26:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js","/_next/static/chunks/1w1axrg6kzses.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/1kn_tf3p-ubex.js","/_next/static/chunks/1wq095nwqbaw1.js"],"SampleDetailWrapper"] 6a:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js"],"IconMark"] 25:T49d,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Crifi.Generic Sample 7ef834fc890f… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 7ef834fc890f…. Malware family: Crifi.Generic. Threat score 100/100. 13/25 AV engines flagged this file. 13 malicious and 16 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/7ef834fc890f8f801316f859915cba63a0771e89738a882bca0656fda5a74ddf","keywords":["Malicious","Crifi.Generic","malware analysis","sandbox report","threat intelligence","7ef834fc890f8f801316f859915cba63a0771e89738a882bca0656fda5a74ddf"],"about":{"@type":"SoftwareApplication","name":"2126f48656722b1eb6e5f59fe213b27a.exe","applicationCategory":["peexe","executable"],"identifier":"7ef834fc890f8f801316f859915cba63a0771e89738a882bca0656fda5a74ddf","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Crifi.Generic","antivirusDetections":{"malicious":13,"total":25},"behavioralIndicators":{"malicious":13,"suspicious":16},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}27:T25c4,Found reference to API (Indicator: "DosDateTimeToFileTime"; Source: "sample.bin"), Found reference to API (Indicator: "DeleteFileA"; Source: "sample.bin"), Found reference to API (Indicator: "AdjustTokenPrivileges"; Source: "sample.bin"), Found reference to API (Indicator: "MulDiv"; Source: "sample.bin"), Found reference to API (Indicator: "GetFileAttributesA"; Source: "sample.bin"), Found reference to API (Indicator: "SetForegroundWindow"; Source: "sample.bin"), Found reference to API (Indicator: "SeShutdownPrivilege"; Source: "sample.bin"), Found reference to API (Indicator: "GetPrivateProfileIntA"; Source: "sample.bin"), Found reference to API (Indicator: "GetExitCodeProcess"; Source: "sample.bin"), Found reference to API (Indicator: "FreeSid"; Source: "sample.bin"), Found reference to API (Indicator: "SetEvent"; Source: "sample.bin"), Found reference to API (Indicator: "GetSystemDirectoryA"; Source: "sample.bin"), Found reference to API (Indicator: "CreateDirectoryA"; Source: "sample.bin"), Found reference to API (Indicator: "GetDriveTypeA"; Source: "sample.bin"), Found reference to API (Indicator: "GlobalFree"; Source: "sample.bin"), Found reference to API (Indicator: "LoadLibraryA"; Source: "sample.bin"), Found reference to API (Indicator: "EqualSid"; Source: "sample.bin"), Found reference to API (Indicator: "CreateThread"; Source: "sample.bin"), Found reference to API (Indicator: "GetFileVersionInfoSizeA"; Source: "sample.bin"), Found reference to API (Indicator: "GetModuleHandleW"; Source: "sample.bin"), Found reference to API (Indicator: "DecryptFileA"; Source: "sample.bin"), Found reference to API (Indicator: "RegQueryValueExA"; Source: "sample.bin"), Found reference to API (Indicator: "GetCurrentProcessId"; Source: "sample.bin"), Found reference to API (Indicator: "RegSetValueExA"; Source: "sample.bin"), Found reference to API (Indicator: "FormatMessageA"; Source: "sample.bin"), Found reference to API (Indicator: "GetStartupInfoW"; Source: "sample.bin"), Found reference to API (Indicator: "GetCurrentDirectoryA"; Source: "sample.bin"), Found reference to API (Indicator: "SetFileAttributesA"; Source: "sample.bin"), Found reference to API (Indicator: "RegOpenKeyExA"; Source: "sample.bin"), Found reference to API (Indicator: "GetDesktopWindow"; Source: "sample.bin"), Found reference to API (Indicator: "CharNextA"; Source: "sample.bin"), Found reference to API (Indicator: "SetWindowPos"; Source: "sample.bin"), Found reference to API (Indicator: "ShowWindow"; Source: "sample.bin"), Found reference to API (Indicator: "GetSystemInfo"; Source: "sample.bin"), Found reference to API (Indicator: "SendMessageA"; Source: "sample.bin"), Found reference to API (Indicator: "UnhandledExceptionFilter"; Source: "sample.bin"), Found reference to API (Indicator: "VerQueryValueA"; Source: "sample.bin"), Found reference to API (Indicator: "DispatchMessageA"; Source: "sample.bin"), Found reference to API (Indicator: "GetWindowLongA"; Source: "sample.bin"), Found reference to API (Indicator: "LookupPrivilegeValueA"; Source: "sample.bin"), Found reference to API (Indicator: "FindFirstFileA"; Source: "sample.bin"), Found reference to API (Indicator: "GetProcAddress"; Source: "sample.bin"), Found reference to API (Indicator: "CreateMutexA"; Source: "sample.bin"), Found reference to API (Indicator: "CreateFileA"; Source: "sample.bin"), Found reference to API (Indicator: "GlobalAlloc"; Source: "sample.bin"), Found reference to API (Indicator: "CheckTokenMembership"; Source: "sample.bin"), Found reference to API (Indicator: "SetFileTime"; Source: "sample.bin"), Found reference to API (Indicator: "RegCloseKey"; Source: "sample.bin"), Found reference to API (Indicator: "GetTempPathA"; Source: "sample.bin"), Found reference to API (Indicator: "GetTokenInformation"; Source: "sample.bin"), Found reference to API (Indicator: "SizeofResource"; Source: "sample.bin"), Found reference to API (Indicator: "ResetEvent"; Source: "sample.bin"), Found reference to API (Indicator: "RemoveDirectoryA"; Source: "sample.bin"), Found reference to API (Indicator: "SetUnhandledExceptionFilter"; Source: "sample.bin"), Found reference to API (Indicator: "GlobalLock"; Source: "sample.bin"), Found reference to API (Indicator: "FindClose"; Source: "sample.bin"), Found reference to API (Indicator: "LocalFileTimeToFileTime"; Source: "sample.bin"), Found reference to API (Indicator: "IsDBCSLeadByte"; Source: "sample.bin"), Found reference to API (Indicator: "GetTickCount"; Source: "sample.bin"), Found reference to API (Indicator: "SetCurrentDirectoryA"; Source: "sample.bin"), Found reference to API (Indicator: "GetDC"; Source: "sample.bin"), Found reference to API (Indicator: "MsgWaitForMultipleObjects"; Source: "sample.bin"), Found reference to API (Indicator: "SetFilePointer"; Source: "sample.bin"), Found reference to API (Indicator: "GetShortPathNameA"; Source: "sample.bin"), Found reference to API (Indicator: "GetPrivateProfileStringA"; Source: "sample.bin"), Found reference to API (Indicator: "TerminateThread"; Source: "sample.bin"), Found reference to API (Indicator: "FreeResource"; Source: "sample.bin"), Found reference to API (Indicator: "lstrcmpA"; Source: "sample.bin"), Found reference to API (Indicator: "ExitProcess"; Source: "sample.bin"), Found reference to API (Indicator: "EnumResourceLanguagesA"; Source: "sample.bin"), Found reference to API (Indicator: "WritePrivateProfileStringA"; Source: "sample.bin"), Found reference to API (Indicator: "GetVolumeInformationA"; Source: "sample.bin"), Found reference to API (Indicator: "GetCurrentThreadId"; Source: "sample.bin"), Found reference to API (Indicator: "MessageBoxA"; Source: "sample.bin"), Found reference to API (Indicator: "SHBrowseForFolder"; Source: "sample.bin"), Found reference to API (Indicator: "GetModuleFileNameA"; Source: "sample.bin"), Found reference to API (Indicator: "GetCurrentProcess"; Source: "sample.bin"), Found reference to API (Indicator: "CharUpperA"; Source: "sample.bin"), Found reference to API (Indicator: "LocalFree"; Source: "sample.bin"), Found reference to API (Indicator: "LoadLibraryExA"; Source: "sample.bin"), Found reference to API (Indicator: "QueryPerformanceCounter"; Source: "sample.bin"), Found reference to API (Indicator: "RegDeleteValueA"; Source: "sample.bin"), Found reference to API (Indicator: "GetWindowRect"; Source: "sample.bin"), Found reference to API (Indicator: "CharPrevA"; Source: "sample.bin"), Found reference to API (Indicator: "GetDeviceCaps"; Source: "sample.bin"), Found reference to API (Indicator: "ReleaseDC"; Source: "sample.bin"), Found reference to API (Indicator: "HeapSetInformation"; Source: "sample.bin"), Found reference to API (Indicator: "GetSystemTimeAsFileTime"; Source: "sample.bin"), Found reference to API (Indicator: "SetWindowTextA"; Source: "sample.bin"), Found reference to API (Indicator: "ExpandEnvironmentStringsA"; Source: "sample.bin"), Found reference to API (Indicator: "AllocateAndInitializeSid"; Source: "sample.bin"), Found reference to API (Indicator: "EnableWindow"; Source: "sample.bin"), Found reference to API (Indicator: "PeekMessageA"; Source: "sample.bin"), Found reference to API (Indicator: "GetVersionExA"; Source: "sample.bin"), Found reference to API (Indicator: "LocalAlloc"; Source: "sample.bin"), Found reference to API (Indicator: "CreateEventA"; Source: "sample.bin"), Found reference to API (Indicator: "GetFileVersionInfoA"; Source: "sample.bin"), Found reference to API (Indicator: "GlobalUnlock"; Source: "sample.bin"), Found reference to API (Indicator: "RegQueryInfoKeyA"; Source: "sample.bin"), Found reference to API (Indicator: "CompareStringA"; Source: "sample.bin"), Found reference to API (Indicator: "WriteFile"; Source: "sample.bin"), Found reference to API (Indicator: "Sleep"; Source: "sample.bin"), Found reference to API (Indicator: "LoadStringA"; Source: "sample.bin"), Found reference to API (Indicator: "LoadResource"; Source: "sample.bin"), Found reference to API (Indicator: "TerminateProcess"; Source: "sample.bin"), Found reference to API (Indicator: "CreateProcessA"; Source: "sample.bin"), Found reference to API (Indicator: "FreeLibrary"; Source: "sample.bin"), Found reference to API (Indicator: "SHGetPathFromIDList"; Source: "sample.bin"), Found reference to API (Indicator: "RegCreateKeyExA"; Source: "sample.bin"), Found reference to API (Indicator: "MessageBeep"; Source: "sample.bin"), Found reference to API (Indicator: "FindNextFileA"; Source: "sample.bin"), Found reference to API (Indicator: "SetWindowLongA"; Source: "sample.bin"), Found reference to API (Indicator: "ReadFile"; Source: "sample.bin"), Found reference to API (Indicator: "CallWindowProcA"; Source: "sample.bin"), Found reference to API (Indicator: "OpenProcessToken"; Source: "sample.bin"), Found reference to API (Indicator: "ExitWindowsEx"; Source: "sample.bin"), Found reference to API (Indicator: "GetTempFileNameA"; Source: "sample.bin"), Found reference to API (Indicator: "GetVersion"; Source: "sample.bin"), Found reference to API (Indicator: "GetLastError"; Source: "sample.bin"), Found reference to API (Indicator: "LockResource"; Source: "sample.bin"), Found reference to API (Indicator: "GetDiskFreeSpaceA"; Source: "sample.bin"), Found reference to API (Indicator: "GetWindowsDirectoryA"; Source: "sample.bin"), Found reference to API (Indicator: "GetSystemMetrics"; Source: "sample.bin"), Found reference to API (Indicator: "WaitForSingleObject"; Source: "sample.bin"), Found reference to API (Indicator: "CloseHandle"; Source: "sample.bin"), Found reference to API (Indicator: "FindResourceA"; Source: "sample.bin")28:T5b1,Found string "system.io.compression.dll" (Source: "00000000-00000844.00000000.78487.00270000.00000004.mdmp") Found string "clrcompression.dll" (Source: "00000000-00000844.00000000.78487.00270000.00000004.mdmp") Found string "system.io.compression.filesystem.dll" (Source: "00000000-00000844.00000000.78487.00270000.00000004.mdmp") Found string "system.io.compression.zipfile.dll" (Source: "00000000-00000844.00000000.78487.00270000.00000004.mdmp") Found string "system.io.compression.dll" (Source: "00000000-00001832.00000000.78155.004D0000.00000004.mdmp") Found string "clrcompression.dll" (Source: "00000000-00001832.00000000.78155.004D0000.00000004.mdmp") Found string "system.io.compression.filesystem.dll" (Source: "00000000-00001832.00000000.78155.004D0000.00000004.mdmp") Found string "system.io.compression.zipfile.dll" (Source: "00000000-00001832.00000000.78155.004D0000.00000004.mdmp") Found string "system.io.compression.dll" (Source: "00000000-00004076.00000000.78867.00250000.00000004.mdmp") Found string "clrcompression.dll" (Source: "00000000-00004076.00000000.78867.00250000.00000004.mdmp") Found string "decompression failed or archive is corrupted" (Source: "00000000-00004076.00000000.78873.009C8000.00000004.mdmp") Found string "compression failed" (Source: "00000000-00004076.00000000.78873.009C8000.00000004.mdmp") Found string "invalid compression level" (Source: "00000000-00004076.00000000.78873.009C8000.00000004.mdmp")29:T48d,"7ef834fc890f8f801316f859915cba63a0771e89738a882bca0656fda5a74ddf.exe" called "FindResourceA" with parameter "2691792" - (UID: 00000000-00005936) "7ef834fc890f8f801316f859915cba63a0771e89738a882bca0656fda5a74ddf.exe" called "FindResourceA" with parameter "2691832" - (UID: 00000000-00005936) "7ef834fc890f8f801316f859915cba63a0771e89738a882bca0656fda5a74ddf.exe" called "FindResourceA" with parameter "2691848" - (UID: 00000000-00005936) "MP5ye33.exe" called "FindResourceA" with parameter "15209292" - (UID: 00000000-00005708) "MP5ye33.exe" called "FindResourceA" with parameter "1635848" - (UID: 00000000-00005708) "MP5ye33.exe" called "FindResourceA" with parameter "15209160" - (UID: 00000000-00005708) "MP5ye33.exe" called "FindResourceA" with parameter "15209168" - (UID: 00000000-00005708) "MP5ye33.exe" called "FindResourceA" with parameter "15209196" - (UID: 00000000-00005708) "MP5ye33.exe" called "FindResourceA" with parameter "15209208" - (UID: 00000000-00005708) "MP5ye33.exe" called "FindResourceA" with parameter "15209224" - (UID: 00000000-00005708) "aR7ev61.exe" called "FindResourceA" with parameter "1250000" - (UID: 00000000-00005684)2a:Tb03,"7ef834fc890f8f801316f859915cba63a0771e89738a882bca0656fda5a74ddf.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '2738288'}" (UID: 00000000-00005936) "7ef834fc890f8f801316f859915cba63a0771e89738a882bca0656fda5a74ddf.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '2738240'}" (UID: 00000000-00005936) "7ef834fc890f8f801316f859915cba63a0771e89738a882bca0656fda5a74ddf.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '2738192'}" (UID: 00000000-00005936) "MP5ye33.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '15255520'}" (UID: 00000000-00005708) "MP5ye33.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '15255632'}" (UID: 00000000-00005708) "MP5ye33.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '15255664'}" (UID: 00000000-00005708) "MP5ye33.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '15255648'}" (UID: 00000000-00005708) "MP5ye33.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '15255616'}" (UID: 00000000-00005708) "MP5ye33.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '15255568'}" (UID: 00000000-00005708) "aR7ev61.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '1296496'}" (UID: 00000000-00005684) "aR7ev61.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '1296448'}" (UID: 00000000-00005684) "aR7ev61.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '1296400'}" (UID: 00000000-00005684) "3Kn814gI.exe" called "LoadResource with parameter {'hModule': '2752512', 'hResInfo': '3622184'}" (UID: 00000000-00005948) "3Kn814gI.exe" called "LoadResource with parameter {'hModule': '2752512', 'hResInfo': '3622200'}" (UID: 00000000-00005948) "3Kn814gI.exe" called "LoadResource with parameter {'hModule': '2752512', 'hResInfo': '3622024'}" (UID: 00000000-00005948) "3Kn814gI.exe" called "LoadResource with parameter {'hModule': '2752512', 'hResInfo': '3622232'}" (UID: 00000000-00005948) "3Kn814gI.exe" called "LoadResource with parameter {'hModule': '2752512', 'hResInfo': '3621880'}" (UID: 00000000-00005948) "3Kn814gI.exe" called "LoadResource with parameter {'hModule': '2752512', 'hResInfo': '3622216'}" (UID: 00000000-00005948) "3Kn814gI.exe" called "LoadResource with parameter {'hModule': '2752512', 'hResInfo': '3621896'}" (UID: 00000000-00005948) "3Kn814gI.exe" called "LoadResource with parameter {'hModule': '2752512', 'hResInfo': '3622040'}" (UID: 00000000-00005948) "3Kn814gI.exe" called "LoadResource with parameter {'hModule': '2752512', 'hResInfo': '3622248'}" (UID: 00000000-00005948) "3Kn814gI.exe" called "LoadResource with parameter {'hModule': '2752512', 'hResInfo': '3621912'}" (UID: 00000000-00005948)2b:T551,file/memory contains long string with (Indicator: "RC2"; File: "supported_browsers_1_.htm") Found reference to "AesGcm256" (Indicator: "Aes"; File: "00002372.00000944.899679.00402000.wprm") Found reference to "AesGcm256" (Indicator: "AesGcm"; File: "00002372.00000944.899679.00402000.wprm") Found reference to "AesFastEngine" (Indicator: "Aes"; File: "00002372.00000944.899679.00402000.wprm") Found reference to "HashAlgorithm" (Indicator: "HashAlgorithm"; File: "00002372.00000944.899679.00402000.wprm") Found reference to "MD5CryptoServiceProvider" (Indicator: "MD5CryptoServiceProvider"; File: "00002372.00000944.899679.00402000.wprm") file/memory contains long string with (Indicator: "RC2"; File: "SSL") Found reference to "AesGcm256" (Indicator: "Aes"; Source: "00000000-00000844.00000000.78487.00E48000.00000004.mdmp") Found reference to "AesGcm256" (Indicator: "AesGcm"; Source: "00000000-00000844.00000000.78487.00E48000.00000004.mdmp") Found reference to "AesFastEngine" (Indicator: "Aes"; Source: "00000000-00000844.00000000.78487.00E48000.00000004.mdmp") Found reference to "HashAlgorithm" (Indicator: "HashAlgorithm"; Source: "00000000-00000844.00000000.78487.00E48000.00000004.mdmp") Found reference to "MD5CryptoServiceProvider" (Indicator: "MD5CryptoServiceProvider"; Source: "00000000-00000844.00000000.78487.00E48000.00000004.mdmp")2c:T6a8,"5ip71Yr.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\SHELL FOLDERS") "5ip71Yr.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\SHELL FOLDERS") "5ip71Yr.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS\LAYERS") "5ip71Yr.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS\LAYERS") "5ip71Yr.exe" (Access type: "OPEN"; Path: "HKCU\CONTROL PANEL\DESKTOP\MUICACHED\MACHINELANGUAGECONFIGURATION") "5ip71Yr.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\MUI\SETTINGS") "5ip71Yr.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\CONTROL PANEL\DESKTOP") "5ip71Yr.exe" (Access type: "OPEN"; Path: "HKCU\CONTROL PANEL\DESKTOP\LANGUAGECONFIGURATION") "5ip71Yr.exe" (Access type: "OPEN"; Path: "HKCU\CONTROL PANEL\DESKTOP") "5ip71Yr.exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP") "5ip71Yr.exe" (Access type: "OPEN"; Path: "HKCU\CONTROL PANEL\DESKTOP\MUICACHED") "5ip71Yr.exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP\MUICACHED") "5ip71Yr.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS") "5ip71Yr.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS") "5ip71Yr.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\SIDEBYSIDE") "5ip71Yr.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\SIDEBYSIDE") "5ip71Yr.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER")2d:T1396,"AppLaunch.exe" called "CryptStringToBinaryA" with parameters {"pszString": "shUfxBHlEuCTp4WSEdWGy0jNFMk1r4o5piEpxTmTeDjZfHOoY4B2jOCJ9eU=" "cchString": "60" "dwFlags": "1" "pcbBinary": "2c000000"} "AppLaunch.exe" called "CryptStringToBinaryA" with parameters {"pszString": "shUfxBHlEuCTp4WSEdWGy0jNFMk1r4o5piEpxTmTeDjZfHOoY4B2jOCJ9eU=" "cchString": "60" "dwFlags": "1" "pbBinary": "b2151fc411e512e093a7859211d586cb48cd14c935af8a39a62129c539937838d97c73a86380768ce089f5e5" "pcbBinary": "2c000000"} "AppLaunch.exe" called "CryptStringToBinaryA" with parameters {"pszString": "shUfxBHlEuCTp4WSEdWGy0jNFMk1r4o5piEpxTmTeDjZcHqzfop+geCJ9eU=" "cchString": "60" "dwFlags": "1" "pcbBinary": "2c000000"} "AppLaunch.exe" called "CryptStringToBinaryA" with parameters {"pszString": "shUfxBHlEuCTp4WSEdWGy0jNFMk1r4o5piEpxTmTeDjZcHqzfop+geCJ9eU=" "cchString": "60" "dwFlags": "1" "pbBinary": "b2151fc411e512e093a7859211d586cb48cd14c935af8a39a62129c539937838d9707ab37e8a7e81e089f5e5" "pcbBinary": "2c000000"} "AppLaunch.exe" called "CryptStringToBinaryA" with parameters {"pszString": "shUfxBHlEuCTp4WSEdWGy0jNFMk1r4o5piEpxTmTeDjfemyveYp9hOCJ9eU=" "cchString": "60" "dwFlags": "1" "pcbBinary": "2c000000"} "AppLaunch.exe" called "CryptStringToBinaryA" with parameters {"pszString": "shUfxBHlEuCTp4WSEdWGy0jNFMk1r4o5piEpxTmTeDjfemyveYp9hOCJ9eU=" "cchString": "60" "dwFlags": "1" "pbBinary": "b2151fc411e512e093a7859211d586cb48cd14c935af8a39a62129c539937838df7a6caf798a7d84e089f5e5" "pcbBinary": "2c000000"} "AppLaunch.exe" called "CryptStringToBinaryA" with parameters {"pszString": "shUfxBHlEuCTp4WSEdWGy0jNFMk1r4o5piEpxTmTeDjWdGa+eIl9juCJ9eU=" "cchString": "60" "dwFlags": "1" "pcbBinary": "2c000000"} "AppLaunch.exe" called "CryptStringToBinaryA" with parameters {"pszString": "shUfxBHlEuCTp4WSEdWGy0jNFMk1r4o5piEpxTmTeDjWdGa+eIl9juCJ9eU=" "cchString": "60" "dwFlags": "1" "pbBinary": "b2151fc411e512e093a7859211d586cb48cd14c935af8a39a62129c539937838d67466be78897d8ee089f5e5" "pcbBinary": "2c000000"} "AppLaunch.exe" called "CryptStringToBinaryA" with parameters {"pszString": "o6oooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooo" "cchString": "128" "dwFlags": "1" "pcbBinary": "60000000"} "AppLaunch.exe" called "CryptStringToBinaryA" with parameters {"pszString": "o6oooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooo" "cchString": "128" "dwFlags": "1" "pbBinary": "a3aa28a28a28a28a28a28a28a28a28a28a28a28a28a28a28a28a28a28a28a28a28a28a28a28a28a28a28a28a28a28a28a28a28a28a28a28a28a28a28a28a28a28a28a28a28a28a28a28a28a28a28a28a28a28a28a28a28a28a28a28a28a28a28" "pcbBinary": "60000000"} "AppLaunch.exe" called "CryptStringToBinaryA" with parameters {"pszString": "o7oooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooo" "cchString": "128" "dwFlags": "1" "pcbBinary": "60000000"} "AppLaunch.exe" called "CryptStringToBinaryA" with parameters {"pszString": "o7oooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooo" "cchString": "128" "dwFlags": "1" "pbBinary": "a3ba28a28a28a28a28a28a28a28a28a28a28a28a28a28a28a28a28a28a28a28a28a28a28a28a28a28a28a28a28a28a28a28a28a28a28a28a28a28a28a28a28a28a28a28a28a28a28a28a28a28a28a28a28a28a28a28a28a28a28a28a28a28a28" "pcbBinary": "60000000"} "AppLaunch.exe" called "CryptStringToBinaryA" with parameters {"pszString": "o8oooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooo" "cchString": "128" "dwFlags": "1" "pcbBinary": "60000000"} "AppLaunch.exe" called "CryptStringToBinaryA" with parameters {"pszString": "o8oooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooo" "cchString": "128" "dwFlags": "1" "pbBinary": "a3ca28a28a28a28a28a28a28a28a28a28a28a28a28a28a28a28a28a28a28a28a28a28a28a28a28a28a28a28a28a28a28a28a28a28a28a28a28a28a28a28a28a28a28a28a28a28a28a28a28a28a28a28a28a28a28a28a28a28a28a28a28a28a28" "pcbBinary": "60000000"} "AppLaunch.exe" called "CryptStringToBinaryA" with parameters {"pszString": "o9oooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooo" "cchString": "128" "dwFlags": "1" "pcbBinary": "60000000"} "AppLaunch.exe" called "CryptStringToBinaryA" with parameters {"pszString": "o9oooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooo" "cchString": "128" "dwFlags": "1" "pbBinary": "a3da28a28a28a28a28a28a28a28a28a28a28a28a28a28a28a28a28a28a28a28a28a28a28a28a28a28a28a28a28a28a28a28a28a28a28a28a28a28a28a28a28a28a28a28a28a28a28a28a28a28a28a28a28a28a28a28a28a28a28a28a28a28a28" "pcbBinary": "60000000"}2e:T131e,Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00005684-59150-15-00131F90 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00005684-59150-15-00131F90 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00005684-59150-16-001344B9 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00005684-59150-16-001344B9 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00005684-59150-22-0013681F Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00005684-59150-22-0013681F Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00005684-59150-26-001324E0 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00005684-59150-26-001324E0 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00005684-59150-29-001352B6 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00005684-59150-29-001352B6 Assembly shows XOR instruction xor eax esp in Stream UID: 00000000-00005684-59150-31-00132390 Assembly shows XOR instruction xor ecx esp in Stream UID: 00000000-00005684-59150-31-00132390 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00005684-59150-33-00132F1D Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00005684-59150-33-00132F1D Assembly shows XOR instruction xor eax esp in Stream UID: 00000000-00005684-59150-36-00133BA2 Assembly shows XOR instruction xor ecx esp in Stream UID: 00000000-00005684-59150-36-00133BA2 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00005684-59150-37-00133FEF Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00005684-59150-37-00133FEF Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00005684-59150-40-00132267 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00005684-59150-40-00132267 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00005684-59150-41-00136495 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00005684-59150-41-00136495 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00005684-59150-42-0013202A Assembly shows XOR instruction xor eax 01h in Stream UID: 00000000-00005684-59150-42-0013202A Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00005684-59150-42-0013202A Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00005684-59150-43-00131AE8 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00005684-59150-43-00131AE8 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00005684-59150-44-00132AAC Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00005684-59150-44-00132AAC Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00005684-59150-52-00134EFD Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00005684-59150-52-00134EFD Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00005684-59150-57-00136298 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00005684-59150-57-00136298 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00005684-59150-59-0013621E Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00005684-59150-59-0013621E Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00005684-59150-60-0013597D Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00005684-59150-60-0013597D Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00005684-59150-62-001355A0 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00005684-59150-62-001355A0 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00005684-59150-63-00135467 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00005684-59150-63-00135467 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00005684-59150-65-001353A1 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00005684-59150-65-001353A1 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00005684-59150-66-00132630 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00005684-59150-66-00132630 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00005684-59150-71-00132CAA Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00005684-59150-71-00132CAA Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00005684-59150-72-001318A3 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00005684-59150-72-001318A3 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00005684-59150-73-001317EE Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00005684-59150-73-001317EE2f:T32ae,Contains base64 string in header "2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP" in header "GET /gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "2FUsCEHe9DWzbNvka6iEPxPBY0w0" in header "GET /gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "Keep" in header "GET /gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "User" in header "GET /gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "ocsp" in header "GET /gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "goog" in header "GET /gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "Keep" in header "GET /r/r1.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: c.pki.goog" Contains base64 string in header "User" in header "GET /r/r1.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: c.pki.goog" Contains base64 string in header "goog" in header "GET /r/r1.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: c.pki.goog" Contains base64 string in header "/wr2/oBFYYahzgVI" in header "GET /wr2/oBFYYahzgVI.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: c.pki.goog" Contains base64 string in header "Keep" in header "GET /wr2/oBFYYahzgVI.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: c.pki.goog" Contains base64 string in header "User" in header "GET /wr2/oBFYYahzgVI.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: c.pki.goog" Contains base64 string in header "goog" in header "GET /wr2/oBFYYahzgVI.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: c.pki.goog" Contains base64 string in header "/wr2/75r4ZyA3vA0" in header "GET /wr2/75r4ZyA3vA0.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: c.pki.goog" Contains base64 string in header "Keep" in header "GET /wr2/75r4ZyA3vA0.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: c.pki.goog" Contains base64 string in header "User" in header "GET /wr2/75r4ZyA3vA0.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: c.pki.goog" Contains base64 string in header "goog" in header "GET /wr2/75r4ZyA3vA0.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: c.pki.goog" Contains base64 string in header "/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEA59dSNcqDdhV39MzSTNbR0" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEA59dSNcqDdhV39MzSTNbR0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.cn" Contains base64 string in header "Keep" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEA59dSNcqDdhV39MzSTNbR0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.cn" Contains base64 string in header "User" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEA59dSNcqDdhV39MzSTNbR0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.cn" Contains base64 string in header "ocsp" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEA59dSNcqDdhV39MzSTNbR0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.cn" Contains base64 string in header "digicert" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEA59dSNcqDdhV39MzSTNbR0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.cn" Contains base64 string in header "/wr2/9UVbN0w5E6Y" in header "GET /wr2/9UVbN0w5E6Y.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: c.pki.goog" Contains base64 string in header "Keep" in header "GET /wr2/9UVbN0w5E6Y.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: c.pki.goog" Contains base64 string in header "User" in header "GET /wr2/9UVbN0w5E6Y.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: c.pki.goog" Contains base64 string in header "goog" in header "GET /wr2/9UVbN0w5E6Y.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: c.pki.goog" Contains base64 string in header "Keep" in header "GET /r/gsr1.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: c.pki.goog" Contains base64 string in header "User" in header "GET /r/gsr1.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: c.pki.goog" Contains base64 string in header "goog" in header "GET /r/gsr1.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: c.pki.goog" Contains base64 string in header "Keep" in header "GET /r/r4.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: c.pki.goog" Contains base64 string in header "User" in header "GET /r/r4.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: c.pki.goog" Contains base64 string in header "goog" in header "GET /r/r4.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: c.pki.goog" Contains base64 string in header "/we1/pl4XiTjSDSk" in header "GET /we1/pl4XiTjSDSk.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: c.pki.goog" Contains base64 string in header "Keep" in header "GET /we1/pl4XiTjSDSk.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: c.pki.goog" Contains base64 string in header "User" in header "GET /we1/pl4XiTjSDSk.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: c.pki.goog" Contains base64 string in header "goog" in header "GET /we1/pl4XiTjSDSk.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: c.pki.goog" Contains base64 string in header "/we1/G0k" in header "GET /we1/G0k-BqpOX8k.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: c.pki.goog" Contains base64 string in header "Keep" in header "GET /we1/G0k-BqpOX8k.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: c.pki.goog" Contains base64 string in header "User" in header "GET /we1/G0k-BqpOX8k.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: c.pki.goog" Contains base64 string in header "goog" in header "GET /we1/G0k-BqpOX8k.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: c.pki.goog" Contains base64 string in header "Keep" in header "GET /we1/x6Eg-8TSwUw.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: c.pki.goog" Contains base64 string in header "User" in header "GET /we1/x6Eg-8TSwUw.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: c.pki.goog" Contains base64 string in header "goog" in header "GET /we1/x6Eg-8TSwUw.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: c.pki.goog" Contains base64 string in header "Keep" in header "GET /rootg2.cer HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: crt.rootg2.amazontrust.com" Contains base64 string in header "User" in header "GET /rootg2.cer HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: crt.rootg2.amazontrust.com" Contains base64 string in header "/MFQwUjBQME4wTDAJBgUrDgMCGgUABBSIfaREXmfqfJR3TkMYnD7O5MhzEgQUnF8A36oB1zArOIiiuG1KnPIRkYMCEwZ" in header "GET /MFQwUjBQME4wTDAJBgUrDgMCGgUABBSIfaREXmfqfJR3TkMYnD7O5MhzEgQUnF8A36oB1zArOIiiuG1KnPIRkYMCEwZ%2FlEoqJ83z%2BsKuKwH5CO65xMY%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.rootg2.amazontrust.com" Contains base64 string in header "2BsKuKwH5CO65xMY" in header "GET /MFQwUjBQME4wTDAJBgUrDgMCGgUABBSIfaREXmfqfJR3TkMYnD7O5MhzEgQUnF8A36oB1zArOIiiuG1KnPIRkYMCEwZ%2FlEoqJ83z%2BsKuKwH5CO65xMY%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.rootg2.amazontrust.com" Contains base64 string in header "Keep" in header "GET /MFQwUjBQME4wTDAJBgUrDgMCGgUABBSIfaREXmfqfJR3TkMYnD7O5MhzEgQUnF8A36oB1zArOIiiuG1KnPIRkYMCEwZ%2FlEoqJ83z%2BsKuKwH5CO65xMY%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.rootg2.amazontrust.com" Contains base64 string in header "User" in header "GET /MFQwUjBQME4wTDAJBgUrDgMCGgUABBSIfaREXmfqfJR3TkMYnD7O5MhzEgQUnF8A36oB1zArOIiiuG1KnPIRkYMCEwZ%2FlEoqJ83z%2BsKuKwH5CO65xMY%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.rootg2.amazontrust.com" Contains base64 string in header "ocsp" in header "GET /MFQwUjBQME4wTDAJBgUrDgMCGgUABBSIfaREXmfqfJR3TkMYnD7O5MhzEgQUnF8A36oB1zArOIiiuG1KnPIRkYMCEwZ%2FlEoqJ83z%2BsKuKwH5CO65xMY%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.rootg2.amazontrust.com" Contains base64 string in header "Keep" in header "GET /MFQwUjBQME4wTDAJBgUrDgMCGgUABBRPWaOUU8%2B5VZ5%2Fa9jFTaU9pkK3FAQUhBjMhTTsvAyUlC4IWZzHshBOCggCEwdzEk8qlS4%2B0YpYvbhdG8DOXyc%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.rootca1.amazontrust.com" Contains base64 string in header "User" in header "GET /MFQwUjBQME4wTDAJBgUrDgMCGgUABBRPWaOUU8%2B5VZ5%2Fa9jFTaU9pkK3FAQUhBjMhTTsvAyUlC4IWZzHshBOCggCEwdzEk8qlS4%2B0YpYvbhdG8DOXyc%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.rootca1.amazontrust.com" Contains base64 string in header "ocsp" in header "GET /MFQwUjBQME4wTDAJBgUrDgMCGgUABBRPWaOUU8%2B5VZ5%2Fa9jFTaU9pkK3FAQUhBjMhTTsvAyUlC4IWZzHshBOCggCEwdzEk8qlS4%2B0YpYvbhdG8DOXyc%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.rootca1.amazontrust.com" Contains base64 string in header "Keep" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTihuFvpmFDw5hOcIp918Jm5B3CQgQUH1KSYVaCVH%2BBZtgdPQqqMlyH3QgCEA3N2p7AWhpIo7uTRZjDirs%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.r2m04.amazontrust.com" Contains base64 string in header "User" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTihuFvpmFDw5hOcIp918Jm5B3CQgQUH1KSYVaCVH%2BBZtgdPQqqMlyH3QgCEA3N2p7AWhpIo7uTRZjDirs%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.r2m04.amazontrust.com" Contains base64 string in header "ocsp" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTihuFvpmFDw5hOcIp918Jm5B3CQgQUH1KSYVaCVH%2BBZtgdPQqqMlyH3QgCEA3N2p7AWhpIo7uTRZjDirs%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.r2m04.amazontrust.com" Contains base64 string in header "/wr2/oQ6nyr8F0m0" in header "GET /wr2/oQ6nyr8F0m0.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: c.pki.goog" Contains base64 string in header "Keep" in header "GET /wr2/oQ6nyr8F0m0.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: c.pki.goog" Contains base64 string in header "User" in header "GET /wr2/oQ6nyr8F0m0.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: c.pki.goog" Contains base64 string in header "goog" in header "GET /wr2/oQ6nyr8F0m0.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: c.pki.goog"30:T462,The analysis contains indicators for crypto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Able to use Microsoft's Enhanced Cryptographic Provider Matched sigs: Contains ability to perform AES/RC4 encryption (API string) Matched sigs: Contains ability to perform decryption (API string) Matched sigs: Able to decrypt/decode data Matched sigs: Contains ability to use Cryptographic classes Matched sigs: Decrypted SSL network traffic Matched sigs: Contains ability to perform Base64 encoding/decoding Matched sigs: Contains CRYPTO related strings Matched sigs: Contains ability to decode base64 data Matched sigs: Contains ability to encrypt/encode message (API string) Matched sigs: Contains reference to crypto DLLs Matched sigs: Calls an API typically used to import cryptographic keys into a CSP Matched sigs: HTTP requests contain Base64 strings Matched sigs: Dropped file has high entropy (likely encrypted/compressed content) Matched sigs: Sample file has high entropy (likely encrypted/compressed content) Matched sigs: Contains XOR operation loops [Stream disassembly]31:T3ab1,Found XOR loop in file "3Kn814gI.exe" at offset 72323; code bytes = 30d0 Found XOR loop in file "3Kn814gI.exe" at offset 122082; code bytes = 30d0 Found XOR loop in file "3Kn814gI.exe" at offset 376916; code bytes = 30d0 Found XOR loop in file "3Kn814gI.exe" at offset 376937; code bytes = 30d0 Found XOR loop in file "3Kn814gI.exe" at offset 691258; code bytes = 30d0 Found XOR loop in file "3Kn814gI.exe" at offset 887915; code bytes = 30d0 Found XOR loop in file "3Kn814gI.exe" at offset 888929; code bytes = 30d0 Found XOR loop in file "3Kn814gI.exe" at offset 891921; code bytes = 30d0 Found XOR loop in file "3Kn814gI.exe" at offset 900833; code bytes = 30d0 Found XOR loop in file "3Kn814gI.exe" at offset 913601; code bytes = 30d0 Found XOR loop in file "3Kn814gI.exe" at offset 130790; code bytes = 33c1 Found XOR loop in file "3Kn814gI.exe" at offset 140043; code bytes = 33c1 Found XOR loop in file "3Kn814gI.exe" at offset 140172; code bytes = 33c1 Found XOR loop in file "3Kn814gI.exe" at offset 351053; code bytes = 33c1 Found XOR loop in file "3Kn814gI.exe" at offset 463773; code bytes = 33c1 Found XOR loop in file "3Kn814gI.exe" at offset 463848; code bytes = 33c1 Found XOR loop in file "3Kn814gI.exe" at offset 597022; code bytes = 33c1 Found XOR loop in file "3Kn814gI.exe" at offset 701978; code bytes = 33c1 Found XOR loop in file "3Kn814gI.exe" at offset 709317; code bytes = 33c1 Found XOR loop in file "3Kn814gI.exe" at offset 709765; code bytes = 33c1 Found XOR loop in file "3Kn814gI.exe" at offset 710341; code bytes = 33c1 Found XOR loop in file "3Kn814gI.exe" at offset 710789; code bytes = 33c1 Found XOR loop in file "3Kn814gI.exe" at offset 895349; code bytes = 33c1 Found XOR loop in file "3Kn814gI.exe" at offset 905289; code bytes = 33c1 Found XOR loop in file "3Kn814gI.exe" at offset 1330; code bytes = 8030 Found XOR loop in file "3Kn814gI.exe" at offset 1959; code bytes = 8030 Found XOR loop in file "3Kn814gI.exe" at offset 232120; code bytes = 8030 Found XOR loop in file "3Kn814gI.exe" at offset 356589; code bytes = 8030 Found XOR loop in file "3Kn814gI.exe" at offset 674772; code bytes = 8030 Found XOR loop in file "3Kn814gI.exe" at offset 687130; code bytes = 8030 Found XOR loop in file "3Kn814gI.exe" at offset 887876; code bytes = 8030 Found XOR loop in file "3Kn814gI.exe" at offset 890824; code bytes = 8030 Found XOR loop in file "3Kn814gI.exe" at offset 894056; code bytes = 8030 Found XOR loop in file "3Kn814gI.exe" at offset 913562; code bytes = 8030 Found XOR loop in file "MP5ye33.exe" at offset 142185; code bytes = 30d0 Found XOR loop in file "MP5ye33.exe" at offset 199963; code bytes = 30d0 Found XOR loop in file "MP5ye33.exe" at offset 255110; code bytes = 30d0 Found XOR loop in file "MP5ye33.exe" at offset 300545; code bytes = 30d0 Found XOR loop in file "MP5ye33.exe" at offset 322962; code bytes = 30d0 Found XOR loop in file "MP5ye33.exe" at offset 344745; code bytes = 30d0 Found XOR loop in file "MP5ye33.exe" at offset 525543; code bytes = 30d0 Found XOR loop in file "MP5ye33.exe" at offset 547847; code bytes = 30d0 Found XOR loop in file "MP5ye33.exe" at offset 709748; code bytes = 30d0 Found XOR loop in file "MP5ye33.exe" at offset 26031; code bytes = 33c1 Found XOR loop in file "MP5ye33.exe" at offset 155201; code bytes = 33c1 Found XOR loop in file "MP5ye33.exe" at offset 168487; code bytes = 33c1 Found XOR loop in file "MP5ye33.exe" at offset 175490; code bytes = 33c1 Found XOR loop in file "MP5ye33.exe" at offset 339061; code bytes = 33c1 Found XOR loop in file "MP5ye33.exe" at offset 387317; code bytes = 33c1 Found XOR loop in file "MP5ye33.exe" at offset 395361; code bytes = 33c1 Found XOR loop in file "MP5ye33.exe" at offset 437823; code bytes = 33c1 Found XOR loop in file "MP5ye33.exe" at offset 533883; code bytes = 33c1 Found XOR loop in file "MP5ye33.exe" at offset 534338; code bytes = 33c1 Found XOR loop in file "MP5ye33.exe" at offset 599515; code bytes = 33c1 Found XOR loop in file "MP5ye33.exe" at offset 661501; code bytes = 33c1 Found XOR loop in file "MP5ye33.exe" at offset 700430; code bytes = 33c1 Found XOR loop in file "MP5ye33.exe" at offset 733622; code bytes = 33c1 Found XOR loop in file "MP5ye33.exe" at offset 840734; code bytes = 33c1 Found XOR loop in file "MP5ye33.exe" at offset 842042; code bytes = 33c1 Found XOR loop in file "MP5ye33.exe" at offset 898489; code bytes = 33c1 Found XOR loop in file "MP5ye33.exe" at offset 90891; code bytes = 8030 Found XOR loop in file "MP5ye33.exe" at offset 102399; code bytes = 8030 Found XOR loop in file "MP5ye33.exe" at offset 103104; code bytes = 8030 Found XOR loop in file "MP5ye33.exe" at offset 295946; code bytes = 8030 Found XOR loop in file "MP5ye33.exe" at offset 476662; code bytes = 8030 Found XOR loop in file "MP5ye33.exe" at offset 673630; code bytes = 8030 Found XOR loop in file "MP5ye33.exe" at offset 717097; code bytes = 8030 Found XOR loop in file "MP5ye33.exe" at offset 759145; code bytes = 8030 Found XOR loop in file "MP5ye33.exe" at offset 771067; code bytes = 8030 Found XOR loop in file "MP5ye33.exe" at offset 771363; code bytes = 8030 Found XOR loop in file "MP5ye33.exe" at offset 799137; code bytes = 8030 Found XOR loop in file "MP5ye33.exe" at offset 888901; code bytes = 8030 Found XOR loop in file "MP5ye33.exe" at offset 888941; code bytes = 8030 Found XOR loop in file "aR7ev61.exe" at offset 159610; code bytes = 30d0 Found XOR loop in file "aR7ev61.exe" at offset 205029; code bytes = 30d0 Found XOR loop in file "aR7ev61.exe" at offset 227429; code bytes = 30d0 Found XOR loop in file "aR7ev61.exe" at offset 249204; code bytes = 30d0 Found XOR loop in file "aR7ev61.exe" at offset 429904; code bytes = 30d0 Found XOR loop in file "aR7ev61.exe" at offset 452208; code bytes = 30d0 Found XOR loop in file "aR7ev61.exe" at offset 26031; code bytes = 33c1 Found XOR loop in file "aR7ev61.exe" at offset 243520; code bytes = 33c1 Found XOR loop in file "aR7ev61.exe" at offset 291751; code bytes = 33c1 Found XOR loop in file "aR7ev61.exe" at offset 299787; code bytes = 33c1 Found XOR loop in file "aR7ev61.exe" at offset 342225; code bytes = 33c1 Found XOR loop in file "aR7ev61.exe" at offset 438244; code bytes = 33c1 Found XOR loop in file "aR7ev61.exe" at offset 438699; code bytes = 33c1 Found XOR loop in file "aR7ev61.exe" at offset 503844; code bytes = 33c1 Found XOR loop in file "aR7ev61.exe" at offset 565798; code bytes = 33c1 Found XOR loop in file "aR7ev61.exe" at offset 671673; code bytes = 33c1 Found XOR loop in file "aR7ev61.exe" at offset 90891; code bytes = 8030 Found XOR loop in file "aR7ev61.exe" at offset 102399; code bytes = 8030 Found XOR loop in file "aR7ev61.exe" at offset 103104; code bytes = 8030 Found XOR loop in file "aR7ev61.exe" at offset 200430; code bytes = 8030 Found XOR loop in file "aR7ev61.exe" at offset 381056; code bytes = 8030 Found XOR loop in file "aR7ev61.exe" at offset 577927; code bytes = 8030 Found XOR loop in file "aR7ev61.exe" at offset 628788; code bytes = 8030 Found XOR loop in file "6pl671.exe" at offset 266103; code bytes = 30d0 Found XOR loop in file "6pl671.exe" at offset 442913; code bytes = 30d0 Found XOR loop in file "6pl671.exe" at offset 446647; code bytes = 30d0 Found XOR loop in file "6pl671.exe" at offset 455450; code bytes = 30d0 Found XOR loop in file "6pl671.exe" at offset 625782; code bytes = 30d0 Found XOR loop in file "6pl671.exe" at offset 637563; code bytes = 30d0 Found XOR loop in file "6pl671.exe" at offset 638587; code bytes = 30d0 Found XOR loop in file "6pl671.exe" at offset 1841; code bytes = 33c1 Found XOR loop in file "6pl671.exe" at offset 1929; code bytes = 33c1 Found XOR loop in file "6pl671.exe" at offset 1954; code bytes = 33c1 Found XOR loop in file "6pl671.exe" at offset 7850; code bytes = 33c1 Found XOR loop in file "6pl671.exe" at offset 9653; code bytes = 33c1 Found XOR loop in file "6pl671.exe" at offset 635869; code bytes = 33c1 Found XOR loop in file "6pl671.exe" at offset 405228; code bytes = 8030 Found XOR loop in file "6pl671.exe" at offset 413465; code bytes = 8030 Found XOR loop in file "6pl671.exe" at offset 451528; code bytes = 8030 Found XOR loop in file "6pl671.exe" at offset 452017; code bytes = 8030 Found XOR loop in file "6pl671.exe" at offset 501390; code bytes = 8030 Found XOR loop in file "6pl671.exe" at offset 505352; code bytes = 8030 Found XOR loop in file "6pl671.exe" at offset 637544; code bytes = 8030 Found XOR loop in file "6pl671.exe" at offset 638568; code bytes = 8030 Found XOR loop in file "5ip71Yr.exe" at offset 262880; code bytes = 30d0 Found XOR loop in file "5ip71Yr.exe" at offset 320635; code bytes = 30d0 Found XOR loop in file "5ip71Yr.exe" at offset 321659; code bytes = 30d0 Found XOR loop in file "5ip71Yr.exe" at offset 1841; code bytes = 33c1 Found XOR loop in file "5ip71Yr.exe" at offset 1929; code bytes = 33c1 Found XOR loop in file "5ip71Yr.exe" at offset 1954; code bytes = 33c1 Found XOR loop in file "5ip71Yr.exe" at offset 7850; code bytes = 33c1 Found XOR loop in file "5ip71Yr.exe" at offset 9653; code bytes = 33c1 Found XOR loop in file "5ip71Yr.exe" at offset 318941; code bytes = 33c1 Found XOR loop in file "5ip71Yr.exe" at offset 320616; code bytes = 8030 Found XOR loop in file "5ip71Yr.exe" at offset 321640; code bytes = 8030 Found XOR loop in file "4NU6qK7.exe" at offset 210726; code bytes = 30d0 Found XOR loop in file "4NU6qK7.exe" at offset 280699; code bytes = 30d0 Found XOR loop in file "4NU6qK7.exe" at offset 281723; code bytes = 30d0 Found XOR loop in file "4NU6qK7.exe" at offset 1841; code bytes = 33c1 Found XOR loop in file "4NU6qK7.exe" at offset 1929; code bytes = 33c1 Found XOR loop in file "4NU6qK7.exe" at offset 1954; code bytes = 33c1 Found XOR loop in file "4NU6qK7.exe" at offset 7850; code bytes = 33c1 Found XOR loop in file "4NU6qK7.exe" at offset 9653; code bytes = 33c1 Found XOR loop in file "4NU6qK7.exe" at offset 94143; code bytes = 33c1 Found XOR loop in file "4NU6qK7.exe" at offset 110895; code bytes = 33c1 Found XOR loop in file "4NU6qK7.exe" at offset 114931; code bytes = 33c1 Found XOR loop in file "4NU6qK7.exe" at offset 117423; code bytes = 33c1 Found XOR loop in file "4NU6qK7.exe" at offset 119803; code bytes = 33c1 Found XOR loop in file "4NU6qK7.exe" at offset 121015; code bytes = 33c1 Found XOR loop in file "4NU6qK7.exe" at offset 126489; code bytes = 33c1 Found XOR loop in file "4NU6qK7.exe" at offset 126728; code bytes = 33c1 Found XOR loop in file "4NU6qK7.exe" at offset 128904; code bytes = 33c1 Found XOR loop in file "4NU6qK7.exe" at offset 131951; code bytes = 33c1 Found XOR loop in file "4NU6qK7.exe" at offset 139401; code bytes = 33c1 Found XOR loop in file "4NU6qK7.exe" at offset 181679; code bytes = 33c1 Found XOR loop in file "4NU6qK7.exe" at offset 206488; code bytes = 33c1 Found XOR loop in file "4NU6qK7.exe" at offset 279005; code bytes = 33c1 Found XOR loop in file "4NU6qK7.exe" at offset 280680; code bytes = 8030 Found XOR loop in file "4NU6qK7.exe" at offset 281704; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 181186; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 203004; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 221981; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 350962; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 396430; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 418847; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 440655; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 621534; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 643854; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 805828; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 986097; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1010971; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1074459; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1220681; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1231994; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1280580; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 26031; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 283734; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 287364; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 434971; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 483235; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 491287; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 533774; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 629874; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 630345; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 695538; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 757557; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 796510; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 829727; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 936880; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 938188; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 968036; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 991324; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1139828; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1319396; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1327033; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 90891; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 102399; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 103104; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 278994; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 391831; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 572637; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 769702; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 813177; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 855258; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 867180; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 867476; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 895275; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1039557; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1065136; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1241831; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1267489; code bytes = 803032:T425,file/memory contains long string with (Indicator: "youtube.com"; File: "supported_browsers_1_.htm") file/memory contains long string with (Indicator: "youtube.com"; File: "PBCDJ3DP.txt") file/memory contains long string with (Indicator: "youtube.com"; File: "IREV43C4.txt") file/memory contains long string with (Indicator: "youtube.com"; File: "0M7MQNGH.txt") file/memory contains long string with (Indicator: "youtube.com"; File: "I8LVHTYQ.txt") file/memory contains long string with (Indicator: "youtube.com"; File: "G9ASQ31B.txt") file/memory contains long string with (Indicator: "youtube.com"; File: "4JZE0BB8.txt") Found string "CONSENTWP.2676bayoutube.com/102431383388163210825482504061830633367" (Indicator: "youtube.com"; File: "NDW6AAC1.txt") Found string "accounts.youtube.com" (Indicator: "youtube.com"; File: "PCAP") Found string "www.paypal.com" (Indicator: "paypal.com"; File: "PCAP") Found string "www.youtube.com" (Indicator: "youtube.com"; File: "PCAP") file/memory contains long string with (Indicator: "youtube.com"; File: "SSL")33:T44b,Found reference to API "GetDriveTypeA" (Indicator: "GetDriveTypeA"; File: "7ef834fc890f8f801316f859915cba63a0771e89738a882bca0656fda5a74ddf") Found reference to API "GetDriveTypeW" (Indicator: "GetDriveTypeW"; File: "7ef834fc890f8f801316f859915cba63a0771e89738a882bca0656fda5a74ddf") Found reference to API "GetLogicalDrives" (Indicator: "GetLogicalDrives"; File: "00002372.00000944.899679.00402000.wprm") Found reference to API "GetLogicalDrives" (Indicator: "GetLogicalDrives"; Source: "00000000-00000844.00000000.78487.00E48000.00000004.mdmp") Found reference to API "GetDriveTypeW" (Indicator: "GetDriveTypeW"; Source: "00000000-00004076.00000000.78873.009C8000.00000004.mdmp") Found reference to API "GetLogicalDrives" (Indicator: "GetLogicalDrives"; Source: "00000000-00004076.00000000.78873.009C8000.00000004.mdmp") Found reference to API "GetDriveTypeA" (Indicator: "GetDriveTypeA"; Source: "00000000-00005684.00000001.77329.0013A000.00000002.mdmp") Found reference to API "GetDriveTypeA" (Indicator: "GetDriveTypeA"; Source: "00000000-00005708.00000001.77262.00E8A000.00000002.mdmp")34:T704,file/memory contains long string with (Indicator: "GetCommandLine"; File: "6pl671.exe") file/memory contains long string with (Indicator: "GetCommandLine"; File: "5ip71Yr.exe") file/memory contains long string with (Indicator: "GetCommandLine"; File: "4NU6qK7.exe") Found string "GetCommandLineW" (Indicator: "GetCommandLine"; File: "7ef834fc890f8f801316f859915cba63a0771e89738a882bca0656fda5a74ddf") Found string "GetCommandLineA" (Indicator: "GetCommandLine"; File: "7ef834fc890f8f801316f859915cba63a0771e89738a882bca0656fda5a74ddf") Found string "GetCursorPos" (Indicator: "GetCursorPos"; File: "7ef834fc890f8f801316f859915cba63a0771e89738a882bca0656fda5a74ddf") Found string "GetCursorPos" (Indicator: "GetCursorPos"; Source: "00000000-00000844.00000000.78487.00E48000.00000004.mdmp") Found string "GetCommandLineA" (Indicator: "GetCommandLine"; Source: "00000000-00000844.00000000.78492.00E40000.00000002.mdmp") Found string "GetCommandLineW" (Indicator: "GetCommandLine"; Source: "00000000-00000844.00000000.78492.00E40000.00000002.mdmp") Found string "GetCommandLineA" (Indicator: "GetCommandLine"; Source: "00000000-00001832.00000000.78150.001E8000.00000004.mdmp, 00000000-00001832.00000000.78155.001E0000.00000002.mdmp") Found string "GetCommandLineW" (Indicator: "GetCommandLine"; Source: "00000000-00001832.00000000.78150.001E8000.00000004.mdmp, 00000000-00001832.00000000.78155.001E0000.00000002.mdmp") Found string "GetCommandLineA" (Indicator: "GetCommandLine"; Source: "00000000-00004076.00000000.78867.009C0000.00000002.mdmp, 00000000-00004076.00000000.78873.009C8000.00000004.mdmp") Found string "GetCommandLineW" (Indicator: "GetCommandLine"; Source: "00000000-00004076.00000000.78867.009C0000.00000002.mdmp, 00000000-00004076.00000000.78873.009C8000.00000004.mdmp")35:T532,Found reference to API "GetKeyboardLayoutNameW" (Indicator: "GetKeyboardLayout"; File: "7ef834fc890f8f801316f859915cba63a0771e89738a882bca0656fda5a74ddf") Found reference to API "GetSystemDefaultLangID" (Indicator: "GetSystemDefaultLangID"; File: "00003020.00000BCC.2569590.00473000.wprm") Found reference to API "GetSystemDefaultUILanguage" (Indicator: "GetSystemDefaultUILanguage"; File: "00003020.00000BCC.2569590.00473000.wprm") Found reference to API "GetUserDefaultLangID" (Indicator: "GetUserDefaultLangID"; File: "00003020.00000BCC.2569590.00473000.wprm") Found reference to API "GetUserDefaultUILanguage" (Indicator: "GetUserDefaultUILanguage"; File: "00003020.00000BCC.2569590.00473000.wprm") Found reference to API "GetSystemDefaultLangID" (Indicator: "GetSystemDefaultLangID"; Source: "00000000-00004076.00000000.78873.009C8000.00000004.mdmp") Found reference to API "GetSystemDefaultUILanguage" (Indicator: "GetSystemDefaultUILanguage"; Source: "00000000-00004076.00000000.78873.009C8000.00000004.mdmp") Found reference to API "GetUserDefaultLangID" (Indicator: "GetUserDefaultLangID"; Source: "00000000-00004076.00000000.78873.009C8000.00000004.mdmp") Found reference to API "GetUserDefaultUILanguage" (Indicator: "GetUserDefaultUILanguage"; Source: "00000000-00004076.00000000.78873.009C8000.00000004.mdmp")36:T3408,"7ef834fc890f8f801316f859915cba63a0771e89738a882bca0656fda5a74ddf.exe" called "RtlGetVersion" with parameter 000000000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00005936) "MP5ye33.exe" called "RtlGetVersion" with parameter 140100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00005708) "MP5ye33.exe" called "RtlGetVersion" with parameter 000000000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00005708) "aR7ev61.exe" called "RtlGetVersion" with parameter 000000000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00005684) "3Kn814gI.exe" called "RtlGetVersion" with parameter 140100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00005948) "3Kn814gI.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00005948) "3Kn814gI.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b00200031000000000003000000b4e1a002c0e1a00288e3a00292e0c86bcd5625e9feffffff08e3a00216bcc76b66b84b70030000003ce2a00208e3a00220bcc76b060000000000716a010000002fbcc76b2a0000000600000066b84b7003000000000000000000000000010000000300000004000000010000000000000001cf6d6c0c6e496e6465780000000000000000000000000000000000000000000000000000010000000000000000020000000300000004000000010000000000000001cf6d6c0c2461706952657475726e0000000000000000000000000000000000000000000002000000 (UID: 00000000-00005948) "3Kn814gI.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b002000310000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000004ce3a00200000000760000009ce3a002feffffff24e3a002cf002a77d6002a776d808075760000003b0000009ce3a00200000000f8e2a0020000000060e3a00295e1257751650900feffffffd6002a772f7b2e75010000005900b406167b2e75fdb44c80 (UID: 00000000-00005948) "3Kn814gI.exe" called "RtlGetVersion" with parameter 000000000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00005948) "3Kn814gI.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000300000044de910250de910218e0910292e0c86bcd5625e9feffffff98df910216bcc76b1a657ba105000000ccde910298df910220bcc76b820500000000716a010000002fbcc76b2a000000820500001a657ba105000000000000000000000000010000000300000004000000010000000000000001cf6d6c0c6e496e6465780000000000000000000000000000000000000000000000000000010000000000000000020000000300000004000000010000000000000001cf6d6c0c2461706952657475726e0000000000000000000000000000000000000000000002000000 (UID: 00000000-00005948) "3Kn814gI.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000300000014e4a70220e4a702e8e5a70292e0c86bcd5625e9feffffff68e5a70216bcc76b3e922aa6070000009ce4a70268e5a70220bcc76b820500000000716a010000002fbcc76b2a000000820500003e922aa607000000000000000000000000010000000300000004000000010000000000000001cf6d6c0c6e496e6465780000000000000000000000000000000000000000000000000000010000000000000000020000000300000004000000010000000000000001cf6d6c0c2461706952657475726e0000000000000000000000000000000000000000000002000000 (UID: 00000000-00005948) "3Kn814gI.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b00200031000000000003000000b4dccb03c0dccb0388decb0392e0c86bcd5625e9feffffff08decb0316bcc76b8c42288b090000003cddcb0308decb0320bcc76b820500000000716a010000002fbcc76b2a000000820500008c42288b09000000000000000000000000010000000300000004000000010000000000000001cf6d6c0c6e496e6465780000000000000000000000000000000000000000000000000000010000000000000000020000000300000004000000010000000000000001cf6d6c0c2461706952657475726e0000000000000000000000000000000000000000000002000000 (UID: 00000000-00005948) "3Kn814gI.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b00200031000000000003000000f4dcb40200ddb402c8deb40292e0c86bcd5625e9feffffff48deb40216bcc76bfcacc9990b0000007cddb40248deb40220bcc76b820500000000716a010000002fbcc76b2a00000082050000fcacc9990b000000000000000000000000010000000300000004000000010000000000000001cf6d6c0c6e496e6465780000000000000000000000000000000000000000000000000000010000000000000000020000000300000004000000010000000000000001cf6d6c0c2461706952657475726e0000000000000000000000000000000000000000000002000000 (UID: 00000000-00005948) "3Kn814gI.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000300000004e3b00210e3b002d8e4b00292e0c86bcd5625e9feffffff58e4b00216bcc76be2b36b840d0000008ce3b00258e4b00220bcc76b820500000000716a010000002fbcc76b2a00000082050000e2b36b840d000000000000000000000000010000000300000004000000010000000000000001cf6d6c0c6e496e6465780000000000000000000000000000000000000000000000000000010000000000000000020000000300000004000000010000000000000001cf6d6c0c2461706952657475726e0000000000000000000000000000000000000000000002000000 (UID: 00000000-00005948) "3Kn814gI.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000300000054dd980260dd980228df980292e0c86bcd5625e9feffffffa8de980216bcc76b5a37df640f000000dcdd9802a8de980220bcc76b820500000000716a010000002fbcc76b2a000000820500005a37df640f000000000000000000000000010000000300000004000000010000000000000001cf6d6c0c6e496e6465780000000000000000000000000000000000000000000000000000010000000000000000020000000300000004000000010000000000000001cf6d6c0c2461706952657475726e0000000000000000000000000000000000000000000002000000 (UID: 00000000-00005948) "3Kn814gI.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000300000024dfa60230dfa602f8e0a60292e0c86bcd5625e9feffffff78e0a60216bcc76b3e73904a11000000acdfa60278e0a60220bcc76b820500000000716a010000002fbcc76b2a000000820500003e73904a11000000000000000000000000010000000300000004000000010000000000000001cf6d6c0c6e496e6465780000000000000000000000000000000000000000000000000000010000000000000000020000000300000004000000010000000000000001cf6d6c0c2461706952657475726e0000000000000000000000000000000000000000000002000000 (UID: 00000000-00005948) "3Kn814gI.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b00200031000000000003000000c4ded003d0ded00398e0d00392e0c86bcd5625e9feffffff18e0d00316bcc76b12a8f55f130000004cdfd00318e0d00320bcc76b820500000000716a010000002fbcc76b2a0000008205000012a8f55f13000000000000000000000000010000000300000004000000010000000000000001cf6d6c0c6e496e6465780000000000000000000000000000000000000000000000000000010000000000000000020000000300000004000000010000000000000001cf6d6c0c2461706952657475726e0000000000000000000000000000000000000000000002000000 (UID: 00000000-00005948) "3Kn814gI.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000300000094dd9602a0dd960268df960292e0c86bcd5625e9feffffffe8de960216bcc76b0457f5d7150000001cde9602e8de960220bcc76b820500000000716a010000002fbcc76b2a000000820500000457f5d715000000000000000000000000010000000300000004000000010000000000000001cf6d6c0c6e496e6465780000000000000000000000000000000000000000000000000000010000000000000000020000000300000004000000010000000000000001cf6d6c0c2461706952657475726e0000000000000000000000000000000000000000000002000000 (UID: 00000000-00005948) "4NU6qK7.exe" called "RtlGetVersion" with parameter 140100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00001832) "4NU6qK7.exe" called "RtlGetVersion" with parameter 000000000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00001832) "5ip71Yr.exe" called "RtlGetVersion" with parameter 140100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00000844)37:T6c1,"7ef834fc890f8f801316f859915cba63a0771e89738a882bca0656fda5a74ddf.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "7ef834fc890f8f801316f859915cba63a0771e89738a882bca0656fda5a74ddf.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "MP5ye33.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "MP5ye33.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "aR7ev61.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "aR7ev61.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "3Kn814gI.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "3Kn814gI.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "4NU6qK7.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "4NU6qK7.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "5ip71Yr.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "5ip71Yr.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "6pl671.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "6pl671.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED")38:T5e1,Found reference to API "EnumWindows" (Indicator: "EnumWindows"; File: "7ef834fc890f8f801316f859915cba63a0771e89738a882bca0656fda5a74ddf") Found reference to API "GetActiveWindow" (Indicator: "GetActiveWindow"; File: "7ef834fc890f8f801316f859915cba63a0771e89738a882bca0656fda5a74ddf") Found reference to API "FindWindowW" (Indicator: "FindWindow"; File: "7ef834fc890f8f801316f859915cba63a0771e89738a882bca0656fda5a74ddf") Found reference to API "GetWindowTextLengthW" (Indicator: "GetWindowText"; File: "7ef834fc890f8f801316f859915cba63a0771e89738a882bca0656fda5a74ddf") Found reference to API "GetWindowTextW" (Indicator: "GetWindowText"; File: "7ef834fc890f8f801316f859915cba63a0771e89738a882bca0656fda5a74ddf") Found reference to API "GetForegroundWindow" (Indicator: "GetForegroundWindow"; File: "7ef834fc890f8f801316f859915cba63a0771e89738a882bca0656fda5a74ddf") Found reference to API "FindWindowExW" (Indicator: "FindWindow"; File: "7ef834fc890f8f801316f859915cba63a0771e89738a882bca0656fda5a74ddf") Found reference to API "GetWindowText" (Indicator: "GetWindowText"; File: "00002372.00000944.899679.00402000.wprm") Found reference to API "FindWindow" (Indicator: "FindWindow"; File: "00002372.00000944.899679.00402000.wprm") Found reference to API "GetWindowText" (Indicator: "GetWindowText"; Source: "00000000-00000844.00000000.78487.00E48000.00000004.mdmp") Found reference to API "FindWindow" (Indicator: "FindWindow"; Source: "00000000-00000844.00000000.78487.00E48000.00000004.mdmp")39:T4b7,"AppLaunch.exe" queries volume information of "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe" at 00000000-00002372-0000010C-535574 "AppLaunch.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel\v4.0_4.0.0.0__b77a5c561934e089\System.ServiceModel.dll" at 00000000-00002372-0000010C-3091103 "AppLaunch.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel\v4.0_4.0.0.0__b77a5c561934e089\System.ServiceModel.dll" at 00000000-00002372-0000010C-3098794 "AppLaunch.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel.Internals\v4.0_4.0.0.0__31bf3856ad364e35\System.ServiceModel.Internals.dll" at 00000000-00002372-0000010C-3709056 "AppLaunch.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel.Internals\v4.0_4.0.0.0__31bf3856ad364e35\System.ServiceModel.Internals.dll" at 00000000-00002372-0000010C-3713067 "AppLaunch.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll" at 00000000-00002372-0000010C-41405943a:T30a5,"7ef834fc890f8f801316f859915cba63a0771e89738a882bca0656fda5a74ddf.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\advpack.dll (UID: 00000000-00005936) "MP5ye33.exe" called "LoadLibrary" with a parameter feclient.dll (UID: 00000000-00005708) "MP5ye33.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\advpack.dll (UID: 00000000-00005708) "aR7ev61.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\advpack.dll (UID: 00000000-00005684) "3Kn814gI.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\uxtheme.dll (UID: 00000000-00005948) "3Kn814gI.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00005948) "3Kn814gI.exe" called "LoadLibrary" with a parameter %TEMP%\IXP002.TMP\3Kn814gI.exe (UID: 00000000-00005948) "3Kn814gI.exe" called "LoadLibrary" with a parameter api-ms-win-core-sysinfo-l1-2-1 (UID: 00000000-00005948) "3Kn814gI.exe" called "LoadLibrary" with a parameter dwmapi.dll (UID: 00000000-00005948) "3Kn814gI.exe" called "LoadLibrary" with a parameter comctl32.dll (UID: 00000000-00005948) "3Kn814gI.exe" called "LoadLibrary" with a parameter UxTheme.dll (UID: 00000000-00005948) "3Kn814gI.exe" called "LoadLibrary" with a parameter IMM32.dll (UID: 00000000-00005948) "3Kn814gI.exe" called "LoadLibrary" with a parameter comctl32 (UID: 00000000-00005948) "3Kn814gI.exe" called "LoadLibrary" with a parameter SHELL32.dll (UID: 00000000-00005948) "3Kn814gI.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00005948) "3Kn814gI.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00005948) "3Kn814gI.exe" called "LoadLibrary" with a parameter propsys.dll (UID: 00000000-00005948) "3Kn814gI.exe" called "LoadLibrary" with a parameter %WINDIR%\System32\ieframe.dll (UID: 00000000-00005948) "3Kn814gI.exe" called "LoadLibrary" with a parameter api-ms-win-downlevel-ole32-l1-1-0.dll (UID: 00000000-00005948) "3Kn814gI.exe" called "LoadLibrary" with a parameter urlmon.dll (UID: 00000000-00005948) "3Kn814gI.exe" called "LoadLibrary" with a parameter api-ms-win-downlevel-shlwapi-l2-1-0.dll (UID: 00000000-00005948) "3Kn814gI.exe" called "LoadLibrary" with a parameter PROPSYS.dll (UID: 00000000-00005948) "3Kn814gI.exe" called "LoadLibrary" with a parameter %PROGRAMFILES%\Internet Explorer\ieproxy.dll (UID: 00000000-00005948) "3Kn814gI.exe" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00005948) "3Kn814gI.exe" called "LoadLibrary" with a parameter iertutil.dll (UID: 00000000-00005948) "3Kn814gI.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00005948) "3Kn814gI.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-1 (UID: 00000000-00005948) "3Kn814gI.exe" called "LoadLibrary" with a parameter ext-ms-win-kernel32-package-current-l1-1-0 (UID: 00000000-00005948) "4NU6qK7.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2 (UID: 00000000-00001832) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\combase.dll (UID: 00000000-00002372) "AppLaunch.exe" called "LoadLibrary" with a parameter psapi.dll (UID: 00000000-00002372) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\mscorlib\36eaccfde177c2e7b93b8dbdde4e012a\mscorlib.ni.dll (UID: 00000000-00002372) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\ole32.dll (UID: 00000000-00002372) "AppLaunch.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00002372) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\uxtheme.dll (UID: 00000000-00002372) "AppLaunch.exe" called "LoadLibrary" with a parameter api-ms-win-core-xstate-l2-1-0.dll (UID: 00000000-00002372) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\clrjit.dll (UID: 00000000-00002372) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System\2c3c912ea8f058f9d04c4650128feb3f\System.ni.dll (UID: 00000000-00002372) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Drawing\f7568d7f1b9d356f64779b4c0927cfb3\System.Drawing.ni.dll (UID: 00000000-00002372) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Windows.Forms\c9a4cbc00f690a9e3cddfc400f6e85bb\System.Windows.Forms.ni.dll (UID: 00000000-00002372) "AppLaunch.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00002372) "AppLaunch.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00002372) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\uxtheme.dll (UID: 00000000-00002372) "AppLaunch.exe" called "LoadLibrary" with a parameter uxtheme.dll (UID: 00000000-00002372) "AppLaunch.exe" called "LoadLibrary" with a parameter user32.dll (UID: 00000000-00002372) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Core\31fae3290fad30c31c98651462d22724\System.Core.ni.dll (UID: 00000000-00002372) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Configuration\96f7edb07b12303f0ec2595c7f3778c7\System.Configuration.ni.dll (UID: 00000000-00002372) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Xml\15af16d373cf0528cb74fc73d365fdbf\System.Xml.ni.dll (UID: 00000000-00002372) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\nlssorting.dll (UID: 00000000-00002372) "AppLaunch.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00002372) "AppLaunch.exe" called "LoadLibrary" with a parameter shell32.dll (UID: 00000000-00002372) "AppLaunch.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00002372) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll (UID: 00000000-00002372) "AppLaunch.exe" called "LoadLibrary" with a parameter bcrypt.dll (UID: 00000000-00002372) "AppLaunch.exe" called "LoadLibrary" with a parameter CRYPTSP.dll (UID: 00000000-00002372) "AppLaunch.exe" called "LoadLibrary" with a parameter CRYPTBASE.dll (UID: 00000000-00002372) "AppLaunch.exe" called "LoadLibrary" with a parameter imm32.dll (UID: 00000000-00002372) "AppLaunch.exe" called "LoadLibrary" with a parameter comctl32.dll (UID: 00000000-00002372) "AppLaunch.exe" called "LoadLibrary" with a parameter gdi32.dll (UID: 00000000-00002372) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\WindowsBase\1a4cc316fb6d09525321fc0be44692d8\WindowsBase.ni.dll (UID: 00000000-00002372) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\PresentationCore\468f4e17be144ca12a73a4297eacc9cc\PresentationCore.ni.dll (UID: 00000000-00002372) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\Presentatio5ae0f00f#\252cc7b0fae8cfe083bdc149957c0c54\PresentationFramework.ni.dll (UID: 00000000-00002372) "AppLaunch.exe" called "LoadLibrary" with a parameter KERNEL32.dll (UID: 00000000-00002372) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\PresentationCore\v4.0_4.0.0.0__31bf3856ad364e35\ucrtbase_clr0400.dll (UID: 00000000-00002372) "AppLaunch.exe" called "LoadLibrary" with a parameter ucrtbase_clr0400.dll (UID: 00000000-00002372) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\PresentationCore\v4.0_4.0.0.0__31bf3856ad364e35\SHLWAPI.dll (UID: 00000000-00002372) "AppLaunch.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00002372) "AppLaunch.exe" called "LoadLibrary" with a parameter dwrite.dll (UID: 00000000-00002372) "AppLaunch.exe" called "LoadLibrary" with a parameter api-ms-win-core-string-l1-1-0 (UID: 00000000-00002372) "AppLaunch.exe" called "LoadLibrary" with a parameter api-ms-win-core-datetime-l1-1-1 (UID: 00000000-00002372) "AppLaunch.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-obsolete-l1-2-0 (UID: 00000000-00002372) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\WPF\wpfgfx_v0400.dll (UID: 00000000-00002372) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\WPF\PresentationNative_v0400.dll (UID: 00000000-00002372) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll (UID: 00000000-00002372) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\en-US\tzres.dll.mui (UID: 00000000-00002372) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\VERSION.dll (UID: 00000000-00002372) "AppLaunch.exe" called "LoadLibrary" with a parameter VERSION.dll (UID: 00000000-00002372) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.ServiceModel\v4.0_4.0.0.0__b77a5c561934e089\System.ServiceModel.dll (UID: 00000000-00002372) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Runteb92aa12#\274e43040c8a7a02ef1065db3283005a\System.Runtime.Serialization. (UID: 00000000-00002372) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.IdentityModel\c2ef5bc545b98a289f02d0b3eddbe280\System.IdentityModel.ni.dll (UID: 00000000-00002372) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\SMDiagnostics\dc67dcb4b2fb4a3853d458cab08561f0\SMDiagnostics.ni.dll (UID: 00000000-00002372) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.ServiceModel.Internals\v4.0_4.0.0.0__31bf3856ad364e35\System.ServiceModel.Intern (UID: 00000000-00002372) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Transactions\3d760b4a3260a41ef84a3fd866780980\System.Transactions.ni.dll (UID: 00000000-00002372) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\clr.dll (UID: 00000000-00002372) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll (UID: 00000000-00002372) "AppLaunch.exe" called "LoadLibrary" with a parameter mscoree.dll (UID: 00000000-00002372) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ws2_32.dll (UID: 00000000-00002372) "AppLaunch.exe" called "LoadLibrary" with a parameter ws2_32.dll (UID: 00000000-00002372) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\diasymreader.dll (UID: 00000000-00002372) "6pl671.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00004076) "6pl671.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2 (UID: 00000000-00004076) "AppLaunch.exe" called "LoadLibrary" with a parameter WS2_32.dll (UID: 00000000-00003020) "AppLaunch.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00003020) "AppLaunch.exe" called "LoadLibrary" with a parameter SspiCli.dll (UID: 00000000-00003020) "AppLaunch.exe" called "LoadLibrary" with a parameter RPCRT4.dll (UID: 00000000-00003020) "AppLaunch.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00003020) "AppLaunch.exe" called "LoadLibrary" with a parameter wshtcpip (UID: 00000000-00003020) "AppLaunch.exe" called "LoadLibrary" with a parameter wship6.dll (UID: 00000000-00003020) "AppLaunch.exe" called "LoadLibrary" with a parameter DNSAPI.dll (UID: 00000000-00003020) "AppLaunch.exe" called "LoadLibrary" with a parameter winhttp.dll (UID: 00000000-00003020) "AppLaunch.exe" called "LoadLibrary" with a parameter CRYPT32.dll (UID: 00000000-00003020)3b:Ta190,"7ef834fc890f8f801316f859915cba63a0771e89738a882bca0656fda5a74ddf.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00005936) "7ef834fc890f8f801316f859915cba63a0771e89738a882bca0656fda5a74ddf.exe" called "GetProcAddress" with a parameter DelNodeRunDLL32 (UID: 00000000-00005936) "7ef834fc890f8f801316f859915cba63a0771e89738a882bca0656fda5a74ddf.exe" called "GetProcAddress" with a parameter UnregisterTraceGuids (UID: 00000000-00005936) "MP5ye33.exe" called "GetProcAddress" with a parameter DecryptFileA (UID: 00000000-00005708) "MP5ye33.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00005708) "MP5ye33.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00005708) "MP5ye33.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00005708) "MP5ye33.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00005708) "MP5ye33.exe" called "GetProcAddress" with a parameter FeClientInitialize (UID: 00000000-00005708) "MP5ye33.exe" called "GetProcAddress" with a parameter DelNodeRunDLL32 (UID: 00000000-00005708) "MP5ye33.exe" called "GetProcAddress" with a parameter UnregisterTraceGuids (UID: 00000000-00005708) "aR7ev61.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00005684) "aR7ev61.exe" called "GetProcAddress" with a parameter DelNodeRunDLL32 (UID: 00000000-00005684) "aR7ev61.exe" called "GetProcAddress" with a parameter UnregisterTraceGuids (UID: 00000000-00005684) "3Kn814gI.exe" called "GetProcAddress" with a parameter ThemeInitApiHook (UID: 00000000-00005948) "3Kn814gI.exe" called "GetProcAddress" with a parameter IsProcessDPIAware (UID: 00000000-00005948) "3Kn814gI.exe" called "GetProcAddress" with a parameter Wow64DisableWow64FsRedirection (UID: 00000000-00005948) "3Kn814gI.exe" called "GetProcAddress" with a parameter Wow64RevertWow64FsRedirection (UID: 00000000-00005948) "3Kn814gI.exe" called "GetProcAddress" with a parameter DwmIsCompositionEnabled (UID: 00000000-00005948) "3Kn814gI.exe" called "GetProcAddress" with a parameter RegisterClassNameW (UID: 00000000-00005948) "3Kn814gI.exe" called "GetProcAddress" with a parameter OpenThemeData (UID: 00000000-00005948) "3Kn814gI.exe" called "GetProcAddress" with a parameter GetThemeBool (UID: 00000000-00005948) "3Kn814gI.exe" called "GetProcAddress" with a parameter ImmGetContext (UID: 00000000-00005948) "3Kn814gI.exe" called "GetProcAddress" with a parameter ImmReleaseContext (UID: 00000000-00005948) "3Kn814gI.exe" called "GetProcAddress" with a parameter ImmAssociateContext (UID: 00000000-00005948) "3Kn814gI.exe" called "GetProcAddress" with a parameter ImmIsIME (UID: 00000000-00005948) "3Kn814gI.exe" called "GetProcAddress" with a parameter HIMAGELIST_QueryInterface (UID: 00000000-00005948) "3Kn814gI.exe" called "GetProcAddress" with a parameter DrawShadowText (UID: 00000000-00005948) "3Kn814gI.exe" called "GetProcAddress" with a parameter DrawSizeBox (UID: 00000000-00005948) "3Kn814gI.exe" called "GetProcAddress" with a parameter DrawScrollBar (UID: 00000000-00005948) "3Kn814gI.exe" called "GetProcAddress" with a parameter SizeBoxHwnd (UID: 00000000-00005948) "3Kn814gI.exe" called "GetProcAddress" with a parameter ScrollBar_MouseMove (UID: 00000000-00005948) "3Kn814gI.exe" called "GetProcAddress" with a parameter ScrollBar_Menu (UID: 00000000-00005948) "3Kn814gI.exe" called "GetProcAddress" with a parameter HandleScrollCmd (UID: 00000000-00005948) "3Kn814gI.exe" called "GetProcAddress" with a parameter DetachScrollBars (UID: 00000000-00005948) "3Kn814gI.exe" called "GetProcAddress" with a parameter AttachScrollBars (UID: 00000000-00005948) "3Kn814gI.exe" called "GetProcAddress" with a parameter CCSetScrollInfo (UID: 00000000-00005948) "3Kn814gI.exe" called "GetProcAddress" with a parameter CCGetScrollInfo (UID: 00000000-00005948) "3Kn814gI.exe" called "GetProcAddress" with a parameter CCEnableScrollBar (UID: 00000000-00005948) "3Kn814gI.exe" called "GetProcAddress" with a parameter QuerySystemGestureStatus (UID: 00000000-00005948) "3Kn814gI.exe" called "GetProcAddress" with a parameter StringFromGUID2 (UID: 00000000-00005948) "3Kn814gI.exe" called "GetProcAddress" with a parameter CoTaskMemAlloc (UID: 00000000-00005948) "3Kn814gI.exe" called "GetProcAddress" with a parameter CoTaskMemFree (UID: 00000000-00005948) "3Kn814gI.exe" called "GetProcAddress" with a parameter SetSystemFileCacheSize (UID: 00000000-00005948) "3Kn814gI.exe" called "GetProcAddress" with a parameter NtSetSystemInformation (UID: 00000000-00005948) "3Kn814gI.exe" called "GetProcAddress" with a parameter PrivIsDllSynchronizationHeld (UID: 00000000-00005948) "3Kn814gI.exe" called "GetProcAddress" with a parameter SHGetInstanceExplorer (UID: 00000000-00005948) "3Kn814gI.exe" called "GetProcAddress" with a parameter OleInitialize (UID: 00000000-00005948) "3Kn814gI.exe" called "GetProcAddress" with a parameter CreateBindCtx (UID: 00000000-00005948) "3Kn814gI.exe" called "GetProcAddress" with a parameter RegisterTraceGuidsW (UID: 00000000-00005948) "3Kn814gI.exe" called "GetProcAddress" with a parameter EventRegister (UID: 00000000-00005948) "3Kn814gI.exe" called "GetProcAddress" with a parameter EventUnregister (UID: 00000000-00005948) "3Kn814gI.exe" called "GetProcAddress" with a parameter EventEnabled (UID: 00000000-00005948) "3Kn814gI.exe" called "GetProcAddress" with a parameter EventWrite (UID: 00000000-00005948) "3Kn814gI.exe" called "GetProcAddress" with a parameter PSCreateMemoryPropertyStore (UID: 00000000-00005948) "3Kn814gI.exe" called "GetProcAddress" with a parameter PSPropertyBag_WriteDWORD (UID: 00000000-00005948) "3Kn814gI.exe" called "GetProcAddress" with a parameter CoGetApartmentType (UID: 00000000-00005948) "3Kn814gI.exe" called "GetProcAddress" with a parameter CoRegisterInitializeSpy (UID: 00000000-00005948) "3Kn814gI.exe" called "GetProcAddress" with a parameter CoGetMalloc (UID: 00000000-00005948) "3Kn814gI.exe" called "GetProcAddress" with a parameter PSPropertyBag_ReadDWORD (UID: 00000000-00005948) "3Kn814gI.exe" called "GetProcAddress" with a parameter PSPropertyBag_ReadGUID (UID: 00000000-00005948) "3Kn814gI.exe" called "GetProcAddress" with a parameter RegEnumKeyW (UID: 00000000-00005948) "3Kn814gI.exe" called "GetProcAddress" with a parameter OpenThreadToken (UID: 00000000-00005948) "3Kn814gI.exe" called "GetProcAddress" with a parameter ApphelpCheckShellObject (UID: 00000000-00005948) "3Kn814gI.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00005948) "3Kn814gI.exe" called "GetProcAddress" with a parameter CLSIDFromOle1Class (UID: 00000000-00005948) "3Kn814gI.exe" called "GetProcAddress" with a parameter GetCatalogObject (UID: 00000000-00005948) "3Kn814gI.exe" called "GetProcAddress" with a parameter GetCatalogObject2 (UID: 00000000-00005948) "3Kn814gI.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00005948) "3Kn814gI.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00005948) "3Kn814gI.exe" called "GetProcAddress" with a parameter AcquireSRWLockShared (UID: 00000000-00005948) "3Kn814gI.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00005948) "3Kn814gI.exe" called "GetProcAddress" with a parameter ReleaseSRWLockShared (UID: 00000000-00005948) "3Kn814gI.exe" called "GetProcAddress" with a parameter EventSetInformation (UID: 00000000-00005948) "3Kn814gI.exe" called "GetProcAddress" with a parameter InitCommonControlsEx (UID: 00000000-00005948) "3Kn814gI.exe" called "GetProcAddress" with a parameter DllGetClassObject (UID: 00000000-00005948) "3Kn814gI.exe" called "GetProcAddress" with a parameter DllCanUnloadNow (UID: 00000000-00005948) "3Kn814gI.exe" called "GetProcAddress" with a parameter IsValidURL (UID: 00000000-00005948) "3Kn814gI.exe" called "GetProcAddress" with a parameter SHStrDupW (UID: 00000000-00005948) "3Kn814gI.exe" called "GetProcAddress" with a parameter PSCreateAdapterFromPropertyStore (UID: 00000000-00005948) "3Kn814gI.exe" called "GetProcAddress" with a parameter PropVariantToBSTR (UID: 00000000-00005948) "3Kn814gI.exe" called "GetProcAddress" with a parameter PropVariantClear (UID: 00000000-00005948) "3Kn814gI.exe" called "GetProcAddress" with a parameter IUnknown_Set (UID: 00000000-00005948) "3Kn814gI.exe" called "GetProcAddress" with a parameter CoInitializeEx (UID: 00000000-00005948) "3Kn814gI.exe" called "GetProcAddress" with a parameter CoTaskMemRealloc (UID: 00000000-00005948) "3Kn814gI.exe" called "GetProcAddress" with a parameter ResolveDelayLoadedAPI (UID: 00000000-00005948) "3Kn814gI.exe" called "GetProcAddress" with a parameter PSPropertyBag_ReadStrAlloc (UID: 00000000-00005948) "3Kn814gI.exe" called "GetProcAddress" with a parameter CoAllowSetForegroundWindow (UID: 00000000-00005948) "3Kn814gI.exe" called "GetProcAddress" with a parameter FindWindowExW (UID: 00000000-00005948) "3Kn814gI.exe" called "GetProcAddress" with a parameter CM_Get_Device_Interface_List_Size_ExW (UID: 00000000-00005948) "3Kn814gI.exe" called "GetProcAddress" with a parameter CM_Get_Device_Interface_List_ExW (UID: 00000000-00005948) "3Kn814gI.exe" called "GetProcAddress" with a parameter RtlDllShutdownInProgress (UID: 00000000-00005948) "3Kn814gI.exe" called "GetProcAddress" with a parameter CoUninitialize (UID: 00000000-00005948) "3Kn814gI.exe" called "GetProcAddress" with a parameter OleUninitialize (UID: 00000000-00005948) "3Kn814gI.exe" called "GetProcAddress" with a parameter CoRevokeInitializeSpy (UID: 00000000-00005948) "3Kn814gI.exe" called "GetProcAddress" with a parameter NdrOleInitializeExtension (UID: 00000000-00005948) "3Kn814gI.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00005948) "3Kn814gI.exe" called "GetProcAddress" with a parameter CoGetMarshalSizeMax (UID: 00000000-00005948) "3Kn814gI.exe" called "GetProcAddress" with a parameter CoMarshalInterface (UID: 00000000-00005948) "3Kn814gI.exe" called "GetProcAddress" with a parameter CoUnmarshalInterface (UID: 00000000-00005948) "3Kn814gI.exe" called "GetProcAddress" with a parameter StringFromIID (UID: 00000000-00005948) "3Kn814gI.exe" called "GetProcAddress" with a parameter CoGetPSClsid (UID: 00000000-00005948) "3Kn814gI.exe" called "GetProcAddress" with a parameter CoReleaseMarshalData (UID: 00000000-00005948) "3Kn814gI.exe" called "GetProcAddress" with a parameter DcomChannelSetHResult (UID: 00000000-00005948) "3Kn814gI.exe" called "GetProcAddress" with a parameter SendMessageTimeoutW (UID: 00000000-00005948) "3Kn814gI.exe" called "GetProcAddress" with a parameter GetWindowThreadProcessId (UID: 00000000-00005948) "3Kn814gI.exe" called "GetProcAddress" with a parameter AllowSetForegroundWindow (UID: 00000000-00005948) "3Kn814gI.exe" called "GetProcAddress" with a parameter PostMessageW (UID: 00000000-00005948) "3Kn814gI.exe" called "GetProcAddress" with a parameter CloseThemeData (UID: 00000000-00005948) "3Kn814gI.exe" called "GetProcAddress" with a parameter UnregisterTraceGuids (UID: 00000000-00005948) "4NU6qK7.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00001832) "4NU6qK7.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00001832) "4NU6qK7.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00001832) "4NU6qK7.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00001832) "4NU6qK7.exe" called "GetProcAddress" with a parameter UnregisterTraceGuids (UID: 00000000-00001832) "5ip71Yr.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00000844) "5ip71Yr.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00000844) "5ip71Yr.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00000844) "5ip71Yr.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00000844) "5ip71Yr.exe" called "GetProcAddress" with a parameter UnregisterTraceGuids (UID: 00000000-00000844) "AppLaunch.exe" called "GetProcAddress" with a parameter GetSystemWindowsDirectoryW (UID: 00000000-00002372) "AppLaunch.exe" called "GetProcAddress" with a parameter AllocateAndInitializeSid (UID: 00000000-00002372) "AppLaunch.exe" called "GetProcAddress" with a parameter OpenProcessToken (UID: 00000000-00002372) "AppLaunch.exe" called "GetProcAddress" with a parameter GetTokenInformation (UID: 00000000-00002372) "AppLaunch.exe" called "GetProcAddress" with a parameter InitializeAcl (UID: 00000000-00002372) "AppLaunch.exe" called "GetProcAddress" with a parameter AddAccessAllowedAce (UID: 00000000-00002372) "AppLaunch.exe" called "GetProcAddress" with a parameter FreeSid (UID: 00000000-00002372) "AppLaunch.exe" called "GetProcAddress" with a parameter AddSIDToBoundaryDescriptor (UID: 00000000-00002372) "AppLaunch.exe" called "GetProcAddress" with a parameter CreateBoundaryDescriptorW (UID: 00000000-00002372) "AppLaunch.exe" called "GetProcAddress" with a parameter CreatePrivateNamespaceW (UID: 00000000-00002372) "AppLaunch.exe" called "GetProcAddress" with a parameter OpenPrivateNamespaceW (UID: 00000000-00002372) "AppLaunch.exe" called "GetProcAddress" with a parameter DeleteBoundaryDescriptor (UID: 00000000-00002372) "AppLaunch.exe" called "GetProcAddress" with a parameter WerRegisterRuntimeExceptionModule (UID: 00000000-00002372) "AppLaunch.exe" called "GetProcAddress" with a parameter RaiseException (UID: 00000000-00002372) "AppLaunch.exe" called "GetProcAddress" with a parameter SetSystemFileCacheSize (UID: 00000000-00002372) "AppLaunch.exe" called "GetProcAddress" with a parameter NtSetSystemInformation (UID: 00000000-00002372) "AppLaunch.exe" called "GetProcAddress" with a parameter PrivIsDllSynchronizationHeld (UID: 00000000-00002372) "AppLaunch.exe" called "GetProcAddress" with a parameter AddDllDirectory (UID: 00000000-00002372) "AppLaunch.exe" called "GetProcAddress" with a parameter GetProcessMemoryInfo (UID: 00000000-00002372) "AppLaunch.exe" called "GetProcAddress" with a parameter CoInitializeEx (UID: 00000000-00002372) "AppLaunch.exe" called "GetProcAddress" with a parameter SystemFunction036 (UID: 00000000-00002372) "AppLaunch.exe" called "GetProcAddress" with a parameter ThemeInitApiHook (UID: 00000000-00002372) "AppLaunch.exe" called "GetProcAddress" with a parameter IsProcessDPIAware (UID: 00000000-00002372) "AppLaunch.exe" called "GetProcAddress" with a parameter GetEnabledXStateFeatures (UID: 00000000-00002372) "AppLaunch.exe" called "GetProcAddress" with a parameter sxsJitStartup (UID: 00000000-00002372) "AppLaunch.exe" called "GetProcAddress" with a parameter jitStartup (UID: 00000000-00002372) "AppLaunch.exe" called "GetProcAddress" with a parameter getJit (UID: 00000000-00002372) "AppLaunch.exe" called "GetProcAddress" with a parameter DecodePointer (UID: 00000000-00002372) "AppLaunch.exe" called "GetProcAddress" with a parameter EncodePointer (UID: 00000000-00002372) "AppLaunch.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00002372) "AppLaunch.exe" called "GetProcAddress" with a parameter LocaleNameToLCID (UID: 00000000-00002372) "AppLaunch.exe" called "GetProcAddress" with a parameter GetUserDefaultLocaleName (UID: 00000000-00002372) "AppLaunch.exe" called "GetProcAddress" with a parameter LCIDToLocaleName (UID: 00000000-00002372) "AppLaunch.exe" called "GetProcAddress" with a parameter GetUserPreferredUILanguages (UID: 00000000-00002372) "AppLaunch.exe" called "GetProcAddress" with a parameter RegCloseKey (UID: 00000000-00002372) "AppLaunch.exe" called "GetProcAddress" with a parameter RegOpenKeyEx (UID: 00000000-00002372) "AppLaunch.exe" called "GetProcAddress" with a parameter RegOpenKeyExW (UID: 00000000-00002372) "AppLaunch.exe" called "GetProcAddress" with a parameter GetFullPathName (UID: 00000000-00002372) "AppLaunch.exe" called "GetProcAddress" with a parameter GetFullPathNameW (UID: 00000000-00002372) "AppLaunch.exe" called "GetProcAddress" with a parameter IsAppThemed (UID: 00000000-00002372) "AppLaunch.exe" called "GetProcAddress" with a parameter IsAppThemedW (UID: 00000000-00002372) "AppLaunch.exe" called "GetProcAddress" with a parameter CreateActCtx (UID: 00000000-00002372) "AppLaunch.exe" called "GetProcAddress" with a parameter CreateActCtxA (UID: 00000000-00002372) "AppLaunch.exe" called "GetProcAddress" with a parameter CoTaskMemAlloc (UID: 00000000-00002372) "AppLaunch.exe" called "GetProcAddress" with a parameter CoTaskMemFree (UID: 00000000-00002372) "AppLaunch.exe" called "GetProcAddress" with a parameter RegisterWindowMessage (UID: 00000000-00002372) "AppLaunch.exe" called "GetProcAddress" with a parameter RegisterWindowMessageW (UID: 00000000-00002372) "AppLaunch.exe" called "GetProcAddress" with a parameter CompareStringOrdinal (UID: 00000000-00002372) "AppLaunch.exe" called "GetProcAddress" with a parameter CloseHandle (UID: 00000000-00002372) "AppLaunch.exe" called "GetProcAddress" with a parameter GetCurrentProcess (UID: 00000000-00002372) "AppLaunch.exe" called "GetProcAddress" with a parameter GetCurrentProcessW (UID: 00000000-00002372) "AppLaunch.exe" called "GetProcAddress" with a parameter OpenProcessTokenW (UID: 00000000-00002372) "AppLaunch.exe" called "GetProcAddress" with a parameter SortGetHandle (UID: 00000000-00002372) "AppLaunch.exe" called "GetProcAddress" with a parameter SortCloseHandle (UID: 00000000-00002372) "AppLaunch.exe" called "GetProcAddress" with a parameter NtQuerySystemInformation (UID: 00000000-00002372) "AppLaunch.exe" called "GetProcAddress" with a parameter GetFileAttributesEx (UID: 00000000-00002372) "AppLaunch.exe" called "GetProcAddress" with a parameter GetFileAttributesExW (UID: 00000000-00002372) "AppLaunch.exe" called "GetProcAddress" with a parameter SetThreadErrorMode (UID: 00000000-00002372) "AppLaunch.exe" called "GetProcAddress" with a parameter CreateFile (UID: 00000000-00002372) "AppLaunch.exe" called "GetProcAddress" with a parameter CreateFileW (UID: 00000000-00002372) "AppLaunch.exe" called "GetProcAddress" with a parameter GetFileType (UID: 00000000-00002372) "AppLaunch.exe" called "GetProcAddress" with a parameter ConvertSidToStringSidW (UID: 00000000-00002372) "AppLaunch.exe" called "GetProcAddress" with a parameter SHGetFolderPathW (UID: 00000000-00002372) "AppLaunch.exe" called "GetProcAddress" with a parameter StringFromGUID2 (UID: 00000000-00002372) "AppLaunch.exe" called "GetProcAddress" with a parameter OpenThreadToken (UID: 00000000-00002372) "AppLaunch.exe" called "GetProcAddress" with a parameter GetProcessExecutableHeap (UID: 00000000-00002372) "AppLaunch.exe" called "GetProcAddress" with a parameter GetProcessExecutableHeap_RetAddr (UID: 00000000-00002372) "AppLaunch.exe" called "GetProcAddress" with a parameter BCryptGetFipsAlgorithmMode (UID: 00000000-00002372) "AppLaunch.exe" called "GetProcAddress" with a parameter CryptGetDefaultProviderW (UID: 00000000-00002372) "AppLaunch.exe" called "GetProcAddress" with a parameter CryptAcquireContextW (UID: 00000000-00002372) "AppLaunch.exe" called "GetProcAddress" with a parameter CPAcquireContext (UID: 00000000-00002372) "AppLaunch.exe" called "GetProcAddress" with a parameter CPReleaseContext (UID: 00000000-00002372) "AppLaunch.exe" called "GetProcAddress" with a parameter CPGenKey (UID: 00000000-00002372) "AppLaunch.exe" called "GetProcAddress" with a parameter CPDeriveKey (UID: 00000000-00002372) "AppLaunch.exe" called "GetProcAddress" with a parameter CPDestroyKey (UID: 00000000-00002372) "AppLaunch.exe" called "GetProcAddress" with a parameter CPSetKeyParam (UID: 00000000-00002372) "AppLaunch.exe" called "GetProcAddress" with a parameter CPGetKeyParam (UID: 00000000-00002372) "AppLaunch.exe" called "GetProcAddress" with a parameter CPExportKey (UID: 00000000-00002372) "AppLaunch.exe" called "GetProcAddress" with a parameter CPImportKey (UID: 00000000-00002372) "AppLaunch.exe" called "GetProcAddress" with a parameter CPEncrypt (UID: 00000000-00002372) "AppLaunch.exe" called "GetProcAddress" with a parameter CPDecrypt (UID: 00000000-00002372) "AppLaunch.exe" called "GetProcAddress" with a parameter CPCreateHash (UID: 00000000-00002372) "AppLaunch.exe" called "GetProcAddress" with a parameter CPHashData (UID: 00000000-00002372) "AppLaunch.exe" called "GetProcAddress" with a parameter CPHashSessionKey (UID: 00000000-00002372) "AppLaunch.exe" called "GetProcAddress" with a parameter CPDestroyHash (UID: 00000000-00002372) "AppLaunch.exe" called "GetProcAddress" with a parameter CPSignHash (UID: 00000000-00002372) "AppLaunch.exe" called "GetProcAddress" with a parameter CPVerifySignature (UID: 00000000-00002372) "AppLaunch.exe" called "GetProcAddress" with a parameter CPGenRandom (UID: 00000000-00002372) "AppLaunch.exe" called "GetProcAddress" with a parameter CPGetUserKey (UID: 00000000-00002372) "AppLaunch.exe" called "GetProcAddress" with a parameter CPSetProvParam (UID: 00000000-00002372) "AppLaunch.exe" called "GetProcAddress" with a parameter CPGetProvParam (UID: 00000000-00002372) "AppLaunch.exe" called "GetProcAddress" with a parameter CPSetHashParam (UID: 00000000-00002372) "AppLaunch.exe" called "GetProcAddress" with a parameter CPGetHashParam (UID: 00000000-00002372) "AppLaunch.exe" called "GetProcAddress" with a parameter CPDuplicateKey (UID: 00000000-00002372) "AppLaunch.exe" called "GetProcAddress" with a parameter CPDuplicateHash (UID: 00000000-00002372) "AppLaunch.exe" called "GetProcAddress" with a parameter EqualSid (UID: 00000000-00002372) "AppLaunch.exe" called "GetProcAddress" with a parameter CryptGenRandom (UID: 00000000-00002372) "AppLaunch.exe" called "GetProcAddress" with a parameter GetFileSize (UID: 00000000-00002372) "AppLaunch.exe" called "GetProcAddress" with a parameter ReadFile (UID: 00000000-00002372) "AppLaunch.exe" called "GetProcAddress" with a parameter GetSystemMetrics (UID: 00000000-00002372) "AppLaunch.exe" called "GetProcAddress" with a parameter GetModuleHandle (UID: 00000000-00002372) "AppLaunch.exe" called "GetProcAddress" with a parameter GetModuleHandleW (UID: 00000000-00002372) "AppLaunch.exe" called "GetProcAddress" with a parameter GetProcAddress (UID: 00000000-00002372) "AppLaunch.exe" called "GetProcAddress" with a parameter WideCharToMultiByte (UID: 00000000-00002372) "AppLaunch.exe" called "GetProcAddress" with a parameter LoadLibraryEx (UID: 00000000-00002372) "AppLaunch.exe" called "GetProcAddress" with a parameter LoadLibraryExW (UID: 00000000-00002372) "AppLaunch.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00002372) "AppLaunch.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00002372) "AppLaunch.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00002372) "AppLaunch.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00002372) "AppLaunch.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionAndSpinCount (UID: 00000000-00002372) "AppLaunch.exe" called "GetProcAddress" with a parameter ProcessIdToSessionId (UID: 00000000-00002372) "AppLaunch.exe" called "GetProcAddress" with a parameter ImmCreateContext (UID: 00000000-00002372) "AppLaunch.exe" called "GetProcAddress" with a parameter ImmDestroyContext (UID: 00000000-00002372) "AppLaunch.exe" called "GetProcAddress" with a parameter ImmNotifyIME (UID: 00000000-00002372) "AppLaunch.exe" called "GetProcAddress" with a parameter ImmAssociateContext (UID: 00000000-00002372) "AppLaunch.exe" called "GetProcAddress" with a parameter ImmReleaseContext (UID: 00000000-00002372) "AppLaunch.exe" called "GetProcAddress" with a parameter ImmGetContext (UID: 00000000-00002372) "AppLaunch.exe" called "GetProcAddress" with a parameter ImmGetCompositionStringA (UID: 00000000-00002372) "AppLaunch.exe" called "GetProcAddress" with a parameter ImmSetCompositionStringA (UID: 00000000-00002372) "AppLaunch.exe" called "GetProcAddress" with a parameter ImmGetCompositionStringW (UID: 00000000-00002372) "AppLaunch.exe" called "GetProcAddress" with a parameter ImmSetCompositionStringW (UID: 00000000-00002372) "AppLaunch.exe" called "GetProcAddress" with a parameter ImmSetCandidateWindow (UID: 00000000-00002372) "AppLaunch.exe" called "GetProcAddress" with a parameter AdjustWindowRectEx (UID: 00000000-00002372) "AppLaunch.exe" called "GetProcAddress" with a parameter GetCurrentThread (UID: 00000000-00002372) "AppLaunch.exe" called "GetProcAddress" with a parameter DuplicateHandle (UID: 00000000-00002372) "AppLaunch.exe" called "GetProcAddress" with a parameter GetCurrentThreadId (UID: 00000000-00002372) "AppLaunch.exe" called "GetProcAddress" with a parameter GetCurrentActCtx (UID: 00000000-00002372) "AppLaunch.exe" called "GetProcAddress" with a parameter ActivateActCtx (UID: 00000000-00002372) "AppLaunch.exe" called "GetProcAddress" with a parameter DefWindowProcW (UID: 00000000-00002372) "AppLaunch.exe" called "GetProcAddress" with a parameter GetStockObject (UID: 00000000-00002372) "AppLaunch.exe" called "GetProcAddress" with a parameter RegisterClass (UID: 00000000-00002372) "AppLaunch.exe" called "GetProcAddress" with a parameter RegisterClassW (UID: 00000000-00002372) "AppLaunch.exe" called "GetProcAddress" with a parameter CreateWindowEx (UID: 00000000-00002372) "AppLaunch.exe" called "GetProcAddress" with a parameter CreateWindowExW (UID: 00000000-00002372) "AppLaunch.exe" called "GetProcAddress" with a parameter SetWindowLong (UID: 00000000-00002372) "AppLaunch.exe" called "GetProcAddress" with a parameter SetWindowLongW (UID: 00000000-00002372) "AppLaunch.exe" called "GetProcAddress" with a parameter GetWindowLong (UID: 00000000-00002372) "AppLaunch.exe" called "GetProcAddress" with a parameter GetWindowLongW (UID: 00000000-00002372) "AppLaunch.exe" called "GetProcAddress" with a parameter RegQueryValueEx (UID: 00000000-00002372) "AppLaunch.exe" called "GetProcAddress" with a parameter RegQueryValueExW (UID: 00000000-00002372) "AppLaunch.exe" called "GetProcAddress" with a parameter CallWindowProc (UID: 00000000-00002372) "AppLaunch.exe" called "GetProcAddress" with a parameter CallWindowProcW (UID: 00000000-00002372) "AppLaunch.exe" called "GetProcAddress" with a parameter GetClientRect (UID: 00000000-00002372) "AppLaunch.exe" called "GetProcAddress" with a parameter GetWindowRect (UID: 00000000-00002372) "AppLaunch.exe" called "GetProcAddress" with a parameter GetParent (UID: 00000000-00002372) "AppLaunch.exe" called "GetProcAddress" with a parameter DeactivateActCtx (UID: 00000000-00002372) "AppLaunch.exe" called "GetProcAddress" with a parameter CryptImportKey (UID: 00000000-00002372) "AppLaunch.exe" called "GetProcAddress" with a parameter CryptExportKey (UID: 00000000-00002372) "AppLaunch.exe" called "GetProcAddress" with a parameter CryptCreateHash (UID: 00000000-00002372) "AppLaunch.exe" called "GetProcAddress" with a parameter CryptHashData (UID: 00000000-00002372) "AppLaunch.exe" called "GetProcAddress" with a parameter CryptGetHashParam (UID: 00000000-00002372) "AppLaunch.exe" called "GetProcAddress" with a parameter CryptDestroyHash (UID: 00000000-00002372) "AppLaunch.exe" called "GetProcAddress" with a parameter CryptDestroyKey (UID: 00000000-00002372) "AppLaunch.exe" called "GetProcAddress" with a parameter LocalAlloc (UID: 00000000-00002372) "AppLaunch.exe" called "GetProcAddress" with a parameter _calloc_base (UID: 00000000-00002372) "AppLaunch.exe" called "GetProcAddress" with a parameter InitializeSListHead (UID: 00000000-00002372) "AppLaunch.exe" called "GetProcAddress" with a parameter malloc (UID: 00000000-00002372) "AppLaunch.exe" called "GetProcAddress" with a parameter SetProcessDPIAware (UID: 00000000-00002372) "AppLaunch.exe" called "GetProcAddress" with a parameter GetEnvironmentVariableW (UID: 00000000-00002372) "AppLaunch.exe" called "GetProcAddress" with a parameter PathAppendW (UID: 00000000-00002372) "AppLaunch.exe" called "GetProcAddress" with a parameter DWriteCreateFactory (UID: 00000000-00002372) "AppLaunch.exe" called "GetProcAddress" with a parameter PathCombineW (UID: 00000000-00002372) "AppLaunch.exe" called "GetProcAddress" with a parameter LoadLibraryW (UID: 00000000-00002372) "AppLaunch.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00002372) "AppLaunch.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00002372) "AppLaunch.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00002372) "AppLaunch.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00002372) "AppLaunch.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00002372) "AppLaunch.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00002372) "AppLaunch.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00002372) "AppLaunch.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00002372) "AppLaunch.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00002372) "AppLaunch.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00002372) "AppLaunch.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00002372) "AppLaunch.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00002372) "AppLaunch.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00002372) "AppLaunch.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00002372) "AppLaunch.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00002372) "AppLaunch.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00002372) "AppLaunch.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00002372) "AppLaunch.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00002372) "AppLaunch.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00002372) "AppLaunch.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00002372) "AppLaunch.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00002372) "AppLaunch.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00002372) "AppLaunch.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00002372) "AppLaunch.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00002372) "AppLaunch.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00002372) "AppLaunch.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00002372) "AppLaunch.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00002372) "AppLaunch.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00002372) "AppLaunch.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00002372) "AppLaunch.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00002372) "AppLaunch.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00002372) "AppLaunch.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00002372) "AppLaunch.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00002372) "AppLaunch.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00002372) "AppLaunch.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00002372) "AppLaunch.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00002372) "AppLaunch.exe" called "GetProcAddress" with a parameter EnumSystemLocalesEx (UID: 00000000-00002372) "AppLaunch.exe" called "GetProcAddress" with a parameter GetDateFormatEx (UID: 00000000-00002372) "AppLaunch.exe" called "GetProcAddress" with a parameter GetTimeFormatEx (UID: 00000000-00002372) "AppLaunch.exe" called "GetProcAddress" with a parameter IsValidLocaleName (UID: 00000000-00002372) "AppLaunch.exe" called "GetProcAddress" with a parameter GdiEntry13 (UID: 00000000-00002372) "AppLaunch.exe" called "GetProcAddress" with a parameter EventWrite (UID: 00000000-00002372) "AppLaunch.exe" called "GetProcAddress" with a parameter EventRegister (UID: 00000000-00002372) "AppLaunch.exe" called "GetProcAddress" with a parameter EventUnregister (UID: 00000000-00002372) "AppLaunch.exe" called "GetProcAddress" with a parameter GetDynamicTimeZoneInformation (UID: 00000000-00002372) "AppLaunch.exe" called "GetProcAddress" with a parameter SHGetFolderPath (UID: 00000000-00002372) "AppLaunch.exe" called "GetProcAddress" with a parameter GetFileMUIPath (UID: 00000000-00002372) "AppLaunch.exe" called "GetProcAddress" with a parameter FreeLibrary (UID: 00000000-00002372) "AppLaunch.exe" called "GetProcAddress" with a parameter FreeLibraryW (UID: 00000000-00002372) "AppLaunch.exe" called "GetProcAddress" with a parameter LoadStringW (UID: 00000000-00002372) "AppLaunch.exe" called "GetProcAddress" with a parameter GetFileVersionInfoSizeW (UID: 00000000-00002372) "AppLaunch.exe" called "GetProcAddress" with a parameter GetFileVersionInfoW (UID: 00000000-00002372) "AppLaunch.exe" called "GetProcAddress" with a parameter VerQueryValueW (UID: 00000000-00002372) "AppLaunch.exe" called "GetProcAddress" with a parameter CryptAcquireContextA (UID: 00000000-00002372) "AppLaunch.exe" called "GetProcAddress" with a parameter CryptReleaseContext (UID: 00000000-00002372) "6pl671.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00004076) "6pl671.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00004076) "6pl671.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00004076) "6pl671.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00004076) "6pl671.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00004076) "6pl671.exe" called "GetProcAddress" with a parameter GetTempPath2W (UID: 00000000-00004076) "6pl671.exe" called "GetProcAddress" with a parameter UnregisterTraceGuids (UID: 00000000-00004076) "AppLaunch.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00003020) "AppLaunch.exe" called "GetProcAddress" with a parameter SetSystemFileCacheSize (UID: 00000000-00003020) "AppLaunch.exe" called "GetProcAddress" with a parameter NtSetSystemInformation (UID: 00000000-00003020) "AppLaunch.exe" called "GetProcAddress" with a parameter PrivIsDllSynchronizationHeld (UID: 00000000-00003020) "AppLaunch.exe" called "GetProcAddress" with a parameter GetProductInfo (UID: 00000000-00003020) "AppLaunch.exe" called "GetProcAddress" with a parameter InitSecurityInterfaceW (UID: 00000000-00003020) "AppLaunch.exe" called "GetProcAddress" with a parameter InitSecurityInterfaceA (UID: 00000000-00003020) "AppLaunch.exe" called "GetProcAddress" with a parameter SystemFunction035 (UID: 00000000-00003020) "AppLaunch.exe" called "GetProcAddress" with a parameter RpcStringBindingComposeW (UID: 00000000-00003020) "AppLaunch.exe" called "GetProcAddress" with a parameter RpcBindingFromStringBindingW (UID: 00000000-00003020) "AppLaunch.exe" called "GetProcAddress" with a parameter RpcBindingSetAuthInfoExW (UID: 00000000-00003020) "AppLaunch.exe" called "GetProcAddress" with a parameter RpcBindingSetOption (UID: 00000000-00003020) "AppLaunch.exe" called "GetProcAddress" with a parameter RpcStringFreeW (UID: 00000000-00003020) "AppLaunch.exe" called "GetProcAddress" with a parameter OpenThreadToken (UID: 00000000-00003020) "AppLaunch.exe" called "GetProcAddress" with a parameter WSAStringToAddressW (UID: 00000000-00003020) "AppLaunch.exe" called "GetProcAddress" with a parameter WSPStartup (UID: 00000000-00003020) "AppLaunch.exe" called "GetProcAddress" with a parameter WSHAddressToString (UID: 00000000-00003020) "AppLaunch.exe" called "GetProcAddress" with a parameter WSHEnumProtocols (UID: 00000000-00003020) "AppLaunch.exe" called "GetProcAddress" with a parameter WSHGetProviderGuid (UID: 00000000-00003020) "AppLaunch.exe" called "GetProcAddress" with a parameter WSHGetSockaddrType (UID: 00000000-00003020) "AppLaunch.exe" called "GetProcAddress" with a parameter WSHGetSocketInformation (UID: 00000000-00003020) "AppLaunch.exe" called "GetProcAddress" with a parameter WSHGetWSAProtocolInfo (UID: 00000000-00003020) "AppLaunch.exe" called "GetProcAddress" with a parameter WSHGetWildcardSockaddr (UID: 00000000-00003020) "AppLaunch.exe" called "GetProcAddress" with a parameter WSHGetWinsockMapping (UID: 00000000-00003020) "AppLaunch.exe" called "GetProcAddress" with a parameter WSHIoctl (UID: 00000000-00003020) "AppLaunch.exe" called "GetProcAddress" with a parameter WSHJoinLeaf (UID: 00000000-00003020) "AppLaunch.exe" called "GetProcAddress" with a parameter WSHNotify (UID: 00000000-00003020) "AppLaunch.exe" called "GetProcAddress" with a parameter WSHOpenSocket (UID: 00000000-00003020) "AppLaunch.exe" called "GetProcAddress" with a parameter WSHOpenSocket2 (UID: 00000000-00003020) "AppLaunch.exe" called "GetProcAddress" with a parameter WSHSetSocketInformation (UID: 00000000-00003020) "AppLaunch.exe" called "GetProcAddress" with a parameter WSHStringToAddress (UID: 00000000-00003020) "AppLaunch.exe" called "GetProcAddress" with a parameter WSHGetBroadcastSockaddr (UID: 00000000-00003020) "AppLaunch.exe" called "GetProcAddress" with a parameter UrlCanonicalizeW (UID: 00000000-00003020) "AppLaunch.exe" called "GetProcAddress" with a parameter StrCmpNW (UID: 00000000-00003020) "AppLaunch.exe" called "GetProcAddress" with a parameter DnsGetProxyInformation (UID: 00000000-00003020) "AppLaunch.exe" called "GetProcAddress" with a parameter NdrClientCall2 (UID: 00000000-00003020) "AppLaunch.exe" called "GetProcAddress" with a parameter RpcBindingFree (UID: 00000000-00003020) "AppLaunch.exe" called "GetProcAddress" with a parameter GetAddrInfoW (UID: 00000000-00003020) "AppLaunch.exe" called "GetProcAddress" with a parameter NSPStartup (UID: 00000000-00003020) "AppLaunch.exe" called "GetProcAddress" with a parameter DnsQueryConfigAllocEx (UID: 00000000-00003020) "AppLaunch.exe" called "GetProcAddress" with a parameter DnsNameCompare_W (UID: 00000000-00003020) "AppLaunch.exe" called "GetProcAddress" with a parameter DnsApiAlloc (UID: 00000000-00003020) "AppLaunch.exe" called "GetProcAddress" with a parameter DnsQueryExW (UID: 00000000-00003020) "AppLaunch.exe" called "GetProcAddress" with a parameter GetCurrentThreadCompartmentId (UID: 00000000-00003020) "AppLaunch.exe" called "GetProcAddress" with a parameter WSAttemptAutodialAddr (UID: 00000000-00003020) "AppLaunch.exe" called "GetProcAddress" with a parameter WSAttemptAutodialName (UID: 00000000-00003020) "AppLaunch.exe" called "GetProcAddress" with a parameter WSNoteSuccessfulHostentLookup (UID: 00000000-00003020) "AppLaunch.exe" called "GetProcAddress" with a parameter DnsApiFree (UID: 00000000-00003020) "AppLaunch.exe" called "GetProcAddress" with a parameter DnsFree (UID: 00000000-00003020) "AppLaunch.exe" called "GetProcAddress" with a parameter NamespaceCallout (UID: 00000000-00003020) "AppLaunch.exe" called "GetProcAddress" with a parameter WSASocketW (UID: 00000000-00003020) "AppLaunch.exe" called "GetProcAddress" with a parameter WSAIoctl (UID: 00000000-00003020) "AppLaunch.exe" called "GetProcAddress" with a parameter FreeAddrInfoW (UID: 00000000-00003020) "AppLaunch.exe" called "GetProcAddress" with a parameter WSARecv (UID: 00000000-00003020) "AppLaunch.exe" called "GetProcAddress" with a parameter WSASend (UID: 00000000-00003020) "AppLaunch.exe" called "GetProcAddress" with a parameter UrlCombineA (UID: 00000000-00003020) "AppLaunch.exe" called "GetProcAddress" with a parameter WSAStringToAddressA (UID: 00000000-00003020) "AppLaunch.exe" called "GetProcAddress" with a parameter SpUserModeInitialize (UID: 00000000-00003020) "AppLaunch.exe" called "GetProcAddress" with a parameter RegCreateKeyExW (UID: 00000000-00003020) "AppLaunch.exe" called "GetProcAddress" with a parameter RegQueryValueExW (UID: 00000000-00003020) "AppLaunch.exe" called "GetProcAddress" with a parameter RegCloseKey (UID: 00000000-00003020) "AppLaunch.exe" called "GetProcAddress" with a parameter CertFreeCertificateContext (UID: 00000000-00003020) "AppLaunch.exe" called "GetProcAddress" with a parameter UnregisterTraceGuids (UID: 00000000-00003020)3c:T548,Found reference to API "GetCommandLineW" (Indicator: "GetCommandLine"; File: "7ef834fc890f8f801316f859915cba63a0771e89738a882bca0656fda5a74ddf") Found reference to API "GetCommandLineA" (Indicator: "GetCommandLine"; File: "7ef834fc890f8f801316f859915cba63a0771e89738a882bca0656fda5a74ddf") Found reference to API "GetCommandLineA" (Indicator: "GetCommandLine"; Source: "00000000-00000844.00000000.78492.00E40000.00000002.mdmp") Found reference to API "GetCommandLineW" (Indicator: "GetCommandLine"; Source: "00000000-00000844.00000000.78492.00E40000.00000002.mdmp") Found reference to API "GetCommandLineA" (Indicator: "GetCommandLine"; Source: "00000000-00001832.00000000.78150.001E8000.00000004.mdmp, 00000000-00001832.00000000.78155.001E0000.00000002.mdmp") Found reference to API "GetCommandLineW" (Indicator: "GetCommandLine"; Source: "00000000-00001832.00000000.78150.001E8000.00000004.mdmp, 00000000-00001832.00000000.78155.001E0000.00000002.mdmp") Found reference to API "GetCommandLineA" (Indicator: "GetCommandLine"; Source: "00000000-00004076.00000000.78867.009C0000.00000002.mdmp, 00000000-00004076.00000000.78873.009C8000.00000004.mdmp") Found reference to API "GetCommandLineW" (Indicator: "GetCommandLine"; Source: "00000000-00004076.00000000.78867.009C0000.00000002.mdmp, 00000000-00004076.00000000.78873.009C8000.00000004.mdmp")3d:T7da,Process iexplore.exe created mutex with name "\Sessions\1\BaseNamedObjects\UpdatingNewTabPageData" Process iexplore.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\!BrowserEmulation!SharedMemory!Mutex" Process iexplore.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\VERMGMTBlockListFileMutex" Process iexplore.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\URLBLOCK_FILEMAPSWITCH_MUTEX_5788" Process iexplore.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\URLBLOCK_HASHFILESWITCH_MUTEX" Process iexplore.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\URLBLOCK_DOWNLOAD_MUTEX" Process iexplore.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\ZonesCacheCounterMutex" Process iexplore.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\ZonesLockedCacheCounterMutex" Process iexplore.exe created mutex with name "\Sessions\1\BaseNamedObjects\IsoScope_169c_IE_EarlyTabStart_0x16f4_Mutex" Process iexplore.exe created mutex with name "\Sessions\1\BaseNamedObjects\IsoScope_169c_ConnHashTable<5788>_HashTable_Mutex" Process iexplore.exe created mutex with name "\Sessions\1\BaseNamedObjects\{5312EE61-79E3-4A24-BFE1-132B85B23C3A}" Process iexplore.exe created mutex with name "\Sessions\1\BaseNamedObjects\IsoScope_169c_IESQMMUTEX_0_303" Process iexplore.exe created mutex with name "\Sessions\1\BaseNamedObjects\IsoScope_169c_IESQMMUTEX_0_331" Process iexplore.exe created mutex with name "\Sessions\1\BaseNamedObjects\{66D0969A-1E86-44CF-B4EC-3806DDDA3B5D}" Process iexplore.exe created mutex with name "\Sessions\1\BaseNamedObjects\IsoScope_169c_IESQMMUTEX_0_519" Process iexplore.exe created mutex with name "\Sessions\1\BaseNamedObjects\IsoScope_169c_IESQMMUTEX_0_274" Process iexplore.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\MSIMGSIZECacheMutex" Process iexplore.exe created mutex with name "\Sessions\1\BaseNamedObjects\_!SHMSFTHISTORY!_"3e:T899,"3Kn814gI.exe" failed to load missing module "api-ms-win-core-sysinfo-l1-2-1" - [base:0; Status:c0000135] "3Kn814gI.exe" failed to load missing module "api-ms-win-appmodel-runtime-l1-1-1" - [base:0; Status:c0000135] "3Kn814gI.exe" failed to load missing module "ext-ms-win-kernel32-package-current-l1-1-0" - [base:0; Status:c0000135] "4NU6qK7.exe" failed to load missing module "api-ms-win-appmodel-runtime-l1-1-2" - [base:0; Status:c0000135] "AppLaunch.exe" failed to load missing module "%WINDIR%\system32\combase.dll" - [base:0; Status:c0000135] "AppLaunch.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\ole32.dll" - [base:0; Status:c0000135] "AppLaunch.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\uxtheme.dll" - [base:0; Status:c0000135] "AppLaunch.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll" - [base:0; Status:c0000135] "AppLaunch.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\PresentationCore\v4.0_4.0.0.0__31bf3856ad364e35\ucrtbase_clr0400.dll" - [base:0; Status:c0000135] "AppLaunch.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\PresentationCore\v4.0_4.0.0.0__31bf3856ad364e35\SHLWAPI.dll" - [base:0; Status:c0000135] "AppLaunch.exe" failed to load missing module "api-ms-win-core-datetime-l1-1-1" - [base:0; Status:c0000135] "AppLaunch.exe" failed to load missing module "api-ms-win-core-localization-obsolete-l1-2-0" - [base:0; Status:c0000135] "AppLaunch.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll" - [base:0; Status:c0000135] "AppLaunch.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\VERSION.dll" - [base:0; Status:c0000135] "AppLaunch.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ws2_32.dll" - [base:0; Status:c0000135] "6pl671.exe" failed to load missing module "api-ms-win-appmodel-runtime-l1-1-2" - [base:0; Status:c0000135]3f:T431,"7ef834fc890f8f801316f859915cba63a0771e89738a882bca0656fda5a74ddf" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE "MP5ye33.exe" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE "aR7ev61.exe" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE "6pl671.exe" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE "5ip71Yr.exe" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE "4NU6qK7.exe" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE40:T90c,Found string "paypalcomsignin" (Indicator: "paypal"; File: "screen_3.png") Found string "youtubecom" (Indicator: "youtube"; File: "screen_5.png") Found string "google.com/y3/signin/identifiercheckConnection=youtubel628checkedDomains=youtubeBicontinue." (Indicator: "youtube"; File: "screen_5.png") file/memory contains long string with (Indicator: "youtube"; File: "_DD856490-A6D0-11F1-A1D6-005056910277_.dat") file/memory contains long string with (Indicator: "youtube"; File: "~DF5561FE7CE5528E7D.TMP") file/memory contains long string with (Indicator: "youtube"; File: "PBCDJ3DP.txt") file/memory contains long string with (Indicator: "youtube"; File: "IREV43C4.txt") file/memory contains long string with (Indicator: "youtube"; File: "0M7MQNGH.txt") file/memory contains long string with (Indicator: "youtube"; File: "I8LVHTYQ.txt") file/memory contains long string with (Indicator: "youtube"; File: "G9ASQ31B.txt") file/memory contains long string with (Indicator: "youtube"; File: "4JZE0BB8.txt") Found string "0vilZf0kaAF0g5LK2..BqmCG2..AAA.0.0.BqmCG2.AWdLORfCe17UCMDNz_Nv3ibFBmgfacebook.com/921784393958431293846121291836031275741tiGYanmPnnK-WnpmMkBQq32Pfacebook.com/9217238839372831356207121291836031275741" (Indicator: "facebook.com"; File: "MTXNRLCN.txt") Found string "0vilZf0kaAF0g5LK2..BqmCG2..AAA.0.0.BqmCG2.AWdLORfCe17UCMDNz_Nv3ibFBmgfacebook.com/921784393958431293846121291836031275741" (Indicator: "facebook.com"; File: "M3EBX0QK.txt") Found string "CONSENTWP.2676bayoutube.com/102431383388163210825482504061830633367" (Indicator: "youtube"; File: "NDW6AAC1.txt") Found string "accounts.youtube.com" (Indicator: "youtube"; File: "PCAP") Found string "twitter.com" (Indicator: "twitter"; File: "PCAP") Found string "www.facebook.com" (Indicator: "facebook.com"; File: "PCAP") Found string "www.paypal.com" (Indicator: "paypal"; File: "PCAP") Found string "www.youtube.com" (Indicator: "youtube"; File: "PCAP") file/memory contains long string with (Indicator: "youtube"; File: "SSL") Found string "GET /login HTTP/1.1Accept: text/html, application/xhtml+xml, */*Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: www.facebook.comDNT: 1Connection: Keep-Alive" (Indicator: "facebook.com"; File: "SSL")41:T7ff,"REGISTRY\USER\S-1-5-21-2092356043-4041700817-663127204-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders" in Source: 00000000-00000844.00000000.78487.00270000.00000004.mdmp "REGISTRY\USER\S-1-5-21-2092356043-4041700817-663127204-1001\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags" in Source: 00000000-00000844.00000000.78487.00270000.00000004.mdmp "REGISTRY\USER\S-1-5-21-2092356043-4041700817-663127204-1001\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags" in Source: 00000000-00001832.00000000.78155.004D0000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\App Paths" in Source: 00000000-00005684.00000001.77329.00131000.00000020.mdmp "p>ISTRY\USER\S-1-5-21-2092356043-4041700817-663127204-1001\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Layers" in Source: 00000000-00005708.00000001.77262.00380000.00000004.mdmp "p>ISTRY\USER\S-1-5-21-2092356043-4041700817-663127204-1001\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Layers" in Source: 00000000-00005708.00000002.78511.00380000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\App Paths" in Source: 00000000-00005708.00000002.78511.00E81000.00000020.mdmp "Software\Microsoft\Windows\CurrentVersion\App Paths" in Source: 00000000-00005936.00000001.77177.00291000.00000020.mdmp "Registry\Machine\Software\Classes\CLSID\{871c5380-42a0-1069-a2ea-08002b30309d}\InProcServer32" in Source: 00000000-00005948.00000000.75456.008E0000.00000004.mdmp "Software\AutoIt v3\AutoIt" in Source: 00000000-00005948.00000001.77378.0033C000.00000002.mdmp "SOFTWARE\Classes\" in Source: 00000000-00005948.00000001.77378.0033C000.00000002.mdmp "SYSTEM\CurrentControlSet\Control\Nls\Language" in Source: 00000000-00005948.00000001.77378.0033C000.00000002.mdmp "Software\Policies\Microsoft\Internet Explorer\TabbedBrowsing" in Source: 00000000-00005948.00000001.77378.008E0000.00000004.mdmp "Software\Policies\Microsoft\Internet Explorer\Main" in Source: 00000000-00005948.00000001.77378.008E0000.00000004.mdmp42:T4045,"GET /gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.pki.goog" Response ==> HTTP/1.1 200 OK Content-Security-Policy-Report-Only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/sytroprc:52:0 Cross-Origin-Opener-Policy-Report-Only: same-origin; report-to=sytroprc:52:0 Report-To: {"group":"sytroprc:52:0" "max_age":2592000 "endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/sytroprc:52:0"}] } Server: scaffolding on HTTPServer2 Content-Length: 1446 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Date: Wed 02 Sep 2026 10:07:07 GMT Cache-Control: public max-age=14400 Content-Type: application/ocsp-response Age: 11368 with response body ==>30C28205C2A20A0100C2A0C28205C29B30C28205C29706092B060105050730010104C28205C28830C28205C28430C281C29EC2A2160414C3BCC2B709C3AA4D79....... "GET /r/r1.crl HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: c.pki.goog" Response ==> HTTP/1.1 200 OK Accept-Ranges: bytes Content-Security-Policy-Report-Only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/cacerts Cross-Origin-Resource-Policy: cross-origin Cross-Origin-Opener-Policy: same-origin; report-to="cacerts" Report-To: {"group":"cacerts" "max_age":2592000 "endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/cacerts"}]} Content-Length: 993 X-Content-Type-Options: nosniff Server: sffe X-XSS-Protection: 0 Date: Wed 02 Sep 2026 12:58:43 GMT Expires: Wed 02 Sep 2026 13:48:43 GMT Cache-Control: public max-age=3000 Age: 1072 Last-Modified: Wed 11 Feb 2026 14:38:00 GMT Content-Type: application/pkix-crl Vary: Accept-Encoding with response body ==>30C28203C39D30C28201C385020101300D06092AC28648C286C3B70D01010B05003047310B300906035504061302555331223020060355040A1319476F6F676C....... "GET /wr2/oBFYYahzgVI.crl HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: c.pki.goog" Response ==> HTTP/1.1 200 OK Accept-Ranges: bytes Content-Security-Policy-Report-Only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/cacerts Cross-Origin-Resource-Policy: cross-origin Cross-Origin-Opener-Policy: same-origin; report-to="cacerts" Report-To: {"group":"cacerts" "max_age":2592000 "endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/cacerts"}]} Content-Length: 51304 X-Content-Type-Options: nosniff Server: sffe X-XSS-Protection: 0 Date: Wed 02 Sep 2026 12:54:22 GMT Expires: Wed 02 Sep 2026 13:44:22 GMT Cache-Control: public max-age=3000 Last-Modified: Wed 02 Sep 2026 09:44:05 GMT Content-Type: application/pkix-crl Vary: Accept-Encoding Age: 1333 with response body ==>30C282C3886430C282C3874C020101300D06092AC28648C286C3B70D01010B0500303B310B3009060355040613025553311E301C060355040A1315476F6F676C....... "GET /wr2/75r4ZyA3vA0.crl HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: c.pki.goog" Response ==> HTTP/1.1 200 OK Accept-Ranges: bytes Content-Security-Policy-Report-Only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/cacerts Cross-Origin-Resource-Policy: cross-origin Cross-Origin-Opener-Policy: same-origin; report-to="cacerts" Report-To: {"group":"cacerts" "max_age":2592000 "endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/cacerts"}]} Content-Length: 51630 X-Content-Type-Options: nosniff Server: sffe X-XSS-Protection: 0 Date: Wed 02 Sep 2026 12:59:51 GMT Expires: Wed 02 Sep 2026 13:49:51 GMT Cache-Control: public max-age=3000 Last-Modified: Wed 02 Sep 2026 12:39:49 GMT Content-Type: application/pkix-crl Vary: Accept-Encoding Age: 1005 with response body ==>30C282C389C2AA30C282C388C292020101300D06092AC28648C286C3B70D01010B0500303B310B3009060355040613025553311E301C060355040A1315476F6F....... "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEA59dSNcqDdhV39MzSTNbR0%3D HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.digicert.cn" Response ==> HTTP/1.1 200 OK Server: Tengine Content-Type: application/ocsp-response Content-Length: 471 Connection: keep-alive Date: Wed 02 Sep 2026 12:35:25 GMT Cache-Control: max-age=7200 X-XSS-Protection: 1; mode=block X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff X-DC-POP: fra-003 Via: ens-cache24.l2us5[0 0 200-0 H] ens-cache15.l2us5[1 0] ens-cache10.us37[0 0 200-0 H] ens-cache20.us37[1 0] Age: 2473 Ali-Swift-Global-Savetime: 1788352525 X-Cache: HIT TCP_MEM_HIT dirn:-2:-2 X-Swift-SaveTime: Wed 02 Sep 2026 12:35:26 GMT X-Swift-CacheTime: 3599 Timing-Allow-Origin: * EagleId: 9b6682a817883549980043209e with response body ==>30C28201C3930A0100C2A0C28201C38C30C28201C38806092B060105050730010104C28201C2B930C28201C2B530C281C29EC2A2160414C2B13EC3836903C3B8....... "GET /wr2/9UVbN0w5E6Y.crl HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: c.pki.goog" Response ==> HTTP/1.1 200 OK Accept-Ranges: bytes Content-Security-Policy-Report-Only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/cacerts Cross-Origin-Resource-Policy: cross-origin Cross-Origin-Opener-Policy: same-origin; report-to="cacerts" Report-To: {"group":"cacerts" "max_age":2592000 "endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/cacerts"}]} Content-Length: 49289 X-Content-Type-Options: nosniff Server: sffe X-XSS-Protection: 0 Date: Wed 02 Sep 2026 12:58:17 GMT Expires: Wed 02 Sep 2026 13:48:17 GMT Cache-Control: public max-age=3000 Age: 1101 Last-Modified: Wed 02 Sep 2026 11:13:28 GMT Content-Type: application/pkix-crl Vary: Accept-Encoding with response body ==>30C282C380C28530C282C2BF6D020101300D06092AC28648C286C3B70D01010B0500303B310B3009060355040613025553311E301C060355040A1315476F6F67....... "GET /r/gsr1.crl HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: c.pki.goog" Response ==> HTTP/1.1 200 OK Accept-Ranges: bytes Content-Security-Policy-Report-Only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/cacerts Cross-Origin-Resource-Policy: cross-origin Cross-Origin-Opener-Policy: same-origin; report-to="cacerts" Report-To: {"group":"cacerts" "max_age":2592000 "endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/cacerts"}]} Content-Length: 1871 X-Content-Type-Options: nosniff Server: sffe X-XSS-Protection: 0 Date: Wed 02 Sep 2026 12:51:41 GMT Expires: Wed 02 Sep 2026 13:41:41 GMT Cache-Control: public max-age=3000 Age: 1513 Last-Modified: Mon 31 Aug 2026 08:08:00 GMT Content-Type: application/pkix-crl Vary: Accept-Encoding with response body ==>30C282074B30C2820633020101300D06092AC28648C286C3B70D01010B05003057310B300906035504061302424531193017060355040A1310476C6F62616C53....... "GET /r/r4.crl HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: c.pki.goog" Response ==> HTTP/1.1 200 OK Accept-Ranges: bytes Content-Security-Policy-Report-Only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/cacerts Cross-Origin-Resource-Policy: cross-origin Cross-Origin-Opener-Policy: same-origin; report-to="cacerts" Report-To: {"group":"cacerts" "max_age":2592000 "endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/cacerts"}]} Content-Length: 528 X-Content-Type-Options: nosniff Server: sffe X-XSS-Protection: 0 Date: Wed 02 Sep 2026 12:34:07 GMT Expires: Wed 02 Sep 2026 13:24:07 GMT Cache-Control: public max-age=3000 Age: 2567 Last-Modified: Wed 11 Feb 2026 14:38:00 GMT Content-Type: application/pkix-crl Vary: Accept-Encoding with response body ==>30C282020C30C28201C293020101300A06082AC28648C38E3D0403033047310B300906035504061302555331223020060355040A1319476F6F676C6520547275....... "GET /we1/pl4XiTjSDSk.crl HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: c.pki.goog" Response ==> HTTP/1.1 200 OK Accept-Ranges: bytes Content-Security-Policy-Report-Only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/cacerts Cross-Origin-Resource-Policy: cross-origin Cross-Origin-Opener-Policy: same-origin; report-to="cacerts" Report-To: {"group":"cacerts" "max_age":2592000 "endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/cacerts"}]} Content-Length: 454 X-Content-Type-Options: nosniff Server: sffe X-XSS-Protection: 0 Date: Wed 02 Sep 2026 12:42:26 GMT Expires: Wed 02 Sep 2026 13:32:26 GMT Cache-Control: public max-age=3000 Age: 2068 Last-Modified: Wed 02 Sep 2026 09:44:59 GMT Content-Type: application/pkix-crl with response body ==>30C28201C38230C2820168020101300A06082AC28648C38E3D040302303B310B3009060355040613025553311E301C060355040A1315476F6F676C6520547275....... "GET /we1/G0k-BqpOX8k.crl HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: c.pki.goog" Response ==> HTTP/1.1 200 OK Accept-Ranges: bytes Content-Security-Policy-Report-Only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/cacerts Cross-Origin-Resource-Policy: cross-origin Cross-Origin-Opener-Policy: same-origin; report-to="cacerts" Report-To: {"group":"cacerts" "max_age":2592000 "endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/cacerts"}]} Content-Length: 348 X-Content-Type-Options: nosniff Server: sffe X-XSS-Protection: 0 Date: Wed 02 Sep 2026 12:53:43 GMT Expires: Wed 02 Sep 2026 13:43:43 GMT Cache-Control: public max-age=3000 Last-Modified: Wed 02 Sep 2026 12:24:37 GMT Content-Type: application/pkix-crl Age: 1392 with response body ==>30C282015830C281C3BE020101300A06082AC28648C38E3D040302303B310B3009060355040613025553311E301C060355040A1315476F6F676C652054727573....... "GET /we1/x6Eg-8TSwUw.crl HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: c.pki.goog" Response ==> HTTP/1.1 200 OK Accept-Ranges: bytes Content-Security-Policy-Report-Only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/cacerts Cross-Origin-Resource-Policy: cross-origin Cross-Origin-Opener-Policy: same-origin; report-to="cacerts" Report-To: {"group":"cacerts" "max_age":2592000 "endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/cacerts"}]} Content-Length: 309 X-Content-Type-Options: nosniff Server: sffe X-XSS-Protection: 0 Date: Wed 02 Sep 2026 13:08:07 GMT Expires: Wed 02 Sep 2026 13:58:07 GMT Cache-Control: public max-age=3000 Last-Modified: Wed 02 Sep 2026 12:44:50 GMT Content-Type: application/pkix-crl Age: 528 with response body ==>30C282013130C281C397020101300A06082AC28648C38E3D040302303B310B3009060355040613025553311E301C060355040A1315476F6F676C652054727573....... "GET /rootg2.cer HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: crt.rootg2.amazontrust.com" Response ==> HTTP/1.1 200 OK Content-Type: binary/octet-stream Content-Length: 1145 Connection: keep-alive Last-Modified: Thu 27 Aug 2026 13:09:28 GMT x-amz-server-side-encryption: AES256 x-amz-version-id: A2X7.ooO5I_EAPPeyyJbO.f4401befYg Accept-Ranges: bytes Server: AmazonS3 Date: Wed 02 Sep 2026 11:42:02 GMT ETag: "c6150925cfea5941ddc7ff2a0a506692" X-Cache: Hit from cloudfront Via: 1.1 3f20d665089a361ca1fc0218db87df5c.cloudfront.net (CloudFront) X-Amz-Cf-Pop: JFK52-P5 X-Amz-Cf-Id: BdurPZDlN3ciaqNcNssAy9gsN4Dx7eVQIEaAaLwZkisFQThYh3PLsg== Age: 5694 with response body ==>30C282047530C282035DC2A003020102020900C2A70E4A4C34C282C2B77F300D06092AC28648C286C3B70D01010B05003068310B300906035504061302555331....... "GET /rootg2.cer HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: crt.rootg2.amazontrust.com" Response ==> HTTP/1.1 200 OK Content-Type: binary/octet-stream Content-Length: 1145 Connection: keep-alive Last-Modified: Thu 27 Aug 2026 13:09:28 GMT x-amz-server-side-encryption: AES256 x-amz-version-id: A2X7.ooO5I_EAPPeyyJbO.f4401befYg Accept-Ranges: bytes Server: AmazonS3 Date: Wed 02 Sep 2026 11:42:02 GMT ETag: "c6150925cfea5941ddc7ff2a0a506692" X-Cache: Hit from cloudfront Via: 1.1 e774c9e3b514be02964a99136a6cdfda.cloudfront.net (CloudFront) X-Amz-Cf-Pop: JFK52-P5 X-Amz-Cf-Id: uTYlI8A7DDB4OGoFsGDovYlXM-8s_Bdg6RK4O6I8Dd-ncnOeN8in-Q== Age: 5694 with response body ==>30C282047530C282035DC2A003020102020900C2A70E4A4C34C282C2B77F300D06092AC28648C286C3B70D01010B05003068310B300906035504061302555331....... "GET /MFQwUjBQME4wTDAJBgUrDgMCGgUABBSIfaREXmfqfJR3TkMYnD7O5MhzEgQUnF8A36oB1zArOIiiuG1KnPIRkYMCEwZ%2FlEoqJ83z%2BsKuKwH5CO65xMY%3D HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.rootg2.amazontrust.com" Response ==> HTTP/1.1 200 OK Content-Type: application/ocsp-response Content-Length: 1560 Connection: keep-alive Date: Wed 02 Sep 2026 13:05:29 GMT x-amzn-RequestId: 79e44c55-dc01-4b66-b5e9-257ecbf720c4 Last-Modified: Wed 2 Sep 2026 13:05:02 GMT Cache-Control: max-age=302400 public no-transform must-revalidate Expires: Wed 9 Sep 2026 12:05:02 GMT ETag: 98656d93c285cab3b18028f96b2f91f53fe55586 X-Cache: Hit from cloudfront Via: 1.1 909ec3586e2eba60d35c2f3468905558.cloudfront.net (CloudFront) X-Amz-Cf-Pop: JFK50-P7 X-Amz-Cf-Id: gHdiLy7uuB7OPTJqJsQpXKPmClCILgYYyiI9_4frKhtie7rxk0FZHg== Age: 692 with response body ==>30C28206140A0100C2A0C282060D30C282060906092B060105050730010104C28205C3BA30C28205C3B630C281C3A1C2A1563054310B30090603550406130255....... "GET /MFQwUjBQME4wTDAJBgUrDgMCGgUABBRPWaOUU8%2B5VZ5%2Fa9jFTaU9pkK3FAQUhBjMhTTsvAyUlC4IWZzHshBOCggCEwdzEk8qlS4%2B0YpYvbhdG8DOXyc%3D HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.rootca1.amazontrust.com" Response ==> HTTP/1.1 200 OK Content-Type: application/ocsp-response Content-Length: 1438 Connection: keep-alive Date: Wed 02 Sep 2026 12:17:03 GMT x-amzn-RequestId: e3bce2f8-7cac-4d2c-890c-5cef6b24c503 Last-Modified: Wed 2 Sep 2026 12:15:59 GMT Cache-Control: max-age=302400 public no-transform must-revalidate Expires: Wed 9 Sep 2026 11:15:59 GMT ETag: 30c75ba14328749cc93cd8407f02623a174d1e44 X-Cache: Hit from cloudfront Via: 1.1 909ec3586e2eba60d35c2f3468905558.cloudfront.net (CloudFront) X-Amz-Cf-Pop: JFK50-P7 X-Amz-Cf-Id: ATwJIKGTXLEnmq5mXZZsHv8753Wr1EU2OAo8rinxEnKPVRBqUUH1dg== Age: 3599 with response body ==>30C28205C29A0A0100C2A0C28205C29330C28205C28F06092B060105050730010104C28205C28030C282057C30C281C394C2A1493047310B3009060355040613....... "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTihuFvpmFDw5hOcIp918Jm5B3CQgQUH1KSYVaCVH%2BBZtgdPQqqMlyH3QgCEA3N2p7AWhpIo7uTRZjDirs%3D HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.r2m04.amazontrust.com" Response ==> HTTP/1.1 200 OK Content-Type: application/ocsp-response Content-Length: 471 Connection: keep-alive X-XSS-Protection: 1; mode=block X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff X-DC-POP: dub-003 Cache-Control: max-age=1800 Date: Wed 02 Sep 2026 12:48:01 GMT X-Cache: Hit from cloudfront Via: 1.1 12c981a65a1c07b0708c5cd3c67b8b86.cloudfront.net (CloudFront) X-Amz-Cf-Pop: JFK50-P16 X-Amz-Cf-Id: aVTn6gRekKhTmMEO--RwhaFCjjJdOqdStTqz1OrkE-4VAnTJDdCCRw== Age: 1741 with response body ==>30C28201C3930A0100C2A0C28201C38C30C28201C38806092B060105050730010104C28201C2B930C28201C2B530C281C29EC2A21604141F52C2926156C28254....... "GET /wr2/oQ6nyr8F0m0.crl HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: c.pki.goog" Response ==> HTTP/1.1 200 OK Accept-Ranges: bytes Content-Security-Policy-Report-Only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/cacerts Cross-Origin-Resource-Policy: cross-origin Cross-Origin-Opener-Policy: same-origin; report-to="cacerts" Report-To: {"group":"cacerts" "max_age":2592000 "endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/cacerts"}]} Content-Length: 53214 X-Content-Type-Options: nosniff Server: sffe X-XSS-Protection: 0 Date: Wed 02 Sep 2026 13:13:15 GMT Expires: Wed 02 Sep 2026 14:03:15 GMT Cache-Control: public max-age=3000 Last-Modified: Wed 02 Sep 2026 12:12:37 GMT Content-Type: application/pkix-crl Vary: Accept-Encoding Age: 229 with response body ==>30C282C38FC39A30C282C38EC382020101300D06092AC28648C286C3B70D01010B0500303B310B3009060355040613025553311E301C060355040A1315476F6F.......43:T217a,"7ef834fc890f8f801316f859915cba63a0771e89738a882bca0656fda5a74ddf.exe" loaded module "%WINDIR%\SYSTEM32\ADVPACK.DLL" at base 6e070000 "7ef834fc890f8f801316f859915cba63a0771e89738a882bca0656fda5a74ddf.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 74ff0000 "MP5ye33.exe" loaded module "FECLIENT.DLL" at base 71e80000 "MP5ye33.exe" loaded module "%WINDIR%\SYSTEM32\ADVPACK.DLL" at base 6bc20000 "MP5ye33.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 74ff0000 "aR7ev61.exe" loaded module "%WINDIR%\SYSTEM32\ADVPACK.DLL" at base 71750000 "aR7ev61.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 74ff0000 "3Kn814gI.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 73f50000 "3Kn814gI.exe" loaded module "KERNEL32.DLL" at base 767c0000 "3Kn814gI.exe" loaded module "DWMAPI.DLL" at base 73c10000 "3Kn814gI.exe" loaded module "COMCTL32.DLL" at base 74040000 "3Kn814gI.exe" loaded module "UXTHEME.DLL" at base 73f50000 "3Kn814gI.exe" loaded module "IMM32.DLL" at base 76fe0000 "3Kn814gI.exe" loaded module "COMCTL32" at base 74040000 "3Kn814gI.exe" loaded module "SHELL32.DLL" at base 75480000 "3Kn814gI.exe" loaded module "OLE32.DLL" at base 768a0000 "3Kn814gI.exe" loaded module "ADVAPI32.DLL" at base 760d0000 "3Kn814gI.exe" loaded module "PROPSYS.DLL" at base 73c80000 "3Kn814gI.exe" loaded module "OLEAUT32.DLL" at base 76a00000 "3Kn814gI.exe" loaded module "APPHELP.DLL" at base 74ff0000 "3Kn814gI.exe" loaded module "CLBCATQ.DLL" at base 76e20000 "3Kn814gI.exe" loaded module "%WINDIR%\SYSTEM32\IEFRAME.DLL" at base 6a710000 "3Kn814gI.exe" loaded module "API-MS-WIN-DOWNLEVEL-OLE32-L1-1-0.DLL" at base 75450000 "3Kn814gI.exe" loaded module "URLMON.DLL" at base 76560000 "3Kn814gI.exe" loaded module "API-MS-WIN-DOWNLEVEL-SHLWAPI-L2-1-0.DLL" at base 72410000 "3Kn814gI.exe" loaded module "%WINDIR%\SYSTEM32\PROPSYS.DLL" at base 73c80000 "3Kn814gI.exe" loaded module "%PROGRAMFILES%\INTERNET EXPLORER\IEPROXY.DLL" at base 72420000 "3Kn814gI.exe" loaded module "IERTUTIL.DLL" at base 77000000 "3Kn814gI.exe" loaded module "%WINDIR%\SYSTEM32\SHELL32.DLL" at base 75480000 "3Kn814gI.exe" loaded module "USER32.DLL" at base 76eb0000 "3Kn814gI.exe" loaded module "SETUPAPI.DLL" at base 761e0000 "3Kn814gI.exe" loaded module "RPCRT4.DLL" at base 766b0000 "3Kn814gI.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 74ff0000 "4NU6qK7.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 74ff0000 "5ip71Yr.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 74ff0000 "AppLaunch.exe" loaded module "PSAPI.DLL" at base 77390000 "AppLaunch.exe" loaded module "RPCRT4.DLL" at base 766b0000 "AppLaunch.exe" loaded module "KERNEL32.DLL" at base 767c0000 "AppLaunch.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\MSCORLIB\36EACCFDE177C2E7B93B8DBDDE4E012A\MSCORLIB.NI.DLL" at base 615e0000 "AppLaunch.exe" loaded module "OLE32.DLL" at base 768a0000 "AppLaunch.exe" loaded module "CRYPTBASE.DLL" at base 75040000 "AppLaunch.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 73f50000 "AppLaunch.exe" loaded module "API-MS-WIN-CORE-XSTATE-L2-1-0.DLL" at base 71a50000 "AppLaunch.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\CLRJIT.DLL" at base 69fd0000 "AppLaunch.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM\2C3C912EA8F058F9D04C4650128FEB3F\SYSTEM.NI.DLL" at base 60b80000 "AppLaunch.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.DRAWING\F7568D7F1B9D356F64779B4C0927CFB3\SYSTEM.DRAWING.NI.DLL" at base 68290000 "AppLaunch.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.WINDOWS.FORMS\C9A4CBC00F690A9E3CDDFC400F6E85BB\SYSTEM.WINDOWS.FORMS.NI.DLL" at base 5fd10000 "AppLaunch.exe" loaded module "ADVAPI32.DLL" at base 760d0000 "AppLaunch.exe" loaded module "UXTHEME.DLL" at base 73f50000 "AppLaunch.exe" loaded module "USER32.DLL" at base 76eb0000 "AppLaunch.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.CORE\31FAE3290FAD30C31C98651462D22724\SYSTEM.CORE.NI.DLL" at base 5f4f0000 "AppLaunch.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.CONFIGURATION\96F7EDB07B12303F0EC2595C7F3778C7\SYSTEM.CONFIGURATION.NI.DLL" at base 5f3e0000 "AppLaunch.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.XML\15AF16D373CF0528CB74FC73D365FDBF\SYSTEM.XML.NI.DLL" at base 5ec60000 "AppLaunch.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\NLSSORTING.DLL" at base 6e050000 "AppLaunch.exe" loaded module "NTDLL.DLL" at base 77240000 "AppLaunch.exe" loaded module "SHELL32.DLL" at base 75480000 "AppLaunch.exe" loaded module "API-MS-WIN-SECURITY-SDDL-L1-1-0.DLL" at base 76fc0000 "AppLaunch.exe" loaded module "PROFAPI.DLL" at base 75150000 "AppLaunch.exe" loaded module "BCRYPT.DLL" at base 74c60000 "AppLaunch.exe" loaded module "CRYPTSP.DLL" at base 74b50000 "AppLaunch.exe" loaded module "%WINDIR%\SYSTEM32\RSAENH.DLL" at base 748e0000 "AppLaunch.exe" loaded module "IMM32.DLL" at base 76fe0000 "AppLaunch.exe" loaded module "COMCTL32.DLL" at base 718d0000 "AppLaunch.exe" loaded module "GDI32.DLL" at base 764e0000 "AppLaunch.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\WINDOWSBASE\1A4CC316FB6D09525321FC0BE44692D8\WINDOWSBASE.NI.DLL" at base 5e840000 "AppLaunch.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\PRESENTATIONCORE\468F4E17BE144CA12A73A4297EACC9CC\PRESENTATIONCORE.NI.DLL" at base 5dc00000 "AppLaunch.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\PRESENTATIO5AE0F00F#\252CC7B0FAE8CFE083BDC149957C0C54\PRESENTATIONFRAMEWORK.NI.DLL" at base 5c810000 "AppLaunch.exe" loaded module "UCRTBASE_CLR0400.DLL" at base 69a00000 "AppLaunch.exe" loaded module "SHLWAPI.DLL" at base 76760000 "AppLaunch.exe" loaded module "DWRITE.DLL" at base 6a060000 "AppLaunch.exe" loaded module "API-MS-WIN-CORE-STRING-L1-1-0" at base 752e0000 "AppLaunch.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\WPF\WPFGFX_V0400.DLL" at base 5c680000 "AppLaunch.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\WPF\PRESENTATIONNATIVE_V0400.DLL" at base 5c590000 "AppLaunch.exe" loaded module "VERSION.DLL" at base 745e0000 "AppLaunch.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.RUNTEB92AA12#\274E43040C8A7A02EF1065DB3283005A\SYSTEM.RUNTIME.SERIALIZATION.NI.DLL" at base 5c2b0000 "AppLaunch.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.IDENTITYMODEL\C2EF5BC545B98A289F02D0B3EDDBE280\SYSTEM.IDENTITYMODEL.NI.DLL" at base 5bfa0000 "AppLaunch.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SMDIAGNOSTICS\DC67DCB4B2FB4A3853D458CAB08561F0\SMDIAGNOSTICS.NI.DLL" at base 6bf20000 "AppLaunch.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.TRANSACTIONS\3D760B4A3260A41EF84A3FD866780980\SYSTEM.TRANSACTIONS.NI.DLL" at base 68110000 "AppLaunch.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_32\SYSTEM.TRANSACTIONS\V4.0_4.0.0.0__B77A5C561934E089\SYSTEM.TRANSACTIONS.DLL" at base 696d0000 "AppLaunch.exe" loaded module "MSCOREE.DLL" at base 6b640000 "AppLaunch.exe" loaded module "WS2_32.DLL" at base 76f80000 "AppLaunch.exe" loaded module "%WINDIR%\SYSTEM32\MSWSOCK.DLL" at base 74b10000 "AppLaunch.exe" loaded module "%WINDIR%\SYSTEM32\WSHTCPIP.DLL" at base 74670000 "AppLaunch.exe" loaded module "%WINDIR%\SYSTEM32\WSHIP6.DLL" at base 74b00000 "AppLaunch.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\DIASYMREADER.DLL" at base 5b7b0000 "6pl671.exe" loaded module "KERNEL32" at base 767c0000 "6pl671.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 74ff0000 "AppLaunch.exe" loaded module "SSPICLI.DLL" at base 74fd0000 "AppLaunch.exe" loaded module "CREDSSP.DLL" at base 747e0000 "AppLaunch.exe" loaded module "WSHTCPIP" at base 74670000 "AppLaunch.exe" loaded module "WSHIP6.DLL" at base 74b00000 "AppLaunch.exe" loaded module "%WINDIR%\SYSTEM32\WSHQOS.DLL" at base 71970000 "AppLaunch.exe" loaded module "DNSAPI.DLL" at base 749d0000 "AppLaunch.exe" loaded module "IPHLPAPI.DLL" at base 734b0000 "AppLaunch.exe" loaded module "RASADHLP.DLL" at base 71800000 "AppLaunch.exe" loaded module "WINHTTP.DLL" at base 71530000 "AppLaunch.exe" loaded module "%WINDIR%\SYSTEM32\FWPUCLNT.DLL" at base 73420000 "AppLaunch.exe" loaded module "%WINDIR%\SYSTEM32\SCHANNEL.DLL" at base 74950000 "AppLaunch.exe" loaded module "CRYPT32.DLL" at base 7518000044:Tb41,"7ef834fc890f8f801316f859915cba63a0771e89738a882bca0656fda5a74ddf" was detected as "Microsoft Cabinet" and name: "sfx" "7ef834fc890f8f801316f859915cba63a0771e89738a882bca0656fda5a74ddf" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "7ef834fc890f8f801316f859915cba63a0771e89738a882bca0656fda5a74ddf" was detected as "Microsoft Visual C/C++" and name: "Compiler" "7ef834fc890f8f801316f859915cba63a0771e89738a882bca0656fda5a74ddf" was detected as "Microsoft Cabinet File" and name: "Archive" "7ef834fc890f8f801316f859915cba63a0771e89738a882bca0656fda5a74ddf" was detected as "Microsoft Linker" and name: "Linker" "3Kn814gI.exe" was detected as "Microsoft Cabinet" and name: "sfx" "3Kn814gI.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "3Kn814gI.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "3Kn814gI.exe" was detected as "Microsoft Cabinet File" and name: "Archive" "3Kn814gI.exe" was detected as "Microsoft Linker" and name: "Linker" "MP5ye33.exe" was detected as "Microsoft Cabinet" and name: "sfx" "MP5ye33.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "MP5ye33.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "MP5ye33.exe" was detected as "Microsoft Cabinet File" and name: "Archive" "MP5ye33.exe" was detected as "Microsoft Linker" and name: "Linker" "aR7ev61.exe" was detected as "Microsoft Cabinet" and name: "sfx" "aR7ev61.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "aR7ev61.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "aR7ev61.exe" was detected as "Microsoft Cabinet File" and name: "Archive" "aR7ev61.exe" was detected as "Microsoft Linker" and name: "Linker" "6pl671.exe" was detected as "Microsoft Cabinet" and name: "sfx" "6pl671.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "6pl671.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "6pl671.exe" was detected as "Microsoft Cabinet File" and name: "Archive" "6pl671.exe" was detected as "Microsoft Linker" and name: "Linker" "5ip71Yr.exe" was detected as "Microsoft Cabinet" and name: "sfx" "5ip71Yr.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "5ip71Yr.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "5ip71Yr.exe" was detected as "Microsoft Cabinet File" and name: "Archive" "5ip71Yr.exe" was detected as "Microsoft Linker" and name: "Linker" "4NU6qK7.exe" was detected as "Microsoft Cabinet" and name: "sfx" "4NU6qK7.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "4NU6qK7.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "4NU6qK7.exe" was detected as "Microsoft Cabinet File" and name: "Archive" "4NU6qK7.exe" was detected as "Microsoft Linker" and name: "Linker"45:T104d,"7ef834fc890f8f801316f859915cba63a0771e89738a882bca0656fda5a74ddf" file has an entrypoint instructions - "call 0x407155,jmp 0x406a6a,push 0x58,push 0x4072b8,call 0x407208,xor ebx, ebx,mov dword ptr [ebp - 0x20], ebx,lea eax, [ebp - 0x68],push eax,call dword ptr [0x40a184],mov dword ptr [ebp - 4], ebx,mov eax, dword ptr fs:[0x18],mov esi, dword ptr [eax + 4],mov edi, ebx,mov edx, 0x4088ac,mov ecx, esi,xor eax, eax,lock cmpxchg dword ptr [edx], ecx,test eax, eax,je 0x406abc,cmp eax, esi,jne 0x406aaf,xor esi, esi,inc esi,mov edi, esi,jmp 0x406abf,push 0x3e8,call dword ptr [0x40a188],jmp 0x406a93,xor esi, esi,inc esi," "3Kn814gI.exe" file has an entrypoint instructions - "call 0x420aea,jmp 0x4203fb,push ebp,mov ebp, esp,push esi,push dword ptr [ebp + 8],mov esi, ecx,call 0x4205e7,mov dword ptr [esi], 0x49fdf0,mov eax, esi,pop esi,pop ebp,ret 4,and dword ptr [ecx + 4], 0,mov eax, ecx,and dword ptr [ecx + 8], 0,mov dword ptr [ecx + 4], 0x49fdf8,mov dword ptr [ecx], 0x49fdf0,ret ,push ebp,mov ebp, esp,push esi,push dword ptr [ebp + 8],mov esi, ecx,call 0x4205e7,mov dword ptr [esi], 0x49fe0c,mov eax, esi,pop esi,pop ebp,ret 4,and dword ptr [ecx + 4], 0,mov eax, ecx,and dword ptr [ecx + 8], 0," "MP5ye33.exe" file has an entrypoint instructions - "call 0x407155,jmp 0x406a6a,push 0x58,push 0x4072b8,call 0x407208,xor ebx, ebx,mov dword ptr [ebp - 0x20], ebx,lea eax, [ebp - 0x68],push eax,call dword ptr [0x40a184],mov dword ptr [ebp - 4], ebx,mov eax, dword ptr fs:[0x18],mov esi, dword ptr [eax + 4],mov edi, ebx,mov edx, 0x4088ac,mov ecx, esi,xor eax, eax,lock cmpxchg dword ptr [edx], ecx,test eax, eax,je 0x406abc,cmp eax, esi,jne 0x406aaf,xor esi, esi,inc esi,mov edi, esi,jmp 0x406abf,push 0x3e8,call dword ptr [0x40a188],jmp 0x406a93,xor esi, esi,inc esi," "aR7ev61.exe" file has an entrypoint instructions - "call 0x407155,jmp 0x406a6a,push 0x58,push 0x4072b8,call 0x407208,xor ebx, ebx,mov dword ptr [ebp - 0x20], ebx,lea eax, [ebp - 0x68],push eax,call dword ptr [0x40a184],mov dword ptr [ebp - 4], ebx,mov eax, dword ptr fs:[0x18],mov esi, dword ptr [eax + 4],mov edi, ebx,mov edx, 0x4088ac,mov ecx, esi,xor eax, eax,lock cmpxchg dword ptr [edx], ecx,test eax, eax,je 0x406abc,cmp eax, esi,jne 0x406aaf,xor esi, esi,inc esi,mov edi, esi,jmp 0x406abf,push 0x3e8,call dword ptr [0x40a188],jmp 0x406a93,xor esi, esi,inc esi," "6pl671.exe" file has an entrypoint instructions - "call 0x402aae,jmp 0x402450,mov ecx, dword ptr [ebp - 0xc],mov dword ptr fs:[0], ecx,pop ecx,pop edi,pop edi,pop esi,pop ebx,mov esp, ebp,pop ebp,push ecx,ret ,mov ecx, dword ptr [ebp - 0x10],xor ecx, ebp,call 0x40231c,jmp 0x4025dc,push eax,push dword ptr fs:[0],lea eax, [esp + 0xc],sub esp, dword ptr [esp + 0xc],push ebx,push esi,push edi,mov dword ptr [eax], ebp,mov ebp, eax,mov eax, dword ptr [0x41800c],xor eax, ebp,push eax,push dword ptr [ebp - 4],mov dword ptr [ebp - 4], 0xffffffff,lea eax, [ebp - 0xc],mov dword ptr fs:[0], eax,ret ,push eax," "5ip71Yr.exe" file has an entrypoint instructions - "call 0x402aae,jmp 0x402450,mov ecx, dword ptr [ebp - 0xc],mov dword ptr fs:[0], ecx,pop ecx,pop edi,pop edi,pop esi,pop ebx,mov esp, ebp,pop ebp,push ecx,ret ,mov ecx, dword ptr [ebp - 0x10],xor ecx, ebp,call 0x40231c,jmp 0x4025dc,push eax,push dword ptr fs:[0],lea eax, [esp + 0xc],sub esp, dword ptr [esp + 0xc],push ebx,push esi,push edi,mov dword ptr [eax], ebp,mov ebp, eax,mov eax, dword ptr [0x41800c],xor eax, ebp,push eax,push dword ptr [ebp - 4],mov dword ptr [ebp - 4], 0xffffffff,lea eax, [ebp - 0xc],mov dword ptr fs:[0], eax,ret ,push eax," "4NU6qK7.exe" file has an entrypoint instructions - "call 0x402aae,jmp 0x402450,mov ecx, dword ptr [ebp - 0xc],mov dword ptr fs:[0], ecx,pop ecx,pop edi,pop edi,pop esi,pop ebx,mov esp, ebp,pop ebp,push ecx,ret ,mov ecx, dword ptr [ebp - 0x10],xor ecx, ebp,call 0x40231c,jmp 0x4025dc,push eax,push dword ptr fs:[0],lea eax, [esp + 0xc],sub esp, dword ptr [esp + 0xc],push ebx,push esi,push edi,mov dword ptr [eax], ebp,mov ebp, eax,mov eax, dword ptr [0x41800c],xor eax, ebp,push eax,push dword ptr [ebp - 4],mov dword ptr [ebp - 4], 0xffffffff,lea eax, [ebp - 0xc],mov dword ptr fs:[0], eax,ret ,push eax,"46:T5c2,"7ef834fc890f8f801316f859915cba63a0771e89738a882bca0656fda5a74ddf.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "7ef834fc890f8f801316f859915cba63a0771e89738a882bca0656fda5a74ddf.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "MP5ye33.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "MP5ye33.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "aR7ev61.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "aR7ev61.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "3Kn814gI.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "3Kn814gI.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "3Kn814gI.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LOCALE"; Key: "00000409") "4NU6qK7.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "4NU6qK7.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "5ip71Yr.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "5ip71Yr.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "6pl671.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "6pl671.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US")47:T106e,Observed system executable string:"C:\Windows\system32\apphelp.dll" [Source: 00005684.00001634.1035358.00050000.wprm] Observed system executable string:"%WINDIR%\system32\advpack.dll" [Source: 00000000-00005936-00000C2B-177478241] Observed system executable string:"rundll32.exe %WINDIR%\system32\advpack.dll,DelNodeRunDLL32 "%TEMP%\IXP000.TMP\"" [Source: 00000000-00005936-00000BC1-177649037] Observed system executable string:"rundll32.exe %WINDIR%\system32\advpack.dll,DelNodeRunDLL32 "%TEMP%\IXP001.TMP\"" [Source: 00000000-00005708-00000BC1-178671996] Observed system executable string:"rundll32.exe %WINDIR%\system32\advpack.dll,DelNodeRunDLL32 "%TEMP%\IXP002.TMP\"" [Source: 00000000-00005684-00000BC1-179380139] Observed system executable string:"%WINDIR%\system32\uxtheme.dll" [Source: 00000000-00005948-00000C2B-179988948] Observed system executable string:"%WINDIR%\System32\ieframe.dll" [Source: 00000000-00005948-00000C2B-184347691] Observed system executable string:"%WINDIR%\system32\combase.dll" [Source: 00000000-00002372-00000C2B-227835763] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\mscorlib\36eaccfde177c2e7b93b8dbdde4e012a\mscorlib.ni.dll" [Source: 00000000-00002372-00000C2B-228013750] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\ole32.dll" [Source: 00000000-00002372-00000C2B-228037085] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\clrjit.dll" [Source: 00000000-00002372-00000C2B-228189982] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System\2c3c912ea8f058f9d04c4650128feb3f\System.ni.dll" [Source: 00000000-00002372-00000C2B-228256214] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Drawing\f7568d7f1b9d356f64779b4c0927cfb3\System.Drawing.ni.dll" [Source: 00000000-00002372-00000C2B-228292361] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Windows.Forms\c9a4cbc00f690a9e3cddfc400f6e85bb\System.Windows.Forms.ni.dll" [Source: 00000000-00002372-00000C2B-228340443] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\uxtheme.dll" [Source: 00000000-00002372-00000C2B-228877055] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Core\31fae3290fad30c31c98651462d22724\System.Core.ni.dll" [Source: 00000000-00002372-00000C2B-228954971] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Configuration\96f7edb07b12303f0ec2595c7f3778c7\System.Configuration.ni.dll" [Source: 00000000-00002372-00000C2B-228976983] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Xml\15af16d373cf0528cb74fc73d365fdbf\System.Xml.ni.dll" [Source: 00000000-00002372-00000C2B-229010330] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\nlssorting.dll" [Source: 00000000-00002372-00000C2B-229034669] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll" [Source: 00000000-00002372-00000C2B-229145558] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\WindowsBase\1a4cc316fb6d09525321fc0be44692d8\WindowsBase.ni.dll" [Source: 00000000-00002372-00000C2B-229763968] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\PresentationCore\468f4e17be144ca12a73a4297eacc9cc\PresentationCore.ni.dll" [Source: 00000000-00002372-00000C2B-229832316] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\Presentatio5ae0f00f#\252cc7b0fae8cfe083bdc149957c0c54\PresentationFramework.ni.dll" [Source: 00000000-00002372-00000C2B-229898391] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_32\PresentationCore\v4.0_4.0.0.0__31bf3856ad364e35\ucrtbase_clr0400.dll" [Source: 00000000-00002372-00000C2B-229981627] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_32\PresentationCore\v4.0_4.0.0.0__31bf3856ad364e35\SHLWAPI.dll" [Source: 00000000-00002372-00000C2B-230048097]48:T584,Spawned process "MP5ye33.exe" (UID: 00000000-00005708) Spawned process "aR7ev61.exe" (UID: 00000000-00005684) Spawned process "3Kn814gI.exe" (UID: 00000000-00005948) Spawned process "iexplore.exe" with commandline "https://accounts.google.com/" (UID: 00000000-00005788) Spawned process "iexplore.exe" with commandline "SCODEF:5788 CREDAT:275457 /prefetch:2" (UID: 00000000-00005940) Spawned process "iexplore.exe" with commandline "SCODEF:5788 CREDAT:275465 /prefetch:2" (UID: 00000000-00004292) Spawned process "iexplore.exe" with commandline "SCODEF:5788 CREDAT:865288 /prefetch:2" (UID: 00000000-00004368) Spawned process "iexplore.exe" with commandline "SCODEF:5788 CREDAT:406544 /prefetch:2" (UID: 00000000-00003448) Spawned process "iexplore.exe" with commandline "SCODEF:5788 CREDAT:668712 /prefetch:2" (UID: 00000000-00003956) Spawned process "iexplore.exe" with commandline "SCODEF:5788 CREDAT:2044957 /prefetch:2" (UID: 00000000-00004116) Spawned process "iexplore.exe" with commandline "SCODEF:5788 CREDAT:603207 /prefetch:2" (UID: 00000000-00003836) Spawned process "4NU6qK7.exe" (UID: 00000000-00001832) Spawned process "AppLaunch.exe" (UID: 00000000-00003720) Spawned process "5ip71Yr.exe" (UID: 00000000-00000844) Spawned process "AppLaunch.exe" (UID: 00000000-00002372) Spawned process "6pl671.exe" (UID: 00000000-00004076) Spawned process "AppLaunch.exe" (UID: 00000000-00003020)49:T584,Spawned process "MP5ye33.exe" (UID: 00000000-00005708) Spawned process "aR7ev61.exe" (UID: 00000000-00005684) Spawned process "3Kn814gI.exe" (UID: 00000000-00005948) Spawned process "iexplore.exe" with commandline "https://accounts.google.com/" (UID: 00000000-00005788) Spawned process "iexplore.exe" with commandline "SCODEF:5788 CREDAT:275457 /prefetch:2" (UID: 00000000-00005940) Spawned process "iexplore.exe" with commandline "SCODEF:5788 CREDAT:275465 /prefetch:2" (UID: 00000000-00004292) Spawned process "iexplore.exe" with commandline "SCODEF:5788 CREDAT:865288 /prefetch:2" (UID: 00000000-00004368) Spawned process "iexplore.exe" with commandline "SCODEF:5788 CREDAT:406544 /prefetch:2" (UID: 00000000-00003448) Spawned process "iexplore.exe" with commandline "SCODEF:5788 CREDAT:668712 /prefetch:2" (UID: 00000000-00003956) Spawned process "iexplore.exe" with commandline "SCODEF:5788 CREDAT:2044957 /prefetch:2" (UID: 00000000-00004116) Spawned process "iexplore.exe" with commandline "SCODEF:5788 CREDAT:603207 /prefetch:2" (UID: 00000000-00003836) Spawned process "4NU6qK7.exe" (UID: 00000000-00001832) Spawned process "AppLaunch.exe" (UID: 00000000-00003720) Spawned process "5ip71Yr.exe" (UID: 00000000-00000844) Spawned process "AppLaunch.exe" (UID: 00000000-00002372) Spawned process "6pl671.exe" (UID: 00000000-00004076) Spawned process "AppLaunch.exe" (UID: 00000000-00003020)4a:Tb80,The input sample is signed with a certificate issued by "CN=WR2, O=Google Trust Services, C=US" (SHA1: FC:B8:DC:ED:6F:0B:18:09:F8:63:FD:24:B5:43:5B:82:24:12:8D:CE; see report for more information) The input sample is signed with a certificate issued by "CN=GTS Root R1, O=Google Trust Services LLC, C=US" (SHA1: 66:E4:16:12:60:B1:00:FE:E0:DE:28:7A:9A:52:93:B4:C2:22:4A:E6; see report for more information) The input sample is signed with a certificate issued by "CN=GlobalSign Root CA, OU=Root CA, O=GlobalSign nv-sa, C=BE" (SHA1: 08:74:54:87:E8:91:C1:9E:30:78:C1:F2:A0:7E:45:29:50:EF:36:F6; see report for more information) The input sample is signed with a certificate issued by "CN=WR2, O=Google Trust Services, C=US" (SHA1: BC:1F:B5:F8:04:0C:7B:4F:F4:4F:20:30:D3:BA:66:E6:AF:8E:8F:AF; see report for more information) The input sample is signed with a certificate issued by "CN=WR2, O=Google Trust Services, C=US" (SHA1: DB:16:C1:37:8D:6C:67:F5:7B:69:A5:CC:5A:E4:14:86:68:68:28:08; see report for more information) The input sample is signed with a certificate issued by "CN=WR2, O=Google Trust Services, C=US" (SHA1: 2F:3E:B0:A8:44:32:59:B0:15:E4:8E:5A:B5:0C:9C:5C:04:8F:36:E4; see report for more information) The input sample is signed with a certificate issued by "CN=WE1, O=Google Trust Services, C=US" (SHA1: 36:C6:15:F5:21:0B:24:21:0E:72:00:85:DD:C6:59:8A:81:39:9C:5F; see report for more information) The input sample is signed with a certificate issued by "CN=GTS Root R4, O=Google Trust Services LLC, C=US" (SHA1: 10:8F:BF:79:4E:18:EC:53:47:A4:14:E4:37:0C:C4:50:6C:29:7A:B2; see report for more information) The input sample is signed with a certificate issued by "CN=GlobalSign Root CA, OU=Root CA, O=GlobalSign nv-sa, C=BE" (SHA1: 93:2B:ED:33:9A:A6:92:12:C8:93:75:B7:93:04:B4:75:49:0B:89:A0; see report for more information) The input sample is signed with a certificate issued by "CN=WE1, O=Google Trust Services, C=US" (SHA1: 3C:F7:A3:68:2E:01:AD:2D:3C:81:BA:39:16:59:75:E3:82:26:E5:84; see report for more information) The input sample is signed with a certificate issued by "CN=DigiCert Global G2 TLS RSA SHA256 2020 CA1, O=DigiCert Inc, C=US" (SHA1: 5B:76:95:FB:5F:5F:B8:AB:EA:41:D9:E5:A2:43:66:53:F3:6E:FC:2E; see report for more information) The input sample is signed with a certificate issued by "CN=DigiCert Global Root G2, OU=www.digicert.com, O=DigiCert Inc, C=US" (SHA1: 1B:51:1A:BE:AD:59:C6:CE:20:70:77:C0:BF:0E:00:43:B1:38:26:12; see report for more information) The input sample is signed with a certificate issued by "CN=DigiCert High Assurance EV Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US" (SHA1: B7:40:25:17:EE:AA:C8:0A:B0:46:81:18:6E:82:47:BD:78:51:CD:0A; see report for more information) The input sample is signed with a certificate issued by "CN=Amazon RSA 2048 M04, O=Amazon, C=US" (SHA1: EE:C1:BD:4E:34:75:3D:C4:2D:EA:58:F4:C4:BE:80:F1:E7:A2:AE:4E; see report for more information)4b:T286a,"3Kn814gI.exe" has type "PE32 executable for MS Windows 5.01 (GUI) Intel i386 5 sections"- Location: [%TEMP%\IXP002.TMP\3Kn814gI.exe]- [targetUID: 00000000-00005948] "MP5ye33.exe" has type "PE32 executable for MS Windows 6.00 (GUI) Intel i386 5 sections"- Location: [%TEMP%\IXP000.TMP\MP5ye33.exe]- [targetUID: 00000000-00005936] "aR7ev61.exe" has type "PE32 executable for MS Windows 6.00 (GUI) Intel i386 5 sections"- Location: [%TEMP%\IXP001.TMP\aR7ev61.exe]- [targetUID: 00000000-00005708] "6pl671.exe" has type "PE32 executable for MS Windows 6.00 (console) Intel i386 5 sections"- Location: [%TEMP%\IXP000.TMP\6pl671.exe]- [targetUID: 00000000-00005936] "5ip71Yr.exe" has type "PE32 executable for MS Windows 6.00 (console) Intel i386 5 sections"- Location: [%TEMP%\IXP001.TMP\5ip71Yr.exe]- [targetUID: 00000000-00005708] "4NU6qK7.exe" has type "PE32 executable for MS Windows 6.00 (console) Intel i386 5 sections"- Location: [%TEMP%\IXP002.TMP\4NU6qK7.exe]- [targetUID: 00000000-00001832] "index-Es9wMzhK_1_.js" has type "Unknown"- [targetUID: N/A] "s82PjsnlZP2IQAEG095i0Yxgo-3469oiGT9DWDYPz6DhfgQe914iiBfD-GevAmvU9KONMKn3YhINqU49pVNahkCkeiF2w9Hlit1WpaE_brMCJG_1_.css" has type "Unknown"- [targetUID: N/A] "identifier_2_.htm" has type "Unknown"- [targetUID: N/A] "identifier_1_.htm" has type "Unknown"- [targetUID: N/A] "login_1_.htm" has type "Unknown"- [targetUID: N/A] "api_1_.js" has type "Unknown"- [targetUID: N/A] "JX42Y9GD.htm" has type "HTML document ASCII text with very long lines (56674) with CRLF line terminators"- [targetUID: N/A] "dinosaur_1_.png" has type "Unknown"- [targetUID: N/A] "0839ECC4815B5D8D5ED699ED1C20C543" has type "Unknown"- [targetUID: N/A] "595CD0DCED5F6DE43A9C77C525C44511" has type "Unknown"- [targetUID: N/A] "75A092F4522006A97542D6AC4F4E69D2" has type "Unknown"- [targetUID: N/A] "9C69E496D546F49A980D7350EC49A180" has type "Unknown"- [targetUID: N/A] "imagestore.dat" has type "Unknown"- [targetUID: N/A] "KFOMCnqEu92Fr1ME7kSn66aGLdTylUAMQXC89YmC2DPNWub2bVmUiAw_1_.woff" has type "Unknown"- [targetUID: N/A] "KFOMCnqEu92Fr1ME7kSn66aGLdTylUAMQXC89YmC2DPNWubEbVmUiAw_1_.woff" has type "Unknown"- [targetUID: N/A] "_DD856490-A6D0-11F1-A1D6-005056910277_.dat" has type "Unknown"- [targetUID: N/A] "~DF5D85F9B866141393.TMP" has type "Unknown"- [targetUID: N/A] "~DF502E41C33002E6B7.TMP" has type "Unknown"- [targetUID: N/A] "~DF5561FE7CE5528E7D.TMP" has type "Unknown"- [targetUID: N/A] "ay1hV6OlegS_1_.ico" has type "Unknown"- [targetUID: N/A] "main_1_.js" has type "Unknown"- [targetUID: N/A] "Qw3hZQNGEDjaO2m6tqIqX5E-AVS5_rSejo46_PCTRspJ0OosolrBEJL3HMXfxQASluL2m_dANVawBpSF_1_.woff" has type "Unknown"- [targetUID: N/A] "en-US.4" has type "Unknown"- [targetUID: N/A] "~DF1E2383D369E3547F.TMP" has type "Unknown"- [targetUID: N/A] "~DFB9AC885B2CEC994A.TMP" has type "Unknown"- [targetUID: N/A] "~DFFA72491C8468644F.TMP" has type "Unknown"- [targetUID: N/A] "~DFF8D54E3F0F8BEE6A.TMP" has type "Unknown"- [targetUID: N/A] "~DFA2FDD3C4F81B7CD5.TMP" has type "Unknown"- [targetUID: N/A] "~DFF5EFE470148BEB0C.TMP" has type "Unknown"- [targetUID: N/A] "~DF30063CB4524089C4.TMP" has type "Unknown"- [targetUID: N/A] "~DF4A39BED61ECC3F4C.TMP" has type "Unknown"- [targetUID: N/A] "~DF86A6C8329AD09711.TMP" has type "Unknown"- [targetUID: N/A] "~DFF84799644963A68C.TMP" has type "Unknown"- [targetUID: N/A] "~DF32554466F48B7CF8.TMP" has type "Unknown"- [targetUID: N/A] "firefox_1_.png" has type "Unknown"- [targetUID: N/A] "yt_logo_rgb_light_1_.png" has type "Unknown"- [targetUID: N/A] "httpErrorPagesScripts_1_" has type "Unknown"- [targetUID: N/A] "_8305A104-A6D0-11F1-A1D6-005056910277_.dat" has type "Unknown"- [targetUID: N/A] "_8305A106-A6D0-11F1-A1D6-005056910277_.dat" has type "Unknown"- [targetUID: N/A] "dberr.txt" has type "Unknown"- [targetUID: N/A] "edgium_1_.png" has type "Unknown"- [targetUID: N/A] "RecoveryStore._8305A102-A6D0-11F1-A1D6-005056910277_.dat" has type "Unknown"- [targetUID: N/A] "chrome_1_.png" has type "Unknown"- [targetUID: N/A] "supported_browsers_1_.htm" has type "Unknown"- [targetUID: N/A] "epic-favicon-96x96_1_.png" has type "Unknown"- [targetUID: N/A] "_8305A105-A6D0-11F1-A1D6-005056910277_.dat" has type "Unknown"- [targetUID: N/A] "favicon_2_.ico" has type "Unknown"- [targetUID: N/A] "57C8EDB95DF3F0AD4EE2DC2B8CFD4157" has type "Unknown"- [targetUID: N/A] "_D069104E-A6D0-11F1-A1D6-005056910277_.dat" has type "Unknown"- [targetUID: N/A] "_D67DD443-A6D0-11F1-A1D6-005056910277_.dat" has type "Unknown"- [targetUID: N/A] "_D67DD444-A6D0-11F1-A1D6-005056910277_.dat" has type "Unknown"- [targetUID: N/A] "_D0691052-A6D0-11F1-A1D6-005056910277_.dat" has type "Unknown"- [targetUID: N/A] "_D069104F-A6D0-11F1-A1D6-005056910277_.dat" has type "Unknown"- [targetUID: N/A] "_D67DD442-A6D0-11F1-A1D6-005056910277_.dat" has type "Unknown"- [targetUID: N/A] "_D67DD446-A6D0-11F1-A1D6-005056910277_.dat" has type "Unknown"- [targetUID: N/A] "_D0691050-A6D0-11F1-A1D6-005056910277_.dat" has type "Unknown"- [targetUID: N/A] "_DD856491-A6D0-11F1-A1D6-005056910277_.dat" has type "Unknown"- [targetUID: N/A] "_D67DD441-A6D0-11F1-A1D6-005056910277_.dat" has type "Unknown"- [targetUID: N/A] "_D67DD445-A6D0-11F1-A1D6-005056910277_.dat" has type "Unknown"- [targetUID: N/A] "_D0691051-A6D0-11F1-A1D6-005056910277_.dat" has type "Unknown"- [targetUID: N/A] "Vk4cmgW6O-5_1_.webp" has type "Unknown"- [targetUID: N/A] "errorPageStrings_1_" has type "Unknown"- [targetUID: N/A] "R11MSOD8HMYYC8110Z08.temp" has type "Unknown"- [targetUID: N/A] "googlelogo_color_74x24dp_1_.png" has type "Unknown"- [targetUID: N/A] "opera_1_.png" has type "Unknown"- [targetUID: N/A] "index-CfssTcG8_1_.css" has type "Unknown"- [targetUID: N/A] "8B2B9A00839EED1DFDCCC3BFC2F5DF12" has type "Unknown"- [targetUID: N/A] "dnserror_1_" has type "Unknown"- [targetUID: N/A] "B76BE66D46C355931939D8CF818D03FD_879AFEB08DCB012707582D902977FF92" has type "Unknown"- [targetUID: N/A] "B76BE66D46C355931939D8CF818D03FD_68DC46933CF3DE41CC968E0784D43DC3" has type "Unknown"- [targetUID: N/A] "BAD725C80F9E10846F35D039A996E4A8_88B6AE015495C1ECC395D19C1DD02894" has type "Unknown"- [targetUID: N/A] "24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA" has type "Unknown"- [targetUID: N/A] "75CA58072B9926F763A91F0CC2798706_3AD253ACA02D44EA5FD30683B8A5B5FA" has type "Unknown"- [targetUID: N/A] "NewErrorPageTemplate_1_" has type "Unknown"- [targetUID: N/A] "CheckConnection_1_.htm" has type "Unknown"- [targetUID: N/A] "favicon_1_.ico" has type "Unknown"- [targetUID: N/A] "DABA17F5E36CBE65640DD2FE24F104E7" has type "Unknown"- [targetUID: N/A] "05DDC6AA91765AACACDB0A5F96DF8199" has type "Unknown"- [targetUID: N/A] "892580777767344DCAEF580FFA143EA6_EF1B61DD3F93C58DBD0734F13C15C0F6" has type "Unknown"- [targetUID: N/A] "PBCDJ3DP.txt" has type "Unknown"- [targetUID: N/A] "IREV43C4.txt" has type "Unknown"- [targetUID: N/A] "C7SOUENT.txt" has type "Unknown"- [targetUID: N/A] "0M7MQNGH.txt" has type "Unknown"- [targetUID: N/A] "1CQ0GJBQ.txt" has type "Unknown"- [targetUID: N/A] "68U1UCAY.txt" has type "Unknown"- [targetUID: N/A] "I8LVHTYQ.txt" has type "Unknown"- [targetUID: N/A] "U15ZN4BR.txt" has type "Unknown"- [targetUID: N/A] "PH1SCE9U.txt" has type "Unknown"- [targetUID: N/A] "B46811C17859FFB409CF0E904A4AA8F8" has type "Unknown"- [targetUID: N/A] "G9ASQ31B.txt" has type "Unknown"- [targetUID: N/A] "4JZE0BB8.txt" has type "Unknown"- [targetUID: N/A] "E2C6CBAF0AF08CF203BA74BF0D0AB6D5_49536AB5156BDD74EFF881D01C36A419" has type "Unknown"- [targetUID: N/A] "D1BEC81CCAFDC823A062FF26A89A6B6D_B9B4646227E0866A0D172EA2B644DB92" has type "Unknown"- [targetUID: N/A] "59D76868C250B3240414CE3EFBB12518_1DA3F061DABFE244FDEDDDD0519BC67D" has type "Unknown"- [targetUID: N/A] "6CAFE3B721B7CE350C58A8F3EB28AA44_C4935EE08CAA8E5372EBE50CFA866626" has type "Unknown"- [targetUID: N/A] "E2C6CBAF0AF08CF203BA74BF0D0AB6D5_EAF5D55D93603A879FA973006301F24F" has type "Unknown"- [targetUID: N/A] "F28CC103A764A74B222272A7D2BDDA5C" has type "Unknown"- [targetUID: N/A] "TLV4ZWFV.txt" has type "Unknown"- [targetUID: N/A] "26C212D9399727259664BDFCA073966E_912C3CA51DE6018A7BE4CA7BC64AAFCD" has type "Unknown"- [targetUID: N/A] "ZJ3392OL.txt" has type "Unknown"- [targetUID: N/A] "55D343B052AE566C8BF677731180E634" has type "Unknown"- [targetUID: N/A] "CC640368512A0520EF9FE4E00D0FE9C4" has type "Unknown"- [targetUID: N/A] "MKGSRAJ9.txt" has type "Unknown"- [targetUID: N/A] "CYE2SJQS.txt" has type "Unknown"- [targetUID: N/A] "H107DKJM.txt" has type "Unknown"- [targetUID: N/A] "X7CPDV8U.txt" has type "Unknown"- [targetUID: N/A] "PJ7U7CAB.txt" has type "Unknown"- [targetUID: N/A] "XW2KG0XV.txt" has type "Unknown"- [targetUID: N/A] "GG9F2T94.txt" has type "Unknown"- [targetUID: N/A] "7QV69M57.htm" has type "gzip compressed data original size modulo 2^32 365"- [targetUID: N/A] "HE4LW6O1.txt" has type "Unknown"- [targetUID: N/A] "favicon_1_.htm" has type "Unknown"- [targetUID: N/A] "MTXNRLCN.txt" has type "Unknown"- [targetUID: N/A] "3CBNLCG7.txt" has type "Unknown"- [targetUID: N/A] "MYFDBTNP.txt" has type "Unknown"- [targetUID: N/A] "M3EBX0QK.txt" has type "Unknown"- [targetUID: N/A] "YPG9VEYU.txt" has type "Unknown"- [targetUID: N/A] "33CPP8XK.txt" has type "Unknown"- [targetUID: N/A] "B70ET29P.txt" has type "Unknown"- [targetUID: N/A] "NDW6AAC1.txt" has type "Unknown"- [targetUID: N/A] "SDEFBGPQ.txt" has type "Unknown"- [targetUID: N/A] "www.epicgames_1_.xml" has type "Unknown"- [targetUID: N/A] "bscframe_1_.htm" has type "Unknown"- [targetUID: N/A] "~DF958B841779BA99C1.TMP" has type "Unknown"- [targetUID: N/A] "~DF77781627C1EA9E59.TMP" has type "Unknown"- [targetUID: N/A] "~DF15F2DD2E8F26FBD1.TMP" has type "Unknown"- [targetUID: N/A] "dnserror_2_" has type "Unknown"- [targetUID: N/A] "NewErrorPageTemplate_2_" has type "Unknown"- [targetUID: N/A] "ZC186DNJ.htm" has type "gzip compressed data original size modulo 2^32 365"- [targetUID: N/A] "X30NWI9R.htm" has type "gzip compressed data original size modulo 2^32 365"- [targetUID: N/A] "LUHK3M02.txt" has type "Unknown"- [targetUID: N/A] "AH5W63OK.txt" has type "Unknown"- [targetUID: N/A] "4P3NK5C4.txt" has type "Unknown"- [targetUID: N/A] "PEI4ISAI.txt" has type "Unknown"- [targetUID: N/A]4c:Tadb,"7ef834fc890f8f801316f859915cba63a0771e89738a882bca0656fda5a74ddf.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\SIDEBYSIDE"; Key: ""; Value: "") "7ef834fc890f8f801316f859915cba63a0771e89738a882bca0656fda5a74ddf.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: ""; Value: "") "7ef834fc890f8f801316f859915cba63a0771e89738a882bca0656fda5a74ddf.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SAFEBOOT\OPTION"; Key: ""; Value: "") "7ef834fc890f8f801316f859915cba63a0771e89738a882bca0656fda5a74ddf.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SRP\GP\DLL"; Key: ""; Value: "") "7ef834fc890f8f801316f859915cba63a0771e89738a882bca0656fda5a74ddf.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "7ef834fc890f8f801316f859915cba63a0771e89738a882bca0656fda5a74ddf.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "7ef834fc890f8f801316f859915cba63a0771e89738a882bca0656fda5a74ddf.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\SIDEBYSIDE\ASSEMBLYSTORAGEROOTS"; Key: ""; Value: "") "7ef834fc890f8f801316f859915cba63a0771e89738a882bca0656fda5a74ddf.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS"; Key: ""; Value: "") "7ef834fc890f8f801316f859915cba63a0771e89738a882bca0656fda5a74ddf.exe" (Access type: "OPEN"; Path: "HKCU\CONTROL PANEL\DESKTOP\MUICACHED\MACHINELANGUAGECONFIGURATION"; Key: ""; Value: "") "7ef834fc890f8f801316f859915cba63a0771e89738a882bca0656fda5a74ddf.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\MUI\SETTINGS"; Key: ""; Value: "") "7ef834fc890f8f801316f859915cba63a0771e89738a882bca0656fda5a74ddf.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\CONTROL PANEL\DESKTOP"; Key: ""; Value: "") "7ef834fc890f8f801316f859915cba63a0771e89738a882bca0656fda5a74ddf.exe" (Access type: "OPEN"; Path: "HKCU\CONTROL PANEL\DESKTOP\LANGUAGECONFIGURATION"; Key: ""; Value: "") "7ef834fc890f8f801316f859915cba63a0771e89738a882bca0656fda5a74ddf.exe" (Access type: "OPEN"; Path: "HKCU\CONTROL PANEL\DESKTOP"; Key: ""; Value: "") "7ef834fc890f8f801316f859915cba63a0771e89738a882bca0656fda5a74ddf.exe" (Access type: "OPEN"; Path: "HKCU\CONTROL PANEL\DESKTOP\MUICACHED"; Key: ""; Value: "") "7ef834fc890f8f801316f859915cba63a0771e89738a882bca0656fda5a74ddf.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: ""; Value: "") "7ef834fc890f8f801316f859915cba63a0771e89738a882bca0656fda5a74ddf.exe" (Access type: "OPEN"; Path: "HKLM"; Key: ""; Value: "")4d:Tfff,"7ef834fc890f8f801316f859915cba63a0771e89738a882bca0656fda5a74ddf.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\SIDEBYSIDE"; Key: "PREFEREXTERNALMANIFEST"; Value: "") "7ef834fc890f8f801316f859915cba63a0771e89738a882bca0656fda5a74ddf.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "CWDILLEGALINDLLSEARCH"; Value: "") "7ef834fc890f8f801316f859915cba63a0771e89738a882bca0656fda5a74ddf.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED"; Value: "") "7ef834fc890f8f801316f859915cba63a0771e89738a882bca0656fda5a74ddf.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS"; Key: "SHOWDEBUGINFO"; Value: "") "7ef834fc890f8f801316f859915cba63a0771e89738a882bca0656fda5a74ddf.exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP"; Key: "PREFERREDUILANGUAGES"; Value: "") "7ef834fc890f8f801316f859915cba63a0771e89738a882bca0656fda5a74ddf.exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP\MUICACHED"; Key: "MACHINEPREFERREDUILANGUAGES"; Value: "") "7ef834fc890f8f801316f859915cba63a0771e89738a882bca0656fda5a74ddf.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: "COMPATDLL"; Value: "") "7ef834fc890f8f801316f859915cba63a0771e89738a882bca0656fda5a74ddf.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: "00060101.00060101"; Value: "") "7ef834fc890f8f801316f859915cba63a0771e89738a882bca0656fda5a74ddf.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: ""; Value: "") "7ef834fc890f8f801316f859915cba63a0771e89738a882bca0656fda5a74ddf.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "SAFEDLLSEARCHMODE"; Value: "") "7ef834fc890f8f801316f859915cba63a0771e89738a882bca0656fda5a74ddf.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\GRE_INITIALIZE"; Key: "DISABLEMETAFILES"; Value: "") "7ef834fc890f8f801316f859915cba63a0771e89738a882bca0656fda5a74ddf.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\COMPATIBILITY32"; Key: "7EF834FC890F8F801316F859915CBA63A0771E89738A882BCA0656FDA5A74DDF"; Value: "") "7ef834fc890f8f801316f859915cba63a0771e89738a882bca0656fda5a74ddf.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINDOWS"; Key: "LOADAPPINIT_DLLS"; Value: "") "7ef834fc890f8f801316f859915cba63a0771e89738a882bca0656fda5a74ddf.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE"; Key: "PAGEALLOCATORUSESYSTEMHEAP"; Value: "") "7ef834fc890f8f801316f859915cba63a0771e89738a882bca0656fda5a74ddf.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE"; Key: "PAGEALLOCATORSYSTEMHEAPISPRIVATE"; Value: "") "7ef834fc890f8f801316f859915cba63a0771e89738a882bca0656fda5a74ddf.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\CMF\CONFIG"; Key: "SYSTEM"; Value: "") "7ef834fc890f8f801316f859915cba63a0771e89738a882bca0656fda5a74ddf.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\WINDOWS ERROR REPORTING\WMR"; Key: "DISABLE"; Value: "") "7ef834fc890f8f801316f859915cba63a0771e89738a882bca0656fda5a74ddf.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\SETUP"; Key: "SOURCEPATH"; Value: "") "7ef834fc890f8f801316f859915cba63a0771e89738a882bca0656fda5a74ddf.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION"; Key: "DEVICEPATH"; Value: "") "7ef834fc890f8f801316f859915cba63a0771e89738a882bca0656fda5a74ddf.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US"; Value: "") "7ef834fc890f8f801316f859915cba63a0771e89738a882bca0656fda5a74ddf.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US"; Value: "")4e:T45d,"7ef834fc890f8f801316f859915cba63a0771e89738a882bca0656fda5a74ddf.exe" reads file "c:\users\%osuser%\appdata\local\temp\ixp000.tmp\mp5ye33.exe" "7ef834fc890f8f801316f859915cba63a0771e89738a882bca0656fda5a74ddf.exe" reads file "c:\users\%osuser%\appdata\local\temp\ixp000.tmp\6pl671.exe" "MP5ye33.exe" reads file "c:\users\%osuser%\appdata\local\temp\ixp001.tmp\ar7ev61.exe" "MP5ye33.exe" reads file "c:\users\%osuser%\appdata\local\temp\ixp001.tmp\5ip71yr.exe" "aR7ev61.exe" reads file "c:\users\%osuser%\appdata\local\temp\ixp002.tmp\3kn814gi.exe" "aR7ev61.exe" reads file "c:\users\%osuser%\appdata\local\temp\ixp002.tmp\4nu6qk7.exe" "3Kn814gI.exe" reads file "c:\windows\system32\ieframe.dll" "3Kn814gI.exe" reads file "c:\program files\internet explorer\ieproxy.dll" "3Kn814gI.exe" reads file "c:\program files\internet explorer\iexplore.exe" "4NU6qK7.exe" reads file "c:\windows\microsoft.net\framework\v4.0.30319\applaunch.exe" "5ip71Yr.exe" reads file "c:\windows\microsoft.net\framework\v4.0.30319\applaunch.exe" "6pl671.exe" reads file "c:\windows\microsoft.net\framework\v4.0.30319\applaunch.exe"4f:Tc9a,"7ef834fc890f8f801316f859915cba63a0771e89738a882bca0656fda5a74ddf.exe" trying to touch file "C:\Windows\SYSTEM32\sechost.dll" "7ef834fc890f8f801316f859915cba63a0771e89738a882bca0656fda5a74ddf.exe" trying to touch file "C:\7ef834fc890f8f801316f859915cba63a0771e89738a882bca0656fda5a74ddf.exe.Local\" "7ef834fc890f8f801316f859915cba63a0771e89738a882bca0656fda5a74ddf.exe" trying to touch file "C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18837_none_41e855142bd5705d" "7ef834fc890f8f801316f859915cba63a0771e89738a882bca0656fda5a74ddf.exe" trying to touch file "C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18837_none_41e855142bd5705d\COMCTL32.dll" "7ef834fc890f8f801316f859915cba63a0771e89738a882bca0656fda5a74ddf.exe" trying to touch file "C:\Cabinet.dll" "7ef834fc890f8f801316f859915cba63a0771e89738a882bca0656fda5a74ddf.exe" trying to touch file "C:\Windows\system32\Cabinet.dll" "7ef834fc890f8f801316f859915cba63a0771e89738a882bca0656fda5a74ddf.exe" trying to touch file "C:\VERSION.dll" "7ef834fc890f8f801316f859915cba63a0771e89738a882bca0656fda5a74ddf.exe" trying to touch file "C:\Windows\system32\VERSION.dll" "7ef834fc890f8f801316f859915cba63a0771e89738a882bca0656fda5a74ddf.exe" trying to touch file "C:\Windows\system32\apphelp.dll" "7ef834fc890f8f801316f859915cba63a0771e89738a882bca0656fda5a74ddf.exe" trying to touch file "C:\Windows\AppPatch\AcLayers.DLL" "7ef834fc890f8f801316f859915cba63a0771e89738a882bca0656fda5a74ddf.exe" trying to touch file "C:\SspiCli.dll" "7ef834fc890f8f801316f859915cba63a0771e89738a882bca0656fda5a74ddf.exe" trying to touch file "C:\Windows\system32\SspiCli.dll" "7ef834fc890f8f801316f859915cba63a0771e89738a882bca0656fda5a74ddf.exe" trying to touch file "C:\WINSPOOL.DRV" "7ef834fc890f8f801316f859915cba63a0771e89738a882bca0656fda5a74ddf.exe" trying to touch file "C:\Windows\system32\WINSPOOL.DRV" "7ef834fc890f8f801316f859915cba63a0771e89738a882bca0656fda5a74ddf.exe" trying to touch file "C:\MPR.dll" "7ef834fc890f8f801316f859915cba63a0771e89738a882bca0656fda5a74ddf.exe" trying to touch file "C:\Windows\system32\MPR.dll" "7ef834fc890f8f801316f859915cba63a0771e89738a882bca0656fda5a74ddf.exe" trying to touch file "C:\Windows\AppPatch\AcGenral.DLL" "7ef834fc890f8f801316f859915cba63a0771e89738a882bca0656fda5a74ddf.exe" trying to touch file "C:\UxTheme.dll" "7ef834fc890f8f801316f859915cba63a0771e89738a882bca0656fda5a74ddf.exe" trying to touch file "C:\Windows\system32\UxTheme.dll" "7ef834fc890f8f801316f859915cba63a0771e89738a882bca0656fda5a74ddf.exe" trying to touch file "C:\WINMM.dll" "7ef834fc890f8f801316f859915cba63a0771e89738a882bca0656fda5a74ddf.exe" trying to touch file "C:\Windows\system32\WINMM.dll" "7ef834fc890f8f801316f859915cba63a0771e89738a882bca0656fda5a74ddf.exe" trying to touch file "C:\samcli.dll" "7ef834fc890f8f801316f859915cba63a0771e89738a882bca0656fda5a74ddf.exe" trying to touch file "C:\Windows\system32\samcli.dll" "7ef834fc890f8f801316f859915cba63a0771e89738a882bca0656fda5a74ddf.exe" trying to touch file "C:\MSACM32.dll" "7ef834fc890f8f801316f859915cba63a0771e89738a882bca0656fda5a74ddf.exe" trying to touch file "C:\Windows\system32\MSACM32.dll"50:Td24,"7ef834fc890f8f801316f859915cba63a0771e89738a882bca0656fda5a74ddf.exe" trying to access non-existent file "C:\Cabinet.dll" "7ef834fc890f8f801316f859915cba63a0771e89738a882bca0656fda5a74ddf.exe" trying to access non-existent file "C:\VERSION.dll" "7ef834fc890f8f801316f859915cba63a0771e89738a882bca0656fda5a74ddf.exe" trying to access non-existent file "C:\SspiCli.dll" "7ef834fc890f8f801316f859915cba63a0771e89738a882bca0656fda5a74ddf.exe" trying to access non-existent file "C:\MPR.dll" "7ef834fc890f8f801316f859915cba63a0771e89738a882bca0656fda5a74ddf.exe" trying to access non-existent file "C:\UxTheme.dll" "7ef834fc890f8f801316f859915cba63a0771e89738a882bca0656fda5a74ddf.exe" trying to access non-existent file "C:\WINMM.dll" "7ef834fc890f8f801316f859915cba63a0771e89738a882bca0656fda5a74ddf.exe" trying to access non-existent file "C:\samcli.dll" "7ef834fc890f8f801316f859915cba63a0771e89738a882bca0656fda5a74ddf.exe" trying to access non-existent file "C:\MSACM32.dll" "7ef834fc890f8f801316f859915cba63a0771e89738a882bca0656fda5a74ddf.exe" trying to access non-existent file "C:\sfc.dll" "7ef834fc890f8f801316f859915cba63a0771e89738a882bca0656fda5a74ddf.exe" trying to access non-existent file "C:\sfc_os.DLL" "7ef834fc890f8f801316f859915cba63a0771e89738a882bca0656fda5a74ddf.exe" trying to access non-existent file "C:\dwmapi.dll" "7ef834fc890f8f801316f859915cba63a0771e89738a882bca0656fda5a74ddf.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP\MP5ye33.exe" "7ef834fc890f8f801316f859915cba63a0771e89738a882bca0656fda5a74ddf.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP\6pl671.exe" "7ef834fc890f8f801316f859915cba63a0771e89738a882bca0656fda5a74ddf.exe" trying to access non-existent file "C:\FLTLIB.DLL" "7ef834fc890f8f801316f859915cba63a0771e89738a882bca0656fda5a74ddf.exe" trying to access non-existent file "C:\MSVCP140.dll" "7ef834fc890f8f801316f859915cba63a0771e89738a882bca0656fda5a74ddf.exe" trying to access non-existent file "C:\VCRUNTIME140.dll" "7ef834fc890f8f801316f859915cba63a0771e89738a882bca0656fda5a74ddf.exe" trying to access non-existent file "C:\api-ms-win-crt-runtime-l1-1-0.dll" "7ef834fc890f8f801316f859915cba63a0771e89738a882bca0656fda5a74ddf.exe" trying to access non-existent file "C:\ucrtbase.DLL" "7ef834fc890f8f801316f859915cba63a0771e89738a882bca0656fda5a74ddf.exe" trying to access non-existent file "C:\api-ms-win-core-timezone-l1-1-0.dll" "7ef834fc890f8f801316f859915cba63a0771e89738a882bca0656fda5a74ddf.exe" trying to access non-existent file "C:\api-ms-win-core-file-l2-1-0.dll" "7ef834fc890f8f801316f859915cba63a0771e89738a882bca0656fda5a74ddf.exe" trying to access non-existent file "C:\api-ms-win-core-localization-l1-2-0.dll" "7ef834fc890f8f801316f859915cba63a0771e89738a882bca0656fda5a74ddf.exe" trying to access non-existent file "C:\api-ms-win-core-synch-l1-2-0.dll" "7ef834fc890f8f801316f859915cba63a0771e89738a882bca0656fda5a74ddf.exe" trying to access non-existent file "C:\api-ms-win-core-processthreads-l1-1-1.dll" "7ef834fc890f8f801316f859915cba63a0771e89738a882bca0656fda5a74ddf.exe" trying to access non-existent file "C:\api-ms-win-core-file-l1-2-0.dll" "7ef834fc890f8f801316f859915cba63a0771e89738a882bca0656fda5a74ddf.exe" trying to access non-existent file "C:\api-ms-win-crt-heap-l1-1-0.dll"51:T87a,"7ef834fc890f8f801316f859915cba63a0771e89738a882bca0656fda5a74ddf.exe" trying to access non-existent file "C:\7ef834fc890f8f801316f859915cba63a0771e89738a882bca0656fda5a74ddf.exe.Local\" "7ef834fc890f8f801316f859915cba63a0771e89738a882bca0656fda5a74ddf.exe" trying to access non-existent file "C:\WINSPOOL.DRV" "7ef834fc890f8f801316f859915cba63a0771e89738a882bca0656fda5a74ddf.exe" trying to access non-existent file "C:\7ef834fc890f8f801316f859915cba63a0771e89738a882bca0656fda5a74ddf.exe.Config" "7ef834fc890f8f801316f859915cba63a0771e89738a882bca0656fda5a74ddf.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP" "7ef834fc890f8f801316f859915cba63a0771e89738a882bca0656fda5a74ddf.exe" trying to access non-existent file "C:\7EF834FC890F8F801316F859915CBA63A0771E89738A882BCA0656FDA5A74DDF.EXE.LOCAL" "7ef834fc890f8f801316f859915cba63a0771e89738a882bca0656fda5a74ddf.exe" trying to access non-existent file "C:\7EF834FC890F8F801316F859915CBA63A0771E89738A882BCA0656FDA5A74DDF.EXE.CONFIG" "MP5ye33.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP\MP5ye33.exe.Local\" "MP5ye33.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP\WINSPOOL.DRV" "MP5ye33.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP\MP5ye33.exe.Config" "MP5ye33.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP001.TMP" "MP5ye33.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP\MP5YE33.EXE.LOCAL" "MP5ye33.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP\MP5YE33.EXE.CONFIG" "aR7ev61.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP001.TMP\aR7ev61.exe.Local\" "aR7ev61.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP001.TMP\WINSPOOL.DRV" "aR7ev61.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP001.TMP\aR7ev61.exe.Config" "aR7ev61.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP002.TMP"52:T46a,"AppLaunch.exe" called "WinHttpSendRequest" with parameters {"hRequest": "10a4b8" "lpszHeaders": "Content-Type: application/x-www-form-urlencoded" "dwHeadersLength": "4294967295" "lpOptional": "act=life" "dwOptionalLength": "8" "dwTotalLength": "8" "dwContext": "0" "$error": "2ee7"} "AppLaunch.exe" called "WinHttpSendRequest" with parameters {"hRequest": "1066f8" "lpszHeaders": "Content-Type: application/x-www-form-urlencoded" "dwHeadersLength": "4294967295" "lpOptional": "act=life" "dwOptionalLength": "8" "dwTotalLength": "8" "dwContext": "0"} "AppLaunch.exe" called "WinHttpSendRequest" with parameters {"hRequest": "10ffe8" "lpszHeaders": "Content-Type: application/x-www-form-urlencoded" "dwHeadersLength": "4294967295" "lpOptional": "act=life" "dwOptionalLength": "8" "dwTotalLength": "8" "dwContext": "0"} "AppLaunch.exe" called "WinHttpSendRequest" with parameters {"hRequest": "10ffe8" "lpszHeaders": "Content-Type: application/x-www-form-urlencoded" "dwHeadersLength": "4294967295" "lpOptional": "act=life" "dwOptionalLength": "8" "dwTotalLength": "8" "dwContext": "0" "$error": "2ee7"}53:T570,Found http requests in header "GET /gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D" Found http requests in header "GET /r/r1.crl" Found http requests in header "GET /wr2/oBFYYahzgVI.crl" Found http requests in header "GET /wr2/75r4ZyA3vA0.crl" Found http requests in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEA59dSNcqDdhV39MzSTNbR0%3D" Found http requests in header "GET /wr2/9UVbN0w5E6Y.crl" Found http requests in header "GET /r/gsr1.crl" Found http requests in header "GET /r/r4.crl" Found http requests in header "GET /we1/pl4XiTjSDSk.crl" Found http requests in header "GET /we1/G0k-BqpOX8k.crl" Found http requests in header "GET /we1/x6Eg-8TSwUw.crl" Found http requests in header "GET /rootg2.cer" Found http requests in header "GET /MFQwUjBQME4wTDAJBgUrDgMCGgUABBSIfaREXmfqfJR3TkMYnD7O5MhzEgQUnF8A36oB1zArOIiiuG1KnPIRkYMCEwZ%2FlEoqJ83z%2BsKuKwH5CO65xMY%3D" Found http requests in header "GET /MFQwUjBQME4wTDAJBgUrDgMCGgUABBRPWaOUU8%2B5VZ5%2Fa9jFTaU9pkK3FAQUhBjMhTTsvAyUlC4IWZzHshBOCggCEwdzEk8qlS4%2B0YpYvbhdG8DOXyc%3D" Found http requests in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTihuFvpmFDw5hOcIp918Jm5B3CQgQUH1KSYVaCVH%2BBZtgdPQqqMlyH3QgCEA3N2p7AWhpIo7uTRZjDirs%3D" Found http requests in header "GET /wr2/oQ6nyr8F0m0.crl"54:T36cb,Found requests in header "GET /ServiceLogin?passive=1209600&continue=https%3A%2F%2Faccounts.google.com%2F&followup=https%3A%2F%2Faccounts.google.com%2F HTTP/1.1Accept: text/html, application/xhtml+xml, */*Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: accounts.google.comCookie: __Host-GAPS=1:LrNK6ainX74ZNkmw8zApcnQBr9ln3A:d09IpyH120nVVVIwConnection: Keep-AliveDNT: 1"; in File: "SSL") Found requests in header "GET /v3/signin/identifier?continue=https://accounts.google.com/&followup=https://accounts.google.com/&passive=1209600&flowName=WebLiteSignIn&flowEntry=ServiceLogin&dsh=S889951949:1788354996006935 HTTP/1.1Accept: text/html, application/xhtml+xml, */*Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: accounts.google.comConnection: Keep-AliveDNT: 1Cookie: __Host-GAPS=1:LrNK6ainX74ZNkmw8zApcnQBr9ln3A:d09IpyH120nVVVIw"; in File: "SSL") Found requests in header "GET / HTTP/1.1Accept: text/html, application/xhtml+xml, */*Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: accounts.google.comDNT: 1Connection: Keep-Alive"; in File: "SSL") Found requests in header "GET /_/bscframe HTTP/1.1Accept: text/html, application/xhtml+xml, */*Referer: https://accounts.google.com/Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: accounts.google.comDNT: 1Connection: Keep-AliveCookie: __Host-GAPS=1:LrNK6ainX74ZNkmw8zApcnQBr9ln3A:d09IpyH120nVVVIw"; in File: "SSL") Found requests in header "GET /favicon.ico HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoHost: accounts.google.comDNT: 1Connection: Keep-AliveCookie: __Host-GAPS=1:LrNK6ainX74ZNkmw8zApcnQBr9ln3A:d09IpyH120nVVVIw"; in File: "SSL") Found requests in header "GET / HTTP/1.1Accept: text/html, application/xhtml+xml, */*Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: accounts.google.comDNT: 1Connection: Keep-AliveCookie: __Host-GAPS=1:LrNK6ainX74ZNkmw8zApcnQBr9ln3A:d09IpyH120nVVVIw"; in File: "SSL") Found requests in header "GET /ServiceLogin?passive=1209600&continue=https%3A%2F%2Faccounts.google.com%2F&followup=https%3A%2F%2Faccounts.google.com%2F HTTP/1.1Accept: text/html, application/xhtml+xml, */*Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: accounts.google.comDNT: 1Connection: Keep-AliveCookie: __Host-GAPS=1:LrNK6ainX74ZNkmw8zApcnQBr9ln3A:d09IpyH120nVVVIw"; in File: "SSL") Found requests in header "GET /v3/signin/identifier?continue=https://accounts.google.com/&followup=https://accounts.google.com/&passive=1209600&flowName=WebLiteSignIn&flowEntry=ServiceLogin&dsh=S992897813:1788355001360540 HTTP/1.1Accept: text/html, application/xhtml+xml, */*Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: accounts.google.comCookie: __Host-GAPS=1:LrNK6ainX74ZNkmw8zApcnQBr9ln3A:d09IpyH120nVVVIwConnection: Keep-AliveDNT: 1"; in File: "SSL") Found requests in header "GET /v3/signin/identifier?continue=https://accounts.google.com/&followup=https://accounts.google.com/&passive=1209600&flowName=WebLiteSignIn&flowEntry=ServiceLogin&dsh=S889951949:1788355027335567 HTTP/1.1Accept: text/html, application/xhtml+xml, */*Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: accounts.google.comCookie: __Host-GAPS=1:LrNK6ainX74ZNkmw8zApcnQBr9ln3A:d09IpyH120nVVVIwConnection: Keep-AliveDNT: 1"; in File: "SSL") Found requests in header "POST /v3/signin/identifier?continue=https://accounts.google.com/&dsh=S889951949:1788355027335567&flowEntry=ServiceLogin&flowName=WebLiteSignIn&followup=https://accounts.google.com/ HTTP/1.1Accept: text/html, application/xhtml+xml, */*Referer: https://accounts.google.com/Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoContent-Type: application/x-www-form-urlencodedAccept-Encoding: gzip, deflateHost: accounts.google.comContent-Length: 258DNT: 1Connection: Keep-AliveCache-Control: no-cacheCookie: __Host-GAPS=1:LrNK6ainX74ZNkmw8zApcnQBr9ln3A:d09IpyH120nVVVIwidentifier=&hiddenPassword=&usi=S889951949%3A1788355027335567&domain=®ion=US&=&bgresponse=FNLReferenceError%3A+%27Symbol%27+is+undefined&pstMsg=1&checkConnection=youtube%3A162&checkedDomains=youtube&action=1&at=ALTjPXOtFkHY-OT52EXyrhqgBIh_%3A1788355027451"; in File: "SSL") Found requests in header "POST /v3/signin/identifier?checkConnection=youtube:162&checkedDomains=youtube&continue=https://accounts.google.com/&dsh=S889951949:1788355027335567&flowEntry=ServiceLogin&flowName=WebLiteSignIn&followup=https://accounts.google.com/&pstMsg=1 HTTP/1.1Accept: text/html, application/xhtml+xml, */*Referer: https://accounts.google.com/Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoContent-Type: application/x-www-form-urlencodedAccept-Encoding: gzip, deflateHost: accounts.google.comContent-Length: 257DNT: 1Connection: Keep-AliveCache-Control: no-cacheCookie: __Host-GAPS=1:LrNK6ainX74ZNkmw8zApcnQBr9ln3A:d09IpyH120nVVVIwidentifier=&hiddenPassword=&usi=S889951949%3A1788355027335567&domain=®ion=US&=&bgresponse=FNLReferenceError%3A+%27Symbol%27+is+undefined&pstMsg=1&checkConnection=youtube%3A65&checkedDomains=youtube&action=1&at=ALTjPXPXJKQ05mGG6woMUQI4v3d7%3A1788355040064"; in File: "SSL") Found requests in header "POST /v3/signin/identifier?checkConnection=youtube:65&checkedDomains=youtube&continue=https://accounts.google.com/&dsh=S889951949:1788355027335567&flowEntry=ServiceLogin&flowName=WebLiteSignIn&followup=https://accounts.google.com/&pstMsg=1 HTTP/1.1Accept: text/html, application/xhtml+xml, */*Referer: https://accounts.google.com/Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoContent-Type: application/x-www-form-urlencodedAccept-Encoding: gzip, deflateHost: accounts.google.comContent-Length: 257DNT: 1Connection: Keep-AliveCache-Control: no-cacheCookie: __Host-GAPS=1:LrNK6ainX74ZNkmw8zApcnQBr9ln3A:d09IpyH120nVVVIwidentifier=&hiddenPassword=&usi=S889951949%3A1788355027335567&domain=®ion=US&=&bgresponse=FNLReferenceError%3A+%27Symbol%27+is+undefined&pstMsg=1&checkConnection=youtube%3A40&checkedDomains=youtube&action=1&at=ALTjPXMJMdbH_iN_XTuPtY7JJ1GM%3A1788355069745"; in File: "SSL") Found requests in header "GET /images/branding/googlelogo/2x/googlelogo_color_74x24dp.png HTTP/1.1Accept: image/png, image/svg+xml, image/*;q=0.8, */*;q=0.5Referer: https://accounts.google.com/Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: ssl.gstatic.comDNT: 1Connection: Keep-Alive"; in File: "SSL") Found requests in header "GET /login HTTP/1.1Accept: text/html, application/xhtml+xml, */*Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: www.facebook.comDNT: 1Connection: Keep-Alive"; in File: "SSL") Found requests in header "GET /accounts/CheckConnection?pmpo=https://accounts.google.com&v=1647555478×tamp=1788354995634 HTTP/1.1Accept: text/html, application/xhtml+xml, */*Referer: https://accounts.google.com/Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: accounts.youtube.comDNT: 1Connection: Keep-AliveCookie: CONSENT=WP.2676ba"; in File: "SSL") Found requests in header "GET /accounts/CheckConnection?pmpo=https://accounts.google.com&v=-928579200×tamp=1788355000054 HTTP/1.1Accept: text/html, application/xhtml+xml, */*Referer: https://accounts.google.com/Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: accounts.youtube.comDNT: 1Connection: Keep-AliveCookie: CONSENT=WP.2676ba"; in File: "SSL") Found requests in header "GET /accounts/CheckConnection?pmpo=https://accounts.google.com&v=-1328875359×tamp=1788355145969 HTTP/1.1Accept: text/html, application/xhtml+xml, */*Referer: https://accounts.google.com/Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: accounts.youtube.comDNT: 1Connection: Keep-AliveCookie: CONSENT=WP.2676ba; __Secure-YNID=21.YT=WHJt3RxaiW-t-zcg82OyQFLIXHQi-uBWVFztcGOYrrHNEqnPy5xYmz_-9Yfh1ktRowpvZmPAtCfCub4Rhn9ITdROk9hqMye1Ll8fJiM6y6TBQw35EYnwDvAkDWuRs8tnuP4Ba-iQ3uaRn4pdQrKHFPidpBOQ3eeuq4vF64w7RXN37mQK6cpJ6aDRPwvfyZILbQm0pqDUNrE3tfutshCqBqSwYMTgv558no7Aplcsaxkj6qpsx6xaqfXY8Xv1F_OBZpNL2NDcgqDc8EssIG94YNA8qZy6Kqr2kizWHs1_ywUixWuqdFmX-hVC7qWY8szvSb3n1xrBExc4KARrHxdflw; hideBrowserUpgradeBox=true; __Secure-ROLLOUT_TOKEN=CMDPo9zAoZzj5AEQm9XUzv3PlgMYm9XUzv3PlgM%3D; VISITOR_INFO1_LIVE=jrFSnCo66Ns; VISITOR_PRIVACY_METADATA=CgJVUxIEGgAgDg%3D%3D; YSC=u2YFyL1fUWI"; in File: "SSL") Found requests in header "GET /accounts/CheckConnection?pmpo=https://accounts.google.com&v=1333103568×tamp=1788355218581 HTTP/1.1Accept: text/html, application/xhtml+xml, */*Referer: https://accounts.google.com/Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: accounts.youtube.comDNT: 1Connection: Keep-AliveCookie: CONSENT=WP.2676ba; __Secure-YNID=21.YT=WHJt3RxaiW-t-zcg82OyQFLIXHQi-uBWVFztcGOYrrHNEqnPy5xYmz_-9Yfh1ktRowpvZmPAtCfCub4Rhn9ITdROk9hqMye1Ll8fJiM6y6TBQw35EYnwDvAkDWuRs8tnuP4Ba-iQ3uaRn4pdQrKHFPidpBOQ3eeuq4vF64w7RXN37mQK6cpJ6aDRPwvfyZILbQm0pqDUNrE3tfutshCqBqSwYMTgv558no7Aplcsaxkj6qpsx6xaqfXY8Xv1F_OBZpNL2NDcgqDc8EssIG94YNA8qZy6Kqr2kizWHs1_ywUixWuqdFmX-hVC7qWY8szvSb3n1xrBExc4KARrHxdflw; hideBrowserUpgradeBox=true; __Secure-ROLLOUT_TOKEN=CMDPo9zAoZzj5AEQm9XUzv3PlgMYm9XUzv3PlgM%3D; VISITOR_INFO1_LIVE=jrFSnCo66Ns; VISITOR_PRIVACY_METADATA=CgJVUxIEGgAgDg%3D%3D; YSC=u2YFyL1fUWI"; in File: "SSL") Found requests in header "GET /accounts/CheckConnection?pmpo=https://accounts.google.com&v=1119924773×tamp=1788355312157 HTTP/1.1Accept: text/html, application/xhtml+xml, */*Referer: https://accounts.google.com/Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: accounts.youtube.comDNT: 1Connection: Keep-AliveCookie: CONSENT=WP.2676ba; __Secure-YNID=21.YT=WHJt3RxaiW-t-zcg82OyQFLIXHQi-uBWVFztcGOYrrHNEqnPy5xYmz_-9Yfh1ktRowpvZmPAtCfCub4Rhn9ITdROk9hqMye1Ll8fJiM6y6TBQw35EYnwDvAkDWuRs8tnuP4Ba-iQ3uaRn4pdQrKHFPidpBOQ3eeuq4vF64w7RXN37mQK6cpJ6aDRPwvfyZILbQm0pqDUNrE3tfutshCqBqSwYMTgv558no7Aplcsaxkj6qpsx6xaqfXY8Xv1F_OBZpNL2NDcgqDc8EssIG94YNA8qZy6Kqr2kizWHs1_ywUixWuqdFmX-hVC7qWY8szvSb3n1xrBExc4KARrHxdflw; hideBrowserUpgradeBox=true; __Secure-ROLLOUT_TOKEN=CMDPo9zAoZzj5AEQm9XUzv3PlgMYm9XUzv3PlgM%3D; VISITOR_INFO1_LIVE=jrFSnCo66Ns; VISITOR_PRIVACY_METADATA=CgJVUxIEGgAgDg%3D%3D; YSC=u2YFyL1fUWI"; in File: "SSL") Found requests in header "GET /accounts/CheckConnection?pmpo=https://accounts.google.com&v=-2067050615×tamp=1788355720744 HTTP/1.1Accept: text/html, application/xhtml+xml, */*Referer: https://accounts.google.com/Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: accounts.youtube.comDNT: 1Connection: Keep-AliveCookie: CONSENT=WP.2676ba; __Secure-YNID=21.YT=WHJt3RxaiW-t-zcg82OyQFLIXHQi-uBWVFztcGOYrrHNEqnPy5xYmz_-9Yfh1ktRowpvZmPAtCfCub4Rhn9ITdROk9hqMye1Ll8fJiM6y6TBQw35EYnwDvAkDWuRs8tnuP4Ba-iQ3uaRn4pdQrKHFPidpBOQ3eeuq4vF64w7RXN37mQK6cpJ6aDRPwvfyZILbQm0pqDUNrE3tfutshCqBqSwYMTgv558no7Aplcsaxkj6qpsx6xaqfXY8Xv1F_OBZpNL2NDcgqDc8EssIG94YNA8qZy6Kqr2kizWHs1_ywUixWuqdFmX-hVC7qWY8szvSb3n1xrBExc4KARrHxdflw; hideBrowserUpgradeBox=true; __Secure-ROLLOUT_TOKEN=CMDPo9zAoZzj5AEQm9XUzv3PlgMYm9XUzv3PlgM%3D; VISITOR_INFO1_LIVE=jrFSnCo66Ns; VISITOR_PRIVACY_METADATA=CgJVUxIEGgAgDg%3D%3D; YSC=u2YFyL1fUWI"; in File: "SSL") Found requests in header "GET /favicon.ico HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoDNT: 1Connection: Keep-AliveHost: www.google.com"; in File: "SSL") Found requests in header "GET /rsrc.php/v5/y0/l/0,cross/s82PjsnlZP2IQAEG095i0Yxgo-3469oiGT9DWDYPz6DhfgQe914iiBfD-GevAmvU9KONMKn3YhINqU49pVNahkCkeiF2w9Hlit1WpaE_brMCJG.css HTTP/1.1Accept: text/css, */*Referer: https://www.facebook.com/loginAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: static.xx.fbcdn.netDNT: 1Connection: Keep-Alive"; in File: "SSL") Found requests in header "GET /rsrc.php/yP/r/kUc6oHI0fJd.woff HTTP/1.1Accept: */*Referer: https://www.facebook.com/loginAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoOrigin: https://www.facebook.comAccept-Encoding: gzip, deflateHost: static.xx.fbcdn.netDNT: 1Connection: Keep-Alive"; in File: "SSL") Found requests in header "GET /rsrc.php/yH/r/uR_TIYVE0g0.eot HTTP/1.1Accept: */*Referer: https://www.facebook.com/loginAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoOrigin: https://www.facebook.comAccept-Encoding: gzip, deflateHost: static.xx.fbcdn.netDNT: 1Connection: Keep-Alive"; in File: "SSL") Found requests in header "GET /rsrc.php/y5/r/Vk4cmgW6O-5.webp HTTP/1.1Accept: image/png, image/svg+xml, image/*;q=0.8, */*;q=0.5Referer: https://www.facebook.com/loginAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: static.xx.fbcdn.netDNT: 1Connection: Keep-Alive"; in File: "SSL")55:Te25,Found reference to API "HttpSendRequestW" (Indicator: "HttpSendRequest"; File: "7ef834fc890f8f801316f859915cba63a0771e89738a882bca0656fda5a74ddf") Found reference to API "InternetReadFile" (Indicator: "InternetReadFile"; File: "7ef834fc890f8f801316f859915cba63a0771e89738a882bca0656fda5a74ddf") Found reference to API "HttpOpenRequestW" (Indicator: "HttpOpenRequest"; File: "7ef834fc890f8f801316f859915cba63a0771e89738a882bca0656fda5a74ddf") Found reference to API "InternetOpenUrlW" (Indicator: "InternetOpen"; File: "7ef834fc890f8f801316f859915cba63a0771e89738a882bca0656fda5a74ddf") Found reference to API "InternetOpenW" (Indicator: "InternetOpen"; File: "7ef834fc890f8f801316f859915cba63a0771e89738a882bca0656fda5a74ddf") Found reference to API "InternetConnectW" (Indicator: "InternetConnect"; File: "7ef834fc890f8f801316f859915cba63a0771e89738a882bca0656fda5a74ddf") Found reference to API "HttpQueryInfoW" (Indicator: "HttpQueryInfo"; File: "7ef834fc890f8f801316f859915cba63a0771e89738a882bca0656fda5a74ddf") Found reference to API "WSAStartup" (Indicator: "WSAStartup"; File: "7ef834fc890f8f801316f859915cba63a0771e89738a882bca0656fda5a74ddf") Found reference to API "WinHttpConnect" (Indicator: "WinHttpConnect"; File: "00003020.00000BCC.2569590.00473000.wprm") Found reference to API "WinHttpOpen" (Indicator: "WinHttpOpen"; File: "00003020.00000BCC.2569590.00473000.wprm") Found reference to API "WinHttpOpenRequest" (Indicator: "HttpOpenRequest"; File: "00003020.00000BCC.2569590.00473000.wprm") Found reference to API "WinHttpOpenRequest" (Indicator: "WinHttpOpen"; File: "00003020.00000BCC.2569590.00473000.wprm") Found reference to API "WinHttpOpenRequest" (Indicator: "WinHttpOpenRequest"; File: "00003020.00000BCC.2569590.00473000.wprm") Found reference to API "WinHttpReadData" (Indicator: "WinHttpReadData"; File: "00003020.00000BCC.2569590.00473000.wprm") Found reference to API "WinHttpSendRequest" (Indicator: "HttpSendRequest"; File: "00003020.00000BCC.2569590.00473000.wprm") Found reference to API "WinHttpSendRequest" (Indicator: "WinHttpSendRequest"; File: "00003020.00000BCC.2569590.00473000.wprm") Found reference to API "WSARecv" (Indicator: "WSARecv"; Source: "00000000-00003020-00000C2C-238058472") Found reference to API "WSASend" (Indicator: "WSASend"; Source: "00000000-00003020-00000C2C-238059012") Found reference to API "WinHttpConnect" (Indicator: "WinHttpConnect"; Source: "00000000-00004076.00000000.78873.009C8000.00000004.mdmp") Found reference to API "WinHttpOpen" (Indicator: "WinHttpOpen"; Source: "00000000-00004076.00000000.78873.009C8000.00000004.mdmp") Found reference to API "WinHttpOpenRequest" (Indicator: "HttpOpenRequest"; Source: "00000000-00004076.00000000.78873.009C8000.00000004.mdmp") Found reference to API "WinHttpOpenRequest" (Indicator: "WinHttpOpen"; Source: "00000000-00004076.00000000.78873.009C8000.00000004.mdmp") Found reference to API "WinHttpOpenRequest" (Indicator: "WinHttpOpenRequest"; Source: "00000000-00004076.00000000.78873.009C8000.00000004.mdmp") Found reference to API "WinHttpReadData" (Indicator: "WinHttpReadData"; Source: "00000000-00004076.00000000.78873.009C8000.00000004.mdmp") Found reference to API "WinHttpSendRequest" (Indicator: "HttpSendRequest"; Source: "00000000-00004076.00000000.78873.009C8000.00000004.mdmp") Found reference to API "WinHttpSendRequest" (Indicator: "WinHttpSendRequest"; Source: "00000000-00004076.00000000.78873.009C8000.00000004.mdmp") Found reference to API "InternetReadFile" (Indicator: "InternetReadFile"; Source: "00000000-00004076.00000000.78873.009C8000.00000004.mdmp")56:Ta8c,Found reference to API "WinHttpCloseHandle" (Indicator: "WinHttpCloseHandle"; File: "00003020.00000BCC.2569590.00473000.wprm") Found reference to API "WinHttpConnect" (Indicator: "WinHttpConnect"; File: "00003020.00000BCC.2569590.00473000.wprm") Found reference to API "WinHttpCrackUrl" (Indicator: "WinHttpCrackUrl"; File: "00003020.00000BCC.2569590.00473000.wprm") Found reference to API "WinHttpOpen" (Indicator: "WinHttpOpen"; File: "00003020.00000BCC.2569590.00473000.wprm") Found reference to API "WinHttpOpenRequest" (Indicator: "WinHttpOpen"; File: "00003020.00000BCC.2569590.00473000.wprm") Found reference to API "WinHttpOpenRequest" (Indicator: "WinHttpOpenRequest"; File: "00003020.00000BCC.2569590.00473000.wprm") Found reference to API "WinHttpQueryDataAvailable" (Indicator: "WinHttpQueryDataAvailable"; File: "00003020.00000BCC.2569590.00473000.wprm") Found reference to API "WinHttpReadData" (Indicator: "WinHttpReadData"; File: "00003020.00000BCC.2569590.00473000.wprm") Found reference to API "WinHttpReceiveResponse" (Indicator: "WinHttpReceiveResponse"; File: "00003020.00000BCC.2569590.00473000.wprm") Found reference to API "WinHttpSendRequest" (Indicator: "WinHttpSendRequest"; File: "00003020.00000BCC.2569590.00473000.wprm") Found reference to API "WinHttpCloseHandle" (Indicator: "WinHttpCloseHandle"; Source: "00000000-00004076.00000000.78873.009C8000.00000004.mdmp") Found reference to API "WinHttpConnect" (Indicator: "WinHttpConnect"; Source: "00000000-00004076.00000000.78873.009C8000.00000004.mdmp") Found reference to API "WinHttpCrackUrl" (Indicator: "WinHttpCrackUrl"; Source: "00000000-00004076.00000000.78873.009C8000.00000004.mdmp") Found reference to API "WinHttpOpen" (Indicator: "WinHttpOpen"; Source: "00000000-00004076.00000000.78873.009C8000.00000004.mdmp") Found reference to API "WinHttpOpenRequest" (Indicator: "WinHttpOpen"; Source: "00000000-00004076.00000000.78873.009C8000.00000004.mdmp") Found reference to API "WinHttpOpenRequest" (Indicator: "WinHttpOpenRequest"; Source: "00000000-00004076.00000000.78873.009C8000.00000004.mdmp") Found reference to API "WinHttpQueryDataAvailable" (Indicator: "WinHttpQueryDataAvailable"; Source: "00000000-00004076.00000000.78873.009C8000.00000004.mdmp") Found reference to API "WinHttpReadData" (Indicator: "WinHttpReadData"; Source: "00000000-00004076.00000000.78873.009C8000.00000004.mdmp") Found reference to API "WinHttpReceiveResponse" (Indicator: "WinHttpReceiveResponse"; Source: "00000000-00004076.00000000.78873.009C8000.00000004.mdmp") Found reference to API "WinHttpSendRequest" (Indicator: "WinHttpSendRequest"; Source: "00000000-00004076.00000000.78873.009C8000.00000004.mdmp")57:T877,file/memory contains long string with (Indicator: " connect "; File: "dnserror_1_") Found reference to API "gethostbyname" (Indicator: "gethostbyname"; File: "7ef834fc890f8f801316f859915cba63a0771e89738a882bca0656fda5a74ddf") Found reference to API "WSACleanup" (Indicator: "wsacleanup"; File: "7ef834fc890f8f801316f859915cba63a0771e89738a882bca0656fda5a74ddf") Found reference to API "WSAGetLastError" (Indicator: "wsagetlasterror"; File: "7ef834fc890f8f801316f859915cba63a0771e89738a882bca0656fda5a74ddf") Found reference to API "WSAStartup" (Indicator: "wsastartup"; File: "7ef834fc890f8f801316f859915cba63a0771e89738a882bca0656fda5a74ddf") Found reference to API "inet_addr" (Indicator: "inet_addr"; File: "7ef834fc890f8f801316f859915cba63a0771e89738a882bca0656fda5a74ddf") Found reference to API "gethostname" (Indicator: "gethostname"; File: "7ef834fc890f8f801316f859915cba63a0771e89738a882bca0656fda5a74ddf") Found reference to API "__WSAFDIsSet" (Indicator: "__wsafdisset"; File: "7ef834fc890f8f801316f859915cba63a0771e89738a882bca0656fda5a74ddf") Found reference to API "inet_ntoa" (Indicator: "inet_ntoa"; File: "7ef834fc890f8f801316f859915cba63a0771e89738a882bca0656fda5a74ddf") Found reference to API "AUTHUI.DLL: Shutdown Choices Message Window" (Indicator: " shutdown "; Source: "00000000-00005684.00000000.75406.00CA0000.00000002.mdmp, 00000000-00005684.00000001.77329.00CA0000.00000002.mdmp") Found reference to API "Do you accept all of the terms of the preceding License Agreement? If you choose No, Install will close. To install you must accept this agreement." (Indicator: " accept "; Source: "00000000-00005684.00000001.77329.0013A000.00000002.mdmp") Found reference to API "AUTHUI.DLL: Shutdown Choices Message Window" (Indicator: " shutdown "; Source: "00000000-00005708.00000000.75339.00F70000.00000002.mdmp, 00000000-00005708.00000001.77262.00F70000.00000002.mdmp") Found reference to API "Do you accept all of the terms of the preceding License Agreement? If you choose No, Install will close. To install you must accept this agreement." (Indicator: " accept "; Source: "00000000-00005708.00000001.77262.00E8A000.00000002.mdmp")58:T9759,"GET /ServiceLogin?passive=1209600&continue=https%3A%2F%2Faccounts.google.com%2F&followup=https%3A%2F%2Faccounts.google.com%2F HTTP/1.1Accept: text/html, application/xhtml+xml, */*Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: accounts.google.comCookie: __Host-GAPS=1:LrNK6ainX74ZNkmw8zApcnQBr9ln3A:d09IpyH120nVVVIwConnection: Keep-AliveDNT: 1" "GET /v3/signin/identifier?continue=https://accounts.google.com/&followup=https://accounts.google.com/&passive=1209600&flowName=WebLiteSignIn&flowEntry=ServiceLogin&dsh=S889951949:1788354996006935 HTTP/1.1Accept: text/html, application/xhtml+xml, */*Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: accounts.google.comConnection: Keep-AliveDNT: 1Cookie: __Host-GAPS=1:LrNK6ainX74ZNkmw8zApcnQBr9ln3A:d09IpyH120nVVVIw" "GET / HTTP/1.1Accept: text/html, application/xhtml+xml, */*Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: accounts.google.comDNT: 1Connection: Keep-Alive" "HTTP/1.1 302 Moved TemporarilyContent-Type: text/html; charset=UTF-8Strict-Transport-Security: max-age=31536000; includeSubDomainsSet-Cookie: __Host-GAPS=1:LrNK6ainX74ZNkmw8zApcnQBr9ln3A:d09IpyH120nVVVIw;Path=/;Expires=Fri, 01-Sep-2028 13:16:35 GMT;Secure;HttpOnly;Priority=HIGHX-Frame-Options: DENYContent-Security-Policy: script-src 'nonce-gMdFsT0PJs8rLR3U-SkApg' 'unsafe-inline' 'unsafe-eval';object-src 'none';base-uri 'self';report-uri /cspreportLocation: https://accounts.google.com/ServiceLogin?passive=1209600&continue=https%3A%2F%2Faccounts.google.com%2F&followup=https%3A%2F%2Faccounts.google.com%2FContent-Encoding: gzipDate: Wed, 02 Sep 2026 13:16:35 GMTExpires: Wed, 02 Sep 2026 13:16:35 GMTCache-Control: private, max-age=0X-Content-Type-Options: nosniffX-XSS-Protection: 1; mode=blockServer: GSEAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Transfer-Encoding: chunked" "0000000100000001�0000000100000001000000010000000100000001000000010000000100000001�000f7�P�j�@��[Kz�5)ڮS�X0��㲙��6��f�y�X!�eⱂ��m�C�<��'"�QK�v?��S�1r�-�.��Ig9w�p�Q� �X�o٭' 'Ts�!��H�x %Ł��3N/�J�p�ֈu�A/��vx�4��M��E�_�f�ݗ�c��n��[�8c��<�K�'h`4MB��%&��K�Y��m", "HTTP/1.1 302 FoundContent-Type: application/binaryCache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Wed, 02 Sep 2026 13:16:36 GMTLocation: https://accounts.google.com/v3/signin/identifier?continue=https://accounts.google.com/&followup=https://accounts.google.com/&passive=1209600&flowName=WebLiteSignIn&flowEntry=ServiceLogin&dsh=S889951949:1788354996006935Strict-Transport-Security: max-age=31536000; includeSubDomainsCross-Origin-Resource-Policy: cross-originContent-Security-Policy: script-src 'nonce-rlu10H27pWebITKN0hLhXw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/AccountsSigninPassiveLoginHttp/cspreport;worker-src 'self'Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/AccountsSigninPassiveLoginHttp/cspreportPermissions-Policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factors=*, ch-ua-platform=*, ch-ua-platform-version=*Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionCross-Origin-Opener-Policy: unsafe-noneServer: ESFContent-Length: 0X-XSS-Protection: 0X-Content-Type-Options: nosniffAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000", "HTTP/1.1 200 OKContent-Type: text/html; charset=utf-8X-Frame-Options: DENYVary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Sitex-auto-login: realm=com.google&args=continue%3Dhttps://accounts.google.com/x-ua-compatible: IE=edgeCache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Wed, 02 Sep 2026 13:16:36 GMTStrict-Transport-Security: max-age=31536000; includeSubDomainsAccept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionCross-Origin-Resource-Policy: same-siteContent-Security-Policy: script-src 'nonce-ZNGhGY3HFLLPLOQS8pGL0A' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /v3/signin/_/AccountsSignInUi/cspreport;worker-src 'self'Content-Security-Policy: require-trusted-types-for 'script';report-uri /v3/signin/_/AccountsSignInUi/cspreportCross-Origin-Opener-Policy-Report-Only: same-origin; report-to="AccountsSignInUi"Report-To: {"group":"AccountsSignInUi","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/AccountsSignInUi"}]}Permissions-Policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factors=*, ch-ua-platform=*, ch-ua-platform-version=*reporting-endpoints: default="/v3/signin/_/AccountsSignInUi/web-reports?context=eJwNw1tIU3EAB-Ax_P8QK9CysgVjCEELtDVpDaqHGipzFzfObmddlraFB2rT7WyQRSWmDxbRQzUpn6KoEI0kehBSosIkrMxBa932UJFYWJFSJNTvg6-sv2RTmU5j26jTPKge1e7a91Fbz5eWz2ovc8_rZyLL6tXnopf7eIDbDkyLw7zF8FLY2BmcER5OVuXEaTZac6KGHxnz4gn_7MyLymN5YVvMi0ZeU3gjdDyZeyumeIX7najgpVN2aLrs-NLowFc--dSBbl744MAfvjHjhLHWhRpeTLlQqrow1-vGPA9edOM2D99rxgiXfGuGzuuBnjewkc1s4VvdHgxxgd_z41ceTHLE4MVBvnbOi5ucGPcixd9XS_jF5VUSKvmHRcICN-2Q4OZPLRJm-Tcv8apWCWs5dF3CXs78k9Ae8UHlxHEfnFkfOiv8OMEZxY-5M37Mc8eEH2num_JDkQM4wl33A-jhs3yes3yFA-uDCPPQhSDucH8hiAHeti6E7bx7MIQGTm6VkWHdCxl6Hv4sY4Sjf2WMGsIY44b6MJp4vz2MumIYXv0erFxWevdhMYfy4vTEzurNrYmOiBKNxVVFPXoomYirsXi0Ja22pZVULJmJJSNmk9listaZak3WSLvpP6BS11s"Content-Encoding: gzipServer: ESFX-XSS-Protection: 0X-Content-Type-Options: nosniffAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Transfer-Encoding: chunked", "0000000100000001�0000000100000001000000010000000100000001000000010000000100000001�00000001,00000001�000092A�0�|�>pCM?�x@HMj�8�c��=��e/3��i�Ѿ;��J^�c]�<��7p+��lRX��ڰ��6��]C��-֦Tk�4�Z�s��IXp��唲�])V��x��/d�I(�a8�JntFb�rb��", "00000001�00000001�00000001m00000001K00000001�000000010022d��J�+�*��A��Տ{CA�P��K��r��lP�1Ks�\./�'k�huQSQ�ZN�w��:Bd�S�Ќ��դ�J�g��N(��R��4%��ślE��k��Š7m-Ov�4��Y��mMK��wQ/[��+��\H�Wæh�:��z[:2;?\�<�.�1F��n��Į�F��69��z��>�m�`�'�;�E�ϟ��Y��KkkkT��J�W��;؂��R��]�M|�mJ��*2^Ϟ�+��xL�2,t��Δ�d��$��t�Ȱ�ao��y��5�k�v��3�"zk|0ޥ��u9ѩ�?Dt��#Q��Et1�0,��K�\r99��ð�G!~�?�4�uB�5ƻڅ��ԉХ��1)��k4��Q4Z׍wz��f��?"��a�ٞ��GK[q�{��D�2\�2J��%�1.��A��j��*�m��.��{I'U`��iłD��p��>RE��c:��6�@D_��0eW�,,�(ԍ��uZ�[�5д�@#��-��SBpZ�[:�j\F��R��bu��=��C�#>Ҷ��:��7�Md��)�Kf�x�5�L).?�ZN��C�J��,��7��?�V��﯑��6��}Jj��n��j�(��vfk�zs}DDmժՑ��6�T�ʜȄ��B�y�t��сޯ�v��)��K~��y>El7kt��a�%5�$ϣ�>��B/�E�$�5��Σ9�mЫ�Y�&�}(w&�>�Ď{��-cf#,6Ą��-��D�4��^�=A^B�C\'הvX�ىF�|>��j��"ǵ=X�!��4tč��*�9�w�u��i�<�^t��n�).=�}�jcq��5[[�~a��^�:��Ӫ�]\s�y�m6K�y͎ί@Pa�j�ǅl��Vio�ؿ0�D�h�6��e��5��i�j��ԛs��j�N;I@�7>��:5l��?�/�j��Jժ~c�-��d�91��Fx�]��#�ac(�΂f[�v{a��;QW�ɘh��α|��πv�� 0-��L�LM��uQO�pG}��ֵ��iX`M�R�W�Q�I)�pD��heZ��b��Y�ۺ�M�G��8��L[Z茅Ņ�p�3��c��e��%�B\.C�M��R��:��UF��r�Mg��e.7��E��FM[nK�-��fd�u0�&;�>��F�з��o�e�%ǔv�U�ͦi�k�_�>��_��[�l��Lߠ'1�%�C��cT1��1?.�y��)��`�ҧ]vn�}`gs�x��V�0��"��Y��?�:�7q��C��P�%bLؔ��?�A��&�D@��[OGN��&�", "%(.��$��P�9`�1UNv�M�Z�AR��Y�͚,I�wB��P�fe�qM��Z��G!�Z��b�y~�F��k{M�*�k�-"W�ψR��6"��U*S��O�,�uQf`X�>[A��uL=�s.�ha��*��y],��_;�6��{MkaYNVG��*�\��-��<�3�H ZHqe�#c0�2��i/=�a�,BΚ�]�8��ņ�"�J�a��Þ��Y6zs#[��ad�u�K6ŗژ��5��\x��bV�Y|kq��9�֡��8Z��Y.�,D�D@s�lj��XܤCs�Q��[��pV�Xl�)�^�y��sś�AL�Rt��J�]�p�'�_{i?{��k��$�~P]��]��_��a_-�p��(�o��Ǯq�n��K�!�A�I'��vE��hL�dІacm�(:6�TD�-uT2��n��nDt}b�d��aw�@'��b��10Ϩ�X^=��C7�{A�-�� #��?�x��t��ޅ��?�u}��Q��?4�t�o�q��д܆�=h#��qt��d�6l�Im��p��w爝��"�M��M�� ^�$�K��"cR��Q:u�1G��q�8��x��8�&�N��L�N�D��>E+�|��î�KD}r[�x��<|��G��E�RTӍJ�(�dܟ]�\��>��;@"��'4�O񒿬��פ�w֞Z�[��3��V�T��~ē�w�:�E�˽��7�zPF�c��7n��enځ�u�.�h��2uF�߂��.Kt?K�!��8��[�֣R��9��-��H��V/[p9�P!��lR��N�w؅�\��!�vy4;��Ԡ8��-�Fȓ�)�JRRo�ڤ��s��+XW�8�R ]p�q1p��-W�� {z��>�C��d?�uV��2۸��!k��Ǒ�� .M��g'�r��T��z+?��8��x��J+��X�C�"�8�F^;{��':e(�*�cj��s��GT�?��n�>�X��5�7Ɩ��?��(��]ZҦ��ʪ��ǝ�&:1��{OJ}��|�SR�r��m�0k��+��A��D�ҎA/�u�� D-�p�F�r��e�mȼ��>��ٳ�W6��;�zgeO�.�>�.(�1|�U7��آ��0:��]��ƾ�:��6��Ͷqe7�c5~ؑ��ނ�mk��(�*/��.�� `KhhD�&M;��fP��s6Ծ�(d�B�ۢ�-\�p", "00000001�00000001�0000000100000001W00000001�00000001�0000000100000001600000001�00000001W00000001�00000001�00000001�00000001+00000001900000001�00000001l00000001B00000001000000010352c4�AeD��e��PA� �͙A=��:�s��|{푤��'��x@�=C�n�Ԑ[>�$��<�&�d��z<~t�R}��w�X��ԫ�ų��I��=e��,��\["ĤL��ܪ�1��(|�Tu/RY��{PT��C�V�@�0�@a*Hb�6��i��Еd.��>^�z�?��LK5��֑��}[mە�֖ �S��\W̱@R�p�3?0��g��cь�\Ō�P��֍�5L�To��S��Lt��"��DΩ��P.L9Z��!�l��l�EZ�� +�tyL��W3ik�o:5?�G��F�5�<��I��%;O�cE��vp�'��I�C(��KSA�5d�sш�3�Y��S��m�ߝ�z�9!!N�߲WόB� 2y>+�ix6�6I�yq��G�>v�p8ZdL� 櫤Am�V��4��ڈ�8��2Hk؝��M�(��>A-��E8��V\��V~�UI�vv`B��^�' m�t��E�1�7�UDe:��G��ו͟��3��U�^N[9L(�k�"H��d�xr6��/pP��{z��vkT~H<`�h��a��ވ�O<", "��; ��K��&�@'ٱaa��M��)��-.�΄�梂�2��s�Y�2�GP&�YZ��Xy:s@�o�8`�Tj�O�)�U��H��|s֐�LrQ�o��S��K�|M�_��dh0$�A�F��v�8�Y:@��;�i��x�\8��L�[9>~�5�*Ϛ�=��G��`�I��t��Vj#J�F&+��C1�pM�J�}��_ W��o�hM��@��x��N��R��1%�D)�┅�&��T��}��Z�2[�б��Z @l&;��/M��J�6��(�>��گ�:�BBp<�.�S��<��v��ي�t\<Բf��Ŕ8��u�6��XL��sk1��I��!��W��-�kz�+ɉ��:T�\��pW��=gs�H��Й�FY�⡄"�}]�N��wmu.#.k��E��2*t�w}W-B��E?Q/�R��k�#Ǫq,�7��${�y��^�eO�eЉ5��6Y4��M�%�"7�"��b�x0��픢Z/�ԗ�}P�L��;00|��45�@-Ж&4��@�sn�[0f��n�7��=P��/X}�۞�otE��`}]��N�n�i�]��J��L�%Ҹ(��O��ʘN׌r,�)ƨZ�T�U�|��C4O>��V��+q#�t�{�ol�4�ؿY_�l��B�3��J��0��߇��{�Jߦu`�I=\�N (�ͮR��P��w�jQvaq7�5��}��틎��^�^��~��B��^s��:��}��Iy�^y�2O�וy��=�J�Bx�J�u�#�Z��$�U�a�a�2e�kZ��d�(��C�Gy�uE�1��5/#��lM��B��0Ξ\�6g��޵��o2�\�~��ʘ=��D/f�0��4d�V�@�Lϛ��i^��x;yi��k�u��δ�jK��Yq��q�á��͌.U`=�؈��2X�0':��^�`�b�@<׌��8+W�^C7\��ؼ��c��c�r.��ʢ��tC]��.bQ3Ѐ��P�^i��G�E�;��@�2��e.5��]�z�T�#�}=�Z�8�^��d�Q��)U�j�љ�`�k�&��@�"�r�>�m\��(�ZIVK6�<�(3ԙx��W�!v�BSS�" "00000001�000000010000000100000001s00000001�00000001800000001�00000001�00000001x00000001z00000001�00000001300000001�00000001,0000000180000001�1047u��:i��Mڦi�mwv:d�5��$�俟@� a�fn��=��?��Z��b!b���N��EC�[�=�#˗��q?��w��㯝�Ι,w>��˳�g��W��׷'��xry:��M�.'�?'��?:��/�C��/'��|-�]ޜkg�7@^�^�Oy��}q:�=�^"�f��O��e;�y3�U�)�Ӎx��u�g_C{s��?�-��̃��[��&gs�Suc勆��~٨�aA9��a��G�jjh��p:=A:� �ǁ��Q��Tp�V�Q̂I��@��햯�&8��zj��D��PH��<�J��#)�9��?�2wV��)Ԥ��죻�ť��_��&�M�W�0�ƙa�r p\r(��H΍gN��p�-�.�@TW\�QsL�y�z ��0MQ[@�F��p:�#uO�?��ظ�oD2��%Y)��í�T�J��+A�/�4t�8ʬ��u�t=�I�$��0��2p�~Ȳ��63֣4I�w��#V�賫�:L�F��7�Ʋ��4��ruZ�Է�橆�QOJA?[��(A�m�:A�X�-�D6��t��", "��X��R��,�w�:�n�*�e�&�v��4D�X�U��@�W�P��R s˰��c�G��@\S�v�O��t��8�M��P�B��&�Y'��ҡ[�Gz��h�3��r>�<2��`�x4�#JXW��\v,Z��@М��6o,��%�1A�z�:�A.D�c��[@�rx�MG�]��s��(C�U��<�`�y�3@�p�{=]]�Sh��wv��B�r�MQ�pӋ��`�ov (�a�9{�O�k�^�E�h��Q��?��o�Jx(�2��8,�Ǵ$I�G+��X��F#�mCbvy1��& �F�~��}�;|��ګ��{�ͼ�M�k6�b��4;F��7nR�'3:��$�%L��T�0�G�8�|xz�S��a��rw�h�U��n�qw�X��d)�t̀��0��:=�>�b�tΰy��$��8��+�a/�|Z�/ˇ�,%�B��4�)�F�%d��=�[�6��.��fl�Y�sfiӦ��y�ݮ��ՂWlӐ-ϲ�Ͱ9��j/&_!�+��?3��9�r�z��:��oPz��(�T�ς�t!{p�\h{J��G��R�TK:�SAk��U��F�~%[.mȱ`��Y��5�ZR��p�Υ��=y��cp/��@v�0ظ�q1T��;:��M�y�mg$��]K�?b�QI�F�-H�p�Z2��>W��*�8�"零Y*Cz!�2��JY�&��Hdf|�)�T��4��1`e�W$<= #\�m#�42�o��0O/��;wO)�B(�T/��p`C�`r�9��zf�j8��P�"Z�YS�MJ��Z��Ȇ+�G��k��M�a�ݔ^7�^]+�)ۄ3��MW�vQ5�H_-A�=��I��n��l��Q�o�`?�)eQ�U��E�p�1��ڍx�|�o�{��^��4��&�� 8!��Cti�Br*�v@��K�q)�7H�Ε�(��@�徠t�v�k�s+��a�v�Uhɰ��&�"�ۚĸxs�^Ư6۽**JI��HG��H��B�!*l�;�ni̯oHE|��(��ݮ�0��&��GU��L�<`~yT�V#�J��*D̯�F�J|�EV�d�X#b~�S)?��/vn7��]�X/��rY�AϾ��Ntr^�=�-�O5�\<ӿ��K}�G�$��l@��Yo}��x��0��^Ȍ��A|�_`��S�ȼ�� h��m\h��)��pz'��\�{4��Ip�MTkj�7LK6�h�薴Bܨ�r��O�r�~ٓ�{�wh+�S�}o��(x��w��1��_��H��j��Y�v�7�s�4�y%��_ʅ9{�Be�ڙ�ː�U/T�E.��3&:�q��CAQ$��kg�)��Ni��=� '��'��i�`h��u��CA�P&��i�2��^�F��}�m݉�~�c��o8�9.._r#2z"�߹LR��rFPrn��o�/xX�e��6g+��&�Z>-G"Lu�w��\p��%��n&]��e�%��KL�e%&�"!�d��G�i��}O��q��:�o�ħ^�]M��:��+9��E��j;K��rL��#ّ�I��V�r��", "��Id}�}d}h��a3��%7:g��EƔb��rL��N��F�nB��7��}�pA��6�Y��xo�~�{/��P�'yQ� O��\v&�QajC��L8V?Zj�S)ʤ6��ά��Kv�01�̼fU�l��u2�.׎'��D��B6�Wx��1�16R�mг��)$��s��T9c/��", "00000001�00000001]00000001i00000001s00000001�00000001<0000000100000001�00000001+00000001�00000001�00000001/00000001�00000001�00000001I00000001�0000000100000001�10d4ڭ�I !��p8cC��W��d�&y�ݚ�LaK�V��t�l&Tֶ.r�&��zag�4�7��|*��EL&"��)��S4��;�+E��D{e�R4Q�6I��e�p��0�Y��s.�e�-�S��L낖�sZ6�e��*�A[&�K��yrW��`�4/�Xg��7�j"G角nϊoӘ'�ʇ�5�'��x�4b��'x� ��Z��1��Ih3��2a��$��q+��l��x��p�ȓ$T�ǉ̥:Ħ��W|]<��c��L%�#�DY�$�@�=|9َG1+_`ʡ��ty�H�W�N1B��)��)9�s��K�8w�i%�؈2("6rW�1��J�R��*��L�>��io��ഷt�b�uv=6�U��&�g=�>��M{,_´��/k�ׁ�`N��љJ��J�,mPZ{9^��q��SV;�JA�T�p�CY3��@�0W==Y��A�BL��w)Kq��E|��">�ex��V��^O��Mz˳e�1��+��(�ې�EI�3�f|lk��v�o��+�l#�n�-z��Y5>�!�y��Xg��=��ΎG#��IbiK񃒏�Ұ��<�K��;�^�Ǔ��~*t6r�)0)M�QZ��_bGļVѵL��=Ͳ]c��"||]��&�w*Eh>I{��lNk�w�<�C�18�[�~M^ܓ��~��O�e4�f��ە�#Cџ7��^_;�?��>^��V�o|7�sG�:��;L��f�B��[��r��qc�N��3��$��t�t��#�M��|��/��jv��|/CɣO��e��)�4�ta��l��-g��9s�7Q��B%@��:��(��ާBȗB��7wnh�'�_4sU;�w��ۣ`f�oC4/�R$H㓐��@�g�qD��/�L�9��rH��Ak8��kd�.gv��v��)��-��V��V�H�r�U&�U�Bg�ϟ0�N��ZA�O�/w��w��B��Eh��m~��1cf'5uT0&}\��*tc=}��愅�if��='J3`�l�wn��À�cd��)�*^��r9硚W��.��`hYl��;�;K��&�ף��a��l;�H֨M�]wj��f��P�N�^�)��'��·��V\#��gp;��j��I�vw��46b#�lL��t��B�60��9<�qi�Y��aRo�z��O�bY�b*�?�G$��c��e�:�e��uTDt^h,��&&�5E��[*#�qP ��|7�_��g��u�)d(�ޑ��&:r��R�}��-��>�:��**�M�IHƩ�*��r��}�8��d�t�M�*ip}p��]|�8�s>X=�4f��j�v�j�n��LMq[�v��7�t��o�Cxd�[h��e��JzRhîq~Pgbl��F'�8��ݗ�6&�!�M��-)�o��N��u!�+G�v\k��$|�eysqbiq��p�ҝ�9��@�F��Dy�&pF8P�-P\��o��o/ˏN1� ��O��A�Cg׏�Aĥ�n��l��֦S��#�w)��Һ�&߁/rayܴ�@��rK^��=��[W��zA��7KfaeE�g@kri��2�cf�]�Q5��P�E��7�2�A��-�6k�f�̴;D��F?�FCc�X^=zjg�vi��9x��5�!��S��?y^��j^UNr��R�+�K:�f�;�v�10�L��~ki?��a��[q�X=�h$�M10�_=�4�F��Fo�*>s�4��6Jx(n!��Q�%B%J�x��k�ml��N��R�^��", "�Lg�y� ��6��Ux6�3b��?��f�ܝ_��E78��؛�p˲��խ��>�٧�]�j�g)_*�^LQw�.Rx��QhZ��e7ߦ��l�X7~]|��.�9��/AW�#��~R��s��>�)AH��q�i�g�xe�A�� 5h��/��9T�[�/�5wZ�=�G`��`��>\g}��x�x�w��d�e�'�� 0��f��[�?JC��Z��<��xkS��O�Lx�Ƿ��"�(Z��]��j�{�8}*��ֲ�f�ӫb�SQ9}ܐ�J�#V�p��B��h!/��,q��,��6�Tn�F_-Z�V�1Q&ˬ0�#�j��4W�%�lS\�(\`<��@��~>Ʀ�Ԋ�)�[��CV�j/��e�"Bʶ]v��Ѩ��t�t��V"��~�A�N*�4�A��>�%J�28��u=2z��͛��u�⩝�5k/m��#x�B*�1�NǺ��E7rN'Fk?3�/%��K~ȠpGO@�R<;w�&��u[�'�b�� 1D�`DP��o/f\|܎��܂\��o�@,햳�zT�AH偑��{��4m@ܱ5��aW~�}�~P��Z��{3{��xu��s�E��כ��O�=÷�f��J��@*Z.�@͜�O�|x!�a|'��7�j�gJ�=�I��k�/p��|��E�&�=��(��:P?m�|��l�̄��R+;��z�$q�A��y�\ή^�uW�x��$�1CZM��فnFMDRe��}�~'H�O��4�+��27�9�#��'.��B\�-��X_S)�/�'y^��:w��l�*��.ע�u��toW'��7��cl��>N:HL��(>Z%\B��q�ug�ʳǧ�^�S�&��\�ʹ[/��֠�1y��*��q9�Tx!�ϫ2�2�q�i*��5k�Rҡ�_�ȗ��Tnt��!v�C��\&g�T&�'4�I�H��E�P�'r��7��O�}T~��0�,)��M2��N.9z�%c\�J�ҙcD^b��W��_��tnY#չ��>�R�&r�%ެ9�iK��XR�5��uel��+�r�Uv�*܃��{Ɛ�nk`T�;��-��b��9L+��l4�x1�Iǈ'��@^��<��T>G�5d׻)�L��+ݖ��. �-�� 9úi-�D��C$�з�|B$�s\�b*��+fe�rqr6�Z��$��n��\z�>�L��0��_��*'h�z6��q��tނ0fs�.4,)��l��0N�v�0,r��ƽ_�&\zA�OqC�w�+�~��N��U��Aw��[�P��L@�Q��*�=��û.�F��<��'�Ff��L+�">�/|(�?cq��tAȆ��=��)��T�O��?�P��I��Bk��-�e>n,nTf�FO9��y��c��e��?�Ī5G� ��L5��,�$I�]'B��A��Uak��{cÂ��̓!D5��υ�s*-��xZ��"̀i��38�%�RF��'(}o�8j!�Fmճ8%�r��"��h�$?L�s=��:��}r<�D*i�w}+��q��a��p:(��?�F~�N<�@�7⟇�Z�ͳ;��lt��7�-j�N��m�iICP�1҈�a^c��{s��p��Oz�.;�fr̮·À�t��m��f�P�I�n_��)Ƹ�l�P�Y1�N��|�,��rp�q,��:��K'� �X/��n��_CH��/p�;GΌ��!U��e�K.��e��l��[�U#�#4EUٔ2��ld�Ԧ$9Ig~��V6G� �+PE!��aUy�VIU�P�8S+Z�B�`^�k��s��َ6��Q^M��-�Qw:�n�M�bd!"�`��/�/��k_[��L� �oY�r�C�=��A�N�(��vg}u9@��:�x��ކ��,5��*2`<�L��L�d�F��P��/(�M_Y��Y8�M��z#tGN��?��9P}[b��3x�!pڨ#_T�|f�5��2?(?5pOh;�5!�a6��y��<:o{��<��Ǒ��^�"0��4�n�D��?��:�ڍ}Fao��-4�8<��oP��33�2��Q�B\�j:�", "��|�~�}�x��gG��BQ�$�40_��J�e�-_j��u7D��<��NN��;��5�b2x|�B�y ��[��@��R7��m^��佅;R�ܽ�eI9w+�u��a5�{��e��7��/�>̔9�ƊǈrH��|\NL2��)%eԽ!��ז��{�"lf !��X&�8�D>��u$�6Y)�r�+��"��G^X+�<�#w��ڥ�E�r;�-ҀIJs��YwV��$��/��)!��r�r�sUu%�9�z��M��c�J��U�DE��K2��l JĀ9c6�P��kL�cWE�lM�)�� A+7XB� p�9��l��e��K�I�XX��n�]Z�"�E�F�f��N��鈹Ê�T�cVi/iNl��j6�F��}~�=˓��M�9��N��Nq:�B��=CFh��q�-�[�:X '��`�7��!��b@C��!�0��}��+�n��]��U3x�3�o�WG��#�ׄ�3sh��I�o(*�VYU�ה�dq{��i!�b��M_䅓-��V�,+s�P90S��#�S�B�JT��8r,�1�(\I�'�ڰr�Np�,�d�A�J��p��KR*�B+�<�i�:%q�Է�M�/�e��Ҍn�붚,2Y��b�r�"�p��r ;�Uw�-�QLGR'��j`(�d�;��&k��I��ܑL��~�.J�g1s~�y.��S��I�� zu�rܱ5�K̀2B:N��㋣y/`��2��0�P�g��gJ4�$�=�Y�˩�MvF4��|U4��t�4T��U?�J.q��\�%��Q�8Hj�W�E��zê��F��Z�B��q"F��ש��-�O��7�28ix��)6f��P�t仸)�F�)�єbgT�z$��#�|��42$W��ieH��ִ��V��i��v3��Һ��f��^�0�^�?��S��4�+��V�r�V��S=�{Οd�Bŷ�P�f߰�]��(1Cֆ��Oרiik��<֮K��R��_KE�:�CC�o4D�:'�L4�i+r$M��y��=��n�x�r̬|Z��%��g�2��vW��JwH��I��0N�4�f|�--��Zs;�t3�sm�Uƣ&�Y«�c-�Y��xWsIE�+{k �S��$��m� ��m�?](?w�n*ѹ�P�E��%`��7Sl풮#{��`��-�Z�j��;��)휵�I��mڊ�Q�)��>u�}�{;:>�", "�i_M�[�AM��f��6�~�F�D+��t��;"��_Ո G�vY�J�%�ф��#�@Pe�P�>��^��a�c`";q]jLA��F� #�E��|m�M��V��0��M윲��N�|v�:7�tƸXF�[�/��s�+��L)f12ݥ�Ϛ�m-��{��{Mt]��o�y+]��:��Ã��\ʮe��\d��i]j��U�G�skE��WIt}��E��..��kvV�6��-�b��bM��[�"%�V��[Īn�:�Rz��*�*�Twd5ҡ��R7WP�qA�0�`�~U`�H�e�oҦ��Z�#t��?��>4݊l�oF�� -7��Q:�(V��BVn��i9yA�@4e�aC�h��`��4�i��$I��X8i��7�7��QHO�Rט��)KL(�T7��놐��l��p2$�k��ߏ��edI$O:��'x�=@��FsU 9?�s��(�s��A`��v��Վ�z4Q�WW^��ɞF�H��x�l�7�b8�� 6�2t̓��R�Yf-�c�oǏ�i�d6xL6a/�߰sM-�i�Ag�E��Y��h��`Z��\�!��f`5y��lon��XN'��J��ŜCc��,E Z��D��>MY��=�)p~��|i��%J{?�|��y�@;��7pK��u��<��?��)k��<��:K�c��]��?>P�[Jԩ��yB�<��z��e#W��u�㋄�VrS1�Gמ9�D��0��^'�Vqr��̪&P��kE.'�}|��sG��\��k�vξzZ��~]8�e�u��R��3ieB�l*�0�Sg��X?=]e�� P��n��[��3��`��G�MQ�>_�G+tDQI��.��ڞ}F_�k�_�7�"8�>�;_��S�|CJ#j3��4~UR�+��Tz��sߟ�Ju��tKoe:(Ƕ�U�LV՛.�)�m-��T��T&��@�V�T$��OJ�Qr�Y�VWڐ�7��F�12�){��`�.�yu�i��R�Gf�ot��b/��_h�Ȍ⍎C!C��.x��#3^�7:��Ա�{~׾�0ǘz}LƫPu�*�.昴��WB��(��ė�7�pC�� Microsoft Corporation\"\n \"MP5ye33.exe\" was detected as \"Microsoft Visual C++ 8\"\n \"aR7ev61.exe\" was detected as \"Microsoft Visual C++ 8\"\n \"6pl671.exe\" was detected as \"VC8 -> Microsoft Corporation\"\n \"5ip71Yr.exe\" was detected as \"VC8 -> Microsoft Corporation\"\n \"4NU6qK7.exe\" was detected as \"VC8 -> Microsoft Corporation\"","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":10,"id":"static-18","sources":[{"report_type":"sandbox","report_id":"6a98218b599feef6ff013813"}]},{"level":"informative","category":"Unusual Characteristics","name":"Reads the windows installation language","description":"\"3Kn814gI.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE GROUPS\"; Key: \"1\")","origin":"Registry Access","mitre_attack_id":"T1614.001","relevance":2,"id":"registry-26","sources":[{"report_type":"sandbox","report_id":"6a98218b599feef6ff013813"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Section contains high entropy","description":"\"7ef834fc890f8f801316f859915cba63a0771e89738a882bca0656fda5a74ddf\" has section name .rsrc with entropy \"7.971467169073982\"\n \"MP5ye33.exe\" has section name .rsrc with entropy \"7.947080436371467\"\n \"aR7ev61.exe\" has section name .rsrc with entropy \"7.916411890380875\"","origin":"Static Parser","mitre_attack_id":"T1027.009","relevance":1,"id":"static-6","sources":[{"report_type":"sandbox","report_id":"6a98218b599feef6ff013813"}]},{"level":"suspicious","category":"External Systems","name":"Detected Suricata Alert","description":"Detected alert \"ET INFO TLS Handshake Failure\" (SID: 2029340, Rev: 2, Severity: 2) categorized as \"Potentially Bad Traffic\"","origin":"Suricata Alerts","relevance":10,"id":"suricata-1","sources":[{"report_type":"sandbox","report_id":"6a98218b599feef6ff013813"}]},{"level":"suspicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"12/24 Antivirus vendors marked sample as malicious (50% detection rate)","origin":"External System","id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"6a98218b599feef6ff013813"}]},{"level":"suspicious","category":"General","name":"Contains ability to find and load resources of a specific module","description":"FindResourceA@KERNEL32.DLL at 00000000-00005684-59150-35-0013468F\n FindResourceA@KERNEL32.DLL at 00000000-00005684-59150-51-00134FE0\n LoadResource@KERNEL32.DLL at 00000000-00005684-59150-57-00136298\n FindResourceA@KERNEL32.DLL at 00000000-00005684-59150-58-00136517\n FindResourceA@KERNEL32.DLL at 00000000-00005684-59150-71-00132CAA","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1005","relevance":1,"id":"stream-32","sources":[{"report_type":"sandbox","report_id":"6a98218b599feef6ff013813"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Drops executable files","description":"\"3Kn814gI.exe\" has type \"PE32 executable for MS Windows 5.01 (GUI) Intel i386 5 sections\"- Location: [%TEMP%\\IXP002.TMP\\3Kn814gI.exe]- [targetUID: 00000000-00005948]\n \"MP5ye33.exe\" has type \"PE32 executable for MS Windows 6.00 (GUI) Intel i386 5 sections\"- Location: [%TEMP%\\IXP000.TMP\\MP5ye33.exe]- [targetUID: 00000000-00005936]\n \"aR7ev61.exe\" has type \"PE32 executable for MS Windows 6.00 (GUI) Intel i386 5 sections\"- Location: [%TEMP%\\IXP001.TMP\\aR7ev61.exe]- [targetUID: 00000000-00005708]\n \"6pl671.exe\" has type \"PE32 executable for MS Windows 6.00 (console) Intel i386 5 sections\"- Location: [%TEMP%\\IXP000.TMP\\6pl671.exe]- [targetUID: 00000000-00005936]\n \"5ip71Yr.exe\" has type \"PE32 executable for MS Windows 6.00 (console) Intel i386 5 sections\"- Location: [%TEMP%\\IXP001.TMP\\5ip71Yr.exe]- [targetUID: 00000000-00005708]\n \"4NU6qK7.exe\" has type \"PE32 executable for MS Windows 6.00 (console) Intel i386 5 sections\"- Location: [%TEMP%\\IXP002.TMP\\4NU6qK7.exe]- [targetUID: 00000000-00001832]","origin":"Binary File","mitre_attack_id":"T1105","relevance":5,"id":"binary-1","sources":[{"report_type":"sandbox","report_id":"6a98218b599feef6ff013813"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Modifies auto-execute functionality by setting/creating a value in the registry","description":"$63","origin":"Registry Access","mitre_attack_id":"T1547.001","relevance":8,"id":"registry-0","sources":[{"report_type":"sandbox","report_id":"6a98218b599feef6ff013813"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Writes a PE file header to disc","description":"$64","origin":"API Call","mitre_attack_id":"T1105","relevance":5,"id":"api-43","sources":[{"report_type":"sandbox","report_id":"6a98218b599feef6ff013813"}]},{"level":"suspicious","category":"Network Related","name":"Sends traffic on typical HTTP outbound port, but without HTTP header","description":"$65","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":5,"id":"network-23","sources":[{"report_type":"sandbox","report_id":"6a98218b599feef6ff013813"}]},{"level":"suspicious","category":"Pattern Matching","name":"YARA signature match - References common sandbox DLLs (sandbox evasion)","description":"YARA signature for common sandbox DLLs that are used for anti-sandbox techniques matched on process \"00000000-00005948\"","origin":"YARA Signature","mitre_attack_id":"T1497.001","relevance":5,"id":"yara-52","sources":[{"report_type":"sandbox","report_id":"6a98218b599feef6ff013813"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Calls an API that may be used to take screenshots","description":"\"3Kn814gI.exe\" called \"CreateCompatibleBitmap\" with parameters {\"hdc\": \"1b010adc\"\n \"cx\": \"32\"\n \"cy\": \"32\"}\n \"3Kn814gI.exe\" called \"CreateCompatibleBitmap\" with parameters {\"hdc\": \"1b010adc\"\n \"cx\": \"16\"\n \"cy\": \"16\"}","origin":"API Call","mitre_attack_id":"T1113","relevance":1,"id":"api-105","sources":[{"report_type":"sandbox","report_id":"6a98218b599feef6ff013813"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the fully qualified path of module","description":"GetModuleFileNameA@KERNEL32.DLL at 00000000-00005684-59150-42-0013202A\n GetModuleFileNameA@KERNEL32.DLL at 00000000-00005684-59150-44-00132AAC\n GetModuleFileNameA@KERNEL32.DLL at 00000000-00005684-59150-78-00135C9E","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1106","relevance":5,"id":"stream-131","sources":[{"report_type":"sandbox","report_id":"6a98218b599feef6ff013813"}]},{"level":"suspicious","category":"System Destruction","name":"Marks file for deletion","description":"\"7ef834fc890f8f801316f859915cba63a0771e89738a882bca0656fda5a74ddf.exe\" marked \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\IXP000.TMP\\6pl671.exe\" for deletion\n \"7ef834fc890f8f801316f859915cba63a0771e89738a882bca0656fda5a74ddf.exe\" marked \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\IXP000.TMP\\MP5ye33.exe\" for deletion\n \"MP5ye33.exe\" marked \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\IXP001.TMP\\5ip71Yr.exe\" for deletion\n \"MP5ye33.exe\" marked \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\IXP001.TMP\\aR7ev61.exe\" for deletion\n \"aR7ev61.exe\" marked \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\IXP002.TMP\\4NU6qK7.exe\" for deletion\n \"aR7ev61.exe\" marked \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\IXP002.TMP\\3Kn814gI.exe\" for deletion","origin":"API Call","mitre_attack_id":"T1070.004","relevance":10,"id":"api-26","sources":[{"report_type":"sandbox","report_id":"6a98218b599feef6ff013813"}]},{"level":"suspicious","category":"System Destruction","name":"Opens file with deletion access rights","description":"$66","origin":"API Call","mitre_attack_id":"T1070.004","relevance":7,"id":"api-25","sources":[{"report_type":"sandbox","report_id":"6a98218b599feef6ff013813"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"CRC value set in PE header does not match actual value","description":"\"3Kn814gI.exe\" claimed CRC 1393614 while the actual is CRC 941791\n \"MP5ye33.exe\" claimed CRC 941402 while the actual is CRC 955207\n \"aR7ev61.exe\" claimed CRC 955207 while the actual is CRC 694312\n \"6pl671.exe\" claimed CRC 694312 while the actual is CRC 680626","origin":"Static Parser","mitre_attack_id":"T1027","relevance":10,"id":"static-0","sources":[{"report_type":"sandbox","report_id":"6a98218b599feef6ff013813"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Imports suspicious APIs","description":"$67","origin":"Static Parser","mitre_attack_id":"T1106","relevance":1,"id":"static-1","sources":[{"report_type":"sandbox","report_id":"6a98218b599feef6ff013813"}]},{"level":"malicious","category":"Exploit/Shellcode","name":"Writes shellcode to a remote process","description":"$68","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1055","relevance":8,"id":"stream-38","sources":[{"report_type":"sandbox","report_id":"6a98218b599feef6ff013813"}]},{"level":"malicious","category":"External Systems","name":"Sample detected by CrowdStrike Static Analysis and ML with relatively high confidence","description":"CrowdStrike Static Analysis and ML (QuickScan) yielded detection: win/malicious_confidence_100% (W)","origin":"External System","relevance":10,"id":"avtest-8","sources":[{"report_type":"sandbox","report_id":"6a98218b599feef6ff013813"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a large number of Antivirus engines","description":"12/24 Antivirus vendors marked sample as malicious (50% detection rate)","origin":"External System","relevance":10,"id":"avtest-3","sources":[{"report_type":"sandbox","report_id":"6a98218b599feef6ff013813"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a trusted antivirus engine","description":"Trusted antivirus vendors count marked sample as malicious (count = 2)","origin":"External System","mitre_attack_id":"T1204.002","relevance":10,"id":"avtest-5","sources":[{"report_type":"sandbox","report_id":"6a98218b599feef6ff013813"}]},{"level":"malicious","category":"General","name":"The analysis extracted a file that was identified as malicious","description":"11/23 Antivirus vendors marked dropped file \"aR7ev61.exe\" as malicious (classified as \"Gen:Heur.Crifi\" with 47% detection rate)\n 16/23 Antivirus vendors marked dropped file \"6pl671.exe\" as malicious (classified as \"Trojan.Kryptik\" with 69% detection rate)\n 16/24 Antivirus vendors marked dropped file \"5ip71Yr.exe\" as malicious (classified as \"Trojan.Kryptik\" with 66% detection rate)\n 16/26 Antivirus vendors marked dropped file \"4NU6qK7.exe\" as malicious (classified as \"Trojan.Kryptik\" with 61% detection rate)","origin":"Binary File","mitre_attack_id":"T1204.002","relevance":10,"id":"binary-11","sources":[{"report_type":"sandbox","report_id":"6a98218b599feef6ff013813"}]},{"level":"malicious","category":"General","name":"The analysis spawned a process that was identified as malicious","description":"11/23 Antivirus vendors marked spawned process \"aR7ev61.exe\" (PID: 5684) as malicious (classified as \"Gen:Heur.Crifi\" with 47% detection rate)\n 16/26 Antivirus vendors marked spawned process \"4NU6qK7.exe\" (PID: 1832) as malicious (classified as \"Trojan.Kryptik\" with 61% detection rate)\n 16/24 Antivirus vendors marked spawned process \"5ip71Yr.exe\" (PID: 844) as malicious (classified as \"Trojan.Kryptik\" with 66% detection rate)\n 16/23 Antivirus vendors marked spawned process \"6pl671.exe\" (PID: 4076) as malicious (classified as \"Trojan.Kryptik\" with 69% detection rate)","origin":"Monitored Target","mitre_attack_id":"T1204.002","relevance":10,"id":"target-58","sources":[{"report_type":"sandbox","report_id":"6a98218b599feef6ff013813"}]},{"level":"malicious","category":"Network Related","name":"Contacts multiple hosts","description":"Contacted 24 (or more) hosts in at least 0 different cls.countries","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":9,"id":"network-17","sources":[{"report_type":"sandbox","report_id":"6a98218b599feef6ff013813"}]},{"level":"malicious","category":"Network Related","name":"Detected multiple DNS responses with a low TTL","description":"\"accounts.google.com\" with TTL 291\n \"accounts.youtube.com\" with TTL 300\n \"c.pki.goog\" with TTL 82\n \"crt.rootg2.amazontrust.com\" with TTL 60\n \"fonts.googleapis.com\" with TTL 76\n \"fonts.gstatic.com\" with TTL 1\n \"js.hcaptcha.com\" with TTL 300\n \"moskhoods.pw\" with TTL 300\n \"numpersb.fun\" with TTL 300\n \"o.ss2.us\" with TTL 380\n \"ocsp.digicert.cn\" with TTL 104\n \"ocsp.pki.goog\" with TTL 200\n \"ocsp.r2m04.amazontrust.com\" with TTL 60\n \"ocsp.rootca1.amazontrust.com\" with TTL 60\n \"ocsp.rootg2.amazontrust.com\" with TTL 60\n \"s.ss2.us\" with TTL 595\n \"ssl.gstatic.com\" with TTL 95\n \"static-assets-prod.unrealengine.com\" with TTL 300\n \"store.steampowered.com\" with TTL 20\n \"twitter.com\" with TTL 3\n \"www.google.com\" with TTL 232\n \"www.youtube.com\" with TTL 300","origin":"Network Traffic","mitre_attack_id":"T1071.004","relevance":3,"id":"network-35","sources":[{"report_type":"sandbox","report_id":"6a98218b599feef6ff013813"}]},{"level":"malicious","category":"Network Related","name":"Makes HTTPS connections using an insecure TLS/SSL version","description":"Connection was made using TLSv1.0 [tls.handshake.version: 0x0301]","origin":"Network Traffic","mitre_attack_id":"T1573","relevance":10,"id":"network-53","sources":[{"report_type":"sandbox","report_id":"6a98218b599feef6ff013813"}]},{"level":"malicious","category":"Network Related","name":"Uses network protocols on unusual ports","description":"TCP traffic to 5.42.92.51 on port 19057","origin":"Network Traffic","mitre_attack_id":"T1571","relevance":7,"id":"network-7","sources":[{"report_type":"sandbox","report_id":"6a98218b599feef6ff013813"}]},{"level":"malicious","category":"Unusual Characteristics","name":"Spawns many processes","description":"Spawned process \"7ef834fc890f8f801316f859915cba63a0771e89738a882bca0656fda5a74ddf.exe\" (UID: 00000000-00005936)\n Spawned process \"MP5ye33.exe\" (UID: 00000000-00005708)\n Spawned process \"aR7ev61.exe\" (UID: 00000000-00005684)\n Spawned process \"3Kn814gI.exe\" (UID: 00000000-00005948)\n Spawned process \"4NU6qK7.exe\" (UID: 00000000-00001832)\n Spawned process \"AppLaunch.exe\" (UID: 00000000-00003720)\n Spawned process \"5ip71Yr.exe\" (UID: 00000000-00000844)\n Spawned process \"AppLaunch.exe\" (UID: 00000000-00002372)\n Spawned process \"6pl671.exe\" (UID: 00000000-00004076)\n Spawned process \"AppLaunch.exe\" (UID: 00000000-00003020)","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":8,"id":"target-14","sources":[{"report_type":"sandbox","report_id":"6a98218b599feef6ff013813"}]}],"incidents":[{"name":"Spyware","details_count":1,"details":[{"detail":"Found a string that may be used as part of an injection method"}],"sources":[{"report_type":"sandbox","report_id":"6a98218b599feef6ff013813"}]},{"name":"Persistence","details_count":2,"details":[{"detail":"Modifies auto-execute functionality by setting/creating a value in the registry"},{"detail":"Spawns many processes"}],"sources":[{"report_type":"sandbox","report_id":"6a98218b599feef6ff013813"}]},{"name":"Fingerprint","details_count":1,"details":[{"detail":"Queries kernel debugger information"}],"sources":[{"report_type":"sandbox","report_id":"6a98218b599feef6ff013813"}]},{"name":"Evasive","details_count":3,"details":[{"detail":"Marks file for deletion"},{"detail":"Contains ability to adjust token privileges"},{"detail":"Contains ability to terminate a process"}],"sources":[{"report_type":"sandbox","report_id":"6a98218b599feef6ff013813"}]},{"name":"Spreading","details_count":1,"details":[{"detail":"Detected multiple DNS responses with a low TTL"}],"sources":[{"report_type":"sandbox","report_id":"6a98218b599feef6ff013813"}]},{"name":"Network Behavior","details_count":1,"details":[{"detail":"Contacts 28 domains and 28 hosts"}],"sources":[{"report_type":"sandbox","report_id":"6a98218b599feef6ff013813"}]}],"intel_graph":{"map":{"Domain:accounts.google.com":{"type":"Domain","value":"accounts.google.com"},"Domain:accounts.youtube.com":{"type":"Domain","value":"accounts.youtube.com"},"Domain:c.pki.goog":{"type":"Domain","value":"c.pki.goog"},"Domain:crt.rootg2.amazontrust.com":{"type":"Domain","value":"crt.rootg2.amazontrust.com"},"Domain:fonts.googleapis.com":{"type":"Domain","value":"fonts.googleapis.com"},"Domain:fonts.gstatic.com":{"type":"Domain","value":"fonts.gstatic.com"},"Domain:js.hcaptcha.com":{"type":"Domain","value":"js.hcaptcha.com"},"Domain:moskhoods.pw":{"type":"Domain","value":"moskhoods.pw"},"Domain:numpersb.fun":{"type":"Domain","value":"numpersb.fun"},"Domain:o.ss2.us":{"type":"Domain","value":"o.ss2.us"},"Domain:ocsp.digicert.cn":{"type":"Domain","value":"ocsp.digicert.cn"},"Domain:ocsp.pki.goog":{"type":"Domain","value":"ocsp.pki.goog"},"Domain:ocsp.r2m04.amazontrust.com":{"type":"Domain","value":"ocsp.r2m04.amazontrust.com"},"Domain:ocsp.rootca1.amazontrust.com":{"type":"Domain","value":"ocsp.rootca1.amazontrust.com"},"Domain:ocsp.rootg2.amazontrust.com":{"type":"Domain","value":"ocsp.rootg2.amazontrust.com"},"Domain:s.ss2.us":{"type":"Domain","value":"s.ss2.us"},"Domain:ssl.gstatic.com":{"type":"Domain","value":"ssl.gstatic.com"},"Domain:static-assets-prod.unrealengine.com":{"type":"Domain","value":"static-assets-prod.unrealengine.com"},"Domain:static.xx.fbcdn.net":{"type":"Domain","value":"static.xx.fbcdn.net"},"Domain:store.steampowered.com":{"type":"Domain","value":"store.steampowered.com"},"Domain:tracking.epicgames.com":{"type":"Domain","value":"tracking.epicgames.com"},"Domain:twitter.com":{"type":"Domain","value":"twitter.com"},"Domain:www.epicgames.com":{"type":"Domain","value":"www.epicgames.com"},"Domain:www.facebook.com":{"type":"Domain","value":"www.facebook.com"},"Domain:www.google.com":{"type":"Domain","value":"www.google.com"},"Domain:www.noticeofpleadings.net":{"type":"Domain","value":"www.noticeofpleadings.net"},"Domain:www.paypal.com":{"type":"Domain","value":"www.paypal.com"},"Domain:www.youtube.com":{"type":"Domain","value":"www.youtube.com"},"File:0e5fe0deb5b4892b17117537ef8c222833be21fde9b172fb1ed1542e8ef47f23":{"type":"File","value":"0e5fe0deb5b4892b17117537ef8c222833be21fde9b172fb1ed1542e8ef47f23"},"File:1a9251dc3b3c064cfc5e2b90b6c7dc3c225f7017066db2b77e49dae90a94a399":{"type":"File","value":"1a9251dc3b3c064cfc5e2b90b6c7dc3c225f7017066db2b77e49dae90a94a399"},"File:256877e6dd00e1010e8a9d6d90716166218a975cac04997248719c5cc14c2a13":{"type":"File","value":"256877e6dd00e1010e8a9d6d90716166218a975cac04997248719c5cc14c2a13"},"File:3718eb3d101cbde59ca668da46cabfe683e31b0d7476ced66cd0ce71ab53aaa4":{"type":"File","value":"3718eb3d101cbde59ca668da46cabfe683e31b0d7476ced66cd0ce71ab53aaa4"},"File:3e191adab4ea25b8d83ea6f80029b25af43fb234c5689f6fd01db91926e60822":{"type":"File","value":"3e191adab4ea25b8d83ea6f80029b25af43fb234c5689f6fd01db91926e60822"},"File:420c01c9c3e381aaf2b28cc2f9ff0bdd3ac09a83a936dec1713894fda9797f40":{"type":"File","value":"420c01c9c3e381aaf2b28cc2f9ff0bdd3ac09a83a936dec1713894fda9797f40"},"File:521b9ca61b59188d42990a32c6bf26fd69ff9de319601ccb1475bcf5085c04a3":{"type":"File","value":"521b9ca61b59188d42990a32c6bf26fd69ff9de319601ccb1475bcf5085c04a3"},"File:53860c17a76878ba2b911a12c34a19ab191e3981b35ce1f1c480832f97d73639":{"type":"File","value":"53860c17a76878ba2b911a12c34a19ab191e3981b35ce1f1c480832f97d73639"},"File:5aeb1c97dd5d490dc7539c58e09b9a0934363b81793f29b539bf5612d9652d24":{"type":"File","value":"5aeb1c97dd5d490dc7539c58e09b9a0934363b81793f29b539bf5612d9652d24"},"File:6007d88865cda81bb228728401f7e70c65feb6a6f88445153b7ab27776935c4b":{"type":"File","value":"6007d88865cda81bb228728401f7e70c65feb6a6f88445153b7ab27776935c4b"},"File:6cd14790ceeb7ff4003bf270d61dcc7715050a7822b51516b66865eafe5a3d8d":{"type":"File","value":"6cd14790ceeb7ff4003bf270d61dcc7715050a7822b51516b66865eafe5a3d8d"},"File:740e6d2fe75757edfe73ebd1a38afccb8a24de434994bc16c4a6ac854081acce":{"type":"File","value":"740e6d2fe75757edfe73ebd1a38afccb8a24de434994bc16c4a6ac854081acce"},"File:7b492c0d9bebad18af6fee6ec2728ab9c1b4f798d60c170755a6dc8fb00b5fd2":{"type":"File","value":"7b492c0d9bebad18af6fee6ec2728ab9c1b4f798d60c170755a6dc8fb00b5fd2"},"File:7ef834fc890f8f801316f859915cba63a0771e89738a882bca0656fda5a74ddf":{"type":"File","value":"7ef834fc890f8f801316f859915cba63a0771e89738a882bca0656fda5a74ddf","verdict":{"verdict":"suspicious","verdict_source":"ClamAV Antivirus","reasons":["File reported as packed by ClamAV antivirus"]}},"File:901351bccd76270620730173d66b61268e4664b085faae5bd9c862b31b1a4ec9":{"type":"File","value":"901351bccd76270620730173d66b61268e4664b085faae5bd9c862b31b1a4ec9"},"File:9f5538ee297a404978922c8c4bb2afa0dd904b6aef8458089acfd09bd613ac24":{"type":"File","value":"9f5538ee297a404978922c8c4bb2afa0dd904b6aef8458089acfd09bd613ac24"},"File:bc78bfa4cd442d895d0d86c191235e03d637f55f33805a4a43fd3a4c3205013d":{"type":"File","value":"bc78bfa4cd442d895d0d86c191235e03d637f55f33805a4a43fd3a4c3205013d"},"File:ca80aca453d15a5159e13484f9f24cbf4a876c07d2b0ff3d4c7209a40535dda6":{"type":"File","value":"ca80aca453d15a5159e13484f9f24cbf4a876c07d2b0ff3d4c7209a40535dda6"},"File:f8f5e88cdb1ab0d79c6960c5c705fff40e24581f39b4566e5ba83660fd49518e":{"type":"File","value":"f8f5e88cdb1ab0d79c6960c5c705fff40e24581f39b4566e5ba83660fd49518e"},"Ip:104.18.21.177":{"type":"Ip","value":"104.18.21.177"},"Ip:104.18.21.94":{"type":"Ip","value":"104.18.21.94"},"Ip:104.19.229.21":{"type":"Ip","value":"104.19.229.21"},"Ip:142.251.150.119":{"type":"Ip","value":"142.251.150.119"},"Ip:142.251.150.4":{"type":"Ip","value":"142.251.150.4"},"Ip:142.251.163.84":{"type":"Ip","value":"142.251.163.84"},"Ip:142.251.218.131":{"type":"Ip","value":"142.251.218.131"},"Ip:142.251.218.202":{"type":"Ip","value":"142.251.218.202"},"Ip:142.251.219.131":{"type":"Ip","value":"142.251.219.131"},"Ip:142.251.219.3":{"type":"Ip","value":"142.251.219.3"},"Ip:142.251.219.46":{"type":"Ip","value":"142.251.219.46"},"Ip:150.171.109.115":{"type":"Ip","value":"150.171.109.115"},"Ip:150.171.110.193":{"type":"Ip","value":"150.171.110.193"},"Ip:151.101.193.21":{"type":"Ip","value":"151.101.193.21"},"Ip:155.102.176.87":{"type":"Ip","value":"155.102.176.87"},"Ip:157.240.254.7":{"type":"Ip","value":"157.240.254.7"},"Ip:172.66.0.227":{"type":"Ip","value":"172.66.0.227"},"Ip:18.164.123.208":{"type":"Ip","value":"18.164.123.208"},"Ip:18.215.204.171":{"type":"Ip","value":"18.215.204.171"},"Ip:18.238.80.36":{"type":"Ip","value":"18.238.80.36"},"Ip:23.37.18.120":{"type":"Ip","value":"23.37.18.120"},"Ip:5.42.92.51":{"type":"Ip","value":"5.42.92.51"},"Ip:52.84.24.24":{"type":"Ip","value":"52.84.24.24"},"Ip:57.144.220.1":{"type":"Ip","value":"57.144.220.1"},"Url:/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEA59dSNcqDdhV39MzSTNbR0%3D":{"type":"Url","value":"/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEA59dSNcqDdhV39MzSTNbR0%3D"},"Url:/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTihuFvpmFDw5hOcIp918Jm5B3CQgQUH1KSYVaCVH%2BBZtgdPQqqMlyH3QgCEA3N2p7AWhpIo7uTRZjDirs%3D":{"type":"Url","value":"/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTihuFvpmFDw5hOcIp918Jm5B3CQgQUH1KSYVaCVH%2BBZtgdPQqqMlyH3QgCEA3N2p7AWhpIo7uTRZjDirs%3D"},"Url:/MFQwUjBQME4wTDAJBgUrDgMCGgUABBRPWaOUU8%2B5VZ5%2Fa9jFTaU9pkK3FAQUhBjMhTTsvAyUlC4IWZzHshBOCggCEwdzEk8qlS4%2B0YpYvbhdG8DOXyc%3D":{"type":"Url","value":"/MFQwUjBQME4wTDAJBgUrDgMCGgUABBRPWaOUU8%2B5VZ5%2Fa9jFTaU9pkK3FAQUhBjMhTTsvAyUlC4IWZzHshBOCggCEwdzEk8qlS4%2B0YpYvbhdG8DOXyc%3D"},"Url:/MFQwUjBQME4wTDAJBgUrDgMCGgUABBSIfaREXmfqfJR3TkMYnD7O5MhzEgQUnF8A36oB1zArOIiiuG1KnPIRkYMCEwZ%2FlEoqJ83z%2BsKuKwH5CO65xMY%3D":{"type":"Url","value":"/MFQwUjBQME4wTDAJBgUrDgMCGgUABBSIfaREXmfqfJR3TkMYnD7O5MhzEgQUnF8A36oB1zArOIiiuG1KnPIRkYMCEwZ%2FlEoqJ83z%2BsKuKwH5CO65xMY%3D"},"Url:/gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D":{"type":"Url","value":"/gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D"},"Url:/r/gsr1.crl":{"type":"Url","value":"/r/gsr1.crl"},"Url:/r/r1.crl":{"type":"Url","value":"/r/r1.crl"},"Url:/r/r4.crl":{"type":"Url","value":"/r/r4.crl"},"Url:/rootg2.cer":{"type":"Url","value":"/rootg2.cer"},"Url:/we1/G0k-BqpOX8k.crl":{"type":"Url","value":"/we1/G0k-BqpOX8k.crl"},"Url:/we1/pl4XiTjSDSk.crl":{"type":"Url","value":"/we1/pl4XiTjSDSk.crl"},"Url:/we1/x6Eg-8TSwUw.crl":{"type":"Url","value":"/we1/x6Eg-8TSwUw.crl"},"Url:/wr2/75r4ZyA3vA0.crl":{"type":"Url","value":"/wr2/75r4ZyA3vA0.crl"},"Url:/wr2/9UVbN0w5E6Y.crl":{"type":"Url","value":"/wr2/9UVbN0w5E6Y.crl"},"Url:/wr2/oBFYYahzgVI.crl":{"type":"Url","value":"/wr2/oBFYYahzgVI.crl"},"Url:/wr2/oQ6nyr8F0m0.crl":{"type":"Url","value":"/wr2/oQ6nyr8F0m0.crl"}},"chains":[{"id":"1544697397012787522","root":"File:7ef834fc890f8f801316f859915cba63a0771e89738a882bca0656fda5a74ddf","edges":[],"verdict":{"verdict":"suspicious","verdict_source":"ClamAV Antivirus","reasons":["File reported as packed by ClamAV antivirus"]}},{"id":"sandbox_network","root":"File:7ef834fc890f8f801316f859915cba63a0771e89738a882bca0656fda5a74ddf","edges":[{"edge_kind":"contacted_ip","from_key":"File:7ef834fc890f8f801316f859915cba63a0771e89738a882bca0656fda5a74ddf","to_key":"Ip:142.251.163.84"},{"edge_kind":"contacted_ip","from_key":"File:7ef834fc890f8f801316f859915cba63a0771e89738a882bca0656fda5a74ddf","to_key":"Ip:142.251.219.3"},{"edge_kind":"contacted_ip","from_key":"File:7ef834fc890f8f801316f859915cba63a0771e89738a882bca0656fda5a74ddf","to_key":"Ip:142.251.219.131"},{"edge_kind":"contacted_ip","from_key":"File:7ef834fc890f8f801316f859915cba63a0771e89738a882bca0656fda5a74ddf","to_key":"Ip:57.144.220.1"},{"edge_kind":"contacted_ip","from_key":"File:7ef834fc890f8f801316f859915cba63a0771e89738a882bca0656fda5a74ddf","to_key":"Ip:142.251.219.46"},{"edge_kind":"contacted_ip","from_key":"File:7ef834fc890f8f801316f859915cba63a0771e89738a882bca0656fda5a74ddf","to_key":"Ip:155.102.176.87"},{"edge_kind":"contacted_ip","from_key":"File:7ef834fc890f8f801316f859915cba63a0771e89738a882bca0656fda5a74ddf","to_key":"Ip:142.251.150.119"},{"edge_kind":"contacted_ip","from_key":"File:7ef834fc890f8f801316f859915cba63a0771e89738a882bca0656fda5a74ddf","to_key":"Ip:157.240.254.7"},{"edge_kind":"contacted_ip","from_key":"File:7ef834fc890f8f801316f859915cba63a0771e89738a882bca0656fda5a74ddf","to_key":"Ip:23.37.18.120"},{"edge_kind":"contacted_ip","from_key":"File:7ef834fc890f8f801316f859915cba63a0771e89738a882bca0656fda5a74ddf","to_key":"Ip:172.66.0.227"},{"edge_kind":"contacted_ip","from_key":"File:7ef834fc890f8f801316f859915cba63a0771e89738a882bca0656fda5a74ddf","to_key":"Ip:104.18.21.94"},{"edge_kind":"contacted_ip","from_key":"File:7ef834fc890f8f801316f859915cba63a0771e89738a882bca0656fda5a74ddf","to_key":"Ip:104.19.229.21"},{"edge_kind":"contacted_ip","from_key":"File:7ef834fc890f8f801316f859915cba63a0771e89738a882bca0656fda5a74ddf","to_key":"Ip:104.18.21.177"},{"edge_kind":"contacted_ip","from_key":"File:7ef834fc890f8f801316f859915cba63a0771e89738a882bca0656fda5a74ddf","to_key":"Ip:18.215.204.171"},{"edge_kind":"contacted_ip","from_key":"File:7ef834fc890f8f801316f859915cba63a0771e89738a882bca0656fda5a74ddf","to_key":"Ip:18.238.80.36"},{"edge_kind":"contacted_ip","from_key":"File:7ef834fc890f8f801316f859915cba63a0771e89738a882bca0656fda5a74ddf","to_key":"Ip:151.101.193.21"},{"edge_kind":"contacted_ip","from_key":"File:7ef834fc890f8f801316f859915cba63a0771e89738a882bca0656fda5a74ddf","to_key":"Ip:18.164.123.208"},{"edge_kind":"contacted_ip","from_key":"File:7ef834fc890f8f801316f859915cba63a0771e89738a882bca0656fda5a74ddf","to_key":"Ip:142.251.150.4"},{"edge_kind":"contacted_ip","from_key":"File:7ef834fc890f8f801316f859915cba63a0771e89738a882bca0656fda5a74ddf","to_key":"Ip:52.84.24.24"},{"edge_kind":"contacted_ip","from_key":"File:7ef834fc890f8f801316f859915cba63a0771e89738a882bca0656fda5a74ddf","to_key":"Ip:142.251.218.202"},{"edge_kind":"contacted_ip","from_key":"File:7ef834fc890f8f801316f859915cba63a0771e89738a882bca0656fda5a74ddf","to_key":"Ip:142.251.218.131"},{"edge_kind":"contacted_ip","from_key":"File:7ef834fc890f8f801316f859915cba63a0771e89738a882bca0656fda5a74ddf","to_key":"Ip:5.42.92.51"},{"edge_kind":"contacted_ip","from_key":"File:7ef834fc890f8f801316f859915cba63a0771e89738a882bca0656fda5a74ddf","to_key":"Ip:150.171.109.115"},{"edge_kind":"contacted_ip","from_key":"File:7ef834fc890f8f801316f859915cba63a0771e89738a882bca0656fda5a74ddf","to_key":"Ip:150.171.110.193"},{"edge_kind":"contacted_domain","from_key":"File:7ef834fc890f8f801316f859915cba63a0771e89738a882bca0656fda5a74ddf","to_key":"Domain:accounts.google.com"},{"edge_kind":"resolves_to","from_key":"Domain:accounts.google.com","to_key":"Ip:142.251.163.84"},{"edge_kind":"contacted_domain","from_key":"File:7ef834fc890f8f801316f859915cba63a0771e89738a882bca0656fda5a74ddf","to_key":"Domain:accounts.youtube.com"},{"edge_kind":"resolves_to","from_key":"Domain:accounts.youtube.com","to_key":"Ip:142.251.219.46"},{"edge_kind":"contacted_domain","from_key":"File:7ef834fc890f8f801316f859915cba63a0771e89738a882bca0656fda5a74ddf","to_key":"Domain:c.pki.goog"},{"edge_kind":"resolves_to","from_key":"Domain:c.pki.goog","to_key":"Ip:142.251.219.3"},{"edge_kind":"contacted_domain","from_key":"File:7ef834fc890f8f801316f859915cba63a0771e89738a882bca0656fda5a74ddf","to_key":"Domain:crt.rootg2.amazontrust.com"},{"edge_kind":"resolves_to","from_key":"Domain:crt.rootg2.amazontrust.com","to_key":"Ip:18.238.80.36"},{"edge_kind":"contacted_domain","from_key":"File:7ef834fc890f8f801316f859915cba63a0771e89738a882bca0656fda5a74ddf","to_key":"Domain:fonts.googleapis.com"},{"edge_kind":"resolves_to","from_key":"Domain:fonts.googleapis.com","to_key":"Ip:142.251.218.202"},{"edge_kind":"contacted_domain","from_key":"File:7ef834fc890f8f801316f859915cba63a0771e89738a882bca0656fda5a74ddf","to_key":"Domain:fonts.gstatic.com"},{"edge_kind":"resolves_to","from_key":"Domain:fonts.gstatic.com","to_key":"Ip:142.251.218.131"},{"edge_kind":"contacted_domain","from_key":"File:7ef834fc890f8f801316f859915cba63a0771e89738a882bca0656fda5a74ddf","to_key":"Domain:js.hcaptcha.com"},{"edge_kind":"resolves_to","from_key":"Domain:js.hcaptcha.com","to_key":"Ip:104.19.229.21"},{"edge_kind":"contacted_domain","from_key":"File:7ef834fc890f8f801316f859915cba63a0771e89738a882bca0656fda5a74ddf","to_key":"Domain:moskhoods.pw"},{"edge_kind":"contacted_domain","from_key":"File:7ef834fc890f8f801316f859915cba63a0771e89738a882bca0656fda5a74ddf","to_key":"Domain:numpersb.fun"},{"edge_kind":"contacted_domain","from_key":"File:7ef834fc890f8f801316f859915cba63a0771e89738a882bca0656fda5a74ddf","to_key":"Domain:o.ss2.us"},{"edge_kind":"contacted_domain","from_key":"File:7ef834fc890f8f801316f859915cba63a0771e89738a882bca0656fda5a74ddf","to_key":"Domain:ocsp.digicert.cn"},{"edge_kind":"resolves_to","from_key":"Domain:ocsp.digicert.cn","to_key":"Ip:155.102.176.87"},{"edge_kind":"contacted_domain","from_key":"File:7ef834fc890f8f801316f859915cba63a0771e89738a882bca0656fda5a74ddf","to_key":"Domain:ocsp.pki.goog"},{"edge_kind":"resolves_to","from_key":"Domain:ocsp.pki.goog","to_key":"Ip:142.251.219.3"},{"edge_kind":"contacted_domain","from_key":"File:7ef834fc890f8f801316f859915cba63a0771e89738a882bca0656fda5a74ddf","to_key":"Domain:ocsp.r2m04.amazontrust.com"},{"edge_kind":"resolves_to","from_key":"Domain:ocsp.r2m04.amazontrust.com","to_key":"Ip:52.84.24.24"},{"edge_kind":"contacted_domain","from_key":"File:7ef834fc890f8f801316f859915cba63a0771e89738a882bca0656fda5a74ddf","to_key":"Domain:ocsp.rootca1.amazontrust.com"},{"edge_kind":"resolves_to","from_key":"Domain:ocsp.rootca1.amazontrust.com","to_key":"Ip:18.164.123.208"},{"edge_kind":"contacted_domain","from_key":"File:7ef834fc890f8f801316f859915cba63a0771e89738a882bca0656fda5a74ddf","to_key":"Domain:ocsp.rootg2.amazontrust.com"},{"edge_kind":"resolves_to","from_key":"Domain:ocsp.rootg2.amazontrust.com","to_key":"Ip:18.164.123.208"},{"edge_kind":"contacted_domain","from_key":"File:7ef834fc890f8f801316f859915cba63a0771e89738a882bca0656fda5a74ddf","to_key":"Domain:s.ss2.us"},{"edge_kind":"contacted_domain","from_key":"File:7ef834fc890f8f801316f859915cba63a0771e89738a882bca0656fda5a74ddf","to_key":"Domain:ssl.gstatic.com"},{"edge_kind":"resolves_to","from_key":"Domain:ssl.gstatic.com","to_key":"Ip:142.251.219.131"},{"edge_kind":"contacted_domain","from_key":"File:7ef834fc890f8f801316f859915cba63a0771e89738a882bca0656fda5a74ddf","to_key":"Domain:static-assets-prod.unrealengine.com"},{"edge_kind":"resolves_to","from_key":"Domain:static-assets-prod.unrealengine.com","to_key":"Ip:104.18.21.177"},{"edge_kind":"contacted_domain","from_key":"File:7ef834fc890f8f801316f859915cba63a0771e89738a882bca0656fda5a74ddf","to_key":"Domain:static.xx.fbcdn.net"},{"edge_kind":"resolves_to","from_key":"Domain:static.xx.fbcdn.net","to_key":"Ip:157.240.254.7"},{"edge_kind":"contacted_domain","from_key":"File:7ef834fc890f8f801316f859915cba63a0771e89738a882bca0656fda5a74ddf","to_key":"Domain:store.steampowered.com"},{"edge_kind":"resolves_to","from_key":"Domain:store.steampowered.com","to_key":"Ip:23.37.18.120"},{"edge_kind":"contacted_domain","from_key":"File:7ef834fc890f8f801316f859915cba63a0771e89738a882bca0656fda5a74ddf","to_key":"Domain:tracking.epicgames.com"},{"edge_kind":"resolves_to","from_key":"Domain:tracking.epicgames.com","to_key":"Ip:18.215.204.171"},{"edge_kind":"contacted_domain","from_key":"File:7ef834fc890f8f801316f859915cba63a0771e89738a882bca0656fda5a74ddf","to_key":"Domain:twitter.com"},{"edge_kind":"resolves_to","from_key":"Domain:twitter.com","to_key":"Ip:172.66.0.227"},{"edge_kind":"contacted_domain","from_key":"File:7ef834fc890f8f801316f859915cba63a0771e89738a882bca0656fda5a74ddf","to_key":"Domain:www.epicgames.com"},{"edge_kind":"resolves_to","from_key":"Domain:www.epicgames.com","to_key":"Ip:104.18.21.94"},{"edge_kind":"contacted_domain","from_key":"File:7ef834fc890f8f801316f859915cba63a0771e89738a882bca0656fda5a74ddf","to_key":"Domain:www.facebook.com"},{"edge_kind":"resolves_to","from_key":"Domain:www.facebook.com","to_key":"Ip:57.144.220.1"},{"edge_kind":"contacted_domain","from_key":"File:7ef834fc890f8f801316f859915cba63a0771e89738a882bca0656fda5a74ddf","to_key":"Domain:www.google.com"},{"edge_kind":"resolves_to","from_key":"Domain:www.google.com","to_key":"Ip:142.251.150.119"},{"edge_kind":"contacted_domain","from_key":"File:7ef834fc890f8f801316f859915cba63a0771e89738a882bca0656fda5a74ddf","to_key":"Domain:www.noticeofpleadings.net"},{"edge_kind":"resolves_to","from_key":"Domain:www.noticeofpleadings.net","to_key":"Ip:150.171.110.193"},{"edge_kind":"contacted_domain","from_key":"File:7ef834fc890f8f801316f859915cba63a0771e89738a882bca0656fda5a74ddf","to_key":"Domain:www.paypal.com"},{"edge_kind":"resolves_to","from_key":"Domain:www.paypal.com","to_key":"Ip:151.101.193.21"},{"edge_kind":"contacted_domain","from_key":"File:7ef834fc890f8f801316f859915cba63a0771e89738a882bca0656fda5a74ddf","to_key":"Domain:www.youtube.com"},{"edge_kind":"resolves_to","from_key":"Domain:www.youtube.com","to_key":"Ip:142.251.150.4"},{"edge_kind":"contacted_url","from_key":"File:7ef834fc890f8f801316f859915cba63a0771e89738a882bca0656fda5a74ddf","to_key":"Url:/gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D"},{"edge_kind":"contacted_url","from_key":"File:7ef834fc890f8f801316f859915cba63a0771e89738a882bca0656fda5a74ddf","to_key":"Url:/r/r1.crl"},{"edge_kind":"contacted_url","from_key":"File:7ef834fc890f8f801316f859915cba63a0771e89738a882bca0656fda5a74ddf","to_key":"Url:/wr2/oBFYYahzgVI.crl"},{"edge_kind":"contacted_url","from_key":"File:7ef834fc890f8f801316f859915cba63a0771e89738a882bca0656fda5a74ddf","to_key":"Url:/wr2/75r4ZyA3vA0.crl"},{"edge_kind":"contacted_url","from_key":"File:7ef834fc890f8f801316f859915cba63a0771e89738a882bca0656fda5a74ddf","to_key":"Url:/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEA59dSNcqDdhV39MzSTNbR0%3D"},{"edge_kind":"contacted_url","from_key":"File:7ef834fc890f8f801316f859915cba63a0771e89738a882bca0656fda5a74ddf","to_key":"Url:/wr2/9UVbN0w5E6Y.crl"},{"edge_kind":"contacted_url","from_key":"File:7ef834fc890f8f801316f859915cba63a0771e89738a882bca0656fda5a74ddf","to_key":"Url:/r/gsr1.crl"},{"edge_kind":"contacted_url","from_key":"File:7ef834fc890f8f801316f859915cba63a0771e89738a882bca0656fda5a74ddf","to_key":"Url:/r/r4.crl"},{"edge_kind":"contacted_url","from_key":"File:7ef834fc890f8f801316f859915cba63a0771e89738a882bca0656fda5a74ddf","to_key":"Url:/we1/pl4XiTjSDSk.crl"},{"edge_kind":"contacted_url","from_key":"File:7ef834fc890f8f801316f859915cba63a0771e89738a882bca0656fda5a74ddf","to_key":"Url:/we1/G0k-BqpOX8k.crl"},{"edge_kind":"contacted_url","from_key":"File:7ef834fc890f8f801316f859915cba63a0771e89738a882bca0656fda5a74ddf","to_key":"Url:/we1/x6Eg-8TSwUw.crl"},{"edge_kind":"contacted_url","from_key":"File:7ef834fc890f8f801316f859915cba63a0771e89738a882bca0656fda5a74ddf","to_key":"Url:/rootg2.cer"},{"edge_kind":"contacted_url","from_key":"File:7ef834fc890f8f801316f859915cba63a0771e89738a882bca0656fda5a74ddf","to_key":"Url:/MFQwUjBQME4wTDAJBgUrDgMCGgUABBSIfaREXmfqfJR3TkMYnD7O5MhzEgQUnF8A36oB1zArOIiiuG1KnPIRkYMCEwZ%2FlEoqJ83z%2BsKuKwH5CO65xMY%3D"},{"edge_kind":"contacted_url","from_key":"File:7ef834fc890f8f801316f859915cba63a0771e89738a882bca0656fda5a74ddf","to_key":"Url:/MFQwUjBQME4wTDAJBgUrDgMCGgUABBRPWaOUU8%2B5VZ5%2Fa9jFTaU9pkK3FAQUhBjMhTTsvAyUlC4IWZzHshBOCggCEwdzEk8qlS4%2B0YpYvbhdG8DOXyc%3D"},{"edge_kind":"contacted_url","from_key":"File:7ef834fc890f8f801316f859915cba63a0771e89738a882bca0656fda5a74ddf","to_key":"Url:/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTihuFvpmFDw5hOcIp918Jm5B3CQgQUH1KSYVaCVH%2BBZtgdPQqqMlyH3QgCEA3N2p7AWhpIo7uTRZjDirs%3D"},{"edge_kind":"contacted_url","from_key":"File:7ef834fc890f8f801316f859915cba63a0771e89738a882bca0656fda5a74ddf","to_key":"Url:/wr2/oQ6nyr8F0m0.crl"}],"verdict":{"verdict":"unknown","verdict_source":"sandbox"}},{"id":"sandbox_files","root":"File:7ef834fc890f8f801316f859915cba63a0771e89738a882bca0656fda5a74ddf","edges":[{"edge_kind":"extracted","from_key":"File:7ef834fc890f8f801316f859915cba63a0771e89738a882bca0656fda5a74ddf","to_key":"File:9f5538ee297a404978922c8c4bb2afa0dd904b6aef8458089acfd09bd613ac24"},{"edge_kind":"extracted","from_key":"File:7ef834fc890f8f801316f859915cba63a0771e89738a882bca0656fda5a74ddf","to_key":"File:6007d88865cda81bb228728401f7e70c65feb6a6f88445153b7ab27776935c4b"},{"edge_kind":"extracted","from_key":"File:7ef834fc890f8f801316f859915cba63a0771e89738a882bca0656fda5a74ddf","to_key":"File:f8f5e88cdb1ab0d79c6960c5c705fff40e24581f39b4566e5ba83660fd49518e"},{"edge_kind":"extracted","from_key":"File:7ef834fc890f8f801316f859915cba63a0771e89738a882bca0656fda5a74ddf","to_key":"File:740e6d2fe75757edfe73ebd1a38afccb8a24de434994bc16c4a6ac854081acce"},{"edge_kind":"extracted","from_key":"File:7ef834fc890f8f801316f859915cba63a0771e89738a882bca0656fda5a74ddf","to_key":"File:bc78bfa4cd442d895d0d86c191235e03d637f55f33805a4a43fd3a4c3205013d"},{"edge_kind":"extracted","from_key":"File:7ef834fc890f8f801316f859915cba63a0771e89738a882bca0656fda5a74ddf","to_key":"File:3e191adab4ea25b8d83ea6f80029b25af43fb234c5689f6fd01db91926e60822"},{"edge_kind":"extracted","from_key":"File:7ef834fc890f8f801316f859915cba63a0771e89738a882bca0656fda5a74ddf","to_key":"File:7b492c0d9bebad18af6fee6ec2728ab9c1b4f798d60c170755a6dc8fb00b5fd2"},{"edge_kind":"extracted","from_key":"File:7ef834fc890f8f801316f859915cba63a0771e89738a882bca0656fda5a74ddf","to_key":"File:3718eb3d101cbde59ca668da46cabfe683e31b0d7476ced66cd0ce71ab53aaa4"},{"edge_kind":"extracted","from_key":"File:7ef834fc890f8f801316f859915cba63a0771e89738a882bca0656fda5a74ddf","to_key":"File:901351bccd76270620730173d66b61268e4664b085faae5bd9c862b31b1a4ec9"},{"edge_kind":"extracted","from_key":"File:7ef834fc890f8f801316f859915cba63a0771e89738a882bca0656fda5a74ddf","to_key":"File:6cd14790ceeb7ff4003bf270d61dcc7715050a7822b51516b66865eafe5a3d8d"},{"edge_kind":"extracted","from_key":"File:7ef834fc890f8f801316f859915cba63a0771e89738a882bca0656fda5a74ddf","to_key":"File:5aeb1c97dd5d490dc7539c58e09b9a0934363b81793f29b539bf5612d9652d24"},{"edge_kind":"extracted","from_key":"File:7ef834fc890f8f801316f859915cba63a0771e89738a882bca0656fda5a74ddf","to_key":"File:521b9ca61b59188d42990a32c6bf26fd69ff9de319601ccb1475bcf5085c04a3"},{"edge_kind":"extracted","from_key":"File:7ef834fc890f8f801316f859915cba63a0771e89738a882bca0656fda5a74ddf","to_key":"File:256877e6dd00e1010e8a9d6d90716166218a975cac04997248719c5cc14c2a13"},{"edge_kind":"extracted","from_key":"File:7ef834fc890f8f801316f859915cba63a0771e89738a882bca0656fda5a74ddf","to_key":"File:1a9251dc3b3c064cfc5e2b90b6c7dc3c225f7017066db2b77e49dae90a94a399"},{"edge_kind":"extracted","from_key":"File:7ef834fc890f8f801316f859915cba63a0771e89738a882bca0656fda5a74ddf","to_key":"File:ca80aca453d15a5159e13484f9f24cbf4a876c07d2b0ff3d4c7209a40535dda6"},{"edge_kind":"extracted","from_key":"File:7ef834fc890f8f801316f859915cba63a0771e89738a882bca0656fda5a74ddf","to_key":"File:53860c17a76878ba2b911a12c34a19ab191e3981b35ce1f1c480832f97d73639"},{"edge_kind":"extracted","from_key":"File:7ef834fc890f8f801316f859915cba63a0771e89738a882bca0656fda5a74ddf","to_key":"File:420c01c9c3e381aaf2b28cc2f9ff0bdd3ac09a83a936dec1713894fda9797f40"},{"edge_kind":"extracted","from_key":"File:7ef834fc890f8f801316f859915cba63a0771e89738a882bca0656fda5a74ddf","to_key":"File:0e5fe0deb5b4892b17117537ef8c222833be21fde9b172fb1ed1542e8ef47f23"}],"verdict":{"verdict":"unknown","verdict_source":"sandbox"}}]}},"activity":{"stats":{"process_count":18,"spawned_processes_count":18,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":22,"imported_dlls_count":197,"dropped_files_count":0,"extracted_files_count":18,"files_written_count":9,"files_deleted_count":0,"registry_keys_created_count":1,"registry_keys_modified_count":0,"registry_keys_deleted_count":3,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":4,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":24,"dns_resolutions_count":28,"contacted_urls_count":16,"http_requests_count":16},"behavior_tags":["credentialharvesting","commodity","lummastealer","criminal","informationstealer","suspicious"],"sample_flags":["Multi-Process","Network Traffic","Extracted Files","Decrypted SSL traffic"],"sandbox_reports":[{"id":"6a98218b599feef6ff013813","environment_id":100,"environment_description":"Windows 7 32 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"Gen:Heur.Crifi","contacted_countries":["RUS","USA"],"submit_name":"7ef834fc890f8f801316f859915cba63a0771e89738a882bca0656fda5a74ddf","analysis_start_time":"2026-09-02T13:15:56+00:00","indicators_count":{"informative":273,"suspicious":63,"malicious":11},"tags":["Multi-Process","Network Traffic","Extracted Files","Decrypted SSL traffic"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":[{"address":"142.251.163.84","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"6a98218b599feef6ff013813"}]},{"address":"142.251.219.3","port":80,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"6a98218b599feef6ff013813"}]},{"address":"142.251.219.131","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"6a98218b599feef6ff013813"}]},{"address":"57.144.220.1","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"6a98218b599feef6ff013813"}]},{"address":"142.251.219.46","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"6a98218b599feef6ff013813"}]},{"address":"155.102.176.87","port":80,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"6a98218b599feef6ff013813"}]},{"address":"142.251.150.119","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"6a98218b599feef6ff013813"}]},{"address":"157.240.254.7","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"6a98218b599feef6ff013813"}]},{"address":"23.37.18.120","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"6a98218b599feef6ff013813"}]},{"address":"172.66.0.227","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"6a98218b599feef6ff013813"}]},{"address":"104.18.21.94","port":443,"protocol":"TCP","sources":[{"report_type":"sandbox","report_id":"6a98218b599feef6ff013813"}]},{"address":"104.19.229.21","port":443,"protocol":"TCP","sources":[{"report_type":"sandbox","report_id":"6a98218b599feef6ff013813"}]},{"address":"104.18.21.177","port":443,"protocol":"TCP","sources":[{"report_type":"sandbox","report_id":"6a98218b599feef6ff013813"}]},{"address":"18.215.204.171","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"6a98218b599feef6ff013813"}]},{"address":"18.238.80.36","port":80,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"6a98218b599feef6ff013813"}]},{"address":"151.101.193.21","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"6a98218b599feef6ff013813"}]},{"address":"18.164.123.208","port":80,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"6a98218b599feef6ff013813"}]},{"address":"142.251.150.4","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"6a98218b599feef6ff013813"}]},{"address":"52.84.24.24","port":80,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"6a98218b599feef6ff013813"}]},{"address":"142.251.218.202","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"6a98218b599feef6ff013813"}]},{"address":"142.251.218.131","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"6a98218b599feef6ff013813"}]},{"address":"5.42.92.51","port":19057,"protocol":"TCP","country":"Russia","sources":[{"report_type":"sandbox","report_id":"6a98218b599feef6ff013813"}]},{"address":"150.171.109.115","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"6a98218b599feef6ff013813"}]},{"address":"150.171.110.193","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"6a98218b599feef6ff013813"}]}],"dns_resolutions":[{"domain":"accounts.google.com","address":"142.251.163.84","ttl":291,"country":"United States","sources":[{"report_type":"sandbox","report_id":"6a98218b599feef6ff013813"}]},{"domain":"accounts.youtube.com","address":"142.251.219.46","ttl":300,"country":"United States","sources":[{"report_type":"sandbox","report_id":"6a98218b599feef6ff013813"}]},{"domain":"c.pki.goog","address":"142.251.219.3","ttl":82,"country":"United States","sources":[{"report_type":"sandbox","report_id":"6a98218b599feef6ff013813"}]},{"domain":"crt.rootg2.amazontrust.com","address":"18.238.80.36","ttl":60,"country":"United States","sources":[{"report_type":"sandbox","report_id":"6a98218b599feef6ff013813"}]},{"domain":"fonts.googleapis.com","address":"142.251.218.202","ttl":76,"country":"United States","sources":[{"report_type":"sandbox","report_id":"6a98218b599feef6ff013813"}]},{"domain":"fonts.gstatic.com","address":"142.251.218.131","ttl":1,"country":"United States","sources":[{"report_type":"sandbox","report_id":"6a98218b599feef6ff013813"}]},{"domain":"js.hcaptcha.com","address":"104.19.229.21","ttl":300,"country":"-","sources":[{"report_type":"sandbox","report_id":"6a98218b599feef6ff013813"}]},{"domain":"moskhoods.pw","ttl":300,"country":"-","sources":[{"report_type":"sandbox","report_id":"6a98218b599feef6ff013813"}]},{"domain":"numpersb.fun","ttl":300,"country":"-","sources":[{"report_type":"sandbox","report_id":"6a98218b599feef6ff013813"}]},{"domain":"o.ss2.us","ttl":380,"country":"-","sources":[{"report_type":"sandbox","report_id":"6a98218b599feef6ff013813"}]},{"domain":"ocsp.digicert.cn","address":"155.102.176.87","ttl":104,"country":"United States","sources":[{"report_type":"sandbox","report_id":"6a98218b599feef6ff013813"}]},{"domain":"ocsp.pki.goog","address":"142.251.219.3","ttl":200,"country":"United States","sources":[{"report_type":"sandbox","report_id":"6a98218b599feef6ff013813"}]},{"domain":"ocsp.r2m04.amazontrust.com","address":"52.84.24.24","ttl":60,"country":"United States","sources":[{"report_type":"sandbox","report_id":"6a98218b599feef6ff013813"}]},{"domain":"ocsp.rootca1.amazontrust.com","address":"18.164.123.208","ttl":60,"country":"United States","sources":[{"report_type":"sandbox","report_id":"6a98218b599feef6ff013813"}]},{"domain":"ocsp.rootg2.amazontrust.com","address":"18.164.123.208","ttl":60,"country":"United States","sources":[{"report_type":"sandbox","report_id":"6a98218b599feef6ff013813"}]},{"domain":"s.ss2.us","ttl":595,"country":"-","sources":[{"report_type":"sandbox","report_id":"6a98218b599feef6ff013813"}]},{"domain":"ssl.gstatic.com","address":"142.251.219.131","ttl":95,"country":"United States","sources":[{"report_type":"sandbox","report_id":"6a98218b599feef6ff013813"}]},{"domain":"static-assets-prod.unrealengine.com","address":"104.18.21.177","ttl":300,"country":"-","sources":[{"report_type":"sandbox","report_id":"6a98218b599feef6ff013813"}]},{"domain":"static.xx.fbcdn.net","address":"157.240.254.7","ttl":3600,"country":"United States","sources":[{"report_type":"sandbox","report_id":"6a98218b599feef6ff013813"}]},{"domain":"store.steampowered.com","address":"23.37.18.120","ttl":20,"country":"United States","sources":[{"report_type":"sandbox","report_id":"6a98218b599feef6ff013813"}]},{"domain":"tracking.epicgames.com","address":"18.215.204.171","ttl":3487,"country":"United States","sources":[{"report_type":"sandbox","report_id":"6a98218b599feef6ff013813"}]},{"domain":"twitter.com","address":"172.66.0.227","ttl":3,"country":"United States","sources":[{"report_type":"sandbox","report_id":"6a98218b599feef6ff013813"}]},{"domain":"www.epicgames.com","address":"104.18.21.94","ttl":3600,"country":"-","sources":[{"report_type":"sandbox","report_id":"6a98218b599feef6ff013813"}]},{"domain":"www.facebook.com","address":"57.144.220.1","ttl":3558,"country":"United States","sources":[{"report_type":"sandbox","report_id":"6a98218b599feef6ff013813"}]},{"domain":"www.google.com","address":"142.251.150.119","ttl":232,"country":"United States","sources":[{"report_type":"sandbox","report_id":"6a98218b599feef6ff013813"}]},{"domain":"www.noticeofpleadings.net","address":"150.171.110.193","ttl":2918,"country":"United States","sources":[{"report_type":"sandbox","report_id":"6a98218b599feef6ff013813"}]},{"domain":"www.paypal.com","address":"151.101.193.21","ttl":706,"country":"United States","sources":[{"report_type":"sandbox","report_id":"6a98218b599feef6ff013813"}]},{"domain":"www.youtube.com","address":"142.251.150.4","ttl":300,"country":"United States","sources":[{"report_type":"sandbox","report_id":"6a98218b599feef6ff013813"}]}],"http_requests":[{"host":"ocsp.pki.goog","host_ip":"142.251.219.3:80","url":"/gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D HTTP/1.1\nConnection: Keep-Alive\nAccept: */*\nUser-Agent: Microsoft-CryptoAPI/6.1\nHost: ocsp.pki.goog","sources":[{"report_type":"sandbox","report_id":"6a98218b599feef6ff013813"}]},{"host":"c.pki.goog","host_ip":"142.251.219.3:80","url":"/r/r1.crl","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /r/r1.crl HTTP/1.1\nConnection: Keep-Alive\nAccept: */*\nUser-Agent: Microsoft-CryptoAPI/6.1\nHost: c.pki.goog","sources":[{"report_type":"sandbox","report_id":"6a98218b599feef6ff013813"}]},{"host":"c.pki.goog","host_ip":"142.251.219.3:80","url":"/wr2/oBFYYahzgVI.crl","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /wr2/oBFYYahzgVI.crl HTTP/1.1\nConnection: Keep-Alive\nAccept: */*\nUser-Agent: Microsoft-CryptoAPI/6.1\nHost: c.pki.goog","sources":[{"report_type":"sandbox","report_id":"6a98218b599feef6ff013813"}]},{"host":"c.pki.goog","host_ip":"142.251.219.3:80","url":"/wr2/75r4ZyA3vA0.crl","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /wr2/75r4ZyA3vA0.crl HTTP/1.1\nConnection: Keep-Alive\nAccept: */*\nUser-Agent: Microsoft-CryptoAPI/6.1\nHost: c.pki.goog","sources":[{"report_type":"sandbox","report_id":"6a98218b599feef6ff013813"}]},{"host":"ocsp.digicert.cn","host_ip":"155.102.176.87:80","url":"/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEA59dSNcqDdhV39MzSTNbR0%3D","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEA59dSNcqDdhV39MzSTNbR0%3D HTTP/1.1\nConnection: Keep-Alive\nAccept: */*\nUser-Agent: Microsoft-CryptoAPI/6.1\nHost: ocsp.digicert.cn","sources":[{"report_type":"sandbox","report_id":"6a98218b599feef6ff013813"}]},{"host":"c.pki.goog","host_ip":"142.251.219.3:80","url":"/wr2/9UVbN0w5E6Y.crl","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /wr2/9UVbN0w5E6Y.crl HTTP/1.1\nConnection: Keep-Alive\nAccept: */*\nUser-Agent: Microsoft-CryptoAPI/6.1\nHost: c.pki.goog","sources":[{"report_type":"sandbox","report_id":"6a98218b599feef6ff013813"}]},{"host":"c.pki.goog","host_ip":"142.251.219.3:80","url":"/r/gsr1.crl","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /r/gsr1.crl HTTP/1.1\nConnection: Keep-Alive\nAccept: */*\nUser-Agent: Microsoft-CryptoAPI/6.1\nHost: c.pki.goog","sources":[{"report_type":"sandbox","report_id":"6a98218b599feef6ff013813"}]},{"host":"c.pki.goog","host_ip":"142.251.219.3:80","url":"/r/r4.crl","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /r/r4.crl HTTP/1.1\nConnection: Keep-Alive\nAccept: */*\nUser-Agent: Microsoft-CryptoAPI/6.1\nHost: c.pki.goog","sources":[{"report_type":"sandbox","report_id":"6a98218b599feef6ff013813"}]},{"host":"c.pki.goog","host_ip":"142.251.219.3:80","url":"/we1/pl4XiTjSDSk.crl","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /we1/pl4XiTjSDSk.crl HTTP/1.1\nConnection: Keep-Alive\nAccept: */*\nUser-Agent: Microsoft-CryptoAPI/6.1\nHost: c.pki.goog","sources":[{"report_type":"sandbox","report_id":"6a98218b599feef6ff013813"}]},{"host":"c.pki.goog","host_ip":"142.251.219.3:80","url":"/we1/G0k-BqpOX8k.crl","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /we1/G0k-BqpOX8k.crl HTTP/1.1\nConnection: Keep-Alive\nAccept: */*\nUser-Agent: Microsoft-CryptoAPI/6.1\nHost: c.pki.goog","sources":[{"report_type":"sandbox","report_id":"6a98218b599feef6ff013813"}]},{"host":"c.pki.goog","host_ip":"142.251.219.3:80","url":"/we1/x6Eg-8TSwUw.crl","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /we1/x6Eg-8TSwUw.crl HTTP/1.1\nConnection: Keep-Alive\nAccept: */*\nUser-Agent: Microsoft-CryptoAPI/6.1\nHost: c.pki.goog","sources":[{"report_type":"sandbox","report_id":"6a98218b599feef6ff013813"}]},{"host":"crt.rootg2.amazontrust.com","host_ip":"18.238.80.36:80","url":"/rootg2.cer","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /rootg2.cer HTTP/1.1\nConnection: Keep-Alive\nAccept: */*\nUser-Agent: Microsoft-CryptoAPI/6.1\nHost: crt.rootg2.amazontrust.com","sources":[{"report_type":"sandbox","report_id":"6a98218b599feef6ff013813"}]},{"host":"ocsp.rootg2.amazontrust.com","host_ip":"18.164.123.208:80","url":"/MFQwUjBQME4wTDAJBgUrDgMCGgUABBSIfaREXmfqfJR3TkMYnD7O5MhzEgQUnF8A36oB1zArOIiiuG1KnPIRkYMCEwZ%2FlEoqJ83z%2BsKuKwH5CO65xMY%3D","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /MFQwUjBQME4wTDAJBgUrDgMCGgUABBSIfaREXmfqfJR3TkMYnD7O5MhzEgQUnF8A36oB1zArOIiiuG1KnPIRkYMCEwZ%2FlEoqJ83z%2BsKuKwH5CO65xMY%3D HTTP/1.1\nConnection: Keep-Alive\nAccept: */*\nUser-Agent: Microsoft-CryptoAPI/6.1\nHost: ocsp.rootg2.amazontrust.com","sources":[{"report_type":"sandbox","report_id":"6a98218b599feef6ff013813"}]},{"host":"ocsp.rootca1.amazontrust.com","host_ip":"18.164.123.208:80","url":"/MFQwUjBQME4wTDAJBgUrDgMCGgUABBRPWaOUU8%2B5VZ5%2Fa9jFTaU9pkK3FAQUhBjMhTTsvAyUlC4IWZzHshBOCggCEwdzEk8qlS4%2B0YpYvbhdG8DOXyc%3D","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /MFQwUjBQME4wTDAJBgUrDgMCGgUABBRPWaOUU8%2B5VZ5%2Fa9jFTaU9pkK3FAQUhBjMhTTsvAyUlC4IWZzHshBOCggCEwdzEk8qlS4%2B0YpYvbhdG8DOXyc%3D HTTP/1.1\nConnection: Keep-Alive\nAccept: */*\nUser-Agent: Microsoft-CryptoAPI/6.1\nHost: ocsp.rootca1.amazontrust.com","sources":[{"report_type":"sandbox","report_id":"6a98218b599feef6ff013813"}]},{"host":"ocsp.r2m04.amazontrust.com","host_ip":"52.84.24.24:80","url":"/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTihuFvpmFDw5hOcIp918Jm5B3CQgQUH1KSYVaCVH%2BBZtgdPQqqMlyH3QgCEA3N2p7AWhpIo7uTRZjDirs%3D","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTihuFvpmFDw5hOcIp918Jm5B3CQgQUH1KSYVaCVH%2BBZtgdPQqqMlyH3QgCEA3N2p7AWhpIo7uTRZjDirs%3D HTTP/1.1\nConnection: Keep-Alive\nAccept: */*\nUser-Agent: Microsoft-CryptoAPI/6.1\nHost: ocsp.r2m04.amazontrust.com","sources":[{"report_type":"sandbox","report_id":"6a98218b599feef6ff013813"}]},{"host":"c.pki.goog","host_ip":"142.251.219.3:80","url":"/wr2/oQ6nyr8F0m0.crl","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /wr2/oQ6nyr8F0m0.crl HTTP/1.1\nConnection: Keep-Alive\nAccept: */*\nUser-Agent: Microsoft-CryptoAPI/6.1\nHost: c.pki.goog","sources":[{"report_type":"sandbox","report_id":"6a98218b599feef6ff013813"}]}]},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"6a98218b599feef6ff013813"}],"processes":[{"pid":5936,"ppid":0,"name":"7ef834fc890f8f801316f859915cba63a0771e89738a882bca0656fda5a74ddf.exe","command_line":"","sha256":"7ef834fc890f8f801316f859915cba63a0771e89738a882bca0656fda5a74ddf","normalized_path":"C:\\7ef834fc890f8f801316f859915cba63a0771e89738a882bca0656fda5a74ddf.exe","uid":"00000000-00005936","icon":"$69"},{"pid":5708,"ppid":5936,"name":"MP5ye33.exe","command_line":"","sha256":"6007d88865cda81bb228728401f7e70c65feb6a6f88445153b7ab27776935c4b","normalized_path":"%TEMP%\\IXP000.TMP\\MP5ye33.exe","parent_uid":"00000000-00005936","uid":"00000000-00005708"},{"pid":5684,"ppid":5708,"name":"aR7ev61.exe","command_line":"","sha256":"740e6d2fe75757edfe73ebd1a38afccb8a24de434994bc16c4a6ac854081acce","normalized_path":"%TEMP%\\IXP001.TMP\\aR7ev61.exe","parent_uid":"00000000-00005708","uid":"00000000-00005684"},{"pid":5948,"ppid":5684,"name":"3Kn814gI.exe","command_line":"","sha256":"bc78bfa4cd442d895d0d86c191235e03d637f55f33805a4a43fd3a4c3205013d","normalized_path":"%TEMP%\\IXP002.TMP\\3Kn814gI.exe","parent_uid":"00000000-00005684","uid":"00000000-00005948"},{"pid":5788,"ppid":5948,"name":"iexplore.exe","command_line":"https://accounts.google.com/","sha256":"8abc7daa81c8a20bfd88b6a60ecc9ed1292fbb6cedbd6f872f36512d9a194bba","normalized_path":"%PROGRAMFILES%\\Internet Explorer\\iexplore.exe","parent_uid":"00000000-00005948","uid":"00000000-00005788"},{"pid":5940,"ppid":5788,"name":"iexplore.exe","command_line":"SCODEF:5788 CREDAT:275457 /prefetch:2","sha256":"8abc7daa81c8a20bfd88b6a60ecc9ed1292fbb6cedbd6f872f36512d9a194bba","normalized_path":"%PROGRAMFILES%\\Internet Explorer\\iexplore.exe","parent_uid":"00000000-00005788","uid":"00000000-00005940"},{"pid":4292,"ppid":5788,"name":"iexplore.exe","command_line":"SCODEF:5788 CREDAT:275465 /prefetch:2","sha256":"8abc7daa81c8a20bfd88b6a60ecc9ed1292fbb6cedbd6f872f36512d9a194bba","normalized_path":"%PROGRAMFILES%\\Internet Explorer\\iexplore.exe","parent_uid":"00000000-00005788","uid":"00000000-00004292"},{"pid":4368,"ppid":5788,"name":"iexplore.exe","command_line":"SCODEF:5788 CREDAT:865288 /prefetch:2","sha256":"8abc7daa81c8a20bfd88b6a60ecc9ed1292fbb6cedbd6f872f36512d9a194bba","normalized_path":"%PROGRAMFILES%\\Internet Explorer\\iexplore.exe","parent_uid":"00000000-00005788","uid":"00000000-00004368"},{"pid":3448,"ppid":5788,"name":"iexplore.exe","command_line":"SCODEF:5788 CREDAT:406544 /prefetch:2","sha256":"8abc7daa81c8a20bfd88b6a60ecc9ed1292fbb6cedbd6f872f36512d9a194bba","normalized_path":"%PROGRAMFILES%\\Internet Explorer\\iexplore.exe","parent_uid":"00000000-00005788","uid":"00000000-00003448"},{"pid":3956,"ppid":5788,"name":"iexplore.exe","command_line":"SCODEF:5788 CREDAT:668712 /prefetch:2","sha256":"8abc7daa81c8a20bfd88b6a60ecc9ed1292fbb6cedbd6f872f36512d9a194bba","normalized_path":"%PROGRAMFILES%\\Internet Explorer\\iexplore.exe","parent_uid":"00000000-00005788","uid":"00000000-00003956"},{"pid":4116,"ppid":5788,"name":"iexplore.exe","command_line":"SCODEF:5788 CREDAT:2044957 /prefetch:2","sha256":"8abc7daa81c8a20bfd88b6a60ecc9ed1292fbb6cedbd6f872f36512d9a194bba","normalized_path":"%PROGRAMFILES%\\Internet Explorer\\iexplore.exe","parent_uid":"00000000-00005788","uid":"00000000-00004116"},{"pid":3836,"ppid":5788,"name":"iexplore.exe","command_line":"SCODEF:5788 CREDAT:603207 /prefetch:2","sha256":"8abc7daa81c8a20bfd88b6a60ecc9ed1292fbb6cedbd6f872f36512d9a194bba","normalized_path":"%PROGRAMFILES%\\Internet Explorer\\iexplore.exe","parent_uid":"00000000-00005788","uid":"00000000-00003836"},{"pid":1832,"ppid":5684,"name":"4NU6qK7.exe","command_line":"","sha256":"3e191adab4ea25b8d83ea6f80029b25af43fb234c5689f6fd01db91926e60822","normalized_path":"%TEMP%\\IXP002.TMP\\4NU6qK7.exe","parent_uid":"00000000-00005684","uid":"00000000-00001832"},{"pid":3720,"ppid":1832,"name":"AppLaunch.exe","command_line":"","sha256":"cfa7d98ad44c7fb11de5ff07da04f8fd4a3423564de05f87ba5e10bd13a1fe59","normalized_path":"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\AppLaunch.exe","parent_uid":"00000000-00001832","uid":"00000000-00003720"},{"pid":844,"ppid":5708,"name":"5ip71Yr.exe","command_line":"","sha256":"f8f5e88cdb1ab0d79c6960c5c705fff40e24581f39b4566e5ba83660fd49518e","normalized_path":"%TEMP%\\IXP001.TMP\\5ip71Yr.exe","parent_uid":"00000000-00005708","uid":"00000000-00000844"},{"pid":2372,"ppid":844,"name":"AppLaunch.exe","command_line":"","sha256":"cfa7d98ad44c7fb11de5ff07da04f8fd4a3423564de05f87ba5e10bd13a1fe59","normalized_path":"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\AppLaunch.exe","parent_uid":"00000000-00000844","uid":"00000000-00002372"},{"pid":4076,"ppid":5936,"name":"6pl671.exe","command_line":"","sha256":"9f5538ee297a404978922c8c4bb2afa0dd904b6aef8458089acfd09bd613ac24","normalized_path":"%TEMP%\\IXP000.TMP\\6pl671.exe","parent_uid":"00000000-00005936","uid":"00000000-00004076"},{"pid":3020,"ppid":4076,"name":"AppLaunch.exe","command_line":"","sha256":"cfa7d98ad44c7fb11de5ff07da04f8fd4a3423564de05f87ba5e10bd13a1fe59","normalized_path":"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\AppLaunch.exe","parent_uid":"00000000-00004076","uid":"00000000-00003020"}],"all_imported_dlls":["Wpc.dll","System.Runtime.Serialization.ni.dll","api-ms-win-crt-heap-l1-1-0.dll","api-ms-win-crt-string-l1-1-0.dll","schannel.dll","xmllite.dll","PresentationCore.ni.dll","PresentationNative_v0400.dll","IPHLPAPI.DLL","rasadhlp.dll","slc.dll","ssv.dll","api-ms-win-core-localization-l1-2-0.dll","user32.dll","nsi.dll","winnsi.dll","dxgi.dll","winmm.dll","sechost.dll","propsys.dll","netapi32.dll","ExplorerFrame.dll","ntmarta.dll","oleaut32.dll","mpr.dll","msvcp140.dll","api-ms-win-crt-convert-l1-1-0.dll","netprofm.dll","gpapi.dll","d3d11.dll","System.Transactions.dll","comdlg32.dll","wkscli.dll","UIAutomationCore.dll","System.Drawing.ni.dll","uxtheme.dll","gdi32.dll","sfc.dll","duser.dll","mscoree.dll","profapi.dll","Wldap32.dll","SensApi.dll","System.Configuration.ni.dll","AcGenral.dll","cfgmgr32.dll","api-ms-win-downlevel-advapi32-l2-1-0.dll","ieui.dll","dui70.dll","URLREDIR.DLL","WindowsBase.ni.dll","System.IdentityModel.ni.dll","shell32.dll","System.Windows.Forms.ni.dll","System.ServiceModel.Internals.dll","usp10.dll","api-ms-win-crt-utility-l1-1-0.dll","cscapi.dll","d3d10warp.dll","samcli.dll","lpk.dll","setupapi.dll","api-ms-win-crt-math-l1-1-0.dll","api-ms-win-core-xstate-l2-1-0.dll","imm32.dll","ucrtbase.dll","dhcpcsvc.dll","MSOHEV.DLL","IEShims.dll","dhcpcsvc6.dll","linkinfo.dll","deploy.dll","imagehlp.dll","urlmon.dll","iertutil.dll","api-ms-win-core-file-l1-2-0.dll","api-ms-win-crt-environment-l1-1-0.dll","VxSSL32.dll","samlib.dll","cryptnet.dll","sxs.dll","api-ms-win-downlevel-shell32-l1-1-0.dll","wship6.dll","nlaapi.dll","netutils.dll","SwDir_1231201.dll","vcruntime140_clr0400.dll","System.ni.dll","msacm32.dll","api-ms-win-downlevel-ole32-l1-1-0.dll","api-ms-win-core-synch-l1-2-0.dll","api-ms-win-crt-locale-l1-1-0.dll","credssp.dll","winhttp.dll","DWrite.dll","vm3dum.dll","api-ms-win-core-file-l2-1-0.dll","psapi.dll","mlang.dll","wshqos.dll","bcrypt.dll","webio.dll","ucrtbase_clr0400.dll","PresentationFramework.ni.dll","KernelBase.dll","rpcrt4.dll","api-ms-win-crt-runtime-l1-1-0.dll","api-ms-win-crt-time-l1-1-0.dll","RpcRtRemote.dll","wevtapi.dll","msvcr100.dll","clr.dll","fltLib.dll","advapi32.dll","sfc_os.dll","api-ms-win-crt-stdio-l1-1-0.dll","advpack.dll","sqmapi.dll","WSHTCPIP.DLL","nlssorting.dll","msvcrt.dll","sspicli.dll","msctf.dll","cryptbase.dll","clbcatq.dll","mscorwks.dll","msimtf.dll","SMDiagnostics.ni.dll","shlwapi.dll","version.dll","api-ms-win-downlevel-advapi32-l1-1-0.dll","api-ms-win-downlevel-user32-l1-1-0.dll","api-ms-win-downlevel-version-l1-1-0.dll","secur32.dll","bcryptprimitives.dll","mshtml.dll","cabinet.dll","devobj.dll","vcruntime140.dll","api-ms-win-core-timezone-l1-1-0.dll","api-ms-win-downlevel-shlwapi-l2-1-0.dll","msasn1.dll","msvcr90.dll","npctrl.dll","ieframe.dll","dnsapi.dll","ncrypt.dll","powrprof.dll","System.Core.ni.dll","msvcp140_clr0400.dll","System.Transactions.ni.dll","diasymreader.dll","comctl32.dll","cryptsp.dll","srvcli.dll","d3d10level9.dll","clrjit.dll","ieproxy.dll","rsaenh.dll","ntshrui.dll","crypt32.dll","oleacc.dll","oleaccrc.dll","ole32.dll","userenv.dll","api-ms-win-downlevel-shlwapi-l1-1-0.dll","api-ms-win-crt-filesystem-l1-1-0.dll","rpcss.dll","FWPUCLNT.DLL","mswsock.dll","normaliz.dll","ntdll.dll","api-ms-win-core-processthreads-l1-1-1.dll","ws2_32.dll","System.ServiceModel.dll","dwmapi.dll","WindowsCodecs.dll","msimg32.dll","mscoreei.dll","jscript9.dll","mscorlib.ni.dll","System.Windows.Forms.dll","wpfgfx_v0400.dll","wininet.dll","wsock32.dll","npmproxy.dll","d2d1.dll","jp2ssv.dll","vm3dum_10.dll","System.Xml.ni.dll","apphelp.dll","AcLayers.dll","feclient.dll","wintrust.dll","vm3dum_loader.dll","kernel32.dll","api-ms-win-downlevel-normaliz-l1-1-0.dll"]},"file_activity":{"dropped_files":[],"extracted_files":[{"name":"6pl671.exe","sha256":"9f5538ee297a404978922c8c4bb2afa0dd904b6aef8458089acfd09bd613ac24","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"6a98218b599feef6ff013813"}]},{"name":"MP5ye33.exe","sha256":"6007d88865cda81bb228728401f7e70c65feb6a6f88445153b7ab27776935c4b","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"6a98218b599feef6ff013813"}]},{"name":"5ip71Yr.exe","sha256":"f8f5e88cdb1ab0d79c6960c5c705fff40e24581f39b4566e5ba83660fd49518e","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"6a98218b599feef6ff013813"}]},{"name":"aR7ev61.exe","sha256":"740e6d2fe75757edfe73ebd1a38afccb8a24de434994bc16c4a6ac854081acce","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"6a98218b599feef6ff013813"}]},{"name":"3Kn814gI.exe","sha256":"bc78bfa4cd442d895d0d86c191235e03d637f55f33805a4a43fd3a4c3205013d","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"6a98218b599feef6ff013813"}]},{"name":"4NU6qK7.exe","sha256":"3e191adab4ea25b8d83ea6f80029b25af43fb234c5689f6fd01db91926e60822","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"6a98218b599feef6ff013813"}]},{"name":"index-Es9wMzhK_1_.js","sha256":"7b492c0d9bebad18af6fee6ec2728ab9c1b4f798d60c170755a6dc8fb00b5fd2","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a98218b599feef6ff013813"}]},{"name":"s82PjsnlZP2IQAEG095i0Yxgo-3469oiGT9DWDYPz6DhfgQe914iiBfD-GevAmvU9KONMKn3YhINqU49pVNahkCkeiF2w9Hlit1WpaE_brMCJG_1_.css","sha256":"3718eb3d101cbde59ca668da46cabfe683e31b0d7476ced66cd0ce71ab53aaa4","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a98218b599feef6ff013813"}]},{"name":"identifier_2_.htm","sha256":"901351bccd76270620730173d66b61268e4664b085faae5bd9c862b31b1a4ec9","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a98218b599feef6ff013813"}]},{"name":"identifier_1_.htm","sha256":"6cd14790ceeb7ff4003bf270d61dcc7715050a7822b51516b66865eafe5a3d8d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a98218b599feef6ff013813"}]},{"name":"login_1_.htm","sha256":"5aeb1c97dd5d490dc7539c58e09b9a0934363b81793f29b539bf5612d9652d24","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a98218b599feef6ff013813"}]},{"name":"api_1_.js","sha256":"521b9ca61b59188d42990a32c6bf26fd69ff9de319601ccb1475bcf5085c04a3","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a98218b599feef6ff013813"}]},{"name":"JX42Y9GD.htm","sha256":"256877e6dd00e1010e8a9d6d90716166218a975cac04997248719c5cc14c2a13","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a98218b599feef6ff013813"}]},{"name":"dinosaur_1_.png","sha256":"1a9251dc3b3c064cfc5e2b90b6c7dc3c225f7017066db2b77e49dae90a94a399","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a98218b599feef6ff013813"}]},{"name":"0839ECC4815B5D8D5ED699ED1C20C543","sha256":"ca80aca453d15a5159e13484f9f24cbf4a876c07d2b0ff3d4c7209a40535dda6","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a98218b599feef6ff013813"}]},{"name":"595CD0DCED5F6DE43A9C77C525C44511","sha256":"53860c17a76878ba2b911a12c34a19ab191e3981b35ce1f1c480832f97d73639","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a98218b599feef6ff013813"}]},{"name":"75A092F4522006A97542D6AC4F4E69D2","sha256":"420c01c9c3e381aaf2b28cc2f9ff0bdd3ac09a83a936dec1713894fda9797f40","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a98218b599feef6ff013813"}]},{"name":"9C69E496D546F49A980D7350EC49A180","sha256":"0e5fe0deb5b4892b17117537ef8c222833be21fde9b172fb1ed1542e8ef47f23","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a98218b599feef6ff013813"}]}],"files_written":[{"path":"%TEMP%\\IXP000.TMP\\TMP4351$.TMP","sources":[{"report_type":"sandbox","report_id":"6a98218b599feef6ff013813"}]},{"path":"%TEMP%\\IXP000.TMP\\MP5ye33.exe","sources":[{"report_type":"sandbox","report_id":"6a98218b599feef6ff013813"}]},{"path":"%TEMP%\\IXP000.TMP\\6pl671.exe","sources":[{"report_type":"sandbox","report_id":"6a98218b599feef6ff013813"}]},{"path":"%TEMP%\\IXP001.TMP\\TMP4351$.TMP","sources":[{"report_type":"sandbox","report_id":"6a98218b599feef6ff013813"}]},{"path":"%TEMP%\\IXP001.TMP\\aR7ev61.exe","sources":[{"report_type":"sandbox","report_id":"6a98218b599feef6ff013813"}]},{"path":"%TEMP%\\IXP001.TMP\\5ip71Yr.exe","sources":[{"report_type":"sandbox","report_id":"6a98218b599feef6ff013813"}]},{"path":"%TEMP%\\IXP002.TMP\\TMP4351$.TMP","sources":[{"report_type":"sandbox","report_id":"6a98218b599feef6ff013813"}]},{"path":"%TEMP%\\IXP002.TMP\\3Kn814gI.exe","sources":[{"report_type":"sandbox","report_id":"6a98218b599feef6ff013813"}]},{"path":"%TEMP%\\IXP002.TMP\\4NU6qK7.exe","sources":[{"report_type":"sandbox","report_id":"6a98218b599feef6ff013813"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\RUNONCE\\","sources":[{"report_type":"sandbox","report_id":"6a98218b599feef6ff013813"}]}],"keys_modified":null,"keys_deleted":[{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\RUNONCE\\WEXTRACT_CLEANUP0\\WEXTRACT_CLEANUP0","sources":[{"report_type":"sandbox","report_id":"6a98218b599feef6ff013813"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\RUNONCE\\WEXTRACT_CLEANUP1\\WEXTRACT_CLEANUP1","sources":[{"report_type":"sandbox","report_id":"6a98218b599feef6ff013813"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\RUNONCE\\WEXTRACT_CLEANUP2\\WEXTRACT_CLEANUP2","sources":[{"report_type":"sandbox","report_id":"6a98218b599feef6ff013813"}]}]},"mutex_activity":{"mutex_created":[{"name":"\\Sessions\\1\\BaseNamedObjects\\UpdatingNewTabPageData","sources":[{"report_type":"sandbox","report_id":"6a98218b599feef6ff013813"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\!BrowserEmulation!SharedMemory!Mutex","sources":[{"report_type":"sandbox","report_id":"6a98218b599feef6ff013813"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\VERMGMTBlockListFileMutex","sources":[{"report_type":"sandbox","report_id":"6a98218b599feef6ff013813"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\URLBLOCK_FILEMAPSWITCH_MUTEX_5788","sources":[{"report_type":"sandbox","report_id":"6a98218b599feef6ff013813"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\URLBLOCK_HASHFILESWITCH_MUTEX","sources":[{"report_type":"sandbox","report_id":"6a98218b599feef6ff013813"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\URLBLOCK_DOWNLOAD_MUTEX","sources":[{"report_type":"sandbox","report_id":"6a98218b599feef6ff013813"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"6a98218b599feef6ff013813"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"6a98218b599feef6ff013813"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\IsoScope_169c_IE_EarlyTabStart_0x16f4_Mutex","sources":[{"report_type":"sandbox","report_id":"6a98218b599feef6ff013813"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\IsoScope_169c_ConnHashTable<5788>_HashTable_Mutex","sources":[{"report_type":"sandbox","report_id":"6a98218b599feef6ff013813"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\{5312EE61-79E3-4A24-BFE1-132B85B23C3A}","sources":[{"report_type":"sandbox","report_id":"6a98218b599feef6ff013813"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\IsoScope_169c_IESQMMUTEX_0_303","sources":[{"report_type":"sandbox","report_id":"6a98218b599feef6ff013813"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\IsoScope_169c_IESQMMUTEX_0_331","sources":[{"report_type":"sandbox","report_id":"6a98218b599feef6ff013813"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\{66D0969A-1E86-44CF-B4EC-3806DDDA3B5D}","sources":[{"report_type":"sandbox","report_id":"6a98218b599feef6ff013813"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\IsoScope_169c_IESQMMUTEX_0_519","sources":[{"report_type":"sandbox","report_id":"6a98218b599feef6ff013813"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\IsoScope_169c_IESQMMUTEX_0_274","sources":[{"report_type":"sandbox","report_id":"6a98218b599feef6ff013813"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\MSIMGSIZECacheMutex","sources":[{"report_type":"sandbox","report_id":"6a98218b599feef6ff013813"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\_!SHMSFTHISTORY!_","sources":[{"report_type":"sandbox","report_id":"6a98218b599feef6ff013813"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\https://www.epicgames.com/","sources":[{"report_type":"sandbox","report_id":"6a98218b599feef6ff013813"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\InternetExplorerDOMStoreQuota","sources":[{"report_type":"sandbox","report_id":"6a98218b599feef6ff013813"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\IsoScope_169c_IESQMMUTEX_0_506","sources":[{"report_type":"sandbox","report_id":"6a98218b599feef6ff013813"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Global\\CLR_PerfMon_WrapMutex","sources":[{"report_type":"sandbox","report_id":"6a98218b599feef6ff013813"}]}]}},"report_ids":{"sandbox_job_ids":["6a98218b599feef6ff013813"]}}}]]}] 20:null 24:[["$","title","0",{"children":"Malicious Crifi.Generic Sample 7ef834fc890f… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample 7ef834fc890f…. Malware family: Crifi.Generic. Threat score 100/100. 13/25 AV engines flagged this file. 13 malicious and 16 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/7ef834fc890f8f801316f859915cba63a0771e89738a882bca0656fda5a74ddf"}],["$","meta","4",{"property":"og:title","content":"Malicious Crifi.Generic Sample 7ef834fc890f… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample 7ef834fc890f…. Malware family: Crifi.Generic. Threat score 100/100. 13/25 AV engines flagged this file. 13 malicious and 16 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/7ef834fc890f8f801316f859915cba63a0771e89738a882bca0656fda5a74ddf"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Crifi.Generic Sample 7ef834fc890f… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample 7ef834fc890f…. Malware family: Crifi.Generic. Threat score 100/100. 13/25 AV engines flagged this file. 13 malicious and 16 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L6a","11",{}]]