL PANEL\DESKTOP\MUICACHED\MACHINELANGUAGECONFIGURATION"; Key: ""; Value: "") "7ca6811b3a9febcffeeee9d839ad6b8eb096688c666be805325d1acf663cc833.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\MUI\SETTINGS"; Key: ""; Value: "") "7ca6811b3a9febcffeeee9d839ad6b8eb096688c666be805325d1acf663cc833.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\CONTROL PANEL\DESKTOP"; Key: ""; Value: "") "7ca6811b3a9febcffeeee9d839ad6b8eb096688c666be805325d1acf663cc833.exe" (Access type: "OPEN"; Path: "HKCU\CONTROL PANEL\DESKTOP\LANGUAGECONFIGURATION"; Key: ""; Value: "") "7ca6811b3a9febcffeeee9d839ad6b8eb096688c666be805325d1acf663cc833.exe" (Access type: "OPEN"; Path: "HKCU\CONTROL PANEL\DESKTOP"; Key: ""; Value: "") "7ca6811b3a9febcffeeee9d839ad6b8eb096688c666be805325d1acf663cc833.exe" (Access type: "OPEN"; Path: "HKCU\CONTROL PANEL\DESKTOP\MUICACHED"; Key: ""; Value: "") "7ca6811b3a9febcffeeee9d839ad6b8eb096688c666be805325d1acf663cc833.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: ""; Value: "") "7ca6811b3a9febcffeeee9d839ad6b8eb096688c666be805325d1acf663cc833.exe" (Access type: "OPEN"; Path: "HKLM"; Key: ""; Value: "")42:Tfff,"7ca6811b3a9febcffeeee9d839ad6b8eb096688c666be805325d1acf663cc833.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\SIDEBYSIDE"; Key: "PREFEREXTERNALMANIFEST"; Value: "") "7ca6811b3a9febcffeeee9d839ad6b8eb096688c666be805325d1acf663cc833.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "CWDILLEGALINDLLSEARCH"; Value: "") "7ca6811b3a9febcffeeee9d839ad6b8eb096688c666be805325d1acf663cc833.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED"; Value: "") "7ca6811b3a9febcffeeee9d839ad6b8eb096688c666be805325d1acf663cc833.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS"; Key: "SHOWDEBUGINFO"; Value: "") "7ca6811b3a9febcffeeee9d839ad6b8eb096688c666be805325d1acf663cc833.exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP"; Key: "PREFERREDUILANGUAGES"; Value: "") "7ca6811b3a9febcffeeee9d839ad6b8eb096688c666be805325d1acf663cc833.exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP\MUICACHED"; Key: "MACHINEPREFERREDUILANGUAGES"; Value: "") "7ca6811b3a9febcffeeee9d839ad6b8eb096688c666be805325d1acf663cc833.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: "COMPATDLL"; Value: "") "7ca6811b3a9febcffeeee9d839ad6b8eb096688c666be805325d1acf663cc833.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: "00060101.00060101"; Value: "") "7ca6811b3a9febcffeeee9d839ad6b8eb096688c666be805325d1acf663cc833.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: ""; Value: "") "7ca6811b3a9febcffeeee9d839ad6b8eb096688c666be805325d1acf663cc833.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "SAFEDLLSEARCHMODE"; Value: "") "7ca6811b3a9febcffeeee9d839ad6b8eb096688c666be805325d1acf663cc833.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\GRE_INITIALIZE"; Key: "DISABLEMETAFILES"; Value: "") "7ca6811b3a9febcffeeee9d839ad6b8eb096688c666be805325d1acf663cc833.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\COMPATIBILITY32"; Key: "7CA6811B3A9FEBCFFEEEE9D839AD6B8EB096688C666BE805325D1ACF663CC833"; Value: "") "7ca6811b3a9febcffeeee9d839ad6b8eb096688c666be805325d1acf663cc833.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINDOWS"; Key: "LOADAPPINIT_DLLS"; Value: "") "7ca6811b3a9febcffeeee9d839ad6b8eb096688c666be805325d1acf663cc833.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE"; Key: "PAGEALLOCATORUSESYSTEMHEAP"; Value: "") "7ca6811b3a9febcffeeee9d839ad6b8eb096688c666be805325d1acf663cc833.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE"; Key: "PAGEALLOCATORSYSTEMHEAPISPRIVATE"; Value: "") "7ca6811b3a9febcffeeee9d839ad6b8eb096688c666be805325d1acf663cc833.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\CMF\CONFIG"; Key: "SYSTEM"; Value: "") "7ca6811b3a9febcffeeee9d839ad6b8eb096688c666be805325d1acf663cc833.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\WINDOWS ERROR REPORTING\WMR"; Key: "DISABLE"; Value: "") "7ca6811b3a9febcffeeee9d839ad6b8eb096688c666be805325d1acf663cc833.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\SETUP"; Key: "SOURCEPATH"; Value: "") "7ca6811b3a9febcffeeee9d839ad6b8eb096688c666be805325d1acf663cc833.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION"; Key: "DEVICEPATH"; Value: "") "7ca6811b3a9febcffeeee9d839ad6b8eb096688c666be805325d1acf663cc833.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US"; Value: "") "7ca6811b3a9febcffeeee9d839ad6b8eb096688c666be805325d1acf663cc833.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US"; Value: "")43:T4e3,The analysis shows indicators which can be used as execution guardrails to ensure that payload only executes against intended targets/system. Matched sigs: Contains ability to delay execution by waiting for signal/timeout (API string) Matched sigs: Contains ability to retrieve the time elapsed since the system was started (API string) Matched sigs: Able to identify virtual environment by using user activity (API string) Matched sigs: Contains ability to detect presence of virtual environment (API string) Matched sigs: Able to retrieve information set for devices (API string) Matched sigs: Reference to an external IP address lookup service identified Matched sigs: Observed a high volume of repeated registry API calls (API Hammering) Matched sigs: Contains ability to detect sandbox (imports API) Matched sigs: Contains ability to delay the execution of current thread Matched sigs: Contains ability to query volume size Matched sigs: Contains ability to detect virtual environment (API) Matched sigs: Makes a code branch decision directly after an API that is environment aware Matched sigs: Checks a device property (often used to detect VM artifacts) Matched sigs: Contains ability to detect presence of virtualization software44:Tc9a,"7ca6811b3a9febcffeeee9d839ad6b8eb096688c666be805325d1acf663cc833.exe" trying to touch file "C:\Windows\SYSTEM32\sechost.dll" "7ca6811b3a9febcffeeee9d839ad6b8eb096688c666be805325d1acf663cc833.exe" trying to touch file "C:\7ca6811b3a9febcffeeee9d839ad6b8eb096688c666be805325d1acf663cc833.exe.Local\" "7ca6811b3a9febcffeeee9d839ad6b8eb096688c666be805325d1acf663cc833.exe" trying to touch file "C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18837_none_41e855142bd5705d" "7ca6811b3a9febcffeeee9d839ad6b8eb096688c666be805325d1acf663cc833.exe" trying to touch file "C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18837_none_41e855142bd5705d\COMCTL32.dll" "7ca6811b3a9febcffeeee9d839ad6b8eb096688c666be805325d1acf663cc833.exe" trying to touch file "C:\Cabinet.dll" "7ca6811b3a9febcffeeee9d839ad6b8eb096688c666be805325d1acf663cc833.exe" trying to touch file "C:\Windows\system32\Cabinet.dll" "7ca6811b3a9febcffeeee9d839ad6b8eb096688c666be805325d1acf663cc833.exe" trying to touch file "C:\VERSION.dll" "7ca6811b3a9febcffeeee9d839ad6b8eb096688c666be805325d1acf663cc833.exe" trying to touch file "C:\Windows\system32\VERSION.dll" "7ca6811b3a9febcffeeee9d839ad6b8eb096688c666be805325d1acf663cc833.exe" trying to touch file "C:\Windows\system32\apphelp.dll" "7ca6811b3a9febcffeeee9d839ad6b8eb096688c666be805325d1acf663cc833.exe" trying to touch file "C:\Windows\AppPatch\AcLayers.DLL" "7ca6811b3a9febcffeeee9d839ad6b8eb096688c666be805325d1acf663cc833.exe" trying to touch file "C:\SspiCli.dll" "7ca6811b3a9febcffeeee9d839ad6b8eb096688c666be805325d1acf663cc833.exe" trying to touch file "C:\Windows\system32\SspiCli.dll" "7ca6811b3a9febcffeeee9d839ad6b8eb096688c666be805325d1acf663cc833.exe" trying to touch file "C:\WINSPOOL.DRV" "7ca6811b3a9febcffeeee9d839ad6b8eb096688c666be805325d1acf663cc833.exe" trying to touch file "C:\Windows\system32\WINSPOOL.DRV" "7ca6811b3a9febcffeeee9d839ad6b8eb096688c666be805325d1acf663cc833.exe" trying to touch file "C:\MPR.dll" "7ca6811b3a9febcffeeee9d839ad6b8eb096688c666be805325d1acf663cc833.exe" trying to touch file "C:\Windows\system32\MPR.dll" "7ca6811b3a9febcffeeee9d839ad6b8eb096688c666be805325d1acf663cc833.exe" trying to touch file "C:\Windows\AppPatch\AcGenral.DLL" "7ca6811b3a9febcffeeee9d839ad6b8eb096688c666be805325d1acf663cc833.exe" trying to touch file "C:\UxTheme.dll" "7ca6811b3a9febcffeeee9d839ad6b8eb096688c666be805325d1acf663cc833.exe" trying to touch file "C:\Windows\system32\UxTheme.dll" "7ca6811b3a9febcffeeee9d839ad6b8eb096688c666be805325d1acf663cc833.exe" trying to touch file "C:\WINMM.dll" "7ca6811b3a9febcffeeee9d839ad6b8eb096688c666be805325d1acf663cc833.exe" trying to touch file "C:\Windows\system32\WINMM.dll" "7ca6811b3a9febcffeeee9d839ad6b8eb096688c666be805325d1acf663cc833.exe" trying to touch file "C:\samcli.dll" "7ca6811b3a9febcffeeee9d839ad6b8eb096688c666be805325d1acf663cc833.exe" trying to touch file "C:\Windows\system32\samcli.dll" "7ca6811b3a9febcffeeee9d839ad6b8eb096688c666be805325d1acf663cc833.exe" trying to touch file "C:\MSACM32.dll" "7ca6811b3a9febcffeeee9d839ad6b8eb096688c666be805325d1acf663cc833.exe" trying to touch file "C:\Windows\system32\MSACM32.dll"45:Td0d,"7ca6811b3a9febcffeeee9d839ad6b8eb096688c666be805325d1acf663cc833.exe" trying to access non-existent file "C:\Cabinet.dll" "7ca6811b3a9febcffeeee9d839ad6b8eb096688c666be805325d1acf663cc833.exe" trying to access non-existent file "C:\VERSION.dll" "7ca6811b3a9febcffeeee9d839ad6b8eb096688c666be805325d1acf663cc833.exe" trying to access non-existent file "C:\SspiCli.dll" "7ca6811b3a9febcffeeee9d839ad6b8eb096688c666be805325d1acf663cc833.exe" trying to access non-existent file "C:\MPR.dll" "7ca6811b3a9febcffeeee9d839ad6b8eb096688c666be805325d1acf663cc833.exe" trying to access non-existent file "C:\UxTheme.dll" "7ca6811b3a9febcffeeee9d839ad6b8eb096688c666be805325d1acf663cc833.exe" trying to access non-existent file "C:\WINMM.dll" "7ca6811b3a9febcffeeee9d839ad6b8eb096688c666be805325d1acf663cc833.exe" trying to access non-existent file "C:\samcli.dll" "7ca6811b3a9febcffeeee9d839ad6b8eb096688c666be805325d1acf663cc833.exe" trying to access non-existent file "C:\MSACM32.dll" "7ca6811b3a9febcffeeee9d839ad6b8eb096688c666be805325d1acf663cc833.exe" trying to access non-existent file "C:\sfc.dll" "7ca6811b3a9febcffeeee9d839ad6b8eb096688c666be805325d1acf663cc833.exe" trying to access non-existent file "C:\sfc_os.DLL" "7ca6811b3a9febcffeeee9d839ad6b8eb096688c666be805325d1acf663cc833.exe" trying to access non-existent file "C:\dwmapi.dll" "7ca6811b3a9febcffeeee9d839ad6b8eb096688c666be805325d1acf663cc833.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP\cZ2SE56.exe" "7ca6811b3a9febcffeeee9d839ad6b8eb096688c666be805325d1acf663cc833.exe" trying to access non-existent file "C:\FLTLIB.DLL" "7ca6811b3a9febcffeeee9d839ad6b8eb096688c666be805325d1acf663cc833.exe" trying to access non-existent file "C:\MSVCP140.dll" "7ca6811b3a9febcffeeee9d839ad6b8eb096688c666be805325d1acf663cc833.exe" trying to access non-existent file "C:\VCRUNTIME140.dll" "7ca6811b3a9febcffeeee9d839ad6b8eb096688c666be805325d1acf663cc833.exe" trying to access non-existent file "C:\api-ms-win-crt-runtime-l1-1-0.dll" "7ca6811b3a9febcffeeee9d839ad6b8eb096688c666be805325d1acf663cc833.exe" trying to access non-existent file "C:\ucrtbase.DLL" "7ca6811b3a9febcffeeee9d839ad6b8eb096688c666be805325d1acf663cc833.exe" trying to access non-existent file "C:\api-ms-win-core-timezone-l1-1-0.dll" "7ca6811b3a9febcffeeee9d839ad6b8eb096688c666be805325d1acf663cc833.exe" trying to access non-existent file "C:\api-ms-win-core-file-l2-1-0.dll" "7ca6811b3a9febcffeeee9d839ad6b8eb096688c666be805325d1acf663cc833.exe" trying to access non-existent file "C:\api-ms-win-core-localization-l1-2-0.dll" "7ca6811b3a9febcffeeee9d839ad6b8eb096688c666be805325d1acf663cc833.exe" trying to access non-existent file "C:\api-ms-win-core-synch-l1-2-0.dll" "7ca6811b3a9febcffeeee9d839ad6b8eb096688c666be805325d1acf663cc833.exe" trying to access non-existent file "C:\api-ms-win-core-processthreads-l1-1-1.dll" "7ca6811b3a9febcffeeee9d839ad6b8eb096688c666be805325d1acf663cc833.exe" trying to access non-existent file "C:\api-ms-win-core-file-l1-2-0.dll" "7ca6811b3a9febcffeeee9d839ad6b8eb096688c666be805325d1acf663cc833.exe" trying to access non-existent file "C:\api-ms-win-crt-heap-l1-1-0.dll" "7ca6811b3a9febcffeeee9d839ad6b8eb096688c666be805325d1acf663cc833.exe" trying to access non-existent file "C:\api-ms-win-crt-string-l1-1-0.dll"46:T87a,"7ca6811b3a9febcffeeee9d839ad6b8eb096688c666be805325d1acf663cc833.exe" trying to access non-existent file "C:\7ca6811b3a9febcffeeee9d839ad6b8eb096688c666be805325d1acf663cc833.exe.Local\" "7ca6811b3a9febcffeeee9d839ad6b8eb096688c666be805325d1acf663cc833.exe" trying to access non-existent file "C:\WINSPOOL.DRV" "7ca6811b3a9febcffeeee9d839ad6b8eb096688c666be805325d1acf663cc833.exe" trying to access non-existent file "C:\7ca6811b3a9febcffeeee9d839ad6b8eb096688c666be805325d1acf663cc833.exe.Config" "7ca6811b3a9febcffeeee9d839ad6b8eb096688c666be805325d1acf663cc833.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP" "7ca6811b3a9febcffeeee9d839ad6b8eb096688c666be805325d1acf663cc833.exe" trying to access non-existent file "C:\7CA6811B3A9FEBCFFEEEE9D839AD6B8EB096688C666BE805325D1ACF663CC833.EXE.LOCAL" "7ca6811b3a9febcffeeee9d839ad6b8eb096688c666be805325d1acf663cc833.exe" trying to access non-existent file "C:\7CA6811B3A9FEBCFFEEEE9D839AD6B8EB096688C666BE805325D1ACF663CC833.EXE.CONFIG" "cZ2SE56.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP\cZ2SE56.exe.Local\" "cZ2SE56.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP\WINSPOOL.DRV" "cZ2SE56.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP\cZ2SE56.exe.Config" "cZ2SE56.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP001.TMP" "cZ2SE56.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP\CZ2SE56.EXE.LOCAL" "cZ2SE56.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP\CZ2SE56.EXE.CONFIG" "nO2Ue30.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP001.TMP\nO2Ue30.exe.Local\" "nO2Ue30.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP001.TMP\WINSPOOL.DRV" "nO2Ue30.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP001.TMP\nO2Ue30.exe.Config" "nO2Ue30.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP002.TMP"47:T487,Found reference to API "WSAStartup" (Indicator: "WSAStartup"; File: "7ca6811b3a9febcffeeee9d839ad6b8eb096688c666be805325d1acf663cc833") Found reference to API "InternetReadFile" (Indicator: "InternetReadFile"; File: "7ca6811b3a9febcffeeee9d839ad6b8eb096688c666be805325d1acf663cc833") Found reference to API "HttpQueryInfoW" (Indicator: "HttpQueryInfo"; File: "7ca6811b3a9febcffeeee9d839ad6b8eb096688c666be805325d1acf663cc833") Found reference to API "InternetConnectW" (Indicator: "InternetConnect"; File: "7ca6811b3a9febcffeeee9d839ad6b8eb096688c666be805325d1acf663cc833") Found reference to API "HttpOpenRequestW" (Indicator: "HttpOpenRequest"; File: "7ca6811b3a9febcffeeee9d839ad6b8eb096688c666be805325d1acf663cc833") Found reference to API "InternetOpenW" (Indicator: "InternetOpen"; File: "7ca6811b3a9febcffeeee9d839ad6b8eb096688c666be805325d1acf663cc833") Found reference to API "HttpSendRequestW" (Indicator: "HttpSendRequest"; File: "7ca6811b3a9febcffeeee9d839ad6b8eb096688c666be805325d1acf663cc833") Found reference to API "InternetOpenUrlW" (Indicator: "InternetOpen"; File: "7ca6811b3a9febcffeeee9d839ad6b8eb096688c666be805325d1acf663cc833")48:T937,Found reference to API "WSAGetLastError" (Indicator: "wsagetlasterror"; File: "7ca6811b3a9febcffeeee9d839ad6b8eb096688c666be805325d1acf663cc833") Found reference to API "WSAStartup" (Indicator: "wsastartup"; File: "7ca6811b3a9febcffeeee9d839ad6b8eb096688c666be805325d1acf663cc833") Found reference to API "WSACleanup" (Indicator: "wsacleanup"; File: "7ca6811b3a9febcffeeee9d839ad6b8eb096688c666be805325d1acf663cc833") Found reference to API "inet_addr" (Indicator: "inet_addr"; File: "7ca6811b3a9febcffeeee9d839ad6b8eb096688c666be805325d1acf663cc833") Found reference to API "gethostbyname" (Indicator: "gethostbyname"; File: "7ca6811b3a9febcffeeee9d839ad6b8eb096688c666be805325d1acf663cc833") Found reference to API "inet_ntoa" (Indicator: "inet_ntoa"; File: "7ca6811b3a9febcffeeee9d839ad6b8eb096688c666be805325d1acf663cc833") Found reference to API "__WSAFDIsSet" (Indicator: "__wsafdisset"; File: "7ca6811b3a9febcffeeee9d839ad6b8eb096688c666be805325d1acf663cc833") Found reference to API "gethostname" (Indicator: "gethostname"; File: "7ca6811b3a9febcffeeee9d839ad6b8eb096688c666be805325d1acf663cc833") Found reference to API "AUTHUI.DLL: Shutdown Choices Message Window" (Indicator: " shutdown "; Source: "00000000-00004644.00000000.90807.01160000.00000002.mdmp") Found reference to API "AUTHUI.DLL: Shutdown Choices Message Window" (Indicator: " shutdown "; Source: "00000000-00005816.00000000.78371.00E00000.00000002.mdmp, 00000000-00005816.00000001.80294.00E00000.00000002.mdmp, 00000000-00005816.00000002.82216.00E00000.00000002.mdmp") Found reference to API "Do you accept all of the terms of the preceding License Agreement? If you choose No, Install will close. To install you must accept this agreement." (Indicator: " accept "; Source: "00000000-00005816.00000002.82216.00C4A000.00000002.mdmp") Found reference to API "AUTHUI.DLL: Shutdown Choices Message Window" (Indicator: " shutdown "; Source: "00000000-00005868.00000000.78447.011C0000.00000002.mdmp, 00000000-00005868.00000001.80369.011C0000.00000002.mdmp, 00000000-00005868.00000002.82294.011C0000.00000002.mdmp") Found reference to API "Do you accept all of the terms of the preceding License Agreement? If you choose No, Install will close. To install you must accept this agreement." (Indicator: " accept "; Source: "00000000-00005868.00000001.80369.0104A000.00000002.mdmp")49:T97b,Found URL "https://t.me/riseprosupportappdata=c:\users\hapubws\appdata\roaminglocalappdata=c:\users\hapubws\appdata\localtemp=c:\users\hapubws\appdata\local\tempcertdllverifycertificatechainpolicycryptmsgdllcnggencontentencryptkeycryptmsgdllcngimportcontentencryptkey1" - Source: "00000000-00004644.00000000.90807.00330000.00000004.mdmp") Found URL "https://t.me/riseprosupport" - Source: "00000000-00004644.00000000.90807.00330000.00000004.mdmp") Found URL "https://ipinfo.io/https://www.maxmind.com/en/locate-my-ip-addressauthorization:" - Source: "00000000-00004644.00000000.90807.01117000.00000002.mdmp") Found URL "http://www.winimage.com/zlibdllherfqq2lyf8x5[x]tiulm:.p)q+e4" - Source: "00000000-00004644.00000000.90807.01117000.00000002.mdmp") Found URL "https://t.me/riseprosupportappdata=c:\users\hapubws\appdata\roaminglocalappdata=c:\users\hapubws\appdata\localtemp=c:\users\hapubws\appdata\local\temp1sps^u88xcertdllverifycertificatechainpolicycryptmsgdllcnggencontentencryptkeycryptmsgdllcngimportcontentencryptkey1" - Source: "00000000-00006008.00000000.78573.004C0000.00000004.mdmp") Found URL "https://t.me/riseprosupport" - Source: "00000000-00006008.00000000.78573.004C0000.00000004.mdmp") Found URL "https://ipinfo.io/https://www.maxmind.com/en/locate-my-ip-addressauthorization:" - Source: "00000000-00006008.00000000.78573.00F77000.00000002.mdmp") Found URL "http://www.winimage.com/zlibdllherfqq2lyf8x5[x]tiulm:.p)q+e4" - Source: "00000000-00006008.00000000.78573.00F77000.00000002.mdmp") Found URL "https://t.me/riseprosupportappdata=c:\users\hapubws\appdata\roaminglocalappdata=c:\users\hapubws\appdata\localtemp=c:\users\hapubws\appdata\local\temp^u88xcertdllverifycertificatechainpolicycryptmsgdllcnggencontentencryptkeycryptmsgdllcngimportcontentencryptkey1" - Source: "00000000-00006008.00000001.80496.004C0000.00000004.mdmp") Found URL "https://t.me/riseprosupport" - Source: "00000000-00006008.00000001.80496.004C0000.00000004.mdmp") Found URL "https://t.me/riseprosupportappdata=c:\users\hapubws\appdata\roaminglocalappdata=c:\users\hapubws\appdata\localtemp=c:\users\hapubws\appdata\local\temp^u88xcertdllverifycertificatechainpolicycryptmsgdllcnggencontentencryptkeycryptmsgdllcngimportcontentencryptkey1" - Source: "00000000-00006008.00000002.82419.004C0000.00000004.mdmp") Found URL "https://t.me/riseprosupport" - Source: "00000000-00006008.00000002.82419.004C0000.00000004.mdmp")4a:T488,Found reference to API "MapVirtualKeyW" (Indicator: "MapVirtualKey"; File: "7ca6811b3a9febcffeeee9d839ad6b8eb096688c666be805325d1acf663cc833") Found reference to API "GetKeyState" (Indicator: "GetKeyState"; File: "7ca6811b3a9febcffeeee9d839ad6b8eb096688c666be805325d1acf663cc833") Found reference to API "GetKeyboardState" (Indicator: "GetKeyboardState"; File: "7ca6811b3a9febcffeeee9d839ad6b8eb096688c666be805325d1acf663cc833") Found reference to API "VkKeyScanW" (Indicator: "VkKeyScan"; File: "7ca6811b3a9febcffeeee9d839ad6b8eb096688c666be805325d1acf663cc833") Found reference to API "AttachThreadInput" (Indicator: "AttachThreadInput"; File: "7ca6811b3a9febcffeeee9d839ad6b8eb096688c666be805325d1acf663cc833") Found reference to API "RegisterHotKey" (Indicator: "RegisterHotKey"; File: "7ca6811b3a9febcffeeee9d839ad6b8eb096688c666be805325d1acf663cc833") Found reference to API "GetAsyncKeyState" (Indicator: "GetAsyncKeyState"; File: "7ca6811b3a9febcffeeee9d839ad6b8eb096688c666be805325d1acf663cc833") Found reference to API "UnregisterHotKey" (Indicator: "UnregisterHotKey"; File: "7ca6811b3a9febcffeeee9d839ad6b8eb096688c666be805325d1acf663cc833")4b:Ta4c,"7ca6811b3a9febcffeeee9d839ad6b8eb096688c666be805325d1acf663cc833.exe" called "FindFirstFileW" with parameter %TEMP%\IXP000.TMP\*.* (UID: 00000000-00005816) "7ca6811b3a9febcffeeee9d839ad6b8eb096688c666be805325d1acf663cc833.exe" called "FindNextFileW" with parameter .. (UID: 00000000-00005816) "7ca6811b3a9febcffeeee9d839ad6b8eb096688c666be805325d1acf663cc833.exe" called "FindNextFileW" with parameter 5UO2EL6.exe (UID: 00000000-00005816) "7ca6811b3a9febcffeeee9d839ad6b8eb096688c666be805325d1acf663cc833.exe" called "FindNextFileW" with parameter cZ2SE56.exe (UID: 00000000-00005816) "cZ2SE56.exe" called "FindFirstFileW" with parameter %TEMP%\IXP001.TMP\*.* (UID: 00000000-00005868) "cZ2SE56.exe" called "FindNextFileW" with parameter .. (UID: 00000000-00005868) "cZ2SE56.exe" called "FindNextFileW" with parameter 4OG898Ow.exe (UID: 00000000-00005868) "cZ2SE56.exe" called "FindNextFileW" with parameter nO2Ue30.exe (UID: 00000000-00005868) "nO2Ue30.exe" called "FindFirstFileW" with parameter %TEMP%\IXP002.TMP\*.* (UID: 00000000-00006080) "nO2Ue30.exe" called "FindNextFileW" with parameter .. (UID: 00000000-00006080) "nO2Ue30.exe" called "FindNextFileW" with parameter 3up60Ma.exe (UID: 00000000-00006080) "nO2Ue30.exe" called "FindNextFileW" with parameter zW9af77.exe (UID: 00000000-00006080) "zW9af77.exe" called "FindFirstFileW" with parameter %TEMP%\IXP003.TMP\*.* (UID: 00000000-00005944) "zW9af77.exe" called "FindNextFileW" with parameter .. (UID: 00000000-00005944) "zW9af77.exe" called "FindNextFileW" with parameter 1sW61HT2.exe (UID: 00000000-00005944) "zW9af77.exe" called "FindNextFileW" with parameter 2IW9992.exe (UID: 00000000-00005944) "1sW61HT2.exe" called "FindFirstFileW" with parameter %WINDIR%\System32\*.* (UID: 00000000-00006008) "1sW61HT2.exe" called "FindNextFileW" with parameter .. (UID: 00000000-00006008) "1sW61HT2.exe" called "FindNextFileW" with parameter 0409 (UID: 00000000-00006008) "1sW61HT2.exe" called "FindNextFileW" with parameter 12520437.cpx (UID: 00000000-00006008) "1sW61HT2.exe" called "FindNextFileW" with parameter 12520850.cpx (UID: 00000000-00006008) "1sW61HT2.exe" called "FindNextFileW" with parameter 7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0 (UID: 00000000-00006008) "1sW61HT2.exe" called "FindNextFileW" with parameter 7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0 (UID: 00000000-00006008) "1sW61HT2.exe" called "FindNextFileW" with parameter aaclient.dll (UID: 00000000-00006008) "1sW61HT2.exe" called "FindNextFileW" with parameter accessibilitycpl.dll (UID: 00000000-00006008)4c:T119b,Found string "\Device\HarddiskVolume2\Windows\Temp\BC3CF9B5-C804-499A-AAAD-250A66DFC403\DismHost.exe" (Indicator: "\Device\"; Source: "00000000-00003472.00000000.87211.00410000.00000004.mdmp") Found string ":\Windows\system32\DRIVERS" (Indicator: "system32\drivers"; Source: "00000000-00003472.00000001.87612.00463000.00000004.mdmp") Found string "C:\Windows\System32\DriverStore\FileRepository\pvscsi.inf_x86_neutral_2e237bca5c8036a7\pvscsi.inf" (Indicator: "system32\drivers"; Source: "00000000-00003472.00000001.87612.00463000.00000004.mdmp") Found string "C:\Windows\System32\DriverStore\FileRepository\vm3d.inf_x86_neutral_abfe51358467898f\vm3d.inf" (Indicator: "system32\drivers"; Source: "00000000-00003472.00000001.87612.00463000.00000004.mdmp") Found string "indows\System32\DriverStore\infstor.dat" (Indicator: "system32\drivers"; Source: "00000000-00003472.00000001.87612.00463000.00000004.mdmp") Found string "indows\System32\DriverStore\infpub.dat" (Indicator: "system32\drivers"; Source: "00000000-00003472.00000001.87612.00463000.00000004.mdmp") Found string "indows\System32\DriverStore\infstrng.dat" (Indicator: "system32\drivers"; Source: "00000000-00003472.00000001.87612.00463000.00000004.mdmp") Found string ":\Windows\System32\DriverStore\drvindex.dat" (Indicator: "system32\drivers"; Source: "00000000-00003472.00000001.87612.00463000.00000004.mdmp") Found string "indows\System32\DriverStore\FileRepository" (Indicator: "system32\drivers"; Source: "00000000-00003472.00000001.87612.00463000.00000004.mdmp") Found string ":\Windows\System32\DriverStore\FileRepository\pvscsi.inf_x86_neutral_2e237bca5c8036a7" (Indicator: "system32\drivers"; Source: "00000000-00003472.00000001.87612.00463000.00000004.mdmp") Found string "PID=3472 Driver C:\Windows\System32\DriverStore\FileRepository\pvscsi.inf_x86_neutral_2e237bca5c8036a7\pvscsi.inf is boot-critical. - CDriverPackage::FillInPackageDetails" (Indicator: "system32\drivers"; Source: "00000000-00003472.00000001.87612.00463000.00000004.mdmp") Found string ":\Windows\System32\DriverStore" (Indicator: "system32\drivers"; Source: "00000000-00003472.00000001.87612.00463000.00000004.mdmp") Found string ":\Windows\System32\DriverStore\infstor.dat" (Indicator: "system32\drivers"; Source: "00000000-00003472.00000001.87612.00463000.00000004.mdmp") Found string ":\Windows\System32\DriverStore\FileRepository" (Indicator: "system32\drivers"; Source: "00000000-00003472.00000001.87612.00463000.00000004.mdmp") Found string "PID=3472 Successfully opened driver package file 'C:\Windows\System32\DriverStore\FileRepository\pvscsi.inf_x86_neutral_2e237bca5c8036a7\pvscsi.inf'. - CDriverManager::OpenPackageByFile" (Indicator: "system32\drivers"; Source: "00000000-00003472.00000001.87612.00463000.00000004.mdmp") Found string "PID=3472 Building driver collection for package 'C:\Windows\System32\DriverStore\FileRepository\pvscsi.inf_x86_neutral_2e237bca5c8036a7\pvscsi.inf'. - CDriverPackage::CreateDriverCollection" (Indicator: "system32\drivers"; Source: "00000000-00003472.00000001.87612.00463000.00000004.mdmp") file/memory contains long string with (Indicator: "system32\drivers"; Source: "00000000-00003472.00000001.87612.00463000.00000004.mdmp") Found string ":\Windows\System32\DriverStore" (Indicator: "system32\drivers"; Source: "00000000-00004644.00000000.90807.00330000.00000004.mdmp") Found string ":\Windows\System32\DriverStore\infpub.dat" (Indicator: "system32\drivers"; Source: "00000000-00004644.00000000.90807.00330000.00000004.mdmp") Found string ":\Windows\System32\DriverStore\infstor.dat" (Indicator: "system32\drivers"; Source: "00000000-00004644.00000000.90807.00330000.00000004.mdmp") Found string ":\Windows\System32\DriverStore\infstrng.dat" (Indicator: "system32\drivers"; Source: "00000000-00004644.00000000.90807.00330000.00000004.mdmp") Found string ":\Windows\System32\DriverStore\drvindex.dat" (Indicator: "system32\drivers"; Source: "00000000-00004644.00000000.90807.00330000.00000004.mdmp") Found string ":\Windows\System32\DriverStore\FileRepository" (Indicator: "system32\drivers"; Source: "00000000-00004644.00000000.90807.00330000.00000004.mdmp") Found string "\Device\HarddiskVolume2\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe" (Indicator: "\Device\"; Source: "00000000-00004644.00000000.90807.00330000.00000004.mdmp") Found string ":\Windows\System32\DriverStore" (Indicator: "system32\drivers"; Source: "00000000-00005816.00000000.78371.00410000.00000004.mdmp")4d:T221c,Observed import api "AllocateAndInitializeSid" which can "allocate and initialize a security identifier (SID) with up to eight subauthorities" [Source: 7ca6811b3a9febcffeeee9d839ad6b8eb096688c666be805325d1acf663cc833] Observed import api "EqualSid" which can "test two security identifier (SID) values for equality" [Source: 7ca6811b3a9febcffeeee9d839ad6b8eb096688c666be805325d1acf663cc833] Observed import api "FreeSid" which can "free a security identifier (SID) previously allocated by using the AllocateAndInitializeSid function" [Source: 7ca6811b3a9febcffeeee9d839ad6b8eb096688c666be805325d1acf663cc833] Observed import api "GetTokenInformation" which can "retrieve a specified type of information about an access token" [Source: 7ca6811b3a9febcffeeee9d839ad6b8eb096688c666be805325d1acf663cc833] Observed import api "InitializeSid" which can "initialize a security identifier (SID)" [Source: 7ca6811b3a9febcffeeee9d839ad6b8eb096688c666be805325d1acf663cc833] Observed import api "AllocateAndInitializeSid" which can "allocate and initialize a security identifier (SID) with up to eight subauthorities" [Source: cZ2SE56.exe] Observed import api "EqualSid" which can "test two security identifier (SID) values for equality" [Source: cZ2SE56.exe] Observed import api "FreeSid" which can "free a security identifier (SID) previously allocated by using the AllocateAndInitializeSid function" [Source: cZ2SE56.exe] Observed import api "GetTokenInformation" which can "retrieve a specified type of information about an access token" [Source: cZ2SE56.exe] Observed import api "InitializeSid" which can "initialize a security identifier (SID)" [Source: cZ2SE56.exe] Observed import api "AllocateAndInitializeSid" which can "allocate and initialize a security identifier (SID) with up to eight subauthorities" [Source: nO2Ue30.exe] Observed import api "EqualSid" which can "test two security identifier (SID) values for equality" [Source: nO2Ue30.exe] Observed import api "FreeSid" which can "free a security identifier (SID) previously allocated by using the AllocateAndInitializeSid function" [Source: nO2Ue30.exe] Observed import api "GetTokenInformation" which can "retrieve a specified type of information about an access token" [Source: nO2Ue30.exe] Observed import api "InitializeSid" which can "initialize a security identifier (SID)" [Source: nO2Ue30.exe] Observed import api "AddAce" which can "add one or more access control entries (ACEs) to a specified access control list (ACL)" [Source: 4OG898Ow.exe] Observed import api "AllocateAndInitializeSid" which can "allocate and initialize a security identifier (SID) with up to eight subauthorities" [Source: 4OG898Ow.exe] Observed import api "CheckTokenMembership" which can "determine whether a specified security identifier (SID) is enabled in an access token" [Source: 4OG898Ow.exe] Observed import api "CopySid" which can "copy a security identifier (SID) to a buffer" [Source: 4OG898Ow.exe] Observed import api "DuplicateToken" which can "create a new access token that duplicates one already in existence" [Source: 4OG898Ow.exe] Observed import api "DuplicateTokenEx" which can "create a new access token that duplicates an existing token" [Source: 4OG898Ow.exe] Observed import api "FreeSid" which can "free a security identifier (SID) previously allocated by using the AllocateAndInitializeSid function" [Source: 4OG898Ow.exe] Observed import api "GetAce" which can "obtain a pointer to an access control entry (ACE) in an access control list (ACL)" [Source: 4OG898Ow.exe] Observed import api "GetAclInformation" which can "retrieve information about an access control list (ACL)" [Source: 4OG898Ow.exe] Observed import api "GetLengthSid" which can "return the length in bytes of a valid security identifier (SID)" [Source: 4OG898Ow.exe] Observed import api "GetSecurityDescriptorDacl" which can "retrieve a pointer to the discretionary access control list (DACL) in a specified security descriptor" [Source: 4OG898Ow.exe] Observed import api "GetTokenInformation" which can "retrieve a specified type of information about an access token" [Source: 4OG898Ow.exe] Observed import api "InitializeAcl" which can "initialize a new ACL structure" [Source: 4OG898Ow.exe] Observed import api "InitializeSecurityDescriptor" which can "initialize a new security descriptor" [Source: 4OG898Ow.exe] Observed import api "InitializeSid" which can "initialize a security identifier (SID)" [Source: 4OG898Ow.exe] Observed import api "SetSecurityDescriptorDacl" which can "set information in a discretionary access control list (DACL)" [Source: 4OG898Ow.exe] Observed import api "AllocateAndInitializeSid" which can "allocate and initialize a security identifier (SID) with up to eight subauthorities" [Source: zW9af77.exe] Observed import api "EqualSid" which can "test two security identifier (SID) values for equality" [Source: zW9af77.exe] Observed import api "FreeSid" which can "free a security identifier (SID) previously allocated by using the AllocateAndInitializeSid function" [Source: zW9af77.exe] Observed import api "GetTokenInformation" which can "retrieve a specified type of information about an access token" [Source: zW9af77.exe] Observed import api "InitializeSid" which can "initialize a security identifier (SID)" [Source: zW9af77.exe] Observed import api "AddAce" which can "add one or more access control entries (ACEs) to a specified access control list (ACL)" [Source: DISMHOST.EXE.6A9813CA.bin] Observed import api "CopySid" which can "copy a security identifier (SID) to a buffer" [Source: DISMHOST.EXE.6A9813CA.bin] Observed import api "GetAclInformation" which can "retrieve information about an access control list (ACL)" [Source: DISMHOST.EXE.6A9813CA.bin] Observed import api "GetLengthSid" which can "return the length in bytes of a valid security identifier (SID)" [Source: DISMHOST.EXE.6A9813CA.bin] Observed import api "GetSecurityDescriptorControl" which can "retrieve a security descriptor control and revision information" [Source: DISMHOST.EXE.6A9813CA.bin] Observed import api "GetSecurityDescriptorDacl" which can "retrieve a pointer to the discretionary access control list (DACL) in a specified security descriptor" [Source: DISMHOST.EXE.6A9813CA.bin] Observed import api "GetSecurityDescriptorGroup" which can "retrieve the primary group information from a security descriptor" [Source: DISMHOST.EXE.6A9813CA.bin] Observed import api "GetSecurityDescriptorOwner" which can "retrieve the owner information from a security descriptor" [Source: DISMHOST.EXE.6A9813CA.bin] Observed import api "GetSecurityDescriptorSacl" which can "retrieve a pointer to the system access control list (SACL) in a specified security descriptor" [Source: DISMHOST.EXE.6A9813CA.bin] Observed import api "GetSidLengthRequired" which can "return the length, in bytes, of the buffer required to store a SID with a specified number of subauthorities" [Source: DISMHOST.EXE.6A9813CA.bin] Observed import api "GetSidSubAuthority" which can "return a pointer to a specified subauthority in a security identifier (SID)" [Source: DISMHOST.EXE.6A9813CA.bin] Observed import api "InitializeAcl" which can "initialize a new ACL structure" [Source: DISMHOST.EXE.6A9813CA.bin] Observed import api "InitializeSecurityDescriptor" which can "initialize a new security descriptor" [Source: DISMHOST.EXE.6A9813CA.bin] Observed import api "InitializeSid" which can "initialize a security identifier (SID)" [Source: DISMHOST.EXE.6A9813CA.bin] Observed import api "IsValidSecurityDescriptor" which can "determine whether the components of a security descriptor are valid" [Source: DISMHOST.EXE.6A9813CA.bin] Observed import api "IsValidSid" which can "validate a security identifier (SID) by verifying that the revision number is within a known range and that the number of subauthorities is less than the maximum" [Source: DISMHOST.EXE.6A9813CA.bin] Observed import api "MakeAbsoluteSD" which can "create a security descriptor in absolute format by using a security descriptor in self-relative format as a template" [Source: DISMHOST.EXE.6A9813CA.bin] Observed import api "SetSecurityDescriptorDacl" which can "set information in a discretionary access control list (DACL)" [Source: DISMHOST.EXE.6A9813CA.bin] Observed import api "SetSecurityDescriptorGroup" which can "set the primary group information of an absolute-format security descriptor replacing any primary group information already present in the security descriptor" [Source: DISMHOST.EXE.6A9813CA.bin] Observed import api "SetSecurityDescriptorOwner" which can "set the owner information of an absolute-format security descriptor" [Source: DISMHOST.EXE.6A9813CA.bin]4e:T9ba,"1sW61HT2.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS"; Key: "WINSOCK_REGISTRY_VERSION"; Value: "") "1sW61HT2.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS"; Key: "NAMESPACE_CALLOUT"; Value: "") "1sW61HT2.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9"; Key: "SERIAL_ACCESS_NUM"; Value: "") "1sW61HT2.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9"; Key: "NEXT_CATALOG_ENTRY_ID"; Value: "") "1sW61HT2.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9"; Key: "NUM_CATALOG_ENTRIES"; Value: "") "1sW61HT2.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000001"; Key: "PACKEDCATALOGITEM"; Value: "") "1sW61HT2.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000002"; Key: "PACKEDCATALOGITEM"; Value: "") "1sW61HT2.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000003"; Key: "PACKEDCATALOGITEM"; Value: "") "1sW61HT2.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000004"; Key: "PACKEDCATALOGITEM"; Value: "") "1sW61HT2.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000005"; Key: "PACKEDCATALOGITEM"; Value: "") "1sW61HT2.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000006"; Key: "PACKEDCATALOGITEM"; Value: "") "1sW61HT2.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000007"; Key: "PACKEDCATALOGITEM"; Value: "") "1sW61HT2.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000008"; Key: "PACKEDCATALOGITEM"; Value: "") "1sW61HT2.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000009"; Key: "PACKEDCATALOGITEM"; Value: "")4f:T45c,"7ca6811b3a9febcffeeee9d839ad6b8eb096688c666be805325d1acf663cc833.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUNONCE"; Key: "WEXTRACT_CLEANUP0"; Value: "rundll32.exe %WINDIR%\system32\advpack.dll,DelNodeRunDLL32 "%TEMP%\IXP000.TMP\"") "cZ2SE56.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUNONCE"; Key: "WEXTRACT_CLEANUP1"; Value: "rundll32.exe %WINDIR%\system32\advpack.dll,DelNodeRunDLL32 "%TEMP%\IXP001.TMP\"") "nO2Ue30.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUNONCE"; Key: "WEXTRACT_CLEANUP2"; Value: "rundll32.exe %WINDIR%\system32\advpack.dll,DelNodeRunDLL32 "%TEMP%\IXP002.TMP\"") "zW9af77.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUNONCE"; Key: "WEXTRACT_CLEANUP3"; Value: "rundll32.exe %WINDIR%\system32\advpack.dll,DelNodeRunDLL32 "%TEMP%\IXP003.TMP\"") "1sW61HT2.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN"; Key: "MAXLOONAFEST131"; Value: "%LOCALAPPDATA%\MaxLoonaFest131\MaxLoonaFest131.exe")50:T5db,"FANBooster131.exe" has type "PE32 executable for MS Windows 6.00 (GUI) Intel i386 5 sections"- Location: [%TEMP%\FANBooster131\FANBooster131.exe]- [targetUID: 00000000-00006008] "cZ2SE56.exe" has type "PE32 executable for MS Windows 6.00 (GUI) Intel i386 5 sections"- Location: [%TEMP%\IXP000.TMP\cZ2SE56.exe]- [targetUID: 00000000-00005816] "nO2Ue30.exe" has type "PE32 executable for MS Windows 6.00 (GUI) Intel i386 5 sections"- Location: [%TEMP%\IXP001.TMP\nO2Ue30.exe]- [targetUID: 00000000-00005868] "4OG898Ow.exe" has type "PE32 executable for MS Windows 5.01 (GUI) Intel i386 5 sections"- Location: [%TEMP%\IXP001.TMP\4OG898Ow.exe]- [targetUID: 00000000-00005868] "zW9af77.exe" has type "PE32 executable for MS Windows 6.00 (GUI) Intel i386 5 sections"- Location: [%TEMP%\IXP002.TMP\zW9af77.exe]- [targetUID: 00000000-00005944] "2IW9992.exe" has type "PE32 executable for MS Windows 6.00 (console) Intel i386 5 sections"- Location: [%TEMP%\IXP003.TMP\2IW9992.exe]- [targetUID: 00000000-00005944] "5UO2EL6.exe" has type "PE32 executable for MS Windows 6.00 (console) Intel i386 5 sections"- Location: [%TEMP%\IXP000.TMP\5UO2EL6.exe]- [targetUID: 00000000-00005816] "3up60Ma.exe" has type "PE32 executable for MS Windows 5.01 (GUI) Intel i386"- Location: [%TEMP%\IXP002.TMP\3up60Ma.exe]- [targetUID: 00000000-00006080] "1sW61HT2.exe" has type "PE32 executable for MS Windows 6.00 (GUI) Intel i386 5 sections"- Location: [%TEMP%\IXP003.TMP\1sW61HT2.exe]- [targetUID: 00000000-00005944]51:T7e8,"FANBooster131.exe" has type "PE32 executable for MS Windows 6.00 (GUI) Intel i386 5 sections"- Location: [%TEMP%\FANBooster131\FANBooster131.exe]- [targetUID: 00000000-00006008] "cZ2SE56.exe" has type "PE32 executable for MS Windows 6.00 (GUI) Intel i386 5 sections"- Location: [%TEMP%\IXP000.TMP\cZ2SE56.exe]- [targetUID: 00000000-00005816] "nO2Ue30.exe" has type "PE32 executable for MS Windows 6.00 (GUI) Intel i386 5 sections"- Location: [%TEMP%\IXP001.TMP\nO2Ue30.exe]- [targetUID: 00000000-00005868] "4OG898Ow.exe" has type "PE32 executable for MS Windows 5.01 (GUI) Intel i386 5 sections"- Location: [%TEMP%\IXP001.TMP\4OG898Ow.exe]- [targetUID: 00000000-00005868] "zW9af77.exe" has type "PE32 executable for MS Windows 6.00 (GUI) Intel i386 5 sections"- Location: [%TEMP%\IXP002.TMP\zW9af77.exe]- [targetUID: 00000000-00005944] "2IW9992.exe" has type "PE32 executable for MS Windows 6.00 (console) Intel i386 5 sections"- Location: [%TEMP%\IXP003.TMP\2IW9992.exe]- [targetUID: 00000000-00005944] "5UO2EL6.exe" has type "PE32 executable for MS Windows 6.00 (console) Intel i386 5 sections"- Location: [%TEMP%\IXP000.TMP\5UO2EL6.exe]- [targetUID: 00000000-00005816] "3up60Ma.exe" has type "PE32 executable for MS Windows 5.01 (GUI) Intel i386"- Location: [%TEMP%\IXP002.TMP\3up60Ma.exe]- [targetUID: 00000000-00006080] "DISMHOST.EXE.6A9813CA.bin" has type "PE32 executable for MS Windows 5.01 (GUI) Intel i386 4 sections"- [targetUID: N/A] "1sW61HT2.exe" has type "PE32 executable for MS Windows 6.00 (GUI) Intel i386 5 sections"- Location: [%TEMP%\IXP003.TMP\1sW61HT2.exe]- [targetUID: 00000000-00005944] "OfficeTrackerNMP131.exe" has type "PE32 executable for MS Windows 6.00 (GUI) Intel i386 5 sections"- Location: [%ALLUSERSPROFILE%\OfficeTrackerNMP131\OfficeTrackerNMP131.exe]- [targetUID: 00000000-00006008] "MaxLoonaFest131.exe" has type "PE32 executable for MS Windows 6.00 (GUI) Intel i386 5 sections"- Location: [%LOCALAPPDATA%\MaxLoonaFest131\MaxLoonaFest131.exe]- [targetUID: 00000000-00006008]52:T631,"7ca6811b3a9febcffeeee9d839ad6b8eb096688c666be805325d1acf663cc833.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUNONCE") "7ca6811b3a9febcffeeee9d839ad6b8eb096688c666be805325d1acf663cc833.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUNONCE"; Key: "WEXTRACT_CLEANUP0"; Value: "rundll32.exe %WINDIR%\system32\advpack.dll,DelNodeRunDLL32 "%TEMP%\IXP000.TMP\"") "cZ2SE56.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUNONCE") "cZ2SE56.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUNONCE"; Key: "WEXTRACT_CLEANUP1"; Value: "rundll32.exe %WINDIR%\system32\advpack.dll,DelNodeRunDLL32 "%TEMP%\IXP001.TMP\"") "nO2Ue30.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUNONCE") "nO2Ue30.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUNONCE"; Key: "WEXTRACT_CLEANUP2"; Value: "rundll32.exe %WINDIR%\system32\advpack.dll,DelNodeRunDLL32 "%TEMP%\IXP002.TMP\"") "zW9af77.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUNONCE") "zW9af77.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUNONCE"; Key: "WEXTRACT_CLEANUP3"; Value: "rundll32.exe %WINDIR%\system32\advpack.dll,DelNodeRunDLL32 "%TEMP%\IXP003.TMP\"") "1sW61HT2.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN"; Key: "MAXLOONAFEST131"; Value: "%LOCALAPPDATA%\MaxLoonaFest131\MaxLoonaFest131.exe")53:Tce7,"7ca6811b3a9febcffeeee9d839ad6b8eb096688c666be805325d1acf663cc833.exe" wrote 32768 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP\cZ2SE56.exe": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "7ca6811b3a9febcffeeee9d839ad6b8eb096688c666be805325d1acf663cc833.exe" wrote 14336 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP\5UO2EL6.exe": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "cZ2SE56.exe" wrote 32768 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP001.TMP\nO2Ue30.exe": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "cZ2SE56.exe" wrote 12800 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP001.TMP\4OG898Ow.exe": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000200100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "nO2Ue30.exe" wrote 32768 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP002.TMP\zW9af77.exe": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "nO2Ue30.exe" wrote 8192 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP002.TMP\3up60Ma.exe": 4d5aff000100000004001000ffff00004001000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0a240000000000000000 ... "zW9af77.exe" wrote 32768 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP003.TMP\1sW61HT2.exe": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000300100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "zW9af77.exe" wrote 340 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP003.TMP\2IW9992.exe": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ...54:T837,RegCreateKeyExA RegOpenKeyExA RegCloseKey OpenProcessToken RegDeleteValueA GetProcAddress GetVersionExA GetModuleFileNameA GetSystemDirectoryA TerminateProcess CreateProcessA GetStartupInfoW FindNextFileA DeleteFileA GetFileAttributesA LockResource CreateThread FindFirstFileA GetSystemInfo CreateDirectoryA GetModuleHandleW GetTempFileNameA UnhandledExceptionFilter CreateFileA FindResourceA GetTempPathA Sleep GetTickCount WriteFile LoadLibraryA GetDriveTypeA LoadLibraryExA GetUserNameA RegEnumKeyExA CredEnumerateA RegEnumKeyA GetFileAttributesW GetTempPathW WriteProcessMemory FindNextFileW FindFirstFileW Process32Next GetModuleFileNameW GetModuleHandleExA GetModuleHandleA GetFileAttributesExW GetModuleHandleExW GetFileSizeEx DeleteFileW GetFileSize GetTickCount64 Process32First CreateRemoteThread CopyFileA CreateToolhelp32Snapshot FindFirstFileExW LoadLibraryExW GetComputerNameA GetCommandLineA OpenProcess IsDebuggerPresent CreateFileW VirtualAllocEx GetCommandLineW ShellExecuteA WSAStartup send recv closesocket socket connect GetUserNameW RegEnumKeyExW RegCreateKeyExW RegDeleteKeyW CreateProcessWithLogonW SetSecurityDescriptorDacl RegDeleteValueW RegOpenKeyExW CreateProcessAsUserW IcmpSendEcho CreateProcessW CreateDirectoryW DeviceIoControl FindResourceExW CopyFileW CopyFileExW Process32FirstW GetVersionExW VirtualAlloc ReadProcessMemory GetComputerNameW OutputDebugStringW GetTempFileNameW Process32NextW GetDriveTypeW LoadLibraryW GetSystemDirectoryW ExitThread ShellExecuteExW ShellExecuteW GetWindowThreadProcessId GetCursorPos FindWindowExW FindWindowW SetKeyboardState GetClipboardData InternetReadFile HttpQueryInfoW InternetConnectW InternetCloseHandle FtpGetFileSize FtpOpenFileW InternetOpenW InternetQueryOptionW HttpSendRequestW InternetQueryDataAvailable InternetOpenUrlW InternetCrackUrlW listen sendto recvfrom bind accept CreateThreadpoolWork SleepConditionVariableSRW GetStartupInfoA OutputDebugStringA CreateFileMappingW MapViewOfFile55:T5d5,"d94fc8dcbc9e403657f9323967855f59.exe" called "FindResourceA" with parameter "8524408" - (UID: 00000000-00007632) "d94fc8dcbc9e403657f9323967855f59.exe" called "FindResourceA" with parameter "8524416" - (UID: 00000000-00007632) "d94fc8dcbc9e403657f9323967855f59.exe" called "FindResourceA" with parameter "8524444" - (UID: 00000000-00007632) "d94fc8dcbc9e403657f9323967855f59.exe" called "FindResourceA" with parameter "8524656" - (UID: 00000000-00007632) "d94fc8dcbc9e403657f9323967855f59.exe" called "FindResourceA" with parameter "8524472" - (UID: 00000000-00007632) "d94fc8dcbc9e403657f9323967855f59.exe" called "FindResourceA" with parameter "8524628" - (UID: 00000000-00007632) "d94fc8dcbc9e403657f9323967855f59.exe" called "FindResourceA" with parameter "8524640" - (UID: 00000000-00007632) "d94fc8dcbc9e403657f9323967855f59.exe" called "FindResourceA" with parameter "1178212" - (UID: 00000000-00007632) "d94fc8dcbc9e403657f9323967855f59.exe" called "FindResourceA" with parameter "8524524" - (UID: 00000000-00007632) "d94fc8dcbc9e403657f9323967855f59.exe" called "FindResourceA" with parameter "8524620" - (UID: 00000000-00007632) "d94fc8dcbc9e403657f9323967855f59.exe" called "FindResourceA" with parameter "1178208" - (UID: 00000000-00007632) "d94fc8dcbc9e403657f9323967855f59.exe" called "FindResourceA" with parameter "8524488" - (UID: 00000000-00007632) "d94fc8dcbc9e403657f9323967855f59.exe" called "FindResourceA" with parameter "8524496" - (UID: 00000000-00007632)56:Tb74,"d94fc8dcbc9e403657f9323967855f59.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '8571008'}" (UID: 00000000-00007632) "d94fc8dcbc9e403657f9323967855f59.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '8570864'}" (UID: 00000000-00007632) "d94fc8dcbc9e403657f9323967855f59.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '8571024'}" (UID: 00000000-00007632) "d94fc8dcbc9e403657f9323967855f59.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '8570912'}" (UID: 00000000-00007632) "d94fc8dcbc9e403657f9323967855f59.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '8570880'}" (UID: 00000000-00007632) "d94fc8dcbc9e403657f9323967855f59.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '8570928'}" (UID: 00000000-00007632) "d94fc8dcbc9e403657f9323967855f59.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '8570976'}" (UID: 00000000-00007632) "d94fc8dcbc9e403657f9323967855f59.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '8570848'}" (UID: 00000000-00007632) "d94fc8dcbc9e403657f9323967855f59.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '8570960'}" (UID: 00000000-00007632) "d94fc8dcbc9e403657f9323967855f59.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '8570992'}" (UID: 00000000-00007632) "cZ2SE56.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '903296'}" (UID: 00000000-00004452) "cZ2SE56.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '903152'}" (UID: 00000000-00004452) "cZ2SE56.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '903312'}" (UID: 00000000-00004452) "cZ2SE56.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '903200'}" (UID: 00000000-00004452) "cZ2SE56.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '903168'}" (UID: 00000000-00004452) "cZ2SE56.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '903216'}" (UID: 00000000-00004452) "cZ2SE56.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '903264'}" (UID: 00000000-00004452) "cZ2SE56.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '903136'}" (UID: 00000000-00004452) "cZ2SE56.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '903248'}" (UID: 00000000-00004452) "cZ2SE56.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '903280'}" (UID: 00000000-00004452) "nO2Ue30.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '18008192'}" (UID: 00000000-00007244) "nO2Ue30.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '18008048'}" (UID: 00000000-00007244) "nO2Ue30.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '18008208'}" (UID: 00000000-00007244)57:Tbbe,"d94fc8dcbc9e403657f9323967855f59.exe" called "RemoveDirectoryA" with parameter %TEMP%\IXP000.TMP (UID: 00000000-00007632) "cZ2SE56.exe" called "RemoveDirectoryA" with parameter %TEMP%\IXP000.TMP (UID: 00000000-00004452) "cZ2SE56.exe" called "RemoveDirectoryA" with parameter %TEMP%\IXP001.TMP (UID: 00000000-00004452) "nO2Ue30.exe" called "RemoveDirectoryA" with parameter %TEMP%\IXP000.TMP (UID: 00000000-00007244) "nO2Ue30.exe" called "RemoveDirectoryA" with parameter %TEMP%\IXP001.TMP (UID: 00000000-00007244) "nO2Ue30.exe" called "RemoveDirectoryA" with parameter %TEMP%\IXP002.TMP (UID: 00000000-00007244) "zW9af77.exe" called "RemoveDirectoryA" with parameter %TEMP%\IXP000.TMP (UID: 00000000-00007692) "zW9af77.exe" called "RemoveDirectoryA" with parameter %TEMP%\IXP001.TMP (UID: 00000000-00007692) "zW9af77.exe" called "RemoveDirectoryA" with parameter %TEMP%\IXP002.TMP (UID: 00000000-00007692) "zW9af77.exe" called "RemoveDirectoryA" with parameter %TEMP%\IXP003.TMP (UID: 00000000-00007692) "zW9af77.exe" called "RemoveDirectoryA" with parameter %TEMP%\IXP003.TMP\ (UID: 00000000-00007692) "1sW61HT2.exe" called "RemoveDirectoryA" with parameter %TEMP%\grandUIAkj1fIxXZz0xJZ\Autofill (UID: 00000000-00007568) "1sW61HT2.exe" called "RemoveDirectoryA" with parameter %TEMP%\grandUIAkj1fIxXZz0xJZ\Files\My Music (UID: 00000000-00007568) "1sW61HT2.exe" called "RemoveDirectoryA" with parameter %TEMP%\grandUIAkj1fIxXZz0xJZ\Files\My Pictures (UID: 00000000-00007568) "1sW61HT2.exe" called "RemoveDirectoryA" with parameter %TEMP%\grandUIAkj1fIxXZz0xJZ\Files\My Videos (UID: 00000000-00007568) "1sW61HT2.exe" called "RemoveDirectoryA" with parameter %TEMP%\grandUIAkj1fIxXZz0xJZ\Files\OneNote Notebooks\My Notebook (UID: 00000000-00007568) "1sW61HT2.exe" called "RemoveDirectoryA" with parameter %TEMP%\grandUIAkj1fIxXZz0xJZ\Files\OneNote Notebooks\OneNote 2010 Guide (UID: 00000000-00007568) "1sW61HT2.exe" called "RemoveDirectoryA" with parameter %TEMP%\grandUIAkj1fIxXZz0xJZ\Files\OneNote Notebooks (UID: 00000000-00007568) "1sW61HT2.exe" called "RemoveDirectoryA" with parameter %TEMP%\grandUIAkj1fIxXZz0xJZ\Files\Outlook Files (UID: 00000000-00007568) "1sW61HT2.exe" called "RemoveDirectoryA" with parameter %TEMP%\grandUIAkj1fIxXZz0xJZ\Files (UID: 00000000-00007568) "1sW61HT2.exe" called "RemoveDirectoryA" with parameter %TEMP%\grandUIAkj1fIxXZz0xJZ\Files\.mitmproxy (UID: 00000000-00007568) "1sW61HT2.exe" called "RemoveDirectoryA" with parameter %TEMP%\grandUIAkj1fIxXZz0xJZ\Files\3D Objects (UID: 00000000-00007568) "1sW61HT2.exe" called "RemoveDirectoryA" with parameter %TEMP%\grandUIAkj1fIxXZz0xJZ\Files\AppData\Local\Adobe\Acrobat\11.0\Cache (UID: 00000000-00007568) "1sW61HT2.exe" called "RemoveDirectoryA" with parameter %TEMP%\grandUIAkj1fIxXZz0xJZ\Files\AppData\Local\Adobe\Acrobat\11.0 (UID: 00000000-00007568) "1sW61HT2.exe" called "RemoveDirectoryA" with parameter %TEMP%\grandUIAkj1fIxXZz0xJZ\Files\AppData\Local\Adobe\Acrobat (UID: 00000000-00007568)58:T898,"1sW61HT2.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "1sW61HT2.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "1sW61HT2.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS"; Key: "") "1sW61HT2.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS"; Key: "") "1sW61HT2.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "1sW61HT2.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "1sW61HT2.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS"; Key: "") "1sW61HT2.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS"; Key: "") "1sW61HT2.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED"; Key: "") "1sW61HT2.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES"; Key: "") "1sW61HT2.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS"; Key: "") "1sW61HT2.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS"; Key: "") "1sW61HT2.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED"; Key: "") "1sW61HT2.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES"; Key: "") "1sW61HT2.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS"; Key: "") "1sW61HT2.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS"; Key: "") "1sW61HT2.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT"; Key: "") "1sW61HT2.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES"; Key: "") "1sW61HT2.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CRLS"; Key: "") "1sW61HT2.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CTLS"; Key: "") "1sW61HT2.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE"; Key: "") "1sW61HT2.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE\CERTIFICATES"; Key: "")59:T4f7,"1sW61HT2.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\AUTOUPDATE"; Key: "DISALLOWEDCERTSYNCDELTATIME") "1sW61HT2.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "1sW61HT2.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "1sW61HT2.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\104C63D2546B8021DD105E9FBA5A8D78169F6B32"; Key: "BLOB") "1sW61HT2.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\247106A405B288A46E70A0262717162D0903E734"; Key: "BLOB") "1sW61HT2.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\27AC9369FAF25207BB2627CEFACCBE4EF9C319B8"; Key: "BLOB") "1sW61HT2.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\339CDD57CFD5B141169B615FF31428782D1DA639"; Key: "BLOB") "1sW61HT2.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\4C27431717565A3A07F3E6D0032C4258949CF9EC"; Key: "BLOB") "1sW61HT2.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\525C47FB3A5E0655FBD4BE963CA1E94D5FECB43D"; Key: "BLOB") "1sW61HT2.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\5AEAEE3F7F2A9449CEBAFEEC68FDD184F20124A7"; Key: "BLOB")5a:Td60,Found reference to API "RegCreateKeyExA" (Indicator: "RegCreateKey"; File: "d94fc8dcbc9e403657f9323967855f59.exe") Found reference to API "" (Indicator: "RegCreateKey"; Source: "00000000-00001476.00000000.68316.02E20000.00000004.mdmp, 00000000-00001476.00000002.72156.02E20000.00000004.mdmp") Found reference to API "" (Indicator: "RegCreateKey"; Source: "00000000-00001476.00000000.68316.02E20000.00000004.mdmp, 00000000-00001476.00000002.72156.02E20000.00000004.mdmp") Found reference to API "" (Indicator: "RegCreateKey"; Source: "00000000-00001476.00000000.68316.02E20000.00000004.mdmp, 00000000-00001476.00000002.72156.02E20000.00000004.mdmp") Found reference to API "" (Indicator: "RegCreateKey"; Source: "00000000-00001476.00000000.68316.02E20000.00000004.mdmp, 00000000-00001476.00000002.72156.02E20000.00000004.mdmp") Found reference to API "" (Indicator: "RegCreateKey"; Source: "00000000-00004452.00000001.68822.02C40000.00000004.mdmp, 00000000-00004452.00000002.70742.02C40000.00000004.mdmp") Found reference to API "" (Indicator: "RegCreateKey"; Source: "00000000-00004452.00000001.68822.02C40000.00000004.mdmp, 00000000-00004452.00000002.70742.02C40000.00000004.mdmp") Found reference to API "" (Indicator: "RegCreateKey"; Source: "00000000-00004452.00000001.68822.02C40000.00000004.mdmp, 00000000-00004452.00000002.70742.02C40000.00000004.mdmp") Found reference to API "" (Indicator: "RegCreateKey"; Source: "00000000-00004452.00000001.68822.02C40000.00000004.mdmp, 00000000-00004452.00000002.70742.02C40000.00000004.mdmp") Found reference to API "RegCreateKeyExA" (Indicator: "RegCreateKey"; Source: "00000000-00004452.00000002.70742.000DA000.00000002.mdmp") Found reference to API "" (Indicator: "RegCreateKey"; Source: "00000000-00007244.00000000.66928.00D90000.00000004.mdmp, 00000000-00007244.00000001.68849.00D90000.00000004.mdmp, 00000000-00007244.00000002.70769.00D90000.00000004.mdmp") Found reference to API "" (Indicator: "RegCreateKey"; Source: "00000000-00007244.00000000.66928.00D90000.00000004.mdmp, 00000000-00007244.00000001.68849.00D90000.00000004.mdmp, 00000000-00007244.00000002.70769.00D90000.00000004.mdmp") Found reference to API "" (Indicator: "RegCreateKey"; Source: "00000000-00007244.00000000.66928.00D90000.00000004.mdmp, 00000000-00007244.00000001.68849.00D90000.00000004.mdmp, 00000000-00007244.00000002.70769.00D90000.00000004.mdmp") Found reference to API "" (Indicator: "RegCreateKey"; Source: "00000000-00007244.00000000.66928.00D90000.00000004.mdmp, 00000000-00007244.00000001.68849.00D90000.00000004.mdmp, 00000000-00007244.00000002.70769.00D90000.00000004.mdmp") Found reference to API "RegCreateKeyExA" (Indicator: "RegCreateKey"; Source: "00000000-00007244.00000000.66928.0112A000.00000002.mdmp")5b:T593,"AppLaunch.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoree.dll" - [base:0; Status:c0000135] "AppLaunch.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\ole32.dll" - [base:0; Status:c0000135] "AppLaunch.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll" - [base:0; Status:c0000135] "AppLaunch.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\VERSION.dll" - [base:0; Status:c0000135] "AppLaunch.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\uxtheme.dll" - [base:0; Status:c0000135] "AppLaunch.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll" - [base:0; Status:c0000135] "AppLaunch.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\PresentationCore\v4.0_4.0.0.0__31bf3856ad364e35\ucrtbase_clr0400.dll" - [base:0; Status:c0000135] "AppLaunch.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\PresentationCore\v4.0_4.0.0.0__31bf3856ad364e35\SHLWAPI.dll" - [base:0; Status:c0000135] "AppLaunch.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll" - [base:0; Status:c0000135]5c:T559,"d94fc8dcbc9e403657f9323967855f59.exe" loaded module "%WINDIR%\SysWOW64\bcryptprimitives.dll" at 76AD0000 "d94fc8dcbc9e403657f9323967855f59.exe" loaded module "%WINDIR%\SysWOW64\bcrypt.dll" at 73200000 "cZ2SE56.exe" loaded module "%WINDIR%\SysWOW64\bcryptprimitives.dll" at 76AD0000 "cZ2SE56.exe" loaded module "%WINDIR%\SysWOW64\bcrypt.dll" at 73200000 "nO2Ue30.exe" loaded module "%WINDIR%\SysWOW64\bcryptprimitives.dll" at 76AD0000 "nO2Ue30.exe" loaded module "%WINDIR%\SysWOW64\bcrypt.dll" at 73200000 "zW9af77.exe" loaded module "%WINDIR%\SysWOW64\bcryptprimitives.dll" at 76AD0000 "zW9af77.exe" loaded module "%WINDIR%\SysWOW64\bcrypt.dll" at 73200000 "1sW61HT2.exe" loaded module "%WINDIR%\SysWOW64\bcryptprimitives.dll" at 76AD0000 "1sW61HT2.exe" loaded module "%WINDIR%\SysWOW64\bcrypt.dll" at 73200000 "schtasks.exe" loaded module "%WINDIR%\SysWOW64\bcryptprimitives.dll" at 76AD0000 "2IW9992.exe" loaded module "%WINDIR%\SysWOW64\bcryptprimitives.dll" at 76AD0000 "2IW9992.exe" loaded module "%WINDIR%\SysWOW64\bcrypt.dll" at 73200000 "AppLaunch.exe" loaded module "%WINDIR%\SysWOW64\bcryptprimitives.dll" at 76AD0000 "AppLaunch.exe" loaded module "%WINDIR%\SysWOW64\bcrypt.dll" at 73200000 "3up60Ma.exe" loaded module "%WINDIR%\SysWOW64\bcryptprimitives.dll" at 76AD0000 "3up60Ma.exe" loaded module "%WINDIR%\SysWOW64\bcrypt.dll" at 732000005d:T9d0,"DELETE FROM %Q.%s WHERE tbl_name=%Q and type!='trigger'" (Source: 7575-2662-004CF800, Indicator: "delete from %q.%s where tbl_name=%q and type!='trigger'") "DELETE FROM %Q.sqlite_stat1 WHERE tbl=%Q" (Source: 7575-2662-004CF800, Indicator: "delete from %q.sqlite_stat1 where tbl=%q") "SELECT name, rootpage, sql FROM '%q'.%s WHERE %s" (Source: 7575-2310-004C2E90, Indicator: "select name, rootpage, sql from '%q'.%s where %s") "UPDATE %Q.%s SET type='table', name=%Q, tbl_name=%Q, rootpage=0, sql=%Q WHERE rowid=#%d" (Source: 7575-2739-004DC570, Indicator: "update %q.%s set type='table', name=%q, tbl_name=%q, rootpage=0, sql=%q where rowid=#%d") "UPDATE "%w".%s SET sql = substr(sql,1,%d) || ', ' || %Q || substr(sql,%d) WHERE type = 'table' AND name = %Q" (Source: 7575-2736-004CD570, Indicator: "update "%w".%s set sql = substr(sql,1,%d) || ', ' || %q || substr(sql,%d) where type = 'table' and name = %q"), "UPDATE %Q.%s SET type='%s' name=%Q tbl_name=%Q rootpage=#%d sql=%Q WHERE rowid=#%d" (Source: 7575-2460-004CF4F0, Indicator: "update %q.%s set type='%s' name=%q tbl_name=%q rootpage=#%d sql=%q where rowid=#%d"), "INSERT INTO %Q.%s VALUES('index',%Q,%Q,#%d,%Q);" (Source: 7575-2649-004CFB70, Indicator: "insert into %q.%s values('index',%q,%q,#%d,%q);"), "CREATE TABLE" (Source: 7575-2466-004CF340, Indicator: "create table"), "DELETE FROM %Q.%s WHERE name=%Q" (Source: 7575-2708-004D0320, Indicator: "delete from %q.%s where name=%q"), "DELETE FROM %Q.sqlite_stat1 WHERE idx=%Q" (Source: 7575-2708-004D0320, Indicator: "delete from %q.sqlite_stat1 where idx=%q"), "UPDATE %Q.%s SET sql = sqlite_rename_table(sql, %Q) tbl_name = %Q name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqlite_autoindex%%' AND type='index' THEN 'sqlite_autoindex_' || %Q || substr(name,%d+18) ELSE name END WHERE tbl_name=%Q AND (type='" (Source: 7575-2734-004CD2C0, Indicator: "update %q.%s set sql = sqlite_rename_table(sql, %q) tbl_name = %q name = case when type='table' then %q when name like 'sqlite_autoindex%%' and type='index' then 'sqlite_autoindex_' || %q || substr(name,%d+18) else name end where tbl_name=%q and (type='") "CREATE TABLE sqlite_master( type text, name text, tbl_name text, rootpage integer, sql text)" (Source: 7575-2265-004D6790, Indicator: "create table sqlite_master( type text, name text, tbl_name text, rootpage integer, sql text)"), "SELECT name rootpage sql FROM '%q'.%s" (Source: 7575-2265-004D6790, Indicator: "select name rootpage sql from '%q'.%s")5e:Tfff,Observed system executable string:"%WINDIR%\system32\advapi32.dll" [Source: 00000000-00007632-00000C25-37632186] Observed system executable string:"%WINDIR%\system32\advpack.dll" [Source: 00000000-00007632-00000C25-37704889] Observed system executable string:"rundll32.exe %WINDIR%\system32\advpack.dll,DelNodeRunDLL32 "%TEMP%\IXP000.TMP\"" [Source: 00000000-00007632-00000BC1-37720110] Observed system executable string:"rundll32.exe %WINDIR%\system32\advpack.dll,DelNodeRunDLL32 "%TEMP%\IXP001.TMP\"" [Source: 00000000-00004452-00000BC1-38167770] Observed system executable string:"rundll32.exe %WINDIR%\system32\advpack.dll,DelNodeRunDLL32 "%TEMP%\IXP002.TMP\"" [Source: 00000000-00007244-00000BC1-38548351] Observed system executable string:"rundll32.exe %WINDIR%\system32\advpack.dll,DelNodeRunDLL32 "%TEMP%\IXP003.TMP\"" [Source: 00000000-00007692-00000BC1-39107812] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll" [Source: 00000000-00004224-00000C25-60067135] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\clr.dll" [Source: 00000000-00004224-00000C25-60413690] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoree.dll" [Source: 00000000-00004224-00000C25-60499768] Observed system executable string:"%WINDIR%\system32\combase.dll" [Source: 00000000-00004224-00000C25-60615539] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\mscorlib\36eaccfde177c2e7b93b8dbdde4e012a\mscorlib.ni.dll" [Source: 00000000-00004224-00000C25-60754880] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\ole32.dll" [Source: 00000000-00004224-00000C25-60817982] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll" [Source: 00000000-00004224-00000C25-60859712] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\clrjit.dll" [Source: 00000000-00004224-00000C25-60935548] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\VERSION.dll" [Source: 00000000-00004224-00000C25-61056118] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System\2c3c912ea8f058f9d04c4650128feb3f\System.ni.dll" [Source: 00000000-00004224-00000C25-61107822] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\uxtheme.dll" [Source: 00000000-00004224-00000C25-61207777] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Core\31fae3290fad30c31c98651462d22724\System.Core.ni.dll" [Source: 00000000-00004224-00000C25-61306073] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Configuration\96f7edb07b12303f0ec2595c7f3778c7\System.Configuration.ni.dll" [Source: 00000000-00004224-00000C25-61328291] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Xml\15af16d373cf0528cb74fc73d365fdbf\System.Xml.ni.dll" [Source: 00000000-00004224-00000C25-61379944] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll" [Source: 00000000-00004224-00000C25-61494675] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\WindowsBase\1a4cc316fb6d09525321fc0be44692d8\WindowsBase.ni.dll" [Source: 00000000-00004224-00000C25-61709298] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\PresentationCore\468f4e17be144ca12a73a4297eacc9cc\PresentationCore.ni.dll" [Source: 00000000-00004224-00000C25-61758254] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\Presentatio5ae0f00f#\252cc7b0fae8cfe083bdc149957c0c54\PresentationFramework.ni.dll" [Source: 00000000-00004224-00000C25-61911330] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_32\PresentationCore\v4.0_4.0.0.0__31bf3856ad364e35\ucrtbase_clr0400.dll" [Source: 00000000-00004224-00000C25-62175248]5f:T520,"d94fc8dcbc9e403657f9323967855f59.exe" queries basic process information of the "C:\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP\cZ2SE56.exe" (UID: 7632) "cZ2SE56.exe" queries basic process information of the "C:\Users\%OSUSER%\AppData\Local\Temp\IXP001.TMP\nO2Ue30.exe" (UID: 4452) "nO2Ue30.exe" queries basic process information of the "C:\Users\%OSUSER%\AppData\Local\Temp\IXP002.TMP\zW9af77.exe" (UID: 7244) "nO2Ue30.exe" queries basic process information of the "C:\Users\%OSUSER%\AppData\Local\Temp\IXP002.TMP\3up60Ma.exe" (UID: 7244) "zW9af77.exe" queries basic process information of the "C:\Users\%OSUSER%\AppData\Local\Temp\IXP003.TMP\1sW61HT2.exe" (UID: 7692) "zW9af77.exe" queries basic process information of the "C:\Users\%OSUSER%\AppData\Local\Temp\IXP003.TMP\2IW9992.exe" (UID: 7692) "1sW61HT2.exe" queries basic process information of the "C:\Windows\SysWOW64\schtasks.exe" (UID: 7568) "1sW61HT2.exe" queries basic process information of the "C:\Users\%OSUSER%\AppData\Local\Temp\IXP003.TMP\1sW61HT2.exe" (UID: 7568) "2IW9992.exe" queries basic process information of the "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe" (UID: 6544) "AppLaunch.exe" queries basic process information of the "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe" (UID: 4224)60:T54a,"zW9af77.exe" called "FindFirstFileA" with parameter %TEMP%\IXP003.TMP\* (UID: 00000000-00007692) "zW9af77.exe" called "FindNextFileA" with parameter .. (UID: 00000000-00007692) "1sW61HT2.exe" called "FindFirstFileA" with parameter %USERPROFILE%\Desktop/\* (UID: 00000000-00007568) "1sW61HT2.exe" called "FindNextFileA" with parameter .. (UID: 00000000-00007568) "1sW61HT2.exe" called "FindNextFileA" with parameter desktop.ini (UID: 00000000-00007568) "1sW61HT2.exe" called "FindFirstFileA" with parameter %USERPROFILE%\Documents/\* (UID: 00000000-00007568) "1sW61HT2.exe" called "FindNextFileA" with parameter Database1.accdb (UID: 00000000-00007568) "1sW61HT2.exe" called "FindNextFileA" with parameter My Music (UID: 00000000-00007568) "1sW61HT2.exe" called "FindNextFileA" with parameter My Pictures (UID: 00000000-00007568) "1sW61HT2.exe" called "FindNextFileA" with parameter My Videos (UID: 00000000-00007568) "1sW61HT2.exe" called "FindNextFileA" with parameter OneNote Notebooks (UID: 00000000-00007568) "1sW61HT2.exe" called "FindNextFileA" with parameter Outlook Files (UID: 00000000-00007568) "1sW61HT2.exe" called "FindFirstFileA" with parameter %TEMP%\grandUIAkj1fIxXZz0xJZ\Autofill\*.* (UID: 00000000-00007568) "1sW61HT2.exe" called "FindFirstFileA" with parameter %USERPROFILE%\Documents/\My Music\* (UID: 00000000-00007568)61:T9fb,Found reference to API "GetDesktopWindow" (Indicator: "GetDesktopWindow"; File: "d94fc8dcbc9e403657f9323967855f59.exe") Found reference to API "GetDC" (Indicator: "GetDC"; File: "d94fc8dcbc9e403657f9323967855f59.exe") Found reference to API "" (Indicator: "GetDC"; Source: "00000000-00001476.00000000.68316.02E20000.00000004.mdmp, 00000000-00001476.00000002.72156.02E20000.00000004.mdmp") Found reference to API "" (Indicator: "GetDC"; Source: "00000000-00001476.00000000.68316.02E20000.00000004.mdmp, 00000000-00001476.00000002.72156.02E20000.00000004.mdmp") Found reference to API "" (Indicator: "GetWindowDC"; Source: "00000000-00001476.00000000.68316.02E20000.00000004.mdmp, 00000000-00001476.00000002.72156.02E20000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00001476.00000000.68316.02E20000.00000004.mdmp, 00000000-00001476.00000002.72156.02E20000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00001476.00000000.68316.02E20000.00000004.mdmp, 00000000-00001476.00000002.72156.02E20000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleBitmap"; Source: "00000000-00001476.00000000.68316.02E20000.00000004.mdmp, 00000000-00001476.00000002.72156.02E20000.00000004.mdmp") Found reference to API "" (Indicator: "BitBlt"; Source: "00000000-00001476.00000000.68316.02E20000.00000004.mdmp, 00000000-00001476.00000002.72156.02E20000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleDC"; Source: "00000000-00001476.00000000.68316.02E20000.00000004.mdmp, 00000000-00001476.00000002.72156.02E20000.00000004.mdmp") Found reference to API "GetDesktopWindow" (Indicator: "GetDesktopWindow"; Source: "00000000-00004452.00000002.70742.000DA000.00000002.mdmp") Found reference to API "GetDC" (Indicator: "GetDC"; Source: "00000000-00004452.00000002.70742.000DA000.00000002.mdmp") Found reference to API "GetDesktopWindow" (Indicator: "GetDesktopWindow"; Source: "00000000-00007244.00000000.66928.0112A000.00000002.mdmp") Found reference to API "GetDC" (Indicator: "GetDC"; Source: "00000000-00007244.00000000.66928.0112A000.00000002.mdmp")62:Ta72,Found reference to API "RegOpenKeyExA" (Indicator: "RegOpenKey"; File: "d94fc8dcbc9e403657f9323967855f59.exe") Found reference to API "RegQueryInfoKeyA" (Indicator: "RegQueryInfoKey"; File: "d94fc8dcbc9e403657f9323967855f59.exe") Found reference to API "RegQueryValueExA" (Indicator: "RegQueryValue"; File: "d94fc8dcbc9e403657f9323967855f59.exe") Found reference to API "" (Indicator: "RegOpenKey"; Source: "00000000-00001476.00000000.68316.02E20000.00000004.mdmp, 00000000-00001476.00000002.72156.02E20000.00000004.mdmp") Found reference to API "" (Indicator: "RegOpenKey"; Source: "00000000-00001476.00000000.68316.02E20000.00000004.mdmp, 00000000-00001476.00000002.72156.02E20000.00000004.mdmp") Found reference to API "" (Indicator: "RegOpenKey"; Source: "00000000-00004452.00000001.68822.02C40000.00000004.mdmp, 00000000-00004452.00000002.70742.02C40000.00000004.mdmp") Found reference to API "" (Indicator: "RegOpenKey"; Source: "00000000-00004452.00000001.68822.02C40000.00000004.mdmp, 00000000-00004452.00000002.70742.02C40000.00000004.mdmp") Found reference to API "RegOpenKeyExA" (Indicator: "RegOpenKey"; Source: "00000000-00004452.00000002.70742.000DA000.00000002.mdmp") Found reference to API "RegQueryInfoKeyA" (Indicator: "RegQueryInfoKey"; Source: "00000000-00004452.00000002.70742.000DA000.00000002.mdmp") Found reference to API "RegQueryValueExA" (Indicator: "RegQueryValue"; Source: "00000000-00004452.00000002.70742.000DA000.00000002.mdmp") Found reference to API "" (Indicator: "RegOpenKey"; Source: "00000000-00007244.00000000.66928.00D90000.00000004.mdmp, 00000000-00007244.00000001.68849.00D90000.00000004.mdmp, 00000000-00007244.00000002.70769.00D90000.00000004.mdmp") Found reference to API "" (Indicator: "RegOpenKey"; Source: "00000000-00007244.00000000.66928.00D90000.00000004.mdmp, 00000000-00007244.00000001.68849.00D90000.00000004.mdmp, 00000000-00007244.00000002.70769.00D90000.00000004.mdmp") Found reference to API "RegOpenKeyExA" (Indicator: "RegOpenKey"; Source: "00000000-00007244.00000000.66928.0112A000.00000002.mdmp") Found reference to API "RegQueryInfoKeyA" (Indicator: "RegQueryInfoKey"; Source: "00000000-00007244.00000000.66928.0112A000.00000002.mdmp") Found reference to API "RegQueryValueExA" (Indicator: "RegQueryValue"; Source: "00000000-00007244.00000000.66928.0112A000.00000002.mdmp")63:T4c3,Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; File: "d94fc8dcbc9e403657f9323967855f59.exe") Found reference to API "OpenProcessToken" (Indicator: "OpenProcessToken"; File: "d94fc8dcbc9e403657f9323967855f59.exe") file/memory contains long string with (Indicator: "OpenProcessToken"; File: "d94fc8dcbc9e403657f9323967855f59.exe") file/memory contains long string with (Indicator: "OpenProcessToken"; Source: "00000000-00004452.00000002.70742.000DA000.00000002.mdmp") Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; Source: "00000000-00004452.00000002.70742.000DA000.00000002.mdmp") Found reference to API "OpenProcessToken" (Indicator: "OpenProcessToken"; Source: "00000000-00004452.00000002.70742.000DA000.00000002.mdmp") file/memory contains long string with (Indicator: "OpenProcessToken"; Source: "00000000-00007244.00000000.66928.0112A000.00000002.mdmp") Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; Source: "00000000-00007244.00000000.66928.0112A000.00000002.mdmp") Found reference to API "OpenProcessToken" (Indicator: "OpenProcessToken"; Source: "00000000-00007244.00000000.66928.0112A000.00000002.mdmp")64:T78a,Found reference to API "RegDeleteValueA" (Indicator: "RegDeleteValue"; File: "d94fc8dcbc9e403657f9323967855f59.exe") Found reference to API "" (Indicator: "RegDeleteValue"; Source: "00000000-00001476.00000000.68316.02E20000.00000004.mdmp, 00000000-00001476.00000002.72156.02E20000.00000004.mdmp") Found reference to API "" (Indicator: "RegDeleteValue"; Source: "00000000-00001476.00000000.68316.02E20000.00000004.mdmp, 00000000-00001476.00000002.72156.02E20000.00000004.mdmp") Found reference to API "" (Indicator: "RegDeleteValue"; Source: "00000000-00004452.00000001.68822.02C40000.00000004.mdmp, 00000000-00004452.00000002.70742.02C40000.00000004.mdmp") Found reference to API "" (Indicator: "RegDeleteValue"; Source: "00000000-00004452.00000001.68822.02C40000.00000004.mdmp, 00000000-00004452.00000002.70742.02C40000.00000004.mdmp") Found reference to API "RegDeleteValueA" (Indicator: "RegDeleteValue"; Source: "00000000-00004452.00000002.70742.000DA000.00000002.mdmp") Found reference to API "" (Indicator: "RegDeleteValue"; Source: "00000000-00007244.00000000.66928.00D90000.00000004.mdmp, 00000000-00007244.00000001.68849.00D90000.00000004.mdmp, 00000000-00007244.00000002.70769.00D90000.00000004.mdmp") Found reference to API "" (Indicator: "RegDeleteValue"; Source: "00000000-00007244.00000000.66928.00D90000.00000004.mdmp, 00000000-00007244.00000001.68849.00D90000.00000004.mdmp, 00000000-00007244.00000002.70769.00D90000.00000004.mdmp") Found reference to API "RegDeleteValueA" (Indicator: "RegDeleteValue"; Source: "00000000-00007244.00000000.66928.0112A000.00000002.mdmp")65:T41e,"d94fc8dcbc9e403657f9323967855f59.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LANGUAGE"; Key: "INSTALLLANGUAGEFALLBACK") "cZ2SE56.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LANGUAGE"; Key: "INSTALLLANGUAGEFALLBACK") "nO2Ue30.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LANGUAGE"; Key: "INSTALLLANGUAGEFALLBACK") "zW9af77.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LANGUAGE"; Key: "INSTALLLANGUAGEFALLBACK") "1sW61HT2.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LANGUAGE"; Key: "INSTALLLANGUAGEFALLBACK") "schtasks.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LANGUAGE"; Key: "INSTALLLANGUAGEFALLBACK") "2IW9992.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LANGUAGE"; Key: "INSTALLLANGUAGEFALLBACK") "AppLaunch.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LANGUAGE"; Key: "INSTALLLANGUAGEFALLBACK") "AppLaunch.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LANGUAGE GROUPS"; Key: "1") "3up60Ma.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LANGUAGE"; Key: "INSTALLLANGUAGEFALLBACK")66:Tb5c,"1sW61HT2.exe" called "CryptUnprotectData" with parameters {"pDataIn": "80000000186b6b03" "pDataOut": "0000000000000000" "$error": "d"} "1sW61HT2.exe" called "CryptUnprotectData" with parameters {"pDataIn": "90000000186b6b03" "pDataOut": "0000000000000000" "$error": "d"} "1sW61HT2.exe" called "CryptUnprotectData" with parameters {"pDataIn": "a0000000186b6b03" "pDataOut": "0000000000000000" "$error": "d"} "1sW61HT2.exe" called "CryptUnprotectData" with parameters {"pDataIn": "b0000000186b6b03" "pDataOut": "0000000000000000" "$error": "d"} "1sW61HT2.exe" called "CryptUnprotectData" with parameters {"pDataIn": "c0000000186b6b03" "pDataOut": "0000000000000000" "$error": "d"} "1sW61HT2.exe" called "CryptUnprotectData" with parameters {"pDataIn": "d0000000186b6b03" "pDataOut": "0000000000000000" "$error": "d"} "1sW61HT2.exe" called "CryptUnprotectData" with parameters {"pDataIn": "e0000000186b6b03" "pDataOut": "0000000000000000" "$error": "d"} "1sW61HT2.exe" called "CryptUnprotectData" with parameters {"pDataIn": "f0000000186b6b03" "pDataOut": "0000000000000000" "$error": "d"} "1sW61HT2.exe" called "CryptUnprotectData" with parameters {"pDataIn": "00010000186b6b03" "pDataOut": "0000000000000000" "$error": "d"} "1sW61HT2.exe" called "CryptUnprotectData" with parameters {"pDataIn": "10010000186b6b03" "pDataOut": "2000000018932a06" "$dataout": "b41f53fd7c91eeb41677c8b431507aa71d8a8df3f42de5625b7d75a16322b842"} "1sW61HT2.exe" called "CryptUnprotectData" with parameters {"pDataIn": "80000000c0726b03" "pDataOut": "0000000000000000" "$error": "d"} "1sW61HT2.exe" called "CryptUnprotectData" with parameters {"pDataIn": "90000000c0726b03" "pDataOut": "0000000000000000" "$error": "d"} "1sW61HT2.exe" called "CryptUnprotectData" with parameters {"pDataIn": "a0000000c0726b03" "pDataOut": "0000000000000000" "$error": "d"} "1sW61HT2.exe" called "CryptUnprotectData" with parameters {"pDataIn": "b0000000c0726b03" "pDataOut": "0000000000000000" "$error": "d"} "1sW61HT2.exe" called "CryptUnprotectData" with parameters {"pDataIn": "c0000000c0726b03" "pDataOut": "0000000000000000" "$error": "d"} "1sW61HT2.exe" called "CryptUnprotectData" with parameters {"pDataIn": "d0000000c0726b03" "pDataOut": "0000000000000000" "$error": "d"} "1sW61HT2.exe" called "CryptUnprotectData" with parameters {"pDataIn": "e0000000c0726b03" "pDataOut": "0000000000000000" "$error": "d"} "1sW61HT2.exe" called "CryptUnprotectData" with parameters {"pDataIn": "f0000000c0726b03" "pDataOut": "0000000000000000" "$error": "d"} "1sW61HT2.exe" called "CryptUnprotectData" with parameters {"pDataIn": "00010000c0726b03" "pDataOut": "0000000000000000" "$error": "d"} "1sW61HT2.exe" called "CryptUnprotectData" with parameters {"pDataIn": "10010000c0726b03" "pDataOut": "2000000018982a06" "$dataout": "b41f53fd7c91eeb41677c8b431507aa71d8a8df3f42de5625b7d75a16322b842"}67:T7d0,"zW9af77.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\IXP003.TMP\2IW9992.exe" for deletion "zW9af77.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\IXP003.TMP\1sW61HT2.exe" for deletion "1sW61HT2.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\posterBoxkj1fIxXZz0xJZ\8ghN89CsjOW1formhistory.sqlite" for deletion "1sW61HT2.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\posterBoxkj1fIxXZz0xJZ\D87fZN3R3jFeplaces.sqlite" for deletion "1sW61HT2.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\posterBoxkj1fIxXZz0xJZ\02zdBXl47cvzcookies.sqlite" for deletion "1sW61HT2.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\posterBoxkj1fIxXZz0xJZ\Ei8DrAmaYu9KLogin Data" for deletion "1sW61HT2.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\posterBoxkj1fIxXZz0xJZ\D87fZN3R3jFeWeb Data" for deletion "1sW61HT2.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\posterBoxkj1fIxXZz0xJZ\02zdBXl47cvzHistory" for deletion "1sW61HT2.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\posterBoxkj1fIxXZz0xJZ\3b6N2Xdh3CYwWeb Data" for deletion "1sW61HT2.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\posterBoxkj1fIxXZz0xJZ\oOPEmFmu_xsJCookies" for deletion "1sW61HT2.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\posterBoxkj1fIxXZz0xJZ\IWPfiAXUTJTSHistory" for deletion "1sW61HT2.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\fEEl9lQf9yE4jhDICcNLw4ogDllzNv5Q.zip" for deletion "1sW61HT2.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\grandUIAkj1fIxXZz0xJZ\Cookies\Edge_Default.txt" for deletion "1sW61HT2.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\grandUIAkj1fIxXZz0xJZ\Cookies\Firefox_ywzu7870.default.txt" for deletion "1sW61HT2.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\grandUIAkj1fIxXZz0xJZ\Downloads\Edge_Default.txt" for deletion "1sW61HT2.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\grandUIAkj1fIxXZz0xJZ\information.txt" for deletion "1sW61HT2.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\grandUIAkj1fIxXZz0xJZ\passwords.txt" for deletion68:T615,"d94fc8dcbc9e403657f9323967855f59.exe" wrote 00000004 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP\cZ2SE56.exe" (Handle: 652) "cZ2SE56.exe" wrote 00000004 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\Temp\IXP001.TMP\nO2Ue30.exe" (Handle: 124) "nO2Ue30.exe" wrote 00000004 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\Temp\IXP002.TMP\zW9af77.exe" (Handle: 652) "nO2Ue30.exe" wrote 00000004 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\Temp\IXP002.TMP\3up60Ma.exe" (Handle: 128) "zW9af77.exe" wrote 00000004 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\Temp\IXP003.TMP\1sW61HT2.exe" (Handle: 656) "zW9af77.exe" wrote 00000004 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\Temp\IXP003.TMP\2IW9992.exe" (Handle: 652) "1sW61HT2.exe" wrote 00000004 bytes to a remote process "C:\Windows\SysWOW64\schtasks.exe" (Handle: 1068) "1sW61HT2.exe" wrote 00000004 bytes to a remote process "C:\Windows\SysWOW64\schtasks.exe" (Handle: 712) "2IW9992.exe" wrote 00000004 bytes to a remote process "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe" (Handle: 144) "2IW9992.exe" wrote 00000200 bytes to a remote process "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe" (Handle: 144) "2IW9992.exe" wrote 0002C000 bytes to a remote process "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe" (Handle: 144) "2IW9992.exe" wrote 0000AA00 bytes to a remote process "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe" (Handle: 144)69:T420,"1sW61HT2.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\15.0\OUTLOOK\PROFILES\OUTLOOK\9375CFF0413111D3B88A00104B2A6676") "1sW61HT2.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINDOWS MESSAGING SUBSYSTEM\PROFILES\OUTLOOK\9375CFF0413111D3B88A00104B2A6676") "1sW61HT2.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS MESSAGING SUBSYSTEM\PROFILES\9375CFF0413111D3B88A00104B2A6676") "1sW61HT2.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\16.0\OUTLOOK\PROFILES\OUTLOOK\9375CFF0413111D3B88A00104B2A6676") "1sW61HT2.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\16.0\OUTLOOK\PROFILES\OUTLOOK\9375CFF0413111D3B88A00104B2A6676\00000001") "1sW61HT2.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\16.0\OUTLOOK\PROFILES\OUTLOOK\9375CFF0413111D3B88A00104B2A6676\00000001"; Key: "EMAIL") "1sW61HT2.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\16.0\OUTLOOK\PROFILES\OUTLOOK\9375CFF0413111D3B88A00104B2A6676\00000002") "1sW61HT2.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\16.0\OUTLOOK\PROFILES\OUTLOOK\9375CFF0413111D3B88A00104B2A6676\00000002"; Key: "EMAIL")6a:T6ae,"1sW61HT2.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Roaming\Mozilla\Firefox\profiles.ini" "1sW61HT2.exe" trying to open a file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Roaming\Mozilla\Firefox\Profiles\ywzu7870.default\LOGINS.JSON" "1sW61HT2.exe" trying to open a file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Roaming\Mozilla\Firefox\Profiles\ywzu7870.default\SIGNONS.SQLITE" "1sW61HT2.exe" trying to open a file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Roaming\Mozilla\Firefox\Profiles\ywzu7870.default\SIGNONS.SQLITE-JOURNAL" "1sW61HT2.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Roaming\Mozilla\Firefox\Profiles\ywzu7870.default\formhistory.sqlite" "1sW61HT2.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Roaming\Mozilla\Firefox\Profiles\ywzu7870.default\places.sqlite" "1sW61HT2.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Roaming\Mozilla\Firefox\Profiles\ywzu7870.default\cookies.sqlite" "1sW61HT2.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Local State" "1sW61HT2.exe" trying to open a file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Roaming\Mozilla\SEAMONKEY\PROFILES.INI" "1sW61HT2.exe" trying to open a file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Roaming\THUNDERBIRD\PROFILES.INI" "1sW61HT2.exe" trying to open a file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Default\LOCAL STATE" "1sW61HT2.exe" trying to open a file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Default\LOCALPREFS.JSON" "1sW61HT2.exe" trying to open a file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Roaming\WATERFOX\PROFILES.INI"6b:T228d,1sW61HT2.exe trying to open a file %LOCALAPPDATA%\Microsoft\Edge\User Data\Ad Blocking\SYNC EXTENSION SETTINGS\NKBIHFBEOGAEAOEHLEFNKODBEFGPGKNN\CURRENT related to MetaMask 1sW61HT2.exe trying to open a file %LOCALAPPDATA%\Microsoft\Edge\User Data\Ad Blocking\LOCAL EXTENSION SETTINGS\NKBIHFBEOGAEAOEHLEFNKODBEFGPGKNN\CURRENT related to MetaMask 1sW61HT2.exe trying to open a file %LOCALAPPDATA%\Microsoft\Edge\User Data\Autofill\SYNC EXTENSION SETTINGS\NKBIHFBEOGAEAOEHLEFNKODBEFGPGKNN\CURRENT related to MetaMask 1sW61HT2.exe trying to open a file %LOCALAPPDATA%\Microsoft\Edge\User Data\Autofill\LOCAL EXTENSION SETTINGS\NKBIHFBEOGAEAOEHLEFNKODBEFGPGKNN\CURRENT related to MetaMask 1sW61HT2.exe trying to open a file %LOCALAPPDATA%\Microsoft\Edge\User Data\AutoLaunchProtocolsComponent\SYNC EXTENSION SETTINGS\NKBIHFBEOGAEAOEHLEFNKODBEFGPGKNN\CURRENT related to MetaMask 1sW61HT2.exe trying to open a file %LOCALAPPDATA%\Microsoft\Edge\User Data\AutoLaunchProtocolsComponent\LOCAL EXTENSION SETTINGS\NKBIHFBEOGAEAOEHLEFNKODBEFGPGKNN\CURRENT related to MetaMask 1sW61HT2.exe trying to open a file %LOCALAPPDATA%\Microsoft\Edge\User Data\BrowserMetrics\SYNC EXTENSION SETTINGS\NKBIHFBEOGAEAOEHLEFNKODBEFGPGKNN\CURRENT related to MetaMask 1sW61HT2.exe trying to open a file %LOCALAPPDATA%\Microsoft\Edge\User Data\BrowserMetrics\LOCAL EXTENSION SETTINGS\NKBIHFBEOGAEAOEHLEFNKODBEFGPGKNN\CURRENT related to MetaMask 1sW61HT2.exe trying to open a file %LOCALAPPDATA%\Microsoft\Edge\User Data\CertificateRevocation\SYNC EXTENSION SETTINGS\NKBIHFBEOGAEAOEHLEFNKODBEFGPGKNN\CURRENT related to MetaMask 1sW61HT2.exe trying to open a file %LOCALAPPDATA%\Microsoft\Edge\User Data\CertificateRevocation\LOCAL EXTENSION SETTINGS\NKBIHFBEOGAEAOEHLEFNKODBEFGPGKNN\CURRENT related to MetaMask 1sW61HT2.exe trying to open a file %LOCALAPPDATA%\Microsoft\Edge\User Data\Crashpad\SYNC EXTENSION SETTINGS\NKBIHFBEOGAEAOEHLEFNKODBEFGPGKNN\CURRENT related to MetaMask 1sW61HT2.exe trying to open a file %LOCALAPPDATA%\Microsoft\Edge\User Data\Crashpad\LOCAL EXTENSION SETTINGS\NKBIHFBEOGAEAOEHLEFNKODBEFGPGKNN\CURRENT related to MetaMask 1sW61HT2.exe trying to open a file %LOCALAPPDATA%\Microsoft\Edge\User Data\Default\SYNC EXTENSION SETTINGS\NKBIHFBEOGAEAOEHLEFNKODBEFGPGKNN\CURRENT related to MetaMask 1sW61HT2.exe trying to open a file %LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Local Extension Settings\NKBIHFBEOGAEAOEHLEFNKODBEFGPGKNN\CURRENT related to MetaMask 1sW61HT2.exe trying to open a file %LOCALAPPDATA%\Microsoft\Edge\User Data\EADPData Component\SYNC EXTENSION SETTINGS\NKBIHFBEOGAEAOEHLEFNKODBEFGPGKNN\CURRENT related to MetaMask 1sW61HT2.exe trying to open a file %LOCALAPPDATA%\Microsoft\Edge\User Data\EADPData Component\LOCAL EXTENSION SETTINGS\NKBIHFBEOGAEAOEHLEFNKODBEFGPGKNN\CURRENT related to MetaMask 1sW61HT2.exe trying to open a file %LOCALAPPDATA%\Microsoft\Edge\User Data\Edge Kids Mode\SYNC EXTENSION SETTINGS\NKBIHFBEOGAEAOEHLEFNKODBEFGPGKNN\CURRENT related to MetaMask 1sW61HT2.exe trying to open a file %LOCALAPPDATA%\Microsoft\Edge\User Data\Edge Kids Mode\LOCAL EXTENSION SETTINGS\NKBIHFBEOGAEAOEHLEFNKODBEFGPGKNN\CURRENT related to MetaMask 1sW61HT2.exe trying to open a file %LOCALAPPDATA%\Microsoft\Edge\User Data\Edge Shopping\SYNC EXTENSION SETTINGS\NKBIHFBEOGAEAOEHLEFNKODBEFGPGKNN\CURRENT related to MetaMask 1sW61HT2.exe trying to open a file %LOCALAPPDATA%\Microsoft\Edge\User Data\Edge Shopping\LOCAL EXTENSION SETTINGS\NKBIHFBEOGAEAOEHLEFNKODBEFGPGKNN\CURRENT related to MetaMask 1sW61HT2.exe trying to open a file %LOCALAPPDATA%\Microsoft\Edge\User Data\Edge Travel\SYNC EXTENSION SETTINGS\NKBIHFBEOGAEAOEHLEFNKODBEFGPGKNN\CURRENT related to MetaMask 1sW61HT2.exe trying to open a file %LOCALAPPDATA%\Microsoft\Edge\User Data\Edge Travel\LOCAL EXTENSION SETTINGS\NKBIHFBEOGAEAOEHLEFNKODBEFGPGKNN\CURRENT related to MetaMask 1sW61HT2.exe trying to open a file %LOCALAPPDATA%\Microsoft\Edge\User Data\Edge Wallet\SYNC EXTENSION SETTINGS\NKBIHFBEOGAEAOEHLEFNKODBEFGPGKNN\CURRENT related to MetaMask 1sW61HT2.exe trying to open a file %LOCALAPPDATA%\Microsoft\Edge\User Data\Edge Wallet\LOCAL EXTENSION SETTINGS\NKBIHFBEOGAEAOEHLEFNKODBEFGPGKNN\CURRENT related to MetaMask 1sW61HT2.exe trying to open a file %LOCALAPPDATA%\Microsoft\Edge\User Data\GrShaderCache\SYNC EXTENSION SETTINGS\NKBIHFBEOGAEAOEHLEFNKODBEFGPGKNN\CURRENT related to MetaMask 1sW61HT2.exe trying to open a file %LOCALAPPDATA%\Microsoft\Edge\User Data\GrShaderCache\LOCAL EXTENSION SETTINGS\NKBIHFBEOGAEAOEHLEFNKODBEFGPGKNN\CURRENT related to MetaMask 1sW61HT2.exe trying to open a file %LOCALAPPDATA%\Microsoft\Edge\User Data\hyphen-data\SYNC EXTENSION SETTINGS\NKBIHFBEOGAEAOEHLEFNKODBEFGPGKNN\CURRENT related to MetaMask 1sW61HT2.exe trying to open a file %LOCALAPPDATA%\Microsoft\Edge\User Data\hyphen-data\LOCAL EXTENSION SETTINGS\NKBIHFBEOGAEAOEHLEFNKODBEFGPGKNN\CURRENT related to MetaMask 1sW61HT2.exe trying to open a file %LOCALAPPDATA%\Microsoft\Edge\User Data\Nurturing\SYNC EXTENSION SETTINGS\NKBIHFBEOGAEAOEHLEFNKODBEFGPGKNN\CURRENT related to MetaMask 1sW61HT2.exe trying to open a file %LOCALAPPDATA%\Microsoft\Edge\User Data\Nurturing\LOCAL EXTENSION SETTINGS\NKBIHFBEOGAEAOEHLEFNKODBEFGPGKNN\CURRENT related to MetaMask 1sW61HT2.exe trying to open a file %LOCALAPPDATA%\Microsoft\Edge\User Data\OptimizationGuidePredictionModels\SYNC EXTENSION SETTINGS\NKBIHFBEOGAEAOEHLEFNKODBEFGPGKNN\CURRENT related to MetaMask 1sW61HT2.exe trying to open a file %LOCALAPPDATA%\Microsoft\Edge\User Data\OptimizationGuidePredictionModels\LOCAL EXTENSION SETTINGS\NKBIHFBEOGAEAOEHLEFNKODBEFGPGKNN\CURRENT related to MetaMask 1sW61HT2.exe trying to open a file %LOCALAPPDATA%\Microsoft\Edge\User Data\OriginTrials\SYNC EXTENSION SETTINGS\NKBIHFBEOGAEAOEHLEFNKODBEFGPGKNN\CURRENT related to MetaMask 1sW61HT2.exe trying to open a file %LOCALAPPDATA%\Microsoft\Edge\User Data\OriginTrials\LOCAL EXTENSION SETTINGS\NKBIHFBEOGAEAOEHLEFNKODBEFGPGKNN\CURRENT related to MetaMask 1sW61HT2.exe trying to open a file %LOCALAPPDATA%\Microsoft\Edge\User Data\RecoveryImproved\SYNC EXTENSION SETTINGS\NKBIHFBEOGAEAOEHLEFNKODBEFGPGKNN\CURRENT related to MetaMask 1sW61HT2.exe trying to open a file %LOCALAPPDATA%\Microsoft\Edge\User Data\RecoveryImproved\LOCAL EXTENSION SETTINGS\NKBIHFBEOGAEAOEHLEFNKODBEFGPGKNN\CURRENT related to MetaMask 1sW61HT2.exe trying to open a file %LOCALAPPDATA%\Microsoft\Edge\User Data\Safe Browsing\SYNC EXTENSION SETTINGS\NKBIHFBEOGAEAOEHLEFNKODBEFGPGKNN\CURRENT related to MetaMask 1sW61HT2.exe trying to open a file %LOCALAPPDATA%\Microsoft\Edge\User Data\Safe Browsing\LOCAL EXTENSION SETTINGS\NKBIHFBEOGAEAOEHLEFNKODBEFGPGKNN\CURRENT related to MetaMask 1sW61HT2.exe trying to open a file %LOCALAPPDATA%\Microsoft\Edge\User Data\SafetyTips\SYNC EXTENSION SETTINGS\NKBIHFBEOGAEAOEHLEFNKODBEFGPGKNN\CURRENT related to MetaMask 1sW61HT2.exe trying to open a file %LOCALAPPDATA%\Microsoft\Edge\User Data\SafetyTips\LOCAL EXTENSION SETTINGS\NKBIHFBEOGAEAOEHLEFNKODBEFGPGKNN\CURRENT related to MetaMask 1sW61HT2.exe trying to open a file %LOCALAPPDATA%\Microsoft\Edge\User Data\ShaderCache\SYNC EXTENSION SETTINGS\NKBIHFBEOGAEAOEHLEFNKODBEFGPGKNN\CURRENT related to MetaMask 1sW61HT2.exe trying to open a file %LOCALAPPDATA%\Microsoft\Edge\User Data\ShaderCache\LOCAL EXTENSION SETTINGS\NKBIHFBEOGAEAOEHLEFNKODBEFGPGKNN\CURRENT related to MetaMask 1sW61HT2.exe trying to open a file %LOCALAPPDATA%\Microsoft\Edge\User Data\SmartScreen\SYNC EXTENSION SETTINGS\NKBIHFBEOGAEAOEHLEFNKODBEFGPGKNN\CURRENT related to MetaMask 1sW61HT2.exe trying to open a file %LOCALAPPDATA%\Microsoft\Edge\User Data\SmartScreen\LOCAL EXTENSION SETTINGS\NKBIHFBEOGAEAOEHLEFNKODBEFGPGKNN\CURRENT related to MetaMask 1sW61HT2.exe trying to open a file %LOCALAPPDATA%\Microsoft\Edge\User Data\Speech Recognition\SYNC EXTENSION SETTINGS\NKBIHFBEOGAEAOEHLEFNKODBEFGPGKNN\CURRENT related to MetaMask 1sW61HT2.exe trying to open a file %LOCALAPPDATA%\Microsoft\Edge\User Data\Speech Recognition\LOCAL EXTENSION SETTINGS\NKBIHFBEOGAEAOEHLEFNKODBEFGPGKNN\CURRENT related to MetaMask 1sW61HT2.exe trying to open a file %LOCALAPPDATA%\Microsoft\Edge\User Data\Subresource Filter\SYNC EXTENSION SETTINGS\NKBIHFBEOGAEAOEHLEFNKODBEFGPGKNN\CURRENT related to MetaMask 1sW61HT2.exe trying to open a file %LOCALAPPDATA%\Microsoft\Edge\User Data\Subresource Filter\LOCAL EXTENSION SETTINGS\NKBIHFBEOGAEAOEHLEFNKODBEFGPGKNN\CURRENT related to MetaMask 1sW61HT2.exe trying to open a file %LOCALAPPDATA%\Microsoft\Edge\User Data\Trust Protection Lists\SYNC EXTENSION SETTINGS\NKBIHFBEOGAEAOEHLEFNKODBEFGPGKNN\CURRENT related to MetaMask 1sW61HT2.exe trying to open a file %LOCALAPPDATA%\Microsoft\Edge\User Data\Trust Protection Lists\LOCAL EXTENSION SETTINGS\NKBIHFBEOGAEAOEHLEFNKODBEFGPGKNN\CURRENT related to MetaMask6c:T53d,Spawned process "d94fc8dcbc9e403657f9323967855f59.exe" (UID: 00000000-00007632) Spawned process "cZ2SE56.exe" (UID: 00000000-00004452) Spawned process "nO2Ue30.exe" (UID: 00000000-00007244) Spawned process "zW9af77.exe" (UID: 00000000-00007692) Spawned process "1sW61HT2.exe" (UID: 00000000-00007568) Spawned process "schtasks.exe" with commandline "schtasks /create /f /RU "%OSUSER%" /tr "%ALLUSERSPROFILE%\\OfficeTrackerNMP131\\OfficeTrackerNMP131.exe" /tn "OfficeTrackerNMP131 HR" /sc HOURLY /rl HIGHEST" (UID: 00000000-00007596) Spawned process "schtasks.exe" with commandline "schtasks /create /f /RU "%OSUSER%" /tr "%ALLUSERSPROFILE%\\OfficeTrackerNMP131\\OfficeTrackerNMP131.exe" /tn "OfficeTrackerNMP131 LG" /sc ONLOGON /rl HIGHEST" (UID: 00000000-00007768) Spawned process "WerFault.exe" with commandline "-pss -s 460 -p 7568 -ip 7568" (UID: 00000000-00005532) Spawned process "WerFault.exe" with commandline "-u -p 7568 -s 2028" (UID: 00000000-00003732) Spawned process "2IW9992.exe" (UID: 00000000-00006544) Spawned process "AppLaunch.exe" (UID: 00000000-00004224) Spawned process "3up60Ma.exe" (UID: 00000000-00001476) Spawned process "WerFault.exe" with commandline "-pss -s 392 -p 7420 -ip 7420" (UID: 00000000-00000204) Spawned process "WerFault.exe" with commandline "-u -p 7420 -s 1740" (UID: 00000000-00005724)6d:T562a,Contains base64 string in header "Keep" in header "GET /geoip/v2.1/city/me HTTP/1.1Connection: Keep-AliveReferer: https://www.maxmind.com/en/locate-my-ip-addressUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: www.maxmind.com" Contains base64 string in header "AliveReferer" in header "GET /geoip/v2.1/city/me HTTP/1.1Connection: Keep-AliveReferer: https://www.maxmind.com/en/locate-my-ip-addressUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: www.maxmind.com" Contains base64 string in header "like" in header "GET /geoip/v2.1/city/me HTTP/1.1Connection: Keep-AliveReferer: https://www.maxmind.com/en/locate-my-ip-addressUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: www.maxmind.com" Contains base64 string in header "/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEATh56TcXPLzbcArQrhdFZ8" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEATh56TcXPLzbcArQrhdFZ8%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "Keep" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEATh56TcXPLzbcArQrhdFZ8%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "User" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEATh56TcXPLzbcArQrhdFZ8%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "ocsp" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEATh56TcXPLzbcArQrhdFZ8%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "digicert" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEATh56TcXPLzbcArQrhdFZ8%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP" in header "GET /gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "2FUsCEHe9DWzbNvka6iEPxPBY0w0" in header "GET /gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "Keep" in header "GET /gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "User" in header "GET /gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "ocsp" in header "GET /gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "goog" in header "GET /gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "Keep" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "User" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "ocsp" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "digicert" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "2Bsl" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTPJvUY%2Bsl%2Bj4yzQuAcL2oQno5fCgQUUWj%2FkK8CB3U8zNllZGKiErhZcjsCEAMcx1gUksFzIhtJYk5T2cw%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "Keep" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTPJvUY%2Bsl%2Bj4yzQuAcL2oQno5fCgQUUWj%2FkK8CB3U8zNllZGKiErhZcjsCEAMcx1gUksFzIhtJYk5T2cw%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "User" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTPJvUY%2Bsl%2Bj4yzQuAcL2oQno5fCgQUUWj%2FkK8CB3U8zNllZGKiErhZcjsCEAMcx1gUksFzIhtJYk5T2cw%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "ocsp" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTPJvUY%2Bsl%2Bj4yzQuAcL2oQno5fCgQUUWj%2FkK8CB3U8zNllZGKiErhZcjsCEAMcx1gUksFzIhtJYk5T2cw%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "digicert" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTPJvUY%2Bsl%2Bj4yzQuAcL2oQno5fCgQUUWj%2FkK8CB3U8zNllZGKiErhZcjsCEAMcx1gUksFzIhtJYk5T2cw%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "Keep" in header "GET /gtsr1/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBQwkcLWD4LqGJ7bE7B1XZsEbmfwUAQU5K8rJnEaK0gnhS9SZizv8IkTcT4CDQIDvFNZazTHGPUBUGY%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "User" in header "GET /gtsr1/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBQwkcLWD4LqGJ7bE7B1XZsEbmfwUAQU5K8rJnEaK0gnhS9SZizv8IkTcT4CDQIDvFNZazTHGPUBUGY%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "ocsp" in header "GET /gtsr1/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBQwkcLWD4LqGJ7bE7B1XZsEbmfwUAQU5K8rJnEaK0gnhS9SZizv8IkTcT4CDQIDvFNZazTHGPUBUGY%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "goog" in header "GET /gtsr1/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBQwkcLWD4LqGJ7bE7B1XZsEbmfwUAQU5K8rJnEaK0gnhS9SZizv8IkTcT4CDQIDvFNZazTHGPUBUGY%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "Keep" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEAx5qUSwjBGVIJJhX%2BJrHYM%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "User" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEAx5qUSwjBGVIJJhX%2BJrHYM%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "ocsp" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEAx5qUSwjBGVIJJhX%2BJrHYM%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "digicert" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEAx5qUSwjBGVIJJhX%2BJrHYM%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "Keep" in header "GET /gts1c3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEFYyRZRleaQREjdgJW3R1jM%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "User" in header "GET /gts1c3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEFYyRZRleaQREjdgJW3R1jM%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "ocsp" in header "GET /gts1c3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEFYyRZRleaQREjdgJW3R1jM%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "goog" in header "GET /gts1c3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEFYyRZRleaQREjdgJW3R1jM%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "Keep" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAbY2QTVWENG9oovp1QifsQ%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "User" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAbY2QTVWENG9oovp1QifsQ%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "ocsp" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAbY2QTVWENG9oovp1QifsQ%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "digicert" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAbY2QTVWENG9oovp1QifsQ%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "2Fr4XN7pXNPZzQ4kYU83E1HScCEQCVN9Jf3G" in header "GET /gts1c3/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEQCVN9Jf3G%2B1pAqd7QzTt1vx HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "Keep" in header "GET /gts1c3/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEQCVN9Jf3G%2B1pAqd7QzTt1vx HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "User" in header "GET /gts1c3/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEQCVN9Jf3G%2B1pAqd7QzTt1vx HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "ocsp" in header "GET /gts1c3/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEQCVN9Jf3G%2B1pAqd7QzTt1vx HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "goog" in header "GET /gts1c3/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEQCVN9Jf3G%2B1pAqd7QzTt1vx HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTk45WiKdPUwcMf8JgMC07ACYqr2AQUt2ui6qiqhIx56rTaD5iyxZV2ufQCEAqiBEK" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTk45WiKdPUwcMf8JgMC07ACYqr2AQUt2ui6qiqhIx56rTaD5iyxZV2ufQCEAqiBEK%2F1RSvcy4lL46SQ4M%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "Keep" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTk45WiKdPUwcMf8JgMC07ACYqr2AQUt2ui6qiqhIx56rTaD5iyxZV2ufQCEAqiBEK%2F1RSvcy4lL46SQ4M%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "User" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTk45WiKdPUwcMf8JgMC07ACYqr2AQUt2ui6qiqhIx56rTaD5iyxZV2ufQCEAqiBEK%2F1RSvcy4lL46SQ4M%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "ocsp" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTk45WiKdPUwcMf8JgMC07ACYqr2AQUt2ui6qiqhIx56rTaD5iyxZV2ufQCEAqiBEK%2F1RSvcy4lL46SQ4M%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "digicert" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTk45WiKdPUwcMf8JgMC07ACYqr2AQUt2ui6qiqhIx56rTaD5iyxZV2ufQCEAqiBEK%2F1RSvcy4lL46SQ4M%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "2Fr4XN7pXNPZzQ4kYU83E1HScCEQCVN9Jf3G" in header "GET /gts1c3/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEQCVN9Jf3G%2B1pAqd7QzTt1vx HTTP/1.1Cache-Control: max-age = 14400Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "Keep" in header "GET /gts1c3/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEQCVN9Jf3G%2B1pAqd7QzTt1vx HTTP/1.1Cache-Control: max-age = 14400Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "User" in header "GET /gts1c3/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEQCVN9Jf3G%2B1pAqd7QzTt1vx HTTP/1.1Cache-Control: max-age = 14400Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "ocsp" in header "GET /gts1c3/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEQCVN9Jf3G%2B1pAqd7QzTt1vx HTTP/1.1Cache-Control: max-age = 14400Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "goog" in header "GET /gts1c3/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEQCVN9Jf3G%2B1pAqd7QzTt1vx HTTP/1.1Cache-Control: max-age = 14400Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "Keep" in header "GET /gts1c3/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEQCLPpgizFvtXApe3cL6kC3u HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "User" in header "GET /gts1c3/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEQCLPpgizFvtXApe3cL6kC3u HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "ocsp" in header "GET /gts1c3/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEQCLPpgizFvtXApe3cL6kC3u HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "goog" in header "GET /gts1c3/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEQCLPpgizFvtXApe3cL6kC3u HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "Keep" in header "GET /gts1c3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEF2rtEA6xK7GEl4nbt8ZZfk%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "User" in header "GET /gts1c3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEF2rtEA6xK7GEl4nbt8ZZfk%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "ocsp" in header "GET /gts1c3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEF2rtEA6xK7GEl4nbt8ZZfk%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "goog" in header "GET /gts1c3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEF2rtEA6xK7GEl4nbt8ZZfk%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "2BrkS7QYXjzkCEAqvpsXKY8RRQeo74ffHUxc" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAqvpsXKY8RRQeo74ffHUxc%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "Keep" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAqvpsXKY8RRQeo74ffHUxc%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "User" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAqvpsXKY8RRQeo74ffHUxc%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "ocsp" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAqvpsXKY8RRQeo74ffHUxc%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "digicert" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAqvpsXKY8RRQeo74ffHUxc%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "Keep" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "User" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "ocsp" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "digicert" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "2BrkS7QYXjzkCEA177el9ggmWelJjG4vdGL0" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEA177el9ggmWelJjG4vdGL0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "Keep" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEA177el9ggmWelJjG4vdGL0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "User" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEA177el9ggmWelJjG4vdGL0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "ocsp" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEA177el9ggmWelJjG4vdGL0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "digicert" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEA177el9ggmWelJjG4vdGL0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com"6e:T536,"AppLaunch.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\WOW6432NODE\CLIENTS\STARTMENUINTERNET"; Key: ""; Value: "") "AppLaunch.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLIENTS\STARTMENUINTERNET"; Key: ""; Value: "") "AppLaunch.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLIENTS\STARTMENUINTERNET\FIREFOX-308046B0AF4A39CB"; Key: ""; Value: "") "AppLaunch.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLIENTS\STARTMENUINTERNET\FIREFOX-308046B0AF4A39CB"; Key: ""; Value: "") "AppLaunch.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLIENTS\STARTMENUINTERNET\FIREFOX-308046B0AF4A39CB\SHELL\OPEN\COMMAND"; Key: ""; Value: "") "AppLaunch.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLIENTS\STARTMENUINTERNET\FIREFOX-308046B0AF4A39CB\SHELL\OPEN\COMMAND"; Key: ""; Value: "") "AppLaunch.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLIENTS\STARTMENUINTERNET\IEXPLORE.EXE"; Key: ""; Value: "") "AppLaunch.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLIENTS\STARTMENUINTERNET\IEXPLORE.EXE"; Key: ""; Value: "") "AppLaunch.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLIENTS\STARTMENUINTERNET\IEXPLORE.EXE\SHELL\OPEN\COMMAND"; Key: ""; Value: "") "AppLaunch.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLIENTS\STARTMENUINTERNET\IEXPLORE.EXE\SHELL\OPEN\COMMAND"; Key: ""; Value: "")6f:T2dd5,"GET /geoip/v2.1/city/me HTTP/1.1 Connection: Keep-Alive Referer: https://www.maxmind.com/en/locate-my-ip-address User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Host: www.maxmind.com" Response ==> HTTP/1.1 403 Forbidden Date: Sun 26 Nov 2023 21:16:46 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 4519 Connection: keep-alive X-Frame-Options: SAMEORIGIN Referrer-Policy: same-origin Cache-Control: max-age=15 Expires: Sun 26 Nov 2023 21:17:01 GMT Server: cloudflare CF-RAY: 82c527869aac15d0-SJC with response body ==>3C21444F43545950452068746D6C3E0A3C212D2D5B6966206C7420494520375D3E203C68746D6C20636C6173733D226E6F2D6A7320696536206F6C6469652220....... "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEATh56TcXPLzbcArQrhdFZ8%3D HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.digicert.com" Response ==> HTTP/1.1 200 OK Accept-Ranges: bytes Age: 1831 Cache-Control: max-age=7200 Content-Type: application/ocsp-response Date: Sun 26 Nov 2023 21:17:19 GMT Last-Modified: Sun 26 Nov 2023 20:46:48 GMT Server: ECAcc (sac/254A) X-Cache: HIT Content-Length: 471 with response body ==>308201D30A0100A08201CC308201C806092B0601050507300101048201B9308201B530819EA2160414B13EC36903F8BF4701D498261A0802EF63642BC3180F32....... "GET /gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.pki.goog" Response ==> HTTP/1.1 200 OK Server: ocsp_responder Content-Length: 1445 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Date: Sun 26 Nov 2023 20:31:01 GMT Cache-Control: public max-age=14400 Content-Type: application/ocsp-response Age: 2778 with response body ==>308205A10A0100A082059A3082059606092B0601050507300101048205873082058330819EA2160414D49BADF2AB3CB9FF1A3E0C506DCF192780868DAA180F32....... "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.digicert.com" Response ==> HTTP/1.1 200 OK Accept-Ranges: bytes Age: 3858 Cache-Control: max-age=7200 Content-Type: application/ocsp-response Date: Sun 26 Nov 2023 21:17:19 GMT Last-Modified: Sun 26 Nov 2023 20:13:01 GMT Server: ECAcc (sac/2551) X-Cache: HIT Content-Length: 471 with response body ==>308201D30A0100A08201CC308201C806092B0601050507300101048201B9308201B530819EA216041403DE503556D14CBB66F0A3E21B1BC397B23DD155180F32....... "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTPJvUY%2Bsl%2Bj4yzQuAcL2oQno5fCgQUUWj%2FkK8CB3U8zNllZGKiErhZcjsCEAMcx1gUksFzIhtJYk5T2cw%3D HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.digicert.com" Response ==> HTTP/1.1 200 OK Accept-Ranges: bytes Age: 1143 Cache-Control: max-age=7200 Content-Type: application/ocsp-response Date: Sun 26 Nov 2023 21:17:20 GMT Last-Modified: Sun 26 Nov 2023 20:58:17 GMT Server: ECAcc (sac/2510) X-Cache: HIT Content-Length: 471 with response body ==>308201D30A0100A08201CC308201C806092B0601050507300101048201B9308201B530819EA21604145168FF90AF0207753CCCD9656462A212B859723B180F32....... "GET /gtsr1/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBQwkcLWD4LqGJ7bE7B1XZsEbmfwUAQU5K8rJnEaK0gnhS9SZizv8IkTcT4CDQIDvFNZazTHGPUBUGY%3D HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.pki.goog" Response ==> HTTP/1.1 200 OK Server: ocsp_responder Content-Length: 724 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Date: Sun 26 Nov 2023 20:30:13 GMT Cache-Control: public max-age=14400 Content-Type: application/ocsp-response Age: 2828 with response body ==>308202D00A0100A08202C9308202C506092B0601050507300101048202B6308202B230819BA2160414E4AF2B26711A2B4827852F52662CEFF08913713E180F32....... "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEAx5qUSwjBGVIJJhX%2BJrHYM%3D HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.digicert.com" Response ==> HTTP/1.1 200 OK Accept-Ranges: bytes Age: 1982 Cache-Control: max-age=7200 Content-Type: application/ocsp-response Date: Sun 26 Nov 2023 21:17:21 GMT Last-Modified: Sun 26 Nov 2023 20:44:19 GMT Server: ECAcc (sac/2507) X-Cache: HIT Content-Length: 471 with response body ==>308201D30A0100A08201CC308201C806092B0601050507300101048201B9308201B530819EA2160414B13EC36903F8BF4701D498261A0802EF63642BC3180F32....... "GET /gts1c3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEFYyRZRleaQREjdgJW3R1jM%3D HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.pki.goog" Response ==> HTTP/1.1 200 OK Server: ocsp_responder Content-Length: 471 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Date: Sun 26 Nov 2023 21:05:02 GMT Cache-Control: public max-age=14400 Content-Type: application/ocsp-response Age: 739 with response body ==>308201D30A0100A08201CC308201C806092B0601050507300101048201B9308201B530819EA21604148A747FAF85CDEE95CD3D9CD0E24614F371351D27180F32....... "GET /gts1c3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEFYyRZRleaQREjdgJW3R1jM%3D HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.pki.goog" Response ==> HTTP/1.1 200 OK Server: ocsp_responder Content-Length: 471 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Date: Sun 26 Nov 2023 21:05:02 GMT Cache-Control: public max-age=14400 Content-Type: application/ocsp-response Age: 740 with response body ==>308201D30A0100A08201CC308201C806092B0601050507300101048201B9308201B530819EA21604148A747FAF85CDEE95CD3D9CD0E24614F371351D27180F32....... "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAbY2QTVWENG9oovp1QifsQ%3D HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.digicert.com" Response ==> HTTP/1.1 200 OK Accept-Ranges: bytes Age: 839 Cache-Control: max-age=7200 Content-Type: application/ocsp-response Date: Sun 26 Nov 2023 21:17:24 GMT Last-Modified: Sun 26 Nov 2023 21:03:25 GMT Server: ECAcc (sac/254F) X-Cache: HIT Content-Length: 471 with response body ==>308201D30A0100A08201CC308201C806092B0601050507300101048201B9308201B530819EA216041403DE503556D14CBB66F0A3E21B1BC397B23DD155180F32....... "GET /gts1c3/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEQCVN9Jf3G%2B1pAqd7QzTt1vx HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.pki.goog" Response ==> HTTP/1.1 200 OK Server: ocsp_responder Content-Length: 472 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Date: Sun 26 Nov 2023 21:12:02 GMT Cache-Control: public max-age=14400 Content-Type: application/ocsp-response Age: 322 with response body ==>308201D40A0100A08201CD308201C906092B0601050507300101048201BA308201B630819FA21604148A747FAF85CDEE95CD3D9CD0E24614F371351D27180F32....... "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTk45WiKdPUwcMf8JgMC07ACYqr2AQUt2ui6qiqhIx56rTaD5iyxZV2ufQCEAqiBEK%2F1RSvcy4lL46SQ4M%3D HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.digicert.com" Response ==> HTTP/1.1 200 OK Accept-Ranges: bytes Age: 1320 Cache-Control: max-age=7200 Content-Type: application/ocsp-response Date: Sun 26 Nov 2023 21:17:25 GMT Last-Modified: Sun 26 Nov 2023 20:55:25 GMT Server: ECAcc (sac/253A) X-Cache: HIT Content-Length: 471 with response body ==>308201D30A0100A08201CC308201C806092B0601050507300101048201B9308201B530819EA2160414B76BA2EAA8AA848C79EAB4DA0F98B2C59576B9F4180F32....... "GET /gts1c3/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEQCVN9Jf3G%2B1pAqd7QzTt1vx HTTP/1.1 Cache-Control: max-age = 14400 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.pki.goog" Response ==> HTTP/1.1 200 OK Server: ocsp_responder Content-Length: 472 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Date: Sun 26 Nov 2023 21:12:02 GMT Cache-Control: public max-age=14400 Content-Type: application/ocsp-response Age: 323 with response body ==>308201D40A0100A08201CD308201C906092B0601050507300101048201BA308201B630819FA21604148A747FAF85CDEE95CD3D9CD0E24614F371351D27180F32....... "GET /gts1c3/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEQCLPpgizFvtXApe3cL6kC3u HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.pki.goog" Response ==> HTTP/1.1 200 OK Server: ocsp_responder Content-Length: 472 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Date: Sun 26 Nov 2023 20:53:16 GMT Cache-Control: public max-age=14400 Content-Type: application/ocsp-response Age: 1456 with response body ==>308201D40A0100A08201CD308201C906092B0601050507300101048201BA308201B630819FA21604148A747FAF85CDEE95CD3D9CD0E24614F371351D27180F32....... "GET /gts1c3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEF2rtEA6xK7GEl4nbt8ZZfk%3D HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.pki.goog" Response ==> HTTP/1.1 200 OK Server: ocsp_responder Content-Length: 471 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Date: Sun 26 Nov 2023 21:16:02 GMT Cache-Control: public max-age=14400 Content-Type: application/ocsp-response Age: 90 with response body ==>308201D30A0100A08201CC308201C806092B0601050507300101048201B9308201B530819EA21604148A747FAF85CDEE95CD3D9CD0E24614F371351D27180F32....... "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAqvpsXKY8RRQeo74ffHUxc%3D HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.digicert.com" Response ==> HTTP/1.1 200 OK Accept-Ranges: bytes Age: 5505 Cache-Control: max-age=7200 Content-Type: application/ocsp-response Date: Sun 26 Nov 2023 21:18:11 GMT Last-Modified: Sun 26 Nov 2023 19:46:26 GMT Server: ECAcc (sac/252C) X-Cache: HIT Content-Length: 471 with response body ==>308201D30A0100A08201CC308201C806092B0601050507300101048201B9308201B530819EA21604144E2254201895E6E36EE60FFAFAB912ED06178F39180F32....... "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.digicert.com" Response ==> HTTP/1.1 200 OK Accept-Ranges: bytes Age: 6430 Cache-Control: max-age=7200 Content-Type: application/ocsp-response Date: Sun 26 Nov 2023 21:18:11 GMT Last-Modified: Sun 26 Nov 2023 19:31:01 GMT Server: ECAcc (sac/2561) X-Cache: HIT Content-Length: 471 with response body ==>308201D30A0100A08201CC308201C806092B0601050507300101048201B9308201B530819EA21604144E2254201895E6E36EE60FFAFAB912ED06178F39180F32....... "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEA177el9ggmWelJjG4vdGL0%3D HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.digicert.com" Response ==> HTTP/1.1 200 OK Accept-Ranges: bytes Age: 1884 Cache-Control: max-age=7200 Content-Type: application/ocsp-response Date: Sun 26 Nov 2023 21:18:12 GMT Last-Modified: Sun 26 Nov 2023 20:46:48 GMT Server: ECAcc (sac/254A) X-Cache: HIT Content-Length: 471 with response body ==>308201D30A0100A08201CC308201C806092B0601050507300101048201B9308201B530819EA21604144E2254201895E6E36EE60FFAFAB912ED06178F39180F32.......70:T520,Found string "" (Indicator: "text/javascript"; File: "18RMD28J.htm") Found string "" (Indicator: "text/javascript"; File: "18RMD28J.htm") Found string "" (Indicator: "text/javascript"; File: "18RMD28J.htm") Found string "" (Indicator: "text/javascript"; File: "18RMD28J.htm")71:T681,"schtasks.exe" (Access type: "OPEN"; Path: "HKCU\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}"; Key: ""; Value: "") "schtasks.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}"; Key: ""; Value: "") "schtasks.exe" (Access type: "OPEN"; Path: "HKCU\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\TREATAS"; Key: ""; Value: "") "schtasks.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\TREATAS"; Key: ""; Value: "") "schtasks.exe" (Access type: "OPEN"; Path: "HKCU\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\PROGID"; Key: ""; Value: "") "schtasks.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\PROGID"; Key: ""; Value: "") "schtasks.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\PROGID"; Key: ""; Value: "") "schtasks.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}"; Key: ""; Value: "") "schtasks.exe" (Access type: "OPEN"; Path: "HKCU\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\INPROCSERVER32"; Key: ""; Value: "") "schtasks.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\INPROCSERVER32"; Key: ""; Value: "") "schtasks.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\INPROCSERVER32"; Key: "INPROCSERVER32"; Value: "") "schtasks.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\INPROCSERVER32"; Key: ""; Value: "")72:T985,Found http requests in header "GET /geoip/v2.1/city/me" Found http requests in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEATh56TcXPLzbcArQrhdFZ8%3D" Found http requests in header "GET /gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D" Found http requests in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D" Found http requests in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTPJvUY%2Bsl%2Bj4yzQuAcL2oQno5fCgQUUWj%2FkK8CB3U8zNllZGKiErhZcjsCEAMcx1gUksFzIhtJYk5T2cw%3D" Found http requests in header "GET /gtsr1/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBQwkcLWD4LqGJ7bE7B1XZsEbmfwUAQU5K8rJnEaK0gnhS9SZizv8IkTcT4CDQIDvFNZazTHGPUBUGY%3D" Found http requests in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEAx5qUSwjBGVIJJhX%2BJrHYM%3D" Found http requests in header "GET /gts1c3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEFYyRZRleaQREjdgJW3R1jM%3D" Found http requests in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAbY2QTVWENG9oovp1QifsQ%3D" Found http requests in header "GET /gts1c3/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEQCVN9Jf3G%2B1pAqd7QzTt1vx" Found http requests in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTk45WiKdPUwcMf8JgMC07ACYqr2AQUt2ui6qiqhIx56rTaD5iyxZV2ufQCEAqiBEK%2F1RSvcy4lL46SQ4M%3D" Found http requests in header "GET /gts1c3/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEQCLPpgizFvtXApe3cL6kC3u" Found http requests in header "GET /gts1c3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEF2rtEA6xK7GEl4nbt8ZZfk%3D" Found http requests in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAqvpsXKY8RRQeo74ffHUxc%3D" Found http requests in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D" Found http requests in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEA177el9ggmWelJjG4vdGL0%3D"73:T36d7,Found requests in header "GET /demo/home.php?s=67.218.111.202 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: db-ip.com"; in File: "SSL") Found requests in header "GET / HTTP/1.1Accept: text/html, application/xhtml+xml, */*Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: accounts.google.comDNT: 1Connection: Keep-Alive"; in File: "SSL") Found requests in header "GET /ServiceLogin?passive=1209600&continue=https%3A%2F%2Faccounts.google.com%2F&followup=https%3A%2F%2Faccounts.google.com%2F HTTP/1.1Accept: text/html, application/xhtml+xml, */*Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: accounts.google.comCookie: __Host-GAPS=1:tM6x96CxLt713SUzlFSl0XNgC4mbTg:dkTScDkpo_ggYMbOConnection: Keep-AliveDNT: 1"; in File: "SSL") Found requests in header "GET /InteractiveLogin?continue=https://accounts.google.com/&followup=https://accounts.google.com/&passive=1209600&ifkv=ASKXGp0kziTOuavbBfPd22VCPBRjbAXHzRFKfPAeYzL--HvKI9iJ39QZqDvRhOuCiwhuWFjkQnUy HTTP/1.1Accept: text/html, application/xhtml+xml, */*Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: accounts.google.comConnection: Keep-AliveDNT: 1Cookie: __Host-GAPS=1:ciPKJkJE4ytHxLjG7K0K3z5Ze1_CwQ:a1aIQm3pIgeC6-gQ"; in File: "SSL") Found requests in header "GET /v3/signin/identifier?continue=https%3A%2F%2Faccounts.google.com%2F&followup=https%3A%2F%2Faccounts.google.com%2F&ifkv=ASKXGp1z_7FfMNCPOqYUA_75aNk-hZgXIy-VXyF3nQ2smxA2pFd3Pl61owiDsqntpv-rmE48D7xLWg&passive=1209600&flowName=GlifWebSignIn&flowEntry=ServiceLogin&dsh=S-435913608%3A1701033442285146&theme=glif HTTP/1.1Accept: text/html, application/xhtml+xml, */*Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: accounts.google.comDNT: 1Connection: Keep-AliveCookie: __Host-GAPS=1:ciPKJkJE4ytHxLjG7K0K3z5Ze1_CwQ:a1aIQm3pIgeC6-gQ"; in File: "SSL") Found requests in header "GET /ServiceLogin?passive=1209600&continue=https%3A%2F%2Faccounts.google.com%2F&followup=https%3A%2F%2Faccounts.google.com%2F HTTP/1.1Accept: text/html, application/xhtml+xml, */*Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: accounts.google.comCookie: __Host-GAPS=1:ciPKJkJE4ytHxLjG7K0K3z5Ze1_CwQ:a1aIQm3pIgeC6-gQConnection: Keep-AliveDNT: 1"; in File: "SSL") Found requests in header "GET /InteractiveLogin?continue=https://accounts.google.com/&followup=https://accounts.google.com/&passive=1209600&ifkv=ASKXGp0My2UCWuQxs5cBv8gUiZ8Qy4quuUVxumPJTM8H7rvaoz86etCUlWQ-0eva0hlBmiDhhsV6 HTTP/1.1Accept: text/html, application/xhtml+xml, */*Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: accounts.google.comConnection: Keep-AliveDNT: 1Cookie: __Host-GAPS=1:ciPKJkJE4ytHxLjG7K0K3z5Ze1_CwQ:a1aIQm3pIgeC6-gQ"; in File: "SSL") Found requests in header "GET /v3/signin/identifier?continue=https%3A%2F%2Faccounts.google.com%2F&followup=https%3A%2F%2Faccounts.google.com%2F&ifkv=ASKXGp2hxmkfcC4bs_4Nu-8ZpBI_L2ztltJbK2MSd3lnHs9VyiC4EDUy839y2oN-9TZOxtgnnqgFdw&passive=1209600&flowName=GlifWebSignIn&flowEntry=ServiceLogin&dsh=S-888744053%3A1701033442301795&theme=glif HTTP/1.1Accept: text/html, application/xhtml+xml, */*Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: accounts.google.comDNT: 1Connection: Keep-AliveCookie: __Host-GAPS=1:ciPKJkJE4ytHxLjG7K0K3z5Ze1_CwQ:a1aIQm3pIgeC6-gQ"; in File: "SSL") Found requests in header "GET /favicon.ico HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoHost: accounts.google.comDNT: 1Connection: Keep-AliveCookie: __Host-GAPS=1:ciPKJkJE4ytHxLjG7K0K3z5Ze1_CwQ:a1aIQm3pIgeC6-gQ"; in File: "SSL") Found requests in header "GET /_/bscframe HTTP/1.1Accept: text/html, application/xhtml+xml, */*Referer: https://accounts.google.com/Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: accounts.google.comDNT: 1Connection: Keep-AliveCookie: __Host-GAPS=1:ciPKJkJE4ytHxLjG7K0K3z5Ze1_CwQ:a1aIQm3pIgeC6-gQ"; in File: "SSL") Found requests in header "POST /v3/signin/_/AccountsSignInUi/data/batchexecute?rpcids=UEkKwb&source-path=%2Fv3%2Fsignin%2Fidentifier&f.sid=5290376564073320786&bl=boq_identityfrontendauthuiserver_20231112.08_p0&hl=en-US&_reqid=78335&rt=c HTTP/1.1Accept: */*X-Same-Domain: 1x-goog-ext-278367001-jspb: ["GlifWebSignIn"]x-goog-ext-391502476-jspb: ["S-888744053:1701033442301795",null,null,"ASKXGp2hxmkfcC4bs_4Nu-8ZpBI_L2ztltJbK2MSd3lnHs9VyiC4EDUy839y2oN-9TZOxtgnnqgFdw"]Content-Type: application/x-www-form-urlencoded;charset=utf-8Referer: https://accounts.google.com/Accept-Language: en-USAccept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoHost: accounts.google.comContent-Length: 165DNT: 1Connection: Keep-AliveCache-Control: no-cacheCookie: __Host-GAPS=1:ciPKJkJE4ytHxLjG7K0K3z5Ze1_CwQ:a1aIQm3pIgeC6-gQ"; in File: "SSL") Found requests in header "GET /generate_204?HJzCBg HTTP/1.1Accept: image/png, image/svg+xml, image/*;q=0.8, */*;q=0.5Referer: https://accounts.google.com/Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: accounts.google.comDNT: 1Connection: Keep-AliveCookie: __Host-GAPS=1:xMvz9xHWukSIl07k_1U7Y9IxAke9Zw:QZR6tiXKpZj-7ep-"; in File: "SSL") Found requests in header "POST /v3/signin/_/AccountsSignInUi/data/batchexecute?rpcids=UEkKwb&source-path=%2Fv3%2Fsignin%2Fidentifier&f.sid=8271543346345158565&bl=boq_identityfrontendauthuiserver_20231112.08_p0&hl=en-US&_reqid=78337&rt=c HTTP/1.1Accept: */*X-Same-Domain: 1x-goog-ext-278367001-jspb: ["GlifWebSignIn"]x-goog-ext-391502476-jspb: ["S-435913608:1701033442285146",null,null,"ASKXGp1z_7FfMNCPOqYUA_75aNk-hZgXIy-VXyF3nQ2smxA2pFd3Pl61owiDsqntpv-rmE48D7xLWg"]Content-Type: application/x-www-form-urlencoded;charset=utf-8Referer: https://accounts.google.com/Accept-Language: en-USAccept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoHost: accounts.google.comContent-Length: 165DNT: 1Connection: Keep-AliveCache-Control: no-cacheCookie: __Host-GAPS=1:xMvz9xHWukSIl07k_1U7Y9IxAke9Zw:QZR6tiXKpZj-7ep-; OTZ=7312126_52_52_123900_48_436380"; in File: "SSL") Found requests in header "GET /_/bscframe HTTP/1.1Accept: text/html, application/xhtml+xml, */*Referer: https://accounts.google.com/Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: accounts.google.comDNT: 1Connection: Keep-AliveCookie: __Host-GAPS=1:xMvz9xHWukSIl07k_1U7Y9IxAke9Zw:QZR6tiXKpZj-7ep-; OTZ=7312126_52_52_123900_48_436380"; in File: "SSL") Found requests in header "GET /generate_204?KHgIgw HTTP/1.1Accept: image/png, image/svg+xml, image/*;q=0.8, */*;q=0.5Referer: https://accounts.google.com/Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: accounts.google.comDNT: 1Connection: Keep-AliveCookie: __Host-GAPS=1:RnWwjO17XcHjHAvH3GXl3XE1kUPl9w:LyC3jFUwsUHaORpE; OTZ=7312126_52_52_123900_48_436380"; in File: "SSL") Found requests in header "GET /v3/signin/_/AccountsSignInUi/gen204/?tmambps=0.00030989010989010987&rtembps=-1&rttms=1 HTTP/1.1Accept: image/png, image/svg+xml, image/*;q=0.8, */*;q=0.5Referer: https://accounts.google.com/Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: accounts.google.comDNT: 1Connection: Keep-AliveCookie: __Host-GAPS=1:RnWwjO17XcHjHAvH3GXl3XE1kUPl9w:LyC3jFUwsUHaORpE; OTZ=7312126_52_52_123900_48_436380; NID=511=JAjf71rSPLOOFfKo1BJI1hSZOrFGVtCj2k34klDlHBHJ9M_wd0b7qBCowZPNIVtFmir8-h39L-1DYUHrp5HHkRzzkGTWMecXUZ9bXiT5r_fU-KETYn791ec_N0DtCIYRytI88CiyFZ92D3LFwarSn9OsTFaLsYwh8Qb_dim8-s4"; in File: "SSL") Found requests in header "GET /v3/signin/_/AccountsSignInUi/gen204/?tmambps=0.00007032418952618453&rtembps=-1&rttms=1 HTTP/1.1Accept: image/png, image/svg+xml, image/*;q=0.8, */*;q=0.5Referer: https://accounts.google.com/Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: accounts.google.comDNT: 1Connection: Keep-AliveCookie: __Host-GAPS=1:RnWwjO17XcHjHAvH3GXl3XE1kUPl9w:LyC3jFUwsUHaORpE; OTZ=7312126_52_52_123900_48_436380; NID=511=JAjf71rSPLOOFfKo1BJI1hSZOrFGVtCj2k34klDlHBHJ9M_wd0b7qBCowZPNIVtFmir8-h39L-1DYUHrp5HHkRzzkGTWMecXUZ9bXiT5r_fU-KETYn791ec_N0DtCIYRytI88CiyFZ92D3LFwarSn9OsTFaLsYwh8Qb_dim8-s4"; in File: "SSL") Found requests in header "GET /s/roboto/v18/KFOlCnqEu92Fr1MmEU9fBBc-.woff HTTP/1.1Accept: */*Referer: https://accounts.google.com/Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoOrigin: https://accounts.google.comAccept-Encoding: gzip, deflateHost: fonts.gstatic.comDNT: 1Connection: Keep-Alive"; in File: "SSL") Found requests in header "GET /s/googlesans/v14/4UabrENHsxJlGDuGo1OIlLU94YtzCwA.woff HTTP/1.1Accept: */*Referer: https://accounts.google.com/Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoOrigin: https://accounts.google.comAccept-Encoding: gzip, deflateHost: fonts.gstatic.comDNT: 1Connection: Keep-Alive"; in File: "SSL") Found requests in header "GET /s/googlesans/v14/4UaGrENHsxJlGDuGo1OIlL3Owpg.woff HTTP/1.1Accept: */*Referer: https://accounts.google.com/Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoOrigin: https://accounts.google.comAccept-Encoding: gzip, deflateHost: fonts.gstatic.comDNT: 1Connection: Keep-Alive"; in File: "SSL") Found requests in header "GET /login HTTP/1.1Accept: text/html, application/xhtml+xml, */*Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: store.steampowered.comDNT: 1Connection: Keep-Alive"; in File: "SSL") Found requests in header "GET /favicon.ico HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoHost: store.steampowered.comDNT: 1Connection: Keep-AliveCookie: steamCountry=US%7Cd5203a3b374fc04fbcd23a13412805b3; browserid=3144137444205573835; sessionid=76d73d62dc41d80f678bd353"; in File: "SSL") Found requests in header "GET /_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en_US.bymDw_vyWXs.es5.O/am=nwgrInNsAMT_hybP3zNODgMAAAAAAAAAAKyB2AE/d=1/excm=_b,_tp,identifierview/ed=1/dg=0/wt=2/ujg=1/rs=AOaEmlGAYUntlQTiAveD0tbPdJWB64HfLA/m=_b,_tp HTTP/1.1Accept: application/javascript, */*;q=0.8Referer: https://accounts.google.com/Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: www.gstatic.comDNT: 1Connection: Keep-Alive"; in File: "SSL") Found requests in header "GET /_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en_US.bymDw_vyWXs.es5.O/ck=boq-identity.AccountsSignInUi.FalVefT2r2I.L.I11.O/am=nwgrInNsAMT_hybP3zNODgMAAAAAAAAAAKyB2AE/d=1/exm=_b,_tp/excm=_b,_tp,identifierview/ed=1/wt=2/ujg=1/rs=AOaEmlG0f8dGfbJbnOjyzQfw8vYK0ipZJw/ee=ASJRFf:LANRae;Al0B8:kibjWe;DaIJ8c:iAskyc;EVNhjf:pw70Gc;EkYFhd:BDnJmb;EmZ2Bf:zr1jrb;Erl4fe:FloWmf;JsbNhc:Xd8iUd;LBgRLc:XVMNvd;Me32dd:MEeYgc;NPKaK:PVlQOd;NSEoX:lazG7b;Oj465e:KG2eXe;Pjplud:EEDORb;QGR0gd:Mlhmy;SMDL4c:K0PMbc;SNUn3:ZwDk9d;UpnZUd:nnwwYc;XdiAjb:NLiXbe;a56pNe:JEfCwb;cEt90b:ws9Tlc;dIoSBb:SpsfSb;eBAeSb:zbML3c;iFQyKf:vfuNJf;io8t5d:yDVVkb;kMFpHd:OTA3Ae;nAFL3:NTMZac;nTuGK:JKNPM;oGtAuc:sOXFj;oSUNyd:K0PMbc;oXZmbc:tUnxGc;pXdRYb:fqEYIb;qddgKe:xQtZb;sP4Vbe:VwDzFe;uY49fb:COQbmf;ul9GGd:VDovNc;vNjB7d:YTxL4;wR5FRb:siKnQd;yxTchf:KUM7Z/m=byfTOb,lsjVmc,LEikZe HTTP/1.1Accept: application/javascript, */*;q=0.8Referer: https://accounts.google.com/Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: www.gstatic.comDNT: 1Connection: Keep-Alive"; in File: "SSL") Found requests in header "GET /_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en_US.bymDw_vyWXs.es5.O/ck=boq-identity.AccountsSignInUi.FalVefT2r2I.L.I11.O/am=nwgrInNsAMT_hybP3zNODgMAAAAAAAAAAKyB2AE/d=1/exm=LEikZe,_b,_tp,byfTOb,lsjVmc/excm=_b,_tp,identifierview/ed=1/wt=2/ujg=1/rs=AOaEmlG0f8dGfbJbnOjyzQfw8vYK0ipZJw/ee=ASJRFf:LANRae;Al0B8:kibjWe;DaIJ8c:iAskyc;EVNhjf:pw70Gc;EkYFhd:BDnJmb;EmZ2Bf:zr1jrb;Erl4fe:FloWmf;JsbNhc:Xd8iUd;LBgRLc:XVMNvd;Me32dd:MEeYgc;NPKaK:PVlQOd;NSEoX:lazG7b;Oj465e:KG2eXe;Pjplud:EEDORb;QGR0gd:Mlhmy;SMDL4c:K0PMbc;SNUn3:ZwDk9d;UpnZUd:nnwwYc;XdiAjb:NLiXbe;a56pNe:JEfCwb;cEt90b:ws9Tlc;dIoSBb:SpsfSb;eBAeSb:zbML3c;iFQyKf:vfuNJf;io8t5d:yDVVkb;kMFpHd:OTA3Ae;nAFL3:NTMZac;nTuGK:JKNPM;oGtAuc:sOXFj;oSUNyd:K0PMbc;oXZmbc:tUnxGc;pXdRYb:fqEYIb;qddgKe:xQtZb;sP4Vbe:VwDzFe;uY49fb:COQbmf;ul9GGd:VDovNc;vNjB7d:YTxL4;wR5FRb:siKnQd;yxTchf:KUM7Z/m=n73qwf,SCuOPb,IZT63,vfuNJf,UUJqVe,ws9Tlc,siKnQd,STuCOe,njlZCf,fJpY1b,b3kMqb,EGw7Od,ZUKRxc,my67ye,t2srLd,EN3i8d,hmHrle,mWLH9d,NOeYWe,O6y8ed,fqEYIb,PrPYRd,MpJwZc,hc6Ubd,KUM7Z,oLggrd,inNHtf,L1AAkb,lwddkf,SpsfSb,tUnxGc,aW3pY,EFQ78c,xQtZb,I6YDgd,zbML3c,zr1jrb,vHEMJe,YHI3We,YTxL4,bSspM,Uas9Hd,zy0vNb,K0PMbc,AvtSve,qmdT9,xBaz7b,eVCnO,LDQI HTTP/1.1Accept: application/javascript, */*;q=0.8Referer: https://accounts.google.com/Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: www.gstatic.comDNT: 1Connection: Keep-Alive"; in File: "SSL")74:T835b,"GET /demo/home.php?s=67.218.111.202 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: db-ip.com" "HTTP/1.1 200 OKDate: Sun, 26 Nov 2023 21:16:46 GMTContent-Type: application/jsonTransfer-Encoding: chunkedConnection: keep-alivex-iplb-request-id: AC451728:7D60_93878F2E:0050_6563B5BE_216B9B4:0401x-iplb-instance: 30783CF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=LqvjSo83aeJjoOhA6amxRiAipcbT8wF4F9ALVTW7XzpMU0nvr1NBEnM0Vz4fMhu8Wmmn9HyniDyjolrmbCv2Tl7e%2FAHoUWd0SQuBjeMAOzZhDHJW8DK9zwt2Ag%3D%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 82c527858f709435-SJCalt-svc: h3=":443"; ma=864004f{"status":"ok","demoInfo":{"error":"over query limit please try again later"}}" "GET / HTTP/1.1Accept: text/html, application/xhtml+xml, */*Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: accounts.google.comDNT: 1Connection: Keep-Alive" "HTTP/1.1 302 Moved TemporarilyContent-Type: text/html; charset=UTF-8Strict-Transport-Security: max-age=31536000; includeSubDomainsSet-Cookie: __Host-GAPS=1:tM6x96CxLt713SUzlFSl0XNgC4mbTg:dkTScDkpo_ggYMbO;Path=/;Expires=Tue, 25-Nov-2025 21:17:22 GMT;Secure;HttpOnly;Priority=HIGHX-Frame-Options: DENYContent-Security-Policy: script-src 'nonce-mHpqGfGGMQf0-7gz8ijotg' 'unsafe-inline' 'unsafe-eval';object-src 'none';base-uri 'self';report-uri /cspreportLocation: https://accounts.google.com/ServiceLogin?passive=1209600&continue=https%3A%2F%2Faccounts.google.com%2F&followup=https%3A%2F%2Faccounts.google.com%2FContent-Encoding: gzipDate: Sun, 26 Nov 2023 21:17:22 GMTExpires: Sun, 26 Nov 2023 21:17:22 GMTCache-Control: private, max-age=0X-Content-Type-Options: nosniffX-XSS-Protection: 1; mode=blockServer: GSEAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Transfer-Encoding: chunked" "HTTP/1.1 302 Moved TemporarilyContent-Type: text/html; charset=UTF-8Strict-Transport-Security: max-age=31536000; includeSubDomainsSet-Cookie: __Host-GAPS=1:ciPKJkJE4ytHxLjG7K0K3z5Ze1_CwQ:a1aIQm3pIgeC6-gQ;Path=/;Expires=Tue, 25-Nov-2025 21:17:22 GMT;Secure;HttpOnly;Priority=HIGHX-Frame-Options: DENYContent-Security-Policy: script-src 'nonce-M-ucj2ro0nPa-goBwnrxfQ' 'unsafe-inline' 'unsafe-eval';object-src 'none';base-uri 'self';report-uri /cspreportLocation: https://accounts.google.com/ServiceLogin?passive=1209600&continue=https%3A%2F%2Faccounts.google.com%2F&followup=https%3A%2F%2Faccounts.google.com%2FContent-Encoding: gzipDate: Sun, 26 Nov 2023 21:17:22 GMTExpires: Sun, 26 Nov 2023 21:17:22 GMTCache-Control: private, max-age=0X-Content-Type-Options: nosniffX-XSS-Protection: 1; mode=blockServer: GSEAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Transfer-Encoding: chunked" "GET /ServiceLogin?passive=1209600&continue=https%3A%2F%2Faccounts.google.com%2F&followup=https%3A%2F%2Faccounts.google.com%2F HTTP/1.1Accept: text/html, application/xhtml+xml, */*Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: accounts.google.comCookie: __Host-GAPS=1:tM6x96CxLt713SUzlFSl0XNgC4mbTg:dkTScDkpo_ggYMbOConnection: Keep-AliveDNT: 1" "GET /InteractiveLogin?continue=https://accounts.google.com/&followup=https://accounts.google.com/&passive=1209600&ifkv=ASKXGp0kziTOuavbBfPd22VCPBRjbAXHzRFKfPAeYzL--HvKI9iJ39QZqDvRhOuCiwhuWFjkQnUy HTTP/1.1Accept: text/html, application/xhtml+xml, */*Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: accounts.google.comConnection: Keep-AliveDNT: 1Cookie: __Host-GAPS=1:ciPKJkJE4ytHxLjG7K0K3z5Ze1_CwQ:a1aIQm3pIgeC6-gQ" "GET /v3/signin/identifier?continue=https%3A%2F%2Faccounts.google.com%2F&followup=https%3A%2F%2Faccounts.google.com%2F&ifkv=ASKXGp1z_7FfMNCPOqYUA_75aNk-hZgXIy-VXyF3nQ2smxA2pFd3Pl61owiDsqntpv-rmE48D7xLWg&passive=1209600&flowName=GlifWebSignIn&flowEntry=ServiceLogin&dsh=S-435913608%3A1701033442285146&theme=glif HTTP/1.1Accept: text/html, application/xhtml+xml, */*Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: accounts.google.comDNT: 1Connection: Keep-AliveCookie: __Host-GAPS=1:ciPKJkJE4ytHxLjG7K0K3z5Ze1_CwQ:a1aIQm3pIgeC6-gQ" "GET /ServiceLogin?passive=1209600&continue=https%3A%2F%2Faccounts.google.com%2F&followup=https%3A%2F%2Faccounts.google.com%2F HTTP/1.1Accept: text/html, application/xhtml+xml, */*Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: accounts.google.comCookie: __Host-GAPS=1:ciPKJkJE4ytHxLjG7K0K3z5Ze1_CwQ:a1aIQm3pIgeC6-gQConnection: Keep-AliveDNT: 1" "GET /InteractiveLogin?continue=https://accounts.google.com/&followup=https://accounts.google.com/&passive=1209600&ifkv=ASKXGp0My2UCWuQxs5cBv8gUiZ8Qy4quuUVxumPJTM8H7rvaoz86etCUlWQ-0eva0hlBmiDhhsV6 HTTP/1.1Accept: text/html, application/xhtml+xml, */*Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: accounts.google.comConnection: Keep-AliveDNT: 1Cookie: __Host-GAPS=1:ciPKJkJE4ytHxLjG7K0K3z5Ze1_CwQ:a1aIQm3pIgeC6-gQ" "GET /v3/signin/identifier?continue=https%3A%2F%2Faccounts.google.com%2F&followup=https%3A%2F%2Faccounts.google.com%2F&ifkv=ASKXGp2hxmkfcC4bs_4Nu-8ZpBI_L2ztltJbK2MSd3lnHs9VyiC4EDUy839y2oN-9TZOxtgnnqgFdw&passive=1209600&flowName=GlifWebSignIn&flowEntry=ServiceLogin&dsh=S-888744053%3A1701033442301795&theme=glif HTTP/1.1Accept: text/html, application/xhtml+xml, */*Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: accounts.google.comDNT: 1Connection: Keep-AliveCookie: __Host-GAPS=1:ciPKJkJE4ytHxLjG7K0K3z5Ze1_CwQ:a1aIQm3pIgeC6-gQ" "000000010000001�1a25��=�w��ֿ�_��N��7b�-F�~Ϭ��k'��R(-[5��nU"�If�;o��Bխ[�nݽ��d��D��_��{� ҙ��lFR�VVu� t"^��m!��;�i766xQ4��c{��SQQ4��Qy�Vz��o�H9|F�5��@dY��fDCw���l�RL'#��(R+��Iٌn�"��j�\��ˁ��rt�ը��엱�KƸxw��]<<��L��&d�l!�k*ځ�mȼj�Bv�l�1��Bv_��K�\�R.Wj�J��֫�*��7�j?�?�P��h�|��C�F�q��{��K�b�(kN�7�-�x��O&�`5>C��K�Tl�O�C�/,��.��Yy��[\��&˱@~�T�W�J��ځ�2⪦>�@t�j0ZN��q*��\�(�B�ܴKLmh��a��h˵2๾�unaЧ��PU��*��V��,�\�>�g��{��;??��2��m��KI��R�D��&��X3��:��H�.'�@_I��J~ˣ~��7[��i��I��&�?��ח!��d�+�y��T�/&㭓?��d�CO!~��ݜ��J��+-�=y�=��jPx*�dj�'��+�$j��V��D��A�,�(�V}��F�\XS�L��i�\m?�;%y��{߿Y��+��ק�06E�5^�{Hs̘|��/cs�Z�o�X|@��Q(�M�P)�]��T(�9�ۓ�+��"a�3�-�2$l��%�T�8�Td�]��T�ej��B��c��u�R��,�Ď��E��AĔJYA��,��G�`��u$:��w(q3DU�+�p�0P��êG�B��߳W�"ED�+��Y�/��DȽj�t.��Wzm��]�3�(��<^�_*tb�ݻ1m�T)�g��ǎ{)X��{�t^P�{�:c�Ҵ�hvi�.=�#۳��k�}��@Y5\*��}�ڐ�kh��ɞ��;C5��p��cE�7�`�QR�d��7� C�E�e��ߔ��=ݱ&��)��!*�M��љ�Hg$��7�kok{<��OI�0�`��-<��O�P�F��ѵ+�`�^P �BW}^r7��H�кU_*4�r/��剠6TEu�{VGϔ^+?��]��-�ޥ�u�m�ɶǒ�l��0S��»�j�ΉME��-ǽp�a)��)PH��h�-��aR�m$zJb��!�[ս%J�^�Ȳ�`��;chycl��dR��:��C�/tC��\��λ6s�o@��%i$)�|yL1�9�9?{�v��nV", "��N��~Y�(��s�d�K�s��ce�~�s�X�^��ܹ�^"'��9I�z��YH4�O��[!��#��mN��c�&�Z�%��YB�_L�{��P�1�� @ h��pGB�Maf4а3�@��I<맑e`��i�h��%4��(�^��h��7��O��ŀ$��9��D�E4^��V�l!�\�/7ĉ{�"��ӟ��]G�e�΍��s�}�m��q�W�m��w��+ӱ��v��#Tj�Z�h"?1��χ��e��Zǰ7o��j{��9��o��w;L��F�\w4��+��꧗'$�=>�}��N��:�;�T/:�Oy�3��띋��]�c�_��˝h�]�6T�޵��Q��Ɗ��.޽�Dy�;�o��Wv�M��ڗ��Ŧm��6��I�I:f"�y9)��a�iܾ��H��/�i(��Ow�k�Z��9K*89y��姿m��K�ߚ��3|�xR�/��~�t�5��]p�H']��]G�PK��Y*��l�\B#psvU��W�,�h�M��L8�ľz��O>s�FNG��.�/��r�W��C��"�a��A~��k�;jP/�N�+�ad�]�oQ��=�&��,u��M��&4��6�b^��l��`��_��]��/�C��??}�n;0�0tP.K�v�%f��ۧ�6��e�m�Z�R^�=��М>/{9��MlM_��cN��h�A�BES��P�C�S�� W��W��)��JYk��a2 0��bC4��kE�zM��#�r��U�}C߱��ϭb+�3�@ Kگ"��E��xGI�!��B�+GLnE�<�۷cA�?��h�5�5�\.dY��}��L�5��=��XQ!��!c��|��6��[�@�V��"�� 7ehv�m��O4�E�;�b�K+��r;f�m�8��J�uOf�?Z9� ��.��}��gqsGg�@�-�^RYҡ��-��K��.:�� G��2��briV@6]lfO��8�U$��a[��1��[X�=��%^Y FB+�\��!��4H�/\�Y�9�;E;> "@��acP��f��e8�+/��-��6_�E�W՜�W�|�5��ӹ#��Wuwx��~��I��M0��U�FH�}^�E�u�*;�C�+�Q��蠌^Y�k��{�z��u�@��B�GߎY�|8�6�j�ݡf�=��tMmf��-c�A��ڰ�ӓ��9��E$�wwC��Z��k-}ܳ�S�}r��O��n��w<�.��6��e��뮃�+��i_�RI;��u��K'��5�֍��B��i�" "�y0��./�Ç-mgt|��~��)�_xEo��6��̙�6��M/�)Z{�W��@Ǎ��)l��P��h��*b�c��ڌ�O�OS^W4�04xa�Mm�CA��rl�R`l�T��MF��uGRr�=T�)�0��^�x��glP�D��1��t)�)��סt쯋��0yd}�f��t�,�w7��dj�ٗL �}}-��@b�� 1�χ�'4��DC�j�~:�N:��q��͵�v+f\D�b��*#�y��L��4M�VC,��j�0s��6qq�64��_z�! @�z�!k��l��*w��~�Х`�� mJ�{t)s2S�L:��1�U5;C7� ��g�X�!�`g�!�X�]�Ɇ�z��b��U�Q�;�%�a#��QH�䫐D�L��y؈yf�a�Яfr��2gw�{��y8=�~>�h��˙�ĭ��7��V%F=�ND��T5��L��X0�-�.,�� iW�H^F^��x�7�8,D�Ǵ-�0�e?��3�J�F��4�"�khE�$p@:�;E2T��$��Qlf��z"�G�q*6��Ȉ��L��V��u�4�LG`�q�^��9�sn�'�(�-�â$KË�Z��p��{5�8��t�0g5�Ųls�u��\��c��LDl��BM��a�u��℀L9�v��j�"so�;˸�N.Y�!"D��.#-�q�/�ȕ2�+�0��y�x�~p�:^^�9�<�ujZ�N��XZ��zj�̘�WՒ��zr*��E�l�a�_8�$2��`_��)K��5^�:\�zL�M^��W2��6z≪�Υ�\=_�P&z��RD׶T��Z�-��I6[��Z�ŢCf�dW>�\�f È��.��̄�}ff+��͒��PY=�ϱ��T(��f�|��=;�7�QU��|��{�+��(Z��=/j\ȹ�X1�j��|_0��\a�qrhqss��̙o��&o�YQՆ8��uy��}d)N��Ҵ~h��f�$�@��T$:f�a�[/�.�싴^v4�H�)J`��"4�UDDqc@��`�#��I��u)�#��\�]˖�&J�r�(��Ա$k�'VD�^�j�\��-��~�Kˉ��v��.1��)y(�Q��n��YE�͟C�Q�㕖"ՄXĕ�\u��9R�LP+�u��9wf�t��ї�d��t#��uE3�wQT�wx}��נ�s�9�Y%o�a�I��1�$�U��3`Q�� >��,l�چk��Ac=59��JGR�i�D�@��&��V�]vF�iP��c�k�БN��Z�g�H(��&Ӈ�� S�|r�?��\��j��W��o8X�;�,��d�À��9"H:H.��h�d9Qo+��'T�O&�V&��Gt��U��-$�K*�o��x��#��o]", "�G��2��p�E�� D1��%�d�"j��^�o��/�%�^oU�R�D��Cln�5��,�)M�9�^�]̒ �Ɨ/��'Ż)��lb٪>X�|�}��%p$r��t��R]KàwQ�Eta-�Y[�Vr�q�}\��<��+��p��x\�0��_@\PT��=t�Ū;��]�W:OW��i��W�"��E�&�;��YSCS$I��e��f۴/��"F��7�4>�m��F�ьWW�[S��37�*�4ȯ(1��Bf�u��t�En�,x�ņOE�%'5�=ξ>�*��G&��Bb��$Dg=zf�ˍ�W�3��*�8�L.�Εo��ET�.^�4�ɋ��S֨�X�O��Ҋu��n d隳��ş��+�:%�pd�SX��a��{�1�1r�&5M!�7ޤΛ�W{ԋ�7w�a��Q�i๋��s��ށv��P;��&�g�R<�c��;8�FR�9�\H��3C>�dP�0��4��7A2�R�΄��!��зzfSp527��$�]n�y#/z��34o�y�]q:Ohi!ғ��>�t�w�G�k0��n�|�C�ko��&�'�̌Ѥ#f��^��F�[|m`�&��>��E��k��rH��D�z,��y�{ĭ}��}��>l{��%��xf��eV�82r�F�E�M#oVhi��ao�ِ M�5E�4.�66l c#K��\�X߬ZHk��(*��R��U��I��t�U��a�Lp��,@�5�_��,ve΍�¯��gi�U�-Ds��'n�TYf��\� �-Jy�^aʽO�2��b�_ k)GG�5g�3�ŧt�X�yc�+$��ŉؒ��Zu��V?K�)�DU�!�Vۑ�?0㐅�^\�z��t�F'��a��|�:��I��?��6!�÷�s��fr~{)q��e9��i�rh�{�x�K-��"�Ť�Ӕ)�˾�K��R�Q��=,�E��$/r]��+��Ry�R%��t��/R�X�y��hΊ|6S6�3��[�ؖ�6�i-.d�+��-t�#o�O.��:�xZ��쫸(:��|T��L�{)�Yk��pq�#�T��{��3��Z�̏�Uۗ�Y�� y��U�=�=V��\Vz�x��OCn;�vC\��Ļ�q��~�>��7v@�G!��L9��7q�dJ��׉�D��樘o��Ǵ/��={�'L�#D*�˃s��3�UJ��kE��w�6b2W-b.A�RI3²5b:�#ʝ�3�[��z��9�/�ˤ)�/E��>D�2�Xf%�9��9��r��x��ZE|ߢ�T8��t�9�� )Q) Ǚ��r��5=�s�Wp]�G�f��^ ��yuv��d2W�ق��ۖ«+�w�ߎ=�r�N��X��B��Q}"��9�%��k��1��u�\�V�j�T.��H��5C�oc{�R� �/�}��7" "#W��!�p-)��B�R�m]M��7�b�ACF��_]Z0�l��b��t/}��K�r�P��du/��ؐ+Q�w��Z�w5��O�;DK��bL�70I)a)Ak�K��rL��*K��{��y��4��(\�ՑD��+��tRۘ�ʤ��腎c�%�=�ڎe��U�1Hb��<��/�x��o]F�ŋ��1A�zőr�D0��|s�8s6@��!�5��D@�"�D�bK8��=�`��c��=�}}t��J�j��>��K�ɳ��", "0001�acfko�6��K��2IN\'ƀ�ˊ�k��E?8��8�#��4i��"e�'>��l��v ��>�)�v��y��2�r��*��1�uy%�o6��d�}eT��MdTtdyN�([_��9ɡ��(�yQ��w�?T@Y-�̍��o��$'��i�x�z^��V�̧��h5�ı��J�>=I{lM�y.��u!�rd�"�Ӎ!�弞!@Ol��G�+��>�PU��1�'v^��\XtT&�e֓.5J��.I�"�S<��~p�=�.�$��t�-�ٝ�ek�6�8fw��ᴙP��1��4"t��!�*��2z��,k)`5J�P��}G}[�>� a��.=4��4��z��!\\��_�5��Ļ��}�;N# ��v��wI�I�Ve�h��$~-�4�.6�5��s7��f�i~��`p��O�p��G?��߾��=W�e��,��Ya��", "�g��}�0��^o��X�nF��R[��%�^��Ꭹ��t+|ܻ�^^ŪsqsF�g��qsJ'yDt:G33�/{��]ه}��Y��7��`��P��©ݎ*�f�t��Ei��;�<��*��d�'��$��,��L��:Z�4��(Ъ�d�>��S�$]_U��w��Eʢb�,Ϯ��R��w�Tqw�v��\��_��$��ŕ��}��M�\��?'��y�8{E+�5A��Uk��ȩ�q��t�1Y��|Nȩ�\��K��;�d��Z��Y��5$)�W�8�7�?O�v�Ai�a�Y��Z��٫x��8��Ń�Fڵ��i�/@��'��l��s��*��{��d��<��|I{��c�I<��4_%�R�z�,�H�I%D�vw�V�,��_�Tv��q�wwz��T��,��g��P�0�7�ʔ*P̼�4K��!/U~�^��m�;��Yfu8��n�ͅ-�9��S�?�Wd`��׍O��窫�tJ7��W�Yb��L�Ц�a�_7T�7��ƿ$W$� Aݠ�˫�h��p�Y��85�K��Q�N��|:��ԑP��`��t|��no/zR�1�~�O,��h��5[�$`m��b>��`�Pؗ1-�s�|NZF�E��{-gn�u1';��#��^j� 4�(�Y��v��X�0��&�Ō�ׅ͒&�&cO��E<�i�ҿX-�bءL��"��Rhz�b�(O'��=��.E�6�O�%�C��xr?X�g�J~��aO��M�>=�;��Y��W�=��?]�S.��~�O��m?զe:ð��]�H�)��`2�$�]��n��i|�e*/��1�W��}�V�n�W�VPʘ�Jj��v)�]J�Q�lbۗ�a��ⶥZ^#��|�9X�{��?޿�Ə��`5I��E��4A��e�O��tytg��z�Lƣ?Wo�3��5H�R��-�L�""�5U�}~{3��Z!��/9m�K", "Oe F2��$��", "00000001�00000001]00000001Y00000001�00000001�0000000160000000100000001�00000001+00000001�00000001�00000001�00000001U00000001�00000001�00000001"00000001)000001icb6$��>��8>��xk�[y��M��sW��"W��hykS�dD��F��@7��y�m��|�?^^��=��Q�訪�aK�D|��F�_�-xi�`e��8΅�gd��~�2�9��Ds��ʀ� ��q��j�G��=��s"��JQ�\��J��Bj�=��8W��fT�H袁s'��u�C'<�b��cA�3��2�YRY�ɑ�W!@��>ت�4��!�{��;��Ɔ�R�u�XXv�Q!=��>c�d�@�~�o��U��a|�Tg4*�qǽ �E�_ҙy�B�Vh(rF�IJq�Jǰ��w��\��bA!D��|W��`�Llgj��e_�㻷��ؐ>=��M��^�@�s.�&�h��:X\Z�XSG]ۉc,b��~y�)CXp�1_��7�GwkG6��/Rn��dI�O�n�]��Ae�'��?� !<�ES�O�9�l�weCTU��?|�bP�ϱk؀�ڔ�v��(W��-�S8��~��`q��SI2��O�A�b�c�c�?�=I:E��V�T��)_e�㝒��?>��R��b��P�^5��r��u��V��Z��1�ZCէȼfQ�@t�Xݬ��D�}��M��2��=�he��o�F�C��`�>��Zx��h}68��T��n��͠�GPJ��h6��)��uUў9U�3Qv�S�NGSܗ�i��x�rR��R�r�#G'�6�N1��1ǧ�I܆��F��8'�BİMn@h4", "�o1FG%��טk�0��P�i��Ai�f\�'��]��k"�tW3{��R12�.�QK_�#k+x#��,*�hP��/��od�k.@#��/4�]uI+:�@��m�^��[f��oژ��%Y��!u��W��EY��΋Z�%K�#5�W��ۈ��:��!#��?=��k��i��"�Yr��b�V�u@�Ӯ$��3�p�3��Ɇܼ��!{�[�I��G��'T^�o��Eq2�6�Z��V�#X��4$%w4��%��8�ռV�>o7R��PZۗL��W�O&7X9՝P�\-aG��@r��"\��6u��8��a�c�f�垌U=|�d�osR�m^��\�=�5?D��uT�5��R��1v]u��7fB��&��6Ҫ.��r�ێl�_?��r��W|��T��U��>b��)F��y��C��ϙ'd�T$�T��T�ͩZG�@�l��E.��u��'��)/׳%*vF��o0@��T��3A#|CYTy�k\'��ױ�6M�P�.��yi�{�gj>oo3l-�Y��|��|��y0}7�:�$��Bޟ�y��]�*��x~�|�z��_��?:J�=�Ӣҳ��H'�z��|��C��YN�]H�]rHР4��s��7%�5�Yf��~�=͹<��A��=b��N��8'P��&��mP��ɵh�J��k��R]P�ozr�n��s;�f��??}��rP=��#k�%Y��hOY�/ ��D�2�s�D�Ն�i��z]!�~��01��W�Ǫ3��*C�7�=Z�7I*��3�a�b0a&�6>�ҽ��酯�ز5�t'=�4P)�cd�r:ȗ�!�Kc� .��<� �f@�J2�.��b֡�d�Ռu��n� ��x��W!�U�@��/�L��2Xo�ߟe�5y�{�\��4��o?��W� ʚ2�8D��0Y?�y��[��z�~\��ZV��d~��\L��Q��xQz?_4{��w?>�WTSSȫäB�z�@��!��޳8W�"��s��raE,|��˧��L7�do�J��t��Q9��'Q�4��OaZ^e@L|#�EQ�¾\" "w�k҄r�5N��7�;�ϸ��˝id��Yy��m�&�c �RՄ;i��^�GH�5Į��ר�s=w�!%��'��S;v�ٱ�-��ޢ��lX��U�4��1+�(^��F�@��};��>ՙ*�t|x��t�u��`N�'��?�p��*�p��U2��[{p��`N�'��˻��Ѓ�oFN�^��c�8��a�%v�o(vv̘��X�_BX>F��.��B�u��X��"�*��;Gx�!< l�τi��m��&��HsS�+��i<��H��N ��4��y#L}�'�t��905�y�Z�B~,Q�ُ�]��گ0��Nڂ��ݵE�.'��w��w8��{��ww��kQ�(��/��", "00000001�0000801]�s�8�Wx�L3s�B%/wG?�K�4餹70�pL1d�f�?l�F�e��J�ңOm�~�]}�Cg3�"Y0+�A0|lj]u@!�/Yu0� BM�*��L�j�;��F��2fW@��00��a(.�ZJ�3Jͯ�g1¯p�|;�}��ң8v#U�\O�A��^!M��#�2�?1��y�OZJ�9:s�u��t�Qׅ8G�k8��E�t�T8CX�8n˵�(��N��Ү�s.rT��sv��+��r��z�.��/�q|�(q�l�y��^��dȷ�#�W#��hIB_�5��&��Y�-C\�CB ��Q9��H��Y�D?�F0�@��#�Ο�tm�Е0�J~�UBD4K"f�N��U4cE�(��/��WbzE��i\uI��T��*��Wߞ�,�Iey9L��B�*_��x�vv�tgv�E�9�1C'G��#XUӪ&��\Oaa�:�C=��z�A}�&Fi)JDzM��¿�l�u��H�`��d��|<�+��i伢�4)��4��4��ki�eu��4ł�V�[zT��sOSW�r�9��@.rT�� 5�� 5w-M��QTU��X��J�bK��1�Px�i��W5��Wh��)�}6M�W��J�HS��J�-{0ћ�X�j:��ңr8�{��Ć<��|��v��R@|!��S��HU��R(P��e��H�b��d�P��e�;c��d&)��:�{� 3��a��pz]�l�)�Q�qp�~<'A��i�F�o�׸8N�ϕ�1��ߋr�A1W�-�(C��꯫��j`-��g�2:��- sv�f��a-��h�4$+��g��)P��0x,�%5��'��(��L��k�B3GM3�:��Ӻ2ٖ��rdG�L[<�T�O�L;<�T+�O"��X@��z�i�o)�!+��ҝ��E\�+��~u�_��z��|�b��d?�s�W�ҥ��&��&��&��ø�"*��b�Ϲ�I��f��Q��`�8��@�o�� Gz\y�A��׋��60��zJEi�<�)X�t�ҵ�*hU�@��5&=�F#%�kȥ@��I��U)п�\a6M)�w��ܶ�6+�޲9�c�-�ل��!H��ML�+�K�-�Y��]�P�?��˟\Ճ�?KP��B��I��~�Ǜ��.��V��" "��y�?�^nd�|�+L~�$ݹc��ի�f��Ң��ͅ��G-��w��}��/��;�u��W�E��L�Ά|�;K��>]�$��ҟ�#�@�3E��m�[�p��W��4S�X(@Y�C��C��O��w�\=�$�4~�{s~&.��L�a4��2$;()9��:h�M�&��Jʶڭ��^��h~ajश��j[rX�n�Ko�q��I=u�'#�^��ó�r˄�M��a��rz4L��?9��_��=?m��:��`&֫��(�fL�κ/�2�;��B.��0T�CN��魝�w&��:G��Dݰ-U��l�l$��jrԎ6�6փ�_��B��9(�2��C��i�4��#�h2�u7�32M/"rJ��x9�O��U�e��ߑ[O��h��m@��`�%-H8�j3��$Yl��~EG��å��!��N�Z��Z�i��Ia��&}5��n�'��L?��C��C<��s+��?�b��Di�C4"Cr#!�T�T�V8R��sn�/CPː[��B��!�52��;��A�!C��dh�>��I !��%��a��C�P�c[��B��5~��;��A��7��f^��I !��*,��(Qw�o��o��{��9z�0@�� D7��o�fE��Z�&�"f3gfG��˗�k��(I�a$�%y�I_]�W��$Վ+N2\1KP˩[��B��$�5��;K��A�c�$ӱ\�4�wJk��f@�F�%�.�{N:Չj��5�;�U��M��L�OP˫[��B��$�5��;O��A�Y[f:�˖�D�Aْ��?�wH�$��%�)u62�-�[�N�-��X�-z�!s��`�[Bl�nn��-U͊ %��\�4��ʖ��-̀ؒ,.�ڷH��k�}��!�R�{zx0@-�Bl�C!s��`�^Bl�nn�/U͊ ��%��xyZ0ˁ.�h��K��5��Ϥ�Ɐ��G�~Mo_ٛ��@��ަ��Tq�#�]E�(�RL��ֳ��;�(Mo_�Eڏ��@@/��TDr�w�C/u]}�sc�K�\l��%�Wpn_,��\��iN�Ry�sdMʻ�c]��~�W��e�`%^��7X��`��'�z��x��tڶ�G��z<��s0�w"��ϻ�=��{�(�e��ں�p�X��/?�Mo��l�ڭ��M�<>��o�y�"75:T67e,Found string "GET /demo/home.php?s=67.218.111.202 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: db-ip.com" (Indicator: "HTTP/1.1"; File: "SSL") file/memory contains long string with (Indicator: "HTTP/1.1"; File: "SSL") Found string "GET / HTTP/1.1Accept: text/html, application/xhtml+xml, */*Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: accounts.google.comDNT: 1Connection: Keep-Alive" (Indicator: "HTTP/1.1"; File: "SSL") Found string "HTTP/1.1 204 No ContentContent-Length: 0Cross-Origin-Resource-Policy: cross-originDate: Sun, 26 Nov 2023 21:17:33 GMTAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000" (Indicator: "HTTP/1.1"; File: "SSL") Found string "HTTP/1.1 204 No ContentContent-Length: 0Cross-Origin-Resource-Policy: cross-originDate: Sun, 26 Nov 2023 21:17:35 GMTAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000" (Indicator: "HTTP/1.1"; File: "SSL") Found string "GET /login HTTP/1.1Accept: text/html, application/xhtml+xml, */*Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: store.steampowered.comDNT: 1Connection: Keep-Alive" (Indicator: "HTTP/1.1"; File: "SSL") Found string "GET /favicon.ico HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoDNT: 1Connection: Keep-AliveHost: www.google.com" (Indicator: "HTTP/1.1"; File: "SSL")76:T2c79,Contains base62 string in header "MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfq" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEATh56TcXPLzbcArQrhdFZ8%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base62 string in header "hLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQ" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEATh56TcXPLzbcArQrhdFZ8%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base62 string in header "P4v0cB1JgmGggC72NkK8MCEATh56TcXPL" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEATh56TcXPLzbcArQrhdFZ8%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base62 string in header "MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V" in header "GET /gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base62 string in header "MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAU" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base62 string in header "2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base62 string in header "MFEwTzBNMEswSTAJBgUrDgMCGgUABBTPJ" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTPJvUY%2Bsl%2Bj4yzQuAcL2oQno5fCgQUUWj%2FkK8CB3U8zNllZGKiErhZcjsCEAMcx1gUksFzIhtJYk5T2cw%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base62 string in header "2FkK8CB3U8zNllZGKiErhZcjsCEAMcx1g" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTPJvUY%2Bsl%2Bj4yzQuAcL2oQno5fCgQUUWj%2FkK8CB3U8zNllZGKiErhZcjsCEAMcx1gUksFzIhtJYk5T2cw%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base62 string in header "ME4wTDBKMEgwRjAJBgUrDgMCGgUABBQwk" in header "GET /gtsr1/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBQwkcLWD4LqGJ7bE7B1XZsEbmfwUAQU5K8rJnEaK0gnhS9SZizv8IkTcT4CDQIDvFNZazTHGPUBUGY%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base62 string in header "cLWD4LqGJ7bE7B1XZsEbmfwUAQU5K8rJn" in header "GET /gtsr1/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBQwkcLWD4LqGJ7bE7B1XZsEbmfwUAQU5K8rJnEaK0gnhS9SZizv8IkTcT4CDQIDvFNZazTHGPUBUGY%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base62 string in header "EaK0gnhS9SZizv8IkTcT4CDQIDvFNZazT" in header "GET /gtsr1/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBQwkcLWD4LqGJ7bE7B1XZsEbmfwUAQU5K8rJnEaK0gnhS9SZizv8IkTcT4CDQIDvFNZazTHGPUBUGY%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base62 string in header "MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfq" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEAx5qUSwjBGVIJJhX%2BJrHYM%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base62 string in header "hLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQ" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEAx5qUSwjBGVIJJhX%2BJrHYM%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base62 string in header "P4v0cB1JgmGggC72NkK8MCEAx5qUSwjBG" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEAx5qUSwjBGVIJJhX%2BJrHYM%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base62 string in header "MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHL" in header "GET /gts1c3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEFYyRZRleaQREjdgJW3R1jM%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base62 string in header "2Fr4XN7pXNPZzQ4kYU83E1HScCEFYyRZR" in header "GET /gts1c3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEFYyRZRleaQREjdgJW3R1jM%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base62 string in header "MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAU" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAbY2QTVWENG9oovp1QifsQ%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base62 string in header "2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAbY2QTVWENG9oovp1QifsQ%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base62 string in header "MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTHL" in header "GET /gts1c3/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEQCVN9Jf3G%2B1pAqd7QzTt1vx HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base62 string in header "2Fr4XN7pXNPZzQ4kYU83E1HScCEQCVN9J" in header "GET /gts1c3/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEQCVN9Jf3G%2B1pAqd7QzTt1vx HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base62 string in header "MFEwTzBNMEswSTAJBgUrDgMCGgUABBTk4" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTk45WiKdPUwcMf8JgMC07ACYqr2AQUt2ui6qiqhIx56rTaD5iyxZV2ufQCEAqiBEK%2F1RSvcy4lL46SQ4M%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base62 string in header "5WiKdPUwcMf8JgMC07ACYqr2AQUt2ui6q" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTk45WiKdPUwcMf8JgMC07ACYqr2AQUt2ui6qiqhIx56rTaD5iyxZV2ufQCEAqiBEK%2F1RSvcy4lL46SQ4M%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base62 string in header "MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTHL" in header "GET /gts1c3/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEQCVN9Jf3G%2B1pAqd7QzTt1vx HTTP/1.1Cache-Control: max-age = 14400Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base62 string in header "2Fr4XN7pXNPZzQ4kYU83E1HScCEQCVN9J" in header "GET /gts1c3/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEQCVN9Jf3G%2B1pAqd7QzTt1vx HTTP/1.1Cache-Control: max-age = 14400Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base62 string in header "MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTHL" in header "GET /gts1c3/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEQCLPpgizFvtXApe3cL6kC3u HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base62 string in header "2Fr4XN7pXNPZzQ4kYU83E1HScCEQCLPpg" in header "GET /gts1c3/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEQCLPpgizFvtXApe3cL6kC3u HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base62 string in header "MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHL" in header "GET /gts1c3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEF2rtEA6xK7GEl4nbt8ZZfk%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base62 string in header "2Fr4XN7pXNPZzQ4kYU83E1HScCEF2rtEA" in header "GET /gts1c3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEF2rtEA6xK7GEl4nbt8ZZfk%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base62 string in header "MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAqvpsXKY8RRQeo74ffHUxc%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base62 string in header "2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAqvpsXKY8RRQeo74ffHUxc%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base62 string in header "2BrkS7QYXjzkCEAqvpsXKY8RRQeo74ffH" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAqvpsXKY8RRQeo74ffHUxc%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base62 string in header "MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base62 string in header "2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base62 string in header "2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base62 string in header "MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEA177el9ggmWelJjG4vdGL0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base62 string in header "2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEA177el9ggmWelJjG4vdGL0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base62 string in header "2BrkS7QYXjzkCEA177el9ggmWelJjG4vd" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEA177el9ggmWelJjG4vdGL0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com"77:T4a0,"new_login_bg_strong_mask_1_.jpg" has type "JPEG image data Exif standard: [TIFF image data little-endian direntries=0] baseline precision 8 1920x1080 components 3" and extension "jpg" "header_logo_1_.png" has type "PNG image data 744 x 171 8-bit/color RGBA non-interlaced" and extension "png" "header_menu_hamburger_1_.png" has type "PNG image data 244 x 212 8-bit/color RGBA non-interlaced" and extension "png" "logo_steam_footer_1_.png" has type "PNG image data 92 x 26 8-bit/color RGBA non-interlaced" and extension "png" "footerLogo_valve_new_1_.png" has type "PNG image data 176 x 50 8-bit/color RGBA non-interlaced" and extension "png" "logo_valve_footer_1_.png" has type "PNG image data 92 x 26 8-bit/color RGBA non-interlaced" and extension "png" "ico_twitter_1_.gif" has type "GIF image data version 89a 16 x 16" and extension "gif" "ico_facebook_1_.gif" has type "GIF image data version 89a 16 x 16" and extension "gif" "btn_header_installsteam_download_1_.png" has type "PNG image data 15 x 13 8-bit/color RGBA non-interlaced" and extension "png" "btn_arrow_down_padded_1_.png" has type "PNG image data 19 x 12 8-bit/color RGBA non-interlaced" and extension "png"78:Tc007,"initAft()